This is the start of the stable review cycle for the 4.13.5 release. There are 110 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu Oct 5 11:42:12 UTC 2017. Anything received after that time might be too late. The whole patch series can be found in one patch at: kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.13.5-rc1.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.13.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> Linux 4.13.5-rc1 Vladis Dronov <vdronov@xxxxxxxxxx> video: fbdev: aty: do not leak uninitialized padding in clk to userspace Paolo Bonzini <pbonzini@xxxxxxxxxx> KVM: VMX: use cmpxchg64 Haozhong Zhang <haozhong.zhang@xxxxxxxxx> KVM: VMX: remove WARN_ON_ONCE in kvm_vcpu_trigger_posted_interrupt Haozhong Zhang <haozhong.zhang@xxxxxxxxx> KVM: VMX: do not change SN bit in vmx_update_pi_irte() Eric Biggers <ebiggers@xxxxxxxxxx> x86/fpu: Don't let userspace set bogus xcomp_bv Laurent Dufour <ldufour@xxxxxxxxxxxxxxxxxx> x86/mm: Fix fault error path using unsafe vma pointer Viresh Kumar <viresh.kumar@xxxxxxxxxx> PM / OPP: Call notifier without holding opp_table->lock Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx> platform/x86: fujitsu-laptop: Don't oops when FUJ02E3 is not presnt satoru takeuchi <satoru.takeuchi@xxxxxxxxx> btrfs: prevent to set invalid default subvolid Naohiro Aota <naohiro.aota@xxxxxxx> btrfs: propagate error to btrfs_cmp_data_prepare caller Naohiro Aota <naohiro.aota@xxxxxxx> btrfs: finish ordered extent cleaning if no progress is found Naohiro Aota <naohiro.aota@xxxxxxx> btrfs: clear ordered flag on cleaning up ordered extents Naohiro Aota <naohiro.aota@xxxxxxx> btrfs: fix NULL pointer dereference from free_reloc_roots() Nicolai Stange <nstange@xxxxxxx> PCI: Fix race condition with driver_override Shaohua Li <shli@xxxxxx> md: separate request handling Shaohua Li <shli@xxxxxx> md: fix a race condition for flush request handling Peter Zijlstra <peterz@xxxxxxxxxxxxx> futex: Fix pi_state->owner serialization Lucas Stach <l.stach@xxxxxxxxxxxxxx> etnaviv: fix gem object list corruption Lucas Stach <l.stach@xxxxxxxxxxxxxx> etnaviv: fix submit error path Richard Genoud <richard.genoud@xxxxxxxxx> mtd: nand: atmel: fix buffer overflow in atmel_pmecc_user Boris Brezillon <boris.brezillon@xxxxxxxxxxxxxxxxxx> mtd: Fix partition alignment check on multi-erasesize devices Jeffy Chen <jeffy.chen@xxxxxxxxxxxxxx> irq/generic-chip: Don't replace domain's name Ethan Zhao <ethan.zhao@xxxxxxxxxx> sched/sysctl: Check user input value of sysctl_sched_time_avg Al Viro <viro@xxxxxxxxxxxxxxxxxx> fix infoleak in waitid(2) Ross Zwisler <ross.zwisler@xxxxxxxxxxxxxxx> xfs: validate bdev support for DAX inode flag Jim Mattson <jmattson@xxxxxxxxxx> kvm: nVMX: Don't allow L2 to access the hardware CR8 Jan H. Schönherr <jschoenh@xxxxxxxxx> KVM: VMX: Do not BUG() on out-of-bounds guest IRQ Boqun Feng <boqun.feng@xxxxxxxxx> kvm/x86: Handle async PF in RCU read-side critical sections Ladi Prosek <lprosek@xxxxxxxxxx> KVM: nVMX: fix HOST_CR3/HOST_CR4 cache Paolo Bonzini <pbonzini@xxxxxxxxxx> KVM: VMX: simplify and fix vmx_vcpu_pi_load Paolo Bonzini <pbonzini@xxxxxxxxxx> KVM: VMX: avoid double list add with VT-d posted interrupts Paolo Bonzini <pbonzini@xxxxxxxxxx> KVM: VMX: extract __pi_post_block Will Deacon <will.deacon@xxxxxxx> arm64: fault: Route pte translation faults via do_translation_fault Will Deacon <will.deacon@xxxxxxx> arm64: mm: Use READ_ONCE when dereferencing pointer to pte table Marc Zyngier <marc.zyngier@xxxxxxx> arm64: Make sure SPsel is always set Oleg Nesterov <oleg@xxxxxxxxxx> seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter() Kees Cook <keescook@xxxxxxxxxxxx> selftests/seccomp: Support glibc 2.26 siginfo_t.h Steven Rostedt (VMware) <rostedt@xxxxxxxxxxx> extable: Enable RCU if it is not watching in kernel_text_address() Steven Rostedt (VMware) <rostedt@xxxxxxxxxxx> extable: Consolidate *kernel_text_address() functions Adrian Hunter <adrian.hunter@xxxxxxxxx> mmc: sdhci-pci: Fix voltage switch for some Intel host controllers Paul E. McKenney <paulmck@xxxxxxxxxxxxxxxxxx> rcu: Allow for page faults in NMI handlers Steve Wise <swise@xxxxxxxxxxxxxxxxxxxxx> iw_cxgb4: put ep reference in pass_accept_req() Steve Wise <swise@xxxxxxxxxxxxxxxxxxxxx> iw_cxgb4: remove the stid on listen create failure Steve Wise <swise@xxxxxxxxxxxxxxxxxxxxx> iw_cxgb4: drop listen destroy replies if no ep found Christoph Hellwig <hch@xxxxxx> bsg-lib: don't free job in bsg_prepare_job Andreas Gruenbacher <agruenba@xxxxxxxxxx> gfs2: Fix debugfs glocks dump Mikulas Patocka <mpatocka@xxxxxxxxxx> brd: fix overflow in __brd_direct_access Vladis Dronov <vdronov@xxxxxxxxxx> nl80211: check for the required netlink attributes presence Ilya Dryomov <idryomov@xxxxxxxxx> libceph: don't allow bidirectional swap of pg-upmap-items Andreas Gruenbacher <agruenba@xxxxxxxxxx> vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets Steve French <smfrench@xxxxxxxxx> SMB3: Don't ignore O_SYNC/O_DSYNC and O_DIRECT flags Steve French <smfrench@xxxxxxxxx> SMB3: handle new statx fields Steve French <smfrench@xxxxxxxxx> SMB: Validate negotiate (to protect against downgrade) even if signing off Steve French <smfrench@xxxxxxxxx> SMB3: Warn user if trying to sign connection that authenticated as guest Steve French <smfrench@xxxxxxxxx> SMB3: Fix endian warning Steve French <smfrench@xxxxxxxxx> Fix SMB3.1.1 guest authentication to Samba Alex Estrin <alex.estrin@xxxxxxxxx> Revert "IB/ipoib: Update broadcast object if PKey value was changed in index 0" Rafael J. Wysocki <rafael.j.wysocki@xxxxxxxxx> PM: core: Fix device_pm_check_callbacks() Gerald Schaefer <gerald.schaefer@xxxxxxxxxx> s390/mm: fix write access check in gup_huge_pmd() Gerald Schaefer <gerald.schaefer@xxxxxxxxxx> s390/mm: make pmdp_invalidate() do invalidation only Pu Hou <bjhoupu@xxxxxxxxxxxxxxxxxx> s390/perf: fix bug when creating per-thread event Paul Burton <paul.burton@xxxxxxxxxx> MIPS: Fix perf event init Gustavo Romero <gromero@xxxxxxxxxxxxxxxxxx> powerpc/tm: Flush TM only if CPU has TM feature Tyrel Datwyler <tyreld@xxxxxxxxxxxxxxxxxx> powerpc/pseries: Fix parent_dn reference leak in add_dt_node() Benjamin Herrenschmidt <benh@xxxxxxxxxxxxxxxxxxx> powerpc/eeh: Create PHB PEs after EEH is initialized Dan Williams <dan.j.williams@xxxxxxxxx> libnvdimm, namespace: fix btt claim class crash Eric Biggers <ebiggers@xxxxxxxxxx> KEYS: prevent KEYCTL_READ on negative key Eric Biggers <ebiggers@xxxxxxxxxx> KEYS: prevent creating a different user's keyrings Eric Biggers <ebiggers@xxxxxxxxxx> KEYS: fix writing past end of user-supplied buffer in keyring_read() Jason A. Donenfeld <Jason@xxxxxxxxx> security/keys: rewrite all of big_key crypto Jason A. Donenfeld <Jason@xxxxxxxxx> security/keys: properly zero out sensitive key material in big_key LEROY Christophe <christophe.leroy@xxxxxx> crypto: talitos - fix hashing LEROY Christophe <christophe.leroy@xxxxxx> crypto: talitos - fix sha224 LEROY Christophe <christophe.leroy@xxxxxx> crypto: talitos - Don't provide setkey for non hmac hashing algs. Stephan Mueller <smueller@xxxxxxxxxx> crypto: drbg - fix freeing of resources Alex Deucher <alexander.deucher@xxxxxxx> drm/radeon: disable hard reset in hibernate for APUs Jean Delvare <jdelvare@xxxxxxx> drm/amdgpu: revert tile table update for oland Uma Shankar <uma.shankar@xxxxxxxxx> Revert "drm/i915/bxt: Disable device ready before shutdown command" Changbin Du <changbin.du@xxxxxxxxx> drm/i915/gvt: Fix incorrect PCI BARs reporting Marek Szyprowski <m.szyprowski@xxxxxxxxxxx> drm/exynos: Fix locking in the suspend/resume paths Guilherme G. Piccoli <gpiccoli@xxxxxxxxxxxxxxxxxx> scsi: aacraid: Add a small delay after IOP reset Dave Carroll <david.carroll@xxxxxxxxxxxxx> scsi: aacraid: Fix 2T+ drives on SmartIOC-2000 Xin Long <lucien.xin@xxxxxxxxx> scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly Dennis Yang <dennisyang@xxxxxxxx> md/raid5: preserve STRIPE_ON_UNPLUG_LIST in break_stripe_batch_list Shaohua Li <shli@xxxxxx> md/raid5: fix a race condition in stripe batch Steven Rostedt (VMware) <rostedt@xxxxxxxxxxx> tracing: Remove RCU work arounds from stack tracer Bo Yan <byan@xxxxxxxxxx> tracing: Erase irqsoff trace with empty write Tahsin Erdogan <tahsin@xxxxxxxxxx> tracing: Fix trace_pipe behavior for instance traces Benjamin Herrenschmidt <benh@xxxxxxxxxxxxxxxxxxx> KVM: PPC: Book3S HV: Don't access XIVE PIPR register using byte accesses Paul Mackerras <paulus@xxxxxxxxxx> KVM: PPC: Book3S HV: Fix bug causing host SLB to be restored incorrectly Paul Mackerras <paulus@xxxxxxxxxx> KVM: PPC: Book3S HV: Hold kvm->lock around call to kvmppc_update_lpcr Thomas Gleixner <tglx@xxxxxxxxxxxxx> genirq: Fix cpumask check in __irq_startup_managed() John Keeping <john@xxxxxxxxxxxx> genirq/msi: Fix populating multiple interrupts Thomas Gleixner <tglx@xxxxxxxxxxxxx> genirq: Make sparse_irq_lock protect what it should protect Johannes Berg <johannes.berg@xxxxxxxxx> mac80211: fix deadlock in driver-managed RX BA session start Avraham Stern <avraham.stern@xxxxxxxxx> mac80211: flush hw_roc_start work before cancelling the ROC Beni Lev <beni.lev@xxxxxxxxx> mac80211_hwsim: Use proper TX power Johannes Berg <johannes.berg@xxxxxxxxx> mac80211: fix VLAN handling with TXQs Steve French <smfrench@xxxxxxxxx> SMB3: Add support for multidialect negotiate (SMB2.1 and later) Christoph Hellwig <hch@xxxxxx> scsi: scsi_transport_fc: fix NULL pointer dereference in fc_bsg_job_timeout John Ogness <john.ogness@xxxxxxxxxxxxx> fs/proc: Report eip/esp in /prod/PID/stat for coredumping Adrian Hunter <adrian.hunter@xxxxxxxxx> mmc: block: Fix incorrectly initialized requests Hyunchul Lee <cheol.lee@xxxxxxx> dm integrity: do not check integrity for failed read operations Mikulas Patocka <mpatocka@xxxxxxxxxx> dax: remove the pmem_dax_ops->flush abstraction Christoph Hellwig <hch@xxxxxx> nvme-pci: propagate (some) errors from host memory buffer setup Akinobu Mita <akinobu.mita@xxxxxxxxx> nvme-pci: use appropriate initial chunk size for HMB allocation Christoph Hellwig <hch@xxxxxx> nvme-pci: fix host memory buffer allocation fallback Shu Wang <shuwang@xxxxxxxxxx> cifs: release auth_key.response for reconnect. Shu Wang <shuwang@xxxxxxxxxx> cifs: release cifs root_cred after exit_cifs Ronnie Sahlberg <lsahlber@xxxxxxxxxx> cifs: check rsp for NULL before dereferencing in SMB2_open ------------- Diffstat: Makefile | 4 +- arch/arm64/include/asm/pgtable.h | 2 +- arch/arm64/kernel/head.S | 1 + arch/arm64/mm/fault.c | 2 +- arch/mips/kernel/perf_event_mipsxx.c | 3 +- arch/powerpc/kernel/eeh.c | 4 + arch/powerpc/kernel/eeh_dev.c | 18 -- arch/powerpc/kernel/ptrace.c | 2 +- arch/powerpc/kvm/book3s_hv.c | 2 + arch/powerpc/kvm/book3s_hv_rm_xive.c | 1 - arch/powerpc/kvm/book3s_hv_rmhandlers.S | 17 +- arch/powerpc/kvm/book3s_xive.c | 1 - arch/powerpc/kvm/book3s_xive_template.c | 7 +- arch/powerpc/platforms/pseries/mobility.c | 4 +- arch/s390/include/asm/pgtable.h | 4 +- arch/s390/kernel/perf_cpum_sf.c | 9 +- arch/s390/mm/gup.c | 7 +- arch/x86/kernel/fpu/regset.c | 9 +- arch/x86/kernel/fpu/signal.c | 4 + arch/x86/kernel/kvm.c | 3 +- arch/x86/kvm/vmx.c | 256 +++++++++++++------------- arch/x86/mm/fault.c | 47 ++--- block/bsg-lib.c | 1 - crypto/drbg.c | 8 +- drivers/base/power/main.c | 9 +- drivers/base/power/opp/core.c | 7 + drivers/block/brd.c | 2 +- drivers/crypto/talitos.c | 9 +- drivers/dax/super.c | 21 ++- drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 189 ++++++++++++++++++- drivers/gpu/drm/etnaviv/etnaviv_gem.c | 3 + drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 6 +- drivers/gpu/drm/exynos/exynos_drm_drv.c | 4 + drivers/gpu/drm/i915/gvt/cfg_space.c | 113 +++++------- drivers/gpu/drm/i915/intel_dsi.c | 11 -- drivers/gpu/drm/radeon/radeon_device.c | 2 +- drivers/infiniband/hw/cxgb4/cm.c | 9 +- drivers/infiniband/ulp/ipoib/ipoib_ib.c | 13 -- drivers/md/dm-integrity.c | 6 +- drivers/md/dm-linear.c | 15 -- drivers/md/dm-stripe.c | 20 -- drivers/md/dm.c | 19 -- drivers/md/md.c | 72 +++++--- drivers/md/md.h | 1 + drivers/md/raid5.c | 13 +- drivers/mmc/core/queue.c | 7 +- drivers/mmc/host/sdhci-pci-core.c | 15 ++ drivers/mtd/mtdpart.c | 8 + drivers/mtd/nand/atmel/pmecc.c | 2 +- drivers/net/wireless/mac80211_hwsim.c | 2 - drivers/nvdimm/namespace_devs.c | 9 + drivers/nvdimm/pmem.c | 7 - drivers/nvme/host/pci.c | 66 ++++--- drivers/pci/pci-sysfs.c | 11 +- drivers/platform/x86/fujitsu-laptop.c | 10 +- drivers/scsi/aacraid/aachba.c | 12 +- drivers/scsi/aacraid/aacraid.h | 5 + drivers/scsi/aacraid/src.c | 2 + drivers/scsi/scsi_transport_fc.c | 2 +- drivers/scsi/scsi_transport_iscsi.c | 2 +- drivers/video/fbdev/aty/atyfb_base.c | 2 +- fs/btrfs/inode.c | 20 ++ fs/btrfs/ioctl.c | 6 +- fs/btrfs/relocation.c | 2 +- fs/cifs/cifsfs.c | 2 +- fs/cifs/cifsglob.h | 6 + fs/cifs/connect.c | 32 +++- fs/cifs/file.c | 7 + fs/cifs/inode.c | 15 ++ fs/cifs/smb2ops.c | 40 ++++ fs/cifs/smb2pdu.c | 111 +++++++++-- fs/cifs/smb2pdu.h | 2 +- fs/dax.c | 4 +- fs/gfs2/glock.c | 14 +- fs/proc/array.c | 9 + fs/read_write.c | 4 +- fs/xfs/xfs_ioctl.c | 3 +- include/linux/dax.h | 5 +- include/linux/device-mapper.h | 3 - include/linux/key.h | 2 + include/net/mac80211.h | 15 +- kernel/exit.c | 23 +-- kernel/extable.c | 45 +++-- kernel/futex.c | 33 ++-- kernel/irq/chip.c | 2 +- kernel/irq/generic-chip.c | 1 - kernel/irq/irqdesc.c | 24 +-- kernel/irq/msi.c | 5 +- kernel/rcu/tree.c | 10 + kernel/seccomp.c | 23 ++- kernel/sysctl.c | 3 +- kernel/trace/trace.c | 12 +- kernel/trace/trace_stack.c | 15 -- net/ceph/osdmap.c | 35 +++- net/mac80211/agg-rx.c | 32 ++-- net/mac80211/ht.c | 6 +- net/mac80211/ieee80211_i.h | 4 + net/mac80211/iface.c | 17 +- net/mac80211/offchannel.c | 2 + net/mac80211/tx.c | 36 +++- net/wireless/nl80211.c | 3 + security/keys/Kconfig | 4 +- security/keys/big_key.c | 138 +++++++------- security/keys/internal.h | 2 +- security/keys/key.c | 2 + security/keys/keyctl.c | 5 + security/keys/keyring.c | 37 ++-- security/keys/process_keys.c | 6 +- tools/testing/selftests/seccomp/seccomp_bpf.c | 18 +- 109 files changed, 1243 insertions(+), 724 deletions(-)