Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merge tag 'v4.9.109' into 4.9-2.0.x-imx #27

Merged
merged 64 commits into from
Jun 25, 2018
Merged
Changes from 1 commit
Commits
Show all changes
64 commits
Select commit Hold shift + click to select a range
d6313fe
tpm: do not suspend/resume if power stays on
Jun 27, 2017
e876bfa
tpm: self test failure should not cause suspend to fail
Mar 20, 2018
7a40374
mmap: introduce sane default mmap limits
torvalds May 11, 2018
4be6529
mmap: relax file size limit for regular files
torvalds May 19, 2018
8d99eb4
btrfs: define SUPER_FLAG_METADUMP_V2
asj Jan 9, 2018
1ec1dfb
kconfig: Avoid format overflow warning from GCC 8.1
nathanchance Jun 2, 2018
8655f28
drm: set FMODE_UNSIGNED_OFFSET for drm files
airlied May 15, 2018
5dcfc06
bnx2x: use the right constant
JuliaLawall Jun 6, 2018
3e14656
dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect()
akodanev May 21, 2018
fc7c872
enic: set DMA mask to 47 bit
May 23, 2018
ffa13b3
ip6mr: only set ip6mr_table from setsockopt when ip6mr_new_table succ…
qsn Jun 5, 2018
d33ecd2
ipv4: remove warning in ip_recv_error
wdebruij May 23, 2018
f698b28
isdn: eicon: fix a missing-check bug
May 21, 2018
0ae3ff2
kcm: Fix use-after-free caused by clonned sockets
Jun 1, 2018
064257c
netdev-FAQ: clarify DaveM's position for stable backports
congwang Jun 5, 2018
ba2ce02
net/packet: refine check for priv area size
Jun 1, 2018
c1d5043
net: usb: cdc_mbim: add flag FLAG_SEND_ZLP
dnlplm May 31, 2018
1118c60
packet: fix reserve calculation
wdebruij May 24, 2018
46ad4d8
qed: Fix mask for physical address in ILT entry
May 21, 2018
2ed49aa
sctp: not allow transport timeout value less than HZ/5 for hb_timer
lxin Jun 5, 2018
3ff7364
team: use netdev_features_t instead of u32
Jun 4, 2018
f833209
vhost: synchronize IOTLB message with dev cleanup
jasowang May 22, 2018
869584e
vrf: check the original netdevice for generating redirect
ssuryaextr Jun 1, 2018
1f19dd9
net/mlx4: Fix irq-unsafe spinlock usage
May 23, 2018
c591536
rtnetlink: validate attributes in do_setlink()
Jun 5, 2018
0e0a027
net: phy: broadcom: Fix bcm_write_exp()
ffainelli May 23, 2018
5300a1c
net: metrics: add proper netlink validation
Jun 5, 2018
02136f3
KVM: VMX: Expose SSBD properly to guests, 4.9 supplement
bwhacks Jun 12, 2018
e1fba17
dm bufio: avoid false-positive Wmaybe-uninitialized warning
arndb Feb 22, 2018
23873ae
objtool: Fix gcov check for older versions of GCC
jpoimboe Jul 24, 2017
cd4f9f2
complete e390f9a port for v4.9.106
philmmanjaro Jun 9, 2018
4f42dc6
Linux 4.9.108
gregkh Jun 13, 2018
47a6aa5
x86/fpu: Hard-disable lazy FPU mode
amluto Oct 5, 2016
c5b9d36
bonding: correctly update link status during mii-commit phase
Mar 27, 2017
bc5ad40
bonding: fix active-backup transition
Apr 4, 2017
ae0c8ee
bonding: require speed/duplex only for 802.3ad, alb and tlb
Phoosha Aug 10, 2017
b53761a
nvme-pci: initialize queue memory before interrupts
Sep 14, 2017
142b79a
af_key: Always verify length of provided sadb_key
Apr 7, 2018
077c9e2
x86/crypto, x86/fpu: Remove X86_FEATURE_EAGER_FPU #ifdef from the crc…
amluto Oct 5, 2016
1e38f8e
nvmet: Move serial number from controller to subsystem
Jul 14, 2017
f43d8e4
nvmet: don't report 0-bytes in serial number
mwilck Jul 13, 2017
1c4eb2a
nvmet: don't overwrite identify sn/fr with 0-bytes
mwilck Aug 14, 2017
be1f605
gpio: No NULL owner
linusw Jan 16, 2018
00b1391
KVM: x86: introduce linear_{read,write}_system
bonzini Jun 6, 2018
838b0e9
KVM: x86: pass kvm_vcpu to kvm_read_guest_virt and kvm_write_guest_vi…
bonzini Jun 6, 2018
8da07ee
staging: android: ion: Switch to pr_warn_once in ion_buffer_destroy
labbott May 14, 2018
14450ab
usbip: vhci_sysfs: fix potential Spectre v1
GustavoARSilva May 19, 2018
187941e
usb-storage: Add support for FL_ALWAYS_SYNC flag in the UAS driver
May 19, 2018
244eb27
usb-storage: Add compatibility quirk flags for G-Technologies G-Drive
May 19, 2018
bc62b33
usb: gadget: udc: renesas_usb3: disable the controller's irqs for rec…
shimoday Apr 10, 2018
70f0a59
serial: sh-sci: Stop using printk format %pCr
geertu Jun 1, 2018
41bdf97
tty/serial: atmel: use port->name as name in request_irq()
May 7, 2018
5b91ae5
serial: samsung: fix maxburst parameter for DMA transactions
mszyprow May 10, 2018
f6e6f0c
serial: 8250: omap: Fix idling of clocks for unused uarts
tmlind May 4, 2018
d9bc59c
vmw_balloon: fixing double free when batching mode is off
gilkup Jun 1, 2018
018e519
tty: pl011: Avoid spuriously stuck-off interrupts
May 10, 2018
13d1c5b
kvm: x86: use correct privilege level for sgdt/sidt/fxsave/fxrstor ac…
bonzini Jun 6, 2018
78e7bbf
Input: goodix - add new ACPI id for GPD Win 2 touch screen
flibitijibibo May 31, 2018
05ca7fe
Input: elan_i2c - add ELAN0612 (Lenovo v330 14IKB) ACPI ID
languitar Jun 4, 2018
ef2aa9f
crypto: vmx - Remove overly verbose printk from AES init routines
mpe May 3, 2018
20f4d77
crypto: omap-sham - fix memleak
liubiin Apr 17, 2018
f09a7b0
perf: sync up x86/.../cpufeatures.h
gregkh Jun 14, 2018
8e52b94
Linux 4.9.109
gregkh Jun 16, 2018
260b81b
Merge tag 'v4.9.109' into 4.9-2.0.x-imx
gibsson Jun 25, 2018
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
staging: android: ion: Switch to pr_warn_once in ion_buffer_destroy
commit 45ad559 upstream.

Syzbot reported yet another warning with Ion:

WARNING: CPU: 0 PID: 1467 at drivers/staging/android/ion/ion.c:122
ion_buffer_destroy+0xd4/0x190 drivers/staging/android/ion/ion.c:122
Kernel panic - not syncing: panic_on_warn set ...

This is catching that a buffer was freed with an existing kernel mapping
still present. This can be easily be triggered from userspace by calling
DMA_BUF_SYNC_START without calling DMA_BUF_SYNC_END. Switch to a single
pr_warn_once to indicate the error without being disruptive.

Reported-by: syzbot+cd8bcd40cb049efa2770@syzkaller.appspotmail.com
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Laura Abbott <labbott@redhat.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
labbott authored and gregkh committed Jun 16, 2018
commit 8da07ee9e433f3af74f126c5bfd1a1a44d0aaeef
5 changes: 4 additions & 1 deletion drivers/staging/android/ion/ion.c
Original file line number Diff line number Diff line change
Expand Up @@ -192,8 +192,11 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap,

void ion_buffer_destroy(struct ion_buffer *buffer)
{
if (WARN_ON(buffer->kmap_cnt > 0))
if (buffer->kmap_cnt > 0) {
pr_warn_once("%s: buffer still mapped in the kernel\n",
__func__);
buffer->heap->ops->unmap_kernel(buffer->heap, buffer);
}
buffer->heap->ops->free(buffer);
vfree(buffer->pages);
kfree(buffer);
Expand Down