malhuda/msm-4.14
1
0
Fork 0
mirror of https://github.com/rd-stuffs/msm-4.14.git synced 2025-02-20 11:45:48 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity
718,017 Commits 5 Branches 0 Tags
Commit Graph

4561 Commits

Author SHA1 Message Date
Isaac J. Manjarres
7ed7e2acf0 Merge remote-tracking branch 'remotes/origin/tmp-51e322a' into msm-4.14 
* remotes/origin/tmp-51e322a:
  Linux 4.14.32
  s390/qeth: on channel error, reject further cmd requests
  s390/qeth: lock read device while queueing next buffer
  s390/qeth: when thread completes, wake up all waiters
  s390/qeth: free netdevice when removing a card
  dpaa_eth: remove duplicate increment of the tx_errors counter
  dpaa_eth: increment the RX dropped counter when needed
  dpaa_eth: remove duplicate initialization
  dpaa_eth: fix error in dpaa_remove()
  soc/fsl/qbman: fix issue in qman_delete_cgr_safe()
  team: Fix double free in error path
  skbuff: Fix not waking applications when errors are enqueued
  qede: Fix qedr link update
  net: systemport: Rewrite __bcm_sysport_tx_reclaim()
  net: Only honor ifindex in IP_PKTINFO if non-0
  netlink: avoid a double skb free in genlmsg_mcast()
  net/iucv: Free memory obtained by kzalloc
  net: fec: Fix unbalanced PM runtime calls
  net: ethernet: ti: cpsw: add check for in-band mode setting with RGMII PHY interface
  net: ethernet: arc: Fix a potential memory leak if an optional regulator is deferred
  l2tp: do not accept arbitrary sockets
  ipv6: fix access to non-linear packet in ndisc_fill_redirect_hdr_option()
  dccp: check sk for closed state in dccp_sendmsg()
  net: Fix hlist corruptions in inet_evict_bucket()
  net: use skb_to_full_sk() in skb_update_prio()
  ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()
  sch_netem: fix skb leak in netem_enqueue()
  kcm: lock lower socket in kcm_attach
  rhashtable: Fix rhlist duplicates insertion
  ppp: avoid loop in xmit recursion detection code
  net sched actions: return explicit error when tunnel_key mode is not specified
  net: phy: Tell caller result of phy_change()
  mlxsw: spectrum_buffers: Set a minimum quota for CPU port traffic
  ipv6: sr: fix scheduling in RCU when creating seg6 lwtunnel state
  ipv6: sr: fix NULL pointer dereference when setting encap source address
  ipv6: old_dport should be a __be16 in __ip6_datagram_connect()
  net: ipv6: keep sk status consistent after datagram connect failure
  macvlan: filter out unsupported feature flags
  devlink: Remove redundant free on error path
  net: phy: relax error checking when creating sysfs link netdev->phydev
  sysfs: symlink: export sysfs_create_link_nowarn()
  qed: Fix non TCP packets should be dropped on iWARP ll2 connection
  tcp: purge write queue upon aborting the connection
  tcp: reset sk_send_head in tcp_write_queue_purge

Change-Id: Ief39b9585daef847f0456cfe8fa70ba0178ea127
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-04-02 13:49:25 -07:00
Isaac J. Manjarres
976852dffe Merge remote-tracking branch 'remotes/origin/tmp-331d833' into msm-4.14 
* remotes/origin/tmp-331d833:
  Linux 4.14.31
  bpf, x64: increase number of passes
  bpf: skip unnecessary capability check
  kbuild: disable clang's default use of -fmerge-all-constants
  x86/pkeys/selftests: Rename 'si_pkey' to 'siginfo_pkey'
  usb: xhci: Fix potential memory leak in xhci_disable_slot()
  usb: xhci: Disable slot even when virt-dev is null
  staging: lustre: ptlrpc: kfree used instead of kvfree
  staging: android: ion: Zero CMA allocated memory
  iio: imu: st_lsm6dsx: fix endianness in st_lsm6dsx_read_oneshot()
  iio: ABI: Fix name of timestamp sysfs file
  perf/x86/intel/uncore: Fix multi-domain PCI CHA enumeration bug on Skylake servers
  perf/x86/intel: Don't accidentally clear high bits in bdw_limit_period()
  perf/core: Fix ctx_event_type in ctx_resched()
  perf stat: Fix CVS output format for non-supported counters
  perf/x86/intel/uncore: Fix Skylake UPI event format
  drm/syncobj: Stop reusing the same struct file for all syncobj -> fd
  x86/boot/64: Verify alignment of the LOAD segment
  x86/build/64: Force the linker to use 2MB page size
  kvm/x86: fix icebp instruction handling
  posix-timers: Protect posix clock array access against speculation
  x86/efi: Free efi_pgd with free_pages()
  x86/vsyscall/64: Use proper accessor to update P4D entry
  selftests/x86/ptrace_syscall: Fix for yet more glibc interference
  x86/entry/64: Don't use IST entry for #BP stack
  tty: vt: fix up tabstops properly
  can: cc770: Fix use after free in cc770_tx_interrupt()
  can: cc770: Fix queue stall & dropped RTR reply
  can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack
  can: ifi: Check core revision upon probe
  can: ifi: Repair the error handling
  can: peak/pcie_fd: remove useless code when interface starts
  can: peak/pcie_fd: fix echo_skb is occupied! bug
  staging: ncpfs: memory corruption in ncp_read_kernel()
  mtd: nand: fsl_ifc: Read ECCSTAT0 and ECCSTAT1 registers for IFC 2.0
  mtd: nand: fsl_ifc: Fix eccstat array overflow for IFC ver >= 2.0.0
  mtd: nand: fsl_ifc: Fix nand waitfunc return value
  mtdchar: fix usage of mtd_ooblayout_ecc()
  tracing: probeevent: Fix to support minus offset from symbol
  rtlwifi: rtl8723be: Fix loss of signal
  brcmfmac: fix P2P_DEVICE ethernet address generation
  libnvdimm, {btt, blk}: do integrity setup before add_disk()
  ACPI / watchdog: Fix off-by-one error at resource assignment
  acpi, numa: fix pxm to online numa node associations
  mm/vmscan: wake up flushers for legacy cgroups too
  drm: udl: Properly check framebuffer mmap offsets
  drm: Reject getfb for multi-plane framebuffers
  drm/radeon: Don't turn off DP sink when disconnected
  drm/vmwgfx: Fix a destoy-while-held mutex problem.
  drm/vmwgfx: Fix black screen and device errors when running without fbdev
  Revert "mm: page_alloc: skip over regions of invalid pfns where possible"
  mm/shmem: do not wait for lock_page() in shmem_unused_huge_shrink()
  mm/thp: do not wait for lock_page() in deferred_split_scan()
  mm/khugepaged.c: convert VM_BUG_ON() to collapse fail
  x86/mm: implement free pmd/pte page interfaces
  mm/vmalloc: add interfaces to free unmapped page table
  h8300: remove extraneous __BIG_ENDIAN definition
  hugetlbfs: check for pgoff value overflow
  nfsd: remove blocked locks on client teardown
  cgroup: fix rule checking for threaded mode switching
  libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version
  libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions
  libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs
  libata: Enable queued TRIM for Samsung SSD 860
  libata: disable LPM for Crucial BX100 SSD 500GB drive
  libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs
  libata: don't try to pass through NCQ commands to non-NCQ devices
  libata: remove WARN() for DMA or PIO command without data
  libata: fix length validation of ATAPI-relayed SCSI commands
  Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174
  Bluetooth: btusb: Add Dell OptiPlex 3060 to btusb_needs_reset_resume_table
  Bluetooth: btusb: Remove Yoga 920 from the btusb_needs_reset_resume_table
  pinctrl: samsung: Validate alias coming from DT
  Drivers: hv: vmbus: Fix ring buffer signaling
  RDMA/mlx5: Fix crash while accessing garbage pointer and freed memory
  clk: sunxi-ng: a31: Fix CLK_OUT_* clock ops
  clk: bcm2835: Protect sections updating shared registers
  clk: bcm2835: Fix ana->maskX definitions
  lockdep: fix fs_reclaim warning
  ahci: Add PCI-id for the Highpoint Rocketraid 644L card
  PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L
  mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs
  mmc: dw_mmc: exynos: fix the suspend/resume issue for exynos5433
  mmc: dw_mmc: Fix the DTO/CTO timeout overflow calculation for 32-bit systems
  mmc: block: fix updating ext_csd caches on ioctl call
  mmc: core: Disable HPI for certain Micron (Numonyx) eMMC cards
  mmc: core: Fix tracepoint print of blk_addr and blksz
  ALSA: hda/realtek - Always immediately update mute LED with pin VREF
  ALSA: hda/realtek - Fix Dell headset Mic can't record
  ALSA: hda/realtek - Fix speaker no sound after system resume
  ALSA: hda - Force polling mode on CFL for fixing codec communication
  ALSA: aloop: Fix access to not-yet-ready substream via cable
  ALSA: aloop: Sync stale timer before release
  ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit
  iio: adc: meson-saradc: unlock on error in meson_sar_adc_lock()
  iio: st_pressure: st_accel: pass correct platform data to init
  iio: chemical: ccs811: Corrected firmware boot/application mode transition
  MIPS: lantiq: ase: Enable MFD_SYSCON
  MIPS: lantiq: Enable AHB Bus for USB
  MIPS: lantiq: Fix Danube USB clock
  MIPS: ralink: Fix booting on MT7621
  MIPS: ralink: Remove ralink_halt()
  ANDROID: arm64: Image.gz-dtb build target depends on Image.gz

Conflicts:
	drivers/staging/android/ion/ion_cma_heap.c

Change-Id: I1ed32b5d3bcf4db15991859bdd89fed0d70fdb86
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-04-02 13:49:16 -07:00
Paul Blakey
07cf9d303c rhashtable: Fix rhlist duplicates insertion 
[ Upstream commit d3dcf8eb615537526bd42ff27a081d46d337816e ]

When inserting duplicate objects (those with the same key),
current rhlist implementation messes up the chain pointers by
updating the bucket pointer instead of prev next pointer to the
newly inserted node. This causes missing elements on removal and
travesal.

Fix that by properly updating pprev pointer to point to
the correct rhash_head next pointer.

Issue: 1241076
Change-Id: I86b2c140bcb4aeb10b70a72a267ff590bb2b17e7
Fixes: ca26893f05e8 ('rhashtable: Add rhlist interface')
Signed-off-by: Paul Blakey <paulb@mellanox.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-03-31 18:10:40 +02:00
Toshi Kani
acdb498164 mm/vmalloc: add interfaces to free unmapped page table 
commit b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e upstream.

On architectures with CONFIG_HAVE_ARCH_HUGE_VMAP set, ioremap() may
create pud/pmd mappings.  A kernel panic was observed on arm64 systems
with Cortex-A75 in the following steps as described by Hanjun Guo.

 1. ioremap a 4K size, valid page table will build,
 2. iounmap it, pte0 will set to 0;
 3. ioremap the same address with 2M size, pgd/pmd is unchanged,
    then set the a new value for pmd;
 4. pte0 is leaked;
 5. CPU may meet exception because the old pmd is still in TLB,
    which will lead to kernel panic.

This panic is not reproducible on x86.  INVLPG, called from iounmap,
purges all levels of entries associated with purged address on x86.  x86
still has memory leak.

The patch changes the ioremap path to free unmapped page table(s) since
doing so in the unmap path has the following issues:

 - The iounmap() path is shared with vunmap(). Since vmap() only
   supports pte mappings, making vunmap() to free a pte page is an
   overhead for regular vmap users as they do not need a pte page freed
   up.

 - Checking if all entries in a pte page are cleared in the unmap path
   is racy, and serializing this check is expensive.

 - The unmap path calls free_vmap_area_noflush() to do lazy TLB purges.
   Clearing a pud/pmd entry before the lazy TLB purges needs extra TLB
   purge.

Add two interfaces, pud_free_pmd_page() and pmd_free_pte_page(), which
clear a given pud/pmd entry and free up a page for the lower level
entries.

This patch implements their stub functions on x86 and arm64, which work
as workaround.

[akpm@linux-foundation.org: fix typo in pmd_free_pte_page() stub]
Link: http://lkml.kernel.org/r/20180314180155.19492-2-toshi.kani@hpe.com
Fixes: e61ce6ade404e ("mm: change ioremap to set up huge I/O mappings")
Reported-by: Lei Li <lious.lilei@hisilicon.com>
Signed-off-by: Toshi Kani <toshi.kani@hpe.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Wang Xuefeng <wxf.wang@hisilicon.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Hanjun Guo <guohanjun@huawei.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Chintan Pandya <cpandya@codeaurora.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-03-28 18:24:38 +02:00
Blagovest Kolenichev
24b2e60f51 Merge android-4.14.29 (45c8dbe) into msm-4.14 
* refs/heads/tmp-45c8dbe
  Linux 4.14.29
  usb: dwc3: Fix GDBGFIFOSPACE_TYPE values
  USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe()
  scsi: qla2xxx: Fix crashes in qla2x00_probe_one on probe failure
  scsi: qla2xxx: Fix logo flag for qlt_free_session_done()
  scsi: qla2xxx: Fix NULL pointer access for fcport structure
  scsi: qla2xxx: Fix smatch warning in qla25xx_delete_{rsp|req}_que
  btrfs: Fix memory barriers usage with device stats counters
  btrfs: remove spurious WARN_ON(ref->count < 0) in find_parent_nodes
  btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device
  btrfs: alloc_chunk: fix DUP stripe size handling
  btrfs: add missing initialization in btrfs_check_shared
  btrfs: Fix NULL pointer exception in find_bio_stripe
  irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis
  RDMAVT: Fix synchronization around percpu_ref
  fs/aio: Use RCU accessors for kioctx_table->table[]
  fs/aio: Add explicit RCU grace period when freeing kioctx
  lock_parent() needs to recheck if dentry got __dentry_kill'ed under it
  KVM: arm/arm64: vgic: Don't populate multiple LRs with the same vintid
  kvm: arm/arm64: vgic-v3: Tighten synchronization for guests using v2 on v3
  KVM: arm/arm64: Reduce verbosity of KVM init log
  fs: Teach path_connected to handle nfs filesystems with multiple roots.
  drm/amdgpu/dce: Don't turn off DP sink when disconnected
  drm/radeon: fix prime teardown order
  drm/amdgpu: fix prime teardown order
  drm/nouveau/bl: Fix oops on driver unbind
  ALSA: seq: Clear client entry before deleting else at closing
  ALSA: seq: Fix possible UAF in snd_seq_check_queue()
  ALSA: hda - Revert power_save option default value
  ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats()
  parisc: Handle case where flush_cache_range is called with no context
  x86/mm: Fix vmalloc_fault to use pXd_large
  KVM: x86: Fix device passthrough when SME is active
  x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist
  x86/speculation, objtool: Annotate indirect calls/jumps for objtool on 32-bit kernels
  x86/vm86/32: Fix POPF emulation
  selftests/x86/entry_from_vm86: Add test cases for POPF
  selftests/x86: Add tests for the STR and SLDT instructions
  selftests/x86: Add tests for User-Mode Instruction Prevention
  selftests/x86/entry_from_vm86: Exit with 1 if we fail
  x86/cpufeatures: Add Intel PCONFIG cpufeature
  x86/cpufeatures: Add Intel Total Memory Encryption cpufeature
  ANDROID: arm-smccc: fix clang build
  staging: android: ashmem: Fix possible deadlock in ashmem_ioctl
  Linux 4.14.28
  drm/i915/glk: Disable Guc and HuC on GLK
  dmaengine: qcom_hidma: check pending interrupts
  IB/mlx5: revisit -Wmaybe-uninitialized warning
  ima: relax requiring a file signature for new files with zero length
  locking/locktorture: Fix num reader/writer corner cases
  rcutorture/configinit: Fix build directory error message
  ipvlan: add L2 check for packets arriving via virtual devices
  Fix misannotated out-of-line _copy_to_user()
  mmc: mmc_test: Ensure command queue is disabled for testing
  ASoC: nuc900: Fix a loop timeout test
  crypto: caam/qi - use correct print specifier for size_t
  mac80211: remove BUG() when interface type is invalid
  mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED
  agp/intel: Flush all chipset writes after updating the GGTT
  arm64: dts: renesas: salvator-common: Add EthernetAVB PHY reset
  powerpc/64: Don't trace irqs-off at interrupt return to soft-disabled context
  powerpc/modules: Don't try to restore r2 after a sibling call
  drm/amdkfd: Fix memory leaks in kfd topology
  veth: set peer GSO values
  net: sched: drop qdisc_reset from dev_graft_qdisc
  virtio_net: Disable interrupts if napi_complete_done rescheduled napi
  media: davinci: vpif_capture: add NULL check on devm_kzalloc return value
  media: cpia2: Fix a couple off by one bugs
  dm raid: fix raid set size revalidation
  media: vsp1: Prevent suspending and resuming DRM pipelines
  scsi: dh: add new rdac devices
  scsi: devinfo: apply to HP XP the same flags as Hitachi VSP
  scsi: core: scsi_get_device_flags_keyed(): Always return device flags
  bnxt_en: Don't print "Link speed -1 no longer supported" messages.
  spi: sun6i: disable/unprepare clocks on remove
  tools/usbip: fixes build with musl libc toolchain
  ath10k: fix invalid STS_CAP_OFFSET_MASK
  mwifiex: cfg80211: do not change virtual interface during scan processing
  clk: qcom: msm8916: fix mnd_width for codec_digcodec
  drm/amdgpu:fix virtual dce bug
  iwlwifi: mvm: avoid dumping assert log when device is stopped
  perf annotate: Fix objdump comment parsing for Intel mov dissassembly
  perf annotate: Fix unnecessary memory allocation for s390x
  pinctrl: sh-pfc: r8a7795-es1: Fix MOD_SEL1 bit[25:24] to 0x3 when using STP_ISEN_1_D
  pinctrl: sh-pfc: r8a7791: Add can_clk function
  drm/sun4i: Fix format mask in DE2 driver
  pwm: stmpe: Fix wrong register offset for hwpwm=2 case
  scsi: ses: don't ask for diagnostic pages repeatedly during probe
  drm/amdgpu:fix random missing of FLR NOTIFY
  cpufreq: Fix governor module removal race
  ath10k: update tdls teardown state to target
  iio: health: max30102: Add power enable parameter to get_temp function
  iio: adc: ina2xx: Shift bus voltage register to mask flag bits
  drm/etnaviv: make THERMAL selectable
  power: supply: ab8500_charger: Bail out in case of error in 'ab8500_charger_init_hw_registers()'
  power: supply: ab8500_charger: Fix an error handling path
  leds: pm8058: Silence pointer to integer size warning
  xfrm: Fix xfrm_replay_overflow_offload_esn
  userns: Don't fail follow_automount based on s_user_ns
  mtd: nand: ifc: update bufnum mask for ver >= 2.0.0
  ARM: dts: omap3-n900: Fix the audio CODEC's reset pin
  ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin
  net: thunderx: Set max queue count taking XDP_TX into account
  mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]()
  net: xfrm: allow clearing socket xfrm policies.
  rtc: brcmstb-waketimer: fix error handling in brcmstb_waketmr_probe()
  net: ieee802154: adf7242: Fix bug if defined DEBUG
  test_firmware: fix setting old custom fw path back on exit
  crypto: cavium - fix memory leak on info
  crypto: ecc - Fix NULL pointer deref. on no default_rng
  sched: Stop resched_cpu() from sending IPIs to offline CPUs
  sched: Stop switched_to_rt() from sending IPIs to offline CPUs
  USB: ledtrig-usbport: fix of-node leak
  typec: tcpm: fusb302: Resolve out of order messaging events
  staging: rtl8822be: fix missing null check on dev_alloc_skb return
  drm/amdgpu: fix get_max_engine_clock_in_mhz
  ARM: dts: exynos: Correct Trats2 panel reset line
  clk: meson: gxbb: fix wrong clock for SARADC/SANA
  ARM: dts: koelsch: Move cec_clock to root node
  iwlwifi: mvm: rs: don't override the rate history in the search cycle
  HID: elo: clear BTN_LEFT mapping
  HID: multitouch: Only look at non touch fields in first packet of a frame
  video/hdmi: Allow "empty" HDMI infoframes
  dma-buf/fence: Fix lock inversion within dma-fence-array
  drm/edid: set ELD connector type in drm_edid_to_eld()
  Revert "btrfs: use proper endianness accessors for super_copy"
  dm mpath: fix passing integrity data
  earlycon: add reg-offset to physical address before mapping
  serial: core: mark port as initialized in autoconfig
  serial: 8250_pci: Add Brainboxes UC-260 4 port serial device
  usb: dwc3: Fix lock-up on ID change during system suspend/resume
  usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb()
  usb: usbmon: Read text within supplied buffer size
  usb: quirks: add control message delay for 1b1c:1b20
  usbip: vudc: fix null pointer dereference on udc->lock
  USB: storage: Add JMicron bridge 152d:2567 to unusual_devs.h
  staging: android: ashmem: Fix lockdep issue during llseek
  staging: comedi: fix comedi_nsamples_left.
  uas: fix comparison for error code
  tty/serial: atmel: add new version check for usart
  serial: sh-sci: prevent lockup on full TTY buffers
  xhci: fix endpoint context tracer output
  xhci: Fix front USB ports on ASUS PRIME B350M-A
  usb: host: xhci-rcar: add support for r8a77965
  ASoC: rt5651: Fix regcache sync errors on resume
  ASoC: wm_adsp: For TLV controls only register TLV get/set
  ASoC: sgtl5000: Fix suspend/resume
  ASoC: sun4i-i2s: Fix RX slot number of SUN8I
  x86: Treat R_X86_64_PLT32 as R_X86_64_PC32
  net: phy: Restore phy_resume() locking assumption
  net: phy: fix resume handling
  ANDROID: sdcardfs: fix lock issue on 32 bit/SMP architectures

Change-Id: Ida88909c333e059adf42a8794c3b92b1d15252f7
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-03-21 10:16:53 -07:00
Christophe Leroy
0ced0c46b4 Fix misannotated out-of-line _copy_to_user() 
[ Upstream commit a0e94598e6b6c0d1df6a5fa14eb7c767ca817a20 ]

Destination is a kernel pointer and source - a userland one
in _copy_from_user(); _copy_to_user() is the other way round.

Fixes: d597580d37377 ("generic ...copy_..._user primitives")
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-03-19 08:42:56 +01:00
Linux Build Service Account
be49c61378 Merge "Merge remote-tracking branch 'remotes/origin/tmp-df0daba' into msm-4.14" into msm-4.14 2018-03-17 14:54:33 -07:00
Linux Build Service Account
14b1002220 Merge "lib: ubsan: Fix compilation issues for ubsan" into msm-4.14 2018-03-15 18:11:28 -07:00
Isaac J. Manjarres
3ba3c6ce0a Merge remote-tracking branch 'remotes/origin/tmp-df0daba' into msm-4.14 
* remotes/origin/tmp-df0daba:
  Linux 4.14.27
  x86/kprobes: Fix kernel crash when probing .entry_trampoline code
  objtool: Fix 32-bit build
  objtool: Fix another switch table detection issue
  objtool, retpolines: Integrate objtool with retpoline support more closely
  objtool: Add module specific retpoline rules
  kbuild: move cc-option and cc-disable-warning after incl. arch Makefile
  kbuild: Set KBUILD_CFLAGS before incl. arch Makefile
  kbuild: re-order the code to not parse unnecessary variables
  objtool: Add retpoline validation
  objtool: Use existing global variables for options
  x86/mm/sme, objtool: Annotate indirect call in sme_encrypt_execute()
  x86/boot, objtool: Annotate indirect jump in secondary_startup_64()
  x86/paravirt, objtool: Annotate indirect calls
  x86/speculation: Move firmware_restrict_branch_speculation_*() from C to CPP
  x86/speculation, objtool: Annotate indirect calls/jumps for objtool
  x86/retpoline: Support retpoline builds with Clang
  x86/speculation: Use IBRS if available before calling into firmware
  Revert "x86/retpoline: Simplify vmexit_fill_RSB()"
  x86-64/realmode: Add instruction suffix
  x86/LDT: Avoid warning in 32-bit builds with older gcc
  x86/asm: Improve how GEN_*_SUFFIXED_RMWcc() specify clobbers
  x86/mm: Remove stale comment about KMEMCHECK
  x86/entry/64: Use 'xorl' for faster register clearing
  x86/entry: Reduce the code footprint of the 'idtentry' macro
  nospec: Include <asm/barrier.h> dependency
  nospec: Kill array_index_nospec_mask_check()
  MIPS: CPC: Map registers using DT in mips_cpc_default_phys_base()
  dt-bindings: Document mti,mips-cpc binding
  scsi: qla2xxx: Fix recursion while sending terminate exchange
  scsi: qla2xxx: Fix NULL pointer crash due to probe failure
  ALSA: hda: add dock and led support for HP ProBook 640 G2
  ALSA: hda: add dock and led support for HP EliteBook 820 G3
  ALSA: hda - Fix a wrong FIXUP for alc289 on Dell machines
  ALSA: seq: More protection for concurrent write and ioctl races
  ALSA: seq: Don't allow resizing pool in use
  ALSA: hda/realtek - Make dock sound work on ThinkPad L570
  ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520
  ALSA: hda/realtek: Limit mic boost on T480
  ALSA: hda/realtek - Add headset mode support for Dell laptop
  ALSA: hda/realtek - Add support headset mode for DELL WYSE
  x86/spectre_v2: Don't check microcode versions when running under hypervisors
  perf tools: Fix trigger class trigger_on()
  x86/MCE: Serialize sysfs changes
  x86/MCE: Save microcode revision in machine check records
  bcache: don't attach backing with duplicate UUID
  bcache: fix crashes in duplicate cache device register
  IB/mlx5: Fix incorrect size of klms in the memory region
  dm bufio: avoid false-positive Wmaybe-uninitialized warning
  kbuild: Handle builtin dtb file names containing hyphens
  IB/core: Fix missing RDMA cgroups release in case of failure to register device
  arm64: mm: fix thinko in non-global page table attribute check
  KVM: s390: fix memory overwrites when not using SCA entries
  virtio_ring: fix num_free handling in error case
  loop: Fix lost writes caused by missing flag
  Documentation/sphinx: Fix Directive import error
  mm/memblock.c: hardcode the end_pfn being -1
  lib/bug.c: exclude non-BUG/WARN exceptions from report_bug()
  Input: matrix_keypad - fix race when disabling interrupts
  PCI: dwc: Fix enumeration end when reaching root subordinate
  MIPS: OCTEON: irq: Check for null return on kzalloc allocation
  MIPS: ath25: Check for kzalloc allocation failure
  MIPS: BMIPS: Do not mask IPIs during suspend
  drm/amdgpu:Always save uvd vcpu_bo in VM Mode
  drm/amdgpu:Correct max uvd handles
  drm/amdgpu: fix KV harvesting
  drm/radeon: fix KV harvesting
  drm/amdgpu: Notify sbios device ready before send request
  drm/amdgpu: used cached pcie gen info for SI (v2)
  drm/amd/powerplay: fix power over limit on Fiji
  drm/radeon: insist on 32-bit DMA for Cedar on PPC64/PPC64LE
  Revert "drm/radeon/pm: autoswitch power state when in balanced mode"
  drm/amd/powerplay/vega10: allow mclk switching with no displays
  drm/amd/powerplay/smu7: allow mclk switching with no displays
  drm/nouveau: prefer XBGR2101010 for addfb ioctl
  drm/amdgpu: Fix deadlock on runtime suspend
  drm/radeon: Fix deadlock on runtime suspend
  drm/nouveau: Fix deadlock on runtime suspend
  drm: Allow determining if current task is output poll worker
  workqueue: Allow retrieval of current task's work struct
  drm/i915: Always call to intel_display_set_init_power() in resume_early.
  scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS
  scsi: core: Avoid that ATA error handling can trigger a kernel hang or oops
  drm/i915/perf: fix perf stream opening lock
  drm/i915: Try EDID bitbanging on HDMI after failed read
  drm/i915: Update watermark state correctly in sanitize_watermarks
  drm/i915: Disable DC states around GMBUS on GLK
  drm/i915: Clear the in-use marker on execbuf failure
  drm/i915: Fix rsvd2 mask when out-fence is returned
  regulator: stm32-vrefbuf: fix check on ready flag
  net/smc: fix NULL pointer dereference on sock_create_kern() error path
  IB/uverbs: Improve lockdep_check
  RDMA/mlx5: Fix integer overflow while resizing CQ
  RDMA/ucma: Check that user doesn't overflow QP state
  RDMA/ucma: Limit possible option size
  NFS: Fix unstable write completion
  pNFS: Prevent the layout header refcount going to zero in pnfs_roc()
  NFS: Fix an incorrect type in struct nfs_direct_req
  scsi: qla2xxx: Fix memory leak in dual/target mode
  scsi: qla2xxx: Fix system crash in qlt_plogi_ack_unref
  scsi: qla2xxx: Remove aborting ELS IOCB call issued as part of timeout.
  scsi: qla2xxx: Defer processing of GS IOCB calls
  scsi: qla2xxx: Clear loop id after delete
  scsi: qla2xxx: Fix scan state field for fcport
  scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport
  scsi: qla2xxx: Fix abort command deadlock due to spinlock
  scsi: qla2xxx: Fix PRLI state check
  scsi: qla2xxx: Fix Relogin being triggered too fast
  scsi: qla2xxx: Fix NPIV host cleanup in target mode
  scsi: qla2xxx: Fix login state machine stuck at GPDB
  scsi: qla2xxx: Serialize GPNID for multiple RSCN
  scsi: qla2xxx: Retry switch command on time out
  scsi: qla2xxx: Fix re-login for Nport Handle in use
  scsi: qla2xxx: Skip IRQ affinity for Target QPairs
  scsi: qla2xxx: Move session delete to driver work queue
  scsi: qla2xxx: Fix gpnid error processing
  scsi: qla2xxx: Fix system crash for Notify ack timeout handling
  tpm: only attempt to disable the LPC CLKRUN if is already enabled
  tpm: remove unused variables
  tpm: delete the TPM_TIS_CLK_ENABLE flag
  tpm: Keep CLKRUN enabled throughout the duration of transmit_cmd()
  tpm_tis: Move ilb_base_addr to tpm_tis_data
  netfilter: use skb_to_full_sk in ip6_route_me_harder
  netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt
  netfilter: bridge: ebt_among: add missing match size checks
  netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets
  netfilter: IDLETIMER: be syzkaller friendly
  netfilter: nat: cope with negative port range
  netfilter: x_tables: fix missing timer initialization in xt_LED
  netfilter: xt_hashlimit: fix lock imbalance
  netfilter: ipt_CLUSTERIP: fix a race condition of proc file creation
  netfilter: add back stackpointer size checks
  ASoC: Intel: kbl: fix jack name
  ASoC: Intel: Skylake: Fix jack name format substitution
  ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds
  watchdog: hpwdt: Remove legacy NMI sourcing.
  watchdog: hpwdt: fix unused variable warning
  watchdog: hpwdt: Check source of NMI
  watchdog: hpwdt: SMBIOS check
  kbuild: move "_all" target out of $(KBUILD_SRC) conditional
  FROMLIST: f2fs: don't put dentry page in pagecache into highmem

Conflicts:
	Makefile

Change-Id: I9c0acaa8aea9f4986bf01898de8d4be4658c64ce
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-03-15 09:55:13 -07:00
Kees Cook
d50cb5cedb lib/bug.c: exclude non-BUG/WARN exceptions from report_bug() 
commit 1b4cfe3c0a30dde968fb43c577a8d7e262a145ee upstream.

Commit b8347c219649 ("x86/debug: Handle warnings before the notifier
chain, to fix KGDB crash") changed the ordering of fixups, and did not
take into account the case of x86 processing non-WARN() and non-BUG()
exceptions.  This would lead to output of a false BUG line with no other
information.

In the case of a refcount exception, it would be immediately followed by
the refcount WARN(), producing very strange double-"cut here":

  lkdtm: attempting bad refcount_inc() overflow
  ------------[ cut here ]------------
  Kernel BUG at 0000000065f29de5 [verbose debug info unavailable]
  ------------[ cut here ]------------
  refcount_t overflow at lkdtm_REFCOUNT_INC_OVERFLOW+0x6b/0x90 in cat[3065], uid/euid: 0/0
  WARNING: CPU: 0 PID: 3065 at kernel/panic.c:657 refcount_error_report+0x9a/0xa4
  ...

In the prior ordering, exceptions were searched first:

   do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str,
   ...
                if (fixup_exception(regs, trapnr))
                        return 0;

  -               if (fixup_bug(regs, trapnr))
  -                       return 0;
  -

As a result, fixup_bugs()'s is_valid_bugaddr() didn't take into account
needing to search the exception list first, since that had already
happened.

So, instead of searching the exception list twice (once in
is_valid_bugaddr() and then again in fixup_exception()), just add a
simple sanity check to report_bug() that will immediately bail out if a
BUG() (or WARN()) entry is not found.

Link: http://lkml.kernel.org/r/20180301225934.GA34350@beast
Fixes: b8347c219649 ("x86/debug: Handle warnings before the notifier chain, to fix KGDB crash")
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Richard Weinberger <richard.weinberger@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-03-15 10:54:32 +01:00
Isaac J. Manjarres
a7ea4f03e5 lib: ubsan: Fix compilation issues for ubsan 
Currently, multiple declarations of data structures and
functions exist, as well as dead code that was meant to be
removed earlier. Remove dead code and multiple declarations
for ubsan.

Change-Id: I2b1d27ab2edc9852a3cd286c70fe8990aa0e0754
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-03-09 11:30:09 -08:00
Isaac J. Manjarres
07f0d9dd34 Merge remote-tracking branch 'remotes/origin/tmp-85ab9a0' into msm-4.14 
* remotes/origin/tmp-85ab9a0:
  Linux 4.14.24
  net: sched: fix use-after-free in tcf_block_put_ext
  net_sched: get rid of rcu_barrier() in tcf_block_put_ext()
  net: sched: crash on blocks with goto chain action
  net: sched: fix crash when deleting secondary chains
  arm64: dts: marvell: mcbin: add comphy references to Ethernet ports
  arm64: dts: marvell: add comphy nodes on cp110 master and slave
  powerpc/pseries: Enable RAS hotplug events later
  MIPS: Implement __multi3 for GCC7 MIPS64r6 builds
  mlxsw: pci: Wait after reset before accessing HW
  nfp: always unmask aux interrupts at init
  of_mdio: avoid MDIO bus removal when a PHY is missing
  net: gianfar_ptp: move set_fipers() to spinlock protecting area
  sctp: make use of pre-calculated len
  sctp: add a ceiling to optlen in some sockopts
  xen/gntdev: Fix partial gntdev_mmap() cleanup
  xen/gntdev: Fix off-by-one error when unmapping with holes
  SolutionEngine771x: fix Ether platform data
  mdio-sun4i: Fix a memory leak
  xen-netfront: enable device after manual module load
  bnxt_en: Fix the 'Invalid VF' id check in bnxt_vf_ndo_prep routine.
  bnxt_en: Fix population of flow_type in bnxt_hwrm_cfa_flow_alloc()
  x86/platform/intel-mid: Revert "Make 'bt_sfi_data' const"
  nvme-fabrics: initialize default host->id in nvmf_host_default()
  powerpc/pseries: Make RAS IRQ explicitly dependent on DLPAR WQ
  leds: core: Fix regression caused by commit 2b83ff96f51d
  bpf: sockmap missing NULL psock check
  ia64, sched/cputime: Fix build error if CONFIG_VIRT_CPU_ACCOUNTING_NATIVE=y
  block: drain queue before waiting for q_usage_counter becoming zero
  wcn36xx: Fix dynamic power saving
  can: flex_can: Correct the checking for frame length in flexcan_start_xmit()
  mac80211: mesh: drop frames appearing to be from us
  nl80211: Check for the required netlink attribute presence
  net: ena: unmask MSI-X only after device initialization is completed
  i40e: don't remove netdev->dev_addr when syncing uc list
  i40e/i40evf: Account for frags split over multiple descriptors in check linearize
  uapi libc compat: add fallback for unsupported libcs
  x86/efi: Fix kernel param add_efi_memmap regression
  RDMA/netlink: Fix locking around __ib_get_device_by_index
  drm/ttm: check the return value of kzalloc
  NET: usb: qmi_wwan: add support for YUGA CLM920-NC5 PID 0x9625
  e1000: fix disabling already-disabled warning
  macvlan: Fix one possible double free
  xfs: quota: check result of register_shrinker()
  xfs: quota: fix missed destroy of qi_tree_lock
  IB/ipoib: Fix race condition in neigh creation
  IB/mlx4: Fix mlx4_ib_alloc_mr error flow
  Input: xen-kbdfront - do not advertise multi-touch pressure support
  ip6_tunnel: allow ip6gre dev mtu to be set below 1280
  btrfs: Fix flush bio leak
  s390/dasd: fix wrongly assigned configuration data
  afs: Fix missing error handling in afs_write_end()
  genirq: Guard handle_bad_irq log messages
  IB/mlx5: Fix mlx5_ib_alloc_mr error flow
  led: core: Fix brightness setting when setting delay_off=0
  perf/x86/intel: Plug memory leak in intel_pmu_init()
  bnx2x: Improve reliability in case of nested PCI errors
  tg3: Enable PHY reset in MTU change path for 5720
  tg3: Add workaround to restrict 5762 MRRS to 2048
  tipc: fix tipc_mon_delete() oops in tipc_enable_bearer() error path
  tipc: error path leak fixes in tipc_enable_bearer()
  netfilter: nf_tables: fix potential NULL-ptr deref in nf_tables_dump_obj_done()
  crypto: inside-secure - fix request allocations in invalidation path
  crypto: inside-secure - free requests even if their handling failed
  crypto: inside-secure - per request invalidation
  arm64: dts: renesas: ulcb: Remove renesas, no-ether-link property
  lib/mpi: Fix umul_ppmm() for MIPS64r6
  crypto: af_alg - Fix race around ctx->rcvused by making it atomic_t
  ARM: dts: ls1021a: fix incorrect clock references
  RDMA/vmw_pvrdma: Call ib_umem_release on destroy QP path
  i915: Reject CCS modifiers for pipe C on Geminilake
  netfilter: uapi: correct UNTRACKED conntrack state bit number
  scsi: storvsc: Fix scsi_cmd error assignments in storvsc_handle_error
  netfilter: nf_tables: fix chain filter in nf_tables_dump_rules()
  xen/balloon: Mark unallocated host memory as UNUSABLE
  ASoC: rsnd: fixup ADG register mask
  net/mlx5: Stay in polling mode when command EQ destroy fails
  net/mlx5: Cleanup IRQs in case of unload failure
  net/mlx5e: Fix ETS BW check
  net: stmmac: Fix bad RX timestamp extraction
  net: stmmac: Fix TX timestamp calculation
  ip6_tunnel: get the min mtu properly in ip6_tnl_xmit
  ip6_gre: remove the incorrect mtu limit for ipgre tap
  ip_gre: remove the incorrect mtu limit for ipgre tap
  vxlan: update skb dst pmtu on tx path
  net: arc_emac: fix arc_emac_rx() error paths
  net: mediatek: setup proper state for disabled GMAC on the default
  x86-64/Xen: eliminate W+X mappings
  staging: ion: Fix ion_cma_heap allocations
  cgroup: Fix deadlock in cpu hotplug path
  ASoC: nau8825: fix issue that pop noise when start capture
  spi: atmel: fixed spin_lock usage inside atmel_spi_remove
  mac80211_hwsim: Fix a possible sleep-in-atomic bug in hwsim_get_radio_nl
  x86/stacktrace: Make zombie stack traces reliable
  xfrm: Reinject transport-mode packets through tasklet
  drm/nouveau/pci: do a msi rearm on init
  net: phy: xgene: disable clk on error paths
  sget(): handle failures of register_shrinker()
  sctp: fix the issue that a __u16 variable may overflow in sctp_ulpq_renege
  x86/asm: Allow again using asm.h when building for the 'bpf' clang target
  ARM: 8731/1: Fix csum_partial_copy_from_user() stack mismatch
  parisc: Reduce thread stack to 16 kb
  ipv6: icmp6: Allow icmp messages to be looped back
  mtd: nand: brcmnand: Zero bitflip is not an error
  mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM
  net: usb: qmi_wwan: add Telit ME910 PID 0x1101 support
  net: aquantia: Fix hardware DMA stream overload on large MRRS
  net: aquantia: Fix actual speed capabilities reporting
  nvme: check hw sectors before setting chunk sectors
  nvme-fc: remove double put reference if admin connect fails
  phy: cpcap-usb: Fix platform_get_irq_byname's error checking.
  dmaengine: fsl-edma: disable clks on all error paths
  scsi: aacraid: Fix I/O drop during reset
  mm/frame_vector.c: release a semaphore in 'get_vaddr_frames()'
  exec: avoid gcc-8 warning for get_task_comm
  hrtimer: Ensure POSIX compliance (relative CLOCK_REALTIME hrtimers)

Conflicts:
	drivers/staging/android/ion/Kconfig
	drivers/staging/android/ion/ion_cma_heap.c

Change-Id: I58485dd9ac8092a184c42a8e125e44523221e3ea
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-03-05 09:44:16 -08:00
James Hogan
22d5e20c6a lib/mpi: Fix umul_ppmm() for MIPS64r6 
[ Upstream commit bbc25bee37d2b32cf3a1fab9195b6da3a185614a ]

Current MIPS64r6 toolchains aren't able to generate efficient
DMULU/DMUHU based code for the C implementation of umul_ppmm(), which
performs an unsigned 64 x 64 bit multiply and returns the upper and
lower 64-bit halves of the 128-bit result. Instead it widens the 64-bit
inputs to 128-bits and emits a __multi3 intrinsic call to perform a 128
x 128 multiply. This is both inefficient, and it results in a link error
since we don't include __multi3 in MIPS linux.

For example commit 90a53e4432b1 ("cfg80211: implement regdb signature
checking") merged in v4.15-rc1 recently broke the 64r6_defconfig and
64r6el_defconfig builds by indirectly selecting MPILIB. The same build
errors can be reproduced on older kernels by enabling e.g. CRYPTO_RSA:

lib/mpi/generic_mpih-mul1.o: In function `mpihelp_mul_1':
lib/mpi/generic_mpih-mul1.c:50: undefined reference to `__multi3'
lib/mpi/generic_mpih-mul2.o: In function `mpihelp_addmul_1':
lib/mpi/generic_mpih-mul2.c:49: undefined reference to `__multi3'
lib/mpi/generic_mpih-mul3.o: In function `mpihelp_submul_1':
lib/mpi/generic_mpih-mul3.c:49: undefined reference to `__multi3'
lib/mpi/mpih-div.o In function `mpihelp_divrem':
lib/mpi/mpih-div.c:205: undefined reference to `__multi3'
lib/mpi/mpih-div.c:142: undefined reference to `__multi3'

Therefore add an efficient MIPS64r6 implementation of umul_ppmm() using
inline assembly and the DMULU/DMUHU instructions, to prevent __multi3
calls being emitted.

Fixes: 7fd08ca58ae6 ("MIPS: Add build support for the MIPS R6 ISA")
Signed-off-by: James Hogan <jhogan@kernel.org>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: linux-mips@linux-mips.org
Cc: linux-crypto@vger.kernel.org
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-03-03 10:24:29 +01:00
Isaac J. Manjarres
9636a4ea18 Merge remote-tracking branch 'remotes/origin/tmp-af3b8e6' into msm-4.14 
* remotes/origin/tmp-af3b8e6:
  Linux 4.14.22
  vmalloc: fix __GFP_HIGHMEM usage for vmalloc_32 on 32b systems
  mei: me: add cannon point device ids for 4th device
  mei: me: add cannon point device ids
  crypto: s5p-sss - Fix kernel Oops in AES-ECB mode
  drm/i915: fix intel_backlight_device_register declaration
  crypto: talitos - fix Kernel Oops on hashing an empty file
  hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close
  powerpc/perf/imc: Fix nest-imc cpuhotplug callback failure
  PCI: rcar: Fix use-after-free in probe error path
  xen: XEN_ACPI_PROCESSOR is Dom0-only
  platform/x86: dell-laptop: Fix keyboard max lighting for Dell Latitude E6410
  x86/mm/kmmio: Fix mmiotrace for page unaligned addresses
  mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep
  usb: dwc3: of-simple: fix missing clk_disable_unprepare
  usb: dwc3: gadget: Wait longer for controller to end command processing
  dmaengine: jz4740: disable/unprepare clk if probe fails
  drm/vc4: Release fence after signalling
  ASoC: rsnd: ssi: fix race condition in rsnd_ssi_pointer_update
  drm/armada: fix leak of crtc structure
  xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies.
  IB/mlx4: Fix RSS hash fields restrictions
  spi: sun4i: disable clocks in the remove function
  ASoC: rockchip: disable clock on error
  staging: ccree: Uninitialized return in ssi_ahash_import()
  clk: fix a panic error caused by accessing NULL pointer
  netfilter: xt_bpf: add overflow checks
  xfrm: Fix xfrm_input() to verify state is valid when (encap_type < 0)
  dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved
  dmaengine: ioat: Fix error handling path
  scsi: bfa: fix type conversion warning
  scsi: bfa: fix access to bfad_im_port_s
  scsi: lpfc: Use after free in lpfc_rq_buf_free()
  gianfar: Disable EEE autoneg by default
  509: fix printing uninitialized stack memory when OID is empty
  net: dsa: mv88e6xxx: Unregister MDIO bus on error path
  net: dsa: mv88e6xxx: Fix interrupt masking on removal
  net: ethernet: arc: fix error handling in emac_rockchip_probe
  virtio_net: fix return value check in receive_mergeable()
  brcmfmac: Avoid build error with make W=1
  btrfs: Fix possible off-by-one in btrfs_search_path_in_tree
  Btrfs: disable FUA if mounted with nobarrier
  btrfs: Fix quota reservation leak on preallocated files
  locking/lockdep: Fix possible NULL deref
  net: qualcomm: rmnet: Fix leak on transmit failure
  KVM: VMX: fix page leak in hardware_setup()
  VSOCK: fix outdated sk_state value in hvs_release()
  net_sched: red: Avoid illegal values
  net_sched: red: Avoid devision by zero
  gianfar: fix a flooded alignment reports because of padding issue.
  nfp: fix port stats for mac representors
  ARM: dts: Fix elm interrupt compiler warning
  s390/dasd: prevent prefix I/O error
  s390/virtio: add BSD license to virtio-ccw
  PM / runtime: Fix handling of suppliers with disabled runtime PM
  powerpc/perf: Fix oops when grouping different pmu events
  m68k: add missing SOFTIRQENTRY_TEXT linker section
  ipvlan: Add the skb->mark as flow4's member to lookup route
  bnxt_en: Need to unconditionally shut down RoCE in bnxt_shutdown
  scripts/kernel-doc: Don't fail with status != 0 if error encountered with -none
  iio: fix kernel-doc build errors
  iio: proximity: sx9500: Assign interrupt from GpioIo()
  md/raid1/10: add missed blk plug
  phylink: ensure we take the link down when phylink_stop() is called
  sfp: fix RX_LOS signal handling
  sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune
  md/raid5: correct degraded calculation in raid5_error
  IB/core: Init subsys if compiled to vmlinuz-core
  RDMA/cma: Make sure that PSN is not over max allowed
  i40iw: Correct ARP index mask
  i40iw: Do not free sqbuf when event is I40IW_TIMER_TYPE_CLOSE
  i40iw: Allocate a sdbuf per CQP WQE
  KVM: arm/arm64: Fix spinlock acquisition in vgic_set_owner
  meson-gx-socinfo: Fix package id parsing
  IB/hfi1: Initialize bth1 in 16B rc ack builder
  pinctrl: sunxi: Fix A64 UART mux value
  pinctrl: sunxi: Fix A80 interrupt pin bank
  gpio: davinci: Assign first bank regs for unbanked case
  gpio: 74x164: Fix crash during .remove()
  net: mvpp2: allocate zeroed tx descriptors
  media: ov13858: Select V4L2_FWNODE
  media: s5k6aa: describe some function parameters
  trace/xdp: fix compile warning: 'struct bpf_map' declared inside parameter list
  kvm: arm: don't treat unavailable HYP mode as an error
  pinctrl: denverton: Fix UART2 RTS pin mode
  perf test: Fix test 21 for s390x
  perf bench numa: Fixup discontiguous/sparse numa nodes
  perf top: Fix window dimensions change handling
  perf: Fix header.size for namespace events
  perf test shell: Fix check open filename arg using 'perf trace' on s390x
  perf annotate: Do not truncate instruction names at 6 chars
  perf help: Fix a bug during strstart() conversion
  perf record: Fix -c/-F options for cpu event aliases
  ARM: dts: am437x-cm-t43: Correct the dmas property of spi0
  ARM: dts: am4372: Correct the interrupts_properties of McASP
  ARM: dts: logicpd-somlv: Fix wl127x pinmux
  ARM: dts: logicpd-som-lv: Fix gpmc addresses for NAND and enet
  ARM: dts: Fix omap4 hang with GPS connected to USB by using wakeupgen
  ARM: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function
  ARM: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context
  serdev: fix receive_buf return value when no callback
  usb: build drivers/usb/common/ when USB_SUPPORT is set
  usbip: keep usbip_device sockfd state in sync with tcp_socket
  staging: iio: ad5933: switch buffer mode to software
  staging: iio: adc: ad7192: fix external frequency setting
  staging: fsl-mc: fix build testing on x86
  binder: replace "%p" with "%pK"
  binder: check for binder_thread allocation failure in binder_poll()
  staging: android: ashmem: Fix a race condition in pin ioctls
  ANDROID: binder: synchronize_rcu() when using POLLFREE.
  ANDROID: binder: remove WARN() for redundant txn error
  dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock
  arm64: dts: add #cooling-cells to CPU nodes
  ARM: 8743/1: bL_switcher: add MODULE_LICENSE tag
  video: fbdev/mmp: add MODULE_LICENSE
  ASoC: ux500: add MODULE_LICENSE tag
  net_sched: gen_estimator: fix lockdep splat
  net: avoid skb_warn_bad_offload on IS_ERR
  rds: tcp: atomically purge entries from rds_tcp_conn_list during netns delete
  rds: tcp: correctly sequence cleanup on netns deletion.
  netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert
  netfilter: xt_cgroup: initialize info->priv in cgroup_mt_check_v1()
  netfilter: on sockopt() acquire sock lock only in the required scope
  netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in clusterip_tg_check()
  netfilter: x_tables: avoid out-of-bounds reads in xt_request_find_{match|target}
  netfilter: x_tables: fix int overflow in xt_alloc_table_info()
  kcov: detect double association with a single task
  KVM: x86: fix escape of guest dr6 to the host
  blk_rq_map_user_iov: fix error override
  staging: android: ion: Switch from WARN to pr_warn
  staging: android: ion: Add __GFP_NOWARN for system contig heap
  crypto: x86/twofish-3way - Fix %rbp usage
  media: pvrusb2: properly check endpoint types
  selinux: skip bounded transition processing if the policy isn't loaded
  selinux: ensure the context is NUL terminated in security_context_to_sid_core()
  ptr_ring: try vmalloc() when kmalloc() fails
  ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE
  ALSA: bcd2000: Add a sanity check for invalid EPs
  ALSA: caiaq: Add a sanity check for invalid EPs
  ALSA: line6: Add a sanity check for invalid EPs
  drm: Require __GFP_NOFAIL for the legacy drm_modeset_lock_all
  dnotify: Handle errors from fsnotify_add_mark_locked() in fcntl_dirnotify()
  blktrace: fix unlocked registration of tracepoints
  sctp: set frag_point in sctp_setsockopt_maxseg correctly
  xfrm: check id proto in validate_tmpl()
  xfrm: Fix stack-out-of-bounds read on socket policy lookup.
  RDMA/netlink: Fix general protection fault
  KVM/x86: Check input paging mode when cs.l is set
  mm,vmscan: Make unregister_shrinker() no-op if register_shrinker() failed.
  xfrm: skip policies marked as dead while rehashing
  xfrm: fix rcu usage in xfrm_get_type_offload
  xfrm: don't call xfrm_policy_cache_flush while holding spinlock
  esp: Fix GRO when the headers not fully in the linear part of the skb.
  mac80211_hwsim: validate number of different channels
  cfg80211: check dev_set_name() return value
  bpf: mark dst unknown on inconsistent {s, u}bounds adjustments
  kcm: Only allow TCP sockets to be attached to a KCM mux
  kcm: Check if sk_user_data already set in kcm_attach
  vhost: use mutex_lock_nested() in vhost_dev_lock_vqs()
  usb: core: Add a helper function to check the validity of EP type in URB
  ANDROID: sdcardfs: Hold i_mutex for i_size_write
  FROMGIT: crypto: speck - add test vectors for Speck64-XTS
  FROMGIT: crypto: speck - add test vectors for Speck128-XTS
  FROMGIT: crypto: arm/speck - add NEON-accelerated implementation of Speck-XTS
  FROMGIT: crypto: speck - export common helpers
  FROMGIT: crypto: speck - add support for the Speck block cipher
  f2fs: updates on v4.16-rc1

Conflicts:
	drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c

Change-Id: I420172cd4438ce010645ceb00a71c4e3f03596d8
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-02-26 10:10:30 -08:00
Eric Biggers
f2f12ea19f 509: fix printing uninitialized stack memory when OID is empty 
[ Upstream commit 8dfd2f22d3bf3ab7714f7495ad5d897b8845e8c1 ]

Callers of sprint_oid() do not check its return value before printing
the result.  In the case where the OID is zero-length, -EBADMSG was
being returned without anything being written to the buffer, resulting
in uninitialized stack memory being printed.  Fix this by writing
"(bad)" to the buffer in the cases where -EBADMSG is returned.

Fixes: 4f73175d0375 ("X.509: Add utility functions to render OIDs as strings")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-02-25 11:08:01 +01:00
Isaac J. Manjarres
2c7009015c Merge remote-tracking branch 'remotes/origin/tmp-474d3c4' into msm-4.14 
* remotes/origin/tmp-474d3c4:
  Linux 4.14.21
  ovl: hash directory inodes for fsnotify
  ASoC: acpi: fix machine driver selection based on quirk
  mmc: sdhci-of-esdhc: fix the mmc error after sleep on ls1046ardb
  mmc: sdhci-of-esdhc: fix eMMC couldn't work after kexec
  mmc: sdhci-of-esdhc: disable SD clock for clock value 0
  media: r820t: fix r820t_write_reg for KASAN
  ARM: dts: Delete bogus reference to the charlcd
  arm: dts: mt2701: Add reset-cells
  arm: dts: mt7623: Update ethsys binding
  ARM: dts: s5pv210: add interrupt-parent for ohci
  arm64: dts: msm8916: Add missing #phy-cells
  ARM: pxa/tosa-bt: add MODULE_LICENSE tag
  ARM: dts: exynos: fix RTC interrupt for exynos5410
  Bluetooth: BT_HCIUART now depends on SERIAL_DEV_BUS
  scsi: core: check for device state in __scsi_remove_target()
  x86/mm, mm/hwpoison: Don't unconditionally unmap kernel 1:1 pages
  usb: Move USB_UHCI_BIG_ENDIAN_* out of USB_SUPPORT
  mvpp2: fix multicast address filter
  ALSA: seq: Fix racy pool initializations
  ALSA: usb: add more device quirks for USB DSD devices
  ALSA: usb-audio: add implicit fb quirk for Behringer UFX1204
  ALSA: hda/realtek: PCI quirk for Fujitsu U7x7
  ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform
  ALSA: hda/realtek - Add headset mode support for Dell laptop
  ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute
  ALSA: hda - Fix headset mic detection problem for two Dell machines
  mtd: nand: vf610: set correct ooblayout
  9p/trans_virtio: discard zero-length reply
  Btrfs: fix unexpected -EEXIST when creating new inode
  Btrfs: fix use-after-free on root->orphan_block_rsv
  Btrfs: fix btrfs_evict_inode to handle abnormal inodes correctly
  Btrfs: fix extent state leak from tree log
  Btrfs: fix crash due to not cleaning up tree log block's dirty bits
  Btrfs: fix deadlock in run_delalloc_nocow
  dm: correctly handle chained bios in dec_pending()
  iscsi-target: make sure to wake up sleeping login worker
  target/iscsi: avoid NULL dereference in CHAP auth error path
  blk-wbt: account flush requests correctly
  xprtrdma: Fix BUG after a device removal
  xprtrdma: Fix calculation of ri_max_send_sges
  drm/qxl: reapply cursor after resetting primary
  qxl: alloc & use shadow for dumb buffers
  arm64: proc: Set PTE_NG for table entries to avoid traversing them twice
  rtlwifi: rtl8821ae: Fix connection lost problem correctly
  mpls, nospec: Sanitize array index in mpls_label_ok()
  tracing: Fix parsing of globs with a wildcard at the beginning
  seq_file: fix incomplete reset on read from zero offset
  xenbus: track caller request id
  xen: Fix {set,clear}_foreign_p2m_mapping on autotranslating guests
  rbd: whitelist RBD_FEATURE_OPERATIONS feature bit
  console/dummy: leave .con_font_get set to NULL
  video: fbdev: atmel_lcdfb: fix display-timings lookup
  PCI: keystone: Fix interrupt-controller-node lookup
  PCI: iproc: Fix NULL pointer dereference for BCMA
  PCI: Disable MSI for HiSilicon Hip06/Hip07 only in Root Port mode
  MIPS: Fix incorrect mem=X@Y handling
  MIPS: Fix typo BIG_ENDIAN to CPU_BIG_ENDIAN
  mm: Fix memory size alignment in devm_memremap_pages_release()
  mm: hide a #warning for COMPILE_TEST
  ext4: correct documentation for grpid mount option
  ext4: save error to disk in __ext4_grp_locked_error()
  ext4: fix a race in the ext4 shutdown path
  jbd2: fix sphinx kernel-doc build warnings
  Revert "apple-gmux: lock iGP IO to protect from vgaarb changes"
  mlx5: fix mlx5_get_vector_affinity to start from completion vector 0
  Revert "mmc: meson-gx: include tx phase in the tuning process"
  mmc: bcm2835: Don't overwrite max frequency unconditionally
  mmc: sdhci: Implement an SDHCI-specific bounce buffer
  mbcache: initialize entry->e_referenced in mb_cache_entry_create()
  rtc-opal: Fix handling of firmware error codes, prevent busy loops
  drm/radeon: adjust tested variable
  drm/radeon: Add dpm quirk for Jet PRO (v2)
  arm64: Add missing Falkor part number for branch predictor hardening
  drm/ast: Load lut in crtc_commit
  drm/amd/powerplay: Fix smu_table_entry.handle type
  drm/qxl: unref cursor bo when finished with it
  drm/ttm: Fix 'buf' pointer update in ttm_bo_vm_access_kmap() (v2)
  drm/ttm: Don't add swapped BOs to swap-LRU list
  x86/entry/64: Fix CR3 restore in paranoid_exit()
  x86/cpu: Change type of x86_cache_size variable to unsigned int
  x86/spectre: Fix an error message
  x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping
  selftests/x86/mpx: Fix incorrect bounds with old _sigfault
  x86/mm: Rename flush_tlb_single() and flush_tlb_one() to __flush_tlb_one_[user|kernel]()
  kmemcheck: rip it out for real
  kmemcheck: rip it out
  kmemcheck: remove whats left of NOTRACK flags
  kmemcheck: stop using GFP_NOTRACK and SLAB_NOTRACK
  kmemcheck: remove annotations
  x86/speculation: Add <asm/msr-index.h> dependency
  nospec: Move array_index_nospec() parameter checking into separate macro
  x86/speculation: Fix up array_index_nospec_mask() asm constraint
  x86/debug: Use UD2 for WARN()
  x86/debug, objtool: Annotate WARN()-related UD2 as reachable
  objtool: Fix segfault in ignore_unreachable_insn()
  selftests/x86: Disable tests requiring 32-bit support on pure 64-bit systems
  selftests/x86: Do not rely on "int $0x80" in single_step_syscall.c
  selftests/x86: Do not rely on "int $0x80" in test_mremap_vdso.c
  selftests/x86/pkeys: Remove unused functions
  selftests/x86: Clean up and document sscanf() usage
  selftests/x86: Fix vDSO selftest segfault for vsyscall=none
  x86/entry/64: Remove the unused 'icebp' macro
  x86/entry/64: Fix paranoid_entry() frame pointer warning
  x86/entry/64: Indent PUSH_AND_CLEAR_REGS and POP_REGS properly
  x86/entry/64: Get rid of the ALLOC_PT_GPREGS_ON_STACK and SAVE_AND_CLEAR_REGS macros
  x86/entry/64: Use PUSH_AND_CLEAN_REGS in more cases
  x86/entry/64: Introduce the PUSH_AND_CLEAN_REGS macro
  x86/entry/64: Interleave XOR register clearing with PUSH instructions
  x86/entry/64: Merge the POP_C_REGS and POP_EXTRA_REGS macros into a single POP_REGS macro
  x86/entry/64: Merge SAVE_C_REGS and SAVE_EXTRA_REGS, remove unused extensions
  x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface
  PM: cpuidle: Fix cpuidle_poll_state_init() prototype
  PM / runtime: Update links_count also if !CONFIG_SRCU
  x86/speculation: Clean up various Spectre related details
  KVM/nVMX: Set the CPU_BASED_USE_MSR_BITMAPS if we have a valid L02 MSR bitmap
  X86/nVMX: Properly set spec_ctrl and pred_cmd before merging MSRs
  KVM/x86: Reduce retpoline performance impact in slot_handle_level_range(), by always inlining iterator helper methods
  Revert "x86/speculation: Simplify indirect_branch_prediction_barrier()"
  x86/speculation: Correct Speculation Control microcode blacklist again
  x86/speculation: Update Speculation Control microcode blacklist
  x86/mm/pti: Fix PTI comment in entry_SYSCALL_64()
  powerpc/mm/radix: Split linear mapping on hot-unplug
  crypto: sun4i_ss_prng - convert lock to _bh in sun4i_ss_prng_generate
  crypto: sun4i_ss_prng - fix return value of sun4i_ss_prng_generate
  compiler-gcc.h: __nostackprotector needs gcc-4.4 and up
  compiler-gcc.h: Introduce __optimize function attribute
  x86/entry/64/compat: Clear registers for compat syscalls, to reduce speculation attack surface
  x86/entry/64: Clear extra registers beyond syscall arguments, to reduce speculation attack surface
  x86: PM: Make APM idle driver initialize polling state
  x86/xen: init %gs very early to avoid page faults with stack protector
  x86/kexec: Make kexec (mostly) work in 5-level paging mode
  x86/gpu: add CFL to early quirks
  drm/i915/kbl: Change a KBL pci id to GT2 from GT1.5
  drm/i915: add GT number to intel_device_info
  arm: spear13xx: Fix spics gpio controller's warning
  arm: spear13xx: Fix dmas cells
  arm: spear600: Add missing interrupt-parent of rtc
  arm: dts: mt7623: fix card detection issue on bananapi-r2
  ARM: dts: nomadik: add interrupt-parent for clcd
  ARM: dts: STi: Add gpio polarity for "hdmi,hpd-gpio" property
  ARM: lpc3250: fix uda1380 gpio numbers
  arm64: dts: msm8916: Correct ipc references for smsm
  s390: fix handling of -1 in set{,fs}[gu]id16 syscalls
  dma-buf: fix reservation_object_wait_timeout_rcu once more v2
  powerpc: Fix DABR match on hash based systems
  powerpc/xive: Use hw CPU ids when configuring the CPU queues
  powerpc/mm: Flush radix process translations when setting MMU type
  powerpc/numa: Invalidate numa_cpu_lookup_table on cpu remove
  powerpc/radix: Remove trace_tlbie call from radix__flush_tlb_all
  ocfs2: try a blocking lock before return AOP_TRUNCATED_PAGE
  mwifiex: resolve reset vs. remove()/shutdown() deadlocks
  PM / devfreq: Propagate error from devfreq_add_device()
  swiotlb: suppress warning when __GFP_NOWARN is set
  cpufreq: powernv: Dont assume distinct pstate values for nominal and pmin
  RDMA/rxe: Fix rxe_qp_cleanup()
  RDMA/rxe: Fix a race condition in rxe_requester()
  RDMA/rxe: Fix a race condition related to the QP error state
  kselftest: fix OOM in memory compaction test
  selftests: seccomp: fix compile error seccomp_bpf
  IB/core: Avoid a potential OOPs for an unused optional parameter
  IB/core: Fix ib_wc structure size to remain in 64 bytes boundary
  IB/core: Fix two kernel warnings triggered by rxe registration
  IB/mlx4: Fix incorrectly releasing steerable UD QPs when have only ETH ports
  IB/qib: Fix comparison error with qperf compare/swap test
  IB/umad: Fix use of unprotected device pointer
  scsi: smartpqi: allow static build ("built-in")
  tracing: Prevent PROFILE_ALL_BRANCHES when FORTIFY_SOURCE=y

Change-Id: I351a603ea607d9c158727d60c8915981a555044f
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-02-23 15:37:55 -08:00
Levin, Alexander (Sasha Levin)
f369f14861 kmemcheck: rip it out 
commit 4675ff05de2d76d167336b368bd07f3fef6ed5a6 upstream.

Fix up makefiles, remove references, and git rm kmemcheck.

Link: http://lkml.kernel.org/r/20171007030159.22241-4-alexander.levin@verizon.com
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Vegard Nossum <vegardno@ifi.uio.no>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Tim Hansen <devtimhansen@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-02-22 15:42:24 +01:00
Christian König
37efa60e16 swiotlb: suppress warning when __GFP_NOWARN is set 
commit d0bc0c2a31c95002d37c3cc511ffdcab851b3256 upstream.

TTM tries to allocate coherent memory in chunks of 2MB first to improve
TLB efficiency and falls back to allocating 4K pages if that fails.

Suppress the warning when the 2MB allocations fails since there is a
valid fall back path.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reported-by: Mike Galbraith <efault@gmx.de>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=104082
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-02-22 15:42:15 +01:00
Isaac J. Manjarres
2ba985d87a Merge remote-tracking branch 'remotes/origin/tmp-0a91e84' into msm-4.14 
* remotes/origin/tmp-0a91e84:
  Linux 4.14.20
  scsi: cxlflash: Reset command ioasc
  scsi: lpfc: Fix crash after bad bar setup on driver attachment
  rcu: Export init_rcu_head() and destroy_rcu_head() to GPL modules
  scsi: core: Ensure that the SCSI error handler gets woken up
  ftrace: Remove incorrect setting of glob search field
  devpts: fix error handling in devpts_mntget()
  mn10300/misalignment: Use SIGSEGV SEGV_MAPERR to report a failed user copy
  ovl: take mnt_want_write() for removing impure xattr
  ovl: fix failure to fsync lower dir
  acpi, nfit: fix register dimm error handling
  ACPI: sbshc: remove raw pointer from printk() message
  drm/i915: Avoid PPS HW/SW state mismatch due to rounding
  arm64: dts: marvell: add Ethernet aliases
  objtool: Fix switch-table detection
  btrfs: Handle btrfs_set_extent_delalloc failure in fixup worker
  lib/ubsan: add type mismatch handler for new GCC/Clang
  lib/ubsan.c: s/missaligned/misaligned/
  clocksource/drivers/stm32: Fix kernel panic with multiple timers
  blk-mq: quiesce queue before freeing queue
  pktcdvd: Fix a recently introduced NULL pointer dereference
  pktcdvd: Fix pkt_setup_dev() error path
  pinctrl: sx150x: Add a static gpio/pinctrl pin range mapping
  pinctrl: sx150x: Register pinctrl before adding the gpiochip
  pinctrl: sx150x: Unregister the pinctrl on release
  pinctrl: mcp23s08: fix irq setup order
  pinctrl: intel: Initialize GPIO properly when used through irqchip
  EDAC, octeon: Fix an uninitialized variable warning
  xtensa: fix futex_atomic_cmpxchg_inatomic
  alpha: fix formating of stack content
  alpha: fix reboot on Avanti platform
  alpha: Fix mixed up args in EXC macro in futex operations
  alpha: osf_sys.c: fix put_tv32 regression
  alpha: fix crash if pthread_create races with signal delivery
  signal/sh: Ensure si_signo is initialized in do_divide_error
  signal/openrisc: Fix do_unaligned_access to send the proper signal
  ipmi: use dynamic memory for DMI driver override
  Bluetooth: btusb: Restore QCA Rome suspend/resume fix with a "rewritten" version
  Revert "Bluetooth: btusb: fix QCA Rome suspend/resume"
  Bluetooth: btsdio: Do not bind to non-removable BCM43341
  HID: quirks: Fix keyboard + touchpad on Toshiba Click Mini not working
  pipe: fix off-by-one error when checking buffer limits
  pipe: actually allow root to exceed the pipe buffer limits
  kernel/relay.c: revert "kernel/relay.c: fix potential memory leak"
  kernel/async.c: revert "async: simplify lowest_in_progress()"
  fs/proc/kcore.c: use probe_kernel_read() instead of memcpy()
  media: cxusb, dib0700: ignore XC2028_I2C_FLUSH
  media: ts2020: avoid integer overflows on 32 bit machines
  media: dvb-frontends: fix i2c access helpers for KASAN
  kasan: rework Kconfig settings
  kasan: don't emit builtin calls when sanitization is off
  Btrfs: raid56: iterate raid56 internal bio with bio_for_each_segment_all
  watchdog: imx2_wdt: restore previous timeout after suspend+resume
  ASoC: skl: Fix kernel warning due to zero NHTL entry
  ASoC: rockchip: i2s: fix playback after runtime resume
  KVM: PPC: Book3S PR: Fix broken select due to misspelling
  KVM: arm/arm64: Handle CPU_PM_ENTER_FAILED
  KVM: PPC: Book3S HV: Drop locks before reading guest memory
  KVM: PPC: Book3S HV: Make sure we don't re-enter guest without XIVE loaded
  KVM: nVMX: Fix bug of injecting L2 exception into L1
  KVM: nVMX: Fix races when sending nested PI while dest enters/leaves L2
  arm: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls
  crypto: sha512-mb - initialize pending lengths correctly
  crypto: caam - fix endless loop when DECO acquire fails
  media: v4l2-compat-ioctl32.c: make ctrl_is_pointer work for subdevs
  media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic
  media: v4l2-compat-ioctl32.c: don't copy back the result for certain errors
  media: v4l2-compat-ioctl32.c: drop pr_info for unknown buffer type
  media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32
  media: v4l2-compat-ioctl32.c: fix ctrl_is_pointer
  media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32
  media: v4l2-compat-ioctl32.c: avoid sizeof(type)
  media: v4l2-compat-ioctl32.c: move 'helper' functions to __get/put_v4l2_format32
  media: v4l2-compat-ioctl32.c: fix the indentation
  media: v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUF
  media: v4l2-ioctl.c: don't copy back the result for -ENOTTY
  media: v4l2-ioctl.c: use check_fmt for enum/g/s/try_fmt
  crypto: hash - prevent using keyed hashes without setting key
  crypto: hash - annotate algorithms taking optional key
  crypto: poly1305 - remove ->setkey() method
  crypto: mcryptd - pass through absence of ->setkey()
  crypto: cryptd - pass through absence of ->setkey()
  crypto: hash - introduce crypto_hash_alg_has_setkey()
  ahci: Add Intel Cannon Lake PCH-H PCI ID
  ahci: Add PCI ids for Intel Bay Trail, Cherry Trail and Apollo Lake AHCI
  ahci: Annotate PCI ids for mobile Intel chipsets as such
  kernfs: fix regression in kernfs_fop_write caused by wrong type
  NFS: Fix a race between mmap() and O_DIRECT
  NFS: reject request for id_legacy key without auxdata
  NFS: commit direct writes even if they fail partially
  NFS: Fix nfsstat breakage due to LOOKUPP
  NFS: Add a cond_resched() to nfs_commit_release_pages()
  nfs41: do not return ENOMEM on LAYOUTUNAVAILABLE
  nfs/pnfs: fix nfs_direct_req ref leak when i/o falls back to the mds
  ubifs: free the encrypted symlink target
  ubi: block: Fix locking for idr_alloc/idr_remove
  ubi: fastmap: Erase outdated anchor PEBs during attach
  ubi: Fix race condition between ubi volume creation and udev
  mtd: nand: sunxi: Fix ECC strength choice
  mtd: nand: Fix nand_do_read_oob() return value
  mtd: nand: brcmnand: Disable prefetch by default
  mtd: cfi: convert inline functions to macros
  arm64: Kill PSCI_GET_VERSION as a variant-2 workaround
  arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support
  arm/arm64: smccc: Implement SMCCC v1.1 inline primitive
  arm/arm64: smccc: Make function identifiers an unsigned quantity
  firmware/psci: Expose SMCCC version through psci_ops
  firmware/psci: Expose PSCI conduit
  arm64: KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling
  arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support
  arm/arm64: KVM: Turn kvm_psci_version into a static inline
  arm64: KVM: Make PSCI_VERSION a fast path
  arm/arm64: KVM: Advertise SMCCC v1.1
  arm/arm64: KVM: Implement PSCI 1.0 support
  arm/arm64: KVM: Add smccc accessors to PSCI code
  arm/arm64: KVM: Add PSCI_VERSION helper
  arm/arm64: KVM: Consolidate the PSCI include files
  arm64: KVM: Increment PC after handling an SMC trap
  arm64: Branch predictor hardening for Cavium ThunderX2
  arm64: Implement branch predictor hardening for Falkor
  arm64: Implement branch predictor hardening for affected Cortex-A CPUs
  arm64: cputype: Add missing MIDR values for Cortex-A72 and Cortex-A75
  arm64: entry: Apply BP hardening for suspicious interrupts from EL0
  arm64: entry: Apply BP hardening for high-priority synchronous exceptions
  arm64: KVM: Use per-CPU vector when BP hardening is enabled
  arm64: Move BP hardening to check_and_switch_context
  arm64: Add skeleton to harden the branch predictor against aliasing attacks
  arm64: Move post_ttbr_update_workaround to C code
  drivers/firmware: Expose psci_get_version through psci_ops structure
  arm64: cpufeature: Pass capability structure to ->enable callback
  arm64: Run enable method for errata work arounds on late CPUs
  arm64: cpufeature: __this_cpu_has_cap() shouldn't stop early
  arm64: futex: Mask __user pointers prior to dereference
  arm64: uaccess: Mask __user pointers for __arch_{clear, copy_*}_user
  arm64: uaccess: Don't bother eliding access_ok checks in __{get, put}_user
  arm64: uaccess: Prevent speculative use of the current addr_limit
  arm64: entry: Ensure branch through syscall table is bounded under speculation
  arm64: Use pointer masking to limit uaccess speculation
  arm64: Make USER_DS an inclusive limit
  arm64: Implement array_index_mask_nospec()
  arm64: barrier: Add CSDB macros to control data-value prediction
  arm64: idmap: Use "awx" flags for .idmap.text .pushsection directives
  arm64: entry: Reword comment about post_ttbr_update_workaround
  arm64: Force KPTI to be disabled on Cavium ThunderX
  arm64: kpti: Add ->enable callback to remap swapper using nG mappings
  arm64: mm: Permit transitioning from Global to Non-Global without BBM
  arm64: kpti: Make use of nG dependent on arm64_kernel_unmapped_at_el0()
  arm64: Turn on KPTI only on CPUs that need it
  arm64: cputype: Add MIDR values for Cavium ThunderX2 CPUs
  arm64: kpti: Fix the interaction between ASID switching and software PAN
  arm64: mm: Introduce TTBR_ASID_MASK for getting at the ASID in the TTBR
  arm64: capabilities: Handle duplicate entries for a capability
  arm64: Take into account ID_AA64PFR0_EL1.CSV3
  arm64: Kconfig: Reword UNMAP_KERNEL_AT_EL0 kconfig entry
  arm64: Kconfig: Add CONFIG_UNMAP_KERNEL_AT_EL0
  arm64: use RET instruction for exiting the trampoline
  arm64: kaslr: Put kernel vectors address in separate data page
  arm64: entry: Add fake CPU feature for unmapping the kernel at EL0
  arm64: tls: Avoid unconditional zeroing of tpidrro_el0 for native tasks
  arm64: cpu_errata: Add Kryo to Falkor 1003 errata
  arm64: erratum: Work around Falkor erratum #E1003 in trampoline code
  arm64: entry: Hook up entry trampoline to exception vectors
  arm64: entry: Explicitly pass exception level to kernel_ventry macro
  arm64: mm: Map entry trampoline into trampoline and kernel page tables
  arm64: entry: Add exception trampoline page for exceptions from EL0
  arm64: mm: Invalidate both kernel and user ASIDs when performing TLBI
  arm64: mm: Add arm64_kernel_unmapped_at_el0 helper
  arm64: mm: Allocate ASIDs in pairs
  arm64: mm: Fix and re-enable ARM64_SW_TTBR0_PAN
  arm64: mm: Rename post_ttbr0_update_workaround
  arm64: mm: Remove pre_ttbr0_update_workaround for Falkor erratum #E1003
  arm64: mm: Move ASID from TTBR0 to TTBR1
  arm64: mm: Temporarily disable ARM64_SW_TTBR0_PAN
  arm64: mm: Use non-global mappings for kernel space
  arm64: move TASK_* definitions to <asm/processor.h>
  media: hdpvr: Fix an error handling path in hdpvr_probe()
  media: dvb-usb-v2: lmedm04: move ts2020 attach to dm04_lme2510_tuner
  media: dvb-usb-v2: lmedm04: Improve logic checking of warm start
  dccp: CVE-2017-8824: use-after-free in DCCP code
  drm/i915: Fix deadlock in i830_disable_pipe()
  drm/i915: Redo plane sanitation during readout
  drm/i915: Add .get_hw_state() method for planes
  sched/rt: Up the root domain ref count when passing it around via IPIs
  sched/rt: Use container_of() to get root domain in rto_push_irq_work_func()
  KVM MMU: check pending exception before injecting APF
  arm64: Add software workaround for Falkor erratum 1041
  arm64: Define cputype macros for Falkor CPU
  watchdog: gpio_wdt: set WDOG_HW_RUNNING in gpio_wdt_stop
  sched/wait: Fix add_wait_queue() behavioral change
  dmaengine: dmatest: fix container_of member in dmatest_callback
  cpufreq: mediatek: add mediatek related projects into blacklist
  CIFS: zero sensitive data when freeing
  cifs: Fix autonegotiate security settings mismatch
  cifs: Fix missing put_xid in cifs_file_strict_mmap
  powerpc/pseries: include linux/types.h in asm/hvcall.h
  watchdog: indydog: Add dependency on SGI_HAS_INDYDOG
  ANDROID: Fixup 64/32-bit divide confusion for WALT configs

Conflicts:
	include/trace/events/sched.h
	kernel/sched/sched.h
	lib/ubsan.c
	lib/ubsan.h
	arch/arm64/configs/sdm855_defconfig
	arch/arm64/configs/sdm855-perf_defconfig

Change-Id: I034588046a45f3d8be0615bed40d2ddd334ebd74
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-02-21 16:33:21 -08:00
Andrey Ryabinin
2617e62c2f lib/ubsan: add type mismatch handler for new GCC/Clang 
commit 42440c1f9911b4b7b8ba3dc4e90c1197bc561211 upstream.

UBSAN=y fails to build with new GCC/clang:

    arch/x86/kernel/head64.o: In function `sanitize_boot_params':
    arch/x86/include/asm/bootparam_utils.h:37: undefined reference to `__ubsan_handle_type_mismatch_v1'

because Clang and GCC 8 slightly changed ABI for 'type mismatch' errors.
Compiler now uses new __ubsan_handle_type_mismatch_v1() function with
slightly modified 'struct type_mismatch_data'.

Let's add new 'struct type_mismatch_data_common' which is independent from
compiler's layout of 'struct type_mismatch_data'.  And make
__ubsan_handle_type_mismatch[_v1]() functions transform compiler-dependent
type mismatch data to our internal representation.  This way, we can
support both old and new compilers with minimal amount of change.

Link: http://lkml.kernel.org/r/20180119152853.16806-1-aryabinin@virtuozzo.com
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Reported-by: Sodagudi Prasad <psodagud@codeaurora.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-02-16 20:23:09 +01:00
Andrew Morton
5a5df77710 lib/ubsan.c: s/missaligned/misaligned/ 
commit b8fe1120b4ba342b4f156d24e952d6e686b20298 upstream.

A vist from the spelling fairy.

Cc: David Laight <David.Laight@ACULAB.COM>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-02-16 20:23:09 +01:00
Arnd Bergmann
062cd3463c kasan: rework Kconfig settings 
commit e7c52b84fb18f08ce49b6067ae6285aca79084a8 upstream.

We get a lot of very large stack frames using gcc-7.0.1 with the default
-fsanitize-address-use-after-scope --param asan-stack=1 options, which can
easily cause an overflow of the kernel stack, e.g.

  drivers/gpu/drm/i915/gvt/handlers.c:2434:1: warning: the frame size of 46176 bytes is larger than 3072 bytes
  drivers/net/wireless/ralink/rt2x00/rt2800lib.c:5650:1: warning: the frame size of 23632 bytes is larger than 3072 bytes
  lib/atomic64_test.c:250:1: warning: the frame size of 11200 bytes is larger than 3072 bytes
  drivers/gpu/drm/i915/gvt/handlers.c:2621:1: warning: the frame size of 9208 bytes is larger than 3072 bytes
  drivers/media/dvb-frontends/stv090x.c:3431:1: warning: the frame size of 6816 bytes is larger than 3072 bytes
  fs/fscache/stats.c:287:1: warning: the frame size of 6536 bytes is larger than 3072 bytes

To reduce this risk, -fsanitize-address-use-after-scope is now split out
into a separate CONFIG_KASAN_EXTRA Kconfig option, leading to stack
frames that are smaller than 2 kilobytes most of the time on x86_64.  An
earlier version of this patch also prevented combining KASAN_EXTRA with
KASAN_INLINE, but that is no longer necessary with gcc-7.0.1.

All patches to get the frame size below 2048 bytes with CONFIG_KASAN=y
and CONFIG_KASAN_EXTRA=n have been merged by maintainers now, so we can
bring back that default now.  KASAN_EXTRA=y still causes lots of
warnings but now defaults to !COMPILE_TEST to disable it in
allmodconfig, and it remains disabled in all other defconfigs since it
is a new option.  I arbitrarily raise the warning limit for KASAN_EXTRA
to 3072 to reduce the noise, but an allmodconfig kernel still has around
50 warnings on gcc-7.

I experimented a bit more with smaller stack frames and have another
follow-up series that reduces the warning limit for 64-bit architectures
to 1280 bytes (without CONFIG_KASAN).

With earlier versions of this patch series, I also had patches to address
the warnings we get with KASAN and/or KASAN_EXTRA, using a
"noinline_if_stackbloat" annotation.

That annotation now got replaced with a gcc-8 bugfix (see
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81715) and a workaround for
older compilers, which means that KASAN_EXTRA is now just as bad as
before and will lead to an instant stack overflow in a few extreme
cases.

This reverts parts of commit 3f181b4d8652 ("lib/Kconfig.debug: disable
-Wframe-larger-than warnings with KASAN=y").  Two patches in linux-next
should be merged first to avoid introducing warnings in an allmodconfig
build:
  3cd890dbe2a4 ("media: dvb-frontends: fix i2c access helpers for KASAN")
  16c3ada89cff ("media: r820t: fix r820t_write_reg for KASAN")

Do we really need to backport this?

I think we do: without this patch, enabling KASAN will lead to
unavoidable kernel stack overflow in certain device drivers when built
with gcc-7 or higher on linux-4.10+ or any version that contains a
backport of commit c5caf21ab0cf8.  Most people are probably still on
older compilers, but it will get worse over time as they upgrade their
distros.

The warnings we get on kernels older than this should all be for code
that uses dangerously large stack frames, though most of them do not
cause an actual stack overflow by themselves.The asan-stack option was
added in linux-4.0, and commit 3f181b4d8652 ("lib/Kconfig.debug:
disable -Wframe-larger-than warnings with KASAN=y") effectively turned
off the warning for allmodconfig kernels, so I would like to see this
fix backported to any kernels later than 4.0.

I have done dozens of fixes for individual functions with stack frames
larger than 2048 bytes with asan-stack, and I plan to make sure that
all those fixes make it into the stable kernels as well (most are
already there).

Part of the complication here is that asan-stack (from 4.0) was
originally assumed to always require much larger stacks, but that
turned out to be a combination of multiple gcc bugs that we have now
worked around and fixed, but sanitize-address-use-after-scope (from
v4.10) has a much higher inherent stack usage and also suffers from at
least three other problems that we have analyzed but not yet fixed
upstream, each of them makes the stack usage more severe than it should
be.

Link: http://lkml.kernel.org/r/20171221134744.2295529-1-arnd@arndb.de
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-02-16 20:23:04 +01:00
Dmitry Vyukov
e35bdb81ad kasan: detect invalid frees 
Detect frees of pointers into middle of heap objects.

Change-Id: Ia3660c0ac4d4af89caa072d69fbc54cbcbcc3c19
Link: http://lkml.kernel.org/r/cb569193190356beb018a03bb8d6fbae67e7adbc.1514378558.git.dvyukov@google.com
Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>a
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: b1d5728939ebe01a773a75a72e7161408ec9805e
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
 2018-02-12 05:53:57 -08:00
Dmitry Vyukov
8ea798b106 kasan: detect invalid frees for large objects 
Patch series "kasan: detect invalid frees".

KASAN detects double-frees, but does not detect invalid-frees (when a
pointer into a middle of heap object is passed to free).  We recently had
a very unpleasant case in crypto code which freed an inner object inside
of a heap allocation.  This left unnoticed during free, but totally
corrupted heap and later lead to a bunch of random crashes all over kernel
code.

Detect invalid frees.

This patch (of 5):

Detect frees of pointers into middle of large heap objects.

I dropped const from kasan_kfree_large() because it starts propagating
through a bunch of functions in kasan_report.c, slab/slub nearest_obj(),
all of their local variables, fixup_red_left(), etc.

Change-Id: I37dbb7cf8b8ceeb594e537396222b29bef6a0eea
Link: http://lkml.kernel.org/r/1b45b4fe1d20fc0de1329aab674c1dd973fee723.1514378558.git.dvyukov@google.com
Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>a
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: 47adccce3e8a31d315f47183ab1185862b2fc5d4
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
 2018-02-12 05:53:56 -08:00
Linux Build Service Account
82eaa9584e Merge "Merge remote-tracking branch 'remotes/origin/tmp-faeb94c' into msm-4.14" 2018-02-09 23:30:00 -08:00
Linux Build Service Account
3b3f58815a Merge "Merge remote-tracking branch 'remotes/origin/tmp-c3a2eda' into msm-4.14" 2018-02-08 18:47:10 -08:00
Linux Build Service Account
c8dd3996fe Merge "lib/ubsan: remove returns-nonnull-attribute checks" 2018-02-08 01:28:19 -08:00
Linux Build Service Account
2ee8a3fa72 Merge "lib/ubsan: add type mismatch handler for new GCC/Clang" 2018-02-08 01:28:18 -08:00
Linux Build Service Account
03ad3d9351 Merge "lib/ubsan.c: s/missaligned/misaligned/" 2018-02-08 01:28:17 -08:00
Andrey Ryabinin
6ccc50118f lib/ubsan: remove returns-nonnull-attribute checks 
Similarly to type mismatch checks, new GCC 8.x and Clang also changed for
ABI for returns_nonnull checks.  While we can update our code to conform
the new ABI it's more reasonable to just remove it.  Because it's just
dead code, we don't have any single user of returns_nonnull attribute in
the whole kernel.

And AFAIU the advantage that this attribute could bring would be mitigated
by -fno-delete-null-pointer-checks cflag that we use to build the kernel.
So it's unlikely we will have a lot of returns_nonnull attribute in
future.

So let's just remove the code, it has no use.

Change-Id: I479d6f1355781017abdee33f5adf8fd3fdbe4304
[aryabinin@virtuozzo.com: fix warning]
  Link: http://lkml.kernel.org/r/20180122165711.11510-1-aryabinin@virtuozzo.com
Link: http://lkml.kernel.org/r/20180119152853.16806-2-aryabinin@virtuozzo.com
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Sodagudi Prasad <psodagud@codeaurora.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: bac7a1fff7926fb9891a18fe33650884b0e13e41
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
 2018-02-07 06:44:09 -08:00
Andrey Ryabinin
0eaa11b6be lib/ubsan: add type mismatch handler for new GCC/Clang 
UBSAN=y fails to build with new GCC/clang:

    arch/x86/kernel/head64.o: In function `sanitize_boot_params':
    arch/x86/include/asm/bootparam_utils.h:37: undefined reference to `__ubsan_handle_type_mismatch_v1'

because Clang and GCC 8 slightly changed ABI for 'type mismatch' errors.
Compiler now uses new __ubsan_handle_type_mismatch_v1() function with
slightly modified 'struct type_mismatch_data'.

Let's add new 'struct type_mismatch_data_common' which is independent from
compiler's layout of 'struct type_mismatch_data'.  And make
__ubsan_handle_type_mismatch[_v1]() functions transform compiler-dependent
type mismatch data to our internal representation.  This way, we can
support both old and new compilers with minimal amount of change.

Change-Id: I94df3107b7b4434305f1188aeadfa40fd0e3d072
Link: http://lkml.kernel.org/r/20180119152853.16806-1-aryabinin@virtuozzo.com
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Reported-by: Sodagudi Prasad <psodagud@codeaurora.org>
Cc: <stable@vger.kernel.org>	[4.5+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: 42440c1f9911b4b7b8ba3dc4e90c1197bc561211
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
 2018-02-07 06:42:00 -08:00
Andrew Morton
db124a989c lib/ubsan.c: s/missaligned/misaligned/ 
A vist from the spelling fairy.

Change-Id: I53e7310d4b5cd86f911c054da381834b9b97b75e
Cc: David Laight <David.Laight@ACULAB.COM>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: b8fe1120b4ba342b4f156d24e952d6e686b20298
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
 2018-02-07 06:40:03 -08:00
Linux Build Service Account
68f1f99b1f Merge "defconfig: sdm855: Enable trace & debug features" 2018-02-07 04:28:00 -08:00
Satya Durga Srinivasu Prabhala
30b0583efc sched: Introduce PANIC_ON_SCHED_BUG 
Introduce PANIC_ON_SCHED_BUG to catch issues related to scheduler
like calling sleepable functions inside atomic context etc.

Change-Id: I9f1fe96772b317b17bd0e7423a48023d3cf141c7
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
 2018-02-06 10:52:57 -08:00
Satya Durga Srinivasu Prabhala
fef9f65460 sched/rt: Add RT class changes snapshot 
This snapshot is taken from msm-4.9 as of commit dd4275868d0fdb7
("sched/rt: Prevent leaking kernel address").

Change-Id: Ifb89c7549ef101ccb089c665b7e93b2c8130e849
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
 2018-02-06 10:52:02 -08:00
Isaac J. Manjarres
3d13954930 Merge remote-tracking branch 'remotes/origin/tmp-faeb94c' into msm-4.14 
* remotes/origin/tmp-faeb94c:
  Linux 4.14.17
  x86/efi: Clarify that reset attack mitigation needs appropriate userspace
  Input: synaptics-rmi4 - do not delete interrupt memory too early
  Input: synaptics-rmi4 - unmask F03 interrupts when port is opened
  test_firmware: fix missing unlock on error in config_num_requests_store()
  iio: chemical: ccs811: Fix output of IIO_CONCENTRATION channels
  iio: adc: stm32: fix scan of multiple channels with DMA
  spi: imx: do not access registers while clocks disabled
  serial: imx: Only wakeup via RTSDEN bit if the system has RTS/CTS
  serial: 8250_uniphier: fix error return code in uniphier_uart_probe()
  serial: 8250_of: fix return code when probe function fails to get reset
  mei: me: allow runtime pm for platform with D0i3
  android: binder: use VM_ALLOC to get vm area
  ANDROID: binder: remove waitqueue when thread exits.
  usb/gadget: Fix "high bandwidth" check in usb_gadget_ep_match_desc()
  usb: uas: unconditionally bring back host after reset
  usb: f_fs: Prevent gadget unbind if it is already unbound
  USB: serial: simple: add Motorola Tetra driver
  usbip: list: don't list devices attached to vhci_hcd
  usbip: prevent bind loops on devices attached to vhci_hcd
  USB: serial: io_edgeport: fix possible sleep-in-atomic
  CDC-ACM: apply quirk for card reader
  USB: cdc-acm: Do not log urb submission errors on disconnect
  USB: serial: pl2303: new device id for Chilitag
  usb: option: Add support for FS040U modem
  tty: fix data race between tty_init_dev and flush of buf
  staging: ccree: fix fips event irq handling build
  staging: ccree: NULLify backup_info when unused
  staging: lustre: separate a connection destroy from free struct kib_conn
  KVM: x86: emulate #UD while in guest mode
  drm/vc4: Move IRQ enable to PM path
  staging: rtl8188eu: Fix incorrect response to SIOCGIWESSID
  usb: gadget: don't dereference g until after it has been null checked
  x86/xen: Support early interrupts in xen pv guests
  media: usbtv: add a new usbid
  ARM: dts: NSP: Fix PPI interrupt types
  ARM: dts: NSP: Disable AHCI controller for HR NSP boards
  iwlwifi: fix access to prph when transport is stopped
  iwlwifi: mvm: fix the TX queue hang timeout for MONITOR vif type
  scsi: ufs: ufshcd: fix potential NULL pointer dereference in ufshcd_config_vreg
  scsi: aacraid: Prevent crash in case of free interrupt during scsi EH path
  perf/core: Fix memory leak triggered by perf --namespace
  xfs: Properly retry failed dquot items in case of error during buffer writeback
  xfs: ubsan fixes
  drm/omap: displays: panel-dpi: add backlight dependency
  drm/omap: Fix error handling path in 'omap_dmm_probe()'
  drm/bridge: tc358767: fix 1-lane behavior
  drm/bridge: tc358767: fix AUXDATAn registers access
  drm/bridge: tc358767: fix timing calculations
  drm/bridge: tc358767: fix DP0_MISC register set
  drm/bridge: tc358767: filter out too high modes
  drm/bridge: tc358767: do no fail on hi-res displays
  drm/bridge: Fix lvds-encoder since the panel_bridge rework.
  kmemleak: add scheduling point to kmemleak_scan()
  scripts/faddr2line: extend usage on generic arch
  SUNRPC: Allow connect to return EHOSTUNREACH
  quota: Check for register_shrinker() failure.
  net: ethernet: xilinx: Mark XILINX_LL_TEMAC broken on 64-bit
  drm/amdgpu: don't try to move pinned BOs
  xfs: fortify xfs_alloc_buftarg error handling
  nvme-pci: fix NULL pointer dereference in nvme_free_host_mem()
  Btrfs: incremental send, fix wrong unlink path after renaming file
  bnxt_en: Fix an error handling path in 'bnxt_get_module_eeprom()'
  net: phy: marvell10g: fix the PHY id mask
  net: mvpp2: fix the txq_init error path
  quota: propagate error from __dquot_initialize
  hwmon: (pmbus) Use 64bit math for DIRECT format values
  lockd: fix "list_add double add" caused by legacy signal interface
  race of lockd inetaddr notifiers vs nlmsvc_rqst change
  nfsd: check for use of the closed special stateid
  grace: replace BUG_ON by WARN_ONCE in exit_net hook
  nfsd: Ensure we check stateid validity in the seqid operation checks
  nfsd: CLOSE SHOULD return the invalid special stateid for NFSv4.x (x>0)
  auxdisplay: img-ascii-lcd: Only build on archs that have IOMEM
  xen-netfront: remove warning when unloading module
  i2c: i2c-boardinfo: fix memory leaks on devinfo
  xfs: log recovery should replay deferred ops in order
  xfs: always free inline data before resetting inode fork during ifree
  KVM: Let KVM_SET_SIGNAL_MASK work as advertised
  Btrfs: fix list_add corruption and soft lockups in fsync
  KVM: VMX: Fix rflags cache during vCPU reset
  KVM: X86: Fix softlockup when get the current kvmclock
  reiserfs: remove unneeded i_version bump
  sctp: set sender next_tsn for the old result with ctsn_ack_point plus 1
  sctp: avoid flushing unsent queue when doing asoc reset
  sctp: only allow the asoc reset when the asoc outq is empty
  btrfs: fix deadlock when writing out space cache
  mac80211: fix the update of path metric for RANN frame
  mac80211: use QoS NDP for AP probing
  drm/rockchip: dw-mipi-dsi: fix possible un-balanced runtime PM enable
  openvswitch: fix the incorrect flow action alloc size
  nvme-rdma: don't complete requests before a send work request has completed
  uapi: fix linux/kfd_ioctl.h userspace compilation errors
  drm/amdkfd: Fix SDMA oversubsription handling
  drm/amdkfd: Fix SDMA ring buffer size calculation
  drm/amdgpu: Fix SDMA load/unload sequence on HWS disabled mode
  bcache: check return value of register_shrinker
  rxrpc: Fix service endpoint expiry
  rxrpc: Provide a different lockdep key for call->user_mutex for kernel calls
  rxrpc: The mutex lock returned by rxrpc_accept_call() needs releasing
  s390: fix alloc_pgste check in init_new_context again
  null_blk: fix dev->badblocks leak
  cpufreq: Add Loongson machine dependencies
  ACPI / bus: Leave modalias empty for devices which are not present
  s390/zcrypt: Fix wrong comparison leading to strange load balancing
  s390/topology: fix compile error in file arch/s390/kernel/smp.c
  nvmet-fc: correct ref counting error when deferred rcv used
  nvme-pci: avoid hmb desc array idx out-of-bound when hmmaxd set.
  nvme-pci: disable APST on Samsung SSD 960 EVO + ASUS PRIME B350M-A
  nvme-loop: check if queue is ready in queue_rq
  nvme-fc: check if queue is ready in queue_rq
  nvme-fabrics: introduce init command check for a queue that is not alive
  KVM: nVMX: Fix vmx_check_nested_events() return value in case an event was reinjected to L2
  KVM: x86: ioapic: Preserve read-only values in the redirection table
  KVM: x86: ioapic: Clear Remote IRR when entry is switched to edge-triggered
  KVM: x86: ioapic: Fix level-triggered EOI and IOAPIC reconfigure race
  KVM: x86: fix em_fxstor() sleeping while in atomic
  KVM: nVMX: Fix mmu context after VMLAUNCH/VMRESUME failure
  KVM: X86: Fix operand/address-size during instruction decoding
  KVM: x86: Don't re-execute instruction when not passing CR2 value
  KVM: x86: emulator: Return to user-mode on L1 CPL=0 emulation failure
  KVM: nVMX/nSVM: Don't intercept #UD when running L2
  cpupower : Fix cpupower working when cpu0 is offline
  cpupowerutils: bench - Fix cpu online check
  Btrfs: bail out gracefully rather than BUG_ON
  btrfs: Fix transaction abort during failure in btrfs_rm_dev_item
  drm/vc4: Account for interrupts in flight
  VFS: Handle lazytime in do_mount()
  scsi: aacraid: Fix hang in kdump
  scsi: aacraid: Fix udev inquiry race condition
  ima/policy: fix parsing of fsuuid
  igb: Free IRQs when device is hotplugged
  mtd: nand: denali_pci: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
  gpio: ath79: add missing MODULE_DESCRIPTION/LICENSE
  gpio: iop: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
  power: reset: zx-reboot: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
  HID: wacom: Fix reporting of touch toggle (WACOM_HID_WD_MUTE_DEVICE) events
  HID: wacom: EKR: ensure devres groups at higher indexes are released
  crypto: af_alg - whitelist mask and type
  crypto: sha3-generic - fixes for alignment and big endian operation
  crypto: inside-secure - avoid unmapping DMA memory that was not mapped
  crypto: inside-secure - fix hash when length is a multiple of a block
  crypto: aesni - Fix out-of-bounds access of the AAD buffer in generic-gcm-aesni
  crypto: aesni - Fix out-of-bounds access of the data buffer in generic-gcm-aesni
  crypto: aesni - add wrapper for generic gcm(aes)
  crypto: aesni - Use GCM IV size constant
  crypto: gcm - add GCM IV size constant
  crypto: aesni - fix typo in generic_gcmaes_decrypt
  crypto: aesni - handle zero length dst buffer
  crypto: ecdh - fix typo in KPP dependency of CRYPTO_ECDH
  ALSA: hda - Reduce the suspend time consumption for ALC256
  gpio: Fix kernel stack leak to userspace
  gpio: stmpe: i2c transfer are forbiden in atomic context
  tools/gpio: Fix build error with musl libc
  KVM: x86: Fix CPUID function for word 6 (80000001_ECX)
  loop: fix concurrent lo_open/lo_release
  futex: Fix OWNER_DEAD fixup
  ANDROID: sdcardfs: Protect set_top
  ANDROID: fsnotify: Notify lower fs of open
  Revert "ANDROID: sdcardfs: notify lower file of opens"
  ANDROID: sdcardfs: Use lower getattr times/size
  ANDROID: Remove duplicate security fix

Change-Id: Icd6d668734e40a73e87cce6c5d467f74cff3e5ae
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-02-05 12:40:29 -08:00
Wei Yongjun
aad757b657 test_firmware: fix missing unlock on error in config_num_requests_store() 
commit a5e1923356505e46476c2fb518559b7a4d9d25b1 upstream.

Add the missing unlock before return from function
config_num_requests_store() in the error handling case.

Fixes: c92316bf8e94 ("test_firmware: add batched firmware tests")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-02-03 17:39:24 +01:00
Rohit Vaswani
1572891f31 lib: spinlock: Cause a watchdog bite on spin_dump 
Currently we cause a BUG_ON once a spin_bug is detected, but
that causes a whole lot of processing and the other CPUs would
have proceeded to perform other actions and the state of the system
is moved by the time we can analyze it.
Provide an option to trigger  a watchdog bite instead so that we
can get the traces as close to the issue as possible.

Change-Id: Ic8d692ebd02c6940a3b4e5798463744db20b0026
Signed-off-by: Rohit Vaswani <rvaswani@codeaurora.org>
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
 2018-02-02 18:23:33 -08:00
Isaac J. Manjarres
ba45a7f1d3 Merge remote-tracking branch 'remotes/origin/tmp-c3a2eda' into msm-4.14 
* remotes/origin/tmp-c3a2eda:
  Linux 4.14.16
  nfsd: auth: Fix gid sorting when rootsquash enabled
  cpufreq: governor: Ensure sufficiently large sampling intervals
  bpf, arm64: fix stack_depth tracking in combination with tail calls
  bpf: reject stores into ctx via st and xadd
  bpf: fix 32-bit divide by zero
  bpf: fix divides by zero
  bpf: avoid false sharing of map refcount with max_entries
  bpf: introduce BPF_JIT_ALWAYS_ON config
  hrtimer: Reset hrtimer cpu base proper on CPU hotplug
  x86/mm/64: Fix vmapped stack syncing on very-large-memory 4-level systems
  x86/microcode: Fix again accessing initrd after having been freed
  x86/microcode/intel: Extend BDW late-loading further with LLC size check
  perf/x86/amd/power: Do not load AMD power module on !AMD platforms
  vmxnet3: repair memory leak
  net: ipv4: Make "ip route get" match iif lo rules again.
  tls: reset crypto_info when do_tls_setsockopt_tx fails
  tls: return -EBUSY if crypto_info is already set
  tls: fix sw_ctx leak
  net/tls: Only attach to sockets in ESTABLISHED state
  netlink: reset extack earlier in netlink_rcv_skb
  nfp: use the correct index for link speed table
  net/mlx5e: Fix fixpoint divide exception in mlx5e_am_stats_compare
  netlink: extack needs to be reset each time through loop
  sctp: reinit stream if stream outcnt has been change by sinit in sendmsg
  flow_dissector: properly cap thoff field
  tun: fix a memory leak for tfile->tx_array
  mlxsw: spectrum_router: Don't log an error on missing neighbor
  gso: validate gso_type in GSO handlers
  ip6_gre: init dev->mtu and dev->hard_header_len correctly
  be2net: restore properly promisc mode after queues reconfiguration
  ppp: unlock all_ppp_mutex before registering device
  net/mlx5: Fix get vector affinity helper function
  {net,ib}/mlx5: Don't disable local loopback multicast traffic when needed
  tipc: fix a memory leak in tipc_nl_node_get_link()
  sctp: return error if the asoc has been peeled off in sctp_wait_for_sndbuf
  sctp: do not allow the v4 socket to bind a v4mapped v6 address
  r8169: fix memory corruption on retrieval of hardware statistics.
  pppoe: take ->needed_headroom of lower device into account on xmit
  net: vrf: Add support for sends to local broadcast address
  net/tls: Fix inverted error codes to avoid endless loop
  net: tcp: close sock if net namespace is exiting
  net: qdisc_pkt_len_init() should be more robust
  net: igmp: fix source address check for IGMPv3 reports
  lan78xx: Fix failure in USB Full Speed
  ipv6: ip6_make_skb() needs to clear cork.base.dst
  ipv6: fix udpv6 sendmsg crash caused by too small MTU
  ipv6: Fix getsockopt() for sockets with default IPV6_AUTOFLOWLABEL
  dccp: don't restart ccid2_hc_tx_rto_expire() if sk in closed state
  ipv4: Make neigh lookup keys for loopback/point-to-point devices be INADDR_ANY
  net: Allow neigh contructor functions ability to modify the primary_key
  drm/vc4: Fix NULL pointer dereference in vc4_save_hang_state()
  ARM: net: bpf: clarify tail_call index
  ARM: net: bpf: fix LDX instructions
  ARM: net: bpf: fix register saving
  ARM: net: bpf: correct stack layout documentation
  ARM: net: bpf: move stack documentation
  ARM: net: bpf: fix stack alignment
  ARM: net: bpf: fix tail call jumps
  ARM: net: bpf: avoid 'bx' instruction on non-Thumb capable CPUs
  orangefs: fix deadlock; do not write i_size in read_iter
  KVM: s390: add proper locking for CMMA migration bitmap
  Btrfs: fix stale entries in readdir
  Input: trackpoint - only expose supported controls for Elan, ALPS and NXP
  Input: trackpoint - force 3 buttons if 0 button is reported
  Input: xpad - add support for PDP Xbox One controllers
  Revert "module: Add retpoline tag to VERMAGIC"
  xfrm: Fix a race in the xdst pcpu cache.
  netfilter: xt_osf: Add missing permission checks
  netfilter: nfnetlink_cthelper: Add missing permission checks
  mm, page_alloc: fix potential false positive in __zone_watermark_ok
  orangefs: initialize op on loop restart in orangefs_devreq_read
  orangefs: use list_for_each_entry_safe in purge_waiting_ops
  ANDROID: Revert "fs: unexport vfs_read and vfs_write"
  ANDROID: sdcardfs: port to 4.14
  ANDROID: fs: Export vfs_rmdir2
  ANDROID: mm: Export do_munmap
  ANDROID: fs: Export d_absolute_path
  ANDROID: fs: Export free_fs_struct and set_fs_pwd
  ANDROID: export security_path_chown
  ANDROID: sdcardfs: Add default_normal option
  ANDROID: sdcardfs: notify lower file of opens
  ANDROID: Sdcardfs: Move gid derivation under flag
  ANDROID: sdcardfs: override credential for ioctl to lower fs
  ANDROID: sdcardfs: Remove unnecessary lock
  ANDROID: sdcardfs: use mount_nodev and fix a issue in sdcardfs_kill_sb
  ANDROID: sdcardfs: remove dead function open_flags_to_access_mode()
  ANDROID: sdcardfs: d_splice_alias can return error values
  ANDROID: sdcardfs: Check for NULL in revalidate
  ANDROID: sdcardfs: Move top to its own struct
  ANDROID: sdcardfs: fix sdcardfs_destroy_inode for the inode RCU approach
  ANDROID: sdcardfs: Don't iput if we didn't igrab
  ANDROID: sdcardfs: Call lower fs's revalidate
  ANDROID: sdcardfs: Avoid setting GIDs outside of valid ranges
  ANDROID: sdcardfs: Copy meta-data from lower inode
  ANDROID: sdcardfs: Use filesystem specific hash
  ANDROID: sdcardfs: Don't complain in fixup_lower_ownership
  ANDROID: sdcardfs: Don't do d_add for lower fs
  ANDROID: sdcardfs: ->iget fixes
  ANDROID: sdcardfs: Change cache GID value
  ANDROID: sdcardfs: Directly pass lower file for mmap
  ANDROID: sdcardfs: update module info
  ANDROID: sdcardfs: use d_splice_alias
  ANDROID: sdcardfs: add read_iter/write_iter opeations
  ANDROID: sdcardfs: fix ->llseek to update upper and lower offset
  ANDROID: sdcardfs: copy lower inode attributes in ->ioctl
  ANDROID: sdcardfs: remove unnecessary call to do_munmap
  ANDROID: sdcardfs: Fix style issues in macros
  ANDROID: sdcardfs: Use seq_puts over seq_printf
  ANDROID: sdcardfs: Use to kstrout
  ANDROID: sdcardfs: Use pr_[...] instead of printk
  ANDROID: sdcardfs: remove unneeded null check
  ANDROID: sdcardfs: Fix style issues with comments
  ANDROID: sdcardfs: Fix formatting
  ANDROID: sdcardfs: correct order of descriptors
  ANDROID: sdcardfs: Fix gid issue
  ANDROID: sdcardfs: Remove uninformative prints
  ANDROID: sdcardfs: move path_put outside of spinlock
  ANDROID: sdcardfs: Use case insensitive hash function
  ANDROID: sdcardfs: declare MODULE_ALIAS_FS
  ANDROID: sdcardfs: Get the blocksize from the lower fs
  ANDROID: sdcardfs: Use d_invalidate instead of drop_recurisve
  ANDROID: sdcardfs: Switch to internal case insensitive compare
  ANDROID: sdcardfs: Use spin_lock_nested
  ANDROID: sdcardfs: Replace get/put with d_lock
  ANDROID: sdcardfs: rate limit warning print
  ANDROID: sdcardfs: Fix case insensitive lookup
  ANDROID: sdcardfs: support direct-IO (DIO) operations
  ANDROID: sdcardfs: implement vm_ops->page_mkwrite
  ANDROID: sdcardfs: Don't bother deleting freelist
  ANDROID: sdcardfs: Add missing path_put
  ANDROID: sdcardfs: Fix incorrect hash
  ANDROID: sdcardfs: Switch strcasecmp for internal call
  ANDROID: sdcardfs: switch to full_name_hash and qstr
  ANDROID: sdcardfs: Add GID Derivation to sdcardfs
  ANDROID: sdcardfs: Remove redundant operation
  ANDROID: sdcardfs: add support for user permission isolation
  ANDROID: sdcardfs: Refactor configfs interface
  ANDROID: sdcardfs: Allow non-owners to touch
  ANDROID: sdcardfs: eliminate the offset argument to ->direct_IO
  ANDROID: sdcardfs: make it use new .rename i_op
  ANDROID: sdcardfs: Propagate dentry down to inode_change_ok()
  ANDROID: sdcardfs: get rid of 'parent' argument of ->d_compare()
  ANDROID: sdcardfs: add parent pointer into dentry name hash
  ANDROID: sdcardfs: use wrappers to access i_mutex
  ANDROID: sdcardfs: Fix locking issue with permision fix up
  ANDROID: sdcardfs: Switch ->d_inode to d_inode()
  ANDROID: sdcardfs: Change magic value
  ANDROID: sdcardfs: Use per mount permissions
  ANDROID: sdcardfs: Add gid and mask to private mount data
  ANDROID: sdcardfs: User new permission2 functions
  ANDROID: sdcardfs: Move directory unlock before touch
  ANDROID: sdcardfs: fix external storage exporting incorrect uid
  ANDROID: sdcardfs: Added top to sdcardfs_inode_info
  ANDROID: sdcardfs: Switch package list to RCU
  ANDROID: sdcardfs: Fix locking for permission fix up
  ANDROID: sdcardfs: Check for other cases on path lookup
  ANDROID: sdcardfs: override umask on mkdir and create
  ANDROID: sdcardfs: fix itnull.cocci warnings
  ANDROID: sdcardfs: Truncate packages_gid.list on overflow
  ANDROID: sdcardfs: remove unneeded __init and __exit
  ANDROID: sdcardfs: Remove unused code
  ANDROID: sdcardfs: remove effectless config option
  ANDROID: sdcardfs: Add support for d_canonical_path
  ANDROID: sdcardfs: Bring up to date with Android M permissions:
  ANDROID: Changed type-casting in packagelist management
  ANDROID: Port of sdcardfs to 4.4
  ANDROID: xattr: Pass EOPNOTSUPP to permission2
  ANDROID: vfs: Add permission2 for filesystems with per mount permissions
  ANDROID: vfs: Add setattr2 for filesystems with per mount permissions
  ANDROID: vfs: Allow filesystems to access their private mount data
  ANDROID: fuse: Add support for d_canonical_path
  ANDROID: mnt: Add filesystem private data to mount points
  ANDROID: vfs: add d_canonical_path for stacked filesystem support
  ANDROID: Included sdcardfs source code for kernel 3.0
  BACKPORT: thermal/drivers/hisi: Add support for hi3660 SoC
  BACKPORT: thermal/drivers/hisi: Prepare to add support for other hisi platforms
  BACKPORT: thermal/drivers/hisi: Add platform prefix to function name
  BACKPORT: thermal/drivers/hisi: Put platform code together
  BACKPORT: thermal/drivers/hisi: Use round up step value
  BACKPORT: thermal/drivers/hisi: Move the clk setup in the corresponding functions
  BACKPORT: thermal/drivers/hisi: Remove mutex_lock in the code
  BACKPORT: thermal/drivers/hisi: Remove thermal data back pointer
  BACKPORT: thermal/drivers/hisi: Convert long to int
  BACKPORT: thermal/drivers/hisi: Rename and remove unused field
  BACKPORT: thermal/drivers/hisi: Remove costly sensor inspection
  BACKPORT: thermal/drivers/hisi: Fix configuration register setting
  BACKPORT: thermal/drivers/hisi: Encapsulate register writes into helpers
  BACKPORT: thermal/drivers/hisi: Remove pointless lock
  BACKPORT: thermal/drivers/hisi: Remove the multiple sensors support
  ANDROID: Fix script to fetch android kernel config fragments for 4.14

Conflicts:
	fs/namei.c
	fs/namespace.c
	fs/open.c
	fs/pnode.c
	fs/sdcardfs/inode.c
	fs/sdcardfs/lookup.c
	include/linux/fs.h

Change-Id: I10679bc0171d61332f99d43b73820c91ae883336
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-02-02 12:50:09 -08:00
Alexei Starovoitov
6fde36d5ce bpf: introduce BPF_JIT_ALWAYS_ON config 
[ upstream commit 290af86629b25ffd1ed6232c4e9107da031705cb ]

The BPF interpreter has been used as part of the spectre 2 attack CVE-2017-5715.

A quote from goolge project zero blog:
"At this point, it would normally be necessary to locate gadgets in
the host kernel code that can be used to actually leak data by reading
from an attacker-controlled location, shifting and masking the result
appropriately and then using the result of that as offset to an
attacker-controlled address for a load. But piecing gadgets together
and figuring out which ones work in a speculation context seems annoying.
So instead, we decided to use the eBPF interpreter, which is built into
the host kernel - while there is no legitimate way to invoke it from inside
a VM, the presence of the code in the host kernel's text section is sufficient
to make it usable for the attack, just like with ordinary ROP gadgets."

To make attacker job harder introduce BPF_JIT_ALWAYS_ON config
option that removes interpreter from the kernel in favor of JIT-only mode.
So far eBPF JIT is supported by:
x64, arm64, arm32, sparc64, s390, powerpc64, mips64

The start of JITed program is randomized and code page is marked as read-only.
In addition "constant blinding" can be turned on with net.core.bpf_jit_harden

v2->v3:
- move __bpf_prog_ret0 under ifdef (Daniel)

v1->v2:
- fix init order, test_bpf and cBPF (Daniel's feedback)
- fix offloaded bpf (Jakub's feedback)
- add 'return 0' dummy in case something can invoke prog->bpf_func
- retarget bpf tree. For bpf-next the patch would need one extra hunk.
  It will be sent when the trees are merged back to net-next

Considered doing:
  int bpf_jit_enable __read_mostly = BPF_EBPF_JIT_DEFAULT;
but it seems better to land the patch as-is and in bpf-next remove
bpf_jit_enable global variable from all JITs, consolidate in one place
and remove this jit_init() function.

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-01-31 14:03:49 +01:00
Runmin Wang
a35d45d785 Merge remote-tracking branch 'remotes/origin/tmp-dad5c14' into msm-4.14 
* remotes/origin/tmp-dad5c14:
  Linux 4.14.9
  linux/compiler.h: Split into compiler.h and compiler_types.h
  selftests/bpf: add tests for recent bugfixes
  bpf: fix integer overflows
  bpf: don't prune branches when a scalar is replaced with a pointer
  bpf: force strict alignment checks for stack pointers
  bpf: fix missing error return in check_stack_boundary()
  bpf: fix 32-bit ALU op verification
  bpf: fix incorrect tracking of register size truncation
  bpf: fix incorrect sign extension in check_alu_op()
  bpf/verifier: fix bounds calculation on BPF_RSH
  bpf, sparc: fix usage of wrong reg for load_skb_regs after call
  bpf, ppc64: do not reload skb pointers in non-skb context
  bpf, s390x: do not reload skb pointers in non-skb context
  bpf: fix corruption on concurrent perf_event_output calls
  bpf: fix branch pruning logic
  mm/sparsemem: Fix ARM64 boot crash when CONFIG_SPARSEMEM_EXTREME=y
  platform/x86: asus-wireless: send an EV_SYN/SYN_REPORT between state changes
  thermal/drivers/hisi: Fix multiple alarm interrupts firing
  thermal/drivers/hisi: Simplify the temperature/step computation
  thermal/drivers/hisi: Fix kernel panic on alarm interrupt
  thermal/drivers/hisi: Fix missing interrupt enablement
  IB/opa_vnic: Properly return the total MACs in UC MAC list
  IB/opa_vnic: Properly clear Mac Table Digest
  drm/vc4: Avoid using vrefresh==0 mode in DSI htotal math.
  cpuidle: fix broadcast control when broadcast can not be entered
  rtc: set the alarm to the next expiring timer
  tcp: fix under-evaluated ssthresh in TCP Vegas
  clk: sunxi-ng: sun6i: Rename HDMI DDC clock to avoid name collision
  staging: greybus: light: Release memory obtained by kasprintf
  RDMA/hns: Avoid NULL pointer exception
  net: ipv6: send NS for DAD when link operationally up
  ibmvnic: Set state UP
  fm10k: ensure we process SM mbx when processing VF mbx
  ARM: exynos_defconfig: Enable UAS support for Odroid HC1 board
  vfio/pci: Virtualize Maximum Payload Size
  i40e: fix client notify of VF reset
  scsi: lpfc: Fix warning messages when NVME_TARGET_FC not defined
  scsi: lpfc: PLOGI failures during NPIV testing
  scsi: lpfc: Fix secure firmware updates
  fm10k: fix mis-ordered parameters in declaration for .ndo_set_vf_bw
  ASoC: codecs: msm8916-wcd-analog: fix module autoload
  sctp: silence warns on sctp_stream_init allocations
  powerpc/watchdog: Do not trigger SMP crash from touch_nmi_watchdog
  powerpc/xmon: Avoid tripping SMP hardlockup watchdog
  ASoC: img-parallel-out: Add pm_runtime_get/put to set_fmt callback
  ASoC: codecs: msm8916-wcd-analog: fix micbias level
  tracing: Exclude 'generic fields' from histograms
  PCI/AER: Report non-fatal errors only to the affected endpoint
  i40e/i40evf: spread CPU affinity hints across online CPUs only
  Bluetooth: hci_bcm: Fix setting of irq trigger type
  Bluetooth: hci_uart_set_flow_control: Fix NULL deref when using serdev
  leds: pca955x: Don't invert requested value in pca955x_gpio_set_value()
  ipv6: grab rt->rt6i_ref before allocating pcpu rt
  ip_gre: check packet length and mtu correctly in erspan tx
  md: always set THREAD_WAKEUP and wake up wqueue if thread existed
  block,bfq: Disable writeback throttling
  IB/rxe: check for allocation failure on elem
  ixgbe: fix use of uninitialized padding
  iio: st_sensors: add register mask for status register
  i40e: use the safe hash table iterator when deleting mac filters
  igb: check memory allocation failure
  PM / OPP: Move error message to debug level
  PCI: Create SR-IOV virtfn/physfn links before attaching driver
  scsi: mpt3sas: Fix IO error occurs on pulling out a drive from RAID1 volume created on two SATA drive
  scsi: cxgb4i: fix Tx skb leak
  PCI: Avoid bus reset if bridge itself is broken
  net: phy: at803x: Change error to EINVAL for invalid MAC
  kvm, mm: account kvm related kmem slabs to kmemcg
  rtc: pl031: make interrupt optional
  crypto: lrw - Fix an error handling path in 'create()'
  crypto: crypto4xx - increase context and scatter ring buffer elements
  clk: sunxi-ng: sun5i: Fix bit offset of audio PLL post-divider
  clk: sunxi-ng: nm: Check if requested rate is supported by fractional clock
  drm: Add retries for lspcon mode detection
  backlight: pwm_bl: Fix overflow condition
  optee: fix invalid of_node_put() in optee_driver_init()
  x86/cpufeatures: Make CPU bugs sticky
  x86/paravirt: Provide a way to check for hypervisors
  x86/paravirt: Dont patch flush_tlb_single
  x86/entry/64: Make cpu_entry_area.tss read-only
  x86/entry: Clean up the SYSENTER_stack code
  x86/entry/64: Remove the SYSENTER stack canary
  x86/entry/64: Move the IST stacks into struct cpu_entry_area
  x86/entry/64: Create a per-CPU SYSCALL entry trampoline
  x86/entry/64: Return to userspace from the trampoline stack
  x86/entry/64: Use a per-CPU trampoline stack for IDT entries
  x86/espfix/64: Stop assuming that pt_regs is on the entry stack
  x86/entry/64: Separate cpu_current_top_of_stack from TSS.sp0
  x86/entry: Remap the TSS into the CPU entry area
  x86/entry: Move SYSENTER_stack to the beginning of struct tss_struct
  x86/dumpstack: Handle stack overflow on all stacks
  x86/entry: Fix assumptions that the HW TSS is at the beginning of cpu_tss
  x86/kasan/64: Teach KASAN about the cpu_entry_area
  x86/mm/fixmap: Generalize the GDT fixmap mechanism, introduce struct cpu_entry_area
  x86/entry/gdt: Put per-CPU GDT remaps in ascending order
  x86/dumpstack: Add get_stack_info() support for the SYSENTER stack
  x86/entry/64: Allocate and enable the SYSENTER stack
  x86/irq/64: Print the offending IP in the stack overflow warning
  x86/irq: Remove an old outdated comment about context tracking races
  x86/unwinder: Handle stack overflows more gracefully
  x86/unwinder/orc: Dont bail on stack overflow
  x86/entry/64/paravirt: Use paravirt-safe macro to access eflags
  x86/mm/kasan: Don't use vmemmap_populate() to initialize shadow
  locking/barriers: Convert users of lockless_dereference() to READ_ONCE()
  locking/barriers: Add implicit smp_read_barrier_depends() to READ_ONCE()
  bpf: fix build issues on um due to mising bpf_perf_event.h
  perf/x86: Enable free running PEBS for REGS_USER/INTR
  x86: Make X86_BUG_FXSAVE_LEAK detectable in CPUID on AMD
  x86/cpufeature: Add User-Mode Instruction Prevention definitions
  drivers/misc/intel/pti: Rename the header file to free up the namespace
  x86/virt: Add enum for hypervisors to replace x86_hyper
  x86/virt, x86/platform: Merge 'struct x86_hyper' into 'struct x86_platform' and 'struct x86_init'
  ACPI / APEI: Replace ioremap_page_range() with fixmap
  selftests/x86/ldt_gdt: Run most existing LDT test cases against the GDT as well
  selftests/x86/ldt_gdt: Add infrastructure to test set_thread_area()
  x86/cpufeatures: Fix various details in the feature definitions
  x86/cpufeatures: Re-tabulate the X86_FEATURE definitions
  x86/mm: Define _PAGE_TABLE using _KERNPG_TABLE
  bitops: Revert cbe96375025e ("bitops: Add clear/set_bit32() to linux/bitops.h")
  x86/cpuid: Replace set/clear_bit32()
  x86/entry/64: Shorten TEST instructions
  x86/traps: Use a new on_thread_stack() helper to clean up an assertion
  x86/entry/64: Remove thread_struct::sp0
  x86/entry/32: Fix cpu_current_top_of_stack initialization at boot
  x86/entry/64: Remove all remaining direct thread_struct::sp0 reads
  x86/entry/64: Stop initializing TSS.sp0 at boot
  x86/xen/64, x86/entry/64: Clean up SP code in cpu_initialize_context()
  x86/entry: Add task_top_of_stack() to find the top of a task's stack
  x86/entry/64: Pass SP0 directly to load_sp0()
  x86/entry/32: Pull the MSR_IA32_SYSENTER_CS update code out of native_load_sp0()
  x86/entry/64: De-Xen-ify our NMI code
  xen, x86/entry/64: Add xen NMI trap entry
  x86/entry/64: Remove the RESTORE_..._REGS infrastructure
  x86/entry/64: Use POP instead of MOV to restore regs on NMI return
  x86/entry/64: Merge the fast and slow SYSRET paths
  x86/entry/64: Use pop instead of movq in syscall_return_via_sysret
  x86/entry/64: Shrink paranoid_exit_restore and make labels local
  x86/entry/64: Simplify reg restore code in the standard IRET paths
  x86/entry/64: Move SWAPGS into the common IRET-to-usermode path
  x86/entry/64: Split the IRET-to-user and IRET-to-kernel paths
  x86/entry/64: Remove the restore_c_regs_and_iret label
  ptrace,x86: Make user_64bit_mode() available to 32-bit builds
  x86/boot: Relocate definition of the initial state of CR0
  x86/mm: Relocate page fault error codes to traps.h
  x86/cpufeatures: Enable new SSE/AVX/AVX512 CPU features
  x86/mm/64: Rename the register_page_bootmem_memmap() 'size' parameter to 'nr_pages'
  x86/build: Beautify build log of syscall headers
  x86/asm: Don't use the confusing '.ifeq' directive
  ACPI / APEI: remove the unused dead-code for SEA/NMI notification type
  x86/xen: Drop 5-level paging support code from the XEN_PV code
  x86/xen: Provide pre-built page tables only for CONFIG_XEN_PV=y and CONFIG_XEN_PVH=y
  x86/kasan: Use the same shadow offset for 4- and 5-level paging
  mm/sparsemem: Allocate mem_section at runtime for CONFIG_SPARSEMEM_EXTREME=y
  x86/cpuid: Prevent out of bound access in do_clear_cpu_cap()
  objtool: Print top level commands on incorrect usage
  x86/platform/UV: Convert timers to use timer_setup()
  x86/fpu: Remove the explicit clearing of XSAVE dependent features
  x86/fpu: Make XSAVE check the base CPUID features before enabling
  x86/fpu: Parse clearcpuid= as early XSAVE argument
  x86/cpuid: Add generic table for CPUID dependencies
  bitops: Add clear/set_bit32() to linux/bitops.h
  x86/unwind: Make CONFIG_UNWINDER_ORC=y the default in kconfig for 64-bit
  x86/unwind: Rename unwinder config options to 'CONFIG_UNWINDER_*'
  x86/fpu/debug: Remove unused 'x86_fpu_state' and 'x86_fpu_deactivate_state' tracepoints
  x86/unwinder: Make CONFIG_UNWINDER_ORC=y the default in the 64-bit defconfig
  ACPI / APEI: adjust a local variable type in ghes_ioremap_pfn_irq()
  x86/head: Add unwind hint annotations
  x86/xen: Add unwind hint annotations
  x86/xen: Fix xen head ELF annotations
  x86/boot: Annotate verify_cpu() as a callable function
  x86/head: Fix head ELF function annotations
  x86/head: Remove unused 'bad_address' code
  x86/head: Remove confusing comment
  objtool: Don't report end of section error after an empty unwind hint
  x86/asm: Remove unnecessary \n\t in front of CC_SET() from asm templates

Change-Id: I8d4690608f817c55a142827e64ff04f7d66a70d1
Signed-off-by: Runmin Wang <runminw@codeaurora.org>
 2018-01-02 14:01:11 -08:00
Josh Poimboeuf
8af220c9e2 x86/unwind: Rename unwinder config options to 'CONFIG_UNWINDER_*' 
commit 11af847446ed0d131cf24d16a7ef3d5ea7a49554 upstream.

Rename the unwinder config options from:

  CONFIG_ORC_UNWINDER
  CONFIG_FRAME_POINTER_UNWINDER
  CONFIG_GUESS_UNWINDER

to:

  CONFIG_UNWINDER_ORC
  CONFIG_UNWINDER_FRAME_POINTER
  CONFIG_UNWINDER_GUESS

... in order to give them a more logical config namespace.

Suggested-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/73972fc7e2762e91912c6b9584582703d6f1b8cc.1507924831.git.jpoimboe@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-12-25 14:26:13 +01:00
Runmin Wang
b716d1c640 Merge remote-tracking branch 'remotes/origin/tmp-3afae84' into msm-4.14 
* remotes/origin/tmp-3afae84:
  Linux 4.14.7
  dvb_frontend: don't use-after-free the frontend struct
  media: dvb-core: always call invoke_release() in fe_free()
  x86/intel_rdt: Fix potential deadlock during resctrl unmount
  RDMA/cxgb4: Annotate r2 and stag as __be32
  md: free unused memory after bitmap resize
  dm raid: fix panic when attempting to force a raid to sync
  audit: ensure that 'audit=1' actually enables audit for PID 1
  audit: Allow auditd to set pid to 0 to end auditing
  nvmet-rdma: update queue list during ib_device removal
  blk-mq: Avoid that request queue removal can trigger list corruption
  ide: ide-atapi: fix compile error with defining macro DEBUG
  ipvlan: fix ipv6 outbound device
  powerpc/powernv/idle: Round up latency and residency values
  kbuild: do not call cc-option before KBUILD_CFLAGS initialization
  KVM: arm/arm64: vgic-its: Preserve the revious read from the pending table
  fix kcm_clone()
  fcntl: don't cap l_start and l_end values for F_GETLK64 in compat syscall
  usb: gadget: ffs: Forbid usb_ep_alloc_request from sleeping
  ipmi: Stop timers before cleaning up the module
  sctp: use right member as the param of list_for_each_entry
  cls_bpf: don't decrement net's refcount when offload fails
  net: openvswitch: datapath: fix data type in queue_gso_packets
  net: accept UFO datagrams from tuntap and packet
  tun: fix rcu_read_lock imbalance in tun_build_skb
  net: ipv6: Fixup device for anycast routes during copy
  tun: free skb in early errors
  tcp: when scheduling TLP, time of RTO should account for current ACK
  tap: free skb if flags error
  net: sched: cbq: create block for q->link.block
  tcp: use current time in tcp_rcv_space_adjust()
  tipc: call tipc_rcv() only if bearer is up in tipc_udp_recv()
  tcp: use IPCB instead of TCP_SKB_CB in inet_exact_dif_match()
  s390/qeth: fix GSO throughput regression
  s390/qeth: fix thinko in IPv4 multicast address tracking
  s390/qeth: build max size GSO skbs on L2 devices
  tcp/dccp: block bh before arming time_wait timer
  stmmac: reset last TSO segment size after device open
  net: remove hlist_nulls_add_tail_rcu()
  usbnet: fix alignment for frames with no ethernet header
  tcp: remove buggy call to tcp_v6_restore_cb()
  net/packet: fix a race in packet_bind() and packet_notifier()
  packet: fix crash in fanout_demux_rollover()
  tcp: add tcp_v4_fill_cb()/tcp_v4_restore_cb()
  sit: update frag_off info
  rds: Fix NULL pointer dereference in __rds_rdma_map
  vhost: fix skb leak in handle_rx()
  tipc: fix memory leak in tipc_accept_from_sock()
  s390/qeth: fix early exit from error path
  net: realtek: r8169: implement set_link_ksettings()
  net: thunderx: Fix TCP/UDP checksum offload for IPv4 pkts
  net: thunderx: Fix TCP/UDP checksum offload for IPv6 pkts
  net: qmi_wwan: add Quectel BG96 2c7c:0296
  Linux 4.14.6
  afs: Connect up the CB.ProbeUuid
  afs: Fix total-length calculation for multiple-page send
  IB/mlx5: Assign send CQ and recv CQ of UMR QP
  IB/mlx4: Increase maximal message size under UD QP
  bnxt_re: changing the ip address shouldn't affect new connections
  f2fs: fix to clear FI_NO_PREALLOC
  xfrm: Copy policy family in clone_policy
  tls: Use kzalloc for aead_request allocation
  jump_label: Invoke jump_label_test() via early_initcall()
  atm: horizon: Fix irq release error
  kbuild: rpm-pkg: fix jobserver unavailable warning
  mailbox: mailbox-test: don't rely on rx_buffer content to signal data ready
  clk: hi3660: fix incorrect uart3 clock freqency
  clk: uniphier: fix DAPLL2 clock rate of Pro5
  clk: qcom: common: fix legacy board-clock registration
  clk: sunxi-ng: a83t: Fix i2c buses bits
  clk: stm32h7: fix test of clock config
  bpf: fix lockdep splat
  geneve: fix fill_info when link down
  fcntl: don't leak fd reference when fixup_compat_flock fails
  sctp: use the right sk after waking up from wait_buf sleep
  sctp: do not free asoc when it is already dead in sctp_sendmsg
  slub: fix sysfs duplicate filename creation when slub_debug=O
  zsmalloc: calling zs_map_object() from irq is a bug
  sparc64/mm: set fields in deferred pages
  block: wake up all tasks blocked in get_request()
  dt-bindings: usb: fix reg-property port-number range
  xfs: fix forgotten rcu read unlock when skipping inode reclaim
  nfp: fix flower offload metadata flag usage
  nfp: inherit the max_mtu from the PF netdev
  sunrpc: Fix rpc_task_begin trace point
  NFS: Fix a typo in nfs_rename()
  dynamic-debug-howto: fix optional/omitted ending line number to be LARGE instead of 0
  lib/genalloc.c: make the avail variable an atomic_long_t
  pipe: match pipe_max_size data type with procfs
  drivers/rapidio/devices/rio_mport_cdev.c: fix resource leak in error handling path in 'rio_dma_transfer()'
  rsi: fix memory leak on buf and usb_reg_buf
  route: update fnhe_expires for redirect when the fnhe exists
  route: also update fnhe_genid when updating a route cache
  gre6: use log_ecn_error module parameter in ip6_tnl_rcv()
  mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl()
  x86/mpx/selftests: Fix up weird arrays
  apparmor: fix leak of null profile name if profile allocation fails
  powerpc/perf: Fix pmu_count to count only nest imc pmus
  coccinelle: fix parallel build with CHECK=scripts/coccicheck
  kbuild: pkg: use --transform option to prefix paths in tar
  net/smc: use sk_rcvbuf as start for rmb creation
  irqchip/qcom: Fix u32 comparison with value less than zero
  ARM: avoid faulting on qemu
  ARM: BUG if jumping to usermode address in kernel mode
  crypto: talitos - fix ctr-aes-talitos
  crypto: talitos - fix use of sg_link_tbl_len
  crypto: talitos - fix AEAD for sha224 on non sha224 capable chips
  crypto: talitos - fix setkey to check key weakness
  crypto: talitos - fix memory corruption on SEC2
  crypto: talitos - fix AEAD test failures
  IB/core: Only enforce security for InfiniBand
  IB/core: Avoid unnecessary return value check
  bus: arm-ccn: fix module unloading Error: Removing state 147 which has instances left.
  bus: arm-ccn: Fix use of smp_processor_id() in preemptible context
  bus: arm-ccn: Check memory allocation failure
  bus: arm-cci: Fix use of smp_processor_id() in preemptible context
  Revert "ARM: dts: imx53: add srtc node"
  arm64: SW PAN: Update saved ttbr0 value on enter_lazy_tlb
  arm64: SW PAN: Point saved ttbr0 at the zero page when switching to init_mm
  arm64: fpsimd: Prevent registers leaking from dead tasks
  KVM: arm/arm64: vgic-its: Check result of allocation before use
  KVM: arm/arm64: vgic: Preserve the revious read from the pending table
  KVM: arm/arm64: vgic-irqfd: Fix MSI entry allocation
  KVM: arm/arm64: Fix broken GICH_ELRSR big endian conversion
  KVM: VMX: remove I/O port 0x80 bypass on Intel hosts
  arm: KVM: Fix VTTBR_BADDR_MASK BUG_ON off-by-one
  arm64: KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one
  media: rc: partial revert of "media: rc: per-protocol repeat period"
  media: rc: sir_ir: detect presence of port
  media: dvb: i2c transfers over usb cannot be done from stack
  drm/i915: Fix vblank timestamp/frame counter jumps on gen2
  drm/exynos: gem: Drop NONCONTIG flag for buffers allocated without IOMMU
  drm/bridge: analogix dp: Fix runtime PM state in get_modes() callback
  md/r5cache: move mddev_lock() out of r5c_journal_mode_set()
  kdb: Fix handling of kallsyms_symbol_next() return value
  brcmfmac: change driver unbind order of the sdio function devices
  iwlwifi: mvm: enable RX offloading with TKIP and WEP
  iwlwifi: mvm: fix packet injection
  iwlwifi: add new cards for 9260 and 22000 series
  iwlwifi: mvm: flush queue before deleting ROC
  iwlwifi: mvm: don't use transmit queue hang detection when it is not possible
  iwlwifi: mvm: mark MIC stripped MPDUs
  powerpc/64s: Initialize ISAv3 MMU registers before setting partition table
  Revert "powerpc: Do not call ppc_md.panic in fadump panic notifier"
  KVM: s390: Fix skey emulation permission check
  s390: fix compat system call table
  s390/mm: fix off-by-one bug in 5-level page table handling
  s390: always save and restore all registers on context switch
  smp/hotplug: Move step CPUHP_AP_SMPCFD_DYING to the correct place
  iommu/vt-d: Fix scatterlist offset handling
  ALSA: usb-audio: Add check return value for usb_string()
  ALSA: usb-audio: Fix out-of-bound error
  ALSA: seq: Remove spurious WARN_ON() at timer check
  ALSA: pcm: prevent UAF in snd_pcm_info
  ALSA: hda/realtek - New codec support for ALC257
  btrfs: handle errors while updating refcounts in update_ref_for_cow
  btrfs: fix missing error return in btrfs_drop_snapshot
  KVM: x86: fix APIC page invalidation
  x86/PCI: Make broadcom_postcore_init() check acpi_disabled
  x86/idt: Load idt early in start_secondary
  X.509: fix comparisons of ->pkey_algo
  X.509: reject invalid BIT STRING for subjectPublicKey
  KEYS: reject NULL restriction string when type is specified
  KEYS: add missing permission check for request_key() destination
  ASN.1: check for error from ASN1_OP_END__ACT actions
  ASN.1: fix out-of-bounds read when parsing indefinite length item
  efi/esrt: Use memunmap() instead of kfree() to free the remapping
  efi: Move some sysfs files to be read-only by root
  scsi: libsas: align sata_device's rps_resp on a cacheline
  scsi: use dma_get_cache_alignment() as minimum DMA alignment
  scsi: dma-mapping: always provide dma_get_cache_alignment
  isa: Prevent NULL dereference in isa_bus driver callbacks
  firmware: vpd: Fix platform driver and device registration/unregistration
  firmware: vpd: Tie firmware kobject to device lifetime
  firmware: vpd: Destroy vpd sections in remove function
  firmware: cleanup FIRMWARE_IN_KERNEL message
  hv: kvp: Avoid reading past allocated blocks from KVP file
  Drivers: hv: vmbus: Fix a rescind issue
  pinctrl: armada-37xx: Fix direction_output() callback behavior
  iio: adc: meson-saradc: Meson8 and Meson8b do not have REG11 and REG13
  iio: adc: meson-saradc: initialize the bandgap correctly on older SoCs
  iio: adc: meson-saradc: fix the bit_idx of the adc_en clock
  iio: adc: cpcap: fix incorrect validation
  iio: health: max30102: Temperature should be in milli Celsius
  iio: stm32: fix adc/trigger link error
  virtio: release virtio index when fail to device_register
  can: peak/pcie_fd: fix potential bug in restarting tx queue
  can: usb_8dev: cancel urb on -EPIPE and -EPROTO
  can: esd_usb2: cancel urb on -EPIPE and -EPROTO
  can: ems_usb: cancel urb on -EPIPE and -EPROTO
  can: mcba_usb: cancel urb on -EPROTO
  can: kvaser_usb: cancel urb on -EPIPE and -EPROTO
  can: kvaser_usb: ratelimit errors if incomplete messages are received
  can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback()
  can: kvaser_usb: free buf in error paths
  can: ti_hecc: Fix napi poll return value for repoll
  can: flexcan: fix VF610 state transition issue
  can: peak/pci: fix potential bug when probe() fails
  can: mcba_usb: fix device disconnect bug
  usb: f_fs: Force Reserved1=1 in OS_DESC_EXT_COMPAT
  serdev: ttyport: fix tty locking in close
  serdev: ttyport: fix NULL-deref on hangup
  serdev: ttyport: add missing receive_buf sanity checks
  usb: gadget: core: Fix ->udc_set_speed() speed handling
  usb: gadget: udc: renesas_usb3: fix number of the pipes

Change-Id: I47977dc6948f8e5edbcd21770a63242e86adcb3b
Signed-off-by: Runmin Wang <runminw@codeaurora.org>
 2017-12-19 11:13:17 -08:00
Randy Dunlap
8cb22e0793 dynamic-debug-howto: fix optional/omitted ending line number to be LARGE instead of 0 
[ Upstream commit 1f3c790bd5989fcfec9e53ad8fa09f5b740c958f ]

line-range is supposed to treat "1-" as "1-endoffile", so
handle the special case by setting last_lineno to UINT_MAX.

Fixes this error:

  dynamic_debug:ddebug_parse_query: last-line:0 < 1st-line:1
  dynamic_debug:ddebug_exec_query: query parse failed

Link: http://lkml.kernel.org/r/10a6a101-e2be-209f-1f41-54637824788e@infradead.org
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Jason Baron <jbaron@akamai.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-12-14 09:53:08 +01:00
Stephen Bates
346008fe47 lib/genalloc.c: make the avail variable an atomic_long_t 
[ Upstream commit 36a3d1dd4e16bcd0d2ddfb4a2ec7092f0ae0d931 ]

If the amount of resources allocated to a gen_pool exceeds 2^32 then the
avail atomic overflows and this causes problems when clients try and
borrow resources from the pool.  This is only expected to be an issue on
64 bit systems.

Add the <linux/atomic.h> header to pull in atomic_long* operations.  So
that 32 bit systems continue to use atomic32_t but 64 bit systems can
use atomic64_t.

Link: http://lkml.kernel.org/r/1509033843-25667-1-git-send-email-sbates@raithlin.com
Signed-off-by: Stephen Bates <sbates@raithlin.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Reviewed-by: Daniel Mentz <danielmentz@google.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-12-14 09:53:08 +01:00
Eric Biggers
4c69b34050 ASN.1: check for error from ASN1_OP_END__ACT actions 
commit 81a7be2cd69b412ab6aeacfe5ebf1bb6e5bce955 upstream.

asn1_ber_decoder() was ignoring errors from actions associated with the
opcodes ASN1_OP_END_SEQ_ACT, ASN1_OP_END_SET_ACT,
ASN1_OP_END_SEQ_OF_ACT, and ASN1_OP_END_SET_OF_ACT.  In practice, this
meant the pkcs7_note_signed_info() action (since that was the only user
of those opcodes).  Fix it by checking for the error, just like the
decoder does for actions associated with the other opcodes.

This bug allowed users to leak slab memory by repeatedly trying to add a
specially crafted "pkcs7_test" key (requires CONFIG_PKCS7_TEST_KEY).

In theory, this bug could also be used to bypass module signature
verification, by providing a PKCS#7 message that is misparsed such that
a signature's ->authattrs do not contain its ->msgdigest.  But it
doesn't seem practical in normal cases, due to restrictions on the
format of the ->authattrs.

Fixes: 42d5ec27f873 ("X.509: Add an ASN.1 decoder")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-12-14 09:52:52 +01:00
Eric Biggers
2c4c01d13f ASN.1: fix out-of-bounds read when parsing indefinite length item 
commit e0058f3a874ebb48b25be7ff79bc3b4e59929f90 upstream.

In asn1_ber_decoder(), indefinitely-sized ASN.1 items were being passed
to the action functions before their lengths had been computed, using
the bogus length of 0x80 (ASN1_INDEFINITE_LENGTH).  This resulted in
reading data past the end of the input buffer, when given a specially
crafted message.

Fix it by rearranging the code so that the indefinite length is resolved
before the action is called.

This bug was originally found by fuzzing the X.509 parser in userspace
using libFuzzer from the LLVM project.

KASAN report (cleaned up slightly):

    BUG: KASAN: slab-out-of-bounds in memcpy ./include/linux/string.h:341 [inline]
    BUG: KASAN: slab-out-of-bounds in x509_fabricate_name.constprop.1+0x1a4/0x940 crypto/asymmetric_keys/x509_cert_parser.c:366
    Read of size 128 at addr ffff880035dd9eaf by task keyctl/195

    CPU: 1 PID: 195 Comm: keyctl Not tainted 4.14.0-09238-g1d3b78bbc6e9 #26
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014
    Call Trace:
     __dump_stack lib/dump_stack.c:17 [inline]
     dump_stack+0xd1/0x175 lib/dump_stack.c:53
     print_address_description+0x78/0x260 mm/kasan/report.c:252
     kasan_report_error mm/kasan/report.c:351 [inline]
     kasan_report+0x23f/0x350 mm/kasan/report.c:409
     memcpy+0x1f/0x50 mm/kasan/kasan.c:302
     memcpy ./include/linux/string.h:341 [inline]
     x509_fabricate_name.constprop.1+0x1a4/0x940 crypto/asymmetric_keys/x509_cert_parser.c:366
     asn1_ber_decoder+0xb4a/0x1fd0 lib/asn1_decoder.c:447
     x509_cert_parse+0x1c7/0x620 crypto/asymmetric_keys/x509_cert_parser.c:89
     x509_key_preparse+0x61/0x750 crypto/asymmetric_keys/x509_public_key.c:174
     asymmetric_key_preparse+0xa4/0x150 crypto/asymmetric_keys/asymmetric_type.c:388
     key_create_or_update+0x4d4/0x10a0 security/keys/key.c:850
     SYSC_add_key security/keys/keyctl.c:122 [inline]
     SyS_add_key+0xe8/0x290 security/keys/keyctl.c:62
     entry_SYSCALL_64_fastpath+0x1f/0x96

    Allocated by task 195:
     __do_kmalloc_node mm/slab.c:3675 [inline]
     __kmalloc_node+0x47/0x60 mm/slab.c:3682
     kvmalloc ./include/linux/mm.h:540 [inline]
     SYSC_add_key security/keys/keyctl.c:104 [inline]
     SyS_add_key+0x19e/0x290 security/keys/keyctl.c:62
     entry_SYSCALL_64_fastpath+0x1f/0x96

Fixes: 42d5ec27f873 ("X.509: Add an ASN.1 decoder")
Reported-by: Alexander Potapenko <glider@google.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-12-14 09:52:52 +01:00
Runmin Wang
5cd5fea2fd Merge remote-tracking branch 'remotes/origin/tmp-51a2a68' into msm-4.14 
* remotes/origin/tmp-51a2a68:
  Linux 4.14.4
  Revert "x86/entry/64: Add missing irqflags tracing to native_load_gs_index()"
  drm/i915: Prevent zero length "index" write
  drm/i915: Don't try indexed reads to alternate slave addresses
  drm/i915/gvt: Correct ADDR_4K/2M/1G_MASK definition
  drm/i915/fbdev: Serialise early hotplug events with async fbdev config
  drm/i915: Re-register PMIC bus access notifier on runtime resume
  drm/i915: Fix false-positive assert_rpm_wakelock_held in i915_pmic_bus_access_notifier v2
  md: forbid a RAID5 from having both a bitmap and a journal.
  e1000e: fix the use of magic numbers for buffer overrun issue
  IB/hfi1: Do not warn on lid conversions for OPA
  IB/core: Do not warn on lid conversions for OPA
  include/linux/compiler-clang.h: handle randomizable anonymous structs
  drm/amdgpu: Set adev->vcn.irq.num_types for VCN
  drm/amdgpu: move UVD/VCE and VCN structure out from union
  drm/edid: Don't send non-zero YQ in AVI infoframe for HDMI 1.x sinks
  drm/fsl-dcu: Don't set connector DPMS property
  drm/fb_helper: Disable all crtc's when initial setup fails.
  drm/amd/pp: fix typecast error in powerplay.
  drm/ttm: once more fix ttm_buffer_object_transfer
  drm/hisilicon: Ensure LDI regs are properly configured.
  drm/panel: simple: Add missing panel_simple_unprepare() calls
  drm/radeon: fix atombios on big endian
  drm/tilcdc: Precalculate total frametime in tilcdc_crtc_set_mode()
  drm/vblank: Tune drm_crtc_accurate_vblank_count() WARN down to a debug
  drm/vblank: Fix flip event vblank count
  drm/ttm: Always and only destroy bo->ttm_resv in ttm_bo_release_list
  drm/amdgpu: reserve root PD while releasing it
  dma-buf: make reservation_object_copy_fences rcu save
  drm/ttm: fix ttm_bo_cleanup_refs_or_queue once more
  drm/amdgpu: Remove check which is not valid for certain VBIOS
  drm/amdgpu: Properly allocate VM invalidate eng v2
  drm/amdgpu: fix error handling in amdgpu_bo_do_create
  drm/amdgpu: correct reference clock value on vega10
  drm/amdgpu: Potential uninitialized variable in amdgpu_vm_update_directories()
  drm/amdgpu: potential uninitialized variable in amdgpu_vce_ring_parse_cs()
  Revert "drm/radeon: dont switch vt on suspend"
  nvme-pci: add quirk for delay before CHK RDY for WDC SN200
  hwmon: (jc42) optionally try to disable the SMBUS timeout
  bcache: recover data from backing when data is clean
  bcache: only permit to recovery read error when cache device is clean
  bcache: Fix building error on MIPS
  cxl: Check if vphb exists before iterating over AFU devices
  i2c: i801: Fix Failed to allocate irq -2147483648 error
  eeprom: at24: check at24_read/write arguments
  eeprom: at24: correctly set the size for at24mac402
  eeprom: at24: fix reading from 24MAC402/24MAC602
  ACPI / EC: Fix regression related to PM ops support in ECDT device
  mmc: core: prepend 0x to OCR entry in sysfs
  mmc: core: prepend 0x to pre_eol_info entry in sysfs
  mmc: block: Ensure that debugfs files are removed
  mmc: core: Do not leave the block driver in a suspended state
  mmc: block: Check return value of blk_get_request()
  mmc: block: Fix missing blk_put_request()
  mmc: sdhci: Avoid swiotlb buffer being full
  KVM: lapic: Fixup LDR on load in x2apic
  KVM: lapic: Split out x2apic ldr calculation
  KVM: x86: inject exceptions produced by x86_decode_insn
  KVM: x86: Exit to user-mode on #UD intercept when emulator requires
  KVM: x86: pvclock: Handle first-time write to pvclock-page contains random junk
  powerpc/kexec: Fix kexec/kdump in P9 guest kernels
  powerpc/powernv: Fix kexec crashes caused by tlbie tracing
  arm64: ftrace: emit ftrace-mod.o contents through code
  arm64: module-plts: factor out PLT generation code for ftrace
  apparmor: fix oops in audit_signal_cb hook
  omapdrm: hdmi4: Correct the SoC revision matching
  drm: omapdrm: Fix DPI on platforms using the DSI VDDS
  s390: revert ELF_ET_DYN_BASE base changes
  lockd: lost rollback of set_grace_period() in lockd_down_net()
  crypto: skcipher - Fix skcipher_walk_aead_common
  crypto: af_alg - remove locking in async callback
  crypto: algif_aead - skip SGL entries with NULL page
  nfsd: fix panic in posix_unblock_lock called from nfs4_laundromat
  nfsd: Fix another OPEN stateid race
  nfsd: Fix stateid races between OPEN and CLOSE
  btrfs: clear space cache inode generation always
  mm/hugetlb: fix NULL-pointer dereference on 5-level paging machine
  autofs: revert "autofs: fix AT_NO_AUTOMOUNT not being honored"
  autofs: revert "autofs: take more care to not update last_used on path walk"
  fs/fat/inode.c: fix sb_rdonly() change
  mm, memcg: fix mem_cgroup_swapout() for THPs
  mm: migrate: fix an incorrect call of prep_transhuge_page()
  mm/madvise.c: fix madvise() infinite loop under special circumstances
  exec: avoid RLIMIT_STACK races with prlimit()
  IB/core: disable memory registration of filesystem-dax vmas
  v4l2: disable filesystem-dax mapping support
  mm: fail get_vaddr_frames() for filesystem-dax mappings
  mm: introduce get_user_pages_longterm
  device-dax: implement ->split() to catch invalid munmap attempts
  mm, hugetlbfs: introduce ->split() to vm_operations_struct
  mm: fix device-dax pud write-faults triggered by get_user_pages()
  mm/cma: fix alloc_contig_range ret code/potential leak
  mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()
  mm, oom_reaper: gather each vma to prevent leaking TLB entry
  mm, memory_hotplug: do not back off draining pcp free pages from kworker context
  platform/x86: hp-wmi: Fix tablet mode detection for convertibles
  Linux 4.14.3
  e1000e: fix buffer overrun while the I219 is processing DMA transactions
  e1000e: Avoid receiver overrun interrupt bursts
  e1000e: Separate signaling for link check/link up
  e1000e: Fix return value test
  e1000e: Fix error path in link detection
  iwlwifi: mvm: support version 7 of the SCAN_REQ_UMAC FW command
  iwlwifi: fix PCI IDs and configuration mapping for 9000 series
  iwlwifi: add new cards for 8260 series
  iwlwifi: add new cards for 8265 series
  iwlwifi: add new cards for a000 series
  iwlwifi: pcie: sort IDs for the 9000 series for easier comparisons
  iwlwifi: add a new a000 device
  iwlwifi: fix wrong struct for a000 device
  ARM64: dts: meson-gxl: Add alternate ARM Trusted Firmware reserved memory zone
  media: venus: reimplement decoder stop command
  media: venus: venc: fix bytesused v4l2_plane field
  media: venus: fix wrong size on dma_free
  media: v4l2-ctrl: Fix flags field on Control events
  cx231xx-cards: fix NULL-deref on missing association descriptor
  media: rc: nec decoder should not send both repeat and keycode
  media: rc: check for integer overflow
  media: Don't do DMA on stack for firmware upload in the AS102 driver
  powerpc/64s/hash: Allow MAP_FIXED allocations to cross 128TB boundary
  powerpc/64s/hash: Fix fork() with 512TB process address space
  powerpc/64s/hash: Fix 128TB-512TB virtual address boundary case allocation
  powerpc/64s/hash: Fix 512T hint detection to use >= 128T
  powerpc/64s/radix: Fix 128TB-512TB virtual address boundary case allocation
  powerpc/64s: Fix masking of SRR1 bits on instruction fault
  powerpc/signal: Properly handle return value from uprobe_deny_signal()
  powerpc/perf/imc: Use cpu_to_node() not topology_physical_package_id()
  powerpc/mm/radix: Fix crashes on Power9 DD1 with radix MMU and STRICT_RWX
  powerpc: Fix boot on BOOK3S_32 with CONFIG_STRICT_KERNEL_RWX
  parisc: Fix validity check of pointer size argument in new CAS implementation
  ixgbe: Fix skb list corruption on Power systems
  fm10k: Use smp_rmb rather than read_barrier_depends
  i40evf: Use smp_rmb rather than read_barrier_depends
  ixgbevf: Use smp_rmb rather than read_barrier_depends
  igbvf: Use smp_rmb rather than read_barrier_depends
  igb: Use smp_rmb rather than read_barrier_depends
  i40e: Use smp_rmb rather than read_barrier_depends
  spi-nor: intel-spi: Fix broken software sequencing codes
  NFC: fix device-allocation error return
  IB/core: Only maintain real QPs in the security lists
  IB/core: Avoid crash on pkey enforcement failed in received MADs
  IB/srp: Avoid that a cable pull can trigger a kernel crash
  IB/hfi1: Fix incorrect available receive user context count
  IB/cm: Fix memory corruption in handling CM request
  IB/srpt: Do not accept invalid initiator port names
  svcrdma: Preserve CB send buffer across retransmits
  libnvdimm, namespace: make 'resource' attribute only readable by root
  libnvdimm, region : make 'resource' attribute only readable by root
  libnvdimm, namespace: fix label initialization to use valid seq numbers
  libnvdimm, pfn: make 'resource' attribute only readable by root
  libnvdimm, dimm: clear 'locked' status on successful DIMM enable
  clk: ti: dra7-atl-clock: fix child-node lookups
  SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status
  dax: fix general protection fault in dax_alloc_inode
  dax: fix PMD faults on zero-length files
  kvm: vmx: Reinstate support for CPUs without virtual NMI
  KVM: SVM: obey guest PAT
  KVM: nVMX: set IDTR and GDTR limits when loading L1 host state
  KVM: PPC: Book3S HV: Don't call real-mode XICS hypercall handlers if not enabled
  lockd: double unregister of inetaddr notifiers
  irqchip/gic-v3: Fix ppi-partitions lookup
  genirq: Track whether the trigger type has been set
  raid1: prevent freeze_array/wait_all_barriers deadlock
  block: Fix a race between blk_cleanup_queue() and timeout handling
  p54: don't unregister leds when they are not initialized
  mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush sequence
  mtd: nand: mtk: fix infinite ECC decode IRQ issue
  mtd: nand: Fix writing mtdoops to nand flash.
  mtd: nand: omap2: Fix subpage write
  mtd: nand: atmel: Actually use the PM ops
  mtd: nand: Export nand_reset() symbol
  mtd: Avoid probe failures when mtd->dbg.dfs_dir is invalid
  target: Avoid early CMD_T_PRE_EXECUTE failures during ABORT_TASK
  target: Fix quiese during transport_write_pending_qf endless loop
  target: Fix caw_sem leak in transport_generic_request_failure
  target: Fix QUEUE_FULL + SCSI task attribute handling
  target: fix buffer offset in core_scsi3_pri_read_full_status
  target: fix null pointer regression in core_tmr_drain_tmr_list
  iscsi-target: Fix non-immediate TMR reference leak
  iscsi-target: Make TASK_REASSIGN use proper se_cmd->cmd_kref
  scsi: lpfc: Fix oops if nvmet_fc_register_targetport fails
  scsi: lpfc: Fix FCP hba_wqidx assignment
  scsi: lpfc: Fix crash receiving ELS while detaching driver
  scsi: lpfc: fix pci hot plug crash in list_add call
  scsi: lpfc: fix pci hot plug crash in timer management routines
  scsi: sd_zbc: Fix sd_zbc_read_zoned_characteristics()
  scsi: qla2xxx: Suppress a kernel complaint in qla_init_base_qpair()
  net/9p: Switch to wait_event_killable()
  fs/9p: Compare qid.path in v9fs_test_inode
  9p: Fix missing commas in mount options
  fix a page leak in vhost_scsi_iov_to_sgl() error recovery
  mfd: lpc_ich: Avoton/Rangeley uses SPI_BYT method
  ASoC: sun8i-codec: Set the BCLK divider
  ASoC: sun8i-codec: Fix left and right channels inversion
  ASoC: sun8i-codec: Invert Master / Slave condition
  ALSA: hda/realtek - Fix ALC700 family no sound issue
  ALSA: hda - Fix yet remaining issue with vmaster 0dB initialization
  ALSA: hda: Fix too short HDMI/DP chmap reporting
  ALSA: hda/realtek - Fix ALC275 no sound issue
  ALSA: timer: Remove kernel warning at compat ioctl error paths
  ALSA: usb-audio: Add sanity checks in v2 clock parsers
  ALSA: usb-audio: Fix potential out-of-bound access at parsing SU
  ALSA: usb-audio: Add sanity checks to FE parser
  ALSA: pcm: update tstamp only if audio_tstamp changed
  ext4: prevent data corruption with journaling + DAX
  ext4: prevent data corruption with inline data + DAX
  ext4: fix interaction between i_size, fallocate, and delalloc after a crash
  ata: fixes kernel crash while tracing ata_eh_link_autopsy event
  fsnotify: fix pinning group in fsnotify_prepare_user_wait()
  fsnotify: pin both inode and vfsmount mark
  fsnotify: clean up fsnotify_prepare/finish_user_wait()
  md/bitmap: revert a patch
  Bluetooth: btqcomsmd: Add support for BD address setup
  md: don't check MD_SB_CHANGE_CLEAN in md_allow_write
  md: fix deadlock error in recent patch.
  iwlwifi: fix firmware names for 9000 and A000 series hw
  rtlwifi: fix uninitialized rtlhal->last_suspend_sec time
  rtlwifi: rtl8192ee: Fix memory leak when loading firmware
  nfsd: deal with revoked delegations appropriately
  NFS: revalidate "." etc correctly on "open".
  NFS: Avoid RCU usage in tracepoints
  nfs: Fix ugly referral attributes
  NFS: Revert "NFS: Move the flock open mode check into nfs_flock()"
  NFS: Fix typo in nomigration mount option
  f2fs: expose some sectors to user in inline data or dentry case
  btrfs: change how we decide to commit transactions during flushing
  isofs: fix timestamps beyond 2027
  fanotify: fix fsnotify_prepare_user_wait() failure
  fs: guard_bio_eod() needs to consider partitions
  bcache: check ca->alloc_thread initialized before wake up it
  libceph: don't WARN() if user tries to add invalid key
  eCryptfs: use after free in ecryptfs_release_messaging()
  fscrypt: lock mutex before checking for bounce page pool
  nilfs2: fix race condition that causes file system corruption
  autofs: don't fail mount for transient error
  mm/z3fold.c: use kref to prevent page free/compact race
  rt2x00usb: mark device removed when get ENOENT usb error
  MIPS: math-emu: Fix final emulation phase for certain instructions
  MIPS: BCM47XX: Fix LED inversion for WRT54GSv1
  MIPS: Fix an n32 core file generation regset support regression
  MIPS: dts: remove bogus bcm96358nb4ser.dtb from dtb-y entry
  MIPS: Fix MIPS64 FP save/restore on 32-bit kernels
  MIPS: Fix odd fp register warnings with MIPS64r2
  dm: discard support requires all targets in a table support discards
  dm: fix race between dm_get_from_kobject() and __dm_destroy()
  MIPS: pci: Remove KERN_WARN instance inside the mt7620 driver
  sched/rt: Simplify the IPI based RT balancing logic
  dm: allocate struct mapped_device with kvzalloc
  ovl: Put upperdentry if ovl_check_origin() fails
  dm bufio: fix integer overflow when limiting maximum cache size
  dm mpath: remove annoying message of 'blk_get_request() returned -11'
  dm zoned: ignore last smaller runt zone
  dm crypt: allow unaligned bv_offset
  dm cache: fix race condition in the writeback mode overwrite_bio optimisation
  dm integrity: allow unaligned bv_offset
  ALSA: hda: Add Raven PCI ID
  PCI: Apply Cavium ThunderX ACS quirk to more Root Ports
  PCI: Set Cavium ACS capability quirk flags to assert RR/CR/SV/UF
  PCI: hv: Use effective affinity mask
  PCI/ASPM: Use correct capability pointer to program LTR_L1.2_THRESHOLD
  PCI/ASPM: Account for downstream device's Port Common_Mode_Restore_Time
  PM / OPP: Add missing of_node_put(np)
  nbd: don't start req until after the dead connection logic
  nbd: wait uninterruptible for the dead timeout
  net: mvneta: fix handling of the Tx descriptor counter
  MIPS: ralink: Fix typo in mt7628 pinmux function
  MIPS: ralink: Fix MT7628 pinmux
  MIPS: cmpxchg64() and HAVE_VIRT_CPU_ACCOUNTING_GEN don't work for 32-bit SMP
  uapi: fix linux/rxrpc.h userspace compilation errors
  uapi: fix linux/tls.h userspace compilation error
  ARM: 8721/1: mm: dump: check hardware RO bit for LPAE
  ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE
  arm64: Implement arch-specific pte_access_permitted()
  perf/x86/intel: Hide TSX events when RTM is not supported
  x86/entry/64: Add missing irqflags tracing to native_load_gs_index()
  x86/entry/64: Fix entry_SYSCALL_64_after_hwframe() IRQ tracing
  x86/decoder: Add new TEST instruction pattern
  x86/boot: Fix boot failure when SMP MP-table is based at 0
  lib/mpi: call cond_resched() from mpi_powm() loop
  sched: Make resched_cpu() unconditional
  serdev: fix registration of second slave
  cpufreq: schedutil: Reset cached_raw_freq when not in sync with next_freq
  ACPI / EC: Fix regression related to triggering source of EC event handling
  ACPI / PM: Fix acpi_pm_notifier_lock vs flush_workqueue() deadlock
  s390/disassembler: increase show_code buffer size
  s390/disassembler: add missing end marker for e7 table
  s390/guarded storage: fix possible memory corruption
  s390/runtime instrumention: fix possible memory corruption
  s390/noexec: execute kexec datamover without DAT
  s390: fix transactional execution control register handling

Change-Id: I5c0d3507068e1f4482753cdcb83d1b43a52b2889
Signed-off-by: Runmin Wang <runminw@codeaurora.org>
 2017-12-06 11:47:09 -08:00
Eric Biggers
ce922b7b4a lib/mpi: call cond_resched() from mpi_powm() loop 
commit 1d9ddde12e3c9bab7f3d3484eb9446315e3571ca upstream.

On a non-preemptible kernel, if KEYCTL_DH_COMPUTE is called with the
largest permitted inputs (16384 bits), the kernel spends 10+ seconds
doing modular exponentiation in mpi_powm() without rescheduling.  If all
threads do it, it locks up the system.  Moreover, it can cause
rcu_sched-stall warnings.

Notwithstanding the insanity of doing this calculation in kernel mode
rather than in userspace, fix it by calling cond_resched() as each bit
from the exponent is processed.  It's still noninterruptible, but at
least it's preemptible now.

Do the cond_resched() once per bit rather than once per MPI limb because
each limb might still easily take 100+ milliseconds on slow CPUs.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-11-30 08:40:39 +00:00
Kyle Yan
1a3004fa9e Merge remote-tracking branch 'origin/tmp-bebc608' into msm-next 
* origin/tmp-bebc608:
  Linux 4.14
  vlan: fix a use-after-free in vlan_device_event()
  tooling/headers: Sync the tools/include/uapi/drm/i915_drm.h UAPI header
  net: dsa: return after vlan prepare phase
  net: dsa: return after mdb prepare phase
  .mailmap: Add Maciej W. Rozycki's Imagination e-mail address
  Revert "x86: CPU: Fix up "cpu MHz" in /proc/cpuinfo"
  can: ifi: Fix transmitter delay calculation
  tcp: fix tcp_fastretrans_alert warning
  tcp: gso: avoid refcount_t warning from tcp_gso_segment()
  can: peak: Add support for new PCIe/M2 CAN FD interfaces
  can: sun4i: handle overrun in RX FIFO
  can: c_can: don't indicate triple sampling support for D_CAN
  x86/debug: Handle warnings before the notifier chain, to fix KGDB crash
  net/mlx5e: Increase Striding RQ minimum size limit to 4 multi-packet WQEs
  net/mlx5e: Set page to null in case dma mapping fails
  net/mlx5e: Fix napi poll with zero budget
  net/mlx5: Cancel health poll before sending panic teardown command
  net/mlx5: Loop over temp list to release delay events
  rds: ib: Fix NULL pointer dereference in debug code
  MAINTAINERS: update TPM driver infrastructure changes
  sysctl: add register_sysctl() dummy helper
  x86/mm: Fix ELF_ET_DYN_BASE for 5-level paging
  perf trace: Call machine__exit() at exit
  perf tools: Fix eBPF event specification parsing
  perf tools: Add "reject" option for parse-events.l
  rbd: use GFP_NOIO for parent stat and data requests
  ALSA: hda - fix headset mic problem for Dell machines with alc274
  cls_u32: use tcf_exts_get_net() before call_rcu()
  cls_tcindex: use tcf_exts_get_net() before call_rcu()
  cls_rsvp: use tcf_exts_get_net() before call_rcu()
  cls_route: use tcf_exts_get_net() before call_rcu()
  cls_matchall: use tcf_exts_get_net() before call_rcu()
  cls_fw: use tcf_exts_get_net() before call_rcu()
  cls_flower: use tcf_exts_get_net() before call_rcu()
  cls_flow: use tcf_exts_get_net() before call_rcu()
  cls_cgroup: use tcf_exts_get_net() before call_rcu()
  cls_bpf: use tcf_exts_get_net() before call_rcu()
  cls_basic: use tcf_exts_get_net() before call_rcu()
  net_sched: introduce tcf_exts_get_net() and tcf_exts_put_net()
  Revert "net_sched: hold netns refcnt for each action"
  net: usb: asix: fill null-ptr-deref in asix_suspend
  Revert "net: usb: asix: fill null-ptr-deref in asix_suspend"
  x86/mm: Unbreak modules that rely on external PAGE_KERNEL availability
  x86/idt: Remove X86_TRAP_BP initialization in idt_setup_traps()
  apparmor: fix off-by-one comparison on MAXMAPPED_SIG
  drm/i915: Deconstruct struct sgt_dma initialiser
  drm/i915: Reject unknown syncobj flags
  MIPS: AR7: Ensure that serial ports are properly set up
  MAINTAINERS: Add Lorenzo Pieralisi for PCI host bridge drivers
  KEYS: fix NULL pointer dereference during ASN.1 parsing [ver #2]
  MIPS: AR7: Defer registration of GPIO
  x86/oprofile/ppro: Do not use __this_cpu*() in preemptible context
  x86/unwind: Disable KASAN checking in the ORC unwinder
  qmi_wwan: Add missing skb_reset_mac_header-call
  bonding: fix slave stuck in BOND_LINK_FAIL state
  qrtr: Move to postcore_initcall
  net: qmi_wwan: fix divide by 0 on bad descriptors
  net: cdc_ether: fix divide by 0 on bad descriptors
  KVM: PPC: Book3S HV: Fix exclusion between HPT resizing and other HPT updates
  bonding: discard lowest hash bit for 802.3ad layer3+4
  Input: synaptics-rmi4 - RMI4 can also use SMBUS version 3
  Input: tsc200x-core - set INPUT_PROP_DIRECT
  Input: elan_i2c - add ELAN060C to the ACPI table
  net/mlx5e/core/en_fs: fix pointer dereference after free in mlx5e_execute_l2_action
  net: mvpp2: Prevent userspace from changing TX affinities
  MAINTAINERS: Remove Gabriele Paoloni as HiSilicon PCI maintainer
  MAINTAINERS: Remove Stephen Bates as Microsemi Switchtec maintainer
  MIPS: BMIPS: Fix missing cbr address
  drivers/ide-cd: Handle missing driver data during status check gracefully
  Revert "scsi: make 'state' device attribute pollable"
  ALSA: seq: Fix OSS sysex delivery in OSS emulation
  x86/smpboot: Make optimization of delay calibration work correctly
  ACPI / PM: Blacklist Low Power S0 Idle _DSM for Dell XPS13 9360
  scripts: add leaking_addresses.pl
  ALSA: seq: Avoid invalid lockdep class warning
  ARM: 8720/1: ensure dump_instr() checks addr_limit
  ALSA: timer: Limit max instances per timer
  tcp: fix DSACK-based undo on non-duplicate ACK
  l2tp: don't use l2tp_tunnel_find() in l2tp_ip and l2tp_ip6
  cpufreq: schedutil: Examine the correct CPU when we update util
  net: usb: asix: fill null-ptr-deref in asix_suspend
  netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed
  cxgb4: update latest firmware version supported
  crypto: ccm - preserve the IV buffer
  crypto: x86/sha1-mb - fix panic due to unaligned access
  crypto: x86/sha256-mb - fix panic due to unaligned access
  xfrm: Fix stack-out-of-bounds read in xfrm_state_find.
  xfrm: do unconditional template resolution before pcpu cache check
  xfrm: defer daddr pointer assignment after spi parsing
  ALSA: usb-audio: support new Amanero Combo384 firmware version
  drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue
  drm/vmwgfx: constify vmw_fence_ops
  workqueue: Fix NULL pointer dereference

Change-Id: Id92cc6896224b2a45aaa1a6c525dee61d2791e60
Signed-off-by: Kyle Yan <kyan@codeaurora.org>
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
 2017-11-12 15:42:11 -08:00