summaryrefslogtreecommitdiff
path: root/kernel (follow)
Commit message (Collapse)AuthorAge
* Merge android-4.4.140 (789274d) into msm-4.4Blagovest Kolenichev2018-07-18
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-789274d Linux 4.4.140 staging: comedi: quatech_daqp_cs: fix no-op loop daqp_ao_insn_write() netfilter: nf_log: don't hold nf_log_mutex during user access mtd: cfi_cmdset_0002: Change erase functions to check chip good only mtd: cfi_cmdset_0002: Change erase functions to retry for error mtd: cfi_cmdset_0002: Change definition naming to retry write operation dm bufio: don't take the lock in dm_bufio_shrink_count mtd: rawnand: mxc: set spare area size register explicitly dm bufio: drop the lock when doing GFP_NOIO allocation dm bufio: avoid sleeping while holding the dm_bufio lock mm, page_alloc: do not break __GFP_THISNODE by zonelist reset media: cx25840: Use subdev host data for PLL override x86/mce: Fix incorrect "Machine check from unknown source" message x86/mce: Detect local MCEs properly HID: debug: check length before copy_to_user() HID: hiddev: fix potential Spectre v1 HID: i2c-hid: Fix "incomplete report" noise ext4: check superblock mapped prior to committing ext4: add more mount time checks of the superblock ext4: add more inode number paranoia checks ext4: clear i_data in ext4_inode_info when removing inline data ext4: include the illegal physical block in the bad map ext4_error msg ext4: verify the depth of extent tree in ext4_find_extent() ext4: only look at the bg_flags field if it is valid ext4: always check block group bounds in ext4_init_block_bitmap() ext4: make sure bitmaps and the inode table don't overlap with bg descriptors jbd2: don't mark block as modified if the handle is out of credits cifs: Fix infinite loop when using hard mount option drbd: fix access after free s390: Correct register corruption in critical section cleanup scsi: sg: mitigate read/write abuse tracing: Fix missing return symbol in function_graph output mm: hugetlb: yield when prepping struct pages ubi: fastmap: Correctly handle interrupted erasures in EBA ARM: dts: imx6q: Use correct SDMA script for SPI5 core netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain() nvme-pci: initialize queue memory before interrupts kprobes/x86: Do not modify singlestep buffer while resuming ipv4: Fix error return value in fib_convert_metrics() i2c: rcar: fix resume by always initializing registers before transfer ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode x86/boot: Fix early command-line parsing when matching at end n_tty: Access echo_* variables carefully. staging: android: ion: Return an ERR_PTR in ion_map_kernel n_tty: Fix stall at n_tty_receive_char_special(). USB: serial: cp210x: add Silicon Labs IDs for Windows Update USB: serial: cp210x: add CESINEL device ids usb: cdc_acm: Add quirk for Uniden UBC125 scanner Change-Id: I01c4fc4b6354c28a7d8ff391ff515096ed4d3da4 Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org> Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * Merge 4.4.140 into android-4.4Greg Kroah-Hartman2018-07-11
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.140 usb: cdc_acm: Add quirk for Uniden UBC125 scanner USB: serial: cp210x: add CESINEL device ids USB: serial: cp210x: add Silicon Labs IDs for Windows Update n_tty: Fix stall at n_tty_receive_char_special(). staging: android: ion: Return an ERR_PTR in ion_map_kernel n_tty: Access echo_* variables carefully. x86/boot: Fix early command-line parsing when matching at end ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode i2c: rcar: fix resume by always initializing registers before transfer ipv4: Fix error return value in fib_convert_metrics() kprobes/x86: Do not modify singlestep buffer while resuming nvme-pci: initialize queue memory before interrupts netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain() ARM: dts: imx6q: Use correct SDMA script for SPI5 core ubi: fastmap: Correctly handle interrupted erasures in EBA mm: hugetlb: yield when prepping struct pages tracing: Fix missing return symbol in function_graph output scsi: sg: mitigate read/write abuse s390: Correct register corruption in critical section cleanup drbd: fix access after free cifs: Fix infinite loop when using hard mount option jbd2: don't mark block as modified if the handle is out of credits ext4: make sure bitmaps and the inode table don't overlap with bg descriptors ext4: always check block group bounds in ext4_init_block_bitmap() ext4: only look at the bg_flags field if it is valid ext4: verify the depth of extent tree in ext4_find_extent() ext4: include the illegal physical block in the bad map ext4_error msg ext4: clear i_data in ext4_inode_info when removing inline data ext4: add more inode number paranoia checks ext4: add more mount time checks of the superblock ext4: check superblock mapped prior to committing HID: i2c-hid: Fix "incomplete report" noise HID: hiddev: fix potential Spectre v1 HID: debug: check length before copy_to_user() x86/mce: Detect local MCEs properly x86/mce: Fix incorrect "Machine check from unknown source" message media: cx25840: Use subdev host data for PLL override mm, page_alloc: do not break __GFP_THISNODE by zonelist reset dm bufio: avoid sleeping while holding the dm_bufio lock dm bufio: drop the lock when doing GFP_NOIO allocation mtd: rawnand: mxc: set spare area size register explicitly dm bufio: don't take the lock in dm_bufio_shrink_count mtd: cfi_cmdset_0002: Change definition naming to retry write operation mtd: cfi_cmdset_0002: Change erase functions to retry for error mtd: cfi_cmdset_0002: Change erase functions to check chip good only netfilter: nf_log: don't hold nf_log_mutex during user access staging: comedi: quatech_daqp_cs: fix no-op loop daqp_ao_insn_write() Linux 4.4.140 Change-Id: I1eb015e1fee548fb958c7e5eb4754b425cfab6b7 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * tracing: Fix missing return symbol in function_graph outputChangbin Du2018-07-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 1fe4293f4b8de75824935f8d8e9a99c7fc6873da upstream. The function_graph tracer does not show the interrupt return marker for the leaf entry. On leaf entries, we see an unbalanced interrupt marker (the interrupt was entered, but nevern left). Before: 1) | SyS_write() { 1) | __fdget_pos() { 1) 0.061 us | __fget_light(); 1) 0.289 us | } 1) | vfs_write() { 1) 0.049 us | rw_verify_area(); 1) + 15.424 us | __vfs_write(); 1) ==========> | 1) 6.003 us | smp_apic_timer_interrupt(); 1) 0.055 us | __fsnotify_parent(); 1) 0.073 us | fsnotify(); 1) + 23.665 us | } 1) + 24.501 us | } After: 0) | SyS_write() { 0) | __fdget_pos() { 0) 0.052 us | __fget_light(); 0) 0.328 us | } 0) | vfs_write() { 0) 0.057 us | rw_verify_area(); 0) | __vfs_write() { 0) ==========> | 0) 8.548 us | smp_apic_timer_interrupt(); 0) <========== | 0) + 36.507 us | } /* __vfs_write */ 0) 0.049 us | __fsnotify_parent(); 0) 0.066 us | fsnotify(); 0) + 50.064 us | } 0) + 50.952 us | } Link: http://lkml.kernel.org/r/1517413729-20411-1-git-send-email-changbin.du@intel.com Cc: stable@vger.kernel.org Fixes: f8b755ac8e0cc ("tracing/function-graph-tracer: Output arrows signal on hardirq call/return") Signed-off-by: Changbin Du <changbin.du@intel.com> Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge android-4.4.139 (7ba5557) into msm-4.4Blagovest Kolenichev2018-07-03
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-7ba5557 Linux 4.4.139 Bluetooth: Fix connection if directed advertising and privacy is used cdc_ncm: avoid padding beyond end of skb dm thin: handle running out of data space vs concurrent discard block: Fix transfer when chunk sectors exceeds max spi: Fix scatterlist elements size in spi_map_buf Btrfs: fix unexpected cow in run_delalloc_nocow ALSA: hda/realtek - Add a quirk for FSC ESPRIMO U9210 Input: elantech - fix V4 report decoding for module with middle key Input: elantech - enable middle button of touchpads on ThinkPad P52 Input: elan_i2c_smbus - fix more potential stack buffer overflows udf: Detect incorrect directory size xen: Remove unnecessary BUG_ON from __unbind_from_irq() Input: elan_i2c - add ELAN0618 (Lenovo v330 15IKB) ACPI ID video: uvesafb: Fix integer overflow in allocation NFSv4: Fix possible 1-byte stack overflow in nfs_idmap_read_and_verify_message nfsd: restrict rd_maxcount to svc_max_payload in nfsd_encode_readdir media: dvb_frontend: fix locking issues at dvb_frontend_get_event() media: cx231xx: Add support for AverMedia DVD EZMaker 7 media: v4l2-compat-ioctl32: prevent go past max size perf intel-pt: Fix packet decoding of CYC packets perf intel-pt: Fix "Unexpected indirect branch" error perf intel-pt: Fix MTC timing after overflow perf intel-pt: Fix decoding to accept CBR between FUP and corresponding TIP perf intel-pt: Fix sync_switch INTEL_PT_SS_NOT_TRACING perf tools: Fix symbol and object code resolution for vdso32 and vdsox32 mfd: intel-lpss: Program REMAP register in PIO mode backlight: tps65217_bl: Fix Device Tree node lookup backlight: max8925_bl: Fix Device Tree node lookup backlight: as3711_bl: Fix Device Tree node lookup xfrm: skip policies marked as dead while rehashing xfrm: Ignore socket policies when rebuilding hash tables UBIFS: Fix potential integer overflow in allocation ubi: fastmap: Cancel work upon detach md: fix two problems with setting the "re-add" device state. linvdimm, pmem: Preserve read-only setting for pmem devices scsi: zfcp: fix missing REC trigger trace on enqueue without ERP thread scsi: zfcp: fix missing REC trigger trace for all objects in ERP_FAILED scsi: zfcp: fix missing REC trigger trace on terminate_rport_io for ERP_FAILED scsi: zfcp: fix missing REC trigger trace on terminate_rport_io early return scsi: zfcp: fix misleading REC trigger trace where erp_action setup failed scsi: zfcp: fix missing SCSI trace for retry of abort / scsi_eh TMF scsi: zfcp: fix missing SCSI trace for result of eh_host_reset_handler scsi: qla2xxx: Fix setting lower transfer speed if GPSC fails iio:buffer: make length types match kfifo types Btrfs: fix clone vs chattr NODATASUM race time: Make sure jiffies_to_msecs() preserves non-zero time periods MIPS: io: Add barrier after register read in inX() PCI: pciehp: Clear Presence Detect and Data Link Layer Status Changed on resume MIPS: BCM47XX: Enable 74K Core ExternalSync for PCIe erratum mtd: cfi_cmdset_0002: Avoid walking all chips when unlocking. mtd: cfi_cmdset_0002: Fix unlocking requests crossing a chip boudary mtd: cfi_cmdset_0002: fix SEGV unlocking multiple chips mtd: cfi_cmdset_0002: Use right chip in do_ppb_xxlock() mtd: cfi_cmdset_0002: Change write buffer to check correct value RDMA/mlx4: Discard unknown SQP work requests IB/qib: Fix DMA api warning with debug kernel of: unittest: for strings, account for trailing \0 in property length field ARM: 8764/1: kgdb: fix NUMREGBYTES so that gdb_regs[] is the correct size powerpc/fadump: Unregister fadump on kexec down path. cpuidle: powernv: Fix promotion from snooze if next state disabled powerpc/ptrace: Fix enforcement of DAWR constraints powerpc/ptrace: Fix setting 512B aligned breakpoints with PTRACE_SET_DEBUGREG powerpc/mm/hash: Add missing isync prior to kernel stack SLB switch fuse: fix control dir setup and teardown fuse: don't keep dead fuse_conn at fuse_fill_super(). fuse: atomic_o_trunc should truncate pagecache Bluetooth: hci_qca: Avoid missing rampatch failure with userspace fw loader ipmi:bt: Set the timeout before doing a capabilities check branch-check: fix long->int truncation when profiling branches mips: ftrace: fix static function graph tracing lib/vsprintf: Remove atomic-unsafe support for %pCr ASoC: cirrus: i2s: Fix {TX|RX}LinCtrlData setup ASoC: cirrus: i2s: Fix LRCLK configuration ASoC: dapm: delete dapm_kcontrol_data paths list before freeing it 1wire: family module autoload fails because of upper/lower case mismatch. usb: do not reset if a low-speed or full-speed device timed out signal/xtensa: Consistenly use SIGBUS in do_unaligned_user serial: sh-sci: Use spin_{try}lock_irqsave instead of open coding version m68k/mm: Adjust VM area to be unmapped by gap size for __iounmap() x86/spectre_v1: Disable compiler optimizations over array_index_mask_nospec() fs/binfmt_misc.c: do not allow offset overflow w1: mxc_w1: Enable clock before calling clk_get_rate() on it libata: Drop SanDisk SD7UB3Q*G1001 NOLPM quirk libata: zpodd: small read overflow in eject_tray() libata: zpodd: make arrays cdb static, reduces object code size cpufreq: Fix new policy initialization during limits updates via sysfs ALSA: hda: add dock and led support for HP ProBook 640 G4 ALSA: hda: add dock and led support for HP EliteBook 830 G5 ALSA: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream() btrfs: scrub: Don't use inode pages for device replace driver core: Don't ignore class_dir_create_and_add() failure. ext4: fix fencepost error in check for inode count overflow during resize ext4: update mtime in ext4_punch_hole even if no blocks are released tcp: verify the checksum of the first data segment in a new connection bonding: re-evaluate force_primary when the primary slave name changes usb: musb: fix remote wakeup racing with suspend Btrfs: make raid6 rebuild retry more tcp: do not overshoot window_clamp in tcp_rcv_space_adjust() Revert "Btrfs: fix scrub to repair raid6 corruption" net/sonic: Use dma_mapping_error() net: qmi_wwan: Add Netgear Aircard 779S atm: zatm: fix memcmp casting ipvs: fix buffer overflow with sync daemon and service netfilter: ebtables: handle string from userspace with care xfrm6: avoid potential infinite loop in _decode_session6() ANDROID: Add kconfig to make dm-verity check_at_most_once default enabled ANDROID: sdcardfs: fix potential crash when reserved_mb is not zero Change-Id: Ibcd2b6614843e4e8fd5a57acf350a9e83e1c0dbc Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
| * | Merge 4.4.139 into android-4.4Greg Kroah-Hartman2018-07-03
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.139 xfrm6: avoid potential infinite loop in _decode_session6() netfilter: ebtables: handle string from userspace with care ipvs: fix buffer overflow with sync daemon and service atm: zatm: fix memcmp casting net: qmi_wwan: Add Netgear Aircard 779S net/sonic: Use dma_mapping_error() Revert "Btrfs: fix scrub to repair raid6 corruption" tcp: do not overshoot window_clamp in tcp_rcv_space_adjust() Btrfs: make raid6 rebuild retry more usb: musb: fix remote wakeup racing with suspend bonding: re-evaluate force_primary when the primary slave name changes tcp: verify the checksum of the first data segment in a new connection ext4: update mtime in ext4_punch_hole even if no blocks are released ext4: fix fencepost error in check for inode count overflow during resize driver core: Don't ignore class_dir_create_and_add() failure. btrfs: scrub: Don't use inode pages for device replace ALSA: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream() ALSA: hda: add dock and led support for HP EliteBook 830 G5 ALSA: hda: add dock and led support for HP ProBook 640 G4 cpufreq: Fix new policy initialization during limits updates via sysfs libata: zpodd: make arrays cdb static, reduces object code size libata: zpodd: small read overflow in eject_tray() libata: Drop SanDisk SD7UB3Q*G1001 NOLPM quirk w1: mxc_w1: Enable clock before calling clk_get_rate() on it fs/binfmt_misc.c: do not allow offset overflow x86/spectre_v1: Disable compiler optimizations over array_index_mask_nospec() m68k/mm: Adjust VM area to be unmapped by gap size for __iounmap() serial: sh-sci: Use spin_{try}lock_irqsave instead of open coding version signal/xtensa: Consistenly use SIGBUS in do_unaligned_user usb: do not reset if a low-speed or full-speed device timed out 1wire: family module autoload fails because of upper/lower case mismatch. ASoC: dapm: delete dapm_kcontrol_data paths list before freeing it ASoC: cirrus: i2s: Fix LRCLK configuration ASoC: cirrus: i2s: Fix {TX|RX}LinCtrlData setup lib/vsprintf: Remove atomic-unsafe support for %pCr mips: ftrace: fix static function graph tracing branch-check: fix long->int truncation when profiling branches ipmi:bt: Set the timeout before doing a capabilities check Bluetooth: hci_qca: Avoid missing rampatch failure with userspace fw loader fuse: atomic_o_trunc should truncate pagecache fuse: don't keep dead fuse_conn at fuse_fill_super(). fuse: fix control dir setup and teardown powerpc/mm/hash: Add missing isync prior to kernel stack SLB switch powerpc/ptrace: Fix setting 512B aligned breakpoints with PTRACE_SET_DEBUGREG powerpc/ptrace: Fix enforcement of DAWR constraints cpuidle: powernv: Fix promotion from snooze if next state disabled powerpc/fadump: Unregister fadump on kexec down path. ARM: 8764/1: kgdb: fix NUMREGBYTES so that gdb_regs[] is the correct size of: unittest: for strings, account for trailing \0 in property length field IB/qib: Fix DMA api warning with debug kernel RDMA/mlx4: Discard unknown SQP work requests mtd: cfi_cmdset_0002: Change write buffer to check correct value mtd: cfi_cmdset_0002: Use right chip in do_ppb_xxlock() mtd: cfi_cmdset_0002: fix SEGV unlocking multiple chips mtd: cfi_cmdset_0002: Fix unlocking requests crossing a chip boudary mtd: cfi_cmdset_0002: Avoid walking all chips when unlocking. MIPS: BCM47XX: Enable 74K Core ExternalSync for PCIe erratum PCI: pciehp: Clear Presence Detect and Data Link Layer Status Changed on resume MIPS: io: Add barrier after register read in inX() time: Make sure jiffies_to_msecs() preserves non-zero time periods Btrfs: fix clone vs chattr NODATASUM race iio:buffer: make length types match kfifo types scsi: qla2xxx: Fix setting lower transfer speed if GPSC fails scsi: zfcp: fix missing SCSI trace for result of eh_host_reset_handler scsi: zfcp: fix missing SCSI trace for retry of abort / scsi_eh TMF scsi: zfcp: fix misleading REC trigger trace where erp_action setup failed scsi: zfcp: fix missing REC trigger trace on terminate_rport_io early return scsi: zfcp: fix missing REC trigger trace on terminate_rport_io for ERP_FAILED scsi: zfcp: fix missing REC trigger trace for all objects in ERP_FAILED scsi: zfcp: fix missing REC trigger trace on enqueue without ERP thread linvdimm, pmem: Preserve read-only setting for pmem devices md: fix two problems with setting the "re-add" device state. ubi: fastmap: Cancel work upon detach UBIFS: Fix potential integer overflow in allocation xfrm: Ignore socket policies when rebuilding hash tables xfrm: skip policies marked as dead while rehashing backlight: as3711_bl: Fix Device Tree node lookup backlight: max8925_bl: Fix Device Tree node lookup backlight: tps65217_bl: Fix Device Tree node lookup mfd: intel-lpss: Program REMAP register in PIO mode perf tools: Fix symbol and object code resolution for vdso32 and vdsox32 perf intel-pt: Fix sync_switch INTEL_PT_SS_NOT_TRACING perf intel-pt: Fix decoding to accept CBR between FUP and corresponding TIP perf intel-pt: Fix MTC timing after overflow perf intel-pt: Fix "Unexpected indirect branch" error perf intel-pt: Fix packet decoding of CYC packets media: v4l2-compat-ioctl32: prevent go past max size media: cx231xx: Add support for AverMedia DVD EZMaker 7 media: dvb_frontend: fix locking issues at dvb_frontend_get_event() nfsd: restrict rd_maxcount to svc_max_payload in nfsd_encode_readdir NFSv4: Fix possible 1-byte stack overflow in nfs_idmap_read_and_verify_message video: uvesafb: Fix integer overflow in allocation Input: elan_i2c - add ELAN0618 (Lenovo v330 15IKB) ACPI ID xen: Remove unnecessary BUG_ON from __unbind_from_irq() udf: Detect incorrect directory size Input: elan_i2c_smbus - fix more potential stack buffer overflows Input: elantech - enable middle button of touchpads on ThinkPad P52 Input: elantech - fix V4 report decoding for module with middle key ALSA: hda/realtek - Add a quirk for FSC ESPRIMO U9210 Btrfs: fix unexpected cow in run_delalloc_nocow spi: Fix scatterlist elements size in spi_map_buf block: Fix transfer when chunk sectors exceeds max dm thin: handle running out of data space vs concurrent discard cdc_ncm: avoid padding beyond end of skb Bluetooth: Fix connection if directed advertising and privacy is used Linux 4.4.139 Change-Id: I93013bedf2ebe3e6a8718972d8854723609963cc Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * time: Make sure jiffies_to_msecs() preserves non-zero time periodsGeert Uytterhoeven2018-07-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit abcbcb80cd09cd40f2089d912764e315459b71f7 upstream. For the common cases where 1000 is a multiple of HZ, or HZ is a multiple of 1000, jiffies_to_msecs() never returns zero when passed a non-zero time period. However, if HZ > 1000 and not an integer multiple of 1000 (e.g. 1024 or 1200, as used on alpha and DECstation), jiffies_to_msecs() may return zero for small non-zero time periods. This may break code that relies on receiving back a non-zero value. jiffies_to_usecs() does not need such a fix: one jiffy can only be less than one µs if HZ > 1000000, and such large values of HZ are already rejected at build time, twice: - include/linux/jiffies.h does #error if HZ >= 12288, - kernel/time/time.c has BUILD_BUG_ON(HZ > USEC_PER_SEC). Broken since forever. Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Cc: John Stultz <john.stultz@linaro.org> Cc: Stephen Boyd <sboyd@kernel.org> Cc: linux-alpha@vger.kernel.org Cc: linux-mips@linux-mips.org Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20180622143357.7495-1-geert@linux-m68k.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge android-4.4.137 (a2e2217) into msm-4.4Srinivasarao P2018-06-27
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-a2e2217 Linux 4.4.137 net: metrics: add proper netlink validation net: phy: broadcom: Fix bcm_write_exp() rtnetlink: validate attributes in do_setlink() team: use netdev_features_t instead of u32 net/mlx4: Fix irq-unsafe spinlock usage qed: Fix mask for physical address in ILT entry packet: fix reserve calculation net: usb: cdc_mbim: add flag FLAG_SEND_ZLP net/packet: refine check for priv area size netdev-FAQ: clarify DaveM's position for stable backports isdn: eicon: fix a missing-check bug ipv4: remove warning in ip_recv_error ip6mr: only set ip6mr_table from setsockopt when ip6mr_new_table succeeds enic: set DMA mask to 47 bit dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect() bnx2x: use the right constant brcmfmac: Fix check for ISO3166 code drm: set FMODE_UNSIGNED_OFFSET for drm files xfs: fix incorrect log_flushed on fsync kconfig: Avoid format overflow warning from GCC 8.1 mmap: relax file size limit for regular files mmap: introduce sane default mmap limits tpm: self test failure should not cause suspend to fail tpm: do not suspend/resume if power stays on ANDROID: Update arm64 ranchu64_defconfig Linux 4.4.136 sparc64: Fix build warnings with gcc 7. mm: fix the NULL mapping case in __isolate_lru_page() fix io_destroy()/aio_complete() race Kbuild: change CC_OPTIMIZE_FOR_SIZE definition drm/i915: Disable LVDS on Radiant P845 hwtracing: stm: fix build error on some arches stm class: Use vmalloc for the master map scsi: scsi_transport_srp: Fix shost to rport translation MIPS: prctl: Disallow FRE without FR with PR_SET_FP_MODE requests MIPS: ptrace: Fix PTRACE_PEEKUSR requests for 64-bit FGRs iio:kfifo_buf: check for uint overflow dmaengine: usb-dmac: fix endless loop in usb_dmac_chan_terminate_all() i2c: rcar: revoke START request early i2c: rcar: check master irqs before slave irqs i2c: rcar: don't issue stop when HW does it automatically i2c: rcar: init new messages in irq i2c: rcar: refactor setup of a msg i2c: rcar: remove spinlock i2c: rcar: remove unused IOERROR state i2c: rcar: rework hw init i2c: rcar: make sure clocks are on when doing clock calculation tcp: avoid integer overflows in tcp_rcv_space_adjust() irda: fix overly long udelay() ASoC: Intel: sst: remove redundant variable dma_dev_name rtlwifi: rtl8192cu: Remove variable self-assignment in rf.c cfg80211: further limit wiphy names to 64 bytes selinux: KASAN: slab-out-of-bounds in xattr_getsecurity tracing: Fix crash when freeing instances with event triggers Input: elan_i2c_smbus - fix corrupted stack Revert "ima: limit file hash setting by user to fix and log modes" xfs: detect agfl count corruption and reset agfl sh: New gcc support USB: serial: cp210x: use tcflag_t to fix incompatible pointer type powerpc/64s: Clear PCR on boot arm64: lse: Add early clobbers to some input/output asm operands FROMLIST: f2fs: run fstrim asynchronously if runtime discard is on goldfish: pipe: ANDROID: address must be written as __pa(x), not x goldfish: pipe: ANDROID: add missing check for memory allocated goldfish: pipe: ANDROID: remove redundant blank lines Update arch/x86/configs/x86_64_ranchu_defconfig ANDROID: x86_64_cuttlefish_defconfig: Enable F2FS ANDROID: Update x86_64_cuttlefish_defconfig FROMLIST: f2fs: early updates queued for v4.18-rc1 Change-Id: I314254168cd5ad06a7c6bca2fa68c8a6ae6c257d Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | Merge 4.4.136 into android-4.4Greg Kroah-Hartman2018-06-06
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.136 arm64: lse: Add early clobbers to some input/output asm operands powerpc/64s: Clear PCR on boot USB: serial: cp210x: use tcflag_t to fix incompatible pointer type sh: New gcc support xfs: detect agfl count corruption and reset agfl Revert "ima: limit file hash setting by user to fix and log modes" Input: elan_i2c_smbus - fix corrupted stack tracing: Fix crash when freeing instances with event triggers selinux: KASAN: slab-out-of-bounds in xattr_getsecurity cfg80211: further limit wiphy names to 64 bytes rtlwifi: rtl8192cu: Remove variable self-assignment in rf.c ASoC: Intel: sst: remove redundant variable dma_dev_name irda: fix overly long udelay() tcp: avoid integer overflows in tcp_rcv_space_adjust() i2c: rcar: make sure clocks are on when doing clock calculation i2c: rcar: rework hw init i2c: rcar: remove unused IOERROR state i2c: rcar: remove spinlock i2c: rcar: refactor setup of a msg i2c: rcar: init new messages in irq i2c: rcar: don't issue stop when HW does it automatically i2c: rcar: check master irqs before slave irqs i2c: rcar: revoke START request early dmaengine: usb-dmac: fix endless loop in usb_dmac_chan_terminate_all() iio:kfifo_buf: check for uint overflow MIPS: ptrace: Fix PTRACE_PEEKUSR requests for 64-bit FGRs MIPS: prctl: Disallow FRE without FR with PR_SET_FP_MODE requests scsi: scsi_transport_srp: Fix shost to rport translation stm class: Use vmalloc for the master map hwtracing: stm: fix build error on some arches drm/i915: Disable LVDS on Radiant P845 Kbuild: change CC_OPTIMIZE_FOR_SIZE definition fix io_destroy()/aio_complete() race mm: fix the NULL mapping case in __isolate_lru_page() sparc64: Fix build warnings with gcc 7. Linux 4.4.136 Change-Id: I3457f995cf22c65952271ecd517a46144ac4dc79 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * tracing: Fix crash when freeing instances with event triggersSteven Rostedt (VMware)2018-06-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 86b389ff22bd6ad8fd3cb98e41cd271886c6d023 upstream. If a instance has an event trigger enabled when it is freed, it could cause an access of free memory. Here's the case that crashes: # cd /sys/kernel/tracing # mkdir instances/foo # echo snapshot > instances/foo/events/initcall/initcall_start/trigger # rmdir instances/foo Would produce: general protection fault: 0000 [#1] PREEMPT SMP PTI Modules linked in: tun bridge ... CPU: 5 PID: 6203 Comm: rmdir Tainted: G W 4.17.0-rc4-test+ #933 Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01 v03.03 07/14/2016 RIP: 0010:clear_event_triggers+0x3b/0x70 RSP: 0018:ffffc90003783de0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 6b6b6b6b6b6b6b2b RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8800c7130ba0 RBP: ffffc90003783e00 R08: ffff8801131993f8 R09: 0000000100230016 R10: ffffc90003783d80 R11: 0000000000000000 R12: ffff8800c7130ba0 R13: ffff8800c7130bd8 R14: ffff8800cc093768 R15: 00000000ffffff9c FS: 00007f6f4aa86700(0000) GS:ffff88011eb40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6f4a5aed60 CR3: 00000000cd552001 CR4: 00000000001606e0 Call Trace: event_trace_del_tracer+0x2a/0xc5 instance_rmdir+0x15c/0x200 tracefs_syscall_rmdir+0x52/0x90 vfs_rmdir+0xdb/0x160 do_rmdir+0x16d/0x1c0 __x64_sys_rmdir+0x17/0x20 do_syscall_64+0x55/0x1a0 entry_SYSCALL_64_after_hwframe+0x49/0xbe This was due to the call the clears out the triggers when an instance is being deleted not removing the trigger from the link list. Cc: stable@vger.kernel.org Fixes: 85f2b08268c01 ("tracing: Add basic event trigger framework") Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge android-4.4.135 (c9d74f2) into msm-4.4Srinivasarao P2018-06-27
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-c9d74f2 Linux 4.4.135 Revert "vti4: Don't override MTU passed on link creation via IFLA_MTU" Revert "vti4: Don't override MTU passed on link creation via IFLA_MTU" Linux 4.4.134 s390/ftrace: use expoline for indirect branches kdb: make "mdr" command repeat Bluetooth: btusb: Add device ID for RTL8822BE ASoC: samsung: i2s: Ensure the RCLK rate is properly determined regulator: of: Add a missing 'of_node_put()' in an error handling path of 'of_regulator_match()' scsi: lpfc: Fix frequency of Release WQE CQEs scsi: lpfc: Fix soft lockup in lpfc worker thread during LIP testing scsi: lpfc: Fix issue_lip if link is disabled netlabel: If PF_INET6, check sk_buff ip header version selftests/net: fixes psock_fanout eBPF test case perf report: Fix memory corruption in --branch-history mode --branch-history perf tests: Use arch__compare_symbol_names to compare symbols x86/apic: Set up through-local-APIC mode on the boot CPU if 'noapic' specified drm/rockchip: Respect page offset for PRIME mmap calls MIPS: Octeon: Fix logging messages with spurious periods after newlines audit: return on memory error to avoid null pointer dereference crypto: sunxi-ss - Add MODULE_ALIAS to sun4i-ss clk: samsung: exynos3250: Fix PLL rates clk: samsung: exynos5250: Fix PLL rates clk: samsung: exynos5433: Fix PLL rates clk: samsung: exynos5260: Fix PLL rates clk: samsung: s3c2410: Fix PLL rates media: cx25821: prevent out-of-bounds read on array card udf: Provide saner default for invalid uid / gid PCI: Add function 1 DMA alias quirk for Marvell 88SE9220 serial: arc_uart: Fix out-of-bounds access through DT alias serial: fsl_lpuart: Fix out-of-bounds access through DT alias serial: imx: Fix out-of-bounds access through serial port index serial: mxs-auart: Fix out-of-bounds access through serial port index serial: samsung: Fix out-of-bounds access through serial port index serial: xuartps: Fix out-of-bounds access through DT alias rtc: tx4939: avoid unintended sign extension on a 24 bit shift staging: rtl8192u: return -ENOMEM on failed allocation of priv->oldaddr hwrng: stm32 - add reset during probe enic: enable rq before updating rq descriptors clk: rockchip: Prevent calculating mmc phase if clock rate is zero media: em28xx: USB bulk packet size fix dmaengine: pl330: fix a race condition in case of threaded irqs media: s3c-camif: fix out-of-bounds array access media: cx23885: Set subdev host data to clk_freq pointer media: cx23885: Override 888 ImpactVCBe crystal frequency ALSA: vmaster: Propagate slave error x86/devicetree: Fix device IRQ settings in DT x86/devicetree: Initialize device tree before using it usb: gadget: composite: fix incorrect handling of OS desc requests usb: gadget: udc: change comparison to bitshift when dealing with a mask gfs2: Fix fallocate chunk size cdrom: do not call check_disk_change() inside cdrom_open() hwmon: (pmbus/adm1275) Accept negative page register values hwmon: (pmbus/max8688) Accept negative page register values perf/core: Fix perf_output_read_group() ASoC: topology: create TLV data for dapm widgets powerpc: Add missing prototype for arch_irq_work_raise() usb: gadget: ffs: Execute copy_to_user() with USER_DS set usb: gadget: ffs: Let setup() return USB_GADGET_DELAYED_STATUS usb: dwc2: Fix interval type issue ipmi_ssif: Fix kernel panic at msg_done_handler PCI: Restore config space on runtime resume despite being unbound MIPS: ath79: Fix AR724X_PLL_REG_PCIE_CONFIG offset xhci: zero usb device slot_id member when disabling and freeing a xhci slot KVM: lapic: stop advertising DIRECTED_EOI when in-kernel IOAPIC is in use i2c: mv64xxx: Apply errata delay only in standard mode ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c ACPICA: Events: add a return on failure from acpi_hw_register_read bcache: quit dc->writeback_thread when BCACHE_DEV_DETACHING is set zorro: Set up z->dev.dma_mask for the DMA API clk: Don't show the incorrect clock phase cpufreq: cppc_cpufreq: Fix cppc_cpufreq_init() failure path usb: dwc3: Update DWC_usb31 GTXFIFOSIZ reg fields arm: dts: socfpga: fix GIC PPI warning virtio-net: Fix operstate for virtio when no VIRTIO_NET_F_STATUS ima: Fallback to the builtin hash algorithm ima: Fix Kconfig to select TPM 2.0 CRB interface ath10k: Fix kernel panic while using worker (ath10k_sta_rc_update_wk) net/mlx5: Protect from command bit overflow selftests: Print the test we're running to /dev/kmsg tools/thermal: tmon: fix for segfault powerpc/perf: Fix kernel address leak via sampling registers powerpc/perf: Prevent kernel address leak to userspace via BHRB buffer rtc: hctosys: Ensure system time doesn't overflow time_t hwmon: (nct6775) Fix writing pwmX_mode parisc/pci: Switch LBA PCI bus from Hard Fail to Soft Fail mode m68k: set dma and coherent masks for platform FEC ethernets powerpc/mpic: Check if cpu_possible() in mpic_physmask() ACPI: acpi_pad: Fix memory leak in power saving threads xen/acpi: off by one in read_acpi_id() btrfs: fix lockdep splat in btrfs_alloc_subvolume_writers Btrfs: fix copy_items() return value when logging an inode btrfs: tests/qgroup: Fix wrong tree backref level Bluetooth: btusb: Add USB ID 7392:a611 for Edimax EW-7611ULB net: bgmac: Fix endian access in bgmac_dma_tx_ring_free() rtc: snvs: Fix usage of snvs_rtc_enable sparc64: Make atomic_xchg() an inline function rather than a macro. fscache: Fix hanging wait on page discarded by writeback KVM: VMX: raise internal error for exception during invalid protected mode state sched/rt: Fix rq->clock_update_flags < RQCF_ACT_SKIP warning ocfs2/dlm: don't handle migrate lockres if already in shutdown btrfs: Fix possible softlock on single core machines Btrfs: fix NULL pointer dereference in log_dir_items Btrfs: bail out on error during replay_dir_deletes mm: fix races between address_space dereference and free in page_evicatable mm/ksm: fix interaction with THP dp83640: Ensure against premature access to PHY registers after reset scsi: aacraid: Insure command thread is not recursively stopped cpufreq: CPPC: Initialize shared perf capabilities of CPUs Force log to disk before reading the AGF during a fstrim sr: get/drop reference to device in revalidate and check_events swap: divide-by-zero when zero length swap file on ssd fs/proc/proc_sysctl.c: fix potential page fault while unregistering sysctl table x86/pgtable: Don't set huge PUD/PMD on non-leaf entries sh: fix debug trap failure to process signals before return to user net: mvneta: fix enable of all initialized RXQs net: Fix untag for vlan packets without ethernet header mm/kmemleak.c: wait for scan completion before disabling free llc: properly handle dev_queue_xmit() return value net-usb: add qmi_wwan if on lte modem wistron neweb d18q1 net/usb/qmi_wwan.c: Add USB id for lt4120 modem net: qmi_wwan: add BroadMobi BM806U 2020:2033 ARM: 8748/1: mm: Define vdso_start, vdso_end as array batman-adv: fix packet loss for broadcasted DHCP packets to a server batman-adv: fix multicast-via-unicast transmission with AP isolation selftests: ftrace: Add a testcase for probepoint selftests: ftrace: Add a testcase for string type with kprobe_event selftests: ftrace: Add probe event argument syntax testcase mm/mempolicy.c: avoid use uninitialized preferred_node RDMA/ucma: Correct option size check using optlen perf/cgroup: Fix child event counting bug vti4: Don't override MTU passed on link creation via IFLA_MTU vti4: Don't count header length twice on tunnel setup batman-adv: fix header size check in batadv_dbg_arp() net: Fix vlan untag for bridge and vlan_dev with reorder_hdr off sunvnet: does not support GSO for sctp ipv4: lock mtu in fnhe when received PMTU < net.ipv4.route.min_pmtu workqueue: use put_device() instead of kfree() bnxt_en: Check valid VNIC ID in bnxt_hwrm_vnic_set_tpa(). netfilter: ebtables: fix erroneous reject of last rule USB: OHCI: Fix NULL dereference in HCDs using HCD_LOCAL_MEM xen: xenbus: use put_device() instead of kfree() fbdev: Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in sbusfb_ioctl_helper(). scsi: sd: Keep disk read-only when re-reading partition scsi: mpt3sas: Do not mark fw_event workqueue as WQ_MEM_RECLAIM usb: musb: call pm_runtime_{get,put}_sync before reading vbus registers e1000e: allocate ring descriptors with dma_zalloc_coherent e1000e: Fix check_for_link return value with autoneg off watchdog: f71808e_wdt: Fix magic close handling KVM: PPC: Book3S HV: Fix VRMA initialization with 2MB or 1GB memory backing selftests/powerpc: Skip the subpage_prot tests if the syscall is unavailable Btrfs: send, fix issuing write op when processing hole in no data mode xen/pirq: fix error path cleanup when binding MSIs net/tcp/illinois: replace broken algorithm reference link gianfar: Fix Rx byte accounting for ndev stats sit: fix IFLA_MTU ignored on NEWLINK bcache: fix kcrashes with fio in RAID5 backend dev dmaengine: rcar-dmac: fix max_chunk_size for R-Car Gen3 virtio-gpu: fix ioctl and expose the fixed status to userspace. r8152: fix tx packets accounting clocksource/drivers/fsl_ftm_timer: Fix error return checking nvme-pci: Fix nvme queue cleanup if IRQ setup fails netfilter: ebtables: convert BUG_ONs to WARN_ONs batman-adv: invalidate checksum on fragment reassembly batman-adv: fix packet checksum in receive path md/raid1: fix NULL pointer dereference media: dmxdev: fix error code for invalid ioctls x86/topology: Update the 'cpu cores' field in /proc/cpuinfo correctly across CPU hotplug operations locking/xchg/alpha: Fix xchg() and cmpxchg() memory ordering bugs regulatory: add NUL to request alpha2 smsc75xx: fix smsc75xx_set_features() ARM: OMAP: Fix dmtimer init for omap1 s390/cio: clear timer when terminating driver I/O s390/cio: fix return code after missing interrupt powerpc/bpf/jit: Fix 32-bit JIT for seccomp_data access kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZE md: raid5: avoid string overflow warning locking/xchg/alpha: Add unconditional memory barrier to cmpxchg() usb: musb: fix enumeration after resume drm/exynos: fix comparison to bitshift when dealing with a mask md raid10: fix NULL deference in handle_write_completed() mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple of 4 NFC: llcp: Limit size of SDP URI ARM: OMAP1: clock: Fix debugfs_create_*() usage ARM: OMAP3: Fix prm wake interrupt for resume ARM: OMAP2+: timer: fix a kmemleak caused in omap_get_timer_dt scsi: qla4xxx: skip error recovery in case of register disconnect. scsi: aacraid: fix shutdown crash when init fails scsi: storvsc: Increase cmd_per_lun for higher speed devices selftests: memfd: add config fragment for fuse usb: dwc2: Fix dwc2_hsotg_core_init_disconnected() usb: gadget: fsl_udc_core: fix ep valid checks usb: gadget: f_uac2: fix bFirstInterface in composite gadget ARC: Fix malformed ARC_EMUL_UNALIGNED default scsi: qla2xxx: Avoid triggering undefined behavior in qla2x00_mbx_completion() scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo() scsi: sym53c8xx_2: iterator underflow in sym_getsync() scsi: bnx2fc: Fix check in SCSI completion handler for timed out request scsi: ufs: Enable quirk to ignore sending WRITE_SAME command irqchip/gic-v3: Change pr_debug message to pr_devel locking/qspinlock: Ensure node->count is updated before initialising node tools/libbpf: handle issues with bpf ELF objects containing .eh_frames bcache: return attach error when no cache set exist bcache: fix for data collapse after re-attaching an attached device bcache: fix for allocator and register thread race bcache: properly set task state in bch_writeback_thread() cifs: silence compiler warnings showing up with gcc-8.0.0 proc: fix /proc/*/map_files lookup arm64: spinlock: Fix theoretical trylock() A-B-A with LSE atomics RDS: IB: Fix null pointer issue xen/grant-table: Use put_page instead of free_page xen-netfront: Fix race between device setup and open MIPS: TXx9: use IS_BUILTIN() for CONFIG_LEDS_CLASS bpf: fix selftests/bpf test_kmod.sh failure when CONFIG_BPF_JIT_ALWAYS_ON=y ACPI: processor_perflib: Do not send _PPC change notification if not ready firmware: dmi_scan: Fix handling of empty DMI strings x86/power: Fix swsusp_arch_resume prototype IB/ipoib: Fix for potential no-carrier state mm: pin address_space before dereferencing it while isolating an LRU page asm-generic: provide generic_pmdp_establish() mm/mempolicy: add nodes_empty check in SYSC_migrate_pages mm/mempolicy: fix the check of nodemask from user ocfs2: return error when we attempt to access a dirty bh in jbd2 ocfs2/acl: use 'ip_xattr_sem' to protect getting extended attribute ocfs2: return -EROFS to mount.ocfs2 if inode block is invalid ntb_transport: Fix bug with max_mw_size parameter RDMA/mlx5: Avoid memory leak in case of XRCD dealloc failure powerpc/numa: Ensure nodes initialized for hotplug powerpc/numa: Use ibm,max-associativity-domains to discover possible nodes jffs2: Fix use-after-free bug in jffs2_iget()'s error handling path HID: roccat: prevent an out of bounds read in kovaplus_profile_activated() scsi: fas216: fix sense buffer initialization Btrfs: fix scrub to repair raid6 corruption btrfs: Fix out of bounds access in btrfs_search_slot Btrfs: set plug for fsync ipmi/powernv: Fix error return code in ipmi_powernv_probe() mac80211_hwsim: fix possible memory leak in hwsim_new_radio_nl() kconfig: Fix expr_free() E_NOT leak kconfig: Fix automatic menu creation mem leak kconfig: Don't leak main menus during parsing watchdog: sp5100_tco: Fix watchdog disable bit nfs: Do not convert nfs_idmap_cache_timeout to jiffies dm thin: fix documentation relative to low water mark threshold tools lib traceevent: Fix get_field_str() for dynamic strings perf callchain: Fix attr.sample_max_stack setting tools lib traceevent: Simplify pointer print logic and fix %pF PCI: Add function 1 DMA alias quirk for Marvell 9128 tracing/hrtimer: Fix tracing bugs by taking all clock bases and modes into account kvm: x86: fix KVM_XEN_HVM_CONFIG ioctl ASoC: au1x: Fix timeout tests in au1xac97c_ac97_read() ALSA: hda - Use IS_REACHABLE() for dependency on input NFSv4: always set NFS_LOCK_LOST when a lock is lost. firewire-ohci: work around oversized DMA reads on JMicron controllers do d_instantiate/unlock_new_inode combinations safely xfs: remove racy hasattr check from attr ops kernel/signal.c: avoid undefined behaviour in kill_something_info kernel/sys.c: fix potential Spectre v1 issue kasan: fix memory hotplug during boot ipc/shm: fix shmat() nil address after round-down when remapping Revert "ipc/shm: Fix shmat mmap nil-page protection" xen-swiotlb: fix the check condition for xen_swiotlb_free_coherent libata: blacklist Micron 500IT SSD with MU01 firmware libata: Blacklist some Sandisk SSDs for NCQ mmc: sdhci-iproc: fix 32bit writes for TRANSFER_MODE register ALSA: timer: Fix pause event notification aio: fix io_destroy(2) vs. lookup_ioctx() race affs_lookup(): close a race with affs_remove_link() KVM: Fix spelling mistake: "cop_unsuable" -> "cop_unusable" MIPS: Fix ptrace(2) PTRACE_PEEKUSR and PTRACE_POKEUSR accesses to o32 FGRs MIPS: ptrace: Expose FIR register through FP regset UPSTREAM: sched/fair: Consider RT/IRQ pressure in capacity_spare_wake Conflicts: drivers/media/dvb-core/dmxdev.c drivers/scsi/sd.c drivers/scsi/ufs/ufshcd.c drivers/usb/gadget/function/f_fs.c fs/ecryptfs/inode.c Change-Id: I15751ed8c82ec65ba7eedcb0d385b9f803c333f7 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | Merge 4.4.134 into android-4.4Greg Kroah-Hartman2018-05-30
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.134 MIPS: ptrace: Expose FIR register through FP regset MIPS: Fix ptrace(2) PTRACE_PEEKUSR and PTRACE_POKEUSR accesses to o32 FGRs KVM: Fix spelling mistake: "cop_unsuable" -> "cop_unusable" affs_lookup(): close a race with affs_remove_link() aio: fix io_destroy(2) vs. lookup_ioctx() race ALSA: timer: Fix pause event notification mmc: sdhci-iproc: fix 32bit writes for TRANSFER_MODE register libata: Blacklist some Sandisk SSDs for NCQ libata: blacklist Micron 500IT SSD with MU01 firmware xen-swiotlb: fix the check condition for xen_swiotlb_free_coherent Revert "ipc/shm: Fix shmat mmap nil-page protection" ipc/shm: fix shmat() nil address after round-down when remapping kasan: fix memory hotplug during boot kernel/sys.c: fix potential Spectre v1 issue kernel/signal.c: avoid undefined behaviour in kill_something_info xfs: remove racy hasattr check from attr ops do d_instantiate/unlock_new_inode combinations safely firewire-ohci: work around oversized DMA reads on JMicron controllers NFSv4: always set NFS_LOCK_LOST when a lock is lost. ALSA: hda - Use IS_REACHABLE() for dependency on input ASoC: au1x: Fix timeout tests in au1xac97c_ac97_read() kvm: x86: fix KVM_XEN_HVM_CONFIG ioctl tracing/hrtimer: Fix tracing bugs by taking all clock bases and modes into account PCI: Add function 1 DMA alias quirk for Marvell 9128 tools lib traceevent: Simplify pointer print logic and fix %pF perf callchain: Fix attr.sample_max_stack setting tools lib traceevent: Fix get_field_str() for dynamic strings dm thin: fix documentation relative to low water mark threshold nfs: Do not convert nfs_idmap_cache_timeout to jiffies watchdog: sp5100_tco: Fix watchdog disable bit kconfig: Don't leak main menus during parsing kconfig: Fix automatic menu creation mem leak kconfig: Fix expr_free() E_NOT leak mac80211_hwsim: fix possible memory leak in hwsim_new_radio_nl() ipmi/powernv: Fix error return code in ipmi_powernv_probe() Btrfs: set plug for fsync btrfs: Fix out of bounds access in btrfs_search_slot Btrfs: fix scrub to repair raid6 corruption scsi: fas216: fix sense buffer initialization HID: roccat: prevent an out of bounds read in kovaplus_profile_activated() jffs2: Fix use-after-free bug in jffs2_iget()'s error handling path powerpc/numa: Use ibm,max-associativity-domains to discover possible nodes powerpc/numa: Ensure nodes initialized for hotplug RDMA/mlx5: Avoid memory leak in case of XRCD dealloc failure ntb_transport: Fix bug with max_mw_size parameter ocfs2: return -EROFS to mount.ocfs2 if inode block is invalid ocfs2/acl: use 'ip_xattr_sem' to protect getting extended attribute ocfs2: return error when we attempt to access a dirty bh in jbd2 mm/mempolicy: fix the check of nodemask from user mm/mempolicy: add nodes_empty check in SYSC_migrate_pages asm-generic: provide generic_pmdp_establish() mm: pin address_space before dereferencing it while isolating an LRU page IB/ipoib: Fix for potential no-carrier state x86/power: Fix swsusp_arch_resume prototype firmware: dmi_scan: Fix handling of empty DMI strings ACPI: processor_perflib: Do not send _PPC change notification if not ready bpf: fix selftests/bpf test_kmod.sh failure when CONFIG_BPF_JIT_ALWAYS_ON=y MIPS: TXx9: use IS_BUILTIN() for CONFIG_LEDS_CLASS xen-netfront: Fix race between device setup and open xen/grant-table: Use put_page instead of free_page RDS: IB: Fix null pointer issue arm64: spinlock: Fix theoretical trylock() A-B-A with LSE atomics proc: fix /proc/*/map_files lookup cifs: silence compiler warnings showing up with gcc-8.0.0 bcache: properly set task state in bch_writeback_thread() bcache: fix for allocator and register thread race bcache: fix for data collapse after re-attaching an attached device bcache: return attach error when no cache set exist tools/libbpf: handle issues with bpf ELF objects containing .eh_frames locking/qspinlock: Ensure node->count is updated before initialising node irqchip/gic-v3: Change pr_debug message to pr_devel scsi: ufs: Enable quirk to ignore sending WRITE_SAME command scsi: bnx2fc: Fix check in SCSI completion handler for timed out request scsi: sym53c8xx_2: iterator underflow in sym_getsync() scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo() scsi: qla2xxx: Avoid triggering undefined behavior in qla2x00_mbx_completion() ARC: Fix malformed ARC_EMUL_UNALIGNED default usb: gadget: f_uac2: fix bFirstInterface in composite gadget usb: gadget: fsl_udc_core: fix ep valid checks usb: dwc2: Fix dwc2_hsotg_core_init_disconnected() selftests: memfd: add config fragment for fuse scsi: storvsc: Increase cmd_per_lun for higher speed devices scsi: aacraid: fix shutdown crash when init fails scsi: qla4xxx: skip error recovery in case of register disconnect. ARM: OMAP2+: timer: fix a kmemleak caused in omap_get_timer_dt ARM: OMAP3: Fix prm wake interrupt for resume ARM: OMAP1: clock: Fix debugfs_create_*() usage NFC: llcp: Limit size of SDP URI mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple of 4 md raid10: fix NULL deference in handle_write_completed() drm/exynos: fix comparison to bitshift when dealing with a mask usb: musb: fix enumeration after resume locking/xchg/alpha: Add unconditional memory barrier to cmpxchg() md: raid5: avoid string overflow warning kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZE powerpc/bpf/jit: Fix 32-bit JIT for seccomp_data access s390/cio: fix return code after missing interrupt s390/cio: clear timer when terminating driver I/O ARM: OMAP: Fix dmtimer init for omap1 smsc75xx: fix smsc75xx_set_features() regulatory: add NUL to request alpha2 locking/xchg/alpha: Fix xchg() and cmpxchg() memory ordering bugs x86/topology: Update the 'cpu cores' field in /proc/cpuinfo correctly across CPU hotplug operations media: dmxdev: fix error code for invalid ioctls md/raid1: fix NULL pointer dereference batman-adv: fix packet checksum in receive path batman-adv: invalidate checksum on fragment reassembly netfilter: ebtables: convert BUG_ONs to WARN_ONs nvme-pci: Fix nvme queue cleanup if IRQ setup fails clocksource/drivers/fsl_ftm_timer: Fix error return checking r8152: fix tx packets accounting virtio-gpu: fix ioctl and expose the fixed status to userspace. dmaengine: rcar-dmac: fix max_chunk_size for R-Car Gen3 bcache: fix kcrashes with fio in RAID5 backend dev sit: fix IFLA_MTU ignored on NEWLINK gianfar: Fix Rx byte accounting for ndev stats net/tcp/illinois: replace broken algorithm reference link xen/pirq: fix error path cleanup when binding MSIs Btrfs: send, fix issuing write op when processing hole in no data mode selftests/powerpc: Skip the subpage_prot tests if the syscall is unavailable KVM: PPC: Book3S HV: Fix VRMA initialization with 2MB or 1GB memory backing watchdog: f71808e_wdt: Fix magic close handling e1000e: Fix check_for_link return value with autoneg off e1000e: allocate ring descriptors with dma_zalloc_coherent usb: musb: call pm_runtime_{get,put}_sync before reading vbus registers scsi: mpt3sas: Do not mark fw_event workqueue as WQ_MEM_RECLAIM scsi: sd: Keep disk read-only when re-reading partition fbdev: Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in sbusfb_ioctl_helper(). xen: xenbus: use put_device() instead of kfree() USB: OHCI: Fix NULL dereference in HCDs using HCD_LOCAL_MEM netfilter: ebtables: fix erroneous reject of last rule bnxt_en: Check valid VNIC ID in bnxt_hwrm_vnic_set_tpa(). workqueue: use put_device() instead of kfree() ipv4: lock mtu in fnhe when received PMTU < net.ipv4.route.min_pmtu sunvnet: does not support GSO for sctp net: Fix vlan untag for bridge and vlan_dev with reorder_hdr off batman-adv: fix header size check in batadv_dbg_arp() vti4: Don't count header length twice on tunnel setup vti4: Don't override MTU passed on link creation via IFLA_MTU perf/cgroup: Fix child event counting bug RDMA/ucma: Correct option size check using optlen mm/mempolicy.c: avoid use uninitialized preferred_node selftests: ftrace: Add probe event argument syntax testcase selftests: ftrace: Add a testcase for string type with kprobe_event selftests: ftrace: Add a testcase for probepoint batman-adv: fix multicast-via-unicast transmission with AP isolation batman-adv: fix packet loss for broadcasted DHCP packets to a server ARM: 8748/1: mm: Define vdso_start, vdso_end as array net: qmi_wwan: add BroadMobi BM806U 2020:2033 net/usb/qmi_wwan.c: Add USB id for lt4120 modem net-usb: add qmi_wwan if on lte modem wistron neweb d18q1 llc: properly handle dev_queue_xmit() return value mm/kmemleak.c: wait for scan completion before disabling free net: Fix untag for vlan packets without ethernet header net: mvneta: fix enable of all initialized RXQs sh: fix debug trap failure to process signals before return to user x86/pgtable: Don't set huge PUD/PMD on non-leaf entries fs/proc/proc_sysctl.c: fix potential page fault while unregistering sysctl table swap: divide-by-zero when zero length swap file on ssd sr: get/drop reference to device in revalidate and check_events Force log to disk before reading the AGF during a fstrim cpufreq: CPPC: Initialize shared perf capabilities of CPUs scsi: aacraid: Insure command thread is not recursively stopped dp83640: Ensure against premature access to PHY registers after reset mm/ksm: fix interaction with THP mm: fix races between address_space dereference and free in page_evicatable Btrfs: bail out on error during replay_dir_deletes Btrfs: fix NULL pointer dereference in log_dir_items btrfs: Fix possible softlock on single core machines ocfs2/dlm: don't handle migrate lockres if already in shutdown sched/rt: Fix rq->clock_update_flags < RQCF_ACT_SKIP warning KVM: VMX: raise internal error for exception during invalid protected mode state fscache: Fix hanging wait on page discarded by writeback sparc64: Make atomic_xchg() an inline function rather than a macro. rtc: snvs: Fix usage of snvs_rtc_enable net: bgmac: Fix endian access in bgmac_dma_tx_ring_free() Bluetooth: btusb: Add USB ID 7392:a611 for Edimax EW-7611ULB btrfs: tests/qgroup: Fix wrong tree backref level Btrfs: fix copy_items() return value when logging an inode btrfs: fix lockdep splat in btrfs_alloc_subvolume_writers xen/acpi: off by one in read_acpi_id() ACPI: acpi_pad: Fix memory leak in power saving threads powerpc/mpic: Check if cpu_possible() in mpic_physmask() m68k: set dma and coherent masks for platform FEC ethernets parisc/pci: Switch LBA PCI bus from Hard Fail to Soft Fail mode hwmon: (nct6775) Fix writing pwmX_mode rtc: hctosys: Ensure system time doesn't overflow time_t powerpc/perf: Prevent kernel address leak to userspace via BHRB buffer powerpc/perf: Fix kernel address leak via sampling registers tools/thermal: tmon: fix for segfault selftests: Print the test we're running to /dev/kmsg net/mlx5: Protect from command bit overflow ath10k: Fix kernel panic while using worker (ath10k_sta_rc_update_wk) ima: Fix Kconfig to select TPM 2.0 CRB interface ima: Fallback to the builtin hash algorithm virtio-net: Fix operstate for virtio when no VIRTIO_NET_F_STATUS arm: dts: socfpga: fix GIC PPI warning usb: dwc3: Update DWC_usb31 GTXFIFOSIZ reg fields cpufreq: cppc_cpufreq: Fix cppc_cpufreq_init() failure path clk: Don't show the incorrect clock phase zorro: Set up z->dev.dma_mask for the DMA API bcache: quit dc->writeback_thread when BCACHE_DEV_DETACHING is set ACPICA: Events: add a return on failure from acpi_hw_register_read ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c i2c: mv64xxx: Apply errata delay only in standard mode KVM: lapic: stop advertising DIRECTED_EOI when in-kernel IOAPIC is in use xhci: zero usb device slot_id member when disabling and freeing a xhci slot MIPS: ath79: Fix AR724X_PLL_REG_PCIE_CONFIG offset PCI: Restore config space on runtime resume despite being unbound ipmi_ssif: Fix kernel panic at msg_done_handler usb: dwc2: Fix interval type issue usb: gadget: ffs: Let setup() return USB_GADGET_DELAYED_STATUS usb: gadget: ffs: Execute copy_to_user() with USER_DS set powerpc: Add missing prototype for arch_irq_work_raise() ASoC: topology: create TLV data for dapm widgets perf/core: Fix perf_output_read_group() hwmon: (pmbus/max8688) Accept negative page register values hwmon: (pmbus/adm1275) Accept negative page register values cdrom: do not call check_disk_change() inside cdrom_open() gfs2: Fix fallocate chunk size usb: gadget: udc: change comparison to bitshift when dealing with a mask usb: gadget: composite: fix incorrect handling of OS desc requests x86/devicetree: Initialize device tree before using it x86/devicetree: Fix device IRQ settings in DT ALSA: vmaster: Propagate slave error media: cx23885: Override 888 ImpactVCBe crystal frequency media: cx23885: Set subdev host data to clk_freq pointer media: s3c-camif: fix out-of-bounds array access dmaengine: pl330: fix a race condition in case of threaded irqs media: em28xx: USB bulk packet size fix clk: rockchip: Prevent calculating mmc phase if clock rate is zero enic: enable rq before updating rq descriptors hwrng: stm32 - add reset during probe staging: rtl8192u: return -ENOMEM on failed allocation of priv->oldaddr rtc: tx4939: avoid unintended sign extension on a 24 bit shift serial: xuartps: Fix out-of-bounds access through DT alias serial: samsung: Fix out-of-bounds access through serial port index serial: mxs-auart: Fix out-of-bounds access through serial port index serial: imx: Fix out-of-bounds access through serial port index serial: fsl_lpuart: Fix out-of-bounds access through DT alias serial: arc_uart: Fix out-of-bounds access through DT alias PCI: Add function 1 DMA alias quirk for Marvell 88SE9220 udf: Provide saner default for invalid uid / gid media: cx25821: prevent out-of-bounds read on array card clk: samsung: s3c2410: Fix PLL rates clk: samsung: exynos5260: Fix PLL rates clk: samsung: exynos5433: Fix PLL rates clk: samsung: exynos5250: Fix PLL rates clk: samsung: exynos3250: Fix PLL rates crypto: sunxi-ss - Add MODULE_ALIAS to sun4i-ss audit: return on memory error to avoid null pointer dereference MIPS: Octeon: Fix logging messages with spurious periods after newlines drm/rockchip: Respect page offset for PRIME mmap calls x86/apic: Set up through-local-APIC mode on the boot CPU if 'noapic' specified perf tests: Use arch__compare_symbol_names to compare symbols perf report: Fix memory corruption in --branch-history mode --branch-history selftests/net: fixes psock_fanout eBPF test case netlabel: If PF_INET6, check sk_buff ip header version scsi: lpfc: Fix issue_lip if link is disabled scsi: lpfc: Fix soft lockup in lpfc worker thread during LIP testing scsi: lpfc: Fix frequency of Release WQE CQEs regulator: of: Add a missing 'of_node_put()' in an error handling path of 'of_regulator_match()' ASoC: samsung: i2s: Ensure the RCLK rate is properly determined Bluetooth: btusb: Add device ID for RTL8822BE kdb: make "mdr" command repeat s390/ftrace: use expoline for indirect branches Linux 4.4.134 Change-Id: Iababaf9b89bc8d0437b95e1368d8b0a9126a178c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * kdb: make "mdr" command repeatRandy Dunlap2018-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 1e0ce03bf142454f38a5fc050bf4fd698d2d36d8 ] The "mdr" command should repeat (continue) when only Enter/Return is pressed, so make it do so. Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: Daniel Thompson <daniel.thompson@linaro.org> Cc: Jason Wessel <jason.wessel@windriver.com> Cc: kgdb-bugreport@lists.sourceforge.net Signed-off-by: Jason Wessel <jason.wessel@windriver.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * audit: return on memory error to avoid null pointer dereferenceRichard Guy Briggs2018-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 23138ead270045f1b3e912e667967b6094244999 ] If there is a memory allocation error when trying to change an audit kernel feature value, the ignored allocation error will trigger a NULL pointer dereference oops on subsequent use of that pointer. Return instead. Passes audit-testsuite. See: https://github.com/linux-audit/audit-kernel/issues/76 Signed-off-by: Richard Guy Briggs <rgb@redhat.com> [PM: not necessary (other funcs check for NULL), but a good practice] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * perf/core: Fix perf_output_read_group()Peter Zijlstra2018-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 9e5b127d6f33468143d90c8a45ca12410e4c3fa7 ] Mark reported his arm64 perf fuzzer runs sometimes splat like: armv8pmu_read_counter+0x1e8/0x2d8 armpmu_event_update+0x8c/0x188 armpmu_read+0xc/0x18 perf_output_read+0x550/0x11e8 perf_event_read_event+0x1d0/0x248 perf_event_exit_task+0x468/0xbb8 do_exit+0x690/0x1310 do_group_exit+0xd0/0x2b0 get_signal+0x2e8/0x17a8 do_signal+0x144/0x4f8 do_notify_resume+0x148/0x1e8 work_pending+0x8/0x14 which asserts that we only call pmu::read() on ACTIVE events. The above callchain does: perf_event_exit_task() perf_event_exit_task_context() task_ctx_sched_out() // INACTIVE perf_event_exit_event() perf_event_set_state(EXIT) // EXIT sync_child_event() perf_event_read_event() perf_output_read() perf_output_read_group() leader->pmu->read() Which results in doing a pmu::read() on an !ACTIVE event. I _think_ this is 'new' since we added attr.inherit_stat, which added the perf_event_read_event() to the exit path, without that perf_event_read_output() would only trigger from samples and for @event to trigger a sample, it's leader _must_ be ACTIVE too. Still, adding this check makes it consistent with the @sub case for the siblings. Reported-and-Tested-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Stephane Eranian <eranian@google.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Vince Weaver <vincent.weaver@maine.edu> Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * sched/rt: Fix rq->clock_update_flags < RQCF_ACT_SKIP warningDavidlohr Bueso2018-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit d29a20645d5e929aa7e8616f28e5d8e1c49263ec ] While running rt-tests' pi_stress program I got the following splat: rq->clock_update_flags < RQCF_ACT_SKIP WARNING: CPU: 27 PID: 0 at kernel/sched/sched.h:960 assert_clock_updated.isra.38.part.39+0x13/0x20 [...] <IRQ> enqueue_top_rt_rq+0xf4/0x150 ? cpufreq_dbs_governor_start+0x170/0x170 sched_rt_rq_enqueue+0x65/0x80 sched_rt_period_timer+0x156/0x360 ? sched_rt_rq_enqueue+0x80/0x80 __hrtimer_run_queues+0xfa/0x260 hrtimer_interrupt+0xcb/0x220 smp_apic_timer_interrupt+0x62/0x120 apic_timer_interrupt+0xf/0x20 </IRQ> [...] do_idle+0x183/0x1e0 cpu_startup_entry+0x5f/0x70 start_secondary+0x192/0x1d0 secondary_startup_64+0xa5/0xb0 We can get rid of it be the "traditional" means of adding an update_rq_clock() call after acquiring the rq->lock in do_sched_rt_period_timer(). The case for the RT task throttling (which this workload also hits) can be ignored in that the skip_update call is actually bogus and quite the contrary (the request bits are removed/reverted). By setting RQCF_UPDATED we really don't care if the skip is happening or not and will therefore make the assert_clock_updated() check happy. Signed-off-by: Davidlohr Bueso <dbueso@suse.de> Reviewed-by: Matt Fleming <matt@codeblueprint.co.uk> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Mike Galbraith <efault@gmx.de> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: dave@stgolabs.net Cc: linux-kernel@vger.kernel.org Cc: rostedt@goodmis.org Link: http://lkml.kernel.org/r/20180402164954.16255-1-dave@stgolabs.net Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * perf/cgroup: Fix child event counting bugSong Liu2018-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit c917e0f259908e75bd2a65877e25f9d90c22c848 ] When a perf_event is attached to parent cgroup, it should count events for all children cgroups: parent_group <---- perf_event \ - child_group <---- process(es) However, in our tests, we found this perf_event cannot report reliable results. Here is an example case: # create cgroups mkdir -p /sys/fs/cgroup/p/c # start perf for parent group perf stat -e instructions -G "p" # on another console, run test process in child cgroup: stressapptest -s 2 -M 1000 & echo $! > /sys/fs/cgroup/p/c/cgroup.procs # after the test process is done, stop perf in the first console shows <not counted> instructions p The instruction should not be "not counted" as the process runs in the child cgroup. We found this is because perf_event->cgrp and cpuctx->cgrp are not identical, thus perf_event->cgrp are not updated properly. This patch fixes this by updating perf_cgroup properly for ancestor cgroup(s). Reported-by: Ephraim Park <ephiepark@fb.com> Signed-off-by: Song Liu <songliubraving@fb.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: <jolsa@redhat.com> Cc: <kernel-team@fb.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Vince Weaver <vincent.weaver@maine.edu> Link: http://lkml.kernel.org/r/20180312165943.1057894-1-songliubraving@fb.com Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * workqueue: use put_device() instead of kfree()Arvind Yadav2018-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 537f4146c53c95aac977852b371bafb9c6755ee1 ] Never directly free @dev after calling device_register(), even if it returned an error! Always use put_device() to give up the reference initialized in this function instead. Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZEDavid Rientjes2018-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 88913bd8ea2a75d7e460a4bed5f75e1c32660d7e ] chan->n_subbufs is set by the user and relay_create_buf() does a kmalloc() of chan->n_subbufs * sizeof(size_t *). kmalloc_slab() will generate a warning when this fails if chan->subbufs * sizeof(size_t *) > KMALLOC_MAX_SIZE. Limit chan->n_subbufs to the maximum allowed kmalloc() size. Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1802061216100.122576@chino.kir.corp.google.com Fixes: f6302f1bcd75 ("relay: prevent integer overflow in relay_open()") Signed-off-by: David Rientjes <rientjes@google.com> Reviewed-by: Andrew Morton <akpm@linux-foundation.org> Cc: Jens Axboe <axboe@kernel.dk> Cc: Dave Jiang <dave.jiang@intel.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * locking/qspinlock: Ensure node->count is updated before initialising nodeWill Deacon2018-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 11dc13224c975efcec96647a4768a6f1bb7a19a8 ] When queuing on the qspinlock, the count field for the current CPU's head node is incremented. This needn't be atomic because locking in e.g. IRQ context is balanced and so an IRQ will return with node->count as it found it. However, the compiler could in theory reorder the initialisation of node[idx] before the increment of the head node->count, causing an IRQ to overwrite the initialised node and potentially corrupt the lock state. Avoid the potential for this harmful compiler reordering by placing a barrier() between the increment of the head node->count and the subsequent node initialisation. Signed-off-by: Will Deacon <will.deacon@arm.com> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Thomas Gleixner <tglx@linutronix.de> Link: http://lkml.kernel.org/r/1518528177-19169-3-git-send-email-will.deacon@arm.com Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * x86/power: Fix swsusp_arch_resume prototypeArnd Bergmann2018-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 328008a72d38b5bde6491e463405c34a81a65d3e ] The declaration for swsusp_arch_resume marks it as 'asmlinkage', but the definition in x86-32 does not, and it fails to include the header with the declaration. This leads to a warning when building with link-time-optimizations: kernel/power/power.h:108:23: error: type of 'swsusp_arch_resume' does not match original declaration [-Werror=lto-type-mismatch] extern asmlinkage int swsusp_arch_resume(void); ^ arch/x86/power/hibernate_32.c:148:0: note: 'swsusp_arch_resume' was previously declared here int swsusp_arch_resume(void) This moves the declaration into a globally visible header file and fixes up both x86 definitions to match it. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Len Brown <len.brown@intel.com> Cc: Andi Kleen <ak@linux.intel.com> Cc: Nicolas Pitre <nico@linaro.org> Cc: linux-pm@vger.kernel.org Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net> Cc: Pavel Machek <pavel@ucw.cz> Cc: Bart Van Assche <bart.vanassche@wdc.com> Link: https://lkml.kernel.org/r/20180202145634.200291-2-arnd@arndb.de Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * kernel/signal.c: avoid undefined behaviour in kill_something_infozhongjiang2018-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 4ea77014af0d6205b05503d1c7aac6eace11d473 upstream. When running kill(72057458746458112, 0) in userspace I hit the following issue. UBSAN: Undefined behaviour in kernel/signal.c:1462:11 negation of -2147483648 cannot be represented in type 'int': CPU: 226 PID: 9849 Comm: test Tainted: G B ---- ------- 3.10.0-327.53.58.70.x86_64_ubsan+ #116 Hardware name: Huawei Technologies Co., Ltd. RH8100 V3/BC61PBIA, BIOS BLHSV028 11/11/2014 Call Trace: dump_stack+0x19/0x1b ubsan_epilogue+0xd/0x50 __ubsan_handle_negate_overflow+0x109/0x14e SYSC_kill+0x43e/0x4d0 SyS_kill+0xe/0x10 system_call_fastpath+0x16/0x1b Add code to avoid the UBSAN detection. [akpm@linux-foundation.org: tweak comment] Link: http://lkml.kernel.org/r/1496670008-59084-1-git-send-email-zhongjiang@huawei.com Signed-off-by: zhongjiang <zhongjiang@huawei.com> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Michal Hocko <mhocko@kernel.org> Cc: Vlastimil Babka <vbabka@suse.cz> Cc: Xishi Qiu <qiuxishi@huawei.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * kernel/sys.c: fix potential Spectre v1 issueGustavo A. R. Silva2018-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 23d6aef74da86a33fa6bb75f79565e0a16ee97c2 upstream. `resource' can be controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: kernel/sys.c:1474 __do_compat_sys_old_getrlimit() warn: potential spectre issue 'get_current()->signal->rlim' (local cap) kernel/sys.c:1455 __do_sys_old_getrlimit() warn: potential spectre issue 'get_current()->signal->rlim' (local cap) Fix this by sanitizing *resource* before using it to index current->signal->rlim Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Link: http://lkml.kernel.org/r/20180515030038.GA11822@embeddedor.com Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Reviewed-by: Andrew Morton <akpm@linux-foundation.org> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Dan Williams <dan.j.williams@intel.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | UPSTREAM: sched/fair: Consider RT/IRQ pressure in capacity_spare_wakeJoel Fernandes2018-05-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | capacity_spare_wake in the slow path influences choice of idlest groups, as we search for groups with maximum spare capacity. In scenarios where RT pressure is high, a sub optimal group can be chosen and hurt performance of the task being woken up. Several tests with results are included below to show improvements with this change. 1) Hackbench on Pixel 2 Android device (4x4 ARM64 Octa core) ------------------------------------------------------------ Here we have RT activity running on big CPU cluster induced with rt-app, and running hackbench in parallel. The RT tasks are bound to 4 CPUs on the big cluster (cpu 4,5,6,7) and have 100ms periodicity with runtime=20ms sleep=80ms. Hackbench shows big benefit (30%) improvement when number of tasks is 8 and 32: Note: data is completion time in seconds (lower is better). Number of loops for 8 and 16 tasks is 50000, and for 32 tasks its 20000. +--------+-----+-------+-------------------+---------------------------+ | groups | fds | tasks | Without Patch | With Patch | +--------+-----+-------+---------+---------+-----------------+---------+ | | | | Mean | Stdev | Mean | Stdev | | | | +-------------------+-----------------+---------+ | 1 | 8 | 8 | 1.0534 | 0.13722 | 0.7293 (+30.7%) | 0.02653 | | 2 | 8 | 16 | 1.6219 | 0.16631 | 1.6391 (-1%) | 0.24001 | | 4 | 8 | 32 | 1.2538 | 0.13086 | 1.1080 (+11.6%) | 0.16201 | +--------+-----+-------+---------+---------+-----------------+---------+ 2) Rohit ran barrier.c test (details below) with following improvements: ------------------------------------------------------------------------ This was Rohit's original use case for a patch he posted at [1] however from his recent tests he showed my patch can replace his slow path changes [1] and there's no need to selectively scan/skip CPUs in find_idlest_group_cpu in the slow path to get the improvement he sees. barrier.c (open_mp code) as a micro-benchmark. It does a number of iterations and barrier sync at the end of each for loop. Here barrier,c is running in along with ping on CPU 0 and 1 as: 'ping -l 10000 -q -s 10 -f hostX' barrier.c can be found at: http://www.spinics.net/lists/kernel/msg2506955.html Following are the results for the iterations per second with this micro-benchmark (higher is better), on a 44 core, 2 socket 88 Threads Intel x86 machine: +--------+------------------+---------------------------+ |Threads | Without patch | With patch | | | | | +--------+--------+---------+-----------------+---------+ | | Mean | Std Dev | Mean | Std Dev | +--------+--------+---------+-----------------+---------+ |1 | 539.36 | 60.16 | 572.54 (+6.15%) | 40.95 | |2 | 481.01 | 19.32 | 530.64 (+10.32%)| 56.16 | |4 | 474.78 | 22.28 | 479.46 (+0.99%) | 18.89 | |8 | 450.06 | 24.91 | 447.82 (-0.50%) | 12.36 | |16 | 436.99 | 22.57 | 441.88 (+1.12%) | 7.39 | |32 | 388.28 | 55.59 | 429.4 (+10.59%)| 31.14 | |64 | 314.62 | 6.33 | 311.81 (-0.89%) | 11.99 | +--------+--------+---------+-----------------+---------+ 3) ping+hackbench test on bare-metal sever (Rohit ran this test) ---------------------------------------------------------------- Here hackbench is running in threaded mode along with, running ping on CPU 0 and 1 as: 'ping -l 10000 -q -s 10 -f hostX' This test is running on 2 socket, 20 core and 40 threads Intel x86 machine: Number of loops is 10000 and runtime is in seconds (Lower is better). +--------------+-----------------+--------------------------+ |Task Groups | Without patch | With patch | | +-------+---------+----------------+---------+ |(Groups of 40)| Mean | Std Dev | Mean | Std Dev | +--------------+-------+---------+----------------+---------+ |1 | 0.851 | 0.007 | 0.828 (+2.77%)| 0.032 | |2 | 1.083 | 0.203 | 1.087 (-0.37%)| 0.246 | |4 | 1.601 | 0.051 | 1.611 (-0.62%)| 0.055 | |8 | 2.837 | 0.060 | 2.827 (+0.35%)| 0.031 | |16 | 5.139 | 0.133 | 5.107 (+0.63%)| 0.085 | |25 | 7.569 | 0.142 | 7.503 (+0.88%)| 0.143 | +--------------+-------+---------+----------------+---------+ [1] https://patchwork.kernel.org/patch/9991635/ Matt Fleming also ran cyclictest and several different hackbench tests on his test machines to santiy-check that the patch doesn't harm any of his usecases. Change-Id: Ibcedbb65273545ff2f4d1962b4eaca14072b1bd2 Cc: Dietmar Eggemann <dietmar.eggemann@arm.com> Cc: Vincent Guittot <vincent.guittot@linaro.org> Cc: Morten Ramussen <morten.rasmussen@arm.com> Cc: Brendan Jackman <brendan.jackman@arm.com> Tested-by: Rohit Jain <rohit.k.jain@oracle.com> Tested-by: Matt Fleming <matt@codeblueprint.co.uk> Signed-off-by: Joel Fernandes <joelaf@google.com> Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org> Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
* | | power:hibernate: KPI marker for Hibernation SuccessAtul Raut2018-06-20
| | | | | | | | | | | | | | | | | | | | | | | | Add KPI Marker for hibernation failure and success needed for perf image. Change-Id: I90a4e503c75ccb1d0edb3d26f7f8d5f08dafe95e Signed-off-by: Atul Raut <araut@codeaurora.org>
* | | Merge "Merge android-4.4.133 (3f51ea2) into msm-4.4"Linux Build Service Account2018-06-02
|\ \ \
| * | | Merge android-4.4.133 (3f51ea2) into msm-4.4Srinivasarao P2018-05-31
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-3f51ea2 Linux 4.4.133 x86/kexec: Avoid double free_page() upon do_kexec_load() failure hfsplus: stop workqueue when fill_super() failed cfg80211: limit wiphy names to 128 bytes gpio: rcar: Add Runtime PM handling for interrupts time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting dmaengine: ensure dmaengine helpers check valid callback scsi: zfcp: fix infinite iteration on ERP ready list scsi: sg: allocate with __GFP_ZERO in sg_build_indirect() scsi: libsas: defer ata device eh commands to libata s390: use expoline thunks in the BPF JIT s390: extend expoline to BC instructions s390: move spectre sysfs attribute code s390/kernel: use expoline for indirect branches s390/lib: use expoline for indirect branches s390: move expoline assembler macros to a header s390: add assembler macros for CPU alternatives ext2: fix a block leak tcp: purge write queue in tcp_connect_init() sock_diag: fix use-after-free read in __sk_free packet: in packet_snd start writing at link layer allocation net: test tailroom before appending to linear skb btrfs: fix reading stale metadata blocks after degraded raid1 mounts btrfs: fix crash when trying to resume balance without the resume flag Btrfs: fix xattr loss after power failure ARM: 8772/1: kprobes: Prohibit kprobes on get_user functions ARM: 8770/1: kprobes: Prohibit probing on optimized_callback ARM: 8769/1: kprobes: Fix to use get_kprobe_ctlblk after irq-disabed tick/broadcast: Use for_each_cpu() specially on UP kernels ARM: 8771/1: kprobes: Prohibit kprobes on do_undefinstr efi: Avoid potential crashes, fix the 'struct efi_pci_io_protocol_32' definition for mixed mode s390: remove indirect branch from do_softirq_own_stack s390/qdio: don't release memory in qdio_setup_irq() s390/cpum_sf: ensure sample frequency of perf event attributes is non-zero s390/qdio: fix access to uninitialized qdio_q fields mm: don't allow deferred pages with NEED_PER_CPU_KM powerpc/powernv: Fix NVRAM sleep in invalid context when crashing procfs: fix pthread cross-thread naming if !PR_DUMPABLE proc read mm's {arg,env}_{start,end} with mmap semaphore taken. tracing/x86/xen: Remove zero data size trace events trace_xen_mmu_flush_tlb{_all} cpufreq: intel_pstate: Enable HWP by default signals: avoid unnecessary taking of sighand->siglock mm: filemap: avoid unnecessary calls to lock_page when waiting for IO to complete during a read mm: filemap: remove redundant code in do_read_cache_page proc: meminfo: estimate available memory more conservatively vmscan: do not force-scan file lru if its absolute size is small powerpc: Don't preempt_disable() in show_cpuinfo() cpuidle: coupled: remove unused define cpuidle_coupled_lock powerpc/powernv: remove FW_FEATURE_OPALv3 and just use FW_FEATURE_OPAL powerpc/powernv: Remove OPALv2 firmware define and references powerpc/powernv: panic() on OPAL < V3 spi: pxa2xx: Allow 64-bit DMA ALSA: control: fix a redundant-copy issue ALSA: hda: Add Lenovo C50 All in one to the power_save blacklist ALSA: usb: mixer: volume quirk for CM102-A+/102S+ usbip: usbip_host: fix bad unlock balance during stub_probe() usbip: usbip_host: fix NULL-ptr deref and use-after-free errors usbip: usbip_host: run rebind from exit when module is removed usbip: usbip_host: delete device from busid_table after rebind usbip: usbip_host: refine probe and disconnect debug msgs to be useful kernel/exit.c: avoid undefined behaviour when calling wait4() futex: futex_wake_op, fix sign_extend32 sign bits pipe: cap initial pipe capacity according to pipe-max-size limit l2tp: revert "l2tp: fix missing print session offset info" Revert "ARM: dts: imx6qdl-wandboard: Fix audio channel swap" lockd: lost rollback of set_grace_period() in lockd_down_net() xfrm: fix xfrm_do_migrate() with AEAD e.g(AES-GCM) futex: Remove duplicated code and fix undefined behaviour futex: Remove unnecessary warning from get_futex_key arm64: Add work around for Arm Cortex-A55 Erratum 1024718 arm64: introduce mov_q macro to move a constant into a 64-bit register audit: move calcs after alloc and check when logging set loginuid ALSA: timer: Call notifier in the same spinlock sctp: delay the authentication for the duplicated cookie-echo chunk sctp: fix the issue that the cookie-ack with auth can't get processed tcp: ignore Fast Open on repair mode bonding: do not allow rlb updates to invalid mac tg3: Fix vunmap() BUG_ON() triggered from tg3_free_consistent(). sctp: use the old asoc when making the cookie-ack chunk in dupcook_d sctp: handle two v4 addrs comparison in sctp_inet6_cmp_addr r8169: fix powering up RTL8168h qmi_wwan: do not steal interfaces from class drivers openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found net: support compat 64-bit time in {s,g}etsockopt net_sched: fq: take care of throttled flows before reuse net/mlx4_en: Verify coalescing parameters are in range net: ethernet: sun: niu set correct packet size in skb llc: better deal with too small mtu ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg dccp: fix tasklet usage bridge: check iface upper dev when setting master via ioctl 8139too: Use disable_irq_nosync() in rtl8139_poll_controller() BACKPORT, FROMLIST: fscrypt: add Speck128/256 support cgroup: Disable IRQs while holding css_set_lock Revert "cgroup: Disable IRQs while holding css_set_lock" cgroup: Disable IRQs while holding css_set_lock ANDROID: proc: fix undefined behavior in proc_uid_base_readdir x86: vdso: Fix leaky vdso linker with CC=clang. ANDROID: build: cuttlefish: Upgrade clang to newer version. ANDROID: build: cuttlefish: Upgrade clang to newer version. ANDROID: build: cuttlefish: Fix path to clang. UPSTREAM: dm bufio: avoid sleeping while holding the dm_bufio lock ANDROID: sdcardfs: Don't d_drop in d_revalidate Conflicts: arch/arm64/include/asm/cputype.h fs/ext4/crypto.c fs/ext4/ext4.h kernel/cgroup.c mm/vmscan.c Change-Id: Ic10c5722b6439af1cf423fd949c493f786764d7e Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| | * | Merge 4.4.133 into android-4.4Greg Kroah-Hartman2018-05-26
| | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.133 8139too: Use disable_irq_nosync() in rtl8139_poll_controller() bridge: check iface upper dev when setting master via ioctl dccp: fix tasklet usage ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg llc: better deal with too small mtu net: ethernet: sun: niu set correct packet size in skb net/mlx4_en: Verify coalescing parameters are in range net_sched: fq: take care of throttled flows before reuse net: support compat 64-bit time in {s,g}etsockopt openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found qmi_wwan: do not steal interfaces from class drivers r8169: fix powering up RTL8168h sctp: handle two v4 addrs comparison in sctp_inet6_cmp_addr sctp: use the old asoc when making the cookie-ack chunk in dupcook_d tg3: Fix vunmap() BUG_ON() triggered from tg3_free_consistent(). bonding: do not allow rlb updates to invalid mac tcp: ignore Fast Open on repair mode sctp: fix the issue that the cookie-ack with auth can't get processed sctp: delay the authentication for the duplicated cookie-echo chunk ALSA: timer: Call notifier in the same spinlock audit: move calcs after alloc and check when logging set loginuid arm64: introduce mov_q macro to move a constant into a 64-bit register arm64: Add work around for Arm Cortex-A55 Erratum 1024718 futex: Remove unnecessary warning from get_futex_key futex: Remove duplicated code and fix undefined behaviour xfrm: fix xfrm_do_migrate() with AEAD e.g(AES-GCM) lockd: lost rollback of set_grace_period() in lockd_down_net() Revert "ARM: dts: imx6qdl-wandboard: Fix audio channel swap" l2tp: revert "l2tp: fix missing print session offset info" pipe: cap initial pipe capacity according to pipe-max-size limit futex: futex_wake_op, fix sign_extend32 sign bits kernel/exit.c: avoid undefined behaviour when calling wait4() usbip: usbip_host: refine probe and disconnect debug msgs to be useful usbip: usbip_host: delete device from busid_table after rebind usbip: usbip_host: run rebind from exit when module is removed usbip: usbip_host: fix NULL-ptr deref and use-after-free errors usbip: usbip_host: fix bad unlock balance during stub_probe() ALSA: usb: mixer: volume quirk for CM102-A+/102S+ ALSA: hda: Add Lenovo C50 All in one to the power_save blacklist ALSA: control: fix a redundant-copy issue spi: pxa2xx: Allow 64-bit DMA powerpc/powernv: panic() on OPAL < V3 powerpc/powernv: Remove OPALv2 firmware define and references powerpc/powernv: remove FW_FEATURE_OPALv3 and just use FW_FEATURE_OPAL cpuidle: coupled: remove unused define cpuidle_coupled_lock powerpc: Don't preempt_disable() in show_cpuinfo() vmscan: do not force-scan file lru if its absolute size is small proc: meminfo: estimate available memory more conservatively mm: filemap: remove redundant code in do_read_cache_page mm: filemap: avoid unnecessary calls to lock_page when waiting for IO to complete during a read signals: avoid unnecessary taking of sighand->siglock cpufreq: intel_pstate: Enable HWP by default tracing/x86/xen: Remove zero data size trace events trace_xen_mmu_flush_tlb{_all} proc read mm's {arg,env}_{start,end} with mmap semaphore taken. procfs: fix pthread cross-thread naming if !PR_DUMPABLE powerpc/powernv: Fix NVRAM sleep in invalid context when crashing mm: don't allow deferred pages with NEED_PER_CPU_KM s390/qdio: fix access to uninitialized qdio_q fields s390/cpum_sf: ensure sample frequency of perf event attributes is non-zero s390/qdio: don't release memory in qdio_setup_irq() s390: remove indirect branch from do_softirq_own_stack efi: Avoid potential crashes, fix the 'struct efi_pci_io_protocol_32' definition for mixed mode ARM: 8771/1: kprobes: Prohibit kprobes on do_undefinstr tick/broadcast: Use for_each_cpu() specially on UP kernels ARM: 8769/1: kprobes: Fix to use get_kprobe_ctlblk after irq-disabed ARM: 8770/1: kprobes: Prohibit probing on optimized_callback ARM: 8772/1: kprobes: Prohibit kprobes on get_user functions Btrfs: fix xattr loss after power failure btrfs: fix crash when trying to resume balance without the resume flag btrfs: fix reading stale metadata blocks after degraded raid1 mounts net: test tailroom before appending to linear skb packet: in packet_snd start writing at link layer allocation sock_diag: fix use-after-free read in __sk_free tcp: purge write queue in tcp_connect_init() ext2: fix a block leak s390: add assembler macros for CPU alternatives s390: move expoline assembler macros to a header s390/lib: use expoline for indirect branches s390/kernel: use expoline for indirect branches s390: move spectre sysfs attribute code s390: extend expoline to BC instructions s390: use expoline thunks in the BPF JIT scsi: libsas: defer ata device eh commands to libata scsi: sg: allocate with __GFP_ZERO in sg_build_indirect() scsi: zfcp: fix infinite iteration on ERP ready list dmaengine: ensure dmaengine helpers check valid callback time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting gpio: rcar: Add Runtime PM handling for interrupts cfg80211: limit wiphy names to 128 bytes hfsplus: stop workqueue when fill_super() failed x86/kexec: Avoid double free_page() upon do_kexec_load() failure Linux 4.4.133 Change-Id: I0554b12889bc91add2a444da95f18d59c6fb9cdb Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | | * time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accountingJohn Stultz2018-05-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 3d88d56c5873f6eebe23e05c3da701960146b801 upstream. Due to how the MONOTONIC_RAW accumulation logic was handled, there is the potential for a 1ns discontinuity when we do accumulations. This small discontinuity has for the most part gone un-noticed, but since ARM64 enabled CLOCK_MONOTONIC_RAW in their vDSO clock_gettime implementation, we've seen failures with the inconsistency-check test in kselftest. This patch addresses the issue by using the same sub-ns accumulation handling that CLOCK_MONOTONIC uses, which avoids the issue for in-kernel users. Since the ARM64 vDSO implementation has its own clock_gettime calculation logic, this patch reduces the frequency of errors, but failures are still seen. The ARM64 vDSO will need to be updated to include the sub-nanosecond xtime_nsec values in its calculation for this issue to be completely fixed. Signed-off-by: John Stultz <john.stultz@linaro.org> Tested-by: Daniel Mentz <danielmentz@google.com> Cc: Prarit Bhargava <prarit@redhat.com> Cc: Kevin Brodsky <kevin.brodsky@arm.com> Cc: Richard Cochran <richardcochran@gmail.com> Cc: Stephen Boyd <stephen.boyd@linaro.org> Cc: Will Deacon <will.deacon@arm.com> Cc: "stable #4 . 8+" <stable@vger.kernel.org> Cc: Miroslav Lichvar <mlichvar@redhat.com> Link: http://lkml.kernel.org/r/1496965462-20003-3-git-send-email-john.stultz@linaro.org Signed-off-by: Thomas Gleixner <tglx@linutronix.de> [fabrizio: cherry-pick to 4.4. Kept cycle_t type for function logarithmic_accumulation local variable "interval". Dropped casting of "interval" variable] Signed-off-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com> Signed-off-by: Biju Das <biju.das@bp.renesas.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | | * tick/broadcast: Use for_each_cpu() specially on UP kernelsDexuan Cui2018-05-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 5596fe34495cf0f645f417eb928ef224df3e3cb4 upstream. for_each_cpu() unintuitively reports CPU0 as set independent of the actual cpumask content on UP kernels. This causes an unexpected PIT interrupt storm on a UP kernel running in an SMP virtual machine on Hyper-V, and as a result, the virtual machine can suffer from a strange random delay of 1~20 minutes during boot-up, and sometimes it can hang forever. Protect if by checking whether the cpumask is empty before entering the for_each_cpu() loop. [ tglx: Use !IS_ENABLED(CONFIG_SMP) instead of #ifdeffery ] Signed-off-by: Dexuan Cui <decui@microsoft.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Josh Poulson <jopoulso@microsoft.com> Cc: "Michael Kelley (EOSG)" <Michael.H.Kelley@microsoft.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: stable@vger.kernel.org Cc: Rakib Mullick <rakib.mullick@gmail.com> Cc: Jork Loeser <Jork.Loeser@microsoft.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: KY Srinivasan <kys@microsoft.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Alexey Dobriyan <adobriyan@gmail.com> Cc: Dmitry Vyukov <dvyukov@google.com> Link: https://lkml.kernel.org/r/KL1P15301MB000678289FE55BA365B3279ABF990@KL1P15301MB0006.APCP153.PROD.OUTLOOK.COM Link: https://lkml.kernel.org/r/KL1P15301MB0006FA63BC22BEB64902EAA0BF930@KL1P15301MB0006.APCP153.PROD.OUTLOOK.COM Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | | * signals: avoid unnecessary taking of sighand->siglockWaiman Long2018-05-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit c7be96af89d4b53211862d8599b2430e8900ed92 upstream. When running certain database workload on a high-end system with many CPUs, it was found that spinlock contention in the sigprocmask syscalls became a significant portion of the overall CPU cycles as shown below. 9.30% 9.30% 905387 dataserver /proc/kcore 0x7fff8163f4d2 [k] _raw_spin_lock_irq | ---_raw_spin_lock_irq | |--99.34%-- __set_current_blocked | sigprocmask | sys_rt_sigprocmask | system_call_fastpath | | | |--50.63%-- __swapcontext | | | | | |--99.91%-- upsleepgeneric | | | |--49.36%-- __setcontext | | ktskRun Looking further into the swapcontext function in glibc, it was found that the function always call sigprocmask() without checking if there are changes in the signal mask. A check was added to the __set_current_blocked() function to avoid taking the sighand->siglock spinlock if there is no change in the signal mask. This will prevent unneeded spinlock contention when many threads are trying to call sigprocmask(). With this patch applied, the spinlock contention in sigprocmask() was gone. Link: http://lkml.kernel.org/r/1474979209-11867-1-git-send-email-Waiman.Long@hpe.com Signed-off-by: Waiman Long <Waiman.Long@hpe.com> Acked-by: Oleg Nesterov <oleg@redhat.com> Cc: Ingo Molnar <mingo@kernel.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Stas Sergeev <stsp@list.ru> Cc: Scott J Norton <scott.norton@hpe.com> Cc: Douglas Hatch <doug.hatch@hpe.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Mel Gorman <mgorman@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | | * kernel/exit.c: avoid undefined behaviour when calling wait4()zhongjiang2018-05-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit dd83c161fbcc5d8be637ab159c0de015cbff5ba4 upstream. wait4(-2147483648, 0x20, 0, 0xdd0000) triggers: UBSAN: Undefined behaviour in kernel/exit.c:1651:9 The related calltrace is as follows: negation of -2147483648 cannot be represented in type 'int': CPU: 9 PID: 16482 Comm: zj Tainted: G B ---- ------- 3.10.0-327.53.58.71.x86_64+ #66 Hardware name: Huawei Technologies Co., Ltd. Tecal RH2285 /BC11BTSA , BIOS CTSAV036 04/27/2011 Call Trace: dump_stack+0x19/0x1b ubsan_epilogue+0xd/0x50 __ubsan_handle_negate_overflow+0x109/0x14e SyS_wait4+0x1cb/0x1e0 system_call_fastpath+0x16/0x1b Exclude the overflow to avoid the UBSAN warning. Link: http://lkml.kernel.org/r/1497264618-20212-1-git-send-email-zhongjiang@huawei.com Signed-off-by: zhongjiang <zhongjiang@huawei.com> Cc: Oleg Nesterov <oleg@redhat.com> Cc: David Rientjes <rientjes@google.com> Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Cc: Xishi Qiu <qiuxishi@huawei.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | | * futex: futex_wake_op, fix sign_extend32 sign bitsJiri Slaby2018-05-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit d70ef22892ed6c066e51e118b225923c9b74af34 upstream. sign_extend32 counts the sign bit parameter from 0, not from 1. So we have to use "11" for 12th bit, not "12". This mistake means we have not allowed negative op and cmp args since commit 30d6e0a4190d ("futex: Remove duplicated code and fix undefined behaviour") till now. Fixes: 30d6e0a4190d ("futex: Remove duplicated code and fix undefined behaviour") Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: Ingo Molnar <mingo@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Darren Hart <dvhart@infradead.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | | * futex: Remove duplicated code and fix undefined behaviourJiri Slaby2018-05-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 30d6e0a4190d37740e9447e4e4815f06992dd8c3 upstream. There is code duplicated over all architecture's headers for futex_atomic_op_inuser. Namely op decoding, access_ok check for uaddr, and comparison of the result. Remove this duplication and leave up to the arches only the needed assembly which is now in arch_futex_atomic_op_inuser. This effectively distributes the Will Deacon's arm64 fix for undefined behaviour reported by UBSAN to all architectures. The fix was done in commit 5f16a046f8e1 (arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage). Look there for an example dump. And as suggested by Thomas, check for negative oparg too, because it was also reported to cause undefined behaviour report. Note that s390 removed access_ok check in d12a29703 ("s390/uaccess: remove pointless access_ok() checks") as access_ok there returns true. We introduce it back to the helper for the sake of simplicity (it gets optimized away anyway). Signed-off-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Russell King <rmk+kernel@armlinux.org.uk> Acked-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc) Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com> [s390] Acked-by: Chris Metcalf <cmetcalf@mellanox.com> [for tile] Reviewed-by: Darren Hart (VMware) <dvhart@infradead.org> Reviewed-by: Will Deacon <will.deacon@arm.com> [core/arm64] Cc: linux-mips@linux-mips.org Cc: Rich Felker <dalias@libc.org> Cc: linux-ia64@vger.kernel.org Cc: linux-sh@vger.kernel.org Cc: peterz@infradead.org Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Max Filippov <jcmvbkbc@gmail.com> Cc: Paul Mackerras <paulus@samba.org> Cc: sparclinux@vger.kernel.org Cc: Jonas Bonn <jonas@southpole.se> Cc: linux-s390@vger.kernel.org Cc: linux-arch@vger.kernel.org Cc: Yoshinori Sato <ysato@users.sourceforge.jp> Cc: linux-hexagon@vger.kernel.org Cc: Helge Deller <deller@gmx.de> Cc: "James E.J. Bottomley" <jejb@parisc-linux.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Matt Turner <mattst88@gmail.com> Cc: linux-snps-arc@lists.infradead.org Cc: Fenghua Yu <fenghua.yu@intel.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: linux-xtensa@linux-xtensa.org Cc: Stefan Kristiansson <stefan.kristiansson@saunalahti.fi> Cc: openrisc@lists.librecores.org Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Cc: Stafford Horne <shorne@gmail.com> Cc: linux-arm-kernel@lists.infradead.org Cc: Richard Henderson <rth@twiddle.net> Cc: Chris Zankel <chris@zankel.net> Cc: Michal Simek <monstr@monstr.eu> Cc: Tony Luck <tony.luck@intel.com> Cc: linux-parisc@vger.kernel.org Cc: Vineet Gupta <vgupta@synopsys.com> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Richard Kuo <rkuo@codeaurora.org> Cc: linux-alpha@vger.kernel.org Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: linuxppc-dev@lists.ozlabs.org Cc: "David S. Miller" <davem@davemloft.net> Link: http://lkml.kernel.org/r/20170824073105.3901-1-jslaby@suse.cz Cc: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | | * futex: Remove unnecessary warning from get_futex_keyMel Gorman2018-05-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 48fb6f4db940e92cfb16cd878cddd59ea6120d06 upstream. Commit 65d8fc777f6d ("futex: Remove requirement for lock_page() in get_futex_key()") removed an unnecessary lock_page() with the side-effect that page->mapping needed to be treated very carefully. Two defensive warnings were added in case any assumption was missed and the first warning assumed a correct application would not alter a mapping backing a futex key. Since merging, it has not triggered for any unexpected case but Mark Rutland reported the following bug triggering due to the first warning. kernel BUG at kernel/futex.c:679! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 3695 Comm: syz-executor1 Not tainted 4.13.0-rc3-00020-g307fec773ba3 #3 Hardware name: linux,dummy-virt (DT) task: ffff80001e271780 task.stack: ffff000010908000 PC is at get_futex_key+0x6a4/0xcf0 kernel/futex.c:679 LR is at get_futex_key+0x6a4/0xcf0 kernel/futex.c:679 pc : [<ffff00000821ac14>] lr : [<ffff00000821ac14>] pstate: 80000145 The fact that it's a bug instead of a warning was due to an unrelated arm64 problem, but the warning itself triggered because the underlying mapping changed. This is an application issue but from a kernel perspective it's a recoverable situation and the warning is unnecessary so this patch removes the warning. The warning may potentially be triggered with the following test program from Mark although it may be necessary to adjust NR_FUTEX_THREADS to be a value smaller than the number of CPUs in the system. #include <linux/futex.h> #include <pthread.h> #include <stdio.h> #include <stdlib.h> #include <sys/mman.h> #include <sys/syscall.h> #include <sys/time.h> #include <unistd.h> #define NR_FUTEX_THREADS 16 pthread_t threads[NR_FUTEX_THREADS]; void *mem; #define MEM_PROT (PROT_READ | PROT_WRITE) #define MEM_SIZE 65536 static int futex_wrapper(int *uaddr, int op, int val, const struct timespec *timeout, int *uaddr2, int val3) { syscall(SYS_futex, uaddr, op, val, timeout, uaddr2, val3); } void *poll_futex(void *unused) { for (;;) { futex_wrapper(mem, FUTEX_CMP_REQUEUE_PI, 1, NULL, mem + 4, 1); } } int main(int argc, char *argv[]) { int i; mem = mmap(NULL, MEM_SIZE, MEM_PROT, MAP_SHARED | MAP_ANONYMOUS, -1, 0); printf("Mapping @ %p\n", mem); printf("Creating futex threads...\n"); for (i = 0; i < NR_FUTEX_THREADS; i++) pthread_create(&threads[i], NULL, poll_futex, NULL); printf("Flipping mapping...\n"); for (;;) { mmap(mem, MEM_SIZE, MEM_PROT, MAP_FIXED | MAP_SHARED | MAP_ANONYMOUS, -1, 0); } return 0; } Reported-and-tested-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Mel Gorman <mgorman@suse.de> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: stable@vger.kernel.org # 4.7+ Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | | * audit: move calcs after alloc and check when logging set loginuidRichard Guy Briggs2018-05-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 76a658c20efd541a62838d9ff68ce94170d7a549 upstream. Move the calculations of values after the allocation in case the allocation fails. This avoids wasting effort in the rare case that it fails, but more importantly saves us extra logic to release the tty ref. Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Cc: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * | cgroup: Disable IRQs while holding css_set_lockDaniel Bristot de Oliveira2018-05-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While testing the deadline scheduler + cgroup setup I hit this warning. [ 132.612935] ------------[ cut here ]------------ [ 132.612951] WARNING: CPU: 5 PID: 0 at kernel/softirq.c:150 __local_bh_enable_ip+0x6b/0x80 [ 132.612952] Modules linked in: (a ton of modules...) [ 132.612981] CPU: 5 PID: 0 Comm: swapper/5 Not tainted 4.7.0-rc2 #2 [ 132.612981] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.2-20150714_191134- 04/01/2014 [ 132.612982] 0000000000000086 45c8bb5effdd088b ffff88013fd43da0 ffffffff813d229e [ 132.612984] 0000000000000000 0000000000000000 ffff88013fd43de0 ffffffff810a652b [ 132.612985] 00000096811387b5 0000000000000200 ffff8800bab29d80 ffff880034c54c00 [ 132.612986] Call Trace: [ 132.612987] <IRQ> [<ffffffff813d229e>] dump_stack+0x63/0x85 [ 132.612994] [<ffffffff810a652b>] __warn+0xcb/0xf0 [ 132.612997] [<ffffffff810e76a0>] ? push_dl_task.part.32+0x170/0x170 [ 132.612999] [<ffffffff810a665d>] warn_slowpath_null+0x1d/0x20 [ 132.613000] [<ffffffff810aba5b>] __local_bh_enable_ip+0x6b/0x80 [ 132.613008] [<ffffffff817d6c8a>] _raw_write_unlock_bh+0x1a/0x20 [ 132.613010] [<ffffffff817d6c9e>] _raw_spin_unlock_bh+0xe/0x10 [ 132.613015] [<ffffffff811388ac>] put_css_set+0x5c/0x60 [ 132.613016] [<ffffffff8113dc7f>] cgroup_free+0x7f/0xa0 [ 132.613017] [<ffffffff810a3912>] __put_task_struct+0x42/0x140 [ 132.613018] [<ffffffff810e776a>] dl_task_timer+0xca/0x250 [ 132.613027] [<ffffffff810e76a0>] ? push_dl_task.part.32+0x170/0x170 [ 132.613030] [<ffffffff8111371e>] __hrtimer_run_queues+0xee/0x270 [ 132.613031] [<ffffffff81113ec8>] hrtimer_interrupt+0xa8/0x190 [ 132.613034] [<ffffffff81051a58>] local_apic_timer_interrupt+0x38/0x60 [ 132.613035] [<ffffffff817d9b0d>] smp_apic_timer_interrupt+0x3d/0x50 [ 132.613037] [<ffffffff817d7c5c>] apic_timer_interrupt+0x8c/0xa0 [ 132.613038] <EOI> [<ffffffff81063466>] ? native_safe_halt+0x6/0x10 [ 132.613043] [<ffffffff81037a4e>] default_idle+0x1e/0xd0 [ 132.613044] [<ffffffff810381cf>] arch_cpu_idle+0xf/0x20 [ 132.613046] [<ffffffff810e8fda>] default_idle_call+0x2a/0x40 [ 132.613047] [<ffffffff810e92d7>] cpu_startup_entry+0x2e7/0x340 [ 132.613048] [<ffffffff81050235>] start_secondary+0x155/0x190 [ 132.613049] ---[ end trace f91934d162ce9977 ]--- The warn is the spin_(lock|unlock)_bh(&css_set_lock) in the interrupt context. Converting the spin_lock_bh to spin_lock_irq(save) to avoid this problem - and other problems of sharing a spinlock with an interrupt. Change-Id: I5b5d5c79c3f380ac35f58596fc2cebaf6348eb67 Cc: Tejun Heo <tj@kernel.org> Cc: Li Zefan <lizefan@huawei.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Juri Lelli <juri.lelli@arm.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: cgroups@vger.kernel.org Cc: stable@vger.kernel.org # 4.5+ Cc: linux-kernel@vger.kernel.org Reviewed-by: Rik van Riel <riel@redhat.com> Reviewed-by: "Luis Claudio R. Goncalves" <lgoncalv@redhat.com> Signed-off-by: Daniel Bristot de Oliveira <bristot@redhat.com> Acked-by: Zefan Li <lizefan@huawei.com> Signed-off-by: Tejun Heo <tj@kernel.org>
| | * | Revert "cgroup: Disable IRQs while holding css_set_lock"Joel Fernandes (Google)2018-05-24
| | | | | | | | | | | | | | | | This reverts commit a47d369cafa270b93c6029eb18d7dbb22cc95645.
| | * | cgroup: Disable IRQs while holding css_set_lockDaniel Bristot de Oliveira2018-05-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While testing the deadline scheduler + cgroup setup I hit this warning. [ 132.612935] ------------[ cut here ]------------ [ 132.612951] WARNING: CPU: 5 PID: 0 at kernel/softirq.c:150 __local_bh_enable_ip+0x6b/0x80 [ 132.612952] Modules linked in: (a ton of modules...) [ 132.612981] CPU: 5 PID: 0 Comm: swapper/5 Not tainted 4.7.0-rc2 #2 [ 132.612981] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.2-20150714_191134- 04/01/2014 [ 132.612982] 0000000000000086 45c8bb5effdd088b ffff88013fd43da0 ffffffff813d229e [ 132.612984] 0000000000000000 0000000000000000 ffff88013fd43de0 ffffffff810a652b [ 132.612985] 00000096811387b5 0000000000000200 ffff8800bab29d80 ffff880034c54c00 [ 132.612986] Call Trace: [ 132.612987] <IRQ> [<ffffffff813d229e>] dump_stack+0x63/0x85 [ 132.612994] [<ffffffff810a652b>] __warn+0xcb/0xf0 [ 132.612997] [<ffffffff810e76a0>] ? push_dl_task.part.32+0x170/0x170 [ 132.612999] [<ffffffff810a665d>] warn_slowpath_null+0x1d/0x20 [ 132.613000] [<ffffffff810aba5b>] __local_bh_enable_ip+0x6b/0x80 [ 132.613008] [<ffffffff817d6c8a>] _raw_write_unlock_bh+0x1a/0x20 [ 132.613010] [<ffffffff817d6c9e>] _raw_spin_unlock_bh+0xe/0x10 [ 132.613015] [<ffffffff811388ac>] put_css_set+0x5c/0x60 [ 132.613016] [<ffffffff8113dc7f>] cgroup_free+0x7f/0xa0 [ 132.613017] [<ffffffff810a3912>] __put_task_struct+0x42/0x140 [ 132.613018] [<ffffffff810e776a>] dl_task_timer+0xca/0x250 [ 132.613027] [<ffffffff810e76a0>] ? push_dl_task.part.32+0x170/0x170 [ 132.613030] [<ffffffff8111371e>] __hrtimer_run_queues+0xee/0x270 [ 132.613031] [<ffffffff81113ec8>] hrtimer_interrupt+0xa8/0x190 [ 132.613034] [<ffffffff81051a58>] local_apic_timer_interrupt+0x38/0x60 [ 132.613035] [<ffffffff817d9b0d>] smp_apic_timer_interrupt+0x3d/0x50 [ 132.613037] [<ffffffff817d7c5c>] apic_timer_interrupt+0x8c/0xa0 [ 132.613038] <EOI> [<ffffffff81063466>] ? native_safe_halt+0x6/0x10 [ 132.613043] [<ffffffff81037a4e>] default_idle+0x1e/0xd0 [ 132.613044] [<ffffffff810381cf>] arch_cpu_idle+0xf/0x20 [ 132.613046] [<ffffffff810e8fda>] default_idle_call+0x2a/0x40 [ 132.613047] [<ffffffff810e92d7>] cpu_startup_entry+0x2e7/0x340 [ 132.613048] [<ffffffff81050235>] start_secondary+0x155/0x190 [ 132.613049] ---[ end trace f91934d162ce9977 ]--- The warn is the spin_(lock|unlock)_bh(&css_set_lock) in the interrupt context. Converting the spin_lock_bh to spin_lock_irq(save) to avoid this problem - and other problems of sharing a spinlock with an interrupt. Change-Id: I2064d3c21863e50ee1a70e57f7915d04f2ba0407 Cc: Tejun Heo <tj@kernel.org> Cc: Li Zefan <lizefan@huawei.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Juri Lelli <juri.lelli@arm.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: cgroups@vger.kernel.org Cc: stable@vger.kernel.org # 4.5+ Cc: linux-kernel@vger.kernel.org Reviewed-by: Rik van Riel <riel@redhat.com> Reviewed-by: "Luis Claudio R. Goncalves" <lgoncalv@redhat.com> Signed-off-by: Daniel Bristot de Oliveira <bristot@redhat.com> Acked-by: Zefan Li <lizefan@huawei.com> Signed-off-by: Tejun Heo <tj@kernel.org> Git-commit: 82d6489d0fed2ec8a8c48c19e8d8a04ac8e5bb26 Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git [runminw@codeaurora.org: resolve trivial merge conflicts] Signed-off-by: Runmin Wang <runminw@codeaurora.org>
* | | | audit: Checks valid value of audit_signals and tsk->audit_contextChetan C R2018-05-29
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There can be a case when current task's audit context may be NULL or even if it is not NULL, it can have invalid non-zero value of dummy variable and also we should audit the signal only if we have non-zero value of audit_signals. Issue has been seen during power on/off tests. So better to add explicit check on these variables. Change-Id: I2f3e17d933fca8e3b8f4013f44f942f11c68f440 Signed-off-by: Chetan C R <cravin@codeaurora.org>
* | | Merge android-4.4.132 (46155cc) into msm-4.4Srinivasarao P2018-05-22
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-46155cc Linux 4.4.132 perf/x86: Fix possible Spectre-v1 indexing for x86_pmu::event_map() perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[] perf/x86/msr: Fix possible Spectre-v1 indexing in the MSR driver perf/x86/cstate: Fix possible Spectre-v1 indexing for pkg_msr perf/x86: Fix possible Spectre-v1 indexing for hw_perf_event cache_* tracing/uprobe_event: Fix strncpy corner case Revert "Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174" atm: zatm: Fix potential Spectre v1 net: atm: Fix potential Spectre v1 can: kvaser_usb: Increase correct stats counter in kvaser_usb_rx_can_msg() tracing: Fix regex_match_front() to not over compare the test string libata: Apply NOLPM quirk for SanDisk SD7UB3Q*G1001 SSDs rfkill: gpio: fix memory leak in probe error path xfrm_user: fix return value from xfrm_user_rcv_msg f2fs: fix a dead loop in f2fs_fiemap() bdi: Fix oops in wb_workfn() tcp: fix TCP_REPAIR_QUEUE bound checking perf: Remove superfluous allocation error check soreuseport: initialise timewait reuseport field dccp: initialize ireq->ir_mark net: fix uninit-value in __hw_addr_add_ex() net: initialize skb->peeked when cloning net: fix rtnh_ok() netlink: fix uninit-value in netlink_sendmsg crypto: af_alg - fix possible uninit-value in alg_bind() ipvs: fix rtnl_lock lockups caused by start_sync_thread usb: musb: host: fix potential NULL pointer dereference USB: serial: option: adding support for ublox R410M USB: serial: option: reimplement interface masking USB: Accept bulk endpoints with 1024-byte maxpacket USB: serial: visor: handle potential invalid device configuration test_firmware: fix setting old custom fw path back on exit, second try drm/vmwgfx: Fix a buffer object leak IB/mlx5: Use unlimited rate when static rate is not supported NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2 RDMA/mlx5: Protect from shift operand overflow RDMA/ucma: Allow resolving address w/o specifying source address xfs: prevent creating negative-sized file via INSERT_RANGE Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro Input: leds - fix out of bound access tracepoint: Do not warn on ENOMEM ALSA: aloop: Add missing cable lock to ctl API callbacks ALSA: aloop: Mark paused device as inactive ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger() ALSA: pcm: Check PCM state at xfern compat ioctl USB: serial: option: Add support for Quectel EP06 gpmi-nand: Handle ECC Errors in erased pages ath10k: rebuild crypto header in rx data frames ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode mac80211: Add RX flag to indicate ICV stripped mac80211: allow same PN for AMSDU sub-frames mac80211: allow not sending MIC up from driver for HW crypto percpu: include linux/sched.h for cond_resched() KVM: s390: Enable all facility bits that are known good for passthrough bpf: map_get_next_key to return first key on NULL perf/core: Fix the perf_cpu_time_max_percent check goldfish: pipe: ANDROID: mark local functions static Revert "goldfish: pipe: ANDROID: Allocate memory with GFP_KERNEL." UPSTREAM: ANDROID: binder: prevent transactions into own process. goldfish: pipe: ANDROID: Add DMA support UPSTREAM: f2fs: clear PageError on writepage - part 2 UPSTREAM: f2fs: avoid fsync() failure caused by EAGAIN in writepage() ANDROID: build.config: enforce trace_printk check ANDROID: x86_64_cuttlefish_defconfig: Disable KPTI UPSTREAM: mac80211: ibss: Fix channel type enum in ieee80211_sta_join_ibss() UPSTREAM: mac80211: Fix clang warning about constant operand in logical operation UPSTREAM: nl80211: Fix enum type of variable in nl80211_put_sta_rate() UPSTREAM: sysfs: remove signedness from sysfs_get_dirent UPSTREAM: tracing: Use cpumask_available() to check if cpumask variable may be used BACKPORT: clocksource: Use GENMASK_ULL in definition of CLOCKSOURCE_MASK UPSTREAM: netpoll: Fix device name check in netpoll_setup() FROMLIST: staging: Fix sparse warnings in vsoc driver. FROMLIST: staging: vsoc: Fix a i386-randconfig warning. FROMLIST: staging: vsoc: Create wc kernel mapping for region shm. Revert "goldfish: pipe: ANDROID: remove a redundant target" goldfish: pipe: ANDROID: Replace writel with gf_write_ptr goldfish: pipe: ANDROID: Use dev_ logging instead of pr_ goldfish: pipe: ANDROID: fix checkpatch warnings goldfish: pipe: ANDROID: Update module license Conflicts: drivers/net/wireless/ath/ath10k/core.c drivers/net/wireless/ath/ath10k/core.h drivers/net/wireless/ath/ath10k/htt_rx.c Change-Id: If2ede1dea6a07b3fd498724e83071fd547170e1c [spathi@codeaurora.org: resolved compilation errors in ath10k by rebuilding crypto header in rx data frames] Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | Merge 4.4.132 into android-4.4Greg Kroah-Hartman2018-05-16
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.132 perf/core: Fix the perf_cpu_time_max_percent check bpf: map_get_next_key to return first key on NULL KVM: s390: Enable all facility bits that are known good for passthrough percpu: include linux/sched.h for cond_resched() mac80211: allow not sending MIC up from driver for HW crypto mac80211: allow same PN for AMSDU sub-frames mac80211: Add RX flag to indicate ICV stripped ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode ath10k: rebuild crypto header in rx data frames gpmi-nand: Handle ECC Errors in erased pages USB: serial: option: Add support for Quectel EP06 ALSA: pcm: Check PCM state at xfern compat ioctl ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger() ALSA: aloop: Mark paused device as inactive ALSA: aloop: Add missing cable lock to ctl API callbacks tracepoint: Do not warn on ENOMEM Input: leds - fix out of bound access Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro xfs: prevent creating negative-sized file via INSERT_RANGE RDMA/ucma: Allow resolving address w/o specifying source address RDMA/mlx5: Protect from shift operand overflow NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2 IB/mlx5: Use unlimited rate when static rate is not supported drm/vmwgfx: Fix a buffer object leak test_firmware: fix setting old custom fw path back on exit, second try USB: serial: visor: handle potential invalid device configuration USB: Accept bulk endpoints with 1024-byte maxpacket USB: serial: option: reimplement interface masking USB: serial: option: adding support for ublox R410M usb: musb: host: fix potential NULL pointer dereference ipvs: fix rtnl_lock lockups caused by start_sync_thread crypto: af_alg - fix possible uninit-value in alg_bind() netlink: fix uninit-value in netlink_sendmsg net: fix rtnh_ok() net: initialize skb->peeked when cloning net: fix uninit-value in __hw_addr_add_ex() dccp: initialize ireq->ir_mark soreuseport: initialise timewait reuseport field perf: Remove superfluous allocation error check tcp: fix TCP_REPAIR_QUEUE bound checking bdi: Fix oops in wb_workfn() f2fs: fix a dead loop in f2fs_fiemap() xfrm_user: fix return value from xfrm_user_rcv_msg rfkill: gpio: fix memory leak in probe error path libata: Apply NOLPM quirk for SanDisk SD7UB3Q*G1001 SSDs tracing: Fix regex_match_front() to not over compare the test string can: kvaser_usb: Increase correct stats counter in kvaser_usb_rx_can_msg() net: atm: Fix potential Spectre v1 atm: zatm: Fix potential Spectre v1 Revert "Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174" tracing/uprobe_event: Fix strncpy corner case perf/x86: Fix possible Spectre-v1 indexing for hw_perf_event cache_* perf/x86/cstate: Fix possible Spectre-v1 indexing for pkg_msr perf/x86/msr: Fix possible Spectre-v1 indexing in the MSR driver perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[] perf/x86: Fix possible Spectre-v1 indexing for x86_pmu::event_map() Linux 4.4.132 Change-Id: I66c21e374dff5a5735f1c5958021612387c635bf Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[]Peter Zijlstra2018-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 4411ec1d1993e8dbff2898390e3fed280d88e446 upstream. > kernel/events/ring_buffer.c:871 perf_mmap_to_page() warn: potential spectre issue 'rb->aux_pages' Userspace controls @pgoff through the fault address. Sanitize the array index before doing the array dereference. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: <stable@kernel.org> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Vince Weaver <vincent.weaver@maine.edu> Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * tracing/uprobe_event: Fix strncpy corner caseMasami Hiramatsu2018-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 50268a3d266ecfdd6c5873d62b2758d9732fc598 upstream. Fix string fetch function to terminate with NUL. It is OK to drop the rest of string. Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Song Liu <songliubraving@fb.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: security@kernel.org Cc: 范龙飞 <long7573@126.com> Fixes: 5baaa59ef09e ("tracing/probes: Implement 'memory' fetch method for uprobes") Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * tracing: Fix regex_match_front() to not over compare the test stringSteven Rostedt (VMware)2018-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit dc432c3d7f9bceb3de6f5b44fb9c657c9810ed6d upstream. The regex match function regex_match_front() in the tracing filter logic, was fixed to test just the pattern length from testing the entire test string. That is, it went from strncmp(str, r->pattern, len) to strcmp(str, r->pattern, r->len). The issue is that str is not guaranteed to be nul terminated, and if r->len is greater than the length of str, it can access more memory than is allocated. The solution is to add a simple test if (len < r->len) return 0. Cc: stable@vger.kernel.org Fixes: 285caad415f45 ("tracing/filters: Fix MATCH_FRONT_ONLY filter matching") Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * perf: Remove superfluous allocation error checkJiri Olsa2018-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit bfb3d7b8b906b66551424d7636182126e1d134c8 upstream. If the get_callchain_buffers fails to allocate the buffer it will decrease the nr_callchain_events right away. There's no point of checking the allocation error for nr_callchain_events > 1. Removing that check. Signed-off-by: Jiri Olsa <jolsa@kernel.org> Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Andi Kleen <andi@firstfloor.org> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: syzkaller-bugs@googlegroups.com Cc: x86@kernel.org Link: http://lkml.kernel.org/r/20180415092352.12403-3-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * tracepoint: Do not warn on ENOMEMMathieu Desnoyers2018-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit d66a270be3310d7aa132fec0cea77d3d32a0ff75 upstream. Tracepoint should only warn when a kernel API user does not respect the required preconditions (e.g. same tracepoint enabled twice, or called to remove a tracepoint that does not exist). Silence warning in out-of-memory conditions, given that the error is returned to the caller. This ensures that out-of-memory error-injection testing does not trigger warnings in tracepoint.c, which were seen by syzbot. Link: https://lkml.kernel.org/r/001a114465e241a8720567419a72@google.com Link: https://lkml.kernel.org/r/001a1140e0de15fc910567464190@google.com Link: http://lkml.kernel.org/r/20180315124424.32319-1-mathieu.desnoyers@efficios.com CC: Peter Zijlstra <peterz@infradead.org> CC: Jiri Olsa <jolsa@redhat.com> CC: Arnaldo Carvalho de Melo <acme@kernel.org> CC: Alexander Shishkin <alexander.shishkin@linux.intel.com> CC: Namhyung Kim <namhyung@kernel.org> CC: stable@vger.kernel.org Fixes: de7b2973903c6 ("tracepoint: Use struct pointer instead of name hash for reg/unreg tracepoints") Reported-by: syzbot+9c0d616860575a73166a@syzkaller.appspotmail.com Reported-by: syzbot+4e9ae7fa46233396f64d@syzkaller.appspotmail.com Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * bpf: map_get_next_key to return first key on NULLTeng Qin2018-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 8fe45924387be6b5c1be59a7eb330790c61d5d10 upstream. When iterating through a map, we need to find a key that does not exist in the map so map_get_next_key will give us the first key of the map. This often requires a lot of guessing in production systems. This patch makes map_get_next_key return the first key when the key pointer in the parameter is NULL. Signed-off-by: Teng Qin <qinteng@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chenbo Feng <fengc@google.com> Cc: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * perf/core: Fix the perf_cpu_time_max_percent checkTan Xiaojun2018-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 1572e45a924f254d9570093abde46430c3172e3d upstream. Use "proc_dointvec_minmax" instead of "proc_dointvec" to check the input value from user-space. If not, we can set a big value and some vars will overflow like "sysctl_perf_event_sample_rate" which will cause a lot of unexpected problems. Signed-off-by: Tan Xiaojun <tanxiaojun@huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: <acme@kernel.org> Cc: <alexander.shishkin@linux.intel.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Vince Weaver <vincent.weaver@maine.edu> Link: http://lkml.kernel.org/r/1487829879-56237-1-git-send-email-tanxiaojun@huawei.com Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | UPSTREAM: tracing: Use cpumask_available() to check if cpumask variable may ↵Matthias Kaehlcke2018-05-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | be used This fixes the following clang warning: kernel/trace/trace.c:3231:12: warning: address of array 'iter->started' will always evaluate to 'true' [-Wpointer-bool-conversion] if (iter->started) Link: http://lkml.kernel.org/r/20170421234110.117075-1-mka@chromium.org Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> (cherry picked from commit 4dbbe2d8e95c351157f292ece067f985c30c7b53) Bug: 78886293 Change-Id: Ib17a68ce55ca80b04bdea2d232f8ca9f88b1b8a3 Signed-off-by: Alistair Strachan <astrachan@google.com>
* | | Merge "Merge android-4.4.131 (d5d6526) into msm-4.4"Linux Build Service Account2018-05-10
|\ \ \