This is the start of the stable review cycle for the 3.18.50 release. There are 124 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat Apr 22 06:35:33 UTC 2017. Anything received after that time might be too late. The whole patch series can be found in one patch at: kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.50-rc1.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> Linux 3.18.50-rc1 Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> give up on gcc ilog2() constant optimizations James Hogan <james.hogan@xxxxxxxxxx> metag/usercopy: Add missing fixups James Hogan <james.hogan@xxxxxxxxxx> metag/usercopy: Fix src fixup in from user rapf loops James Hogan <james.hogan@xxxxxxxxxx> metag/usercopy: Set flags before ADDZ James Hogan <james.hogan@xxxxxxxxxx> metag/usercopy: Zero rest of buffer from copy_from_user James Hogan <james.hogan@xxxxxxxxxx> metag/usercopy: Add early abort to copy_to_user James Hogan <james.hogan@xxxxxxxxxx> metag/usercopy: Fix alignment error checking James Hogan <james.hogan@xxxxxxxxxx> metag/usercopy: Drop unused macros Huacai Chen <chenhc@xxxxxxxxxx> MIPS: Flush wrong invalid FTLB entry for huge page Wei Yongjun <yongjun_wei@xxxxxxxxxxxxxxxxx> ring-buffer: Fix return value check in test_ringbuffer() Chris Salls <salls@xxxxxxxxxxx> mm/mempolicy.c: fix error handling in set_mempolicy and mbind. Rafał Miłecki <rafal@xxxxxxxxxx> mtd: bcm47xxpart: fix parsing first block after aligned TRX Naoya Horiguchi <n-horiguchi@xxxxxxxxxxxxx> mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd() Bjorn Andersson <bjorn.andersson@xxxxxxxxxx> pinctrl: qcom: Don't clear status bit on irq_unmask Ladi Prosek <lprosek@xxxxxxxxxx> virtio_balloon: init 1st buffer in stats vq Mauricio Faria de Oliveira <mauricfo@xxxxxxxxxxxxxxxxxx> block: allow WRITE_SAME commands with the SG_IO ioctl Henrik Ingo <henrik.ingo@xxxxxxxxxxxxx> uvcvideo: uvc_scan_fallback() for webcams with broken chain Gabriel Krisman Bertazi <krisman@xxxxxxxxxxxxxxxxxx> serial: 8250_pci: Detach low-level driver during PCI error recovery Joerg Roedel <jroedel@xxxxxxx> ACPI: Do not create a platform_device for IOAPIC/IOxAPIC Josh Poimboeuf <jpoimboe@xxxxxxxxxx> ACPI: Fix incompatibility with mcount-based function graph tracing Darrick J. Wong <darrick.wong@xxxxxxxxxx> xfs: clear _XBF_PAGES from buffers when readahead page Eric Sandeen <sandeen@xxxxxxxxxxx> xfs: fix up xfs_swap_extent_forks inline extent handling Darrick J. Wong <darrick.wong@xxxxxxxxxx> xfs: don't allow di_size with high bit set Todd Fujinaka <todd.fujinaka@xxxxxxxxx> igb: add i211 to i210 PHY workaround Chris J Arges <christopherarges@xxxxxxxxx> igb: Workaround for igb i210 firmware issue Koos Vriezen <koos.vriezen@xxxxxxxxx> iommu/vt-d: Fix NULL pointer dereference in device_to_iommu Adrian Hunter <adrian.hunter@xxxxxxxxx> mmc: sdhci: Do not disable interrupts while waiting for clock Eric Biggers <ebiggers@xxxxxxxxxx> ext4: mark inode dirty after converting inline directory Michael Engl <michael.engl@xxxxxxxxxxxxxxxxx> iio: adc: ti_am335x_adc: fix fifo overrun recovery Johan Hovold <johan@xxxxxxxxxx> USB: usbtmc: add missing endpoint sanity check Johan Hovold <johan@xxxxxxxxxx> uwb: i1480-dfu: fix NULL-deref at probe Johan Hovold <johan@xxxxxxxxxx> uwb: hwa-rc: fix NULL-deref at probe Johan Hovold <johan@xxxxxxxxxx> mmc: ushc: fix NULL-deref at probe Eric Dumazet <edumazet@xxxxxxxxxx> tcp: initialize icsk_ack.lrcvtime at session start time Daniel Borkmann <daniel@xxxxxxxxxxxxx> socket, bpf: fix sk_filter use after free in sk_clone_lock Andrey Ulanov <andreyu@xxxxxxxxxx> net: unix: properly re-increment inflight counter of GC discarded candidates Eric Dumazet <edumazet@xxxxxxxxxx> net: properly release sk_frag.page Florian Fainelli <f.fainelli@xxxxxxxxx> net: bcmgenet: Do not suspend PHY if Wake-on-LAN is enabled Maor Gottlieb <maorg@xxxxxxxxxxxx> net/mlx5: Increase number of max QPs in default profile Oliver Neukum <oneukum@xxxxxxxx> ACM gadget: fix endianness in notifications Johan Hovold <johan@xxxxxxxxxx> Input: sur40 - validate number of endpoints before using them Johan Hovold <johan@xxxxxxxxxx> Input: kbtab - validate number of endpoints before using them Johan Hovold <johan@xxxxxxxxxx> Input: cm109 - validate number of endpoints before using them Johan Hovold <johan@xxxxxxxxxx> Input: yealink - validate number of endpoints before using them Johan Hovold <johan@xxxxxxxxxx> Input: hanwang - validate number of endpoints before using them Johan Hovold <johan@xxxxxxxxxx> Input: ims-pcu - validate number of endpoints before using them Johan Hovold <johan@xxxxxxxxxx> Input: iforce - validate number of endpoints before using them Kai-Heng Feng <kai.heng.feng@xxxxxxxxxxxxx> Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000 Eric Dumazet <edumazet@xxxxxxxxxx> ipv4: provide stronger user input validation in nl_fib_input() Tahsin Erdogan <tahsin@xxxxxxxxxx> percpu: acquire pcpu_lock when updating pcpu_nr_empty_pop_pages Johan Hovold <johan@xxxxxxxxxx> isdn/gigaset: fix NULL-deref at probe Max Lohrmann <post@xxxxxxxxxxxxxx> target: Fix VERIFY_16 handling in sbc_parse_cdb Shaohua Li <shli@xxxxxx> md/raid1/10: fix potential deadlock Peter Zijlstra <peterz@xxxxxxxxxxxxx> perf/core: Fix event inheritance on fork() Marc Zyngier <marc.zyngier@xxxxxxx> arm/arm64: KVM: Take mmap_sem in kvm_arch_prepare_memory_region David Hildenbrand <david@xxxxxxxxxx> KVM: kvm_io_bus_unregister_dev() should never fail Peter Xu <peterx@xxxxxxxxxx> KVM: x86: clear bus pointer when destroyed Thomas Huth <thuth@xxxxxxxxxx> KVM: PPC: Book3S PR: Fix illegal opcode emulation Roman Mashak <mrv@xxxxxxxxxxxx> net sched actions: decrement module reference count after table flush. Marcelo Ricardo Leitner <marcelo.leitner@xxxxxxxxx> sctp: deny peeloff operation on asocs with threads sleeping on it Mantas M <grawity@xxxxxxxxx> net: ipv6: check route protocol when deleting routes Ben Hutchings <ben@xxxxxxxxxxxxxxx> catc: Use heap buffer for memory size test Ben Hutchings <ben@xxxxxxxxxxxxxxx> catc: Combine failure cleanup code in catc_probe() Ben Hutchings <ben@xxxxxxxxxxxxxxx> rtl8150: Use heap buffers for all register access Ben Hutchings <ben@xxxxxxxxxxxxxxx> pegasus: Use heap buffers for all register access Omar Sandoval <osandov@xxxxxx> virtio-console: avoid DMA from stack Stefan Brüns <stefan.bruens@xxxxxxxxxxxxxx> dvb-usb-firmware: don't do DMA on stack Mauro Carvalho Chehab <mchehab@xxxxxxxxxxxxxxxx> dvb-usb: don't use stack for firmware load Kees Cook <keescook@xxxxxxxxxxxx> mm: Tighten x86 /dev/mem with zeroing reads Thierry Reding <treding@xxxxxxxxxx> rtc: tegra: Implement clock handling Lee, Chun-Yi <joeyli.kernel@xxxxxxxxx> platform/x86: acer-wmi: setup accelerometer when machine has appropriate notify event Arnd Bergmann <arnd@xxxxxxxx> dvb-usb-v2: avoid use-after-free Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> crypto: ahash - Fix EINPROGRESS notification callback Benjamin Herrenschmidt <benh@xxxxxxxxxxxxxxxxxxx> powerpc: Disable HFSCR[TM] if TM is not supported Minchan Kim <minchan@xxxxxxxxxx> zram: do not use copy_page with non-page aligned address Richard Genoud <richard.genoud@xxxxxxxxx> tty/serial: atmel: fix race condition (TX+DMA) Horia Geantă <horia.geanta@xxxxxxx> crypto: caam - fix RNG deinstantiation error checking Ankur Arora <ankur.a.arora@xxxxxxxxxx> xen/acpi: upload PM state from init-domain to Xen John Garry <john.garry@xxxxxxxxxx> scsi: libsas: fix ata xfer length peter chang <dpf@xxxxxxxxxx> scsi: sg: check length passed to SG_NEXT_CMD_LEN Chris Leech <cleech@xxxxxxxxxx> scsi: libiscsi: add lock around task lists to fix list corruption regression Anton Blanchard <anton@xxxxxxxxx> scsi: lpfc: Add shutdown method for kexec Nicholas Bellinger <nab@xxxxxxxxxxxxxxx> target/pscsi: Fix TYPE_TAPE + TYPE_MEDIMUM_CHANGER export Michael Ellerman <mpe@xxxxxxxxxxxxxx> powerpc/boot: Fix zImage TOC alignment Paul Mackerras <paulus@xxxxxxxxxx> powerpc: Don't try to fix up misaligned load-with-reservation instructions Frederic Barrat <fbarrat@xxxxxxxxxxxxxxxxxx> powerpc/mm: Add missing global TLB invalidate if cxl is active Takashi Iwai <tiwai@xxxxxxx> ALSA: seq: Fix race during FIFO resize Takashi Iwai <tiwai@xxxxxxx> ALSA: seq: Fix racy cell insertions during snd_seq_pool_done() Uwe Kleine-König <uwe@xxxxxxxxxxxxxxxxx> rtc: s35390a: improve irq handling Uwe Kleine-König <uwe@xxxxxxxxxxxxxxxxx> rtc: s35390a: implement reset routine as suggested by the reference Uwe Kleine-König <uwe@xxxxxxxxxxxxxxxxx> rtc: s35390a: make sure all members in the output are set Uwe Kleine-König <uwe@xxxxxxxxxxxxxxxxx> rtc: s35390a: fix reading out alarm Vitaly Kuznetsov <vkuznets@xxxxxxxxxx> Drivers: hv: balloon: don't crash when memory is added in non-sorted order bsegall@xxxxxxxxxx <bsegall@xxxxxxxxxx> ptrace: fix PTRACE_LISTEN race corrupting task->state Jan-Marek Glogowski <glogow@xxxxxxxxxx> Reset TreeId to zero on SMB2 TREE_CONNECT Heiko Carstens <heiko.carstens@xxxxxxxxxx> s390/uaccess: get_user() should zero on failure (again) Marcelo Henrique Cerri <marcelo.cerri@xxxxxxxxxxxxx> s390/decompressor: fix initrd corruption caused by bss clear Dave Martin <Dave.Martin@xxxxxxx> metag/ptrace: Reject partial NT_METAG_RPIPE writes Dave Martin <Dave.Martin@xxxxxxx> metag/ptrace: Provide default TXSTATUS for short NT_PRSTATUS Dave Martin <Dave.Martin@xxxxxxx> metag/ptrace: Preserve previous registers for short regset write Dave Martin <Dave.Martin@xxxxxxx> sparc/ptrace: Preserve previous registers for short regset write Dave Martin <Dave.Martin@xxxxxxx> mips/ptrace: Preserve previous registers for short regset write Dave Martin <Dave.Martin@xxxxxxx> c6x/ptrace: Remove useless PTRACE_SETREGSET implementation Li Qiang <liq3ea@xxxxxxxxx> drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() Thomas Hellstrom <thellstrom@xxxxxxxxxx> drm/vmwgfx: Remove getparam error message Thomas Hellstrom <thellstrom@xxxxxxxxxx> drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces Murray McAllister <murray.mcallister@xxxxxxxxxxxxxxx> drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl() Murray McAllister <murray.mcallister@xxxxxxxxxxxxxxx> drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() Thomas Hellstrom <thellstrom@xxxxxxxxxx> drm/vmwgfx: Type-check lookups of fence objects Paolo Bonzini <pbonzini@xxxxxxxxxx> kvm: fix page struct leak in handle_vmon Amit Pundir <amit.pundir@xxxxxxxxxx> Revert "ARM: 8457/1: psci-smp is built only for SMP" Max Bires <jbires@xxxxxxxxxx> char: lack of bool string made CONFIG_DEVPORT always on Geert Uytterhoeven <geert@xxxxxxxxxxxxxx> char: Drop bogus dependency of DEVPORT on !M68K Steven Rostedt (VMware) <rostedt@xxxxxxxxxxx> ftrace: Fix removing of second function probe Juergen Gross <jgross@xxxxxxxx> xen, fbfront: fix connecting to backend Martin K. Petersen <martin.petersen@xxxxxxxxxx> scsi: sd: Fix capacity calculation with 32-bit sector_t Martin K. Petersen <martin.petersen@xxxxxxxxxx> scsi: sr: Sanity check returned mode data Nicholas Bellinger <nab@xxxxxxxxxxxxxxx> iscsi-target: Drop work-around for legacy GlobalSAN initiator Nicholas Bellinger <nab@xxxxxxxxxxxxxxx> iscsi-target: Fix TMR reference leak during session shutdown Mathias Krause <minipli@xxxxxxxxxxxxxx> x86/vdso: Ensure vdso32_enabled gets set to valid values only Thomas Gleixner <tglx@xxxxxxxxxxxxx> x86/vdso: Plug race between mapping and ELF header setup Peter Zijlstra <peterz@xxxxxxxxxxxxx> perf/x86: Avoid exposing wrong/stale data in intel_pmu_lbr_read_32() Cameron Gutman <aicommander@xxxxxxxxx> Input: xpad - add support for Razer Wildcat gamepad Germano Percossi <germano.percossi@xxxxxxxxxx> CIFS: store results of cifs_reopen_file to avoid infinite wait ------------- Diffstat: Makefile | 4 +- arch/arm/include/asm/psci.h | 2 +- arch/arm/kvm/mmu.c | 3 + arch/c6x/kernel/ptrace.c | 41 ---- arch/metag/include/asm/uaccess.h | 15 +- arch/metag/kernel/ptrace.c | 19 +- arch/metag/lib/usercopy.c | 312 ++++++++++--------------- arch/mips/kernel/ptrace.c | 3 +- arch/mips/mm/tlbex.c | 25 +- arch/powerpc/boot/zImage.lds.S | 1 + arch/powerpc/kernel/align.c | 27 ++- arch/powerpc/kernel/setup_64.c | 9 + arch/powerpc/kvm/emulate.c | 1 - arch/powerpc/mm/hash_native_64.c | 7 +- arch/s390/boot/compressed/misc.c | 35 +-- arch/s390/include/asm/uaccess.h | 2 +- arch/sparc/kernel/ptrace_64.c | 2 +- arch/x86/include/asm/elf.h | 2 +- arch/x86/kernel/cpu/perf_event_intel_lbr.c | 2 + arch/x86/kvm/vmx.c | 10 +- arch/x86/mm/init.c | 40 +++- arch/x86/vdso/vdso32-setup.c | 11 +- block/scsi_ioctl.c | 3 + crypto/ahash.c | 79 ++++--- drivers/acpi/Makefile | 1 - drivers/acpi/acpi_platform.c | 8 +- drivers/block/zram/zram_drv.c | 6 +- drivers/char/Kconfig | 6 +- drivers/char/mem.c | 82 ++++--- drivers/char/virtio_console.c | 12 +- drivers/crypto/caam/ctrl.c | 3 +- drivers/gpu/drm/ttm/ttm_object.c | 10 +- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 79 ++++--- drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 31 ++- drivers/hv/hv_balloon.c | 4 +- drivers/iio/adc/ti_am335x_adc.c | 13 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/xpad.c | 2 + drivers/input/misc/cm109.c | 4 + drivers/input/misc/ims-pcu.c | 4 + drivers/input/misc/yealink.c | 4 + drivers/input/serio/i8042-x86ia64io.h | 7 + drivers/input/tablet/hanwang.c | 3 + drivers/input/tablet/kbtab.c | 3 + drivers/input/touchscreen/sur40.c | 3 + drivers/iommu/intel-iommu.c | 2 +- drivers/isdn/gigaset/bas-gigaset.c | 3 + drivers/md/raid10.c | 18 ++ drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 10 +- drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 33 ++- drivers/media/usb/uvc/uvc_driver.c | 118 +++++++++- drivers/mmc/host/sdhci.c | 4 +- drivers/mmc/host/ushc.c | 3 + drivers/mtd/bcm47xxpart.c | 10 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 6 +- drivers/net/ethernet/intel/igb/e1000_phy.c | 4 + drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +- drivers/net/usb/catc.c | 56 +++-- drivers/net/usb/pegasus.c | 29 ++- drivers/net/usb/rtl8150.c | 34 ++- drivers/pinctrl/qcom/pinctrl-msm.c | 4 - drivers/platform/x86/acer-wmi.c | 22 +- drivers/rtc/rtc-s35390a.c | 167 ++++++++++--- drivers/rtc/rtc-tegra.c | 28 ++- drivers/scsi/libiscsi.c | 26 ++- drivers/scsi/libsas/sas_ata.c | 2 +- drivers/scsi/lpfc/lpfc_init.c | 1 + drivers/scsi/sd.c | 20 +- drivers/scsi/sg.c | 2 + drivers/scsi/sr.c | 6 +- drivers/target/iscsi/iscsi_target_parameters.c | 16 -- drivers/target/iscsi/iscsi_target_util.c | 12 +- drivers/target/target_core_pscsi.c | 47 +--- drivers/target/target_core_sbc.c | 10 +- drivers/tty/serial/8250/8250_pci.c | 23 +- drivers/tty/serial/atmel_serial.c | 5 + drivers/usb/class/usbtmc.c | 7 + drivers/usb/gadget/function/f_acm.c | 4 +- drivers/uwb/hwa-rc.c | 3 + drivers/uwb/i1480/dfu/usb.c | 3 + drivers/video/fbdev/xen-fbfront.c | 4 +- drivers/virtio/virtio_balloon.c | 2 + drivers/xen/xen-acpi-processor.c | 34 ++- fs/cifs/file.c | 6 +- fs/cifs/smb2pdu.c | 4 + fs/ext4/inline.c | 5 +- fs/xfs/libxfs/xfs_inode_buf.c | 8 + fs/xfs/xfs_bmap_util.c | 7 +- fs/xfs/xfs_buf.c | 1 + include/crypto/internal/hash.h | 10 + include/drm/ttm/ttm_object.h | 5 +- include/linux/kvm_host.h | 4 +- include/linux/log2.h | 13 +- include/scsi/libiscsi.h | 1 + kernel/events/core.c | 5 +- kernel/ptrace.c | 14 +- kernel/trace/ftrace.c | 20 +- kernel/trace/ring_buffer.c | 8 +- mm/hugetlb.c | 6 +- mm/mempolicy.c | 20 +- mm/percpu.c | 5 +- net/core/sock.c | 16 +- net/ipv4/fib_frontend.c | 3 +- net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_minisocks.c | 1 + net/ipv6/route.c | 2 + net/sched/act_api.c | 5 +- net/sctp/socket.c | 8 +- net/unix/garbage.c | 18 +- sound/core/seq/seq_clientmgr.c | 1 + sound/core/seq/seq_fifo.c | 7 + sound/core/seq/seq_memory.c | 17 +- sound/core/seq/seq_memory.h | 1 + virt/kvm/eventfd.c | 3 +- virt/kvm/kvm_main.c | 40 +++- 117 files changed, 1293 insertions(+), 704 deletions(-)