1. 29 10月, 2017 4 次提交
    • L
      Merge tag 'pci-v4.14-fixes-6' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · 22450e03
      Linus Torvalds 提交于
      Pull PCI fix from Bjorn Helgaas:
       "Move alpha PCI IRQ map/swizzle functions out of initdata to fix
        regression from PCI core IRQ mapping changes (Lorenzo Pieralisi)"
      
      * tag 'pci-v4.14-fixes-6' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        alpha/PCI: Move pci_map_irq()/pci_swizzle() out of initdata
      22450e03
    • L
      Merge tag 'drm-fixes-for-v4.14-rc7' of git://people.freedesktop.org/~airlied/linux · b35f0ca7
      Linus Torvalds 提交于
      Pull drm fixes from Dave Airlie:
       "Two amd fixes, one i915 core and a few i915 GVT fixes, things seem
        fairly quiet"
      
      * tag 'drm-fixes-for-v4.14-rc7' of git://people.freedesktop.org/~airlied/linux:
        drm/i915/gvt: Adding ACTHD mmio read handler
        drm/i915/gvt: Extract mmio_read_from_hw() common function
        drm/i915/gvt: Refine MMIO_RING_F()
        drm/i915/gvt: properly check per_ctx bb valid state
        drm/i915/perf: fix perf enable/disable ioctls with 32bits userspace
        drm/amd/amdgpu: Remove workaround check for UVD6 on APUs
        drm/amd/powerplay: fix uninitialized variable
      b35f0ca7
    • L
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 5345da89
      Linus Torvalds 提交于
      Pull SCSI fixes from James Bottomley:
       "Six fixes for mostly minor issues, most of which have small race
        windows for occurring"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: Suppress a kernel warning in case the prep function returns BLKPREP_DEFER
        scsi: sg: Re-fix off by one in sg_fill_request_table()
        scsi: aacraid: Fix controller initialization failure
        scsi: hpsa: Fix configured_logical_drive_count·check
        scsi: qla2xxx: Initialize Work element before requesting IRQs
        scsi: zfcp: fix erp_action use-before-initialize in REC action trace
      5345da89
    • D
      assoc_array: Fix a buggy node-splitting case · ea678998
      David Howells 提交于
      This fixes CVE-2017-12193.
      
      Fix a case in the assoc_array implementation in which a new leaf is
      added that needs to go into a node that happens to be full, where the
      existing leaves in that node cluster together at that level to the
      exclusion of new leaf.
      
      What needs to happen is that the existing leaves get moved out to a new
      node, N1, at level + 1 and the existing node needs replacing with one,
      N0, that has pointers to the new leaf and to N1.
      
      The code that tries to do this gets this wrong in two ways:
      
       (1) The pointer that should've pointed from N0 to N1 is set to point
           recursively to N0 instead.
      
       (2) The backpointer from N0 needs to be set correctly in the case N0 is
           either the root node or reached through a shortcut.
      
      Fix this by removing this path and using the split_node path instead,
      which achieves the same end, but in a more general way (thanks to Eric
      Biggers for spotting the redundancy).
      
      The problem manifests itself as:
      
        BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
        IP: assoc_array_apply_edit+0x59/0xe5
      
      Fixes: 3cb98950 ("Add a generic associative array implementation.")
      Reported-and-tested-by: NWU Fan <u3536072@connect.hku.hk>
      Signed-off-by: NDavid Howells <dhowells@redhat.com>
      Cc: stable@vger.kernel.org [v3.13-rc1+]
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      ea678998
  2. 28 10月, 2017 11 次提交
  3. 27 10月, 2017 13 次提交
  4. 26 10月, 2017 12 次提交
    • L
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · 3b5a9a8e
      Linus Torvalds 提交于
      Pull block fixes from Jens Axboe:
       "A few select fixes that should go into this series. Mainly for NVMe,
        but also a single stable fix for nbd from Josef"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        nbd: handle interrupted sendmsg with a sndtimeo set
        nvme-rdma: Fix error status return in tagset allocation failure
        nvme-rdma: Fix possible double free in reconnect flow
        nvmet: synchronize sqhd update
        nvme-fc: retry initial controller connections 3 times
        nvme-fc: fix iowait hang
      3b5a9a8e
    • L
      Merge tag 'spi-fix-v4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · 832c6b18
      Linus Torvalds 提交于
      Pull spi fixes from Mark Brown:
       "There are a bunch of device specific fixes (more than I'd like, I've
        been lax sending these) plus one important core fix for the conversion
        to use an IDR for bus number allocation which avoids issues with
        collisions when some but not all of the buses in the system have a
        fixed bus number specified.
      
        The Armada changes are rather large, specificially "spi: armada-3700:
        Fix padding when sending not 4-byte aligned data", but it's a storage
        corruption issue and there's things like indentation changes which
        make it look bigger than it really is. It's been cooking in -next for
        quite a while now and is part of the reason for the delay"
      
      * tag 'spi-fix-v4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
        spi: fix IDR collision on systems with both fixed and dynamic SPI bus numbers
        spi: bcm-qspi: Fix use after free in bcm_qspi_probe() in error path
        spi: a3700: Return correct value on timeout detection
        spi: uapi: spidev: add missing ioctl header
        spi: stm32: Fix logical error in stm32_spi_prepare_mbr()
        spi: armada-3700: Fix padding when sending not 4-byte aligned data
        spi: armada-3700: Fix failing commands with quad-SPI
      832c6b18
    • L
      Merge tag 'ceph-for-4.14-rc7' of git://github.com/ceph/ceph-client · 601c5c2e
      Linus Torvalds 提交于
      Pull ceph fix from Ilya Dryomov:
       "A small lock imbalance fix, marked for stable"
      
      * tag 'ceph-for-4.14-rc7' of git://github.com/ceph/ceph-client:
        ceph: unlock dangling spinlock in try_flush_caps()
      601c5c2e
    • J
      xen: fix booting ballooned down hvm guest · 5266b8e4
      Juergen Gross 提交于
      Commit 96edd61d ("xen/balloon: don't
      online new memory initially") introduced a regression when booting a
      HVM domain with memory less than mem-max: instead of ballooning down
      immediately the system would try to use the memory up to mem-max
      resulting in Xen crashing the domain.
      
      For HVM domains the current size will be reflected in Xenstore node
      memory/static-max instead of memory/target.
      
      Additionally we have to trigger the ballooning process at once.
      
      Cc: <stable@vger.kernel.org> # 4.13
      Fixes: 96edd61d ("xen/balloon: don't
             online new memory initially")
      Reported-by: NSimon Gaiser <hw42@ipsumj.de>
      Suggested-by: NBoris Ostrovsky <boris.ostrovsky@oracle.com>
      Signed-off-by: NJuergen Gross <jgross@suse.com>
      Reviewed-by: NBoris Ostrovsky <boris.ostrovsky@oracle.com>
      Signed-off-by: NBoris Ostrovsky <boris.ostrovsky@oracle.com>
      5266b8e4
    • L
      Merge tag 'xfs-4.14-fixes-7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · 4ed59027
      Linus Torvalds 提交于
      Pull xfs fix from Darrick Wong:
       "Here's (hopefully) the last bugfix for 4.14:
      
         - Rework nowait locking code to reduce locking overhead penalty"
      
      * tag 'xfs-4.14-fixes-7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: fix AIM7 regression
      4ed59027
    • L
      Merge tag 'hwmon-for-linus-v4.14-rc7' of... · 035bcf88
      Linus Torvalds 提交于
      Merge tag 'hwmon-for-linus-v4.14-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
      
      Pull hwmon fixes from Guenter Roeck:
      
       - Fix initial temperature readings for TMP102
      
       - Fix timeouts in DA9052 driver by increasing its sampling rate
      
      * tag 'hwmon-for-linus-v4.14-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        hwmon: (tmp102) Fix first temperature reading
        hwmon: (da9052) Increase sample rate when using TSI
      035bcf88
    • L
      Merge tag 'sound-4.14-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · ecda3d95
      Linus Torvalds 提交于
      Pull sound fixes from Takashi Iwai:
       "Just two HD-audio fixups for a recent Realtek codec model. It's pretty
        safe to apply (and unsurprisingly boring)"
      
      * tag 'sound-4.14-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda - fix headset mic problem for Dell machines with alc236
        ALSA: hda/realtek - Add support for ALC236/ALC3204
      ecda3d95
    • D
      Merge tag 'drm-intel-fixes-2017-10-25' of... · 522dbb35
      Dave Airlie 提交于
      Merge tag 'drm-intel-fixes-2017-10-25' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
      
      drm-intel-fixes-2017-10-25:
      
      only 1 fix for stable:
      
      - fix perf enable/disable ioctls for 32bits (lionel)
      
      * tag 'drm-intel-fixes-2017-10-25' of git://anongit.freedesktop.org/drm/drm-intel:
        drm/i915/perf: fix perf enable/disable ioctls with 32bits userspace
      522dbb35
    • D
      Merge branch 'drm-fixes-4.14' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · 5a28747b
      Dave Airlie 提交于
      two suspend/resume regression fixes.
      
      * 'drm-fixes-4.14' of git://people.freedesktop.org/~agd5f/linux:
        drm/amd/amdgpu: Remove workaround check for UVD6 on APUs
        drm/amd/powerplay: fix uninitialized variable
      5a28747b
    • M
      RDMA/netlink: OOPs in rdma_nl_rcv_msg() from misinterpreted flag · b4d91aeb
      Michael J. Ruhl 提交于
      rdma_nl_rcv_msg() checks to see if it should use the .dump() callback
      or the .doit() callback.  The check is done with this check:
      
      if (flags & NLM_F_DUMP) ...
      
      The NLM_F_DUMP flag is two bits (NLM_F_ROOT | NLM_F_MATCH).
      
      When an RDMA_NL_LS message (response) is received, the bit used for
      indicating an error is the same bit as NLM_F_ROOT.
      
      NLM_F_ROOT == (0x100) == RDMA_NL_LS_F_ERR.
      
      ibacm sends a response with the RDMA_NL_LS_F_ERR bit set if an error
      occurs in the service.  The current code then misinterprets the
      NLM_F_DUMP bit and trys to call the .dump() callback.
      
      If the .dump() callback for the specified request is not available
      (which is true for the RDMA_NL_LS messages) the following Oops occurs:
      
      [ 4555.960256] BUG: unable to handle kernel NULL pointer dereference at
         (null)
      [ 4555.969046] IP:           (null)
      [ 4555.972664] PGD 10543f1067 P4D 10543f1067 PUD 1033f93067 PMD 0
      [ 4555.979287] Oops: 0010 [#1] SMP
      [ 4555.982809] Modules linked in: rpcrdma ib_isert iscsi_target_mod
      target_core_mod ib_iser libiscsi scsi_transport_iscsi ib_ipoib rdma_ucm ib_ucm
      ib_uverbs ib_umad rdma_cm ib_cm iw_cm dm_mirror dm_region_hash dm_log dm_mod
      dax sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm irqbypass
      crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel crypto_simd
      glue_helper cryptd hfi1 rdmavt iTCO_wdt iTCO_vendor_support ib_core mei_me
      lpc_ich pcspkr mei ioatdma sg shpchp i2c_i801 mfd_core wmi ipmi_si ipmi_devintf
      ipmi_msghandler acpi_power_meter acpi_pad nfsd auth_rpcgss nfs_acl lockd grace
      sunrpc ip_tables ext4 mbcache jbd2 sd_mod mgag200 drm_kms_helper syscopyarea
      sysfillrect sysimgblt fb_sys_fops ttm igb ahci crc32c_intel ptp libahci
      pps_core drm dca libata i2c_algo_bit i2c_core
      [ 4556.061190] CPU: 54 PID: 9841 Comm: ibacm Tainted: G          I
      4.14.0-rc2+ #6
      [ 4556.069667] Hardware name: Intel Corporation S2600WT2/S2600WT2, BIOS
      SE5C610.86B.01.01.0008.021120151325 02/11/2015
      [ 4556.081339] task: ffff880855f42d00 task.stack: ffffc900246b4000
      [ 4556.087967] RIP: 0010:          (null)
      [ 4556.092166] RSP: 0018:ffffc900246b7bc8 EFLAGS: 00010246
      [ 4556.098018] RAX: ffffffff81dbe9e0 RBX: ffff881058bb1000 RCX:
      0000000000000000
      [ 4556.105997] RDX: 0000000000001100 RSI: ffff881058bb1320 RDI:
      ffff881056362000
      [ 4556.113984] RBP: ffffc900246b7bf8 R08: 0000000000000ec0 R09:
      0000000000001100
      [ 4556.121971] R10: ffff8810573a5000 R11: 0000000000000000 R12:
      ffff881056362000
      [ 4556.129957] R13: 0000000000000ec0 R14: ffff881058bb1320 R15:
      0000000000000ec0
      [ 4556.137945] FS:  00007fe0ba5a38c0(0000) GS:ffff88105f080000(0000)
      knlGS:0000000000000000
      [ 4556.147000] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [ 4556.153433] CR2: 0000000000000000 CR3: 0000001056f5d003 CR4:
      00000000001606e0
      [ 4556.161419] Call Trace:
      [ 4556.164167]  ? netlink_dump+0x12c/0x290
      [ 4556.168468]  __netlink_dump_start+0x186/0x1f0
      [ 4556.173357]  rdma_nl_rcv_msg+0x193/0x1b0 [ib_core]
      [ 4556.178724]  rdma_nl_rcv+0xdc/0x130 [ib_core]
      [ 4556.183604]  netlink_unicast+0x181/0x240
      [ 4556.187998]  netlink_sendmsg+0x2c2/0x3b0
      [ 4556.192392]  sock_sendmsg+0x38/0x50
      [ 4556.196299]  SYSC_sendto+0x102/0x190
      [ 4556.200308]  ? __audit_syscall_entry+0xaf/0x100
      [ 4556.205387]  ? syscall_trace_enter+0x1d0/0x2b0
      [ 4556.210366]  ? __audit_syscall_exit+0x209/0x290
      [ 4556.215442]  SyS_sendto+0xe/0x10
      [ 4556.219060]  do_syscall_64+0x67/0x1b0
      [ 4556.223165]  entry_SYSCALL64_slow_path+0x25/0x25
      [ 4556.228328] RIP: 0033:0x7fe0b9db2a63
      [ 4556.232333] RSP: 002b:00007ffc55edc260 EFLAGS: 00000293 ORIG_RAX:
      000000000000002c
      [ 4556.240808] RAX: ffffffffffffffda RBX: 0000000000000010 RCX:
      00007fe0b9db2a63
      [ 4556.248796] RDX: 0000000000000010 RSI: 00007ffc55edc280 RDI:
      000000000000000d
      [ 4556.256782] RBP: 00007ffc55edc670 R08: 00007ffc55edc270 R09:
      000000000000000c
      [ 4556.265321] R10: 0000000000000000 R11: 0000000000000293 R12:
      00007ffc55edc280
      [ 4556.273846] R13: 000000000260b400 R14: 000000000000000d R15:
      0000000000000001
      [ 4556.282368] Code:  Bad RIP value.
      [ 4556.286629] RIP:           (null) RSP: ffffc900246b7bc8
      [ 4556.293013] CR2: 0000000000000000
      [ 4556.297292] ---[ end trace 8d67abcfd10ec209 ]---
      [ 4556.305465] Kernel panic - not syncing: Fatal exception
      [ 4556.313786] Kernel Offset: disabled
      [ 4556.321563] ---[ end Kernel panic - not syncing: Fatal exception
      [ 4556.328960] ------------[ cut here ]------------
      
      Special case RDMA_NL_LS response messages to call the appropriate
      callback.
      
      Additionally, make sure that the .dump() callback is not NULL
      before calling it.
      
      Fixes: 647c75ac ("RDMA/netlink: Convert LS to doit callback")
      Reviewed-by: NMike Marciniszyn <mike.marciniszyn@intel.com>
      Reviewed-by: NKaike Wan <kaike.wan@intel.com>
      Reviewed-by: NAlex Estrin <alex.estrin@intel.com>
      Signed-off-by: NMichael J. Ruhl <michael.j.ruhl@intel.com>
      Reviewed-by: NShiraz Saleem <shiraz.saleem@intel.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      b4d91aeb
    • D
      SMB: fix validate negotiate info uninitialised memory use · a2d9daad
      David Disseldorp 提交于
      An undersize validate negotiate info server response causes the client
      to use uninitialised memory for struct validate_negotiate_info_rsp
      comparisons of Dialect, SecurityMode and/or Capabilities members.
      
      Link: https://bugzilla.samba.org/show_bug.cgi?id=13092
      Fixes: 7db0a6ef ("SMB3: Work around mount failure when using SMB3 dialect to Macs")
      Signed-off-by: NDavid Disseldorp <ddiss@suse.de>
      Reviewed-by: NPavel Shilovsky <pshilov@microsoft.com>
      Signed-off-by: NSteve French <smfrench@gmail.com>
      a2d9daad
    • D
      SMB: fix leak of validate negotiate info response buffer · fe83bebc
      David Disseldorp 提交于
      Fixes: ff1c038a ("Check SMB3 dialects against downgrade attacks")
      Signed-off-by: NDavid Disseldorp <ddiss@suse.de>
      Signed-off-by: NSteve French <smfrench@gmail.com>
      fe83bebc