This is the start of the stable review cycle for the 4.14.328 release.
There are 65 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 26 Oct 2023 08:32:31 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.328-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.328-rc2
Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Bluetooth: hci_event: Fix using memcmp when comparing keys
Kees Cook <keescook(a)chromium.org>
Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
Edward AD <twuufnxlz(a)gmail.com>
Bluetooth: hci_sock: fix slab oob read in create_monitor_event
Haibo Chen <haibo.chen(a)nxp.com>
gpio: vf610: set value before the direction to avoid a glitch
Niklas Schnelle <schnelle(a)linux.ibm.com>
s390/pci: fix iommu bitmap allocation
Peter Zijlstra <peterz(a)infradead.org>
perf: Disallow mis-matched inherited group reads
Puliang Lu <puliang.lu(a)fibocom.com>
USB: serial: option: add Fibocom to DELL custom modem FM101R-GL
Benoît Monin <benoit.monin(a)gmx.fr>
USB: serial: option: add entry for Sierra EM9191 with new firmware
Fabio Porcedda <fabio.porcedda(a)gmail.com>
USB: serial: option: add Telit LE910C4-WWX 0x1035 composition
Sunil V L <sunilvl(a)ventanamicro.com>
ACPI: irq: Fix incorrect return value in acpi_register_gsi()
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"
Avri Altman <avri.altman(a)wdc.com>
mmc: core: Capture correct oemid-bits for eMMC cards
Kees Cook <keescook(a)chromium.org>
sky2: Make sure there is at least one frag_addr available
Benjamin Berg <benjamin.berg(a)intel.com>
wifi: cfg80211: avoid leaking stack data into trace
Wen Gong <quic_wgong(a)quicinc.com>
wifi: mac80211: allow transmitting EAPOL frames with tainted key
Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Bluetooth: hci_core: Fix build warnings
Ying Hsu <yinghsu(a)chromium.org>
Bluetooth: Avoid redundant authentication
Ma Ke <make_ruc2021(a)163.com>
HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event
Clément Léger <cleger(a)rivosinc.com>
tracing: relax trace_event_eval_update() execution with cond_resched()
Damien Le Moal <dlemoal(a)kernel.org>
ata: libata-eh: Fix compilation warning in ata_eh_link_report()
Chengfeng Ye <dg573847474(a)gmail.com>
gpio: timberdale: Fix potential deadlock on &tgpio->lock
Jeff Layton <jlayton(a)kernel.org>
overlayfs: set ctime when setting mtime and atime
Heiner Kallweit <hkallweit1(a)gmail.com>
i2c: mux: Avoid potential false error message in i2c_mux_add_adapter
Josef Bacik <josef(a)toxicpanda.com>
btrfs: initialize start_slot in btrfs_log_prealloc_extents
Tony Lindgren <tony(a)atomide.com>
ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone
Michal Schmidt <mschmidt(a)redhat.com>
i40e: prevent crash on probe if hw registers have invalid values
Dan Carpenter <dan.carpenter(a)linaro.org>
net: usb: smsc95xx: Fix an error code in smsc95xx_reset()
Josua Mayer <josua(a)solid-run.com>
net: rfkill: gpio: prevent value glitch during probe
Ma Ke <make_ruc2021(a)163.com>
net: ipv6: fix return value check in esp_remove_trailer
Ma Ke <make_ruc2021(a)163.com>
net: ipv4: fix return value check in esp_remove_trailer
Eric Dumazet <edumazet(a)google.com>
xfrm: fix a data-race in xfrm_gen_index()
Florian Westphal <fw(a)strlen.de>
netfilter: nft_payload: fix wrong mac header matching
Jim Mattson <jmattson(a)google.com>
KVM: x86: Mask LVTPC when handling a PMI
Johan Hovold <johan+linaro(a)kernel.org>
regmap: fix NULL deref on lookup
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
Arnd Bergmann <arnd(a)arndb.de>
Bluetooth: avoid memcmp() out of bounds warning
Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Bluetooth: hci_event: Fix coding style
Arkadiusz Bokowy <arkadiusz.bokowy(a)gmail.com>
Bluetooth: vhci: Fix race when opening vhci device
Ziyang Xuan <william.xuanziyang(a)huawei.com>
Bluetooth: Fix a refcnt underflow problem for hci_conn
Lee, Chun-Yi <jlee(a)suse.com>
Bluetooth: Reject connection with the device which has same BD_ADDR
Lee, Chun-Yi <jlee(a)suse.com>
Bluetooth: hci_event: Ignore NULL link key
Ricardo Cañuelo <ricardo.canuelo(a)collabora.com>
usb: hub: Guard against accesses to uninitialized BOS descriptors
Borislav Petkov (AMD) <bp(a)alien8.de>
x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs
Krishna Kurapati <quic_kriskura(a)quicinc.com>
usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
Piyush Mehta <piyush.mehta(a)amd.com>
usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
pinctrl: avoid unsafe code pattern in find_pinctrl()
Michal Koutný <mkoutny(a)suse.com>
cgroup: Remove duplicates in cgroup v1 tasks file
Matthias Berndt <matthias_berndt(a)gmx.de>
Input: xpad - add PXN V900 support
Javier Carrasco <javier.carrasco.cruz(a)gmail.com>
Input: powermate - fix use-after-free in powermate_config_complete
Xiubo Li <xiubli(a)redhat.com>
ceph: fix incorrect revoked caps assert in ceph_fill_file_size()
Jorge Sanjuan Garcia <jorge.sanjuangarcia(a)duagon.com>
mcb: remove is_added flag from mcb_device struct
Alexander Zangerl <az(a)breathe-safe.com>
iio: pressure: ms5611: ms5611_prom_is_valid false negative bug
Phil Elwell <phil(a)raspberrypi.com>
iio: pressure: bmp280: Fix NULL pointer exception
Xingxing Luo <xingxing.luo(a)unisoc.com>
usb: musb: Modify the "HWVers" register address
Xingxing Luo <xingxing.luo(a)unisoc.com>
usb: musb: Get the musb_qh poniter after musb_giveback
Javier Carrasco <javier.carrasco.cruz(a)gmail.com>
net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read
Wesley Cheng <quic_wcheng(a)quicinc.com>
usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer
Waiman Long <longman(a)redhat.com>
workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask()
Jeremy Cline <jeremy(a)jcline.org>
nfc: nci: assert requested protocol is valid
Dan Carpenter <dan.carpenter(a)linaro.org>
ixgbe: fix crash with empty VF macvlan list
Konstantin Meskhidze <konstantin.meskhidze(a)huawei.com>
drm/vmwgfx: fix typo of sizeof argument
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
ieee802154: ca8210: Fix a potential UAF in ca8210_probe
Martin Fuzzey <martin.fuzzey(a)flowbird.group>
drm: etvnaviv: fix bad backport leading to warning
Hans de Goede <hdegoede(a)redhat.com>
HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
Artem Chernyshev <artem.chernyshev(a)red-soft.ru>
RDMA/cxgb4: Check skb value for failure to allocate
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/omap4-droid4-xt894.dts | 1 +
arch/s390/pci/pci_dma.c | 16 +++++-
arch/x86/include/asm/msr-index.h | 4 ++
arch/x86/kernel/cpu/amd.c | 9 ++++
arch/x86/kvm/lapic.c | 8 ++-
drivers/acpi/irq.c | 7 ++-
drivers/ata/libata-eh.c | 2 +-
drivers/base/regmap/regmap.c | 2 +-
drivers/bluetooth/hci_vhci.c | 3 ++
drivers/gpio/gpio-timberdale.c | 5 +-
drivers/gpio/gpio-vf610.c | 4 +-
drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 2 +-
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +-
drivers/hid/hid-holtek-kbd.c | 4 ++
drivers/hid/hid-logitech-hidpp.c | 3 +-
drivers/i2c/i2c-mux.c | 2 +-
drivers/iio/pressure/bmp280-core.c | 2 +-
drivers/iio/pressure/ms5611_core.c | 2 +-
drivers/infiniband/hw/cxgb4/cm.c | 3 ++
drivers/input/joystick/xpad.c | 2 +
drivers/input/misc/powermate.c | 1 +
drivers/mcb/mcb-core.c | 10 ++--
drivers/mcb/mcb-parse.c | 2 -
drivers/mmc/core/mmc.c | 2 +-
drivers/net/ethernet/intel/i40e/i40e_common.c | 4 +-
drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 5 +-
drivers/net/ethernet/marvell/sky2.h | 2 +-
drivers/net/ieee802154/ca8210.c | 17 ++----
drivers/net/usb/dm9601.c | 7 ++-
drivers/net/usb/smsc95xx.c | 2 +-
drivers/usb/core/hub.c | 28 ++++++++--
drivers/usb/core/hub.h | 2 +-
drivers/usb/gadget/function/f_ncm.c | 26 +++++++---
drivers/usb/gadget/udc/udc-xilinx.c | 20 ++++---
drivers/usb/host/xhci-ring.c | 4 +-
drivers/usb/musb/musb_debugfs.c | 2 +-
drivers/usb/musb/musb_host.c | 9 +++-
drivers/usb/serial/option.c | 7 +++
fs/btrfs/tree-log.c | 2 +-
fs/ceph/inode.c | 4 +-
fs/overlayfs/copy_up.c | 2 +-
include/linux/mcb.h | 1 -
include/linux/perf_event.h | 1 +
include/net/bluetooth/hci_core.h | 2 +-
include/net/netns/xfrm.h | 1 +
kernel/cgroup/cgroup-v1.c | 5 +-
kernel/events/core.c | 39 +++++++++++---
kernel/trace/trace_events.c | 1 +
kernel/workqueue.c | 8 ++-
net/bluetooth/hci_conn.c | 72 ++++++++++++++++----------
net/bluetooth/hci_core.c | 8 +--
net/bluetooth/hci_event.c | 33 +++++++++---
net/bluetooth/hci_sock.c | 3 +-
net/ipv4/esp4.c | 4 +-
net/ipv6/esp6.c | 4 +-
net/mac80211/tx.c | 3 +-
net/netfilter/nft_payload.c | 2 +-
net/nfc/nci/core.c | 5 ++
net/nfc/nci/spi.c | 2 +
net/rfkill/rfkill-gpio.c | 4 +-
net/wireless/nl80211.c | 2 +-
net/xfrm/xfrm_policy.c | 6 +--
63 files changed, 310 insertions(+), 141 deletions(-)
We are seeing systemd hang on its autofs direct mount at
/proc/sys/fs/binfmt_misc.
Historically this was due to a mismatch in the communication structure
size between a 64 bit kernel and a 32 bit user space and was fixed by
making the pipe communication record oriented.
During autofs v5 development I decided to stay with the existing usage
instead of changing to a packed structure for autofs <=> user space
communications which turned out to be a mistake on my part.
Problems arose and they were fixed by allowing for the 64 bit to 32
bit size difference in the automount(8) code.
Along the way systemd started to use autofs and eventually encountered
this problem too. systemd refused to compensate for the length
difference insisting it be fixed in the kernel. Fortunately Linus
implemented the packetized pipe which resolved the problem in a
straight forward and simple way.
In the autofs mount api conversion series I inadvertatly dropped the
packet pipe flag settings when adding the autofs_parse_fd() function.
This patch fixes that omission.
Fixes: 546694b8f658 ("autofs: add autofs_parse_fd()")
Signed-off-by: Ian Kent <raven(a)themaw.net>
Cc: Bill O'Donnell <bodonnel(a)redhat.com>
Cc: Christian Brauner <brauner(a)kernel.org>
Cc: Arnd Bergmann <arnd(a)arndb.de>
Cc: Dan Carpenter <dan.carpenter(a)linaro.org>
Cc: Anders Roxell <anders.roxell(a)linaro.org>
Cc: Naresh Kamboju <naresh.kamboju(a)linaro.org>
Cc: Stephen Rothwell <sfr(a)canb.auug.org.au>
Reported-by: Linux Kernel Functional Testing <lkft(a)linaro.org>
Reported-by: Anders Roxell <anders.roxell(a)linaro.org>
---
fs/autofs/autofs_i.h | 13 +++++++++----
fs/autofs/inode.c | 2 ++
2 files changed, 11 insertions(+), 4 deletions(-)
diff --git a/fs/autofs/autofs_i.h b/fs/autofs/autofs_i.h
index 244f18cdf23c..8c1d587b3eef 100644
--- a/fs/autofs/autofs_i.h
+++ b/fs/autofs/autofs_i.h
@@ -221,15 +221,20 @@ static inline int autofs_check_pipe(struct file *pipe)
return 0;
}
-static inline int autofs_prepare_pipe(struct file *pipe)
+static inline void autofs_set_packet_pipe_flags(struct file *pipe)
{
- int ret = autofs_check_pipe(pipe);
- if (ret < 0)
- return ret;
/* We want a packet pipe */
pipe->f_flags |= O_DIRECT;
/* We don't expect -EAGAIN */
pipe->f_flags &= ~O_NONBLOCK;
+}
+
+static inline int autofs_prepare_pipe(struct file *pipe)
+{
+ int ret = autofs_check_pipe(pipe);
+ if (ret < 0)
+ return ret;
+ autofs_set_packet_pipe_flags(pipe);
return 0;
}
diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c
index 6d2e01c9057d..a3d62acc293a 100644
--- a/fs/autofs/inode.c
+++ b/fs/autofs/inode.c
@@ -177,6 +177,8 @@ static int autofs_parse_fd(struct fs_context *fc, struct autofs_sb_info *sbi,
return -EBADF;
}
+ autofs_set_packet_pipe_flags(pipe);
+
if (sbi->pipe)
fput(sbi->pipe);
--
2.41.0
