Linux 4.14.273
Greg Kroah-Hartman
maintainerI'm announcing the release of the 4.14.273 kernel.
All users of the 4.14 kernel series must upgrade.
The updated 4.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 arch/arm/boot/dts/rk3288.dtsi | 2 arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 6 + arch/mips/kernel/smp.c | 6 - drivers/atm/eni.c | 2 drivers/atm/firestream.c | 2 drivers/firmware/efi/apple-properties.c | 2 drivers/firmware/efi/efi.c | 2 drivers/input/tablet/aiptek.c | 10 -- drivers/net/can/rcar/rcar_canfd.c | 6 - drivers/net/ethernet/sfc/mcdi.c | 2 drivers/usb/gadget/function/rndis.c | 1 drivers/usb/gadget/udc/core.c | 3 fs/sysfs/file.c | 3 include/linux/if_arp.h | 1 lib/Kconfig | 1 net/ipv4/tcp.c | 10 +- net/packet/af_packet.c | 11 ++ net/sctp/sm_statefuns.c | 108 +++++++++++++++----------- net/wireless/nl80211.c | 3 net/xfrm/xfrm_state.c | 8 + tools/perf/util/symbol.c | 2 tools/testing/selftests/vm/userfaultfd.c | 1 23 files changed, 118 insertions(+), 76 deletions(-)
Alan Stern (1):
usb: gadget: Fix use-after-free bug by not setting udc->dev.driver
Alexander Lobakin (1):
MIPS: smp: fill in sibling and core maps earlier
Chengming Zhou (1):
kselftest/vm: fix tests build with old libc
Corentin Labbe (1):
ARM: dts: rockchip: fix a typo on rk3288 crypto-controller
Dan Carpenter (1):
usb: gadget: rndis: prevent integer overflow in rndis_set_response()
Eric Dumazet (2):
tcp: make tcp_read_sock() more robust
net/packet: fix slab-out-of-bounds access in packet_recvmsg()
Greg Kroah-Hartman (1):
Linux 4.14.273
Jakob Unterwurzacher (1):
arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity
Jia-Ju Bai (1):
atm: firestream: check the return value of ioremap() in fs_init()
Jiasheng Jiang (1):
atm: eni: Add check for dma_map_single
Julian Braha (1):
ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE
Lad Prabhakar (1):
can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready
Lucas Wei (1):
fs: sysfs_emit: Remove PAGE_SIZE alignment check
Michael Petlan (1):
perf symbols: Fix symbol size calculation condition
Nicolas Dichtel (1):
net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit()
Niels Dossche (1):
sfc: extend the locking on mcdi->seqno
Pavel Skripkin (1):
Input: aiptek - properly check endpoint type
Randy Dunlap (1):
efi: fix return value of __setup handlers
Sreeramya Soratkal (1):
nl80211: Update bss channel on channel switch for P2P_CLIENT
Xin Long (2):
sctp: fix the processing for INIT chunk
sctp: fix the processing for INIT_ACK chunk
Yan Yan (1):
xfrm: Fix xfrm migrate issues when address family changes
Greg Kroah-Hartman
maintainerMakefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 4 PATCHLEVEL = 14 -SUBLEVEL = 272 +SUBLEVEL = 273 EXTRAVERSION = NAME = Petit Gorille
arch/arm/boot/dts/rk3288.dtsi +1 -1
@@ -943,7 +943,7 @@ status = "disabled"; }; - crypto: cypto-controller@ff8a0000 { + crypto: crypto@ff8a0000 { compatible = "rockchip,rk3288-crypto"; reg = <0x0 0xff8a0000 0x0 0x4000>; interrupts = <GIC_SPI 48 IRQ_TYPE_LEVEL_HIGH>;
arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +6 -0
@@ -484,6 +484,12 @@ }; &sdhci { + /* + * Signal integrity isn't great at 200MHz but 100MHz has proven stable + * enough. + */ + max-frequency = <100000000>; + bus-width = <8>; mmc-hs400-1_8v; mmc-hs400-enhanced-strobe;
arch/mips/kernel/smp.c +3 -3
@@ -372,6 +372,9 @@ asmlinkage void start_secondary(void) cpu =smp_processor_id (); cpu_data[cpu].udelay_val = loops_per_jiffy; +set_cpu_sibling_map (cpu); +set_cpu_core_map (cpu); +cpumask_set_cpu (cpu, &cpu_coherent_mask);notify_cpu_starting (cpu);
@@ -383,9 +386,6 @@ asmlinkage void start_secondary(void)/* The CPU is running and counters synchronised, now mark it online */ set_cpu_online (cpu, true); -set_cpu_sibling_map (cpu); -set_cpu_core_map (cpu); -calculate_cpu_foreign_map ();/*
drivers/atm/eni.c +2 -0
@@ -1114,6 +1114,8 @@ DPRINTK("iovcnt = %d\n",skb_shinfo(skb)->nr_frags); } paddr =dma_map_single (&eni_dev->pci_dev->dev,skb->data,skb->len,DMA_TO_DEVICE ); +if (dma_mapping_error (&eni_dev->pci_dev->dev, paddr)) +return enq_next;ENI_PRV_PADDR (skb) = paddr;/* prepare DMA queue entries */ j =0 ;
drivers/atm/firestream.c +2 -0
@@ -1692,6 +1692,8 @@ static int fs_init(struct fs_dev *dev) dev->hw_base =pci_resource_start (pci_dev,0 ); dev->base =ioremap (dev->hw_base,0x1000 ); +if (!dev->base) +return 1 ;reset_chip (dev);
drivers/firmware/efi/apple-properties.c +1 -1
@@ -30,7 +30,7 @@ static bool dump_properties __initdata;static int __init dump_properties_enable (char *arg) { dump_properties = true; -return 0 ; +return 1 ; }__setup ("dump_apple_properties" , dump_properties_enable);
drivers/firmware/efi/efi.c +1 -1
@@ -230,7 +230,7 @@ static int __init efivar_ssdt_setup(char *str)memcpy (efivar_ssdt, str,strlen (str)); else pr_warn("efivar_ssdt: name too long: %s\n", str); -return 0 ; +return 1 ; }__setup ("efivar_ssdt=" , efivar_ssdt_setup);
drivers/input/tablet/aiptek.c +4 -6
@@ -1821,15 +1821,13 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)input_set_abs_params (inputdev,ABS_TILT_Y ,AIPTEK_TILT_MIN ,AIPTEK_TILT_MAX ,0 ,0 );input_set_abs_params (inputdev,ABS_WHEEL ,AIPTEK_WHEEL_MIN ,AIPTEK_WHEEL_MAX -1 ,0 ,0 ); -/* Verify that a device really has an endpoint */ -if (intf->cur_altsetting->desc.bNumEndpoints <1 ) { + err =usb_find_common_endpoints (intf->cur_altsetting, +NULL ,NULL , &endpoint,NULL ); +if (err) {dev_err (&intf->dev, -"interface has %d endpoints, but must have minimum 1\n" , - intf->cur_altsetting->desc.bNumEndpoints); - err = -EINVAL ; +"interface has no int in endpoints, but must have minimum 1\n" ); goto fail3; } - endpoint = &intf->cur_altsetting->endpoint[0 ].desc;/* Go set up our URB, which is called when the tablet receives * input.
drivers/net/can/rcar/rcar_canfd.c +3 -3
@@ -1602,15 +1602,15 @@ static int rcar_canfd_channel_probe(struct rcar_canfd_global *gpriv, u32 ch,netif_napi_add (ndev, &priv->napi, rcar_canfd_rx_poll,RCANFD_NAPI_WEIGHT ); +spin_lock_init (&priv->tx_lock); +devm_can_led_init (ndev); + gpriv->ch[priv->channel] = priv; err =register_candev (ndev);if (err) {dev_err (&pdev->dev,"register_candev() failed, error %d\n" , err); goto fail_candev; } -spin_lock_init (&priv->tx_lock); -devm_can_led_init (ndev); - gpriv->ch[priv->channel] = priv;dev_info (&pdev->dev,"device registered (channel %u)\n" , priv->channel);return 0 ;
drivers/net/ethernet/sfc/mcdi.c +1 -1
@@ -167,9 +167,9 @@ static void efx_mcdi_send_request(struct efx_nic *efx, unsigned cmd,/* Serialise with efx_mcdi_ev_cpl() and efx_mcdi_ev_death() */ spin_lock_bh (&mcdi->iface_lock); ++mcdi->seqno; + seqno = mcdi->seqno &SEQ_MASK ;spin_unlock_bh (&mcdi->iface_lock); - seqno = mcdi->seqno &SEQ_MASK ; xflags =0 ;if (mcdi->mode ==MCDI_MODE_EVENTS ) xflags |=MCDI_HEADER_XFLAGS_EVREQ ;
drivers/usb/gadget/function/rndis.c +1 -0
@@ -643,6 +643,7 @@ static int rndis_set_response(struct rndis_params *params, BufLength =le32_to_cpu (buf->InformationBufferLength); BufOffset =le32_to_cpu (buf->InformationBufferOffset);if ((BufLength >RNDIS_MAX_TOTAL_SIZE ) || + (BufOffset >RNDIS_MAX_TOTAL_SIZE ) || (BufOffset +8 >=RNDIS_MAX_TOTAL_SIZE ))return -EINVAL ;
drivers/usb/gadget/udc/core.c +0 -3
@@ -1284,7 +1284,6 @@ static void usb_gadget_remove_driver(struct usb_udc *udc)usb_gadget_udc_stop (udc); udc->driver =NULL ; - udc->dev.driver =NULL ; udc->gadget->dev.driver =NULL ; }
@@ -1333,7 +1332,6 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dri driver->function); udc->driver = driver; - udc->dev.driver = &driver->driver; udc->gadget->dev.driver = &driver->driver;usb_gadget_udc_set_speed (udc, driver->max_speed);
@@ -1355,7 +1353,6 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dridev_err (&udc->dev,"failed to start %s: %d\n" , udc->driver->function, ret); udc->driver =NULL ; - udc->dev.driver =NULL ; udc->gadget->dev.driver =NULL ;return ret; }
fs/sysfs/file.c +1 -2
@@ -565,8 +565,7 @@ int sysfs_emit(char *buf, const char *fmt, ...)va_list args;int len; -if (WARN (!buf ||offset_in_page (buf), -"invalid sysfs_emit: buf:%p\n" , buf)) +if (WARN (!buf,"invalid sysfs_emit: buf:%p\n" , buf))return 0 ;va_start (args, fmt);
include/linux/if_arp.h +1 -0
@@ -55,6 +55,7 @@ static inline bool dev_is_mac_header_xmit(const struct net_device *dev)case ARPHRD_VOID :case ARPHRD_NONE :case ARPHRD_RAWIP : +case ARPHRD_PIMREG :return false;default :return true;
lib/Kconfig +0 -1
@@ -16,7 +16,6 @@ config BITREVERSE config HAVE_ARCH_BITREVERSE bool default n - depends on BITREVERSE help This option enables the use of hardware bit-reversal instructions on architectures which support such operations.
net/ipv4/tcp.c +6 -4
@@ -1657,11 +1657,13 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,if (!copied) copied = used;break ; - }else if (used <= len) { - seq += used; - copied += used; - offset += used; } +if (WARN_ON_ONCE (used > len)) + used = len; + seq += used; + copied += used; + offset += used; +/* If recv_actor drops the lock (e.g. TCP splice * receive) the skb pointer might be invalid when * getting here: tcp_collapse might have deleted it
net/packet/af_packet.c +10 -1
@@ -2285,8 +2285,11 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, copy_skb =skb_get (skb); skb_head = skb->data; } -if (copy_skb) +if (copy_skb) { +memset (&PACKET_SKB_CB (copy_skb)->sa.ll,0 , +sizeof (PACKET_SKB_CB (copy_skb)->sa.ll));skb_set_owner_r (copy_skb, sk); + } } snaplen = po->rx_ring.frame_size - macoff;if ((int )snaplen <0 ) {
@@ -3442,6 +3445,8 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,sock_recv_ts_and_drops (msg, sk, skb);if (msg->msg_name) { +const size_t max_len =min (sizeof (skb->cb), +sizeof (struct sockaddr_storage ));int copy_len;/* If the address length field is there to be filled
@@ -3464,6 +3469,10 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, msg->msg_namelen =sizeof (struct sockaddr_ll ); } } +if (WARN_ON_ONCE (copy_len > max_len)) { + copy_len = max_len; + msg->msg_namelen = copy_len; + }memcpy (msg->msg_name, &PACKET_SKB_CB (skb)->sa, copy_len); }
net/sctp/sm_statefuns.c +65 -43
204 lines not on this page · raw message
net/wireless/nl80211.c +2 -1
@@ -14777,7 +14777,8 @@ void cfg80211_ch_switch_notify(struct net_device *dev, wdev->chandef = *chandef; wdev->preset_chandef = *chandef; -if (wdev->iftype ==NL80211_IFTYPE_STATION && +if ((wdev->iftype ==NL80211_IFTYPE_STATION || + wdev->iftype ==NL80211_IFTYPE_P2P_CLIENT ) && !WARN_ON (!wdev->current_bss)) wdev->current_bss->pub.channel = chandef->chan;
net/xfrm/xfrm_state.c +5 -3
@@ -1421,9 +1421,6 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig,memcpy (&x->mark, &orig->mark,sizeof (x->mark)); -if (xfrm_init_state (x) <0 ) - goto error; - x->props.flags = orig->props.flags; x->props.extra_flags = orig->props.extra_flags;
@@ -1501,6 +1498,11 @@ struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,if (!xc)return NULL ; + xc->props.family = m->new_family; + +if (xfrm_init_state (xc) <0 ) + goto error; +memcpy (&xc->id.daddr, &m->new_daddr,sizeof (xc->id.daddr));memcpy (&xc->props.saddr, &m->new_saddr,sizeof (xc->props.saddr));
tools/perf/util/symbol.c +1 -1
@@ -224,7 +224,7 @@ void symbols__fixup_end(struct rb_root *symbols) prev = curr; curr = rb_entry(nd, struct symbol, rb_node); -if (prev->end == prev->start && prev->end != curr->start) +if (prev->end == prev->start || prev->end != curr->start)arch__symbols__fixup_end (prev, curr); }
tools/testing/selftests/vm/userfaultfd.c +1 -0
@@ -60,6 +60,7 @@#include <signal.h> #include <poll.h> #include <string.h> +#include <linux/mman.h> #include <sys/mman.h> #include <sys/syscall.h> #include <sys/ioctl.h>