[PATCH 4.4 15/47] iio: ad9523: Fix displayed phase

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Lars-Peter Clausen commit 5a4e33c1c53ae7d4425f7d94e60e4458a37b349e upstream. Fix the displayed phase for the ad9523 driver. Currently the most significant decimal place is dropped and all

[PATCH 4.4 24/47] uprobes: Use synchronize_rcu() not synchronize_sched()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit 016f8ffc48cb01d1e7701649c728c5d2e737d295 upstream. While debugging another bug, I was looking at all the synchronize*() functions being used in kernel/trace, and

[PATCH 4.4 02/47] net: mac802154: tx: expand tailroom if necessary

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Alexander Aring commit f9c52831133050c6b82aa8b6831c92da2bbf2a0b upstream. This patch is necessary if case of AF_PACKET or other socket interface which I am aware of it and didn't allocated the

[PATCH 4.4 20/47] vmw_balloon: fix VMCI use when balloon built into kernel

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Nadav Amit commit c3cc1b0fc27508da53fe955a3b23d03964410682 upstream. Currently, when all modules, including VMCI and VMware balloon are built into the kernel, the initialization of the balloon

[PATCH 4.4 15/47] iio: ad9523: Fix displayed phase

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Lars-Peter Clausen commit 5a4e33c1c53ae7d4425f7d94e60e4458a37b349e upstream. Fix the displayed phase for the ad9523 driver. Currently the most significant decimal place is dropped and all

[PATCH 4.4 24/47] uprobes: Use synchronize_rcu() not synchronize_sched()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit 016f8ffc48cb01d1e7701649c728c5d2e737d295 upstream. While debugging another bug, I was looking at all the synchronize*() functions being used in kernel/trace, and

[PATCH 4.4 21/47] tracing: Do not call start/stop() functions when tracing_on does not change

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit f143641bfef9a4a60c57af30de26c63057e7e695 upstream. Currently, when one echo's in 1 into tracing_on, the current tracer's "start()" function is executed, even if

[PATCH 4.4 21/47] tracing: Do not call start/stop() functions when tracing_on does not change

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit f143641bfef9a4a60c57af30de26c63057e7e695 upstream. Currently, when one echo's in 1 into tracing_on, the current tracer's "start()" function is executed, even if

[PATCH 4.4 12/47] net/9p/trans_fd.c: fix race-condition by flushing workqueue before the kfree()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Tomas Bortoli commit 430ac66eb4c5b5c4eb846b78ebf65747510b30f1 upstream. The patch adds the flush in p9_mux_poll_stop() as it the function used by p9_conn_destroy(), in turn called by

[PATCH 4.4 18/47] vmw_balloon: do not use 2MB without batching

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Nadav Amit commit 5081efd112560d3febb328e627176235b250d59d upstream. If the hypervisor sets 2MB batching is on, while batching is cleared, the balloon code breaks. In this case the legacy

[PATCH 4.4 16/47] iio: ad9523: Fix return value for ad952x_store()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Lars-Peter Clausen commit 9a5094ca29ea9b1da301b31fd377c0c0c4c23034 upstream. A sysfs write callback function needs to either return the number of consumed characters or an error. The

[PATCH 4.4 01/47] net: 6lowpan: fix reserved space for single frames

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Alexander Aring commit ac74f87c789af40936a80131c4759f3e72579c3a upstream. This patch fixes patch add handling to take care tail and headroom for single 6lowpan frames. We need to be sure we

[PATCH 4.4 12/47] net/9p/trans_fd.c: fix race-condition by flushing workqueue before the kfree()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Tomas Bortoli commit 430ac66eb4c5b5c4eb846b78ebf65747510b30f1 upstream. The patch adds the flush in p9_mux_poll_stop() as it the function used by p9_conn_destroy(), in turn called by

[PATCH 4.4 18/47] vmw_balloon: do not use 2MB without batching

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Nadav Amit commit 5081efd112560d3febb328e627176235b250d59d upstream. If the hypervisor sets 2MB batching is on, while batching is cleared, the balloon code breaks. In this case the legacy

[PATCH 4.4 16/47] iio: ad9523: Fix return value for ad952x_store()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Lars-Peter Clausen commit 9a5094ca29ea9b1da301b31fd377c0c0c4c23034 upstream. A sysfs write callback function needs to either return the number of consumed characters or an error. The

[PATCH 4.4 01/47] net: 6lowpan: fix reserved space for single frames

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Alexander Aring commit ac74f87c789af40936a80131c4759f3e72579c3a upstream. This patch fixes patch add handling to take care tail and headroom for single 6lowpan frames. We need to be sure we

[PATCH 4.9 38/63] pnfs/blocklayout: off by one in bl_map_stripe()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Dan Carpenter commit 0914bb965e38a055e9245637aed117efbe976e91 upstream. "dev->nr_children" is the number of children which were parsed successfully in bl_parse_stripe(). It could be all of

[PATCH 4.4 11/47] net/9p/client.c: version pointer uninitialized

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Tomas Bortoli commit 7913690dcc5e18e235769fd87c34143072f5dbea upstream. The p9_client_version() does not initialize the version pointer. If the call to p9pdu_readf() returns an error and

[PATCH 4.9 30/63] tracing/blktrace: Fix to allow setting same value

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit 757d9140072054528b13bbe291583d9823cde195 upstream. Masami Hiramatsu reported: Current trace-enable attribute in sysfs returns an error if user writes the

[PATCH 4.4 10/47] 9p/virtio: fix off-by-one error in sg list bounds check

4.4-stable review patch. If anyone has any objections, please let me know. -- From: jiangyiwen commit 23cba9cbde0bba05d772b335fe5f66aa82b9ad19 upstream. Because the value of limit is VIRTQUEUE_NUM, if index is equal to limit, it will cause sg array out of bounds, so correct

[PATCH 4.9 39/63] NFSv4 client live hangs after live data migration recovery

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Bill Baker commit 0f90be132cbf1537d87a6a8b9e80867adac892f6 upstream. After a live data migration event at the NFS server, the client may send I/O requests to the wrong server, causing a live

[PATCH 4.9 38/63] pnfs/blocklayout: off by one in bl_map_stripe()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Dan Carpenter commit 0914bb965e38a055e9245637aed117efbe976e91 upstream. "dev->nr_children" is the number of children which were parsed successfully in bl_parse_stripe(). It could be all of

[PATCH 4.4 11/47] net/9p/client.c: version pointer uninitialized

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Tomas Bortoli commit 7913690dcc5e18e235769fd87c34143072f5dbea upstream. The p9_client_version() does not initialize the version pointer. If the call to p9pdu_readf() returns an error and

[PATCH 4.9 30/63] tracing/blktrace: Fix to allow setting same value

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit 757d9140072054528b13bbe291583d9823cde195 upstream. Masami Hiramatsu reported: Current trace-enable attribute in sysfs returns an error if user writes the

[PATCH 4.4 10/47] 9p/virtio: fix off-by-one error in sg list bounds check

4.4-stable review patch. If anyone has any objections, please let me know. -- From: jiangyiwen commit 23cba9cbde0bba05d772b335fe5f66aa82b9ad19 upstream. Because the value of limit is VIRTQUEUE_NUM, if index is equal to limit, it will cause sg array out of bounds, so correct

[PATCH 4.9 39/63] NFSv4 client live hangs after live data migration recovery

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Bill Baker commit 0f90be132cbf1537d87a6a8b9e80867adac892f6 upstream. After a live data migration event at the NFS server, the client may send I/O requests to the wrong server, causing a live

[PATCH 4.9 36/63] xtensa: limit offsets in __loop_cache_{all,page}

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Max Filippov commit be75de25251f7cf3e399ca1f584716a95510d24a upstream. When building kernel for xtensa cores with big cache lines (e.g. 128 bytes or more) __loop_cache_all and

[PATCH 4.9 37/63] xtensa: increase ranges in ___invalidate_{i,d}cache_all

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Max Filippov commit fec3259c9f747c039f90e99570540114c8d81a14 upstream. Cache invalidation macros use cache line size to iterate over invalidated cache lines, assuming that all cache ways are

[PATCH 4.9 36/63] xtensa: limit offsets in __loop_cache_{all,page}

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Max Filippov commit be75de25251f7cf3e399ca1f584716a95510d24a upstream. When building kernel for xtensa cores with big cache lines (e.g. 128 bytes or more) __loop_cache_all and

[PATCH 4.9 37/63] xtensa: increase ranges in ___invalidate_{i,d}cache_all

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Max Filippov commit fec3259c9f747c039f90e99570540114c8d81a14 upstream. Cache invalidation macros use cache line size to iterate over invalidated cache lines, assuming that all cache ways are

[PATCH 4.9 63/63] fs/quota: Fix spectre gadget in do_quotactl

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jeremy Cline commit 7b6924d94a60c6b8c1279ca003e8744e6cd9e8b1 upstream. 'type' is user-controlled, so sanitize it after the bounds check to avoid using it in speculative execution. This covers

[PATCH 4.9 35/63] KVM: VMX: fixes for vmentry_l1d_flush module parameter

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Paolo Bonzini commit 0027ff2a75f9dcf0537ac0a65c5840b0e21a4950 upstream. Two bug fixes: 1) missing entries in the l1d_param array; this can cause a host crash if an access attempts to reach

[PATCH 4.9 34/63] PM / sleep: wakeup: Fix build error caused by missing SRCU support

4.9-stable review patch. If anyone has any objections, please let me know. -- From: zhangyi (F) commit 3df6f61fff49632492490fb6e42646b803a9958a upstream. Commit ea0212f40c6 (power: auto select CONFIG_SRCU) made the code in drivers/base/power/wakeup.c use SRCU instead of RCU,

[PATCH 4.9 63/63] fs/quota: Fix spectre gadget in do_quotactl

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jeremy Cline commit 7b6924d94a60c6b8c1279ca003e8744e6cd9e8b1 upstream. 'type' is user-controlled, so sanitize it after the bounds check to avoid using it in speculative execution. This covers

[PATCH 4.9 35/63] KVM: VMX: fixes for vmentry_l1d_flush module parameter

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Paolo Bonzini commit 0027ff2a75f9dcf0537ac0a65c5840b0e21a4950 upstream. Two bug fixes: 1) missing entries in the l1d_param array; this can cause a host crash if an access attempts to reach

[PATCH 4.9 34/63] PM / sleep: wakeup: Fix build error caused by missing SRCU support

4.9-stable review patch. If anyone has any objections, please let me know. -- From: zhangyi (F) commit 3df6f61fff49632492490fb6e42646b803a9958a upstream. Commit ea0212f40c6 (power: auto select CONFIG_SRCU) made the code in drivers/base/power/wakeup.c use SRCU instead of RCU,

[PATCH 4.9 60/63] perf auxtrace: Fix queue resize

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Adrian Hunter commit 99cbbe56eb8bede625f410ab62ba34673ffa7d21 upstream. When the number of queues grows beyond 32, the array of queues is resized but not all members were being copied. Fix by

[PATCH 4.9 33/63] 9p: fix multiple NULL-pointer-dereferences

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Tomas Bortoli commit 10aa14527f458e9867cf3d2cc6b8cb0f6704448b upstream. Added checks to prevent GPFs from raising. Link: http://lkml.kernel.org/r/20180727110558.5479-1-tomasbort...@gmail.com

[PATCH 4.9 59/63] bcache: release dc->writeback_lock properly in bch_writeback_thread()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Shan Hai commit 3943b040f11ed0cc6d4585fd286a623ca8634547 upstream. The writeback thread would exit with a lock held when the cache device is detached via sysfs interface, fix it by releasing

[PATCH 4.9 60/63] perf auxtrace: Fix queue resize

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Adrian Hunter commit 99cbbe56eb8bede625f410ab62ba34673ffa7d21 upstream. When the number of queues grows beyond 32, the array of queues is resized but not all members were being copied. Fix by

[PATCH 4.9 33/63] 9p: fix multiple NULL-pointer-dereferences

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Tomas Bortoli commit 10aa14527f458e9867cf3d2cc6b8cb0f6704448b upstream. Added checks to prevent GPFs from raising. Link: http://lkml.kernel.org/r/20180727110558.5479-1-tomasbort...@gmail.com

[PATCH 4.9 59/63] bcache: release dc->writeback_lock properly in bch_writeback_thread()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Shan Hai commit 3943b040f11ed0cc6d4585fd286a623ca8634547 upstream. The writeback thread would exit with a lock held when the cache device is detached via sysfs interface, fix it by releasing

[PATCH 4.9 51/63] ubifs: Check data node size before truncate

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Richard Weinberger commit 95a22d2084d72ea067d8323cc85677dba5d97cae upstream. Check whether the size is within bounds before using it. If the size is not correct, abort and dump the bad data

[PATCH 4.9 58/63] printk/tracing: Do not trace printk_nmi_enter()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit d1c392c9e2a301f38998a353f467f76414e38725 upstream. I hit the following splat in my tests: [ cut here ] IRQs not enabled as expected

[PATCH 4.9 52/63] ubifs: Fix synced_i_size calculation for xattr inodes

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Richard Weinberger commit 59965593205fa4044850d35ee3557cf0b7edcd14 upstream. In ubifs_jnl_update() we sync parent and child inodes to the flash, in case of xattrs, the parent inode (AKA host

[PATCH 4.9 51/63] ubifs: Check data node size before truncate

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Richard Weinberger commit 95a22d2084d72ea067d8323cc85677dba5d97cae upstream. Check whether the size is within bounds before using it. If the size is not correct, abort and dump the bad data

[PATCH 4.9 58/63] printk/tracing: Do not trace printk_nmi_enter()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit d1c392c9e2a301f38998a353f467f76414e38725 upstream. I hit the following splat in my tests: [ cut here ] IRQs not enabled as expected

[PATCH 4.9 52/63] ubifs: Fix synced_i_size calculation for xattr inodes

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Richard Weinberger commit 59965593205fa4044850d35ee3557cf0b7edcd14 upstream. In ubifs_jnl_update() we sync parent and child inodes to the flash, in case of xattrs, the parent inode (AKA host

[PATCH 4.9 61/63] crypto: vmx - Fix sleep-in-atomic bugs

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Ondrej Mosnacek commit 0522236d4f9c5ab2e79889cb020d1acbe5da416e upstream. This patch fixes sleep-in-atomic bugs in AES-CBC and AES-XTS VMX implementations. The problem is that the blkcipher_*

[PATCH 4.9 50/63] Revert "UBIFS: Fix potential integer overflow in allocation"

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Richard Weinberger commit 08acbdd6fd736b90f8d725da5a0de4de2dd6de62 upstream. This reverts commit 353748a359f1821ee934afc579cf04572406b420. It bypassed the linux-mtd review process and fixes

[PATCH 4.9 57/63] libnvdimm: fix ars_status output length calculation

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Vishal Verma commit 286e87718103acdf85f4ed323a37e4839a8a7c05 upstream. Commit efda1b5d87cb ("acpi, nfit, libnvdimm: fix / harden ars_status output length handling") Introduced additional

[PATCH 4.9 61/63] crypto: vmx - Fix sleep-in-atomic bugs

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Ondrej Mosnacek commit 0522236d4f9c5ab2e79889cb020d1acbe5da416e upstream. This patch fixes sleep-in-atomic bugs in AES-CBC and AES-XTS VMX implementations. The problem is that the blkcipher_*

[PATCH 4.9 50/63] Revert "UBIFS: Fix potential integer overflow in allocation"

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Richard Weinberger commit 08acbdd6fd736b90f8d725da5a0de4de2dd6de62 upstream. This reverts commit 353748a359f1821ee934afc579cf04572406b420. It bypassed the linux-mtd review process and fixes

[PATCH 4.9 57/63] libnvdimm: fix ars_status output length calculation

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Vishal Verma commit 286e87718103acdf85f4ed323a37e4839a8a7c05 upstream. Commit efda1b5d87cb ("acpi, nfit, libnvdimm: fix / harden ars_status output length handling") Introduced additional

[PATCH 4.9 53/63] pwm: tiehrpwm: Fix disabling of output of PWMs

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Vignesh R commit 38dabd91ff0bde33352ca3cc65ef515599b77a05 upstream. pwm-tiehrpwm driver disables PWM output by putting it in low output state via active AQCSFRC register in

[PATCH 4.9 56/63] getxattr: use correct xattr length

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Christian Brauner commit 82c9a927bc5df6e06b72d206d24a9d10cced4eb5 upstream. When running in a container with a user namespace, if you call getxattr with name = "system.posix_acl_access" and

[PATCH 4.9 55/63] udlfb: set optimal write delay

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Mikulas Patocka commit bb24153a3f13dd0dbc1f8055ad97fe346d598f66 upstream. The default delay 5 jiffies is too much when the kernel is compiled with HZ=100 - it results in jumpy cursor in

[PATCH 4.9 54/63] fb: fix lost console when the user unplugs a USB adapter

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Mikulas Patocka commit 8c5b044299951acd91e830a688dd920477ea1eda upstream. I have a USB display adapter using the udlfb driver and I use it on an ARM board that doesn't have any graphics card.

[PATCH 4.9 53/63] pwm: tiehrpwm: Fix disabling of output of PWMs

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Vignesh R commit 38dabd91ff0bde33352ca3cc65ef515599b77a05 upstream. pwm-tiehrpwm driver disables PWM output by putting it in low output state via active AQCSFRC register in

[PATCH 4.9 56/63] getxattr: use correct xattr length

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Christian Brauner commit 82c9a927bc5df6e06b72d206d24a9d10cced4eb5 upstream. When running in a container with a user namespace, if you call getxattr with name = "system.posix_acl_access" and

[PATCH 4.9 55/63] udlfb: set optimal write delay

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Mikulas Patocka commit bb24153a3f13dd0dbc1f8055ad97fe346d598f66 upstream. The default delay 5 jiffies is too much when the kernel is compiled with HZ=100 - it results in jumpy cursor in

[PATCH 4.9 54/63] fb: fix lost console when the user unplugs a USB adapter

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Mikulas Patocka commit 8c5b044299951acd91e830a688dd920477ea1eda upstream. I have a USB display adapter using the udlfb driver and I use it on an ARM board that doesn't have any graphics card.

[PATCH 4.9 32/63] mfd: hi655x: Fix regmap area declared size for hi655x

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Rafael David Tinoco commit 6afebb70ee7a4bde106dc1a875e7ac7997248f84 upstream. Fixes https://bugs.linaro.org/show_bug.cgi?id=3903 LTP Functional tests have caused a bad paging request when

[PATCH 4.9 48/63] userns: move user access out of the mutex

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jann Horn commit 5820f140edef111a9ea2ef414ab2428b8cb805b1 upstream. The old code would hold the userns_state_mutex indefinitely if memdup_user_nul stalled due to e.g. a userfault region.

[PATCH 4.9 32/63] mfd: hi655x: Fix regmap area declared size for hi655x

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Rafael David Tinoco commit 6afebb70ee7a4bde106dc1a875e7ac7997248f84 upstream. Fixes https://bugs.linaro.org/show_bug.cgi?id=3903 LTP Functional tests have caused a bad paging request when

[PATCH 4.9 48/63] userns: move user access out of the mutex

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jann Horn commit 5820f140edef111a9ea2ef414ab2428b8cb805b1 upstream. The old code would hold the userns_state_mutex indefinitely if memdup_user_nul stalled due to e.g. a userfault region.

[PATCH 4.9 49/63] ubifs: Fix memory leak in lprobs self-check

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Richard Weinberger commit eef19816ada3abd56d9f20c88794cc2fea83ebb2 upstream. Allocate the buffer after we return early. Otherwise memory is being leaked. Cc: Fixes: 1e51764a3c2a ("UBIFS: add

[PATCH 4.9 49/63] ubifs: Fix memory leak in lprobs self-check

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Richard Weinberger commit eef19816ada3abd56d9f20c88794cc2fea83ebb2 upstream. Allocate the buffer after we return early. Otherwise memory is being leaked. Cc: Fixes: 1e51764a3c2a ("UBIFS: add

[PATCH 4.9 46/63] osf_getdomainname(): use copy_to_user()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Al Viro commit 9ba3eb5103cf56f0daaf07de4507df76e7813ed7 upstream. Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman --- arch/alpha/kernel/osf_sys.c | 23 +-- 1

[PATCH 4.9 47/63] sys: dont hold uts_sem while accessing userspace memory

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jann Horn commit 42a0cc3478584d4d63f68f2f5af021ddbea771fa upstream. Holding uts_sem as a writer while accessing userspace memory allows a namespace admin to stall all processes that attempt to

[PATCH 4.9 46/63] osf_getdomainname(): use copy_to_user()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Al Viro commit 9ba3eb5103cf56f0daaf07de4507df76e7813ed7 upstream. Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman --- arch/alpha/kernel/osf_sys.c | 23 +-- 1

[PATCH 4.9 47/63] sys: dont hold uts_sem while accessing userspace memory

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jann Horn commit 42a0cc3478584d4d63f68f2f5af021ddbea771fa upstream. Holding uts_sem as a writer while accessing userspace memory allows a namespace admin to stall all processes that attempt to

[PATCH 4.9 44/63] iommu/vt-d: Add definitions for PFSID

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jacob Pan commit 0f725561e168485eff7277d683405c05b192f537 upstream. When SRIOV VF device IOTLB is invalidated, we need to provide the PF source ID such that IOMMU hardware can gauge the depth

[PATCH 4.9 45/63] iommu/vt-d: Fix dev iotlb pfsid use

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jacob Pan commit 1c48db44924298ad0cb5a6386b88017539be8822 upstream. PFSID should be used in the invalidation descriptor for flushing device IOTLBs on SRIOV VFs. Signed-off-by: Jacob Pan Cc:

[PATCH 4.9 44/63] iommu/vt-d: Add definitions for PFSID

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jacob Pan commit 0f725561e168485eff7277d683405c05b192f537 upstream. When SRIOV VF device IOTLB is invalidated, we need to provide the PF source ID such that IOMMU hardware can gauge the depth

[PATCH 4.9 45/63] iommu/vt-d: Fix dev iotlb pfsid use

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jacob Pan commit 1c48db44924298ad0cb5a6386b88017539be8822 upstream. PFSID should be used in the invalidation descriptor for flushing device IOTLBs on SRIOV VFs. Signed-off-by: Jacob Pan Cc:

kselftests for memory.oom.group

Here is the third version of the patchset. Changes since the last patchset: - Updated commit message of first patch to clarify fixes - Add ack from Roman There should be no code changes since the last patchset. Let me know if any improvements can be made, and thanks for your time! -Jay

kselftests for memory.oom.group

Here is the third version of the patchset. Changes since the last patchset: - Updated commit message of first patch to clarify fixes - Add ack from Roman There should be no code changes since the last patchset. Let me know if any improvements can be made, and thanks for your time! -Jay

[PATCH 4.9 41/63] Replace magic for trusting the secondary keyring with #define

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Yannik Sembritzki commit 817aef260037f33ee0f44c17fe341323d3aebd6d upstream. Replace the use of a magic number that indicates that verify_*_signature() should use the secondary keyring with a

[PATCH 4.9 41/63] Replace magic for trusting the secondary keyring with #define

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Yannik Sembritzki commit 817aef260037f33ee0f44c17fe341323d3aebd6d upstream. Replace the use of a magic number that indicates that verify_*_signature() should use the secondary keyring with a

[PATCH 4.9 40/63] ARM: tegra: Fix Tegra30 Cardhu PCA954x reset

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jon Hunter commit 6e1811900b6fe6f2b4665dba6bd6ed32c6b98575 upstream. On all versions of Tegra30 Cardhu, the reset signal to the NXP PCA9546 I2C mux is connected to the Tegra GPIO BB0.

[PATCH 4.9 43/63] mm/tlb: Remove tlb_remove_table() non-concurrent condition

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Peter Zijlstra commit a6f572084fbee8b30f91465f4a085d7a90901c57 upstream. Will noted that only checking mm_users is incorrect; we should also check mm_count in order to cover CPUs that have a

[PATCH 4.9 40/63] ARM: tegra: Fix Tegra30 Cardhu PCA954x reset

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jon Hunter commit 6e1811900b6fe6f2b4665dba6bd6ed32c6b98575 upstream. On all versions of Tegra30 Cardhu, the reset signal to the NXP PCA9546 I2C mux is connected to the Tegra GPIO BB0.

[PATCH 4.9 43/63] mm/tlb: Remove tlb_remove_table() non-concurrent condition

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Peter Zijlstra commit a6f572084fbee8b30f91465f4a085d7a90901c57 upstream. Will noted that only checking mm_users is incorrect; we should also check mm_count in order to cover CPUs that have a

[PATCH v3 1/2] Fix cg_read_strcmp()

From: Jay Kamat Fix a couple issues with cg_read_strcmp(), to improve correctness of cgroup tests - Fix cg_read_strcmp() always returning 0 for empty "needle" strings. Previously, this function read to a size = 1 buffer when comparing against empty strings, which would lead to cg_read_strcmp()

[PATCH v3 2/2] Add tests for memory.oom.group

From: Jay Kamat Add tests for memory.oom.group for the following cases: - Killing all processes in a leaf cgroup, but leaving the parent untouched - Killing all processes in a parent and leaf cgroup - Keeping processes marked by OOM_SCORE_ADJ_MIN alive when considered for being killed by the

[PATCH v3 1/2] Fix cg_read_strcmp()

From: Jay Kamat Fix a couple issues with cg_read_strcmp(), to improve correctness of cgroup tests - Fix cg_read_strcmp() always returning 0 for empty "needle" strings. Previously, this function read to a size = 1 buffer when comparing against empty strings, which would lead to cg_read_strcmp()

[PATCH v3 2/2] Add tests for memory.oom.group

From: Jay Kamat Add tests for memory.oom.group for the following cases: - Killing all processes in a leaf cgroup, but leaving the parent untouched - Killing all processes in a parent and leaf cgroup - Keeping processes marked by OOM_SCORE_ADJ_MIN alive when considered for being killed by the

[PATCH 4.9 07/63] libertas: fix suspend and resume for SDIO connected cards

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Daniel Mack commit 7444a8092906ed44c09459780c56ba57043e39b1 upstream. Prior to commit 573185cc7e64 ("mmc: core: Invoke sdio func driver's PM callbacks from the sdio bus"), the MMC core used to

[PATCH 4.9 08/63] mailbox: xgene-slimpro: Fix potential NULL pointer dereference

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Gustavo A. R. Silva commit 3512a18cbd8d09e22a790540cb9624c3c49827ba upstream. There is a potential execution path in which function platform_get_resource() returns NULL. If this happens, we

[PATCH 4.9 31/63] uprobes: Use synchronize_rcu() not synchronize_sched()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit 016f8ffc48cb01d1e7701649c728c5d2e737d295 upstream. While debugging another bug, I was looking at all the synchronize*() functions being used in kernel/trace, and

[PATCH 4.9 05/63] spi: spi-fsl-dspi: Fix imprecise abort on VF500 during probe

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Krzysztof Kozlowski commit d8ffee2f551a627ffb7b216e2da322cb9a037f77 upstream. Registers of DSPI should not be accessed before enabling its clock. On Toradex Colibri VF50 on Iris carrier board

[PATCH 4.9 00/63] 4.9.126-stable review

This is the start of the stable review cycle for the 4.9.126 release. There are 63 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun Sep 9 21:09:58 UTC 2018. Anything

[PATCH 4.9 06/63] drm/i915/userptr: reject zero user_size

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Matthew Auld commit c11c7bfd213495784b22ef82a69b6489f8d0092f upstream. Operating on a zero sized GEM userptr object will lead to explosions. Fixes: 5cc9ed4b9a7a ("drm/i915: Introduce mapping

[PATCH 4.9 07/63] libertas: fix suspend and resume for SDIO connected cards

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Daniel Mack commit 7444a8092906ed44c09459780c56ba57043e39b1 upstream. Prior to commit 573185cc7e64 ("mmc: core: Invoke sdio func driver's PM callbacks from the sdio bus"), the MMC core used to

[PATCH 4.9 08/63] mailbox: xgene-slimpro: Fix potential NULL pointer dereference

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Gustavo A. R. Silva commit 3512a18cbd8d09e22a790540cb9624c3c49827ba upstream. There is a potential execution path in which function platform_get_resource() returns NULL. If this happens, we

[PATCH 4.9 31/63] uprobes: Use synchronize_rcu() not synchronize_sched()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit 016f8ffc48cb01d1e7701649c728c5d2e737d295 upstream. While debugging another bug, I was looking at all the synchronize*() functions being used in kernel/trace, and

[PATCH 4.9 05/63] spi: spi-fsl-dspi: Fix imprecise abort on VF500 during probe

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Krzysztof Kozlowski commit d8ffee2f551a627ffb7b216e2da322cb9a037f77 upstream. Registers of DSPI should not be accessed before enabling its clock. On Toradex Colibri VF50 on Iris carrier board

[PATCH 4.9 00/63] 4.9.126-stable review

This is the start of the stable review cycle for the 4.9.126 release. There are 63 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun Sep 9 21:09:58 UTC 2018. Anything

[PATCH 4.9 06/63] drm/i915/userptr: reject zero user_size

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Matthew Auld commit c11c7bfd213495784b22ef82a69b6489f8d0092f upstream. Operating on a zero sized GEM userptr object will lead to explosions. Fixes: 5cc9ed4b9a7a ("drm/i915: Introduce mapping

<    1   2   3   4   5   6   7   8   9   10   >