This is a note to let you know that I've just added the patch titled
[PATCH] Revert "genirq: Use irqd_get_trigger_type to compare the
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
revert-genirq-use-irqd_get_trigger_type-to-compare-the.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 399af491b3f604277121f817ab0da9be6801bcef Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Date: Fri, 30 Mar 2018 10:43:30 +0200
Subject: [PATCH] Revert "genirq: Use irqd_get_trigger_type to compare the
trigger type for shared IRQs"
This reverts commit f2596a9808acfd02ce1ee389f0e1c37e64aec5f6 which is
commit 382bd4de61827dbaaf5fb4fb7b1f4be4a86505e7 upstream.
It causes too many problems with the stable tree, and would require too
many other things to be backported, so just revert it.
Reported-by: Guenter Roeck <linux(a)roeck-us.net>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Hans de Goede <hdegoede(a)redhat.com>
Cc: Marc Zyngier <marc.zyngier(a)arm.com>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Sasha Levin <alexander.levin(a)microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
kernel/irq/manage.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1210,10 +1210,8 @@ __setup_irq(unsigned int irq, struct irq
* set the trigger type must match. Also all must
* agree on ONESHOT.
*/
- unsigned int oldtype = irqd_get_trigger_type(&desc->irq_data);
-
if (!((old->flags & new->flags) & IRQF_SHARED) ||
- (oldtype != (new->flags & IRQF_TRIGGER_MASK)) ||
+ ((old->flags ^ new->flags) & IRQF_TRIGGER_MASK) ||
((old->flags ^ new->flags) & IRQF_ONESHOT))
goto mismatch;
Patches currently in stable-queue which might be from gregkh(a)linuxfoundation.org are
queue-4.9/net-fix-hlist-corruptions-in-inet_evict_bucket.patch
queue-4.9/ppp-avoid-loop-in-xmit-recursion-detection-code.patch
queue-4.9/ipv6-fix-access-to-non-linear-packet-in-ndisc_fill_redirect_hdr_option.patch
queue-4.9/net-only-honor-ifindex-in-ip_pktinfo-if-non-0.patch
queue-4.9/skbuff-fix-not-waking-applications-when-errors-are-enqueued.patch
queue-4.9/rhashtable-fix-rhlist-duplicates-insertion.patch
queue-4.9/kcm-lock-lower-socket-in-kcm_attach.patch
queue-4.9/s390-qeth-when-thread-completes-wake-up-all-waiters.patch
queue-4.9/sch_netem-fix-skb-leak-in-netem_enqueue.patch
queue-4.9/s390-qeth-lock-read-device-while-queueing-next-buffer.patch
queue-4.9/net-systemport-rewrite-__bcm_sysport_tx_reclaim.patch
queue-4.9/revert-genirq-use-irqd_get_trigger_type-to-compare-the.patch
queue-4.9/l2tp-do-not-accept-arbitrary-sockets.patch
queue-4.9/netlink-avoid-a-double-skb-free-in-genlmsg_mcast.patch
queue-4.9/team-fix-double-free-in-error-path.patch
queue-4.9/net-use-skb_to_full_sk-in-skb_update_prio.patch
queue-4.9/ieee802154-6lowpan-fix-possible-null-deref-in-lowpan_device_event.patch
queue-4.9/net-hns-fix-a-skb-used-after-free-bug.patch
queue-4.9/soc-fsl-qbman-fix-issue-in-qman_delete_cgr_safe.patch
queue-4.9/net-iucv-free-memory-obtained-by-kzalloc.patch
queue-4.9/net-ethernet-arc-fix-a-potential-memory-leak-if-an-optional-regulator-is-deferred.patch
queue-4.9/s390-qeth-on-channel-error-reject-further-cmd-requests.patch
queue-4.9/scsi-sg-don-t-return-bogus-sg_requests.patch
queue-4.9/dccp-check-sk-for-closed-state-in-dccp_sendmsg.patch
queue-4.9/net-fec-fix-unbalanced-pm-runtime-calls.patch
queue-4.9/net-ethernet-ti-cpsw-add-check-for-in-band-mode-setting-with-rgmii-phy-interface.patch
queue-4.9/net-sched-actions-return-explicit-error-when-tunnel_key-mode-is-not-specified.patch
queue-4.9/s390-qeth-free-netdevice-when-removing-a-card.patch
memblock_search_pfn_nid() returns the nid and the [start|end]_pfn of the
memory region where pfn sits in. While the calculation of start_pfn has
potential issue when the regions base is not page aligned.
For example, we assume PAGE_SHIFT is 12 and base is 0x1234. Current
implementation would return 1 while this is not correct.
This patch fixes this by using PFN_UP().
The original commit is commit e76b63f80d93 ("memblock, numa: binary search
node id") and merged in v3.12.
Signed-off-by: Wei Yang <richard.weiyang(a)gmail.com>
Cc: 3.12 <stable(a)vger.kernel.org>
---
mm/memblock.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/memblock.c b/mm/memblock.c
index b6ba6b7adadc..de768307696d 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -1673,7 +1673,7 @@ int __init_memblock memblock_search_pfn_nid(unsigned long pfn,
if (mid == -1)
return -1;
- *start_pfn = PFN_DOWN(type->regions[mid].base);
+ *start_pfn = PFN_UP(type->regions[mid].base);
*end_pfn = PFN_DOWN(type->regions[mid].base + type->regions[mid].size);
return type->regions[mid].nid;
--
2.15.1
From: Eric Biggers <ebiggers(a)google.com>
ext4 isn't validating the sizes of xattrs. This is problematic
because ->e_value_size is a u32, but ext4_xattr_get() returns an int.
A very large size is misinterpreted as an error code, which
ext4_get_acl() translates into a bogus ERR_PTR() for which IS_ERR()
returns false, causing a crash.
Fix this by validating that all xattrs are <= INT_MAX bytes. Also add
explicit checks in ext4_xattr_block_get() and ext4_xattr_ibody_get()
just in case the xattr block is corrupted in memory.
This issue has been assigned CVE-2018-1095.
https://bugzilla.kernel.org/show_bug.cgi?id=199185https://bugzilla.redhat.com/show_bug.cgi?id=1560793
Reported-by: Wen Xu <wen.xu(a)gatech.edu>
Signed-off-by: Eric Biggers <ebiggers(a)google.com>
Signed-off-by: Theodore Ts'o <tytso(a)mit.edu>
Cc: stable(a)vger.kernel.org
---
fs/ext4/xattr.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 63656dbafdc4..fea1108c3bea 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -201,6 +201,9 @@ ext4_xattr_check_entries(struct ext4_xattr_entry *entry, void *end,
u32 size = le32_to_cpu(entry->e_value_size);
void *value;
+ if (size > INT_MAX)
+ return -EFSCORRUPTED;
+
/*
* The value cannot overlap the names, and the value
* with padding cannot extend beyond 'end'. Check both
@@ -523,8 +526,10 @@ ext4_xattr_block_get(struct inode *inode, int name_index, const char *name,
if (error)
goto cleanup;
size = le32_to_cpu(entry->e_value_size);
+ error = -ERANGE;
+ if (unlikely(size > INT_MAX))
+ goto cleanup;
if (buffer) {
- error = -ERANGE;
if (size > buffer_size)
goto cleanup;
if (entry->e_value_inum) {
@@ -572,8 +577,10 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name,
if (error)
goto cleanup;
size = le32_to_cpu(entry->e_value_size);
+ error = -ERANGE;
+ if (unlikely(size > INT_MAX))
+ goto cleanup;
if (buffer) {
- error = -ERANGE;
if (size > buffer_size)
goto cleanup;
if (entry->e_value_inum) {
--
2.16.1.72.g5be1f00a9a
This is a note to let you know that I've just added the patch titled
Revert "USB: serial: ftdi_sio: add Id for Physik Instrumente E-870"
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From 5267c5e09c25e2ee6242b37833a9bdf9d97f54a2 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan(a)kernel.org>
Date: Thu, 29 Mar 2018 14:35:40 +0200
Subject: Revert "USB: serial: ftdi_sio: add Id for Physik Instrumente E-870"
This reverts commit 79a0b33165d8d8ec0840fcfc74fd0a8f219abeee.
Turns out this is not an FTDI device after all.
Fixes: 79a0b33165d8 ("USB: serial: ftdi_sio: add Id for Physik Instrumente E-870")
Reported-by: Martin Teichmann <martin.teichmann(a)xfel.eu>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Johan Hovold <johan(a)kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/serial/ftdi_sio.c | 1 -
drivers/usb/serial/ftdi_sio_ids.h | 1 -
2 files changed, 2 deletions(-)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 566f25781ea0..87202ad5a50d 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -894,7 +894,6 @@ static const struct usb_device_id id_table_combined[] = {
{ USB_DEVICE(PI_VID, PI_1014_PID) },
{ USB_DEVICE(PI_VID, PI_1015_PID) },
{ USB_DEVICE(PI_VID, PI_1016_PID) },
- { USB_DEVICE(PI_VID, PI_E870_PID) },
{ USB_DEVICE(KONDO_VID, KONDO_USB_SERIAL_PID) },
{ USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
{ USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index f7790758de7c..975d02666c5a 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -981,7 +981,6 @@
#define PI_1014_PID 0x1014 /* PI Device */
#define PI_1015_PID 0x1015 /* PI Device */
#define PI_1016_PID 0x1016 /* PI Digital Servo Module */
-#define PI_E870_PID 0x1019 /* PI E-870 Piezomotor Controller */
/*
* Kondo Kagaku Co.Ltd.
--
2.16.3
This is a note to let you know that I've just added the patch titled
usb: musb: gadget: misplaced out of bounds check
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From af6f8529098aeb0e56a68671b450cf74e7a64fcd Mon Sep 17 00:00:00 2001
From: Heinrich Schuchardt <xypron.glpk(a)gmx.de>
Date: Thu, 29 Mar 2018 10:48:28 -0500
Subject: usb: musb: gadget: misplaced out of bounds check
musb->endpoints[] has array size MUSB_C_NUM_EPS.
We must check array bounds before accessing the array and not afterwards.
Signed-off-by: Heinrich Schuchardt <xypron.glpk(a)gmx.de>
Signed-off-by: Bin Liu <b-liu(a)ti.com>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/musb/musb_gadget_ep0.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/drivers/usb/musb/musb_gadget_ep0.c b/drivers/usb/musb/musb_gadget_ep0.c
index 18da4873e52e..91a5027b5c1f 100644
--- a/drivers/usb/musb/musb_gadget_ep0.c
+++ b/drivers/usb/musb/musb_gadget_ep0.c
@@ -89,15 +89,19 @@ static int service_tx_status_request(
}
is_in = epnum & USB_DIR_IN;
- if (is_in) {
- epnum &= 0x0f;
+ epnum &= 0x0f;
+ if (epnum >= MUSB_C_NUM_EPS) {
+ handled = -EINVAL;
+ break;
+ }
+
+ if (is_in)
ep = &musb->endpoints[epnum].ep_in;
- } else {
+ else
ep = &musb->endpoints[epnum].ep_out;
- }
regs = musb->endpoints[epnum].regs;
- if (epnum >= MUSB_C_NUM_EPS || !ep->desc) {
+ if (!ep->desc) {
handled = -EINVAL;
break;
}
--
2.16.3
This is a note to let you know that I've just added the patch titled
Revert "USB: serial: ftdi_sio: add Id for Physik Instrumente E-870"
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the usb-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 5267c5e09c25e2ee6242b37833a9bdf9d97f54a2 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan(a)kernel.org>
Date: Thu, 29 Mar 2018 14:35:40 +0200
Subject: Revert "USB: serial: ftdi_sio: add Id for Physik Instrumente E-870"
This reverts commit 79a0b33165d8d8ec0840fcfc74fd0a8f219abeee.
Turns out this is not an FTDI device after all.
Fixes: 79a0b33165d8 ("USB: serial: ftdi_sio: add Id for Physik Instrumente E-870")
Reported-by: Martin Teichmann <martin.teichmann(a)xfel.eu>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Johan Hovold <johan(a)kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/serial/ftdi_sio.c | 1 -
drivers/usb/serial/ftdi_sio_ids.h | 1 -
2 files changed, 2 deletions(-)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 566f25781ea0..87202ad5a50d 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -894,7 +894,6 @@ static const struct usb_device_id id_table_combined[] = {
{ USB_DEVICE(PI_VID, PI_1014_PID) },
{ USB_DEVICE(PI_VID, PI_1015_PID) },
{ USB_DEVICE(PI_VID, PI_1016_PID) },
- { USB_DEVICE(PI_VID, PI_E870_PID) },
{ USB_DEVICE(KONDO_VID, KONDO_USB_SERIAL_PID) },
{ USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
{ USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index f7790758de7c..975d02666c5a 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -981,7 +981,6 @@
#define PI_1014_PID 0x1014 /* PI Device */
#define PI_1015_PID 0x1015 /* PI Device */
#define PI_1016_PID 0x1016 /* PI Digital Servo Module */
-#define PI_E870_PID 0x1019 /* PI E-870 Piezomotor Controller */
/*
* Kondo Kagaku Co.Ltd.
--
2.16.3