The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 18dfb5326370991c81a6d1ed6d1aeee055cb8c05 Mon Sep 17 00:00:00 2001
From: Mathieu Othacehe <m.othacehe(a)gmail.com>
Date: Sun, 3 May 2020 11:29:55 +0200
Subject: [PATCH] iio: vcnl4000: Fix i2c swapped word reading.
The bytes returned by the i2c reading need to be swapped
unconditionally. Otherwise, on be16 platforms, an incorrect value will be
returned.
Taking the slow path via next merge window as its been around a while
and we have a patch set dependent on this which would be held up.
Fixes: 62a1efb9f868 ("iio: add vcnl4000 combined ALS and proximity sensor")
Signed-off-by: Mathieu Othacehe <m.othacehe(a)gmail.com>
Cc: <Stable(a)vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
diff --git a/drivers/iio/light/vcnl4000.c b/drivers/iio/light/vcnl4000.c
index 985cc39ede8e..979746a7d411 100644
--- a/drivers/iio/light/vcnl4000.c
+++ b/drivers/iio/light/vcnl4000.c
@@ -220,7 +220,6 @@ static int vcnl4000_measure(struct vcnl4000_data *data, u8 req_mask,
u8 rdy_mask, u8 data_reg, int *val)
{
int tries = 20;
- __be16 buf;
int ret;
mutex_lock(&data->vcnl4000_lock);
@@ -247,13 +246,12 @@ static int vcnl4000_measure(struct vcnl4000_data *data, u8 req_mask,
goto fail;
}
- ret = i2c_smbus_read_i2c_block_data(data->client,
- data_reg, sizeof(buf), (u8 *) &buf);
+ ret = i2c_smbus_read_word_swapped(data->client, data_reg);
if (ret < 0)
goto fail;
mutex_unlock(&data->vcnl4000_lock);
- *val = be16_to_cpu(buf);
+ *val = ret;
return 0;
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 18dfb5326370991c81a6d1ed6d1aeee055cb8c05 Mon Sep 17 00:00:00 2001
From: Mathieu Othacehe <m.othacehe(a)gmail.com>
Date: Sun, 3 May 2020 11:29:55 +0200
Subject: [PATCH] iio: vcnl4000: Fix i2c swapped word reading.
The bytes returned by the i2c reading need to be swapped
unconditionally. Otherwise, on be16 platforms, an incorrect value will be
returned.
Taking the slow path via next merge window as its been around a while
and we have a patch set dependent on this which would be held up.
Fixes: 62a1efb9f868 ("iio: add vcnl4000 combined ALS and proximity sensor")
Signed-off-by: Mathieu Othacehe <m.othacehe(a)gmail.com>
Cc: <Stable(a)vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
diff --git a/drivers/iio/light/vcnl4000.c b/drivers/iio/light/vcnl4000.c
index 985cc39ede8e..979746a7d411 100644
--- a/drivers/iio/light/vcnl4000.c
+++ b/drivers/iio/light/vcnl4000.c
@@ -220,7 +220,6 @@ static int vcnl4000_measure(struct vcnl4000_data *data, u8 req_mask,
u8 rdy_mask, u8 data_reg, int *val)
{
int tries = 20;
- __be16 buf;
int ret;
mutex_lock(&data->vcnl4000_lock);
@@ -247,13 +246,12 @@ static int vcnl4000_measure(struct vcnl4000_data *data, u8 req_mask,
goto fail;
}
- ret = i2c_smbus_read_i2c_block_data(data->client,
- data_reg, sizeof(buf), (u8 *) &buf);
+ ret = i2c_smbus_read_word_swapped(data->client, data_reg);
if (ret < 0)
goto fail;
mutex_unlock(&data->vcnl4000_lock);
- *val = be16_to_cpu(buf);
+ *val = ret;
return 0;
From: Eric Biggers <ebiggers(a)google.com>
If the dentry name passed to ->d_compare() fits in dentry::d_iname, then
it may be concurrently modified by a rename. This can cause undefined
behavior (possibly out-of-bounds memory accesses or crashes) in
utf8_strncasecmp(), since fs/unicode/ isn't written to handle strings
that may be concurrently modified.
Fix this by first copying the filename to a stack buffer if needed.
This way we get a stable snapshot of the filename.
Fixes: 2c2eb7a300cd ("f2fs: Support case-insensitive file name lookups")
Cc: <stable(a)vger.kernel.org> # v5.4+
Cc: Al Viro <viro(a)zeniv.linux.org.uk>
Cc: Daniel Rosenberg <drosen(a)google.com>
Cc: Gabriel Krisman Bertazi <krisman(a)collabora.co.uk>
Signed-off-by: Eric Biggers <ebiggers(a)google.com>
---
v2: Use memcpy() + barrier() instead of a byte-by-byte copy.
Also rebased onto f2fs/dev.
fs/f2fs/dir.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index 29f70f2295cce..d35976785e8c5 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -1114,11 +1114,27 @@ static int f2fs_d_compare(const struct dentry *dentry, unsigned int len,
const struct inode *dir = READ_ONCE(parent->d_inode);
const struct f2fs_sb_info *sbi = F2FS_SB(dentry->d_sb);
struct qstr entry = QSTR_INIT(str, len);
+ char strbuf[DNAME_INLINE_LEN];
int res;
if (!dir || !IS_CASEFOLDED(dir))
goto fallback;
+ /*
+ * If the dentry name is stored in-line, then it may be concurrently
+ * modified by a rename. If this happens, the VFS will eventually retry
+ * the lookup, so it doesn't matter what ->d_compare() returns.
+ * However, it's unsafe to call utf8_strncasecmp() with an unstable
+ * string. Therefore, we have to copy the name into a temporary buffer.
+ */
+ if (len <= DNAME_INLINE_LEN - 1) {
+ memcpy(strbuf, str, len);
+ strbuf[len] = 0;
+ entry.name = strbuf;
+ /* prevent compiler from optimizing out the temporary buffer */
+ barrier();
+ }
+
res = utf8_strncasecmp(sbi->s_encoding, name, &entry);
if (res >= 0)
return res;
--
2.26.2
The patch titled
Subject: nilfs2: fix null pointer dereference at nilfs_segctor_do_construct()
has been added to the -mm tree. Its filename is
nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/nilfs2-fix-null-pointer-dereferenc…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/nilfs2-fix-null-pointer-dereferenc…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Subject: nilfs2: fix null pointer dereference at nilfs_segctor_do_construct()
After commit c3aab9a0bd91 ("mm/filemap.c: don't initiate writeback if
mapping has no dirty pages"), the following null pointer dereference has
been reported on nilfs2:
BUG: kernel NULL pointer dereference, address: 00000000000000a8
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
...
RIP: 0010:percpu_counter_add_batch+0xa/0x60
...
Call Trace:
__test_set_page_writeback+0x2d3/0x330
nilfs_segctor_do_construct+0x10d3/0x2110 [nilfs2]
nilfs_segctor_construct+0x168/0x260 [nilfs2]
nilfs_segctor_thread+0x127/0x3b0 [nilfs2]
kthread+0xf8/0x130
...
This crash turned out to be caused by set_page_writeback() call for
segment summary buffers at nilfs_segctor_prepare_write().
set_page_writeback() can call inc_wb_stat(inode_to_wb(inode),
WB_WRITEBACK) where inode_to_wb(inode) is NULL if the inode of
underlying block device does not have an associated wb.
This fixes the issue by calling inode_attach_wb() in advance to ensure
to associate the bdev inode with its wb.
Link: http://lkml.kernel.org/r/20200608.011819.1399059588922299158.konishi.ryusuk…
Fixes: c3aab9a0bd91 ("mm/filemap.c: don't initiate writeback if mapping has no dirty pages")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Reported-by: Walton Hoops <me(a)waltonhoops.com>
Reported-by: Tomas Hlavaty <tom(a)logand.com>
Reported-by: ARAI Shun-ichi <hermes(a)ceres.dti.ne.jp>
Reported-by: Hideki EIRAKU <hdk1983(a)gmail.com>
Cc: <stable(a)vger.kernel.org> [5.4+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/nilfs2/segment.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/nilfs2/segment.c~nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct
+++ a/fs/nilfs2/segment.c
@@ -2780,6 +2780,8 @@ int nilfs_attach_log_writer(struct super
if (!nilfs->ns_writer)
return -ENOMEM;
+ inode_attach_wb(nilfs->ns_bdev->bd_inode, NULL);
+
err = nilfs_segctor_start_thread(nilfs->ns_writer);
if (err) {
kfree(nilfs->ns_writer);
_
Patches currently in -mm which might be from konishi.ryusuke(a)gmail.com are
nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch
This is the start of the stable review cycle for the 5.7.1 release.
There are 14 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 07 Jun 2020 13:54:56 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.7.1-rc1.…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.7.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.7.1-rc1
Dan Carpenter <dan.carpenter(a)oracle.com>
airo: Fix read overflows sending packets
DENG Qingfang <dqfext(a)gmail.com>
net: dsa: mt7530: set CPU port to fallback mode
Sakari Ailus <sakari.ailus(a)linux.intel.com>
media: staging: ipu3-imgu: Move alignment attribute to field
Sakari Ailus <sakari.ailus(a)linux.intel.com>
media: Revert "staging: imgu: Address a compiler warning on alignment"
Jérôme Pouiller <jerome.pouiller(a)silabs.com>
mmc: fix compilation of user API
Daniel Axtens <dja(a)axtens.net>
kernel/relay.c: handle alloc_percpu returning NULL in relay_open
Herbert Xu <herbert(a)gondor.apana.org.au>
crypto: api - Fix use-after-free and race in crypto_spawn_alg
Matthew Garrett <matthewgarrett(a)google.com>
mt76: mt76x02u: Add support for newer versions of the XBox One wifi adapter
Giuseppe Marco Randazzo <gmrandazzo(a)gmail.com>
p54usb: add AirVasT USB stick device-id
Julian Sax <jsbc(a)gmx.de>
HID: i2c-hid: add Schneider SCL142ALM to descriptor override
Benjamin Tissoires <benjamin.tissoires(a)redhat.com>
HID: multitouch: enable multi-input as a quirk for some devices
Scott Shumate <scott.shumate(a)gmail.com>
HID: sony: Fix for broken buttons on DS3 USB dongles
Fan Yang <Fan_Yang(a)sjtu.edu.cn>
mm: Fix mremap not considering huge pmd devmap
Brad Love <brad(a)nextdimension.cc>
media: dvbdev: Fix tuner->demod media controller link
-------------
Diffstat:
Makefile | 4 ++--
arch/x86/include/asm/pgtable.h | 1 +
crypto/algapi.c | 22 +++++++++++++++------
crypto/api.c | 3 ++-
crypto/internal.h | 1 +
drivers/hid/hid-multitouch.c | 26 +++++++++++++++++++++++++
drivers/hid/hid-sony.c | 17 ++++++++++++++++
drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++
drivers/media/dvb-core/dvbdev.c | 5 +++--
drivers/net/dsa/mt7530.c | 11 ++++++++---
drivers/net/dsa/mt7530.h | 6 ++++++
drivers/net/wireless/cisco/airo.c | 12 ++++++++++++
drivers/net/wireless/intersil/p54/p54usb.c | 1 +
drivers/net/wireless/mediatek/mt76/mt76x02.h | 1 +
drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 +
drivers/staging/media/ipu3/include/intel-ipu3.h | 7 ++++---
include/uapi/linux/mmc/ioctl.h | 1 +
kernel/relay.c | 5 +++++
mm/mremap.c | 2 +-
19 files changed, 116 insertions(+), 18 deletions(-)