[PATCH 3.16 102/204] usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Kazuya Mizuguchi commit 29c7f3e68eec4ae94d85ad7b5dfdafdb8089f513 upstream. The DREQE bit of the DnFIFOSEL should be set to 1 after the DE bit of USB-DMAC on R-Car SoCs is set to 1 after the US

[PATCH 3.16 106/204] iommu/exynos: Remove initconst attribute to avoid potential kernel oops

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Marek Szyprowski commit 9d25e3cc83d731ae4eeb017fd07562fde3f80bef upstream. Exynos SYSMMU registers standard platform device with sysmmu_of_match table, what means that this table is accessed e

[PATCH 3.2 30/94] packet: only test po->has_vnet_hdr once in packet_snd

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Willem de Bruijn commit da7c9561015e93d10fe6aab73e9288e0d09d65a6 upstream. Packet socket option po->has_vnet_hdr can be updated concurrently with other operations if no ring is attached. Do no

[PATCH 3.16 112/204] ecryptfs: fix dereference of NULL user_key_payload

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Eric Biggers commit f5c09ab489a11ca490d6a82df57cfc1bea3e upstream. In eCryptfs, we failed to verify that the authentication token keys are not revoked before dereferencing their payloads,

[PATCH 3.16 111/204] lib/digsig: fix dereference of NULL user_key_payload

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Eric Biggers commit 192cabd6a296cbc57b3d8c05c4c89d87fc102506 upstream. digsig_verify() requests a user key, then accesses its payload. However, a revoked key has a NULL payload, and we failed

[PATCH 3.16 109/204] KEYS: encrypted: fix dereference of NULL user_key_payload

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Eric Biggers commit 13923d0865ca96312197962522e88bc0aedccd74 upstream. A key of type "encrypted" references a "master key" which is used to encrypt and decrypt the encrypted key's payload. Ho

[PATCH 3.16 006/204] spi: uapi: spidev: add missing ioctl header

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Baruch Siach commit a2b4a79b88b24c49d98d45a06a014ffd22ada1a4 upstream. The SPI_IOC_MESSAGE() macro references _IOC_SIZEBITS. Add linux/ioctl.h to make sure this macro is defined. This fixes th

[PATCH 3.16 103/204] usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Andrew Gabbasov commit aec17e1e249567e82b26dafbb86de7d07fde8729 upstream. KASAN enabled configuration reports an error BUG: KASAN: use-after-free in usb_composite_overwrite_options+...

[PATCH 3.16 110/204] FS-Cache: fix dereference of NULL user_key_payload

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Eric Biggers commit d124b2c53c7bee6569d2a2d0b18b4a1afde00134 upstream. When the file /proc/fs/fscache/objects (available with CONFIG_FSCACHE_OBJECT_LIST=y) is opened, we request a user key wit

[PATCH 3.16 007/204] scsi: lpfc: Don't return internal MBXERR_ERROR code from probe function

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Stefano Brivio commit 5c756065e47dc3e84b00577bd109f0a8e69903d7 upstream. Internal error codes happen to be positive, thus the PCI driver core won't treat them as failure, but we do. This would

[PATCH 3.16 097/204] workqueue: replace pool->manager_arb mutex with a flag

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Tejun Heo commit 692b48258dda7c302e777d7d5f4217244478f1f6 upstream. Josef reported a HARDIRQ-safe -> HARDIRQ-unsafe lock order detected by lockdep: [ 1270.472259] WARNING: HARDIRQ-safe -> HA

[PATCH 3.16 108/204] bus: mbus: fix window size calculation for 4GB windows

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Jan Luebbe commit 2bbbd96357ce76cc45ec722c00f654aa7b189112 upstream. At least the Armada XP SoC supports 4GB on a single DRAM window. Because the size register values contain the actual size -

[PATCH 3.16 082/204] scsi: sd: Implement blacklist option for WRITE SAME w/ UNMAP

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: "Martin K. Petersen" commit 28a0bc4120d38a394499382ba21d6965a67a3703 upstream. SBC-4 states: "A MAXIMUM UNMAP LBA COUNT field set to a non-zero value indicates the maximum number of LBAs

[PATCH 3.16 096/204] udp: fix bcast packet reception

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Paolo Abeni commit 996b44fcef8f216ea0b6b6e74468c5a77b5e341f upstream. The commit bc044e8db796 ("udp: perform source validation for mcast early demux") does not take into account that broadcast

[PATCH 3.16 113/204] iommu/amd: Finish TLB flush in amd_iommu_unmap()

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Joerg Roedel commit ce76353f169a6471542d999baf3d29b121dce9c0 upstream. The function only sends the flush command to the IOMMU(s), but does not wait for its completion when it returns. Fix that

[PATCH 3.16 107/204] KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Haozhong Zhang commit 8eb3f87d903168bdbd1222776a6b1e281f50513e upstream. When KVM emulates an exit from L2 to L1, it loads L1 CR4 into the guest CR4. Before this CR4 loading, the guest CR4 ref

[PATCH 3.16 078/204] l2tp: fix l2tp_eth module loading

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Guillaume Nault commit 9f775ead5e570e7e19015b9e4e2f3dd6e71a5935 upstream. The l2tp_eth module crashes if its netlink callbacks are run when the pernet data aren't initialised. We should norma

[PATCH 3.16 075/204] ipv4: fix broadcast packets reception

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Paolo Abeni commit ad0ea1989cc4d5905941d0a9e62c63ad6d859cef upstream. Currently, ingress ipv4 broadcast datagrams are dropped since, in udp_v4_early_demux(), ip_check_mc_rcu() is invoked even

[PATCH 3.16 080/204] brcmfmac: Add check for short event packets

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Kevin Cernekee commit dd2349121bb1b8ff688c3ca6a2a0bea9d8c142ca upstream. The length of the data in the received skb is currently passed into brcmf_fweh_process_event() as packet_len, but this

[PATCH 3.16 079/204] brcmfmac: Add length checks on firmware events

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Hante Meuleman commit 0aedbcaf6f182690790d98d90d5fe1e64c846c34 upstream. Add additional length checks on firmware events to create more robust code. Reviewed-by: Arend Van Spriel Reviewed-by

[PATCH 3.16 083/204] USB: serial: qcserial: add Dell DW5818, DW5819

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Shrirang Bagul commit f5d9644c5fca7d8e8972268598bb516a7eae17f9 upstream. Dell Wireless 5819/5818 devices are re-branded Sierra Wireless MC74 series which will by default boot with vid 0x413c a

[PATCH 3.16 074/204] staging: iio: ade7759: fix signed extension bug on shift of a u8

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Colin Ian King commit 13ffe9a26df4e156363579b25c904dd0b1e31bfb upstream. The current shift of st->rx[2] left shifts a u8 24 bits left, promotes the integer to a an int and then to a unsigned u

[PATCH 3.16 076/204] IPv4: early demux can return an error code

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Paolo Abeni commit 7487449c86c65202b3b725c4524cb48dd65e4e6f upstream. Currently no error is emitted, but this infrastructure will used by the next patch to allow source address validation for

[PATCH 3.16 064/204] Revert "IB/ipoib: Update broadcast object if PKey value was changed in index 0"

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Alex Estrin commit 612601d0013f03de9dc134809f242ba6da9ca252 upstream. commit 9a9b8112699d will cause core to fail UD QP from being destroyed on ipoib unload, therefore cause resources leakage.

[PATCH 3.16 065/204] USB: dummy-hcd: fix connection failures (wrong speed)

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit fe659bcc9b173bcfdd958ce2aec75e47651e74e1 upstream. The dummy-hcd UDC driver is not careful about the way it handles connection speeds. It ignores the module parameter that i

[PATCH 3.16 093/204] nl80211: Define policy for packet pattern attributes

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Peng Xu commit ad670233c9e1d5feb365d870e30083ef1b889177 upstream. Define a policy for packet pattern attributes in order to fix a potential read over the end of the buffer during nla_get_u32()

[PATCH 3.16 061/204] netfilter: ipset: pernet ops must be unregistered last

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Florian Westphal commit e23ed762db7ed1950a6408c3be80bc56909ab3d4 upstream. Removing the ipset module leaves a small window where one cpu performs module removal while another runs a command li

[PATCH 3.16 066/204] USB: dummy-hcd: fix infinite-loop resubmission bug

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit 0173a68bfb0ad1c72a6ee39cc485aa2c97540b98 upstream. The dummy-hcd HCD/UDC emulator tries not to do too much work during each timer interrupt. But it doesn't try very hard; cu

[PATCH 3.16 069/204] usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Yoshihiro Shimoda commit 6124607acc88fffeaadf3aacfeb3cc1304c87387 upstream. This patch fixes an issue that the driver sets the BCLR bit of {C,Dn}FIFOCTR register to 1 even when it's non-DCP pi

[PATCH 3.16 060/204] l2tp: fix race condition in l2tp_tunnel_delete

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Sabrina Dubroca commit 62b982eeb4589b2e6d7c01a90590e3a4c2b2ca19 upstream. If we try to delete the same tunnel twice, the first delete operation does a lookup (l2tp_tunnel_get), finds the tunne

[PATCH 3.16 070/204] usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Yoshihiro Shimoda commit 0a2ce62b61f2c76d0213edf4e37aaf54a8ddf295 upstream. This patch fixes an issue that the usbhsf_fifo_clear() is possible to cause 10 msec delay if the pipe is RX directio

[PATCH 3.16 056/204] Btrfs: fix incorrect {node,sector}size endianness from BTRFS_IOC_FS_INFO

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Omar Sandoval commit bea7eafdbda3ba1d4b2ccb9cca829eefb7989bb9 upstream. fs_info->super_copy->{node,sector}size are little-endian, but the ioctl should return the values in native endianness. U

[PATCH 3.16 063/204] arm64: Make sure SPsel is always set

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Marc Zyngier commit 5371513fb338fb9989c569dc071326d369d6ade8 upstream. When the kernel is entered at EL2 on an ARMv8.0 system, we construct the EL1 pstate and make sure this uses the the EL1 s

[PATCH 3.16 048/204] KEYS: fix key refcount leak in keyctl_assume_authority()

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Eric Biggers commit 884bee0215fcc239b30c062c37ca29077005e064 upstream. In keyctl_assume_authority(), if keyctl_change_reqkey_auth() were to fail, we would leak the reference to the 'authkey'.

[PATCH 3.16 041/204] iio: adc: mcp320x: Fix oops on module unload

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Lukas Wunner commit 0964e40947a630a2a6f724e968246992f97bcf1c upstream. The driver calls spi_get_drvdata() in its ->remove hook even though it has never called spi_set_drvdata(). Stack trace f

[PATCH 3.16 034/204] usb-storage: fix bogus hardware error messages for ATA pass-thru devices

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit a4fd4a724d6c30ad671046d83be2e9be2f11d275 upstream. Ever since commit a621bac3044e ("scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands"), people have been gett

[PATCH 3.16 046/204] KEYS: fix cred refcount leak in request_key_auth_new()

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Eric Biggers commit 44d8143340a99b167c74365e844516b73523c087 upstream. In request_key_auth_new(), if key_alloc() or key_instantiate_and_link() were to fail, we would leak a reference to the 's

[PATCH 3.16 037/204] USB: gadgetfs: Fix crash caused by inadequate synchronization

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit 520b72fc64debf8a86c3853b8e486aa5982188f0 upstream. The gadgetfs driver (drivers/usb/gadget/legacy/inode.c) was written before the UDC and composite frameworks were adopted; i

[PATCH 3.16 032/204] Input: uinput - avoid FF flush when destroying device

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Dmitry Torokhov commit e8b95728f724797f958912fd9b765a695595d3a6 upstream. Normally, when input device supporting force feedback effects is being destroyed, we try to "flush" currently playing

[PATCH 3.16 031/204] net_sched: always reset qdisc backlog in qdisc_reset()

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Konstantin Khlebnikov commit c8e1812960eeae42e2183154927028511c4bc566 upstream. SKB stored in qdisc->gso_skb also counted into backlog. Some qdiscs don't reset backlog to zero in ->reset(), f

[PATCH 3.16 068/204] USB: dummy-hcd: Fix erroneous synchronization change

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 upstream. A recent change to the synchronization in dummy-hcd was incorrect. The issue was that dummy_udc_stop() contained no locking

[PATCH 3.16 058/204] drm/i915/bios: ignore HDMI on port A

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Jani Nikula commit 2ba7d7e0437127314864238f8bfcb8369d81075c upstream. The hardware state readout oopses after several warnings when trying to use HDMI on port A, if such a combination is confi

[PATCH 3.16 016/204] s390/mm: fix write access check in gup_huge_pmd()

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Gerald Schaefer commit ba385c0594e723d41790ecfb12c610e6f90c7785 upstream. The check for the _SEGMENT_ENTRY_PROTECT bit in gup_huge_pmd() is the wrong way around. It must not be set for write==

[PATCH 3.16 204/204] KEYS: add missing permission check for request_key() destination

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Eric Biggers commit 4dca6ea1d9432052afb06baf2e3ae78188a4410b upstream. When the request_key() syscall is not passed a destination keyring, it links the requested key (if constructed) into the

[PATCH 3.16 015/204] ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Xin Long commit 76cc0d3282d4b933fa144fa41fbc5318e0fdca24 upstream. Now in ip6gre_header before packing the ipv6 header, it skb_push t->hlen which only includes encap_hlen + tun_hlen. It means

[PATCH 3.16 009/204] USB: serial: option: add support for TP-Link LTE module

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Henryk Heisig commit 837ddc4793a69b256ac5e781a5e729b448a8d983 upstream. This commit adds support for TP-Link LTE mPCIe module is used in in TP-Link MR200v1, MR6400v1 and v2 routers. Signed-of

[PATCH 3.16 000/204] 3.16.52-rc1 review

This is the start of the stable review cycle for the 3.16.52 release. There are 204 patches in this series, which will be posted as responses to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon Jan 1 17:00:00 UTC 2018. Anything rece

[PATCH 3.16 020/204] tracing: Fix trace_pipe behavior for instance traces

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Tahsin Erdogan commit 75df6e688ccd517e339a7c422ef7ad73045b18a2 upstream. When reading data from trace_pipe, tracing_wait_pipe() performs a check to see if tracing has been turned off after som

[PATCH 3.16 027/204] cifs: release cifs root_cred after exit_cifs

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Shu Wang commit 94183331e815617246b1baa97e0916f358c794bb upstream. memory leak was found by kmemleak. exit_cifs_spnego should be called before cifs module removed, or cifs root_cred will not b

[PATCH 3.16 035/204] usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit 113f6eb6d50cfa5e2a1cdcf1678b12661fa272ab upstream. Kris Lindgren reports that without the NO_WP_DETECT flag, his Seagate external disk drive fails all write accesses. This r

[PATCH 3.16 013/204] xhci: fix finding correct bus_state structure for USB 3.1 hosts

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Mathias Nyman commit 5a838a13c9b4e5dd188b7a6eaeb894e9358ead0c upstream. xhci driver keeps a bus_state structure for each hcd (usb2 and usb3) The structure is picked based on hcd speed, but dr

[PATCH 3.16 014/204] usb: pci-quirks.c: Corrected timeout values used in handshake

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Jim Dickerson commit 114ec3a6f9096d211a4aff4277793ba969a62c73 upstream. Servers were emitting failed handoff messages but were not waiting the full 1 second as designated in section 4.22.1 of

[PATCH 3.16 012/204] usb: Increase quirk delay for USB devices

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Dmitry Fleytman commit b2a542bbb3081dbd64acc8929c140d196664c406 upstream. Commit e0429362ab15 ("usb: Add device quirk for Logitech HD Pro Webcams C920 and C930e") introduced quirk to workaroun

[PATCH 3.16 008/204] USB: serial: ftdi_sio: add id for Cypress WICED dev board

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Jeffrey Chu commit a6c215e21b0dc5fe9416dce90f9acc2ea53c4502 upstream. Add CYPRESS_VID vid and CYPRESS_WICED_BT_USB and CYPRESS_WICED_WL_USB device IDs to ftdi_sio driver. Signed-off-by: Jeffr

[PATCH 3.16 001/204] tile: array underflow in setup_maxnodemem()

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Dan Carpenter commit 637f23abca87d26e091e0d6647ec878d97d2c6cd upstream. My static checker correctly complains that we should have a lower bound on "node" to prevent an array underflow. Fixes:

[PATCH 3.16 005/204] HID: i2c-hid: allocate hid buffers for real worst case

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Adrian Salido commit 8320caeeffdefec3b58b9d4a7ed8e1079492fe7b upstream. The buffer allocation is not currently accounting for an extra byte for the report id. This can cause an out of bounds a

[PATCH 3.2 39/94] sh: sh7722: remove nonexistent GPIO_PTQ7 to fix pinctrl registration

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Geert Uytterhoeven commit b78412b8300a8453b78d2c1b0b925b66493bb011 upstream. Patch series "sh: sh7722/sh7757i/sh7264/sh7269: Fix pinctrl registration", v2. Magnus Damm reported that on sh7722/

[PATCH 3.2 40/94] sh: sh7757: remove nonexistent GPIO_PT[JLNQ]7_RESV to fix pinctrl registration

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Geert Uytterhoeven commit d8ce38f69843a56da044e56b6c16aecfbc3c6e39 upstream. Commit 3810e96056ff ("sh: modify pinmux for SH7757 2nd cut") renamed GPIO_PT[JLNQ]7 to GPIO_PT[JLNQ]7_RESV, and remo

[PATCH 3.2 21/94] KEYS: fix key refcount leak in keyctl_assume_authority()

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Eric Biggers commit 884bee0215fcc239b30c062c37ca29077005e064 upstream. In keyctl_assume_authority(), if keyctl_change_reqkey_auth() were to fail, we would leak the reference to the 'authkey'.

[PATCH 3.16 002/204] ASoC: adau17x1: Workaround for noise bug in ADC

3.16.52-rc1 review patch. If anyone has any objections, please let me know. -- From: Ricard Wanderlof commit 1e6f4fc06f6411adf98bbbe7fcd79442cd2b2a75 upstream. The ADC in the ADAU1361 (and possibly other Analog Devices codecs) exhibits a cyclic variation in the noise floor (in

Re: [PATCH 2/4] PCI/DPC/AER: Address Concurrency between AER and DPC

: https://github.com/0day-ci/linux/commits/Oza-Pawandeep/Address-error-and-recovery-for-AER-and-DPC/20171228-222058 config: x86_64-randconfig-r0-12282251 (attached as .config) compiler: gcc-6 (Debian 6.4.0-9) 6.4.0 20171026 reproduce: # save the attached .config to linux build tree

[PATCH 3.2 35/94] l2tp: fix l2tp_eth module loading

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Guillaume Nault commit 9f775ead5e570e7e19015b9e4e2f3dd6e71a5935 upstream. The l2tp_eth module crashes if its netlink callbacks are run when the pernet data aren't initialised. We should normal

[PATCH 3.2 72/94] ocfs2: fstrim: Fix start offset of first cluster group during fstrim

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Ashish Samant commit 105ddc93f06ebe3e553f58563d11ed63dbcd59f0 upstream. The first cluster group descriptor is not stored at the start of the group but at an offset from the start. We need to t

[PATCH 3.2 26/94] USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit f16443a034c7aa359ddf6f0f9bc40d01ca31faea upstream. Using the syzkaller kernel fuzzer, Andrey Konovalov generated the following error in gadgetfs: > BUG: KASAN: use-after-free

[PATCH 3.2 27/94] USB: dummy-hcd: Fix erroneous synchronization change

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 upstream. A recent change to the synchronization in dummy-hcd was incorrect. The issue was that dummy_udc_stop() contained no locking

[PATCH 3.2 22/94] KEYS: fix key refcount leak in keyctl_read_key()

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Eric Biggers commit 7fc0786d956d9e59b68d282be9b156179846ea3d upstream. In keyctl_read_key(), if key_permission() were to return an error code other than EACCES, we would leak a the reference to

[PATCH 3.2 51/94] KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Haozhong Zhang commit 8eb3f87d903168bdbd1222776a6b1e281f50513e upstream. When KVM emulates an exit from L2 to L1, it loads L1 CR4 into the guest CR4. Before this CR4 loading, the guest CR4 refe

[PATCH 3.2 81/94] x86/oprofile/ppro: Do not use __this_cpu*() in preemptible context

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Borislav Petkov commit a743bbeef27b9176987ec0cb7f906ab0ab52d1da upstream. The warning below says it all: BUG: using __this_cpu_read() in preemptible [] code: swapper/0/1 caller is

[PATCH 3.2 20/94] KEYS: don't revoke uninstantiated key in request_key_auth_new()

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Eric Biggers commit f7b48cf08fa63a68b59c2894806ee478216d7f91 upstream. If key_instantiate_and_link() were to fail (which fortunately isn't possible currently), the call to key_revoke(authkey) w

[PATCH 3.2 44/94] ALSA: seq: Fix copy_from_user() call inside lock

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Takashi Iwai commit 5803b023881857db32ffefa0d269c90280a67ee0 upstream. The event handler in the virmidi sequencer code takes a read-lock for the linked list traverse, while it's calling snd_seq

[PATCH 3.2 23/94] KEYS: prevent creating a different user's keyrings

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Eric Biggers commit 237bbd29f7a049d310d907f4b2716a7feef9abf3 upstream. It was possible for an unprivileged user to create the user and user session keyrings for another user. For example:

[PATCH 3.2 82/94] MIPS: AR7: Ensure that serial ports are properly set up

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Oswald Buddenhagen commit b084116f8587b222a2c5ef6dcd846f40f24b9420 upstream. Without UPF_FIXED_TYPE, the data from the PORT_AR7 uart_config entry is never copied, resulting in a dead port. Fix

[PATCH 3.2 41/94] Smack: remove unneeded NULL-termination from securtity label

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Konstantin Khlebnikov commit da1b63566c469bf3e2b24182114422e16b1aa34c upstream. Values of extended attributes are stored as binary blobs. NULL-termination of them isn't required. It just wastes

[PATCH 3.2 48/94] usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Kazuya Mizuguchi commit 29c7f3e68eec4ae94d85ad7b5dfdafdb8089f513 upstream. The DREQE bit of the DnFIFOSEL should be set to 1 after the DE bit of USB-DMAC on R-Car SoCs is set to 1 after the USB

[PATCH 3.2 24/94] vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Andreas Gruenbacher commit fc46820b27a2d9a46f7e90c9ceb4a64a1bc5fab8 upstream. In generic_file_llseek_size, return -ENXIO for negative offsets as well as offsets beyond EOF. This affects filesy

[PATCH 3.2 29/94] usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Yoshihiro Shimoda commit 0a2ce62b61f2c76d0213edf4e37aaf54a8ddf295 upstream. This patch fixes an issue that the usbhsf_fifo_clear() is possible to cause 10 msec delay if the pipe is RX direction

[PATCH 3.2 28/94] usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Yoshihiro Shimoda commit 6124607acc88fffeaadf3aacfeb3cc1304c87387 upstream. This patch fixes an issue that the driver sets the BCLR bit of {C,Dn}FIFOCTR register to 1 even when it's non-DCP pip

[PATCH 3.2 57/94] net: enable interface alias removal via rtnl

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Nicolas Dichtel commit 2459b4c635858094df78abb9ca87d99f89fe8ca5 upstream. IFLA_IFALIAS is defined as NLA_STRING. It means that the minimal length of the attribute is 1 ("\0"). However, to remov

[PATCH 3.2 83/94] dccp: CVE-2017-8824: use-after-free in DCCP code

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Mohamed Ghannam commit 69c64866ce072dea1d1e59a0d61e0f66c0dffb76 upstream. Whenever the sock object is in DCCP_CLOSED state, dccp_disconnect() must free dccps_hc_tx_ccid and dccps_hc_rx_ccid and

[PATCH 3.2 38/94] kernel/params.c: align add_sysfs_param documentation with code

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Jean Delvare commit 630cc2b30a42c70628368a412beb4a5e5dd71abe upstream. This parameter is named kp, so the documentation should use that. Fixes: 9b473de87209 ("param: Fix duplicate module prefi

[PATCH 3.2 73/94] l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv()

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Guillaume Nault commit a3c18422a4b4e108bcf6a2328f48867e1003fd95 upstream. Socket must be held while under the protection of the l2tp lock; there is no guarantee that sk remains valid after the

[PATCH 3.2 42/94] lsm: fix smack_inode_removexattr and xattr_getsecurity memleak

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Casey Schaufler commit 57e7ba04d422c3d41c8426380303ec9b7533ded9 upstream. security_inode_getsecurity() provides the text string value of a security attribute. It does not provide a "secctx". Th

[PATCH 3.2 34/94] staging: iio: ade7759: fix signed extension bug on shift of a u8

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Colin Ian King commit 13ffe9a26df4e156363579b25c904dd0b1e31bfb upstream. The current shift of st->rx[2] left shifts a u8 24 bits left, promotes the integer to a an int and then to a unsigned u6

[PATCH 3.2 25/94] USB: dummy-hcd: fix infinite-loop resubmission bug

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit 0173a68bfb0ad1c72a6ee39cc485aa2c97540b98 upstream. The dummy-hcd HCD/UDC emulator tries not to do too much work during each timer interrupt. But it doesn't try very hard; cur

[PATCH 3.2 64/94] l2tp: hold tunnel in pppol2tp_connect()

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Guillaume Nault commit f9e56baf03f9d36043a78f16e3e8b2cfd211e09e upstream. Use l2tp_tunnel_get() in pppol2tp_connect() to ensure the tunnel isn't going to disappear while processing the rest of

[PATCH 3.2 63/94] sctp: fix a type cast warnings that causes a_rwnd gets the wrong value

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Xin Long commit f6fc6bc0b8e0bb13a210bd7386ffdcb1a5f30ef1 upstream. These warnings were found by running 'make C=2 M=net/sctp/'. Commit d4d6fb5787a6 ("sctp: Try not to change a_rwnd when faking

[PATCH 3.2 67/94] macvtap: fix TUNSETSNDBUF values > 64k

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: "Michael S. Tsirkin" commit 3ea79249e81e5ed051f2e6480cbde896d99046e8 upstream. Upon TUNSETSNDBUF, macvtap reads the requested sndbuf size into a local variable u. commit 39ec7de7092b ("macvtap

[PATCH 3.2 50/94] scsi: libiscsi: fix shifting of DID_REQUEUE host byte

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Johannes Thumshirn commit eef9ffdf9cd39b2986367bc8395e2772bc1284ba upstream. The SCSI host byte should be shifted left by 16 in order to have scsi_decide_disposition() do the right thing (.i.e.

[PATCH 3.2 68/94] tun/tap: sanitize TUNSETSNDBUF input

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Craig Gallek commit 93161922c658c714715686cd0cf69b090cb9bf1d upstream. Syzkaller found several variants of the lockup below by setting negative values with the TUNSETSNDBUF ioctl. This patch a

[PATCH 3.2 75/94] l2tp: don't use l2tp_tunnel_find() in l2tp_ip and l2tp_ip6

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Guillaume Nault commit 8f7dc9ae4a7aece9fbc3e6637bdfa38b36bcdf09 upstream. Using l2tp_tunnel_find() in l2tp_ip_recv() is wrong for two reasons: * It doesn't take a reference on the returned t

[PATCH 3.2 74/94] l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Guillaume Nault commit 94d7ee0baa8b764cf64ad91ed69464c1a6a0066b upstream. The code following l2tp_tunnel_find() expects that a new reference is held on sk. Either sk_receive_skb() or the discar

[PATCH 3.2 56/94] l2tp: check ps->sock before running pppol2tp_session_ioctl()

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Guillaume Nault commit 5903f594935a3841137c86b9d5b75143a5b7121c upstream. When pppol2tp_session_ioctl() is called by pppol2tp_tunnel_ioctl(), the session may be unconnected. That is, it was cre

[PATCH 3.2 45/94] crypto: shash - Fix zero-length shash ahash digest crash

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Herbert Xu commit b61907bb42409adf9b3120f741af7c57dd7e3db2 upstream. The shash ahash digest adaptor function may crash if given a zero-length input together with a null SG list. This is becaus

[PATCH 3.2 37/94] scsi: sd: Implement blacklist option for WRITE SAME w/ UNMAP

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: "Martin K. Petersen" commit 28a0bc4120d38a394499382ba21d6965a67a3703 upstream. SBC-4 states: "A MAXIMUM UNMAP LBA COUNT field set to a non-zero value indicates the maximum number of LBAs

[PATCH 3.2 08/94] usb: Increase quirk delay for USB devices

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Dmitry Fleytman commit b2a542bbb3081dbd64acc8929c140d196664c406 upstream. Commit e0429362ab15 ("usb: Add device quirk for Logitech HD Pro Webcams C920 and C930e") introduced quirk to workaround

[PATCH 3.2 59/94] usb: cdc_acm: Add quirk for Elatec TWN3

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Maksim Salau commit 765fb2f181cad669f2beb87842a05d8071f2be85 upstream. Elatec TWN3 has the union descriptor on data interface. This results in failure to bind the device to the driver with the

[PATCH 3.2 47/94] USB: dummy-hcd: Fix deadlock caused by disconnect detection

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit ab219221a5064abfff9f78c323c4a257b16cdb81 upstream. The dummy-hcd driver calls the gadget driver's disconnect callback under the wrong conditions. It should invoke the callbac

[PATCH 3.2 49/94] ALSA: caiaq: Fix stray URB at probe error path

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Takashi Iwai commit 99fee508245825765ff60155fed43f970ff83a8f upstream. caiaq driver doesn't kill the URB properly at its error path during the probe, which may lead to a use-after-free error la

[PATCH 3.2 43/94] kvm/x86: Avoid async PF preempting the kernel incorrectly

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Boqun Feng commit a2b7861bb33b2538420bb5d8554153484d3f961f upstream. Currently, in PREEMPT_COUNT=n kernel, kvm_async_pf_task_wait() could call schedule() to reschedule in some cases. This coul

[PATCH 3.2 31/94] sched/sysctl: Check user input value of sysctl_sched_time_avg

3.2.97-rc1 review patch. If anyone has any objections, please let me know. -- From: Ethan Zhao commit 5ccba44ba118a500050076b0344632459779 upstream. System will hang if user set sysctl_sched_time_avg to 0: [root@XXX ~]# sysctl kernel.sched_time_avg_ms=0 Stack traceba

<    1   2   3   4   5   6   7   8   9   >