The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 41fe242979e463d6ad251077ded01b825a330b7e Mon Sep 17 00:00:00 2001
From: Liu Xiang <liu.xiang6(a)zte.com.cn>
Date: Tue, 28 Aug 2018 22:32:57 +0800
Subject: [PATCH] mtd: spi-nor: fsl-quadspi: fix read error for flash size
larger than 16MB
If the size of spi-nor flash is larger than 16MB, the read_opcode
is set to SPINOR_OP_READ_1_1_4_4B, and fsl_qspi_get_seqid() will
return -EINVAL when cmd is SPINOR_OP_READ_1_1_4_4B. This can
cause read operation fail.
Fixes: e46ecda764dc ("mtd: spi-nor: Add Freescale QuadSPI driver")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Liu Xiang <liu.xiang6(a)zte.com.cn>
Signed-off-by: Boris Brezillon <boris.brezillon(a)bootlin.com>
diff --git a/drivers/mtd/spi-nor/fsl-quadspi.c b/drivers/mtd/spi-nor/fsl-quadspi.c
index d1ace310e7c1..1ff3430f82c8 100644
--- a/drivers/mtd/spi-nor/fsl-quadspi.c
+++ b/drivers/mtd/spi-nor/fsl-quadspi.c
@@ -478,6 +478,7 @@ static int fsl_qspi_get_seqid(struct fsl_qspi *q, u8 cmd)
{
switch (cmd) {
case SPINOR_OP_READ_1_1_4:
+ case SPINOR_OP_READ_1_1_4_4B:
return SEQID_READ;
case SPINOR_OP_WREN:
return SEQID_WREN;
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 6c925b333368cda4e1b0513b07f72316c0e7edd7 Mon Sep 17 00:00:00 2001
From: Ricardo Ribalda Delgado <ricardo.ribalda(a)gmail.com>
Date: Thu, 4 Oct 2018 15:01:04 +0200
Subject: [PATCH] mtd: maps: gpio-addr-flash: Fix ioremapped size
We should only iomap the area of the chip that is memory mapped.
Otherwise we could be mapping devices beyond the memory space or that
belong to other devices.
Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda(a)gmail.com>
Fixes: ebd71e3a4861 ("mtd: maps: gpio-addr-flash: fix warnings and make more portable")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Boris Brezillon <boris.brezillon(a)bootlin.com>
diff --git a/drivers/mtd/maps/gpio-addr-flash.c b/drivers/mtd/maps/gpio-addr-flash.c
index 17be47f72973..6de16e81994c 100644
--- a/drivers/mtd/maps/gpio-addr-flash.c
+++ b/drivers/mtd/maps/gpio-addr-flash.c
@@ -234,7 +234,7 @@ static int gpio_flash_probe(struct platform_device *pdev)
state->map.copy_to = gf_copy_to;
state->map.bankwidth = pdata->width;
state->map.size = state->win_size * (1 << state->gpio_count);
- state->map.virt = ioremap_nocache(memory->start, state->map.size);
+ state->map.virt = ioremap_nocache(memory->start, state->win_size);
if (!state->map.virt)
return -ENOMEM;
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 6c925b333368cda4e1b0513b07f72316c0e7edd7 Mon Sep 17 00:00:00 2001
From: Ricardo Ribalda Delgado <ricardo.ribalda(a)gmail.com>
Date: Thu, 4 Oct 2018 15:01:04 +0200
Subject: [PATCH] mtd: maps: gpio-addr-flash: Fix ioremapped size
We should only iomap the area of the chip that is memory mapped.
Otherwise we could be mapping devices beyond the memory space or that
belong to other devices.
Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda(a)gmail.com>
Fixes: ebd71e3a4861 ("mtd: maps: gpio-addr-flash: fix warnings and make more portable")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Boris Brezillon <boris.brezillon(a)bootlin.com>
diff --git a/drivers/mtd/maps/gpio-addr-flash.c b/drivers/mtd/maps/gpio-addr-flash.c
index 17be47f72973..6de16e81994c 100644
--- a/drivers/mtd/maps/gpio-addr-flash.c
+++ b/drivers/mtd/maps/gpio-addr-flash.c
@@ -234,7 +234,7 @@ static int gpio_flash_probe(struct platform_device *pdev)
state->map.copy_to = gf_copy_to;
state->map.bankwidth = pdata->width;
state->map.size = state->win_size * (1 << state->gpio_count);
- state->map.virt = ioremap_nocache(memory->start, state->map.size);
+ state->map.virt = ioremap_nocache(memory->start, state->win_size);
if (!state->map.virt)
return -ENOMEM;
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 6c925b333368cda4e1b0513b07f72316c0e7edd7 Mon Sep 17 00:00:00 2001
From: Ricardo Ribalda Delgado <ricardo.ribalda(a)gmail.com>
Date: Thu, 4 Oct 2018 15:01:04 +0200
Subject: [PATCH] mtd: maps: gpio-addr-flash: Fix ioremapped size
We should only iomap the area of the chip that is memory mapped.
Otherwise we could be mapping devices beyond the memory space or that
belong to other devices.
Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda(a)gmail.com>
Fixes: ebd71e3a4861 ("mtd: maps: gpio-addr-flash: fix warnings and make more portable")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Boris Brezillon <boris.brezillon(a)bootlin.com>
diff --git a/drivers/mtd/maps/gpio-addr-flash.c b/drivers/mtd/maps/gpio-addr-flash.c
index 17be47f72973..6de16e81994c 100644
--- a/drivers/mtd/maps/gpio-addr-flash.c
+++ b/drivers/mtd/maps/gpio-addr-flash.c
@@ -234,7 +234,7 @@ static int gpio_flash_probe(struct platform_device *pdev)
state->map.copy_to = gf_copy_to;
state->map.bankwidth = pdata->width;
state->map.size = state->win_size * (1 << state->gpio_count);
- state->map.virt = ioremap_nocache(memory->start, state->map.size);
+ state->map.virt = ioremap_nocache(memory->start, state->win_size);
if (!state->map.virt)
return -ENOMEM;
The patch below does not apply to the 4.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 6c925b333368cda4e1b0513b07f72316c0e7edd7 Mon Sep 17 00:00:00 2001
From: Ricardo Ribalda Delgado <ricardo.ribalda(a)gmail.com>
Date: Thu, 4 Oct 2018 15:01:04 +0200
Subject: [PATCH] mtd: maps: gpio-addr-flash: Fix ioremapped size
We should only iomap the area of the chip that is memory mapped.
Otherwise we could be mapping devices beyond the memory space or that
belong to other devices.
Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda(a)gmail.com>
Fixes: ebd71e3a4861 ("mtd: maps: gpio-addr-flash: fix warnings and make more portable")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Boris Brezillon <boris.brezillon(a)bootlin.com>
diff --git a/drivers/mtd/maps/gpio-addr-flash.c b/drivers/mtd/maps/gpio-addr-flash.c
index 17be47f72973..6de16e81994c 100644
--- a/drivers/mtd/maps/gpio-addr-flash.c
+++ b/drivers/mtd/maps/gpio-addr-flash.c
@@ -234,7 +234,7 @@ static int gpio_flash_probe(struct platform_device *pdev)
state->map.copy_to = gf_copy_to;
state->map.bankwidth = pdata->width;
state->map.size = state->win_size * (1 << state->gpio_count);
- state->map.virt = ioremap_nocache(memory->start, state->map.size);
+ state->map.virt = ioremap_nocache(memory->start, state->win_size);
if (!state->map.virt)
return -ENOMEM;
I'm announcing the release of the 4.18.18 kernel.
All users of the 4.18 kernel series must upgrade.
The updated 4.18.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.18.y
and can be browsed at the normal kernel.org git web browser:
http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/x86/include/asm/fpu/internal.h | 2
arch/x86/include/asm/percpu.h | 8 +-
arch/x86/kernel/pci-swiotlb.c | 2
arch/x86/kernel/setup.c | 2
arch/x86/kernel/time.c | 2
arch/x86/kernel/tsc.c | 6 -
drivers/clk/sunxi-ng/ccu-sun4i-a10.c | 10 ++
drivers/gpio/gpio-mxs.c | 4 -
drivers/gpu/drm/drm_edid.c | 5 +
drivers/gpu/drm/drm_fb_helper.c | 91 +++++++------------------
drivers/gpu/drm/sun4i/sun4i_dotclock.c | 12 +++
drivers/infiniband/core/ucm.c | 3
drivers/infiniband/core/ucma.c | 3
drivers/input/mouse/elan_i2c_core.c | 1
drivers/misc/eeprom/at24.c | 17 ++++
drivers/ptp/ptp_chardev.c | 4 +
drivers/usb/class/cdc-acm.c | 16 ++--
drivers/usb/core/devio.c | 4 -
drivers/usb/gadget/function/f_mass_storage.c | 3
drivers/usb/host/xhci-pci.c | 6 +
drivers/usb/roles/intel-xhci-usb-role-switch.c | 2
drivers/usb/usbip/vhci_hcd.c | 57 +++++++++++----
fs/cachefiles/namei.c | 2
fs/fscache/cookie.c | 31 ++------
fs/fscache/internal.h | 1
fs/fscache/main.c | 4 -
fs/ioctl.c | 2
fs/nfsd/vfs.c | 3
fs/overlayfs/copy_up.c | 2
fs/read_write.c | 17 ++++
include/drm/drm_edid.h | 6 -
include/linux/bpf_verifier.h | 3
include/linux/fs.h | 17 ----
kernel/bpf/verifier.c | 10 +-
kernel/sched/fair.c | 22 +++++-
kernel/sched/sched.h | 2
kernel/trace/trace_events_hist.c | 32 ++++++--
38 files changed, 243 insertions(+), 173 deletions(-)
Al Viro (1):
cachefiles: fix the race between cachefiles_bury_object() and rmdir(2)
Alan Chiang (1):
eeprom: at24: Add support for address-width property
Alan Stern (1):
USB: fix the usbfs flag sanitization for control transfers
Amir Goldstein (1):
vfs: swap names of {do,vfs}_clone_file_range()
Boris Brezillon (1):
drm/sun4i: Fix an ulong overflow in the dotclock driver
Chen-Yu Tsai (1):
clk: sunxi-ng: sun4i: Set VCO and PLL bias current to lowest setting
Christoph Hellwig (1):
x86/swiotlb: Enable swiotlb for > 4GiG RAM on 32-bit kernels
Clint Taylor (1):
drm/edid: VSDB yCBCr420 Deep Color mode bit definitions
Daniel Borkmann (1):
bpf: fix partial copy of map_ptr when dst is scalar
David Howells (1):
fscache: Fix incomplete initialisation of inline key space
Eric Sandeen (1):
fscache: Fix out of bound read in long cookie keys
Eugeniy Paltsev (1):
drm: fb-helper: Reject all pixel format changing requests
Greg Kroah-Hartman (1):
Linux 4.18.18
Gustavo A. R. Silva (4):
ptp: fix Spectre v1 vulnerability
RDMA/ucma: Fix Spectre v1 vulnerability
IB/ucm: Fix Spectre v1 vulnerability
usb: gadget: storage: Fix Spectre v1 vulnerability
Heikki Krogerus (1):
usb: xhci: pci: Enable Intel USB role mux on Apollo Lake platforms
Kai-Heng Feng (1):
drm/edid: Add 6 bpc quirk for BOE panel in HP Pavilion 15-n233sl
Linus Walleij (1):
gpio: mxs: Get rid of external API call
Masami Hiramatsu (2):
tracing: Fix synthetic event to accept unsigned modifier
tracing: Fix synthetic event to allow semicolon at end
Mikhail Nikiforov (1):
Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15IGM
Nathan Chancellor (1):
x86/time: Correct the attribute on jiffies' definition
Oliver Neukum (1):
cdc-acm: fix race between reset and control messaging
Peter Zijlstra (2):
x86/tsc: Force inlining of cyc2ns bits
x86/percpu: Fix this_cpu_read()
Phil Auld (1):
sched/fair: Fix throttle_list starvation with low CFS quota
Sebastian Andrzej Siewior (1):
x86/fpu: Fix i486 + no387 boot crash by only saving FPU registers on context switch if there is an FPU
Shuah Khan (Samsung OSG) (1):
usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control()
Tobias Herzog (2):
cdc-acm: do not reset notification buffer index upon urb unlinking
cdc-acm: correct counting of UART states in serial state notification
Wan Ahmad Zainie (1):
usb: roles: intel_xhci: Fix Unbalanced pm_runtime_enable
Zhimin Gu (1):
x86, hibernate: Fix nosave_regions setup for hibernation
This is the start of the stable review cycle for the 4.18.18 release.
There are 34 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Nov 10 21:51:21 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.18.18-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.18.18-rc1
Sebastian Andrzej Siewior <bigeasy(a)linutronix.de>
x86/fpu: Fix i486 + no387 boot crash by only saving FPU registers on context switch if there is an FPU
Christoph Hellwig <hch(a)lst.de>
x86/swiotlb: Enable swiotlb for > 4GiG RAM on 32-bit kernels
Nathan Chancellor <natechancellor(a)gmail.com>
x86/time: Correct the attribute on jiffies' definition
Peter Zijlstra <peterz(a)infradead.org>
x86/percpu: Fix this_cpu_read()
Zhimin Gu <kookoo.gu(a)intel.com>
x86, hibernate: Fix nosave_regions setup for hibernation
Peter Zijlstra <peterz(a)infradead.org>
x86/tsc: Force inlining of cyc2ns bits
Phil Auld <pauld(a)redhat.com>
sched/fair: Fix throttle_list starvation with low CFS quota
Boris Brezillon <boris.brezillon(a)bootlin.com>
drm/sun4i: Fix an ulong overflow in the dotclock driver
Mikhail Nikiforov <jackxviichaos(a)gmail.com>
Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15IGM
Masami Hiramatsu <mhiramat(a)kernel.org>
tracing: Fix synthetic event to allow semicolon at end
Masami Hiramatsu <mhiramat(a)kernel.org>
tracing: Fix synthetic event to accept unsigned modifier
Ming Lei <ming.lei(a)redhat.com>
block: don't deal with discard limit in blkdev_issue_discard()
Alan Stern <stern(a)rowland.harvard.edu>
USB: fix the usbfs flag sanitization for control transfers
Heikki Krogerus <heikki.krogerus(a)linux.intel.com>
usb: xhci: pci: Enable Intel USB role mux on Apollo Lake platforms
Wan Ahmad Zainie <wan.ahmad.zainie.wan.mohamad(a)intel.com>
usb: roles: intel_xhci: Fix Unbalanced pm_runtime_enable
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
usb: gadget: storage: Fix Spectre v1 vulnerability
Shuah Khan (Samsung OSG) <shuah(a)kernel.org>
usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control()
Oliver Neukum <oneukum(a)suse.com>
cdc-acm: fix race between reset and control messaging
Tobias Herzog <t-herzog(a)gmx.de>
cdc-acm: correct counting of UART states in serial state notification
Tobias Herzog <t-herzog(a)gmx.de>
cdc-acm: do not reset notification buffer index upon urb unlinking
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
IB/ucm: Fix Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
RDMA/ucma: Fix Spectre v1 vulnerability
Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
drm: fb-helper: Reject all pixel format changing requests
Clint Taylor <clinton.a.taylor(a)intel.com>
drm/edid: VSDB yCBCr420 Deep Color mode bit definitions
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
drm/edid: Add 6 bpc quirk for BOE panel in HP Pavilion 15-n233sl
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ptp: fix Spectre v1 vulnerability
Eric Sandeen <sandeen(a)redhat.com>
fscache: Fix out of bound read in long cookie keys
Al Viro <viro(a)zeniv.linux.org.uk>
cachefiles: fix the race between cachefiles_bury_object() and rmdir(2)
David Howells <dhowells(a)redhat.com>
fscache: Fix incomplete initialisation of inline key space
Chen-Yu Tsai <wens(a)csie.org>
clk: sunxi-ng: sun4i: Set VCO and PLL bias current to lowest setting
Linus Walleij <linus.walleij(a)linaro.org>
gpio: mxs: Get rid of external API call
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: fix partial copy of map_ptr when dst is scalar
Amir Goldstein <amir73il(a)gmail.com>
vfs: swap names of {do,vfs}_clone_file_range()
Alan Chiang <alanx.chiang(a)intel.com>
eeprom: at24: Add support for address-width property
-------------
Diffstat:
Makefile | 4 +-
arch/x86/include/asm/fpu/internal.h | 2 +-
arch/x86/include/asm/percpu.h | 8 +--
arch/x86/kernel/pci-swiotlb.c | 2 -
arch/x86/kernel/setup.c | 2 +-
arch/x86/kernel/time.c | 2 +-
arch/x86/kernel/tsc.c | 6 +-
block/blk-lib.c | 28 +-------
drivers/clk/sunxi-ng/ccu-sun4i-a10.c | 10 ++-
drivers/gpio/gpio-mxs.c | 4 +-
drivers/gpu/drm/drm_edid.c | 5 +-
drivers/gpu/drm/drm_fb_helper.c | 91 ++++++++------------------
drivers/gpu/drm/sun4i/sun4i_dotclock.c | 12 +++-
drivers/infiniband/core/ucm.c | 3 +
drivers/infiniband/core/ucma.c | 3 +
drivers/input/mouse/elan_i2c_core.c | 1 +
drivers/misc/eeprom/at24.c | 17 +++++
drivers/ptp/ptp_chardev.c | 4 ++
drivers/usb/class/cdc-acm.c | 16 ++---
drivers/usb/core/devio.c | 4 +-
drivers/usb/gadget/function/f_mass_storage.c | 3 +
drivers/usb/host/xhci-pci.c | 6 +-
drivers/usb/roles/intel-xhci-usb-role-switch.c | 2 +
drivers/usb/usbip/vhci_hcd.c | 57 +++++++++++-----
fs/cachefiles/namei.c | 2 +-
fs/fscache/cookie.c | 31 +++------
fs/fscache/internal.h | 1 -
fs/fscache/main.c | 4 +-
fs/ioctl.c | 2 +-
fs/nfsd/vfs.c | 3 +-
fs/overlayfs/copy_up.c | 2 +-
fs/read_write.c | 17 ++++-
include/drm/drm_edid.h | 6 +-
include/linux/bpf_verifier.h | 3 +
include/linux/fs.h | 17 +----
kernel/bpf/verifier.c | 10 +--
kernel/sched/fair.c | 22 ++++++-
kernel/sched/sched.h | 2 +
kernel/trace/trace_events_hist.c | 32 +++++++--
39 files changed, 246 insertions(+), 200 deletions(-)
This is the start of the stable review cycle for the 4.14.80 release.
There are 31 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Nov 10 21:51:09 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.80-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.80-rc1
Christophe Leroy <christophe.leroy(a)c-s.fr>
net: fs_enet: do not call phy_stop() in interrupts
Sebastian Andrzej Siewior <bigeasy(a)linutronix.de>
x86/fpu: Fix i486 + no387 boot crash by only saving FPU registers on context switch if there is an FPU
Nathan Chancellor <natechancellor(a)gmail.com>
x86/time: Correct the attribute on jiffies' definition
Peter Zijlstra <peterz(a)infradead.org>
x86/percpu: Fix this_cpu_read()
Zhimin Gu <kookoo.gu(a)intel.com>
x86, hibernate: Fix nosave_regions setup for hibernation
Peter Zijlstra <peterz(a)infradead.org>
x86/tsc: Force inlining of cyc2ns bits
Phil Auld <pauld(a)redhat.com>
sched/fair: Fix throttle_list starvation with low CFS quota
Mikhail Nikiforov <jackxviichaos(a)gmail.com>
Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15IGM
Alan Stern <stern(a)rowland.harvard.edu>
USB: fix the usbfs flag sanitization for control transfers
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
usb: gadget: storage: Fix Spectre v1 vulnerability
Shuah Khan (Samsung OSG) <shuah(a)kernel.org>
usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control()
Oliver Neukum <oneukum(a)suse.com>
cdc-acm: fix race between reset and control messaging
Tobias Herzog <t-herzog(a)gmx.de>
cdc-acm: correct counting of UART states in serial state notification
Tobias Herzog <t-herzog(a)gmx.de>
cdc-acm: do not reset notification buffer index upon urb unlinking
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
IB/ucm: Fix Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
RDMA/ucma: Fix Spectre v1 vulnerability
Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
drm: fb-helper: Reject all pixel format changing requests
Clint Taylor <clinton.a.taylor(a)intel.com>
drm/edid: VSDB yCBCr420 Deep Color mode bit definitions
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
drm/edid: Add 6 bpc quirk for BOE panel in HP Pavilion 15-n233sl
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ptp: fix Spectre v1 vulnerability
Al Viro <viro(a)zeniv.linux.org.uk>
cachefiles: fix the race between cachefiles_bury_object() and rmdir(2)
Brian Foster <bfoster(a)redhat.com>
xfs: truncate transaction does not modify the inobt
Linus Walleij <linus.walleij(a)linaro.org>
gpio: mxs: Get rid of external API call
Amir Goldstein <amir73il(a)gmail.com>
fsnotify: fix ignore mask logic in fsnotify()
Dmitry Osipenko <digetx(a)gmail.com>
clk: tegra: Add quirk for getting CDEV1/2 clocks on Tegra20
Sasha Levin <sashal(a)kernel.org>
Revert "ARM: tegra: Fix ULPI regression on Tegra20"
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: fix partial copy of map_ptr when dst is scalar
Johan Hovold <johan(a)kernel.org>
USB: serial: option: add two-endpoints device-id flag
Kristian Evensen <kristian.evensen(a)gmail.com>
USB: serial: option: improve Quectel EP06 detection
Amir Goldstein <amir73il(a)gmail.com>
vfs: swap names of {do,vfs}_clone_file_range()
Alan Chiang <alanx.chiang(a)intel.com>
eeprom: at24: Add support for address-width property
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/tegra20.dtsi | 2 +-
arch/x86/include/asm/fpu/internal.h | 2 +-
arch/x86/include/asm/percpu.h | 8 +-
arch/x86/kernel/setup.c | 2 +-
arch/x86/kernel/time.c | 2 +-
arch/x86/kernel/tsc.c | 6 +-
drivers/clk/tegra/clk-tegra114.c | 2 +-
drivers/clk/tegra/clk-tegra124.c | 2 +-
drivers/clk/tegra/clk-tegra20.c | 32 +++++++-
drivers/clk/tegra/clk-tegra210.c | 2 +-
drivers/clk/tegra/clk-tegra30.c | 2 +-
drivers/clk/tegra/clk.c | 5 +-
drivers/clk/tegra/clk.h | 2 +-
drivers/gpio/gpio-mxs.c | 4 +-
drivers/gpu/drm/drm_edid.c | 5 +-
drivers/gpu/drm/drm_fb_helper.c | 91 +++++++---------------
drivers/infiniband/core/ucm.c | 3 +
drivers/infiniband/core/ucma.c | 3 +
drivers/input/mouse/elan_i2c_core.c | 1 +
drivers/misc/eeprom/at24.c | 17 ++++
.../net/ethernet/freescale/fs_enet/fs_enet-main.c | 16 +++-
drivers/net/ethernet/freescale/fs_enet/fs_enet.h | 1 +
drivers/ptp/ptp_chardev.c | 4 +
drivers/usb/class/cdc-acm.c | 16 ++--
drivers/usb/core/devio.c | 4 +-
drivers/usb/gadget/function/f_mass_storage.c | 3 +
drivers/usb/serial/option.c | 15 +++-
drivers/usb/usbip/vhci_hcd.c | 57 ++++++++++----
fs/cachefiles/namei.c | 2 +-
fs/ioctl.c | 2 +-
fs/nfsd/vfs.c | 3 +-
fs/notify/fsnotify.c | 14 ++--
fs/overlayfs/copy_up.c | 2 +-
fs/read_write.c | 17 +++-
fs/xfs/libxfs/xfs_trans_resv.c | 9 +--
include/drm/drm_edid.h | 6 +-
include/linux/bpf_verifier.h | 3 +
include/linux/fs.h | 17 +---
kernel/bpf/verifier.c | 10 ++-
kernel/sched/fair.c | 22 +++++-
kernel/sched/sched.h | 2 +
42 files changed, 255 insertions(+), 167 deletions(-)
From: Changwei Ge <ge.changwei(a)h3c.com>
Somehow, file system metadata was corrupted, which causes
ocfs2_check_dir_entry() to fail in function ocfs2_dir_foreach_blk_el().
According to the original design intention, if above happens we should
skip the problematic block and continue to retrieve dir entry. But there
is obviouse misuse of brelse around related code.
After failure of ocfs2_check_dir_entry(), currunt code just moves to next
position and uses the problematic buffer head again and again during
which the problematic buffer head is released for multiple times. I
suppose, this a serious issue which is long-lived in ocfs2. This may
cause other file systems which is also used in a the same host insane.
So we should also consider about bakcporting this patch into
linux -stable.
Suggested-by: Changkuo Shi <shi.changkuo(a)h3c.com>
Cc: stable(a)vger.kernel.org
Signed-off-by: Changwei Ge <ge.changwei(a)h3c.com>
---
fs/ocfs2/dir.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
index b048d4f..c121abb 100644
--- a/fs/ocfs2/dir.c
+++ b/fs/ocfs2/dir.c
@@ -1897,8 +1897,7 @@ static int ocfs2_dir_foreach_blk_el(struct inode *inode,
/* On error, skip the f_pos to the
next block. */
ctx->pos = (ctx->pos | (sb->s_blocksize - 1)) + 1;
- brelse(bh);
- continue;
+ break;
}
if (le64_to_cpu(de->inode)) {
unsigned char d_type = DT_UNKNOWN;
--
2.7.4
Dear friend,
I am Abel Brent, a NATO soldier serving in Afghanistan. I and my
Comrades, we are seeking your assistance to help us
receive/invest our funds in your country in any lucrative
business. Please if this proposal is acceptable by you, kindly
respond back to me for more details.
Thanks and waiting to hear from you
Abel.
This is a note to let you know that I've just added the patch titled
serial: sh-sci: Fix could not remove dev_attr_rx_fifo_timeout
to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 641a41dbba217ee5bd26abe6be77f8cead9cd00e Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
Date: Tue, 30 Oct 2018 15:13:35 +0900
Subject: serial: sh-sci: Fix could not remove dev_attr_rx_fifo_timeout
This patch fixes an issue that the sci_remove() could not remove
dev_attr_rx_fifo_timeout because uart_remove_one_port() set
the port->port.type to PORT_UNKNOWN.
Reported-by: Hiromitsu Yamasaki <hiromitsu.yamasaki.ym(a)renesas.com>
Fixes: 5d23188a473d ("serial: sh-sci: make RX FIFO parameters tunable via sysfs")
Cc: <stable(a)vger.kernel.org> # v4.11+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
Reviewed-by: Ulrich Hecht <uli+renesas(a)fpond.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/serial/sh-sci.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index e19bfbba8a01..effba6ce0caa 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -3102,6 +3102,7 @@ static struct uart_driver sci_uart_driver = {
static int sci_remove(struct platform_device *dev)
{
struct sci_port *port = platform_get_drvdata(dev);
+ unsigned int type = port->port.type; /* uart_remove_... clears it */
sci_ports_in_use &= ~BIT(port->port.line);
uart_remove_one_port(&sci_uart_driver, &port->port);
@@ -3112,8 +3113,7 @@ static int sci_remove(struct platform_device *dev)
sysfs_remove_file(&dev->dev.kobj,
&dev_attr_rx_fifo_trigger.attr);
}
- if (port->port.type == PORT_SCIFA || port->port.type == PORT_SCIFB ||
- port->port.type == PORT_HSCIF) {
+ if (type == PORT_SCIFA || type == PORT_SCIFB || type == PORT_HSCIF) {
sysfs_remove_file(&dev->dev.kobj,
&dev_attr_rx_fifo_timeout.attr);
}
--
2.19.1
Unfortunately drm_dp_get_mst_branch_device which is called from both
drm_dp_mst_handle_down_rep and drm_dp_mst_handle_up_rep seem to rely
on that mgr->mst_primary is not NULL, which seem to be wrong as it can be
cleared with simultaneous mode set, if probing fails or in other case.
mgr->lock mutex doesn't protect against that as it might just get
assigned to NULL right before, not simultaneously.
There are currently bugs 107738, 108616 bugs which crash in
drm_dp_get_mst_branch_device, caused by this issue.
v2: Refactored the code, as it was nicely noticed.
Fixed Bugzilla bug numbers(second was 108616, but not 108816)
and added links.
Reviewed-by: Lyude Paul <lyude(a)redhat.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108616
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107738
Signed-off-by: Stanislav Lisovskiy <stanislav.lisovskiy(a)intel.com>
---
drivers/gpu/drm/drm_dp_mst_topology.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 5ff1d79b86c4..0e0df398222d 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1275,6 +1275,9 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_
mutex_lock(&mgr->lock);
mstb = mgr->mst_primary;
+ if (!mstb)
+ goto out;
+
for (i = 0; i < lct - 1; i++) {
int shift = (i % 2) ? 0 : 4;
int port_num = (rad[i / 2] >> shift) & 0xf;
--
2.17.1
This is a note to let you know that I've just added the patch titled
xhci: handle port status events for removed USB3 hcd
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 1245374e9b8340fc255fd51b2015173a83050d03 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman(a)linux.intel.com>
Date: Fri, 9 Nov 2018 17:21:18 +0200
Subject: xhci: handle port status events for removed USB3 hcd
At xhci removal the USB3 hcd (shared_hcd) is removed before the primary
USB2 hcd. Interrupts for port status changes may still occur for USB3
ports after the shared_hcd is freed, causing NULL pointer dereference.
Check if xhci->shared_hcd is still valid before handing USB3 port events
Cc: <stable(a)vger.kernel.org>
Reported-by: Peter Chen <peter.chen(a)nxp.com>
Tested-by: Jack Pham <jackp(a)codeaurora.org>
Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/host/xhci-ring.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index a8d92c90fb58..80d464ea5a9a 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1556,6 +1556,13 @@ static void handle_port_status(struct xhci_hcd *xhci,
goto cleanup;
}
+ /* We might get interrupts after shared_hcd is removed */
+ if (port->rhub == &xhci->usb3_rhub && xhci->shared_hcd == NULL) {
+ xhci_dbg(xhci, "ignore port event for removed USB3 hcd\n");
+ bogus_port_status = true;
+ goto cleanup;
+ }
+
hcd = port->rhub->hcd;
bus_state = &xhci->bus_state[hcd_index(hcd)];
hcd_portnum = port->hcd_portnum;
--
2.19.1
This is a note to let you know that I've just added the patch titled
xhci: Add check for invalid byte size error when UAS devices are
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From d9193efba84fe4c4aa22a569fade5e6ca971f8af Mon Sep 17 00:00:00 2001
From: Sandeep Singh <sandeep.singh(a)amd.com>
Date: Fri, 9 Nov 2018 17:21:19 +0200
Subject: xhci: Add check for invalid byte size error when UAS devices are
connected.
Observed "TRB completion code (27)" error which corresponds to Stopped -
Length Invalid error(xhci spec section 4.17.4) while connecting USB to
SATA bridge.
Looks like this case was not considered when the following patch[1] was
committed. Hence adding this new check which can prevent
the invalid byte size error.
[1] ade2e3a xhci: handle transfer events without TRB pointer
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Sandeep Singh <sandeep.singh(a)amd.com>
cc: Nehal Shah <Nehal-bakulchandra.Shah(a)amd.com>
cc: Shyam Sundar S K <Shyam-sundar.S-k(a)amd.com>
Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/host/xhci-ring.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 80d464ea5a9a..730a6ecd85fc 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2273,6 +2273,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
goto cleanup;
case COMP_RING_UNDERRUN:
case COMP_RING_OVERRUN:
+ case COMP_STOPPED_LENGTH_INVALID:
goto cleanup;
default:
xhci_err(xhci, "ERROR Transfer event for unknown stream ring slot %u ep %u\n",
--
2.19.1
This is a note to let you know that I've just added the patch titled
xhci: Fix leaking USB3 shared_hcd at xhci removal
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From f068090426ea8d72c408ebd42953a82a88e2282c Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman(a)linux.intel.com>
Date: Fri, 9 Nov 2018 17:21:17 +0200
Subject: xhci: Fix leaking USB3 shared_hcd at xhci removal
Ensure that the shared_hcd pointer is valid when calling usb_put_hcd()
The shared_hcd is removed and freed in xhci by first calling
usb_remove_hcd(xhci->shared_hcd), and later
usb_put_hcd(xhci->shared_hcd)
Afer commit fe190ed0d602 ("xhci: Do not halt the host until both HCD have
disconnected their devices.") the shared_hcd was never properly put as
xhci->shared_hcd was set to NULL before usb_put_hcd(xhci->shared_hcd) was
called.
shared_hcd (USB3) is removed before primary hcd (USB2).
While removing the primary hcd we might need to handle xhci interrupts
to cleanly remove last USB2 devices, therefore we need to set
xhci->shared_hcd to NULL before removing the primary hcd to let xhci
interrupt handler know shared_hcd is no longer available.
xhci-plat.c, xhci-histb.c and xhci-mtk first create both their hcd's before
adding them. so to keep the correct reverse removal order use a temporary
shared_hcd variable for them.
For more details see commit 4ac53087d6d4 ("usb: xhci: plat: Create both
HCDs before adding them")
Fixes: fe190ed0d602 ("xhci: Do not halt the host until both HCD have disconnected their devices.")
Cc: Joel Stanley <joel(a)jms.id.au>
Cc: Chunfeng Yun <chunfeng.yun(a)mediatek.com>
Cc: Thierry Reding <treding(a)nvidia.com>
Cc: Jianguo Sun <sunjianguo1(a)huawei.com>
Cc: <stable(a)vger.kernel.org>
Reported-by: Jack Pham <jackp(a)codeaurora.org>
Tested-by: Jack Pham <jackp(a)codeaurora.org>
Tested-by: Peter Chen <peter.chen(a)nxp.com>
Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/host/xhci-histb.c | 6 ++++--
drivers/usb/host/xhci-mtk.c | 6 ++++--
drivers/usb/host/xhci-pci.c | 1 +
drivers/usb/host/xhci-plat.c | 6 ++++--
drivers/usb/host/xhci-tegra.c | 1 +
drivers/usb/host/xhci.c | 2 --
6 files changed, 14 insertions(+), 8 deletions(-)
diff --git a/drivers/usb/host/xhci-histb.c b/drivers/usb/host/xhci-histb.c
index 27f00160332e..3c4abb5a1c3f 100644
--- a/drivers/usb/host/xhci-histb.c
+++ b/drivers/usb/host/xhci-histb.c
@@ -325,14 +325,16 @@ static int xhci_histb_remove(struct platform_device *dev)
struct xhci_hcd_histb *histb = platform_get_drvdata(dev);
struct usb_hcd *hcd = histb->hcd;
struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ struct usb_hcd *shared_hcd = xhci->shared_hcd;
xhci->xhc_state |= XHCI_STATE_REMOVING;
- usb_remove_hcd(xhci->shared_hcd);
+ usb_remove_hcd(shared_hcd);
+ xhci->shared_hcd = NULL;
device_wakeup_disable(&dev->dev);
usb_remove_hcd(hcd);
- usb_put_hcd(xhci->shared_hcd);
+ usb_put_hcd(shared_hcd);
xhci_histb_host_disable(histb);
usb_put_hcd(hcd);
diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
index 71d0d33c3286..60987c787e44 100644
--- a/drivers/usb/host/xhci-mtk.c
+++ b/drivers/usb/host/xhci-mtk.c
@@ -590,12 +590,14 @@ static int xhci_mtk_remove(struct platform_device *dev)
struct xhci_hcd_mtk *mtk = platform_get_drvdata(dev);
struct usb_hcd *hcd = mtk->hcd;
struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ struct usb_hcd *shared_hcd = xhci->shared_hcd;
- usb_remove_hcd(xhci->shared_hcd);
+ usb_remove_hcd(shared_hcd);
+ xhci->shared_hcd = NULL;
device_init_wakeup(&dev->dev, false);
usb_remove_hcd(hcd);
- usb_put_hcd(xhci->shared_hcd);
+ usb_put_hcd(shared_hcd);
usb_put_hcd(hcd);
xhci_mtk_sch_exit(mtk);
xhci_mtk_clks_disable(mtk);
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 01c57055c0c5..1fb448cd2667 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -380,6 +380,7 @@ static void xhci_pci_remove(struct pci_dev *dev)
if (xhci->shared_hcd) {
usb_remove_hcd(xhci->shared_hcd);
usb_put_hcd(xhci->shared_hcd);
+ xhci->shared_hcd = NULL;
}
/* Workaround for spurious wakeups at shutdown with HSW */
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 32b5574ad5c5..ef09cb06212f 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -362,14 +362,16 @@ static int xhci_plat_remove(struct platform_device *dev)
struct xhci_hcd *xhci = hcd_to_xhci(hcd);
struct clk *clk = xhci->clk;
struct clk *reg_clk = xhci->reg_clk;
+ struct usb_hcd *shared_hcd = xhci->shared_hcd;
xhci->xhc_state |= XHCI_STATE_REMOVING;
- usb_remove_hcd(xhci->shared_hcd);
+ usb_remove_hcd(shared_hcd);
+ xhci->shared_hcd = NULL;
usb_phy_shutdown(hcd->usb_phy);
usb_remove_hcd(hcd);
- usb_put_hcd(xhci->shared_hcd);
+ usb_put_hcd(shared_hcd);
clk_disable_unprepare(clk);
clk_disable_unprepare(reg_clk);
diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
index 6b5db344de30..938ff06c0349 100644
--- a/drivers/usb/host/xhci-tegra.c
+++ b/drivers/usb/host/xhci-tegra.c
@@ -1303,6 +1303,7 @@ static int tegra_xusb_remove(struct platform_device *pdev)
usb_remove_hcd(xhci->shared_hcd);
usb_put_hcd(xhci->shared_hcd);
+ xhci->shared_hcd = NULL;
usb_remove_hcd(tegra->hcd);
usb_put_hcd(tegra->hcd);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 0420eefa647a..c928dbbff881 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -719,8 +719,6 @@ static void xhci_stop(struct usb_hcd *hcd)
/* Only halt host and free memory after both hcds are removed */
if (!usb_hcd_is_primary_hcd(hcd)) {
- /* usb core will free this hcd shortly, unset pointer */
- xhci->shared_hcd = NULL;
mutex_unlock(&xhci->mutex);
return;
}
--
2.19.1