Skip to content

3.18.55-stable review

Greg Kroah-Hartman kernel-hardening linux-metag lkml stable 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest55 of 59 patches 3 repliesIn review

55 of 59 patches are in this archive. The cover letter announces 59.

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/59USB: ene_usb6250: fix DMA to the stackdrivers/usb/storage/ene_ub6250.c+55 -350 replies
2/59watchdog: pcwd_usb: fix NULL-deref at probedrivers/watchdog/pcwd_usb.c+3 -00 replies
3/59char: lp: fix possible integer overflow in lp_setup()drivers/char/lp.c+5 -10 replies
4/59USB: core: replace %p with %pKdrivers/usb/core/devio.c drivers/usb/core/hcd.c drivers/usb/core/urb.c+5 -50 replies
5/59dm btree: fix for dm_btree_find_lowest_key()drivers/md/persistent-data/dm-btree.c+6 -20 replies
6/59dm bufio: avoid a possible ABBA deadlockdrivers/md/dm-bufio.c+5 -40 replies
7/59dm thin metadata: call precommit before saving the rootsdrivers/md/dm-thin-metadata.c+2 -20 replies
8/59dm space map disk: fix some book keeping in the disk space mapdrivers/md/persistent-data/dm-space-map-disk.c+14 -10 replies
9/59mwifiex: pcie: fix cmd_buf use-after-free in remove/resetdrivers/net/wireless/mwifiex/pcie.c+7 -00 replies
11/59regulator: tps65023: Fix inverted core enable logic.drivers/regulator/tps65023-regulator.c+1 -20 replies
12/59ath9k_htc: fix NULL-deref at probedrivers/net/wireless/ath/ath9k/hif_usb.c+3 -00 replies
13/59cdc-acm: fix possible invalid access when processing notificationdrivers/usb/class/cdc-acm.c+9 -40 replies
14/59of: fix sparse warning in of_pci_range_parser_onedrivers/of/address.c+1 -10 replies
15/59of: fdt: add missing allocation-failure checkdrivers/of/fdt.c+3 -00 replies
16/59iio: dac: ad7303: fix channel descriptiondrivers/iio/dac/ad7303.c+3 -30 replies
17/59pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processeskernel/pid_namespace.c+1 -10 replies
18/59USB: serial: ftdi_sio: fix setting latency for unprivileged usersdrivers/usb/serial/ftdi_sio.c+1 -10 replies
19/59USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDsdrivers/usb/serial/ftdi_sio.c drivers/usb/serial/ftdi_sio_ids.h+6 -40 replies
20/59usb: host: xhci-plat: propagate return value of platform_get_irq()drivers/usb/host/xhci-plat.c+1 -10 replies
21/59usb: host: xhci-mem: allocate zeroed Scratchpad Bufferdrivers/usb/host/xhci-mem.c+1 -10 replies
22/59net: irda: irda-usb: fix firmware name on big-endian hostsdrivers/net/irda/irda-usb.c+1 -10 replies
23/59usbvision: fix NULL-deref at probedrivers/media/usb/usbvision/usbvision-video.c+8 -10 replies
24/59mceusb: fix NULL-deref at probedrivers/media/rc/mceusb.c+2 -20 replies
25/59ttusb2: limit messages to buffer sizedrivers/media/usb/dvb-usb/ttusb2.c+19 -00 replies
26/59usb: musb: tusb6010_omap: Do not reset the other directions packet sizedrivers/usb/musb/tusb6010_omap.c+9 -40 replies
27/59USB: iowarrior: fix info ioctl on big-endian hostsdrivers/usb/misc/iowarrior.c+1 -10 replies
28/59usb: serial: option: add Telit ME910 supportdrivers/usb/serial/option.c+8 -00 replies
30/59USB: serial: mct_u232: fix big-endian baud-rate handlingdrivers/usb/serial/mct_u232.c+1 -10 replies
31/59USB: serial: io_ti: fix div-by-zero in set_termiosdrivers/usb/serial/io_ti.c+4 -10 replies
32/59USB: hub: fix SS hub-descriptor handlingdrivers/usb/core/hub.c+6 -20 replies
33/59USB: hub: fix non-SS hub-descriptor handlingdrivers/usb/core/hub.c+9 -40 replies
34/59tty: Prevent ldisc drivers from re-using stale tty fieldsdrivers/tty/tty_ldisc.c+7 -02 replies
36/59iio: proximity: as3935: fix as3935_writedrivers/iio/proximity/as3935.c+1 -20 replies
37/59gspca: konica: add missing endpoint sanity checkdrivers/media/usb/gspca/konica.c+3 -00 replies
38/59s5p-mfc: Fix unbalanced call to clock managementdrivers/media/platform/s5p-mfc/s5p_mfc.c+1 -00 replies
39/59dib0700: fix NULL-deref at probedrivers/media/usb/dvb-usb/dib0700_core.c+3 -00 replies
40/59zr364xx: enforce minimum size when reading headerdrivers/media/usb/zr364xx/zr364xx.c+8 -00 replies
41/59cx231xx-cards: fix NULL-deref at probedrivers/media/usb/cx231xx/cx231xx-cards.c+40 -50 replies
42/59cx231xx-audio: fix NULL-deref at probedrivers/media/usb/cx231xx/cx231xx-audio.c+13 -20 replies
43/59powerpc/pseries: Fix of_node_put() underflow during DLPAR removearch/powerpc/platforms/pseries/dlpar.c+0 -10 replies
44/59ARM: dts: at91: sama5d3_xplained: fix ADC vrefarch/arm/boot/dts/at91-sama5d3_xplained.dts+1 -00 replies
45/59ARM: dts: at91: sama5d3_xplained: not all ADC channels are availablearch/arm/boot/dts/at91-sama5d3_xplained.dts+1 -30 replies
46/59arm64: uaccess: ensure extension of access_ok() addrarch/arm64/include/asm/uaccess.h+2 -10 replies
47/59arm64: documentation: document tagged pointer stack constraintsDocumentation/arm64/tagged-pointers.txt+49 -170 replies
48/59xc2028: Fix use-after-free bug properlydrivers/media/tuners/tuner-xc2028.c+16 -210 replies
49/59mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thpmm/huge_memory.c+11 -10 replies
50/59metag/uaccess: Fix access_ok()arch/metag/include/asm/uaccess.h+24 -160 replies
51/59metag/uaccess: Check access_ok in strncpy_from_userarch/metag/include/asm/uaccess.h+7 -20 replies
52/59stackprotector: Increase the per-task stack canarys random range from 32 bits to 64 bits on 64-bit platformskernel/fork.c+1 -10 replies
53/59uwb: fix device quirk on big-endian hostsdrivers/uwb/i1480/dfu/usb.c+3 -20 replies
54/59osf_wait4(): fix infoleakarch/alpha/kernel/osf_sys.c+4 -20 replies
55/59tracing/kprobes: Enforce kprobes teardown after testinginclude/linux/kprobes.h kernel/kprobes.c kernel/trace/trace_kprobe.c+9 -20 replies
56/59PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platformsdrivers/pci/pci-sysfs.c+7 -30 replies
58/59drivers: char: mem: Check for address space wraparound with mmap()drivers/char/mem.c+5 -00 replies
59/59usb: misc: legousbtower: Fix memory leakdrivers/usb/misc/legousbtower.c+1 -00 replies

Reviews trailers per patch

14 of 55 patches have a Reviewed-by or Acked-by.

PatchAndreas HartmannGuenter RoeckOliver NeukumLars-Peter ClausenTony LindgrenGreg Kroah-HartmanPete ZaitcevAlan SternNicolas FerreDave MartinWill DeaconKirill A. ShutemovArjan van de VenRik van RielKees CookMasami Hiramatsu
1/59Reported-and-tested-by
2/59R-b
3/59
4/59
5/59
6/59
7/59
8/59
9/59
11/59
12/59
13/59A-b
14/59
15/59
16/59R-b
17/59T-b
18/59
19/59
20/59
21/59
22/59
23/59
24/59
25/59
26/59T-b
27/59
28/59
30/59R-b A-b
31/59R-b
32/59A-b
33/59A-b
34/59
36/59
37/59
38/59
39/59
40/59
41/59
42/59
43/59
44/59A-b
45/59A-b
46/59A-b
47/59R-b A-b
48/59
49/59A-b
50/59
51/59
52/59A-b A-b A-b
53/59
54/59
55/59A-b
56/59
58/59
59/59

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 16 reviewers.

Read the v1 thread

Cover letter [PATCH 3.18 00/59] 3.18.55-stable review

This is the start of the stable review cycle for the 3.18.55 release. There are 59 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Thu May 25 20:08:28 UTC 2017. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.55-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 3.18.55-rc1

Maksim Salau <[email protected]>
usb: misc: legousbtower: Fix memory leak

Julius Werner <[email protected]>
drivers: char: mem: Check for address space wraparound with mmap()

Lukas Wunner <[email protected]>
PCI: Freeze PME scan before suspending devices

David Woodhouse <[email protected]>
PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms

Thomas Gleixner <[email protected]>
tracing/kprobes: Enforce kprobes teardown after testing

Al Viro <[email protected]>
osf_wait4(): fix infoleak

Johan Hovold <[email protected]>
uwb: fix device quirk on big-endian hosts

Daniel Micay <[email protected]>
stackprotector: Increase the per-task stack canary's random range from 32 bits to 64 bits on 64-bit platforms

James Hogan <[email protected]>
metag/uaccess: Check access_ok in strncpy_from_user

James Hogan <[email protected]>
metag/uaccess: Fix access_ok()

Keno Fischer <[email protected]>
mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp

Takashi Iwai <[email protected]>
xc2028: Fix use-after-free bug properly

Kristina Martsenko <[email protected]>
arm64: documentation: document tagged pointer stack constraints

Mark Rutland <[email protected]>
arm64: uaccess: ensure extension of access_ok() addr

Ludovic Desroches <[email protected]>
ARM: dts: at91: sama5d3_xplained: not all ADC channels are available

Ludovic Desroches <[email protected]>
ARM: dts: at91: sama5d3_xplained: fix ADC vref

Tyrel Datwyler <[email protected]>
powerpc/pseries: Fix of_node_put() underflow during DLPAR remove

Johan Hovold <[email protected]>
cx231xx-audio: fix NULL-deref at probe

Johan Hovold <[email protected]>
cx231xx-cards: fix NULL-deref at probe

Alyssa Milburn <[email protected]>
zr364xx: enforce minimum size when reading header

Johan Hovold <[email protected]>
dib0700: fix NULL-deref at probe

Marek Szyprowski <[email protected]>
s5p-mfc: Fix unbalanced call to clock management

Johan Hovold <[email protected]>
gspca: konica: add missing endpoint sanity check

Matt Ranostay <[email protected]>

    iio: proximity: as3935: fix as3935_write

Dan Carpenter <[email protected]>
ipx: call ipxitf_put() in ioctl error path

Peter Hurley <[email protected]>
tty: Prevent ldisc drivers from re-using stale tty fields

Johan Hovold <[email protected]>
USB: hub: fix non-SS hub-descriptor handling

Johan Hovold <[email protected]>
USB: hub: fix SS hub-descriptor handling

Johan Hovold <[email protected]>
USB: serial: io_ti: fix div-by-zero in set_termios

Johan Hovold <[email protected]>
USB: serial: mct_u232: fix big-endian baud-rate handling

Bjørn Mork <[email protected]>
USB: serial: qcserial: add more Lenovo EM74xx device IDs

Daniele Palmas <[email protected]>
usb: serial: option: add Telit ME910 support

Johan Hovold <[email protected]>
USB: iowarrior: fix info ioctl on big-endian hosts

Peter Ujfalusi <[email protected]>
usb: musb: tusb6010_omap: Do not reset the other direction's packet size

Alyssa Milburn <[email protected]>
ttusb2: limit messages to buffer size

Johan Hovold <[email protected]>
mceusb: fix NULL-deref at probe

Johan Hovold <[email protected]>
usbvision: fix NULL-deref at probe

Johan Hovold <[email protected]>
net: irda: irda-usb: fix firmware name on big-endian hosts

Peter Chen <[email protected]>
usb: host: xhci-mem: allocate zeroed Scratchpad Buffer

Thomas Petazzoni <[email protected]>
usb: host: xhci-plat: propagate return value of platform_get_irq()

Andrey Korolyov <[email protected]>
USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs

Anthony Mallet <[email protected]>
USB: serial: ftdi_sio: fix setting latency for unprivileged users

Eric W. Biederman <[email protected]>
pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes

Pavel Roskin <[email protected]>
iio: dac: ad7303: fix channel description

Johan Hovold <[email protected]>
of: fdt: add missing allocation-failure check

Rob Herring <[email protected]>
of: fix sparse warning in of_pci_range_parser_one

Tobias Herzog <[email protected]>
cdc-acm: fix possible invalid access when processing notification

Johan Hovold <[email protected]>
ath9k_htc: fix NULL-deref at probe

Richard Cochran <[email protected]>
regulator: tps65023: Fix inverted core enable logic.

Daniel Glöckner <[email protected]>
ima: accept previously set IMA_NEW_FILE

Brian Norris <[email protected]>
mwifiex: pcie: fix cmd_buf use-after-free in remove/reset

Joe Thornber <[email protected]>
dm space map disk: fix some book keeping in the disk space map

Joe Thornber <[email protected]>
dm thin metadata: call precommit before saving the roots

Mikulas Patocka <[email protected]>
dm bufio: avoid a possible ABBA deadlock

Vinothkumar Raja <[email protected]>
dm btree: fix for dm_btree_find_lowest_key()

Vamsi Krishna Samavedam <[email protected]>
USB: core: replace %p with %pK

Willy Tarreau <[email protected]>
char: lp: fix possible integer overflow in lp_setup()

Johan Hovold <[email protected]>
watchdog: pcwd_usb: fix NULL-deref at probe

Alan Stern <[email protected]>
USB: ene_usb6250: fix DMA to the stack

-------------

Diffstat:

 Documentation/arm64/tagged-pointers.txt        | 62 +++++++++++++-----
 Makefile                                       |  4 +-
 arch/alpha/kernel/osf_sys.c                    |  6 +-
 arch/arm/boot/dts/at91-sama5d3_xplained.dts    |  5 +-
 arch/arm64/include/asm/uaccess.h               |  3 +-
 arch/metag/include/asm/uaccess.h               | 49 ++++++++------
 arch/powerpc/platforms/pseries/dlpar.c         |  1 -
 drivers/char/lp.c                              |  6 +-
 drivers/char/mem.c                             |  5 ++
 drivers/iio/dac/ad7303.c                       |  6 +-
 drivers/iio/proximity/as3935.c                 |  3 +-
 drivers/md/dm-bufio.c                          |  9 +--
 drivers/md/dm-thin-metadata.c                  |  4 +-
 drivers/md/persistent-data/dm-btree.c          |  8 ++-
 drivers/md/persistent-data/dm-space-map-disk.c | 15 ++++-
 drivers/media/platform/s5p-mfc/s5p_mfc.c       |  1 +
 drivers/media/rc/mceusb.c                      |  4 +-
 drivers/media/tuners/tuner-xc2028.c            | 37 +++++------
 drivers/media/usb/cx231xx/cx231xx-audio.c      | 15 ++++-
 drivers/media/usb/cx231xx/cx231xx-cards.c      | 45 +++++++++++--
 drivers/media/usb/dvb-usb/dib0700_core.c       |  3 +
 drivers/media/usb/dvb-usb/ttusb2.c             | 19 ++++++
 drivers/media/usb/gspca/konica.c               |  3 +
 drivers/media/usb/usbvision/usbvision-video.c  |  9 ++-
 drivers/media/usb/zr364xx/zr364xx.c            |  8 +++
 drivers/net/irda/irda-usb.c                    |  2 +-
 drivers/net/wireless/ath/ath9k/hif_usb.c       |  3 +
 drivers/net/wireless/mwifiex/pcie.c            |  7 ++
 drivers/of/address.c                           |  2 +-
 drivers/of/fdt.c                               |  3 +
 drivers/pci/pci-sysfs.c                        | 10 ++-
 drivers/pci/pci.c                              |  9 +--
 drivers/regulator/tps65023-regulator.c         |  3 +-
 drivers/tty/tty_ldisc.c                        |  7 ++
 drivers/usb/class/cdc-acm.c                    | 13 ++--
 drivers/usb/core/devio.c                       |  4 +-
 drivers/usb/core/hcd.c                         |  4 +-
 drivers/usb/core/hub.c                         | 19 ++++--
 drivers/usb/core/urb.c                         |  2 +-
 drivers/usb/host/xhci-mem.c                    |  2 +-
 drivers/usb/host/xhci-plat.c                   |  2 +-
 drivers/usb/misc/iowarrior.c                   |  2 +-
 drivers/usb/misc/legousbtower.c                |  1 +
 drivers/usb/musb/tusb6010_omap.c               | 13 ++--
 drivers/usb/serial/ftdi_sio.c                  | 10 +--
 drivers/usb/serial/ftdi_sio_ids.h              |  2 +
 drivers/usb/serial/io_ti.c                     |  5 +-
 drivers/usb/serial/mct_u232.c                  |  2 +-
 drivers/usb/serial/option.c                    |  8 +++
 drivers/usb/serial/qcserial.c                  |  2 +
 drivers/usb/storage/ene_ub6250.c               | 90 ++++++++++++++++----------
 drivers/uwb/i1480/dfu/usb.c                    |  5 +-
 drivers/watchdog/pcwd_usb.c                    |  3 +
 include/linux/kprobes.h                        |  4 +-
 kernel/fork.c                                  |  2 +-
 kernel/kprobes.c                               |  2 +-
 kernel/pid_namespace.c                         |  2 +-
 kernel/trace/trace_kprobe.c                    |  5 ++
 mm/huge_memory.c                               | 12 +++-
 net/ipx/af_ipx.c                               |  5 +-
 security/integrity/ima/ima_appraise.c          |  5 +-
 61 files changed, 428 insertions(+), 174 deletions(-)