From 2f6b3a464a84b3ed8267966553d7040b806945c2 Mon Sep 17 00:00:00 2001 From: Salvatore Bonaccorso Date: Fri, 28 Aug 2020 12:41:58 +0200 Subject: [PATCH] Update to 4.19.142 Add CVE id reference for CVE-2020-14314 Cleanup debian/changelog file Refresh "net: ena: fix crash during ena_remove()" for context changes in 4.19.142 --- debian/changelog | 71 ++++++++++++++++++- ...-net-ena-fix-crash-during-ena_remove.patch | 18 +++-- 2 files changed, 78 insertions(+), 11 deletions(-) diff --git a/debian/changelog b/debian/changelog index eaf2e3e9c..7fa6a48ca 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,4 +1,4 @@ -linux (4.19.141-1) UNRELEASED; urgency=medium +linux (4.19.142-1) UNRELEASED; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.133 @@ -536,6 +536,73 @@ linux (4.19.141-1) UNRELEASED; urgency=medium - khugepaged: retract_page_tables() remember to test exit - [arm64] dts: marvell: espressobin: add ethernet alias - drm: Added orientation quirk for ASUS tablet model T103HAF + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.142 + - drm/vgem: Replace opencoded version of drm_gem_dumb_map_offset() + - perf probe: Fix memory leakage when the probe point is not found + - khugepaged: khugepaged_test_exit() check mmget_still_valid() + - khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter() + - btrfs: export helpers for subvolume name/id resolution + - btrfs: don't show full path of bind mounts in subvol= + - btrfs: Move free_pages_out label in inline extent handling branch in + compress_file_range + - btrfs: inode: fix NULL pointer dereference if inode doesn't need + compression + - btrfs: sysfs: use NOFS for device creation + - romfs: fix uninitialized memory leak in romfs_dev_read() + - kernel/relay.c: fix memleak on destroy relay channel + - mm: include CMA pages in lowmem_reserve at boot + - mm, page_alloc: fix core hung in free_pcppages_bulk() + - ext4: fix checking of directory entry validity for inline directories + - jbd2: add the missing unlock_buffer() in the error path of + jbd2_write_superblock() + - [s390x] scsi: zfcp: Fix use-after-free in request timeout handlers + - kthread: Do not preempt current task if it is going to call schedule() + - spi: Prevent adding devices below an unregistering controller + - scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices + - scsi: target: tcmu: Fix crash in tcmu_flush_dcache_range on ARM + - media: budget-core: Improve exception handling in budget_register() + - Input: psmouse - add a newline when printing 'proto' by sysfs + - m68knommu: fix overwriting of bits in ColdFire V3 cache control + - svcrdma: Fix another Receive buffer leak + - xfs: fix inode quota reservation checks + - jffs2: fix UAF problem + - ceph: fix use-after-free for fsc->mdsc + - [x86] cpufreq: intel_pstate: Fix cpuinfo_max_freq when + MSR_TURBO_RATIO_LIMIT is 0 + - scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases + - virtio_ring: Avoid loop when vq is broken in virtqueue_poll + - xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init + - fs/signalfd.c: fix inconsistent return codes for signalfd4 + - ext4: fix potential negative array index in do_split() (CVE-2020-14314) + - ext4: don't allow overlapping system zones + - i40e: Set RX_ONLY mode for unicast promiscuous on VLAN + - i40e: Fix crash during removing i40e driver + - [armhf] net: fec: correct the error path for regulator disable in probe + - bonding: show saner speed for broadcast mode + - bonding: fix a potential double-unregister + - [s390x] runtime_instrumentation: fix storage key handling + - [s390x] ptrace: fix storage key handling + - [x86] ASoC: intel: Fix memleak in sst_media_open + - [amd64,arm64] vfio/type1: Add proper error unwind for + vfio_iommu_replay() + - [x86] kvm: Toggling CR4.SMAP does not load PDPTEs in PAE mode + - [x86] kvm: Toggling CR4.PKE does not load PDPTEs in PAE mode + - efi: avoid error message when booting under Xen + - afs: Fix NULL deref in afs_dynroot_depopulate() + - bonding: fix active-backup failover for current ARP slave + - net: ena: Prevent reset after device destruction + - [x86] hv_netvsc: Fix the queue_mapping in netvsc_vf_xmit() + - [armhf] net: dsa: b53: check for timeout + - [powerpc*] pseries: Do not initiate shutdown when system is running on + UPS + - efi: add missed destroy_workqueue when efisubsys_init fails + - epoll: Keep a reference on files added to the check list + - do_epoll_ctl(): clean the failure exits up a bit + - mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible + - xen: don't reschedule in preemption off sections + - clk: Evict unregistered clks from parent caches + - KVM: Pass MMU notifier range flags to kvm_unmap_hva_range() + - [arm64] KVM: Only reschedule if MMU_NOTIFIER_RANGE_BLOCKABLE is not set [ Salvatore Bonaccorso ] * Bump ABI to 11 @@ -549,6 +616,8 @@ linux (4.19.141-1) UNRELEASED; urgency=medium for context changes in 4.19.138 * [rt] Refresh "watchdog: prevent deferral of watchdogd wakeup on RT" for context changes in 4.19.141 + * Refresh "net: ena: fix crash during ena_remove()" for context changes in + 4.19.142 -- Salvatore Bonaccorso Tue, 04 Aug 2020 16:33:40 +0200 diff --git a/debian/patches/features/all/ena/0017-net-ena-fix-crash-during-ena_remove.patch b/debian/patches/features/all/ena/0017-net-ena-fix-crash-during-ena_remove.patch index 446f3d61d..59f2b13b7 100644 --- a/debian/patches/features/all/ena/0017-net-ena-fix-crash-during-ena_remove.patch +++ b/debian/patches/features/all/ena/0017-net-ena-fix-crash-during-ena_remove.patch @@ -33,11 +33,9 @@ Signed-off-by: David S. Miller drivers/net/ethernet/amazon/ena/ena_netdev.c | 21 ++++++++++---------- 1 file changed, 10 insertions(+), 11 deletions(-) -Index: linux/drivers/net/ethernet/amazon/ena/ena_netdev.c -=================================================================== ---- linux.orig/drivers/net/ethernet/amazon/ena/ena_netdev.c -+++ linux/drivers/net/ethernet/amazon/ena/ena_netdev.c -@@ -1848,6 +1848,8 @@ static void ena_down(struct ena_adapter +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -1853,6 +1853,8 @@ static void ena_down(struct ena_adapter rc = ena_com_dev_reset(adapter->ena_dev, adapter->reset_reason); if (rc) dev_err(&adapter->pdev->dev, "Device reset failed\n"); @@ -46,7 +44,7 @@ Index: linux/drivers/net/ethernet/amazon/ena/ena_netdev.c } ena_destroy_all_io_queues(adapter); -@@ -1914,6 +1916,9 @@ static int ena_close(struct net_device * +@@ -1919,6 +1921,9 @@ static int ena_close(struct net_device * netif_dbg(adapter, ifdown, netdev, "%s\n", __func__); @@ -56,7 +54,7 @@ Index: linux/drivers/net/ethernet/amazon/ena/ena_netdev.c if (test_bit(ENA_FLAG_DEV_UP, &adapter->flags)) ena_down(adapter); -@@ -2613,9 +2618,7 @@ static void ena_destroy_device(struct en +@@ -2618,9 +2623,7 @@ static void ena_destroy_device(struct en ena_down(adapter); /* Stop the device from sending AENQ events (in case reset flag is set @@ -67,7 +65,7 @@ Index: linux/drivers/net/ethernet/amazon/ena/ena_netdev.c */ if (!(test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags) && dev_up)) ena_com_dev_reset(adapter->ena_dev, adapter->reset_reason); -@@ -3452,6 +3455,8 @@ err_rss: +@@ -3455,6 +3458,8 @@ err_rss: ena_com_rss_destroy(ena_dev); err_free_msix: ena_com_dev_reset(ena_dev, ENA_REGS_RESET_INIT_ERR); @@ -76,8 +74,8 @@ Index: linux/drivers/net/ethernet/amazon/ena/ena_netdev.c ena_free_mgmnt_irq(adapter); ena_disable_msix(adapter); err_worker_destroy: -@@ -3498,18 +3503,12 @@ static void ena_remove(struct pci_dev *p - +@@ -3504,18 +3509,12 @@ static void ena_remove(struct pci_dev *p + del_timer_sync(&adapter->timer_service); cancel_work_sync(&adapter->reset_task); - unregister_netdev(netdev);