This is a note to let you know that I've just added the patch titled
arm64: Kconfig: select COMPAT_BINFMT_ELF only when BINFMT_ELF is set
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
arm64-kconfig-select-compat_binfmt_elf-only-when-binfmt_elf-is-set.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 2e449048a25eb75d48dff12882b93f26d130a1c6 Mon Sep 17 00:00:00 2001
From: Kefeng Wang <wangkefeng.wang(a)huawei.com>
Date: Thu, 26 Jan 2017 11:19:55 +0800
Subject: arm64: Kconfig: select COMPAT_BINFMT_ELF only when BINFMT_ELF is set
From: Kefeng Wang <wangkefeng.wang(a)huawei.com>
commit 2e449048a25eb75d48dff12882b93f26d130a1c6 upstream.
Fix warning:
"(COMPAT) selects COMPAT_BINFMT_ELF which has unmet direct dependencies
(COMPAT && BINFMT_ELF)"
Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com>
Signed-off-by: Will Deacon <will.deacon(a)arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
arch/arm64/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1007,7 +1007,7 @@ source "fs/Kconfig.binfmt"
config COMPAT
bool "Kernel support for 32-bit EL0"
depends on ARM64_4K_PAGES || EXPERT
- select COMPAT_BINFMT_ELF
+ select COMPAT_BINFMT_ELF if BINFMT_ELF
select HAVE_UID16
select OLD_SIGSUSPEND3
select COMPAT_OLD_SIGACTION
Patches currently in stable-queue which might be from wangkefeng.wang(a)huawei.com are
queue-4.9/arm64-kconfig-select-compat_binfmt_elf-only-when-binfmt_elf-is-set.patch
This is a note to let you know that I've just added the patch titled
ALSA: hda/ca0132 - fix possible NULL pointer use
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
alsa-hda-ca0132-fix-possible-null-pointer-use.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 46a049dae771b95e77ac6c823330f4a60f600236 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd(a)arndb.de>
Date: Wed, 11 Jan 2017 14:39:44 +0100
Subject: ALSA: hda/ca0132 - fix possible NULL pointer use
From: Arnd Bergmann <arnd(a)arndb.de>
commit 46a049dae771b95e77ac6c823330f4a60f600236 upstream.
gcc-7 caught what it considers a NULL pointer dereference:
sound/pci/hda/patch_ca0132.c: In function 'dspio_scp.constprop':
sound/pci/hda/patch_ca0132.c:1487:4: error: argument 1 null where non-null expected [-Werror=nonnull]
This is plausible from looking at the function, as we compare 'reply'
to NULL earlier in it. I have not tried to analyze if there are constraints
that make it impossible to hit the bug, but adding another NULL check in
the end kills the warning and makes the function more robust.
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
Signed-off-by: Takashi Iwai <tiwai(a)suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
sound/pci/hda/patch_ca0132.c | 3 +++
1 file changed, 3 insertions(+)
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -1482,6 +1482,9 @@ static int dspio_scp(struct hda_codec *c
} else if (ret_size != reply_data_size) {
codec_dbg(codec, "RetLen and HdrLen .NE.\n");
return -EINVAL;
+ } else if (!reply) {
+ codec_dbg(codec, "NULL reply\n");
+ return -EINVAL;
} else {
*reply_len = ret_size*sizeof(unsigned int);
memcpy(reply, scp_reply.data, *reply_len);
Patches currently in stable-queue which might be from arnd(a)arndb.de are
queue-4.9/kasan-rework-kconfig-settings.patch
queue-4.9/tw5864-use-dev_warn-instead-of-warn-to-shut-up-warning.patch
queue-4.9/perf-x86-shut-up-false-positive-wmaybe-uninitialized-warning.patch
queue-4.9/go7007-add-media_camera_support-dependency.patch
queue-4.9/scsi-advansys-fix-build-warning-for-pci-n.patch
queue-4.9/video-fbdev-via-remove-possibly-unused-variables.patch
queue-4.9/drm-exynos-mark-pm-functions-as-__maybe_unused.patch
queue-4.9/binfmt_elf-compat-avoid-unused-function-warning.patch
queue-4.9/idle-i7300-add-pci-dependency.patch
queue-4.9/cw1200-fix-bogus-maybe-uninitialized-warning.patch
queue-4.9/x86-build-silence-the-build-with-make-s.patch
queue-4.9/gpio-xgene-mark-pm-functions-as-__maybe_unused.patch
queue-4.9/kvm-add-x86_local_apic-dependency.patch
queue-4.9/reiserfs-avoid-a-wmaybe-uninitialized-warning.patch
queue-4.9/scsi-advansys-fix-uninitialized-data-access.patch
queue-4.9/drm-i915-fix-intel_backlight_device_register-declaration.patch
queue-4.9/spi-bcm-qspi-shut-up-warning-about-cfi-header-inclusion.patch
queue-4.9/asoc-ux500-add-module_license-tag.patch
queue-4.9/x86-microcode-amd-change-load_microcode_amd-s-param-to-bool-to-fix-preemptibility-bug.patch
queue-4.9/video-fbdev-mmp-add-module_license.patch
queue-4.9/usb-phy-msm-add-regulator-dependency.patch
queue-4.9/arm64-dts-add-cooling-cells-to-cpu-nodes.patch
queue-4.9/vmxnet3-prevent-building-with-64k-pages.patch
queue-4.9/x86-platform-add-pci-dependency-for-punit_atom_debug.patch
queue-4.9/alsa-hda-ca0132-fix-possible-null-pointer-use.patch
queue-4.9/thermal-fix-intel_soc_dts_iosf_core-dependencies.patch
queue-4.9/arm64-define-bug-instruction-without-config_bug.patch
queue-4.9/arm64-sunxi-always-enable-reset-controller.patch
queue-4.9/tc358743-fix-register-i2c_rd-wr-functions.patch
queue-4.9/security-keys-big_key-requires-config_crypto.patch
queue-4.9/drm-i915-hide-unused-intel_panel_set_backlight-function.patch
queue-4.9/x86-fpu-math-emu-fix-possible-uninitialized-variable-use.patch
queue-4.9/arm-8743-1-bl_switcher-add-module_license-tag.patch
queue-4.9/em28xx-only-use-mt9v011-if-camera-support-is-enabled.patch
queue-4.9/arm64-fix-warning-about-swapper_pg_dir-overflow.patch
queue-4.9/shmem-avoid-maybe-uninitialized-warning.patch
queue-4.9/input-tca8418_keypad-hide-gcc-4.9-wmaybe-uninitialized-warning.patch
queue-4.9/drm-nouveau-hide-gcc-4.9-wmaybe-uninitialized.patch
queue-4.9/x86-add-multiuser-dependency-for-kvm.patch
queue-4.9/isdn-eicon-reduce-stack-size-of-sig_ind-function.patch
This is a note to let you know that I've just added the patch titled
xfrm: Fix xfrm_input() to verify state is valid when (encap_type < 0)
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
xfrm-fix-xfrm_input-to-verify-state-is-valid-when-encap_type-0.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Fri Feb 23 11:45:09 CET 2018
From: Aviv Heller <avivh(a)mellanox.com>
Date: Tue, 28 Nov 2017 19:55:40 +0200
Subject: xfrm: Fix xfrm_input() to verify state is valid when (encap_type < 0)
From: Aviv Heller <avivh(a)mellanox.com>
[ Upstream commit 4ce3dbe397d7b6b15f272ae757c78c35e9e4b61d ]
Code path when (encap_type < 0) does not verify the state is valid
before progressing.
This will result in a crash if, for instance, x->km.state ==
XFRM_STATE_ACQ.
Fixes: 7785bba299a8 ("esp: Add a software GRO codepath")
Signed-off-by: Aviv Heller <avivh(a)mellanox.com>
Signed-off-by: Yevgeny Kliteynik <kliteyn(a)mellanox.com>
Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
net/xfrm/xfrm_input.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -207,7 +207,7 @@ int xfrm_input(struct sk_buff *skb, int
xfrm_address_t *daddr;
struct xfrm_mode *inner_mode;
u32 mark = skb->mark;
- unsigned int family;
+ unsigned int family = AF_UNSPEC;
int decaps = 0;
int async = 0;
bool xfrm_gro = false;
@@ -216,6 +216,16 @@ int xfrm_input(struct sk_buff *skb, int
if (encap_type < 0) {
x = xfrm_input_state(skb);
+
+ if (unlikely(x->km.state != XFRM_STATE_VALID)) {
+ if (x->km.state == XFRM_STATE_ACQ)
+ XFRM_INC_STATS(net, LINUX_MIB_XFRMACQUIREERROR);
+ else
+ XFRM_INC_STATS(net,
+ LINUX_MIB_XFRMINSTATEINVALID);
+ goto drop;
+ }
+
family = x->outer_mode->afinfo->family;
/* An encap_type of -1 indicates async resumption. */
Patches currently in stable-queue which might be from avivh(a)mellanox.com are
queue-4.14/xfrm-fix-xfrm_input-to-verify-state-is-valid-when-encap_type-0.patch
This is a note to let you know that I've just added the patch titled
xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies.
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
xfrm-fix-stack-out-of-bounds-with-misconfigured-transport-mode-policies.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Fri Feb 23 11:45:09 CET 2018
From: Steffen Klassert <steffen.klassert(a)secunet.com>
Date: Fri, 8 Dec 2017 08:07:25 +0100
Subject: xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies.
From: Steffen Klassert <steffen.klassert(a)secunet.com>
[ Upstream commit 732706afe1cc46ef48493b3d2b69c98f36314ae4 ]
On policies with a transport mode template, we pass the addresses
from the flowi to xfrm_state_find(), assuming that the IP addresses
(and address family) don't change during transformation.
Unfortunately our policy template validation is not strict enough.
It is possible to configure policies with transport mode template
where the address family of the template does not match the selectors
address family. This lead to stack-out-of-bound reads because
we compare arddesses of the wrong family. Fix this by refusing
such a configuration, address family can not change on transport
mode.
We use the assumption that, on transport mode, the first templates
address family must match the address family of the policy selector.
Subsequent transport mode templates must mach the address family of
the previous template.
Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
net/xfrm/xfrm_user.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1417,11 +1417,14 @@ static void copy_templates(struct xfrm_p
static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
{
+ u16 prev_family;
int i;
if (nr > XFRM_MAX_DEPTH)
return -EINVAL;
+ prev_family = family;
+
for (i = 0; i < nr; i++) {
/* We never validated the ut->family value, so many
* applications simply leave it at zero. The check was
@@ -1433,6 +1436,12 @@ static int validate_tmpl(int nr, struct
if (!ut[i].family)
ut[i].family = family;
+ if ((ut[i].mode == XFRM_MODE_TRANSPORT) &&
+ (ut[i].family != prev_family))
+ return -EINVAL;
+
+ prev_family = ut[i].family;
+
switch (ut[i].family) {
case AF_INET:
break;
Patches currently in stable-queue which might be from steffen.klassert(a)secunet.com are
queue-4.14/xfrm-fix-stack-out-of-bounds-read-on-socket-policy-lookup.patch
queue-4.14/xfrm-skip-policies-marked-as-dead-while-rehashing.patch
queue-4.14/xfrm-fix-stack-out-of-bounds-with-misconfigured-transport-mode-policies.patch
queue-4.14/xfrm-fix-xfrm_input-to-verify-state-is-valid-when-encap_type-0.patch
queue-4.14/xfrm-fix-rcu-usage-in-xfrm_get_type_offload.patch
queue-4.14/esp-fix-gro-when-the-headers-not-fully-in-the-linear-part-of-the-skb.patch
queue-4.14/xfrm-don-t-call-xfrm_policy_cache_flush-while-holding-spinlock.patch
queue-4.14/xfrm-check-id-proto-in-validate_tmpl.patch
This is a note to let you know that I've just added the patch titled
x86/mm/kmmio: Fix mmiotrace for page unaligned addresses
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
x86-mm-kmmio-fix-mmiotrace-for-page-unaligned-addresses.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Fri Feb 23 11:45:09 CET 2018
From: Karol Herbst <kherbst(a)redhat.com>
Date: Mon, 27 Nov 2017 08:51:39 +0100
Subject: x86/mm/kmmio: Fix mmiotrace for page unaligned addresses
From: Karol Herbst <kherbst(a)redhat.com>
[ Upstream commit 6d60ce384d1d5ca32b595244db4077a419acc687 ]
If something calls ioremap() with an address not aligned to PAGE_SIZE, the
returned address might be not aligned as well. This led to a probe
registered on exactly the returned address, but the entire page was armed
for mmiotracing.
On calling iounmap() the address passed to unregister_kmmio_probe() was
PAGE_SIZE aligned by the caller leading to a complete freeze of the
machine.
We should always page align addresses while (un)registerung mappings,
because the mmiotracer works on top of pages, not mappings. We still keep
track of the probes based on their real addresses and lengths though,
because the mmiotrace still needs to know what are mapped memory regions.
Also move the call to mmiotrace_iounmap() prior page aligning the address,
so that all probes are unregistered properly, otherwise the kernel ends up
failing memory allocations randomly after disabling the mmiotracer.
Tested-by: Lyude <lyude(a)redhat.com>
Signed-off-by: Karol Herbst <kherbst(a)redhat.com>
Acked-by: Pekka Paalanen <ppaalanen(a)gmail.com>
Cc: Linus Torvalds <torvalds(a)linux-foundation.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Steven Rostedt <rostedt(a)goodmis.org>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: nouveau(a)lists.freedesktop.org
Link: http://lkml.kernel.org/r/20171127075139.4928-1-kherbst@redhat.com
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
arch/x86/mm/ioremap.c | 4 ++--
arch/x86/mm/kmmio.c | 12 +++++++-----
2 files changed, 9 insertions(+), 7 deletions(-)
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -349,11 +349,11 @@ void iounmap(volatile void __iomem *addr
return;
}
+ mmiotrace_iounmap(addr);
+
addr = (volatile void __iomem *)
(PAGE_MASK & (unsigned long __force)addr);
- mmiotrace_iounmap(addr);
-
/* Use the vm area unlocked, assuming the caller
ensures there isn't another iounmap for the same address
in parallel. Reuse of the virtual address is prevented by
--- a/arch/x86/mm/kmmio.c
+++ b/arch/x86/mm/kmmio.c
@@ -435,17 +435,18 @@ int register_kmmio_probe(struct kmmio_pr
unsigned long flags;
int ret = 0;
unsigned long size = 0;
+ unsigned long addr = p->addr & PAGE_MASK;
const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK);
unsigned int l;
pte_t *pte;
spin_lock_irqsave(&kmmio_lock, flags);
- if (get_kmmio_probe(p->addr)) {
+ if (get_kmmio_probe(addr)) {
ret = -EEXIST;
goto out;
}
- pte = lookup_address(p->addr, &l);
+ pte = lookup_address(addr, &l);
if (!pte) {
ret = -EINVAL;
goto out;
@@ -454,7 +455,7 @@ int register_kmmio_probe(struct kmmio_pr
kmmio_count++;
list_add_rcu(&p->list, &kmmio_probes);
while (size < size_lim) {
- if (add_kmmio_fault_page(p->addr + size))
+ if (add_kmmio_fault_page(addr + size))
pr_err("Unable to set page fault.\n");
size += page_level_size(l);
}
@@ -528,19 +529,20 @@ void unregister_kmmio_probe(struct kmmio
{
unsigned long flags;
unsigned long size = 0;
+ unsigned long addr = p->addr & PAGE_MASK;
const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK);
struct kmmio_fault_page *release_list = NULL;
struct kmmio_delayed_release *drelease;
unsigned int l;
pte_t *pte;
- pte = lookup_address(p->addr, &l);
+ pte = lookup_address(addr, &l);
if (!pte)
return;
spin_lock_irqsave(&kmmio_lock, flags);
while (size < size_lim) {
- release_kmmio_fault_page(p->addr + size, &release_list);
+ release_kmmio_fault_page(addr + size, &release_list);
size += page_level_size(l);
}
list_del_rcu(&p->list);
Patches currently in stable-queue which might be from kherbst(a)redhat.com are
queue-4.14/x86-mm-kmmio-fix-mmiotrace-for-page-unaligned-addresses.patch
This is a note to let you know that I've just added the patch titled
xen: XEN_ACPI_PROCESSOR is Dom0-only
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
xen-xen_acpi_processor-is-dom0-only.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Fri Feb 23 11:45:09 CET 2018
From: Jan Beulich <JBeulich(a)suse.com>
Date: Tue, 12 Dec 2017 03:18:11 -0700
Subject: xen: XEN_ACPI_PROCESSOR is Dom0-only
From: Jan Beulich <JBeulich(a)suse.com>
[ Upstream commit c4f9d9cb2c29ff04c6b4bb09b72802d8aedfc7cb ]
Add a respective dependency.
Signed-off-by: Jan Beulich <jbeulich(a)suse.com>
Reviewed-by: Juergen Gross <jgross(a)suse.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky(a)oracle.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/xen/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -258,7 +258,7 @@ config XEN_ACPI_HOTPLUG_CPU
config XEN_ACPI_PROCESSOR
tristate "Xen ACPI processor"
- depends on XEN && X86 && ACPI_PROCESSOR && CPU_FREQ
+ depends on XEN && XEN_DOM0 && X86 && ACPI_PROCESSOR && CPU_FREQ
default m
help
This ACPI processor uploads Power Management information to the Xen
Patches currently in stable-queue which might be from JBeulich(a)suse.com are
queue-4.14/xen-xen_acpi_processor-is-dom0-only.patch
This is a note to let you know that I've just added the patch titled
VSOCK: fix outdated sk_state value in hvs_release()
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
vsock-fix-outdated-sk_state-value-in-hvs_release.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Fri Feb 23 11:45:09 CET 2018
From: Stefan Hajnoczi <stefanha(a)redhat.com>
Date: Tue, 5 Dec 2017 11:31:14 +0000
Subject: VSOCK: fix outdated sk_state value in hvs_release()
From: Stefan Hajnoczi <stefanha(a)redhat.com>
[ Upstream commit c9d3fe9da094a9a7a3d3cd365b334b822e05f5e8 ]
Since commit 3b4477d2dcf2709d0be89e2a8dced3d0f4a017f2 ("VSOCK: use TCP
state constants for sk_state") VSOCK has used TCP_* constants for
sk_state.
Commit b4562ca7925a3bedada87a3dd072dd5bad043288 ("hv_sock: add locking
in the open/close/release code paths") reintroduced the SS_DISCONNECTING
constant.
This patch replaces the old SS_DISCONNECTING with the new TCP_CLOSING
constant.
CC: Dexuan Cui <decui(a)microsoft.com>
CC: Cathy Avery <cavery(a)redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha(a)redhat.com>
Reviewed-by: Jorgen Hansen <jhansen(a)vmware.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
net/vmw_vsock/hyperv_transport.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/vmw_vsock/hyperv_transport.c
+++ b/net/vmw_vsock/hyperv_transport.c
@@ -488,7 +488,7 @@ static void hvs_release(struct vsock_soc
lock_sock(sk);
- sk->sk_state = SS_DISCONNECTING;
+ sk->sk_state = TCP_CLOSING;
vsock_remove_sock(vsk);
release_sock(sk);
Patches currently in stable-queue which might be from stefanha(a)redhat.com are
queue-4.14/vsock-fix-outdated-sk_state-value-in-hvs_release.patch
This is a note to let you know that I've just added the patch titled
virtio_net: fix return value check in receive_mergeable()
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
virtio_net-fix-return-value-check-in-receive_mergeable.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Fri Feb 23 11:45:09 CET 2018
From: Yunjian Wang <wangyunjian(a)huawei.com>
Date: Mon, 4 Dec 2017 14:02:19 +0800
Subject: virtio_net: fix return value check in receive_mergeable()
From: Yunjian Wang <wangyunjian(a)huawei.com>
[ Upstream commit 03e9f8a05bce7330bcd9c5cc54c8e42d0fcbf993 ]
The function virtqueue_get_buf_ctx() could return NULL, the return
value 'buf' need to be checked with NULL, not value 'ctx'.
Signed-off-by: Yunjian Wang <wangyunjian(a)huawei.com>
Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/net/virtio_net.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -714,7 +714,7 @@ static struct sk_buff *receive_mergeable
int num_skb_frags;
buf = virtqueue_get_buf_ctx(rq->vq, &len, &ctx);
- if (unlikely(!ctx)) {
+ if (unlikely(!buf)) {
pr_debug("%s: rx error: %d buffers out of %d missing\n",
dev->name, num_buf,
virtio16_to_cpu(vi->vdev,
Patches currently in stable-queue which might be from wangyunjian(a)huawei.com are
queue-4.14/virtio_net-fix-return-value-check-in-receive_mergeable.patch
This is a note to let you know that I've just added the patch titled
usb: dwc3: of-simple: fix missing clk_disable_unprepare
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
usb-dwc3-of-simple-fix-missing-clk_disable_unprepare.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Fri Feb 23 11:45:09 CET 2018
From: Andreas Platschek <andreas.platschek(a)opentech.at>
Date: Thu, 7 Dec 2017 11:32:20 +0100
Subject: usb: dwc3: of-simple: fix missing clk_disable_unprepare
From: Andreas Platschek <andreas.platschek(a)opentech.at>
[ Upstream commit ded600ea9fb51a495d2fcd21e90351df876488e8 ]
If of_clk_get() fails, the clean-up of already initialized clocks should be
the same as when clk_prepare_enable() fails. Thus a clk_disable_unprepare()
for each clock should be called before the clk_put().
Found by Linux Driver Verification project (linuxtesting.org).
Fixes: 16adc674d0d6 ("usb: dwc3: ep0: fix setup_packet_pending initialization")
Signed-off-by: Andreas Platschek <andreas.platschek(a)opentech.at>
Signed-off-by: Felipe Balbi <felipe.balbi(a)linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/dwc3/dwc3-of-simple.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -57,8 +57,10 @@ static int dwc3_of_simple_clk_init(struc
clk = of_clk_get(np, i);
if (IS_ERR(clk)) {
- while (--i >= 0)
+ while (--i >= 0) {
+ clk_disable_unprepare(simple->clks[i]);
clk_put(simple->clks[i]);
+ }
return PTR_ERR(clk);
}
Patches currently in stable-queue which might be from andreas.platschek(a)opentech.at are
queue-4.14/usb-dwc3-of-simple-fix-missing-clk_disable_unprepare.patch
This is a note to let you know that I've just added the patch titled
trace/xdp: fix compile warning: 'struct bpf_map' declared inside parameter list
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
trace-xdp-fix-compile-warning-struct-bpf_map-declared-inside-parameter-list.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Fri Feb 23 11:45:09 CET 2018
From: Xie XiuQi <xiexiuqi(a)huawei.com>
Date: Thu, 30 Nov 2017 09:41:29 +0800
Subject: trace/xdp: fix compile warning: 'struct bpf_map' declared inside parameter list
From: Xie XiuQi <xiexiuqi(a)huawei.com>
[ Upstream commit 23721a755f98ac846897a013c92cccb281c1bcc8 ]
We meet this compile warning, which caused by missing bpf.h in xdp.h.
In file included from ./include/trace/events/xdp.h:10:0,
from ./include/linux/bpf_trace.h:6,
from drivers/net/ethernet/intel/i40e/i40e_txrx.c:29:
./include/trace/events/xdp.h:93:17: warning: ‘struct bpf_map’ declared inside parameter list will not be visible outside of this definition or declaration
const struct bpf_map *map, u32 map_index),
^
./include/linux/tracepoint.h:187:34: note: in definition of macro ‘__DECLARE_TRACE’
static inline void trace_##name(proto) \
^~~~~
./include/linux/tracepoint.h:352:24: note: in expansion of macro ‘PARAMS’
__DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), \
^~~~~~
./include/linux/tracepoint.h:477:2: note: in expansion of macro ‘DECLARE_TRACE’
DECLARE_TRACE(name, PARAMS(proto), PARAMS(args))
^~~~~~~~~~~~~
./include/linux/tracepoint.h:477:22: note: in expansion of macro ‘PARAMS’
DECLARE_TRACE(name, PARAMS(proto), PARAMS(args))
^~~~~~
./include/trace/events/xdp.h:89:1: note: in expansion of macro ‘DEFINE_EVENT’
DEFINE_EVENT(xdp_redirect_template, xdp_redirect,
^~~~~~~~~~~~
./include/trace/events/xdp.h:90:2: note: in expansion of macro ‘TP_PROTO’
TP_PROTO(const struct net_device *dev,
^~~~~~~~
./include/trace/events/xdp.h:93:17: warning: ‘struct bpf_map’ declared inside parameter list will not be visible outside of this definition or declaration
const struct bpf_map *map, u32 map_index),
^
./include/linux/tracepoint.h:203:38: note: in definition of macro ‘__DECLARE_TRACE’
register_trace_##name(void (*probe)(data_proto), void *data) \
^~~~~~~~~~
./include/linux/tracepoint.h:354:4: note: in expansion of macro ‘PARAMS’
PARAMS(void *__data, proto), \
^~~~~~
Reported-by: Huang Daode <huangdaode(a)hisilicon.com>
Cc: Hanjun Guo <guohanjun(a)huawei.com>
Fixes: 8d3b778ff544 ("xdp: tracepoint xdp_redirect also need a map argument")
Signed-off-by: Xie XiuQi <xiexiuqi(a)huawei.com>
Acked-by: Jesper Dangaard Brouer <brouer(a)redhat.com>
Acked-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
include/trace/events/xdp.h | 1 +
1 file changed, 1 insertion(+)
--- a/include/trace/events/xdp.h
+++ b/include/trace/events/xdp.h
@@ -8,6 +8,7 @@
#include <linux/netdevice.h>
#include <linux/filter.h>
#include <linux/tracepoint.h>
+#include <linux/bpf.h>
#define __XDP_ACT_MAP(FN) \
FN(ABORTED) \
Patches currently in stable-queue which might be from xiexiuqi(a)huawei.com are
queue-4.14/trace-xdp-fix-compile-warning-struct-bpf_map-declared-inside-parameter-list.patch
This is a note to let you know that I've just added the patch titled
usb: build drivers/usb/common/ when USB_SUPPORT is set
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
usb-build-drivers-usb-common-when-usb_support-is-set.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Fri Feb 23 11:45:09 CET 2018
From: Randy Dunlap <rdunlap(a)infradead.org>
Date: Fri, 17 Nov 2017 11:00:45 -0800
Subject: usb: build drivers/usb/common/ when USB_SUPPORT is set
From: Randy Dunlap <rdunlap(a)infradead.org>
[ Upstream commit c9d24f78268be444e803fb2bb138a2f598de9c23 ]
PHY drivers can use ULPI interfaces when CONFIG_USB (which is host side
support) is not enabled, so also build drivers/usb/ when CONFIG_USB_SUPPORT
is enabled so that drivers/usb/common/ is built.
ERROR: "ulpi_unregister_driver" [drivers/phy/ti/phy-tusb1210.ko] undefined!
ERROR: "__ulpi_register_driver" [drivers/phy/ti/phy-tusb1210.ko] undefined!
ERROR: "ulpi_read" [drivers/phy/ti/phy-tusb1210.ko] undefined!
ERROR: "ulpi_write" [drivers/phy/ti/phy-tusb1210.ko] undefined!
ERROR: "ulpi_unregister_driver" [drivers/phy/qualcomm/phy-qcom-usb-hs.ko] undefined!
ERROR: "__ulpi_register_driver" [drivers/phy/qualcomm/phy-qcom-usb-hs.ko] undefined!
ERROR: "ulpi_write" [drivers/phy/qualcomm/phy-qcom-usb-hs.ko] undefined!
Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/Makefile | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -105,6 +105,7 @@ obj-$(CONFIG_TC) += tc/
obj-$(CONFIG_UWB) += uwb/
obj-$(CONFIG_USB_PHY) += usb/
obj-$(CONFIG_USB) += usb/
+obj-$(CONFIG_USB_SUPPORT) += usb/
obj-$(CONFIG_PCI) += usb/
obj-$(CONFIG_USB_GADGET) += usb/
obj-$(CONFIG_OF) += usb/
Patches currently in stable-queue which might be from rdunlap(a)infradead.org are
queue-4.14/usb-build-drivers-usb-common-when-usb_support-is-set.patch
queue-4.14/iio-fix-kernel-doc-build-errors.patch
This is a note to let you know that I've just added the patch titled
spi: sun4i: disable clocks in the remove function
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
spi-sun4i-disable-clocks-in-the-remove-function.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Fri Feb 23 11:45:09 CET 2018
From: Takuo Koguchi <takuo.koguchi(a)gmail.com>
Date: Thu, 7 Dec 2017 16:20:14 +0900
Subject: spi: sun4i: disable clocks in the remove function
From: Takuo Koguchi <takuo.koguchi(a)gmail.com>
[ Upstream commit c810daba0ab5226084a56893a789af427a801146 ]
mclk and hclk need to be disabled. Since pm_runtime_disable does
not disable the clocks, use pm_runtime_force_suspend instead.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Takuo Koguchi <takuo.koguchi.sw(a)hitachi.com>
Acked-by: Maxime Ripard <maxime.ripard(a)free-electrons.com>
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/spi/spi-sun4i.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/spi/spi-sun4i.c
+++ b/drivers/spi/spi-sun4i.c
@@ -525,7 +525,7 @@ err_free_master:
static int sun4i_spi_remove(struct platform_device *pdev)
{
- pm_runtime_disable(&pdev->dev);
+ pm_runtime_force_suspend(&pdev->dev);
return 0;
}
Patches currently in stable-queue which might be from takuo.koguchi(a)gmail.com are
queue-4.14/spi-sun4i-disable-clocks-in-the-remove-function.patch
This is a note to let you know that I've just added the patch titled
staging: ccree: Uninitialized return in ssi_ahash_import()
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
staging-ccree-uninitialized-return-in-ssi_ahash_import.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Fri Feb 23 11:45:09 CET 2018
From: Dan Carpenter <dan.carpenter(a)oracle.com>
Date: Tue, 5 Dec 2017 17:37:17 +0300
Subject: staging: ccree: Uninitialized return in ssi_ahash_import()
From: Dan Carpenter <dan.carpenter(a)oracle.com>
[ Upstream commit aece09024414b54158e03aa45f4a4436e7cb996c ]
The return value isn't initialized on some success paths.
Fixes: c5f39d07860c ("staging: ccree: fix leak of import() after init()")
Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/ccree/ssi_hash.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/ccree/ssi_hash.c
+++ b/drivers/staging/ccree/ssi_hash.c
@@ -1781,7 +1781,7 @@ static int ssi_ahash_import(struct ahash
struct device *dev = &ctx->drvdata->plat_dev->dev;
struct ahash_req_ctx *state = ahash_request_ctx(req);
u32 tmp;
- int rc;
+ int rc = 0;
memcpy(&tmp, in, sizeof(u32));
if (tmp != CC_EXPORT_MAGIC) {
Patches currently in stable-queue which might be from dan.carpenter(a)oracle.com are
queue-4.14/scsi-lpfc-use-after-free-in-lpfc_rq_buf_free.patch
queue-4.14/staging-ccree-uninitialized-return-in-ssi_ahash_import.patch
This is a note to let you know that I've just added the patch titled
sfp: fix RX_LOS signal handling
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
sfp-fix-rx_los-signal-handling.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Fri Feb 23 11:45:09 CET 2018
From: Russell King <rmk+kernel(a)armlinux.org.uk>
Date: Thu, 30 Nov 2017 13:59:11 +0000
Subject: sfp: fix RX_LOS signal handling
From: Russell King <rmk+kernel(a)armlinux.org.uk>
[ Upstream commit acf1c02f023926b8b04672a9e81b1711ae681619 ]
The options word is a be16 quantity, so we need to test the flags
having converted the endian-ness. Convert the flag bits to be16,
which can be optimised by the compiler, rather than converting a
variable at runtime.
Reported-by: Florian Fainelli <f.fainelli(a)gmail.com>
Signed-off-by: Russell King <rmk+kernel(a)armlinux.org.uk>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/net/phy/sfp.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
@@ -358,7 +358,7 @@ static void sfp_sm_link_check_los(struct
* SFP_OPTIONS_LOS_NORMAL are set? For now, we assume
* the same as SFP_OPTIONS_LOS_NORMAL set.
*/
- if (sfp->id.ext.options & SFP_OPTIONS_LOS_INVERTED)
+ if (sfp->id.ext.options & cpu_to_be16(SFP_OPTIONS_LOS_INVERTED))
los ^= SFP_F_LOS;
if (los)
@@ -583,7 +583,8 @@ static void sfp_sm_event(struct sfp *sfp
if (event == SFP_E_TX_FAULT)
sfp_sm_fault(sfp, true);
else if (event ==
- (sfp->id.ext.options & SFP_OPTIONS_LOS_INVERTED ?
+ (sfp->id.ext.options &
+ cpu_to_be16(SFP_OPTIONS_LOS_INVERTED) ?
SFP_E_LOS_HIGH : SFP_E_LOS_LOW))
sfp_sm_link_up(sfp);
break;
@@ -593,7 +594,8 @@ static void sfp_sm_event(struct sfp *sfp
sfp_sm_link_down(sfp);
sfp_sm_fault(sfp, true);
} else if (event ==
- (sfp->id.ext.options & SFP_OPTIONS_LOS_INVERTED ?
+ (sfp->id.ext.options &
+ cpu_to_be16(SFP_OPTIONS_LOS_INVERTED) ?
SFP_E_LOS_LOW : SFP_E_LOS_HIGH)) {
sfp_sm_link_down(sfp);
sfp_sm_next(sfp, SFP_S_WAIT_LOS, 0);
Patches currently in stable-queue which might be from rmk+kernel(a)armlinux.org.uk are
queue-4.14/sfp-fix-rx_los-signal-handling.patch
queue-4.14/drm-armada-fix-leak-of-crtc-structure.patch
queue-4.14/arm-8743-1-bl_switcher-add-module_license-tag.patch
queue-4.14/phylink-ensure-we-take-the-link-down-when-phylink_stop-is-called.patch
This is a note to let you know that I've just added the patch titled
serdev: fix receive_buf return value when no callback
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
serdev-fix-receive_buf-return-value-when-no-callback.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Fri Feb 23 11:45:09 CET 2018
From: Johan Hovold <johan(a)kernel.org>
Date: Fri, 3 Nov 2017 15:30:53 +0100
Subject: serdev: fix receive_buf return value when no callback
From: Johan Hovold <johan(a)kernel.org>
[ Upstream commit fd00cf81a9a84776ba58e56bd042c726dcf75cf3 ]
The receive_buf callback is supposed to return the number of bytes
processed and should specifically not return a negative errno.
Due to missing sanity checks in the serdev tty-port controller, a driver
not providing a receive_buf callback could cause the flush_to_ldisc()
worker to spin in a tight loop when the tty buffer pointers are
incremented with -EINVAL (-22).
The missing sanity checks have now been added to the tty-port
controller, but let's fix up the serdev-controller helper as well.
Signed-off-by: Johan Hovold <johan(a)kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
include/linux/serdev.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/linux/serdev.h
+++ b/include/linux/serdev.h
@@ -184,7 +184,7 @@ static inline int serdev_controller_rece
struct serdev_device *serdev = ctrl->serdev;
if (!serdev || !serdev->ops->receive_buf)
- return -EINVAL;
+ return 0;
return serdev->ops->receive_buf(serdev, data, count);
}
Patches currently in stable-queue which might be from johan(a)kernel.org are
queue-4.14/serdev-fix-receive_buf-return-value-when-no-callback.patch
This is a note to let you know that I've just added the patch titled
sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
sctp-only-update-outstanding_bytes-for-transmitted-queue-when-doing-prsctp_prune.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Fri Feb 23 11:45:09 CET 2018
From: Xin Long <lucien.xin(a)gmail.com>
Date: Sat, 25 Nov 2017 21:18:34 +0800
Subject: sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune
From: Xin Long <lucien.xin(a)gmail.com>
[ Upstream commit d30fc5126efb0c33b7adf5966d3051db2c3d7721 ]
Now outstanding_bytes is only increased when appending chunks into one
packet and sending it at 1st time, while decreased when it is about to
move into retransmit queue. It means outstanding_bytes value is already
decreased for all chunks in retransmit queue.
However sctp_prsctp_prune_sent is a common function to check the chunks
in both transmitted and retransmit queue, it decrease outstanding_bytes
when moving a chunk into abandoned queue from either of them.
It could cause outstanding_bytes underflow, as it also decreases it's
value for the chunks in retransmit queue.
This patch fixes it by only updating outstanding_bytes for transmitted
queue when pruning queues for prsctp prio policy, the same fix is also
needed in sctp_check_transmitted.
Fixes: 8dbdf1f5b09c ("sctp: implement prsctp PRIO policy")
Signed-off-by: Xin Long <lucien.xin(a)gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
net/sctp/outqueue.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -368,7 +368,8 @@ static int sctp_prsctp_prune_sent(struct
asoc->abandoned_sent[SCTP_PR_INDEX(PRIO)]++;
streamout->abandoned_sent[SCTP_PR_INDEX(PRIO)]++;
- if (!chk->tsn_gap_acked) {
+ if (queue != &asoc->outqueue.retransmit &&
+ !chk->tsn_gap_acked) {
if (chk->transport)
chk->transport->flight_size -=
sctp_data_size(chk);
@@ -1429,7 +1430,8 @@ static void sctp_check_transmitted(struc
/* If this chunk has not been acked, stop
* considering it as 'outstanding'.
*/
- if (!tchunk->tsn_gap_acked) {
+ if (transmitted_queue != &q->retransmit &&
+ !tchunk->tsn_gap_acked) {
if (tchunk->transport)
tchunk->transport->flight_size -=
sctp_data_size(tchunk);
Patches currently in stable-queue which might be from lucien.xin(a)gmail.com are
queue-4.14/sctp-only-update-outstanding_bytes-for-transmitted-queue-when-doing-prsctp_prune.patch
queue-4.14/sctp-set-frag_point-in-sctp_setsockopt_maxseg-correctly.patch
This is a note to let you know that I've just added the patch titled
scsi: lpfc: Use after free in lpfc_rq_buf_free()
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
scsi-lpfc-use-after-free-in-lpfc_rq_buf_free.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Fri Feb 23 11:45:09 CET 2018
From: Dan Carpenter <dan.carpenter(a)oracle.com>
Date: Wed, 22 Nov 2017 11:58:03 +0300
Subject: scsi: lpfc: Use after free in lpfc_rq_buf_free()
From: Dan Carpenter <dan.carpenter(a)oracle.com>
[ Upstream commit 9816ef6ecbc102b9bcbb1d83e12c7fb19924f38c ]
The error message dereferences "rqb_entry" so we need to print it first
and then free the buffer.
Fixes: 6c621a2229b0 ("scsi: lpfc: Separate NVMET RQ buffer posting from IO resources SGL/iocbq/context")
Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com>
Acked-by: Dick Kennedy <dick.kennedy(a)broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/scsi/lpfc/lpfc_mem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -753,12 +753,12 @@ lpfc_rq_buf_free(struct lpfc_hba *phba,
drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys);
rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);
if (rc < 0) {
- (rqbp->rqb_free_buffer)(phba, rqb_entry);
lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
"6409 Cannot post to RQ %d: %x %x\n",
rqb_entry->hrq->queue_id,
rqb_entry->hrq->host_index,
rqb_entry->hrq->hba_index);
+ (rqbp->rqb_free_buffer)(phba, rqb_entry);
} else {
list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);
rqbp->buffer_count++;
Patches currently in stable-queue which might be from dan.carpenter(a)oracle.com are
queue-4.14/scsi-lpfc-use-after-free-in-lpfc_rq_buf_free.patch
queue-4.14/staging-ccree-uninitialized-return-in-ssi_ahash_import.patch
This is a note to let you know that I've just added the patch titled
scsi: bfa: fix type conversion warning
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
scsi-bfa-fix-type-conversion-warning.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 48d83282db077f93b2cf40de120f4d6f29eb293b Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd(a)arndb.de>
Date: Wed, 6 Dec 2017 15:14:18 +0100
Subject: scsi: bfa: fix type conversion warning
From: Arnd Bergmann <arnd(a)arndb.de>
commit 48d83282db077f93b2cf40de120f4d6f29eb293b upstream.
A regression fix introduced a harmless type mismatch warning:
drivers/scsi/bfa/bfad_bsg.c: In function 'bfad_im_bsg_vendor_request':
drivers/scsi/bfa/bfad_bsg.c:3137:35: error: initialization of 'struct bfad_im_port_s *' from 'long unsigned int' makes pointer from integer without a cast [-Werror=int-conversion]
struct bfad_im_port_s *im_port = shost->hostdata[0];
^~~~~
drivers/scsi/bfa/bfad_bsg.c: In function 'bfad_im_bsg_els_ct_request':
drivers/scsi/bfa/bfad_bsg.c:3353:35: error: initialization of 'struct bfad_im_port_s *' from 'long unsigned int' makes pointer from integer without a cast [-Werror=int-conversion]
struct bfad_im_port_s *im_port = shost->hostdata[0];
This changes the code back to shost_priv() once more, but encapsulates
it in an inline function to document the rather unusual way of
using the private data only as a pointer to the previously allocated
structure.
I did not try to get rid of the extra indirection level entirely,
which would have been rather invasive and required reworking the entire
initialization sequence.
Fixes: 45349821ab3a ("scsi: bfa: fix access to bfad_im_port_s")
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
Reviewed-by: Johannes Thumshirn <jthumshirn(a)suse.de>
Reviewed-by: Hannes Reinecke <hare(a)suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
Cc: Sasha Levin <Alexander.Levin(a)microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/scsi/bfa/bfad_bsg.c | 4 ++--
drivers/scsi/bfa/bfad_im.c | 6 ++++--
drivers/scsi/bfa/bfad_im.h | 10 ++++++++++
3 files changed, 16 insertions(+), 4 deletions(-)
--- a/drivers/scsi/bfa/bfad_bsg.c
+++ b/drivers/scsi/bfa/bfad_bsg.c
@@ -3136,7 +3136,7 @@ bfad_im_bsg_vendor_request(struct bsg_jo
struct fc_bsg_reply *bsg_reply = job->reply;
uint32_t vendor_cmd = bsg_request->rqst_data.h_vendor.vendor_cmd[0];
struct Scsi_Host *shost = fc_bsg_to_shost(job);
- struct bfad_im_port_s *im_port = shost->hostdata[0];
+ struct bfad_im_port_s *im_port = bfad_get_im_port(shost);
struct bfad_s *bfad = im_port->bfad;
struct request_queue *request_q = job->req->q;
void *payload_kbuf;
@@ -3359,7 +3359,7 @@ bfad_im_bsg_els_ct_request(struct bsg_jo
{
struct bfa_bsg_data *bsg_data;
struct Scsi_Host *shost = fc_bsg_to_shost(job);
- struct bfad_im_port_s *im_port = shost->hostdata[0];
+ struct bfad_im_port_s *im_port = bfad_get_im_port(shost);
struct bfad_s *bfad = im_port->bfad;
bfa_bsg_fcpt_t *bsg_fcpt;
struct bfad_fcxp *drv_fcxp;
--- a/drivers/scsi/bfa/bfad_im.c
+++ b/drivers/scsi/bfa/bfad_im.c
@@ -546,6 +546,7 @@ int
bfad_im_scsi_host_alloc(struct bfad_s *bfad, struct bfad_im_port_s *im_port,
struct device *dev)
{
+ struct bfad_im_port_pointer *im_portp;
int error = 1;
mutex_lock(&bfad_mutex);
@@ -564,7 +565,8 @@ bfad_im_scsi_host_alloc(struct bfad_s *b
goto out_free_idr;
}
- im_port->shost->hostdata[0] = (unsigned long)im_port;
+ im_portp = shost_priv(im_port->shost);
+ im_portp->p = im_port;
im_port->shost->unique_id = im_port->idr_id;
im_port->shost->this_id = -1;
im_port->shost->max_id = MAX_FCP_TARGET;
@@ -748,7 +750,7 @@ bfad_scsi_host_alloc(struct bfad_im_port
sht->sg_tablesize = bfad->cfg_data.io_max_sge;
- return scsi_host_alloc(sht, sizeof(unsigned long));
+ return scsi_host_alloc(sht, sizeof(struct bfad_im_port_pointer));
}
void
--- a/drivers/scsi/bfa/bfad_im.h
+++ b/drivers/scsi/bfa/bfad_im.h
@@ -69,6 +69,16 @@ struct bfad_im_port_s {
struct fc_vport *fc_vport;
};
+struct bfad_im_port_pointer {
+ struct bfad_im_port_s *p;
+};
+
+static inline struct bfad_im_port_s *bfad_get_im_port(struct Scsi_Host *host)
+{
+ struct bfad_im_port_pointer *im_portp = shost_priv(host);
+ return im_portp->p;
+}
+
enum bfad_itnim_state {
ITNIM_STATE_NONE,
ITNIM_STATE_ONLINE,
Patches currently in stable-queue which might be from arnd(a)arndb.de are
queue-4.14/staging-fsl-mc-fix-build-testing-on-x86.patch
queue-4.14/scsi-bfa-fix-type-conversion-warning.patch
queue-4.14/asoc-ux500-add-module_license-tag.patch
queue-4.14/video-fbdev-mmp-add-module_license.patch
queue-4.14/arm64-dts-add-cooling-cells-to-cpu-nodes.patch
queue-4.14/arm-8743-1-bl_switcher-add-module_license-tag.patch
This is a note to let you know that I've just added the patch titled
scripts/kernel-doc: Don't fail with status != 0 if error encountered with -none
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
scripts-kernel-doc-don-t-fail-with-status-0-if-error-encountered-with-none.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Fri Feb 23 11:45:09 CET 2018
From: Will Deacon <will.deacon(a)arm.com>
Date: Wed, 29 Nov 2017 15:20:03 +0000
Subject: scripts/kernel-doc: Don't fail with status != 0 if error encountered with -none
From: Will Deacon <will.deacon(a)arm.com>
[ Upstream commit e814bccbafece52a24e152d2395b5d49eef55841 ]
My bisect scripts starting running into build failures when trying to
compile 4.15-rc1 with the builds failing with things like:
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:2078: error: Cannot parse struct or union!
The line in question is actually just a #define, but after some digging
it turns out that my scripts pass W=1 and since commit 3a025e1d1c2ea
("Add optional check for bad kernel-doc comments") that results in
kernel-doc running on each source file. The file in question has a
badly formatted comment immediately before the #define:
/**
* struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for
* bus layer usage.
*/
which causes the regex in dump_struct to fail (lack of braces following
struct declaration) and kernel-doc returns 1, which causes the build
to fail.
Fix the issue by always returning 0 from kernel-doc when invoked with
-none. It successfully generates no documentation, and prints out any
issues.
Cc: Matthew Wilcox <mawilcox(a)microsoft.com>
Cc: Jonathan Corbet <corbet(a)lwn.net>
Signed-off-by: Will Deacon <will.deacon(a)arm.com>
Signed-off-by: Jonathan Corbet <corbet(a)lwn.net>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
scripts/kernel-doc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -3216,4 +3216,4 @@ if ($verbose && $warnings) {
print STDERR "$warnings warnings\n";
}
-exit($errors);
+exit($output_mode eq "none" ? 0 : $errors);
Patches currently in stable-queue which might be from will.deacon(a)arm.com are
queue-4.14/scripts-kernel-doc-don-t-fail-with-status-0-if-error-encountered-with-none.patch
This is a note to let you know that I've just added the patch titled
s390/virtio: add BSD license to virtio-ccw
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
s390-virtio-add-bsd-license-to-virtio-ccw.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Fri Feb 23 11:45:09 CET 2018
From: "Michael S. Tsirkin" <mst(a)redhat.com>
Date: Tue, 28 Nov 2017 16:11:29 +0200
Subject: s390/virtio: add BSD license to virtio-ccw
From: "Michael S. Tsirkin" <mst(a)redhat.com>
[ Upstream commit edfb8d8fcb94a75b2e61c63549d4a5f6474ad3d2 ]
The original intent of the virtio header relicensing
from 2008 was to make sure anyone can implement compatible
devices/drivers. The virtio-ccw was omitted by mistake.
We have an ack from the only contributor as well as the
maintainer from IBM, so it's not too late to fix that.
Make it dual-licensed with GPLv2, as the whole kernel is GPL2.
Acked-by: Christian Borntraeger <borntraeger(a)de.ibm.com>
Acked-by: Cornelia Huck <cohuck(a)redhat.com>
Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com>
Signed-off-by: Heiko Carstens <heiko.carstens(a)de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky(a)de.ibm.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
arch/s390/include/uapi/asm/virtio-ccw.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/s390/include/uapi/asm/virtio-ccw.h
+++ b/arch/s390/include/uapi/asm/virtio-ccw.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
/*
* Definitions for virtio-ccw devices.
*
Patches currently in stable-queue which might be from mst(a)redhat.com are
queue-4.14/ptr_ring-try-vmalloc-when-kmalloc-fails.patch
queue-4.14/virtio_net-fix-return-value-check-in-receive_mergeable.patch
queue-4.14/vhost-use-mutex_lock_nested-in-vhost_dev_lock_vqs.patch
queue-4.14/ptr_ring-fail-early-if-queue-occupies-more-than-kmalloc_max_size.patch
queue-4.14/s390-virtio-add-bsd-license-to-virtio-ccw.patch