3892 Commits

Author	SHA1	Message	Date
Greg Kroah-Hartman	8ca5759502	This is the 4.19.73 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl1/KiEACgkQONu9yGCS aT49JBAAy7b3wv1WXAtg9wsyS1JL4HbMXt3YjtokIX+UpkznoqII4B85QftPBbiD 9zDuTWPjhrqKv1GsMkFRCqBVp5wGVik1MIbjVuKdstFN5W8KQybpbYnSW4T52+wS cs6oOPkLydAfWzKeq+ekEeU8yr5dua+Ui3huundZ49wseJWQP3fh9T+ToUx8V/cr tsLiRRgI0djj7KQWVuM1j8YGKT/6qk/UL0HMVZyoIdLmsxpLap+LWe0+CRXn8rvs eJJlVQTVtYf/ySoHkpnwR12VsjRYjx6pNkm/GrebMCkM7wF/4RMqxk7j9EU0PENH VUdRrUd+j/YPp6QzjSFMK0+0eb7Gm3X0FEN0IGZshu1r/CDnoj/7hqnBmOlYIbhv pdteYaLqWq7JjAHu7vF+S4aNQRGpAZb05LsbTJ39Eu3FbdVTLXsAuUveZ7Y4/y0X ri2M3d/sF/cjc3C+V7Y7h422SM36jSAK6496VAoRyqqjX/3JyROhgfU9NAMzVr83 4uI904z9lH4TZGOd5YQgX2VuOtBcGwa7+g6fy97u1tp8UxSWFZRGDDLRysF/dIJO Wi51UK0Q7EWnqBTe0TFF6TjE5tC7R3ZgzqEQ1MU4eLI5mqokg82DAK4Ub2Wk5Qch CGs5/d16OOrLtG2RoaOGz9UdQR7IHUXLSqkKbaEdstc16MXNXns= =cmGh -----END PGP SIGNATURE----- Merge 4.19.73 into android-4.19 Changes in 4.19.73 ALSA: hda - Fix potential endless loop at applying quirks ALSA: hda/realtek - Fix overridden device-specific initialization ALSA: hda/realtek - Add quirk for HP Pavilion 15 ALSA: hda/realtek - Enable internal speaker & headset mic of ASUS UX431FL ALSA: hda/realtek - Fix the problem of two front mics on a ThinkCentre sched/fair: Don't assign runtime for throttled cfs_rq drm/vmwgfx: Fix double free in vmw_recv_msg() vhost/test: fix build for vhost test vhost/test: fix build for vhost test - again powerpc/tm: Fix FP/VMX unavailable exceptions inside a transaction batman-adv: fix uninit-value in batadv_netlink_get_ifindex() batman-adv: Only read OGM tvlv_len after buffer len check hv_sock: Fix hang when a connection is closed Blk-iolatency: warn on negative inflight IO counter blk-iolatency: fix STS_AGAIN handling {nl,mac}80211: fix interface combinations on crypto controlled devices timekeeping: Use proper ktime_add when adding nsecs in coarse offset selftests: fib_rule_tests: use pre-defined DEV_ADDR x86/ftrace: Fix warning and considate ftrace_jmp_replace() and ftrace_call_replace() powerpc/64: mark start_here_multiplatform as __ref media: stm32-dcmi: fix irq = 0 case arm64: dts: rockchip: enable usb-host regulators at boot on rk3328-rock64 scripts/decode_stacktrace: match basepath using shell prefix operator, not regex riscv: remove unused variable in ftrace nvme-fc: use separate work queue to avoid warning clk: s2mps11: Add used attribute to s2mps11_dt_match remoteproc: qcom: q6v5: shore up resource probe handling modules: always page-align module section allocations kernel/module: Fix mem leak in module_add_modinfo_attrs drm/i915: Re-apply "Perform link quality check, unconditionally during long pulse" media: cec/v4l2: move V4L2 specific CEC functions to V4L2 media: cec: remove cec-edid.c scsi: qla2xxx: Move log messages before issuing command to firmware keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h Drivers: hv: kvp: Fix two "this statement may fall through" warnings x86, hibernate: Fix nosave_regions setup for hibernation remoteproc: qcom: q6v5-mss: add SCM probe dependency drm/amdgpu/gfx9: Update gfx9 golden settings. drm/amdgpu: Update gc_9_0 golden settings. KVM: x86: hyperv: enforce vp_index < KVM_MAX_VCPUS KVM: x86: hyperv: consistently use 'hv_vcpu' for 'struct kvm_vcpu_hv' variables KVM: x86: hyperv: keep track of mismatched VP indexes KVM: hyperv: define VP assist page helpers x86/kvm/lapic: preserve gfn_to_hva_cache len on cache reinit drm/i915: Fix intel_dp_mst_best_encoder() drm/i915: Rename PLANE_CTL_DECOMPRESSION_ENABLE drm/i915/gen9+: Fix initial readout for Y tiled framebuffers drm/atomic_helper: Disallow new modesets on unregistered connectors Drivers: hv: kvp: Fix the indentation of some "break" statements Drivers: hv: kvp: Fix the recent regression caused by incorrect clean-up powerplay: Respect units on max dcfclk watermark drm/amd/pp: Fix truncated clock value when set watermark drm/amd/dm: Understand why attaching path/tile properties are needed ARM: davinci: da8xx: define gpio interrupts as separate resources ARM: davinci: dm365: define gpio interrupts as separate resources ARM: davinci: dm646x: define gpio interrupts as separate resources ARM: davinci: dm355: define gpio interrupts as separate resources ARM: davinci: dm644x: define gpio interrupts as separate resources s390/zcrypt: reinit ap queue state machine during device probe media: vim2m: use workqueue media: vim2m: use cancel_delayed_work_sync instead of flush_schedule_work drm/i915: Restore sane defaults for KMS on GEM error load drm/i915: Cleanup gt powerstate from gem KVM: PPC: Book3S HV: Fix race between kvm_unmap_hva_range and MMU mode switch Btrfs: clean up scrub is_dev_replace parameter Btrfs: fix deadlock with memory reclaim during scrub btrfs: Remove extent_io_ops::fill_delalloc btrfs: Fix error handling in btrfs_cleanup_ordered_extents scsi: megaraid_sas: Fix combined reply queue mode detection scsi: megaraid_sas: Add check for reset adapter bit scsi: megaraid_sas: Use 63-bit DMA addressing powerpc/pkeys: Fix handling of pkey state across fork() btrfs: volumes: Make sure no dev extent is beyond device boundary btrfs: Use real device structure to verify dev extent media: vim2m: only cancel work if it is for right context ARC: show_regs: lockdep: re-enable preemption ARC: mm: do_page_fault fixes #1: relinquish mmap_sem if signal arrives while handle_mm_fault IB/uverbs: Fix OOPs upon device disassociation crypto: ccree - fix resume race condition on init crypto: ccree - add missing inline qualifier drm/vblank: Allow dynamic per-crtc max_vblank_count drm/i915/ilk: Fix warning when reading emon_status with no output mfd: Kconfig: Fix I2C_DESIGNWARE_PLATFORM dependencies tpm: Fix some name collisions with drivers/char/tpm.h bcache: replace hard coded number with BUCKET_GC_GEN_MAX bcache: treat stale && dirty keys as bad keys KVM: VMX: Compare only a single byte for VMCS' "launched" in vCPU-run iio: adc: exynos-adc: Add S5PV210 variant dt-bindings: iio: adc: exynos-adc: Add S5PV210 variant iio: adc: exynos-adc: Use proper number of channels for Exynos4x12 mt76: fix corrupted software generated tx CCMP PN drm/nouveau: Don't WARN_ON VCPI allocation failures iwlwifi: fix devices with PCI Device ID 0x34F0 and 11ac RF modules iwlwifi: add new card for 9260 series x86/kvmclock: set offset for kvm unstable clock spi: spi-gpio: fix SPI_CS_HIGH capability powerpc/kvm: Save and restore host AMR/IAMR/UAMOR mmc: renesas_sdhi: Fix card initialization failure in high speed mode btrfs: scrub: pass fs_info to scrub_setup_ctx btrfs: scrub: move scrub_setup_ctx allocation out of device_list_mutex btrfs: scrub: fix circular locking dependency warning btrfs: init csum_list before possible free PCI: qcom: Fix error handling in runtime PM support PCI: qcom: Don't deassert reset GPIO during probe drm: add __user attribute to ptr_to_compat() CIFS: Fix error paths in writeback code CIFS: Fix leaking locked VFS cache pages in writeback retry drm/i915: Handle vm_mmap error during I915_GEM_MMAP ioctl with WC set drm/i915: Sanity check mmap length against object size usb: typec: tcpm: Try PD-2.0 if sink does not respond to 3.0 source-caps arm64: dts: stratix10: add the sysmgr-syscon property from the gmac's IB/mlx5: Reset access mask when looping inside page fault handler kvm: mmu: Fix overflow on kvm mmu page limit calculation x86/kvm: move kvm_load/put_guest_xcr0 into atomic context KVM: x86: Always use 32-bit SMRAM save state for 32-bit kernels cifs: Fix lease buffer length error media: i2c: tda1997x: select V4L2_FWNODE ext4: protect journal inode's blocks using block_validity ARM: dts: qcom: ipq4019: fix PCI range ARM: dts: qcom: ipq4019: Fix MSI IRQ type ARM: dts: qcom: ipq4019: enlarge PCIe BAR range dt-bindings: mmc: Add supports-cqe property dt-bindings: mmc: Add disable-cqe-dcmd property. PCI: Add macro for Switchtec quirk declarations PCI: Reset Lenovo ThinkPad P50 nvgpu at boot if necessary dm mpath: fix missing call of path selector type->end_io blk-mq: free hw queue's resource in hctx's release handler mmc: sdhci-pci: Add support for Intel CML PCI: dwc: Use devm_pci_alloc_host_bridge() to simplify code cifs: smbd: take an array of reqeusts when sending upper layer data dm crypt: move detailed message into debug level signal/arc: Use force_sig_fault where appropriate ARC: mm: fix uninitialised signal code in do_page_fault ARC: mm: SIGSEGV userspace trying to access kernel virtual memory drm/amdkfd: Add missing Polaris10 ID kvm: Check irqchip mode before assign irqfd drm/amdgpu: fix ring test failure issue during s3 in vce 3.0 (V2) drm/amdgpu/{uvd,vcn}: fetch ring's read_ptr after alloc Btrfs: fix race between block group removal and block group allocation cifs: add spinlock for the openFileList to cifsInodeInfo clk: tegra: Fix maximum audio sync clock for Tegra124/210 clk: tegra210: Fix default rates for HDA clocks IB/hfi1: Avoid hardlockup with flushlist_lock apparmor: reset pos on failure to unpack for various functions scsi: target/core: Use the SECTOR_SHIFT constant scsi: target/iblock: Fix overrun in WRITE SAME emulation staging: wilc1000: fix error path cleanup in wilc_wlan_initialize() scsi: zfcp: fix request object use-after-free in send path causing wrong traces cifs: Properly handle auto disabling of serverino option ALSA: hda - Don't resume forcibly i915 HDMI/DP codec ceph: use ceph_evict_inode to cleanup inode's resource KVM: x86: optimize check for valid PAT value KVM: VMX: Always signal #GP on WRMSR to MSR_IA32_CR_PAT with bad value KVM: VMX: Fix handling of #MC that occurs during VM-Entry KVM: VMX: check CPUID before allowing read/write of IA32_XSS KVM: PPC: Use ccr field in pt_regs struct embedded in vcpu struct KVM: PPC: Book3S HV: Fix CR0 setting in TM emulation ARM: dts: gemini: Set DIR-685 SPI CS as active low RDMA/srp: Document srp_parse_in() arguments RDMA/srp: Accept again source addresses that do not have a port number btrfs: correctly validate compression type resource: Include resource end in walk_*() interfaces resource: Fix find_next_iomem_res() iteration issue resource: fix locking in find_next_iomem_res() pstore: Fix double-free in pstore_mkfile() failure path dm thin metadata: check if in fail_io mode when setting needs_check drm/panel: Add support for Armadeus ST0700 Adapt ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips powerpc/mm: Limit rma_size to 1TB when running without HV mode iommu/iova: Remove stale cached32_node gpio: don't WARN() on NULL descs if gpiolib is disabled i2c: at91: disable TXRDY interrupt after sending data i2c: at91: fix clk_offset for sama5d2 mm/migrate.c: initialize pud_entry in migrate_vma() iio: adc: gyroadc: fix uninitialized return code NFSv4: Fix delegation state recovery bcache: only clear BTREE_NODE_dirty bit when it is set bcache: add comments for mutex_lock(&b->write_lock) bcache: fix race in btree_flush_write() drm/i915: Make sure cdclk is high enough for DP audio on VLV/CHV virtio/s390: fix race on airq_areas[] drm/atomic_helper: Allow DPMS On<->Off changes for unregistered connectors ext4: don't perform block validity checks on the journal inode ext4: fix block validity checks for journal inodes using indirect blocks ext4: unsigned int compared against zero PCI: Reset both NVIDIA GPU and HDA in ThinkPad P50 workaround powerpc/tm: Remove msr_tm_active() powerpc/tm: Fix restoring FP/VMX facility incorrectly on interrupts vhost: make sure log_num < in_num Linux 4.19.73 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I7bc57825aeb36759bb8e8726888da9af06392c09	2019-09-16 09:35:02 +02:00
Mike Salvatore	17111037fd	apparmor: reset pos on failure to unpack for various functions ... [ Upstream commit 156e42996b ] Each function that manipulates the aa_ext struct should reset it's "pos" member on failure. This ensures that, on failure, no changes are made to the state of the aa_ext struct. There are paths were elements are optional and the error path is used to indicate the optional element is not present. This means instead of just aborting on error the unpack stream can become unsynchronized on optional elements, if using one of the affected functions. Cc: stable@vger.kernel.org Fixes: 736ec752d9 ("AppArmor: policy routines for loading and unpacking policy") Signed-off-by: Mike Salvatore <mike.salvatore@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2019-09-16 08:22:16 +02:00
Alexander Potapenko	a5587d8fce	UPSTREAM: mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options ... Upstream commit 6471384af2 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options"). Patch series "add init_on_alloc/init_on_free boot options", v10. Provide init_on_alloc and init_on_free boot options. These are aimed at preventing possible information leaks and making the control-flow bugs that depend on uninitialized values more deterministic. Enabling either of the options guarantees that the memory returned by the page allocator and SL[AU]B is initialized with zeroes. SLOB allocator isn't supported at the moment, as its emulation of kmem caches complicates handling of SLAB_TYPESAFE_BY_RCU caches correctly. Enabling init_on_free also guarantees that pages and heap objects are initialized right after they're freed, so it won't be possible to access stale data by using a dangling pointer. As suggested by Michal Hocko, right now we don't let the heap users to disable initialization for certain allocations. There's not enough evidence that doing so can speed up real-life cases, and introducing ways to opt-out may result in things going out of control. This patch (of 2): The new options are needed to prevent possible information leaks and make control-flow bugs that depend on uninitialized values more deterministic. This is expected to be on-by-default on Android and Chrome OS. And it gives the opportunity for anyone else to use it under distros too via the boot args. (The init_on_free feature is regularly requested by folks where memory forensics is included in their threat models.) init_on_alloc=1 makes the kernel initialize newly allocated pages and heap objects with zeroes. Initialization is done at allocation time at the places where checks for __GFP_ZERO are performed. init_on_free=1 makes the kernel initialize freed pages and heap objects with zeroes upon their deletion. This helps to ensure sensitive data doesn't leak via use-after-free accesses. Both init_on_alloc=1 and init_on_free=1 guarantee that the allocator returns zeroed memory. The two exceptions are slab caches with constructors and SLAB_TYPESAFE_BY_RCU flag. Those are never zero-initialized to preserve their semantics. Both init_on_alloc and init_on_free default to zero, but those defaults can be overridden with CONFIG_INIT_ON_ALLOC_DEFAULT_ON and CONFIG_INIT_ON_FREE_DEFAULT_ON. If either SLUB poisoning or page poisoning is enabled, those options take precedence over init_on_alloc and init_on_free: initialization is only applied to unpoisoned allocations. Slowdown for the new features compared to init_on_free=0, init_on_alloc=0: hackbench, init_on_free=1: +7.62% sys time (st.err 0.74%) hackbench, init_on_alloc=1: +7.75% sys time (st.err 2.14%) Linux build with -j12, init_on_free=1: +8.38% wall time (st.err 0.39%) Linux build with -j12, init_on_free=1: +24.42% sys time (st.err 0.52%) Linux build with -j12, init_on_alloc=1: -0.13% wall time (st.err 0.42%) Linux build with -j12, init_on_alloc=1: +0.57% sys time (st.err 0.40%) The slowdown for init_on_free=0, init_on_alloc=0 compared to the baseline is within the standard error. The new features are also going to pave the way for hardware memory tagging (e.g. arm64's MTE), which will require both on_alloc and on_free hooks to set the tags for heap objects. With MTE, tagging will have the same cost as memory initialization. Although init_on_free is rather costly, there are paranoid use-cases where in-memory data lifetime is desired to be minimized. There are various arguments for/against the realism of the associated threat models, but given that we'll need the infrastructure for MTE anyway, and there are people who want wipe-on-free behavior no matter what the performance cost, it seems reasonable to include it in this series. [glider@google.com: v8] Link: http://lkml.kernel.org/r/20190626121943.131390-2-glider@google.com [glider@google.com: v9] Link: http://lkml.kernel.org/r/20190627130316.254309-2-glider@google.com [glider@google.com: v10] Link: http://lkml.kernel.org/r/20190628093131.199499-2-glider@google.com Link: http://lkml.kernel.org/r/20190617151050.92663-2-glider@google.com Signed-off-by: Alexander Potapenko <glider@google.com> Acked-by: Kees Cook <keescook@chromium.org> Acked-by: Michal Hocko <mhocko@suse.cz> [page and dmapool parts Acked-by: James Morris <jamorris@linux.microsoft.com>] Cc: Christoph Lameter <cl@linux.com> Cc: Masahiro Yamada <yamada.masahiro@socionext.com> Cc: "Serge E. Hallyn" <serge@hallyn.com> Cc: Nick Desaulniers <ndesaulniers@google.com> Cc: Kostya Serebryany <kcc@google.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Sandeep Patil <sspatil@android.com> Cc: Laura Abbott <labbott@redhat.com> Cc: Randy Dunlap <rdunlap@infradead.org> Cc: Jann Horn <jannh@google.com> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Marco Elver <elver@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Change-Id: If0620a6a8aed34c21e98458c965e94f5a9dfd297 Bug: 138435492 Test: Boot cuttlefish with and without Test: CONFIG_INIT_ON_ALLOC_DEFAULT_ON/CONFIG_INIT_ON_FREE_DEFAULT_ON Signed-off-by: Alexander Potapenko <glider@google.com>	2019-08-30 11:58:12 +02:00
Greg Kroah-Hartman	de4c70d6a9	This is the 4.19.65 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl1Js7MACgkQONu9yGCS aT4PQxAAo7xa4kYvDxc1RjUY/yIlp6lQ3rpYAAfZB0t8vN+dqivnJZ7m6JHeWX1Y CMcxg85zxLVFeuiXdP821Zj68AB5zqlWMhX0bXm2lhw/Eo9+XHzXtnrLZHhz0/Xd M5cmfIPmoyPCUQQfzSfUMvch+ZpwzEt5op5pUfSjckSpjHQZ0HFj1WJ4D8Hn9jAJ y4+DAKDZgtqhb3GvpS6MoVnBJgcPk9+mBiDkSb12L392+FvHqfeBi3tDRhvyiZAO iJrk747SPds7NlNmuRnj7YyUSDhBzaceRCz0Jsv9FT5EKXoPErXdsL3Bkfa9TREM pH0OaMgNr6WSXLO9qIMcfxMeaKVIvIbotqBTkBTzhEAGPkHA75dhi0lpixXXFExg MaqhLfmHO0dOEr9FrvYGe7f2wUA1Rdw/qRTM3KPEKmHxMqBS7eufIWMHwie1n9Oe cYoP6UkxUIvhUyFV2BlMRFdMfaDbtR0iqy8Dqh36NISD6PAYaUGSoVeSO1fEg4Jy 5GgrKPg6rcz2XNY2cVbsm2zLpqY4dY58SFK9ORfuULdKUQvScvFGrdSSW0CgX+uc F/5NmPutUoboHVxFraDPx7yo46pHf1RW0Me4xZ0aJ3e9ituLAN4fmJ9u46nofb5M thPelQlMVt30O41uViJ0ADkOjCsiBr3AxOFvc76Ct9Q/BJVxhLk= =JVBv -----END PGP SIGNATURE----- Merge 4.19.65 into android-4.19 Changes in 4.19.65 ARM: riscpc: fix DMA ARM: dts: rockchip: Make rk3288-veyron-minnie run at hs200 ARM: dts: rockchip: Make rk3288-veyron-mickey's emmc work again ARM: dts: rockchip: Mark that the rk3288 timer might stop in suspend ftrace: Enable trampoline when rec count returns back to one dmaengine: tegra-apb: Error out if DMA_PREP_INTERRUPT flag is unset arm64: dts: rockchip: fix isp iommu clocks and power domain kernel/module.c: Only return -EEXIST for modules that have finished loading firmware/psci: psci_checker: Park kthreads before stopping them MIPS: lantiq: Fix bitfield masking dmaengine: rcar-dmac: Reject zero-length slave DMA requests clk: tegra210: fix PLLU and PLLU_OUT1 fs/adfs: super: fix use-after-free bug clk: sprd: Add check for return value of sprd_clk_regmap_init() btrfs: fix minimum number of chunk errors for DUP btrfs: qgroup: Don't hold qgroup_ioctl_lock in btrfs_qgroup_inherit() cifs: Fix a race condition with cifs_echo_request ceph: fix improper use of smp_mb__before_atomic() ceph: return -ERANGE if virtual xattr value didn't fit in buffer ACPI: blacklist: fix clang warning for unused DMI table scsi: zfcp: fix GCC compiler warning emitted with -Wmaybe-uninitialized perf version: Fix segfault due to missing OPT_END() x86: kvm: avoid constant-conversion warning ACPI: fix false-positive -Wuninitialized warning be2net: Signal that the device cannot transmit during reconfiguration x86/apic: Silence -Wtype-limits compiler warnings x86: math-emu: Hide clang warnings for 16-bit overflow mm/cma.c: fail if fixed declaration can't be honored lib/test_overflow.c: avoid tainting the kernel and fix wrap size lib/test_string.c: avoid masking memset16/32/64 failures coda: add error handling for fget coda: fix build using bare-metal toolchain uapi linux/coda_psdev.h: move upc_req definition from uapi to kernel side headers drivers/rapidio/devices/rio_mport_cdev.c: NUL terminate some strings ipc/mqueue.c: only perform resource calculation if user valid mlxsw: spectrum_dcb: Configure DSCP map as the last rule is removed xen/pv: Fix a boot up hang revealed by int3 self test x86/kvm: Don't call kvm_spurious_fault() from .fixup x86/paravirt: Fix callee-saved function ELF sizes x86, boot: Remove multiple copy of static function sanitize_boot_params() drm/nouveau: fix memory leak in nouveau_conn_reset() kconfig: Clear "written" flag to avoid data loss kbuild: initialize CLANG_FLAGS correctly in the top Makefile Btrfs: fix incremental send failure after deduplication Btrfs: fix race leading to fs corruption after transaction abort mmc: dw_mmc: Fix occasional hang after tuning on eMMC mmc: meson-mx-sdio: Fix misuse of GENMASK macro gpiolib: fix incorrect IRQ requesting of an active-low lineevent IB/hfi1: Fix Spectre v1 vulnerability mtd: rawnand: micron: handle on-die "ECC-off" devices correctly selinux: fix memory leak in policydb_init() ALSA: hda: Fix 1-minute detection delay when i915 module is not available mm: vmscan: check if mem cgroup is disabled or not before calling memcg slab shrinker s390/dasd: fix endless loop after read unit address configuration cgroup: kselftest: relax fs_spec checks parisc: Fix build of compressed kernel even with debug enabled drivers/perf: arm_pmu: Fix failure path in PM notifier arm64: compat: Allow single-byte watchpoints on all addresses arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG} nbd: replace kill_bdev() with __invalidate_device() again xen/swiotlb: fix condition for calling xen_destroy_contiguous_region() IB/mlx5: Fix unreg_umr to ignore the mkey state IB/mlx5: Use direct mkey destroy command upon UMR unreg failure IB/mlx5: Move MRs to a kernel PD when freeing them to the MR cache IB/mlx5: Fix clean_mr() to work in the expected order IB/mlx5: Fix RSS Toeplitz setup to be aligned with the HW specification IB/hfi1: Check for error on call to alloc_rsm_map_table drm/i915/gvt: fix incorrect cache entry for guest page mapping eeprom: at24: make spd world-readable again ARC: enable uboot support unconditionally objtool: Support GCC 9 cold subfunction naming scheme gcc-9: properly declare the {pv,hv}clock_page storage x86/vdso: Prevent segfaults due to hoisted vclock reads scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA x86/cpufeatures: Carve out CQM features retrieval x86/cpufeatures: Combine word 11 and 12 into a new scattered features word x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations x86/speculation: Enable Spectre v1 swapgs mitigations x86/entry/64: Use JMP instead of JMPQ x86/speculation/swapgs: Exclude ATOMs from speculation through SWAPGS Documentation: Add swapgs description to the Spectre v1 documentation Linux 4.19.65 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iceeabdb164657e0a616db618e6aa8445d56b0dc1	2019-08-06 20:08:18 +02:00
Ondrej Mosnacek	46650ac2e1	selinux: fix memory leak in policydb_init() ... commit 45385237f6 upstream. Since roles_init() adds some entries to the role hash table, we need to destroy also its keys/values on error, otherwise we get a memory leak in the error path. Cc: <stable@vger.kernel.org> Reported-by: syzbot+fee3a14d4cdf92646287@syzkaller.appspotmail.com Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-08-06 19:06:54 +02:00
Greg Kroah-Hartman	71ce27c31a	This is the 4.19.61 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl06qFcACgkQONu9yGCS aT6O9A/+JZqoVYnItpOnT8Hu//0mYEKvREWqsoTJNpZJhLWtGjPTT9ospHNpVgfC GUkFqngWzXHpzCgTYHUV3Mm+SIiVXCM3nkCU1+2YOsPzrKo/lJSfFt3wOYGpKO5V qratAQLra5TqR0teR00aQblqKqfmrux05uL9dNcVIwve813m00jFALcpjrXnanpP tx5cqCo3uHOou5XLraHx/CMPnfJI/mLegBUTM4DxAmN2vG4gQck2gnrU7s1eg4cy 1Fqh0Oo2Ycj5p9yoGss02JqR3wGZHOEmF55j2JcTZAPvW6/c55iPd52Trn8kPOHB Awq/VwJmP4p10a4TWoZpv7VqpL3PzO8/AW7QWOER8QnDzfOTHGae7YT8LVp5Xqj5 1NqowuP/Tm0yaZSaDLqkdvhVqTi0oGL8OCYLErpeR9PQ3P+p3paaswopsPqnXURj Q4Pahe1vm9WG2NpKh2bHVmmVkQmvwuxxxnaa31HI/IyLd5bYFV1/LbEa/XrSK36W VJtO+0AjERO9uTVP/YDloDkQ4R3+3W+m520jYsgf1OwY7v/Kc6iLb7cDwci/ZWMy YSMm8hrO0nzuT0SI25TKLDvxjGbANKvxytzOQMOTb8NsIWwaoEKWh+4r9XkdUXNa +dx72I5J2Be+3hk+eaDNzCdEae5pgVTxBpwJbzI4RfnK1Doa4uE= =hJdd -----END PGP SIGNATURE----- Merge 4.19.61 into android-4.19 Changes in 4.19.61 MIPS: ath79: fix ar933x uart parity mode MIPS: fix build on non-linux hosts arm64/efi: Mark __efistub_stext_offset as an absolute symbol explicitly scsi: iscsi: set auth_protocol back to NULL if CHAP_A value is not supported dmaengine: imx-sdma: fix use-after-free on probe error path wil6210: fix potential out-of-bounds read ath10k: Do not send probe response template for mesh ath9k: Check for errors when reading SREV register ath6kl: add some bounds checking ath10k: add peer id check in ath10k_peer_find_by_id wil6210: fix spurious interrupts in 3-msi ath: DFS JP domain W56 fixed pulse type 3 RADAR detection regmap: debugfs: Fix memory leak in regmap_debugfs_init batman-adv: fix for leaked TVLV handler. media: dvb: usb: fix use after free in dvb_usb_device_exit media: spi: IR LED: add missing of table registration crypto: talitos - fix skcipher failure due to wrong output IV media: ov7740: avoid invalid framesize setting media: marvell-ccic: fix DMA s/g desc number calculation media: vpss: fix a potential NULL pointer dereference media: media_device_enum_links32: clean a reserved field net: stmmac: dwmac1000: Clear unused address entries net: stmmac: dwmac4/5: Clear unused address entries qed: Set the doorbell address correctly signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig af_key: fix leaks in key_pol_get_resp and dump_sp. xfrm: Fix xfrm sel prefix length validation fscrypt: clean up some BUG_ON()s in block encryption/decryption perf annotate TUI browser: Do not use member from variable within its own initialization media: mc-device.c: don't memset __user pointer contents media: saa7164: fix remove_proc_entry warning media: staging: media: davinci_vpfe: - Fix for memory leak if decoder initialization fails. net: phy: Check against net_device being NULL crypto: talitos - properly handle split ICV. crypto: talitos - Align SEC1 accesses to 32 bits boundaries. tua6100: Avoid build warnings. batman-adv: Fix duplicated OGMs on NETDEV_UP locking/lockdep: Fix merging of hlocks with non-zero references media: wl128x: Fix some error handling in fm_v4l2_init_video_device() net: hns3: set ops to null when unregister ad_dev cpupower : frequency-set -r option misses the last cpu in related cpu list arm64: mm: make CONFIG_ZONE_DMA32 configurable perf jvmti: Address gcc string overflow warning for strncpy() net: stmmac: dwmac4: fix flow control issue net: stmmac: modify default value of tx-frames crypto: inside-secure - do not rely on the hardware last bit for result descriptors net: fec: Do not use netdev messages too early net: axienet: Fix race condition causing TX hang s390/qdio: handle PENDING state for QEBSM devices RAS/CEC: Fix pfn insertion net: sfp: add mutex to prevent concurrent state checks ipset: Fix memory accounting for hash types on resize perf cs-etm: Properly set the value of 'old' and 'head' in snapshot mode perf test 6: Fix missing kvm module load for s390 perf report: Fix OOM error in TUI mode on s390 irqchip/meson-gpio: Add support for Meson-G12A SoC media: uvcvideo: Fix access to uninitialized fields on probe error media: fdp1: Support M3N and E3 platforms iommu: Fix a leak in iommu_insert_resv_region gpio: omap: fix lack of irqstatus_raw0 for OMAP4 gpio: omap: ensure irq is enabled before wakeup regmap: fix bulk writes on paged registers bpf: silence warning messages in core media: s5p-mfc: fix reading min scratch buffer size on MFC v6/v7 selinux: fix empty write to keycreate file x86/cpu: Add Ice Lake NNPI to Intel family ASoC: meson: axg-tdm: fix sample clock inversion rcu: Force inlining of rcu_read_lock() x86/cpufeatures: Add FDP_EXCPTN_ONLY and ZERO_FCS_FDS qed: iWARP - Fix tc for MPA ll2 connection net: hns3: fix for skb leak when doing selftest block: null_blk: fix race condition for null_del_dev blkcg, writeback: dead memcgs shouldn't contribute to writeback ownership arbitration xfrm: fix sa selector validation sched/core: Add __sched tag for io_schedule() sched/fair: Fix "runnable_avg_yN_inv" not used warnings perf/x86/intel/uncore: Handle invalid event coding for free-running counter x86/atomic: Fix smp_mb__{before,after}_atomic() perf evsel: Make perf_evsel__name() accept a NULL argument vhost_net: disable zerocopy by default ipoib: correcly show a VF hardware address x86/cacheinfo: Fix a -Wtype-limits warning blk-iolatency: only account submitted bios ACPICA: Clear status of GPEs on first direct enable EDAC/sysfs: Fix memory leak when creating a csrow object nvme: fix possible io failures when removing multipathed ns nvme-pci: properly report state change failure in nvme_reset_work nvme-pci: set the errno on ctrl state change error lightnvm: pblk: fix freeing of merged pages arm64: Do not enable IRQs for ct_user_exit ipsec: select crypto ciphers for xfrm_algo ipvs: defer hook registration to avoid leaks media: s5p-mfc: Make additional clocks optional media: i2c: fix warning same module names ntp: Limit TAI-UTC offset timer_list: Guard procfs specific code acpi/arm64: ignore 5.1 FADTs that are reported as 5.0 media: coda: fix mpeg2 sequence number handling media: coda: fix last buffer handling in V4L2_ENC_CMD_STOP media: coda: increment sequence offset for the last returned frame media: vimc: cap: check v4l2_fill_pixfmt return value media: hdpvr: fix locking and a missing msleep net: stmmac: sun8i: force select external PHY when no internal one rtlwifi: rtl8192cu: fix error handle when usb probe failed mt7601u: do not schedule rx_tasklet when the device has been disconnected x86/build: Add 'set -e' to mkcapflags.sh to delete broken capflags.c mt7601u: fix possible memory leak when the device is disconnected ipvs: fix tinfo memory leak in start_sync_thread ath10k: add missing error handling ath10k: fix PCIE device wake up failed perf tools: Increase MAX_NR_CPUS and MAX_CACHES ASoC: Intel: hdac_hdmi: Set ops to NULL on remove libata: don't request sense data on !ZAC ATA devices clocksource/drivers/exynos_mct: Increase priority over ARM arch timer xsk: Properly terminate assignment in xskq_produce_flush_desc rslib: Fix decoding of shortened codes rslib: Fix handling of of caller provided syndrome ixgbe: Check DDM existence in transceiver before access crypto: serpent - mark __serpent_setkey_sbox noinline crypto: asymmetric_keys - select CRYPTO_HASH where needed wil6210: drop old event after wmi_call timeout EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec bcache: check CACHE_SET_IO_DISABLE in allocator code bcache: check CACHE_SET_IO_DISABLE bit in bch_journal() bcache: acquire bch_register_lock later in cached_dev_free() bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush() bcache: fix potential deadlock in cached_def_free() net: hns3: fix a -Wformat-nonliteral compile warning net: hns3: add some error checking in hclge_tm module ath10k: destroy sdio workqueue while remove sdio module net: mvpp2: prs: Don't override the sign bit in SRAM parser shift igb: clear out skb->tstamp after reading the txtime iwlwifi: mvm: Drop large non sta frames bpf: fix uapi bpf_prog_info fields alignment perf stat: Make metric event lookup more robust perf stat: Fix group lookup for metric group bnx2x: Prevent ptp_task to be rescheduled indefinitely net: usb: asix: init MAC address buffers rxrpc: Fix oops in tracepoint bpf, libbpf, smatch: Fix potential NULL pointer dereference selftests: bpf: fix inlines in test_lwt_seg6local bonding: validate ip header before check IPPROTO_IGMP gpiolib: Fix references to gpiod_[gs]et_*value_cansleep() variants tools: bpftool: Fix json dump crash on powerpc Bluetooth: hci_bcsp: Fix memory leak in rx_skb Bluetooth: Add new 13d3:3491 QCA_ROME device Bluetooth: Add new 13d3:3501 QCA_ROME device Bluetooth: 6lowpan: search for destination address in all peers perf tests: Fix record+probe_libc_inet_pton.sh for powerpc64 Bluetooth: Check state in l2cap_disconnect_rsp gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable() Bluetooth: validate BLE connection interval updates gtp: fix suspicious RCU usage gtp: fix Illegal context switch in RCU read-side critical section. gtp: fix use-after-free in gtp_encap_destroy() gtp: fix use-after-free in gtp_newlink() net: mvmdio: defer probe of orion-mdio if a clock is not ready iavf: fix dereference of null rx_buffer pointer floppy: fix div-by-zero in setup_format_params floppy: fix out-of-bounds read in next_valid_format floppy: fix invalid pointer dereference in drive_name floppy: fix out-of-bounds read in copy_buffer xen: let alloc_xenballooned_pages() fail if not enough memory free scsi: NCR5380: Reduce goto statements in NCR5380_select() scsi: NCR5380: Always re-enable reselection interrupt Revert "scsi: ncr5380: Increase register polling limit" scsi: core: Fix race on creating sense cache scsi: megaraid_sas: Fix calculation of target ID scsi: mac_scsi: Increase PIO/PDMA transfer length threshold scsi: mac_scsi: Fix pseudo DMA implementation, take 2 crypto: ghash - fix unaligned memory access in ghash_setkey() crypto: ccp - Validate the the error value used to index error messages crypto: arm64/sha1-ce - correct digest for empty data in finup crypto: arm64/sha2-ce - correct digest for empty data in finup crypto: chacha20poly1305 - fix atomic sleep when using async algorithm crypto: crypto4xx - fix AES CTR blocksize value crypto: crypto4xx - fix blocksize for cfb and ofb crypto: crypto4xx - block ciphers should only accept complete blocks crypto: ccp - memset structure fields to zero before reuse crypto: ccp/gcm - use const time tag comparison. crypto: crypto4xx - fix a potential double free in ppc4xx_trng_probe Revert "bcache: set CACHE_SET_IO_DISABLE in bch_cached_dev_error()" bcache: Revert "bcache: fix high CPU occupancy during journal" bcache: Revert "bcache: free heap cache_set->flush_btree in bch_journal_free" bcache: ignore read-ahead request failure on backing device bcache: fix mistaken sysfs entry for io_error counter bcache: destroy dc->writeback_write_wq if failed to create dc->writeback_thread Input: gtco - bounds check collection indent level Input: alps - don't handle ALPS cs19 trackpoint-only device Input: synaptics - whitelist Lenovo T580 SMBus intertouch Input: alps - fix a mismatch between a condition check and its comment regulator: s2mps11: Fix buck7 and buck8 wrong voltages arm64: tegra: Update Jetson TX1 GPU regulator timings iwlwifi: pcie: don't service an interrupt that was masked iwlwifi: pcie: fix ALIVE interrupt handling for gen2 devices w/o MSI-X iwlwifi: don't WARN when calling iwl_get_shared_mem_conf with RF-Kill iwlwifi: fix RF-Kill interrupt while FW load for gen2 devices NFSv4: Handle the special Linux file open access mode pnfs/flexfiles: Fix PTR_ERR() dereferences in ff_layout_track_ds_error pNFS: Fix a typo in pnfs_update_layout pnfs: Fix a problem where we gratuitously start doing I/O through the MDS lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE ASoC: dapm: Adapt for debugfs API change raid5-cache: Need to do start() part job after adding journal device ALSA: seq: Break too long mutex context in the write loop ALSA: hda/realtek - Fixed Headphone Mic can't record on Dell platform ALSA: hda/realtek: apply ALC891 headset fixup to one Dell machine media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom() media: coda: Remove unbalanced and unneeded mutex unlock media: videobuf2-core: Prevent size alignment wrapping buffer size to 0 media: videobuf2-dma-sg: Prevent size from overflowing KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed arm64: tegra: Fix AGIC register range fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes. kconfig: fix missing choice values in auto.conf drm/nouveau/i2c: Enable i2c pads & busses during preinit padata: use smp_mb in padata_reorder to avoid orphaned padata jobs dm zoned: fix zone state management race xen/events: fix binding user event channels to cpus 9p/xen: Add cleanup path in p9_trans_xen_init 9p/virtio: Add cleanup path in p9_virtio_init x86/boot: Fix memory leak in default_get_smp_config() perf/x86/intel: Fix spurious NMI on fixed counter perf/x86/amd/uncore: Do not set 'ThreadMask' and 'SliceMask' for non-L3 PMCs perf/x86/amd/uncore: Set the thread mask for F17h L3 PMCs drm/edid: parse CEA blocks embedded in DisplayID intel_th: pci: Add Ice Lake NNPI support PCI: hv: Fix a use-after-free bug in hv_eject_device_work() PCI: Do not poll for PME if the device is in D3cold PCI: qcom: Ensure that PERST is asserted for at least 100 ms Btrfs: fix data loss after inode eviction, renaming it, and fsync it Btrfs: fix fsync not persisting dentry deletions due to inode evictions Btrfs: add missing inode version, ctime and mtime updates when punching hole IB/mlx5: Report correctly tag matching rendezvous capability HID: wacom: generic: only switch the mode on devices with LEDs HID: wacom: generic: Correct pad syncing HID: wacom: correct touch resolution x/y typo libnvdimm/pfn: fix fsdax-mode namespace info-block zero-fields coda: pass the host file in vma->vm_file on mmap include/asm-generic/bug.h: fix "cut here" for WARN_ON for __WARN_TAINT architectures xfs: fix pagecache truncation prior to reflink xfs: flush removing page cache in xfs_reflink_remap_prep xfs: don't overflow xattr listent buffer xfs: rename m_inotbt_nores to m_finobt_nores xfs: don't ever put nlink > 0 inodes on the unlinked list xfs: reserve blocks for ifree transaction during log recovery xfs: fix reporting supported extra file attributes for statx() xfs: serialize unaligned dio writes against all other dio writes xfs: abort unaligned nowait directio early gpu: ipu-v3: ipu-ic: Fix saturation bit offset in TPMEM crypto: caam - limit output IV to CBC to work around CTR mode DMA issue parisc: Ensure userspace privilege for ptraced processes in regset functions parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1 powerpc/32s: fix suspend/resume when IBATs 4-7 are used powerpc/watchpoint: Restore NV GPRs while returning from exception powerpc/powernv/npu: Fix reference leak powerpc/pseries: Fix oops in hotplug memory notifier mmc: sdhci-msm: fix mutex while in spinlock eCryptfs: fix a couple type promotion bugs mtd: rawnand: mtk: Correct low level time calculation of r/w cycle mtd: spinand: read returns badly if the last page has bitflips intel_th: msu: Fix single mode with disabled IOMMU Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug usb: Handle USB3 remote wakeup for LPM enabled devices correctly blk-throttle: fix zero wait time for iops throttled group blk-iolatency: clear use_delay when io.latency is set to zero blkcg: update blkcg_print_stat() to handle larger outputs net: mvmdio: allow up to four clocks to be specified for orion-mdio dt-bindings: allow up to four clocks for orion-mdio dm bufio: fix deadlock with loop device Linux 4.19.61 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I2f565111b1c16f369fa86e0481527fcc6357fe1b	2019-07-26 10:31:53 +02:00
Ondrej Mosnacek	914026d581	selinux: fix empty write to keycreate file ... [ Upstream commit 464c258aa4 ] When sid == 0 (we are resetting keycreate_sid to the default value), we should skip the KEY__CREATE check. Before this patch, doing a zero-sized write to /proc/self/keycreate would check if the current task can create unlabeled keys (which would usually fail with -EACCESS and generate an AVC). Now it skips the check and correctly sets the task's keycreate_sid to 0. Bug report: https://bugzilla.redhat.com/show_bug.cgi?id=1719067 Tested using the reproducer from the report above. Fixes: 4eb582cf1f ("[PATCH] keys: add a way to store the appropriate context for newly-created keys") Reported-by: Kir Kolyshkin <kir@sacred.ru> Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2019-07-26 09:14:07 +02:00
Greg Kroah-Hartman	e5304c6929	This is the 4.19.56 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl0RlqIACgkQONu9yGCS aT5MEQ/9Ftd5Y4EmSSeuRYZle8Dx9t15sR3mBtaKTdKk96KtVvlQNJhFEsm4IdrS O7IlUrR40ED3bqhOcFMUSvJOFiTnqJeMr0l5ukUMilszV6KO3Nhe0OX1huIA63bY EgoS+4YFcI0aDuVytTbI6wnW3f0KjxmCSWF0RgN7fQMgWa9ulBTjfXhUlQsnAVIM zVWS3K6VDjmxskTP6qmrt6OGgSFFy95drYoHG2wYiqGxIH1gCyHQAchWu6CPn92s rbzgzVeEYLpKGHlfWUfbIYSYOprVm4WXISqLABT4vDiWGFWey/g1dlIqI7gslLmN DpcSphYZo7xiW0Fh76zwh/n61lo7W2loho8k9VxxQR1hmgiYrMFEN7T1SyL7OgQ8 eplY50JOZN0OgW6HGa0ad2noUImKQccufGwsOCVlTxxAIn7qVgaGu2LtuBGb2P1o C6rBOSQ1LyRikOw1/ElIWxwnBJ9p+JjFhEH94HoFB7wyaROFfl+9LJvXt9zLop0E G0oG2QIp/+cusYY3h+eeMtw8gqa0oOnvwiaEbd7y1JVandjFBR01O0Uv0h+VKwSC HsBGnj2BpF8p3FYNXRVb4Wiii0QyWYjnDbrtndzLFj/fLOvR8bDb8HKBLOStm1UC 8PUc0w+sFo2tZ60Z4kXgkLL2yiiE/rQcDF0SsEgtFe4RTr7Feys= =GLuP -----END PGP SIGNATURE----- Merge 4.19.56 into android-4.19 Changes in 4.19.56 tracing: Silence GCC 9 array bounds warning objtool: Support per-function rodata sections gcc-9: silence 'address-of-packed-member' warning ovl: support the FS_IOC_FS[SG]ETXATTR ioctls ovl: fix wrong flags check in FS_IOC_FS[SG]ETXATTR ioctls ovl: make i_ino consistent with st_ino in more cases ovl: detect overlapping layers ovl: don't fail with disconnected lower NFS ovl: fix bogus -Wmaybe-unitialized warning s390/jump_label: Use "jdd" constraint on gcc9 s390/ap: rework assembler functions to use unions for in/out register variables mmc: sdhci: sdhci-pci-o2micro: Correctly set bus width when tuning mmc: core: API to temporarily disable retuning for SDIO CRC errors mmc: core: Add sdio_retune_hold_now() and sdio_retune_release() mmc: core: Prevent processing SDIO IRQs when the card is suspended scsi: ufs: Avoid runtime suspend possibly being blocked forever usb: chipidea: udc: workaround for endpoint conflict issue xhci: detect USB 3.2 capable host controllers correctly usb: xhci: Don't try to recover an endpoint if port is in error state. IB/hfi1: Validate fault injection opcode user input IB/hfi1: Silence txreq allocation warnings iio: temperature: mlx90632 Relax the compatibility check Input: synaptics - enable SMBus on ThinkPad E480 and E580 Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD Input: silead - add MSSL0017 to acpi_device_id apparmor: fix PROFILE_MEDIATES for untrusted input apparmor: enforce nullbyte at end of tag string brcmfmac: sdio: Disable auto-tuning around commands expected to fail brcmfmac: sdio: Don't tune while the card is off ARC: fix build warnings dmaengine: dw-axi-dmac: fix null dereference when pointer first is null dmaengine: sprd: Fix block length overflow ARC: [plat-hsdk]: Add missing multicast filter bins number to GMAC node ARC: [plat-hsdk]: Add missing FIFO size entry in GMAC node fpga: dfl: afu: Pass the correct device to dma_mapping_error() fpga: dfl: Add lockdep classes for pdata->lock parport: Fix mem leak in parport_register_dev_model parisc: Fix compiler warnings in float emulation code IB/rdmavt: Fix alloc_qpn() WARN_ON() IB/hfi1: Insure freeze_work work_struct is canceled on shutdown IB/{qib, hfi1, rdmavt}: Correct ibv_devinfo max_mr value IB/hfi1: Validate page aligned for a given virtual address MIPS: uprobes: remove set but not used variable 'epc' xtensa: Fix section mismatch between memblock_reserve and mem_reserve kselftest/cgroup: fix unexpected testing failure on test_memcontrol kselftest/cgroup: fix unexpected testing failure on test_core kselftest/cgroup: fix incorrect test_core skip selftests: vm: install test_vmalloc.sh for run_vmtests net: dsa: mv88e6xxx: avoid error message on remove from VLAN 0 net: hns: Fix loopback test failed at copper ports mdesc: fix a missing-check bug in get_vdev_port_node_info() sparc: perf: fix updated event period in response to PERF_EVENT_IOC_PERIOD net: ethernet: mediatek: Use hw_feature to judge if HWLRO is supported net: ethernet: mediatek: Use NET_IP_ALIGN to judge if HW RX_2BYTE_OFFSET is enabled drm/arm/mali-dp: Add a loop around the second set CVAL and try 5 times drm/arm/hdlcd: Actually validate CRTC modes drm/arm/hdlcd: Allow a bit of clock tolerance nvmet: fix data_len to 0 for bdev-backed write_zeroes scripts/checkstack.pl: Fix arm64 wrong or unknown architecture scsi: ufs: Check that space was properly alloced in copy_query_response scsi: smartpqi: unlock on error in pqi_submit_raid_request_synchronous() net: ipvlan: Fix ipvlan device tso disabled while NETIF_F_IP_CSUM is set s390/qeth: fix VLAN attribute in bridge_hostnotify udev event hwmon: (core) add thermal sensors only if dev->of_node is present hwmon: (pmbus/core) Treat parameters as paged if on multiple pages arm64: Silence gcc warnings about arch ABI drift nvme: Fix u32 overflow in the number of namespace list calculation btrfs: start readahead also in seed devices can: xilinx_can: use correct bittiming_const for CAN FD core can: flexcan: fix timeout when set small bitrate can: purge socket error queue on sock destruct riscv: mm: synchronize MMU after pte change powerpc/bpf: use unsigned division instruction for 64-bit operations ARM: imx: cpuidle-imx6sx: Restrict the SW2ISO increase to i.MX6SX ARM: dts: dra76x: Update MMC2_HS200_MANUAL1 iodelay values ARM: dts: am57xx-idk: Remove support for voltage switching for SD card arm64/sve: <uapi/asm/ptrace.h> should not depend on <uapi/linux/prctl.h> arm64: ssbd: explicitly depend on <linux/prctl.h> drm/vmwgfx: Use the backdoor port if the HB port is not available staging: erofs: add requirements field in superblock Bluetooth: Align minimum encryption key size for LE and BR/EDR connections Bluetooth: Fix regression with minimum encryption key size alignment SMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write cfg80211: fix memory leak of wiphy device name mac80211: drop robust management frames from unknown TA {nl,mac}80211: allow 4addr AP operation on crypto controlled devices mac80211: handle deauthentication/disassociation from TDLS peer nl80211: fix station_info pertid memory leak mac80211: Do not use stack memory with scatterlist for GMAC x86/resctrl: Don't stop walking closids when a locksetup group is found powerpc/mm/64s/hash: Reallocate context ids on fork Linux 4.19.56 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2019-06-25 15:46:46 +08:00
Jann Horn	31c9958068	apparmor: enforce nullbyte at end of tag string ... commit 8404d7a674 upstream. A packed AppArmor policy contains null-terminated tag strings that are read by unpack_nameX(). However, unpack_nameX() uses string functions on them without ensuring that they are actually null-terminated, potentially leading to out-of-bounds accesses. Make sure that the tag string is null-terminated before passing it to strcmp(). Cc: stable@vger.kernel.org Fixes: 736ec752d9 ("AppArmor: policy routines for loading and unpacking policy") Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-06-25 11:35:54 +08:00
John Johansen	eb2b0bf5c4	apparmor: fix PROFILE_MEDIATES for untrusted input ... commit 23375b13f9 upstream. While commit 11c236b89d ("apparmor: add a default null dfa") ensure every profile has a policy.dfa it does not resize the policy.start[] to have entries for every possible start value. Which means PROFILE_MEDIATES is not safe to use on untrusted input. Unforunately commit b9590ad4c4 ("apparmor: remove POLICY_MEDIATES_SAFE") did not take into account the start value usage. The input string in profile_query_cb() is user controlled and is not properly checked to be within the limited start[] entries, even worse it can't be as userspace policy is allowed to make us of entries types the kernel does not know about. This mean usespace can currently cause the kernel to access memory up to 240 entries beyond the start array bounds. Cc: stable@vger.kernel.org Fixes: b9590ad4c4 ("apparmor: remove POLICY_MEDIATES_SAFE") Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-06-25 11:35:54 +08:00
Kees Cook	90169c0955	UPSTREAM: security: Implement Clang's stack initialization ... CONFIG_INIT_STACK_ALL turns on stack initialization based on -ftrivial-auto-var-init in Clang builds, which has greater coverage than CONFIG_GCC_PLUGINS_STRUCTLEAK_BYREF_ALL. -ftrivial-auto-var-init Clang option provides trivial initializers for uninitialized local variables, variable fields and padding. It has three possible values: pattern - uninitialized locals are filled with a fixed pattern (mostly 0xAA on 64-bit platforms, see https://reviews.llvm.org/D54604 for more details, but 0x000000AA for 32-bit pointers) likely to cause crashes when uninitialized value is used; zero (it's still debated whether this flag makes it to the official Clang release) - uninitialized locals are filled with zeroes; uninitialized (default) - uninitialized locals are left intact. This patch uses only the "pattern" mode when CONFIG_INIT_STACK_ALL is enabled. Developers have the possibility to opt-out of this feature on a per-variable basis by using __attribute__((uninitialized)), but such use should be well justified in comments. Change-Id: I3ae7ade50c55fa6b88e8eed23942f09530ceb0e7 Co-developed-by: Alexander Potapenko <glider@google.com> Signed-off-by: Alexander Potapenko <glider@google.com> Signed-off-by: Kees Cook <keescook@chromium.org> Tested-by: Alexander Potapenko <glider@google.com> Acked-by: Masahiro Yamada <yamada.masahiro@socionext.com> (cherry picked from commit 709a972efb) Bug: 133428616 Signed-off-by: Alexander Potapenko <glider@google.com>	2019-06-17 19:26:21 +00:00
Alexander Potapenko	e0c6791d04	BACKPORT: security: Create "kernel hardening" config area ... Right now kernel hardening options are scattered around various Kconfig files. This can be a central place to collect these kinds of options going forward. This is initially populated with the memory initialization options from the gcc-plugins. The Android backport only moves the config options available in 4.19 at the moment. Change-Id: Iadf83f71da5410bad0aff01309365de0809fde96 Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: Masahiro Yamada <yamada.masahiro@socionext.com> (cherry picked from commit 9f671e5815) Bug: 133428616 Signed-off-by: Alexander Potapenko <glider@google.com>	2019-06-17 19:26:08 +00:00
Greg Kroah-Hartman	3f534fa2fc	This is the 4.19.49 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlz8soUACgkQONu9yGCS aT5o7w//cc+XhbVg3ro68Rq2byYVuntdiKtYDYlEQtv5DORELdX29g6gBlLlO+ma J29W/8quC9fi8EERG14TRvhh8MJNlQCv5g+Afvqr42zCOBowUFL4q3o06dON2e3v qhKsEhwcvHH/dR+ixtw1zpSNl6bIdG87C5gxYpWvpjCHpVpVDwLHfRK7GbSS/ioe Ys2uJwtbB4ZpileCoA4O61alYNLq/zP/gJiKraMbrwfOPfY3dmDIqo6KMniUyFs3 0E0w6AKp2PalsoVxyl6mD0KGFFChWz0AfSE6b3IdlzXC2qOZkWlAKPWxpQMHWdme HVGXHxrW6aDVk+RGOmIk1dKWDdVqTZJ1Cx1RscrtIQsQwuXqR/STgoqu1hbQ/B4W /jMak4BICuyfnOzsmuQbIhOWaf8KTIokYfQ92SAEDQl+xRhxqe2VTSCkl0gVE+Yr KxMoyzyZTYidpWRedUGJiACNjlgogYp3L9xiJjHz2dlQD9r4GTsHXo2CbzV1jYrL HKqmkz6angoHx3Vw6tffCe9117KFKkOxX8MG3xRMZMfRglRbNd3m8Uo+YGOWcscU e1mUE+71woj89TquN7cTg5hY5/kRiGwVJBqihSuWzeJsf0LPab9Txv7ipHKuzh84 i8e3Isi3eoZR55ZsU7Jl8QeDIZ2OSNprUy9ldvaI2K4fg/VxpA4= =hIeN -----END PGP SIGNATURE----- Merge 4.19.49 into android-4.19 Changes in 4.19.49 sparc64: Fix regression in non-hypervisor TLB flush xcall include/linux/bitops.h: sanitize rotate primitives xhci: update bounce buffer with correct sg num xhci: Use %zu for printing size_t type xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic() usb: xhci: avoid null pointer deref when bos field is NULL usbip: usbip_host: fix BUG: sleeping function called from invalid context usbip: usbip_host: fix stub_dev lock context imbalance regression USB: Fix slab-out-of-bounds write in usb_get_bos_descriptor USB: sisusbvga: fix oops in error path of sisusb_probe USB: Add LPM quirk for Surface Dock GigE adapter USB: rio500: refuse more than one device at a time USB: rio500: fix memory leak in close after disconnect media: usb: siano: Fix general protection fault in smsusb media: usb: siano: Fix false-positive "uninitialized variable" warning media: smsusb: better handle optional alignment brcmfmac: fix NULL pointer derefence during USB disconnect scsi: zfcp: fix missing zfcp_port reference put on -EBUSY from port_remove scsi: zfcp: fix to prevent port_remove with pure auto scan LUNs (only sdevs) tracing: Avoid memory leak in predicate_parse() Btrfs: fix wrong ctime and mtime of a directory after log replay Btrfs: fix race updating log root item during fsync Btrfs: fix fsync not persisting changed attributes of a directory Btrfs: incremental send, fix file corruption when no-holes feature is enabled iio: dac: ds4422/ds4424 fix chip verification iio: adc: ti-ads8688: fix timestamp is not updated in buffer s390/crypto: fix gcm-aes-s390 selftest failures s390/crypto: fix possible sleep during spinlock aquired KVM: PPC: Book3S HV: XIVE: Do not clear IRQ data of passthrough interrupts powerpc/perf: Fix MMCRA corruption by bhrb_filter ALSA: line6: Assure canceling delayed work at disconnection ALSA: hda/realtek - Set default power save node to 0 ALSA: hda/realtek - Improve the headset mic for Acer Aspire laptops KVM: s390: Do not report unusabled IDs via KVM_CAP_MAX_VCPU_ID drm/nouveau/i2c: Disable i2c bus access after ->fini() i2c: mlxcpld: Fix wrong initialization order in probe i2c: synquacer: fix synquacer_i2c_doxfer() return value tty: serial: msm_serial: Fix XON/XOFF tty: max310x: Fix external crystal register setup memcg: make it work on sparse non-0-node systems kernel/signal.c: trace_signal_deliver when signal_group_exit arm64: Fix the arm64_personality() syscall wrapper redirection docs: Fix conf.py for Sphinx 2.0 doc: Cope with the deprecation of AutoReporter doc: Cope with Sphinx logging deprecations ima: show rules with IMA_INMASK correctly evm: check hash algorithm passed to init_desc() vt/fbcon: deinitialize resources in visual_init() after failed memory allocation serial: sh-sci: disable DMA for uart_console staging: vc04_services: prevent integer overflow in create_pagelist() staging: wlan-ng: fix adapter initialization failure cifs: fix memory leak of pneg_inbuf on -EOPNOTSUPP ioctl case CIFS: cifs_read_allocate_pages: don't iterate through whole page array on ENOMEM Revert "lockd: Show pid of lockd for remote locks" gcc-plugins: Fix build failures under Darwin host drm/tegra: gem: Fix CPU-cache maintenance for BO's allocated using get_pages() drm/vmwgfx: Don't send drm sysfs hotplug events on initial master set drm/sun4i: Fix sun8i HDMI PHY clock initialization drm/sun4i: Fix sun8i HDMI PHY configuration for > 148.5 MHz drm/rockchip: shutdown drm subsystem on shutdown drm/lease: Make sure implicit planes are leased Compiler Attributes: add support for __copy (gcc >= 9) include/linux/module.h: copy __init/__exit attrs to init/cleanup_module Revert "x86/build: Move _etext to actual end of .text" Revert "binder: fix handling of misaligned binder object" binder: fix race between munmap() and direct reclaim x86/ftrace: Do not call function graph from dynamic trampolines x86/ftrace: Set trampoline pages as executable x86/kprobes: Set instruction page as executable scsi: lpfc: Fix backport of faf5a744f4 ("scsi: lpfc: avoid uninitialized variable warning") of: overlay: validate overlay properties #address-cells and #size-cells of: overlay: set node fields from properties when add new overlay node media: uvcvideo: Fix uvc_alloc_entity() allocation alignment Linux 4.19.49 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2019-06-09 09:27:18 +02:00
Roberto Sassu	6e322a9e42	evm: check hash algorithm passed to init_desc() ... commit 221be106d7 upstream. This patch prevents memory access beyond the evm_tfm array by checking the validity of the index (hash algorithm) passed to init_desc(). The hash algorithm can be arbitrarily set if the security.ima xattr type is not EVM_XATTR_HMAC. Fixes: 5feeb61183 ("evm: Allow non-SHA1 digital signatures") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-06-09 09:17:21 +02:00
Roberto Sassu	f85b87a9a2	ima: show rules with IMA_INMASK correctly ... commit 8cdc23a3d9 upstream. Show the '^' character when a policy rule has flag IMA_INMASK. Fixes: 80eae209d6 ("IMA: allow reading back the current IMA policy") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-06-09 09:17:21 +02:00
Greg Kroah-Hartman	cab4399ebf	This is the 4.19.47 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlzxMDsACgkQONu9yGCS aT6kjxAAvyKCDNGaQgBXGXe6xvBK7ad+mk+MU6WVycN+PIQzA8zVfR7RcGJgEP8t 65QrePyacMe5bmSgTnUKGz6DpwpWbCMamyftjoaPWIhxDFmQy7FB9ANOVoPDBw49 +jKT30ioBSI6LYQDU4xhxDO01HVEXmmLZquqYDfLoHOMLeXCivfTlM7PQPfxMZzn fdeLtvfCnfMiftkXZjGqaWoUAnrlTmncQk9nXMcDgxrGy9pHJ6B1WWE5ygqr4Z5s MaKfHotCSYD/eP8JsyIdJg+iMESv5Z0ZDCjbVslm81fCLeUD6atdnmpYxCphmT7Q ifN23i4FJrXBX4xLpD9RYzavH3+hQzqb2pt02aBZRW0OLFK0qjYrkdayjwWGOIUI zK9bgfHiiNKtoyvakQJ09uMhpO2thWeTMh8a6iBLTQ5Koi60adW1l5GrPuTTZYG7 V8xNB2cLsUktDsAr1I/kwrCMlE/oNFgy2La5zMzmELnFTUJRlMAoAGaa1DPcOFLt QVdT8luJMu+1KTeMZPoK/7QQGszMDTAot4+Ys56KyPQ6zN/rGr2vm7kHYn41FyEp KXpyeIm0/RKxUysz2Fyx+dL75e4ZhBof+amQ7Kotz6bF45o+ZwJ7THT6XKIOoln5 E7iI5RhQMZ2WuVIHLKa0QFBRn4RPpzie1lwOXWAAF6oqNgewXHw= =fjPE -----END PGP SIGNATURE----- Merge 4.19.47 into android-4.19 Changes in 4.19.47 x86: Hide the int3_emulate_call/jmp functions from UML ext4: do not delete unlinked inode from orphan list on failed truncate ext4: wait for outstanding dio during truncate in nojournal mode f2fs: Fix use of number of devices KVM: x86: fix return value for reserved EFER bio: fix improper use of smp_mb__before_atomic() sbitmap: fix improper use of smp_mb__before_atomic() Revert "scsi: sd: Keep disk read-only when re-reading partition" crypto: vmx - CTR: always increment IV as quadword mmc: sdhci-iproc: cygnus: Set NO_HISPD bit to fix HS50 data hold time problem mmc: sdhci-iproc: Set NO_HISPD bit to fix HS50 data hold time problem kvm: svm/avic: fix off-by-one in checking host APIC ID libnvdimm/pmem: Bypass CONFIG_HARDENED_USERCOPY overhead arm64/kernel: kaslr: reduce module randomization range to 2 GB arm64/iommu: handle non-remapped addresses in ->mmap and ->get_sgtable gfs2: Fix sign extension bug in gfs2_update_stats btrfs: don't double unlock on error in btrfs_punch_hole Btrfs: do not abort transaction at btrfs_update_root() after failure to COW path Btrfs: avoid fallback to transaction commit during fsync of files with holes Btrfs: fix race between ranged fsync and writeback of adjacent ranges btrfs: sysfs: Fix error path kobject memory leak btrfs: sysfs: don't leak memory when failing add fsid udlfb: fix some inconsistent NULL checking fbdev: fix divide error in fb_var_to_videomode NFSv4.2 fix unnecessary retry in nfs4_copy_file_range NFSv4.1 fix incorrect return value in copy_file_range bpf: add bpf_jit_limit knob to restrict unpriv allocations brcmfmac: assure SSID length from firmware is limited brcmfmac: add subtype check for event handling in data path arm64: errata: Add workaround for Cortex-A76 erratum #1463225 btrfs: honor path->skip_locking in backref code ovl: relax WARN_ON() for overlapping layers use case fbdev: fix WARNING in __alloc_pages_nodemask bug media: cpia2: Fix use-after-free in cpia2_exit media: serial_ir: Fix use-after-free in serial_ir_init_module media: vb2: add waiting_in_dqbuf flag media: vivid: use vfree() instead of kfree() for dev->bitmap_cap ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit bpf: devmap: fix use-after-free Read in __dev_map_entry_free batman-adv: mcast: fix multicast tt/tvlv worker locking at76c50x-usb: Don't register led_trigger if usb_register_driver failed acct_on(): don't mess with freeze protection Revert "btrfs: Honour FITRIM range constraints during free space trim" gfs2: Fix lru_count going negative cxgb4: Fix error path in cxgb4_init_module NFS: make nfs_match_client killable IB/hfi1: Fix WQ_MEM_RECLAIM warning gfs2: Fix occasional glock use-after-free mmc: core: Verify SD bus width tools/bpf: fix perf build error with uClibc (seen on ARC) selftests/bpf: set RLIMIT_MEMLOCK properly for test_libbpf_open.c bpftool: exclude bash-completion/bpftool from .gitignore pattern dmaengine: tegra210-dma: free dma controller in remove() net: ena: gcc 8: fix compilation warning hv_netvsc: fix race that may miss tx queue wakeup Bluetooth: Ignore CC events not matching the last HCI command pinctrl: zte: fix leaked of_node references ASoC: Intel: kbl_da7219_max98357a: Map BTN_0 to KEY_PLAYPAUSE usb: dwc2: gadget: Increase descriptors count for ISOC's usb: dwc3: move synchronize_irq() out of the spinlock protected block ASoC: hdmi-codec: unlock the device on startup errors powerpc/perf: Return accordingly on invalid chip-id in powerpc/boot: Fix missing check of lseek() return value powerpc/perf: Fix loop exit condition in nest_imc_event_init ASoC: imx: fix fiq dependencies spi: pxa2xx: fix SCR (divisor) calculation brcm80211: potential NULL dereference in brcmf_cfg80211_vndr_cmds_dcmd_handler() ACPI / property: fix handling of data_nodes in acpi_get_next_subnode() drm/nouveau/bar/nv50: ensure BAR is mapped media: stm32-dcmi: return appropriate error codes during probe ARM: vdso: Remove dependency with the arch_timer driver internals arm64: Fix compiler warning from pte_unmap() with -Wunused-but-set-variable powerpc/watchdog: Use hrtimers for per-CPU heartbeat sched/cpufreq: Fix kobject memleak scsi: qla2xxx: Fix a qla24xx_enable_msix() error path scsi: qla2xxx: Fix abort handling in tcm_qla2xxx_write_pending() scsi: qla2xxx: Avoid that lockdep complains about unsafe locking in tcm_qla2xxx_close_session() scsi: qla2xxx: Fix hardirq-unsafe locking x86/modules: Avoid breaking W^X while loading modules Btrfs: fix data bytes_may_use underflow with fallocate due to failed quota reserve btrfs: fix panic during relocation after ENOSPC before writeback happens btrfs: Don't panic when we can't find a root key iwlwifi: pcie: don't crash on invalid RX interrupt rtc: 88pm860x: prevent use-after-free on device remove rtc: stm32: manage the get_irq probe defer case scsi: qedi: Abort ep termination if offload not scheduled s390/kexec_file: Fix detection of text segment in ELF loader sched/nohz: Run NOHZ idle load balancer on HK_FLAG_MISC CPUs w1: fix the resume command API s390: qeth: address type mismatch warning dmaengine: pl330: _stop: clear interrupt status mac80211/cfg80211: update bss channel on channel switch libbpf: fix samples/bpf build failure due to undefined UINT32_MAX slimbus: fix a potential NULL pointer dereference in of_qcom_slim_ngd_register ASoC: fsl_sai: Update is_slave_mode with correct value mwifiex: prevent an array overflow rsi: Fix NULL pointer dereference in kmalloc net: cw1200: fix a NULL pointer dereference nvme: set 0 capacity if namespace block size exceeds PAGE_SIZE nvme-rdma: fix a NULL deref when an admin connect times out crypto: sun4i-ss - Fix invalid calculation of hash end bcache: avoid potential memleak of list of journal_replay(s) in the CACHE_SYNC branch of run_cache_set bcache: return error immediately in bch_journal_replay() bcache: fix failure in journal relplay bcache: add failure check to run_cache_set() for journal replay bcache: avoid clang -Wunintialized warning RDMA/cma: Consider scope_id while binding to ipv6 ll address vfio-ccw: Do not call flush_workqueue while holding the spinlock vfio-ccw: Release any channel program when releasing/removing vfio-ccw mdev x86/build: Move _etext to actual end of .text smpboot: Place the __percpu annotation correctly x86/mm: Remove in_nmi() warning from 64-bit implementation of vmalloc_fault() mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC versions Bluetooth: hci_qca: Give enough time to ROME controller to bootup. HID: logitech-hidpp: use RAP instead of FAP to get the protocol version pinctrl: pistachio: fix leaked of_node references pinctrl: samsung: fix leaked of_node references clk: rockchip: undo several noc and special clocks as critical on rk3288 perf/arm-cci: Remove broken race mitigation dmaengine: at_xdmac: remove BUG_ON macro in tasklet media: coda: clear error return value before picture run media: ov6650: Move v4l2_clk_get() to ov6650_video_probe() helper media: au0828: stop video streaming only when last user stops media: ov2659: make S_FMT succeed even if requested format doesn't match audit: fix a memory leak bug media: stm32-dcmi: fix crash when subdev do not expose any formats media: au0828: Fix NULL pointer dereference in au0828_analog_stream_enable() media: pvrusb2: Prevent a buffer overflow iio: adc: stm32-dfsdm: fix unmet direct dependencies detected block: fix use-after-free on gendisk powerpc/numa: improve control of topology updates powerpc/64: Fix booting large kernels with STRICT_KERNEL_RWX random: fix CRNG initialization when random.trust_cpu=1 random: add a spinlock_t to struct batched_entropy cgroup: protect cgroup->nr_(dying_)descendants by css_set_lock sched/core: Check quota and period overflow at usec to nsec conversion sched/rt: Check integer overflow at usec to nsec conversion sched/core: Handle overflow in cpu_shares_write_u64 staging: vc04_services: handle kzalloc failure drm/msm: a5xx: fix possible object reference leak irq_work: Do not raise an IPI when queueing work on the local CPU thunderbolt: Take domain lock in switch sysfs attribute callbacks s390/qeth: handle error from qeth_update_from_chp_desc() USB: core: Don't unbind interfaces following device reset failure x86/irq/64: Limit IST stack overflow check to #DB stack drm: etnaviv: avoid DMA API warning when importing buffers phy: sun4i-usb: Make sure to disable PHY0 passby for peripheral mode phy: mapphone-mdm6600: add gpiolib dependency i40e: Able to add up to 16 MAC filters on an untrusted VF i40e: don't allow changes to HW VLAN stripping on active port VLANs ACPI/IORT: Reject platform device creation on NUMA node mapping failure arm64: vdso: Fix clock_getres() for CLOCK_REALTIME RDMA/cxgb4: Fix null pointer dereference on alloc_skb failure perf/x86/msr: Add Icelake support perf/x86/intel/rapl: Add Icelake support perf/x86/intel/cstate: Add Icelake support hwmon: (vt1211) Use request_muxed_region for Super-IO accesses hwmon: (smsc47m1) Use request_muxed_region for Super-IO accesses hwmon: (smsc47b397) Use request_muxed_region for Super-IO accesses hwmon: (pc87427) Use request_muxed_region for Super-IO accesses hwmon: (f71805f) Use request_muxed_region for Super-IO accesses scsi: libsas: Do discovery on empty PHY to update PHY info mmc: core: make pwrseq_emmc (partially) support sleepy GPIO controllers mmc_spi: add a status check for spi_sync_locked mmc: sdhci-of-esdhc: add erratum eSDHC5 support mmc: sdhci-of-esdhc: add erratum A-009204 support mmc: sdhci-of-esdhc: add erratum eSDHC-A001 and A-008358 support drm/amdgpu: fix old fence check in amdgpu_fence_emit PM / core: Propagate dev->power.wakeup_path when no callbacks clk: rockchip: Fix video codec clocks on rk3288 extcon: arizona: Disable mic detect if running when driver is removed clk: rockchip: Make rkpwm a critical clock on rk3288 s390: zcrypt: initialize variables before_use x86/microcode: Fix the ancient deprecated microcode loading method s390/mm: silence compiler warning when compiling without CONFIG_PGSTE s390: cio: fix cio_irb declaration selftests: cgroup: fix cleanup path in test_memcg_subtree_control() qmi_wwan: Add quirk for Quectel dynamic config cpufreq: ppc_cbe: fix possible object reference leak cpufreq/pasemi: fix possible object reference leak cpufreq: pmac32: fix possible object reference leak cpufreq: kirkwood: fix possible object reference leak block: sed-opal: fix IOC_OPAL_ENABLE_DISABLE_MBR x86/build: Keep local relocations with ld.lld drm/pl111: fix possible object reference leak iio: ad_sigma_delta: Properly handle SPI bus locking vs CS assertion iio: hmc5843: fix potential NULL pointer dereferences iio: common: ssp_sensors: Initialize calculated_time in ssp_common_process_data iio: adc: ti-ads7950: Fix improper use of mlock selftests/bpf: ksym_search won't check symbols exists rtlwifi: fix a potential NULL pointer dereference mwifiex: Fix mem leak in mwifiex_tm_cmd brcmfmac: fix missing checks for kmemdup b43: shut up clang -Wuninitialized variable warning brcmfmac: convert dev_init_lock mutex to completion brcmfmac: fix WARNING during USB disconnect in case of unempty psq brcmfmac: fix race during disconnect when USB completion is in progress brcmfmac: fix Oops when bringing up interface during USB disconnect rtc: xgene: fix possible race condition rtlwifi: fix potential NULL pointer dereference scsi: ufs: Fix regulator load and icc-level configuration scsi: ufs: Avoid configuring regulator with undefined voltage range drm/panel: otm8009a: Add delay at the end of initialization arm64: cpu_ops: fix a leaked reference by adding missing of_node_put wil6210: fix return code of wmi_mgmt_tx and wmi_mgmt_tx_ext x86/uaccess, ftrace: Fix ftrace_likely_update() vs. SMAP x86/uaccess, signal: Fix AC=1 bloat x86/ia32: Fix ia32_restore_sigcontext() AC leak x86/uaccess: Fix up the fixup chardev: add additional check for minor range overlap RDMA/hns: Fix bad endianess of port_pd variable sh: sh7786: Add explicit I/O cast to sh7786_mm_sel() HID: core: move Usage Page concatenation to Main item ASoC: eukrea-tlv320: fix a leaked reference by adding missing of_node_put ASoC: fsl_utils: fix a leaked reference by adding missing of_node_put cxgb3/l2t: Fix undefined behaviour HID: logitech-hidpp: change low battery level threshold from 31 to 30 percent spi: tegra114: reset controller on probe kobject: Don't trigger kobject_uevent(KOBJ_REMOVE) twice. media: video-mux: fix null pointer dereferences media: wl128x: prevent two potential buffer overflows media: gspca: Kill URBs on USB device disconnect efifb: Omit memory map check on legacy boot thunderbolt: property: Fix a missing check of kzalloc thunderbolt: Fix to check the return value of kmemdup timekeeping: Force upper bound for setting CLOCK_REALTIME scsi: qedf: Add missing return in qedf_post_io_req() in the fcport offload check virtio_console: initialize vtermno value for ports tty: ipwireless: fix missing checks for ioremap overflow: Fix -Wtype-limits compilation warnings x86/mce: Fix machine_check_poll() tests for error types rcutorture: Fix cleanup path for invalid torture_type strings x86/mce: Handle varying MCA bank counts rcuperf: Fix cleanup path for invalid perf_type strings usb: core: Add PM runtime calls to usb_hcd_platform_shutdown scsi: qla4xxx: avoid freeing unallocated dma memory scsi: lpfc: avoid uninitialized variable warning selinux: avoid uninitialized variable warning batman-adv: allow updating DAT entry timeouts on incoming ARP Replies dmaengine: tegra210-adma: use devm_clk_*() helpers hwrng: omap - Set default quality thunderbolt: Fix to check return value of ida_simple_get thunderbolt: Fix to check for kmemdup failure drm/amd/display: fix releasing planes when exiting odm thunderbolt: property: Fix a NULL pointer dereference e1000e: Disable runtime PM on CNP+ tinydrm/mipi-dbi: Use dma-safe buffers for all SPI transfers igb: Exclude device from suspend direct complete optimization media: si2165: fix a missing check of return value media: dvbsky: Avoid leaking dvb frontend media: m88ds3103: serialize reset messages in m88ds3103_set_frontend media: staging: davinci_vpfe: disallow building with COMPILE_TEST drm/amd/display: Fix Divide by 0 in memory calculations drm/amd/display: Set stream->mode_changed when connectors change scsi: ufs: fix a missing check of devm_reset_control_get media: vimc: stream: fix thread state before sleep media: gspca: do not resubmit URBs when streaming has stopped media: go7007: avoid clang frame overflow warning with KASAN media: vimc: zero the media_device on probe scsi: lpfc: Fix FDMI manufacturer attribute value scsi: lpfc: Fix fc4type information for FDMI media: saa7146: avoid high stack usage with clang scsi: lpfc: Fix SLI3 commands being issued on SLI4 devices spi : spi-topcliff-pch: Fix to handle empty DMA buffers drm/omap: dsi: Fix PM for display blank with paired dss_pll calls spi: rspi: Fix sequencer reset during initialization spi: imx: stop buffer overflow in RX FIFO flush spi: Fix zero length xfer bug ASoC: davinci-mcasp: Fix clang warning without CONFIG_PM drm/v3d: Handle errors from IRQ setup. drm/drv: Hold ref on parent device during drm_device lifetime drm: Wake up next in drm_read() chain if we are forced to putback the event drm/sun4i: dsi: Change the start delay calculation vfio-ccw: Prevent quiesce function going into an infinite loop drm/sun4i: dsi: Enforce boundaries on the start delay NFS: Fix a double unlock from nfs_match,get_client Linux 4.19.47 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2019-05-31 08:14:29 -07:00
Arnd Bergmann	a2ace9b243	selinux: avoid uninitialized variable warning ... [ Upstream commit 98bbbb76f2 ] clang correctly points out a code path that would lead to an uninitialized variable use: security/selinux/netlabel.c:310:6: error: variable 'addr' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] if (ip_hdr(skb)->version == 4) { ^~~~~~~~~~~~~~~~~~~~~~~~~ security/selinux/netlabel.c:322:40: note: uninitialized use occurs here rc = netlbl_conn_setattr(ep->base.sk, addr, &secattr); ^~~~ security/selinux/netlabel.c:310:2: note: remove the 'if' if its condition is always true if (ip_hdr(skb)->version == 4) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ security/selinux/netlabel.c:291:23: note: initialize the variable 'addr' to silence this warning struct sockaddr *addr; ^ = NULL This is probably harmless since we should not see ipv6 packets of CONFIG_IPV6 is disabled, but it's better to rearrange the code so this cannot happen. Signed-off-by: Arnd Bergmann <arnd@arndb.de> [PM: removed old patchwork link, fixed checkpatch.pl style errors] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2019-05-31 06:46:31 -07:00
Greg Kroah-Hartman	aa07ecba6f	This is the 4.19.46 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlzpbCYACgkQONu9yGCS aT6aJhAAjh1h5q6oRAWZ7k3CTbx7abpi3FwqlGsrinxRkwdDvy6TXTo8gBn0emS0 8TEiQXLm/6M3IGyR8m7w2TGxThyk5xtUqEbxldHwzU/wsZzJ8KegnQUbpmdmJtrh BnvPygwOSldm8fqNZsFNWNCwt0m9LqPm5m57lHOj4PsxRFkr6jVYjtrynTbyDBus fT4Dec/jD/0hZbP2aeS5YWNee1ElgiiRewU5q5+Dn8yIDlaX81hkiu+J/EUS/97n 8Irn7Zs7wgjEwVe9xz1SEqAO0TtDH7wgxV2JMcXMRCbj45vmiUPh9IrSqqhvjqbf Gr36rGyuA2AIlMlzppEgP8ZiL6b5/2+e0mZFVfV4Ck3zThWq/pi8xrNk/AGVbXSA yE7j7PMVC0Pr9zFOBEsdb6HEOkwy4drGlSWiGkN5jZ5/yexGT4LhEpoMwqSd6tZ8 p12OdVmrEYZyasKOEGyOLFvUWKDT+aClFXcnB0Vi3GNtw6K4aHJU1dtPcpeD+PvO qMY2ePAj3GXKcg+r4dQPcbO+xEer8JZS/clTXNVwArGMQ/KII6hz2XCeSXe+aVnA 5SJZQnyimgaEev1Y1C7VVYBa4T+S54O+tjvKhv4fuX4vL622rLkUmMJyb2XWNSIC HagZOcEN7PY9KWqaMiP5GtcumfAUQCtNfXY0QMYhR+9B2Sl2zGg= =P21c -----END PGP SIGNATURE----- Merge 4.19.46 into android-4.19 Changes in 4.19.46 ipv6: fix src addr routing with the exception table ipv6: prevent possible fib6 leaks net: Always descend into dsa/ net: avoid weird emergency message net/mlx4_core: Change the error print to info print net: test nouarg before dereferencing zerocopy pointers net: usb: qmi_wwan: add Telit 0x1260 and 0x1261 compositions nfp: flower: add rcu locks when accessing netdev for tunnels ppp: deflate: Fix possible crash in deflate_init rtnetlink: always put IFLA_LINK for links with a link-netnsid tipc: switch order of device registration to fix a crash vsock/virtio: free packets during the socket release tipc: fix modprobe tipc failed after switch order of device registration vsock/virtio: Initialize core virtio vsock before registering the driver net/mlx5: Imply MLXFW in mlx5_core net/mlx5e: Fix ethtool rxfh commands when CONFIG_MLX5_EN_RXNFC is disabled parisc: Export running_on_qemu symbol for modules parisc: Skip registering LED when running in QEMU parisc: Use PA_ASM_LEVEL in boot code parisc: Rename LEVEL to PA_ASM_LEVEL to avoid name clash with DRBD code stm class: Fix channel free in stm output free path stm class: Fix channel bitmap on 32-bit systems brd: re-enable __GFP_HIGHMEM in brd_insert_page() proc: prevent changes to overridden credentials Revert "MD: fix lock contention for flush bios" md: batch flush requests. md: add mddev->pers to avoid potential NULL pointer dereference dcache: sort the freeing-without-RCU-delay mess for good. intel_th: msu: Fix single mode with IOMMU p54: drop device reference count if fails to enable device of: fix clang -Wunsequenced for be32_to_cpu() cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level() phy: ti-pipe3: fix missing bit-wise or operator when assigning val media: ov6650: Fix sensor possibly not detected on probe media: imx: csi: Allow unknown nearest upstream entities media: imx: Clear fwnode link struct for each endpoint iteration NFS4: Fix v4.0 client state corruption when mount PNFS fallback to MDS if no deviceid found clk: hi3660: Mark clk_gate_ufs_subsys as critical clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider clk: mediatek: Disable tuner_en before change PLL rate clk: rockchip: fix wrong clock definitions for rk3328 udlfb: delete the unused parameter for dlfb_handle_damage udlfb: fix sleeping inside spinlock udlfb: introduce a rendering mutex fuse: fix writepages on 32bit fuse: honor RLIMIT_FSIZE in fuse_file_fallocate ovl: fix missing upper fs freeze protection on copy up for ioctl iommu/tegra-smmu: Fix invalid ASID bits on Tegra30/114 ceph: flush dirty inodes before proceeding with remount x86_64: Add gap to int3 to allow for call emulation x86_64: Allow breakpoints to emulate call instructions ftrace/x86_64: Emulate call function while updating in breakpoint handler tracing: Fix partial reading of trace event's id file memory: tegra: Fix integer overflow on tick value calculation perf intel-pt: Fix instructions sampling rate perf intel-pt: Fix improved sample timestamp perf intel-pt: Fix sample timestamp wrt non-taken branches MIPS: perf: Fix build with CONFIG_CPU_BMIPS5000 enabled objtool: Allow AR to be overridden with HOSTAR fbdev/efifb: Ignore framebuffer memmap entries that lack any memory types fbdev: sm712fb: fix brightness control on reboot, don't set SR30 fbdev: sm712fb: fix VRAM detection, don't set SR70/71/74/75 fbdev: sm712fb: fix white screen of death on reboot, don't set CR3B-CR3F fbdev: sm712fb: fix boot screen glitch when sm712fb replaces VGA fbdev: sm712fb: fix crashes during framebuffer writes by correctly mapping VRAM fbdev: sm712fb: fix support for 1024x768-16 mode fbdev: sm712fb: use 1024x768 by default on non-MIPS, fix garbled display fbdev: sm712fb: fix crashes and garbled display during DPMS modesetting PCI: Mark AMD Stoney Radeon R7 GPU ATS as broken PCI: Mark Atheros AR9462 to avoid bus reset PCI: Init PCIe feature bits for managed host bridge alloc PCI/AER: Change pci_aer_init() stub to return void PCI: rcar: Add the initialization of PCIe link in resume_noirq() PCI: Factor out pcie_retrain_link() function PCI: Work around Pericom PCIe-to-PCI bridge Retrain Link erratum dm cache metadata: Fix loading discard bitset dm zoned: Fix zone report handling dm delay: fix a crash when invalid device is specified dm integrity: correctly calculate the size of metadata area dm mpath: always free attached_handler_name in parse_path() fuse: Add FOPEN_STREAM to use stream_open() xfrm: policy: Fix out-of-bound array accesses in __xfrm_policy_unlink xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module vti4: ipip tunnel deregistration fixes. xfrm: clean up xfrm protocol checks esp4: add length check for UDP encapsulation xfrm: Honor original L3 slave device in xfrmi policy lookup xfrm4: Fix uninitialized memory read in _decode_session4 clk: sunxi-ng: nkmp: Avoid GENMASK(-1, 0) power: supply: cpcap-battery: Fix division by zero securityfs: fix use-after-free on symlink traversal apparmorfs: fix use-after-free on symlink traversal PCI: Fix issue with "pci=disable_acs_redir" parameter being ignored x86: kvm: hyper-v: deal with buggy TLB flush requests from WS2012 mac80211: Fix kernel panic due to use of txq after free net: ieee802154: fix missing checks for regmap_update_bits KVM: arm/arm64: Ensure vcpu target is unset on reset failure power: supply: sysfs: prevent endless uevent loop with CONFIG_POWER_SUPPLY_DEBUG bpf: Fix preempt_enable_no_resched() abuse qmi_wwan: new Wistron, ZTE and D-Link devices iwlwifi: mvm: check for length correctness in iwl_mvm_create_skb() sched/cpufreq: Fix kobject memleak x86/mm/mem_encrypt: Disable all instrumentation for early SME setup ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour perf bench numa: Add define for RUSAGE_THREAD if not present perf/x86/intel: Fix race in intel_pmu_disable_event() Revert "Don't jump to compute_result state from check_result state" md/raid: raid5 preserve the writeback action after the parity check driver core: Postpone DMA tear-down until after devres release for probe failure Revert "selftests/bpf: skip verifier tests for unsupported program types" bpf: relax inode permission check for retrieving bpf program bpf: add map_lookup_elem_sys_only for lookups from syscall side bpf, lru: avoid messing with eviction heuristics upon syscall lookup fbdev: sm712fb: fix memory frequency by avoiding a switch/case fallthrough Linux 4.19.46 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2019-05-25 19:09:59 +02:00
Al Viro	b21ca2769b	apparmorfs: fix use-after-free on symlink traversal ... [ Upstream commit f51dcd0f62 ] symlink body shouldn't be freed without an RCU delay. Switch apparmorfs to ->destroy_inode() and use of call_rcu(); free both the inode and symlink body in the callback. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Sasha Levin <sashal@kernel.org>	2019-05-25 18:23:42 +02:00
Al Viro	9a0467e1f6	securityfs: fix use-after-free on symlink traversal ... [ Upstream commit 46c8744196 ] symlink body shouldn't be freed without an RCU delay. Switch securityfs to ->destroy_inode() and use of call_rcu(); free both the inode and symlink body in the callback. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Sasha Levin <sashal@kernel.org>	2019-05-25 18:23:42 +02:00
Greg Kroah-Hartman	0b63cd6d63	This is the 4.19.44 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlzdoMwACgkQONu9yGCS aT5H9RAAkvsM0ryV/0BLcS7bAc2qXHz3shwcqMRHeqLSHCI728Ew3vbrenquQ9ou I1I2gXVjVr3fT5IrNeEKC/RJg5EvUBD25dm3Iei9cTf8kqnnFaEqQFe+jIvVOMfR zr//hEG3lOO5tLtyK1pnZxrW1uKl7B+1O64bVMpHSola+5teV51r/PxqYM5lNKYm A0YhhcrTZ4f1ZY1nctgb3g5XousPHJAMhe8ACv6zO7I+eWwn410nUeAJL7WK8SvL UqW0xgLAkKsYrriaDCPC9VeOVMUetCHeT9KbYQ8W9p+kb5bMQua4d/YJtCxulnqH TAQosuCVSVoq+jQIZS+El4+teCQW/aAkHFGo+08e9ti+trEliz2u2PxiloZoGlxl M4iIPwjkp7YJ9WHoVdNjObPiv5vt+2pWDEPhB7p++nsk5/2ArbShqWVDREj09SRp RpOJ7UGl+Nckk8IppfQgRUOlVyMW6a+Fw7GX7dxnyh9U1g48w5ebNTVeUvKxQVCJ a99U9qqGRgmEsgicnOXs4tRMYuU0gn3j0Qjhd9G2xYijh8ElMLgTJyv+2JiUIavC nXmSVW3G54dR7N94aDfWm/z85w/uFmTmT4BiqNuc4/gHVyyk12Q9RbsV4T617xls wiCkGoLKlpi9cp6abxB9H+oav9PdZd9ztwZMSB35k1AIgh6oeo0= =v14F -----END PGP SIGNATURE----- Merge 4.19.44 into android-4.19 Changes in 4.19.44 bfq: update internal depth state when queue depth changes platform/x86: sony-laptop: Fix unintentional fall-through platform/x86: thinkpad_acpi: Disable Bluetooth for some machines platform/x86: dell-laptop: fix rfkill functionality hwmon: (pwm-fan) Disable PWM if fetching cooling data fails kernfs: fix barrier usage in __kernfs_new_node() virt: vbox: Sanity-check parameter types for hgcm-calls coming from userspace USB: serial: fix unthrottle races iio: adc: xilinx: fix potential use-after-free on remove iio: adc: xilinx: fix potential use-after-free on probe iio: adc: xilinx: prevent touching unclocked h/w on remove acpi/nfit: Always dump _DSM output payload libnvdimm/namespace: Fix a potential NULL pointer dereference HID: input: add mapping for Expose/Overview key HID: input: add mapping for keyboard Brightness Up/Down/Toggle keys HID: input: add mapping for "Toggle Display" key libnvdimm/btt: Fix a kmemdup failure check s390/dasd: Fix capacity calculation for large volumes mac80211: fix unaligned access in mesh table hash function mac80211: Increase MAX_MSG_LEN cfg80211: Handle WMM rules in regulatory domain intersection mac80211: fix memory accounting with A-MSDU aggregation nl80211: Add NL80211_FLAG_CLEAR_SKB flag for other NL commands libnvdimm/pmem: fix a possible OOB access when read and write pmem s390/3270: fix lockdep false positive on view->lock drm/amd/display: extending AUX SW Timeout clocksource/drivers/npcm: select TIMER_OF clocksource/drivers/oxnas: Fix OX820 compatible selftests: fib_tests: Fix 'Command line is not complete' errors mISDN: Check address length before reading address family vxge: fix return of a free'd memblock on a failed dma mapping qede: fix write to free'd pointer error and double free of ptp afs: Unlock pages for __pagevec_release() drm/amd/display: If one stream full updates, full update all planes s390/pkey: add one more argument space for debug feature entry x86/build/lto: Fix truncated .bss with -fdata-sections x86/reboot, efi: Use EFI reboot for Acer TravelMate X514-51T KVM: fix spectrev1 gadgets KVM: x86: avoid misreporting level-triggered irqs as edge-triggered in tracing tools lib traceevent: Fix missing equality check for strcmp ipmi: ipmi_si_hardcode.c: init si_type array to fix a crash ocelot: Don't sleep in atomic context (irqs_disabled()) scsi: aic7xxx: fix EISA support mm: fix inactive list balancing between NUMA nodes and cgroups init: initialize jump labels before command line option parsing selftests: netfilter: check icmp pkttoobig errors are set as related ipvs: do not schedule icmp errors from tunnels netfilter: ctnetlink: don't use conntrack/expect object addresses as id netfilter: nf_tables: prevent shift wrap in nft_chain_parse_hook() MIPS: perf: ath79: Fix perfcount IRQ assignment s390: ctcm: fix ctcm_new_device error return code drm/sun4i: Set device driver data at bind time for use in unbind drm/sun4i: Fix component unbinding and component master deletion selftests/net: correct the return value for run_netsocktests netfilter: fix nf_l4proto_log_invalid to log invalid packets gpu: ipu-v3: dp: fix CSC handling drm/imx: don't skip DP channel disable for background plane ARM: 8856/1: NOMMU: Fix CCR register faulty initialization when MPU is disabled spi: Micrel eth switch: declare missing of table spi: ST ST95HF NFC: declare missing of table drm/sun4i: Unbind components before releasing DRM and memory Input: synaptics-rmi4 - fix possible double free RDMA/hns: Bugfix for mapping user db mm/memory_hotplug.c: drop memory device reference after find_memory_block() powerpc/smp: Fix NMI IPI timeout powerpc/smp: Fix NMI IPI xmon timeout net: dsa: mv88e6xxx: fix few issues in mv88e6390x_port_set_cmode mm/memory.c: fix modifying of page protection by insert_pfn() usb: typec: Fix unchecked return value netfilter: nf_tables: use-after-free in dynamic operations netfilter: nf_tables: add missing ->release_ops() in error path of newrule() net: fec: manage ahb clock in runtime pm mlxsw: spectrum_switchdev: Add MDB entries in prepare phase mlxsw: core: Do not use WQ_MEM_RECLAIM for EMAD workqueue mlxsw: core: Do not use WQ_MEM_RECLAIM for mlxsw ordered workqueue mlxsw: core: Do not use WQ_MEM_RECLAIM for mlxsw workqueue net/tls: fix the IV leaks net: strparser: partially revert "strparser: Call skb_unclone conditionally" NFC: nci: Add some bounds checking in nci_hci_cmd_received() nfc: nci: Potential off by one in ->pipes[] array x86/kprobes: Avoid kretprobe recursion bug cw1200: fix missing unlock on error in cw1200_hw_scan() mwl8k: Fix rate_idx underflow rtlwifi: rtl8723ae: Fix missing break in switch statement Don't jump to compute_result state from check_result state um: Don't hardcode path as it is architecture dependent powerpc/64s: Include cpu header bonding: fix arp_validate toggling in active-backup mode bridge: Fix error path for kobject_init_and_add() dpaa_eth: fix SG frame cleanup fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied ipv4: Fix raw socket lookup for local traffic net: dsa: Fix error cleanup path in dsa_init_module net: ethernet: stmmac: dwmac-sun8i: enable support of unicast filtering net: macb: Change interrupt and napi enable order in open net: seeq: fix crash caused by not set dev.parent net: ucc_geth - fix Oops when changing number of buffers in the ring packet: Fix error path in packet_init selinux: do not report error on connect(AF_UNSPEC) vlan: disable SIOCSHWTSTAMP in container vrf: sit mtu should not be updated when vrf netdev is the link tuntap: fix dividing by zero in ebpf queue selection tuntap: synchronize through tfiles array instead of tun->numqueues isdn: bas_gigaset: use usb_fill_int_urb() properly tipc: fix hanging clients using poll with EPOLLOUT flag drivers/virt/fsl_hypervisor.c: dereferencing error pointers in ioctl drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl powerpc/book3s/64: check for NULL pointer in pgd_alloc() powerpc/powernv/idle: Restore IAMR after idle powerpc/booke64: set RI in default MSR PCI: hv: Fix a memory leak in hv_eject_device_work() PCI: hv: Add hv_pci_remove_slots() when we unload the driver PCI: hv: Add pci_destroy_slot() in pci_devices_present_work(), if necessary Linux 4.19.44 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2019-05-16 19:52:46 +02:00
Paolo Abeni	dfdfad3d18	selinux: do not report error on connect(AF_UNSPEC) ... [ Upstream commit c7e0d6cca8 ] calling connect(AF_UNSPEC) on an already connected TCP socket is an established way to disconnect() such socket. After commit 68741a8ada ("selinux: Fix ltp test connect-syscall failure") it no longer works and, in the above scenario connect() fails with EAFNOSUPPORT. Fix the above falling back to the generic/old code when the address family is not AF_INET{4,6}, but leave the SCTP code path untouched, as it has specific constraints. Fixes: 68741a8ada ("selinux: Fix ltp test connect-syscall failure") Reported-by: Tom Deseyn <tdeseyn@redhat.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-05-16 19:41:30 +02:00
Greg Kroah-Hartman	44c5f03127	This is the 4.19.41 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlzSZ3MACgkQONu9yGCS aT7f2hAAww50MxygeVQXgB0zJ7oSlEBwJAUH1GRCj1ual70pDoK9W8iuacPI4gNu +A0V4cD+lndMZ8E+F9/Vmzhmj/xHdxRfCkRmtnpa5IKUJqA/bLr1kdspYO6G354G ZBGvizvmFaAikbqNSnoadQZ5AYoT/C4FxxD6t/meQtnwmrK+OhRlh1xCkTddAbQo UEPDns9pxqrwHK7tS0GbPXLWgsr4y7BPq92ILdt/GFZGmEBJa0+tf66/DF+RMKjD OCmAkiFr+hN8KScUHeZpJKdmI3s7dHEUnQnwkHyC1TwjEXwxhtA0QZgzl9j1F8JI f27kbJrpmYuw2QADJyZmCnTiqBo7XglItxEZ2csJKyV7+jFFlzKT4S26iyrHwgXp BTdSuTaVe2Ubp/EiULwoSsmxaIyW6fROotQK/x4oB0eDm+OSXq217nnbnF2MRpMb eOqzRPCd5CvL8+7T9rc0kOJcDuK/9h95OjzZWBo9rDGz0glxlokw7cJ4fUyrJMPo kcw7ZIRRHLtKGTD/ZKX3XrErAqz9I4RAEzBRAXT6W0is7PUi00vFNcOU4ThNSsSK ihfuHsp9Jq/SKEUl6/CumU8e91LWv77/gqYxLLuygpuKLFLpMMc/PQOruxXT6ojx QC/KIUtcMfTP+xy23Wg2UQ1BXhl+HcfShXzvcEXxHzjgHpglKvc= =S4RT -----END PGP SIGNATURE----- Merge 4.19.41 into android-4.19 Changes in 4.19.41 iwlwifi: fix driver operation for 5350 mwifiex: Make resume actually do something useful again on SDIO cards mac80211: don't attempt to rename ERR_PTR() debugfs dirs i2c: synquacer: fix enumeration of slave devices i2c: imx: correct the method of getting private data in notifier_call i2c: Remove unnecessary call to irq_find_mapping i2c: Clear client->irq in i2c_device_remove i2c: Allow recovery of the initial IRQ by an I2C client device. i2c: Prevent runtime suspend of adapter when Host Notify is required ALSA: hda/realtek - Add new Dell platform for headset mode ALSA: hda/realtek - Fixed Dell AIO speaker noise ALSA: hda/realtek - Apply the fixup for ASUS Q325UAR USB: yurex: Fix protection fault after device removal USB: w1 ds2490: Fix bug caused by improper use of altsetting array USB: dummy-hcd: Fix failure to give back unlinked URBs usb: usbip: fix isoc packet num validation in get_pipe USB: core: Fix unterminated string returned by usb_string() USB: core: Fix bug caused by duplicate interface PM usage counter nvme-loop: init nvmet_ctrl fatal_err_work when allocate efi: Fix debugobjects warning on 'efi_rts_work' arm64: dts: rockchip: fix rk3328-roc-cc gmac2io tx/rx_delay HID: logitech: check the return value of create_singlethread_workqueue HID: debug: fix race condition with between rdesc_show() and device removal rtc: cros-ec: Fail suspend/resume if wake IRQ can't be configured rtc: sh: Fix invalid alarm warning for non-enabled alarm batman-adv: Reduce claim hash refcnt only for removed entry batman-adv: Reduce tt_local hash refcnt only for removed entry batman-adv: Reduce tt_global hash refcnt only for removed entry batman-adv: fix warning in function batadv_v_elp_get_throughput ARM: dts: rockchip: Fix gpu opp node names for rk3288 reset: meson-audio-arb: Fix missing .owner setting of reset_controller_dev igb: Fix WARN_ONCE on runtime suspend riscv: fix accessing 8-byte variable from RV32 HID: quirks: Fix keyboard + touchpad on Lenovo Miix 630 net: hns3: fix compile error net/mlx5: E-Switch, Fix esw manager vport indication for more vport commands bonding: show full hw address in sysfs for slave entries net: stmmac: use correct DMA buffer size in the RX descriptor net: stmmac: ratelimit RX error logs net: stmmac: don't stop NAPI processing when dropping a packet net: stmmac: don't overwrite discard_frame status net: stmmac: fix dropping of multi-descriptor RX frames net: stmmac: don't log oversized frames jffs2: fix use-after-free on symlink traversal debugfs: fix use-after-free on symlink traversal mfd: twl-core: Disable IRQ while suspended block: use blk_free_flush_queue() to free hctx->fq in blk_mq_init_hctx rtc: da9063: set uie_unsupported when relevant HID: input: add mapping for Assistant key vfio/pci: use correct format characters scsi: core: add new RDAC LENOVO/DE_Series device scsi: storvsc: Fix calculation of sub-channel count arm/mach-at91/pm : fix possible object reference leak arm64: fix wrong check of on_sdei_stack in nmi context net: hns: fix KASAN: use-after-free in hns_nic_net_xmit_hw() net: hns: Use NAPI_POLL_WEIGHT for hns driver net: hns: Fix probabilistic memory overwrite when HNS driver initialized net: hns: fix ICMP6 neighbor solicitation messages discard problem net: hns: Fix WARNING when remove HNS driver with SMMU enabled libcxgb: fix incorrect ppmax calculation KVM: SVM: prevent DBG_DECRYPT and DBG_ENCRYPT overflow kmemleak: powerpc: skip scanning holes in the .bss section hugetlbfs: fix memory leak for resv_map sh: fix multiple function definition build errors xsysace: Fix error handling in ace_setup fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock ARM: orion: don't use using 64-bit DMA masks ARM: iop: don't use using 64-bit DMA masks block: pass no-op callback to INIT_WORK(). perf/x86/amd: Update generic hardware cache events for Family 17h Bluetooth: btusb: request wake pin with NOAUTOEN Bluetooth: mediatek: fix up an error path to restore bdev->tx_state clk: qcom: Add missing freq for usb30_master_clk on 8998 staging: iio: adt7316: allow adt751x to use internal vref for all dacs staging: iio: adt7316: fix the dac read calculation staging: iio: adt7316: fix the dac write calculation scsi: RDMA/srpt: Fix a credit leak for aborted commands ASoC: Intel: bytcr_rt5651: Revert "Fix DMIC map headsetmic mapping" ASoC: wm_adsp: Correct handling of compressed streams that restart ASoC: stm32: fix sai driver name initialisation platform/x86: intel_pmc_core: Fix PCH IP name platform/x86: intel_pmc_core: Handle CFL regmap properly IB/core: Unregister notifier before freeing MAD security IB/core: Fix potential memory leak while creating MAD agents IB/core: Destroy QP if XRC QP fails Input: snvs_pwrkey - initialize necessary driver data before enabling IRQ Input: stmfts - acknowledge that setting brightness is a blocking call gpio: mxc: add check to return defer probe if clock tree NOT ready selinux: avoid silent denials in permissive mode under RCU walk selinux: never allow relabeling on context mounts mac80211: Honor SW_CRYPTO_CONTROL for unicast keys in AP VLAN mode powerpc/mm/hash: Handle mmap_min_addr correctly in get_unmapped_area topdown search x86/mce: Improve error message when kernel cannot recover, p2 clk: x86: Add system specific quirk to mark clocks as critical x86/mm/KASLR: Fix the size of the direct mapping section x86/mm: Fix a crash with kmemleak_scan() x86/mm/tlb: Revert "x86/mm: Align TLB invalidation info" i2c: i2c-stm32f7: Fix SDADEL minimum formula media: v4l2: i2c: ov7670: Fix PLL bypass register values ASoC: wm_adsp: Check for buffer in trigger stop mm/kmemleak.c: fix unused-function warning Linux 4.19.41 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2019-05-08 07:39:48 +02:00
Ondrej Mosnacek	574be22140	selinux: never allow relabeling on context mounts ... commit a83d6ddaeb upstream. In the SECURITY_FS_USE_MNTPOINT case we never want to allow relabeling files/directories, so we should never set the SBLABEL_MNT flag. The 'special handling' in selinux_is_sblabel_mnt() is only intended for when the behavior is set to SECURITY_FS_USE_GENFS. While there, make the logic in selinux_is_sblabel_mnt() more explicit and add a BUILD_BUG_ON() to make sure that introducing a new SECURITY_FS_USE_* forces a review of the logic. Fixes: d5f3a5f6e7 ("selinux: add security in-core xattr support for pstore and debugfs") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Reviewed-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-05-08 07:21:54 +02:00
Stephen Smalley	6b13ae52ac	selinux: avoid silent denials in permissive mode under RCU walk ... commit 3a28cff3bd upstream. commit 0dc1ba24f7 ("SELINUX: Make selinux cache VFS RCU walks safe") results in no audit messages at all if in permissive mode because the cache is updated during the rcu walk and thus no denial occurs on the subsequent ref walk. Fix this by not updating the cache when performing a non-blocking permission check. This only affects search and symlink read checks during rcu walk. Fixes: 0dc1ba24f7 ("SELINUX: Make selinux cache VFS RCU walks safe") Reported-by: BMK <bmktuwien@gmail.com> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-05-08 07:21:54 +02:00
Greg Kroah-Hartman	dda1dd3ba3	This is the 4.19.39 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlzNPTYACgkQONu9yGCS aT5+LA//TEZMvKwfq8ASsp17ncB9jNrV9G5gwwTv4Aa+Zv16LN5pLhlTwqJE1JCc wJzisFxCGNil0LTZYlpTwGnPvjNB4MPqyMEU5B7GkLsbRCjCJCZUpCEhrsEhR6D+ finLDnSAHh8+c/kvETIazvzTw9BP8YUDe7j933L54pXONfAHUvYDkz57ri5oEyIE 9g+Haot6gytgnPH1iU3A+uSjMll2naBHT1ga7F6fqU6EuhIogtEepG1Y6TWT6zfQ IDO4HZwMhdi75ITkv06lh/1zdQaMaGWE+R7svKfQ5UoH89eIUvRjKl8Pkdd5JPha 1LOz5HBBTxCZdzl70UF8n0ZzlNYP71rQ1CT4bo+U4kPNWNvKZb2MxJEOxB7/JqJo qNrv1lBE1ERBM5s8NlTSx1P+RSs3G6kLhDIgz+uB8ALl87zDkwUA7ynP13NFsP2c QY7E0eianWSYJxrqhkgWXQ/ToYRLsCBARvAHMZgDveVUNe83SyK1NFhZD77weDSC WtirUFzKpw0ZtVjs8Ox6zh4HRtAFXsyPvnlPbtrMdaU0GtEox2Skg7SKboEZfyUa 8nu98ZdEdzqAKKUOs2o/3vVFnq4NKmw1khpo1OEW5Ob76KdDHYGMiiGOYH1vEGY1 OxqNyNgw8/8OT6drCrAgx7+4X+BTXdiSXORUyp9AP7WpELwMy4Q= =35Eg -----END PGP SIGNATURE----- Merge 4.19.39 into android-4.19 Changes in 4.19.39 selinux: use kernel linux/socket.h for genheaders and mdp Revert "ACPICA: Clear status of GPEs before enabling them" mm: make page ref count overflow check tighter and more explicit mm: add 'try_get_page()' helper function mm: prevent get_user_pages() from overflowing page refcount fs: prevent page refcount overflow in pipe_buf_get ARM: dts: bcm283x: Fix hdmi hpd gpio pull s390: limit brk randomization to 32MB net: ieee802154: fix a potential NULL pointer dereference ieee802154: hwsim: propagate genlmsg_reply return code net: stmmac: don't set own bit too early for jumbo frames qlcnic: Avoid potential NULL pointer dereference xsk: fix umem memory leak on cleanup staging: axis-fifo: add CONFIG_OF dependency staging, mt7621-pci: fix build without pci support netfilter: nft_set_rbtree: check for inactive element after flag mismatch netfilter: bridge: set skb transport_header before entering NF_INET_PRE_ROUTING netfilter: fix NETFILTER_XT_TARGET_TEE dependencies netfilter: ip6t_srh: fix NULL pointer dereferences s390/qeth: fix race when initializing the IP address table ARM: imx51: fix a leaked reference by adding missing of_node_put sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init() serial: ar933x_uart: Fix build failure with disabled console KVM: arm64: Reset the PMU in preemptible context KVM: arm/arm64: vgic-its: Take the srcu lock when writing to guest memory KVM: arm/arm64: vgic-its: Take the srcu lock when parsing the memslots usb: dwc3: pci: add support for Comet Lake PCH ID usb: gadget: net2280: Fix overrun of OUT messages usb: gadget: net2280: Fix net2280_dequeue() usb: gadget: net2272: Fix net2272_dequeue() ARM: dts: pfla02: increase phy reset duration i2c: i801: Add support for Intel Comet Lake net: ks8851: Dequeue RX packets explicitly net: ks8851: Reassert reset pin if chip ID check fails net: ks8851: Delay requesting IRQ until opened net: ks8851: Set initial carrier state to down staging: rtl8188eu: Fix potential NULL pointer dereference of kcalloc staging: rtlwifi: rtl8822b: fix to avoid potential NULL pointer dereference staging: rtl8712: uninitialized memory in read_bbreg_hdl() staging: rtlwifi: Fix potential NULL pointer dereference of kzalloc net: macb: Add null check for PCLK and HCLK net/sched: don't dereference a->goto_chain to read the chain index ARM: dts: imx6qdl: Fix typo in imx6qdl-icore-rqs.dtsi drm/tegra: hub: Fix dereference before check NFS: Fix a typo in nfs_init_timeout_values() net: xilinx: fix possible object reference leak net: ibm: fix possible object reference leak net: ethernet: ti: fix possible object reference leak drm: Fix drm_release() and device unplug gpio: aspeed: fix a potential NULL pointer dereference drm/meson: Fix invalid pointer in meson_drv_unbind() drm/meson: Uninstall IRQ handler ARM: davinci: fix build failure with allnoconfig scsi: mpt3sas: Fix kernel panic during expander reset scsi: aacraid: Insure we don't access PCIe space during AER/EEH scsi: qla4xxx: fix a potential NULL pointer dereference usb: usb251xb: fix to avoid potential NULL pointer dereference leds: trigger: netdev: fix refcnt leak on interface rename x86/realmode: Don't leak the trampoline kernel address usb: u132-hcd: fix resource leak ceph: fix use-after-free on symlink traversal scsi: zfcp: reduce flood of fcrscn1 trace records on multi-element RSCN x86/mm: Don't exceed the valid physical address space libata: fix using DMA buffers on stack gpio: of: Fix of_gpiochip_add() error path nvme-multipath: relax ANA state check perf machine: Update kernel map address and re-order properly kconfig/[mn]conf: handle backspace (^H) key iommu/amd: Reserve exclusion range in iova-domain ptrace: take into account saved_sigmask in PTRACE{GET,SET}SIGMASK leds: pca9532: fix a potential NULL pointer dereference leds: trigger: netdev: use memcpy in device_name_store Linux 4.19.39 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2019-05-04 09:28:59 +02:00
Paulo Alcantara	145f6a70bb	selinux: use kernel linux/socket.h for genheaders and mdp ... commit dfbd199a7c upstream. When compiling genheaders and mdp from a newer host kernel, the following error happens: In file included from scripts/selinux/genheaders/genheaders.c:18: ./security/selinux/include/classmap.h:238:2: error: #error New address family defined, please update secclass_map. #error New address family defined, please update secclass_map. ^~~~~ make[3]: *** [scripts/Makefile.host:107: scripts/selinux/genheaders/genheaders] Error 1 make[2]: *** [scripts/Makefile.build:599: scripts/selinux/genheaders] Error 2 make[1]: *** [scripts/Makefile.build:599: scripts/selinux] Error 2 make[1]: *** Waiting for unfinished jobs.... Instead of relying on the host definition, include linux/socket.h in classmap.h to have PF_MAX. Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara <paulo@paulo.ac> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> [PM: manually merge in mdp.c, subject line tweaks] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-05-04 09:20:10 +02:00
Greg Kroah-Hartman	9bf5904866	This is the 4.19.37 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlzEBokACgkQONu9yGCS aT7G7w/8C93URGM67H7ynkCHTo8y3hkRE2rUJPckJNdS+IJKuecmOphak4tF0h07 qPWDPya70Q1S0cNu661TuVAGrhmE5jBx8/xfZaAOeaaU0xtZive+TfSHdAQQaHct tDk32O85N1aZ49rDEz9ibr7CGLVFDZtyhxV5gFMYQpjbqA7MzJC61zQg1jHyPSCz sKjQzW+uXMuSLru8jXHMvp41K5sFFp5gYdQbAVKlWtt79qPxWdxZPJbLbM0LBbtz XHt9E45Ink3ALF9P6tZ4e6gi4zzlNbh9yR92+X5NK5/8AP57yWba4W9JHWIfMBpC yyDYTOEAzdxqa2Jrgwr4WTdKH6U7FbQZFmWfTBB4VotbHLBWkVXj0OnF10qxP9eQ p5wGDTJAlWezhX1BTCfYroglDsvqhj+gHfwHzDRF1Del1dRgydRMQc0qLD1d9tul ovzwOkx1xyJrM2wq05I5gc0FoVyOL6/KCwqMrpVfKa3WKY7Uttjgf56bMqdIIkns i/6opzF+wtvwlLlCoXgYPXdm6kbWdgvS+skVHfWcHmZFMuGrFGGzJNwzXb7qnVjK T0hD1OestsfTyD/amnDNYkNeCkoOZqtHAi+xYOQR4kGY5cxP1lQJf85MgAy6RZSY h+rjys76Qf6+hTCtrowLr8SgksX4ACWxm+UarfAiiNnnDXwGfu8= =SrFV -----END PGP SIGNATURE----- Merge 4.19.37 into android-4.19 Changes in 4.19.37 bonding: fix event handling for stacked bonds failover: allow name change on IFF_UP slave interfaces net: atm: Fix potential Spectre v1 vulnerabilities net: bridge: fix per-port af_packet sockets net: bridge: multicast: use rcu to access port list from br_multicast_start_querier net: Fix missing meta data in skb with vlan packet net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv tcp: tcp_grow_window() needs to respect tcp_space() team: set slave to promisc if team is already in promisc mode tipc: missing entries in name table of publications vhost: reject zero size iova range ipv4: recompile ip options in ipv4_link_failure ipv4: ensure rcu_read_lock() in ipv4_link_failure() net: thunderx: raise XDP MTU to 1508 net: thunderx: don't allow jumbo frames with XDP net/mlx5: FPGA, tls, hold rcu read lock a bit longer net/tls: prevent bad memory access in tls_is_sk_tx_device_offloaded() net/mlx5: FPGA, tls, idr remove on flow delete route: Avoid crash from dereferencing NULL rt->from sch_cake: Use tc_skb_protocol() helper for getting packet protocol sch_cake: Make sure we can write the IP header before changing DSCP bits nfp: flower: replace CFI with vlan present nfp: flower: remove vlan CFI bit from push vlan action sch_cake: Simplify logic in cake_select_tin() net: IP defrag: encapsulate rbtree defrag code into callable functions net: IP6 defrag: use rbtrees for IPv6 defrag net: IP6 defrag: use rbtrees in nf_conntrack_reasm.c CIFS: keep FileInfo handle live during oplock break cifs: Fix use-after-free in SMB2_write cifs: Fix use-after-free in SMB2_read cifs: fix handle leak in smb2_query_symlink() KVM: x86: Don't clear EFER during SMM transitions for 32-bit vCPU KVM: x86: svm: make sure NMI is injected after nmi_singlestep Staging: iio: meter: fixed typo staging: iio: ad7192: Fix ad7193 channel address iio: gyro: mpu3050: fix chip ID reading iio/gyro/bmg160: Use millidegrees for temperature scale iio:chemical:bme680: Fix, report temperature in millidegrees iio:chemical:bme680: Fix SPI read interface iio: cros_ec: Fix the maths for gyro scale calculation iio: ad_sigma_delta: select channel when reading register iio: dac: mcp4725: add missing powerdown bits in store eeprom iio: Fix scan mask selection iio: adc: at91: disable adc channel interrupt in timeout case iio: core: fix a possible circular locking dependency io: accel: kxcjk1013: restore the range after resume. staging: most: core: use device description as name staging: comedi: vmk80xx: Fix use of uninitialized semaphore staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf staging: comedi: ni_usb6501: Fix use of uninitialized mutex staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf ALSA: hda/realtek - add two more pin configuration sets to quirk table ALSA: core: Fix card races between register and disconnect Input: elan_i2c - add hardware ID for multiple Lenovo laptops serial: sh-sci: Fix HSCIF RX sampling point adjustment serial: sh-sci: Fix HSCIF RX sampling point calculation vt: fix cursor when clearing the screen scsi: core: set result when the command cannot be dispatched Revert "scsi: fcoe: clear FC_RP_STARTED flags when receiving a LOGO" Revert "svm: Fix AVIC incomplete IPI emulation" coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping ipmi: fix sleep-in-atomic in free_user at cleanup SRCU user->release_barrier crypto: x86/poly1305 - fix overflow during partial reduction drm/ttm: fix out-of-bounds read in ttm_put_pages() v2 arm64: futex: Restore oldval initialization to work around buggy compilers x86/kprobes: Verify stack frame on kretprobe kprobes: Mark ftrace mcount handler functions nokprobe kprobes: Fix error check when reusing optimized probes rt2x00: do not increment sequence number while re-transmitting mac80211: do not call driver wake_tx_queue op during reconfig drm/amdgpu/gmc9: fix VM_L2_CNTL3 programming perf/x86/amd: Add event map for AMD Family 17h x86/cpu/bugs: Use __initconst for 'const' init data perf/x86: Fix incorrect PEBS_REGS x86/speculation: Prevent deadlock on ssb_state::lock timers/sched_clock: Prevent generic sched_clock wrap caused by tick_freeze() nfit/ars: Remove ars_start_flags nfit/ars: Introduce scrub_flags nfit/ars: Allow root to busy-poll the ARS state machine nfit/ars: Avoid stale ARS results mmc: sdhci: Fix data command CRC error handling mmc: sdhci: Rename SDHCI_ACMD12_ERR and SDHCI_INT_ACMD12ERR mmc: sdhci: Handle auto-command errors modpost: file2alias: go back to simple devtable lookup modpost: file2alias: check prototype of handler tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete tpm: Fix the type of the return value in calc_tpm2_event_size() Revert "kbuild: use -Oz instead of -Os when using clang" sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup device_cgroup: fix RCU imbalance in error case mm/vmstat.c: fix /proc/vmstat format for CONFIG_DEBUG_TLBFLUSH=y CONFIG_SMP=n ALSA: info: Fix racy addition/deletion of nodes percpu: stop printing kernel addresses tools include: Adopt linux/bits.h ASoC: rockchip: add missing INTERLEAVED PCM attribute i2c-hid: properly terminate i2c_hid_dmi_desc_override_table[] array Revert "locking/lockdep: Add debug_locks check in __lock_downgrade()" kernel/sysctl.c: fix out-of-bounds access when setting file-max Linux 4.19.37 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2019-04-30 12:53:00 +02:00
Jann Horn	628c99a836	device_cgroup: fix RCU imbalance in error case ... commit 0fcc4c8c04 upstream. When dev_exception_add() returns an error (due to a failed memory allocation), make sure that we move the RCU preemption count back to where it was before we were called. We dropped the RCU read lock inside the loop body, so we can't just "break". sparse complains about this, too: $ make -s C=2 security/device_cgroup.o ./include/linux/rcupdate.h:647:9: warning: context imbalance in 'propagate_exception' - unexpected unlock Fixes: d591fb5661 ("device_cgroup: simplify cgroup tree walk in propagate_exception()") Cc: stable@vger.kernel.org Signed-off-by: Jann Horn <jannh@google.com> Acked-by: Michal Hocko <mhocko@suse.com> Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-04-27 09:36:40 +02:00
Greg Kroah-Hartman	d885da678e	This is the 4.19.34 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlynu40ACgkQONu9yGCS aT5X6g//Wkfm/+qSZ0GhLDQkPniiH1QkvzhOmVrrxu+KB0qsiwsEl8Srw33ZVkJK LT8+IPGiG9jEGu9dj+BYXTIfy9ZvfSsEL2N6GhYwDSXP0fok2rUaHbZvv1IB2g4W afhGdNwNAUCJ/j1UrUsi+SAFJ+xWbVxFpGstd0cqM9IbKdEV7RIukvuKckHiKOKR qI8FxC+G2PAr+BtnETfk5/suPDJ7B3ZicDoMhiWJGxJ6dfFTVmkSmasSoPDaMiHm 4S3hN2lu+WTeRpRPPB17Dlk4MmIp0k+bGYBKAlaxAMCc/RZxvbT2pRYaMQbId2/L mNUfSnOQFGEAhlAPfb7wdbObphnyT34GhlkWfZBTrnhPO0/FomLOvU6xVdcNuakX Tv2JKfDzb+2ttcMZ+0T84Ru9RztoswFATSw8uFMVxW8oTS6MVWnHu96Kxfl7QO3J PdlIGcyqxSuWNE8OX1QVtdSruGZfwUDNs94S4nQJtkB8BViRwhGJlqaXuy4d9Wp6 fGlI2W6qhjyosi2wBSMTjh/ytk/jq0vfs+z2XjR2gAYssvB/SOLR/AlSVguWsDnf WaoFBkXvCbuPvPlo0TrLpl5RW5WlOtLXHE3Vr3dKp458wLwpf/OZBGoZiknp7DrF PzBZs2ie5tmyqTxbAygl7WkbQPJ682pd5R4nf5CY+zvUaOMZv1g= =Iuup -----END PGP SIGNATURE----- Merge 4.19.34 into android-4.19 Changes in 4.19.34 arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals ext4: cleanup bh release code in ext4_ind_remove_space() tty/serial: atmel: Add is_half_duplex helper tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped CIFS: fix POSIX lock leak and invalid ptr deref h8300: use cc-cross-prefix instead of hardcoding h8300-unknown-linux- f2fs: fix to adapt small inline xattr space in __find_inline_xattr() f2fs: fix to avoid deadlock in f2fs_read_inline_dir() tracing: kdb: Fix ftdump to not sleep net/mlx5: Avoid panic when setting vport rate net/mlx5: Avoid panic when setting vport mac, getting vport config gpio: gpio-omap: fix level interrupt idling include/linux/relay.h: fix percpu annotation in struct rchan sysctl: handle overflow for file-max net: stmmac: Avoid sometimes uninitialized Clang warnings enic: fix build warning without CONFIG_CPUMASK_OFFSTACK libbpf: force fixdep compilation at the start of the build scsi: hisi_sas: Set PHY linkrate when disconnected scsi: hisi_sas: Fix a timeout race of driver internal and SMP IO iio: adc: fix warning in Qualcomm PM8xxx HK/XOADC driver x86/hyperv: Fix kernel panic when kexec on HyperV perf c2c: Fix c2c report for empty numa node mm/sparse: fix a bad comparison mm/cma.c: cma_declare_contiguous: correct err handling mm/page_ext.c: fix an imbalance with kmemleak mm, swap: bounds check swap_info array accesses to avoid NULL derefs mm,oom: don't kill global init via memory.oom.group memcg: killed threads should not invoke memcg OOM killer mm, mempolicy: fix uninit memory access mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512! mm/slab.c: kmemleak no scan alien caches ocfs2: fix a panic problem caused by o2cb_ctl f2fs: do not use mutex lock in atomic context fs/file.c: initialize init_files.resize_wait page_poison: play nicely with KASAN cifs: use correct format characters dm thin: add sanity checks to thin-pool and external snapshot creation f2fs: fix to check inline_xattr_size boundary correctly cifs: Accept validate negotiate if server return NT_STATUS_NOT_SUPPORTED cifs: Fix NULL pointer dereference of devname netfilter: nf_tables: check the result of dereferencing base_chain->stats netfilter: conntrack: tcp: only close if RST matches exact sequence jbd2: fix invalid descriptor block checksum fs: fix guard_bio_eod to check for real EOD errors tools lib traceevent: Fix buffer overflow in arg_eval PCI/PME: Fix hotplug/sysfs remove deadlock in pcie_pme_remove() wil6210: check null pointer in _wil_cfg80211_merge_extra_ies mt76: fix a leaked reference by adding a missing of_node_put crypto: crypto4xx - add missing of_node_put after of_device_is_available crypto: cavium/zip - fix collision with generic cra_driver_name usb: chipidea: Grab the (legacy) USB PHY by phandle first powerpc/powernv/ioda: Fix locked_vm counting for memory used by IOMMU tables scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c kbuild: invoke syncconfig if include/config/auto.conf.cmd is missing powerpc/xmon: Fix opcode being uninitialized in print_insn_powerpc coresight: etm4x: Add support to enable ETMv4.2 serial: 8250_pxa: honor the port number from devicetree ARM: 8840/1: use a raw_spinlock_t in unwind iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables powerpc/hugetlb: Handle mmap_min_addr correctly in get_unmapped_area callback btrfs: qgroup: Make qgroup async transaction commit more aggressive mmc: omap: fix the maximum timeout setting net: dsa: mv88e6xxx: Add lockdep classes to fix false positive splat e1000e: Fix -Wformat-truncation warnings mlxsw: spectrum: Avoid -Wformat-truncation warnings platform/x86: ideapad-laptop: Fix no_hw_rfkill_list for Lenovo RESCUER R720-15IKBN platform/mellanox: mlxreg-hotplug: Fix KASAN warning loop: set GENHD_FL_NO_PART_SCAN after blkdev_reread_part() IB/mlx4: Increase the timeout for CM cache clk: fractional-divider: check parent rate only if flag is set perf annotate: Fix getting source line failure ASoC: qcom: Fix of-node refcount unbalance in qcom_snd_parse_of() cpufreq: acpi-cpufreq: Report if CPU doesn't support boost technologies efi: cper: Fix possible out-of-bounds access s390/ism: ignore some errors during deregistration scsi: megaraid_sas: return error when create DMA pool failed scsi: fcoe: make use of fip_mode enum complete drm/amd/display: Clear stream->mode_changed after commit perf test: Fix failure of 'evsel-tp-sched' test on s390 mwifiex: don't advertise IBSS features without FW support perf report: Don't shadow inlined symbol with different addr range SoC: imx-sgtl5000: add missing put_device() media: ov7740: fix runtime pm initialization media: sh_veu: Correct return type for mem2mem buffer helpers media: s5p-jpeg: Correct return type for mem2mem buffer helpers media: rockchip/rga: Correct return type for mem2mem buffer helpers media: s5p-g2d: Correct return type for mem2mem buffer helpers media: mx2_emmaprp: Correct return type for mem2mem buffer helpers media: mtk-jpeg: Correct return type for mem2mem buffer helpers mt76: usb: do not run mt76u_queues_deinit twice xen/gntdev: Do not destroy context while dma-bufs are in use vfs: fix preadv64v2 and pwritev64v2 compat syscalls with offset == -1 HID: intel-ish-hid: avoid binding wrong ishtp_cl_device cgroup, rstat: Don't flush subtree root unless necessary jbd2: fix race when writing superblock leds: lp55xx: fix null deref on firmware load failure perf report: Add s390 diagnosic sampling descriptor size iwlwifi: pcie: fix emergency path ACPI / video: Refactor and fix dmi_is_desktop() selftests: skip seccomp get_metadata test if not real root kprobes: Prohibit probing on bsearch() kprobes: Prohibit probing on RCU debug routine netfilter: conntrack: fix cloned unconfirmed skb->_nfct race in __nf_conntrack_confirm ARM: 8833/1: Ensure that NEON code always compiles with Clang ARM: dts: meson8b: fix the Ethernet data line signals in eth_rgmii_pins ALSA: PCM: check if ops are defined before suspending PCM ath10k: fix shadow register implementation for WCN3990 usb: f_fs: Avoid crash due to out-of-scope stack ptr access sched/topology: Fix percpu data types in struct sd_data & struct s_data bcache: fix input overflow to cache set sysfs file io_error_halflife bcache: fix input overflow to sequential_cutoff bcache: fix potential div-zero error of writeback_rate_i_term_inverse bcache: improve sysfs_strtoul_clamp() genirq: Avoid summation loops for /proc/stat net: marvell: mvpp2: fix stuck in-band SGMII negotiation iw_cxgb4: fix srqidx leak during connection abort net: phy: consider latched link-down status in polling mode fbdev: fbmem: fix memory access if logo is bigger than the screen cdrom: Fix race condition in cdrom_sysctl_register drm: rcar-du: add missing of_node_put drm/amd/display: Don't re-program planes for DPMS changes drm/amd/display: Disconnect mpcc when changing tg perf/aux: Make perf_event accessible to setup_aux() e1000e: fix cyclic resets at link up with active tx e1000e: Exclude device from suspend direct complete optimization platform/x86: intel_pmc_core: Fix PCH IP sts reading i2c: of: Try to find an I2C adapter matching the parent staging: spi: mt7621: Add return code check on device_reset() iwlwifi: mvm: fix RFH config command with >=10 CPUs ASoC: fsl-asoc-card: fix object reference leaks in fsl_asoc_card_probe sched/debug: Initialize sd_sysctl_cpus if !CONFIG_CPUMASK_OFFSTACK efi/memattr: Don't bail on zero VA if it equals the region's PA sched/core: Use READ_ONCE()/WRITE_ONCE() in move_queued_task()/task_rq_lock() drm/vkms: Bugfix extra vblank frame ARM: dts: lpc32xx: Remove leading 0x and 0s from bindings notation efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted soc: qcom: gsbi: Fix error handling in gsbi_probe() mt7601u: bump supported EEPROM version ARM: 8830/1: NOMMU: Toggle only bits in EXC_RETURN we are really care of ARM: avoid Cortex-A9 livelock on tight dmb loops block, bfq: fix in-service-queue check for queue merging bpf: fix missing prototype warnings selftests/bpf: skip verifier tests for unsupported program types powerpc/64s: Clear on-stack exception marker upon exception return cgroup/pids: turn cgroup_subsys->free() into cgroup_subsys->release() to fix the accounting backlight: pwm_bl: Use gpiod_get_value_cansleep() to get initial state tty: increase the default flip buffer limit to 2*640K powerpc/pseries: Perform full re-add of CPU for topology update post-migration drm/amd/display: Enable vblank interrupt during CRC capture ALSA: dice: add support for Solid State Logic Duende Classic/Mini usb: dwc3: gadget: Fix OTG events when gadget driver isn't loaded platform/x86: intel-hid: Missing power button release on some Dell models perf script python: Use PyBytes for attr in trace-event-python perf script python: Add trace_context extension module to sys.modules media: mt9m111: set initial frame size other than 0x0 hwrng: virtio - Avoid repeated init of completion soc/tegra: fuse: Fix illegal free of IO base address HID: intel-ish: ipc: handle PIMR before ish_wakeup also clear PISR busy_clear bit f2fs: UBSAN: set boolean value iostat_enable correctly hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable cpu/hotplug: Mute hotplug lockdep during init dmaengine: imx-dma: fix warning comparison of distinct pointer types dmaengine: qcom_hidma: assign channel cookie correctly dmaengine: qcom_hidma: initialize tx flags in hidma_prep_dma_* netfilter: physdev: relax br_netfilter dependency media: rcar-vin: Allow independent VIN link enablement media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting pinctrl: meson: meson8b: add the eth_rxd2 and eth_rxd3 pins drm: Auto-set allow_fb_modifiers when given modifiers at plane init drm/nouveau: Stop using drm_crtc_force_disable x86/build: Specify elf_i386 linker emulation explicitly for i386 objects selinux: do not override context on context mounts brcmfmac: Use firmware_request_nowarn for the clm_blob wlcore: Fix memory leak in case wl12xx_fetch_firmware failure x86/build: Mark per-CPU symbols as absolute explicitly for LLD drm/fb-helper: fix leaks in error path of drm_fb_helper_fbdev_setup clk: meson: clean-up clock registration clk: rockchip: fix frac settings of GPLL clock for rk3328 dmaengine: tegra: avoid overflow of byte tracking Input: soc_button_array - fix mapping of the 5th GPIO in a PNP0C40 device drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers net: stmmac: Avoid one more sometimes uninitialized Clang warning ACPI / video: Extend chassis-type detection with a "Lunch Box" check bcache: fix potential div-zero error of writeback_rate_p_term_inverse kprobes/x86: Blacklist non-attachable interrupt functions Linux 4.19.34 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2019-04-05 22:43:09 +02:00
Ondrej Mosnacek	e30e0b0915	selinux: do not override context on context mounts ... [ Upstream commit 53e0c2aa9a ] Ignore all selinux_inode_notifysecctx() calls on mounts with SBLABEL_MNT flag unset. This is achived by returning -EOPNOTSUPP for this case in selinux_inode_setsecurtity() (because that function should not be called in such case anyway) and translating this error to 0 in selinux_inode_notifysecctx(). This fixes behavior of kernfs-based filesystems when mounted with the 'context=' option. Before this patch, if a node's context had been explicitly set to a non-default value and later the filesystem has been remounted with the 'context=' option, then this node would show up as having the manually-set context and not the mount-specified one. Steps to reproduce: # mount -t cgroup2 cgroup2 /sys/fs/cgroup/unified # chcon unconfined_u:object_r:user_home_t:s0 /sys/fs/cgroup/unified/cgroup.stat # ls -lZ /sys/fs/cgroup/unified total 0 -r--r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.controllers -rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.max.depth -rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.max.descendants -rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.procs -r--r--r--. 1 root root unconfined_u:object_r:user_home_t:s0 0 Dec 13 10:41 cgroup.stat -rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.subtree_control -rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.threads # umount /sys/fs/cgroup/unified # mount -o context=system_u:object_r:tmpfs_t:s0 -t cgroup2 cgroup2 /sys/fs/cgroup/unified Result before: # ls -lZ /sys/fs/cgroup/unified total 0 -r--r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.controllers -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.max.depth -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.max.descendants -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.procs -r--r--r--. 1 root root unconfined_u:object_r:user_home_t:s0 0 Dec 13 10:41 cgroup.stat -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.subtree_control -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.threads Result after: # ls -lZ /sys/fs/cgroup/unified total 0 -r--r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.controllers -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.max.depth -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.max.descendants -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.procs -r--r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.stat -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.subtree_control -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.threads Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Reviewed-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2019-04-05 22:33:16 +02:00
Greg Kroah-Hartman	bb418a146a	This is the 4.19.31 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlyWhJcACgkQONu9yGCS aT6XzxAAzP2QGzC4SVPgcFH1woF/d8Cz0zQ81mLXzjXtEPm39fZCM2hbBnxkXLu1 peFyrKNk6/c9541D9gsQCQT6Fu+H6u1bJKcIezlKJ2xyB/MsU1hXkjZrTJYW3RRs gimy1EGdood2el1ubEBZiaspazoeRzBqtg1Nsmr4V0l+RT8HwtKKw+0+Nxixfp59 NoVkqTpPI5mL0FiH2R9ogcfg3SvgMZOsOhOBjdPvSjiJJsbvIWcW48MCs95XSUpF R+l/fWn+oiFCcIqBaFheujuqZMvVrUHZHaWAPMuoR/c3Cdf0lTBokdv6UM9c0nv3 61jX5r5ImRI/dfQANN5mbB1YKcs5xOI+I7QZHQ2q4clsWrWyLapXW4clrAZJ6z5t UVeVbuLV2y5PL9GJyBcXpyY0BOf4e2gZURaPY3C5McNwgybNoiR0ZePqKb8ZhZyh jYOYRoBjJJpZoVTSt6MNX95NTvGaSAtqKMu1s3IeMfpwCfQKBPMOuBHr/dUqSC6I U0xxjk/71C15dSPVcTVJT/lmcKc6TXgoagnfbn8GBtDOAjBNsYyUJLQI+db1ERCe 9MEB9k1Z87ROQ5jQCQmWsewOVAtFZBEvSszFmpKv3zTe8M2oFpXG56zckdiumwHU nSfeZTTeWzsFJd30MioEnGYm3ZwKwZx7wi0x4B4WWvBfSpp20Us= =xtLx -----END PGP SIGNATURE----- Merge 4.19.31 into android-4.19 Changes in 4.19.31 media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused() 9p: use inode->i_lock to protect i_size_write() under 32-bit 9p/net: fix memory leak in p9_client_create ASoC: fsl_esai: fix register setting issue in RIGHT_J mode ASoC: codecs: pcm186x: fix wrong usage of DECLARE_TLV_DB_SCALE() ASoC: codecs: pcm186x: Fix energysense SLEEP bit iio: adc: exynos-adc: Fix NULL pointer exception on unbind mei: hbm: clean the feature flags on link reset mei: bus: move hw module get/put to probe/release stm class: Fix an endless loop in channel allocation crypto: caam - fix hash context DMA unmap size crypto: ccree - fix missing break in switch statement crypto: caam - fixed handling of sg list crypto: caam - fix DMA mapping of stack memory crypto: ccree - fix free of unallocated mlli buffer crypto: ccree - unmap buffer before copying IV crypto: ccree - don't copy zero size ciphertext crypto: cfb - add missing 'chunksize' property crypto: cfb - remove bogus memcpy() with src == dest crypto: ahash - fix another early termination in hash walk crypto: rockchip - fix scatterlist nents error crypto: rockchip - update new iv to device in multiple operations drm/imx: ignore plane updates on disabled crtcs gpu: ipu-v3: Fix i.MX51 CSI control registers offset drm/imx: imx-ldb: add missing of_node_puts gpu: ipu-v3: Fix CSI offsets for imx53 ASoC: rt5682: Correct the setting while select ASRC clk for AD/DA filter clocksource: timer-ti-dm: Fix pwm dmtimer usage of fck reparenting KVM: arm/arm64: vgic: Make vgic_dist->lpi_list_lock a raw_spinlock arm64: dts: rockchip: fix graph_port warning on rk3399 bob kevin and excavator s390/dasd: fix using offset into zero size array error Input: pwm-vibra - prevent unbalanced regulator Input: pwm-vibra - stop regulator after disabling pwm, not before ARM: dts: Configure clock parent for pwm vibra ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized ASoC: dapm: fix out-of-bounds accesses to DAPM lookup tables ASoC: rsnd: fixup rsnd_ssi_master_clk_start() user count check KVM: arm/arm64: Reset the VCPU without preemption and vcpu state loaded arm/arm64: KVM: Allow a VCPU to fully reset itself arm/arm64: KVM: Don't panic on failure to properly reset system registers KVM: arm/arm64: vgic: Always initialize the group of private IRQs KVM: arm64: Forbid kprobing of the VHE world-switch code ASoC: samsung: Prevent clk_get_rate() calls in atomic context ARM: OMAP2+: fix lack of timer interrupts on CPU1 after hotplug Input: cap11xx - switch to using set_brightness_blocking() Input: ps2-gpio - flush TX work when closing port Input: matrix_keypad - use flush_delayed_work() mac80211: call drv_ibss_join() on restart mac80211: Fix Tx aggregation session tear down with ITXQs netfilter: compat: initialize all fields in xt_init blk-mq: insert rq with DONTPREP to hctx dispatch list when requeue ipvs: fix dependency on nf_defrag_ipv6 floppy: check_events callback should not return a negative number xprtrdma: Make sure Send CQ is allocated on an existing compvec NFS: Don't use page_file_mapping after removing the page mm/gup: fix gup_pmd_range() for dax Revert "mm: use early_pfn_to_nid in page_ext_init" scsi: qla2xxx: Fix panic from use after free in qla2x00_async_tm_cmd net: dsa: bcm_sf2: potential array overflow in bcm_sf2_sw_suspend() x86/CPU: Add Icelake model number mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs net: hns: Fix object reference leaks in hns_dsaf_roce_reset() i2c: cadence: Fix the hold bit setting i2c: bcm2835: Clear current buffer pointers and counts after a transfer auxdisplay: ht16k33: fix potential user-after-free on module unload Input: st-keyscan - fix potential zalloc NULL dereference clk: sunxi-ng: v3s: Fix TCON reset de-assert bit kallsyms: Handle too long symbols in kallsyms.c clk: sunxi: A31: Fix wrong AHB gate number esp: Skip TX bytes accounting when sending from a request socket ARM: 8824/1: fix a migrating irq bug when hotplug cpu bpf: only adjust gso_size on bytestream protocols bpf: fix lockdep false positive in stackmap af_key: unconditionally clone on broadcast ARM: 8835/1: dma-mapping: Clear DMA ops on teardown assoc_array: Fix shortcut creation keys: Fix dependency loop between construction record and auth key scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task net: systemport: Fix reception of BPDUs net: dsa: bcm_sf2: Do not assume DSA master supports WoL pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins qmi_wwan: apply SET_DTR quirk to Sierra WP7607 net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe() xfrm: Fix inbound traffic via XFRM interfaces across network namespaces mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush timeout issue ASoC: topology: free created components in tplg load error qed: Fix iWARP buffer size provided for syn packet processing. qed: Fix iWARP syn packet mac address validation. ARM: dts: armada-xp: fix Armada XP boards NAND description arm64: Relax GIC version check during early boot ARM: tegra: Restore DT ABI on Tegra124 Chromebooks net: marvell: mvneta: fix DMA debug warning mm: handle lru_add_drain_all for UP properly tmpfs: fix link accounting when a tmpfile is linked in ixgbe: fix older devices that do not support IXGBE_MRQC_L3L4TXSWEN ARCv2: lib: memcpy: fix doing prefetchw outside of buffer ARC: uacces: remove lp_start, lp_end from clobber list ARCv2: support manual regfile save on interrupts ARCv2: don't assume core 0x54 has dual issue phonet: fix building with clang mac80211_hwsim: propagate genlmsg_reply return code bpf, lpm: fix lookup bug in map_delete_elem net: thunderx: make CFG_DONE message to run through generic send-ack sequence net: thunderx: add nicvf_send_msg_to_pf result check for set_rx_mode_task nfp: bpf: fix code-gen bug on BPF_ALU | BPF_XOR | BPF_K nfp: bpf: fix ALU32 high bits clearance bug bnxt_en: Fix typo in firmware message timeout logic. bnxt_en: Wait longer for the firmware message response to complete. net: set static variable an initial value in atl2_probe() selftests: fib_tests: sleep after changing carrier. again. tmpfs: fix uninitialized return value in shmem_link stm class: Prevent division by zero nfit: acpi_nfit_ctl(): Check out_obj->type in the right place acpi/nfit: Fix bus command validation nfit/ars: Attempt a short-ARS whenever the ARS state is idle at boot nfit/ars: Attempt short-ARS even in the no_init_ars case libnvdimm/label: Clear 'updating' flag after label-set update libnvdimm, pfn: Fix over-trim in trim_pfn_device() libnvdimm/pmem: Honor force_raw for legacy pmem regions libnvdimm: Fix altmap reservation size calculation fix cgroup_do_mount() handling of failure exits crypto: aead - set CRYPTO_TFM_NEED_KEY if ->setkey() fails crypto: aegis - fix handling chunked inputs crypto: arm/crct10dif - revert to C code for short inputs crypto: arm64/aes-neonbs - fix returning final keystream block crypto: arm64/crct10dif - revert to C code for short inputs crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails crypto: morus - fix handling chunked inputs crypto: pcbc - remove bogus memcpy()s with src == dest crypto: skcipher - set CRYPTO_TFM_NEED_KEY if ->setkey() fails crypto: testmgr - skip crc32c context test for ahash algorithms crypto: x86/aegis - fix handling chunked inputs and MAY_SLEEP crypto: x86/aesni-gcm - fix crash on empty plaintext crypto: x86/morus - fix handling chunked inputs and MAY_SLEEP crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling crypto: arm64/aes-ccm - fix bugs in non-NEON fallback routine CIFS: Do not reset lease state to NONE on lease break CIFS: Do not skip SMB2 message IDs on send failures CIFS: Fix read after write for files with read caching tracing: Use strncpy instead of memcpy for string keys in hist triggers tracing: Do not free iter->trace in fail path of tracing_open_pipe() tracing/perf: Use strndup_user() instead of buggy open-coded version xen: fix dom0 boot on huge systems ACPI / device_sysfs: Avoid OF modalias creation for removed device mmc: sdhci-esdhc-imx: fix HS400 timing issue mmc:fix a bug when max_discard is 0 netfilter: ipt_CLUSTERIP: fix warning unused variable cn spi: ti-qspi: Fix mmap read when more than one CS in use spi: pxa2xx: Setup maximum supported DMA transfer length regulator: s2mps11: Fix steps for buck7, buck8 and LDO35 regulator: max77620: Initialize values for DT properties regulator: s2mpa01: Fix step values for some LDOs clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown clocksource/drivers/arch_timer: Workaround for Allwinner A64 timer instability s390/setup: fix early warning messages s390/virtio: handle find on invalid queue gracefully scsi: virtio_scsi: don't send sc payload with tmfs scsi: aacraid: Fix performance issue on logical drives scsi: sd: Optimal I/O size should be a multiple of physical block size scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock scsi: qla2xxx: Fix LUN discovery if loop id is not assigned yet by firmware fs/devpts: always delete dcache dentry-s in dput() splice: don't merge into linked buffers ovl: During copy up, first copy up data and then xattrs ovl: Do not lose security.capability xattr over metadata file copy-up m68k: Add -ffreestanding to CFLAGS Btrfs: setup a nofs context for memory allocation at btrfs_create_tree() Btrfs: setup a nofs context for memory allocation at __btrfs_set_acl btrfs: ensure that a DUP or RAID1 block group has exactly two stripes Btrfs: fix corruption reading shared and compressed extents after hole punching soc: qcom: rpmh: Avoid accessing freed memory from batch API libertas_tf: don't set URB_ZERO_PACKET on IN USB transfer irqchip/gic-v3-its: Avoid parsing _indirect_ twice for Device table irqchip/brcmstb-l2: Use _irqsave locking variants in non-interrupt code x86/kprobes: Prohibit probing on optprobe template code cpufreq: kryo: Release OPP tables on module removal cpufreq: tegra124: add missing of_node_put() cpufreq: pxa2xx: remove incorrect __init annotation ext4: fix check of inode in swap_inode_boot_loader ext4: cleanup pagecache before swap i_data ext4: update quota information while swapping boot loader inode ext4: add mask of ext4 flags to swap ext4: fix crash during online resizing PCI/ASPM: Use LTR if already enabled by platform PCI/DPC: Fix print AER status in DPC event handling PCI: dwc: skip MSI init if MSIs have been explicitly disabled IB/hfi1: Close race condition on user context disable and close cxl: Wrap iterations over afu slices inside 'afu_list_lock' ext2: Fix underflow in ext2_max_size() clk: uniphier: Fix update register for CPU-gear clk: clk-twl6040: Fix imprecise external abort for pdmclk clk: samsung: exynos5: Fix possible NULL pointer exception on platform_device_alloc() failure clk: samsung: exynos5: Fix kfree() of const memory on setting driver_override clk: ingenic: Fix round_rate misbehaving with non-integer dividers clk: ingenic: Fix doc of ingenic_cgu_div_info usb: chipidea: tegra: Fix missed ci_hdrc_remove_device() usb: typec: tps6598x: handle block writes separately with plain-I2C adapters dmaengine: usb-dmac: Make DMAC system sleep callbacks explicit mm: hwpoison: fix thp split handing in soft_offline_in_use_page() mm/vmalloc: fix size check for remap_vmalloc_range_partial() mm/memory.c: do_fault: avoid usage of stale vm_area_struct kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv device property: Fix the length used in PROPERTY_ENTRY_STRING() intel_th: Don't reference unassigned outputs parport_pc: fix find_superio io compare code, should use equal test. i2c: tegra: fix maximum transfer size media: i2c: ov5640: Fix post-reset delay gpio: pca953x: Fix dereference of irq data in shutdown can: flexcan: FLEXCAN_IFLAG_MB: add () around macro argument drm/i915: Relax mmap VMA check bpf: only test gso type on gso packets serial: uartps: Fix stuck ISR if RX disabled with non-empty FIFO serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart serial: 8250_pci: Fix number of ports for ACCES serial cards serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup() jbd2: clear dirty flag when revoking a buffer from an older transaction jbd2: fix compile warning when using JBUFFER_TRACE selinux: add the missing walk_size + len check in selinux_sctp_bind_connect security/selinux: fix SECURITY_LSM_NATIVE_LABELS on reused superblock powerpc/32: Clear on-stack exception marker upon exception return powerpc/wii: properly disable use of BATs when requested. powerpc/powernv: Make opal log only readable by root powerpc/83xx: Also save/restore SPRG4-7 during suspend powerpc/powernv: Don't reprogram SLW image on every KVM guest entry/exit powerpc: Fix 32-bit KVM-PR lockup and host crash with MacOS guest powerpc/ptrace: Simplify vr_get/set() to avoid GCC warning powerpc/hugetlb: Don't do runtime allocation of 16G pages in LPAR configuration powerpc/traps: fix recoverability of machine check handling on book3s/32 powerpc/traps: Fix the message printed when stack overflows ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify arm64: Fix HCR.TGE status for NMI contexts arm64: debug: Ensure debug handlers check triggering exception level arm64: KVM: Fix architecturally invalid reset value for FPEXC32_EL2 ipmi_si: fix use-after-free of resource->name dm: fix to_sector() for 32bit dm integrity: limit the rate of error messages mfd: sm501: Fix potential NULL pointer dereference cpcap-charger: generate events for userspace NFS: Fix I/O request leakages NFS: Fix an I/O request leakage in nfs_do_recoalesce NFS: Don't recoalesce on error in nfs_pageio_complete_mirror() nfsd: fix performance-limiting session calculation nfsd: fix memory corruption caused by readdir nfsd: fix wrong check in write_v4_end_grace() NFSv4.1: Reinitialise sequence results before retransmitting a request svcrpc: fix UDP on servers with lots of threads PM / wakeup: Rework wakeup source timer cancellation bcache: never writeback a discard operation stable-kernel-rules.rst: add link to networking patch queue vt: perform safe console erase in the right order x86/unwind/orc: Fix ORC unwind table alignment perf intel-pt: Fix CYC timestamp calculation after OVF perf tools: Fix split_kallsyms_for_kcore() for trampoline symbols perf auxtrace: Define auxtrace record alignment perf intel-pt: Fix overlap calculation for padding perf/x86/intel/uncore: Fix client IMC events return huge result perf intel-pt: Fix divide by zero when TSC is not available md: Fix failed allocation of md_register_thread tpm/tpm_crb: Avoid unaligned reads in crb_recv() tpm: Unify the send callback behaviour rcu: Do RCU GP kthread self-wakeup from softirq and interrupt media: imx: prpencvf: Stop upstream before disabling IDMA channel media: lgdt330x: fix lock status reporting media: uvcvideo: Avoid NULL pointer dereference at the end of streaming media: vimc: Add vimc-streamer for stream control media: imx: csi: Disable CSI immediately after last EOF media: imx: csi: Stop upstream before disabling IDMA channel drm/fb-helper: generic: Fix drm_fbdev_client_restore() drm/radeon/evergreen_cs: fix missing break in switch statement drm/amd/powerplay: correct power reading on fiji drm/amd/display: don't call dm_pp_ function from an fpu block KVM: Call kvm_arch_memslots_updated() before updating memslots KVM: x86/mmu: Detect MMIO generation wrap in any address space KVM: x86/mmu: Do not cache MMIO accesses while memslots are in flux KVM: nVMX: Sign extend displacements of VMX instr's mem operands KVM: nVMX: Apply addr size mask to effective address for VMX instructions KVM: nVMX: Ignore limit checks on VMX instructions using flat segments bcache: use (REQ_META|REQ_PRIO) to indicate bio for metadata s390/setup: fix boot crash for machine without EDAT-1 Linux 4.19.31 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2019-03-23 21:13:30 +01:00
J. Bruce Fields	c7dad095f3	security/selinux: fix SECURITY_LSM_NATIVE_LABELS on reused superblock ... commit 3815a245b5 upstream. In the case when we're reusing a superblock, selinux_sb_clone_mnt_opts() fails to set set_kern_flags, with the result that nfs_clone_sb_security() incorrectly clears NFS_CAP_SECURITY_LABEL. The result is that if you mount the same NFS filesystem twice, NFS security labels are turned off, even if they would work fine if you mounted the filesystem only once. ("fixes" may be not exactly the right tag, it may be more like "fixed-other-cases-but-missed-this-one".) Cc: Scott Mayhew <smayhew@redhat.com> Cc: stable@vger.kernel.org Fixes: 0b4d3452b8 "security/selinux: allow security_sb_clone_mnt_opts..." Signed-off-by: J. Bruce Fields <bfields@redhat.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-03-23 20:10:06 +01:00
Xin Long	e4f6f82c9e	selinux: add the missing walk_size + len check in selinux_sctp_bind_connect ... commit 292c997a19 upstream. As does in __sctp_connect(), when checking addrs in a while loop, after get the addr len according to sa_family, it's necessary to do the check walk_size + af->sockaddr_len > addrs_size to make sure it won't access an out-of-bounds addr. The same thing is needed in selinux_sctp_bind_connect(), otherwise an out-of-bounds issue can be triggered: [14548.772313] BUG: KASAN: slab-out-of-bounds in selinux_sctp_bind_connect+0x1aa/0x1f0 [14548.927083] Call Trace: [14548.938072] dump_stack+0x9a/0xe9 [14548.953015] print_address_description+0x65/0x22e [14548.996524] kasan_report.cold.6+0x92/0x1a6 [14549.015335] selinux_sctp_bind_connect+0x1aa/0x1f0 [14549.036947] security_sctp_bind_connect+0x58/0x90 [14549.058142] __sctp_setsockopt_connectx+0x5a/0x150 [sctp] [14549.081650] sctp_setsockopt.part.24+0x1322/0x3ce0 [sctp] Cc: stable@vger.kernel.org Fixes: d452930fd3 ("selinux: Add SCTP support") Reported-by: Chunyu Hu <chuhu@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-03-23 20:10:06 +01:00
David Howells	7268328219	keys: Fix dependency loop between construction record and auth key ... [ Upstream commit 822ad64d7e ] In the request_key() upcall mechanism there's a dependency loop by which if a key type driver overrides the ->request_key hook and the userspace side manages to lose the authorisation key, the auth key and the internal construction record (struct key_construction) can keep each other pinned. Fix this by the following changes: (1) Killing off the construction record and using the auth key instead. (2) Including the operation name in the auth key payload and making the payload available outside of security/keys/. (3) The ->request_key hook is given the authkey instead of the cons record and operation name. Changes (2) and (3) allow the auth key to naturally be cleaned up if the keyring it is in is destroyed or cleared or the auth key is unlinked. Fixes: 7ee02a316600 ("keys: Fix dependency loop between construction record and auth key") Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <james.morris@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2019-03-23 20:09:48 +01:00
Greg Kroah-Hartman	4afd597192	This is the 4.19.30 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlyQ3LoACgkQONu9yGCS aT5Y5g/+N1arp6Uk2IsKLVnNlKeKHZpZjAtKao/XET9ZiG1f69C2C/kIQXA4++w9 tdp5giX6FfOEVOLWZx1yNWR1HjSshAGgRgantpzRVJjlobhvKqLi8m7S32+2t/wn bxXelQb3tg/xshUVKesH1Po/y0M7776rpZACJQcqPRoft4a6PULnMn8ou3D8KQ4q j0bexgW8nM/Gf2t6+dLBpITiW+v4dOc8t/9vko5Dg7/RlNpHRzo9a/JCmuZeujJZ EECisCBPOx/DY2CTshC6r4T9IeVQn8TT7845H/yuwrPrAuignrvflN800S06AfGr 2n0m2fyarXMGAVTWomxXVMYIUr+rAco+vYAgf9TRNELOYgvT0Qw2qesQSSNTvjdE C1H3i8UMlyg0L4/vn+s+2ZPR72uxgZegFEV7YBKmX8nph3lGABX1uw58mv+rAwEh ZKMyiWnNhx06iue8Tl+73qRYpV9JdxiJ1MoJXP7KWHLvSa9eXZ1G0G3RCyXeZrgn 6AczWAmLv1qX3FeiHxECXmCJZwQssSZLHq+k6F/CFjlfIVo3jQzVprA8UNdEIHZA TOImur2fWuIU4Yqn4SHspZSxPX1W+tGq797841aaqhX4T3PZSQwd6493DoMiZDbM auDrIcFhBzoRJscSkyAbj3Vdo5AzSOcAoveAJNJrsUQUzGFOdQ8= =0Uqy -----END PGP SIGNATURE----- Merge 4.19.30 into android-4.19 Changes in 4.19.30 connector: fix unsafe usage of ->real_parent gro_cells: make sure device is up in gro_cells_receive() ipv4/route: fail early when inet dev is missing l2tp: fix infoleak in l2tp_ip6_recvmsg() lan743x: Fix RX Kernel Panic lan743x: Fix TX Stall Issue net: hsr: fix memory leak in hsr_dev_finalize() net/hsr: fix possible crash in add_timer() net: sit: fix UBSAN Undefined behaviour in check_6rd net/x25: fix use-after-free in x25_device_event() net/x25: reset state in x25_connect() pptp: dst_release sk_dst_cache in pptp_sock_destruct ravb: Decrease TxFIFO depth of Q3 and Q2 to one route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race rxrpc: Fix client call queueing, waiting for channel sctp: remove sched init from sctp_stream_init tcp: do not report TCP_CM_INQ of 0 for closed connections tcp: Don't access TCP_SKB_CB before initializing it tcp: handle inet_csk_reqsk_queue_add() failures vxlan: Fix GRO cells race condition between receive and link delete vxlan: test dev->flags & IFF_UP before calling gro_cells_receive() net/mlx4_core: Fix reset flow when in command polling mode net/mlx4_core: Fix locking in SRIOV mode when switching between events and polling net/mlx4_core: Fix qp mtt size calculation net/x25: fix a race in x25_bind() mdio_bus: Fix use-after-free on device_register fails net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255 ipv6: route: purge exception on removal team: use operstate consistently for linkup ipvlan: disallow userns cap_net_admin to change global mode/flags ipv6: route: enforce RCU protection in rt6_update_exception_stamp_rt() ipv6: route: enforce RCU protection in ip6_route_check_nh_onlink() bonding: fix PACKET_ORIGDEV regression net/smc: fix smc_poll in SMC_INIT state missing barriers in some of unix_sock ->addr and ->path accesses net: sched: flower: insert new filter to idr after setting its mask f2fs: wait on atomic writes to count F2FS_CP_WB_DATA perf/x86: Fixup typo in stub functions ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56 ALSA: firewire-motu: fix construction of PCM frame for capture direction ALSA: hda: Extend i915 component bind timeout ALSA: hda - add more quirks for HP Z2 G4 and HP Z240 ALSA: hda/realtek: Enable audio jacks of ASUS UX362FA with ALC294 ALSA: hda/realtek - Reduce click noise on Dell Precision 5820 headphone ALSA: hda/realtek: Enable headset MIC of Acer TravelMate X514-51T with ALC255 perf/x86/intel: Fix memory corruption perf/x86/intel: Make dev_attr_allow_tsx_force_abort static It's wrong to add len to sector_nr in raid10 reshape twice drm: Block fb changes for async plane updates staging: erofs: fix race when the managed cache is enabled i40e: report correct statistics when XDP is enabled vhost/vsock: fix vhost vsock cid hashing inconsistent Linux 4.19.30 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2019-03-19 13:24:04 +01:00
Al Viro	345af5abca	missing barriers in some of unix_sock ->addr and ->path accesses ... [ Upstream commit ae3b564179 ] Several u->addr and u->path users are not holding any locks in common with unix_bind(). unix_state_lock() is useless for those purposes. u->addr is assign-once and *(u->addr) is fully set up by the time we set u->addr (all under unix_table_lock). u->path is also set in the same critical area, also before setting u->addr, and any unix_sock with ->path filled will have non-NULL ->addr. So setting ->addr with smp_store_release() is all we need for those "lockless" users - just have them fetch ->addr with smp_load_acquire() and don't even bother looking at ->path if they see NULL ->addr. Users of ->addr and ->path fall into several classes now: 1) ones that do smp_load_acquire(u->addr) and access *(u->addr) and u->path only if smp_load_acquire() has returned non-NULL. 2) places holding unix_table_lock. These are guaranteed that *(u->addr) is seen fully initialized. If unix_sock is in one of the "bound" chains, so's ->path. 3) unix_sock_destructor() using ->addr is safe. All places that set u->addr are guaranteed to have seen all stores *(u->addr) while holding a reference to u and unix_sock_destructor() is called when (atomic) refcount hits zero. 4) unix_release_sock() using ->path is safe. unix_bind() is serialized wrt unix_release() (normally - by struct file refcount), and for the instances that had ->path set by unix_bind() unix_release_sock() comes from unix_release(), so they are fine. Instances that had it set in unix_stream_connect() either end up attached to a socket (in unix_accept()), in which case the call chain to unix_release_sock() and serialization are the same as in the previous case, or they never get accept'ed and unix_release_sock() is called when the listener is shut down and its queue gets purged. In that case the listener's queue lock provides the barriers needed - unix_stream_connect() shoves our unix_sock into listener's queue under that lock right after having set ->path and eventual unix_release_sock() caller picks them from that queue under the same lock right before calling unix_release_sock(). 5) unix_find_other() use of ->path is pointless, but safe - it happens with successful lookup by (abstract) name, so ->path.dentry is guaranteed to be NULL there. earlier-variant-reviewed-by: "Paul E. McKenney" <paulmck@linux.ibm.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-03-19 13:12:41 +01:00
Greg Kroah-Hartman	2e568c979c	This is the 4.19.29 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlyJb/EACgkQONu9yGCS aT4y0g//b9t9/onhTaXcY/ByPmBAwqNgugi7eYcZqGDBp7aCDOBLF6eOwbhdvvuS ZTaZ5eWG3Twz3mZu9vveuskgMci2npDyLPgqBWGzW+Ef5r/xPd40diaI75ZUc68T gimWbQ0VANuXKklK6LysBUaVQWE3ilIy6qnnpj0DI3ipNDoE62Ry1LNthuKy+73J w6r7uwkb6X/CkXpNB/L4cDdpSy/CvhGQhd6p91lBuE4DfyPqEzslYCokD9aPXp9b Fedt/Re+8eULBNcgqPYxkS5pBrbHtqrGf00AMlzC8DkC+GZyDqSP2xjv6AiTfGJd uf0/Jvsv2OBnP4aYsbk+uB2z3plzPBgmXxa/1bm+yrGCMvbpi9mMx75HM2joAeVp tVN4ZN65kNgJkXCchJTHdQ3s6teOD8Par1czy570HyKBU6l1j3AGArGm+b4WGPWx dL+82coojMKxKNdTHfxUXES6QGKp716r3un6mCrKR0xET/SDayzDQMaSM8UOtArK ELzNeKzKTc5oBx6i+JfGmY8ZsedpNGCIPpsiuoSYAaon5ZzNbruzOAlDOThs157d YezDHZ9XMrx3kN/xYnqZD63x/5egq9REbZGWljeykbNkWcEY74jIkKwNLxqv3P64 JsLp60owvjzwtzKycjZogNU//GGNTBdb+6pESq4MxJpPTteFWnc= =n9iV -----END PGP SIGNATURE----- Merge 4.19.29 into android-4.19 Changes in 4.19.29 media: uvcvideo: Fix 'type' check leading to overflow vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel perf script: Fix crash with printing mixed trace point and other events perf core: Fix perf_proc_update_handler() bug perf tools: Handle TOPOLOGY headers with no CPU perf script: Fix crash when processing recorded stat data IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM iommu/amd: Call free_iova_fast with pfn in map_sg iommu/amd: Unmap all mapped pages in error path of map_sg riscv: fixup max_low_pfn with PFN_DOWN. ipvs: Fix signed integer overflow when setsockopt timeout iommu/amd: Fix IOMMU page flush when detach device from a domain clk: ti: Fix error handling in ti_clk_parse_divider_data() clk: qcom: gcc: Use active only source for CPUSS clocks xtensa: SMP: fix ccount_timer_shutdown riscv: Adjust mmap base address at a third of task size IB/ipoib: Fix for use-after-free in ipoib_cm_tx_start selftests: cpu-hotplug: fix case where CPUs offline > CPUs present xtensa: SMP: fix secondary CPU initialization xtensa: smp_lx200_defconfig: fix vectors clash xtensa: SMP: mark each possible CPU as present iomap: get/put the page in iomap_page_create/release() iomap: fix a use after free in iomap_dio_rw xtensa: SMP: limit number of possible CPUs by NR_CPUS net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case net: hns: Fix for missing of_node_put() after of_parse_phandle() net: hns: Restart autoneg need return failed when autoneg off net: hns: Fix wrong read accesses via Clause 45 MDIO protocol net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup() netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present gpio: vf610: Mask all GPIO interrupts selftests: net: use LDLIBS instead of LDFLAGS selftests: timers: use LDLIBS instead of LDFLAGS nfs: Fix NULL pointer dereference of dev_name qed: Fix bug in tx promiscuous mode settings qed: Fix LACP pdu drops for VFs qed: Fix VF probe failure while FLR qed: Fix system crash in ll2 xmit qed: Fix stack out of bounds bug scsi: libfc: free skb when receiving invalid flogi resp scsi: scsi_debug: fix write_same with virtual_gb problem scsi: bnx2fc: Fix error handling in probe() scsi: 53c700: pass correct "dev" to dma_alloc_attrs() platform/x86: Fix unmet dependency warning for ACPI_CMPC platform/x86: Fix unmet dependency warning for SAMSUNG_Q10 net: macb: Apply RXUBR workaround only to versions with errata x86/boot/compressed/64: Set EFER.LME=1 in 32-bit trampoline before returning to long mode cifs: fix computation for MAX_SMB2_HDR_SIZE x86/microcode/amd: Don't falsely trick the late loading mechanism arm64: kprobe: Always blacklist the KVM world-switch code apparmor: Fix aa_label_build() error handling for failed merges x86/kexec: Don't setup EFI info if EFI runtime is not enabled proc: fix /proc/net/* after setns(2) x86_64: increase stack size for KASAN_EXTRA mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone lib/test_kmod.c: potential double free in error handling fs/drop_caches.c: avoid softlockups in drop_pagecache_sb() autofs: drop dentry reference only when it is never used autofs: fix error return in autofs_fill_super() mm, memory_hotplug: fix off-by-one in is_pageblock_removable ARM: OMAP: dts: N950/N9: fix onenand timings ARM: dts: omap4-droid4: Fix typo in cpcap IRQ flags ARM: dts: sun8i: h3: Add ethernet0 alias to Beelink X2 arm: dts: meson: Fix IRQ trigger type for macirq ARM: dts: meson8b: odroidc1: mark the SD card detection GPIO active-low ARM: dts: meson8m2: mxiii-plus: mark the SD card detection GPIO active-low ARM: dts: imx6sx: correct backward compatible of gpt arm64: dts: renesas: r8a7796: Enable DMA for SCIF2 arm64: dts: renesas: r8a77965: Enable DMA for SCIF2 soc: fsl: qbman: avoid race in clearing QMan interrupt pinctrl: mcp23s08: spi: Fix regmap allocation for mcp23s18 wlcore: sdio: Fixup power on/off sequence bpftool: Fix prog dump by tag bpftool: fix percpu maps updating bpf: sock recvbuff must be limited by rmem_max in bpf_setsockopt() ARM: pxa: ssp: unneeded to free devm_ allocated data arm64: dts: add msm8996 compatible to gicv3 batman-adv: release station info tidstats DTS: CI20: Fix bugs in ci20's device tree. usb: phy: fix link errors irqchip/gic-v4: Fix occasional VLPI drop irqchip/gic-v3-its: Gracefully fail on LPI exhaustion irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable drm/amdgpu: Add missing power attribute to APU check drm/radeon: check if device is root before getting pci speed caps drm/amdgpu: Transfer fences to dmabuf importer net: stmmac: Fallback to Platform Data clock in Watchdog conversion net: stmmac: Send TSO packets always from Queue 0 net: stmmac: Disable EEE mode earlier in XMIT callback irqchip/gic-v3-its: Fix ITT_entry_size accessor relay: check return of create_buf_file() properly bpf, selftests: fix handling of sparse CPU allocations bpf: fix lockdep false positive in percpu_freelist bpf: fix potential deadlock in bpf_prog_register bpf: Fix syscall's stackmap lookup potential deadlock drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init dmaengine: at_xdmac: Fix wrongfull report of a channel as in use vsock/virtio: fix kernel panic after device hot-unplug vsock/virtio: reset connected sockets on device removal dmaengine: dmatest: Abort test in case of mapping error selftests: netfilter: fix config fragment CONFIG_NF_TABLES_INET selftests: netfilter: add simple masq/redirect test cases netfilter: nf_nat: skip nat clash resolution for same-origin entries s390/qeth: release cmd buffer in error paths s390/qeth: fix use-after-free in error path s390/qeth: cancel close_dev work before removing a card perf symbols: Filter out hidden symbols from labels perf trace: Support multiple "vfs_getname" probes MIPS: Remove function size check in get_frame_info() Revert "scsi: libfc: Add WARN_ON() when deleting rports" i2c: omap: Use noirq system sleep pm ops to idle device for suspend drm/amdgpu: use spin_lock_irqsave to protect vm_manager.pasid_idr nvme: lock NS list changes while handling command effects nvme-pci: fix rapid add remove sequence fs: ratelimit __find_get_block_slow() failure message. qed: Fix EQ full firmware assert. qed: Consider TX tcs while deriving the max num_queues for PF. qede: Fix system crash on configuring channels. blk-iolatency: fix IO hang due to negative inflight counter nvme-pci: add missing unlock for reset error Input: wacom_serial4 - add support for Wacom ArtPad II tablet Input: elan_i2c - add id for touchpad found in Lenovo s21e-20 iscsi_ibft: Fix missing break in switch statement scsi: aacraid: Fix missing break in switch statement x86/PCI: Fixup RTIT_BAR of Intel Denverton Trace Hub arm64: dts: zcu100-revC: Give wifi some time after power-on arm64: dts: hikey: Give wifi some time after power-on arm64: dts: hikey: Revert "Enable HS200 mode on eMMC" ARM: dts: exynos: Fix pinctrl definition for eMMC RTSN line on Odroid X2/U3 ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU ARM: dts: exynos: Fix max voltage for buck8 regulator on Odroid XU3/XU4 drm: disable uncached DMA optimization for ARM and arm64 netfilter: xt_TEE: fix wrong interface selection netfilter: xt_TEE: add missing code to get interface index in checkentry. gfs2: Fix missed wakeups in find_insert_glock staging: erofs: add error handling for xattr submodule staging: erofs: fix fast symlink w/o xattr when fs xattr is on staging: erofs: fix memleak of inode's shared xattr array staging: erofs: fix race of initializing xattrs of a inode at the same time staging: erofs: keep corrupted fs from crashing kernel in erofs_namei() cifs: allow calling SMB2_xxx_free(NULL) ath9k: Avoid OF no-EEPROM quirks without qca,no-eeprom driver core: Postpone DMA tear-down until after devres release perf/x86/intel: Make cpuc allocations consistent perf/x86/intel: Generalize dynamic constraint creation x86: Add TSX Force Abort CPUID/MSR perf/x86/intel: Implement support for TSX Force Abort Linux 4.19.29 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2019-03-13 14:17:29 -07:00
John Johansen	d7807b6227	apparmor: Fix aa_label_build() error handling for failed merges ... [ Upstream commit d6d478aee0 ] aa_label_merge() can return NULL for memory allocations failures make sure to handle and set the correct error in this case. Reported-by: Peng Hao <peng.hao2@zte.com.cn> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2019-03-13 14:02:32 -07:00
Greg Kroah-Hartman	c97d2b535c	This is the 4.19.26 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlx2U68ACgkQONu9yGCS aT6rHA/+PGrMAAzSp193bme2rap7P/EzDD0JF0aQOLwizdit5A4zIYSZApVVSaw5 U8KIQg+fcwIjTvzBmkHddDVVJBEv/VdE8Xkf0EOIOidIQNqMoRQN7ctU1bnKfUyC 20/xZBlc78BEU4TB4JpNiKkzD3bsl/Gsb2A3VenhHe0H8dbj4oJYyNWWY99/433y u1SNmTogLJ0p64+1XWMCTqPJA2xkUIOciFSLiO7d51MfpbguMwcW+T9XSwYat3tp uTdfvZYKc4iGPa4pZCZmZY7+Lrxne2OjMhp3bUlp0coKrjlNO848X+kG7gsVZ7EN MA7YOXUj/Ngjl+E9EilNY5gybY2hK0IzaaV8W9TRVYvPBjgSwe5Mj9/EXYO0L8q0 Arla5HsJdRhLX7HDJ41w8BIngko87hetAaTZVCct+F+nnMYGrrMsle+BgYYbnd7r NYWB8HwZZ3krkWmAZb+Phpleo3Oj7beum5MLoydSH4pXhTVft5D/V8K2fwLmZtgP FsIC1J09jDvXJ5qHTFBY4ugTq8l21YZ2oMPdwcB6X8hBIKji4XydQ0HPrdMyAtXB tqUkzyLZlP1uzm9T3E+hyATWeM4ue7qLFacp7cX5LokDWIxlWi7tcIqBHqRZez+y S7un8/Lmz8ZvzC674JTZl1iXSHuuK6TFLrwI3mw/CVhg2qRvZtk= =EDHP -----END PGP SIGNATURE----- Merge 4.19.26 into android-4.19 Changes in 4.19.26 ARM: 8834/1: Fix: kprobes: optimized kprobes illegal instruction tracing: Fix number of entries in trace header MIPS: eBPF: Always return sign extended 32b values gpio: MT7621: use a per instance irq_chip structure gpio: pxa: avoid attempting to set pin direction via pinctrl on MMP2 mac80211: Restore vif beacon interval if start ap fails mac80211: Use linked list instead of rhashtable walk for mesh tables mac80211: Free mpath object when rhashtable insertion fails libceph: handle an empty authorize reply ceph: avoid repeatedly adding inode to mdsc->snap_flush_list numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES proc, oom: do not report alien mms when setting oom_score_adj ALSA: hda/realtek - Headset microphone and internal speaker support for System76 oryp5 ALSA: hda/realtek: Disable PC beep in passthrough on alc285 KEYS: allow reaching the keys quotas exactly backlight: pwm_bl: Fix devicetree parsing with auto-generated brightness tables mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells pvcalls-front: read all data before closing the connection pvcalls-front: don't try to free unallocated rings pvcalls-front: properly allocate sk pvcalls-back: set -ENOTCONN in pvcalls_conn_back_read mfd: twl-core: Fix section annotations on {,un}protect_pm_master mfd: db8500-prcmu: Fix some section annotations mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported mfd: ab8500-core: Return zero in get_register_interruptible() mfd: bd9571mwv: Add volatile register to make DVFS work mfd: qcom_rpm: write fw_version to CTRL_REG mfd: wm5110: Add missing ASRC rate register mfd: axp20x: Add AC power supply cell for AXP813 mfd: axp20x: Re-align MFD cell entries mfd: axp20x: Add supported cells for AXP803 mfd: cros_ec_dev: Add missing mfd_remove_devices() call in remove mfd: tps65218: Use devm_regmap_add_irq_chip and clean up error path in probe() mfd: mc13xxx: Fix a missing check of a register-read failure xen/pvcalls: remove set but not used variable 'intf' qed: Fix qed_chain_set_prod() for PBL chains with non power of 2 page count qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory barrier net: hns: Fix use after free identified by SLUB debug bpf: Fix [::] -> [::1] rewrite in sys_sendmsg selftests/bpf: Test [::] -> [::1] rewrite in sys_sendmsg in test_sock_addr watchdog: mt7621_wdt/rt2880_wdt: Fix compilation problem net/mlx4: Get rid of page operation after dma_alloc_coherent MIPS: ath79: Enable OF serial ports in the default config xprtrdma: Double free in rpcrdma_sendctxs_create() mlxsw: spectrum_acl: Add cleanup after C-TCAM update error condition selftests: forwarding: Add a test for VLAN deletion netfilter: nf_tables: fix leaking object reference count scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param scsi: isci: initialize shost fully before calling scsi_add_host() include/linux/compiler*.h: fix OPTIMIZER_HIDE_VAR MIPS: jazz: fix 64bit build netfilter: nft_flow_offload: Fix reverse route lookup bpf: correctly set initial window on active Fast Open sender pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock bpf: fix panic in stack_map_get_build_id() on i386 and arm32 netfilter: nft_flow_offload: fix interaction with vrf slave device RDMA/mthca: Clear QP objects during their allocation powerpc/8xx: fix setting of pagetable for Abatron BDI debug tool. acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() net: stmmac: Fix PCI module removal leak net: stmmac: dwxgmac2: Only clear interrupts that are active net: stmmac: Check if CBS is supported before configuring net: stmmac: Fix the logic of checking if RX Watchdog must be enabled net: stmmac: Prevent RX starvation in stmmac_napi_poll() isdn: i4l: isdn_tty: Fix some concurrency double-free bugs scsi: tcmu: avoid cmd/qfull timers updated whenever a new cmd comes scsi: ufs: Fix system suspend status scsi: qedi: Add ep_state for login completion on un-reachable targets scsi: ufs: Fix geometry descriptor size scsi: cxgb4i: add wait_for_completion() netfilter: nft_flow_offload: fix checking method of conntrack helper always clear the X2APIC_ENABLE bit for PV guest drm/meson: add missing of_node_put drm/amdkfd: Don't assign dGPUs to APU topology devices drm/amd/display: fix PME notification not working in RV desktop vhost: return EINVAL if iovecs size does not match the message size drm/sun4i: backend: add missing of_node_puts pvcalls-front: fix potential null dereference selftests: tc-testing: drop test on missing tunnel key id selftests: tc-testing: fix tunnel_key failure if dst_port is unspecified selftests: tc-testing: fix parsing of ife type afs: Don't set vnode->cb_s_break in afs_validate() afs: Fix key refcounting in file locking code bpf: don't assume build-id length is always 20 bytes bpf: zero out build_id for BPF_STACK_BUILD_ID_IP selftests/bpf: retry tests that expect build-id atm: he: fix sign-extension overflow on large shift hwmon: (tmp421) Correct the misspelling of the tmp442 compatible attribute in OF device ID table leds: lp5523: fix a missing check of return value of lp55xx_read bpf: bpf_setsockopt: reset sock dst on SO_MARK changes dpaa_eth: NETIF_F_LLTX requires to do our own update of trans_start mlxsw: pci: Return error on PCI reset timeout net: bridge: Mark FDB entries that were added by user as such mlxsw: spectrum_switchdev: Do not treat static FDB entries as sticky selftests: forwarding: Add a test case for externally learned FDB entries net/mlx5e: Fix wrong (zero) TX drop counter indication for representor isdn: avm: Fix string plus integer warning from Clang batman-adv: fix uninit-value in batadv_interface_tx() inet_diag: fix reporting cgroup classid and fallback to priority ipv6: propagate genlmsg_reply return code net: ena: fix race between link up and device initalization net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames net/mlx5e: Don't overwrite pedit action when multiple pedit used net/packet: fix 4gb buffer limit due to overflow check net: sfp: do not probe SFP module before we're attached sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment sctp: set stream ext to NULL after freeing it in sctp_stream_outq_migrate team: avoid complex list operations in team_nl_cmd_options_set() Revert "socket: fix struct ifreq size in compat ioctl" Revert "kill dev_ifsioc()" net: socket: fix SIOCGIFNAME in compat net: socket: make bond ioctls go through compat_ifreq_ioctl() geneve: should not call rt6_lookup() when ipv6 was disabled sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach() net_sched: fix a race condition in tcindex_destroy() net_sched: fix a memory leak in cls_tcindex net_sched: fix two more memory leaks in cls_tcindex net/mlx5e: XDP, fix redirect resources availability check RDMA/srp: Rework SCSI device reset handling KEYS: user: Align the payload buffer KEYS: always initialize keyring_index_key::desc_len parisc: Fix ptrace syscall number modification ARCv2: Enable unaligned access in early ASM code ARC: U-boot: check arguments paranoidly ARC: define ARCH_SLAB_MINALIGN = 8 drm/amdgpu: Set DPM_FLAG_NEVER_SKIP when enabling PM-runtime gpu: drm: radeon: Set DPM_FLAG_NEVER_SKIP when enabling PM-runtime drm/i915/fbdev: Actually configure untiled displays drm/amd/display: Fix MST reboot/poweroff sequence mac80211: allocate tailroom for forwarded mesh packets kvm: x86: Return LA57 feature based on hardware capability net: validate untrusted gso packets without csum offload net: avoid false positives in untrusted gso validation staging: erofs: fix a bug when appling cache strategy staging: erofs: complete error handing of z_erofs_do_read_page staging: erofs: replace BUG_ON with DBG_BUGON in data.c staging: erofs: drop multiref support temporarily staging: erofs: remove the redundant d_rehash() for the root dentry staging: erofs: atomic_cond_read_relaxed on ref-locked workgroup staging: erofs: fix `erofs_workgroup_{try_to_freeze, unfreeze}' staging: erofs: add a full barrier in erofs_workgroup_unfreeze staging: erofs: {dir,inode,super}.c: rectify BUG_ONs staging: erofs: unzip_{pagevec.h,vle.c}: rectify BUG_ONs staging: erofs: unzip_vle_lz4.c,utils.c: rectify BUG_ONs Revert "bridge: do not add port to router list when receives query with source 0.0.0.0" netfilter: nf_tables: fix flush after rule deletion in the same batch netfilter: nft_compat: use-after-free when deleting targets netfilter: ipv6: Don't preserve original oif for loopback address netfilter: nfnetlink_osf: add missing fmatch check netfilter: ipt_CLUSTERIP: fix sleep-in-atomic bug in clusterip_config_entry_put() udlfb: handle unplug properly pinctrl: max77620: Use define directive for max77620_pinconf_param values net: phylink: avoid resolving link state too early Linux 4.19.26 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2019-02-27 10:23:18 +01:00
Eric Biggers	8b4b1d7cc4	KEYS: always initialize keyring_index_key::desc_len ... commit ede0fa98a9 upstream. syzbot hit the 'BUG_ON(index_key->desc_len == 0);' in __key_link_begin() called from construct_alloc_key() during sys_request_key(), because the length of the key description was never calculated. The problem is that we rely on ->desc_len being initialized by search_process_keyrings(), specifically by search_nested_keyrings(). But, if the process isn't subscribed to any keyrings that never happens. Fix it by always initializing keyring_index_key::desc_len as soon as the description is set, like we already do in some places. The following program reproduces the BUG_ON() when it's run as root and no session keyring has been installed. If it doesn't work, try removing pam_keyinit.so from /etc/pam.d/login and rebooting. #include <stdlib.h> #include <unistd.h> #include <keyutils.h> int main(void) { int id = add_key("keyring", "syz", NULL, 0, KEY_SPEC_USER_KEYRING); keyctl_setperm(id, KEY_OTH_WRITE); setreuid(5000, 5000); request_key("user", "desc", "", id); } Reported-by: syzbot+ec24e95ea483de0a24da@syzkaller.appspotmail.com Fixes: b2a4df200d ("KEYS: Expand the capacity of a keyring") Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: James Morris <james.morris@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-02-27 10:09:00 +01:00
Eric Biggers	f812bec554	KEYS: allow reaching the keys quotas exactly ... commit a08bf91ce2 upstream. If the sysctl 'kernel.keys.maxkeys' is set to some number n, then actually users can only add up to 'n - 1' keys. Likewise for 'kernel.keys.maxbytes' and the root_* versions of these sysctls. But these sysctls are apparently supposed to be *maximums*, as per their names and all documentation I could find -- the keyrings(7) man page, Documentation/security/keys/core.rst, and all the mentions of EDQUOT meaning that the key quota was *exceeded* (as opposed to reached). Thus, fix the code to allow reaching the quotas exactly. Fixes: 0b77f5bfb4 ("keys: make the keyring quotas controllable through /proc/sys") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <james.morris@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-02-27 10:08:50 +01:00
Greg Kroah-Hartman	6e0411bdc2	This is the 4.19.21 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlxjFL8ACgkQONu9yGCS aT643xAAk+mnsrOfU6/LBFjcJUUUYohK01UAU+PRvTjy4uH8rrA4G01xvp11ftIu jjEikA2582ScR5a2Ww+E4SfqOdKT4z9hOGLTnyI0P4xN9jeVidvu9+C90AYyBYhi orHm1osVQIj6n9+OQ5db+DzZYbZLbyfCoqNXbq9EoLvNRS3FUUH0y2VXqcz9Ghcj obpdHTVMKRaFkRWdCglo+3hSpoKrncSVpKrwUXR18GCt8jjZjj39kI9t6UoGNfc7 nN3GOd26U1tpGo6ShZJYu6aPjV+zoYNlsg1o2zn9qJANIdulYe30vqNhWCeJ+/T7 WcT3EHv4pPEO3Lvgfp+l10Nc6IbYdJEFUpAP3CvfP+MvRfKvz8Vo3Nm/BQlr20+q +MUYJb+wxhlHPRLV192XbnYFkEzZg7vzymoMPL034XheAkOkPbOK0IIVo41p5Rai LxmOdvhzfAktbtD/VWnLTUbexjs2EJ05bvZRjdPKKIMBNKnAWz4ux3KcHxpdsUF8 KMCKwpJE8KDM4uiaKVdyfMhFeIg37pmy+7Uv9cUFjWwtsL3K+CiAXg8uaSvnajKr bOhwbFIgxoOI9VRBK8M0wvzouphA0miVbxOY81sdfbMeWNpbCLdb968AFz25llta rVlWp7bSAUQTsvTkVBv6mrTKPwzO4jnfHYN8yj5gO7pr5fmC2ig= =L+Mp -----END PGP SIGNATURE----- Merge 4.19.21 into android-4.19 Changes in 4.19.21 devres: Align data[] to ARCH_KMALLOC_MINALIGN drm/bufs: Fix Spectre v1 vulnerability staging: iio: adc: ad7280a: handle error from __ad7280_read32() drm/vgem: Fix vgem_init to get drm device available. pinctrl: bcm2835: Use raw spinlock for RT compatibility ASoC: Intel: mrfld: fix uninitialized variable access gpiolib: Fix possible use after free on label drm/sun4i: Initialize registers in tcon-top driver genirq/affinity: Spread IRQs to all available NUMA nodes gpu: ipu-v3: image-convert: Prevent race between run and unprepare nds32: Fix gcc 8.0 compiler option incompatible. wil6210: fix reset flow for Talyn-mb wil6210: fix memory leak in wil_find_tx_bcast_2 ath10k: assign 'n_cipher_suites' for WCN3990 ath9k: dynack: use authentication messages for 'late' ack scsi: lpfc: Correct LCB RJT handling scsi: mpt3sas: Call sas_remove_host before removing the target devices scsi: lpfc: Fix LOGO/PLOGI handling when triggerd by ABTS Timeout event ARM: 8808/1: kexec:offline panic_smp_self_stop CPU clk: boston: fix possible memory leak in clk_boston_setup() dlm: Don't swamp the CPU with callbacks queued during recovery x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux) powerpc/pseries: add of_node_put() in dlpar_detach_node() crypto: aes_ti - disable interrupts while accessing S-box drm/vc4: ->x_scaling[1] should never be set to VC4_SCALING_NONE serial: fsl_lpuart: clear parity enable bit when disable parity ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl MIPS: Boston: Disable EG20T prefetch dpaa2-ptp: defer probe when portal allocation failed iwlwifi: fw: do not set sgi bits for HE connection staging:iio:ad2s90: Make probe handle spi_setup failure fpga: altera-cvp: Fix registration for CvP incapable devices Tools: hv: kvp: Fix a warning of buffer overflow with gcc 8.0.1 fpga: altera-cvp: fix 'bad IO access' on x86_64 vbox: fix link error with 'gcc -Og' platform/chrome: don't report EC_MKBP_EVENT_SENSOR_FIFO as wakeup i40e: prevent overlapping tx_timeout recover scsi: hisi_sas: change the time of SAS SSP connection staging: iio: ad7780: update voltage on read usbnet: smsc95xx: fix rx packet alignment drm/rockchip: fix for mailbox read size ARM: OMAP2+: hwmod: Fix some section annotations drm/amd/display: fix gamma not being applied correctly drm/amd/display: calculate stream->phy_pix_clk before clock mapping bpf: libbpf: retry map creation without the name net/mlx5: EQ, Use the right place to store/read IRQ affinity hint modpost: validate symbol names also in find_elf_symbol perf tools: Add Hygon Dhyana support soc/tegra: Don't leak device tree node reference media: rc: ensure close() is called on rc_unregister_device media: video-i2c: avoid accessing released memory area when removing driver media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm() staging: erofs: fix the definition of DBG_BUGON clk: meson: meson8b: do not use cpu_div3 for cpu_scale_out_sel clk: meson: meson8b: fix the width of the cpu_scale_div clock clk: meson: meson8b: mark the CPU clock as CLK_IS_CRITICAL ptp: Fix pass zero to ERR_PTR() in ptp_clock_register dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll powerpc/32: Add .data..Lubsan_data*/.data..Lubsan_type* sections explicitly iio: adc: meson-saradc: check for devm_kasprintf failure iio: adc: meson-saradc: fix internal clock names iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID media: adv*/tc358743/ths8200: fill in min width/height/pixelclock ACPI: SPCR: Consider baud rate 0 as preconfigured state staging: pi433: fix potential null dereference f2fs: move dir data flush to write checkpoint process f2fs: fix race between write_checkpoint and write_begin f2fs: fix wrong return value of f2fs_acl_create i2c: sh_mobile: add support for r8a77990 (R-Car E3) arm64: io: Ensure calls to delay routines are ordered against prior readX() net: aquantia: return 'err' if set MPI_DEINIT state fails sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN soc: bcm: brcmstb: Don't leak device tree node reference nfsd4: fix crash on writing v4_end_grace before nfsd startup drm: Clear state->acquire_ctx before leaving drm_atomic_helper_commit_duplicated_state() perf: arm_spe: handle devm_kasprintf() failure arm64: io: Ensure value passed to __iormb() is held in a 64-bit register Thermal: do not clear passive state during system sleep thermal: Fix locking in cooling device sysfs update cur_state firmware/efi: Add NULL pointer checks in efivars API functions s390/zcrypt: improve special ap message cmd handling mt76x0: dfs: fix IBI_R11 configuration on non-radar channels arm64: ftrace: don't adjust the LR value drm/v3d: Fix prime imports of buffers from other drivers. ARM: dts: mmp2: fix TWSI2 ARM: dts: aspeed: add missing memory unit-address x86/fpu: Add might_fault() to user_insn() media: i2c: TDA1997x: select CONFIG_HDMI media: DaVinci-VPBE: fix error handling in vpbe_initialize() smack: fix access permissions for keyring xtensa: xtfpga.dtsi: fix dtc warnings about SPI usb: dwc3: Correct the logic for checking TRB full in __dwc3_prepare_one_trb() usb: dwc2: Disable power down feature on Samsung SoCs usb: hub: delay hub autosuspend if USB3 port is still link training timekeeping: Use proper seqcount initializer usb: mtu3: fix the issue about SetFeature(U1/U2_Enable) clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module clocks media: imx274: select REGMAP_I2C drm/amdgpu/powerplay: fix clock stretcher limits on polaris (v2) tipc: fix node keep alive interval calculation driver core: Move async_synchronize_full call kobject: return error code if writing /sys/.../uevent fails IB/hfi1: Unreserve a reserved request when it is completed usb: dwc3: trace: add missing break statement to make compiler happy gpio: mt7621: report failure of devm_kasprintf() gpio: mt7621: pass mediatek_gpio_bank_probe() failure up the stack pinctrl: sx150x: handle failure case of devm_kstrdup iommu/amd: Fix amd_iommu=force_isolation ARM: dts: Fix OMAP4430 SDP Ethernet startup mips: bpf: fix encoding bug for mm_srlv32_op media: coda: fix H.264 deblocking filter controls ARM: dts: Fix up the D-Link DIR-685 MTD partition info watchdog: renesas_wdt: don't set divider while watchdog is running ARM: dts: imx51-zii-rdu1: Do not specify "power-gpio" for hpa1 usb: dwc3: gadget: Disable CSP for stream OUT ep iommu/arm-smmu-v3: Avoid memory corruption from Hisilicon MSI payloads iommu/arm-smmu: Add support for qcom,smmu-v2 variant iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer sata_rcar: fix deferred probing clk: imx6sl: ensure MMDC CH0 handshake is bypassed platform/x86: mlx-platform: Fix tachometer registers cpuidle: big.LITTLE: fix refcount leak OPP: Use opp_table->regulators to verify no regulator case tee: optee: avoid possible double list_del() drm/msm/dsi: fix dsi clock names in DSI 10nm PLL driver drm/msm: dpu: Only check flush register against pending flushes lightnvm: pblk: fix resubmission of overwritten write err lbas lightnvm: pblk: add lock protection to list operations i2c-axxia: check for error conditions first phy: sun4i-usb: add support for missing USB PHY index mlxsw: spectrum_acl: Limit priority value udf: Fix BUG on corrupted inode switchtec: Fix SWITCHTEC_IOCTL_EVENT_IDX_ALL flags overwrite selftests/bpf: use __bpf_constant_htons in test_prog.c ARM: pxa: avoid section mismatch warning ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M KVM: PPC: Book3S: Only report KVM_CAP_SPAPR_TCE_VFIO on powernv machines mmc: bcm2835: Recover from MMC_SEND_EXT_CSD mmc: bcm2835: reset host on timeout mmc: meson-mx-sdio: check devm_kasprintf for failure memstick: Prevent memstick host from getting runtime suspended during card detection mmc: sdhci-of-esdhc: Fix timeout checks mmc: sdhci-omap: Fix timeout checks mmc: sdhci-xenon: Fix timeout checks mmc: jz4740: Get CD/WP GPIOs from descriptors usb: renesas_usbhs: add support for RZ/G2E btrfs: harden agaist duplicate fsid on scanned devices serial: sh-sci: Fix locking in sci_submit_rx() serial: sh-sci: Resume PIO in sci_rx_interrupt() on DMA failure tty: serial: samsung: Properly set flags in autoCTS mode perf test: Fix perf_event_attr test failure perf dso: Fix unchecked usage of strncpy() perf header: Fix unchecked usage of strncpy() btrfs: use tagged writepage to mitigate livelock of snapshot perf probe: Fix unchecked usage of strncpy() i2c: sh_mobile: Add support for r8a774c0 (RZ/G2E) bnxt_en: Disable MSIX before re-reserving NQs/CMPL rings. tools/power/x86/intel_pstate_tracer: Fix non root execution for post processing a trace file livepatch: check kzalloc return values arm64: KVM: Skip MMIO insn after emulation usb: musb: dsps: fix otg state machine usb: musb: dsps: fix runtime pm for peripheral mode perf header: Fix up argument to ctime() perf tools: Cast off_t to s64 to avoid warning on bionic libc percpu: convert spin_lock_irq to spin_lock_irqsave. net: hns3: fix incomplete uninitialization of IRQ in the hns3_nic_uninit_vector_data() drm/amd/display: Add retry to read ddc_clock pin Bluetooth: hci_bcm: Handle deferred probing for the clock supply drm/amd/display: fix YCbCr420 blank color powerpc/uaccess: fix warning/error with access_ok() mac80211: fix radiotap vendor presence bitmap handling xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi mlxsw: spectrum: Properly cleanup LAG uppers when removing port from LAG scsi: smartpqi: correct host serial num for ssa scsi: smartpqi: correct volume status scsi: smartpqi: increase fw status register read timeout cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan() net: hns3: add max vector number check for pf powerpc/perf: Fix thresholding counter data for unknown type iwlwifi: mvm: fix setting HE ppe FW config powerpc/powernv/ioda: Allocate indirect TCE levels of cached userspace addresses on demand mlx5: update timecounter at least twice per counter overflow drbd: narrow rcu_read_lock in drbd_sync_handshake drbd: disconnect, if the wrong UUIDs are attached on a connected peer drbd: skip spurious timeout (ping-timeo) when failing promote drbd: Avoid Clang warning about pointless switch statment drm/amd/display: validate extended dongle caps video: clps711x-fb: release disp device node in probe() md: fix raid10 hang issue caused by barrier fbdev: fbmem: behave better with small rotated displays and many CPUs i40e: define proper net_device::neigh_priv_len ice: Do not enable NAPI on q_vectors that have no rings igb: Fix an issue that PME is not enabled during runtime suspend ACPI/APEI: Clear GHES block_status before panic() fbdev: fbcon: Fix unregister crash when more than one framebuffer powerpc/mm: Fix reporting of kernel execute faults on the 8xx pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins pinctrl: meson: meson8b: fix the GPIO function for the GPIOAO pins KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported powerpc/fadump: Do not allow hot-remove memory from fadump reserved area. kvm: Change offset in kvm_write_guest_offset_cached to unsigned NFS: nfs_compare_mount_options always compare auth flavors. perf build: Don't unconditionally link the libbfd feature test to -liberty and -lz hwmon: (lm80) fix a missing check of the status of SMBus read hwmon: (lm80) fix a missing check of bus read in lm80 probe seq_buf: Make seq_buf_puts() null-terminate the buffer crypto: ux500 - Use proper enum in cryp_set_dma_transfer crypto: ux500 - Use proper enum in hash_set_dma_transfer MIPS: ralink: Select CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8 cifs: check ntwrk_buf_start for NULL before dereferencing it f2fs: fix use-after-free issue when accessing sbi->stat_info um: Avoid marking pages with "changed protection" niu: fix missing checks of niu_pci_eeprom_read f2fs: fix sbi->extent_list corruption issue cgroup: fix parsing empty mount option string perf python: Do not force closing original perf descriptor in evlist.get_pollfd() scripts/decode_stacktrace: only strip base path when a prefix of the path arch/sh/boards/mach-kfr2r09/setup.c: fix struct mtd_oob_ops build warning ocfs2: don't clear bh uptodate for block read ocfs2: improve ocfs2 Makefile mm/page_alloc.c: don't call kasan_free_pages() at deferred mem init zram: fix lockdep warning of free block handling isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw() gdrom: fix a memory leak bug fsl/fman: Use GFP_ATOMIC in {memac,tgec}_add_hash_mac_address() block/swim3: Fix -EBUSY error when re-opening device after unmount thermal: bcm2835: enable hwmon explicitly kdb: Don't back trace on a cpu that didn't round up PCI: imx: Enable MSI from downstream components thermal: generic-adc: Fix adc to temp interpolation HID: lenovo: Add checks to fix of_led_classdev_register arm64/sve: ptrace: Fix SVE_PT_REGS_OFFSET definition kernel/hung_task.c: break RCU locks based on jiffies proc/sysctl: fix return error for proc_doulongvec_minmax() kernel/hung_task.c: force console verbose before panic fs/epoll: drop ovflist branch prediction exec: load_script: don't blindly truncate shebang string kernel/kcov.c: mark write_comp_data() as notrace scripts/gdb: fix lx-version string output xfs: Fix xqmstats offsets in /proc/fs/xfs/xqmstat xfs: cancel COW blocks before swapext xfs: Fix error code in 'xfs_ioc_getbmap()' xfs: fix overflow in xfs_attr3_leaf_verify xfs: fix shared extent data corruption due to missing cow reservation xfs: fix transient reference count error in xfs_buf_resubmit_failed_buffers xfs: delalloc -> unwritten COW fork allocation can go wrong fs/xfs: fix f_ffree value for statfs when project quota is set xfs: fix PAGE_MASK usage in xfs_free_file_space xfs: fix inverted return from xfs_btree_sblock_verify_crc thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set dccp: fool proof ccid_hc_[rt]x_parse_options() enic: fix checksum validation for IPv6 lib/test_rhashtable: Make test_insert_dup() allocate its hash table dynamically net: dp83640: expire old TX-skb net: dsa: Fix lockdep false positive splat net: dsa: Fix NULL checking in dsa_slave_set_eee() net: dsa: mv88e6xxx: Fix counting of ATU violations net: dsa: slave: Don't propagate flag changes on down slave interfaces net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames net: systemport: Fix WoL with password after deep sleep rds: fix refcount bug in rds_sock_addref Revert "net: phy: marvell: avoid pause mode on SGMII-to-Copper for 88e151x" rxrpc: bad unlock balance in rxrpc_recvmsg sctp: check and update stream->out_curr when allocating stream_out sctp: walk the list of asoc safely skge: potential memory corruption in skge_get_regs() virtio_net: Account for tx bytes and packets on sending xdp_frames net/mlx5e: FPGA, fix Innova IPsec TX offload data path performance xfs: eof trim writeback mapping as soon as it is cached ALSA: compress: Fix stop handling on compressed capture streams ALSA: usb-audio: Add support for new T+A USB DAC ALSA: hda - Serialize codec registrations ALSA: hda/realtek - Fix lose hp_pins for disable auto mute ALSA: hda/realtek - Use a common helper for hp pin reference ALSA: hda/realtek - Headset microphone support for System76 darp5 fuse: call pipe_buf_release() under pipe lock fuse: decrement NR_WRITEBACK_TEMP on the right page fuse: handle zero sized retrieve correctly HID: debug: fix the ring buffer implementation dmaengine: bcm2835: Fix interrupt race on RT dmaengine: bcm2835: Fix abort of transactions dmaengine: imx-dma: fix wrong callback invoke futex: Handle early deadlock return correctly irqchip/gic-v3-its: Plug allocation race for devices sharing a DevID usb: phy: am335x: fix race condition in _probe usb: dwc3: gadget: Handle 0 xfer length for OUT EP usb: gadget: udc: net2272: Fix bitwise and boolean operations usb: gadget: musb: fix short isoc packets with inventra dma staging: speakup: fix tty-operation NULL derefs scsi: cxlflash: Prevent deadlock when adapter probe fails scsi: aic94xx: fix module loading KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM perf/x86/intel/uncore: Add Node ID mask x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out() perf/core: Don't WARN() for impossible ring-buffer sizes perf tests evsel-tp-sched: Fix bitwise operator serial: fix race between flush_to_ldisc and tty_open serial: 8250_pci: Make PCI class test non fatal serial: sh-sci: Do not free irqs that have already been freed cacheinfo: Keep the old value if of_property_read_u32 fails IB/hfi1: Add limit test for RC/UC send via loopback perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu() ath9k: dynack: make ewma estimation faster ath9k: dynack: check da->enabled first in sampling routines Linux 4.19.21 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2019-02-12 20:37:21 +01:00
Zoran Markovic	54e71cb050	smack: fix access permissions for keyring ... [ Upstream commit 5b841bfab6 ] Function smack_key_permission() only issues smack requests for the following operations: - KEY_NEED_READ (issues MAY_READ) - KEY_NEED_WRITE (issues MAY_WRITE) - KEY_NEED_LINK (issues MAY_WRITE) - KEY_NEED_SETATTR (issues MAY_WRITE) A blank smack request is issued in all other cases, resulting in smack access being granted if there is any rule defined between subject and object, or denied with -EACCES otherwise. Request MAY_READ access for KEY_NEED_SEARCH and KEY_NEED_VIEW. Fix the logic in the unlikely case when both MAY_READ and MAY_WRITE are needed. Validate access permission field for valid contents. Signed-off-by: Zoran Markovic <zmarkovic@sierrawireless.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Cc: Casey Schaufler <casey@schaufler-ca.com> Cc: James Morris <jmorris@namei.org> Cc: "Serge E. Hallyn" <serge@hallyn.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2019-02-12 19:47:05 +01:00
Greg Kroah-Hartman	26bf816608	This is the 4.19.18 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlxMGy0ACgkQONu9yGCS aT5ppQ/8COjyZg1aTrCrd0ttMHYotw3Lb4B6E/SCf2ub4X38SxGz9irhQ7r2FKdK w0ZXlLOF2ddqWe6BUnIfWago4Pk1GBpg3bgnp5XyYTjlJbfI2yZ9ggiO0iNYBPaL fN2JwM9eze/7cDlpYbhwGpF4+Wz8wTrzh+NIputcvC6n3SQH/cTGmOUa9rlamQju uukkvLanAYY3sqDCl4B415Ds44ROU4filqHYIkvZC81jc3Q0YZ8M7cTmpLcDQKGz 8Z+Veil07jEM9bF2W8iX79nwxMT+edFC62HMuRCoxJKq+1kccw1TVMWpQ8TWbv13 zeLOqXxNP6VcNaC251q3QzlInRDp1dtr8KtzA/OG0WFnZBTEDng/iChhiL8qZt0R 9+Sz7n9uZ5pMRK3tr03Ccjg3AneKWRqad2iaTB/kOwAdu7Uqxz8U9qUuRDFPV7OY KTMCCfdS8XpMHl/S+Cvg2dqSNiBEkNmowYO6NvQClG0aoN4/6wH+m2TZ0hCl6PVq pNFOTJmp7FOaztEZC4rqW8DoOGeGaNo5DP9A2XKKDR20F7EiAE437ApEQ4p5QGVk ek4uslZkwJWU/UOzXRl/Hoz0OlI0ixsdZy1vw88HCl7SD1E7xHJpnRUkOjigTT1Q nbCt0Nm/A2+c1tKbzU+PVW8FtIbutZhW1BtrqaIbbHr9NBTICR0= =Yg+/ -----END PGP SIGNATURE----- Merge 4.19.18 into android-4.19 Changes in 4.19.18 ipv6: Consider sk_bound_dev_if when binding a socket to a v4 mapped address mlxsw: spectrum: Disable lag port TX before removing it mlxsw: spectrum_switchdev: Set PVID correctly during VLAN deletion net: dsa: mv88x6xxx: mv88e6390 errata net, skbuff: do not prefer skb allocation fails early qmi_wwan: add MTU default to qmap network interface r8169: Add support for new Realtek Ethernet ipv6: Take rcu_read_lock in __inet6_bind for mapped addresses net: clear skb->tstamp in bridge forwarding path netfilter: ipset: Allow matching on destination MAC address for mac and ipmac sets gpio: pl061: Move irq_chip definition inside struct pl061 drm/amd/display: Guard against null stream_state in set_crc_source drm/amdkfd: fix interrupt spin lock ixgbe: allow IPsec Tx offload in VEPA mode platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey e1000e: allow non-monotonic SYSTIM readings usb: typec: tcpm: Do not disconnect link for self powered devices selftests/bpf: enable (uncomment) all tests in test_libbpf.sh of: overlay: add missing of_node_put() after add new node to changeset writeback: don't decrement wb->refcnt if !wb->bdi serial: set suppress_bind_attrs flag only if builtin bpf: Allow narrow loads with offset > 0 ALSA: oxfw: add support for APOGEE duet FireWire x86/mce: Fix -Wmissing-prototypes warnings MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur crypto: ecc - regularize scalar for scalar multiplication arm64: perf: set suppress_bind_attrs flag to true drm/atomic-helper: Complete fake_commit->flip_done potentially earlier clk: meson: meson8b: fix incorrect divider mapping in cpu_scale_table samples: bpf: fix: error handling regarding kprobe_events usb: gadget: udc: renesas_usb3: add a safety connection way for forced_b_device fpga: altera-cvp: fix probing for multiple FPGAs on the bus selinux: always allow mounting submounts ASoC: pcm3168a: Don't disable pcm3168a when CONFIG_PM defined scsi: qedi: Check for session online before getting iSCSI TLV data. drm/amdgpu: Reorder uvd ring init before uvd resume rxe: IB_WR_REG_MR does not capture MR's iova field efi/libstub: Disable some warnings for x86{,_64} jffs2: Fix use of uninitialized delayed_work, lockdep breakage clk: imx: make mux parent strings const pstore/ram: Do not treat empty buffers as valid media: uvcvideo: Refactor teardown of uvc on USB disconnect powerpc/xmon: Fix invocation inside lock region powerpc/pseries/cpuidle: Fix preempt warning media: firewire: Fix app_info parameter type in avc_ca{,_app}_info ASoC: use dma_ops of parent device for acp_audio_dma media: venus: core: Set dma maximum segment size staging: erofs: fix use-after-free of on-stack `z_erofs_vle_unzip_io' net: call sk_dst_reset when set SO_DONTROUTE scsi: target: use consistent left-aligned ASCII INQUIRY data scsi: target/core: Make sure that target_wait_for_sess_cmds() waits long enough selftests: do not macro-expand failed assertion expressions arm64: kasan: Increase stack size for KASAN_EXTRA clk: imx6q: reset exclusive gates on init arm64: Fix minor issues with the dcache_by_line_op macro bpf: relax verifier restriction on BPF_MOV | BPF_ALU kconfig: fix file name and line number of warn_ignored_character() kconfig: fix memory leak when EOF is encountered in quotation mmc: atmel-mci: do not assume idle after atmci_request_end btrfs: volumes: Make sure there is no overlap of dev extents at mount time btrfs: alloc_chunk: fix more DUP stripe size handling btrfs: fix use-after-free due to race between replace start and cancel btrfs: improve error handling of btrfs_add_link tty/serial: do not free trasnmit buffer page under port lock perf intel-pt: Fix error with config term "pt=0" perf tests ARM: Disable breakpoint tests 32-bit perf svghelper: Fix unchecked usage of strncpy() perf parse-events: Fix unchecked usage of strncpy() perf vendor events intel: Fix Load_Miss_Real_Latency on SKL/SKX netfilter: ipt_CLUSTERIP: check MAC address when duplicate config is set netfilter: ipt_CLUSTERIP: remove wrong WARN_ON_ONCE in netns exit routine netfilter: ipt_CLUSTERIP: fix deadlock in netns exit routine x86/topology: Use total_cpus for max logical packages calculation dm crypt: use u64 instead of sector_t to store iv_offset dm kcopyd: Fix bug causing workqueue stalls perf stat: Avoid segfaults caused by negated options tools lib subcmd: Don't add the kernel sources to the include path dm snapshot: Fix excessive memory usage and workqueue stalls perf cs-etm: Correct packets swapping in cs_etm__flush() perf tools: Add missing sigqueue() prototype for systems lacking it perf tools: Add missing open_memstream() prototype for systems lacking it quota: Lock s_umount in exclusive mode for Q_XQUOTA{ON,OFF} quotactls. clocksource/drivers/integrator-ap: Add missing of_node_put() dm: Check for device sector overflow if CONFIG_LBDAF is not set Bluetooth: btusb: Add support for Intel bluetooth device 8087:0029 ALSA: bebob: fix model-id of unit for Apogee Ensemble sysfs: Disable lockdep for driver bind/unbind files IB/usnic: Fix potential deadlock scsi: mpt3sas: fix memory ordering on 64bit writes scsi: smartpqi: correct lun reset issues ath10k: fix peer stats null pointer dereference scsi: smartpqi: call pqi_free_interrupts() in pqi_shutdown() scsi: megaraid: fix out-of-bound array accesses iomap: don't search past page end in iomap_is_partially_uptodate ocfs2: fix panic due to unrecovered local alloc mm/page-writeback.c: don't break integrity writeback on ->writepage() error mm/swap: use nr_node_ids for avail_lists in swap_info_struct userfaultfd: clear flag if remap event not enabled mm, proc: be more verbose about unstable VMA flags in /proc/<pid>/smaps iwlwifi: mvm: Send LQ command as async when necessary Bluetooth: Fix unnecessary error message for HCI request completion ipmi: fix use-after-free of user->release_barrier.rda ipmi: msghandler: Fix potential Spectre v1 vulnerabilities ipmi: Prevent use-after-free in deliver_response ipmi:ssif: Fix handling of multi-part return messages ipmi: Don't initialize anything in the core until something uses it Linux 4.19.18 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2019-01-26 11:58:37 +01:00
Ondrej Mosnacek	34ea589d97	selinux: always allow mounting submounts ... [ Upstream commit 2cbdcb882f ] If a superblock has the MS_SUBMOUNT flag set, we should always allow mounting it. These mounts are done automatically by the kernel either as part of mounting some parent mount (e.g. debugfs always mounts tracefs under "tracing" for compatibility) or they are mounted automatically as needed on subdirectory accesses (e.g. NFS crossmnt mounts). Since such automounts are either an implicit consequence of the parent mount (which is already checked) or they can happen during regular accesses (where it doesn't make sense to check against the current task's context), the mount permission check should be skipped for them. Without this patch, attempts to access contents of an automounted directory can cause unexpected SELinux denials. In the current kernel tree, the MS_SUBMOUNT flag is set only via vfs_submount(), which is called only from the following places: - AFS, when automounting special "symlinks" referencing other cells - CIFS, when automounting "referrals" - NFS, when automounting subtrees - debugfs, when automounting tracefs In all cases the submounts are meant to be transparent to the user and it makes sense that if mounting the master is allowed, then so should be the automounts. Note that CAP_SYS_ADMIN capability checking is already skipped for (SB_KERNMOUNT|SB_SUBMOUNT) in: - sget_userns() in fs/super.c: if (!(flags & (SB_KERNMOUNT|SB_SUBMOUNT)) && !(type->fs_flags & FS_USERNS_MOUNT) && !capable(CAP_SYS_ADMIN)) return ERR_PTR(-EPERM); - sget() in fs/super.c: /* Ensure the requestor has permissions over the target filesystem */ if (!(flags & (SB_KERNMOUNT|SB_SUBMOUNT)) && !ns_capable(user_ns, CAP_SYS_ADMIN)) return ERR_PTR(-EPERM); Verified internally on patched RHEL 7.6 with a reproducer using NFS+httpd and selinux-tesuite. Fixes: 93faccbbfa ("fs: Better permission checking for submounts") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2019-01-26 09:32:36 +01:00
Greg Kroah-Hartman	73dc755ee0	This is the 4.19.17 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlxHf8cACgkQONu9yGCS aT71Mg/9FnDYja+AD9hj01kFsh6+C4K/QLZY69kLgzmNvr1htsWLRvxSta0dIKc0 In4rianKMhOHekGub6ufO0Ne1jPV9ZCF61cZ/oENISB5D/oVZJL+baR92zeodSg9 XFBPRu9eKPQV+UFPliyyKEJtyWEmLHvJMOQkKft0reduZgPy0xonkQ97K48QmF9G b/Ly6E8c/qfQThIqn0wfPQ2DUYET9cCE667iw8+Mwzr2HYuLoltyp9ODyMW2fuNT vyKve8s+IQ8wCKy1fkwyIJD7CjV0mJMJfUYx1Ax+ewU6MtBDrhEyfcfA9sJfsyRH k/BydK4aQJqcejp8ajOVQjZFZtGMnuTM38n3SpJnyNLWz6JvCTQr8dl2A5Y5/iph Q1FQH9BHKWCCJO8JVjfMYhCewvdo47mjE1gUfs9HyyW4SjJxhJCn07u2LU1YCRHW G9NqRb208UZw7O6prCsdZRlZPJjon1Fln7ym/esKjuMRyNNycV093ysPaqzhKrJq 2Dxgt+fYBaP63BawAZUC+kQ0iX4OcSja78F4txbVBeksqskNAPHreMbcd5PDid/h bN89kPVCIV0eFJa0AMuKHdrbljRH/I6wbKmz3KvyjoRgq8KGc2PvrSe4DTJfax3W gOEnESLn7r58oUQ0OmfSv7U4zU700tuH9wOpFZyb5vqVvdXcQzA= =NSqX -----END PGP SIGNATURE----- Merge 4.19.17 into android-4.19 Changes in 4.19.17 tty/ldsem: Wake up readers after timed out down_write() tty: Hold tty_ldisc_lock() during tty_reopen() tty: Simplify tty->count math in tty_reopen() tty: Don't hold ldisc lock in tty_reopen() if ldisc present can: gw: ensure DLC boundaries after CAN frame modification netfilter: nf_conncount: replace CONNCOUNT_LOCK_SLOTS with CONNCOUNT_SLOTS netfilter: nf_conncount: don't skip eviction when age is negative netfilter: nf_conncount: split gc in two phases netfilter: nf_conncount: restart search when nodes have been erased netfilter: nf_conncount: merge lookup and add functions netfilter: nf_conncount: move all list iterations under spinlock netfilter: nf_conncount: speculative garbage collection on empty lists netfilter: nf_conncount: fix argument order to find_next_bit mmc: sdhci-msm: Disable CDR function on TX Revert "scsi: target: iscsi: cxgbit: fix csk leak" scsi: target: iscsi: cxgbit: fix csk leak scsi: target: iscsi: cxgbit: fix csk leak arm64/kvm: consistently handle host HCR_EL2 flags arm64: Don't trap host pointer auth use to EL2 ipv6: fix kernel-infoleak in ipv6_local_error() net: bridge: fix a bug on using a neighbour cache entry without checking its state packet: Do not leak dev refcounts on error exit tcp: change txhash on SYN-data timeout tun: publish tfile after it's fully initialized lan743x: Remove phy_read from link status change function smc: move unhash as early as possible in smc_release() r8169: don't try to read counters if chip is in a PCI power-save state bonding: update nest level on unlink ip: on queued skb use skb_header_pointer instead of pskb_may_pull r8169: load Realtek PHY driver module before r8169 crypto: sm3 - fix undefined shift by >= width of value crypto: caam - fix zero-length buffer DMA mapping crypto: authencesn - Avoid twice completion call in decrypt path crypto: ccree - convert to use crypto_authenc_extractkeys() crypto: bcm - convert to use crypto_authenc_extractkeys() crypto: authenc - fix parsing key with misaligned rta_len crypto: talitos - reorder code in talitos_edesc_alloc() crypto: talitos - fix ablkcipher for CONFIG_VMAP_STACK xen: Fix x86 sched_clock() interface for xen Revert "btrfs: balance dirty metadata pages in btrfs_finish_ordered_io" btrfs: wait on ordered extents on abort cleanup Yama: Check for pid death before checking ancestry scsi: core: Synchronize request queue PM status only on successful resume scsi: sd: Fix cache_type_store() mips: fix n32 compat_ipc_parse_version MIPS: BCM47XX: Setup struct device for the SoC MIPS: lantiq: Fix IPI interrupt handling drm/i915/gvt: Fix mmap range check OF: properties: add missing of_node_put mfd: tps6586x: Handle interrupts on suspend media: v4l: ioctl: Validate num_planes for debug messages RDMA/nldev: Don't expose unsafe global rkey to regular user RDMA/vmw_pvrdma: Return the correct opcode when creating WR kbuild: Disable LD_DEAD_CODE_DATA_ELIMINATION with ftrace & GCC <= 4.7 net: dsa: realtek-smi: fix OF child-node lookup pstore/ram: Avoid allocation and leak of platform data arm64: kaslr: ensure randomized quantities are clean to the PoC arm64: dts: marvell: armada-ap806: reserve PSCI area Disable MSI also when pcie-octeon.pcie_disable on fix int_sqrt64() for very large numbers omap2fb: Fix stack memory disclosure media: vivid: fix error handling of kthread_run media: vivid: set min width/height to a value > 0 bpf: in __bpf_redirect_no_mac pull mac only if present ipv6: make icmp6_send() robust against null skb->dev LSM: Check for NULL cred-security on free media: vb2: vb2_mmap: move lock up sunrpc: handle ENOMEM in rpcb_getport_async netfilter: ebtables: account ebt_table_info to kmemcg block: use rcu_work instead of call_rcu to avoid sleep in softirq selinux: fix GPF on invalid policy blockdev: Fix livelocks on loop device sctp: allocate sctp_sockaddr_entry with kzalloc tipc: fix uninit-value in in tipc_conn_rcv_sub tipc: fix uninit-value in tipc_nl_compat_link_reset_stats tipc: fix uninit-value in tipc_nl_compat_bearer_enable tipc: fix uninit-value in tipc_nl_compat_link_set tipc: fix uninit-value in tipc_nl_compat_name_table_dump tipc: fix uninit-value in tipc_nl_compat_doit block/loop: Don't grab "struct file" for vfs_getattr() operation. block/loop: Use global lock for ioctl() operation. loop: Fold __loop_release into loop_release loop: Get rid of loop_index_mutex loop: Push lo_ctl_mutex down into individual ioctls loop: Split setting of lo_state from loop_clr_fd loop: Push loop_ctl_mutex down into loop_clr_fd() loop: Push loop_ctl_mutex down to loop_get_status() loop: Push loop_ctl_mutex down to loop_set_status() loop: Push loop_ctl_mutex down to loop_set_fd() loop: Push loop_ctl_mutex down to loop_change_fd() loop: Move special partition reread handling in loop_clr_fd() loop: Move loop_reread_partitions() out of loop_ctl_mutex loop: Fix deadlock when calling blkdev_reread_part() loop: Avoid circular locking dependency between loop_ctl_mutex and bd_mutex loop: Get rid of 'nested' acquisition of loop_ctl_mutex loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl() loop: drop caches if offset or block_size are changed drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock selftests: Fix test errors related to lib.mk khdr target media: vb2: be sure to unlock mutex on errors nbd: Use set_blocksize() to set device blocksize Linux 4.19.17 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2019-01-23 08:46:58 +01:00
Stephen Smalley	5a79e71e0b	selinux: fix GPF on invalid policy ... commit 5b0e7310a2 upstream. levdatum->level can be NULL if we encounter an error while loading the policy during sens_read prior to initializing it. Make sure sens_destroy handles that case correctly. Reported-by: syzbot+6664500f0f18f07a5c0e@syzkaller.appspotmail.com Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-01-22 21:40:35 +01:00
James Morris	a19aedf1a7	LSM: Check for NULL cred-security on free ... commit a5795fd38e upstream. From: Casey Schaufler <casey@schaufler-ca.com> Check that the cred security blob has been set before trying to clean it up. There is a case during credential initialization that could result in this. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Acked-by: John Johansen <john.johansen@canonical.com> Signed-off-by: James Morris <james.morris@microsoft.com> Reported-by: syzbot+69ca07954461f189e808@syzkaller.appspotmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-01-22 21:40:35 +01:00
Kees Cook	b955a2c756	Yama: Check for pid death before checking ancestry ... commit 9474f4e7cd upstream. It's possible that a pid has died before we take the rcu lock, in which case we can't walk the ancestry list as it may be detached. Instead, check for death first before doing the walk. Reported-by: syzbot+a9ac39bf55329e206219@syzkaller.appspotmail.com Fixes: 2d514487fa ("security: Yama LSM") Cc: stable@vger.kernel.org Suggested-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: James Morris <james.morris@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-01-22 21:40:32 +01:00