Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756756AbdDPKx0 (ORCPT ); Sun, 16 Apr 2017 06:53:26 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:59188 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756728AbdDPKxI (ORCPT ); Sun, 16 Apr 2017 06:53:08 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , torvalds@linux-foundation.org, akpm@linux-foundation.org, linux@roeck-us.net, shuahkh@osg.samsung.com, patches@kernelci.org, ben.hutchings@codethink.co.uk, stable@vger.kernel.org Subject: [PATCH 3.18 000/145] 3.18.49-stable review Date: Sun, 16 Apr 2017 12:48:13 +0200 Message-Id: <20170416080200.205458595@linuxfoundation.org> X-Mailer: git-send-email 2.12.2 MIME-Version: 1.0 User-Agent: quilt/0.65 X-KernelTest-Patch: http://kernel.org/pub/linux/kernel/v4.x/stable-review/patch-3.18.49-rc1.gz X-KernelTest-Tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git X-KernelTest-Branch: linux-3.18.y X-KernelTest-Patches: git://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git X-KernelTest-Version: 3.18.49-rc1 X-KernelTest-Deadline: 2017-04-18T08:02+00:00 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 25620 Lines: 658 This is the start of the stable review cycle for the 3.18.49 release. There are 145 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. --------- Wait, what? 3.18? Wasn't that kernel dead and forgotten and left to rot on the side of the road? Yes, it was, but unfortunately, there's a few million or so devices out there in the wild that still rely on this kernel. Now, some of their manufacturers and SoC vendors might not be keeping their kernels up to date very well, but some do actually care about security and their users, so this release is for them. If you happen to have a vendor that does not care about their users, go complain, as odds are, your device is very insecure right now... Because of this strange situation, and thanks to some vendors backing the effort[1], I'll keep 3.18-stable alive in a semi-active mode, doing releases every once in a while to keep it up to date and working well based on what is happening in other more well-maintained stable kernels (hint, use 4.4 or 4.9 or newer PLEASE, if your vendor refuses to do so, switch vendors, it's the only way they will learn...) I don't know how long I'll keep doing this, so if you care about 3.18, please contact me to let me know the expected lifespan of your device. And finally, due to the delay from the last 3.18-stable kernel release, there is a large backlog of patches, this is about 1/2 of the pending ones so far. I'll be working on catching up to the rest of them over the next few weeks, and then the updates should be smaller than this one. ok, back to your normal form-letter stable -rc release notice: --------- Responses should be made by Tue Apr 18 08:01:19 UTC 2017. Anything received after that time might be too late. The whole patch series can be found in one patch at: kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.49-rc1.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y and the diffstat can be found below. thanks, greg k-h [1] Google's android-common-3.18 will be tracking these releases for those of you caring about a working android kernel based on 3.18, I recommend using this tree: https://android.googlesource.com/kernel/common/+/android-3.18 ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman Linux 3.18.49-rc1 Hannes Frederic Sowa dccp: fix memory leak during tear-down of unsuccessful connection request Jon Maxwell dccp/tcp: fix routing redirect race Dmitry V. Levin uapi: fix linux/packet_diag.h userspace compilation error Eric Dumazet net: fix socket refcounting in skb_complete_tx_timestamp() Eric Dumazet net: fix socket refcounting in skb_complete_wifi_ack() Eric Dumazet tcp: fix various issues for sockets morphing to listen state Ilya Dryomov libceph: don't set weight to IN when OSD is destroyed Ravi Bangoria powerpc: Emulation support for load/store instructions on LE Ralf Baechle MIPS: DEC: Avoid la pseudo-instruction in delay slots Arnd Bergmann MIPS: ip22: Fix ip28 build for modern gcc Arnd Bergmann MIPS: ip27: Disable qlge driver in defconfig Alan Stern USB: fix linked-list corruption in rh_call_control() Guenter Roeck usb: hub: Fix crash after failure to read BOS descriptor Johan Hovold USB: wusbcore: fix NULL-deref at probe Johan Hovold USB: idmouse: fix NULL-deref at probe Johan Hovold USB: lvtest: fix NULL-deref at probe Johan Hovold USB: uss720: fix NULL-deref at probe Samuel Thibault usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk Roger Quadros usb: gadget: f_uvc: Fix SuperSpeed companion descriptor's wBytesPerInterval Bjørn Mork USB: serial: qcserial: add Dell DW5811e Janosch Frank KVM: s390: Fix guest migration for huge guests resulting in panic Heiko Carstens s390: use correct input data address for setup_randomness Heiko Carstens s390: make setup_randomness work Martin Schwidefsky s390: TASK_SIZE for kernel threads Julian Wiedmann s390/qdio: clear DSCI prior to scanning multiple input queues Wang, Rui Y crypto: ghash-clmulni - Fix load failure Jiri Slaby crypto: algif_hash - avoid zero-sized array Wang, Rui Y crypto: mcryptd - Fix load failure Wang, Rui Y crypto: cryptd - Assign statesize properly Peter Zijlstra futex: Add missing error handling to FUTEX_REQUEUE_PI Peter Zijlstra futex: Fix potential use-after-free in FUTEX_REQUEUE_PI Jack Morgenstein net/mlx4_core: Fix when to save some qp context flags for dynamic VST to VGT transitions Jack Morgenstein net/mlx4_core: Fix racy CQ (Completion Queue) free Eugenia Emantayev net/mlx4_en: Fix bad WQE issue Guenter Roeck usb: hub: Wait for connection to be reestablished after port reset Andrey Konovalov net/packet: fix overflow in check for priv area size Arnaldo Carvalho de Melo dccp: Unlock sock before calling sk_free() Alexander Potapenko net: don't call strlen() on the user buffer in packet_bind_spkt() Paul Hüber l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv Julian Anastasov ipv4: mask tos for input route David Forster vti6: return GRE_KEY for vti6 Matthias Schiffer vxlan: correctly validate VXLAN ID against VXLAN_N_VID Florian Westphal netlink: remove mmapped netlink support Rik van Riel tracing: Add #undef to fix compile error Arnd Bergmann cpmac: remove hopeless #warning Michel Dänzer drm/ttm: Make sure BOs being swapped out are cacheable Y.C. Chen drm/ast: Fix AST2400 POST failure without BMC FW or VBIOS Y.C. Chen drm/ast: Call open_key before enable_mmio in POST code Y.C. Chen drm/ast: Fix test for VGA enabled Shuah Khan samples: move mic/mpssd example code from Documentation Jason A. Donenfeld padata: avoid race in reordering Mikulas Patocka dm: flush queued bios when process blocks to avoid deadlock Luis de Bethencourt mvsas: fix misleading indentation Johan Hovold USB: serial: io_ti: fix information leak in completion handler Johan Hovold USB: serial: io_ti: fix NULL-deref in interrupt callback Johan Hovold USB: iowarrior: fix NULL-deref in write Johan Hovold USB: iowarrior: fix NULL-deref at probe Johan Hovold USB: serial: omninet: fix reference leaks at open Johan Hovold USB: serial: safe_serial: fix information leak in completion handler Guenter Roeck usb: host: xhci-plat: Fix timeout on removal of hot pluggable xhci controllers Felipe Balbi usb: gadget: function: f_fs: pass companion descriptor along Felipe Balbi usb: dwc3: gadget: make Set Endpoint Configuration macros safe Peter Chen usb: gadget: dummy_hcd: clear usb_gadget region before registration Arnd Bergmann mtd: pmcmsp: use kstrndup instead of kmalloc+strncpy Arnd Bergmann crypto: improve gcc optimization flags for serpent and wp512 Steven Rostedt (VMware) ktest: Fix child exit code processing OGAWA Hirofumi fat: fix using uninitialized fields of fat_inode/fsinfo_inode Arnd Bergmann libceph: use BUG() instead of BUG_ON(1) Matt Chen mac80211: flush delayed work when entering suspend Max Filippov xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD Trond Myklebust nlm: Ensure callback code also checks that the files match Johan Hovold USB: serial: digi_acceleport: fix OOB-event processing Johan Hovold USB: serial: digi_acceleport: fix OOB data sanity check Feras Daoud IB/ipoib: Fix deadlock between rmmod and set_mode Dmitry Tunin Bluetooth: Add another AR3012 04ca:3018 device Janosch Frank KVM: s390: Disable dirty log retrieval for UCONTROL guests Ian Abbott serial: 8250_pci: Add MKS Tenta SCOM-0800 and SCOM-0801 cards Shuxiao Zhang staging: android: ashmem: lseek failed due to no FMODE_LSEEK. Andy Whitcroft xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window Andy Whitcroft xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder Florian Westphal xfrm: policy: init locks early Tomasz Majchrzak raid10: increment write counter after bio is split Zhaohongjiang cancel the setfilesize transation when io error happen Alexander Popov tty: n_hdlc: get rid of racy n_hdlc.tbuf Jiri Slaby TTY: n_hdlc, fix lockdep false positive Rasmus Villemoes lib/vsprintf.c: improve sanity check in vsnprintf() Maxime Jayat net: socket: fix recvmmsg not returning error from sock_error Andrey Konovalov dccp: fix freeing skb too early for IPV6_RECVPKTINFO Eric Dumazet net/llc: avoid BUG_ON() in skb_orphan() Richard Weinberger drbd: Fix kernel_sendmsg() usage - potential NULL deref Felipe Balbi usb: gadget: u_ether: remove interrupt throttling Johan Hovold USB: cdc-acm: fix TIOCMIWAIT Paul Fertser Revert "staging: nvec: ps2: change serio type to passthrough" Paul Fertser drivers: staging: nvec: remove bogus reset command for PS/2 interface Arnd Bergmann staging: iio: ad5933: avoid uninitialized variable in error case Andrey Ryabinin coredump: fix unfreezable coredumping task Jann Horn swapfile: fix memory corruption via malformed swapfile Sean Young dib0700: fix nec repeat handling murray foster ASoC: cs4270: fix DAPM stream name mismatch Eric Dumazet netlink: do not enter direct reclaim from netlink_dump() Willem de Bruijn packet: on direct_xmit, limit tso and csum to supported devices Marcelo Ricardo Leitner sctp: validate chunk len before actually using it Jiri Slaby net: sctp, forbid negative length Eric Dumazet ipv4: disable BH in set_ping_group_range() Eric Dumazet net: pktgen: remove rcu locking in pktgen_change_name() Nicolas Dichtel ipv6: correctly add local routes when lo goes up Anoob Soman packet: call fanout_release, while UNREGISTERING a netdev Andrew Collins net: Add netdev all_adj_list refcnt propagation to fix panic Nikolay Aleksandrov ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route Lance Richardson ip6_gre: fix flowi6_proto value in ip6gre_xmit_other() Eric Dumazet tcp: fix a compile error in DBGUNDO() Douglas Caetano dos Santos tcp: fix wrong checksum calculation on MTU probing Kees Cook fbdev: color map copying bounds checking Stephen Smalley selinux: fix off-by-one in setprocattr Oliver Neukum HID: usbhid: add ATEN CS962 to list of quirky devices David Hsu pwm: Unexport children before chip removal Boris Brezillon UBI: fastmap: scrub PEB when bitflips are detected in a free PEB EC header Arnd Bergmann smc91x: avoid self-comparison warning Arnd Bergmann drm/exynos: fix error handling in exynos_drm_subdrv_open Arnd Bergmann ARM: 8584/1: floppy: avoid gcc-6 warning Jiri Slaby tty: vt, fix bogus division in csi_J Linus Torvalds Fix potential infoleak in older kernels Marcel Hasler ALSA: usb-audio: Add quirk for Syntek STK1160 Arve Hjønnevåg ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct Arve Hjønnevåg ANDROID: binder: Add strong ref checks Eric Dumazet tcp: fix overflow in __tcp_retransmit_skb() Peter Chen usb: chipidea: move the lock initialization to core file Ashok Raj iommu/vt-d: Fix IOMMU lookup for SR-IOV Virtual Functions Eric Dumazet tcp: avoid infinite loop in tcp_splice_read() Eric Dumazet ipv6: tcp: add a missing tcp_v6_restore_cb() Eric Dumazet ipv6: tcp: restore IP6CB for pktoptions skbs Eric Dumazet ip6_gre: fix ip6gre_err() invalid reads Eric Dumazet l2tp: do not use udp_ioctl() WANG Cong ping: fix a null pointer dereference WANG Cong sit: fix a double free on error path Marcelo Ricardo Leitner sctp: avoid BUG_ON on sctp_wait_for_sndbuf Benjamin Poirier mlx4: Invoke softirqs after napi_reschedule Eric Dumazet netlabel: out of bound access in cipso_v4_validate() Eric Dumazet ipv4: keep skb->dst around in presence of IP options Eric Dumazet net: use a work queue to defer net_disable_timestamp() work Eric Dumazet tcp: fix 0 divide in __tcp_select_window() Dan Carpenter ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim() Eric Dumazet ipv6: fix ip6_tnl_parse_tlv_enc_lim() Eric Dumazet can: Fix kernel panic at security_sock_rcv_skb Linus Torvalds Revert "af_unix: Fix splice-bind deadlock" ------------- Diffstat: Documentation/Makefile | 2 +- Documentation/mic/Makefile | 1 - Documentation/mic/mpssd/Makefile | 19 - Documentation/networking/netlink_mmap.txt | 339 ---------- Makefile | 4 +- arch/arm/include/asm/floppy.h | 2 +- arch/mips/configs/ip27_defconfig | 1 - arch/mips/dec/int-handler.S | 40 +- arch/mips/sgi-ip22/Platform | 2 +- arch/powerpc/lib/sstep.c | 20 - arch/s390/include/asm/processor.h | 3 +- arch/s390/kernel/setup.c | 8 +- arch/s390/kvm/kvm-s390.c | 3 + arch/s390/mm/pgtable.c | 19 +- arch/x86/crypto/ghash-clmulni-intel_glue.c | 26 + arch/x86/include/asm/uaccess.h | 10 +- arch/xtensa/kernel/setup.c | 4 +- crypto/Makefile | 2 + crypto/algif_hash.c | 2 +- crypto/cryptd.c | 1 + crypto/mcryptd.c | 1 + drivers/block/drbd/drbd_main.c | 2 +- drivers/bluetooth/ath3k.c | 2 + drivers/bluetooth/btusb.c | 1 + drivers/gpu/drm/ast/ast_post.c | 48 +- drivers/gpu/drm/exynos/exynos_drm_core.c | 2 +- drivers/gpu/drm/ttm/ttm_bo.c | 4 +- drivers/hid/hid-ids.h | 1 + drivers/hid/usbhid/hid-quirks.c | 1 + drivers/infiniband/ulp/ipoib/ipoib_cm.c | 12 +- drivers/infiniband/ulp/ipoib/ipoib_main.c | 6 +- drivers/iommu/dmar.c | 4 +- drivers/iommu/intel-iommu.c | 13 + drivers/md/dm.c | 55 ++ drivers/md/raid10.c | 4 +- drivers/media/usb/dvb-usb/dib0700_core.c | 5 +- drivers/mtd/maps/pmcmsp-flash.c | 4 +- drivers/mtd/ubi/fastmap.c | 7 +- drivers/net/ethernet/mellanox/mlx4/cq.c | 38 +- drivers/net/ethernet/mellanox/mlx4/en_rx.c | 13 +- .../net/ethernet/mellanox/mlx4/resource_tracker.c | 5 +- drivers/net/ethernet/smsc/smc91x.c | 2 +- drivers/net/ethernet/ti/cpmac.c | 2 +- drivers/net/vxlan.c | 2 +- drivers/pwm/core.c | 2 + drivers/pwm/sysfs.c | 18 + drivers/s390/cio/qdio_thinint.c | 8 +- drivers/scsi/mvsas/mv_sas.c | 4 +- drivers/staging/android/ashmem.c | 1 + drivers/staging/android/binder.c | 35 +- drivers/staging/iio/impedance-analyzer/ad5933.c | 17 +- drivers/staging/nvec/nvec_ps2.c | 6 +- drivers/tty/n_hdlc.c | 143 ++-- drivers/tty/serial/8250/8250_pci.c | 13 + drivers/tty/vt/vt.c | 2 +- drivers/usb/chipidea/core.c | 1 + drivers/usb/chipidea/udc.c | 2 - drivers/usb/class/cdc-acm.c | 2 - drivers/usb/core/config.c | 10 + drivers/usb/core/hcd.c | 7 +- drivers/usb/core/hub.c | 13 +- drivers/usb/core/quirks.c | 8 + drivers/usb/dwc3/gadget.h | 14 +- drivers/usb/gadget/function/f_fs.c | 15 +- drivers/usb/gadget/function/f_uvc.c | 2 +- drivers/usb/gadget/function/u_ether.c | 8 - drivers/usb/gadget/udc/dummy_hcd.c | 2 + drivers/usb/host/xhci-plat.c | 2 + drivers/usb/misc/idmouse.c | 3 + drivers/usb/misc/iowarrior.c | 21 +- drivers/usb/misc/lvstest.c | 4 + drivers/usb/misc/uss720.c | 5 + drivers/usb/serial/digi_acceleport.c | 14 +- drivers/usb/serial/io_ti.c | 8 +- drivers/usb/serial/omninet.c | 6 - drivers/usb/serial/qcserial.c | 2 + drivers/usb/serial/safe_serial.c | 5 + drivers/usb/wusbcore/wa-hc.c | 3 + drivers/video/fbdev/core/fbcmap.c | 26 +- fs/coredump.c | 3 + fs/fat/inode.c | 13 +- fs/xfs/xfs_aops.c | 13 +- include/linux/can/core.h | 7 +- include/linux/ceph/osdmap.h | 2 +- include/linux/lockd/lockd.h | 3 +- include/linux/mroute.h | 2 +- include/linux/mroute6.h | 2 +- include/linux/pwm.h | 5 + include/linux/usb/quirks.h | 6 + include/net/cipso_ipv4.h | 4 + include/trace/events/syscalls.h | 1 + include/uapi/linux/netlink.h | 4 + include/uapi/linux/netlink_diag.h | 2 + include/uapi/linux/packet_diag.h | 2 +- kernel/futex.c | 22 +- kernel/padata.c | 5 +- lib/vsprintf.c | 2 +- mm/swapfile.c | 2 + net/can/af_can.c | 12 +- net/can/af_can.h | 3 +- net/can/bcm.c | 4 +- net/can/gw.c | 2 +- net/can/raw.c | 4 +- net/ceph/osdmap.c | 1 - net/core/dev.c | 100 +-- net/core/pktgen.c | 17 +- net/core/skbuff.c | 30 +- net/dccp/ccids/ccid2.c | 1 + net/dccp/input.c | 3 +- net/dccp/ipv4.c | 3 +- net/dccp/ipv6.c | 8 +- net/dccp/minisocks.c | 1 + net/ipv4/cipso_ipv4.c | 4 + net/ipv4/ip_sockglue.c | 9 +- net/ipv4/ipmr.c | 3 +- net/ipv4/ping.c | 2 + net/ipv4/route.c | 4 +- net/ipv4/sysctl_net_ipv4.c | 4 +- net/ipv4/tcp.c | 6 + net/ipv4/tcp_input.c | 3 +- net/ipv4/tcp_ipv4.c | 10 +- net/ipv4/tcp_output.c | 21 +- net/ipv4/tcp_timer.c | 6 +- net/ipv6/addrconf.c | 2 +- net/ipv6/ip6_gre.c | 42 +- net/ipv6/ip6_tunnel.c | 34 +- net/ipv6/ip6_vti.c | 4 + net/ipv6/ip6mr.c | 5 +- net/ipv6/route.c | 4 +- net/ipv6/sit.c | 1 + net/ipv6/tcp_ipv6.c | 32 +- net/l2tp/l2tp_core.h | 1 + net/l2tp/l2tp_ip.c | 29 +- net/l2tp/l2tp_ip6.c | 2 +- net/llc/llc_conn.c | 3 + net/llc/llc_sap.c | 3 + net/mac80211/pm.c | 1 + net/netlink/Kconfig | 9 - net/netlink/af_netlink.c | 741 +-------------------- net/netlink/af_netlink.h | 15 - net/netlink/diag.c | 39 -- net/packet/af_packet.c | 22 +- net/sctp/sm_statefuns.c | 12 +- net/sctp/socket.c | 8 +- net/socket.c | 4 +- net/unix/af_unix.c | 66 +- net/xfrm/xfrm_policy.c | 10 +- net/xfrm/xfrm_user.c | 9 +- {Documentation => samples}/mic/mpssd/.gitignore | 0 samples/mic/mpssd/Makefile | 27 + {Documentation => samples}/mic/mpssd/micctrl | 0 {Documentation => samples}/mic/mpssd/mpss | 0 {Documentation => samples}/mic/mpssd/mpssd.c | 0 {Documentation => samples}/mic/mpssd/mpssd.h | 0 {Documentation => samples}/mic/mpssd/sysfs.c | 0 security/selinux/hooks.c | 2 +- sound/soc/codecs/cs4270.c | 8 +- sound/usb/quirks-table.h | 17 + tools/testing/ktest/ktest.pl | 2 +- 159 files changed, 1029 insertions(+), 1660 deletions(-)