4.9-stable patches

added patches:
	lockd-lost-rollback-of-set_grace_period-in-lockd_down_net.patch
	revert-arm-dts-imx6qdl-wandboard-fix-audio-channel-swap.patch
	xfrm-fix-xfrm_do_migrate-with-aead-e.g-aes-gcm.patch

diff --git a/queue-4.9/lockd-lost-rollback-of-set_grace_period-in-lockd_down_net.patch b/queue-4.9/lockd-lost-rollback-of-set_grace_period-in-lockd_down_net.patch
new file mode 100644 (file)
index 0000000..785f90a
--- /dev/null
+++ b/queue-4.9/lockd-lost-rollback-of-set_grace_period-in-lockd_down_net.patch
@@ -0,0 +1,42 @@
+From 3a2b19d1ee5633f76ae8a88da7bc039a5d1732aa Mon Sep 17 00:00:00 2001
+From: Vasily Averin <vvs@virtuozzo.com>
+Date: Thu, 2 Nov 2017 13:03:42 +0300
+Subject: lockd: lost rollback of set_grace_period() in lockd_down_net()
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+commit 3a2b19d1ee5633f76ae8a88da7bc039a5d1732aa upstream.
+
+Commit efda760fe95ea ("lockd: fix lockd shutdown race") is incorrect,
+it removes lockd_manager and disarm grace_period_end for init_net only.
+
+If nfsd was started from another net namespace lockd_up_net() calls
+set_grace_period() that adds lockd_manager into per-netns list
+and queues grace_period_end delayed work.
+
+These action should be reverted in lockd_down_net().
+Otherwise it can lead to double list_add on after restart nfsd in netns,
+and to use-after-free if non-disarmed delayed work will be executed after netns destroy.
+
+Fixes: efda760fe95e ("lockd: fix lockd shutdown race")
+Cc: stable@vger.kernel.org
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/lockd/svc.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/lockd/svc.c
++++ b/fs/lockd/svc.c
+@@ -274,6 +274,8 @@ static void lockd_down_net(struct svc_se
+       if (ln->nlmsvc_users) {
+               if (--ln->nlmsvc_users == 0) {
+                       nlm_shutdown_hosts_net(net);
++                      cancel_delayed_work_sync(&ln->grace_period_end);
++                      locks_end_grace(&ln->lockd_manager);
+                       svc_shutdown_net(serv, net);
+                       dprintk("lockd_down_net: per-net data destroyed; net=%p\n", net);
+               }

diff --git a/queue-4.9/revert-arm-dts-imx6qdl-wandboard-fix-audio-channel-swap.patch b/queue-4.9/revert-arm-dts-imx6qdl-wandboard-fix-audio-channel-swap.patch
new file mode 100644 (file)
index 0000000..0527082
--- /dev/null
+++ b/queue-4.9/revert-arm-dts-imx6qdl-wandboard-fix-audio-channel-swap.patch
@@ -0,0 +1,41 @@
+From 888f09638074428dc5ce7cfe1e6e1d2588112579 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Thu, 17 May 2018 11:47:39 +0200
+Subject: Revert "ARM: dts: imx6qdl-wandboard: Fix audio channel swap"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+This reverts commit c53c4ad96242e868da492f424535bf4b45f80503 which was
+commit 79935915300c5eb88a0e94fa9148a7505c14a02a upstream.
+
+As Ben points out:
+       This depends on:
+
+       commit 570c70a60f53ca737ead4e5966c446bf0d39fac9
+       Author: Fabio Estevam <fabio.estevam@nxp.com>
+       Date:   Wed Apr 5 11:32:34 2017 -0300
+
+           ASoC: sgtl5000: Allow LRCLK pad drive strength to be changed
+
+which did not show up until 4.13, so this makes no sense to have in this
+stable branch.
+
+Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Cc: Fabio Estevam <fabio.estevam@nxp.com>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/imx6qdl-wandboard.dtsi |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
+@@ -88,7 +88,6 @@
+               clocks = <&clks IMX6QDL_CLK_CKO>;
+               VDDA-supply = <&reg_2p5v>;
+               VDDIO-supply = <&reg_3p3v>;
+-              lrclk-strength = <3>;
+       };
+ };
+ 

diff --git a/queue-4.9/series b/queue-4.9/series
index 24c3a93232b071a846ef4794ba0e8a9e64d4cd20..9bfb69c4b32faa86ca118cad6315f821c7420f5d 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -26,3 +26,6 @@ sctp-delay-the-authentication-for-the-duplicated-cookie-echo-chunk.patch
 mm-vmstat-print-non-populated-zones-in-zoneinfo.patch
 serial-sccnxp-fix-error-handling-in-sccnxp_probe.patch
 futex-remove-duplicated-code-and-fix-undefined-behaviour.patch
+xfrm-fix-xfrm_do_migrate-with-aead-e.g-aes-gcm.patch
+lockd-lost-rollback-of-set_grace_period-in-lockd_down_net.patch
+revert-arm-dts-imx6qdl-wandboard-fix-audio-channel-swap.patch

diff --git a/queue-4.9/xfrm-fix-xfrm_do_migrate-with-aead-e.g-aes-gcm.patch b/queue-4.9/xfrm-fix-xfrm_do_migrate-with-aead-e.g-aes-gcm.patch
new file mode 100644 (file)
index 0000000..65b9408
--- /dev/null
+++ b/queue-4.9/xfrm-fix-xfrm_do_migrate-with-aead-e.g-aes-gcm.patch
@@ -0,0 +1,42 @@
+From 75bf50f4aaa1c78d769d854ab3d975884909e4fb Mon Sep 17 00:00:00 2001
+From: Antony Antony <antony@phenome.org>
+Date: Thu, 7 Dec 2017 21:54:27 +0100
+Subject: xfrm: fix xfrm_do_migrate() with AEAD e.g(AES-GCM)
+
+From: Antony Antony <antony@phenome.org>
+
+commit 75bf50f4aaa1c78d769d854ab3d975884909e4fb upstream.
+
+copy geniv when cloning the xfrm state.
+
+x->geniv was not copied to the new state and migration would fail.
+
+xfrm_do_migrate
+  ..
+  xfrm_state_clone()
+   ..
+   ..
+   esp_init_aead()
+   crypto_alloc_aead()
+    crypto_alloc_tfm()
+     crypto_find_alg() return EAGAIN and failed
+
+Signed-off-by: Antony Antony <antony@phenome.org>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/xfrm/xfrm_state.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -1197,6 +1197,7 @@ static struct xfrm_state *xfrm_state_clo
+ 
+       if (orig->aead) {
+               x->aead = xfrm_algo_aead_clone(orig->aead);
++              x->geniv = orig->geniv;
+               if (!x->aead)
+                       goto error;
+       }