kernel, branch linux-3.14.y

Linux 3.14.79

2016-09-11T08:00:18Z

mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED

2016-09-11T07:59:59Z

commit ad33bb04b2a6cee6c1f99fabb15cddbf93ff0433 upstream. pmd_trans_unstable()/pmd_none_or_trans_huge_or_clear_bad() were introduced to locklessy (but atomically) detect when a pmd is a regular (stable) pmd or when the pmd is unstable and can infinitely transition from pmd_none() and pmd_trans_huge() from under us, while only holding the mmap_sem for reading (for writing not). While holding the mmap_sem only for reading, MADV_DONTNEED can run from under us and so before we can assume the pmd to be a regular stable pmd we need to compare it against pmd_none() and pmd_trans_huge() in an atomic way, with pmd_trans_unstable(). The old pmd_trans_huge() left a tiny window for a race. Useful applications are unlikely to notice the difference as doing MADV_DONTNEED concurrently with a page fault would lead to undefined behavior. [js] 3.12 backport: no pmd_devmap in 3.12 yet. [akpm@linux-foundation.org: tidy up comment grammar/layout] Signed-off-by: Andrea Arcangeli Reported-by: Kirill A. Shutemov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Cc: Vlastimil Babka Signed-off-by: Jiri Slaby Signed-off-by: Greg Kroah-Hartman

fix d_walk()/non-delayed __d_free() race

2016-09-11T07:59:58Z

I checked Jari's explanation below and found that v3.14.77 and v3.12.62 are missing the same fix as 3.10. In fact Al's original commit 3d56c25 ("fix d_walk()/non-delayed __d_free() race") used to mention to check this __d_materialise_dentry() function in the Cc: stable line, but this got lost during the backports. Normally all of our 3 kernels need to apply the following patch that Ben correctly put in 3.16 and 3.2. I'm fixing the backport in 3.10.103 right now. On Mon, Aug 22, 2016 at 04:56:57PM +0300, Jari Ruusu wrote: > This patch for 3.10 branch appears to be missing one important > > + dentry->d_flags |= DCACHE_RCUACCESS; > > in fs/dcache.c __d_materialise_dentry() function. When Ben Hutchings > backported Al Viro's original fix to stable branches that he maintains, > he added that one additional line to both 3.2 and 3.16 branches. Please > consider including that additional one line fix for 3.10 stable branch > also. > > > Ben Hutchings said this on his 3.2.82-rc1 patch: > [bwh: Backported to 3.2: > - Adjust context > - Also set the flag in __d_materialise_dentry())] > > http://marc.info/?l=linux-kernel&m=147117565612275&w=2 > > > Ben Hutchings said this on his 3.16.37-rc1 patch: > [bwh: Backported to 3.16: > - Adjust context > - Also set the flag in __d_materialise_dentry())] > > http://marc.info/?l=linux-kernel&m=147117433412006&w=2 > > > Also mentioned by Sasha Levin on 3.18 and 4.1 commits: > Cc: stable@vger.kernel.org # v3.2+ (and watch out for __d_materialise_dentry()) > > http://marc.info/?l=linux-stable-commits&m=146648034410827&w=2 > http://marc.info/?l=linux-stable-commits&m=146647471009771&w=2 Signed-off-by: Greg Kroah-Hartman

s390/sclp_ctl: fix potential information leak with /dev/sclp

2016-09-11T07:59:58Z

commit 532c34b5fbf1687df63b3fcd5b2846312ac943c6 upstream. The sclp_ctl_ioctl_sccb function uses two copy_from_user calls to retrieve the sclp request from user space. The first copy_from_user fetches the length of the request which is stored in the first two bytes of the request. The second copy_from_user gets the complete sclp request, but this copies the length field a second time. A malicious user may have changed the length in the meantime. Reported-by: Pengfei Wang Reviewed-by: Michael Holzheu Signed-off-by: Martin Schwidefsky Signed-off-by: Juerg Haefliger Signed-off-by: Greg Kroah-Hartman

rds: fix an infoleak in rds_inc_info_copy

2016-09-11T07:59:58Z

commit 4116def2337991b39919f3b448326e21c40e0dbb upstream. The last field "flags" of object "minfo" is not initialized. Copying this object out may leak kernel stack data. Assign 0 to it to avoid leak. Signed-off-by: Kangjie Lu Acked-by: Santosh Shilimkar Signed-off-by: David S. Miller Signed-off-by: Juerg Haefliger Signed-off-by: Greg Kroah-Hartman

staging: comedi: ni_mio_common: fix wrong insn_write handler

2016-09-11T07:59:58Z

commit 5ca05345c56cb979e1a25ab6146437002f95cac8 upstream. For counter subdevices, the `s->insn_write` handler is being set to the wrong function, `ni_tio_insn_read()`. It should be `ni_tio_insn_write()`. Signed-off-by: Ian Abbott Reported-by: Éric Piel Fixes: 10f74377eec3 ("staging: comedi: ni_tio: make ni_tio_winsn() a proper comedi (*insn_write)") Signed-off-by: Greg Kroah-Hartman

ext4: validate that metadata blocks do not overlap superblock

2016-09-11T07:59:58Z

commit 829fa70dddadf9dd041d62b82cd7cea63943899d upstream. A number of fuzzing failures seem to be caused by allocation bitmaps or other metadata blocks being pointed at the superblock. This can cause kernel BUG or WARNings once the superblock is overwritten, so validate the group descriptor blocks to make sure this doesn't happen. Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman

stb6100: fix buffer length check in stb6100_write_reg_range()

2016-09-11T07:59:58Z

commit 7e6bd12fb77b0067df13fb3ba3fadbdff2945396 upstream. We are checking sizeof() the wrong variable! Signed-off-by: Alexander Shiyan Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab Cc: Willy Tarreau Signed-off-by: Greg Kroah-Hartman

ALSA: oxygen: Fix logical-not-parentheses warning

2016-09-11T07:59:58Z

commit 8ec7cfce3762299ae289c384e281b2f4010ae231 upstream. This fixes the following warning, that is seen with gcc 5.1: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]. Signed-off-by: Tomer Barletz Signed-off-by: Takashi Iwai Cc: Willy Tarreau Signed-off-by: Greg Kroah-Hartman

HID: hid-input: Add parentheses to quell gcc warning

2016-09-11T07:59:58Z

commit 09a5c34e8d6b05663ec4c3d22b1fbd9fec89aaf9 upstream. GCC reports a -Wlogical-not-parentheses warning here; therefore add parentheses to shut it up and to express our intent more. Signed-off-by: James C Boyd Signed-off-by: Jiri Kosina Cc: Willy Tarreau Signed-off-by: Greg Kroah-Hartman