summaryrefslogtreecommitdiff
path: root/include/linux (follow)
Commit message (Collapse)AuthorAge
* Merge 4.4.124 into android-4.4Greg Kroah-Hartman2018-03-25
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.124 tpm: fix potential buffer overruns caused by bit glitches on the bus tpm_tis: fix potential buffer overruns caused by bit glitches on the bus SMB3: Validate negotiate request must always be signed CIFS: Enable encryption during session setup phase staging: android: ashmem: Fix possible deadlock in ashmem_ioctl platform/x86: asus-nb-wmi: Add wapf4 quirk for the X302UA regulator: anatop: set default voltage selector for pcie x86: i8259: export legacy_pic symbol rtc: cmos: Do not assume irq 8 for rtc when there are no legacy irqs Input: ar1021_i2c - fix too long name in driver's device table time: Change posix clocks ops interfaces to use timespec64 ACPI/processor: Fix error handling in __acpi_processor_start() ACPI/processor: Replace racy task affinity logic cpufreq/sh: Replace racy task affinity logic genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs i2c: i2c-scmi: add a MS HID net: ipv6: send unsolicited NA on admin up media/dvb-core: Race condition when writing to CAM spi: dw: Disable clock after unregistering the host ath: Fix updating radar flags for coutry code India clk: ns2: Correct SDIO bits scsi: virtio_scsi: Always try to read VPD pages KVM: PPC: Book3S PR: Exit KVM on failed mapping ARM: 8668/1: ftrace: Fix dynamic ftrace with DEBUG_RODATA and !FRAME_POINTER iommu/omap: Register driver before setting IOMMU ops md/raid10: wait up frozen array in handle_write_completed NFS: Fix missing pg_cleanup after nfs_pageio_cond_complete() tcp: remove poll() flakes with FastOpen e1000e: fix timing for 82579 Gigabit Ethernet controller ALSA: hda - Fix headset microphone detection for ASUS N551 and N751 IB/ipoib: Fix deadlock between ipoib_stop and mcast join flow IB/ipoib: Update broadcast object if PKey value was changed in index 0 HSI: ssi_protocol: double free in ssip_pn_xmit() IB/mlx4: Take write semaphore when changing the vma struct IB/mlx4: Change vma from shared to private ASoC: Intel: Skylake: Uninitialized variable in probe_codec() Fix driver usage of 128B WQEs when WQ_CREATE is V1. netfilter: xt_CT: fix refcnt leak on error path openvswitch: Delete conntrack entry clashing with an expectation. mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR() wan: pc300too: abort path on failure qlcnic: fix unchecked return value scsi: mac_esp: Replace bogus memory barrier with spinlock infiniband/uverbs: Fix integer overflows NFS: don't try to cross a mountpount when there isn't one there. iio: st_pressure: st_accel: Initialise sensor platform data properly mt7601u: check return value of alloc_skb rndis_wlan: add return value validation Btrfs: send, fix file hole not being preserved due to inline extent mac80211: don't parse encrypted management frames in ieee80211_frame_acked mfd: palmas: Reset the POWERHOLD mux during power off mtip32xx: use runtime tag to initialize command header staging: unisys: visorhba: fix s-Par to boot with option CONFIG_VMAP_STACK set to y staging: wilc1000: fix unchecked return value mmc: sdhci-of-esdhc: limit SD clock for ls1012a/ls1046a ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP ipmi/watchdog: fix wdog hang on panic waiting for ipmi response ACPI / PMIC: xpower: Fix power_table addresses drm/nouveau/kms: Increase max retries in scanout position queries. bnx2x: Align RX buffers power: supply: pda_power: move from timer to delayed_work Input: twl4030-pwrbutton - use correct device for irq request md/raid10: skip spare disk as 'first' disk ia64: fix module loading for gcc-5.4 tcm_fileio: Prevent information leak for short reads video: fbdev: udlfb: Fix buffer on stack sm501fb: don't return zero on failure path in sm501fb_start() net: hns: fix ethtool_get_strings overflow in hns driver cifs: small underflow in cnvrtDosUnixTm() rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL perf tests kmod-path: Don't fail if compressed modules aren't supported Bluetooth: hci_qca: Avoid setup failure on missing rampatch media: c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt drm/msm: fix leak in failed get_pages RDMA/iwpm: Fix uninitialized error code in iwpm_send_mapinfo() rtlwifi: rtl_pci: Fix the bug when inactiveps is enabled. media: bt8xx: Fix err 'bt878_probe()' media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart cros_ec: fix nul-termination for firmware build info platform/chrome: Use proper protocol transfer function mmc: avoid removing non-removable hosts during suspend IB/ipoib: Avoid memory leak if the SA returns a different DGID RDMA/cma: Use correct size when writing netlink stats IB/umem: Fix use of npages/nmap fields vgacon: Set VGA struct resource types drm/omap: DMM: Check for DMM readiness after successful transaction commit pty: cancel pty slave port buf's work in tty_release coresight: Fix disabling of CoreSight TPIU pinctrl: Really force states during suspend/resume iommu/vt-d: clean up pr_irq if request_threaded_irq fails ip6_vti: adjust vti mtu according to mtu of lower device RDMA/ocrdma: Fix permissions for OCRDMA_RESET_STATS nfsd4: permit layoutget of executable-only files clk: si5351: Rename internal plls to avoid name collisions dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63 RDMA/ucma: Fix access to non-initialized CM_ID object Linux 4.4.124 Change-Id: Iac6f5bda7941f032c5b1f58750e084140b0e3f23 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * time: Change posix clocks ops interfaces to use timespec64Deepa Dinamani2018-03-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit d340266e19ddb70dbd608f9deedcfb35fdb9d419 ] struct timespec is not y2038 safe on 32 bit machines. The posix clocks apis use struct timespec directly and through struct itimerspec. Replace the posix clock interfaces to use struct timespec64 and struct itimerspec64 instead. Also fix up their implementations accordingly. Note that the clock_getres() interface has also been changed to use timespec64 even though this particular interface is not affected by the y2038 problem. This helps verification for internal kernel code for y2038 readiness by getting rid of time_t/ timeval/ timespec. Signed-off-by: Deepa Dinamani <deepa.kernel@gmail.com> Cc: arnd@arndb.de Cc: y2038@lists.linaro.org Cc: netdev@vger.kernel.org Cc: Richard Cochran <richardcochran@gmail.com> Cc: john.stultz@linaro.org Link: http://lkml.kernel.org/r/1490555058-4603-3-git-send-email-deepa.kernel@gmail.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | Merge 4.4.123 into android-4.4Greg Kroah-Hartman2018-03-22
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.123 blkcg: fix double free of new_blkg in blkcg_init_queue Input: tsc2007 - check for presence and power down tsc2007 during probe staging: speakup: Replace BUG_ON() with WARN_ON(). staging: wilc1000: add check for kmalloc allocation failure. HID: reject input outside logical range only if null state is set drm: qxl: Don't alloc fbdev if emulation is not supported ath10k: fix a warning during channel switch with multiple vaps PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown() selinux: check for address length in selinux_socket_bind() perf sort: Fix segfault with basic block 'cycles' sort dimension i40e: Acquire NVM lock before reads on all devices i40e: fix ethtool to get EEPROM data from X722 interface perf tools: Make perf_event__synthesize_mmap_events() scale drivers: net: xgene: Fix hardware checksum setting drm: Defer disabling the vblank IRQ until the next interrupt (for instant-off) ath10k: disallow DFS simulation if DFS channel is not enabled perf probe: Return errno when not hitting any event HID: clamp input to logical range if no null state net/8021q: create device with all possible features in wanted_features ARM: dts: Adjust moxart IRQ controller and flags batman-adv: handle race condition for claims between gateways of: fix of_device_get_modalias returned length when truncating buffers solo6x10: release vb2 buffers in solo_stop_streaming() scsi: ipr: Fix missed EH wakeup media: i2c/soc_camera: fix ov6650 sensor getting wrong clock timers, sched_clock: Update timeout for clock wrap sysrq: Reset the watchdog timers while displaying high-resolution timers Input: qt1070 - add OF device ID table sched: act_csum: don't mangle TCP and UDP GSO packets ASoC: rcar: ssi: don't set SSICR.CKDV = 000 with SSIWSR.CONT spi: omap2-mcspi: poll OMAP2_MCSPI_CHSTAT_RXS for PIO transfer tcp: sysctl: Fix a race to avoid unexpected 0 window from space dmaengine: imx-sdma: add 1ms delay to ensure SDMA channel is stopped driver: (adm1275) set the m,b and R coefficients correctly for power mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative() blk-throttle: make sure expire time isn't too big f2fs: relax node version check for victim data in gc bonding: refine bond_fold_stats() wrap detection braille-console: Fix value returned by _braille_console_setup drm/vmwgfx: Fixes to vmwgfx_fb vxlan: vxlan dev should inherit lowerdev's gso_max_size NFC: nfcmrvl: Include unaligned.h instead of access_ok.h NFC: nfcmrvl: double free on error path ARM: dts: r8a7790: Correct parent of SSI[0-9] clocks ARM: dts: r8a7791: Correct parent of SSI[0-9] clocks powerpc: Avoid taking a data miss on every userspace instruction miss net/faraday: Add missing include of of.h ARM: dts: koelsch: Correct clock frequency of X2 DU clock input reiserfs: Make cancel_old_flush() reliable ALSA: firewire-digi00x: handle all MIDI messages on streaming packets fm10k: correctly check if interface is removed scsi: ses: don't get power status of SES device slot on probe apparmor: Make path_max parameter readonly iommu/iova: Fix underflow bug in __alloc_and_insert_iova_range video: ARM CLCD: fix dma allocation size drm/radeon: Fail fb creation from imported dma-bufs. drm/amdgpu: Fail fb creation from imported dma-bufs. (v2) coresight: Fixes coresight DT parse to get correct output port ID. MIPS: BPF: Quit clobbering callee saved registers in JIT code. MIPS: BPF: Fix multiple problems in JIT skb access helpers. MIPS: r2-on-r6-emu: Fix BLEZL and BGTZL identification MIPS: r2-on-r6-emu: Clear BLTZALL and BGEZALL debugfs counters regulator: isl9305: fix array size md/raid6: Fix anomily when recovering a single device in RAID6. usb: dwc2: Make sure we disconnect the gadget state usb: gadget: dummy_hcd: Fix wrong power status bit clear/reset in dummy_hub_control() drivers/perf: arm_pmu: handle no platform_device perf inject: Copy events when reordering events in pipe mode perf session: Don't rely on evlist in pipe mode scsi: sg: check for valid direction before starting the request scsi: sg: close race condition in sg_remove_sfp_usercontext() kprobes/x86: Fix kprobe-booster not to boost far call instructions kprobes/x86: Set kprobes pages read-only pwm: tegra: Increase precision in PWM rate calculation wil6210: fix memory access violation in wil_memcpy_from/toio_32 drm/edid: set ELD connector type in drm_edid_to_eld() video/hdmi: Allow "empty" HDMI infoframes HID: elo: clear BTN_LEFT mapping ARM: dts: exynos: Correct Trats2 panel reset line sched: Stop switched_to_rt() from sending IPIs to offline CPUs sched: Stop resched_cpu() from sending IPIs to offline CPUs test_firmware: fix setting old custom fw path back on exit net: xfrm: allow clearing socket xfrm policies. mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]() ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin ARM: dts: omap3-n900: Fix the audio CODEC's reset pin ath10k: update tdls teardown state to target cpufreq: Fix governor module removal race clk: qcom: msm8916: fix mnd_width for codec_digcodec ath10k: fix invalid STS_CAP_OFFSET_MASK tools/usbip: fixes build with musl libc toolchain spi: sun6i: disable/unprepare clocks on remove scsi: core: scsi_get_device_flags_keyed(): Always return device flags scsi: devinfo: apply to HP XP the same flags as Hitachi VSP scsi: dh: add new rdac devices media: cpia2: Fix a couple off by one bugs veth: set peer GSO values drm/amdkfd: Fix memory leaks in kfd topology agp/intel: Flush all chipset writes after updating the GGTT mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED mac80211: remove BUG() when interface type is invalid ASoC: nuc900: Fix a loop timeout test ipvlan: add L2 check for packets arriving via virtual devices rcutorture/configinit: Fix build directory error message ima: relax requiring a file signature for new files with zero length selftests/x86/entry_from_vm86: Exit with 1 if we fail selftests/x86: Add tests for User-Mode Instruction Prevention selftests/x86: Add tests for the STR and SLDT instructions selftests/x86/entry_from_vm86: Add test cases for POPF x86/vm86/32: Fix POPF emulation x86/mm: Fix vmalloc_fault to use pXd_large ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats() ALSA: hda - Revert power_save option default value ALSA: seq: Fix possible UAF in snd_seq_check_queue() ALSA: seq: Clear client entry before deleting else at closing drm/amdgpu/dce: Don't turn off DP sink when disconnected fs: Teach path_connected to handle nfs filesystems with multiple roots. lock_parent() needs to recheck if dentry got __dentry_kill'ed under it fs/aio: Add explicit RCU grace period when freeing kioctx fs/aio: Use RCU accessors for kioctx_table->table[] irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis scsi: sg: fix SG_DXFER_FROM_DEV transfers scsi: sg: fix static checker warning in sg_is_valid_dxfer scsi: sg: only check for dxfer_len greater than 256M ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux btrfs: alloc_chunk: fix DUP stripe size handling btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe() usb: gadget: bdc: 64-bit pointer capability check bpf: fix incorrect sign extension in check_alu_op() Linux 4.4.123 Change-Id: Ieb89411248f93522dde29edb8581f8ece22e33a7 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * fs: Teach path_connected to handle nfs filesystems with multiple roots.Eric W. Biederman2018-03-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 95dd77580ccd66a0da96e6d4696945b8cea39431 upstream. On nfsv2 and nfsv3 the nfs server can export subsets of the same filesystem and report the same filesystem identifier, so that the nfs client can know they are the same filesystem. The subsets can be from disjoint directory trees. The nfsv2 and nfsv3 filesystems provides no way to find the common root of all directory trees exported form the server with the same filesystem identifier. The practical result is that in struct super s_root for nfs s_root is not necessarily the root of the filesystem. The nfs mount code sets s_root to the root of the first subset of the nfs filesystem that the kernel mounts. This effects the dcache invalidation code in generic_shutdown_super currently called shrunk_dcache_for_umount and that code for years has gone through an additional list of dentries that might be dentry trees that need to be freed to accomodate nfs. When I wrote path_connected I did not realize nfs was so special, and it's hueristic for avoiding calling is_subdir can fail. The practical case where this fails is when there is a move of a directory from the subtree exposed by one nfs mount to the subtree exposed by another nfs mount. This move can happen either locally or remotely. With the remote case requiring that the move directory be cached before the move and that after the move someone walks the path to where the move directory now exists and in so doing causes the already cached directory to be moved in the dcache through the magic of d_splice_alias. If someone whose working directory is in the move directory or a subdirectory and now starts calling .. from the initial mount of nfs (where s_root == mnt_root), then path_connected as a heuristic will not bother with the is_subdir check. As s_root really is not the root of the nfs filesystem this heuristic is wrong, and the path may actually not be connected and path_connected can fail. The is_subdir function might be cheap enough that we can call it unconditionally. Verifying that will take some benchmarking and the result may not be the same on all kernels this fix needs to be backported to. So I am avoiding that for now. Filesystems with snapshots such as nilfs and btrfs do something similar. But as the directory tree of the snapshots are disjoint from one another and from the main directory tree rename won't move things between them and this problem will not occur. Cc: stable@vger.kernel.org Reported-by: Al Viro <viro@ZenIV.linux.org.uk> Fixes: 397d425dc26d ("vfs: Test for and handle paths that are unreachable from their mnt_root") Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * regulator: isl9305: fix array sizeVincent Stehlé2018-03-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 0c08aaf873174c95e674cf21ffcd041c589d2e5b ] ISL9305_MAX_REGULATOR is the last index used to access the init_data[] array, so we need to add one to this last index to obtain the necessary array size. This fixes the following smatch error: drivers/regulator/isl9305.c:160 isl9305_i2c_probe() error: buffer overflow 'pdata->init_data' 3 <= 3 Fixes: dec38b5ce6a9edb4 ("regulator: isl9305: Add Intersil ISL9305/H driver") Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net> Cc: Mark Brown <broonie@kernel.org> Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative()Kirill A. Shutemov2018-03-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 591a3d7c09fa08baff48ad86c2347dbd28a52753 ] 0day testing by Fengguang Wu triggered this crash while running Trinity: kernel BUG at include/linux/pagemap.h:151! ... CPU: 0 PID: 458 Comm: trinity-c0 Not tainted 4.11.0-rc2-00251-g2947ba0 #1 ... Call Trace: __get_user_pages_fast() get_user_pages_fast() get_futex_key() futex_requeue() do_futex() SyS_futex() do_syscall_64() entry_SYSCALL64_slow_path() It' VM_BUG_ON() due to false-negative in_atomic(). We call page_cache_get_speculative() with disabled local interrupts. It should be atomic enough. So let's check for disabled interrupts in the VM_BUG_ON() condition too, to resolve this. ( This got triggered by the conversion of the x86 GUP code to the generic GUP code. ) Reported-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Cc: Kirill A. Shutemov <kirill@shutemov.name> Cc: LKP <lkp@01.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-mm@kvack.org Link: http://lkml.kernel.org/r/20170324114709.pcytvyb3d6ajux33@black.fi.intel.com Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | llist: clang: introduce member_address_is_nonnull()Alexander Potapenko2018-03-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently llist_for_each_entry() and llist_for_each_entry_safe() iterate until &pos->member != NULL. But when building the kernel with Clang, the compiler assumes &pos->member cannot be NULL if the member's offset is greater than 0 (which would be equivalent to the object being non-contiguous in memory). Therefore the loop condition is always true, and the loops become infinite. To work around this, introduce the member_address_is_nonnull() macro, which casts object pointer to uintptr_t, thus letting the member pointer to be NULL. Signed-off-by: Alexander Potapenko <glider@google.com> Tested-by: Sodagudi Prasad <psodagud@codeaurora.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit beaec533fc2701a28a4d667f67c9f59c6e4e0d13) Reported-by: Jean-Baptiste Théou <jb@essential.com> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I90d5c5cfbbc6f847370f296975416a797dc067ee
* | Merge 4.4.122 into android-4.4Greg Kroah-Hartman2018-03-18
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.122 RDMA/ucma: Limit possible option size RDMA/ucma: Check that user doesn't overflow QP state RDMA/mlx5: Fix integer overflow while resizing CQ scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS workqueue: Allow retrieval of current task's work struct drm: Allow determining if current task is output poll worker drm/nouveau: Fix deadlock on runtime suspend drm/radeon: Fix deadlock on runtime suspend drm/amdgpu: Fix deadlock on runtime suspend drm/amdgpu: Notify sbios device ready before send request drm/radeon: fix KV harvesting drm/amdgpu: fix KV harvesting MIPS: BMIPS: Do not mask IPIs during suspend MIPS: ath25: Check for kzalloc allocation failure MIPS: OCTEON: irq: Check for null return on kzalloc allocation Input: matrix_keypad - fix race when disabling interrupts loop: Fix lost writes caused by missing flag kbuild: Handle builtin dtb file names containing hyphens bcache: don't attach backing with duplicate UUID x86/MCE: Serialize sysfs changes ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520 ALSA: seq: Don't allow resizing pool in use ALSA: seq: More protection for concurrent write and ioctl races ALSA: hda: add dock and led support for HP EliteBook 820 G3 ALSA: hda: add dock and led support for HP ProBook 640 G2 nospec: Include <asm/barrier.h> dependency watchdog: hpwdt: SMBIOS check watchdog: hpwdt: Check source of NMI watchdog: hpwdt: fix unused variable warning netfilter: nfnetlink_queue: fix timestamp attribute ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds Input: tca8418_keypad - remove double read of key event register tc358743: fix register i2c_rd/wr function fix netfilter: add back stackpointer size checks netfilter: x_tables: fix missing timer initialization in xt_LED netfilter: nat: cope with negative port range netfilter: IDLETIMER: be syzkaller friendly netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets netfilter: bridge: ebt_among: add missing match size checks netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt netfilter: use skb_to_full_sk in ip_route_me_harder netfilter: x_tables: pass xt_counters struct instead of packet counter netfilter: x_tables: pass xt_counters struct to counter allocator netfilter: x_tables: pack percpu counter allocations ext4: inplace xattr block update fails to deduplicate blocks ubi: Fix race condition between ubi volume creation and udev scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport NFS: Fix an incorrect type in struct nfs_direct_req Revert "ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux" x86/module: Detect and skip invalid relocations x86: Treat R_X86_64_PLT32 as R_X86_64_PC32 serial: sh-sci: prevent lockup on full TTY buffers tty/serial: atmel: add new version check for usart uas: fix comparison for error code staging: comedi: fix comedi_nsamples_left. staging: android: ashmem: Fix lockdep issue during llseek USB: storage: Add JMicron bridge 152d:2567 to unusual_devs.h usb: quirks: add control message delay for 1b1c:1b20 USB: usbmon: remove assignment from IS_ERR argument usb: usbmon: Read text within supplied buffer size usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb() serial: 8250_pci: Add Brainboxes UC-260 4 port serial device fixup: sctp: verify size of a new chunk in _sctp_make_chunk() Linux 4.4.122 Change-Id: I0946c4a7c59be33f18bed6498c3cdb748e82bbaf Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * usb: quirks: add control message delay for 1b1c:1b20Danilo Krummrich2018-03-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit cb88a0588717ba6c756cb5972d75766b273a6817 upstream. Corsair Strafe RGB keyboard does not respond to usb control messages sometimes and hence generates timeouts. Commit de3af5bf259d ("usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard") tried to fix those timeouts by adding USB_QUIRK_DELAY_INIT. Unfortunately, even with this quirk timeouts of usb_control_msg() can still be seen, but with a lower frequency (approx. 1 out of 15): [ 29.103520] usb 1-8: string descriptor 0 read error: -110 [ 34.363097] usb 1-8: can't set config #1, error -110 Adding further delays to different locations where usb control messages are issued just moves the timeouts to other locations, e.g.: [ 35.400533] usbhid 1-8:1.0: can't add hid device: -110 [ 35.401014] usbhid: probe of 1-8:1.0 failed with error -110 The only way to reliably avoid those issues is having a pause after each usb control message. In approx. 200 boot cycles no more timeouts were seen. Addionaly, keep USB_QUIRK_DELAY_INIT as it turned out to be necessary to have the delay in hub_port_connect() after hub_port_init(). The overall boot time seems not to be influenced by these additional delays, even on fast machines and lightweight distributions. Fixes: de3af5bf259d ("usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard") Cc: stable@vger.kernel.org Signed-off-by: Danilo Krummrich <danilokrummrich@dk-develop.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * netfilter: x_tables: pack percpu counter allocationsFlorian Westphal2018-03-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit ae0ac0ed6fcf5af3be0f63eb935f483f44a402d2 upstream. instead of allocating each xt_counter individually, allocate 4k chunks and then use these for counter allocation requests. This should speed up rule evaluation by increasing data locality, also speeds up ruleset loading because we reduce calls to the percpu allocator. As Eric points out we can't use PAGE_SIZE, page_allocator would fail on arches with 64k page size. Suggested-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * netfilter: x_tables: pass xt_counters struct to counter allocatorFlorian Westphal2018-03-18
| | | | | | | | | | | | | | | | | | | | | | | | commit f28e15bacedd444608e25421c72eb2cf4527c9ca upstream. Keeps some noise away from a followup patch. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * netfilter: x_tables: pass xt_counters struct instead of packet counterFlorian Westphal2018-03-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 4d31eef5176df06f218201bc9c0ce40babb41660 upstream. On SMP we overload the packet counter (unsigned long) to contain percpu offset. Hide this from callers and pass xt_counters address instead. Preparation patch to allocate the percpu counters in page-sized batch chunks. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * nospec: Include <asm/barrier.h> dependencyDan Williams2018-03-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit eb6174f6d1be16b19cfa43dac296bfed003ce1a6 upstream. The nospec.h header expects the per-architecture header file <asm/barrier.h> to optionally define array_index_mask_nospec(). Include that dependency to prevent inadvertent fallback to the default array_index_mask_nospec() implementation. The default implementation may not provide a full mitigation on architectures that perform data value speculation. Reported-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Arjan van de Ven <arjan@linux.intel.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: David Woodhouse <dwmw2@infradead.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Will Deacon <will.deacon@arm.com> Cc: linux-arch@vger.kernel.org Link: http://lkml.kernel.org/r/151881605404.17395.1341935530792574707.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * workqueue: Allow retrieval of current task's work structLukas Wunner2018-03-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 27d4ee03078aba88c5e07dcc4917e8d01d046f38 upstream. Introduce a helper to retrieve the current task's work struct if it is a workqueue worker. This allows us to fix a long-standing deadlock in several DRM drivers wherein the ->runtime_suspend callback waits for a specific worker to finish and that worker in turn calls a function which waits for runtime suspend to finish. That function is invoked from multiple call sites and waiting for runtime suspend to finish is the correct thing to do except if it's executing in the context of the worker. Cc: Lai Jiangshan <jiangshanlai@gmail.com> Cc: Dave Airlie <airlied@redhat.com> Cc: Ben Skeggs <bskeggs@redhat.com> Cc: Alex Deucher <alexander.deucher@amd.com> Acked-by: Tejun Heo <tj@kernel.org> Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Lukas Wunner <lukas@wunner.de> Link: https://patchwork.freedesktop.org/patch/msgid/2d8f603074131eb87e588d2b803a71765bd3a2fd.1518338788.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | FROMLIST: f2fs: don't put dentry page in pagecache into highmemYunlong Song2018-03-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick from origin/upstream-f2fs-stable-linux-4.4.y: 39ed8376d611 ("f2fs: don't put dentry page in pagecache into highmem") Previous dentry page uses highmem, which will cause panic in platforms using highmem (such as arm), since the address space of dentry pages from highmem directly goes into the decryption path via the function fscrypt_fname_disk_to_usr. But sg_init_one assumes the address is not from highmem, and then cause panic since it doesn't call kmap_high but kunmap_high is triggered at the end. To fix this problem in a simple way, this patch avoids to put dentry page in pagecache into highmem. Change-Id: I0c87dafb92fce72bf70403a15d28c73992c03203 Signed-off-by: Yunlong Song <yunlong.song@huawei.com> Reviewed-by: Chao Yu <yuchao0@huawei.com> [Jaegeuk Kim: fix coding style] Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* | Merge 4.4.121 into android-4.4Greg Kroah-Hartman2018-03-11
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.121 tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus ALSA: usb-audio: Add a quirck for B&W PX headphones ALSA: hda: Add a power_save blacklist cpufreq: s3c24xx: Fix broken s3c_cpufreq_init() media: m88ds3103: don't call a non-initalized function nospec: Allow index argument to have const-qualified type ARM: mvebu: Fix broken PL310_ERRATA_753970 selects KVM: mmu: Fix overlap between public and private memslots x86/syscall: Sanitize syscall table de-references under speculation fix btrfs: Don't clear SGID when inheriting ACLs ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux x86/apic/vector: Handle legacy irq data correctly leds: do not overflow sysfs buffer in led_trigger_show x86/spectre: Fix an error message Revert "led: core: Fix brightness setting when setting delay_off=0" bridge: check brport attr show in brport_show fib_semantics: Don't match route with mismatching tclassid hdlc_ppp: carrier detect ok, don't turn off negotiation ipv6 sit: work around bogus gcc-8 -Wrestrict warning net: fix race on decreasing number of TX queues net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68 netlink: ensure to loop over all netns in genlmsg_multicast_allns() ppp: prevent unregistered channels from connecting to PPP units udplite: fix partial checksum initialization sctp: fix dst refcnt leak in sctp_v4_get_dst sctp: fix dst refcnt leak in sctp_v6_get_dst() s390/qeth: fix SETIP command handling s390/qeth: fix IPA command submission race sctp: verify size of a new chunk in _sctp_make_chunk() net: mpls: Pull common label check into helper mpls, nospec: Sanitize array index in mpls_label_ok() dm io: fix duplicate bio completion due to missing ref count bpf, x64: implement retpoline for tail call btrfs: preserve i_mode if __btrfs_set_acl() fails Linux 4.4.121 Change-Id: Ifc1f73c407f35cc1815e6f69bbed838c8ca60bc2 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * nospec: Allow index argument to have const-qualified typeRasmus Villemoes2018-03-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit b98c6a160a057d5686a8c54c79cc6c8c94a7d0c8 upstream. The last expression in a statement expression need not be a bare variable, quoting gcc docs The last thing in the compound statement should be an expression followed by a semicolon; the value of this subexpression serves as the value of the entire construct. and we already use that in e.g. the min/max macros which end with a ternary expression. This way, we can allow index to have const-qualified type, which will in some cases avoid the need for introducing a local copy of index of non-const qualified type. That, in turn, can prevent readers not familiar with the internals of array_index_nospec from wondering about the seemingly redundant extra variable, and I think that's worthwhile considering how confusing the whole _nospec business is. The expression _i&_mask has type unsigned long (since that is the type of _mask, and the BUILD_BUG_ONs guarantee that _i will get promoted to that), so in order not to change the type of the whole expression, add a cast back to typeof(_i). Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Andy Lutomirski <luto@kernel.org> Cc: Arjan van de Ven <arjan@linux.intel.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: David Woodhouse <dwmw2@infradead.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Will Deacon <will.deacon@arm.com> Cc: linux-arch@vger.kernel.org Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/151881604837.17395.10812767547837568328.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | ANDROID: cpufreq: times: Add missing includesConnor O'Brien2018-03-07
| | | | | | | | | | | | | | | | Without these, the goldfish x86 and x86_64 builds fail. Test: build kernel for goldfish x86 and x86_64 Change-Id: I1cbdbaaa03404975ee51c7420927d605074c93e4 Signed-off-by: Connor O'Brien <connoro@google.com>
* | ANDROID: cpufreq: Add time_in_state to /proc/uid directoriesConnor O'Brien2018-03-06
| | | | | | | | | | | | | | | | | | | | Add per-uid files that report the data in binary format rather than text, to allow faster reading & parsing by userspace. Signed-off-by: Connor O'Brien <connoro@google.com> Bug: 72339335 Test: compare values to those reported in /proc/uid_time_in_state Change-Id: I463039ea7f17b842be4c70024fe772539fe2ce02
* | ANDROID: proc: Add /proc/uid directoryConnor O'Brien2018-03-06
| | | | | | | | | | | | | | | | | | | | | | | | | | Add support for reporting per-uid information through procfs, roughly following the approach used for per-tid and per-tgid directories in fs/proc/base.c. This also entails some new tracking of which uids have been used, to avoid losing information when the last task with a given uid exits. Signed-off-by: Connor O'Brien <connoro@google.com> Bug: 72339335 Test: ls /proc/uid/; compare with UIDs in /proc/uid_time_in_state Change-Id: I0908f0c04438b11ceb673d860e58441bf503d478
* | ANDROID: cpufreq: times: track per-uid time in stateConnor O'Brien2018-03-06
| | | | | | | | | | | | | | | | | | | | Add /proc/uid_time_in_state showing per uid/frequency/cluster times. Allow uid removal through /proc/uid_cputime/remove_uid_range. Signed-off-by: Connor O'Brien <connoro@google.com> Bug: 72339335 Test: Read /proc/uid_time_in_state Change-Id: I20ba3546a27c25b7e7991e2a86986e158aafa58c
* | ANDROID: cpufreq: track per-task time in stateConnor O'Brien2018-03-06
| | | | | | | | | | | | | | | | | | | | | | | | Add time in state data to task structs, and create /proc/<pid>/time_in_state files to show how long each individual task has run at each frequency. Create a CONFIG_CPU_FREQ_TIMES option to enable/disable this tracking. Signed-off-by: Connor O'Brien <connoro@google.com> Bug: 72339335 Test: Read /proc/<pid>/time_in_state Change-Id: Ia6456754f4cb1e83b2bc35efa8fbe9f8696febc8
* | Merge 4.4.118 into android-4.4Greg Kroah-Hartman2018-02-26
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.118 net: add dst_cache support net: replace dst_cache ip6_tunnel implementation with the generic one cfg80211: check dev_set_name() return value mm,vmscan: Make unregister_shrinker() no-op if register_shrinker() failed. xfrm: Fix stack-out-of-bounds read on socket policy lookup. xfrm: check id proto in validate_tmpl() blktrace: fix unlocked registration of tracepoints drm: Require __GFP_NOFAIL for the legacy drm_modeset_lock_all Provide a function to create a NUL-terminated string from unterminated data selinux: ensure the context is NUL terminated in security_context_to_sid_core() selinux: skip bounded transition processing if the policy isn't loaded crypto: x86/twofish-3way - Fix %rbp usage KVM: x86: fix escape of guest dr6 to the host netfilter: x_tables: fix int overflow in xt_alloc_table_info() netfilter: x_tables: avoid out-of-bounds reads in xt_request_find_{match|target} netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in clusterip_tg_check() netfilter: on sockopt() acquire sock lock only in the required scope netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert net: avoid skb_warn_bad_offload on IS_ERR ASoC: ux500: add MODULE_LICENSE tag video: fbdev/mmp: add MODULE_LICENSE arm64: dts: add #cooling-cells to CPU nodes Make DST_CACHE a silent config option dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock staging: android: ashmem: Fix a race condition in pin ioctls binder: check for binder_thread allocation failure in binder_poll() staging: iio: adc: ad7192: fix external frequency setting usbip: keep usbip_device sockfd state in sync with tcp_socket usb: build drivers/usb/common/ when USB_SUPPORT is set ARM: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context ARM: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function ARM: dts: Fix omap4 hang with GPS connected to USB by using wakeupgen ARM: dts: am4372: Correct the interrupts_properties of McASP perf top: Fix window dimensions change handling perf bench numa: Fixup discontiguous/sparse numa nodes media: s5k6aa: describe some function parameters pinctrl: sunxi: Fix A80 interrupt pin bank RDMA/cma: Make sure that PSN is not over max allowed scripts/kernel-doc: Don't fail with status != 0 if error encountered with -none ipvlan: Add the skb->mark as flow4's member to lookup route powerpc/perf: Fix oops when grouping different pmu events s390/dasd: prevent prefix I/O error gianfar: fix a flooded alignment reports because of padding issue. net_sched: red: Avoid devision by zero net_sched: red: Avoid illegal values btrfs: Fix possible off-by-one in btrfs_search_path_in_tree 509: fix printing uninitialized stack memory when OID is empty dmaengine: ioat: Fix error handling path dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved clk: fix a panic error caused by accessing NULL pointer ASoC: rockchip: disable clock on error spi: sun4i: disable clocks in the remove function xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies. drm/armada: fix leak of crtc structure dmaengine: jz4740: disable/unprepare clk if probe fails mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep x86/mm/kmmio: Fix mmiotrace for page unaligned addresses xen: XEN_ACPI_PROCESSOR is Dom0-only hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close virtio_balloon: prevent uninitialized variable use isdn: icn: remove a #warning vmxnet3: prevent building with 64K pages gpio: intel-mid: Fix build warning when !CONFIG_PM platform/x86: intel_mid_thermal: Fix suspend handlers unused warning video: fbdev: via: remove possibly unused variables scsi: advansys: fix build warning for PCI=n x86/ras/inject: Make it depend on X86_LOCAL_APIC=y arm64: define BUG() instruction without CONFIG_BUG x86/fpu/math-emu: Fix possible uninitialized variable use tools build: Add tools tree support for 'make -s' x86/build: Silence the build with "make -s" thermal: fix INTEL_SOC_DTS_IOSF_CORE dependencies x86: add MULTIUSER dependency for KVM x86/platform: Add PCI dependency for PUNIT_ATOM_DEBUG scsi: advansys: fix uninitialized data access arm64: Kconfig: select COMPAT_BINFMT_ELF only when BINFMT_ELF is set ALSA: hda/ca0132 - fix possible NULL pointer use reiserfs: avoid a -Wmaybe-uninitialized warning ssb: mark ssb_bus_register as __maybe_unused thermal: spear: use __maybe_unused for PM functions x86/boot: Avoid warning for zero-filling .bss scsi: sim710: fix build warning drivers/net: fix eisa_driver probe section mismatch dpt_i2o: fix build warning profile: hide unused functions when !CONFIG_PROC_FS md: avoid warning for 32-bit sector_t mtd: ichxrom: maybe-uninitialized with gcc-4.9 mtd: maps: add __init attribute mptfusion: hide unused seq_mpt_print_ioc_summary function scsi: fdomain: drop fdomain_pci_tbl when built-in video: fbdev: sis: remove unused variable staging: ste_rmi4: avoid unused function warnings fbdev: sis: enforce selection of at least one backend video: Use bool instead int pointer for get_opt_bool() argument scsi: mvumi: use __maybe_unused to hide pm functions SCSI: initio: remove duplicate module device table pwc: hide unused label usb: musb/ux500: remove duplicate check for dma_is_compatible tty: hvc_xen: hide xen_console_remove when unused target/user: Fix cast from pointer to phys_addr_t driver-core: use 'dev' argument in dev_dbg_ratelimited stub fbdev: auo_k190x: avoid unused function warnings amd-xgbe: Fix unused suspend handlers build warning mtd: sh_flctl: pass FIFO as physical address mtd: cfi: enforce valid geometry configuration fbdev: s6e8ax0: avoid unused function warnings modsign: hide openssl output in silent builds Drivers: hv: vmbus: fix build warning fbdev: sm712fb: avoid unused function warnings hwrng: exynos - use __maybe_unused to hide pm functions USB: cdc_subset: only build when one driver is enabled rtlwifi: fix gcc-6 indentation warning staging: wilc1000: fix kbuild test robot error x86/platform/olpc: Fix resume handler build warning netfilter: ipvs: avoid unused variable warnings ipv4: ipconfig: avoid unused ic_proto_used symbol tc1100-wmi: fix build warning when CONFIG_PM not enabled tlan: avoid unused label with PCI=n drm/vmwgfx: use *_32_bits() macros tty: cyclades: cyz_interrupt is only used for PCI genirq/msi: Add stubs for get_cached_msi_msg/pci_write_msi_msg ASoC: mediatek: add i2c dependency iio: adc: axp288: remove redundant duplicate const on axp288_adc_channels infiniband: cxgb4: use %pR format string for printing resources b2c2: flexcop: avoid unused function warnings i2c: remove __init from i2c_register_board_info() staging: unisys: visorinput depends on INPUT tc358743: fix register i2c_rd/wr functions drm/nouveau: hide gcc-4.9 -Wmaybe-uninitialized Input: tca8418_keypad - hide gcc-4.9 -Wmaybe-uninitialized warning KVM: add X86_LOCAL_APIC dependency go7007: add MEDIA_CAMERA_SUPPORT dependency em28xx: only use mt9v011 if camera support is enabled ISDN: eicon: reduce stack size of sig_ind function ASoC: rockchip: use __maybe_unused to hide st_irq_syscfg_resume serial: 8250_mid: fix broken DMA dependency drm/gma500: Sanity-check pipe index hdpvr: hide unused variable v4l: remove MEDIA_TUNER dependency for VIDEO_TUNER cw1200: fix bogus maybe-uninitialized warning wireless: cw1200: use __maybe_unused to hide pm functions_ perf/x86: Shut up false-positive -Wmaybe-uninitialized warning dmaengine: zx: fix build warning net: hp100: remove unnecessary #ifdefs gpio: xgene: mark PM functions as __maybe_unused ncpfs: fix unused variable warning Revert "power: bq27xxx_battery: Remove unneeded dependency in Kconfig" power: bq27xxx_battery: mark some symbols __maybe_unused isdn: sc: work around type mismatch warning binfmt_elf: compat: avoid unused function warning idle: i7300: add PCI dependency usb: phy: msm add regulator dependency ncr5380: shut up gcc indentation warning ARM: tegra: select USB_ULPI from EHCI rather than platform ASoC: Intel: Kconfig: fix build when ACPI is not enabled netlink: fix nla_put_{u8,u16,u32} for KASAN dell-wmi, dell-laptop: depends DMI genksyms: Fix segfault with invalid declarations x86/microcode/AMD: Change load_microcode_amd()'s param to bool to fix preemptibility bug drm/gma500: remove helper function kasan: rework Kconfig settings KVM: async_pf: Fix #DF due to inject "Page not Present" and "Page Ready" exceptions simultaneously x86/retpoline: Remove the esp/rsp thunk KVM: x86: Make indirect calls in emulator speculation safe KVM: VMX: Make indirect call speculation safe module/retpoline: Warn about missing retpoline in module x86/nospec: Fix header guards names x86/bugs: Drop one "mitigation" from dmesg x86/cpu/bugs: Make retpoline module warning conditional x86/spectre: Check CONFIG_RETPOLINE in command line parser Documentation: Document array_index_nospec array_index_nospec: Sanitize speculative array de-references x86: Implement array_index_mask_nospec x86: Introduce barrier_nospec x86/get_user: Use pointer masking to limit speculation x86/syscall: Sanitize syscall table de-references under speculation vfs, fdtable: Prevent bounds-check bypass via speculative execution nl80211: Sanitize array index in parse_txq_params x86/spectre: Report get_user mitigation for spectre_v1 x86/spectre: Fix spelling mistake: "vunerable"-> "vulnerable" x86/paravirt: Remove 'noreplace-paravirt' cmdline option x86/kvm: Update spectre-v1 mitigation x86/retpoline: Avoid retpolines for built-in __init functions x86/spectre: Simplify spectre_v2 command line parsing x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL KVM: nVMX: kmap() can't fail KVM: nVMX: vmx_complete_nested_posted_interrupt() can't fail kvm: nVMX: Fix kernel panics induced by illegal INVEPT/INVVPID types KVM: VMX: clean up declaration of VPID/EPT invalidation types KVM: nVMX: invvpid handling improvements crypto: s5p-sss - Fix kernel Oops in AES-ECB mode net: dst_cache_per_cpu_dst_set() can be static Linux 4.4.118 Change-Id: I01c76e1c15a611e13a1e98092bc5c01cdb5b6adb Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * x86/retpoline: Avoid retpolines for built-in __init functionsDavid Woodhouse2018-02-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (cherry picked from commit 66f793099a636862a71c59d4a6ba91387b155e0c) There's no point in building init code with retpolines, since it runs before any potentially hostile userspace does. And before the retpoline is actually ALTERNATIVEd into place, for much of it. Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: karahmed@amazon.de Cc: peterz@infradead.org Cc: bp@alien8.de Link: https://lkml.kernel.org/r/1517484441-1420-2-git-send-email-dwmw@amazon.co.uk Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> [jwang: port to 4.4] Signed-off-by: Jack Wang <jinpu.wang@profitbricks.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * vfs, fdtable: Prevent bounds-check bypass via speculative executionDan Williams2018-02-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (cherry picked from commit 56c30ba7b348b90484969054d561f711ba196507) 'fd' is a user controlled value that is used as a data dependency to read from the 'fdt->fd' array. In order to avoid potential leaks of kernel memory values, block speculative execution of the instruction stream that could issue reads based on an invalid 'file *' returned from __fcheck_files. Co-developed-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: linux-arch@vger.kernel.org Cc: kernel-hardening@lists.openwall.com Cc: gregkh@linuxfoundation.org Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: torvalds@linux-foundation.org Cc: alan@linux.intel.com Link: https://lkml.kernel.org/r/151727418500.33451.17392199002892248656.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> [jwang: cherry pick to 4.4] Signed-off-by: Jack Wang <jinpu.wang@profitbricks.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * array_index_nospec: Sanitize speculative array de-referencesDan Williams2018-02-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (cherry picked from commit f3804203306e098dae9ca51540fcd5eb700d7f40) array_index_nospec() is proposed as a generic mechanism to mitigate against Spectre-variant-1 attacks, i.e. an attack that bypasses boundary checks via speculative execution. The array_index_nospec() implementation is expected to be safe for current generation CPUs across multiple architectures (ARM, x86). Based on an original implementation by Linus Torvalds, tweaked to remove speculative flows by Alexei Starovoitov, and tweaked again by Linus to introduce an x86 assembly implementation for the mask generation. Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org> Co-developed-by: Alexei Starovoitov <ast@kernel.org> Suggested-by: Cyril Novikov <cnovikov@lynx.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: linux-arch@vger.kernel.org Cc: kernel-hardening@lists.openwall.com Cc: Peter Zijlstra <peterz@infradead.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Russell King <linux@armlinux.org.uk> Cc: gregkh@linuxfoundation.org Cc: torvalds@linux-foundation.org Cc: alan@linux.intel.com Link: https://lkml.kernel.org/r/151727414229.33451.18411580953862676575.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> [jwang: cherry pick to 4.4] Signed-off-by: Jack Wang <jinpu.wang@profitbricks.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * module/retpoline: Warn about missing retpoline in moduleAndi Kleen2018-02-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (cherry picked from commit caf7501a1b4ec964190f31f9c3f163de252273b8) There's a risk that a kernel which has full retpoline mitigations becomes vulnerable when a module gets loaded that hasn't been compiled with the right compiler or the right option. To enable detection of that mismatch at module load time, add a module info string "retpoline" at build time when the module was compiled with retpoline support. This only covers compiled C source, but assembler source or prebuilt object files are not checked. If a retpoline enabled kernel detects a non retpoline protected module at load time, print a warning and report it in the sysfs vulnerability file. [ tglx: Massaged changelog ] Signed-off-by: Andi Kleen <ak@linux.intel.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: David Woodhouse <dwmw2@infradead.org> Cc: gregkh@linuxfoundation.org Cc: torvalds@linux-foundation.org Cc: jeyu@kernel.org Cc: arjan@linux.intel.com Link: https://lkml.kernel.org/r/20180125235028.31211-1-andi@firstfloor.org Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> [jwang: port to 4.4] Signed-off-by: Jack Wang <jinpu.wang@profitbricks.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * genirq/msi: Add stubs for get_cached_msi_msg/pci_write_msi_msgArnd Bergmann2018-02-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 2f44e29cef006a4b0a4ecf7d4c5aac7d0fbb505c upstream. A bug fix to the MSIx handling in vfio added references to functions that may not be defined if MSI is disabled in the kernel, resulting in this link error: drivers/built-in.o: In function `vfio_msi_set_vector_signal': :(.text+0x450808): undefined reference to `get_cached_msi_msg' :(.text+0x45080c): undefined reference to `write_msi_msg' As suggested by Alex Williamson, add stub implementations for get_cached_msi_msg() and pci_write_msi_msg(). In case this bugfix gets backported, please note that the #ifdef has changed over time, originally both functions were implemented in drivers/pci/msi.c and controlled by CONFIG_PCI_MSI, while nowadays get_cached_msi_msg() is part of the generic MSI support and can be used without PCI. Fixes: b8f02af096b1 ("vfio/pci: Restore MSIx message prior to enabling") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Cc: Marc Zyngier <marc.zyngier@arm.com> Cc: Alex Williamson <alex.williamson@redhat.com> Cc: Bjorn Helgaas <bhelgaas@google.com> Cc: Bart Van Assche <bart.vanassche@sandisk.com> Link: http://lkml.kernel.org/r/1413190208.4202.34.camel@ul30vt.home Link: http://lkml.kernel.org/r/20170214215343.3307861-1-arnd@arndb.de Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * mtd: sh_flctl: pass FIFO as physical addressArnd Bergmann2018-02-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 1873315fb156cbc8e46f28e8b128f17ff6c31728 upstream. By convention, the FIFO address we pass using dmaengine_slave_config is a physical address in the form that is understood by the DMA engine, as a dma_addr_t, phys_addr_t or resource_size_t. The sh_flctl driver however passes a virtual __iomem address that gets cast to dma_addr_t in the slave driver. This happens to work on shmobile because that platform sets up an identity mapping for its MMIO regions, but such code is not portable to other platforms, and prevents us from ever changing the platform mapping or reusing the driver on other architectures like ARM64 that might not have the mapping. We also get a warning about a type mismatch for the case that dma_addr_t is wider than a pointer, i.e. when CONFIG_LPAE is set: drivers/mtd/nand/sh_flctl.c: In function 'flctl_setup_dma': drivers/mtd/nand/sh_flctl.c:163:17: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast] cfg.dst_addr = (dma_addr_t)FLDTFIFO(flctl); This changes the driver to instead pass the physical address of the FIFO that is extracted from the MMIO resource, making the code more portable and avoiding the warning. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Brian Norris <computersforpeace@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * driver-core: use 'dev' argument in dev_dbg_ratelimited stubArnd Bergmann2018-02-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 1f62ff34a90471d1b735bac2c79e894afc7c59bc upstream. dev_dbg_ratelimited() is a macro that ignores its first argument when DEBUG is not set, which can lead to unused variable warnings: ethernet/mellanox/mlxsw/pci.c: In function 'mlxsw_pci_cqe_sdq_handle': ethernet/mellanox/mlxsw/pci.c:646:18: warning: unused variable 'pdev' [-Wunused-variable] ethernet/mellanox/mlxsw/pci.c: In function 'mlxsw_pci_cqe_rdq_handle': ethernet/mellanox/mlxsw/pci.c:671:18: warning: unused variable 'pdev' [-Wunused-variable] The macro already ensures that all its other arguments are silently ignored by the compiler without triggering a warning, through the use of the no_printk() macro, but the dev argument is not passed into that. This changes the definition to use the same trick as no_printk() with an if(0) that leads the compiler to not evaluate the side-effects but still see that 'dev' might not be unused. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Suggested-by: Andrew Lunn <andrew@lunn.ch> Fixes: 6f586e663e3b ("driver-core: Shut up dev_dbg_reatelimited() without DEBUG") Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * Provide a function to create a NUL-terminated string from unterminated dataDavid Howells2018-02-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit f35157417215ec138c920320c746fdb3e04ef1d5 upstream. Provide a function, kmemdup_nul(), that will create a NUL-terminated string from an unterminated character array where the length is known in advance. This is better than kstrndup() in situations where we already know the string length as the strnlen() in kstrndup() is superfluous. Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | f2fs: updates on v4.16-rc1Jaegeuk Kim2018-02-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull f2fs updates from Jaegeuk Kim: "In this round, we've followed up to support some generic features such as cgroup, block reservation, linking fscrypt_ops, delivering write_hints, and some ioctls. And, we could fix some corner cases in terms of power-cut recovery and subtle deadlocks. Enhancements: - bitmap operations to handle NAT blocks - readahead to improve readdir speed - switch to use fscrypt_* - apply write hints for direct IO - add reserve_root=%u,resuid=%u,resgid=%u to reserve blocks for root/uid/gid - modify b_avail and b_free to consider root reserved blocks - support cgroup writeback - support FIEMAP_FLAG_XATTR for fibmap - add F2FS_IOC_PRECACHE_EXTENTS to pre-cache extents - add F2FS_IOC_{GET/SET}_PIN_FILE to pin LBAs for data blocks - support inode creation time Bug fixs: - sysfile-based quota operations - memory footprint accounting - allow to write data on partial preallocation case - fix deadlock case on fallocate - fix to handle fill_super errors - fix missing inode updates of fsync'ed file - recover renamed file which was fsycn'ed before - drop inmemory pages in corner error case - keep last_disk_size correctly - recover missing i_inline flags during roll-forward Various clean-up patches were added as well" Cherry-pick from origin/upstream-f2fs-stable-linux-4.4.y: 5f9b3abb911f f2fs: support inode creation time 9fb0de175172 f2fs: rebuild sit page from sit info in mem 1062a0c01829 f2fs: stop issuing discard if fs is readonly fa043fae9030 f2fs: clean up duplicated assignment in init_discard_policy b007190234d6 f2fs: use GFP_F2FS_ZERO for cleanup 35b11839a1ae f2fs: allow to recover node blocks given updated checkpoint e56500860be0 f2fs: recover some i_inline flags 64aa9569a1bf f2fs: correct removexattr behavior for null valued extended attribute 70b3a923daff f2fs: drop page cache after fs shutdown 8069a0e983d9 f2fs: stop gc/discard thread after fs shutdown bb924f777717 f2fs: hanlde error case in f2fs_ioc_shutdown 700b53f21ee8 f2fs: split need_inplace_update f31d52811c1f f2fs: fix to update last_disk_size correctly eeb0118b8340 f2fs: kill F2FS_INLINE_XATTR_ADDRS for cleanup c1b74c967092 f2fs: clean up error path of fill_super d5efd57e013b f2fs: avoid hungtask when GC encrypted block if io_bits is set c4027d08430b f2fs: allow quota to use reserved blocks 18d267c273a9 f2fs: fix to drop all inmem pages correctly 4dca47531eb0 f2fs: speed up defragment on sparse file 999f806a7c9e f2fs: support F2FS_IOC_PRECACHE_EXTENTS 84960fca96c4 f2fs: add an ioctl to disable GC for specific file 292c8e1cfd4d f2fs: prevent newly created inode from being dirtied incorrectly 58b1f5b0fcf1 f2fs: support FIEMAP_FLAG_XATTR 6afa9a94d09b f2fs: fix to cover f2fs_inline_data_fiemap with inode_lock 10f4a4140b61 f2fs: check node page again in write end io b203c58dfd55 f2fs: fix to caclulate required free section correctly d49132d45cb0 f2fs: handle newly created page when revoking inmem pages 2ce6b9d8167e f2fs: add resgid and resuid to reserve root blocks f53dcf6799ab f2fs: implement cgroup writeback support 1338f376d5a3 f2fs: remove unused pend_list_tag d4f19f6266ab f2fs: avoid high cpu usage in discard thread b78e9302e2e3 f2fs: make local functions static 62438ba87b79 f2fs: add reserved blocks for root user 06a366757ff7 f2fs: check segment type in __f2fs_replace_block 4c6bc4be375a f2fs: update inode info to inode page for new file 591b33638733 f2fs: show precise # of blocks that user/root can use b242d7edc537 f2fs: clean up unneeded declaration 87b8168e9ef0 f2fs: continue to do direct IO if we only preallocate partial blocks 2b4d859bd9d8 f2fs: enable quota at remount from r to w 54bf13a0adcd f2fs: skip stop_checkpoint for user data writes 25ef3006ba23 f2fs: fix missing error number for xattr operation cff2c7fe417b f2fs: recover directory operations by fsync e2bb618a0a6b f2fs: return error during fill_super 8a2c11d8658d f2fs: fix an error case of missing update inode page cd38d5ada5a4 f2fs: fix potential hangtask in f2fs_trace_pid e81cafbeba4b f2fs: no need return value in restore summary process 04d44000d633 f2fs: use unlikely for release case 925d0933d8f0 f2fs: don't return value in truncate_data_blocks_range f7986c416d1b f2fs: clean up f2fs_map_blocks e4f5e26cdadf f2fs: clean up hash codes 1f994d47080c f2fs: fix error handling in fill_super e7db649b5fb1 f2fs: spread f2fs_k{m,z}alloc 5d4e487b9929 f2fs: inject fault to kvmalloc 8b33886c37cd f2fs: inject fault to kzalloc d94680798786 f2fs: remove a redundant conditional expression 3bc01114a338 f2fs: apply write hints to select the type of segment for direct write c80f01959114 f2fs: switch to fscrypt_prepare_setattr() bb8b850365ff f2fs: switch to fscrypt_prepare_lookup() 9ab470eaf8a8 f2fs: switch to fscrypt_prepare_rename() aeaac517a12d f2fs: switch to fscrypt_prepare_link() 101c6a96ad1c f2fs: switch to fscrypt_file_open() 6d025237a1f8 f2fs: remove repeated f2fs_bug_on b01e03d724de f2fs: remove an excess variable e1f9be2f7c82 f2fs: fix lock dependency in between dio_rwsem & i_mmap_sem e5c7c8601030 f2fs: remove unused parameter f130dbb98a68 f2fs: still write data if preallocate only partial blocks 47ee9b259811 f2fs: introduce sysfs readdir_ra to readahead inode block in readdir 55e2f89181ce f2fs: fix concurrent problem for updating free bitmap e1398f6554b4 f2fs: remove unneeded memory footprint accounting 2d69561135f2 f2fs: no need to read nat block if nat_block_bitmap is set 4dd2d0733809 f2fs: reserve nid resource for quota sysfile Signed-off-by: Jaegeuk Kim <jaegeuk@google.com>
* | Merge 4.4.117 into android-4.4Greg Kroah-Hartman2018-02-22
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.117 IB/mlx4: Fix incorrectly releasing steerable UD QPs when have only ETH ports PM / devfreq: Propagate error from devfreq_add_device() s390: fix handling of -1 in set{,fs}[gu]id16 syscalls ARM: dts: STi: Add gpio polarity for "hdmi,hpd-gpio" property arm: spear600: Add missing interrupt-parent of rtc arm: spear13xx: Fix dmas cells arm: spear13xx: Fix spics gpio controller's warning ALSA: seq: Fix regression by incorrect ioctl_mutex usages KVM/x86: Reduce retpoline performance impact in slot_handle_level_range(), by always inlining iterator helper methods x86/cpu: Change type of x86_cache_size variable to unsigned int drm/radeon: adjust tested variable rtc-opal: Fix handling of firmware error codes, prevent busy loops ext4: save error to disk in __ext4_grp_locked_error() ext4: correct documentation for grpid mount option mm: hide a #warning for COMPILE_TEST video: fbdev: atmel_lcdfb: fix display-timings lookup console/dummy: leave .con_font_get set to NULL rtlwifi: rtl8821ae: Fix connection lost problem correctly Btrfs: fix deadlock in run_delalloc_nocow Btrfs: fix crash due to not cleaning up tree log block's dirty bits Btrfs: fix unexpected -EEXIST when creating new inode ALSA: hda - Fix headset mic detection problem for two Dell machines ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute ALSA: hda/realtek: PCI quirk for Fujitsu U7x7 ALSA: usb-audio: add implicit fb quirk for Behringer UFX1204 ALSA: seq: Fix racy pool initializations mvpp2: fix multicast address filter dm: correctly handle chained bios in dec_pending() x86: fix build warnign with 32-bit PAE vfs: don't do RCU lookup of empty pathnames ARM: pxa/tosa-bt: add MODULE_LICENSE tag ARM: dts: s5pv210: add interrupt-parent for ohci media: r820t: fix r820t_write_reg for KASAN Linux 4.4.117 Change-Id: Id192d691d19a99889dc5d36711f18576f48f2981 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * x86: fix build warnign with 32-bit PAEArnd Bergmann2018-02-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I ran into a 4.9 build warning in randconfig testing, starting with the KAISER patches: arch/x86/kernel/ldt.c: In function 'alloc_ldt_struct': arch/x86/include/asm/pgtable_types.h:208:24: error: large integer implicitly truncated to unsigned type [-Werror=overflow] #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX) ^ arch/x86/kernel/ldt.c:81:6: note: in expansion of macro '__PAGE_KERNEL' __PAGE_KERNEL); ^~~~~~~~~~~~~ I originally ran into this last year when the patches were part of linux-next, and tried to work around it by using the proper 'pteval_t' types consistently, but that caused additional problems. This takes a much simpler approach, and makes the argument type of the dummy helper always 64-bit, which is wide enough for any page table layout and won't hurt since this call is just an empty stub anyway. Fixes: 8f0baadf2bea ("kaiser: merged update") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Kees Cook <keescook@chromium.org> Acked-by: Hugh Dickins <hughd@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | BACKPORT: tee: add start argument to shm_register callbackJens Wiklander2018-02-21
| | | | | | | | | | | | | | | | | | | | Adds a start argument to the shm_register callback to allow the callback to check memory type of the passed pages. Change-Id: I61457d60ca192637f8d986e2d6f8aeb153d2c484 Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> (cherry picked from commit 95ffe4ca43877eea176d7e95aa0d38bbdc3d2903) Signed-off-by: Victor Chong <victor.chong@linaro.org>
* | BACKPORT: tee: shm: inline tee_shm_get_id()Volodymyr Babchuk2018-02-21
| | | | | | | | | | | | | | | | | | | | | | Now, when struct tee_shm is defined in public header, we can inline small getter functions like this one. Change-Id: I9aba40c18ec448c043ab0b31849e4d6429908371 Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> (cherry picked from commit ef8e08d24ca84846ce639b835ebd2f15a943f42b) Signed-off-by: Victor Chong <victor.chong@linaro.org>
* | BACKPORT: tee: use reference counting for tee_contextVolodymyr Babchuk2018-02-21
| | | | | | | | | | | | | | | | | | | | | | We need to ensure that tee_context is present until last shared buffer will be freed. Change-Id: I0346e266f17b06af82144290d230029d0193a3d8 Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> (cherry picked from commit 217e0250cccb9e54d457991446cd3fab413085e1) Signed-off-by: Victor Chong <victor.chong@linaro.org>
* | BACKPORT: tee: shm: add page accessor functionsVolodymyr Babchuk2018-02-21
| | | | | | | | | | | | | | | | | | | | | | In order to register a shared buffer in TEE, we need accessor function that return list of pages for that buffer. Change-Id: I4078da3e7fff7e44bb6478e297250458d66dd89d Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> (cherry picked from commit e0c69ae8bfb500facebe1fa331f9400c216eaab0) Signed-off-by: Victor Chong <victor.chong@linaro.org>
* | BACKPORT: tee: shm: add accessors for buffer size and page offsetVolodymyr Babchuk2018-02-21
| | | | | | | | | | | | | | | | | | | | These two function will be needed for shared memory registration in OP-TEE Change-Id: Iccfbc063f90edd2f8a283bc0424d95e1f0874c8a Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> (cherry picked from commit b25946ad951c013c31d0a0e82d2017004bdc8fed) Signed-off-by: Victor Chong <victor.chong@linaro.org>
* | BACKPORT: tee: add register user memoryJens Wiklander2018-02-21
| | | | | | | | | | | | | | | | | | | | | | | | Added new ioctl to allow users register own buffers as a shared memory. Change-Id: If7f52f1d7c733d1d31de791523a07748e77fa202 Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com> [jw: moved tee_shm_is_registered() declaration] [jw: added space after __tee_shm_alloc() implementation] Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> (cherry picked from commit 033ddf12bcf5326b93bd604f50a7474a434a35f9) Signed-off-by: Victor Chong <victor.chong@linaro.org>
* | BACKPORT: tee: flexible shared memory pool creationJens Wiklander2018-02-21
| | | | | | | | | | | | | | | | | | | | | | | | Makes creation of shm pools more flexible by adding new more primitive functions to allocate a shm pool. This makes it easier to add driver specific shm pool management. Change-Id: Ief7841b612e1f2ad67222f058bb6627ac9dcd41d Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com> (cherry picked from commit e2aca5d8928acb9cc9a87802b02102d4f9b9b596) Signed-off-by: Victor Chong <victor.chong@linaro.org>
* | BACKPORT: tee: add tee_param_is_memref() for driver useJens Wiklander2018-02-21
| | | | | | | | | | | | | | | | Change-Id: I105eb7c113b68695c28123f520d8d9b07a1fcda4 Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> (cherry picked from commit 84debcc53533f162bf11f24e6a503d227c175cbe) Signed-off-by: Victor Chong <victor.chong@linaro.org>
* | Merge 4.4.116 into android-4.4Greg Kroah-Hartman2018-02-20
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.116 powerpc/bpf/jit: Disable classic BPF JIT on ppc64le powerpc/64: Fix flush_(d|i)cache_range() called from modules powerpc: Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC powerpc: Simplify module TOC handling powerpc/pseries: Add H_GET_CPU_CHARACTERISTICS flags & wrapper powerpc/64: Add macros for annotating the destination of rfid/hrfid powerpc/64s: Simple RFI macro conversions powerpc/64: Convert fast_exception_return to use RFI_TO_USER/KERNEL powerpc/64: Convert the syscall exit path to use RFI_TO_USER/KERNEL powerpc/64s: Convert slb_miss_common to use RFI_TO_USER/KERNEL powerpc/64s: Add support for RFI flush of L1-D cache powerpc/64s: Support disabling RFI flush with no_rfi_flush and nopti powerpc/pseries: Query hypervisor for RFI flush settings powerpc/powernv: Check device-tree for RFI flush settings powerpc/64s: Wire up cpu_show_meltdown() powerpc/64s: Allow control of RFI flush via debugfs ASoC: pcm512x: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE usbip: vhci_hcd: clear just the USB_PORT_STAT_POWER bit usbip: fix 3eee23c3ec14 tcp_socket address still in the status file net: cdc_ncm: initialize drvflags before usage ASoC: simple-card: Fix misleading error message ASoC: rsnd: don't call free_irq() on Parent SSI ASoC: rsnd: avoid duplicate free_irq() drm: rcar-du: Use the VBK interrupt for vblank events drm: rcar-du: Fix race condition when disabling planes at CRTC stop x86/asm: Fix inline asm call constraints for GCC 4.4 ip6mr: fix stale iterator net: igmp: add a missing rcu locking section qlcnic: fix deadlock bug r8169: fix RTL8168EP take too long to complete driver initialization. tcp: release sk_frag.page in tcp_disconnect vhost_net: stop device during reset owner media: soc_camera: soc_scale_crop: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE KEYS: encrypted: fix buffer overread in valid_master_desc() don't put symlink bodies in pagecache into highmem crypto: tcrypt - fix S/G table for test_aead_speed() x86/microcode/AMD: Do not load when running on a hypervisor x86/microcode: Do the family check first powerpc/pseries: include linux/types.h in asm/hvcall.h cifs: Fix missing put_xid in cifs_file_strict_mmap cifs: Fix autonegotiate security settings mismatch CIFS: zero sensitive data when freeing dmaengine: dmatest: fix container_of member in dmatest_callback x86/kaiser: fix build error with KASAN && !FUNCTION_GRAPH_TRACER kaiser: fix compile error without vsyscall netfilter: nf_queue: Make the queue_handler pernet posix-timer: Properly check sigevent->sigev_notify usb: gadget: uvc: Missing files for configfs interface sched/rt: Use container_of() to get root domain in rto_push_irq_work_func() sched/rt: Up the root domain ref count when passing it around via IPIs dccp: CVE-2017-8824: use-after-free in DCCP code media: dvb-usb-v2: lmedm04: Improve logic checking of warm start media: dvb-usb-v2: lmedm04: move ts2020 attach to dm04_lme2510_tuner mtd: cfi: convert inline functions to macros mtd: nand: brcmnand: Disable prefetch by default mtd: nand: Fix nand_do_read_oob() return value mtd: nand: sunxi: Fix ECC strength choice ubi: block: Fix locking for idr_alloc/idr_remove nfs/pnfs: fix nfs_direct_req ref leak when i/o falls back to the mds NFS: Add a cond_resched() to nfs_commit_release_pages() NFS: commit direct writes even if they fail partially NFS: reject request for id_legacy key without auxdata kernfs: fix regression in kernfs_fop_write caused by wrong type ahci: Annotate PCI ids for mobile Intel chipsets as such ahci: Add PCI ids for Intel Bay Trail, Cherry Trail and Apollo Lake AHCI ahci: Add Intel Cannon Lake PCH-H PCI ID crypto: hash - introduce crypto_hash_alg_has_setkey() crypto: cryptd - pass through absence of ->setkey() crypto: poly1305 - remove ->setkey() method nsfs: mark dentry with DCACHE_RCUACCESS media: v4l2-ioctl.c: don't copy back the result for -ENOTTY vb2: V4L2_BUF_FLAG_DONE is set after DQBUF media: v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUF media: v4l2-compat-ioctl32.c: fix the indentation media: v4l2-compat-ioctl32.c: move 'helper' functions to __get/put_v4l2_format32 media: v4l2-compat-ioctl32.c: avoid sizeof(type) media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32 media: v4l2-compat-ioctl32.c: fix ctrl_is_pointer media: v4l2-compat-ioctl32.c: make ctrl_is_pointer work for subdevs media: v4l2-compat-ioctl32: Copy v4l2_window->global_alpha media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32 media: v4l2-compat-ioctl32.c: drop pr_info for unknown buffer type media: v4l2-compat-ioctl32.c: don't copy back the result for certain errors media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic crypto: caam - fix endless loop when DECO acquire fails arm: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls KVM: nVMX: Fix races when sending nested PI while dest enters/leaves L2 watchdog: imx2_wdt: restore previous timeout after suspend+resume media: ts2020: avoid integer overflows on 32 bit machines media: cxusb, dib0700: ignore XC2028_I2C_FLUSH kernel/async.c: revert "async: simplify lowest_in_progress()" HID: quirks: Fix keyboard + touchpad on Toshiba Click Mini not working Bluetooth: btsdio: Do not bind to non-removable BCM43341 Revert "Bluetooth: btusb: fix QCA Rome suspend/resume" Bluetooth: btusb: Restore QCA Rome suspend/resume fix with a "rewritten" version signal/openrisc: Fix do_unaligned_access to send the proper signal signal/sh: Ensure si_signo is initialized in do_divide_error alpha: fix crash if pthread_create races with signal delivery alpha: fix reboot on Avanti platform xtensa: fix futex_atomic_cmpxchg_inatomic EDAC, octeon: Fix an uninitialized variable warning pktcdvd: Fix pkt_setup_dev() error path btrfs: Handle btrfs_set_extent_delalloc failure in fixup worker nvme: Fix managing degraded controllers ACPI: sbshc: remove raw pointer from printk() message ovl: fix failure to fsync lower dir mn10300/misalignment: Use SIGSEGV SEGV_MAPERR to report a failed user copy ftrace: Remove incorrect setting of glob search field Linux 4.4.116 Change-Id: Id000cb8d59b74de063902e9ad24dd07fe1b1694b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * mtd: cfi: convert inline functions to macrosArnd Bergmann2018-02-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 9e343e87d2c4c707ef8fae2844864d4dde3a2d13 upstream. The map_word_() functions, dating back to linux-2.6.8, try to perform bitwise operations on a 'map_word' structure. This may have worked with compilers that were current then (gcc-3.4 or earlier), but end up being rather inefficient on any version I could try now (gcc-4.4 or higher). Specifically we hit a problem analyzed in gcc PR81715 where we fail to reuse the stack space for local variables. This can be seen immediately in the stack consumption for cfi_staa_erase_varsize() and other functions that (with CONFIG_KASAN) can be up to 2200 bytes. Changing the inline functions into macros brings this down to 1280 bytes. Without KASAN, the same problem exists, but the stack consumption is lower to start with, my patch shrinks it from 920 to 496 bytes on with arm-linux-gnueabi-gcc-5.4, and saves around 1KB in .text size for cfi_cmdset_0020.c, as it avoids copying map_word structures for each call to one of these helpers. With the latest gcc-8 snapshot, the problem is fixed in upstream gcc, but nobody uses that yet, so we should still work around it in mainline kernels and probably backport the workaround to stable kernels as well. We had a couple of other functions that suffered from the same gcc bug, and all of those had a simpler workaround involving dummy variables in the inline function. Unfortunately that did not work here, the macro hack was the best I could come up with. It would also be helpful to have someone to a little performance testing on the patch, to see how much it helps in terms of CPU utilitzation. Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Richard Weinberger <richard@nod.at> Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * don't put symlink bodies in pagecache into highmemAl Viro2018-02-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 21fc61c73c3903c4c312d0802da01ec2b323d174 upstream. kmap() in page_follow_link_light() needed to go - allowing to hold an arbitrary number of kmaps for long is a great way to deadlocking the system. new helper (inode_nohighmem(inode)) needs to be used for pagecache symlinks inodes; done for all in-tree cases. page_follow_link_light() instrumented to yell about anything missed. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Jin Qian <jinqian@google.com> Signed-off-by: Jin Qian <jinqian@android.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | UPSTREAM: irqchip: mips-gic: Provide VP ID accessorPaul Burton2018-02-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Provide a gic_read_local_vp_id() function to read the VCNUM field of the GICs local VP_IDENT register. This will be used by a further patch to check that the value reported by the GIC matches up with the kernels calculation. Signed-off-by: Paul Burton <paul.burton@imgtec.com> Acked-by: Jason Cooper <jason@lakedaemon.net> Cc: Andrew Bresticker <abrestic@chromium.org> Cc: Jason Cooper <jason@lakedaemon.net> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: James Hogan <james.hogan@imgtec.com> Cc: Marc Zyngier <marc.zyngier@arm.com> Cc: linux-mips@linux-mips.org Cc: linux-kernel@vger.kernel.org Patchwork: https://patchwork.linux-mips.org/patch/12334/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> (cherry picked from commit 835d2b452969820fd67a755a2c01fb6e12822448) Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
* | BACKPORT: exit_thread: accept a task parameter to be exitedJiri Slaby2018-02-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We need to call exit_thread from copy_process in a fail path. So make it accept task_struct as a parameter. [v2] * s390: exit_thread_runtime_instr doesn't make sense to be called for non-current tasks. * arm: fix the comment in vfp_thread_copy * change 'me' to 'tsk' for task_struct * now we can change only archs that actually have exit_thread [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: "David S. Miller" <davem@davemloft.net> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: "James E.J. Bottomley" <jejb@parisc-linux.org> Cc: Aurelien Jacquiot <a-jacquiot@ti.com> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Chen Liqin <liqin.linux@gmail.com> Cc: Chris Metcalf <cmetcalf@mellanox.com> Cc: Chris Zankel <chris@zankel.net> Cc: David Howells <dhowells@redhat.com> Cc: Fenghua Yu <fenghua.yu@intel.com> Cc: Geert Uytterhoeven <geert@linux-m68k.org> Cc: Guan Xuetao <gxt@mprc.pku.edu.cn> Cc: Haavard Skinnemoen <hskinnemoen@gmail.com> Cc: Hans-Christian Egtvedt <egtvedt@samfundet.no> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Helge Deller <deller@gmx.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Cc: James Hogan <james.hogan@imgtec.com> Cc: Jeff Dike <jdike@addtoit.com> Cc: Jesper Nilsson <jesper.nilsson@axis.com> Cc: Jiri Slaby <jslaby@suse.cz> Cc: Jonas Bonn <jonas@southpole.se> Cc: Koichi Yasutake <yasutake.koichi@jp.panasonic.com> Cc: Lennox Wu <lennox.wu@gmail.com> Cc: Ley Foon Tan <lftan@altera.com> Cc: Mark Salter <msalter@redhat.com> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Matt Turner <mattst88@gmail.com> Cc: Max Filippov <jcmvbkbc@gmail.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Michal Simek <monstr@monstr.eu> Cc: Mikael Starvik <starvik@axis.com> Cc: Paul Mackerras <paulus@samba.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Rich Felker <dalias@libc.org> Cc: Richard Henderson <rth@twiddle.net> Cc: Richard Kuo <rkuo@codeaurora.org> Cc: Richard Weinberger <richard@nod.at> Cc: Russell King <linux@arm.linux.org.uk> Cc: Steven Miao <realmz6@gmail.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Tony Luck <tony.luck@intel.com> Cc: Vineet Gupta <vgupta@synopsys.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Yoshinori Sato <ysato@users.sourceforge.jp> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit e64646946ed32902fd597fa6e514b1da84642de3) Conflicts: arch/s390/kernel/process.c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
* | BACKPORT: exit_thread: remove empty bodiesJiri Slaby2018-02-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Define HAVE_EXIT_THREAD for archs which want to do something in exit_thread. For others, let's define exit_thread as an empty inline. This is a cleanup before we change the prototype of exit_thread to accept a task parameter. [akpm@linux-foundation.org: fix mips] Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: "David S. Miller" <davem@davemloft.net> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: "James E.J. Bottomley" <jejb@parisc-linux.org> Cc: Aurelien Jacquiot <a-jacquiot@ti.com> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Chen Liqin <liqin.linux@gmail.com> Cc: Chris Metcalf <cmetcalf@mellanox.com> Cc: Chris Zankel <chris@zankel.net> Cc: David Howells <dhowells@redhat.com> Cc: Fenghua Yu <fenghua.yu@intel.com> Cc: Geert Uytterhoeven <geert@linux-m68k.org> Cc: Guan Xuetao <gxt@mprc.pku.edu.cn> Cc: Haavard Skinnemoen <hskinnemoen@gmail.com> Cc: Hans-Christian Egtvedt <egtvedt@samfundet.no> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Helge Deller <deller@gmx.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Cc: James Hogan <james.hogan@imgtec.com> Cc: Jeff Dike <jdike@addtoit.com> Cc: Jesper Nilsson <jesper.nilsson@axis.com> Cc: Jiri Slaby <jslaby@suse.cz> Cc: Jonas Bonn <jonas@southpole.se> Cc: Koichi Yasutake <yasutake.koichi@jp.panasonic.com> Cc: Lennox Wu <lennox.wu@gmail.com> Cc: Ley Foon Tan <lftan@altera.com> Cc: Mark Salter <msalter@redhat.com> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Matt Turner <mattst88@gmail.com> Cc: Max Filippov <jcmvbkbc@gmail.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Michal Simek <monstr@monstr.eu> Cc: Mikael Starvik <starvik@axis.com> Cc: Paul Mackerras <paulus@samba.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Rich Felker <dalias@libc.org> Cc: Richard Henderson <rth@twiddle.net> Cc: Richard Kuo <rkuo@codeaurora.org> Cc: Richard Weinberger <richard@nod.at> Cc: Russell King <linux@arm.linux.org.uk> Cc: Steven Miao <realmz6@gmail.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Tony Luck <tony.luck@intel.com> Cc: Vineet Gupta <vgupta@synopsys.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Yoshinori Sato <ysato@users.sourceforge.jp> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit 5f56a5dfdb9bcb3bca03df59980d4d2f012cbb53) Conflicts: arch/powerpc/kernel/process.c arch/xtensa/Kconfig Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
* | Merge 4.4.115 into android-4.4Greg Kroah-Hartman2018-02-03
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.115 loop: fix concurrent lo_open/lo_release bpf: fix branch pruning logic x86: bpf_jit: small optimization in emit_bpf_tail_call() bpf: fix bpf_tail_call() x64 JIT bpf: introduce BPF_JIT_ALWAYS_ON config bpf: arsh is not supported in 32 bit alu thus reject it bpf: avoid false sharing of map refcount with max_entries bpf: fix divides by zero bpf: fix 32-bit divide by zero bpf: reject stores into ctx via st and xadd x86/pti: Make unpoison of pgd for trusted boot work for real kaiser: fix intel_bts perf crashes ALSA: seq: Make ioctls race-free crypto: aesni - handle zero length dst buffer crypto: af_alg - whitelist mask and type power: reset: zx-reboot: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE gpio: iop: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE gpio: ath79: add missing MODULE_DESCRIPTION/LICENSE mtd: nand: denali_pci: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE igb: Free IRQs when device is hotplugged KVM: x86: emulator: Return to user-mode on L1 CPL=0 emulation failure KVM: x86: Don't re-execute instruction when not passing CR2 value KVM: X86: Fix operand/address-size during instruction decoding KVM: x86: ioapic: Fix level-triggered EOI and IOAPIC reconfigure race KVM: x86: ioapic: Clear Remote IRR when entry is switched to edge-triggered KVM: x86: ioapic: Preserve read-only values in the redirection table ACPI / bus: Leave modalias empty for devices which are not present cpufreq: Add Loongson machine dependencies bcache: check return value of register_shrinker drm/amdgpu: Fix SDMA load/unload sequence on HWS disabled mode drm/amdkfd: Fix SDMA ring buffer size calculation drm/amdkfd: Fix SDMA oversubsription handling openvswitch: fix the incorrect flow action alloc size mac80211: fix the update of path metric for RANN frame btrfs: fix deadlock when writing out space cache KVM: VMX: Fix rflags cache during vCPU reset xen-netfront: remove warning when unloading module nfsd: CLOSE SHOULD return the invalid special stateid for NFSv4.x (x>0) nfsd: Ensure we check stateid validity in the seqid operation checks grace: replace BUG_ON by WARN_ONCE in exit_net hook nfsd: check for use of the closed special stateid lockd: fix "list_add double add" caused by legacy signal interface hwmon: (pmbus) Use 64bit math for DIRECT format values net: ethernet: xilinx: Mark XILINX_LL_TEMAC broken on 64-bit quota: Check for register_shrinker() failure. SUNRPC: Allow connect to return EHOSTUNREACH kmemleak: add scheduling point to kmemleak_scan() drm/omap: Fix error handling path in 'omap_dmm_probe()' xfs: ubsan fixes scsi: aacraid: Prevent crash in case of free interrupt during scsi EH path scsi: ufs: ufshcd: fix potential NULL pointer dereference in ufshcd_config_vreg media: usbtv: add a new usbid usb: gadget: don't dereference g until after it has been null checked staging: rtl8188eu: Fix incorrect response to SIOCGIWESSID usb: option: Add support for FS040U modem USB: serial: pl2303: new device id for Chilitag USB: cdc-acm: Do not log urb submission errors on disconnect CDC-ACM: apply quirk for card reader USB: serial: io_edgeport: fix possible sleep-in-atomic usbip: prevent bind loops on devices attached to vhci_hcd usbip: list: don't list devices attached to vhci_hcd USB: serial: simple: add Motorola Tetra driver usb: f_fs: Prevent gadget unbind if it is already unbound usb: uas: unconditionally bring back host after reset selinux: general protection fault in sock_has_perm serial: imx: Only wakeup via RTSDEN bit if the system has RTS/CTS spi: imx: do not access registers while clocks disabled Linux 4.4.115 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * bpf: avoid false sharing of map refcount with max_entriesDaniel Borkmann2018-02-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ upstream commit be95a845cc4402272994ce290e3ad928aff06cb9 ] In addition to commit b2157399cc98 ("bpf: prevent out-of-bounds speculation") also change the layout of struct bpf_map such that false sharing of fast-path members like max_entries is avoided when the maps reference counter is altered. Therefore enforce them to be placed into separate cachelines. pahole dump after change: struct bpf_map { const struct bpf_map_ops * ops; /* 0 8 */ struct bpf_map * inner_map_meta; /* 8 8 */ void * security; /* 16 8 */ enum bpf_map_type map_type; /* 24 4 */ u32 key_size; /* 28 4 */ u32 value_size; /* 32 4 */ u32 max_entries; /* 36 4 */ u32 map_flags; /* 40 4 */ u32 pages; /* 44 4 */ u32 id; /* 48 4 */ int numa_node; /* 52 4 */ bool unpriv_array; /* 56 1 */ /* XXX 7 bytes hole, try to pack */ /* --- cacheline 1 boundary (64 bytes) --- */ struct user_struct * user; /* 64 8 */ atomic_t refcnt; /* 72 4 */ atomic_t usercnt; /* 76 4 */ struct work_struct work; /* 80 32 */ char name[16]; /* 112 16 */ /* --- cacheline 2 boundary (128 bytes) --- */ /* size: 128, cachelines: 2, members: 17 */ /* sum members: 121, holes: 1, sum holes: 7 */ }; Now all entries in the first cacheline are read only throughout the life time of the map, set up once during map creation. Overall struct size and number of cachelines doesn't change from the reordering. struct bpf_map is usually first member and embedded in map structs in specific map implementations, so also avoid those members to sit at the end where it could potentially share the cacheline with first map values e.g. in the array since remote CPUs could trigger map updates just as well for those (easily dirtying members like max_entries intentionally as well) while having subsequent values in cache. Quoting from Google's Project Zero blog [1]: Additionally, at least on the Intel machine on which this was tested, bouncing modified cache lines between cores is slow, apparently because the MESI protocol is used for cache coherence [8]. Changing the reference counter of an eBPF array on one physical CPU core causes the cache line containing the reference counter to be bounced over to that CPU core, making reads of the reference counter on all other CPU cores slow until the changed reference counter has been written back to memory. Because the length and the reference counter of an eBPF array are stored in the same cache line, this also means that changing the reference counter on one physical CPU core causes reads of the eBPF array's length to be slow on other physical CPU cores (intentional false sharing). While this doesn't 'control' the out-of-bounds speculation through masking the index as in commit b2157399cc98, triggering a manipulation of the map's reference counter is really trivial, so lets not allow to easily affect max_entries from it. Splitting to separate cachelines also generally makes sense from a performance perspective anyway in that fast-path won't have a cache miss if the map gets pinned, reused in other progs, etc out of control path, thus also avoids unintentional false sharing. [1] https://googleprojectzero.blogspot.ch/2018/01/reading-privileged-memory-with-side.html Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>