* refs/heads/tmp-bb52bba:
Linux 4.9.88
PCI: dwc: Fix enumeration end when reaching root subordinate
earlycon: add reg-offset to physical address before mapping
serial: core: mark port as initialized in autoconfig
serial: 8250_pci: Add Brainboxes UC-260 4 port serial device
usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb()
usb: usbmon: Read text within supplied buffer size
usb: quirks: add control message delay for 1b1c:1b20
usbip: vudc: fix null pointer dereference on udc->lock
USB: storage: Add JMicron bridge 152d:2567 to unusual_devs.h
staging: android: ashmem: Fix lockdep issue during llseek
staging: comedi: fix comedi_nsamples_left.
uas: fix comparison for error code
tty/serial: atmel: add new version check for usart
serial: sh-sci: prevent lockup on full TTY buffers
ASoC: rt5651: Fix regcache sync errors on resume
ASoC: sgtl5000: Fix suspend/resume
x86: Treat R_X86_64_PLT32 as R_X86_64_PC32
x86/module: Detect and skip invalid relocations
NFS: Fix unstable write completion
NFS: Fix an incorrect type in struct nfs_direct_req
scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport
ubi: Fix race condition between ubi volume creation and udev
ext4: inplace xattr block update fails to deduplicate blocks
netfilter: x_tables: pack percpu counter allocations
netfilter: x_tables: pass xt_counters struct to counter allocator
netfilter: x_tables: pass xt_counters struct instead of packet counter
netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt
netfilter: bridge: ebt_among: add missing match size checks
netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets
netfilter: IDLETIMER: be syzkaller friendly
netfilter: nat: cope with negative port range
netfilter: x_tables: fix missing timer initialization in xt_LED
netfilter: add back stackpointer size checks
tc358743: fix register i2c_rd/wr function fix
Input: tca8418_keypad - remove double read of key event register
ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds
watchdog: hpwdt: Remove legacy NMI sourcing.
watchdog: hpwdt: fix unused variable warning
watchdog: hpwdt: Check source of NMI
watchdog: hpwdt: SMBIOS check
x86/paravirt, objtool: Annotate indirect calls
x86/speculation: Move firmware_restrict_branch_speculation_*() from C to CPP
x86/boot, objtool: Annotate indirect jump in secondary_startup_64()
x86/speculation, objtool: Annotate indirect calls/jumps for objtool
x86/retpoline: Support retpoline builds with Clang
x86/speculation: Use IBRS if available before calling into firmware
Revert "x86/retpoline: Simplify vmexit_fill_RSB()"
nospec: Include <asm/barrier.h> dependency
nospec: Kill array_index_nospec_mask_check()
ALSA: hda: add dock and led support for HP ProBook 640 G2
ALSA: hda: add dock and led support for HP EliteBook 820 G3
ALSA: seq: More protection for concurrent write and ioctl races
ALSA: seq: Don't allow resizing pool in use
ALSA: hda/realtek - Make dock sound work on ThinkPad L570
ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520
ALSA: hda/realtek: Limit mic boost on T480
x86/spectre_v2: Don't check microcode versions when running under hypervisors
perf tools: Fix trigger class trigger_on()
x86/MCE: Serialize sysfs changes
bcache: don't attach backing with duplicate UUID
bcache: fix crashes in duplicate cache device register
IB/mlx5: Fix incorrect size of klms in the memory region
kbuild: Handle builtin dtb file names containing hyphens
KVM: s390: fix memory overwrites when not using SCA entries
virtio_ring: fix num_free handling in error case
loop: Fix lost writes caused by missing flag
Input: matrix_keypad - fix race when disabling interrupts
MIPS: OCTEON: irq: Check for null return on kzalloc allocation
MIPS: ath25: Check for kzalloc allocation failure
MIPS: BMIPS: Do not mask IPIs during suspend
drm/amdgpu:Always save uvd vcpu_bo in VM Mode
drm/amdgpu:Correct max uvd handles
drm/amdgpu: fix KV harvesting
drm/radeon: fix KV harvesting
drm/amdgpu: Notify sbios device ready before send request
drm/amdgpu: Fix deadlock on runtime suspend
drm/radeon: Fix deadlock on runtime suspend
drm/nouveau: Fix deadlock on runtime suspend
drm: Allow determining if current task is output poll worker
workqueue: Allow retrieval of current task's work struct
drm/i915: Always call to intel_display_set_init_power() in resume_early.
scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS
drm/i915: Try EDID bitbanging on HDMI after failed read
RDMA/mlx5: Fix integer overflow while resizing CQ
RDMA/ucma: Check that user doesn't overflow QP state
RDMA/ucma: Limit possible option size
ANDROID: sdcardfs: fix lock issue on 32 bit/SMP architectures
UPSTREAM: kasan: add functions for unpoisoning stack variables
UPSTREAM: kasan: add tests for alloca poisoning
UPSTREAM: kasan: support alloca() poisoning
UPSTREAM: kasan/Makefile: support LLVM style asan parameters
BACKPORT: kasan: add compiler support for clang
kbuild: fix --gc-sections
BACKPORT: fix "netfilter: xt_bpf: Fix XT_BPF_MODE_FD_PINNED mode of 'xt_bpf_info_v1'"
UPSTREAM: netfilter: xt_bpf: add overflow checks
UPSTREAM: netfilter: xt_bpf: Fix XT_BPF_MODE_FD_PINNED mode of 'xt_bpf_info_v1'
UPSTREAM: netfilter: xt_bpf: support ebpf
FROMLIST: f2fs: don't put dentry page in pagecache into highmem
Change-Id: I7f13fedc725fe5333e18e4e5b6639eee27ea1120
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
* refs/heads/tmp-a290494:
Linux 4.9.87
btrfs: preserve i_mode if __btrfs_set_acl() fails
bpf, ppc64: fix out of bounds access in tail call
bpf: add schedule points in percpu arrays management
bpf, arm64: fix out of bounds access in tail call
bpf, x64: implement retpoline for tail call
bpf: fix mlock precharge on arraymaps
bpf: fix wrong exposure of map_flags into fdinfo for lpm
mpls, nospec: Sanitize array index in mpls_label_ok()
net: mpls: Pull common label check into helper
sctp: verify size of a new chunk in _sctp_make_chunk()
s390/qeth: fix IPA command submission race
s390/qeth: fix IP address lookup for L3 devices
s390/qeth: fix double-free on IP add/remove race
s390/qeth: fix IP removal on offline cards
s390/qeth: fix overestimated count of buffer elements
s390/qeth: fix SETIP command handling
s390/qeth: fix underestimated count of buffer elements
sctp: fix dst refcnt leak in sctp_v6_get_dst()
tcp_bbr: better deal with suboptimal GSO
rxrpc: Fix send in rxrpc_send_data_packet()
tcp: Honor the eor bit in tcp_mtu_probe
net: phy: fix phy_start to consider PHY_IGNORE_INTERRUPT
mlxsw: spectrum_switchdev: Check success of FDB add operation
sctp: fix dst refcnt leak in sctp_v4_get_dst
udplite: fix partial checksum initialization
ppp: prevent unregistered channels from connecting to PPP units
netlink: ensure to loop over all netns in genlmsg_multicast_allns()
net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68
net: fix race on decreasing number of TX queues
ipv6 sit: work around bogus gcc-8 -Wrestrict warning
hdlc_ppp: carrier detect ok, don't turn off negotiation
fib_semantics: Don't match route with mismatching tclassid
bridge: check brport attr show in brport_show
x86/apic/vector: Handle legacy irq data correctly
netlink: put module reference if dump start fails
md: only allow remove_and_add_spares when no sync_thread running.
x86/speculation: Use Indirect Branch Prediction Barrier in context switch
x86/mm: Give each mm TLB flush generation a unique ID
ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux
ARM: dts: LogicPD SOM-LV: Fix I2C1 pinmux
dm io: fix duplicate bio completion due to missing ref count
PCI/ASPM: Deal with missing root ports in link state handling
KVM/VMX: Optimize vmx_vcpu_run() and svm_vcpu_run() by marking the RDMSR path as unlikely()
KVM/x86: Remove indirect MSR op calls from SPEC_CTRL
KVM: mmu: Fix overlap between public and private memslots
ARM: kvm: fix building with gcc-8
ARM: mvebu: Fix broken PL310_ERRATA_753970 selects
nospec: Allow index argument to have const-qualified type
media: m88ds3103: don't call a non-initalized function
x86/platform/intel-mid: Handle Intel Edison reboot correctly
x86/xen: Zero MSR_IA32_SPEC_CTRL before suspend
dax: fix vma_is_fsdax() helper
cpufreq: s3c24xx: Fix broken s3c_cpufreq_init()
parisc: Fix ordering of cache and TLB flushes
timers: Forward timer base before migrating timers
ALSA: hda - Fix pincfg at resume on Lenovo T470 dock
ALSA: hda: Add a power_save blacklist
ALSA: usb-audio: Add a quirck for B&W PX headphones
tpm-dev-common: Reject too short writes
tpm_tis_spi: Use DMA-safe memory for SPI transfers
tpm: constify transmit data pointers
tpm_tis: fix potential buffer overruns caused by bit glitches on the bus
tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus
tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus
tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus
FROMLIST: ARM: amba: Don't read past the end of sysfs "driver_override" buffer
UPSTREAM: ANDROID: binder: remove WARN() for redundant txn error
Conflicts:
kernel/time/timer.c
Change-Id: I302546c52a480e9a4c661accf021766c499739b9
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlquPRAACgkQONu9yGCS
aT6gpA/9GRBca/4SKY1Bdsqtw12mVa2iy/xl4tBhzZAxxMiEjam9vDFNd9Gw0r/J
iNGUFiZgWkN/dVMLnadPdtKbsg/MmD2CvXPtZY5LywgNyvTY6zZxMXExzjjI3h8n
bdC68g+qcolPsqwZHJL/wScSZH8Q2UZKwugRCoGkzt6dZmLoiVWMmb9RXc36hPek
cPyGne/uQMlanMOQYAVe2enJoC18JWeeOuPLzSvs3y8Rj1ZlzWM3aaAaTdKfiMWc
ewK/DDIu9a/pt5xmi2RgCuMZeU84qCvZMAt+v2e56LmAMqZ5MQHUcXscUDofyvrt
X3jSaXV5gvKGSGY+/U4JzDX+/B37z6mKUZF7b7ZTpdTfR6cgHFW7TGPkCkNQplfK
aVF1cCIy65Gjp62LZXSQI5rSAB5C72ryk4resFVZ+QcLRzPhYSS1H6aD5UzfdhkC
QhfKJU+6HfpGEWtjL5pUkNFOprP8f2mfFNNuzmo9Ev5f+qvyT35WCyWzSOz0a/E6
dQNhHCpUzykLI4YuUFIUaieNLIshhrGnNxo32CKzLqup8NMtyXsyyzGciSWSWNyw
f9tbULluWlimDx+hukrrnD8Hw5jzN0D7JlSy9WVjYNvBV6CLGz6ZalzhY0uUAjoT
IsgiN76klZ77fOr6FhnU+mErPBexuYgScWJW8TeqqmK+0gX4i0Y=
=X9zL
-----END PGP SIGNATURE-----
Merge 4.9.88 into android-4.9
Changes in 4.9.88
RDMA/ucma: Limit possible option size
RDMA/ucma: Check that user doesn't overflow QP state
RDMA/mlx5: Fix integer overflow while resizing CQ
drm/i915: Try EDID bitbanging on HDMI after failed read
scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS
drm/i915: Always call to intel_display_set_init_power() in resume_early.
workqueue: Allow retrieval of current task's work struct
drm: Allow determining if current task is output poll worker
drm/nouveau: Fix deadlock on runtime suspend
drm/radeon: Fix deadlock on runtime suspend
drm/amdgpu: Fix deadlock on runtime suspend
drm/amdgpu: Notify sbios device ready before send request
drm/radeon: fix KV harvesting
drm/amdgpu: fix KV harvesting
drm/amdgpu:Correct max uvd handles
drm/amdgpu:Always save uvd vcpu_bo in VM Mode
MIPS: BMIPS: Do not mask IPIs during suspend
MIPS: ath25: Check for kzalloc allocation failure
MIPS: OCTEON: irq: Check for null return on kzalloc allocation
Input: matrix_keypad - fix race when disabling interrupts
loop: Fix lost writes caused by missing flag
virtio_ring: fix num_free handling in error case
KVM: s390: fix memory overwrites when not using SCA entries
kbuild: Handle builtin dtb file names containing hyphens
IB/mlx5: Fix incorrect size of klms in the memory region
bcache: fix crashes in duplicate cache device register
bcache: don't attach backing with duplicate UUID
x86/MCE: Serialize sysfs changes
perf tools: Fix trigger class trigger_on()
x86/spectre_v2: Don't check microcode versions when running under hypervisors
ALSA: hda/realtek: Limit mic boost on T480
ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520
ALSA: hda/realtek - Make dock sound work on ThinkPad L570
ALSA: seq: Don't allow resizing pool in use
ALSA: seq: More protection for concurrent write and ioctl races
ALSA: hda: add dock and led support for HP EliteBook 820 G3
ALSA: hda: add dock and led support for HP ProBook 640 G2
nospec: Kill array_index_nospec_mask_check()
nospec: Include <asm/barrier.h> dependency
Revert "x86/retpoline: Simplify vmexit_fill_RSB()"
x86/speculation: Use IBRS if available before calling into firmware
x86/retpoline: Support retpoline builds with Clang
x86/speculation, objtool: Annotate indirect calls/jumps for objtool
x86/boot, objtool: Annotate indirect jump in secondary_startup_64()
x86/speculation: Move firmware_restrict_branch_speculation_*() from C to CPP
x86/paravirt, objtool: Annotate indirect calls
watchdog: hpwdt: SMBIOS check
watchdog: hpwdt: Check source of NMI
watchdog: hpwdt: fix unused variable warning
watchdog: hpwdt: Remove legacy NMI sourcing.
ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds
Input: tca8418_keypad - remove double read of key event register
tc358743: fix register i2c_rd/wr function fix
netfilter: add back stackpointer size checks
netfilter: x_tables: fix missing timer initialization in xt_LED
netfilter: nat: cope with negative port range
netfilter: IDLETIMER: be syzkaller friendly
netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets
netfilter: bridge: ebt_among: add missing match size checks
netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt
netfilter: x_tables: pass xt_counters struct instead of packet counter
netfilter: x_tables: pass xt_counters struct to counter allocator
netfilter: x_tables: pack percpu counter allocations
ext4: inplace xattr block update fails to deduplicate blocks
ubi: Fix race condition between ubi volume creation and udev
scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport
NFS: Fix an incorrect type in struct nfs_direct_req
NFS: Fix unstable write completion
x86/module: Detect and skip invalid relocations
x86: Treat R_X86_64_PLT32 as R_X86_64_PC32
ASoC: sgtl5000: Fix suspend/resume
ASoC: rt5651: Fix regcache sync errors on resume
serial: sh-sci: prevent lockup on full TTY buffers
tty/serial: atmel: add new version check for usart
uas: fix comparison for error code
staging: comedi: fix comedi_nsamples_left.
staging: android: ashmem: Fix lockdep issue during llseek
USB: storage: Add JMicron bridge 152d:2567 to unusual_devs.h
usbip: vudc: fix null pointer dereference on udc->lock
usb: quirks: add control message delay for 1b1c:1b20
usb: usbmon: Read text within supplied buffer size
usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb()
serial: 8250_pci: Add Brainboxes UC-260 4 port serial device
serial: core: mark port as initialized in autoconfig
earlycon: add reg-offset to physical address before mapping
PCI: dwc: Fix enumeration end when reaching root subordinate
Linux 4.9.88
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
commit c4585a2823edf4d1326da44d1524ecbfda26bb37 upstream.
ebt_among is special, it has a dynamic match size and is exempt
from the central size checks.
Therefore it must check that the size of the match structure
provided from userspace is sane by making sure em->match_size
is at least the minimum size of the expected structure.
The module has such a check, but its only done after accessing
a structure that might be out of bounds.
tested with: ebtables -A INPUT ... \
--among-dst fe:fe:fe:fe:fe:fe
--among-dst fe:fe:fe:fe:fe:fe --among-src fe:fe:fe:fe:ff:f,fe:fe:fe:fe:fe:fb,fe:fe:fe:fe:fc:fd,fe:fe:fe:fe:fe:fd,fe:fe:fe:fe:fe:fe
--among-src fe:fe:fe:fe:ff:f,fe:fe:fe:fe:fe:fa,fe:fe:fe:fe:fe:fd,fe:fe:fe:fe:fe:fe,fe:fe:fe:fe:fe:fe
Reported-by: <syzbot+fe0b19af568972814355@syzkaller.appspotmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Florian Westphalauthored and Greg Kroah-Hartmancommited 2018-03-18 11:18:53 +01:00
commit b71812168571fa55e44cdd0254471331b9c4c4c6 upstream.
We need to make sure the offsets are not out of range of the
total size.
Also check that they are in ascending order.
The WARN_ON triggered by syzkaller (it sets panic_on_warn) is
changed to also bail out, no point in continuing parsing.
Briefly tested with simple ruleset of
-A INPUT --limit 1/s' --log
plus jump to custom chains using 32bit ebtables binary.
Reported-by: <syzbot+845a53d13171abf8bf29@syzkaller.appspotmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Florian Westphalauthored and Greg Kroah-Hartmancommited 2018-03-18 11:18:53 +01:00
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlqlSYcACgkQONu9yGCS
aT4QOBAAlV3X1U64uPZAafv52q/4GVvjh3fymj2aThOImY6cCG2wuQfEHq4lqRKJ
ua+AY1etuGqJbQlroy8j85bIRtE1pmtW+hAA+vaITcrPJhWzhHmssMCK2aM1Jtim
+zDXuh4GjXZ+5Gv3p4bbf3otFOgegr2Ftn4dVEmDClkSqRmNEpAtPzSo5TZQCopN
+QksrFTXMs9QEBxCnfXWHxz0c1EIpaJVtyteX6wVZKC2hjOoF5RBBvErUABW9Po0
db9+6v488AVouaEqxoLmtcwwUFhetMh/5M4oapD8NeRuwkG+4jFNDZcXIRaCzzyu
/8DzeyaP1luA/6q0dSI9JD5Whg7FnuZ4A888D+pLHjEQgSgnxhIX38lpsRcrEbl9
8myFYPoxj6eryM31Z3jW566TI7vT0uqxrc5RzKaFW1xwxLU1Dur5N09VROYIsLvm
YXUjELN+RwrQa5OkenKbTFy0OPjDHzuo1V/b98T6LujozkyboKAsCUyqE+HukUSe
Vicg8h5APSPnMSbPLVW5xDDzShBaKhFps92ELsUEZzr5GGS5SX7TBHlbX0bRKs59
1+hsVts6Twi30/PUJBGkYCAfJ/Jqe0L9l/kj4wnBKWyBLFP5YRerkww2pZ1b/diY
kwmxH26tSI9g3Nh4oeUB3j5MKu23XhDucB0r2H3pLqfTqFcoT3M=
=Y/Vz
-----END PGP SIGNATURE-----
Merge 4.9.87 into android-4.9
Changes in 4.9.87
tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus
tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus
tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus
tpm_tis: fix potential buffer overruns caused by bit glitches on the bus
tpm: constify transmit data pointers
tpm_tis_spi: Use DMA-safe memory for SPI transfers
tpm-dev-common: Reject too short writes
ALSA: usb-audio: Add a quirck for B&W PX headphones
ALSA: hda: Add a power_save blacklist
ALSA: hda - Fix pincfg at resume on Lenovo T470 dock
timers: Forward timer base before migrating timers
parisc: Fix ordering of cache and TLB flushes
cpufreq: s3c24xx: Fix broken s3c_cpufreq_init()
dax: fix vma_is_fsdax() helper
x86/xen: Zero MSR_IA32_SPEC_CTRL before suspend
x86/platform/intel-mid: Handle Intel Edison reboot correctly
media: m88ds3103: don't call a non-initalized function
nospec: Allow index argument to have const-qualified type
ARM: mvebu: Fix broken PL310_ERRATA_753970 selects
ARM: kvm: fix building with gcc-8
KVM: mmu: Fix overlap between public and private memslots
KVM/x86: Remove indirect MSR op calls from SPEC_CTRL
KVM/VMX: Optimize vmx_vcpu_run() and svm_vcpu_run() by marking the RDMSR path as unlikely()
PCI/ASPM: Deal with missing root ports in link state handling
dm io: fix duplicate bio completion due to missing ref count
ARM: dts: LogicPD SOM-LV: Fix I2C1 pinmux
ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux
x86/mm: Give each mm TLB flush generation a unique ID
x86/speculation: Use Indirect Branch Prediction Barrier in context switch
md: only allow remove_and_add_spares when no sync_thread running.
netlink: put module reference if dump start fails
x86/apic/vector: Handle legacy irq data correctly
bridge: check brport attr show in brport_show
fib_semantics: Don't match route with mismatching tclassid
hdlc_ppp: carrier detect ok, don't turn off negotiation
ipv6 sit: work around bogus gcc-8 -Wrestrict warning
net: fix race on decreasing number of TX queues
net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68
netlink: ensure to loop over all netns in genlmsg_multicast_allns()
ppp: prevent unregistered channels from connecting to PPP units
udplite: fix partial checksum initialization
sctp: fix dst refcnt leak in sctp_v4_get_dst
mlxsw: spectrum_switchdev: Check success of FDB add operation
net: phy: fix phy_start to consider PHY_IGNORE_INTERRUPT
tcp: Honor the eor bit in tcp_mtu_probe
rxrpc: Fix send in rxrpc_send_data_packet()
tcp_bbr: better deal with suboptimal GSO
sctp: fix dst refcnt leak in sctp_v6_get_dst()
s390/qeth: fix underestimated count of buffer elements
s390/qeth: fix SETIP command handling
s390/qeth: fix overestimated count of buffer elements
s390/qeth: fix IP removal on offline cards
s390/qeth: fix double-free on IP add/remove race
s390/qeth: fix IP address lookup for L3 devices
s390/qeth: fix IPA command submission race
sctp: verify size of a new chunk in _sctp_make_chunk()
net: mpls: Pull common label check into helper
mpls, nospec: Sanitize array index in mpls_label_ok()
bpf: fix wrong exposure of map_flags into fdinfo for lpm
bpf: fix mlock precharge on arraymaps
bpf, x64: implement retpoline for tail call
bpf, arm64: fix out of bounds access in tail call
bpf: add schedule points in percpu arrays management
bpf, ppc64: fix out of bounds access in tail call
btrfs: preserve i_mode if __btrfs_set_acl() fails
Linux 4.9.87
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 1b12580af1d0677c3c3a19e35bfe5d59b03f737f ]
Now br_sysfs_if file flush doesn't have attr show. To read it will
cause kernel panic after users chmod u+r this file.
Xiong found this issue when running the commands:
ip link add br0 type bridge
ip link add type veth
ip link set veth0 master br0
chmod u+r /sys/devices/virtual/net/veth0/brport/flush
timeout 3 cat /sys/devices/virtual/net/veth0/brport/flush
kernel crashed with NULL a pointer dereference call trace.
This patch is to fix it by return -EINVAL when brport_attr->show
is null, just the same as the check for brport_attr->store in
brport_store().
Fixes: 9cf637473c ("bridge: add sysfs hook to flush forwarding table")
Reported-by: Xiong Zhou <xzhou@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Xin Longauthored and Greg Kroah-Hartmancommited 2018-03-11 16:21:31 +01:00
* refs/heads/tmp-127372f:
Linux 4.9.74
mm/vmstat: Make NR_TLB_REMOTE_FLUSH_RECEIVED available even on UP
tty: fix tty_ldisc_receive_buf() documentation
n_tty: fix EXTPROC vs ICANON interaction with TIOCINQ (aka FIONREAD)
x86/smpboot: Remove stale TLB flush invocations
nohz: Prevent a timer interrupt storm in tick_nohz_stop_sched_tick()
timers: Reinitialize per cpu bases on hotplug
timers: Invoke timer_start_debug() where it makes sense
timers: Use deferrable base independent of base::nohz_active
usb: xhci: Add XHCI_TRUST_TX_LENGTH for Renesas uPD720201
USB: Fix off by one in type-specific length check of BOS SSP capability
usb: add RESET_RESUME for ELSA MicroLink 56K
usb: Add device quirk for Logitech HD Pro Webcam C925e
USB: serial: option: adding support for YUGA CLM920-NC5
USB: serial: option: add support for Telit ME910 PID 0x1101
USB: serial: qcserial: add Sierra Wireless EM7565
USB: serial: ftdi_sio: add id for Airbus DS P8GR
usbip: vhci: stop printing kernel pointer addresses in messages
usbip: stub: stop printing kernel pointer addresses in messages
usbip: prevent leaking socket pointer address in messages
usbip: fix usbip bind writing random string after command in match_busid
s390/qeth: update takeover IPs after configuration change
s390/qeth: lock IP table while applying takeover changes
s390/qeth: don't apply takeover changes to RXIP
s390/qeth: apply takeover changes when mode is toggled
net/mlx5: Fix error flow in CREATE_QP command
net/mlx5e: Prevent possible races in VXLAN control flow
net/mlx5e: Add refcount to VXLAN structure
net/mlx5e: Fix possible deadlock of VXLAN lock
net/mlx5e: Fix features check of IPv6 traffic
net/mlx5: Fix rate limit packet pacing naming and struct
tcp: invalidate rate samples during SACK reneging
sock: free skb in skb_complete_tx_timestamp on error
net: phy: micrel: ksz9031: reconfigure autoneg after phy autoneg workaround
net: Fix double free and memory corruption in get_net_ns_by_id()
net: fec: Allow reception of frames bigger than 1522 bytes
net: bridge: fix early call to br_stp_change_bridge_id and plug newlink leaks
ipv4: Fix use-after-free when flushing FIB tables
adding missing rcu_read_unlock in ipxip6_rcv
sctp: Replace use of sockets_allocated with specified macro.
net: mvmdio: disable/unprepare clocks in EPROBE_DEFER case
net: ipv4: fix for a race condition in raw_sendmsg
tg3: Fix rx hang on MTU change with 5717/5719
tcp md5sig: Use skb's saddr when replying to an incoming segment
tcp_bbr: record "full bw reached" decision in new full_bw_reached bit
RDS: Check cmsg_len before dereferencing CMSG_DATA
ptr_ring: add barriers
net: reevalulate autoflowlabel setting after sysctl setting
net: qmi_wwan: add Sierra EM7565 1199:9091
netlink: Add netns check on taps
net: igmp: Use correct source address on IGMPv3 reports
net: fec: unmap the xmit buffer that are not transferred by DMA
ipv6: mcast: better catch silly mtu values
ipv4: igmp: guard against silly MTU values
kbuild: add '-fno-stack-check' to kernel build options
x86/mm/64: Fix reboot interaction with CR4.PCIDE
x86/mm: Enable CR4.PCIDE on supported systems
x86/mm: Add the 'nopcid' boot option to turn off PCID
x86/mm: Disable PCID on 32-bit kernels
x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code
x86/mm: Reimplement flush_tlb_page() using flush_tlb_mm_range()
x86/mm: Make flush_tlb_mm_range() more predictable
x86/mm: Remove flush_tlb() and flush_tlb_current_task()
x86/vm86/32: Switch to flush_tlb_mm_range() in mark_screen_rdonly()
ALSA: hda - fix headset mic detection issue on a Dell machine
ALSA: hda: Drop useless WARN_ON()
ASoC: tlv320aic31xx: Fix GPIO1 register definition
ASoC: twl4030: fix child-node lookup
ASoC: fsl_ssi: AC'97 ops need regmap, clock and cleaning up on failure
ASoC: da7218: fix fix child-node lookup
ASoC: wm_adsp: Fix validation of firmware and coeff lengths
iw_cxgb4: Only validate the MSN for successful completions
ring-buffer: Mask out the info bits when returning buffer page length
tracing: Fix crash when it fails to alloc ring buffer
tracing: Fix possible double free on failure of allocating trace buffer
tracing: Remove extra zeroing out of the ring buffer page
sync objtool's copy of x86-opcode-map.txt
Conflicts:
include/linux/cpuhotplug.h
kernel/time/timer.c
Change-Id: I0198e2b75715d13acd86237321966774cd6d9f1d
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlpL3vYACgkQONu9yGCS
aT4/aQ//VcOiG5at4QV8aEyPkmlL69jspa5yWwbbz0p3vddZrGHb72aT+lfcPgOk
tZpHR4zKOwPPu6ROgVMnyGQTks/I5ZwCqxVjuapgiXJy34QIh6JLjldKl03Bfoz8
2Q+5u1eia1R+2pLhEQLPp5siH3pbgqjMiC/jr2UtleC1QKiwOgmFApoXsl35OxUW
VkTjdqTcllxa5cFmEgb53xzH/zm0XemVe6xNH4Y+KMUmow/GcynPdxjZxkBpgl4t
HEhPR1UP708JF+LHv4FA35HujtxtK9y1UVpZmroW4Y6tW/lwwYAgvIWOC0EYv1i0
Uin5NfvG2BVkSmct19qn7IKfuVffCRb+dxvKP9I1wembqZSo68QC8rjs/dYbw+VU
SOGZM/Nd4m3yseM1QjQHc97GSvxtDwqzRBFp5c43HXrmn1ha8By9kqWa25JsiwJo
GHWmDzTWw9gW7Jp/1EVY7VGO3FNSJHy87ZIHoEnAXxzCtf7BZL2Z+myQhhPIiCXg
9jtcGkhvFVkvwjJQAAxPRr8kcNQaGZbTqh/ZhYzahl/HNAX6Ez/af30wJkmand2V
geps+QgWIzy6dgIiWr9YnJgqRbMeaHE8Ncn/Ch/8Lp30tkFnpUEOrdqFOscDtVgk
yzKFl57pnoxVdGjqejiF10v904sG1uHU8h87jtmnhxpgUz/TTLo=
=RrJV
-----END PGP SIGNATURE-----
Merge 4.9.74 into android-4.9-o
Changes in 4.9.74
sync objtool's copy of x86-opcode-map.txt
tracing: Remove extra zeroing out of the ring buffer page
tracing: Fix possible double free on failure of allocating trace buffer
tracing: Fix crash when it fails to alloc ring buffer
ring-buffer: Mask out the info bits when returning buffer page length
iw_cxgb4: Only validate the MSN for successful completions
ASoC: wm_adsp: Fix validation of firmware and coeff lengths
ASoC: da7218: fix fix child-node lookup
ASoC: fsl_ssi: AC'97 ops need regmap, clock and cleaning up on failure
ASoC: twl4030: fix child-node lookup
ASoC: tlv320aic31xx: Fix GPIO1 register definition
ALSA: hda: Drop useless WARN_ON()
ALSA: hda - fix headset mic detection issue on a Dell machine
x86/vm86/32: Switch to flush_tlb_mm_range() in mark_screen_rdonly()
x86/mm: Remove flush_tlb() and flush_tlb_current_task()
x86/mm: Make flush_tlb_mm_range() more predictable
x86/mm: Reimplement flush_tlb_page() using flush_tlb_mm_range()
x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code
x86/mm: Disable PCID on 32-bit kernels
x86/mm: Add the 'nopcid' boot option to turn off PCID
x86/mm: Enable CR4.PCIDE on supported systems
x86/mm/64: Fix reboot interaction with CR4.PCIDE
kbuild: add '-fno-stack-check' to kernel build options
ipv4: igmp: guard against silly MTU values
ipv6: mcast: better catch silly mtu values
net: fec: unmap the xmit buffer that are not transferred by DMA
net: igmp: Use correct source address on IGMPv3 reports
netlink: Add netns check on taps
net: qmi_wwan: add Sierra EM7565 1199:9091
net: reevalulate autoflowlabel setting after sysctl setting
ptr_ring: add barriers
RDS: Check cmsg_len before dereferencing CMSG_DATA
tcp_bbr: record "full bw reached" decision in new full_bw_reached bit
tcp md5sig: Use skb's saddr when replying to an incoming segment
tg3: Fix rx hang on MTU change with 5717/5719
net: ipv4: fix for a race condition in raw_sendmsg
net: mvmdio: disable/unprepare clocks in EPROBE_DEFER case
sctp: Replace use of sockets_allocated with specified macro.
adding missing rcu_read_unlock in ipxip6_rcv
ipv4: Fix use-after-free when flushing FIB tables
net: bridge: fix early call to br_stp_change_bridge_id and plug newlink leaks
net: fec: Allow reception of frames bigger than 1522 bytes
net: Fix double free and memory corruption in get_net_ns_by_id()
net: phy: micrel: ksz9031: reconfigure autoneg after phy autoneg workaround
sock: free skb in skb_complete_tx_timestamp on error
tcp: invalidate rate samples during SACK reneging
net/mlx5: Fix rate limit packet pacing naming and struct
net/mlx5e: Fix features check of IPv6 traffic
net/mlx5e: Fix possible deadlock of VXLAN lock
net/mlx5e: Add refcount to VXLAN structure
net/mlx5e: Prevent possible races in VXLAN control flow
net/mlx5: Fix error flow in CREATE_QP command
s390/qeth: apply takeover changes when mode is toggled
s390/qeth: don't apply takeover changes to RXIP
s390/qeth: lock IP table while applying takeover changes
s390/qeth: update takeover IPs after configuration change
usbip: fix usbip bind writing random string after command in match_busid
usbip: prevent leaking socket pointer address in messages
usbip: stub: stop printing kernel pointer addresses in messages
usbip: vhci: stop printing kernel pointer addresses in messages
USB: serial: ftdi_sio: add id for Airbus DS P8GR
USB: serial: qcserial: add Sierra Wireless EM7565
USB: serial: option: add support for Telit ME910 PID 0x1101
USB: serial: option: adding support for YUGA CLM920-NC5
usb: Add device quirk for Logitech HD Pro Webcam C925e
usb: add RESET_RESUME for ELSA MicroLink 56K
USB: Fix off by one in type-specific length check of BOS SSP capability
usb: xhci: Add XHCI_TRUST_TX_LENGTH for Renesas uPD720201
timers: Use deferrable base independent of base::nohz_active
timers: Invoke timer_start_debug() where it makes sense
timers: Reinitialize per cpu bases on hotplug
nohz: Prevent a timer interrupt storm in tick_nohz_stop_sched_tick()
x86/smpboot: Remove stale TLB flush invocations
n_tty: fix EXTPROC vs ICANON interaction with TIOCINQ (aka FIONREAD)
tty: fix tty_ldisc_receive_buf() documentation
mm/vmstat: Make NR_TLB_REMOTE_FLUSH_RECEIVED available even on UP
Linux 4.9.74
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlpL3vYACgkQONu9yGCS
aT4/aQ//VcOiG5at4QV8aEyPkmlL69jspa5yWwbbz0p3vddZrGHb72aT+lfcPgOk
tZpHR4zKOwPPu6ROgVMnyGQTks/I5ZwCqxVjuapgiXJy34QIh6JLjldKl03Bfoz8
2Q+5u1eia1R+2pLhEQLPp5siH3pbgqjMiC/jr2UtleC1QKiwOgmFApoXsl35OxUW
VkTjdqTcllxa5cFmEgb53xzH/zm0XemVe6xNH4Y+KMUmow/GcynPdxjZxkBpgl4t
HEhPR1UP708JF+LHv4FA35HujtxtK9y1UVpZmroW4Y6tW/lwwYAgvIWOC0EYv1i0
Uin5NfvG2BVkSmct19qn7IKfuVffCRb+dxvKP9I1wembqZSo68QC8rjs/dYbw+VU
SOGZM/Nd4m3yseM1QjQHc97GSvxtDwqzRBFp5c43HXrmn1ha8By9kqWa25JsiwJo
GHWmDzTWw9gW7Jp/1EVY7VGO3FNSJHy87ZIHoEnAXxzCtf7BZL2Z+myQhhPIiCXg
9jtcGkhvFVkvwjJQAAxPRr8kcNQaGZbTqh/ZhYzahl/HNAX6Ez/af30wJkmand2V
geps+QgWIzy6dgIiWr9YnJgqRbMeaHE8Ncn/Ch/8Lp30tkFnpUEOrdqFOscDtVgk
yzKFl57pnoxVdGjqejiF10v904sG1uHU8h87jtmnhxpgUz/TTLo=
=RrJV
-----END PGP SIGNATURE-----
Merge 4.9.74 into android-4.9
Changes in 4.9.74
sync objtool's copy of x86-opcode-map.txt
tracing: Remove extra zeroing out of the ring buffer page
tracing: Fix possible double free on failure of allocating trace buffer
tracing: Fix crash when it fails to alloc ring buffer
ring-buffer: Mask out the info bits when returning buffer page length
iw_cxgb4: Only validate the MSN for successful completions
ASoC: wm_adsp: Fix validation of firmware and coeff lengths
ASoC: da7218: fix fix child-node lookup
ASoC: fsl_ssi: AC'97 ops need regmap, clock and cleaning up on failure
ASoC: twl4030: fix child-node lookup
ASoC: tlv320aic31xx: Fix GPIO1 register definition
ALSA: hda: Drop useless WARN_ON()
ALSA: hda - fix headset mic detection issue on a Dell machine
x86/vm86/32: Switch to flush_tlb_mm_range() in mark_screen_rdonly()
x86/mm: Remove flush_tlb() and flush_tlb_current_task()
x86/mm: Make flush_tlb_mm_range() more predictable
x86/mm: Reimplement flush_tlb_page() using flush_tlb_mm_range()
x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code
x86/mm: Disable PCID on 32-bit kernels
x86/mm: Add the 'nopcid' boot option to turn off PCID
x86/mm: Enable CR4.PCIDE on supported systems
x86/mm/64: Fix reboot interaction with CR4.PCIDE
kbuild: add '-fno-stack-check' to kernel build options
ipv4: igmp: guard against silly MTU values
ipv6: mcast: better catch silly mtu values
net: fec: unmap the xmit buffer that are not transferred by DMA
net: igmp: Use correct source address on IGMPv3 reports
netlink: Add netns check on taps
net: qmi_wwan: add Sierra EM7565 1199:9091
net: reevalulate autoflowlabel setting after sysctl setting
ptr_ring: add barriers
RDS: Check cmsg_len before dereferencing CMSG_DATA
tcp_bbr: record "full bw reached" decision in new full_bw_reached bit
tcp md5sig: Use skb's saddr when replying to an incoming segment
tg3: Fix rx hang on MTU change with 5717/5719
net: ipv4: fix for a race condition in raw_sendmsg
net: mvmdio: disable/unprepare clocks in EPROBE_DEFER case
sctp: Replace use of sockets_allocated with specified macro.
adding missing rcu_read_unlock in ipxip6_rcv
ipv4: Fix use-after-free when flushing FIB tables
net: bridge: fix early call to br_stp_change_bridge_id and plug newlink leaks
net: fec: Allow reception of frames bigger than 1522 bytes
net: Fix double free and memory corruption in get_net_ns_by_id()
net: phy: micrel: ksz9031: reconfigure autoneg after phy autoneg workaround
sock: free skb in skb_complete_tx_timestamp on error
tcp: invalidate rate samples during SACK reneging
net/mlx5: Fix rate limit packet pacing naming and struct
net/mlx5e: Fix features check of IPv6 traffic
net/mlx5e: Fix possible deadlock of VXLAN lock
net/mlx5e: Add refcount to VXLAN structure
net/mlx5e: Prevent possible races in VXLAN control flow
net/mlx5: Fix error flow in CREATE_QP command
s390/qeth: apply takeover changes when mode is toggled
s390/qeth: don't apply takeover changes to RXIP
s390/qeth: lock IP table while applying takeover changes
s390/qeth: update takeover IPs after configuration change
usbip: fix usbip bind writing random string after command in match_busid
usbip: prevent leaking socket pointer address in messages
usbip: stub: stop printing kernel pointer addresses in messages
usbip: vhci: stop printing kernel pointer addresses in messages
USB: serial: ftdi_sio: add id for Airbus DS P8GR
USB: serial: qcserial: add Sierra Wireless EM7565
USB: serial: option: add support for Telit ME910 PID 0x1101
USB: serial: option: adding support for YUGA CLM920-NC5
usb: Add device quirk for Logitech HD Pro Webcam C925e
usb: add RESET_RESUME for ELSA MicroLink 56K
USB: Fix off by one in type-specific length check of BOS SSP capability
usb: xhci: Add XHCI_TRUST_TX_LENGTH for Renesas uPD720201
timers: Use deferrable base independent of base::nohz_active
timers: Invoke timer_start_debug() where it makes sense
timers: Reinitialize per cpu bases on hotplug
nohz: Prevent a timer interrupt storm in tick_nohz_stop_sched_tick()
x86/smpboot: Remove stale TLB flush invocations
n_tty: fix EXTPROC vs ICANON interaction with TIOCINQ (aka FIONREAD)
tty: fix tty_ldisc_receive_buf() documentation
mm/vmstat: Make NR_TLB_REMOTE_FLUSH_RECEIVED available even on UP
Linux 4.9.74
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 84aeb437ab98a2bce3d4b2111c79723aedfceb33 ]
The early call to br_stp_change_bridge_id in bridge's newlink can cause
a memory leak if an error occurs during the newlink because the fdb
entries are not cleaned up if a different lladdr was specified, also
another minor issue is that it generates fdb notifications with
ifindex = 0. Another unrelated memory leak is the bridge sysfs entries
which get added on NETDEV_REGISTER event, but are not cleaned up in the
newlink error path. To remove this special case the call to
br_stp_change_bridge_id is done after netdev register and we cleanup the
bridge on changelink error via br_dev_delete to plug all leaks.
This patch makes netlink bridge destruction on newlink error the same as
dellink and ioctl del which is necessary since at that point we have a
fully initialized bridge device.
To reproduce the issue:
$ ip l add br0 address 00:11:22:33:44:55 type bridge group_fwd_mask 1
RTNETLINK answers: Invalid argument
$ rmmod bridge
[ 1822.142525] =============================================================================
[ 1822.143640] BUG bridge_fdb_cache (Tainted: G O ): Objects remaining in bridge_fdb_cache on __kmem_cache_shutdown()
[ 1822.144821] -----------------------------------------------------------------------------
[ 1822.145990] Disabling lock debugging due to kernel taint
[ 1822.146732] INFO: Slab 0x0000000092a844b2 objects=32 used=2 fp=0x00000000fef011b0 flags=0x1ffff8000000100
[ 1822.147700] CPU: 2 PID: 13584 Comm: rmmod Tainted: G B O 4.15.0-rc2+ #87
[ 1822.148578] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[ 1822.150008] Call Trace:
[ 1822.150510] dump_stack+0x78/0xa9
[ 1822.151156] slab_err+0xb1/0xd3
[ 1822.151834] ? __kmalloc+0x1bb/0x1ce
[ 1822.152546] __kmem_cache_shutdown+0x151/0x28b
[ 1822.153395] shutdown_cache+0x13/0x144
[ 1822.154126] kmem_cache_destroy+0x1c0/0x1fb
[ 1822.154669] SyS_delete_module+0x194/0x244
[ 1822.155199] ? trace_hardirqs_on_thunk+0x1a/0x1c
[ 1822.155773] entry_SYSCALL_64_fastpath+0x23/0x9a
[ 1822.156343] RIP: 0033:0x7f929bd38b17
[ 1822.156859] RSP: 002b:00007ffd160e9a98 EFLAGS: 00000202 ORIG_RAX: 00000000000000b0
[ 1822.157728] RAX: ffffffffffffffda RBX: 00005578316ba090 RCX: 00007f929bd38b17
[ 1822.158422] RDX: 00007f929bd9ec60 RSI: 0000000000000800 RDI: 00005578316ba0f0
[ 1822.159114] RBP: 0000000000000003 R08: 00007f929bff5f20 R09: 00007ffd160e8a11
[ 1822.159808] R10: 00007ffd160e9860 R11: 0000000000000202 R12: 00007ffd160e8a80
[ 1822.160513] R13: 0000000000000000 R14: 0000000000000000 R15: 00005578316ba090
[ 1822.161278] INFO: Object 0x000000007645de29 @offset=0
[ 1822.161666] INFO: Object 0x00000000d5df2ab5 @offset=128
Fixes: 30313a3d57 ("bridge: Handle IFLA_ADDRESS correctly when creating bridge device")
Fixes: 5b8d5429daa0 ("bridge: netlink: register netdevice before executing changelink")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Nikolay Aleksandrovauthored and Greg Kroah-Hartmancommited 2018-01-02 20:35:12 +01:00
* 4.9/tmp-8dd0f52:
Linux 4.9.72
sparc32: Export vac_cache_size to fix build error
bpf: fix incorrect sign extension in check_alu_op()
bpf: reject out-of-bounds stack pointer calculation
bpf: fix branch pruning logic
bpf: adjust insn_aux_data when patching insns
Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature"
platform/x86: asus-wireless: send an EV_SYN/SYN_REPORT between state changes
MIPS: math-emu: Fix final emulation phase for certain instructions
thermal/drivers/hisi: Fix multiple alarm interrupts firing
thermal/drivers/hisi: Simplify the temperature/step computation
thermal/drivers/hisi: Fix kernel panic on alarm interrupt
thermal/drivers/hisi: Fix missing interrupt enablement
thermal: hisilicon: Handle return value of clk_prepare_enable
cpuidle: fix broadcast control when broadcast can not be entered
rtc: set the alarm to the next expiring timer
tcp: fix under-evaluated ssthresh in TCP Vegas
clk: sunxi-ng: sun6i: Rename HDMI DDC clock to avoid name collision
staging: greybus: light: Release memory obtained by kasprintf
net: ipv6: send NS for DAD when link operationally up
fm10k: ensure we process SM mbx when processing VF mbx
vfio/pci: Virtualize Maximum Payload Size
scsi: lpfc: PLOGI failures during NPIV testing
scsi: lpfc: Fix secure firmware updates
fm10k: fix mis-ordered parameters in declaration for .ndo_set_vf_bw
ASoC: img-parallel-out: Add pm_runtime_get/put to set_fmt callback
tracing: Exclude 'generic fields' from histograms
PCI/AER: Report non-fatal errors only to the affected endpoint
IB/rxe: check for allocation failure on elem
ixgbe: fix use of uninitialized padding
igb: check memory allocation failure
PM / OPP: Move error message to debug level
PCI: Create SR-IOV virtfn/physfn links before attaching driver
scsi: mpt3sas: Fix IO error occurs on pulling out a drive from RAID1 volume created on two SATA drive
scsi: cxgb4i: fix Tx skb leak
PCI: Avoid bus reset if bridge itself is broken
net: phy: at803x: Change error to EINVAL for invalid MAC
kvm, mm: account kvm related kmem slabs to kmemcg
rtc: pl031: make interrupt optional
crypto: crypto4xx - increase context and scatter ring buffer elements
backlight: pwm_bl: Fix overflow condition
bnxt_en: Fix NULL pointer dereference in reopen failure path
cpuidle: powernv: Pass correct drv->cpumask for registration
ARM: dma-mapping: disallow dma_get_sgtable() for non-kernel managed memory
Btrfs: fix an integer overflow check
netfilter: nfnetlink_queue: fix secctx memory leak
xhci: plat: Register shutdown for xhci_plat
net: moxa: fix TX overrun memory leak
isdn: kcapi: avoid uninitialized data
virtio_balloon: prevent uninitialized variable use
virtio-balloon: use actual number of stats for stats queue buffers
KVM: pci-assign: do not map smm memory slot pages in vt-d page tables
net: ipconfig: fix ic_close_devs() use-after-free
cpufreq: Fix creation of symbolic links to policy directories
ARM: dts: am335x-evmsk: adjust mmc2 param to allow suspend
netfilter: nf_nat_snmp: Fix panic when snmp_trap_helper fails to register
netfilter: nfnl_cthelper: fix a race when walk the nf_ct_helper_hash table
irda: vlsi_ir: fix check for DMA mapping errors
RDMA/iser: Fix possible mr leak on device removal event
i40e: Do not enable NAPI on q_vectors that have no rings
IB/rxe: increment msn only when completing a request
IB/rxe: double free on error
net: Do not allow negative values for busy_read and busy_poll sysctl interfaces
nbd: set queue timeout properly
infiniband: Fix alignment of mmap cookies to support VIPT caching
IB/core: Protect against self-requeue of a cq work item
i40iw: Receive netdev events post INET_NOTIFIER state
bna: avoid writing uninitialized data into hw registers
s390/qeth: no ETH header for outbound AF_IUCV
s390/qeth: size calculation outbound buffers
r8152: prevent the driver from transmitting packets with carrier off
ASoC: STI: Fix reader substream pointer set
HID: xinmo: fix for out of range for THT 2P arcade controller.
hwmon: (asus_atk0110) fix uninitialized data access
ARM: dts: ti: fix PCI bus dtc warnings
KVM: VMX: Fix enable VPID conditions
KVM: x86: correct async page present tracepoint
kvm: vmx: Flush TLB when the APIC-access address changes
scsi: lpfc: Fix PT2PT PRLI reject
pinctrl: st: add irq_request/release_resources callbacks
inet: frag: release spinlock before calling icmp_send()
tipc: fix nametbl deadlock at tipc_nametbl_unsubscribe
r8152: fix the rx early size of RTL8153
iommu/exynos: Workaround FLPD cache flush issues for SYSMMU v5
netfilter: nfnl_cthelper: Fix memory leak
netfilter: nfnl_cthelper: fix runtime expectation policy updates
usb: gadget: udc: remove pointer dereference after free
usb: gadget: f_uvc: Sanity check wMaxPacketSize for SuperSpeed
hwmon: (max31790) Set correct PWM value
net: qmi_wwan: Add USB IDs for MDM6600 modem on Motorola Droid 4
sctp: out_qlen should be updated when pruning unsent queue
bna: integer overflow bug in debugfs
sch_dsmark: fix invalid skb_cow() usage
vsock: cancel packets when failing to connect
vhost-vsock: add pkt cancel capability
vsock: track pkt owner vsock
crypto: deadlock between crypto_alg_sem/rtnl_mutex/genl_mutex
r8152: fix the list rx_done may be used without initialization
cpuidle: Validate cpu_dev in cpuidle_add_sysfs()
nvme-loop: handle cpu unplug when re-establishing the controller
arm: kprobes: Align stack to 8-bytes in test code
arm: kprobes: Fix the return address of multiple kretprobes
HID: corsair: Add driver Scimitar Pro RGB gaming mouse 1b1c:1b3e support to hid-corsair
HID: corsair: support for K65-K70 Rapidfire and Scimitar Pro RGB
kvm: fix usage of uninit spinlock in avic_vm_destroy()
ALSA: hda - add support for docking station for HP 840 G3
ALSA: hda - add support for docking station for HP 820 G2
arm64: Initialise high_memory global variable earlier
cxl: Check if vphb exists before iterating over AFU devices
Linux 4.9.71
ath9k: fix tx99 potential info leak
icmp: don't fail on fragment reassembly time exceeded
IB/ipoib: Grab rtnl lock on heavy flush when calling ndo_open/stop
RDMA/cma: Avoid triggering undefined behavior
macvlan: Only deliver one copy of the frame to the macvlan interface
udf: Avoid overflow when session starts at large offset
scsi: bfa: integer overflow in debugfs
scsi: sd: change allow_restart to bool in sysfs interface
scsi: sd: change manage_start_stop to bool in sysfs interface
rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_disassoc_cmd
rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_createbss_cmd
vt6655: Fix a possible sleep-in-atomic bug in vt6655_suspend
IB/core: Fix calculation of maximum RoCE MTU
scsi: scsi_devinfo: Add REPORTLUN2 to EMC SYMMETRIX blacklist entry
raid5: Set R5_Expanded on parity devices as well as data.
pinctrl: adi2: Fix Kconfig build problem
usb: musb: da8xx: fix babble condition handling
tty fix oops when rmmod 8250
soc: mediatek: pwrap: fix compiler errors
powerpc/perf/hv-24x7: Fix incorrect comparison in memord
scsi: hpsa: destroy sas transport properties before scsi_host
scsi: hpsa: cleanup sas_phy structures in sysfs when unloading
PCI: Detach driver before procfs & sysfs teardown on device remove
RDMA/cxgb4: Declare stag as __be32
xfs: fix incorrect extent state in xfs_bmap_add_extent_unwritten_real
xfs: fix log block underflow during recovery cycle verification
l2tp: cleanup l2tp_tunnel_delete calls
nvme: use kref_get_unless_zero in nvme_find_get_ns
platform/x86: hp_accel: Add quirk for HP ProBook 440 G4
btrfs: tests: Fix a memory leak in error handling path in 'run_test()'
arm64: prevent regressions in compressed kernel image size when upgrading to binutils 2.27
Ib/hfi1: Return actual operational VLs in port info query
bcache: fix wrong cache_misses statistics
bcache: explicitly destroy mutex while exiting
GFS2: Take inode off order_write list when setting jdata flag
scsi: scsi_debug: write_same: fix error report
thermal/drivers/step_wise: Fix temperature regulation misbehavior
ASoC: rsnd: rsnd_ssi_run_mods() needs to care ssi_parent_mod
ppp: Destroy the mutex when cleanup
clk: tegra: Fix cclk_lp divisor register
clk: hi6220: mark clock cs_atb_syspll as critical
clk: imx6: refine hdmi_isfr's parent to make HDMI work on i.MX6 SoCs w/o VPU
clk: mediatek: add the option for determining PLL source clock
mm: Handle 0 flags in _calc_vm_trans() macro
crypto: tcrypt - fix buffer lengths in test_aead_speed()
arm-ccn: perf: Prevent module unload while PMU is in use
xfs: truncate pagecache before writeback in xfs_setattr_size()
iommu/amd: Limit the IOVA page range to the specified addresses
badblocks: fix wrong return value in badblocks_set if badblocks are disabled
target/file: Do not return error for UNMAP if length is zero
target:fix condition return in core_pr_dump_initiator_port()
iscsi-target: fix memory leak in lio_target_tiqn_addtpg()
target/iscsi: Fix a race condition in iscsit_add_reject_from_cmd()
platform/x86: intel_punit_ipc: Fix resource ioremap warning
powerpc/ipic: Fix status get and status clear
powerpc/opal: Fix EBUSY bug in acquiring tokens
netfilter: ipvs: Fix inappropriate output of procfs
iommu/mediatek: Fix driver name
PCI: Do not allocate more buses than available in parent
powerpc/powernv/cpufreq: Fix the frequency read by /proc/cpuinfo
PCI/PME: Handle invalid data when reading Root Status
dmaengine: ti-dma-crossbar: Correct am335x/am43xx mux value type
ASoC: Intel: Skylake: Fix uuid_module memory leak in failure case
rtc: pcf8563: fix output clock rate
video: fbdev: au1200fb: Return an error code if a memory allocation fails
video: fbdev: au1200fb: Release some resources if a memory allocation fails
video: udlfb: Fix read EDID timeout
fbdev: controlfb: Add missing modes to fix out of bounds access
sfc: don't warn on successful change of MAC
HID: cp2112: fix broken gpio_direction_input callback
Revert "x86/acpi: Set persistent cpuid <-> nodeid mapping when booting"
target: fix race during implicit transition work flushes
target: fix ALUA transition timeout handling
target: Use system workqueue for ALUA transitions
btrfs: add missing memset while reading compressed inline extents
NFSv4.1 respect server's max size in CREATE_SESSION
efi/esrt: Cleanup bad memory map log messages
perf symbols: Fix symbols__fixup_end heuristic for corner cases
tty: fix data race in tty_ldisc_ref_wait()
tty: don't panic on OOM in tty_set_ldisc()
rxrpc: Ignore BUSY packets on old calls
net: mpls: Fix nexthop alive tracking on down events
net/mlx4_core: Avoid delays during VF driver device shutdown
nvmet-rdma: Fix a possible uninitialized variable dereference
nvmet: confirm sq percpu has scheduled and switched to atomic
nvme-loop: fix a possible use-after-free when destroying the admin queue
afs: Fix abort on signal while waiting for call completion
afs: Fix afs_kill_pages()
afs: Fix page leak in afs_write_begin()
afs: Populate and use client modification time
afs: Better abort and net error handling
afs: Invalid op ID should abort with RXGEN_OPCODE
afs: Fix the maths in afs_fs_store_data()
afs: Prevent callback expiry timer overflow
afs: Migrate vlocation fields to 64-bit
afs: Flush outstanding writes when an fd is closed
afs: Deal with an empty callback array
afs: Adjust mode bits processing
afs: Populate group ID from vnode status
afs: Fix missing put_page()
drm/radeon: reinstate oland workaround for sclk
mmc: mediatek: Fixed bug where clock frequency could be set wrong
sched/deadline: Use deadline instead of period when calculating overflow
sched/deadline: Throttle a constrained deadline task activated after the deadline
sched/deadline: Make sure the replenishment timer fires in the next period
sched/deadline: Add missing update_rq_clock() in dl_task_timer()
iwlwifi: mvm: cleanup pending frames in DQA mode
Drivers: hv: util: move waiting for release to hv_utils_transport itself
drm/radeon/si: add dpm quirk for Oland
fjes: Fix wrong netdevice feature flags
scsi: hpsa: do not timeout reset operations
scsi: hpsa: limit outstanding rescans
scsi: hpsa: update check for logical volume status
ASoC: rcar: clear DE bit only in PDMACHCR when it stops
openrisc: fix issue handling 8 byte get_user calls
intel_th: pci: Add Gemini Lake support
drm: amd: remove broken include path
qed: Fix interrupt flags on Rx LL2
qed: Fix mapping leak on LL2 rx flow
qed: Align CIDs according to DORQ requirement
mlxsw: reg: Fix SPVMLR max record count
mlxsw: reg: Fix SPVM max record count
net: Resend IGMP memberships upon peer notification.
irqchip/mvebu-odmi: Select GENERIC_MSI_IRQ_DOMAIN
dmaengine: Fix array index out of bounds warning in __get_unmap_pool()
net: wimax/i2400m: fix NULL-deref at probe
writeback: fix memory leak in wb_queue_work()
blk-mq: Fix tagset reinit in the presence of cpu hot-unplug
ASoC: rsnd: fix sound route path when using SRC6/SRC9
netfilter: bridge: honor frag_max_size when refragmenting
drm/omap: fix dmabuf mmap for dma_alloc'ed buffers
Input: i8042 - add TUXEDO BU1406 (N24_25BU) to the nomux list
NFSD: fix nfsd_reset_versions for NFSv4.
NFSD: fix nfsd_minorversion(.., NFSD_AVAIL)
drm/amdgpu: fix parser init error path to avoid crash in parser fini
iommu/io-pgtable-arm-v7s: Check for leaf entry before dereferencing it
net/mlx5: Don't save PCI state when PCI error is detected
net/mlx5: Fix create autogroup prev initializer
rxrpc: Wake up the transmitter if Rx window size increases on the peer
net: bcmgenet: Power up the internal PHY before probing the MII
net: bcmgenet: synchronize irq0 status between the isr and task
net: bcmgenet: power down internal phy if open or resume fails
net: bcmgenet: reserved phy revisions must be checked first
net: bcmgenet: correct MIB access of UniMAC RUNT counters
net: bcmgenet: correct the RBUF_OVFL_CNT and RBUF_ERR_CNT MIB values
bnxt_en: Ignore 0 value in autoneg supported speed from firmware.
net: initialize msg.msg_flags in recvfrom
userfaultfd: selftest: vm: allow to build in vm/ directory
userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE
md-cluster: free md_cluster_info if node leave cluster
usb: xhci-mtk: check hcc_params after adding primary hcd
KVM: nVMX: do not warn when MSR bitmap address is not backed
usb: phy: isp1301: Add OF device ID table
mac80211: Fix addition of mesh configuration element
ext4: fix crash when a directory's i_size is too small
ext4: fix fdatasync(2) after fallocate(2) operation
dmaengine: dmatest: move callback wait queue to thread context
eeprom: at24: change nvmem stride to 1
sched/rt: Do not pull from current CPU if only one CPU to pull
nfs: don't wait on commit in nfs_commit_inode() if there were no commit requests
xhci: Don't add a virt_dev to the devs array before it's fully allocated
Bluetooth: btusb: driver to enable the usb-wakeup feature
usb: xhci: fix TDS for MTK xHCI1.1
ceph: drop negative child dentries before try pruning inode's alias
usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer
usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input
usb: add helper to extract bits 12:11 of wMaxPacketSize
usbip: fix stub_rx: get_pipe() to validate endpoint number
USB: core: prevent malicious bNumInterfaces overflow
USB: uas and storage: Add US_FL_BROKEN_FUA for another JMicron JMS567 ID
tracing: Allocate mask_str buffer dynamically
autofs: fix careless error in recent commit
crypto: salsa20 - fix blkcipher_walk API usage
crypto: hmac - require that the underlying hash algorithm is unkeyed
crypto: rsa - fix buffer overread when stripping leading zeroes
mfd: fsl-imx25: Clean up irq settings during removal
Linux 4.9.70
RDMA/cxgb4: Annotate r2 and stag as __be32
md: free unused memory after bitmap resize
audit: ensure that 'audit=1' actually enables audit for PID 1
ipvlan: fix ipv6 outbound device
kbuild: do not call cc-option before KBUILD_CFLAGS initialization
powerpc/64: Fix checksum folding in csum_tcpudp_nofold and ip_fast_csum_nofold
KVM: arm/arm64: vgic-its: Preserve the revious read from the pending table
fix kcm_clone()
usb: gadget: ffs: Forbid usb_ep_alloc_request from sleeping
s390: always save and restore all registers on context switch
ipmi: Stop timers before cleaning up the module
Fix handling of verdicts after NF_QUEUE
tipc: call tipc_rcv() only if bearer is up in tipc_udp_recv()
s390/qeth: fix thinko in IPv4 multicast address tracking
s390/qeth: fix GSO throughput regression
s390/qeth: build max size GSO skbs on L2 devices
tcp/dccp: block bh before arming time_wait timer
stmmac: reset last TSO segment size after device open
net: remove hlist_nulls_add_tail_rcu()
usbnet: fix alignment for frames with no ethernet header
net/packet: fix a race in packet_bind() and packet_notifier()
packet: fix crash in fanout_demux_rollover()
sit: update frag_off info
rds: Fix NULL pointer dereference in __rds_rdma_map
tipc: fix memory leak in tipc_accept_from_sock()
s390/qeth: fix early exit from error path
net: qmi_wwan: add Quectel BG96 2c7c:0296
ANDROID: dma-buf/sw_sync: Rename active_list to link
FROMLIST: android: binder: Fix null ptr dereference in debug msg
FROMLIST: android: binder: Move buffer out of area shared with user space
FROMLIST: android: binder: Add allocator selftest
FROMLIST: android: binder: Refactor prev and next buffer into a helper function
Linux 4.9.69
afs: Connect up the CB.ProbeUuid
IB/mlx5: Assign send CQ and recv CQ of UMR QP
IB/mlx4: Increase maximal message size under UD QP
xfrm: Copy policy family in clone_policy
jump_label: Invoke jump_label_test() via early_initcall()
atm: horizon: Fix irq release error
clk: uniphier: fix DAPLL2 clock rate of Pro5
bpf: fix lockdep splat
sctp: use the right sk after waking up from wait_buf sleep
sctp: do not free asoc when it is already dead in sctp_sendmsg
zsmalloc: calling zs_map_object() from irq is a bug
sparc64/mm: set fields in deferred pages
block: wake up all tasks blocked in get_request()
dt-bindings: usb: fix reg-property port-number range
xfs: fix forgotten rcu read unlock when skipping inode reclaim
sunrpc: Fix rpc_task_begin trace point
NFS: Fix a typo in nfs_rename()
dynamic-debug-howto: fix optional/omitted ending line number to be LARGE instead of 0
lib/genalloc.c: make the avail variable an atomic_long_t
drivers/rapidio/devices/rio_mport_cdev.c: fix resource leak in error handling path in 'rio_dma_transfer()'
route: update fnhe_expires for redirect when the fnhe exists
route: also update fnhe_genid when updating a route cache
gre6: use log_ecn_error module parameter in ip6_tnl_rcv()
mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl()
x86/mpx/selftests: Fix up weird arrays
coccinelle: fix parallel build with CHECK=scripts/coccicheck
kbuild: pkg: use --transform option to prefix paths in tar
EDAC, i5000, i5400: Fix definition of NRECMEMB register
EDAC, i5000, i5400: Fix use of MTR_DRAM_WIDTH macro
powerpc/powernv/ioda2: Gracefully fail if too many TCE levels requested
drm/amd/amdgpu: fix console deadlock if late init failed
axonram: Fix gendisk handling
netfilter: don't track fragmented packets
zram: set physical queue limits to avoid array out of bounds accesses
blk-mq: initialize mq kobjects in blk_mq_init_allocated_queue()
i2c: riic: fix restart condition
crypto: s5p-sss - Fix completing crypto request in IRQ handler
ipv6: reorder icmpv6_init() and ip6_mr_init()
ibmvnic: Allocate number of rx/tx buffers agreed on by firmware
ibmvnic: Fix overflowing firmware/hardware TX queue
rds: tcp: Sequence teardown of listen and acceptor sockets to avoid races
bnx2x: do not rollback VF MAC/VLAN filters we did not configure
bnx2x: fix detection of VLAN filtering feature for VF
bnx2x: fix possible overrun of VFPF multicast addresses array
bnx2x: prevent crash when accessing PTP with interface down
spi_ks8995: regs_size incorrect for some devices
spi_ks8995: fix "BUG: key accdaa28 not in .data!"
KVM: arm/arm64: VGIC: Fix command handling while ITS being disabled
arm64: KVM: Survive unknown traps from guests
arm: KVM: Survive unknown traps from guests
KVM: nVMX: reset nested_run_pending if the vCPU is going to be reset
irqchip/crossbar: Fix incorrect type of register size
scsi: lpfc: Fix crash during Hardware error recovery on SLI3 adapters
scsi: qla2xxx: Fix ql_dump_buffer
workqueue: trigger WARN if queue_delayed_work() is called with NULL @wq
libata: drop WARN from protocol error in ata_sff_qc_issue()
kvm: nVMX: VMCLEAR should not cause the vCPU to shut down
usb: gadget: udc: net2280: Fix tmp reusage in net2280 driver
usb: gadget: pxa27x: Test for a valid argument pointer
usb: dwc3: gadget: Fix system suspend/resume on TI platforms
USB: gadgetfs: Fix a potential memory leak in 'dev_config()'
usb: gadget: configs: plug memory leak
HID: chicony: Add support for another ASUS Zen AiO keyboard
gpio: altera: Use handle_level_irq when configured as a level_high
ASoC: rcar: avoid SSI_MODEx settings for SSI8
ARM: OMAP2+: Release device node after it is no longer needed.
ARM: OMAP2+: Fix device node reference counts
powerpc/64: Fix checksum folding in csum_add()
module: set __jump_table alignment to 8
lirc: fix dead lock between open and wakeup_filter
powerpc: Fix compiling a BE kernel with a powerpc64le toolchain
selftest/powerpc: Fix false failures for skipped tests
powerpc/64: Invalidate process table caching after setting process table
x86/hpet: Prevent might sleep splat on resume
sched/fair: Make select_idle_cpu() more aggressive
x86/platform/uv/BAU: Fix HUB errors by remove initial write to sw-ack register
x86/selftests: Add clobbers for int80 on x86_64
ARM: OMAP2+: gpmc-onenand: propagate error on initialization failure
vti6: Don't report path MTU below IPV6_MIN_MTU.
ARM: 8657/1: uaccess: consistently check object sizes
Revert "spi: SPI_FSL_DSPI should depend on HAS_DMA"
Revert "drm/armada: Fix compile fail"
mm: drop unused pmdp_huge_get_and_clear_notify()
thp: fix MADV_DONTNEED vs. numa balancing race
thp: reduce indentation level in change_huge_pmd()
ARM: avoid faulting on qemu
ARM: BUG if jumping to usermode address in kernel mode
usb: f_fs: Force Reserved1=1 in OS_DESC_EXT_COMPAT
crypto: talitos - fix ctr-aes-talitos
crypto: talitos - fix use of sg_link_tbl_len
crypto: talitos - fix AEAD for sha224 on non sha224 capable chips
crypto: talitos - fix setkey to check key weakness
crypto: talitos - fix memory corruption on SEC2
crypto: talitos - fix AEAD test failures
bus: arm-ccn: fix module unloading Error: Removing state 147 which has instances left.
bus: arm-ccn: Fix use of smp_processor_id() in preemptible context
bus: arm-ccn: Check memory allocation failure
bus: arm-cci: Fix use of smp_processor_id() in preemptible context
arm64: fpsimd: Prevent registers leaking from dead tasks
KVM: arm/arm64: vgic-its: Check result of allocation before use
KVM: arm/arm64: vgic-irqfd: Fix MSI entry allocation
KVM: arm/arm64: Fix broken GICH_ELRSR big endian conversion
KVM: VMX: remove I/O port 0x80 bypass on Intel hosts
arm: KVM: Fix VTTBR_BADDR_MASK BUG_ON off-by-one
arm64: KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one
media: dvb: i2c transfers over usb cannot be done from stack
drm/exynos: gem: Drop NONCONTIG flag for buffers allocated without IOMMU
kdb: Fix handling of kallsyms_symbol_next() return value
brcmfmac: change driver unbind order of the sdio function devices
powerpc/64s: Initialize ISAv3 MMU registers before setting partition table
KVM: s390: Fix skey emulation permission check
s390: fix compat system call table
smp/hotplug: Move step CPUHP_AP_SMPCFD_DYING to the correct place
iommu/vt-d: Fix scatterlist offset handling
ALSA: usb-audio: Add check return value for usb_string()
ALSA: usb-audio: Fix out-of-bound error
ALSA: seq: Remove spurious WARN_ON() at timer check
ALSA: pcm: prevent UAF in snd_pcm_info
btrfs: fix missing error return in btrfs_drop_snapshot
KVM: x86: fix APIC page invalidation
x86/PCI: Make broadcom_postcore_init() check acpi_disabled
X.509: fix comparisons of ->pkey_algo
X.509: reject invalid BIT STRING for subjectPublicKey
KEYS: add missing permission check for request_key() destination
ASN.1: check for error from ASN1_OP_END__ACT actions
ASN.1: fix out-of-bounds read when parsing indefinite length item
efi/esrt: Use memunmap() instead of kfree() to free the remapping
efi: Move some sysfs files to be read-only by root
scsi: libsas: align sata_device's rps_resp on a cacheline
scsi: use dma_get_cache_alignment() as minimum DMA alignment
scsi: dma-mapping: always provide dma_get_cache_alignment
isa: Prevent NULL dereference in isa_bus driver callbacks
hv: kvp: Avoid reading past allocated blocks from KVP file
virtio: release virtio index when fail to device_register
can: usb_8dev: cancel urb on -EPIPE and -EPROTO
can: esd_usb2: cancel urb on -EPIPE and -EPROTO
can: ems_usb: cancel urb on -EPIPE and -EPROTO
can: kvaser_usb: cancel urb on -EPIPE and -EPROTO
can: kvaser_usb: ratelimit errors if incomplete messages are received
can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback()
can: kvaser_usb: free buf in error paths
can: ti_hecc: Fix napi poll return value for repoll
usb: gadget: udc: renesas_usb3: fix number of the pipes
ANDROID: Revert "arm64: move ELF_ET_DYN_BASE to 4GB / 4MB"
ANDROID: Revert "arm: move ELF_ET_DYN_BASE to 4MB"
Linux 4.9.68
xen-netfront: avoid crashing on resume after a failure in talk_to_netback()
usb: host: fix incorrect updating of offset
USB: usbfs: Filter flags passed in from user space
USB: devio: Prevent integer overflow in proc_do_submiturb()
USB: Increase usbfs transfer limit
USB: core: Add type-specific length check of BOS descriptors
usb: xhci: fix panic in xhci_free_virt_devices_depth_first
usb: hub: Cycle HUB power when initialization fails
dma-buf: Update kerneldoc for sync_file_create
dma-buf/sync_file: hold reference to fence when creating sync_file
dma-buf/sw_sync: force signal all unsignaled fences on dying timeline
dma-fence: Introduce drm_fence_set_error() helper
dma-fence: Wrap querying the fence->status
dma-fence: Clear fence->status during dma_fence_init()
dma-buf/sw_sync: clean up list before signaling the fence
dma-buf/sw_sync: move timeline_fence_ops around
dma-buf/sw-sync: Use an rbtree to sort fences in the timeline
dma-buf/sw-sync: Fix locking around sync_timeline lists
dma-buf/sw-sync: sync_pt is private and of fixed size
dma-buf/sw-sync: Reduce irqsave/irqrestore from known context
dma-buf/sw-sync: Prevent user overflow on timeline advance
dma-buf/sw-sync: Fix the is-signaled test to handle u32 wraparound
dma-buf/dma-fence: Extract __dma_fence_is_later()
net: fec: fix multicast filtering hardware setup
xen-netback: vif counters from int/long to u64
cec: initiator should be the same as the destination for, poll
xen-netfront: Improve error handling during initialization
mm: avoid returning VM_FAULT_RETRY from ->page_mkwrite handlers
vfio/spapr: Fix missing mutex unlock when creating a window
be2net: fix initial MAC setting
net: thunderx: avoid dereferencing xcv when NULL
net: phy: micrel: KSZ8795 do not set SUPPORTED_[Asym_]Pause
gtp: fix cross netns recv on gtp socket
gtp: clear DF bit on GTP packet tx
nvmet: cancel fatal error and flush async work before free controller
i2c: i2c-cadence: Initialize configuration before probing devices
tcp: correct memory barrier usage in tcp_check_space()
dmaengine: pl330: fix double lock
tipc: fix cleanup at module unload
tipc: fix nametbl_lock soft lockup at module exit
RDMA/qedr: Fix RDMA CM loopback
RDMA/qedr: Return success when not changing QP state
mac80211: don't try to sleep in rate_control_rate_init()
drm/amdgpu: fix unload driver issue for virtual display
x86/fpu: Set the xcomp_bv when we fake up a XSAVES area
net: sctp: fix array overrun read on sctp_timer_tbl
drm/exynos/decon5433: set STANDALONE_UPDATE_F on output enablement
drm/amdgpu: fix bug set incorrect value to vce register
qla2xxx: Fix wrong IOCB type assumption
powerpc/mm: Fix memory hotplug BUG() on radix
perf/x86/intel: Account interrupts for PEBS errors
NFSv4: Fix client recovery when server reboots multiple times
mac80211: prevent skb/txq mismatch
KVM: arm/arm64: Fix occasional warning from the timer work function
drm/exynos/decon5433: set STANDALONE_UPDATE_F also if planes are disabled
drm/exynos/decon5433: update shadow registers iff there are active windows
nfs: Don't take a reference on fl->fl_file for LOCK operation
ravb: Remove Rx overflow log messages
mac80211: calculate min channel width correctly
mm: fix remote numa hits statistics
net: qrtr: Mark 'buf' as little endian
libfs: Modify mount_pseudo_xattr to be clear it is not a userspace mount
net/appletalk: Fix kernel memory disclosure
be2net: fix unicast list filling
be2net: fix accesses to unicast list
vti6: fix device register to report IFLA_INFO_KIND
ARM: OMAP1: DMA: Correct the number of logical channels
ARM: OMAP2+: Fix WL1283 Bluetooth Baud Rate
net: systemport: Pad packet before inserting TSB
net: systemport: Utilize skb_put_padto()
libcxgb: fix error check for ip6_route_output()
usb: gadget: f_fs: Fix ExtCompat descriptor validation
dmaengine: stm32-dma: Fix null pointer dereference in stm32_dma_tx_status
dmaengine: stm32-dma: Set correct args number for DMA request from DT
l2tp: take remote address into account in l2tp_ip and l2tp_ip6 socket lookups
net/mlx4_en: Fix type mismatch for 32-bit systems
dax: Avoid page invalidation races and unnecessary radix tree traversals
iio: adc: ti-ads1015: add 10% to conversion wait time
tools include: Do not use poison with C++
kprobes/x86: Disable preemption in ftrace-based jprobes
perf test attr: Fix ignored test case result
usbip: tools: Install all headers needed for libusbip development
sysrq : fix Show Regs call trace on ARM
EDAC, sb_edac: Fix missing break in switch
x86/entry: Use SYSCALL_DEFINE() macros for sys_modify_ldt()
serial: 8250: Preserve DLD[7:4] for PORT_XR17V35X
usb: phy: tahvo: fix error handling in tahvo_usb_probe()
mmc: sdhci-msm: fix issue with power irq
spi: spi-axi: fix potential use-after-free after deregistration
spi: sh-msiof: Fix DMA transfer size check
staging: rtl8188eu: avoid a null dereference on pmlmepriv
serial: 8250_fintek: Fix rs485 disablement on invalid ioctl()
m68k: fix ColdFire node shift size calculation
staging: greybus: loopback: Fix iteration count on async path
selftests/x86/ldt_get: Add a few additional tests for limits
s390/pci: do not require AIS facility
ima: fix hash algorithm initialization
USB: serial: option: add Quectel BG96 id
s390/runtime instrumentation: simplify task exit handling
serial: 8250_pci: Add Amazon PCI serial device ID
usb: quirks: Add no-lpm quirk for KY-688 USB 3.1 Type-C Hub
uas: Always apply US_FL_NO_ATA_1X quirk to Seagate devices
mm, oom_reaper: gather each vma to prevent leaking TLB entry
Revert "crypto: caam - get rid of tasklet"
drm/fsl-dcu: enable IRQ before drm_atomic_helper_resume()
drm/fsl-dcu: avoid disabling pixel clock twice on suspend
bcache: recover data from backing when data is clean
bcache: only permit to recovery read error when cache device is clean
Linux 4.9.67
drm/i915: Prevent zero length "index" write
drm/i915: Don't try indexed reads to alternate slave addresses
NFS: revalidate "." etc correctly on "open".
Revert "x86/entry/64: Add missing irqflags tracing to native_load_gs_index()"
drm/amd/pp: fix typecast error in powerplay.
drm/ttm: once more fix ttm_buffer_object_transfer
drm/hisilicon: Ensure LDI regs are properly configured.
drm/panel: simple: Add missing panel_simple_unprepare() calls
drm/radeon: fix atombios on big endian
drm/amdgpu: Potential uninitialized variable in amdgpu_vm_update_directories()
drm/amdgpu: potential uninitialized variable in amdgpu_vce_ring_parse_cs()
Revert "drm/radeon: dont switch vt on suspend"
nvme-pci: add quirk for delay before CHK RDY for WDC SN200
hwmon: (jc42) optionally try to disable the SMBUS timeout
bcache: Fix building error on MIPS
i2c: i801: Fix Failed to allocate irq -2147483648 error
eeprom: at24: check at24_read/write arguments
eeprom: at24: correctly set the size for at24mac402
eeprom: at24: fix reading from 24MAC402/24MAC602
mmc: core: prepend 0x to OCR entry in sysfs
mmc: core: Do not leave the block driver in a suspended state
KVM: lapic: Fixup LDR on load in x2apic
KVM: lapic: Split out x2apic ldr calculation
KVM: x86: inject exceptions produced by x86_decode_insn
KVM: x86: Exit to user-mode on #UD intercept when emulator requires
KVM: x86: pvclock: Handle first-time write to pvclock-page contains random junk
ARM: OMAP2+: Fix WL1283 Bluetooth Baud Rate
mfd: twl4030-power: Fix pmic for boards that need vmmc1 on reboot
nfsd: fix panic in posix_unblock_lock called from nfs4_laundromat
nfsd: Fix another OPEN stateid race
nfsd: Fix stateid races between OPEN and CLOSE
btrfs: clear space cache inode generation always
mm/madvise.c: fix madvise() infinite loop under special circumstances
mm, hugetlbfs: introduce ->split() to vm_operations_struct
mm/cma: fix alloc_contig_range ret code/potential leak
mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()
ARM: dts: omap3: logicpd-torpedo-37xx-devkit: Fix MMC1 cd-gpio
ARM: dts: LogicPD Torpedo: Fix camera pin mux
Linux 4.9.66
xen: xenbus driver must not accept invalid transaction ids
nvmet: fix KATO offset in Set Features
cec: update log_addr[] before finishing configuration
cec: CEC_MSG_GIVE_FEATURES should abort for CEC version < 2
cec: when canceling a message, don't overwrite old status info
s390/kbuild: enable modversions for symbols exported from asm
ASoC: wm_adsp: Don't overrun firmware file buffer when reading region data
btrfs: return the actual error value from from btrfs_uuid_tree_iterate
crypto: marvell - Copy IVDIG before launching partial DMA ahash requests
ASoC: rsnd: don't double free kctrl
netfilter: nf_tables: fix oob access
netfilter: nft_queue: use raw_smp_processor_id()
spi: SPI_FSL_DSPI should depend on HAS_DMA
staging: iio: cdc: fix improper return value
iio: light: fix improper return value
adm80211: add checks for dma mapping errors
mac80211: Suppress NEW_PEER_CANDIDATE event if no room
mac80211: Remove invalid flag operations in mesh TSF synchronization
drm/mediatek: don't use drm_put_dev
clk: qcom: ipq4019: Add all the frequencies for apss cpu
drm: Apply range restriction after color adjustment when allocation
gpio: mockup: dynamically allocate memory for chip name
ALSA: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE
ath10k: set CTS protection VDEV param only if VDEV is up
bnxt_en: Set default completion ring for async events.
pinctrl: sirf: atlas7: Add missing 'of_node_put()'
ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats()
ath10k: ignore configuring the incorrect board_id
ath10k: fix incorrect txpower set by P2P_DEVICE interface
mwifiex: sdio: fix use after free issue for save_adapter
adm80211: return an error if adm8211_alloc_rings() fails
rt2800: set minimum MPDU and PSDU lengths to sane values
drm/armada: Fix compile fail
net: 3com: typhoon: typhoon_init_one: fix incorrect return values
net: 3com: typhoon: typhoon_init_one: make return values more specific
net: Allow IP_MULTICAST_IF to set index to L3 slave
fscrypt: use ENOTDIR when setting encryption policy on nondirectory
fscrypt: use ENOKEY when file cannot be created w/o key
dmaengine: zx: set DMA_CYCLIC cap_mask bit
clk: sunxi-ng: fix PLL_CPUX adjusting on A33
clk: sunxi-ng: A31: Fix spdif clock register
drm/sun4i: Fix a return value in case of error
PCI: Apply _HPX settings only to relevant devices
RDS: RDMA: fix the ib_map_mr_sg_zbva() argument
RDS: RDMA: return appropriate error on rdma map failures
RDS: make message size limit compliant with spec
e1000e: Avoid receiver overrun interrupt bursts
e1000e: Separate signaling for link check/link up
e1000e: Fix return value test
e1000e: Fix error path in link detection
Revert "drm/i915: Do not rely on wm preservation for ILK watermarks"
PM / OPP: Add missing of_node_put(np)
net/9p: Switch to wait_event_killable()
fscrypt: lock mutex before checking for bounce page pool
sched/rt: Simplify the IPI based RT balancing logic
media: v4l2-ctrl: Fix flags field on Control events
cx231xx-cards: fix NULL-deref on missing association descriptor
media: rc: check for integer overflow
media: Don't do DMA on stack for firmware upload in the AS102 driver
powerpc/signal: Properly handle return value from uprobe_deny_signal()
parisc: Fix validity check of pointer size argument in new CAS implementation
ixgbe: Fix skb list corruption on Power systems
fm10k: Use smp_rmb rather than read_barrier_depends
i40evf: Use smp_rmb rather than read_barrier_depends
ixgbevf: Use smp_rmb rather than read_barrier_depends
igbvf: Use smp_rmb rather than read_barrier_depends
igb: Use smp_rmb rather than read_barrier_depends
i40e: Use smp_rmb rather than read_barrier_depends
NFC: fix device-allocation error return
IB/srp: Avoid that a cable pull can trigger a kernel crash
IB/srpt: Do not accept invalid initiator port names
libnvdimm, namespace: make 'resource' attribute only readable by root
libnvdimm, namespace: fix label initialization to use valid seq numbers
libnvdimm, pfn: make 'resource' attribute only readable by root
clk: ti: dra7-atl-clock: fix child-node lookups
SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status
KVM: SVM: obey guest PAT
KVM: nVMX: set IDTR and GDTR limits when loading L1 host state
lockd: double unregister of inetaddr notifiers
irqchip/gic-v3: Fix ppi-partitions lookup
block: Fix a race between blk_cleanup_queue() and timeout handling
p54: don't unregister leds when they are not initialized
mtd: nand: mtk: fix infinite ECC decode IRQ issue
mtd: nand: Fix writing mtdoops to nand flash.
mtd: nand: omap2: Fix subpage write
target: Fix QUEUE_FULL + SCSI task attribute handling
iscsi-target: Fix non-immediate TMR reference leak
fs/9p: Compare qid.path in v9fs_test_inode
fix a page leak in vhost_scsi_iov_to_sgl() error recovery
ALSA: hda/realtek - Fix ALC700 family no sound issue
ALSA: hda: Fix too short HDMI/DP chmap reporting
ALSA: timer: Remove kernel warning at compat ioctl error paths
ALSA: usb-audio: Add sanity checks in v2 clock parsers
ALSA: usb-audio: Fix potential out-of-bound access at parsing SU
ALSA: usb-audio: Add sanity checks to FE parser
ALSA: pcm: update tstamp only if audio_tstamp changed
ext4: fix interaction between i_size, fallocate, and delalloc after a crash
ata: fixes kernel crash while tracing ata_eh_link_autopsy event
rtlwifi: fix uninitialized rtlhal->last_suspend_sec time
rtlwifi: rtl8192ee: Fix memory leak when loading firmware
nfsd: deal with revoked delegations appropriately
NFS: Avoid RCU usage in tracepoints
nfs: Fix ugly referral attributes
NFS: Fix typo in nomigration mount option
isofs: fix timestamps beyond 2027
bcache: check ca->alloc_thread initialized before wake up it
libceph: don't WARN() if user tries to add invalid key
eCryptfs: use after free in ecryptfs_release_messaging()
nilfs2: fix race condition that causes file system corruption
autofs: don't fail mount for transient error
rt2x00usb: mark device removed when get ENOENT usb error
MIPS: BCM47XX: Fix LED inversion for WRT54GSv1
MIPS: Fix an n32 core file generation regset support regression
MIPS: dts: remove bogus bcm96358nb4ser.dtb from dtb-y entry
MIPS: Fix odd fp register warnings with MIPS64r2
dm: fix race between dm_get_from_kobject() and __dm_destroy()
MIPS: pci: Remove KERN_WARN instance inside the mt7620 driver
dm: allocate struct mapped_device with kvzalloc
dm bufio: fix integer overflow when limiting maximum cache size
ALSA: hda: Add Raven PCI ID
PCI: Set Cavium ACS capability quirk flags to assert RR/CR/SV/UF
MIPS: ralink: Fix typo in mt7628 pinmux function
MIPS: ralink: Fix MT7628 pinmux
ARM: 8721/1: mm: dump: check hardware RO bit for LPAE
ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE
arm64: Implement arch-specific pte_access_permitted()
x86/entry/64: Add missing irqflags tracing to native_load_gs_index()
x86/decoder: Add new TEST instruction pattern
lib/mpi: call cond_resched() from mpi_powm() loop
sched: Make resched_cpu() unconditional
vsock: use new wait API for vsock_stream_sendmsg()
ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER
x86/mm: fix use-after-free of vma during userfaultfd fault
ACPI / EC: Fix regression related to triggering source of EC event handling
s390/disassembler: increase show_code buffer size
s390/disassembler: add missing end marker for e7 table
s390/runtime instrumention: fix possible memory corruption
s390: fix transactional execution control register handling
Conflicts:
drivers/android/binder_alloc.c
drivers/android/binder_alloc.h
drivers/android/binder_alloc_selftest.c
drivers/mmc/core/bus.c
drivers/mmc/host/sdhci-msm.c
drivers/thermal/step_wise.c
kernel/cpu.c
mm/oom_kill.c
sound/usb/mixer.c
Change-Id: Id01eb66cafc5970b460321e44ec8ffcfa76971a6
Signed-off-by: Kyle Yan <kyan@codeaurora.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlo6KFYACgkQONu9yGCS
aT4mzw//cSnAjc7kuTtk96GKWat1bQExyb4scmsEkArfVKhoCy0Dhyr9yr4Y6+mX
6l2uUyQ70jhqOvinWIVuoDJoiZhtloudCe6ehmXm81xZsLacmelIC9NHGZ/vx/10
vC4BIZZgft5JiL4OSp/XTd0t++8maK5RUwp8cCqqTDeUyqHKNjUg+moMuJdjvRf7
4qGoBZ4lyijUU5V+WC98KSZSPncU6U1atA6k6Yvgu7oMFGembztERCx19Ka0JxA5
mzsmAH3TIhHUSGinDpTfW9x3Cmu0Dg3H7mQ0AaEVjhAi1oKTxxp0drLCZbeJUAXX
9QPJqr20XZWkuGX/yuy1vkcVo6kRfjaPYi1yyiFoEQ23hYXAaTJyiXC/CWv6kAkc
MOIXqHQgfegDAC33EzVunp/ue0sBwVAhFTpaTwbUiKJ+lpZY74mV+bjk6gZdlGJM
9TAOE66oAPNt6SM+5QC5mtO9cC03nCDIzbud5KXzdjYH8RBfIEvidxNv5qM6x8Hb
dJn6//nQzMTYIQFHja19Sqbt0xXq2lck5DrZZ+YnXlHr5JH1DzPQfqfmu8GD094e
H3oLDUmyBVnkI5jmgo3Xc+ZLArUMX7HhTyKSp+mXxRtGNulcbbQwaSWjEUoqYSzN
twMQPS+NKu+ZuubztP+7gOvyofmAAfcPX6yZpTnPyFKEnjyU3Uw=
=nCSn
-----END PGP SIGNATURE-----
Merge 4.9.71 into android-4.9-o
Changes in 4.9.71
mfd: fsl-imx25: Clean up irq settings during removal
crypto: rsa - fix buffer overread when stripping leading zeroes
crypto: hmac - require that the underlying hash algorithm is unkeyed
crypto: salsa20 - fix blkcipher_walk API usage
autofs: fix careless error in recent commit
tracing: Allocate mask_str buffer dynamically
USB: uas and storage: Add US_FL_BROKEN_FUA for another JMicron JMS567 ID
USB: core: prevent malicious bNumInterfaces overflow
usbip: fix stub_rx: get_pipe() to validate endpoint number
usb: add helper to extract bits 12:11 of wMaxPacketSize
usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input
usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer
ceph: drop negative child dentries before try pruning inode's alias
usb: xhci: fix TDS for MTK xHCI1.1
Bluetooth: btusb: driver to enable the usb-wakeup feature
xhci: Don't add a virt_dev to the devs array before it's fully allocated
nfs: don't wait on commit in nfs_commit_inode() if there were no commit requests
sched/rt: Do not pull from current CPU if only one CPU to pull
eeprom: at24: change nvmem stride to 1
dmaengine: dmatest: move callback wait queue to thread context
ext4: fix fdatasync(2) after fallocate(2) operation
ext4: fix crash when a directory's i_size is too small
mac80211: Fix addition of mesh configuration element
usb: phy: isp1301: Add OF device ID table
KVM: nVMX: do not warn when MSR bitmap address is not backed
usb: xhci-mtk: check hcc_params after adding primary hcd
md-cluster: free md_cluster_info if node leave cluster
userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE
userfaultfd: selftest: vm: allow to build in vm/ directory
net: initialize msg.msg_flags in recvfrom
bnxt_en: Ignore 0 value in autoneg supported speed from firmware.
net: bcmgenet: correct the RBUF_OVFL_CNT and RBUF_ERR_CNT MIB values
net: bcmgenet: correct MIB access of UniMAC RUNT counters
net: bcmgenet: reserved phy revisions must be checked first
net: bcmgenet: power down internal phy if open or resume fails
net: bcmgenet: synchronize irq0 status between the isr and task
net: bcmgenet: Power up the internal PHY before probing the MII
rxrpc: Wake up the transmitter if Rx window size increases on the peer
net/mlx5: Fix create autogroup prev initializer
net/mlx5: Don't save PCI state when PCI error is detected
iommu/io-pgtable-arm-v7s: Check for leaf entry before dereferencing it
drm/amdgpu: fix parser init error path to avoid crash in parser fini
NFSD: fix nfsd_minorversion(.., NFSD_AVAIL)
NFSD: fix nfsd_reset_versions for NFSv4.
Input: i8042 - add TUXEDO BU1406 (N24_25BU) to the nomux list
drm/omap: fix dmabuf mmap for dma_alloc'ed buffers
netfilter: bridge: honor frag_max_size when refragmenting
ASoC: rsnd: fix sound route path when using SRC6/SRC9
blk-mq: Fix tagset reinit in the presence of cpu hot-unplug
writeback: fix memory leak in wb_queue_work()
net: wimax/i2400m: fix NULL-deref at probe
dmaengine: Fix array index out of bounds warning in __get_unmap_pool()
irqchip/mvebu-odmi: Select GENERIC_MSI_IRQ_DOMAIN
net: Resend IGMP memberships upon peer notification.
mlxsw: reg: Fix SPVM max record count
mlxsw: reg: Fix SPVMLR max record count
qed: Align CIDs according to DORQ requirement
qed: Fix mapping leak on LL2 rx flow
qed: Fix interrupt flags on Rx LL2
drm: amd: remove broken include path
intel_th: pci: Add Gemini Lake support
openrisc: fix issue handling 8 byte get_user calls
ASoC: rcar: clear DE bit only in PDMACHCR when it stops
scsi: hpsa: update check for logical volume status
scsi: hpsa: limit outstanding rescans
scsi: hpsa: do not timeout reset operations
fjes: Fix wrong netdevice feature flags
drm/radeon/si: add dpm quirk for Oland
Drivers: hv: util: move waiting for release to hv_utils_transport itself
iwlwifi: mvm: cleanup pending frames in DQA mode
sched/deadline: Add missing update_rq_clock() in dl_task_timer()
sched/deadline: Make sure the replenishment timer fires in the next period
sched/deadline: Throttle a constrained deadline task activated after the deadline
sched/deadline: Use deadline instead of period when calculating overflow
mmc: mediatek: Fixed bug where clock frequency could be set wrong
drm/radeon: reinstate oland workaround for sclk
afs: Fix missing put_page()
afs: Populate group ID from vnode status
afs: Adjust mode bits processing
afs: Deal with an empty callback array
afs: Flush outstanding writes when an fd is closed
afs: Migrate vlocation fields to 64-bit
afs: Prevent callback expiry timer overflow
afs: Fix the maths in afs_fs_store_data()
afs: Invalid op ID should abort with RXGEN_OPCODE
afs: Better abort and net error handling
afs: Populate and use client modification time
afs: Fix page leak in afs_write_begin()
afs: Fix afs_kill_pages()
afs: Fix abort on signal while waiting for call completion
nvme-loop: fix a possible use-after-free when destroying the admin queue
nvmet: confirm sq percpu has scheduled and switched to atomic
nvmet-rdma: Fix a possible uninitialized variable dereference
net/mlx4_core: Avoid delays during VF driver device shutdown
net: mpls: Fix nexthop alive tracking on down events
rxrpc: Ignore BUSY packets on old calls
tty: don't panic on OOM in tty_set_ldisc()
tty: fix data race in tty_ldisc_ref_wait()
perf symbols: Fix symbols__fixup_end heuristic for corner cases
efi/esrt: Cleanup bad memory map log messages
NFSv4.1 respect server's max size in CREATE_SESSION
btrfs: add missing memset while reading compressed inline extents
target: Use system workqueue for ALUA transitions
target: fix ALUA transition timeout handling
target: fix race during implicit transition work flushes
Revert "x86/acpi: Set persistent cpuid <-> nodeid mapping when booting"
HID: cp2112: fix broken gpio_direction_input callback
sfc: don't warn on successful change of MAC
fbdev: controlfb: Add missing modes to fix out of bounds access
video: udlfb: Fix read EDID timeout
video: fbdev: au1200fb: Release some resources if a memory allocation fails
video: fbdev: au1200fb: Return an error code if a memory allocation fails
rtc: pcf8563: fix output clock rate
ASoC: Intel: Skylake: Fix uuid_module memory leak in failure case
dmaengine: ti-dma-crossbar: Correct am335x/am43xx mux value type
PCI/PME: Handle invalid data when reading Root Status
powerpc/powernv/cpufreq: Fix the frequency read by /proc/cpuinfo
PCI: Do not allocate more buses than available in parent
iommu/mediatek: Fix driver name
netfilter: ipvs: Fix inappropriate output of procfs
powerpc/opal: Fix EBUSY bug in acquiring tokens
powerpc/ipic: Fix status get and status clear
platform/x86: intel_punit_ipc: Fix resource ioremap warning
target/iscsi: Fix a race condition in iscsit_add_reject_from_cmd()
iscsi-target: fix memory leak in lio_target_tiqn_addtpg()
target:fix condition return in core_pr_dump_initiator_port()
target/file: Do not return error for UNMAP if length is zero
badblocks: fix wrong return value in badblocks_set if badblocks are disabled
iommu/amd: Limit the IOVA page range to the specified addresses
xfs: truncate pagecache before writeback in xfs_setattr_size()
arm-ccn: perf: Prevent module unload while PMU is in use
crypto: tcrypt - fix buffer lengths in test_aead_speed()
mm: Handle 0 flags in _calc_vm_trans() macro
clk: mediatek: add the option for determining PLL source clock
clk: imx6: refine hdmi_isfr's parent to make HDMI work on i.MX6 SoCs w/o VPU
clk: hi6220: mark clock cs_atb_syspll as critical
clk: tegra: Fix cclk_lp divisor register
ppp: Destroy the mutex when cleanup
ASoC: rsnd: rsnd_ssi_run_mods() needs to care ssi_parent_mod
thermal/drivers/step_wise: Fix temperature regulation misbehavior
scsi: scsi_debug: write_same: fix error report
GFS2: Take inode off order_write list when setting jdata flag
bcache: explicitly destroy mutex while exiting
bcache: fix wrong cache_misses statistics
Ib/hfi1: Return actual operational VLs in port info query
arm64: prevent regressions in compressed kernel image size when upgrading to binutils 2.27
btrfs: tests: Fix a memory leak in error handling path in 'run_test()'
platform/x86: hp_accel: Add quirk for HP ProBook 440 G4
nvme: use kref_get_unless_zero in nvme_find_get_ns
l2tp: cleanup l2tp_tunnel_delete calls
xfs: fix log block underflow during recovery cycle verification
xfs: fix incorrect extent state in xfs_bmap_add_extent_unwritten_real
RDMA/cxgb4: Declare stag as __be32
PCI: Detach driver before procfs & sysfs teardown on device remove
scsi: hpsa: cleanup sas_phy structures in sysfs when unloading
scsi: hpsa: destroy sas transport properties before scsi_host
powerpc/perf/hv-24x7: Fix incorrect comparison in memord
soc: mediatek: pwrap: fix compiler errors
tty fix oops when rmmod 8250
usb: musb: da8xx: fix babble condition handling
pinctrl: adi2: Fix Kconfig build problem
raid5: Set R5_Expanded on parity devices as well as data.
scsi: scsi_devinfo: Add REPORTLUN2 to EMC SYMMETRIX blacklist entry
IB/core: Fix calculation of maximum RoCE MTU
vt6655: Fix a possible sleep-in-atomic bug in vt6655_suspend
rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_createbss_cmd
rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_disassoc_cmd
scsi: sd: change manage_start_stop to bool in sysfs interface
scsi: sd: change allow_restart to bool in sysfs interface
scsi: bfa: integer overflow in debugfs
udf: Avoid overflow when session starts at large offset
macvlan: Only deliver one copy of the frame to the macvlan interface
RDMA/cma: Avoid triggering undefined behavior
IB/ipoib: Grab rtnl lock on heavy flush when calling ndo_open/stop
icmp: don't fail on fragment reassembly time exceeded
ath9k: fix tx99 potential info leak
Linux 4.9.71
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlo6KFYACgkQONu9yGCS
aT4mzw//cSnAjc7kuTtk96GKWat1bQExyb4scmsEkArfVKhoCy0Dhyr9yr4Y6+mX
6l2uUyQ70jhqOvinWIVuoDJoiZhtloudCe6ehmXm81xZsLacmelIC9NHGZ/vx/10
vC4BIZZgft5JiL4OSp/XTd0t++8maK5RUwp8cCqqTDeUyqHKNjUg+moMuJdjvRf7
4qGoBZ4lyijUU5V+WC98KSZSPncU6U1atA6k6Yvgu7oMFGembztERCx19Ka0JxA5
mzsmAH3TIhHUSGinDpTfW9x3Cmu0Dg3H7mQ0AaEVjhAi1oKTxxp0drLCZbeJUAXX
9QPJqr20XZWkuGX/yuy1vkcVo6kRfjaPYi1yyiFoEQ23hYXAaTJyiXC/CWv6kAkc
MOIXqHQgfegDAC33EzVunp/ue0sBwVAhFTpaTwbUiKJ+lpZY74mV+bjk6gZdlGJM
9TAOE66oAPNt6SM+5QC5mtO9cC03nCDIzbud5KXzdjYH8RBfIEvidxNv5qM6x8Hb
dJn6//nQzMTYIQFHja19Sqbt0xXq2lck5DrZZ+YnXlHr5JH1DzPQfqfmu8GD094e
H3oLDUmyBVnkI5jmgo3Xc+ZLArUMX7HhTyKSp+mXxRtGNulcbbQwaSWjEUoqYSzN
twMQPS+NKu+ZuubztP+7gOvyofmAAfcPX6yZpTnPyFKEnjyU3Uw=
=nCSn
-----END PGP SIGNATURE-----
Merge 4.9.71 into android-4.9
Changes in 4.9.71
mfd: fsl-imx25: Clean up irq settings during removal
crypto: rsa - fix buffer overread when stripping leading zeroes
crypto: hmac - require that the underlying hash algorithm is unkeyed
crypto: salsa20 - fix blkcipher_walk API usage
autofs: fix careless error in recent commit
tracing: Allocate mask_str buffer dynamically
USB: uas and storage: Add US_FL_BROKEN_FUA for another JMicron JMS567 ID
USB: core: prevent malicious bNumInterfaces overflow
usbip: fix stub_rx: get_pipe() to validate endpoint number
usb: add helper to extract bits 12:11 of wMaxPacketSize
usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input
usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer
ceph: drop negative child dentries before try pruning inode's alias
usb: xhci: fix TDS for MTK xHCI1.1
Bluetooth: btusb: driver to enable the usb-wakeup feature
xhci: Don't add a virt_dev to the devs array before it's fully allocated
nfs: don't wait on commit in nfs_commit_inode() if there were no commit requests
sched/rt: Do not pull from current CPU if only one CPU to pull
eeprom: at24: change nvmem stride to 1
dmaengine: dmatest: move callback wait queue to thread context
ext4: fix fdatasync(2) after fallocate(2) operation
ext4: fix crash when a directory's i_size is too small
mac80211: Fix addition of mesh configuration element
usb: phy: isp1301: Add OF device ID table
KVM: nVMX: do not warn when MSR bitmap address is not backed
usb: xhci-mtk: check hcc_params after adding primary hcd
md-cluster: free md_cluster_info if node leave cluster
userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE
userfaultfd: selftest: vm: allow to build in vm/ directory
net: initialize msg.msg_flags in recvfrom
bnxt_en: Ignore 0 value in autoneg supported speed from firmware.
net: bcmgenet: correct the RBUF_OVFL_CNT and RBUF_ERR_CNT MIB values
net: bcmgenet: correct MIB access of UniMAC RUNT counters
net: bcmgenet: reserved phy revisions must be checked first
net: bcmgenet: power down internal phy if open or resume fails
net: bcmgenet: synchronize irq0 status between the isr and task
net: bcmgenet: Power up the internal PHY before probing the MII
rxrpc: Wake up the transmitter if Rx window size increases on the peer
net/mlx5: Fix create autogroup prev initializer
net/mlx5: Don't save PCI state when PCI error is detected
iommu/io-pgtable-arm-v7s: Check for leaf entry before dereferencing it
drm/amdgpu: fix parser init error path to avoid crash in parser fini
NFSD: fix nfsd_minorversion(.., NFSD_AVAIL)
NFSD: fix nfsd_reset_versions for NFSv4.
Input: i8042 - add TUXEDO BU1406 (N24_25BU) to the nomux list
drm/omap: fix dmabuf mmap for dma_alloc'ed buffers
netfilter: bridge: honor frag_max_size when refragmenting
ASoC: rsnd: fix sound route path when using SRC6/SRC9
blk-mq: Fix tagset reinit in the presence of cpu hot-unplug
writeback: fix memory leak in wb_queue_work()
net: wimax/i2400m: fix NULL-deref at probe
dmaengine: Fix array index out of bounds warning in __get_unmap_pool()
irqchip/mvebu-odmi: Select GENERIC_MSI_IRQ_DOMAIN
net: Resend IGMP memberships upon peer notification.
mlxsw: reg: Fix SPVM max record count
mlxsw: reg: Fix SPVMLR max record count
qed: Align CIDs according to DORQ requirement
qed: Fix mapping leak on LL2 rx flow
qed: Fix interrupt flags on Rx LL2
drm: amd: remove broken include path
intel_th: pci: Add Gemini Lake support
openrisc: fix issue handling 8 byte get_user calls
ASoC: rcar: clear DE bit only in PDMACHCR when it stops
scsi: hpsa: update check for logical volume status
scsi: hpsa: limit outstanding rescans
scsi: hpsa: do not timeout reset operations
fjes: Fix wrong netdevice feature flags
drm/radeon/si: add dpm quirk for Oland
Drivers: hv: util: move waiting for release to hv_utils_transport itself
iwlwifi: mvm: cleanup pending frames in DQA mode
sched/deadline: Add missing update_rq_clock() in dl_task_timer()
sched/deadline: Make sure the replenishment timer fires in the next period
sched/deadline: Throttle a constrained deadline task activated after the deadline
sched/deadline: Use deadline instead of period when calculating overflow
mmc: mediatek: Fixed bug where clock frequency could be set wrong
drm/radeon: reinstate oland workaround for sclk
afs: Fix missing put_page()
afs: Populate group ID from vnode status
afs: Adjust mode bits processing
afs: Deal with an empty callback array
afs: Flush outstanding writes when an fd is closed
afs: Migrate vlocation fields to 64-bit
afs: Prevent callback expiry timer overflow
afs: Fix the maths in afs_fs_store_data()
afs: Invalid op ID should abort with RXGEN_OPCODE
afs: Better abort and net error handling
afs: Populate and use client modification time
afs: Fix page leak in afs_write_begin()
afs: Fix afs_kill_pages()
afs: Fix abort on signal while waiting for call completion
nvme-loop: fix a possible use-after-free when destroying the admin queue
nvmet: confirm sq percpu has scheduled and switched to atomic
nvmet-rdma: Fix a possible uninitialized variable dereference
net/mlx4_core: Avoid delays during VF driver device shutdown
net: mpls: Fix nexthop alive tracking on down events
rxrpc: Ignore BUSY packets on old calls
tty: don't panic on OOM in tty_set_ldisc()
tty: fix data race in tty_ldisc_ref_wait()
perf symbols: Fix symbols__fixup_end heuristic for corner cases
efi/esrt: Cleanup bad memory map log messages
NFSv4.1 respect server's max size in CREATE_SESSION
btrfs: add missing memset while reading compressed inline extents
target: Use system workqueue for ALUA transitions
target: fix ALUA transition timeout handling
target: fix race during implicit transition work flushes
Revert "x86/acpi: Set persistent cpuid <-> nodeid mapping when booting"
HID: cp2112: fix broken gpio_direction_input callback
sfc: don't warn on successful change of MAC
fbdev: controlfb: Add missing modes to fix out of bounds access
video: udlfb: Fix read EDID timeout
video: fbdev: au1200fb: Release some resources if a memory allocation fails
video: fbdev: au1200fb: Return an error code if a memory allocation fails
rtc: pcf8563: fix output clock rate
ASoC: Intel: Skylake: Fix uuid_module memory leak in failure case
dmaengine: ti-dma-crossbar: Correct am335x/am43xx mux value type
PCI/PME: Handle invalid data when reading Root Status
powerpc/powernv/cpufreq: Fix the frequency read by /proc/cpuinfo
PCI: Do not allocate more buses than available in parent
iommu/mediatek: Fix driver name
netfilter: ipvs: Fix inappropriate output of procfs
powerpc/opal: Fix EBUSY bug in acquiring tokens
powerpc/ipic: Fix status get and status clear
platform/x86: intel_punit_ipc: Fix resource ioremap warning
target/iscsi: Fix a race condition in iscsit_add_reject_from_cmd()
iscsi-target: fix memory leak in lio_target_tiqn_addtpg()
target:fix condition return in core_pr_dump_initiator_port()
target/file: Do not return error for UNMAP if length is zero
badblocks: fix wrong return value in badblocks_set if badblocks are disabled
iommu/amd: Limit the IOVA page range to the specified addresses
xfs: truncate pagecache before writeback in xfs_setattr_size()
arm-ccn: perf: Prevent module unload while PMU is in use
crypto: tcrypt - fix buffer lengths in test_aead_speed()
mm: Handle 0 flags in _calc_vm_trans() macro
clk: mediatek: add the option for determining PLL source clock
clk: imx6: refine hdmi_isfr's parent to make HDMI work on i.MX6 SoCs w/o VPU
clk: hi6220: mark clock cs_atb_syspll as critical
clk: tegra: Fix cclk_lp divisor register
ppp: Destroy the mutex when cleanup
ASoC: rsnd: rsnd_ssi_run_mods() needs to care ssi_parent_mod
thermal/drivers/step_wise: Fix temperature regulation misbehavior
scsi: scsi_debug: write_same: fix error report
GFS2: Take inode off order_write list when setting jdata flag
bcache: explicitly destroy mutex while exiting
bcache: fix wrong cache_misses statistics
Ib/hfi1: Return actual operational VLs in port info query
arm64: prevent regressions in compressed kernel image size when upgrading to binutils 2.27
btrfs: tests: Fix a memory leak in error handling path in 'run_test()'
platform/x86: hp_accel: Add quirk for HP ProBook 440 G4
nvme: use kref_get_unless_zero in nvme_find_get_ns
l2tp: cleanup l2tp_tunnel_delete calls
xfs: fix log block underflow during recovery cycle verification
xfs: fix incorrect extent state in xfs_bmap_add_extent_unwritten_real
RDMA/cxgb4: Declare stag as __be32
PCI: Detach driver before procfs & sysfs teardown on device remove
scsi: hpsa: cleanup sas_phy structures in sysfs when unloading
scsi: hpsa: destroy sas transport properties before scsi_host
powerpc/perf/hv-24x7: Fix incorrect comparison in memord
soc: mediatek: pwrap: fix compiler errors
tty fix oops when rmmod 8250
usb: musb: da8xx: fix babble condition handling
pinctrl: adi2: Fix Kconfig build problem
raid5: Set R5_Expanded on parity devices as well as data.
scsi: scsi_devinfo: Add REPORTLUN2 to EMC SYMMETRIX blacklist entry
IB/core: Fix calculation of maximum RoCE MTU
vt6655: Fix a possible sleep-in-atomic bug in vt6655_suspend
rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_createbss_cmd
rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_disassoc_cmd
scsi: sd: change manage_start_stop to bool in sysfs interface
scsi: sd: change allow_restart to bool in sysfs interface
scsi: bfa: integer overflow in debugfs
udf: Avoid overflow when session starts at large offset
macvlan: Only deliver one copy of the frame to the macvlan interface
RDMA/cma: Avoid triggering undefined behavior
IB/ipoib: Grab rtnl lock on heavy flush when calling ndo_open/stop
icmp: don't fail on fragment reassembly time exceeded
ath9k: fix tx99 potential info leak
Linux 4.9.71
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 4ca60d08cbe65f501baad64af50fceba79c19fbb ]
consider a bridge with mtu 9000, but end host sending smaller
packets to another host with mtu < 9000.
In this case, after reassembly, bridge+defrag would refragment,
and then attempt to send the reassembled packet as long as it
was below 9k.
Instead we have to cap by the largest fragment size seen.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Florian Westphalauthored and Greg Kroah-Hartmancommited 2017-12-20 10:07:20 +01:00
This API is needed by the NSS connection manager modules
to enable NSS fast path for bridge flows. The connection
manager needs to inspect the netdevice of the bridge slave
port that has learned a given MAC address.
Currently no such API exists that is exported out of the
kernel network stack for this purpose.
Change-Id: I3f8848739d820346135b09b93f760122874468fd
Signed-off-by: Ravinder konka <rkonka@codeaurora.org>
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>
Ravinder Konkaauthored and Gerrit - the friendly Code Review servercommited 2017-10-16 22:14:22 -07:00
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlnZ4T0ACgkQONu9yGCS
aT6X/xAAo5OSIR5UYr3cowfCPu1jcKtmTOvNX5/7caO0VD/0TTEeTUGbJ+QlAJ1K
rZSQLY3wVMT6tdUKqgjayJooAeUBk7wind6VOM44lWRZyztmvEAX9p/ippbu0LmD
YCk+lfh/ZZGl9smu8o619PiTiAhMy7jUHbQAY1FVfn9Io3V/y4TmXAD6MrSkFZtW
LaodzMU3jGWnyW/Jb9X5KTuKT89tF8pBwneyhMOGkrG6x4MDkfaMZYuULT9g1Y3m
LccWR3SJAHumM/PgvbvhYSqVwRIqqvDDoz+e25CjCVxyypq3jHng6IZyfj6CI/9O
MHP/AUjOH5yQPHGw4B31ukbwdRBCf4E9bwIvd6jphOxOM8qZAvBoNKQ4taUYLPAw
YQHFYQ6Sfne07eqcxnM5MyBAQ2eR40OEG+K3bP8JOkYVh1aS+2/Dz+rjZSbMR+lJ
w7ON24179fQ2tKpsZGNoggvcBSpLimUNqDUmkOKnIEjwuG+jI+7GG+5SY3bDsR3d
FvIxevhh9Qc1mc6OpZxqy/yvs/HUdtFu16Yx109aVnMKHLaSlvvCaCWbfGkfVgEN
skt8L+JHxigfJP4xZhR0WYA20uTlXVTqQEmH2um+ZSUNj2z6O1U8UF3b2xtFUvvh
0E2oJtY1/L4NqmWKHenjBSDxRPXa4TtCUX/ytplKitUkvGYNMZA=
=GZkt
-----END PGP SIGNATURE-----
Merge 4.9.54 into android-4.9-o
Changes in 4.9.54
drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define
drm: bridge: add DT bindings for TI ths8135
GFS2: Fix reference to ERR_PTR in gfs2_glock_iter_next
drm/i915: Fix the overlay frontbuffer tracking
ARM: dts: exynos: Add CPU OPPs for Exynos4412 Prime
clk: sunxi-ng: fix PLL_CPUX adjusting on H3
RDS: RDMA: Fix the composite message user notification
ARM: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes
MIPS: Ensure bss section ends on a long-aligned address
MIPS: ralink: Fix a typo in the pinmux setup.
MIPS: ralink: Fix incorrect assignment on ralink_soc
power: supply: axp288_fuel_gauge: Fix fuel_gauge_reg_readb return on error
scsi: be2iscsi: Add checks to validate CID alloc/free
ARM: dts: am335x-chilisom: Wakeup from RTC-only state by power on event
igb: re-assign hw address pointer on reset after PCI error
extcon: axp288: Use vbus-valid instead of -present to determine cable presence
reset: ti_syscon: fix a ti_syscon_reset_status issue
sh_eth: use correct name for ECMR_MPDE bit
clk/axs10x: Clear init field in driver probe
usb: make the MTK XHCI driver compile for older MIPS SoCs
hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes
iio: adc: imx25-gcq: Fix module autoload
iio: adc: axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications
iio: adc: hx711: Add DT binding for avia,hx711
IB/rxe: Add a runtime check in alloc_index()
IB/rxe: Fix a MR reference leak in check_rkey()
ARM: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM
drm/i915/psr: disable psr2 for resolution greater than 32X20
serial: 8250: moxa: Store num_ports in brd
tty: goldfish: Fix a parameter of a call to free_irq
serial: 8250_port: Remove dangerous pr_debug()
IB/ipoib: Fix deadlock over vlan_mutex
IB/ipoib: rtnl_unlock can not come after free_netdev
IB/ipoib: Replace list_del of the neigh->list with list_del_init
arm: dts: mt2701: Add subsystem clock controller device nodes
drm/amdkfd: fix improper return value on error
USB: serial: mos7720: fix control-message error handling
USB: serial: mos7840: fix control-message error handling
sfc: get PIO buffer size from the NIC
partitions/efi: Fix integer overflow in GPT size calculation
ASoC: dapm: handle probe deferrals
audit: log 32-bit socketcalls
ath10k: prevent sta pointer rcu violation
spi: pxa2xx: Add support for Intel Gemini Lake
iommu/arm-smmu: Set privileged attribute to 'default' instead of 'unprivileged'
usb: chipidea: vbus event may exist before starting gadget
rtl8xxxu: Add additional USB IDs for rtl8192eu devices
ASoC: dapm: fix some pointer error handling
drm: mali-dp: Fix destination size handling when rotating
drm: mali-dp: Fix transposed horizontal/vertical flip
HID: wacom: release the resources before leaving despite devm
MIPS: Lantiq: Fix another request_mem_region() return code check
mips: ath79: clock:- Unmap region obtained by of_iomap
lkdtm: Fix Oops when unloading the module
net: core: Prevent from dereferencing null pointer when releasing SKB
net/packet: check length in getsockopt() called with PACKET_HDRLEN
team: fix memory leaks
usb: plusb: Add support for PL-27A1
udp: disable inner UDP checksum offloads in IPsec case
net: dsa: b53: Include IMP/CPU port in dumb forwarding mode
qed: Fix possible system hang in the dcbnl-getdcbx() path.
mmc: sdio: fix alignment issue in struct sdio_func
bridge: netlink: register netdevice before executing changelink
Btrfs: fix segmentation fault when doing dio read
Btrfs: fix potential use-after-free for cloned bio
sata_via: Enable hotplug only on VT6421
hugetlbfs: initialize shared policy as part of inode allocation
kasan: do not sanitize kexec purgatory
drivers/rapidio/devices/tsi721.c: make module parameter variable name unique
netfilter: invoke synchronize_rcu after set the _hook_ to NULL
MIPS: IRQ Stack: Unwind IRQ stack onto task stack
iommu/exynos: Block SYSMMU while invalidating FLPD cache
exynos-gsc: Do not swap cb/cr for semi planar formats
MIPS: smp-cps: Fix retrieval of VPE mask on big endian CPUs
nvme-rdma: handle cpu unplug when re-establishing the controller
netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max
parisc: perf: Fix potential NULL pointer dereference
nfs: make nfs4_cb_sv_ops static
ibmvnic: Free tx/rx scrq pointer array when releasing sub-crqs
cpufreq: intel_pstate: Update pid_params.sample_rate_ns in pid_param_set()
x86/acpi: Restore the order of CPU IDs
iommu/io-pgtable-arm: Check for leaf entry before dereferencing it
mm/cgroup: avoid panic when init with low memory
rds: ib: add error handle
md/raid10: submit bio directly to replacement disk
netfilter: nf_tables: set pktinfo->thoff at AH header if found
i2c: meson: fix wrong variable usage in meson_i2c_put_data
xfs: remove kmem_zalloc_greedy
ASoC: wm_adsp: Return an error on write to a disabled volatile control
libata: transport: Remove circular dependency at free time
ARM: dts: BCM5301X: Fix memory start address
tools/power turbostat: bugfix: GFXMHz column not changing
IB/qib: fix false-postive maybe-uninitialized warning
ARM: remove duplicate 'const' annotations'
ASoC: rt5514: fix gcc-7 warning
ASoC: rt5659: drop double const
ASoC: rt5660: remove double const
ALSA: au88x0: avoid theoretical uninitialized access
ttpci: address stringop overflow warning
s390/mm: make pmdp_invalidate() do invalidation only
Linux 4.9.54
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlnZ4T0ACgkQONu9yGCS
aT6X/xAAo5OSIR5UYr3cowfCPu1jcKtmTOvNX5/7caO0VD/0TTEeTUGbJ+QlAJ1K
rZSQLY3wVMT6tdUKqgjayJooAeUBk7wind6VOM44lWRZyztmvEAX9p/ippbu0LmD
YCk+lfh/ZZGl9smu8o619PiTiAhMy7jUHbQAY1FVfn9Io3V/y4TmXAD6MrSkFZtW
LaodzMU3jGWnyW/Jb9X5KTuKT89tF8pBwneyhMOGkrG6x4MDkfaMZYuULT9g1Y3m
LccWR3SJAHumM/PgvbvhYSqVwRIqqvDDoz+e25CjCVxyypq3jHng6IZyfj6CI/9O
MHP/AUjOH5yQPHGw4B31ukbwdRBCf4E9bwIvd6jphOxOM8qZAvBoNKQ4taUYLPAw
YQHFYQ6Sfne07eqcxnM5MyBAQ2eR40OEG+K3bP8JOkYVh1aS+2/Dz+rjZSbMR+lJ
w7ON24179fQ2tKpsZGNoggvcBSpLimUNqDUmkOKnIEjwuG+jI+7GG+5SY3bDsR3d
FvIxevhh9Qc1mc6OpZxqy/yvs/HUdtFu16Yx109aVnMKHLaSlvvCaCWbfGkfVgEN
skt8L+JHxigfJP4xZhR0WYA20uTlXVTqQEmH2um+ZSUNj2z6O1U8UF3b2xtFUvvh
0E2oJtY1/L4NqmWKHenjBSDxRPXa4TtCUX/ytplKitUkvGYNMZA=
=GZkt
-----END PGP SIGNATURE-----
Merge 4.9.54 into android-4.9
Changes in 4.9.54
drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define
drm: bridge: add DT bindings for TI ths8135
GFS2: Fix reference to ERR_PTR in gfs2_glock_iter_next
drm/i915: Fix the overlay frontbuffer tracking
ARM: dts: exynos: Add CPU OPPs for Exynos4412 Prime
clk: sunxi-ng: fix PLL_CPUX adjusting on H3
RDS: RDMA: Fix the composite message user notification
ARM: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes
MIPS: Ensure bss section ends on a long-aligned address
MIPS: ralink: Fix a typo in the pinmux setup.
MIPS: ralink: Fix incorrect assignment on ralink_soc
power: supply: axp288_fuel_gauge: Fix fuel_gauge_reg_readb return on error
scsi: be2iscsi: Add checks to validate CID alloc/free
ARM: dts: am335x-chilisom: Wakeup from RTC-only state by power on event
igb: re-assign hw address pointer on reset after PCI error
extcon: axp288: Use vbus-valid instead of -present to determine cable presence
reset: ti_syscon: fix a ti_syscon_reset_status issue
sh_eth: use correct name for ECMR_MPDE bit
clk/axs10x: Clear init field in driver probe
usb: make the MTK XHCI driver compile for older MIPS SoCs
hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes
iio: adc: imx25-gcq: Fix module autoload
iio: adc: axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications
iio: adc: hx711: Add DT binding for avia,hx711
IB/rxe: Add a runtime check in alloc_index()
IB/rxe: Fix a MR reference leak in check_rkey()
ARM: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM
drm/i915/psr: disable psr2 for resolution greater than 32X20
serial: 8250: moxa: Store num_ports in brd
tty: goldfish: Fix a parameter of a call to free_irq
serial: 8250_port: Remove dangerous pr_debug()
IB/ipoib: Fix deadlock over vlan_mutex
IB/ipoib: rtnl_unlock can not come after free_netdev
IB/ipoib: Replace list_del of the neigh->list with list_del_init
arm: dts: mt2701: Add subsystem clock controller device nodes
drm/amdkfd: fix improper return value on error
USB: serial: mos7720: fix control-message error handling
USB: serial: mos7840: fix control-message error handling
sfc: get PIO buffer size from the NIC
partitions/efi: Fix integer overflow in GPT size calculation
ASoC: dapm: handle probe deferrals
audit: log 32-bit socketcalls
ath10k: prevent sta pointer rcu violation
spi: pxa2xx: Add support for Intel Gemini Lake
iommu/arm-smmu: Set privileged attribute to 'default' instead of 'unprivileged'
usb: chipidea: vbus event may exist before starting gadget
rtl8xxxu: Add additional USB IDs for rtl8192eu devices
ASoC: dapm: fix some pointer error handling
drm: mali-dp: Fix destination size handling when rotating
drm: mali-dp: Fix transposed horizontal/vertical flip
HID: wacom: release the resources before leaving despite devm
MIPS: Lantiq: Fix another request_mem_region() return code check
mips: ath79: clock:- Unmap region obtained by of_iomap
lkdtm: Fix Oops when unloading the module
net: core: Prevent from dereferencing null pointer when releasing SKB
net/packet: check length in getsockopt() called with PACKET_HDRLEN
team: fix memory leaks
usb: plusb: Add support for PL-27A1
udp: disable inner UDP checksum offloads in IPsec case
net: dsa: b53: Include IMP/CPU port in dumb forwarding mode
qed: Fix possible system hang in the dcbnl-getdcbx() path.
mmc: sdio: fix alignment issue in struct sdio_func
bridge: netlink: register netdevice before executing changelink
Btrfs: fix segmentation fault when doing dio read
Btrfs: fix potential use-after-free for cloned bio
sata_via: Enable hotplug only on VT6421
hugetlbfs: initialize shared policy as part of inode allocation
kasan: do not sanitize kexec purgatory
drivers/rapidio/devices/tsi721.c: make module parameter variable name unique
netfilter: invoke synchronize_rcu after set the _hook_ to NULL
MIPS: IRQ Stack: Unwind IRQ stack onto task stack
iommu/exynos: Block SYSMMU while invalidating FLPD cache
exynos-gsc: Do not swap cb/cr for semi planar formats
MIPS: smp-cps: Fix retrieval of VPE mask on big endian CPUs
nvme-rdma: handle cpu unplug when re-establishing the controller
netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max
parisc: perf: Fix potential NULL pointer dereference
nfs: make nfs4_cb_sv_ops static
ibmvnic: Free tx/rx scrq pointer array when releasing sub-crqs
cpufreq: intel_pstate: Update pid_params.sample_rate_ns in pid_param_set()
x86/acpi: Restore the order of CPU IDs
iommu/io-pgtable-arm: Check for leaf entry before dereferencing it
mm/cgroup: avoid panic when init with low memory
rds: ib: add error handle
md/raid10: submit bio directly to replacement disk
netfilter: nf_tables: set pktinfo->thoff at AH header if found
i2c: meson: fix wrong variable usage in meson_i2c_put_data
xfs: remove kmem_zalloc_greedy
ASoC: wm_adsp: Return an error on write to a disabled volatile control
libata: transport: Remove circular dependency at free time
ARM: dts: BCM5301X: Fix memory start address
tools/power turbostat: bugfix: GFXMHz column not changing
IB/qib: fix false-postive maybe-uninitialized warning
ARM: remove duplicate 'const' annotations'
ASoC: rt5514: fix gcc-7 warning
ASoC: rt5659: drop double const
ASoC: rt5660: remove double const
ALSA: au88x0: avoid theoretical uninitialized access
ttpci: address stringop overflow warning
s390/mm: make pmdp_invalidate() do invalidation only
Linux 4.9.54
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 5b8d5429daa05bebef6ffd3297df3b502cc6f184 ]
Peter reported a kernel oops when executing the following command:
$ ip link add name test type bridge vlan_default_pvid 1
[13634.939408] BUG: unable to handle kernel NULL pointer dereference at
0000000000000190
[13634.939436] IP: __vlan_add+0x73/0x5f0
[...]
[13634.939783] Call Trace:
[13634.939791] ? pcpu_next_unpop+0x3b/0x50
[13634.939801] ? pcpu_alloc+0x3d2/0x680
[13634.939810] ? br_vlan_add+0x135/0x1b0
[13634.939820] ? __br_vlan_set_default_pvid.part.28+0x204/0x2b0
[13634.939834] ? br_changelink+0x120/0x4e0
[13634.939844] ? br_dev_newlink+0x50/0x70
[13634.939854] ? rtnl_newlink+0x5f5/0x8a0
[13634.939864] ? rtnl_newlink+0x176/0x8a0
[13634.939874] ? mem_cgroup_commit_charge+0x7c/0x4e0
[13634.939886] ? rtnetlink_rcv_msg+0xe1/0x220
[13634.939896] ? lookup_fast+0x52/0x370
[13634.939905] ? rtnl_newlink+0x8a0/0x8a0
[13634.939915] ? netlink_rcv_skb+0xa1/0xc0
[13634.939925] ? rtnetlink_rcv+0x24/0x30
[13634.939934] ? netlink_unicast+0x177/0x220
[13634.939944] ? netlink_sendmsg+0x2fe/0x3b0
[13634.939954] ? _copy_from_user+0x39/0x40
[13634.939964] ? sock_sendmsg+0x30/0x40
[13634.940159] ? ___sys_sendmsg+0x29d/0x2b0
[13634.940326] ? __alloc_pages_nodemask+0xdf/0x230
[13634.940478] ? mem_cgroup_commit_charge+0x7c/0x4e0
[13634.940592] ? mem_cgroup_try_charge+0x76/0x1a0
[13634.940701] ? __handle_mm_fault+0xdb9/0x10b0
[13634.940809] ? __sys_sendmsg+0x51/0x90
[13634.940917] ? entry_SYSCALL_64_fastpath+0x1e/0xad
The problem is that the bridge's VLAN group is created after setting the
default PVID, when registering the netdevice and executing its
ndo_init().
Fix this by changing the order of both operations, so that
br_changelink() is only processed after the netdevice is registered,
when the VLAN group is already initialized.
Fixes: b6677449dff6 ("bridge: netlink: call br_changelink() during br_dev_newlink()")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reported-by: Peter V. Saveliev <peter@svinota.eu>
Tested-by: Peter V. Saveliev <peter@svinota.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Ido Schimmelauthored and Greg Kroah-Hartmancommited 2017-10-08 10:26:08 +02:00
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlnCCKQACgkQONu9yGCS
aT6KghAA15NXnnZVpg61mmFjA9rDYduNnNcKyJl+rVT2xNxndRf4EmXgNf2gCbY0
0Kg092lk1ErA0rCXwWCUeB30VaDh+1uZZykYfbtB+cQvwNiseCRpDTiqYbubxSYM
um2rePxP/VO0RAD0BxUBfqz9tuGuCThiKyndkvHOLmT8aFMrfPhf8f7+rcy1iSkT
OyEVWAzyp3aCN7v9+8MAs6cP+e/uHOQW5pvjbvVDxtIUFJXP8JPRASzGrj+gmL4V
J18VxflLhbulXQ7IHKBGxiNPy8usV5N6ZPSLT4t9zBzoVW+f10XCZeaMFK9iA0/H
b9PB/eoJXqfnLovRpj18708IxJMdJk8aeX0ceZT1Mrei7jfyRdTHH2E0FhdiiMo8
KMuR+8JowO3n4LYPeci9maQyzuQV7ZVEVIyTKCCPsRvGaAzRrWCy39AoCw1LqUQH
ZrpjLIasncbc+zlxwySg8UOGkDgr0IT8Ljex0V8GOvyWDZhZqOGKhVqyyUmYRQPU
Fq0byQ57XCEPSIXy9wpGvabKqIp0mddd7cHpeGttlYfE0sSLDAJXhi/A/Fgu1t1O
CnRFLKsrw0yCbu2GlljdQDEqDdhIgVb2tyjy3h6TD2SW4xMPu3SnrASahnr2Hus5
MS3MK9R7Gbhbk3DfqG79KD2gc3e9FMjGbQl7dkwTfOWdn44jp/4=
=FJ/9
-----END PGP SIGNATURE-----
Merge 4.9.51 into android-4.9
Changes in 4.9.51
ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt()
ipv6: add rcu grace period before freeing fib6_node
ipv6: fix sparse warning on rt6i_node
macsec: add genl family module alias
udp: on peeking bad csum, drop packets even if not at head
fsl/man: Inherit parent device and of_node
sctp: Avoid out-of-bounds reads from address storage
qlge: avoid memcpy buffer overflow
netvsc: fix deadlock betwen link status and removal
cxgb4: Fix stack out-of-bounds read due to wrong size to t4_record_mbox()
packet: Don't write vnet header beyond end of buffer
kcm: do not attach PF_KCM sockets to avoid deadlock
Revert "net: phy: Correctly process PHY_HALTED in phy_stop_machine()"
tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0
mlxsw: spectrum: Forbid linking to devices that have uppers
bridge: switchdev: Clear forward mark when transmitting packet
Revert "net: use lib/percpu_counter API for fragmentation mem accounting"
Revert "net: fix percpu memory leaks"
gianfar: Fix Tx flow control deactivation
vhost_net: correctly check tx avail during rx busy polling
ip6_gre: update mtu properly in ip6gre_err
ipv6: fix memory leak with multiple tables during netns destruction
ipv6: fix typo in fib6_net_exit()
sctp: fix missing wake ups in some situations
ip_tunnel: fix setting ttl and tos value in collect_md mode
f2fs: let fill_super handle roll-forward errors
f2fs: check hot_data for roll-forward recovery
x86/fsgsbase/64: Fully initialize FS and GS state in start_thread_common
x86/fsgsbase/64: Report FSBASE and GSBASE correctly in core dumps
x86/switch_to/64: Rewrite FS/GS switching yet again to fix AMD CPUs
xfs: Move handling of missing page into one place in xfs_find_get_desired_pgoff()
xfs: fix spurious spin_is_locked() assert failures on non-smp kernels
xfs: push buffer of flush locked dquot to avoid quotacheck deadlock
xfs: try to avoid blowing out the transaction reservation when bunmaping a shared extent
xfs: release bli from transaction properly on fs shutdown
xfs: remove bli from AIL before release on transaction abort
xfs: don't allow bmap on rt files
xfs: free uncommitted transactions during log recovery
xfs: free cowblocks and retry on buffered write ENOSPC
xfs: don't crash on unexpected holes in dir/attr btrees
xfs: check _btree_check_block value
xfs: set firstfsb to NULLFSBLOCK before feeding it to _bmapi_write
xfs: check _alloc_read_agf buffer pointer before using
xfs: fix quotacheck dquot id overflow infinite loop
xfs: fix multi-AG deadlock in xfs_bunmapi
xfs: Fix per-inode DAX flag inheritance
xfs: fix inobt inode allocation search optimization
xfs: clear MS_ACTIVE after finishing log recovery
xfs: don't leak quotacheck dquots when cow recovery
iomap: fix integer truncation issues in the zeroing and dirtying helpers
xfs: write unmount record for ro mounts
xfs: toggle readonly state around xfs_log_mount_finish
xfs: remove xfs_trans_ail_delete_bulk
xfs: Add infrastructure needed for error propagation during buffer IO failure
xfs: Properly retry failed inode items in case of error during buffer writeback
xfs: fix recovery failure when log record header wraps log end
xfs: always verify the log tail during recovery
xfs: fix log recovery corruption error due to tail overwrite
xfs: handle -EFSCORRUPTED during head/tail verification
xfs: add log recovery tracepoint for head/tail
xfs: stop searching for free slots in an inode chunk when there are none
xfs: evict all inodes involved with log redo item
xfs: check for race with xfs_reclaim_inode() in xfs_ifree_cluster()
xfs: open-code xfs_buf_item_dirty()
xfs: remove unnecessary dirty bli format check for ordered bufs
xfs: ordered buffer log items are never formatted
xfs: refactor buffer logging into buffer dirtying helper
xfs: don't log dirty ranges for ordered buffers
xfs: skip bmbt block ino validation during owner change
xfs: move bmbt owner change to last step of extent swap
xfs: disallow marking previously dirty buffers as ordered
xfs: relog dirty buffers during swapext bmbt owner change
xfs: disable per-inode DAX flag
xfs: fix incorrect log_flushed on fsync
xfs: don't set v3 xflags for v2 inodes
xfs: open code end_buffer_async_write in xfs_finish_page_writeback
xfs: use kmem_free to free return value of kmem_zalloc
md/raid5: release/flush io in raid5_do_work()
xfs: fix compiler warnings
ipv6: Fix may be used uninitialized warning in rt6_check
Linux 4.9.51
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlnCCKQACgkQONu9yGCS
aT6KghAA15NXnnZVpg61mmFjA9rDYduNnNcKyJl+rVT2xNxndRf4EmXgNf2gCbY0
0Kg092lk1ErA0rCXwWCUeB30VaDh+1uZZykYfbtB+cQvwNiseCRpDTiqYbubxSYM
um2rePxP/VO0RAD0BxUBfqz9tuGuCThiKyndkvHOLmT8aFMrfPhf8f7+rcy1iSkT
OyEVWAzyp3aCN7v9+8MAs6cP+e/uHOQW5pvjbvVDxtIUFJXP8JPRASzGrj+gmL4V
J18VxflLhbulXQ7IHKBGxiNPy8usV5N6ZPSLT4t9zBzoVW+f10XCZeaMFK9iA0/H
b9PB/eoJXqfnLovRpj18708IxJMdJk8aeX0ceZT1Mrei7jfyRdTHH2E0FhdiiMo8
KMuR+8JowO3n4LYPeci9maQyzuQV7ZVEVIyTKCCPsRvGaAzRrWCy39AoCw1LqUQH
ZrpjLIasncbc+zlxwySg8UOGkDgr0IT8Ljex0V8GOvyWDZhZqOGKhVqyyUmYRQPU
Fq0byQ57XCEPSIXy9wpGvabKqIp0mddd7cHpeGttlYfE0sSLDAJXhi/A/Fgu1t1O
CnRFLKsrw0yCbu2GlljdQDEqDdhIgVb2tyjy3h6TD2SW4xMPu3SnrASahnr2Hus5
MS3MK9R7Gbhbk3DfqG79KD2gc3e9FMjGbQl7dkwTfOWdn44jp/4=
=FJ/9
-----END PGP SIGNATURE-----
Merge 4.9.51 into android-4.9-o
Changes in 4.9.51
ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt()
ipv6: add rcu grace period before freeing fib6_node
ipv6: fix sparse warning on rt6i_node
macsec: add genl family module alias
udp: on peeking bad csum, drop packets even if not at head
fsl/man: Inherit parent device and of_node
sctp: Avoid out-of-bounds reads from address storage
qlge: avoid memcpy buffer overflow
netvsc: fix deadlock betwen link status and removal
cxgb4: Fix stack out-of-bounds read due to wrong size to t4_record_mbox()
packet: Don't write vnet header beyond end of buffer
kcm: do not attach PF_KCM sockets to avoid deadlock
Revert "net: phy: Correctly process PHY_HALTED in phy_stop_machine()"
tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0
mlxsw: spectrum: Forbid linking to devices that have uppers
bridge: switchdev: Clear forward mark when transmitting packet
Revert "net: use lib/percpu_counter API for fragmentation mem accounting"
Revert "net: fix percpu memory leaks"
gianfar: Fix Tx flow control deactivation
vhost_net: correctly check tx avail during rx busy polling
ip6_gre: update mtu properly in ip6gre_err
ipv6: fix memory leak with multiple tables during netns destruction
ipv6: fix typo in fib6_net_exit()
sctp: fix missing wake ups in some situations
ip_tunnel: fix setting ttl and tos value in collect_md mode
f2fs: let fill_super handle roll-forward errors
f2fs: check hot_data for roll-forward recovery
x86/fsgsbase/64: Fully initialize FS and GS state in start_thread_common
x86/fsgsbase/64: Report FSBASE and GSBASE correctly in core dumps
x86/switch_to/64: Rewrite FS/GS switching yet again to fix AMD CPUs
xfs: Move handling of missing page into one place in xfs_find_get_desired_pgoff()
xfs: fix spurious spin_is_locked() assert failures on non-smp kernels
xfs: push buffer of flush locked dquot to avoid quotacheck deadlock
xfs: try to avoid blowing out the transaction reservation when bunmaping a shared extent
xfs: release bli from transaction properly on fs shutdown
xfs: remove bli from AIL before release on transaction abort
xfs: don't allow bmap on rt files
xfs: free uncommitted transactions during log recovery
xfs: free cowblocks and retry on buffered write ENOSPC
xfs: don't crash on unexpected holes in dir/attr btrees
xfs: check _btree_check_block value
xfs: set firstfsb to NULLFSBLOCK before feeding it to _bmapi_write
xfs: check _alloc_read_agf buffer pointer before using
xfs: fix quotacheck dquot id overflow infinite loop
xfs: fix multi-AG deadlock in xfs_bunmapi
xfs: Fix per-inode DAX flag inheritance
xfs: fix inobt inode allocation search optimization
xfs: clear MS_ACTIVE after finishing log recovery
xfs: don't leak quotacheck dquots when cow recovery
iomap: fix integer truncation issues in the zeroing and dirtying helpers
xfs: write unmount record for ro mounts
xfs: toggle readonly state around xfs_log_mount_finish
xfs: remove xfs_trans_ail_delete_bulk
xfs: Add infrastructure needed for error propagation during buffer IO failure
xfs: Properly retry failed inode items in case of error during buffer writeback
xfs: fix recovery failure when log record header wraps log end
xfs: always verify the log tail during recovery
xfs: fix log recovery corruption error due to tail overwrite
xfs: handle -EFSCORRUPTED during head/tail verification
xfs: add log recovery tracepoint for head/tail
xfs: stop searching for free slots in an inode chunk when there are none
xfs: evict all inodes involved with log redo item
xfs: check for race with xfs_reclaim_inode() in xfs_ifree_cluster()
xfs: open-code xfs_buf_item_dirty()
xfs: remove unnecessary dirty bli format check for ordered bufs
xfs: ordered buffer log items are never formatted
xfs: refactor buffer logging into buffer dirtying helper
xfs: don't log dirty ranges for ordered buffers
xfs: skip bmbt block ino validation during owner change
xfs: move bmbt owner change to last step of extent swap
xfs: disallow marking previously dirty buffers as ordered
xfs: relog dirty buffers during swapext bmbt owner change
xfs: disable per-inode DAX flag
xfs: fix incorrect log_flushed on fsync
xfs: don't set v3 xflags for v2 inodes
xfs: open code end_buffer_async_write in xfs_finish_page_writeback
xfs: use kmem_free to free return value of kmem_zalloc
md/raid5: release/flush io in raid5_do_work()
xfs: fix compiler warnings
ipv6: Fix may be used uninitialized warning in rt6_check
Linux 4.9.51
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 79e99bdd60b484af9afe0147e85a13e66d5c1cdb ]
Commit 6bc506b4fb ("bridge: switchdev: Add forward mark support for
stacked devices") added the 'offload_fwd_mark' bit to the skb in order
to allow drivers to indicate to the bridge driver that they already
forwarded the packet in L2.
In case the bit is set, before transmitting the packet from each port,
the port's mark is compared with the mark stored in the skb's control
block. If both marks are equal, we know the packet arrived from a switch
device that already forwarded the packet and it's not re-transmitted.
However, if the packet is transmitted from the bridge device itself
(e.g., br0), we should clear the 'offload_fwd_mark' bit as the mark
stored in the skb's control block isn't valid.
This scenario can happen in rare cases where a packet was trapped during
L3 forwarding and forwarded by the kernel to a bridge device.
Fixes: 6bc506b4fb ("bridge: switchdev: Add forward mark support for stacked devices")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reported-by: Yotam Gigi <yotamg@mellanox.com>
Tested-by: Yotam Gigi <yotamg@mellanox.com>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Ido Schimmelauthored and Greg Kroah-Hartmancommited 2017-09-20 08:19:55 +02:00
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAllxlFQACgkQONu9yGCS
aT42GBAAlL+49kLHeHQszHbIhCyd3bf59TC6cMZdGCA11X/TxvS4jFWpeopXQ7SR
rngaPiAItWFuakZPAIe+cdIQhA1P8o0pwr5iIj0/bXilKYF9ujNrOXxYGTD6qgeB
1G437oYOcIXZQ1sHzy0eMYxM/s8HvmFvVxCwOaISqB6LIZDtX5lYQdzSk/Iy5zAt
k0YBr+q+c6rm9039UQrvyQ0oTwUh0qSWg4rSW8tCOJcIJZP2BaD4M0BLQbaCOYWg
43Npx4MAHqIzWk38fZ7KxOo9yfNv6vbqW1WpB2WAT6i4zJJ6JtXqr7BpYVrSLDL9
NQWvxpuPbEcACL0Mt/mp2fh3bqfh5Hxl77YijyLCo5yq3XRt4w2kOsLUtEiSomQb
51rik+amM7v+ryJqPHLbSngZWbPoVZmkBO1psm5CaMcA4WnVEYy+ga9tnnXRQOzu
8irWSr4L4AxqBoxR/OjyfBcdIOlvgT9jEgnLnER1/W3vHtooyEkXBDYoZ4MszXWm
79VTDRb8i5VIm97klPUpo61D8kGnZOuXDJS2arKqJqVBjcVHeeOwU0jF/4HVpU4N
HKHS/PQRLbV8Aa1r3uADAZLs01dUV1qbdgd7EZBUWj6Vix80w4e3K+kTDIcCe8zC
1KkvGNWjP/3JxwH6GgHsz8hJ6I4Dmsl9JTRUSAFnnGeSj68UDN4=
=QrTI
-----END PGP SIGNATURE-----
Merge 4.9.39 into android-4.9
Changes in 4.9.39
xen-netfront: Rework the fix for Rx stall during OOM and network stress
net_sched: fix error recovery at qdisc creation
net: sched: Fix one possible panic when no destroy callback
net/phy: micrel: configure intterupts after autoneg workaround
ipv6: avoid unregistering inet6_dev for loopback
net: dp83640: Avoid NULL pointer dereference.
tcp: reset sk_rx_dst in tcp_disconnect()
net: prevent sign extension in dev_get_stats()
bridge: mdb: fix leak on complete_info ptr on fail path
rocker: move dereference before free
bpf: prevent leaking pointer via xadd on unpriviledged
net: handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish()
net/mlx5: Cancel delayed recovery work when unloading the driver
liquidio: fix bug in soft reset failure detection
net/mlx5e: Fix TX carrier errors report in get stats ndo
ipv6: dad: don't remove dynamic addresses if link is down
vxlan: fix hlist corruption
net: core: Fix slab-out-of-bounds in netdev_stats_to_stats64
net: ipv6: Compare lwstate in detecting duplicate nexthops
vrf: fix bug_on triggered by rx when destroying a vrf
rds: tcp: use sock_create_lite() to create the accept socket
brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()
brcmfmac: Fix a memory leak in error handling path in 'brcmf_cfg80211_attach'
brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain
sfc: don't read beyond unicast address list
cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE
cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES
cfg80211: Check if PMKID attribute is of expected size
cfg80211: Check if NAN service ID is of expected size
irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity
parisc: Report SIGSEGV instead of SIGBUS when running out of stack
parisc: use compat_sys_keyctl()
parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs
parisc/mm: Ensure IRQs are off in switch_mm()
tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/: Depth
thp, mm: fix crash due race in MADV_FREE handling
kernel/extable.c: mark core_kernel_text notrace
mm/list_lru.c: fix list_lru_count_node() to be race free
fs/dcache.c: fix spin lockup issue on nlru->lock
checkpatch: silence perl 5.26.0 unescaped left brace warnings
binfmt_elf: use ELF_ET_DYN_BASE only for PIE
arm: move ELF_ET_DYN_BASE to 4MB
arm64: move ELF_ET_DYN_BASE to 4GB / 4MB
powerpc: move ELF_ET_DYN_BASE to 4GB / 4MB
s390: reduce ELF_ET_DYN_BASE
exec: Limit arg stack to at most 75% of _STK_LIM
ARM64: dts: marvell: armada37xx: Fix timer interrupt specifiers
vt: fix unchecked __put_user() in tioclinux ioctls
rcu: Add memory barriers for NOCB leader wakeup
nvmem: core: fix leaks on registration errors
mnt: In umount propagation reparent in a separate pass
mnt: In propgate_umount handle visiting mounts in any order
mnt: Make propagate_umount less slow for overlapping mount propagation trees
selftests/capabilities: Fix the test_execve test
mm: fix overflow check in expand_upwards()
crypto: talitos - Extend max key length for SHA384/512-HMAC and AEAD
crypto: atmel - only treat EBUSY as transient if backlog
crypto: sha1-ssse3 - Disable avx2
crypto: caam - properly set IV after {en,de}crypt
crypto: caam - fix signals handling
Revert "sched/core: Optimize SCHED_SMT"
sched/fair, cpumask: Export for_each_cpu_wrap()
sched/topology: Fix building of overlapping sched-groups
sched/topology: Optimize build_group_mask()
sched/topology: Fix overlapping sched_group_mask
PM / wakeirq: Convert to SRCU
PM / QoS: return -EINVAL for bogus strings
tracing: Use SOFTIRQ_OFFSET for softirq dectection for more accurate results
kvm: vmx: Do not disable intercepts for BNDCFGS
kvm: x86: Guest BNDCFGS requires guest MPX support
kvm: vmx: Check value written to IA32_BNDCFGS
kvm: vmx: allow host to access guest MSR_IA32_BNDCFGS
4.9.39
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAllBNNMACgkQONu9yGCS
aT4rJA//XOtxp2nr01OqffSItCX0vq7vMofbjo7spI2LF3JyxKkx0hje0im82XoD
cYhZHyeK9lCHRZt2O541xOp3ITconecRvlt6uq49zKNvlFAelnp0rRTOktluJK/n
Xm7EP2KLHeHXv+rvCfzU0hDC9fvoZe82NIF7kddAWHX4D/K3C6Jw6FVc4/QPl2MG
11R6pylPtMGObgPEmfDlohBitcC3KawXAhIcyTTAr3rcuO2Wm00H+uF0VOpyD9hZ
S5A8ecuyZVQw3mIKAJ9vOwkVoln1E+/P/OltWEXElkBZONHpI4LB2IE7Nmwnx+pE
5oO3afNZIYOejX+GQvK2Apc8VONDV2VZRoIstzl+uaKDNGFaSLIu8AQ/UQfmoqTE
Pwrp/FxgDGjq6NOf/+MqNhiqS9433Xgmt4HT5xctzS0zFNGzLIokdjRH3x7n6cez
2JvdtRvJfdNq31kh6xQE/8oXuZktRSw3GxC5K4Dw3NRh02/9KNAgEjNPEMNXziGw
RhLhyXl8i5eGAu1gxruojzRyCvaMS6S8ZcAvSSoJze0kj8jfkZtQbBswvS1LF9EI
FFemshd1sQxUeZiXGYPuUUfyDvxvs7KRIqAYux8lsIhSQTu16REqsZRrzidpDP+K
xtH61YBWhwDHZKIoT+Jchmn8QCytI77MvFdGuTl+KRPV4OyyeJs=
=NE4C
-----END PGP SIGNATURE-----
Merge 4.9.32 into android-4.9
Changes in 4.9.32
bnx2x: Fix Multi-Cos
vxlan: eliminate cached dst leak
ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()
cxgb4: avoid enabling napi twice to the same queue
tcp: disallow cwnd undo when switching congestion control
vxlan: fix use-after-free on deletion
ipv6: Fix leak in ipv6_gso_segment().
net: ping: do not abuse udp_poll()
net/ipv6: Fix CALIPSO causing GPF with datagram support
net: ethoc: enable NAPI before poll may be scheduled
net: stmmac: fix completely hung TX when using TSO
net: bridge: start hello timer only if device is up
sparc64: Add __multi3 for gcc 7.x and later.
sparc64: mm: fix copy_tsb to correctly copy huge page TSBs
sparc: Machine description indices can vary
sparc64: reset mm cpumask after wrap
sparc64: combine activate_mm and switch_mm
sparc64: redefine first version
sparc64: add per-cpu mm of secondary contexts
sparc64: new context wrap
sparc64: delete old wrap code
arch/sparc: support NR_CPUS = 4096
serial: ifx6x60: fix use-after-free on module unload
ptrace: Properly initialize ptracer_cred on fork
crypto: asymmetric_keys - handle EBUSY due to backlog correctly
KEYS: fix dereferencing NULL payload with nonzero length
KEYS: fix freeing uninitialized memory in key_update()
KEYS: encrypted: avoid encrypting/decrypting stack buffers
crypto: drbg - wait for crypto op not signal safe
crypto: gcm - wait for crypto op not signal safe
drm/amdgpu/ci: disable mclk switching for high refresh rates (v2)
nfsd4: fix null dereference on replay
nfsd: Fix up the "supattr_exclcreat" attributes
efi: Don't issue error message when booted under Xen
kvm: async_pf: fix rcu_irq_enter() with irqs enabled
KVM: cpuid: Fix read/write out-of-bounds vulnerability in cpuid emulation
arm64: KVM: Preserve RES1 bits in SCTLR_EL2
arm64: KVM: Allow unaligned accesses at EL2
arm: KVM: Allow unaligned accesses at HYP
KVM: async_pf: avoid async pf injection when in guest mode
KVM: arm/arm64: vgic-v3: Do not use Active+Pending state for a HW interrupt
KVM: arm/arm64: vgic-v2: Do not use Active+Pending state for a HW interrupt
dmaengine: usb-dmac: Fix DMAOR AE bit definition
dmaengine: ep93xx: Always start from BASE0
dmaengine: ep93xx: Don't drain the transfers in terminate_all()
dmaengine: mv_xor_v2: handle mv_xor_v2_prep_sw_desc() error properly
dmaengine: mv_xor_v2: properly handle wrapping in the array of HW descriptors
dmaengine: mv_xor_v2: do not use descriptors not acked by async_tx
dmaengine: mv_xor_v2: enable XOR engine after its configuration
dmaengine: mv_xor_v2: fix tx_submit() implementation
dmaengine: mv_xor_v2: remove interrupt coalescing
dmaengine: mv_xor_v2: set DMA mask to 40 bits
cfq-iosched: fix the delay of cfq_group's vdisktime under iops mode
xen/privcmd: Support correctly 64KB page granularity when mapping memory
ext4: fix SEEK_HOLE
ext4: keep existing extra fields when inode expands
ext4: fix data corruption with EXT4_GET_BLOCKS_ZERO
ext4: fix fdatasync(2) after extent manipulation operations
drm: Fix oops + Xserver hang when unplugging USB drm devices
usb: gadget: f_mass_storage: Serialize wake and sleep execution
usb: chipidea: udc: fix NULL pointer dereference if udc_start failed
usb: chipidea: debug: check before accessing ci_role
staging/lustre/lov: remove set_fs() call from lov_getstripe()
iio: adc: bcm_iproc_adc: swap primary and secondary isr handler's
iio: light: ltr501 Fix interchanged als/ps register field
iio: proximity: as3935: fix AS3935_INT mask
iio: proximity: as3935: fix iio_trigger_poll issue
mei: make sysfs modalias format similar as uevent modalias
cpufreq: cpufreq_register_driver() should return -ENODEV if init fails
target: Re-add check to reject control WRITEs with overflow data
drm/msm: Expose our reservation object when exporting a dmabuf.
ahci: Acer SA5-271 SSD Not Detected Fix
cgroup: Prevent kill_css() from being called more than once
Input: elantech - add Fujitsu Lifebook E546/E557 to force crc_enabled
cpuset: consider dying css as offline
fs: add i_blocksize()
ufs: restore proper tail allocation
fix ufs_isblockset()
ufs: restore maintaining ->i_blocks
ufs: set correct ->s_maxsize
ufs_extend_tail(): fix the braino in calling conventions of ufs_new_fragments()
ufs_getfrag_block(): we only grab ->truncate_mutex on block creation path
cxl: Fix error path on bad ioctl
cxl: Avoid double free_irq() for psl,slice interrupts
btrfs: use correct types for page indices in btrfs_page_exists_in_range
btrfs: fix memory leak in update_space_info failure path
KVM: arm/arm64: Handle possible NULL stage2 pud when ageing pages
scsi: qla2xxx: don't disable a not previously enabled PCI device
scsi: qla2xxx: Modify T262 FW dump template to specify same start/end to debug customer issues
scsi: qla2xxx: Set bit 15 for DIAG_ECHO_TEST MBC
scsi: qla2xxx: Fix mailbox pointer error in fwdump capture
powerpc/sysdev/simple_gpio: Fix oops in gpio save_regs function
powerpc/numa: Fix percpu allocations to be NUMA aware
powerpc/hotplug-mem: Fix missing endian conversion of aa_index
powerpc/kernel: Fix FP and vector register restoration
powerpc/kernel: Initialize load_tm on task creation
perf/core: Drop kernel samples even though :u is specified
drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve()
drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()
drm/vmwgfx: Make sure backup_handle is always valid
drm/nouveau/tmr: fully separate alarm execution/pending lists
ALSA: timer: Fix race between read and ioctl
ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT
ASoC: Fix use-after-free at card unregistration
cpu/hotplug: Drop the device lock on error
drivers: char: mem: Fix wraparound check to allow mappings up to the end
serial: sh-sci: Fix panic when serial console and DMA are enabled
arm64: traps: fix userspace cache maintenance emulation on a tagged pointer
arm64: hw_breakpoint: fix watchpoint matching for tagged pointers
arm64: entry: improve data abort handling of tagged pointers
ARM: 8636/1: Cleanup sanity_check_meminfo
ARM: 8637/1: Adjust memory boundaries after reservations
usercopy: Adjust tests to deal with SMAP/PAN
drm/i915/vbt: don't propagate errors from intel_bios_init()
drm/i915/vbt: split out defaults that are set when there is no VBT
cpufreq: schedutil: move cached_raw_freq to struct sugov_policy
cpufreq: schedutil: Fix per-CPU structure initialization in sugov_start()
netfilter: nft_set_rbtree: handle element re-addition after deletion
Linux 4.9.32
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit aeb073241fe7a2b932e04e20c60e47718332877f ]
When the transition of NO_STP -> KERNEL_STP was fixed by always calling
mod_timer in br_stp_start, it introduced a new regression which causes
the timer to be armed even when the bridge is down, and since we stop
the timers in its ndo_stop() function, they never get disabled if the
device is destroyed before it's upped.
To reproduce:
$ while :; do ip l add br0 type bridge hello_time 100; brctl stp br0 on;
ip l del br0; done;
CC: Xin Long <lucien.xin@gmail.com>
CC: Ivan Vecera <cera@cera.cz>
CC: Sebastian Ott <sebott@linux.vnet.ibm.com>
Reported-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Fixes: 6d18c732b95c ("bridge: start hello_timer when enabling KERNEL_STP in br_stp_start")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Nikolay Aleksandrovauthored and Greg Kroah-Hartmancommited 2017-06-14 15:05:52 +02:00
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlk30IgACgkQONu9yGCS
aT48xxAAirJKKnig+OKPmRy0lMajaUjOHvBDkCJ5o4FObnqwWLbf+2CxNBXCP20G
t8/SXk2AR2OjDqB2MG+3YozDrYXQ146oTDOUhBChuWQCQoZQni5l/fpF7qcjFhG9
OvG8YquFElQ7b0kr59hnbvxM2SifjzL9gyEzFG+ERFGf6m8UDxvPjVr/GWwzrt3v
SKo1Rgy6KgeSbOvwPo5uLaGl9gA5D/4UhHTgwDc3ijnwlhrEUEz+7hONH2qpG8n6
AyJbC/5fnJIyxYyyHHKez9ezf2ntxlkMB6CHClVKOPMhbs+3wkwOEk4hqzYgLHNU
gzawLfBT67X3Uw3b40Sdfhhjwx5kje7SGeMvURdrXUlgh95epGSqxYRl7O2dmZQA
HE6GFOiDiwKvR4aJiSW+7z3FCurbvzghIMacoGiSrtjlkLGUyYnC7+r/LuLGsRD8
QpWAxquzLqeJ8OLsyMBYISHtaTNPb2OEzLvLzy8uDPAO9a2HeC1TUqrnHynHwymw
jrHk1X02eum1/P2KV2Ye1xsInOThKJGTlKLcTI1/Ds5q4oXCf1lmJjk66biw9YJB
UHiSGEEwgmEPidfSfqXmOH1RCUbqN0bJRVfjiwYaPPmNzh4keyrYwzh8yrawZbFy
QWMRNnZwe3xExqX8bdz7/1j5v6LdAtaC9ebkabnY8GnVDjT8JUk=
=C5Fd
-----END PGP SIGNATURE-----
Merge 4.9.31 into android-4.9
Changes in 4.9.31
dccp/tcp: do not inherit mc_list from parent
driver: vrf: Fix one possible use-after-free issue
ipv6/dccp: do not inherit ipv6_mc_list from parent
s390/qeth: handle sysfs error during initialization
s390/qeth: unbreak OSM and OSN support
s390/qeth: avoid null pointer dereference on OSN
s390/qeth: add missing hash table initializations
bpf, arm64: fix faulty emission of map access in tail calls
netem: fix skb_orphan_partial()
net: fix compile error in skb_orphan_partial()
tcp: avoid fragmenting peculiar skbs in SACK
sctp: fix src address selection if using secondary addresses for ipv6
sctp: do not inherit ipv6_{mc|ac|fl}_list from parent
net/packet: fix missing net_device reference release
net/mlx5e: Use the correct pause values for ethtool advertising
net/mlx5e: Fix ethtool pause support and advertise reporting
tcp: eliminate negative reordering in tcp_clean_rtx_queue
net: Improve handling of failures on link and route dumps
ipv6: Prevent overrun when parsing v6 header options
ipv6: Check ip6_find_1stfragopt() return value properly.
bridge: netlink: check vlan_default_pvid range
qmi_wwan: add another Lenovo EM74xx device ID
bridge: start hello_timer when enabling KERNEL_STP in br_stp_start
ipv6: fix out of bound writes in __ip6_append_data()
bonding: fix accounting of active ports in 3ad
net/mlx5: Avoid using pending command interface slots
net: phy: marvell: Limit errata to 88m1101
vlan: Fix tcp checksum offloads in Q-in-Q vlans
be2net: Fix offload features for Q-in-Q packets
virtio-net: enable TSO/checksum offloads for Q-in-Q vlans
tcp: avoid fastopen API to be used on AF_UNSPEC
sctp: fix ICMP processing if skb is non-linear
ipv4: add reference counting to metrics
bpf: add bpf_clone_redirect to bpf_helper_changes_pkt_data
sparc: Fix -Wstringop-overflow warning
sparc/ftrace: Fix ftrace graph time measurement
fs/ufs: Set UFS default maximum bytes per file
powerpc/spufs: Fix hash faults for kernel regions
drivers/tty: 8250: only call fintek_8250_probe when doing port I/O
i2c: i2c-tiny-usb: fix buffer not being DMA capable
crypto: skcipher - Add missing API setkey checks
x86/MCE: Export memory_error()
acpi, nfit: Fix the memory error check in nfit_handle_mce()
Revert "ACPI / button: Change default behavior to lid_init_state=open"
mmc: sdhci-iproc: suppress spurious interrupt with Multiblock read
iscsi-target: Always wait for kthread_should_stop() before kthread exit
ibmvscsis: Clear left-over abort_cmd pointers
ibmvscsis: Fix the incorrect req_lim_delta
HID: wacom: Have wacom_tpc_irq guard against possible NULL dereference
nvme-rdma: support devices with queue size < 32
nvme: use blk_mq_start_hw_queues() in nvme_kill_queues()
nvme: avoid to use blk_mq_abort_requeue_list()
scsi: mpt3sas: Force request partial completion alignment
drm/radeon/ci: disable mclk switching for high refresh rates (v2)
drm/radeon: Unbreak HPD handling for r600+
drm/radeon: Fix vram_size/visible values in DRM_RADEON_GEM_INFO ioctl
pcmcia: remove left-over %Z format
ALSA: hda - apply STAC_9200_DELL_M22 quirk for Dell Latitude D430
mm/migrate: fix refcount handling when !hugepage_migration_supported()
mlock: fix mlock count can not decrease in race condition
mm: consider memblock reservations for deferred memory initialization sizing
RDMA/qib,hfi1: Fix MR reference count leak on write with immediate
x86/boot: Use CROSS_COMPILE prefix for readelf
ksm: prevent crash after write_protect_page fails
slub/memcg: cure the brainless abuse of sysfs attributes
mm/slub.c: trace free objects at KERN_INFO
drm/gma500/psb: Actually use VBT mode when it is found
xfs: Fix missed holes in SEEK_HOLE implementation
xfs: use ->b_state to fix buffer I/O accounting release race
xfs: fix off-by-one on max nr_pages in xfs_find_get_desired_pgoff()
xfs: verify inline directory data forks
xfs: rework the inline directory verifiers
xfs: fix kernel memory exposure problems
xfs: use dedicated log worker wq to avoid deadlock with cil wq
xfs: fix over-copying of getbmap parameters from userspace
xfs: actually report xattr extents via iomap
xfs: drop iolock from reclaim context to appease lockdep
xfs: fix integer truncation in xfs_bmap_remap_alloc
xfs: handle array index overrun in xfs_dir2_leaf_readbuf()
xfs: prevent multi-fsb dir readahead from reading random blocks
xfs: fix up quotacheck buffer list error handling
xfs: support ability to wait on new inodes
xfs: update ag iterator to support wait on new inodes
xfs: wait on new inodes during quotaoff dquot release
xfs: reserve enough blocks to handle btree splits when remapping
xfs: fix use-after-free in xfs_finish_page_writeback
xfs: fix indlen accounting error on partial delalloc conversion
xfs: BMAPX shouldn't barf on inline-format directories
xfs: bad assertion for delalloc an extent that start at i_size
xfs: xfs_trans_alloc_empty
xfs: avoid mount-time deadlock in CoW extent recovery
xfs: fix unaligned access in xfs_btree_visit_blocks
xfs: Fix off-by-in in loop termination in xfs_find_get_desired_pgoff()
Linux 4.9.31
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 6d18c732b95c0a9d35e9f978b4438bba15412284 ]
Since commit 76b91c32dd ("bridge: stp: when using userspace stp stop
kernel hello and hold timers"), bridge would not start hello_timer if
stp_enabled is not KERNEL_STP when br_dev_open.
The problem is even if users set stp_enabled with KERNEL_STP later,
the timer will still not be started. It causes that KERNEL_STP can
not really work. Users have to re-ifup the bridge to avoid this.
This patch is to fix it by starting br->hello_timer when enabling
KERNEL_STP in br_stp_start.
As an improvement, it's also to start hello_timer again only when
br->stp_enabled is KERNEL_STP in br_hello_timer_expired, there is
no reason to start the timer again when it's NO_STP.
Fixes: 76b91c32dd ("bridge: stp: when using userspace stp stop kernel hello and hold timers")
Reported-by: Haidong Li <haili@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Reviewed-by: Ivan Vecera <cera@cera.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Xin Longauthored and Greg Kroah-Hartmancommited 2017-06-07 12:07:44 +02:00
[ Upstream commit a285860211bf257b0e6d522dac6006794be348af ]
Currently it is allowed to set the default pvid of a bridge to a value
above VLAN_VID_MASK (0xfff). This patch adds a check to br_validate and
returns -EINVAL in case the pvid is out of bounds.
Reproduce by calling:
[root@test ~]# ip l a type bridge
[root@test ~]# ip l a type dummy
[root@test ~]# ip l s bridge0 type bridge vlan_filtering 1
[root@test ~]# ip l s bridge0 type bridge vlan_default_pvid 9999
[root@test ~]# ip l s dummy0 master bridge0
[root@test ~]# bridge vlan
port vlan ids
bridge0 9999 PVID Egress Untagged
dummy0 9999 PVID Egress Untagged
Fixes: 0f963b7592 ("bridge: netlink: add support for default_pvid")
Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: Tobias Jungel <tobias.jungel@bisdn.de>
Acked-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Tobias Jungelauthored and Greg Kroah-Hartmancommited 2017-06-07 12:07:44 +02:00
[ Upstream commit a13b2082ece95247779b9995c4e91b4246bed023 ]
Andreas reports kernel oops during rmmod of the br_netfilter module.
Hannes debugged the oops down to a NULL rt6info->rt6i_indev.
Problem is that br_netfilter has the nasty concept of adding a fake
rtable to skb->dst; this happens in a br_netfilter prerouting hook.
A second hook (in bridge LOCAL_IN) is supposed to remove these again
before the skb is handed up the stack.
However, on module unload hooks get unregistered which means an
skb could traverse the prerouting hook that attaches the fake_rtable,
while the 'fake rtable remove' hook gets removed from the hooklist
immediately after.
Fixes: 34666d467c ("netfilter: bridge: move br_netfilter out of the core")
Reported-by: Andreas Karis <akaris@redhat.com>
Debugged-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Florian Westphalauthored and Greg Kroah-Hartmancommited 2017-03-22 12:43:34 +01:00
[ Upstream commit 8953de2f02ad7b15e4964c82f9afd60f128e4e98 ]
Even with multicast flooding turned off, IPv6 ND should still work so
that IPv6 connectivity is provided. Allow this by continuing to flood
multicast traffic originated by us.
Fixes: b6cb5ac833 ("net: bridge: add per-port multicast flood flag")
Cc: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: Mike Manning <mmanning@brocade.com>
Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Mike Manningauthored and Greg Kroah-Hartmancommited 2017-03-22 12:43:32 +01:00
[ Upstream commit b6677449dff674cf5b81429b11d5c7f358852ef9 ]
Any bridge options specified during link creation (e.g. ip link add)
are ignored as br_dev_newlink() does not process them.
Use br_changelink() to do it.
Fixes: 1332351617 ("bridge: implement rtnl_link_ops->changelink")
Signed-off-by: Ivan Vecera <cera@cera.cz>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Ivan Veceraauthored and Greg Kroah-Hartmancommited 2017-02-04 09:47:10 +01:00
Since rx_bytes accounting does not include Ethernet Headers in
br_input.c, excluding ETH_HLEN on the transmit path for consistent
measurement of packet length on both the Tx and Rx chains.
The clean way would be for Rx to include the eth header, but the
skb len has already been adjusted by the time the br code sees the skb.
This is only a temporary workaround until we can completely ignore or
cleanly fix the skb->len handling.
Change-Id: I910de95a4686b2119da7f1f326e2154ef31f9972
Signed-off-by: Ashish Sharma <ashishsharma@google.com>
Ashish Sharmaauthored and Dmitry Shmidtcommited 2017-01-19 13:32:38 -08:00
commit 14221cc45caad2fcab3a8543234bb7eda9b540d5 upstream.
Problem:
br_nf_pre_routing_finish() calls itself instead of
br_nf_pre_routing_finish_bridge(). Due to this bug reverse path filter drops
packets that go through bridge interface.
User impact:
Local docker containers with bridge network can not communicate with each
other.
Fixes: c5136b15ea ("netfilter: bridge: add and use br_nf_hook_thresh")
Signed-off-by: Artur Molchanov <artur.molchanov@synesis.ru>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Artur Molchanovauthored and Greg Kroah-Hartmancommited 2017-01-19 20:18:01 +01:00
Function br_sysfs_addbr() does not set error code when the call
kobject_create_and_add() returns a NULL pointer. It may be better to
return "-ENOMEM" when kobject_create_and_add() fails.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188781
Signed-off-by: Pan Bian <bianpan2016@163.com>
Acked-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Pan Bianauthored and David S. Millercommited 2016-12-05 13:26:22 -05:00
Satish reported a problem with the perm multicast router ports not getting
reenabled after some series of events, in particular if it happens that the
multicast snooping has been disabled and the port goes to disabled state
then it will be deleted from the router port list, but if it moves into
non-disabled state it will not be re-added because the mcast snooping is
still disabled, and enabling snooping later does nothing.
Here are the steps to reproduce, setup br0 with snooping enabled and eth1
added as a perm router (multicast_router = 2):
1. $ echo 0 > /sys/class/net/br0/bridge/multicast_snooping
2. $ ip l set eth1 down
^ This step deletes the interface from the router list
3. $ ip l set eth1 up
^ This step does not add it again because mcast snooping is disabled
4. $ echo 1 > /sys/class/net/br0/bridge/multicast_snooping
5. $ bridge -d -s mdb show
<empty>
At this point we have mcast enabled and eth1 as a perm router (value = 2)
but it is not in the router list which is incorrect.
After this change:
1. $ echo 0 > /sys/class/net/br0/bridge/multicast_snooping
2. $ ip l set eth1 down
^ This step deletes the interface from the router list
3. $ ip l set eth1 up
^ This step does not add it again because mcast snooping is disabled
4. $ echo 1 > /sys/class/net/br0/bridge/multicast_snooping
5. $ bridge -d -s mdb show
router ports on br0: eth1
Note: we can directly do br_multicast_enable_port for all because the
querier timer already has checks for the port state and will simply
expire if it's in blocking/disabled. See the comment added by
commit 9aa6638216 ("bridge: multicast: add a comment to
br_port_state_selection about blocking state")
Fixes: 561f1103a2 ("bridge: Add multicast_snooping sysfs toggle")
Reported-by: Satish Ashok <sashok@cumulusnetworks.com>
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Nikolay Aleksandrovauthored and David S. Millercommited 2016-10-18 13:52:13 -04:00
When I added the multicast flood control flag, I also added an attribute
for it for sysfs similar to other flags, but I forgot to add it to
brport_attrs.
Fixes: b6cb5ac833 ("net: bridge: add per-port multicast flood flag")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Nikolay Aleksandrovauthored and David S. Millercommited 2016-10-13 12:16:36 -04:00
When using bridge without bridge netfilter enabled the message
displayed is rather confusing and leads to belive that a deprecated
feature is in use. Use IS_MODULE to be explicit that the message only
affects users which use bridge netfilter as module and reword the
message.
Signed-off-by: Stefan Agner <stefan@agner.ch>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stefan Agnerauthored and David S. Millercommited 2016-10-02 22:44:03 -04:00
Conflicts:
net/netfilter/core.c
net/netfilter/nf_tables_netdev.c
Resolve two conflicts before pull request for David's net-next tree:
1) Between c73c248490 ("netfilter: nf_tables_netdev: remove redundant
ip_hdr assignment") from the net tree and commit ddc8b6027a
("netfilter: introduce nft_set_pktinfo_{ipv4, ipv6}_validate()").
2) Between e8bffe0cf9 ("net: Add _nf_(un)register_hooks symbols") and
Aaron Conole's patches to replace list_head with single linked list.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Pablo Neira Ayusocommited 2016-09-25 23:34:19 +02:00
NFTA_LOG_FLAGS attribute is already supported, but the related
NF_LOG_XXX flags are not exposed to the userspace. So we cannot
explicitly enable log flags to log uid, tcp sequence, ip options
and so on, i.e. such rule "nft add rule filter output log uid"
is not supported yet.
So move NF_LOG_XXX macro definitions to the uapi/../nf_log.h. In
order to keep consistent with other modules, change NF_LOG_MASK to
refer to all supported log flags. On the other hand, add a new
NF_LOG_DEFAULT_MASK to refer to the original default log flags.
Finally, if user specify the unsupported log flags or NFTA_LOG_GROUP
and NFTA_LOG_FLAGS are set at the same time, report EINVAL to the
userspace.
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Liping Zhangauthored and Pablo Neira Ayusocommited 2016-09-25 23:16:43 +02:00
The netfilter hook list never uses the prev pointer, and so can be trimmed to
be a simple singly-linked list.
In addition to having a more light weight structure for hook traversal,
struct net becomes 5568 bytes (down from 6400) and struct net_device becomes
2176 bytes (down from 2240).
Signed-off-by: Aaron Conole <aconole@bytheb.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Aaron Conoleauthored and Pablo Neira Ayusocommited 2016-09-25 14:38:48 +02:00
All of the callers of nf_hook_slow already hold the rcu_read_lock, so this
cleanup removes the recursive call. This is just a cleanup, as the locking
code gracefully handles this situation.
Signed-off-by: Aaron Conole <aconole@bytheb.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Aaron Conoleauthored and Pablo Neira Ayusocommited 2016-09-24 21:29:53 +02:00
This replaces the last uses of NF_HOOK_THRESH().
Followup patch will remove it and rename nf_hook_thresh.
The reason is that inet (non-bridge) netfilter no longer invokes the
hooks from hooks, so we do no longer need the thresh value to skip hooks
with a lower priority.
The bridge netfilter however may need to do this. br_nf_hook_thresh is a
wrapper that is supposed to do this, i.e. only call hooks with a
priority that exceeds NF_BR_PRI_BRNF.
It's used only in the recursion cases of br_netfilter. It invokes
nf_hook_slow while holding an rcu read-side critical section to make a
future cleanup simpler.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Aaron Conole <aconole@bytheb.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Florian Westphalauthored and Pablo Neira Ayusocommited 2016-09-24 21:25:48 +02:00
If /sbin/bridge-stp is available on the system, bridge tries to execute
it instead of the kernel implementation when starting/stopping STP.
If anything goes wrong with /sbin/bridge-stp, bridge silently falls back
to kernel STP, making hard to debug userspace STP.
This patch adds a br_stp_call_user helper to start/stop userspace STP
and debug errors from the program: abnormal exit status is stored in the
lower byte and normal exit status is stored in higher byte.
Below is a simple example on a kernel with dynamic debug enabled:
# ln -s /bin/false /sbin/bridge-stp
# brctl stp br0 on
br0: failed to start userspace STP (256)
# dmesg
br0: /sbin/bridge-stp exited with code 1
br0: failed to start userspace STP (256)
br0: using kernel STP
Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Vivien Didelotauthored and David S. Millercommited 2016-09-13 11:21:31 -04:00
Conflicts:
drivers/net/ethernet/mediatek/mtk_eth_soc.c
drivers/net/ethernet/qlogic/qed/qed_dcbx.c
drivers/net/phy/Kconfig
All conflicts were cases of overlapping commits.
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Millercommited 2016-09-12 15:52:44 -07:00
Blagovest Kolenichev
commited 
Greg Kroah-Hartman
commited 
Florian Westphal
authored and
Greg Kroah-Hartman
commited 
Xin Long
authored and
Nikolay Aleksandrov
authored and
Kyle Yan
commited 
Linux Build Service Account
authored and
Gerrit - the friendly Code Review server
commited 
Ravinder Konka
authored and
Ido Schimmel
authored and
Eduardo Valentin
authored and
Tobias Jungel
authored and
android-build-merger
commited 
Mike Manning
authored and
Dmitry Shmidt
commited 
Ivan Vecera
authored and
Ashish Sharma
authored and
Artur Molchanov
authored and
Pan Bian
authored and
David S. Miller
commited 
Stefan Agner
authored and
Pablo Neira Ayuso
commited 
Liping Zhang
authored and
Aaron Conole
authored and
Vivien Didelot
authored and