Re: [PATCH stable-4.4.y] KVM: VMX: Fix x2apic check in vmx_msr_bitmap_mode()

On Thu, Feb 21, 2019 at 03:15:30PM +0100, Greg Kroah-Hartman wrote: > Ugh, good catch! > > Any hint as to what type of testing that you did that caught this? I > keep asking people to run some kvm tests, but so far no one is :( We caught this at SUSE while testing candidate kernel updates for on

[PATCH 4.14 08/23] net: crypto set sk to NULL when af_alg_release.

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Mao Wenan [ Upstream commit 9060cb719e61b685ec0102574e10337fa5f445ea ] KASAN has found use-after-free in sockfs_setattr. The existed commit 6d8c50dcb029 ("socket: close race condition between

[PATCH 4.9 05/20] net: phy: xgmiitorgmii: Support generic PHY status read

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Paul Kocialkowski [ Upstream commit 197f9ab7f08ce4b9ece662f747c3991b2f0fbb57 ] Some PHY drivers like the generic one do not provide a read_status callback on their own but rely on genphy_read_s

[PATCH 4.19 24/30] mmc: meson-gx: fix interrupt name

4.19-stable review patch. If anyone has any objections, please let me know. -- From: Martin Blumenstingl commit 83e418a805d880a8b18add07f94d19b2a5a80307 upstream. Commit bb364890323cca ("mmc: meson-gx: Free irq in release() callback") changed the _probe code to use request_thr

[PATCH 3.18 04/13] tcp: clear icsk_backoff in tcp_write_queue_purge()

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 04c03114be82194d4a4858d41dba8e286ad1787c ] soukjin bae reported a crash in tcp_v4_err() handling ICMP_DEST_UNREACH after tcp_write_queue_head(sk) returned a NULL

[PATCH 4.20 24/32] PCI: Fix __initdata issue with "pci=disable_acs_redir" parameter

4.20-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit d2fd6e81912a665993b24dcdc1c1384a42a54f7e ] The disable_acs_redir parameter stores a pointer to the string passed to pci_setup(). However, the string passed to PCI setup is actually

[PATCH 4.19 16/30] vxlan: test dev->flags & IFF_UP before calling netif_rx()

4.19-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 4179cb5a4c924cd233eaadd081882425bc98f44e ] netif_rx() must be called under a strict contract. At device dismantle phase, core networking clears IFF_UP and flush_all_backlogs() is ca

[PATCH 4.9 03/20] hwmon: (lm80) Fix missing unlock on error in set_fan_div()

4.9-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 07bd14ccc3049f9c0147a91a4227a571f981601a ] Add the missing unlock before return from function set_fan_div() in the error handling case. Fixes: c9c63915519b ("hwmon: (lm80) fix a miss

Re: [PATCH 5/6] lib: Fix function documentation for strncpy_from_user

On Thu, Feb 21, 2019 at 2:05 AM Kees Cook wrote: > On Mon, Feb 18, 2019 at 4:52 PM Jann Horn wrote: > > AFAICS the byte_at_a_time loop exits when max==0 is reached, and then > > if `res >= count` (in other words, if we've copied as many bytes as > > requested, haven't encountered a null byte so f

[PATCH 4.19 13/30] sky2: Increase D3 delay again

4.19-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 1765f5dcd00963e33f1b8a4e0f34061fbc0e2f7f ] Another platform requires even longer delay to make the device work correctly after S3. So increase the delay to 300ms. BugLink: https://

[PATCH 4.19 15/30] vsock: cope with memory allocation failure at socket creation time

4.19-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 225d9464268599a5b4d094d02ec17808e44c7553 ] In the unlikely event that the kmalloc call in vmci_transport_socket_init() fails, we end-up calling vmci_transport_destruct() with a NULL

[PATCH 4.19 01/30] af_packet: fix raw sockets over 6in4 tunnel

4.19-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 88a8121dc1d3d0dbddd411b79ed236b6b6ea415c ] Since commit cb9f1b783850, scapy (which uses an AF_PACKET socket in SOCK_RAW mode) is unable to send a basic icmp packet over a sit tunnel:

[PATCH 4.14 03/23] net: ipv4: use a dedicated counter for icmp_v4 redirect packets

4.14-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit c09551c6ff7fe16a79a42133bcecba5fc2fc3291 ] According to the algorithm described in the comment block at the beginning of ip_rt_send_redirect, the host should try to send 'ip_rt_redir

[PATCH 4.14 23/23] ax25: fix possible use-after-free

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet commit 63530aba7826a0f8e129874df9c4d264f9db3f9e upstream. syzbot found that ax25 routes where not properly protected against concurrent use [1]. In this particular report the bug

[PATCH 3.18 09/13] hwmon: (lm80) Fix missing unlock on error in set_fan_div()

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Wei Yongjun commit 07bd14ccc3049f9c0147a91a4227a571f981601a upstream. Add the missing unlock before return from function set_fan_div() in the error handling case. Fixes: c9c63915519b ("hwmon:

Re: [PATCH v2 02/13] x86/mm: Add p?d_large() definitions

On Thu, Feb 21, 2019 at 11:34:51AM +, Steven Price wrote: > Exposing the pud/pgd levels of the page tables to walk_page_range() means > we may come across the exotic large mappings that come with large areas > of contiguous memory (such as the kernel's linear map). > > Expose p?d_large() from

[PATCH 4.14 02/23] net: fix IPv6 prefix route residue

4.14-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit e75913c93f7cd5f338ab373c34c93a655bd309cb ] Follow those steps: # ip addr add 2001:123::1/32 dev eth0 # ip addr add 2001:123:456::2/64 dev eth0 # ip addr del 2001:123::1/32 dev eth

[PATCH] mdio_bus: Fix use-after-free on device_register fails

From: YueHaibing KASAN has found use-after-free in fixed_mdio_bus_init, commit 0c692d07842a ("drivers/net/phy/mdio_bus.c: call put_device on device_register() failure") call put_device() while device_register() fails,give up the last reference to the device and allow mdiobus_release to be execute

KASAN: slab-out-of-bounds Read in ip6_hold_safe

Hello, syzbot found the following crash on: HEAD commit:b71acb0e3721 Merge branch 'linus' of git://git.kernel.org/.. git tree: net-next console output: https://syzkaller.appspot.com/x/log.txt?x=1672a39b40 kernel config: https://syzkaller.appspot.com/x/.config?x=b03c5892bb940c76 da

[PATCH 4.14 07/23] mlxsw: __mlxsw_sp_port_headroom_set(): Fix a use of local variable

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Petr Machata [ Upstream commit 289460404f6947ef1c38e67d680be9a84161250b ] The function-local variable "delay" enters the loop interpreted as delay in bits. However, inside the loop it gets ove

[PATCH 4.19 12/30] net: validate untrusted gso packets without csum offload

4.19-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit d5be7f632bad0f489879eed0ff4b99bd7fe0b74c ] Syzkaller again found a path to a kernel crash through bad gso input. By building an excessively large packet to cause an skb field to wrap

[PATCH 4.9 18/20] net/x25: do not hold the cpu too long in x25_new_lci()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet commit cf657d22ee1f0e887326a92169f2e28dc932fd10 upstream. Due to quadratic behavior of x25_new_lci(), syzbot was able to trigger an rcu stall. Fix this by not blocking BH for the

[PATCH 3.18 11/13] net/x25: do not hold the cpu too long in x25_new_lci()

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet commit cf657d22ee1f0e887326a92169f2e28dc932fd10 upstream. Due to quadratic behavior of x25_new_lci(), syzbot was able to trigger an rcu stall. Fix this by not blocking BH for the

[PATCH 4.9 11/20] tcp: tcp_v4_err() should be more careful

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 2c4cc9712364c051b1de2d175d5fbea6be948ebf ] ICMP handlers are not very often stressed, we should make them more resilient to bugs that might surface in the future.

[PATCH 4.9 04/20] net: Fix for_each_netdev_feature on Big endian

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Hauke Mehrtens [ Upstream commit 3b89ea9c5902acccdbbdec307c85edd1bf52515e ] The features attribute is of type u64 and stored in the native endianes on the system. The for_each_set_bit() macro t

[PATCH 4.9 06/20] net: stmmac: handle endianness in dwmac4_get_timestamp

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Alexandre Torgue [ Upstream commit 224babd62d6f19581757a6d8bae3bf9501fc10de ] GMAC IP is little-endian and used on several kind of CPU (big or little endian). Main callbacks functions of the st

Re: [PATCH v4 04/16] powerpc/mm/32s: use generic mmu_mapin_ram() for all blocks.

Le 21/02/2019 à 14:51, Michael Ellerman a écrit : Christophe Leroy writes: Now that mmu_mapin_ram() is able to handle other blocks than the one starting at 0, the WII can use it for all its blocks. Signed-off-by: Christophe Leroy --- arch/powerpc/mm/pgtable_32.c | 27 +--

[PATCH 4.9 12/20] net: Do not allocate page fragments that are not skb aligned

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Alexander Duyck [ Upstream commit 3bed3cc4156eedf652b4df72bdb35d4f1a2a739d ] This patch addresses the fact that there are drivers, specifically tun, that will call into the network page fragmen

general protection fault in dev_get_by_index_rcu

Hello, syzbot found the following crash on: HEAD commit:c433570458e4 ax25: fix a use-after-free in ax25_fillin_cb() git tree: net console output: https://syzkaller.appspot.com/x/log.txt?x=1352f84b40 kernel config: https://syzkaller.appspot.com/x/.config?x=4b137b8ba637eb77 dashboar

[PATCH 4.4 04/20] net: Fix for_each_netdev_feature on Big endian

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Hauke Mehrtens [ Upstream commit 3b89ea9c5902acccdbbdec307c85edd1bf52515e ] The features attribute is of type u64 and stored in the native endianes on the system. The for_each_set_bit() macro t

Re: [PATCH] staging/erofs: fix sparse's warnings on undeclared symbols in erofs

Hi Bo, On 2019/2/21 22:28, Bo YU wrote: > From: Bo Yu > > Fix sparse warnings: > > drivers/staging/erofs/utils.c:134:6: warning: symbol > 'erofs_try_to_release_workgroup' was not declared. Should it be static? > > Fixes: 51232df5e4b26("staging: erofs: fix race when the managed cache is > enab

[PATCH 4.9 10/20] net: Add header for usage of fls64()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: "David S. Miller" [ Upstream commit 8681ef1f3d295bd3600315325f3b3396d76d02f6 ] Fixes: 3b89ea9c5902 ("net: Fix for_each_netdev_feature on Big endian") Suggested-by: Eric Dumazet Signed-off-by:

[PATCH 4.4 03/20] hwmon: (lm80) Fix missing unlock on error in set_fan_div()

4.4-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 07bd14ccc3049f9c0147a91a4227a571f981601a ] Add the missing unlock before return from function set_fan_div() in the error handling case. Fixes: c9c63915519b ("hwmon: (lm80) fix a miss

[PATCH 4.4 08/20] net: Do not allocate page fragments that are not skb aligned

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Alexander Duyck [ Upstream commit 3bed3cc4156eedf652b4df72bdb35d4f1a2a739d ] This patch addresses the fact that there are drivers, specifically tun, that will call into the network page fragmen

[PATCH 4.4 16/20] mfd: as3722: Mark PM functions as __maybe_unused

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit a7b956fd38dd217dd78e3058110929f5ac914df1 upstream. The newly introduced as3722_i2c_suspend/resume functions are built unconditionally, but only used when power management i

[PATCH 4.4 05/20] sky2: Increase D3 delay again

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Kai-Heng Feng [ Upstream commit 1765f5dcd00963e33f1b8a4e0f34061fbc0e2f7f ] Another platform requires even longer delay to make the device work correctly after S3. So increase the delay to 300m

[PATCH 4.14 09/23] net: Fix for_each_netdev_feature on Big endian

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Hauke Mehrtens [ Upstream commit 3b89ea9c5902acccdbbdec307c85edd1bf52515e ] The features attribute is of type u64 and stored in the native endianes on the system. The for_each_set_bit() macro

[PATCH 3.18 13/13] ax25: fix possible use-after-free

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet commit 63530aba7826a0f8e129874df9c4d264f9db3f9e upstream. syzbot found that ax25 routes where not properly protected against concurrent use [1]. In this particular report the bug

[PATCH 3.18 05/13] vxlan: test dev->flags & IFF_UP before calling netif_rx()

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 4179cb5a4c924cd233eaadd081882425bc98f44e ] netif_rx() must be called under a strict contract. At device dismantle phase, core networking clears IFF_UP and flush

[PATCH 3.18 02/13] sky2: Increase D3 delay again

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Kai-Heng Feng [ Upstream commit 1765f5dcd00963e33f1b8a4e0f34061fbc0e2f7f ] Another platform requires even longer delay to make the device work correctly after S3. So increase the delay to 300

Re: [GIT PULL 7/7] stm class: Prevent division by zero

Greg Kroah-Hartman writes: > On Thu, Feb 21, 2019 at 03:49:59PM +0200, Alexander Shishkin wrote: >> Using STP_POLICY_ID_SET ioctl command with dummy_stm device, or any STM >> device that supplies zero mmio channel size, will trigger a division by >> zero bug in the kernel. >> >> Prevent this by

[PATCH 4.14 19/23] tcp: clear icsk_backoff in tcp_write_queue_purge()

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 04c03114be82194d4a4858d41dba8e286ad1787c ] soukjin bae reported a crash in tcp_v4_err() handling ICMP_DEST_UNREACH after tcp_write_queue_head(sk) returned a NULL

[PATCH 4.4 06/20] net: Add header for usage of fls64()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: "David S. Miller" [ Upstream commit 8681ef1f3d295bd3600315325f3b3396d76d02f6 ] Fixes: 3b89ea9c5902 ("net: Fix for_each_netdev_feature on Big endian") Suggested-by: Eric Dumazet Signed-off-by:

Re: [GIT PULL 6/7] stm class: Fix an endless loop in channel allocation

On Thu, Feb 21, 2019 at 03:49:58PM +0200, Alexander Shishkin wrote: > From: Zhi Jin > > There is a bug in the channel allocation logic that leads to an endless > loop when looking for a contiguous range of channels in a range with a > mixture of free and occupied channels. For example, opening th

[PATCH 4.19 10/30] net: stmmac: Fix a race in EEE enable callback

4.19-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 8a7493e58ad688eb23b81e45461c5d314f4402f1 ] We are saving the status of EEE even before we try to enable it. This leads to a race with XMIT function that tries to arm EEE timer before

[PATCH 4.19 20/30] net: Do not allocate page fragments that are not skb aligned

4.19-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 3bed3cc4156eedf652b4df72bdb35d4f1a2a739d ] This patch addresses the fact that there are drivers, specifically tun, that will call into the network page fragment allocators with buffe

[PATCH 4.14 14/23] sky2: Increase D3 delay again

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Kai-Heng Feng [ Upstream commit 1765f5dcd00963e33f1b8a4e0f34061fbc0e2f7f ] Another platform requires even longer delay to make the device work correctly after S3. So increase the delay to 300

Re: [PATCH] platform/x86: intel_pmc_core: Avoid a u32 overflow

On Sat, Feb 16, 2019 at 2:19 AM Rajat Jain wrote: > > The register (SLP_S0_RES) at offset slp_s0_offset is a 32 bit register. > The pmc_core_adjust_slp_s0_step() could overflow the u32 value while > returning it after adjusting the step. Thus change to u64, this is > already accounted for in debug

[PATCH 4.19 19/30] tcp: tcp_v4_err() should be more careful

4.19-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 2c4cc9712364c051b1de2d175d5fbea6be948ebf ] ICMP handlers are not very often stressed, we should make them more resilient to bugs that might surface in the future. If there is no pac

[PATCH 4.20 13/32] net: validate untrusted gso packets without csum offload

4.20-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit d5be7f632bad0f489879eed0ff4b99bd7fe0b74c ] Syzkaller again found a path to a kernel crash through bad gso input. By building an excessively large packet to cause an skb field to wrap

[PATCH 4.19 21/30] hwmon: (lm80) Fix missing unlock on error in set_fan_div()

4.19-stable review patch. If anyone has any objections, please let me know. -- From: Wei Yongjun commit 07bd14ccc3049f9c0147a91a4227a571f981601a upstream. Add the missing unlock before return from function set_fan_div() in the error handling case. Fixes: c9c63915519b ("hwmon:

[PATCH 4.20 31/32] mISDN: fix a race in dev_expire_timer()

4.20-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet commit bdcc5bc25548ef6b08e2e43937148f907c212292 upstream. Since mISDN_close() uses dev->pending to iterate over active timers, there is a chance that one timer got removed from th

[PATCH 4.20 19/32] net: netcp: Fix ethss driver probe issue

4.20-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 1f43f400a2cbb02f3d34de8fe30075c070254816 ] Recent commit below has introduced a bug in netcp driver that causes the ethss driver probe failure and thus break the networking function

[PATCH 4.19 03/30] mlxsw: __mlxsw_sp_port_headroom_set(): Fix a use of local variable

4.19-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 289460404f6947ef1c38e67d680be9a84161250b ] The function-local variable "delay" enters the loop interpreted as delay in bits. However, inside the loop it gets overwritten by the resul

general protection fault in relay_switch_subbuf

Hello, syzbot found the following crash on: HEAD commit:c04e2a780caf Merge tag 'fsnotify_for_v5.0-rc4' of git://gi.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=133424c0c0 kernel config: https://syzkaller.appspot.com/x/.config?x=505743eba4e4f68 das

Re: [PATCH] bpfilter: remove extra header search paths for bpfilter_umh

On Thu, Jan 31, 2019 at 12:15:35PM +0900, Masahiro Yamada wrote: > Currently, the header search paths -Itools/include and > -Itools/include/uapi are not used. Let's drop the unused code. > > We can remove -I. too by fixing up one C file. > This patch reintroduces the problem last fixed with comm

[PATCH 4.4 13/20] [PATCH] x86: livepatch: Treat R_X86_64_PLT32 as R_X86_64_PC32

4.4-stable review patch. If anyone has any objections, please let me know. -- Signed-off-by: chenzefeng On x86-64, for 32-bit PC-relacive branches, we can generate PLT32 relocation, instead of PC32 relocation. and R_X86_64_PLT32 can be treated the same as R_X86_64_PC32 since li

Re: [PATCH v3 0/5] ICL support and other enhancements for PMC Core

On Thu, Feb 14, 2019 at 1:56 PM Rajneesh Bhardwaj wrote: > > Changes in v3: > * Dropped reference to coreboot project as suggested by Thomas and Boris. > * Rebased onto "for-next" branch of pdx86 tree and dropped previously >accepted five patches from v2 of this series since they are already

[PATCH 4.4 17/20] net/x25: do not hold the cpu too long in x25_new_lci()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet commit cf657d22ee1f0e887326a92169f2e28dc932fd10 upstream. Due to quadratic behavior of x25_new_lci(), syzbot was able to trigger an rcu stall. Fix this by not blocking BH for the

[PATCH] cpuidle: Add a predict callback for the governors

Predicting the next event on the current CPU is implemented in the idle state selection function, thus the selection logic and the prediction are tied together and it is hard to decorrelate both. The following change introduces the cpuidle function to give the opportunity to the governor to store

Re: [PATCH] ipmi_si: fix oops when loading ipmi_si driver

On Thu, Feb 21, 2019 at 02:35:41PM +0800, Yang Yingliang wrote: > When we excute the following commands, we got oops > modprobe ipmi_si ports=0xffc0e3 type=bt Hmm, I have been contemplating pulling out the hardcode interface from IPMI, I didn't know anyone was using it. It obviously hasn't been t

[PATCH 4.14 20/23] sunrpc: fix 4 more call sites that were using stack memory with a scatterlist

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Scott Mayhew commit e7afe6c1d486b516ed586dcc10b3e7e3e85a9c2b upstream. While trying to reproduce a reported kernel panic on arm64, I discovered that AUTH_GSS basically doesn't work at all with

Re: [PATCH v2 03/13] mm: Add generic p?d_large() macros

On Thu, Feb 21, 2019 at 02:46:18PM +, Steven Price wrote: > On 21/02/2019 14:28, Kirill A. Shutemov wrote: > > On Thu, Feb 21, 2019 at 11:34:52AM +, Steven Price wrote: > >> From: James Morse > >> > >> Exposing the pud/pgd levels of the page tables to walk_page_range() means > >> we may co

Re: [PATCH 5/6] lib: Fix function documentation for strncpy_from_user

On 21/02/2019 07.02, Kees Cook wrote: > P.S. Here's C string API Rant (I just had to get this out, please feel > free to ignore): I'll bite. First, it's "linux kernel string API", only some of string.h interfaces are in std C. Sure, none of those satisfy all use cases, but adding Yet Another One

[PATCH 4.19 22/30] scsi: target/core: Use kmem_cache_free() instead of kfree()

4.19-stable review patch. If anyone has any objections, please let me know. -- From: Wei Yongjun commit 8b2db98e814a5ec45e8800fc22ca9000ae0a517b upstream. memory allocated by kmem_cache_alloc() should be freed using kmem_cache_free(), not kfree(). Fixes: ad669505c4e9 ("scsi:

[PATCH 4.14 21/23] net/x25: do not hold the cpu too long in x25_new_lci()

4.14-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet commit cf657d22ee1f0e887326a92169f2e28dc932fd10 upstream. Due to quadratic behavior of x25_new_lci(), syzbot was able to trigger an rcu stall. Fix this by not blocking BH for the

[PATCH 4.4 19/20] ax25: fix possible use-after-free

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet commit 63530aba7826a0f8e129874df9c4d264f9db3f9e upstream. syzbot found that ax25 routes where not properly protected against concurrent use [1]. In this particular report the bug

[PATCH 4.14 06/23] hwmon: (lm80) Fix missing unlock on error in set_fan_div()

4.14-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 07bd14ccc3049f9c0147a91a4227a571f981601a ] Add the missing unlock before return from function set_fan_div() in the error handling case. Fixes: c9c63915519b ("hwmon: (lm80) fix a mis

[PATCH 4.19 27/30] netfilter: nf_nat_snmp_basic: add missing length checks in ASN.1 cbs

4.19-stable review patch. If anyone has any objections, please let me know. -- From: Jann Horn commit c4c07b4d6fa1f11880eab8e076d3d060ef3f55fc upstream. The generic ASN.1 decoder infrastructure doesn't guarantee that callbacks will get as much data as they expect; callbacks ha

[PATCH 4.9 00/20] 4.9.160-stable review

This is the start of the stable review cycle for the 4.9.160 release. There are 20 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat Feb 23 12:52:16 UTC 2019. Anything receiv

[PATCH 4.9 02/20] vsock: cope with memory allocation failure at socket creation time

4.9-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 225d9464268599a5b4d094d02ec17808e44c7553 ] In the unlikely event that the kmalloc call in vmci_transport_socket_init() fails, we end-up calling vmci_transport_destruct() with a NULL v

[PATCH 4.4 07/20] tcp: tcp_v4_err() should be more careful

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 2c4cc9712364c051b1de2d175d5fbea6be948ebf ] ICMP handlers are not very often stressed, we should make them more resilient to bugs that might surface in the future.

[PATCH 4.9 13/20] tcp: clear icsk_backoff in tcp_write_queue_purge()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 04c03114be82194d4a4858d41dba8e286ad1787c ] soukjin bae reported a crash in tcp_v4_err() handling ICMP_DEST_UNREACH after tcp_write_queue_head(sk) returned a NULL

[PATCH 4.19 25/30] PCI: Fix __initdata issue with "pci=disable_acs_redir" parameter

4.19-stable review patch. If anyone has any objections, please let me know. -- From: Logan Gunthorpe commit d2fd6e81912a665993b24dcdc1c1384a42a54f7e upstream. The disable_acs_redir parameter stores a pointer to the string passed to pci_setup(). However, the string passed to P

[PATCH 4.14 04/23] vsock: cope with memory allocation failure at socket creation time

4.14-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 225d9464268599a5b4d094d02ec17808e44c7553 ] In the unlikely event that the kmalloc call in vmci_transport_socket_init() fails, we end-up calling vmci_transport_destruct() with a NULL

[PATCH 4.19 14/30] vhost: correctly check the return value of translate_desc() in log_used()

4.19-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 816db7663565cd23f74ed3d5c9240522e3fb0dda ] When fail, translate_desc() returns negative value, otherwise the number of iovs. So we should fail when the return value is negative inste

[PATCH 4.19 26/30] sunrpc: fix 4 more call sites that were using stack memory with a scatterlist

4.19-stable review patch. If anyone has any objections, please let me know. -- From: Scott Mayhew commit e7afe6c1d486b516ed586dcc10b3e7e3e85a9c2b upstream. While trying to reproduce a reported kernel panic on arm64, I discovered that AUTH_GSS basically doesn't work at all with

Re: [PATCH 4.19 23/30] x86_64: increase stack size for KASAN_EXTRA

On 2/21/19 5:36 PM, Greg Kroah-Hartman wrote: > 4.19-stable review patch. If anyone has any objections, please let me know. > Drop it please. It increases kernel stack up to 4-order which is above PAGE_ALLOC_COSTLY_ORDER. This changes behavior of the fork() by making it fail with -ENOMEM due of

[PATCH 4.20 14/32] sky2: Increase D3 delay again

4.20-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 1765f5dcd00963e33f1b8a4e0f34061fbc0e2f7f ] Another platform requires even longer delay to make the device work correctly after S3. So increase the delay to 300ms. BugLink: https://

[PATCH 3.18 00/13] 3.18.136-stable review

This is the start of the stable review cycle for the 3.18.136 release. There are 13 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat Feb 23 12:52:12 UTC 2019. Anything recei

[PATCH 3.18 07/13] net: stmmac: Fix a race in EEE enable callback

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Jose Abreu [ Upstream commit 8a7493e58ad688eb23b81e45461c5d314f4402f1 ] We are saving the status of EEE even before we try to enable it. This leads to a race with XMIT function that tries to a

[PATCH 4.20 30/32] net/x25: do not hold the cpu too long in x25_new_lci()

4.20-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet commit cf657d22ee1f0e887326a92169f2e28dc932fd10 upstream. Due to quadratic behavior of x25_new_lci(), syzbot was able to trigger an rcu stall. Fix this by not blocking BH for the

[PATCH 4.9 08/20] sky2: Increase D3 delay again

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Kai-Heng Feng [ Upstream commit 1765f5dcd00963e33f1b8a4e0f34061fbc0e2f7f ] Another platform requires even longer delay to make the device work correctly after S3. So increase the delay to 300m

[PATCH 3.18 03/13] tcp: tcp_v4_err() should be more careful

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 2c4cc9712364c051b1de2d175d5fbea6be948ebf ] ICMP handlers are not very often stressed, we should make them more resilient to bugs that might surface in the future

[PATCH 4.4 10/20] vxlan: test dev->flags & IFF_UP before calling netif_rx()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 4179cb5a4c924cd233eaadd081882425bc98f44e ] netif_rx() must be called under a strict contract. At device dismantle phase, core networking clears IFF_UP and flush_

[PATCH 4.14 00/23] 4.14.103-stable review

This is the start of the stable review cycle for the 4.14.103 release. There are 23 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat Feb 23 12:52:22 UTC 2019. Anything recei

[PATCH 4.20 16/32] net: Add header for usage of fls64()

4.20-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 8681ef1f3d295bd3600315325f3b3396d76d02f6 ] Fixes: 3b89ea9c5902 ("net: Fix for_each_netdev_feature on Big endian") Suggested-by: Eric Dumazet Signed-off-by: David S. Miller Signed-o

[PATCH 4.20 10/32] net: phy: xgmiitorgmii: Support generic PHY status read

4.20-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 197f9ab7f08ce4b9ece662f747c3991b2f0fbb57 ] Some PHY drivers like the generic one do not provide a read_status callback on their own but rely on genphy_read_status being called direct

[PATCH 4.9 07/20] net: validate untrusted gso packets without csum offload

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Willem de Bruijn [ Upstream commit d5be7f632bad0f489879eed0ff4b99bd7fe0b74c ] Syzkaller again found a path to a kernel crash through bad gso input. By building an excessively large packet to ca

[PATCH 4.4 12/20] net: ipv4: use a dedicated counter for icmp_v4 redirect packets

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Lorenzo Bianconi [ Upstream commit c09551c6ff7fe16a79a42133bcecba5fc2fc3291 ] According to the algorithm described in the comment block at the beginning of ip_rt_send_redirect, the host should

[PATCH 4.19 06/30] net: fix IPv6 prefix route residue

4.19-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit e75913c93f7cd5f338ab373c34c93a655bd309cb ] Follow those steps: # ip addr add 2001:123::1/32 dev eth0 # ip addr add 2001:123:456::2/64 dev eth0 # ip addr del 2001:123::1/32 dev eth

[PATCH 4.4 00/20] 4.4.176-stable review

This is the start of the stable review cycle for the 4.4.176 release. There are 20 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat Feb 23 14:19:37 UTC 2019. Anything receiv

[PATCH 4.9 17/20] btrfs: Remove false alert when fiemap range is smaller than on-disk extent

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Qu Wenruo commit 848c23b78fafdcd3270b06a30737f8dbd70c347f upstream. Commit 4751832da990 ("btrfs: fiemap: Cache and merge fiemap extent before submit it to user") introduced a warning to catch u

[PATCH 4.4 11/20] net: stmmac: Fix a race in EEE enable callback

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Jose Abreu [ Upstream commit 8a7493e58ad688eb23b81e45461c5d314f4402f1 ] We are saving the status of EEE even before we try to enable it. This leads to a race with XMIT function that tries to ar

[PATCH 4.14 05/23] vxlan: test dev->flags & IFF_UP before calling netif_rx()

4.14-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 4179cb5a4c924cd233eaadd081882425bc98f44e ] netif_rx() must be called under a strict contract. At device dismantle phase, core networking clears IFF_UP and flush_all_backlogs() is ca

Re: [GIT PULL 5/7] intel_th: Don't reference unassigned outputs

On Thu, Feb 21, 2019 at 03:49:57PM +0200, Alexander Shishkin wrote: > When an output port driver is removed, also remove references to it from > any masters. Failing to do this causes a NULL ptr dereference when > configuring another output port: > > > BUG: unable to handle kernel NULL pointer der

[PATCH 3.18 12/13] mISDN: fix a race in dev_expire_timer()

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet commit bdcc5bc25548ef6b08e2e43937148f907c212292 upstream. Since mISDN_close() uses dev->pending to iterate over active timers, there is a chance that one timer got removed from th

Re: [GIT PULL 7/7] stm class: Prevent division by zero

On Thu, Feb 21, 2019 at 03:49:59PM +0200, Alexander Shishkin wrote: > Using STP_POLICY_ID_SET ioctl command with dummy_stm device, or any STM > device that supplies zero mmio channel size, will trigger a division by > zero bug in the kernel. > > Prevent this by disallowing channel widths other tha

[PATCH 4.9 09/20] vhost: correctly check the return value of translate_desc() in log_used()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jason Wang [ Upstream commit 816db7663565cd23f74ed3d5c9240522e3fb0dda ] When fail, translate_desc() returns negative value, otherwise the number of iovs. So we should fail when the return value

[PATCH 4.4 14/20] kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Jann Horn commit cfa39381173d5f969daf43582c95ad679189cbc9 upstream. kvm_ioctl_create_device() does the following: 1. creates a device that holds a reference to the VM object (with a borrowed

<    1   2   3   4   5   6   7   8   9   10   >