malhuda/msm-4.14
1
0
Fork 0
mirror of https://github.com/rd-stuffs/msm-4.14.git synced 2025-02-20 11:45:48 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity
720,797 Commits 5 Branches 0 Tags
Commit Graph

4575 Commits

Author SHA1 Message Date
Blagovest Kolenichev
0e1a219e24 Merge android-4.14.43 (4c9e0a9) into msm-4.14 
* refs/heads/tmp-4c9e0a9
  Linux 4.14.43
  x86/bugs: Rename SSBD_NO to SSB_NO
  KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD
  x86/speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG
  x86/bugs: Rework spec_ctrl base and mask logic
  x86/bugs: Remove x86_spec_ctrl_set()
  x86/bugs: Expose x86_spec_ctrl_base directly
  x86/bugs: Unify x86_spec_ctrl_{set_guest,restore_host}
  x86/speculation: Rework speculative_store_bypass_update()
  x86/speculation: Add virtualized speculative store bypass disable support
  x86/bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL
  x86/speculation: Handle HT correctly on AMD
  x86/cpufeatures: Add FEATURE_ZEN
  x86/cpufeatures: Disentangle SSBD enumeration
  x86/cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS
  x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP
  KVM: SVM: Move spec control call after restore of GS
  x86/cpu: Make alternative_msr_write work for 32-bit code
  x86/bugs: Fix the parameters alignment and missing void
  x86/bugs: Make cpu_show_common() static
  x86/bugs: Fix __ssb_select_mitigation() return type
  Documentation/spec_ctrl: Do some minor cleanups
  proc: Use underscores for SSBD in 'status'
  x86/bugs: Rename _RDS to _SSBD
  x86/speculation: Make "seccomp" the default mode for Speculative Store Bypass
  seccomp: Move speculation migitation control to arch code
  seccomp: Add filter flag to opt-out of SSB mitigation
  seccomp: Use PR_SPEC_FORCE_DISABLE
  prctl: Add force disable speculation
  x86/bugs: Make boot modes __ro_after_init
  seccomp: Enable speculation flaw mitigations
  proc: Provide details on speculation flaw mitigations
  nospec: Allow getting/setting on non-current task
  x86/speculation: Add prctl for Speculative Store Bypass mitigation
  x86/process: Allow runtime control of Speculative Store Bypass
  prctl: Add speculation control prctls
  x86/speculation: Create spec-ctrl.h to avoid include hell
  x86/KVM/VMX: Expose SPEC_CTRL Bit(2) to the guest
  x86/bugs/AMD: Add support to disable RDS on Fam[15,16,17]h if requested
  x86/bugs: Whitelist allowed SPEC_CTRL MSR values
  x86/bugs/intel: Set proper CPU features and setup RDS
  x86/bugs: Provide boot parameters for the spec_store_bypass_disable mitigation
  x86/cpufeatures: Add X86_FEATURE_RDS
  x86/bugs: Expose /sys/../spec_store_bypass
  x86/bugs, KVM: Support the combination of guest and host IBRS
  x86/bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits
  x86/bugs: Concentrate bug reporting into a separate function
  x86/bugs: Concentrate bug detection into a separate function
  x86/nospec: Simplify alternative_msr_write()
  btrfs: fix reading stale metadata blocks after degraded raid1 mounts
  btrfs: Fix delalloc inodes invalidation during transaction abort
  btrfs: Split btrfs_del_delalloc_inode into 2 functions
  btrfs: fix crash when trying to resume balance without the resume flag
  btrfs: property: Set incompat flag if lzo/zstd compression is set
  Btrfs: send, fix invalid access to commit roots due to concurrent snapshotting
  Btrfs: fix xattr loss after power failure
  ARM: 8772/1: kprobes: Prohibit kprobes on get_user functions
  ARM: 8770/1: kprobes: Prohibit probing on optimized_callback
  ARM: 8769/1: kprobes: Fix to use get_kprobe_ctlblk after irq-disabed
  tick/broadcast: Use for_each_cpu() specially on UP kernels
  x86/mm: Drop TS_COMPAT on 64-bit exec() syscall
  ARM: 8771/1: kprobes: Prohibit kprobes on do_undefinstr
  efi: Avoid potential crashes, fix the 'struct efi_pci_io_protocol_32' definition for mixed mode
  x86/pkeys: Do not special case protection key 0
  x86/pkeys: Override pkey when moving away from PROT_EXEC
  s390: remove indirect branch from do_softirq_own_stack
  s390/qdio: don't release memory in qdio_setup_irq()
  s390/cpum_sf: ensure sample frequency of perf event attributes is non-zero
  s390/qdio: fix access to uninitialized qdio_q fields
  drm/i915/gen9: Add WaClearHIZ_WM_CHICKEN3 for bxt and glk
  mm: don't allow deferred pages with NEED_PER_CPU_KM
  radix tree: fix multi-order iteration race
  lib/test_bitmap.c: fix bitmap optimisation tests to report errors correctly
  drm: Match sysfs name in link removal to link creation
  powerpc/powernv: Fix NVRAM sleep in invalid context when crashing
  i2c: designware: fix poll-after-enable regression
  netfilter: nf_socket: Fix out of bounds access in nf_sk_lookup_slow_v{4,6}
  netfilter: nf_tables: can't fail after linking rule into active rule list
  netfilter: nf_tables: free set name in error path
  tee: shm: fix use-after-free via temporarily dropped reference
  tracing/x86/xen: Remove zero data size trace events trace_xen_mmu_flush_tlb{_all}
  vfio: ccw: fix cleanup if cp_prefetch fails
  powerpc: Don't preempt_disable() in show_cpuinfo()
  KVM: arm/arm64: VGIC/ITS: protect kvm_read_guest() calls with SRCU lock
  KVM: arm/arm64: VGIC/ITS save/restore: protect kvm_read_guest() calls
  spi: bcm-qspi: Always read and set BSPI_MAST_N_BOOT_CTRL
  spi: bcm-qspi: Avoid setting MSPI_CDRAM_PCS for spi-nor master
  spi: pxa2xx: Allow 64-bit DMA
  ALSA: control: fix a redundant-copy issue
  ALSA: hda: Add Lenovo C50 All in one to the power_save blacklist
  ALSA: usb: mixer: volume quirk for CM102-A+/102S+
  usbip: usbip_host: fix bad unlock balance during stub_probe()
  usbip: usbip_host: fix NULL-ptr deref and use-after-free errors
  usbip: usbip_host: run rebind from exit when module is removed
  usbip: usbip_host: delete device from busid_table after rebind
  usbip: usbip_host: refine probe and disconnect debug msgs to be useful
  Linux 4.14.42
  proc: do not access cmdline nor environ from file-backed areas
  l2tp: revert "l2tp: fix missing print session offset info"
  xfrm: fix xfrm_do_migrate() with AEAD e.g(AES-GCM)
  btrfs: Take trans lock before access running trans in check_delayed_ref
  xfrm: Use __skb_queue_tail in xfrm_trans_queue
  scsi: aacraid: Correct hba_send to include iu_type
  udp: fix SO_BINDTODEVICE
  nsh: fix infinite loop
  net/mlx5e: Allow offloading ipv4 header re-write for icmp
  ipv6: fix uninit-value in ip6_multipath_l3_keys()
  hv_netvsc: set master device
  net/mlx5: Avoid cleaning flow steering table twice during error flow
  net/mlx5e: TX, Use correct counter in dma_map error flow
  net: sched: fix error path in tcf_proto_create() when modules are not configured
  bonding: send learning packets for vlans on slave
  bonding: do not allow rlb updates to invalid mac
  tg3: Fix vunmap() BUG_ON() triggered from tg3_free_consistent().
  tcp: ignore Fast Open on repair mode
  tcp_bbr: fix to zero idle_restart only upon S/ACKed data
  sctp: use the old asoc when making the cookie-ack chunk in dupcook_d
  sctp: remove sctp_chunk_put from fail_mark err path in sctp_ulpevent_make_rcvmsg
  sctp: handle two v4 addrs comparison in sctp_inet6_cmp_addr
  sctp: fix the issue that the cookie-ack with auth can't get processed
  sctp: delay the authentication for the duplicated cookie-echo chunk
  rds: do not leak kernel memory to user land
  r8169: fix powering up RTL8168h
  qmi_wwan: do not steal interfaces from class drivers
  openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found
  net/tls: Fix connection stall on partial tls record
  net/tls: Don't recursively call push_record during tls_write_space callbacks
  net: support compat 64-bit time in {s,g}etsockopt
  net_sched: fq: take care of throttled flows before reuse
  net sched actions: fix refcnt leak in skbmod
  net/mlx5: E-Switch, Include VF RDMA stats in vport statistics
  net/mlx5e: Err if asked to offload TC match on frag being first
  net/mlx4_en: Verify coalescing parameters are in range
  net/mlx4_en: Fix an error handling path in 'mlx4_en_init_netdev()'
  net: ethernet: ti: cpsw: fix packet leaking in dual_mac mode
  net: ethernet: sun: niu set correct packet size in skb
  llc: better deal with too small mtu
  ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg
  ipv4: fix fnhe usage by non-cached routes
  dccp: fix tasklet usage
  bridge: check iface upper dev when setting master via ioctl
  8139too: Use disable_irq_nosync() in rtl8139_poll_controller()
  ANDROID: sdcardfs: Don't d_drop in d_revalidate
  FROMLIST: brcmfmac: fix initialization of struct cfg80211_inform_bss variable
  FROMLIST: brcmfmac: reports boottime_ns while informing bss

Change-Id: I43c27b71b153a2a87070de3ea393002769856960
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-05-22 13:21:39 -07:00
Ross Zwisler
572e2385ae radix tree: fix multi-order iteration race 
commit 9f418224e8114156d995b98fa4e0f4fd21f685fe upstream.

Fix a race in the multi-order iteration code which causes the kernel to
hit a GP fault.  This was first seen with a production v4.15 based
kernel (4.15.6-300.fc27.x86_64) utilizing a DAX workload which used
order 9 PMD DAX entries.

The race has to do with how we tear down multi-order sibling entries
when we are removing an item from the tree.  Remember for example that
an order 2 entry looks like this:

  struct radix_tree_node.slots[] = [entry][sibling][sibling][sibling]

where 'entry' is in some slot in the struct radix_tree_node, and the
three slots following 'entry' contain sibling pointers which point back
to 'entry.'

When we delete 'entry' from the tree, we call :

  radix_tree_delete()
    radix_tree_delete_item()
      __radix_tree_delete()
        replace_slot()

replace_slot() first removes the siblings in order from the first to the
last, then at then replaces 'entry' with NULL.  This means that for a
brief period of time we end up with one or more of the siblings removed,
so:

  struct radix_tree_node.slots[] = [entry][NULL][sibling][sibling]

This causes an issue if you have a reader iterating over the slots in
the tree via radix_tree_for_each_slot() while only under
rcu_read_lock()/rcu_read_unlock() protection.  This is a common case in
mm/filemap.c.

The issue is that when __radix_tree_next_slot() => skip_siblings() tries
to skip over the sibling entries in the slots, it currently does so with
an exact match on the slot directly preceding our current slot.
Normally this works:

                                      V preceding slot
  struct radix_tree_node.slots[] = [entry][sibling][sibling][sibling]
                                              ^ current slot

This lets you find the first sibling, and you skip them all in order.

But in the case where one of the siblings is NULL, that slot is skipped
and then our sibling detection is interrupted:

                                             V preceding slot
  struct radix_tree_node.slots[] = [entry][NULL][sibling][sibling]
                                                    ^ current slot

This means that the sibling pointers aren't recognized since they point
all the way back to 'entry', so we think that they are normal internal
radix tree pointers.  This causes us to think we need to walk down to a
struct radix_tree_node starting at the address of 'entry'.

In a real running kernel this will crash the thread with a GP fault when
you try and dereference the slots in your broken node starting at
'entry'.

We fix this race by fixing the way that skip_siblings() detects sibling
nodes.  Instead of testing against the preceding slot we instead look
for siblings via is_sibling_entry() which compares against the position
of the struct radix_tree_node.slots[] array.  This ensures that sibling
entries are properly identified, even if they are no longer contiguous
with the 'entry' they point to.

Link: http://lkml.kernel.org/r/20180503192430.7582-6-ross.zwisler@linux.intel.com
Fixes: 148deab223b2 ("radix-tree: improve multiorder iterators")
Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com>
Reported-by: CR, Sapthagirish <sapthagirish.cr@intel.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Chinner <david@fromorbit.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-05-22 18:53:58 +02:00
Matthew Wilcox
f6c0f020ee lib/test_bitmap.c: fix bitmap optimisation tests to report errors correctly 
commit 1e3054b98c5415d5cb5f8824fc33b548ae5644c3 upstream.

I had neglected to increment the error counter when the tests failed,
which made the tests noisy when they fail, but not actually return an
error code.

Link: http://lkml.kernel.org/r/20180509114328.9887-1-mpe@ellerman.id.au
Fixes: 3cc78125a081 ("lib/test_bitmap.c: add optimisation tests")
Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Reported-by: Michael Ellerman <mpe@ellerman.id.au>
Tested-by: Michael Ellerman <mpe@ellerman.id.au>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: Yury Norov <ynorov@caviumnetworks.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: <stable@vger.kernel.org>	[4.13+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-05-22 18:53:58 +02:00
Blagovest Kolenichev
f4d73128a3 Merge android-4.14.41 (04f740d) into msm-4.14 
* refs/heads/tmp-04f740d
  Linux 4.14.41
  KVM: x86: remove APIC Timer periodic/oneshot spikes
  KVM: PPC: Book3S HV: Fix handling of large pages in radix page fault handler
  perf/x86: Fix possible Spectre-v1 indexing for x86_pmu::event_map()
  perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[]
  perf/x86/msr: Fix possible Spectre-v1 indexing in the MSR driver
  perf/x86/cstate: Fix possible Spectre-v1 indexing for pkg_msr
  perf/x86: Fix possible Spectre-v1 indexing for hw_perf_event cache_*
  tracing/uprobe_event: Fix strncpy corner case
  sched/autogroup: Fix possible Spectre-v1 indexing for sched_prio_to_weight[]
  smb3: directory sync should not return an error
  nvme: add quirk to force medium priority for SQ creation
  thermal: exynos: Propagate error value from tmu_read()
  thermal: exynos: Reading temperature makes sense only when TMU is turned on
  Bluetooth: btusb: Only check needs_reset_resume DMI table for QCA rome chipsets
  Bluetooth: btusb: Add Dell XPS 13 9360 to btusb_needs_reset_resume_table
  Revert "Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174"
  cpufreq: schedutil: Avoid using invalid next_freq
  PCI / PM: Check device_may_wakeup() in pci_enable_wake()
  PCI / PM: Always check PME wakeup capability for runtime wakeup support
  atm: zatm: Fix potential Spectre v1
  net: atm: Fix potential Spectre v1
  drm/atomic: Clean private obj old_state/new_state in drm_atomic_state_default_clear()
  drm/atomic: Clean old_state/new_state in drm_atomic_state_default_clear()
  drm/nouveau: Fix deadlock in nv50_mstm_register_connector()
  drm/i915: Fix drm:intel_enable_lvds ERROR message in kernel log
  drm/vc4: Fix scaling of uni-planar formats
  can: hi311x: Work around TX complete interrupt erratum
  can: hi311x: Acquire SPI lock on ->do_get_berr_counter
  can: kvaser_usb: Increase correct stats counter in kvaser_usb_rx_can_msg()
  ceph: fix rsize/wsize capping in ceph_direct_read_write()
  mm, oom: fix concurrent munlock and oom reaper unmap, v3
  mm: sections are not offlined during memory hotremove
  z3fold: fix reclaim lock-ups
  tracing: Fix regex_match_front() to not over compare the test string
  dm integrity: use kvfree for kvmalloc'd memory
  libata: Apply NOLPM quirk for SanDisk SD7UB3Q*G1001 SSDs
  rfkill: gpio: fix memory leak in probe error path
  gpio: fix error path in lineevent_create
  gpio: fix aspeed_gpio unmask irq
  gpioib: do not free unrequested descriptors
  compat: fix 4-byte infoleak via uninitialized struct field
  arm64: Add work around for Arm Cortex-A55 Erratum 1024718
  KVM: PPC: Book3S HV: Fix VRMA initialization with 2MB or 1GB memory backing
  KVM: PPC: Book3S HV: Fix guest time accounting with VIRT_CPU_ACCOUNTING_GEN
  KVM: PPC: Book3S HV: Fix trap number return from __kvmppc_vcore_entry
  bdi: Fix oops in wb_workfn()
  bdi: wake up concurrent wb_shutdown() callers.
  tcp: fix TCP_REPAIR_QUEUE bound checking
  perf: Remove superfluous allocation error check
  memcg: fix per_node_info cleanup
  inetpeer: fix uninit-value in inet_getpeer
  soreuseport: initialise timewait reuseport field
  ipv4: fix uninit-value in ip_route_output_key_hash_rcu()
  dccp: initialize ireq->ir_mark
  net: fix uninit-value in __hw_addr_add_ex()
  net: initialize skb->peeked when cloning
  net: fix rtnh_ok()
  netlink: fix uninit-value in netlink_sendmsg
  crypto: af_alg - fix possible uninit-value in alg_bind()
  kcm: Call strp_stop before strp_done in kcm_attach
  netfilter: ebtables: don't attempt to allocate 0-sized compat array
  ipvs: fix rtnl_lock lockups caused by start_sync_thread
  ANDROID: goldfish: drop CONFIG_INPUT_KEYCHORD
  Linux 4.14.40
  tracing: Fix bad use of igrab in trace_uprobe.c
  irqchip/qcom: Fix check for spurious interrupts
  platform/x86: asus-wireless: Fix NULL pointer dereference
  usb: musb: trace: fix NULL pointer dereference in musb_g_tx()
  usb: musb: host: fix potential NULL pointer dereference
  USB: serial: option: adding support for ublox R410M
  USB: serial: option: reimplement interface masking
  USB: Accept bulk endpoints with 1024-byte maxpacket
  usb: dwc3: gadget: Fix list_del corruption in dwc3_ep_dequeue
  USB: serial: visor: handle potential invalid device configuration
  errseq: Always report a writeback error once
  test_firmware: fix setting old custom fw path back on exit, second try
  drm/bridge: vga-dac: Fix edid memory leak
  drm/vmwgfx: Fix a buffer object leak
  iw_cxgb4: Atomically flush per QP HW CQEs
  IB/hfi1: Fix NULL pointer dereference when invalid num_vls is used
  IB/hfi1: Fix loss of BECN with AHG
  IB/hfi1: Fix handling of FECN marked multicast packet
  IB/mlx5: Use unlimited rate when static rate is not supported
  NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2
  RDMA/mlx5: Protect from shift operand overflow
  RDMA/mlx5: Fix multiple NULL-ptr deref errors in rereg_mr flow
  RDMA/ucma: Allow resolving address w/o specifying source address
  RDMA/cxgb4: release hw resources on device removal
  xfs: prevent creating negative-sized file via INSERT_RANGE
  rtlwifi: cleanup 8723be ant_sel definition
  rtlwifi: btcoex: Add power_on_setting routine
  Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro
  Input: leds - fix out of bound access
  scsi: target: Fix fortify_panic kernel exception
  tracepoint: Do not warn on ENOMEM
  ALSA: aloop: Add missing cable lock to ctl API callbacks
  ALSA: aloop: Mark paused device as inactive
  ALSA: dice: fix kernel NULL pointer dereference due to invalid calculation for array index
  ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger()
  ALSA: pcm: Check PCM state at xfern compat ioctl
  ALSA: hda - Fix incorrect usage of IS_REACHABLE()
  USB: serial: option: Add support for Quectel EP06
  ACPI / button: make module loadable when booted in non-ACPI mode
  crypto: talitos - fix IPsec cipher in length
  percpu: include linux/sched.h for cond_resched()
  net: don't call update_pmtu unconditionally
  geneve: update skb dst pmtu on tx path
  UPSTREAM: f2fs: avoid fsync() failure caused by EAGAIN in writepage()
  UPSTREAM: f2fs: clear PageError on writepage - part 2
  ANDROID: build.config: enforce trace_printk check
  FROMLIST: staging: Fix sparse warnings in vsoc driver.
  FROMLIST: staging: vsoc: Fix a i386-randconfig warning.
  FROMLIST: staging: vsoc: Create wc kernel mapping for region shm.

Change-Id: I697004775203b8bb5cace4fdf7e6489cfd32b54b
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-05-16 10:03:23 -07:00
Isaac J. Manjarres
7b6565dbcb lib: refcount: Cause kernel panic on refcount error detection 
Currently, when using the refcount API functions,
a warning is printed out once to let a user of
the refcount API know that an error case has been
detected. Then the refcount functions will
silently return, without modifying the reference count, which
could be mistaken for a successful modification. This can
allow for improper use of the object associated with that
refcount later. Trigger a kernel panic in case of refcount
error detection to prevent misuse of objects associated with
refcounts.

Change-Id: Ifb6a331d08a7d6c285225bc9667d2f4054db3561
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-05-09 22:53:15 -07:00
Matthew Wilcox
0799a0ea96 errseq: Always report a writeback error once 
commit b4678df184b314a2bd47d2329feca2c2534aa12b upstream.

The errseq_t infrastructure assumes that errors which occurred before
the file descriptor was opened are of no interest to the application.
This turns out to be a regression for some applications, notably Postgres.

Before errseq_t, a writeback error would be reported exactly once (as
long as the inode remained in memory), so Postgres could open a file,
call fsync() and find out whether there had been a writeback error on
that file from another process.

This patch changes the errseq infrastructure to report errors to all
file descriptors which are opened after the error occurred, but before
it was reported to any file descriptor.  This restores the user-visible
behaviour.

Cc: stable@vger.kernel.org
Fixes: 5660e13d2fd6 ("fs: new infrastructure for writeback error handling and reporting")
Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-05-09 09:51:54 +02:00
qctecmdr Service
8d86cfc2f3 Merge "Merge remote-tracking branch 'remotes/origin/tmp-c50e5cb' into msm-4.14" 2018-05-03 00:13:48 -07:00
Isaac J. Manjarres
8cfb73341f Merge remote-tracking branch 'remotes/origin/tmp-c50e5cb' into msm-4.14 
* remotes/origin/tmp-c50e5cb:
  Linux 4.14.39
  powerpc/eeh: Fix race with driver un/bind
  arm/arm64: KVM: Add PSCI version selection API
  tick/sched: Do not mess with an enqueued hrtimer
  x86/microcode: Do not exit early from __reload_late()
  x86/microcode/intel: Save microcode patch unconditionally
  x86/smpboot: Don't use mwait_play_dead() on AMD systems
  x86/ipc: Fix x32 version of shmid64_ds and msqid64_ds
  tools/lib/subcmd/pager.c: do not alias select() params
  objtool, perf: Fix GCC 8 -Wrestrict error
  drm/i915: Enable display WA#1183 from its correct spot
  drm/amdgpu: set COMPUTE_PGM_RSRC1 for SGPR/VGPR clearing shaders
  rtc: opal: Fix OPAL RTC driver OPAL_BUSY loops
  cpufreq: powernv: Fix hardlockup due to synchronous smp_call in timer interrupt
  earlycon: Use a pointer table to fix __earlycon_table stride
  fpga-manager: altera-ps-spi: preserve nCONFIG state
  libceph: validate con->state at the top of try_write()
  libceph: reschedule a tick in finish_hunting()
  libceph: un-backoff on tick when we have a authenticated session
  ASoC: fsl_esai: Fix divisor calculation failure at lower ratio
  crypto: drbg - set freed buffers to NULL
  powerpc/powernv/npu: Do a PID GPU TLB flush when invalidating a large address range
  powerpc/mm: Flush cache on memory hot(un)plug
  KVM: arm/arm64: Close VMID generation race
  ARM: socfpga_defconfig: Remove QSPI Sector 4K size force
  ARM: amba: Don't read past the end of sysfs "driver_override" buffer
  ARM: amba: Fix race condition with driver_override
  ARM: amba: Make driver_override output consistent with other buses
  PCI: aardvark: Fix PCIe Max Read Request Size setting
  PCI: aardvark: Use ISR1 instead of ISR0 interrupt in legacy irq mode
  PCI: aardvark: Set PIO_ADDR_LS correctly in advk_pcie_rd_conf()
  PCI: aardvark: Fix logic in advk_pcie_{rd,wr}_conf()
  ANDROID: binder: prevent transactions into own process.
  vfio: ccw: process ssch with interrupts disabled
  bfq-iosched: ensure to clear bic/bfqq pointers when preparing request
  scsi: sd: Defer spinning up drive while SANITIZE is in progress
  kobject: don't use WARN for registration failures
  mtd: rawnand: tango: Fix struct clk memory leak
  mtd: cfi: cmdset_0002: Do not allow read/write to suspend erase block.
  mtd: cfi: cmdset_0001: Workaround Micron Erase suspend bug.
  mtd: cfi: cmdset_0001: Do not allow read/write to suspend erase block.
  mtd: spi-nor: cadence-quadspi: Fix page fault kernel panic
  ALSA: hda/realtek - change the location for one of two front mics
  ALSA: hda/realtek - Update ALC255 depop optimize
  ALSA: hda/realtek - Add some fixes for ALC233
  ALSA: hda: Hardening for potential Spectre v1
  ALSA: seq: oss: Hardening for potential Spectre v1
  ALSA: seq: oss: Fix unbalanced use lock for synth MIDI device
  ALSA: core: Report audio_tstamp in snd_pcm_sync_ptr
  ALSA: pcm: Return negative delays from SNDRV_PCM_IOCTL_DELAY.
  ALSA: control: Hardening for potential Spectre v1
  ALSA: rme9652: Hardening for potential Spectre v1
  ALSA: hdspm: Hardening for potential Spectre v1
  ALSA: asihpi: Hardening for potential Spectre v1
  ALSA: opl3: Hardening for potential Spectre v1
  ALSA: hda - Skip jack and others for non-existing PCM streams
  ALSA: dice: fix error path to destroy initialized stream data
  ALSA: dice: fix OUI for TC group
  tty: Use __GFP_NOFAIL for tty_ldisc_get()
  tty: Avoid possible error pointer dereference at tty_ldisc_restore().
  tty: n_gsm: Fix DLCI handling for ADM mode if debug & 2 is not set
  tty: n_gsm: Fix long delays with control frame timeouts in ADM mode
  tty: Don't call panic() at tty_ldisc_init()
  drm/virtio: fix vq wait_event condition
  virtio_console: reset on out of memory
  virtio_console: move removal code
  virtio_console: drop custom control queue cleanup
  virtio_console: free buffers after reset
  virtio_console: don't tie bufs to a vq
  virtio: add ability to iterate over vqs
  ALSA: usb-audio: Skip broken EU on Dell dock USB-audio
  USB: Increment wakeup count on remote wakeup.
  usb: core: Add quirk for HP v222w 16GB Mini
  usb: typec: ucsi: Increase command completion timeout value
  USB: serial: cp210x: add ID for NI USB serial console
  USB: serial: ftdi_sio: use jtag quirk for Arrow USB Blaster
  USB: serial: simple: add libtransistor console
  xhci: Fix USB ports for Dell Inspiron 5775
  Revert "xhci: plat: Register shutdown for xhci_plat"
  usbip: vhci_hcd: check rhport before using in vhci_hub_control()
  usbip: vhci_hcd: Fix usb device and sockfd leaks
  usbip: usbip_host: fix to hold parent lock for device_attach() calls
  usbip: usbip_event: fix to not print kernel pointer address
  random: rate limit unseeded randomness warnings
  random: fix possible sleeping allocation from irq context
  random: set up the NUMA crng instances after the CRNG is fully initialized
  ext4: fix bitmap position validation
  ext4: add validity checks for bitmap block numbers
  ext4: add MODULE_SOFTDEP to ensure crc32c is included in the initramfs
  ext4: set h_journal if there is a failure starting a reserved handle
  ext4: prevent right-shifting extents beyond EXT_MAX_BLOCKS
  cfi: print target address on failure

Change-Id: I9a3d0c10b1a2d2c28872401cb656d490604352a7
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-05-02 14:08:33 -07:00
Matt Wagantall
6499baf92d exit: Add PANIC_ON_RECURSIVE_FAULT Kconfig option 
If a recursive fault is detected during do_exit(), tasks are left
to sit and wait in an un-interruptible sleep until the system
reboots (typically manually). Add Kconfig option to change this
behaviour and force a panic.

This is particularly important if a critical system task encounters
a recursive fault (ex. a kworker). Otherwise, the system may be
unusable, but since the scheduler is still running system watchdogs
may continue to be pet.

Change-Id: Ifc26fc79d6066f05a3b2c4d27f78bf4f8d2bd640
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
 2018-05-01 14:17:04 -07:00
Dmitry Vyukov
a5f4276787 kobject: don't use WARN for registration failures 
commit 3e14c6abbfb5c94506edda9d8e2c145d79375798 upstream.

This WARNING proved to be noisy. The function still returns an error
and callers should handle it. That's how most of kernel code works.
Downgrade the WARNING to pr_err() and leave WARNINGs for kernel bugs.

Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Reported-by: syzbot+209c0f67f99fec8eb14b@syzkaller.appspotmail.com
Reported-by: syzbot+7fb6d9525a4528104e05@syzkaller.appspotmail.com
Reported-by: syzbot+2e63711063e2d8f9ea27@syzkaller.appspotmail.com
Reported-by: syzbot+de73361ee4971b6e6f75@syzkaller.appspotmail.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-05-01 12:58:19 -07:00
Isaac J. Manjarres
4f5d011e6d Merge remote-tracking branch 'remotes/origin/tmp-bb60f28' into msm-4.14 
* remotes/origin/tmp-bb60f28:
  Linux 4.14.37
  mac80211_hwsim: fix use-after-free bug in hwsim_exit_net
  Revert "KVM: X86: Fix SMRAM accessing even if VM is shutdown"
  RDMA/mlx5: Fix NULL dereference while accessing XRC_TGT QPs
  perf: Return proper values for user stack errors
  perf: Fix sample_max_stack maximum check
  netfilter: x_tables: limit allocation requests for blob rule heads
  netfilter: compat: reject huge allocation requests
  netfilter: compat: prepare xt_compat_init_offsets to return errors
  netfilter: x_tables: add counters allocation wrapper
  netfilter: x_tables: cap allocations at 512 mbyte
  alarmtimer: Init nanosleep alarm timer on stack
  RDMA/core: Reduce poll batch for direct cq polling
  irqchip/gic-v3: Change pr_debug message to pr_devel
  cpumask: Make for_each_cpu_wrap() available on UP as well
  irqchip/gic-v3: Ignore disabled ITS nodes
  perf test: Fix test trace+probe_libc_inet_pton.sh for s390x
  powerpc/powernv: IMC fix out of bounds memory access at shutdown
  locking/qspinlock: Ensure node->count is updated before initialising node
  x86/platform/UV: Fix GAM Range Table entries less than 1GB
  powerpc/mm/hash64: Zero PGD pages on allocation
  vfs/proc/kcore, x86/mm/kcore: Fix SMAP fault when dumping vsyscall user page
  PM / wakeirq: Fix unbalanced IRQ enable for wakeirq
  ACPI / EC: Restore polling during noirq suspend/resume phases
  bpf: fix rlimit in reuseport net selftest
  net: stmmac: discard disabled flags in interrupt status register
  SUNRPC: Don't call __UDPX_INC_STATS() from a preemptible context
  KVM: PPC: Book3S HV: Fix handling of secondary HPTEG in HPT resizing code
  tools/libbpf: handle issues with bpf ELF objects containing .eh_frames
  net: Extra '_get' in declaration of arch_get_platform_mac_address
  svcrdma: Fix Read chunk round-up
  rxrpc: Don't put crypto buffers on the stack
  selftests/ftrace: Add some missing glob checks
  cpufreq: intel_pstate: Enable HWP during system resume on CPU0
  bcache: return attach error when no cache set exist
  bcache: fix for data collapse after re-attaching an attached device
  bcache: fix for allocator and register thread race
  bcache: properly set task state in bch_writeback_thread()
  cifs: silence compiler warnings showing up with gcc-8.0.0
  PM / domains: Fix up domain-idle-states OF parsing
  proc: fix /proc/*/map_files lookup
  arm64: spinlock: Fix theoretical trylock() A-B-A with LSE atomics
  RDS: IB: Fix null pointer issue
  bpf: sockmap, fix leaking maps with attached but not detached progs
  xen/grant-table: Use put_page instead of free_page
  xen-netfront: Fix race between device setup and open
  perf evsel: Fix period/freq terms setup
  MIPS: Generic: Support GIC in EIC mode
  perf record: Fix period option handling
  MIPS: TXx9: use IS_BUILTIN() for CONFIG_LEDS_CLASS
  bpf: fix selftests/bpf test_kmod.sh failure when CONFIG_BPF_JIT_ALWAYS_ON=y
  ACPI / scan: Use acpi_bus_get_status() to initialize ACPI_TYPE_DEVICE devs
  ACPI / bus: Do not call _STA on battery devices with unmet dependencies
  ACPI: processor_perflib: Do not send _PPC change notification if not ready
  firmware: dmi_scan: Fix handling of empty DMI strings
  x86/dumpstack: Avoid uninitlized variable
  x86/power: Fix swsusp_arch_resume prototype
  netfilter: ipv6: nf_defrag: Kill frag queue on RFC2460 failure
  s390/eadm: fix CONFIG_BLOCK include dependency
  drm/nouveau/pmu/fuc: don't use movw directly anymore
  IB/core: Map iWarp AH type to undefined in rdma_ah_find_type
  IB/ipoib: Fix for potential no-carrier state
  IB/hfi1: Fix for potential refcount leak in hfi1_open_file()
  IB/hfi1: Re-order IRQ cleanup to address driver cleanup race
  blk-mq: fix discard merge with scheduler attached
  openvswitch: Remove padding from packet before L3+ conntrack processing
  mm/fadvise: discard partial page if endbyte is also EOF
  mm: pin address_space before dereferencing it while isolating an LRU page
  mm: thp: use down_read_trylock() in khugepaged to avoid long block
  sparc64: update pmdp_invalidate() to return old pmd value
  asm-generic: provide generic_pmdp_establish()
  mm/mempolicy: add nodes_empty check in SYSC_migrate_pages
  mm/mempolicy: fix the check of nodemask from user
  ocfs2: return error when we attempt to access a dirty bh in jbd2
  ocfs2/acl: use 'ip_xattr_sem' to protect getting extended attribute
  ocfs2: return -EROFS to mount.ocfs2 if inode block is invalid
  fs/dax.c: release PMD lock even when there is no PMD support in DAX
  x86/kvm/vmx: do not use vm-exit instruction length for fast MMIO when running nested
  kvm: Map PFN-type memory regions as writable (if possible)
  tcp_nv: fix potential integer overflow in tcpnv_acked
  netfilter: x_tables: fix pointer leaks to userspace
  x86/hyperv: Check for required priviliges in hyperv_init()
  gianfar: prevent integer wrapping in the rx handler
  ntb_transport: Fix bug with max_mw_size parameter
  RDMA/mlx5: Avoid memory leak in case of XRCD dealloc failure
  powerpc/numa: Ensure nodes initialized for hotplug
  powerpc/numa: Use ibm,max-associativity-domains to discover possible nodes
  samples/bpf: Partially fixes the bpf.o build
  i40e: fix reported mask for ntuple filters
  i40e: program fragmented IPv4 filter input set
  ixgbe: don't set RXDCTL.RLPML for 82599
  jffs2: Fix use-after-free bug in jffs2_iget()'s error handling path
  RDMA/uverbs: Use an unambiguous errno for method not supported
  crypto: artpec6 - remove select on non-existing CRYPTO_SHA384
  device property: Define type of PROPERTY_ENRTY_*() macros
  tty: serial: exar: Relocate sleep wake-up handling
  x86/hyperv: Stop suppressing X86_FEATURE_PCID
  fm10k: fix "failed to kill vid" message for VF
  igb: Clear TXSTMP when ptp_tx_work() is timeout
  igb: Allow to remove administratively set MAC on VFs
  ASoC: rockchip: Use dummy_dai for rt5514 dsp dailink
  blk-mq-debugfs: don't allow write on attributes with seq_operations set
  KVM: s390: vsie: use READ_ONCE to access some SCB fields
  platform/x86: thinkpad_acpi: suppress warning about palm detection
  i40evf: ignore link up if not running
  i40evf: Don't schedule reset_task when device is being removed
  bpf: test_maps: cleanup sockmaps when test ends
  block: Set BIO_TRACE_COMPLETION on new bio during split
  nfp: fix error return code in nfp_pci_probe()
  HID: roccat: prevent an out of bounds read in kovaplus_profile_activated()
  Input: stmfts - set IRQ_NOAUTOEN to the irq flag
  scsi: fas216: fix sense buffer initialization
  scsi: devinfo: fix format of the device list
  f2fs: avoid hungtask when GC encrypted block if io_bits is set
  RDMA/cma: Check existence of netdevice during port validation
  Btrfs: raid56: fix race between merge_bio and rbio_orig_end_io
  Btrfs: fix unexpected EEXIST from btrfs_get_extent
  btrfs: fail mount when sb flag is not in BTRFS_SUPER_FLAG_SUPP
  Btrfs: fix scrub to repair raid6 corruption
  btrfs: Fix out of bounds access in btrfs_search_slot
  Btrfs: set plug for fsync
  ipmi/powernv: Fix error return code in ipmi_powernv_probe()
  mac80211_hwsim: fix possible memory leak in hwsim_new_radio_nl()
  kconfig: Fix expr_free() E_NOT leak
  kconfig: Fix automatic menu creation mem leak
  kconfig: Don't leak main menus during parsing
  watchdog: sp5100_tco: Fix watchdog disable bit
  PCI: Add dummy pci_irqd_intx_xlate() for CONFIG_PCI=n build
  MIPS: Fix clean of vmlinuz.{32,ecoff,bin,srec}
  nfs: Do not convert nfs_idmap_cache_timeout to jiffies
  IB/cq: Don't force IB_POLL_DIRECT poll context for ib_process_cq_direct
  spi: a3700: Clear DATA_OUT when performing a read
  net: stmmac: dwmac-meson8b: propagate rate changes to the parent clock
  net: stmmac: dwmac-meson8b: fix setting the RGMII TX clock on Meson8b
  ubifs: Fix uninitialized variable in search_dh_cookie()
  blk-mq: turn WARN_ON in __blk_mq_run_hw_queue into printk
  dm mpath: return DM_MAPIO_REQUEUE on blk-mq rq allocation failure
  dm thin: fix documentation relative to low water mark threshold
  iommu/vt-d: Use domain instead of cache fetching
  powerpc: System reset avoid interleaving oops using die synchronisation
  iommu/exynos: Don't unconditionally steal bus ops
  perf record: Fix failed memory allocation for get_cpuid_str
  tools lib traceevent: Fix get_field_str() for dynamic strings
  perf callchain: Fix attr.sample_max_stack setting
  tools lib traceevent: Simplify pointer print logic and fix %pF
  perf unwind: Do not look just at the global callchain_param.record_mode
  scsi: qla2xxx: Fix warning in qla2x00_async_iocb_timeout()
  i40iw: Zero-out consumer key on allocate stag for FMR
  i40iw: Free IEQ resources
  Input: synaptics - reset the ABS_X/Y fuzz after initializing MT axes
  libbpf: Makefile set specified permission mode
  Input: psmouse - fix Synaptics detection when protocol is disabled
  PCI: Add function 1 DMA alias quirk for Marvell 9128
  selftest: ftrace: Fix to pick text symbols for kprobes
  xprtrdma: Fix backchannel allocation of extra rpcrdma_reps
  platform/x86: dell-laptop: Filter out spurious keyboard backlight change events
  KVM: s390: use created_vcpus in more places
  tracing/hrtimer: Fix tracing bugs by taking all clock bases and modes into account
  netfilter: ipv6: nf_defrag: Pass on packets to stack per RFC2460
  KVM: PPC: Book3S HV: Enable migration of decrementer register
  RDMA/core: Clarify rdma_ah_find_type
  kvm: x86: fix KVM_XEN_HVM_CONFIG ioctl
  ASoC: au1x: Fix timeout tests in au1xac97c_ac97_read()
  ALSA: hda - Use IS_REACHABLE() for dependency on input
  ACPI / LPSS: Do not instiate platform_dev for devs without MMIO resources
  NFSv4: always set NFS_LOCK_LOST when a lock is lost.
  x86/tsc: Allow TSC calibration without PIT
  firewire-ohci: work around oversized DMA reads on JMicron controllers
  usb: musb: Fix external abort in musb_remove on omap2430
  usb: musb: call pm_runtime_{get,put}_sync before reading vbus registers
  usb: musb: fix enumeration after resume
  drm/i915/bxt, glk: Increase PCODE timeouts during CDCLK freq changing
  drm/i915: Fix LSPCON TMDS output buffer enabling from low-power state
  drm/i915: Do no use kfree() to free a kmem_cache_alloc() return value
  drm/i915/audio: Fix audio detection issue on GLK
  drm/i915/gvt: throw error on unhandled vfio ioctls
  drm/vc4: Fix memory leak during BO teardown
  x86/tsc: Prevent 32bit truncation in calc_hpet_ref()
  clocksource/imx-tpm: Correct -ETIME return condition check
  x86/acpi: Prevent X2APIC id 0xffffffff from being accounted
  btrfs: fix unaligned access in readdir
  cifs: do not allow creating sockets except with SMB1 posix exensions
  UPSTREAM: module: Do not paper over type mismatches in module_param_call()
  UPSTREAM: treewide: Fix function prototypes for module_param_call()
  UPSTREAM: module: Prepare to convert all module_param_call() prototypes
  UPSTREAM: kbuild: add clang-version.sh
  UPSTREAM: console: Expand dummy functions for CFI
  UPSTREAM: console: SisUSB2VGA: Drop dummy con_font_get()
  ANDROID: sdcardfs: Set s_root to NULL after putting
  ANDROID: sdcardfs: d_make_root calls iput
  ANDROID: sdcardfs: Check for private data earlier
  ANDROID: sched: Remove duplicate const specifier

Conflicts:
	kernel/sched/sched.h

Change in module_param_call() definition requires alignment in:

	drivers/hwtracing/coresight/coresight-event.c
	drivers/power/reset/msm-poweroff.c

Change-Id: I0114d2226301af0b1775b37d79db5529653b135d
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-04-26 10:14:52 -07:00
Yonghong Song
3e01c16d87 bpf: fix selftests/bpf test_kmod.sh failure when CONFIG_BPF_JIT_ALWAYS_ON=y 
[ Upstream commit 09584b406742413ac4c8d7e030374d4daa045b69 ]

With CONFIG_BPF_JIT_ALWAYS_ON is defined in the config file,
tools/testing/selftests/bpf/test_kmod.sh failed like below:
  [root@localhost bpf]# ./test_kmod.sh
  sysctl: setting key "net.core.bpf_jit_enable": Invalid argument
  [ JIT enabled:0 hardened:0 ]
  [  132.175681] test_bpf: #297 BPF_MAXINSNS: Jump, gap, jump, ... FAIL to prog_create err=-524 len=4096
  [  132.458834] test_bpf: Summary: 348 PASSED, 1 FAILED, [340/340 JIT'ed]
  [ JIT enabled:1 hardened:0 ]
  [  133.456025] test_bpf: #297 BPF_MAXINSNS: Jump, gap, jump, ... FAIL to prog_create err=-524 len=4096
  [  133.730935] test_bpf: Summary: 348 PASSED, 1 FAILED, [340/340 JIT'ed]
  [ JIT enabled:1 hardened:1 ]
  [  134.769730] test_bpf: #297 BPF_MAXINSNS: Jump, gap, jump, ... FAIL to prog_create err=-524 len=4096
  [  135.050864] test_bpf: Summary: 348 PASSED, 1 FAILED, [340/340 JIT'ed]
  [ JIT enabled:1 hardened:2 ]
  [  136.442882] test_bpf: #297 BPF_MAXINSNS: Jump, gap, jump, ... FAIL to prog_create err=-524 len=4096
  [  136.821810] test_bpf: Summary: 348 PASSED, 1 FAILED, [340/340 JIT'ed]
  [root@localhost bpf]#

The test_kmod.sh load/remove test_bpf.ko multiple times with different
settings for sysctl net.core.bpf_jit_{enable,harden}. The failed test #297
of test_bpf.ko is designed such that JIT always fails.

Commit 290af86629b2 (bpf: introduce BPF_JIT_ALWAYS_ON config)
introduced the following tightening logic:
    ...
        if (!bpf_prog_is_dev_bound(fp->aux)) {
                fp = bpf_int_jit_compile(fp);
    #ifdef CONFIG_BPF_JIT_ALWAYS_ON
                if (!fp->jited) {
                        *err = -ENOTSUPP;
                        return fp;
                }
    #endif
    ...
With this logic, Test #297 always gets return value -ENOTSUPP
when CONFIG_BPF_JIT_ALWAYS_ON is defined, causing the test failure.

This patch fixed the failure by marking Test #297 as expected failure
when CONFIG_BPF_JIT_ALWAYS_ON is defined.

Fixes: 290af86629b2 (bpf: introduce BPF_JIT_ALWAYS_ON config)
Signed-off-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-04-26 11:02:16 +02:00
Blagovest Kolenichev
bce6a97741 Merge android-4.14.35 (07e1389) into msm-4.14 
* refs/heads/tmp-07e1389
  Linux 4.14.35
  nfsd: fix incorrect umasks
  hugetlbfs: fix bug in pgoff overflow checking
  xen: xenbus_dev_frontend: Fix XS_TRANSACTION_END handling
  ovl: fix lookup with middle layer opaque dir and absolute path redirects
  blk-mq: don't keep offline CPUs mapped to hctx 0
  lib: fix stall in __bitmap_parselist()
  f2fs: fix heap mode to reset it back
  sunrpc: remove incorrect HMAC request initialization
  ath9k: Protect queue draining by rcu_read_lock()
  hwmon: (ina2xx) Fix access to uninitialized mutex
  x86/mce/AMD: Get address from already initialized block
  x86/mce/AMD, EDAC/mce_amd: Enumerate Reserved SMCA bank type
  x86/mce/AMD: Pass the bank number to smca_get_bank_type()
  x86/MCE: Report only DRAM ECC as memory errors on AMD systems
  rtl8187: Fix NULL pointer dereference in priv->conf_mutex
  Bluetooth: hci_bcm: Treat Interrupt ACPI resources as always being active-low
  Bluetooth: Fix connection if directed advertising and privacy is used
  getname_kernel() needs to make sure that ->name != ->iname in long case
  get_user_pages_fast(): return -EFAULT on access_ok failure
  s390/ipl: ensure loadparm valid flag is set
  s390/qdio: don't merge ERROR output buffers
  s390/qdio: don't retry EQBS after CCQ 96
  nfit: fix region registration vs block-data-window ranges
  block/loop: fix deadlock after loop_set_status
  apparmor: fix resource audit messages when auditing peer
  apparmor: fix display of .ns_name for containers
  apparmor: fix logging of the existence test for signals
  scsi: qla2xxx: Fix small memory leak in qla2x00_probe_one on probe failure
  x86/MCE/AMD: Define a function to get SMCA bank type
  radeon: hide pointless #warning when compile testing
  perf/core: Fix use-after-free in uprobe_perf_close()
  perf intel-pt: Fix timestamp following overflow
  perf intel-pt: Fix error recovery from missing TIP packet
  perf intel-pt: Fix sync_switch
  perf intel-pt: Fix overlap detection to identify consecutive buffers correctly
  KVM: PPC: Book3S HV: trace_tlbie must not be called in realmode
  PCI: hv: Serialize the present and eject work items
  Drivers: hv: vmbus: do not mark HV_PCIE as perf_device
  parisc: Fix HPMC handler by increasing size to multiple of 16 bytes
  parisc: Fix out of array access in match_pci_device()
  media: v4l: vsp1: Fix header display list status check in continuous mode
  media: v4l2-compat-ioctl32: don't oops on overlay
  lan78xx: Correctly indicate invalid OTP
  vhost: Fix vhost_copy_to_user()
  vhost: fix vhost_vq_access_ok() log check
  slip: Check if rstate is initialized before uncompressing
  rds: MP-RDS may use an invalid c_path
  cdc_ether: flag the Cinterion AHS8 modem by gemalto as WWAN
  netfilter: ipset: Missing nfnl_lock()/nfnl_unlock() is added to ip_set_net_exit()
  ANDROID: Add build server config for cuttlefish.
  ANDROID: Add defconfig for cuttlefish.
  FROMLIST: staging: Android: Add 'vsoc' driver for cuttlefish.
  ANDROID: cpufreq: Add time_in_state to /proc/uid directories
  ANDROID: proc: Add /proc/uid directory
  ANDROID: cpufreq: times: track per-uid time in state
  ANDROID: cpufreq: track per-task time in state
  f2fs/fscrypt: updates to v4.17-rc1

Change-Id: I0fdc9762e63ff9a9abb25e6adea0c723e517a2a6
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-04-19 08:58:41 -07:00
Yury Norov
a333a284ff lib: fix stall in __bitmap_parselist() 
commit 8351760ff5b2042039554b4948ddabaac644a976 upstream.

syzbot is catching stalls at __bitmap_parselist()
(https://syzkaller.appspot.com/bug?id=ad7e0351fbc90535558514a71cd3edc11681997a).
The trigger is

  unsigned long v = 0;
  bitmap_parselist("7:,", &v, BITS_PER_LONG);

which results in hitting infinite loop at

    while (a <= b) {
	    off = min(b - a + 1, used_size);
	    bitmap_set(maskp, a, off);
	    a += group_size;
    }

due to used_size == group_size == 0.

Link: http://lkml.kernel.org/r/20180404162647.15763-1-ynorov@caviumnetworks.com
Fixes: 0a5ce0831d04382a ("lib/bitmap.c: make bitmap_parselist() thread-safe and much faster")
Signed-off-by: Yury Norov <ynorov@caviumnetworks.com>
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: syzbot <syzbot+6887cbb011c8054e8a3d@syzkaller.appspotmail.com>
Cc: Noam Camus <noamca@mellanox.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Matthew Wilcox <mawilcox@microsoft.com>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-04-19 08:56:20 +02:00
Isaac J. Manjarres
7ed7e2acf0 Merge remote-tracking branch 'remotes/origin/tmp-51e322a' into msm-4.14 
* remotes/origin/tmp-51e322a:
  Linux 4.14.32
  s390/qeth: on channel error, reject further cmd requests
  s390/qeth: lock read device while queueing next buffer
  s390/qeth: when thread completes, wake up all waiters
  s390/qeth: free netdevice when removing a card
  dpaa_eth: remove duplicate increment of the tx_errors counter
  dpaa_eth: increment the RX dropped counter when needed
  dpaa_eth: remove duplicate initialization
  dpaa_eth: fix error in dpaa_remove()
  soc/fsl/qbman: fix issue in qman_delete_cgr_safe()
  team: Fix double free in error path
  skbuff: Fix not waking applications when errors are enqueued
  qede: Fix qedr link update
  net: systemport: Rewrite __bcm_sysport_tx_reclaim()
  net: Only honor ifindex in IP_PKTINFO if non-0
  netlink: avoid a double skb free in genlmsg_mcast()
  net/iucv: Free memory obtained by kzalloc
  net: fec: Fix unbalanced PM runtime calls
  net: ethernet: ti: cpsw: add check for in-band mode setting with RGMII PHY interface
  net: ethernet: arc: Fix a potential memory leak if an optional regulator is deferred
  l2tp: do not accept arbitrary sockets
  ipv6: fix access to non-linear packet in ndisc_fill_redirect_hdr_option()
  dccp: check sk for closed state in dccp_sendmsg()
  net: Fix hlist corruptions in inet_evict_bucket()
  net: use skb_to_full_sk() in skb_update_prio()
  ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()
  sch_netem: fix skb leak in netem_enqueue()
  kcm: lock lower socket in kcm_attach
  rhashtable: Fix rhlist duplicates insertion
  ppp: avoid loop in xmit recursion detection code
  net sched actions: return explicit error when tunnel_key mode is not specified
  net: phy: Tell caller result of phy_change()
  mlxsw: spectrum_buffers: Set a minimum quota for CPU port traffic
  ipv6: sr: fix scheduling in RCU when creating seg6 lwtunnel state
  ipv6: sr: fix NULL pointer dereference when setting encap source address
  ipv6: old_dport should be a __be16 in __ip6_datagram_connect()
  net: ipv6: keep sk status consistent after datagram connect failure
  macvlan: filter out unsupported feature flags
  devlink: Remove redundant free on error path
  net: phy: relax error checking when creating sysfs link netdev->phydev
  sysfs: symlink: export sysfs_create_link_nowarn()
  qed: Fix non TCP packets should be dropped on iWARP ll2 connection
  tcp: purge write queue upon aborting the connection
  tcp: reset sk_send_head in tcp_write_queue_purge

Change-Id: Ief39b9585daef847f0456cfe8fa70ba0178ea127
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-04-02 13:49:25 -07:00
Isaac J. Manjarres
976852dffe Merge remote-tracking branch 'remotes/origin/tmp-331d833' into msm-4.14 
* remotes/origin/tmp-331d833:
  Linux 4.14.31
  bpf, x64: increase number of passes
  bpf: skip unnecessary capability check
  kbuild: disable clang's default use of -fmerge-all-constants
  x86/pkeys/selftests: Rename 'si_pkey' to 'siginfo_pkey'
  usb: xhci: Fix potential memory leak in xhci_disable_slot()
  usb: xhci: Disable slot even when virt-dev is null
  staging: lustre: ptlrpc: kfree used instead of kvfree
  staging: android: ion: Zero CMA allocated memory
  iio: imu: st_lsm6dsx: fix endianness in st_lsm6dsx_read_oneshot()
  iio: ABI: Fix name of timestamp sysfs file
  perf/x86/intel/uncore: Fix multi-domain PCI CHA enumeration bug on Skylake servers
  perf/x86/intel: Don't accidentally clear high bits in bdw_limit_period()
  perf/core: Fix ctx_event_type in ctx_resched()
  perf stat: Fix CVS output format for non-supported counters
  perf/x86/intel/uncore: Fix Skylake UPI event format
  drm/syncobj: Stop reusing the same struct file for all syncobj -> fd
  x86/boot/64: Verify alignment of the LOAD segment
  x86/build/64: Force the linker to use 2MB page size
  kvm/x86: fix icebp instruction handling
  posix-timers: Protect posix clock array access against speculation
  x86/efi: Free efi_pgd with free_pages()
  x86/vsyscall/64: Use proper accessor to update P4D entry
  selftests/x86/ptrace_syscall: Fix for yet more glibc interference
  x86/entry/64: Don't use IST entry for #BP stack
  tty: vt: fix up tabstops properly
  can: cc770: Fix use after free in cc770_tx_interrupt()
  can: cc770: Fix queue stall & dropped RTR reply
  can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack
  can: ifi: Check core revision upon probe
  can: ifi: Repair the error handling
  can: peak/pcie_fd: remove useless code when interface starts
  can: peak/pcie_fd: fix echo_skb is occupied! bug
  staging: ncpfs: memory corruption in ncp_read_kernel()
  mtd: nand: fsl_ifc: Read ECCSTAT0 and ECCSTAT1 registers for IFC 2.0
  mtd: nand: fsl_ifc: Fix eccstat array overflow for IFC ver >= 2.0.0
  mtd: nand: fsl_ifc: Fix nand waitfunc return value
  mtdchar: fix usage of mtd_ooblayout_ecc()
  tracing: probeevent: Fix to support minus offset from symbol
  rtlwifi: rtl8723be: Fix loss of signal
  brcmfmac: fix P2P_DEVICE ethernet address generation
  libnvdimm, {btt, blk}: do integrity setup before add_disk()
  ACPI / watchdog: Fix off-by-one error at resource assignment
  acpi, numa: fix pxm to online numa node associations
  mm/vmscan: wake up flushers for legacy cgroups too
  drm: udl: Properly check framebuffer mmap offsets
  drm: Reject getfb for multi-plane framebuffers
  drm/radeon: Don't turn off DP sink when disconnected
  drm/vmwgfx: Fix a destoy-while-held mutex problem.
  drm/vmwgfx: Fix black screen and device errors when running without fbdev
  Revert "mm: page_alloc: skip over regions of invalid pfns where possible"
  mm/shmem: do not wait for lock_page() in shmem_unused_huge_shrink()
  mm/thp: do not wait for lock_page() in deferred_split_scan()
  mm/khugepaged.c: convert VM_BUG_ON() to collapse fail
  x86/mm: implement free pmd/pte page interfaces
  mm/vmalloc: add interfaces to free unmapped page table
  h8300: remove extraneous __BIG_ENDIAN definition
  hugetlbfs: check for pgoff value overflow
  nfsd: remove blocked locks on client teardown
  cgroup: fix rule checking for threaded mode switching
  libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version
  libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions
  libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs
  libata: Enable queued TRIM for Samsung SSD 860
  libata: disable LPM for Crucial BX100 SSD 500GB drive
  libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs
  libata: don't try to pass through NCQ commands to non-NCQ devices
  libata: remove WARN() for DMA or PIO command without data
  libata: fix length validation of ATAPI-relayed SCSI commands
  Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174
  Bluetooth: btusb: Add Dell OptiPlex 3060 to btusb_needs_reset_resume_table
  Bluetooth: btusb: Remove Yoga 920 from the btusb_needs_reset_resume_table
  pinctrl: samsung: Validate alias coming from DT
  Drivers: hv: vmbus: Fix ring buffer signaling
  RDMA/mlx5: Fix crash while accessing garbage pointer and freed memory
  clk: sunxi-ng: a31: Fix CLK_OUT_* clock ops
  clk: bcm2835: Protect sections updating shared registers
  clk: bcm2835: Fix ana->maskX definitions
  lockdep: fix fs_reclaim warning
  ahci: Add PCI-id for the Highpoint Rocketraid 644L card
  PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L
  mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs
  mmc: dw_mmc: exynos: fix the suspend/resume issue for exynos5433
  mmc: dw_mmc: Fix the DTO/CTO timeout overflow calculation for 32-bit systems
  mmc: block: fix updating ext_csd caches on ioctl call
  mmc: core: Disable HPI for certain Micron (Numonyx) eMMC cards
  mmc: core: Fix tracepoint print of blk_addr and blksz
  ALSA: hda/realtek - Always immediately update mute LED with pin VREF
  ALSA: hda/realtek - Fix Dell headset Mic can't record
  ALSA: hda/realtek - Fix speaker no sound after system resume
  ALSA: hda - Force polling mode on CFL for fixing codec communication
  ALSA: aloop: Fix access to not-yet-ready substream via cable
  ALSA: aloop: Sync stale timer before release
  ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit
  iio: adc: meson-saradc: unlock on error in meson_sar_adc_lock()
  iio: st_pressure: st_accel: pass correct platform data to init
  iio: chemical: ccs811: Corrected firmware boot/application mode transition
  MIPS: lantiq: ase: Enable MFD_SYSCON
  MIPS: lantiq: Enable AHB Bus for USB
  MIPS: lantiq: Fix Danube USB clock
  MIPS: ralink: Fix booting on MT7621
  MIPS: ralink: Remove ralink_halt()
  ANDROID: arm64: Image.gz-dtb build target depends on Image.gz

Conflicts:
	drivers/staging/android/ion/ion_cma_heap.c

Change-Id: I1ed32b5d3bcf4db15991859bdd89fed0d70fdb86
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-04-02 13:49:16 -07:00
Paul Blakey
07cf9d303c rhashtable: Fix rhlist duplicates insertion 
[ Upstream commit d3dcf8eb615537526bd42ff27a081d46d337816e ]

When inserting duplicate objects (those with the same key),
current rhlist implementation messes up the chain pointers by
updating the bucket pointer instead of prev next pointer to the
newly inserted node. This causes missing elements on removal and
travesal.

Fix that by properly updating pprev pointer to point to
the correct rhash_head next pointer.

Issue: 1241076
Change-Id: I86b2c140bcb4aeb10b70a72a267ff590bb2b17e7
Fixes: ca26893f05e8 ('rhashtable: Add rhlist interface')
Signed-off-by: Paul Blakey <paulb@mellanox.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-03-31 18:10:40 +02:00
Toshi Kani
acdb498164 mm/vmalloc: add interfaces to free unmapped page table 
commit b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e upstream.

On architectures with CONFIG_HAVE_ARCH_HUGE_VMAP set, ioremap() may
create pud/pmd mappings.  A kernel panic was observed on arm64 systems
with Cortex-A75 in the following steps as described by Hanjun Guo.

 1. ioremap a 4K size, valid page table will build,
 2. iounmap it, pte0 will set to 0;
 3. ioremap the same address with 2M size, pgd/pmd is unchanged,
    then set the a new value for pmd;
 4. pte0 is leaked;
 5. CPU may meet exception because the old pmd is still in TLB,
    which will lead to kernel panic.

This panic is not reproducible on x86.  INVLPG, called from iounmap,
purges all levels of entries associated with purged address on x86.  x86
still has memory leak.

The patch changes the ioremap path to free unmapped page table(s) since
doing so in the unmap path has the following issues:

 - The iounmap() path is shared with vunmap(). Since vmap() only
   supports pte mappings, making vunmap() to free a pte page is an
   overhead for regular vmap users as they do not need a pte page freed
   up.

 - Checking if all entries in a pte page are cleared in the unmap path
   is racy, and serializing this check is expensive.

 - The unmap path calls free_vmap_area_noflush() to do lazy TLB purges.
   Clearing a pud/pmd entry before the lazy TLB purges needs extra TLB
   purge.

Add two interfaces, pud_free_pmd_page() and pmd_free_pte_page(), which
clear a given pud/pmd entry and free up a page for the lower level
entries.

This patch implements their stub functions on x86 and arm64, which work
as workaround.

[akpm@linux-foundation.org: fix typo in pmd_free_pte_page() stub]
Link: http://lkml.kernel.org/r/20180314180155.19492-2-toshi.kani@hpe.com
Fixes: e61ce6ade404e ("mm: change ioremap to set up huge I/O mappings")
Reported-by: Lei Li <lious.lilei@hisilicon.com>
Signed-off-by: Toshi Kani <toshi.kani@hpe.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Wang Xuefeng <wxf.wang@hisilicon.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Hanjun Guo <guohanjun@huawei.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Chintan Pandya <cpandya@codeaurora.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-03-28 18:24:38 +02:00
Blagovest Kolenichev
24b2e60f51 Merge android-4.14.29 (45c8dbe) into msm-4.14 
* refs/heads/tmp-45c8dbe
  Linux 4.14.29
  usb: dwc3: Fix GDBGFIFOSPACE_TYPE values
  USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe()
  scsi: qla2xxx: Fix crashes in qla2x00_probe_one on probe failure
  scsi: qla2xxx: Fix logo flag for qlt_free_session_done()
  scsi: qla2xxx: Fix NULL pointer access for fcport structure
  scsi: qla2xxx: Fix smatch warning in qla25xx_delete_{rsp|req}_que
  btrfs: Fix memory barriers usage with device stats counters
  btrfs: remove spurious WARN_ON(ref->count < 0) in find_parent_nodes
  btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device
  btrfs: alloc_chunk: fix DUP stripe size handling
  btrfs: add missing initialization in btrfs_check_shared
  btrfs: Fix NULL pointer exception in find_bio_stripe
  irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis
  RDMAVT: Fix synchronization around percpu_ref
  fs/aio: Use RCU accessors for kioctx_table->table[]
  fs/aio: Add explicit RCU grace period when freeing kioctx
  lock_parent() needs to recheck if dentry got __dentry_kill'ed under it
  KVM: arm/arm64: vgic: Don't populate multiple LRs with the same vintid
  kvm: arm/arm64: vgic-v3: Tighten synchronization for guests using v2 on v3
  KVM: arm/arm64: Reduce verbosity of KVM init log
  fs: Teach path_connected to handle nfs filesystems with multiple roots.
  drm/amdgpu/dce: Don't turn off DP sink when disconnected
  drm/radeon: fix prime teardown order
  drm/amdgpu: fix prime teardown order
  drm/nouveau/bl: Fix oops on driver unbind
  ALSA: seq: Clear client entry before deleting else at closing
  ALSA: seq: Fix possible UAF in snd_seq_check_queue()
  ALSA: hda - Revert power_save option default value
  ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats()
  parisc: Handle case where flush_cache_range is called with no context
  x86/mm: Fix vmalloc_fault to use pXd_large
  KVM: x86: Fix device passthrough when SME is active
  x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist
  x86/speculation, objtool: Annotate indirect calls/jumps for objtool on 32-bit kernels
  x86/vm86/32: Fix POPF emulation
  selftests/x86/entry_from_vm86: Add test cases for POPF
  selftests/x86: Add tests for the STR and SLDT instructions
  selftests/x86: Add tests for User-Mode Instruction Prevention
  selftests/x86/entry_from_vm86: Exit with 1 if we fail
  x86/cpufeatures: Add Intel PCONFIG cpufeature
  x86/cpufeatures: Add Intel Total Memory Encryption cpufeature
  ANDROID: arm-smccc: fix clang build
  staging: android: ashmem: Fix possible deadlock in ashmem_ioctl
  Linux 4.14.28
  drm/i915/glk: Disable Guc and HuC on GLK
  dmaengine: qcom_hidma: check pending interrupts
  IB/mlx5: revisit -Wmaybe-uninitialized warning
  ima: relax requiring a file signature for new files with zero length
  locking/locktorture: Fix num reader/writer corner cases
  rcutorture/configinit: Fix build directory error message
  ipvlan: add L2 check for packets arriving via virtual devices
  Fix misannotated out-of-line _copy_to_user()
  mmc: mmc_test: Ensure command queue is disabled for testing
  ASoC: nuc900: Fix a loop timeout test
  crypto: caam/qi - use correct print specifier for size_t
  mac80211: remove BUG() when interface type is invalid
  mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED
  agp/intel: Flush all chipset writes after updating the GGTT
  arm64: dts: renesas: salvator-common: Add EthernetAVB PHY reset
  powerpc/64: Don't trace irqs-off at interrupt return to soft-disabled context
  powerpc/modules: Don't try to restore r2 after a sibling call
  drm/amdkfd: Fix memory leaks in kfd topology
  veth: set peer GSO values
  net: sched: drop qdisc_reset from dev_graft_qdisc
  virtio_net: Disable interrupts if napi_complete_done rescheduled napi
  media: davinci: vpif_capture: add NULL check on devm_kzalloc return value
  media: cpia2: Fix a couple off by one bugs
  dm raid: fix raid set size revalidation
  media: vsp1: Prevent suspending and resuming DRM pipelines
  scsi: dh: add new rdac devices
  scsi: devinfo: apply to HP XP the same flags as Hitachi VSP
  scsi: core: scsi_get_device_flags_keyed(): Always return device flags
  bnxt_en: Don't print "Link speed -1 no longer supported" messages.
  spi: sun6i: disable/unprepare clocks on remove
  tools/usbip: fixes build with musl libc toolchain
  ath10k: fix invalid STS_CAP_OFFSET_MASK
  mwifiex: cfg80211: do not change virtual interface during scan processing
  clk: qcom: msm8916: fix mnd_width for codec_digcodec
  drm/amdgpu:fix virtual dce bug
  iwlwifi: mvm: avoid dumping assert log when device is stopped
  perf annotate: Fix objdump comment parsing for Intel mov dissassembly
  perf annotate: Fix unnecessary memory allocation for s390x
  pinctrl: sh-pfc: r8a7795-es1: Fix MOD_SEL1 bit[25:24] to 0x3 when using STP_ISEN_1_D
  pinctrl: sh-pfc: r8a7791: Add can_clk function
  drm/sun4i: Fix format mask in DE2 driver
  pwm: stmpe: Fix wrong register offset for hwpwm=2 case
  scsi: ses: don't ask for diagnostic pages repeatedly during probe
  drm/amdgpu:fix random missing of FLR NOTIFY
  cpufreq: Fix governor module removal race
  ath10k: update tdls teardown state to target
  iio: health: max30102: Add power enable parameter to get_temp function
  iio: adc: ina2xx: Shift bus voltage register to mask flag bits
  drm/etnaviv: make THERMAL selectable
  power: supply: ab8500_charger: Bail out in case of error in 'ab8500_charger_init_hw_registers()'
  power: supply: ab8500_charger: Fix an error handling path
  leds: pm8058: Silence pointer to integer size warning
  xfrm: Fix xfrm_replay_overflow_offload_esn
  userns: Don't fail follow_automount based on s_user_ns
  mtd: nand: ifc: update bufnum mask for ver >= 2.0.0
  ARM: dts: omap3-n900: Fix the audio CODEC's reset pin
  ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin
  net: thunderx: Set max queue count taking XDP_TX into account
  mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]()
  net: xfrm: allow clearing socket xfrm policies.
  rtc: brcmstb-waketimer: fix error handling in brcmstb_waketmr_probe()
  net: ieee802154: adf7242: Fix bug if defined DEBUG
  test_firmware: fix setting old custom fw path back on exit
  crypto: cavium - fix memory leak on info
  crypto: ecc - Fix NULL pointer deref. on no default_rng
  sched: Stop resched_cpu() from sending IPIs to offline CPUs
  sched: Stop switched_to_rt() from sending IPIs to offline CPUs
  USB: ledtrig-usbport: fix of-node leak
  typec: tcpm: fusb302: Resolve out of order messaging events
  staging: rtl8822be: fix missing null check on dev_alloc_skb return
  drm/amdgpu: fix get_max_engine_clock_in_mhz
  ARM: dts: exynos: Correct Trats2 panel reset line
  clk: meson: gxbb: fix wrong clock for SARADC/SANA
  ARM: dts: koelsch: Move cec_clock to root node
  iwlwifi: mvm: rs: don't override the rate history in the search cycle
  HID: elo: clear BTN_LEFT mapping
  HID: multitouch: Only look at non touch fields in first packet of a frame
  video/hdmi: Allow "empty" HDMI infoframes
  dma-buf/fence: Fix lock inversion within dma-fence-array
  drm/edid: set ELD connector type in drm_edid_to_eld()
  Revert "btrfs: use proper endianness accessors for super_copy"
  dm mpath: fix passing integrity data
  earlycon: add reg-offset to physical address before mapping
  serial: core: mark port as initialized in autoconfig
  serial: 8250_pci: Add Brainboxes UC-260 4 port serial device
  usb: dwc3: Fix lock-up on ID change during system suspend/resume
  usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb()
  usb: usbmon: Read text within supplied buffer size
  usb: quirks: add control message delay for 1b1c:1b20
  usbip: vudc: fix null pointer dereference on udc->lock
  USB: storage: Add JMicron bridge 152d:2567 to unusual_devs.h
  staging: android: ashmem: Fix lockdep issue during llseek
  staging: comedi: fix comedi_nsamples_left.
  uas: fix comparison for error code
  tty/serial: atmel: add new version check for usart
  serial: sh-sci: prevent lockup on full TTY buffers
  xhci: fix endpoint context tracer output
  xhci: Fix front USB ports on ASUS PRIME B350M-A
  usb: host: xhci-rcar: add support for r8a77965
  ASoC: rt5651: Fix regcache sync errors on resume
  ASoC: wm_adsp: For TLV controls only register TLV get/set
  ASoC: sgtl5000: Fix suspend/resume
  ASoC: sun4i-i2s: Fix RX slot number of SUN8I
  x86: Treat R_X86_64_PLT32 as R_X86_64_PC32
  net: phy: Restore phy_resume() locking assumption
  net: phy: fix resume handling
  ANDROID: sdcardfs: fix lock issue on 32 bit/SMP architectures

Change-Id: Ida88909c333e059adf42a8794c3b92b1d15252f7
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-03-21 10:16:53 -07:00
Christophe Leroy
0ced0c46b4 Fix misannotated out-of-line _copy_to_user() 
[ Upstream commit a0e94598e6b6c0d1df6a5fa14eb7c767ca817a20 ]

Destination is a kernel pointer and source - a userland one
in _copy_from_user(); _copy_to_user() is the other way round.

Fixes: d597580d37377 ("generic ...copy_..._user primitives")
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-03-19 08:42:56 +01:00
Linux Build Service Account
be49c61378 Merge "Merge remote-tracking branch 'remotes/origin/tmp-df0daba' into msm-4.14" into msm-4.14 2018-03-17 14:54:33 -07:00
Linux Build Service Account
14b1002220 Merge "lib: ubsan: Fix compilation issues for ubsan" into msm-4.14 2018-03-15 18:11:28 -07:00
Isaac J. Manjarres
3ba3c6ce0a Merge remote-tracking branch 'remotes/origin/tmp-df0daba' into msm-4.14 
* remotes/origin/tmp-df0daba:
  Linux 4.14.27
  x86/kprobes: Fix kernel crash when probing .entry_trampoline code
  objtool: Fix 32-bit build
  objtool: Fix another switch table detection issue
  objtool, retpolines: Integrate objtool with retpoline support more closely
  objtool: Add module specific retpoline rules
  kbuild: move cc-option and cc-disable-warning after incl. arch Makefile
  kbuild: Set KBUILD_CFLAGS before incl. arch Makefile
  kbuild: re-order the code to not parse unnecessary variables
  objtool: Add retpoline validation
  objtool: Use existing global variables for options
  x86/mm/sme, objtool: Annotate indirect call in sme_encrypt_execute()
  x86/boot, objtool: Annotate indirect jump in secondary_startup_64()
  x86/paravirt, objtool: Annotate indirect calls
  x86/speculation: Move firmware_restrict_branch_speculation_*() from C to CPP
  x86/speculation, objtool: Annotate indirect calls/jumps for objtool
  x86/retpoline: Support retpoline builds with Clang
  x86/speculation: Use IBRS if available before calling into firmware
  Revert "x86/retpoline: Simplify vmexit_fill_RSB()"
  x86-64/realmode: Add instruction suffix
  x86/LDT: Avoid warning in 32-bit builds with older gcc
  x86/asm: Improve how GEN_*_SUFFIXED_RMWcc() specify clobbers
  x86/mm: Remove stale comment about KMEMCHECK
  x86/entry/64: Use 'xorl' for faster register clearing
  x86/entry: Reduce the code footprint of the 'idtentry' macro
  nospec: Include <asm/barrier.h> dependency
  nospec: Kill array_index_nospec_mask_check()
  MIPS: CPC: Map registers using DT in mips_cpc_default_phys_base()
  dt-bindings: Document mti,mips-cpc binding
  scsi: qla2xxx: Fix recursion while sending terminate exchange
  scsi: qla2xxx: Fix NULL pointer crash due to probe failure
  ALSA: hda: add dock and led support for HP ProBook 640 G2
  ALSA: hda: add dock and led support for HP EliteBook 820 G3
  ALSA: hda - Fix a wrong FIXUP for alc289 on Dell machines
  ALSA: seq: More protection for concurrent write and ioctl races
  ALSA: seq: Don't allow resizing pool in use
  ALSA: hda/realtek - Make dock sound work on ThinkPad L570
  ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520
  ALSA: hda/realtek: Limit mic boost on T480
  ALSA: hda/realtek - Add headset mode support for Dell laptop
  ALSA: hda/realtek - Add support headset mode for DELL WYSE
  x86/spectre_v2: Don't check microcode versions when running under hypervisors
  perf tools: Fix trigger class trigger_on()
  x86/MCE: Serialize sysfs changes
  x86/MCE: Save microcode revision in machine check records
  bcache: don't attach backing with duplicate UUID
  bcache: fix crashes in duplicate cache device register
  IB/mlx5: Fix incorrect size of klms in the memory region
  dm bufio: avoid false-positive Wmaybe-uninitialized warning
  kbuild: Handle builtin dtb file names containing hyphens
  IB/core: Fix missing RDMA cgroups release in case of failure to register device
  arm64: mm: fix thinko in non-global page table attribute check
  KVM: s390: fix memory overwrites when not using SCA entries
  virtio_ring: fix num_free handling in error case
  loop: Fix lost writes caused by missing flag
  Documentation/sphinx: Fix Directive import error
  mm/memblock.c: hardcode the end_pfn being -1
  lib/bug.c: exclude non-BUG/WARN exceptions from report_bug()
  Input: matrix_keypad - fix race when disabling interrupts
  PCI: dwc: Fix enumeration end when reaching root subordinate
  MIPS: OCTEON: irq: Check for null return on kzalloc allocation
  MIPS: ath25: Check for kzalloc allocation failure
  MIPS: BMIPS: Do not mask IPIs during suspend
  drm/amdgpu:Always save uvd vcpu_bo in VM Mode
  drm/amdgpu:Correct max uvd handles
  drm/amdgpu: fix KV harvesting
  drm/radeon: fix KV harvesting
  drm/amdgpu: Notify sbios device ready before send request
  drm/amdgpu: used cached pcie gen info for SI (v2)
  drm/amd/powerplay: fix power over limit on Fiji
  drm/radeon: insist on 32-bit DMA for Cedar on PPC64/PPC64LE
  Revert "drm/radeon/pm: autoswitch power state when in balanced mode"
  drm/amd/powerplay/vega10: allow mclk switching with no displays
  drm/amd/powerplay/smu7: allow mclk switching with no displays
  drm/nouveau: prefer XBGR2101010 for addfb ioctl
  drm/amdgpu: Fix deadlock on runtime suspend
  drm/radeon: Fix deadlock on runtime suspend
  drm/nouveau: Fix deadlock on runtime suspend
  drm: Allow determining if current task is output poll worker
  workqueue: Allow retrieval of current task's work struct
  drm/i915: Always call to intel_display_set_init_power() in resume_early.
  scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS
  scsi: core: Avoid that ATA error handling can trigger a kernel hang or oops
  drm/i915/perf: fix perf stream opening lock
  drm/i915: Try EDID bitbanging on HDMI after failed read
  drm/i915: Update watermark state correctly in sanitize_watermarks
  drm/i915: Disable DC states around GMBUS on GLK
  drm/i915: Clear the in-use marker on execbuf failure
  drm/i915: Fix rsvd2 mask when out-fence is returned
  regulator: stm32-vrefbuf: fix check on ready flag
  net/smc: fix NULL pointer dereference on sock_create_kern() error path
  IB/uverbs: Improve lockdep_check
  RDMA/mlx5: Fix integer overflow while resizing CQ
  RDMA/ucma: Check that user doesn't overflow QP state
  RDMA/ucma: Limit possible option size
  NFS: Fix unstable write completion
  pNFS: Prevent the layout header refcount going to zero in pnfs_roc()
  NFS: Fix an incorrect type in struct nfs_direct_req
  scsi: qla2xxx: Fix memory leak in dual/target mode
  scsi: qla2xxx: Fix system crash in qlt_plogi_ack_unref
  scsi: qla2xxx: Remove aborting ELS IOCB call issued as part of timeout.
  scsi: qla2xxx: Defer processing of GS IOCB calls
  scsi: qla2xxx: Clear loop id after delete
  scsi: qla2xxx: Fix scan state field for fcport
  scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport
  scsi: qla2xxx: Fix abort command deadlock due to spinlock
  scsi: qla2xxx: Fix PRLI state check
  scsi: qla2xxx: Fix Relogin being triggered too fast
  scsi: qla2xxx: Fix NPIV host cleanup in target mode
  scsi: qla2xxx: Fix login state machine stuck at GPDB
  scsi: qla2xxx: Serialize GPNID for multiple RSCN
  scsi: qla2xxx: Retry switch command on time out
  scsi: qla2xxx: Fix re-login for Nport Handle in use
  scsi: qla2xxx: Skip IRQ affinity for Target QPairs
  scsi: qla2xxx: Move session delete to driver work queue
  scsi: qla2xxx: Fix gpnid error processing
  scsi: qla2xxx: Fix system crash for Notify ack timeout handling
  tpm: only attempt to disable the LPC CLKRUN if is already enabled
  tpm: remove unused variables
  tpm: delete the TPM_TIS_CLK_ENABLE flag
  tpm: Keep CLKRUN enabled throughout the duration of transmit_cmd()
  tpm_tis: Move ilb_base_addr to tpm_tis_data
  netfilter: use skb_to_full_sk in ip6_route_me_harder
  netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt
  netfilter: bridge: ebt_among: add missing match size checks
  netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets
  netfilter: IDLETIMER: be syzkaller friendly
  netfilter: nat: cope with negative port range
  netfilter: x_tables: fix missing timer initialization in xt_LED
  netfilter: xt_hashlimit: fix lock imbalance
  netfilter: ipt_CLUSTERIP: fix a race condition of proc file creation
  netfilter: add back stackpointer size checks
  ASoC: Intel: kbl: fix jack name
  ASoC: Intel: Skylake: Fix jack name format substitution
  ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds
  watchdog: hpwdt: Remove legacy NMI sourcing.
  watchdog: hpwdt: fix unused variable warning
  watchdog: hpwdt: Check source of NMI
  watchdog: hpwdt: SMBIOS check
  kbuild: move "_all" target out of $(KBUILD_SRC) conditional
  FROMLIST: f2fs: don't put dentry page in pagecache into highmem

Conflicts:
	Makefile

Change-Id: I9c0acaa8aea9f4986bf01898de8d4be4658c64ce
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-03-15 09:55:13 -07:00
Kees Cook
d50cb5cedb lib/bug.c: exclude non-BUG/WARN exceptions from report_bug() 
commit 1b4cfe3c0a30dde968fb43c577a8d7e262a145ee upstream.

Commit b8347c219649 ("x86/debug: Handle warnings before the notifier
chain, to fix KGDB crash") changed the ordering of fixups, and did not
take into account the case of x86 processing non-WARN() and non-BUG()
exceptions.  This would lead to output of a false BUG line with no other
information.

In the case of a refcount exception, it would be immediately followed by
the refcount WARN(), producing very strange double-"cut here":

  lkdtm: attempting bad refcount_inc() overflow
  ------------[ cut here ]------------
  Kernel BUG at 0000000065f29de5 [verbose debug info unavailable]
  ------------[ cut here ]------------
  refcount_t overflow at lkdtm_REFCOUNT_INC_OVERFLOW+0x6b/0x90 in cat[3065], uid/euid: 0/0
  WARNING: CPU: 0 PID: 3065 at kernel/panic.c:657 refcount_error_report+0x9a/0xa4
  ...

In the prior ordering, exceptions were searched first:

   do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str,
   ...
                if (fixup_exception(regs, trapnr))
                        return 0;

  -               if (fixup_bug(regs, trapnr))
  -                       return 0;
  -

As a result, fixup_bugs()'s is_valid_bugaddr() didn't take into account
needing to search the exception list first, since that had already
happened.

So, instead of searching the exception list twice (once in
is_valid_bugaddr() and then again in fixup_exception()), just add a
simple sanity check to report_bug() that will immediately bail out if a
BUG() (or WARN()) entry is not found.

Link: http://lkml.kernel.org/r/20180301225934.GA34350@beast
Fixes: b8347c219649 ("x86/debug: Handle warnings before the notifier chain, to fix KGDB crash")
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Richard Weinberger <richard.weinberger@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-03-15 10:54:32 +01:00
Isaac J. Manjarres
a7ea4f03e5 lib: ubsan: Fix compilation issues for ubsan 
Currently, multiple declarations of data structures and
functions exist, as well as dead code that was meant to be
removed earlier. Remove dead code and multiple declarations
for ubsan.

Change-Id: I2b1d27ab2edc9852a3cd286c70fe8990aa0e0754
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-03-09 11:30:09 -08:00
Isaac J. Manjarres
07f0d9dd34 Merge remote-tracking branch 'remotes/origin/tmp-85ab9a0' into msm-4.14 
* remotes/origin/tmp-85ab9a0:
  Linux 4.14.24
  net: sched: fix use-after-free in tcf_block_put_ext
  net_sched: get rid of rcu_barrier() in tcf_block_put_ext()
  net: sched: crash on blocks with goto chain action
  net: sched: fix crash when deleting secondary chains
  arm64: dts: marvell: mcbin: add comphy references to Ethernet ports
  arm64: dts: marvell: add comphy nodes on cp110 master and slave
  powerpc/pseries: Enable RAS hotplug events later
  MIPS: Implement __multi3 for GCC7 MIPS64r6 builds
  mlxsw: pci: Wait after reset before accessing HW
  nfp: always unmask aux interrupts at init
  of_mdio: avoid MDIO bus removal when a PHY is missing
  net: gianfar_ptp: move set_fipers() to spinlock protecting area
  sctp: make use of pre-calculated len
  sctp: add a ceiling to optlen in some sockopts
  xen/gntdev: Fix partial gntdev_mmap() cleanup
  xen/gntdev: Fix off-by-one error when unmapping with holes
  SolutionEngine771x: fix Ether platform data
  mdio-sun4i: Fix a memory leak
  xen-netfront: enable device after manual module load
  bnxt_en: Fix the 'Invalid VF' id check in bnxt_vf_ndo_prep routine.
  bnxt_en: Fix population of flow_type in bnxt_hwrm_cfa_flow_alloc()
  x86/platform/intel-mid: Revert "Make 'bt_sfi_data' const"
  nvme-fabrics: initialize default host->id in nvmf_host_default()
  powerpc/pseries: Make RAS IRQ explicitly dependent on DLPAR WQ
  leds: core: Fix regression caused by commit 2b83ff96f51d
  bpf: sockmap missing NULL psock check
  ia64, sched/cputime: Fix build error if CONFIG_VIRT_CPU_ACCOUNTING_NATIVE=y
  block: drain queue before waiting for q_usage_counter becoming zero
  wcn36xx: Fix dynamic power saving
  can: flex_can: Correct the checking for frame length in flexcan_start_xmit()
  mac80211: mesh: drop frames appearing to be from us
  nl80211: Check for the required netlink attribute presence
  net: ena: unmask MSI-X only after device initialization is completed
  i40e: don't remove netdev->dev_addr when syncing uc list
  i40e/i40evf: Account for frags split over multiple descriptors in check linearize
  uapi libc compat: add fallback for unsupported libcs
  x86/efi: Fix kernel param add_efi_memmap regression
  RDMA/netlink: Fix locking around __ib_get_device_by_index
  drm/ttm: check the return value of kzalloc
  NET: usb: qmi_wwan: add support for YUGA CLM920-NC5 PID 0x9625
  e1000: fix disabling already-disabled warning
  macvlan: Fix one possible double free
  xfs: quota: check result of register_shrinker()
  xfs: quota: fix missed destroy of qi_tree_lock
  IB/ipoib: Fix race condition in neigh creation
  IB/mlx4: Fix mlx4_ib_alloc_mr error flow
  Input: xen-kbdfront - do not advertise multi-touch pressure support
  ip6_tunnel: allow ip6gre dev mtu to be set below 1280
  btrfs: Fix flush bio leak
  s390/dasd: fix wrongly assigned configuration data
  afs: Fix missing error handling in afs_write_end()
  genirq: Guard handle_bad_irq log messages
  IB/mlx5: Fix mlx5_ib_alloc_mr error flow
  led: core: Fix brightness setting when setting delay_off=0
  perf/x86/intel: Plug memory leak in intel_pmu_init()
  bnx2x: Improve reliability in case of nested PCI errors
  tg3: Enable PHY reset in MTU change path for 5720
  tg3: Add workaround to restrict 5762 MRRS to 2048
  tipc: fix tipc_mon_delete() oops in tipc_enable_bearer() error path
  tipc: error path leak fixes in tipc_enable_bearer()
  netfilter: nf_tables: fix potential NULL-ptr deref in nf_tables_dump_obj_done()
  crypto: inside-secure - fix request allocations in invalidation path
  crypto: inside-secure - free requests even if their handling failed
  crypto: inside-secure - per request invalidation
  arm64: dts: renesas: ulcb: Remove renesas, no-ether-link property
  lib/mpi: Fix umul_ppmm() for MIPS64r6
  crypto: af_alg - Fix race around ctx->rcvused by making it atomic_t
  ARM: dts: ls1021a: fix incorrect clock references
  RDMA/vmw_pvrdma: Call ib_umem_release on destroy QP path
  i915: Reject CCS modifiers for pipe C on Geminilake
  netfilter: uapi: correct UNTRACKED conntrack state bit number
  scsi: storvsc: Fix scsi_cmd error assignments in storvsc_handle_error
  netfilter: nf_tables: fix chain filter in nf_tables_dump_rules()
  xen/balloon: Mark unallocated host memory as UNUSABLE
  ASoC: rsnd: fixup ADG register mask
  net/mlx5: Stay in polling mode when command EQ destroy fails
  net/mlx5: Cleanup IRQs in case of unload failure
  net/mlx5e: Fix ETS BW check
  net: stmmac: Fix bad RX timestamp extraction
  net: stmmac: Fix TX timestamp calculation
  ip6_tunnel: get the min mtu properly in ip6_tnl_xmit
  ip6_gre: remove the incorrect mtu limit for ipgre tap
  ip_gre: remove the incorrect mtu limit for ipgre tap
  vxlan: update skb dst pmtu on tx path
  net: arc_emac: fix arc_emac_rx() error paths
  net: mediatek: setup proper state for disabled GMAC on the default
  x86-64/Xen: eliminate W+X mappings
  staging: ion: Fix ion_cma_heap allocations
  cgroup: Fix deadlock in cpu hotplug path
  ASoC: nau8825: fix issue that pop noise when start capture
  spi: atmel: fixed spin_lock usage inside atmel_spi_remove
  mac80211_hwsim: Fix a possible sleep-in-atomic bug in hwsim_get_radio_nl
  x86/stacktrace: Make zombie stack traces reliable
  xfrm: Reinject transport-mode packets through tasklet
  drm/nouveau/pci: do a msi rearm on init
  net: phy: xgene: disable clk on error paths
  sget(): handle failures of register_shrinker()
  sctp: fix the issue that a __u16 variable may overflow in sctp_ulpq_renege
  x86/asm: Allow again using asm.h when building for the 'bpf' clang target
  ARM: 8731/1: Fix csum_partial_copy_from_user() stack mismatch
  parisc: Reduce thread stack to 16 kb
  ipv6: icmp6: Allow icmp messages to be looped back
  mtd: nand: brcmnand: Zero bitflip is not an error
  mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM
  net: usb: qmi_wwan: add Telit ME910 PID 0x1101 support
  net: aquantia: Fix hardware DMA stream overload on large MRRS
  net: aquantia: Fix actual speed capabilities reporting
  nvme: check hw sectors before setting chunk sectors
  nvme-fc: remove double put reference if admin connect fails
  phy: cpcap-usb: Fix platform_get_irq_byname's error checking.
  dmaengine: fsl-edma: disable clks on all error paths
  scsi: aacraid: Fix I/O drop during reset
  mm/frame_vector.c: release a semaphore in 'get_vaddr_frames()'
  exec: avoid gcc-8 warning for get_task_comm
  hrtimer: Ensure POSIX compliance (relative CLOCK_REALTIME hrtimers)

Conflicts:
	drivers/staging/android/ion/Kconfig
	drivers/staging/android/ion/ion_cma_heap.c

Change-Id: I58485dd9ac8092a184c42a8e125e44523221e3ea
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-03-05 09:44:16 -08:00
James Hogan
22d5e20c6a lib/mpi: Fix umul_ppmm() for MIPS64r6 
[ Upstream commit bbc25bee37d2b32cf3a1fab9195b6da3a185614a ]

Current MIPS64r6 toolchains aren't able to generate efficient
DMULU/DMUHU based code for the C implementation of umul_ppmm(), which
performs an unsigned 64 x 64 bit multiply and returns the upper and
lower 64-bit halves of the 128-bit result. Instead it widens the 64-bit
inputs to 128-bits and emits a __multi3 intrinsic call to perform a 128
x 128 multiply. This is both inefficient, and it results in a link error
since we don't include __multi3 in MIPS linux.

For example commit 90a53e4432b1 ("cfg80211: implement regdb signature
checking") merged in v4.15-rc1 recently broke the 64r6_defconfig and
64r6el_defconfig builds by indirectly selecting MPILIB. The same build
errors can be reproduced on older kernels by enabling e.g. CRYPTO_RSA:

lib/mpi/generic_mpih-mul1.o: In function `mpihelp_mul_1':
lib/mpi/generic_mpih-mul1.c:50: undefined reference to `__multi3'
lib/mpi/generic_mpih-mul2.o: In function `mpihelp_addmul_1':
lib/mpi/generic_mpih-mul2.c:49: undefined reference to `__multi3'
lib/mpi/generic_mpih-mul3.o: In function `mpihelp_submul_1':
lib/mpi/generic_mpih-mul3.c:49: undefined reference to `__multi3'
lib/mpi/mpih-div.o In function `mpihelp_divrem':
lib/mpi/mpih-div.c:205: undefined reference to `__multi3'
lib/mpi/mpih-div.c:142: undefined reference to `__multi3'

Therefore add an efficient MIPS64r6 implementation of umul_ppmm() using
inline assembly and the DMULU/DMUHU instructions, to prevent __multi3
calls being emitted.

Fixes: 7fd08ca58ae6 ("MIPS: Add build support for the MIPS R6 ISA")
Signed-off-by: James Hogan <jhogan@kernel.org>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: linux-mips@linux-mips.org
Cc: linux-crypto@vger.kernel.org
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-03-03 10:24:29 +01:00
Isaac J. Manjarres
9636a4ea18 Merge remote-tracking branch 'remotes/origin/tmp-af3b8e6' into msm-4.14 
* remotes/origin/tmp-af3b8e6:
  Linux 4.14.22
  vmalloc: fix __GFP_HIGHMEM usage for vmalloc_32 on 32b systems
  mei: me: add cannon point device ids for 4th device
  mei: me: add cannon point device ids
  crypto: s5p-sss - Fix kernel Oops in AES-ECB mode
  drm/i915: fix intel_backlight_device_register declaration
  crypto: talitos - fix Kernel Oops on hashing an empty file
  hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close
  powerpc/perf/imc: Fix nest-imc cpuhotplug callback failure
  PCI: rcar: Fix use-after-free in probe error path
  xen: XEN_ACPI_PROCESSOR is Dom0-only
  platform/x86: dell-laptop: Fix keyboard max lighting for Dell Latitude E6410
  x86/mm/kmmio: Fix mmiotrace for page unaligned addresses
  mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep
  usb: dwc3: of-simple: fix missing clk_disable_unprepare
  usb: dwc3: gadget: Wait longer for controller to end command processing
  dmaengine: jz4740: disable/unprepare clk if probe fails
  drm/vc4: Release fence after signalling
  ASoC: rsnd: ssi: fix race condition in rsnd_ssi_pointer_update
  drm/armada: fix leak of crtc structure
  xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies.
  IB/mlx4: Fix RSS hash fields restrictions
  spi: sun4i: disable clocks in the remove function
  ASoC: rockchip: disable clock on error
  staging: ccree: Uninitialized return in ssi_ahash_import()
  clk: fix a panic error caused by accessing NULL pointer
  netfilter: xt_bpf: add overflow checks
  xfrm: Fix xfrm_input() to verify state is valid when (encap_type < 0)
  dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved
  dmaengine: ioat: Fix error handling path
  scsi: bfa: fix type conversion warning
  scsi: bfa: fix access to bfad_im_port_s
  scsi: lpfc: Use after free in lpfc_rq_buf_free()
  gianfar: Disable EEE autoneg by default
  509: fix printing uninitialized stack memory when OID is empty
  net: dsa: mv88e6xxx: Unregister MDIO bus on error path
  net: dsa: mv88e6xxx: Fix interrupt masking on removal
  net: ethernet: arc: fix error handling in emac_rockchip_probe
  virtio_net: fix return value check in receive_mergeable()
  brcmfmac: Avoid build error with make W=1
  btrfs: Fix possible off-by-one in btrfs_search_path_in_tree
  Btrfs: disable FUA if mounted with nobarrier
  btrfs: Fix quota reservation leak on preallocated files
  locking/lockdep: Fix possible NULL deref
  net: qualcomm: rmnet: Fix leak on transmit failure
  KVM: VMX: fix page leak in hardware_setup()
  VSOCK: fix outdated sk_state value in hvs_release()
  net_sched: red: Avoid illegal values
  net_sched: red: Avoid devision by zero
  gianfar: fix a flooded alignment reports because of padding issue.
  nfp: fix port stats for mac representors
  ARM: dts: Fix elm interrupt compiler warning
  s390/dasd: prevent prefix I/O error
  s390/virtio: add BSD license to virtio-ccw
  PM / runtime: Fix handling of suppliers with disabled runtime PM
  powerpc/perf: Fix oops when grouping different pmu events
  m68k: add missing SOFTIRQENTRY_TEXT linker section
  ipvlan: Add the skb->mark as flow4's member to lookup route
  bnxt_en: Need to unconditionally shut down RoCE in bnxt_shutdown
  scripts/kernel-doc: Don't fail with status != 0 if error encountered with -none
  iio: fix kernel-doc build errors
  iio: proximity: sx9500: Assign interrupt from GpioIo()
  md/raid1/10: add missed blk plug
  phylink: ensure we take the link down when phylink_stop() is called
  sfp: fix RX_LOS signal handling
  sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune
  md/raid5: correct degraded calculation in raid5_error
  IB/core: Init subsys if compiled to vmlinuz-core
  RDMA/cma: Make sure that PSN is not over max allowed
  i40iw: Correct ARP index mask
  i40iw: Do not free sqbuf when event is I40IW_TIMER_TYPE_CLOSE
  i40iw: Allocate a sdbuf per CQP WQE
  KVM: arm/arm64: Fix spinlock acquisition in vgic_set_owner
  meson-gx-socinfo: Fix package id parsing
  IB/hfi1: Initialize bth1 in 16B rc ack builder
  pinctrl: sunxi: Fix A64 UART mux value
  pinctrl: sunxi: Fix A80 interrupt pin bank
  gpio: davinci: Assign first bank regs for unbanked case
  gpio: 74x164: Fix crash during .remove()
  net: mvpp2: allocate zeroed tx descriptors
  media: ov13858: Select V4L2_FWNODE
  media: s5k6aa: describe some function parameters
  trace/xdp: fix compile warning: 'struct bpf_map' declared inside parameter list
  kvm: arm: don't treat unavailable HYP mode as an error
  pinctrl: denverton: Fix UART2 RTS pin mode
  perf test: Fix test 21 for s390x
  perf bench numa: Fixup discontiguous/sparse numa nodes
  perf top: Fix window dimensions change handling
  perf: Fix header.size for namespace events
  perf test shell: Fix check open filename arg using 'perf trace' on s390x
  perf annotate: Do not truncate instruction names at 6 chars
  perf help: Fix a bug during strstart() conversion
  perf record: Fix -c/-F options for cpu event aliases
  ARM: dts: am437x-cm-t43: Correct the dmas property of spi0
  ARM: dts: am4372: Correct the interrupts_properties of McASP
  ARM: dts: logicpd-somlv: Fix wl127x pinmux
  ARM: dts: logicpd-som-lv: Fix gpmc addresses for NAND and enet
  ARM: dts: Fix omap4 hang with GPS connected to USB by using wakeupgen
  ARM: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function
  ARM: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context
  serdev: fix receive_buf return value when no callback
  usb: build drivers/usb/common/ when USB_SUPPORT is set
  usbip: keep usbip_device sockfd state in sync with tcp_socket
  staging: iio: ad5933: switch buffer mode to software
  staging: iio: adc: ad7192: fix external frequency setting
  staging: fsl-mc: fix build testing on x86
  binder: replace "%p" with "%pK"
  binder: check for binder_thread allocation failure in binder_poll()
  staging: android: ashmem: Fix a race condition in pin ioctls
  ANDROID: binder: synchronize_rcu() when using POLLFREE.
  ANDROID: binder: remove WARN() for redundant txn error
  dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock
  arm64: dts: add #cooling-cells to CPU nodes
  ARM: 8743/1: bL_switcher: add MODULE_LICENSE tag
  video: fbdev/mmp: add MODULE_LICENSE
  ASoC: ux500: add MODULE_LICENSE tag
  net_sched: gen_estimator: fix lockdep splat
  net: avoid skb_warn_bad_offload on IS_ERR
  rds: tcp: atomically purge entries from rds_tcp_conn_list during netns delete
  rds: tcp: correctly sequence cleanup on netns deletion.
  netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert
  netfilter: xt_cgroup: initialize info->priv in cgroup_mt_check_v1()
  netfilter: on sockopt() acquire sock lock only in the required scope
  netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in clusterip_tg_check()
  netfilter: x_tables: avoid out-of-bounds reads in xt_request_find_{match|target}
  netfilter: x_tables: fix int overflow in xt_alloc_table_info()
  kcov: detect double association with a single task
  KVM: x86: fix escape of guest dr6 to the host
  blk_rq_map_user_iov: fix error override
  staging: android: ion: Switch from WARN to pr_warn
  staging: android: ion: Add __GFP_NOWARN for system contig heap
  crypto: x86/twofish-3way - Fix %rbp usage
  media: pvrusb2: properly check endpoint types
  selinux: skip bounded transition processing if the policy isn't loaded
  selinux: ensure the context is NUL terminated in security_context_to_sid_core()
  ptr_ring: try vmalloc() when kmalloc() fails
  ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE
  ALSA: bcd2000: Add a sanity check for invalid EPs
  ALSA: caiaq: Add a sanity check for invalid EPs
  ALSA: line6: Add a sanity check for invalid EPs
  drm: Require __GFP_NOFAIL for the legacy drm_modeset_lock_all
  dnotify: Handle errors from fsnotify_add_mark_locked() in fcntl_dirnotify()
  blktrace: fix unlocked registration of tracepoints
  sctp: set frag_point in sctp_setsockopt_maxseg correctly
  xfrm: check id proto in validate_tmpl()
  xfrm: Fix stack-out-of-bounds read on socket policy lookup.
  RDMA/netlink: Fix general protection fault
  KVM/x86: Check input paging mode when cs.l is set
  mm,vmscan: Make unregister_shrinker() no-op if register_shrinker() failed.
  xfrm: skip policies marked as dead while rehashing
  xfrm: fix rcu usage in xfrm_get_type_offload
  xfrm: don't call xfrm_policy_cache_flush while holding spinlock
  esp: Fix GRO when the headers not fully in the linear part of the skb.
  mac80211_hwsim: validate number of different channels
  cfg80211: check dev_set_name() return value
  bpf: mark dst unknown on inconsistent {s, u}bounds adjustments
  kcm: Only allow TCP sockets to be attached to a KCM mux
  kcm: Check if sk_user_data already set in kcm_attach
  vhost: use mutex_lock_nested() in vhost_dev_lock_vqs()
  usb: core: Add a helper function to check the validity of EP type in URB
  ANDROID: sdcardfs: Hold i_mutex for i_size_write
  FROMGIT: crypto: speck - add test vectors for Speck64-XTS
  FROMGIT: crypto: speck - add test vectors for Speck128-XTS
  FROMGIT: crypto: arm/speck - add NEON-accelerated implementation of Speck-XTS
  FROMGIT: crypto: speck - export common helpers
  FROMGIT: crypto: speck - add support for the Speck block cipher
  f2fs: updates on v4.16-rc1

Conflicts:
	drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c

Change-Id: I420172cd4438ce010645ceb00a71c4e3f03596d8
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-02-26 10:10:30 -08:00
Eric Biggers
f2f12ea19f 509: fix printing uninitialized stack memory when OID is empty 
[ Upstream commit 8dfd2f22d3bf3ab7714f7495ad5d897b8845e8c1 ]

Callers of sprint_oid() do not check its return value before printing
the result.  In the case where the OID is zero-length, -EBADMSG was
being returned without anything being written to the buffer, resulting
in uninitialized stack memory being printed.  Fix this by writing
"(bad)" to the buffer in the cases where -EBADMSG is returned.

Fixes: 4f73175d0375 ("X.509: Add utility functions to render OIDs as strings")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-02-25 11:08:01 +01:00
Isaac J. Manjarres
2c7009015c Merge remote-tracking branch 'remotes/origin/tmp-474d3c4' into msm-4.14 
* remotes/origin/tmp-474d3c4:
  Linux 4.14.21
  ovl: hash directory inodes for fsnotify
  ASoC: acpi: fix machine driver selection based on quirk
  mmc: sdhci-of-esdhc: fix the mmc error after sleep on ls1046ardb
  mmc: sdhci-of-esdhc: fix eMMC couldn't work after kexec
  mmc: sdhci-of-esdhc: disable SD clock for clock value 0
  media: r820t: fix r820t_write_reg for KASAN
  ARM: dts: Delete bogus reference to the charlcd
  arm: dts: mt2701: Add reset-cells
  arm: dts: mt7623: Update ethsys binding
  ARM: dts: s5pv210: add interrupt-parent for ohci
  arm64: dts: msm8916: Add missing #phy-cells
  ARM: pxa/tosa-bt: add MODULE_LICENSE tag
  ARM: dts: exynos: fix RTC interrupt for exynos5410
  Bluetooth: BT_HCIUART now depends on SERIAL_DEV_BUS
  scsi: core: check for device state in __scsi_remove_target()
  x86/mm, mm/hwpoison: Don't unconditionally unmap kernel 1:1 pages
  usb: Move USB_UHCI_BIG_ENDIAN_* out of USB_SUPPORT
  mvpp2: fix multicast address filter
  ALSA: seq: Fix racy pool initializations
  ALSA: usb: add more device quirks for USB DSD devices
  ALSA: usb-audio: add implicit fb quirk for Behringer UFX1204
  ALSA: hda/realtek: PCI quirk for Fujitsu U7x7
  ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform
  ALSA: hda/realtek - Add headset mode support for Dell laptop
  ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute
  ALSA: hda - Fix headset mic detection problem for two Dell machines
  mtd: nand: vf610: set correct ooblayout
  9p/trans_virtio: discard zero-length reply
  Btrfs: fix unexpected -EEXIST when creating new inode
  Btrfs: fix use-after-free on root->orphan_block_rsv
  Btrfs: fix btrfs_evict_inode to handle abnormal inodes correctly
  Btrfs: fix extent state leak from tree log
  Btrfs: fix crash due to not cleaning up tree log block's dirty bits
  Btrfs: fix deadlock in run_delalloc_nocow
  dm: correctly handle chained bios in dec_pending()
  iscsi-target: make sure to wake up sleeping login worker
  target/iscsi: avoid NULL dereference in CHAP auth error path
  blk-wbt: account flush requests correctly
  xprtrdma: Fix BUG after a device removal
  xprtrdma: Fix calculation of ri_max_send_sges
  drm/qxl: reapply cursor after resetting primary
  qxl: alloc & use shadow for dumb buffers
  arm64: proc: Set PTE_NG for table entries to avoid traversing them twice
  rtlwifi: rtl8821ae: Fix connection lost problem correctly
  mpls, nospec: Sanitize array index in mpls_label_ok()
  tracing: Fix parsing of globs with a wildcard at the beginning
  seq_file: fix incomplete reset on read from zero offset
  xenbus: track caller request id
  xen: Fix {set,clear}_foreign_p2m_mapping on autotranslating guests
  rbd: whitelist RBD_FEATURE_OPERATIONS feature bit
  console/dummy: leave .con_font_get set to NULL
  video: fbdev: atmel_lcdfb: fix display-timings lookup
  PCI: keystone: Fix interrupt-controller-node lookup
  PCI: iproc: Fix NULL pointer dereference for BCMA
  PCI: Disable MSI for HiSilicon Hip06/Hip07 only in Root Port mode
  MIPS: Fix incorrect mem=X@Y handling
  MIPS: Fix typo BIG_ENDIAN to CPU_BIG_ENDIAN
  mm: Fix memory size alignment in devm_memremap_pages_release()
  mm: hide a #warning for COMPILE_TEST
  ext4: correct documentation for grpid mount option
  ext4: save error to disk in __ext4_grp_locked_error()
  ext4: fix a race in the ext4 shutdown path
  jbd2: fix sphinx kernel-doc build warnings
  Revert "apple-gmux: lock iGP IO to protect from vgaarb changes"
  mlx5: fix mlx5_get_vector_affinity to start from completion vector 0
  Revert "mmc: meson-gx: include tx phase in the tuning process"
  mmc: bcm2835: Don't overwrite max frequency unconditionally
  mmc: sdhci: Implement an SDHCI-specific bounce buffer
  mbcache: initialize entry->e_referenced in mb_cache_entry_create()
  rtc-opal: Fix handling of firmware error codes, prevent busy loops
  drm/radeon: adjust tested variable
  drm/radeon: Add dpm quirk for Jet PRO (v2)
  arm64: Add missing Falkor part number for branch predictor hardening
  drm/ast: Load lut in crtc_commit
  drm/amd/powerplay: Fix smu_table_entry.handle type
  drm/qxl: unref cursor bo when finished with it
  drm/ttm: Fix 'buf' pointer update in ttm_bo_vm_access_kmap() (v2)
  drm/ttm: Don't add swapped BOs to swap-LRU list
  x86/entry/64: Fix CR3 restore in paranoid_exit()
  x86/cpu: Change type of x86_cache_size variable to unsigned int
  x86/spectre: Fix an error message
  x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping
  selftests/x86/mpx: Fix incorrect bounds with old _sigfault
  x86/mm: Rename flush_tlb_single() and flush_tlb_one() to __flush_tlb_one_[user|kernel]()
  kmemcheck: rip it out for real
  kmemcheck: rip it out
  kmemcheck: remove whats left of NOTRACK flags
  kmemcheck: stop using GFP_NOTRACK and SLAB_NOTRACK
  kmemcheck: remove annotations
  x86/speculation: Add <asm/msr-index.h> dependency
  nospec: Move array_index_nospec() parameter checking into separate macro
  x86/speculation: Fix up array_index_nospec_mask() asm constraint
  x86/debug: Use UD2 for WARN()
  x86/debug, objtool: Annotate WARN()-related UD2 as reachable
  objtool: Fix segfault in ignore_unreachable_insn()
  selftests/x86: Disable tests requiring 32-bit support on pure 64-bit systems
  selftests/x86: Do not rely on "int $0x80" in single_step_syscall.c
  selftests/x86: Do not rely on "int $0x80" in test_mremap_vdso.c
  selftests/x86/pkeys: Remove unused functions
  selftests/x86: Clean up and document sscanf() usage
  selftests/x86: Fix vDSO selftest segfault for vsyscall=none
  x86/entry/64: Remove the unused 'icebp' macro
  x86/entry/64: Fix paranoid_entry() frame pointer warning
  x86/entry/64: Indent PUSH_AND_CLEAR_REGS and POP_REGS properly
  x86/entry/64: Get rid of the ALLOC_PT_GPREGS_ON_STACK and SAVE_AND_CLEAR_REGS macros
  x86/entry/64: Use PUSH_AND_CLEAN_REGS in more cases
  x86/entry/64: Introduce the PUSH_AND_CLEAN_REGS macro
  x86/entry/64: Interleave XOR register clearing with PUSH instructions
  x86/entry/64: Merge the POP_C_REGS and POP_EXTRA_REGS macros into a single POP_REGS macro
  x86/entry/64: Merge SAVE_C_REGS and SAVE_EXTRA_REGS, remove unused extensions
  x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface
  PM: cpuidle: Fix cpuidle_poll_state_init() prototype
  PM / runtime: Update links_count also if !CONFIG_SRCU
  x86/speculation: Clean up various Spectre related details
  KVM/nVMX: Set the CPU_BASED_USE_MSR_BITMAPS if we have a valid L02 MSR bitmap
  X86/nVMX: Properly set spec_ctrl and pred_cmd before merging MSRs
  KVM/x86: Reduce retpoline performance impact in slot_handle_level_range(), by always inlining iterator helper methods
  Revert "x86/speculation: Simplify indirect_branch_prediction_barrier()"
  x86/speculation: Correct Speculation Control microcode blacklist again
  x86/speculation: Update Speculation Control microcode blacklist
  x86/mm/pti: Fix PTI comment in entry_SYSCALL_64()
  powerpc/mm/radix: Split linear mapping on hot-unplug
  crypto: sun4i_ss_prng - convert lock to _bh in sun4i_ss_prng_generate
  crypto: sun4i_ss_prng - fix return value of sun4i_ss_prng_generate
  compiler-gcc.h: __nostackprotector needs gcc-4.4 and up
  compiler-gcc.h: Introduce __optimize function attribute
  x86/entry/64/compat: Clear registers for compat syscalls, to reduce speculation attack surface
  x86/entry/64: Clear extra registers beyond syscall arguments, to reduce speculation attack surface
  x86: PM: Make APM idle driver initialize polling state
  x86/xen: init %gs very early to avoid page faults with stack protector
  x86/kexec: Make kexec (mostly) work in 5-level paging mode
  x86/gpu: add CFL to early quirks
  drm/i915/kbl: Change a KBL pci id to GT2 from GT1.5
  drm/i915: add GT number to intel_device_info
  arm: spear13xx: Fix spics gpio controller's warning
  arm: spear13xx: Fix dmas cells
  arm: spear600: Add missing interrupt-parent of rtc
  arm: dts: mt7623: fix card detection issue on bananapi-r2
  ARM: dts: nomadik: add interrupt-parent for clcd
  ARM: dts: STi: Add gpio polarity for "hdmi,hpd-gpio" property
  ARM: lpc3250: fix uda1380 gpio numbers
  arm64: dts: msm8916: Correct ipc references for smsm
  s390: fix handling of -1 in set{,fs}[gu]id16 syscalls
  dma-buf: fix reservation_object_wait_timeout_rcu once more v2
  powerpc: Fix DABR match on hash based systems
  powerpc/xive: Use hw CPU ids when configuring the CPU queues
  powerpc/mm: Flush radix process translations when setting MMU type
  powerpc/numa: Invalidate numa_cpu_lookup_table on cpu remove
  powerpc/radix: Remove trace_tlbie call from radix__flush_tlb_all
  ocfs2: try a blocking lock before return AOP_TRUNCATED_PAGE
  mwifiex: resolve reset vs. remove()/shutdown() deadlocks
  PM / devfreq: Propagate error from devfreq_add_device()
  swiotlb: suppress warning when __GFP_NOWARN is set
  cpufreq: powernv: Dont assume distinct pstate values for nominal and pmin
  RDMA/rxe: Fix rxe_qp_cleanup()
  RDMA/rxe: Fix a race condition in rxe_requester()
  RDMA/rxe: Fix a race condition related to the QP error state
  kselftest: fix OOM in memory compaction test
  selftests: seccomp: fix compile error seccomp_bpf
  IB/core: Avoid a potential OOPs for an unused optional parameter
  IB/core: Fix ib_wc structure size to remain in 64 bytes boundary
  IB/core: Fix two kernel warnings triggered by rxe registration
  IB/mlx4: Fix incorrectly releasing steerable UD QPs when have only ETH ports
  IB/qib: Fix comparison error with qperf compare/swap test
  IB/umad: Fix use of unprotected device pointer
  scsi: smartpqi: allow static build ("built-in")
  tracing: Prevent PROFILE_ALL_BRANCHES when FORTIFY_SOURCE=y

Change-Id: I351a603ea607d9c158727d60c8915981a555044f
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-02-23 15:37:55 -08:00
Levin, Alexander (Sasha Levin)
f369f14861 kmemcheck: rip it out 
commit 4675ff05de2d76d167336b368bd07f3fef6ed5a6 upstream.

Fix up makefiles, remove references, and git rm kmemcheck.

Link: http://lkml.kernel.org/r/20171007030159.22241-4-alexander.levin@verizon.com
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Vegard Nossum <vegardno@ifi.uio.no>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Tim Hansen <devtimhansen@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-02-22 15:42:24 +01:00
Christian König
37efa60e16 swiotlb: suppress warning when __GFP_NOWARN is set 
commit d0bc0c2a31c95002d37c3cc511ffdcab851b3256 upstream.

TTM tries to allocate coherent memory in chunks of 2MB first to improve
TLB efficiency and falls back to allocating 4K pages if that fails.

Suppress the warning when the 2MB allocations fails since there is a
valid fall back path.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reported-by: Mike Galbraith <efault@gmx.de>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=104082
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-02-22 15:42:15 +01:00
Isaac J. Manjarres
2ba985d87a Merge remote-tracking branch 'remotes/origin/tmp-0a91e84' into msm-4.14 
* remotes/origin/tmp-0a91e84:
  Linux 4.14.20
  scsi: cxlflash: Reset command ioasc
  scsi: lpfc: Fix crash after bad bar setup on driver attachment
  rcu: Export init_rcu_head() and destroy_rcu_head() to GPL modules
  scsi: core: Ensure that the SCSI error handler gets woken up
  ftrace: Remove incorrect setting of glob search field
  devpts: fix error handling in devpts_mntget()
  mn10300/misalignment: Use SIGSEGV SEGV_MAPERR to report a failed user copy
  ovl: take mnt_want_write() for removing impure xattr
  ovl: fix failure to fsync lower dir
  acpi, nfit: fix register dimm error handling
  ACPI: sbshc: remove raw pointer from printk() message
  drm/i915: Avoid PPS HW/SW state mismatch due to rounding
  arm64: dts: marvell: add Ethernet aliases
  objtool: Fix switch-table detection
  btrfs: Handle btrfs_set_extent_delalloc failure in fixup worker
  lib/ubsan: add type mismatch handler for new GCC/Clang
  lib/ubsan.c: s/missaligned/misaligned/
  clocksource/drivers/stm32: Fix kernel panic with multiple timers
  blk-mq: quiesce queue before freeing queue
  pktcdvd: Fix a recently introduced NULL pointer dereference
  pktcdvd: Fix pkt_setup_dev() error path
  pinctrl: sx150x: Add a static gpio/pinctrl pin range mapping
  pinctrl: sx150x: Register pinctrl before adding the gpiochip
  pinctrl: sx150x: Unregister the pinctrl on release
  pinctrl: mcp23s08: fix irq setup order
  pinctrl: intel: Initialize GPIO properly when used through irqchip
  EDAC, octeon: Fix an uninitialized variable warning
  xtensa: fix futex_atomic_cmpxchg_inatomic
  alpha: fix formating of stack content
  alpha: fix reboot on Avanti platform
  alpha: Fix mixed up args in EXC macro in futex operations
  alpha: osf_sys.c: fix put_tv32 regression
  alpha: fix crash if pthread_create races with signal delivery
  signal/sh: Ensure si_signo is initialized in do_divide_error
  signal/openrisc: Fix do_unaligned_access to send the proper signal
  ipmi: use dynamic memory for DMI driver override
  Bluetooth: btusb: Restore QCA Rome suspend/resume fix with a "rewritten" version
  Revert "Bluetooth: btusb: fix QCA Rome suspend/resume"
  Bluetooth: btsdio: Do not bind to non-removable BCM43341
  HID: quirks: Fix keyboard + touchpad on Toshiba Click Mini not working
  pipe: fix off-by-one error when checking buffer limits
  pipe: actually allow root to exceed the pipe buffer limits
  kernel/relay.c: revert "kernel/relay.c: fix potential memory leak"
  kernel/async.c: revert "async: simplify lowest_in_progress()"
  fs/proc/kcore.c: use probe_kernel_read() instead of memcpy()
  media: cxusb, dib0700: ignore XC2028_I2C_FLUSH
  media: ts2020: avoid integer overflows on 32 bit machines
  media: dvb-frontends: fix i2c access helpers for KASAN
  kasan: rework Kconfig settings
  kasan: don't emit builtin calls when sanitization is off
  Btrfs: raid56: iterate raid56 internal bio with bio_for_each_segment_all
  watchdog: imx2_wdt: restore previous timeout after suspend+resume
  ASoC: skl: Fix kernel warning due to zero NHTL entry
  ASoC: rockchip: i2s: fix playback after runtime resume
  KVM: PPC: Book3S PR: Fix broken select due to misspelling
  KVM: arm/arm64: Handle CPU_PM_ENTER_FAILED
  KVM: PPC: Book3S HV: Drop locks before reading guest memory
  KVM: PPC: Book3S HV: Make sure we don't re-enter guest without XIVE loaded
  KVM: nVMX: Fix bug of injecting L2 exception into L1
  KVM: nVMX: Fix races when sending nested PI while dest enters/leaves L2
  arm: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls
  crypto: sha512-mb - initialize pending lengths correctly
  crypto: caam - fix endless loop when DECO acquire fails
  media: v4l2-compat-ioctl32.c: make ctrl_is_pointer work for subdevs
  media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic
  media: v4l2-compat-ioctl32.c: don't copy back the result for certain errors
  media: v4l2-compat-ioctl32.c: drop pr_info for unknown buffer type
  media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32
  media: v4l2-compat-ioctl32.c: fix ctrl_is_pointer
  media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32
  media: v4l2-compat-ioctl32.c: avoid sizeof(type)
  media: v4l2-compat-ioctl32.c: move 'helper' functions to __get/put_v4l2_format32
  media: v4l2-compat-ioctl32.c: fix the indentation
  media: v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUF
  media: v4l2-ioctl.c: don't copy back the result for -ENOTTY
  media: v4l2-ioctl.c: use check_fmt for enum/g/s/try_fmt
  crypto: hash - prevent using keyed hashes without setting key
  crypto: hash - annotate algorithms taking optional key
  crypto: poly1305 - remove ->setkey() method
  crypto: mcryptd - pass through absence of ->setkey()
  crypto: cryptd - pass through absence of ->setkey()
  crypto: hash - introduce crypto_hash_alg_has_setkey()
  ahci: Add Intel Cannon Lake PCH-H PCI ID
  ahci: Add PCI ids for Intel Bay Trail, Cherry Trail and Apollo Lake AHCI
  ahci: Annotate PCI ids for mobile Intel chipsets as such
  kernfs: fix regression in kernfs_fop_write caused by wrong type
  NFS: Fix a race between mmap() and O_DIRECT
  NFS: reject request for id_legacy key without auxdata
  NFS: commit direct writes even if they fail partially
  NFS: Fix nfsstat breakage due to LOOKUPP
  NFS: Add a cond_resched() to nfs_commit_release_pages()
  nfs41: do not return ENOMEM on LAYOUTUNAVAILABLE
  nfs/pnfs: fix nfs_direct_req ref leak when i/o falls back to the mds
  ubifs: free the encrypted symlink target
  ubi: block: Fix locking for idr_alloc/idr_remove
  ubi: fastmap: Erase outdated anchor PEBs during attach
  ubi: Fix race condition between ubi volume creation and udev
  mtd: nand: sunxi: Fix ECC strength choice
  mtd: nand: Fix nand_do_read_oob() return value
  mtd: nand: brcmnand: Disable prefetch by default
  mtd: cfi: convert inline functions to macros
  arm64: Kill PSCI_GET_VERSION as a variant-2 workaround
  arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support
  arm/arm64: smccc: Implement SMCCC v1.1 inline primitive
  arm/arm64: smccc: Make function identifiers an unsigned quantity
  firmware/psci: Expose SMCCC version through psci_ops
  firmware/psci: Expose PSCI conduit
  arm64: KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling
  arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support
  arm/arm64: KVM: Turn kvm_psci_version into a static inline
  arm64: KVM: Make PSCI_VERSION a fast path
  arm/arm64: KVM: Advertise SMCCC v1.1
  arm/arm64: KVM: Implement PSCI 1.0 support
  arm/arm64: KVM: Add smccc accessors to PSCI code
  arm/arm64: KVM: Add PSCI_VERSION helper
  arm/arm64: KVM: Consolidate the PSCI include files
  arm64: KVM: Increment PC after handling an SMC trap
  arm64: Branch predictor hardening for Cavium ThunderX2
  arm64: Implement branch predictor hardening for Falkor
  arm64: Implement branch predictor hardening for affected Cortex-A CPUs
  arm64: cputype: Add missing MIDR values for Cortex-A72 and Cortex-A75
  arm64: entry: Apply BP hardening for suspicious interrupts from EL0
  arm64: entry: Apply BP hardening for high-priority synchronous exceptions
  arm64: KVM: Use per-CPU vector when BP hardening is enabled
  arm64: Move BP hardening to check_and_switch_context
  arm64: Add skeleton to harden the branch predictor against aliasing attacks
  arm64: Move post_ttbr_update_workaround to C code
  drivers/firmware: Expose psci_get_version through psci_ops structure
  arm64: cpufeature: Pass capability structure to ->enable callback
  arm64: Run enable method for errata work arounds on late CPUs
  arm64: cpufeature: __this_cpu_has_cap() shouldn't stop early
  arm64: futex: Mask __user pointers prior to dereference
  arm64: uaccess: Mask __user pointers for __arch_{clear, copy_*}_user
  arm64: uaccess: Don't bother eliding access_ok checks in __{get, put}_user
  arm64: uaccess: Prevent speculative use of the current addr_limit
  arm64: entry: Ensure branch through syscall table is bounded under speculation
  arm64: Use pointer masking to limit uaccess speculation
  arm64: Make USER_DS an inclusive limit
  arm64: Implement array_index_mask_nospec()
  arm64: barrier: Add CSDB macros to control data-value prediction
  arm64: idmap: Use "awx" flags for .idmap.text .pushsection directives
  arm64: entry: Reword comment about post_ttbr_update_workaround
  arm64: Force KPTI to be disabled on Cavium ThunderX
  arm64: kpti: Add ->enable callback to remap swapper using nG mappings
  arm64: mm: Permit transitioning from Global to Non-Global without BBM
  arm64: kpti: Make use of nG dependent on arm64_kernel_unmapped_at_el0()
  arm64: Turn on KPTI only on CPUs that need it
  arm64: cputype: Add MIDR values for Cavium ThunderX2 CPUs
  arm64: kpti: Fix the interaction between ASID switching and software PAN
  arm64: mm: Introduce TTBR_ASID_MASK for getting at the ASID in the TTBR
  arm64: capabilities: Handle duplicate entries for a capability
  arm64: Take into account ID_AA64PFR0_EL1.CSV3
  arm64: Kconfig: Reword UNMAP_KERNEL_AT_EL0 kconfig entry
  arm64: Kconfig: Add CONFIG_UNMAP_KERNEL_AT_EL0
  arm64: use RET instruction for exiting the trampoline
  arm64: kaslr: Put kernel vectors address in separate data page
  arm64: entry: Add fake CPU feature for unmapping the kernel at EL0
  arm64: tls: Avoid unconditional zeroing of tpidrro_el0 for native tasks
  arm64: cpu_errata: Add Kryo to Falkor 1003 errata
  arm64: erratum: Work around Falkor erratum #E1003 in trampoline code
  arm64: entry: Hook up entry trampoline to exception vectors
  arm64: entry: Explicitly pass exception level to kernel_ventry macro
  arm64: mm: Map entry trampoline into trampoline and kernel page tables
  arm64: entry: Add exception trampoline page for exceptions from EL0
  arm64: mm: Invalidate both kernel and user ASIDs when performing TLBI
  arm64: mm: Add arm64_kernel_unmapped_at_el0 helper
  arm64: mm: Allocate ASIDs in pairs
  arm64: mm: Fix and re-enable ARM64_SW_TTBR0_PAN
  arm64: mm: Rename post_ttbr0_update_workaround
  arm64: mm: Remove pre_ttbr0_update_workaround for Falkor erratum #E1003
  arm64: mm: Move ASID from TTBR0 to TTBR1
  arm64: mm: Temporarily disable ARM64_SW_TTBR0_PAN
  arm64: mm: Use non-global mappings for kernel space
  arm64: move TASK_* definitions to <asm/processor.h>
  media: hdpvr: Fix an error handling path in hdpvr_probe()
  media: dvb-usb-v2: lmedm04: move ts2020 attach to dm04_lme2510_tuner
  media: dvb-usb-v2: lmedm04: Improve logic checking of warm start
  dccp: CVE-2017-8824: use-after-free in DCCP code
  drm/i915: Fix deadlock in i830_disable_pipe()
  drm/i915: Redo plane sanitation during readout
  drm/i915: Add .get_hw_state() method for planes
  sched/rt: Up the root domain ref count when passing it around via IPIs
  sched/rt: Use container_of() to get root domain in rto_push_irq_work_func()
  KVM MMU: check pending exception before injecting APF
  arm64: Add software workaround for Falkor erratum 1041
  arm64: Define cputype macros for Falkor CPU
  watchdog: gpio_wdt: set WDOG_HW_RUNNING in gpio_wdt_stop
  sched/wait: Fix add_wait_queue() behavioral change
  dmaengine: dmatest: fix container_of member in dmatest_callback
  cpufreq: mediatek: add mediatek related projects into blacklist
  CIFS: zero sensitive data when freeing
  cifs: Fix autonegotiate security settings mismatch
  cifs: Fix missing put_xid in cifs_file_strict_mmap
  powerpc/pseries: include linux/types.h in asm/hvcall.h
  watchdog: indydog: Add dependency on SGI_HAS_INDYDOG
  ANDROID: Fixup 64/32-bit divide confusion for WALT configs

Conflicts:
	include/trace/events/sched.h
	kernel/sched/sched.h
	lib/ubsan.c
	lib/ubsan.h
	arch/arm64/configs/sdm855_defconfig
	arch/arm64/configs/sdm855-perf_defconfig

Change-Id: I034588046a45f3d8be0615bed40d2ddd334ebd74
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-02-21 16:33:21 -08:00
Andrey Ryabinin
2617e62c2f lib/ubsan: add type mismatch handler for new GCC/Clang 
commit 42440c1f9911b4b7b8ba3dc4e90c1197bc561211 upstream.

UBSAN=y fails to build with new GCC/clang:

    arch/x86/kernel/head64.o: In function `sanitize_boot_params':
    arch/x86/include/asm/bootparam_utils.h:37: undefined reference to `__ubsan_handle_type_mismatch_v1'

because Clang and GCC 8 slightly changed ABI for 'type mismatch' errors.
Compiler now uses new __ubsan_handle_type_mismatch_v1() function with
slightly modified 'struct type_mismatch_data'.

Let's add new 'struct type_mismatch_data_common' which is independent from
compiler's layout of 'struct type_mismatch_data'.  And make
__ubsan_handle_type_mismatch[_v1]() functions transform compiler-dependent
type mismatch data to our internal representation.  This way, we can
support both old and new compilers with minimal amount of change.

Link: http://lkml.kernel.org/r/20180119152853.16806-1-aryabinin@virtuozzo.com
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Reported-by: Sodagudi Prasad <psodagud@codeaurora.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-02-16 20:23:09 +01:00
Andrew Morton
5a5df77710 lib/ubsan.c: s/missaligned/misaligned/ 
commit b8fe1120b4ba342b4f156d24e952d6e686b20298 upstream.

A vist from the spelling fairy.

Cc: David Laight <David.Laight@ACULAB.COM>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-02-16 20:23:09 +01:00
Arnd Bergmann
062cd3463c kasan: rework Kconfig settings 
commit e7c52b84fb18f08ce49b6067ae6285aca79084a8 upstream.

We get a lot of very large stack frames using gcc-7.0.1 with the default
-fsanitize-address-use-after-scope --param asan-stack=1 options, which can
easily cause an overflow of the kernel stack, e.g.

  drivers/gpu/drm/i915/gvt/handlers.c:2434:1: warning: the frame size of 46176 bytes is larger than 3072 bytes
  drivers/net/wireless/ralink/rt2x00/rt2800lib.c:5650:1: warning: the frame size of 23632 bytes is larger than 3072 bytes
  lib/atomic64_test.c:250:1: warning: the frame size of 11200 bytes is larger than 3072 bytes
  drivers/gpu/drm/i915/gvt/handlers.c:2621:1: warning: the frame size of 9208 bytes is larger than 3072 bytes
  drivers/media/dvb-frontends/stv090x.c:3431:1: warning: the frame size of 6816 bytes is larger than 3072 bytes
  fs/fscache/stats.c:287:1: warning: the frame size of 6536 bytes is larger than 3072 bytes

To reduce this risk, -fsanitize-address-use-after-scope is now split out
into a separate CONFIG_KASAN_EXTRA Kconfig option, leading to stack
frames that are smaller than 2 kilobytes most of the time on x86_64.  An
earlier version of this patch also prevented combining KASAN_EXTRA with
KASAN_INLINE, but that is no longer necessary with gcc-7.0.1.

All patches to get the frame size below 2048 bytes with CONFIG_KASAN=y
and CONFIG_KASAN_EXTRA=n have been merged by maintainers now, so we can
bring back that default now.  KASAN_EXTRA=y still causes lots of
warnings but now defaults to !COMPILE_TEST to disable it in
allmodconfig, and it remains disabled in all other defconfigs since it
is a new option.  I arbitrarily raise the warning limit for KASAN_EXTRA
to 3072 to reduce the noise, but an allmodconfig kernel still has around
50 warnings on gcc-7.

I experimented a bit more with smaller stack frames and have another
follow-up series that reduces the warning limit for 64-bit architectures
to 1280 bytes (without CONFIG_KASAN).

With earlier versions of this patch series, I also had patches to address
the warnings we get with KASAN and/or KASAN_EXTRA, using a
"noinline_if_stackbloat" annotation.

That annotation now got replaced with a gcc-8 bugfix (see
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81715) and a workaround for
older compilers, which means that KASAN_EXTRA is now just as bad as
before and will lead to an instant stack overflow in a few extreme
cases.

This reverts parts of commit 3f181b4d8652 ("lib/Kconfig.debug: disable
-Wframe-larger-than warnings with KASAN=y").  Two patches in linux-next
should be merged first to avoid introducing warnings in an allmodconfig
build:
  3cd890dbe2a4 ("media: dvb-frontends: fix i2c access helpers for KASAN")
  16c3ada89cff ("media: r820t: fix r820t_write_reg for KASAN")

Do we really need to backport this?

I think we do: without this patch, enabling KASAN will lead to
unavoidable kernel stack overflow in certain device drivers when built
with gcc-7 or higher on linux-4.10+ or any version that contains a
backport of commit c5caf21ab0cf8.  Most people are probably still on
older compilers, but it will get worse over time as they upgrade their
distros.

The warnings we get on kernels older than this should all be for code
that uses dangerously large stack frames, though most of them do not
cause an actual stack overflow by themselves.The asan-stack option was
added in linux-4.0, and commit 3f181b4d8652 ("lib/Kconfig.debug:
disable -Wframe-larger-than warnings with KASAN=y") effectively turned
off the warning for allmodconfig kernels, so I would like to see this
fix backported to any kernels later than 4.0.

I have done dozens of fixes for individual functions with stack frames
larger than 2048 bytes with asan-stack, and I plan to make sure that
all those fixes make it into the stable kernels as well (most are
already there).

Part of the complication here is that asan-stack (from 4.0) was
originally assumed to always require much larger stacks, but that
turned out to be a combination of multiple gcc bugs that we have now
worked around and fixed, but sanitize-address-use-after-scope (from
v4.10) has a much higher inherent stack usage and also suffers from at
least three other problems that we have analyzed but not yet fixed
upstream, each of them makes the stack usage more severe than it should
be.

Link: http://lkml.kernel.org/r/20171221134744.2295529-1-arnd@arndb.de
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-02-16 20:23:04 +01:00
Dmitry Vyukov
e35bdb81ad kasan: detect invalid frees 
Detect frees of pointers into middle of heap objects.

Change-Id: Ia3660c0ac4d4af89caa072d69fbc54cbcbcc3c19
Link: http://lkml.kernel.org/r/cb569193190356beb018a03bb8d6fbae67e7adbc.1514378558.git.dvyukov@google.com
Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>a
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: b1d5728939ebe01a773a75a72e7161408ec9805e
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
 2018-02-12 05:53:57 -08:00
Dmitry Vyukov
8ea798b106 kasan: detect invalid frees for large objects 
Patch series "kasan: detect invalid frees".

KASAN detects double-frees, but does not detect invalid-frees (when a
pointer into a middle of heap object is passed to free).  We recently had
a very unpleasant case in crypto code which freed an inner object inside
of a heap allocation.  This left unnoticed during free, but totally
corrupted heap and later lead to a bunch of random crashes all over kernel
code.

Detect invalid frees.

This patch (of 5):

Detect frees of pointers into middle of large heap objects.

I dropped const from kasan_kfree_large() because it starts propagating
through a bunch of functions in kasan_report.c, slab/slub nearest_obj(),
all of their local variables, fixup_red_left(), etc.

Change-Id: I37dbb7cf8b8ceeb594e537396222b29bef6a0eea
Link: http://lkml.kernel.org/r/1b45b4fe1d20fc0de1329aab674c1dd973fee723.1514378558.git.dvyukov@google.com
Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>a
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: 47adccce3e8a31d315f47183ab1185862b2fc5d4
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
 2018-02-12 05:53:56 -08:00
Linux Build Service Account
82eaa9584e Merge "Merge remote-tracking branch 'remotes/origin/tmp-faeb94c' into msm-4.14" 2018-02-09 23:30:00 -08:00
Linux Build Service Account
3b3f58815a Merge "Merge remote-tracking branch 'remotes/origin/tmp-c3a2eda' into msm-4.14" 2018-02-08 18:47:10 -08:00
Linux Build Service Account
c8dd3996fe Merge "lib/ubsan: remove returns-nonnull-attribute checks" 2018-02-08 01:28:19 -08:00
Linux Build Service Account
2ee8a3fa72 Merge "lib/ubsan: add type mismatch handler for new GCC/Clang" 2018-02-08 01:28:18 -08:00
Linux Build Service Account
03ad3d9351 Merge "lib/ubsan.c: s/missaligned/misaligned/" 2018-02-08 01:28:17 -08:00
Andrey Ryabinin
6ccc50118f lib/ubsan: remove returns-nonnull-attribute checks 
Similarly to type mismatch checks, new GCC 8.x and Clang also changed for
ABI for returns_nonnull checks.  While we can update our code to conform
the new ABI it's more reasonable to just remove it.  Because it's just
dead code, we don't have any single user of returns_nonnull attribute in
the whole kernel.

And AFAIU the advantage that this attribute could bring would be mitigated
by -fno-delete-null-pointer-checks cflag that we use to build the kernel.
So it's unlikely we will have a lot of returns_nonnull attribute in
future.

So let's just remove the code, it has no use.

Change-Id: I479d6f1355781017abdee33f5adf8fd3fdbe4304
[aryabinin@virtuozzo.com: fix warning]
  Link: http://lkml.kernel.org/r/20180122165711.11510-1-aryabinin@virtuozzo.com
Link: http://lkml.kernel.org/r/20180119152853.16806-2-aryabinin@virtuozzo.com
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Sodagudi Prasad <psodagud@codeaurora.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: bac7a1fff7926fb9891a18fe33650884b0e13e41
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
 2018-02-07 06:44:09 -08:00
Andrey Ryabinin
0eaa11b6be lib/ubsan: add type mismatch handler for new GCC/Clang 
UBSAN=y fails to build with new GCC/clang:

    arch/x86/kernel/head64.o: In function `sanitize_boot_params':
    arch/x86/include/asm/bootparam_utils.h:37: undefined reference to `__ubsan_handle_type_mismatch_v1'

because Clang and GCC 8 slightly changed ABI for 'type mismatch' errors.
Compiler now uses new __ubsan_handle_type_mismatch_v1() function with
slightly modified 'struct type_mismatch_data'.

Let's add new 'struct type_mismatch_data_common' which is independent from
compiler's layout of 'struct type_mismatch_data'.  And make
__ubsan_handle_type_mismatch[_v1]() functions transform compiler-dependent
type mismatch data to our internal representation.  This way, we can
support both old and new compilers with minimal amount of change.

Change-Id: I94df3107b7b4434305f1188aeadfa40fd0e3d072
Link: http://lkml.kernel.org/r/20180119152853.16806-1-aryabinin@virtuozzo.com
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Reported-by: Sodagudi Prasad <psodagud@codeaurora.org>
Cc: <stable@vger.kernel.org>	[4.5+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: 42440c1f9911b4b7b8ba3dc4e90c1197bc561211
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
 2018-02-07 06:42:00 -08:00
Andrew Morton
db124a989c lib/ubsan.c: s/missaligned/misaligned/ 
A vist from the spelling fairy.

Change-Id: I53e7310d4b5cd86f911c054da381834b9b97b75e
Cc: David Laight <David.Laight@ACULAB.COM>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: b8fe1120b4ba342b4f156d24e952d6e686b20298
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
 2018-02-07 06:40:03 -08:00
Linux Build Service Account
68f1f99b1f Merge "defconfig: sdm855: Enable trace & debug features" 2018-02-07 04:28:00 -08:00
Satya Durga Srinivasu Prabhala
30b0583efc sched: Introduce PANIC_ON_SCHED_BUG 
Introduce PANIC_ON_SCHED_BUG to catch issues related to scheduler
like calling sleepable functions inside atomic context etc.

Change-Id: I9f1fe96772b317b17bd0e7423a48023d3cf141c7
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
 2018-02-06 10:52:57 -08:00
Satya Durga Srinivasu Prabhala
fef9f65460 sched/rt: Add RT class changes snapshot 
This snapshot is taken from msm-4.9 as of commit dd4275868d0fdb7
("sched/rt: Prevent leaking kernel address").

Change-Id: Ifb89c7549ef101ccb089c665b7e93b2c8130e849
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
 2018-02-06 10:52:02 -08:00
Isaac J. Manjarres
3d13954930 Merge remote-tracking branch 'remotes/origin/tmp-faeb94c' into msm-4.14 
* remotes/origin/tmp-faeb94c:
  Linux 4.14.17
  x86/efi: Clarify that reset attack mitigation needs appropriate userspace
  Input: synaptics-rmi4 - do not delete interrupt memory too early
  Input: synaptics-rmi4 - unmask F03 interrupts when port is opened
  test_firmware: fix missing unlock on error in config_num_requests_store()
  iio: chemical: ccs811: Fix output of IIO_CONCENTRATION channels
  iio: adc: stm32: fix scan of multiple channels with DMA
  spi: imx: do not access registers while clocks disabled
  serial: imx: Only wakeup via RTSDEN bit if the system has RTS/CTS
  serial: 8250_uniphier: fix error return code in uniphier_uart_probe()
  serial: 8250_of: fix return code when probe function fails to get reset
  mei: me: allow runtime pm for platform with D0i3
  android: binder: use VM_ALLOC to get vm area
  ANDROID: binder: remove waitqueue when thread exits.
  usb/gadget: Fix "high bandwidth" check in usb_gadget_ep_match_desc()
  usb: uas: unconditionally bring back host after reset
  usb: f_fs: Prevent gadget unbind if it is already unbound
  USB: serial: simple: add Motorola Tetra driver
  usbip: list: don't list devices attached to vhci_hcd
  usbip: prevent bind loops on devices attached to vhci_hcd
  USB: serial: io_edgeport: fix possible sleep-in-atomic
  CDC-ACM: apply quirk for card reader
  USB: cdc-acm: Do not log urb submission errors on disconnect
  USB: serial: pl2303: new device id for Chilitag
  usb: option: Add support for FS040U modem
  tty: fix data race between tty_init_dev and flush of buf
  staging: ccree: fix fips event irq handling build
  staging: ccree: NULLify backup_info when unused
  staging: lustre: separate a connection destroy from free struct kib_conn
  KVM: x86: emulate #UD while in guest mode
  drm/vc4: Move IRQ enable to PM path
  staging: rtl8188eu: Fix incorrect response to SIOCGIWESSID
  usb: gadget: don't dereference g until after it has been null checked
  x86/xen: Support early interrupts in xen pv guests
  media: usbtv: add a new usbid
  ARM: dts: NSP: Fix PPI interrupt types
  ARM: dts: NSP: Disable AHCI controller for HR NSP boards
  iwlwifi: fix access to prph when transport is stopped
  iwlwifi: mvm: fix the TX queue hang timeout for MONITOR vif type
  scsi: ufs: ufshcd: fix potential NULL pointer dereference in ufshcd_config_vreg
  scsi: aacraid: Prevent crash in case of free interrupt during scsi EH path
  perf/core: Fix memory leak triggered by perf --namespace
  xfs: Properly retry failed dquot items in case of error during buffer writeback
  xfs: ubsan fixes
  drm/omap: displays: panel-dpi: add backlight dependency
  drm/omap: Fix error handling path in 'omap_dmm_probe()'
  drm/bridge: tc358767: fix 1-lane behavior
  drm/bridge: tc358767: fix AUXDATAn registers access
  drm/bridge: tc358767: fix timing calculations
  drm/bridge: tc358767: fix DP0_MISC register set
  drm/bridge: tc358767: filter out too high modes
  drm/bridge: tc358767: do no fail on hi-res displays
  drm/bridge: Fix lvds-encoder since the panel_bridge rework.
  kmemleak: add scheduling point to kmemleak_scan()
  scripts/faddr2line: extend usage on generic arch
  SUNRPC: Allow connect to return EHOSTUNREACH
  quota: Check for register_shrinker() failure.
  net: ethernet: xilinx: Mark XILINX_LL_TEMAC broken on 64-bit
  drm/amdgpu: don't try to move pinned BOs
  xfs: fortify xfs_alloc_buftarg error handling
  nvme-pci: fix NULL pointer dereference in nvme_free_host_mem()
  Btrfs: incremental send, fix wrong unlink path after renaming file
  bnxt_en: Fix an error handling path in 'bnxt_get_module_eeprom()'
  net: phy: marvell10g: fix the PHY id mask
  net: mvpp2: fix the txq_init error path
  quota: propagate error from __dquot_initialize
  hwmon: (pmbus) Use 64bit math for DIRECT format values
  lockd: fix "list_add double add" caused by legacy signal interface
  race of lockd inetaddr notifiers vs nlmsvc_rqst change
  nfsd: check for use of the closed special stateid
  grace: replace BUG_ON by WARN_ONCE in exit_net hook
  nfsd: Ensure we check stateid validity in the seqid operation checks
  nfsd: CLOSE SHOULD return the invalid special stateid for NFSv4.x (x>0)
  auxdisplay: img-ascii-lcd: Only build on archs that have IOMEM
  xen-netfront: remove warning when unloading module
  i2c: i2c-boardinfo: fix memory leaks on devinfo
  xfs: log recovery should replay deferred ops in order
  xfs: always free inline data before resetting inode fork during ifree
  KVM: Let KVM_SET_SIGNAL_MASK work as advertised
  Btrfs: fix list_add corruption and soft lockups in fsync
  KVM: VMX: Fix rflags cache during vCPU reset
  KVM: X86: Fix softlockup when get the current kvmclock
  reiserfs: remove unneeded i_version bump
  sctp: set sender next_tsn for the old result with ctsn_ack_point plus 1
  sctp: avoid flushing unsent queue when doing asoc reset
  sctp: only allow the asoc reset when the asoc outq is empty
  btrfs: fix deadlock when writing out space cache
  mac80211: fix the update of path metric for RANN frame
  mac80211: use QoS NDP for AP probing
  drm/rockchip: dw-mipi-dsi: fix possible un-balanced runtime PM enable
  openvswitch: fix the incorrect flow action alloc size
  nvme-rdma: don't complete requests before a send work request has completed
  uapi: fix linux/kfd_ioctl.h userspace compilation errors
  drm/amdkfd: Fix SDMA oversubsription handling
  drm/amdkfd: Fix SDMA ring buffer size calculation
  drm/amdgpu: Fix SDMA load/unload sequence on HWS disabled mode
  bcache: check return value of register_shrinker
  rxrpc: Fix service endpoint expiry
  rxrpc: Provide a different lockdep key for call->user_mutex for kernel calls
  rxrpc: The mutex lock returned by rxrpc_accept_call() needs releasing
  s390: fix alloc_pgste check in init_new_context again
  null_blk: fix dev->badblocks leak
  cpufreq: Add Loongson machine dependencies
  ACPI / bus: Leave modalias empty for devices which are not present
  s390/zcrypt: Fix wrong comparison leading to strange load balancing
  s390/topology: fix compile error in file arch/s390/kernel/smp.c
  nvmet-fc: correct ref counting error when deferred rcv used
  nvme-pci: avoid hmb desc array idx out-of-bound when hmmaxd set.
  nvme-pci: disable APST on Samsung SSD 960 EVO + ASUS PRIME B350M-A
  nvme-loop: check if queue is ready in queue_rq
  nvme-fc: check if queue is ready in queue_rq
  nvme-fabrics: introduce init command check for a queue that is not alive
  KVM: nVMX: Fix vmx_check_nested_events() return value in case an event was reinjected to L2
  KVM: x86: ioapic: Preserve read-only values in the redirection table
  KVM: x86: ioapic: Clear Remote IRR when entry is switched to edge-triggered
  KVM: x86: ioapic: Fix level-triggered EOI and IOAPIC reconfigure race
  KVM: x86: fix em_fxstor() sleeping while in atomic
  KVM: nVMX: Fix mmu context after VMLAUNCH/VMRESUME failure
  KVM: X86: Fix operand/address-size during instruction decoding
  KVM: x86: Don't re-execute instruction when not passing CR2 value
  KVM: x86: emulator: Return to user-mode on L1 CPL=0 emulation failure
  KVM: nVMX/nSVM: Don't intercept #UD when running L2
  cpupower : Fix cpupower working when cpu0 is offline
  cpupowerutils: bench - Fix cpu online check
  Btrfs: bail out gracefully rather than BUG_ON
  btrfs: Fix transaction abort during failure in btrfs_rm_dev_item
  drm/vc4: Account for interrupts in flight
  VFS: Handle lazytime in do_mount()
  scsi: aacraid: Fix hang in kdump
  scsi: aacraid: Fix udev inquiry race condition
  ima/policy: fix parsing of fsuuid
  igb: Free IRQs when device is hotplugged
  mtd: nand: denali_pci: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
  gpio: ath79: add missing MODULE_DESCRIPTION/LICENSE
  gpio: iop: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
  power: reset: zx-reboot: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
  HID: wacom: Fix reporting of touch toggle (WACOM_HID_WD_MUTE_DEVICE) events
  HID: wacom: EKR: ensure devres groups at higher indexes are released
  crypto: af_alg - whitelist mask and type
  crypto: sha3-generic - fixes for alignment and big endian operation
  crypto: inside-secure - avoid unmapping DMA memory that was not mapped
  crypto: inside-secure - fix hash when length is a multiple of a block
  crypto: aesni - Fix out-of-bounds access of the AAD buffer in generic-gcm-aesni
  crypto: aesni - Fix out-of-bounds access of the data buffer in generic-gcm-aesni
  crypto: aesni - add wrapper for generic gcm(aes)
  crypto: aesni - Use GCM IV size constant
  crypto: gcm - add GCM IV size constant
  crypto: aesni - fix typo in generic_gcmaes_decrypt
  crypto: aesni - handle zero length dst buffer
  crypto: ecdh - fix typo in KPP dependency of CRYPTO_ECDH
  ALSA: hda - Reduce the suspend time consumption for ALC256
  gpio: Fix kernel stack leak to userspace
  gpio: stmpe: i2c transfer are forbiden in atomic context
  tools/gpio: Fix build error with musl libc
  KVM: x86: Fix CPUID function for word 6 (80000001_ECX)
  loop: fix concurrent lo_open/lo_release
  futex: Fix OWNER_DEAD fixup
  ANDROID: sdcardfs: Protect set_top
  ANDROID: fsnotify: Notify lower fs of open
  Revert "ANDROID: sdcardfs: notify lower file of opens"
  ANDROID: sdcardfs: Use lower getattr times/size
  ANDROID: Remove duplicate security fix

Change-Id: Icd6d668734e40a73e87cce6c5d467f74cff3e5ae
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
 2018-02-05 12:40:29 -08:00