Linux 4.9.297
Greg Kroah-Hartman
maintainerI'm announcing the release of the 4.9.297 kernel.
All users of the 4.9 kernel series must upgrade.
The updated 4.9.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 arch/arm64/include/asm/sysreg.h | 69 +++++++++++++++++++++-- arch/arm64/kernel/head.S | 49 ++++++---------- arch/arm64/mm/proc.S | 24 -------- drivers/bluetooth/btusb.c | 32 ++++++++-- drivers/isdn/mISDN/core.c | 6 +- drivers/isdn/mISDN/core.h | 4 - drivers/isdn/mISDN/layer1.c | 4 - drivers/net/ethernet/intel/i40e/i40e_main.c | 32 ++++++++-- drivers/net/ieee802154/atusb.c | 10 ++- drivers/net/usb/rndis_host.c | 5 + drivers/power/reset/ltc2952-poweroff.c | 4 - drivers/scsi/libiscsi.c | 6 +- drivers/virtio/virtio_pci_common.c | 7 ++ fs/xfs/xfs_ioctl.c | 3 - include/linux/bug.h | 72 ------------------------ include/linux/build_bug.h | 84 ++++++++++++++++++++++++++++ kernel/trace/trace.c | 6 +- net/ipv4/udp.c | 2 net/ipv6/ip6_vti.c | 2 net/mac80211/mlme.c | 2 net/phonet/pep.c | 1 net/sched/sch_qfq.c | 6 -- 23 files changed, 264 insertions(+), 168 deletions(-)
Darrick J. Wong (1):
xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
Eric Dumazet (1):
sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
Greg Kroah-Hartman (1):
Linux 4.9.297
Hangyu Hua (1):
phonet: refcount leak in pep_sock_accep
Ian Abbott (1):
bug: split BUILD_BUG stuff out into <linux/build_bug.h>
James Morse (1):
arm64: sysreg: Move to use definitions for all the SCTLR bits
Jedrzej Jagielski (1):
i40e: Fix incorrect netdev's real number of RX/TX queues
Lixiaokeng (1):
scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
Mark Rutland (2):
arm64: reduce el2_setup branching
arm64: move !VHE work to end of el2_setup
Nathan Chancellor (1):
power: reset: ltc2952: Fix use of floating point literals
Naveen N. Rao (2):
tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
tracing: Tag trace_percpu_buffer as a percpu pointer
Parav Pandit (1):
virtio_pci: Support surprise removal of virtio pci device
Pavel Skripkin (1):
ieee802154: atusb: fix uninit value in atusb_set_extended_addr
Stefan Traby (1):
arm64: Remove a redundancy in sysreg.h
Takashi Iwai (1):
Bluetooth: btusb: Apply QCA Rome patches for some ATH3012 models
Thomas Toye (1):
rndis_host: support Hytera digital radios
Tom Rix (1):
mac80211: initialize variable have_higher_than_11mbit
William Zhao (1):
ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
wolfgang huang (1):
mISDN: change function names to avoid conflicts
yangxingwu (1):
net: udp: fix alignment problem in udp4_seq_show()
Greg Kroah-Hartman
maintainerMakefile +1 -1
@@ -1,6 +1,6 @@ VERSION = 4 PATCHLEVEL = 9 -SUBLEVEL = 296 +SUBLEVEL = 297 EXTRAVERSION = NAME = Roaring Lionus
arch/arm64/include/asm/sysreg.h +65 -4
108 lines not on this page · raw message
arch/arm64/kernel/head.S +19 -30
72 lines not on this page · raw message
arch/arm64/mm/proc.S +1 -23
@@ -413,11 +413,7 @@ ENTRY(__cpu_setup) /* * Prepare SCTLR */ - adr x5, crval - ldp w5, w6, [x5] - mrs x0, sctlr_el1 - bic x0, x0, x5 // clear bits - orr x0, x0, x6 // set bits + mov_q x0, SCTLR_EL1_SET /* * Set/prepare TCR and TTBR. We use 512GB (39-bit) address range for * both user and kernel.
@@ -453,21 +449,3 @@ ENTRY(__cpu_setup) msr tcr_el1, x10 ret // return to head.S ENDPROC(__cpu_setup) - - /* - * We set the desired value explicitly, including those of the - * reserved bits. The values of bits EE & E0E were set early in - * el2_setup, which are left untouched below. - * - * n n T - * U E WT T UD US IHBS - * CE0 XWHW CZ ME TEEA S - * .... .IEE .... NEAI TE.I ..AD DEN0 ACAM - * 0011 0... 1101 ..0. ..0. 10.. .0.. .... < hardware reserved - * .... .1.. .... 01.1 11.1 ..01 0.01 1101 < software settings - */ - .type crval, #object -crval: - .word 0xfcffffff // clear - .word 0x34d5d91d // set - .popsection
drivers/bluetooth/btusb.c +25 -7
@@ -2442,11 +2442,9 @@ static const struct qca_device_info qca_devices_table[] = { { 0x00000302, 28, 4, 18 }, /* Rome 3.2 */ }; -static int btusb_qca_send_vendor_req (struct hci_dev *hdev,u8 request, +static int btusb_qca_send_vendor_req (struct usb_device *udev,u8 request,void *data,u16 size) { -struct btusb_data *btdata =hci_get_drvdata (hdev); -struct usb_device *udev = btdata->udev;int pipe, err;u8 *buf;
@@ -2461,7 +2459,7 @@ static int btusb_qca_send_vendor_req(struct hci_dev *hdev, u8 request, err =usb_control_msg (udev, pipe, request,USB_TYPE_VENDOR |USB_DIR_IN ,0 ,0 , buf, size,USB_CTRL_SET_TIMEOUT );if (err <0 ) { -BT_ERR ("%s: Failed to access otp area (%d)" , hdev->name, err); +dev_err (&udev->dev,"Failed to access otp area (%d)" , err); goto done; }
@@ -2617,20 +2615,38 @@ static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,return err; } +/* identify the ROM version and check whether patches are needed */ +static bool btusb_qca_need_patch (struct usb_device *udev) +{ +struct qca_version ver; + +if (btusb_qca_send_vendor_req (udev,QCA_GET_TARGET_VERSION , &ver, +sizeof (ver)) <0 ) +return false; +/* only low ROM versions need patches */ +return !(le32_to_cpu (ver.rom_version) & ~0xffffU ); +} +static int btusb_setup_qca (struct hci_dev *hdev) { +struct btusb_data *btdata =hci_get_drvdata (hdev); +struct usb_device *udev = btdata->udev;const struct qca_device_info *info =NULL ;struct qca_version ver;u32 ver_rom;u8 status;int i, err; - err =btusb_qca_send_vendor_req (hdev,QCA_GET_TARGET_VERSION , &ver, + err =btusb_qca_send_vendor_req (udev,QCA_GET_TARGET_VERSION , &ver,sizeof (ver));if (err <0 )return err; ver_rom =le32_to_cpu (ver.rom_version); +/* Don't care about high ROM versions */ +if (ver_rom & ~0xffffU ) +return 0 ; +for (i =0 ; i <ARRAY_SIZE (qca_devices_table); i++) {if (ver_rom == qca_devices_table[i].rom_version) info = &qca_devices_table[i];
@@ -2641,7 +2657,7 @@ static int btusb_setup_qca(struct hci_dev *hdev)return -ENODEV ; } - err =btusb_qca_send_vendor_req (hdev,QCA_CHECK_STATUS , &status, + err =btusb_qca_send_vendor_req (udev,QCA_CHECK_STATUS , &status,sizeof (status));if (err <0 )return err;
@@ -2787,7 +2803,8 @@ static int btusb_probe(struct usb_interface *intf,/* Old firmware would otherwise let ath3k driver load * patch and sysconfig files */ -if (le16_to_cpu (udev->descriptor.bcdDevice) <=0x0001 ) +if (le16_to_cpu (udev->descriptor.bcdDevice) <=0x0001 && + !btusb_qca_need_patch (udev))return -ENODEV ; }
@@ -2937,6 +2954,7 @@ static int btusb_probe(struct usb_interface *intf, }if (id->driver_info &BTUSB_ATH3012 ) { + data->setup_on_usb = btusb_setup_qca; hdev->set_bdaddr = btusb_set_bdaddr_ath3012;set_bit (HCI_QUIRK_SIMULTANEOUS_DISCOVERY , &hdev->quirks);set_bit (HCI_QUIRK_STRICT_DUPLICATE_FILTER , &hdev->quirks);
drivers/isdn/mISDN/core.c +3 -3
@@ -390,7 +390,7 @@ mISDNInit(void) err =mISDN_inittimer (&debug);if (err) goto error2; - err =l1_init (&debug); + err =Isdnl1_Init (&debug);if (err) goto error3; err =Isdnl2_Init (&debug);
@@ -404,7 +404,7 @@ mISDNInit(void) error5:Isdnl2_cleanup (); error4: -l1_cleanup (); +Isdnl1_cleanup (); error3:mISDN_timer_cleanup (); error2:
@@ -417,7 +417,7 @@ static void mISDN_cleanup(void) {misdn_sock_cleanup ();Isdnl2_cleanup (); -l1_cleanup (); +Isdnl1_cleanup ();mISDN_timer_cleanup ();class_unregister (&mISDN_class);
drivers/isdn/mISDN/core.h +2 -2
@@ -69,8 +69,8 @@ struct Bprotocol *get_Bprotocol4id(u_int);extern int mISDN_inittimer (u_int *);extern void mISDN_timer_cleanup (void ); -extern int l1_init (u_int *); -extern void l1_cleanup (void ); +extern int Isdnl1_Init (u_int *); +extern void Isdnl1_cleanup (void );extern int Isdnl2_Init (u_int *);extern void Isdnl2_cleanup (void );
drivers/isdn/mISDN/layer1.c +2 -2
@@ -407,7 +407,7 @@ create_l1(struct dchannel *dch, dchannel_l1callback *dcb) {EXPORT_SYMBOL (create_l1);int -l1_init (u_int *deb) +Isdnl1_Init (u_int *deb) { debug = deb; l1fsm_s.state_count =L1S_STATE_COUNT ;
@@ -419,7 +419,7 @@ l1_init(u_int *deb) }void -l1_cleanup (void ) +Isdnl1_cleanup (void ) {mISDN_FsmFree (&l1fsm_s); }
drivers/net/ethernet/intel/i40e/i40e_main.c +25 -7
@@ -5429,6 +5429,27 @@ int i40e_open(struct net_device *netdev)return 0 ; } +/** +* i40e_netif_set_realnum_tx_rx_queues - Update number of tx/rx queues +* @vsi: vsi structure +* +* This updates netdev's number of tx/rx queues +* +* Returns status of setting tx/rx queues +**/ +static int i40e_netif_set_realnum_tx_rx_queues (struct i40e_vsi *vsi) +{ +int ret; + + ret =netif_set_real_num_rx_queues (vsi->netdev, + vsi->num_queue_pairs); +if (ret) +return ret; + +return netif_set_real_num_tx_queues (vsi->netdev, + vsi->num_queue_pairs); +} +/** * i40e_vsi_open - * @vsi: the VSI to open
@@ -5463,13 +5484,7 @@ int i40e_vsi_open(struct i40e_vsi *vsi) goto err_setup_rx;/* Notify the stack of the actual queue counts. */ - err =netif_set_real_num_tx_queues (vsi->netdev, - vsi->num_queue_pairs); -if (err) - goto err_set_queues; - - err =netif_set_real_num_rx_queues (vsi->netdev, - vsi->num_queue_pairs); + err =i40e_netif_set_realnum_tx_rx_queues (vsi);if (err) goto err_set_queues;
@@ -9908,6 +9923,9 @@ struct i40e_vsi *i40e_vsi_setup(struct i40e_pf *pf, u8 type,case I40E_VSI_VMDQ2 :case I40E_VSI_FCOE : ret =i40e_config_netdev (vsi); +if (ret) + goto err_netdev; + ret =i40e_netif_set_realnum_tx_rx_queues (vsi);if (ret) goto err_netdev; ret =register_netdev (vsi->netdev);
drivers/net/ieee802154/atusb.c +6 -4
@@ -79,7 +79,9 @@ static int atusb_control_msg(struct atusb *atusb, unsigned int pipe, ret =usb_control_msg (usb_dev, pipe, request, requesttype, value, index, data, size, timeout); -if (ret <0 ) { +if (ret < size) { + ret = ret <0 ? ret : -ENODATA ; + atusb->err = ret; dev_err(&usb_dev->dev, "atusb_control_msg: req 0x%02x val 0x%x idx 0x%x, error %d\n",
@@ -637,9 +639,9 @@ static int atusb_get_and_show_build(struct atusb *atusb)if (!build)return -ENOMEM ; - ret =atusb_control_msg (atusb,usb_rcvctrlpipe (usb_dev,0 ), -ATUSB_BUILD ,ATUSB_REQ_FROM_DEV ,0 ,0 , - build,ATUSB_BUILD_SIZE ,1000 ); +/* We cannot call atusb_control_msg() here, since this request may read various length data */ + ret =usb_control_msg (atusb->usb_dev,usb_rcvctrlpipe (usb_dev,0 ),ATUSB_BUILD , +ATUSB_REQ_FROM_DEV ,0 ,0 , build,ATUSB_BUILD_SIZE ,1000 );if (ret >=0 ) { build[ret] =0 ;dev_info (&usb_dev->dev,"Firmware: build %s\n" , build);
drivers/net/usb/rndis_host.c +5 -0
@@ -619,6 +619,11 @@ static const struct usb_device_id products [] = {USB_DEVICE_AND_INTERFACE_INFO (0x1630 ,0x0042 , USB_CLASS_COMM, 2 /* ACM */, 0x0ff), .driver_info = (unsigned long ) &rndis_poll_status_info, +}, { +/* Hytera Communications DMR radios' "Radio to PC Network" */ +USB_VENDOR_AND_INTERFACE_INFO (0x238b , +USB_CLASS_COMM ,2 /* ACM */ ,0x0ff ), + .driver_info = (unsigned long)&rndis_info, }, {/* RNDIS is MSFT's un-official variant of CDC ACM */ USB_INTERFACE_INFO(USB_CLASS_COMM, 2 /* ACM */, 0x0ff),
drivers/power/reset/ltc2952-poweroff.c +2 -2
@@ -169,8 +169,8 @@ static void ltc2952_poweroff_kill(void)static void ltc2952_poweroff_default (struct ltc2952_poweroff *data) { - data->wde_interval =ktime_set (0 ,300L *1E6L ); - data->trigger_delay =ktime_set (2 ,500L *1E6L ); + data->wde_interval =ktime_set (0 ,300L *NSEC_PER_MSEC ); + data->trigger_delay =ktime_set (2 ,500L *NSEC_PER_MSEC );hrtimer_init (&data->timer_trigger,CLOCK_MONOTONIC ,HRTIMER_MODE_REL ); data->timer_trigger.function = ltc2952_poweroff_timer_trigger;
drivers/scsi/libiscsi.c +4 -2
@@ -2991,6 +2991,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn) {struct iscsi_conn *conn = cls_conn->dd_data;struct iscsi_session *session = conn->session; +char *tmp_persistent_address = conn->persistent_address; +char *tmp_local_ipaddr = conn->local_ipaddr;del_timer_sync (&conn->transport_timer);
@@ -3012,8 +3014,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)spin_lock_bh (&session->frwd_lock);free_pages ((unsigned long ) conn->data,get_order (ISCSI_DEF_MAX_RECV_SEG_LEN )); -kfree (conn->persistent_address); -kfree (conn->local_ipaddr);/* regular RX path uses back_lock */ spin_lock_bh (&session->back_lock); kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task,
@@ -3025,6 +3025,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)mutex_unlock (&session->eh_mutex);iscsi_destroy_conn (cls_conn); +kfree (tmp_persistent_address); +kfree (tmp_local_ipaddr); }EXPORT_SYMBOL_GPL (iscsi_conn_teardown);
drivers/virtio/virtio_pci_common.c +7 -0
@@ -547,6 +547,13 @@ static void virtio_pci_remove(struct pci_dev *pci_dev)struct virtio_pci_device *vp_dev =pci_get_drvdata (pci_dev);struct device *dev =get_device (&vp_dev->vdev.dev); +/* +* Device is marked broken on surprise removal so that virtio upper +* layers can abort any ongoing operation. +*/ +if (!pci_device_is_present (pci_dev)) +virtio_break_device (&vp_dev->vdev); +unregister_virtio_device (&vp_dev->vdev);if (vp_dev->ioaddr)
fs/xfs/xfs_ioctl.c +2 -1
@@ -712,7 +712,8 @@ xfs_ioc_space( flags |=XFS_PREALLOC_CLEAR ;if (bf->l_start >XFS_ISIZE (ip)) { error =xfs_alloc_file_space (ip,XFS_ISIZE (ip), - bf->l_start -XFS_ISIZE (ip),0 ); + bf->l_start -XFS_ISIZE (ip), +XFS_BMAPI_PREALLOC );if (error) goto out_unlock; }
include/linux/bug.h +1 -71
87 lines not on this page · raw message
include/linux/build_bug.h new file +84 -0
84 lines not on this page · raw message
kernel/trace/trace.c +3 -3
@@ -2354,7 +2354,7 @@ struct trace_buffer_struct {char buffer[4 ][TRACE_BUF_SIZE ]; }; -static struct trace_buffer_struct *trace_percpu_buffer; +static struct trace_buffer_struct __percpu *trace_percpu_buffer;/* * Thise allows for lockless recording. If we're nested too deeply, then
@@ -2364,7 +2364,7 @@ static char *get_trace_buf(void) {struct trace_buffer_struct *buffer =this_cpu_ptr (trace_percpu_buffer); -if (!buffer || buffer->nesting >=4 ) +if (!trace_percpu_buffer || buffer->nesting >=4 )return NULL ; buffer->nesting++;
@@ -2383,7 +2383,7 @@ static void put_trace_buf(void)static int alloc_percpu_trace_buffer (void ) { -struct trace_buffer_struct *buffers; +struct trace_buffer_struct __percpu *buffers; buffers = alloc_percpu(struct trace_buffer_struct);if (WARN (!buffers,"Could not allocate percpu trace_printk buffer" ))
net/ipv4/udp.c +1 -1
@@ -2435,7 +2435,7 @@ int udp4_seq_show(struct seq_file *seq, void *v) {seq_setwidth (seq,127 );if (v ==SEQ_START_TOKEN ) -seq_puts (seq," sl local_address rem_address st tx_queue " +seq_puts (seq," sl local_address rem_address st tx_queue " "rx_queue tr tm->when retrnsmt uid timeout " "inode ref pointer drops" );else {
net/ipv6/ip6_vti.c +2 -0
@@ -773,6 +773,8 @@ vti6_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)struct net *net =dev_net (dev);struct vti6_net *ip6n =net_generic (net, vti6_net_id); +memset (&p1,0 ,sizeof (p1)); +switch (cmd) {case SIOCGETTUNNEL :if (dev == ip6n->fb_tnl_dev) {
net/mac80211/mlme.c +1 -1
@@ -4450,7 +4450,7 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,if (new_sta) {u32 rates =0 , basic_rates =0 ; -bool have_higher_than_11mbit; +bool have_higher_than_11mbit = false;int min_rate =INT_MAX , min_rate_index =-1 ;struct ieee80211_chanctx_conf *chanctx_conf;const struct cfg80211_bss_ies *ies;
net/phonet/pep.c +1 -0
@@ -878,6 +878,7 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp) err =pep_accept_conn (newsk, skb);if (err) { +__sock_put (sk);sock_put (newsk); newsk =NULL ; goto drop;
net/sched/sch_qfq.c +2 -4
@@ -1439,10 +1439,8 @@ static int qfq_init_qdisc(struct Qdisc *sch, struct nlattr *opt)if (err <0 )return err; -if (qdisc_dev (sch)->tx_queue_len +1 >QFQ_MAX_AGG_CLASSES ) - max_classes =QFQ_MAX_AGG_CLASSES ; -else - max_classes =qdisc_dev (sch)->tx_queue_len +1 ; + max_classes =min_t (u64, (u64 )qdisc_dev (sch)->tx_queue_len +1 , +QFQ_MAX_AGG_CLASSES );/* max_cl_shift = floor(log_2(max_classes)) */ max_cl_shift =__fls (max_classes); q->max_agg_classes =1 <<max_cl_shift;