- Kernel - mailweb.openeuler.org

openEuler Summit 2020 来了，欢迎申报申报 Summit 议题
by Liyongle (Fred) 05 Nov '20

05 Nov '20

openEuler Summit 是由 openEuler 社区举办的开发者交流会，首届线下 openEuler Summit 将于 12 月24-25日在北京举行。 openEuler Summit 广泛邀请操作系统生态的开发者、用户、社区贡献者、软件爱好者共同解读 openEuler 的最新版，探讨未来的技术路线，让技术、生态、商业在这里产生奇妙的化学反应。开源是一种态度、分享是一种精神。Call for Speaker、Call for Sponsor、Call for SIG、Call for Demo 现已全面开放报名。我们诚挚的邀请您报名演讲、演示 Demo、发表案例、参与社区建设。期待您的到来。 [cid:image001.png@01D6B34F.EDA0B950] [cid:image002.png@01D6B34F.EDA0B950] [cid:image003.png@01D6B34F.EDA0B950] [cid:image004.png@01D6B34F.EDA0B950] Fred 李永乐

1 0

[PATCH 1/2] vt: keyboard, simplify vt_kdgkbsent
by Yang Yingliang 04 Nov '20

04 Nov '20

From: Jiri Slaby <jslaby(a)suse.cz> mainline inclusion from mainline-v5.10-rc2 commit 6ca03f90527e499dd5e32d6522909e2ad390896b category: bugfix bugzilla: NA CVE: CVE-2020-25656 -------------------------------- Use 'strlen' of the string, add one for NUL terminator and simply do 'copy_to_user' instead of the explicit 'for' loop. This makes the KDGKBSENT case more compact. The only thing we need to take care about is NULL 'func_table[i]'. Use an empty string in that case. The original check for overflow could never trigger as the func_buf strings are always shorter or equal to 'struct kbsentry's. Cc: <stable(a)vger.kernel.org> Signed-off-by: Jiri Slaby <jslaby(a)suse.cz> Link: https://lore.kernel.org/r/20201019085517.10176-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/tty/vt/keyboard.c | 28 +++++++++------------------- 1 file changed, 9 insertions(+), 19 deletions(-) diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index a7455f8a4235..56315d23f34e 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -1994,9 +1994,7 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) { struct kbsentry *kbs; - char *p; u_char *q; - u_char __user *up; int sz, fnw_sz; int delta; char *first_free, *fj, *fnw; @@ -2022,23 +2020,15 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) i = kbs->kb_func; switch (cmd) { - case KDGKBSENT: - sz = sizeof(kbs->kb_string) - 1; /* sz should have been - a struct member */ - up = user_kdgkb->kb_string; - p = func_table[i]; - if(p) - for ( ; *p && sz; p++, sz--) - if (put_user(*p, up++)) { - ret = -EFAULT; - goto reterr; - } - if (put_user('\0', up)) { - ret = -EFAULT; - goto reterr; - } - kfree(kbs); - return ((p && *p) ? -EOVERFLOW : 0); + case KDGKBSENT: { + /* size should have been a struct member */ + unsigned char *from = func_table[i] ? : ""; + + ret = copy_to_user(user_kdgkb->kb_string, from, + strlen(from) + 1) ? -EFAULT : 0; + + goto reterr; + } case KDSKBSENT: if (!perm) { ret = -EPERM; -- 2.25.1

1 1

[PATCH] binder: fix UAF when releasing todo list
by Yang Yingliang 04 Nov '20

04 Nov '20

From: Todd Kjos <tkjos(a)google.com> stable inclusion from linux-4.19.153 commit 35cc2facc2a5ff52b9aa03f2dc81dcb000d97da3 CVE: CVE-2020-0423 -------------------------------- commit f3277cbfba763cd2826396521b9296de67cf1bbc upstream. When releasing a thread todo list when tearing down a binder_proc, the following race was possible which could result in a use-after-free: 1. Thread 1: enter binder_release_work from binder_thread_release 2. Thread 2: binder_update_ref_for_handle() -> binder_dec_node_ilocked() 3. Thread 2: dec nodeA --> 0 (will free node) 4. Thread 1: ACQ inner_proc_lock 5. Thread 2: block on inner_proc_lock 6. Thread 1: dequeue work (BINDER_WORK_NODE, part of nodeA) 7. Thread 1: REL inner_proc_lock 8. Thread 2: ACQ inner_proc_lock 9. Thread 2: todo list cleanup, but work was already dequeued 10. Thread 2: free node 11. Thread 2: REL inner_proc_lock 12. Thread 1: deref w->type (UAF) The problem was that for a BINDER_WORK_NODE, the binder_work element must not be accessed after releasing the inner_proc_lock while processing the todo list elements since another thread might be handling a deref on the node containing the binder_work element leading to the node being freed. Signed-off-by: Todd Kjos <tkjos(a)google.com> Link: https://lore.kernel.org/r/20201009232455.4054810-1-tkjos@google.com Cc: <stable(a)vger.kernel.org> # 4.14, 4.19, 5.4, 5.8 Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/android/binder.c | 35 ++++++++++------------------------- 1 file changed, 10 insertions(+), 25 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index cf4367135a00..18c32637047f 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -285,7 +285,7 @@ struct binder_device { struct binder_work { struct list_head entry; - enum { + enum binder_work_type { BINDER_WORK_TRANSACTION = 1, BINDER_WORK_TRANSACTION_COMPLETE, BINDER_WORK_RETURN_ERROR, @@ -895,27 +895,6 @@ static struct binder_work *binder_dequeue_work_head_ilocked( return w; } -/** - * binder_dequeue_work_head() - Dequeues the item at head of list - * @proc: binder_proc associated with list - * @list: list to dequeue head - * - * Removes the head of the list if there are items on the list - * - * Return: pointer dequeued binder_work, NULL if list was empty - */ -static struct binder_work *binder_dequeue_work_head( - struct binder_proc *proc, - struct list_head *list) -{ - struct binder_work *w; - - binder_inner_proc_lock(proc); - w = binder_dequeue_work_head_ilocked(list); - binder_inner_proc_unlock(proc); - return w; -} - static void binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer); static void binder_free_thread(struct binder_thread *thread); @@ -4229,13 +4208,17 @@ static void binder_release_work(struct binder_proc *proc, struct list_head *list) { struct binder_work *w; + enum binder_work_type wtype; while (1) { - w = binder_dequeue_work_head(proc, list); + binder_inner_proc_lock(proc); + w = binder_dequeue_work_head_ilocked(list); + wtype = w ? w->type : 0; + binder_inner_proc_unlock(proc); if (!w) return; - switch (w->type) { + switch (wtype) { case BINDER_WORK_TRANSACTION: { struct binder_transaction *t; @@ -4269,9 +4252,11 @@ static void binder_release_work(struct binder_proc *proc, kfree(death); binder_stats_deleted(BINDER_STAT_DEATH); } break; + case BINDER_WORK_NODE: + break; default: pr_err("unexpected work type, %d, not freed\n", - w->type); + wtype); break; } } -- 2.25.1

1 0

[PATCH 001/110] mm: fix double page fault on arm64 if PTE_AF is cleared
by Yang Yingliang 04 Nov '20

04 Nov '20

From: Jia He <justin.he(a)arm.com> stable inclusion from linux-4.19.149 commit 8579a0440381353e0a71dd6a4d4371be8457eac4 -------------------------------- [ Upstream commit 83d116c53058d505ddef051e90ab27f57015b025 ] When we tested pmdk unit test [1] vmmalloc_fork TEST3 on arm64 guest, there will be a double page fault in __copy_from_user_inatomic of cow_user_page. To reproduce the bug, the cmd is as follows after you deployed everything: make -C src/test/vmmalloc_fork/ TEST_TIME=60m check Below call trace is from arm64 do_page_fault for debugging purpose: [ 110.016195] Call trace: [ 110.016826] do_page_fault+0x5a4/0x690 [ 110.017812] do_mem_abort+0x50/0xb0 [ 110.018726] el1_da+0x20/0xc4 [ 110.019492] __arch_copy_from_user+0x180/0x280 [ 110.020646] do_wp_page+0xb0/0x860 [ 110.021517] __handle_mm_fault+0x994/0x1338 [ 110.022606] handle_mm_fault+0xe8/0x180 [ 110.023584] do_page_fault+0x240/0x690 [ 110.024535] do_mem_abort+0x50/0xb0 [ 110.025423] el0_da+0x20/0x24 The pte info before __copy_from_user_inatomic is (PTE_AF is cleared): [ffff9b007000] pgd=000000023d4f8003, pud=000000023da9b003, pmd=000000023d4b3003, pte=360000298607bd3 As told by Catalin: "On arm64 without hardware Access Flag, copying from user will fail because the pte is old and cannot be marked young. So we always end up with zeroed page after fork() + CoW for pfn mappings. we don't always have a hardware-managed access flag on arm64." This patch fixes it by calling pte_mkyoung. Also, the parameter is changed because vmf should be passed to cow_user_page() Add a WARN_ON_ONCE when __copy_from_user_inatomic() returns error in case there can be some obscure use-case (by Kirill). [1] https://github.com/pmem/pmdk/tree/master/src/test/vmmalloc_fork Signed-off-by: Jia He <justin.he(a)arm.com> Reported-by: Yibo Cai <Yibo.Cai(a)arm.com> Reviewed-by: Catalin Marinas <catalin.marinas(a)arm.com> Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/memory.c | 104 ++++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 89 insertions(+), 15 deletions(-) diff --git a/mm/memory.c b/mm/memory.c index c65d3993ac63..c4c667c0b89d 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -117,6 +117,18 @@ int randomize_va_space __read_mostly = 2; #endif +#ifndef arch_faults_on_old_pte +static inline bool arch_faults_on_old_pte(void) +{ + /* + * Those arches which don't have hw access flag feature need to + * implement their own helper. By default, "true" means pagefault + * will be hit on old pte. + */ + return true; +} +#endif + static int __init disable_randmaps(char *s) { randomize_va_space = 0; @@ -2089,32 +2101,82 @@ static inline int pte_unmap_same(struct mm_struct *mm, pmd_t *pmd, return same; } -static inline void cow_user_page(struct page *dst, struct page *src, unsigned long va, struct vm_area_struct *vma) +static inline bool cow_user_page(struct page *dst, struct page *src, + struct vm_fault *vmf) { + bool ret; + void *kaddr; + void __user *uaddr; + bool force_mkyoung; + struct vm_area_struct *vma = vmf->vma; + struct mm_struct *mm = vma->vm_mm; + unsigned long addr = vmf->address; + debug_dma_assert_idle(src); + if (likely(src)) { + copy_user_highpage(dst, src, addr, vma); + return true; + } + /* * If the source page was a PFN mapping, we don't have * a "struct page" for it. We do a best-effort copy by * just copying from the original user address. If that * fails, we just zero-fill it. Live with it. */ - if (unlikely(!src)) { - void *kaddr = kmap_atomic(dst); - void __user *uaddr = (void __user *)(va & PAGE_MASK); + kaddr = kmap_atomic(dst); + uaddr = (void __user *)(addr & PAGE_MASK); + + /* + * On architectures with software "accessed" bits, we would + * take a double page fault, so mark it accessed here. + */ + force_mkyoung = arch_faults_on_old_pte() && !pte_young(vmf->orig_pte); + if (force_mkyoung) { + pte_t entry; + + vmf->pte = pte_offset_map_lock(mm, vmf->pmd, addr, &vmf->ptl); + if (!likely(pte_same(*vmf->pte, vmf->orig_pte))) { + /* + * Other thread has already handled the fault + * and we don't need to do anything. If it's + * not the case, the fault will be triggered + * again on the same address. + */ + ret = false; + goto pte_unlock; + } + entry = pte_mkyoung(vmf->orig_pte); + if (ptep_set_access_flags(vma, addr, vmf->pte, entry, 0)) + update_mmu_cache(vma, addr, vmf->pte); + } + + /* + * This really shouldn't fail, because the page is there + * in the page tables. But it might just be unreadable, + * in which case we just give up and fill the result with + * zeroes. + */ + if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE)) { /* - * This really shouldn't fail, because the page is there - * in the page tables. But it might just be unreadable, - * in which case we just give up and fill the result with - * zeroes. + * Give a warn in case there can be some obscure + * use-case */ - if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE)) - clear_page(kaddr); - kunmap_atomic(kaddr); - flush_dcache_page(dst); - } else - copy_user_highpage(dst, src, va, vma); + WARN_ON_ONCE(1); + clear_page(kaddr); + } + + ret = true; + +pte_unlock: + if (force_mkyoung) + pte_unmap_unlock(vmf->pte, vmf->ptl); + kunmap_atomic(kaddr); + flush_dcache_page(dst); + + return ret; } static gfp_t __get_fault_gfp_mask(struct vm_area_struct *vma) @@ -2268,7 +2330,19 @@ static vm_fault_t wp_page_copy(struct vm_fault *vmf) vmf->address); if (!new_page) goto oom; - cow_user_page(new_page, old_page, vmf->address, vma); + + if (!cow_user_page(new_page, old_page, vmf)) { + /* + * COW failed, if the fault was solved by other, + * it's fine. If not, userspace would re-fault on + * the same address and we will handle the fault + * from the second attempt. + */ + put_page(new_page); + if (old_page) + put_page(old_page); + return 0; + } } if (mem_cgroup_try_charge_delay(new_page, mm, GFP_KERNEL, &memcg, false)) -- 2.25.1

1 109

[PATCH] iscsi: remove unnecessary __GENKSYMS__ define
by Yang Yingliang 04 Nov '20

04 Nov '20

hulk inclusion category: bugfix bugzilla: NA CVE: NA ------------------------------ remove unnecessary __GENKSYMS__ define Fixes: fc7b0914a6fa ("iscsi: use dynamic single thread workqueue...") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/scsi/libiscsi.h | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h index a5f8094e3334..e03b9244499e 100644 --- a/include/scsi/libiscsi.h +++ b/include/scsi/libiscsi.h @@ -253,9 +253,7 @@ struct iscsi_conn { /* custom statistics */ uint32_t eh_abort_cnt; uint32_t fmr_unalign_cnt; -#ifndef __GENKSYMS__ - int intimate_cpu; /* offset:588, KABI is ok */ -#endif + int intimate_cpu; }; struct iscsi_pool { -- 2.25.1

1 0

[PATCH] arm64: fix abi change caused by ILP32
by Yang Yingliang 02 Nov '20

02 Nov '20

From: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> hulk inclusion category: bugfix bugzilla: NA CVE: NA ---------------------------- One of the ILP32 patchset rename 'compat_user_mode' and 'compat_thumb_mode' to 'a32_user_mode' and 'a32_user_mode'. But these two macros are used in some opensource userspace application. To keep compatibility, we redefine these two macros. Fixes: 23b2f00 ("arm64: rename functions that reference compat term") Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/include/asm/ptrace.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h index 3fafb1af3d66..f1662df255ca 100644 --- a/arch/arm64/include/asm/ptrace.h +++ b/arch/arm64/include/asm/ptrace.h @@ -213,6 +213,8 @@ static inline void forget_syscall(struct pt_regs *regs) #define a32_thumb_mode(regs) (0) #endif +#define compat_thumb_mode(regs) a32_thumb_mode(regs) + #define user_mode(regs) \ (((regs)->pstate & PSR_MODE_MASK) == PSR_MODE_EL0t) @@ -220,6 +222,8 @@ static inline void forget_syscall(struct pt_regs *regs) (((regs)->pstate & (PSR_MODE32_BIT | PSR_MODE_MASK)) == \ (PSR_MODE32_BIT | PSR_MODE_EL0t)) +#define compat_user_mode(regs) a32_user_mode(regs) + #define processor_mode(regs) \ ((regs)->pstate & PSR_MODE_MASK) -- 2.25.1

1 0

[PATCH 1/7] xen/events: add a proper barrier to 2-level uevent unmasking
by Yang Yingliang 02 Nov '20

02 Nov '20

From: Juergen Gross <jgross(a)suse.com> mainline inclusion from mainline-v5.10 commit 4d3fe31bd993ef504350989786858aefdb877daa category: bugfix bugzilla: NA CVE: CVE-2020-27673 -------------------------------- A follow-up patch will require certain write to happen before an event channel is unmasked. While the memory barrier is not strictly necessary for all the callers, the main one will need it. In order to avoid an extra memory barrier when using fifo event channels, mandate evtchn_unmask() to provide write ordering. The 2-level event handling unmask operation is missing an appropriate barrier, so add it. Fifo event channels are fine in this regard due to using sync_cmpxchg(). This is part of XSA-332. Cc: stable(a)vger.kernel.org Suggested-by: Julien Grall <julien(a)xen.org> Signed-off-by: Juergen Gross <jgross(a)suse.com> Reviewed-by: Julien Grall <jgrall(a)amazon.com> Reviewed-by: Wei Liu <wl(a)xen.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/xen/events/events_2l.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/xen/events/events_2l.c b/drivers/xen/events/events_2l.c index 5478c761cd41..f026624898e7 100644 --- a/drivers/xen/events/events_2l.c +++ b/drivers/xen/events/events_2l.c @@ -91,6 +91,8 @@ static void evtchn_2l_unmask(unsigned port) BUG_ON(!irqs_disabled()); + smp_wmb(); /* All writes before unmask must be visible. */ + if (unlikely((cpu != cpu_from_evtchn(port)))) do_hypercall = 1; else { -- 2.25.1

1 6

[PATCH] sdei_watchdog: avoid possible false hardlockup
by Yang Yingliang 02 Nov '20

02 Nov '20

From: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> hulk inclusion category: bugfix bugzilla: NA CVE: NA ------------------------------ Firmware may not trigger SDEI event as required frequency. SDEI event may be triggered too soon, which cause false hardlockup in kernel. Check the time stamp in sdei_watchdog_callbak and skip the hardlockup check if it is invoked too soon. Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/kernel/watchdog_sdei.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/arch/arm64/kernel/watchdog_sdei.c b/arch/arm64/kernel/watchdog_sdei.c index 05b9a9a223a7..aa980b090598 100644 --- a/arch/arm64/kernel/watchdog_sdei.c +++ b/arch/arm64/kernel/watchdog_sdei.c @@ -23,6 +23,7 @@ static int sdei_watchdog_event_num; static bool disable_sdei_nmi_watchdog; static bool sdei_watchdog_registered; +static DEFINE_PER_CPU(ktime_t, last_check_time); int watchdog_sdei_enable(unsigned int cpu) { @@ -35,6 +36,7 @@ int watchdog_sdei_enable(unsigned int cpu) refresh_hld_last_timestamp(); #endif + __this_cpu_write(last_check_time, ktime_get_mono_fast_ns()); sdei_api_set_secure_timer_period(watchdog_thresh); ret = sdei_api_event_enable(sdei_watchdog_event_num); @@ -63,6 +65,23 @@ void watchdog_sdei_disable(unsigned int cpu) static int sdei_watchdog_callback(u32 event, struct pt_regs *regs, void *arg) { + ktime_t delta, now = ktime_get_mono_fast_ns(); + + delta = now - __this_cpu_read(last_check_time); + __this_cpu_write(last_check_time, now); + + /* + * Set delta to 4/5 of the actual watchdog threshold period so the + * hrtimer is guaranteed to fire at least once within the real + * watchdog threshold. + */ + if (delta < watchdog_thresh * (u64)NSEC_PER_SEC * 4 / 5) { + pr_err(FW_BUG "SDEI Watchdog event triggered too soon, " + "time to last check:%lld ns\n", delta); + WARN_ON(1); + return 0; + } + watchdog_hardlockup_check(regs); return 0; -- 2.25.1

1 0

[PATCH 000/119] backport stable-4.19.154
by Yang Yingliang 02 Nov '20

02 Nov '20

Abhishek Pandit-Subedi (1): Bluetooth: Only mark socket zapped after unlocking Adam Goode (1): media: uvcvideo: Ensure all probed info is returned to v4l2 Aditya Pakki (1): media: st-delta: Fix reference count leak in delta_run_work Adrian Hunter (1): perf intel-pt: Fix "context_switch event has no tid" error Al Grant (1): perf: correct SNOOPX field offset Alex Williamson (1): vfio/pci: Clear token on bypass registration failure Alexander Aring (1): fs: dlm: fix configfs memory leak Athira Rajeev (1): powerpc/perf: Exclude pmc5/6 from the irrelevant PMU group constraints Brooke Basile (1): ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs() Can Guo (1): scsi: ufs: ufs-qcom: Fix race conditions caused by ufs_qcom_testbus_config() Chris Chiu (1): rtl8xxxu: prevent potential memory leak Christian Eggers (1): eeprom: at25: set minimum read/write access stride to 1 Christoph Hellwig (1): PM: hibernate: remove the bogus call to get_gendisk() in software_resume() Claudiu Beznea (1): clk: at91: clk-main: update key before writing AT91_CKGR_MOR Colin Ian King (1): IB/rdmavt: Fix sizeof mismatch Cong Wang (1): ip_gre: set dev->hard_header_len and dev->needed_headroom properly Cristian Ciocaltea (1): ARM: dts: owl-s500: Fix incorrect PPI interrupt specifiers Dan Aloni (1): svcrdma: fix bounce buffers for unaligned offsets and multiple pages Dan Carpenter (3): rpmsg: smd: Fix a kobj leak in in qcom_smd_parse_edge() Input: imx6ul_tsc - clean up some errors in imx6ul_tsc_resume() memory: omap-gpmc: Fix a couple off by ones Daniel Thompson (1): kdb: Fix pager search for multi-line strings Darrick J. Wong (2): ext4: limit entries returned when counting fsmap records xfs: make sure the rt allocator doesn't run off the end Dinghao Liu (7): watchdog: Fix memleak in watchdog_cdev_register watchdog: Use put_device on error media: vsp1: Fix runtime PM imbalance on error media: platform: s3c-camif: Fix runtime PM imbalance on error media: platform: sti: hva: Fix runtime PM imbalance on error media: bdisp: Fix runtime PM imbalance on error media: venus: core: Fix runtime PM imbalance in venus_probe Dirk Behme (1): i2c: rcar: Auto select RESET_CONTROLLER Doug Horn (1): Fix use after free in get_capset_info callback. Eli Billauer (1): usb: core: Solve race condition in anchor cleanup functions Eric Biggers (1): reiserfs: only call unlock_new_inode() if I_NEW Finn Thain (2): powerpc/tau: Check processor type before enabling TAU interrupt powerpc/tau: Disable TAU between measurements Francesco Ruggeri (1): netfilter: conntrack: connection timeout after re-register Greg Kroah-Hartman (1): Linux 4.19.154 Guenter Roeck (1): watchdog: sp5100: Fix definition of EFCH_PM_DECODEEN3 Hamish Martin (1): usb: ohci: Default to per-port over-current protection Hans de Goede (1): i2c: core: Restore acpi_walk_dep_device_list() getting called after registering the ACPI i2c devs Hauke Mehrtens (1): pwm: img: Fix null pointer access in probe Horia Geantă (1): ARM: dts: imx6sl: fix rng node Jamie Iles (1): f2fs: wait for sysfs kobject removal before freeing f2fs_sb_info Jan Kara (3): udf: Limit sparing table size udf: Avoid accessing uninitialized data on failed inode read reiserfs: Fix memory leak in reiserfs_parse_options() Jason Gunthorpe (2): RDMA/cma: Remove dead code for kernel rdmacm multicast RDMA/cma: Consolidate the destruction of a cma_multicast in one place Jassi Brar (1): mailbox: avoid timer start from callback Jernej Skrabec (1): ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix dcdc1 regulator Jing Xiangfeng (3): rapidio: fix the missed put_device() for rio_mport_add_riodev scsi: mvumi: Fix error return in mvumi_io_attach() scsi: ibmvfc: Fix error return in ibmvfc_probe() Joakim Zhang (1): can: flexcan: flexcan_chip_stop(): add error handling and propagate error value Johan Hovold (1): USB: cdc-acm: handle broken union descriptors Juri Lelli (1): sched/features: Fix !CONFIG_JUMP_LABEL case Kaige Li (1): NTB: hw: amd: fix an issue about leak system resources Kajol Jain (1): powerpc/perf/hv-gpci: Fix starting index value Keita Suzuki (2): misc: rtsx: Fix memory leak in rtsx_pci_probe brcmsmac: fix memory leak in wlc_phy_attach_lcnphy Krzysztof Kozlowski (5): Input: ep93xx_keypad - fix handling of platform_get_irq() error Input: omap4-keypad - fix handling of platform_get_irq() error Input: twl4030_keypad - fix handling of platform_get_irq() error Input: sun4i-ps2 - fix handling of platform_get_irq() error memory: fsl-corenet-cf: Fix handling of platform_get_irq() error Leon Romanovsky (1): overflow: Include header file with SIZE_MAX declaration Lijun Ou (1): RDMA/hns: Set the unsupported wr opcode Lorenzo Colitti (1): usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets. Mark Tomlinson (1): PCI: iproc: Set affinity mask on MSI interrupts Martijn de Gouw (1): SUNRPC: fix copying of multiple pages in gss_read_proxy_verf() Matthew Wilcox (Oracle) (1): ramfs: fix nommu mmap with gaps in the page cache Mauro Carvalho Chehab (2): media: saa7134: avoid a shift overflow usb: dwc3: simple: add support for Hikey 970 Michal Simek (1): arm64: dts: zynqmp: Remove additional compatible string for i2c IPs Navid Emamdoost (1): clk: bcm2835: add missing release if devm_clk_hw_register fails Nicholas Piggin (1): powerpc/64s/radix: Fix mm_cpumask trimming race vs kthread_use_mm Nilesh Javali (2): scsi: qedi: Protect active command list to avoid list corruption scsi: qedi: Fix list_del corruption while removing active I/O Oliver Neukum (2): media: ati_remote: sanity check for both endpoints USB: cdc-wdm: Make wdm_flush() interruptible and add wdm_fsync(). Pablo Neira Ayuso (1): netfilter: nf_fwd_netdev: clear timestamp in forwarding path Pali Rohár (1): mmc: sdio: Check for CISTPL_VERS_1 buffer size Pavel Machek (2): crypto: ccp - fix error handling media: firewire: fix memory leak Peilin Ye (1): ipvs: Fix uninit-value in do_ip_vs_set_ctl() Peng Fan (1): tty: serial: fsl_lpuart: fix lpuart32_poll_get_char Qiushi Wu (4): media: sti: Fix reference count leaks media: exynos4-is: Fix several reference count leaks due to pm_runtime_get_sync media: exynos4-is: Fix a reference count leak due to pm_runtime_get_sync media: exynos4-is: Fix a reference count leak Robert Hoo (1): KVM: x86: emulating RDPID failure shall return #UD rather than #GP Roman Bolshakov (1): scsi: target: core: Add CONTROL field for trace events Rustam Kovhaev (1): ntfs: add check for mft record size in superblock Sherry Sun (2): mic: vop: copy data to kernel space then write to io memory misc: vop: add round_up(x,4) for vring_size to avoid kernel panic Souptick Joarder (1): rapidio: fix error handling path Srikar Dronamraju (1): cpufreq: powernv: Fix frame-size-overflow in powernv_cpufreq_reboot_notifier Stephan Gerhold (2): arm64: dts: qcom: pm8916: Remove invalid reg size from wcd_codec arm64: dts: qcom: msm8916: Fix MDP/DSI interrupts Stephen Boyd (1): clk: rockchip: Initialize hw to error to avoid undefined behavior Tetsuo Handa (2): block: ratelimit handle_bad_sector() message mwifiex: don't call del_timer_sync() on uninitialized timer Thomas Pedersen (1): mac80211: handle lack of sband->bitrates in rates Tobias Jordan (1): lib/crc32.c: fix trivial typo in preprocessor condition Tong Zhang (1): tty: ipwireless: fix error handling Valentin Vidic (1): net: korina: cast KSEG0 address to pointer in kfree Vasant Hegde (1): powerpc/powernv/dump: Fix race while processing OPAL dump Vincent Mailhol (1): usb: cdc-acm: add quirk to blacklist ETAS ES58X devices Wang Yufen (1): brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach Weihang Li (1): RDMA/hns: Fix missing sq_sig_type when querying QP Xiaolong Huang (1): media: media/pci: prevent memory leak in bttv_probe Xiaoyang Xu (1): vfio iommu type1: Fix memory leak in vfio_iommu_type1_pin_pages YueHaibing (2): Input: stmfts - fix a & vs && typo memory: omap-gpmc: Fix build error without CONFIG_OF Zekun Shen (1): ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n() Zqiang (1): usb: gadget: function: printer: fix use-after-free in __lock_acquire zhenwei pi (1): nvmet: fix uninitialized work for zero kato Makefile | 2 +- arch/arm/boot/dts/imx6sl.dtsi | 2 + arch/arm/boot/dts/owl-s500.dtsi | 6 +- .../boot/dts/sun8i-r40-bananapi-m2-ultra.dts | 10 +- arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 +- arch/arm64/boot/dts/qcom/pm8916.dtsi | 2 +- arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 +- arch/powerpc/include/asm/tlb.h | 13 --- arch/powerpc/kernel/tau_6xx.c | 96 +++++++------------ arch/powerpc/mm/tlb-radix.c | 23 +++-- arch/powerpc/perf/hv-gpci-requests.h | 6 +- arch/powerpc/perf/isa207-common.c | 10 ++ arch/powerpc/platforms/Kconfig | 14 +-- arch/powerpc/platforms/powernv/opal-dump.c | 41 +++++--- arch/x86/kvm/emulate.c | 2 +- block/blk-core.c | 9 +- drivers/clk/at91/clk-main.c | 11 ++- drivers/clk/bcm/clk-bcm2835.c | 4 +- drivers/clk/rockchip/clk-half-divider.c | 2 +- drivers/cpufreq/powernv-cpufreq.c | 9 +- drivers/crypto/ccp/ccp-ops.c | 2 +- drivers/gpu/drm/virtio/virtgpu_kms.c | 2 + drivers/gpu/drm/virtio/virtgpu_vq.c | 10 +- drivers/i2c/busses/Kconfig | 1 + drivers/i2c/i2c-core-acpi.c | 11 ++- drivers/infiniband/core/cma.c | 84 +++++++--------- drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 1 - drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 1 + drivers/infiniband/sw/rdmavt/vt.c | 4 +- drivers/input/keyboard/ep93xx_keypad.c | 4 +- drivers/input/keyboard/omap4-keypad.c | 6 +- drivers/input/keyboard/twl4030_keypad.c | 8 +- drivers/input/serio/sun4i-ps2.c | 9 +- drivers/input/touchscreen/imx6ul_tsc.c | 27 +++--- drivers/input/touchscreen/stmfts.c | 2 +- drivers/mailbox/mailbox.c | 12 ++- drivers/media/firewire/firedtv-fw.c | 6 +- drivers/media/pci/bt8xx/bttv-driver.c | 13 ++- drivers/media/pci/saa7134/saa7134-tvaudio.c | 3 +- drivers/media/platform/exynos4-is/fimc-isp.c | 4 +- drivers/media/platform/exynos4-is/fimc-lite.c | 2 +- drivers/media/platform/exynos4-is/media-dev.c | 4 +- drivers/media/platform/exynos4-is/mipi-csis.c | 4 +- drivers/media/platform/qcom/venus/core.c | 5 +- drivers/media/platform/s3c-camif/camif-core.c | 5 +- drivers/media/platform/sti/bdisp/bdisp-v4l2.c | 3 +- drivers/media/platform/sti/delta/delta-v4l2.c | 4 +- drivers/media/platform/sti/hva/hva-hw.c | 4 +- drivers/media/platform/vsp1/vsp1_drv.c | 11 ++- drivers/media/rc/ati_remote.c | 4 + drivers/media/usb/uvc/uvc_v4l2.c | 30 ++++++ drivers/memory/fsl-corenet-cf.c | 6 +- drivers/memory/omap-gpmc.c | 8 +- drivers/misc/cardreader/rtsx_pcr.c | 4 +- drivers/misc/eeprom/at25.c | 2 +- drivers/misc/mic/vop/vop_main.c | 2 +- drivers/misc/mic/vop/vop_vringh.c | 24 +++-- drivers/mmc/core/sdio_cis.c | 3 + drivers/net/can/flexcan.c | 34 +++++-- drivers/net/ethernet/korina.c | 4 +- drivers/net/wireless/ath/ath10k/htt_rx.c | 8 ++ drivers/net/wireless/ath/ath9k/hif_usb.c | 19 ++++ .../broadcom/brcm80211/brcmfmac/msgbuf.c | 2 + .../broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 4 +- drivers/net/wireless/marvell/mwifiex/usb.c | 3 +- .../wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 10 +- drivers/ntb/hw/amd/ntb_hw_amd.c | 1 + drivers/nvme/target/core.c | 3 +- drivers/pci/controller/pcie-iproc-msi.c | 13 ++- drivers/pwm/pwm-img.c | 3 +- drivers/rapidio/devices/rio_mport_cdev.c | 18 ++-- drivers/rpmsg/qcom_smd.c | 32 +++++-- drivers/scsi/ibmvscsi/ibmvfc.c | 1 + drivers/scsi/mvumi.c | 1 + drivers/scsi/qedi/qedi_fw.c | 23 ++++- drivers/scsi/qedi/qedi_iscsi.c | 2 + drivers/scsi/ufs/ufs-qcom.c | 5 - drivers/tty/ipwireless/network.c | 4 +- drivers/tty/ipwireless/tty.c | 2 +- drivers/tty/serial/fsl_lpuart.c | 2 +- drivers/usb/class/cdc-acm.c | 23 +++++ drivers/usb/class/cdc-wdm.c | 72 ++++++++++---- drivers/usb/core/urb.c | 89 ++++++++++------- drivers/usb/dwc3/dwc3-of-simple.c | 1 + drivers/usb/gadget/function/f_ncm.c | 2 +- drivers/usb/gadget/function/f_printer.c | 16 +++- drivers/usb/host/ohci-hcd.c | 16 ++-- drivers/vfio/pci/vfio_pci_intrs.c | 4 +- drivers/vfio/vfio_iommu_type1.c | 3 +- drivers/watchdog/sp5100_tco.h | 2 +- drivers/watchdog/watchdog_dev.c | 6 +- fs/dlm/config.c | 3 + fs/ext4/fsmap.c | 3 + fs/f2fs/sysfs.c | 1 + fs/ntfs/inode.c | 6 ++ fs/ramfs/file-nommu.c | 2 +- fs/reiserfs/inode.c | 3 +- fs/reiserfs/super.c | 8 +- fs/udf/inode.c | 25 ++--- fs/udf/super.c | 6 ++ fs/xfs/xfs_rtalloc.c | 11 +++ include/linux/overflow.h | 1 + include/scsi/scsi_common.h | 7 ++ include/trace/events/target.h | 12 +-- include/uapi/linux/perf_event.h | 2 +- kernel/debug/kdb/kdb_io.c | 8 +- kernel/power/hibernate.c | 11 --- kernel/sched/core.c | 2 +- kernel/sched/sched.h | 13 ++- lib/crc32.c | 2 +- net/bluetooth/l2cap_sock.c | 7 +- net/ipv4/ip_gre.c | 15 ++- net/mac80211/cfg.c | 3 +- net/mac80211/sta_info.c | 4 + net/netfilter/ipvs/ip_vs_ctl.c | 7 +- net/netfilter/nf_conntrack_proto_tcp.c | 19 ++-- net/netfilter/nf_dup_netdev.c | 1 + net/netfilter/nft_fwd_netdev.c | 1 + net/sunrpc/auth_gss/svcauth_gss.c | 27 ++++-- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 3 +- samples/mic/mpssd/mpssd.c | 4 +- tools/perf/util/intel-pt.c | 8 +- 122 files changed, 808 insertions(+), 450 deletions(-) -- 2.25.1

1 119

[PATCH 000/145] backport stable-4.19.153
by Yang Yingliang 30 Oct '20

30 Oct '20

Alex Dewar (1): VMCI: check return value of get_user_pages_fast() for errors Arnd Bergmann (1): mtd: lpddr: fix excessive stack usage with clang Artem Savkov (1): pty: do tty_flip_buffer_push without port->lock in pty_write Arvind Sankar (1): x86/fpu: Allow multiple bits in clearcpuid= parameter Bryan O'Donoghue (1): wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680 Christophe JAILLET (5): crypto: ixp4xx - Fix the size used in a 'dma_free_coherent()' call ath10k: Fix the size used in a 'dma_free_coherent()' call in an error handling path mwifiex: Do not use GFP_KERNEL in atomic context staging: rtl8192u: Do not use GFP_KERNEL in atomic context scsi: qla4xxx: Fix an error handling path in 'qla4xxx_get_host_stats()' Colin Ian King (3): x86/events/amd/iommu: Fix sizeof mismatch video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error qtnfmac: fix resource leaks on unsupported iftype error return path Cong Wang (1): tipc: fix the skb_unshare() in tipc_buf_append() Dan Carpenter (8): ALSA: bebob: potential info leak in hwdep_read() cifs: remove bogus debug code ath6kl: prevent potential array overflow in ath6kl_add_new_sta() ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb() HID: roccat: add bounds checking in kone_sysfs_write_settings() ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd() mfd: sm501: Fix leaks in probe() scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs() Darrick J. Wong (2): xfs: limit entries returned when counting fsmap records xfs: fix high key handling in the rt allocator's query_range function David Ahern (1): ipv4: Restore flowi4_oif update before call to xfrm_lookup_route David Wilder (2): ibmveth: Switch order of ibmveth_helper calls. ibmveth: Identify ingress large send packets. Davide Caratti (1): net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels Defang Bo (1): nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download() Dinghao Liu (4): EDAC/i5100: Fix error handling order in i5100_init_one() media: omap3isp: Fix memleak in isp_probe media: mx2_emmaprp: Fix memleak in emmaprp_probe video: fbdev: radeon: Fix memleak in radeonfb_pci_register Dmitry Torokhov (1): HID: hid-input: fix stylus battery reporting Emmanuel Grumbach (1): iwlwifi: mvm: split a print to avoid a WARNING in ROC Eran Ben Elisha (1): net/mlx5: Don't call timecounter cyc2time directly from 1PPS flow Eric Dumazet (2): icmp: randomize the global rate limiter quota: clear padding in v2r1_mem2diskdqb() Finn Thain (3): powerpc/tau: Use appropriate temperature sample interval powerpc/tau: Convert from timer to workqueue powerpc/tau: Remove duplicated set_thresholds() call Greg Kroah-Hartman (1): Linux 4.19.153 Guenter Roeck (1): hwmon: (pmbus/max34440) Fix status register reads for MAX344{51,60,61} Guillaume Tucker (1): ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT values Hans de Goede (2): pwm: lpss: Fix off by one error in base_unit math in pwm_lpss_prepare() pwm: lpss: Add range limit check for the base_unit register value Heiner Kallweit (2): r8169: fix data corruption issue on RTL8402 r8169: fix operation under forced interrupt threading Herbert Xu (2): crypto: algif_aead - Do not set MAY_BACKLOG on the async path crypto: algif_skcipher - EBUSY on aio should be an error Håkon Bugge (2): IB/mlx4: Fix starvation in paravirt mux/demux IB/mlx4: Adjust delayed work when a dup is observed Jason Gunthorpe (2): RDMA/ucma: Fix locking for ctx->events_reported RDMA/ucma: Add missing locking around rdma_leave_multicast() Jian-Hong Pan (1): ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 Johannes Berg (1): nl80211: fix non-split wiphy information John Donnelly (1): scsi: target: tcmu: Fix warning: 'page' may be used uninitialized Jonathan Lemon (1): mlx4: handle non-napi callers to napi_poll Julian Anastasov (1): ipvs: clear skb->tstamp in forwarding path Karsten Graul (1): net/smc: fix valid DMBE buffer sizes Krzysztof Kozlowski (1): EDAC/ti: Fix handling of platform_get_irq() error Laurent Pinchart (2): media: uvcvideo: Set media controller entity functions media: uvcvideo: Silence shift-out-of-bounds warning Libing Zhou (1): x86/nmi: Fix nmi_handle() duration miscalculation Linus Walleij (4): net: dsa: rtl8366: Check validity of passed VLANs net: dsa: rtl8366: Refactor VLAN/PVID init net: dsa: rtl8366: Skip PVID setting if not requested net: dsa: rtl8366rb: Support all 4096 VLANs Lorenzo Colitti (2): usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above. usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well Maciej Żenczykowski (1): net/ipv4: always honour route mtu during forwarding Madhuparna Bhowmik (1): crypto: picoxcell - Fix potential race condition bug Marek Vasut (2): net: fec: Fix phy_device lookup for phy_reset_after_clk_enable() net: fec: Fix PHY init after phy_reset_after_clk_enable() Mark Salter (1): drivers/perf: xgene_pmu: Fix uninitialized resource struct Mark Tomlinson (1): mtd: mtdoops: Don't write panic data twice Michal Kalderon (2): RDMA/qedr: Fix use of uninitialized field RDMA/qedr: Fix inline size returned for iWARP Michał Mirosław (1): regulator: resolve supply after creating regulator Minas Harutyunyan (1): usb: dwc2: Fix INTR OUT transfers in DDMA mode. Nathan Chancellor (1): usb: dwc2: Fix parameter type in function pointer prototype Nathan Lynch (1): powerpc/pseries: explicitly reschedule during drmem_lmb list traversal Neal Cardwell (1): tcp: fix to update snd_wl1 in bulk receiver fast path Necip Fazil Yildiran (2): pinctrl: bcm: fix kconfig dependency warning when !GPIOLIB arc: plat-hsdk: fix kconfig dependency warning when !RESET_CONTROLLER Nicholas Mc Guire (2): powerpc/pseries: Fix missing of_node_put() in rng_init() powerpc/icp-hv: Fix missing of_node_put() in success path Ong Boon Leong (1): net: stmmac: use netif_tx_start|stop_all_queues() function Pablo Neira Ayuso (1): netfilter: nf_log: missing vlan offload tag and proto Pali Rohár (1): cpufreq: armada-37xx: Add missing MODULE_DEVICE_TABLE Qiushi Wu (7): media: rcar-vin: Fix a reference count leak. media: rockchip/rga: Fix a reference count leak. media: platform: fcp: Fix a reference count leak. media: camss: Fix a reference count leak. media: s5p-mfc: Fix a reference count leak media: stm32-dcmi: Fix a reference count leak media: ti-vpe: Fix a missing check and reference count leak Ralph Campbell (1): mm/memcg: fix device private memcg accounting Rohit Maheshwari (1): net/tls: sendfile fails with ktls offload Rohit kumar (2): ASoC: qcom: lpass-platform: fix memory leak ASoC: qcom: lpass-cpu: fix concurrency issue Samuel Holland (1): Bluetooth: hci_uart: Cancel init work before unregistering Sean Christopherson (1): KVM: x86/mmu: Commit zap of remaining invalid pages when recovering lpages Shyam Prasad N (1): cifs: Return the error from crypt_message when enc/dec key not found. Souptick Joarder (2): drivers/virt/fsl_hypervisor: Fix error handling path misc: mic: scif: Fix error handling path Srinivas Kandagatla (3): slimbus: core: check get_addr before removing laddr ida slimbus: core: do not enter to clock pause mode in core slimbus: qcom-ngd-ctrl: disable ngd in qmi server down callback Suravee Suthikulpanit (1): KVM: SVM: Initialize prev_ga_tag before use Suren Baghdasaryan (1): mm, oom_adj: don't loop through tasks in __set_oom_adj when not necessary Sylwester Nawrocki (1): media: Revert "media: exynos4-is: Add missed check for pinctrl_lookup_state()" Takashi Iwai (1): ALSA: seq: oss: Avoid mutex lock for a long-time ioctl Tero Kristo (1): crypto: omap-sham - fix digcnt register handling with export/import Thomas Gleixner (1): net: enic: Cure the enic api locking trainwreck Thomas Preston (2): pinctrl: mcp23s08: Fix mcp23x17_regmap initialiser pinctrl: mcp23s08: Fix mcp23x17 precious range Tianjia Zhang (3): crypto: mediatek - Fix wrong return value in mtk_desc_ring_alloc() scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba() scsi: csiostor: Fix wrong return value in csio_hw_prep_fw() Todd Kjos (1): binder: fix UAF when releasing todo list Tom Rix (8): media: tuner-simple: fix regression in simple_set_radio_freq media: m5mols: Check function pointer in m5mols_sensor_power media: tc358743: initialize variable media: tc358743: cleanup tc358743_cec_isr brcmfmac: check ndev pointer drm/gma500: fix error check video: fbdev: sis: fix null ptr dereference mwifiex: fix double free Tong Zhang (1): tty: serial: earlycon dependency Tyrel Datwyler (1): tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup() Vadim Pasternak (1): platform/x86: mlx-platform: Remove PSU EEPROM configuration Valentin Vidic (1): net: korina: fix kfree of rx/tx descriptor array Venkateswara Naralasetty (1): ath10k: provide survey info as accumulated data Vinay Kumar Yadav (3): chelsio/chtls: fix socket lock chelsio/chtls: correct netdevice for vlan interface chelsio/chtls: correct function return and return type Wilken Gottwalt (1): net: usb: qmi_wwan: add Cellient MPL200 card Xiaoliang Pang (1): cypto: mediatek - fix leaks in mtk_desc_ring_alloc Xie He (2): net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling ether_setup Yonghong Song (1): net: fix pos incrementment in ipv6_route_seq_next dinghao.liu(a)zju.edu.cn (1): backlight: sky81452-backlight: Fix refcount imbalance on error Łukasz Stelmach (2): spi: spi-s3c64xx: swap s3c64xx_spi_set_cs() and s3c64xx_enable_datapath() spi: spi-s3c64xx: Check return values .../admin-guide/kernel-parameters.txt | 2 +- Documentation/networking/ip-sysctl.txt | 4 +- Makefile | 2 +- arch/arc/plat-hsdk/Kconfig | 1 + arch/arm/mm/cache-l2x0.c | 16 +- arch/powerpc/include/asm/drmem.h | 18 +- arch/powerpc/include/asm/reg.h | 2 +- arch/powerpc/kernel/tau_6xx.c | 55 ++-- arch/powerpc/platforms/pseries/rng.c | 1 + arch/powerpc/sysdev/xics/icp-hv.c | 1 + arch/x86/events/amd/iommu.c | 2 +- arch/x86/kernel/fpu/init.c | 30 +- arch/x86/kernel/nmi.c | 5 +- arch/x86/kvm/mmu.c | 1 + arch/x86/kvm/svm.c | 1 + crypto/algif_aead.c | 7 +- crypto/algif_skcipher.c | 2 +- drivers/android/binder.c | 35 +-- drivers/bluetooth/hci_ldisc.c | 1 + drivers/bluetooth/hci_serdev.c | 2 + drivers/cpufreq/armada-37xx-cpufreq.c | 6 + drivers/crypto/chelsio/chtls/chtls_cm.c | 3 + drivers/crypto/chelsio/chtls/chtls_io.c | 5 +- drivers/crypto/ixp4xx_crypto.c | 2 +- drivers/crypto/mediatek/mtk-platform.c | 8 +- drivers/crypto/omap-sham.c | 3 + drivers/crypto/picoxcell_crypto.c | 9 +- drivers/edac/i5100_edac.c | 11 +- drivers/edac/ti_edac.c | 3 +- drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +- drivers/hid/hid-input.c | 4 +- drivers/hid/hid-roccat-kone.c | 23 +- drivers/hwmon/pmbus/max34440.c | 3 - drivers/infiniband/core/ucma.c | 6 +- drivers/infiniband/hw/mlx4/cm.c | 3 + drivers/infiniband/hw/mlx4/mad.c | 34 ++- drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 + drivers/infiniband/hw/qedr/main.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/media/i2c/m5mols/m5mols_core.c | 3 +- drivers/media/i2c/tc358743.c | 14 +- drivers/media/platform/exynos4-is/media-dev.c | 4 +- drivers/media/platform/mx2_emmaprp.c | 7 +- drivers/media/platform/omap3isp/isp.c | 6 +- .../media/platform/qcom/camss/camss-csiphy.c | 4 +- drivers/media/platform/rcar-fcp.c | 4 +- drivers/media/platform/rcar-vin/rcar-dma.c | 4 +- drivers/media/platform/rockchip/rga/rga-buf.c | 1 + drivers/media/platform/s5p-mfc/s5p_mfc_pm.c | 4 +- drivers/media/platform/stm32/stm32-dcmi.c | 4 +- drivers/media/platform/ti-vpe/vpe.c | 2 + drivers/media/tuners/tuner-simple.c | 5 +- drivers/media/usb/uvc/uvc_ctrl.c | 6 +- drivers/media/usb/uvc/uvc_entity.c | 35 +++ drivers/mfd/sm501.c | 8 +- drivers/misc/mic/scif/scif_rma.c | 4 +- drivers/misc/vmw_vmci/vmci_queue_pair.c | 10 +- drivers/mtd/lpddr/lpddr2_nvm.c | 35 ++- drivers/mtd/mtdoops.c | 11 +- drivers/net/dsa/realtek-smi.h | 4 +- drivers/net/dsa/rtl8366.c | 280 ++++++++++-------- drivers/net/dsa/rtl8366rb.c | 2 +- drivers/net/ethernet/cisco/enic/enic.h | 1 + drivers/net/ethernet/cisco/enic/enic_api.c | 6 + drivers/net/ethernet/cisco/enic/enic_main.c | 27 +- drivers/net/ethernet/freescale/fec_main.c | 35 ++- drivers/net/ethernet/ibm/ibmveth.c | 19 +- drivers/net/ethernet/korina.c | 3 +- drivers/net/ethernet/mellanox/mlx4/en_rx.c | 3 + drivers/net/ethernet/mellanox/mlx4/en_tx.c | 2 +- .../ethernet/mellanox/mlx5/core/lib/clock.c | 5 +- drivers/net/ethernet/realtek/r8169.c | 54 ++-- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 33 +-- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wan/hdlc.c | 10 +- drivers/net/wan/hdlc_raw_eth.c | 1 + drivers/net/wireless/ath/ath10k/ce.c | 2 +- drivers/net/wireless/ath/ath10k/mac.c | 2 +- drivers/net/wireless/ath/ath6kl/main.c | 3 + drivers/net/wireless/ath/ath6kl/wmi.c | 5 + drivers/net/wireless/ath/ath9k/htc_hst.c | 2 + drivers/net/wireless/ath/wcn36xx/main.c | 2 +- .../broadcom/brcm80211/brcmfmac/core.c | 2 +- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 +- drivers/net/wireless/marvell/mwifiex/scan.c | 2 +- drivers/net/wireless/marvell/mwifiex/sdio.c | 2 + .../net/wireless/quantenna/qtnfmac/commands.c | 2 + drivers/perf/xgene_pmu.c | 32 +- drivers/pinctrl/bcm/Kconfig | 1 + drivers/pinctrl/pinctrl-mcp23s08.c | 24 +- drivers/platform/x86/mlx-platform.c | 15 +- drivers/pwm/pwm-lpss.c | 7 +- drivers/regulator/core.c | 21 +- drivers/scsi/be2iscsi/be_main.c | 4 +- drivers/scsi/csiostor/csio_hw.c | 2 +- drivers/scsi/qla2xxx/qla_nvme.c | 2 +- drivers/scsi/qla4xxx/ql4_os.c | 2 +- drivers/slimbus/core.c | 6 +- drivers/slimbus/qcom-ngd-ctrl.c | 4 + drivers/spi/spi-s3c64xx.c | 52 +++- .../staging/rtl8192u/ieee80211/ieee80211_rx.c | 2 +- drivers/target/target_core_user.c | 2 +- drivers/tty/hvc/hvcs.c | 14 +- drivers/tty/pty.c | 2 +- drivers/tty/serial/Kconfig | 1 + drivers/usb/dwc2/gadget.c | 40 ++- drivers/usb/dwc2/params.c | 2 +- drivers/usb/gadget/function/f_ncm.c | 6 +- drivers/usb/gadget/function/u_ether.c | 2 +- drivers/video/backlight/sky81452-backlight.c | 1 + drivers/video/fbdev/aty/radeon_base.c | 2 +- drivers/video/fbdev/sis/init.c | 11 +- drivers/video/fbdev/vga16fb.c | 14 +- drivers/virt/fsl_hypervisor.c | 17 +- fs/cifs/asn1.c | 16 +- fs/cifs/smb2ops.c | 2 +- fs/proc/base.c | 3 +- fs/quota/quota_v2.c | 1 + fs/xfs/libxfs/xfs_rtbitmap.c | 11 +- fs/xfs/xfs_fsmap.c | 3 + include/linux/oom.h | 1 + include/linux/sched/coredump.h | 1 + include/net/ip.h | 6 + include/net/netfilter/nf_log.h | 1 + kernel/fork.c | 21 ++ mm/memcontrol.c | 5 +- mm/oom_kill.c | 2 + net/ipv4/icmp.c | 7 +- net/ipv4/netfilter/nf_log_arp.c | 19 +- net/ipv4/netfilter/nf_log_ipv4.c | 6 +- net/ipv4/route.c | 4 +- net/ipv4/tcp_input.c | 2 + net/ipv6/ip6_fib.c | 4 +- net/ipv6/netfilter/nf_log_ipv6.c | 8 +- net/netfilter/ipvs/ip_vs_xmit.c | 6 + net/netfilter/nf_log_common.c | 12 + net/nfc/netlink.c | 2 +- net/sched/act_tunnel_key.c | 2 +- net/smc/smc_core.c | 2 +- net/tipc/msg.c | 3 +- net/tls/tls_device.c | 11 +- net/wireless/nl80211.c | 5 +- sound/core/seq/oss/seq_oss.c | 7 +- sound/firewire/bebob/bebob_hwdep.c | 3 +- sound/pci/hda/patch_realtek.c | 42 +++ sound/soc/qcom/lpass-cpu.c | 16 - sound/soc/qcom/lpass-platform.c | 3 +- 147 files changed, 968 insertions(+), 566 deletions(-) -- 2.25.1

1 145

2024

2023

2022

2021

2020

2019

Kernel