Linux 4.14.288
Greg Kroah-Hartman
maintainerI'm announcing the release of the 4.14.288 kernel.
All users of the 4.14 kernel series must upgrade.
The updated 4.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +- arch/powerpc/platforms/powernv/rng.c | 16 ++++++++++------ drivers/dma/at_xdmac.c | 5 +++++ drivers/dma/ti-dma-crossbar.c | 5 +++++ drivers/i2c/busses/i2c-cadence.c | 1 + drivers/iommu/dmar.c | 2 +- drivers/net/can/grcan.c | 1 - drivers/net/can/usb/gs_usb.c | 23 +++++++++++++++++++++-- drivers/net/usb/usbnet.c | 17 ++++++++++++----- drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c | 10 +++++----- drivers/video/fbdev/core/fbcon.c | 5 +++++ fs/xfs/xfs_inode.c | 1 - include/net/esp.h | 2 -- include/video/of_display_timing.h | 2 ++ lib/idr.c | 4 +++- mm/slub.c | 4 ++-- net/ipv4/esp4.c | 5 ++--- net/ipv6/esp6.c | 5 ++--- net/rose/rose_route.c | 4 ++-- 19 files changed, 79 insertions(+), 35 deletions(-)
Duoming Zhou (1):
net: rose: fix UAF bug caused by rose_t0timer_expiry
Eric Sandeen (1):
xfs: remove incorrect ASSERT in xfs_rename
Greg Kroah-Hartman (1):
Linux 4.14.288
Helge Deller (1):
fbcon: Disallow setting font bigger than screen size
Hsin-Yi Wang (1):
video: of_display_timing.h: include errno.h
Jann Horn (1):
mm/slub: add missing TID updates on slab deactivation
Jason A. Donenfeld (1):
powerpc/powernv: delay rng platform device creation until later in boot
Liang He (1):
can: grcan: grcan_probe(): remove extra of_node_get()
Linus Torvalds (1):
ida: don't use BUG_ON() for debugging
Miaoqian Lin (2):
dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate
dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate
Michael Walle (1):
dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly
Oliver Neukum (1):
usbnet: fix memory leak in error case
Rhett Aultman (1):
can: gs_usb: gs_usb_open/close(): fix memory leak
Sabrina Dubroca (1):
esp: limit skb_page_frag_refill use to a single page
Samuel Holland (1):
pinctrl: sunxi: a83t: Fix NAND function name for some pins
Satish Nagireddy (1):
i2c: cadence: Unregister the clk notifier in error path
Yian Chen (1):
iommu/vt-d: Fix PCI bus rescan device hot add
Greg Kroah-Hartman
maintainerMakefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 4 PATCHLEVEL = 14 -SUBLEVEL = 287 +SUBLEVEL = 288 EXTRAVERSION = NAME = Petit Gorille
arch/powerpc/platforms/powernv/rng.c +10 -6
@@ -176,12 +176,8 @@ static int __init pnv_get_random_long_early(unsigned long *v) NULL) != pnv_get_random_long_early)return 0 ; -for_each_compatible_node (dn,NULL ,"ibm,power-rng" ) { -if (rng_create (dn)) -continue ; -/* Create devices for hwrng driver */ -of_platform_device_create (dn,NULL ,NULL ); - } +for_each_compatible_node (dn,NULL ,"ibm,power-rng" ) +rng_create (dn);if (!ppc_md.get_random_seed)return 0 ;
@@ -205,10 +201,18 @@ void __init pnv_rng_init(void)static int __init pnv_rng_late_init (void ) { +struct device_node *dn;unsigned long v; +/* In case it wasn't called during init for some other reason. */ if (ppc_md.get_random_seed == pnv_get_random_long_early)pnv_get_random_long_early (&v); + +if (ppc_md.get_random_seed == powernv_get_random_long) { +for_each_compatible_node (dn,NULL ,"ibm,power-rng" ) +of_platform_device_create (dn,NULL ,NULL ); + } +return 0 ; }machine_subsys_initcall (powernv, pnv_rng_late_init);
drivers/dma/at_xdmac.c +5 -0
@@ -1804,6 +1804,11 @@ static int at_xdmac_alloc_chan_resources(struct dma_chan *chan)for (i =0 ; i < init_nr_desc_per_channel; i++) { desc =at_xdmac_alloc_desc (chan,GFP_ATOMIC );if (!desc) { +if (i ==0 ) { +dev_warn (chan2dev (chan), +"can't allocate any descriptors\n" ); +return -EIO ; + }dev_warn (chan2dev (chan),"only %d descriptors have been allocated\n" , i);break ;
drivers/dma/ti-dma-crossbar.c +5 -0
@@ -251,6 +251,7 @@ static void *ti_dra7_xbar_route_allocate(struct of_phandle_args *dma_spec,if (dma_spec->args[0 ] >= xbar->xbar_requests) {dev_err (&pdev->dev,"Invalid XBAR request number: %d\n" , dma_spec->args[0 ]); +put_device (&pdev->dev);return ERR_PTR (-EINVAL ); }
@@ -258,12 +259,14 @@ static void *ti_dra7_xbar_route_allocate(struct of_phandle_args *dma_spec, dma_spec->np =of_parse_phandle (ofdma->of_node,"dma-masters" ,0 );if (!dma_spec->np) {dev_err (&pdev->dev,"Can't get DMA master\n" ); +put_device (&pdev->dev);return ERR_PTR (-EINVAL ); } map =kzalloc (sizeof (*map),GFP_KERNEL );if (!map) {of_node_put (dma_spec->np); +put_device (&pdev->dev);return ERR_PTR (-ENOMEM ); }
@@ -274,6 +277,8 @@ static void *ti_dra7_xbar_route_allocate(struct of_phandle_args *dma_spec,mutex_unlock (&xbar->mutex);dev_err (&pdev->dev,"Run out of free DMA requests\n" );kfree (map); +of_node_put (dma_spec->np); +put_device (&pdev->dev);return ERR_PTR (-ENOMEM ); }set_bit (map->xbar_out, xbar->dma_inuse);
drivers/i2c/busses/i2c-cadence.c +1 -0
@@ -990,6 +990,7 @@ static int cdns_i2c_probe(struct platform_device *pdev)return 0 ; err_clk_dis: +clk_notifier_unregister (id->clk, &id->clk_rate_change_nb);clk_disable_unprepare (id->clk);pm_runtime_set_suspended (&pdev->dev);pm_runtime_disable (&pdev->dev);
drivers/iommu/dmar.c +1 -1
@@ -374,7 +374,7 @@ static int dmar_pci_bus_notifier(struct notifier_block *nb,static struct notifier_block dmar_pci_bus_nb = { .notifier_call = dmar_pci_bus_notifier, - .priority =INT_MIN , + .priority =1 , }; static struct dmar_drhd_unit *
drivers/net/can/grcan.c +0 -1
@@ -1669,7 +1669,6 @@ static int grcan_probe(struct platform_device *ofdev)*/ sysid_parent =of_find_node_by_path ("/ambapp0" );if (sysid_parent) { -of_node_get (sysid_parent); err =of_property_read_u32 (sysid_parent,"systemid" , &sysid);if (!err && ((sysid &GRLIB_VERSION_MASK ) >=GRCAN_TXBUG_SAFE_GRLIB_VERSION ))
drivers/net/can/usb/gs_usb.c +21 -2
@@ -192,6 +192,8 @@ struct gs_can {struct usb_anchor tx_submitted;atomic_t active_tx_urbs; +void *rxbuf[GS_MAX_RX_URBS ]; +dma_addr_t rxbuf_dma[GS_MAX_RX_URBS ]; };/* usb interface struct */
@@ -600,6 +602,7 @@ static int gs_can_open(struct net_device *netdev)for (i =0 ; i <GS_MAX_RX_URBS ; i++) {struct urb *urb;u8 *buf; +dma_addr_t buf_dma;/* alloc rx urb */ urb =usb_alloc_urb (0 ,GFP_KERNEL );
@@ -610,7 +613,7 @@ static int gs_can_open(struct net_device *netdev) buf =usb_alloc_coherent (dev->udev,sizeof (struct gs_host_frame ),GFP_KERNEL , - &urb->transfer_dma); + &buf_dma);if (!buf) {netdev_err (netdev,"No memory left for USB buffer\n" );
@@ -618,6 +621,8 @@ static int gs_can_open(struct net_device *netdev)return -ENOMEM ; } + urb->transfer_dma = buf_dma; +/* fill, anchor, and submit rx urb */ usb_fill_bulk_urb(urb, dev->udev,
@@ -641,10 +646,17 @@ static int gs_can_open(struct net_device *netdev) rc);usb_unanchor_urb (urb); +usb_free_coherent (dev->udev, +sizeof (struct gs_host_frame ), + buf, + buf_dma);usb_free_urb (urb);break ; } + dev->rxbuf[i] = buf; + dev->rxbuf_dma[i] = buf_dma; +/* Drop reference, * USB core will take care of freeing it */
@@ -709,13 +721,20 @@ static int gs_can_close(struct net_device *netdev)int rc;struct gs_can *dev =netdev_priv (netdev);struct gs_usb *parent = dev->parent; +unsigned int i;netif_stop_queue (netdev);/* Stop polling */ parent->active_channels--; -if (!parent->active_channels) +if (!parent->active_channels) {usb_kill_anchored_urbs (&parent->rx_submitted); +for (i =0 ; i <GS_MAX_RX_URBS ; i++) +usb_free_coherent (dev->udev, +sizeof (struct gs_host_frame ), + dev->rxbuf[i], + dev->rxbuf_dma[i]); + }/* Stop sending URBs */ usb_kill_anchored_urbs (&dev->tx_submitted);
drivers/net/usb/usbnet.c +12 -5
@@ -2135,7 +2135,7 @@ static void usbnet_async_cmd_cb(struct urb *urb)int usbnet_write_cmd_async (struct usbnet *dev,u8 cmd,u8 reqtype,u16 value,u16 index,const void *data,u16 size) { -struct usb_ctrlrequest *req =NULL ; +struct usb_ctrlrequest *req;struct urb *urb;int err = -ENOMEM ;void *buf =NULL ;
@@ -2153,7 +2153,7 @@ int usbnet_write_cmd_async(struct usbnet *dev, u8 cmd, u8 reqtype,if (!buf) {netdev_err (dev->net,"Error allocating buffer" " in %s!\n" , __func__); - goto fail_free; + goto fail_free_urb; } }
@@ -2177,14 +2177,21 @@ int usbnet_write_cmd_async(struct usbnet *dev, u8 cmd, u8 reqtype,if (err <0 ) {netdev_err (dev->net,"Error submitting the control" " message: status=%d\n" , err); - goto fail_free; + goto fail_free_all; }return 0 ; +fail_free_all: +kfree (req); fail_free_buf:kfree (buf); -fail_free: -kfree (req); +/* +* avoid a double free +* needed because the flag can be set only +* after filling the URB +*/ + urb->transfer_flags =0 ; +fail_free_urb:usb_free_urb (urb); fail:return err;
drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c +5 -5
@@ -158,26 +158,26 @@ static const struct sunxi_desc_pin sun8i_a83t_pins[] = {SUNXI_PIN (SUNXI_PINCTRL_PIN (C ,14 ),SUNXI_FUNCTION (0x0 ,"gpio_in" ),SUNXI_FUNCTION (0x1 ,"gpio_out" ), -SUNXI_FUNCTION (0x2 ,"nand" ),/* DQ6 */ +SUNXI_FUNCTION (0x2 ,"nand0" ),/* DQ6 */ SUNXI_FUNCTION (0x3 ,"mmc2" )),/* D6 */ SUNXI_PIN (SUNXI_PINCTRL_PIN (C ,15 ),SUNXI_FUNCTION (0x0 ,"gpio_in" ),SUNXI_FUNCTION (0x1 ,"gpio_out" ), -SUNXI_FUNCTION (0x2 ,"nand" ),/* DQ7 */ +SUNXI_FUNCTION (0x2 ,"nand0" ),/* DQ7 */ SUNXI_FUNCTION (0x3 ,"mmc2" )),/* D7 */ SUNXI_PIN (SUNXI_PINCTRL_PIN (C ,16 ),SUNXI_FUNCTION (0x0 ,"gpio_in" ),SUNXI_FUNCTION (0x1 ,"gpio_out" ), -SUNXI_FUNCTION (0x2 ,"nand" ),/* DQS */ +SUNXI_FUNCTION (0x2 ,"nand0" ),/* DQS */ SUNXI_FUNCTION (0x3 ,"mmc2" )),/* RST */ SUNXI_PIN (SUNXI_PINCTRL_PIN (C ,17 ),SUNXI_FUNCTION (0x0 ,"gpio_in" ),SUNXI_FUNCTION (0x1 ,"gpio_out" ), -SUNXI_FUNCTION (0x2 ,"nand" )),/* CE2 */ +SUNXI_FUNCTION (0x2 ,"nand0" )),/* CE2 */ SUNXI_PIN (SUNXI_PINCTRL_PIN (C ,18 ),SUNXI_FUNCTION (0x0 ,"gpio_in" ),SUNXI_FUNCTION (0x1 ,"gpio_out" ), -SUNXI_FUNCTION (0x2 ,"nand" )),/* CE3 */ +SUNXI_FUNCTION (0x2 ,"nand0" )),/* CE3 */ /* Hole */ SUNXI_PIN(SUNXI_PINCTRL_PIN(D, 2), SUNXI_FUNCTION(0x0, "gpio_in"),
drivers/video/fbdev/core/fbcon.c +5 -0
@@ -2445,6 +2445,11 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigneif (charcount !=256 && charcount !=512 )return -EINVAL ; +/* font bigger than screen resolution ? */ +if (w >FBCON_SWAP (info->var.rotate, info->var.xres, info->var.yres) || + h >FBCON_SWAP (info->var.rotate, info->var.yres, info->var.xres)) +return -EINVAL ; +/* Make sure drawing engine can handle the font */ if (!(info->pixmap.blit_x & (1 << (font->width -1 ))) || !(info->pixmap.blit_y & (1 << (font->height -1 ))))
fs/xfs/xfs_inode.c +0 -1
@@ -2964,7 +2964,6 @@ xfs_rename(* appropriately. */ if (flags &RENAME_WHITEOUT ) { -ASSERT (!(flags & (RENAME_NOREPLACE |RENAME_EXCHANGE ))); error =xfs_rename_alloc_whiteout (target_dp, &wip);if (error)return error;
include/net/esp.h +0 -2
@@ -4,8 +4,6 @@#include <linux/skbuff.h> -#define ESP_SKB_FRAG_MAXSIZE (PAGE_SIZE << SKB_FRAG_PAGE_ORDER) -struct ip_esp_hdr ;static inline struct ip_esp_hdr *ip_esp_hdr (const struct sk_buff *skb)
include/video/of_display_timing.h +2 -0
@@ -9,6 +9,8 @@#ifndef __LINUX_OF_DISPLAY_TIMING_H#define __LINUX_OF_DISPLAY_TIMING_H +#include <linux/errno.h> +struct device_node ;struct display_timing ;struct display_timings ;
lib/idr.c +3 -1
@@ -498,7 +498,9 @@ void ida_simple_remove(struct ida *ida, unsigned int id) {unsigned long flags; -BUG_ON ((int )id <0 ); +if ((int )id <0 ) +return ; +spin_lock_irqsave (&simple_ida_lock, flags);ida_remove (ida, id);spin_unlock_irqrestore (&simple_ida_lock, flags);
mm/slub.c +2 -2
@@ -2171,6 +2171,7 @@ static void deactivate_slab(struct kmem_cache *s, struct page *page, c->page =NULL ; c->freelist =NULL ; + c->tid =next_tid (c->tid); }/*
@@ -2306,8 +2307,6 @@ static inline void flush_slab(struct kmem_cache *s, struct kmem_cache_cpu *c) {stat (s,CPUSLAB_FLUSH );deactivate_slab (s, c->page, c->freelist, c); - - c->tid =next_tid (c->tid); }/*
@@ -2592,6 +2591,7 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,if (!freelist) { c->page =NULL ; + c->tid =next_tid (c->tid);stat (s,DEACTIVATE_BYPASS ); goto new_slab; }
net/ipv4/esp4.c +2 -3
@@ -257,7 +257,6 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *struct page *page;struct sk_buff *trailer;int tailen = esp->tailen; -unsigned int allocsz;/* this is non-NULL only with UDP Encapsulation */ if (x->encap) {
@@ -267,8 +266,8 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *return err; } - allocsz =ALIGN (skb->data_len + tailen,L1_CACHE_BYTES ); -if (allocsz >ESP_SKB_FRAG_MAXSIZE ) +if (ALIGN (tailen,L1_CACHE_BYTES ) >PAGE_SIZE || +ALIGN (skb->data_len,L1_CACHE_BYTES ) >PAGE_SIZE ) goto cow;if (!skb_cloned (skb)) {
net/ipv6/esp6.c +2 -3
@@ -223,10 +223,9 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_infostruct page *page;struct sk_buff *trailer;int tailen = esp->tailen; -unsigned int allocsz; - allocsz =ALIGN (skb->data_len + tailen,L1_CACHE_BYTES ); -if (allocsz >ESP_SKB_FRAG_MAXSIZE ) +if (ALIGN (tailen,L1_CACHE_BYTES ) >PAGE_SIZE || +ALIGN (skb->data_len,L1_CACHE_BYTES ) >PAGE_SIZE ) goto cow;if (!skb_cloned (skb)) {
net/rose/rose_route.c +2 -2
@@ -230,8 +230,8 @@ static void rose_remove_neigh(struct rose_neigh *rose_neigh) {struct rose_neigh *s; -rose_stop_ftimer (rose_neigh); -rose_stop_t0timer (rose_neigh); +del_timer_sync (&rose_neigh->ftimer); +del_timer_sync (&rose_neigh->t0timer);skb_queue_purge (&rose_neigh->queue);