This is the start of the stable review cycle for the 4.11.3 release. There are 197 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu May 25 20:07:44 UTC 2017. Anything received after that time might be too late. The whole patch series can be found in one patch at: kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.11.3-rc1.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.11.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> Linux 4.11.3-rc1 Tadeusz Struk <tadeusz.struk@xxxxxxxxx> IB/hfi1: Protect the global dev_cntr_names and port_cntr_names Chris Wilson <chris@xxxxxxxxxxxxxxxxxx> drm/i915/gvt: Disable access to stolen memory as a guest Julius Werner <jwerner@xxxxxxxxxxxx> drivers: char: mem: Check for address space wraparound with mmap() Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx> nfsd: Fix up the "supattr_exclcreat" attributes J. Bruce Fields <bfields@xxxxxxxxxx> nfsd: encoders mustn't use unitialized values in error cases Ari Kauppi <ari@xxxxxxxxxxxx> nfsd: fix undefined behavior in nfsd4_layout_verify Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx> NFSv4: Fix an rcu lock leak Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx> pNFS/flexfiles: Check the result of nfs4_pnfs_ds_connect Benjamin Coddington <bcodding@xxxxxxxxxx> NFS: Use GFP_NOIO for two allocations in writeback Fred Isaman <fred.isaman@xxxxxxxxx> NFS: Fix use after free in write error path Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx> NFSv4: Fix a hang in OPEN related to server reboot Mario Kleiner <mario.kleiner.de@xxxxxxxxx> drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2 Alexander Couzens <lynxis@xxxxxxx> mtd: nand: add ooblayout for old hamming layout Roger Quadros <rogerq@xxxxxx> mtd: nand: omap2: Fix partition creation via cmdline mtdparts Simon Baatz <gmbnomis@xxxxxxxxx> mtd: nand: orion: fix clk handling Lukas Wunner <lukas@xxxxxxxxx> PCI: Freeze PME scan before suspending devices David Woodhouse <dwmw@xxxxxxxxxxxx> PCI: Only allow WC mmap on prefetchable resources David Woodhouse <dwmw@xxxxxxxxxxxx> PCI: Fix another sanity check bug in /proc/pci mmap David Woodhouse <dwmw@xxxxxxxxxxxx> PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms K. Y. Srinivasan <kys@xxxxxxxxxxxxx> PCI: hv: Specify CPU_AFFINITY_ALL for MSI affinity when >= 32 CPUs K. Y. Srinivasan <kys@xxxxxxxxxxxxx> PCI: hv: Allocate interrupt descriptors with GFP_ATOMIC Tomasz Nowicki <tn@xxxxxxxxxxxx> PCI/ACPI: Add ThunderX pass2.x 2nd node MCFG quirk Bjorn Helgaas <bhelgaas@xxxxxxxxxx> PCI/ACPI: Tidy up MCFG quirk whitespace Dawei Chien <dawei.chien@xxxxxxxxxxxx> thermal: mt8173: minor mtk_thermal.c cleanups Thomas Gleixner <tglx@xxxxxxxxxxxxx> tracing/kprobes: Enforce kprobes teardown after testing Arnd Bergmann <arnd@xxxxxxxx> firmware: ti_sci: fix strncat length check Masami Hiramatsu <mhiramat@xxxxxxxxxx> um: Fix to call read_initrd after init_bootmem Lars Ellenberg <lars.ellenberg@xxxxxxxxxx> drbd: fix request leak introduced by locking/atomic, kref: Kill kref_sub() Al Viro <viro@xxxxxxxxxxxxxxxxxx> osf_wait4(): fix infoleak Suzuki K Poulose <suzuki.poulose@xxxxxxx> kvm: arm/arm64: Force reading uncached stage2 PGD Suzuki K Poulose <suzuki.poulose@xxxxxxx> kvm: arm/arm64: Fix use after free of stage2 page table Suzuki K Poulose <suzuki.poulose@xxxxxxx> kvm: arm/arm64: Fix race in resetting stage2 PGD Huacai Chen <chenhc@xxxxxxxxxx> MIPS: Loongson-3: Select MIPS_L1_CACHE_SHIFT_6 Jon Derrick <jonathan.derrick@xxxxxxxxx> nvme: unmap CMB and remove sysfs file in reset path Thomas Gleixner <tglx@xxxxxxxxxxxxx> genirq: Fix chained interrupt data ordering Johan Hovold <johan@xxxxxxxxxx> uwb: fix device quirk on big-endian hosts Daniel Micay <danielmicay@xxxxxxxxx> stackprotector: Increase the per-task stack canary's random range from 32 bits to 64 bits on 64-bit platforms James Hogan <james.hogan@xxxxxxxxxx> metag/uaccess: Check access_ok in strncpy_from_user James Hogan <james.hogan@xxxxxxxxxx> metag/uaccess: Fix access_ok() Li, Fei <fei.li@xxxxxxxxx> cpuidle: check dev before usage in cpuidle_use_deepest_state() KarimAllah Ahmed <karahmed@xxxxxxxxx> iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings Malcolm Priestley <tvboxspy@xxxxxxxxx> staging: rtl8192e: GetTs Fix invalid TID 7 warning. Malcolm Priestley <tvboxspy@xxxxxxxxx> staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD. Malcolm Priestley <tvboxspy@xxxxxxxxx> staging: rtl8192e: fix 2 byte alignment of register BSSIDR. Malcolm Priestley <tvboxspy@xxxxxxxxx> staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory. Phil Elwell <phil@xxxxxxxxxxxxxxx> staging: vc04_services: Fix bulk cache maintenance Kristina Martsenko <kristina.martsenko@xxxxxxx> arm64: documentation: document tagged pointer stack constraints Kristina Martsenko <kristina.martsenko@xxxxxxx> arm64: entry: improve data abort handling of tagged pointers Kristina Martsenko <kristina.martsenko@xxxxxxx> arm64: hw_breakpoint: fix watchpoint matching for tagged pointers Kristina Martsenko <kristina.martsenko@xxxxxxx> arm64: traps: fix userspace cache maintenance emulation on a tagged pointer Mark Rutland <mark.rutland@xxxxxxx> arm64: uaccess: ensure extension of access_ok() addr Mark Rutland <mark.rutland@xxxxxxx> arm64: armv8_deprecated: ensure extension of addr Mark Rutland <mark.rutland@xxxxxxx> arm64: ensure extension of smp_store_release value Mark Rutland <mark.rutland@xxxxxxx> arm64: xchg: hazard against entire exchange variable Daniel Lezcano <daniel.lezcano@xxxxxxxxxx> arm64: dts: hi6220: Reset the mmc hosts Leonard Crestez <leonard.crestez@xxxxxxx> ARM: dts: imx6sx-sdb: Remove OPP override Ludovic Desroches <ludovic.desroches@xxxxxxxxxxxxx> ARM: dts: at91: sama5d3_xplained: not all ADC channels are available Ludovic Desroches <ludovic.desroches@xxxxxxxxxxxxx> ARM: dts: at91: sama5d3_xplained: fix ADC vref Vladimir Murzin <vladimir.murzin@xxxxxxx> ARM: 8670/1: V7M: Do not corrupt vector table around v7m_invalidate_l1 call Jon Medhurst <tixy@xxxxxxxxxx> ARM: 8667/3: Fix memory attribute inconsistencies when using fixmap Ard Biesheuvel <ard.biesheuvel@xxxxxxxxxx> ARM: 8662/1: module: split core and init PLT sections Zhichao Huang <zhichao.huang@xxxxxxxxxx> KVM: arm: plug potential guest hardware debug leakage Marc Zyngier <marc.zyngier@xxxxxxx> KVM: arm/arm64: vgic-v3: Do not use Active+Pending state for a HW interrupt Marc Zyngier <marc.zyngier@xxxxxxx> KVM: arm/arm64: vgic-v2: Do not use Active+Pending state for a HW interrupt Marc Zyngier <marc.zyngier@xxxxxxx> arm: KVM: Do not use stack-protector to compile HYP code Marc Zyngier <marc.zyngier@xxxxxxx> arm64: KVM: Do not use stack-protector to compile EL2 code Michael Neuling <mikey@xxxxxxxxxxx> powerpc/tm: Fix FP and VMX register corruption Michael Ellerman <mpe@xxxxxxxxxxxxxx> powerpc/mm: Fix crash in page table dump with huge pages LiuHailong <liu.hailong6@xxxxxxxxxx> powerpc/64e: Fix hang when debugging programs with relocated kernel Alistair Popple <alistair@xxxxxxxxxxxx> powerpc/powernv: Fix TCE kill on NVLink2 Alexey Kardashevskiy <aik@xxxxxxxxx> powerpc/iommu: Do not call PageTransHuge() on tail pages Tyrel Datwyler <tyreld@xxxxxxxxxxxxxxxxxx> powerpc/sysfs: Fix reference leak of cpu device_nodes present at boot Tyrel Datwyler <tyreld@xxxxxxxxxxxxxxxxxx> powerpc/pseries: Fix of_node_put() underflow during DLPAR remove Mahesh Salgaonkar <mahesh@xxxxxxxxxxxxxxxxxx> powerpc/book3s/mce: Move add_taint() later in virtual mode Russell Currey <ruscur@xxxxxxxxxx> powerpc/eeh: Avoid use after free in eeh_handle_special_event() David Gibson <david@xxxxxxxxxxxxxxxxxxxxx> powerpc/mm: Ensure IRQs are off in switch_mm() Johan Hovold <johan@xxxxxxxxxx> cx231xx-cards: fix NULL-deref at probe Johan Hovold <johan@xxxxxxxxxx> cx231xx-audio: fix NULL-deref at probe Johan Hovold <johan@xxxxxxxxxx> cx231xx-audio: fix init error path Alyssa Milburn <amilburn@xxxxxxxx> dw2102: limit messages to buffer size Alyssa Milburn <amilburn@xxxxxxxx> digitv: limit messages to buffer size Daniel Scheller <d.scheller@xxxxxxx> dvb-frontends/cxd2841er: define symbol_rate_min/max in T/C fe-ops Alyssa Milburn <amilburn@xxxxxxxx> zr364xx: enforce minimum size when reading header Johan Hovold <johan@xxxxxxxxxx> dib0700: fix NULL-deref at probe Marek Szyprowski <m.szyprowski@xxxxxxxxxxx> s5p-mfc: Fix unbalanced call to clock management Johan Hovold <johan@xxxxxxxxxx> gspca: konica: add missing endpoint sanity check Marek Szyprowski <m.szyprowski@xxxxxxxxxxx> s5p-mfc: Fix race between interrupt routine and device functions Lee Jones <lee.jones@xxxxxxxxxx> cec: Fix runtime BUG when (CONFIG_RC_CORE && !CEC_CAP_RC) Srinivas Pandruvada <srinivas.pandruvada@xxxxxxxxxxxxxxx> iio: hid-sensor: Store restore poll and hysteresis on S3 Matt Ranostay <matt.ranostay@xxxxxxxxxxxx> iio: proximity: as3935: fix as3935_write Dan Carpenter <dan.carpenter@xxxxxxxxxx> ipx: call ipxitf_put() in ioctl error path Johan Hovold <johan@xxxxxxxxxx> USB: hub: fix non-SS hub-descriptor handling Johan Hovold <johan@xxxxxxxxxx> USB: hub: fix SS hub-descriptor handling Johan Hovold <johan@xxxxxxxxxx> USB: serial: io_ti: fix div-by-zero in set_termios Johan Hovold <johan@xxxxxxxxxx> USB: serial: mct_u232: fix big-endian baud-rate handling Bjørn Mork <bjorn@xxxxxxx> USB: serial: qcserial: add more Lenovo EM74xx device IDs Daniele Palmas <dnlplm@xxxxxxxxx> usb: serial: option: add Telit ME910 support Johan Hovold <johan@xxxxxxxxxx> USB: iowarrior: fix info ioctl on big-endian hosts Tony Lindgren <tony@xxxxxxxxxxx> usb: musb: Fix trying to suspend while active for OTG configurations Peter Ujfalusi <peter.ujfalusi@xxxxxx> usb: musb: tusb6010_omap: Do not reset the other direction's packet size Thinh Nguyen <Thinh.Nguyen@xxxxxxxxxxxx> usb: dwc3: gadget: Prevent losing events in event cache Ben Hutchings <ben@xxxxxxxxxxxxxxx> dvb-usb-dibusb-mc-common: Add MODULE_LICENSE Alyssa Milburn <amilburn@xxxxxxxx> ttusb2: limit messages to buffer size Johan Hovold <johan@xxxxxxxxxx> mceusb: fix NULL-deref at probe Johan Hovold <johan@xxxxxxxxxx> usbvision: fix NULL-deref at probe Johan Hovold <johan@xxxxxxxxxx> net: irda: irda-usb: fix firmware name on big-endian hosts Peter Chen <peter.chen@xxxxxxx> usb: host: xhci-mem: allocate zeroed Scratchpad Buffer Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx> xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton Alan Stern <stern@xxxxxxxxxxxxxxxxxxx> USB: xhci: fix lock-inversion problem Thomas Petazzoni <thomas.petazzoni@xxxxxxxxxxxxxxxxxx> usb: host: xhci-plat: propagate return value of platform_get_irq() Matthias Lange <matthias.lange@xxxxxxxxxxxxxxx> xhci: remove GFP_DMA flag from allocation Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx> xhci: Fix command ring stop regression in 4.11 Yazen Ghannam <yazen.ghannam@xxxxxxx> EDAC, amd64: Fix reporting of Chip Select sizes on Fam17h Jan Kara <jack@xxxxxxx> dax: fix data corruption when fault races with write Toshi Kani <toshi.kani@xxxxxxx> libnvdimm: fix clear length of nvdimm_forget_poison() David Howells <dhowells@xxxxxxxxxx> Make stat/lstat/fstatat pass AT_NO_AUTOMOUNT to vfs_statx() Johan Hovold <johan@xxxxxxxxxx> USB: chaoskey: fix Alea quirk on big-endian hosts Andrey Korolyov <andrey@xxxxxxx> USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs Anthony Mallet <anthony.mallet@xxxxxxx> USB: serial: ftdi_sio: fix setting latency for unprivileged users Kirill Tkhai <ktkhai@xxxxxxxxxxxxx> pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes() Eric W. Biederman <ebiederm@xxxxxxxxxxxx> pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes Michael J. Ruhl <michael.j.ruhl@xxxxxxxxx> IB/hfi1: Fix a subcontext memory leak Michael J. Ruhl <michael.j.ruhl@xxxxxxxxx> IB/hfi1: Return an error on memory allocation failure Fabrice Gasnier <fabrice.gasnier@xxxxxx> iio: stm32 trigger: fix sampling_frequency read Andreas Klinger <ak@xxxxxxxxxxxxx> IIO: bmp280-core.c: fix error in humidity calculation Pavel Roskin <plroskin@xxxxxxxxx> iio: dac: ad7303: fix channel description James Smart <jsmart2021@xxxxxxxxx> scsi: lpfc: Fix panic on BFS configuration Bryant G. Ly <bryantly@xxxxxxxxxxxxxxxxxx> ibmvscsis: Do not send aborted task response Johan Hovold <johan@xxxxxxxxxx> of: fdt: add missing allocation-failure check Tyrel Datwyler <tyreld@xxxxxxxxxxxxxxxxxx> of: fix "/cpus" reference leak in of_numa_parse_cpu_nodes() Rob Herring <robh@xxxxxxxxxx> of: fix sparse warning in of_pci_range_parser_one Takashi Iwai <tiwai@xxxxxxx> proc: Fix unbalanced hard link numbers Vaibhav Jain <vaibhav@xxxxxxxxxxxxxxxxxx> cxl: Route eeh events to all drivers in cxl_pci_error_detected() Vaibhav Jain <vaibhav@xxxxxxxxxxxxxxxxxx> cxl: Force context lock during EEH flow Gerd Hoffmann <kraxel@xxxxxxxxxx> ohci-pci: add qemu quirk Tobias Herzog <t-herzog@xxxxxx> cdc-acm: fix possible invalid access when processing notification David Rivshin <DRivshin@xxxxxxxxxxx> gpio: omap: return error if requested debounce time is not possible Ben Skeggs <bskeggs@xxxxxxxxxx> drm/nouveau/tmr: handle races with hw when updating the next alarm time Ben Skeggs <bskeggs@xxxxxxxxxx> drm/nouveau/tmr: avoid processing completed alarms when adding a new one Ben Skeggs <bskeggs@xxxxxxxxxx> drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm Ben Skeggs <bskeggs@xxxxxxxxxx> drm/nouveau/tmr: ack interrupt before processing alarms Ben Skeggs <bskeggs@xxxxxxxxxx> drm/nouveau/kms/nv50: skip core channel cursor update on position-only changes Ben Skeggs <bskeggs@xxxxxxxxxx> drm/nouveau/kms/nv50: fix source-rect-only plane updates Ben Skeggs <bskeggs@xxxxxxxxxx> drm/nouveau/therm: remove ineffective workarounds for alarm bugs Mario Kleiner <mario.kleiner.de@xxxxxxxxx> drm/amdgpu: Add missing lb_vblank_lead_lines setup to DCE-6 path. Mario Kleiner <mario.kleiner.de@xxxxxxxxx> drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations. Mario Kleiner <mario.kleiner.de@xxxxxxxxx> drm/amdgpu: Make display watermark calculations more accurate Johan Hovold <johan@xxxxxxxxxx> ath9k_htc: fix NULL-deref at probe Dmitry Tunin <hanipouspilot@xxxxxxxxx> ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device Martin Schwidefsky <schwidefsky@xxxxxxxxxx> s390/cputime: fix incorrect system time Michael Holzheu <holzheu@xxxxxxxxxxxxxxxxxx> s390/kdump: Add final note Richard Cochran <rcochran@xxxxxxxxxxxxx> regulator: tps65023: Fix inverted core enable logic. Wadim Egorov <w.egorov@xxxxxxxxx> regulator: rk808: Fix RK818 LDO2 Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> x86: fix 32-bit case of __get_user_asm_u64() Wanpeng Li <wanpeng.li@xxxxxxxxxxx> KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation Wanpeng Li <wanpeng.li@xxxxxxxxxxx> KVM: x86: Fix potential preemption when get the current kvmclock timestamp Wanpeng Li <wanpeng.li@xxxxxxxxxxx> KVM: x86: Fix load damaged SSEx MXCSR register Daniel Glöckner <dg@xxxxxxxxx> ima: accept previously set IMA_NEW_FILE Brian Norris <briannorris@xxxxxxxxxxxx> mwifiex: pcie: fix cmd_buf use-after-free in remove/reset Brian Norris <briannorris@xxxxxxxxxxxx> mwifiex: MAC randomization should not be persistent Larry Finger <Larry.Finger@xxxxxxxxxxxx> rtlwifi: rtl8821ae: setup 8812ae RFE according to device type NeilBrown <neilb@xxxxxxxx> md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop Dennis Yang <dennisyang@xxxxxxxx> md: update slab_cache before releasing new stripes when stripes resizing Joe Thornber <ejt@xxxxxxxxxx> dm space map disk: fix some book keeping in the disk space map Joe Thornber <ejt@xxxxxxxxxx> dm thin metadata: call precommit before saving the roots Mikulas Patocka <mpatocka@xxxxxxxxxx> dm bufio: make the parameter "retain_bytes" unsigned long Mike Snitzer <snitzer@xxxxxxxxxx> dm cache metadata: fail operations if fail_io mode has been established Bart Van Assche <bart.vanassche@xxxxxxxxxxx> dm mpath: delay requeuing while path initialization is in progress Bart Van Assche <bart.vanassche@xxxxxxxxxxx> dm mpath: avoid that path removal can trigger an infinite loop Bart Van Assche <bart.vanassche@xxxxxxxxxxx> dm mpath: split and rename activate_path() to prepare for its expanded use Bart Van Assche <bart.vanassche@xxxxxxxxxxx> dm mpath: requeue after a small delay if blk_get_request() fails Mikulas Patocka <mpatocka@xxxxxxxxxx> dm bufio: check new buffer allocation watermark every 30 seconds Mikulas Patocka <mpatocka@xxxxxxxxxx> dm bufio: avoid a possible ABBA deadlock Mikulas Patocka <mpatocka@xxxxxxxxxx> dm raid: select the Kconfig option CONFIG_MD_RAID0 Vinothkumar Raja <vinraja@xxxxxxxxxxxxxxxxx> dm btree: fix for dm_btree_find_lowest_key() Paolo Abeni <pabeni@xxxxxxxxxx> infiniband: call ipv6 route lookup via the stub interface Sagi Grimberg <sagi@xxxxxxxxxxx> mlx5: Fix mlx5_ib_map_mr_sg mr length Alexander Sverdlin <alexander.sverdlin@xxxxxxxxx> ASoC: cs4271: configure reset GPIO as output Petr Vandrovec <petr@xxxxxxxxxx> tpm: fix handling of the TPM 2.0 event logs Hon Ching \(Vicky) Lo <honclo@xxxxxxxxxxxxxxxxxx> vTPM: Fix missing NULL check Jerry Snitselaar <jsnitsel@xxxxxxxxxx> tpm_crb: check for bad response size Nayna Jain <nayna@xxxxxxxxxxxxxxxxxx> tpm: add sleep only for retry in i2c_nuvoton_write_status() Nayna Jain <nayna@xxxxxxxxxxxxxxxxxx> tpm: msleep() delays - replace with usleep_range() in i2c nuvoton driver Peter Huewe <peter.huewe@xxxxxxxxxxxx> tpm_tis_spi: Add small delay after last transfer Peter Huewe <peter.huewe@xxxxxxxxxxxx> tpm_tis_spi: Remove limitation of transfers to MAX_SPI_FRAMESIZE bytes Peter Huewe <peter.huewe@xxxxxxxxxxxx> tpm_tis_spi: Check correct byte for wait state indicator Peter Huewe <peter.huewe@xxxxxxxxxxxx> tpm_tis_spi: Abort transfer when too many wait states are signaled Peter Huewe <peter.huewe@xxxxxxxxxxxx> tpm_tis_spi: Use single function to transfer data Amir Goldstein <amir73il@xxxxxxxxx> fanotify: don't expose EOPENSTALE to userspace Jeeja KP <jeeja.kp@xxxxxxxxx> ALSA: hda: Fix cpu lockup when stopping the cmd dmas Alexander Steffen <Alexander.Steffen@xxxxxxxxxxxx> tpm_tis_core: Choose appropriate timeout for reading burstcount Vamsi Krishna Samavedam <vskrishn@xxxxxxxxxxxxxx> USB: core: replace %p with %pK Willy Tarreau <w@xxxxxx> char: lp: fix possible integer overflow in lp_setup() Johan Hovold <johan@xxxxxxxxxx> watchdog: pcwd_usb: fix NULL-deref at probe Alan Stern <stern@xxxxxxxxxxxxxxxxxxx> USB: ene_usb6250: fix DMA to the stack Maksim Salau <maksim.salau@xxxxxxxxx> usb: misc: legousbtower: Fix memory leak Maksim Salau <maksim.salau@xxxxxxxxx> usb: misc: legousbtower: Fix buffers on stack ------------- Diffstat: Documentation/arm64/tagged-pointers.txt | 62 ++++++-- Makefile | 4 +- arch/alpha/kernel/osf_sys.c | 6 +- arch/arm/boot/dts/at91-sama5d3_xplained.dts | 5 +- arch/arm/boot/dts/imx6sx-sdb.dts | 17 --- arch/arm/include/asm/fixmap.h | 2 +- arch/arm/include/asm/kvm_coproc.h | 3 +- arch/arm/include/asm/module.h | 9 +- arch/arm/kernel/module-plts.c | 87 +++++++---- arch/arm/kernel/module.lds | 1 + arch/arm/kernel/setup.c | 4 +- arch/arm/kvm/coproc.c | 77 +++++++--- arch/arm/kvm/handle_exit.c | 4 +- arch/arm/kvm/hyp/Makefile | 2 + arch/arm/kvm/hyp/switch.c | 4 +- arch/arm/kvm/mmu.c | 33 +++-- arch/arm/mm/mmu.c | 16 ++- arch/arm/mm/proc-v7m.S | 4 +- arch/arm64/boot/dts/hisilicon/hi6220.dtsi | 3 + arch/arm64/include/asm/asm-uaccess.h | 9 ++ arch/arm64/include/asm/barrier.h | 20 ++- arch/arm64/include/asm/cmpxchg.h | 2 +- arch/arm64/include/asm/uaccess.h | 9 +- arch/arm64/kernel/armv8_deprecated.c | 3 +- arch/arm64/kernel/entry.S | 5 +- arch/arm64/kernel/hw_breakpoint.c | 3 + arch/arm64/kernel/traps.c | 4 +- arch/arm64/kvm/hyp/Makefile | 2 + arch/metag/include/asm/uaccess.h | 49 ++++--- arch/mips/Kconfig | 1 + arch/powerpc/include/asm/mmu_context.h | 17 ++- arch/powerpc/kernel/eeh_driver.c | 19 ++- arch/powerpc/kernel/exceptions-64e.S | 12 ++ arch/powerpc/kernel/mce.c | 2 + arch/powerpc/kernel/process.c | 19 +++ arch/powerpc/kernel/sysfs.c | 6 + arch/powerpc/kernel/traps.c | 4 +- arch/powerpc/mm/dump_linuxpagetables.c | 7 +- arch/powerpc/mm/mmu_context_iommu.c | 4 +- arch/powerpc/platforms/powernv/npu-dma.c | 8 +- arch/powerpc/platforms/powernv/pci-ioda.c | 10 +- arch/powerpc/platforms/powernv/pci.h | 2 +- arch/powerpc/platforms/pseries/dlpar.c | 1 - arch/s390/kernel/crash_dump.c | 15 ++ arch/s390/kernel/entry.S | 21 ++- arch/um/kernel/initrd.c | 4 +- arch/um/kernel/um_arch.c | 6 + arch/x86/include/asm/uaccess.h | 6 +- arch/x86/kernel/fpu/init.c | 1 + arch/x86/kvm/x86.c | 43 ++++-- drivers/acpi/pci_mcfg.c | 14 +- drivers/block/drbd/drbd_req.c | 27 ++-- drivers/char/lp.c | 6 +- drivers/char/mem.c | 5 + drivers/char/tpm/tpm2_eventlog.c | 14 +- drivers/char/tpm/tpm_crb.c | 3 +- drivers/char/tpm/tpm_i2c_nuvoton.c | 24 ++-- drivers/char/tpm/tpm_ibmvtpm.c | 8 +- drivers/char/tpm/tpm_tis_core.c | 6 +- drivers/char/tpm/tpm_tis_spi.c | 160 +++++++++------------ drivers/cpuidle/cpuidle.c | 3 +- drivers/edac/amd64_edac.c | 40 +++--- drivers/firmware/ti_sci.c | 3 +- drivers/gpio/gpio-omap.c | 23 ++- drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 29 ++-- drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 29 ++-- drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 36 ++--- drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 29 ++-- drivers/gpu/drm/drm_edid.c | 8 ++ drivers/gpu/drm/i915/i915_gem_stolen.c | 5 + drivers/gpu/drm/nouveau/nv50_display.c | 18 +-- drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 59 +++++--- drivers/gpu/drm/nouveau/nvkm/subdev/timer/nv04.c | 2 +- .../iio/common/hid-sensors/hid-sensor-attributes.c | 26 +++- .../iio/common/hid-sensors/hid-sensor-trigger.c | 20 ++- drivers/iio/dac/ad7303.c | 6 +- drivers/iio/pressure/bmp280-core.c | 11 +- drivers/iio/proximity/as3935.c | 3 +- drivers/iio/trigger/stm32-timer-trigger.c | 6 +- drivers/infiniband/core/addr.c | 4 +- drivers/infiniband/hw/hfi1/file_ops.c | 5 +- drivers/infiniband/hw/hfi1/init.c | 1 + drivers/infiniband/hw/hfi1/user_exp_rcv.c | 32 +++-- drivers/infiniband/hw/hfi1/user_exp_rcv.h | 1 + drivers/infiniband/hw/hfi1/verbs.c | 12 +- drivers/infiniband/hw/mlx5/mr.c | 2 +- drivers/iommu/intel-iommu.c | 5 +- drivers/md/Kconfig | 1 + drivers/md/dm-bufio.c | 35 +++-- drivers/md/dm-cache-metadata.c | 12 +- drivers/md/dm-mpath.c | 47 ++++-- drivers/md/dm-rq.c | 2 +- drivers/md/dm-thin-metadata.c | 4 +- drivers/md/md.c | 5 + drivers/md/persistent-data/dm-btree.c | 8 +- drivers/md/persistent-data/dm-space-map-disk.c | 15 +- drivers/md/raid5.c | 6 +- drivers/media/cec/cec-core.c | 2 +- drivers/media/dvb-frontends/cxd2841er.c | 4 +- drivers/media/platform/s5p-mfc/s5p_mfc.c | 13 +- drivers/media/rc/mceusb.c | 4 +- drivers/media/usb/cx231xx/cx231xx-audio.c | 42 ++++-- drivers/media/usb/cx231xx/cx231xx-cards.c | 45 +++++- drivers/media/usb/dvb-usb/dib0700_core.c | 3 + drivers/media/usb/dvb-usb/dibusb-mc-common.c | 2 + drivers/media/usb/dvb-usb/digitv.c | 3 + drivers/media/usb/dvb-usb/dw2102.c | 54 +++++++ drivers/media/usb/dvb-usb/ttusb2.c | 19 +++ drivers/media/usb/gspca/konica.c | 3 + drivers/media/usb/usbvision/usbvision-video.c | 9 +- drivers/media/usb/zr364xx/zr364xx.c | 8 ++ drivers/misc/cxl/pci.c | 34 +++-- drivers/mtd/nand/nand_base.c | 70 ++++++++- drivers/mtd/nand/omap2.c | 9 ++ drivers/mtd/nand/orion_nand.c | 42 +++--- drivers/net/irda/irda-usb.c | 2 +- drivers/net/wireless/ath/ath9k/hif_usb.c | 4 + drivers/net/wireless/marvell/mwifiex/cfg80211.c | 4 +- drivers/net/wireless/marvell/mwifiex/pcie.c | 7 + .../net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 122 +++++++++++++--- .../net/wireless/realtek/rtlwifi/rtl8821ae/reg.h | 1 + drivers/nvdimm/bus.c | 5 +- drivers/nvme/host/pci.c | 7 +- drivers/of/address.c | 2 +- drivers/of/fdt.c | 3 + drivers/of/of_numa.c | 2 + drivers/pci/host/pci-hyperv.c | 13 +- drivers/pci/pci-sysfs.c | 10 +- drivers/pci/pci.c | 9 +- drivers/pci/proc.c | 21 ++- drivers/regulator/rk808-regulator.c | 2 +- drivers/regulator/tps65023-regulator.c | 3 +- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 114 +++++++++++---- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.h | 2 + drivers/scsi/lpfc/lpfc_crtn.h | 1 + drivers/scsi/lpfc/lpfc_init.c | 7 + drivers/scsi/lpfc/lpfc_sli.c | 19 ++- drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 24 ++-- drivers/staging/rtl8192e/rtl819x_TSProc.c | 15 +- .../interface/vchiq_arm/vchiq_2835_arm.c | 31 ++-- drivers/thermal/mtk_thermal.c | 2 +- drivers/usb/class/cdc-acm.c | 13 +- drivers/usb/core/devio.c | 14 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/hub.c | 19 ++- drivers/usb/core/urb.c | 2 +- drivers/usb/dwc3/gadget.c | 9 ++ drivers/usb/host/ohci-hcd.c | 3 +- drivers/usb/host/ohci-pci.c | 16 +++ drivers/usb/host/ohci.h | 1 + drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci-mem.c | 4 +- drivers/usb/host/xhci-pci.c | 7 +- drivers/usb/host/xhci-plat.c | 2 +- drivers/usb/host/xhci-ring.c | 13 +- drivers/usb/host/xhci.c | 8 +- drivers/usb/misc/chaoskey.c | 2 +- drivers/usb/misc/iowarrior.c | 2 +- drivers/usb/misc/legousbtower.c | 38 +++-- drivers/usb/musb/musb_host.c | 9 +- drivers/usb/musb/tusb6010_omap.c | 13 +- drivers/usb/serial/ftdi_sio.c | 10 +- drivers/usb/serial/ftdi_sio_ids.h | 2 + drivers/usb/serial/io_ti.c | 5 +- drivers/usb/serial/mct_u232.c | 2 +- drivers/usb/serial/option.c | 8 ++ drivers/usb/serial/qcserial.c | 2 + drivers/usb/storage/ene_ub6250.c | 90 +++++++----- drivers/uwb/i1480/dfu/usb.c | 5 +- drivers/watchdog/pcwd_usb.c | 3 + fs/dax.c | 32 ++--- fs/nfs/callback_proc.c | 6 +- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 2 +- fs/nfs/nfs4proc.c | 4 +- fs/nfs/pagelist.c | 15 +- fs/nfs/write.c | 2 +- fs/nfsd/nfs4proc.c | 3 +- fs/nfsd/nfs4xdr.c | 19 ++- fs/notify/fanotify/fanotify_user.c | 26 ++-- fs/proc/generic.c | 1 + include/linux/fs.h | 8 +- include/linux/hid-sensor-hub.h | 2 + include/linux/kprobes.h | 3 + kernel/fork.c | 10 +- kernel/irq/chip.c | 2 +- kernel/kprobes.c | 2 +- kernel/pid_namespace.c | 2 +- kernel/trace/trace_kprobe.c | 5 + net/ipx/af_ipx.c | 5 +- security/integrity/ima/ima_appraise.c | 5 +- sound/hda/hdac_controller.c | 4 + sound/soc/codecs/cs4271.c | 2 +- virt/kvm/arm/vgic/vgic-v2.c | 7 + virt/kvm/arm/vgic/vgic-v3.c | 7 + 198 files changed, 1908 insertions(+), 857 deletions(-)