diff --git a/debian/changelog b/debian/changelog index 50c6e0466..f76eed694 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,4 +1,4 @@ -linux (4.19.101-1) UNRELEASED; urgency=medium +linux (4.19.102-1) UNRELEASED; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.99 @@ -564,9 +564,64 @@ linux (4.19.101-1) UNRELEASED; urgency=medium - block: cleanup __blkdev_issue_discard() - block: fix 32 bit overflow in __blkdev_issue_discard() - [arm64] KVM: Write arch.mdcr_el2 changes since last vcpu_load on VHE + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.102 + - vfs: fix do_last() regression + - crypto: pcrypt - Fix user-after-free on module unload + - perf c2c: Fix return type for histogram sorting comparision functions + - PM / devfreq: Add new name attribute for sysfs + - tools lib: Fix builds when glibc contains strlcpy() + - ext4: validate the debug_want_extra_isize mount option at parse time + - mm/mempolicy.c: fix out of bounds write in mpol_parse_str() + - reiserfs: Fix memory leak of journal device string + - media: digitv: don't continue if remote control state can't be read + - media: af9005: uninitialized variable printked + - media: vp7045: do not read uninitialized values if usb transfer fails + - media: gspca: zero usb_buf + - media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0 + - tomoyo: Use atomic_t for statistics counter + - ttyprintk: fix a potential deadlock in interrupt context issue + - Bluetooth: Fix race condition in hci_release_sock() + - cgroup: Prevent double killing of css when enabling threaded cgroup + - [armhf] dts: sun8i: a83t: Correct USB3503 GPIOs polarity + - [armhf] dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint + dt nodes + - [armhf] dts: beagle-x15-common: Model 5V0 regulator + - [arm64] clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order + - mac80211: mesh: restrict airtime metric to peered established plinks + - ASoC: rt5640: Fix NULL dereference on module unload + - ixgbevf: Remove limit of 10 entries for unicast filter list + - ixgbe: Fix calculation of queue with VFs and flow director on interface + flap + - igb: Fix SGMII SFP module discovery for 100FX/LX. + - [x86] platform/x86: GPD pocket fan: Allow somewhat lower/higher + temperature limits + - qmi_wwan: Add support for Quectel RM500Q + - wireless: fix enabling channel 12 for custom regulatory domain + - cfg80211: Fix radar event during another phy CAC + - mac80211: Fix TKIP replay protection immediately after key setup + - netfilter: nft_tunnel: ERSPAN_VERSION must not be null + - [armhf] net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec + - bnxt_en: Fix ipv6 RFS filter matching logic. + - iwlwifi: Don't ignore the cap field upon mcc update + - [armhf] dts: am335x-boneblack-common: fix memory size + - vti[6]: fix packet tx through bpf_redirect() + - xfrm interface: fix packet tx through bpf_redirect() + - xfrm: interface: do not confirm neighbor when do pmtu update + - scsi: fnic: do not queue commands during fwreset + - [armhf] 8955/1: virt: Relax arch timer version check during early boot + - [arm64] tee: optee: Fix compilation issue with nommu + - airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE + - airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE + - r8152: get default setting of WOL before initializing + - qlcnic: Fix CPU soft lockup while collecting firmware dump + - seq_tab_next() should increase position index + - l2t_seq_next should increase position index + - net: Fix skb->csum update in inet_proto_csum_replace16(). + - btrfs: do not zero f_bavail if we have available space + - perf report: Fix no libunwind compiled warning break s390 issue + - mm/migrate.c: also overwrite error when it is bigger than zero [ Salvatore Bonaccorso ] - * vfs: fix do_last() regression * Refresh "Revert "objtool: Fix CONFIG_STACK_VALIDATION=y warning for out-of-tree modules"" for context changes in 4.19.99 * Refresh "ARM: dts: bcm283x: Correct vchiq compatible string" for context diff --git a/debian/patches/bugfix/all/vfs-fix-do_last-regression.patch b/debian/patches/bugfix/all/vfs-fix-do_last-regression.patch deleted file mode 100644 index 42b79fbe8..000000000 --- a/debian/patches/bugfix/all/vfs-fix-do_last-regression.patch +++ /dev/null @@ -1,57 +0,0 @@ -From: Al Viro -Date: Sat, 1 Feb 2020 16:26:45 +0000 -Subject: vfs: fix do_last() regression -Origin: https://git.kernel.org/linus/6404674acd596de41fd3ad5f267b4525494a891a - -Brown paperbag time: fetching ->i_uid/->i_mode really should've been -done from nd->inode. I even suggested that, but the reason for that has -slipped through the cracks and I went for dir->d_inode instead - made -for more "obvious" patch. - -Analysis: - - - at the entry into do_last() and all the way to step_into(): dir (aka - nd->path.dentry) is known not to have been freed; so's nd->inode and - it's equal to dir->d_inode unless we are already doomed to -ECHILD. - inode of the file to get opened is not known. - - - after step_into(): inode of the file to get opened is known; dir - might be pointing to freed memory/be negative/etc. - - - at the call of may_create_in_sticky(): guaranteed to be out of RCU - mode; inode of the file to get opened is known and pinned; dir might - be garbage. - -The last was the reason for the original patch. Except that at the -do_last() entry we can be in RCU mode and it is possible that -nd->path.dentry->d_inode has already changed under us. - -In that case we are going to fail with -ECHILD, but we need to be -careful; nd->inode is pointing to valid struct inode and it's the same -as nd->path.dentry->d_inode in "won't fail with -ECHILD" case, so we -should use that. - -Reported-by: "Rantala, Tommi T. (Nokia - FI/Espoo)" -Reported-by: syzbot+190005201ced78a74ad6@syzkaller.appspotmail.com -Wearing-brown-paperbag: Al Viro -Cc: stable@kernel.org -Fixes: d0cb50185ae9 ("do_last(): fetch directory ->i_mode and ->i_uid before it's too late") -Signed-off-by: Al Viro -Signed-off-by: Linus Torvalds ---- - fs/namei.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -3259,8 +3259,8 @@ static int do_last(struct nameidata *nd, - struct file *file, const struct open_flags *op) - { - struct dentry *dir = nd->path.dentry; -- kuid_t dir_uid = dir->d_inode->i_uid; -- umode_t dir_mode = dir->d_inode->i_mode; -+ kuid_t dir_uid = nd->inode->i_uid; -+ umode_t dir_mode = nd->inode->i_mode; - int open_flag = op->open_flag; - bool will_truncate = (open_flag & O_TRUNC) != 0; - bool got_write = false; diff --git a/debian/patches/series b/debian/patches/series index c39cc6608..0e5166c93 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -297,6 +297,5 @@ debian/i386-686-pae-pci-set-pci-nobios-by-default.patch debian/ntfs-mark-it-as-broken.patch bugfix/all/wimax-i2400-fix-memory-leak.patch bugfix/all/wimax-i2400-fix-memory-leak-in-i2400m_op_rfkill_sw_toggle.patch -bugfix/all/vfs-fix-do_last-regression.patch # ABI maintenance