- Linux-stable-mirror - lists.linaro.org

patch "mei: don't update offset in write" added to char-misc-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled mei: don't update offset in write to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From a103af1b64d74853a5e08ca6c86aeb0e5c6ca4f1 Mon Sep 17 00:00:00 2001 From: Alexander Usyskin <alexander.usyskin(a)intel.com> Date: Mon, 9 Jul 2018 12:21:44 +0300 Subject: mei: don't update offset in write MEI enables writes of complete messages only while read can be performed in parts, hence write should not update the file offset to not break interleaving partial reads with writes. Cc: <stable(a)vger.kernel.org> Signed-off-by: Alexander Usyskin <alexander.usyskin(a)intel.com> Signed-off-by: Tomas Winkler <tomas.winkler(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/misc/mei/main.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c index f690918f7817..302ba7a63bd2 100644 --- a/drivers/misc/mei/main.c +++ b/drivers/misc/mei/main.c @@ -312,7 +312,6 @@ static ssize_t mei_write(struct file *file, const char __user *ubuf, } } - *offset = 0; cb = mei_cl_alloc_cb(cl, length, MEI_FOP_WRITE, file); if (!cb) { rets = -ENOMEM; -- 2.18.0

7 years, 4 months

1
0
0 0

patch "mei: bus: type promotion bug in mei_nfc_if_version()" added to char-misc-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled mei: bus: type promotion bug in mei_nfc_if_version() to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From b40b3e9358fbafff6a4ba0f4b9658f6617146f9c Mon Sep 17 00:00:00 2001 From: Dan Carpenter <dan.carpenter(a)oracle.com> Date: Wed, 11 Jul 2018 15:29:31 +0300 Subject: mei: bus: type promotion bug in mei_nfc_if_version() We accidentally removed the check for negative returns without considering the issue of type promotion. The "if_version_length" variable is type size_t so if __mei_cl_recv() returns a negative then "bytes_recv" is type promoted to a high positive value and treated as success. Cc: <stable(a)vger.kernel.org> Fixes: 582ab27a063a ("mei: bus: fix received data size check in NFC fixup") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Signed-off-by: Tomas Winkler <tomas.winkler(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/misc/mei/bus-fixup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c index e45fe826d87d..65e28be3c8cc 100644 --- a/drivers/misc/mei/bus-fixup.c +++ b/drivers/misc/mei/bus-fixup.c @@ -341,7 +341,7 @@ static int mei_nfc_if_version(struct mei_cl *cl, ret = 0; bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length, 0, 0); - if (bytes_recv < if_version_length) { + if (bytes_recv < 0 || bytes_recv < if_version_length) { dev_err(bus->dev, "Could not read IF version\n"); ret = -EIO; goto err; -- 2.18.0

7 years, 4 months

1
0
0 0

[PATCHv2 1/2] libnvdimm: Use max contiguous area for namespace size

by Keith Busch

This patch will find the max contiguous area to determine the largest namespace size that can be created. If the requested size exceeds the largest available, ENOSPC error will be returned. This fixes the allocation underrun error and wrong error return code that have otherwise been observed as the following kernel warning: WARNING: CPU: <CPU> PID: <PID> at drivers/nvdimm/namespace_devs.c:913 size_store Fixes: a1f3e4d6a0c3 ("libnvdimm, region: update nd_region_available_dpa() for multi-pmem support") Cc: <stable(a)vger.kernel.org> Signed-off-by: Keith Busch <keith.busch(a)intel.com> --- v1 -> v2: Updated changelog to indicate the warning this patch fixes and copy stable. Fixed code comments with the correct name of a function drivers/nvdimm/dimm_devs.c | 29 +++++++++++++++++++++++++++++ drivers/nvdimm/namespace_devs.c | 2 +- drivers/nvdimm/nd-core.h | 3 +++ drivers/nvdimm/region_devs.c | 23 +++++++++++++++++++++++ 4 files changed, 56 insertions(+), 1 deletion(-) diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c index 8d348b22ba45..791a93cd8eb1 100644 --- a/drivers/nvdimm/dimm_devs.c +++ b/drivers/nvdimm/dimm_devs.c @@ -536,6 +536,35 @@ resource_size_t nd_blk_available_dpa(struct nd_region *nd_region) return info.available; } +/** + * nd_pmem_max_contiguous_dpa - For the given dimm+region, return the max + * contiguous unallocated dpa range. + * @nd_region: constrain available space check to this reference region + * @nd_mapping: container of dpa-resource-root + labels + */ +resource_size_t nd_pmem_max_contiguous_dpa(struct nd_region *nd_region, + struct nd_mapping *nd_mapping) +{ + struct nvdimm_drvdata *ndd = to_ndd(nd_mapping); + resource_size_t start, end, max = 0; + struct resource *res; + + if (!ndd) + return 0; + + start = nd_mapping->start; + end = start + nd_mapping->size; + + for_each_dpa_resource(ndd, res) { + if ((res->start - start) > max) + max = res->start - start; + start = res->start + resource_size(res); + } + if (start < end && end - start > max) + max = end - start; + return max; +} + /** * nd_pmem_available_dpa - for the given dimm+region account unallocated dpa * @nd_mapping: container of dpa-resource-root + labels diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c index 28afdd668905..c00d1d2d48f9 100644 --- a/drivers/nvdimm/namespace_devs.c +++ b/drivers/nvdimm/namespace_devs.c @@ -1032,7 +1032,7 @@ static ssize_t __size_store(struct device *dev, unsigned long long val) allocated += nvdimm_allocated_dpa(ndd, &label_id); } - available = nd_region_available_dpa(nd_region); + available = nd_region_contiguous_max(nd_region); if (val > available + allocated) return -ENOSPC; diff --git a/drivers/nvdimm/nd-core.h b/drivers/nvdimm/nd-core.h index 79274ead54fb..8e4acd075b0f 100644 --- a/drivers/nvdimm/nd-core.h +++ b/drivers/nvdimm/nd-core.h @@ -100,6 +100,9 @@ struct nd_region; struct nvdimm_drvdata; struct nd_mapping; void nd_mapping_free_labels(struct nd_mapping *nd_mapping); +resource_size_t nd_pmem_max_contiguous_dpa(struct nd_region *nd_region, + struct nd_mapping *nd_mapping); +resource_size_t nd_region_contiguous_max(struct nd_region *nd_region); resource_size_t nd_pmem_available_dpa(struct nd_region *nd_region, struct nd_mapping *nd_mapping, resource_size_t *overlap); resource_size_t nd_blk_available_dpa(struct nd_region *nd_region); diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c index ec3543b83330..8af483d7ef57 100644 --- a/drivers/nvdimm/region_devs.c +++ b/drivers/nvdimm/region_devs.c @@ -357,6 +357,29 @@ static ssize_t set_cookie_show(struct device *dev, } static DEVICE_ATTR_RO(set_cookie); +resource_size_t nd_region_contiguous_max(struct nd_region *nd_region) +{ + resource_size_t available = 0; + int i; + + WARN_ON(!is_nvdimm_bus_locked(&nd_region->dev)); + for (i = 0; i < nd_region->ndr_mappings; i++) { + struct nd_mapping *nd_mapping = &nd_region->mapping[i]; + struct nvdimm_drvdata *ndd = to_ndd(nd_mapping); + + /* if a dimm is disabled the available capacity is zero */ + if (!ndd) + return 0; + + if (is_memory(&nd_region->dev)) + available += nd_pmem_max_contiguous_dpa(nd_region, + nd_mapping); + else if (is_nd_blk(&nd_region->dev)) + available += nd_blk_available_dpa(nd_region); + } + return available; +} + resource_size_t nd_region_available_dpa(struct nd_region *nd_region) { resource_size_t blk_max_overlap = 0, available, overlap; -- 2.14.3

7 years, 4 months

2
9
0 0

6ed66c3ce095ae65bbc976b5817c318653745736 for 4.14-stable

by Sudip Mukherjee

Hi Greg, I think you have missed 6ed66c3ce095ae65bbc976b5817c318653745736 for the v4.14-stable tree. No backport needed, it will apply cleanly. -- Regards Sudip

7 years, 4 months

3
5
0 0

patch "mei: bus: type promotion bug in mei_nfc_if_version()" added to char-misc-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled mei: bus: type promotion bug in mei_nfc_if_version() to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the char-misc-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From b40b3e9358fbafff6a4ba0f4b9658f6617146f9c Mon Sep 17 00:00:00 2001 From: Dan Carpenter <dan.carpenter(a)oracle.com> Date: Wed, 11 Jul 2018 15:29:31 +0300 Subject: mei: bus: type promotion bug in mei_nfc_if_version() We accidentally removed the check for negative returns without considering the issue of type promotion. The "if_version_length" variable is type size_t so if __mei_cl_recv() returns a negative then "bytes_recv" is type promoted to a high positive value and treated as success. Cc: <stable(a)vger.kernel.org> Fixes: 582ab27a063a ("mei: bus: fix received data size check in NFC fixup") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Signed-off-by: Tomas Winkler <tomas.winkler(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/misc/mei/bus-fixup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c index e45fe826d87d..65e28be3c8cc 100644 --- a/drivers/misc/mei/bus-fixup.c +++ b/drivers/misc/mei/bus-fixup.c @@ -341,7 +341,7 @@ static int mei_nfc_if_version(struct mei_cl *cl, ret = 0; bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length, 0, 0); - if (bytes_recv < if_version_length) { + if (bytes_recv < 0 || bytes_recv < if_version_length) { dev_err(bus->dev, "Could not read IF version\n"); ret = -EIO; goto err; -- 2.18.0

7 years, 4 months

1
0
0 0

patch "mei: don't update offset in write" added to char-misc-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled mei: don't update offset in write to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the char-misc-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From a103af1b64d74853a5e08ca6c86aeb0e5c6ca4f1 Mon Sep 17 00:00:00 2001 From: Alexander Usyskin <alexander.usyskin(a)intel.com> Date: Mon, 9 Jul 2018 12:21:44 +0300 Subject: mei: don't update offset in write MEI enables writes of complete messages only while read can be performed in parts, hence write should not update the file offset to not break interleaving partial reads with writes. Cc: <stable(a)vger.kernel.org> Signed-off-by: Alexander Usyskin <alexander.usyskin(a)intel.com> Signed-off-by: Tomas Winkler <tomas.winkler(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/misc/mei/main.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c index f690918f7817..302ba7a63bd2 100644 --- a/drivers/misc/mei/main.c +++ b/drivers/misc/mei/main.c @@ -312,7 +312,6 @@ static ssize_t mei_write(struct file *file, const char __user *ubuf, } } - *offset = 0; cb = mei_cl_alloc_cb(cl, length, MEI_FOP_WRITE, file); if (!cb) { rets = -ENOMEM; -- 2.18.0

7 years, 4 months

1
0
0 0

Re: bpf commits for stable

by Greg KH

On Thu, Jul 12, 2018 at 10:33:24AM +0200, Daniel Borkmann wrote: > Hi Greg, > > if you have a chance, please queue the following BPF patches for -stable: Always cc: stable@vger for stable stuff, as I'm not the only stable tree out there... > > - 4.17.y: > > 3a38bb98d9ab ("bpf/tracing: fix a deadlock in perf_event_detach_bpf_prog") This is already in 4.17. > c93552c443eb ("bpf: properly enforce index mask to prevent out-of-bounds speculation") So is this. > 58990d1ff3f7 ("bpf: reject passing modified ctx to helper functions") Now applied. > b16558579576 ("bpf: implement dummy fops for bpf objects") Does not apply at all :( > 7d1982b4e335 ("bpf: fix panic in prog load calls cleanup") Does not apply :( > ed2b82c03dc1 ("bpf: hash map: decrement counter on error") This is not in Linus's tree. > - 4.14.y: > > c93552c443eb ("bpf: properly enforce index mask to prevent out-of-bounds speculation") Doesn't apply to 4.14.y :( > b16558579576 ("bpf: implement dummy fops for bpf objects") Does not apply at all. > ed2b82c03dc1 ("bpf: hash map: decrement counter on error") Not in Linus's tree. Can you send me the needed backports? thanks, greg k-h

7 years, 4 months

2
1
0 0

63039c29f7a4ce8a8bd165173840543c0098d7b0 for 4.14-stable

by Sudip Mukherjee

Hi Greg, Please apply the attached backported patch to 4.14-stable tree. Backported by changing the argument. -- Regards Sudip

7 years, 4 months

2
1
0 0

[PATCH 4.9 000/310] 4.9.94-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.9.94 release. There are 310 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri Apr 13 18:35:00 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.94-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.9.94-rc1 David Ahern <dsahern(a)gmail.com> vrf: Fix use after free and double free in vrf_finish_output Craig Dillabaugh <cdillaba(a)mojatatu.com> net sched actions: fix dumping which requires several messages to user space Dave Watson <davejwatson(a)fb.com> strparser: Fix sign of err codes Moshe Shemesh <moshe(a)mellanox.com> net/mlx4_core: Fix memory leak while delete slave's resources Jason Wang <jasowang(a)redhat.com> vhost_net: add missing lock nesting notation Xin Long <lucien.xin(a)gmail.com> team: move dev_mc_sync after master_upper_dev_link in team_port_add Xin Long <lucien.xin(a)gmail.com> route: check sysctl_fib_multipath_use_neigh earlier than hash Jason Wang <jasowang(a)redhat.com> vhost: validate log when IOTLB is enabled Eran Ben Elisha <eranbe(a)mellanox.com> net/mlx4_en: Fix mixed PFC and Global pause user control requests Davide Caratti <dcaratti(a)redhat.com> net/sched: fix NULL dereference on the error path of tcf_skbmod_init() Davide Caratti <dcaratti(a)redhat.com> net/sched: fix NULL dereference in the error path of tunnel_key_init() Shahar Klein <shahark(a)mellanox.com> net/mlx5e: Sync netdev vxlan ports at open Eric Dumazet <edumazet(a)google.com> vti6: better validate user provided tunnel names Eric Dumazet <edumazet(a)google.com> ip6_tunnel: better validate user provided tunnel names Eric Dumazet <edumazet(a)google.com> ip6_gre: better validate user provided tunnel names Eric Dumazet <edumazet(a)google.com> ipv6: sit: better validate user provided tunnel names Eric Dumazet <edumazet(a)google.com> ip_tunnel: better validate user provided tunnel names Eric Dumazet <edumazet(a)google.com> net: fool proof dev_valid_name() Xin Long <lucien.xin(a)gmail.com> bonding: process the err returned by dev_set_allmulti properly in bond_enslave Xin Long <lucien.xin(a)gmail.com> bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave Xin Long <lucien.xin(a)gmail.com> bonding: fix the err path for dev hwaddr sync in bond_enslave Hangbin Liu <liuhangbin(a)gmail.com> vlan: also check phy_driver ts_info for vlan's real device Jason Wang <jasowang(a)redhat.com> vhost: correctly remove wait queue during poll failure Kai-Heng Feng <kai.heng.feng(a)canonical.com> sky2: Increase D3 delay to sky2 stops working after suspend Eric Dumazet <edumazet(a)google.com> sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6 Eric Dumazet <edumazet(a)google.com> sctp: do not leak kernel memory to user space Heiner Kallweit <hkallweit1(a)gmail.com> r8169: fix setting driver_data after register_netdev Eric Dumazet <edumazet(a)google.com> pptp: remove a buggy dst release in pptp_connect() Davide Caratti <dcaratti(a)redhat.com> net/sched: fix NULL dereference in the error path of tcf_bpf_init() Alexander Potapenko <glider(a)google.com> netlink: make sure nladdr has correct size in netlink_connect() Jeff Barnhill <0xeffeff(a)gmail.com> net/ipv6: Increment OUTxxx counters after netfilter hook David Ahern <dsahern(a)gmail.com> net/ipv6: Fix route leaking between VRFs Eric Dumazet <edumazet(a)google.com> net: fix possible out-of-bound read in skb_network_protocol() Paolo Abeni <pabeni(a)redhat.com> ipv6: the entire IPv6 header chain must fit the first fragment Miguel Fadon Perlines <mfadon(a)teldat.com> arp: fix arp_filter on l3slave devices Alexandre Belloni <alexandre.belloni(a)free-electrons.com> clk: at91: fix clk-generated compilation Theodore Ts'o <tytso(a)mit.edu> random: use lockless method of accessing and updating f->reg_idx Nathan Chancellor <natechancellor(a)gmail.com> virtio_net: check return value of skb_to_sgvec in one more location Jason A. Donenfeld <Jason(a)zx2c4.com> virtio_net: check return value of skb_to_sgvec always Jason A. Donenfeld <Jason(a)zx2c4.com> rxrpc: check return value of skb_to_sgvec always Jason A. Donenfeld <Jason(a)zx2c4.com> ipsec: check return value of skb_to_sgvec always Jiri Olsa <jolsa(a)kernel.org> perf tools: Fix copyfile_offset update of output offset Miquel Raynal <miquel.raynal(a)free-electrons.com> mtd: mtd_oobtest: Handle bitflips during reads Hans de Goede <hdegoede(a)redhat.com> Input: goodix - disable IRQs while suspended Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> sdhci: Advertise 2.0v supply on SDIO host controller Arjun Vynipadath <arjun(a)chelsio.com> cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> EDAC, mv64x60: Fix an error handling path Tony Lindgren <tony(a)atomide.com> tty: n_gsm: Allow ADM response in addition to UA for control dlci Ming Lei <ming.lei(a)redhat.com> blk-mq: fix kernel oops in blk_mq_tag_idle() chenxiang <chenxiang66(a)hisilicon.com> scsi: libsas: initialize sas_phy status according to response of DISCOVER Jason Yan <yanaijie(a)huawei.com> scsi: libsas: fix error when getting phy events Jason Yan <yanaijie(a)huawei.com> scsi: libsas: fix memory leak in sas_smp_get_phy_events() Tang Junhui <tang.junhui(a)zte.com.cn> bcache: segregate flash only volume write streams Tang Junhui <tang.junhui(a)zte.com.cn> bcache: stop writeback thread after detaching Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> drm/vc4: Fix resource leak in 'vc4_get_hang_state_ioctl()' in error handling path Mickaël Salaün <mic(a)digikod.net> selftests: kselftest_harness: Fix compile warning Karicheri, Muralidharan <m-karicheri2(a)ti.com> hsr: fix incorrect warning Roopa Prabhu <roopa(a)cumulusnetworks.com> vxlan: dont migrate permanent fdb entries during learn Stefan Haberland <sth(a)linux.vnet.ibm.com> s390/dasd: fix hanging safe offline Bob Moore <robert.moore(a)intel.com> ACPICA: Disassembler: Abort on an invalid/unknown AML opcode Lv Zheng <lv.zheng(a)intel.com> ACPICA: Events: Add runtime stub support for event APIs Lv Zheng <lv.zheng(a)intel.com> ACPICA: OSL: Add support to exclude stdarg.h Christophe Jaillet <christophe.jaillet(a)wanadoo.fr> cpuidle: dt: Add missing 'of_node_put()' Marcel Holtmann <marcel(a)holtmann.org> Bluetooth: Send HCI Set Event Mask Page 2 command only when needed Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> clk: meson: meson8b: add compatibles for Meson8 and Meson8m2 Netanel Belgazal <netanel(a)amazon.com> net: ena: disable admin msix while working in polling mode Netanel Belgazal <netanel(a)amazon.com> net: ena: add missing unmap bars on device removal Netanel Belgazal <netanel(a)amazon.com> net: ena: add missing return when ena_com_get_io_handlers() fails Netanel Belgazal <netanel(a)amazon.com> net: ena: fix race condition between submit and completion admin command Netanel Belgazal <netanel(a)amazon.com> net: ena: fix rare uncompleted admin command false alarm Lorenzo Bianconi <lorenzo.bianconi83(a)gmail.com> iio: magnetometer: st_magn_spi: fix spi_device_id table Jag Raman <jag.raman(a)oracle.com> sparc64: ldc abort during vds iso boot Fabio Estevam <fabio.estevam(a)nxp.com> net: fec: Add a fec_enet_clear_ethtool_stats() stub for CONFIG_M5272 Xin Long <lucien.xin(a)gmail.com> sctp: fix recursive locking warning in sctp_do_peeloff Mintz, Yuval <Yuval.Mintz(a)cavium.com> bnx2x: Allow vfs to disable txvlan offload Tero Kristo <t-kristo(a)ti.com> crypto: omap-sham - fix closing of hash with separate finalize call Tero Kristo <t-kristo(a)ti.com> crypto: omap-sham - buffer handling fixes for hashing later Girish Moodalbail <girish.moodalbail(a)oracle.com> geneve: add missing rx stats accounting Mario Molitor <mario_molitor(a)web.de> stmmac: fix ptp header for GMAC3 hw timestamp Robin Murphy <robin.murphy(a)arm.com> coresight: tmc: Configure DMA mask appropriately Suzuki K Poulose <suzuki.poulose(a)arm.com> coresight: Fix reference count for software sources Heiner Kallweit <hkallweit1(a)gmail.com> pinctrl: meson-gxbb: remove non-existing pin GPIOX_22 Dan Carpenter <dan.carpenter(a)oracle.com> X.509: Fix error code in x509_cert_parse() Arnd Bergmann <arnd(a)arndb.de> xen: avoid type warning in xchg_xen_ulong Willem de Bruijn <willemb(a)google.com> skbuff: only inherit relevant tx_flags Namhyung Kim <namhyung(a)kernel.org> perf tests: Decompress kernel module before objdump Namhyung Kim <namhyung(a)kernel.org> perf tools: Decompress kernel module when reading DSO data Christian Lamparter <chunkeey(a)googlemail.com> net: emac: fix reset timeout with AR8035 phy James Wang <jnwang(a)suse.com> Fix loop device flush before configure v3 Geert Uytterhoeven <geert+renesas(a)glider.be> ARM: dts: armadillo800eva: Split LCD mux and gpio Marcin Nowakowski <marcin.nowakowski(a)imgtec.com> MIPS: kprobes: flush_insn_slot should flush only if probe initialised Marcin Nowakowski <marcin.nowakowski(a)imgtec.com> MIPS: mm: adjust PKMAP location Marcin Nowakowski <marcin.nowakowski(a)imgtec.com> MIPS: mm: fixed mappings: correct initialisation Daniel Bristot de Oliveira <bristot(a)redhat.com> sched/deadline: Use the revised wakeup rule for suspending constrained dl tasks Peter Zijlstra <peterz(a)infradead.org> perf/core: Correct event creation with PERF_FORMAT_GROUP Chris Wilson <chris(a)chris-wilson.co.uk> e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails Jim Mattson <jmattson(a)google.com> KVM: nVMX: Update vmcs12->guest_linear_address on nested VM-exit Ming Lei <ming.lei(a)redhat.com> nvme: fix hang in remove path Rakesh Pandit <rakesh(a)tuxera.com> nvme-pci: fix multiple ctrl removal scheduling Leonard Crestez <leonard.crestez(a)nxp.com> ARM: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull Russell King <rmk+kernel(a)armlinux.org.uk> net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support A Sun <as1033x(a)comcast.net> mceusb: sporadic RX truncation corruption fix Pan Bian <bianpan2016(a)163.com> cx25840: fix unchecked return values Dan Carpenter <dan.carpenter(a)oracle.com> cxl: Unlock on error in probe Jacob Keller <jacob.e.keller(a)intel.com> igb: fix race condition with PTP_TX_IN_PROGRESS bits Jacob Keller <jacob.e.keller(a)intel.com> e1000e: fix race condition around skb_tstamp_tx() Christian Lamparter <chunkeey(a)googlemail.com> ARM: dts: qcom: ipq4019: fix i2c_0 node Robert Jarzmik <robert.jarzmik(a)free.fr> tags: honor COMPILED_SOURCE with apart output directory Luca Coelho <luciano.coelho(a)intel.com> iwlwifi: fix min API version for 7265D, 3168, 8000 and 8265 Luca Coelho <luciano.coelho(a)intel.com> iwlwifi: pcie: only use d0i3 in suspend/resume if system_pm is set to d0i3 Johannes Berg <johannes.berg(a)intel.com> iwlwifi: tt: move ucode_loaded check under mutex Haim Dreyfuss <haim.dreyfuss(a)intel.com> iwlwifi: mvm: Fix command queue number on d0i3 flow Maciej S. Szmigiero <mail(a)maciej.szmigiero.name> watchdog: f71808e_wdt: Add F71868 support Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> iwlwifi: mvm: fix firmware debug restart recording Milian Wolff <milian.wolff(a)kdab.com> perf report: Ensure the perf DSO mapping matches what libdw sees Namhyung Kim <namhyung(a)kernel.org> perf header: Set proper module name when build-id event found Ido Shamay <idos(a)mellanox.com> net/mlx4: Check if Granular QoS per VF has been enabled before updating QP qos_vport Talat Batheesh <talatb(a)mellanox.com> net/mlx4: Fix the check in attaching steering rules Haishuang Yan <yanhaishuang(a)cmss.chinamobile.com> sit: reload iphdr in ipip6_rcv Jason A. Donenfeld <Jason(a)zx2c4.com> macsec: check return value of skb_to_sgvec always Jason A. Donenfeld <Jason(a)zx2c4.com> skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow Liam McBirnie <mcbirnie.l(a)gmail.com> ip6_tunnel: fix traffic class routing for tunnels Dmitry Monakhov <dmonakhov(a)openvz.org> bio-integrity: Do not allocate integrity context for bio w/o data Thomas Bogendoerfer <tsbogend(a)alpha.franken.de> Fix serial console on SNI RM400 machines Ganesh Goudar <ganeshgr(a)chelsio.com> cxgb4: fix incorrect cim_la output for T6 Christophe Leroy <christophe.leroy(a)c-s.fr> powerpc/8xx: fix mpc8xx_get_irq() return on no irq Tomi Valkeinen <tomi.valkeinen(a)ti.com> drm/omap: fix tiled buffer stride calculations Steven L. Roberts <robers97(a)gmail.com> RDMA/hfi1: fix array termination by appending NULL to attr array Raju Rangoju <rajur(a)chelsio.com> RDMA/iw_cxgb4: Avoid touch after free error in ARP failure handlers Leonard Crestez <leonard.crestez(a)nxp.com> net: phy: micrel: Restore led_mode and clk_sel on resume Jia-Ju Bai <baijiaju1990(a)163.com> mISDN: Fix a sleep-in-atomic bug Ard Biesheuvel <ard.biesheuvel(a)linaro.org> arm64: kernel: restrict /dev/mem read() calls to linear region Jia-Ju Bai <baijiaju1990(a)163.com> qlcnic: Fix a sleep-in-atomic bug in qlcnic_82xx_hw_write_wx_2M and qlcnic_82xx_hw_read_wx_2M Jiri Olsa <jolsa(a)kernel.org> perf trace: Add mmap alias for s390 Anilkumar Kolli <akolli(a)qti.qualcomm.com> ath10k: add BMI parameters to fix calibration from DT/pre-cal Dan Carpenter <dan.carpenter(a)oracle.com> drm/amdkfd: NULL dereference involving create_process() Michael Ellerman <mpe(a)ellerman.id.au> powerpc/spufs: Fix coredump of SPU contexts Bryan O'Donoghue <pure.logic(a)nexus-software.ie> clk: Fix __set_clk_rates error print-string Sudeep Holla <sudeep.holla(a)arm.com> clk: scpi: fix return type of __scpi_dvfs_round_rate Roman Pen <roman.penyaev(a)profitbricks.com> KVM: SVM: do not zero out segment attributes if segment is unusable or not present Masahiro Yamada <yamada.masahiro(a)socionext.com> mtd: nand: check ecc->total sanity in nand_scan_tail Boris Brezillon <boris.brezillon(a)free-electrons.com> mtd: nand: gpmi: Fix gpmi_nand_init() error path Maxime Ripard <maxime.ripard(a)free-electrons.com> dt-bindings: display: sun4i: Add allwinner,tcon-channel property Maxime Ripard <maxime.ripard(a)free-electrons.com> drm/sun4i: Ignore the generic connectors for components Alexandre Belloni <alexandre.belloni(a)free-electrons.com> clk: at91: fix clk-generated parenting Gustavo A. R. Silva <garsilva(a)embeddedor.com> net: freescale: fix potential null pointer dereference NeilBrown <neilb(a)suse.com> SUNRPC: ensure correct error is reported by xs_tcp_setup_socket() Vaibhav Jain <vaibhav(a)linux.vnet.ibm.com> rtc: interface: Validate alarm-time before handling rollover Vaibhav Jain <vaibhav(a)linux.vnet.ibm.com> rtc: opal: Handle disabled TPO in opal_get_tpo_time() Jesse Brandeburg <jesse.brandeburg(a)intel.com> i40evf: fix merge error in older patch Gary Bisson <gary.bisson(a)boundarydevices.com> rtc: m41t80: fix SQW dividers override when setting a date Arjun Vynipadath <arjun(a)chelsio.com> cxgb4: Fix netdev_features flag Arjun Vynipadath <arjun(a)chelsio.com> cxgb4: FW upgrade fixes Arnd Bergmann <arnd(a)arndb.de> net/mlx5: avoid build warning for uniprocessor Will Deacon <will.deacon(a)arm.com> arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage Sudip Mukherjee <sudipm.mukherjee(a)gmail.com> backlight: Report error on failure Arvind Yadav <arvind.yadav.cs(a)gmail.com> dmaengine: imx-sdma: Handle return value of clk_prepare_enable Ivan Mikhaylov <ivan(a)de.ibm.com> powerpc/[booke|4xx]: Don't clobber TCR[WP] when setting TCR[DIE] Miklos Szeredi <mszeredi(a)redhat.com> ovl: filter trusted xattr for non-admin Hans de Goede <hdegoede(a)redhat.com> HID: i2c: Call acpi_device_fix_up_power for ACPI-enumerated devices Florian Westphal <fw(a)strlen.de> netfilter: conntrack: don't call iter for non-confirmed conntracks Sai Praneeth <sai.praneeth.prakhya(a)intel.com> x86/efi: Disable runtime services on kexec kernel if booted with efi=old_map Firo Yang <firogm(a)gmail.com> hdlcdrv: Fix divide by zero in hdlcdrv_ioctl Colin Ian King <colin.king(a)canonical.com> wl1251: check return from call to wl1251_acx_arp_ip_filter Stanislaw Gruszka <sgruszka(a)redhat.com> rt2x00: do not pause queue unconditionally on error path Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()' Hans de Goede <hdegoede(a)redhat.com> pinctrl: baytrail: Enable glitch filter for GPIOs used as interrupts Robert Jarzmik <robert.jarzmik(a)free.fr> backlight: tdo24m: Fix the SPI CS between transfers Ming Lei <ming.lei(a)redhat.com> blk-mq: fix race between updating nr_hw_queues and switching io sched Mike Marciniszyn <mike.marciniszyn(a)intel.com> IB/rdmavt: Allocate CQ memory on the correct node Linus Walleij <linus.walleij(a)linaro.org> gpio: label descriptors using the device name Pieter \"PoroCYon\" Sluys <pcy(a)national.shitposting.agency> vfb: fix video mode and line_length being set when loaded Peter Große <pegro(a)friiks.de> mac80211: Fix setting TX power on monitor interfaces Geert Uytterhoeven <geert+renesas(a)glider.be> ACPI: EC: Fix debugfs_create_*() usage Shanker Donthineni <shankerd(a)codeaurora.org> irqchip/gic-v3: Fix the driver probe() fail due to disabled GICC entry Chaitra P B <chaitra.basappa(a)broadcom.com> scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag. Rafael David Tinoco <rafael.tinoco(a)canonical.com> scsi: libiscsi: Allow sd_shutdown on bad transport Hans de Goede <hdegoede(a)redhat.com> ASoC: Intel: cht_bsw_rt5645: Analog Mic support Pardha Saradhi K <pardha.saradhi.kesapragada(a)intel.com> ASoC: Intel: Skylake: Disable clock gating during firmware and library download Mauro Carvalho Chehab <mchehab(a)kernel.org> media: videobuf2-core: don't go out of the buffer range Maciej Purski <m.purski(a)samsung.com> hwmon: (ina2xx) Make calibration register value fixed Gustavo A. R. Silva <garsilva(a)embeddedor.com> PM / devfreq: Fix potential NULL pointer dereference in governor_store NeilBrown <neilb(a)suse.com> VFS: close race between getcwd() and d_move() Moni Shoua <monis(a)mellanox.com> net/mlx4_en: Change default QoS settings Hans de Goede <hdegoede(a)redhat.com> ACPI / video: Default lcd_only to true on Win8-ready and newer machines Sowmini Varadhan <sowmini.varadhan(a)oracle.com> rds; Reset rs->rs_bound_addr in rds_add_bound() failure path Hangbin Liu <liuhangbin(a)gmail.com> l2tp: fix missing print session offset info Masami Hiramatsu <mhiramat(a)kernel.org> perf probe: Add warning message if there is unexpected event name Yi Zeng <yizeng(a)asrmicro.com> thermal: power_allocator: fix one race condition issue for thermal_instances list Rasmus Villemoes <rasmus.villemoes(a)prevas.dk> ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node Shiraz Saleem <shiraz.saleem(a)intel.com> i40iw: Correct Q1/XF object count equation Shiraz Saleem <shiraz.saleem(a)intel.com> i40iw: Fix sequence number for the first partial FPDU Jordan Crouse <jcrouse(a)codeaurora.org> drm/msm: Take the mutex before calling msm_gem_new_impl linzhang <xiaolou4617(a)gmail.com> net: llc: add lock_sock in llc_ui_bind to avoid a race condition Jan H. Schönherr <jschoenh(a)amazon.de> KVM: nVMX: Fix handling of lmsw instruction Wanpeng Li <wanpeng.li(a)hotmail.com> KVM: X86: Fix preempt the preemption timer cancel Christoph Hellwig <hch(a)lst.de> PCI/msi: fix the pci_alloc_irq_vectors_affinity stub Thomas Gleixner <tglx(a)linutronix.de> cpuhotplug: Link lock stacks for hotplug callbacks Nithin Sujir <nsujir(a)tintri.com> bonding: Don't update slave->link until ready to commit KT Liao <kt.liao(a)emc.com.tw> Input: elan_i2c - clear INT before resetting controller Roman Kapl <roman.kapl(a)sysgo.com> net: move somaxconn init from sysctl code Eric Dumazet <edumazet(a)google.com> tcp: better validation of received ack sequences Timmy Li <lixiaoping3(a)huawei.com> ARM64: PCI: Fix struct acpi_pci_root_ops allocation failure path Eryu Guan <eguan(a)redhat.com> ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff() Michael Schmitz <schmitzmic(a)gmail.com> fix race in drivers/char/random.c:get_reg() Maurizio Lombardi <mlombard(a)redhat.com> scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats() Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: rsnd: SSI PIO adjust to 24bit mode Dan Carpenter <dan.carpenter(a)oracle.com> pNFS/flexfiles: missing error code in ff_layout_alloc_lseg() Liping Zhang <zlpnobody(a)gmail.com> netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize Milian Wolff <milian.wolff(a)kdab.com> perf report: Fix off-by-one for non-activation frames Dan Carpenter <dan.carpenter(a)oracle.com> libceph: NULL deref on crush_decode() error path Lin Zhang <xiaolou4617(a)gmail.com> net: ieee802154: fix net_device reference release too early Jesper Dangaard Brouer <brouer(a)redhat.com> mlx5: fix bug reading rss_hash_type from CQE Dan Carpenter <dan.carpenter(a)oracle.com> block: fix an error code in add_partition() Stephen Smalley <sds(a)tycho.nsa.gov> selinux: do not check open permission on sockets Tariq Toukan <tariqt(a)mellanox.com> net/mlx5: Tolerate irq_set_affinity_hint() failures Hans de Goede <hdegoede(a)redhat.com> gpio: crystalcove: Do not write regular gpio registers for virtual GPIOs Vlastimil Babka <vbabka(a)suse.cz> sched/numa: Use down_read_trylock() for the mmap_sem Dan Carpenter <dan.carpenter(a)oracle.com> perf/core: Fix error handling in perf_event_alloc() Tin Huynh <tnhuynh(a)apm.com> leds: pca955x: Correct I2C Functionality Holger Brunck <holger.brunck(a)keymile.com> net/wan/fsl_ucc_hdlc: fix muram allocation error Kees Cook <keescook(a)chromium.org> ray_cs: Avoid reading past end of buffer Suman Anna <s-anna(a)ti.com> ARM: davinci: da8xx: Create DSP device only when assigned memory Guoqing Jiang <gqjiang(a)suse.com> md-cluster: fix potential lock issue in add_new_disk Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru> ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors Mikko Koivunen <mikko.koivunen(a)fi.rohmeurope.com> iio: light: rpr0521 poweroff for probe fails Nikita Yushchenko <nikita.yoush(a)cogentembedded.com> iio: hi8435: cleanup reset gpio Nikita Yushchenko <nikita.yoush(a)cogentembedded.com> iio: hi8435: avoid garbage event at first enable Stefan Agner <stefan(a)agner.ch> ASoC: simple-card: fix mic jack initialization Antony Antony <antony(a)phenome.org> xfrm: fix state migration copy replay sequence numbers Michael Ellerman <mpe(a)ellerman.id.au> selftests/powerpc: Fix TM resched DSCR test with some compilers Colin Ian King <colin.king(a)canonical.com> ath5k: fix memory leak on buf on failed eeprom read Michael Ellerman <mpe(a)ellerman.id.au> powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash Varun Prakash <varun(a)chelsio.com> scsi: csiostor: fix use after free in csio_hw_use_fwconfig() Ido Schimmel <idosch(a)mellanox.com> mlxsw: spectrum: Avoid possible NULL pointer dereference Geert Uytterhoeven <geert+renesas(a)glider.be> sh_eth: Use platform device for printing before register_netdev() Holger Brunck <holger.brunck(a)keymile.com> fsl/qe: add bit description for SYNL register for GUMR Holger Brunck <holger.brunck(a)keymile.com> net/wan/fsl_ucc_hdlc: fix incorrect memory allocation Holger Brunck <holger.brunck(a)keymile.com> net/wan/fsl_ucc_hdlc: fix unitialized variable warnings Geert Uytterhoeven <geert+renesas(a)glider.be> serial: sh-sci: Fix race condition causing garbage during shutdown Vignesh R <vigneshr(a)ti.com> serial: 8250: omap: Disable DMA for console UART Alan Stern <stern(a)rowland.harvard.edu> USB: ene_usb6250: fix SCSI residue overwriting linzhang <xiaolou4617(a)gmail.com> net: x25: fix one potential use-after-free issue Alan Stern <stern(a)rowland.harvard.edu> USB: ene_usb6250: fix first command execution Petr Cvek <petr.cvek(a)tul.cz> pxa_camera: fix module remove codepath for v4l2 clock Jisheng Zhang <jszhang(a)marvell.com> usb: chipidea: properly handle host or gadget initialization failure Sugar Zhang <sugar.zhang(a)rock-chips.com> ARM: dts: rockchip: fix rk322x i2s1 pinctrl error Ihar Hrachyshka <ihrachys(a)redhat.com> arp: honour gratuitous ARP _replies_ Ihar Hrachyshka <ihrachys(a)redhat.com> neighbour: update neigh timestamps iff update is effective Suman Anna <s-anna(a)ti.com> uio: fix incorrect memory leak cleanup Thomas Winter <Thomas.Winter(a)alliedtelesis.co.nz> ipmr: vrf: Find VIFs using the actual device Thomas Petazzoni <thomas.petazzoni(a)free-electrons.com> ata: libahci: properly propagate return value of platform_get_irq() Colin Ian King <colin.king(a)canonical.com> btrfs: fix incorrect error return ret being passed to mapping_set_error Pan Bian <bianpan2016(a)163.com> usb: dwc3: keystone: check return value James Morse <james.morse(a)arm.com> KVM: arm64: Restore host physical timer access on hyp_panic() James Morse <james.morse(a)arm.com> KVM: arm: Restore banked registers and physical timer access on hyp_panic() Anup Patel <anup.patel(a)broadcom.com> async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome() Mahesh Bandewar <maheshb(a)google.com> ipv6: avoid dad-failures for addresses with NODAD Julia Lawall <julia.lawall(a)lip6.fr> mdio: mux: fix device_node_continue.cocci warnings Ganapatrao Kulkarni <ganapatrao.kulkarni(a)cavium.com> arm64: perf: Ignore exclude_hv when kernel is running in HYP Peter Rosin <peda(a)axentia.se> i2c: mux: reg: put away the parent i2c adapter on probe failure Fabio Estevam <fabio.estevam(a)nxp.com> ARM: dts: imx6qdl-wandboard: Fix audio channel swap Michael Ellerman <mpe(a)ellerman.id.au> powerpc/modules: If mprofile-kernel is enabled add it to vermagic Peter Zijlstra <peterz(a)infradead.org> x86/tsc: Provide 'tsc=unstable' boot parameter Geert Uytterhoeven <geert+renesas(a)glider.be> clk: renesas: rcar-gen2: Fix PLL0 on R-Car V2H and E2 Andrea della Porta <sfaragnaus(a)gmail.com> staging: wlan-ng: prism2mgmt.c: fixed a double endian conversion before calling hfa384x_drvr_setconfig16, also fixes relative sparse warning Fabio Estevam <fabio.estevam(a)nxp.com> ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin Nicholas Mc Guire <der.herr(a)hofr.at> iio: pressure: zpa2326: report interrupted case as failure Dan Carpenter <dan.carpenter(a)oracle.com> PowerCap: Fix an error code in powercap_register_zone() Doug Berger <opendmb(a)gmail.com> bus: brcmstb_gisb: correct support for 64-bit address output Doug Berger <opendmb(a)gmail.com> bus: brcmstb_gisb: Use register offsets with writes too Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> SMB2: Fix share type handling Reza Arbab <arbab(a)linux.vnet.ibm.com> mm, vmstat: Remove spurious WARN() during zoneinfo print Neil Horman <nhorman(a)tuxdriver.com> vmxnet3: ensure that adapter is in proper state during force_close MaJun <majun258(a)huawei.com> irqchip/mbigen: Fix the clear register offset calculation Paul Mackerras <paulus(a)ozlabs.org> KVM: PPC: Book3S PR: Check copy_to/from_user return values KT Liao <kt.liao(a)emc.com.tw> Input: elantech - force relative mode on a certain module Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - check if device is there before really probing Jon Mason <jon.mason(a)broadcom.com> mdio: mux: Correct mdio_mux_init error path issues Colin Ian King <colin.king(a)canonical.com> netxen_nic: set rcode to the return status from the call to netxen_issue_cmd Stefan Wahren <stefan.wahren(a)i2se.com> net: qca_spi: Fix alignment issues in rx path Wen Xiong <wenxiong(a)linux.vnet.ibm.com> blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split op Will Deacon <will.deacon(a)arm.com> perf/callchain: Force USER_DS when invoking perf_callchain_user() Rabin Vincent <rabinv(a)axis.com> CIFS: silence lockdep splat in cifs_relock_file() Trond Myklebust <trond.myklebust(a)primarydata.com> NFSv4.1: Work around a Linux server bug... Ram Amrani <Ram.Amrani(a)cavium.com> qed: Correct doorbell configuration for !4Kb pages Talat Batheesh <talatb(a)mellanox.com> net/mlx4_en: Avoid adding steering rules with invalid ring Heiko Carstens <heiko.carstens(a)de.ibm.com> s390: move _text symbol to address higher than zero Kirill Tkhai <ktkhai(a)virtuozzo.com> pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid() Dan Carpenter <dan.carpenter(a)oracle.com> drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests J. Bruce Fields <bfields(a)redhat.com> lockd: fix lockd shutdown race Grygorii Strashko <grygorii.strashko(a)ti.com> net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control Jim Baxter <jim_baxter(a)mentor.com> net: cdc_ncm: Fix TX zero padding Dan Carpenter <dan.carpenter(a)oracle.com> ipmi_ssif: unlock on allocation failure Rabin Vincent <rabinv(a)axis.com> ubi: fastmap: Fix slab corruption Kees Cook <keescook(a)chromium.org> qlge: Avoid reading past end of buffer Kees Cook <keescook(a)chromium.org> bna: Avoid reading past end of buffer Luca Coelho <luciano.coelho(a)intel.com> mac80211: bail out from prep_connection() if a reconfig is ongoing Steffen Klassert <steffen.klassert(a)secunet.com> af_key: Fix slab-out-of-bounds in pfkey_compile_policy. Bart Van Assche <bart.vanassche(a)sandisk.com> IB/srpt: Avoid that aborting a command triggers a kernel warning Bart Van Assche <bart.vanassche(a)sandisk.com> IB/srpt: Fix abort handling Kees Cook <keescook(a)chromium.org> x86/boot: Declare error() as noreturn Trond Myklebust <trond.myklebust(a)primarydata.com> NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION Amir Goldstein <amir73il(a)gmail.com> ovl: persistent inode numbers for upper hardlinks Matthias Kaehlcke <mka(a)chromium.org> x86/mm/kaslr: Use the _ASM_MUL macro for multiplication to work around Clang incompatibility Josh Poimboeuf <jpoimboe(a)redhat.com> x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic() Pan Bian <bianpan2016(a)163.com> rtc: snvs: fix an incorrect check of return value Julia Cartwright <julia(a)ni.com> md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock Johannes Berg <johannes.berg(a)intel.com> cfg80211: make RATE_INFO_BW_20 the default sudarsana.kalluru(a)cavium.com <sudarsana.kalluru(a)cavium.com> qed: Fix overriding of supported autoneg value. ------------- Diffstat: .../bindings/clock/amlogic,meson8b-clkc.txt | 11 ++- .../bindings/display/sunxi/sun4i-drm.txt | 11 ++- Makefile | 4 +- arch/arm/boot/dts/imx53-qsrb.dts | 2 +- arch/arm/boot/dts/imx6qdl-wandboard.dtsi | 1 + arch/arm/boot/dts/ls1021a.dtsi | 2 +- arch/arm/boot/dts/qcom-ipq4019.dtsi | 4 +- arch/arm/boot/dts/r8a7740-armadillo800eva.dts | 2 + arch/arm/boot/dts/rk322x.dtsi | 6 +- arch/arm/include/asm/xen/events.h | 2 +- arch/arm/kvm/hyp/switch.c | 2 + arch/arm/mach-davinci/devices-da8xx.c | 10 +++ arch/arm/mach-imx/cpu.c | 3 + arch/arm/mach-imx/mxc.h | 6 ++ arch/arm64/include/asm/futex.h | 8 +- arch/arm64/kernel/pci.c | 4 +- arch/arm64/kernel/perf_event.c | 23 +++-- arch/arm64/kvm/hyp/switch.c | 1 + arch/arm64/mm/mmap.c | 19 +++-- arch/mips/include/asm/kprobes.h | 3 +- arch/mips/include/asm/pgtable-32.h | 7 +- arch/mips/mm/pgtable-32.c | 6 +- arch/powerpc/include/asm/module.h | 4 + arch/powerpc/include/asm/page.h | 12 +++ arch/powerpc/kernel/time.c | 14 +++- arch/powerpc/kvm/book3s_pr_papr.c | 34 ++++++-- arch/powerpc/platforms/cell/spufs/coredump.c | 2 + arch/powerpc/sysdev/mpc8xx_pic.c | 2 +- arch/s390/kernel/vmlinux.lds.S | 8 +- arch/sparc/kernel/ldc.c | 7 +- arch/x86/boot/compressed/error.h | 4 +- arch/x86/include/asm/asm.h | 1 + arch/x86/kernel/tsc.c | 2 + arch/x86/kvm/lapic.c | 2 + arch/x86/kvm/svm.c | 24 +++--- arch/x86/kvm/vmx.c | 10 ++- arch/x86/lib/csum-copy_64.S | 12 +-- arch/x86/lib/kaslr.c | 3 +- arch/x86/platform/efi/efi.c | 6 +- block/bio-integrity.c | 3 + block/blk-mq.c | 11 ++- block/partition-generic.c | 4 +- crypto/asymmetric_keys/x509_cert_parser.c | 1 + crypto/async_tx/async_pq.c | 5 +- drivers/acpi/acpi_video.c | 14 +++- drivers/acpi/acpica/evxfevnt.c | 18 ++++ drivers/acpi/acpica/psobject.c | 14 ++++ drivers/acpi/ec.c | 2 +- drivers/acpi/ec_sys.c | 2 +- drivers/acpi/internal.h | 2 +- drivers/ata/libahci_platform.c | 5 +- drivers/block/loop.c | 3 + drivers/bus/brcmstb_gisb.c | 42 +++++----- drivers/char/ipmi/ipmi_ssif.c | 2 + drivers/char/random.c | 10 ++- drivers/clk/at91/clk-generated.c | 4 +- drivers/clk/clk-conf.c | 2 +- drivers/clk/clk-scpi.c | 6 +- drivers/clk/meson/Kconfig | 6 +- drivers/clk/meson/meson8b.c | 5 +- drivers/clk/renesas/clk-rcar-gen2.c | 23 ++++- drivers/cpuidle/dt_idle_states.c | 4 +- drivers/crypto/omap-sham.c | 31 ++++--- drivers/devfreq/devfreq.c | 3 +- drivers/dma/imx-sdma.c | 23 +++-- drivers/edac/mv64x60_edac.c | 2 +- drivers/gpio/gpio-crystalcove.c | 54 ++++++++---- drivers/gpio/gpiolib.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 3 +- drivers/gpu/drm/msm/msm_gem.c | 6 ++ drivers/gpu/drm/omapdrm/omap_gem.c | 4 +- drivers/gpu/drm/sun4i/sun4i_drv.c | 12 +++ drivers/gpu/drm/vc4/vc4_gem.c | 13 +-- drivers/hid/i2c-hid/i2c-hid.c | 13 +++ drivers/hwmon/ina2xx.c | 87 +++++++++++-------- drivers/hwtracing/coresight/coresight-tmc.c | 7 ++ drivers/hwtracing/coresight/coresight.c | 15 +++- drivers/i2c/muxes/i2c-mux-reg.c | 17 ++-- drivers/iio/adc/hi8435.c | 27 ++++-- drivers/iio/light/rpr0521.c | 17 +++- drivers/iio/magnetometer/st_magn_spi.c | 2 - drivers/iio/pressure/zpa2326.c | 18 ++-- drivers/infiniband/hw/cxgb4/cm.c | 6 +- drivers/infiniband/hw/hfi1/sysfs.c | 3 +- drivers/infiniband/hw/i40iw/i40iw_ctrl.c | 6 +- drivers/infiniband/hw/i40iw/i40iw_d.h | 1 + drivers/infiniband/hw/i40iw/i40iw_puda.c | 2 +- drivers/infiniband/sw/rdmavt/cq.c | 10 ++- drivers/infiniband/ulp/srpt/ib_srpt.c | 9 +- drivers/input/mouse/elan_i2c_core.c | 7 ++ drivers/input/mouse/elan_i2c_i2c.c | 9 +- drivers/input/mouse/elantech.c | 11 +++ drivers/input/touchscreen/goodix.c | 8 +- drivers/irqchip/irq-gic-v3.c | 11 +++ drivers/irqchip/irq-mbigen.c | 5 +- drivers/isdn/mISDN/stack.c | 2 +- drivers/leds/leds-pca955x.c | 2 +- drivers/md/bcache/alloc.c | 19 +++-- drivers/md/bcache/super.c | 6 ++ drivers/md/md-cluster.c | 4 +- drivers/md/raid5.c | 17 ++-- drivers/media/i2c/cx25840/cx25840-core.c | 36 ++++---- drivers/media/platform/pxa_camera.c | 14 +++- drivers/media/rc/mceusb.c | 9 +- drivers/media/v4l2-core/videobuf2-core.c | 4 + drivers/misc/cxl/flash.c | 8 +- drivers/misc/vmw_vmci/vmci_queue_pair.c | 10 ++- drivers/mmc/host/sdhci-pci-core.c | 2 + drivers/mmc/host/sdhci.c | 7 ++ drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 10 ++- drivers/mtd/nand/nand_base.c | 5 ++ drivers/mtd/tests/oobtest.c | 21 +++++ drivers/mtd/ubi/fastmap.c | 33 +++++++- drivers/net/bonding/bond_main.c | 84 ++++++++++--------- drivers/net/ethernet/amazon/ena/ena_com.c | 35 ++++---- drivers/net/ethernet/amazon/ena/ena_netdev.c | 17 +++- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 19 ++++- drivers/net/ethernet/brocade/bna/bfa_ioc.c | 2 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 11 +++ drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 32 ++++++- drivers/net/ethernet/chelsio/cxgb4vf/sge.c | 23 +++-- drivers/net/ethernet/freescale/fec_main.c | 4 + drivers/net/ethernet/freescale/fsl_pq_mdio.c | 9 +- drivers/net/ethernet/ibm/emac/core.c | 26 +++++- drivers/net/ethernet/intel/e1000e/netdev.c | 17 +++- .../net/ethernet/intel/i40evf/i40evf_virtchnl.c | 1 + drivers/net/ethernet/intel/igb/igb_ptp.c | 12 ++- drivers/net/ethernet/marvell/sky2.c | 2 +- drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c | 77 ++++++++++------- drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 33 ++++---- drivers/net/ethernet/mellanox/mlx4/en_main.c | 4 +- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 7 ++ drivers/net/ethernet/mellanox/mlx4/mcg.c | 15 +++- drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 1 + drivers/net/ethernet/mellanox/mlx4/qp.c | 19 +++++ .../net/ethernet/mellanox/mlx4/resource_tracker.c | 17 ++-- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 10 +-- drivers/net/ethernet/mellanox/mlx5/core/main.c | 14 +--- .../ethernet/mellanox/mlxsw/spectrum_switchdev.c | 6 +- .../net/ethernet/qlogic/netxen/netxen_nic_ctx.c | 2 +- drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +- drivers/net/ethernet/qlogic/qed/qed_main.c | 6 +- drivers/net/ethernet/qlogic/qed/qed_mcp.h | 1 + drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c | 2 +- drivers/net/ethernet/qlogic/qlge/qlge_dbg.c | 4 +- drivers/net/ethernet/qualcomm/qca_spi.c | 10 ++- drivers/net/ethernet/realtek/r8169.c | 4 +- drivers/net/ethernet/renesas/sh_eth.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 15 +++- drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h | 3 +- drivers/net/ethernet/ti/cpsw.c | 16 ++++ drivers/net/geneve.c | 36 +++++--- drivers/net/hamradio/hdlcdrv.c | 2 + drivers/net/macsec.c | 13 ++- drivers/net/phy/mdio-mux.c | 11 +-- drivers/net/phy/micrel.c | 42 ++++++---- drivers/net/phy/phy.c | 6 ++ drivers/net/ppp/pptp.c | 1 - drivers/net/team/team.c | 12 ++- drivers/net/usb/cdc_ncm.c | 11 ++- drivers/net/virtio_net.c | 16 +++- drivers/net/vmxnet3/vmxnet3_drv.c | 5 ++ drivers/net/vrf.c | 8 +- drivers/net/vxlan.c | 2 +- drivers/net/wan/fsl_ucc_hdlc.c | 18 ++-- drivers/net/wireless/ath/ath10k/bmi.h | 2 + drivers/net/wireless/ath/ath10k/core.c | 16 +++- drivers/net/wireless/ath/ath5k/debug.c | 5 +- drivers/net/wireless/intel/iwlwifi/iwl-7000.c | 4 +- drivers/net/wireless/intel/iwlwifi/iwl-8000.c | 4 +- drivers/net/wireless/intel/iwlwifi/iwl-prph.h | 1 + drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c | 12 +-- drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 6 +- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 32 +++++-- drivers/net/wireless/intel/iwlwifi/mvm/tt.c | 8 +- drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 6 +- drivers/net/wireless/ralink/rt2x00/rt2x00mac.c | 22 +++-- drivers/net/wireless/ray_cs.c | 7 +- drivers/net/wireless/ti/wl1251/main.c | 3 +- drivers/nvme/host/core.c | 4 + drivers/nvme/host/pci.c | 13 ++- drivers/pinctrl/intel/pinctrl-baytrail.c | 6 ++ drivers/pinctrl/meson/pinctrl-meson-gxbb.c | 1 - drivers/powercap/powercap_sys.c | 1 + drivers/rtc/interface.c | 9 +- drivers/rtc/rtc-m41t80.c | 12 +++ drivers/rtc/rtc-opal.c | 10 +++ drivers/rtc/rtc-snvs.c | 2 +- drivers/s390/block/dasd.c | 8 +- drivers/scsi/bnx2fc/bnx2fc.h | 1 + drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 10 ++- drivers/scsi/csiostor/csio_hw.c | 5 +- drivers/scsi/libiscsi.c | 24 +++++- drivers/scsi/libsas/sas_expander.c | 4 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 28 ++++--- drivers/staging/wlan-ng/prism2mgmt.c | 2 +- drivers/thermal/power_allocator.c | 2 + drivers/tty/n_gsm.c | 17 +++- drivers/tty/serial/8250/8250_omap.c | 4 + drivers/tty/serial/sccnxp.c | 15 ++-- drivers/tty/serial/sh-sci.c | 16 +++- drivers/uio/uio.c | 8 +- drivers/usb/chipidea/core.c | 29 +++++-- drivers/usb/dwc3/dwc3-keystone.c | 4 + drivers/usb/storage/ene_ub6250.c | 11 ++- drivers/vhost/net.c | 4 +- drivers/vhost/vhost.c | 17 ++-- drivers/video/backlight/backlight.c | 15 ++-- drivers/video/backlight/corgi_lcd.c | 2 +- drivers/video/backlight/tdo24m.c | 2 +- drivers/video/backlight/tosa_lcd.c | 2 +- drivers/video/fbdev/vfb.c | 17 ++++ drivers/watchdog/Kconfig | 7 +- drivers/watchdog/f71808e_wdt.c | 27 ++++-- fs/btrfs/extent_io.c | 2 +- fs/cifs/file.c | 2 +- fs/cifs/smb2pdu.c | 14 ++-- fs/dcache.c | 23 +++-- fs/ext4/file.c | 2 +- fs/ext4/mballoc.c | 23 +++-- fs/lockd/svc.c | 6 +- fs/nfs/flexfilelayout/flexfilelayout.c | 1 + fs/nfs/nfs4proc.c | 13 ++- fs/nfs/nfs4state.c | 10 ++- fs/overlayfs/dir.c | 3 + fs/overlayfs/inode.c | 12 ++- include/acpi/platform/acgcc.h | 10 +++ include/acpi/platform/acintel.h | 2 + include/linux/mlx4/qp.h | 1 + include/linux/mlx5/device.h | 10 ++- include/linux/pci.h | 6 +- include/linux/sched.h | 1 + include/linux/skbuff.h | 8 +- include/net/cfg80211.h | 2 +- include/net/x25.h | 4 +- include/soc/fsl/qe/qe.h | 4 + kernel/cpu.c | 13 +++ kernel/events/callchain.c | 6 ++ kernel/events/core.c | 19 +++-- kernel/pid.c | 4 +- kernel/sched/core.c | 2 + kernel/sched/deadline.c | 98 +++++++++++++++++++--- kernel/sched/fair.c | 3 +- mm/vmstat.c | 2 - net/8021q/vlan_dev.c | 6 +- net/bluetooth/hci_core.c | 17 +++- net/ceph/osdmap.c | 1 + net/core/dev.c | 4 +- net/core/neighbour.c | 14 +++- net/core/net_namespace.c | 19 +++++ net/core/skbuff.c | 75 +++++++++++------ net/core/sysctl_net_core.c | 2 - net/hsr/hsr_forward.c | 3 +- net/hsr/hsr_framereg.c | 9 +- net/hsr/hsr_framereg.h | 2 +- net/ieee802154/socket.c | 8 +- net/ipv4/ah4.c | 8 +- net/ipv4/arp.c | 18 +++- net/ipv4/esp4.c | 13 +-- net/ipv4/fib_semantics.c | 20 +++-- net/ipv4/ip_tunnel.c | 11 +-- net/ipv4/ipmr.c | 18 +++- net/ipv4/tcp_input.c | 24 +++--- net/ipv6/addrconf.c | 5 +- net/ipv6/ah6.c | 8 +- net/ipv6/esp6.c | 12 ++- net/ipv6/ip6_gre.c | 8 +- net/ipv6/ip6_output.c | 20 +++-- net/ipv6/ip6_tunnel.c | 14 +++- net/ipv6/ip6_vti.c | 7 +- net/ipv6/route.c | 3 + net/ipv6/sit.c | 9 +- net/key/af_key.c | 2 +- net/l2tp/l2tp_netlink.c | 2 + net/llc/af_llc.c | 3 + net/mac80211/cfg.c | 28 ++++++- net/mac80211/driver-ops.h | 3 +- net/mac80211/mlme.c | 4 + net/netfilter/nf_conntrack_core.c | 39 ++++++--- net/netfilter/nf_conntrack_netlink.c | 7 +- net/netlink/af_netlink.c | 3 + net/rds/bind.c | 1 + net/rxrpc/rxkad.c | 19 +++-- net/sched/act_api.c | 4 +- net/sched/act_bpf.c | 12 ++- net/sched/act_skbmod.c | 3 +- net/sched/act_tunnel_key.c | 9 +- net/sctp/ipv6.c | 4 +- net/sctp/socket.c | 17 ++-- net/strparser/strparser.c | 4 +- net/sunrpc/xprtsock.c | 7 +- net/x25/af_x25.c | 24 ++++-- net/x25/sysctl_net_x25.c | 5 +- net/xfrm/xfrm_state.c | 2 + scripts/tags.sh | 1 + security/selinux/hooks.c | 10 ++- sound/soc/generic/simple-card.c | 2 +- sound/soc/intel/atom/sst/sst_stream.c | 2 +- sound/soc/intel/boards/cht_bsw_rt5645.c | 7 ++ sound/soc/intel/skylake/skl-messages.c | 4 + sound/soc/intel/skylake/skl-pcm.c | 4 + sound/soc/sh/rcar/ssi.c | 11 ++- tools/perf/builtin-trace.c | 4 + tools/perf/tests/code-reading.c | 20 ++++- tools/perf/util/dso.c | 16 ++++ tools/perf/util/header.c | 12 ++- tools/perf/util/probe-event.c | 8 ++ tools/perf/util/unwind-libdw.c | 14 +++- tools/perf/util/unwind-libunwind-local.c | 11 +++ tools/perf/util/util.c | 2 +- .../testing/selftests/powerpc/tm/tm-resched-dscr.c | 2 +- tools/testing/selftests/seccomp/seccomp_bpf.c | 2 +- 312 files changed, 2424 insertions(+), 917 deletions(-)

7 years, 4 months

8
314
0 0

[PATCH] fat: Fix memory allocation failure handling of match_strdup()

by OGAWA Hirofumi

In parse_options(), if match_strdup() failed, parse_options() leaves opts->iocharset in unexpected state (i.e. still pointing the freed string). And this can be the cause of double free. To fix, this initialize opts->iocharset always when freeing. Reported-by: syzbot+90b8e10515ae88228a92(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Signed-off-by: OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp> --- fs/fat/inode.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff -puN fs/fat/inode.c~fat-fix-kmalloc-failure fs/fat/inode.c --- linux/fs/fat/inode.c~fat-fix-kmalloc-failure 2018-07-12 12:20:30.388600735 +0900 +++ linux-hirofumi/fs/fat/inode.c 2018-07-12 15:09:48.764070539 +0900 @@ -703,13 +703,21 @@ static void fat_set_state(struct super_b brelse(bh); } +static void fat_reset_iocharset(struct fat_mount_options *opts) +{ + if (opts->iocharset != fat_default_iocharset) { + /* Note: opts->iocharset can be NULL here */ + kfree(opts->iocharset); + opts->iocharset = fat_default_iocharset; + } +} + static void delayed_free(struct rcu_head *p) { struct msdos_sb_info *sbi = container_of(p, struct msdos_sb_info, rcu); unload_nls(sbi->nls_disk); unload_nls(sbi->nls_io); - if (sbi->options.iocharset != fat_default_iocharset) - kfree(sbi->options.iocharset); + fat_reset_iocharset(&sbi->options); kfree(sbi); } @@ -1124,7 +1132,7 @@ static int parse_options(struct super_bl opts->fs_fmask = opts->fs_dmask = current_umask(); opts->allow_utime = -1; opts->codepage = fat_default_codepage; - opts->iocharset = fat_default_iocharset; + fat_reset_iocharset(opts); if (is_vfat) { opts->shortname = VFAT_SFN_DISPLAY_WINNT|VFAT_SFN_CREATE_WIN95; opts->rodir = 0; @@ -1281,8 +1289,7 @@ static int parse_options(struct super_bl /* vfat specific */ case Opt_charset: - if (opts->iocharset != fat_default_iocharset) - kfree(opts->iocharset); + fat_reset_iocharset(opts); iocharset = match_strdup(&args[0]); if (!iocharset) return -ENOMEM; @@ -1873,8 +1880,7 @@ out_fail: iput(fat_inode); unload_nls(sbi->nls_io); unload_nls(sbi->nls_disk); - if (sbi->options.iocharset != fat_default_iocharset) - kfree(sbi->options.iocharset); + fat_reset_iocharset(&sbi->options); sb->s_fs_info = NULL; kfree(sbi); return error; _ -- OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp>

7 years, 4 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror