summaryrefslogtreecommitdiff
path: root/kernel (follow)
Commit message (Collapse)AuthorAge
...
| | * x86/power: Fix swsusp_arch_resume prototypeArnd Bergmann2018-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 328008a72d38b5bde6491e463405c34a81a65d3e ] The declaration for swsusp_arch_resume marks it as 'asmlinkage', but the definition in x86-32 does not, and it fails to include the header with the declaration. This leads to a warning when building with link-time-optimizations: kernel/power/power.h:108:23: error: type of 'swsusp_arch_resume' does not match original declaration [-Werror=lto-type-mismatch] extern asmlinkage int swsusp_arch_resume(void); ^ arch/x86/power/hibernate_32.c:148:0: note: 'swsusp_arch_resume' was previously declared here int swsusp_arch_resume(void) This moves the declaration into a globally visible header file and fixes up both x86 definitions to match it. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Len Brown <len.brown@intel.com> Cc: Andi Kleen <ak@linux.intel.com> Cc: Nicolas Pitre <nico@linaro.org> Cc: linux-pm@vger.kernel.org Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net> Cc: Pavel Machek <pavel@ucw.cz> Cc: Bart Van Assche <bart.vanassche@wdc.com> Link: https://lkml.kernel.org/r/20180202145634.200291-2-arnd@arndb.de Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * kernel/signal.c: avoid undefined behaviour in kill_something_infozhongjiang2018-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 4ea77014af0d6205b05503d1c7aac6eace11d473 upstream. When running kill(72057458746458112, 0) in userspace I hit the following issue. UBSAN: Undefined behaviour in kernel/signal.c:1462:11 negation of -2147483648 cannot be represented in type 'int': CPU: 226 PID: 9849 Comm: test Tainted: G B ---- ------- 3.10.0-327.53.58.70.x86_64_ubsan+ #116 Hardware name: Huawei Technologies Co., Ltd. RH8100 V3/BC61PBIA, BIOS BLHSV028 11/11/2014 Call Trace: dump_stack+0x19/0x1b ubsan_epilogue+0xd/0x50 __ubsan_handle_negate_overflow+0x109/0x14e SYSC_kill+0x43e/0x4d0 SyS_kill+0xe/0x10 system_call_fastpath+0x16/0x1b Add code to avoid the UBSAN detection. [akpm@linux-foundation.org: tweak comment] Link: http://lkml.kernel.org/r/1496670008-59084-1-git-send-email-zhongjiang@huawei.com Signed-off-by: zhongjiang <zhongjiang@huawei.com> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Michal Hocko <mhocko@kernel.org> Cc: Vlastimil Babka <vbabka@suse.cz> Cc: Xishi Qiu <qiuxishi@huawei.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * kernel/sys.c: fix potential Spectre v1 issueGustavo A. R. Silva2018-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 23d6aef74da86a33fa6bb75f79565e0a16ee97c2 upstream. `resource' can be controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: kernel/sys.c:1474 __do_compat_sys_old_getrlimit() warn: potential spectre issue 'get_current()->signal->rlim' (local cap) kernel/sys.c:1455 __do_sys_old_getrlimit() warn: potential spectre issue 'get_current()->signal->rlim' (local cap) Fix this by sanitizing *resource* before using it to index current->signal->rlim Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Link: http://lkml.kernel.org/r/20180515030038.GA11822@embeddedor.com Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Reviewed-by: Andrew Morton <akpm@linux-foundation.org> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Dan Williams <dan.j.williams@intel.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | UPSTREAM: sched/fair: Consider RT/IRQ pressure in capacity_spare_wakeJoel Fernandes2018-05-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | capacity_spare_wake in the slow path influences choice of idlest groups, as we search for groups with maximum spare capacity. In scenarios where RT pressure is high, a sub optimal group can be chosen and hurt performance of the task being woken up. Several tests with results are included below to show improvements with this change. 1) Hackbench on Pixel 2 Android device (4x4 ARM64 Octa core) ------------------------------------------------------------ Here we have RT activity running on big CPU cluster induced with rt-app, and running hackbench in parallel. The RT tasks are bound to 4 CPUs on the big cluster (cpu 4,5,6,7) and have 100ms periodicity with runtime=20ms sleep=80ms. Hackbench shows big benefit (30%) improvement when number of tasks is 8 and 32: Note: data is completion time in seconds (lower is better). Number of loops for 8 and 16 tasks is 50000, and for 32 tasks its 20000. +--------+-----+-------+-------------------+---------------------------+ | groups | fds | tasks | Without Patch | With Patch | +--------+-----+-------+---------+---------+-----------------+---------+ | | | | Mean | Stdev | Mean | Stdev | | | | +-------------------+-----------------+---------+ | 1 | 8 | 8 | 1.0534 | 0.13722 | 0.7293 (+30.7%) | 0.02653 | | 2 | 8 | 16 | 1.6219 | 0.16631 | 1.6391 (-1%) | 0.24001 | | 4 | 8 | 32 | 1.2538 | 0.13086 | 1.1080 (+11.6%) | 0.16201 | +--------+-----+-------+---------+---------+-----------------+---------+ 2) Rohit ran barrier.c test (details below) with following improvements: ------------------------------------------------------------------------ This was Rohit's original use case for a patch he posted at [1] however from his recent tests he showed my patch can replace his slow path changes [1] and there's no need to selectively scan/skip CPUs in find_idlest_group_cpu in the slow path to get the improvement he sees. barrier.c (open_mp code) as a micro-benchmark. It does a number of iterations and barrier sync at the end of each for loop. Here barrier,c is running in along with ping on CPU 0 and 1 as: 'ping -l 10000 -q -s 10 -f hostX' barrier.c can be found at: http://www.spinics.net/lists/kernel/msg2506955.html Following are the results for the iterations per second with this micro-benchmark (higher is better), on a 44 core, 2 socket 88 Threads Intel x86 machine: +--------+------------------+---------------------------+ |Threads | Without patch | With patch | | | | | +--------+--------+---------+-----------------+---------+ | | Mean | Std Dev | Mean | Std Dev | +--------+--------+---------+-----------------+---------+ |1 | 539.36 | 60.16 | 572.54 (+6.15%) | 40.95 | |2 | 481.01 | 19.32 | 530.64 (+10.32%)| 56.16 | |4 | 474.78 | 22.28 | 479.46 (+0.99%) | 18.89 | |8 | 450.06 | 24.91 | 447.82 (-0.50%) | 12.36 | |16 | 436.99 | 22.57 | 441.88 (+1.12%) | 7.39 | |32 | 388.28 | 55.59 | 429.4 (+10.59%)| 31.14 | |64 | 314.62 | 6.33 | 311.81 (-0.89%) | 11.99 | +--------+--------+---------+-----------------+---------+ 3) ping+hackbench test on bare-metal sever (Rohit ran this test) ---------------------------------------------------------------- Here hackbench is running in threaded mode along with, running ping on CPU 0 and 1 as: 'ping -l 10000 -q -s 10 -f hostX' This test is running on 2 socket, 20 core and 40 threads Intel x86 machine: Number of loops is 10000 and runtime is in seconds (Lower is better). +--------------+-----------------+--------------------------+ |Task Groups | Without patch | With patch | | +-------+---------+----------------+---------+ |(Groups of 40)| Mean | Std Dev | Mean | Std Dev | +--------------+-------+---------+----------------+---------+ |1 | 0.851 | 0.007 | 0.828 (+2.77%)| 0.032 | |2 | 1.083 | 0.203 | 1.087 (-0.37%)| 0.246 | |4 | 1.601 | 0.051 | 1.611 (-0.62%)| 0.055 | |8 | 2.837 | 0.060 | 2.827 (+0.35%)| 0.031 | |16 | 5.139 | 0.133 | 5.107 (+0.63%)| 0.085 | |25 | 7.569 | 0.142 | 7.503 (+0.88%)| 0.143 | +--------------+-------+---------+----------------+---------+ [1] https://patchwork.kernel.org/patch/9991635/ Matt Fleming also ran cyclictest and several different hackbench tests on his test machines to santiy-check that the patch doesn't harm any of his usecases. Change-Id: Ibcedbb65273545ff2f4d1962b4eaca14072b1bd2 Cc: Dietmar Eggemann <dietmar.eggemann@arm.com> Cc: Vincent Guittot <vincent.guittot@linaro.org> Cc: Morten Ramussen <morten.rasmussen@arm.com> Cc: Brendan Jackman <brendan.jackman@arm.com> Tested-by: Rohit Jain <rohit.k.jain@oracle.com> Tested-by: Matt Fleming <matt@codeblueprint.co.uk> Signed-off-by: Joel Fernandes <joelaf@google.com> Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org> Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
* | | power:hibernate: KPI marker for Hibernation SuccessAtul Raut2018-06-20
| | | | | | | | | | | | | | | | | | | | | | | | Add KPI Marker for hibernation failure and success needed for perf image. Change-Id: I90a4e503c75ccb1d0edb3d26f7f8d5f08dafe95e Signed-off-by: Atul Raut <araut@codeaurora.org>
* | | Merge "Merge android-4.4.133 (3f51ea2) into msm-4.4"Linux Build Service Account2018-06-02
|\ \ \
| * | | Merge android-4.4.133 (3f51ea2) into msm-4.4Srinivasarao P2018-05-31
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-3f51ea2 Linux 4.4.133 x86/kexec: Avoid double free_page() upon do_kexec_load() failure hfsplus: stop workqueue when fill_super() failed cfg80211: limit wiphy names to 128 bytes gpio: rcar: Add Runtime PM handling for interrupts time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting dmaengine: ensure dmaengine helpers check valid callback scsi: zfcp: fix infinite iteration on ERP ready list scsi: sg: allocate with __GFP_ZERO in sg_build_indirect() scsi: libsas: defer ata device eh commands to libata s390: use expoline thunks in the BPF JIT s390: extend expoline to BC instructions s390: move spectre sysfs attribute code s390/kernel: use expoline for indirect branches s390/lib: use expoline for indirect branches s390: move expoline assembler macros to a header s390: add assembler macros for CPU alternatives ext2: fix a block leak tcp: purge write queue in tcp_connect_init() sock_diag: fix use-after-free read in __sk_free packet: in packet_snd start writing at link layer allocation net: test tailroom before appending to linear skb btrfs: fix reading stale metadata blocks after degraded raid1 mounts btrfs: fix crash when trying to resume balance without the resume flag Btrfs: fix xattr loss after power failure ARM: 8772/1: kprobes: Prohibit kprobes on get_user functions ARM: 8770/1: kprobes: Prohibit probing on optimized_callback ARM: 8769/1: kprobes: Fix to use get_kprobe_ctlblk after irq-disabed tick/broadcast: Use for_each_cpu() specially on UP kernels ARM: 8771/1: kprobes: Prohibit kprobes on do_undefinstr efi: Avoid potential crashes, fix the 'struct efi_pci_io_protocol_32' definition for mixed mode s390: remove indirect branch from do_softirq_own_stack s390/qdio: don't release memory in qdio_setup_irq() s390/cpum_sf: ensure sample frequency of perf event attributes is non-zero s390/qdio: fix access to uninitialized qdio_q fields mm: don't allow deferred pages with NEED_PER_CPU_KM powerpc/powernv: Fix NVRAM sleep in invalid context when crashing procfs: fix pthread cross-thread naming if !PR_DUMPABLE proc read mm's {arg,env}_{start,end} with mmap semaphore taken. tracing/x86/xen: Remove zero data size trace events trace_xen_mmu_flush_tlb{_all} cpufreq: intel_pstate: Enable HWP by default signals: avoid unnecessary taking of sighand->siglock mm: filemap: avoid unnecessary calls to lock_page when waiting for IO to complete during a read mm: filemap: remove redundant code in do_read_cache_page proc: meminfo: estimate available memory more conservatively vmscan: do not force-scan file lru if its absolute size is small powerpc: Don't preempt_disable() in show_cpuinfo() cpuidle: coupled: remove unused define cpuidle_coupled_lock powerpc/powernv: remove FW_FEATURE_OPALv3 and just use FW_FEATURE_OPAL powerpc/powernv: Remove OPALv2 firmware define and references powerpc/powernv: panic() on OPAL < V3 spi: pxa2xx: Allow 64-bit DMA ALSA: control: fix a redundant-copy issue ALSA: hda: Add Lenovo C50 All in one to the power_save blacklist ALSA: usb: mixer: volume quirk for CM102-A+/102S+ usbip: usbip_host: fix bad unlock balance during stub_probe() usbip: usbip_host: fix NULL-ptr deref and use-after-free errors usbip: usbip_host: run rebind from exit when module is removed usbip: usbip_host: delete device from busid_table after rebind usbip: usbip_host: refine probe and disconnect debug msgs to be useful kernel/exit.c: avoid undefined behaviour when calling wait4() futex: futex_wake_op, fix sign_extend32 sign bits pipe: cap initial pipe capacity according to pipe-max-size limit l2tp: revert "l2tp: fix missing print session offset info" Revert "ARM: dts: imx6qdl-wandboard: Fix audio channel swap" lockd: lost rollback of set_grace_period() in lockd_down_net() xfrm: fix xfrm_do_migrate() with AEAD e.g(AES-GCM) futex: Remove duplicated code and fix undefined behaviour futex: Remove unnecessary warning from get_futex_key arm64: Add work around for Arm Cortex-A55 Erratum 1024718 arm64: introduce mov_q macro to move a constant into a 64-bit register audit: move calcs after alloc and check when logging set loginuid ALSA: timer: Call notifier in the same spinlock sctp: delay the authentication for the duplicated cookie-echo chunk sctp: fix the issue that the cookie-ack with auth can't get processed tcp: ignore Fast Open on repair mode bonding: do not allow rlb updates to invalid mac tg3: Fix vunmap() BUG_ON() triggered from tg3_free_consistent(). sctp: use the old asoc when making the cookie-ack chunk in dupcook_d sctp: handle two v4 addrs comparison in sctp_inet6_cmp_addr r8169: fix powering up RTL8168h qmi_wwan: do not steal interfaces from class drivers openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found net: support compat 64-bit time in {s,g}etsockopt net_sched: fq: take care of throttled flows before reuse net/mlx4_en: Verify coalescing parameters are in range net: ethernet: sun: niu set correct packet size in skb llc: better deal with too small mtu ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg dccp: fix tasklet usage bridge: check iface upper dev when setting master via ioctl 8139too: Use disable_irq_nosync() in rtl8139_poll_controller() BACKPORT, FROMLIST: fscrypt: add Speck128/256 support cgroup: Disable IRQs while holding css_set_lock Revert "cgroup: Disable IRQs while holding css_set_lock" cgroup: Disable IRQs while holding css_set_lock ANDROID: proc: fix undefined behavior in proc_uid_base_readdir x86: vdso: Fix leaky vdso linker with CC=clang. ANDROID: build: cuttlefish: Upgrade clang to newer version. ANDROID: build: cuttlefish: Upgrade clang to newer version. ANDROID: build: cuttlefish: Fix path to clang. UPSTREAM: dm bufio: avoid sleeping while holding the dm_bufio lock ANDROID: sdcardfs: Don't d_drop in d_revalidate Conflicts: arch/arm64/include/asm/cputype.h fs/ext4/crypto.c fs/ext4/ext4.h kernel/cgroup.c mm/vmscan.c Change-Id: Ic10c5722b6439af1cf423fd949c493f786764d7e Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| | * | Merge 4.4.133 into android-4.4Greg Kroah-Hartman2018-05-26
| | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.133 8139too: Use disable_irq_nosync() in rtl8139_poll_controller() bridge: check iface upper dev when setting master via ioctl dccp: fix tasklet usage ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg llc: better deal with too small mtu net: ethernet: sun: niu set correct packet size in skb net/mlx4_en: Verify coalescing parameters are in range net_sched: fq: take care of throttled flows before reuse net: support compat 64-bit time in {s,g}etsockopt openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found qmi_wwan: do not steal interfaces from class drivers r8169: fix powering up RTL8168h sctp: handle two v4 addrs comparison in sctp_inet6_cmp_addr sctp: use the old asoc when making the cookie-ack chunk in dupcook_d tg3: Fix vunmap() BUG_ON() triggered from tg3_free_consistent(). bonding: do not allow rlb updates to invalid mac tcp: ignore Fast Open on repair mode sctp: fix the issue that the cookie-ack with auth can't get processed sctp: delay the authentication for the duplicated cookie-echo chunk ALSA: timer: Call notifier in the same spinlock audit: move calcs after alloc and check when logging set loginuid arm64: introduce mov_q macro to move a constant into a 64-bit register arm64: Add work around for Arm Cortex-A55 Erratum 1024718 futex: Remove unnecessary warning from get_futex_key futex: Remove duplicated code and fix undefined behaviour xfrm: fix xfrm_do_migrate() with AEAD e.g(AES-GCM) lockd: lost rollback of set_grace_period() in lockd_down_net() Revert "ARM: dts: imx6qdl-wandboard: Fix audio channel swap" l2tp: revert "l2tp: fix missing print session offset info" pipe: cap initial pipe capacity according to pipe-max-size limit futex: futex_wake_op, fix sign_extend32 sign bits kernel/exit.c: avoid undefined behaviour when calling wait4() usbip: usbip_host: refine probe and disconnect debug msgs to be useful usbip: usbip_host: delete device from busid_table after rebind usbip: usbip_host: run rebind from exit when module is removed usbip: usbip_host: fix NULL-ptr deref and use-after-free errors usbip: usbip_host: fix bad unlock balance during stub_probe() ALSA: usb: mixer: volume quirk for CM102-A+/102S+ ALSA: hda: Add Lenovo C50 All in one to the power_save blacklist ALSA: control: fix a redundant-copy issue spi: pxa2xx: Allow 64-bit DMA powerpc/powernv: panic() on OPAL < V3 powerpc/powernv: Remove OPALv2 firmware define and references powerpc/powernv: remove FW_FEATURE_OPALv3 and just use FW_FEATURE_OPAL cpuidle: coupled: remove unused define cpuidle_coupled_lock powerpc: Don't preempt_disable() in show_cpuinfo() vmscan: do not force-scan file lru if its absolute size is small proc: meminfo: estimate available memory more conservatively mm: filemap: remove redundant code in do_read_cache_page mm: filemap: avoid unnecessary calls to lock_page when waiting for IO to complete during a read signals: avoid unnecessary taking of sighand->siglock cpufreq: intel_pstate: Enable HWP by default tracing/x86/xen: Remove zero data size trace events trace_xen_mmu_flush_tlb{_all} proc read mm's {arg,env}_{start,end} with mmap semaphore taken. procfs: fix pthread cross-thread naming if !PR_DUMPABLE powerpc/powernv: Fix NVRAM sleep in invalid context when crashing mm: don't allow deferred pages with NEED_PER_CPU_KM s390/qdio: fix access to uninitialized qdio_q fields s390/cpum_sf: ensure sample frequency of perf event attributes is non-zero s390/qdio: don't release memory in qdio_setup_irq() s390: remove indirect branch from do_softirq_own_stack efi: Avoid potential crashes, fix the 'struct efi_pci_io_protocol_32' definition for mixed mode ARM: 8771/1: kprobes: Prohibit kprobes on do_undefinstr tick/broadcast: Use for_each_cpu() specially on UP kernels ARM: 8769/1: kprobes: Fix to use get_kprobe_ctlblk after irq-disabed ARM: 8770/1: kprobes: Prohibit probing on optimized_callback ARM: 8772/1: kprobes: Prohibit kprobes on get_user functions Btrfs: fix xattr loss after power failure btrfs: fix crash when trying to resume balance without the resume flag btrfs: fix reading stale metadata blocks after degraded raid1 mounts net: test tailroom before appending to linear skb packet: in packet_snd start writing at link layer allocation sock_diag: fix use-after-free read in __sk_free tcp: purge write queue in tcp_connect_init() ext2: fix a block leak s390: add assembler macros for CPU alternatives s390: move expoline assembler macros to a header s390/lib: use expoline for indirect branches s390/kernel: use expoline for indirect branches s390: move spectre sysfs attribute code s390: extend expoline to BC instructions s390: use expoline thunks in the BPF JIT scsi: libsas: defer ata device eh commands to libata scsi: sg: allocate with __GFP_ZERO in sg_build_indirect() scsi: zfcp: fix infinite iteration on ERP ready list dmaengine: ensure dmaengine helpers check valid callback time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting gpio: rcar: Add Runtime PM handling for interrupts cfg80211: limit wiphy names to 128 bytes hfsplus: stop workqueue when fill_super() failed x86/kexec: Avoid double free_page() upon do_kexec_load() failure Linux 4.4.133 Change-Id: I0554b12889bc91add2a444da95f18d59c6fb9cdb Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | | * time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accountingJohn Stultz2018-05-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 3d88d56c5873f6eebe23e05c3da701960146b801 upstream. Due to how the MONOTONIC_RAW accumulation logic was handled, there is the potential for a 1ns discontinuity when we do accumulations. This small discontinuity has for the most part gone un-noticed, but since ARM64 enabled CLOCK_MONOTONIC_RAW in their vDSO clock_gettime implementation, we've seen failures with the inconsistency-check test in kselftest. This patch addresses the issue by using the same sub-ns accumulation handling that CLOCK_MONOTONIC uses, which avoids the issue for in-kernel users. Since the ARM64 vDSO implementation has its own clock_gettime calculation logic, this patch reduces the frequency of errors, but failures are still seen. The ARM64 vDSO will need to be updated to include the sub-nanosecond xtime_nsec values in its calculation for this issue to be completely fixed. Signed-off-by: John Stultz <john.stultz@linaro.org> Tested-by: Daniel Mentz <danielmentz@google.com> Cc: Prarit Bhargava <prarit@redhat.com> Cc: Kevin Brodsky <kevin.brodsky@arm.com> Cc: Richard Cochran <richardcochran@gmail.com> Cc: Stephen Boyd <stephen.boyd@linaro.org> Cc: Will Deacon <will.deacon@arm.com> Cc: "stable #4 . 8+" <stable@vger.kernel.org> Cc: Miroslav Lichvar <mlichvar@redhat.com> Link: http://lkml.kernel.org/r/1496965462-20003-3-git-send-email-john.stultz@linaro.org Signed-off-by: Thomas Gleixner <tglx@linutronix.de> [fabrizio: cherry-pick to 4.4. Kept cycle_t type for function logarithmic_accumulation local variable "interval". Dropped casting of "interval" variable] Signed-off-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com> Signed-off-by: Biju Das <biju.das@bp.renesas.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | | * tick/broadcast: Use for_each_cpu() specially on UP kernelsDexuan Cui2018-05-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 5596fe34495cf0f645f417eb928ef224df3e3cb4 upstream. for_each_cpu() unintuitively reports CPU0 as set independent of the actual cpumask content on UP kernels. This causes an unexpected PIT interrupt storm on a UP kernel running in an SMP virtual machine on Hyper-V, and as a result, the virtual machine can suffer from a strange random delay of 1~20 minutes during boot-up, and sometimes it can hang forever. Protect if by checking whether the cpumask is empty before entering the for_each_cpu() loop. [ tglx: Use !IS_ENABLED(CONFIG_SMP) instead of #ifdeffery ] Signed-off-by: Dexuan Cui <decui@microsoft.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Josh Poulson <jopoulso@microsoft.com> Cc: "Michael Kelley (EOSG)" <Michael.H.Kelley@microsoft.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: stable@vger.kernel.org Cc: Rakib Mullick <rakib.mullick@gmail.com> Cc: Jork Loeser <Jork.Loeser@microsoft.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: KY Srinivasan <kys@microsoft.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Alexey Dobriyan <adobriyan@gmail.com> Cc: Dmitry Vyukov <dvyukov@google.com> Link: https://lkml.kernel.org/r/KL1P15301MB000678289FE55BA365B3279ABF990@KL1P15301MB0006.APCP153.PROD.OUTLOOK.COM Link: https://lkml.kernel.org/r/KL1P15301MB0006FA63BC22BEB64902EAA0BF930@KL1P15301MB0006.APCP153.PROD.OUTLOOK.COM Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | | * signals: avoid unnecessary taking of sighand->siglockWaiman Long2018-05-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit c7be96af89d4b53211862d8599b2430e8900ed92 upstream. When running certain database workload on a high-end system with many CPUs, it was found that spinlock contention in the sigprocmask syscalls became a significant portion of the overall CPU cycles as shown below. 9.30% 9.30% 905387 dataserver /proc/kcore 0x7fff8163f4d2 [k] _raw_spin_lock_irq | ---_raw_spin_lock_irq | |--99.34%-- __set_current_blocked | sigprocmask | sys_rt_sigprocmask | system_call_fastpath | | | |--50.63%-- __swapcontext | | | | | |--99.91%-- upsleepgeneric | | | |--49.36%-- __setcontext | | ktskRun Looking further into the swapcontext function in glibc, it was found that the function always call sigprocmask() without checking if there are changes in the signal mask. A check was added to the __set_current_blocked() function to avoid taking the sighand->siglock spinlock if there is no change in the signal mask. This will prevent unneeded spinlock contention when many threads are trying to call sigprocmask(). With this patch applied, the spinlock contention in sigprocmask() was gone. Link: http://lkml.kernel.org/r/1474979209-11867-1-git-send-email-Waiman.Long@hpe.com Signed-off-by: Waiman Long <Waiman.Long@hpe.com> Acked-by: Oleg Nesterov <oleg@redhat.com> Cc: Ingo Molnar <mingo@kernel.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Stas Sergeev <stsp@list.ru> Cc: Scott J Norton <scott.norton@hpe.com> Cc: Douglas Hatch <doug.hatch@hpe.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Mel Gorman <mgorman@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | | * kernel/exit.c: avoid undefined behaviour when calling wait4()zhongjiang2018-05-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit dd83c161fbcc5d8be637ab159c0de015cbff5ba4 upstream. wait4(-2147483648, 0x20, 0, 0xdd0000) triggers: UBSAN: Undefined behaviour in kernel/exit.c:1651:9 The related calltrace is as follows: negation of -2147483648 cannot be represented in type 'int': CPU: 9 PID: 16482 Comm: zj Tainted: G B ---- ------- 3.10.0-327.53.58.71.x86_64+ #66 Hardware name: Huawei Technologies Co., Ltd. Tecal RH2285 /BC11BTSA , BIOS CTSAV036 04/27/2011 Call Trace: dump_stack+0x19/0x1b ubsan_epilogue+0xd/0x50 __ubsan_handle_negate_overflow+0x109/0x14e SyS_wait4+0x1cb/0x1e0 system_call_fastpath+0x16/0x1b Exclude the overflow to avoid the UBSAN warning. Link: http://lkml.kernel.org/r/1497264618-20212-1-git-send-email-zhongjiang@huawei.com Signed-off-by: zhongjiang <zhongjiang@huawei.com> Cc: Oleg Nesterov <oleg@redhat.com> Cc: David Rientjes <rientjes@google.com> Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Cc: Xishi Qiu <qiuxishi@huawei.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | | * futex: futex_wake_op, fix sign_extend32 sign bitsJiri Slaby2018-05-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit d70ef22892ed6c066e51e118b225923c9b74af34 upstream. sign_extend32 counts the sign bit parameter from 0, not from 1. So we have to use "11" for 12th bit, not "12". This mistake means we have not allowed negative op and cmp args since commit 30d6e0a4190d ("futex: Remove duplicated code and fix undefined behaviour") till now. Fixes: 30d6e0a4190d ("futex: Remove duplicated code and fix undefined behaviour") Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: Ingo Molnar <mingo@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Darren Hart <dvhart@infradead.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | | * futex: Remove duplicated code and fix undefined behaviourJiri Slaby2018-05-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 30d6e0a4190d37740e9447e4e4815f06992dd8c3 upstream. There is code duplicated over all architecture's headers for futex_atomic_op_inuser. Namely op decoding, access_ok check for uaddr, and comparison of the result. Remove this duplication and leave up to the arches only the needed assembly which is now in arch_futex_atomic_op_inuser. This effectively distributes the Will Deacon's arm64 fix for undefined behaviour reported by UBSAN to all architectures. The fix was done in commit 5f16a046f8e1 (arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage). Look there for an example dump. And as suggested by Thomas, check for negative oparg too, because it was also reported to cause undefined behaviour report. Note that s390 removed access_ok check in d12a29703 ("s390/uaccess: remove pointless access_ok() checks") as access_ok there returns true. We introduce it back to the helper for the sake of simplicity (it gets optimized away anyway). Signed-off-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Russell King <rmk+kernel@armlinux.org.uk> Acked-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc) Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com> [s390] Acked-by: Chris Metcalf <cmetcalf@mellanox.com> [for tile] Reviewed-by: Darren Hart (VMware) <dvhart@infradead.org> Reviewed-by: Will Deacon <will.deacon@arm.com> [core/arm64] Cc: linux-mips@linux-mips.org Cc: Rich Felker <dalias@libc.org> Cc: linux-ia64@vger.kernel.org Cc: linux-sh@vger.kernel.org Cc: peterz@infradead.org Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Max Filippov <jcmvbkbc@gmail.com> Cc: Paul Mackerras <paulus@samba.org> Cc: sparclinux@vger.kernel.org Cc: Jonas Bonn <jonas@southpole.se> Cc: linux-s390@vger.kernel.org Cc: linux-arch@vger.kernel.org Cc: Yoshinori Sato <ysato@users.sourceforge.jp> Cc: linux-hexagon@vger.kernel.org Cc: Helge Deller <deller@gmx.de> Cc: "James E.J. Bottomley" <jejb@parisc-linux.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Matt Turner <mattst88@gmail.com> Cc: linux-snps-arc@lists.infradead.org Cc: Fenghua Yu <fenghua.yu@intel.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: linux-xtensa@linux-xtensa.org Cc: Stefan Kristiansson <stefan.kristiansson@saunalahti.fi> Cc: openrisc@lists.librecores.org Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Cc: Stafford Horne <shorne@gmail.com> Cc: linux-arm-kernel@lists.infradead.org Cc: Richard Henderson <rth@twiddle.net> Cc: Chris Zankel <chris@zankel.net> Cc: Michal Simek <monstr@monstr.eu> Cc: Tony Luck <tony.luck@intel.com> Cc: linux-parisc@vger.kernel.org Cc: Vineet Gupta <vgupta@synopsys.com> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Richard Kuo <rkuo@codeaurora.org> Cc: linux-alpha@vger.kernel.org Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: linuxppc-dev@lists.ozlabs.org Cc: "David S. Miller" <davem@davemloft.net> Link: http://lkml.kernel.org/r/20170824073105.3901-1-jslaby@suse.cz Cc: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | | * futex: Remove unnecessary warning from get_futex_keyMel Gorman2018-05-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 48fb6f4db940e92cfb16cd878cddd59ea6120d06 upstream. Commit 65d8fc777f6d ("futex: Remove requirement for lock_page() in get_futex_key()") removed an unnecessary lock_page() with the side-effect that page->mapping needed to be treated very carefully. Two defensive warnings were added in case any assumption was missed and the first warning assumed a correct application would not alter a mapping backing a futex key. Since merging, it has not triggered for any unexpected case but Mark Rutland reported the following bug triggering due to the first warning. kernel BUG at kernel/futex.c:679! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 3695 Comm: syz-executor1 Not tainted 4.13.0-rc3-00020-g307fec773ba3 #3 Hardware name: linux,dummy-virt (DT) task: ffff80001e271780 task.stack: ffff000010908000 PC is at get_futex_key+0x6a4/0xcf0 kernel/futex.c:679 LR is at get_futex_key+0x6a4/0xcf0 kernel/futex.c:679 pc : [<ffff00000821ac14>] lr : [<ffff00000821ac14>] pstate: 80000145 The fact that it's a bug instead of a warning was due to an unrelated arm64 problem, but the warning itself triggered because the underlying mapping changed. This is an application issue but from a kernel perspective it's a recoverable situation and the warning is unnecessary so this patch removes the warning. The warning may potentially be triggered with the following test program from Mark although it may be necessary to adjust NR_FUTEX_THREADS to be a value smaller than the number of CPUs in the system. #include <linux/futex.h> #include <pthread.h> #include <stdio.h> #include <stdlib.h> #include <sys/mman.h> #include <sys/syscall.h> #include <sys/time.h> #include <unistd.h> #define NR_FUTEX_THREADS 16 pthread_t threads[NR_FUTEX_THREADS]; void *mem; #define MEM_PROT (PROT_READ | PROT_WRITE) #define MEM_SIZE 65536 static int futex_wrapper(int *uaddr, int op, int val, const struct timespec *timeout, int *uaddr2, int val3) { syscall(SYS_futex, uaddr, op, val, timeout, uaddr2, val3); } void *poll_futex(void *unused) { for (;;) { futex_wrapper(mem, FUTEX_CMP_REQUEUE_PI, 1, NULL, mem + 4, 1); } } int main(int argc, char *argv[]) { int i; mem = mmap(NULL, MEM_SIZE, MEM_PROT, MAP_SHARED | MAP_ANONYMOUS, -1, 0); printf("Mapping @ %p\n", mem); printf("Creating futex threads...\n"); for (i = 0; i < NR_FUTEX_THREADS; i++) pthread_create(&threads[i], NULL, poll_futex, NULL); printf("Flipping mapping...\n"); for (;;) { mmap(mem, MEM_SIZE, MEM_PROT, MAP_FIXED | MAP_SHARED | MAP_ANONYMOUS, -1, 0); } return 0; } Reported-and-tested-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Mel Gorman <mgorman@suse.de> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: stable@vger.kernel.org # 4.7+ Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | | * audit: move calcs after alloc and check when logging set loginuidRichard Guy Briggs2018-05-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 76a658c20efd541a62838d9ff68ce94170d7a549 upstream. Move the calculations of values after the allocation in case the allocation fails. This avoids wasting effort in the rare case that it fails, but more importantly saves us extra logic to release the tty ref. Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Cc: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * | cgroup: Disable IRQs while holding css_set_lockDaniel Bristot de Oliveira2018-05-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While testing the deadline scheduler + cgroup setup I hit this warning. [ 132.612935] ------------[ cut here ]------------ [ 132.612951] WARNING: CPU: 5 PID: 0 at kernel/softirq.c:150 __local_bh_enable_ip+0x6b/0x80 [ 132.612952] Modules linked in: (a ton of modules...) [ 132.612981] CPU: 5 PID: 0 Comm: swapper/5 Not tainted 4.7.0-rc2 #2 [ 132.612981] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.2-20150714_191134- 04/01/2014 [ 132.612982] 0000000000000086 45c8bb5effdd088b ffff88013fd43da0 ffffffff813d229e [ 132.612984] 0000000000000000 0000000000000000 ffff88013fd43de0 ffffffff810a652b [ 132.612985] 00000096811387b5 0000000000000200 ffff8800bab29d80 ffff880034c54c00 [ 132.612986] Call Trace: [ 132.612987] <IRQ> [<ffffffff813d229e>] dump_stack+0x63/0x85 [ 132.612994] [<ffffffff810a652b>] __warn+0xcb/0xf0 [ 132.612997] [<ffffffff810e76a0>] ? push_dl_task.part.32+0x170/0x170 [ 132.612999] [<ffffffff810a665d>] warn_slowpath_null+0x1d/0x20 [ 132.613000] [<ffffffff810aba5b>] __local_bh_enable_ip+0x6b/0x80 [ 132.613008] [<ffffffff817d6c8a>] _raw_write_unlock_bh+0x1a/0x20 [ 132.613010] [<ffffffff817d6c9e>] _raw_spin_unlock_bh+0xe/0x10 [ 132.613015] [<ffffffff811388ac>] put_css_set+0x5c/0x60 [ 132.613016] [<ffffffff8113dc7f>] cgroup_free+0x7f/0xa0 [ 132.613017] [<ffffffff810a3912>] __put_task_struct+0x42/0x140 [ 132.613018] [<ffffffff810e776a>] dl_task_timer+0xca/0x250 [ 132.613027] [<ffffffff810e76a0>] ? push_dl_task.part.32+0x170/0x170 [ 132.613030] [<ffffffff8111371e>] __hrtimer_run_queues+0xee/0x270 [ 132.613031] [<ffffffff81113ec8>] hrtimer_interrupt+0xa8/0x190 [ 132.613034] [<ffffffff81051a58>] local_apic_timer_interrupt+0x38/0x60 [ 132.613035] [<ffffffff817d9b0d>] smp_apic_timer_interrupt+0x3d/0x50 [ 132.613037] [<ffffffff817d7c5c>] apic_timer_interrupt+0x8c/0xa0 [ 132.613038] <EOI> [<ffffffff81063466>] ? native_safe_halt+0x6/0x10 [ 132.613043] [<ffffffff81037a4e>] default_idle+0x1e/0xd0 [ 132.613044] [<ffffffff810381cf>] arch_cpu_idle+0xf/0x20 [ 132.613046] [<ffffffff810e8fda>] default_idle_call+0x2a/0x40 [ 132.613047] [<ffffffff810e92d7>] cpu_startup_entry+0x2e7/0x340 [ 132.613048] [<ffffffff81050235>] start_secondary+0x155/0x190 [ 132.613049] ---[ end trace f91934d162ce9977 ]--- The warn is the spin_(lock|unlock)_bh(&css_set_lock) in the interrupt context. Converting the spin_lock_bh to spin_lock_irq(save) to avoid this problem - and other problems of sharing a spinlock with an interrupt. Change-Id: I5b5d5c79c3f380ac35f58596fc2cebaf6348eb67 Cc: Tejun Heo <tj@kernel.org> Cc: Li Zefan <lizefan@huawei.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Juri Lelli <juri.lelli@arm.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: cgroups@vger.kernel.org Cc: stable@vger.kernel.org # 4.5+ Cc: linux-kernel@vger.kernel.org Reviewed-by: Rik van Riel <riel@redhat.com> Reviewed-by: "Luis Claudio R. Goncalves" <lgoncalv@redhat.com> Signed-off-by: Daniel Bristot de Oliveira <bristot@redhat.com> Acked-by: Zefan Li <lizefan@huawei.com> Signed-off-by: Tejun Heo <tj@kernel.org>
| | * | Revert "cgroup: Disable IRQs while holding css_set_lock"Joel Fernandes (Google)2018-05-24
| | | | | | | | | | | | | | | | This reverts commit a47d369cafa270b93c6029eb18d7dbb22cc95645.
| | * | cgroup: Disable IRQs while holding css_set_lockDaniel Bristot de Oliveira2018-05-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While testing the deadline scheduler + cgroup setup I hit this warning. [ 132.612935] ------------[ cut here ]------------ [ 132.612951] WARNING: CPU: 5 PID: 0 at kernel/softirq.c:150 __local_bh_enable_ip+0x6b/0x80 [ 132.612952] Modules linked in: (a ton of modules...) [ 132.612981] CPU: 5 PID: 0 Comm: swapper/5 Not tainted 4.7.0-rc2 #2 [ 132.612981] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.2-20150714_191134- 04/01/2014 [ 132.612982] 0000000000000086 45c8bb5effdd088b ffff88013fd43da0 ffffffff813d229e [ 132.612984] 0000000000000000 0000000000000000 ffff88013fd43de0 ffffffff810a652b [ 132.612985] 00000096811387b5 0000000000000200 ffff8800bab29d80 ffff880034c54c00 [ 132.612986] Call Trace: [ 132.612987] <IRQ> [<ffffffff813d229e>] dump_stack+0x63/0x85 [ 132.612994] [<ffffffff810a652b>] __warn+0xcb/0xf0 [ 132.612997] [<ffffffff810e76a0>] ? push_dl_task.part.32+0x170/0x170 [ 132.612999] [<ffffffff810a665d>] warn_slowpath_null+0x1d/0x20 [ 132.613000] [<ffffffff810aba5b>] __local_bh_enable_ip+0x6b/0x80 [ 132.613008] [<ffffffff817d6c8a>] _raw_write_unlock_bh+0x1a/0x20 [ 132.613010] [<ffffffff817d6c9e>] _raw_spin_unlock_bh+0xe/0x10 [ 132.613015] [<ffffffff811388ac>] put_css_set+0x5c/0x60 [ 132.613016] [<ffffffff8113dc7f>] cgroup_free+0x7f/0xa0 [ 132.613017] [<ffffffff810a3912>] __put_task_struct+0x42/0x140 [ 132.613018] [<ffffffff810e776a>] dl_task_timer+0xca/0x250 [ 132.613027] [<ffffffff810e76a0>] ? push_dl_task.part.32+0x170/0x170 [ 132.613030] [<ffffffff8111371e>] __hrtimer_run_queues+0xee/0x270 [ 132.613031] [<ffffffff81113ec8>] hrtimer_interrupt+0xa8/0x190 [ 132.613034] [<ffffffff81051a58>] local_apic_timer_interrupt+0x38/0x60 [ 132.613035] [<ffffffff817d9b0d>] smp_apic_timer_interrupt+0x3d/0x50 [ 132.613037] [<ffffffff817d7c5c>] apic_timer_interrupt+0x8c/0xa0 [ 132.613038] <EOI> [<ffffffff81063466>] ? native_safe_halt+0x6/0x10 [ 132.613043] [<ffffffff81037a4e>] default_idle+0x1e/0xd0 [ 132.613044] [<ffffffff810381cf>] arch_cpu_idle+0xf/0x20 [ 132.613046] [<ffffffff810e8fda>] default_idle_call+0x2a/0x40 [ 132.613047] [<ffffffff810e92d7>] cpu_startup_entry+0x2e7/0x340 [ 132.613048] [<ffffffff81050235>] start_secondary+0x155/0x190 [ 132.613049] ---[ end trace f91934d162ce9977 ]--- The warn is the spin_(lock|unlock)_bh(&css_set_lock) in the interrupt context. Converting the spin_lock_bh to spin_lock_irq(save) to avoid this problem - and other problems of sharing a spinlock with an interrupt. Change-Id: I2064d3c21863e50ee1a70e57f7915d04f2ba0407 Cc: Tejun Heo <tj@kernel.org> Cc: Li Zefan <lizefan@huawei.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Juri Lelli <juri.lelli@arm.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: cgroups@vger.kernel.org Cc: stable@vger.kernel.org # 4.5+ Cc: linux-kernel@vger.kernel.org Reviewed-by: Rik van Riel <riel@redhat.com> Reviewed-by: "Luis Claudio R. Goncalves" <lgoncalv@redhat.com> Signed-off-by: Daniel Bristot de Oliveira <bristot@redhat.com> Acked-by: Zefan Li <lizefan@huawei.com> Signed-off-by: Tejun Heo <tj@kernel.org> Git-commit: 82d6489d0fed2ec8a8c48c19e8d8a04ac8e5bb26 Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git [runminw@codeaurora.org: resolve trivial merge conflicts] Signed-off-by: Runmin Wang <runminw@codeaurora.org>
* | | | audit: Checks valid value of audit_signals and tsk->audit_contextChetan C R2018-05-29
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There can be a case when current task's audit context may be NULL or even if it is not NULL, it can have invalid non-zero value of dummy variable and also we should audit the signal only if we have non-zero value of audit_signals. Issue has been seen during power on/off tests. So better to add explicit check on these variables. Change-Id: I2f3e17d933fca8e3b8f4013f44f942f11c68f440 Signed-off-by: Chetan C R <cravin@codeaurora.org>
* | | Merge android-4.4.132 (46155cc) into msm-4.4Srinivasarao P2018-05-22
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-46155cc Linux 4.4.132 perf/x86: Fix possible Spectre-v1 indexing for x86_pmu::event_map() perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[] perf/x86/msr: Fix possible Spectre-v1 indexing in the MSR driver perf/x86/cstate: Fix possible Spectre-v1 indexing for pkg_msr perf/x86: Fix possible Spectre-v1 indexing for hw_perf_event cache_* tracing/uprobe_event: Fix strncpy corner case Revert "Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174" atm: zatm: Fix potential Spectre v1 net: atm: Fix potential Spectre v1 can: kvaser_usb: Increase correct stats counter in kvaser_usb_rx_can_msg() tracing: Fix regex_match_front() to not over compare the test string libata: Apply NOLPM quirk for SanDisk SD7UB3Q*G1001 SSDs rfkill: gpio: fix memory leak in probe error path xfrm_user: fix return value from xfrm_user_rcv_msg f2fs: fix a dead loop in f2fs_fiemap() bdi: Fix oops in wb_workfn() tcp: fix TCP_REPAIR_QUEUE bound checking perf: Remove superfluous allocation error check soreuseport: initialise timewait reuseport field dccp: initialize ireq->ir_mark net: fix uninit-value in __hw_addr_add_ex() net: initialize skb->peeked when cloning net: fix rtnh_ok() netlink: fix uninit-value in netlink_sendmsg crypto: af_alg - fix possible uninit-value in alg_bind() ipvs: fix rtnl_lock lockups caused by start_sync_thread usb: musb: host: fix potential NULL pointer dereference USB: serial: option: adding support for ublox R410M USB: serial: option: reimplement interface masking USB: Accept bulk endpoints with 1024-byte maxpacket USB: serial: visor: handle potential invalid device configuration test_firmware: fix setting old custom fw path back on exit, second try drm/vmwgfx: Fix a buffer object leak IB/mlx5: Use unlimited rate when static rate is not supported NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2 RDMA/mlx5: Protect from shift operand overflow RDMA/ucma: Allow resolving address w/o specifying source address xfs: prevent creating negative-sized file via INSERT_RANGE Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro Input: leds - fix out of bound access tracepoint: Do not warn on ENOMEM ALSA: aloop: Add missing cable lock to ctl API callbacks ALSA: aloop: Mark paused device as inactive ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger() ALSA: pcm: Check PCM state at xfern compat ioctl USB: serial: option: Add support for Quectel EP06 gpmi-nand: Handle ECC Errors in erased pages ath10k: rebuild crypto header in rx data frames ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode mac80211: Add RX flag to indicate ICV stripped mac80211: allow same PN for AMSDU sub-frames mac80211: allow not sending MIC up from driver for HW crypto percpu: include linux/sched.h for cond_resched() KVM: s390: Enable all facility bits that are known good for passthrough bpf: map_get_next_key to return first key on NULL perf/core: Fix the perf_cpu_time_max_percent check goldfish: pipe: ANDROID: mark local functions static Revert "goldfish: pipe: ANDROID: Allocate memory with GFP_KERNEL." UPSTREAM: ANDROID: binder: prevent transactions into own process. goldfish: pipe: ANDROID: Add DMA support UPSTREAM: f2fs: clear PageError on writepage - part 2 UPSTREAM: f2fs: avoid fsync() failure caused by EAGAIN in writepage() ANDROID: build.config: enforce trace_printk check ANDROID: x86_64_cuttlefish_defconfig: Disable KPTI UPSTREAM: mac80211: ibss: Fix channel type enum in ieee80211_sta_join_ibss() UPSTREAM: mac80211: Fix clang warning about constant operand in logical operation UPSTREAM: nl80211: Fix enum type of variable in nl80211_put_sta_rate() UPSTREAM: sysfs: remove signedness from sysfs_get_dirent UPSTREAM: tracing: Use cpumask_available() to check if cpumask variable may be used BACKPORT: clocksource: Use GENMASK_ULL in definition of CLOCKSOURCE_MASK UPSTREAM: netpoll: Fix device name check in netpoll_setup() FROMLIST: staging: Fix sparse warnings in vsoc driver. FROMLIST: staging: vsoc: Fix a i386-randconfig warning. FROMLIST: staging: vsoc: Create wc kernel mapping for region shm. Revert "goldfish: pipe: ANDROID: remove a redundant target" goldfish: pipe: ANDROID: Replace writel with gf_write_ptr goldfish: pipe: ANDROID: Use dev_ logging instead of pr_ goldfish: pipe: ANDROID: fix checkpatch warnings goldfish: pipe: ANDROID: Update module license Conflicts: drivers/net/wireless/ath/ath10k/core.c drivers/net/wireless/ath/ath10k/core.h drivers/net/wireless/ath/ath10k/htt_rx.c Change-Id: If2ede1dea6a07b3fd498724e83071fd547170e1c [spathi@codeaurora.org: resolved compilation errors in ath10k by rebuilding crypto header in rx data frames] Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | Merge 4.4.132 into android-4.4Greg Kroah-Hartman2018-05-16
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.132 perf/core: Fix the perf_cpu_time_max_percent check bpf: map_get_next_key to return first key on NULL KVM: s390: Enable all facility bits that are known good for passthrough percpu: include linux/sched.h for cond_resched() mac80211: allow not sending MIC up from driver for HW crypto mac80211: allow same PN for AMSDU sub-frames mac80211: Add RX flag to indicate ICV stripped ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode ath10k: rebuild crypto header in rx data frames gpmi-nand: Handle ECC Errors in erased pages USB: serial: option: Add support for Quectel EP06 ALSA: pcm: Check PCM state at xfern compat ioctl ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger() ALSA: aloop: Mark paused device as inactive ALSA: aloop: Add missing cable lock to ctl API callbacks tracepoint: Do not warn on ENOMEM Input: leds - fix out of bound access Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro xfs: prevent creating negative-sized file via INSERT_RANGE RDMA/ucma: Allow resolving address w/o specifying source address RDMA/mlx5: Protect from shift operand overflow NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2 IB/mlx5: Use unlimited rate when static rate is not supported drm/vmwgfx: Fix a buffer object leak test_firmware: fix setting old custom fw path back on exit, second try USB: serial: visor: handle potential invalid device configuration USB: Accept bulk endpoints with 1024-byte maxpacket USB: serial: option: reimplement interface masking USB: serial: option: adding support for ublox R410M usb: musb: host: fix potential NULL pointer dereference ipvs: fix rtnl_lock lockups caused by start_sync_thread crypto: af_alg - fix possible uninit-value in alg_bind() netlink: fix uninit-value in netlink_sendmsg net: fix rtnh_ok() net: initialize skb->peeked when cloning net: fix uninit-value in __hw_addr_add_ex() dccp: initialize ireq->ir_mark soreuseport: initialise timewait reuseport field perf: Remove superfluous allocation error check tcp: fix TCP_REPAIR_QUEUE bound checking bdi: Fix oops in wb_workfn() f2fs: fix a dead loop in f2fs_fiemap() xfrm_user: fix return value from xfrm_user_rcv_msg rfkill: gpio: fix memory leak in probe error path libata: Apply NOLPM quirk for SanDisk SD7UB3Q*G1001 SSDs tracing: Fix regex_match_front() to not over compare the test string can: kvaser_usb: Increase correct stats counter in kvaser_usb_rx_can_msg() net: atm: Fix potential Spectre v1 atm: zatm: Fix potential Spectre v1 Revert "Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174" tracing/uprobe_event: Fix strncpy corner case perf/x86: Fix possible Spectre-v1 indexing for hw_perf_event cache_* perf/x86/cstate: Fix possible Spectre-v1 indexing for pkg_msr perf/x86/msr: Fix possible Spectre-v1 indexing in the MSR driver perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[] perf/x86: Fix possible Spectre-v1 indexing for x86_pmu::event_map() Linux 4.4.132 Change-Id: I66c21e374dff5a5735f1c5958021612387c635bf Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[]Peter Zijlstra2018-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 4411ec1d1993e8dbff2898390e3fed280d88e446 upstream. > kernel/events/ring_buffer.c:871 perf_mmap_to_page() warn: potential spectre issue 'rb->aux_pages' Userspace controls @pgoff through the fault address. Sanitize the array index before doing the array dereference. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: <stable@kernel.org> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Vince Weaver <vincent.weaver@maine.edu> Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * tracing/uprobe_event: Fix strncpy corner caseMasami Hiramatsu2018-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 50268a3d266ecfdd6c5873d62b2758d9732fc598 upstream. Fix string fetch function to terminate with NUL. It is OK to drop the rest of string. Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Song Liu <songliubraving@fb.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: security@kernel.org Cc: 范龙飞 <long7573@126.com> Fixes: 5baaa59ef09e ("tracing/probes: Implement 'memory' fetch method for uprobes") Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * tracing: Fix regex_match_front() to not over compare the test stringSteven Rostedt (VMware)2018-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit dc432c3d7f9bceb3de6f5b44fb9c657c9810ed6d upstream. The regex match function regex_match_front() in the tracing filter logic, was fixed to test just the pattern length from testing the entire test string. That is, it went from strncmp(str, r->pattern, len) to strcmp(str, r->pattern, r->len). The issue is that str is not guaranteed to be nul terminated, and if r->len is greater than the length of str, it can access more memory than is allocated. The solution is to add a simple test if (len < r->len) return 0. Cc: stable@vger.kernel.org Fixes: 285caad415f45 ("tracing/filters: Fix MATCH_FRONT_ONLY filter matching") Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * perf: Remove superfluous allocation error checkJiri Olsa2018-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit bfb3d7b8b906b66551424d7636182126e1d134c8 upstream. If the get_callchain_buffers fails to allocate the buffer it will decrease the nr_callchain_events right away. There's no point of checking the allocation error for nr_callchain_events > 1. Removing that check. Signed-off-by: Jiri Olsa <jolsa@kernel.org> Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Andi Kleen <andi@firstfloor.org> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: syzkaller-bugs@googlegroups.com Cc: x86@kernel.org Link: http://lkml.kernel.org/r/20180415092352.12403-3-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * tracepoint: Do not warn on ENOMEMMathieu Desnoyers2018-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit d66a270be3310d7aa132fec0cea77d3d32a0ff75 upstream. Tracepoint should only warn when a kernel API user does not respect the required preconditions (e.g. same tracepoint enabled twice, or called to remove a tracepoint that does not exist). Silence warning in out-of-memory conditions, given that the error is returned to the caller. This ensures that out-of-memory error-injection testing does not trigger warnings in tracepoint.c, which were seen by syzbot. Link: https://lkml.kernel.org/r/001a114465e241a8720567419a72@google.com Link: https://lkml.kernel.org/r/001a1140e0de15fc910567464190@google.com Link: http://lkml.kernel.org/r/20180315124424.32319-1-mathieu.desnoyers@efficios.com CC: Peter Zijlstra <peterz@infradead.org> CC: Jiri Olsa <jolsa@redhat.com> CC: Arnaldo Carvalho de Melo <acme@kernel.org> CC: Alexander Shishkin <alexander.shishkin@linux.intel.com> CC: Namhyung Kim <namhyung@kernel.org> CC: stable@vger.kernel.org Fixes: de7b2973903c6 ("tracepoint: Use struct pointer instead of name hash for reg/unreg tracepoints") Reported-by: syzbot+9c0d616860575a73166a@syzkaller.appspotmail.com Reported-by: syzbot+4e9ae7fa46233396f64d@syzkaller.appspotmail.com Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * bpf: map_get_next_key to return first key on NULLTeng Qin2018-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 8fe45924387be6b5c1be59a7eb330790c61d5d10 upstream. When iterating through a map, we need to find a key that does not exist in the map so map_get_next_key will give us the first key of the map. This often requires a lot of guessing in production systems. This patch makes map_get_next_key return the first key when the key pointer in the parameter is NULL. Signed-off-by: Teng Qin <qinteng@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chenbo Feng <fengc@google.com> Cc: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * perf/core: Fix the perf_cpu_time_max_percent checkTan Xiaojun2018-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 1572e45a924f254d9570093abde46430c3172e3d upstream. Use "proc_dointvec_minmax" instead of "proc_dointvec" to check the input value from user-space. If not, we can set a big value and some vars will overflow like "sysctl_perf_event_sample_rate" which will cause a lot of unexpected problems. Signed-off-by: Tan Xiaojun <tanxiaojun@huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: <acme@kernel.org> Cc: <alexander.shishkin@linux.intel.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Vince Weaver <vincent.weaver@maine.edu> Link: http://lkml.kernel.org/r/1487829879-56237-1-git-send-email-tanxiaojun@huawei.com Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | UPSTREAM: tracing: Use cpumask_available() to check if cpumask variable may ↵Matthias Kaehlcke2018-05-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | be used This fixes the following clang warning: kernel/trace/trace.c:3231:12: warning: address of array 'iter->started' will always evaluate to 'true' [-Wpointer-bool-conversion] if (iter->started) Link: http://lkml.kernel.org/r/20170421234110.117075-1-mka@chromium.org Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> (cherry picked from commit 4dbbe2d8e95c351157f292ece067f985c30c7b53) Bug: 78886293 Change-Id: Ib17a68ce55ca80b04bdea2d232f8ca9f88b1b8a3 Signed-off-by: Alistair Strachan <astrachan@google.com>
* | | Merge "Merge android-4.4.131 (d5d6526) into msm-4.4"Linux Build Service Account2018-05-10
|\ \ \
| * | | Merge android-4.4.131 (d5d6526) into msm-4.4Srinivasarao P2018-05-03
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-d5d6526 Linux 4.4.131 serial: mctrl_gpio: Add missing module license serial: mctrl_gpio: export mctrl_gpio_disable_ms and mctrl_gpio_init x86/smpboot: Don't use mwait_play_dead() on AMD systems x86/ipc: Fix x32 version of shmid64_ds and msqid64_ds libceph: validate con->state at the top of try_write() ASoC: fsl_esai: Fix divisor calculation failure at lower ratio ARM: amba: Don't read past the end of sysfs "driver_override" buffer ARM: amba: Fix race condition with driver_override ARM: amba: Make driver_override output consistent with other buses scsi: sd: Defer spinning up drive while SANITIZE is in progress kobject: don't use WARN for registration failures mtd: cfi: cmdset_0002: Do not allow read/write to suspend erase block. mtd: cfi: cmdset_0001: Workaround Micron Erase suspend bug. mtd: cfi: cmdset_0001: Do not allow read/write to suspend erase block. ALSA: hda/realtek - Add some fixes for ALC233 ALSA: hda: Hardening for potential Spectre v1 ALSA: seq: oss: Hardening for potential Spectre v1 ALSA: seq: oss: Fix unbalanced use lock for synth MIDI device ALSA: core: Report audio_tstamp in snd_pcm_sync_ptr ALSA: control: Hardening for potential Spectre v1 ALSA: rme9652: Hardening for potential Spectre v1 ALSA: hdspm: Hardening for potential Spectre v1 ALSA: asihpi: Hardening for potential Spectre v1 ALSA: opl3: Hardening for potential Spectre v1 tty: Use __GFP_NOFAIL for tty_ldisc_get() tty: n_gsm: Fix DLCI handling for ADM mode if debug & 2 is not set tty: n_gsm: Fix long delays with control frame timeouts in ADM mode tty: Don't call panic() at tty_ldisc_init() drm/virtio: fix vq wait_event condition virtio_console: free buffers after reset virtio: add ability to iterate over vqs ALSA: usb-audio: Skip broken EU on Dell dock USB-audio USB: Increment wakeup count on remote wakeup. usb: core: Add quirk for HP v222w 16GB Mini USB: serial: cp210x: add ID for NI USB serial console USB: serial: ftdi_sio: use jtag quirk for Arrow USB Blaster USB: serial: simple: add libtransistor console usbip: vhci_hcd: Fix usb device and sockfd leaks usbip: usbip_host: fix to hold parent lock for device_attach() calls ext4: fix bitmap position validation ext4: add validity checks for bitmap block numbers ext4: set h_journal if there is a failure starting a reserved handle ext4: prevent right-shifting extents beyond EXT_MAX_BLOCKS goldfish: pipe: ANDROID: Allocate memory with GFP_KERNEL. goldfish: pipe: ANDROID: Do not crash goldfish: pipe: ANDROID: remove redundant casting goldfish: pipe: ANDROID: Add 'pipe' to pipe functions goldfish: pipe: ANDROID: fix whitespace goldfish: pipe: ANDROID: rename global variables goldfish: pipe: ANDROID: remove a redundant target goldfish: pipe: ANDROID: add blank lines goldfish: pipe: ANDROID: replace 'BUG_ON' with 'BUILD_BUG_ON' goldfish: pipe: ANDROID: use the 'BIT' macro for wakeup flags goldfish: pipe: ANDROID: fix logging format strings Linux 4.4.130 s390/uprobes: implement arch_uretprobe_is_alive() s390/cio: update chpid descriptor after resource accessibility event cdrom: information leak in cdrom_ioctl_media_changed() scsi: mptsas: Disable WRITE SAME ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy net: af_packet: fix race in PACKET_{R|T}X_RING tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets net: fix deadlock while clearing neighbor proxy table tipc: add policy for TIPC_NLA_NET_ADDR llc: fix NULL pointer deref for SOCK_ZAPPED llc: hold llc_sap before release_sock() sctp: do not check port in sctp_inet6_cmp_addr vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi pppoe: check sockaddr length in pppoe_connect() packet: fix bitfield update race team: fix netconsole setup over team team: avoid adding twice the same option to the event list tcp: don't read out-of-bounds opsize llc: delete timers synchronously in llc_sk_free() net: validate attribute sizes in neigh_dump_table() l2tp: check sockaddr length in pppol2tp_connect() KEYS: DNS: limit the length of option strings bonding: do not set slave_dev npinfo before slave_enable_netpoll in bond_enslave s390: correct module section names for expoline code revert s390: correct nospec auto detection init order s390: add sysfs attributes for spectre s390: report spectre mitigation via syslog s390: add automatic detection of the spectre defense s390: move nobp parameter functions to nospec-branch.c s390/entry.S: fix spurious zeroing of r0 s390: do not bypass BPENTER for interrupt system calls s390: Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) s390: introduce execute-trampolines for branches s390: run user space and KVM guests with modified branch prediction s390: add options to change branch prediction behaviour for the kernel s390/alternative: use a copy of the facility bit mask s390: add optimized array_index_mask_nospec s390: scrub registers on kernel entry and KVM exit KVM: s390: wire up bpb feature s390: enable CPU alternatives unconditionally s390: introduce CPU alternatives Revert "ath10k: send (re)assoc peer command when NSS changed" jbd2: fix use after free in kjournald2() ath9k_hw: check if the chip failed to wake up Input: drv260x - fix initializing overdrive voltage r8152: add Linksys USB3GIGV1 id staging: ion : Donnot wakeup kswapd in ion system alloc perf: Return proper values for user stack errors x86/tsc: Prevent 32bit truncation in calc_hpet_ref() cifs: do not allow creating sockets except with SMB1 posix exensions UPSTREAM: tracing: always define trace_{irq,preempt}_{enable_disable} ANDROID: staging: ion: Obey kptr_restrict ANDROID: sdcardfs: Set s_root to NULL after putting ANDROID: sdcardfs: d_make_root calls iput ANDROID: sdcardfs: Check for private data earlier Conflicts: drivers/staging/android/ion/ion.c drivers/staging/android/ion/ion_cma_heap.c drivers/staging/android/ion/ion_system_heap.c Change-Id: I8155103b3787bb800f85291cc7378a8e29a8436f Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| | * | Merge 4.4.130 into android-4.4Greg Kroah-Hartman2018-04-30
| | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.130 cifs: do not allow creating sockets except with SMB1 posix exensions x86/tsc: Prevent 32bit truncation in calc_hpet_ref() perf: Return proper values for user stack errors staging: ion : Donnot wakeup kswapd in ion system alloc r8152: add Linksys USB3GIGV1 id Input: drv260x - fix initializing overdrive voltage ath9k_hw: check if the chip failed to wake up jbd2: fix use after free in kjournald2() Revert "ath10k: send (re)assoc peer command when NSS changed" s390: introduce CPU alternatives s390: enable CPU alternatives unconditionally KVM: s390: wire up bpb feature s390: scrub registers on kernel entry and KVM exit s390: add optimized array_index_mask_nospec s390/alternative: use a copy of the facility bit mask s390: add options to change branch prediction behaviour for the kernel s390: run user space and KVM guests with modified branch prediction s390: introduce execute-trampolines for branches s390: Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) s390: do not bypass BPENTER for interrupt system calls s390/entry.S: fix spurious zeroing of r0 s390: move nobp parameter functions to nospec-branch.c s390: add automatic detection of the spectre defense s390: report spectre mitigation via syslog s390: add sysfs attributes for spectre s390: correct nospec auto detection init order s390: correct module section names for expoline code revert bonding: do not set slave_dev npinfo before slave_enable_netpoll in bond_enslave KEYS: DNS: limit the length of option strings l2tp: check sockaddr length in pppol2tp_connect() net: validate attribute sizes in neigh_dump_table() llc: delete timers synchronously in llc_sk_free() tcp: don't read out-of-bounds opsize team: avoid adding twice the same option to the event list team: fix netconsole setup over team packet: fix bitfield update race pppoe: check sockaddr length in pppoe_connect() vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi sctp: do not check port in sctp_inet6_cmp_addr llc: hold llc_sap before release_sock() llc: fix NULL pointer deref for SOCK_ZAPPED tipc: add policy for TIPC_NLA_NET_ADDR net: fix deadlock while clearing neighbor proxy table tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets net: af_packet: fix race in PACKET_{R|T}X_RING ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy scsi: mptsas: Disable WRITE SAME cdrom: information leak in cdrom_ioctl_media_changed() s390/cio: update chpid descriptor after resource accessibility event s390/uprobes: implement arch_uretprobe_is_alive() Linux 4.4.130 Change-Id: I58646180c70ac61da3e2a602085760881d914eb5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | | * perf: Return proper values for user stack errorsJiri Olsa2018-04-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 78b562fbfa2cf0a9fcb23c3154756b690f4905c1 upstream. Return immediately when we find issue in the user stack checks. The error value could get overwritten by following check for PERF_SAMPLE_REGS_INTR. Signed-off-by: Jiri Olsa <jolsa@kernel.org> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Andi Kleen <andi@firstfloor.org> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: syzkaller-bugs@googlegroups.com Cc: x86@kernel.org Fixes: 60e2364e60e8 ("perf: Add ability to sample machine state on interrupt") Link: http://lkml.kernel.org/r/20180415092352.12403-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | | Merge "taskstats: fix the length of cgroupstats_cmd_get_policy"Linux Build Service Account2018-05-07
|\ \ \ \
| * | | | taskstats: fix the length of cgroupstats_cmd_get_policyWANG Cong2018-05-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | cgroupstats_cmd_get_policy is [CGROUPSTATS_CMD_ATTR_MAX+1], taskstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1], but their family.maxattr is TASKSTATS_CMD_ATTR_MAX. CGROUPSTATS_CMD_ATTR_MAX is less than TASKSTATS_CMD_ATTR_MAX, so we could end up accessing out-of-bound. Change cgroupstats_cmd_get_policy to TASKSTATS_CMD_ATTR_MAX+1, this is safe because the rest are initialized to 0's. Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Git-commit: 243d52126184b072a18fe2130ce0008f8aa3a340 Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Change-Id: Ie03c41de881d8e0e88ba35f5369e4e955d8d8682 CRs-Fixed: 2234354 Signed-off-by: Jeff Johnson <jjohnson@codeaurora.org>
* | | | | Merge "sched/walt: Fix use after free in trace_sched_update_task_ravg()"Linux Build Service Account2018-05-03
|\ \ \ \ \ | |/ / / / |/| | | |
| * | | | sched/walt: Fix use after free in trace_sched_update_task_ravg()Pavankumar Kondeti2018-05-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 4d09122c1868 ("sched: Fix spinlock recursion in sched_exit()") moved freeing of task's current and previous window arrays outside the rq->lock. These arrays can be accessed from another CPU in parallel and end up using freed memory. For example, CPU#0 CPU#1 ---------------------------------- ------------------------------- sched_exit() try_to_wake_up()--> The task wakes up on CPU#0 task_rq_lock() set_task_cpu() fixup_busy_time() --> waiting for CPU#0's rq->lock task_rq_unlock() fixup_busy_time()-->lock acquired free_task_load_ptrs() kfree(p->ravg.curr_window_cpu) update_task_ravg()-->called on current of CPU#0 trace_sched_update_task_ravg() --> access freed memory p->ravg.curr_window_cpu = NULL; To fix this issue, window array pointers must be set to NULL before freeing the memory. Since this happens outside the lock, memory barriers are needed on write and read paths. A much simpler alternative would be skipping update_task_ravg() trace point for tasks that are marked as dead. The window stats of dead tasks are not updated any ways. While at it, skip this trace point for newly created tasks for which also window stats are not updated. Change-Id: I4d7cb8a3cf7cf84270b09721140d35205643b7ab Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org> [spathi@codeaurora.org: moved changes to hmp.c since EAS is not supported] Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
* | | | | Merge "defconfig: Enable preemptirq tracing for msm8998 and sdm660"Linux Build Service Account2018-05-03
|\ \ \ \ \ | |_|/ / / |/| | | |
| * | | | trace/irq: Add trace point to track IRQs disable callersPavankumar Kondeti2018-04-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add trace point to track IRQs disable callers to isolate issues unrelated to scheduler and improve debug turn around time. Change-Id: Ib1ef45d8bed1fc0e128b5ab2051f0c30e8c50ee7 Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org> Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org> Signed-off-by: Lingutla Chandrasekhar <clingutla@codeaurora.org>
| * | | | sched: Add trace point to track preemption disable callersPavankumar Kondeti2018-04-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add trace point to track preemption disable callers to isolate issues unrelated to scheduler and improve debug turn around time. Change-Id: If9303b7165167e8f79cd339929daf4afc31a61c4 Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org> Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org> Signed-off-by: Lingutla Chandrasekhar <clingutla@codeaurora.org>
* | | | | Merge android-4.4.129 (b1c4836) into msm-4.4Srinivasarao P2018-04-24
|\ \ \ \ \ | |_|/ / / |/| | / / | | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-b1c4836 Linux 4.4.129 writeback: safer lock nesting fanotify: fix logic of events on child ext4: bugfix for mmaped pages in mpage_release_unused_pages() mm/filemap.c: fix NULL pointer in page_cache_tree_insert() mm: allow GFP_{FS,IO} for page_cache_read page cache allocation autofs: mount point create should honour passed in mode Don't leak MNT_INTERNAL away from internal mounts rpc_pipefs: fix double-dput() hypfs_kill_super(): deal with failed allocations jffs2_kill_sb(): deal with failed allocations powerpc/lib: Fix off-by-one in alternate feature patching powerpc/eeh: Fix enabling bridge MMIO windows MIPS: memset.S: Fix clobber of v1 in last_fixup MIPS: memset.S: Fix return of __clear_user from Lpartial_fixup MIPS: memset.S: EVA & fault support for small_memset MIPS: uaccess: Add micromips clobbers to bzero invocation HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device ALSA: hda - New VIA controller suppor no-snoop path ALSA: rawmidi: Fix missing input substream checks in compat ioctls ALSA: line6: Use correct endpoint type for midi output ext4: fix deadlock between inline_data and ext4_expand_extra_isize_ea() ext4: fix crashes in dioread_nolock mode drm/radeon: Fix PCIe lane width calculation ext4: don't allow r/w mounts if metadata blocks overlap the superblock vfio/pci: Virtualize Maximum Read Request Size vfio/pci: Virtualize Maximum Payload Size vfio-pci: Virtualize PCIe & AF FLR ALSA: pcm: Fix endless loop for XRUN recovery in OSS emulation ALSA: pcm: Fix mutex unbalance in OSS emulation ioctls ALSA: pcm: Return -EBUSY for OSS ioctls changing busy streams ALSA: pcm: Avoid potential races between OSS ioctls and read/write ALSA: pcm: Use ERESTARTSYS instead of EINTR in OSS emulation ALSA: oss: consolidate kmalloc/memset 0 call to kzalloc watchdog: f71808e_wdt: Fix WD_EN register read thermal: imx: Fix race condition in imx_thermal_probe() clk: bcm2835: De-assert/assert PLL reset signal when appropriate clk: mvebu: armada-38x: add support for missing clocks clk: mvebu: armada-38x: add support for 1866MHz variants mmc: jz4740: Fix race condition in IRQ mask update iommu/vt-d: Fix a potential memory leak um: Use POSIX ucontext_t instead of struct ucontext dmaengine: at_xdmac: fix rare residue corruption IB/srp: Fix completion vector assignment algorithm IB/srp: Fix srp_abort() ALSA: pcm: Fix UAF at PCM release via PCM timer access RDMA/ucma: Don't allow setting RDMA_OPTION_IB_PATH without an RDMA device ext4: fail ext4_iget for root directory if unallocated ext4: don't update checksum of new initialized bitmaps jbd2: if the journal is aborted then don't allow update of the log tail random: use a tighter cap in credit_entropy_bits_safe() thunderbolt: Resume control channel after hibernation image is created ASoC: ssm2602: Replace reg_default_raw with reg_default HID: core: Fix size as type u32 HID: Fix hid_report_len usage powerpc/powernv: Fix OPAL NVRAM driver OPAL_BUSY loops powerpc/powernv: define a standard delay for OPAL_BUSY type retry loops powerpc/64: Fix smp_wmb barrier definition use use lwsync consistently powerpc/powernv: Handle unknown OPAL errors in opal_nvram_write() HID: i2c-hid: fix size check and type usage usb: dwc3: pci: Properly cleanup resource USB:fix USB3 devices behind USB3 hubs not resuming at hibernate thaw ACPI / hotplug / PCI: Check presence of slot itself in get_slot_status() ACPI / video: Add quirk to force acpi-video backlight on Samsung 670Z5E regmap: Fix reversed bounds check in regmap_raw_write() xen-netfront: Fix hang on device removal ARM: dts: at91: sama5d4: fix pinctrl compatible string ARM: dts: at91: at91sam9g25: fix mux-mask pinctrl property usb: musb: gadget: misplaced out of bounds check mm, slab: reschedule cache_reap() on the same CPU ipc/shm: fix use-after-free of shm file via remap_file_pages() resource: fix integer overflow at reallocation fs/reiserfs/journal.c: add missing resierfs_warning() arg ubi: Reject MLC NAND ubi: Fix error for write access ubi: fastmap: Don't flush fastmap work on detach ubifs: Check ubifs_wbuf_sync() return code tty: make n_tty_read() always abort if hangup is in progress x86/hweight: Don't clobber %rdi x86/hweight: Get rid of the special calling convention lan78xx: Correctly indicate invalid OTP slip: Check if rstate is initialized before uncompressing cdc_ether: flag the Cinterion AHS8 modem by gemalto as WWAN hwmon: (ina2xx) Fix access to uninitialized mutex rtl8187: Fix NULL pointer dereference in priv->conf_mutex getname_kernel() needs to make sure that ->name != ->iname in long case s390/ipl: ensure loadparm valid flag is set s390/qdio: don't merge ERROR output buffers s390/qdio: don't retry EQBS after CCQ 96 block/loop: fix deadlock after loop_set_status Revert "perf tests: Decompress kernel module before objdump" radeon: hide pointless #warning when compile testing perf intel-pt: Fix timestamp following overflow perf intel-pt: Fix error recovery from missing TIP packet perf intel-pt: Fix sync_switch perf intel-pt: Fix overlap detection to identify consecutive buffers correctly parisc: Fix out of array access in match_pci_device() media: v4l2-compat-ioctl32: don't oops on overlay f2fs: check cap_resource only for data blocks Revert "f2fs: introduce f2fs_set_page_dirty_nobuffer" f2fs: clear PageError on writepage UPSTREAM: timer: Export destroy_hrtimer_on_stack() BACKPORT: dm verity: add 'check_at_most_once' option to only validate hashes once f2fs: call unlock_new_inode() before d_instantiate() f2fs: refactor read path to allow multiple postprocessing steps fscrypt: allow synchronous bio decryption Change-Id: I45f4ac10734d92023b53118d83dcd6c83974a283 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | | Merge 4.4.129 into android-4.4Greg Kroah-Hartman2018-04-24
| |\ \ \ | | | |/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.129 media: v4l2-compat-ioctl32: don't oops on overlay parisc: Fix out of array access in match_pci_device() perf intel-pt: Fix overlap detection to identify consecutive buffers correctly perf intel-pt: Fix sync_switch perf intel-pt: Fix error recovery from missing TIP packet perf intel-pt: Fix timestamp following overflow radeon: hide pointless #warning when compile testing Revert "perf tests: Decompress kernel module before objdump" block/loop: fix deadlock after loop_set_status s390/qdio: don't retry EQBS after CCQ 96 s390/qdio: don't merge ERROR output buffers s390/ipl: ensure loadparm valid flag is set getname_kernel() needs to make sure that ->name != ->iname in long case rtl8187: Fix NULL pointer dereference in priv->conf_mutex hwmon: (ina2xx) Fix access to uninitialized mutex cdc_ether: flag the Cinterion AHS8 modem by gemalto as WWAN slip: Check if rstate is initialized before uncompressing lan78xx: Correctly indicate invalid OTP x86/hweight: Get rid of the special calling convention x86/hweight: Don't clobber %rdi tty: make n_tty_read() always abort if hangup is in progress ubifs: Check ubifs_wbuf_sync() return code ubi: fastmap: Don't flush fastmap work on detach ubi: Fix error for write access ubi: Reject MLC NAND fs/reiserfs/journal.c: add missing resierfs_warning() arg resource: fix integer overflow at reallocation ipc/shm: fix use-after-free of shm file via remap_file_pages() mm, slab: reschedule cache_reap() on the same CPU usb: musb: gadget: misplaced out of bounds check ARM: dts: at91: at91sam9g25: fix mux-mask pinctrl property ARM: dts: at91: sama5d4: fix pinctrl compatible string xen-netfront: Fix hang on device removal regmap: Fix reversed bounds check in regmap_raw_write() ACPI / video: Add quirk to force acpi-video backlight on Samsung 670Z5E ACPI / hotplug / PCI: Check presence of slot itself in get_slot_status() USB:fix USB3 devices behind USB3 hubs not resuming at hibernate thaw usb: dwc3: pci: Properly cleanup resource HID: i2c-hid: fix size check and type usage powerpc/powernv: Handle unknown OPAL errors in opal_nvram_write() powerpc/64: Fix smp_wmb barrier definition use use lwsync consistently powerpc/powernv: define a standard delay for OPAL_BUSY type retry loops powerpc/powernv: Fix OPAL NVRAM driver OPAL_BUSY loops HID: Fix hid_report_len usage HID: core: Fix size as type u32 ASoC: ssm2602: Replace reg_default_raw with reg_default thunderbolt: Resume control channel after hibernation image is created random: use a tighter cap in credit_entropy_bits_safe() jbd2: if the journal is aborted then don't allow update of the log tail ext4: don't update checksum of new initialized bitmaps ext4: fail ext4_iget for root directory if unallocated RDMA/ucma: Don't allow setting RDMA_OPTION_IB_PATH without an RDMA device ALSA: pcm: Fix UAF at PCM release via PCM timer access IB/srp: Fix srp_abort() IB/srp: Fix completion vector assignment algorithm dmaengine: at_xdmac: fix rare residue corruption um: Use POSIX ucontext_t instead of struct ucontext iommu/vt-d: Fix a potential memory leak mmc: jz4740: Fix race condition in IRQ mask update clk: mvebu: armada-38x: add support for 1866MHz variants clk: mvebu: armada-38x: add support for missing clocks clk: bcm2835: De-assert/assert PLL reset signal when appropriate thermal: imx: Fix race condition in imx_thermal_probe() watchdog: f71808e_wdt: Fix WD_EN register read ALSA: oss: consolidate kmalloc/memset 0 call to kzalloc ALSA: pcm: Use ERESTARTSYS instead of EINTR in OSS emulation ALSA: pcm: Avoid potential races between OSS ioctls and read/write ALSA: pcm: Return -EBUSY for OSS ioctls changing busy streams ALSA: pcm: Fix mutex unbalance in OSS emulation ioctls ALSA: pcm: Fix endless loop for XRUN recovery in OSS emulation vfio-pci: Virtualize PCIe & AF FLR vfio/pci: Virtualize Maximum Payload Size vfio/pci: Virtualize Maximum Read Request Size ext4: don't allow r/w mounts if metadata blocks overlap the superblock drm/radeon: Fix PCIe lane width calculation ext4: fix crashes in dioread_nolock mode ext4: fix deadlock between inline_data and ext4_expand_extra_isize_ea() ALSA: line6: Use correct endpoint type for midi output ALSA: rawmidi: Fix missing input substream checks in compat ioctls ALSA: hda - New VIA controller suppor no-snoop path HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device MIPS: uaccess: Add micromips clobbers to bzero invocation MIPS: memset.S: EVA & fault support for small_memset MIPS: memset.S: Fix return of __clear_user from Lpartial_fixup MIPS: memset.S: Fix clobber of v1 in last_fixup powerpc/eeh: Fix enabling bridge MMIO windows powerpc/lib: Fix off-by-one in alternate feature patching jffs2_kill_sb(): deal with failed allocations hypfs_kill_super(): deal with failed allocations rpc_pipefs: fix double-dput() Don't leak MNT_INTERNAL away from internal mounts autofs: mount point create should honour passed in mode mm: allow GFP_{FS,IO} for page_cache_read page cache allocation mm/filemap.c: fix NULL pointer in page_cache_tree_insert() ext4: bugfix for mmaped pages in mpage_release_unused_pages() fanotify: fix logic of events on child writeback: safer lock nesting Linux 4.4.129 Change-Id: I8806d2cc92fe512f27a349e8f630ced0cac9a8d7 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | resource: fix integer overflow at reallocationTakashi Iwai2018-04-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 60bb83b81169820c691fbfa33a6a4aef32aa4b0b upstream. We've got a bug report indicating a kernel panic at booting on an x86-32 system, and it turned out to be the invalid PCI resource assigned after reallocation. __find_resource() first aligns the resource start address and resets the end address with start+size-1 accordingly, then checks whether it's contained. Here the end address may overflow the integer, although resource_contains() still returns true because the function validates only start and end address. So this ends up with returning an invalid resource (start > end). There was already an attempt to cover such a problem in the commit 47ea91b4052d ("Resource: fix wrong resource window calculation"), but this case is an overseen one. This patch adds the validity check of the newly calculated resource for avoiding the integer overflow problem. Bugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=1086739 Link: http://lkml.kernel.org/r/s5hpo37d5l8.wl-tiwai@suse.de Fixes: 23c570a67448 ("resource: ability to resize an allocated resource") Signed-off-by: Takashi Iwai <tiwai@suse.de> Reported-by: Michael Henders <hendersm@shaw.ca> Tested-by: Michael Henders <hendersm@shaw.ca> Reviewed-by: Andrew Morton <akpm@linux-foundation.org> Cc: Ram Pai <linuxram@us.ibm.com> Cc: Bjorn Helgaas <bhelgaas@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | | UPSTREAM: timer: Export destroy_hrtimer_on_stack()Guenter Roeck2018-04-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | hrtimer_init_on_stack() needs a matching call to destroy_hrtimer_on_stack(), so both need to be exported. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit c08376ac97cb202ec65320f3d90d5c4c5e2adb0b) [astrachan: Fixes i386-allmodconfig build failure in vsoc.ko noticed by 01.org kbuild-all project building kernel/msm] Bug: 78036828 Change-Id: If4d5c466255019322ea21ef38ee5b1b382cce969 Signed-off-by: Alistair Strachan <astrachan@google.com>
* | | | Merge android-4.4.128 (89904cc) into msm-4.4Srinivasarao P2018-04-20
|\| | | | |_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-89904cc ANDROID: Add build server config for cuttlefish. ANDROID: Add defconfig for cuttlefish. FROMLIST: staging: Android: Add 'vsoc' driver for cuttlefish. Revert "proc: make oom adjustment files user read-only" Revert "fixup! proc: make oom adjustment files user read-only" Linux 4.4.128 Revert "xhci: plat: Register shutdown for xhci_plat" vrf: Fix use after free and double free in vrf_finish_output ipv6: the entire IPv6 header chain must fit the first fragment net/ipv6: Increment OUTxxx counters after netfilter hook net sched actions: fix dumping which requires several messages to user space r8169: fix setting driver_data after register_netdev vti6: better validate user provided tunnel names ip6_tunnel: better validate user provided tunnel names ip6_gre: better validate user provided tunnel names ipv6: sit: better validate user provided tunnel names ip_tunnel: better validate user provided tunnel names net: fool proof dev_valid_name() bonding: process the err returned by dev_set_allmulti properly in bond_enslave bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave bonding: fix the err path for dev hwaddr sync in bond_enslave vlan: also check phy_driver ts_info for vlan's real device vhost: correctly remove wait queue during poll failure sky2: Increase D3 delay to sky2 stops working after suspend sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6 sctp: do not leak kernel memory to user space pptp: remove a buggy dst release in pptp_connect() net/sched: fix NULL dereference in the error path of tcf_bpf_init() netlink: make sure nladdr has correct size in netlink_connect() net/ipv6: Fix route leaking between VRFs net: fix possible out-of-bound read in skb_network_protocol() arp: fix arp_filter on l3slave devices Kbuild: provide a __UNIQUE_ID for clang futex: Remove requirement for lock_page() in get_futex_key() random: use lockless method of accessing and updating f->reg_idx virtio_net: check return value of skb_to_sgvec in one more location virtio_net: check return value of skb_to_sgvec always rxrpc: check return value of skb_to_sgvec always ipsec: check return value of skb_to_sgvec always perf tools: Fix copyfile_offset update of output offset cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages EDAC, mv64x60: Fix an error handling path tty: n_gsm: Allow ADM response in addition to UA for control dlci blk-mq: fix kernel oops in blk_mq_tag_idle() scsi: libsas: initialize sas_phy status according to response of DISCOVER scsi: libsas: fix error when getting phy events scsi: libsas: fix memory leak in sas_smp_get_phy_events() bcache: segregate flash only volume write streams bcache: stop writeback thread after detaching vxlan: dont migrate permanent fdb entries during learn s390/dasd: fix hanging safe offline ACPICA: Disassembler: Abort on an invalid/unknown AML opcode ACPICA: Events: Add runtime stub support for event APIs cpuidle: dt: Add missing 'of_node_put()' Bluetooth: Send HCI Set Event Mask Page 2 command only when needed iio: magnetometer: st_magn_spi: fix spi_device_id table sparc64: ldc abort during vds iso boot sctp: fix recursive locking warning in sctp_do_peeloff bnx2x: Allow vfs to disable txvlan offload xen: avoid type warning in xchg_xen_ulong skbuff: only inherit relevant tx_flags perf tests: Decompress kernel module before objdump net: emac: fix reset timeout with AR8035 phy Fix loop device flush before configure v3 MIPS: kprobes: flush_insn_slot should flush only if probe initialised MIPS: mm: adjust PKMAP location MIPS: mm: fixed mappings: correct initialisation perf/core: Correct event creation with PERF_FORMAT_GROUP e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails ARM: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support mceusb: sporadic RX truncation corruption fix cx25840: fix unchecked return values e1000e: fix race condition around skb_tstamp_tx() tags: honor COMPILED_SOURCE with apart output directory perf report: Ensure the perf DSO mapping matches what libdw sees perf header: Set proper module name when build-id event found net/mlx4: Check if Granular QoS per VF has been enabled before updating QP qos_vport net/mlx4: Fix the check in attaching steering rules sit: reload iphdr in ipip6_rcv skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow bio-integrity: Do not allocate integrity context for bio w/o data Fix serial console on SNI RM400 machines cxgb4: fix incorrect cim_la output for T6 drm/omap: fix tiled buffer stride calculations mISDN: Fix a sleep-in-atomic bug qlcnic: Fix a sleep-in-atomic bug in qlcnic_82xx_hw_write_wx_2M and qlcnic_82xx_hw_read_wx_2M perf trace: Add mmap alias for s390 powerpc/spufs: Fix coredump of SPU contexts clk: Fix __set_clk_rates error print-string clk: scpi: fix return type of __scpi_dvfs_round_rate KVM: SVM: do not zero out segment attributes if segment is unusable or not present net: freescale: fix potential null pointer dereference SUNRPC: ensure correct error is reported by xs_tcp_setup_socket() rtc: interface: Validate alarm-time before handling rollover rtc: opal: Handle disabled TPO in opal_get_tpo_time() cxgb4: FW upgrade fixes net/mlx5: avoid build warning for uniprocessor arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage dmaengine: imx-sdma: Handle return value of clk_prepare_enable powerpc/[booke|4xx]: Don't clobber TCR[WP] when setting TCR[DIE] ovl: filter trusted xattr for non-admin hdlcdrv: Fix divide by zero in hdlcdrv_ioctl wl1251: check return from call to wl1251_acx_arp_ip_filter ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()' gpio: label descriptors using the device name vfb: fix video mode and line_length being set when loaded scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag. scsi: libiscsi: Allow sd_shutdown on bad transport ASoC: Intel: cht_bsw_rt5645: Analog Mic support media: videobuf2-core: don't go out of the buffer range hwmon: (ina2xx) Make calibration register value fixed rds; Reset rs->rs_bound_addr in rds_add_bound() failure path l2tp: fix missing print session offset info perf probe: Add warning message if there is unexpected event name thermal: power_allocator: fix one race condition issue for thermal_instances list ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node net: llc: add lock_sock in llc_ui_bind to avoid a race condition KVM: nVMX: Fix handling of lmsw instruction bonding: Don't update slave->link until ready to commit Input: elan_i2c - clear INT before resetting controller net: move somaxconn init from sysctl code tcp: better validation of received ack sequences ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff() fix race in drivers/char/random.c:get_reg() scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats() ASoC: rsnd: SSI PIO adjust to 24bit mode pNFS/flexfiles: missing error code in ff_layout_alloc_lseg() netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize libceph: NULL deref on crush_decode() error path net: ieee802154: fix net_device reference release too early mlx5: fix bug reading rss_hash_type from CQE block: fix an error code in add_partition() selinux: do not check open permission on sockets net/mlx5: Tolerate irq_set_affinity_hint() failures sched/numa: Use down_read_trylock() for the mmap_sem leds: pca955x: Correct I2C Functionality ray_cs: Avoid reading past end of buffer ARM: davinci: da8xx: Create DSP device only when assigned memory md-cluster: fix potential lock issue in add_new_disk ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors iio: hi8435: cleanup reset gpio iio: hi8435: avoid garbage event at first enable xfrm: fix state migration copy replay sequence numbers selftests/powerpc: Fix TM resched DSCR test with some compilers ath5k: fix memory leak on buf on failed eeprom read powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash scsi: csiostor: fix use after free in csio_hw_use_fwconfig() sh_eth: Use platform device for printing before register_netdev() serial: sh-sci: Fix race condition causing garbage during shutdown serial: 8250: omap: Disable DMA for console UART USB: ene_usb6250: fix SCSI residue overwriting net: x25: fix one potential use-after-free issue USB: ene_usb6250: fix first command execution usb: chipidea: properly handle host or gadget initialization failure arp: honour gratuitous ARP _replies_ neighbour: update neigh timestamps iff update is effective ata: libahci: properly propagate return value of platform_get_irq() btrfs: fix incorrect error return ret being passed to mapping_set_error usb: dwc3: keystone: check return value async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome() ipv6: avoid dad-failures for addresses with NODAD ARM: dts: imx6qdl-wandboard: Fix audio channel swap x86/tsc: Provide 'tsc=unstable' boot parameter staging: wlan-ng: prism2mgmt.c: fixed a double endian conversion before calling hfa384x_drvr_setconfig16, also fixes relative sparse warning ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin PowerCap: Fix an error code in powercap_register_zone() bus: brcmstb_gisb: correct support for 64-bit address output bus: brcmstb_gisb: Use register offsets with writes too SMB2: Fix share type handling vmxnet3: ensure that adapter is in proper state during force_close KVM: PPC: Book3S PR: Check copy_to/from_user return values Input: elantech - force relative mode on a certain module Input: elan_i2c - check if device is there before really probing netxen_nic: set rcode to the return status from the call to netxen_issue_cmd net: qca_spi: Fix alignment issues in rx path blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split op CIFS: silence lockdep splat in cifs_relock_file() NFSv4.1: Work around a Linux server bug... net/mlx4_en: Avoid adding steering rules with invalid ring s390: move _text symbol to address higher than zero pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid() drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests lockd: fix lockd shutdown race net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control net: cdc_ncm: Fix TX zero padding ipmi_ssif: unlock on allocation failure qlge: Avoid reading past end of buffer bna: Avoid reading past end of buffer mac80211: bail out from prep_connection() if a reconfig is ongoing af_key: Fix slab-out-of-bounds in pfkey_compile_policy. IB/srpt: Fix abort handling NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic() rtc: snvs: fix an incorrect check of return value md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock cfg80211: make RATE_INFO_BW_20 the default ANDROID: proc: add null check in proc_uid_init f2fs/fscrypt: updates to v4.17-rc1 Reduce amount of casting in drivers/tty/goldfish.c. Conflicts: drivers/staging/android/Kconfig drivers/staging/android/Makefile Change-Id: Ic7aa3df76a0312b8d6d84f8a8e11e793311a239a Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | Merge 4.4.128 into android-4.4Greg Kroah-Hartman2018-04-14
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.128 cfg80211: make RATE_INFO_BW_20 the default md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock rtc: snvs: fix an incorrect check of return value x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic() NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION IB/srpt: Fix abort handling af_key: Fix slab-out-of-bounds in pfkey_compile_policy. mac80211: bail out from prep_connection() if a reconfig is ongoing bna: Avoid reading past end of buffer qlge: Avoid reading past end of buffer ipmi_ssif: unlock on allocation failure net: cdc_ncm: Fix TX zero padding net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control lockd: fix lockd shutdown race drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid() s390: move _text symbol to address higher than zero net/mlx4_en: Avoid adding steering rules with invalid ring NFSv4.1: Work around a Linux server bug... CIFS: silence lockdep splat in cifs_relock_file() blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split op net: qca_spi: Fix alignment issues in rx path netxen_nic: set rcode to the return status from the call to netxen_issue_cmd Input: elan_i2c - check if device is there before really probing Input: elantech - force relative mode on a certain module KVM: PPC: Book3S PR: Check copy_to/from_user return values vmxnet3: ensure that adapter is in proper state during force_close SMB2: Fix share type handling bus: brcmstb_gisb: Use register offsets with writes too bus: brcmstb_gisb: correct support for 64-bit address output PowerCap: Fix an error code in powercap_register_zone() ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin staging: wlan-ng: prism2mgmt.c: fixed a double endian conversion before calling hfa384x_drvr_setconfig16, also fixes relative sparse warning x86/tsc: Provide 'tsc=unstable' boot parameter ARM: dts: imx6qdl-wandboard: Fix audio channel swap ipv6: avoid dad-failures for addresses with NODAD async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome() usb: dwc3: keystone: check return value btrfs: fix incorrect error return ret being passed to mapping_set_error ata: libahci: properly propagate return value of platform_get_irq() neighbour: update neigh timestamps iff update is effective arp: honour gratuitous ARP _replies_ usb: chipidea: properly handle host or gadget initialization failure USB: ene_usb6250: fix first command execution net: x25: fix one potential use-after-free issue USB: ene_usb6250: fix SCSI residue overwriting serial: 8250: omap: Disable DMA for console UART serial: sh-sci: Fix race condition causing garbage during shutdown sh_eth: Use platform device for printing before register_netdev() scsi: csiostor: fix use after free in csio_hw_use_fwconfig() powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash ath5k: fix memory leak on buf on failed eeprom read selftests/powerpc: Fix TM resched DSCR test with some compilers xfrm: fix state migration copy replay sequence numbers iio: hi8435: avoid garbage event at first enable iio: hi8435: cleanup reset gpio ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors md-cluster: fix potential lock issue in add_new_disk ARM: davinci: da8xx: Create DSP device only when assigned memory ray_cs: Avoid reading past end of buffer leds: pca955x: Correct I2C Functionality sched/numa: Use down_read_trylock() for the mmap_sem net/mlx5: Tolerate irq_set_affinity_hint() failures selinux: do not check open permission on sockets block: fix an error code in add_partition() mlx5: fix bug reading rss_hash_type from CQE net: ieee802154: fix net_device reference release too early libceph: NULL deref on crush_decode() error path netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize pNFS/flexfiles: missing error code in ff_layout_alloc_lseg() ASoC: rsnd: SSI PIO adjust to 24bit mode scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats() fix race in drivers/char/random.c:get_reg() ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff() tcp: better validation of received ack sequences net: move somaxconn init from sysctl code Input: elan_i2c - clear INT before resetting controller bonding: Don't update slave->link until ready to commit KVM: nVMX: Fix handling of lmsw instruction net: llc: add lock_sock in llc_ui_bind to avoid a race condition ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node thermal: power_allocator: fix one race condition issue for thermal_instances list perf probe: Add warning message if there is unexpected event name l2tp: fix missing print session offset info rds; Reset rs->rs_bound_addr in rds_add_bound() failure path hwmon: (ina2xx) Make calibration register value fixed media: videobuf2-core: don't go out of the buffer range ASoC: Intel: cht_bsw_rt5645: Analog Mic support scsi: libiscsi: Allow sd_shutdown on bad transport scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag. vfb: fix video mode and line_length being set when loaded gpio: label descriptors using the device name ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()' wl1251: check return from call to wl1251_acx_arp_ip_filter hdlcdrv: Fix divide by zero in hdlcdrv_ioctl ovl: filter trusted xattr for non-admin powerpc/[booke|4xx]: Don't clobber TCR[WP] when setting TCR[DIE] dmaengine: imx-sdma: Handle return value of clk_prepare_enable arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage net/mlx5: avoid build warning for uniprocessor cxgb4: FW upgrade fixes rtc: opal: Handle disabled TPO in opal_get_tpo_time() rtc: interface: Validate alarm-time before handling rollover SUNRPC: ensure correct error is reported by xs_tcp_setup_socket() net: freescale: fix potential null pointer dereference KVM: SVM: do not zero out segment attributes if segment is unusable or not present clk: scpi: fix return type of __scpi_dvfs_round_rate clk: Fix __set_clk_rates error print-string powerpc/spufs: Fix coredump of SPU contexts perf trace: Add mmap alias for s390 qlcnic: Fix a sleep-in-atomic bug in qlcnic_82xx_hw_write_wx_2M and qlcnic_82xx_hw_read_wx_2M mISDN: Fix a sleep-in-atomic bug drm/omap: fix tiled buffer stride calculations cxgb4: fix incorrect cim_la output for T6 Fix serial console on SNI RM400 machines bio-integrity: Do not allocate integrity context for bio w/o data skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow sit: reload iphdr in ipip6_rcv net/mlx4: Fix the check in attaching steering rules net/mlx4: Check if Granular QoS per VF has been enabled before updating QP qos_vport perf header: Set proper module name when build-id event found perf report: Ensure the perf DSO mapping matches what libdw sees tags: honor COMPILED_SOURCE with apart output directory e1000e: fix race condition around skb_tstamp_tx() cx25840: fix unchecked return values mceusb: sporadic RX truncation corruption fix net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support ARM: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails perf/core: Correct event creation with PERF_FORMAT_GROUP MIPS: mm: fixed mappings: correct initialisation MIPS: mm: adjust PKMAP location MIPS: kprobes: flush_insn_slot should flush only if probe initialised Fix loop device flush before configure v3 net: emac: fix reset timeout with AR8035 phy perf tests: Decompress kernel module before objdump skbuff: only inherit relevant tx_flags xen: avoid type warning in xchg_xen_ulong bnx2x: Allow vfs to disable txvlan offload sctp: fix recursive locking warning in sctp_do_peeloff sparc64: ldc abort during vds iso boot iio: magnetometer: st_magn_spi: fix spi_device_id table Bluetooth: Send HCI Set Event Mask Page 2 command only when needed cpuidle: dt: Add missing 'of_node_put()' ACPICA: Events: Add runtime stub support for event APIs ACPICA: Disassembler: Abort on an invalid/unknown AML opcode s390/dasd: fix hanging safe offline vxlan: dont migrate permanent fdb entries during learn bcache: stop writeback thread after detaching bcache: segregate flash only volume write streams scsi: libsas: fix memory leak in sas_smp_get_phy_events() scsi: libsas: fix error when getting phy events scsi: libsas: initialize sas_phy status according to response of DISCOVER blk-mq: fix kernel oops in blk_mq_tag_idle() tty: n_gsm: Allow ADM response in addition to UA for control dlci EDAC, mv64x60: Fix an error handling path cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages perf tools: Fix copyfile_offset update of output offset ipsec: check return value of skb_to_sgvec always rxrpc: check return value of skb_to_sgvec always virtio_net: check return value of skb_to_sgvec always virtio_net: check return value of skb_to_sgvec in one more location random: use lockless method of accessing and updating f->reg_idx futex: Remove requirement for lock_page() in get_futex_key() Kbuild: provide a __UNIQUE_ID for clang arp: fix arp_filter on l3slave devices net: fix possible out-of-bound read in skb_network_protocol() net/ipv6: Fix route leaking between VRFs netlink: make sure nladdr has correct size in netlink_connect() net/sched: fix NULL dereference in the error path of tcf_bpf_init() pptp: remove a buggy dst release in pptp_connect() sctp: do not leak kernel memory to user space sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6 sky2: Increase D3 delay to sky2 stops working after suspend vhost: correctly remove wait queue during poll failure vlan: also check phy_driver ts_info for vlan's real device bonding: fix the err path for dev hwaddr sync in bond_enslave bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave bonding: process the err returned by dev_set_allmulti properly in bond_enslave net: fool proof dev_valid_name() ip_tunnel: better validate user provided tunnel names ipv6: sit: better validate user provided tunnel names ip6_gre: better validate user provided tunnel names ip6_tunnel: better validate user provided tunnel names vti6: better validate user provided tunnel names r8169: fix setting driver_data after register_netdev net sched actions: fix dumping which requires several messages to user space net/ipv6: Increment OUTxxx counters after netfilter hook ipv6: the entire IPv6 header chain must fit the first fragment vrf: Fix use after free and double free in vrf_finish_output Revert "xhci: plat: Register shutdown for xhci_plat" Linux 4.4.128 Change-Id: I9c1e58f634cc18f15a840c9d192c892dfcc5ff73 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * futex: Remove requirement for lock_page() in get_futex_key()Mel Gorman2018-04-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 65d8fc777f6dcfee12785c057a6b57f679641c90 upstream. When dealing with key handling for shared futexes, we can drastically reduce the usage/need of the page lock. 1) For anonymous pages, the associated futex object is the mm_struct which does not require the page lock. 2) For inode based, keys, we can check under RCU read lock if the page mapping is still valid and take reference to the inode. This just leaves one rare race that requires the page lock in the slow path when examining the swapcache. Additionally realtime users currently have a problem with the page lock being contended for unbounded periods of time during futex operations. Task A get_futex_key() lock_page() ---> preempted Now any other task trying to lock that page will have to wait until task A gets scheduled back in, which is an unbound time. With this patch, we pretty much have a lockless futex_get_key(). Experiments show that this patch can boost/speedup the hashing of shared futexes with the perf futex benchmarks (which is good for measuring such change) by up to 45% when there are high (> 100) thread counts on a 60 core Westmere. Lower counts are pretty much in the noise range or less than 10%, but mid range can be seen at over 30% overall throughput (hash ops/sec). This makes anon-mem shared futexes much closer to its private counterpart. Signed-off-by: Mel Gorman <mgorman@suse.de> [ Ported on top of thp refcount rework, changelog, comments, fixes. ] Signed-off-by: Davidlohr Bueso <dbueso@suse.de> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Cc: Chris Mason <clm@fb.com> Cc: Darren Hart <dvhart@linux.intel.com> Cc: Hugh Dickins <hughd@google.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Mel Gorman <mgorman@techsingularity.net> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Cc: dave@stgolabs.net Link: http://lkml.kernel.org/r/1455045314-8305-3-git-send-email-dave@stgolabs.net Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Chenbo Feng <fengc@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * perf/core: Correct event creation with PERF_FORMAT_GROUPPeter Zijlstra2018-04-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit ba5213ae6b88fb170c4771fef6553f759c7d8cdd ] Andi was asking about PERF_FORMAT_GROUP vs inherited events, which led to the discovery of a bug from commit: 3dab77fb1bf8 ("perf: Rework/fix the whole read vs group stuff") - PERF_SAMPLE_GROUP = 1U << 4, + PERF_SAMPLE_READ = 1U << 4, - if (attr->inherit && (attr->sample_type & PERF_SAMPLE_GROUP)) + if (attr->inherit && (attr->read_format & PERF_FORMAT_GROUP)) is a clear fail :/ While this changes user visible behaviour; it was previously possible to create an inherited event with PERF_SAMPLE_READ; this is deemed acceptible because its results were always incorrect. Reported-by: Andi Kleen <ak@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Arnaldo Carvalho de Melo <acme@kernel.org> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Vince Weaver <vince@deater.net> Fixes: 3dab77fb1bf8 ("perf: Rework/fix the whole read vs group stuff") Link: http://lkml.kernel.org/r/20170530094512.dy2nljns2uq7qa3j@hirez.programming.kicks-ass.net Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * sched/numa: Use down_read_trylock() for the mmap_semVlastimil Babka2018-04-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 8655d5497735b288f8a9b458bd22e7d1bf95bb61 ] A customer has reported a soft-lockup when running an intensive memory stress test, where the trace on multiple CPU's looks like this: RIP: 0010:[<ffffffff810c53fe>] [<ffffffff810c53fe>] native_queued_spin_lock_slowpath+0x10e/0x190 ... Call Trace: [<ffffffff81182d07>] queued_spin_lock_slowpath+0x7/0xa [<ffffffff811bc331>] change_protection_range+0x3b1/0x930 [<ffffffff811d4be8>] change_prot_numa+0x18/0x30 [<ffffffff810adefe>] task_numa_work+0x1fe/0x310 [<ffffffff81098322>] task_work_run+0x72/0x90 Further investigation showed that the lock contention here is pmd_lock(). The task_numa_work() function makes sure that only one thread is let to perform the work in a single scan period (via cmpxchg), but if there's a thread with mmap_sem locked for writing for several periods, multiple threads in task_numa_work() can build up a convoy waiting for mmap_sem for read and then all get unblocked at once. This patch changes the down_read() to the trylock version, which prevents the build up. For a workload experiencing mmap_sem contention, it's probably better to postpone the NUMA balancing work anyway. This seems to have fixed the soft lockups involving pmd_lock(), which is in line with the convoy theory. Signed-off-by: Vlastimil Babka <vbabka@suse.cz> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: Rik van Riel <riel@redhat.com> Acked-by: Mel Gorman <mgorman@techsingularity.net> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Link: http://lkml.kernel.org/r/20170515131316.21909-1-vbabka@suse.cz Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>