- Linux-stable-mirror - lists.linaro.org

[Linux-stable-mirror] [PATCH 4.14 000/164] 4.14.6-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.6 release. There are 164 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu Dec 14 12:34:08 UTC 2017. Anything received after that time might be too late. The whole patch series can be found in one patch at: kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.6-rc1.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.6-rc1 Reinette Chatre <reinette.chatre(a)intel.com> x86/intel_rdt: Fix potential deadlock during resctrl unmount Leon Romanovsky <leon(a)kernel.org> RDMA/cxgb4: Annotate r2 and stag as __be32 Zdenek Kabelac <zkabelac(a)redhat.com> md: free unused memory after bitmap resize Heinz Mauelshagen <heinzm(a)redhat.com> dm raid: fix panic when attempting to force a raid to sync Paul Moore <paul(a)paul-moore.com> audit: ensure that 'audit=1' actually enables audit for PID 1 Steve Grubb <sgrubb(a)redhat.com> audit: Allow auditd to set pid to 0 to end auditing Israel Rukshin <israelr(a)mellanox.com> nvmet-rdma: update queue list during ib_device removal Bart Van Assche <bart.vanassche(a)wdc.com> blk-mq: Avoid that request queue removal can trigger list corruption Hongxu Jia <hongxu.jia(a)windriver.com> ide: ide-atapi: fix compile error with defining macro DEBUG Keefe Liu <liuqifa(a)huawei.com> ipvlan: fix ipv6 outbound device Vaidyanathan Srinivasan <svaidy(a)linux.vnet.ibm.com> powerpc/powernv/idle: Round up latency and residency values Masahiro Yamada <yamada.masahiro(a)socionext.com> kbuild: do not call cc-option before KBUILD_CFLAGS initialization David Howells <dhowells(a)redhat.com> afs: Connect up the CB.ProbeUuid David Howells <dhowells(a)redhat.com> afs: Fix total-length calculation for multiple-page send Majd Dibbiny <majd(a)mellanox.com> IB/mlx5: Assign send CQ and recv CQ of UMR QP Mark Bloch <markb(a)mellanox.com> IB/mlx4: Increase maximal message size under UD QP Sriharsha Basavapatna <sriharsha.basavapatna(a)broadcom.com> bnxt_re: changing the ip address shouldn't affect new connections Chao Yu <yuchao0(a)huawei.com> f2fs: fix to clear FI_NO_PREALLOC Herbert Xu <herbert(a)gondor.apana.org.au> xfrm: Copy policy family in clone_policy Ilya Lesokhin <ilyal(a)mellanox.com> tls: Use kzalloc for aead_request allocation Jason Baron <jbaron(a)akamai.com> jump_label: Invoke jump_label_test() via early_initcall() Arvind Yadav <arvind.yadav.cs(a)gmail.com> atm: horizon: Fix irq release error Masahiro Yamada <yamada.masahiro(a)socionext.com> kbuild: rpm-pkg: fix jobserver unavailable warning Sudeep Holla <sudeep.holla(a)arm.com> mailbox: mailbox-test: don't rely on rx_buffer content to signal data ready Zhong Kaihua <zhongkaihua(a)huawei.com> clk: hi3660: fix incorrect uart3 clock freqency Masahiro Yamada <yamada.masahiro(a)socionext.com> clk: uniphier: fix DAPLL2 clock rate of Pro5 Johan Hovold <johan(a)kernel.org> clk: qcom: common: fix legacy board-clock registration Mylene JOSSERAND <mylene.josserand(a)free-electrons.com> clk: sunxi-ng: a83t: Fix i2c buses bits Gabriel Fernandez <gabriel.fernandez(a)st.com> clk: stm32h7: fix test of clock config Eric Dumazet <edumazet(a)google.com> bpf: fix lockdep splat Hangbin Liu <liuhangbin(a)gmail.com> geneve: fix fill_info when link down Jeff Layton <jlayton(a)redhat.com> fcntl: don't leak fd reference when fixup_compat_flock fails Xin Long <lucien.xin(a)gmail.com> sctp: use the right sk after waking up from wait_buf sleep Xin Long <lucien.xin(a)gmail.com> sctp: do not free asoc when it is already dead in sctp_sendmsg Miles Chen <miles.chen(a)mediatek.com> slub: fix sysfs duplicate filename creation when slub_debug=O Sergey Senozhatsky <sergey.senozhatsky.work(a)gmail.com> zsmalloc: calling zs_map_object() from irq is a bug Pavel Tatashin <pasha.tatashin(a)oracle.com> sparc64/mm: set fields in deferred pages Ming Lei <ming.lei(a)redhat.com> block: wake up all tasks blocked in get_request() Johan Hovold <johan(a)kernel.org> dt-bindings: usb: fix reg-property port-number range Darrick J. Wong <darrick.wong(a)oracle.com> xfs: fix forgotten rcu read unlock when skipping inode reclaim Pieter Jansen van Vuuren <pieter.jansenvanvuuren(a)netronome.com> nfp: fix flower offload metadata flag usage Dirk van der Merwe <dirk.vandermerwe(a)netronome.com> nfp: inherit the max_mtu from the PF netdev Chuck Lever <chuck.lever(a)oracle.com> sunrpc: Fix rpc_task_begin trace point Trond Myklebust <trond.myklebust(a)primarydata.com> NFS: Fix a typo in nfs_rename() Randy Dunlap <rdunlap(a)infradead.org> dynamic-debug-howto: fix optional/omitted ending line number to be LARGE instead of 0 Stephen Bates <sbates(a)raithlin.com> lib/genalloc.c: make the avail variable an atomic_long_t Joe Lawrence <joe.lawrence(a)redhat.com> pipe: match pipe_max_size data type with procfs Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> drivers/rapidio/devices/rio_mport_cdev.c: fix resource leak in error handling path in 'rio_dma_transfer()' Colin Ian King <colin.king(a)canonical.com> rsi: fix memory leak on buf and usb_reg_buf Xin Long <lucien.xin(a)gmail.com> route: update fnhe_expires for redirect when the fnhe exists Xin Long <lucien.xin(a)gmail.com> route: also update fnhe_genid when updating a route cache Alexey Kodanev <alexey.kodanev(a)oracle.com> gre6: use log_ecn_error module parameter in ip6_tnl_rcv() Ben Hutchings <ben.hutchings(a)codethink.co.uk> mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl() Dave Hansen <dave.hansen(a)linux.intel.com> x86/mpx/selftests: Fix up weird arrays John Johansen <john.johansen(a)canonical.com> apparmor: fix leak of null profile name if profile allocation fails Madhavan Srinivasan <maddy(a)linux.vnet.ibm.com> powerpc/perf: Fix pmu_count to count only nest imc pmus Masahiro Yamada <yamada.masahiro(a)socionext.com> coccinelle: fix parallel build with CHECK=scripts/coccicheck Masahiro Yamada <yamada.masahiro(a)socionext.com> kbuild: pkg: use --transform option to prefix paths in tar Ursula Braun <ursula.braun(a)de.ibm.com> net/smc: use sk_rcvbuf as start for rmb creation Colin Ian King <colin.king(a)canonical.com> irqchip/qcom: Fix u32 comparison with value less than zero Russell King <rmk+kernel(a)armlinux.org.uk> ARM: avoid faulting on qemu Russell King <rmk+kernel(a)armlinux.org.uk> ARM: BUG if jumping to usermode address in kernel mode LEROY Christophe <christophe.leroy(a)c-s.fr> crypto: talitos - fix ctr-aes-talitos LEROY Christophe <christophe.leroy(a)c-s.fr> crypto: talitos - fix use of sg_link_tbl_len LEROY Christophe <christophe.leroy(a)c-s.fr> crypto: talitos - fix AEAD for sha224 on non sha224 capable chips LEROY Christophe <christophe.leroy(a)c-s.fr> crypto: talitos - fix setkey to check key weakness LEROY Christophe <christophe.leroy(a)c-s.fr> crypto: talitos - fix memory corruption on SEC2 LEROY Christophe <christophe.leroy(a)c-s.fr> crypto: talitos - fix AEAD test failures Daniel Jurgens <danielj(a)mellanox.com> IB/core: Only enforce security for InfiniBand Parav Pandit <parav(a)mellanox.com> IB/core: Avoid unnecessary return value check Kim Phillips <kim.phillips(a)arm.com> bus: arm-ccn: fix module unloading Error: Removing state 147 which has instances left. Marc Zyngier <marc.zyngier(a)arm.com> bus: arm-ccn: Fix use of smp_processor_id() in preemptible context Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> bus: arm-ccn: Check memory allocation failure Marc Zyngier <marc.zyngier(a)arm.com> bus: arm-cci: Fix use of smp_processor_id() in preemptible context Fabio Estevam <fabio.estevam(a)nxp.com> Revert "ARM: dts: imx53: add srtc node" Will Deacon <will.deacon(a)arm.com> arm64: SW PAN: Update saved ttbr0 value on enter_lazy_tlb Will Deacon <will.deacon(a)arm.com> arm64: SW PAN: Point saved ttbr0 at the zero page when switching to init_mm Dave Martin <Dave.Martin(a)arm.com> arm64: fpsimd: Prevent registers leaking from dead tasks Marc Zyngier <marc.zyngier(a)arm.com> KVM: arm/arm64: vgic-its: Check result of allocation before use Marc Zyngier <marc.zyngier(a)arm.com> KVM: arm/arm64: vgic: Preserve the revious read from the pending table Marc Zyngier <marc.zyngier(a)arm.com> KVM: arm/arm64: vgic-irqfd: Fix MSI entry allocation Christoffer Dall <christoffer.dall(a)linaro.org> KVM: arm/arm64: Fix broken GICH_ELRSR big endian conversion Andrew Honig <ahonig(a)google.com> KVM: VMX: remove I/O port 0x80 bypass on Intel hosts Marc Zyngier <marc.zyngier(a)arm.com> arm: KVM: Fix VTTBR_BADDR_MASK BUG_ON off-by-one Kristina Martsenko <kristina.martsenko(a)arm.com> arm64: KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one Sean Young <sean(a)mess.org> media: rc: partial revert of "media: rc: per-protocol repeat period" Sean Young <sean(a)mess.org> media: rc: sir_ir: detect presence of port Laurent Caumont <lcaumont2(a)gmail.com> media: dvb: i2c transfers over usb cannot be done from stack Daniel Vetter <daniel.vetter(a)ffwll.ch> drm: safely free connectors from connector_iter Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Fix vblank timestamp/frame counter jumps on gen2 Marek Szyprowski <m.szyprowski(a)samsung.com> drm/exynos: gem: Drop NONCONTIG flag for buffers allocated without IOMMU Marek Szyprowski <m.szyprowski(a)samsung.com> drm/bridge: analogix dp: Fix runtime PM state in get_modes() callback Song Liu <songliubraving(a)fb.com> md/r5cache: move mddev_lock() out of r5c_journal_mode_set() Daniel Thompson <daniel.thompson(a)linaro.org> kdb: Fix handling of kallsyms_symbol_next() return value Arend Van Spriel <arend.vanspriel(a)broadcom.com> brcmfmac: change driver unbind order of the sdio function devices David Spinadel <david.spinadel(a)intel.com> iwlwifi: mvm: enable RX offloading with TKIP and WEP Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> iwlwifi: mvm: fix packet injection Ihab Zhaika <ihab.zhaika(a)intel.com> iwlwifi: add new cards for 9260 and 22000 series Johannes Berg <johannes.berg(a)intel.com> iwlwifi: mvm: flush queue before deleting ROC Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> iwlwifi: mvm: don't use transmit queue hang detection when it is not possible Sara Sharon <sara.sharon(a)intel.com> iwlwifi: mvm: mark MIC stripped MPDUs Nicholas Piggin <npiggin(a)gmail.com> powerpc/64s: Initialize ISAv3 MMU registers before setting partition table David Gibson <david(a)gibson.dropbear.id.au> Revert "powerpc: Do not call ppc_md.panic in fadump panic notifier" Janosch Frank <frankja(a)linux.vnet.ibm.com> KVM: s390: Fix skey emulation permission check Heiko Carstens <heiko.carstens(a)de.ibm.com> s390: fix compat system call table Heiko Carstens <heiko.carstens(a)de.ibm.com> s390/mm: fix off-by-one bug in 5-level page table handling Heiko Carstens <heiko.carstens(a)de.ibm.com> s390: always save and restore all registers on context switch Lai Jiangshan <jiangshanlai(a)gmail.com> smp/hotplug: Move step CPUHP_AP_SMPCFD_DYING to the correct place Robin Murphy <robin.murphy(a)arm.com> iommu/vt-d: Fix scatterlist offset handling Jaejoong Kim <climbbb.kim(a)gmail.com> ALSA: usb-audio: Add check return value for usb_string() Jaejoong Kim <climbbb.kim(a)gmail.com> ALSA: usb-audio: Fix out-of-bound error Takashi Iwai <tiwai(a)suse.de> ALSA: seq: Remove spurious WARN_ON() at timer check Robb Glasser <rglasser(a)google.com> ALSA: pcm: prevent UAF in snd_pcm_info Kailang Yang <kailang(a)realtek.com> ALSA: hda/realtek - New codec support for ALC257 Jeff Mahoney <jeffm(a)suse.com> btrfs: handle errors while updating refcounts in update_ref_for_cow Jeff Mahoney <jeffm(a)suse.com> btrfs: fix missing error return in btrfs_drop_snapshot Radim Krčmář <rkrcmar(a)redhat.com> KVM: x86: fix APIC page invalidation Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> x86/PCI: Make broadcom_postcore_init() check acpi_disabled Chunyu Hu <chuhu(a)redhat.com> x86/idt: Load idt early in start_secondary Eric Biggers <ebiggers(a)google.com> X.509: fix comparisons of ->pkey_algo Eric Biggers <ebiggers(a)google.com> X.509: reject invalid BIT STRING for subjectPublicKey Eric Biggers <ebiggers(a)google.com> KEYS: reject NULL restriction string when type is specified Eric Biggers <ebiggers(a)google.com> KEYS: add missing permission check for request_key() destination Eric Biggers <ebiggers(a)google.com> ASN.1: check for error from ASN1_OP_END__ACT actions Eric Biggers <ebiggers(a)google.com> ASN.1: fix out-of-bounds read when parsing indefinite length item Pan Bian <bianpan2016(a)163.com> efi/esrt: Use memunmap() instead of kfree() to free the remapping Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> efi: Move some sysfs files to be read-only by root Huacai Chen <chenhc(a)lemote.com> scsi: libsas: align sata_device's rps_resp on a cacheline Huacai Chen <chenhc(a)lemote.com> scsi: use dma_get_cache_alignment() as minimum DMA alignment Christoph Hellwig <hch(a)lst.de> scsi: dma-mapping: always provide dma_get_cache_alignment William Breathitt Gray <vilhelm.gray(a)gmail.com> isa: Prevent NULL dereference in isa_bus driver callbacks Guenter Roeck <linux(a)roeck-us.net> firmware: vpd: Fix platform driver and device registration/unregistration Guenter Roeck <linux(a)roeck-us.net> firmware: vpd: Tie firmware kobject to device lifetime Guenter Roeck <linux(a)roeck-us.net> firmware: vpd: Destroy vpd sections in remove function Robin H. Johnson <robbat2(a)gentoo.org> firmware: cleanup FIRMWARE_IN_KERNEL message Paul Meyer <Paul.Meyer(a)microsoft.com> hv: kvp: Avoid reading past allocated blocks from KVP file K. Y. Srinivasan <kys(a)microsoft.com> Drivers: hv: vmbus: Fix a rescind issue Gregory CLEMENT <gregory.clement(a)free-electrons.com> pinctrl: armada-37xx: Fix direction_output() callback behavior Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> iio: adc: meson-saradc: Meson8 and Meson8b do not have REG11 and REG13 Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> iio: adc: meson-saradc: initialize the bandgap correctly on older SoCs Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> iio: adc: meson-saradc: fix the bit_idx of the adc_en clock Pan Bian <bianpan2016(a)163.com> iio: adc: cpcap: fix incorrect validation Peter Meerwald-Stadler <pmeerw(a)pmeerw.net> iio: health: max30102: Temperature should be in milli Celsius Arnd Bergmann <arnd(a)arndb.de> iio: stm32: fix adc/trigger link error weiping zhang <zwp10758(a)gmail.com> virtio: release virtio index when fail to device_register Stephane Grosjean <s.grosjean(a)peak-system.com> can: peak/pcie_fd: fix potential bug in restarting tx queue Martin Kelly <mkelly(a)xevo.com> can: usb_8dev: cancel urb on -EPIPE and -EPROTO Martin Kelly <mkelly(a)xevo.com> can: esd_usb2: cancel urb on -EPIPE and -EPROTO Martin Kelly <mkelly(a)xevo.com> can: ems_usb: cancel urb on -EPIPE and -EPROTO Martin Kelly <mkelly(a)xevo.com> can: mcba_usb: cancel urb on -EPROTO Martin Kelly <mkelly(a)xevo.com> can: kvaser_usb: cancel urb on -EPIPE and -EPROTO Jimmy Assarsson <jimmyassarsson(a)gmail.com> can: kvaser_usb: ratelimit errors if incomplete messages are received Jimmy Assarsson <jimmyassarsson(a)gmail.com> can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback() Jimmy Assarsson <jimmyassarsson(a)gmail.com> can: kvaser_usb: free buf in error paths Oliver Stäbler <oliver.staebler(a)bytesatwork.ch> can: ti_hecc: Fix napi poll return value for repoll Marc Kleine-Budde <mkl(a)pengutronix.de> can: flexcan: fix VF610 state transition issue Stephane Grosjean <s.grosjean(a)peak-system.com> can: peak/pci: fix potential bug when probe() fails Martin Kelly <mkelly(a)xevo.com> can: mcba_usb: fix device disconnect bug John Keeping <john(a)metanate.com> usb: f_fs: Force Reserved1=1 in OS_DESC_EXT_COMPAT Johan Hovold <johan(a)kernel.org> serdev: ttyport: fix tty locking in close Johan Hovold <johan(a)kernel.org> serdev: ttyport: fix NULL-deref on hangup Johan Hovold <johan(a)kernel.org> serdev: ttyport: add missing receive_buf sanity checks Roger Quadros <rogerq(a)ti.com> usb: gadget: core: Fix ->udc_set_speed() speed handling Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> usb: gadget: udc: renesas_usb3: fix number of the pipes ------------- Diffstat: .../devicetree/bindings/usb/usb-device.txt | 2 +- Makefile | 25 ++++---- arch/arm/boot/dts/imx53.dtsi | 9 --- arch/arm/include/asm/assembler.h | 18 ++++++ arch/arm/include/asm/kvm_arm.h | 3 +- arch/arm/kernel/entry-header.S | 6 ++ arch/arm64/include/asm/efi.h | 4 +- arch/arm64/include/asm/kvm_arm.h | 3 +- arch/arm64/include/asm/mmu_context.h | 46 +++++++------- arch/arm64/kernel/process.c | 9 +++ arch/powerpc/include/asm/machdep.h | 1 + arch/powerpc/include/asm/setup.h | 1 + arch/powerpc/kernel/cpu_setup_power.S | 2 + arch/powerpc/kernel/fadump.c | 22 ------- arch/powerpc/kernel/setup-common.c | 27 +++++++++ arch/powerpc/platforms/powernv/opal-imc.c | 6 +- arch/powerpc/platforms/ps3/setup.c | 15 +++++ arch/powerpc/platforms/pseries/setup.c | 1 + arch/s390/include/asm/switch_to.h | 27 ++++----- arch/s390/kernel/syscalls.S | 6 +- arch/s390/kvm/priv.c | 11 +++- arch/s390/mm/pgalloc.c | 2 - arch/sparc/mm/init_64.c | 9 ++- arch/x86/include/asm/kvm_host.h | 3 + arch/x86/kernel/cpu/intel_rdt_rdtgroup.c | 10 ++-- arch/x86/kernel/smpboot.c | 2 +- arch/x86/kvm/vmx.c | 5 -- arch/x86/kvm/x86.c | 14 +++++ arch/x86/pci/broadcom_bus.c | 2 +- block/blk-core.c | 5 +- crypto/asymmetric_keys/pkcs7_verify.c | 2 +- crypto/asymmetric_keys/x509_cert_parser.c | 2 + crypto/asymmetric_keys/x509_public_key.c | 2 +- drivers/atm/horizon.c | 2 +- drivers/base/Kconfig | 25 ++++---- drivers/base/isa.c | 10 ++-- drivers/bus/arm-cci.c | 7 ++- drivers/bus/arm-ccn.c | 11 +++- drivers/clk/clk-stm32h7.c | 4 +- drivers/clk/hisilicon/clk-hi3660.c | 2 +- drivers/clk/qcom/common.c | 6 +- drivers/clk/sunxi-ng/ccu-sun8i-a83t.c | 4 +- drivers/clk/uniphier/clk-uniphier-sys.c | 2 +- drivers/cpuidle/cpuidle-powernv.c | 4 +- drivers/crypto/talitos.c | 66 +++++++++++++------- drivers/firmware/efi/efi.c | 3 +- drivers/firmware/efi/esrt.c | 17 +++--- drivers/firmware/efi/runtime-map.c | 10 ++-- drivers/firmware/google/vpd.c | 48 +++++++++++---- drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 2 + drivers/gpu/drm/drm_connector.c | 28 ++++++++- drivers/gpu/drm/drm_mode_config.c | 2 + drivers/gpu/drm/exynos/exynos_drm_gem.c | 9 +++ drivers/gpu/drm/i915/intel_display.c | 51 +++++++++++----- drivers/hv/channel.c | 10 +++- drivers/hv/channel_mgmt.c | 7 ++- drivers/ide/ide-atapi.c | 6 +- drivers/iio/adc/cpcap-adc.c | 2 +- drivers/iio/adc/meson_saradc.c | 52 ++++++++++++---- drivers/iio/health/max30102.c | 2 +- drivers/infiniband/core/security.c | 63 ++++++++++++++----- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 + drivers/infiniband/hw/cxgb4/t4fw_ri_api.h | 4 +- drivers/infiniband/hw/mlx4/qp.c | 2 +- drivers/infiniband/hw/mlx5/main.c | 2 + drivers/iommu/intel-iommu.c | 8 ++- drivers/irqchip/qcom-irq-combiner.c | 2 +- drivers/mailbox/mailbox-test.c | 11 ++-- drivers/md/bitmap.c | 9 +++ drivers/md/dm-raid.c | 21 +++---- drivers/md/raid5-cache.c | 22 +++---- drivers/media/rc/rc-main.c | 32 +++++----- drivers/media/rc/sir_ir.c | 40 +++++++++++-- drivers/media/usb/dvb-usb/dibusb-common.c | 16 ++++- drivers/net/can/flexcan.c | 5 +- drivers/net/can/peak_canfd/peak_canfd.c | 9 +-- drivers/net/can/peak_canfd/peak_pciefd_main.c | 5 +- drivers/net/can/sja1000/peak_pci.c | 5 +- drivers/net/can/ti_hecc.c | 3 + drivers/net/can/usb/ems_usb.c | 2 + drivers/net/can/usb/esd_usb2.c | 2 + drivers/net/can/usb/kvaser_usb.c | 13 ++-- drivers/net/can/usb/mcba_usb.c | 2 + drivers/net/can/usb/usb_8dev.c | 2 + drivers/net/ethernet/netronome/nfp/flower/main.h | 3 +- .../net/ethernet/netronome/nfp/flower/metadata.c | 7 ++- drivers/net/ethernet/netronome/nfp/nfp_net_repr.c | 2 + drivers/net/geneve.c | 24 ++++---- drivers/net/ipvlan/ipvlan_core.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +- drivers/net/wireless/intel/iwlwifi/fw/api/txq.h | 4 ++ drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 4 +- drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 3 + drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 1 + drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 14 ++++- drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 53 ++++++++++++---- .../net/wireless/intel/iwlwifi/mvm/time-event.c | 24 +++++++- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 3 +- drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 11 +++- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 + drivers/net/wireless/mac80211_hwsim.c | 5 +- drivers/net/wireless/rsi/rsi_91x_usb.c | 12 ++-- drivers/nvme/target/rdma.c | 6 +- drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 13 +++- drivers/rapidio/devices/rio_mport_cdev.c | 3 +- drivers/scsi/scsi_lib.c | 10 ++-- drivers/tty/serdev/serdev-ttyport.c | 26 +++++++- drivers/usb/gadget/function/f_fs.c | 13 +++- drivers/usb/gadget/udc/core.c | 8 ++- drivers/usb/gadget/udc/renesas_usb3.c | 2 +- drivers/virtio/virtio.c | 2 + fs/afs/cmservice.c | 3 + fs/afs/rxrpc.c | 13 +++- fs/btrfs/ctree.c | 18 ++++-- fs/btrfs/extent-tree.c | 1 + fs/f2fs/file.c | 1 + fs/fcntl.c | 5 +- fs/nfs/dir.c | 2 +- fs/pipe.c | 2 +- fs/xfs/xfs_inode.c | 1 + include/drm/drm_connector.h | 8 +++ include/linux/dma-mapping.h | 2 - include/linux/genalloc.h | 3 +- include/linux/hyperv.h | 1 + include/linux/iio/timer/stm32-lptim-trigger.h | 5 +- include/linux/sysfs.h | 6 ++ include/scsi/libsas.h | 2 +- kernel/audit.c | 39 ++++++------ kernel/bpf/percpu_freelist.c | 8 ++- kernel/cpu.c | 10 ++-- kernel/debug/kdb/kdb_io.c | 2 +- kernel/jump_label.c | 2 +- kernel/sysctl.c | 2 +- lib/asn1_decoder.c | 49 ++++++++------- lib/dynamic_debug.c | 4 ++ lib/genalloc.c | 10 ++-- mm/slub.c | 4 ++ mm/zsmalloc.c | 2 +- net/ipv4/route.c | 14 +++-- net/ipv6/ip6_gre.c | 2 +- net/sctp/socket.c | 38 ++++++++---- net/smc/smc_core.c | 2 +- net/sunrpc/sched.c | 3 +- net/tls/tls_sw.c | 2 +- net/xfrm/xfrm_policy.c | 1 + scripts/coccicheck | 15 +++-- scripts/package/Makefile | 9 ++- security/apparmor/policy.c | 3 +- security/keys/keyctl.c | 24 ++++---- security/keys/request_key.c | 46 +++++++++++--- sound/core/pcm.c | 2 + sound/core/seq/seq_timer.c | 2 +- sound/pci/hda/patch_realtek.c | 8 +++ sound/usb/mixer.c | 13 ++-- tools/hv/hv_kvp_daemon.c | 70 +++++----------------- tools/testing/selftests/x86/mpx-hw.h | 4 +- virt/kvm/arm/hyp/vgic-v2-sr.c | 4 -- virt/kvm/arm/vgic/vgic-irqfd.c | 3 +- virt/kvm/arm/vgic/vgic-its.c | 2 + virt/kvm/arm/vgic/vgic-v3.c | 2 +- virt/kvm/kvm_main.c | 8 +++ 162 files changed, 1132 insertions(+), 586 deletions(-)

7 years, 6 months

7
173
0 0

[Linux-stable-mirror] [PATCH v2] gpio: fix "gpio-line-names" property retrieval

by chleroy

Following commit 9427ecbed46cc ("gpio: Rework of_gpiochip_set_names() to use device property accessors"), "gpio-line-names" DT property is not retrieved anymore when chip->parent is not set by the driver. This is due to OF based property reads having been replaced by device based property reads. This patch fixes that by making use of fwnode_property_read_string_array() instead of device_property_read_string_array() and handing over either of_fwnode_handle(chip->of_node) or dev_fwnode(chip->parent) to that function. Fixes: 9427ecbed46cc ("gpio: Rework of_gpiochip_set_names() to use device property accessors") Cc: stable(a)vger.kernel.org Signed-off-by: Christophe Leroy <christophe.leroy(a)c-s.fr> --- drivers/gpio/gpiolib-acpi.c | 2 +- drivers/gpio/gpiolib-devprop.c | 17 +++++++---------- drivers/gpio/gpiolib-of.c | 3 ++- drivers/gpio/gpiolib.h | 3 ++- 4 files changed, 12 insertions(+), 13 deletions(-) diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c index eb4528c87c0b..d6f3d9ee1350 100644 --- a/drivers/gpio/gpiolib-acpi.c +++ b/drivers/gpio/gpiolib-acpi.c @@ -1074,7 +1074,7 @@ void acpi_gpiochip_add(struct gpio_chip *chip) } if (!chip->names) - devprop_gpiochip_set_names(chip); + devprop_gpiochip_set_names(chip, dev_fwnode(chip->parent)); acpi_gpiochip_request_regions(acpi_gpio); acpi_gpiochip_scan_gpios(acpi_gpio); diff --git a/drivers/gpio/gpiolib-devprop.c b/drivers/gpio/gpiolib-devprop.c index 27f383bda7d9..f748aa3e77f7 100644 --- a/drivers/gpio/gpiolib-devprop.c +++ b/drivers/gpio/gpiolib-devprop.c @@ -19,30 +19,27 @@ /** * devprop_gpiochip_set_names - Set GPIO line names using device properties * @chip: GPIO chip whose lines should be named, if possible + * @fwnode: Property Node containing the gpio-line-names property * * Looks for device property "gpio-line-names" and if it exists assigns * GPIO line names for the chip. The memory allocated for the assigned * names belong to the underlying firmware node and should not be released * by the caller. */ -void devprop_gpiochip_set_names(struct gpio_chip *chip) +void devprop_gpiochip_set_names(struct gpio_chip *chip, + const struct fwnode_handle *fwnode) { struct gpio_device *gdev = chip->gpiodev; const char **names; int ret, i; - if (!chip->parent) { - dev_warn(&gdev->dev, "GPIO chip parent is NULL\n"); - return; - } - - ret = device_property_read_string_array(chip->parent, "gpio-line-names", + ret = fwnode_property_read_string_array(fwnode, "gpio-line-names", NULL, 0); if (ret < 0) return; if (ret != gdev->ngpio) { - dev_warn(chip->parent, + dev_warn(&gdev->dev, "names %d do not match number of GPIOs %d\n", ret, gdev->ngpio); return; @@ -52,10 +49,10 @@ void devprop_gpiochip_set_names(struct gpio_chip *chip) if (!names) return; - ret = device_property_read_string_array(chip->parent, "gpio-line-names", + ret = fwnode_property_read_string_array(fwnode, "gpio-line-names", names, gdev->ngpio); if (ret < 0) { - dev_warn(chip->parent, "failed to read GPIO line names\n"); + dev_warn(&gdev->dev, "failed to read GPIO line names\n"); kfree(names); return; } diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c index e0d59e61b52f..72a0695d2ac3 100644 --- a/drivers/gpio/gpiolib-of.c +++ b/drivers/gpio/gpiolib-of.c @@ -493,7 +493,8 @@ int of_gpiochip_add(struct gpio_chip *chip) /* If the chip defines names itself, these take precedence */ if (!chip->names) - devprop_gpiochip_set_names(chip); + devprop_gpiochip_set_names(chip, + of_fwnode_handle(chip->of_node)); of_node_get(chip->of_node); diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h index af48322839c3..6c44d1652139 100644 --- a/drivers/gpio/gpiolib.h +++ b/drivers/gpio/gpiolib.h @@ -228,7 +228,8 @@ static inline int gpio_chip_hwgpio(const struct gpio_desc *desc) return desc - &desc->gdev->descs[0]; } -void devprop_gpiochip_set_names(struct gpio_chip *chip); +void devprop_gpiochip_set_names(struct gpio_chip *chip, + const struct fwnode_handle *fwnode); /* With descriptor prefix */ -- 2.13.3

7 years, 6 months

1
0
0 0

[Linux-stable-mirror] [PATCH v2] PCI: keystone: fix interrupt-controller-node lookup

by Johan Hovold

Fix child-node lookup during initialisation which was using the wrong OF-helper and ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children. To make things worse, the parent pci node could end up being prematurely freed as of_find_node_by_name() drops a reference to its first argument. Any matching child interrupt-controller node was also leaked. Fixes: 0c4ffcfe1fbc ("PCI: keystone: Add TI Keystone PCIe driver") Cc: stable <stable(a)vger.kernel.org> # 3.18 Acked-by: Murali Karicheri <m-karicheri2(a)ti.com> Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi(a)arm.com> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- v2 - amend commit message and mention explicitly that of_find_node_by_name() drops a reference to the start node - add Murali's and Lorenzo's acks drivers/pci/dwc/pci-keystone.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/pci/dwc/pci-keystone.c b/drivers/pci/dwc/pci-keystone.c index 5bee3af47588..39405598b22d 100644 --- a/drivers/pci/dwc/pci-keystone.c +++ b/drivers/pci/dwc/pci-keystone.c @@ -178,7 +178,7 @@ static int ks_pcie_get_irq_controller_info(struct keystone_pcie *ks_pcie, } /* interrupt controller is in a child node */ - *np_temp = of_find_node_by_name(np_pcie, controller); + *np_temp = of_get_child_by_name(np_pcie, controller); if (!(*np_temp)) { dev_err(dev, "Node for %s is absent\n", controller); return -EINVAL; @@ -187,6 +187,7 @@ static int ks_pcie_get_irq_controller_info(struct keystone_pcie *ks_pcie, temp = of_irq_count(*np_temp); if (!temp) { dev_err(dev, "No IRQ entries in %s\n", controller); + of_node_put(*np_temp); return -EINVAL; } @@ -204,6 +205,8 @@ static int ks_pcie_get_irq_controller_info(struct keystone_pcie *ks_pcie, break; } + of_node_put(*np_temp); + if (temp) { *num_irqs = temp; return 0; -- 2.15.0

7 years, 6 months

3
6
0 0

[Linux-stable-mirror] [PATCH] mm: save/restore current->journal_info in handle_mm_fault

by Yan, Zheng

We recently got an Oops report: BUG: unable to handle kernel NULL pointer dereference at (null) IP: jbd2__journal_start+0x38/0x1a2 [...] Call Trace: ext4_page_mkwrite+0x307/0x52b _ext4_get_block+0xd8/0xd8 do_page_mkwrite+0x6e/0xd8 handle_mm_fault+0x686/0xf9b mntput_no_expire+0x1f/0x21e __do_page_fault+0x21d/0x465 dput+0x4a/0x2f7 page_fault+0x22/0x30 copy_user_generic_string+0x2c/0x40 copy_page_to_iter+0x8c/0x2b8 generic_file_read_iter+0x26e/0x845 timerqueue_del+0x31/0x90 ceph_read_iter+0x697/0xa33 [ceph] hrtimer_cancel+0x23/0x41 futex_wait+0x1c8/0x24d get_futex_key+0x32c/0x39a __vfs_read+0xe0/0x130 vfs_read.part.1+0x6c/0x123 handle_mm_fault+0x831/0xf9b __fget+0x7e/0xbf SyS_read+0x4d/0xb5 ceph_read_iter() uses current->journal_info to pass context info to ceph_readpages(). Because ceph_readpages() needs to know if its caller has already gotten capability of using page cache (distinguish read from readahead/fadvise). ceph_read_iter() set current->journal_info, then calls generic_file_read_iter(). In above Oops, page fault happened when copying data to userspace. Page fault handler called ext4_page_mkwrite(). Ext4 code read current->journal_info and assumed it is journal handle. I checked other filesystems, btrfs probably suffers similar problem for its readpage. (page fault happens when write() copies data from userspace memory and the memory is mapped to a file in btrfs. verify_parent_transid() can be called during readpage) Cc: stable(a)vger.kernel.org Signed-off-by: "Yan, Zheng" <zyan(a)redhat.com> --- mm/memory.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/mm/memory.c b/mm/memory.c index a728bed16c20..db2a50233c49 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -4044,6 +4044,7 @@ int handle_mm_fault(struct vm_area_struct *vma, unsigned long address, unsigned int flags) { int ret; + void *old_journal_info; __set_current_state(TASK_RUNNING); @@ -4065,11 +4066,24 @@ int handle_mm_fault(struct vm_area_struct *vma, unsigned long address, if (flags & FAULT_FLAG_USER) mem_cgroup_oom_enable(); + /* + * Fault can happen when filesystem A's read_iter()/write_iter() + * copies data to/from userspace. Filesystem A may have set + * current->journal_info. If the userspace memory is MAP_SHARED + * mapped to a file in filesystem B, we later may call filesystem + * B's vm operation. Filesystem B may also want to read/set + * current->journal_info. + */ + old_journal_info = current->journal_info; + current->journal_info = NULL; + if (unlikely(is_vm_hugetlb_page(vma))) ret = hugetlb_fault(vma->vm_mm, vma, address, flags); else ret = __handle_mm_fault(vma, address, flags); + current->journal_info = old_journal_info; + if (flags & FAULT_FLAG_USER) { mem_cgroup_oom_disable(); /* -- 2.13.6

7 years, 6 months

4
6
0 0

[Linux-stable-mirror] [PATCH] mac80211: Fix addition of mesh configuration element

by Richard Schütz

From: Ilan peer <ilan.peer(a)intel.com> commit 57629915d568c522ac1422df7bba4bee5b5c7a7c upstream. The code was setting the capabilities byte to zero, after it was already properly set previously. Fix it. The bug was found while debugging hwsim mesh tests failures that happened since the commit mentioned below. Fixes: 76f43b4c0a93 ("mac80211: Remove invalid flag operations in mesh TSF synchronization") Signed-off-by: Ilan Peer <ilan.peer(a)intel.com> Reviewed-by: Masashi Honma <masashi.honma(a)gmail.com> Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Richard Schütz <rschuetz(a)uni-koblenz.de> --- net/mac80211/mesh.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c index cc2a63bd233f..9c23172feba0 100644 --- a/net/mac80211/mesh.c +++ b/net/mac80211/mesh.c @@ -279,8 +279,6 @@ int mesh_add_meshconf_ie(struct ieee80211_sub_if_data *sdata, /* Mesh PS mode. See IEEE802.11-2012 8.4.2.100.8 */ *pos |= ifmsh->ps_peers_deep_sleep ? IEEE80211_MESHCONF_CAPAB_POWER_SAVE_LEVEL : 0x00; - *pos++ = 0x00; - return 0; } -- 2.15.1

7 years, 6 months

2
1
0 0

[Linux-stable-mirror] [PATCH] gpio: fix "gpio-line-names" property retrieval

by Christophe Leroy

Following commit 9427ecbed46cc ("gpio: Rework of_gpiochip_set_names() to use device property accessors"), "gpio-line-names" DT property is not retrieved anymore when chip->parent is not set by the driver. This patch fixes that. Fixes: 9427ecbed46cc ("gpio: Rework of_gpiochip_set_names() to use device property accessors") Cc: stable(a)vger.kernel.org Signed-off-by: Christophe Leroy <christophe.leroy(a)c-s.fr> --- drivers/gpio/gpiolib-devprop.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/gpio/gpiolib-devprop.c b/drivers/gpio/gpiolib-devprop.c index 27f383bda7d9..310dbc451a85 100644 --- a/drivers/gpio/gpiolib-devprop.c +++ b/drivers/gpio/gpiolib-devprop.c @@ -30,20 +30,24 @@ void devprop_gpiochip_set_names(struct gpio_chip *chip) struct gpio_device *gdev = chip->gpiodev; const char **names; int ret, i; + struct device *dev; - if (!chip->parent) { + if (chip->parent) { + dev = chip->parent; + } else if (gdev->dev.of_node) { + dev = &gdev->dev; + } else { dev_warn(&gdev->dev, "GPIO chip parent is NULL\n"); return; } - ret = device_property_read_string_array(chip->parent, "gpio-line-names", + ret = device_property_read_string_array(dev, "gpio-line-names", NULL, 0); if (ret < 0) return; if (ret != gdev->ngpio) { - dev_warn(chip->parent, - "names %d do not match number of GPIOs %d\n", ret, + dev_warn(dev, "names %d do not match number of GPIOs %d\n", ret, gdev->ngpio); return; } @@ -52,10 +56,10 @@ void devprop_gpiochip_set_names(struct gpio_chip *chip) if (!names) return; - ret = device_property_read_string_array(chip->parent, "gpio-line-names", + ret = device_property_read_string_array(dev, "gpio-line-names", names, gdev->ngpio); if (ret < 0) { - dev_warn(chip->parent, "failed to read GPIO line names\n"); + dev_warn(dev, "failed to read GPIO line names\n"); kfree(names); return; } -- 2.13.3

7 years, 6 months

2
1
0 0

[Linux-stable-mirror] [PATCH] mmc: renesas_sdhi: Add MODULE_LICENSE

by Yoshihiro Shimoda

From: Masaharu Hayakawa <masaharu.hayakawa.ry(a)renesas.com> The following error occurs when loading renesas_sdhi_core.c module, so add MODULE_LICENSE("GPL v2"). renesas_sdhi_core: module license 'unspecified' taints kernel. Signed-off-by: Masaharu Hayakawa <masaharu.hayakawa.ry(a)renesas.com> Fixes: 9d08428afb72 ("mmc: renesas-sdhi: make renesas_sdhi_sys_dmac main module file") Cc: <stable(a)vger.kernel.org> # v4.13+ [Shimoda: Added Fixes tag and Cc to the stable ML] Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> --- drivers/mmc/host/renesas_sdhi_core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c index fcf7235..157e1d9 100644 --- a/drivers/mmc/host/renesas_sdhi_core.c +++ b/drivers/mmc/host/renesas_sdhi_core.c @@ -24,6 +24,7 @@ #include <linux/kernel.h> #include <linux/clk.h> #include <linux/slab.h> +#include <linux/module.h> #include <linux/of_device.h> #include <linux/platform_device.h> #include <linux/mmc/host.h> @@ -667,3 +668,5 @@ int renesas_sdhi_remove(struct platform_device *pdev) return 0; } EXPORT_SYMBOL_GPL(renesas_sdhi_remove); + +MODULE_LICENSE("GPL v2"); -- 1.9.1

7 years, 6 months

3
2
0 0

[Linux-stable-mirror] Patch "media: dvb-core: always call invoke_release() in fe_free()" has been added to the 4.14-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled media: dvb-core: always call invoke_release() in fe_free() to the 4.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: media-dvb-core-always-call-invoke_release-in-fe_free.patch and it can be found in the queue-4.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From 62229de19ff2b7f3e0ebf4d48ad99061127d0281 Mon Sep 17 00:00:00 2001 From: Daniel Scheller <d.scheller(a)gmx.net> Date: Sun, 29 Oct 2017 11:43:22 -0400 Subject: media: dvb-core: always call invoke_release() in fe_free() From: Daniel Scheller <d.scheller(a)gmx.net> commit 62229de19ff2b7f3e0ebf4d48ad99061127d0281 upstream. Follow-up to: ead666000a5f ("media: dvb_frontend: only use kref after initialized") The aforementioned commit fixed refcount OOPSes when demod driver attaching succeeded but tuner driver didn't. However, the use count of the attached demod drivers don't go back to zero and thus couldn't be cleanly unloaded. Improve on this by calling dvb_frontend_invoke_release() in __dvb_frontend_free() regardless of fepriv being NULL, instead of returning when fepriv is NULL. This is safe to do since _invoke_release() will check for passed pointers being valid before calling the .release() function. [mchehab(a)s-opensource.com: changed the logic a little bit to reduce conflicts with another bug fix patch under review] Fixes: ead666000a5f ("media: dvb_frontend: only use kref after initialized") Signed-off-by: Daniel Scheller <d.scheller(a)gmx.net> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)s-opensource.com> Cc: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/media/dvb-core/dvb_frontend.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@ -145,13 +145,14 @@ static void __dvb_frontend_free(struct d { struct dvb_frontend_private *fepriv = fe->frontend_priv; - if (!fepriv) - return; - - dvb_free_device(fepriv->dvbdev); + if (fepriv) + dvb_free_device(fepriv->dvbdev); dvb_frontend_invoke_release(fe, fe->ops.release); + if (!fepriv) + return; + kfree(fepriv); fe->frontend_priv = NULL; } Patches currently in stable-queue which might be from d.scheller(a)gmx.net are queue-4.14/media-dvb-core-always-call-invoke_release-in-fe_free.patch

7 years, 6 months

1
0
0 0

[Linux-stable-mirror] Patch "dvb_frontend: don't use-after-free the frontend struct" has been added to the 4.14-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled dvb_frontend: don't use-after-free the frontend struct to the 4.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: dvb_frontend-don-t-use-after-free-the-frontend-struct.patch and it can be found in the queue-4.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From b1cb7372fa822af6c06c8045963571d13ad6348b Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab <mchehab(a)s-opensource.com> Date: Tue, 7 Nov 2017 08:39:39 -0500 Subject: dvb_frontend: don't use-after-free the frontend struct From: Mauro Carvalho Chehab <mchehab(a)s-opensource.com> commit b1cb7372fa822af6c06c8045963571d13ad6348b upstream. dvb_frontend_invoke_release() may free the frontend struct. So, the free logic can't update it anymore after calling it. That's OK, as __dvb_frontend_free() is called only when the krefs are zeroed, so nobody is using it anymore. That should fix the following KASAN error: The KASAN report looks like this (running on kernel 3e0cc09a3a2c40ec1ffb6b4e12da86e98feccb11 (4.14-rc5+)): ================================================================== BUG: KASAN: use-after-free in __dvb_frontend_free+0x113/0x120 Write of size 8 at addr ffff880067d45a00 by task kworker/0:1/24 CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.14.0-rc5-43687-g06ab8a23e0e6 #545 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:16 dump_stack+0x292/0x395 lib/dump_stack.c:52 print_address_description+0x78/0x280 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 kasan_report+0x23d/0x350 mm/kasan/report.c:409 __asan_report_store8_noabort+0x1c/0x20 mm/kasan/report.c:435 __dvb_frontend_free+0x113/0x120 drivers/media/dvb-core/dvb_frontend.c:156 dvb_frontend_put+0x59/0x70 drivers/media/dvb-core/dvb_frontend.c:176 dvb_frontend_detach+0x120/0x150 drivers/media/dvb-core/dvb_frontend.c:2803 dvb_usb_adapter_frontend_exit+0xd6/0x160 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:340 dvb_usb_adapter_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:116 dvb_usb_exit+0x9b/0x200 drivers/media/usb/dvb-usb/dvb-usb-init.c:132 dvb_usb_device_exit+0xa5/0xf0 drivers/media/usb/dvb-usb/dvb-usb-init.c:295 usb_unbind_interface+0x21c/0xa90 drivers/usb/core/driver.c:423 __device_release_driver drivers/base/dd.c:861 device_release_driver_internal+0x4f1/0x5c0 drivers/base/dd.c:893 device_release_driver+0x1e/0x30 drivers/base/dd.c:918 bus_remove_device+0x2f4/0x4b0 drivers/base/bus.c:565 device_del+0x5c4/0xab0 drivers/base/core.c:1985 usb_disable_device+0x1e9/0x680 drivers/usb/core/message.c:1170 usb_disconnect+0x260/0x7a0 drivers/usb/core/hub.c:2124 hub_port_connect drivers/usb/core/hub.c:4754 hub_port_connect_change drivers/usb/core/hub.c:5009 port_event drivers/usb/core/hub.c:5115 hub_event+0x1318/0x3740 drivers/usb/core/hub.c:5195 process_one_work+0xc73/0x1d90 kernel/workqueue.c:2119 worker_thread+0x221/0x1850 kernel/workqueue.c:2253 kthread+0x363/0x440 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431 Allocated by task 24: save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551 kmem_cache_alloc_trace+0x11e/0x2d0 mm/slub.c:2772 kmalloc ./include/linux/slab.h:493 kzalloc ./include/linux/slab.h:666 dtt200u_fe_attach+0x4c/0x110 drivers/media/usb/dvb-usb/dtt200u-fe.c:212 dtt200u_frontend_attach+0x35/0x80 drivers/media/usb/dvb-usb/dtt200u.c:136 dvb_usb_adapter_frontend_init+0x32b/0x660 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:286 dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:86 dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:162 dvb_usb_device_init+0xf73/0x17f0 drivers/media/usb/dvb-usb/dvb-usb-init.c:277 dtt200u_usb_probe+0xa1/0xe0 drivers/media/usb/dvb-usb/dtt200u.c:155 usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26b/0x3c0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932 generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174 usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26b/0x3c0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457 hub_port_connect drivers/usb/core/hub.c:4903 hub_port_connect_change drivers/usb/core/hub.c:5009 port_event drivers/usb/core/hub.c:5115 hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195 process_one_work+0xc73/0x1d90 kernel/workqueue.c:2119 worker_thread+0x221/0x1850 kernel/workqueue.c:2253 kthread+0x363/0x440 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431 Freed by task 24: save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:524 slab_free_hook mm/slub.c:1390 slab_free_freelist_hook mm/slub.c:1412 slab_free mm/slub.c:2988 kfree+0xf6/0x2f0 mm/slub.c:3919 dtt200u_fe_release+0x3c/0x50 drivers/media/usb/dvb-usb/dtt200u-fe.c:202 dvb_frontend_invoke_release.part.13+0x1c/0x30 drivers/media/dvb-core/dvb_frontend.c:2790 dvb_frontend_invoke_release drivers/media/dvb-core/dvb_frontend.c:2789 __dvb_frontend_free+0xad/0x120 drivers/media/dvb-core/dvb_frontend.c:153 dvb_frontend_put+0x59/0x70 drivers/media/dvb-core/dvb_frontend.c:176 dvb_frontend_detach+0x120/0x150 drivers/media/dvb-core/dvb_frontend.c:2803 dvb_usb_adapter_frontend_exit+0xd6/0x160 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:340 dvb_usb_adapter_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:116 dvb_usb_exit+0x9b/0x200 drivers/media/usb/dvb-usb/dvb-usb-init.c:132 dvb_usb_device_exit+0xa5/0xf0 drivers/media/usb/dvb-usb/dvb-usb-init.c:295 usb_unbind_interface+0x21c/0xa90 drivers/usb/core/driver.c:423 __device_release_driver drivers/base/dd.c:861 device_release_driver_internal+0x4f1/0x5c0 drivers/base/dd.c:893 device_release_driver+0x1e/0x30 drivers/base/dd.c:918 bus_remove_device+0x2f4/0x4b0 drivers/base/bus.c:565 device_del+0x5c4/0xab0 drivers/base/core.c:1985 usb_disable_device+0x1e9/0x680 drivers/usb/core/message.c:1170 usb_disconnect+0x260/0x7a0 drivers/usb/core/hub.c:2124 hub_port_connect drivers/usb/core/hub.c:4754 hub_port_connect_change drivers/usb/core/hub.c:5009 port_event drivers/usb/core/hub.c:5115 hub_event+0x1318/0x3740 drivers/usb/core/hub.c:5195 process_one_work+0xc73/0x1d90 kernel/workqueue.c:2119 worker_thread+0x221/0x1850 kernel/workqueue.c:2253 kthread+0x363/0x440 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431 The buggy address belongs to the object at ffff880067d45500 which belongs to the cache kmalloc-2048 of size 2048 The buggy address is located 1280 bytes inside of 2048-byte region [ffff880067d45500, ffff880067d45d00) The buggy address belongs to the page: page:ffffea00019f5000 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 flags: 0x100000000008100(slab|head) raw: 0100000000008100 0000000000000000 0000000000000000 00000001000f000f raw: dead000000000100 dead000000000200 ffff88006c002d80 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff880067d45900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff880067d45980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff880067d45a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff880067d45a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff880067d45b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fixes: ead666000a5f ("media: dvb_frontend: only use kref after initialized") Reported-by: Andrey Konovalov <andreyknvl(a)google.com> Suggested-by: Matthias Schwarzott <zzam(a)gentoo.org> Tested-by: Andrey Konovalov <andreyknvl(a)google.com> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)s-opensource.com> Cc: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/media/dvb-core/dvb_frontend.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@ -150,11 +150,8 @@ static void __dvb_frontend_free(struct d dvb_frontend_invoke_release(fe, fe->ops.release); - if (!fepriv) - return; - - kfree(fepriv); - fe->frontend_priv = NULL; + if (fepriv) + kfree(fepriv); } static void dvb_frontend_free(struct kref *ref) Patches currently in stable-queue which might be from mchehab(a)s-opensource.com are queue-4.14/media-dvb-core-always-call-invoke_release-in-fe_free.patch queue-4.14/dvb_frontend-don-t-use-after-free-the-frontend-struct.patch

7 years, 6 months

1
0
0 0

[Linux-stable-mirror] Stable patches for v4.14:dvb_frontend

by Guenter Roeck

Hi Greg, please apply the following two patches to v4.14-stable. 62229de19ff2 media: dvb-core: always call invoke_release() in fe_free() b1cb7372fa82 dvb_frontend: don't use-after-free the frontend struct The first patch fixes a bug and avoids a conflict when applying the second patch, and the second patch fixes CVE-2017-16648. My apologies for the noise if the patches are already queued. Thanks, Guenter

7 years, 6 months

2
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror