commit 1e0d2875797752db3b008fcbea55d5695cb0893a
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Thu Sep 7 08:32:43 2017 +0200

    Linux 3.18.70

commit c54625c865feaf1a0880f4362341ea3c6ca251e5
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Fri Sep 1 18:55:33 2017 +0200

    epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()
    
    commit 138e4ad67afd5c6c318b056b4d17c17f2c0ca5c0 upstream.
    
    The race was introduced by me in commit 971316f0503a ("epoll:
    ep_unregister_pollwait() can use the freed pwq->whead").  I did not
    realize that nothing can protect eventpoll after ep_poll_callback() sets
    ->whead = NULL, only whead->lock can save us from the race with
    ep_free() or ep_remove().
    
    Move ->whead = NULL to the end of ep_poll_callback() and add the
    necessary barriers.
    
    TODO: cleanup the ewake/EPOLLEXCLUSIVE logic, it was confusing even
    before this patch.
    
    Hopefully this explains use-after-free reported by syzcaller:
    
            BUG: KASAN: use-after-free in debug_spin_lock_before
            ...
             _raw_spin_lock_irqsave+0x4a/0x60 kernel/locking/spinlock.c:159
             ep_poll_callback+0x29f/0xff0 fs/eventpoll.c:1148
    
    this is spin_lock(eventpoll->lock),
    
            ...
            Freed by task 17774:
            ...
             kfree+0xe8/0x2c0 mm/slub.c:3883
             ep_free+0x22c/0x2a0 fs/eventpoll.c:865
    
    Fixes: 971316f0503a ("epoll: ep_unregister_pollwait() can use the freed pwq->whead")
    Reported-by: 范龙飞 <long7573@126.com>
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eed3054241a07fdfccca7561e99ede87ded44ab1
Author: Xiangliang.Yu <Xiangliang.Yu@amd.com>
Date:   Wed Aug 16 14:25:51 2017 +0800

    drm/ttm: Fix accounting error when fail to get pages for pool
    
    commit 9afae2719273fa1d406829bf3498f82dbdba71c7 upstream.
    
    When fail to get needed page for pool, need to put allocated pages
    into pool. But current code has a miscalculation of allocated pages,
    correct it.
    
    Signed-off-by: Xiangliang.Yu <Xiangliang.Yu@amd.com>
    Reviewed-by: Christian König <christian.koenig@amd.com>
    Reviewed-by: Monk Liu <monk.liu@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0d400015a32c703273b90601574956a4452a9311
Author: Vladis Dronov <vdronov@redhat.com>
Date:   Wed Aug 2 19:50:14 2017 +0200

    xfrm: policy: check policy direction value
    
    commit 7bab09631c2a303f87a7eb7e3d69e888673b9b7e upstream.
    
    The 'dir' parameter in xfrm_migrate() is a user-controlled byte which is used
    as an array index. This can lead to an out-of-bound access, kernel lockup and
    DoS. Add a check for the 'dir' value.
    
    This fixes CVE-2017-11600.
    
    References: https://bugzilla.redhat.com/show_bug.cgi?id=1474928
    Fixes: 80c9abaabf42 ("[XFRM]: Extension for dynamic update of endpoint address(es)")
    Reported-by: "bo Zhang" <zhangbo5891001@gmail.com>
    Signed-off-by: Vladis Dronov <vdronov@redhat.com>
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cefe4448671112a96ee893ff2797990b775b1441
Author: Cong Wang <xiyou.wangcong@gmail.com>
Date:   Thu Aug 31 16:47:43 2017 +0200

    wl1251: add a missing spin_lock_init()
    
    commit f581a0dd744fe32b0a8805e279c59ec1ac676d60 upstream.
    
    wl1251: add a missing spin_lock_init()
    
    This fixes the following kernel warning:
    
     [ 5668.771453] BUG: spinlock bad magic on CPU#0, kworker/u2:3/9745
     [ 5668.771850]  lock: 0xce63ef20, .magic: 00000000, .owner: <none>/-1,
     .owner_cpu: 0
     [ 5668.772277] CPU: 0 PID: 9745 Comm: kworker/u2:3 Tainted: G        W
     4.12.0-03002-gec979a4-dirty #40
     [ 5668.772796] Hardware name: Nokia RX-51 board
     [ 5668.773071] Workqueue: phy1 wl1251_irq_work
     [ 5668.773345] [<c010c9e4>] (unwind_backtrace) from [<c010a274>]
     (show_stack+0x10/0x14)
     [ 5668.773803] [<c010a274>] (show_stack) from [<c01545a4>]
     (do_raw_spin_lock+0x6c/0xa0)
     [ 5668.774230] [<c01545a4>] (do_raw_spin_lock) from [<c06ca578>]
     (_raw_spin_lock_irqsave+0x10/0x18)
     [ 5668.774658] [<c06ca578>] (_raw_spin_lock_irqsave) from [<c048c010>]
     (wl1251_op_tx+0x38/0x5c)
     [ 5668.775115] [<c048c010>] (wl1251_op_tx) from [<c06a12e8>]
     (ieee80211_tx_frags+0x188/0x1c0)
     [ 5668.775543] [<c06a12e8>] (ieee80211_tx_frags) from [<c06a138c>]
     (__ieee80211_tx+0x6c/0x130)
     [ 5668.775970] [<c06a138c>] (__ieee80211_tx) from [<c06a3dbc>]
     (ieee80211_tx+0xdc/0x104)
     [ 5668.776367] [<c06a3dbc>] (ieee80211_tx) from [<c06a4af0>]
     (__ieee80211_subif_start_xmit+0x454/0x8c8)
     [ 5668.776824] [<c06a4af0>] (__ieee80211_subif_start_xmit) from
     [<c06a4f94>] (ieee80211_subif_start_xmit+0x30/0x2fc)
     [ 5668.777343] [<c06a4f94>] (ieee80211_subif_start_xmit) from
     [<c0578848>] (dev_hard_start_xmit+0x80/0x118)
    ...
    
        by adding the missing spin_lock_init().
    
    Reported-by: Pavel Machek <pavel@ucw.cz>
    Cc: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
    Acked-by: Pavel Machek <pavel@ucw.cz>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Pavel Machek <pavel@ucw.cz>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 447be1587b07cccdd4d9d95cea410f28ce859e57
Author: Steve French <smfrench@gmail.com>
Date:   Sun Aug 27 16:56:08 2017 -0500

    CIFS: remove endian related sparse warning
    
    commit 6e3c1529c39e92ed64ca41d53abadabbaa1d5393 upstream.
    
    Recent patch had an endian warning ie
    cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup()
    
    Signed-off-by: Steve French <smfrench@gmail.com>
    CC: Ronnie Sahlberg <lsahlber@redhat.com>
    Acked-by: Pavel Shilovsky <pshilov@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 79c22326c2c05462b932f4dd21b6ba9a2961b29f
Author: Pavel Shilovsky <pshilov@microsoft.com>
Date:   Thu Aug 24 15:16:40 2017 -0700

    CIFS: Fix maximum SMB2 header size
    
    commit 9e37b1784f2be9397a903307574ee565bbadfd75 upstream.
    
    Currently the maximum size of SMB2/3 header is set incorrectly which
    leads to hanging of directory listing operations on encrypted SMB3
    connections. Fix this by setting the maximum size to 170 bytes that
    is calculated as RFC1002 length field size (4) + transform header
    size (52) + SMB2 header size (64) + create response size (56).
    
    Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
    Signed-off-by: Steve French <smfrench@gmail.com>
    Acked-by: Sachin Prabhu <sprabhu@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9b5ae8b0989251afdc61a0a29a1dfa639602e200
Author: Tejun Heo <tj@kernel.org>
Date:   Mon Aug 28 14:51:27 2017 -0700

    cpumask: fix spurious cpumask_of_node() on non-NUMA multi-node configs
    
    commit b339752d054fb32863418452dff350a1086885b1 upstream.
    
    When !NUMA, cpumask_of_node(@node) equals cpu_online_mask regardless of
    @node.  The assumption seems that if !NUMA, there shouldn't be more than
    one node and thus reporting cpu_online_mask regardless of @node is
    correct.  However, that assumption was broken years ago to support
    DISCONTIGMEM and whether a system has multiple nodes or not is
    separately controlled by NEED_MULTIPLE_NODES.
    
    This means that, on a system with !NUMA && NEED_MULTIPLE_NODES,
    cpumask_of_node() will report cpu_online_mask for all possible nodes,
    indicating that the CPUs are associated with multiple nodes which is an
    impossible configuration.
    
    This bug has been around forever but doesn't look like it has caused any
    noticeable symptoms.  However, it triggers a WARN recently added to
    workqueue to verify NUMA affinity configuration.
    
    Fix it by reporting empty cpumask on non-zero nodes if !NUMA.
    
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Reported-and-tested-by: Geert Uytterhoeven <geert@linux-m68k.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 25bd5a5750b98bbdc59b727c8759847e2d4d5fed
Author: Stephen Douthit <stephend@adiengineering.com>
Date:   Mon Aug 7 17:11:00 2017 -0400

    i2c: ismt: Return EMSGSIZE for block reads with bogus length
    
    commit ba201c4f5ebe13d7819081756378777d8153f23e upstream.
    
    Compare the number of bytes actually seen on the wire to the byte
    count field returned by the slave device.
    
    Previously we just overwrote the byte count returned by the slave
    with the real byte count and let the caller figure out if the
    message was sane.
    
    Signed-off-by: Stephen Douthit <stephend@adiengineering.com>
    Tested-by: Dan Priamo <danp@adiengineering.com>
    Acked-by: Neil Horman <nhorman@tuxdriver.com>
    Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5b6cfd5b7318c4626c884286f5303eb0951151de
Author: Stephen Douthit <stephend@adiengineering.com>
Date:   Mon Aug 7 17:10:59 2017 -0400

    i2c: ismt: Don't duplicate the receive length for block reads
    
    commit b6c159a9cb69c2cf0bf59d4e12c3a2da77e4d994 upstream.
    
    According to Table 15-14 of the C2000 EDS (Intel doc #510524) the
    rx data pointed to by the descriptor dptr contains the byte count.
    
    desc->rxbytes reports all bytes read on the wire, including the
    "byte count" byte.  So if a device sends 4 bytes in response to a
    block read, on the wire and in the DMA buffer we see:
    
    count data1 data2 data3 data4
     0x04  0xde  0xad  0xbe  0xef
    
    That's what we want to return in data->block to the next level.
    
    Instead we were actually prefixing that with desc->rxbytes:
    
    bad
    count count data1 data2 data3 data4
     0x05  0x04  0xde  0xad  0xbe  0xef
    
    This was discovered while developing a BMC solution relying on the
    ipmi_ssif.c driver which was trying to interpret the bogus length
    field as part of the IPMI response.
    
    Signed-off-by: Stephen Douthit <stephend@adiengineering.com>
    Tested-by: Dan Priamo <danp@adiengineering.com>
    Acked-by: Neil Horman <nhorman@tuxdriver.com>
    Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>