The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 2855b33514d290c51d52d94e25d3ef942cd4d578 Mon Sep 17 00:00:00 2001
From: "Michael S. Tsirkin" <mst(a)redhat.com>
Date: Fri, 20 Apr 2018 19:54:23 +0300
Subject: [PATCH] virtio_console: don't tie bufs to a vq
an allocated buffer doesn't need to be tied to a vq -
only vq->vdev is ever used. Pass the function the
just what it needs - the vdev.
Cc: stable(a)vger.kernel.org
Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com>
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 468f06134012..3e56f328b4cb 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -422,7 +422,7 @@ static void reclaim_dma_bufs(void)
}
}
-static struct port_buffer *alloc_buf(struct virtqueue *vq, size_t buf_size,
+static struct port_buffer *alloc_buf(struct virtio_device *vdev, size_t buf_size,
int pages)
{
struct port_buffer *buf;
@@ -445,16 +445,16 @@ static struct port_buffer *alloc_buf(struct virtqueue *vq, size_t buf_size,
return buf;
}
- if (is_rproc_serial(vq->vdev)) {
+ if (is_rproc_serial(vdev)) {
/*
* Allocate DMA memory from ancestor. When a virtio
* device is created by remoteproc, the DMA memory is
* associated with the grandparent device:
* vdev => rproc => platform-dev.
*/
- if (!vq->vdev->dev.parent || !vq->vdev->dev.parent->parent)
+ if (!vdev->dev.parent || !vdev->dev.parent->parent)
goto free_buf;
- buf->dev = vq->vdev->dev.parent->parent;
+ buf->dev = vdev->dev.parent->parent;
/* Increase device refcnt to avoid freeing it */
get_device(buf->dev);
@@ -838,7 +838,7 @@ static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
count = min((size_t)(32 * 1024), count);
- buf = alloc_buf(port->out_vq, count, 0);
+ buf = alloc_buf(port->portdev->vdev, count, 0);
if (!buf)
return -ENOMEM;
@@ -957,7 +957,7 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe,
if (ret < 0)
goto error_out;
- buf = alloc_buf(port->out_vq, 0, pipe->nrbufs);
+ buf = alloc_buf(port->portdev->vdev, 0, pipe->nrbufs);
if (!buf) {
ret = -ENOMEM;
goto error_out;
@@ -1374,7 +1374,7 @@ static unsigned int fill_queue(struct virtqueue *vq, spinlock_t *lock)
nr_added_bufs = 0;
do {
- buf = alloc_buf(vq, PAGE_SIZE, 0);
+ buf = alloc_buf(vq->vdev, PAGE_SIZE, 0);
if (!buf)
break;
FYI: About My Previous Message
Hi,
Am Mrs Patricia William, i just want to know if you receive my
previous email i sent to you last three (3) days ago.
Is your email still Active? If YES; please can you email me back,
i have something very important to discuss with you.
Awaits your reply soon..
Best Regard
Mrs. Patricia Williams
At a commit f91c9d7610a ('ALSA: firewire-lib: cache maximum length of
payload to reduce function calls'), maximum size of payload for tx
isochronous packet is cached to reduce the number of function calls.
This cache was programmed to updated at a first callback of ohci1394 IR
context. However, the maximum size is required to queueing packets before
starting the isochronous context.
As a result, the cached value is reused to queue packets in next time to
starting the isochronous context. Then the cache is updated in a first
callback of the isochronous context. This can cause kernel NULL pointer
dereference in a below call graph:
(sound/firewire/amdtp-stream.c)
amdtp_stream_start()
->queue_in_packet()
->queue_packet()
(drivers/firewire/core-iso.c)
->fw_iso_context_queue()
->struct fw_card_driver.queue_iso()
(drivers/firewire/ohci.c)
= ohci_queue_iso()
->queue_iso_packet_per_buffer()
buffer->pages[page]
The issued dereference occurs in a case that:
- target unit supports different stream formats for sampling transmission
frequency.
- maximum length of payload for tx stream in a first trial is bigger
than the length in a second trial.
In this case, correct number of pages are allocated for DMA and the 'pages'
array has enough elements, while index of the element is wrongly calculated
according to the old value of length of payload in a call of
'queue_in_packet()'. Then it causes the issue.
This commit fixes the critical bug. This affects all of drivers in ALSA
firewire stack in Linux kernel v4.12 or later.
[12665.302360] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
[12665.302415] IP: ohci_queue_iso+0x47c/0x800 [firewire_ohci]
[12665.302439] PGD 0
[12665.302440] P4D 0
[12665.302450]
[12665.302470] Oops: 0000 [#1] SMP PTI
[12665.302487] Modules linked in: ...
[12665.303096] CPU: 1 PID: 12760 Comm: jackd Tainted: P OE 4.13.0-38-generic #43-Ubuntu
[12665.303154] Hardware name: /DH77DF, BIOS KCH7710H.86A.0069.2012.0224.1825 02/24/2012
[12665.303215] task: ffff9ce87da2ae80 task.stack: ffffb5b8823d0000
[12665.303258] RIP: 0010:ohci_queue_iso+0x47c/0x800 [firewire_ohci]
[12665.303301] RSP: 0018:ffffb5b8823d3ab8 EFLAGS: 00010086
[12665.303337] RAX: ffff9ce4f4876930 RBX: 0000000000000008 RCX: ffff9ce88a3955e0
[12665.303384] RDX: 0000000000000000 RSI: 0000000034877f00 RDI: 0000000000000000
[12665.303427] RBP: ffffb5b8823d3b68 R08: ffff9ce8ccb390a0 R09: ffff9ce877639ab0
[12665.303475] R10: 0000000000000108 R11: 0000000000000000 R12: 0000000000000003
[12665.303513] R13: 0000000000000000 R14: ffff9ce4f4876950 R15: 0000000000000000
[12665.303554] FS: 00007f2ec467f8c0(0000) GS:ffff9ce8df280000(0000) knlGS:0000000000000000
[12665.303600] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[12665.303633] CR2: 0000000000000030 CR3: 00000002dcf90004 CR4: 00000000000606e0
[12665.303674] Call Trace:
[12665.303698] fw_iso_context_queue+0x18/0x20 [firewire_core]
[12665.303735] queue_packet+0x88/0xe0 [snd_firewire_lib]
[12665.303770] amdtp_stream_start+0x19b/0x270 [snd_firewire_lib]
[12665.303811] start_streams+0x276/0x3c0 [snd_dice]
[12665.303840] snd_dice_stream_start_duplex+0x1bf/0x480 [snd_dice]
[12665.303882] ? vma_gap_callbacks_rotate+0x1e/0x30
[12665.303914] ? __rb_insert_augmented+0xab/0x240
[12665.303936] capture_prepare+0x3c/0x70 [snd_dice]
[12665.303961] snd_pcm_do_prepare+0x1d/0x30 [snd_pcm]
[12665.303985] snd_pcm_action_single+0x3b/0x90 [snd_pcm]
[12665.304009] snd_pcm_action_nonatomic+0x68/0x70 [snd_pcm]
[12665.304035] snd_pcm_prepare+0x68/0x90 [snd_pcm]
[12665.304058] snd_pcm_common_ioctl1+0x4c0/0x940 [snd_pcm]
[12665.304083] snd_pcm_capture_ioctl1+0x19b/0x250 [snd_pcm]
[12665.304108] snd_pcm_capture_ioctl+0x27/0x40 [snd_pcm]
[12665.304131] do_vfs_ioctl+0xa8/0x630
[12665.304148] ? entry_SYSCALL_64_after_hwframe+0xe9/0x139
[12665.304172] ? entry_SYSCALL_64_after_hwframe+0xe2/0x139
[12665.304195] ? entry_SYSCALL_64_after_hwframe+0xdb/0x139
[12665.304218] ? entry_SYSCALL_64_after_hwframe+0xd4/0x139
[12665.304242] ? entry_SYSCALL_64_after_hwframe+0xcd/0x139
[12665.304265] ? entry_SYSCALL_64_after_hwframe+0xc6/0x139
[12665.304288] ? entry_SYSCALL_64_after_hwframe+0xbf/0x139
[12665.304312] ? entry_SYSCALL_64_after_hwframe+0xb8/0x139
[12665.304335] ? entry_SYSCALL_64_after_hwframe+0xb1/0x139
[12665.304358] SyS_ioctl+0x79/0x90
[12665.304374] ? entry_SYSCALL_64_after_hwframe+0x72/0x139
[12665.304397] entry_SYSCALL_64_fastpath+0x24/0xab
[12665.304417] RIP: 0033:0x7f2ec3750ef7
[12665.304433] RSP: 002b:00007fff99e31388 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[12665.304465] RAX: ffffffffffffffda RBX: 00007fff99e312f0 RCX: 00007f2ec3750ef7
[12665.304494] RDX: 0000000000000000 RSI: 0000000000004140 RDI: 0000000000000007
[12665.304522] RBP: 0000556ebc63fd60 R08: 0000556ebc640560 R09: 0000000000000000
[12665.304553] R10: 0000000000000001 R11: 0000000000000246 R12: 0000556ebc63fcf0
[12665.304584] R13: 0000000000000000 R14: 0000000000000007 R15: 0000000000000000
[12665.304612] Code: 01 00 00 44 89 eb 45 31 ed 45 31 db 66 41 89 1e 66 41 89 5e 0c 66 45 89 5e 0e 49 8b 49 08 49 63 d4 4d 85 c0 49 63 ff 48 8b 14 d1 <48> 8b 72 30 41 8d 14 37 41 89 56 04 48 63 d3 0f 84 ce 00 00 00
[12665.304713] RIP: ohci_queue_iso+0x47c/0x800 [firewire_ohci] RSP: ffffb5b8823d3ab8
[12665.304743] CR2: 0000000000000030
[12665.317701] ---[ end trace 9d55b056dd52a19f ]---
Fixes: f91c9d7610a ('ALSA: firewire-lib: cache maximum length of payload to reduce function calls')
Cc: <stable(a)vger.kernel.org> # v4.12+
Signed-off-by: Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
---
sound/firewire/amdtp-stream.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c
index 4a1dc145327b..cb9acfe60f6a 100644
--- a/sound/firewire/amdtp-stream.c
+++ b/sound/firewire/amdtp-stream.c
@@ -773,8 +773,6 @@ static void amdtp_stream_first_callback(struct fw_iso_context *context,
u32 cycle;
unsigned int packets;
- s->max_payload_length = amdtp_stream_get_max_payload(s);
-
/*
* For in-stream, first packet has come.
* For out-stream, prepared to transmit first packet
@@ -879,6 +877,9 @@ int amdtp_stream_start(struct amdtp_stream *s, int channel, int speed)
amdtp_stream_update(s);
+ if (s->direction == AMDTP_IN_STREAM)
+ s->max_payload_length = amdtp_stream_get_max_payload(s);
+
if (s->flags & CIP_NO_HEADER)
s->tag = TAG_NO_CIP_HEADER;
else
--
2.14.1
This is the start of the stable review cycle for the 4.14.38 release.
There are 80 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun Apr 29 13:57:13 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.38-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.38-rc1
Hans de Goede <hdegoede(a)redhat.com>
ACPI / video: Only default only_lcd to true on Win8-ready _desktops_
Heiko Carstens <heiko.carstens(a)de.ibm.com>
s390/uprobes: implement arch_uretprobe_is_alive()
Stefan Haberland <sth(a)linux.vnet.ibm.com>
s390/dasd: fix IO error for newly defined devices
Sebastian Ott <sebott(a)linux.ibm.com>
s390/cio: update chpid descriptor after resource accessibility event
Peter Xu <peterx(a)redhat.com>
tracing: Fix missing tab for hwlat_detector print format
Finn Thain <fthain(a)telegraphics.com.au>
block/swim: Fix IO error at end of medium
Finn Thain <fthain(a)telegraphics.com.au>
block/swim: Fix array bounds check
Finn Thain <fthain(a)telegraphics.com.au>
block/swim: Select appropriate drive on device open
Finn Thain <fthain(a)telegraphics.com.au>
block/swim: Rename macros to avoid inconsistent inverted logic
Finn Thain <fthain(a)telegraphics.com.au>
block/swim: Remove extra put_disk() call from error path
Finn Thain <fthain(a)telegraphics.com.au>
block/swim: Don't log an error message for an invalid ioctl
Finn Thain <fthain(a)telegraphics.com.au>
block/swim: Check drive type
Finn Thain <fthain(a)telegraphics.com.au>
m68k/mac: Don't remap SWIM MMIO region
Robert Kolchmeyer <rkolchmeyer(a)google.com>
fsnotify: Fix fsnotify_mark_connector race
Dan Carpenter <dan.carpenter(a)oracle.com>
cdrom: information leak in cdrom_ioctl_media_changed()
Martin K. Petersen <martin.petersen(a)oracle.com>
scsi: mptsas: Disable WRITE SAME
Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
commoncap: Handle memory allocation failure.
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "mm/hmm: fix header file if/else/endif maze"
Klaus Goger <klaus.goger(a)theobroma-systems.com>
arm64: dts: rockchip: remove vdd_log from rk3399-puma
Michal Simek <michal.simek(a)xilinx.com>
microblaze: Setup dependencies for ASM optimized lib functions
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: correct module section names for expoline code revert
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: correct nospec auto detection init order
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: add sysfs attributes for spectre
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: report spectre mitigation via syslog
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: add automatic detection of the spectre defense
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: move nobp parameter functions to nospec-branch.c
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390/entry.S: fix spurious zeroing of r0
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: do not bypass BPENTER for interrupt system calls
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*)
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
KVM: s390: force bp isolation for VSIE
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: introduce execute-trampolines for branches
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: run user space and KVM guests with modified branch prediction
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: add options to change branch prediction behaviour for the kernel
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390/alternative: use a copy of the facility bit mask
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: add optimized array_index_mask_nospec
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: scrub registers on kernel entry and KVM exit
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
KVM: s390: wire up bpb feature
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: enable CPU alternatives unconditionally
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: introduce CPU alternatives
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "microblaze: fix endian handling"
Michael S. Tsirkin <mst(a)redhat.com>
virtio_net: fix adding vids on big-endian
Michael S. Tsirkin <mst(a)redhat.com>
virtio_net: split out ctrl buffer
Ivan Khoronzhuk <ivan.khoronzhuk(a)linaro.org>
net: ethernet: ti: cpsw: fix tx vlan priority mapping
Cong Wang <xiyou.wangcong(a)gmail.com>
llc: fix NULL pointer deref for SOCK_ZAPPED
Cong Wang <xiyou.wangcong(a)gmail.com>
llc: hold llc_sap before release_sock()
Alexander Aring <aring(a)mojatatu.com>
net: sched: ife: check on metadata length
Alexander Aring <aring(a)mojatatu.com>
net: sched: ife: handle malformed tlv length
Soheil Hassas Yeganeh <soheil(a)google.com>
tcp: clear tp->packets_out when purging write queue
Alexander Aring <aring(a)mojatatu.com>
net: sched: ife: signal not finding metaid
Doron Roberts-Kedes <doronrk(a)fb.com>
strparser: Fix incorrect strp->need_bytes value.
Tom Lendacky <thomas.lendacky(a)amd.com>
amd-xgbe: Only use the SFP supported transceiver signals
Doron Roberts-Kedes <doronrk(a)fb.com>
strparser: Do not call mod_delayed_work with a timeout of LONG_MAX
Tom Lendacky <thomas.lendacky(a)amd.com>
amd-xgbe: Improve KR auto-negotiation and training
Xin Long <lucien.xin(a)gmail.com>
sctp: do not check port in sctp_inet6_cmp_addr
Tom Lendacky <thomas.lendacky(a)amd.com>
amd-xgbe: Add pre/post auto-negotiation phy hooks
Toshiaki Makita <makita.toshiaki(a)lab.ntt.co.jp>
vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi
Guillaume Nault <g.nault(a)alphalink.fr>
pppoe: check sockaddr length in pppoe_connect()
Eric Dumazet <edumazet(a)google.com>
tipc: add policy for TIPC_NLA_NET_ADDR
Willem de Bruijn <willemb(a)google.com>
packet: fix bitfield update race
Xin Long <lucien.xin(a)gmail.com>
team: fix netconsole setup over team
Ursula Braun <ubraun(a)linux.vnet.ibm.com>
net/smc: fix shutdown in state SMC_LISTEN
Paolo Abeni <pabeni(a)redhat.com>
team: avoid adding twice the same option to the event list
Wolfgang Bumiller <w.bumiller(a)proxmox.com>
net: fix deadlock while clearing neighbor proxy table
Eric Dumazet <edumazet(a)google.com>
tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets
Eric Dumazet <edumazet(a)google.com>
net: af_packet: fix race in PACKET_{R|T}X_RING
Jann Horn <jannh(a)google.com>
tcp: don't read out-of-bounds opsize
Cong Wang <xiyou.wangcong(a)gmail.com>
llc: delete timers synchronously in llc_sk_free()
Eric Dumazet <edumazet(a)google.com>
net: validate attribute sizes in neigh_dump_table()
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: check sockaddr length in pppol2tp_connect()
Eric Biggers <ebiggers(a)google.com>
KEYS: DNS: limit the length of option strings
Ahmed Abdelsalam <amsalam20(a)gmail.com>
ipv6: sr: fix NULL pointer dereference in seg6_do_srh_encap()- v4 pkts
Eric Dumazet <edumazet(a)google.com>
ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy
Xin Long <lucien.xin(a)gmail.com>
bonding: do not set slave_dev npinfo before slave_enable_netpoll in bond_enslave
Karthikeyan Periyasamy <periyasa(a)codeaurora.org>
Revert "ath10k: send (re)assoc peer command when NSS changed"
James Bottomley <James.Bottomley(a)HansenPartnership.com>
tpm: add retry logic
Winkler, Tomas <tomas.winkler(a)intel.com>
tpm: tpm-interface: fix tpm_transmit/_cmd kdoc
Tomas Winkler <tomas.winkler(a)intel.com>
tpm: cmd_ready command can be issued only after granting locality
Paweł Jabłoński <pawel.jablonski(a)intel.com>
i40e: Fix attach VF to VM issue
Neil Armstrong <narmstrong(a)baylibre.com>
drm: bridge: dw-hdmi: Fix overflow workaround for Amlogic Meson GX SoCs
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "pinctrl: intel: Initialize GPIO properly when used through irqchip"
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 3 +
Makefile | 4 +-
arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 11 -
arch/microblaze/Kconfig.platform | 1 +
arch/microblaze/Makefile | 17 +-
arch/microblaze/lib/fastcopy.S | 4 -
arch/s390/Kconfig | 47 ++++
arch/s390/Makefile | 10 +
arch/s390/include/asm/alternative.h | 149 ++++++++++++
arch/s390/include/asm/barrier.h | 24 ++
arch/s390/include/asm/facility.h | 18 ++
arch/s390/include/asm/kvm_host.h | 3 +-
arch/s390/include/asm/lowcore.h | 7 +-
arch/s390/include/asm/nospec-branch.h | 17 ++
arch/s390/include/asm/processor.h | 4 +
arch/s390/include/asm/thread_info.h | 4 +
arch/s390/include/uapi/asm/kvm.h | 5 +-
arch/s390/kernel/Makefile | 6 +-
arch/s390/kernel/alternative.c | 112 +++++++++
arch/s390/kernel/early.c | 5 +
arch/s390/kernel/entry.S | 250 ++++++++++++++++++---
arch/s390/kernel/ipl.c | 1 +
arch/s390/kernel/module.c | 65 +++++-
arch/s390/kernel/nospec-branch.c | 169 ++++++++++++++
arch/s390/kernel/processor.c | 18 ++
arch/s390/kernel/setup.c | 14 +-
arch/s390/kernel/smp.c | 7 +-
arch/s390/kernel/uprobes.c | 9 +
arch/s390/kernel/vmlinux.lds.S | 37 +++
arch/s390/kvm/kvm-s390.c | 12 +
arch/s390/kvm/vsie.c | 30 +++
drivers/acpi/acpi_video.c | 27 ++-
drivers/block/swim.c | 49 ++--
drivers/block/swim3.c | 6 +-
drivers/cdrom/cdrom.c | 2 +-
drivers/char/tpm/tpm-interface.c | 131 ++++++++---
drivers/char/tpm/tpm.h | 1 +
drivers/char/tpm/tpm_crb.c | 108 ++++++---
drivers/char/tpm/tpm_tis_core.c | 4 +-
drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 3 +
drivers/message/fusion/mptsas.c | 1 +
drivers/net/bonding/bond_main.c | 3 +-
drivers/net/ethernet/amd/xgbe/xgbe-common.h | 8 +
drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c | 16 ++
drivers/net/ethernet/amd/xgbe/xgbe-main.c | 1 +
drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 24 +-
drivers/net/ethernet/amd/xgbe/xgbe-pci.c | 2 +
drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 196 ++++++++++++++--
drivers/net/ethernet/amd/xgbe/xgbe.h | 9 +
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 11 +
drivers/net/ethernet/ti/cpsw.c | 2 +-
drivers/net/ppp/pppoe.c | 4 +
drivers/net/team/team.c | 38 +++-
drivers/net/virtio_net.c | 68 +++---
drivers/net/wireless/ath/ath10k/mac.c | 5 +-
drivers/pinctrl/intel/pinctrl-intel.c | 23 +-
drivers/s390/block/dasd_alias.c | 13 +-
drivers/s390/char/Makefile | 2 +
drivers/s390/cio/chsc.c | 14 +-
include/linux/fsnotify_backend.h | 4 +-
include/linux/hmm.h | 9 +-
include/linux/if_vlan.h | 7 +-
include/linux/tpm.h | 2 +-
include/net/ife.h | 3 +-
include/net/llc_conn.h | 1 +
include/net/tcp.h | 1 +
include/uapi/linux/kvm.h | 1 +
kernel/trace/trace_entries.h | 2 +-
net/core/dev.c | 2 +-
net/core/neighbour.c | 40 ++--
net/dns_resolver/dns_key.c | 13 +-
net/ife/ife.c | 38 +++-
net/ipv4/tcp.c | 7 +-
net/ipv4/tcp_input.c | 7 +-
net/ipv6/route.c | 2 +
net/ipv6/seg6_iptunnel.c | 2 +-
net/l2tp/l2tp_ppp.c | 7 +
net/llc/af_llc.c | 14 +-
net/llc/llc_c_ac.c | 9 +-
net/llc/llc_conn.c | 22 +-
net/packet/af_packet.c | 83 ++++---
net/packet/internal.h | 10 +-
net/sched/act_ife.c | 9 +-
net/sctp/ipv6.c | 60 ++---
net/smc/af_smc.c | 10 +-
net/strparser/strparser.c | 9 +-
net/tipc/netlink.c | 3 +-
security/commoncap.c | 2 +
88 files changed, 1842 insertions(+), 371 deletions(-)
This is the start of the stable review cycle for the 4.9.97 release.
There are 74 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun Apr 29 13:56:52 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.97-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.97-rc1
Hans de Goede <hdegoede(a)redhat.com>
ACPI / video: Only default only_lcd to true on Win8-ready _desktops_
Heiko Carstens <heiko.carstens(a)de.ibm.com>
s390/uprobes: implement arch_uretprobe_is_alive()
Stefan Haberland <sth(a)linux.vnet.ibm.com>
s390/dasd: fix IO error for newly defined devices
Sebastian Ott <sebott(a)linux.ibm.com>
s390/cio: update chpid descriptor after resource accessibility event
Dan Carpenter <dan.carpenter(a)oracle.com>
cdrom: information leak in cdrom_ioctl_media_changed()
Martin K. Petersen <martin.petersen(a)oracle.com>
scsi: mptsas: Disable WRITE SAME
Doron Roberts-Kedes <doronrk(a)fb.com>
strparser: Fix incorrect strp->need_bytes value.
Eric Dumazet <edumazet(a)google.com>
ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy
Eric Dumazet <edumazet(a)google.com>
net: af_packet: fix race in PACKET_{R|T}X_RING
Eric Dumazet <edumazet(a)google.com>
tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets
Wolfgang Bumiller <w.bumiller(a)proxmox.com>
net: fix deadlock while clearing neighbor proxy table
Ivan Khoronzhuk <ivan.khoronzhuk(a)linaro.org>
net: ethernet: ti: cpsw: fix tx vlan priority mapping
Cong Wang <xiyou.wangcong(a)gmail.com>
llc: fix NULL pointer deref for SOCK_ZAPPED
Cong Wang <xiyou.wangcong(a)gmail.com>
llc: hold llc_sap before release_sock()
Alexander Aring <aring(a)mojatatu.com>
net: sched: ife: signal not finding metaid
Xin Long <lucien.xin(a)gmail.com>
sctp: do not check port in sctp_inet6_cmp_addr
Toshiaki Makita <makita.toshiaki(a)lab.ntt.co.jp>
vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi
Guillaume Nault <g.nault(a)alphalink.fr>
pppoe: check sockaddr length in pppoe_connect()
Eric Dumazet <edumazet(a)google.com>
tipc: add policy for TIPC_NLA_NET_ADDR
Willem de Bruijn <willemb(a)google.com>
packet: fix bitfield update race
Xin Long <lucien.xin(a)gmail.com>
team: fix netconsole setup over team
Paolo Abeni <pabeni(a)redhat.com>
team: avoid adding twice the same option to the event list
Jann Horn <jannh(a)google.com>
tcp: don't read out-of-bounds opsize
Cong Wang <xiyou.wangcong(a)gmail.com>
llc: delete timers synchronously in llc_sk_free()
Eric Dumazet <edumazet(a)google.com>
net: validate attribute sizes in neigh_dump_table()
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: check sockaddr length in pppol2tp_connect()
Eric Biggers <ebiggers(a)google.com>
KEYS: DNS: limit the length of option strings
Xin Long <lucien.xin(a)gmail.com>
bonding: do not set slave_dev npinfo before slave_enable_netpoll in bond_enslave
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: correct module section names for expoline code revert
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: correct nospec auto detection init order
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: add sysfs attributes for spectre
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: report spectre mitigation via syslog
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: add automatic detection of the spectre defense
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: move nobp parameter functions to nospec-branch.c
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390/entry.S: fix spurious zeroing of r0
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: do not bypass BPENTER for interrupt system calls
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*)
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
KVM: s390: force bp isolation for VSIE
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: introduce execute-trampolines for branches
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: run user space and KVM guests with modified branch prediction
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: add options to change branch prediction behaviour for the kernel
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390/alternative: use a copy of the facility bit mask
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: add optimized array_index_mask_nospec
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: scrub registers on kernel entry and KVM exit
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
KVM: s390: wire up bpb feature
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: enable CPU alternatives unconditionally
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: introduce CPU alternatives
Sinan Kaya <okaya(a)codeaurora.org>
PCI: Wait up to 60 seconds for device to become ready after FLR
Karthikeyan Periyasamy <periyasa(a)codeaurora.org>
Revert "ath10k: send (re)assoc peer command when NSS changed"
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "pinctrl: intel: Initialize GPIO properly when used through irqchip"
Grant Grundler <grundler(a)chromium.org>
r8152: add Linksys USB3GIGV1 id
Benjamin Beichler <benjamin.beichler(a)uni-rostock.de>
mac80211_hwsim: fix use-after-free bug in hwsim_exit_net
Imre Deak <imre.deak(a)intel.com>
drm/i915/bxt, glk: Increase PCODE timeouts during CDCLK freq changing
Leon Romanovsky <leonro(a)mellanox.com>
RDMA/mlx5: Fix NULL dereference while accessing XRC_TGT QPs
Jiri Olsa <jolsa(a)kernel.org>
perf: Return proper values for user stack errors
Jiri Olsa <jolsa(a)kernel.org>
perf: Fix sample_max_stack maximum check
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "perf tools: Decompress kernel module when reading DSO data"
Sahitya Tummala <stummala(a)codeaurora.org>
jbd2: fix use after free in kjournald2()
Felix Fietkau <nbd(a)nbd.name>
ath9k_hw: check if the chip failed to wake up
Paul Burton <paul.burton(a)imgtec.com>
OF: Prevent unaligned access in of_alias_scan()
Dan Carpenter <dan.carpenter(a)oracle.com>
stk-webcam: fix an endian bug in stk_camera_read_reg()
Colin Ian King <colin.king(a)canonical.com>
power: supply: bq2415x: check for NULL acpi_id to avoid null pointer dereference
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: drv260x - fix initializing overdrive voltage
Matt Redfearn <matt.redfearn(a)imgtec.com>
MIPS: Generic: Fix big endian CPUs on generic machine
Merlijn Wajer <merlijn(a)wizzup.org>
usb: musb: Fix external abort in musb_remove on omap2430
Merlijn Wajer <merlijn(a)wizzup.org>
usb: musb: call pm_runtime_{get,put}_sync before reading vbus registers
Andreas Kemnade <andreas(a)kemnade.info>
usb: musb: fix enumeration after resume
Jean Delvare <jdelvare(a)suse.de>
i2c: i801: Restore configuration at shutdown
Jean Delvare <jdelvare(a)suse.de>
i2c: i801: Save register SMBSLVCMD value only once
Benjamin Tissoires <benjamin.tissoires(a)redhat.com>
i2c: i801: store and restore the SLVCMD register at load and unload
Imre Deak <imre.deak(a)intel.com>
drm/i915: Fix LSPCON TMDS output buffer enabling from low-power state
Daniel J Blueman <daniel(a)quora.org>
drm/vc4: Fix memory leak during BO teardown
Xiaoming Gao <gxm.linux.kernel(a)gmail.com>
x86/tsc: Prevent 32bit truncation in calc_hpet_ref()
Steve French <smfrench(a)gmail.com>
cifs: do not allow creating sockets except with SMB1 posix exensions
-------------
Diffstat:
Documentation/kernel-parameters.txt | 3 +
Makefile | 4 +-
arch/mips/Kconfig | 1 +
arch/s390/Kconfig | 47 ++++++
arch/s390/Makefile | 10 ++
arch/s390/include/asm/alternative.h | 149 +++++++++++++++++
arch/s390/include/asm/barrier.h | 24 +++
arch/s390/include/asm/facility.h | 18 +++
arch/s390/include/asm/kvm_host.h | 3 +-
arch/s390/include/asm/lowcore.h | 7 +-
arch/s390/include/asm/nospec-branch.h | 17 ++
arch/s390/include/asm/processor.h | 4 +
arch/s390/include/asm/thread_info.h | 4 +
arch/s390/include/uapi/asm/kvm.h | 5 +-
arch/s390/kernel/Makefile | 6 +-
arch/s390/kernel/alternative.c | 112 +++++++++++++
arch/s390/kernel/early.c | 5 +
arch/s390/kernel/entry.S | 250 ++++++++++++++++++++++++++---
arch/s390/kernel/ipl.c | 1 +
arch/s390/kernel/module.c | 65 +++++++-
arch/s390/kernel/nospec-branch.c | 169 +++++++++++++++++++
arch/s390/kernel/processor.c | 18 +++
arch/s390/kernel/setup.c | 14 +-
arch/s390/kernel/smp.c | 7 +-
arch/s390/kernel/uprobes.c | 9 ++
arch/s390/kernel/vmlinux.lds.S | 37 +++++
arch/s390/kvm/kvm-s390.c | 13 +-
arch/s390/kvm/vsie.c | 30 ++++
arch/x86/kernel/tsc.c | 2 +-
drivers/acpi/acpi_video.c | 27 +++-
drivers/cdrom/cdrom.c | 2 +-
drivers/gpu/drm/drm_dp_dual_mode_helper.c | 39 ++++-
drivers/gpu/drm/i915/i915_drv.h | 6 +-
drivers/gpu/drm/i915/intel_display.c | 9 +-
drivers/gpu/drm/i915/intel_pm.c | 6 +-
drivers/gpu/drm/vc4/vc4_bo.c | 2 +
drivers/gpu/drm/vc4/vc4_validate_shaders.c | 1 +
drivers/i2c/busses/i2c-i801.c | 29 +++-
drivers/infiniband/hw/mlx5/qp.c | 3 +-
drivers/input/misc/drv260x.c | 2 +-
drivers/media/usb/stkwebcam/stk-sensor.c | 6 +-
drivers/media/usb/stkwebcam/stk-webcam.c | 11 +-
drivers/media/usb/stkwebcam/stk-webcam.h | 2 +-
drivers/message/fusion/mptsas.c | 1 +
drivers/net/bonding/bond_main.c | 3 +-
drivers/net/ethernet/ti/cpsw.c | 2 +-
drivers/net/ppp/pppoe.c | 4 +
drivers/net/team/team.c | 38 ++++-
drivers/net/usb/cdc_ether.c | 10 ++
drivers/net/usb/r8152.c | 2 +
drivers/net/wireless/ath/ath10k/mac.c | 5 +-
drivers/net/wireless/ath/ath9k/hw.c | 4 +
drivers/net/wireless/mac80211_hwsim.c | 7 +-
drivers/of/base.c | 2 +-
drivers/pci/pci.c | 52 ++++--
drivers/pinctrl/intel/pinctrl-intel.c | 23 +--
drivers/power/supply/bq2415x_charger.c | 5 +
drivers/s390/block/dasd_alias.c | 13 +-
drivers/s390/char/Makefile | 2 +
drivers/s390/cio/chsc.c | 14 +-
drivers/usb/musb/musb_core.c | 8 +-
fs/cifs/dir.c | 9 +-
fs/jbd2/journal.c | 2 +-
include/linux/if_vlan.h | 7 +-
include/net/llc_conn.h | 1 +
include/uapi/linux/kvm.h | 1 +
kernel/events/callchain.c | 21 +--
kernel/events/core.c | 4 +-
net/core/dev.c | 2 +-
net/core/neighbour.c | 40 +++--
net/dns_resolver/dns_key.c | 13 +-
net/ipv4/tcp.c | 6 +-
net/ipv4/tcp_input.c | 7 +-
net/ipv6/route.c | 2 +
net/l2tp/l2tp_ppp.c | 7 +
net/llc/af_llc.c | 14 +-
net/llc/llc_c_ac.c | 9 +-
net/llc/llc_conn.c | 22 ++-
net/packet/af_packet.c | 82 +++++++---
net/packet/internal.h | 10 +-
net/sched/act_ife.c | 2 +-
net/sctp/ipv6.c | 60 +++----
net/strparser/strparser.c | 7 +-
net/tipc/netlink.c | 3 +-
tools/perf/util/dso.c | 16 --
85 files changed, 1459 insertions(+), 262 deletions(-)
This is the start of the stable review cycle for the 3.18.107 release.
There are 24 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun Apr 29 13:56:20 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.107-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 3.18.107-rc1
Dan Carpenter <dan.carpenter(a)oracle.com>
cdrom: information leak in cdrom_ioctl_media_changed()
Martin K. Petersen <martin.petersen(a)oracle.com>
scsi: mptsas: Disable WRITE SAME
Eric Dumazet <edumazet(a)google.com>
ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy
Cong Wang <xiyou.wangcong(a)gmail.com>
llc: delete timers synchronously in llc_sk_free()
Eric Dumazet <edumazet(a)google.com>
net: af_packet: fix race in PACKET_{R|T}X_RING
Eric Dumazet <edumazet(a)google.com>
tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets
Willem de Bruijn <willemb(a)google.com>
packet: fix bitfield update race
Cong Wang <xiyou.wangcong(a)gmail.com>
llc: fix NULL pointer deref for SOCK_ZAPPED
Cong Wang <xiyou.wangcong(a)gmail.com>
llc: hold llc_sap before release_sock()
Guillaume Nault <g.nault(a)alphalink.fr>
pppoe: check sockaddr length in pppoe_connect()
Xin Long <lucien.xin(a)gmail.com>
team: fix netconsole setup over team
Paolo Abeni <pabeni(a)redhat.com>
team: avoid adding twice the same option to the event list
Jann Horn <jannh(a)google.com>
tcp: don't read out-of-bounds opsize
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: check sockaddr length in pppol2tp_connect()
Eric Biggers <ebiggers(a)google.com>
KEYS: DNS: limit the length of option strings
Xin Long <lucien.xin(a)gmail.com>
bonding: do not set slave_dev npinfo before slave_enable_netpoll in bond_enslave
Sahitya Tummala <stummala(a)codeaurora.org>
jbd2: fix use after free in kjournald2()
Matthew Wilcox <mawilcox(a)microsoft.com>
mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
Jiri Olsa <jolsa(a)kernel.org>
perf: Return proper values for user stack errors
Theodore Ts'o <tytso(a)mit.edu>
ext4: don't update checksum of new initialized bitmaps
wangguang <wang.guang55(a)zte.com.cn>
ext4: bugfix for mmaped pages in mpage_release_unused_pages()
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix deadlock between inline_data and ext4_expand_extra_isize_ea()
Xiaoming Gao <gxm.linux.kernel(a)gmail.com>
x86/tsc: Prevent 32bit truncation in calc_hpet_ref()
Steve French <smfrench(a)gmail.com>
cifs: do not allow creating sockets except with SMB1 posix exensions
-------------
Diffstat:
Makefile | 4 +-
arch/x86/kernel/tsc.c | 2 +-
drivers/cdrom/cdrom.c | 2 +-
drivers/message/fusion/mptsas.c | 1 +
drivers/net/bonding/bond_main.c | 3 +-
drivers/net/ppp/pppoe.c | 4 ++
drivers/net/team/team.c | 38 ++++++++++++++----
fs/cifs/dir.c | 9 +++--
fs/ext4/balloc.c | 3 +-
fs/ext4/ialloc.c | 43 ++------------------
fs/ext4/inline.c | 66 ++++++++++++++-----------------
fs/ext4/inode.c | 2 +
fs/ext4/xattr.c | 30 ++++++--------
fs/ext4/xattr.h | 32 +++++++++++++++
fs/jbd2/journal.c | 2 +-
include/net/llc_conn.h | 1 +
kernel/events/core.c | 4 +-
mm/filemap.c | 4 +-
net/dns_resolver/dns_key.c | 13 +++---
net/ipv4/tcp.c | 6 ++-
net/ipv4/tcp_input.c | 7 +---
net/ipv6/route.c | 2 +
net/l2tp/l2tp_ppp.c | 7 ++++
net/llc/af_llc.c | 14 ++++++-
net/llc/llc_c_ac.c | 9 +----
net/llc/llc_conn.c | 22 ++++++++++-
net/packet/af_packet.c | 88 +++++++++++++++++++++++++++++------------
net/packet/internal.h | 10 ++---
28 files changed, 254 insertions(+), 174 deletions(-)
Hi,
This 4th version of the series which fixes %p uses in kprobes.
Some by replacing with %pS, some by replacing with %px but
masking with kallsyms_show_value().
I've read the thread about %pK and if I understand correctly
we shouldn't print kernel addresses. However, kprobes debugfs
interface can not stop to show the actual probe address because
it should be compared with addresses in kallsyms for debugging.
So, it depends on that kallsyms_show_value() allows to show
address to user, because if it returns true, anyway that user
can dump /proc/kallsyms.
Other error messages are replaced it with %pS or just removed.
This series also including fixes for arch ports too.
Changes in this version;
[1/7] Fix "list" file's mode too.
[2/7] Do not use local variables and fix comment.
[4/7] Use WARN_ONCE() for single bug.
[5/7] Just remove %p.
Thank you,
---
Masami Hiramatsu (7):
kprobes: Make list and blacklist root user read only
kprobes: Show blacklist addresses as same as kallsyms does
kprobes: Show address of kprobes if kallsyms does
kprobes: Replace %p with other pointer types
kprobes/x86: Fix %p uses in error messages
kprobes/arm: Fix %p uses in error messages
kprobes/arm64: Fix %p uses in error messages
arch/arm/probes/kprobes/core.c | 10 +++----
arch/arm/probes/kprobes/test-core.c | 1 -
arch/arm64/kernel/probes/kprobes.c | 4 +--
arch/x86/kernel/kprobes/core.c | 13 +++------
kernel/kprobes.c | 52 +++++++++++++++++++++--------------
5 files changed, 42 insertions(+), 38 deletions(-)
--
Masami Hiramatsu (Linaro) <mhiramat(a)kernel.org>