This is the start of the stable review cycle for the 4.14.287 release.
There are 29 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 07 Jul 2022 11:55:56 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.287-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.287-rc1
Daniele Palmas <dnlplm(a)gmail.com>
net: usb: qmi_wwan: add Telit 0x1070 composition
Carlo Lobrano <c.lobrano(a)gmail.com>
net: usb: qmi_wwan: add Telit 0x1060 composition
Oleksandr Tyshchenko <oleksandr_tyshchenko(a)epam.com>
xen/arm: Fix race in RB-tree based P2M accounting
Roger Pau Monne <roger.pau(a)citrix.com>
xen/blkfront: force data bouncing when backend is untrusted
Roger Pau Monne <roger.pau(a)citrix.com>
xen/netfront: force data bouncing when backend is untrusted
Roger Pau Monne <roger.pau(a)citrix.com>
xen/netfront: fix leaking data in shared pages
Roger Pau Monne <roger.pau(a)citrix.com>
xen/blkfront: fix leaking data in shared pages
Ilya Lesokhin <ilyal(a)mellanox.com>
net: Rename and export copy_skb_header
katrinzhou <katrinzhou(a)tencent.com>
ipv6/sit: fix ipip6_tunnel_get_prl return value
kernel test robot <lkp(a)intel.com>
sit: use min
Doug Berger <opendmb(a)gmail.com>
net: dsa: bcm_sf2: force pause link settings
Yang Yingliang <yangyingliang(a)huawei.com>
hwmon: (ibmaem) don't call platform_device_del() if platform_device_add() fails
Demi Marie Obenour <demi(a)invisiblethingslab.com>
xen/gntdev: Avoid blocking in unmap_grant_pages()
Michael Walle <michael(a)walle.cc>
NFC: nxp-nci: Don't issue a zero length i2c_master_read()
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
nfc: nfcmrvl: Fix irq_of_parse_and_map() return value
Yevhen Orlov <yevhen.orlov(a)plvision.eu>
net: bonding: fix use-after-free after 802.3ad slave unbind
Eric Dumazet <edumazet(a)google.com>
net: bonding: fix possible NULL deref in rlb code
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nft_dynset: restore set element counter when failing to update
Jason Wang <jasowang(a)redhat.com>
caif_virtio: fix race between virtio_device_ready() and ndo_open()
YueHaibing <yuehaibing(a)huawei.com>
net: ipv6: unexport __init-annotated seg6_hmac_net_init()
Oliver Neukum <oneukum(a)suse.com>
usbnet: fix memory allocation in helpers
Kamal Heib <kamalheib1(a)gmail.com>
RDMA/qedr: Fix reporting QP timeout attribute
Jose Alonso <joalonsof(a)gmail.com>
net: usb: ax88179_178a: Fix packet receiving
Duoming Zhou <duoming(a)zju.edu.cn>
net: rose: fix UAF bugs caused by timer handler
Chuck Lever <chuck.lever(a)oracle.com>
SUNRPC: Fix READ_PLUS crasher
Jason A. Donenfeld <Jason(a)zx2c4.com>
s390/archrandom: simplify back to earlier design and initialize earlier
Mikulas Patocka <mpatocka(a)redhat.com>
dm raid: fix KASAN warning in raid5_add_disks
Heinz Mauelshagen <heinzm(a)redhat.com>
dm raid: fix accesses beyond end of raid member array
Chris Ye <chris.ye(a)intel.com>
nvdimm: Fix badblocks clear off-by-one error
-------------
Diffstat:
Makefile | 4 +-
arch/arm/xen/p2m.c | 6 +-
arch/s390/crypto/arch_random.c | 20 +----
arch/s390/include/asm/archrandom.h | 32 ++++----
arch/s390/kernel/setup.c | 5 ++
drivers/block/xen-blkfront.c | 49 ++++++++-----
drivers/hwmon/ibmaem.c | 12 ++-
drivers/infiniband/hw/qedr/qedr.h | 1 +
drivers/infiniband/hw/qedr/verbs.c | 4 +-
drivers/md/dm-raid.c | 34 +++++----
drivers/md/raid5.c | 1 +
drivers/net/bonding/bond_3ad.c | 3 +-
drivers/net/bonding/bond_alb.c | 2 +-
drivers/net/caif/caif_virtio.c | 10 ++-
drivers/net/dsa/bcm_sf2.c | 5 ++
drivers/net/usb/ax88179_178a.c | 101 +++++++++++++++++++-------
drivers/net/usb/qmi_wwan.c | 2 +
drivers/net/usb/usbnet.c | 4 +-
drivers/net/xen-netfront.c | 52 ++++++++++++-
drivers/nfc/nfcmrvl/i2c.c | 6 +-
drivers/nfc/nfcmrvl/spi.c | 6 +-
drivers/nfc/nxp-nci/i2c.c | 3 +
drivers/nvdimm/bus.c | 4 +-
drivers/xen/gntdev.c | 145 ++++++++++++++++++++++++++-----------
include/linux/skbuff.h | 1 +
net/core/skbuff.c | 9 ++-
net/ipv6/seg6_hmac.c | 1 -
net/ipv6/sit.c | 10 +--
net/netfilter/nft_set_hash.c | 2 +
net/rose/rose_timer.c | 34 +++++----
net/sunrpc/xdr.c | 2 +-
31 files changed, 382 insertions(+), 188 deletions(-)
Check that a user-provided thermal state is within the maximum
thermal states supported by a given driver before attempting to
apply it. This prevents a subsequent OOB access in
thermal_cooling_device_stats_update() while performing
state-transition accounting on drivers that do not have this check
in their set_cur_state() handle.
Signed-off-by: Varad Gautam <varadgautam(a)google.com>
Cc: stable(a)vger.kernel.org
---
drivers/thermal/thermal_sysfs.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c
index 1c4aac8464a7..0c6b0223b133 100644
--- a/drivers/thermal/thermal_sysfs.c
+++ b/drivers/thermal/thermal_sysfs.c
@@ -607,7 +607,7 @@ cur_state_store(struct device *dev, struct device_attribute *attr,
const char *buf, size_t count)
{
struct thermal_cooling_device *cdev = to_cooling_device(dev);
- unsigned long state;
+ unsigned long state, max_state;
int result;
if (sscanf(buf, "%ld\n", &state) != 1)
@@ -618,10 +618,20 @@ cur_state_store(struct device *dev, struct device_attribute *attr,
mutex_lock(&cdev->lock);
+ result = cdev->ops->get_max_state(cdev, &max_state);
+ if (result)
+ goto unlock;
+
+ if (state > max_state) {
+ result = -EINVAL;
+ goto unlock;
+ }
+
result = cdev->ops->set_cur_state(cdev, state);
if (!result)
thermal_cooling_device_stats_update(cdev, state);
+unlock:
mutex_unlock(&cdev->lock);
return result ? result : count;
}
--
2.37.0.rc0.161.g10f37bed90-goog