This is the start of the stable review cycle for the 4.19.4 release.
There are 42 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri Nov 23 18:31:31 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.4-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.4-rc1
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation"
Frieder Schrempf <frieder.schrempf(a)kontron.de>
usbnet: smsc95xx: disable carrier check while suspending
David Howells <dhowells(a)redhat.com>
rxrpc: Fix lockup due to no error backoff after ack transmit error
Stefan Wahren <stefan.wahren(a)i2se.com>
net: smsc95xx: Fix MTU range
Shalom Toledo <shalomt(a)mellanox.com>
mlxsw: spectrum: Fix IP2ME CPU policer configuration
Xin Long <lucien.xin(a)gmail.com>
sctp: not increase stream's incnt before sending addstrm_in request
Martin Schiller <ms(a)dev.tdt.de>
net: phy: mdio-gpio: Fix working over slow can_sleep GPIOs
Xin Long <lucien.xin(a)gmail.com>
sctp: fix strchange_flags name for Stream Change Event
Tristram Ha <Tristram.Ha(a)microchip.com>
net: dsa: microchip: initialize mutex before use
Subash Abhinov Kasiviswanathan <subashab(a)codeaurora.org>
net: qualcomm: rmnet: Fix incorrect assignment of real_dev
Xin Long <lucien.xin(a)gmail.com>
sctp: define SCTP_SS_DEFAULT for Stream schedulers
Holger Hoffstätte <holger(a)applied-asynchrony.com>
net: phy: realtek: fix RTL8201F sysfs name
Andrew Lunn <andrew(a)lunn.ch>
net: dsa: mv88e6xxx: Fix clearing of stats counters
Denis Drozdov <denisd(a)mellanox.com>
net/mlx5e: IPoIB, Reset QP after channels are closed
Raed Salem <raeds(a)mellanox.com>
net/mlx5: IPSec, Fix the SA context hash key
Xin Long <lucien.xin(a)gmail.com>
l2tp: fix a sock refcnt leak in l2tp_tunnel_register
Eric Dumazet <edumazet(a)google.com>
inet: frags: better deal with smp races
Shay Agroskin <shayag(a)mellanox.com>
net/mlx5e: Removed unnecessary warnings in FEC caps query
Valentine Fatiev <valentinef(a)mellanox.com>
net/mlx5e: Fix selftest for small MTUs
Or Gerlitz <ogerlitz(a)mellanox.com>
net/mlx5e: Always use the match level enum when parsing TC rule match
Xin Long <lucien.xin(a)gmail.com>
Revert "sctp: remove sctp_transport_pmtu_check"
Moshe Shemesh <moshe(a)mellanox.com>
net/mlx5e: RX, verify received packet size in Linear Striding RQ
Yuval Avnery <yuvalav(a)mellanox.com>
net/mlx5e: Adjust to max number of channles when re-attaching
Or Gerlitz <ogerlitz(a)mellanox.com>
net/mlx5e: Claim TC hw offloads support only under a proper build config
Or Gerlitz <ogerlitz(a)mellanox.com>
net/mlx5e: Don't match on vlan non-existence if ethertype is wildcarded
Jon Maloy <donmalo99(a)gmail.com>
tipc: fix link re-establish failure
Jakub Kicinski <jakub.kicinski(a)netronome.com>
net: sched: cls_flower: validate nested enc_opts_policy to avoid warning
Davide Caratti <dcaratti(a)redhat.com>
net/sched: act_pedit: fix memory leak when IDR allocation fails
Florian Fainelli <f.fainelli(a)gmail.com>
net: systemport: Protect stop from timeout
Matthew Cover <werekraken(a)gmail.com>
tuntap: fix multiqueue rx
Jon Maloy <donmalo99(a)gmail.com>
tipc: fix lockdep warning when reinitilaizing sockets
Jon Maloy <donmalo99(a)gmail.com>
tipc: don't assume linear buffer when reading ancillary data
Siva Reddy Kallam <siva.kallam(a)broadcom.com>
tg3: Add PHY reset for 5717/5719/5720 in change ring and flow control paths
Stephen Mallon <stephen.mallon(a)sydney.edu.au>
tcp: Fix SOF_TIMESTAMPING_RX_HARDWARE to use the latest timestamp during TCP coalescing
Xin Long <lucien.xin(a)gmail.com>
sctp: not allow to set asoc prsctp_enable by sockopt
Eric Dumazet <edumazet(a)google.com>
net-gro: reset skb->pkt_type in napi_reuse_skb()
Doug Berger <opendmb(a)gmail.com>
net: bcmgenet: protect stop from timeout
David Ahern <dsahern(a)gmail.com>
ipv6: Fix PMTU updates for UDP/raw sockets in presence of VRF
Xin Long <lucien.xin(a)gmail.com>
ipv6: fix a dst leak when removing its exception
Sabrina Dubroca <sd(a)queasysnail.net>
ip_tunnel: don't force DF when MTU is locked
Michał Mirosław <mirq-linux(a)rere.qmqm.pl>
ibmvnic: fix accelerated VLAN handling
배석진 <soukjin.bae(a)samsung.com>
flow_dissector: do not dissect l4 ports for fragments
-------------
Diffstat:
Makefile | 4 +-
arch/x86/kernel/cpu/bugs.c | 57 ++----------------
drivers/net/dsa/microchip/ksz_common.c | 10 ++--
drivers/net/dsa/mv88e6xxx/global1.c | 2 +
drivers/net/ethernet/broadcom/bcmsysport.c | 15 +++--
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 13 +++--
drivers/net/ethernet/broadcom/tg3.c | 18 +++++-
drivers/net/ethernet/ibm/ibmvnic.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 +
drivers/net/ethernet/mellanox/mlx5/core/en/port.c | 4 +-
.../ethernet/mellanox/mlx5/core/en/port_buffer.c | 4 +-
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 37 ++++++++++--
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 6 ++
.../net/ethernet/mellanox/mlx5/core/en_selftest.c | 26 ++++-----
drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 3 +
drivers/net/ethernet/mellanox/mlx5/core/en_stats.h | 2 +
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 67 +++++++++++-----------
.../net/ethernet/mellanox/mlx5/core/fpga/ipsec.c | 10 +++-
.../net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 2 +-
drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 1 -
drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c | 6 +-
drivers/net/phy/mdio-gpio.c | 10 ++--
drivers/net/phy/realtek.c | 2 +-
drivers/net/tun.c | 6 +-
drivers/net/usb/smsc95xx.c | 9 +++
include/net/sctp/sctp.h | 12 ++++
include/uapi/linux/sctp.h | 3 +
kernel/cpu.c | 11 +---
net/core/dev.c | 4 ++
net/core/flow_dissector.c | 4 +-
net/ipv4/inet_fragment.c | 29 +++++-----
net/ipv4/ip_tunnel_core.c | 2 +-
net/ipv4/tcp_input.c | 1 +
net/ipv6/route.c | 14 +++--
net/l2tp/l2tp_core.c | 9 ++-
net/rxrpc/ar-internal.h | 1 +
net/rxrpc/call_event.c | 18 ++++--
net/rxrpc/output.c | 35 +++++++++--
net/sched/act_pedit.c | 3 +-
net/sched/cls_flower.c | 14 ++++-
net/sctp/output.c | 3 +
net/sctp/outqueue.c | 2 +-
net/sctp/socket.c | 26 ++-------
net/sctp/stream.c | 1 -
net/tipc/discover.c | 19 +++---
net/tipc/link.c | 11 ++--
net/tipc/net.c | 45 ++++++++++++---
net/tipc/net.h | 2 +-
net/tipc/socket.c | 15 +++--
49 files changed, 356 insertions(+), 245 deletions(-)
Sorry for the quick follow-on release, but this resolves two reported
issues that should have gotten into the previous release.
I'm announcing the release of the 4.9.140 kernel.
All users of the 4.9 kernel series must upgrade.
The updated 4.9.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y
and can be browsed at the normal kernel.org git web browser:
http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 -
arch/x86/kernel/cpu/bugs.c | 57 ++++-----------------------------------------
kernel/cpu.c | 11 --------
net/ipv6/route.c | 11 ++++++--
4 files changed, 16 insertions(+), 65 deletions(-)
Greg Kroah-Hartman (3):
Revert "x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation"
Revert "ipv6: set rt6i_protocol properly in the route when it is installed"
Linux 4.9.140
The patch below does not apply to the 4.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b082f2dd80612015cd6d9d84e52099734ec9a0e1 Mon Sep 17 00:00:00 2001
From: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com>
Date: Fri, 26 Oct 2018 15:28:56 +0300
Subject: [PATCH] x86/ldt: Remove unused variable in map_ldt_struct()
Splitting out the sanity check in map_ldt_struct() moved page table syncing
into a separate function, which made the pgd variable unused. Remove it.
[ tglx: Massaged changelog ]
Fixes: 9bae3197e15d ("x86/ldt: Split out sanity check in map_ldt_struct()")
Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Reviewed-by: Andy Lutomirski <luto(a)kernel.org>
Cc: bp(a)alien8.de
Cc: hpa(a)zytor.com
Cc: dave.hansen(a)linux.intel.com
Cc: peterz(a)infradead.org
Cc: boris.ostrovsky(a)oracle.com
Cc: jgross(a)suse.com
Cc: bhe(a)redhat.com
Cc: willy(a)infradead.org
Cc: linux-mm(a)kvack.org
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20181026122856.66224-4-kirill.shutemov@linux.inte…
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index 18e4525c5933..6135ae8ce036 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -207,7 +207,6 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
bool is_vmalloc;
spinlock_t *ptl;
int i, nr_pages;
- pgd_t *pgd;
if (!static_cpu_has(X86_FEATURE_PTI))
return 0;
@@ -221,13 +220,6 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
/* Check if the current mappings are sane */
sanity_check_ldt_mapping(mm);
- /*
- * Did we already have the top level entry allocated? We can't
- * use pgd_none() for this because it doens't do anything on
- * 4-level page table kernels.
- */
- pgd = pgd_offset(mm, LDT_BASE_ADDR);
-
is_vmalloc = is_vmalloc_addr(ldt->entries);
nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE);
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b082f2dd80612015cd6d9d84e52099734ec9a0e1 Mon Sep 17 00:00:00 2001
From: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com>
Date: Fri, 26 Oct 2018 15:28:56 +0300
Subject: [PATCH] x86/ldt: Remove unused variable in map_ldt_struct()
Splitting out the sanity check in map_ldt_struct() moved page table syncing
into a separate function, which made the pgd variable unused. Remove it.
[ tglx: Massaged changelog ]
Fixes: 9bae3197e15d ("x86/ldt: Split out sanity check in map_ldt_struct()")
Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Reviewed-by: Andy Lutomirski <luto(a)kernel.org>
Cc: bp(a)alien8.de
Cc: hpa(a)zytor.com
Cc: dave.hansen(a)linux.intel.com
Cc: peterz(a)infradead.org
Cc: boris.ostrovsky(a)oracle.com
Cc: jgross(a)suse.com
Cc: bhe(a)redhat.com
Cc: willy(a)infradead.org
Cc: linux-mm(a)kvack.org
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20181026122856.66224-4-kirill.shutemov@linux.inte…
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index 18e4525c5933..6135ae8ce036 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -207,7 +207,6 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
bool is_vmalloc;
spinlock_t *ptl;
int i, nr_pages;
- pgd_t *pgd;
if (!static_cpu_has(X86_FEATURE_PTI))
return 0;
@@ -221,13 +220,6 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
/* Check if the current mappings are sane */
sanity_check_ldt_mapping(mm);
- /*
- * Did we already have the top level entry allocated? We can't
- * use pgd_none() for this because it doens't do anything on
- * 4-level page table kernels.
- */
- pgd = pgd_offset(mm, LDT_BASE_ADDR);
-
is_vmalloc = is_vmalloc_addr(ldt->entries);
nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE);
From: Jerome Brunet <jbrunet(a)baylibre.com>
[ Upstream commit e39f9dd8206ad66992ac0e6218ef1ba746f2cce9 ]
If a bias is enabled on a pin of an Amlogic SoC, calling .pin_config_set()
with PIN_CONFIG_BIAS_DISABLE will not disable the bias. Instead it will
force a pull-down bias on the pin.
Instead of the pull type register bank, the driver should access the pull
enable register bank.
Fixes: 6ac730951104 ("pinctrl: add driver for Amlogic Meson SoCs")
Signed-off-by: Jerome Brunet <jbrunet(a)baylibre.com>
Acked-by: Neil Armstrong <narmstrong(a)baylibre.com>
Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/pinctrl/meson/pinctrl-meson.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c
index 29a458da78db..4f3ab18636a3 100644
--- a/drivers/pinctrl/meson/pinctrl-meson.c
+++ b/drivers/pinctrl/meson/pinctrl-meson.c
@@ -192,7 +192,7 @@ static int meson_pinconf_set(struct pinctrl_dev *pcdev, unsigned int pin,
dev_dbg(pc->dev, "pin %u: disable bias\n", pin);
meson_calc_reg_and_bit(bank, pin, REG_PULL, ®, &bit);
- ret = regmap_update_bits(pc->reg_pull, reg,
+ ret = regmap_update_bits(pc->reg_pullen, reg,
BIT(bit), 0);
if (ret)
return ret;
--
2.17.1
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: vivid: free bitmap_cap when updating std/timings/etc.
Author: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Date: Fri Nov 9 08:37:44 2018 -0500
When vivid_update_format_cap() is called it should free any overlay
bitmap since the compose size will change.
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Reported-by: syzbot+0cc8e3cc63ca373722c6(a)syzkaller.appspotmail.com
Cc: <stable(a)vger.kernel.org> # for v3.18 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung(a)kernel.org>
drivers/media/platform/vivid/vivid-vid-cap.c | 2 ++
1 file changed, 2 insertions(+)
---
diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c
index 8213297ee9dc..a1ed5fdabc75 100644
--- a/drivers/media/platform/vivid/vivid-vid-cap.c
+++ b/drivers/media/platform/vivid/vivid-vid-cap.c
@@ -451,6 +451,8 @@ void vivid_update_format_cap(struct vivid_dev *dev, bool keep_controls)
tpg_s_rgb_range(&dev->tpg, v4l2_ctrl_g_ctrl(dev->rgb_range_cap));
break;
}
+ vfree(dev->bitmap_cap);
+ dev->bitmap_cap = NULL;
vivid_update_quality(dev);
tpg_reset_source(&dev->tpg, dev->src_rect.width, dev->src_rect.height, dev->field_cap);
dev->crop_cap = dev->src_rect;
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: v4l2-tpg: array index could become negative
Author: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Date: Thu Nov 8 11:12:47 2018 -0500
text[s] is a signed char, so using that as index into the font8x16 array
can result in negative indices. Cast it to u8 to be safe.
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Reported-by: syzbot+ccf0a61ed12f2a7313ee(a)syzkaller.appspotmail.com
Cc: <stable(a)vger.kernel.org> # for v4.7 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung(a)kernel.org>
drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---
diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
index fa483b95bc5a..d9a590ae7545 100644
--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
@@ -1769,7 +1769,7 @@ typedef struct { u16 __; u8 _; } __packed x24;
unsigned s; \
\
for (s = 0; s < len; s++) { \
- u8 chr = font8x16[text[s] * 16 + line]; \
+ u8 chr = font8x16[(u8)text[s] * 16 + line]; \
\
if (hdiv == 2 && tpg->hflip) { \
pos[3] = (chr & (0x01 << 6) ? fg : bg); \
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: vb2: check memory model for VIDIOC_CREATE_BUFS
Author: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Date: Thu Nov 8 07:23:37 2018 -0500
vb2_core_create_bufs did not check if the memory model for newly added
buffers is the same as for already existing buffers. It should return an
error if they aren't the same.
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Reported-by: syzbot+e1fb118a2ebb88031d21(a)syzkaller.appspotmail.com
Cc: <stable(a)vger.kernel.org> # for v4.16 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung(a)kernel.org>
drivers/media/common/videobuf2/videobuf2-core.c | 3 +++
1 file changed, 3 insertions(+)
---
diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
index 2fcab61b8ff5..03954c13024c 100644
--- a/drivers/media/common/videobuf2/videobuf2-core.c
+++ b/drivers/media/common/videobuf2/videobuf2-core.c
@@ -812,6 +812,9 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory,
memset(q->alloc_devs, 0, sizeof(q->alloc_devs));
q->memory = memory;
q->waiting_for_buffers = !q->is_output;
+ } else if (q->memory != memory) {
+ dprintk(1, "memory model mismatch\n");
+ return -EINVAL;
}
num_buffers = min(*count, VB2_MAX_FRAME - q->num_buffers);
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: vim2m: use cancel_delayed_work_sync instead of flush_schedule_work
Author: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Date: Wed Nov 7 09:04:54 2018 -0500
The use of flush_schedule_work() made no sense and caused a syzkaller error.
Replace with the correct cancel_delayed_work_sync().
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Reported-by: syzbot+69780d144754b8071f4b(a)syzkaller.appspotmail.com
Cc: <stable(a)vger.kernel.org> # for v4.20 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung(a)kernel.org>
drivers/media/platform/vim2m.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
---
diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
index 035c7b7c8d87..d01821a6906a 100644
--- a/drivers/media/platform/vim2m.c
+++ b/drivers/media/platform/vim2m.c
@@ -803,10 +803,11 @@ static int vim2m_start_streaming(struct vb2_queue *q, unsigned count)
static void vim2m_stop_streaming(struct vb2_queue *q)
{
struct vim2m_ctx *ctx = vb2_get_drv_priv(q);
+ struct vim2m_dev *dev = ctx->dev;
struct vb2_v4l2_buffer *vbuf;
unsigned long flags;
- flush_scheduled_work();
+ cancel_delayed_work_sync(&dev->work_run);
for (;;) {
if (V4L2_TYPE_IS_OUTPUT(q->type))
vbuf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);