This is the start of the stable review cycle for the 3.12.64 release. There are 119 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon Oct 3 12:25:22 CEST 2016. Anything received after that time might be too late. The whole patch series can be found in one patch at: http://kernel.org/pub/linux/kernel/people/jirislaby/stable-review/patch-3.12.64-rc1.xz and the diffstat can be found below. thanks, js =============== Al Viro (26): microblaze: fix __get_user() avr32: fix copy_from_user() microblaze: fix copy_from_user() fix minor infoleak in get_user_ex() mn10300: failing __get_user() and get_user() should zero m32r: fix __get_user() sh64: failing __get_user() should zero score: fix __get_user/get_user s390: get_user() should zero on failure asm-generic: make get_user() clear the destination on errors frv: fix clear_user() cris: buggered copy_from_user/copy_to_user/clear_user blackfin: fix copy_from_user() score: fix copy_from_user() and friends sh: fix copy_from_user() hexagon: fix strncpy_from_user() error return mips: copy_from_user() must zero the destination on access_ok() failure asm-generic: make copy_from_user() zero the destination properly alpha: fix copy_from_user() metag: copy_from_user() should zero the destination on access_ok() failure parisc: fix copy_from_user() openrisc: fix copy_from_user() mn10300: copy_from_user() should zero on access_ok() failure... sparc32: fix copy_from_user() ppc32: fix copy_from_user() ia64: copy_from_user() should zero the destination on access_ok() failure Alan Stern (3): USB: validate wMaxPacketValue entries in endpoint descriptors USB: fix typo in wMaxPacketSize validation USB: change bInterval default to 10 ms Alexander Shiyan (1): stb6100: fix buffer length check in stb6100_write_reg_range() Alexey Khoroshilov (2): USB: serial: mos7720: fix non-atomic allocation in write path USB: serial: mos7840: fix non-atomic allocation in write path Alexey Klimov (1): USB: serial: fix memleak in driver-registration error path Ard Biesheuvel (1): crypto: cryptd - initialize child shash_desc on import Chen-Yu Tsai (1): clocksource/drivers/sun4i: Clear interrupts after stopping timer in probe function Christian König (1): drm/radeon: fix radeon_move_blit on 32bit systems Daeho Jeong (1): ext4: avoid modifying checksum fields directly during checksum verification Dan Carpenter (2): crypto: nx - off by one bug in nx_of_update_msc() ACPI / sysfs: fix error code in get_status() Daniel Vetter (1): drm: Reject page_flip for !DRIVER_MODESET Daniele Palmas (2): USB: serial: option: add support for Telit LE920A4 USB: serial: simple: add support for another Infineon flashloader Dave Carroll (1): aacraid: Check size values after double-fetch from user Dave Chinner (1): xfs: fix superblock inprogress check Dave Jones (1): ipv6: release dst in ping_v6_sendmsg Dmitry Torokhov (3): Input: i8042 - break load dependency between atkbd/psmouse and i8042 Input: i8042 - set up shared ps2_cmd_mutex for AUX ports Input: ili210x - fix permissions on "calibrate" attribute Emmanouil Maroudas (1): EDAC: Increment correct counter in edac_inc_ue_error() Emrah Demir (1): mISDN: Fixing missing validation in base_sock_bind() Eric Dumazet (2): tcp: fix use after free in tcp_xmit_retransmit_queue() tcp: properly scale window in tcp_v[46]_reqsk_send_ack() Felipe Balbi (1): usb: dwc3: gadget: increment request->actual once Felix Fietkau (1): mac80211: fix purging multicast PS buffer queue Gavin Li (1): cdc-acm: fix wrong pipe type on rx interrupt xfers Greg Kroah-Hartman (1): Revert "can: fix handling of unmodifiable configuration options fix" Guenter Roeck (2): avr32: fix 'undefined reference to `___copy_from_user' openrisc: fix the fix of copy_from_user() Helge Deller (1): parisc: Fix order of EREFUSED define in errno.h Ian Abbott (1): staging: comedi: daqboard2000: bug fix board type matching code James C Boyd (1): HID: hid-input: Add parentheses to quell gcc warning James Hogan (2): MIPS: KVM: Check for pfn noslot case arm64: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO Jason S. McMullan (3): PCI: Support PCIe devices with short cfg_size PCI: Add Netronome vendor and device IDs PCI: Limit config space size for Netronome NFP6000 family Jean-Gabriel Gill-Couture (1): HID: add usb device id for Apple Magic Keyboard Jim Lin (1): usb: xhci: Fix panic if disconnect Jiri Kosina (1): x86/mm/pat, /dev/mem: Remove superfluous error message Johannes Berg (1): Revert "wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel" John Stultz (1): timekeeping: Cap array access in timekeeping_debug Konstantin Khlebnikov (2): ext4: use __GFP_NOFAIL in ext4_free_blocks() net: ratelimit warnings about dst entry refcount underflow or overflow Krzysztof Kozlowski (1): hwrng: exynos - Disable runtime PM on probe failure Linus Walleij (3): gpio: Fix OF build problem on UM iio: accel: kxsd9: Fix raw read return iio: accel: kxsd9: Fix scaling bug Lubomir Rintel (1): USB: serial: option: add D-Link DWM-156/A3 Maciej S. Szmigiero (1): mISDN: Support DR6 indication in mISDNipac driver Mahesh Bandewar (1): bonding: Fix bonding crash Martin Schwidefsky (1): s390/sclp_ctl: fix potential information leak with /dev/sclp Mathias Nyman (2): usb: define USB_SPEED_SUPER_PLUS speed for SuperSpeedPlus USB3.1 devices xhci: Make sure xhci handles USB_SPEED_SUPER_PLUS devices. Michal Kubecek (2): net: disable fragment reassembly if high_thresh is set to zero ipvs: count pre-established TCP states as active Mike Snitzer (1): dm flakey: fix reads to be issued if drop_writes configured Paul Blakey (1): net/mlx5: Added missing check of msg length in verifying its signature Paul Mackerras (1): powerpc/mm: Don't alias user region to other regions below PAGE_OFFSET Rob Clark (1): drm/msm: fix use of copy_from_user() while holding spinlock Robert Deliën (1): USB: serial: ftdi_sio: add PIDs for Ivium Technologies devices Sai Gurrappadi (1): cpufreq: Fix GOV_LIMITS handling for the userspace governor Sebastian Andrzej Siewior (1): x86/mm: Disable preemption during CR3 read+write Sebastian Reichel (1): ARM: OMAP3: hwmod data: Add sysc information for DSI Sheng-Hui J. Chu (1): USB: serial: ftdi_sio: add device ID for WICED USB UART dev board Simon Horman (2): PCI: Add Netronome NFP4000 PF device ID PCI: Limit config space size for Netronome NFP4000 Soheil Hassas Yeganeh (1): tun: fix transmit timestamp support Stefan Haberland (1): s390/dasd: fix hanging device after clear subchannel Steven Rostedt (1): x86/paravirt: Do not trace _paravirt_ident_*() functions Suzuki K Poulose (1): kvm-arm: Unmap shadow pagetables properly Takashi Iwai (1): ALSA: rawmidi: Fix possible deadlock with virmidi registration Tejun Heo (1): timers: Use proper base migration in add_timer_on() Theodore Ts'o (1): ext4: validate that metadata blocks do not overlap superblock Tim Gardner (1): be2iscsi: Fix bogus WARN_ON length check Tomer Barletz (1): ALSA: oxygen: Fix logical-not-parentheses warning Trond Myklebust (1): NFSv4.x: Fix a refcount leak in nfs_callback_up_net Tyrel Datwyler (1): scsi: fix upper bounds check of sense key in scsi_sense_key_string() Vegard Nossum (5): fs/seq_file: fix out-of-bounds read net/irda: handle iriap_register_lsap() allocation failure ALSA: timer: fix NULL pointer dereference in read()/ioctl() race ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE ALSA: timer: fix NULL pointer dereference on memory allocation failure Vincent Stehlé (1): ubifs: Fix assertion in layout_in_gaps() Vineet Gupta (1): ARC: uaccess: get_user to zero out dest in cause of fault Wanpeng Li (1): x86/apic: Do not init irq remapping if ioapic is disabled Will Deacon (1): arm64: spinlocks: implement smp_mb__before_spinlock() as smp_mb() Willy Tarreau (1): fix d_walk()/non-delayed __d_free() race Yinghai Lu (1): megaraid_sas: Fix probing cards without io port Yoshihiro Shimoda (1): usb: renesas_usbhs: fix clearing the {BRDY,BEMP}STS condition arch/alpha/include/asm/uaccess.h | 19 +++--- arch/arc/include/asm/uaccess.h | 11 ++- arch/arm/kvm/arm.c | 2 - arch/arm/kvm/mmu.c | 1 + arch/arm/mach-omap2/omap_hwmod_3xxx_data.c | 12 ++++ arch/arm64/include/asm/elf.h | 1 + arch/arm64/include/asm/spinlock.h | 10 +++ arch/arm64/include/uapi/asm/auxvec.h | 2 + arch/avr32/include/asm/uaccess.h | 11 ++- arch/avr32/kernel/avr32_ksyms.c | 2 +- arch/avr32/lib/copy_user.S | 8 +-- arch/blackfin/include/asm/uaccess.h | 9 +-- arch/cris/include/asm/uaccess.h | 71 +++++++++----------- arch/frv/include/asm/uaccess.h | 12 +++- arch/hexagon/include/asm/uaccess.h | 3 +- arch/ia64/include/asm/uaccess.h | 20 +++--- arch/m32r/include/asm/uaccess.h | 2 +- arch/metag/include/asm/uaccess.h | 3 +- arch/microblaze/include/asm/uaccess.h | 11 +-- arch/mips/include/asm/uaccess.h | 3 + arch/mips/kvm/kvm_tlb.c | 2 +- arch/mn10300/include/asm/uaccess.h | 1 + arch/mn10300/lib/usercopy.c | 4 +- arch/openrisc/include/asm/uaccess.h | 35 +++------- arch/parisc/include/asm/uaccess.h | 7 +- arch/parisc/include/uapi/asm/errno.h | 4 +- arch/powerpc/include/asm/uaccess.h | 21 +----- arch/powerpc/mm/slb_low.S | 7 +- arch/s390/include/asm/uaccess.h | 8 +-- arch/score/include/asm/uaccess.h | 46 +++++++------ arch/sh/include/asm/uaccess.h | 5 +- arch/sh/include/asm/uaccess_64.h | 1 + arch/sparc/include/asm/uaccess_32.h | 4 +- arch/x86/include/asm/tlbflush.h | 7 ++ arch/x86/include/asm/uaccess.h | 6 +- arch/x86/kernel/apic/apic.c | 3 + arch/x86/kernel/paravirt.c | 4 +- arch/x86/mm/pat.c | 5 +- crypto/cryptd.c | 9 ++- drivers/acpi/sysfs.c | 7 +- drivers/char/hw_random/exynos-rng.c | 9 ++- drivers/char/mem.c | 6 +- drivers/clocksource/sun4i_timer.c | 9 ++- drivers/cpufreq/cpufreq_userspace.c | 43 ++++++++++-- drivers/crypto/nx/nx.c | 2 +- drivers/edac/edac_mc.c | 2 +- drivers/gpio/Kconfig | 1 + drivers/gpu/drm/drm_crtc.c | 3 + drivers/gpu/drm/msm/msm_gem_submit.c | 27 ++++++-- drivers/gpu/drm/radeon/radeon_ttm.c | 4 +- drivers/hid/hid-apple.c | 2 + drivers/hid/hid-core.c | 1 + drivers/hid/hid-ids.h | 1 + drivers/hid/hid-input.c | 2 +- drivers/iio/accel/kxsd9.c | 2 + drivers/input/serio/i8042.c | 17 +---- drivers/input/serio/libps2.c | 10 ++- drivers/input/touchscreen/ili210x.c | 2 +- drivers/isdn/hardware/mISDN/ipac.h | 1 + drivers/isdn/hardware/mISDN/mISDNipac.c | 2 + drivers/isdn/mISDN/socket.c | 3 + drivers/md/dm-flakey.c | 27 +++++--- drivers/media/dvb-frontends/stb6100.c | 2 +- drivers/net/bonding/bond_main.c | 7 +- drivers/net/can/dev.c | 3 - drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 86 +++++++++++++++--------- drivers/net/tun.c | 5 +- drivers/pci/pci-sysfs.c | 18 ++--- drivers/pci/quirks.c | 12 ++++ drivers/s390/block/dasd.c | 10 ++- drivers/s390/char/sclp_ctl.c | 12 ++-- drivers/scsi/aacraid/commctrl.c | 13 +++- drivers/scsi/be2iscsi/be_main.c | 2 +- drivers/scsi/constants.c | 5 +- drivers/scsi/megaraid/megaraid_sas_base.c | 6 +- drivers/scsi/megaraid/megaraid_sas_fusion.c | 2 +- drivers/staging/comedi/drivers/daqboard2000.c | 2 +- drivers/usb/class/cdc-acm.c | 5 +- drivers/usb/class/cdc-acm.h | 1 - drivers/usb/core/config.c | 97 ++++++++++++++++++++++----- drivers/usb/core/devices.c | 10 +-- drivers/usb/core/hcd-pci.c | 2 +- drivers/usb/core/hcd.c | 6 +- drivers/usb/core/hub.c | 24 ++++--- drivers/usb/core/urb.c | 3 +- drivers/usb/core/usb.h | 2 +- drivers/usb/dwc3/gadget.c | 19 +++--- drivers/usb/host/xhci-hub.c | 3 + drivers/usb/host/xhci-mem.c | 9 ++- drivers/usb/host/xhci-ring.c | 3 +- drivers/usb/host/xhci.c | 7 +- drivers/usb/renesas_usbhs/mod.c | 11 ++- drivers/usb/serial/ftdi_sio.c | 3 + drivers/usb/serial/ftdi_sio_ids.h | 12 ++++ drivers/usb/serial/mos7720.c | 2 +- drivers/usb/serial/mos7840.c | 4 +- drivers/usb/serial/option.c | 22 ++++++ drivers/usb/serial/usb-serial-simple.c | 3 +- drivers/usb/serial/usb-serial.c | 4 +- fs/dcache.c | 1 + fs/ext4/inode.c | 38 ++++++----- fs/ext4/mballoc.c | 47 +++++++------ fs/ext4/namei.c | 9 ++- fs/ext4/super.c | 36 +++++++--- fs/ext4/xattr.c | 13 ++-- fs/nfs/callback.c | 1 + fs/seq_file.c | 4 +- fs/ubifs/tnc_commit.c | 2 +- fs/xfs/xfs_sb.c | 3 +- include/asm-generic/uaccess.h | 20 ++++-- include/linux/i8042.h | 6 -- include/linux/netdevice.h | 1 + include/linux/pci_ids.h | 7 ++ include/linux/serio.h | 24 +++++-- include/net/tcp.h | 2 + include/uapi/linux/usb/ch9.h | 1 + kernel/time/timekeeping_debug.c | 9 ++- kernel/timer.c | 19 +++++- net/core/dev.c | 16 +++++ net/core/dst.c | 4 +- net/ipv4/ip_fragment.c | 4 ++ net/ipv4/tcp_ipv4.c | 8 ++- net/ipv6/netfilter/nf_conntrack_reasm.c | 3 + net/ipv6/ping.c | 9 ++- net/ipv6/reassembly.c | 4 ++ net/ipv6/tcp_ipv6.c | 8 ++- net/irda/iriap.c | 8 ++- net/mac80211/cfg.c | 2 +- net/mac80211/tx.c | 6 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 25 ++++++- net/wireless/wext-core.c | 25 +------ sound/core/rawmidi.c | 4 +- sound/core/timer.c | 20 +++++- sound/pci/oxygen/oxygen_mixer.c | 2 +- 134 files changed, 923 insertions(+), 480 deletions(-) -- 2.10.0 -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html