[PATCH 4.9 41/75] net: bridge: fix early call to br_stp_change_bridge_id and plug newlink leaks

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Nikolay Aleksandrov [ Upstream commit 84aeb437ab98a2bce3d4b2111c79723aedfceb33 ] The early call to br_stp_change_bridge_id in bridge's newlink can cause a memory leak if an error occurs

[PATCH 4.9 40/75] ipv4: Fix use-after-free when flushing FIB tables

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Ido Schimmel [ Upstream commit b4681c2829e24943aadd1a7bb3a30d41d0a20050 ] Since commit 0ddcf43d5d4a ("ipv4: FIB Local/MAIN table collapse") the local table uses the same trie allocated for

[PATCH 4.9 49/75] net/mlx5e: Fix possible deadlock of VXLAN lock

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Gal Pressman [ Upstream commit 6323514116404cc651df1b7fffa1311ddf8ce647 ] mlx5e_vxlan_lookup_port is called both from mlx5e_add_vxlan_port (user context) and mlx5e_features_check (softirq),

[PATCH 4.9 48/75] net/mlx5e: Fix features check of IPv6 traffic

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Gal Pressman [ Upstream commit 2989ad1ec03021ee6d2193c35414f1d970a243de ] The assumption that the next header field contains the transport protocol is wrong for IPv6 packets with extension

[PATCH 4.9 47/75] net/mlx5: Fix rate limit packet pacing naming and struct

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Eran Ben Elisha [ Upstream commit 37e92a9d4fe38dc3e7308913575983a6a088c8d4 ] In mlx5_ifc, struct size was not complete, and thus driver was sending garbage after the last defined field. Fixed

[PATCH 4.9 56/75] s390/qeth: update takeover IPs after configuration change

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Julian Wiedmann [ Upstream commit 02f510f326501470348a5df341e8232c3497 ] Any modification to the takeover IP-ranges requires that we re-evaluate which IP addresses are takeover-eligible.

[PATCH 4.9 35/75] tg3: Fix rx hang on MTU change with 5717/5719

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Brian King [ Upstream commit 748a240c589824e9121befb1cba5341c319885bc ] This fixes a hang issue seen when changing the MTU size from 1500 MTU to 9000 MTU on both 5717 and 5719 chips. In

[PATCH 4.9 54/75] s390/qeth: dont apply takeover changes to RXIP

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Julian Wiedmann [ Upstream commit b22d73d6689fd902a66c08ebe71ab2f3b351e22f ] When takeover is switched off, current code clears the 'TAKEOVER' flag on all IPs. But the flag is also used for

[PATCH 4.9 53/75] s390/qeth: apply takeover changes when mode is toggled

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Julian Wiedmann [ Upstream commit 7fbd9493f0eeae8cef58300505a9ef5c8fce6313 ] Just as for an explicit enable/disable, toggling the takeover mode also requires that the IP addresses get

[PATCH 4.9 36/75] net: ipv4: fix for a race condition in raw_sendmsg

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Mohamed Ghannam [ Upstream commit 8f659a03a0ba9289b9aeb9b4470e6fb263d6f483 ] inet->hdrincl is racy, and could lead to uninitialized stack pointer usage, so its value should be read only once.

[PATCH 4.9 61/75] USB: serial: ftdi_sio: add id for Airbus DS P8GR

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Max Schulze commit c6a36ad383559a60a249aa6016cebf3cb8b6c485 upstream. Add AIRBUS_DS_P8GR device IDs to ftdi_sio driver. Signed-off-by: Max Schulze Signed-off-by: Johan Hovold Signed-off-by:

[PATCH 4.9 60/75] usbip: vhci: stop printing kernel pointer addresses in messages

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Shuah Khan commit 8272d099d05f7ab2776cf56a2ab9f9443be18907 upstream. Remove and/or change debug, info. and error messages to not print kernel pointer addresses. Signed-off-by: Shuah Khan

[PATCH 4.9 63/75] USB: serial: option: add support for Telit ME910 PID 0x1101

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Daniele Palmas commit 08933099e6404f588f81c2050bfec7313e06eeaf upstream. This patch adds support for PID 0x1101 of Telit ME910. Signed-off-by: Daniele Palmas Signed-off-by: Johan Hovold

[PATCH 4.9 59/75] usbip: stub: stop printing kernel pointer addresses in messages

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Shuah Khan commit 248a22044366f588d46754c54dfe29ffe4f8b4df upstream. Remove and/or change debug, info. and error messages to not print kernel pointer addresses. Signed-off-by: Shuah Khan

[PATCH 4.9 75/75] tty: fix tty_ldisc_receive_buf() documentation

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Johan Hovold commit e7e51dcf3b8a5f65c5653a054ad57eb2492a90d0 upstream. The tty_ldisc_receive_buf() helper returns the number of bytes processed so drop the bogus "not" from the kernel doc

[PATCH 4.9 25/75] ipv6: mcast: better catch silly mtu values

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit b9b312a7a451e9c098921856e7cfbc201120e1a7 ] syzkaller reported crashes in IPv6 stack [1] Xin Long found that lo MTU was set to silly values. IPv6 stack reacts

[PATCH 4.9 74/75] n_tty: fix EXTPROC vs ICANON interaction with TIOCINQ (aka FIONREAD)

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Linus Torvalds commit 966031f340185eddd05affcf72b740549f056348 upstream. We added support for EXTPROC back in 2010 in commit 26df6d13406d ("tty: Add EXTPROC support for LINEMODE") and the

[PATCH 4.9 66/75] usb: add RESET_RESUME for ELSA MicroLink 56K

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Oliver Neukum commit b9096d9f15c142574ebebe8fbb137012bb9d99c2 upstream. This modem needs this quirk to operate. It produces timeouts when resumed without reset. Signed-off-by: Oliver Neukum

[PATCH 4.9 31/75] ptr_ring: add barriers

4.9-stable review patch. If anyone has any objections, please let me know. -- From: "Michael S. Tsirkin" [ Upstream commit a8ceb5dbfde1092b466936bca0ff3be127ecf38e ] Users of ptr_ring expect that it's safe to give the data structure a pointer and have it be available to

[PATCH 4.9 32/75] RDS: Check cmsg_len before dereferencing CMSG_DATA

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Avinash Repaka [ Upstream commit 14e138a86f6347c6199f610576d2e11c03bec5f0 ] RDS currently doesn't check if the length of the control message is large enough to hold the required data, before

[PATCH 4.9 68/75] usb: xhci: Add XHCI_TRUST_TX_LENGTH for Renesas uPD720201

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Daniel Thompson commit da99706689481717998d1d48edd389f339eea979 upstream. When plugging in a USB webcam I see the following message: xhci_hcd :04:00.0: WARN Successful completion on short

[PATCH 4.9 30/75] net: reevalulate autoflowlabel setting after sysctl setting

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Shaohua Li [ Upstream commit 513674b5a2c9c7a67501506419da5c3c77ac6f08 ] sysctl.ip6.auto_flowlabels is default 1. In our hosts, we set it to 2. If sockopt doesn't set autoflowlabel, outcome

[PATCH 4.9 70/75] timers: Invoke timer_start_debug() where it makes sense

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit fd45bb77ad682be728d1002431d77b8c73342836 upstream. The timer start debug function is called before the proper timer base is set. As a consequence the trace data contains

[PATCH 4.9 72/75] nohz: Prevent a timer interrupt storm in tick_nohz_stop_sched_tick()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 5d62c183f9e9df1deeea0906d099a94e8a43047a upstream. The conditions in irq_exit() to invoke tick_nohz_irq_exit() which subsequently invokes tick_nohz_stop_sched_tick()

[PATCH 4.9 33/75] tcp_bbr: record "full bw reached" decision in new full_bw_reached bit

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Neal Cardwell [ Upstream commit c589e69b508d29ed8e644dfecda453f71c02ec27 ] This commit records the "full bw reached" decision in a new full_bw_reached bit. This is a pure refactor that does

[PATCH 4.9 73/75] x86/smpboot: Remove stale TLB flush invocations

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 322f8b8b340c824aef891342b0f5795d15e11562 upstream. smpboot_setup_warm_reset_vector() and smpboot_restore_warm_reset_vector() invoke local_flush_tlb() for no obvious

[PATCH 4.9 71/75] timers: Reinitialize per cpu bases on hotplug

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 26456f87aca7157c057de65c9414b37f1ab881d1 upstream. The timer wheel bases are not (re)initialized on CPU hotplug. That leaves them with a potentially stale clk and

[PATCH 4.9 69/75] timers: Use deferrable base independent of base::nohz_active

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Anna-Maria Gleixner commit ced6d5c11d3e7b342f1a80f908e6756ebd4b8ddd upstream. During boot and before base::nohz_active is set in the timer bases, deferrable timers are enqueued into the

[PATCH 4.9 67/75] USB: Fix off by one in type-specific length check of BOS SSP capability

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Mathias Nyman commit 07b9f12864d16c3a861aef4817eb1efccbc5d0e6 upstream. USB 3.1 devices are not detected as 3.1 capable since 4.15-rc3 due to a off by one in commit 81cf4a45360f ("USB: core:

[PATCH 4.14 010/146] x86/mm/pti: Allow NX poison to be set in p4d/pgd

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Dave Hansen commit 1c4de1ff4fe50453b968579ee86fac3da80dd783 upstream. With PAGE_TABLE_ISOLATION the user portion of the kernel page tables is poisoned with the NX bit so if the entry code

[PATCH 4.14 000/146] 4.14.11-stable review

This is the start of the stable review cycle for the 4.14.11 release. There are 146 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed Jan 3 14:00:12 UTC 2018. Anything

[PATCH 4.14 015/146] x86/mm/pti: Share cpu_entry_area with user space page tables

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Andy Lutomirski commit f7cfbee91559ca7e3e961a00ffac921208a115ad upstream. Share the cpu entry area so the user space and kernel space page tables have the same P4D page. Signed-off-by: Andy

[PATCH 4.14 017/146] x86/mm/pti: Share entry text PMD

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 6dc72c3cbca0580642808d677181cad4c6433893 upstream. Share the entry text PMD of the kernel mapping with the user space mapping. If large pages are enabled this is a

[PATCH 4.14 016/146] x86/entry: Align entry text section to PMD boundary

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 2f7412ba9c6af5ab16bdbb4a3fdb1dcd2b4fd3c2 upstream. The (irq)entry text must be visible in the user space page tables. To allow simple PMD based sharing, make the entry

[PATCH 4.14 014/146] x86/mm/pti: Force entry through trampoline when PTI active

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 8d4b067895791ab9fdb1aadfc505f64d71239dd2 upstream. Force the entry through the trampoline only when PTI is active. Otherwise go through the normal entry code.

[PATCH 4.14 018/146] x86/mm/pti: Map ESPFIX into user space

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Andy Lutomirski commit 4b6bbe95b87966ba08999574db65c93c5e925a36 upstream. Map the ESPFIX pages into user space when PTI is enabled. Signed-off-by: Andy Lutomirski Signed-off-by: Thomas

[PATCH 4.14 012/146] x86/mm/pti: Populate user PGD

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Dave Hansen commit fc2fbc8512ed08d1de7720936fd7d2e4ce02c3a2 upstream. In clone_pgd_range() copy the init user PGDs which cover the kernel half of the address space, so a process has all the

[PATCH 4.14 019/146] x86/cpu_entry_area: Add debugstore entries to cpu_entry_area

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 10043e02db7f8a4161f76434931051e7d797a5f6 upstream. The Intel PEBS/BTS debug store is a design trainwreck as it expects virtual addresses which must be visible in any

[PATCH 4.14 022/146] x86/pti: Put the LDT in its own PGD if PTI is on

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Andy Lutomirski commit f55f0501cbf65ec41cca5058513031b711730b1d upstream. With PTI enabled, the LDT must be mapped in the usermode tables somewhere. The LDT is per process, i.e. per mm. An

[PATCH 4.14 020/146] x86/events/intel/ds: Map debug buffers in cpu_entry_area

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Hugh Dickins commit c1961a4631daef4aeabee8e368b1b13e8f173c91 upstream. The BTS and PEBS buffers both have their virtual addresses programmed into the hardware. This means that any access to

[PATCH 4.14 025/146] x86/mm: Abstract switching CR3

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Dave Hansen commit 48e111982cda033fec832c6b0592c2acedd85d04 upstream. In preparation to adding additional PCID flushing, abstract the loading of a new ASID into CR3. [ PeterZ: Split out from

[PATCH 4.14 004/146] x86/cpufeatures: Add X86_BUG_CPU_INSECURE

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit a89f040fa34ec9cd682aed98b8f04e3c47d998bd upstream. Many x86 CPUs leak information to user space due to missing isolation of user space and kernel space page tables.

[PATCH 4.14 003/146] tracing: Fix crash when it fails to alloc ring buffer

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Jing Xia commit 24f2aaf952ee0b59f31c3a18b8b36c9e3d3c2cf5 upstream. Double free of the ring buffer happens when it fails to alloc new ring buffer instance for max_buffer if TRACER_MAX_TRACE is

[PATCH 4.14 006/146] x86/mm/pti: Prepare the x86/entry assembly code for entry/exit CR3 switching

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Dave Hansen commit 8a09317b895f073977346779df52f67c1056d81d upstream. PAGE_TABLE_ISOLATION needs to switch to a different CR3 value when it enters the kernel and switch back when it exits.

[PATCH 4.14 009/146] x86/mm/pti: Add mapping helper functions

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Dave Hansen commit 61e9b3671007a5da8127955a1a3bda7e0d5f42e8 upstream. Add the pagetable helper functions do manage the separate user space page tables. [ tglx: Split out from the big combo

[PATCH 4.14 041/146] ASoC: da7218: fix fix child-node lookup

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Johan Hovold commit bc6476d6c1edcb9b97621b5131bd169aa81f27db upstream. Fix child-node lookup during probe, which ended up searching the whole device tree depth-first starting at the parent

[PATCH 4.14 007/146] x86/mm/pti: Add infrastructure for page table isolation

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit aa8c6248f8c75acfd610fe15d8cae23cf70d9d09 upstream. Add the initial files for kernel page table isolation, with a minimal init function and the boot time detection for

[PATCH 4.14 028/146] x86/mm: Use INVPCID for __native_flush_tlb_single()

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Dave Hansen commit 6cff64b8607f89f50498055a20e45754b0c1 upstream. This uses INVPCID to shoot down individual lines of the user mapping instead of marking the entire user map as invalid.

[PATCH 4.14 039/146] ASoC: codecs: msm8916-wcd: Fix supported formats

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Srinivas Kandagatla commit 51f493ae71adc2c49a317a13c38e54e1cdf46005 upstream. This codec is configurable for only 16 bit and 32 bit samples, so reflect this in the supported formats also

[PATCH 4.14 037/146] ring-buffer: Do no reuse reader page if still in use

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit ae415fa4c5248a8cf4faabd5a3c20576cb1ad607 upstream. To free the reader page that is allocated with ring_buffer_alloc_read_page(), ring_buffer_free_read_page()

[PATCH 4.14 042/146] ASoC: fsl_ssi: AC97 ops need regmap, clock and cleaning up on failure

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Maciej S. Szmigiero commit 695b78b548d8a26288f041e907ff17758df9e1d5 upstream. AC'97 ops (register read / write) need SSI regmap and clock, so they have to be set after them. We also need to

[PATCH 4.14 046/146] IB/hfi: Only read capability registers if the capability exists

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Michael J. Ruhl commit 4c009af473b2026caaa26107e34d7cc68dad7756 upstream. During driver init, various registers are saved to allow restoration after an FLR or gen3 bump. Some of these

[PATCH 4.14 045/146] gpio: fix "gpio-line-names" property retrieval

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Christophe Leroy commit 822703354774ec935169cbbc8d503236bcb54fda upstream. Following commit 9427ecbed46cc ("gpio: Rework of_gpiochip_set_names() to use device property accessors"),

[PATCH 4.14 051/146] ALSA: hda - Add MIC_NO_PRESENCE fixup for 2 HP machines

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Hui Wang commit 322f74ede933b3e2cb78768b6a6fdbfbf478a0c1 upstream. There is a headset jack on the front panel, when we plug a headset into it, the headset mic can't trigger unsol events, and

[PATCH 4.14 047/146] IB/mlx5: Serialize access to the VMA list

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Majd Dibbiny commit ad9a3668a434faca1339789ed2f043d679199309 upstream. User-space applications can do mmap and munmap directly at any time. Since the VMA list is not protected with a mutex,

[PATCH 4.14 050/146] ALSA: hda: Drop useless WARN_ON()

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Takashi Iwai commit a36c2638380c0a4676647a1f553b70b20d3ebce1 upstream. Since the commit 97cc2ed27e5a ("ALSA: hda - Fix yet another i915 pointer leftover in error path") cleared hdac_acomp

[PATCH 4.14 060/146] ipv6: mcast: better catch silly mtu values

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit b9b312a7a451e9c098921856e7cfbc201120e1a7 ] syzkaller reported crashes in IPv6 stack [1] Xin Long found that lo MTU was set to silly values. IPv6 stack reacts

[PATCH 4.14 057/146] block: dont let passthrough IO go into .make_request_fn()

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Ming Lei commit 14cb0dc6479dc5ebc63b3a459a5d89a2f1b39fed upstream. Commit a8821f3f3("block: Improvements to bounce-buffer handling") tries to make sure that the bio to .make_request_fn won't

[PATCH 4.14 054/146] ALSA: hda - Fix missing COEF init for ALC225/295/299

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Takashi Iwai commit 44be77c590f381bc629815ac789b8b15ecc4ddcf upstream. There was a long-standing problem on HP Spectre X360 with Kabylake where it lacks of the front speaker output in some

[PATCH 4.14 052/146] ALSA: hda - change the location for one mic on a Lenovo machine

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Hui Wang commit 8da5bbfc7cbba909f4f32d5e1dda3750baa5d853 upstream. There are two front mics on this machine, and current driver assign the same name Mic to both of them, but pulseaudio can't

[PATCH 4.14 056/146] block: fix blk_rq_append_bio

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Jens Axboe commit 0abc2a10389f0c9070f76ca906c7382788036b93 upstream. Commit caa4b02476e3(blk-map: call blk_queue_bounce from blk_rq_append_bio) moves blk_queue_bounce() into

[PATCH 4.14 065/146] net: reevalulate autoflowlabel setting after sysctl setting

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Shaohua Li [ Upstream commit 513674b5a2c9c7a67501506419da5c3c77ac6f08 ] sysctl.ip6.auto_flowlabels is default 1. In our hosts, we set it to 2. If sockopt doesn't set autoflowlabel, outcome

[PATCH 4.14 062/146] net: igmp: Use correct source address on IGMPv3 reports

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Kevin Cernekee [ Upstream commit a46182b00290839fa3fa159d54fd3237bd8669f0 ] Closing a multicast socket after the final IPv4 address is deleted from an interface can generate a membership

[PATCH 4.14 063/146] netlink: Add netns check on taps

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Kevin Cernekee [ Upstream commit 93c647643b48f0131f02e45da3bd367d80443291 ] Currently, a nlmon link inside a child namespace can observe systemwide netlink activity. Filter the traffic so

[PATCH 4.14 031/146] x86/mm/pti: Add Kconfig

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Dave Hansen commit 385ce0ea4c078517fa51c261882c4e72fba53005 upstream. Finally allow CONFIG_PAGE_TABLE_ISOLATION to be enabled. PARAVIRT generally requires that the kernel not manage its own

[PATCH 4.14 076/146] s390/qeth: update takeover IPs after configuration change

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Julian Wiedmann [ Upstream commit 02f510f326501470348a5df341e8232c3497 ] Any modification to the takeover IP-ranges requires that we re-evaluate which IP addresses are takeover-eligible.

[PATCH 4.14 077/146] net: ipv4: fix for a race condition in raw_sendmsg

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Mohamed Ghannam [ Upstream commit 8f659a03a0ba9289b9aeb9b4470e6fb263d6f483 ] inet->hdrincl is racy, and could lead to uninitialized stack pointer usage, so its value should be read only

[PATCH 4.14 034/146] x86/mm/dump_pagetables: Allow dumping current pagetables

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit a4b51ef6552c704764684cef7e753162dc87c5fa upstream. Add two debugfs files which allow to dump the pagetable of the current task. current_kernel dumps the regular page

[PATCH 4.14 067/146] RDS: Check cmsg_len before dereferencing CMSG_DATA

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Avinash Repaka [ Upstream commit 14e138a86f6347c6199f610576d2e11c03bec5f0 ] RDS currently doesn't check if the length of the control message is large enough to hold the required data, before

[PATCH 4.14 081/146] ip6_gre: fix device features for ioctl setup

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Alexey Kodanev [ Upstream commit e5a9336adb317db55eb3fe8200856096f3c71109 ] When ip6gre is created using ioctl, its features, such as scatter-gather, GSO and tx-checksumming will be turned

[PATCH 4.14 079/146] sctp: Replace use of sockets_allocated with specified macro.

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Tonghao Zhang [ Upstream commit 8cb38a602478e9f806571f6920b0a3298aabf042 ] The patch(180d8cd942ce) replaces all uses of struct sock fields' memory_pressure, memory_allocated,

[PATCH 4.14 035/146] x86/ldt: Make the LDT mapping RO

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 9f5cb6b32d9e0a3a7453222baaf15664d92adbf2 upstream. Now that the LDT mapping is in a known area when PAGE_TABLE_ISOLATION is enabled its a primary target for attacks, if

[PATCH 4.14 090/146] net/mlx5e: Fix features check of IPv6 traffic

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Gal Pressman [ Upstream commit 2989ad1ec03021ee6d2193c35414f1d970a243de ] The assumption that the next header field contains the transport protocol is wrong for IPv6 packets with extension

[PATCH 4.14 083/146] net: bridge: fix early call to br_stp_change_bridge_id and plug newlink leaks

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Nikolay Aleksandrov [ Upstream commit 84aeb437ab98a2bce3d4b2111c79723aedfceb33 ] The early call to br_stp_change_bridge_id in bridge's newlink can cause a memory leak if an error occurs

[PATCH 4.14 086/146] sock: free skb in skb_complete_tx_timestamp on error

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Willem de Bruijn [ Upstream commit 35b99dffc3f710cafceee6c8c6ac6a98eb2cb4bf ] skb_complete_tx_timestamp must ingest the skb it is passed. Call kfree_skb if the skb cannot be enqueued.

[PATCH 4.14 092/146] net/mlx5e: Prevent possible races in VXLAN control flow

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Gal Pressman [ Upstream commit 0c1cc8b2215f5122ca614b5adca60346018758c3 ] When calling add/remove VXLAN port, a lock must be held in order to prevent race scenarios when more than one

[PATCH 4.14 088/146] net/mlx5: Fix rate limit packet pacing naming and struct

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Eran Ben Elisha [ Upstream commit 37e92a9d4fe38dc3e7308913575983a6a088c8d4 ] In mlx5_ifc, struct size was not complete, and thus driver was sending garbage after the last defined field.

[PATCH 4.14 068/146] tcp_bbr: record "full bw reached" decision in new full_bw_reached bit

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Neal Cardwell [ Upstream commit c589e69b508d29ed8e644dfecda453f71c02ec27 ] This commit records the "full bw reached" decision in a new full_bw_reached bit. This is a pure refactor that does

[PATCH 4.14 091/146] net/mlx5e: Add refcount to VXLAN structure

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Gal Pressman [ Upstream commit 23f4cc2cd9ed92570647220aca60d0197d8c1fa9 ] A refcount mechanism must be implemented in order to prevent unwanted scenarios such as: - Open an IPv4 VXLAN

[PATCH 4.14 085/146] net: phy: micrel: ksz9031: reconfigure autoneg after phy autoneg workaround

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Grygorii Strashko [ Upstream commit c1a8d0a3accf64a014d605e6806ce05d1c17adf1 ] Under some circumstances driver will perform PHY reset in ksz9031_read_status() to fix autoneg failure case

[PATCH 4.14 098/146] sctp: make sure stream nums can match optlen in sctp_setsockopt_reset_streams

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit 2342b8d95bcae5946e1b9b8d58645f37500ef2e7 ] Now in sctp_setsockopt_reset_streams, it only does the check optlen < sizeof(*params) for optlen. But it's not enough,

[PATCH 4.14 069/146] tcp md5sig: Use skbs saddr when replying to an incoming segment

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Christoph Paasch [ Upstream commit 30791ac41927ebd3e75486f9504b6d2280463bf0 ] The MD5-key that belongs to a connection is identified by the peer's IP-address. When we are in

[PATCH 4.14 096/146] net: dsa: bcm_sf2: Clear IDDQ_GLOBAL_PWR bit for PHY

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Florian Fainelli [ Upstream commit 4b52d010113e11006a389f2a8315167ede9e0b10 ] The PHY on BCM7278 has an additional bit that needs to be cleared: IDDQ_GLOBAL_PWR, without doing this, the PHY

linux-next: Signed-off-by missing for commit in the iversion tree

Hi Jeff, Commit e9f12c2601ee ("ima: Use i_version only when filesystem supports it") is missing a Signed-off-by from its committer. -- Cheers, Stephen Rothwell

[PATCH 4.14 097/146] s390/qeth: fix error handling in checksum cmd callback

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Julian Wiedmann [ Upstream commit ad3cbf61332914711e5f506972b1dc9af8d62146 ] Make sure to check both return code fields before processing the response. Otherwise we risk operating on invalid

[PATCH 4.14 093/146] net/mlx5: Fix error flow in CREATE_QP command

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Moni Shoua [ Upstream commit dbff26e44dc3ec4de6578733b054a0114652a764 ] In error flow, when DESTROY_QP command should be executed, the wrong mailbox was set with data, not the one that is

[PATCH 4.14 102/146] net: phy: marvell: Limit 88m1101 autoneg errata to 88E1145 as well.

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Zhao Qiang [ Upstream commit c505873eaece2b4aefd07d339dc7e1400e0235ac ] 88E1145 also need this autoneg errata. Fixes: f2899788353c ("net: phy: marvell: Limit errata to 88m1101")

[PATCH 4.14 101/146] tcp: fix potential underestimation on rcv_rtt

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Wei Wang [ Upstream commit 9ee11bd03cb1a5c3ca33c2bb70e7ed325f68890f ] When ms timestamp is used, current logic uses 1us in tcp_rcv_rtt_update() when the real rcv_rtt is within 1 - 999us.

[PATCH 4.14 070/146] tg3: Fix rx hang on MTU change with 5717/5719

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Brian King [ Upstream commit 748a240c589824e9121befb1cba5341c319885bc ] This fixes a hang issue seen when changing the MTU size from 1500 MTU to 9000 MTU on both 5717 and 5719 chips. In

[PATCH 4.14 071/146] tcp_bbr: reset full pipe detection on loss recovery undo

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Neal Cardwell [ Upstream commit 2f6c498e4f15d27852c04ed46d804a39137ba364 ] Fix BBR so that upon notification of a loss recovery undo BBR resets the full pipe detection (STARTUP exit) state

[PATCH 4.14 104/146] tcp: refresh tcp_mstamp from timers callbacks

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 4688eb7cf3ae2c2721d1dacff5c1384cba47d176 ] Only the retransmit timer currently refreshes tcp_mstamp We should do the same for delayed acks and keepalives.

[PATCH 4.14 072/146] tcp_bbr: reset long-term bandwidth sampling on loss recovery undo

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Neal Cardwell [ Upstream commit 600647d467c6d04b3954b41a6ee1795b5ae00550 ] Fix BBR so that upon notification of a loss recovery undo BBR resets long-term bandwidth sampling. Under high

[PATCH 4.14 074/146] s390/qeth: dont apply takeover changes to RXIP

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Julian Wiedmann [ Upstream commit b22d73d6689fd902a66c08ebe71ab2f3b351e22f ] When takeover is switched off, current code clears the 'TAKEOVER' flag on all IPs. But the flag is also used for

[PATCH 4.14 120/146] usbip: stub: stop printing kernel pointer addresses in messages

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Shuah Khan commit 248a22044366f588d46754c54dfe29ffe4f8b4df upstream. Remove and/or change debug, info. and error messages to not print kernel pointer addresses. Signed-off-by: Shuah Khan

[PATCH 4.14 119/146] usbip: prevent leaking socket pointer address in messages

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Shuah Khan commit 90120d15f4c397272aaf41077960a157fc4212bf upstream. usbip driver is leaking socket pointer address in messages. Remove the messages that aren't useful and print sockfd in the

[PATCH 4.14 107/146] net: sched: fix static key imbalance in case of ingress/clsact_init error

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Jiri Pirko [ Upstream commit b59e6979a86384e68b0ab6ffeab11f0034fba82d ] Move static key increments to the beginning of the init function so they pair 1:1 with decrements in

[PATCH 4.14 121/146] usbip: vhci: stop printing kernel pointer addresses in messages

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Shuah Khan commit 8272d099d05f7ab2776cf56a2ab9f9443be18907 upstream. Remove and/or change debug, info. and error messages to not print kernel pointer addresses. Signed-off-by: Shuah Khan

[PATCH 4.14 118/146] usbip: fix usbip bind writing random string after command in match_busid

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Juan Zea commit 544c4605acc5ae4afe7dd5914147947db182f2fb upstream. usbip bind writes commands followed by random string when writing to match_busid attribute in sysfs, caused by using full

[PATCH 4.14 116/146] skbuff: in skb_copy_ubufs unclone before releasing zerocopy

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Willem de Bruijn skb_copy_ubufs must unclone before it is safe to modify its skb_shared_info with skb_zcopy_clear. Commit b90ddd568792 ("skbuff: skb_copy_ubufs must release uarg even without

[PATCH 4.14 122/146] USB: chipidea: msm: fix ulpi-node lookup

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Johan Hovold commit 964728f9f407eca0b417fdf8e784b7a76979490c upstream. Fix child-node lookup during probe, which ended up searching the whole device tree depth-first starting at the parent

<    4   5   6   7   8   9   10   11   12   13   >