I'm announcing the release of the 4.9.323 kernel.
All users of the 4.9 kernel series must upgrade.
The updated 4.9.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
drivers/dma/at_xdmac.c | 5 +++++
drivers/dma/ti-dma-crossbar.c | 5 +++++
drivers/i2c/busses/i2c-cadence.c | 1 +
drivers/iommu/dmar.c | 2 +-
drivers/net/can/grcan.c | 1 -
drivers/net/can/usb/gs_usb.c | 23 +++++++++++++++++++++--
drivers/net/usb/usbnet.c | 17 ++++++++++++-----
drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c | 10 +++++-----
fs/xfs/xfs_inode.c | 1 -
include/video/of_display_timing.h | 2 ++
lib/idr.c | 4 +++-
mm/slub.c | 5 +++++
net/rose/rose_route.c | 4 ++--
14 files changed, 63 insertions(+), 19 deletions(-)
Duoming Zhou (1):
net: rose: fix UAF bug caused by rose_t0timer_expiry
Eric Sandeen (1):
xfs: remove incorrect ASSERT in xfs_rename
Greg Kroah-Hartman (1):
Linux 4.9.323
Hsin-Yi Wang (1):
video: of_display_timing.h: include errno.h
Jann Horn (1):
mm/slub: add missing TID updates on slab deactivation
Liang He (1):
can: grcan: grcan_probe(): remove extra of_node_get()
Linus Torvalds (1):
ida: don't use BUG_ON() for debugging
Miaoqian Lin (2):
dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate
dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate
Michael Walle (1):
dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly
Oliver Neukum (1):
usbnet: fix memory leak in error case
Rhett Aultman (1):
can: gs_usb: gs_usb_open/close(): fix memory leak
Samuel Holland (1):
pinctrl: sunxi: a83t: Fix NAND function name for some pins
Satish Nagireddy (1):
i2c: cadence: Unregister the clk notifier in error path
Yian Chen (1):
iommu/vt-d: Fix PCI bus rescan device hot add
This reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac.
As commit 46bbe5c671e0 ("tracing: fix double free") said, the
"double free" problem reported by clang static analyzer is:
> In parse_var_defs() if there is a problem allocating
> var_defs.expr, the earlier var_defs.name is freed.
> This free is duplicated by free_var_defs() which frees
> the rest of the list.
However, if there is a problem allocating N-th var_defs.expr:
+ in parse_var_defs(), the freed 'earlier var_defs.name' is
actually the N-th var_defs.name;
+ then in free_var_defs(), the names from 0th to (N-1)-th are freed;
IF ALLOCATING PROBLEM HAPPENED HERE!!! -+
\
|
0th 1th (N-1)-th N-th V
+-------------+-------------+-----+-------------+-----------
var_defs: | name | expr | name | expr | ... | name | expr | name | ///
+-------------+-------------+-----+-------------+-----------
These two frees don't act on same name, so there was no "double free"
problem before. Conversely, after that commit, we get a "memory leak"
problem because the above "N-th var_defs.name" is not freed.
If enable CONFIG_DEBUG_KMEMLEAK and inject a fault at where the N-th
var_defs.expr allocated, then execute on shell like:
$ echo 'hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc' > \
/sys/kernel/debug/tracing/events/kmem/kmalloc/trigger
Then kmemleak reports:
unreferenced object 0xffff8fb100ef3518 (size 8):
comm "bash", pid 196, jiffies 4295681690 (age 28.538s)
hex dump (first 8 bytes):
76 31 00 00 b1 8f ff ff v1......
backtrace:
[<0000000038fe4895>] kstrdup+0x2d/0x60
[<00000000c99c049a>] event_hist_trigger_parse+0x206f/0x20e0
[<00000000ae70d2cc>] trigger_process_regex+0xc0/0x110
[<0000000066737a4c>] event_trigger_write+0x75/0xd0
[<000000007341e40c>] vfs_write+0xbb/0x2a0
[<0000000087fde4c2>] ksys_write+0x59/0xd0
[<00000000581e9cdf>] do_syscall_64+0x3a/0x80
[<00000000cf3b065c>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
Cc: stable(a)vger.kernel.org
Fixes: 46bbe5c671e0 ("tracing: fix double free")
Reported-by: Hulk Robot <hulkci(a)huawei.com>
Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com>
---
kernel/trace/trace_events_hist.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 48e82e141d54..2784951e0fc8 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -4430,6 +4430,7 @@ static int parse_var_defs(struct hist_trigger_data *hist_data)
s = kstrdup(field_str, GFP_KERNEL);
if (!s) {
+ kfree(hist_data->attrs->var_defs.name[n_vars]);
ret = -ENOMEM;
goto free;
}
--
2.32.0
This is the start of the stable review cycle for the 4.19.252 release.
There are 31 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 13 Jul 2022 09:05:28 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.252-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.252-rc1
Miaoqian Lin <linmq006(a)gmail.com>
dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate
Miaoqian Lin <linmq006(a)gmail.com>
dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate
Michael Walle <michael(a)walle.cc>
dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
dmaengine: pl330: Fix lockdep warning about non-static key
Linus Torvalds <torvalds(a)linux-foundation.org>
ida: don't use BUG_ON() for debugging
Shuah Khan <skhan(a)linuxfoundation.org>
misc: rtsx_usb: set return value in rsp_buf alloc err path
Shuah Khan <skhan(a)linuxfoundation.org>
misc: rtsx_usb: use separate command and response buffers
Shuah Khan <skhan(a)linuxfoundation.org>
misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer
Satish Nagireddy <satish.nagireddy(a)getcruise.com>
i2c: cadence: Unregister the clk notifier in error path
Vladimir Oltean <vladimir.oltean(a)nxp.com>
selftests: forwarding: fix error message in learning_test
Vladimir Oltean <vladimir.oltean(a)nxp.com>
selftests: forwarding: fix learning_test when h1 supports IFF_UNICAST_FLT
Vladimir Oltean <vladimir.oltean(a)nxp.com>
selftests: forwarding: fix flood_unicast_test when h2 supports IFF_UNICAST_FLT
Rick Lindsley <ricklind(a)us.ibm.com>
ibmvnic: Properly dispose of all skbs during a failover.
Claudiu Beznea <claudiu.beznea(a)microchip.com>
ARM: at91: pm: use proper compatible for sama5d2's rtc
Samuel Holland <samuel(a)sholland.org>
pinctrl: sunxi: a83t: Fix NAND function name for some pins
Miaoqian Lin <linmq006(a)gmail.com>
ARM: meson: Fix refcount leak in meson_smp_prepare_cpus
Eric Sandeen <sandeen(a)redhat.com>
xfs: remove incorrect ASSERT in xfs_rename
Jimmy Assarsson <extja(a)kvaser.com>
can: kvaser_usb: kvaser_usb_leaf: fix bittiming limits
Jimmy Assarsson <extja(a)kvaser.com>
can: kvaser_usb: kvaser_usb_leaf: fix CAN clock frequency regression
Jimmy Assarsson <extja(a)kvaser.com>
can: kvaser_usb: replace run-time checks with struct kvaser_usb_driver_info
Jason A. Donenfeld <Jason(a)zx2c4.com>
powerpc/powernv: delay rng platform device creation until later in boot
Hsin-Yi Wang <hsinyi(a)chromium.org>
video: of_display_timing.h: include errno.h
Helge Deller <deller(a)gmx.de>
fbcon: Disallow setting font bigger than screen size
Yian Chen <yian.chen(a)intel.com>
iommu/vt-d: Fix PCI bus rescan device hot add
Duoming Zhou <duoming(a)zju.edu.cn>
net: rose: fix UAF bug caused by rose_t0timer_expiry
Oliver Neukum <oneukum(a)suse.com>
usbnet: fix memory leak in error case
Rhett Aultman <rhett.aultman(a)samsara.com>
can: gs_usb: gs_usb_open/close(): fix memory leak
Liang He <windhl(a)126.com>
can: grcan: grcan_probe(): remove extra of_node_get()
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: bcm: use call_rcu() instead of costly synchronize_rcu()
Jann Horn <jannh(a)google.com>
mm/slub: add missing TID updates on slab deactivation
Sabrina Dubroca <sd(a)queasysnail.net>
esp: limit skb_page_frag_refill use to a single page
-------------
Diffstat:
Makefile | 4 +-
arch/arm/mach-at91/pm.c | 2 +-
arch/arm/mach-meson/platsmp.c | 2 +
arch/powerpc/platforms/powernv/rng.c | 16 +-
drivers/dma/at_xdmac.c | 5 +
drivers/dma/pl330.c | 2 +-
drivers/dma/ti/dma-crossbar.c | 5 +
drivers/i2c/busses/i2c-cadence.c | 1 +
drivers/iommu/dmar.c | 2 +-
drivers/misc/cardreader/rtsx_usb.c | 27 ++-
drivers/net/can/grcan.c | 1 -
drivers/net/can/usb/gs_usb.c | 23 +-
drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 25 ++-
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 255 ++++++++++++----------
drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 4 +-
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 119 +++++-----
drivers/net/ethernet/ibm/ibmvnic.c | 9 +
drivers/net/usb/usbnet.c | 17 +-
drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c | 10 +-
drivers/video/fbdev/core/fbcon.c | 5 +
fs/xfs/xfs_inode.c | 1 -
include/linux/rtsx_usb.h | 2 -
include/net/esp.h | 2 -
include/video/of_display_timing.h | 2 +
lib/idr.c | 4 +-
mm/slub.c | 4 +-
net/can/bcm.c | 18 +-
net/ipv4/esp4.c | 5 +-
net/ipv6/esp6.c | 5 +-
net/rose/rose_route.c | 4 +-
tools/testing/selftests/net/forwarding/lib.sh | 6 +-
31 files changed, 357 insertions(+), 230 deletions(-)
This is the start of the stable review cycle for the 5.4.205 release.
There are 38 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 13 Jul 2022 09:05:28 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.205-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.205-rc1
Miaoqian Lin <linmq006(a)gmail.com>
dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate
Miaoqian Lin <linmq006(a)gmail.com>
dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate
Michael Walle <michael(a)walle.cc>
dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
dmaengine: pl330: Fix lockdep warning about non-static key
Linus Torvalds <torvalds(a)linux-foundation.org>
ida: don't use BUG_ON() for debugging
Samuel Holland <samuel(a)sholland.org>
dt-bindings: dma: allwinner,sun50i-a64-dma: Fix min/max typo
Shuah Khan <skhan(a)linuxfoundation.org>
misc: rtsx_usb: set return value in rsp_buf alloc err path
Shuah Khan <skhan(a)linuxfoundation.org>
misc: rtsx_usb: use separate command and response buffers
Shuah Khan <skhan(a)linuxfoundation.org>
misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer
Peter Robinson <pbrobinson(a)gmail.com>
dmaengine: imx-sdma: Allow imx8m for imx7 FW revs
Satish Nagireddy <satish.nagireddy(a)getcruise.com>
i2c: cadence: Unregister the clk notifier in error path
Vladimir Oltean <vladimir.oltean(a)nxp.com>
selftests: forwarding: fix error message in learning_test
Vladimir Oltean <vladimir.oltean(a)nxp.com>
selftests: forwarding: fix learning_test when h1 supports IFF_UNICAST_FLT
Vladimir Oltean <vladimir.oltean(a)nxp.com>
selftests: forwarding: fix flood_unicast_test when h2 supports IFF_UNICAST_FLT
Rick Lindsley <ricklind(a)us.ibm.com>
ibmvnic: Properly dispose of all skbs during a failover.
Claudiu Beznea <claudiu.beznea(a)microchip.com>
ARM: at91: pm: use proper compatibles for sam9x60's rtc and rtt
Claudiu Beznea <claudiu.beznea(a)microchip.com>
ARM: at91: pm: use proper compatible for sama5d2's rtc
Andrei Lalaev <andrey.lalaev(a)gmail.com>
pinctrl: sunxi: sunxi_pconf_set: use correct offset
Samuel Holland <samuel(a)sholland.org>
pinctrl: sunxi: a83t: Fix NAND function name for some pins
Miaoqian Lin <linmq006(a)gmail.com>
ARM: meson: Fix refcount leak in meson_smp_prepare_cpus
Eric Sandeen <sandeen(a)redhat.com>
xfs: remove incorrect ASSERT in xfs_rename
Jimmy Assarsson <extja(a)kvaser.com>
can: kvaser_usb: kvaser_usb_leaf: fix bittiming limits
Jimmy Assarsson <extja(a)kvaser.com>
can: kvaser_usb: kvaser_usb_leaf: fix CAN clock frequency regression
Jimmy Assarsson <extja(a)kvaser.com>
can: kvaser_usb: replace run-time checks with struct kvaser_usb_driver_info
Jason A. Donenfeld <Jason(a)zx2c4.com>
powerpc/powernv: delay rng platform device creation until later in boot
Hsin-Yi Wang <hsinyi(a)chromium.org>
video: of_display_timing.h: include errno.h
Helge Deller <deller(a)gmx.de>
fbcon: Prevent that screen size is smaller than font size
Helge Deller <deller(a)gmx.de>
fbcon: Disallow setting font bigger than screen size
Helge Deller <deller(a)gmx.de>
fbmem: Check virtual screen sizes in fb_set_var()
Guiling Deng <greens9(a)163.com>
fbdev: fbmem: Fix logo center image dx issue
Yian Chen <yian.chen(a)intel.com>
iommu/vt-d: Fix PCI bus rescan device hot add
Duoming Zhou <duoming(a)zju.edu.cn>
net: rose: fix UAF bug caused by rose_t0timer_expiry
Oliver Neukum <oneukum(a)suse.com>
usbnet: fix memory leak in error case
Rhett Aultman <rhett.aultman(a)samsara.com>
can: gs_usb: gs_usb_open/close(): fix memory leak
Liang He <windhl(a)126.com>
can: grcan: grcan_probe(): remove extra of_node_get()
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: bcm: use call_rcu() instead of costly synchronize_rcu()
Jann Horn <jannh(a)google.com>
mm/slub: add missing TID updates on slab deactivation
Sabrina Dubroca <sd(a)queasysnail.net>
esp: limit skb_page_frag_refill use to a single page
-------------
Diffstat:
.../bindings/dma/allwinner,sun50i-a64-dma.yaml | 2 +-
Makefile | 4 +-
arch/arm/mach-at91/pm.c | 6 +-
arch/arm/mach-meson/platsmp.c | 2 +
arch/powerpc/platforms/powernv/rng.c | 16 +-
drivers/dma/at_xdmac.c | 5 +
drivers/dma/imx-sdma.c | 2 +-
drivers/dma/pl330.c | 2 +-
drivers/dma/ti/dma-crossbar.c | 5 +
drivers/i2c/busses/i2c-cadence.c | 1 +
drivers/iommu/dmar.c | 2 +-
drivers/misc/cardreader/rtsx_usb.c | 27 ++-
drivers/net/can/grcan.c | 1 -
drivers/net/can/usb/gs_usb.c | 23 +-
drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 25 +-
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 255 ++++++++++++---------
drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 4 +-
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 119 +++++-----
drivers/net/ethernet/ibm/ibmvnic.c | 9 +
drivers/net/usb/usbnet.c | 17 +-
drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c | 10 +-
drivers/pinctrl/sunxi/pinctrl-sunxi.c | 2 +
drivers/video/fbdev/core/fbcon.c | 33 +++
drivers/video/fbdev/core/fbmem.c | 16 +-
fs/xfs/xfs_inode.c | 1 -
include/linux/fbcon.h | 4 +
include/linux/rtsx_usb.h | 2 -
include/net/esp.h | 2 -
include/video/of_display_timing.h | 2 +
lib/idr.c | 3 +-
mm/slub.c | 4 +-
net/can/bcm.c | 18 +-
net/ipv4/esp4.c | 5 +-
net/ipv6/esp6.c | 5 +-
net/rose/rose_route.c | 4 +-
tools/testing/selftests/net/forwarding/lib.sh | 6 +-
36 files changed, 408 insertions(+), 236 deletions(-)