summaryrefslogtreecommitdiff
path: root/drivers/s390 (follow)
Commit message (Collapse)AuthorAge
* Merge 4.4.302 into android-4.4-pGreg Kroah-Hartman2022-02-03
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.302 can: bcm: fix UAF of bcm op Bluetooth: refactor malicious adv data check s390/hypfs: include z/VM guests with access control group set scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices udf: Restore i_lenAlloc when inode expansion fails udf: Fix NULL ptr deref when converting from inline format PM: wakeup: simplify the output logic of pm_show_wakelocks() serial: stm32: fix software flow control transfer tty: n_gsm: fix SW flow control encoding/handling tty: Add support for Brainboxes UC cards. usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge USB: core: Fix hang in usb_kill_urb by adding memory barriers scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() ipv6_tunnel: Rate limit warning messages net: fix information leakage in /proc/net/ptype ipv4: avoid using shared IP generator for connected sockets net-procfs: show net devices bound packet types drm/msm: Fix wrong size calculation hwmon: (lm90) Reduce maximum conversion rate for G781 ipv4: raw: lock the socket in raw_bind() ipv4: tcp: send zero IPID in SYNACK messages Bluetooth: MGMT: Fix misplaced BT_HS check Revert "drm/radeon/ci: disable mclk switching for high refresh rates (v2)" Revert "tc358743: fix register i2c_rd/wr function fix" KVM: x86: Fix misplaced backport of "work around leak of uninitialized stack contents" Input: i8042 - Fix misplaced backport of "add ASUS Zenbook Flip to noselftest list" Linux 4.4.302 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I5191d3cb4df0fa8de60170d2fedf4a3c51380fdf
| * scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devicesSteffen Maier2022-02-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 8c9db6679be4348b8aae108e11d4be2f83976e30 upstream. Suppose we have an environment with a number of non-NPIV FCP devices (virtual HBAs / FCP devices / zfcp "adapter"s) sharing the same physical FCP channel (HBA port) and its I_T nexus. Plus a number of storage target ports zoned to such shared channel. Now one target port logs out of the fabric causing an RSCN. Zfcp reacts with an ADISC ELS and subsequent port recovery depending on the ADISC result. This happens on all such FCP devices (in different Linux images) concurrently as they all receive a copy of this RSCN. In the following we look at one of those FCP devices. Requests other than FSF_QTCB_FCP_CMND can be slow until they get a response. Depending on which requests are affected by slow responses, there are different recovery outcomes. Here we want to fix failed recoveries on port or adapter level by avoiding recovery requests that can be slow. We need the cached N_Port_ID for the remote port "link" test with ADISC. Just before sending the ADISC, we now intentionally forget the old cached N_Port_ID. The idea is that on receiving an RSCN for a port, we have to assume that any cached information about this port is stale. This forces a fresh new GID_PN [FC-GS] nameserver lookup on any subsequent recovery for the same port. Since we typically can still communicate with the nameserver efficiently, we now reach steady state quicker: Either the nameserver still does not know about the port so we stop recovery, or the nameserver already knows the port potentially with a new N_Port_ID and we can successfully and quickly perform open port recovery. For the one case, where ADISC returns successfully, we re-initialize port->d_id because that case does not involve any port recovery. This also solves a problem if the storage WWPN quickly logs into the fabric again but with a different N_Port_ID. Such as on virtual WWPN takeover during target NPIV failover. [https://www.redbooks.ibm.com/abstracts/redp5477.html] In that case the RSCN from the storage FDISC was ignored by zfcp and we could not successfully recover the failover. On some later failback on the storage, we could have been lucky if the virtual WWPN got the same old N_Port_ID from the SAN switch as we still had cached. Then the related RSCN triggered a successful port reopen recovery. However, there is no guarantee to get the same N_Port_ID on NPIV FDISC. Even though NPIV-enabled FCP devices are not affected by this problem, this code change optimizes recovery time for gone remote ports as a side effect. The timely drop of cached N_Port_IDs prevents unnecessary slow open port attempts. While the problem might have been in code before v2.6.32 commit 799b76d09aee ("[SCSI] zfcp: Decouple gid_pn requests from erp") this fix depends on the gid_pn_work introduced with that commit, so we mark it as culprit to satisfy fix dependencies. Note: Point-to-point remote port is already handled separately and gets its N_Port_ID from the cached peer_d_id. So resetting port->d_id in general does not affect PtP. Link: https://lore.kernel.org/r/20220118165803.3667947-1-maier@linux.ibm.com Fixes: 799b76d09aee ("[SCSI] zfcp: Decouple gid_pn requests from erp") Cc: <stable@vger.kernel.org> #2.6.32+ Suggested-by: Benjamin Block <bblock@linux.ibm.com> Reviewed-by: Benjamin Block <bblock@linux.ibm.com> Signed-off-by: Steffen Maier <maier@linux.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | Merge 4.4.276 into android-4.4-pGreg Kroah-Hartman2021-07-20
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.276 ALSA: usb-audio: fix rate on Ozone Z90 USB headset media: dvb-usb: fix wrong definition Input: usbtouchscreen - fix control-request directions net: can: ems_usb: fix use-after-free in ems_usb_disconnect() usb: gadget: eem: fix echo command packet response issue USB: cdc-acm: blacklist Heimann USB Appset device ntfs: fix validity check for file name attribute iov_iter_fault_in_readable() should do nothing in xarray case Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl ARM: dts: at91: sama5d4: fix pinctrl muxing btrfs: clear defrag status of a root if starting transaction fails ext4: fix kernel infoleak via ext4_extent_header ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit ext4: remove check for zero nr_to_scan in ext4_es_scan() ext4: fix avefreec in find_group_orlov SUNRPC: Fix the batch tasks count wraparound. SUNRPC: Should wake up the privileged task firstly. s390/cio: dont call css_wait_for_slow_path() inside a lock iio: ltr501: mark register holding upper 8 bits of ALS_DATA{0,1} and PS_DATA as volatile, too iio: ltr501: ltr559: fix initialization of LTR501_ALS_CONTR iio: ltr501: ltr501_read_ps(): add missing endianness conversion serial_cs: Add Option International GSM-Ready 56K/ISDN modem ath9k: Fix kernel NULL pointer dereference during ath_reset_internal() ssb: sdio: Don't overwrite const buffer if block_write fails seq_buf: Make trace_seq_putmem_hex() support data longer than 8 fuse: check connected before queueing on fpq->io spi: spi-topcliff-pch: Fix potential double free in pch_spi_process_messages() spi: omap-100k: Fix the length judgment problem crypto: nx - add missing MODULE_DEVICE_TABLE media: cpia2: fix memory leak in cpia2_usb_probe media: pvrusb2: fix warning in pvr2_i2c_core_done crypto: qat - check return code of qat_hal_rd_rel_reg() crypto: qat - remove unused macro in FW loader media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release media: bt8xx: Fix a missing check bug in bt878_probe mmc: via-sdmmc: add a check against NULL pointer dereference crypto: shash - avoid comparing pointers to exported functions under CFI media: dvb_net: avoid speculation from net slot btrfs: disable build on platforms having page size 256K regulator: da9052: Ensure enough delay time for .set_voltage_time_sel ACPI: processor idle: Fix up C-state latency if not ordered block_dump: remove block_dump feature in mark_inode_dirty() fs: dlm: cancel work sync othercon random32: Fix implicit truncation warning in prandom_seed_state() ACPI: bus: Call kobject_put() in acpi_init() error path platform/x86: toshiba_acpi: Fix missing error code in toshiba_acpi_setup_keyboard() ia64: mca_drv: fix incorrect array size calculation crypto: ixp4xx - dma_unmap the correct address crypto: ux500 - Fix error return code in hash_hw_final() sata_highbank: fix deferred probing pata_rb532_cf: fix deferred probing media: I2C: change 'RST' to "RSET" to fix multiple build errors pata_octeon_cf: avoid WARN_ON() in ata_host_activate() pata_ep93xx: fix deferred probing media: tc358743: Fix error return code in tc358743_probe_of() media: siano: Fix out-of-bounds warnings in smscore_load_firmware_family2() mmc: usdhi6rol0: fix error return code in usdhi6_probe() media: s5p-g2d: Fix a memory leak on ctx->fh.m2m_ctx spi: spi-sun6i: Fix chipselect/clock bug crypto: nx - Fix RCU warning in nx842_OF_upd_status ACPI: sysfs: Fix a buffer overrun problem with description_show() net: pch_gbe: Propagate error from devm_gpio_request_one() ehea: fix error return code in ehea_restart_qps() drm: qxl: ensure surf.data is ininitialized wireless: carl9170: fix LEDS build errors & warnings brcmsmac: mac80211_if: Fix a resource leak in an error handling path ath10k: Fix an error code in ath10k_add_interface() netlabel: Fix memory leak in netlbl_mgmt_add_common netfilter: nft_exthdr: check for IPv6 packet before further processing net: ethernet: aeroflex: fix UAF in greth_of_remove net: ethernet: ezchip: fix UAF in nps_enet_remove net: ethernet: ezchip: fix error handling vxlan: add missing rcu_read_lock() in neigh_reduce() i40e: Fix error handling in i40e_vsi_open writeback: fix obtain a reference to a freeing memcg css tty: nozomi: Fix a resource leak in an error handling function iio: adis_buffer: do not return ints in irq handlers iio: accel: bma180: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: stk8312: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: stk8ba50: Fix buffer alignment in iio_push_to_buffers_with_timestamp() Input: hil_kbd - fix error return code in hil_dev_connect() char: pcmcia: error out if 'num_bytes_read' is greater than 4 in set_protocol() tty: nozomi: Fix the error handling path of 'nozomi_card_init()' scsi: FlashPoint: Rename si_flags field s390: appldata depends on PROC_SYSCTL staging: gdm724x: check for buffer overflow in gdm_lte_multi_sdu_pkt() staging: gdm724x: check for overflow in gdm_lte_netif_rx() scsi: mpt3sas: Fix error return value in _scsih_expander_add() phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe() extcon: sm5502: Drop invalid register write in sm5502_reg_data extcon: max8997: Add missing modalias string mmc: vub3000: fix control-request direction scsi: core: Retry I/O for Notify (Enable Spinup) Required error net: pch_gbe: Use proper accessors to BE data in pch_ptp_match() hugetlb: clear huge pte during flush function on mips platform atm: iphase: fix possible use-after-free in ia_module_exit() mISDN: fix possible use-after-free in HFC_cleanup() atm: nicstar: Fix possible use-after-free in nicstar_cleanup() net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT reiserfs: add check for invalid 1st journal block drm/virtio: Fix double free on probe failure udf: Fix NULL pointer dereference in udf_symlink function e100: handle eeprom as little endian ipv6: use prandom_u32() for ID generation RDMA/cxgb4: Fix missing error code in create_qp() dm space maps: don't reset space map allocation cursor when committing net: micrel: check return value after calling platform_get_resource() selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC xfrm: Fix error reporting in xfrm_state_construct. wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP wl1251: Fix possible buffer overflow in wl1251_cmd_scan cw1200: add missing MODULE_DEVICE_TABLE atm: nicstar: use 'dma_free_coherent' instead of 'kfree' atm: nicstar: register the interrupt handler in the right place sfc: avoid double pci_remove of VFs sfc: error code if SRIOV cannot be disabled wireless: wext-spy: Fix out-of-bounds warning RDMA/cma: Fix rdma_resolve_route() memory leak Bluetooth: Fix the HCI to MGMT status conversion table Bluetooth: Shutdown controller after workqueues are flushed or cancelled Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc. sctp: add size validation when walking chunks fuse: reject internal errno can: gw: synchronize rcu operations before removing gw job entry can: bcm: delay release of struct bcm_op after synchronize_rcu() mac80211: fix memory corruption in EAPOL handling powerpc/barrier: Avoid collision with clang's __lwsync macro mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode ata: ahci_sunxi: Disable DIPM ASoC: tegra: Set driver_name=tegra for all machine drivers ipmi/watchdog: Stop watchdog timer when the current action is 'none' power: supply: ab8500: Fix an old bug seq_buf: Fix overflow in seq_buf_putmem_hex() ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe dm btree remove: assign new_root only when removal succeeds media: zr364xx: fix memory leak in zr364xx_start_readpipe media: gspca/sq905: fix control-request direction media: gspca/sunplus: fix zero-length control requests media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K jfs: fix GPF in diFree KVM: x86: Use guest MAXPHYADDR from CPUID.0x8000_0008 iff TDP is enabled KVM: X86: Disable hardware breakpoints unconditionally before kvm_x86->run() tty: serial: fsl_lpuart: fix the potential risk of division or modulo by zero misc/libmasm/module: Fix two use after free in ibmasm_init_one Revert "ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro" scsi: lpfc: Fix "Unexpected timeout" error in direct attach topology tty: serial: 8250: serial_cs: Fix a memory leak in error handling path fs/jfs: Fix missing error code in lmLogInit() scsi: iscsi: Add iscsi_cls_conn refcount helpers mfd: da9052/stmpe: Add and modify MODULE_DEVICE_TABLE ALSA: sb: Fix potential double-free of CSP mixer elements powerpc/ps3: Add dma_mask to ps3_dma_region gpio: zynq: Check return value of pm_runtime_get_sync ALSA: ppc: fix error return code in snd_pmac_probe() selftests/powerpc: Fix "no_handler" EBB selftest ASoC: soc-core: Fix the error return code in snd_soc_of_parse_audio_routing() ALSA: bebob: add support for ToneWeal FW66 usb: gadget: f_hid: fix endianness issue with descriptors usb: gadget: hid: fix error return code in hid_bind() powerpc/boot: Fixup device-tree on little endian backlight: lm3630a: Fix return code of .update_status() callback ALSA: hda: Add IRQ check for platform_get_irq() lib/decompress_unlz4.c: correctly handle zero-padding around initrds. pwm: spear: Don't modify HW state in .remove callback power: supply: ab8500: Avoid NULL pointers power: reset: gpio-poweroff: add missing MODULE_DEVICE_TABLE ARM: 9087/1: kprobes: test-thumb: fix for LLVM_IAS=1 watchdog: Fix possible use-after-free in wdt_startup() watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff() watchdog: Fix possible use-after-free by calling del_timer_sync() ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty power: supply: charger-manager: add missing MODULE_DEVICE_TABLE power: supply: ab8500: add missing MODULE_DEVICE_TABLE virtio-blk: Fix memory leak among suspend/resume procedure virtio_console: Assure used length from device is limited PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun um: fix error return code in slip_open() um: fix error return code in winch_tramp() nfs: fix acl memory leak of posix_acl_create() ALSA: isa: Fix error return code in snd_cmi8330_probe() hexagon: use common DISCARDS macro ARM: dts: exynos: fix PWM LED max brightness on Odroid XU4 rtc: fix snprintf() checking in is_rtc_hctosys() memory: fsl_ifc: fix leak of IO mapping on probe failure memory: fsl_ifc: fix leak of private memory on probe failure scsi: be2iscsi: Fix an error handling path in beiscsi_dev_probe() mips: disable branch profiling in boot/decompress.o MIPS: vdso: Invalid GIC access through VDSO seq_file: disallow extremely large seq buffer allocations Linux 4.4.276 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: If7756927f46fbb8a74337ee1eae8031c0d3579e2
| * s390/cio: dont call css_wait_for_slow_path() inside a lockVineeth Vijayan2021-07-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit c749d8c018daf5fba6dfac7b6c5c78b27efd7d65 upstream. Currently css_wait_for_slow_path() gets called inside the chp->lock. The path-verification-loop of slowpath inside this lock could lead to deadlock as reported by the lockdep validator. The ccw_device_get_chp_desc() during the instance of a device-set-online would try to acquire the same 'chp->lock' to read the chp->desc. The instance of this function can get called from multiple scenario, like probing or setting-device online manually. This could, in some corner-cases lead to the deadlock. lockdep validator reported this as, CPU0 CPU1 ---- ---- lock(&chp->lock); lock(kn->active#43); lock(&chp->lock); lock((wq_completion)cio); The chp->lock was introduced to serialize the access of struct channel_path. This lock is not needed for the css_wait_for_slow_path() function, so invoke the slow-path function outside this lock. Fixes: b730f3a93395 ("[S390] cio: add lock to struct channel_path") Cc: <stable@vger.kernel.org> Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com> Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | Merge 4.4.262 into android-4.4-pGreg Kroah-Hartman2021-03-17
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.262 uapi: nfnetlink_cthelper.h: fix userspace compilation error ath9k: fix transmitting to stations in dynamic SMPS mode net: Fix gro aggregation for udp encaps with zero csum can: skb: can_skb_set_owner(): fix ref counting if socket was closed before setting skb ownership can: flexcan: assert FRZ bit in flexcan_chip_freeze() can: flexcan: enable RX FIFO after FRZ/HALT valid netfilter: x_tables: gpf inside xt_find_revision() cifs: return proper error code in statfs(2) floppy: fix lock_fdc() signal handling Revert "mm, slub: consider rest of partial list if acquire_slab() fails" futex: Change locking rules futex: Cure exit race futex: fix dead code in attach_to_pi_owner() net/mlx4_en: update moderation when config reset net: lapbether: Remove netif_start_queue / netif_stop_queue net: davicom: Fix regulator not turned off on failed probe net: davicom: Fix regulator not turned off on driver removal media: usbtv: Fix deadlock on suspend mmc: mxs-mmc: Fix a resource leak in an error handling path in 'mxs_mmc_probe()' mmc: mediatek: fix race condition between msdc_request_timeout and irq powerpc/perf: Record counter overflow always if SAMPLE_IP is unset PCI: xgene-msi: Fix race in installing chained irq handler s390/smp: __smp_rescan_cpus() - move cpumask away from stack scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling ALSA: hda/hdmi: Cancel pending works before suspend ALSA: hda: Avoid spurious unsol event handling during S3/S4 ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar s390/dasd: fix hanging DASD driver unbind mmc: core: Fix partition switch time for eMMC scripts/recordmcount.{c,pl}: support -ffunction-sections .text.* section names libertas: fix a potential NULL pointer dereference Goodix Fingerprint device is not a modem usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio slot usb: renesas_usbhs: Clear PIPECFG for re-enabling pipe with other EPNUM xhci: Improve detection of device initiated wake signal. USB: serial: io_edgeport: fix memory leak in edge_startup USB: serial: ch341: add new Product ID USB: serial: cp210x: add ID for Acuity Brands nLight Air Adapter USB: serial: cp210x: add some more GE USB IDs usbip: fix stub_dev to check for stream socket usbip: fix vhci_hcd to check for stream socket usbip: fix stub_dev usbip_sockfd_store() races leading to gpf staging: rtl8192u: fix ->ssid overflow in r8192_wx_set_scan() staging: rtl8188eu: prevent ->ssid overflow in rtw_wx_set_scan() staging: rtl8712: unterminated string leads to read overflow staging: rtl8188eu: fix potential memory corruption in rtw_check_beacon_data() staging: rtl8712: Fix possible buffer overflow in r8712_sitesurvey_cmd staging: rtl8192e: Fix possible buffer overflow in _rtl92e_wx_set_scan staging: comedi: addi_apci_1032: Fix endian problem for COS sample staging: comedi: addi_apci_1500: Fix endian problem for command sample staging: comedi: adv_pci1710: Fix endian problem for AI command data staging: comedi: das6402: Fix endian problem for AI command data staging: comedi: das800: Fix endian problem for AI command data staging: comedi: dmm32at: Fix endian problem for AI command data staging: comedi: me4000: Fix endian problem for AI command data staging: comedi: pcl711: Fix endian problem for AI command data staging: comedi: pcl818: Fix endian problem for AI command data NFSv4.2: fix return value of _nfs4_get_security_label() block: rsxx: fix error return code of rsxx_pci_probe() alpha: add $(src)/ rather than $(obj)/ to make source file path alpha: merge build rules of division routines alpha: make short build log available for division routines alpha: Package string routines together alpha: move exports to actual definitions alpha: get rid of tail-zeroing in __copy_user() alpha: switch __copy_user() and __do_clean_user() to normal calling conventions powerpc/64s: Fix instruction encoding for lis in ppc_function_entry() media: hdpvr: Fix an error handling path in hdpvr_probe() KVM: arm64: Fix exclusive limit for IPA size iio: imu: adis16400: release allocated memory on failure iio: imu: adis16400: fix memory leak xen/events: reset affinity of 2-level event when tearing it down xen/events: don't unmask an event channel when an eoi is pending xen/events: avoid handling the same event on two cpus at the same time Linux 4.4.262 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I0200586dffb4dee7db8d50887a87d6a8d9650b5a
| * s390/dasd: fix hanging DASD driver unbindStefan Haberland2021-03-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 7d365bd0bff3c0310c39ebaffc9a8458e036d666 upstream. In case of an unbind of the DASD device driver the function dasd_generic_remove() is called which shuts down the device. Among others this functions removes the int_handler from the cdev. During shutdown the device cancels all outstanding IO requests and waits for completion of the clear request. Unfortunately the clear interrupt will never be received when there is no interrupt handler connected. Fix by moving the int_handler removal after the call to the state machine where no request or interrupt is outstanding. Cc: stable@vger.kernel.org Signed-off-by: Stefan Haberland <sth@linux.ibm.com> Tested-by: Bjoern Walk <bwalk@linux.ibm.com> Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | Merge 4.4.250 into android-4.4-pGreg Kroah-Hartman2021-01-09
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.250 ALSA: hda/ca0132 - Fix work handling in delayed HP detection ALSA: usb-audio: simplify set_sync_ep_implicit_fb_quirk ALSA: usb-audio: fix sync-ep altsetting sanity check ALSA: hda/realtek - Support Dell headset mode for ALC3271 ALSA: hda - Fix a wrong FIXUP for alc289 on Dell machines ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236 s390/dasd: fix hanging device offline processing USB: serial: digi_acceleport: fix write-wakeup deadlocks uapi: move constants from <linux/kernel.h> to <linux/const.h> of: fix linker-section match-table corruption reiserfs: add check for an invalid ih_entry_count misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells() media: gp8psk: initialize stats at power control logic ALSA: seq: Use bool for snd_seq_queue internal flags module: set MODULE_STATE_GOING state when a module fails to load quota: Don't overflow quota file offsets powerpc: sysdev: add missing iounmap() on error in mpic_msgr_probe() module: delay kobject uevent until after module init call iio:magnetometer:mag3110: Fix alignment and data leak issues. mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start Linux 4.4.250 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I084f3c7f25922b12c18e7b7a51ad3ca2a14e0a49
| * s390/dasd: fix hanging device offline processingStefan Haberland2021-01-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 658a337a606f48b7ebe451591f7681d383fa115e ] For an LCU update a read unit address configuration IO is required. This is started using sleep_on(), which has early exit paths in case the device is not usable for IO. For example when it is in offline processing. In those cases the LCU update should fail and not be retried. Therefore lcu_update_work checks if EOPNOTSUPP is returned or not. Commit 41995342b40c ("s390/dasd: fix endless loop after read unit address configuration") accidentally removed the EOPNOTSUPP return code from read_unit_address_configuration(), which in turn might lead to an endless loop of the LCU update in offline processing. Fix by returning EOPNOTSUPP again if the device is not able to perform the request. Fixes: 41995342b40c ("s390/dasd: fix endless loop after read unit address configuration") Cc: stable@vger.kernel.org #5.3 Signed-off-by: Stefan Haberland <sth@linux.ibm.com> Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | Merge 4.4.249 into android-4.4-pGreg Kroah-Hartman2020-12-29
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.249 spi: bcm2835aux: Fix use-after-free on unbind spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe ARC: stack unwinding: don't assume non-current task is sleeping platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE Input: cm109 - do not stomp on control URB Input: i8042 - add Acer laptops to the i8042 reset list pinctrl: amd: remove debounce filter setting in IRQ type setting spi: Prevent adding devices below an unregistering controller net/mlx4_en: Avoid scheduling restart task if it is already running tcp: fix cwnd-limited bug for TSO deferral where we send nothing net: stmmac: delete the eee_ctrl_timer after napi disabled net: bridge: vlan: fix error return code in __vlan_add() USB: dummy-hcd: Fix uninitialized array use in init() USB: add RESET_RESUME quirk for Snapscan 1212 ALSA: usb-audio: Fix potential out-of-bounds shift ALSA: usb-audio: Fix control 'access overflow' errors from chmap xhci: Give USB2 ports time to enter U3 in bus suspend USB: sisusbvga: Make console support depend on BROKEN ALSA: pcm: oss: Fix potential out-of-bounds shift serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access USB: serial: cp210x: enable usb generic throttle/unthrottle scsi: bnx2i: Requires MMU can: softing: softing_netdev_open(): fix error handling RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait dm table: Remove BUG_ON(in_interrupt()) soc/tegra: fuse: Fix index bug in get_process_id USB: serial: option: add interface-number sanity check to flag handling USB: gadget: f_rndis: fix bitrate for SuperSpeed and above usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul media: msi2500: assign SPI bus number dynamically Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() drm/gma500: fix double free of gma_connector ARM: p2v: fix handling of LPAE translation in BE mode crypto: talitos - Fix return type of current_desc_hdr() spi: img-spfi: fix reference leak in img_spfi_resume ASoC: pcm: DRAIN support reactivation Bluetooth: Fix null pointer dereference in hci_event_packet() spi: spi-ti-qspi: fix reference leak in ti_qspi_setup spi: tegra20-slink: fix reference leak in slink ops of tegra20 spi: tegra20-sflash: fix reference leak in tegra_sflash_resume spi: tegra114: fix reference leak in tegra spi ops RDMa/mthca: Work around -Wenum-conversion warning MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA media: solo6x10: fix missing snd_card_free in error handling case drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() Input: ads7846 - fix integer overflow on Rt calculation Input: ads7846 - fix unaligned access on 7845 powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32 soc: ti: knav_qmss: fix reference leak in knav_queue_probe soc: ti: Fix reference imbalance in knav_dma_probe drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe memstick: fix a double-free bug in memstick_check ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host orinoco: Move context allocation after processing the skb cw1200: fix missing destroy_workqueue() on error in cw1200_init_common mips: cdmm: fix use-after-free in mips_cdmm_bus_discover NFSv4.2: condition READDIR's mask for security label based on LSM state lockd: don't use interval-based rebinding over TCP NFS: switch nfsiod to be an UNBOUND workqueue. media: saa7146: fix array overflow in vidioc_s_audio() pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe() memstick: r592: Fix error return in r592_probe() ASoC: jz4740-i2s: add missed checks for clk_get() dm ioctl: fix error return code in target_message clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI cpufreq: highbank: Add missing MODULE_DEVICE_TABLE cpufreq: loongson1: Add missing MODULE_ALIAS cpufreq: scpi: Add missing MODULE_ALIAS scsi: pm80xx: Fix error return in pm8001_pci_probe() seq_buf: Avoid type mismatch for seq_buf_init scsi: fnic: Fix error return code in fnic_probe() powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe usb: oxu210hp-hcd: Fix memory leak in oxu_create speakup: fix uninitialized flush_lock nfs_common: need lock during iterate through the list x86/kprobes: Restore BTF if the single-stepping is cancelled extcon: max77693: Fix modalias string ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control() um: chan_xterm: Fix fd leak nfc: s3fwrn5: Release the nfc firmware powerpc/ps3: use dma_mapping_error() checkpatch: fix unescaped left brace net: bcmgenet: Fix a resource leak in an error handling path in the probe functin net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function net: korina: fix return value clk: ti: Fix memleak in ti_fapll_synth_setup perf record: Fix memory leak when using '--user-regs=?' to list registers qlcnic: Fix error code in probe clk: s2mps11: Fix a resource leak in error handling paths in the probe function cfg80211: initialize rekey_data Input: cros_ec_keyb - send 'scancodes' in addition to key events Input: goodix - add upside-down quirk for Teclast X98 Pro tablet media: gspca: Fix memory leak in probe media: sunxi-cir: ensure IR is handled when it is continuous media: netup_unidvb: Don't leak SPI master in probe error path Input: cyapa_gen6 - fix out-of-bounds stack access Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks" ACPI: PNP: compare the string length in the matching_id() ALSA: pcm: oss: Fix a few more UBSAN fixes s390/dasd: fix list corruption of pavgroup group list s390/dasd: fix list corruption of lcu list staging: comedi: mf6x4: Fix AI end-of-conversion detection powerpc/perf: Exclude kernel samples while counting events in user space. USB: serial: mos7720: fix parallel-port state restore USB: serial: keyspan_pda: fix dropped unthrottle interrupts USB: serial: keyspan_pda: fix write deadlock USB: serial: keyspan_pda: fix stalled writes USB: serial: keyspan_pda: fix write-wakeup use-after-free USB: serial: keyspan_pda: fix tx-unthrottle use-after-free USB: serial: keyspan_pda: fix write unthrottling btrfs: quota: Set rescan progress to (u64)-1 if we hit last leaf btrfs: scrub: Don't use inode page cache in scrub_handle_errored_block() Btrfs: fix selftests failure due to uninitialized i_mode in test inodes btrfs: fix return value mixup in btrfs_get_extent ext4: fix a memory leak of ext4_free_data ceph: fix race in concurrent __ceph_remove_cap invocations jffs2: Fix GC exit abnormally jfs: Fix array index bounds check in dbAdjTree spi: rb4xx: Don't leak SPI master in probe error path mtd: parser: cmdline: Fix parsing of part-names with colons iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume iio:pressure:mpl3115: Force alignment of buffer xen/xenbus: Allow watches discard events before queueing xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path() xen/xenbus/xen_bus_type: Support will_handle watch callback xen/xenbus: Count pending messages for each watch xenbus/xenbus_backend: Disallow pending watch messages PCI: Fix pci_slot_release() NULL pointer dereference Linux 4.4.249 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iaea4f3ffb4c5334d15d921074b56782c24166b09
| * s390/dasd: fix list corruption of lcu listStefan Haberland2020-12-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 53a7f655834c7c335bf683f248208d4fbe4b47bc upstream. In dasd_alias_disconnect_device_from_lcu the device is removed from any list on the LCU. Afterwards the LCU is removed from the lcu list if it does not contain devices any longer. The lcu->lock protects the lcu from parallel updates. But to cancel all workers and wait for completion the lcu->lock has to be unlocked. If two devices are removed in parallel and both are removed from the LCU the first device that takes the lcu->lock again will delete the LCU because it is already empty but the second device also tries to free the LCU which leads to a list corruption of the lcu list. Fix by removing the device right before the lcu is checked without unlocking the lcu->lock in between. Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1") Cc: stable@vger.kernel.org Signed-off-by: Stefan Haberland <sth@linux.ibm.com> Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * s390/dasd: fix list corruption of pavgroup group listStefan Haberland2020-12-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 0ede91f83aa335da1c3ec68eb0f9e228f269f6d8 upstream. dasd_alias_add_device() moves devices to the active_devices list in case of a scheduled LCU update regardless if they have previously been in a pavgroup or not. Example: device A and B are in the same pavgroup. Device A has already been in a pavgroup and the private->pavgroup pointer is set and points to a valid pavgroup. While going through dasd_add_device it is moved from the pavgroup to the active_devices list. In parallel device B might be removed from the same pavgroup in remove_device_from_lcu() which in turn checks if the group is empty and deletes it accordingly because device A has already been removed from there. When now device A enters remove_device_from_lcu() it is tried to remove it from the pavgroup again because the pavgroup pointer is still set and again the empty group will be cleaned up which leads to a list corruption. Fix by setting private->pavgroup to NULL in dasd_add_device. If the device has been the last device on the pavgroup an empty pavgroup remains but this will be cleaned up by the scheduled lcu_update which iterates over all existing pavgroups. Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1") Cc: stable@vger.kernel.org Signed-off-by: Stefan Haberland <sth@linux.ibm.com> Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | Merge 4.4.235 into android-4.4-pGreg Kroah-Hartman2020-09-03
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.235 net: Fix potential wrong skb->protocol in skb_vlan_untag() tipc: fix uninit skb->data in tipc_nl_compat_dumpit() ipvlan: fix device features bonding: show saner speed for broadcast mode bonding: fix a potential double-unregister powerpc/pseries: Do not initiate shutdown when system is running on UPS ALSA: pci: delete repeated words in comments ASoC: tegra: Fix reference count leaks. media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq() scsi: target: tcmu: Fix crash on ARM during cmd completion drm/amdkfd: Fix reference count leaks. drm/radeon: fix multiple reference count leak drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms drm/amd/display: fix ref count leak in amdgpu_drm_ioctl drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails scsi: lpfc: Fix shost refcount mismatch when deleting vport selftests/powerpc: Purge extra count_pmc() calls of ebb selftests PCI: Fix pci_create_slot() reference count leak rtlwifi: rtl8192cu: Prevent leaking urb mips/vdso: Fix resource leaks in genvdso.c drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open drm/nouveau: Fix reference count leak in nouveau_connector_detect locking/lockdep: Fix overflow in presentation of average lock-time scsi: iscsi: Do not put host in iscsi_set_flashnode_param() ceph: fix potential mdsc use-after-free crash scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del() EDAC/ie31200: Fallback if host bridge device is already initialized media: davinci: vpif_capture: fix potential double free powerpc/spufs: add CONFIG_COREDUMP dependency USB: sisusbvga: Fix a potential UB casued by left shifting a negative value Revert "ath10k: fix DMA related firmware crashes on multiple devices" i2c: rcar: in slave mode, clear NACK earlier jbd2: make sure jh have b_transaction set in refile/unfile_buffer jbd2: abort journal if free a async write error metadata buffer s390/cio: add cond_resched() in the slow_eval_known_fn() loop scsi: ufs: Fix possible infinite loop in ufshcd_hold net: gianfar: Add of_node_put() before goto statement fbcon: prevent user font height or width change from causing potential out-of-bounds access USB: lvtest: return proper error code in probe vt: defer kfree() of vc_screenbuf in vc_do_resize() vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize() serial: samsung: Removes the IRQ not found warning serial: pl011: Don't leak amba_ports entry on driver register error serial: 8250: change lock order in serial8250_do_startup() writeback: Protect inode->i_io_list with inode->i_lock writeback: Avoid skipping inode writeback writeback: Fix sync livelock due to b_dirty_time processing XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information. xhci: Do warm-reset when both CAS and XDEV_RESUME are set PM: sleep: core: Fix the handling of pending runtime resume requests device property: Fix the secondary firmware node handling in set_primary_fwnode() USB: yurex: Fix bad gfp argument usb: uas: Add quirk for PNY Pro Elite USB: quirks: Add no-lpm quirk for another Raydium touchscreen USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe() usb: storage: Add unusual_uas entry for Sony PSZ drives btrfs: check the right error variable in btrfs_del_dir_entries_in_log HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage() ALSA: usb-audio: Update documentation comment for MS2109 quirk Linux 4.4.235 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic94d552561168bb9f44bc1350806425cbc35f743
| * s390/cio: add cond_resched() in the slow_eval_known_fn() loopVineeth Vijayan2020-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 0b8eb2ee9da1e8c9b8082f404f3948aa82a057b2 ] The scanning through subchannels during the time of an event could take significant amount of time in case of platforms with lots of known subchannels. This might result in higher scheduling latencies for other tasks especially on systems with a single CPU. Add cond_resched() call, as the loop in slow_eval_known_fn() can be executed for a longer duration. Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com> Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | Merge 4.4.233 into android-4.4-pGreg Kroah-Hartman2020-08-21
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.233 xfs: don't call xfs_da_shrink_inode with NULL bp net: phy: mdio-bcm-unimac: fix potential NULL dereference in unimac_mdio_probe() media: rc: prevent memory leak in cx23888_ir_probe ath9k_htc: release allocated buffer if timed out ath9k: release allocated buffer if timed out nfs: Move call to security_inode_listsecurity into nfs_listxattr PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl() drm: hold gem reference until object is no longer accessed f2fs: check memory boundary by insane namelen f2fs: check if file namelen exceeds max value ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins. rds: Prevent kernel-infoleak in rds_notify_queue_get() net/x25: Fix x25_neigh refcnt leak when x25 disconnect net/x25: Fix null-ptr-deref in x25_disconnect sh: Fix validation of system call number net: lan78xx: add missing endpoint sanity check net: lan78xx: fix transfer-buffer memory leak mlxsw: core: Increase scope of RCU read-side critical section mac80211: mesh: Free ie data when leaving mesh nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame net: ethernet: ravb: exit if re-initialization fails in tx timeout Revert "i2c: cadence: Fix the hold bit setting" xen-netfront: fix potential deadlock in xennet_remove() x86/i8259: Use printk_deferred() to prevent deadlock random32: update the net random state on interrupt and activity ARM: percpu.h: fix build error random: fix circular include dependency on arm64 after addition of percpu.h random32: remove net_rand_state from the latent entropy gcc plugin random32: move the pseudo-random 32-bit definitions to prandom.h ext4: fix direct I/O read error USB: serial: qcserial: add EM7305 QDL product ID ALSA: seq: oss: Serialize ioctls Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt() Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt() Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt() vgacon: Fix for missing check in scrollback handling mtd: properly check all write ioctls for permissions net/9p: validate fds in p9_fd_open drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason cfg80211: check vendor command doit pointer before use igb: reinit_locked() should be called with rtnl_lock atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent tools lib traceevent: Fix memory leak in process_dynamic_array_len binder: Prevent context manager from incrementing ref 0 ipv4: Silence suspicious RCU usage warning ipv6: fix memory leaks on IPV6_ADDRFORM path Revert "vxlan: fix tos value before xmit" net: lan78xx: replace bogus endpoint lookup usb: hso: check for return value in hso_serial_common_create() vxlan: Ensure FDB dump is performed under RCU Smack: fix use-after-free in smk_write_relabel_self() tracepoint: Mark __tracepoint_string's __used udp: drop corrupt packets earlier to avoid data corruption gpio: fix oops resulting from calling of_get_named_gpio(NULL, ...) EDAC: Fix reference count leaks m68k: mac: Don't send IOP message until channel is idle m68k: mac: Fix IOP status/control register writes ARM: at91: pm: add missing put_device() call in at91_pm_sram_init() ARM: socfpga: PM: add missing put_device() call in socfpga_setup_ocram_self_refresh() drm/tilcdc: fix leak & null ref in panel_connector_get_modes Bluetooth: add a mutex lock to avoid UAF in do_enale_set fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync video: fbdev: neofb: fix memory leak in neo_scan_monitor() drm/nouveau: fix multiple instances of reference count leaks drm/debugfs: fix plain echo to connector "force" attribute mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls brcmfmac: To fix Bss Info flag definition Bug iwlegacy: Check the return value of pcie_capability_read_*() usb: gadget: net2280: fix memory leak on probe error handling paths bdc: Fix bug causing crash after multiple disconnects dyndbg: fix a BUG_ON in ddebug_describe_flags bcache: fix super block seq numbers comparision in register_cache_set() ACPICA: Do not increment operation_region reference counts for field units agp/intel: Fix a memory leak on module initialisation failure video: fbdev: sm712fb: fix an issue about iounmap for a wrong address console: newport_con: fix an issue about leak related system resources iio: improve IIO_CONCENTRATION channel type description leds: lm355x: avoid enum conversion warning media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities() scsi: cumana_2: Fix different dev_id between request_irq() and free_irq() cxl: Fix kobject memleak drm/radeon: fix array out-of-bounds read and write issues scsi: powertec: Fix different dev_id between request_irq() and free_irq() scsi: eesox: Fix different dev_id between request_irq() and free_irq() media: firewire: Using uninitialized values in node_probe() media: exynos4-is: Add missed check for pinctrl_lookup_state() drm: panel: simple: Fix bpc for LG LB070WV8 panel mwifiex: Prevent memory corruption handling keys powerpc/vdso: Fix vdso cpu truncation PCI/ASPM: Add missing newline in sysfs 'policy' usb: dwc2: Fix error path in gadget registration scsi: mesh: Fix panic after host or bus reset Smack: fix another vsscanf out of bounds Smack: prevent underflow in smk_set_cipso() power: supply: check if calc_soc succeeded in pm860x_init_battery s390/qeth: don't process empty bridge port events wl1251: fix always return 0 error net: spider_net: Fix the size used in a 'dma_free_coherent()' call dlm: Fix kobject memleak pinctrl-single: fix pcs_parse_pinconf() return value drivers/net/wan/lapbether: Added needed_headroom and a skb->len check net/nfc/rawsock.c: add CAP_NET_RAW check. net: Set fput_needed iff FDPUT_FPUT is set ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109 ALSA: usb-audio: add quirk for Pioneer DDJ-RB crypto: qat - fix double free in qat_uclo_create_batch_init_list fs/minix: check return value of sb_getblk() fs/minix: don't allow getting deleted inodes fs/minix: reject too-large maximum file size ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109 9p: Fix memory leak in v9fs_mount parisc: mask out enable and reserved bits from sba imask ARM: 8992/1: Fix unwind_frame for clang-built kernels xen/balloon: fix accounting in alloc_xenballooned_pages error path xen/balloon: make the balloon wait interruptible PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context() btrfs: only search for left_info if there is no right_info in try_merge_free_space btrfs: fix memory leaks after failure to lookup checksums during inode logging powerpc: Fix circular dependency between percpu.h and mmu.h net: ethernet: stmmac: Disable hardware multicast filter net: stmmac: dwmac1000: provide multicast filter fallback md/raid5: Fix Force reconstruct-write io stuck in degraded raid5 bcache: allocate meta data pages as compound pages mac80211: fix misplaced while instead of if MIPS: CPU#0 is not hotpluggable ext2: fix missing percpu_counter_inc ocfs2: change slot number type s16 to u16 kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler pseries: Fix 64 bit logical memory block panic USB: serial: ftdi_sio: make process-packet buffer unsigned USB: serial: ftdi_sio: clean up receive processing iommu/omap: Check for failure of a call to omap_iommu_dump_ctx iommu/vt-d: Enforce PASID devTLB field mask i2c: rcar: slave: only send STOP event when we have been addressed clk: clk-atlas6: fix return value check in atlas6_clk_init() Input: sentelic - fix error return when fsp_reg_write fails drm/vmwgfx: Fix two list_for_each loop exit tests nfs: Fix getxattr kernel panic and memory overflow fs/ufs: avoid potential u32 multiplication overflow mfd: dln2: Run event handler loop under spinlock ALSA: echoaudio: Fix potential Oops in snd_echo_resume() sh: landisk: Add missing initialization of sh_io_port_base ipv6: check skb->protocol before lookup for nexthop Linux 4.4.233 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iec7dcf69361bcc247996f3de2e20ba64ed0ce3a8
| * s390/qeth: don't process empty bridge port eventsJulian Wiedmann2020-08-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 02472e28b9a45471c6d8729ff2c7422baa9be46a ] Discard events that don't contain any entries. This shouldn't happen, but subsequent code relies on being able to use entry 0. So better be safe than accessing garbage. Fixes: b4d72c08b358 ("qeth: bridgeport support - basic control") Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Reviewed-by: Alexandra Winter <wintera@linux.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | Merge 4.4.229 into android-4.4-pGreg Kroah-Hartman2020-07-01
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.229 s390: fix syscall_get_error for compat processes clk: sunxi: Fix incorrect usage of round_down() i2c: piix4: Detect secondary SMBus controller on AMD AM4 chipsets clk: qcom: msm8916: Fix the address location of pll->config_reg ALSA: isa/wavefront: prevent out of bounds write in ioctl scsi: qla2xxx: Fix issue with adapter's stopping state i2c: pxa: clear all master action bits in i2c_pxa_stop_message() usblp: poison URBs upon disconnect ps3disk: use the default segment boundary vfio/pci: fix memory leaks in alloc_perm_bits() mfd: wm8994: Fix driver operation if loaded as modules scsi: lpfc: Fix lpfc_nodelist leak when processing unsolicited event nfsd: Fix svc_xprt refcnt leak when setup callback client failed powerpc/crashkernel: Take "mem=" option into account yam: fix possible memory leak in yam_init_driver mksysmap: Fix the mismatch of '.L' symbols in System.map scsi: sr: Fix sr_probe() missing deallocate of device minor scsi: ibmvscsi: Don't send host info in adapter info MAD after LPM ALSA: usb-audio: Improve frames size computation s390/qdio: put thinint indicator after early error tty: hvc: Fix data abort due to race in hvc_open staging: sm750fb: add missing case while setting FB_VISUAL i2c: pxa: fix i2c_pxa_scream_blue_murder() debug output serial: amba-pl011: Make sure we initialize the port.lock spinlock drivers: base: Fix NULL pointer exception in __platform_driver_probe() if a driver developer is foolish PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges power: supply: smb347-charger: IRQSTAT_D is volatile scsi: mpt3sas: Fix double free warnings dlm: remove BUG() before panic() clk: ti: composite: fix memory leak tty: n_gsm: Fix SOF skipping tty: n_gsm: Fix waking up upper tty layer when room available powerpc/pseries/ras: Fix FWNMI_VALID off by one powerpc/ps3: Fix kexec shutdown hang vfio-pci: Mask cap zero usb/ohci-platform: Fix a warning when hibernating USB: host: ehci-mxc: Add error handling in ehci_mxc_drv_probe() tty: n_gsm: Fix bogus i++ in gsm_data_kick clk: samsung: exynos5433: Add IGNORE_UNUSED flag to sclk_i2s1 watchdog: da9062: No need to ping manually before setting timeout usb: dwc2: gadget: move gadget resume after the core is in L0 state USB: gadget: udc: s3c2410_udc: Remove pointless NULL check in s3c2410_udc_nuke usb: gadget: lpc32xx_udc: don't dereference ep pointer before null check usb: gadget: fix potential double-free in m66592_probe. net: sunrpc: Fix off-by-one issues in 'rpc_ntop6' ASoC: fsl_asrc_dma: Fix dma_chan leak when config DMA channel failed openrisc: Fix issue with argument clobbering for clone/fork gfs2: Allow lock_nolock mount to specify jid=X scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj lib/zlib: remove outdated and incorrect pre-increment optimization include/linux/bitops.h: avoid clang shift-count-overflow warnings elfnote: mark all .note sections SHF_ALLOC selftests/net: in timestamping, strncpy needs to preserve null byte scsi: acornscsi: Fix an error handling path in acornscsi_probe() usb/xhci-plat: Set PM runtime as active on resume usb/ehci-platform: Set PM runtime as active on resume perf report: Fix NULL pointer dereference in hists__fprintf_nr_sample_events() bcache: fix potential deadlock problem in btree_gc_coalesce block: Fix use-after-free in blkdev_get() libata: Use per port sync for detach drm: encoder_slave: fix refcouting error for modules drm/dp_mst: Reformat drm_dp_check_act_status() a bit drm/qxl: Use correct notify port address when creating cursor ring selinux: fix double free ext4: fix partial cluster initialization when splitting extent drm/dp_mst: Increase ACT retry timeout to 3s sparc64: fix misuses of access_process_vm() in genregs32_[sg]et() block: nr_sects_write(): Disable preemption on seqcount write crypto: algboss - don't wait during notifier callback kprobes: Fix to protect kick_kprobe_optimizer() by kprobe_mutex powerpc/kprobes: Fixes for kprobe_lookup_name() on BE x86/kprobes: Avoid kretprobe recursion bug kretprobe: Prevent triggering kretprobe from within kprobe_flush_task e1000e: Do not wake up the system via WOL if device wakeup is disabled sched/rt, net: Use CONFIG_PREEMPTION.patch net: core: device_rename: Use rwsem instead of a seqcount net: Revert "pkt_sched: fq: use proper locking in fq_dump_stats()" scsi: scsi_devinfo: handle non-terminated strings l2tp: Allow duplicate session creation with UDP net: sched: export __netdev_watchdog_up() fix a braino in "sparc32: fix register window handling in genregs32_[gs]et()" net: fix memleak in register_netdevice() net: usb: ax88179_178a: fix packet alignment padding tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes ip_tunnel: fix use-after-free in ip_tunnel_lookup() tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT ip6_gre: fix use-after-free in ip6gre_tunnel_lookup() tcp: grow window for OOO packets only for SACK flows sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket net: Fix the arp error in some cases net: Do not clear the sock TX queue in sk_set_socket() net: core: reduce recursion limit value mld: fix memory leak in ipv6_mc_destroy_dev() USB: ohci-sm501: Add missed iounmap() in remove usb: dwc2: Postponed gadget registration to the udc class driver usb: add USB_QUIRK_DELAY_INIT for Logitech C922 PCI: Disable MSI for HiSilicon Hip06/Hip07 Root Ports USB: ehci: reopen solution for Synopsys HC bug usb: host: ehci-exynos: Fix error check in exynos_ehci_probe() ALSA: usb-audio: add quirk for Denon DCD-1500RE xhci: Fix incorrect EP_STATE_MASK xhci: Fix enumeration issue when setting max packet size for FS devices. cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip ALSA: usb-audio: uac1: Invalidate ctl on interrupt ALSA: usb-audio: allow clock source validity interrupts ALSA: usb-audio: Clean up mixer element list traverse ALSA: usb-audio: Fix OOB access of mixer element list xhci: Poll for U0 after disabling USB2 LPM cifs/smb3: Fix data inconsistent when punch hole cifs/smb3: Fix data inconsistent when zero file range efi/esrt: Fix reference count leak in esre_create_sysfs_entry. RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads() ARM: imx5: add missing put_device() call in imx_suspend_alloc_ocram() usb: gadget: udc: Potential Oops in error handling code netfilter: ipset: fix unaligned atomic access sched/core: Fix PI boosting between RT and DEADLINE tasks net: alx: fix race condition in alx_remove kbuild: improve cc-option to clean up all temporary files blktrace: break out of blktrace setup on concurrent calls ACPI: sysfs: Fix pm_profile_attr type KVM: X86: Fix MSR range of APIC registers in X2APIC mode mm/slab: use memzero_explicit() in kzfree() ocfs2: load global_inode_alloc ocfs2: fix value of OCFS2_INVALID_SLOT ocfs2: fix panic on nfs server over ocfs2 arm64: perf: Report the PC value in REGS_ABI_32 mode tracing: Fix event trigger to accept redundant spaces drm/radeon: fix fb_div check in ni_init_smc_spll_table() sunrpc: fixed rollback in rpc_gssd_dummy_populate() SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment() pNFS/flexfiles: Fix list corruption if the mirror count changes NFSv4 fix CLOSE not waiting for direct IO compeletion PCI: Disable MSI for HiSilicon Hip06/Hip07 only in Root Port mode ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate() Linux 4.4.229 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic510bbcf5c6e701c747c612876e3ce141757a34a
| * s390/qdio: put thinint indicator after early errorJulian Wiedmann2020-06-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 75e82bec6b2622c6f455b7a543fb5476a5d0eed7 ] qdio_establish() calls qdio_setup_thinint() via qdio_setup_irq(). If the subsequent qdio_establish_thinint() fails, we miss to put the DSCI again. Thus the DSCI isn't available for re-use. Given enough of such errors, we could end up with having only the shared DSCI available. Merge qdio_setup_thinint() into qdio_establish_thinint(), and deal with such an error internally. Fixes: 779e6e1c724d ("[S390] qdio: new qdio driver.") Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Reviewed-by: Benjamin Block <bblock@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | Merge 4.4.226 into android-4.4-pGreg Kroah-Hartman2020-06-03
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.226 ax25: fix setsockopt(SO_BINDTODEVICE) net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()" sctp: Start shutdown on association restart if in SHUTDOWN-SENT state and socket is closed net/mlx5: Add command entry handling completion net: sun: fix missing release regions in cas_init_one(). net/mlx4_core: fix a memory leak bug. uapi: fix linux/if_pppol2tp.h userspace compilation errors IB/cma: Fix reference count leak when no ipv4 addresses are set cachefiles: Fix race between read_waiter and read_copier involving op->to_do usb: gadget: legacy: fix redundant initialization warnings cifs: Fix null pointer check in cifs_read Input: usbtouchscreen - add support for BonXeon TP Input: evdev - call input_flush_device() on release(), not flush() Input: xpad - add custom init packet for Xbox One S controllers Input: i8042 - add ThinkPad S230u to i8042 reset list IB/qib: Call kobject_put() when kobject_init_and_add() fails ALSA: hwdep: fix a left shifting 1 by 31 UB bug ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC exec: Always set cap_ambient in cap_bprm_set_creds fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() include/asm-generic/topology.h: guard cpumask_of_node() macro argument iommu: Fix reference count leak in iommu_group_alloc. parisc: Fix kernel panic in mem_init() x86/dma: Fix max PFN arithmetic overflow on 32 bit systems xfrm: allow to accept packets with ipv6 NEXTHDR_HOP in xfrm_input xfrm: fix a warning in xfrm_policy_insert_list xfrm: fix a NULL-ptr deref in xfrm_local_error vti4: eliminated some duplicate code. ip_vti: receive ipip packet by calling ip_tunnel_rcv netfilter: nft_reject_bridge: enable reject with bridge vlan netfilter: ipset: Fix subcounter update skip netfilter: nf_conntrack_pptp: prevent buffer overflows in debug code qlcnic: fix missing release in qlcnic_83xx_interrupt_test. bonding: Fix reference count leak in bond_sysfs_slave_add. netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build mm: remove VM_BUG_ON(PageSlab()) from page_mapcount() drm/fb-helper: Use proper plane mask for fb cleanup genirq/generic_pending: Do not lose pending affinity update usb: renesas_usbhs: gadget: fix spin_lock_init() for &uep->lock mac80211: fix memory leak net: rtnl_configure_link: fix dev flags changes arg to __dev_notify_flags mm/vmalloc.c: don't dereference possible NULL pointer in __vunmap() asm-prototypes: Clear any CPP defines before declaring the functions sc16is7xx: move label 'err_spi' to correct section drm/msm: Fix possible null dereference on failure of get_pages() printk: help pr_debug and pr_devel to optimize out arguments scsi: zfcp: fix request object use-after-free in send path causing wrong traces Linux 4.4.226 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia5473e84bcdec9d8a045a80a1c683fc1072f8c4f
| * scsi: zfcp: fix request object use-after-free in send path causing wrong tracesBenjamin Block2020-06-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 106d45f350c7cac876844dc685845cba4ffdb70b ] When tracing instances where we open and close WKA ports, we also pass the request-ID of the respective FSF command. But after successfully sending the FSF command we must not use the request-object anymore, as this might result in an use-after-free (see "zfcp: fix request object use-after-free in send path causing seqno errors" ). To fix this add a new variable that caches the request-ID before sending the request. This won't change during the hand-off to the FCP channel, and so it's safe to trace this cached request-ID later, instead of using the request object. Signed-off-by: Benjamin Block <bblock@linux.ibm.com> Fixes: d27a7cb91960 ("zfcp: trace on request for open and close of WKA port") Cc: <stable@vger.kernel.org> #2.6.38+ Reviewed-by: Steffen Maier <maier@linux.ibm.com> Reviewed-by: Jens Remus <jremus@linux.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | Merge 4.4.221 into android-4.4-pGreg Kroah-Hartman2020-05-02
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.221 ext4: fix extent_status fragmentation for plain files ALSA: hda - Fix incorrect usage of IS_REACHABLE() net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg() net: ipv4: avoid unused variable warning for sysctl crypto: mxs-dcp - make symbols 'sha1_null_hash' and 'sha256_null_hash' static vti4: removed duplicate log message. scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login ceph: return ceph_mdsc_do_request() errors from __get_parent() ceph: don't skip updating wanted caps when cap is stale pwm: rcar: Fix late Runtime PM enablement scsi: iscsi: Report unbind session event when the target has been removed ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map() kernel/gcov/fs.c: gcov_seq_next() should increase position index ipc/util.c: sysvipc_find_ipc() should increase position index s390/cio: avoid duplicated 'ADD' uevents pwm: renesas-tpu: Fix late Runtime PM enablement pwm: bcm2835: Dynamically allocate base ipv6: fix restrict IPV6_ADDRFORM operation macvlan: fix null dereference in macvlan_device_event() net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node net/x25: Fix x25_neigh refcnt leak when receiving frame tcp: cache line align MAX_TCP_HEADER team: fix hang in team_mode_get() xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish ALSA: hda: Remove ASUS ROG Zenith from the blacklist iio: xilinx-xadc: Fix ADC-B powerdown iio: xilinx-xadc: Fix clearing interrupt when enabling trigger iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode fs/namespace.c: fix mountpoint reference counter race USB: sisusbvga: Change port variable from signed to unsigned USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70 RGB RAPIDFIRE drivers: usb: core: Don't disable irqs in usb_sg_wait() during URB submit. drivers: usb: core: Minimize irq disabling in usb_sg_cancel() USB: core: Fix free-while-in-use bug in the USB S-Glibrary USB: hub: Fix handling of connect changes during sleep ALSA: usx2y: Fix potential NULL dereference ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices KVM: Check validity of resolved slot when searching memslots KVM: VMX: Enable machine check support for 32bit targets tty: hvc: fix buffer overflow during hvc_alloc(). tty: rocket, avoid OOB access usb-storage: Add unusual_devs entry for JMicron JMS566 audit: check the length of userspace generated audit records ASoC: dapm: fixup dapm kcontrol widget ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y staging: comedi: dt2815: fix writing hi byte of analog output staging: comedi: Fix comedi_device refcnt leak in comedi_open staging: vt6656: Fix drivers TBTT timing counter. staging: vt6656: Power save stop wake_up_count wrap around. UAS: no use logging any details in case of ENODEV UAS: fix deadlock in error handling and PM flushing work usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset() remoteproc: Fix wrong rvring index computation sctp: use right member as the param of list_for_each_entry fuse: fix possibly missed wake-up after abort mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete net/cxgb4: Check the return from t4_query_params properly perf/core: fix parent pid/tid in task exit events bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B scsi: target: fix PR IN / READ FULL STATUS for FC xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status ext4: convert BUG_ON's to WARN_ON's in mballoc.c ext4: avoid declaring fs inconsistent due to invalid file handles ext4: protect journal inode's blocks using block_validity ext4: don't perform block validity checks on the journal inode ext4: fix block validity checks for journal inodes using indirect blocks ext4: unsigned int compared against zero propagate_one(): mnt_set_mountpoint() needs mount_lock Linux 4.4.221 Change-Id: I95cadd4206a7c89541de002faacea3a28e7b1ac3 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * s390/cio: avoid duplicated 'ADD' ueventsCornelia Huck2020-05-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 05ce3e53f375295c2940390b2b429e506e07655c ] The common I/O layer delays the ADD uevent for subchannels and delegates generating this uevent to the individual subchannel drivers. The io_subchannel driver will do so when the associated ccw_device has been registered -- but unconditionally, so more ADD uevents will be generated if a subchannel has been unbound from the io_subchannel driver and later rebound. To fix this, only generate the ADD event if uevents were still suppressed for the device. Fixes: fa1a8c23eb7d ("s390: cio: Delay uevents for subchannels") Message-Id: <20200327124503.9794-2-cohuck@redhat.com> Reported-by: Boris Fiuczynski <fiuczy@linux.ibm.com> Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | Merge 4.4.220 into android-4.4-pGreg Kroah-Hartman2020-04-24
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.220 bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads net: vxge: fix wrong __VA_ARGS__ usage qlcnic: Fix bad kzalloc null test i2c: st: fix missing struct parameter description irqchip/versatile-fpga: Handle chained IRQs properly selftests/x86/ptrace_syscall_32: Fix no-vDSO segfault libata: Remove extra scsi_host_put() in ata_scsi_add_hosts() gfs2: Don't demote a glock until its revokes are written x86/boot: Use unsigned comparison for addresses locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps() btrfs: remove a BUG_ON() from merge_reloc_roots() btrfs: track reloc roots based on their commit root bytenr misc: rtsx: set correct pcr_ops for rts522A ASoC: fix regwmask ASoC: dapm: connect virtual mux with default value ASoC: dpcm: allow start or stop during pause for backend ASoC: topology: use name_prefix for new kcontrol usb: gadget: f_fs: Fix use after free issue as part of queue failure usb: gadget: composite: Inform controller driver of self-powered ALSA: usb-audio: Add mixer workaround for TRX40 and co ALSA: hda: Add driver blacklist ALSA: hda: Fix potential access overflow in beep helper ALSA: ice1724: Fix invalid access for enumerated ctl items ALSA: pcm: oss: Fix regression by buffer overflow fix acpi/x86: ignore unspecified bit positions in the ACPI global lock field thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n KEYS: reaching the keys quotas correctly irqchip/versatile-fpga: Apply clear-mask earlier MIPS: OCTEON: irq: Fix potential NULL pointer dereference ath9k: Handle txpower changes even when TPC is disabled signal: Extend exec_id to 64bits x86/entry/32: Add missing ASM_CLAC to general_protection entry KVM: x86: Allocate new rmap and large page tracking when moving memslot crypto: mxs-dcp - fix scatterlist linearization for hash futex: futex_wake_op, do not fail on invalid op xen-netfront: Rework the fix for Rx stall during OOM and network stress ALSA: hda: Initialize power_state field properly Btrfs: incremental send, fix invalid memory access IB/ipoib: Fix lockdep issue found on ipoib_ib_dev_heavy_flush scsi: zfcp: fix missing erp_lock in port recovery trigger for point-to-point arm64: armv8_deprecated: Fix undef_hook mask for thumb setend ext4: fix a data race at inode->i_blocks ocfs2: no need try to truncate file beyond i_size s390/diag: fix display of diagnose call statistics Input: i8042 - add Acer Aspire 5738z to nomux list kmod: make request_module() return an error when autoloading is disabled hfsplus: fix crash and filesystem corruption when deleting files libata: Return correct status in sata_pmp_eh_recover_pm() when ATA_DFLAG_DETACH is set powerpc/64/tm: Don't let userspace set regs->trap via sigreturn Btrfs: fix crash during unmount due to race with delayed inode workers drm/dp_mst: Fix clearing payload state on topology disable ipmi: fix hung processes in __get_guid() powerpc/fsl_booke: Avoid creating duplicate tlb1 entry misc: echo: Remove unnecessary parentheses and simplify check for zero mfd: dln2: Fix sanity checking for endpoints net: ipv4: devinet: Fix crash when add/del multicast IP with autojoin net: ipv6: do not consider routes via gateways for anycast address check scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic jbd2: improve comments about freeing data buffers whose page mapping is NULL ext4: fix incorrect group count in ext4_fill_super error message ext4: fix incorrect inodes per group in error message ASoC: Intel: mrfld: fix incorrect check on p->sink ASoC: Intel: mrfld: return error codes when an error occurs ALSA: usb-audio: Don't override ignore_ctl_error value from the map mac80211_hwsim: Use kstrndup() in place of kasprintf() ext4: do not zeroout extents beyond i_disksize dm flakey: check for null arg_name in parse_features() kvm: x86: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD x86/mitigations: Clear CPU buffers on the SYSCALL fast path tracing: Fix the race between registering 'snapshot' event trigger and triggering 'snapshot' operation scsi: sg: add sg_remove_request in sg_common_write ALSA: hda: Don't release card at firmware loading error video: fbdev: sis: Remove unnecessary parentheses and commented code drm: NULL pointer dereference [null-pointer-deref] (CWE 476) problem wil6210: increase firmware ready timeout wil6210: fix temperature debugfs scsi: ufs: ufs-qcom: remove broken hci version quirk wil6210: rate limit wil_rx_refill error rtc: pm8xxx: Fix issue in RTC write path soc: qcom: smem: Use le32_to_cpu for comparison of: fix missing kobject init for !SYSFS && OF_DYNAMIC config of: unittest: kmemleak in of_unittest_platform_populate() clk: at91: usb: continue if clk_hw_round_rate() return zero clk: tegra: Fix Tegra PMC clock out parents NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context fails ext4: do not commit super on read-only bdev percpu_counter: fix a data race at vm_committed_as compiler.h: fix error in BUILD_BUG_ON() reporting NFS: Fix memory leaks in nfs_pageio_stop_mirroring() ext2: fix empty body warnings when -Wextra is used iommu/amd: Fix the configuration of GCR3 table root pointer fbdev: potential information leak in do_fb_ioctl() tty: evh_bytechan: Fix out of bounds accesses locktorture: Print ratio of acquisitions, not failures mtd: lpddr: Fix a double free in probe() mtd: phram: fix a double free issue in error path x86/CPU: Add native CPUID variants returning a single datum x86/microcode/intel: replace sync_core() with native_cpuid_reg(eax) x86/vdso: Fix lsl operand order Linux 4.4.220 Change-Id: Ic931642c95ad95eb2755c3c20f6802e04283e68b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * scsi: zfcp: fix missing erp_lock in port recovery trigger for point-to-pointSteffen Maier2020-04-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 819732be9fea728623e1ed84eba28def7384ad1f upstream. v2.6.27 commit cc8c282963bd ("[SCSI] zfcp: Automatically attach remote ports") introduced zfcp automatic port scan. Before that, the user had to use the sysfs attribute "port_add" of an FCP device (adapter) to add and open remote (target) ports, even for the remote peer port in point-to-point topology. That code path did a proper port open recovery trigger taking the erp_lock. Since above commit, a new helper function zfcp_erp_open_ptp_port() performed an UNlocked port open recovery trigger. This can race with other parallel recovery triggers. In zfcp_erp_action_enqueue() this could corrupt e.g. adapter->erp_total_count or adapter->erp_ready_head. As already found for fabric topology in v4.17 commit fa89adba1941 ("scsi: zfcp: fix infinite iteration on ERP ready list"), there was an endless loop during tracing of rport (un)block. A subsequent v4.18 commit 9e156c54ace3 ("scsi: zfcp: assert that the ERP lock is held when tracing a recovery trigger") introduced a lockdep assertion for that case. As a side effect, that lockdep assertion now uncovered the unlocked code path for PtP. It is from within an adapter ERP action: zfcp_erp_strategy[1479] intentionally DROPs erp lock around zfcp_erp_strategy_do_action() zfcp_erp_strategy_do_action[1441] NO erp lock zfcp_erp_adapter_strategy[876] NO erp lock zfcp_erp_adapter_strategy_open[855] NO erp lock zfcp_erp_adapter_strategy_open_fsf[806]NO erp lock zfcp_erp_adapter_strat_fsf_xconf[772] erp lock only around zfcp_erp_action_to_running(), BUT *_not_* around zfcp_erp_enqueue_ptp_port() zfcp_erp_enqueue_ptp_port[728] BUG: *_not_* taking erp lock _zfcp_erp_port_reopen[432] assumes to be called with erp lock zfcp_erp_action_enqueue[314] assumes to be called with erp lock zfcp_dbf_rec_trig[288] _checks_ to be called with erp lock: lockdep_assert_held(&adapter->erp_lock); It causes the following lockdep warning: WARNING: CPU: 2 PID: 775 at drivers/s390/scsi/zfcp_dbf.c:288 zfcp_dbf_rec_trig+0x16a/0x188 no locks held by zfcperp0.0.17c0/775. Fix this by using the proper locked recovery trigger helper function. Link: https://lore.kernel.org/r/20200312174505.51294-2-maier@linux.ibm.com Fixes: cc8c282963bd ("[SCSI] zfcp: Automatically attach remote ports") Cc: <stable@vger.kernel.org> #v2.6.27+ Reviewed-by: Jens Remus <jremus@linux.ibm.com> Reviewed-by: Benjamin Block <bblock@linux.ibm.com> Signed-off-by: Steffen Maier <maier@linux.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | Merge 4.4.216 into android-4.4-pGreg Kroah-Hartman2020-03-11
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.216 iwlwifi: pcie: fix rb_allocator workqueue allocation ext4: fix potential race between online resizing and write operations ext4: fix potential race between s_flex_groups online resizing and access ext4: fix potential race between s_group_info online resizing and access ipmi:ssif: Handle a possible NULL pointer reference mac80211: consider more elements in parsing CRC cfg80211: check wiphy driver existence for drvinfo report cifs: Fix mode output in debugging statements cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE sysrq: Restore original console_loglevel when sysrq disabled sysrq: Remove duplicated sysrq message net: fib_rules: Correctly set table field when table number exceeds 8 bits net: phy: restore mdio regs in the iproc mdio driver ipv6: Fix nlmsg_flags when splitting a multipath route ipv6: Fix route replacement with dev-only route sctp: move the format error check out of __sctp_sf_do_9_1_abort nfc: pn544: Fix occasional HW initialization failure net: sched: correct flower port blocking ext4: potential crash on allocation error in ext4_alloc_flex_bg_array() audit: fix error handling in audit_data_to_entry() HID: core: fix off-by-one memset in hid_report_raw_event() HID: core: increase HID report buffer size to 8KiB HID: hiddev: Fix race in in hiddev_disconnect() MIPS: VPE: Fix a double free and a memory leak in 'release_vpe()' i2c: jz4780: silence log flood on txabrt ecryptfs: Fix up bad backport of fe2e082f5da5b4a0a92ae32978f81507ef37ec66 include/linux/bitops.h: introduce BITS_PER_TYPE net: netlink: cap max groups which will be considered in netlink_bind() namei: only return -ECHILD from follow_dotdot_rcu() KVM: Check for a bad hva before dropping into the ghc slow path slip: stop double free sl->dev in slip_open mm: make page ref count overflow check tighter and more explicit mm: add 'try_get_page()' helper function mm, gup: remove broken VM_BUG_ON_PAGE compound check for hugepages mm, gup: ensure real head page is ref-counted when using hugepages mm: prevent get_user_pages() from overflowing page refcount pipe: add pipe_buf_get() helper fs: prevent page refcount overflow in pipe_buf_get audit: always check the netlink payload length in audit_receive_msg() serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags usb: gadget: serial: fix Tx stall after buffer overflow drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI drm/msm/dsi: save pll state before dsi host is powered off net: ks8851-ml: Remove 8-bit bus accessors net: ks8851-ml: Fix 16-bit data access net: ks8851-ml: Fix 16-bit IO operation watchdog: da9062: do not ping the hw during stop() s390/cio: cio_ignore_proc_seq_next should increase position index cifs: don't leak -EAGAIN for stat() during reconnect usb: storage: Add quirk for Samsung Fit flash usb: quirks: add NO_LPM quirk for Logitech Screen Share usb: core: hub: do error out if usb_autopm_get_interface() fails usb: core: port: do error out if usb_autopm_get_interface() fails vgacon: Fix a UAF in vgacon_invert_region fat: fix uninit-memory access for partial initialized inode vt: selection, close sel_buffer race vt: selection, push console lock down vt: selection, push sel_lock up dmaengine: tegra-apb: Fix use-after-free dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path ASoC: dapm: Correct DAPM handling of active widgets during shutdown RDMA/iwcm: Fix iwcm work deallocation RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen() ARM: imx: build v7_cpu_resume() unconditionally hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT() dmaengine: coh901318: Fix a double lock bug in dma_tc_handle() powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems dm cache: fix a crash due to incorrect work item cancelling crypto: algif_skcipher - use ZERO_OR_NULL_PTR in skcipher_recvmsg_async Linux 4.4.216 Change-Id: I9b747fb2a39b1137ee4ec9c5bb2c1aac2419e97b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * s390/cio: cio_ignore_proc_seq_next should increase position indexVasily Averin2020-03-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 8b101a5e14f2161869636ff9cb4907b7749dc0c2 ] if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output. Link: https://bugzilla.kernel.org/show_bug.cgi?id=206283 Link: https://lore.kernel.org/r/d44c53a7-9bc1-15c7-6d4a-0c10cb9dffce@virtuozzo.com Reviewed-by: Cornelia Huck <cohuck@redhat.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Vasily Averin <vvs@virtuozzo.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | Merge 4.4.207 into android-4.4-pGreg Kroah-Hartman2019-12-21
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.207 x86/apic/32: Avoid bogus LDR warnings usb: gadget: u_serial: add missing port entry locking tty: serial: msm_serial: Fix flow control x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect serial: serial_core: Perform NULL checks for break_ctl ops serial: ifx6x60: add missed pm_runtime_disable autofs: fix a leak in autofs_expire_indirect() NFC: nxp-nci: Fix NULL pointer dereference after I2C communication error Input: cyttsp4_core - fix use after free bug ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed() rsxx: add missed destroy_workqueue calls in remove net: ep93xx_eth: fix mismatch of request_mem_region in remove serial: core: Allow processing sysrq at port unlock time iwlwifi: mvm: Send non offchannel traffic via AP sta ARM: 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+ extcon: max8997: Fix lack of path setting in USB device mode clk: rockchip: fix rk3188 sclk_smc gate data clk: rockchip: fix rk3188 sclk_mac_lbtest parameter ordering dlm: fix missing idr_destroy for recover_idr MIPS: SiByte: Enable ZONE_DMA32 for LittleSur scsi: zfcp: drop default switch case which might paper over missing case pinctrl: qcom: ssbi-gpio: fix gpio-hog related boot issues Staging: iio: adt7316: Fix i2c data reading, set the data field regulator: Fix return value of _set_load() stub MIPS: OCTEON: octeon-platform: fix typing math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning rtc: max8997: Fix the returned value in case of error in 'max8997_rtc_read_alarm()' rtc: dt-binding: abx80x: fix resistance scale ARM: dts: exynos: Use Samsung SoC specific compatible for DWC2 module dmaengine: coh901318: Fix a double-lock bug dmaengine: coh901318: Remove unused variable ACPI: fix acpi_find_child_device() invocation in acpi_preset_companion() dma-mapping: fix return type of dma_set_max_seg_size() altera-stapl: check for a null key before strcasecmp'ing it serial: imx: fix error handling in console_setup i2c: imx: don't print error message on probe defer dlm: NULL check before kmem_cache_destroy is not needed nfsd: fix a warning in __cld_pipe_upcall() ARM: OMAP1/2: fix SoC name printing net/x25: fix called/calling length calculation in x25_parse_address_block net/x25: fix null_x25_address handling ARM: dts: mmp2: fix the gpio interrupt cell number tcp: fix off-by-one bug on aborting window-probing socket modpost: skip ELF local symbols during section mismatch check kbuild: fix single target build for external module ARM: dts: pxa: clean up USB controller nodes dlm: fix invalid cluster name warning powerpc/math-emu: Update macros from GCC MIPS: OCTEON: cvmx_pko_mem_debug8: use oldest forward compatible definition nfsd: Return EPERM, not EACCES, in some SETATTR cases mlx4: Use snprintf instead of complicated strcpy ARM: dts: sunxi: Fix PMU compatible strings sched/fair: Scale bandwidth quota and period without losing quota/period ratio precision fuse: verify nlink fuse: verify attributes ALSA: pcm: oss: Avoid potential buffer overflows Input: goodix - add upside-down quirk for Teclast X89 tablet CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks CIFS: Fix SMB2 oplock break processing tty: vt: keyboard: reject invalid keycodes can: slcan: Fix use-after-free Read in slcan_open jbd2: Fix possible overflow in jbd2_log_space_left() drm/i810: Prevent underflow in ioctl KVM: x86: do not modify masked bits of shared MSRs KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES crypto: crypto4xx - fix double-free in crypto4xx_destroy_sdr crypto: user - fix memory leak in crypto_report spi: atmel: Fix CS high support RDMA/qib: Validate ->show()/store() callbacks before calling them thermal: Fix deadlock in thermal thermal_zone_device_check KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332) appletalk: Fix potential NULL pointer dereference in unregister_snap_client appletalk: Set error code if register_snap_client failed ALSA: hda - Fix pending unsol events at shutdown sched/core: Allow putting thread_info into task_struct sched/core: Add try_get_task_stack() and put_task_stack() sched/core, x86: Make struct thread_info arch specific again fs/proc: Stop reporting eip and esp in /proc/PID/stat fs/proc: Report eip/esp in /prod/PID/stat for coredumping proc: fix coredump vs read /proc/*/stat race fs/proc/array.c: allow reporting eip/esp for all coredumping threads usb: gadget: configfs: Fix missing spin_lock_init() usb: Allow USB device to be warm reset in suspended state staging: rtl8188eu: fix interface sanity check staging: rtl8712: fix interface sanity check staging: gigaset: fix general protection fault on probe staging: gigaset: fix illegal free on probe errors staging: gigaset: add endpoint-type sanity check xhci: Increase STS_HALT timeout in xhci_suspend() iio: humidity: hdc100x: fix IIO_HUMIDITYRELATIVE channel reporting USB: atm: ueagle-atm: add missing endpoint check USB: idmouse: fix interface sanity checks USB: serial: io_edgeport: fix epic endpoint lookup USB: adutux: fix interface sanity check usb: core: urb: fix URB structure initialization function usb: mon: Fix a deadlock in usbmon between mmap and read mtd: spear_smi: Fix Write Burst mode virtio-balloon: fix managed page counts when migrating pages between zones btrfs: check page->mapping when loading free space cache btrfs: Remove btrfs_bio::flags member rtlwifi: rtl8192de: Fix missing code to retrieve RX buffer address rtlwifi: rtl8192de: Fix missing callback that tests for hw release of buffer rtlwifi: rtl8192de: Fix missing enable interrupt flag lib: raid6: fix awk build warnings workqueue: Fix spurious sanity check failures in destroy_workqueue() workqueue: Fix pwq ref leak in rescuer_thread() ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report blk-mq: avoid sysfs buffer overflow with too many CPU cores cgroup: pids: use atomic64_t for pids->limit ar5523: check NULL before memcpy() in ar5523_cmd() media: bdisp: fix memleak on release media: radio: wl1273: fix interrupt masking on release cpuidle: Do not unset the driver if it is there already ACPI: OSL: only free map once in osl.c ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data() ACPI: PM: Avoid attaching ACPI PM domain to certain devices pinctrl: samsung: Fix device node refcount leaks in S3C24xx wakeup controller init pinctrl: samsung: Fix device node refcount leaks in init code powerpc: Allow 64bit VDSO __kernel_sync_dicache to work across ranges >4GB video/hdmi: Fix AVI bar unpack quota: Check that quota is not dirty before release quota: fix livelock in dquot_writeback_dquots scsi: zfcp: trace channel log even for FCP command responses usb: xhci: only set D3hot for pci device xhci: Fix memory leak in xhci_add_in_port() xhci: make sure interrupts are restored to correct state iio: adis16480: Add debugfs_reg_access entry Btrfs: fix negative subv_writers counter and data space leak after buffered write scsi: lpfc: Cap NPIV vports to 256 e100: Fix passing zero to 'PTR_ERR' warning in e100_load_ucode_wait x86/MCE/AMD: Turn off MC4_MISC thresholding on all family 0x15 models ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO polarity pinctrl: samsung: Fix device node refcount leaks in S3C64xx wakeup controller init scsi: qla2xxx: Fix DMA unmap leak scsi: qla2xxx: Fix qla24xx_process_bidir_cmd() scsi: qla2xxx: Always check the qla2x00_wait_for_hba_online() return value powerpc: Fix vDSO clock_getres() mm/shmem.c: cast the type of unmap_start to u64 blk-mq: make sure that line break can be printed workqueue: Fix missing kfree(rescuer) in destroy_workqueue() sunrpc: fix crash when cache_head become valid before update kernel/module.c: wakeup processes in module_wq on module unload net: bridge: deny dev_set_mac_address() when unregistering tcp: md5: fix potential overestimation of TCP option space tipc: fix ordering of tipc module init and exit routine inet: protect against too small mtu values. tcp: fix rejected syncookies due to stale timestamps tcp: tighten acceptance of ACKs not matching a child socket tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE() net: ethernet: ti: cpsw: fix extra rx interrupt PCI: Fix Intel ACS quirk UPDCR register address PCI/MSI: Fix incorrect MSI-X masking on resume xtensa: fix TLB sanity checker CIFS: Respect O_SYNC and O_DIRECT flags during reconnect ARM: dts: s3c64xx: Fix init order of clock providers ARM: tegra: Fix FLOW_CTLR_HALT register clobbering by tegra_resume() vfio/pci: call irq_bypass_unregister_producer() before freeing irq dm btree: increase rebalance threshold in __rebalance2() drm/radeon: fix r1xx/r2xx register checker for POT textures xhci: fix USB3 device initiated resume race with roothub autosuspend net: stmmac: use correct DMA buffer size in the RX descriptor net: stmmac: don't stop NAPI processing when dropping a packet Linux 4.4.207 Change-Id: I2505ee1dcf004c7f28e711cd71977ea33150e733 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * scsi: zfcp: trace channel log even for FCP command responsesSteffen Maier2019-12-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 100843f176109af94600e500da0428e21030ca7f ] While v2.6.26 commit b75db73159cc ("[SCSI] zfcp: Add qtcb dump to hba debug trace") is right that we don't want to flood the (payload) trace ring buffer, we don't trace successful FCP command responses by default. So we can include the channel log for problem determination with failed responses of any FSF request type. Fixes: b75db73159cc ("[SCSI] zfcp: Add qtcb dump to hba debug trace") Fixes: a54ca0f62f95 ("[SCSI] zfcp: Redesign of the debug tracing for HBA records.") Cc: <stable@vger.kernel.org> #2.6.38+ Link: https://lore.kernel.org/r/e37597b5c4ae123aaa85fd86c23a9f71e994e4a9.1572018132.git.bblock@linux.ibm.com Reviewed-by: Benjamin Block <bblock@linux.ibm.com> Signed-off-by: Steffen Maier <maier@linux.ibm.com> Signed-off-by: Benjamin Block <bblock@linux.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
| * scsi: zfcp: drop default switch case which might paper over missing caseSteffen Maier2019-12-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 0c902936e55cff9335b27ed632fc45e7115ced75 ] This was introduced with v4.18 commit 8c3d20aada70 ("scsi: zfcp: fix missing REC trigger trace for all objects in ERP_FAILED") but would now suppress helpful -Wswitch compiler warnings when building with W=1 such as the following forced example: drivers/s390/scsi/zfcp_erp.c: In function 'zfcp_erp_handle_failed': drivers/s390/scsi/zfcp_erp.c:126:2: warning: enumeration value 'ZFCP_ERP_ACTION_REOPEN_PORT_FORCED' not handled in switch [-Wswitch] switch (want) { ^~~~~~ But then again, only with W=1 we would notice unhandled enum cases. Without the default cases and a missed unhandled enum case, the code might perform unforeseen things we might not want... As of today, we never run through the removed default case, so removing it is no functional change. In the future, we never should run through a default case but introduce the necessary specific case(s) to handle new functionality. Signed-off-by: Steffen Maier <maier@linux.ibm.com> Reviewed-by: Benjamin Block <bblock@linux.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | Merge 4.4.203 into android-4.4-pGreg Kroah-Hartman2019-11-25
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.203 slip: Fix memory leak in slip_open error path ax88172a: fix information leak on short answers ALSA: usb-audio: Fix missing error check at mixer resolution test ALSA: usb-audio: not submit urb for stopped endpoint Input: ff-memless - kill timer in destroy() ecryptfs_lookup_interpose(): lower_dentry->d_inode is not stable ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either iommu/vt-d: Fix QI_DEV_IOTLB_PFSID and QI_DEV_EIOTLB_PFSID macros mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm() mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup() mmc: sdhci-of-at91: fix quirk2 overwrite iio: dac: mcp4922: fix error handling in mcp4922_write_raw ALSA: pcm: signedness bug in snd_pcm_plug_alloc() ARM: dts: at91/trivial: Fix USART1 definition for at91sam9g45 ALSA: seq: Do error checks at creating system ports gfs2: Don't set GFS2_RDF_UPTODATE when the lvb is updated ASoC: dpcm: Properly initialise hw->rate_max MIPS: BCM47XX: Enable USB power on Netgear WNDR3400v3 ARM: dts: exynos: Fix sound in Snow-rev5 Chromebook i40e: use correct length for strncpy i40e: hold the rtnl lock on clearing interrupt scheme i40e: Prevent deleting MAC address from VF when set by PF ARM: dts: pxa: fix power i2c base address rtl8187: Fix warning generated when strncpy() destination length matches the sixe argument net: lan78xx: Bail out if lan78xx_get_endpoints fails ASoC: sgtl5000: avoid division by zero if lo_vag is zero ath10k: wmi: disable softirq's while calling ieee80211_rx mips: txx9: fix iounmap related issue of: make PowerMac cache node search conditional on CONFIG_PPC_PMAC ARM: dts: omap3-gta04: give spi_lcd node a label so that we can overwrite in other DTS files ARM: dts: omap3-gta04: tvout: enable as display1 alias ARM: dts: omap3-gta04: make NAND partitions compatible with recent U-Boot ARM: dts: omap3-gta04: keep vpll2 always on dmaengine: dma-jz4780: Further residue status fix signal: Always ignore SIGKILL and SIGSTOP sent to the global init signal: Properly deliver SIGILL from uprobes signal: Properly deliver SIGSEGV from x86 uprobes scsi: sym53c8xx: fix NULL pointer dereference panic in sym_int_sir() ARM: imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff" is set scsi: pm80xx: Corrected dma_unmap_sg() parameter scsi: pm80xx: Fixed system hang issue during kexec boot kprobes: Don't call BUG_ON() if there is a kprobe in use on free list nvmem: core: return error code instead of NULL from nvmem_device_get media: fix: media: pci: meye: validate offset to avoid arbitrary access ALSA: intel8x0m: Register irq handler after register initializations pinctrl: at91-pio4: fix has_config check in atmel_pctl_dt_subnode_to_map() llc: avoid blocking in llc_sap_close() powerpc/vdso: Correct call frame information ARM: dts: socfpga: Fix I2C bus unit-address error pinctrl: at91: don't use the same irqchip with multiple gpiochips cxgb4: Fix endianness issue in t4_fwcache() power: supply: ab8500_fg: silence uninitialized variable warnings power: supply: max8998-charger: Fix platform data retrieval kernfs: Fix range checks in kernfs_get_target_path s390/qeth: invoke softirqs after napi_schedule() PCI/ACPI: Correct error message for ASPM disabling serial: mxs-auart: Fix potential infinite loop powerpc/iommu: Avoid derefence before pointer check powerpc/64s/hash: Fix stab_rr off by one initialization powerpc/pseries: Disable CPU hotplug across migrations libfdt: Ensure INT_MAX is defined in libfdt_env.h power: supply: twl4030_charger: fix charging current out-of-bounds power: supply: twl4030_charger: disable eoc interrupt on linear charge net: toshiba: fix return type of ndo_start_xmit function net: xilinx: fix return type of ndo_start_xmit function net: broadcom: fix return type of ndo_start_xmit function net: amd: fix return type of ndo_start_xmit function usb: chipidea: Fix otg event handler ARM: dts: am335x-evm: fix number of cpsw ARM: dts: ux500: Correct SCU unit address ARM: dts: ux500: Fix LCDA clock line muxing ARM: dts: ste: Fix SPI controller node names cpufeature: avoid warning when compiling with clang bnx2x: Ignore bandwidth attention in single function mode net: micrel: fix return type of ndo_start_xmit function x86/CPU: Use correct macros for Cyrix calls MIPS: kexec: Relax memory restriction media: pci: ivtv: Fix a sleep-in-atomic-context bug in ivtv_yuv_init() media: davinci: Fix implicit enum conversion warning usb: gadget: uvc: configfs: Drop leaked references to config items usb: gadget: uvc: configfs: Prevent format changes after linking header usb: gadget: uvc: Factor out video USB request queueing usb: gadget: uvc: Only halt video streaming endpoint in bulk mode misc: kgdbts: Fix restrict error misc: genwqe: should return proper error value. vfio/pci: Fix potential memory leak in vfio_msi_cap_len scsi: libsas: always unregister the old device if going to discover new ARM: dts: tegra30: fix xcvr-setup-use-fuses ARM: tegra: apalis_t30: fix mmc1 cmd pull-up net: smsc: fix return type of ndo_start_xmit function EDAC: Raise the maximum number of memory controllers Bluetooth: L2CAP: Detect if remote is not able to use the whole MPS arm64: dts: amd: Fix SPI bus warnings fuse: use READ_ONCE on congestion_threshold and max_background Bluetooth: hci_ldisc: Fix null pointer derefence in case of early data Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto() memfd: Use radix_tree_deref_slot_protected to avoid the warning. slcan: Fix memory leak in error path net: cdc_ncm: Signedness bug in cdc_ncm_set_dgram_size() x86/atomic: Fix smp_mb__{before,after}_atomic() apparmor: fix uninitialized lsm_audit member apparmor: fix update the mtime of the profile file on replacement apparmor: fix module parameters can be changed after policy is locked kprobes/x86: Prohibit probing on exception masking instructions uprobes/x86: Prohibit probing on MOV SS instruction fbdev: Remove unused SH-Mobile HDMI driver fbdev: Ditch fb_edid_add_monspecs block: introduce blk_rq_is_passthrough libata: have ata_scsi_rw_xlat() fail invalid passthrough requests net: ovs: fix return type of ndo_start_xmit function f2fs: return correct errno in f2fs_gc SUNRPC: Fix priority queue fairness ath10k: fix vdev-start timeout on error ath9k: fix reporting calculated new FFT upper max usb: gadget: udc: fotg210-udc: Fix a sleep-in-atomic-context bug in fotg210_get_status() nl80211: Fix a GET_KEY reply attribute dmaengine: ep93xx: Return proper enum in ep93xx_dma_chan_direction dmaengine: timb_dma: Use proper enum in td_prep_slave_sg mei: samples: fix a signedness bug in amt_host_if_call() cxgb4: Use proper enum in cxgb4_dcb_handle_fw_update cxgb4: Use proper enum in IEEE_FAUX_SYNC powerpc/pseries: Fix DTL buffer registration powerpc/pseries: Fix how we iterate over the DTL entries mtd: rawnand: sh_flctl: Use proper enum for flctl_dma_fifo0_transfer ixgbe: Fix crash with VFs and flow director on interface flap IB/mthca: Fix error return code in __mthca_init_one() ata: ep93xx: Use proper enums for directions ALSA: hda/sigmatel - Disable automute for Elo VuPoint KVM: PPC: Book3S PR: Exiting split hack mode needs to fixup both PC and LR USB: serial: cypress_m8: fix interrupt-out transfer length mtd: physmap_of: Release resources on error brcmfmac: fix full timeout waiting for action frame on-channel tx NFSv4.x: fix lock recovery during delegation recall dmaengine: ioat: fix prototype of ioat_enumerate_channels Input: st1232 - set INPUT_PROP_DIRECT property x86/olpc: Fix build error with CONFIG_MFD_CS5535=m crypto: mxs-dcp - Fix SHA null hashes and output length crypto: mxs-dcp - Fix AES issues ACPI / SBS: Fix rare oops when removing modules fbdev: sbuslib: use checked version of put_user() fbdev: sbuslib: integer overflow in sbusfb_ioctl_helper() bcache: recal cached_dev_sectors on detach proc/vmcore: Fix i386 build error of missing copy_oldmem_page_encrypted() backlight: lm3639: Unconditionally call led_classdev_unregister printk: Give error on attempt to set log buffer length to over 2G media: isif: fix a NULL pointer dereference bug GFS2: Flush the GFS2 delete workqueue before stopping the kernel threads media: cx231xx: fix potential sign-extension overflow on large shift x86/kexec: Correct KEXEC_BACKUP_SRC_END off-by-one error gpio: syscon: Fix possible NULL ptr usage spi: spidev: Fix OF tree warning logic ARM: 8802/1: Call syscall_trace_exit even when system call skipped hwmon: (pwm-fan) Silence error on probe deferral mac80211: minstrel: fix CCK rate group streams value spi: rockchip: initialize dma_slave_config properly arm64: uaccess: Ensure PAN is re-enabled after unhandled uaccess fault Linux 4.4.203 Change-Id: Icba08e9fbb6f47274ee6fcf1023a1469cd8550d3 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * s390/qeth: invoke softirqs after napi_schedule()Julian Wiedmann2019-11-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 4d19db777a2f32c9b76f6fd517ed8960576cb43e ] Calling napi_schedule() from process context does not ensure that the NET_RX softirq is run in a timely fashion. So trigger it manually. This is no big issue with current code. A call to ndo_open() is usually followed by a ndo_set_rx_mode() call, and for qeth this contains a spin_unlock_bh(). Except for OSN, where qeth_l2_set_rx_mode() bails out early. Nevertheless it's best to not depend on this behaviour, and just fix the issue at its source like all other drivers do. For instance see commit 83a0c6e58901 ("i40e: Invoke softirqs after napi_reschedule"). Fixes: a1c3ed4c9ca0 ("qeth: NAPI support for l2 and l3 discipline") Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | Merge 4.4.198 into android-4.4-pGreg Kroah-Hartman2019-10-29
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.198 scsi: ufs: skip shutdown if hba is not powered scsi: megaraid: disable device when probe failed after enabled device scsi: qla2xxx: Fix unbound sleep in fcport delete path. ARM: OMAP2+: Fix missing reset done flag for am3 and am43 ARM: dts: am4372: Set memory bandwidth limit for DISPC nl80211: fix null pointer dereference mips: Loongson: Fix the link time qualifier of 'serial_exit()' net: hisilicon: Fix usage of uninitialized variable in function mdio_sc_cfg_reg_write() namespace: fix namespace.pl script to support relative paths loop: Add LOOP_SET_DIRECT_IO to compat ioctl net: bcmgenet: Fix RGMII_MODE_EN value for GENET v1/2/3 net: bcmgenet: Set phydev->dev_flags only for internal PHYs sctp: change sctp_prot .no_autobind with true net: avoid potential infinite loop in tc_ctl_action() ipv4: Return -ENETUNREACH if we can't create route but saddr is valid memfd: Fix locking when tagging pins USB: legousbtower: fix memleak on disconnect usb: udc: lpc32xx: fix bad bit shift operation USB: serial: ti_usb_3410_5052: fix port-close races USB: ldusb: fix memleak on disconnect USB: usblp: fix use-after-free on disconnect USB: ldusb: fix read info leaks scsi: core: try to get module before removing device ASoC: rsnd: Reinitialize bit clock inversion flag for every format setting cfg80211: wext: avoid copying malformed SSIDs mac80211: Reject malformed SSID elements drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50 scsi: zfcp: fix reaction on bit error threshold notification mm/slub: fix a deadlock in show_slab_objects() xtensa: drop EXPORT_SYMBOL for outs*/ins* parisc: Fix vmap memory leak in ioremap()/iounmap() CIFS: avoid using MID 0xFFFF btrfs: block-group: Fix a memory leak due to missing btrfs_put_block_group() memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()' cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown xen/netback: fix error path of xenvif_connect_data() PCI: PM: Fix pci_power_up() net: sched: Fix memory exposure from short TCA_U32_SEL RDMA/cxgb4: Do not dma memory off of the stack Linux 4.4.198 Change-Id: Ibaaa507ab0873375f5ad9ef2d53982aa8d346599 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * scsi: zfcp: fix reaction on bit error threshold notificationSteffen Maier2019-10-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 2190168aaea42c31bff7b9a967e7b045f07df095 ] On excessive bit errors for the FCP channel ingress fibre path, the channel notifies us. Previously, we only emitted a kernel message and a trace record. Since performance can become suboptimal with I/O timeouts due to bit errors, we now stop using an FCP device by default on channel notification so multipath on top can timely failover to other paths. A new module parameter zfcp.ber_stop can be used to get zfcp old behavior. User explanation of new kernel message: * Description: * The FCP channel reported that its bit error threshold has been exceeded. * These errors might result from a problem with the physical components * of the local fibre link into the FCP channel. * The problem might be damage or malfunction of the cable or * cable connection between the FCP channel and * the adjacent fabric switch port or the point-to-point peer. * Find details about the errors in the HBA trace for the FCP device. * The zfcp device driver closed down the FCP device * to limit the performance impact from possible I/O command timeouts. * User action: * Check for problems on the local fibre link, ensure that fibre optics are * clean and functional, and all cables are properly plugged. * After the repair action, you can manually recover the FCP device by * writing "0" into its "failed" sysfs attribute. * If recovery through sysfs is not possible, set the CHPID of the device * offline and back online on the service element. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: <stable@vger.kernel.org> #2.6.30+ Link: https://lore.kernel.org/r/20191001104949.42810-1-maier@linux.ibm.com Reviewed-by: Jens Remus <jremus@linux.ibm.com> Reviewed-by: Benjamin Block <bblock@linux.ibm.com> Signed-off-by: Steffen Maier <maier@linux.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | Merge 4.4.197 into android-4.4-pGreg Kroah-Hartman2019-10-17
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.197 KVM: s390: Test for bad access register and size at the start of S390_MEM_OP s390/topology: avoid firing events before kobjs are created s390/cio: avoid calling strlen on null pointer s390/cio: exclude subchannels with no parent from pseudo check KVM: nVMX: handle page fault in vmread fix ASoC: Define a set of DAPM pre/post-up events powerpc/powernv: Restrict OPAL symbol map to only be readable by root can: mcp251x: mcp251x_hw_reset(): allow more time after a reset crypto: qat - Silence smp_processor_id() warning ieee802154: atusb: fix use-after-free at disconnect cfg80211: initialize on-stack chandefs ima: always return negative code for error fs: nfs: Fix possible null-pointer dereferences in encode_attrs() 9p: avoid attaching writeback_fid on mmap with type PRIVATE xen/pci: reserve MCFG areas earlier ceph: fix directories inode i_blkbits initialization drm/amdgpu: Check for valid number of registers to read thermal: Fix use-after-free when unregistering thermal zone device fuse: fix memleak in cuse_channel_open kernel/elfcore.c: include proper prototypes tools lib traceevent: Do not free tep->cmdlines in add_new_comm() on failure perf stat: Fix a segmentation fault when using repeat forever crypto: caam - fix concurrency issue in givencrypt descriptor cfg80211: add and use strongly typed element iteration macros cfg80211: Use const more consistently in for_each_element macros nl80211: validate beacon head ASoC: sgtl5000: Improve VAG power and mute control panic: ensure preemption is disabled during panic() USB: rio500: Remove Rio 500 kernel driver USB: yurex: Don't retry on unexpected errors USB: yurex: fix NULL-derefs on disconnect USB: usb-skeleton: fix runtime PM after driver unbind USB: usb-skeleton: fix NULL-deref on disconnect xhci: Prevent device initiated U1/U2 link pm if exit latency is too long xhci: Check all endpoints for LPM timeout usb: xhci: wait for CNR controller not ready bit in xhci resume xhci: Increase STS_SAVE timeout in xhci_suspend() USB: adutux: remove redundant variable minor USB: adutux: fix use-after-free on disconnect USB: adutux: fix NULL-derefs on disconnect USB: adutux: fix use-after-free on release USB: iowarrior: fix use-after-free on disconnect USB: iowarrior: fix use-after-free on release USB: iowarrior: fix use-after-free after driver unbind USB: usblp: fix runtime PM after driver unbind USB: chaoskey: fix use-after-free on release USB: ldusb: fix NULL-derefs on driver unbind serial: uartlite: fix exit path null pointer USB: serial: keyspan: fix NULL-derefs on open() and write() USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20 USB: serial: option: add Telit FN980 compositions USB: serial: option: add support for Cinterion CLS8 devices USB: serial: fix runtime PM after driver unbind USB: usblcd: fix I/O after disconnect USB: microtek: fix info-leak at probe USB: dummy-hcd: fix power budget for SuperSpeed mode usb: renesas_usbhs: gadget: Do not discard queues in usb_ep_set_{halt,wedge}() usb: renesas_usbhs: gadget: Fix usb_ep_set_{halt,wedge}() behavior USB: legousbtower: fix slab info leak at probe USB: legousbtower: fix deadlock on disconnect USB: legousbtower: fix potential NULL-deref on disconnect USB: legousbtower: fix open after failed reset request USB: legousbtower: fix use-after-free on release staging: vt6655: Fix memory leak in vt6655_probe iio: adc: ad799x: fix probe error handling iio: light: opt3001: fix mutex unlock race perf llvm: Don't access out-of-scope array CIFS: Gracefully handle QueryInfo errors during open CIFS: Force reval dentry if LOOKUP_REVAL flag is set kernel/sysctl.c: do not override max_threads provided by userspace arm64: capabilities: Handle sign of the feature bit arm64: Rename cpuid_feature field extract routines Staging: fbtft: fix memory leak in fbtft_framebuffer_alloc cifs: Check uniqueid for SMB2+ and return -ESTALE if necessary CIFS: Force revalidate inode when dentry is stale media: stkwebcam: fix runtime PM after driver unbind tracing: Get trace_array reference for available_tracers files x86/asm: Fix MWAITX C-state hint value xfs: clear sb->s_fs_info on mount failure Linux 4.4.197 Change-Id: I0879b08629040431c71dae0d8b5474863d5e0391 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * s390/cio: exclude subchannels with no parent from pseudo checkVasily Gorbik2019-10-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit ab5758848039de9a4b249d46e4ab591197eebaf2 upstream. ccw console is created early in start_kernel and used before css is initialized or ccw console subchannel is registered. Until then console subchannel does not have a parent. For that reason assume subchannels with no parent are not pseudo subchannels. This fixes the following kasan finding: BUG: KASAN: global-out-of-bounds in sch_is_pseudo_sch+0x8e/0x98 Read of size 8 at addr 00000000000005e8 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.0-rc8-07370-g6ac43dd12538 #2 Hardware name: IBM 2964 NC9 702 (z/VM 6.4.0) Call Trace: ([<000000000012cd76>] show_stack+0x14e/0x1e0) [<0000000001f7fb44>] dump_stack+0x1a4/0x1f8 [<00000000007d7afc>] print_address_description+0x64/0x3c8 [<00000000007d75f6>] __kasan_report+0x14e/0x180 [<00000000018a2986>] sch_is_pseudo_sch+0x8e/0x98 [<000000000189b950>] cio_enable_subchannel+0x1d0/0x510 [<00000000018cac7c>] ccw_device_recognition+0x12c/0x188 [<0000000002ceb1a8>] ccw_device_enable_console+0x138/0x340 [<0000000002cf1cbe>] con3215_init+0x25e/0x300 [<0000000002c8770a>] console_init+0x68a/0x9b8 [<0000000002c6a3d6>] start_kernel+0x4fe/0x728 [<0000000000100070>] startup_continue+0x70/0xd0 Cc: stable@vger.kernel.org Reviewed-by: Sebastian Ott <sebott@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * s390/cio: avoid calling strlen on null pointerVasily Gorbik2019-10-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit ea298e6ee8b34b3ed4366be7eb799d0650ebe555 upstream. Fix the following kasan finding: BUG: KASAN: global-out-of-bounds in ccwgroup_create_dev+0x850/0x1140 Read of size 1 at addr 0000000000000000 by task systemd-udevd.r/561 CPU: 30 PID: 561 Comm: systemd-udevd.r Tainted: G B Hardware name: IBM 3906 M04 704 (LPAR) Call Trace: ([<0000000231b3db7e>] show_stack+0x14e/0x1a8) [<0000000233826410>] dump_stack+0x1d0/0x218 [<000000023216fac4>] print_address_description+0x64/0x380 [<000000023216f5a8>] __kasan_report+0x138/0x168 [<00000002331b8378>] ccwgroup_create_dev+0x850/0x1140 [<00000002332b618a>] group_store+0x3a/0x50 [<00000002323ac706>] kernfs_fop_write+0x246/0x3b8 [<00000002321d409a>] vfs_write+0x132/0x450 [<00000002321d47da>] ksys_write+0x122/0x208 [<0000000233877102>] system_call+0x2a6/0x2c8 Triggered by: openat(AT_FDCWD, "/sys/bus/ccwgroup/drivers/qeth/group", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0666) = 16 write(16, "0.0.bd00,0.0.bd01,0.0.bd02", 26) = 26 The problem is that __get_next_id in ccwgroup_create_dev might set "buf" buffer pointer to NULL and explicit check for that is required. Cc: stable@vger.kernel.org Reviewed-by: Sebastian Ott <sebott@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | Merge 4.4.190 into android-4.4-pGreg Kroah-Hartman2019-08-25
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.190 usb: iowarrior: fix deadlock on disconnect sound: fix a memory leak bug x86/mm: Check for pfn instead of page in vmalloc_sync_one() x86/mm: Sync also unmappings in vmalloc_sync_all() mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy() perf db-export: Fix thread__exec_comm() usb: yurex: Fix use-after-free in yurex_delete can: peak_usb: fix potential double kfree_skb() netfilter: nfnetlink: avoid deadlock due to synchronous request_module iscsi_ibft: make ISCSI_IBFT dependson ACPI instead of ISCSI_IBFT_FIND mac80211: don't warn about CW params when not using them hwmon: (nct6775) Fix register address and added missed tolerance for nct6106 cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init() s390/qdio: add sanity checks to the fast-requeue path ALSA: compress: Fix regression on compressed capture streams ALSA: compress: Prevent bypasses of set_params ALSA: compress: Be more restrictive about when a drain is allowed perf probe: Avoid calling freeing routine multiple times for same pointer ARM: davinci: fix sleep.S build error on ARMv4 scsi: megaraid_sas: fix panic on loading firmware crashdump scsi: ibmvfc: fix WARN_ON during event pool release tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop perf/core: Fix creating kernel counters for PMUs that override event->cpu can: peak_usb: pcan_usb_pro: Fix info-leaks to USB devices can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices hwmon: (nct7802) Fix wrong detection of in4 presence ALSA: firewire: fix a memory leak bug mac80211: don't WARN on short WMM parameters from AP SMB3: Fix deadlock in validate negotiate hits reconnect smb3: send CAP_DFS capability during session setup mwifiex: fix 802.11n/WPA detection scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA sh: kernel: hw_breakpoint: Fix missing break in switch statement usb: gadget: f_midi: fail if set_alt fails to allocate requests USB: gadget: f_midi: fixing a possible double-free in f_midi mm/memcontrol.c: fix use after free in mem_cgroup_iter() ALSA: hda - Fix a memory leak bug HID: holtek: test for sanity of intfdata HID: hiddev: avoid opening a disconnected device HID: hiddev: do cleanup in failure of opening a device Input: kbtab - sanity check for endpoint type Input: iforce - add sanity checks net: usb: pegasus: fix improper read if get_registers() fail xen/pciback: remove set but not used variable 'old_state' irqchip/irq-imx-gpcv2: Forward irq type to parent perf header: Fix divide by zero error if f_header.attr_size==0 perf header: Fix use of unitialized value warning libata: zpodd: Fix small read overflow in zpodd_get_mech_type() scsi: hpsa: correct scsi command status issue after reset ata: libahci: do not complain in case of deferred probe kbuild: modpost: handle KBUILD_EXTRA_SYMBOLS only for external modules IB/core: Add mitigation for Spectre V1 ocfs2: remove set but not used variable 'last_hash' asm-generic: fix -Wtype-limits compiler warnings staging: comedi: dt3000: Fix signed integer overflow 'divider * base' staging: comedi: dt3000: Fix rounding up of timer divisor USB: core: Fix races in character device registration and deregistraion usb: cdc-acm: make sure a refcount is taken early enough USB: serial: option: add D-Link DWM-222 device ID USB: serial: option: Add support for ZTE MF871A USB: serial: option: add the BroadMobi BM818 card USB: serial: option: Add Motorola modem UARTs Backport minimal compiler_attributes.h to support GCC 9 include/linux/module.h: copy __init/__exit attrs to init/cleanup_module arm64: compat: Allow single-byte watchpoints on all addresses Input: psmouse - fix build error of multiple definition asm-generic: default BUG_ON(x) to if(x)BUG() scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure RDMA: Directly cast the sockaddr union to sockaddr IB/mlx5: Make coding style more consistent x86/vdso: Remove direct HPET access through the vDSO iommu/amd: Move iommu_init_pci() to .init section x86/boot: Disable the address-of-packed-member compiler warning net/packet: fix race in tpacket_snd() xen/netback: Reset nr_frags before freeing skb net/mlx5e: Only support tx/rx pause setting for port owner sctp: fix the transport error_count check bonding: Add vlan tx offload to hw_enc_features Linux 4.4.190 Change-Id: Ic4094fbac2f9b8f6d4a9b4397e82471f40424332 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * s390/qdio: add sanity checks to the fast-requeue pathJulian Wiedmann2019-08-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit a6ec414a4dd529eeac5c3ea51c661daba3397108 ] If the device driver were to send out a full queue's worth of SBALs, current code would end up discovering the last of those SBALs as PRIMED and erroneously skip the SIGA-w. This immediately stalls the queue. Add a check to not attempt fast-requeue in this case. While at it also make sure that the state of the previous SBAL was successfully extracted before inspecting it. Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Reviewed-by: Jens Remus <jremus@linux.ibm.com> Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | Merge 4.4.188 into android-4.4-pGreg Kroah-Hartman2019-08-06
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.188 ARM: riscpc: fix DMA ARM: dts: rockchip: Mark that the rk3288 timer might stop in suspend kernel/module.c: Only return -EEXIST for modules that have finished loading MIPS: lantiq: Fix bitfield masking dmaengine: rcar-dmac: Reject zero-length slave DMA requests fs/adfs: super: fix use-after-free bug btrfs: fix minimum number of chunk errors for DUP ceph: fix improper use of smp_mb__before_atomic() scsi: zfcp: fix GCC compiler warning emitted with -Wmaybe-uninitialized ACPI: fix false-positive -Wuninitialized warning be2net: Signal that the device cannot transmit during reconfiguration x86/apic: Silence -Wtype-limits compiler warnings x86: math-emu: Hide clang warnings for 16-bit overflow mm/cma.c: fail if fixed declaration can't be honored coda: add error handling for fget coda: fix build using bare-metal toolchain uapi linux/coda_psdev.h: move upc_req definition from uapi to kernel side headers ipc/mqueue.c: only perform resource calculation if user valid x86/kvm: Don't call kvm_spurious_fault() from .fixup selinux: fix memory leak in policydb_init() s390/dasd: fix endless loop after read unit address configuration xen/swiotlb: fix condition for calling xen_destroy_contiguous_region() Linux 4.4.188 Change-Id: I6ed0db8e205744849b0242a9fd12b38f728077e0 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * s390/dasd: fix endless loop after read unit address configurationStefan Haberland2019-08-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 41995342b40c418a47603e1321256d2c4a2ed0fb upstream. After getting a storage server event that causes the DASD device driver to update its unit address configuration during a device shutdown there is the possibility of an endless loop in the device driver. In the system log there will be ongoing DASD error messages with RC: -19. The reason is that the loop starting the ruac request only terminates when the retry counter is decreased to 0. But in the sleep_on function there are early exit paths that do not decrease the retry counter. Prevent an endless loop by handling those cases separately. Remove the unnecessary do..while loop since the sleep_on function takes care of retries by itself. Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1") Cc: stable@vger.kernel.org # 2.6.25+ Signed-off-by: Stefan Haberland <sth@linux.ibm.com> Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * scsi: zfcp: fix GCC compiler warning emitted with -Wmaybe-uninitializedBenjamin Block2019-08-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 484647088826f2f651acbda6bcf9536b8a466703 ] GCC v9 emits this warning: CC drivers/s390/scsi/zfcp_erp.o drivers/s390/scsi/zfcp_erp.c: In function 'zfcp_erp_action_enqueue': drivers/s390/scsi/zfcp_erp.c:217:26: warning: 'erp_action' may be used uninitialized in this function [-Wmaybe-uninitialized] 217 | struct zfcp_erp_action *erp_action; | ^~~~~~~~~~ This is a possible false positive case, as also documented in the GCC documentations: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wmaybe-uninitialized The actual code-sequence is like this: Various callers can invoke the function below with the argument "want" being one of: ZFCP_ERP_ACTION_REOPEN_ADAPTER, ZFCP_ERP_ACTION_REOPEN_PORT_FORCED, ZFCP_ERP_ACTION_REOPEN_PORT, or ZFCP_ERP_ACTION_REOPEN_LUN. zfcp_erp_action_enqueue(want, ...) ... need = zfcp_erp_required_act(want, ...) need = want ... maybe: need = ZFCP_ERP_ACTION_REOPEN_PORT maybe: need = ZFCP_ERP_ACTION_REOPEN_ADAPTER ... return need ... zfcp_erp_setup_act(need, ...) struct zfcp_erp_action *erp_action; // <== line 217 ... switch(need) { case ZFCP_ERP_ACTION_REOPEN_LUN: ... erp_action = &zfcp_sdev->erp_action; WARN_ON_ONCE(erp_action->port != port); // <== access ... break; case ZFCP_ERP_ACTION_REOPEN_PORT: case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED: ... erp_action = &port->erp_action; WARN_ON_ONCE(erp_action->port != port); // <== access ... break; case ZFCP_ERP_ACTION_REOPEN_ADAPTER: ... erp_action = &adapter->erp_action; WARN_ON_ONCE(erp_action->port != NULL); // <== access ... break; } ... WARN_ON_ONCE(erp_action->adapter != adapter); // <== access When zfcp_erp_setup_act() is called, 'need' will never be anything else than one of the 4 possible enumeration-names that are used in the switch-case, and 'erp_action' is initialized for every one of them, before it is used. Thus the warning is a false positive, as documented. We introduce the extra if{} in the beginning to create an extra code-flow, so the compiler can be convinced that the switch-case will never see any other value. BUG_ON()/BUG() is intentionally not used to not crash anything, should this ever happen anyway - right now it's impossible, as argued above; and it doesn't introduce a 'default:' switch-case to retain warnings should 'enum zfcp_erp_act_type' ever be extended and no explicit case be introduced. See also v5.0 commit 399b6c8bc9f7 ("scsi: zfcp: drop old default switch case which might paper over missing case"). Signed-off-by: Benjamin Block <bblock@linux.ibm.com> Reviewed-by: Jens Remus <jremus@linux.ibm.com> Reviewed-by: Steffen Maier <maier@linux.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | Merge 4.4.187 into android-4.4-pGreg Kroah-Hartman2019-08-04
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.187 MIPS: ath79: fix ar933x uart parity mode MIPS: fix build on non-linux hosts dmaengine: imx-sdma: fix use-after-free on probe error path ath10k: Do not send probe response template for mesh ath9k: Check for errors when reading SREV register ath6kl: add some bounds checking ath: DFS JP domain W56 fixed pulse type 3 RADAR detection batman-adv: fix for leaked TVLV handler. media: dvb: usb: fix use after free in dvb_usb_device_exit crypto: talitos - fix skcipher failure due to wrong output IV media: marvell-ccic: fix DMA s/g desc number calculation media: vpss: fix a potential NULL pointer dereference net: stmmac: dwmac1000: Clear unused address entries signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig af_key: fix leaks in key_pol_get_resp and dump_sp. xfrm: Fix xfrm sel prefix length validation media: staging: media: davinci_vpfe: - Fix for memory leak if decoder initialization fails. net: phy: Check against net_device being NULL tua6100: Avoid build warnings. locking/lockdep: Fix merging of hlocks with non-zero references media: wl128x: Fix some error handling in fm_v4l2_init_video_device() cpupower : frequency-set -r option misses the last cpu in related cpu list net: fec: Do not use netdev messages too early net: axienet: Fix race condition causing TX hang s390/qdio: handle PENDING state for QEBSM devices perf test 6: Fix missing kvm module load for s390 gpio: omap: fix lack of irqstatus_raw0 for OMAP4 gpio: omap: ensure irq is enabled before wakeup regmap: fix bulk writes on paged registers bpf: silence warning messages in core rcu: Force inlining of rcu_read_lock() xfrm: fix sa selector validation perf evsel: Make perf_evsel__name() accept a NULL argument vhost_net: disable zerocopy by default EDAC/sysfs: Fix memory leak when creating a csrow object media: i2c: fix warning same module names ntp: Limit TAI-UTC offset timer_list: Guard procfs specific code acpi/arm64: ignore 5.1 FADTs that are reported as 5.0 media: coda: fix mpeg2 sequence number handling media: coda: increment sequence offset for the last returned frame mt7601u: do not schedule rx_tasklet when the device has been disconnected x86/build: Add 'set -e' to mkcapflags.sh to delete broken capflags.c mt7601u: fix possible memory leak when the device is disconnected ath10k: fix PCIE device wake up failed rslib: Fix decoding of shortened codes rslib: Fix handling of of caller provided syndrome ixgbe: Check DDM existence in transceiver before access EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush() Bluetooth: hci_bcsp: Fix memory leak in rx_skb Bluetooth: 6lowpan: search for destination address in all peers Bluetooth: Check state in l2cap_disconnect_rsp Bluetooth: validate BLE connection interval updates crypto: ghash - fix unaligned memory access in ghash_setkey() crypto: arm64/sha1-ce - correct digest for empty data in finup crypto: arm64/sha2-ce - correct digest for empty data in finup Input: gtco - bounds check collection indent level regulator: s2mps11: Fix buck7 and buck8 wrong voltages tracing/snapshot: Resize spare buffer if size changed NFSv4: Handle the special Linux file open access mode lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE ALSA: seq: Break too long mutex context in the write loop media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom() media: coda: Remove unbalanced and unneeded mutex unlock KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed drm/nouveau/i2c: Enable i2c pads & busses during preinit padata: use smp_mb in padata_reorder to avoid orphaned padata jobs 9p/virtio: Add cleanup path in p9_virtio_init PCI: Do not poll for PME if the device is in D3cold take floppy compat ioctls to sodding floppy.c floppy: fix div-by-zero in setup_format_params floppy: fix out-of-bounds read in next_valid_format floppy: fix invalid pointer dereference in drive_name floppy: fix out-of-bounds read in copy_buffer coda: pass the host file in vma->vm_file on mmap gpu: ipu-v3: ipu-ic: Fix saturation bit offset in TPMEM parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1 powerpc/32s: fix suspend/resume when IBATs 4-7 are used powerpc/watchpoint: Restore NV GPRs while returning from exception eCryptfs: fix a couple type promotion bugs intel_th: msu: Fix single mode with disabled IOMMU Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug usb: Handle USB3 remote wakeup for LPM enabled devices correctly dm bufio: fix deadlock with loop device bnx2x: Prevent load reordering in tx completion processing caif-hsi: fix possible deadlock in cfhsi_exit_module() ipv4: don't set IPv6 only flags to IPv4 addresses net: bcmgenet: use promisc for unsupported filters net: neigh: fix multiple neigh timer scheduling nfc: fix potential illegal memory access sky2: Disable MSI on ASUS P6T netrom: fix a memory leak in nr_rx_frame() netrom: hold sock when setting skb->destructor tcp: Reset bytes_acked and bytes_received when disconnecting bonding: validate ip header before check IPPROTO_IGMP net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling net: bridge: mcast: fix stale ipv6 hdr pointer when handling v6 query net: bridge: stp: don't cache eth dest pointer before skb pull elevator: fix truncation of icq_cache_name NFSv4: Fix open create exclusive when the server reboots nfsd: increase DRC cache limit nfsd: give out fewer session slots as limit approaches nfsd: fix performance-limiting session calculation nfsd: Fix overflow causing non-working mounts on 1 TB machines drm/panel: simple: Fix panel_simple_dsi_probe usb: core: hub: Disable hub-initiated U1/U2 tty: max310x: Fix invalid baudrate divisors calculator pinctrl: rockchip: fix leaked of_node references tty: serial: cpm_uart - fix init when SMC is relocated memstick: Fix error cleanup path of memstick_init tty/serial: digicolor: Fix digicolor-usart already registered warning tty: serial: msm_serial: avoid system lockup condition drm/virtio: Add memory barriers for capset cache. phy: renesas: rcar-gen2: Fix memory leak at error paths usb: gadget: Zero ffs_io_data powerpc/pci/of: Fix OF flags parsing for 64bit BARs PCI: sysfs: Ignore lockdep for remove attribute iio: iio-utils: Fix possible incorrect mask calculation recordmcount: Fix spurious mcount entries on powerpc mfd: core: Set fwnode for created devices mfd: arizona: Fix undefined behavior um: Silence lockdep complaint about mmap_sem powerpc/4xx/uic: clear pending interrupt after irq type/pol change serial: sh-sci: Fix TX DMA buffer flushing and workqueue races kallsyms: exclude kasan local symbols on s390 perf test mmap-thread-lookup: Initialize variable to suppress memory sanitizer warning f2fs: avoid out-of-range memory access mailbox: handle failed named mailbox channel request powerpc/eeh: Handle hugepages in ioremap space sh: prevent warnings when using iounmap mm/kmemleak.c: fix check for softirq context 9p: pass the correct prototype to read_cache_page mm/mmu_notifier: use hlist_add_head_rcu() locking/lockdep: Fix lock used or unused stats error locking/lockdep: Hide unused 'class' variable usb: wusbcore: fix unbalanced get/put cluster_id usb: pci-quirks: Correct AMD PLL quirk detection x86/sysfb_efi: Add quirks for some devices with swapped width and height x86/speculation/mds: Apply more accurate check on hypervisor platform hpet: Fix division by zero in hpet_time_div() ALSA: line6: Fix wrong altsetting for LINE6_PODHD500_1 ALSA: hda - Add a conexant codec entry to let mute led work powerpc/tm: Fix oops on sigreturn on systems without TM access: avoid the RCU grace period for the temporary subjective credentials vmstat: Remove BUG_ON from vmstat_update mm, vmstat: make quiet_vmstat lighter ipv6: check sk sk_type and protocol early in ip_mroute_set/getsockopt tcp: reset sk_send_head in tcp_write_queue_purge ISDN: hfcsusb: checking idx of ep configuration media: cpia2_usb: first wake up, then free in disconnect media: radio-raremono: change devm_k*alloc to k*alloc Bluetooth: hci_uart: check for missing tty operations sched/fair: Don't free p->numa_faults with concurrent readers drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl ceph: hold i_ceph_lock when removing caps for freeing inode Linux 4.4.187 Change-Id: I6086b23376cdf9f6a905f727fb07175a7ebdd356 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * s390/qdio: handle PENDING state for QEBSM devicesJulian Wiedmann2019-08-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 04310324c6f482921c071444833e70fe861b73d9 ] When a CQ-enabled device uses QEBSM for SBAL state inspection, get_buf_states() can return the PENDING state for an Output Queue. get_outbound_buffer_frontier() isn't prepared for this, and any PENDING buffer will permanently stall all further completion processing on this Queue. This isn't a concern for non-QEBSM devices, as get_buf_states() for such devices will manually turn PENDING buffers into EMPTY ones. Fixes: 104ea556ee7f ("qdio: support asynchronous delivery of storage blocks") Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | Merge 4.4.186 into android-4.4-pGreg Kroah-Hartman2019-07-22
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.186 Input: elantech - enable middle button support on 2 ThinkPads samples, bpf: fix to change the buffer size for read() mac80211: mesh: fix RCU warning mwifiex: Fix possible buffer overflows at parsing bss descriptor dt-bindings: can: mcp251x: add mcp25625 support can: mcp251x: add support for mcp25625 Input: imx_keypad - make sure keyboard can always wake up system ARM: davinci: da850-evm: call regulator_has_full_constraints() ARM: davinci: da8xx: specify dma_coherent_mask for lcdc md: fix for divide error in status_resync bnx2x: Check if transceiver implements DDM before access udf: Fix incorrect final NOT_ALLOCATED (hole) extent length x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg() x86/tls: Fix possible spectre-v1 in do_get_thread_area() mwifiex: Abort at too short BSS descriptor element mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies() fscrypt: don't set policy for a dead directory mwifiex: Don't abort on small, spec-compliant vendor IEs USB: serial: ftdi_sio: add ID for isodebug v1 USB: serial: option: add support for GosunCn ME3630 RNDIS mode usb: gadget: ether: Fix race between gether_disconnect and rx_submit usb: renesas_usbhs: add a workaround for a race condition of workqueue staging: comedi: dt282x: fix a null pointer deref on interrupt staging: comedi: amplc_pci230: fix null pointer deref on interrupt carl9170: fix misuse of device driver API VMCI: Fix integer overflow in VMCI handle arrays MIPS: Remove superfluous check for __linux__ e1000e: start network tx queue only when link is up perf/core: Fix perf_sample_regs_user() mm check ARM: omap2: remove incorrect __init annotation be2net: fix link failure after ethtool offline test ppp: mppe: Add softdep to arc4 sis900: fix TX completion dm verity: use message limit for data block corruption message kvm: x86: avoid warning on repeated KVM_SET_TSS_ADDR ARC: hide unused function unw_hdr_alloc s390: fix stfle zero padding s390/qdio: (re-)initialize tiqdio list entries s390/qdio: don't touch the dsci in tiqdio_add_input_queues() KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock Linux 4.4.186 Change-Id: Ib318f4f4b7c21ffdccc7807d8bb26c0b46557129 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * s390/qdio: don't touch the dsci in tiqdio_add_input_queues()Julian Wiedmann2019-07-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit ac6639cd3db607d386616487902b4cc1850a7be5 upstream. Current code sets the dsci to 0x00000080. Which doesn't make any sense, as the indicator area is located in the _left-most_ byte. Worse: if the dsci is the _shared_ indicator, this potentially clears the indication of activity for a _different_ device. tiqdio_thinint_handler() will then have no reason to call that device's IRQ handler, and the device ends up stalling. Fixes: d0c9d4a89fff ("[S390] qdio: set correct bit in dsci") Cc: <stable@vger.kernel.org> Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * s390/qdio: (re-)initialize tiqdio list entriesJulian Wiedmann2019-07-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit e54e4785cb5cb4896cf4285964aeef2125612fb2 upstream. When tiqdio_remove_input_queues() removes a queue from the tiq_list as part of qdio_shutdown(), it doesn't re-initialize the queue's list entry and the prev/next pointers go stale. If a subsequent qdio_establish() fails while sending the ESTABLISH cmd, it calls qdio_shutdown() again in QDIO_IRQ_STATE_ERR state and tiqdio_remove_input_queues() will attempt to remove the queue entry a second time. This dereferences the stale pointers, and bad things ensue. Fix this by re-initializing the list entry after removing it from the list. For good practice also initialize the list entry when the queue is first allocated, and remove the quirky checks that papered over this omission. Note that prior to commit e521813468f7 ("s390/qdio: fix access to uninitialized qdio_q fields"), these checks were bogus anyway. setup_queues_misc() clears the whole queue struct, and thus needs to re-init the prev/next pointers as well. Fixes: 779e6e1c724d ("[S390] qdio: new qdio driver.") Cc: <stable@vger.kernel.org> Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | Merge 4.4.185 into android-4.4-pGreg Kroah-Hartman2019-07-10
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.185 fs/binfmt_flat.c: make load_flat_shared_library() work mm/page_idle.c: fix oops because end_pfn is larger than max_pfn scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck() tracing: Silence GCC 9 array bounds warning gcc-9: silence 'address-of-packed-member' warning usb: chipidea: udc: workaround for endpoint conflict issue Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD apparmor: enforce nullbyte at end of tag string parport: Fix mem leak in parport_register_dev_model parisc: Fix compiler warnings in float emulation code IB/hfi1: Insure freeze_work work_struct is canceled on shutdown MIPS: uprobes: remove set but not used variable 'epc' net: hns: Fix loopback test failed at copper ports sparc: perf: fix updated event period in response to PERF_EVENT_IOC_PERIOD scripts/checkstack.pl: Fix arm64 wrong or unknown architecture scsi: ufs: Check that space was properly alloced in copy_query_response s390/qeth: fix VLAN attribute in bridge_hostnotify udev event hwmon: (pmbus/core) Treat parameters as paged if on multiple pages Btrfs: fix race between readahead and device replace/removal btrfs: start readahead also in seed devices can: flexcan: fix timeout when set small bitrate can: purge socket error queue on sock destruct ARM: imx: cpuidle-imx6sx: Restrict the SW2ISO increase to i.MX6SX Bluetooth: Align minimum encryption key size for LE and BR/EDR connections Bluetooth: Fix regression with minimum encryption key size alignment SMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write cfg80211: fix memory leak of wiphy device name mac80211: drop robust management frames from unknown TA perf ui helpline: Use strlcpy() as a shorter form of strncpy() + explicit set nul perf help: Remove needless use of strncpy() 9p/rdma: do not disconnect on down_interruptible EAGAIN 9p: acl: fix uninitialized iattr access 9p/rdma: remove useless check in cm_event_handler 9p: p9dirent_read: check network-provided name length net/9p: include trans_common.h to fix missing prototype warning. KVM: X86: Fix scan ioapic use-before-initialization ovl: modify ovl_permission() to do checks on two inodes x86/speculation: Allow guests to use SSBD even if host does not cpu/speculation: Warn on unsupported mitigations= parameter sctp: change to hold sk after auth shkey is created successfully tipc: change to use register_pernet_device tipc: check msg->req data len in tipc_nl_compat_bearer_disable team: Always enable vlan tx offload ipv4: Use return value of inet_iif() for __raw_v4_lookup in the while loop bonding: Always enable vlan tx offload net: check before dereferencing netdev_ops during busy poll Bluetooth: Fix faulty expression for minimum encryption key size check um: Compile with modern headers ASoC : cs4265 : readable register too low spi: bitbang: Fix NULL pointer dereference in spi_unregister_master ASoC: max98090: remove 24-bit format support if RJ is 0 usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i] usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC scsi: hpsa: correct ioaccel2 chaining ARC: Assume multiplier is always present ARC: fix build warning in elf.h MIPS: math-emu: do not use bools for arithmetic mfd: omap-usb-tll: Fix register offsets swiotlb: Make linux/swiotlb.h standalone includible bug.h: work around GCC PR82365 in BUG() MIPS: Workaround GCC __builtin_unreachable reordering bug ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME crypto: user - prevent operating on larval algorithms ALSA: seq: fix incorrect order of dest_client/dest_ports arguments ALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages ALSA: usb-audio: fix sign unintended sign extension on left shifts lib/mpi: Fix karactx leak in mpi_powm btrfs: Ensure replaced device doesn't have pending chunk allocation tty: rocket: fix incorrect forward declaration of 'rp_init()' ARC: handle gcc generated __builtin_trap for older compiler arm64, vdso: Define vdso_{start,end} as array KVM: x86: degrade WARN to pr_warn_ratelimited dmaengine: imx-sdma: remove BD_INTR for channel0 Linux 4.4.185 Change-Id: If1b1ee0b61d5f6d6fb162dc446c621d6baebfab9 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * s390/qeth: fix VLAN attribute in bridge_hostnotify udev eventAlexandra Winter2019-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 335726195e460cb6b3f795b695bfd31f0ea70ef0 ] Enabling sysfs attribute bridge_hostnotify triggers a series of udev events for the MAC addresses of all currently connected peers. In case no VLAN is set for a peer, the device reports the corresponding MAC addresses with VLAN ID 4096. This currently results in attribute VLAN=4096 for all non-VLAN interfaces in the initial series of events after host-notify is enabled. Instead, no VLAN attribute should be reported in the udev event for non-VLAN interfaces. Only the initial events face this issue. For dynamic changes that are reported later, the device uses a validity flag. This also changes the code so that it now sets the VLAN attribute for MAC addresses with VID 0. On Linux, no qeth interface will ever be registered with VID 0: Linux kernel registers VID 0 on all network interfaces initially, but qeth will drop .ndo_vlan_rx_add_vid for VID 0. Peers with other OSs could register MACs with VID 0. Fixes: 9f48b9db9a22 ("qeth: bridgeport support - address notifications") Signed-off-by: Alexandra Winter <wintera@linux.ibm.com> Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | Merge 4.4.181 into android-4.4-pGreg Kroah-Hartman2019-06-11
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.181 x86/speculation/mds: Revert CPU buffer clear on double fault exit x86/speculation/mds: Improve CPU buffer clear documentation ARM: exynos: Fix a leaked reference by adding missing of_node_put crypto: vmx - fix copy-paste error in CTR mode crypto: crct10dif-generic - fix use via crypto_shash_digest() crypto: x86/crct10dif-pcl - fix use via crypto_shash_digest() ALSA: usb-audio: Fix a memory leak bug ALSA: hda/hdmi - Consider eld_valid when reporting jack event ALSA: hda/realtek - EAPD turn on later ASoC: max98090: Fix restore of DAPM Muxes ASoC: RT5677-SPI: Disable 16Bit SPI Transfers mm/mincore.c: make mincore() more conservative ocfs2: fix ocfs2 read inode data panic in ocfs2_iget mfd: da9063: Fix OTP control register names to match datasheets for DA9063/63L tty/vt: fix write/write race in ioctl(KDSKBSENT) handler ext4: actually request zeroing of inode table after grow ext4: fix ext4_show_options for file systems w/o journal Btrfs: do not start a transaction at iterate_extent_inodes() bcache: fix a race between cache register and cacheset unregister bcache: never set KEY_PTRS of journal key to 0 in journal_reclaim() ipmi:ssif: compare block number correctly for multi-part return messages crypto: gcm - Fix error return code in crypto_gcm_create_common() crypto: gcm - fix incompatibility between "gcm" and "gcm_base" crypto: chacha20poly1305 - set cra_name correctly crypto: salsa20 - don't access already-freed walk.iv crypto: arm/aes-neonbs - don't access already-freed walk.iv writeback: synchronize sync(2) against cgroup writeback membership switches fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount ext4: zero out the unused memory region in the extent tree block ALSA: hda/realtek - Fix for Lenovo B50-70 inverted internal microphone bug KVM: x86: Skip EFER vs. guest CPUID checks for host-initiated writes net: avoid weird emergency message net/mlx4_core: Change the error print to info print ppp: deflate: Fix possible crash in deflate_init tipc: switch order of device registration to fix a crash tipc: fix modprobe tipc failed after switch order of device registration stm class: Fix channel free in stm output free path md: add mddev->pers to avoid potential NULL pointer dereference intel_th: msu: Fix single mode with IOMMU of: fix clang -Wunsequenced for be32_to_cpu() cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level() media: ov6650: Fix sensor possibly not detected on probe NFS4: Fix v4.0 client state corruption when mount clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider fuse: fix writepages on 32bit fuse: honor RLIMIT_FSIZE in fuse_file_fallocate iommu/tegra-smmu: Fix invalid ASID bits on Tegra30/114 ceph: flush dirty inodes before proceeding with remount tracing: Fix partial reading of trace event's id file memory: tegra: Fix integer overflow on tick value calculation perf intel-pt: Fix instructions sampling rate perf intel-pt: Fix improved sample timestamp perf intel-pt: Fix sample timestamp wrt non-taken branches fbdev: sm712fb: fix brightness control on reboot, don't set SR30 fbdev: sm712fb: fix VRAM detection, don't set SR70/71/74/75 fbdev: sm712fb: fix white screen of death on reboot, don't set CR3B-CR3F fbdev: sm712fb: fix boot screen glitch when sm712fb replaces VGA fbdev: sm712fb: fix crashes during framebuffer writes by correctly mapping VRAM fbdev: sm712fb: fix support for 1024x768-16 mode fbdev: sm712fb: use 1024x768 by default on non-MIPS, fix garbled display fbdev: sm712fb: fix crashes and garbled display during DPMS modesetting PCI: Mark Atheros AR9462 to avoid bus reset dm delay: fix a crash when invalid device is specified xfrm: policy: Fix out-of-bound array accesses in __xfrm_policy_unlink xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module vti4: ipip tunnel deregistration fixes. xfrm4: Fix uninitialized memory read in _decode_session4 KVM: arm/arm64: Ensure vcpu target is unset on reset failure power: supply: sysfs: prevent endless uevent loop with CONFIG_POWER_SUPPLY_DEBUG ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour perf bench numa: Add define for RUSAGE_THREAD if not present Revert "Don't jump to compute_result state from check_result state" md/raid: raid5 preserve the writeback action after the parity check btrfs: Honour FITRIM range constraints during free space trim fbdev: sm712fb: fix memory frequency by avoiding a switch/case fallthrough ext4: do not delete unlinked inode from orphan list on failed truncate KVM: x86: fix return value for reserved EFER bio: fix improper use of smp_mb__before_atomic() Revert "scsi: sd: Keep disk read-only when re-reading partition" crypto: vmx - CTR: always increment IV as quadword gfs2: Fix sign extension bug in gfs2_update_stats Btrfs: fix race between ranged fsync and writeback of adjacent ranges btrfs: sysfs: don't leak memory when failing add fsid fbdev: fix divide error in fb_var_to_videomode hugetlb: use same fault hash key for shared and private mappings fbdev: fix WARNING in __alloc_pages_nodemask bug media: cpia2: Fix use-after-free in cpia2_exit media: vivid: use vfree() instead of kfree() for dev->bitmap_cap ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit at76c50x-usb: Don't register led_trigger if usb_register_driver failed perf tools: No need to include bitops.h in util.h tools include: Adopt linux/bits.h gfs2: Fix lru_count going negative cxgb4: Fix error path in cxgb4_init_module mmc: core: Verify SD bus width powerpc/boot: Fix missing check of lseek() return value ASoC: imx: fix fiq dependencies spi: pxa2xx: fix SCR (divisor) calculation brcm80211: potential NULL dereference in brcmf_cfg80211_vndr_cmds_dcmd_handler() rtc: 88pm860x: prevent use-after-free on device remove w1: fix the resume command API dmaengine: pl330: _stop: clear interrupt status mac80211/cfg80211: update bss channel on channel switch ASoC: fsl_sai: Update is_slave_mode with correct value mwifiex: prevent an array overflow net: cw1200: fix a NULL pointer dereference bcache: return error immediately in bch_journal_replay() bcache: fix failure in journal relplay bcache: add failure check to run_cache_set() for journal replay bcache: avoid clang -Wunintialized warning x86/build: Move _etext to actual end of .text smpboot: Place the __percpu annotation correctly x86/mm: Remove in_nmi() warning from 64-bit implementation of vmalloc_fault() mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC versions HID: logitech-hidpp: use RAP instead of FAP to get the protocol version pinctrl: pistachio: fix leaked of_node references dmaengine: at_xdmac: remove BUG_ON macro in tasklet media: coda: clear error return value before picture run media: ov6650: Move v4l2_clk_get() to ov6650_video_probe() helper media: au0828: stop video streaming only when last user stops media: ov2659: make S_FMT succeed even if requested format doesn't match audit: fix a memory leak bug media: au0828: Fix NULL pointer dereference in au0828_analog_stream_enable() media: pvrusb2: Prevent a buffer overflow powerpc/numa: improve control of topology updates sched/core: Check quota and period overflow at usec to nsec conversion sched/core: Handle overflow in cpu_shares_write_u64 USB: core: Don't unbind interfaces following device reset failure x86/irq/64: Limit IST stack overflow check to #DB stack i40e: don't allow changes to HW VLAN stripping on active port VLANs RDMA/cxgb4: Fix null pointer dereference on alloc_skb failure hwmon: (vt1211) Use request_muxed_region for Super-IO accesses hwmon: (smsc47m1) Use request_muxed_region for Super-IO accesses hwmon: (smsc47b397) Use request_muxed_region for Super-IO accesses hwmon: (pc87427) Use request_muxed_region for Super-IO accesses hwmon: (f71805f) Use request_muxed_region for Super-IO accesses scsi: libsas: Do discovery on empty PHY to update PHY info mmc_spi: add a status check for spi_sync_locked mmc: sdhci-of-esdhc: add erratum eSDHC5 support mmc: sdhci-of-esdhc: add erratum eSDHC-A001 and A-008358 support PM / core: Propagate dev->power.wakeup_path when no callbacks extcon: arizona: Disable mic detect if running when driver is removed s390: cio: fix cio_irb declaration cpufreq: ppc_cbe: fix possible object reference leak cpufreq/pasemi: fix possible object reference leak cpufreq: pmac32: fix possible object reference leak x86/build: Keep local relocations with ld.lld iio: ad_sigma_delta: Properly handle SPI bus locking vs CS assertion iio: hmc5843: fix potential NULL pointer dereferences iio: common: ssp_sensors: Initialize calculated_time in ssp_common_process_data rtlwifi: fix a potential NULL pointer dereference brcmfmac: fix missing checks for kmemdup b43: shut up clang -Wuninitialized variable warning brcmfmac: convert dev_init_lock mutex to completion brcmfmac: fix race during disconnect when USB completion is in progress scsi: ufs: Fix regulator load and icc-level configuration scsi: ufs: Avoid configuring regulator with undefined voltage range arm64: cpu_ops: fix a leaked reference by adding missing of_node_put x86/ia32: Fix ia32_restore_sigcontext() AC leak chardev: add additional check for minor range overlap HID: core: move Usage Page concatenation to Main item ASoC: eukrea-tlv320: fix a leaked reference by adding missing of_node_put ASoC: fsl_utils: fix a leaked reference by adding missing of_node_put cxgb3/l2t: Fix undefined behaviour spi: tegra114: reset controller on probe media: wl128x: prevent two potential buffer overflows virtio_console: initialize vtermno value for ports tty: ipwireless: fix missing checks for ioremap rcutorture: Fix cleanup path for invalid torture_type strings usb: core: Add PM runtime calls to usb_hcd_platform_shutdown scsi: qla4xxx: avoid freeing unallocated dma memory media: m88ds3103: serialize reset messages in m88ds3103_set_frontend media: go7007: avoid clang frame overflow warning with KASAN media: saa7146: avoid high stack usage with clang scsi: lpfc: Fix SLI3 commands being issued on SLI4 devices spi : spi-topcliff-pch: Fix to handle empty DMA buffers spi: rspi: Fix sequencer reset during initialization spi: Fix zero length xfer bug ASoC: davinci-mcasp: Fix clang warning without CONFIG_PM ipv6: Consider sk_bound_dev_if when binding a raw socket to an address llc: fix skb leak in llc_build_and_send_ui_pkt() net-gro: fix use-after-free read in napi_gro_frags() net: stmmac: fix reset gpio free missing usbnet: fix kernel crash after disconnect tipc: Avoid copying bytes beyond the supplied data bnxt_en: Fix aggregation buffer leak under OOM condition. net: mvpp2: fix bad MVPP2_TXQ_SCHED_TOKEN_CNTR_REG queue value crypto: vmx - ghash: do nosimd fallback manually xen/pciback: Don't disable PCI_COMMAND on PCI device reset. Revert "tipc: fix modprobe tipc failed after switch order of device registration" tipc: fix modprobe tipc failed after switch order of device registration -v2 sparc64: Fix regression in non-hypervisor TLB flush xcall include/linux/bitops.h: sanitize rotate primitives xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic() usb: xhci: avoid null pointer deref when bos field is NULL USB: Fix slab-out-of-bounds write in usb_get_bos_descriptor USB: sisusbvga: fix oops in error path of sisusb_probe USB: Add LPM quirk for Surface Dock GigE adapter USB: rio500: refuse more than one device at a time USB: rio500: fix memory leak in close after disconnect media: usb: siano: Fix general protection fault in smsusb media: usb: siano: Fix false-positive "uninitialized variable" warning media: smsusb: better handle optional alignment scsi: zfcp: fix missing zfcp_port reference put on -EBUSY from port_remove scsi: zfcp: fix to prevent port_remove with pure auto scan LUNs (only sdevs) Btrfs: fix race updating log root item during fsync ALSA: hda/realtek - Set default power save node to 0 drm/nouveau/i2c: Disable i2c bus access after ->fini() tty: serial: msm_serial: Fix XON/XOFF tty: max310x: Fix external crystal register setup memcg: make it work on sparse non-0-node systems kernel/signal.c: trace_signal_deliver when signal_group_exit CIFS: cifs_read_allocate_pages: don't iterate through whole page array on ENOMEM binder: Replace "%p" with "%pK" for stable binder: replace "%p" with "%pK" net: create skb_gso_validate_mac_len() bnx2x: disable GSO where gso_size is too big for hardware brcmfmac: Add length checks on firmware events brcmfmac: screening firmware event packet brcmfmac: revise handling events in receive path brcmfmac: fix incorrect event channel deduction brcmfmac: add length checks in scheduled scan result handler brcmfmac: add subtype check for event handling in data path userfaultfd: don't pin the user memory in userfaultfd_file_create() Revert "x86/build: Move _etext to actual end of .text" net: cdc_ncm: GetNtbFormat endian fix usb: gadget: fix request length error for isoc transfer media: uvcvideo: Fix uvc_alloc_entity() allocation alignment ethtool: fix potential userspace buffer overflow neighbor: Call __ipv4_neigh_lookup_noref in neigh_xmit net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query net: rds: fix memory leak in rds_ib_flush_mr_pool pktgen: do not sleep with the thread lock held. rcu: locking and unlocking need to always be at least barriers parisc: Use implicit space register selection for loading the coherence index of I/O pdirs fuse: fallocate: fix return with locked inode MIPS: pistachio: Build uImage.gz by default genwqe: Prevent an integer overflow in the ioctl drm/gma500/cdv: Check vbt config bits when detecting lvds panels fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock fuse: Add FOPEN_STREAM to use stream_open() ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled ethtool: check the return value of get_regs_len Linux 4.4.181 Change-Id: I0c9e7effbb6bd5d1978b4ffad3db3b76af6692bc Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * scsi: zfcp: fix to prevent port_remove with pure auto scan LUNs (only sdevs)Steffen Maier2019-06-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit ef4021fe5fd77ced0323cede27979d80a56211ca upstream. When the user tries to remove a zfcp port via sysfs, we only rejected it if there are zfcp unit children under the port. With purely automatically scanned LUNs there are no zfcp units but only SCSI devices. In such cases, the port_remove erroneously continued. We close the port and this implicitly closes all LUNs under the port. The SCSI devices survive with their private zfcp_scsi_dev still holding a reference to the "removed" zfcp_port (still allocated but invisible in sysfs) [zfcp_get_port_by_wwpn in zfcp_scsi_slave_alloc]. This is not a problem as long as the fc_rport stays blocked. Once (auto) port scan brings back the removed port, we unblock its fc_rport again by design. However, there is no mechanism that would recover (open) the LUNs under the port (no "ersfs_3" without zfcp_unit [zfcp_erp_strategy_followup_success]). Any pending or new I/O to such LUN leads to repeated: Done: NEEDS_RETRY Result: hostbyte=DID_IMM_RETRY driverbyte=DRIVER_OK See also v4.10 commit 6f2ce1c6af37 ("scsi: zfcp: fix rport unblock race with LUN recovery"). Even a manual LUN recovery (echo 0 > /sys/bus/scsi/devices/H:C:T:L/zfcp_failed) does not help, as the LUN links to the old "removed" port which remains to lack ZFCP_STATUS_COMMON_RUNNING [zfcp_erp_required_act]. The only workaround is to first ensure that the fc_rport is blocked (e.g. port_remove again in case it was re-discovered by (auto) port scan), then delete the SCSI devices, and finally re-discover by (auto) port scan. The port scan includes an fc_rport unblock, which in turn triggers a new scan on the scsi target to freshly get new pure auto scan LUNs. Fix this by rejecting port_remove also if there are SCSI devices (even without any zfcp_unit) under this port. Re-use mechanics from v3.7 commit d99b601b6338 ("[SCSI] zfcp: restore refcount check on port_remove"). However, we have to give up zfcp_sysfs_port_units_mutex earlier in unit_add to prevent a deadlock with scsi_host scan taking shost->scan_mutex first and then zfcp_sysfs_port_units_mutex now in our zfcp_scsi_slave_alloc(). Signed-off-by: Steffen Maier <maier@linux.ibm.com> Fixes: b62a8d9b45b9 ("[SCSI] zfcp: Use SCSI device data zfcp scsi dev instead of zfcp unit") Fixes: f8210e34887e ("[SCSI] zfcp: Allow midlayer to scan for LUNs when running in NPIV mode") Cc: <stable@vger.kernel.org> #2.6.37+ Reviewed-by: Benjamin Block <bblock@linux.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * scsi: zfcp: fix missing zfcp_port reference put on -EBUSY from port_removeSteffen Maier2019-06-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit d27e5e07f9c49bf2a6a4ef254ce531c1b4fb5a38 upstream. With this early return due to zfcp_unit child(ren), we don't use the zfcp_port reference from the earlier zfcp_get_port_by_wwpn() anymore and need to put it. Signed-off-by: Steffen Maier <maier@linux.ibm.com> Fixes: d99b601b6338 ("[SCSI] zfcp: restore refcount check on port_remove") Cc: <stable@vger.kernel.org> #3.7+ Reviewed-by: Jens Remus <jremus@linux.ibm.com> Reviewed-by: Benjamin Block <bblock@linux.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>