January 2018 - Linux-stable-mirror

[Linux-stable-mirror] [PATCH 3.18 00/52] 3.18.93-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 3.18.93 release. There are 52 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed Jan 31 12:36:07 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.93-rc1.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 3.18.93-rc1 Jim Westfall <jwestfall(a)surrealistic.net> ipv4: Make neigh lookup keys for loopback/point-to-point devices be INADDR_ANY Mike Maloney <maloney(a)google.com> ipv6: fix udpv6 sendmsg crash caused by too small MTU Jim Westfall <jwestfall(a)surrealistic.net> net: Allow neigh contructor functions ability to modify the primary_key Neil Horman <nhorman(a)tuxdriver.com> vmxnet3: repair memory leak Xin Long <lucien.xin(a)gmail.com> sctp: return error if the asoc has been peeled off in sctp_wait_for_sndbuf Xin Long <lucien.xin(a)gmail.com> sctp: do not allow the v4 socket to bind a v4mapped v6 address Guillaume Nault <g.nault(a)alphalink.fr> pppoe: take ->needed_headroom of lower device into account on xmit Eric Dumazet <edumazet(a)google.com> net: qdisc_pkt_len_init() should be more robust Craig Gallek <kraig(a)google.com> tcp: __tcp_hdrlen() helper Felix Fietkau <nbd(a)nbd.name> net: igmp: fix source address check for IGMPv3 reports Alexey Kodanev <alexey.kodanev(a)oracle.com> dccp: don't restart ccid2_hc_tx_rto_expire() if sk in closed state Dan Streetman <ddstreet(a)ieee.org> net: tcp: close sock if net namespace is exiting Jia Zhang <zhang.jia(a)linux.alibaba.com> x86/microcode/intel: Extend BDW late-loading further with LLC size check Richard Weinberger <richard(a)nod.at> um: Remove copy&paste code from init.h Richard Weinberger <richard(a)nod.at> um: Stop abusing __KERNEL__ Greg KH <gregkh(a)linuxfoundation.org> eventpoll.h: add missing epoll event masks Thomas Meyer <thomas(a)m3y3r.de> um: link vmlinux with -no-pie Johannes Thumshirn <jthumshirn(a)suse.de> scsi: libiscsi: fix shifting of DID_REQUEUE host byte Jiri Slaby <jslaby(a)suse.cz> fs/fcntl: f_setown, avoid undefined behaviour Jeff Mahoney <jeffm(a)suse.com> reiserfs: don't preallocate blocks for extended attributes Jeff Mahoney <jeffm(a)suse.com> reiserfs: fix race in prealloc discard Kevin Cernekee <cernekee(a)chromium.org> netfilter: xt_osf: Add missing permission checks Kevin Cernekee <cernekee(a)chromium.org> netfilter: nfnetlink_cthelper: Add missing permission checks Ulrich Weber <ulrich.weber(a)riverbed.com> netfilter: nf_conntrack_sip: extend request line validation Florian Westphal <fw(a)strlen.de> netfilter: restart search if moved to other chain Liping Zhang <liping.zhang(a)spreadtrum.com> netfilter: nf_ct_expect: remove the redundant slash when policy name is empty Jiri Slaby <jslaby(a)suse.cz> ipc: msg, make msgrcv work with LONG_MIN Michal Hocko <mhocko(a)suse.com> hwpoison, memcg: forcibly uncharge LRU pages Michal Hocko <mhocko(a)suse.com> mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in the stack Marc Kleine-Budde <mkl(a)pengutronix.de> can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once Marc Kleine-Budde <mkl(a)pengutronix.de> can: af_can: can_rcv(): replace WARN_ONCE by pr_warn_once Jonathan Dieter <jdieter(a)lesbg.com> usbip: Fix implicit fallthrough warning Andy Lutomirski <luto(a)kernel.org> x86/asm/32: Make sync_core() handle missing CPUID on all 32-bit kernels Jonas Gorski <jonas.gorski(a)gmail.com> MIPS: AR7: ensure the port type's FCR value is used Marc Zyngier <marc.zyngier(a)arm.com> arm64: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls Dennis Yang <dennisyang(a)qnap.com> dm thin metadata: THIN_MAX_CONCURRENT_LOCKS should be 6 Joe Thornber <thornber(a)redhat.com> dm btree: fix serious bug in btree_split_beneath() Thomas Petazzoni <thomas.petazzoni(a)free-electrons.com> ARM: dts: kirkwood: fix pin-muxing of MPP7 on OpenBlocks A7 Arnd Bergmann <arnd(a)arndb.de> phy: work around 'phys' references to usb-nop-xceiv devices Johan Hovold <johan(a)kernel.org> Input: twl4030-vibra - fix sibling-node lookup Marek Belisko <marek(a)goldelico.com> Input: twl4030-vibra - fix ERROR: Bad of_node_put() warning Johan Hovold <johan(a)kernel.org> Input: twl6040-vibra - fix child-node lookup H. Nikolaus Schaller <hns(a)goldelico.com> Input: twl6040-vibra - fix DT node memory management Johan Hovold <johan(a)kernel.org> Input: 88pm860x-ts - fix child-node lookup Joe Lawrence <joe.lawrence(a)redhat.com> pipe: avoid round_pipe_size() nr_pages overflow on 32-bit Eric Biggers <ebiggers(a)google.com> af_key: fix buffer overread in parse_exthdrs() Eric Biggers <ebiggers(a)google.com> af_key: fix buffer overread in verify_address_len() Takashi Iwai <tiwai(a)suse.de> ALSA: hda - Apply the existing quirk to iMac 14,1 Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Remove yet superfluous WARN_ON() Li Jinyue <lijinyue(a)huawei.com> futex: Prevent overflow by strengthen input validation Hannes Reinecke <hare(a)suse.de> scsi: sg: disable SET_FORCE_LOW_DMA Arnd Bergmann <arnd(a)arndb.de> gcov: disable for COMPILE_TEST ------------- Diffstat: Makefile | 4 ++-- arch/arm/boot/dts/kirkwood-openblocks_a7.dts | 10 ++++++++-- arch/arm64/kvm/handle_exit.c | 4 ++-- arch/mips/ar7/platform.c | 2 +- arch/um/Makefile | 9 +++++---- arch/um/drivers/mconsole.h | 2 +- arch/um/include/shared/init.h | 24 ++-------------------- arch/um/include/shared/user.h | 2 +- arch/x86/include/asm/processor.h | 2 +- arch/x86/kernel/cpu/microcode/intel.c | 20 +++++++++++++++++-- arch/x86/um/shared/sysdep/tls.h | 6 +++--- drivers/input/misc/twl4030-vibra.c | 7 +++++-- drivers/input/misc/twl6040-vibra.c | 2 +- drivers/input/touchscreen/88pm860x-ts.c | 16 +++++++++++---- drivers/md/dm-thin-metadata.c | 6 +++++- drivers/md/persistent-data/dm-btree.c | 19 ++---------------- drivers/net/ppp/pppoe.c | 11 +++++----- drivers/net/vmxnet3/vmxnet3_drv.c | 2 +- drivers/phy/phy-core.c | 4 ++++ drivers/scsi/libiscsi.c | 2 +- drivers/scsi/sg.c | 30 +++++++++------------------- fs/fcntl.c | 4 ++++ fs/pipe.c | 18 +++++++++++++++-- fs/reiserfs/bitmap.c | 14 ++++++++++--- include/linux/tcp.h | 7 ++++++- include/net/arp.h | 3 +++ include/net/net_namespace.h | 10 ++++++++++ include/scsi/sg.h | 1 - include/uapi/linux/eventpoll.h | 13 ++++++++++++ ipc/msg.c | 5 ++++- kernel/futex.c | 3 +++ kernel/gcov/Kconfig | 1 + mm/memcontrol.c | 2 +- mm/memory-failure.c | 7 +++++++ mm/mmap.c | 6 ++++-- net/can/af_can.c | 22 ++++++++++---------- net/core/dev.c | 19 ++++++++++++++---- net/core/neighbour.c | 4 ++-- net/dccp/ccids/ccid2.c | 3 +++ net/ipv4/arp.c | 7 ++++++- net/ipv4/igmp.c | 2 +- net/ipv4/tcp.c | 3 +++ net/ipv4/tcp_timer.c | 15 ++++++++++++++ net/ipv6/ip6_output.c | 6 ++++-- net/key/af_key.c | 8 ++++++++ net/netfilter/nf_conntrack_core.c | 7 +++++++ net/netfilter/nf_conntrack_expect.c | 2 +- net/netfilter/nf_conntrack_sip.c | 5 ++++- net/netfilter/nfnetlink_cthelper.c | 10 ++++++++++ net/netfilter/xt_osf.c | 7 +++++++ net/sctp/socket.c | 30 +++++++++++----------------- sound/core/pcm_lib.c | 1 - sound/pci/hda/patch_cirrus.c | 1 + tools/usb/usbip/src/usbip.c | 2 ++ 54 files changed, 284 insertions(+), 148 deletions(-)

6 years, 3 months

3
59
0 0

[Linux-stable-mirror] [git:media_tree/master] media: v4l2-compat-ioctl32.c: make ctrl_is_pointer work for subdevs

by Mauro Carvalho Chehab

This is an automatic generated email to let you know that the following patch were queued: Subject: media: v4l2-compat-ioctl32.c: make ctrl_is_pointer work for subdevs Author: Hans Verkuil <hansverk(a)cisco.com> Date: Tue Jan 30 10:18:32 2018 -0500 If the device is of type VFL_TYPE_SUBDEV then vdev->ioctl_ops is NULL so the 'if (!ops->vidioc_query_ext_ctrl)' check would crash. Add a test for !ops to the condition. All sub-devices that have controls will use the control framework, so they do not have an equivalent to ops->vidioc_query_ext_ctrl. Returning false if ops is NULL is the correct thing to do here. Fixes: b8c601e8af ("v4l2-compat-ioctl32.c: fix ctrl_is_pointer") Signed-off-by: Hans Verkuil <hans.verkuil(a)cisco.com> Acked-by: Sakari Ailus <sakari.ailus(a)linux.intel.com> Reported-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Reviewed-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Cc: <stable(a)vger.kernel.org> # for v4.15 and up Signed-off-by: Mauro Carvalho Chehab <mchehab(a)s-opensource.com> drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c index bdb5c226d01c..5198c9eeb348 100644 --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c @@ -770,7 +770,7 @@ static inline bool ctrl_is_pointer(struct file *file, u32 id) return ctrl && ctrl->is_ptr; } - if (!ops->vidioc_query_ext_ctrl) + if (!ops || !ops->vidioc_query_ext_ctrl) return false; return !ops->vidioc_query_ext_ctrl(file, fh, &qec) &&

6 years, 3 months

1
0
0 0

[Linux-stable-mirror] [PATCH] ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info

by Tyrel Datwyler

The fcp_rsp_info structure as defined in the FC spec has an initial 3 bytes reserved field. The ibmvfc driver mistakenly defined this field as 4 bytes resulting in the rsp_code field being defined in what should be the start of the second reserved field and thus always being reported as zero by the driver. Ideally, we should wire ibmvfc up with libfc for the sake of code deduplication, and ease of maintaining standardized structures in a single place. However, for now simply fixup the definition in ibmvfc for backporting to distros on older kernels. Wiring up with libfc will be done in a followup patch. Cc: stable(a)vger.kernel.org Reported-by: Hannes Reinecke <hare(a)suse.de> Signed-off-by: Tyrel Datwyler <tyreld(a)linux.vnet.ibm.com> --- drivers/scsi/ibmvscsi/ibmvfc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc.h b/drivers/scsi/ibmvscsi/ibmvfc.h index 9a0696f..b81a53c 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc.h +++ b/drivers/scsi/ibmvscsi/ibmvfc.h @@ -367,7 +367,7 @@ enum ibmvfc_fcp_rsp_info_codes { }; struct ibmvfc_fcp_rsp_info { - __be16 reserved; + u8 reserved[3]; u8 rsp_code; u8 reserved2[4]; }__attribute__((packed, aligned (2))); -- 2.7.4

6 years, 3 months

2
1
0 0

[Linux-stable-mirror] [PATCH v3 2/5] crypto: caam: Fix endless loop when RNG is already initialized

by Bryan O'Donoghue

commit 1005bccd7a4a ("crypto: caam - enable instantiation of all RNG4 state handles") introduces a control when incrementing ent_delay which contains the following comment above it: /* * If either SH were instantiated by somebody else * (e.g. u-boot) then it is assumed that the entropy * parameters are properly set and thus the function * setting these (kick_trng(...)) is skipped. * Also, if a handle was instantiated, do not change * the TRNG parameters. */ This is a problem observed when sec_init() has been run in u-boot and and TrustZone is enabled. We can fix this by instantiating all rng state handles in u-boot but, on the Kernel side we should ensure that this non-terminating path is dealt with. Fixes: 1005bccd7a4a ("crypto: caam - enable instantiation of all RNG4 state handles") Reported-by: Ryan Harkin <ryan.harkin(a)linaro.org> Cc: "Horia Geantă" <horia.geanta(a)nxp.com> Cc: Aymen Sghaier <aymen.sghaier(a)nxp.com> Cc: Fabio Estevam <fabio.estevam(a)nxp.com> Cc: Peng Fan <peng.fan(a)nxp.com> Cc: "David S. Miller" <davem(a)davemloft.net> Cc: Lukas Auer <lukas.auer(a)aisec.fraunhofer.de> Cc: <stable(a)vger.kernel.org> # 4.12+ Signed-off-by: Bryan O'Donoghue <pure.logic(a)nexus-software.ie> --- drivers/crypto/caam/ctrl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c index 98986d3..0a1e96b 100644 --- a/drivers/crypto/caam/ctrl.c +++ b/drivers/crypto/caam/ctrl.c @@ -704,7 +704,10 @@ static int caam_probe(struct platform_device *pdev) ent_delay); kick_trng(pdev, ent_delay); ent_delay += 400; + } else if (ctrlpriv->rng4_sh_init && inst_handles) { + ent_delay += 400; } + /* * if instantiate_rng(...) fails, the loop will rerun * and the kick_trng(...) function will modfiy the -- 2.7.4

6 years, 3 months

1
0
0 0

[Linux-stable-mirror] [PATCH v3 1/5] crypto: caam: Fix null dereference at error path

by Bryan O'Donoghue

From: Rui Miguel Silva <rui.silva(a)linaro.org> caam_remove already removes the debugfs entry, so we need to remove the one immediately before calling caam_remove. This fix a NULL dereference at error paths is caam_probe fail. [bod: changed name prefix to "crypto: caam: Fix .."] [bod: added Fixes tag] Fixes: 67c2315def06 ("crypto: caam - add Queue Interface (QI) backend support") Tested-by: Ryan Harkin <ryan.harkin(a)linaro.org> Signed-off-by: Rui Miguel Silva <rui.silva(a)linaro.org> Cc: "Horia Geantă" <horia.geanta(a)nxp.com> Cc: Aymen Sghaier <aymen.sghaier(a)nxp.com> Cc: Fabio Estevam <fabio.estevam(a)nxp.com> Cc: Peng Fan <peng.fan(a)nxp.com> Cc: "David S. Miller" <davem(a)davemloft.net> Cc: Lukas Auer <lukas.auer(a)aisec.fraunhofer.de> Cc: <stable(a)vger.kernel.org> # 4.12+ Reviewed-by: Horia Geantă <horia.geanta(a)nxp.com> Signed-off-by: Bryan O'Donoghue <pure.logic(a)nexus-software.ie> --- drivers/crypto/caam/ctrl.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c index 027e121..98986d3 100644 --- a/drivers/crypto/caam/ctrl.c +++ b/drivers/crypto/caam/ctrl.c @@ -809,9 +809,6 @@ static int caam_probe(struct platform_device *pdev) return 0; caam_remove: -#ifdef CONFIG_DEBUG_FS - debugfs_remove_recursive(ctrlpriv->dfs_root); -#endif caam_remove(pdev); return ret; -- 2.7.4

6 years, 3 months

1
0
0 0

[Linux-stable-mirror] + mm-memory_hotplug-fix-memmap-initialization.patch added to -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm, memory_hotplug: fix memmap initialization has been added to the -mm tree. Its filename is mm-memory_hotplug-fix-memmap-initialization.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/mm-memory_hotplug-fix-memmap-initi… and later at http://ozlabs.org/~akpm/mmotm/broken-out/mm-memory_hotplug-fix-memmap-initi… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Michal Hocko <mhocko(a)suse.com> Subject: mm, memory_hotplug: fix memmap initialization Bharata has noticed that onlining a newly added memory doesn't increase the total memory, pointing to f7f99100d8d9 ("mm: stop zeroing memory during allocation in vmemmap") as a culprit. This commit has changed the way how the memory for memmaps is initialized and moves it from the allocation time to the initialization time. This works properly for the early memmap init path. It doesn't work for the memory hotplug though because we need to mark page as reserved when the sparsemem section is created and later initialize it completely during onlining. memmap_init_zone is called in the early stage of onlining. With the current code it calls __init_single_page and as such it clears up the whole stage and therefore online_pages_range skips those pages. Fix this by skipping mm_zero_struct_page in __init_single_page for memory hotplug path. This is quite uggly but unifying both early init and memory hotplug init paths is a large project. Make sure we plug the regression at least. Link: http://lkml.kernel.org/r/20180130101141.GW21609@dhcp22.suse.cz Fixes: f7f99100d8d9 ("mm: stop zeroing memory during allocation in vmemmap") Signed-off-by: Michal Hocko <mhocko(a)suse.com> Reported-by: Bharata B Rao <bharata(a)linux.vnet.ibm.com> Tested-by: Bharata B Rao <bharata(a)linux.vnet.ibm.com> Reviewed-by: Pavel Tatashin <pasha.tatashin(a)oracle.com> Cc: Steven Sistare <steven.sistare(a)oracle.com> Cc: Daniel Jordan <daniel.m.jordan(a)oracle.com> Cc: Bob Picco <bob.picco(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/page_alloc.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff -puN mm/page_alloc.c~mm-memory_hotplug-fix-memmap-initialization mm/page_alloc.c --- a/mm/page_alloc.c~mm-memory_hotplug-fix-memmap-initialization +++ a/mm/page_alloc.c @@ -1178,9 +1178,10 @@ static void free_one_page(struct zone *z } static void __meminit __init_single_page(struct page *page, unsigned long pfn, - unsigned long zone, int nid) + unsigned long zone, int nid, bool zero) { - mm_zero_struct_page(page); + if (zero) + mm_zero_struct_page(page); set_page_links(page, zone, nid, pfn); init_page_count(page); page_mapcount_reset(page); @@ -1195,9 +1196,9 @@ static void __meminit __init_single_page } static void __meminit __init_single_pfn(unsigned long pfn, unsigned long zone, - int nid) + int nid, bool zero) { - return __init_single_page(pfn_to_page(pfn), pfn, zone, nid); + return __init_single_page(pfn_to_page(pfn), pfn, zone, nid, zero); } #ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT @@ -1218,7 +1219,7 @@ static void __meminit init_reserved_page if (pfn >= zone->zone_start_pfn && pfn < zone_end_pfn(zone)) break; } - __init_single_pfn(pfn, zid, nid); + __init_single_pfn(pfn, zid, nid, true); } #else static inline void init_reserved_page(unsigned long pfn) @@ -1535,7 +1536,7 @@ static unsigned long __init deferred_in } else { page++; } - __init_single_page(page, pfn, zid, nid); + __init_single_page(page, pfn, zid, nid, true); nr_pages++; } return (nr_pages); @@ -5400,15 +5401,20 @@ not_early: * can be created for invalid pages (for alignment) * check here not to call set_pageblock_migratetype() against * pfn out of zone. + * + * Please note that MEMMAP_HOTPLUG path doesn't clear memmap + * because this is done early in sparse_add_one_section */ if (!(pfn & (pageblock_nr_pages - 1))) { struct page *page = pfn_to_page(pfn); - __init_single_page(page, pfn, zone, nid); + __init_single_page(page, pfn, zone, nid, + context != MEMMAP_HOTPLUG); set_pageblock_migratetype(page, MIGRATE_MOVABLE); cond_resched(); } else { - __init_single_pfn(pfn, zone, nid); + __init_single_pfn(pfn, zone, nid, + context != MEMMAP_HOTPLUG); } } } _ Patches currently in -mm which might be from mhocko(a)suse.com are mm-drop-hotplug-lock-from-lru_add_drain_all.patch mm-oom-docs-describe-the-cgroup-aware-oom-killer-fix-2.patch mm-hugetlb-drop-hugepages_treat_as_movable-sysctl.patch mm-introduce-map_fixed_safe.patch fs-elf-drop-map_fixed-usage-from-elf_map.patch fs-elf-drop-map_fixed-usage-from-elf_map-fix-fix.patch mm-numa-rework-do_pages_move.patch mm-migrate-remove-reason-argument-from-new_page_t.patch mm-migrate-remove-reason-argument-from-new_page_t-fix-3.patch mm-unclutter-thp-migration.patch mm-hugetlb-unify-core-page-allocation-accounting-and-initialization.patch mm-hugetlb-integrate-giga-hugetlb-more-naturally-to-the-allocation-path.patch mm-hugetlb-do-not-rely-on-overcommit-limit-during-migration.patch mm-hugetlb-get-rid-of-surplus-page-accounting-tricks.patch mm-hugetlb-further-simplify-hugetlb-allocation-api.patch hugetlb-mempolicy-fix-the-mbind-hugetlb-migration.patch hugetlb-mbind-fall-back-to-default-policy-if-vma-is-null.patch mm-memory_hotplug-fix-memmap-initialization.patch

6 years, 3 months

1
0
0 0

[Linux-stable-mirror] [PATCH] KVM: x86: Fix CPUID function for word 6 (80000001_ECX)

by Paolo Bonzini

From: Janakarajan Natarajan <Janakarajan.Natarajan(a)amd.com> [ upstream commit 50a671d4d15b859f447fa527191073019b6ce9cb ] The function for CPUID 80000001 ECX is set to 0xc0000001. Set it to 0x80000001. Signed-off-by: Janakarajan Natarajan <Janakarajan.Natarajan(a)amd.com> Reviewed-by: Jim Mattson <jmattson(a)google.com> Reviewed-by: Krish Sadhukhan <krish.sadhukhan(a)oracle.com> Reviewed-by: Borislav Petkov <bp(a)suse.de> Fixes: d6321d493319 ("KVM: x86: generalize guest_cpuid_has_ helpers") Signed-off-by: Radim Krčmář <rkrcmar(a)redhat.com> --- arch/x86/kvm/cpuid.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h index cdc70a3a6583..c2cea6651279 100644 --- a/arch/x86/kvm/cpuid.h +++ b/arch/x86/kvm/cpuid.h @@ -44,7 +44,7 @@ static const struct cpuid_reg reverse_cpuid[] = { [CPUID_8086_0001_EDX] = {0x80860001, 0, CPUID_EDX}, [CPUID_1_ECX] = { 1, 0, CPUID_ECX}, [CPUID_C000_0001_EDX] = {0xc0000001, 0, CPUID_EDX}, - [CPUID_8000_0001_ECX] = {0xc0000001, 0, CPUID_ECX}, + [CPUID_8000_0001_ECX] = {0x80000001, 0, CPUID_ECX}, [CPUID_7_0_EBX] = { 7, 0, CPUID_EBX}, [CPUID_D_1_EAX] = { 0xd, 1, CPUID_EAX}, [CPUID_F_0_EDX] = { 0xf, 0, CPUID_EDX}, -- 2.14.3

6 years, 3 months

1
0
0 0

[Linux-stable-mirror] [PATCH 4.14 00/71] 4.14.16-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.16 release. There are 71 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed Jan 31 12:37:59 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.16-rc1.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.16-rc1 Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> cpufreq: governor: Ensure sufficiently large sampling intervals Daniel Borkmann <daniel(a)iogearbox.net> bpf, arm64: fix stack_depth tracking in combination with tail calls Daniel Borkmann <daniel(a)iogearbox.net> bpf: reject stores into ctx via st and xadd Alexei Starovoitov <ast(a)kernel.org> bpf: fix 32-bit divide by zero Eric Dumazet <edumazet(a)google.com> bpf: fix divides by zero Daniel Borkmann <daniel(a)iogearbox.net> bpf: avoid false sharing of map refcount with max_entries Alexei Starovoitov <ast(a)kernel.org> bpf: introduce BPF_JIT_ALWAYS_ON config Thomas Gleixner <tglx(a)linutronix.de> hrtimer: Reset hrtimer cpu base proper on CPU hotplug Andy Lutomirski <luto(a)kernel.org> x86/mm/64: Fix vmapped stack syncing on very-large-memory 4-level systems Borislav Petkov <bp(a)suse.de> x86/microcode: Fix again accessing initrd after having been freed Jia Zhang <zhang.jia(a)linux.alibaba.com> x86/microcode/intel: Extend BDW late-loading further with LLC size check Xiao Liang <xiliang(a)redhat.com> perf/x86/amd/power: Do not load AMD power module on !AMD platforms Neil Horman <nhorman(a)tuxdriver.com> vmxnet3: repair memory leak Lorenzo Colitti <lorenzo(a)google.com> net: ipv4: Make "ip route get" match iif lo rules again. Sabrina Dubroca <sd(a)queasysnail.net> tls: reset crypto_info when do_tls_setsockopt_tx fails Sabrina Dubroca <sd(a)queasysnail.net> tls: return -EBUSY if crypto_info is already set Sabrina Dubroca <sd(a)queasysnail.net> tls: fix sw_ctx leak Ilya Lesokhin <ilyal(a)mellanox.com> net/tls: Only attach to sockets in ESTABLISHED state Xin Long <lucien.xin(a)gmail.com> netlink: reset extack earlier in netlink_rcv_skb Jakub Kicinski <jakub.kicinski(a)netronome.com> nfp: use the correct index for link speed table Talat Batheesh <talatb(a)mellanox.com> net/mlx5e: Fix fixpoint divide exception in mlx5e_am_stats_compare David Ahern <dsahern(a)gmail.com> netlink: extack needs to be reset each time through loop Xin Long <lucien.xin(a)gmail.com> sctp: reinit stream if stream outcnt has been change by sinit in sendmsg Eric Dumazet <edumazet(a)google.com> flow_dissector: properly cap thoff field Cong Wang <xiyou.wangcong(a)gmail.com> tun: fix a memory leak for tfile->tx_array Yuval Mintz <yuvalm(a)mellanox.com> mlxsw: spectrum_router: Don't log an error on missing neighbor Willem de Bruijn <willemb(a)google.com> gso: validate gso_type in GSO handlers Alexey Kodanev <alexey.kodanev(a)oracle.com> ip6_gre: init dev->mtu and dev->hard_header_len correctly Ivan Vecera <cera(a)cera.cz> be2net: restore properly promisc mode after queues reconfiguration Guillaume Nault <g.nault(a)alphalink.fr> ppp: unlock all_ppp_mutex before registering device Saeed Mahameed <saeedm(a)mellanox.com> net/mlx5: Fix get vector affinity helper function Eran Ben Elisha <eranbe(a)mellanox.com> {net,ib}/mlx5: Don't disable local loopback multicast traffic when needed Cong Wang <xiyou.wangcong(a)gmail.com> tipc: fix a memory leak in tipc_nl_node_get_link() Xin Long <lucien.xin(a)gmail.com> sctp: return error if the asoc has been peeled off in sctp_wait_for_sndbuf Xin Long <lucien.xin(a)gmail.com> sctp: do not allow the v4 socket to bind a v4mapped v6 address Francois Romieu <romieu(a)fr.zoreil.com> r8169: fix memory corruption on retrieval of hardware statistics. Guillaume Nault <g.nault(a)alphalink.fr> pppoe: take ->needed_headroom of lower device into account on xmit David Ahern <dsahern(a)gmail.com> net: vrf: Add support for sends to local broadcast address r.hering(a)avm.de <r.hering(a)avm.de> net/tls: Fix inverted error codes to avoid endless loop Dan Streetman <ddstreet(a)ieee.org> net: tcp: close sock if net namespace is exiting Eric Dumazet <edumazet(a)google.com> net: qdisc_pkt_len_init() should be more robust Felix Fietkau <nbd(a)nbd.name> net: igmp: fix source address check for IGMPv3 reports Yuiko Oshino <yuiko.oshino(a)microchip.com> lan78xx: Fix failure in USB Full Speed Eric Dumazet <edumazet(a)google.com> ipv6: ip6_make_skb() needs to clear cork.base.dst Mike Maloney <maloney(a)google.com> ipv6: fix udpv6 sendmsg crash caused by too small MTU Ben Hutchings <ben.hutchings(a)codethink.co.uk> ipv6: Fix getsockopt() for sockets with default IPV6_AUTOFLOWLABEL Alexey Kodanev <alexey.kodanev(a)oracle.com> dccp: don't restart ccid2_hc_tx_rto_expire() if sk in closed state Jim Westfall <jwestfall(a)surrealistic.net> ipv4: Make neigh lookup keys for loopback/point-to-point devices be INADDR_ANY Jim Westfall <jwestfall(a)surrealistic.net> net: Allow neigh contructor functions ability to modify the primary_key Boris Brezillon <boris.brezillon(a)free-electrons.com> drm/vc4: Fix NULL pointer dereference in vc4_save_hang_state() Russell King <rmk+kernel(a)armlinux.org.uk> ARM: net: bpf: clarify tail_call index Russell King <rmk+kernel(a)armlinux.org.uk> ARM: net: bpf: fix LDX instructions Russell King <rmk+kernel(a)armlinux.org.uk> ARM: net: bpf: fix register saving Russell King <rmk+kernel(a)armlinux.org.uk> ARM: net: bpf: correct stack layout documentation Russell King <rmk+kernel(a)armlinux.org.uk> ARM: net: bpf: move stack documentation Russell King <rmk+kernel(a)armlinux.org.uk> ARM: net: bpf: fix stack alignment Russell King <rmk+kernel(a)armlinux.org.uk> ARM: net: bpf: fix tail call jumps Russell King <rmk+kernel(a)armlinux.org.uk> ARM: net: bpf: avoid 'bx' instruction on non-Thumb capable CPUs Martin Brandenburg <martin(a)omnibond.com> orangefs: fix deadlock; do not write i_size in read_iter Christian Borntraeger <borntraeger(a)de.ibm.com> KVM: s390: add proper locking for CMMA migration bitmap Josef Bacik <jbacik(a)fb.com> Btrfs: fix stale entries in readdir Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: trackpoint - only expose supported controls for Elan, ALPS and NXP Aaron Ma <aaron.ma(a)canonical.com> Input: trackpoint - force 3 buttons if 0 button is reported Mark Furneaux <mark(a)furneaux.ca> Input: xpad - add support for PDP Xbox One controllers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "module: Add retpoline tag to VERMAGIC" Steffen Klassert <steffen.klassert(a)secunet.com> xfrm: Fix a race in the xdst pcpu cache. Kevin Cernekee <cernekee(a)chromium.org> netfilter: xt_osf: Add missing permission checks Kevin Cernekee <cernekee(a)chromium.org> netfilter: nfnetlink_cthelper: Add missing permission checks Vlastimil Babka <vbabka(a)suse.cz> mm, page_alloc: fix potential false positive in __zone_watermark_ok Martin Brandenburg <martin(a)omnibond.com> orangefs: initialize op on loop restart in orangefs_devreq_read Martin Brandenburg <martin(a)omnibond.com> orangefs: use list_for_each_entry_safe in purge_waiting_ops ------------- Diffstat: Makefile | 4 +- arch/arm/net/bpf_jit_32.c | 225 ++++++++++--------- arch/arm64/net/bpf_jit_comp.c | 20 +- arch/s390/kvm/kvm-s390.c | 18 +- arch/x86/events/amd/power.c | 2 +- arch/x86/kernel/cpu/microcode/core.c | 2 +- arch/x86/kernel/cpu/microcode/intel.c | 20 +- arch/x86/mm/tlb.c | 34 ++- drivers/cpufreq/cpufreq_governor.c | 19 +- drivers/gpu/drm/vc4/vc4_gem.c | 12 +- drivers/infiniband/hw/mlx5/main.c | 9 +- drivers/input/joystick/xpad.c | 19 ++ drivers/input/mouse/trackpoint.c | 245 +++++++++++++-------- drivers/input/mouse/trackpoint.h | 34 +-- drivers/net/ethernet/emulex/benet/be_main.c | 9 + drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c | 6 + .../net/ethernet/mellanox/mlx5/core/en_selftest.c | 27 ++- drivers/net/ethernet/mellanox/mlx5/core/main.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/vport.c | 22 +- .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 10 +- .../net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +- drivers/net/ethernet/realtek/r8169.c | 9 +- drivers/net/ppp/ppp_generic.c | 5 +- drivers/net/ppp/pppoe.c | 11 +- drivers/net/tun.c | 15 +- drivers/net/usb/lan78xx.c | 1 + drivers/net/vmxnet3/vmxnet3_drv.c | 2 +- drivers/net/vrf.c | 5 +- fs/btrfs/delayed-inode.c | 26 +-- fs/orangefs/devorangefs-req.c | 3 +- fs/orangefs/file.c | 7 +- fs/orangefs/orangefs-kernel.h | 11 - fs/orangefs/waitqueue.c | 4 +- include/linux/bpf.h | 21 +- include/linux/mlx5/driver.h | 19 +- include/linux/mlx5/mlx5_ifc.h | 5 +- include/linux/vermagic.h | 8 +- include/net/arp.h | 3 + include/net/ipv6.h | 1 + include/net/net_namespace.h | 10 + include/net/tls.h | 2 +- init/Kconfig | 7 + kernel/bpf/core.c | 23 +- kernel/bpf/verifier.c | 37 ++++ kernel/time/hrtimer.c | 3 + lib/test_bpf.c | 11 +- mm/page_alloc.c | 6 +- net/core/dev.c | 19 +- net/core/filter.c | 10 +- net/core/flow_dissector.c | 3 +- net/core/neighbour.c | 4 +- net/core/sysctl_net_core.c | 6 + net/dccp/ccids/ccid2.c | 3 + net/ipv4/arp.c | 7 +- net/ipv4/esp4_offload.c | 3 + net/ipv4/igmp.c | 2 +- net/ipv4/route.c | 1 + net/ipv4/tcp.c | 3 + net/ipv4/tcp_offload.c | 3 + net/ipv4/tcp_timer.c | 15 ++ net/ipv4/udp_offload.c | 3 + net/ipv6/esp6_offload.c | 3 + net/ipv6/ip6_gre.c | 14 +- net/ipv6/ip6_output.c | 9 +- net/ipv6/ipv6_sockglue.c | 2 +- net/ipv6/tcpv6_offload.c | 3 + net/ipv6/udp_offload.c | 3 + net/netfilter/nfnetlink_cthelper.c | 10 + net/netfilter/xt_osf.c | 7 + net/netlink/af_netlink.c | 3 +- net/sctp/offload.c | 3 + net/sctp/socket.c | 40 ++-- net/socket.c | 9 + net/tipc/node.c | 26 ++- net/tls/tls_main.c | 17 +- net/tls/tls_sw.c | 16 +- net/xfrm/xfrm_policy.c | 8 +- tools/testing/selftests/bpf/test_verifier.c | 29 ++- 78 files changed, 843 insertions(+), 438 deletions(-)

6 years, 3 months

4
76
0 0

[Linux-stable-mirror] [PATCHv2 12/13] v4l2-compat-ioctl32.c: don't copy back the result for certain errors

by Hans Verkuil

From: Hans Verkuil <hans.verkuil(a)cisco.com> Some ioctls need to copy back the result even if the ioctl returned an error. However, don't do this for the error code -ENOTTY. It makes no sense in that cases. Signed-off-by: Hans Verkuil <hans.verkuil(a)cisco.com> Acked-by: Sakari Ailus <sakari.ailus(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> # for v4.15 and up --- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c index 7ee3777cbe9c..3a1fca1440ac 100644 --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c @@ -968,6 +968,9 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar set_fs(old_fs); } + if (err == -ENOTTY) + return err; + /* Special case: even after an error we need to put the results back for these ioctls since the error_idx will contain information on which control failed. */ -- 2.15.1

6 years, 3 months

3
2
0 0

[Linux-stable-mirror] [PATCHv2 09/13] v4l2-compat-ioctl32.c: fix ctrl_is_pointer

by Hans Verkuil

From: Hans Verkuil <hans.verkuil(a)cisco.com> ctrl_is_pointer just hardcoded two known string controls, but that caused problems when using e.g. custom controls that use a pointer for the payload. Reimplement this function: it now finds the v4l2_ctrl (if the driver uses the control framework) or it calls vidioc_query_ext_ctrl (if the driver implements that directly). In both cases it can now check if the control is a pointer control or not. Signed-off-by: Hans Verkuil <hans.verkuil(a)cisco.com> Cc: <stable(a)vger.kernel.org> # for v4.15 and up --- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 57 ++++++++++++++++++--------- 1 file changed, 38 insertions(+), 19 deletions(-) diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c index 7dff9b4aeb19..30c5be1f0549 100644 --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c @@ -18,6 +18,8 @@ #include <linux/videodev2.h> #include <linux/v4l2-subdev.h> #include <media/v4l2-dev.h> +#include <media/v4l2-fh.h> +#include <media/v4l2-ctrls.h> #include <media/v4l2-ioctl.h> static long native_ioctl(struct file *file, unsigned int cmd, unsigned long arg) @@ -601,24 +603,39 @@ struct v4l2_ext_control32 { }; } __attribute__ ((packed)); -/* The following function really belong in v4l2-common, but that causes - a circular dependency between modules. We need to think about this, but - for now this will do. */ - -/* Return non-zero if this control is a pointer type. Currently only - type STRING is a pointer type. */ -static inline int ctrl_is_pointer(u32 id) +/* Return true if this control is a pointer type. */ +static inline bool ctrl_is_pointer(struct file *file, u32 id) { - switch (id) { - case V4L2_CID_RDS_TX_PS_NAME: - case V4L2_CID_RDS_TX_RADIO_TEXT: - return 1; - default: - return 0; + struct video_device *vdev = video_devdata(file); + struct v4l2_fh *fh = NULL; + struct v4l2_ctrl_handler *hdl = NULL; + struct v4l2_query_ext_ctrl qec = { id }; + const struct v4l2_ioctl_ops *ops = vdev->ioctl_ops; + + if (test_bit(V4L2_FL_USES_V4L2_FH, &vdev->flags)) + fh = file->private_data; + + if (fh && fh->ctrl_handler) + hdl = fh->ctrl_handler; + else if (vdev->ctrl_handler) + hdl = vdev->ctrl_handler; + + if (hdl) { + struct v4l2_ctrl *ctrl = v4l2_ctrl_find(hdl, id); + + return ctrl && ctrl->is_ptr; } + + if (!ops->vidioc_query_ext_ctrl) + return false; + + return !ops->vidioc_query_ext_ctrl(file, fh, &qec) && + (qec.flags & V4L2_CTRL_FLAG_HAS_PAYLOAD); } -static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext_controls32 __user *up) +static int get_v4l2_ext_controls32(struct file *file, + struct v4l2_ext_controls *kp, + struct v4l2_ext_controls32 __user *up) { struct v4l2_ext_control32 __user *ucontrols; struct v4l2_ext_control __user *kcontrols; @@ -651,7 +668,7 @@ static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext return -EFAULT; if (get_user(id, &kcontrols->id)) return -EFAULT; - if (ctrl_is_pointer(id)) { + if (ctrl_is_pointer(file, id)) { void __user *s; if (get_user(p, &ucontrols->string)) @@ -666,7 +683,9 @@ static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext return 0; } -static int put_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext_controls32 __user *up) +static int put_v4l2_ext_controls32(struct file *file, + struct v4l2_ext_controls *kp, + struct v4l2_ext_controls32 __user *up) { struct v4l2_ext_control32 __user *ucontrols; struct v4l2_ext_control __user *kcontrols = @@ -698,7 +717,7 @@ static int put_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext /* Do not modify the pointer when copying a pointer control. The contents of the pointer was changed, not the pointer itself. */ - if (ctrl_is_pointer(id)) + if (ctrl_is_pointer(file, id)) size -= sizeof(ucontrols->value64); if (copy_in_user(ucontrols, kcontrols, size)) return -EFAULT; @@ -912,7 +931,7 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar case VIDIOC_G_EXT_CTRLS: case VIDIOC_S_EXT_CTRLS: case VIDIOC_TRY_EXT_CTRLS: - err = get_v4l2_ext_controls32(&karg.v2ecs, up); + err = get_v4l2_ext_controls32(file, &karg.v2ecs, up); compatible_arg = 0; break; case VIDIOC_DQEVENT: @@ -939,7 +958,7 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar case VIDIOC_G_EXT_CTRLS: case VIDIOC_S_EXT_CTRLS: case VIDIOC_TRY_EXT_CTRLS: - if (put_v4l2_ext_controls32(&karg.v2ecs, up)) + if (put_v4l2_ext_controls32(file, &karg.v2ecs, up)) err = -EFAULT; break; case VIDIOC_S_EDID: -- 2.15.1

6 years, 3 months

3
2
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror January 2018