Going through the uses of timeval in the user space API,
I noticed two bugs in ppdev that were introduced in the y2038
conversion:
* The range check was accidentally moved from ppsettime to
ppgettime
* On sparc64, the microseconds are in the other half of the
64-bit word.
Fix both, and mark the fix for stable backports.
Cc: stable(a)vger.kernel.org
Fixes: 3b9ab374a1e6 ("ppdev: convert to y2038 safe")
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
---
drivers/char/ppdev.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
index c86f18aa8985..34bb88fe0b0a 100644
--- a/drivers/char/ppdev.c
+++ b/drivers/char/ppdev.c
@@ -619,20 +619,27 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
if (copy_from_user(time32, argp, sizeof(time32)))
return -EFAULT;
+ if ((time32[0] < 0) || (time32[1] < 0))
+ return -EINVAL;
+
return pp_set_timeout(pp->pdev, time32[0], time32[1]);
case PPSETTIME64:
if (copy_from_user(time64, argp, sizeof(time64)))
return -EFAULT;
+ if ((time64[0] < 0) || (time64[1] < 0))
+ return -EINVAL;
+
+ if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall())
+ time64[1] >>= 32;
+
return pp_set_timeout(pp->pdev, time64[0], time64[1]);
case PPGETTIME32:
jiffies_to_timespec64(pp->pdev->timeout, &ts);
time32[0] = ts.tv_sec;
time32[1] = ts.tv_nsec / NSEC_PER_USEC;
- if ((time32[0] < 0) || (time32[1] < 0))
- return -EINVAL;
if (copy_to_user(argp, time32, sizeof(time32)))
return -EFAULT;
@@ -643,8 +650,9 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
jiffies_to_timespec64(pp->pdev->timeout, &ts);
time64[0] = ts.tv_sec;
time64[1] = ts.tv_nsec / NSEC_PER_USEC;
- if ((time64[0] < 0) || (time64[1] < 0))
- return -EINVAL;
+
+ if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall())
+ time64[1] <<= 32;
if (copy_to_user(argp, time64, sizeof(time64)))
return -EFAULT;
--
2.20.0
As explained in the following commit a9a1a4833613 ("pinctrl:
armada-37xx: Fix gpio interrupt setup") the armada_37xx_irq_set_type()
function can be called before the initialization of the mask field.
That means that we can't use this field in this function and need to
workaround it using hwirq.
Fixes: 30ac0d3b0702 ("pinctrl: armada-37xx: Add edge both type gpio irq support")
Cc: stable(a)vger.kernel.org
Reported-by: Russell King <rmk+kernel(a)armlinux.org.uk>
Signed-off-by: Gregory CLEMENT <gregory.clement(a)bootlin.com>
---
drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
index 9df4277a16be..aa9dcde0f069 100644
--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
@@ -595,10 +595,10 @@ static int armada_37xx_irq_set_type(struct irq_data *d, unsigned int type)
regmap_read(info->regmap, in_reg, &in_val);
/* Set initial polarity based on current input level. */
- if (in_val & d->mask)
- val |= d->mask; /* falling */
+ if (in_val & BIT(d->hwirq % GPIO_PER_REG))
+ val |= BIT(d->hwirq % GPIO_PER_REG); /* falling */
else
- val &= ~d->mask; /* rising */
+ val &= ~(BIT(d->hwirq % GPIO_PER_REG)); /* rising */
break;
}
default:
--
2.24.0
I'm announcing the release of the 5.3.12 kernel.
All users of the 5.3 kernel series must upgrade.
The updated 5.3.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.3.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/x86/kernel/early-quirks.c | 2
arch/x86/kvm/mmu.c | 8 +-
drivers/base/memory.c | 36 +++++++++++++
drivers/gpu/drm/i915/display/intel_display_power.c | 3 +
drivers/gpu/drm/i915/gt/intel_mocs.c | 8 --
drivers/gpu/drm/i915/i915_drv.c | 3 -
drivers/i2c/i2c-core-acpi.c | 28 +++++++++-
drivers/infiniband/hw/hfi1/init.c | 1
drivers/infiniband/hw/hfi1/pcie.c | 4 +
drivers/infiniband/hw/hfi1/rc.c | 16 ++---
drivers/infiniband/hw/hfi1/sdma.c | 5 +
drivers/infiniband/hw/hfi1/tid_rdma.c | 57 +++++++++++----------
drivers/infiniband/hw/hfi1/tid_rdma.h | 3 -
drivers/infiniband/hw/hfi1/verbs.c | 10 +--
drivers/input/ff-memless.c | 9 +++
drivers/input/rmi4/rmi_f11.c | 4 -
drivers/input/rmi4/rmi_f12.c | 32 ++++++++++-
drivers/input/rmi4/rmi_f54.c | 5 +
drivers/mmc/host/sdhci-of-at91.c | 2
drivers/net/can/slcan.c | 1
drivers/net/ethernet/cortina/gemini.c | 1
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 10 +++
drivers/net/ethernet/mellanox/mlx4/main.c | 3 +
drivers/net/ethernet/mellanox/mlxsw/core.c | 5 +
drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 2
drivers/net/netdevsim/dev.c | 2
drivers/net/slip/slip.c | 1
drivers/net/usb/ax88172a.c | 2
drivers/net/usb/qmi_wwan.c | 2
drivers/scsi/scsi_lib.c | 3 -
fs/btrfs/inode.c | 15 +++++
fs/ecryptfs/inode.c | 19 ++++---
fs/io_uring.c | 2
include/linux/intel-iommu.h | 6 +-
include/linux/kvm_host.h | 1
include/linux/memory.h | 1
include/net/devlink.h | 3 +
include/trace/events/tcp.h | 2
include/uapi/linux/devlink.h | 1
kernel/signal.c | 2
kernel/time/ntp.c | 2
mm/hugetlb_cgroup.c | 2
mm/memcontrol.c | 2
mm/memory_hotplug.c | 43 +++++++++------
mm/mempolicy.c | 14 +++--
mm/page_io.c | 6 +-
mm/slub.c | 39 +++-----------
net/core/devlink.c | 45 ++++++++++++++++
net/ipv4/ipmr.c | 3 -
net/smc/af_smc.c | 3 -
sound/usb/endpoint.c | 3 +
sound/usb/mixer.c | 4 +
sound/usb/quirks.c | 4 -
sound/usb/validate.c | 6 +-
virt/kvm/kvm_main.c | 26 ++++++++-
56 files changed, 369 insertions(+), 155 deletions(-)
Al Viro (2):
ecryptfs_lookup_interpose(): lower_dentry->d_inode is not stable
ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either
Aleksander Morgado (1):
net: usb: qmi_wwan: add support for Foxconn T77W968 LTE modules
Andrew Duggan (2):
Input: synaptics-rmi4 - disable the relative position IRQ in the F12 driver
Input: synaptics-rmi4 - do not consume more data than we have (F11, F12)
Arnd Bergmann (1):
ntp/y2038: Remove incorrect time_t truncation
Aya Levin (1):
devlink: Add method for time-stamp on reporter's dump
Chuhong Yuan (2):
net: gemini: add missed free_netdev
Input: synaptics-rmi4 - destroy F54 poller workqueue when removing
Corentin Labbe (1):
net: ethernet: dwmac-sun8i: Use the correct function in exit path
David Hildenbrand (1):
mm/memory_hotplug: fix try_offline_node()
Eric Auger (1):
iommu/vt-d: Fix QI_DEV_IOTLB_PFSID and QI_DEV_EIOTLB_PFSID macros
Eugen Hristev (1):
mmc: sdhci-of-at91: fix quirk2 overwrite
Filipe Manana (1):
Btrfs: fix log context list corruption after rename exchange operation
Greg Kroah-Hartman (1):
Linux 5.3.12
Guillaume Nault (1):
ipmr: Fix skb headroom in ipmr_get_route().
Hans de Goede (1):
i2c: acpi: Force bus speed to 400KHz if a Silead touchscreen is present
Henry Lin (1):
ALSA: usb-audio: not submit urb for stopped endpoint
Ioana Ciornei (1):
dpaa2-eth: free already allocated channels on probe defer
James Erwin (1):
IB/hfi1: Ensure full Gen3 speed in a Gen4 system
Jani Nikula (1):
drm/i915: update rawclk also on resume
Jens Axboe (1):
io_uring: ensure registered buffer import returns the IO length
Jiri Pirko (2):
devlink: disallow reload operation during device cleanup
mlxsw: core: Enable devlink reload only on probe
Jouni Hogander (2):
slip: Fix memory leak in slip_open error path
slcan: Fix memory leak in error path
Kai-Heng Feng (1):
x86/quirks: Disable HPET on Intel Coffe Lake platforms
Kaike Wan (3):
IB/hfi1: Ensure r_tid_ack is valid before building TID RDMA ACK packet
IB/hfi1: Calculate flow weight based on QP MTU for TID RDMA
IB/hfi1: TID RDMA WRITE should not return IB_WC_RNR_RETRY_EXC_ERR
Laura Abbott (1):
mm: slub: really fix slab walking for init_on_free
Lucas Stach (2):
Input: synaptics-rmi4 - fix video buffer size
Input: synaptics-rmi4 - clear IRQ enables for F54
Matt Roper (1):
Revert "drm/i915/ehl: Update MOCS table for EHL"
Michael Schmitz (1):
scsi: core: Handle drivers which set sg_tablesize to zero
Mike Marciniszyn (1):
IB/hfi1: Use a common pad buffer for 9B and 16B packets
Oleg Nesterov (1):
cgroup: freezer: call cgroup_enter_frozen() with preemption disabled in ptrace_stop()
Oliver Neukum (2):
ax88172a: fix information leak on short answers
Input: ff-memless - kill timer in destroy()
Roman Gushchin (2):
mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm()
mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup()
Sean Christopherson (1):
KVM: MMU: Do not treat ZONE_DEVICE pages as being reserved
Takashi Iwai (3):
ALSA: usb-audio: Fix missing error check at mixer resolution test
ALSA: usb-audio: Fix incorrect NULL check in create_yamaha_midi_quirk()
ALSA: usb-audio: Fix incorrect size check for processing/extension units
Tony Lu (1):
tcp: remove redundant new line from tcp_event_sk_skb
Ursula Braun (2):
net/smc: fix fastopen for non-blocking connect()
net/smc: fix refcount non-blocking connect() -part 2
Vinayak Menon (1):
mm/page_io.c: do not free shared swap slots
Yang Shi (1):
mm: mempolicy: fix the wrong return value and potential pages leak of mbind