[PATCH 4.4 135/193] [media] em28xx: only use mt9v011 if camera support is enabled

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit 190b23b4eb997767afad186bd8c96badceabf39e upstream. In randconfig builds that select VIDEO_EM28XX_V4L2 and MEDIA_SUBDRV_AUTOSELECT, but not MEDIA_CAMERA_SUPPORT, we get a Kc

[PATCH 4.4 138/193] serial: 8250_mid: fix broken DMA dependency

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Heikki Krogerus commit 0ff4230584320b2153752ba54e2e8edbd6addf2c upstream. In order to enable HSU DMA PCI driver, the HSU DMA Engine must be enabled. This add a check for that. Reported-by: kbu

[PATCH 4.4 140/193] [media] hdpvr: hide unused variable

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit b97baa3e22e18dac42001e665cf27ad1211bf878 upstream. The i2c client pointer is only used when CONFIG_I2C is set, and otherwise produces a compile-time warning: drivers/media

[PATCH 4.4 143/193] wireless: cw1200: use __maybe_unused to hide pm functions_

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit 836856e3bd61d0644e5178a2c1b51d90459e2788 upstream. The cw1200 uses #ifdef to check for CONFIG_PM, but then uses SIMPLE_DEV_PM_OPS, which leaves the references out when CONF

[PATCH 4.4 150/193] power: bq27xxx_battery: mark some symbols __maybe_unused

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann Without the I2C driver, we get a few warnings: drivers/power/bq27xxx_battery.c:288:12: error: 'bq27xxx_regs' defined but not used [-Werror=unused-variable] static u8 *bq27xxx_re

[PATCH 4.4 145/193] dmaengine: zx: fix build warning

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Jun Nie commit 067fdeb2f391bfa071f741a2b3eb74b8ff3785cd upstream. Fix build warning that related to PAGE_SIZE. The maximum DMA length has nothing to do with PAGE_SIZE, just use a fix number for

[PATCH 4.4 148/193] ncpfs: fix unused variable warning

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Miklos Szeredi commit 9a232de4999666b2e8ea6775b2b0e3e4feb09b7a upstream. Without CONFIG_NCPFS_NLS the following warning is seen: fs/ncpfs/dir.c: In function 'ncp_hash_dentry': fs/ncpfs/dir.c:1

[PATCH 4.4 121/193] drm/vmwgfx: use *_32_bits() macros

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Paul Bolle commit 0e7c875d1ae9dcf4d8c6018a45e5529feaef8956 upstream. Use the upper_32_bits() macro instead of the four line equivalent that triggers a GCC warning on 32 bits x86: drivers/gp

[PATCH 4.4 119/193] tc1100-wmi: fix build warning when CONFIG_PM not enabled

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Colin Ian King commit 75d7e7d7a8f4966cb8b1da54a1c74fb2a97ae8fc upstream. Conditionally declare suspend_data on CONFIG_PM to avoid the following warning when CONFIG_OM is not enabled: drivers/p

[PATCH 4.4 154/193] usb: phy: msm add regulator dependency

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann On linux-4.4 and linux-4.9 we get a warning about an array that is never initialized when CONFIG_REGULATOR is disabled: drivers/usb/phy/phy-msm-usb.c: In function 'msm_otg_probe':

[PATCH 4.4 167/193] KVM: VMX: Make indirect call speculation safe

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Peter Zijlstra (cherry picked from commit c940a3fb1e2e9b7d03228ab28f375fb5a47ff699) Replace indirect call with CALL_NOSPEC. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixne

[PATCH 4.4 155/193] ncr5380: shut up gcc indentation warning

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann gcc-6 and higher warn about the way some loops are written in the ncr5380 driver: drivers/scsi/g_NCR5380.c: In function 'generic_NCR5380_pread': drivers/scsi/g_NCR5380.c:541:3: er

[PATCH 4.4 169/193] x86/nospec: Fix header guards names

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Borislav Petkov (cherry picked from commit 7a32fc51ca938e67974cbb9db31e1a43f98345a9) ... to adhere to the _ASM_X86_ naming scheme. No functional change. Signed-off-by: Borislav Petkov Signed

[PATCH 4.4 175/193] x86: Implement array_index_mask_nospec

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Dan Williams (cherry picked from commit babdde2698d482b6c0de1eab4f697cf5856c5859) array_index_nospec() uses a mask to sanitize user controllable array indexes, i.e. generate a 0 mask if 'index'

[PATCH 4.4 173/193] Documentation: Document array_index_nospec

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Mark Rutland (cherry picked from commit f84a56f73dddaeac1dba8045b007f742f61cd2da) Document the rationale and usage of the new array_index_nospec() helper. Signed-off-by: Mark Rutland Signed-o

[PATCH 4.4 179/193] vfs, fdtable: Prevent bounds-check bypass via speculative execution

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Dan Williams (cherry picked from commit 56c30ba7b348b90484969054d561f711ba196507) 'fd' is a user controlled value that is used as a data dependency to read from the 'fdt->fd' array. In order t

[PATCH 4.4 177/193] x86/get_user: Use pointer masking to limit speculation

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Dan Williams (cherry picked from commit c7f631cb07e7da06ac1d231ca178452339e32a94) Quoting Linus: I do think that it would be a good idea to very expressly document the fact that it's n

[PATCH 4.4 156/193] ARM: tegra: select USB_ULPI from EHCI rather than platform

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit a262e87ff354f12447bb6268bd63edf7ba1c20e0 upstream. For historic reasons, the tegra platform selects USB_ULPI from architecture code, but that hasn't really made sense for a

[PATCH 4.4 184/193] x86/kvm: Update spectre-v1 mitigation

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Dan Williams (cherry picked from commit 085331dfc6bbe3501fb936e657331ca943827600) Commit 75f139aaf896 "KVM: x86: Add memory barrier on vmcs field lookup" added a raw 'asm("lfence");' to prevent

[PATCH 4.4 190/193] kvm: nVMX: Fix kernel panics induced by illegal INVEPT/INVVPID types

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Jim Mattson commit 85c856b39b479dde410ddd09df1da745343010c9 upstream Bitwise shifts by amounts greater than or equal to the width of the left operand are undefined. A malicious guest can exploi

[PATCH 4.4 157/193] ASoC: Intel: Kconfig: fix build when ACPI is not enabled

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Vinod Koul commit 3493d4a86457c7de9f1e602b4267c9b0f9ec1c9f upstream. Randy reported following error when ACPI is not enabled: warning: (SND_SOC_INTEL_BYTCR_RT5640_MACH && SND_SOC_INTEL_BYTCR_R

[PATCH 4.4 153/193] idle: i7300: add PCI dependency

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann GCC correctly points out an uninitialized variable use when CONFIG_PCI is disabled. drivers/idle/i7300_idle.c: In function 'i7300_idle_notifier': include/asm-generic/bug.h:119:5:

[PATCH 4.4 160/193] genksyms: Fix segfault with invalid declarations

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Michal Marek commit d920f7c6628c63a390009c237fb80a203c2e400a upstream. Do not try to recover too early and segfault when parsing invalid declarations such as echo 'int (int);' | scripts/genksy

[PATCH 4.9 001/145] vhost: use mutex_lock_nested() in vhost_dev_lock_vqs()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jason Wang commit e9cb4239134c860e5f92c75bf5321bd377bb505b upstream. We used to call mutex_lock() in vhost_dev_lock_vqs() which tries to hold mutexes of all virtqueues. This may confuse lockdep

[PATCH 4.9 030/145] crypto: hash - annotate algorithms taking optional key

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Eric Biggers commit a208fa8f33031b9e0aba44c7d1b7e68eb0cbd29e upstream. We need to consistently enforce that keyed hashes cannot be used without setting the key. To do this we need a reliable w

[PATCH 4.9 022/145] netfilter: x_tables: fix int overflow in xt_alloc_table_info()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Dmitry Vyukov commit 889c604fd0b5f6d3b8694ade229ee44124de1127 upstream. syzkaller triggered OOM kills by passing ipt_replace.size = -1 to IPT_SO_SET_REPLACE. The root cause is that SMP_ALIGN()

[PATCH 4.9 000/145] 4.9.84-stable review

This is the start of the stable review cycle for the 4.9.84 release. There are 145 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun Feb 25 17:06:27 UTC 2018. Anything receiv

[PATCH 4.9 019/145] blk_rq_map_user_iov: fix error override

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Douglas Gilbert commit 69e0927b3774563c19b5fb32e91d75edc147fb62 upstream. During stress tests by syzkaller on the sg driver the block layer infrequently returns EINVAL. Closer inspection shows

[PATCH 4.9 026/145] netfilter: xt_cgroup: initialize info->priv in cgroup_mt_check_v1()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Cong Wang commit ba7cd5d95f25cc6005f687dabdb4e7a6063adda9 upstream. xt_cgroup_info_v1->priv is an internal pointer only used for kernel, we should not trust what user-space provides. Reported-

[PATCH 4.9 012/145] ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jason Wang commit 6e6e41c3112276288ccaf80c70916779b84bb276 upstream. To avoid slab to warn about exceeded size, fail early if queue occupies more than KMALLOC_MAX_SIZE. Reported-by: syzbot+e4d

[PATCH 4.9 021/145] kcov: detect double association with a single task

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Dmitry Vyukov commit a77660d231f8b3d84fd23ed482e0964f7aa546d6 upstream. Currently KCOV_ENABLE does not check if the current task is already associated with another kcov descriptor. As the resu

[PATCH 4.9 005/145] xfrm: skip policies marked as dead while rehashing

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Florian Westphal commit 862591bf4f519d1b8d859af720fafeaebdd0162a upstream. syzkaller triggered following KASAN splat: BUG: KASAN: slab-out-of-bounds in xfrm_hash_rebuild+0xdbe/0xf00 net/xfrm/

[PATCH 4.9 008/145] xfrm: check id proto in validate_tmpl()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Cong Wang commit 6a53b7593233ab9e4f96873ebacc0f653a55c3e1 upstream. syzbot reported a kernel warning in xfrm_state_fini(), which indicates that we have entries left in the list net->xfrm.state_

[PATCH 4.9 053/145] pinctrl: sunxi: Fix A80 interrupt pin bank

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Andre Przywara [ Upstream commit 6ad4cc8d1ac483e0fd33f605fb2788b0ecf51ed4 ] On the A80 the pins on port B can trigger interrupts, and those are assigned to the second interrupt bank. Having tw

[PATCH 4.9 006/145] mm,vmscan: Make unregister_shrinker() no-op if register_shrinker() failed.

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Tetsuo Handa commit bb422a738f6566f7439cd347d54e321e4fe92a9f upstream. Syzbot caught an oops at unregister_shrinker() because combination of commit 1d3d4437eae1bb29 ("vmscan: per-node deferred

[PATCH 4.9 036/145] dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Paolo Abeni commit dfec091439bb2acf763497cfc58f2bdfc67c56b7 upstream. After commit 3f34cfae1238 ("netfilter: on sockopt() acquire sock lock only in the required scope"), the caller of nf_{get/s

[PATCH 4.9 033/145] video: fbdev/mmp: add MODULE_LICENSE

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit c1530ac5a3ce93a1f02adabc4508b5fbf862dfe2 upstream. Kbuild complains about the lack of a license tag in this driver: WARNING: modpost: missing MODULE_LICENSE() in drivers/v

[PATCH 4.9 057/145] sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit d30fc5126efb0c33b7adf5966d3051db2c3d7721 ] Now outstanding_bytes is only increased when appending chunks into one packet and sending it at 1st time, while decreased

[PATCH 4.9 063/145] ARM: dts: Fix elm interrupt compiler warning

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Tony Lindgren [ Upstream commit d364b038bc962f494cffb8f6cb6cddbe41bcb5b6 ] Looks like the interrupt property is missing the controller and level information causing: Warning (interrupts_prope

[PATCH 4.9 060/145] m68k: add missing SOFTIRQENTRY_TEXT linker section

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Greg Ungerer [ Upstream commit 969de0988b77e5a57aac2f7270191a3c50540c52 ] Commit be7635e7287e ("arch, ftrace: for KASAN put hard/soft IRQ entries into separate sections") added a new linker se

[PATCH 4.9 070/145] 509: fix printing uninitialized stack memory when OID is empty

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Eric Biggers [ Upstream commit 8dfd2f22d3bf3ab7714f7495ad5d897b8845e8c1 ] Callers of sprint_oid() do not check its return value before printing the result. In the case where the OID is zero-l

[PATCH 4.9 073/145] dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved

4.9-stable review patch. If anyone has any objections, please let me know. -- From: "Gustavo A. R. Silva" [ Upstream commit 62a277d43d47e74972de44d33bd3763e31992414 ] _xt_ is being dereferenced before it is null checked, hence there is a potential null pointer dereference. F

[PATCH 4.9 066/145] net_sched: red: Avoid illegal values

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Nogah Frankel [ Upstream commit 8afa10cbe281b10371fee5a87ab266e48d71a7f9 ] Check the qmin & qmax values doesn't overflow for the given Wlog value. Check that qmin <= qmax. Fixes: a783474591f2

[PATCH 4.9 071/145] gianfar: Disable EEE autoneg by default

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Claudiu Manoil [ Upstream commit b6b5e8a691185606df3198c89e3b4fd9d4f6 ] This controller does not support EEE, but it may connect to a PHY which supports EEE and advertises EEE by default,

[PATCH 4.9 080/145] usb: dwc3: gadget: Wait longer for controller to end command processing

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Vincent Pelletier [ Upstream commit 8722e095f5a44d0e409e45c5ddc2ee9cf589c777 ] DWC3_DEPCMD_ENDTRANSFER has been witnessed to require around 600 iterations before controller would become idle a

[PATCH 4.9 094/145] vmxnet3: prevent building with 64K pages

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit fbdf0e28d061708cf18ba0f8e0db5360dc9a15b9 upstream. I got a warning about broken code on ARM64 with 64K pages: drivers/net/vmxnet3/vmxnet3_drv.c: In function 'vmxnet3_rq_in

[PATCH 4.9 078/145] drm/armada: fix leak of crtc structure

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Russell King [ Upstream commit 33cd3c07a976e11c3c4cc6b0b3db6760ad1590c5 ] Fix the leak of the CRTC structure in the failure paths of armada_drm_crtc_create(). Signed-off-by: Russell King Sig

[PATCH 4.9 105/145] gpio: xgene: mark PM functions as __maybe_unused

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit b115bebc07f282067eccc06fd5aa3060ab1426da upstream. When CONFIG_PM_SLEEP is disabled, we get a warning about unused functions: drivers/gpio/gpio-xgene.c:155:12: warning: 'x

[PATCH 4.9 092/145] shmem: avoid maybe-uninitialized warning

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit 23f919d4ad0eb325595f10f55be4301b2965d6d6 upstream. After enabling -Wmaybe-uninitialized warnings, we get a false-postive warning for shmem: mm/shmem.c: In function `shme

[PATCH 4.9 101/145] perf: xgene: Include module.h

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Stephen Boyd commit c0bfc549e96231e0ead4424de6e4933fde819d70 upstream. I ran into a build error when I disabled CONFIG_ACPI and tried to compile this driver: drivers/perf/xgene_pmu.c:1242:1: w

[PATCH 4.9 102/145] video: fbdev: via: remove possibly unused variables

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit 484c7bbf2649831714da3a0fa30213977458e9b5 upstream. When CONFIG_PROC_FS is disabled, we get warnings about unused variables as remove_proc_entry() evaluates to an empty macr

[PATCH 4.9 110/145] thermal: fix INTEL_SOC_DTS_IOSF_CORE dependencies

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit 68fd77cf8a4b045594231f07e5fc92e1a34c0a9e upstream. We get a Kconfig warning when selecting this without also enabling CONFIG_PCI: warning: (X86_INTEL_LPSS && INTEL_SOC_DTS

[PATCH 4.9 113/145] x86/platform: Add PCI dependency for PUNIT_ATOM_DEBUG

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit d689c64d189e43d782fec5649fb0afe303c5b3f9 upstream. The IOSF_MBI option requires PCI support, without it we get a harmless Kconfig warning when it gets selected by PUNIT_ATO

[PATCH 4.9 118/145] reiserfs: avoid a -Wmaybe-uninitialized warning

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit ab4949640d6674b617b314ad3c2c00353304bab9 upstream. The latest gcc-7.0.1 snapshot warns about an unintialized variable use: In file included from fs/reiserfs/lbalance.c:8:0

[PATCH 4.9 091/145] drm/i915: fix intel_backlight_device_register declaration

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit ac29fc66855b79c2960c63a4a66952d5b721d698 upstream. The alternative intel_backlight_device_register() definition apparently never got used, but I have now run into a case of

[PATCH 4.9 131/145] ISDN: eicon: reduce stack size of sig_ind function

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit 27d807180ae0a9e50d90adf9b22573c21be904c2 upstream. I noticed that this function uses a lot of kernel stack when the "latent entropy" plugin is enabled: drivers/isdn/hardwa

[PATCH 4.9 140/145] usb: phy: msm add regulator dependency

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann On linux-4.4 and linux-4.9 we get a warning about an array that is never initialized when CONFIG_REGULATOR is disabled: drivers/usb/phy/phy-msm-usb.c: In function 'msm_otg_probe':

[PATCH 4.9 138/145] idle: i7300: add PCI dependency

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann GCC correctly points out an uninitialized variable use when CONFIG_PCI is disabled. drivers/idle/i7300_idle.c: In function 'i7300_idle_notifier': include/asm-generic/bug.h:119:5:

[PATCH 4.9 145/145] crypto: s5p-sss - Fix kernel Oops in AES-ECB mode

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Kamil Konieczny commit c927b080c67e3e97193c81fc1d27f4251bf4e036 upstream. In AES-ECB mode crypt is done with key only, so any use of IV can cause kernel Oops. Use IV only in AES-CBC and AES-CTR

[PATCH 4.9 121/145] drm: exynos: mark pm functions as __maybe_unused

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit 7e1751001818209b214b8c3df0b3c91fae250ea2 upstream. The rework of the exynos DRM clock handling introduced warnings for configurations that have CONFIG_PM disabled: drivers

[PATCH 4.9 141/145] x86/microcode/AMD: Change load_microcode_amd()s param to bool to fix preemptibility bug

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Borislav Petkov commit dac6ca243c4c49a9ca7507d3d66140ebfac8b04b upstream. With CONFIG_DEBUG_PREEMPT enabled, I get: BUG: using smp_processor_id() in preemptible [] code: swapper/0/1

[PATCH 4.14 010/159] xfrm: fix rcu usage in xfrm_get_type_offload

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Sabrina Dubroca commit 2f10a61cee8fdb9f8da90f5db687e1862b22cf06 upstream. request_module can sleep, thus we cannot hold rcu_read_lock() while calling it. The function also jumps back and takes

[PATCH 4.9 128/145] [media] go7007: add MEDIA_CAMERA_SUPPORT dependency

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit fa6317eedd6341f2144ed1097706d8c34f18b6e4 upstream. If MEDIA_SUBDRV_AUTOSELECT and VIDEO_GO7007 are both set, we automatically select VIDEO_OV7640, but that depends on MEDIA

[PATCH 4.9 127/145] [media] tc358743: fix register i2c_rd/wr functions

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit 3538aa6ecfb2dd727a40f9ebbbf25a0c2afe6226 upstream. While testing with CONFIG_UBSAN, I got this warning: drivers/media/i2c/tc358743.c: In function 'tc358743_probe': drivers

[PATCH 4.14 011/159] xfrm: skip policies marked as dead while rehashing

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Florian Westphal commit 862591bf4f519d1b8d859af720fafeaebdd0162a upstream. syzkaller triggered following KASAN splat: BUG: KASAN: slab-out-of-bounds in xfrm_hash_rebuild+0xdbe/0xf00 net/xfrm

[PATCH 4.14 003/159] kcm: Check if sk_user_data already set in kcm_attach

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Tom Herbert commit e5571240236c5652f3e079b1d5866716a7ad819c upstream. This is needed to prevent sk_user_data being overwritten. The check is done under the callback lock. This should prevent a

[PATCH 4.14 022/159] ALSA: caiaq: Add a sanity check for invalid EPs

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Takashi Iwai commit 58fc7f73a85d45a47057dad2af53502fdf6cf778 upstream. As syzkaller spotted, currently caiaq driver submits a URB with the fixed EP without checking whether it's actually avail

[PATCH 4.14 019/159] dnotify: Handle errors from fsnotify_add_mark_locked() in fcntl_dirnotify()

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Jan Kara commit b3a0066005821acdc0cdb092cb72587182ab583f upstream. fsnotify_add_mark_locked() can fail but we do not check its return value. This didn't matter before commit 9dd813c15b2c "fsno

[PATCH 4.14 024/159] ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Jason Wang commit 6e6e41c3112276288ccaf80c70916779b84bb276 upstream. To avoid slab to warn about exceeded size, fail early if queue occupies more than KMALLOC_MAX_SIZE. Reported-by: syzbot+e4

[PATCH 4.14 014/159] RDMA/netlink: Fix general protection fault

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Leon Romanovsky commit d0e312fe3d34c1bc014a7f8ec6540d05e8077483 upstream. The RDMA netlink core code checks validity of messages by ensuring that type and operand are in range. It works well f

[PATCH 4.14 026/159] selinux: ensure the context is NUL terminated in security_context_to_sid_core()

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Paul Moore commit ef28df55ac27e1e5cd122e19fa311d886d47a756 upstream. The syzbot/syzkaller automated tests found a problem in security_context_to_sid_core() during early boot (before we load th

[PATCH 4.14 017/159] sctp: set frag_point in sctp_setsockopt_maxseg correctly

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long commit ecca8f88da5c4260cc2bccfefd2a24976704c366 upstream. Now in sctp_setsockopt_maxseg user_frag or frag_point can be set with val >= 8 and val <= SCTP_MAX_CHUNK_LEN. But both checks

[PATCH 4.14 023/159] ALSA: bcd2000: Add a sanity check for invalid EPs

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Takashi Iwai commit 6815a0b444572527256f0d0efd8efe3ddede6018 upstream. As syzkaller spotted, currently bcd2000 driver submits a URB with the fixed EP without checking whether it's actually ava

[PATCH 4.14 007/159] mac80211_hwsim: validate number of different channels

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Johannes Berg commit 51a1aaa631c90223888d8beac4d649dc11d2ca55 upstream. When creating a new radio on the fly, hwsim allows this to be done with an arbitrary number of channels, but cfg80211 on

[PATCH 4.14 009/159] xfrm: dont call xfrm_policy_cache_flush while holding spinlock

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Florian Westphal commit b1bdcb59b64f806ef08d25a85c39ffb3ad841ce6 upstream. xfrm_policy_cache_flush can sleep, so it cannot be called while holding a spinlock. We could release the lock first,

[PATCH 4.14 042/159] rds: tcp: atomically purge entries from rds_tcp_conn_list during netns delete

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Sowmini Varadhan commit f10b4cff98c6977668434fbf5dd58695eeca2897 upstream. The rds_tcp_kill_sock() function parses the rds_tcp_conn_list to find the rds_connection entries marked for deletion

[PATCH 4.14 046/159] video: fbdev/mmp: add MODULE_LICENSE

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit c1530ac5a3ce93a1f02adabc4508b5fbf862dfe2 upstream. Kbuild complains about the lack of a license tag in this driver: WARNING: modpost: missing MODULE_LICENSE() in drivers/

[PATCH 4.14 054/159] binder: replace "%p" with "%pK"

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Todd Kjos commit 8ca86f1639ec5890d400fff9211aca22d0a392eb upstream. The format specifier "%p" can leak kernel addresses. Use "%pK" instead. There were 4 remaining cases in binder.c. Signed-of

[PATCH 4.14 034/159] kcov: detect double association with a single task

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Dmitry Vyukov commit a77660d231f8b3d84fd23ed482e0964f7aa546d6 upstream. Currently KCOV_ENABLE does not check if the current task is already associated with another kcov descriptor. As the res

[PATCH 4.14 048/159] arm64: dts: add #cooling-cells to CPU nodes

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit acbf76ee05067c3942852019993f7beb69a0f45f upstream. dtc complains about the lack of #coolin-cells properties for the CPU nodes that are referred to as "cooling-device": ar

[PATCH 4.14 050/159] ANDROID: binder: remove WARN() for redundant txn error

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Todd Kjos commit e46a3b3ba7509cb7fda0e07bc7c63a2cd90f579b upstream. binder_send_failed_reply() is called when a synchronous transaction fails. It reports an error to the thread that is waiting

[PATCH 4.14 058/159] usbip: keep usbip_device sockfd state in sync with tcp_socket

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Shuah Khan commit 009f41aed4b3e11e6dc1e3c07377a10c20f1a5ed upstream. Keep usbip_device sockfd state in sync with tcp_socket. When tcp_socket is reset to null, reset sockfd to -1 to keep it in

[PATCH 4.14 056/159] staging: iio: adc: ad7192: fix external frequency setting

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Alexandru Ardelean commit e31b617d0a63c6558485aaa730fd162faa95a766 upstream. The external clock frequency was set only when selecting the internal clock, which is fixed at 4.9152 Mhz. This is

[PATCH 4.14 060/159] serdev: fix receive_buf return value when no callback

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Johan Hovold [ Upstream commit fd00cf81a9a84776ba58e56bd042c726dcf75cf3 ] The receive_buf callback is supposed to return the number of bytes processed and should specifically not return a neg

[PATCH 4.14 064/159] ARM: dts: logicpd-som-lv: Fix gpmc addresses for NAND and enet

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Adam Ford [ Upstream commit 3c18bbf3d11d2005da08b57ff26f44ff1c2b12d0 ] This patch fixes and issue where the NAND and GPMC based ethernet controller stopped working. This also updates the GPM

[PATCH 4.14 062/159] ARM: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Keerthy [ Upstream commit b6d6af7226465b6d11eac09d0be2ab78a4a9eb62 ] Referring TRM Am335X series: http://www.ti.com/lit/ug/spruh73p/spruh73p.pdf The LastPowerStateEntered bitfield is present

[PATCH 4.14 068/159] perf record: Fix -c/-F options for cpu event aliases

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Andi Kleen [ Upstream commit 59622fd496a3175c7bf549046e091d81c303ecff ] The Intel PMU event aliases have a implicit period= specifier to set the default period. Unfortunately this breaks ove

[PATCH 4.14 040/159] netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Cong Wang commit 7dc68e98757a8eccf8ca7a53a29b896f1eef1f76 upstream. rateest_hash is supposed to be protected by xt_rateest_mutex, and, as suggested by Eric, lookup and insert should be atomic,

[PATCH 4.14 066/159] ARM: dts: am4372: Correct the interrupts_properties of McASP

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Peter Ujfalusi [ Upstream commit 627395a6f8091c0aa18f49dca7df59ba3ec147ef ] Fixes the following warnings: arch/arm/boot/dts/am437x-cm-t43.dtb: Warning (interrupts_property): interrupts size

[PATCH 4.14 088/159] KVM: arm/arm64: Fix spinlock acquisition in vgic_set_owner

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Marc Zyngier [ Upstream commit 7465894e90e5a47e0e52aa5f1f708653fc40020f ] vgic_set_owner acquires the irq lock without disabling interrupts, resulting in a lockdep splat (an interrupt could f

[PATCH 4.14 089/159] i40iw: Allocate a sdbuf per CQP WQE

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Chien Tin Tung [ Upstream commit 100d6de2ced538c539d923dc14a1b5cbae234503 ] Currently there is only one sdbuf per Control QP (CQP) for programming Segment Descriptor (SD). If multiple SD work

[PATCH 4.14 095/159] sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Xin Long [ Upstream commit d30fc5126efb0c33b7adf5966d3051db2c3d7721 ] Now outstanding_bytes is only increased when appending chunks into one packet and sending it at 1st time, while decreased

[PATCH 4.14 074/159] perf bench numa: Fixup discontiguous/sparse numa nodes

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Satheesh Rajendran [ Upstream commit 321a7c35c90cc834851ceda18a8ee18f1d032b92 ] Certain systems are designed to have sparse/discontiguous nodes. On such systems, 'perf bench numa' hangs, sho

[PATCH 4.14 107/159] s390/virtio: add BSD license to virtio-ccw

4.14-stable review patch. If anyone has any objections, please let me know. -- From: "Michael S. Tsirkin" [ Upstream commit edfb8d8fcb94a75b2e61c63549d4a5f6474ad3d2 ] The original intent of the virtio header relicensing from 2008 was to make sure anyone can implement compatib

[PATCH 4.14 077/159] kvm: arm: dont treat unavailable HYP mode as an error

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Ard Biesheuvel [ Upstream commit 58d0d19a204604ca0da26058828a53558b265da3 ] Since it is perfectly legal to run the kernel at EL1, it is not actually an error if HYP mode is not available when

[PATCH 4.14 114/159] VSOCK: fix outdated sk_state value in hvs_release()

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Stefan Hajnoczi [ Upstream commit c9d3fe9da094a9a7a3d3cd365b334b822e05f5e8 ] Since commit 3b4477d2dcf2709d0be89e2a8dced3d0f4a017f2 ("VSOCK: use TCP state constants for sk_state") VSOCK has us

[PATCH 4.14 123/159] net: ethernet: arc: fix error handling in emac_rockchip_probe

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Branislav Radocaj [ Upstream commit e46772a6946a7d1f3fbbc1415871851d6651f1d4 ] If clk_set_rate() fails, we should disable clk before return. Found by Linux Driver Verification project (linuxt

[PATCH 4.14 125/159] net: dsa: mv88e6xxx: Unregister MDIO bus on error path

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Andrew Lunn [ Upstream commit 3126aeec5313565bfa19e2dd8fd7e3c3390514cb ] The MDIO busses need to be unregistered before they are freed, otherwise BUG() is called. Add a call to the unregister

[PATCH 4.14 127/159] gianfar: Disable EEE autoneg by default

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Claudiu Manoil [ Upstream commit b6b5e8a691185606df3198c89e3b4fd9d4f6 ] This controller does not support EEE, but it may connect to a PHY which supports EEE and advertises EEE by default,

[PATCH 4.14 132/159] dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved

4.14-stable review patch. If anyone has any objections, please let me know. -- From: "Gustavo A. R. Silva" [ Upstream commit 62a277d43d47e74972de44d33bd3763e31992414 ] _xt_ is being dereferenced before it is null checked, hence there is a potential null pointer dereference.

<    2   3   4   5   6   7   8   9   10   11   >