1. 07 Dec, 2017 7 commits
  2. 06 Dec, 2017 23 commits
  3. 05 Dec, 2017 10 commits
    • Robb Glasser's avatar
      ALSA: pcm: prevent UAF in snd_pcm_info · 362bca57
      Robb Glasser authored
      When the device descriptor is closed, the `substream->runtime` pointer
      is freed. But another thread may be in the ioctl handler, case
      SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which
      calls snd_pcm_info() which accesses the now freed `substream->runtime`.
      Note: this fixes CVE-2017-0861
      Signed-off-by: default avatarRobb Glasser <rglasser@google.com>
      Signed-off-by: default avatarNick Desaulniers <ndesaulniers@google.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 13231cac
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "A bunch of fixes for aacraid, a set of coherency fixes that only
        affect non-coherent platforms and one coccinelle detected null check
        after use"
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: libsas: align sata_device's rps_resp on a cacheline
        scsi: use dma_get_cache_alignment() as minimum DMA alignment
        scsi: dma-mapping: always provide dma_get_cache_alignment
        scsi: ufs: ufshcd: fix potential NULL pointer dereference in ufshcd_config_vreg
        scsi: aacraid: Prevent crash in case of free interrupt during scsi EH path
        scsi: aacraid: Perform initialization reset only once
        scsi: aacraid: Check for PCI state of device in a generic way
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · e6cdd80a
      Linus Torvalds authored
      Pull rdma fixes from Jason Gunthorpe:
       "Here is the first rc pull request for RDMA. This includes an important
        core fix for a regression in iWarp if SELinux is enabled, a fix for a
        compilation regression introduced in this merge window, and one
        obscure kconfig combination that oops's the kernel.
        For drivers, we have hns fixes needed to make their devices work on
        certain ARM IOMMU configurations, a stack data leak for hfi1, and
        various testing discovered -rc bug fixes for i40iw.
        This cycle we pushed back on the driver maintainers to have better
        commit messages for -rc material"
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        IB/core: Only enforce security for InfiniBand
        RDMA/hns: Get rid of page operation after dma_alloc_coherent
        RDMA/hns: Get rid of virt_to_page and vmap calls after dma_alloc_coherent
        RDMA/hns: Fix the issue of IOVA not page continuous in hip08
        IB/core: Init subsys if compiled to vmlinuz-core
        RDMA/cma: Make sure that PSN is not over max allowed
        i40iw: Notify user of established connection after QP in RTS
        i40iw: Move MPA request event for loopback after connect
        i40iw: Correct ARP index mask
        i40iw: Do not free sqbuf when event is I40IW_TIMER_TYPE_CLOSE
        i40iw: Allocate a sdbuf per CQP WQE
        IB: INFINIBAND should depend on HAS_DMA
        IB/hfi1: Initialize bth1 in 16B rc ack builder
    • Linus Torvalds's avatar
      Merge tag 'char-misc-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · 6a5e05a4
      Linus Torvalds authored
      Pull char/misc fixes from Greg KH:
       "Here are some small misc driver fixes for 4.15-rc3 to resolve reported
        issues. Specifically these are:
         - binder fix for a memory leak
         - vpd driver fixes for a number of reported problems
         - hyperv driver fix for memory accesses where it shouldn't be.
        All of these have been in linux-next for a while. There's also one
        more MAINTAINERS file update that came in today to get the Android
        developer's emails correct, which is also in this pull request, that
        was not in linux-next, but should not be an issue"
      * tag 'char-misc-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        MAINTAINERS: update Android driver maintainers.
        firmware: vpd: Fix platform driver and device registration/unregistration
        firmware: vpd: Tie firmware kobject to device lifetime
        firmware: vpd: Destroy vpd sections in remove function
        hv: kvp: Avoid reading past allocated blocks from KVP file
        Drivers: hv: vmbus: Fix a rescind issue
        ANDROID: binder: fix transaction leak.
    • Linus Torvalds's avatar
      Merge tag 'driver-core-4.15-rc3' of... · 1fbd55c0
      Linus Torvalds authored
      Merge tag 'driver-core-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
      Pull driver core fixes from Greg KH:
       "Here are 3 small fixes for some reported issues:
         - a debugfs build error that lots of people have reported
         - a Kconfig help text cleanup now that the firmware is not in the
           kernel tree
         - an ISA bus bug fix for a reported issue that has been there since
        All of these have been in linux-next with no reported issues"
      * tag 'driver-core-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        firmware: cleanup FIRMWARE_IN_KERNEL message
        isa: Prevent NULL dereference in isa_bus driver callbacks
        debugfs: fix debugfs_real_fops() build error
    • Linus Torvalds's avatar
      Merge tag 'staging-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 73996933
      Linus Torvalds authored
      Pull staging and iio driver fixes from Greg KH:
       "Here are a number of small staging and iio driver fixes for reported
        issues for 4.15-rc3. Nothing major here, the majority is IIO issues,
        like normal, but there are also some small bugfixes for a few staging
        drivers as well.
        Full details are in the shortlog.
        All of these have been in linux-next for a while with no reported
      * tag 'staging-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        iio: stm32: fix adc/trigger link error
        iio: health: max30102: Temperature should be in milli Celsius
        iio: fix kernel-doc build errors
        iio: adc: meson-saradc: Meson8 and Meson8b do not have REG11 and REG13
        iio: adc: meson-saradc: initialize the bandgap correctly on older SoCs
        iio: adc: meson-saradc: fix the bit_idx of the adc_en clock
        iio: proximity: sx9500: Assign interrupt from GpioIo()
        iio: adc: cpcap: fix incorrect validation
        staging: octeon-usb: use __delay() instead of cvmx_wait()
        staging: rtl8188eu: Fix incorrect response to SIOCGIWESSID
        staging: ccree: fix leak of import() after init()
        staging: comedi: ni_atmio: fix license warning.
    • Linus Torvalds's avatar
      Merge tag 'tty-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · 84dda296
      Linus Torvalds authored
      Pull tty/serial driver fixes from Greg KH:
       "Here are some small serdev and serial fixes for 4.15-rc3. They resolve
        some reported problems:
         - a number of serdev fixes to resolve crashes
         - MIPS build fixes for their serial port
         - a new 8250 device id
        All of these have been in linux-next for a while with no reported
      * tag 'tty-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        MIPS: Add custom serial.h with BASE_BAUD override for generic kernel
        serdev: ttyport: fix tty locking in close
        serdev: ttyport: fix NULL-deref on hangup
        serdev: fix receive_buf return value when no callback
        serdev: ttyport: add missing receive_buf sanity checks
        serial: 8250_early: Only set divisor if valid clk & baud
        serial: 8250_pci: Add Amazon PCI serial device ID
    • Linus Torvalds's avatar
      Merge tag 'usb-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 6b0b3bda
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are a few minor USB fixes for 4.15-rc3.
        The largest here is the Kconfig text and configuration changes for the
        USB TypeC build options that you reported during the -rc1 merge
        window. The others are all just small fixes for reported issues, as
        well as some new device ids.
        The most "interesting" of anything here is the usbip fixes as it seems
        lots of people are starting to pay attention to that driver at the
        moment. These fixes should resolve all of the reported problems as of
        Of course there are the usual xhci and gadget fixes as well, can't go
        a pull request without those...
        All of these have been in linux-next for a while with no reported
      * tag 'usb-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (22 commits)
        usb: xhci: fix panic in xhci_free_virt_devices_depth_first
        xhci: Don't show incorrect WARN message about events for empty rings
        usbip: fix usbip attach to find a port that matches the requested speed
        usbip: Fix USB device hang due to wrong enabling of scatter-gather
        uas: Always apply US_FL_NO_ATA_1X quirk to Seagate devices
        usb: quirks: Add no-lpm quirk for KY-688 USB 3.1 Type-C Hub
        usb: build drivers/usb/common/ when USB_SUPPORT is set
        usb: hub: Cycle HUB power when initialization fails
        USB: core: Add type-specific length check of BOS descriptors
        usb: host: fix incorrect updating of offset
        USB: ulpi: fix bus-node lookup
        USB: usbfs: Filter flags passed in from user space
        usb: add user selectable option for the whole USB Type-C Support
        usb: f_fs: Force Reserved1=1 in OS_DESC_EXT_COMPAT
        usb: gadget: core: Fix ->udc_set_speed() speed handling
        usb: gadget: allow to enable legacy drivers without USB_ETH
        usb: gadget: udc: renesas_usb3: fix number of the pipes
        usb: gadget: don't dereference g until after it has been null checked
        USB: serial: usb_debug: add new USB device id
        usb: bdc: fix platform_no_drv_owner.cocci warnings
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-v4.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl · 54b99370
      Linus Torvalds authored
      Pull pin control fixes from Linus Walleij:
       "As with GPIO not much action in pin control. All are driver fixes:
         - fix the UART2 RTS pin mode on Intel Denverton
         - fix the direction_output() behaviour on the Armada 37xx
         - fix the groups selection per-SoC on the Gemini
         - fix the interrupt pin bank on the Sunxi A80
         - fix the UART mux on the Sunxi A64
         - disable the strict mode on the Sunxi H5 driver"
      * tag 'pinctrl-v4.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinctrl: sunxi: Disable strict mode for H5 driver
        pinctrl: sunxi: Fix A64 UART mux value
        pinctrl: sunxi: Fix A80 interrupt pin bank
        pinctrl: gemini: Fix usage of 3512 groups
        pinctrl: armada-37xx: Fix direction_output() callback behavior
        pinctrl: denverton: Fix UART2 RTS pin mode
    • Linus Torvalds's avatar
      Merge tag 'gpio-v4.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · f81c7287
      Linus Torvalds authored
      Pull GPIO fixes from Linus Walleij:
       "Three small fixes for GPIO. Not much, I'm surprised by the silence in
        my subsystems. All driver fixes:
         - fix a crash in the 74x164 driver
         - fix IRQ banks in the DaVinci driver
         - fix the vendor prefix in the PCA953x driver"
      * tag 'gpio-v4.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpio: pca953x: fix vendor prefix for PCA9654
        gpio: davinci: Assign first bank regs for unbanked case
        gpio: 74x164: Fix crash during .remove()