RE: [PATCH 03/10] perf tool: new iterfaces to read event from ring buffer

> On 2017/10/11 3:17, Arnaldo Carvalho de Melo wrote: > > Em Wed, Oct 11, 2017 at 03:10:37AM +0800, Wangnan (F) escreveu: > >> > >> On 2017/10/11 3:00, Arnaldo Carvalho de Melo wrote: > >>> Em Tue, Oct 10, 2017 at 03:36:28PM -0300, Arnaldo Carvalho de Melo > escreveu: > Em Tue, Oct 10, 2017 at

[PATCH 4.9 016/105] USB: dummy-hcd: Fix erroneous synchronization change

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 upstream. A recent change to the synchronization in dummy-hcd was incorrect. The issue was that dummy_udc_stop() contained no locking

[PATCH 4.9 002/105] USB: gadgetfs: fix copy_to_user while holding spinlock

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit 6e76c01e71551cb221c1f3deacb9dcd9a7346784 upstream. The gadgetfs driver as a long-outstanding FIXME, regarding a call of copy_to_user() made while holding a spinlock. This pat

[PATCH 4.9 017/105] USB: devio: Dont corrupt user memory

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Dan Carpenter commit fa1ed74eb1c233be6131ec92df21ab46499a15b6 upstream. The user buffer has "uurb->buffer_length" bytes. If the kernel has more information than that, we should truncate it ins

[PATCH 4.9 018/105] usb: gadget: mass_storage: set msg_registered after msg registered

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Li Jun commit 8e55d30322c6a0ef746c256a1beda9c73ecb27a6 upstream. If there is no UDC available, the msg register will fail and this flag will not be set, but the driver is already added into pen

[PATCH 4.9 021/105] USB: core: harden cdc_parse_cdc_header

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Greg Kroah-Hartman commit 2e1c42391ff2556387b3cb6308b24f6f65619feb upstream. Andrey Konovalov reported a possible out-of-bounds problem for the cdc_parse_cdc_header function. He writes:

[PATCH] staging: greybus: mark expected switch fall-through in check_urb_status

In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Signed-off-by: Gustavo A. R. Silva --- drivers/staging/greybus/es2.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/staging/greybus/es2.c b/drivers/staging/greybus/es2.c inde

[PATCH 4.9 022/105] usb: Increase quirk delay for USB devices

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Dmitry Fleytman commit b2a542bbb3081dbd64acc8929c140d196664c406 upstream. Commit e0429362ab15 ("usb: Add device quirk for Logitech HD Pro Webcams C920 and C930e") introduced quirk to workaround

[PATCH 4.9 023/105] USB: fix out-of-bounds in usb_set_configuration

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Greg Kroah-Hartman commit bd7a3fe770ebd8391d1c7d072ff88e9e76d063eb upstream. Andrey Konovalov reported a possible out-of-bounds problem for a USB interface association descriptor. He writes:

[PATCH 4.9 025/105] xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Mathias Nyman commit 4ec1cd3e7ccc35681270da028dbc29ca7bbd upstream. The flow control workaround for ASM1042A xHC hosts sleeps between register polling. The workaround gets called in several

[PATCH 4.9 028/105] iio: adc: twl4030: Fix an error handling path in twl4030_madc_probe()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Christophe JAILLET commit 245a396a9b1a67ac5c3228737c261b3e48708a2a upstream. If 'devm_regulator_get()' fails, we should go through the existing error handling path instead of returning directly

[PATCH 4.9 026/105] xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Mathias Nyman commit 7bea22b124d77845c85a62eaa29a85ba6cc2f899 upstream. A SuperSpeedPlus roothub needs to have the Link Protocol (LP) bit set in the bmSublinkSpeedAttr[] entry of a SuperSpeedPl

[PATCH 4.9 003/105] usb: gadget: udc: atmel: set vbus irqflags explicitly

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Nicolas Ferre commit 6baeda120d90aa637b08f7604de104ab00ce9126 upstream. The driver triggers actions on both edges of the vbus signal. The former PIO controller was triggering IRQs on both fall

[PATCH 4.9 027/105] Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts"

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Kai-Heng Feng commit bcd6a7aa13800afc1418e6b29d944d882214939a upstream. This reverts commit dec08194ffeccfa1cf085906b53d301930eae18f. Commit dec08194ffec ("xhci: Limit USB2 port wake support f

[PATCH 4.9 032/105] iio: core: Return error for failed read_reg

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Matt Fornero commit 3d62c78a6eb9a7d67bace9622b66ad51e81c5f9b upstream. If an IIO device returns an error code for a read access via debugfs, it is currently ignored by the IIO core (other than

[PATCH 4.9 030/105] iio: ad_sigma_delta: Implement a dedicated reset function

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Dragos Bogdan commit 7fc10de8d49a748c476532c9d8e8fe19e548dd67 upstream. Since most of the SD ADCs have the option of reseting the serial interface by sending a number of SCLKs with CS = 0 and D

[PATCH 4.9 034/105] iio: ad7793: Fix the serial interface reset

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Dragos Bogdan commit 7ee3b7ebcb74714df6d94c8f500f307e1ee5dda5 upstream. The serial interface can be reset by writing 32 consecutive 1s to the device. 'ret' was initialized correctly but its val

[PATCH 4.9 036/105] iio: adc: mcp320x: Fix oops on module unload

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Lukas Wunner commit 0964e40947a630a2a6f724e968246992f97bcf1c upstream. The driver calls spi_get_drvdata() in its ->remove hook even though it has never called spi_set_drvdata(). Stack trace fo

[PATCH 4.9 035/105] iio: adc: mcp320x: Fix readout of negative voltages

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Lukas Wunner commit e6f4794371ee7cce1339e7ca9542f1e703c5f84a upstream. Commit f686a36b4b79 ("iio: adc: mcp320x: Add support for mcp3301") returns a signed voltage from mcp320x_adc_conversion()

Re: [PATCH] block: add partition uuid into uevent as "PARTUUID"

Hi Konstantin, > On Oct 6, 2017, at 7:42 AM, Konstantin Khlebnikov > wrote: > > Both most common formats have uuid in addition to partition name: > GPT: standard uuid ---- > DOS: 4 byte disk signature and 1 byte partition -xx > > Tools from util-linux us

[PATCH 4.9 004/105] usb: gadget: udc: renesas_usb3: fix for no-data control transfer

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Yoshihiro Shimoda commit 4dcf4bab4a409e81284b8202137e4a85b96b34de upstream. When bRequestType & USB_DIR_IN is false and req.length is 0 in control transfer, since it means non-data, this driver

[PATCH 4.9 007/105] usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit 113f6eb6d50cfa5e2a1cdcf1678b12661fa272ab upstream. Kris Lindgren reports that without the NO_WP_DETECT flag, his Seagate external disk drive fails all write accesses. This re

[PATCH 4.9 006/105] usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Yoshihiro Shimoda commit 447b8a01b84f048d93d43bfe1fcaa4fcc56595cc upstream. This patch fixes an issue that this driver cannot go status stage in control read when the req.zero is set to 1 and t

[PATCH 4.9 008/105] usb-storage: fix bogus hardware error messages for ATA pass-thru devices

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit a4fd4a724d6c30ad671046d83be2e9be2f11d275 upstream. Ever since commit a621bac3044e ("scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands"), people have been getti

[PATCH 4.9 049/105] tcp: update skb->skb_mstamp more carefully

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 8c72c65b426b47b3c166a8fef0d8927fe5e8a28d ] liujian reported a problem in TCP_USER_TIMEOUT processing with a patch in tcp_probe_timer() : https://www.spinic

[PATCH 4.9 000/105] 4.9.55-stable review

This is the start of the stable review cycle for the 4.9.55 release. There are 105 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu Oct 12 19:24:56 UTC 2017. Anything receiv

[PATCH 4.9 053/105] ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit 76cc0d3282d4b933fa144fa41fbc5318e0fdca24 ] Now in ip6gre_header before packing the ipv6 header, it skb_push t->hlen which only includes encap_hlen + tun_hlen. It mea

[PATCH 4.9 051/105] tcp: fix data delivery rate

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit fc22579917eb7e13433448a342f1cb1592920940 ] Now skb->mstamp_skb is updated later, we also need to call tcp_rate_skb_sent() after the update is done. Fixes: 8c72c

[PATCH 4.9 052/105] udpv6: Fix the checksum computation when HW checksum does not apply

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Subash Abhinov Kasiviswanathan [ Upstream commit 63ecc3d9436f8012e49dc846d6cb0a85a3433517 ] While trying an ESP transport mode encryption for UDPv6 packets of datagram size 1436 with MTU 1500,

Re: [PATCH v2] dts: display5: Device tree description of LWN's DISPLAY5 board

Hi Lukasz, Usually the Subject should have the ARM prefix: ARM: dts: On Mon, Sep 25, 2017 at 12:37 PM, Lukasz Majewski wrote: > + backlight_lvds: backlight { > + compatible = "pwm-backlight"; > + pinctrl-names = "default"; > + pinctrl-0 = <&p

[PATCH 4.9 056/105] net/sched: cls_matchall: fix crash when used with classful qdisc

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Davide Caratti [ Upstream commit 3ff4cbec87da48b0ec1f7b6196607b034de0c680 ] this script, edited from Linux Advanced Routing and Traffic Control guide tc q a dev en0 root handle 1: htb default

[PATCH 4.9 058/105] net: emac: Fix napi poll list corruption

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Christian Lamparter [ Upstream commit f55956065ec94e3e9371463d693a1029c4cc3007 ] This patch is pretty much a carbon copy of commit 3079c652141f ("caif: Fix napi poll list corruption") with "ca

Re: [PATCH] radix-tree: get_slot_offset() returns invalid offset when parent is NULL

On Tue, 10 Oct 2017 10:52:01 +0800 Wei Yang wrote: > When parent is NULL, get_slot_offset() returns almost the address of slot. > This is an invalid value for offset. > > One possible scenario happens on deleting #0 index, when it is the only one > in tree. > > Current behavior doesn't harm the

[PATCH 4.9 061/105] isdn/i4l: fetch the ppp_write buffer in one shot

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Meng Xu [ Upstream commit 02388bf87f72e1d47174cd8f81c34443920eb5a0 ] In isdn_ppp_write(), the header (i.e., protobuf) of the buffer is fetched twice from userspace. The first fetch is used to

[PATCH 4.9 060/105] bpf: one perf event close wont free bpf program attached by another perf event

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Yonghong Song [ Upstream commit ec9dd352d591f0c90402ec67a317c1ed4fb2e638 ] This patch fixes a bug exhibited by the following scenario: 1. fd1 = perf_event_open with attr.config = ID1 2. at

[PATCH 4.9 062/105] net_sched: always reset qdisc backlog in qdisc_reset()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Konstantin Khlebnikov [ Upstream commit c8e1812960eeae42e2183154927028511c4bc566 ] SKB stored in qdisc->gso_skb also counted into backlog. Some qdiscs don't reset backlog to zero in ->reset()

[PATCH 4.9 066/105] l2tp: fix race condition in l2tp_tunnel_delete

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Sabrina Dubroca [ Upstream commit 62b982eeb4589b2e6d7c01a90590e3a4c2b2ca19 ] If we try to delete the same tunnel twice, the first delete operation does a lookup (l2tp_tunnel_get), finds the tu

[PATCH 4.9 059/105] packet: hold bind lock when rebinding to fanout hook

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Willem de Bruijn [ Upstream commit 008ba2a13f2d04c947adc536d19debb8fe66f110 ] Packet socket bind operations must hold the po->bind_lock. This keeps po->running consistent with whether the sock

[PATCH 4.9 067/105] tun: bail out from tun_get_user() if the skb is empty

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Alexander Potapenko [ Upstream commit 2580c4c17aee3ad58e9751012bad278dd074ccae ] KMSAN (https://github.com/google/kmsan) reported accessing uninitialized skb->data[0] in the case the skb is em

[PATCH 4.9 042/105] lsm: fix smack_inode_removexattr and xattr_getsecurity memleak

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Casey Schaufler commit 57e7ba04d422c3d41c8426380303ec9b7533ded9 upstream. security_inode_getsecurity() provides the text string value of a security attribute. It does not provide a "secctx". Th

[PATCH 4.9 072/105] netlink: do not proceed if dumps start() errs

4.9-stable review patch. If anyone has any objections, please let me know. -- From: "Jason A. Donenfeld" [ Upstream commit fef0035c0f31322d417d1954bba5ab959bf91183 ] Drivers that use the start method for netlink dumping rely on dumpit not being called if start fails. For exam

[PATCH 4.9 070/105] packet: only test po->has_vnet_hdr once in packet_snd

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Willem de Bruijn [ Upstream commit da7c9561015e93d10fe6aab73e9288e0d09d65a6 ] Packet socket option po->has_vnet_hdr can be updated concurrently with other operations if no ring is attached. D

[PATCH 4.9 073/105] ip6_gre: ip6gre_tap device should keep dst

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit 2d40557cc702ed8e5edd9bd422233f86652d932e ] The patch 'ip_gre: ipgre_tap device should keep dst' fixed a issue that ipgre_tap mtu couldn't be updated in tx path. The

[PATCH 4.9 075/105] tipc: use only positive error codes in messages

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Parthasarathy Bhuvaragan [ Upstream commit aad06212d36cf34859428a0a279e5c14ee5c9e26 ] In commit e3a77561e7d32 ("tipc: split up function tipc_msg_eval()"), we have updated the function tipc_msg

[PATCH 4.9 077/105] socket, bpf: fix possible use after free

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit eefca20eb20c66b06cf5ed09b49b1a7caaa27b7b ] Starting from linux-4.4, 3WHS no longer takes the listener lock. Since this time, we might hit a use-after-free in sk

[PATCH 4.9 078/105] powerpc/64s: Use emergency stack for kernel TM Bad Thing program checks

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Cyril Bur commit 265e60a170d0a0ecfc2d20490134ed2c48dd45ab upstream. When using transactional memory (TM), the CPU can be in one of six states as far as TM is concerned, encoded in the Machine S

[PATCH 4.9 043/105] ALSA: compress: Remove unused variable

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Guneshwor Singh commit a931b9ce93841a5b66b709ba5a244276e345e63b upstream. Commit 04c5d5a430fc ("ALSA: compress: Embed struct device") removed the statement that used 'str' but didn't remove the

[PATCH 4.9 046/105] mlxsw: spectrum: Prevent mirred-related crash on removal

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Yuval Mintz [ Upstream commit 6399ebcccffa12e65bc15eda039d37673264ebce ] When removing the offloading of mirred actions under matchall classifiers, mlxsw would find the destination port associ

[PATCH 4.9 048/105] sctp: potential read out of bounds in sctp_ulpevent_type_enabled()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Dan Carpenter [ Upstream commit fa5f7b51fc3080c2b195fa87c7eca7c05e56f673 ] This code causes a static checker warning because Smatch doesn't trust anything that comes from skb->data. I've revi

[PATCH 4.9 081/105] driver core: platform: Dont read past the end of "driver_override" buffer

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Nicolai Stange commit bf563b01c2895a4bfd1a29cc5abc67fe706ecffd upstream. When printing the driver_override parameter when it is 4095 and 4094 bytes long, the printing code would access invalid

[PATCH 4.9 039/105] staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Stefan Wahren commit 974d4d03fc020af4fa4e9e72a86f0fefa37803c5 upstream. This fixes a NULL pointer dereference on RPi 2 with multi_v7_defconfig. The function page_address() could return NULL wit

[PATCH 4.9 093/105] scsi: sd: Do not override max_sectors_kb sysfs setting

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Martin K. Petersen commit 77082ca503bed061f7fbda7cfd7c93beda967a41 upstream. A user may lower the max_sectors_kb setting in sysfs to accommodate certain workloads. Previously we would always se

[PATCH 4.9 091/105] iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Luca Coelho commit 97bce57bd7f96e1218751996f549a6e61f18cc8c upstream. The MCAST_FILTER_CMD can get quite large when we have many mcast addresses to set (we support up to 255). So the command s

[PATCH 4.9 095/105] brcmfmac: setup passive scan if requested by user-space

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arend Van Spriel commit 35f62727df0ed8e5e4857e162d94fd46d861f1cf upstream. The driver was not properly configuring firmware with regard to the type of scan. It always performed an active scan e

[PATCH 4.9 097/105] nvme-pci: Use PCI bus address for data/queues in CMB

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Christoph Hellwig commit 8969f1f8291762c13147c1ba89d46238af01675b upstream. Currently, NVMe PCI host driver is programming CMB dma address as I/O SQs addresses. This results in failures on syst

[PATCH 4.9 100/105] vfs: deny copy_file_range() for non regular files

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Amir Goldstein commit 11cbfb10775aa2a01cee966d118049ede9d0bdf2 upstream. There is no in-tree file system that implements copy_file_range() for non regular files. Deny an attempt to copy_file_r

[PATCH 4.9 082/105] Drivers: hv: fcopy: restore correct transfer length

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Olaf Hering commit 549e658a0919e355a2b2144dc380b3729bef7f3e upstream. Till recently the expected length of bytes read by the daemon did depend on the context. It was either hv_start_fcopy or hv

[PATCH 4.9 099/105] sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Peter Zijlstra commit 50e76632339d4655859523a39249dd95ee5e93e7 upstream. Cpusets vs. suspend-resume is _completely_ broken. And it got noticed because it now resulted in non-cpuset usage breaki

[PATCH 4.9 083/105] stm class: Fix a use-after-free

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Alexander Shishkin commit fd085bb1766d6a598f53af2308374a546a49775a upstream. For reasons unknown, the stm_source removal path uses device_destroy() to kill the underlying device object. Because

[PATCH 4.9 104/105] f2fs: dont allow encrypted operations without keys

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jaegeuk Kim commit 363fa4e078cbdc97a172c19d19dc04b41b52ebc8 upstream. This patch fixes the renaming bug on encrypted filenames, which was pointed by (ext4: don't allow encrypted operations wi

[PATCH 4.9 102/105] ext4: Dont clear SGID when inheriting ACLs

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jan Kara commit a3bb2d5587521eea6dab2d05326abb0afb460abd upstream. When new directory 'DIR1' is created in a directory 'DIR0' with SGID bit set, DIR1 is expected to have SGID bit set (and ownin

[PATCH 4.9 084/105] ftrace: Fix kmemleak in unregister_ftrace_graph

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Shu Wang commit 2b0b8499ae75df91455bbeb7491d45affc384fb0 upstream. The trampoline allocated by function tracer was overwriten by function_graph tracer, and caused a memory leak. The save_global

[PATCH 4.9 087/105] HID: wacom: Always increment hdev refcount within wacom_get_hdev_data

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jason Gerecke commit 2a5e597c6bb1b873e473e5f57147e9e5d2755430 upstream. The wacom_get_hdev_data function is used to find and return a reference to the "other half" of a Wacom device (i.e., the

[PATCH 4.9 085/105] HID: i2c-hid: allocate hid buffers for real worst case

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Adrian Salido commit 8320caeeffdefec3b58b9d4a7ed8e1079492fe7b upstream. The buffer allocation is not currently accounting for an extra byte for the report id. This can cause an out of bounds ac

[PATCH 4.9 088/105] HID: wacom: bits shifted too much for 9th and 10th buttons

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Ping Cheng commit ce06760ba46b66dae50f2519ae76bd15e89b5710 upstream. Cintiq 12 has 10 expresskey buttons. The bit shift for the last two buttons were off by 5. Fixes: c7f0522 ("HID: wacom: Sli

[PATCH 4.9 089/105] rocker: fix rocker_tlv_put_* functions for KASAN

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit 6098d7ddd62f532f80ee2a4b01aca500a8e4e9e4 upstream. Inlining these functions creates lots of stack variables that each take 64 bytes when KASAN is enabled, leading to this w

[PATCH 4.13 010/160] sctp: potential read out of bounds in sctp_ulpevent_type_enabled()

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Dan Carpenter [ Upstream commit fa5f7b51fc3080c2b195fa87c7eca7c05e56f673 ] This code causes a static checker warning because Smatch doesn't trust anything that comes from skb->data. I've rev

[PATCH 4.13 011/160] tcp: update skb->skb_mstamp more carefully

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 8c72c65b426b47b3c166a8fef0d8927fe5e8a28d ] liujian reported a problem in TCP_USER_TIMEOUT processing with a patch in tcp_probe_timer() : https://www.spini

[PATCH 4.13 013/160] tcp: fix data delivery rate

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit fc22579917eb7e13433448a342f1cb1592920940 ] Now skb->mstamp_skb is updated later, we also need to call tcp_rate_skb_sent() after the update is done. Fixes: 8c72

[PATCH 4.13 014/160] udpv6: Fix the checksum computation when HW checksum does not apply

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Subash Abhinov Kasiviswanathan [ Upstream commit 63ecc3d9436f8012e49dc846d6cb0a85a3433517 ] While trying an ESP transport mode encryption for UDPv6 packets of datagram size 1436 with MTU 1500

[PATCH 4.13 016/160] net: phy: Fix mask value write on gmii2rgmii converter speed register

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Fahad Kunnathadi [ Upstream commit f2654a4781318dc7ab8d6cde66f1fa39eab980a9 ] To clear Speed Selection in MDIO control register(0x10), ie, clear bits 6 and 13 to zero while keeping other bits

[PATCH 4.13 015/160] ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit 76cc0d3282d4b933fa144fa41fbc5318e0fdca24 ] Now in ip6gre_header before packing the ipv6 header, it skb_push t->hlen which only includes encap_hlen + tun_hlen. It me

[PATCH 4.13 020/160] bpf: do not disable/enable BH in bpf_map_free_id()

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 930651a75bf1ba6893a8b8475270664ebdb6cf4a ] syzkaller reported following splat [1] Since hard irq are disabled by the caller, bpf_map_free_id() should not try t

[PATCH 4.13 022/160] net: emac: Fix napi poll list corruption

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Christian Lamparter [ Upstream commit f55956065ec94e3e9371463d693a1029c4cc3007 ] This patch is pretty much a carbon copy of commit 3079c652141f ("caif: Fix napi poll list corruption") with "c

[PATCH 4.13 002/160] usb: dwc3: ep0: fix DMA starvation by assigning req->trb on ep0

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Felipe Balbi commit 55168470835688e5da5828cdcf1b1498d7baadb1 upstream. If we don't assign a TRB to ep0 requests, we won't be able to unmap the request later on resulting in starvation of DMA r

[PATCH 4.13 024/160] packet: hold bind lock when rebinding to fanout hook

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Willem de Bruijn [ Upstream commit 008ba2a13f2d04c947adc536d19debb8fe66f110 ] Packet socket bind operations must hold the po->bind_lock. This keeps po->running consistent with whether the soc

[PATCH 4.13 021/160] tcp: fastopen: fix on syn-data transmit failure

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit b5b7db8d680464b1d631fd016f5e093419f0bfd9 ] Our recent change exposed a bug in TCP Fastopen Client that syzkaller found right away [1] When we prepare skb with

[PATCH 4.13 027/160] isdn/i4l: fetch the ppp_write buffer in one shot

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Meng Xu [ Upstream commit 02388bf87f72e1d47174cd8f81c34443920eb5a0 ] In isdn_ppp_write(), the header (i.e., protobuf) of the buffer is fetched twice from userspace. The first fetch is used to

[PATCH 4.13 003/160] mlxsw: spectrum: Fix EEPROM access in case of SFP/SFP+

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Arkadi Sharshevsky [ Upstream commit 4400081b631af69abc63cea3352680e3d85e0c39 ] The current code does not handle correctly the access to the upper page in case of SFP/SFP+ EEPROM. In that cas

[PATCH 4.13 028/160] net_sched: always reset qdisc backlog in qdisc_reset()

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Konstantin Khlebnikov [ Upstream commit c8e1812960eeae42e2183154927028511c4bc566 ] SKB stored in qdisc->gso_skb also counted into backlog. Some qdiscs don't reset backlog to zero in ->reset(

Re: [PATCH 03/10] perf tool: new iterfaces to read event from ring buffer

On 2017/10/11 3:55, Liang, Kan wrote: On 2017/10/11 3:17, Arnaldo Carvalho de Melo wrote: Em Wed, Oct 11, 2017 at 03:10:37AM +0800, Wangnan (F) escreveu: On 2017/10/11 3:00, Arnaldo Carvalho de Melo wrote: Em Tue, Oct 10, 2017 at 03:36:28PM -0300, Arnaldo Carvalho de Melo escreveu: Em Tue,

[PATCH 4.13 032/160] l2tp: fix race condition in l2tp_tunnel_delete

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Sabrina Dubroca [ Upstream commit 62b982eeb4589b2e6d7c01a90590e3a4c2b2ca19 ] If we try to delete the same tunnel twice, the first delete operation does a lookup (l2tp_tunnel_get), finds the t

[PATCH 4.13 030/160] net: qcom/emac: specify the correct size when mapping a DMA buffer

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Timur Tabi [ Upstream commit a93ad944f4ff9a797abff17c73fc4b1e4a1d9141 ] When mapping the RX DMA buffers, the driver was accidentally specifying zero for the buffer length. Under normal circu

[PATCH 4.13 031/160] vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Alexey Kodanev [ Upstream commit 36f6ee22d2d66046e369757ec6bbe1c482957ba6 ] When running LTP IPsec tests, KASan might report: BUG: KASAN: use-after-free in vti_tunnel_xmit+0xeee/0xff0 [ip_vt

[PATCH 4.13 033/160] tun: bail out from tun_get_user() if the skb is empty

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Alexander Potapenko [ Upstream commit 2580c4c17aee3ad58e9751012bad278dd074ccae ] KMSAN (https://github.com/google/kmsan) reported accessing uninitialized skb->data[0] in the case the skb is e

[PATCH 4.13 006/160] mlxsw: spectrum: Prevent mirred-related crash on removal

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Yuval Mintz [ Upstream commit 6399ebcccffa12e65bc15eda039d37673264ebce ] When removing the offloading of mirred actions under matchall classifiers, mlxsw would find the destination port assoc

[PATCH 4.13 035/160] net: dsa: Fix network device registration order

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Florian Fainelli [ Upstream commit e804441cfe0b60f6c430901946a69c01eac09df1 ] We cannot be registering the network device first, then setting its carrier off and finally connecting it to a PH

[PATCH 4.13 034/160] net: dsa: mv88e6xxx: Allow dsa and cpu ports in multiple vlans

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Andrew Lunn [ Upstream commit db06ae41945b14feb7f696dcafe8048cc37e8a20 ] Ports with the same VLAN must all be in the same bridge. However the CPU and DSA ports need to be in multiple VLANs sp

[PATCH 4.13 008/160] net_sched: gen_estimator: fix scaling error in bytes/packets samples

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit ca558e185972d8ecd308760abf972f5d408bcff0 ] Denys reported wrong rate estimations with HTB classes. It appears the bug was added in linux-4.10, since my tests w

[PATCH 4.13 000/160] 4.13.6-stable review

This is the start of the stable review cycle for the 4.13.6 release. There are 160 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu Oct 12 19:05:14 UTC 2017. Anything receiv

[PATCH 4.13 048/160] net: rtnetlink: fix info leak in RTM_GETSTATS call

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Nikolay Aleksandrov [ Upstream commit ce024f42c2e28b6bce4ecc1e891b42f57f753892 ] When RTM_GETSTATS was added the fields of its header struct were not all initialized when returning the result

[PATCH 4.13 050/160] usb: gadget: core: fix ->udc_set_speed() logic

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Roger Quadros commit 97e133d54c1ca8948b191e5721a145a76c4db33d upstream. Consider the following case: udc controller supports SuperSpeed. If we first load a HighSpeed gadget followed by a Supe

[PATCH 4.13 049/160] bpf: fix bpf_tail_call() x64 JIT

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Alexei Starovoitov [ Upstream commit 90caccdd8cc0215705f18b92771b449b01e2474a ] - bpf prog_array just like all other types of bpf array accepts 32-bit index. Clarify that in the comment. -

[PATCH 4.13 051/160] USB: gadgetfs: Fix crash caused by inadequate synchronization

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit 520b72fc64debf8a86c3853b8e486aa5982188f0 upstream. The gadgetfs driver (drivers/usb/gadget/legacy/inode.c) was written before the UDC and composite frameworks were adopted; i

[PATCH 4.13 053/160] usb: gadget: udc: atmel: set vbus irqflags explicitly

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Nicolas Ferre commit 6baeda120d90aa637b08f7604de104ab00ce9126 upstream. The driver triggers actions on both edges of the vbus signal. The former PIO controller was triggering IRQs on both fal

Re: [PATCH] ARM: head-common.S: Clear lr before jumping to start_kernel()

* Geert Uytterhoeven [171003 11:32]: > On Tue, Oct 3, 2017 at 8:15 PM, Geert Uytterhoeven > wrote: > > On Tue, Oct 3, 2017 at 8:11 PM, Geert Uytterhoeven > > wrote: > >> On Tue, Oct 3, 2017 at 5:37 PM, Nicolas Pitre > >> wrote: > >>> On Tue, 3 Oct 2017, Geert Uytterhoeven wrote: > >>> Please

[PATCH 4.13 056/160] usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Yoshihiro Shimoda commit 447b8a01b84f048d93d43bfe1fcaa4fcc56595cc upstream. This patch fixes an issue that this driver cannot go status stage in control read when the req.zero is set to 1 and

[PATCH 1/2] coresight: Extend the PIDR mask to cover relevant bits in PIDR2

From: Suzuki K Poulose As per coresight standards, PIDR2 register has the following format : [2-0] - JEP106_bits6to4 [3]- JEDEC, designer ID is specified by JEDEC. However some of the drivers only use mask of 0x3 for the PIDR2 leaving bits [3-2] unchecked, which could potentially match t

[PATCH 2/2] doc: coresight: correct usage for disabling idle states

From: Leo Yan In the coresight CPU debug document it suggests to use 'echo' command to set latency request to /dev/cpu_dma_latency so can disable all CPU idle states, but in fact this doesn't work. This is because when the command 'echo' exits, it releases the device node's file descriptor and t

[PATCH 0/2] coresight: next v4.14-rc4

Hey Greg, Just a couple of patches for this cycle (to counterweight the barrage of the last cycle). Please consider for the v4.15 cycle - applies on your char-misc-next (c2e5df616e1a) Regards, Mathieu Leo Yan (1): doc: coresight: correct usage for disabling idle states Suzuki K Poulose (1):

<    1   2   3   4   5   6   7   8   9   10   >