The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 42a657f57628402c73237547f0134e083e2f6764 Mon Sep 17 00:00:00 2001
From: Pan Bian <bianpan2016(a)163.com>
Date: Fri, 23 Nov 2018 18:10:15 +0800
Subject: [PATCH] btrfs: relocation: set trans to be NULL after ending
transaction
The function relocate_block_group calls btrfs_end_transaction to release
trans when update_backref_cache returns 1, and then continues the loop
body. If btrfs_block_rsv_refill fails this time, it will jump out the
loop and the freed trans will be accessed. This may result in a
use-after-free bug. The patch assigns NULL to trans after trans is
released so that it will not be accessed.
Fixes: 0647bf564f1 ("Btrfs: improve forever loop when doing balance relocation")
CC: stable(a)vger.kernel.org # 4.4+
Reviewed-by: Qu Wenruo <wqu(a)suse.com>
Signed-off-by: Pan Bian <bianpan2016(a)163.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 924116f654a1..a3f75b8926d4 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -3959,6 +3959,7 @@ static noinline_for_stack int relocate_block_group(struct reloc_control *rc)
restart:
if (update_backref_cache(trans, &rc->backref_cache)) {
btrfs_end_transaction(trans);
+ trans = NULL;
continue;
}
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 42a657f57628402c73237547f0134e083e2f6764 Mon Sep 17 00:00:00 2001
From: Pan Bian <bianpan2016(a)163.com>
Date: Fri, 23 Nov 2018 18:10:15 +0800
Subject: [PATCH] btrfs: relocation: set trans to be NULL after ending
transaction
The function relocate_block_group calls btrfs_end_transaction to release
trans when update_backref_cache returns 1, and then continues the loop
body. If btrfs_block_rsv_refill fails this time, it will jump out the
loop and the freed trans will be accessed. This may result in a
use-after-free bug. The patch assigns NULL to trans after trans is
released so that it will not be accessed.
Fixes: 0647bf564f1 ("Btrfs: improve forever loop when doing balance relocation")
CC: stable(a)vger.kernel.org # 4.4+
Reviewed-by: Qu Wenruo <wqu(a)suse.com>
Signed-off-by: Pan Bian <bianpan2016(a)163.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 924116f654a1..a3f75b8926d4 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -3959,6 +3959,7 @@ static noinline_for_stack int relocate_block_group(struct reloc_control *rc)
restart:
if (update_backref_cache(trans, &rc->backref_cache)) {
btrfs_end_transaction(trans);
+ trans = NULL;
continue;
}
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 552f0329c75b3e1d7f9bb8c9e421d37403f192cd Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Mon, 19 Nov 2018 16:20:34 +0000
Subject: [PATCH] Btrfs: fix race between enabling quotas and subvolume
creation
We have a race between enabling quotas end subvolume creation that cause
subvolume creation to fail with -EINVAL, and the following diagram shows
how it happens:
CPU 0 CPU 1
btrfs_ioctl()
btrfs_ioctl_quota_ctl()
btrfs_quota_enable()
mutex_lock(fs_info->qgroup_ioctl_lock)
btrfs_ioctl()
create_subvol()
btrfs_qgroup_inherit()
-> save fs_info->quota_root
into quota_root
-> stores a NULL value
-> tries to lock the mutex
qgroup_ioctl_lock
-> blocks waiting for
the task at CPU0
-> sets BTRFS_FS_QUOTA_ENABLED in fs_info
-> sets quota_root in fs_info->quota_root
(non-NULL value)
mutex_unlock(fs_info->qgroup_ioctl_lock)
-> checks quota enabled
flag is set
-> returns -EINVAL because
fs_info->quota_root was
NULL before it acquired
the mutex
qgroup_ioctl_lock
-> ioctl returns -EINVAL
Returning -EINVAL to user space will be confusing if all the arguments
passed to the subvolume creation ioctl were valid.
Fix it by grabbing the value from fs_info->quota_root after acquiring
the mutex.
CC: stable(a)vger.kernel.org # 4.4+
Reviewed-by: Qu Wenruo <wqu(a)suse.com>
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 45868fd76209..f70825af6438 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -2659,7 +2659,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
int i;
u64 *i_qgroups;
struct btrfs_fs_info *fs_info = trans->fs_info;
- struct btrfs_root *quota_root = fs_info->quota_root;
+ struct btrfs_root *quota_root;
struct btrfs_qgroup *srcgroup;
struct btrfs_qgroup *dstgroup;
u32 level_size = 0;
@@ -2669,6 +2669,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags))
goto out;
+ quota_root = fs_info->quota_root;
if (!quota_root) {
ret = -EINVAL;
goto out;
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 552f0329c75b3e1d7f9bb8c9e421d37403f192cd Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Mon, 19 Nov 2018 16:20:34 +0000
Subject: [PATCH] Btrfs: fix race between enabling quotas and subvolume
creation
We have a race between enabling quotas end subvolume creation that cause
subvolume creation to fail with -EINVAL, and the following diagram shows
how it happens:
CPU 0 CPU 1
btrfs_ioctl()
btrfs_ioctl_quota_ctl()
btrfs_quota_enable()
mutex_lock(fs_info->qgroup_ioctl_lock)
btrfs_ioctl()
create_subvol()
btrfs_qgroup_inherit()
-> save fs_info->quota_root
into quota_root
-> stores a NULL value
-> tries to lock the mutex
qgroup_ioctl_lock
-> blocks waiting for
the task at CPU0
-> sets BTRFS_FS_QUOTA_ENABLED in fs_info
-> sets quota_root in fs_info->quota_root
(non-NULL value)
mutex_unlock(fs_info->qgroup_ioctl_lock)
-> checks quota enabled
flag is set
-> returns -EINVAL because
fs_info->quota_root was
NULL before it acquired
the mutex
qgroup_ioctl_lock
-> ioctl returns -EINVAL
Returning -EINVAL to user space will be confusing if all the arguments
passed to the subvolume creation ioctl were valid.
Fix it by grabbing the value from fs_info->quota_root after acquiring
the mutex.
CC: stable(a)vger.kernel.org # 4.4+
Reviewed-by: Qu Wenruo <wqu(a)suse.com>
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 45868fd76209..f70825af6438 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -2659,7 +2659,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
int i;
u64 *i_qgroups;
struct btrfs_fs_info *fs_info = trans->fs_info;
- struct btrfs_root *quota_root = fs_info->quota_root;
+ struct btrfs_root *quota_root;
struct btrfs_qgroup *srcgroup;
struct btrfs_qgroup *dstgroup;
u32 level_size = 0;
@@ -2669,6 +2669,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags))
goto out;
+ quota_root = fs_info->quota_root;
if (!quota_root) {
ret = -EINVAL;
goto out;
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 552f0329c75b3e1d7f9bb8c9e421d37403f192cd Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Mon, 19 Nov 2018 16:20:34 +0000
Subject: [PATCH] Btrfs: fix race between enabling quotas and subvolume
creation
We have a race between enabling quotas end subvolume creation that cause
subvolume creation to fail with -EINVAL, and the following diagram shows
how it happens:
CPU 0 CPU 1
btrfs_ioctl()
btrfs_ioctl_quota_ctl()
btrfs_quota_enable()
mutex_lock(fs_info->qgroup_ioctl_lock)
btrfs_ioctl()
create_subvol()
btrfs_qgroup_inherit()
-> save fs_info->quota_root
into quota_root
-> stores a NULL value
-> tries to lock the mutex
qgroup_ioctl_lock
-> blocks waiting for
the task at CPU0
-> sets BTRFS_FS_QUOTA_ENABLED in fs_info
-> sets quota_root in fs_info->quota_root
(non-NULL value)
mutex_unlock(fs_info->qgroup_ioctl_lock)
-> checks quota enabled
flag is set
-> returns -EINVAL because
fs_info->quota_root was
NULL before it acquired
the mutex
qgroup_ioctl_lock
-> ioctl returns -EINVAL
Returning -EINVAL to user space will be confusing if all the arguments
passed to the subvolume creation ioctl were valid.
Fix it by grabbing the value from fs_info->quota_root after acquiring
the mutex.
CC: stable(a)vger.kernel.org # 4.4+
Reviewed-by: Qu Wenruo <wqu(a)suse.com>
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 45868fd76209..f70825af6438 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -2659,7 +2659,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
int i;
u64 *i_qgroups;
struct btrfs_fs_info *fs_info = trans->fs_info;
- struct btrfs_root *quota_root = fs_info->quota_root;
+ struct btrfs_root *quota_root;
struct btrfs_qgroup *srcgroup;
struct btrfs_qgroup *dstgroup;
u32 level_size = 0;
@@ -2669,6 +2669,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags))
goto out;
+ quota_root = fs_info->quota_root;
if (!quota_root) {
ret = -EINVAL;
goto out;
Hi,
[This is an automated email]
This commit has been processed by the -stable helper bot and determined
to be a high probability candidate for -stable trees. (score: 46.9374)
The bot has tested the following trees: v4.16.1, v4.15.16, v4.14.33, v4.9.93, v4.4.127.
v4.16.1: Build OK!
v4.15.16: Build OK!
v4.14.33: Build OK!
v4.9.93: Failed to apply! Possible dependencies:
9648dc15772d ("recordmcount: arm: Implement make_nop")
v4.4.127: Failed to apply! Possible dependencies:
9648dc15772d ("recordmcount: arm: Implement make_nop")
Please let us know if you'd like to have this patch included in a stable tree.
--
Thanks,
Sasha
Commit '88ba95bedb79 ("backlight: pwm_bl: Compute brightness of LED
linearly to human eye")' allows the possibility to compute a default
brightness table when there isn't the brightness-levels property in the
DT. Unfortunately the changes made broke the pwm backlight for the
non-DT boards.
Usually, the non-DT boards don't pass the brightness levels via platform
data, instead, it sets the max_brightness in their platform data and the
driver calculates the level without a table. The offending patch assumed
that when there is no brightness levels table we should create one, but this
is clearly wrong for the non-DT case.
After this patch the code handles the DT and the non-DT case taking in
consideration also if max_brightness is set or not.
Fixes: 88ba95bedb79 ("backlight: pwm_bl: Compute brightness of LED linearly to human eye")
Cc: <stable(a)vger.kernel.org>
Reported-by: Robert Jarzmik <robert.jarzmik(a)free.fr>
Signed-off-by: Enric Balletbo i Serra <enric.balletbo(a)collabora.com>
Tested-by: Robert Jarzmik <robert.jarzmik(a)free.fr>
Acked-by: Daniel Thompson <daniel.thompson(a)linaro.org>
---
Changes in v3:
- Fixed some typos in commit message.
- Removed ' in Fixes tag.
Changes in v2:
- Rebase on top of mainline
- Add Tested-by and Acked-by tags.
drivers/video/backlight/pwm_bl.c | 41 +++++++++++++++++++++++++++-----
1 file changed, 35 insertions(+), 6 deletions(-)
diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
index 678b27063198..f9ef0673a083 100644
--- a/drivers/video/backlight/pwm_bl.c
+++ b/drivers/video/backlight/pwm_bl.c
@@ -562,7 +562,30 @@ static int pwm_backlight_probe(struct platform_device *pdev)
goto err_alloc;
}
- if (!data->levels) {
+ if (data->levels) {
+ /*
+ * For the DT case, only when brightness levels is defined
+ * data->levels is filled. For the non-DT case, data->levels
+ * can come from platform data, however is not usual.
+ */
+ for (i = 0; i <= data->max_brightness; i++) {
+ if (data->levels[i] > pb->scale)
+ pb->scale = data->levels[i];
+
+ pb->levels = data->levels;
+ }
+ } else if (!data->max_brightness) {
+ /*
+ * If no brightness levels are provided and max_brightness is
+ * not set, use the default brightness table. For the DT case,
+ * max_brightness is set to 0 when brightness levels is not
+ * specified. For the non-DT case, max_brightness is usually
+ * set to some value.
+ */
+
+ /* Get the PWM period (in nanoseconds) */
+ pwm_get_state(pb->pwm, &state);
+
ret = pwm_backlight_brightness_default(&pdev->dev, data,
state.period);
if (ret < 0) {
@@ -570,13 +593,19 @@ static int pwm_backlight_probe(struct platform_device *pdev)
"failed to setup default brightness table\n");
goto err_alloc;
}
- }
- for (i = 0; i <= data->max_brightness; i++) {
- if (data->levels[i] > pb->scale)
- pb->scale = data->levels[i];
+ for (i = 0; i <= data->max_brightness; i++) {
+ if (data->levels[i] > pb->scale)
+ pb->scale = data->levels[i];
- pb->levels = data->levels;
+ pb->levels = data->levels;
+ }
+ } else {
+ /*
+ * That only happens for the non-DT case, where platform data
+ * sets the max_brightness value.
+ */
+ pb->scale = data->max_brightness;
}
pb->lth_brightness = data->lth_brightness * (state.period / pb->scale);
--
2.19.1
This is the start of the stable review cycle for the 3.18.128 release.
There are 83 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Dec 1 14:01:23 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.128-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 3.18.128-rc1
Thomas Zimmermann <tzimmermann(a)suse.de>
drm/ast: Remove existing framebuffers before loading driver
WANG Cong <xiyou.wangcong(a)gmail.com>
af_unix: move unix_mknod() out of bindlock
Greg Kroah-Hartman <greg(a)kroah.com>
tty: wipe buffer if not echoing data
Linus Torvalds <torvalds(a)linux-foundation.org>
tty: wipe buffer.
Mauricio Faria de Oliveira <mauricfo(a)linux.vnet.ibm.com>
scsi: qla2xxx: do not queue commands when unloading
Subhash Jadavani <subhashj(a)codeaurora.org>
scsi: ufs: fix race between clock gating and devfreq scaling work
Venkat Gopalakrishnan <venkatg(a)codeaurora.org>
scsi: ufshcd: Fix race between clk scaling and ungate work
Yaniv Gardi <ygardi(a)codeaurora.org>
scsi: ufs: fix bugs related to null pointer access and array size
Johannes Thumshirn <jthumshirn(a)suse.de>
cw1200: Don't leak memory if krealloc failes
Ramses Ramírez <ramzeto(a)gmail.com>
Input: xpad - add support for Xbox1 PDP Camo series gamepad
Enno Boland <gottox(a)voidlinux.eu>
Input: xpad - fix GPD Win 2 controller name
Ethan Lee <flibitijibibo(a)gmail.com>
Input: xpad - add GPD Win 2 Controller USB IDs
Marcus Folkesson <marcus.folkesson(a)gmail.com>
Input: xpad - avoid using __set_bit() for capabilities
Leo Sperling <leosperling97(a)gmail.com>
Input: xpad - fix some coding style issues
Francis Therien <frtherien(a)gmail.com>
Input: xpad - add PDP device id 0x02a4
Mark Furneaux <mark(a)furneaux.ca>
Input: xpad - add support for PDP Xbox One controllers
Cameron Gutman <aicommander(a)gmail.com>
Input: xpad - validate USB endpoint type during probe
Cameron Gutman <aicommander(a)gmail.com>
Input: xpad - fix PowerA init quirk for some gamepad models
Arvind Yadav <arvind.yadav.cs(a)gmail.com>
Input: xpad - constify usb_device_id
Benjamin Valentin <benpicco(a)googlemail.com>
Input: xpad - sync supported devices with XBCD
Benjamin Valentin <benpicco(a)googlemail.com>
Input: xpad - sync supported devices with 360Controller
Benjamin Valentin <benpicco(a)googlemail.com>
Input: xpad - add USB IDs for Mad Catz Brawlstick and Razer Sabertooth
Benjamin Valentin <benpicco(a)googlemail.com>
Input: xpad - sync supported devices with xboxdrv
Benjamin Valentin <benpicco(a)googlemail.com>
Input: xpad - sort supported devices by USB ID
Cameron Gutman <aicommander(a)gmail.com>
Input: xpad - support some quirky Xbox One pads
Cameron Gutman <aicommander(a)gmail.com>
Input: xpad - restore LED state after device resume
Cameron Gutman <aicommander(a)gmail.com>
Input: xpad - fix stuck mode button on Xbox One S pad
Cameron Gutman <aicommander(a)gmail.com>
Input: xpad - don't depend on endpoint order
Pavel Rojtberg <rojtberg(a)gmail.com>
Input: xpad - simplify error condition in init_output
Daniel Tobias <dan.g.tob(a)gmail.com>
Input: xpad - move reporting xbox one home button to common function
Daniel Tobias <dan.g.tob(a)gmail.com>
Input: xpad - correctly sort vendor id's
Pavel Rojtberg <rojtberg(a)gmail.com>
Input: xpad - use correct product id for x360w controllers
Cameron Gutman <aicommander(a)gmail.com>
Input: xpad - fix Xbox One rumble stopping after 2.5 secs
Cameron Gutman <aicommander(a)gmail.com>
Input: xpad - add product ID for Xbox One S pad
Cameron Gutman <aicommander(a)gmail.com>
Input: xpad - power off wireless 360 controllers on suspend
Cameron Gutman <aicommander(a)gmail.com>
Input: xpad - fix oops when attaching an unknown Xbox One gamepad
Cameron Gutman <aicommander(a)gmail.com>
Input: xpad - fix rumble on Xbox One controllers with 2015 firmware
Pavel Rojtberg <rojtberg(a)gmail.com>
Input: xpad - xbox one elite controller support
Pavel Rojtberg <rojtberg(a)gmail.com>
Input: xpad - add more third-party controllers
Cameron Gutman <aicommander(a)gmail.com>
Input: xpad - prevent spurious input from wired Xbox 360 controllers
Pavel Rojtberg <rojtberg(a)gmail.com>
Input: xpad - move pending clear to the correct location
Silvan Jegen <s.jegen(a)gmail.com>
Input: xpad - add Mad Catz FightStick TE 2 VID/PID
Arnd Bergmann <arnd(a)arndb.de>
Input: xpad - remove unused function
Pavel Rojtberg <rojtberg(a)gmail.com>
Input: xpad - correct xbox one pad device name
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: xpad - use LED API when identifying wireless controllers
Pavel Rojtberg <rojtberg(a)gmail.com>
Input: xpad - workaround dead irq_out after suspend/ resume
Pierre-Loup A. Griffais <githubpublic(a)plagman.net>
Input: xpad - update Xbox One Force Feedback Support
Pavel Rojtberg <rojtberg(a)gmail.com>
Input: xpad - correctly handle concurrent LED and FF requests
Pierre-Loup A. Griffais <pgriffais(a)valvesoftware.com>
Input: xpad - handle "present" and "gone" correctly
Clement Calmels <clement.calmels(a)free.fr>
Input: xpad - remove spurious events of wireless xpad 360 controller
Pavel Rojtberg <rojtberg(a)gmail.com>
Input: xpad - fix clash of presence handling with LED setting
Pavel Rojtberg <rojtberg(a)gmail.com>
Input: xpad - query wireless controller state at init
Pierre-Loup A. Griffais <pgriffais(a)valvesoftware.com>
Input: xpad - move the input device creation to a new function
Pavel Rojtberg <rojtberg(a)gmail.com>
Input: xpad - x360w: report dpad as buttons and axes
Pavel Rojtberg <rojtberg(a)gmail.com>
Input: xpad - factor out URB submission in xpad_play_effect
Pavel Rojtberg <rojtberg(a)gmail.com>
Input: xpad - remove needless bulk out URB used for LED setup
Pavel Rojtberg <rojtberg(a)gmail.com>
Input: xpad - use ida() for finding the pad_nr
Pavel Rojtberg <rojtberg(a)gmail.com>
Input: xpad - clarify LED enumeration
Dario Scarpa <dario.scarpa(a)duskzone.it>
Input: xpad - fix Razer Atrox Arcade Stick button mapping
Erik Lundgren <eriklundgren93(a)gmail.com>
Input: xpad - add Covert Forces edition of the Xbox One controller
Pavel Rojtberg <rojtberg(a)gmail.com>
Input: xpad - re-send LED command on present event
Pierre-Loup A. Griffais <pgriffais(a)valvesoftware.com>
Input: xpad - set the LEDs properly on XBox Wireless controllers
Ming-ting Yao Wei <mwei(a)lxde.org>
Input: xpad - add rumble support for Xbox One controller
Aniroop Mathur <aniroop.mathur(a)gmail.com>
Input: initialize device counter variables with -1
Greg Hackmann <ghackmann(a)android.com>
arm64: remove no-op -p linker flag
Yufen Yu <yuyufen(a)huawei.com>
tmpfs: make lseek(SEEK_DATA/SEK_HOLE) return ENXIO with a negative offset
Satheesh Rajendran <sathnaga(a)linux.vnet.ibm.com>
powerpc/numa: Suppress "VPHN is not supported" messages
Prarit Bhargava <prarit(a)redhat.com>
kdb: Use strscpy with destination buffer size
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Fix a bogus get/put in generic_key_to_expire()
Russell King <rmk+kernel(a)armlinux.org.uk>
ARM: make lookup_processor_type() non-__init
Anson Huang <anson.huang(a)nxp.com>
cpufreq: imx6q: add return value check for voltage scale
Marc Kleine-Budde <mkl(a)pengutronix.de>
can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb
Marc Kleine-Budde <mkl(a)pengutronix.de>
can: dev: __can_get_echo_skb(): Don't crash the kernel if can_priv::echo_skb is accessed out of bounds
Marc Kleine-Budde <mkl(a)pengutronix.de>
can: dev: __can_get_echo_skb(): replace struct can_frame by canfd_frame to access frame length
Marc Kleine-Budde <mkl(a)pengutronix.de>
can: dev: can_get_echo_skb(): factor out non sending code to __can_get_echo_skb()
Y.C. Chen <yc_chen(a)aspeedtech.com>
drm/ast: change resolution may cause screen blurred
Y.C. Chen <yc_chen(a)aspeedtech.com>
drm/ast: fixed cursor may disappear sometimes
Eric Dumazet <edumazet(a)google.com>
llc: do not use sk_eat_skb()
Andrew Price <anprice(a)redhat.com>
gfs2: Don't leave s_fs_info pointing to freed memory in init_sbd
Xin Long <lucien.xin(a)gmail.com>
sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer
Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
bfs: add sanity check at bfs_fill_super()
Dominique Martinet <dominique.martinet(a)cea.fr>
v9fs_dir_readdir: fix double-free on p9stat_read error
Dennis Wassenberg <dennis.wassenberg(a)secunet.com>
usb: core: Fix hub port connection events lost
-------------
Diffstat:
Makefile | 4 +-
arch/arm/kernel/head-common.S | 6 +-
arch/arm64/Makefile | 2 +-
arch/powerpc/mm/numa.c | 2 +-
drivers/cpufreq/imx6q-cpufreq.c | 7 +-
drivers/gpu/drm/ast/ast_drv.c | 21 +
drivers/gpu/drm/ast/ast_mode.c | 3 +-
drivers/input/gameport/gameport.c | 4 +-
drivers/input/joystick/xpad.c | 1422 +++++++++++++++++++++++++++----------
drivers/input/misc/ims-pcu.c | 4 +-
drivers/input/serio/serio.c | 4 +-
drivers/input/serio/serio_raw.c | 4 +-
drivers/net/can/dev.c | 48 +-
drivers/net/wireless/cw1200/wsm.c | 16 +-
drivers/scsi/qla2xxx/qla_os.c | 5 +
drivers/scsi/ufs/ufs.h | 3 +-
drivers/scsi/ufs/ufshcd.c | 72 +-
drivers/tty/n_tty.c | 19 +-
drivers/tty/tty_buffer.c | 2 +
drivers/usb/core/hub.c | 4 +-
fs/9p/vfs_dir.c | 11 -
fs/bfs/inode.c | 9 +-
fs/gfs2/ops_fstype.c | 2 +-
include/linux/can/dev.h | 1 +
kernel/debug/kdb/kdb_io.c | 15 +-
kernel/debug/kdb/kdb_private.h | 2 +-
kernel/debug/kdb/kdb_support.c | 10 +-
mm/shmem.c | 4 +-
net/llc/af_llc.c | 11 +-
net/sctp/associola.c | 10 +-
net/sunrpc/auth_generic.c | 8 +-
net/unix/af_unix.c | 27 +-
32 files changed, 1293 insertions(+), 469 deletions(-)
I've backported a number of fixes for security issues affecting 4.14-
stable. All of these are already fixed in 4.19-stable.
Most of the issues involve filesystem validation, and I tested with the
reproducers where available.
For the BPF fix, I verified that the self-tests didn't regress and
temporarily added logging to check that the mitigation is applied when
needed.
Ben.
--
Ben Hutchings, Software Developer Codethink Ltd
https://www.codethink.co.uk/ Dale House, 35 Dale Street
Manchester, M1 2HF, United Kingdom
Hello,
Please pick the following commit from Linus' tree:
commit 910b0797fa9e8af09c44a3fa36cb310ba7a7218d
Author: Matthias Schwarzott <zzam(a)gentoo.org>
Date: Mon Oct 30 06:07:29 2017 -0400
media: em28xx: Fix use-after-free when disconnecting
into stable for 4.14, 4.9, and 4.4. I have verified it applies on
4.14.84, 4.9.141, and 4.4.165.
thanks,
Steve
Hi,
On 01-11-18 07:55, Mogens Jensen wrote:
> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> On Wednesday, October 31, 2018 9:29 AM, Hans de Goede <hdegoede(a)redhat.com> wrote:
>
>> Hi,
>>
>> On 31-10-18 07:02, Mogens Jensen wrote:
>>
>>> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
>>> On Tuesday, October 30, 2018 7:10 PM, Hans de Goede hdegoede(a)redhat.com wrote:
>>>
>>>> Hi,
>>>> On 30-10-18 19:56, Mogens Jensen wrote:
>>>>
>>>>> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
>>>>> On Tuesday, October 30, 2018 4:04 PM, Hans de Goede hdegoede(a)redhat.com wrote:
>>>>>
>>>>>> Hi,
>>>>>> On 30-10-18 16:46, Hans de Goede wrote:
>>>>>>
>>>>>>> Hi,
>>>>>>> On 30-10-18 16:04, Pierre-Louis Bossart wrote:
>>>>>>>
>>>>>>>> In addition I am not aware of any baytrail device using plt_clk_0, so moving a common machine driver such a cht_bsw_max98090_ti to use plt_clk0 only would break other devices (e.g. Rambi/Orco). Asking for both clocks to be on might work though,
>>>>>>>
>>>>>>> Ok, so we need to have a DMI based quirk for the Swanky and maybe also
>>>>>>> the clapper to use plt_clk_0 there. Asking for 2 clks if we only need
>>>>>>> one does not seem like a good plan.
>>>>>>
>>>>>> Dean, Mogens,
>>>>>> To write a proper patch for this I'm going to need DMI strings
>>>>>> from your devices.
>>>>>> Can you please run (as normal user):
>>>>>> grep . /sys/class/dmi/id/* 2> /dev/null
>>>>>> And reply with the output of this command?
>>>>>> I have attached the output from a coreboot seabios based clapper.
>>>>
>>>> Thank you.
>>>>
>>>>> Should I still test 0001-ASoC-intel-cht_bsw_max98090_ti-Use-pmc_plt_clk_0-ins.patch with SND_SOC_INTEL_CHT_BSW_MAX98090_TI_MACH and asoundrc from Dean? There seems to have been some development in the case since that request was made.
>>>>
>>>> Yes please test that, I expect that to also fix things for the
>>>> Clapper, but I need to have that confirmed before submitting a
>>>> patch upstream adding a quirk for the Clapper to use pmc_plt_clk_0
>>>> instead of pmc_plt_clk_3.
>>>> Regards,
>>>> Hans
>>>
>>> Unfortunately I only have access to longterm kernel 4.14 for building/running on this system, and 0001-ASoC-intel-cht_bsw_max98090_ti-Use-pmc_plt_clk_0-ins.patch does not patch against 4.14.78. Can a test patch for 4.14 be created?
>>
>> Can you run (as root):
>>
>> for i in /sys/kernel/debug/clk/pmc_plt_clk_?; do echo -n "$i: "; cat $i/clk_flags; echo; done
>>
>> When running a kernel with working audio?
>>
>> Then I can confirm that the Clapper is also using pmc_plt_clk_0, so that I can
>> fix this for the clapper for 4.18+
>>
>> I've just checked the 4.14 sources and in 4.14 the SND_SOC_INTEL_CHT_BSW_MAX98090_TI_MACH
>> driver does not support mclk control yet, so for the 4.14 kernel the only way to
>> fix this is to revert the 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL")
>> commit.
>>
>> Regards,
>>
>> Hans
>>
> Here is the output from the Clapper with 4.14.78 and working sound:
>
> /sys/kernel/debug/clk/pmc_plt_clk_0: 0x00000800
> /sys/kernel/debug/clk/pmc_plt_clk_1: 0x00000000
> /sys/kernel/debug/clk/pmc_plt_clk_2: 0x00000000
> /sys/kernel/debug/clk/pmc_plt_clk_3: 0x00000000
> /sys/kernel/debug/clk/pmc_plt_clk_4: 0x00000000
> /sys/kernel/debug/clk/pmc_plt_clk_5: 0x00000000
Ok, so your Clapper model indeed is also using clk 0 and not clk 3 as
expected. I've just submitted a patch upstream adding a quirk for this.
As for what the plan is with 4.14, I don't know. I believe that
reverting the commit causing the issue there is fine.
Regards,
Hans
Hello,
We ran automated tests on a recent commit from this kernel tree:
Kernel repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Commit: 96db90800c06 Linux 4.19.6
The results of these automated tests are provided below.
Overall result: PASSED
Patch merge: OK
Compile: OK
Kernel tests: OK
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Compile testing
---------------
We compiled the kernel for 2 architectures:
x86_64:
make options: make INSTALL_MOD_STRIP=1 -j56 targz-pkg
configuration: https://artifacts.cki-project.org/builds/x86_64/96db90800c06d3fe3fa08eb6222…
aarch64:
make options: make INSTALL_MOD_STRIP=1 -j56 targz-pkg
configuration: https://artifacts.cki-project.org/builds/aarch64/96db90800c06d3fe3fa08eb622…
Hardware testing
----------------
We booted each kernel and ran the following tests:
x86_64:
/distribution/kpkginstall (boot test)
LTP lite - release 20180515
xfstests: ext4
xfstests: xfs
/kernel/misc/amtu
arm64:
/distribution/kpkginstall (boot test)
LTP lite - release 20180515
xfstests: ext4
xfstests: xfs
/kernel/misc/amtu