mirror of
https://github.com/rd-stuffs/msm-4.14.git
synced 2025-02-20 11:45:48 +08:00
245 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Greg Kroah-Hartman
|
1cfd841998 |
This is the 4.14.163 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl4W78kACgkQONu9yGCS aT4NTA//YhoVBrpdfY8I2ELs1HZzQJmzZBI0U8eB3pGPy/PuBLpQLVl99Zmjm62u q2vFtIh7LNLS5f74Pl5qTkWPN/Zapk9nAsyJ9Iy8EUGXZer4mZaIILpBpG+N4OhB /qbK5hkrJg51z97uspk9jTfdzCJ6Sa7j5ssB1BTulT936Naa1wcVgIAoAk0ezNrW mNAfjSmUT0iYbdl60LQgRshFhfk6/S+EuDOWUa34zK9c8JU9ll+cpyqTI//d+gnp 5ttBIx9h/ZDJUDYLe9LSFy56ZUpLkNoDgO7Cqgs+AgvVYVhu2yrZhVSYIpa9gHh9 wxxrRJST2kUELTiKw3e1pEL4SmNv6RvldwqBXqjO7cdTp19aYBGUEKWVEJsHuPrs waW0FMvEZO7lo02sh3nlakOOj6IDqAJOI1ZvLyZiffxwp5LzxV+uh2AvkfQTYSst vEawCIomABPLynYfGil1TCBEe9N0zieNVFRxXLb89xn0KfMWzCvqLO2zr9wChCel KEe+yCViT4bvC+zpUgk3WCXYtk04mLzbVJeEPc6PBn8I4t1olzrztfWRPlK3ywqK XsWDIuOZ0E6advzv+7Ztwk2gcHgKo0vMXXkVUwUm/jOpeaEO9i5bedp37vsGld2m QCwYxGBTFNaASfHHrXQ0i2p/7V7dGTPB2ZR6pQvf96DZepLtS6I= =yTFw -----END PGP SIGNATURE----- Merge 4.14.163 into android-4.14 Changes in 4.14.163 nvme_fc: add module to ops template to allow module references iio: adc: max9611: Fix too short conversion time delay PM / devfreq: Don't fail devfreq_dev_release if not in list RDMA/cma: add missed unregister_pernet_subsys in init failure rxe: correctly calculate iCRC for unaligned payloads scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func scsi: qla2xxx: Don't call qlt_async_event twice scsi: iscsi: qla4xxx: fix double free in probe scsi: libsas: stop discovering if oob mode is disconnected drm/nouveau: Move the declaration of struct nouveau_conn_atom up a bit usb: gadget: fix wrong endpoint desc net: make socket read/write_iter() honor IOCB_NOWAIT md: raid1: check rdev before reference in raid1_sync_request func s390/cpum_sf: Adjust sampling interval to avoid hitting sample limits s390/cpum_sf: Avoid SBD overflow condition in irq handler IB/mlx4: Follow mirror sequence of device add during device removal xen-blkback: prevent premature module unload xen/balloon: fix ballooned page accounting without hotplug enabled PM / hibernate: memory_bm_find_bit(): Tighten node optimisation xfs: fix mount failure crash on invalid iclog memory access taskstats: fix data-race drm: limit to INT_MAX in create_blob ioctl ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code drm/sun4i: hdmi: Remove duplicate cleanup calls MIPS: Avoid VDSO ABI breakage due to global register variable media: pulse8-cec: fix lost cec_transmit_attempt_done() call media: cec: CEC 2.0-only bcast messages were ignored media: cec: avoid decrementing transmit_queue_sz if it is 0 mm/zsmalloc.c: fix the migrated zspage statistics. memcg: account security cred as well to kmemcg pstore/ram: Write new dumps to start of recycled zones locks: print unsigned ino in /proc/locks dmaengine: Fix access to uninitialized dma_slave_caps compat_ioctl: block: handle Persistent Reservations compat_ioctl: block: handle BLKREPORTZONE/BLKRESETZONE ata: libahci_platform: Export again ahci_platform_<en/dis>able_phys() ata: ahci_brcm: Allow optional reset controller to be used ata: ahci_brcm: Fix AHCI resources management gpiolib: fix up emulated open drain outputs tracing: Fix lock inversion in trace_event_enable_tgid_record() tracing: Have the histogram compare functions convert to u64 first ALSA: cs4236: fix error return comparison of an unsigned integer ALSA: firewire-motu: Correct a typo in the clock proc string exit: panic before exit_mm() on global init exit ftrace: Avoid potential division by zero in function profiler arm64: Revert support for execute-only user mappings PM / devfreq: Check NULL governor in available_governors_show nfsd4: fix up replay_matches_cache() scsi: qla2xxx: Drop superfluous INIT_WORK of del_work xfs: don't check for AG deadlock for realtime files in bunmapi platform/x86: pmc_atom: Add Siemens CONNECT X300 to critclk_systems DMI table Bluetooth: btusb: fix PM leak in error case of setup Bluetooth: delete a stray unlock Bluetooth: Fix memory leak in hci_connect_le_scan media: flexcop-usb: ensure -EIO is returned on error condition regulator: ab8500: Remove AB8505 USB regulator media: usb: fix memory leak in af9005_identify_state dt-bindings: clock: renesas: rcar-usb2-clock-sel: Fix typo in example tty: serial: msm_serial: Fix lockup for sysrq and oops fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP scsi: qedf: Do not retry ELS request if qedf_alloc_cmd fails drm/mst: Fix MST sideband up-reply failure handling powerpc/pseries/hvconsole: Fix stack overread via udbg selftests: rtnetlink: add addresses with fixed life time rxrpc: Fix possible NULL pointer access in ICMP handling ath9k_htc: Modify byte order for an error message ath9k_htc: Discard undersized packets arm64: dts: meson: odroid-c2: Disable usb_otg bus to avoid power failed warning net: add annotations on hh->hh_len lockless accesses s390/smp: fix physical to logical CPU map for SMT xen/blkback: Avoid unmapping unmapped grant pages perf/x86/intel/bts: Fix the use of page_private() Linux 4.14.163 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
Aleksandr Yashkin
|
45b0a5affc |
pstore/ram: Write new dumps to start of recycled zones
commit 9e5f1c19800b808a37fb9815a26d382132c26c3d upstream. The ram_core.c routines treat przs as circular buffers. When writing a new crash dump, the old buffer needs to be cleared so that the new dump doesn't end up in the wrong place (i.e. at the end). The solution to this problem is to reset the circular buffer state before writing a new Oops dump. Signed-off-by: Aleksandr Yashkin <a.yashkin@inango-systems.com> Signed-off-by: Nikolay Merinov <n.merinov@inango-systems.com> Signed-off-by: Ariel Gilman <a.gilman@inango-systems.com> Link: https://lore.kernel.org/r/20191223133816.28155-1-n.merinov@inango-systems.com Fixes: 896fc1f0c4c6 ("pstore/ram: Switch to persistent_ram routines") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Greg Kroah-Hartman
|
f960b38ecc |
This is the 4.14.159 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl35LxUACgkQONu9yGCS aT4dLRAAn62JwQdXIRD51BSeXOCxH/oTba3lec9YCf7ttnQojnBKg4Fzxps4R0eH a32uSWOfEb9P7CIIlSAKTx6XPJ3TAmsFjUO1KmO0kbMVmUw6G3yb0g/96/tNjSUt xJwyhYSasQDMmxV/5HvrkCbobeHP1Gf+eacKWfJHaVOUo1UXaW+25A++I5fYOdhn vrcHmJyJAQN38beSOVLDUJ+VXTyEO5ZUG+Pe7IwK1QiOF4JfWoIddCdxxyynT5PR R54x+xPLsaiFXQEjlVIATIsr9KgR3is4utpfSd7MYGxCD7yV4VNrZZighVKBIlV8 39K0zmcpbSIu3PHvxVGxpdjTzPWErPKH6tjHJ/weMI+zy4tHpzUOvpooH46BvYsn XMhlqsYlWS0Nj9eCpUxxkDr1hyuZlpv5RPyW4xKFWor6zQvVi+cl1wiDu0tKCD7T gg3vB04mMOBnGUsEzTc0I/hPcWp6xThQg4N9Zh/MbdwqSkN5KHDgakIMa2yEYRB7 ZLskhnvB2te1KVHvn5CsxR0ABPextALn/u/7qELgGIKoyJVzgmL/lF3wceGsUwz3 hpcWmYKKu5nPg+L1bCHj05O3IcaUhCmvTBkV39nh4TshTTPU0PkvBv20UoChcgER /4QhKydpeLwKi5hTuBuHN6z3PuGrId3opf28KdGsHQ1KGPqd5os= =p3OE -----END PGP SIGNATURE----- Merge 4.14.159 into android-4.14 Changes in 4.14.159 rsi: release skb if rsi_prepare_beacon fails arm64: tegra: Fix 'active-low' warning for Jetson TX1 regulator usb: gadget: u_serial: add missing port entry locking tty: serial: fsl_lpuart: use the sg count from dma_map_sg tty: serial: msm_serial: Fix flow control serial: pl011: Fix DMA ->flush_buffer() serial: serial_core: Perform NULL checks for break_ctl ops serial: ifx6x60: add missed pm_runtime_disable autofs: fix a leak in autofs_expire_indirect() RDMA/hns: Correct the value of HNS_ROCE_HEM_CHUNK_LEN iwlwifi: pcie: don't consider IV len in A-MSDU exportfs_decode_fh(): negative pinned may become positive without the parent locked audit_get_nd(): don't unlock parent too early NFC: nxp-nci: Fix NULL pointer dereference after I2C communication error xfrm: release device reference for invalid state Input: cyttsp4_core - fix use after free bug sched/core: Avoid spurious lock dependencies ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed() rsxx: add missed destroy_workqueue calls in remove net: ep93xx_eth: fix mismatch of request_mem_region in remove i2c: core: fix use after free in of_i2c_notify serial: core: Allow processing sysrq at port unlock time cxgb4vf: fix memleak in mac_hlist initialization iwlwifi: mvm: synchronize TID queue removal iwlwifi: mvm: Send non offchannel traffic via AP sta ARM: 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+ net/mlx5: Release resource on error flow clk: sunxi-ng: a64: Fix gate bit of DSI DPHY dlm: fix possible call to kfree() for non-initialized pointer extcon: max8997: Fix lack of path setting in USB device mode net: ethernet: ti: cpts: correct debug for expired txq skb rtc: s3c-rtc: Avoid using broken ALMYEAR register i40e: don't restart nway if autoneg not supported clk: rockchip: fix rk3188 sclk_smc gate data clk: rockchip: fix rk3188 sclk_mac_lbtest parameter ordering ARM: dts: rockchip: Fix rk3288-rock2 vcc_flash name dlm: fix missing idr_destroy for recover_idr MIPS: SiByte: Enable ZONE_DMA32 for LittleSur net: dsa: mv88e6xxx: Work around mv886e6161 SERDES missing MII_PHYSID2 scsi: zfcp: drop default switch case which might paper over missing case crypto: ecc - check for invalid values in the key verification test crypto: bcm - fix normal/non key hash algorithm failure pinctrl: qcom: ssbi-gpio: fix gpio-hog related boot issues Staging: iio: adt7316: Fix i2c data reading, set the data field mm/vmstat.c: fix NUMA statistics updates clk: rockchip: fix I2S1 clock gate register for rk3328 clk: rockchip: fix ID of 8ch clock of I2S1 for rk3328 regulator: Fix return value of _set_load() stub net-next/hinic:fix a bug in set mac address iomap: sub-block dio needs to zeroout beyond EOF MIPS: OCTEON: octeon-platform: fix typing net/smc: use after free fix in smc_wr_tx_put_slot() math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning rtc: max8997: Fix the returned value in case of error in 'max8997_rtc_read_alarm()' rtc: dt-binding: abx80x: fix resistance scale ARM: dts: exynos: Use Samsung SoC specific compatible for DWC2 module media: pulse8-cec: return 0 when invalidating the logical address media: cec: report Vendor ID after initialization dmaengine: coh901318: Fix a double-lock bug dmaengine: coh901318: Remove unused variable dmaengine: dw-dmac: implement dma protection control setting usb: dwc3: debugfs: Properly print/set link state for HS usb: dwc3: don't log probe deferrals; but do log other error codes ACPI: fix acpi_find_child_device() invocation in acpi_preset_companion() f2fs: fix count of seg_freed to make sec_freed correct f2fs: change segment to section in f2fs_ioc_gc_range ARM: dts: rockchip: Fix the PMU interrupt number for rv1108 ARM: dts: rockchip: Assign the proper GPIO clocks for rv1108 f2fs: fix to allow node segment for GC by ioctl path sparc: Correct ctx->saw_frame_pointer logic. dma-mapping: fix return type of dma_set_max_seg_size() altera-stapl: check for a null key before strcasecmp'ing it serial: imx: fix error handling in console_setup i2c: imx: don't print error message on probe defer lockd: fix decoding of TEST results ASoC: rsnd: tidyup registering method for rsnd_kctrl_new() ARM: dts: sun5i: a10s: Fix HDMI output DTC warning ARM: dts: sun8i: v3s: Change pinctrl nodes to avoid warning dlm: NULL check before kmem_cache_destroy is not needed ARM: debug: enable UART1 for socfpga Cyclone5 nfsd: fix a warning in __cld_pipe_upcall() ASoC: au8540: use 64-bit arithmetic instead of 32-bit ARM: OMAP1/2: fix SoC name printing arm64: dts: meson-gxl-libretech-cc: fix GPIO lines names arm64: dts: meson-gxbb-nanopi-k2: fix GPIO lines names arm64: dts: meson-gxbb-odroidc2: fix GPIO lines names arm64: dts: meson-gxl-khadas-vim: fix GPIO lines names net/x25: fix called/calling length calculation in x25_parse_address_block net/x25: fix null_x25_address handling ARM: dts: mmp2: fix the gpio interrupt cell number ARM: dts: realview-pbx: Fix duplicate regulator nodes tcp: fix off-by-one bug on aborting window-probing socket tcp: fix SNMP under-estimation on failed retransmission tcp: fix SNMP TCP timeout under-estimation modpost: skip ELF local symbols during section mismatch check kbuild: fix single target build for external module mtd: fix mtd_oobavail() incoherent returned value ARM: dts: pxa: clean up USB controller nodes clk: sunxi-ng: h3/h5: Fix CSI_MCLK parent ARM: dts: realview: Fix some more duplicate regulator nodes dlm: fix invalid cluster name warning net/mlx4_core: Fix return codes of unsupported operations pstore/ram: Avoid NULL deref in ftrace merging failure path powerpc/math-emu: Update macros from GCC clk: renesas: r8a77995: Correct parent clock of DU MIPS: OCTEON: cvmx_pko_mem_debug8: use oldest forward compatible definition nfsd: Return EPERM, not EACCES, in some SETATTR cases tty: Don't block on IO when ldisc change is pending media: stkwebcam: Bugfix for wrong return values firmware: qcom: scm: fix compilation error when disabled mlxsw: spectrum_router: Relax GRE decap matching check IB/hfi1: Ignore LNI errors before DC8051 transitions to Polling state IB/hfi1: Close VNIC sdma_progress sleep window mlx4: Use snprintf instead of complicated strcpy usb: mtu3: fix dbginfo in qmu_tx_zlp_error_handler ARM: dts: sunxi: Fix PMU compatible strings media: vimc: fix start stream when link is disabled net: aquantia: fix RSS table and key sizes tcp: exit if nothing to retransmit on RTO timeout sched/fair: Scale bandwidth quota and period without losing quota/period ratio precision fuse: verify nlink fuse: verify attributes ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236 ALSA: pcm: oss: Avoid potential buffer overflows ALSA: hda - Add mute led support for HP ProBook 645 G4 Input: synaptics - switch another X1 Carbon 6 to RMI/SMbus Input: synaptics-rmi4 - re-enable IRQs in f34v7_do_reflash Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers Input: goodix - add upside-down quirk for Teclast X89 tablet coresight: etm4x: Fix input validation for sysfs. Input: Fix memory leak in psxpad_spi_probe x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks CIFS: Fix SMB2 oplock break processing tty: vt: keyboard: reject invalid keycodes can: slcan: Fix use-after-free Read in slcan_open kernfs: fix ino wrap-around detection jbd2: Fix possible overflow in jbd2_log_space_left() drm/i810: Prevent underflow in ioctl KVM: arm/arm64: vgic: Don't rely on the wrong pending table KVM: x86: do not modify masked bits of shared MSRs KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES crypto: crypto4xx - fix double-free in crypto4xx_destroy_sdr crypto: af_alg - cast ki_complete ternary op to int crypto: ccp - fix uninitialized list head crypto: ecdh - fix big endian bug in ECC library crypto: user - fix memory leak in crypto_report spi: atmel: Fix CS high support RDMA/qib: Validate ->show()/store() callbacks before calling them iomap: Fix pipe page leakage during splicing thermal: Fix deadlock in thermal thermal_zone_device_check binder: Handle start==NULL in binder_update_page_range() ASoC: rsnd: fixup MIX kctrl registration KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332) appletalk: Fix potential NULL pointer dereference in unregister_snap_client appletalk: Set error code if register_snap_client failed usb: gadget: configfs: Fix missing spin_lock_init() usb: gadget: pch_udc: fix use after free scsi: qla2xxx: Fix driver unload hang media: venus: remove invalid compat_ioctl32 handler USB: uas: honor flag to avoid CAPACITY16 USB: uas: heed CAPACITY_HEURISTICS USB: documentation: flags on usb-storage versus UAS usb: Allow USB device to be warm reset in suspended state staging: rtl8188eu: fix interface sanity check staging: rtl8712: fix interface sanity check staging: gigaset: fix general protection fault on probe staging: gigaset: fix illegal free on probe errors staging: gigaset: add endpoint-type sanity check usb: xhci: only set D3hot for pci device xhci: Increase STS_HALT timeout in xhci_suspend() xhci: handle some XHCI_TRUST_TX_LENGTH quirks cases as default behaviour. ARM: dts: pandora-common: define wl1251 as child node of mmc3 iio: humidity: hdc100x: fix IIO_HUMIDITYRELATIVE channel reporting USB: atm: ueagle-atm: add missing endpoint check USB: idmouse: fix interface sanity checks USB: serial: io_edgeport: fix epic endpoint lookup USB: adutux: fix interface sanity check usb: core: urb: fix URB structure initialization function usb: mon: Fix a deadlock in usbmon between mmap and read tpm: add check after commands attribs tab allocation mtd: spear_smi: Fix Write Burst mode virtio-balloon: fix managed page counts when migrating pages between zones usb: dwc3: ep0: Clear started flag on completion btrfs: check page->mapping when loading free space cache btrfs: use refcount_inc_not_zero in kill_all_nodes Btrfs: fix negative subv_writers counter and data space leak after buffered write btrfs: Remove btrfs_bio::flags member Btrfs: send, skip backreference walking for extents with many references btrfs: record all roots for rename exchange on a subvol rtlwifi: rtl8192de: Fix missing code to retrieve RX buffer address rtlwifi: rtl8192de: Fix missing callback that tests for hw release of buffer rtlwifi: rtl8192de: Fix missing enable interrupt flag lib: raid6: fix awk build warnings ovl: relax WARN_ON() on rename to self ALSA: hda - Fix pending unsol events at shutdown md/raid0: Fix an error message in raid0_make_request() watchdog: aspeed: Fix clock behaviour for ast2600 hwrng: omap - Fix RNG wait loop timeout dm zoned: reduce overhead of backing device checks workqueue: Fix spurious sanity check failures in destroy_workqueue() workqueue: Fix pwq ref leak in rescuer_thread() ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report blk-mq: avoid sysfs buffer overflow with too many CPU cores cgroup: pids: use atomic64_t for pids->limit ar5523: check NULL before memcpy() in ar5523_cmd() s390/mm: properly clear _PAGE_NOEXEC bit when it is not supported media: bdisp: fix memleak on release media: radio: wl1273: fix interrupt masking on release media: cec.h: CEC_OP_REC_FLAG_ values were swapped cpuidle: Do not unset the driver if it is there already intel_th: Fix a double put_device() in error path intel_th: pci: Add Ice Lake CPU support intel_th: pci: Add Tiger Lake CPU support PM / devfreq: Lock devfreq in trans_stat_show cpufreq: powernv: fix stack bloat and hard limit on number of CPUs ACPI: OSL: only free map once in osl.c ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data() ACPI: PM: Avoid attaching ACPI PM domain to certain devices pinctrl: samsung: Add of_node_put() before return in error path pinctrl: samsung: Fix device node refcount leaks in S3C24xx wakeup controller init pinctrl: samsung: Fix device node refcount leaks in init code pinctrl: samsung: Fix device node refcount leaks in S3C64xx wakeup controller init mmc: host: omap_hsmmc: add code for special init of wl1251 to get rid of pandora_wl1251_init_card ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO polarity ppdev: fix PPGETTIME/PPSETTIME ioctls powerpc: Allow 64bit VDSO __kernel_sync_dicache to work across ranges >4GB powerpc/xive: Prevent page fault issues in the machine crash handler powerpc: Allow flush_icache_range to work across ranges >4GB powerpc/xive: Skip ioremap() of ESB pages for LSI interrupts video/hdmi: Fix AVI bar unpack quota: Check that quota is not dirty before release ext2: check err when partial != NULL quota: fix livelock in dquot_writeback_dquots ext4: Fix credit estimate for final inode freeing reiserfs: fix extended attributes on the root directory block: fix single range discard merge scsi: zfcp: trace channel log even for FCP command responses scsi: qla2xxx: Fix DMA unmap leak scsi: qla2xxx: Fix session lookup in qlt_abort_work() scsi: qla2xxx: Fix qla24xx_process_bidir_cmd() scsi: qla2xxx: Always check the qla2x00_wait_for_hba_online() return value scsi: qla2xxx: Fix message indicating vectors used by driver xhci: Fix memory leak in xhci_add_in_port() xhci: make sure interrupts are restored to correct state iio: adis16480: Add debugfs_reg_access entry phy: renesas: rcar-gen3-usb2: Fix sysfs interface of "role" omap: pdata-quirks: remove openpandora quirks for mmc3 and wl1251 scsi: lpfc: Cap NPIV vports to 256 scsi: lpfc: Correct code setting non existent bits in sli4 ABORT WQE drbd: Change drbd_request_detach_interruptible's return type to int e100: Fix passing zero to 'PTR_ERR' warning in e100_load_ucode_wait x86/MCE/AMD: Turn off MC4_MISC thresholding on all family 0x15 models x86/MCE/AMD: Carve out the MC4_MISC thresholding quirk power: supply: cpcap-battery: Fix signed counter sample register mlxsw: spectrum_router: Refresh nexthop neighbour when it becomes dead media: vimc: fix component match compare ath10k: fix fw crash by moving chip reset after napi disabled powerpc: Avoid clang warnings around setjmp and longjmp powerpc: Fix vDSO clock_getres() ext4: work around deleting a file with i_nlink == 0 safely firmware: qcom: scm: Ensure 'a0' status code is treated as signed mm/shmem.c: cast the type of unmap_start to u64 ext4: fix a bug in ext4_wait_for_tail_page_commit mfd: rk808: Fix RK818 ID template blk-mq: make sure that line break can be printed workqueue: Fix missing kfree(rescuer) in destroy_workqueue() sunrpc: fix crash when cache_head become valid before update net/mlx5e: Fix SFF 8472 eeprom length gfs2: fix glock reference problem in gfs2_trans_remove_revoke kernel/module.c: wakeup processes in module_wq on module unload gpiolib: acpi: Add Terra Pad 1061 to the run_edge_events_on_boot_blacklist raid5: need to set STRIPE_HANDLE for batch head of: unittest: fix memory leak in attach_node_and_children Linux 4.14.159 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
Kees Cook
|
6c22e4aea4 |
pstore/ram: Avoid NULL deref in ftrace merging failure path
[ Upstream commit 8665569e97dd52920713b95675409648986b5b0d ] Given corruption in the ftrace records, it might be possible to allocate tmp_prz without assigning prz to it, but still marking it as needing to be freed, which would cause at least a NULL dereference. smatch warnings: fs/pstore/ram.c:340 ramoops_pstore_read() error: we previously assumed 'prz' could be null (see line 255) https://lists.01.org/pipermail/kbuild-all/2018-December/055528.html Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Fixes: 2fbea82bbb89 ("pstore: Merge per-CPU ftrace records into one") Cc: "Joel Fernandes (Google)" <joel@joelfernandes.org> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Greg Kroah-Hartman
|
dc5b5874e1 |
This is the 4.14.125 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlz/gL8ACgkQONu9yGCS
aT4seg//QP6cbLk/0iW5pvrB3pYigMD8Y0O4z3e0QrJrjOhnFYqQqWx8WYZaIoh8
rx49qfk/wz1ck1sXMa1Uj3X+WUJW0D741DdEva9jVko5aRG80MIX9MxIAOM5xc5c
lg1cJWZVlAdRQK2rp6unddRgbFlfuBuae+6Gn10TYYDASH/yjKzCC9Kfztn2IViB
Gtydz+QMpSw6713QS+/gmjzHQyrhD9lkmYFQI0kf8DZwswk7NEf8ZU8jcf9JhZRJ
EfzBy2ExglCNJyCufvaO7HNuP0TSEOKF9KY4ScydzpXvbcBNTyljWF64Y8EO6fop
oK0zDTSw3LmwRi9q2yZjsD1JVapvO00To9v8BpPhEazNNpKXicVutl+CqBVTy+4w
kzESY1jnJesRdtEmbVjgfDpwU/K4FM5ATo/SI5zBObtpsuxHjwivsgvtQWy1Ul9a
N3e3yUVtvE9Z42pz5sXGWo5AH70oFdTs8CB93LVfPpDN7nJiyPJci5BZX0kkYI3s
gb/ix8pBdrwYY9xWBbi5Y+6h0iPvMZA4o5+rR6NitzjmAvt8JbWfEB6W8Fd2Q/1g
1XadZkv1BnmuGL3mc4r6j3WsoRiNaCll65OmV7oAyIMqBWDhk7HxozYdPZlAhCJe
QfdQh16h2IBhL44kUEKzp+29AAqofUEw+i4XjGHP1QFuOv9nNTg=
=2ESo
-----END PGP SIGNATURE-----
Merge 4.14.125 into android-4.14
Changes in 4.14.125
ethtool: fix potential userspace buffer overflow
Fix memory leak in sctp_process_init
neighbor: Call __ipv4_neigh_lookup_noref in neigh_xmit
net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query
net: rds: fix memory leak in rds_ib_flush_mr_pool
pktgen: do not sleep with the thread lock held.
ipv6: fix EFAULT on sendto with icmpv6 and hdrincl
ipv6: use READ_ONCE() for inet->hdrincl as in ipv4
net: sfp: read eeprom in maximum 16 byte increments
ipv6: fix the check before getting the cookie in rt6_get_cookie
Revert "fib_rules: fix error in backport of e9919a24d302 ("fib_rules: return 0...")"
Revert "fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied"
rcu: locking and unlocking need to always be at least barriers
parisc: Use implicit space register selection for loading the coherence index of I/O pdirs
fuse: fallocate: fix return with locked inode
pstore: Remove needless lock during console writes
pstore: Convert buf_lock to semaphore
pstore/ram: Run without kernel crash dump region
x86/power: Fix 'nosmt' vs hibernation triple fault during resume
i2c: xiic: Add max_read_len quirk
MIPS: Bounds check virt_addr_valid
MIPS: pistachio: Build uImage.gz by default
Revert "MIPS: perf: ath79: Fix perfcount IRQ assignment"
genwqe: Prevent an integer overflow in the ioctl
test_firmware: Use correct snprintf() limit
drm/gma500/cdv: Check vbt config bits when detecting lvds panels
drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3)
drm/amdgpu/psp: move psp version specific function pointers to early_init
drm/radeon: prefer lower reference dividers
drm/i915: Fix I915_EXEC_RING_MASK
drm/i915/fbc: disable framebuffer compression on GeminiLake
TTY: serial_core, add ->install
qmi_wwan: Add quirk for Quectel dynamic config
fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock
fuse: Add FOPEN_STREAM to use stream_open()
ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled
ethtool: check the return value of get_regs_len
Linux 4.14.125
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
Kees Cook
|
08ae2e88de |
pstore/ram: Run without kernel crash dump region
commit 8880fa32c557600f5f624084152668ed3c2ea51e upstream.
The ram pstore backend has always had the crash dumper frontend enabled
unconditionally. However, it was possible to effectively disable it
by setting a record_size=0. All the machinery would run (storing dumps
to the temporary crash buffer), but 0 bytes would ultimately get stored
due to there being no przs allocated for dumps. Commit 89d328f637b9
("pstore/ram: Correctly calculate usable PRZ bytes"), however, assumed
that there would always be at least one allocated dprz for calculating
the size of the temporary crash buffer. This was, of course, not the
case when record_size=0, and would lead to a NULL deref trying to find
the dprz buffer size:
BUG: unable to handle kernel NULL pointer dereference at (null)
...
IP: ramoops_probe+0x285/0x37e (fs/pstore/ram.c:808)
cxt->pstore.bufsize = cxt->dprzs[0]->buffer_size;
Instead, we need to only enable the frontends based on the success of the
prz initialization and only take the needed actions when those zones are
available. (This also fixes a possible error in detecting if the ftrace
frontend should be enabled.)
Reported-and-tested-by: Yaro Slav <yaro330@gmail.com>
Fixes: 89d328f637b9 ("pstore/ram: Correctly calculate usable PRZ bytes")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Kees Cook
|
f72ecfe93a |
pstore: Convert buf_lock to semaphore
commit ea84b580b95521644429cc6748b6c2bf27c8b0f3 upstream. Instead of running with interrupts disabled, use a semaphore. This should make it easier for backends that may need to sleep (e.g. EFI) when performing a write: |BUG: sleeping function called from invalid context at kernel/sched/completion.c:99 |in_atomic(): 1, irqs_disabled(): 1, pid: 2236, name: sig-xstate-bum |Preemption disabled at: |[<ffffffff99d60512>] pstore_dump+0x72/0x330 |CPU: 26 PID: 2236 Comm: sig-xstate-bum Tainted: G D 4.20.0-rc3 #45 |Call Trace: | dump_stack+0x4f/0x6a | ___might_sleep.cold.91+0xd3/0xe4 | __might_sleep+0x50/0x90 | wait_for_completion+0x32/0x130 | virt_efi_query_variable_info+0x14e/0x160 | efi_query_variable_store+0x51/0x1a0 | efivar_entry_set_safe+0xa3/0x1b0 | efi_pstore_write+0x109/0x140 | pstore_dump+0x11c/0x330 | kmsg_dump+0xa4/0xd0 | oops_exit+0x22/0x30 ... Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Fixes: 21b3ddd39fee ("efi: Don't use spinlocks for efi vars") Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Kees Cook
|
d80d6f65fb |
pstore: Remove needless lock during console writes
commit b77fa617a2ff4d6beccad3d3d4b3a1f2d10368aa upstream.
Since the console writer does not use the preallocated crash dump buffer
any more, there is no reason to perform locking around it.
Fixes: 70ad35db3321 ("pstore: Convert console write to use ->write_buf")
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Greg Kroah-Hartman
|
70014b13c2 |
This is the 4.14.96 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlxMHDMACgkQONu9yGCS
aT4oYQ/+OclwNUcJKM2zF4slFRZdvrLKWeOwnroUQ8vzOGrTQTs7G7okXTAI6v2t
TcaNkz91ACbwpHLsGzXkKtjfxrbEgsPAfMzfycZqqg00//BW4VJqa/WYQOrJDe8q
e7g2mVXBDwAyAHHPwlYc8MKWmptQn8qI8YySDN5jaSu8tyLjFuW3HvoUn6ex0Txh
qKTx7z4g7N/SMzgwXtd9Ybi9ubqqolMhU1psXJMNGEZkudAOJHx7nXEoPXUlZV4t
fb3TzAA3JSfXZMSobgYyVsv/KDoXutLdvP7LsexXTGnvZ2CfYeM9MUCLLH+U5Hq4
NZ0ot7Qgd/sdKF9CYi+Z2urUF+Ug53toWqWSxfntPYmAHAZTFCDYbICzb+O/FaCr
DFShHGbyaw7QVnsMOfhrRsIgRqnooOUJ1GlVXPAfROH3O0HFJ58xEYy5jzIPklQG
l4vi8xkcmO67m4B1eGs3t+/VygMXxCZGKdj1+PkJYow44o6FYDq5UyEmPnl7FzG8
JKBg8gye3AJla2lz+IzGDrGOlkxVphNH0ESPNDDSxD3E+2vKZtzK9Gmf99kfYByW
tuAGmo/banQ5qrJpgJ7vQWpvapH454GA6U2/a4Z/G5oXI2paQ7benbLtyRvbHsMD
ELsbyOdzxcWNTl+KQ0l2AU71TprwSI0/wDfO5mXYXfQ8U5ZTrWU=
=Sxip
-----END PGP SIGNATURE-----
Merge 4.14.96 into android-4.14
Changes in 4.14.96
ipv6: Consider sk_bound_dev_if when binding a socket to a v4 mapped address
mlxsw: spectrum: Disable lag port TX before removing it
mlxsw: spectrum_switchdev: Set PVID correctly during VLAN deletion
net, skbuff: do not prefer skb allocation fails early
qmi_wwan: add MTU default to qmap network interface
r8169: Add support for new Realtek Ethernet
ipv6: Take rcu_read_lock in __inet6_bind for mapped addresses
net: dsa: mv88x6xxx: mv88e6390 errata
gpio: pl061: Move irq_chip definition inside struct pl061
platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey
e1000e: allow non-monotonic SYSTIM readings
writeback: don't decrement wb->refcnt if !wb->bdi
serial: set suppress_bind_attrs flag only if builtin
ALSA: oxfw: add support for APOGEE duet FireWire
x86/mce: Fix -Wmissing-prototypes warnings
MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur
arm64: perf: set suppress_bind_attrs flag to true
usb: gadget: udc: renesas_usb3: add a safety connection way for forced_b_device
selinux: always allow mounting submounts
rxe: IB_WR_REG_MR does not capture MR's iova field
jffs2: Fix use of uninitialized delayed_work, lockdep breakage
clk: imx: make mux parent strings const
pstore/ram: Do not treat empty buffers as valid
powerpc/xmon: Fix invocation inside lock region
powerpc/pseries/cpuidle: Fix preempt warning
media: firewire: Fix app_info parameter type in avc_ca{,_app}_info
media: venus: core: Set dma maximum segment size
net: call sk_dst_reset when set SO_DONTROUTE
scsi: target: use consistent left-aligned ASCII INQUIRY data
selftests: do not macro-expand failed assertion expressions
clk: imx6q: reset exclusive gates on init
arm64: Fix minor issues with the dcache_by_line_op macro
kconfig: fix file name and line number of warn_ignored_character()
kconfig: fix memory leak when EOF is encountered in quotation
mmc: atmel-mci: do not assume idle after atmci_request_end
btrfs: improve error handling of btrfs_add_link
tty/serial: do not free trasnmit buffer page under port lock
perf intel-pt: Fix error with config term "pt=0"
perf svghelper: Fix unchecked usage of strncpy()
perf parse-events: Fix unchecked usage of strncpy()
netfilter: ipt_CLUSTERIP: check MAC address when duplicate config is set
dm crypt: use u64 instead of sector_t to store iv_offset
dm kcopyd: Fix bug causing workqueue stalls
tools lib subcmd: Don't add the kernel sources to the include path
dm snapshot: Fix excessive memory usage and workqueue stalls
quota: Lock s_umount in exclusive mode for Q_XQUOTA{ON,OFF} quotactls.
clocksource/drivers/integrator-ap: Add missing of_node_put()
ALSA: bebob: fix model-id of unit for Apogee Ensemble
sysfs: Disable lockdep for driver bind/unbind files
IB/usnic: Fix potential deadlock
scsi: smartpqi: correct lun reset issues
scsi: smartpqi: call pqi_free_interrupts() in pqi_shutdown()
scsi: megaraid: fix out-of-bound array accesses
ocfs2: fix panic due to unrecovered local alloc
mm/page-writeback.c: don't break integrity writeback on ->writepage() error
mm/swap: use nr_node_ids for avail_lists in swap_info_struct
mm, proc: be more verbose about unstable VMA flags in /proc/<pid>/smaps
nfs: fix a deadlock in nfs client initialization
ipmi:pci: Blacklist a Realtek "IPMI" device
cifs: allow disabling insecure dialects in the config
drm/i915/gvt: Fix mmap range check
PCI: dwc: Move interrupt acking into the proper callback
ipmi:ssif: Fix handling of multi-part return messages
Linux 4.14.96
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
Joel Fernandes (Google)
|
e1e3a46706 |
pstore/ram: Do not treat empty buffers as valid
[ Upstream commit 30696378f68a9e3dad6bfe55938b112e72af00c2 ] The ramoops backend currently calls persistent_ram_save_old() even if a buffer is empty. While this appears to work, it is does not seem like the right thing to do and could lead to future bugs so lets avoid that. It also prevents misleading prints in the logs which claim the buffer is valid. I got something like: found existing buffer, size 0, start 0 When I was expecting: no valid data in buffer (sig = ...) This bails out early (and reports with pr_debug()), since it's an acceptable state. Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org> Co-developed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Greg Kroah-Hartman
|
7af2b8dc5a |
This is the 4.14.95 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlxIE0EACgkQONu9yGCS aT61TA/8DW4kMdCfzRvMqCSdK5SZsdrpnCk0UlZ52rW7kR3DAEa3moLlrGJ/+vTe 7fTFB1kvFmhTot3+QApnr/X6tQUHOLP1rQR8jxI62717XZJcJQ8yrg1OVWJsDEYc 48j0/WFPY5bMpFb+Y/H3zwxSKLghxlQ5G+e87TTvZvaa2E7So6qSU6G38xUtyaZX RY+OKJoLr13RhNahcAEX25XTN/L1V2OlKPQyRSn4YByYaFDmVyMi5nr5RHSDIR6Y 9aQyiUsYnHJW55zc4G7h/6uMr3kggZJ2EDpIfNvMbm5GqoY2eUujLEj32sxjud7A GYiOm3avaZ+X8SoZ4l/2V8cAfutBcgMj0X0ctMwmGkg9anCDu9qOSmMxpd5wyArK A8S1M4M29JJ5/jX8guRMWk1drDnPbaZYc+qpPVWkCs3XU490edYKHXzKSYdU24q5 jygFjtyAqlLUFriXhjUQQ+/90W7UN+JZeQM9nyw/fc25o+xK5xKJDTwgkYNdIYPb xcIFLeyYKDs5Z580tA8m6aUvSGznLGIPQPElL8TnDh8CYjzItiqyqHmb78jlU+J1 VpHuSpEwKz8dJXjgPK+7jemxkxQo6DX1JSDse+4plyvU7H8D+KSozGBbJnVj3tT+ F6BypdY6dFe+MaFJaqumuxPDHgrp83GlQ2GCetHocai5DDq5kjY= =erwN -----END PGP SIGNATURE----- Merge 4.14.95 into android-4.14 Changes in 4.14.95 tty/ldsem: Wake up readers after timed out down_write() tty: Hold tty_ldisc_lock() during tty_reopen() tty: Simplify tty->count math in tty_reopen() tty: Don't hold ldisc lock in tty_reopen() if ldisc present can: gw: ensure DLC boundaries after CAN frame modification mmc: sdhci-msm: Disable CDR function on TX media: em28xx: Fix misplaced reset of dev->v4l::field_count sched/fair: Fix bandwidth timer clock drift condition Revert "scsi: target: iscsi: cxgbit: fix csk leak" scsi: target: iscsi: cxgbit: fix csk leak arm64/kvm: consistently handle host HCR_EL2 flags arm64: Don't trap host pointer auth use to EL2 ipv6: fix kernel-infoleak in ipv6_local_error() net: bridge: fix a bug on using a neighbour cache entry without checking its state packet: Do not leak dev refcounts on error exit bonding: update nest level on unlink ip: on queued skb use skb_header_pointer instead of pskb_may_pull crypto: caam - fix zero-length buffer DMA mapping crypto: authencesn - Avoid twice completion call in decrypt path crypto: bcm - convert to use crypto_authenc_extractkeys() crypto: authenc - fix parsing key with misaligned rta_len Revert "btrfs: balance dirty metadata pages in btrfs_finish_ordered_io" btrfs: wait on ordered extents on abort cleanup Yama: Check for pid death before checking ancestry scsi: core: Synchronize request queue PM status only on successful resume scsi: sd: Fix cache_type_store() crypto: talitos - reorder code in talitos_edesc_alloc() crypto: talitos - fix ablkcipher for CONFIG_VMAP_STACK mips: fix n32 compat_ipc_parse_version MIPS: lantiq: Fix IPI interrupt handling OF: properties: add missing of_node_put mfd: tps6586x: Handle interrupts on suspend media: v4l: ioctl: Validate num_planes for debug messages pstore/ram: Avoid allocation and leak of platform data arm64: kaslr: ensure randomized quantities are clean to the PoC Disable MSI also when pcie-octeon.pcie_disable on omap2fb: Fix stack memory disclosure media: vivid: fix error handling of kthread_run media: vivid: set min width/height to a value > 0 bpf: in __bpf_redirect_no_mac pull mac only if present LSM: Check for NULL cred-security on free media: vb2: vb2_mmap: move lock up sunrpc: handle ENOMEM in rpcb_getport_async netfilter: ebtables: account ebt_table_info to kmemcg selinux: fix GPF on invalid policy blockdev: Fix livelocks on loop device sctp: allocate sctp_sockaddr_entry with kzalloc tipc: fix uninit-value in tipc_nl_compat_link_reset_stats tipc: fix uninit-value in tipc_nl_compat_bearer_enable tipc: fix uninit-value in tipc_nl_compat_link_set tipc: fix uninit-value in tipc_nl_compat_name_table_dump tipc: fix uninit-value in tipc_nl_compat_doit block/loop: Don't grab "struct file" for vfs_getattr() operation. block/loop: Use global lock for ioctl() operation. loop: Fold __loop_release into loop_release loop: Get rid of loop_index_mutex loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl() loop: drop caches if offset or block_size are changed drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock media: vb2: be sure to unlock mutex on errors nbd: Use set_blocksize() to set device blocksize Linux 4.14.95 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Kees Cook
|
96188b1886 |
pstore/ram: Avoid allocation and leak of platform data
commit 5631e8576a3caf606cdc375f97425a67983b420c upstream.
Yue Hu noticed that when parsing device tree the allocated platform data
was never freed. Since it's not used beyond the function scope, this
switches to using a stack variable instead.
Reported-by: Yue Hu <huyue2@yulong.com>
Fixes: 35da60941e44 ("pstore/ram: add Device Tree bindings")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Greg Kroah-Hartman
|
310c9f0e31 |
This is the 4.14.89 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlwXXkgACgkQONu9yGCS aT6JpQ/9HJbNsJQnTRpq06a+pWTEJfekr/QGu3h/Xd3s2MLSrbh+LI1srxV+Uvum RRMMx/6O3MQ79rxhZ8KQASZFi50jct8xOVAYHXteK04Am/Kd+srxATfvzww+qk0Q XqUfT+5Q266eycU2hVkhxTS1mskNBOWc7b6JO30d9+m166D5qflQuwgSm1kjFyGE lceWUJEUN0KFSCIRH2bMs2m0sHPMCIkrzaAAHZgXmWGG9Dg51WlNxHrYCHZhvhI7 qGFRFv6ZLgr29DgGVdlGp6MV5ZCJYBVVHD5l1vnNu7ej190RXZlQaMrmaMWPwoSg c57qHLoo1L6ryv0tic1dT1zHkV2RSTTWqeuOovmp+z0ZKrAgdcUZou/9mAleN3Px QUzbKXAZe3OSOqb8W427EegNfzVlIm/YANU+MjjE1T0XMZytXUn2RjOFRjqJggfn 5ONWdbIWYBfcQKJv33EthG+XXgw7UO8djGG2QeikQzhR4qRVUnUj88ENjLaHC+Q6 U5+4pTvVI/GdbB8vGvK+IRpliO7leAJVMjb46DA9nd8q88dtYI+NNulYCvBtZqcC For7IqJxWtliyIJyOMijKwd3SP+PG+WruvxROohmgscUBvC0gO3K5UA9KLWvUy/w sfnWhnN13Yx/LWi/Ur10c/Ba4lnK4tKGQC23NI/FD8Hdr3R0Cv8= =Ut8S -----END PGP SIGNATURE----- Merge 4.14.89 into android-4.14 Changes in 4.14.89 ipv4: ipv6: netfilter: Adjust the frag mem limit when truesize changes ipv6: Check available headroom in ip6_xmit() even without options neighbour: Avoid writing before skb->head in neigh_hh_output() ipv6: sr: properly initialize flowi6 prior passing to ip6_route_output net: 8139cp: fix a BUG triggered by changing mtu with network traffic net/mlx4_core: Correctly set PFC param if global pause is turned off. net/mlx4_en: Change min MTU size to ETH_MIN_MTU net: phy: don't allow __set_phy_supported to add unsupported modes net: Prevent invalid access to skb->prev in __qdisc_drop_all rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices sctp: kfree_rcu asoc tcp: Do not underestimate rwnd_limited tcp: fix NULL ref in tail loss probe tun: forbid iface creation with rtnl ops virtio-net: keep vnet header zeroed after processing XDP ARM: OMAP2+: prm44xx: Fix section annotation on omap44xx_prm_enable_io_wakeup ASoC: rsnd: fixup clock start checker staging: rtl8723bs: Fix the return value in case of error in 'rtw_wx_read32()' ARM: dts: logicpd-somlv: Fix interrupt on mmc3_dat1 ARM: OMAP1: ams-delta: Fix possible use of uninitialized field sysv: return 'err' instead of 0 in __sysv_write_inode selftests: add script to stress-test nft packet path vs. control plane netfilter: nf_tables: fix use-after-free when deleting compat expressions hwmon (ina2xx) Fix NULL id pointer in probe() ASoC: wm_adsp: Fix dma-unsafe read of scratch registers s390/cpum_cf: Reject request for sampling in event initialization hwmon: (ina2xx) Fix current value calculation ASoC: omap-abe-twl6040: Fix missing audio card caused by deferred probing ASoC: dapm: Recalculate audio map forcely when card instantiated iio/hid-sensors: Fix IIO_CHAN_INFO_RAW returning wrong values for signed numbers netfilter: xt_hashlimit: fix a possible memory leak in htable_create() hwmon: (w83795) temp4_type has writable permission perf tools: Restore proper cwd on return from mnt namespace PCI: imx6: Fix link training status detection in link up check objtool: Fix double-free in .cold detection error path objtool: Fix segfault in .cold detection with -ffunction-sections ARM: dts: at91: sama5d2: use the divided clock for SMC Btrfs: send, fix infinite loop due to directory rename dependencies RDMA/mlx5: Fix fence type for IB_WR_LOCAL_INV WR RDMA/rdmavt: Fix rvt_create_ah function signature ASoC: omap-mcbsp: Fix latency value calculation for pm_qos ASoC: omap-mcpdm: Add pm_qos handling to avoid under/overruns with CPU_IDLE ASoC: omap-dmic: Add pm_qos handling to avoid overruns with CPU_IDLE exportfs: do not read dentry after free bpf: fix check of allowed specifiers in bpf_trace_printk ipvs: call ip_vs_dst_notifier earlier than ipv6_dev_notf USB: omap_udc: use devm_request_irq() USB: omap_udc: fix crashes on probe error and module removal USB: omap_udc: fix omap_udc_start() on 15xx machines USB: omap_udc: fix USB gadget functionality on Palm Tungsten E USB: omap_udc: fix rejection of out transfers when DMA is used drm/meson: add support for 1080p25 mode netfilter: ipv6: Preserve link scope traffic original oif IB/mlx5: Fix page fault handling for MW KVM: x86: fix empty-body warnings x86/kvm/vmx: fix old-style function declaration net: thunderx: fix NULL pointer dereference in nic_remove usb: gadget: u_ether: fix unsafe list iteration netfilter: nf_tables: deactivate expressions in rule replecement routine cachefiles: Fix page leak in cachefiles_read_backing_file while vmscan is active igb: fix uninitialized variables ixgbe: recognize 1000BaseLX SFP modules as 1Gbps net: hisilicon: remove unexpected free_netdev drm/amdgpu: Add delay after enable RLC ucode drm/ast: fixed reading monitor EDID not stable issue xen: xlate_mmu: add missing header to fix 'W=1' warning Revert "xen/balloon: Mark unallocated host memory as UNUSABLE" pstore/ram: Correctly calculate usable PRZ bytes fscache: fix race between enablement and dropping of object fscache, cachefiles: remove redundant variable 'cache' nvme: flush namespace scanning work just before removing namespaces ACPI/IORT: Fix iort_get_platform_device_domain() uninitialized pointer value ocfs2: fix deadlock caused by ocfs2_defrag_extent() mm/page_alloc.c: fix calculation of pgdat->nr_zones hfs: do not free node before using hfsplus: do not free node before using debugobjects: avoid recursive calls with kmemleak ocfs2: fix potential use after free Revert "printk: Never set console_may_schedule in console_trylock()" printk: Add console owner and waiter logic to load balance console writes printk: Hide console waiter logic into helpers printk: Never set console_may_schedule in console_trylock() printk: Wake klogd when passing console_lock owner lib/rbtree-test: lower default params flexfiles: enforce per-mirror stateid only for v4 DSes staging: speakup: Replace strncpy with memcpy ALSA: fireface: fix reference to wrong register for clock configuration ALSA: hda/realtek - Fixed headphone issue for ALC700 IB/hfi1: Fix an out-of-bounds access in get_hw_stats tcp: lack of available data can also cause TSO defer Linux 4.14.89 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Kees Cook
|
b718d6bede |
pstore/ram: Correctly calculate usable PRZ bytes
[ Upstream commit 89d328f637b9904b6d4c9af73c8a608b8dd4d6f8 ]
The actual number of bytes stored in a PRZ is smaller than the
bytes requested by platform data, since there is a header on each
PRZ. Additionally, if ECC is enabled, there are trailing bytes used
as well. Normally this mismatch doesn't matter since PRZs are circular
buffers and the leading "overflow" bytes are just thrown away. However, in
the case of a compressed record, this rather badly corrupts the results.
This corruption was visible with "ramoops.mem_size=204800 ramoops.ecc=1".
Any stored crashes would not be uncompressable (producing a pstorefs
"dmesg-*.enc.z" file), and triggering errors at boot:
[ 2.790759] pstore: crypto_comp_decompress failed, ret = -22!
Backporting this depends on commit 70ad35db3321 ("pstore: Convert console
write to use ->write_buf")
Reported-by: Joel Fernandes <joel@joelfernandes.org>
Fixes: b0aad7a99c1d ("pstore: Add compression support to pstore")
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||
|
Greg Kroah-Hartman
|
5efa57938b |
This is the 4.14.72 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlurKVgACgkQONu9yGCS aT4QAQ/6AydrXG3viEM2XdOHlWyi4JyJJlRMciM00gZRcyWHRkEy1S4XgwSmwyWt BglQGrUhCfXkKbhExQYnKKZWarqwdrw3N33kclxxA6HvsIVoci8gvAIuT6vbizKe ZlIeNcyQGCV6KcjbyG3rv3zsy4Mqh3N+SpQ2id2T00dSLje5zPzgRLMBnNkVB1P7 ufZW3eVrPv2aS8Scf7s2Xl52bOBHA9u1Ht7Rdig3kyyfPuSjuhqJKrNiuNDWQ7tS Xg7ZB15bfTia+2ILEydAfURyrgWDB92pOSPM64l/wENoOWk4/HOcxZr9BjyoQneK vfXwRts5mG2JX2MmsTww8n5x2BqlY3Z7pbKySGnLLxcCz87rMPicmyoOIQZxUFsB fGHcBmI4T+UW55Dxc3jfW8u9iAarN2xYZKVG16NY/7HVMLIgxSae1LBSQJZq3mJ8 RPYF7Q3a7A7Mmtn+gJQhRKaI9kB8WDQuf565Vx+9ihOaq0sMU+zdgQGm0hfRx4PT 2L7xYHj0kDB54ZWYpo66CrNSSY97UdSR8W7Yb2ZkDpsmz5uuPU1F2pn58lSzqhu8 oXuIPTmgHvoRAYVpmfTwlYSb28CpBfmRr2noTlrPMYxYVdhWl+1bNSGYO8EJaEH5 hWyMvSRgrngzqe8EihzN9CqyDUXNPBYr/P52auL0Ecx1IlH9Slk= =sCX+ -----END PGP SIGNATURE----- Merge 4.14.72 into android-4.14 Changes in 4.14.72 be2net: Fix memory leak in be_cmd_get_profile_config() net/mlx5: Fix use-after-free in self-healing flow net: qca_spi: Fix race condition in spi transfers rds: fix two RCU related problems net/mlx5: Check for error in mlx5_attach_interface net/mlx5: Fix debugfs cleanup in the device init/remove flow net/mlx5: E-Switch, Fix memory leak when creating switchdev mode FDB tables net/tls: Set count of SG entries if sk_alloc_sg returns -ENOSPC erspan: fix error handling for erspan tunnel erspan: return PACKET_REJECT when the appropriate tunnel is not found tcp: really ignore MSG_ZEROCOPY if no SO_ZEROCOPY hv/netvsc: Fix NULL dereference at single queue mode fallback usb: dwc3: change stream event enable bit back to 13 iommu/arm-smmu-v3: sync the OVACKFLG to PRIQ consumer register iommu/io-pgtable-arm-v7s: Abort allocation when table address overflows the PTE ALSA: msnd: Fix the default sample sizes ALSA: usb-audio: Fix multiple definitions in AU0828_DEVICE() macro xfrm: fix 'passing zero to ERR_PTR()' warning amd-xgbe: use dma_mapping_error to check map errors gfs2: Special-case rindex for gfs2_grow clk: imx6ul: fix missing of_node_put() clk: core: Potentially free connection id clk: clk-fixed-factor: Clear OF_POPULATED flag in case of failure kbuild: add .DELETE_ON_ERROR special target media: tw686x: Fix oops on buffer alloc failure dmaengine: pl330: fix irq race with terminate_all MIPS: ath79: fix system restart media: videobuf2-core: check for q->error in vb2_core_qbuf() IB/rxe: Drop QP0 silently block: allow max_discard_segments to be stacked IB/ipoib: Fix error return code in ipoib_dev_init() mtd/maps: fix solutionengine.c printk format warnings media: ov5645: Supported external clock is 24MHz perf test: Fix subtest number when showing results gfs2: Don't reject a supposedly full bitmap if we have blocks reserved perf tools: Synthesize GROUP_DESC feature in pipe mode fbdev: omapfb: off by one in omapfb_register_client() perf tools: Fix struct comm_str removal crash video: goldfishfb: fix memory leak on driver remove fbdev/via: fix defined but not used warning perf powerpc: Fix callchain ip filtering when return address is in a register video: fbdev: pxafb: clear allocated memory for video modes fbdev: Distinguish between interlaced and progressive modes ARM: exynos: Clear global variable on init error path perf powerpc: Fix callchain ip filtering nvme-rdma: unquiesce queues when deleting the controller KVM: arm/arm64: vgic: Fix possible spectre-v1 write in vgic_mmio_write_apr() powerpc/powernv: opal_put_chars partial write fix staging: bcm2835-camera: fix timeout handling in wait_for_completion_timeout staging: bcm2835-camera: handle wait_for_completion_timeout return properly ASoC: rt5514: Fix the issue of the delay volume applied MIPS: jz4740: Bump zload address mac80211: restrict delayed tailroom needed decrement Smack: Fix handling of IPv4 traffic received by PF_INET6 sockets wan/fsl_ucc_hdlc: use IS_ERR_VALUE() to check return value of qe_muram_alloc arm64: fix possible spectre-v1 write in ptrace_hbp_set_event() reset: imx7: Fix always writing bits as 0 efi/arm: preserve early mapping of UEFI memory map longer for BGRT nfp: avoid buffer leak when FW communication fails xen-netfront: fix queue name setting arm64: dts: qcom: db410c: Fix Bluetooth LED trigger ARM: dts: qcom: msm8974-hammerhead: increase load on l20 for sdhci s390/qeth: fix race in used-buffer accounting s390/qeth: reset layer2 attribute on layer switch platform/x86: toshiba_acpi: Fix defined but not used build warnings KVM: arm/arm64: Fix vgic init race drivers/base: stop new probing during shutdown i2c: aspeed: Fix initial values of master and slave state dmaengine: mv_xor_v2: kill the tasklets upon exit crypto: sharah - Unregister correct algorithms for SAHARA 3 x86/pti: Check the return value of pti_user_pagetable_walk_p4d() x86/pti: Check the return value of pti_user_pagetable_walk_pmd() x86/mm/pti: Add an overflow check to pti_clone_pmds() xen-netfront: fix warn message as irq device name has '/' RDMA/cma: Protect cma dev list with lock pstore: Fix incorrect persistent ram buffer mapping xen/netfront: fix waiting for xenbus state change IB/ipoib: Avoid a race condition between start_xmit and cm_rep_handler s390/crypto: Fix return code checking in cbc_paes_crypt() mmc: omap_hsmmc: fix wakeirq handling on removal ipmi: Fix I2C client removal in the SSIF driver Tools: hv: Fix a bug in the key delete code misc: hmc6352: fix potential Spectre v1 xhci: Fix use after free for URB cancellation on a reallocated endpoint usb: Don't die twice if PCI xhci host is not responding in resume mei: ignore not found client in the enumeration mei: bus: need to unlink client before freeing USB: Add quirk to support DJI CineSSD usb: uas: add support for more quirk flags usb: Avoid use-after-free by flushing endpoints early in usb_set_interface() usb: host: u132-hcd: Fix a sleep-in-atomic-context bug in u132_get_frame() USB: add quirk for WORLDE Controller KS49 or Prodipe MIDI 49C USB controller usb: gadget: udc: renesas_usb3: fix maxpacket size of ep0 USB: net2280: Fix erroneous synchronization change USB: serial: io_ti: fix array underflow in completion handler usb: misc: uss720: Fix two sleep-in-atomic-context bugs USB: serial: ti_usb_3410_5052: fix array underflow in completion handler USB: yurex: Fix buffer over-read in yurex_write() usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt() Revert "cdc-acm: implement put_char() and flush_chars()" cifs: prevent integer overflow in nxt_dir_entry() CIFS: fix wrapping bugs in num_entries() xtensa: ISS: don't allocate memory in platform_setup perf/core: Force USER_DS when recording user stack data x86/EISA: Don't probe EISA bus for Xen PV guests NFSv4.1 fix infinite loop on I/O. binfmt_elf: Respect error return from `regset->active' net/mlx5: Add missing SET_DRIVER_VERSION command translation arm64: dts: uniphier: Add missing cooling device properties for CPUs audit: fix use-after-free in audit_add_watch mtdchar: fix overflows in adjustment of `count` vfs: fix freeze protection in mnt_want_write_file() for overlayfs Bluetooth: Use lock_sock_nested in bt_accept_enqueue evm: Don't deadlock if a crypto algorithm is unavailable KVM: PPC: Book3S HV: Add of_node_put() in success path security: check for kstrdup() failure in lsm_append() MIPS: loongson64: cs5536: Fix PCI_OHCI_INT_REG reads configfs: fix registered group removal pinctrl: rza1: Fix selector use for groups and functions sched/core: Use smp_mb() in wake_woken_function() efi/esrt: Only call efi_mem_reserve() for boot services memory ARM: hisi: handle of_iomap and fix missing of_node_put ARM: hisi: fix error handling and missing of_node_put ARM: hisi: check of_iomap and fix missing of_node_put liquidio: fix hang when re-binding VF host drv after running DPDK VF driver gpu: ipu-v3: csi: pass back mbus_code_to_bus_cfg error codes tty: fix termios input-speed encoding when using BOTHER tty: fix termios input-speed encoding mmc: sdhci-of-esdhc: set proper dma mask for ls104x chips mmc: tegra: prevent HS200 on Tegra 3 mmc: sdhci: do not try to use 3.3V signaling if not supported drm/nouveau: Fix runtime PM leak in drm_open() drm/nouveau/debugfs: Wake up GPU before doing any reclocking drm/nouveau: tegra: Detach from ARM DMA/IOMMU mapping parport: sunbpp: fix error return code sched/fair: Fix util_avg of new tasks for asymmetric systems coresight: Handle errors in finding input/output ports coresight: tpiu: Fix disabling timeouts coresight: ETM: Add support for Arm Cortex-A73 and Cortex-A35 staging: bcm2835-audio: Don't leak workqueue if open fails gpio: pxa: Fix potential NULL dereference gpiolib: Mark gpio_suffixes array with __maybe_unused mfd: 88pm860x-i2c: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT) input: rohm_bu21023: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT) drm/amdkfd: Fix error codes in kfd_get_process rtc: bq4802: add error handling for devm_ioremap ALSA: pcm: Fix snd_interval_refine first/last with open min/max scsi: libfc: fixup 'sleeping function called from invalid context' selftest: timers: Tweak raw_skew to SKIP when ADJ_OFFSET/other clock adjustments are in progress drm/panel: type promotion bug in s6e8aa0_read_mtp_id() blk-mq: only attempt to merge bio if there is rq in sw queue blk-mq: avoid to synchronize rcu inside blk_cleanup_queue() pinctrl: msm: Fix msm_config_group_get() to be compliant pinctrl: qcom: spmi-gpio: Fix pmic_gpio_config_get() to be compliant clk: tegra: bpmp: Don't crash when a clock fails to register mei: bus: type promotion bug in mei_nfc_if_version() earlycon: Initialize port->uartclk based on clock-frequency property earlycon: Remove hardcoded port->uartclk initialization in of_setup_earlycon ASoC: samsung: i2s: Fix error handling path in i2s_set_sysclk() ASoC: samsung: Fix invalid argument when devm_gpiod_get is called drm/i915: Apply the GTT write flush for all !llc machines net/ipv6: prevent use after free in ip6_route_mpath_notify e1000e: Remove Other from EIAC Partial revert "e1000e: Avoid receiver overrun interrupt bursts" e1000e: Fix queue interrupt re-raising in Other interrupt e1000e: Avoid missed interrupts following ICR read Revert "e1000e: Separate signaling for link check/link up" e1000e: Fix link check race condition e1000e: Fix check_for_link return value with autoneg off Linux 4.14.72 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
Bin Yang
|
1e5b387747 |
pstore: Fix incorrect persistent ram buffer mapping
commit 831b624df1b420c8f9281ed1307a8db23afb72df upstream.
persistent_ram_vmap() returns the page start vaddr.
persistent_ram_iomap() supports non-page-aligned mapping.
persistent_ram_buffer_map() always adds offset-in-page to the vaddr
returned from these two functions, which causes incorrect mapping of
non-page-aligned persistent ram buffer.
By default ftrace_size is 4096 and max_ftrace_cnt is nr_cpu_ids. Without
this patch, the zone_sz in ramoops_init_przs() is 4096/nr_cpu_ids which
might not be page aligned. If the offset-in-page > 2048, the vaddr will be
in next page. If the next page is not mapped, it will cause kernel panic:
[ 0.074231] BUG: unable to handle kernel paging request at ffffa19e0081b000
...
[ 0.075000] RIP: 0010:persistent_ram_new+0x1f8/0x39f
...
[ 0.075000] Call Trace:
[ 0.075000] ramoops_init_przs.part.10.constprop.15+0x105/0x260
[ 0.075000] ramoops_probe+0x232/0x3a0
[ 0.075000] platform_drv_probe+0x3e/0xa0
[ 0.075000] driver_probe_device+0x2cd/0x400
[ 0.075000] __driver_attach+0xe4/0x110
[ 0.075000] ? driver_probe_device+0x400/0x400
[ 0.075000] bus_for_each_dev+0x70/0xa0
[ 0.075000] driver_attach+0x1e/0x20
[ 0.075000] bus_add_driver+0x159/0x230
[ 0.075000] ? do_early_param+0x95/0x95
[ 0.075000] driver_register+0x70/0xc0
[ 0.075000] ? init_pstore_fs+0x4d/0x4d
[ 0.075000] __platform_driver_register+0x36/0x40
[ 0.075000] ramoops_init+0x12f/0x131
[ 0.075000] do_one_initcall+0x4d/0x12c
[ 0.075000] ? do_early_param+0x95/0x95
[ 0.075000] kernel_init_freeable+0x19b/0x222
[ 0.075000] ? rest_init+0xbb/0xbb
[ 0.075000] kernel_init+0xe/0xfc
[ 0.075000] ret_from_fork+0x3a/0x50
Signed-off-by: Bin Yang <bin.yang@intel.com>
[kees: add comments describing the mapping differences, updated commit log]
Fixes: 24c3d2f342ed ("staging: android: persistent_ram: Make it possible to use memory outside of bootmem")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
Arve Hjønnevåg
|
ea5c90a736 |
ANDROID: fs: pstore: ram: Add ramoops_console_write_buf api
Allow writing into the ramoops console buffer. Change-Id: Iff0d69b562e4dae33ea7f8d19412227bebb17e47 Signed-off-by: Arve Hjønnevåg <arve@android.com> |
||
Greg Kroah-Hartman
|
b24413180f |
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
Many source files in the tree are missing licensing information, which makes it harder for compliance tools to determine the correct license. By default all files without license information are under the default license of the kernel, which is GPL version 2. Update the files which contain no license information with the 'GPL-2.0' SPDX license identifier. The SPDX identifier is a legally binding shorthand, which can be used instead of the full boiler plate text. This patch is based on work done by Thomas Gleixner and Kate Stewart and Philippe Ombredanne. How this work was done: Patches were generated and checked against linux-4.14-rc6 for a subset of the use cases: - file had no licensing information it it. - file was a */uapi/* one with no licensing information in it, - file was a */uapi/* one with existing licensing information, Further patches will be generated in subsequent months to fix up cases where non-standard license headers were used, and references to license had to be inferred by heuristics based on keywords. The analysis to determine which SPDX License Identifier to be applied to a file was done in a spreadsheet of side by side results from of the output of two independent scanners (ScanCode & Windriver) producing SPDX tag:value files created by Philippe Ombredanne. Philippe prepared the base worksheet, and did an initial spot review of a few 1000 files. The 4.13 kernel was the starting point of the analysis with 60,537 files assessed. Kate Stewart did a file by file comparison of the scanner results in the spreadsheet to determine which SPDX license identifier(s) to be applied to the file. She confirmed any determination that was not immediately clear with lawyers working with the Linux Foundation. Criteria used to select files for SPDX license identifier tagging was: - Files considered eligible had to be source code files. - Make and config files were included as candidates if they contained >5 lines of source - File already had some variant of a license header in it (even if <5 lines). All documentation files were explicitly excluded. The following heuristics were used to determine which SPDX license identifiers to apply. - when both scanners couldn't find any license traces, file was considered to have no license information in it, and the top level COPYING file license applied. For non */uapi/* files that summary was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 11139 and resulted in the first patch in this series. If that file was a */uapi/* path one, it was "GPL-2.0 WITH Linux-syscall-note" otherwise it was "GPL-2.0". Results of that was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 WITH Linux-syscall-note 930 and resulted in the second patch in this series. - if a file had some form of licensing information in it, and was one of the */uapi/* ones, it was denoted with the Linux-syscall-note if any GPL family license was found in the file or had no licensing in it (per prior point). Results summary: SPDX license identifier # files ---------------------------------------------------|------ GPL-2.0 WITH Linux-syscall-note 270 GPL-2.0+ WITH Linux-syscall-note 169 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) 21 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) 17 LGPL-2.1+ WITH Linux-syscall-note 15 GPL-1.0+ WITH Linux-syscall-note 14 ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) 5 LGPL-2.0+ WITH Linux-syscall-note 4 LGPL-2.1 WITH Linux-syscall-note 3 ((GPL-2.0 WITH Linux-syscall-note) OR MIT) 3 ((GPL-2.0 WITH Linux-syscall-note) AND MIT) 1 and that resulted in the third patch in this series. - when the two scanners agreed on the detected license(s), that became the concluded license(s). - when there was disagreement between the two scanners (one detected a license but the other didn't, or they both detected different licenses) a manual inspection of the file occurred. - In most cases a manual inspection of the information in the file resulted in a clear resolution of the license that should apply (and which scanner probably needed to revisit its heuristics). - When it was not immediately clear, the license identifier was confirmed with lawyers working with the Linux Foundation. - If there was any question as to the appropriate license identifier, the file was flagged for further research and to be revisited later in time. In total, over 70 hours of logged manual review was done on the spreadsheet to determine the SPDX license identifiers to apply to the source files by Kate, Philippe, Thomas and, in some cases, confirmation by lawyers working with the Linux Foundation. Kate also obtained a third independent scan of the 4.13 code base from FOSSology, and compared selected files where the other two scanners disagreed against that SPDX file, to see if there was new insights. The Windriver scanner is based on an older version of FOSSology in part, so they are related. Thomas did random spot checks in about 500 files from the spreadsheets for the uapi headers and agreed with SPDX license identifier in the files he inspected. For the non-uapi files Thomas did random spot checks in about 15000 files. In initial set of patches against 4.14-rc6, 3 files were found to have copy/paste license identifier errors, and have been fixed to reflect the correct identifier. Additionally Philippe spent 10 hours this week doing a detailed manual inspection and review of the 12,461 patched files from the initial patch version early this week with: - a full scancode scan run, collecting the matched texts, detected license ids and scores - reviewing anything where there was a license detected (about 500+ files) to ensure that the applied SPDX license was correct - reviewing anything where there was no detection but the patch license was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied SPDX license was correct This produced a worksheet with 20 files needing minor correction. This worksheet was then exported into 3 different .csv files for the different types of files to be modified. These .csv files were then reviewed by Greg. Thomas wrote a script to parse the csv files and add the proper SPDX tag to the file, in the format that the file expected. This script was further refined by Greg based on the output to detect more types of files automatically and to distinguish between header and source .c files (which need different comment types.) Finally Greg ran the script using the .csv files to generate the patches. Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org> Reviewed-by: Philippe Ombredanne <pombredanne@nexb.com> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Kees Cook
|
c71b02e4d2 |
Revert "pstore: Honor dmesg_restrict sysctl on dmesg dumps"
This reverts commit 68c4a4f8abc60c9440ede9cd123d48b78325f7a3, with various conflict clean-ups. The capability check required too much privilege compared to simple DAC controls. A system builder was forced to have crash handler processes run with CAP_SYSLOG which would give it the ability to read (and wipe) the _current_ dmesg, which is much more access than being given access only to the historical log stored in pstorefs. With the prior commit to make the root directory 0750, the files are protected by default but a system builder can now opt to give access to a specific group (via chgrp on the pstorefs root directory) without being forced to also give away CAP_SYSLOG. Suggested-by: Nick Kralevich <nnk@google.com> Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Petr Mladek <pmladek@suse.cz> Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com> |
||
|
Kees Cook
|
d7caa33687 |
pstore: Make default pstorefs root dir perms 0750
Currently only DMESG and CONSOLE record types are protected, and it isn't obvious that they are using a capability check. Instead switch to explicit root directory mode of 0750 to keep files private by default. This will allow the removal of the capability check, which was non-obvious and forces a process to have possibly too much privilege when simple post-boot chgrp for readers would be possible without it. Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com> |
||
Linus Torvalds
|
78dcf73421 |
Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull ->s_options removal from Al Viro: "Preparations for fsmount/fsopen stuff (coming next cycle). Everything gets moved to explicit ->show_options(), killing ->s_options off + some cosmetic bits around fs/namespace.c and friends. Basically, the stuff needed to work with fsmount series with minimum of conflicts with other work. It's not strictly required for this merge window, but it would reduce the PITA during the coming cycle, so it would be nice to have those bits and pieces out of the way" * 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: isofs: Fix isofs_show_options() VFS: Kill off s_options and helpers orangefs: Implement show_options 9p: Implement show_options isofs: Implement show_options afs: Implement show_options affs: Implement show_options befs: Implement show_options spufs: Implement show_options bpf: Implement show_options ramfs: Implement show_options pstore: Implement show_options omfs: Implement show_options hugetlbfs: Implement show_options VFS: Don't use save/replace_mount_options if not using generic_show_options VFS: Provide empty name qstr VFS: Make get_filesystem() return the affected filesystem VFS: Clean up whitespace in fs/namespace.c and fs/super.c Provide a function to create a NUL-terminated string from unterminated data |
||
David Howells
|
349d743895 |
pstore: Implement show_options
Implement the show_options superblock op for pstore as part of a bid to get rid of s_options and generic_show_options() to make it easier to implement a context-based mount where the mount options can be passed individually over a file descriptor. Signed-off-by: David Howells <dhowells@redhat.com> cc: Kees Cook <keescook@chromium.org> cc: Anton Vorontsov <anton@enomsg.org> cc: Colin Cross <ccross@android.com> cc: Tony Luck <tony.luck@intel.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> |
||
Geliang Tang
|
077090af33 |
pstore: use memdup_user
Use memdup_user() helper instead of open-coding to simplify the code. Signed-off-by: Geliang Tang <geliangtang@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
d3762358a7 |
pstore: Fix format string to use %u for record id
The format string for record->id (u64) was using %lld instead of %llu. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
c7f3c595f6 |
pstore: Populate pstore record->time field
The current time will be initially available in the record->time field for all pstore_read() and pstore_write() calls. Backends can either update the field during read(), or use the field during write() instead of fetching time themselves. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
e581ca813a |
pstore: Create common record initializer
In preparation for setting timestamps in the pstore core, create a common initializer routine, instead of using static initializers. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
656de42e83 |
pstore: Avoid potential infinite loop
If a backend does not correctly iterate through its records, pstore will get stuck loading entries. Detect this with a large record count, and announce if we ever hit the limit. This will let future backend reading bugs less annoying to debug. Additionally adjust the error about pstore_mkfile() failing. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
Douglas Anderson
|
f6525b96dd |
pstore: Fix leaked pstore_record in pstore_get_backend_records()
When the "if (record->size <= 0)" test is true in
pstore_get_backend_records() it's pretty clear that nobody holds a
reference to the allocated pstore_record, yet we don't free it.
Let's free it.
Fixes: 2a2b0acf768c ("pstore: Allocate records on heap instead of stack")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
|
||
Ankit Kumar
|
4a16d1cb24 |
pstore: Don't warn if data is uncompressed and type is not PSTORE_TYPE_DMESG
commit 9abdcccc3d5f ("pstore: Extract common arguments into structure")
moved record decompression to function. decompress_record() gets
called without checking type and compressed flag. Warning will be
reported if data is uncompressed. Pstore type PSTORE_TYPE_PPC_OPAL,
PSTORE_TYPE_PPC_COMMON doesn't contain compressed data and warning get
printed part of dmesg.
Partial dmesg log:
[ 35.848914] pstore: ignored compressed record type 6
[ 35.848927] pstore: ignored compressed record type 8
Above warning should not get printed as it is known that data won't be
compressed for above type and it is valid condition.
This patch returns if data is not compressed and print warning only if
data is compressed and type is not PSTORE_TYPE_DMESG.
Reported-by: Anton Blanchard <anton@au1.ibm.com>
Signed-off-by: Ankit Kumar <ankit@linux.vnet.ibm.com>
Reviewed-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Fixes: 9abdcccc3d5f ("pstore: Extract common arguments into structure")
Cc: stable@vger.kernel.org
|
||
|
Linus Torvalds
|
291b38a756 |
Annotation of module parameters that specify device settings
-----BEGIN PGP SIGNATURE-----
iQIVAwUAWPiW6vSw1s6N8H32AQLOrw/+NTqGf7bjq+64YKS6NfR0XDgE+wNJltGO
ck7zJW3NHIg76RNu8s0I9xg5aVmwizz3Z5DGROZquaolnezux4tQihZ3AFyxIzLc
+Y3WHYagcML7yFfjl/WznCLRD5EW3yPln4lCvQO0nW/xICRYeRI057JaIbi2Dtek
BhcXt3c4AjXDLdYJkgtHV3p2R2mt8hcdFdWqqx6s7JaIThZNRGNzxAgtbcB9k5IW
HVG9ZEIL73VBYWHrYivzjHYF5rBnNCPt87eOwDQeTOSkhv8te+u9k+bH8vxZw1T0
XUtDrLBndKiuVo2GUfLkkF8LItx3Q9eLCJYy0joaIliyPqTEsPx9KjQ+Af0cxS9s
ZPCZ5SYf96stKmDeL5xaMfrAmeyVHJ4lc4JTOqdzbIT8blsOSfYO/03p0ALShSDv
/RQLaKGlf8Bjoy8PwKFcXb4sIDufcd/U1Av/EMFXxOfgN/u2JUkGKq6EaIM5B68L
fHPje+aR9VNELPmPjwNOWtmN4I79EH3EItQf7zv0KG+UeKhcHLx/EAcSJ3ZRKEkH
Lathg7pPOEJGArPiVO79TZzBG01ADn1aiwv65XObMzNZ+54xI/mN/Y1DNF/kL5jU
XzvNzEjFt8mwMIZGVNdAt4+pDyMfIZGZSyUkSRKFnaQZMIvQrfQIU9RLBYLX5eOx
+/p0VkIwDpg=
=lbS7
-----END PGP SIGNATURE-----
Merge tag 'hwparam-20170420' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs
Pull hw lockdown support from David Howells:
"Annotation of module parameters that configure hardware resources
including ioports, iomem addresses, irq lines and dma channels.
This allows a future patch to prohibit the use of such module
parameters to prevent that hardware from being abused to gain access
to the running kernel image as part of locking the kernel down under
UEFI secure boot conditions.
Annotations are made by changing:
module_param(n, t, p)
module_param_named(n, v, t, p)
module_param_array(n, t, m, p)
to:
module_param_hw(n, t, hwtype, p)
module_param_hw_named(n, v, t, hwtype, p)
module_param_hw_array(n, t, hwtype, m, p)
where the module parameter refers to a hardware setting
hwtype specifies the type of the resource being configured. This can
be one of:
ioport Module parameter configures an I/O port
iomem Module parameter configures an I/O mem address
ioport_or_iomem Module parameter could be either (runtime set)
irq Module parameter configures an I/O port
dma Module parameter configures a DMA channel
dma_addr Module parameter configures a DMA buffer address
other Module parameter configures some other value
Note that the hwtype is compile checked, but not currently stored (the
lockdown code probably won't require it). It is, however, there for
future use.
A bonus is that the hwtype can also be used for grepping.
The intention is for the kernel to ignore or reject attempts to set
annotated module parameters if lockdown is enabled. This applies to
options passed on the boot command line, passed to insmod/modprobe or
direct twiddling in /sys/module/ parameter files.
The module initialisation then needs to handle the parameter not being
set, by (1) giving an error, (2) probing for a value or (3) using a
reasonable default.
What I can't do is just reject a module out of hand because it may
take a hardware setting in the module parameters. Some important
modules, some ipmi stuff for instance, both probe for hardware and
allow hardware to be manually specified; if the driver is aborts with
any error, you don't get any ipmi hardware.
Further, trying to do this entirely in the module initialisation code
doesn't protect against sysfs twiddling.
[!] Note that in and of itself, this series of patches should have no
effect on the the size of the kernel or code execution - that is
left to a patch in the next series to effect. It does mark
annotated kernel parameters with a KERNEL_PARAM_FL_HWPARAM flag in
an already existing field"
* tag 'hwparam-20170420' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: (38 commits)
Annotate hardware config module parameters in sound/pci/
Annotate hardware config module parameters in sound/oss/
Annotate hardware config module parameters in sound/isa/
Annotate hardware config module parameters in sound/drivers/
Annotate hardware config module parameters in fs/pstore/
Annotate hardware config module parameters in drivers/watchdog/
Annotate hardware config module parameters in drivers/video/
Annotate hardware config module parameters in drivers/tty/
Annotate hardware config module parameters in drivers/staging/vme/
Annotate hardware config module parameters in drivers/staging/speakup/
Annotate hardware config module parameters in drivers/staging/media/
Annotate hardware config module parameters in drivers/scsi/
Annotate hardware config module parameters in drivers/pcmcia/
Annotate hardware config module parameters in drivers/pci/hotplug/
Annotate hardware config module parameters in drivers/parport/
Annotate hardware config module parameters in drivers/net/wireless/
Annotate hardware config module parameters in drivers/net/wan/
Annotate hardware config module parameters in drivers/net/irda/
Annotate hardware config module parameters in drivers/net/hamradio/
Annotate hardware config module parameters in drivers/net/ethernet/
...
|
||
|
Kees Cook
|
3a7d2fd16c |
pstore: Solve lockdep warning by moving inode locks
Lockdep complains about a possible deadlock between mount and unlink (which is technically impossible), but fixing this improves possible future multiple-backend support, and keeps locking in the right order. The lockdep warning could be triggered by unlinking a file in the pstore filesystem: -> #1 (&sb->s_type->i_mutex_key#14){++++++}: lock_acquire+0xc9/0x220 down_write+0x3f/0x70 pstore_mkfile+0x1f4/0x460 pstore_get_records+0x17a/0x320 pstore_fill_super+0xa4/0xc0 mount_single+0x89/0xb0 pstore_mount+0x13/0x20 mount_fs+0xf/0x90 vfs_kern_mount+0x66/0x170 do_mount+0x190/0xd50 SyS_mount+0x90/0xd0 entry_SYSCALL_64_fastpath+0x1c/0xb1 -> #0 (&psinfo->read_mutex){+.+.+.}: __lock_acquire+0x1ac0/0x1bb0 lock_acquire+0xc9/0x220 __mutex_lock+0x6e/0x990 mutex_lock_nested+0x16/0x20 pstore_unlink+0x3f/0xa0 vfs_unlink+0xb5/0x190 do_unlinkat+0x24c/0x2a0 SyS_unlinkat+0x16/0x30 entry_SYSCALL_64_fastpath+0x1c/0xb1 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&sb->s_type->i_mutex_key#14); lock(&psinfo->read_mutex); lock(&sb->s_type->i_mutex_key#14); lock(&psinfo->read_mutex); Reported-by: Marta Lofstedt <marta.lofstedt@intel.com> Reported-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: Namhyung Kim <namhyung@kernel.org> |
||
|
Geliang Tang
|
3509d048c8 |
pstore: Remove unused vmalloc.h in pmsg
Since the vmalloc code has been removed from write_pmsg() in the commit "5bf6d1b pstore/pmsg: drop bounce buffer", remove the unused header vmalloc.h. Signed-off-by: Geliang Tang <geliangtang@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
David Howells
|
b90fe0c4e0 |
Annotate hardware config module parameters in fs/pstore/
When the kernel is running in secure boot mode, we lock down the kernel to prevent userspace from modifying the running kernel image. Whilst this includes prohibiting access to things like /dev/mem, it must also prevent access by means of configuring driver modules in such a way as to cause a device to access or modify the kernel image. To this end, annotate module_param* statements that refer to hardware configuration and indicate for future reference what type of parameter they specify. The parameter parser in the core sees this information and can skip such parameters with an error message if the kernel is locked down. The module initialisation then runs as normal, but just sees whatever the default values for those parameters is. Note that we do still need to do the module initialisation because some drivers have viable defaults set in case parameters aren't specified and some drivers support automatic configuration (e.g. PNP or PCI) in addition to manually coded parameters. This patch annotates drivers in fs/pstore/. Suggested-by: Alan Cox <gnomes@lxorguk.ukuu.org.uk> Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Kees Cook <keescook@chromium.org> cc: Anton Vorontsov <anton@enomsg.org> cc: Colin Cross <ccross@android.com> cc: Tony Luck <tony.luck@intel.com> |
||
|
Kees Cook
|
30800d9977 |
pstore: simplify write_user_compat()
Nothing actually uses write_user_compat() currently, but there is no reason to reuse the dmesg buffer. Instead, just allocate a new record buffer, copy in from userspace, and pass it to write() as normal. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
4c9ec21976 |
pstore: Remove write_buf() callback
Now that write() and write_buf() are functionally identical, this removes write_buf(), and renames write_buf_user() to write_user(). Additionally adds sanity-checks for pstore_info's declared functions and flags at registration time. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
fdd0311863 |
pstore: Replace arguments for write_buf_user() API
Removes argument list in favor of pstore record, though the user buffer remains passed separately since it must carry the __user annotation. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
b10b471145 |
pstore: Replace arguments for write_buf() API
As with the other API updates, this removes the long argument list in favor of passing a single pstore recaord. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
a61072aae6 |
pstore: Replace arguments for erase() API
This removes the argument list for the erase() callback and replaces it with a pointer to the backend record details to be removed. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
83f70f0769 |
pstore: Do not duplicate record metadata
This switches the inode-private data from carrying duplicate metadata to keeping the record passed in during pstore_mkfile(). Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
2a2b0acf76 |
pstore: Allocate records on heap instead of stack
In preparation for handling records off to pstore_mkfile(), allocate the record instead of reusing stack. This still always frees the record, though, since pstore_mkfile() isn't yet keeping it. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
1dfff7dd67 |
pstore: Pass record contents instead of copying
pstore_mkfile() shouldn't have to memcpy the record contents. It can use the existing copy instead. This adjusts the allocation lifetime management and renames the contents variable from "data" to "buf" to assist moving to struct pstore_record in the future. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
7e8cc8dce1 |
pstore: Always allocate buffer for decompression
Currently, pstore_mkfile() performs a memcpy() of the record contents, so it can live anywhere. However, this is needlessly wasteful. In preparation of pstore_mkfile() keeping the record contents, always allocate a buffer for the contents. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
76cc9580e3 |
pstore: Replace arguments for write() API
Similar to the pstore_info read() callback, there were too many arguments. This switches to the new struct pstore_record pointer instead. This adds "reason" and "part" to the record structure as well. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
125cc42baf |
pstore: Replace arguments for read() API
The argument list for the pstore_read() interface is unwieldy. This changes passes the new struct pstore_record instead. The erst backend was already doing something similar internally. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
1edd1aa397 |
pstore: Switch pstore_mkfile to pass record
Instead of the long list of arguments, just pass the new record struct. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
634f8f5167 |
pstore: Move record decompression to function
This moves the record decompression logic out to a separate function to avoid the deep indentation. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
9abdcccc3d |
pstore: Extract common arguments into structure
The read/mkfile pair pass the same arguments and should be cleared between calls. Move to a structure and wipe it after every loop. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
0d7cd09a3d |
pstore: Improve register_pstore() error reporting
Uncommon errors are better to get reported to dmesg so developers can more easily figure out why pstore is unhappy with a backend attempting to register. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
1344dd86f3 |
pstore: Avoid race in module unloading
Technically, it might be possible for struct pstore_info to go out of scope after the module_put(), so report the backend name first. Signed-off-by: Kees Cook <keescook@chromium.org> |
||
|
Kees Cook
|
6330d55347 |
pstore: Shut down worker when unregistering
When built as a module and running with update_ms >= 0, pstore will Oops during module unload since the work timer is still running. This makes sure the worker is stopped before unloading. Signed-off-by: Kees Cook <keescook@chromium.org> Cc: stable@vger.kernel.org |