December 2020 - Linux-stable-mirror

Re: [PATCH v1] HID: make arrays usage and value to be the same

by Will McVicker

On Sat, Dec 05, 2020 at 12:48:48AM +0000, Will McVicker wrote: > The HID subsystem allows an "HID report field" to have a different > number of "values" and "usages" when it is allocated. When a field > struct is created, the size of the usage array is guaranteed to be at > least as large as the values array, but it may be larger. This leads to > a potential out-of-bounds write in > __hidinput_change_resolution_multipliers() and an out-of-bounds read in > hidinput_count_leds(). > > To fix this, let's make sure that both the usage and value arrays are > the same size. > > Signed-off-by: Will McVicker <willmcvicker(a)google.com> > --- > drivers/hid/hid-core.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c > index 56172fe6995c..8a8b2b982f83 100644 > --- a/drivers/hid/hid-core.c > +++ b/drivers/hid/hid-core.c > @@ -90,7 +90,7 @@ EXPORT_SYMBOL_GPL(hid_register_report); > * Register a new field for this report. > */ > > -static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages, unsigned values) > +static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages) > { > struct hid_field *field; > > @@ -101,7 +101,7 @@ static struct hid_field *hid_register_field(struct hid_report *report, unsigned > > field = kzalloc((sizeof(struct hid_field) + > usages * sizeof(struct hid_usage) + > - values * sizeof(unsigned)), GFP_KERNEL); > + usages * sizeof(unsigned)), GFP_KERNEL); > if (!field) > return NULL; > > @@ -300,7 +300,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign > usages = max_t(unsigned, parser->local.usage_index, > parser->global.report_count); > > - field = hid_register_field(report, usages, parser->global.report_count); > + field = hid_register_field(report, usages); > if (!field) > return 0; > > -- > 2.29.2.576.ga3fc446d84-goog > Hi Jiri and Benjamin, This is a friendly reminder in case this got lost in your inbox. Thanks, Will

3 years, 3 months

2
3
0 0

[PATCH] mfd: gateworks-gsc: fix interrupt type

by Tim Harvey

The Gateworks System Controller has an active-low interrupt. Fix the interrupt request type. Fixes: d85234994b2f ("mfd: Add Gateworks System Controller core driver") Cc: <stable(a)vger.kernel.org> Signed-off-by: Tim Harvey <tharvey(a)gateworks.com> --- drivers/mfd/gateworks-gsc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mfd/gateworks-gsc.c b/drivers/mfd/gateworks-gsc.c index 576da62..d878767 100644 --- a/drivers/mfd/gateworks-gsc.c +++ b/drivers/mfd/gateworks-gsc.c @@ -234,7 +234,7 @@ static int gsc_probe(struct i2c_client *client) ret = devm_regmap_add_irq_chip(dev, gsc->regmap, client->irq, IRQF_ONESHOT | IRQF_SHARED | - IRQF_TRIGGER_FALLING, 0, + IRQF_TRIGGER_LOW, 0, &gsc_irq_chip, &irq_data); if (ret) return ret; -- 2.7.4

3 years, 3 months

2
1
0 0

FAILED: patch "[PATCH] drm/i915: Fix mismatch between misplaced vma check and vma" failed to apply to 4.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 0e53656ad8abc99e0a80c3de611e593ebbf55829 Mon Sep 17 00:00:00 2001 From: Chris Wilson <chris(a)chris-wilson.co.uk> Date: Wed, 16 Dec 2020 09:29:51 +0000 Subject: [PATCH] drm/i915: Fix mismatch between misplaced vma check and vma insert When inserting a VMA, we restrict the placement to the low 4G unless the caller opts into using the full range. This was done to allow usersapce the opportunity to transition slowly from a 32b address space, and to avoid breaking inherent 32b assumptions of some commands. However, for insert we limited ourselves to 4G-4K, but on verification we allowed the full 4G. This causes some attempts to bind a new buffer to sporadically fail with -ENOSPC, but at other times be bound successfully. commit 48ea1e32c39d ("drm/i915/gen9: Set PIN_ZONE_4G end to 4GB - 1 page") suggests that there is a genuine problem with stateless addressing that cannot utilize the last page in 4G and so we purposefully excluded it. This means that the quick pin pass may cause us to utilize a buggy placement. Reported-by: CQ Tang <cq.tang(a)intel.com> Testcase: igt/gem_exec_params/larger-than-life-batch Fixes: 48ea1e32c39d ("drm/i915/gen9: Set PIN_ZONE_4G end to 4GB - 1 page") Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk> Cc: CQ Tang <cq.tang(a)intel.com> Reviewed-by: CQ Tang <cq.tang(a)intel.com> Reviewed-by: Matthew Auld <matthew.auld(a)intel.com> Cc: <stable(a)vger.kernel.org> # v4.5+ Link: https://patchwork.freedesktop.org/patch/msgid/20201216092951.7124-1-chris@c… (cherry picked from commit 5f22cc0b134ab702d7f64b714e26018f7288ffee) Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c index b07dc1156a0e..bcc80f428172 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c @@ -382,7 +382,7 @@ eb_vma_misplaced(const struct drm_i915_gem_exec_object2 *entry, return true; if (!(flags & EXEC_OBJECT_SUPPORTS_48B_ADDRESS) && - (vma->node.start + vma->node.size - 1) >> 32) + (vma->node.start + vma->node.size + 4095) >> 32) return true; if (flags & __EXEC_OBJECT_NEEDS_MAP &&

3 years, 3 months

2
1
0 0

[stable] ext4 fscrypt_get_encryption_info() circular locking dependency

by Sergey Senozhatsky

Hi, I got the following lockdep splat the other day, while running some tests on 4.19. I didn't test other stable kernels, but it seems that 5.4 should also have similar problem. As far as I can tell, ext4_dir_open() has been removed quite recently: https://www.mail-archive.com/linux-f2fs-devel@lists.sourceforge.net/msg1872… Eric, Ted, Jaegeuk, how difficult would it be to remove ext4_dir_open() from the stable kernels? (I'm interested in ext4 in particular, I understand that other filesystems may also need similar patches) [ 133.454721] kswapd0/79 is trying to acquire lock: [ 133.454724] 00000000a815a55f (jbd2_handle){++++}, at: start_this_handle+0x1f9/0x859 [ 133.454730] but task is already holding lock: [ 133.454731] 00000000106bd5a3 (fs_reclaim){+.+.}, at: __fs_reclaim_acquire+0x5/0x2f [ 133.454736] which lock already depends on the new lock. [ 133.454739] the existing dependency chain (in reverse order) is: [ 133.454740] -> #2 (fs_reclaim){+.+.}: [ 133.454745] kmem_cache_alloc_trace+0x44/0x28b [ 133.454748] mempool_create_node+0x46/0x92 [ 133.454750] fscrypt_initialize+0xa0/0xbf [ 133.454752] fscrypt_get_encryption_info+0xa4/0x774 [ 133.454754] ext4_dir_open+0x1b/0x2d [ 133.454757] do_dentry_open+0x144/0x36d [ 133.454759] path_openat+0x2d7/0x156d [ 133.454762] do_filp_open+0x97/0x13e [ 133.454764] do_sys_open+0x128/0x3a3 [ 133.454766] do_syscall_64+0x6f/0x22a [ 133.454769] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 133.454771] -> #1 (fscrypt_init_mutex){+.+.}: [ 133.454774] mutex_lock_nested+0x20/0x26 [ 133.454776] fscrypt_initialize+0x20/0xbf [ 133.454778] fscrypt_get_encryption_info+0xa4/0x774 [ 133.454780] fscrypt_inherit_context+0xbe/0xe6 [ 133.454782] __ext4_new_inode+0x11ee/0x1631 [ 133.454785] ext4_mkdir+0x112/0x416 [ 133.454787] vfs_mkdir2+0x135/0x1c6 [ 133.454789] do_mkdirat+0xc3/0x138 [ 133.454791] do_syscall_64+0x6f/0x22a [ 133.454793] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 133.454795] -> #0 (jbd2_handle){++++}: [ 133.454798] start_this_handle+0x21c/0x859 [ 133.454800] jbd2__journal_start+0xa2/0x282 [ 133.454802] ext4_release_dquot+0x58/0x93 [ 133.454804] dqput+0x196/0x1ec [ 133.454806] __dquot_drop+0x8d/0xb2 [ 133.454809] ext4_clear_inode+0x22/0x8c [ 133.454811] ext4_evict_inode+0x127/0x662 [ 133.454813] evict+0xc0/0x241 [ 133.454816] dispose_list+0x36/0x54 [ 133.454818] prune_icache_sb+0x56/0x76 [ 133.454820] super_cache_scan+0x13a/0x19c [ 133.454822] shrink_slab+0x39a/0x572 [ 133.454824] shrink_node+0x3f8/0x63b [ 133.454826] balance_pgdat+0x1bd/0x326 [ 133.454828] kswapd+0x2ad/0x510 [ 133.454831] kthread+0x14d/0x155 [ 133.454833] ret_from_fork+0x24/0x50 [ 133.454834] other info that might help us debug this: [ 133.454836] Chain exists of: jbd2_handle --> fscrypt_init_mutex --> fs_reclaim [ 133.454840] Possible unsafe locking scenario: [ 133.454841] CPU0 CPU1 [ 133.454843] ---- ---- [ 133.454844] lock(fs_reclaim); [ 133.454846] lock(fscrypt_init_mutex); [ 133.454848] lock(fs_reclaim); [ 133.454850] lock(jbd2_handle); [ 133.454851] *** DEADLOCK *** [ 133.454854] 3 locks held by kswapd0/79: [ 133.454855] #0: 00000000106bd5a3 (fs_reclaim){+.+.}, at: __fs_reclaim_acquire+0x5/0x2f [ 133.454859] #1: 00000000c230047b (shrinker_rwsem){++++}, at: shrink_slab+0x3b/0x572 [ 133.454862] #2: 00000000ce797452 (&type->s_umount_key#45){++++}, at: trylock_super+0x1b/0x47 [ 133.454866] stack backtrace: [ 133.454869] CPU: 6 PID: 79 Comm: kswapd0 Not tainted 4.19.161 #43 [ 133.454872] Call Trace: [ 133.454877] dump_stack+0xbd/0x11d [ 133.454880] ? print_circular_bug+0x2c1/0x2d4 [ 133.454883] __lock_acquire+0x1977/0x1981 [ 133.454886] ? start_this_handle+0x1f9/0x859 [ 133.454888] lock_acquire+0x1b7/0x202 [ 133.454890] ? start_this_handle+0x1f9/0x859 [ 133.454893] start_this_handle+0x21c/0x859 [ 133.454895] ? start_this_handle+0x1f9/0x859 [ 133.454897] ? kmem_cache_alloc+0x1d1/0x27d [ 133.454900] jbd2__journal_start+0xa2/0x282 [ 133.454902] ? __ext4_journal_start_sb+0x10b/0x208 [ 133.454905] ext4_release_dquot+0x58/0x93 [ 133.454907] dqput+0x196/0x1ec [ 133.454909] __dquot_drop+0x8d/0xb2 [ 133.454912] ? dquot_drop+0x27/0x43 [ 133.454914] ext4_clear_inode+0x22/0x8c [ 133.454917] ext4_evict_inode+0x127/0x662 [ 133.454920] evict+0xc0/0x241 [ 133.454923] dispose_list+0x36/0x54 [ 133.454926] prune_icache_sb+0x56/0x76 [ 133.454928] super_cache_scan+0x13a/0x19c [ 133.454931] shrink_slab+0x39a/0x572 [ 133.454934] shrink_node+0x3f8/0x63b [ 133.454938] balance_pgdat+0x1bd/0x326 [ 133.454941] kswapd+0x2ad/0x510 [ 133.454946] ? init_wait_entry+0x2e/0x2e [ 133.454949] kthread+0x14d/0x155 [ 133.454951] ? wakeup_kswapd+0x20d/0x20d [ 133.454953] ? kthread_destroy_worker+0x62/0x62 [ 133.454956] ret_from_fork+0x24/0x50 -ss

3 years, 3 months

2
5
0 0

[PATCH] riscv: Trace irq on only interrupt is enabled

by Atish Patra

We should call irq trace only if interrupt is going to be enabled during excecption handling. Otherwise, it results in following warning during boot with lock debugging enabled. [ 0.000000] ------------[ cut here ]------------ [ 0.000000] DEBUG_LOCKS_WARN_ON(early_boot_irqs_disabled) [ 0.000000] WARNING: CPU: 0 PID: 0 at kernel/locking/lockdep.c:4085 lockdep_hardirqs_on_prepare+0x22a/0x22e [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.10.0-00022-ge20097fb37e2-dirty #548 [ 0.000000] epc: c005d5d4 ra : c005d5d4 sp : c1c01e80 [ 0.000000] gp : c1d456e0 tp : c1c0a980 t0 : 00000000 [ 0.000000] t1 : ffffffff t2 : 00000000 s0 : c1c01ea0 [ 0.000000] s1 : c100f360 a0 : 0000002d a1 : c00666ee [ 0.000000] a2 : 00000000 a3 : 00000000 a4 : 00000000 [ 0.000000] a5 : 00000000 a6 : c1c6b390 a7 : 3ffff00e [ 0.000000] s2 : c2384fe8 s3 : 00000000 s4 : 00000001 [ 0.000000] s5 : c1c0a980 s6 : c1d48000 s7 : c1613b4c [ 0.000000] s8 : 00000fff s9 : 80000200 s10: c1613b40 [ 0.000000] s11: 00000000 t3 : 00000000 t4 : 00000000 [ 0.000000] t5 : 00000001 t6 : 00000000 Fixes: 3c4697982982 ("riscv:Enable LOCKDEP_SUPPORT & fixup TRACE_IRQFLAGS_SUPPORT") Cc: stable(a)vger.kernel.org Signed-off-by: Atish Patra <atish.patra(a)wdc.com> --- arch/riscv/kernel/entry.S | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S index 524d918f3601..7dea5ee5a3ac 100644 --- a/arch/riscv/kernel/entry.S +++ b/arch/riscv/kernel/entry.S @@ -124,15 +124,15 @@ skip_context_tracking: REG_L a1, (a1) jr a1 1: -#ifdef CONFIG_TRACE_IRQFLAGS - call trace_hardirqs_on -#endif /* * Exceptions run with interrupts enabled or disabled depending on the * state of SR_PIE in m/sstatus. */ andi t0, s1, SR_PIE beqz t0, 1f +#ifdef CONFIG_TRACE_IRQFLAGS + call trace_hardirqs_on +#endif csrs CSR_STATUS, SR_IE 1: -- 2.25.1

3 years, 3 months

2
1
0 0

[PATCH 4.14 000/242] 4.14.213-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.213 release. There are 242 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.213-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.213-rc1 Jubin Zhong <zhongjubin(a)huawei.com> PCI: Fix pci_slot_release() NULL pointer dereference Dan Williams <dan.j.williams(a)intel.com> libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels SeongJae Park <sjpark(a)amazon.de> xenbus/xenbus_backend: Disallow pending watch messages SeongJae Park <sjpark(a)amazon.de> xen/xenbus: Count pending messages for each watch SeongJae Park <sjpark(a)amazon.de> xen/xenbus/xen_bus_type: Support will_handle watch callback SeongJae Park <sjpark(a)amazon.de> xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path() SeongJae Park <sjpark(a)amazon.de> xen/xenbus: Allow watches discard events before queueing Pawel Wieczorkiewicz <wipawel(a)amazon.de> xen-blkback: set ring->xenblkd to NULL after kthread_stop() Terry Zhou <bjzhou(a)marvell.com> clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9 Zhao Heming <heming.zhao(a)suse.com> md/cluster: fix deadlock when node is doing resync job Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio:imu:bmi160: Fix too large a buffer. Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio:pressure:mpl3115: Force alignment of buffer Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio:light:rpr0521: Fix timestamp alignment and prevent data leak. Qinglang Miao <miaoqinglang(a)huawei.com> iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume Nuno Sá <nuno.sa(a)analog.com> iio: buffer: Fix demux update Sven Eckelmann <sven(a)narfation.org> mtd: parser: cmdline: Fix parsing of part-names with colons Evan Green <evgreen(a)chromium.org> soc: qcom: smp2p: Safely acquire spinlock without IRQs Lukas Wunner <lukas(a)wunner.de> spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path Lukas Wunner <lukas(a)wunner.de> spi: sc18is602: Don't leak SPI master in probe error path Lukas Wunner <lukas(a)wunner.de> spi: rb4xx: Don't leak SPI master in probe error path Lukas Wunner <lukas(a)wunner.de> spi: pic32: Don't leak DMA channels in probe error path Lukas Wunner <lukas(a)wunner.de> spi: davinci: Fix use-after-free on unbind Lukas Wunner <lukas(a)wunner.de> spi: spi-sh: Fix use-after-free on unbind Zwane Mwaikambo <zwane(a)yosper.io> drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor() Dave Kleikamp <dave.kleikamp(a)oracle.com> jfs: Fix array index bounds check in dbAdjTree Zhe Li <lizhe67(a)huawei.com> jffs2: Fix GC exit abnormally Luis Henriques <lhenriques(a)suse.de> ceph: fix race in concurrent __ceph_remove_cap invocations Roberto Sassu <roberto.sassu(a)huawei.com> ima: Don't modify file descriptor mode on the fly David Hildenbrand <david(a)redhat.com> powerpc/powernv/memtrace: Don't leak kernel memory to user space Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/xmon: Change printk() to pr_cont() Tyrel Datwyler <tyreld(a)linux.ibm.com> powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter Nicolas Ferre <nicolas.ferre(a)microchip.com> ARM: dts: at91: sama5d2: fix CAN message ram offset and size Marc Zyngier <maz(a)kernel.org> KVM: arm64: Introduce handling of AArch32 TTBCR2 traps Jan Kara <jack(a)suse.cz> ext4: fix deadlock with fs freezing and EA inodes Chunguang Xu <brookxu(a)tencent.com> ext4: fix a memory leak of ext4_free_data Pavel Machek <pavel(a)denx.de> btrfs: fix return value mixup in btrfs_get_extent Filipe Manana <fdmanana(a)suse.com> Btrfs: fix selftests failure due to uninitialized i_mode in test inodes Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix write unthrottling Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix tx-unthrottle use-after-free Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix write-wakeup use-after-free Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix stalled writes Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix write deadlock Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix dropped unthrottle interrupts Johan Hovold <johan(a)kernel.org> USB: serial: mos7720: fix parallel-port state restore Borislav Petkov <bp(a)suse.de> EDAC/amd64: Fix PCI component registration Ard Biesheuvel <ardb(a)kernel.org> crypto: ecdh - avoid unaligned accesses in ecdh_set_secret() Athira Rajeev <atrajeev(a)linux.vnet.ibm.com> powerpc/perf: Exclude kernel samples while counting events in user space. Ian Abbott <abbotti(a)mev.co.uk> staging: comedi: mf6x4: Fix AI end-of-conversion detection Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: fix list corruption of lcu list Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: fix list corruption of pavgroup group list Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: prevent inconsistent LCU device data Sven Schnelle <svens(a)linux.ibm.com> s390/smp: perform initial CPU reset also for SMT siblings Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Disable sample read check if firmware doesn't give back Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix a few more UBSAN fixes Chris Chiu <chiu(a)endlessos.org> ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 Hui Wang <hui.wang(a)canonical.com> ACPI: PNP: compare the string length in the matching_id() Daniel Scally <djrscally(a)gmail.com> Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks" Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup() Arnd Bergmann <arnd(a)arndb.de> Input: cyapa_gen6 - fix out-of-bounds stack access Lukas Wunner <lukas(a)wunner.de> media: netup_unidvb: Don't leak SPI master in probe error path Sean Young <sean(a)mess.org> media: sunxi-cir: ensure IR is handled when it is continuous Alan Stern <stern(a)rowland.harvard.edu> media: gspca: Fix memory leak in probe Simon Beginn <linux(a)simonmicro.de> Input: goodix - add upside-down quirk for Teclast X98 Pro tablet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: cros_ec_keyb - send 'scancodes' in addition to key events Serge Hallyn <shallyn(a)cisco.com> fix namespaced fscaps when !CONFIG_SECURITY Sara Sharon <sara.sharon(a)intel.com> cfg80211: initialize rekey_data Jernej Skrabec <jernej.skrabec(a)siol.net> clk: sunxi-ng: Make sure divider tables have sentinel Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> clk: s2mps11: Fix a resource leak in error handling paths in the probe function Dan Carpenter <dan.carpenter(a)oracle.com> qlcnic: Fix error code in probe Zheng Zengkai <zhengzengkai(a)huawei.com> perf record: Fix memory leak when using '--user-regs=?' to list registers Lokesh Vutla <lokeshvutla(a)ti.com> pwm: lp3943: Dynamically allocate PWM chip base Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> pwm: zx: Add missing cleanup in error path Zhang Qilong <zhangqilong3(a)huawei.com> clk: ti: Fix memleak in ti_fapll_synth_setup Arnd Bergmann <arnd(a)arndb.de> watchdog: coh901327: add COMMON_CLK dependency Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> watchdog: qcom: Avoid context switch in restart handler Vincent Stehlé <vincent.stehle(a)laposte.net> net: korina: fix return value Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> net: bcmgenet: Fix a resource leak in an error handling path in the probe functin Dwaipayan Ray <dwaipayanray1(a)gmail.com> checkpatch: fix unescaped left brace Vincent Stehlé <vincent.stehle(a)laposte.net> powerpc/ps3: use dma_mapping_error() Bongsu Jeon <bongsu.jeon(a)samsung.com> nfc: s3fwrn5: Release the nfc firmware Anton Ivanov <anton.ivanov(a)cambridgegreys.com> um: chan_xterm: Fix fd leak Guenter Roeck <linux(a)roeck-us.net> watchdog: sirfsoc: Add missing dependency on HAS_IOMEM Marc Zyngier <maz(a)kernel.org> irqchip/alpine-msi: Fix freeing of interrupts on allocation error path Dan Carpenter <dan.carpenter(a)oracle.com> ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control() Marek Szyprowski <m.szyprowski(a)samsung.com> extcon: max77693: Fix modalias string Dmitry Osipenko <digetx(a)gmail.com> clk: tegra: Fix duplicated SE clock entry Masami Hiramatsu <mhiramat(a)kernel.org> x86/kprobes: Restore BTF if the single-stepping is cancelled Cheng Lin <cheng.lin130(a)zte.com.cn> nfs_common: need lock during iterate through the list kazuo ito <kzpn200(a)gmail.com> nfsd: Fix message level for normal termination Yang Yingliang <yangyingliang(a)huawei.com> speakup: fix uninitialized flush_lock Zhang Qilong <zhangqilong3(a)huawei.com> usb: oxu210hp-hcd: Fix memory leak in oxu_create Zhang Qilong <zhangqilong3(a)huawei.com> usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe Nathan Lynch <nathanl(a)linux.ibm.com> powerpc/pseries/hibernation: remove redundant cacheinfo update Nathan Lynch <nathanl(a)linux.ibm.com> powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops Zhang Changzhong <zhangchangzhong(a)huawei.com> scsi: fnic: Fix error return code in fnic_probe() Arnd Bergmann <arnd(a)arndb.de> seq_buf: Avoid type mismatch for seq_buf_init Zhang Qilong <zhangqilong3(a)huawei.com> scsi: pm80xx: Fix error return in pm8001_pci_probe() Qinglang Miao <miaoqinglang(a)huawei.com> scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe Pali Rohár <pali(a)kernel.org> cpufreq: scpi: Add missing MODULE_ALIAS Pali Rohár <pali(a)kernel.org> cpufreq: loongson1: Add missing MODULE_ALIAS Pali Rohár <pali(a)kernel.org> cpufreq: st: Add missing MODULE_DEVICE_TABLE Pali Rohár <pali(a)kernel.org> cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE Pali Rohár <pali(a)kernel.org> cpufreq: highbank: Add missing MODULE_DEVICE_TABLE Keqian Zhu <zhukeqian1(a)huawei.com> clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI Qinglang Miao <miaoqinglang(a)huawei.com> dm ioctl: fix error return code in target_message Chuhong Yuan <hslester96(a)gmail.com> ASoC: jz4740-i2s: add missed checks for clk_get() Leon Romanovsky <leonro(a)nvidia.com> net/mlx5: Properly convey driver version to firmware Jing Xiangfeng <jingxiangfeng(a)huawei.com> memstick: r592: Fix error return in r592_probe() Chen-Yu Tsai <wens(a)csie.org> arm64: dts: rockchip: Fix UART pull-ups on rk3328 Yu Kuai <yukuai3(a)huawei.com> pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe() Claudiu Beznea <claudiu.beznea(a)microchip.com> ARM: dts: at91: sama5d2: map securam as device Yu Kuai <yukuai3(a)huawei.com> clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent() Dan Carpenter <dan.carpenter(a)oracle.com> media: saa7146: fix array overflow in vidioc_s_audio() Jason Gunthorpe <jgg(a)nvidia.com> vfio-pci: Use io_remap_pfn_range() for PCI IO memory NeilBrown <neilb(a)suse.de> NFS: switch nfsiod to be an UNBOUND workqueue. Calum Mackay <calum.mackay(a)oracle.com> lockd: don't use interval-based rebinding over TCP Trond Myklebust <trond.myklebust(a)hammerspace.com> SUNRPC: xprt_load_transport() needs to support the netid "rdma6" Olga Kornievskaia <kolga(a)netapp.com> NFSv4.2: condition READDIR's mask for security label based on LSM state Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> ath10k: Release some resources in an error handling path Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> ath10k: Fix an error handling path Alexandre Belloni <alexandre.belloni(a)bootlin.com> ARM: dts: at91: at91sam9rl: fix ADC triggers Bharat Gooty <bharat.gooty(a)broadcom.com> PCI: iproc: Fix out-of-bound array accesses Marc Zyngier <maz(a)kernel.org> genirq/irqdomain: Don't try to free an interrupt that has no mapping Zhang Qilong <zhangqilong3(a)huawei.com> power: supply: bq24190_charger: fix reference leak Chris Packham <chris.packham(a)alliedtelesis.co.nz> ARM: dts: Remove non-existent i2c1 from 98dx3236 Jing Xiangfeng <jingxiangfeng(a)huawei.com> HSI: omap_ssi: Don't jump to free ID in ssi_add_controller() Dan Carpenter <dan.carpenter(a)oracle.com> media: max2175: fix max2175_set_csm_mode() error code Qinglang Miao <miaoqinglang(a)huawei.com> mips: cdmm: fix use-after-free in mips_cdmm_bus_discover Daniel T. Lee <danieltimlee(a)gmail.com> samples: bpf: Fix lwt_len_hist reusing previous BPF map Keita Suzuki <keitasuzuki.park(a)sslab.ics.keio.ac.jp> media: siano: fix memory leak of debugfs members in smsdvb_hotplug Qinglang Miao <miaoqinglang(a)huawei.com> cw1200: fix missing destroy_workqueue() on error in cw1200_init_common Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> orinoco: Move context allocation after processing the skb Cristian Birsan <cristian.birsan(a)microchip.com> ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host Cristian Birsan <cristian.birsan(a)microchip.com> ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host Qinglang Miao <miaoqinglang(a)huawei.com> memstick: fix a double-free bug in memstick_check Kamal Heib <kamalheib1(a)gmail.com> RDMA/cxgb4: Validate the number of CQEs Zhang Qilong <zhangqilong3(a)huawei.com> Input: omap4-keypad - fix runtime PM error handling Zhihao Cheng <chengzhihao1(a)huawei.com> drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe Zhang Qilong <zhangqilong3(a)huawei.com> soc: ti: Fix reference imbalance in knav_dma_probe Zhang Qilong <zhangqilong3(a)huawei.com> soc: ti: knav_qmss: fix reference leak in knav_queue_probe Zhang Qilong <zhangqilong3(a)huawei.com> crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ads7846 - fix unaligned access on 7845 Oleksij Rempel <o.rempel(a)pengutronix.de> Input: ads7846 - fix integer overflow on Rt calculation David Jander <david(a)protonic.nl> Input: ads7846 - fix race that causes missing releases Yang Yingliang <yangyingliang(a)huawei.com> drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() Qinglang Miao <miaoqinglang(a)huawei.com> media: solo6x10: fix missing snd_card_free in error handling case Martin Wilck <mwilck(a)suse.com> scsi: core: Fix VPD LUN ID designator priorities Yu Kuai <yukuai3(a)huawei.com> media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm() Zhang Qilong <zhangqilong3(a)huawei.com> staging: greybus: codecs: Fix reference counter leak in error handling Necip Fazil Yildiran <fazilyildiran(a)gmail.com> MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA Arnd Bergmann <arnd(a)arndb.de> RDMa/mthca: Work around -Wenum-conversion warning Zhang Qilong <zhangqilong3(a)huawei.com> ASoC: arizona: Fix a wrong free in wm8997_probe Vincent Bernat <vincent(a)bernat.ch> net: evaluate net.ipv4.conf.all.proxy_arp_pvlan Vincent Bernat <vincent(a)bernat.ch> net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown Zhang Qilong <zhangqilong3(a)huawei.com> ASoC: wm8998: Fix PM disable depth imbalance on error Tsuchiya Yuto <kitakar(a)gmail.com> mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure Zhang Qilong <zhangqilong3(a)huawei.com> spi: tegra114: fix reference leak in tegra spi ops Zhang Qilong <zhangqilong3(a)huawei.com> spi: tegra20-sflash: fix reference leak in tegra_sflash_resume Zhang Qilong <zhangqilong3(a)huawei.com> spi: tegra20-slink: fix reference leak in slink ops of tegra20 Zhang Qilong <zhangqilong3(a)huawei.com> spi: spi-ti-qspi: fix reference leak in ti_qspi_setup Anmol Karn <anmol.karan123(a)gmail.com> Bluetooth: Fix null pointer dereference in hci_event_packet() Paweł Chmiel <pawel.mikolaj.chmiel(a)gmail.com> arm64: dts: exynos: Correct psci compatible used on Exynos7 Paul Moore <paul(a)paul-moore.com> selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling Cezary Rojewski <cezary.rojewski(a)intel.com> ASoC: pcm: DRAIN support reactivation Zhang Qilong <zhangqilong3(a)huawei.com> spi: img-spfi: fix reference leak in img_spfi_resume Christophe Leroy <christophe.leroy(a)csgroup.eu> crypto: talitos - Fix return type of current_desc_hdr() Thomas Gleixner <tglx(a)linutronix.de> sched: Reenable interrupts in do_sched_yield() Peng Liu <iwtbavbm(a)gmail.com> sched/deadline: Fix sched_dl_global_validate() Ard Biesheuvel <ardb(a)kernel.org> ARM: p2v: fix handling of LPAE translation in BE mode Arvind Sankar <nivedita(a)alum.mit.edu> x86/mm/ident_map: Check for errors from ident_pud_init() Bob Pearson <rpearsonhpe(a)gmail.com> RDMA/rxe: Compute PSN windows correctly Tianyue Ren <rentianyue(a)kylinos.cn> selinux: fix error initialization in inode_doinit_with_dentry() Kamal Heib <kamalheib1(a)gmail.com> RDMA/bnxt_re: Set queue pair state when being queried Nicolas Boichat <drinkcat(a)chromium.org> soc: mediatek: Check if power domains can be powered on at boot time Dan Carpenter <dan.carpenter(a)oracle.com> soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains() Tom Rix <trix(a)redhat.com> drm/gma500: fix double free of gma_connector Peilin Ye <yepeilin.cs(a)gmail.com> Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() Dae R. Jeong <dae.r.jeong(a)kaist.ac.kr> md: fix a warning caused by a race between concurrent md_ioctl()s Eric Biggers <ebiggers(a)google.com> crypto: af_alg - avoid undefined behavior accessing salg_name Antti Palosaari <crope(a)iki.fi> media: msi2500: assign SPI bus number dynamically Jan Kara <jack(a)suse.cz> quota: Sanity-check quota file headers on load Alexey Kardashevskiy <aik(a)ozlabs.ru> serial_core: Check for port state when tty is in error state Julian Sax <jsbc(a)gmx.de> HID: i2c-hid: add Vero K147 to descriptor override Krzysztof Kozlowski <krzk(a)kernel.org> ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU Krzysztof Kozlowski <krzk(a)kernel.org> ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410 Krzysztof Kozlowski <krzk(a)kernel.org> ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU Fabio Estevam <festevam(a)gmail.com> usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul Will McVicker <willmcvicker(a)google.com> USB: gadget: f_rndis: fix bitrate for SuperSpeed and above Jack Pham <jackp(a)codeaurora.org> usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus Will McVicker <willmcvicker(a)google.com> USB: gadget: f_midi: setup SuperSpeed Plus descriptors taehyun.cho <taehyun.cho(a)samsung.com> USB: gadget: f_acm: add support for SuperSpeed Plus Johan Hovold <johan(a)kernel.org> USB: serial: option: add interface-number sanity check to flag handling Nicolin Chen <nicoleotsuka(a)gmail.com> soc/tegra: fuse: Fix index bug in get_process_id Thomas Gleixner <tglx(a)linutronix.de> dm table: Remove BUG_ON(in_interrupt()) Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> scsi: mpt3sas: Increase IOCInit request timeout to 30s Sven Eckelmann <sven(a)narfation.org> vxlan: Copy needed_tailroom from lowerdev Sven Eckelmann <sven(a)narfation.org> vxlan: Add needed_headroom for lower device Qinglang Miao <miaoqinglang(a)huawei.com> drm/tegra: sor: Disable clocks on error in tegra_sor_init() Nicholas Piggin <npiggin(a)gmail.com> kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling Leon Romanovsky <leonro(a)nvidia.com> RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait Zhang Qilong <zhangqilong3(a)huawei.com> can: softing: softing_netdev_open(): fix error handling Randy Dunlap <rdunlap(a)infradead.org> scsi: bnx2i: Requires MMU Baruch Siach <baruch(a)tkos.co.il> gpio: mvebu: fix potential user-after-free on probe Icenowy Zheng <icenowy(a)aosc.io> ARM: dts: sun8i: v3s: fix GIC node memory range Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: baytrail: Avoid clearing debounce value when turning it off Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: merrifield: Set default bias in case no particular value given Xin Xiong <xiongx18(a)fudan.edu.cn> drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi Alexander Sverdlin <alexander.sverdlin(a)gmail.com> serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix potential out-of-bounds shift Thomas Gleixner <tglx(a)linutronix.de> USB: sisusbvga: Make console support depend on BROKEN Oliver Neukum <oneukum(a)suse.com> USB: UAS: introduce a quirk to set no_write_same Li Jun <jun.li(a)nxp.com> xhci: Give USB2 ports time to enter U3 in bus suspend Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Fix control 'access overflow' errors from chmap Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Fix potential out-of-bounds shift Oliver Neukum <oneukum(a)suse.com> USB: add RESET_RESUME quirk for Snapscan 1212 Bui Quang Minh <minhquangbui99(a)gmail.com> USB: dummy-hcd: Fix uninitialized array use in init() Eric Dumazet <edumazet(a)google.com> mac80211: mesh: fix mesh_pathtbl_init() error path Zhang Changzhong <zhangchangzhong(a)huawei.com> net: bridge: vlan: fix error return code in __vlan_add() Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux Fugang Duan <fugang.duan(a)nxp.com> net: stmmac: delete the eee_ctrl_timer after napi disabled Moshe Shemesh <moshe(a)mellanox.com> net/mlx4_en: Handle TX error CQE Moshe Shemesh <moshe(a)mellanox.com> net/mlx4_en: Avoid scheduling restart task if it is already running Neal Cardwell <ncardwell(a)google.com> tcp: fix cwnd-limited bug for TSO deferral where we send nothing Fugang Duan <fugang.duan(a)nxp.com> net: stmmac: free tx skb buffer in stmmac_resume() Ansuel Smith <ansuelsmth(a)gmail.com> PCI: qcom: Add missing reset for ipq806x Arvind Sankar <nivedita(a)alum.mit.edu> x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP Dan Carpenter <dan.carpenter(a)oracle.com> scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()" Arnd Bergmann <arnd(a)arndb.de> kbuild: avoid static_assert for genksyms Coiby Xu <coiby.xu(a)gmail.com> pinctrl: amd: remove debounce filter setting in IRQ type setting Chris Chiu <chiu(a)endlessos.org> Input: i8042 - add Acer laptops to the i8042 reset list Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: cm109 - do not stomp on control URB Timo Witte <timo.witte(a)gmail.com> platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE Hao Si <si.hao(a)zte.com.cn> soc: fsl: dpio: Get the cpumask through cpumask_of(cpu) Can Guo <cang(a)codeaurora.org> scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE Vineet Gupta <vgupta(a)synopsys.com> ARC: stack unwinding: don't assume non-current task is sleeping Sara Sharon <sara.sharon(a)intel.com> iwlwifi: mvm: fix kernel panic in case of assert during CSA Markus Reichl <m.reichl(a)fivetechno.de> arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards. Johannes Berg <johannes.berg(a)intel.com> iwlwifi: pcie: limit memory read spin time Nathan Chancellor <natechancellor(a)gmail.com> spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe Lukas Wunner <lukas(a)wunner.de> spi: bcm2835aux: Fix use-after-free on unbind ------------- Diffstat: Documentation/admin-guide/kernel-parameters.txt | 1 + Documentation/networking/ip-sysctl.txt | 3 + Makefile | 4 +- arch/arc/kernel/stacktrace.c | 23 ++-- arch/arm/boot/dts/armada-xp-98dx3236.dtsi | 5 - arch/arm/boot/dts/at91-sama5d3_xplained.dts | 7 ++ arch/arm/boot/dts/at91-sama5d4_xplained.dts | 7 ++ arch/arm/boot/dts/at91sam9rl.dtsi | 19 ++-- arch/arm/boot/dts/exynos5410-odroidxu.dts | 6 +- arch/arm/boot/dts/exynos5410-pinctrl.dtsi | 28 +++++ arch/arm/boot/dts/exynos5410.dtsi | 4 + arch/arm/boot/dts/sama5d2.dtsi | 7 +- arch/arm/boot/dts/sun8i-v3s.dtsi | 2 +- arch/arm/kernel/head.S | 6 +- arch/arm/mach-shmobile/pm-rmobile.c | 1 + arch/arm64/boot/dts/exynos/exynos7.dtsi | 4 +- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 16 +-- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 3 + arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/kvm/sys_regs.c | 1 + arch/mips/bcm47xx/Kconfig | 1 + arch/powerpc/include/asm/cputable.h | 5 - arch/powerpc/kernel/rtas.c | 2 +- arch/powerpc/perf/core-book3s.c | 10 ++ arch/powerpc/platforms/powernv/memtrace.c | 22 ++++ arch/powerpc/platforms/pseries/suspend.c | 4 - arch/powerpc/xmon/nonstdio.c | 2 +- arch/s390/kernel/smp.c | 18 +-- arch/um/drivers/xterm.c | 5 + arch/x86/include/asm/pgtable_types.h | 1 + arch/x86/kernel/kprobes/core.c | 5 + arch/x86/mm/ident_map.c | 12 +- arch/x86/mm/mem_encrypt.c | 4 +- crypto/af_alg.c | 10 +- crypto/ecdh.c | 9 +- drivers/acpi/acpi_pnp.c | 3 + drivers/acpi/device_pm.c | 41 ++----- drivers/acpi/resource.c | 2 +- drivers/block/xen-blkback/xenbus.c | 4 +- drivers/bus/mips_cdmm.c | 4 +- drivers/clk/clk-s2mps11.c | 1 + drivers/clk/mvebu/armada-37xx-xtal.c | 4 +- drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 1 + drivers/clk/sunxi-ng/ccu-sun8i-h3.c | 1 + drivers/clk/tegra/clk-id.h | 1 + drivers/clk/tegra/clk-tegra-periph.c | 2 +- drivers/clk/ti/fapll.c | 11 +- drivers/clocksource/arm_arch_timer.c | 23 ++-- drivers/clocksource/cadence_ttc_timer.c | 18 +-- drivers/cpufreq/highbank-cpufreq.c | 7 ++ drivers/cpufreq/loongson1-cpufreq.c | 1 + drivers/cpufreq/mediatek-cpufreq.c | 1 + drivers/cpufreq/scpi-cpufreq.c | 1 + drivers/cpufreq/sti-cpufreq.c | 7 ++ drivers/crypto/omap-aes.c | 3 +- drivers/crypto/talitos.c | 6 +- drivers/edac/amd64_edac.c | 26 +++-- drivers/extcon/extcon-max77693.c | 2 +- drivers/gpio/gpio-mvebu.c | 16 ++- drivers/gpu/drm/drm_dp_aux_dev.c | 2 +- drivers/gpu/drm/drm_dp_mst_topology.c | 7 +- drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +- drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 1 + drivers/gpu/drm/tegra/sor.c | 10 +- drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++ drivers/hsi/controllers/omap_ssi_core.c | 2 +- drivers/iio/adc/rockchip_saradc.c | 2 +- drivers/iio/imu/bmi160/bmi160_core.c | 4 +- drivers/iio/industrialio-buffer.c | 6 +- drivers/iio/light/rpr0521.c | 17 ++- drivers/iio/pressure/mpl3115.c | 9 +- drivers/infiniband/core/cm.c | 2 + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 + drivers/infiniband/hw/cxgb4/cq.c | 3 + drivers/infiniband/hw/mthca/mthca_cq.c | 2 +- drivers/infiniband/hw/mthca/mthca_dev.h | 1 - drivers/infiniband/sw/rxe/rxe_req.c | 3 +- drivers/input/keyboard/cros_ec_keyb.c | 1 + drivers/input/keyboard/omap4-keypad.c | 89 +++++++++------ drivers/input/misc/cm109.c | 7 +- drivers/input/mouse/cyapa_gen6.c | 2 +- drivers/input/serio/i8042-x86ia64io.h | 42 +++++++ drivers/input/touchscreen/ads7846.c | 52 +++++---- drivers/input/touchscreen/goodix.c | 12 ++ drivers/irqchip/irq-alpine-msi.c | 3 +- drivers/md/dm-ioctl.c | 1 + drivers/md/dm-table.c | 6 - drivers/md/md-cluster.c | 67 ++++++----- drivers/md/md.c | 13 ++- drivers/media/common/siano/smsdvb-main.c | 5 +- drivers/media/i2c/max2175.c | 2 +- drivers/media/pci/netup_unidvb/netup_unidvb_spi.c | 5 +- drivers/media/pci/saa7146/mxb.c | 19 ++-- drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +- .../media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c | 1 + drivers/media/rc/sunxi-cir.c | 2 + drivers/media/usb/gspca/gspca.c | 1 + drivers/media/usb/msi2500/msi2500.c | 2 +- drivers/memstick/core/memstick.c | 1 - drivers/memstick/host/r592.c | 12 +- drivers/mtd/cmdlinepart.c | 14 ++- drivers/net/can/softing/softing_main.c | 9 +- drivers/net/ethernet/allwinner/sun4i-emac.c | 7 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 +- drivers/net/ethernet/korina.c | 2 +- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 21 ++-- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 40 +++++-- drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 12 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 6 +- drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c | 1 + .../net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 6 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 27 ++++- drivers/net/vxlan.c | 3 + drivers/net/wireless/ath/ath10k/usb.c | 7 +- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +- drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 36 ++++-- .../net/wireless/intersil/orinoco/orinoco_usb.c | 14 +-- drivers/net/wireless/marvell/mwifiex/main.c | 2 + drivers/net/wireless/st/cw1200/main.c | 2 + drivers/net/xen-netback/xenbus.c | 6 +- drivers/nfc/s3fwrn5/firmware.c | 4 +- drivers/nvdimm/label.c | 9 ++ drivers/pci/dwc/pcie-qcom.c | 12 ++ drivers/pci/host/pcie-iproc.c | 10 +- drivers/pci/pci-acpi.c | 4 +- drivers/pci/slot.c | 6 +- drivers/pinctrl/intel/pinctrl-baytrail.c | 8 +- drivers/pinctrl/intel/pinctrl-merrifield.c | 8 ++ drivers/pinctrl/pinctrl-amd.c | 7 -- drivers/pinctrl/pinctrl-falcon.c | 14 ++- drivers/platform/x86/acer-wmi.c | 1 + drivers/power/supply/bq24190_charger.c | 20 +++- drivers/ps3/ps3stor_lib.c | 2 +- drivers/pwm/pwm-lp3943.c | 1 + drivers/pwm/pwm-zx.c | 1 + drivers/s390/block/dasd_alias.c | 12 +- drivers/scsi/be2iscsi/be_main.c | 4 +- drivers/scsi/bnx2i/Kconfig | 1 + drivers/scsi/fnic/fnic_main.c | 1 + drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +- drivers/scsi/pm8001/pm8001_init.c | 3 +- drivers/scsi/qedi/qedi_main.c | 4 +- drivers/scsi/scsi_lib.c | 126 ++++++++++++++------- drivers/scsi/ufs/ufshcd.c | 7 ++ drivers/soc/mediatek/mtk-scpsys.c | 5 +- drivers/soc/qcom/smp2p.c | 5 +- drivers/soc/tegra/fuse/speedo-tegra210.c | 2 +- drivers/soc/ti/knav_dma.c | 13 ++- drivers/soc/ti/knav_qmss_queue.c | 4 +- drivers/spi/spi-bcm2835aux.c | 17 +-- drivers/spi/spi-davinci.c | 2 +- drivers/spi/spi-img-spfi.c | 4 +- drivers/spi/spi-pic32.c | 1 + drivers/spi/spi-rb4xx.c | 2 +- drivers/spi/spi-sc18is602.c | 13 +-- drivers/spi/spi-sh.c | 13 +-- drivers/spi/spi-st-ssc4.c | 5 +- drivers/spi/spi-tegra114.c | 2 + drivers/spi/spi-tegra20-sflash.c | 1 + drivers/spi/spi-tegra20-slink.c | 2 + drivers/spi/spi-ti-qspi.c | 1 + drivers/staging/comedi/drivers/mf6x4.c | 3 +- drivers/staging/fsl-mc/bus/dpio/dpio-driver.c | 5 +- drivers/staging/greybus/audio_codec.c | 2 + drivers/staging/speakup/speakup_dectlk.c | 2 +- drivers/tty/serial/8250/8250_omap.c | 5 - drivers/tty/serial/serial_core.c | 4 + drivers/usb/chipidea/ci_hdrc_imx.c | 3 +- drivers/usb/core/quirks.c | 3 + drivers/usb/gadget/function/f_acm.c | 2 +- drivers/usb/gadget/function/f_fs.c | 5 +- drivers/usb/gadget/function/f_midi.c | 6 + drivers/usb/gadget/function/f_rndis.c | 4 +- drivers/usb/gadget/udc/dummy_hcd.c | 2 +- drivers/usb/host/ehci-omap.c | 1 + drivers/usb/host/oxu210hp-hcd.c | 4 +- drivers/usb/host/xhci-hub.c | 4 + drivers/usb/misc/sisusbvga/Kconfig | 2 +- drivers/usb/serial/keyspan_pda.c | 63 ++++++----- drivers/usb/serial/mos7720.c | 2 + drivers/usb/serial/option.c | 23 +++- drivers/usb/storage/uas.c | 3 + drivers/usb/storage/unusual_uas.h | 7 +- drivers/usb/storage/usb.c | 3 + drivers/vfio/pci/vfio_pci.c | 4 +- drivers/watchdog/Kconfig | 3 +- drivers/watchdog/qcom-wdt.c | 2 +- drivers/xen/xen-pciback/xenbus.c | 2 +- drivers/xen/xenbus/xenbus.h | 2 + drivers/xen/xenbus/xenbus_client.c | 8 +- drivers/xen/xenbus/xenbus_probe.c | 1 + drivers/xen/xenbus/xenbus_probe_backend.c | 7 ++ drivers/xen/xenbus/xenbus_xs.c | 34 ++++-- fs/btrfs/inode.c | 2 +- fs/btrfs/tests/btrfs-tests.c | 8 +- fs/ceph/caps.c | 11 +- fs/ext4/inode.c | 19 +++- fs/ext4/mballoc.c | 1 + fs/jffs2/readinode.c | 16 +++ fs/jfs/jfs_dmap.h | 2 +- fs/lockd/host.c | 20 ++-- fs/nfs/inode.c | 2 +- fs/nfs/nfs4proc.c | 10 +- fs/nfs_common/grace.c | 6 +- fs/nfsd/nfssvc.c | 3 +- fs/quota/quota_v2.c | 19 ++++ include/acpi/acpi_bus.h | 5 - include/linux/build_bug.h | 5 + include/linux/inetdevice.h | 4 +- include/linux/security.h | 2 +- include/linux/seq_buf.h | 2 +- include/linux/sunrpc/xprt.h | 1 + include/linux/trace_seq.h | 4 +- include/linux/usb_usual.h | 2 + include/uapi/linux/if_alg.h | 16 +++ include/xen/xenbus.h | 15 ++- kernel/cpu.c | 6 +- kernel/irq/irqdomain.c | 11 +- kernel/sched/core.c | 6 +- kernel/sched/deadline.c | 5 +- kernel/sched/sched.h | 42 +++---- net/bluetooth/hci_event.c | 17 +-- net/bridge/br_vlan.c | 4 +- net/ipv4/tcp_output.c | 9 +- net/mac80211/mesh_pathtbl.c | 4 +- net/sunrpc/xprt.c | 65 ++++++++--- net/sunrpc/xprtrdma/module.c | 1 + net/sunrpc/xprtrdma/transport.c | 1 + net/sunrpc/xprtsock.c | 4 + net/wireless/nl80211.c | 2 +- samples/bpf/lwt_len_hist.sh | 2 + samples/bpf/test_lwt_bpf.sh | 0 scripts/checkpatch.pl | 2 +- security/integrity/ima/ima_crypto.c | 20 +--- security/selinux/hooks.c | 16 ++- sound/core/oss/pcm_oss.c | 28 +++-- sound/pci/hda/patch_realtek.c | 1 + sound/soc/codecs/wm8997.c | 2 + sound/soc/codecs/wm8998.c | 4 +- sound/soc/codecs/wm_adsp.c | 5 +- sound/soc/jz4740/jz4740-i2s.c | 4 + sound/soc/soc-pcm.c | 2 + sound/usb/clock.c | 6 + sound/usb/format.c | 2 + sound/usb/stream.c | 6 +- tools/perf/util/parse-regs-options.c | 2 +- 246 files changed, 1453 insertions(+), 675 deletions(-)

3 years, 3 months

5
245
0 0

[PATCH AUTOSEL 5.7 01/30] drm/msm: fix potential memleak in error branch

by Sasha Levin

From: Bernard Zhao <bernard(a)vivo.com> [ Upstream commit 177d3819633cd520e3f95df541a04644aab4c657 ] In function msm_submitqueue_create, the queue is a local variable, in return -EINVAL branch, queue didn`t add to ctx`s list yet, and also didn`t kfree, this maybe bring in potential memleak. Signed-off-by: Bernard Zhao <bernard(a)vivo.com> [trivial commit msg fixup] Signed-off-by: Rob Clark <robdclark(a)chromium.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpu/drm/msm/msm_submitqueue.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/msm/msm_submitqueue.c b/drivers/gpu/drm/msm/msm_submitqueue.c index 001fbf537440a..a1d94be7883a0 100644 --- a/drivers/gpu/drm/msm/msm_submitqueue.c +++ b/drivers/gpu/drm/msm/msm_submitqueue.c @@ -71,8 +71,10 @@ int msm_submitqueue_create(struct drm_device *drm, struct msm_file_private *ctx, queue->flags = flags; if (priv->gpu) { - if (prio >= priv->gpu->nr_rings) + if (prio >= priv->gpu->nr_rings) { + kfree(queue); return -EINVAL; + } queue->prio = prio; } -- 2.25.1

3 years, 3 months

5
27
0 0

FAILED: patch "[PATCH] spi: pxa2xx: Fix use-after-free on unbind" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 5626308bb94d9f930aa5f7c77327df4c6daa7759 Mon Sep 17 00:00:00 2001 From: Lukas Wunner <lukas(a)wunner.de> Date: Mon, 7 Dec 2020 09:17:05 +0100 Subject: [PATCH] spi: pxa2xx: Fix use-after-free on unbind pxa2xx_spi_remove() accesses the driver's private data after calling spi_unregister_controller() even though that function releases the last reference on the spi_controller and thereby frees the private data. Fix by switching over to the new devm_spi_alloc_master/slave() helper which keeps the private data accessible until the driver has unbound. Fixes: 32e5b57232c0 ("spi: pxa2xx: Fix controller unregister order") Signed-off-by: Lukas Wunner <lukas(a)wunner.de> Cc: <stable(a)vger.kernel.org> # v2.6.17+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation Cc: <stable(a)vger.kernel.org> # v2.6.17+: 32e5b57232c0: spi: pxa2xx: Fix controller unregister order Cc: <stable(a)vger.kernel.org> # v2.6.17+ Link: https://lore.kernel.org/r/5764b04d4a6e43069ebb7808f64c2f774ac6f193.16072868… Signed-off-by: Mark Brown <broonie(a)kernel.org> diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c index 62a0f0f86553..bd2354fd438d 100644 --- a/drivers/spi/spi-pxa2xx.c +++ b/drivers/spi/spi-pxa2xx.c @@ -1691,9 +1691,9 @@ static int pxa2xx_spi_probe(struct platform_device *pdev) } if (platform_info->is_slave) - controller = spi_alloc_slave(dev, sizeof(struct driver_data)); + controller = devm_spi_alloc_slave(dev, sizeof(*drv_data)); else - controller = spi_alloc_master(dev, sizeof(struct driver_data)); + controller = devm_spi_alloc_master(dev, sizeof(*drv_data)); if (!controller) { dev_err(&pdev->dev, "cannot alloc spi_controller\n"); @@ -1916,7 +1916,6 @@ static int pxa2xx_spi_probe(struct platform_device *pdev) free_irq(ssp->irq, drv_data); out_error_controller_alloc: - spi_controller_put(controller); pxa_ssp_free(ssp); return status; }

3 years, 3 months

2
1
0 0

FAILED: patch "[PATCH] iio: imu: st_lsm6dsx: fix edge-trigger interrupts" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 3f9bce7a22a3f8ac9d885c9d75bc45569f24ac8b Mon Sep 17 00:00:00 2001 From: Lorenzo Bianconi <lorenzo(a)kernel.org> Date: Sat, 14 Nov 2020 19:39:05 +0100 Subject: [PATCH] iio: imu: st_lsm6dsx: fix edge-trigger interrupts If we are using edge IRQs, new samples can arrive while processing current interrupt since there are no hw guarantees the irq line stays "low" long enough to properly detect the new interrupt. In this case the new sample will be missed. Polling FIFO status register in st_lsm6dsx_handler_thread routine allow us to read new samples even if the interrupt arrives while processing previous data and the timeslot where the line is "low" is too short to be properly detected. Fixes: 89ca88a7cdf2 ("iio: imu: st_lsm6dsx: support active-low interrupts") Fixes: 290a6ce11d93 ("iio: imu: add support to lsm6dsx driver") Signed-off-by: Lorenzo Bianconi <lorenzo(a)kernel.org> Link: https://lore.kernel.org/r/5e93cda7dc1e665f5685c53ad8e9ea71dbae782d.16053788… Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c index 467214e2e77c..7cedaab096a7 100644 --- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c @@ -2069,19 +2069,35 @@ st_lsm6dsx_report_motion_event(struct st_lsm6dsx_hw *hw) static irqreturn_t st_lsm6dsx_handler_thread(int irq, void *private) { struct st_lsm6dsx_hw *hw = private; + int fifo_len = 0, len; bool event; - int count; event = st_lsm6dsx_report_motion_event(hw); if (!hw->settings->fifo_ops.read_fifo) return event ? IRQ_HANDLED : IRQ_NONE; - mutex_lock(&hw->fifo_lock); - count = hw->settings->fifo_ops.read_fifo(hw); - mutex_unlock(&hw->fifo_lock); + /* + * If we are using edge IRQs, new samples can arrive while + * processing current interrupt since there are no hw + * guarantees the irq line stays "low" long enough to properly + * detect the new interrupt. In this case the new sample will + * be missed. + * Polling FIFO status register allow us to read new + * samples even if the interrupt arrives while processing + * previous data and the timeslot where the line is "low" is + * too short to be properly detected. + */ + do { + mutex_lock(&hw->fifo_lock); + len = hw->settings->fifo_ops.read_fifo(hw); + mutex_unlock(&hw->fifo_lock); + + if (len > 0) + fifo_len += len; + } while (len > 0); - return count || event ? IRQ_HANDLED : IRQ_NONE; + return fifo_len || event ? IRQ_HANDLED : IRQ_NONE; } static int st_lsm6dsx_irq_setup(struct st_lsm6dsx_hw *hw)

3 years, 3 months

2
1
0 0

FAILED: patch "[PATCH] iio: imu: st_lsm6dsx: fix edge-trigger interrupts" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 3f9bce7a22a3f8ac9d885c9d75bc45569f24ac8b Mon Sep 17 00:00:00 2001 From: Lorenzo Bianconi <lorenzo(a)kernel.org> Date: Sat, 14 Nov 2020 19:39:05 +0100 Subject: [PATCH] iio: imu: st_lsm6dsx: fix edge-trigger interrupts If we are using edge IRQs, new samples can arrive while processing current interrupt since there are no hw guarantees the irq line stays "low" long enough to properly detect the new interrupt. In this case the new sample will be missed. Polling FIFO status register in st_lsm6dsx_handler_thread routine allow us to read new samples even if the interrupt arrives while processing previous data and the timeslot where the line is "low" is too short to be properly detected. Fixes: 89ca88a7cdf2 ("iio: imu: st_lsm6dsx: support active-low interrupts") Fixes: 290a6ce11d93 ("iio: imu: add support to lsm6dsx driver") Signed-off-by: Lorenzo Bianconi <lorenzo(a)kernel.org> Link: https://lore.kernel.org/r/5e93cda7dc1e665f5685c53ad8e9ea71dbae782d.16053788… Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c index 467214e2e77c..7cedaab096a7 100644 --- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c @@ -2069,19 +2069,35 @@ st_lsm6dsx_report_motion_event(struct st_lsm6dsx_hw *hw) static irqreturn_t st_lsm6dsx_handler_thread(int irq, void *private) { struct st_lsm6dsx_hw *hw = private; + int fifo_len = 0, len; bool event; - int count; event = st_lsm6dsx_report_motion_event(hw); if (!hw->settings->fifo_ops.read_fifo) return event ? IRQ_HANDLED : IRQ_NONE; - mutex_lock(&hw->fifo_lock); - count = hw->settings->fifo_ops.read_fifo(hw); - mutex_unlock(&hw->fifo_lock); + /* + * If we are using edge IRQs, new samples can arrive while + * processing current interrupt since there are no hw + * guarantees the irq line stays "low" long enough to properly + * detect the new interrupt. In this case the new sample will + * be missed. + * Polling FIFO status register allow us to read new + * samples even if the interrupt arrives while processing + * previous data and the timeslot where the line is "low" is + * too short to be properly detected. + */ + do { + mutex_lock(&hw->fifo_lock); + len = hw->settings->fifo_ops.read_fifo(hw); + mutex_unlock(&hw->fifo_lock); + + if (len > 0) + fifo_len += len; + } while (len > 0); - return count || event ? IRQ_HANDLED : IRQ_NONE; + return fifo_len || event ? IRQ_HANDLED : IRQ_NONE; } static int st_lsm6dsx_irq_setup(struct st_lsm6dsx_hw *hw)

3 years, 3 months

2
1
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror December 2020