Re: [PATCH] kbuild: deb-pkg: change the source package name to 'linux'

uild.include >   >  # Remove hyphens since they have special meaning in RPM filenames >  KERNELPATH := kernel-$(subst -,_,$(KERNELRELEASE)) > -KDEB_SOURCENAME ?= linux-$(KERNELRELEASE) > +KDEB_SOURCENAME ?= linux >  KBUILD_PKG_ROOTCMD ?="fakeroot -u" >  export KDEB_SOURCE

Re: [PATCH 4.9 00/78] 4.9.262-rc1 review

a cherry-picking approach is going to work for fixing futexes on 4.9. But I now have an additional patch series that seems to fix this warning (and some other older bugs that I didn't reproduce) and continues to pass the self-tests. I'll send that along shortly. Ben. -- Ben Hutchings It is a

Re: [PATCH] x86/tlb: Flush global mappings when KAISER is disabled

FYI... >     *on > >     :) We're supporting both 4.9 and 4.19 in Debian 9. The general rule is we carry on with the same stable kernel branch for the whole 5 year support period, but add the option of using the kernel version from the next stable release

Re: futex breakage in 4.9 stable branch

On Mon, Mar 01, 2021 at 09:07:03AM +0100, Greg Kroah-Hartman wrote: > On Mon, Mar 01, 2021 at 01:13:08AM +0100, Ben Hutchings wrote: > > On Tue, 2021-02-23 at 15:00 +0100, Greg Kroah-Hartman wrote: > > > I'm announcing the release of the 4.9.258 kernel. > > > > &

futex breakage in 4.9 stable branch

r, the more we change futex in 4.9, the more difficult it is going to be to update the 4.9-rt branch. But I don't see any better option available at the moment. Thoughts? Ben. -- Ben Hutchings I'm always amazed by the number of people who take up solipsism because they heard someon

Re: Pass modules to Linux kernel without initrd

ed instead of initramfs-tools or dracut. The upstream of that is: <https://github.com/chris-se/tiny-initramfs/>. But I don't anticipate that we would change the default initramfs builder any time soon. Ben. -- Ben Hutchings The world is coming to an end. Please log off. signature

Re: drivers/accessibility/speakup/serialio.c:48:19: warning: variable 'quot' set but not used

On Mon, 2020-11-16 at 21:33 +0100, Samuel Thibault wrote: > Ben Hutchings, le lun. 16 nov. 2020 19:51:23 +, a ecrit: > > On Mon, 2020-11-16 at 20:01 +0100, Samuel Thibault wrote: > > > Perhaps we should rather use > > > > > > depends on ISA || (X86 &

Re: drivers/accessibility/speakup/serialio.c:48:19: warning: variable 'quot' set but not used

heir out macros into > consuming their parameters? [...] It does seem odd for parisc to define the I/O functions this way. I don't know if it's really a bug. Ben. -- Ben Hutchings Everything should be made as simple as possible, but not simpler.

Re: [PATCH 4.19 19/71] btrfs: extent_io: add proper error handling to lock_extent_buffer_for_io()

+ * Lock eb pages and flush the bio if we can't the locks > > + * > > + * Return 0 if nothing went wrong > > + * Return >0 is same as 0, except bio is not submitted > > + * Return <0 if something went wrong, no page is locked > &

Re: [PATCH 5.4 00/57] 5.4.70-rc1 review

14 91011294 (b9400294) [...] This corresponds to the statement: status = readl(host_base + HOST_IRQ_STAT); So it looks like the PCI device stopped responding to MMIO for some reason. It could be faulty hardware. I don't see any sign of run-time power management in that driver that

Re: process '/usr/bin/rsync' started with executable stack

he m68k and parisc kernel ports still don't support any alternatives to trampolines for signal return, or they didn't when I reviewed this a few months ago. Ben. > Thoughts? > > -Kees > > > [1] Ben appears well aware of this idea, as he suggested it in 2018. :) > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=887159 > -- Ben Hutchings Anthony's Law of Force: Don't force it, get a larger hammer. signature.asc Description: This is a digitally signed message part

Linux 3.16.85

): fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() Ben Hutchings (3): scsi: sg: Change next_cmd_len handling to mirror upstream scsi: sg: Re-fix off by one in sg_fill_request_table() Linux 3.16.85 Colin Ian King (1): ext4: unsigned int compared

Re: [PATCH 3.16 00/61] 3.16.85-rc1 review

On Wed, 2020-06-10 at 12:08 -0700, Guenter Roeck wrote: > On Tue, Jun 09, 2020 at 07:03:51PM +0100, Ben Hutchings wrote: > > This is the start of the stable review cycle for the 3.16.85 release. > > There are 61 patches in this series, which will be posted as responses > > to

Re: [PATCH AUTOSEL 5.6 080/606] i2c: dev: Fix the race between the release of i2c_dev and cdev

On Mon, 2020-06-08 at 19:03 -0400, Sasha Levin wrote: > From: Kevin Hao > > commit 1413ef638abae4ab5621901cf4d8ef08a4a48ba6 upstream. [...] This was already applied in 5.6.15. Ben. -- Ben Hutchings, Software Developer Codethink Ltd https://www.codeth

Re: [PATCH 3.16 42/61] scsi: sg: don't return bogus Sg_requests

On Tue, 2020-06-09 at 14:28 -0400, Tony Battersby wrote: > On 6/9/20 2:04 PM, Ben Hutchings wrote: > > 3.16.85-rc1 review patch. If anyone has any objections, please let me know. > > > > -- > > > > From: Jo

[PATCH 3.16 05/61] slip: Fix use-after-free Read in slip_open

ree_netdev()] Signed-off-by: Ben Hutchings --- --- a/drivers/net/slip/slip.c +++ b/drivers/net/slip/slip.c @@ -867,7 +867,7 @@ err_free_chan: sl->tty = NULL; tty->disc_data = NULL; clear_bit(SLF_INUSE, >flags); - free_netdev(sl->dev); + sl_free_netdev

[PATCH 3.16 03/61] slcan: not call free_netdev before rtnl_unlock in slcan_open

. This patch is a 1:1 copy of upstream slip.c commit f596c87005f7 ("slip: not call free_netdev before rtnl_unlock in slip_open"). Reported-by: yangerkun Signed-off-by: Oliver Hartkopp Signed-off-by: David S. Miller [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben

[PATCH 3.16 07/61] net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject

0x580 [<e0aa5d8f>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [<285b3d1a>] 0x Cc: David Miller Cc: Lukas Bulwahn Signed-off-by: Jouni Hogander Signed-off-by: David S. Miller [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings --- net/core/ne

[PATCH 3.16 02/61] can: slcan: Fix use-after-free Read in slcan_open

Signed-off-by: Marc Kleine-Budde [bwh: Backported to 3.16: slc_free_netdev() calls free_netdev() here, so delete the direct call to free_netdev()] Signed-off-by: Ben Hutchings --- --- a/drivers/net/can/slcan.c +++ b/drivers/net/can/slcan.c @@ -620,7 +620,7 @@ err_free_chan: sl->tty = NULL

[PATCH 3.16 01/61] slcan: Fix memory leak in error path

021b83b99>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [<8ea75434>] 0x Cc: Wolfgang Grandegger Cc: Marc Kleine-Budde Cc: Lukas Bulwahn Signed-off-by: Jouni Hogander Signed-off-by: Marc Kleine-Budde Signed-off-by: Ben Hutchings --- drivers/net/can/slcan.

[PATCH 3.16 06/61] slip: not call free_netdev before rtnl_unlock in slip_open

. Signed-off-by: yangerkun Reviewed-by: Oliver Hartkopp Signed-off-by: David S. Miller [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings --- drivers/net/slip/slip.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/net/slip/slip.c +++ b/drivers/net/slip/slip.c @@ -867,7

[PATCH 3.16 17/61] drivers: usb: core: Minimize irq disabling in usb_sg_cancel()

Stern Signed-off-by: David Mosberger Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- drivers/usb/core/message.c | 37 + 1 file changed, 17 insertions(+), 20 deletions(-) --- a/drivers/usb/core/message.c +++ b/drivers/usb/core/message.c

[PATCH 3.16 04/61] slip: Fix memory leak in slip_open error path

S. Miller" Cc: Oliver Hartkopp Cc: Lukas Bulwahn Signed-off-by: Jouni Hogander Signed-off-by: David S. Miller Signed-off-by: Ben Hutchings --- drivers/net/slip/slip.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/slip/slip.c +++ b/drivers/net/slip/slip.c @@ -867,6 +867,7 @@

[PATCH 3.16 12/61] selinux: convert WARN_ONCE() to printk() in selinux_nlmsg_perm()

.] Signed-off-by: Paul Moore Signed-off-by: Ben Hutchings --- security/selinux/hooks.c | 7 --- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -4683,9 +4683,10 @@ static int selinux_nlmsg_perm(struct soc err

[PATCH 3.16 11/61] selinux: cleanup error reporting in selinux_nlmsg_perm()

he audit record type. Added "protocol=" to help track down which protocol (NETLINK_AUDIT?) was used within the netlink protocol family. Signed-off-by: Richard Guy Briggs [Rewrote the patch subject line] Signed-off-by: Paul Moore Signed-off-by: Ben Hutchings --- security/selinux/ho

[PATCH 3.16 21/61] mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()

-by: Ben Hutchings --- drivers/net/wireless/mwifiex/scan.c | 7 +++ 1 file changed, 7 insertions(+) --- a/drivers/net/wireless/mwifiex/scan.c +++ b/drivers/net/wireless/mwifiex/scan.c @@ -2267,6 +2267,13 @@ mwifiex_cmd_append_vsie_tlv(struct mwifi vs_param_set->header.

[PATCH 3.16 15/61] selinux: properly handle multiple messages in selinux_netlink_send()

and subject to SELinux access control. Prior to this patch, SELinux only inspected the first message in the sk_buff. Cc: sta...@vger.kernel.org Reported-by: Dmitry Vyukov Reviewed-by: Stephen Smalley Signed-off-by: Paul Moore [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben

[PATCH 3.16 08/61] net-sysfs: fix netdev_queue_add_kobject() breakage

n rx|netdev_queue_add_kobject") Signed-off-by: Eric Dumazet Cc: Jouni Hogander Signed-off-by: David S. Miller Signed-off-by: Ben Hutchings --- net/core/net-sysfs.c | 1 + 1 file changed, 1 insertion(+) --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -1158,6 +1158,7 @@

[PATCH 3.16 19/61] scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()

() error: buffer overflow 'hd->sel_timeout' 255 <= u32max. It's true that we probably should have a bounds check here. Signed-off-by: Dan Carpenter Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen Signed-off-by: Ben Hutchings --- drivers/message/fusion/mptctl.c | 2

[PATCH 3.16 22/61] mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()

which contains illegal wmm elements , this may trigger a heap buffer overflow. Fix it by putting the length check before calling memcpy(). Signed-off-by: Qing Xu Signed-off-by: Kalle Valo [bwh: Backported to 3.16: adjust filename] Signed-off-by: Ben Hutchings --- drivers/net/wireless/mwifiex

[PATCH 3.16 24/61] sg: prevent integer overflow when converting from sectors to bytes

Mita Acked by: Douglas Gilbert Signed-off-by: Christoph Hellwig Signed-off-by: Ben Hutchings --- drivers/scsi/sg.c | 17 + 1 file changed, 13 insertions(+), 4 deletions(-) --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -865,6 +865,15 @@ static int srp_done(Sg_fd *sfp

[PATCH 3.16 20/61] scsi: mptfusion: Fix double fetch bug in ioctl

/r/20200114123414.GA7957@kadam Reported-by: Tom Hatskevich Reviewed-by: Greg Kroah-Hartman Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen Signed-off-by: Ben Hutchings --- drivers/message/fusion/mptctl.c | 213 1 file changed, 50 insertions(+), 1

[PATCH 3.16 32/61] scsi: sg: off by one in sg_ioctl()

t; should be >=. Fixes: 109bade9c625 ("scsi: sg: use standard lists for sg_requests") Signed-off-by: Dan Carpenter Acked-by: Douglas Gilbert Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- drivers/scsi/sg.c | 2 +- 1 file

[PATCH 3.16 45/61] scsi: sg: add sg_remove_request in sg_write

/610618d9-e983-fd56-ed0f-639428343...@huawei.com Acked-by: Douglas Gilbert Signed-off-by: Wu Bo Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin [groeck: Backport to v5.4.y and older kernels] Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings

[PATCH 3.16 29/61] scsi: sg: recheck MMAP_IO request length with lock held

-off-by: Todd Poynor Acked-by: Douglas Gilbert Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- drivers/scsi/sg.c | 7 +-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -1772,9 +177

[PATCH 3.16 48/61] ext4: Make checks for metadata_csum feature safer

wing fixes. Signed-off-by: Tahsin Erdogan Acked-by: Jan Kara [bwh: Ported to 3.16: Use EXT4_HAS_RO_COMPAT_FEATURE()] Signed-off-by: Ben Hutchings --- --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -2411,21 +2411,24 @@ extern void ext4_group_desc_csum_set(str extern int ext4_register_li_requ

[PATCH 3.16 50/61] ext4: unsigned int compared against zero

ore Ts'o Signed-off-by: Ben Hutchings --- fs/ext4/block_validity.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/fs/ext4/block_validity.c +++ b/fs/ext4/block_validity.c @@ -142,7 +142,8 @@ static int ext4_protect_reserved_inode(s struct inode *inode; struct ext4_sb_in

[PATCH 3.16 56/61] x86/cpu: Add 'table' argument to cpu_matches()

. [ bp: Flip arguments order. ] Signed-off-by: Mark Gross Signed-off-by: Borislav Petkov Signed-off-by: Thomas Gleixner Reviewed-by: Josh Poimboeuf Signed-off-by: Ben Hutchings --- arch/x86/kernel/cpu/common.c | 23 +-- 1 file changed, 13 insertions(+), 10 deletions

[PATCH 3.16 25/61] scsi: sg: Change next_cmd_len handling to mirror upstream

3.16.85-rc1 review patch. If anyone has any objections, please let me know. -- From: Ben Hutchings Change the type of next_cmd_len to unsigned char, done in upstream commit 65c26a0f3969 "sg: relax 16 byte cdb restriction". Move the range check from sg_write() t

[PATCH 3.16 28/61] scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE

: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- drivers/scsi/sg.c | 12 +--- 1 file changed, 9 insertions(+), 3 deletions(-) --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -1310,6 +1310,7 @@ sg_mmap(struct file *filp, struct vm_are unsigned l

[PATCH 3.16 59/61] x86/speculation: Add Ivy Bridge to affected list

3.16.85-rc1 review patch. If anyone has any objections, please let me know. -- From: Josh Poimboeuf commit 3798cc4d106e91382bfe016caa2edada27c2bb3f upstream. Make the docs match the code. Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Signed-off-by: Ben

[PATCH 3.16 55/61] x86/cpu: Add a steppings field to struct x86_cpu_id

Petkov Signed-off-by: Thomas Gleixner Reviewed-by: Tony Luck Reviewed-by: Josh Poimboeuf Signed-off-by: Ben Hutchings --- arch/x86/include/asm/cpu_device_id.h | 27 +++ arch/x86/kernel/cpu/match.c | 7 ++- include/linux/mod_devicetable.h | 6

[PATCH 3.16 53/61] ext4: add cond_resched() to ext4_protect_reserved_inode

gned-off-by: Theodore Ts'o Cc: sta...@kernel.org Signed-off-by: Ben Hutchings --- fs/ext4/block_validity.c | 1 + 1 file changed, 1 insertion(+) --- a/fs/ext4/block_validity.c +++ b/fs/ext4/block_validity.c @@ -153,6 +153,7 @@ static int ext4_protect_reserved_inode(s return P

[PATCH 3.16 52/61] ext4: don't perform block validity checks on the journal inode

xes: 345c0dbf3a30 ("ext4: protect journal inode's blocks using block_validity") Reported-by: Dan Rue Signed-off-by: Theodore Ts'o Tested-by: Naresh Kamboju [bwh: Backported to 3.16: Use EXT4_HAS_COMPAT_FEATURE()] Signed-off-by: Ben Hutchings --- --- a/fs/ext4/extents.c +++ b/fs/e

[PATCH 3.16 40/61] scsi: sg: fix static checker warning in sg_is_valid_dxfer

ilbert Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- drivers/scsi/sg.c | 7 +-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -796,8 +796,11 @@ static bool sg_is_valid_dxfer(sg_i

[PATCH 3.16 36/61] scsi: sg: disable SET_FORCE_LOW_DMA

-by: Ben Hutchings --- drivers/scsi/sg.c | 30 +- include/scsi/sg.h | 1 - 2 files changed, 9 insertions(+), 22 deletions(-) --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -157,7 +157,6 @@ typedef struct sg_fd { /* holds the sta struct list_head

[PATCH 3.16 23/61] sg: O_EXCL and other lock handling

in sg have been re-worked in this patch, notably sg_request::done . That can wait for a follow-up patch if this one meets with approval. Signed-off-by: Douglas Gilbert Reviewed-by: Hannes Reinecke Signed-off-by: Ben Hutchings --- drivers/scsi/sg.c | 424 +---

[PATCH 3.16 09/61] net-sysfs: Call dev_hold always in netdev_queue_add_kobject

in kobject_init_and_add. Fixes: b8eb718348b8 ("net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject") Reported-by: Hulk Robot Cc: Tetsuo Handa Cc: David Miller Cc: Lukas Bulwahn Signed-off-by: David S. Miller [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben

[PATCH 3.16 51/61] ext4: fix block validity checks for journal inodes using indirect blocks

8: invalid block Fix this by adding the missing exception check. Fixes: 345c0dbf3a30 ("ext4: protect journal inode's blocks using block_validity") Reported-by: Arthur Marsh Signed-off-by: Theodore Ts'o [bwh: Backported to 3.16: Use EXT4_HAS_COMPAT_FEATURE] Signed-off-by: Ben Hutching

[PATCH 3.16 35/61] scsi: sg: Re-fix off by one in sg_fill_request_table()

3.16.85-rc1 review patch. If anyone has any objections, please let me know. -- From: Ben Hutchings commit 587c3c9f286cee5c9cac38d28c8ae1875f4ec85b upstream. Commit 109bade9c625 ("scsi: sg: use standard lists for sg_requests") introduced an off-by-one error i

[PATCH 3.16 47/61] USB: gadget: fix illegal array access in binding with UDC

-by: Ben Hutchings --- drivers/usb/gadget/configfs.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -254,6 +254,9 @@ static ssize_t gadget_dev_desc_UDC_store char *name; int ret; + if (strlen(page) <

[PATCH 3.16 27/61] scsi: sg: reset 'res_in_use' after unlinking reserved array

Signed-off-by: Martin K. Petersen Cc: Todd Poynor Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- drivers/scsi/sg.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -2062,6 +2062,8 @@ sg_unlink_reserve(Sg_fd * sfp, Sg_reques

[PATCH 3.16 10/61] net-sysfs: Call dev_hold always in rx_queue_add_kobject

xt] Signed-off-by: Ben Hutchings --- net/core/net-sysfs.c | 7 +-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -782,14 +782,17 @@ static int rx_queue_add_kobject(struct n struct kobject *kobj = >kobj;

[PATCH 3.16 42/61] scsi: sg: don't return bogus Sg_requests

-by: Hannes Reinecke Acked-by: Doug Gilbert Signed-off-by: Martin K. Petersen Cc: Tony Battersby Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- drivers/scsi/sg.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c

[PATCH 3.16 44/61] scsi: sg: add sg_remove_request in sg_common_write

Signed-off-by: Ben Hutchings --- drivers/scsi/sg.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -808,8 +808,10 @@ sg_common_write(Sg_fd * sfp, Sg_request SCSI_LOG_TIMEOUT(4, printk("sg_common_write: scsi opcode=0x%02x,

[PATCH 3.16 46/61] signal: Extend exec_id to 64bits

locations. Link: https://lore.kernel.org/kernel-hardening/20200324215049.ga3...@pi3.com.pl Fixes: 2.3.23pre2 Cc: sta...@vger.kernel.org Signed-off-by: "Eric W. Biederman" [bwh: Backported to 3.16: - Use ACCESS_ONCE() - Adjust context] Signed-off-by: Ben Hutchings --- fs/exec.c

[PATCH 3.16 33/61] scsi: sg: factor out sg_fill_request_table()

Reinecke Reviewed-by: Bart Van Assche Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- drivers/scsi/sg.c | 61 +++ 1 file changed, 35 insertions(+), 26 deletions

[PATCH 3.16 58/61] x86/speculation: Add SRBDS vulnerability and mitigation documentation

. ] Signed-off-by: Mark Gross Signed-off-by: Borislav Petkov Reviewed-by: Tony Luck Reviewed-by: Josh Poimboeuf Signed-off-by: Ben Hutchings --- .../special-register-buffer-data-sampling.rst | 148 ++ 1 file changed, 148 insertions(+) create mode 100644 Documentation/hw-vuln

[PATCH 3.16 37/61] scsi: sg: check for valid direction before starting the request

. Petersen Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- drivers/scsi/sg.c | 46 ++ 1 file changed, 34 insertions(+), 12 deletions(-) --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -701,18 +701,14

[PATCH 3.16 39/61] scsi: sg: fix SG_DXFER_FROM_DEV transfers

ng the request") Reported-by: Chris Clayton Tested-by: Chris Clayton Cc: Douglas Gilbert Reviewed-by: Hannes Reinecke Tested-by: Chris Clayton Acked-by: Douglas Gilbert Signed-off-by: Martin K. Petersen Cc: Cristian Crinteanu Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutching

[PATCH 3.16 26/61] scsi: sg: protect accesses to 'reserved' page array

Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen Signed-off-by: Todd Poynor Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- drivers/scsi/sg.c | 47 ++- 1 file changed, 26 insertions(+), 21 deletions

[PATCH 3.16 57/61] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation

Gross Signed-off-by: Borislav Petkov Signed-off-by: Thomas Gleixner Reviewed-by: Tony Luck Reviewed-by: Pawan Gupta Reviewed-by: Josh Poimboeuf Tested-by: Neelima Krishnan [bwh: Backported to 3.16: - CPU feature words and bugs are numbered differently - Adjust filename for ] Signed-off-by: Ben

[PATCH 3.16 60/61] random: always use batched entropy for get_random_u{32,64}

Link: https://lore.kernel.org/r/20200221201037.30231-1-ja...@zx2c4.com Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman [bwh: Backported to 3.16: Only get_random_int() exists here] Signed-off-by: Ben Hutchings --- drivers/char/random.c | 6 -- 1 file changed, 6 deletions(-) --- a

[PATCH 3.16 61/61] fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()

: https://github.com/google/kmsan/issues/76 Signed-off-by: Linus Torvalds [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings --- fs/binfmt_elf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -1575,7 +1575,7 @@ static int

[PATCH 3.16 49/61] ext4: protect journal inode's blocks using block_validity

of EFSCORRUPTED] Signed-off-by: Ben Hutchings --- --- a/fs/ext4/block_validity.c +++ b/fs/ext4/block_validity.c @@ -137,6 +137,48 @@ static void debug_print_tree(struct ext4 printk("\n"); } +static int ext4_protect_reserved_inode(struct super_block *sb, u32 ino) +{ + struct in

[PATCH 3.16 38/61] scsi: sg: close race condition in sg_remove_sfp_usercontext()

. Reported-by: Christoph Hellwig Signed-off-by: Hannes Reinecke Reviewed-by: Johannes Thumshirn Tested-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- drivers

[PATCH 3.16 30/61] scsi: sg: remove 'save_scat_len'

-by: Christoph Hellwig Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- drivers/scsi/sg.c | 2 -- 1 file changed, 2 deletions(-) --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -154,7 +154,6 @@ typedef struct sg_fd { /* holds

[PATCH 3.16 16/61] drivers: usb: core: Don't disable irqs in usb_sg_wait() during URB submit.

ger Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- drivers/usb/core/message.c | 15 +++ 1 file changed, 7 insertions(+), 8 deletions(-) --- a/drivers/usb/core/message.c +++ b/drivers/usb/core/message.c @@ -306,9 +306,10 @@ static void sg_complete(

[PATCH 3.16 34/61] scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE

-by: Ben Hutchings --- drivers/scsi/sg.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -881,7 +881,6 @@ sg_fill_request_table(Sg_fd *sfp, sg_req list_for_each_entry(srp, >rq_list, entry) { if (val > SG_MAX

[PATCH 3.16 54/61] x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping

Molnar Signed-off-by: Greg Kroah-Hartman [bwh: Backported to 3.16: - Drop changes in arch/x86/lib/cpu.c - Adjust filenames, context] Signed-off-by: Ben Hutchings --- arch/x86/include/asm/acpi.h| 2 +- arch/x86/include/asm/processor.h | 2 +- arch/x86/kernel/amd_nb.c

[PATCH 3.16 13/61] selinux: Print 'sclass' as string when unrecognized netlink message occurs

makes it easier to distinguish the right class. Signed-off-by: Marek Milkovic Acked-by: Stephen Smalley [PM: 80-char width fixes] Signed-off-by: Paul Moore Signed-off-by: Ben Hutchings --- security/selinux/hooks.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/security

[PATCH 3.16 00/61] 3.16.85-rc1 review

initialized memory in fill_thread_core_info() [1d605416fb7175e1adf094251466caa52093b413] Ben Hutchings (2): scsi: sg: Change next_cmd_len handling to mirror upstream [65c26a0f39695ba01d9693754f27ca76cc8a3ab5, bf33f87dd04c371ea33feb821b60d63d754e3124] scsi: sg: Re-fix

[PATCH 3.16 41/61] scsi: sg: only check for dxfer_len greater than 256M

Suggested-by: Doug Gilbert Cc: Doug Gilbert Cc: Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman [bwh: Backported to 3.16: Include ] Signed-off-by: Ben Hutchings --- drivers/scsi/sg.c | 31 +-- 1 file changed, 1

[PATCH 3.16 18/61] USB: core: Fix free-while-in-use bug in the USB S-Glibrary

ggered, which happens when io->count reaches zero. Signed-off-by: Alan Stern Reported-and-tested-by: Kyungtae Kim CC: Link: https://lore.kernel.org/r/pine.lnx.4.44l0.2003281615140.14837-100...@netrider.rowland.org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- drivers

[PATCH 3.16 31/61] scsi: sg: use standard lists for sg_requests

Reviewed-by: Johannes Thumshirn Tested-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- drivers/scsi/sg.c | 147 +++--- 1 file changed, 61

[PATCH 3.16 14/61] selinux: rate-limit netlink message warnings in selinux_nlmsg_perm()

spam. The warning is supposed to help to find misbehaving programs, so print the triggering command name and pid. Reported-by: Florian Weimer Signed-off-by: Vladis Dronov [PM: subject line tweak to make checkpatch.pl happy] Signed-off-by: Paul Moore Signed-off-by: Ben Hutchings --- security

[PATCH 3.16 43/61] scsi: sg: fix minor memory leak in error path

other lock handling") Cc: Reviewed-by: Ewan D. Milne Signed-off-by: Tony Battersby Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- drivers/scsi/sg.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/scsi/

Linux 3.16.84

string before copying it Arnd Bergmann (2): sparc32: fix struct ipc64_perm type definition x86: kvm: avoid unused variable warning Ben Hutchings (1): Linux 3.16.84 Bin Liu (1): usb: dwc3: turn off VBUS when leaving host mode Bryan O'Donoghue (2): usb: gadget: f_ncm

Re: [PATCH 3.16 00/99] 3.16.84-rc1 review

On Thu, 2020-05-21 at 15:37 -0700, Guenter Roeck wrote: > On 5/21/20 1:20 PM, Ben Hutchings wrote: > > On Wed, 2020-05-20 at 14:23 -0700, Guenter Roeck wrote: > > > On 5/20/20 7:13 AM, Ben Hutchings wrote: > > > > This is the start of the stable review

Re: [PATCH 3.16 35/99] pxa168fb: Fix the function used to release some memory in an error handling path

of the probe function > > both use 'dma_free_wc'. > > I've not look in details, but it looks consistent and the patch would > > not apply as-is anyway. > > > > just my 2c. > > > > CJ > > > > Le 20/05/2020

Re: [PATCH 3.16 00/99] 3.16.84-rc1 review

On Thu, 2020-05-21 at 00:40 -0700, Guenter Roeck wrote: > On 5/20/20 7:47 PM, Chen-Yu Tsai wrote: > > On Thu, May 21, 2020 at 5:23 AM Guenter Roeck wrote: > > > On 5/20/20 7:13 AM, Ben Hutchings wrote: > > > > This is the start of the stable review

Re: [PATCH 3.16 00/99] 3.16.84-rc1 review

On Wed, 2020-05-20 at 14:23 -0700, Guenter Roeck wrote: > On 5/20/20 7:13 AM, Ben Hutchings wrote: > > This is the start of the stable review cycle for the 3.16.84 release. > > There are 99 patches in this series, which will be posted as responses > > to this one. If

Re: [PATCH 3.16 43/99] efi: Use early_mem*() instead of early_io*()

On Wed, 2020-05-20 at 15:14 +0100, Ben Hutchings wrote: > 3.16.84-rc1 review patch. If anyone has any objections, please let me know. > > -- > > From: Daniel Kiper > > commit abc93f8eb6e46a480485f19256bdbda36ec78a84 upstream. I've now seen that this dep

Re: [PATCH 3.16 37/99] clk: tegra: Mark fuse clock as critical

On Wed, 2020-05-20 at 15:14 +0100, Ben Hutchings wrote: > 3.16.84-rc1 review patch. If anyone has any objections, please let me know. > > -- > > From: Stephen Warren > > commit bf83b96f87ae2abb1e535306ea53608e8de5dfbb upstream. I've now dropped thi

[PATCH 3.16 01/99] fs/namespace.c: fix mountpoint reference counter race

() umount_mnt() mntput_no_expire() To fix this race condition, grab mount_lock before updating m_count in pivot_root(). Reference: CVE-2020-12114 Cc: Al Viro Signed-off-by: Piotr Krysiuk Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- fs/namespace.c |2

[PATCH 3.16 00/99] 3.16.84-rc1 review

/drivers/dummy.c | 2 +- sound/sh/aica.c| 4 +- virt/kvm/ioapic.c | 15 ++- virt/kvm/kvm_main.c| 12 +- 94 files changed, 711 insertions(+), 444 deletions(-) -- Ben Hutchings All the simple pr

[PATCH 3.16 06/99] padata: get_next is never NULL

ch updates the comments and fixes the code assumptions. Signed-off-by: Jason A. Donenfeld Reported-by: Dan Carpenter Acked-by: Steffen Klassert Signed-off-by: Herbert Xu Signed-off-by: Ben Hutchings --- kernel/padata.c | 13 - 1 file changed, 4 insertions(+), 9 deletions(-) --- a/kerne

[PATCH 3.16 11/99] padata: Remove broken queue flushing

n Signed-off-by: Herbert Xu Signed-off-by: Ben Hutchings --- --- a/kernel/padata.c +++ b/kernel/padata.c @@ -33,6 +33,8 @@ #define MAX_OBJ_NUM 1000 +static void padata_free_pd(struct parallel_data *pd); + static int padata_index_to_cpu(struct parallel_data *pd, int cpu_index) { int cp

[PATCH 3.16 08/99] padata: ensure padata_do_serial() runs on the correct CPU

gets called on the wrong CPU, defer invoking padata_reorder() via a kernel worker on the CPU we're expected to run on. Signed-off-by: Mathias Krause Signed-off-by: Herbert Xu Signed-off-by: Ben Hutchings --- include/linux/padata.h | 2 ++ kernel/padata.c| 20 +++- 2

[PATCH 3.16 16/99] crypto: af_alg - Use bh_lock_sock in sk_destruct

Signed-off-by: Herbert Xu Signed-off-by: Ben Hutchings --- crypto/af_alg.c | 6 -- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/crypto/af_alg.c +++ b/crypto/af_alg.c @@ -136,11 +136,13 @@ void af_alg_release_parent(struct sock * sk = ask->parent; as

[PATCH 3.16 04/99] padata: Remove unused but set variables

-off-by: Herbert Xu Signed-off-by: Ben Hutchings --- kernel/padata.c | 4 1 file changed, 4 deletions(-) --- a/kernel/padata.c +++ b/kernel/padata.c @@ -63,15 +63,11 @@ static int padata_cpu_hash(struct parall static void padata_parallel_worker(struct work_struct *parallel_work

[PATCH 3.16 10/99] padata: initialize pd->cpu with effective cpumask

ux-kernel@vger.kernel.org Signed-off-by: Herbert Xu Signed-off-by: Ben Hutchings --- kernel/padata.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/kernel/padata.c +++ b/kernel/padata.c @@ -435,7 +435,7 @@ static struct parallel_data *padata_allo atomic_set(>re

[PATCH 3.16 13/99] crypto: pcrypt - Fix user-after-free on module unload

. As otherwise the crypto algorithms are still alive and can be used while the padata structure is being freed. Fixes: 5068c7a883d1 ("crypto: pcrypt - Add pcrypt crypto...") Signed-off-by: Herbert Xu [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings --- crypto/pcrypt.c

[PATCH 3.16 21/99] reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling

which is not held. Jump to 'error_unlocked' instead. Fixes: f32485be8397 ("reiserfs: delay reiserfs lock until journal initialization") Signed-off-by: Jan Kara Signed-off-by: Ben Hutchings --- fs/reiserfs/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/reiser

[PATCH 3.16 07/99] padata: ensure the reorder timer callback runs on the correct CPU

. If they differ, schedule a work item on the target CPU that does the padata_reorder() call for us. Signed-off-by: Mathias Krause Signed-off-by: Herbert Xu Signed-off-by: Ben Hutchings --- include/linux/padata.h | 2 ++ kernel/padata.c| 43 +- 2 files

[PATCH 3.16 18/99] crypto: api - Fix race condition in crypto_spawn_alg

disappear altogether before we shoot it. This patch fixes it by moving the shooting into the locked section. Fixes: 6bfd48096ff8 ("[CRYPTO] api: Added spawns") Signed-off-by: Herbert Xu Signed-off-by: Ben Hutchings --- crypto/algapi.c | 16 +--- crypto/api.c | 3 +

[PATCH 3.16 03/99] spi: spi-dw: Add lock protect dw_spi rx/tx to prevent concurrent calls

igned-off-by: Nobuhiro Iwamatsu (CIP) Signed-off-by: Ben Hutchings --- drivers/spi/spi-dw.c | 14 -- drivers/spi/spi-dw.h | 1 + 2 files changed, 13 insertions(+), 2 deletions(-) --- a/drivers/spi/spi-dw.c +++ b/drivers/spi/spi-dw.c @@ -182,9 +182,11 @@ static inline u32 rx_max(struct d

[PATCH 3.16 09/99] padata: Replace delayed timer with immediate workqueue in padata_reorder

se is broken. You cannot flush async crypto requests so it makes no sense to even try. A subsequent patch will fix it by replacing it with a ref counting scheme. Signed-off-by: Herbert Xu [bwh: Backported to 3.16: - Deleted code used the old timer API here - Adjust context] Signed-off-by: B

[PATCH 3.16 15/99] padata: always acquire cpu_hotplug_lock before pinst->lock

Cc: Eric Biggers Cc: Herbert Xu Cc: Steffen Klassert Cc: linux-cry...@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Herbert Xu Signed-off-by: Ben Hutchings --- kernel/padata.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/kernel/padata.c +++ b/kernel/pad

[PATCH 3.16 24/99] brcmfmac: Fix use after free in brcmf_sdio_readframes()

arpenter Acked-by: Franky Lin Signed-off-by: Kalle Valo [bwh: Backported to 3.16: adjust filename] Signed-off-by: Ben Hutchings --- drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c +++ b/drivers/n

  1   2   3   4   5   6   7   8   9   10   >