This is the start of the stable review cycle for the 4.19.240 release.
There are 53 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 28 Apr 2022 08:17:22 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.240-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.240-rc1
Marek Vasut <marex(a)denx.de>
Revert "net: micrel: fix KS8851_MLL Kconfig"
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: Fix UAF bugs in ax25 timers
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: Fix NULL pointer dereferences in ax25 timers
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: fix NPD bug in ax25_disconnect
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: fix UAF bug in ax25_send_control()
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: Fix refcount leaks caused by ax25_cb_del()
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: fix UAF bugs of net_device caused by rebinding operation
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: fix reference count leaks of ax25_dev
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: add refcount in ax25_dev to avoid UAF bugs
Khazhismel Kumykov <khazhy(a)google.com>
block/compat_ioctl: fix range check in BLKGETSIZE
Lee Jones <lee.jones(a)linaro.org>
staging: ion: Prevent incorrect reference counting behavour
Theodore Ts'o <tytso(a)mit.edu>
ext4: force overhead calculation if the s_overhead_cluster makes no sense
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix overhead calculation to account for the reserved gdt blocks
Tadeusz Struk <tadeusz.struk(a)linaro.org>
ext4: limit length to bitmap_maxbytes - blocksize in punch_hole
Ye Bin <yebin10(a)huawei.com>
ext4: fix symlink file size not match to file content
Rob Herring <robh(a)kernel.org>
arm_pmu: Validate single/group leader events
Sergey Matyukevich <sergey.matyukevich(a)synopsys.com>
ARC: entry: fix syscall_trace_exit argument
Sasha Neftin <sasha.neftin(a)intel.com>
e1000e: Fix possible overflow in LTR decoding
Xiaomeng Tong <xiam0nd.tong(a)gmail.com>
ASoC: soc-dapm: fix two incorrect uses of list iterator
Paolo Valerio <pvalerio(a)redhat.com>
openvswitch: fix OOB access in reserve_sfa_size()
Athira Rajeev <atrajeev(a)linux.vnet.ibm.com>
powerpc/perf: Fix power9 event alternatives
Dave Stevenson <dave.stevenson(a)raspberrypi.com>
drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare
Dave Stevenson <dave.stevenson(a)raspberrypi.com>
drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised
Xiaomeng Tong <xiam0nd.tong(a)gmail.com>
dma: at_xdmac: fix a missing check on list iterator
Zheyu Ma <zheyuma97(a)gmail.com>
ata: pata_marvell: Check the 'bmdma_addr' beforing reading
Mikulas Patocka <mpatocka(a)redhat.com>
stat: fix inconsistency between struct stat and struct compat_stat
Tomas Melin <tomas.melin(a)vaisala.com>
net: macb: Restart tx only if queue pointer is lagging
Xiaoke Wang <xkernel.wang(a)foxmail.com>
drm/msm/mdp5: check the return of kzalloc()
Lv Ruyi <lv.ruyi(a)zte.com.cn>
dpaa_eth: Fix missing of_node_put in dpaa_get_ts_info()
Borislav Petkov <bp(a)alien8.de>
brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant
Borislav Petkov <bp(a)suse.de>
mt76: Fix undefined behavior due to shift overflowing the constant
David Howells <dhowells(a)redhat.com>
cifs: Check the IOCB_DIRECT flag, not O_DIRECT
Hongbin Wang <wh_bin(a)126.com>
vxlan: fix error return code in vxlan_fdb_append
Borislav Petkov <bp(a)suse.de>
ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant
Jiapeng Chong <jiapeng.chong(a)linux.alibaba.com>
platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative
Sameer Pujar <spujar(a)nvidia.com>
reset: tegra-bpmp: Restore Handle errors in BPMP response
Kees Cook <keescook(a)chromium.org>
ARM: vexpress/spc: Avoid negative array index when !SMP
Eric Dumazet <edumazet(a)google.com>
netlink: reset network and mac headers in netlink_dump()
Eric Dumazet <edumazet(a)google.com>
net/sched: cls_u32: fix possible leak in u32_init_knode()
Hangbin Liu <liuhangbin(a)gmail.com>
net/packet: fix packet_sock xmit return value checking
David Howells <dhowells(a)redhat.com>
rxrpc: Restore removed timer deletion
Miaoqian Lin <linmq006(a)gmail.com>
dmaengine: imx-sdma: Fix error checking in sdma_event_remap
Miaoqian Lin <linmq006(a)gmail.com>
ASoC: msm8916-wcd-digital: Check failure for devm_snd_soc_register_component
Mark Brown <broonie(a)kernel.org>
ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek
Kuniyuki Iwashima <kuniyu(a)amazon.co.jp>
tcp: Fix potential use-after-free due to double kfree()
Ricardo Dias <rdias(a)singlestore.com>
tcp: fix race condition when creating child sockets from syncookies
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Clear MIDI port active flag after draining
Bob Peterson <rpeterso(a)redhat.com>
gfs2: assign rgrp glock before compute_bitstructs
Mikulas Patocka <mpatocka(a)redhat.com>
dm integrity: fix memory corruption when tag_size is less than digest size
Hangyu Hua <hbh25y(a)gmail.com>
can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path
Daniel Bristot de Oliveira <bristot(a)kernel.org>
tracing: Dump stacktrace trigger to the corresponding instance
Xiongwei Song <sxwjean(a)gmail.com>
mm: page_alloc: fix building error on -Werror=array-compare
Kees Cook <keescook(a)chromium.org>
etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead
-------------
Diffstat:
Makefile | 4 +-
arch/arc/kernel/entry.S | 1 +
arch/arm/mach-vexpress/spc.c | 2 +-
arch/powerpc/perf/power9-pmu.c | 8 +--
arch/x86/include/asm/compat.h | 6 +-
block/compat_ioctl.c | 2 +-
drivers/ata/pata_marvell.c | 2 +
drivers/dma/at_xdmac.c | 12 ++--
drivers/dma/imx-sdma.c | 4 +-
drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 3 +
.../gpu/drm/panel/panel-raspberrypi-touchscreen.c | 13 ++++-
drivers/md/dm-integrity.c | 7 ++-
drivers/net/can/usb/usb_8dev.c | 30 +++++-----
drivers/net/ethernet/cadence/macb_main.c | 8 +++
drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c | 8 ++-
drivers/net/ethernet/intel/e1000e/ich8lan.c | 4 +-
drivers/net/ethernet/micrel/Kconfig | 1 -
drivers/net/vxlan.c | 4 +-
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt76x2_pci.c | 2 +-
drivers/perf/arm_pmu.c | 10 ++--
drivers/platform/x86/samsung-laptop.c | 2 -
drivers/reset/tegra/reset-bpmp.c | 9 ++-
drivers/staging/android/ion/ion.c | 3 +
fs/cifs/cifsfs.c | 2 +-
fs/ext4/inode.c | 11 +++-
fs/ext4/page-io.c | 4 +-
fs/ext4/super.c | 19 ++++--
fs/gfs2/rgrp.c | 9 +--
fs/stat.c | 19 +++---
include/linux/etherdevice.h | 5 +-
include/net/ax25.h | 12 ++++
include/net/inet_hashtables.h | 5 +-
kernel/trace/trace_events_trigger.c | 9 ++-
mm/page_alloc.c | 2 +-
net/ax25/af_ax25.c | 38 +++++++++---
net/ax25/ax25_dev.c | 28 +++++++--
net/ax25/ax25_route.c | 13 ++++-
net/ax25/ax25_subr.c | 20 +++++--
net/dccp/ipv4.c | 2 +-
net/dccp/ipv6.c | 2 +-
net/ipv4/inet_connection_sock.c | 2 +-
net/ipv4/inet_hashtables.c | 68 +++++++++++++++++++---
net/ipv4/tcp_ipv4.c | 13 ++++-
net/ipv6/tcp_ipv6.c | 13 ++++-
net/netlink/af_netlink.c | 7 +++
net/openvswitch/flow_netlink.c | 2 +-
net/packet/af_packet.c | 13 +++--
net/rxrpc/net_ns.c | 2 +
net/sched/cls_u32.c | 8 +--
sound/soc/atmel/sam9g20_wm8731.c | 61 -------------------
sound/soc/codecs/msm8916-wcd-digital.c | 9 ++-
sound/soc/soc-dapm.c | 6 +-
sound/usb/midi.c | 1 +
sound/usb/usbaudio.h | 2 +-
55 files changed, 359 insertions(+), 195 deletions(-)
xtensa is the last user of the PT_SINGLESTEP flag. Changing tsk->ptrace in
user_enable_single_step and user_disable_single_step without locking could
potentiallly cause problems.
So use a thread info flag instead of a flag in tsk->ptrace. Use TIF_SINGLESTEP
that xtensa already had defined but unused.
Remove the definitions of PT_SINGLESTEP and PT_BLOCKSTEP as they have no more users.
Cc: stable(a)vger.kernel.org
Acked-by: Max Filippov <jcmvbkbc(a)gmail.com>
Signed-off-by: "Eric W. Biederman" <ebiederm(a)xmission.com>
---
arch/xtensa/kernel/ptrace.c | 4 ++--
arch/xtensa/kernel/signal.c | 4 ++--
include/linux/ptrace.h | 6 ------
3 files changed, 4 insertions(+), 10 deletions(-)
diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
index 323c678a691f..b952e67cc0cc 100644
--- a/arch/xtensa/kernel/ptrace.c
+++ b/arch/xtensa/kernel/ptrace.c
@@ -225,12 +225,12 @@ const struct user_regset_view *task_user_regset_view(struct task_struct *task)
void user_enable_single_step(struct task_struct *child)
{
- child->ptrace |= PT_SINGLESTEP;
+ set_tsk_thread_flag(child, TIF_SINGLESTEP);
}
void user_disable_single_step(struct task_struct *child)
{
- child->ptrace &= ~PT_SINGLESTEP;
+ clear_tsk_thread_flag(child, TIF_SINGLESTEP);
}
/*
diff --git a/arch/xtensa/kernel/signal.c b/arch/xtensa/kernel/signal.c
index 6f68649e86ba..ac50ec46c8f1 100644
--- a/arch/xtensa/kernel/signal.c
+++ b/arch/xtensa/kernel/signal.c
@@ -473,7 +473,7 @@ static void do_signal(struct pt_regs *regs)
/* Set up the stack frame */
ret = setup_frame(&ksig, sigmask_to_save(), regs);
signal_setup_done(ret, &ksig, 0);
- if (current->ptrace & PT_SINGLESTEP)
+ if (test_thread_flag(TIF_SINGLESTEP))
task_pt_regs(current)->icountlevel = 1;
return;
@@ -499,7 +499,7 @@ static void do_signal(struct pt_regs *regs)
/* If there's no signal to deliver, we just restore the saved mask. */
restore_saved_sigmask();
- if (current->ptrace & PT_SINGLESTEP)
+ if (test_thread_flag(TIF_SINGLESTEP))
task_pt_regs(current)->icountlevel = 1;
return;
}
diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
index 4c06f9f8ef3f..c952c5ba8fab 100644
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -46,12 +46,6 @@ extern int ptrace_access_vm(struct task_struct *tsk, unsigned long addr,
#define PT_EXITKILL (PTRACE_O_EXITKILL << PT_OPT_FLAG_SHIFT)
#define PT_SUSPEND_SECCOMP (PTRACE_O_SUSPEND_SECCOMP << PT_OPT_FLAG_SHIFT)
-/* single stepping state bits (used on ARM and PA-RISC) */
-#define PT_SINGLESTEP_BIT 31
-#define PT_SINGLESTEP (1<<PT_SINGLESTEP_BIT)
-#define PT_BLOCKSTEP_BIT 30
-#define PT_BLOCKSTEP (1<<PT_BLOCKSTEP_BIT)
-
extern long arch_ptrace(struct task_struct *child, long request,
unsigned long addr, unsigned long data);
extern int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len);
--
2.35.3
[BUG]
For a 4K sector sized btrfs with v1 cache enabled and only mounted on
systems with 4K page size, if it's mounted on subpage (64K page size)
systems, it can cause the following warning on v1 space cache:
BTRFS error (device dm-1): csum mismatch on free space cache
BTRFS warning (device dm-1): failed to load free space cache for block group 84082688, rebuilding it now
Although not a big deal, as kernel can rebuild it without problem, such
warning will bother end users, especially if they want to switch the
same btrfs seamlessly between different page sized systems.
[CAUSE]
V1 free space cache is still using fixed PAGE_SIZE for various bitmap,
like BITS_PER_BITMAP.
Such hard-coded PAGE_SIZE usage will cause various mismatch, from v1
cache size to checksum.
Thus kernel will always reject v1 cache with a different PAGE_SIZE with
csum mismatch.
[FIX]
Although we should fix v1 cache, it's already going to be marked
deprecated soon.
And we have v2 cache based on metadata (which is already fully subpage
compatible), and it has almost everything superior than v1 cache.
So just force subpage mount to use v2 cache on mount.
Reported-by: Matt Corallo <blnxfsl(a)bluematt.me>
CC: stable(a)vger.kernel.org # 5.15+
Link: https://lore.kernel.org/linux-btrfs/61aa27d1-30fc-c1a9-f0f4-9df544395ec3@bl…
Signed-off-by: Qu Wenruo <wqu(a)suse.com>
---
fs/btrfs/disk-io.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index d456f426924c..34eb6d4b904a 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3675,6 +3675,17 @@ int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_device
if (sectorsize < PAGE_SIZE) {
struct btrfs_subpage_info *subpage_info;
+ /*
+ * V1 space cache has some hardcoded PAGE_SIZE usage, and is
+ * going to be deprecated.
+ *
+ * Force to use v2 cache for subpage case.
+ */
+ btrfs_clear_opt(fs_info->mount_opt, SPACE_CACHE);
+ btrfs_set_and_info(fs_info, FREE_SPACE_TREE,
+ "forcing free space tree for sector size %u with page size %lu",
+ sectorsize, PAGE_SIZE);
+
btrfs_warn(fs_info,
"read-write for sector size %u with page size %lu is experimental",
sectorsize, PAGE_SIZE);
--
2.35.1
From: Oliver Hartkopp <socketcan(a)hartkopp.net>
As a carry over from the CAN_RAW socket (which allows to change the CAN
interface while mantaining the filter setup) the re-binding of the
CAN_ISOTP socket needs to take care about CAN ID address information and
subscriptions. It turned out that this feature is so limited (e.g. the
sockopts remain fix) that it finally has never been needed/used.
In opposite to the stateless CAN_RAW socket the switching of the CAN ID
subscriptions might additionally lead to an interrupted ongoing PDU
reception. So better remove this unneeded complexity.
Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
Link: https://lore.kernel.org/all/20220422082337.1676-1-socketcan@hartkopp.net
Cc: stable(a)vger.kernel.org
Signed-off-by: Oliver Hartkopp <socketcan(a)hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de>
---
net/can/isotp.c | 25 +++++--------------------
1 file changed, 5 insertions(+), 20 deletions(-)
diff --git a/net/can/isotp.c b/net/can/isotp.c
index ff5d7870294e..1e7c6a460ef9 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -1189,6 +1189,11 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)
lock_sock(sk);
+ if (so->bound) {
+ err = -EINVAL;
+ goto out;
+ }
+
/* do not register frame reception for functional addressing */
if (so->opt.flags & CAN_ISOTP_SF_BROADCAST)
do_rx_reg = 0;
@@ -1199,10 +1204,6 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)
goto out;
}
- if (so->bound && addr->can_ifindex == so->ifindex &&
- rx_id == so->rxid && tx_id == so->txid)
- goto out;
-
dev = dev_get_by_index(net, addr->can_ifindex);
if (!dev) {
err = -ENODEV;
@@ -1237,22 +1238,6 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)
dev_put(dev);
- if (so->bound && do_rx_reg) {
- /* unregister old filter */
- if (so->ifindex) {
- dev = dev_get_by_index(net, so->ifindex);
- if (dev) {
- can_rx_unregister(net, dev, so->rxid,
- SINGLE_MASK(so->rxid),
- isotp_rcv, sk);
- can_rx_unregister(net, dev, so->txid,
- SINGLE_MASK(so->txid),
- isotp_rcv_echo, sk);
- dev_put(dev);
- }
- }
- }
-
/* switch to new settings */
so->ifindex = ifindex;
so->rxid = rx_id;
base-commit: d9157f6806d1499e173770df1f1b234763de5c79
--
2.35.1