Re: [PATCH] binder: fix proc->files use-after-free

On Thu, Nov 16, 2017 at 09:48:13AM -0800, Todd Kjos wrote: > > @@ -875,22 +871,34 @@ static void binder_free_thread(struct binder_thread > > *thread); > > static void binder_free_proc(struct binder_proc *proc); > > static void binder_inc_node_tmpref_ilocked(struct binder_node *node); > > > > +st

[PATCH 4.13 27/44] ip6_gre: only increase err_count for some certain type icmpv6 in ip6gre_err

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit f8d20b46ce55cf40afb30dcef6d9288f7ef46d9b ] The similar fix in patch 'ipip: only increase err_count for some certain type icmp in ipip_err' is needed for ip6gre_err.

[PATCH 4.13 39/44] mac80211: use constant time comparison with keys

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Jason A. Donenfeld commit 2bdd713b92a9cade239d3c7d15205a09f556624d upstream. Otherwise we risk leaking information via timing side channel. Fixes: fdf7cb4185b6 ("mac80211: accept key reinstal

[PATCH 4.13 36/44] ipv6: addrconf: increment ifp refcount before ipv6_del_addr()

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit e669b86945478b3d90d2d87e3793a6eed06d332f ] In the (unlikely) event fixup_permanent_addr() returns a failure, addrconf_permanent_addr() calls ipv6_del_addr() wit

[PATCH 4.13 37/44] tcp: fix tcp_mtu_probe() vs highest_sack

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 2b7cda9c35d3b940eb9ce74b30bbd5eb30db493d ] Based on SNMP values provided by Roman, Yuchung made the observation that some crashes in tcp_sacktag_walk() might be

[PATCH 4.13 32/44] sctp: reset owner sk for data chunks on out queues when migrating a sock

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit d04adf1b355181e737b6b1e23d801b07f0b7c4c0 ] Now when migrating sock to another one in sctp_sock_migrate(), it only resets owner sk for the data in receive queues, no

[PATCH 4.13 34/44] l2tp: hold tunnel in pppol2tp_connect()

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Guillaume Nault [ Upstream commit f9e56baf03f9d36043a78f16e3e8b2cfd211e09e ] Use l2tp_tunnel_get() in pppol2tp_connect() to ensure the tunnel isn't going to disappear while processing the res

[PATCH 4.13 35/44] tun/tap: sanitize TUNSETSNDBUF input

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Craig Gallek [ Upstream commit 93161922c658c714715686cd0cf69b090cb9bf1d ] Syzkaller found several variants of the lockup below by setting negative values with the TUNSETSNDBUF ioctl. This pa

[PATCH 4.13 05/44] netlink: do not set cb_running if dumps start() errs

4.13-stable review patch. If anyone has any objections, please let me know. -- From: "Jason A. Donenfeld" [ Upstream commit 41c87425a1ac9b633e0fcc78eb1f19640c8fb5a0 ] It turns out that multiple places can call netlink_dump(), which means it's still possible to dereference par

[PATCH 4.13 06/44] net: call cgroup_sk_alloc() earlier in sk_clone_lock()

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit c0576e3975084d4699b7bfef578613fb8e1144f6 ] If for some reason, the newly allocated child need to be freed, we will call cgroup_put() (via sk_free_unlock_clone()

[PATCH 4.13 41/44] usb: usbtest: fix NULL pointer dereference

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit 7c80f9e4a588f1925b07134bb2e3689335f6c6d8 upstream. If the usbtest driver encounters a device with an IN bulk endpoint but no OUT bulk endpoint, it will try to dereference a N

[PATCH 4.13 43/44] EDAC, sb_edac: Dont create a second memory controller if HA1 is not present

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Qiuxu Zhuo commit 15cc3ae001873845b5d842e212478a6570c7d938 upstream. Yi Zhang reported the following failure on a 2-socket Haswell (E5-2603v3) server (DELL PowerEdge 730xd): EDAC sbridge: S

[PATCH 4.13 00/44] 4.13.14-stable review

This is the start of the stable review cycle for the 4.13.14 release. There are 44 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat Nov 18 17:28:05 UTC 2017. Anything receiv

[PATCH 4.13 31/44] tun: allow positive return values on dev_get_valid_name() call

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Julien Gomes [ Upstream commit 5c25f65fd1e42685f7ccd80e0621829c105785d9 ] If the name argument of dev_get_valid_name() contains "%d", it will try to assign it a unit number in __dev__alloc_na

[PATCH 4.13 40/44] mac80211: dont compare TKIP TX MIC key in reinstall prevention

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Johannes Berg commit cfbb0d90a7abb289edc91833d0905931f8805f12 upstream. For the reinstall prevention, the code I had added compares the whole key. It turns out though that iwlwifi firmware doe

[PATCH 4.13 07/44] macsec: fix memory leaks when skb_to_sgvec fails

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Sabrina Dubroca [ Upstream commit 5aba2ba5030b66a6f8c93049b718556f9aacd7c6 ] Fixes: cda7ea690350 ("macsec: check return value of skb_to_sgvec always") Signed-off-by: Sabrina Dubroca Signed-o

[PATCH 4.13 23/44] tap: double-free in error path in tap_open()

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Girish Moodalbail [ Upstream commit 78e0ea6791d7baafb8a0ca82b1bd0c7b3453c919 ] Double free of skb_array in tap module is causing kernel panic. When tap_set_queue() fails we free skb_array rig

[PATCH 4.13 25/44] net/mlx5e: Properly deal with encap flows add/del under neigh update

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Or Gerlitz [ Upstream commit 3c37745ec614ff048d5dce38f976804b05d307ee ] Currently, the encap action offload is handled in the actions parse function and not in mlx5e_tc_add_fdb_flow() where w

[PATCH 4.13 24/44] net/mlx5: Fix health work queue spin lock to IRQ safe

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Moshe Shemesh [ Upstream commit 6377ed0bbae6fa28853e1679d068a9106c8a8908 ] spin_lock/unlock of health->wq_lock should be IRQ safe. It was changed to spin_lock_irqsave since adding commit 0179

[PATCH 4.13 26/44] ipip: only increase err_count for some certain type icmp in ipip_err

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit f3594f0a7ea36661d7fd942facd7f31a64245f1a ] t->err_count is used to count the link failure on tunnel and an err will be reported to user socket in tx path if t->err_

[PATCH 4.13 02/44] gso: fix payload length when gso_size is zero

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Alexey Kodanev [ Upstream commit 3d0241d57c7b25bb75ac9d7a62753642264fdbce ] When gso_size reset to zero for the tail segment in skb_segment(), later in ipv6_gso_segment(), __skb_udp_tunnel_se

[PATCH 4.13 16/44] soreuseport: fix initialization race

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Craig Gallek [ Upstream commit 1b5f962e71bfad6284574655c406597535c3ea7a ] Syzkaller stumbled upon a way to trigger WARNING: CPU: 1 PID: 13881 at net/core/sock_reuseport.c:41 reuseport_alloc+0

[PATCH 4.13 18/44] sctp: full support for ipv6 ip_nonlocal_bind & IP_FREEBIND

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Laszlo Toth [ Upstream commit b71d21c274eff20a9db8158882b545b141b73ab8 ] Commit 9b9742022888 ("sctp: support ipv6 nonlocal bind") introduced support for the above options as v4 sctp did, so p

[PATCH 4.13 17/44] ipv6: flowlabel: do not leave opt->tot_len with garbage

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 864e2a1f8aac05effac6063ce316b480facb46ff ] When syzkaller team brought us a C repro for the crash [1] that had been reported many times in the past, I finally c

[PATCH 4.13 10/44] netlink: fix netlink_ack() extack race

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Johannes Berg [ Upstream commit 48044eb490be71c203e14dd89e8bae87209eab52 ] It seems that it's possible to toggle NETLINK_F_EXT_ACK through setsockopt() while another thread/CPU is building a

[PATCH 4.13 12/44] tcp/dccp: fix ireq->opt races

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit c92e8c02fe664155ac4234516e32544bec0f113d ] syzkaller found another bug in DCCP/TCP stacks [1] For the reasons explained in commit ce1050089c96 ("tcp/dccp: fix

[PATCH 4.9 15/39] tcp/dccp: fix lockdep splat in inet_csk_route_req()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit a6ca7abe53633d08eea1c6756cb49c9b2d4c90bf ] This patch fixes the following lockdep splat in inet_csk_route_req() lockdep_rcu_suspicious inet_csk_route_req

[PATCH 4.9 39/39] misc: panel: properly restore atomic counter on error path

4.9-stable review patch. If anyone has any objections, please let me know. -- commit 93dc1774d2a4c7a298d5cdf78cc8acdcb7b1428d upstream. Commit f4757af ("staging: panel: Fix single-open policy race condition") introduced in 3.19-rc1 attempted to fix a race condition on the open,

[PATCH 4.9 13/39] ipv6: flowlabel: do not leave opt->tot_len with garbage

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 864e2a1f8aac05effac6063ce316b480facb46ff ] When syzkaller team brought us a C repro for the crash [1] that had been reported many times in the past, I finally co

[PATCH 4.9 31/39] ALSA: seq: Cancel pending autoload work at unbinding device

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Takashi Iwai commit fc27fe7e8deef2f37cba3f2be2d52b6ca5eb9d57 upstream. ALSA sequencer core has a mechanism to load the enumerated devices automatically, and it's performed in an off-load work.

[PATCH 4.13 11/44] sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect

4.13-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit 1cc276cec9ec574d41cf47dfc0f51406b6f26ab4 ] Now sctp processes icmp redirect packet in sctp_icmp_redirect where it calls sctp_transport_dst_check in which tp->dst ca

[PATCH 4.9 29/39] usb: usbtest: fix NULL pointer dereference

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit 7c80f9e4a588f1925b07134bb2e3689335f6c6d8 upstream. If the usbtest driver encounters a device with an IN bulk endpoint but no OUT bulk endpoint, it will try to dereference a NU

[PATCH 4.9 30/39] Input: ims-psu - check if CDC union descriptor is sane

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Dmitry Torokhov commit ea04efee7635c9120d015dcdeeeb6988130cb67a upstream. Before trying to use CDC union descriptor, try to validate whether that it is sane by checking that intf->altsetting->e

[PATCH 4.9 23/39] sctp: reset owner sk for data chunks on out queues when migrating a sock

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit d04adf1b355181e737b6b1e23d801b07f0b7c4c0 ] Now when migrating sock to another one in sctp_sock_migrate(), it only resets owner sk for the data in receive queues, not

[PATCH 4.9 27/39] mac80211: use constant time comparison with keys

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jason A. Donenfeld commit 2bdd713b92a9cade239d3c7d15205a09f556624d upstream. Otherwise we risk leaking information via timing side channel. Fixes: fdf7cb4185b6 ("mac80211: accept key reinstall

[PATCH 4.4 07/28] tun/tap: sanitize TUNSETSNDBUF input

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Craig Gallek [ Upstream commit 93161922c658c714715686cd0cf69b090cb9bf1d ] Syzkaller found several variants of the lockup below by setting negative values with the TUNSETSNDBUF ioctl. This pat

[PATCH 4.4 05/28] Input: ims-psu - check if CDC union descriptor is sane

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Dmitry Torokhov commit ea04efee7635c9120d015dcdeeeb6988130cb67a upstream. Before trying to use CDC union descriptor, try to validate whether that it is sane by checking that intf->altsetting->e

[PATCH 4.4 08/28] tcp: fix tcp_mtu_probe() vs highest_sack

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 2b7cda9c35d3b940eb9ce74b30bbd5eb30db493d ] Based on SNMP values provided by Roman, Yuchung made the observation that some crashes in tcp_sacktag_walk() might be

Re: [PATCH 1/2] mm,vmscan: Kill global shrinker lock.

On Wed, Nov 15, 2017 at 09:56:02AM +0900, Minchan Kim wrote: > @@ -498,6 +498,14 @@ static unsigned long shrink_slab(gfp_t gfp_mask, int nid, > sc.nid = 0; > > freed += do_shrink_slab(&sc, shrinker, nr_scanned, nr_eligible); > + /* > +

[PATCH 4.4 04/28] usb: usbtest: fix NULL pointer dereference

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit 7c80f9e4a588f1925b07134bb2e3689335f6c6d8 upstream. If the usbtest driver encounters a device with an IN bulk endpoint but no OUT bulk endpoint, it will try to dereference a NU

[PATCH 4.4 26/28] target/iscsi: Fix iSCSI task reassignment handling

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Bart Van Assche commit 59b6986dbfcdab96a971f9663221849de79a7556 upstream. Allocate a task management request structure for all task management requests, including task reassignment. This change

[PATCH 4.4 03/28] mac80211: dont compare TKIP TX MIC key in reinstall prevention

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Johannes Berg commit cfbb0d90a7abb289edc91833d0905931f8805f12 upstream. For the reinstall prevention, the code I had added compares the whole key. It turns out though that iwlwifi firmware does

[PATCH 4.4 28/28] misc: panel: properly restore atomic counter on error path

4.4-stable review patch. If anyone has any objections, please let me know. -- commit 93dc1774d2a4c7a298d5cdf78cc8acdcb7b1428d upstream. Commit f4757af ("staging: panel: Fix single-open policy race condition") introduced in 3.19-rc1 attempted to fix a race condition on the open,

[PATCH 4.4 27/28] target: Fix node_acl demo-mode + uncached dynamic shutdown regression

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Nicholas Bellinger commit 6f48655facfd7f7ccfe6d252ac0fe319ab02e4dd upstream. This patch fixes a generate_node_acls = 1 + cache_dynamic_acls = 0 regression, that was introduced by commit 01d4

[PATCH 4.4 24/28] tipc: fix link attribute propagation bug

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Richard Alpe commit d01332f1acacc0cb43a61f4244dd2b846d4cd585 upstream. Changing certain link attributes (link tolerance and link priority) from the TIPC management tool is supposed to automatic

Re: [PATCH v3 3/3] kvm: arm64: handle single-step of userspace mmio instructions

On 16/11/17 15:39, Alex Bennée wrote: The system state of KVM when using userspace emulation is not complete until we return into KVM_RUN. To handle mmio related updates we wait until they have been committed and then schedule our KVM_EXIT_DEBUG. The kvm_arm_handle_step_debug() helper tells us

[PATCH 4.4 23/28] security/keys: add CONFIG_KEYS_COMPAT to Kconfig

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Bilal Amarni commit 47b2c3fff4932e6fc17ce13d51a43c6969714e20 upstream. CONFIG_KEYS_COMPAT is defined in arch-specific Kconfigs and is missing for several 64-bit architectures : mips, parisc, ti

[PATCH 4.4 20/28] tcp/dccp: fix ireq->opt races

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit c92e8c02fe664155ac4234516e32544bec0f113d ] syzkaller found another bug in DCCP/TCP stacks [1] For the reasons explained in commit ce1050089c96 ("tcp/dccp: fix i

[PATCH 4.4 18/28] ppp: fix race in ppp device destruction

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Guillaume Nault [ Upstream commit 6151b8b37b119e8e3a8401b080d532520c95faf4 ] ppp_release() tries to ensure that netdevices are unregistered before decrementing the unit refcount and running pp

[PATCH 4.4 02/28] mac80211: use constant time comparison with keys

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Jason A. Donenfeld commit 2bdd713b92a9cade239d3c7d15205a09f556624d upstream. Otherwise we risk leaking information via timing side channel. Fixes: fdf7cb4185b6 ("mac80211: accept key reinstall

Re: [PATCH 1/7] checkpatch: Implement new --ignore-cfg parameter

On Thu, 2017-11-16 at 09:09 -0800, Joe Perches wrote: > (adding Andrew Morton) > > On Thu, 2017-11-16 at 18:01 +0100, Knut Omang wrote: > > This parameter is intended to be used in a subsequent commit to kbuild to > > allow > > a convenient way to run checkpatch from make. > > _why_ is this usef

[PATCH 4.4 17/28] sctp: reset owner sk for data chunks on out queues when migrating a sock

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit d04adf1b355181e737b6b1e23d801b07f0b7c4c0 ] Now when migrating sock to another one in sctp_sock_migrate(), it only resets owner sk for the data in receive queues, not

[PATCH 4.4 13/28] ipv6: flowlabel: do not leave opt->tot_len with garbage

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 864e2a1f8aac05effac6063ce316b480facb46ff ] When syzkaller team brought us a C repro for the crash [1] that had been reported many times in the past, I finally co

[PATCH 4.4 16/28] tun: allow positive return values on dev_get_valid_name() call

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Julien Gomes [ Upstream commit 5c25f65fd1e42685f7ccd80e0621829c105785d9 ] If the name argument of dev_get_valid_name() contains "%d", it will try to assign it a unit number in __dev__alloc_nam

[PATCH 4.4 15/28] ip6_gre: only increase err_count for some certain type icmpv6 in ip6gre_err

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit f8d20b46ce55cf40afb30dcef6d9288f7ef46d9b ] The similar fix in patch 'ipip: only increase err_count for some certain type icmp in ipip_err' is needed for ip6gre_err.

[PATCH 4.4 11/28] sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit 1cc276cec9ec574d41cf47dfc0f51406b6f26ab4 ] Now sctp processes icmp redirect packet in sctp_icmp_redirect where it calls sctp_transport_dst_check in which tp->dst can

[PATCH 4.4 01/28] mac80211: accept key reinstall without changing anything

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Johannes Berg commit fdf7cb4185b60c68e1a75e61691c4afdc15dea0e upstream. When a key is reinstalled we can reset the replay counters etc. which can lead to nonce reuse and/or replay detection bei

[PATCH 4.4 00/28] 4.4.99-stable review

This is the start of the stable review cycle for the 4.4.99 release. There are 28 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat Nov 18 17:41:29 UTC 2017. Anything receive

Re: [PATCH] mailbox: txdone_method shouldn't always be reset

On Thu 16 Nov 09:06 PST 2017, Jassi Brar wrote: > On Thu, Nov 16, 2017 at 10:21 PM, Jassi Brar wrote: > > On Thu, Nov 16, 2017 at 11:01 AM, Bjorn Andersson > > wrote: > >> A client that knows how to drive txdone would temporarily "upgrade" the > >> method to TXDONE_BY_ACK. But with the introduct

[PATCH] rsi: fix memory leak on buf and usb_reg_buf

From: Colin Ian King In the cases where len is too long, the error return path fails to kfree allocated buffers buf and usb_reg_buf. The simplest fix is to perform the sanity check on len before the allocations to avoid having to do the kfree'ing in the first place. Detected by CoverityScan, CI

[PATCH] scsi: pmcraid: use correct size unit when calling find_first_zero_bit()

find_first_zero_bit()'s parameter 'size' is defined in bits, not in bytes. Signed-off-by: Niklas Cassel --- drivers/scsi/pmcraid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c index 4f9f115fb6a0..04ce838546f4 100644 --- a/dri

Re: [PATCH v2 18/18] arm64: select ARCH_SUPPORTS_LTO_CLANG

On Thu, Nov 16, 2017 at 09:16:49AM -0800, Nick Desaulniers wrote: > On Thu, Nov 16, 2017 at 8:59 AM, Peter Zijlstra wrote: > > On Thu, Nov 16, 2017 at 08:50:41AM -0800, Nick Desaulniers wrote: > >> On Thu, Nov 16, 2017 at 8:30 AM, Peter Zijlstra > >> wrote: > >> > >> > Ideally we'd get the toolc

[PATCH 3.18 13/20] net/unix: dont show information about sockets from other namespaces

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Andrei Vagin [ Upstream commit 0f5da659d8f1810f44de14acf2c80cd6499623a0 ] socket_diag shows information only about sockets from a namespace where a diag socket lives. But if we request infor

[PATCH 3.18 12/20] sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit 1cc276cec9ec574d41cf47dfc0f51406b6f26ab4 ] Now sctp processes icmp redirect packet in sctp_icmp_redirect where it calls sctp_transport_dst_check in which tp->dst ca

[PATCH 3.18 14/20] tun: allow positive return values on dev_get_valid_name() call

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Julien Gomes [ Upstream commit 5c25f65fd1e42685f7ccd80e0621829c105785d9 ] If the name argument of dev_get_valid_name() contains "%d", it will try to assign it a unit number in __dev__alloc_na

[PATCH 3.18 02/20] mac80211: accept key reinstall without changing anything

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Johannes Berg commit fdf7cb4185b60c68e1a75e61691c4afdc15dea0e upstream. When a key is reinstalled we can reset the replay counters etc. which can lead to nonce reuse and/or replay detection be

Re: [PATCH v7 04/13] slimbus: core: Add slim controllers support

thanks for the comments. On 16/11/17 16:42, Vinod Koul wrote: On Wed, Nov 15, 2017 at 02:10:34PM +, srinivas.kandaga...@linaro.org wrote: +static void slim_dev_release(struct device *dev) +{ + struct slim_device *sbdev = to_slim_device(dev); + + put_device(sbdev->ctrl->dev);

[PATCH 3.18 03/20] mac80211: use constant time comparison with keys

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Jason A. Donenfeld commit 2bdd713b92a9cade239d3c7d15205a09f556624d upstream. Otherwise we risk leaking information via timing side channel. Fixes: fdf7cb4185b6 ("mac80211: accept key reinstal

[PATCH 3.18 18/20] ip6_gre: only increase err_count for some certain type icmpv6 in ip6gre_err

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit f8d20b46ce55cf40afb30dcef6d9288f7ef46d9b ] The similar fix in patch 'ipip: only increase err_count for some certain type icmp in ipip_err' is needed for ip6gre_err.

Re: [PATCH v2 03/14] soundwire: Add Master registration

On Thu, Nov 16, 2017 at 10:19:44PM +0530, Vinod Koul wrote: > On Thu, Nov 16, 2017 at 04:05:22PM +, Srinivas Kandagatla wrote: > > >+ *bus->assigned = ~GENMASK(SDW_BROADCAST_DEV_NUM, SDW_ENUM_DEV_NUM); > > Can't we use ida for this. > > This would also cut down code added for allocating dev_

[PATCH 3.18 05/20] usb: usbtest: fix NULL pointer dereference

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit 7c80f9e4a588f1925b07134bb2e3689335f6c6d8 upstream. If the usbtest driver encounters a device with an IN bulk endpoint but no OUT bulk endpoint, it will try to dereference a N

[PATCH 3.18 20/20] target/iscsi: Fix iSCSI task reassignment handling

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Bart Van Assche commit 59b6986dbfcdab96a971f9663221849de79a7556 upstream. Allocate a task management request structure for all task management requests, including task reassignment. This chang

[PATCH 3.18 19/20] security/keys: add CONFIG_KEYS_COMPAT to Kconfig

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Bilal Amarni commit 47b2c3fff4932e6fc17ce13d51a43c6969714e20 upstream. CONFIG_KEYS_COMPAT is defined in arch-specific Kconfigs and is missing for several 64-bit architectures : mips, parisc, t

[PATCH 3.18 08/20] tun/tap: sanitize TUNSETSNDBUF input

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Craig Gallek [ Upstream commit 93161922c658c714715686cd0cf69b090cb9bf1d ] Syzkaller found several variants of the lockup below by setting negative values with the TUNSETSNDBUF ioctl. This pa

[PATCH 3.18 09/20] tcp: fix tcp_mtu_probe() vs highest_sack

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 2b7cda9c35d3b940eb9ce74b30bbd5eb30db493d ] Based on SNMP values provided by Roman, Yuchung made the observation that some crashes in tcp_sacktag_walk() might be

[PATCH 3.18 06/20] Input: ims-psu - check if CDC union descriptor is sane

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Dmitry Torokhov commit ea04efee7635c9120d015dcdeeeb6988130cb67a upstream. Before trying to use CDC union descriptor, try to validate whether that it is sane by checking that intf->altsetting->

[PATCH 3.18 04/20] mac80211: dont compare TKIP TX MIC key in reinstall prevention

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Johannes Berg commit cfbb0d90a7abb289edc91833d0905931f8805f12 upstream. For the reinstall prevention, the code I had added compares the whole key. It turns out though that iwlwifi firmware doe

[PATCH 3.18 15/20] sctp: reset owner sk for data chunks on out queues when migrating a sock

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit d04adf1b355181e737b6b1e23d801b07f0b7c4c0 ] Now when migrating sock to another one in sctp_sock_migrate(), it only resets owner sk for the data in receive queues, no

[PATCH 3.18 11/20] tun: call dev_get_valid_name() before register_netdevice()

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Cong Wang [ Upstream commit 0ad646c81b2182f7fa67ec0c8c825e0ee165696d ] register_netdevice() could fail early when we have an invalid dev name, in which case ->ndo_uninit() is not called. For

[PATCH 3.18 17/20] ipip: only increase err_count for some certain type icmp in ipip_err

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit f3594f0a7ea36661d7fd942facd7f31a64245f1a ] t->err_count is used to count the link failure on tunnel and an err will be reported to user socket in tx path if t->err_

[PATCH 3.18 16/20] ipv6: flowlabel: do not leave opt->tot_len with garbage

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 864e2a1f8aac05effac6063ce316b480facb46ff ] When syzkaller team brought us a C repro for the crash [1] that had been reported many times in the past, I finally c

[PATCH 3.18 10/20] l2tp: check ps->sock before running pppol2tp_session_ioctl()

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Guillaume Nault [ Upstream commit 5903f594935a3841137c86b9d5b75143a5b7121c ] When pppol2tp_session_ioctl() is called by pppol2tp_tunnel_ioctl(), the session may be unconnected. That is, it wa

[PATCH 3.18 00/20] 3.18.82-stable review

This is the start of the stable review cycle for the 3.18.82 release. There are 20 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat Nov 18 17:27:03 UTC 2017. Anything receiv

[PATCH 3.18 01/20] [PATCH] Revert "ceph: unlock dangling spinlock in try_flush_caps()"

3.18-stable review patch. If anyone has any objections, please let me know. -- This reverts commit 55d4aa12af57ea7782f0c8bbc3b01e44673b05ba which is commit 6c2838fbdedb9b72a81c931d49e56b229b6cdbca upstream. The locking issue was not a problem in 3.18, and now sparse rightly comp

Re: [PATCH v2 3/4] Add support for AMD Core Perf Extension in guest

On Thu, Nov 16, 2017 at 11:13:47AM -0600, Natarajan, Janakarajan wrote: > On 11/15/2017 1:07 PM, Borislav Petkov wrote: > > On Wed, Nov 15, 2017 at 01:04:03PM -0600, Natarajan, Janakarajan wrote: > > > So, when the amd_pmu_init is called, a query to guest_cpuid_family() > > > gives a > > > value o

Re: [PATCH v2 02/14] soundwire: Add SoundWire bus type

On Thu, Nov 16, 2017 at 10:32:21PM +0530, Vinod Koul wrote: > On Thu, Nov 16, 2017 at 04:05:17PM +, Srinivas Kandagatla wrote: > > >+static const struct sdw_device_id * > > >+sdw_get_device_id(struct sdw_slave *slave, struct sdw_driver *drv) > > Indentation looks Odd here, > not really, the r

Re: [PATCH] mailbox: txdone_method shouldn't always be reset

(- Remove Alexey Klimov's ARM id as he has left the company, adding his personal id instead) On 16/11/17 16:51, Jassi Brar wrote: > On Thu, Nov 16, 2017 at 11:01 AM, Bjorn Andersson > wrote: >> A client that knows how to drive txdone would temporarily "upgrade" the >> method to TXDONE_BY_ACK. Bu

Re: [git pull] drm for v4.15

On 16/11/17 05:59 AM, Linus Torvalds wrote: > > There's something odd about drm people. You guys like these completely > insane generated header files, and you seem to be populating the whole > tree with this odd and diseased notion of "generated header files are > cool". > > Is somebody getting

Re: [PATCH 0/4] treewide: Fix line continuation formats

On Thu, 2017-11-16 at 12:11 -0500, Mimi Zohar wrote: > On Thu, 2017-11-16 at 07:27 -0800, Joe Perches wrote: > > Avoid using line continations in formats as that causes unexpected > > output. > > Is having lines greater than 80 characters the preferred method? yes. > Could you add quotes before

Re: [PATCH v2 18/18] arm64: select ARCH_SUPPORTS_LTO_CLANG

On Thu, Nov 16, 2017 at 8:59 AM, Peter Zijlstra wrote: > On Thu, Nov 16, 2017 at 08:50:41AM -0800, Nick Desaulniers wrote: >> On Thu, Nov 16, 2017 at 8:30 AM, Peter Zijlstra wrote: >> >> > Ideally we'd get the toolchain people to commit to supporting the kernel >> > memory model along side the C1

Re: [PATCH v2 04/17] PCI: designware-ep: Pre-allocate memory for MSI in dw_pcie_ep_init

On 10/31/2017 07:01 AM, Kishon Vijay Abraham I wrote: > Hi Niklas, > > On Monday 30 October 2017 06:12 PM, Niklas Cassel wrote: >> Certain SoCs need to map the MSI address in raise_irq. >> To map an address, you first need to call pci_epc_mem_alloc_addr, >> however, pci_epc_mem_alloc_addr calls io

Re: [PATCH 0/2] ALSA: nm256: Fine-tuning for three function implementations

On Thu, 16 Nov 2017 18:05:27 +0100, SF Markus Elfring wrote: > > From: Markus Elfring > Date: Thu, 16 Nov 2017 18:00:18 +0100 > > Two update suggestions were taken into account > from static source code analysis. Markus, I'd apply this kind of patches only when they are really tested on the har

Re: [PATCH v2 3/4] Add support for AMD Core Perf Extension in guest

On 11/15/2017 1:07 PM, Borislav Petkov wrote: On Wed, Nov 15, 2017 at 01:04:03PM -0600, Natarajan, Janakarajan wrote: So, when the amd_pmu_init is called, a query to guest_cpuid_family() gives a value of -1. And that is because...? And it can be fixed to give the proper guest family I presume .

RE: [patches] Re: [PATCH v9 05/12] RISC-V: Atomic and Locking Code

> From: Will Deacon [mailto:will.dea...@arm.com] > Hi Daniel, > > On Thu, Nov 16, 2017 at 06:40:46AM +, Daniel Lustig wrote: > > > > In that case, maybe we should just start out having a fence on > > > > both sides for > > > > > > Actually, given your architecture is RCsc rather than RCpc, so

Re: [PATCH] KVM: x86: inject exceptions produced by x86_decode_insn

2017-11-13 09:32+0100, Paolo Bonzini: > On 13/11/2017 08:15, Wanpeng Li wrote: > > 2017-11-10 17:49 GMT+08:00 Paolo Bonzini : > >> Sometimes, a processor might execute an instruction while another > >> processor is updating the page tables for that instruction's code page, > >> but before the TLB s

Re: [PATCH v2 11/18] arm64: make mrs_s and msr_s macros work with LTO

On Thu, Nov 16, 2017 at 11:01:44AM -0600, Segher Boessenkool wrote: > The thing with .purgem can work. Inelegant, sure, but it can work :-) It works, there are already functions in the kernel that use these macros more than once. I agree that this might not be the most elegant solution, but at le

Re: [PATCH 0/4] treewide: Fix line continuation formats

On Thu, 2017-11-16 at 07:27 -0800, Joe Perches wrote: > Avoid using line continations in formats as that causes unexpected > output. Is having lines greater than 80 characters the preferred method?  Could you add quotes before the backlash and before the first word on the next line instead? Mimi

Re: [PATCH 1/7] checkpatch: Implement new --ignore-cfg parameter

(adding Andrew Morton) On Thu, 2017-11-16 at 18:01 +0100, Knut Omang wrote: > This parameter is intended to be used in a subsequent commit to kbuild to > allow > a convenient way to run checkpatch from make. _why_ is this useful? > By accepting comments and multiple lines of commands, the idea

Re: [PATCH v2 11/18] arm64: make mrs_s and msr_s macros work with LTO

On Thu, Nov 16, 2017 at 08:46:08AM -0800, Sami Tolvanen wrote: > On Thu, Nov 16, 2017 at 07:56:50AM -0600, Segher Boessenkool wrote: > > The compiler is fine, the assembler is fine (and the linker has > > nothing to do with it). Your code is not fine. > > Would you care to elaborate? The current

Re: [PATCH v2 1/4] omapdrm: fix compatible string for td028ttec1

On 11/16/2017 10:10 AM, H. Nikolaus Schaller wrote: > Hi Andrew, > >> Am 16.11.2017 um 16:53 schrieb Andrew F. Davis : >> >> On 11/16/2017 07:43 AM, H. Nikolaus Schaller wrote: >>> Am 16.11.2017 um 13:32 schrieb Tomi Valkeinen : On 16/11/17 10:50, H. Nikolaus Schaller wrote: > T

<    1   2   3   4   5   6   7   8   9   10   >