1. 02 Nov, 2017 31 commits
  2. 01 Nov, 2017 9 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace · 3a99df9a
      Linus Torvalds authored
      Pull signal bugfix from Eric Biederman:
       "When making the generic support for SIGEMT conditional on the presence
        of SIGEMT I made a typo that causes it to fail to activate. It was
        noticed comparatively quickly but the bug report just made it to me
        today"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:
        signal: Fix name of SIGEMT in #if defined() check
      3a99df9a
    • Andrew Clayton's avatar
      signal: Fix name of SIGEMT in #if defined() check · c3aff086
      Andrew Clayton authored
      Commit cc731525 ("signal: Remove kernel interal si_code magic")
      added a check for SIGMET and NSIGEMT being defined. That SIGMET should
      in fact be SIGEMT, with SIGEMT being defined in
      arch/{alpha,mips,sparc}/include/uapi/asm/signal.h
      
      This was actually pointed out by BenHutchings in a lwn.net comment
      here https://lwn.net/Comments/734608/
      
      Fixes: cc731525 ("signal: Remove kernel interal si_code magic")
      Signed-off-by: default avatarAndrew Clayton <andrew@digital-domain.net>
      Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
      c3aff086
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · 1cc15701
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A few fixes that should go into this series:
      
         - Regression fix for ide-cd, ensuring that a request is fully
           initialized. From Hongxu.
      
         - Ditto fix for virtio_blk, from Bart.
      
         - NVMe fix from Keith, ensuring that we set the right block size on
           revalidation. If the block size changed, we'd be in trouble without
           it.
      
         - NVMe rdma fix from Sagi, fixing a potential hang while the
           controller is being removed"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        ide:ide-cd: fix kernel panic resulting from missing scsi_req_init
        nvme: Fix setting logical block format when revalidating
        virtio_blk: Fix an SG_IO regression
        nvme-rdma: fix possible hang when issuing commands during ctrl removal
      1cc15701
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 4f2ba5dc
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix refcounting in xfrm_bundle_lookup() when using a dummy bundle,
          from Steffen Klassert.
      
       2) Fix crypto header handling in rx data frames in ath10k driver, from
          Vasanthakumar Thiagarajan.
      
       3) Fix use after free of qdisc when we defer tcp_chain_flush() to a
          workqueue. From Cong Wang.
      
       4) Fix double free in lapbether driver, from Pan Bian.
      
       5) Sanitize TUNSETSNDBUF values, from Craig Gallek.
      
       6) Fix refcounting when addrconf_permanent_addr() calls
          ipv6_del_addr(). From Eric Dumazet.
      
       7) Fix MTU probing bug in TCP that goes back to 2007, from Eric
          Dumazet.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
        tcp: fix tcp_mtu_probe() vs highest_sack
        ipv6: addrconf: increment ifp refcount before ipv6_del_addr()
        tun/tap: sanitize TUNSETSNDBUF input
        mlxsw: i2c: Fix buffer increment counter for write transaction
        mlxsw: reg: Add high and low temperature thresholds
        MAINTAINERS: Remove Yotam from mlxfw
        MAINTAINERS: Update Yotam's E-mail
        net: hns: set correct return value
        net: lapbether: fix double free
        bpf: remove SK_REDIRECT from UAPI
        net: phy: marvell: Only configure RGMII delays when using RGMII
        xfrm: Fix GSO for IPsec with GRE tunnel.
        tc-testing: fix arg to ip command: -s -> -n
        net_sched: remove tcf_block_put_deferred()
        l2tp: hold tunnel in pppol2tp_connect()
        Revert "ath10k: fix napi_poll budget overflow"
        ath10k: rebuild crypto header in rx data frames
        wcn36xx: Remove unnecessary rcu_read_unlock in wcn36xx_bss_info_changed
        xfrm: Clear sk_dst_cache when applying per-socket policy.
        xfrm: Fix xfrm_dst_cache memleak
      4f2ba5dc
    • Vlastimil Babka's avatar
      x86/mm: fix use-after-free of vma during userfaultfd fault · cb0631fd
      Vlastimil Babka authored
      Syzkaller with KASAN has reported a use-after-free of vma->vm_flags in
      __do_page_fault() with the following reproducer:
      
        mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
        mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
        r0 = userfaultfd(0x0)
        ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000-0x18)={0xaa, 0x0, 0x0})
        ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000019000)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1, 0x0})
        r1 = gettid()
        syz_open_dev$evdev(&(0x7f0000013000-0x12)="2f6465762f696e7075742f6576656e742300", 0x0, 0x0)
        tkill(r1, 0x7)
      
      The vma should be pinned by mmap_sem, but handle_userfault() might (in a
      return to userspace scenario) release it and then acquire again, so when
      we return to __do_page_fault() (with other result than VM_FAULT_RETRY),
      the vma might be gone.
      
      Specifically, per Andrea the scenario is
       "A return to userland to repeat the page fault later with a
        VM_FAULT_NOPAGE retval (potentially after handling any pending signal
        during the return to userland). The return to userland is identified
        whenever FAULT_FLAG_USER|FAULT_FLAG_KILLABLE are both set in
        vmf->flags"
      
      However, since commit a3c4fb7c ("x86/mm: Fix fault error path using
      unsafe vma pointer") there is a vma_pkey() read of vma->vm_flags after
      that point, which can thus become use-after-free.  Fix this by moving
      the read before calling handle_mm_fault().
      Reported-by: default avatarsyzbot <bot+6a5269ce759a7bb12754ed9622076dc93f65a1f6@syzkaller.appspotmail.com>
      Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Suggested-by: default avatarKirill A. Shutemov <kirill@shutemov.name>
      Fixes: 3c4fb7c9c2e ("x86/mm: Fix fault error path using unsafe vma pointer")
      Reviewed-by: default avatarAndrea Arcangeli <aarcange@redhat.com>
      Signed-off-by: default avatarVlastimil Babka <vbabka@suse.cz>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      cb0631fd
    • Linus Torvalds's avatar
      Merge tag 'smb3-file-name-too-long-fix' of git://git.samba.org/sfrench/cifs-2.6 · 89db69d6
      Linus Torvalds authored
      Pull cifs fix from Steve French:
       "smb3 file name too long fix"
      
      * tag 'smb3-file-name-too-long-fix' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: check MaxPathNameComponentLength != 0 before using it
      89db69d6
    • Hongxu Jia's avatar
      ide:ide-cd: fix kernel panic resulting from missing scsi_req_init · 79d73346
      Hongxu Jia authored
      Since we split the scsi_request out of struct request, while the
      standard prep_rq_fn builds 10 byte cmds, it missed to invoke
      scsi_req_init() to initialize certain fields of a scsi_request
      structure (.__cmd[], .cmd, .cmd_len and .sense_len but no other
      members of struct scsi_request).
      
      An example panic on virtual machines (qemu/virtualbox) to boot
      from IDE cdrom:
      ...
      [    8.754381] Call Trace:
      [    8.755419]  blk_peek_request+0x182/0x2e0
      [    8.755863]  blk_fetch_request+0x1c/0x40
      [    8.756148]  ? ktime_get+0x40/0xa0
      [    8.756385]  do_ide_request+0x37d/0x660
      [    8.756704]  ? cfq_group_service_tree_add+0x98/0xc0
      [    8.757011]  ? cfq_service_tree_add+0x1e5/0x2c0
      [    8.757313]  ? ktime_get+0x40/0xa0
      [    8.757544]  __blk_run_queue+0x3d/0x60
      [    8.757837]  queue_unplugged+0x2f/0xc0
      [    8.758088]  blk_flush_plug_list+0x1f4/0x240
      [    8.758362]  blk_finish_plug+0x2c/0x40
      ...
      [    8.770906] RIP: ide_cdrom_prep_fn+0x63/0x180 RSP: ffff92aec018bae8
      [    8.772329] ---[ end trace 6408481e551a85c9 ]---
      ...
      
      Fixes: 82ed4db4 ("block: split scsi_request out of struct request")
      Signed-off-by: default avatarHongxu Jia <hongxu.jia@windriver.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      79d73346
    • David S. Miller's avatar
      Merge branch 'for-upstream' of... · 59c1cecc
      David S. Miller authored
      Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
      
      Johan Hedberg says:
      
      ====================
      pull request: bluetooth-next 2017-11-01
      
      Here's one more bluetooth-next pull request for the 4.15 kernel.
      
       - New NFA344A device entry for btusb drvier
       - Fix race conditions in hci_ldisc
       - Fix for isochronous interface assignments in btusb driver
       - A few other smaller fixes & improvements
      
      Please let me know if there are any issues pulling. Thanks.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      59c1cecc
    • Alexei Starovoitov's avatar
      bpf: fix verifier memory leaks · 1969db47
      Alexei Starovoitov authored
      fix verifier memory leaks
      
      Fixes: 638f5b90 ("bpf: reduce verifier memory consumption")
      Signed-off-by: default avatarAlexei Starovoitov <ast@fb.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1969db47