This is the start of the stable review cycle for the 3.18.49 release.
There are 145 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
---------
Wait, what? 3.18? Wasn't that kernel dead and forgotten and left to
rot on the side of the road? Yes, it was, but unfortunately, there's a
few million or so devices out there in the wild that still rely on this
kernel. Now, some of their manufacturers and SoC vendors might not be
keeping their kernels up to date very well, but some do actually care
about security and their users, so this release is for them. If you
happen to have a vendor that does not care about their users, go
complain, as odds are, your device is very insecure right now...
Because of this strange situation, and thanks to some vendors backing
the effort[1], I'll keep 3.18-stable alive in a semi-active mode, doing
releases every once in a while to keep it up to date and working well
based on what is happening in other more well-maintained stable kernels
(hint, use 4.4 or 4.9 or newer PLEASE, if your vendor refuses to do so,
switch vendors, it's the only way they will learn...) I don't know how
long I'll keep doing this, so if you care about 3.18, please contact me
to let me know the expected lifespan of your device.
And finally, due to the delay from the last 3.18-stable kernel release,
there is a large backlog of patches, this is about 1/2 of the pending
ones so far. I'll be working on catching up to the rest of them over
the next few weeks, and then the updates should be smaller than this
one.
ok, back to your normal form-letter stable -rc release notice:
---------
Responses should be made by Tue Apr 18 08:01:19 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.49-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
linux-3.18.y
and the diffstat can be found below.
thanks,
greg k-h
[1] Google's android-common-3.18 will be tracking these releases for
those of you caring about a working android kernel based on 3.18, I
recommend using this tree:
https://android.googlesource.com/kernel/common/+/android-3.18
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 3.18.49-rc1
Hannes Frederic Sowa <[email protected]>
dccp: fix memory leak during tear-down of unsuccessful connection request
Jon Maxwell <[email protected]>
dccp/tcp: fix routing redirect race
Dmitry V. Levin <[email protected]>
uapi: fix linux/packet_diag.h userspace compilation error
Eric Dumazet <[email protected]>
net: fix socket refcounting in skb_complete_tx_timestamp()
Eric Dumazet <[email protected]>
net: fix socket refcounting in skb_complete_wifi_ack()
Eric Dumazet <[email protected]>
tcp: fix various issues for sockets morphing to listen state
Ilya Dryomov <[email protected]>
libceph: don't set weight to IN when OSD is destroyed
Ravi Bangoria <[email protected]>
powerpc: Emulation support for load/store instructions on LE
Ralf Baechle <[email protected]>
MIPS: DEC: Avoid la pseudo-instruction in delay slots
Arnd Bergmann <[email protected]>
MIPS: ip22: Fix ip28 build for modern gcc
Arnd Bergmann <[email protected]>
MIPS: ip27: Disable qlge driver in defconfig
Alan Stern <[email protected]>
USB: fix linked-list corruption in rh_call_control()
Guenter Roeck <[email protected]>
usb: hub: Fix crash after failure to read BOS descriptor
Johan Hovold <[email protected]>
USB: wusbcore: fix NULL-deref at probe
Johan Hovold <[email protected]>
USB: idmouse: fix NULL-deref at probe
Johan Hovold <[email protected]>
USB: lvtest: fix NULL-deref at probe
Johan Hovold <[email protected]>
USB: uss720: fix NULL-deref at probe
Samuel Thibault <[email protected]>
usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk
Roger Quadros <[email protected]>
usb: gadget: f_uvc: Fix SuperSpeed companion descriptor's wBytesPerInterval
Bjørn Mork <[email protected]>
USB: serial: qcserial: add Dell DW5811e
Janosch Frank <[email protected]>
KVM: s390: Fix guest migration for huge guests resulting in panic
Heiko Carstens <[email protected]>
s390: use correct input data address for setup_randomness
Heiko Carstens <[email protected]>
s390: make setup_randomness work
Martin Schwidefsky <[email protected]>
s390: TASK_SIZE for kernel threads
Julian Wiedmann <[email protected]>
s390/qdio: clear DSCI prior to scanning multiple input queues
Wang, Rui Y <[email protected]>
crypto: ghash-clmulni - Fix load failure
Jiri Slaby <[email protected]>
crypto: algif_hash - avoid zero-sized array
Wang, Rui Y <[email protected]>
crypto: mcryptd - Fix load failure
Wang, Rui Y <[email protected]>
crypto: cryptd - Assign statesize properly
Peter Zijlstra <[email protected]>
futex: Add missing error handling to FUTEX_REQUEUE_PI
Peter Zijlstra <[email protected]>
futex: Fix potential use-after-free in FUTEX_REQUEUE_PI
Jack Morgenstein <[email protected]>
net/mlx4_core: Fix when to save some qp context flags for dynamic VST to
VGT transitions
Jack Morgenstein <[email protected]>
net/mlx4_core: Fix racy CQ (Completion Queue) free
Eugenia Emantayev <[email protected]>
net/mlx4_en: Fix bad WQE issue
Guenter Roeck <[email protected]>
usb: hub: Wait for connection to be reestablished after port reset
Andrey Konovalov <[email protected]>
net/packet: fix overflow in check for priv area size
Arnaldo Carvalho de Melo <[email protected]>
dccp: Unlock sock before calling sk_free()
Alexander Potapenko <[email protected]>
net: don't call strlen() on the user buffer in packet_bind_spkt()
Paul Hüber <[email protected]>
l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv
Julian Anastasov <[email protected]>
ipv4: mask tos for input route
David Forster <[email protected]>
vti6: return GRE_KEY for vti6
Matthias Schiffer <[email protected]>
vxlan: correctly validate VXLAN ID against VXLAN_N_VID
Florian Westphal <[email protected]>
netlink: remove mmapped netlink support
Rik van Riel <[email protected]>
tracing: Add #undef to fix compile error
Arnd Bergmann <[email protected]>
cpmac: remove hopeless #warning
Michel Dänzer <[email protected]>
drm/ttm: Make sure BOs being swapped out are cacheable
Y.C. Chen <[email protected]>
drm/ast: Fix AST2400 POST failure without BMC FW or VBIOS
Y.C. Chen <[email protected]>
drm/ast: Call open_key before enable_mmio in POST code
Y.C. Chen <[email protected]>
drm/ast: Fix test for VGA enabled
Shuah Khan <[email protected]>
samples: move mic/mpssd example code from Documentation
Jason A. Donenfeld <[email protected]>
padata: avoid race in reordering
Mikulas Patocka <[email protected]>
dm: flush queued bios when process blocks to avoid deadlock
Luis de Bethencourt <[email protected]>
mvsas: fix misleading indentation
Johan Hovold <[email protected]>
USB: serial: io_ti: fix information leak in completion handler
Johan Hovold <[email protected]>
USB: serial: io_ti: fix NULL-deref in interrupt callback
Johan Hovold <[email protected]>
USB: iowarrior: fix NULL-deref in write
Johan Hovold <[email protected]>
USB: iowarrior: fix NULL-deref at probe
Johan Hovold <[email protected]>
USB: serial: omninet: fix reference leaks at open
Johan Hovold <[email protected]>
USB: serial: safe_serial: fix information leak in completion handler
Guenter Roeck <[email protected]>
usb: host: xhci-plat: Fix timeout on removal of hot pluggable xhci
controllers
Felipe Balbi <[email protected]>
usb: gadget: function: f_fs: pass companion descriptor along
Felipe Balbi <[email protected]>
usb: dwc3: gadget: make Set Endpoint Configuration macros safe
Peter Chen <[email protected]>
usb: gadget: dummy_hcd: clear usb_gadget region before registration
Arnd Bergmann <[email protected]>
mtd: pmcmsp: use kstrndup instead of kmalloc+strncpy
Arnd Bergmann <[email protected]>
crypto: improve gcc optimization flags for serpent and wp512
Steven Rostedt (VMware) <[email protected]>
ktest: Fix child exit code processing
OGAWA Hirofumi <[email protected]>
fat: fix using uninitialized fields of fat_inode/fsinfo_inode
Arnd Bergmann <[email protected]>
libceph: use BUG() instead of BUG_ON(1)
Matt Chen <[email protected]>
mac80211: flush delayed work when entering suspend
Max Filippov <[email protected]>
xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD
Trond Myklebust <[email protected]>
nlm: Ensure callback code also checks that the files match
Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix OOB-event processing
Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix OOB data sanity check
Feras Daoud <[email protected]>
IB/ipoib: Fix deadlock between rmmod and set_mode
Dmitry Tunin <[email protected]>
Bluetooth: Add another AR3012 04ca:3018 device
Janosch Frank <[email protected]>
KVM: s390: Disable dirty log retrieval for UCONTROL guests
Ian Abbott <[email protected]>
serial: 8250_pci: Add MKS Tenta SCOM-0800 and SCOM-0801 cards
Shuxiao Zhang <[email protected]>
staging: android: ashmem: lseek failed due to no FMODE_LSEEK.
Andy Whitcroft <[email protected]>
xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window
Andy Whitcroft <[email protected]>
xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder
Florian Westphal <[email protected]>
xfrm: policy: init locks early
Tomasz Majchrzak <[email protected]>
raid10: increment write counter after bio is split
Zhaohongjiang <[email protected]>
cancel the setfilesize transation when io error happen
Alexander Popov <[email protected]>
tty: n_hdlc: get rid of racy n_hdlc.tbuf
Jiri Slaby <[email protected]>
TTY: n_hdlc, fix lockdep false positive
Rasmus Villemoes <[email protected]>
lib/vsprintf.c: improve sanity check in vsnprintf()
Maxime Jayat <[email protected]>
net: socket: fix recvmmsg not returning error from sock_error
Andrey Konovalov <[email protected]>
dccp: fix freeing skb too early for IPV6_RECVPKTINFO
Eric Dumazet <[email protected]>
net/llc: avoid BUG_ON() in skb_orphan()
Richard Weinberger <[email protected]>
drbd: Fix kernel_sendmsg() usage - potential NULL deref
Felipe Balbi <[email protected]>
usb: gadget: u_ether: remove interrupt throttling
Johan Hovold <[email protected]>
USB: cdc-acm: fix TIOCMIWAIT
Paul Fertser <[email protected]>
Revert "staging: nvec: ps2: change serio type to passthrough"
Paul Fertser <[email protected]>
drivers: staging: nvec: remove bogus reset command for PS/2 interface
Arnd Bergmann <[email protected]>
staging: iio: ad5933: avoid uninitialized variable in error case
Andrey Ryabinin <[email protected]>
coredump: fix unfreezable coredumping task
Jann Horn <[email protected]>
swapfile: fix memory corruption via malformed swapfile
Sean Young <[email protected]>
dib0700: fix nec repeat handling
murray foster <[email protected]>
ASoC: cs4270: fix DAPM stream name mismatch
Eric Dumazet <[email protected]>
netlink: do not enter direct reclaim from netlink_dump()
Willem de Bruijn <[email protected]>
packet: on direct_xmit, limit tso and csum to supported devices
Marcelo Ricardo Leitner <[email protected]>
sctp: validate chunk len before actually using it
Jiri Slaby <[email protected]>
net: sctp, forbid negative length
Eric Dumazet <[email protected]>
ipv4: disable BH in set_ping_group_range()
Eric Dumazet <[email protected]>
net: pktgen: remove rcu locking in pktgen_change_name()
Nicolas Dichtel <[email protected]>
ipv6: correctly add local routes when lo goes up
Anoob Soman <[email protected]>
packet: call fanout_release, while UNREGISTERING a netdev
Andrew Collins <[email protected]>
net: Add netdev all_adj_list refcnt propagation to fix panic
Nikolay Aleksandrov <[email protected]>
ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route
Lance Richardson <[email protected]>
ip6_gre: fix flowi6_proto value in ip6gre_xmit_other()
Eric Dumazet <[email protected]>
tcp: fix a compile error in DBGUNDO()
Douglas Caetano dos Santos <[email protected]>
tcp: fix wrong checksum calculation on MTU probing
Kees Cook <[email protected]>
fbdev: color map copying bounds checking
Stephen Smalley <[email protected]>
selinux: fix off-by-one in setprocattr
Oliver Neukum <[email protected]>
HID: usbhid: add ATEN CS962 to list of quirky devices
David Hsu <[email protected]>
pwm: Unexport children before chip removal
Boris Brezillon <[email protected]>
UBI: fastmap: scrub PEB when bitflips are detected in a free PEB EC header
Arnd Bergmann <[email protected]>
smc91x: avoid self-comparison warning
Arnd Bergmann <[email protected]>
drm/exynos: fix error handling in exynos_drm_subdrv_open
Arnd Bergmann <[email protected]>
ARM: 8584/1: floppy: avoid gcc-6 warning
Jiri Slaby <[email protected]>
tty: vt, fix bogus division in csi_J
Linus Torvalds <[email protected]>
Fix potential infoleak in older kernels
Marcel Hasler <[email protected]>
ALSA: usb-audio: Add quirk for Syntek STK1160
Arve Hjønnevåg <[email protected]>
ANDROID: binder: Clear binder and cookie when setting handle in flat binder
struct
Arve Hjønnevåg <[email protected]>
ANDROID: binder: Add strong ref checks
Eric Dumazet <[email protected]>
tcp: fix overflow in __tcp_retransmit_skb()
Peter Chen <[email protected]>
usb: chipidea: move the lock initialization to core file
Ashok Raj <[email protected]>
iommu/vt-d: Fix IOMMU lookup for SR-IOV Virtual Functions
Eric Dumazet <[email protected]>
tcp: avoid infinite loop in tcp_splice_read()
Eric Dumazet <[email protected]>
ipv6: tcp: add a missing tcp_v6_restore_cb()
Eric Dumazet <[email protected]>
ipv6: tcp: restore IP6CB for pktoptions skbs
Eric Dumazet <[email protected]>
ip6_gre: fix ip6gre_err() invalid reads
Eric Dumazet <[email protected]>
l2tp: do not use udp_ioctl()
WANG Cong <[email protected]>
ping: fix a null pointer dereference
WANG Cong <[email protected]>
sit: fix a double free on error path
Marcelo Ricardo Leitner <[email protected]>
sctp: avoid BUG_ON on sctp_wait_for_sndbuf
Benjamin Poirier <[email protected]>
mlx4: Invoke softirqs after napi_reschedule
Eric Dumazet <[email protected]>
netlabel: out of bound access in cipso_v4_validate()
Eric Dumazet <[email protected]>
ipv4: keep skb->dst around in presence of IP options
Eric Dumazet <[email protected]>
net: use a work queue to defer net_disable_timestamp() work
Eric Dumazet <[email protected]>
tcp: fix 0 divide in __tcp_select_window()
Dan Carpenter <[email protected]>
ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim()
Eric Dumazet <[email protected]>
ipv6: fix ip6_tnl_parse_tlv_enc_lim()
Eric Dumazet <[email protected]>
can: Fix kernel panic at security_sock_rcv_skb
Linus Torvalds <[email protected]>
Revert "af_unix: Fix splice-bind deadlock"
-------------
Diffstat:
Documentation/Makefile | 2 +-
Documentation/mic/Makefile | 1 -
Documentation/mic/mpssd/Makefile | 19 -
Documentation/networking/netlink_mmap.txt | 339 ----------
Makefile | 4 +-
arch/arm/include/asm/floppy.h | 2 +-
arch/mips/configs/ip27_defconfig | 1 -
arch/mips/dec/int-handler.S | 40 +-
arch/mips/sgi-ip22/Platform | 2 +-
arch/powerpc/lib/sstep.c | 20 -
arch/s390/include/asm/processor.h | 3 +-
arch/s390/kernel/setup.c | 8 +-
arch/s390/kvm/kvm-s390.c | 3 +
arch/s390/mm/pgtable.c | 19 +-
arch/x86/crypto/ghash-clmulni-intel_glue.c | 26 +
arch/x86/include/asm/uaccess.h | 10 +-
arch/xtensa/kernel/setup.c | 4 +-
crypto/Makefile | 2 +
crypto/algif_hash.c | 2 +-
crypto/cryptd.c | 1 +
crypto/mcryptd.c | 1 +
drivers/block/drbd/drbd_main.c | 2 +-
drivers/bluetooth/ath3k.c | 2 +
drivers/bluetooth/btusb.c | 1 +
drivers/gpu/drm/ast/ast_post.c | 48 +-
drivers/gpu/drm/exynos/exynos_drm_core.c | 2 +-
drivers/gpu/drm/ttm/ttm_bo.c | 4 +-
drivers/hid/hid-ids.h | 1 +
drivers/hid/usbhid/hid-quirks.c | 1 +
drivers/infiniband/ulp/ipoib/ipoib_cm.c | 12 +-
drivers/infiniband/ulp/ipoib/ipoib_main.c | 6 +-
drivers/iommu/dmar.c | 4 +-
drivers/iommu/intel-iommu.c | 13 +
drivers/md/dm.c | 55 ++
drivers/md/raid10.c | 4 +-
drivers/media/usb/dvb-usb/dib0700_core.c | 5 +-
drivers/mtd/maps/pmcmsp-flash.c | 4 +-
drivers/mtd/ubi/fastmap.c | 7 +-
drivers/net/ethernet/mellanox/mlx4/cq.c | 38 +-
drivers/net/ethernet/mellanox/mlx4/en_rx.c | 13 +-
.../net/ethernet/mellanox/mlx4/resource_tracker.c | 5 +-
drivers/net/ethernet/smsc/smc91x.c | 2 +-
drivers/net/ethernet/ti/cpmac.c | 2 +-
drivers/net/vxlan.c | 2 +-
drivers/pwm/core.c | 2 +
drivers/pwm/sysfs.c | 18 +
drivers/s390/cio/qdio_thinint.c | 8 +-
drivers/scsi/mvsas/mv_sas.c | 4 +-
drivers/staging/android/ashmem.c | 1 +
drivers/staging/android/binder.c | 35 +-
drivers/staging/iio/impedance-analyzer/ad5933.c | 17 +-
drivers/staging/nvec/nvec_ps2.c | 6 +-
drivers/tty/n_hdlc.c | 143 ++--
drivers/tty/serial/8250/8250_pci.c | 13 +
drivers/tty/vt/vt.c | 2 +-
drivers/usb/chipidea/core.c | 1 +
drivers/usb/chipidea/udc.c | 2 -
drivers/usb/class/cdc-acm.c | 2 -
drivers/usb/core/config.c | 10 +
drivers/usb/core/hcd.c | 7 +-
drivers/usb/core/hub.c | 13 +-
drivers/usb/core/quirks.c | 8 +
drivers/usb/dwc3/gadget.h | 14 +-
drivers/usb/gadget/function/f_fs.c | 15 +-
drivers/usb/gadget/function/f_uvc.c | 2 +-
drivers/usb/gadget/function/u_ether.c | 8 -
drivers/usb/gadget/udc/dummy_hcd.c | 2 +
drivers/usb/host/xhci-plat.c | 2 +
drivers/usb/misc/idmouse.c | 3 +
drivers/usb/misc/iowarrior.c | 21 +-
drivers/usb/misc/lvstest.c | 4 +
drivers/usb/misc/uss720.c | 5 +
drivers/usb/serial/digi_acceleport.c | 14 +-
drivers/usb/serial/io_ti.c | 8 +-
drivers/usb/serial/omninet.c | 6 -
drivers/usb/serial/qcserial.c | 2 +
drivers/usb/serial/safe_serial.c | 5 +
drivers/usb/wusbcore/wa-hc.c | 3 +
drivers/video/fbdev/core/fbcmap.c | 26 +-
fs/coredump.c | 3 +
fs/fat/inode.c | 13 +-
fs/xfs/xfs_aops.c | 13 +-
include/linux/can/core.h | 7 +-
include/linux/ceph/osdmap.h | 2 +-
include/linux/lockd/lockd.h | 3 +-
include/linux/mroute.h | 2 +-
include/linux/mroute6.h | 2 +-
include/linux/pwm.h | 5 +
include/linux/usb/quirks.h | 6 +
include/net/cipso_ipv4.h | 4 +
include/trace/events/syscalls.h | 1 +
include/uapi/linux/netlink.h | 4 +
include/uapi/linux/netlink_diag.h | 2 +
include/uapi/linux/packet_diag.h | 2 +-
kernel/futex.c | 22 +-
kernel/padata.c | 5 +-
lib/vsprintf.c | 2 +-
mm/swapfile.c | 2 +
net/can/af_can.c | 12 +-
net/can/af_can.h | 3 +-
net/can/bcm.c | 4 +-
net/can/gw.c | 2 +-
net/can/raw.c | 4 +-
net/ceph/osdmap.c | 1 -
net/core/dev.c | 100 +--
net/core/pktgen.c | 17 +-
net/core/skbuff.c | 30 +-
net/dccp/ccids/ccid2.c | 1 +
net/dccp/input.c | 3 +-
net/dccp/ipv4.c | 3 +-
net/dccp/ipv6.c | 8 +-
net/dccp/minisocks.c | 1 +
net/ipv4/cipso_ipv4.c | 4 +
net/ipv4/ip_sockglue.c | 9 +-
net/ipv4/ipmr.c | 3 +-
net/ipv4/ping.c | 2 +
net/ipv4/route.c | 4 +-
net/ipv4/sysctl_net_ipv4.c | 4 +-
net/ipv4/tcp.c | 6 +
net/ipv4/tcp_input.c | 3 +-
net/ipv4/tcp_ipv4.c | 10 +-
net/ipv4/tcp_output.c | 21 +-
net/ipv4/tcp_timer.c | 6 +-
net/ipv6/addrconf.c | 2 +-
net/ipv6/ip6_gre.c | 42 +-
net/ipv6/ip6_tunnel.c | 34 +-
net/ipv6/ip6_vti.c | 4 +
net/ipv6/ip6mr.c | 5 +-
net/ipv6/route.c | 4 +-
net/ipv6/sit.c | 1 +
net/ipv6/tcp_ipv6.c | 32 +-
net/l2tp/l2tp_core.h | 1 +
net/l2tp/l2tp_ip.c | 29 +-
net/l2tp/l2tp_ip6.c | 2 +-
net/llc/llc_conn.c | 3 +
net/llc/llc_sap.c | 3 +
net/mac80211/pm.c | 1 +
net/netlink/Kconfig | 9 -
net/netlink/af_netlink.c | 741 +--------------------
net/netlink/af_netlink.h | 15 -
net/netlink/diag.c | 39 --
net/packet/af_packet.c | 22 +-
net/sctp/sm_statefuns.c | 12 +-
net/sctp/socket.c | 8 +-
net/socket.c | 4 +-
net/unix/af_unix.c | 66 +-
net/xfrm/xfrm_policy.c | 10 +-
net/xfrm/xfrm_user.c | 9 +-
{Documentation => samples}/mic/mpssd/.gitignore | 0
samples/mic/mpssd/Makefile | 27 +
{Documentation => samples}/mic/mpssd/micctrl | 0
{Documentation => samples}/mic/mpssd/mpss | 0
{Documentation => samples}/mic/mpssd/mpssd.c | 0
{Documentation => samples}/mic/mpssd/mpssd.h | 0
{Documentation => samples}/mic/mpssd/sysfs.c | 0
security/selinux/hooks.c | 2 +-
sound/soc/codecs/cs4270.c | 8 +-
sound/usb/quirks-table.h | 17 +
tools/testing/ktest/ktest.pl | 2 +-
159 files changed, 1029 insertions(+), 1660 deletions(-)
