May 2019 - Linux-stable-mirror

by Kees Cook

Hi Greg, Can you please add these two pstore fixes to 4.14 please? They are prerequisites for another fix I'll be sending to Linus soon that'll be needed in 4.14 (to fix the bug Yaro ran into). b77fa617a2ff ("pstore: Remove needless lock during console writes") ea84b580b955 ("pstore: Convert buf_lock to semaphore") Thanks! -- Kees Cook

5 years, 5 months

2
3
0 0

[PATCH AUTOSEL 4.9 01/25] iio: adc: xilinx: fix potential use-after-free on remove

by Sasha Levin

From: Sven Van Asbroeck <thesven73(a)gmail.com> [ Upstream commit 62039b6aef63380ba7a37c113bbaeee8a55c5342 ] When cancel_delayed_work() returns, the delayed work may still be running. This means that the core could potentially free the private structure (struct xadc) while the delayed work is still using it. This is a potential use-after-free. Fix by calling cancel_delayed_work_sync(), which waits for any residual work to finish before returning. Signed-off-by: Sven Van Asbroeck <TheSven73(a)gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/iio/adc/xilinx-xadc-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c index 56cf5907a5f0..143894a315d9 100644 --- a/drivers/iio/adc/xilinx-xadc-core.c +++ b/drivers/iio/adc/xilinx-xadc-core.c @@ -1299,7 +1299,7 @@ static int xadc_remove(struct platform_device *pdev) } free_irq(irq, indio_dev); clk_disable_unprepare(xadc->clk); - cancel_delayed_work(&xadc->zynq_unmask_work); + cancel_delayed_work_sync(&xadc->zynq_unmask_work); kfree(xadc->data); kfree(indio_dev->channels); -- 2.20.1

5 years, 5 months

3
26
0 0

[PATCH v5] x86/mm/KASLR: Fix the size of vmemmap section

by Baoquan He

kernel_randomize_memory() hardcodes the size of vmemmap section as 1 TB, to support the maximum amount of system RAM in 4-level paging mode, 64 TB. However, 1 TB is not enough for vmemmap in 5-level paging mode. Assuming the size of struct page is 64 Bytes, to support 4 PB system RAM in 5-level, 64 TB of vmemmap area is needed. The wrong hardcoding may cause vmemmap stamping into the following cpu_entry_area section, if KASLR puts vmemmap very close to cpu_entry_area , and the actual area of vmemmap is much bigger than 1 TB. So here calculate the actual size of vmemmap region, then align up to 1 TB boundary. In 4-level it's always 1 TB. In 5-level it's adjusted on demand. The current code reserves 0.5 PB for vmemmap in 5-level. In this new way, the left space can be saved to join randomization to increase the entropy. Fiexes: eedb92abb9bb ("x86/mm: Make virtual memory layout dynamic for CONFIG_X86_5LEVEL=y") Signed-off-by: Baoquan He <bhe(a)redhat.com> Acked-by: Kirill A. Shutemov <kirill(a)linux.intel.com> Reviewed-by: Kees Cook <keescook(a)chromium.org> Cc: stable(a)vger.kernel.org --- v4->v5: Add Fixes tag and Cc to stable. v3->v4: Fix the incorrect style of code comment; Add ack tags from Kirill and Kees. v3 discussion is here: http://lkml.kernel.org/r/20190422091045.GB3584@localhost.localdomain arch/x86/mm/kaslr.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/arch/x86/mm/kaslr.c b/arch/x86/mm/kaslr.c index dc3f058bdf9b..c0eedb85a92f 100644 --- a/arch/x86/mm/kaslr.c +++ b/arch/x86/mm/kaslr.c @@ -52,7 +52,7 @@ static __initdata struct kaslr_memory_region { } kaslr_regions[] = { { &page_offset_base, 0 }, { &vmalloc_base, 0 }, - { &vmemmap_base, 1 }, + { &vmemmap_base, 0 }, }; /* Get size in bytes used by the memory region */ @@ -78,6 +78,7 @@ void __init kernel_randomize_memory(void) unsigned long rand, memory_tb; struct rnd_state rand_state; unsigned long remain_entropy; + unsigned long vmemmap_size; vaddr_start = pgtable_l5_enabled() ? __PAGE_OFFSET_BASE_L5 : __PAGE_OFFSET_BASE_L4; vaddr = vaddr_start; @@ -109,6 +110,14 @@ void __init kernel_randomize_memory(void) if (memory_tb < kaslr_regions[0].size_tb) kaslr_regions[0].size_tb = memory_tb; + /* + * Calculate how many TB vmemmap region needs, and aligned to + * 1TB boundary. + */ + vmemmap_size = (kaslr_regions[0].size_tb << (TB_SHIFT - PAGE_SHIFT)) * + sizeof(struct page); + kaslr_regions[2].size_tb = DIV_ROUND_UP(vmemmap_size, 1UL << TB_SHIFT); + /* Calculate entropy available between regions */ remain_entropy = vaddr_end - vaddr_start; for (i = 0; i < ARRAY_SIZE(kaslr_regions); i++) -- 2.17.2

5 years, 5 months

3
3
0 0

[PATCH, RESEND] RDMA/srp: Accept again source addresses that do not have a port number

by Bart Van Assche

The function srp_parse_in() is used both for parsing source address specifications and for target address specifications. Target addresses must have a port number. Having to specify a port number for source addresses is inconvenient. Make sure that srp_parse_in() supports again parsing addresses with no port number. Cc: Laurence Oberman <loberman(a)redhat.com> Cc: <stable(a)vger.kernel.org> Fixes: c62adb7def71 ("IB/srp: Fix IPv6 address parsing") # v4.17. Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> --- drivers/infiniband/ulp/srp/ib_srp.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index be9ddcad8f28..87848faa7502 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -3481,13 +3481,14 @@ static const match_table_t srp_opt_tokens = { * @net: [in] Network namespace. * @sa: [out] Address family, IP address and port number. * @addr_port_str: [in] IP address and port number. + * @has_port: [out] Whether or not @addr_port_str includes a port number. * * Parse the following address formats: * - IPv4: <ip_address>:<port>, e.g. 1.2.3.4:5. * - IPv6: \[<ipv6_address>\]:<port>, e.g. [1::2:3%4]:5. */ static int srp_parse_in(struct net *net, struct sockaddr_storage *sa, - const char *addr_port_str) + const char *addr_port_str, bool *has_port) { char *addr_end, *addr = kstrdup(addr_port_str, GFP_KERNEL); char *port_str; @@ -3496,9 +3497,12 @@ static int srp_parse_in(struct net *net, struct sockaddr_storage *sa, if (!addr) return -ENOMEM; port_str = strrchr(addr, ':'); - if (!port_str) - return -EINVAL; - *port_str++ = '\0'; + if (port_str && strchr(port_str, ']')) + port_str = NULL; + if (port_str) + *port_str++ = '\0'; + if (has_port) + *has_port = port_str != NULL; ret = inet_pton_with_scope(net, AF_INET, addr, port_str, sa); if (ret && addr[0]) { addr_end = addr + strlen(addr) - 1; @@ -3520,6 +3524,7 @@ static int srp_parse_options(struct net *net, const char *buf, char *p; substring_t args[MAX_OPT_ARGS]; unsigned long long ull; + bool has_port; int opt_mask = 0; int token; int ret = -EINVAL; @@ -3618,7 +3623,8 @@ static int srp_parse_options(struct net *net, const char *buf, ret = -ENOMEM; goto out; } - ret = srp_parse_in(net, &target->rdma_cm.src.ss, p); + ret = srp_parse_in(net, &target->rdma_cm.src.ss, p, + NULL); if (ret < 0) { pr_warn("bad source parameter '%s'\n", p); kfree(p); @@ -3634,7 +3640,10 @@ static int srp_parse_options(struct net *net, const char *buf, ret = -ENOMEM; goto out; } - ret = srp_parse_in(net, &target->rdma_cm.dst.ss, p); + ret = srp_parse_in(net, &target->rdma_cm.dst.ss, p, + &has_port); + if (!has_port) + ret = -EINVAL; if (ret < 0) { pr_warn("bad dest parameter '%s'\n", p); kfree(p); -- 2.22.0.rc1

5 years, 5 months

2
3
0 0

[PATCH 3.16 000/305] 3.16.63-rc1 review

by Ben Hutchings

This is the start of the stable review cycle for the 3.16.63 release. There are 305 patches in this series, which will be posted as responses to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri Feb 08 18:00:00 UTC 2019. Anything received after that time might be too late. All the patches have also been committed to the linux-3.16.y-rc branch of https://git.kernel.org/pub/scm/linux/kernel/git/bwh/linux-stable-rc.git . A shortlog and diffstat can be found below. Ben. ------------- Aaro Koskinen (1): MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310 [e8cde625bfe8a714a856e1366bcbb259d7346095] Aaron Ma (2): usb: xhci: fix timeout for transition from RExit to U0 [a5baeaeabcca3244782a9b6382ebab6f8a58f583] usb: xhci: fix uninitialized completion when USB3 port got wrong status [958c0bd86075d4ef1c936998deefe1947e539240] Ahmad Fatoum (1): mtd: spi-nor: fsl-quadspi: Don't let -EINVAL on the bus [000412276370a9bcfec73b3752ceefd9a927f1db] Al Viro (2): gfs2_meta: ->mount() can get NULL dev_name [3df629d873f8683af6f0d34dfc743f637966d483] new helper: uaccess_kernel() [db68ce10c4f0a27c1ff9fa0e789e5c41f8c4ea63] Alex Stanoev (1): ALSA: ca0106: Disable IZD on SB0570 DAC to fix audio pops [ac237c28d5ac1b241d58b1b7b4b9fa10efb22fb5] Alexander Theissen (1): usb: appledisplay: Add 27" Apple Cinema Display [d7859905301880ad3e16272399d26900af3ac496] Amir Goldstein (1): lockd: fix access beyond unterminated strings in prints [93f38b6fae0ea8987e22d9e6c38f8dfdccd867ee] Anders Roxell (1): cpupower: remove stringop-truncation waring [8a7e2d2ea080d10a189a1d611344b0330468ebc3] Andrea Parri (1): uprobes: Fix handle_swbp() vs. unregister() + register() race once more [09d3f015d1e1b4fee7e9bbdcf54201d239393391] Andreas Kemnade (1): w1: omap-hdq: fix missing bus unregister at removal [a007734618fee1bf35556c04fa498d41d42c7301] Andreas Larsson (1): sparc32: Fix inverted invalid_frame_pointer checks on sigreturns [07b5ab3f71d318e52c18cc3b73c1d44c908aacfa] Andy Lutomirski (1): x86/vdso: Fix vDSO syscall fallback asm constraint regression [02e425668f5c9deb42787d10001a3b605993ad15] Anssi Hannula (2): net: macb: add missing barriers when reading descriptors [6e0af298066f3b6d99f58989bb0dca6f764b4c6d] net: macb: fix dropped RX frames due to a race [8159ecab0db9095902d4c73605fb8787f5c7d653] Arnd Bergmann (4): ARM: fix put_user() for gcc-8 [9f73bd8bb445e0cbe4bcef6d4cfc788f1e184007] kbuild: fix kernel/bounds.c 'W=1' warning [6a32c2469c3fbfee8f25bcd20af647326650a6cf] mtd: docg3: don't set conflicting BCH_CONST_PARAMS option [be2e1c9dcf76886a83fb1c433a316e26d4ca2550] turn off -Wattribute-alias [bee20031772af3debe8cbaa234528f24c7892e8f] Aya Levin (1): net/mlx4: Fix UBSAN warning of signed integer overflow [a463146e67c848cbab5ce706d6528281b7cded08] Ben Greear (1): mac80211: Clear beacon_int in ieee80211_do_stop [5c21e8100dfd57c806e833ae905e26efbb87840f] Ben Hutchings (3): ipv6: Fix another sparse warning on rt6i_node [not upstream; function has been removed] s390/dasd: Restore a necessary cast [not upstream; variable type has been changed] x86/boot: eboot.c: Include string function declarations [393f203f5fd54421fddb1e2a263f64d3876eeadb] Benjamin Poirier (1): xfrm: Fix bucket count reported to userspace [ca92e173ab34a4f7fc4128bd372bd96f1af6f507] Bin Meng (1): PCI: Add Device IDs for Intel GPU "spurious interrupt" quirk [d0c9606b31a21028fb5b753c8ad79626292accfd] Breno Leitao (1): HID: hiddev: fix potential Spectre v1 [f11274396a538b31bc010f782e05c2ce3f804c13] Carlos Maiolino (1): xfs: Fix xqmstats offsets in /proc/fs/xfs/xqmstat [41657e5507b13e963be906d5d874f4f02374fd5c] Chad Austin (1): fuse: continue to send FUSE_RELEASEDIR when FUSE_OPEN returns ENOSYS [2e64ff154ce6ce9a8dc0f9556463916efa6ff460] Changwei Ge (1): ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry [29aa30167a0a2e6045a0d6d2e89d8168132333d5] Chen Gang (1): s390/timex: fix get_tod_clock_ext() inline assembly [e38f97813302065fbc9c9eab5c1a94dc021d71e2] Chris Mason (1): Btrfs: don't clean dirty pages during buffered writes [7703bdd8d23e6ef057af3253958a793ec6066b28] Chris Wilson (1): drm/i915: Large page offsets for pread/pwrite [a5e856a5348f6cd50889d125c40bbeec7328e466] Christian Hoff (1): Input: matrix_keypad - check for errors from of_get_named_gpio() [d55bda1b3e7c5a87f10da54fdda866a9a9cef30b] Christophe Leroy (1): gpio: max7301: fix driver for use with CONFIG_VMAP_STACK [abf221d2f51b8ce7b9959a8953f880a8b0a1400d] Chuck Lever (1): SUNRPC: Fix leak of krb5p encode pages [8dae5398ab1ac107b1517e8195ed043d5f422bd0] Colin Ian King (3): media: cx231xx: fix potential sign-extension overflow on large shift [32ae592036d7aeaabcccb2b1715373a68639a768] vxge: ensure data0 is initialized in when fetching firmware version information [f7db2beb4c2c6cc8111f5ab90fc7363ca91107b6] x86/mtrr: Don't copy uninitialized gentry fields back to userspace [32043fa065b51e0b1433e48d118821c71b5cd65d] Dan Carpenter (6): bnx2fc: fix an error code in _bnx2fc_create() [2043e1fd09c1896bb03a6e25b64baa84a30879c9] libertas_tf: prevent underflow in process_cmdrequest() [3348ef6a6a126706d6a73ed40c18d8033df72783] qlcnic: fix a return in qlcnic_dcb_get_capability() [c94f026fb742b2d3199422751dbc4f6fc0e753d8] scsi: bnx2fc: Fix NULL dereference in error handling [9ae4f8420ed7be4b13c96600e3568c144d101a23] staging: comedi: quatech_daqp_cs: fix no-op loop daqp_ao_insn_write() [1376b0a2160319125c3a2822e8c09bd283cd8141] uio: Fix an Oops on load [432798195bbce1f8cd33d1c0284d0538835e25fb] Dennis Wassenberg (1): usb: core: Fix hub port connection events lost [22454b79e6de05fa61a2a72d00d2eed798abbb75] Dexuan Cui (4): Drivers: hv: kvp: Fix the recent regression caused by incorrect clean-up [e670de54c813b5bc3672dd1c67871dc60e9206f4] Drivers: hv: kvp: Fix two "this statement may fall through" warnings [fc62c3b1977d62e6374fd6e28d371bb42dfa5c9d] Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels [fc96df16a1ce80cbb3c316ab7d4dc8cd5c2852ce] Drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl() [eceb05965489784f24bbf4d61ba60e475a983016] Diego Viola (2): libata: Apply NOLPM quirk for SAMSUNG MZ7TD256HAFV-000L9 [a435ab4f80f983c53b4ca4f8c12b3ddd3ca17670] libata: blacklist SAMSUNG MZ7TD256HAFV-000L9 SSD [410b5c7b48368317af95f0113692561d01d8144e] Dmitry Bazhenov (1): hwmon: (pmbus) Fix page count auto-detection. [e7c6a55606b5c46b449d76588968b4d8caae903f] Dmitry Bilunov (1): KVM: Handle MSR_IA32_PERF_CTL [0c2df2a1affd183ba9c114915f42a2d464b4f58f] Dmitry V. Levin (1): mips: fix mips_get_syscall_arg o32 check [c50cbd85cd7027d32ac5945bb60217936b4f7eaf] Eduardo Habkost (1): kvm: x86: Add AMD's EX_CFG to the list of ignored MSRs [0e1b869fff60c81b510c2d00602d778f8f59dd9a] Emmanuel Grumbach (1): mac80211: ignore NullFunc frames in the duplicate detection [990d71846a0b7281bd933c34d734e6afc7408e7e] Emmanuel Pescosta (1): usb: quirks: Add delay-init quirk for Corsair K70 LUX RGB [a77112577667cbda7c6292c52d909636aef31fd9] Enric Balletbo i Serra (1): PM / devfreq: Fix devfreq_add_device() when drivers are built as modules. [23c7b54ca1cd1797ef39169ab85e6d46f1c2d061] Eric Biggers (2): HID: uhid: forbid UHID_CREATE under KERNEL_DS or elevated privileges [8c01db7619f07c85c5cd81ec5eb83608b56c88f5] ima: fix showing large 'violations' or 'runtime_measurements_count' [1e4c8dafbb6bf72fb5eca035b861e39c5896c2b7] Eric Dumazet (4): ipv6: tunnels: fix two use-after-free [cbb49697d5512ce9e61b45ce75d3ee43d7ea5524] llc: do not use sk_eat_skb() [604d415e2bd642b7e02c80e719e0396b9d4a77a6] net-gro: reset skb->pkt_type in napi_reuse_skb() [33d9a2c72f086cbf1087b2fd2d1a15aa9df14a7f] rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices [688838934c231bb08f46db687e57f6d8bf82709c] Eric W. Biederman (5): mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts [df7342b240185d58d3d9665c0bbf0a0f5570ec29] mount: Prevent MNT_DETACH from disconnecting locked mounts [9c8e0a1b683525464a2abe9fb4b54404a50ed2b4] mount: Retest MNT_LOCKED in do_umount [25d202ed820ee347edec0bf3bf553544556bf64b] signal/GenWQE: Fix sending of SIGKILL [0ab93e9c99f8208c0a1a7b7170c827936268c996] signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace init [3597dfe01d12f570bc739da67f857fd222a3ea66] Erik Schmauss (1): ACPICA: AML interpreter: add region addresses in global list during initialization [4abb951b73ff0a8a979113ef185651aa3c8da19b] Eugen Hristev (2): iio: adc: at91: fix acking DRDY irq on simple conversions [bc1b45326223e7e890053cf6266357adfa61942d] iio: adc: at91: fix wrong channel number in triggered buffer mode [aea835f2dc8a682942b859179c49ad1841a6c8b9] Felipe Balbi (1): Revert "usb: dwc3: gadget: skip Set/Clear Halt when invalid" [38317f5c0f2faae5110854f36edad810f841d62f] Felix Fietkau (1): mac80211: fix reordering of buffered broadcast packets [9ec1190d065998650fd9260dea8cf3e1f56c0e8c] Filipe Manana (5): Btrfs: ensure path name is null terminated at btrfs_control_ioctl [f505754fd6599230371cb01b9332754ddc104be1] Btrfs: fix data corruption due to cloning of eof block [ac765f83f1397646c11092a032d4f62c3d478b81] Btrfs: fix null pointer dereference on compressed write path error [3527a018c00e5dbada2f9d7ed5576437b6dd5cfb] Btrfs: fix race between enabling quotas and subvolume creation [552f0329c75b3e1d7f9bb8c9e421d37403f192cd] Btrfs: fix use-after-free when dumping free space [9084cb6a24bf5838a665af92ded1af8363f9e563] Finn Thain (1): scsi: esp_scsi: Track residual for PIO transfers [fd47d919d0c336e7c22862b51ee94927ffea227a] Florian Fainelli (1): net: phy: Stop with excessive soft reset [6e2d85ec05591b739059f65fe8438c9c5999f7d8] Florian Westphal (4): netfilter: nf_tables: don't use position attribute on rule replacement [447750f281abef547be44fdcfe3bc4447b3115a8] netfilter: nf_tables: fix oob access [3e38df136e453aa69eb4472108ebce2fb00b1ba6] netfilter: nf_tables: fix use-after-free when deleting compat expressions [29e3880109e357fdc607b4393f8308cef6af9413] netfilter: x_tables: add and use xt_check_proc_name [b1d0a5d0cba4597c0394997b2d5fced3e3841b4e] Frank Sorenson (1): sunrpc: correct the computation for page_ptr when truncating [5d7a5bcb67c70cbc904057ef52d3fcfeb24420bb] François Cami (1): libata: Apply NOLPM quirk for SAMSUNG PM830 CXM13D1Q. [76936e9a6df17b89481bd2655c8684291afbe656] Geert Uytterhoeven (4): iommu/ipmmu-vmsa: Fix crash on early domain free [e5b78f2e349eef5d4fca5dc1cf5a3b4b2cc27abd] thermal: rcar: Make error and remove paths symmetrical with init [ac71c7025ebc1ed25114b1be77dc60b7f8cb8544] thermal: rcar_thermal: Prevent doing work after unbind [697ee786f15d7b65c7f3045d45fe3a05d28e0911] thermal: rcar_thermal: Prevent hardware access during system suspend [3a31386217628ffe2491695be2db933c25dde785] Gustavo A. R. Silva (2): drivers/misc/sgi-gru: fix Spectre v1 vulnerability [fee05f455ceb5c670cbe48e2f9454ebc4a388554] drm/ioctl: Fix Spectre v1 vulnerabilities [505b5240329b922f21f91d5b5d1e535c805eca6d] H Hartley Sweeten (2): staging: comedi: quatech_daqp_cs: fix bug in daqp_ao_insn_write() [e024181b02ed6b833358bede3f2d0c52cb5fb6bc] staging: comedi: quatech_daqp_cs: use comedi_timeout() in ao (*insn_write) [e031642eccc040648b09cfc7d632e2e8d0b6f94f] H. Peter Anvin (2): arch/alpha, termios: implement BOTHER, IBSHIFT and termios2 [d0ffb805b729322626639336986bc83fc2e60871] termios, tty/tty_baudrate.c: fix buffer overrun [991a25194097006ec1e0d2e0814ff920e59e3465] Halil Pasic (2): virtio/s390: avoid race on vcdev->config [2448a299ec416a80f699940a86f4a6d9a4f643b1] virtio/s390: fix race in ccw_io_helper() [78b1a52e05c9db11d293342e8d6d8a230a04b4e7] Hangbin Liu (1): team: no need to do team_notify_peers or team_mcast_rejoin when disabling port [5ed9dc99107144f83b6c1bb52a69b58875baf540] Hans Verkuil (1): media: vb2: don't call __vb2_queue_cancel if vb2_start_streaming failed [04990215dec43c424daff00d1f622167b8aafd1f] Hans de Goede (3): ACPI / platform: Add SMB0001 HID to forbidden_id_list [2bbb5fa37475d7aa5fa62f34db1623f3da2dfdfa] iio/hid-sensors: Fix IIO_CHAN_INFO_RAW returning wrong values for signed numbers [0145b50566e7de5637e80ecba96c7f0e6fff1aad] libata: Apply NOLPM quirk for SAMSUNG MZMPC128HBFU-000MV SSD [b5b4d3a52c8fd6e3fc6469c5a64ca0139c07229e] Harry Pan (1): usb: quirk: add no-LPM quirk on SanDisk Ultra Flair device [2f2dde6ba89b1ef1fe23c1138131b315d9aa4019] He Zhe (3): kgdboc: Passing ekgdboc to command line causes panic [1bd54d851f50dea6af30c3e6ff4f3e9aab5558f9] printk: Fix panic caused by passing log_buf_len to command line [277fcdb2cfee38ccdbe07e705dbd4896ba0c9930] x86/corruption-check: Fix panic in memory_corruption_check() when boot option without value is provided [ccde460b9ae5c2bd5e4742af0a7f623c2daad566] Helge Deller (1): parisc: Fix map_pages() to not overwrite existing pte entries [3c229b3f2dd8133f61bb81d3cb018be92f4bba39] Himanshu Madhani (1): scsi: qla2xxx: Fix incorrect port speed being set for FC adapters [4c1458df9635c7e3ced155f594d2e7dfd7254e21] Hou Tao (1): jffs2: free jffs2_sb_info through jffs2_kill_sb() [92e2921f7eee63450a5f953f4b15dc6210219430] Huacai Chen (1): hwmon: (w83795) temp4_type has writable permission [09aaf6813cfca4c18034fda7a43e68763f34abb1] Hui Peng (1): ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c [5f8cf712582617d523120df67d392059eaf2fc4b] Ido Schimmel (1): rtnetlink: Disallow FDB configuration for non-Ethernet device [da71577545a52be3e0e9225a946e5fd79cfab015] Ilya Dryomov (1): libceph: bump CEPH_MSG_MAX_DATA_LEN [94e6992bb560be8bffb47f287194adf070b57695] Ingo Molnar (1): timer/debug: Change /proc/timer_list from 0444 to 0400 [8e7df2b5b7f245c9bd11064712db5cb69044a362] Jakub Kicinski (1): net: sched: gred: pass the right attribute to gred_change_table_def() [38b4f18d56372e1e21771ab7b0357b853330186c] Janusz Krzysztofik (1): ARM: OMAP1: ams-delta: Fix possible use of uninitialized field [cec83ff1241ec98113a19385ea9e9cfa9aa4125b] Jason Wang (1): vhost: make sure used idx is seen before log in vhost_add_used_n() [841df922417eb82c835e93d4b93eb6a68c99d599] Jeff Mahoney (1): btrfs: fix error handling in btrfs_dev_replace_start [5c06147128fbbdf7a84232c5f0d808f53153defe] Jeff Moyer (1): aio: fix spectre gadget in lookup_ioctx [a538e3ff9dabcdf6c3f477a373c629213d1c3066] Jens Axboe (2): floppy: fix race condition in __floppy_read_block_0() [de7b75d82f70c5469675b99ad632983c50b6f7e7] scsi: sd: use mempool for discard special page [61cce6f6eeced5ddd9cac55e807fe28b4f18c1ba] Jeremy Cline (1): ALSA: hda - Add mic quirk for the Lenovo G50-30 (17aa:3905) [e7bb6ad5685f05685dd8a6a5eda7bfcd14d5f95b] Jim Mattson (2): KVM: nVMX: Always reflect #NM VM-exits to L1 [3c6e099fa15fdb6fb1892199ed8709012e1294f2] kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb [fd65d3142f734bc4376053c8d75670041903134d] Jiri Kosina (1): x86/speculation: Apply IBPB more strictly to avoid cross-process data leak [dbfe2953f63c640463c630746cd5d9de8b2f63ae] Joe Jin (1): xen-swiotlb: use actually allocated size on check physical continuous [7250f422da0480d8512b756640f131b9b893ccda] Johan Hovold (3): USB: serial: cypress_m8: fix interrupt-out transfer length [56445eef55cb5904096fed7a73cf87b755dfffc7] net: bcmgenet: fix OF child-node lookup [d397dbe606120a1ea1b11b0020c3f7a3852da5ac] of: add helper to lookup compatible child node [36156f9241cb0f9e37d998052873ca7501ad4b36] John David Anglin (1): parisc: Fix address in HPMC IVA [1138b6718ff74d2a934459643e3754423d23b5e2] Jorgen Hansen (2): VMCI: Resource wildcard match fixed [11924ba5e671d6caef1516923e2bd8c72929a3fe] VSOCK: Send reset control packet when socket is partially bound [a915b982d8f5e4295f64b8dd37ce753874867e88] Josef Bacik (1): btrfs: wait on caching when putting the bg cache [3aa7c7a31c26321696b92841d5103461c6f3f517] Juergen Gross (1): x86/pae: use 64 bit atomic xchg function in native_ptep_get_and_clear [b2d7a075a1ccef2fb321d595802190c8e9b39004] Julian Wiedmann (2): s390/qeth: fix length check in SNMP processing [9a764c1e59684c0358e16ccaafd870629f2cfe67] s390/qeth: invoke softirqs after napi_schedule() [4d19db777a2f32c9b76f6fd517ed8960576cb43e] Junaid Shahid (1): kvm: mmu: Fix race in emulated page table writes [0e0fee5c539b61fdd098332e0e2cc375d9073706] Jörgen Storvist (1): USB: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode) [cc6730df08a291e51e145bc65e24ffb5e2f17ab6] Kai-Heng Feng (4): ALSA: hda: Add support for AMD Stoney Ridge [3deef52ce10514ccdebba8e8ab85f9cebd0eb3f7] USB: Wait for extra delay time after USB_PORT_FEAT_RESET for quirky hub [781f0766cc41a9dd2e5d118ef4b1d5d89430257b] USB: quirks: Add no-lpm quirk for Raydium touchscreens [deefd24228a172d1b27d4a9adbfd2cdacd60ae64] USB: usb-storage: Add new IDs to ums-realtek [a84a1bcc992f0545a51d2e120b8ca2ef20e2ea97] Kirill A. Shutemov (1): x86/mm: Fix regression with huge pages on PAE [70f1528747651b20c7769d3516ade369f9963237] Krzysztof Kozlowski (1): clk: s2mps11: Fix matching when built as module and DT node contains compatible [8985167ecf57f97061599a155bb9652c84ea4913] Ladi Prosek (1): KVM: x86: Add MSR_AMD64_DC_CFG to the list of ignored MSRs [405a353a0e20d09090ad96147da6afad9b0ce056] Lars-Peter Clausen (1): iio: ad5064: Fix regulator handling [8911a43bc198877fad9f4b0246a866b26bb547ab] Leon Romanovsky (1): RDMA/cm: Respect returned status of cm_init_av_by_path [e54b6a3bcd1ec972b25a164bdf495d9e7120b107] Linus Torvalds (1): disable new gcc-7.1.1 warnings for now [bd664f6b3e376a8ef4990f87d08271cc2d01ba9a] Loic Poulain (1): usb: chipidea: Prevent unbalanced IRQ disable [8b97d73c4d72a2abf58f8e49062a7ee1e5f1334e] Lubomir Rintel (2): ARM: mmp/mmp2: fix cpu_is_mmp2() on mmp2-dt [76f4e2c3b6a560cdd7a75b87df543e04d05a9e5f] libertas: don't set URB_ZERO_PACKET on IN USB transfer [6528d88047801b80d2a5370ad46fb6eff2f509e0] Luca Coelho (1): iwlwifi: mvm: check return value of rs_rate_from_ucode_rate() [3d71c3f1f50cf309bd20659422af549bc784bfff] Lukas Czerner (1): ext4: initialize retries variable in ext4_da_write_inline_data_begin() [625ef8a3acd111d5f496d190baf99d1a815bd03e] Lukas Wunner (2): PCI/ASPM: Fix link_state teardown on device removal [aeae4f3e5c38d47bdaef50446dc0ec857307df68] genirq: Fix race on spurious interrupt detection [746a923b863a1065ef77324e1e43f19b1a3eab5c] Maarten Jacobs (1): usb: cdc-acm: add entry for Hiro (Conexant) modem [63529eaa6164ef7ab4b907b25ac3648177e5e78f] Maciej S. Szmigiero (1): pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges [95691e3eddc41da2d1cd3cca51fecdfb46bd85bc] Macpaul Lin (1): kgdboc: fix KASAN global-out-of-bounds bug in param_set_kgdboc_var() [dada6a43b0402eba438a17ac86fdc64ac56a4607] Marc Kleine-Budde (4): can: dev: __can_get_echo_skb(): Don't crash the kernel if can_priv::echo_skb is accessed out of bounds [e7a6994d043a1e31d5b17706a22ce33d2a3e4cdc] can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb [7da11ba5c5066dadc2e96835a6233d56d7b7764a] can: dev: __can_get_echo_skb(): replace struct can_frame by canfd_frame to access frame length [200f5c49f7a2cd694436bfc6cb0662b794c96736] can: dev: can_get_echo_skb(): factor out non sending code to __can_get_echo_skb() [a4310fa2f24687888ce80fdb0e88583561a23700] Marco Felsch (1): media: tvp5150: fix width alignment during set_selection() [bd24db04101f45a9c1d874fe21b0c7eab7bcadec] Marek Szyprowski (1): ARM: dts: exynos: Disable pull control for MAX8997 interrupts on Origen [f5e758b8358f6c27e8a351ddf0b441a64cdabb94] Mathias Nyman (3): usb: xhci: Prevent bus suspend if a port connect change or polling state is detected [2f31a67f01a8beb22cae754c53522cb61a005750] xhci: Don't prevent USB2 bus suspend in state check intended for USB3 only [45f750c16cae3625014c14c77bd9005eda975d35] xhci: Prevent U1/U2 link pm states if exit latency is too long [0472bf06c6fd33c1a18aaead4c8f91e5a03d8d7b] Mathias Payer (1): USB: check usb_get_extra_descriptor for proper size [704620afc70cf47abb9d6a1a57f3825d2bca49cf] Mattias Jacobsson (1): USB: misc: appledisplay: add 20" Apple Cinema Display [f6501f49199097b99e4e263644d88c90d1ec1060] Mauro Carvalho Chehab (3): media: em28xx: fix input name for Terratec AV 350 [15644bfa195bd166d0a5ed76ae2d587f719c3dac] media: em28xx: make v4l2-compliance happier by starting sequence on zero [afeaade90db4c5dab93f326d9582be1d5954a198] media: em28xx: use a default format if TRY_FMT fails [f823ce2a1202d47110a7ef86b65839f0be8adc38] Max Filippov (6): xtensa: add NOTES section to the linker script [4119ba211bc4f1bf638f41e50b7a0f329f58aa16] xtensa: enable coprocessors that are being flushed [2958b66694e018c552be0b60521fec27e8d12988] xtensa: fix boot parameters address translation [40dc948f234b73497c3278875eb08a01d5854d3f] xtensa: fix coprocessor context offset definitions [03bc996af0cc71c7f30c384d8ce7260172423b34] xtensa: fix coprocessor part of ptrace_{get,set}xregs [38a35a78c5e270cbe53c4fef6b0d3c2da90dd849] xtensa: make sure bFLT stack is 16 byte aligned [0773495b1f5f1c5e23551843f87b5ff37e7af8f7] Michael Kelley (2): clockevents/drivers/i8253: Add support for PIT shutdown quirk [35b69a420bfb56b7b74cb635ea903db05e357bec] x86/hyper-v: Enable PIT shutdown quirk [1de72c706488b7be664a601cf3843bd01e327e58] Michael Niewöhner (1): usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series [effd14f66cc1ef6701a19c5a56e39c35f4d395a5] Michal Hocko (1): memory_hotplug: cond_resched in __remove_pages [dd33ad7b251f900481701b2a82d25de583867708] Mike Kravetz (2): hugetlbfs: dirty pages as they are added to pagecache [22146c3ce98962436e401f7b7016a6f664c9ffb5] hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444! [5e41540c8a0f0e98c337dda8b391e5dda0cde7cf] Miklos Szeredi (3): fuse: cleanup fuse_file refcounting [267d84449f52349ee252db684ed95ede18e51744] fuse: fix blocked_waitq wakeup [908a572b80f6e9577b45e81b3dfe2e22111286b8] fuse: fix leaked notify reply [7fabaf303458fcabb694999d6fa772cc13d4e217] Mikulas Patocka (2): mach64: fix display corruption on big endian machines [3c6c6a7878d00a3ac997a779c5b9861ff25dfcc8] mach64: fix image corruption due to reading accelerator registers [c09bcc91bb94ed91f1391bffcbe294963d605732] Nadav Amit (1): media: uvcvideo: Fix uvc_alloc_entity() allocation alignment [89dd34caf73e28018c58cd193751e41b1f8bdc56] Nathan Chancellor (2): clk: s2mps11: Add used attribute to s2mps11_dt_match [9c940bbe2bb47e03ca5e937d30b6a50bf9c0e671] misc: atmel-ssc: Fix section annotation on atmel_ssc_get_driver_data [7c97301285b62a41d6bceded7d964085fc8cc50f] Naveen N. Rao (2): powerpc/pseries: Fix DTL buffer registration [db787af1b8a6b4be428ee2ea7d409dafcaa4a43c] powerpc/pseries: Fix how we iterate over the DTL entries [9258227e9dd1da8feddb07ad9702845546a581c9] Nicholas Mc Guire (2): media: pci: cx23885: handle adding to list failure [c5d59528e24ad22500347b199d52b9368e686a42] usb: gadget: fsl_udc_core: check allocation return value and cleanup on failure [4ab2b48c98f2ec9712452d520a381917f91ac3d2] Nicolas Dichtel (1): tun: forbid iface creation with rtnl ops [35b827b6d06199841a83839e8bb69c0cd13a28be] Nicolas Huaman (1): ALSA: usb-audio: update quirk for B&W PX to remove microphone [c369c8db15d51fa175d2ba85928f79d16af6b562] Nicolas Pitre (1): Cramfs: fix abad comparison when wrap-arounds occur [672ca9dd13f1aca0c17516f76fc5b0e8344b3e46] Nikolay Borisov (1): btrfs: Always try all copies when reading extent buffers [f8397d69daef06d358430d3054662fb597e37c00] Oliver Hartkopp (1): can: raw: check for CAN FD capable netdev in raw_sendmsg() [a43608fa77213ad5ac5f75994254b9f65d57cfa0] Ondrej Mosnacek (1): crypto: lrw - Fix out-of bounds access on counter overflow [fbe1a850b3b1522e9fc22319ccbbcd2ab05328d2] Pan Bian (5): btrfs: relocation: set trans to be NULL after ending transaction [42a657f57628402c73237547f0134e083e2f6764] exportfs: do not read dentry after free [2084ac6c505a58f7efdec13eba633c6aaa085ca5] ext2: fix potential use after free [ecebf55d27a11538ea84aee0be643dd953f830d5] hfs: do not free node before using [ce96a407adef126870b3f4a1b73529dd8aa80f49] rapidio/rionet: do not free skb before reading its length [cfc435198f53a6fa1f656d98466b24967ff457d0] Paolo Bonzini (1): KVM: x86: remove code for lazy FPU handling [bd7e5b0899a429445cc6e3037c13f8b5ae3be903] Parav Pandit (3): IB/cm: Avoid AV ah_attr overwriting during LAP message handling [a5c57d327272bdf3a8b19686eaca2ec683449e67] IB/cm: Fix sleeping while spin lock is held [33f93e1ebcf5acfaef06cda2d3e373730519e33e] IB/{cm, umad}: Handle av init error [0c4386ec77cfcd0ccbdbe8c2e67dd3a49b2a4c7f] Paul Mackerras (1): powerpc: Fix COFF zImage booting on old powermacs [5564597d51c8ff5b88d95c76255e18b13b760879] Paul Moore (1): cipso: don't use IPCB() to locate the CIPSO IP option [04f81f0154e4bf002be6f4d85668ce1257efa4d9] Paulo Alcantara (1): cifs: Fix separator when building path from dentry [c988de29ca161823db6a7125e803d597ef75b49c] Petr Machata (1): vxlan: Fix error path in __vxlan_dev_create() [6db9246871394b3a136cd52001a0763676563840] Punnaiah Choudary Kalluri (1): net: macb: Fix race condition in driver when Rx frame is dropped [d4c216c54197d741ed8b7ca54f13645dfb3eacde] Quinn Tran (1): scsi: qla2xxx: shutdown chip if reset fail [1e4ac5d6fe0a4af17e4b6251b884485832bf75a3] Richard Genoud (2): dmaengine: at_hdmac: fix memory leak in at_dma_xlate() [98f5f932254b88ce828bc8e4d1642d14e5854caa] dmaengine: at_hdmac: fix module unloading [77e75fda94d2ebb86aa9d35fb1860f6395bf95de] Richard Weinberger (2): um: Drop own definition of PTRACE_SYSEMU/_SINGLESTEP [0676b957c24bfb6e495449ba7b7e72c5b5d79233] um: Give start_idle_thread() a return code [7ff1e34bbdc15acab823b1ee4240e94623d50ee8] Robbie Ko (1): Btrfs: fix cur_offset in the error case for nocow [506481b20e818db40b6198815904ecd2d6daee64] Russell King (1): mmc: omap_hsmmc: fix DMA API warning [0b479790684192ab7024ce6a621f93f6d0a64d92] Sagi Grimberg (1): iser: set sector for ambiguous mr status errors [24c3456c8d5ee6fc1933ca40f7b4406130682668] Sakari Ailus (1): media: v4l: event: Add subscription to list before calling "add" operation [92539d3eda2c090b382699bbb896d4b54e9bdece] Sandeep Singh (1): xhci: workaround CSS timeout on AMD SNPS 3.0 xHC [a7d57abcc8a5bdeb53bbf8e87558e8e0a2c2a29d] Sebastian Parschauer (2): HID: Add quirk for Microsoft PIXART OEM mouse [e82e62e390d39c3819641cd721695702180d54fb] HID: Add quirk for Primax PIXART OEM mice [fb862c3b199d28bee238d52e8270eae8650d6cb0] Sergei Shtylyov (1): spi: sh-msiof: fix deferred probing [f34c6e6257aa477cdfe7e9bbbecd3c5648ecda69] Serhey Popovych (1): tun: Consistently configure generic netdev params via rtnetlink [df52eab23d703142c766ac00bdb8db19d71238d0] Spencer E. Olson (1): staging: comedi: ni_mio_common: protect register write overflow [1cbca5852d6c16e85a21487a15d211195aacd4a1] Stefan Nuernberger (1): net/ipv4: defensive cipso option parsing [076ed3da0c9b2f88d9157dbe7044a45641ae369e] Stefano Brivio (1): ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are called [ee1abcf689353f36d9322231b4320926096bdee0] Steve French (3): smb3: allow stats which track session and share reconnects to be reset [2c887635cd6ab3af619dc2be94e5bf8f2e172b78] smb3: do not attempt cifs operation in smb3 query info error path [1e77a8c204c9d1b655c61751b8ad0fde22421dbb] smb3: on kerberos mount if server doesn't specify auth type use krb5 [926674de6705f0f1dbf29a62fd758d0977f535d6] Steven Rostedt (2): tracing: Fix memory leak in set_trigger_filter() [3cec638b3d793b7cacdec5b8072364b41caeb0e1] tracing: Fix memory leak of instance function hash filters [2840f84f74035e5a535959d5f17269c69fa6edc5] Sven Eckelmann (3): batman-adv: Check total_size when queueing fragments [53e771457e823fbc21834f60508c42a4270534fd] batman-adv: Expand merged fragment buffer for full packet [d7d8bbb40a5b1f682ee6589e212934f4c6b8ad60] batman-adv: Use only queued fragments when merging [83e8b87721f21b26b843633caca8ef453e943623] Taehee Yoo (1): netfilter: xt_IDLETIMER: add sysfs filename checking routine [54451f60c8fa061af9051a53be9786393947367c] Takashi Iwai (8): ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write [7194eda1ba0872d917faf3b322540b4f57f11ba5] ALSA: control: Fix race between adding and removing a user element [e1a7bfe3807974e66f971f2589d4e0197ec0fced] ALSA: oss: Use kvzalloc() for local buffer allocations [65766ee0bf7fe8b3be80e2e1c3ef54ad59b29476] ALSA: pcm: Call snd_pcm_unlink() conditionally at closing [b51abed8355e5556886623b2772fa6b7598d2282] ALSA: sparc: Fix invalid snd_free_pages() at error path [9a20332ab373b1f8f947e0a9c923652b32dab031] ALSA: usb-audio: Avoid nested autoresume calls [47ab154593827b1a8f0713a2b9dd445753d551d8] ALSA: usb-audio: Replace probing flag with active refcount [a6da499b76b1a75412f047ac388e9ffd69a5c55b] ALSA: wss: Fix invalid snd_free_pages() at error path [7b69154171b407844c273ab4c10b5f0ddcd6aa29] Takashi Sakamoto (1): ALSA: control: fix failure to return numerical ID in 'add' event [d34890cf4113397625a6629d71749fa638a7a734] Tang Junhui (1): bcache: fix miss key refill->end in writeback [2d6cb6edd2c7fb4f40998895bda45006281b1ac5] Tang.Junhui (1): bcache: fix wrong cache_misses statistics [c157313791a999646901b3e3c6888514ebc36d62] Tarick Bedeir (1): net/mlx4_core: Correctly set PFC param if global pause is turned off. [bd5122cd1e0644d8bd8dd84517c932773e999766] Theodore Ts'o (4): ext4: avoid possible double brelse() in add_new_gdb() on error path [4f32c38b4662312dd3c5f113d8bdd459887fb773] ext4: fix EXT4_IOC_SWAP_BOOT [18aded17492088962ef43f00825179598b3e8c58] ext4: fix possible leak of sbi->s_group_desc_leak in error path [9e463084cdb22e0b56b2dfbc50461020409a5fd3] ext4: fix use-after-free race in ext4_remount()'s error path [33458eaba4dfe778a426df6a19b7aad2ff9f7eec] Thomas Gleixner (2): mac80211_hwsim: Replace bogus hrtimer clockid [8fbcfeb8a9cc803464d6c166e7991913711c612c] x86/eisa: Add missing include [ef1d4deab953ecb1dfcf9f167043bda8b3f14a11] Thomas Zimmermann (1): drm/ast: Remove existing framebuffers before loading driver [5478ad10e7850ce3d8b7056db05ddfa3c9ddad9a] Thor Thayer (1): net: stmmac: Fix RX packet size > 8191 [8137b6ef0ce469154e5cf19f8e7fe04d9a72ac5e] Tom Lendacky (1): x86/mm: Simplify p[g4um]d_page() macros [fd7e315988b784509ba3f1b42f539bd0b1fca9bb] Tomasz Figa (1): power: supply: max8998-charger: Fix platform data retrieval [cb90a2c6f77fe9b43d1e3f759bb2f13fe7fa1811] Tony Luck (1): EDAC, {i7core,sb,skx}_edac: Fix uncorrected error counting [432de7fd7630c84ad24f1c2acd1e3bb4ce3741ca] Tore Anderson (1): USB: serial: option: add HP lt4132 [d57ec3c83b5153217a70b561d4fb6ed96f2f7a25] Toshi Kani (3): x86/asm: Add pud/pmd mask interfaces to handle large PAT bit [4be4c1fb9a754b100466ebaec50f825be0b2050b] x86/asm: Fix pud/pmd interfaces to handle large PAT bit [f70abb0fc3da1b2945c92751ccda2744081bf2b7] x86/asm: Move PUD_PAGE macros to page_types.h [832102671855f73962e7a04fdafd48b9385ea5c6] Trond Myklebust (3): NFSv4: Don't exit the state manager without clearing NFS4CLNT_MANAGER_RUNNING [21a446cf186570168b7281b154b1993968598aca] SUNRPC: Fix a potential race in xprt_connect() [0a9a4304f3614e25d9de9b63502ca633c01c0d70] nfsd: Fix an Oops in free_session() [bb6ad5572c0022e17e846b382d7413cdcf8055be] Ulf Hansson (2): mmc: core: Reset HPI enabled state during re-init and in case of errors [a0741ba40a009f97c019ae7541dc61c1fdf41efb] mmc: core: Use a minimum 1600ms timeout when enabling CACHE ctrl [e3ae3401aa19432ee4943eb0bbc2ec704d07d793] Vasily Averin (10): ext4: add missing brelse() add_new_gdb_meta_bg()'s error path [61a9c11e5e7a0dab5381afa5d9d4dd5ebf18f7a0] ext4: add missing brelse() in set_flexbg_block_bitmap()'s error path [cea5794122125bf67559906a0762186cf417099c] ext4: add missing brelse() update_backups()'s error path [ea0abbb648452cdb6e1734b702b6330a7448fcf8] ext4: avoid buffer leak in ext4_orphan_add() after prior errors [feaf264ce7f8d54582e2f66eb82dd9dd124c94f3] ext4: avoid potential extra brelse in setup_new_flex_group_blocks() [9e4028935cca3f9ef9b6a90df9da6f1f94853536] ext4: fix buffer leak in __ext4_read_dirblock() on error path [de59fae0043f07de5d25e02ca360f7d57bfa5866] ext4: fix buffer leak in ext4_xattr_move_to_block() on error path [6bdc9977fcdedf47118d2caf7270a19f4b6d8a8f] ext4: fix missing cleanup if ext4_alloc_flex_bg_array() fails while resizing [f348e2241fb73515d65b5d77dd9c174128a7fbf2] ext4: fix possible inode leak in the retry loop of ext4_resize_fs() [db6aee62406d9fbb53315fcddd81f1dc271d49fa] ext4: release bs.bh before re-using in ext4_xattr_block_find() [45ae932d246f721e6584430017176cbcadfde610] Vasyl Vavrychuk (1): mac80211_hwsim: Timer should be initialized before device registered [a1881c9b8a1edef0a5ae1d5c1b61406fe3402114] Ville Syrjälä (2): drm/i915: Disable LP3 watermarks on all SNB machines [03981c6ebec4fc7056b9b45f847393aeac90d060] drm: Rewrite drm_ioctl_flags() to resemble the new drm_ioctl() code [7ef5f82b100716b23de7d2da6ff602b0842e5804] Wanpeng Li (1): KVM: X86: Fix NULL deref in vcpu_scan_ioapic [dcbd3e49c2f0b2c2d8a321507ff8f3de4af76d7c] Wei Yongjun (1): IB/mthca: Fix error return code in __mthca_init_one() [39f2495618c5e980d2873ea3f2d1877dd253e07a] Wenwen Wang (1): dm ioctl: harden copy_params()'s copy_from_user() from malicious users [800a7340ab7dd667edf95e74d8e4f23a17e87076] Wolfram Sang (1): mmc: core: use mrq->sbc when sending CMD23 for RPMB [a44f7cb937321d4961bfc8f28912126b06e701c5] Xin Long (1): l2tp: fix a sock refcnt leak in l2tp_tunnel_register [f8504f4ca0a0e9f84546ef86e00b24d2ea9a0bd2] Y.C. Chen (2): drm/ast: change resolution may cause screen blurred [1a37bd823891568f8721989aed0615835632d81a] drm/ast: fixed cursor may disappear sometimes [7989b9ee8bafe5cc625381dd0c3c4586de27ca26] Yogesh Gaur (1): mtd: spi-nor: fsl-quadspi: fix api naming typo _init_ahb_read [dd50a1c4e56d6d2ea753f87a35b1f1e09cb877d7] Young Xiao (1): staging: rtl8712: Fix possible buffer overrun [300cd664865bed5d50ae0a42fb4e3a6f415e8a10] YueHaibing (3): SUNRPC: drop pointless static qualifier in xdr_get_next_encode_buffer() [025911a5f4e36955498ed50806ad1b02f0f76288] exportfs: fix 'passing zero to ERR_PTR()' warning [909e22e05353a783c526829427e9a8de122fba9c] sysv: return 'err' instead of 0 in __sysv_write_inode [c4b7d1ba7d263b74bb72e9325262a67139605cde] Yujuan.Qi (1): Cipso: cipso_v4_optptr enter infinite loop [40413955ee265a5e42f710940ec78f5450d49149] Zhimin Gu (1): x86, hibernate: Fix nosave_regions setup for hibernation [cc55f7537db6af371e9c1c6a71161ee40f918824] Makefile | 8 +- arch/alpha/include/asm/termios.h | 8 +- arch/alpha/include/uapi/asm/ioctls.h | 5 + arch/alpha/include/uapi/asm/termbits.h | 17 ++++ arch/arm/boot/dts/exynos4210-origen.dts | 9 ++ arch/arm/include/asm/uaccess.h | 2 +- arch/arm/mach-mmp/include/mach/cputype.h | 6 +- arch/arm/mach-omap1/board-ams-delta.c | 3 + arch/mips/include/asm/syscall.h | 2 +- arch/parisc/kernel/entry.S | 2 +- arch/parisc/kernel/traps.c | 3 +- arch/parisc/mm/init.c | 8 +- arch/powerpc/boot/crt0.S | 4 +- arch/powerpc/platforms/pseries/dtl.c | 4 +- arch/s390/hypfs/hypfs_vm.c | 2 +- arch/s390/include/asm/timex.h | 10 +- arch/sparc/kernel/signal_32.c | 4 +- arch/um/os-Linux/skas/process.c | 5 + arch/x86/boot/boot.h | 1 - arch/x86/boot/compressed/eboot.c | 3 +- arch/x86/boot/video-mode.c | 2 + arch/x86/boot/video.c | 2 + arch/x86/include/asm/kvm_host.h | 2 - arch/x86/include/asm/page_64_types.h | 3 - arch/x86/include/asm/page_types.h | 13 ++- arch/x86/include/asm/pgtable-3level.h | 7 +- arch/x86/include/asm/pgtable.h | 19 ++-- arch/x86/include/asm/pgtable_types.h | 34 ++++++- arch/x86/include/asm/x86_init.h | 1 - arch/x86/include/uapi/asm/msr-index.h | 1 + arch/x86/kernel/check.c | 15 +++ arch/x86/kernel/cpu/mshyperv.c | 11 +++ arch/x86/kernel/cpu/mtrr/if.c | 2 + arch/x86/kernel/eisa.c | 1 + arch/x86/kernel/setup.c | 2 +- arch/x86/kvm/mmu.c | 27 ++--- arch/x86/kvm/svm.c | 62 ++++-------- arch/x86/kvm/vmx.c | 121 +++-------------------- arch/x86/kvm/x86.c | 21 ++-- arch/x86/mm/tlb.c | 29 ++++-- arch/x86/um/shared/sysdep/ptrace_32.h | 10 -- arch/x86/vdso/vclock_gettime.c | 8 +- arch/xtensa/boot/Makefile | 2 +- arch/xtensa/include/asm/processor.h | 6 +- arch/xtensa/kernel/asm-offsets.c | 16 +-- arch/xtensa/kernel/head.S | 7 +- arch/xtensa/kernel/process.c | 5 +- arch/xtensa/kernel/ptrace.c | 42 +++++++- arch/xtensa/kernel/vmlinux.lds.S | 1 + crypto/lrw.c | 7 +- drivers/acpi/acpi_platform.c | 1 + drivers/acpi/acpica/dsopcode.c | 4 + drivers/ata/libata-core.c | 5 + drivers/block/floppy.c | 3 +- drivers/clk/clk-s2mps11.c | 27 +++++ drivers/clocksource/i8253.c | 14 ++- drivers/devfreq/devfreq.c | 53 +++++++++- drivers/dma/at_hdmac.c | 10 +- drivers/edac/i7core_edac.c | 1 + drivers/edac/sb_edac.c | 1 + drivers/gpio/gpio-max7301.c | 12 +-- drivers/gpu/drm/ast/ast_drv.c | 21 ++++ drivers/gpu/drm/ast/ast_mode.c | 3 +- drivers/gpu/drm/drm_drv.c | 21 ++-- drivers/gpu/drm/i915/i915_gem.c | 15 ++- drivers/gpu/drm/i915/intel_pm.c | 43 +++++++- drivers/hid/hid-ids.h | 3 + drivers/hid/hid-sensor-hub.c | 13 ++- drivers/hid/uhid.c | 13 +++ drivers/hid/usbhid/hid-quirks.c | 3 + drivers/hid/usbhid/hiddev.c | 18 +++- drivers/hv/channel.c | 8 ++ drivers/hv/hv_kvp.c | 24 ++++- drivers/hv/vmbus_drv.c | 20 ++++ drivers/hwmon/pmbus/pmbus.c | 2 + drivers/hwmon/pmbus/pmbus_core.c | 5 +- drivers/hwmon/w83795.c | 2 +- drivers/iio/accel/hid-sensor-accel-3d.c | 5 +- drivers/iio/adc/at91_adc.c | 6 +- drivers/iio/dac/ad5064.c | 55 ++++++++--- drivers/iio/gyro/hid-sensor-gyro-3d.c | 5 +- drivers/iio/light/hid-sensor-als.c | 8 +- drivers/iio/light/hid-sensor-prox.c | 8 +- drivers/iio/magnetometer/hid-sensor-magn-3d.c | 8 +- drivers/iio/orientation/hid-sensor-incl-3d.c | 8 +- drivers/iio/pressure/hid-sensor-press.c | 8 +- drivers/infiniband/core/cm.c | 42 +++++--- drivers/infiniband/core/user_mad.c | 10 +- drivers/infiniband/hw/mthca/mthca_main.c | 3 +- drivers/infiniband/ulp/iser/iser_verbs.c | 7 +- drivers/input/keyboard/matrix_keypad.c | 23 +++-- drivers/iommu/ipmmu-vmsa.c | 3 + drivers/md/bcache/btree.c | 2 +- drivers/md/bcache/request.c | 6 +- drivers/md/dm-ioctl.c | 18 ++-- drivers/media/i2c/tvp5150.c | 14 ++- drivers/media/pci/cx23885/altera-ci.c | 10 ++ drivers/media/usb/cx231xx/cx231xx-video.c | 2 +- drivers/media/usb/em28xx/em28xx-cards.c | 4 +- drivers/media/usb/em28xx/em28xx-video.c | 8 +- drivers/media/usb/uvc/uvc_driver.c | 2 +- drivers/media/v4l2-core/v4l2-event.c | 43 ++++---- drivers/media/v4l2-core/videobuf2-core.c | 4 +- drivers/misc/atmel-ssc.c | 2 +- drivers/misc/genwqe/card_base.h | 2 +- drivers/misc/genwqe/card_dev.c | 9 +- drivers/misc/sgi-gru/grukdump.c | 4 + drivers/misc/vmw_vmci/vmci_resource.c | 3 +- drivers/mmc/card/block.c | 15 ++- drivers/mmc/core/mmc.c | 19 +++- drivers/mmc/host/omap.c | 11 ++- drivers/mmc/host/omap_hsmmc.c | 12 ++- drivers/mtd/devices/Kconfig | 2 +- drivers/mtd/spi-nor/fsl-quadspi.c | 14 ++- drivers/net/can/dev.c | 48 ++++++--- drivers/net/ethernet/broadcom/genet/bcmmii.c | 2 +- drivers/net/ethernet/cadence/macb.c | 22 ++++- drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 4 +- drivers/net/ethernet/mellanox/mlx4/mlx4.h | 4 +- drivers/net/ethernet/neterion/vxge/vxge-config.c | 2 +- drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 3 +- drivers/net/ethernet/stmicro/stmmac/descs_com.h | 2 +- drivers/net/ethernet/stmicro/stmmac/enh_desc.c | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/phy/phy_device.c | 2 - drivers/net/rionet.c | 2 +- drivers/net/team/team.c | 2 - drivers/net/tun.c | 2 +- drivers/net/vxlan.c | 13 ++- drivers/net/wireless/iwlwifi/mvm/rs.c | 29 ++++-- drivers/net/wireless/libertas/if_usb.c | 2 - drivers/net/wireless/libertas_tf/if_usb.c | 5 +- drivers/net/wireless/mac80211_hwsim.c | 8 +- drivers/of/base.c | 25 +++++ drivers/pci/pcie/aspm.c | 2 +- drivers/pci/quirks.c | 4 + drivers/pci/remove.c | 4 +- drivers/pcmcia/ricoh.h | 35 +++++++ drivers/pcmcia/yenta_socket.c | 3 +- drivers/power/max8998_charger.c | 2 +- drivers/rtc/rtc-hid-sensor-time.c | 2 +- drivers/s390/block/dasd_alias.c | 3 +- drivers/s390/kvm/virtio_ccw.c | 17 +++- drivers/s390/net/qeth_core_main.c | 27 +++-- drivers/s390/net/qeth_l2_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 3 + drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 3 +- drivers/scsi/esp_scsi.c | 1 + drivers/scsi/esp_scsi.h | 2 + drivers/scsi/mac_esp.c | 2 + drivers/scsi/qla2xxx/qla_init.c | 2 +- drivers/scsi/qla2xxx/qla_mbx.c | 5 +- drivers/scsi/sd.c | 17 +++- drivers/spi/spi-sh-msiof.c | 4 +- drivers/staging/comedi/drivers/ni_mio_common.c | 22 +++-- drivers/staging/comedi/drivers/quatech_daqp_cs.c | 25 ++++- drivers/staging/rtl8712/mlme_linux.c | 2 +- drivers/staging/rtl8712/rtl871x_mlme.c | 2 +- drivers/thermal/rcar_thermal.c | 9 +- drivers/tty/serial/kgdboc.c | 9 +- drivers/tty/tty_ioctl.c | 4 +- drivers/uio/uio.c | 7 +- drivers/usb/chipidea/otg.h | 3 +- drivers/usb/class/cdc-acm.c | 3 + drivers/usb/core/hub.c | 16 ++- drivers/usb/core/quirks.c | 18 ++++ drivers/usb/core/usb.c | 6 +- drivers/usb/dwc3/gadget.c | 6 -- drivers/usb/gadget/fsl_udc_core.c | 30 +++++- drivers/usb/host/hwa-hc.c | 2 +- drivers/usb/host/xhci-hub.c | 67 +++++++++---- drivers/usb/host/xhci-pci.c | 4 + drivers/usb/host/xhci-ring.c | 2 +- drivers/usb/host/xhci.c | 42 +++++++- drivers/usb/host/xhci.h | 5 +- drivers/usb/misc/appledisplay.c | 2 + drivers/usb/serial/cypress_m8.c | 2 +- drivers/usb/serial/option.c | 8 +- drivers/usb/storage/unusual_realtek.h | 10 ++ drivers/vhost/vhost.c | 2 + drivers/video/fbdev/aty/mach64_accel.c | 28 +++--- drivers/w1/masters/omap_hdq.c | 2 + drivers/xen/swiotlb-xen.c | 6 ++ fs/aio.c | 2 + fs/btrfs/dev-replace.c | 7 +- fs/btrfs/disk-io.c | 10 +- fs/btrfs/extent-tree.c | 1 + fs/btrfs/file.c | 30 ++++-- fs/btrfs/free-space-cache.c | 2 + fs/btrfs/inode.c | 6 +- fs/btrfs/ioctl.c | 12 ++- fs/btrfs/qgroup.c | 3 +- fs/btrfs/relocation.c | 1 + fs/btrfs/super.c | 1 + fs/cifs/cifs_debug.c | 3 + fs/cifs/cifs_spnego.c | 6 +- fs/cifs/dir.c | 2 +- fs/cifs/inode.c | 10 +- fs/cramfs/inode.c | 3 +- fs/exportfs/expfs.c | 3 +- fs/ext2/xattr.c | 2 +- fs/ext4/ext4.h | 3 +- fs/ext4/inline.c | 2 +- fs/ext4/ioctl.c | 33 +++++-- fs/ext4/namei.c | 5 +- fs/ext4/resize.c | 28 +++--- fs/ext4/super.c | 91 ++++++++++------- fs/ext4/xattr.c | 4 + fs/fuse/dev.c | 19 +++- fs/fuse/dir.c | 4 +- fs/fuse/file.c | 37 +++---- fs/fuse/fuse_i.h | 3 +- fs/gfs2/ops_fstype.c | 3 + fs/hfs/btree.c | 3 +- fs/jffs2/super.c | 4 +- fs/lockd/host.c | 2 +- fs/namespace.c | 22 ++++- fs/nfs/nfs4state.c | 8 +- fs/ocfs2/dir.c | 3 +- fs/sysv/inode.c | 2 +- fs/xfs/xfs_stats.c | 2 +- include/linux/can/dev.h | 1 + include/linux/ceph/libceph.h | 8 +- include/linux/hid-sensor-hub.h | 4 +- include/linux/i8253.h | 1 + include/linux/kvm_host.h | 2 - include/linux/netfilter/x_tables.h | 2 + include/linux/of.h | 8 ++ include/linux/ptrace.h | 21 +++- include/linux/uaccess.h | 3 + include/linux/usb.h | 4 +- include/linux/usb/quirks.h | 3 + include/net/cipso_ipv4.h | 25 +++-- kernel/bounds.c | 4 +- kernel/events/uprobes.c | 12 ++- kernel/irq/manage.c | 8 +- kernel/printk/printk.c | 7 +- kernel/ptrace.c | 10 ++ kernel/signal.c | 2 +- kernel/time/timer_list.c | 2 +- kernel/trace/ftrace.c | 1 + kernel/trace/trace_events_trigger.c | 6 +- mm/hugetlb.c | 29 +++++- mm/memory_hotplug.c | 2 + net/batman-adv/fragmentation.c | 20 ++-- net/batman-adv/types.h | 2 + net/can/raw.c | 15 +-- net/core/dev.c | 4 + net/core/rtnetlink.c | 13 +++ net/ipv4/cipso_ipv4.c | 62 ++++++++---- net/ipv6/ip6_fib.c | 6 +- net/ipv6/ip6_vti.c | 1 + net/ipv6/ndisc.c | 3 +- net/l2tp/l2tp_core.c | 9 +- net/llc/af_llc.c | 13 +-- net/mac80211/iface.c | 2 + net/mac80211/rx.c | 1 + net/mac80211/tx.c | 4 +- net/netfilter/nf_tables_api.c | 22 ++--- net/netfilter/nft_compat.c | 3 +- net/netfilter/x_tables.c | 30 ++++++ net/netfilter/xt_IDLETIMER.c | 20 ++++ net/netfilter/xt_hashlimit.c | 5 +- net/netfilter/xt_recent.c | 6 +- net/netlabel/netlabel_kapi.c | 15 ++- net/sched/sch_gred.c | 2 +- net/sunrpc/auth_gss/auth_gss.c | 4 + net/sunrpc/svc_xprt.c | 2 +- net/sunrpc/xdr.c | 7 +- net/sunrpc/xprt.c | 11 ++- net/vmw_vsock/vmci_transport.c | 67 +++++++++---- net/xfrm/xfrm_state.c | 2 +- security/integrity/ima/ima_fs.c | 6 +- sound/core/control.c | 79 ++++++++------- sound/core/oss/pcm_oss.c | 2 +- sound/core/oss/pcm_plugin.c | 2 +- sound/core/pcm_native.c | 3 +- sound/isa/wss/wss_lib.c | 2 - sound/pci/ac97/ac97_codec.c | 2 +- sound/pci/ca0106/ca0106.h | 2 +- sound/pci/hda/hda_intel.c | 4 + sound/pci/hda/patch_conexant.c | 1 + sound/sparc/cs4231.c | 8 +- sound/usb/card.c | 81 ++++++++++----- sound/usb/endpoint.c | 10 +- sound/usb/mixer.c | 32 ++---- sound/usb/mixer_quirks.c | 112 ++++++++++----------- sound/usb/pcm.c | 32 +++--- sound/usb/proc.c | 4 +- sound/usb/quirks-table.h | 9 +- sound/usb/usbaudio.h | 11 ++- tools/power/cpupower/bench/parse.c | 2 +- 293 files changed, 2221 insertions(+), 1084 deletions(-) -- Ben Hutchings Horngren's Observation: Among economists, the real world is often a special case.

5 years, 5 months

6
312
0 0

[PATCH 4.19 000/276] 4.19.47-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.47 release. There are 276 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat 01 Jun 2019 03:02:08 AM UTC. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.47-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.47-rc1 Benjamin Coddington <bcodding(a)redhat.com> NFS: Fix a double unlock from nfs_match,get_client Maxime Ripard <maxime.ripard(a)bootlin.com> drm/sun4i: dsi: Enforce boundaries on the start delay Farhan Ali <alifm(a)linux.ibm.com> vfio-ccw: Prevent quiesce function going into an infinite loop Maxime Ripard <maxime.ripard(a)bootlin.com> drm/sun4i: dsi: Change the start delay calculation Chris Wilson <chris(a)chris-wilson.co.uk> drm: Wake up next in drm_read() chain if we are forced to putback the event Noralf Trønnes <noralf(a)tronnes.org> drm/drv: Hold ref on parent device during drm_device lifetime Eric Anholt <eric(a)anholt.net> drm/v3d: Handle errors from IRQ setup. Arnd Bergmann <arnd(a)arndb.de> ASoC: davinci-mcasp: Fix clang warning without CONFIG_PM Chris Lesiak <chris.lesiak(a)licor.com> spi: Fix zero length xfer bug Trent Piepho <tpiepho(a)impinj.com> spi: imx: stop buffer overflow in RX FIFO flush Geert Uytterhoeven <geert+renesas(a)glider.be> spi: rspi: Fix sequencer reset during initialization Tony Lindgren <tony(a)atomide.com> drm/omap: dsi: Fix PM for display blank with paired dss_pll calls Aditya Pakki <pakki001(a)umn.edu> spi : spi-topcliff-pch: Fix to handle empty DMA buffers James Smart <jsmart2021(a)gmail.com> scsi: lpfc: Fix SLI3 commands being issued on SLI4 devices Arnd Bergmann <arnd(a)arndb.de> media: saa7146: avoid high stack usage with clang James Smart <jsmart2021(a)gmail.com> scsi: lpfc: Fix fc4type information for FDMI James Smart <jsmart2021(a)gmail.com> scsi: lpfc: Fix FDMI manufacturer attribute value Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: vimc: zero the media_device on probe Arnd Bergmann <arnd(a)arndb.de> media: go7007: avoid clang frame overflow warning with KASAN Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: gspca: do not resubmit URBs when streaming has stopped Helen Fornazier <helen.koike(a)collabora.com> media: vimc: stream: fix thread state before sleep Kangjie Lu <kjlu(a)umn.edu> scsi: ufs: fix a missing check of devm_reset_control_get Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> drm/amd/display: Set stream->mode_changed when connectors change Murton Liu <murton.liu(a)amd.com> drm/amd/display: Fix Divide by 0 in memory calculations Arnd Bergmann <arnd(a)arndb.de> media: staging: davinci_vpfe: disallow building with COMPILE_TEST James Hutchinson <jahutchinson99(a)googlemail.com> media: m88ds3103: serialize reset messages in m88ds3103_set_frontend Stefan Brüns <stefan.bruens(a)rwth-aachen.de> media: dvbsky: Avoid leaking dvb frontend Kangjie Lu <kjlu(a)umn.edu> media: si2165: fix a missing check of return value Kai-Heng Feng <kai.heng.feng(a)canonical.com> igb: Exclude device from suspend direct complete optimization Noralf Trønnes <noralf(a)tronnes.org> tinydrm/mipi-dbi: Use dma-safe buffers for all SPI transfers Kai-Heng Feng <kai.heng.feng(a)canonical.com> e1000e: Disable runtime PM on CNP+ Kangjie Lu <kjlu(a)umn.edu> thunderbolt: property: Fix a NULL pointer dereference Dmytro Laktyushkin <Dmytro.Laktyushkin(a)amd.com> drm/amd/display: fix releasing planes when exiting odm Aditya Pakki <pakki001(a)umn.edu> thunderbolt: Fix to check for kmemdup failure Aditya Pakki <pakki001(a)umn.edu> thunderbolt: Fix to check return value of ida_simple_get Rouven Czerwinski <r.czerwinski(a)pengutronix.de> hwrng: omap - Set default quality Sameer Pujar <spujar(a)nvidia.com> dmaengine: tegra210-adma: use devm_clk_*() helpers Linus Lüssing <linus.luessing(a)c0d3.blue> batman-adv: allow updating DAT entry timeouts on incoming ARP Replies Arnd Bergmann <arnd(a)arndb.de> selinux: avoid uninitialized variable warning Arnd Bergmann <arnd(a)arndb.de> scsi: lpfc: avoid uninitialized variable warning Arnd Bergmann <arnd(a)arndb.de> scsi: qla4xxx: avoid freeing unallocated dma memory Tony Lindgren <tony(a)atomide.com> usb: core: Add PM runtime calls to usb_hcd_platform_shutdown Paul E. McKenney <paulmck(a)linux.ibm.com> rcuperf: Fix cleanup path for invalid perf_type strings Yazen Ghannam <yazen.ghannam(a)amd.com> x86/mce: Handle varying MCA bank counts Paul E. McKenney <paulmck(a)linux.ibm.com> rcutorture: Fix cleanup path for invalid torture_type strings Tony Luck <tony.luck(a)intel.com> x86/mce: Fix machine_check_poll() tests for error types Leon Romanovsky <leon(a)kernel.org> overflow: Fix -Wtype-limits compilation warnings Kangjie Lu <kjlu(a)umn.edu> tty: ipwireless: fix missing checks for ioremap Pankaj Gupta <pagupta(a)redhat.com> virtio_console: initialize vtermno value for ports Chad Dupuis <cdupuis(a)marvell.com> scsi: qedf: Add missing return in qedf_post_io_req() in the fcport offload check Thomas Gleixner <tglx(a)linutronix.de> timekeeping: Force upper bound for setting CLOCK_REALTIME Aditya Pakki <pakki001(a)umn.edu> thunderbolt: Fix to check the return value of kmemdup Kangjie Lu <kjlu(a)umn.edu> thunderbolt: property: Fix a missing check of kzalloc Ard Biesheuvel <ard.biesheuvel(a)linaro.org> efifb: Omit memory map check on legacy boot Ezequiel Garcia <ezequiel(a)collabora.com> media: gspca: Kill URBs on USB device disconnect Dan Carpenter <dan.carpenter(a)oracle.com> media: wl128x: prevent two potential buffer overflows Kangjie Lu <kjlu(a)umn.edu> media: video-mux: fix null pointer dereferences Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kobject: Don't trigger kobject_uevent(KOBJ_REMOVE) twice. Sowjanya Komatineni <skomatineni(a)nvidia.com> spi: tegra114: reset controller on probe Hans de Goede <hdegoede(a)redhat.com> HID: logitech-hidpp: change low battery level threshold from 31 to 30 percent Gustavo A. R. Silva <gustavo(a)embeddedor.com> cxgb3/l2t: Fix undefined behaviour Wen Yang <wen.yang99(a)zte.com.cn> ASoC: fsl_utils: fix a leaked reference by adding missing of_node_put Wen Yang <wen.yang99(a)zte.com.cn> ASoC: eukrea-tlv320: fix a leaked reference by adding missing of_node_put Nicolas Saenz Julienne <nsaenzjulienne(a)suse.de> HID: core: move Usage Page concatenation to Main item Geert Uytterhoeven <geert+renesas(a)glider.be> sh: sh7786: Add explicit I/O cast to sh7786_mm_sel() Leon Romanovsky <leon(a)kernel.org> RDMA/hns: Fix bad endianess of port_pd variable Chengguang Xu <cgxu519(a)gmx.com> chardev: add additional check for minor range overlap Peter Zijlstra <peterz(a)infradead.org> x86/uaccess: Fix up the fixup Peter Zijlstra <peterz(a)infradead.org> x86/ia32: Fix ia32_restore_sigcontext() AC leak Peter Zijlstra <peterz(a)infradead.org> x86/uaccess, signal: Fix AC=1 bloat Peter Zijlstra <peterz(a)infradead.org> x86/uaccess, ftrace: Fix ftrace_likely_update() vs. SMAP Lior David <liord(a)codeaurora.org> wil6210: fix return code of wmi_mgmt_tx and wmi_mgmt_tx_ext Wen Yang <wen.yang99(a)zte.com.cn> arm64: cpu_ops: fix a leaked reference by adding missing of_node_put Yannick Fertré <yannick.fertre(a)st.com> drm/panel: otm8009a: Add delay at the end of initialization Stanley Chu <stanley.chu(a)mediatek.com> scsi: ufs: Avoid configuring regulator with undefined voltage range Stanley Chu <stanley.chu(a)mediatek.com> scsi: ufs: Fix regulator load and icc-level configuration Ping-Ke Shih <pkshih(a)realtek.com> rtlwifi: fix potential NULL pointer dereference Alexandre Belloni <alexandre.belloni(a)bootlin.com> rtc: xgene: fix possible race condition Piotr Figiel <p.figiel(a)camlintechnologies.com> brcmfmac: fix Oops when bringing up interface during USB disconnect Piotr Figiel <p.figiel(a)camlintechnologies.com> brcmfmac: fix race during disconnect when USB completion is in progress Piotr Figiel <p.figiel(a)camlintechnologies.com> brcmfmac: fix WARNING during USB disconnect in case of unempty psq Piotr Figiel <p.figiel(a)camlintechnologies.com> brcmfmac: convert dev_init_lock mutex to completion Arnd Bergmann <arnd(a)arndb.de> b43: shut up clang -Wuninitialized variable warning Kangjie Lu <kjlu(a)umn.edu> brcmfmac: fix missing checks for kmemdup YueHaibing <yuehaibing(a)huawei.com> mwifiex: Fix mem leak in mwifiex_tm_cmd Kangjie Lu <kjlu(a)umn.edu> rtlwifi: fix a potential NULL pointer dereference Daniel T. Lee <danieltimlee(a)gmail.com> selftests/bpf: ksym_search won't check symbols exists Justin Chen <justinpopo6(a)gmail.com> iio: adc: ti-ads7950: Fix improper use of mlock Nathan Chancellor <natechancellor(a)gmail.com> iio: common: ssp_sensors: Initialize calculated_time in ssp_common_process_data Kangjie Lu <kjlu(a)umn.edu> iio: hmc5843: fix potential NULL pointer dereferences Lars-Peter Clausen <lars(a)metafoo.de> iio: ad_sigma_delta: Properly handle SPI bus locking vs CS assertion Wen Yang <wen.yang99(a)zte.com.cn> drm/pl111: fix possible object reference leak Kees Cook <keescook(a)chromium.org> x86/build: Keep local relocations with ld.lld David Kozub <zub(a)linux.fjfi.cvut.cz> block: sed-opal: fix IOC_OPAL_ENABLE_DISABLE_MBR Wen Yang <wen.yang99(a)zte.com.cn> cpufreq: kirkwood: fix possible object reference leak Wen Yang <wen.yang99(a)zte.com.cn> cpufreq: pmac32: fix possible object reference leak Wen Yang <wen.yang99(a)zte.com.cn> cpufreq/pasemi: fix possible object reference leak Wen Yang <wen.yang99(a)zte.com.cn> cpufreq: ppc_cbe: fix possible object reference leak Kristian Evensen <kristian.evensen(a)gmail.com> qmi_wwan: Add quirk for Quectel dynamic config Roman Gushchin <guro(a)fb.com> selftests: cgroup: fix cleanup path in test_memcg_subtree_control() Arnd Bergmann <arnd(a)arndb.de> s390: cio: fix cio_irb declaration Thomas Huth <thuth(a)redhat.com> s390/mm: silence compiler warning when compiling without CONFIG_PGSTE Borislav Petkov <bp(a)suse.de> x86/microcode: Fix the ancient deprecated microcode loading method Arnd Bergmann <arnd(a)arndb.de> s390: zcrypt: initialize variables before_use Douglas Anderson <dianders(a)chromium.org> clk: rockchip: Make rkpwm a critical clock on rk3288 Charles Keepax <ckeepax(a)opensource.cirrus.com> extcon: arizona: Disable mic detect if running when driver is removed Douglas Anderson <dianders(a)chromium.org> clk: rockchip: Fix video codec clocks on rk3288 Ulf Hansson <ulf.hansson(a)linaro.org> PM / core: Propagate dev->power.wakeup_path when no callbacks Christian König <christian.koenig(a)amd.com> drm/amdgpu: fix old fence check in amdgpu_fence_emit Yinbo Zhu <yinbo.zhu(a)nxp.com> mmc: sdhci-of-esdhc: add erratum eSDHC-A001 and A-008358 support Yinbo Zhu <yinbo.zhu(a)nxp.com> mmc: sdhci-of-esdhc: add erratum A-009204 support Yinbo Zhu <yinbo.zhu(a)nxp.com> mmc: sdhci-of-esdhc: add erratum eSDHC5 support Kangjie Lu <kjlu(a)umn.edu> mmc_spi: add a status check for spi_sync_locked Andrea Merello <andrea.merello(a)gmail.com> mmc: core: make pwrseq_emmc (partially) support sleepy GPIO controllers John Garry <john.garry(a)huawei.com> scsi: libsas: Do discovery on empty PHY to update PHY info Guenter Roeck <linux(a)roeck-us.net> hwmon: (f71805f) Use request_muxed_region for Super-IO accesses Guenter Roeck <linux(a)roeck-us.net> hwmon: (pc87427) Use request_muxed_region for Super-IO accesses Guenter Roeck <linux(a)roeck-us.net> hwmon: (smsc47b397) Use request_muxed_region for Super-IO accesses Guenter Roeck <linux(a)roeck-us.net> hwmon: (smsc47m1) Use request_muxed_region for Super-IO accesses Guenter Roeck <linux(a)roeck-us.net> hwmon: (vt1211) Use request_muxed_region for Super-IO accesses Kan Liang <kan.liang(a)linux.intel.com> perf/x86/intel/cstate: Add Icelake support Kan Liang <kan.liang(a)linux.intel.com> perf/x86/intel/rapl: Add Icelake support Kan Liang <kan.liang(a)linux.intel.com> perf/x86/msr: Add Icelake support Colin Ian King <colin.king(a)canonical.com> RDMA/cxgb4: Fix null pointer dereference on alloc_skb failure Vincenzo Frascino <vincenzo.frascino(a)arm.com> arm64: vdso: Fix clock_getres() for CLOCK_REALTIME Kefeng Wang <wangkefeng.wang(a)huawei.com> ACPI/IORT: Reject platform device creation on NUMA node mapping failure Nicholas Nunley <nicholas.d.nunley(a)intel.com> i40e: don't allow changes to HW VLAN stripping on active port VLANs Adam Ludkiewicz <adam.ludkiewicz(a)intel.com> i40e: Able to add up to 16 MAC filters on an untrusted VF Arnd Bergmann <arnd(a)arndb.de> phy: mapphone-mdm6600: add gpiolib dependency Paul Kocialkowski <paul.kocialkowski(a)bootlin.com> phy: sun4i-usb: Make sure to disable PHY0 passby for peripheral mode Russell King <rmk+kernel(a)armlinux.org.uk> drm: etnaviv: avoid DMA API warning when importing buffers Thomas Gleixner <tglx(a)linutronix.de> x86/irq/64: Limit IST stack overflow check to #DB stack Alan Stern <stern(a)rowland.harvard.edu> USB: core: Don't unbind interfaces following device reset failure Julian Wiedmann <jwi(a)linux.ibm.com> s390/qeth: handle error from qeth_update_from_chp_desc() Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Take domain lock in switch sysfs attribute callbacks Nicholas Piggin <npiggin(a)gmail.com> irq_work: Do not raise an IPI when queueing work on the local CPU Wen Yang <wen.yang99(a)zte.com.cn> drm/msm: a5xx: fix possible object reference leak Nicholas Mc Guire <hofrat(a)osadl.org> staging: vc04_services: handle kzalloc failure Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru> sched/core: Handle overflow in cpu_shares_write_u64 Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru> sched/rt: Check integer overflow at usec to nsec conversion Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru> sched/core: Check quota and period overflow at usec to nsec conversion Roman Gushchin <guro(a)fb.com> cgroup: protect cgroup->nr_(dying_)descendants by css_set_lock Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> random: add a spinlock_t to struct batched_entropy Jon DeVree <nuxi(a)vault24.org> random: fix CRNG initialization when random.trust_cpu=1 Russell Currey <ruscur(a)russell.cc> powerpc/64: Fix booting large kernels with STRICT_KERNEL_RWX Nathan Lynch <nathanl(a)linux.ibm.com> powerpc/numa: improve control of topology updates Yufen Yu <yuyufen(a)huawei.com> block: fix use-after-free on gendisk Fabrice Gasnier <fabrice.gasnier(a)st.com> iio: adc: stm32-dfsdm: fix unmet direct dependencies detected Dan Carpenter <dan.carpenter(a)oracle.com> media: pvrusb2: Prevent a buffer overflow Shuah Khan <shuah(a)kernel.org> media: au0828: Fix NULL pointer dereference in au0828_analog_stream_enable() Hugues Fruchet <hugues.fruchet(a)st.com> media: stm32-dcmi: fix crash when subdev do not expose any formats Wenwen Wang <wang6495(a)umn.edu> audit: fix a memory leak bug Akinobu Mita <akinobu.mita(a)gmail.com> media: ov2659: make S_FMT succeed even if requested format doesn't match Hans Verkuil <hverkuil(a)xs4all.nl> media: au0828: stop video streaming only when last user stops Janusz Krzysztofik <jmkrzyszt(a)gmail.com> media: ov6650: Move v4l2_clk_get() to ov6650_video_probe() helper Philipp Zabel <p.zabel(a)pengutronix.de> media: coda: clear error return value before picture run Nicolas Ferre <nicolas.ferre(a)microchip.com> dmaengine: at_xdmac: remove BUG_ON macro in tasklet Robin Murphy <robin.murphy(a)arm.com> perf/arm-cci: Remove broken race mitigation Douglas Anderson <dianders(a)chromium.org> clk: rockchip: undo several noc and special clocks as critical on rk3288 Wen Yang <wen.yang99(a)zte.com.cn> pinctrl: samsung: fix leaked of_node references Wen Yang <wen.yang99(a)zte.com.cn> pinctrl: pistachio: fix leaked of_node references Hans de Goede <hdegoede(a)redhat.com> HID: logitech-hidpp: use RAP instead of FAP to get the protocol version Balakrishna Godavarthi <bgodavar(a)codeaurora.org> Bluetooth: hci_qca: Give enough time to ROME controller to bootup. Peter Zijlstra <peterz(a)infradead.org> mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC versions Jiri Kosina <jkosina(a)suse.cz> x86/mm: Remove in_nmi() warning from 64-bit implementation of vmalloc_fault() Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> smpboot: Place the __percpu annotation correctly Kees Cook <keescook(a)chromium.org> x86/build: Move _etext to actual end of .text Farhan Ali <alifm(a)linux.ibm.com> vfio-ccw: Release any channel program when releasing/removing vfio-ccw mdev Farhan Ali <alifm(a)linux.ibm.com> vfio-ccw: Do not call flush_workqueue while holding the spinlock Parav Pandit <parav(a)mellanox.com> RDMA/cma: Consider scope_id while binding to ipv6 ll address Arnd Bergmann <arnd(a)arndb.de> bcache: avoid clang -Wunintialized warning Coly Li <colyli(a)suse.de> bcache: add failure check to run_cache_set() for journal replay Tang Junhui <tang.junhui.linux(a)gmail.com> bcache: fix failure in journal relplay Coly Li <colyli(a)suse.de> bcache: return error immediately in bch_journal_replay() Shenghui Wang <shhuiw(a)foxmail.com> bcache: avoid potential memleak of list of journal_replay(s) in the CACHE_SYNC branch of run_cache_set Corentin Labbe <clabbe.montjoie(a)gmail.com> crypto: sun4i-ss - Fix invalid calculation of hash end Sagi Grimberg <sagi(a)grimberg.me> nvme-rdma: fix a NULL deref when an admin connect times out Sagi Grimberg <sagi(a)grimberg.me> nvme: set 0 capacity if namespace block size exceeds PAGE_SIZE Kangjie Lu <kjlu(a)umn.edu> net: cw1200: fix a NULL pointer dereference Aditya Pakki <pakki001(a)umn.edu> rsi: Fix NULL pointer dereference in kmalloc Dan Carpenter <dan.carpenter(a)oracle.com> mwifiex: prevent an array overflow Daniel Baluta <daniel.baluta(a)nxp.com> ASoC: fsl_sai: Update is_slave_mode with correct value Kangjie Lu <kjlu(a)umn.edu> slimbus: fix a potential NULL pointer dereference in of_qcom_slim_ngd_register Daniel T. Lee <danieltimlee(a)gmail.com> libbpf: fix samples/bpf build failure due to undefined UINT32_MAX Sergey Matyukevich <sergey.matyukevich.os(a)quantenna.com> mac80211/cfg80211: update bss channel on channel switch Sugar Zhang <sugar.zhang(a)rock-chips.com> dmaengine: pl330: _stop: clear interrupt status Arnd Bergmann <arnd(a)arndb.de> s390: qeth: address type mismatch warning Mariusz Bialonczyk <manio(a)skyboo.net> w1: fix the resume command API Nicholas Piggin <npiggin(a)gmail.com> sched/nohz: Run NOHZ idle load balancer on HK_FLAG_MISC CPUs Philipp Rudo <prudo(a)linux.ibm.com> s390/kexec_file: Fix detection of text segment in ELF loader Manish Rangankar <mrangankar(a)marvell.com> scsi: qedi: Abort ep termination if offload not scheduled Fabien Dessenne <fabien.dessenne(a)st.com> rtc: stm32: manage the get_irq probe defer case Sven Van Asbroeck <thesven73(a)gmail.com> rtc: 88pm860x: prevent use-after-free on device remove Johannes Berg <johannes.berg(a)intel.com> iwlwifi: pcie: don't crash on invalid RX interrupt Qu Wenruo <wqu(a)suse.com> btrfs: Don't panic when we can't find a root key Josef Bacik <josef(a)toxicpanda.com> btrfs: fix panic during relocation after ENOSPC before writeback happens Robbie Ko <robbieko(a)synology.com> Btrfs: fix data bytes_may_use underflow with fallocate due to failed quota reserve Nadav Amit <namit(a)vmware.com> x86/modules: Avoid breaking W^X while loading modules Bart Van Assche <bvanassche(a)acm.org> scsi: qla2xxx: Fix hardirq-unsafe locking Bart Van Assche <bvanassche(a)acm.org> scsi: qla2xxx: Avoid that lockdep complains about unsafe locking in tcm_qla2xxx_close_session() Bart Van Assche <bvanassche(a)acm.org> scsi: qla2xxx: Fix abort handling in tcm_qla2xxx_write_pending() Bart Van Assche <bvanassche(a)acm.org> scsi: qla2xxx: Fix a qla24xx_enable_msix() error path Viresh Kumar <viresh.kumar(a)linaro.org> sched/cpufreq: Fix kobject memleak Nicholas Piggin <npiggin(a)gmail.com> powerpc/watchdog: Use hrtimers for per-CPU heartbeat Qian Cai <cai(a)lca.pw> arm64: Fix compiler warning from pte_unmap() with -Wunused-but-set-variable Marc Zyngier <marc.zyngier(a)arm.com> ARM: vdso: Remove dependency with the arch_timer driver internals Fabien Dessenne <fabien.dessenne(a)st.com> media: stm32-dcmi: return appropriate error codes during probe Jon Derrick <jonathan.derrick(a)intel.com> drm/nouveau/bar/nv50: ensure BAR is mapped Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> ACPI / property: fix handling of data_nodes in acpi_get_next_subnode() Dan Carpenter <dan.carpenter(a)oracle.com> brcm80211: potential NULL dereference in brcmf_cfg80211_vndr_cmds_dcmd_handler() Flavio Suligoi <f.suligoi(a)asem.it> spi: pxa2xx: fix SCR (divisor) calculation Arnd Bergmann <arnd(a)arndb.de> ASoC: imx: fix fiq dependencies Anju T Sudhakar <anju(a)linux.vnet.ibm.com> powerpc/perf: Fix loop exit condition in nest_imc_event_init Bo YU <tsu.yubo(a)gmail.com> powerpc/boot: Fix missing check of lseek() return value Anju T Sudhakar <anju(a)linux.vnet.ibm.com> powerpc/perf: Return accordingly on invalid chip-id in Jerome Brunet <jbrunet(a)baylibre.com> ASoC: hdmi-codec: unlock the device on startup errors Marek Szyprowski <m.szyprowski(a)samsung.com> usb: dwc3: move synchronize_irq() out of the spinlock protected block Minas Harutyunyan <minas.harutyunyan(a)synopsys.com> usb: dwc2: gadget: Increase descriptors count for ISOC's Mac Chiang <mac.chiang(a)intel.com> ASoC: Intel: kbl_da7219_max98357a: Map BTN_0 to KEY_PLAYPAUSE Wen Yang <wen.yang99(a)zte.com.cn> pinctrl: zte: fix leaked of_node references João Paulo Rechi Vita <jprvita(a)gmail.com> Bluetooth: Ignore CC events not matching the last HCI command Haiyang Zhang <haiyangz(a)microsoft.com> hv_netvsc: fix race that may miss tx queue wakeup Sameeh Jubran <sameehj(a)amazon.com> net: ena: gcc 8: fix compilation warning Sameer Pujar <spujar(a)nvidia.com> dmaengine: tegra210-dma: free dma controller in remove() Masahiro Yamada <yamada.masahiro(a)socionext.com> bpftool: exclude bash-completion/bpftool from .gitignore pattern Yonghong Song <yhs(a)fb.com> selftests/bpf: set RLIMIT_MEMLOCK properly for test_libbpf_open.c Vineet Gupta <Vineet.Gupta1(a)synopsys.com> tools/bpf: fix perf build error with uClibc (seen on ARC) Raul E Rangel <rrangel(a)chromium.org> mmc: core: Verify SD bus width Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: Fix occasional glock use-after-free Mike Marciniszyn <mike.marciniszyn(a)intel.com> IB/hfi1: Fix WQ_MEM_RECLAIM warning Roberto Bergantinos Corpas <rbergant(a)redhat.com> NFS: make nfs_match_client killable YueHaibing <yuehaibing(a)huawei.com> cxgb4: Fix error path in cxgb4_init_module Ross Lagerwall <ross.lagerwall(a)citrix.com> gfs2: Fix lru_count going negative David Sterba <dsterba(a)suse.com> Revert "btrfs: Honour FITRIM range constraints during free space trim" Al Viro <viro(a)zeniv.linux.org.uk> acct_on(): don't mess with freeze protection YueHaibing <yuehaibing(a)huawei.com> at76c50x-usb: Don't register led_trigger if usb_register_driver failed Linus Lüssing <linus.luessing(a)c0d3.blue> batman-adv: mcast: fix multicast tt/tvlv worker locking Eric Dumazet <edumazet(a)google.com> bpf: devmap: fix use-after-free Read in __dev_map_entry_free YueHaibing <yuehaibing(a)huawei.com> ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit Alexander Potapenko <glider(a)google.com> media: vivid: use vfree() instead of kfree() for dev->bitmap_cap Hans Verkuil <hverkuil(a)xs4all.nl> media: vb2: add waiting_in_dqbuf flag YueHaibing <yuehaibing(a)huawei.com> media: serial_ir: Fix use-after-free in serial_ir_init_module YueHaibing <yuehaibing(a)huawei.com> media: cpia2: Fix use-after-free in cpia2_exit Jiufei Xue <jiufei.xue(a)linux.alibaba.com> fbdev: fix WARNING in __alloc_pages_nodemask bug Amir Goldstein <amir73il(a)gmail.com> ovl: relax WARN_ON() for overlapping layers use case Josef Bacik <josef(a)toxicpanda.com> btrfs: honor path->skip_locking in backref code Will Deacon <will.deacon(a)arm.com> arm64: errata: Add workaround for Cortex-A76 erratum #1463225 Arend van Spriel <arend.vanspriel(a)broadcom.com> brcmfmac: add subtype check for event handling in data path Arend van Spriel <arend.vanspriel(a)broadcom.com> brcmfmac: assure SSID length from firmware is limited Daniel Borkmann <daniel(a)iogearbox.net> bpf: add bpf_jit_limit knob to restrict unpriv allocations Olga Kornievskaia <kolga(a)netapp.com> NFSv4.1 fix incorrect return value in copy_file_range Olga Kornievskaia <olga.kornievskaia(a)gmail.com> NFSv4.2 fix unnecessary retry in nfs4_copy_file_range Shile Zhang <shile.zhang(a)linux.alibaba.com> fbdev: fix divide error in fb_var_to_videomode Dan Carpenter <dan.carpenter(a)oracle.com> udlfb: fix some inconsistent NULL checking Tobin C. Harding <tobin(a)kernel.org> btrfs: sysfs: don't leak memory when failing add fsid Tobin C. Harding <tobin(a)kernel.org> btrfs: sysfs: Fix error path kobject memory leak Filipe Manana <fdmanana(a)suse.com> Btrfs: fix race between ranged fsync and writeback of adjacent ranges Filipe Manana <fdmanana(a)suse.com> Btrfs: avoid fallback to transaction commit during fsync of files with holes Filipe Manana <fdmanana(a)suse.com> Btrfs: do not abort transaction at btrfs_update_root() after failure to COW path Josef Bacik <josef(a)toxicpanda.com> btrfs: don't double unlock on error in btrfs_punch_hole Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: Fix sign extension bug in gfs2_update_stats Christoph Hellwig <hch(a)lst.de> arm64/iommu: handle non-remapped addresses in ->mmap and ->get_sgtable Ard Biesheuvel <ard.biesheuvel(a)arm.com> arm64/kernel: kaslr: reduce module randomization range to 2 GB Dan Williams <dan.j.williams(a)intel.com> libnvdimm/pmem: Bypass CONFIG_HARDENED_USERCOPY overhead Suthikulpanit, Suravee <Suravee.Suthikulpanit(a)amd.com> kvm: svm/avic: fix off-by-one in checking host APIC ID Trac Hoang <trac.hoang(a)broadcom.com> mmc: sdhci-iproc: Set NO_HISPD bit to fix HS50 data hold time problem Trac Hoang <trac.hoang(a)broadcom.com> mmc: sdhci-iproc: cygnus: Set NO_HISPD bit to fix HS50 data hold time problem Daniel Axtens <dja(a)axtens.net> crypto: vmx - CTR: always increment IV as quadword Martin K. Petersen <martin.petersen(a)oracle.com> Revert "scsi: sd: Keep disk read-only when re-reading partition" Andrea Parri <andrea.parri(a)amarulasolutions.com> sbitmap: fix improper use of smp_mb__before_atomic() Andrea Parri <andrea.parri(a)amarulasolutions.com> bio: fix improper use of smp_mb__before_atomic() Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: fix return value for reserved EFER Damien Le Moal <damien.lemoal(a)wdc.com> f2fs: Fix use of number of devices Jan Kara <jack(a)suse.cz> ext4: wait for outstanding dio during truncate in nojournal mode Jan Kara <jack(a)suse.cz> ext4: do not delete unlinked inode from orphan list on failed truncate Steven Rostedt (VMware) <rostedt(a)goodmis.org> x86: Hide the int3_emulate_call/jmp functions from UML ------------- Diffstat: Documentation/arm64/silicon-errata.txt | 1 + Documentation/sysctl/net.txt | 8 +++ Makefile | 4 +- arch/arm/include/asm/cp15.h | 2 + arch/arm/vdso/vgettimeofday.c | 5 +- arch/arm64/Kconfig | 18 +++++ arch/arm64/include/asm/cpucaps.h | 3 +- arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/pgtable.h | 3 +- arch/arm64/include/asm/vdso_datapage.h | 1 + arch/arm64/kernel/asm-offsets.c | 2 +- arch/arm64/kernel/cpu_errata.c | 24 +++++++ arch/arm64/kernel/cpu_ops.c | 1 + arch/arm64/kernel/kaslr.c | 6 +- arch/arm64/kernel/module.c | 2 +- arch/arm64/kernel/syscall.c | 31 +++++++++ arch/arm64/kernel/vdso.c | 3 + arch/arm64/kernel/vdso/gettimeofday.S | 7 +- arch/arm64/mm/dma-mapping.c | 10 +++ arch/arm64/mm/fault.c | 37 +++++++++- arch/powerpc/boot/addnote.c | 6 +- arch/powerpc/kernel/head_64.S | 4 +- arch/powerpc/kernel/watchdog.c | 81 +++++++++++----------- arch/powerpc/mm/numa.c | 18 +++-- arch/powerpc/perf/imc-pmu.c | 7 +- arch/powerpc/platforms/powernv/opal-imc.c | 2 +- arch/s390/kernel/kexec_elf.c | 7 +- arch/s390/mm/pgtable.c | 2 + arch/sh/include/cpu-sh4/cpu/sh7786.h | 2 +- arch/x86/Makefile | 2 +- arch/x86/events/intel/cstate.c | 2 + arch/x86/events/intel/rapl.c | 2 + arch/x86/events/msr.c | 1 + arch/x86/ia32/ia32_signal.c | 29 ++++---- arch/x86/include/asm/text-patching.h | 4 +- arch/x86/kernel/alternative.c | 28 ++++++-- arch/x86/kernel/cpu/mcheck/mce-inject.c | 14 ++-- arch/x86/kernel/cpu/mcheck/mce.c | 66 ++++++++++++------ arch/x86/kernel/cpu/microcode/core.c | 3 +- arch/x86/kernel/irq_64.c | 19 +++-- arch/x86/kernel/module.c | 2 +- arch/x86/kernel/signal.c | 29 ++++---- arch/x86/kernel/vmlinux.lds.S | 6 +- arch/x86/kvm/svm.c | 6 +- arch/x86/kvm/x86.c | 2 +- arch/x86/lib/memcpy_64.S | 3 +- arch/x86/mm/fault.c | 2 - block/genhd.c | 19 +++++ block/partition-generic.c | 7 ++ block/sed-opal.c | 9 ++- drivers/acpi/arm64/iort.c | 19 +++-- drivers/acpi/property.c | 8 +++ drivers/base/power/main.c | 4 ++ drivers/bluetooth/hci_qca.c | 2 + drivers/char/hw_random/omap-rng.c | 1 + drivers/char/random.c | 57 ++++++++------- drivers/char/virtio_console.c | 3 +- drivers/clk/rockchip/clk-rk3288.c | 21 +++--- drivers/cpufreq/cpufreq.c | 1 + drivers/cpufreq/cpufreq_governor.c | 2 + drivers/cpufreq/kirkwood-cpufreq.c | 19 ++--- drivers/cpufreq/pasemi-cpufreq.c | 1 + drivers/cpufreq/pmac32-cpufreq.c | 2 + drivers/cpufreq/ppc_cbe_cpufreq.c | 1 + drivers/crypto/sunxi-ss/sun4i-ss-hash.c | 5 +- drivers/crypto/vmx/aesp8-ppc.pl | 2 +- drivers/dma/at_xdmac.c | 6 +- drivers/dma/pl330.c | 10 ++- drivers/dma/tegra210-adma.c | 28 ++++---- drivers/extcon/extcon-arizona.c | 10 +++ drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 24 +++++-- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 6 +- .../gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c | 20 ++++-- drivers/gpu/drm/drm_drv.c | 5 +- drivers/gpu/drm/drm_file.c | 1 + drivers/gpu/drm/etnaviv/etnaviv_drv.c | 5 ++ drivers/gpu/drm/etnaviv/etnaviv_drv.h | 1 + drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 10 +-- drivers/gpu/drm/nouveau/nvkm/subdev/bar/nv50.c | 12 +++- drivers/gpu/drm/omapdrm/dss/dsi.c | 60 ++++++++-------- drivers/gpu/drm/panel/panel-orisetech-otm8009a.c | 3 + drivers/gpu/drm/pl111/pl111_versatile.c | 4 ++ drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 8 ++- drivers/gpu/drm/tinydrm/ili9225.c | 6 +- drivers/gpu/drm/tinydrm/mipi-dbi.c | 58 +++++++++++----- drivers/gpu/drm/v3d/v3d_drv.c | 8 ++- drivers/gpu/drm/v3d/v3d_drv.h | 2 +- drivers/gpu/drm/v3d/v3d_irq.c | 13 +++- drivers/hid/hid-core.c | 36 ++++++---- drivers/hid/hid-logitech-hidpp.c | 23 ++++-- drivers/hwmon/f71805f.c | 15 +++- drivers/hwmon/pc87427.c | 14 +++- drivers/hwmon/smsc47b397.c | 13 +++- drivers/hwmon/smsc47m1.c | 28 +++++--- drivers/hwmon/vt1211.c | 15 +++- drivers/iio/adc/Kconfig | 1 + drivers/iio/adc/ad_sigma_delta.c | 16 +++-- drivers/iio/adc/ti-ads7950.c | 19 +++-- drivers/iio/common/ssp_sensors/ssp_iio.c | 2 +- drivers/iio/magnetometer/hmc5843_i2c.c | 7 +- drivers/iio/magnetometer/hmc5843_spi.c | 7 +- drivers/infiniband/core/cma.c | 25 +++++-- drivers/infiniband/hw/cxgb4/cm.c | 2 + drivers/infiniband/hw/hfi1/init.c | 3 +- drivers/infiniband/hw/hns/hns_roce_ah.c | 2 +- drivers/md/bcache/alloc.c | 5 +- drivers/md/bcache/journal.c | 26 ++++++- drivers/md/bcache/super.c | 25 +++++-- drivers/media/common/videobuf2/videobuf2-core.c | 22 ++++++ drivers/media/dvb-frontends/m88ds3103.c | 9 ++- drivers/media/dvb-frontends/si2165.c | 8 ++- drivers/media/i2c/ov2659.c | 6 +- drivers/media/i2c/ov6650.c | 25 ++++--- drivers/media/pci/saa7146/hexium_gemini.c | 5 +- drivers/media/pci/saa7146/hexium_orion.c | 5 +- drivers/media/platform/coda/coda-bit.c | 3 + drivers/media/platform/stm32/stm32-dcmi.c | 20 ++++-- drivers/media/platform/video-mux.c | 5 ++ drivers/media/platform/vimc/vimc-core.c | 2 + drivers/media/platform/vimc/vimc-streamer.c | 2 +- drivers/media/platform/vivid/vivid-vid-cap.c | 2 +- drivers/media/radio/wl128x/fmdrv_common.c | 7 +- drivers/media/rc/serial_ir.c | 9 +-- drivers/media/usb/au0828/au0828-video.c | 16 +++-- drivers/media/usb/cpia2/cpia2_v4l.c | 3 +- drivers/media/usb/dvb-usb-v2/dvbsky.c | 18 ++--- drivers/media/usb/go7007/go7007-fw.c | 4 +- drivers/media/usb/gspca/gspca.c | 12 +++- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 2 + drivers/media/usb/pvrusb2/pvrusb2-hdw.h | 1 + drivers/mmc/core/pwrseq_emmc.c | 38 +++++----- drivers/mmc/core/sd.c | 8 +++ drivers/mmc/host/mmc_spi.c | 4 ++ drivers/mmc/host/sdhci-iproc.c | 6 +- drivers/mmc/host/sdhci-of-esdhc.c | 8 +++ drivers/net/ethernet/amazon/ena/ena_netdev.c | 2 +- drivers/net/ethernet/chelsio/cxgb3/l2t.h | 2 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 15 +++- drivers/net/ethernet/intel/e1000e/netdev.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 8 +++ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 6 +- drivers/net/ethernet/intel/igb/igb_main.c | 3 + drivers/net/hyperv/netvsc.c | 15 ++-- drivers/net/usb/qmi_wwan.c | 65 +++++++++-------- drivers/net/wireless/ath/wil6210/cfg80211.c | 5 ++ drivers/net/wireless/ath/wil6210/wmi.c | 11 +-- drivers/net/wireless/atmel/at76c50x-usb.c | 4 +- drivers/net/wireless/broadcom/b43/phy_lp.c | 6 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 6 ++ .../wireless/broadcom/brcm80211/brcmfmac/core.c | 15 ++-- .../wireless/broadcom/brcm80211/brcmfmac/fweh.h | 16 +++-- .../broadcom/brcm80211/brcmfmac/fwsignal.c | 42 ++++++----- .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 2 +- .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 27 +++++--- .../wireless/broadcom/brcm80211/brcmfmac/vendor.c | 5 +- drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 7 +- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 6 +- drivers/net/wireless/marvell/mwifiex/cfp.c | 3 + drivers/net/wireless/realtek/rtlwifi/base.c | 5 ++ .../net/wireless/realtek/rtlwifi/rtl8188ee/fw.c | 2 + .../wireless/realtek/rtlwifi/rtl8192c/fw_common.c | 2 + .../net/wireless/realtek/rtlwifi/rtl8192ee/fw.c | 2 + .../net/wireless/realtek/rtlwifi/rtl8723ae/fw.c | 2 + .../net/wireless/realtek/rtlwifi/rtl8723be/fw.c | 2 + .../net/wireless/realtek/rtlwifi/rtl8821ae/fw.c | 4 ++ drivers/net/wireless/rsi/rsi_91x_mac80211.c | 30 ++++---- drivers/net/wireless/st/cw1200/main.c | 5 ++ drivers/nvdimm/pmem.c | 10 ++- drivers/nvme/host/core.c | 7 +- drivers/nvme/host/rdma.c | 10 +-- drivers/perf/arm-cci.c | 21 +++--- drivers/phy/allwinner/phy-sun4i-usb.c | 4 ++ drivers/phy/motorola/Kconfig | 2 +- drivers/pinctrl/pinctrl-pistachio.c | 2 + drivers/pinctrl/samsung/pinctrl-exynos-arm.c | 1 + drivers/pinctrl/zte/pinctrl-zx.c | 1 + drivers/rtc/rtc-88pm860x.c | 2 +- drivers/rtc/rtc-stm32.c | 9 ++- drivers/rtc/rtc-xgene.c | 18 +++-- drivers/s390/cio/cio.h | 2 +- drivers/s390/cio/vfio_ccw_drv.c | 32 +++++---- drivers/s390/cio/vfio_ccw_ops.c | 11 ++- drivers/s390/crypto/zcrypt_api.c | 4 ++ drivers/s390/net/qeth_core.h | 10 ++- drivers/s390/net/qeth_core_main.c | 14 ++-- drivers/scsi/libsas/sas_expander.c | 5 ++ drivers/scsi/lpfc/lpfc_ct.c | 20 ++++-- drivers/scsi/lpfc/lpfc_hbadisc.c | 11 ++- drivers/scsi/lpfc/lpfc_nvme.c | 8 +-- drivers/scsi/qedf/qedf_io.c | 1 + drivers/scsi/qedi/qedi_iscsi.c | 3 + drivers/scsi/qla2xxx/qla_isr.c | 6 +- drivers/scsi/qla2xxx/qla_target.c | 25 +++---- drivers/scsi/qla2xxx/tcm_qla2xxx.c | 7 +- drivers/scsi/qla4xxx/ql4_os.c | 2 +- drivers/scsi/sd.c | 3 +- drivers/scsi/ufs/ufs-hisi.c | 4 ++ drivers/scsi/ufs/ufshcd.c | 28 +++++--- drivers/slimbus/qcom-ngd-ctrl.c | 4 ++ drivers/spi/spi-imx.c | 2 +- drivers/spi/spi-pxa2xx.c | 8 ++- drivers/spi/spi-rspi.c | 9 ++- drivers/spi/spi-tegra114.c | 32 +++++---- drivers/spi/spi-topcliff-pch.c | 15 +++- drivers/spi/spi.c | 2 + drivers/ssb/bridge_pcmcia_80211.c | 9 ++- drivers/staging/media/davinci_vpfe/Kconfig | 2 +- .../interface/vchiq_arm/vchiq_2835_arm.c | 3 + .../vc04_services/interface/vchiq_arm/vchiq_core.c | 2 + drivers/thunderbolt/icm.c | 5 ++ drivers/thunderbolt/property.c | 12 +++- drivers/thunderbolt/switch.c | 67 +++++++++--------- drivers/thunderbolt/tb.h | 3 +- drivers/thunderbolt/xdomain.c | 8 ++- drivers/tty/ipwireless/main.c | 8 +++ drivers/usb/core/hcd.c | 3 + drivers/usb/core/hub.c | 5 +- drivers/usb/dwc2/gadget.c | 27 ++++---- drivers/usb/dwc3/core.c | 2 + drivers/usb/dwc3/gadget.c | 2 - drivers/video/fbdev/core/fbcmap.c | 2 + drivers/video/fbdev/core/modedb.c | 3 + drivers/video/fbdev/efifb.c | 3 +- drivers/video/fbdev/udlfb.c | 14 ++-- drivers/w1/w1_io.c | 3 +- fs/btrfs/backref.c | 19 +++-- fs/btrfs/extent-tree.c | 28 ++------ fs/btrfs/file.c | 19 +++-- fs/btrfs/relocation.c | 31 ++++++--- fs/btrfs/root-tree.c | 17 ++--- fs/btrfs/sysfs.c | 7 +- fs/btrfs/tree-log.c | 1 + fs/char_dev.c | 6 ++ fs/ext4/inode.c | 23 +++--- fs/f2fs/data.c | 17 +++-- fs/f2fs/f2fs.h | 13 +++- fs/f2fs/file.c | 2 +- fs/f2fs/gc.c | 2 +- fs/f2fs/segment.c | 13 ++-- fs/gfs2/glock.c | 23 +++--- fs/gfs2/lock_dlm.c | 9 +-- fs/gfs2/log.c | 3 +- fs/gfs2/lops.c | 6 +- fs/internal.h | 2 - fs/nfs/client.c | 7 +- fs/nfs/nfs42proc.c | 3 - fs/nfs/nfs4file.c | 12 ++-- fs/overlayfs/dir.c | 2 +- fs/overlayfs/inode.c | 3 +- include/drm/tinydrm/mipi-dbi.h | 5 +- include/linux/bio.h | 2 +- include/linux/cgroup-defs.h | 5 ++ include/linux/filter.h | 2 + include/linux/genhd.h | 1 + include/linux/hid.h | 1 + include/linux/iio/adc/ad_sigma_delta.h | 1 + include/linux/mount.h | 2 + include/linux/overflow.h | 12 +++- include/linux/smpboot.h | 2 +- include/linux/time64.h | 21 ++++++ include/media/videobuf2-core.h | 1 + include/net/bluetooth/hci.h | 1 + kernel/acct.c | 4 +- kernel/auditfilter.c | 12 ++-- kernel/bpf/core.c | 49 ++++++++++++- kernel/bpf/devmap.c | 3 + kernel/cgroup/cgroup.c | 6 ++ kernel/irq_work.c | 75 +++++++++++--------- kernel/module.c | 5 ++ kernel/rcu/rcuperf.c | 5 ++ kernel/rcu/rcutorture.c | 5 ++ kernel/sched/core.c | 9 ++- kernel/sched/fair.c | 16 +++-- kernel/sched/rt.c | 5 ++ kernel/time/time.c | 2 +- kernel/time/timekeeping.c | 6 +- kernel/trace/trace_branch.c | 4 ++ lib/kobject_uevent.c | 11 +-- lib/sbitmap.c | 2 +- lib/strncpy_from_user.c | 5 +- lib/strnlen_user.c | 4 +- net/batman-adv/distributed-arp-table.c | 4 +- net/batman-adv/main.c | 1 + net/batman-adv/multicast.c | 11 +-- net/batman-adv/types.h | 5 ++ net/bluetooth/hci_core.c | 5 ++ net/bluetooth/hci_event.c | 12 ++++ net/bluetooth/hci_request.c | 5 ++ net/bluetooth/hci_request.h | 1 + net/core/sysctl_net_core.c | 10 ++- net/mac80211/mlme.c | 3 - net/wireless/nl80211.c | 5 ++ security/selinux/netlabel.c | 14 ++-- sound/soc/codecs/hdmi-codec.c | 6 +- sound/soc/davinci/davinci-mcasp.c | 2 + sound/soc/fsl/Kconfig | 9 +-- sound/soc/fsl/eukrea-tlv320.c | 4 +- sound/soc/fsl/fsl_sai.c | 2 + sound/soc/fsl/fsl_utils.c | 1 + sound/soc/intel/boards/kbl_da7219_max98357a.c | 2 +- tools/bpf/bpftool/.gitignore | 2 +- tools/lib/bpf/bpf.c | 2 + tools/lib/bpf/bpf.h | 1 + tools/testing/selftests/bpf/test_libbpf_open.c | 2 + tools/testing/selftests/bpf/trace_helpers.c | 4 ++ tools/testing/selftests/cgroup/test_memcontrol.c | 38 +++++----- 307 files changed, 2130 insertions(+), 977 deletions(-)

5 years, 5 months

11
292
0 0

[PATCH 2/7] drm/i915/sdvo: Implement proper HDMI audio support for SDVO

by Ville Syrjala

From: Ville Syrjälä <ville.syrjala(a)linux.intel.com> Our SDVO audio support is pretty bogus. We can't push audio over the SDVO bus, so trying to enable audio in the SDVO control register doesn't do anything. In fact it looks like the SDVO encoder will always mix in the audio coming over HDA, and there's no (at least documented) way to disable that from our side. So HDMI audio does work currently but only by luck really. What is missing though is the ELD. To pass the ELD to the audio driver we need to write it to magic buffer in the SDVO encoder hardware which then gets pulled out via HDA in the other end. Ie. pretty much the same thing we had for native HDMI before we started to just pass the ELD between the drivers. This sort of explains why we even have that silly hardware buffer with native HDMI. $ cat /proc/asound/card0/eld#1.0 -monitor_present 0 -eld_valid 0 +monitor_present 1 +eld_valid 1 +monitor_name LG TV +connection_type HDMI +... This also fixes our state readout since we can now query the SDVO encoder about the state of the "ELD valid" and "presence detect" bits. As mentioned those don't actually control whether audio gets sent over the HDMI cable, but it's the best we can do. Cc: stable(a)vger.kernel.org Cc: Daniel Vetter <daniel.vetter(a)ffwll.ch> Cc: zardam(a)gmail.com Tested-by: zardam(a)gmail.com Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108976 Fixes: de44e256b92c ("drm/i915/sdvo: Shut up state checker with hdmi cards on gen3") Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com> --- drivers/gpu/drm/i915/intel_sdvo.c | 58 +++++++++++++++++++++----- drivers/gpu/drm/i915/intel_sdvo_regs.h | 3 ++ 2 files changed, 50 insertions(+), 11 deletions(-) diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c index 61db07244296..7f64352a3413 100644 --- a/drivers/gpu/drm/i915/intel_sdvo.c +++ b/drivers/gpu/drm/i915/intel_sdvo.c @@ -916,6 +916,13 @@ static bool intel_sdvo_set_colorimetry(struct intel_sdvo *intel_sdvo, return intel_sdvo_set_value(intel_sdvo, SDVO_CMD_SET_COLORIMETRY, &mode, 1); } +static bool intel_sdvo_set_audio_state(struct intel_sdvo *intel_sdvo, + u8 audio_state) +{ + return intel_sdvo_set_value(intel_sdvo, SDVO_CMD_SET_AUDIO_STAT, + &audio_state, 1); +} + #if 0 static void intel_sdvo_dump_hdmi_buf(struct intel_sdvo *intel_sdvo) { @@ -1487,11 +1494,6 @@ static void intel_sdvo_pre_enable(struct intel_encoder *intel_encoder, else sdvox |= SDVO_PIPE_SEL(crtc->pipe); - if (crtc_state->has_audio) { - WARN_ON_ONCE(INTEL_GEN(dev_priv) < 4); - sdvox |= SDVO_AUDIO_ENABLE; - } - if (INTEL_GEN(dev_priv) >= 4) { /* done in crtc_mode_set as the dpll_md reg must be written early */ } else if (IS_I945G(dev_priv) || IS_I945GM(dev_priv) || @@ -1635,8 +1637,13 @@ static void intel_sdvo_get_config(struct intel_encoder *encoder, if (sdvox & HDMI_COLOR_RANGE_16_235) pipe_config->limited_color_range = true; - if (sdvox & SDVO_AUDIO_ENABLE) - pipe_config->has_audio = true; + if (intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_AUDIO_STAT, + &val, 1)) { + u8 mask = SDVO_AUDIO_ELD_VALID | SDVO_AUDIO_PRESENCE_DETECT; + + if ((val & mask) == mask) + pipe_config->has_audio = true; + } if (intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_ENCODE, &val, 1)) { @@ -1647,6 +1654,32 @@ static void intel_sdvo_get_config(struct intel_encoder *encoder, intel_sdvo_get_avi_infoframe(intel_sdvo, pipe_config); } +static void intel_sdvo_disable_audio(struct intel_sdvo *intel_sdvo) +{ + intel_sdvo_set_audio_state(intel_sdvo, 0); +} + +static void intel_sdvo_enable_audio(struct intel_sdvo *intel_sdvo, + const struct intel_crtc_state *crtc_state, + const struct drm_connector_state *conn_state) +{ + const struct drm_display_mode *adjusted_mode = + &crtc_state->base.adjusted_mode; + struct drm_connector *connector = conn_state->connector; + u8 *eld = connector->eld; + + eld[6] = drm_av_sync_delay(connector, adjusted_mode) / 2; + + intel_sdvo_set_audio_state(intel_sdvo, 0); + + intel_sdvo_write_infoframe(intel_sdvo, SDVO_HBUF_INDEX_ELD, + SDVO_HBUF_TX_DISABLED, + eld, drm_eld_size(eld)); + + intel_sdvo_set_audio_state(intel_sdvo, SDVO_AUDIO_ELD_VALID | + SDVO_AUDIO_PRESENCE_DETECT); +} + static void intel_disable_sdvo(struct intel_encoder *encoder, const struct intel_crtc_state *old_crtc_state, const struct drm_connector_state *conn_state) @@ -1656,6 +1689,9 @@ static void intel_disable_sdvo(struct intel_encoder *encoder, struct intel_crtc *crtc = to_intel_crtc(old_crtc_state->base.crtc); u32 temp; + if (old_crtc_state->has_audio) + intel_sdvo_disable_audio(intel_sdvo); + intel_sdvo_set_active_outputs(intel_sdvo, 0); if (0) intel_sdvo_set_encoder_power_state(intel_sdvo, @@ -1741,6 +1777,9 @@ static void intel_enable_sdvo(struct intel_encoder *encoder, intel_sdvo_set_encoder_power_state(intel_sdvo, DRM_MODE_DPMS_ON); intel_sdvo_set_active_outputs(intel_sdvo, intel_sdvo->attached_output); + + if (pipe_config->has_audio) + intel_sdvo_enable_audio(intel_sdvo, pipe_config, conn_state); } static enum drm_mode_status @@ -2603,7 +2642,6 @@ static bool intel_sdvo_dvi_init(struct intel_sdvo *intel_sdvo, int device) { struct drm_encoder *encoder = &intel_sdvo->base.base; - struct drm_i915_private *dev_priv = to_i915(encoder->dev); struct drm_connector *connector; struct intel_encoder *intel_encoder = to_intel_encoder(encoder); struct intel_connector *intel_connector; @@ -2640,9 +2678,7 @@ intel_sdvo_dvi_init(struct intel_sdvo *intel_sdvo, int device) encoder->encoder_type = DRM_MODE_ENCODER_TMDS; connector->connector_type = DRM_MODE_CONNECTOR_DVID; - /* gen3 doesn't do the hdmi bits in the SDVO register */ - if (INTEL_GEN(dev_priv) >= 4 && - intel_sdvo_is_hdmi_connector(intel_sdvo, device)) { + if (intel_sdvo_is_hdmi_connector(intel_sdvo, device)) { connector->connector_type = DRM_MODE_CONNECTOR_HDMIA; intel_sdvo_connector->is_hdmi = true; } diff --git a/drivers/gpu/drm/i915/intel_sdvo_regs.h b/drivers/gpu/drm/i915/intel_sdvo_regs.h index db0ed499268a..e9ba3b047f93 100644 --- a/drivers/gpu/drm/i915/intel_sdvo_regs.h +++ b/drivers/gpu/drm/i915/intel_sdvo_regs.h @@ -707,6 +707,9 @@ struct intel_sdvo_enhancements_arg { #define SDVO_CMD_GET_AUDIO_ENCRYPT_PREFER 0x90 #define SDVO_CMD_SET_AUDIO_STAT 0x91 #define SDVO_CMD_GET_AUDIO_STAT 0x92 + #define SDVO_AUDIO_ELD_VALID (1 << 0) + #define SDVO_AUDIO_PRESENCE_DETECT (1 << 1) + #define SDVO_AUDIO_CP_READY (1 << 2) #define SDVO_CMD_SET_HBUF_INDEX 0x93 #define SDVO_HBUF_INDEX_ELD 0 #define SDVO_HBUF_INDEX_AVI_IF 1 -- 2.21.0

5 years, 5 months

3
2
0 0

[PATCH 1/1] [v4.9.y] coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping

by Ajay Kaher

From: Andrea Arcangeli <aarcange(a)redhat.com> commit 1eb719f09f7e319e79f6abf2b9e8c0dcc1c477b5 upstream. The core dumping code has always run without holding the mmap_sem for writing, despite that is the only way to ensure that the entire vma layout will not change from under it. Only using some signal serialization on the processes belonging to the mm is not nearly enough. This was pointed out earlier. For example in Hugh's post from Jul 2017: https://lkml.kernel.org/r/alpine.LSU.2.11.1707191716030.2055@eggly.anvils "Not strictly relevant here, but a related note: I was very surprised to discover, only quite recently, how handle_mm_fault() may be called without down_read(mmap_sem) - when core dumping. That seems a misguided optimization to me, which would also be nice to correct" In particular because the growsdown and growsup can move the vm_start/vm_end the various loops the core dump does around the vma will not be consistent if page faults can happen concurrently. Pretty much all users calling mmget_not_zero()/get_task_mm() and then taking the mmap_sem had the potential to introduce unexpected side effects in the core dumping code. Adding mmap_sem for writing around the ->core_dump invocation is a viable long term fix, but it requires removing all copy user and page faults and to replace them with get_dump_page() for all binary formats which is not suitable as a short term fix. For the time being this solution manually covers the places that can confuse the core dump either by altering the vma layout or the vma flags while it runs. Once ->core_dump runs under mmap_sem for writing the function mmget_still_valid() can be dropped. Allowing mmap_sem protected sections to run in parallel with the coredump provides some minor parallelism advantage to the swapoff code (which seems to be safe enough by never mangling any vma field and can keep doing swapins in parallel to the core dumping) and to some other corner case. In order to facilitate the backporting I added "Fixes: 86039bd3b4e6" however the side effect of this same race condition in /proc/pid/mem should be reproducible since before 2.6.12-rc2 so I couldn't add any other "Fixes:" because there's no hash beyond the git genesis commit. Because find_extend_vma() is the only location outside of the process context that could modify the "mm" structures under mmap_sem for reading, by adding the mmget_still_valid() check to it, all other cases that take the mmap_sem for reading don't need the new check after mmget_not_zero()/get_task_mm(). The expand_stack() in page fault context also doesn't need the new check, because all tasks under core dumping are frozen. Link: http://lkml.kernel.org/r/20190325224949.11068-1-aarcange@redhat.com Fixes: 86039bd3b4e6 ("userfaultfd: add new syscall to provide memory externalization") Signed-off-by: Andrea Arcangeli <aarcange(a)redhat.com> Reported-by: Jann Horn <jannh(a)google.com> Suggested-by: Oleg Nesterov <oleg(a)redhat.com> Acked-by: Peter Xu <peterx(a)redhat.com> Reviewed-by: Mike Rapoport <rppt(a)linux.ibm.com> Reviewed-by: Oleg Nesterov <oleg(a)redhat.com> Reviewed-by: Jann Horn <jannh(a)google.com> Acked-by: Jason Gunthorpe <jgg(a)mellanox.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [Ajay: Dropped infiniband changes to get patch to apply on 4.9.y] Signed-off-by: Ajay Kaher <akaher(a)vmware.com> Reviewed-by: Srivatsa S. Bhat (VMware) <srivatsa(a)csail.mit.edu> --- fs/proc/task_mmu.c | 18 ++++++++++++++++++ fs/userfaultfd.c | 9 +++++++++ include/linux/sched.h | 21 +++++++++++++++++++++ mm/mmap.c | 7 ++++++- 4 files changed, 54 insertions(+), 1 deletion(-) diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 5138e78..4b207b1 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -1057,6 +1057,24 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf, count = -EINTR; goto out_mm; } + /* + * Avoid to modify vma->vm_flags + * without locked ops while the + * coredump reads the vm_flags. + */ + if (!mmget_still_valid(mm)) { + /* + * Silently return "count" + * like if get_task_mm() + * failed. FIXME: should this + * function have returned + * -ESRCH if get_task_mm() + * failed like if + * get_proc_task() fails? + */ + up_write(&mm->mmap_sem); + goto out_mm; + } for (vma = mm->mmap; vma; vma = vma->vm_next) { vma->vm_flags &= ~VM_SOFTDIRTY; vma_set_page_prot(vma); diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index 784d667..8bf425a 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -479,6 +479,8 @@ static int userfaultfd_release(struct inode *inode, struct file *file) * taking the mmap_sem for writing. */ down_write(&mm->mmap_sem); + if (!mmget_still_valid(mm)) + goto skip_mm; prev = NULL; for (vma = mm->mmap; vma; vma = vma->vm_next) { cond_resched(); @@ -501,6 +503,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file) vma->vm_flags = new_flags; vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX; } +skip_mm: up_write(&mm->mmap_sem); mmput(mm); wakeup: @@ -802,6 +805,9 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, goto out; down_write(&mm->mmap_sem); + if (!mmget_still_valid(mm)) + goto out_unlock; + vma = find_vma_prev(mm, start, &prev); if (!vma) goto out_unlock; @@ -947,6 +953,9 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx, goto out; down_write(&mm->mmap_sem); + if (!mmget_still_valid(mm)) + goto out_unlock; + vma = find_vma_prev(mm, start, &prev); if (!vma) goto out_unlock; diff --git a/include/linux/sched.h b/include/linux/sched.h index 1c487a3..c3d9ca0 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2933,6 +2933,27 @@ static inline void mmdrop_async(struct mm_struct *mm) } } +/* + * This has to be called after a get_task_mm()/mmget_not_zero() + * followed by taking the mmap_sem for writing before modifying the + * vmas or anything the coredump pretends not to change from under it. + * + * NOTE: find_extend_vma() called from GUP context is the only place + * that can modify the "mm" (notably the vm_start/end) under mmap_sem + * for reading and outside the context of the process, so it is also + * the only case that holds the mmap_sem for reading that must call + * this function. Generally if the mmap_sem is hold for reading + * there's no need of this check after get_task_mm()/mmget_not_zero(). + * + * This function can be obsoleted and the check can be removed, after + * the coredump code will hold the mmap_sem for writing before + * invoking the ->core_dump methods. + */ +static inline bool mmget_still_valid(struct mm_struct *mm) +{ + return likely(!mm->core_state); +} + static inline bool mmget_not_zero(struct mm_struct *mm) { return atomic_inc_not_zero(&mm->mm_users); diff --git a/mm/mmap.c b/mm/mmap.c index 3f2314a..acd93d1 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -45,6 +45,7 @@ #include <linux/moduleparam.h> #include <linux/pkeys.h> +#include <linux/sched.h> #include <asm/uaccess.h> #include <asm/cacheflush.h> #include <asm/tlb.h> @@ -2448,7 +2449,8 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr) vma = find_vma_prev(mm, addr, &prev); if (vma && (vma->vm_start <= addr)) return vma; - if (!prev || expand_stack(prev, addr)) + /* don't alter vm_end if the coredump is running */ + if (!prev || !mmget_still_valid(mm) || expand_stack(prev, addr)) return NULL; if (prev->vm_flags & VM_LOCKED) populate_vma_page_range(prev, addr, prev->vm_end, NULL); @@ -2474,6 +2476,9 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr) return vma; if (!(vma->vm_flags & VM_GROWSDOWN)) return NULL; + /* don't alter vm_start if the coredump is running */ + if (!mmget_still_valid(mm)) + return NULL; start = vma->vm_start; if (expand_stack(vma, addr)) return NULL; -- 2.7.4

5 years, 5 months

2
4
0 0

[PATCH] usb: dwc2: host: Fix wMaxPacketSize handling (fix webcam regression)

by Douglas Anderson

In commit abb621844f6a ("usb: ch9: make usb_endpoint_maxp() return only packet size") the API to usb_endpoint_maxp() changed. It used to just return wMaxPacketSize but after that commit it returned wMaxPacketSize with the high bits (the multiplier) masked off. If you wanted to get the multiplier it was now up to your code to call the new usb_endpoint_maxp_mult() which was introduced in commit 541b6fe63023 ("usb: add helper to extract bits 12:11 of wMaxPacketSize"). Prior to the API change most host drivers were updated, but no update was made to dwc2. Presumably it was assumed that dwc2 was too simplistic to use the multiplier and thus just didn't support a certain class of USB devices. However, it turns out that dwc2 did use the multiplier and many devices using it were working quite nicely. That means that many USB devices have been broken since the API change. One such device is a Logitech HD Pro Webcam C920. Specifically, though dwc2 didn't directly call usb_endpoint_maxp(), it did call usb_maxpacket() which in turn called usb_endpoint_maxp(). Let's update dwc2 to work properly with the new API. Fixes: abb621844f6a ("usb: ch9: make usb_endpoint_maxp() return only packet size") Cc: stable(a)vger.kernel.org Signed-off-by: Douglas Anderson <dianders(a)chromium.org> --- drivers/usb/dwc2/hcd.c | 29 +++++++++++++++++------------ drivers/usb/dwc2/hcd.h | 20 +++++++++++--------- drivers/usb/dwc2/hcd_intr.c | 5 +++-- drivers/usb/dwc2/hcd_queue.c | 10 ++++++---- 4 files changed, 37 insertions(+), 27 deletions(-) diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c index b50ec3714fd8..5c51bf5506d1 100644 --- a/drivers/usb/dwc2/hcd.c +++ b/drivers/usb/dwc2/hcd.c @@ -2608,7 +2608,7 @@ static int dwc2_assign_and_init_hc(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh) chan->dev_addr = dwc2_hcd_get_dev_addr(&urb->pipe_info); chan->ep_num = dwc2_hcd_get_ep_num(&urb->pipe_info); chan->speed = qh->dev_speed; - chan->max_packet = dwc2_max_packet(qh->maxp); + chan->max_packet = qh->maxp; chan->xfer_started = 0; chan->halt_status = DWC2_HC_XFER_NO_HALT_STATUS; @@ -2686,7 +2686,7 @@ static int dwc2_assign_and_init_hc(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh) * This value may be modified when the transfer is started * to reflect the actual transfer length */ - chan->multi_count = dwc2_hb_mult(qh->maxp); + chan->multi_count = qh->maxp_mult; if (hsotg->params.dma_desc_enable) { chan->desc_list_addr = qh->desc_list_dma; @@ -3806,19 +3806,21 @@ static struct dwc2_hcd_urb *dwc2_hcd_urb_alloc(struct dwc2_hsotg *hsotg, static void dwc2_hcd_urb_set_pipeinfo(struct dwc2_hsotg *hsotg, struct dwc2_hcd_urb *urb, u8 dev_addr, - u8 ep_num, u8 ep_type, u8 ep_dir, u16 mps) + u8 ep_num, u8 ep_type, u8 ep_dir, + u16 maxp, u16 maxp_mult) { if (dbg_perio() || ep_type == USB_ENDPOINT_XFER_BULK || ep_type == USB_ENDPOINT_XFER_CONTROL) dev_vdbg(hsotg->dev, - "addr=%d, ep_num=%d, ep_dir=%1x, ep_type=%1x, mps=%d\n", - dev_addr, ep_num, ep_dir, ep_type, mps); + "addr=%d, ep_num=%d, ep_dir=%1x, ep_type=%1x, maxp=%d (%d mult)\n", + dev_addr, ep_num, ep_dir, ep_type, maxp, maxp_mult); urb->pipe_info.dev_addr = dev_addr; urb->pipe_info.ep_num = ep_num; urb->pipe_info.pipe_type = ep_type; urb->pipe_info.pipe_dir = ep_dir; - urb->pipe_info.mps = mps; + urb->pipe_info.maxp = maxp; + urb->pipe_info.maxp_mult = maxp_mult; } /* @@ -3909,8 +3911,9 @@ void dwc2_hcd_dump_state(struct dwc2_hsotg *hsotg) dwc2_hcd_is_pipe_in(&urb->pipe_info) ? "IN" : "OUT"); dev_dbg(hsotg->dev, - " Max packet size: %d\n", - dwc2_hcd_get_mps(&urb->pipe_info)); + " Max packet size: %d (%d mult)\n", + dwc2_hcd_get_maxp(&urb->pipe_info), + dwc2_hcd_get_maxp_mult(&urb->pipe_info)); dev_dbg(hsotg->dev, " transfer_buffer: %p\n", urb->buf); @@ -4510,8 +4513,10 @@ static void dwc2_dump_urb_info(struct usb_hcd *hcd, struct urb *urb, } dev_vdbg(hsotg->dev, " Speed: %s\n", speed); - dev_vdbg(hsotg->dev, " Max packet size: %d\n", - usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe))); + dev_vdbg(hsotg->dev, " Max packet size: %d (%d mult)\n", + usb_endpoint_maxp(&urb->ep->desc), + usb_endpoint_maxp_mult(&urb->ep->desc)); + dev_vdbg(hsotg->dev, " Data buffer length: %d\n", urb->transfer_buffer_length); dev_vdbg(hsotg->dev, " Transfer buffer: %p, Transfer DMA: %08lx\n", @@ -4594,8 +4599,8 @@ static int _dwc2_hcd_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, dwc2_hcd_urb_set_pipeinfo(hsotg, dwc2_urb, usb_pipedevice(urb->pipe), usb_pipeendpoint(urb->pipe), ep_type, usb_pipein(urb->pipe), - usb_maxpacket(urb->dev, urb->pipe, - !(usb_pipein(urb->pipe)))); + usb_endpoint_maxp(&ep->desc), + usb_endpoint_maxp_mult(&ep->desc)); buf = urb->transfer_buffer; diff --git a/drivers/usb/dwc2/hcd.h b/drivers/usb/dwc2/hcd.h index c089ffa1f0a8..ce6445a06588 100644 --- a/drivers/usb/dwc2/hcd.h +++ b/drivers/usb/dwc2/hcd.h @@ -171,7 +171,8 @@ struct dwc2_hcd_pipe_info { u8 ep_num; u8 pipe_type; u8 pipe_dir; - u16 mps; + u16 maxp; + u16 maxp_mult; }; struct dwc2_hcd_iso_packet_desc { @@ -264,6 +265,7 @@ struct dwc2_hs_transfer_time { * - USB_ENDPOINT_XFER_ISOC * @ep_is_in: Endpoint direction * @maxp: Value from wMaxPacketSize field of Endpoint Descriptor + * @maxp_mult: Multiplier for maxp * @dev_speed: Device speed. One of the following values: * - USB_SPEED_LOW * - USB_SPEED_FULL @@ -340,6 +342,7 @@ struct dwc2_qh { u8 ep_type; u8 ep_is_in; u16 maxp; + u16 maxp_mult; u8 dev_speed; u8 data_toggle; u8 ping_state; @@ -503,9 +506,14 @@ static inline u8 dwc2_hcd_get_pipe_type(struct dwc2_hcd_pipe_info *pipe) return pipe->pipe_type; } -static inline u16 dwc2_hcd_get_mps(struct dwc2_hcd_pipe_info *pipe) +static inline u16 dwc2_hcd_get_maxp(struct dwc2_hcd_pipe_info *pipe) +{ + return pipe->maxp; +} + +static inline u16 dwc2_hcd_get_maxp_mult(struct dwc2_hcd_pipe_info *pipe) { - return pipe->mps; + return pipe->maxp_mult; } static inline u8 dwc2_hcd_get_dev_addr(struct dwc2_hcd_pipe_info *pipe) @@ -620,12 +628,6 @@ static inline bool dbg_urb(struct urb *urb) static inline bool dbg_perio(void) { return false; } #endif -/* High bandwidth multiplier as encoded in highspeed endpoint descriptors */ -#define dwc2_hb_mult(wmaxpacketsize) (1 + (((wmaxpacketsize) >> 11) & 0x03)) - -/* Packet size for any kind of endpoint descriptor */ -#define dwc2_max_packet(wmaxpacketsize) ((wmaxpacketsize) & 0x07ff) - /* * Returns true if frame1 index is greater than frame2 index. The comparison * is done modulo FRLISTEN_64_SIZE. This accounts for the rollover of the diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c index 88b5dcf3aefc..a052d39b4375 100644 --- a/drivers/usb/dwc2/hcd_intr.c +++ b/drivers/usb/dwc2/hcd_intr.c @@ -1617,8 +1617,9 @@ static void dwc2_hc_ahberr_intr(struct dwc2_hsotg *hsotg, dev_err(hsotg->dev, " Speed: %s\n", speed); - dev_err(hsotg->dev, " Max packet size: %d\n", - dwc2_hcd_get_mps(&urb->pipe_info)); + dev_err(hsotg->dev, " Max packet size: %d (mult %d)\n", + dwc2_hcd_get_maxp(&urb->pipe_info), + dwc2_hcd_get_maxp_mult(&urb->pipe_info)); dev_err(hsotg->dev, " Data buffer length: %d\n", urb->length); dev_err(hsotg->dev, " Transfer buffer: %p, Transfer DMA: %08lx\n", urb->buf, (unsigned long)urb->dma); diff --git a/drivers/usb/dwc2/hcd_queue.c b/drivers/usb/dwc2/hcd_queue.c index ea3aa640c15c..68bbac64b753 100644 --- a/drivers/usb/dwc2/hcd_queue.c +++ b/drivers/usb/dwc2/hcd_queue.c @@ -708,7 +708,7 @@ static void dwc2_hs_pmap_unschedule(struct dwc2_hsotg *hsotg, static int dwc2_uframe_schedule_split(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh) { - int bytecount = dwc2_hb_mult(qh->maxp) * dwc2_max_packet(qh->maxp); + int bytecount = qh->maxp_mult * qh->maxp; int ls_search_slice; int err = 0; int host_interval_in_sched; @@ -1332,7 +1332,7 @@ static int dwc2_check_max_xfer_size(struct dwc2_hsotg *hsotg, u32 max_channel_xfer_size; int status = 0; - max_xfer_size = dwc2_max_packet(qh->maxp) * dwc2_hb_mult(qh->maxp); + max_xfer_size = qh->maxp * qh->maxp_mult; max_channel_xfer_size = hsotg->params.max_transfer_size; if (max_xfer_size > max_channel_xfer_size) { @@ -1517,8 +1517,9 @@ static void dwc2_qh_init(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh, u32 prtspd = (hprt & HPRT0_SPD_MASK) >> HPRT0_SPD_SHIFT; bool do_split = (prtspd == HPRT0_SPD_HIGH_SPEED && dev_speed != USB_SPEED_HIGH); - int maxp = dwc2_hcd_get_mps(&urb->pipe_info); - int bytecount = dwc2_hb_mult(maxp) * dwc2_max_packet(maxp); + int maxp = dwc2_hcd_get_maxp(&urb->pipe_info); + int maxp_mult = dwc2_hcd_get_maxp_mult(&urb->pipe_info); + int bytecount = maxp_mult * maxp; char *speed, *type; /* Initialize QH */ @@ -1531,6 +1532,7 @@ static void dwc2_qh_init(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh, qh->data_toggle = DWC2_HC_PID_DATA0; qh->maxp = maxp; + qh->maxp_mult = maxp_mult; INIT_LIST_HEAD(&qh->qtd_list); INIT_LIST_HEAD(&qh->qh_list_entry); -- 2.22.0.rc1.311.g5d7573a151-goog

5 years, 5 months

3
2
0 0

[PATCH] crypto: chacha20poly1305 - fix atomic sleep when using async algorithm

by Eric Biggers

From: Eric Biggers <ebiggers(a)google.com> Clear the CRYPTO_TFM_REQ_MAY_SLEEP flag when the chacha20poly1305 operation is being continued from an async completion callback, since sleeping may not be allowed in that context. This is basically the same bug that was recently fixed in the xts and lrw templates. But, it's always been broken in chacha20poly1305 too. This was found using syzkaller in combination with the updated crypto self-tests which actually test the MAY_SLEEP flag now. Reproducer: python -c 'import socket; socket.socket(socket.AF_ALG, 5, 0).bind( ("aead", "rfc7539(cryptd(chacha20-generic),poly1305-generic)"))' Kernel output: BUG: sleeping function called from invalid context at include/crypto/algapi.h:426 in_atomic(): 1, irqs_disabled(): 0, pid: 1001, name: kworker/2:2 [...] CPU: 2 PID: 1001 Comm: kworker/2:2 Not tainted 5.2.0-rc2 #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-20181126_142135-anatol 04/01/2014 Workqueue: crypto cryptd_queue_worker Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x4d/0x6a lib/dump_stack.c:113 ___might_sleep kernel/sched/core.c:6138 [inline] ___might_sleep.cold.19+0x8e/0x9f kernel/sched/core.c:6095 crypto_yield include/crypto/algapi.h:426 [inline] crypto_hash_walk_done+0xd6/0x100 crypto/ahash.c:113 shash_ahash_update+0x41/0x60 crypto/shash.c:251 shash_async_update+0xd/0x10 crypto/shash.c:260 crypto_ahash_update include/crypto/hash.h:539 [inline] poly_setkey+0xf6/0x130 crypto/chacha20poly1305.c:337 poly_init+0x51/0x60 crypto/chacha20poly1305.c:364 async_done_continue crypto/chacha20poly1305.c:78 [inline] poly_genkey_done+0x15/0x30 crypto/chacha20poly1305.c:369 cryptd_skcipher_complete+0x29/0x70 crypto/cryptd.c:279 cryptd_skcipher_decrypt+0xcd/0x110 crypto/cryptd.c:339 cryptd_queue_worker+0x70/0xa0 crypto/cryptd.c:184 process_one_work+0x1ed/0x420 kernel/workqueue.c:2269 worker_thread+0x3e/0x3a0 kernel/workqueue.c:2415 kthread+0x11f/0x140 kernel/kthread.c:255 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352 Fixes: 71ebc4d1b27d ("crypto: chacha20poly1305 - Add a ChaCha20-Poly1305 AEAD construction, RFC7539") Cc: <stable(a)vger.kernel.org> # v4.2+ Cc: Martin Willi <martin(a)strongswan.org> Signed-off-by: Eric Biggers <ebiggers(a)google.com> --- crypto/chacha20poly1305.c | 30 +++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/crypto/chacha20poly1305.c b/crypto/chacha20poly1305.c index e38a2d61819a7..acbbf010222e3 100644 --- a/crypto/chacha20poly1305.c +++ b/crypto/chacha20poly1305.c @@ -65,6 +65,8 @@ struct chachapoly_req_ctx { unsigned int cryptlen; /* Actual AD, excluding IV */ unsigned int assoclen; + /* request flags, with MAY_SLEEP cleared if needed */ + u32 flags; union { struct poly_req poly; struct chacha_req chacha; @@ -74,8 +76,12 @@ struct chachapoly_req_ctx { static inline void async_done_continue(struct aead_request *req, int err, int (*cont)(struct aead_request *)) { - if (!err) + if (!err) { + struct chachapoly_req_ctx *rctx = aead_request_ctx(req); + + rctx->flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP; err = cont(req); + } if (err != -EINPROGRESS && err != -EBUSY) aead_request_complete(req, err); @@ -142,7 +148,7 @@ static int chacha_decrypt(struct aead_request *req) dst = scatterwalk_ffwd(rctx->dst, req->dst, req->assoclen); } - skcipher_request_set_callback(&creq->req, aead_request_flags(req), + skcipher_request_set_callback(&creq->req, rctx->flags, chacha_decrypt_done, req); skcipher_request_set_tfm(&creq->req, ctx->chacha); skcipher_request_set_crypt(&creq->req, src, dst, @@ -186,7 +192,7 @@ static int poly_tail(struct aead_request *req) memcpy(&preq->tail.cryptlen, &len, sizeof(len)); sg_set_buf(preq->src, &preq->tail, sizeof(preq->tail)); - ahash_request_set_callback(&preq->req, aead_request_flags(req), + ahash_request_set_callback(&preq->req, rctx->flags, poly_tail_done, req); ahash_request_set_tfm(&preq->req, ctx->poly); ahash_request_set_crypt(&preq->req, preq->src, @@ -217,7 +223,7 @@ static int poly_cipherpad(struct aead_request *req) sg_init_table(preq->src, 1); sg_set_buf(preq->src, &preq->pad, padlen); - ahash_request_set_callback(&preq->req, aead_request_flags(req), + ahash_request_set_callback(&preq->req, rctx->flags, poly_cipherpad_done, req); ahash_request_set_tfm(&preq->req, ctx->poly); ahash_request_set_crypt(&preq->req, preq->src, NULL, padlen); @@ -248,7 +254,7 @@ static int poly_cipher(struct aead_request *req) sg_init_table(rctx->src, 2); crypt = scatterwalk_ffwd(rctx->src, crypt, req->assoclen); - ahash_request_set_callback(&preq->req, aead_request_flags(req), + ahash_request_set_callback(&preq->req, rctx->flags, poly_cipher_done, req); ahash_request_set_tfm(&preq->req, ctx->poly); ahash_request_set_crypt(&preq->req, crypt, NULL, rctx->cryptlen); @@ -278,7 +284,7 @@ static int poly_adpad(struct aead_request *req) sg_init_table(preq->src, 1); sg_set_buf(preq->src, preq->pad, padlen); - ahash_request_set_callback(&preq->req, aead_request_flags(req), + ahash_request_set_callback(&preq->req, rctx->flags, poly_adpad_done, req); ahash_request_set_tfm(&preq->req, ctx->poly); ahash_request_set_crypt(&preq->req, preq->src, NULL, padlen); @@ -302,7 +308,7 @@ static int poly_ad(struct aead_request *req) struct poly_req *preq = &rctx->u.poly; int err; - ahash_request_set_callback(&preq->req, aead_request_flags(req), + ahash_request_set_callback(&preq->req, rctx->flags, poly_ad_done, req); ahash_request_set_tfm(&preq->req, ctx->poly); ahash_request_set_crypt(&preq->req, req->src, NULL, rctx->assoclen); @@ -329,7 +335,7 @@ static int poly_setkey(struct aead_request *req) sg_init_table(preq->src, 1); sg_set_buf(preq->src, rctx->key, sizeof(rctx->key)); - ahash_request_set_callback(&preq->req, aead_request_flags(req), + ahash_request_set_callback(&preq->req, rctx->flags, poly_setkey_done, req); ahash_request_set_tfm(&preq->req, ctx->poly); ahash_request_set_crypt(&preq->req, preq->src, NULL, sizeof(rctx->key)); @@ -353,7 +359,7 @@ static int poly_init(struct aead_request *req) struct poly_req *preq = &rctx->u.poly; int err; - ahash_request_set_callback(&preq->req, aead_request_flags(req), + ahash_request_set_callback(&preq->req, rctx->flags, poly_init_done, req); ahash_request_set_tfm(&preq->req, ctx->poly); @@ -391,7 +397,7 @@ static int poly_genkey(struct aead_request *req) chacha_iv(creq->iv, req, 0); - skcipher_request_set_callback(&creq->req, aead_request_flags(req), + skcipher_request_set_callback(&creq->req, rctx->flags, poly_genkey_done, req); skcipher_request_set_tfm(&creq->req, ctx->chacha); skcipher_request_set_crypt(&creq->req, creq->src, creq->src, @@ -431,7 +437,7 @@ static int chacha_encrypt(struct aead_request *req) dst = scatterwalk_ffwd(rctx->dst, req->dst, req->assoclen); } - skcipher_request_set_callback(&creq->req, aead_request_flags(req), + skcipher_request_set_callback(&creq->req, rctx->flags, chacha_encrypt_done, req); skcipher_request_set_tfm(&creq->req, ctx->chacha); skcipher_request_set_crypt(&creq->req, src, dst, @@ -449,6 +455,7 @@ static int chachapoly_encrypt(struct aead_request *req) struct chachapoly_req_ctx *rctx = aead_request_ctx(req); rctx->cryptlen = req->cryptlen; + rctx->flags = aead_request_flags(req); /* encrypt call chain: * - chacha_encrypt/done() @@ -470,6 +477,7 @@ static int chachapoly_decrypt(struct aead_request *req) struct chachapoly_req_ctx *rctx = aead_request_ctx(req); rctx->cryptlen = req->cryptlen - POLY1305_DIGEST_SIZE; + rctx->flags = aead_request_flags(req); /* decrypt call chain: * - poly_genkey/done() -- 2.21.0

5 years, 5 months

2
1
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror May 2019