summaryrefslogtreecommitdiff
path: root/arch/powerpc/kernel (follow)
Commit message (Collapse)AuthorAge
* Merge remote-tracking branch 'google/common/android-4.4-p' into ↵Michael Bestas2022-02-04
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lineage-18.1-caf-msm8998 * google/common/android-4.4-p: Linux 4.4.302 Input: i8042 - Fix misplaced backport of "add ASUS Zenbook Flip to noselftest list" KVM: x86: Fix misplaced backport of "work around leak of uninitialized stack contents" Revert "tc358743: fix register i2c_rd/wr function fix" Revert "drm/radeon/ci: disable mclk switching for high refresh rates (v2)" Bluetooth: MGMT: Fix misplaced BT_HS check ipv4: tcp: send zero IPID in SYNACK messages ipv4: raw: lock the socket in raw_bind() hwmon: (lm90) Reduce maximum conversion rate for G781 drm/msm: Fix wrong size calculation net-procfs: show net devices bound packet types ipv4: avoid using shared IP generator for connected sockets net: fix information leakage in /proc/net/ptype ipv6_tunnel: Rate limit warning messages scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() USB: core: Fix hang in usb_kill_urb by adding memory barriers usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge tty: Add support for Brainboxes UC cards. tty: n_gsm: fix SW flow control encoding/handling serial: stm32: fix software flow control transfer PM: wakeup: simplify the output logic of pm_show_wakelocks() udf: Fix NULL ptr deref when converting from inline format udf: Restore i_lenAlloc when inode expansion fails scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices s390/hypfs: include z/VM guests with access control group set Bluetooth: refactor malicious adv data check can: bcm: fix UAF of bcm op Linux 4.4.301 drm/i915: Flush TLBs before releasing backing store Linux 4.4.300 lib82596: Fix IRQ check in sni_82596_probe bcmgenet: add WOL IRQ check net_sched: restore "mpu xxx" handling dmaengine: at_xdmac: Fix at_xdmac_lld struct definition dmaengine: at_xdmac: Fix lld view setting dmaengine: at_xdmac: Print debug message after realeasing the lock dmaengine: at_xdmac: Don't start transactions at tx_submit level netns: add schedule point in ops_exit_list() net: axienet: fix number of TX ring slots for available check net: axienet: Wait for PhyRstCmplt after core reset af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses ext4: don't use the orphan list when migrating an inode ext4: Fix BUG_ON in ext4_bread when write quota data ext4: set csum seed in tmp inode while migrating to extents ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers power: bq25890: Enable continuous conversion for ADC at charging scsi: sr: Don't use GFP_DMA MIPS: Octeon: Fix build errors using clang i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters ALSA: seq: Set upper limit of processed events w1: Misuse of get_user()/put_user() reported by sparse i2c: mpc: Correct I2C reset procedure powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING i2c: i801: Don't silently correct invalid transfer size powerpc/btext: add missing of_node_put powerpc/cell: add missing of_node_put powerpc/powernv: add missing of_node_put powerpc/6xx: add missing of_node_put parisc: Avoid calling faulthandler_disabled() twice serial: core: Keep mctrl register state and cached copy in sync serial: pl010: Drop CR register reset on set_termios dm space map common: add bounds check to sm_ll_lookup_bitmap() dm btree: add a defensive bounds check to insert_at() net: mdio: Demote probed message to debug print btrfs: remove BUG_ON(!eie) in find_parent_nodes btrfs: remove BUG_ON() in find_parent_nodes() ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() ACPICA: Utilities: Avoid deleting the same object twice in a row um: registers: Rename function names to avoid conflicts and build problems ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() media: igorplugusb: receiver overflow should be reported net: bonding: debug: avoid printing debug logs when bond is not notifying peers iwlwifi: mvm: synchronize with FW after multicast commands media: m920x: don't use stack on USB reads media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() floppy: Add max size check for user space request mwifiex: Fix skb_over_panic in mwifiex_usb_recv() HSI: core: Fix return freed object in hsi_new_client media: b2c2: Add missing check in flexcop_pci_isr: usb: gadget: f_fs: Use stream_open() for endpoint files ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply fs: dlm: filter user dlm messages for kernel locks Bluetooth: Fix debugfs entry leak in hci_register_dev() RDMA/cxgb4: Set queue pair state when being queried mips: bcm63xx: add support for clk_set_parent() mips: lantiq: add support for clk_set_parent() misc: lattice-ecp3-config: Fix task hung when firmware load failed ASoC: samsung: idma: Check of ioremap return value dmaengine: pxa/mmp: stop referencing config->slave_id RDMA/core: Let ib_find_gid() continue search even after empty entry char/mwave: Adjust io port register size ALSA: oss: fix compile error when OSS_DEBUG is enabled powerpc/prom_init: Fix improper check of prom_getprop() ALSA: hda: Add missing rwsem around snd_ctl_remove() calls ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls ALSA: jack: Add missing rwsem around snd_ctl_remove() calls ext4: avoid trim error on fs with small groups net: mcs7830: handle usb read errors properly pcmcia: fix setting of kthread task states can: xilinx_can: xcan_probe(): check for error irq can: softing: softing_startstop(): fix set but not used variable warning spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe ppp: ensure minimum packet size in ppp_write() pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() usb: ftdi-elan: fix memory leak on device disconnect media: msi001: fix possible null-ptr-deref in msi001_probe() media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() media: dib8000: Fix a memleak in dib8000_init() floppy: Fix hang in watchdog when disk is ejected serial: amba-pl011: do not request memory region twice drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() arm64: dts: qcom: msm8916: fix MMC controller aliases netfilter: bridge: add support for pppoe filtering tty: serial: atmel: Call dma_async_issue_pending() tty: serial: atmel: Check return code of dmaengine_submit() crypto: qce - fix uaf on qce_ahash_register_one Bluetooth: stop proccessing malicious adv data Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller can: softing_cs: softingcs_probe(): fix memleak on registration failure media: stk1160: fix control-message timeouts media: pvrusb2: fix control-message timeouts media: dib0700: fix undefined behavior in tuner shutdown media: em28xx: fix control-message timeouts media: mceusb: fix control-message timeouts rtc: cmos: take rtc_lock while reading from CMOS nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() HID: uhid: Fix worker destroying device without any protection rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled media: uvcvideo: fix division by zero at stream start drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk() can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved} can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe() USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status USB: core: Fix bug in resuming hub's handling of wakeup requests Bluetooth: bfusb: fix division by zero in send path Linux 4.4.299 power: reset: ltc2952: Fix use of floating point literals mISDN: change function names to avoid conflicts net: udp: fix alignment problem in udp4_seq_show() ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() phonet: refcount leak in pep_sock_accep rndis_host: support Hytera digital radios xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc i40e: Fix incorrect netdev's real number of RX/TX queues mac80211: initialize variable have_higher_than_11mbit ieee802154: atusb: fix uninit value in atusb_set_extended_addr Bluetooth: btusb: Apply QCA Rome patches for some ATH3012 models bpf, test: fix ld_abs + vlan push/pop stress test Linux 4.4.298 net: fix use-after-free in tw_timer_handler Input: spaceball - fix parsing of movement data packets Input: appletouch - initialize work before device registration scsi: vmw_pvscsi: Set residual data length conditionally usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set. uapi: fix linux/nfc.h userspace compilation errors nfc: uapi: use kernel size_t to fix user-space builds selinux: initialize proto variable in selinux_ip_postroute_compat() recordmcount.pl: fix typo in s390 mcount regex platform/x86: apple-gmux: use resource_size() with res Linux 4.4.297 phonet/pep: refuse to enable an unbound pipe hamradio: improve the incomplete fix to avoid NPD hamradio: defer ax25 kfree after unregister_netdev ax25: NPD bug when detaching AX25 device xen/blkfront: fix bug in backported patch ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling ALSA: drivers: opl3: Fix incorrect use of vp->state ALSA: jack: Check the return value of kstrdup() hwmon: (lm90) Fix usage of CONFIG2 register in detect function drivers: net: smc911x: Check for error irq bonding: fix ad_actor_system option setting to default qlcnic: potential dereference null pointer of rx_queue->page_ring IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() HID: holtek: fix mouse probing can: kvaser_usb: get CAN clock frequency from device net: usb: lan78xx: add Allied Telesis AT29M2-AF Conflicts: drivers/usb/gadget/function/f_fs.c Change-Id: Iabc390c3c9160c7a2864ffe1125d73412ffdb31d
| * Merge 4.4.300 into android-4.4-pGreg Kroah-Hartman2022-01-27
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.300 Bluetooth: bfusb: fix division by zero in send path USB: core: Fix bug in resuming hub's handling of wakeup requests USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe() can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved} drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk() media: uvcvideo: fix division by zero at stream start rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled HID: uhid: Fix worker destroying device without any protection nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() rtc: cmos: take rtc_lock while reading from CMOS media: mceusb: fix control-message timeouts media: em28xx: fix control-message timeouts media: dib0700: fix undefined behavior in tuner shutdown media: pvrusb2: fix control-message timeouts media: stk1160: fix control-message timeouts can: softing_cs: softingcs_probe(): fix memleak on registration failure PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails Bluetooth: stop proccessing malicious adv data crypto: qce - fix uaf on qce_ahash_register_one tty: serial: atmel: Check return code of dmaengine_submit() tty: serial: atmel: Call dma_async_issue_pending() netfilter: bridge: add support for pppoe filtering arm64: dts: qcom: msm8916: fix MMC controller aliases drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() serial: amba-pl011: do not request memory region twice floppy: Fix hang in watchdog when disk is ejected media: dib8000: Fix a memleak in dib8000_init() media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() media: msi001: fix possible null-ptr-deref in msi001_probe() usb: ftdi-elan: fix memory leak on device disconnect pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() ppp: ensure minimum packet size in ppp_write() spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe can: softing: softing_startstop(): fix set but not used variable warning can: xilinx_can: xcan_probe(): check for error irq pcmcia: fix setting of kthread task states net: mcs7830: handle usb read errors properly ext4: avoid trim error on fs with small groups ALSA: jack: Add missing rwsem around snd_ctl_remove() calls ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls ALSA: hda: Add missing rwsem around snd_ctl_remove() calls powerpc/prom_init: Fix improper check of prom_getprop() ALSA: oss: fix compile error when OSS_DEBUG is enabled char/mwave: Adjust io port register size RDMA/core: Let ib_find_gid() continue search even after empty entry dmaengine: pxa/mmp: stop referencing config->slave_id ASoC: samsung: idma: Check of ioremap return value misc: lattice-ecp3-config: Fix task hung when firmware load failed mips: lantiq: add support for clk_set_parent() mips: bcm63xx: add support for clk_set_parent() RDMA/cxgb4: Set queue pair state when being queried Bluetooth: Fix debugfs entry leak in hci_register_dev() fs: dlm: filter user dlm messages for kernel locks ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply usb: gadget: f_fs: Use stream_open() for endpoint files media: b2c2: Add missing check in flexcop_pci_isr: HSI: core: Fix return freed object in hsi_new_client mwifiex: Fix skb_over_panic in mwifiex_usb_recv() floppy: Add max size check for user space request media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() media: m920x: don't use stack on USB reads iwlwifi: mvm: synchronize with FW after multicast commands net: bonding: debug: avoid printing debug logs when bond is not notifying peers media: igorplugusb: receiver overflow should be reported media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream um: registers: Rename function names to avoid conflicts and build problems ACPICA: Utilities: Avoid deleting the same object twice in a row ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() btrfs: remove BUG_ON() in find_parent_nodes() btrfs: remove BUG_ON(!eie) in find_parent_nodes net: mdio: Demote probed message to debug print dm btree: add a defensive bounds check to insert_at() dm space map common: add bounds check to sm_ll_lookup_bitmap() serial: pl010: Drop CR register reset on set_termios serial: core: Keep mctrl register state and cached copy in sync parisc: Avoid calling faulthandler_disabled() twice powerpc/6xx: add missing of_node_put powerpc/powernv: add missing of_node_put powerpc/cell: add missing of_node_put powerpc/btext: add missing of_node_put i2c: i801: Don't silently correct invalid transfer size powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING i2c: mpc: Correct I2C reset procedure w1: Misuse of get_user()/put_user() reported by sparse ALSA: seq: Set upper limit of processed events i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters MIPS: Octeon: Fix build errors using clang scsi: sr: Don't use GFP_DMA power: bq25890: Enable continuous conversion for ADC at charging ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers ext4: set csum seed in tmp inode while migrating to extents ext4: Fix BUG_ON in ext4_bread when write quota data ext4: don't use the orphan list when migrating an inode powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress net: axienet: Wait for PhyRstCmplt after core reset net: axienet: fix number of TX ring slots for available check netns: add schedule point in ops_exit_list() dmaengine: at_xdmac: Don't start transactions at tx_submit level dmaengine: at_xdmac: Print debug message after realeasing the lock dmaengine: at_xdmac: Fix lld view setting dmaengine: at_xdmac: Fix at_xdmac_lld struct definition net_sched: restore "mpu xxx" handling bcmgenet: add WOL IRQ check lib82596: Fix IRQ check in sni_82596_probe Linux 4.4.300 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic6c59dd0f4ed703fff49584b3774d39e4548af4a
| | * powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILINGMichael Ellerman2022-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit a4ac0d249a5db80e79d573db9e4ad29354b643a8 ] setup_profiling_timer() is only needed when CONFIG_PROFILING is enabled. Fixes the following W=1 warning when CONFIG_PROFILING=n: linux/arch/powerpc/kernel/smp.c:1638:5: error: no previous prototype for ‘setup_profiling_timer’ Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20211124093254.1054750-5-mpe@ellerman.id.au Signed-off-by: Sasha Levin <sashal@kernel.org>
| | * powerpc/btext: add missing of_node_putJulia Lawall2022-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit a1d2b210ffa52d60acabbf7b6af3ef7e1e69cda0 ] for_each_node_by_type performs an of_node_get on each iteration, so a break out of the loop requires an of_node_put. A simplified version of the semantic patch that fixes this problem is as follows (http://coccinelle.lip6.fr): // <smpl> @@ local idexpression n; expression e; @@ for_each_node_by_type(n,...) { ... ( of_node_put(n); | e = n | + of_node_put(n); ? break; ) ... } ... when != n // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/1448051604-25256-6-git-send-email-Julia.Lawall@lip6.fr Signed-off-by: Sasha Levin <sashal@kernel.org>
| | * powerpc/prom_init: Fix improper check of prom_getprop()Peiwei Hu2022-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 869fb7e5aecbc163003f93f36dcc26d0554319f6 ] prom_getprop() can return PROM_ERROR. Binary operator can not identify it. Fixes: 94d2dde738a5 ("[POWERPC] Efika: prune fixups and make them more carefull") Signed-off-by: Peiwei Hu <jlu.hpw@foxmail.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/tencent_BA28CC6897B7C95A92EB8C580B5D18589105@qq.com Signed-off-by: Sasha Levin <sashal@kernel.org>
* | | Merge remote-tracking branch 'common/android-4.4-p' into ↵Michael Bestas2021-10-12
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lineage-18.1-caf-msm8998 # By Sergey Shtylyov (9) and others # Via Greg Kroah-Hartman * common/android-4.4-p: Linux 4.4.288 libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD. usb: testusb: Fix for showing the connection speed scsi: sd: Free scsi_disk device via put_device() ext2: fix sleeping in atomic bugs on error sparc64: fix pci_iounmap() when CONFIG_PCI is not set xen-netback: correct success/error reporting for the SKB-with-fraglist case af_unix: fix races in sk_peer_pid and sk_peer_cred accesses Linux 4.4.287 Revert "arm64: Mark __stack_chk_guard as __ro_after_init" Linux 4.4.286 cred: allow get_cred() and put_cred() to be given NULL. HID: usbhid: free raw_report buffers in usbhid_stop netfilter: ipset: Fix oversized kvmalloc() calls HID: betop: fix slab-out-of-bounds Write in betop_probe arm64: Extend workaround for erratum 1024718 to all versions of Cortex-A55 EDAC/synopsys: Fix wrong value type assignment for edac_mode ext4: fix potential infinite loop in ext4_dx_readdir() ipack: ipoctal: fix module reference leak ipack: ipoctal: fix missing allocation-failure check ipack: ipoctal: fix tty-registration error handling ipack: ipoctal: fix tty registration race ipack: ipoctal: fix stack information leak e100: fix buffer overrun in e100_get_regs e100: fix length calculation in e100_get_regs_len ipvs: check that ip_vs_conn_tab_bits is between 8 and 20 mac80211: fix use-after-free in CCMP/GCMP RX tty: Fix out-of-bound vmalloc access in imageblit qnx4: work around gcc false positive warning bug spi: Fix tegra20 build with CONFIG_PM=n net: 6pack: Fix tx timeout and slot time alpha: Declare virt_to_phys and virt_to_bus parameter as pointer to volatile arm64: Mark __stack_chk_guard as __ro_after_init parisc: Use absolute_pointer() to define PAGE0 qnx4: avoid stringop-overread errors sparc: avoid stringop-overread errors net: i825xx: Use absolute_pointer for memcpy from fixed memory location compiler.h: Introduce absolute_pointer macro m68k: Double cast io functions to unsigned long blktrace: Fix uaf in blk_trace access after removing by sysfs scsi: iscsi: Adjust iface sysfs attr detection net/mlx4_en: Don't allow aRFS for encapsulated packets net: hso: fix muxed tty registration USB: serial: option: add device id for Foxconn T99W265 USB: serial: option: remove duplicate USB device ID USB: serial: option: add Telit LN920 compositions USB: serial: mos7840: remove duplicated 0xac24 device ID USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter xen/x86: fix PV trap handling on secondary processors cifs: fix incorrect check for null pointer in header_assemble usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned() usb: gadget: r8a66597: fix a loop in set_feature() Linux 4.4.285 sctp: validate from_addr_param return drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV blk-throttle: fix UAF by deleteing timer in blk_throtl_exit() nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group nilfs2: fix NULL pointer in nilfs_##name##_attr_release nilfs2: fix memory leak in nilfs_sysfs_create_device_group ceph: lockdep annotations for try_nonblocking_invalidate dmaengine: ioat: depends on !UML parisc: Move pci_dev_is_behind_card_dino to where it is used dmaengine: acpi: Avoid comparison GSI with Linux vIRQ dmaengine: acpi-dma: check for 64-bit MMIO address profiling: fix shift-out-of-bounds bugs prctl: allow to setup brk for et_dyn executables 9p/trans_virtio: Remove sysfs file on probe failure thermal/drivers/exynos: Fix an error code in exynos_tmu_probe() sctp: add param size validation for SCTP_PARAM_SET_PRIMARY sctp: validate chunk size in __rcv_asconf_lookup PM / wakeirq: Fix unbalanced IRQ enable for wakeirq s390/bpf: Fix optimizing out zero-extensions Linux 4.4.284 s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant net: renesas: sh_eth: Fix freeing wrong tx descriptor qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom ARC: export clear_user_page() for modules mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()' PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n ethtool: Fix an error code in cxgb2.c dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation x86/mm: Fix kern_addr_valid() to cope with existing but not present entries net/af_unix: fix a data-race in unix_dgram_poll tipc: increase timeout in tipc_sk_enqueue() r6040: Restore MDIO clock frequency after MAC reset net/l2tp: Fix reference count leak in l2tp_udp_recv_core dccp: don't duplicate ccid when cloning dccp sock ptp: dp83640: don't define PAGE0 net-caif: avoid user-triggerable WARN_ON(1) bnx2x: Fix enabling network interfaces without VFs platform/chrome: cros_ec_proto: Send command again when timeout occurs parisc: fix crash with signals and alloca net: fix NULL pointer reference in cipso_v4_doi_free ath9k: fix OOB read ar9300_eeprom_restore_internal parport: remove non-zero check on count Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set" cifs: fix wrong release in sess_alloc_buffer() failed path mmc: rtsx_pci: Fix long reads when clock is prescaled gfs2: Don't call dlm after protocol is unmounted rpc: fix gss_svc_init cleanup on failure ARM: tegra: tamonten: Fix UART pad setting gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port() Bluetooth: skip invalid hci_sync_conn_complete_evt serial: 8250_pci: make setup_port() parameters explicitly unsigned hvsi: don't panic on tty_register_driver failure xtensa: ISS: don't panic in rs_init serial: 8250: Define RX trigger levels for OxSemi 950 devices s390/jump_label: print real address in a case of a jump label bug ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() video: fbdev: riva: Error out if 'pixclock' equals zero video: fbdev: kyro: Error out if 'pixclock' equals zero video: fbdev: asiliantfb: Error out if 'pixclock' equals zero bpf/tests: Do not PASS tests without actually testing the result bpf/tests: Fix copy-and-paste error in double word test tty: serial: jsm: hold port lock when reporting modem line changes usb: gadget: u_ether: fix a potential null pointer dereference usb: host: fotg210: fix the actual_length of an iso packet Smack: Fix wrong semantics in smk_access_entry() netlink: Deal with ESRCH error in nlmsg_notify() video: fbdev: kyro: fix a DoS bug by restricting user input iio: dac: ad5624r: Fix incorrect handling of an optional regulator. PCI: Use pci_update_current_state() in pci_enable_device_flags() crypto: mxs-dcp - Use sg_mapping_iter to copy data pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry() openrisc: don't printk() unconditionally PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported ARM: 9105/1: atags_to_fdt: don't warn about stack size libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs media: rc-loopback: return number of emitters rather than error media: uvc: don't do DMA on stack VMCI: fix NULL pointer dereference when unmapping queue pair power: supply: max17042: handle fails of reading status register xen: fix setting of max_pfn in shared_info PCI/MSI: Skip masking MSI-X on Xen PV rtc: tps65910: Correct driver module alias fbmem: don't allow too huge resolutions clk: kirkwood: Fix a clocking boot regression KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted tty: Fix data race between tiocsti() and flush_to_ldisc() ipv4: make exception cache less predictible bcma: Fix memory leak for internally-handled cores ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() usb: ehci-orion: Handle errors of clk_prepare_enable() in probe i2c: mt65xx: fix IRQ check CIFS: Fix a potencially linear read overflow mmc: moxart: Fix issue with uninitialized dma_slave_config mmc: dw_mmc: Fix issue with uninitialized dma_slave_config i2c: s3c2410: fix IRQ check i2c: iop3xx: fix deferred probing Bluetooth: add timeout sanity check to hci_inquiry usb: gadget: mv_u3d: request_irq() after initializing UDC usb: phy: tahvo: add IRQ check usb: host: ohci-tmio: add IRQ check Bluetooth: Move shutdown callback before flushing tx and rx queue usb: phy: twl6030: add IRQ checks usb: phy: fsl-usb: add IRQ check usb: gadget: udc: at91: add IRQ check drm/msm/dsi: Fix some reference counted resource leaks Bluetooth: fix repeated calls to sco_sock_kill arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7 Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow PCI: PM: Enable PME if it can be signaled from D3cold i2c: highlander: add IRQ check net: cipso: fix warnings in netlbl_cipsov4_add_std tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos Bluetooth: sco: prevent information leak in sco_conn_defer_accept() media: go7007: remove redundant initialization media: dvb-usb: fix uninit-value in vp702x_read_mac_addr media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init certs: Trigger creation of RSA module signing key if it's not an RSA key m68k: emu: Fix invalid free in nfeth_cleanup() udf_get_extendedattr() had no boundary checks. crypto: qat - fix reuse of completion variable crypto: qat - do not ignore errors from enable_vf2pf_comms() libata: fix ata_host_start() power: supply: max17042_battery: fix typo in MAx17042_TOFF crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() crypto: mxs-dcp - Check for DMA mapping errors PCI: Call Max Payload Size-related fixup quirks early x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions Revert "btrfs: compression: don't try to compress if we don't have enough pages" mm/page_alloc: speed up the iteration of max_order net: ll_temac: Remove left-over debug message powerpc/boot: Delete unneeded .globl _zimage_start powerpc/module64: Fix comment in R_PPC64_ENTRY handling mm/kmemleak.c: make cond_resched() rate-limiting more efficient s390/disassembler: correct disassembly lines alignment ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2) tc358743: fix register i2c_rd/wr function fix PM / wakeirq: Enable dedicated wakeirq for suspend USB: serial: mos7720: improve OOM-handling in read_mos_reg() usb: phy: isp1301: Fix build warning when CONFIG_OF is disabled igmp: Add ip_mc_list lock in ip_check_mc_rcu media: stkwebcam: fix memory leak in stk_camera_probe ath9k: Postpone key cache entry deletion for TXQ frames reference it ath: Modify ath_key_delete() to not need full key entry ath: Export ath_hw_keysetmac() ath9k: Clear key cache explicitly on disabling hardware ath: Use safer key clearing with key cache entries ALSA: pcm: fix divide error in snd_pcm_lib_ioctl ARM: 8918/2: only build return_address() if needed cryptoloop: add a deprecation warning qede: Fix memset corruption ARC: fix allnoconfig build warning xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG ext4: fix race writing to an inline_data file while its xattrs are changing Change-Id: I0d3200388e095f977c784cba314b9cc061848c7a
| * | Merge 4.4.284 into android-4.4-pGreg Kroah-Hartman2021-09-22
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.284 ext4: fix race writing to an inline_data file while its xattrs are changing xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG ARC: fix allnoconfig build warning qede: Fix memset corruption cryptoloop: add a deprecation warning ARM: 8918/2: only build return_address() if needed ALSA: pcm: fix divide error in snd_pcm_lib_ioctl ath: Use safer key clearing with key cache entries ath9k: Clear key cache explicitly on disabling hardware ath: Export ath_hw_keysetmac() ath: Modify ath_key_delete() to not need full key entry ath9k: Postpone key cache entry deletion for TXQ frames reference it media: stkwebcam: fix memory leak in stk_camera_probe igmp: Add ip_mc_list lock in ip_check_mc_rcu usb: phy: isp1301: Fix build warning when CONFIG_OF is disabled USB: serial: mos7720: improve OOM-handling in read_mos_reg() PM / wakeirq: Enable dedicated wakeirq for suspend tc358743: fix register i2c_rd/wr function fix ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2) s390/disassembler: correct disassembly lines alignment mm/kmemleak.c: make cond_resched() rate-limiting more efficient powerpc/module64: Fix comment in R_PPC64_ENTRY handling powerpc/boot: Delete unneeded .globl _zimage_start net: ll_temac: Remove left-over debug message mm/page_alloc: speed up the iteration of max_order Revert "btrfs: compression: don't try to compress if we don't have enough pages" x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions PCI: Call Max Payload Size-related fixup quirks early crypto: mxs-dcp - Check for DMA mapping errors crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() power: supply: max17042_battery: fix typo in MAx17042_TOFF libata: fix ata_host_start() crypto: qat - do not ignore errors from enable_vf2pf_comms() crypto: qat - fix reuse of completion variable udf_get_extendedattr() had no boundary checks. m68k: emu: Fix invalid free in nfeth_cleanup() certs: Trigger creation of RSA module signing key if it's not an RSA key media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init media: dvb-usb: fix uninit-value in vp702x_read_mac_addr media: go7007: remove redundant initialization Bluetooth: sco: prevent information leak in sco_conn_defer_accept() tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos net: cipso: fix warnings in netlbl_cipsov4_add_std i2c: highlander: add IRQ check PCI: PM: Enable PME if it can be signaled from D3cold Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7 Bluetooth: fix repeated calls to sco_sock_kill drm/msm/dsi: Fix some reference counted resource leaks usb: gadget: udc: at91: add IRQ check usb: phy: fsl-usb: add IRQ check usb: phy: twl6030: add IRQ checks Bluetooth: Move shutdown callback before flushing tx and rx queue usb: host: ohci-tmio: add IRQ check usb: phy: tahvo: add IRQ check usb: gadget: mv_u3d: request_irq() after initializing UDC Bluetooth: add timeout sanity check to hci_inquiry i2c: iop3xx: fix deferred probing i2c: s3c2410: fix IRQ check mmc: dw_mmc: Fix issue with uninitialized dma_slave_config mmc: moxart: Fix issue with uninitialized dma_slave_config CIFS: Fix a potencially linear read overflow i2c: mt65xx: fix IRQ check usb: ehci-orion: Handle errors of clk_prepare_enable() in probe ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() bcma: Fix memory leak for internally-handled cores ipv4: make exception cache less predictible tty: Fix data race between tiocsti() and flush_to_ldisc() KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted clk: kirkwood: Fix a clocking boot regression fbmem: don't allow too huge resolutions rtc: tps65910: Correct driver module alias PCI/MSI: Skip masking MSI-X on Xen PV xen: fix setting of max_pfn in shared_info power: supply: max17042: handle fails of reading status register VMCI: fix NULL pointer dereference when unmapping queue pair media: uvc: don't do DMA on stack media: rc-loopback: return number of emitters rather than error libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs ARM: 9105/1: atags_to_fdt: don't warn about stack size PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure openrisc: don't printk() unconditionally pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry() crypto: mxs-dcp - Use sg_mapping_iter to copy data PCI: Use pci_update_current_state() in pci_enable_device_flags() iio: dac: ad5624r: Fix incorrect handling of an optional regulator. video: fbdev: kyro: fix a DoS bug by restricting user input netlink: Deal with ESRCH error in nlmsg_notify() Smack: Fix wrong semantics in smk_access_entry() usb: host: fotg210: fix the actual_length of an iso packet usb: gadget: u_ether: fix a potential null pointer dereference tty: serial: jsm: hold port lock when reporting modem line changes bpf/tests: Fix copy-and-paste error in double word test bpf/tests: Do not PASS tests without actually testing the result video: fbdev: asiliantfb: Error out if 'pixclock' equals zero video: fbdev: kyro: Error out if 'pixclock' equals zero video: fbdev: riva: Error out if 'pixclock' equals zero ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() s390/jump_label: print real address in a case of a jump label bug serial: 8250: Define RX trigger levels for OxSemi 950 devices xtensa: ISS: don't panic in rs_init hvsi: don't panic on tty_register_driver failure serial: 8250_pci: make setup_port() parameters explicitly unsigned Bluetooth: skip invalid hci_sync_conn_complete_evt gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port() ARM: tegra: tamonten: Fix UART pad setting rpc: fix gss_svc_init cleanup on failure gfs2: Don't call dlm after protocol is unmounted mmc: rtsx_pci: Fix long reads when clock is prescaled cifs: fix wrong release in sess_alloc_buffer() failed path Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set" parport: remove non-zero check on count ath9k: fix OOB read ar9300_eeprom_restore_internal net: fix NULL pointer reference in cipso_v4_doi_free parisc: fix crash with signals and alloca platform/chrome: cros_ec_proto: Send command again when timeout occurs bnx2x: Fix enabling network interfaces without VFs net-caif: avoid user-triggerable WARN_ON(1) ptp: dp83640: don't define PAGE0 dccp: don't duplicate ccid when cloning dccp sock net/l2tp: Fix reference count leak in l2tp_udp_recv_core r6040: Restore MDIO clock frequency after MAC reset tipc: increase timeout in tipc_sk_enqueue() net/af_unix: fix a data-race in unix_dgram_poll x86/mm: Fix kern_addr_valid() to cope with existing but not present entries dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation ethtool: Fix an error code in cxgb2.c PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()' ARC: export clear_user_page() for modules qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom net: renesas: sh_eth: Fix freeing wrong tx descriptor s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant Linux 4.4.284 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Idf3220461e42648ba134a245e9670231dbd18b5c
| | * powerpc/module64: Fix comment in R_PPC64_ENTRY handlingMichael Ellerman2021-09-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 2fb0a2c989837c976b68233496bbaefb47cd3d6f upstream. The comment here is wrong, the addi reads from r2 not r12. The code is correct, 0x38420000 = addi r2,r2,0. Fixes: a61674bdfc7c ("powerpc/module: Handle R_PPC64_ENTRY relocations") Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge branch 'android-4.4-p' of ↵Michael Bestas2021-05-31
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-18.1-caf-msm8998 This brings LA.UM.9.2.r1-03300-SDMxx0.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 3628cdd31199d Merge 4.4.270 into android-4.4-p Conflicts: drivers/mmc/core/core.c drivers/usb/core/hub.c kernel/trace/trace.c Change-Id: I6b81471122341f9769ce9c65cbd0fedd5e908b38
| * | Merge 4.4.269 into android-4.4-pGreg Kroah-Hartman2021-05-22
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.269 timerfd: Reject ALARM timerfds without CAP_WAKE_ALARM net: usb: ax88179_178a: initialize local variables before use iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd() ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet USB: Add reset-resume quirk for WD19's Realtek Hub platform/x86: thinkpad_acpi: Correct thermal sensor allocation s390/disassembler: increase ebpf disasm buffer size ACPI: custom_method: fix potential use-after-free issue ACPI: custom_method: fix a possible memory leak ecryptfs: fix kernel panic with null dev_name mmc: core: Do a power cycle when the CMD11 fails mmc: core: Set read only for SD cards with permanent write protect bit fbdev: zero-fill colormap in fbcmap.c staging: wimax/i2400m: fix byte-order issue usb: gadget: uvc: add bInterval checking for HS mode PCI: PM: Do not read power state in pci_enable_device_flags() x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS) spi: dln2: Fix reference leak to master spi: omap-100k: Fix reference leak to master intel_th: Consistency and off-by-one fix phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove() btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s scsi: target: pscsi: Fix warning in pscsi_complete_cmd() media: ite-cir: check for receive overflow media: media/saa7164: fix saa7164_encoder_register() memory leak bugs media: gspca/sq905.c: fix uninitialized variable media: em28xx: fix memory leak clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return power: supply: generic-adc-battery: fix possible use-after-free in gab_remove() power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove() media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove() media: dvb-usb: fix memory leak in dvb_usb_adapter_init media: gscpa/stv06xx: fix memory leak drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal drm/amdgpu: fix NULL pointer dereference scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO response scsi: libfc: Fix a format specifier ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer ALSA: sb: Fix two use after free in snd_sb_qsound_build arm64/vdso: Discard .note.gnu.property sections in vDSO openvswitch: fix stack OOB read while fragmenting IPv4 packets jffs2: Fix kasan slab-out-of-bounds problem powerpc/eeh: Fix EEH handling for hugepages in ioremap space. powerpc: fix EDEADLOCK redefinition error in uapi/asm/errno.h jffs2: check the validity of dstlen in jffs2_zlib_compress() ftrace: Handle commands when closing set_ftrace_filter file ext4: fix check to prevent false positive report of incorrect used inodes ext4: fix error code in ext4_commit_super usb: gadget: dummy_hcd: fix gpf in gadget_setup usb: gadget/function/f_fs string table fix for multiple languages dm persistent data: packed struct should have an aligned() attribute too dm space map common: fix division bug in sm_ll_find_free_block() Bluetooth: verify AMP hci_chan before amp_destroy hsr: use netdev_err() instead of WARN_ONCE() net/nfc: fix use-after-free llcp_sock_bind/connect FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR misc: lis3lv02d: Fix false-positive WARN on various HP models misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct misc: vmw_vmci: explicitly initialize vmci_datagram payload tracing: Use strlcpy() instead of strcpy() in __trace_find_cmdline() tracing: Treat recording comm for idle task as a success tracing: Map all PIDs to command lines tracing: Restructure trace_clock_global() to never block md: factor out a mddev_find_locked helper from mddev_find md: md_open returns -EBUSY when entering racing area ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() cfg80211: scan: drop entry from hidden_list on overflow drm/radeon: fix copy of uninitialized variable back to userspace ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices KVM: s390: split kvm_s390_real_to_abs usb: gadget: pch_udc: Revert d3cb25a12138 completely memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250 ARM: dts: exynos: correct PMIC interrupt trigger level on Snow usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() usb: gadget: pch_udc: Check if driver is present before calling ->setup() usb: gadget: pch_udc: Check for DMA mapping error crypto: qat - don't release uninitialized resources fotg210-udc: Fix DMA on EP0 for length > max packet size fotg210-udc: Fix EP0 IN requests bigger than two packets fotg210-udc: Remove a dubious condition leading to fotg210_done fotg210-udc: Mask GRP2 interrupts we don't handle fotg210-udc: Don't DMA more than the buffer can take fotg210-udc: Complete OUT requests on short packets mtd: require write permissions for locking and badblock ioctls crypto: qat - fix error path in adf_isr_resource_alloc() staging: rtl8192u: Fix potential infinite loop crypto: qat - Fix a double free in adf_create_ring usb: gadget: r8a66597: Add missing null check on return from platform_get_resource USB: cdc-acm: fix unprivileged TIOCCSERIAL tty: fix return value for unsupported ioctls ttyprintk: Add TTY hangup callback. media: vivid: fix assignment of dev->fbuf_out_flags media: omap4iss: return error code when omap4iss_get() failed media: m88rs6000t: avoid potential out-of-bounds reads on arrays pata_arasan_cf: fix IRQ check pata_ipx4xx_cf: fix IRQ check sata_mv: add IRQ checks ata: libahci_platform: fix IRQ check scsi: fcoe: Fix mismatched fcoe_wwn_from_mac declaration media: dvb-usb-remote: fix dvb_usb_nec_rc_key_to_event type mismatch scsi: jazz_esp: Add IRQ check scsi: sun3x_esp: Add IRQ check scsi: sni_53c710: Add IRQ check HSI: core: fix resource leaks in hsi_add_client_from_dt() x86/events/amd/iommu: Fix sysfs type mismatch HID: plantronics: Workaround for double volume key presses net: lapbether: Prevent racing when checking whether the netif is running powerpc/prom: Mark identical_pvr_fixup as __init ALSA: core: remove redundant spin_lock pair in snd_card_disconnect nfc: pn533: prevent potential memory corruption ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls powerpc: iommu: fix build when neither PCI or IBMVIO is set mac80211: bail out if cipher schemes are invalid mt7601u: fix always true expression net: thunderx: Fix unintentional sign extension issue i2c: cadence: add IRQ check i2c: jz4780: add IRQ check i2c: sh7760: add IRQ check powerpc/pseries: extract host bridge from pci_bus prior to bus removal i2c: sh7760: fix IRQ error path mwl8k: Fix a double Free in mwl8k_probe_hw vsock/vmci: log once the failed queue pair allocation net: davinci_emac: Fix incorrect masking of tx and rx error channel ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of 'add') net:nfc:digital: Fix a double free in digital_tg_recv_dep_req kfifo: fix ternary sign extension bugs Revert "net/sctp: fix race condition in sctp_destroy_sock" sctp: delay auto_asconf init until binding the first addr fs: dlm: fix debugfs dump tipc: convert dest node's address to network order net: stmmac: Set FIFO sizes for ipq806x ALSA: hdsp: don't disable if not enabled ALSA: hdspm: don't disable if not enabled ALSA: rme9652: don't disable if not enabled Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default Bluetooth: initialize skb_queue_head at l2cap_chan_create() ip6_vti: proper dev_{hold|put} in ndo_[un]init methods mac80211: clear the beacon's CRC after channel switch cuse: prevent clone selftests: Set CC to clang in lib.mk if LLVM is set kconfig: nconf: stop endless search loops sctp: Fix out-of-bounds warning in sctp_process_asconf_param() ASoC: rt286: Generalize support for ALC3263 codec wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join powerpc/iommu: Annotate nested lock for lockdep ASoC: rt286: Make RT286_SET_GPIO_* readable and writable PCI: Release OF node in pci_scan_device()'s error path NFS: Deal correctly with attribute generation counter overflow pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() NFSv4.2 fix handling of sr_eof in SEEK's reply sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b drm/radeon: Fix off-by-one power_state index heap overwrite ksm: fix potential missing rmap_item for stable_node kernel: kexec_file: fix error return code of kexec_calculate_store_digests() ARC: entry: fix off-by-one error in syscall number validation powerpc/64s: Fix crashes when toggling entry flush barrier squashfs: fix divide error in calculate_skip() usb: fotg210-hcd: Fix an error message usb: xhci: Increase timeout for HC halt usb: dwc2: Fix gadget DMA unmap direction usb: core: hub: fix race condition about TRSMRCY of resume KVM: x86: Cancel pvclock_gtod_work on module removal FDDI: defxx: Make MMIO the configuration default except for EISA thermal/core/fair share: Lock the thermal zone while looping over instances dm ioctl: fix out of bounds array access when no devices kobject_uevent: remove warning in init_uevent_argv() x86/msr: Fix wr/rdmsr_safe_regs_on_cpu() prototypes kgdb: fix gcc-11 warning on indentation usb: sl811-hcd: improve misleading indentation cxgb4: Fix the -Wmisleading-indentation warning isdn: capi: fix mismatched prototypes ACPI / hotplug / PCI: Fix reference count leak in enable_slot() um: Mark all kernel symbols as local ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP sit: proper dev_{hold|put} in ndo_[un]init methods ip6_tunnel: sit: proper dev_{hold|put} in ndo_[un]init methods ipv6: remove extra dev_hold() for fallback tunnels xhci: Do not use GFP_KERNEL in (potentially) atomic context iio: tsl2583: Fix division by a zero lux_val Linux 4.4.269 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ifc6e8ab285aa71c13faa3c5002c25c5e33110b47
| | * powerpc/iommu: Annotate nested lock for lockdepAlexey Kardashevskiy2021-05-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit cc7130bf119add37f36238343a593b71ef6ecc1e ] The IOMMU table is divided into pools for concurrent mappings and each pool has a separate spinlock. When taking the ownership of an IOMMU group to pass through a device to a VM, we lock these spinlocks which triggers a false negative warning in lockdep (below). This fixes it by annotating the large pool's spinlock as a nest lock which makes lockdep not complaining when locking nested locks if the nest lock is locked already. === WARNING: possible recursive locking detected 5.11.0-le_syzkaller_a+fstn1 #100 Not tainted -------------------------------------------- qemu-system-ppc/4129 is trying to acquire lock: c0000000119bddb0 (&(p->lock)/1){....}-{2:2}, at: iommu_take_ownership+0xac/0x1e0 but task is already holding lock: c0000000119bdd30 (&(p->lock)/1){....}-{2:2}, at: iommu_take_ownership+0xac/0x1e0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&(p->lock)/1); lock(&(p->lock)/1); === Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20210301063653.51003-1-aik@ozlabs.ru Signed-off-by: Sasha Levin <sashal@kernel.org>
| | * powerpc/prom: Mark identical_pvr_fixup as __initNathan Chancellor2021-05-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 1ef1dd9c7ed27b080445e1576e8a05957e0e4dfc ] If identical_pvr_fixup() is not inlined, there are two modpost warnings: WARNING: modpost: vmlinux.o(.text+0x54e8): Section mismatch in reference from the function identical_pvr_fixup() to the function .init.text:of_get_flat_dt_prop() The function identical_pvr_fixup() references the function __init of_get_flat_dt_prop(). This is often because identical_pvr_fixup lacks a __init annotation or the annotation of of_get_flat_dt_prop is wrong. WARNING: modpost: vmlinux.o(.text+0x551c): Section mismatch in reference from the function identical_pvr_fixup() to the function .init.text:identify_cpu() The function identical_pvr_fixup() references the function __init identify_cpu(). This is often because identical_pvr_fixup lacks a __init annotation or the annotation of identify_cpu is wrong. identical_pvr_fixup() calls two functions marked as __init and is only called by a function marked as __init so it should be marked as __init as well. At the same time, remove the inline keywork as it is not necessary to inline this function. The compiler is still free to do so if it feels it is worthwhile since commit 889b3c1245de ("compiler: remove CONFIG_OPTIMIZE_INLINING entirely"). Fixes: 14b3d926a22b ("[POWERPC] 4xx: update 440EP(x)/440GR(x) identical PVR issue workaround") Signed-off-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://github.com/ClangBuiltLinux/linux/issues/1316 Link: https://lore.kernel.org/r/20210302200829.2680663-1-nathan@kernel.org Signed-off-by: Sasha Levin <sashal@kernel.org>
| | * powerpc/eeh: Fix EEH handling for hugepages in ioremap space.Mahesh Salgaonkar2021-05-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 5ae5bc12d0728db60a0aa9b62160ffc038875f1a upstream. During the EEH MMIO error checking, the current implementation fails to map the (virtual) MMIO address back to the pci device on radix with hugepage mappings for I/O. This results into failure to dispatch EEH event with no recovery even when EEH capability has been enabled on the device. eeh_check_failure(token) # token = virtual MMIO address addr = eeh_token_to_phys(token); edev = eeh_addr_cache_get_dev(addr); if (!edev) return 0; eeh_dev_check_failure(edev); <= Dispatch the EEH event In case of hugepage mappings, eeh_token_to_phys() has a bug in virt -> phys translation that results in wrong physical address, which is then passed to eeh_addr_cache_get_dev() to match it against cached pci I/O address ranges to get to a PCI device. Hence, it fails to find a match and the EEH event never gets dispatched leaving the device in failed state. The commit 33439620680be ("powerpc/eeh: Handle hugepages in ioremap space") introduced following logic to translate virt to phys for hugepage mappings: eeh_token_to_phys(): + pa = pte_pfn(*ptep); + + /* On radix we can do hugepage mappings for io, so handle that */ + if (hugepage_shift) { + pa <<= hugepage_shift; <= This is wrong + pa |= token & ((1ul << hugepage_shift) - 1); + } This patch fixes the virt -> phys translation in eeh_token_to_phys() function. $ cat /sys/kernel/debug/powerpc/eeh_address_cache mem addr range [0x0000040080000000-0x00000400807fffff]: 0030:01:00.1 mem addr range [0x0000040080800000-0x0000040080ffffff]: 0030:01:00.1 mem addr range [0x0000040081000000-0x00000400817fffff]: 0030:01:00.0 mem addr range [0x0000040081800000-0x0000040081ffffff]: 0030:01:00.0 mem addr range [0x0000040082000000-0x000004008207ffff]: 0030:01:00.1 mem addr range [0x0000040082080000-0x00000400820fffff]: 0030:01:00.0 mem addr range [0x0000040082100000-0x000004008210ffff]: 0030:01:00.1 mem addr range [0x0000040082110000-0x000004008211ffff]: 0030:01:00.0 Above is the list of cached io address ranges of pci 0030:01:00.<fn>. Before this patch: Tracing 'arg1' of function eeh_addr_cache_get_dev() during error injection clearly shows that 'addr=' contains wrong physical address: kworker/u16:0-7 [001] .... 108.883775: eeh_addr_cache_get_dev: (eeh_addr_cache_get_dev+0xc/0xf0) addr=0x80103000a510 dmesg shows no EEH recovery messages: [ 108.563768] bnx2x: [bnx2x_timer:5801(eth2)]MFW seems hanged: drv_pulse (0x9ae) != mcp_pulse (0x7fff) [ 108.563788] bnx2x: [bnx2x_hw_stats_update:870(eth2)]NIG timer max (4294967295) [ 108.883788] bnx2x: [bnx2x_acquire_hw_lock:2013(eth1)]lock_status 0xffffffff resource_bit 0x1 [ 108.884407] bnx2x 0030:01:00.0 eth1: MDC/MDIO access timeout [ 108.884976] bnx2x 0030:01:00.0 eth1: MDC/MDIO access timeout <..> After this patch: eeh_addr_cache_get_dev() trace shows correct physical address: <idle>-0 [001] ..s. 1043.123828: eeh_addr_cache_get_dev: (eeh_addr_cache_get_dev+0xc/0xf0) addr=0x40080bc7cd8 dmesg logs shows EEH recovery getting triggerred: [ 964.323980] bnx2x: [bnx2x_timer:5801(eth2)]MFW seems hanged: drv_pulse (0x746f) != mcp_pulse (0x7fff) [ 964.323991] EEH: Recovering PHB#30-PE#10000 [ 964.324002] EEH: PE location: N/A, PHB location: N/A [ 964.324006] EEH: Frozen PHB#30-PE#10000 detected <..> Fixes: 33439620680b ("powerpc/eeh: Handle hugepages in ioremap space") Cc: stable@vger.kernel.org # v5.3+ Reported-by: Dominic DeMarco <ddemarc@us.ibm.com> Signed-off-by: Mahesh Salgaonkar <mahesh@linux.ibm.com> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/161821396263.48361.2796709239866588652.stgit@jupiter Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge branch 'android-4.4-p' of ↵Michael Bestas2020-12-09
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-06200-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 4cb652f2d058e ANDROID: cuttlefish_defconfig: Disable CONFIG_KSM Conflicts: arch/arm64/include/asm/mmu_context.h arch/powerpc/include/asm/uaccess.h drivers/scsi/ufs/ufshcd.c Change-Id: I25e090fc1a5a7d379aa8f681371e9918b3adeda6
| * | Merge 4.4.246 into android-4.4-pGreg Kroah-Hartman2020-11-24
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.246 ah6: fix error return code in ah6_input() atm: nicstar: Unmap DMA on send error net: b44: fix error return code in b44_init_one() net: bridge: add missing counters to ndo_get_stats64 callback netlabel: fix our progress tracking in netlbl_unlabel_staticlist() netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist() net/mlx4_core: Fix init_hca fields offset net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request qlcnic: fix error return code in qlcnic_83xx_restart_hw() sctp: change to hold/put transport for proto_unreach_timer net: usb: qmi_wwan: Set DTR quirk for MR400 net: Have netpoll bring-up DSA management interface pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq arm64: psci: Avoid printing in cpu_psci_cpu_die() MIPS: Fix BUILD_ROLLBACK_PROLOGUE for microMIPS Input: adxl34x - clean up a data type in adxl34x_probe() arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy ARM: dts: imx50-evk: Fix the chip select 1 IOMUX perf lock: Don't free "lock_seq_stat" if read_count isn't zero can: dev: can_restart(): post buffer from the right context can: peak_usb: fix potential integer overflow on shift of a int can: m_can: m_can_handle_state_change(): fix state change MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu regulator: ti-abb: Fix array out of bound read access on the first transition libfs: fix error cast of negative value in simple_attr_write() powerpc/uaccess-flush: fix corenet64_smp_defconfig build ALSA: ctl: fix error path at adding user-defined element set ALSA: mixart: Fix mutex deadlock tty: serial: imx: keep console clocks always on efivarfs: fix memory leak in efivarfs_create() ext4: fix bogus warning in ext4_update_dx_flag() xtensa: disable preemption around cache alias management calls mac80211: minstrel: remove deferred sampling code mac80211: minstrel: fix tx status processing corner case mac80211: allow driver to prevent two stations w/ same address mac80211: free sta in sta_info_insert_finish() on errors s390/cpum_sf.c: fix file permission for cpum_sfb_size x86/microcode/intel: Check patch signature before saving microcode for early loading Linux 4.4.246 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I61a042e58de9b4af9a8e1880cf9ad829f57af60c
| | * powerpc/uaccess-flush: fix corenet64_smp_defconfig buildDaniel Axtens2020-11-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Gunter reports problems with the corenet64_smp_defconfig: In file included from arch/powerpc/kernel/ppc_ksyms.c:10:0: arch/powerpc/include/asm/book3s/64/kup-radix.h:11:29: error: redefinition of ‘allow_user_access’ static __always_inline void allow_user_access(void __user *to, const void __user *from, ^~~~~~~~~~~~~~~~~ In file included from arch/powerpc/include/asm/uaccess.h:12:0, from arch/powerpc/kernel/ppc_ksyms.c:8: arch/powerpc/include/asm/kup.h:12:20: note: previous definition of ‘allow_user_access’ was here static inline void allow_user_access(void __user *to, const void __user *from, ^~~~~~~~~~~~~~~~~ This is because ppc_ksyms.c imports asm/book3s/64/kup-radix.h guarded by CONFIG_PPC64, rather than CONFIG_PPC_BOOK3S_64 which it should do. Fix it. Reported-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Daniel Axtens <dja@axtens.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | Merge 4.4.245 into android-4.4-pGreg Kroah-Hartman2020-11-22
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.245 powerpc/64s: Define MASKABLE_RELON_EXCEPTION_PSERIES_OOL powerpc/64s: move some exception handlers out of line powerpc/64s: flush L1D on kernel entry powerpc: Add a framework for user access tracking powerpc: Implement user_access_begin and friends powerpc: Fix __clear_user() with KUAP enabled powerpc/uaccess: Evaluate macro arguments once, before user access is allowed powerpc/64s: flush L1D after user accesses i2c: imx: Fix external abort on interrupt in exit paths xfs: catch inode allocation state mismatch corruption xfs: validate cached inodes are free when allocated powerpc/8xx: Always fault when _PAGE_ACCESSED is not set Input: sunkbd - avoid use-after-free in teardown paths mac80211: always wind down STA state KVM: x86: clflushopt should be treated as a no-op by emulation Linux 4.4.245 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I78cbd0900d1b7be38a6d7e588bff9189bc8f1718
| | * powerpc/8xx: Always fault when _PAGE_ACCESSED is not setChristophe Leroy2020-11-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 29daf869cbab69088fe1755d9dd224e99ba78b56 upstream. The kernel expects pte_young() to work regardless of CONFIG_SWAP. Make sure a minor fault is taken to set _PAGE_ACCESSED when it is not already set, regardless of the selection of CONFIG_SWAP. This adds at least 3 instructions to the TLB miss exception handlers fast path. Following patch will reduce this overhead. Also update the rotation instruction to the correct number of bits to reflect all changes done to _PAGE_ACCESSED over time. Fixes: d069cb4373fe ("powerpc/8xx: Don't touch ACCESSED when no SWAP.") Fixes: 5f356497c384 ("powerpc/8xx: remove unused _PAGE_WRITETHRU") Fixes: e0a8e0d90a9f ("powerpc/8xx: Handle PAGE_USER via APG bits") Fixes: 5b2753fc3e8a ("powerpc/8xx: Implementation of PAGE_EXEC") Fixes: a891c43b97d3 ("powerpc/8xx: Prepare handlers for _PAGE_HUGE for 512k pages.") Cc: stable@vger.kernel.org Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/af834e8a0f1fa97bfae65664950f0984a70c4750.1602492856.git.christophe.leroy@csgroup.eu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * powerpc/64s: flush L1D after user accessesNicholas Piggin2020-11-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 9a32a7e78bd0cd9a9b6332cbdc345ee5ffd0c5de upstream. IBM Power9 processors can speculatively operate on data in the L1 cache before it has been completely validated, via a way-prediction mechanism. It is not possible for an attacker to determine the contents of impermissible memory using this method, since these systems implement a combination of hardware and software security measures to prevent scenarios where protected data could be leaked. However these measures don't address the scenario where an attacker induces the operating system to speculatively execute instructions using data that the attacker controls. This can be used for example to speculatively bypass "kernel user access prevention" techniques, as discovered by Anthony Steinhauser of Google's Safeside Project. This is not an attack by itself, but there is a possibility it could be used in conjunction with side-channels or other weaknesses in the privileged code to construct an attack. This issue can be mitigated by flushing the L1 cache between privilege boundaries of concern. This patch flushes the L1 cache after user accesses. This is part of the fix for CVE-2020-4788. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Signed-off-by: Daniel Axtens <dja@axtens.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * powerpc: Fix __clear_user() with KUAP enabledAndrew Donnellan2020-11-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 61e3acd8c693a14fc69b824cb5b08d02cb90a6e7 upstream. The KUAP implementation adds calls in clear_user() to enable and disable access to userspace memory. However, it doesn't add these to __clear_user(), which is used in the ptrace regset code. As there's only one direct user of __clear_user() (the regset code), and the time taken to set the AMR for KUAP purposes is going to dominate the cost of a quick access_ok(), there's not much point having a separate path. Rename __clear_user() to __arch_clear_user(), and make __clear_user() just call clear_user(). Reported-by: syzbot+f25ecf4b2982d8c7a640@syzkaller-ppc64.appspotmail.com Reported-by: Daniel Axtens <dja@axtens.net> Suggested-by: Michael Ellerman <mpe@ellerman.id.au> Fixes: de78a9c42a79 ("powerpc: Add a framework for Kernel Userspace Access Protection") Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com> [mpe: Use __arch_clear_user() for the asm version like arm64 & nds32] Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20191209132221.15328-1-ajd@linux.ibm.com Signed-off-by: Daniel Axtens <dja@axtens.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * powerpc/64s: flush L1D on kernel entryNicholas Piggin2020-11-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit f79643787e0a0762d2409b7b8334e83f22d85695 upstream. IBM Power9 processors can speculatively operate on data in the L1 cache before it has been completely validated, via a way-prediction mechanism. It is not possible for an attacker to determine the contents of impermissible memory using this method, since these systems implement a combination of hardware and software security measures to prevent scenarios where protected data could be leaked. However these measures don't address the scenario where an attacker induces the operating system to speculatively execute instructions using data that the attacker controls. This can be used for example to speculatively bypass "kernel user access prevention" techniques, as discovered by Anthony Steinhauser of Google's Safeside Project. This is not an attack by itself, but there is a possibility it could be used in conjunction with side-channels or other weaknesses in the privileged code to construct an attack. This issue can be mitigated by flushing the L1 cache between privilege boundaries of concern. This patch flushes the L1 cache on kernel entry. This is part of the fix for CVE-2020-4788. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Signed-off-by: Daniel Axtens <dja@axtens.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * powerpc/64s: move some exception handlers out of lineDaniel Axtens2020-11-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (backport only) We're about to grow the exception handlers, which will make a bunch of them no longer fit within the space available. We move them out of line. This is a fiddly and error-prone business, so in the interests of reviewability I haven't merged this in with the addition of the entry flush. Signed-off-by: Daniel Axtens <dja@axtens.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge branch 'android-4.4-p' of ↵Michael Bestas2020-11-15
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.2.r1-07400-sdm660.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 34b1d1174c2c7 UPSTREAM: arm64: kaslr: Fix up the kernel image alignment Conflicts: scripts/setlocalversion Change-Id: Id2981587a6e92eb10cfdc9b6d13cd4bd2abb5670
| * | Merge 4.4.241 into android-4.4-pGreg Kroah-Hartman2020-10-29
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.241 ibmveth: Identify ingress large send packets. tipc: fix the skb_unshare() in tipc_buf_append() net/ipv4: always honour route mtu during forwarding r8169: fix data corruption issue on RTL8402 ALSA: bebob: potential info leak in hwdep_read() mm/kasan: print name of mem[set,cpy,move]() caller in report mm/kasan: add API to check memory regions compiler.h, kasan: Avoid duplicating __read_once_size_nocheck() compiler.h: Add read_word_at_a_time() function. lib/strscpy: Shut up KASAN false-positives in strscpy() x86/mm/ptdump: Fix soft lockup in page table walker net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling ether_setup nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download() tcp: fix to update snd_wl1 in bulk receiver fast path icmp: randomize the global rate limiter cifs: remove bogus debug code ima: Don't ignore errors from crypto_shash_update() EDAC/i5100: Fix error handling order in i5100_init_one() crypto: ixp4xx - Fix the size used in a 'dma_free_coherent()' call media: Revert "media: exynos4-is: Add missed check for pinctrl_lookup_state()" media: m5mols: Check function pointer in m5mols_sensor_power media: omap3isp: Fix memleak in isp_probe crypto: omap-sham - fix digcnt register handling with export/import media: tc358743: initialize variable media: ti-vpe: Fix a missing check and reference count leak ath6kl: prevent potential array overflow in ath6kl_add_new_sta() ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb() wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680 mwifiex: Do not use GFP_KERNEL in atomic context drm/gma500: fix error check scsi: qla4xxx: Fix an error handling path in 'qla4xxx_get_host_stats()' scsi: csiostor: Fix wrong return value in csio_hw_prep_fw() backlight: sky81452-backlight: Fix refcount imbalance on error VMCI: check return value of get_user_pages_fast() for errors tty: serial: earlycon dependency tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup() pty: do tty_flip_buffer_push without port->lock in pty_write drivers/virt/fsl_hypervisor: Fix error handling path video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error video: fbdev: sis: fix null ptr dereference HID: roccat: add bounds checking in kone_sysfs_write_settings() ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd() misc: mic: scif: Fix error handling path ALSA: seq: oss: Avoid mutex lock for a long-time ioctl quota: clear padding in v2r1_mem2diskdqb() net: enic: Cure the enic api locking trainwreck mfd: sm501: Fix leaks in probe() usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well nl80211: fix non-split wiphy information mwifiex: fix double free net: korina: fix kfree of rx/tx descriptor array IB/mlx4: Adjust delayed work when a dup is observed powerpc/pseries: Fix missing of_node_put() in rng_init() powerpc/icp-hv: Fix missing of_node_put() in success path mtd: lpddr: fix excessive stack usage with clang mtd: mtdoops: Don't write panic data twice ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT values powerpc/tau: Use appropriate temperature sample interval powerpc/tau: Remove duplicated set_thresholds() call powerpc/tau: Disable TAU between measurements perf intel-pt: Fix "context_switch event has no tid" error kdb: Fix pager search for multi-line strings powerpc/perf/hv-gpci: Fix starting index value cpufreq: powernv: Fix frame-size-overflow in powernv_cpufreq_reboot_notifier lib/crc32.c: fix trivial typo in preprocessor condition vfio/pci: Clear token on bypass registration failure Input: imx6ul_tsc - clean up some errors in imx6ul_tsc_resume() Input: ep93xx_keypad - fix handling of platform_get_irq() error Input: omap4-keypad - fix handling of platform_get_irq() error Input: sun4i-ps2 - fix handling of platform_get_irq() error KVM: x86: emulating RDPID failure shall return #UD rather than #GP memory: omap-gpmc: Fix a couple off by ones memory: fsl-corenet-cf: Fix handling of platform_get_irq() error arm64: dts: zynqmp: Remove additional compatible string for i2c IPs powerpc/powernv/dump: Fix race while processing OPAL dump media: firewire: fix memory leak media: ati_remote: sanity check for both endpoints media: exynos4-is: Fix several reference count leaks due to pm_runtime_get_sync media: exynos4-is: Fix a reference count leak due to pm_runtime_get_sync media: exynos4-is: Fix a reference count leak media: bdisp: Fix runtime PM imbalance on error media: media/pci: prevent memory leak in bttv_probe media: uvcvideo: Ensure all probed info is returned to v4l2 mmc: sdio: Check for CISTPL_VERS_1 buffer size media: saa7134: avoid a shift overflow ntfs: add check for mft record size in superblock PM: hibernate: remove the bogus call to get_gendisk() in software_resume() scsi: mvumi: Fix error return in mvumi_io_attach() scsi: target: core: Add CONTROL field for trace events usb: gadget: function: printer: fix use-after-free in __lock_acquire udf: Limit sparing table size udf: Avoid accessing uninitialized data on failed inode read ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs() misc: rtsx: Fix memory leak in rtsx_pci_probe reiserfs: only call unlock_new_inode() if I_NEW xfs: make sure the rt allocator doesn't run off the end usb: ohci: Default to per-port over-current protection Bluetooth: Only mark socket zapped after unlocking scsi: ibmvfc: Fix error return in ibmvfc_probe() brcmsmac: fix memory leak in wlc_phy_attach_lcnphy rtl8xxxu: prevent potential memory leak Fix use after free in get_capset_info callback. tty: ipwireless: fix error handling ipvs: Fix uninit-value in do_ip_vs_set_ctl() reiserfs: Fix memory leak in reiserfs_parse_options() brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach usb: core: Solve race condition in anchor cleanup functions ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n() net: korina: cast KSEG0 address to pointer in kfree usb: cdc-acm: add quirk to blacklist ETAS ES58X devices USB: cdc-wdm: Make wdm_flush() interruptible and add wdm_fsync(). Linux 4.4.241 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I996be1c1248d000431eb6f5c53472dbafba8bd9c
| | * powerpc/tau: Disable TAU between measurementsFinn Thain2020-10-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit e63d6fb5637e92725cf143559672a34b706bca4f ] Enabling CONFIG_TAU_INT causes random crashes: Unrecoverable exception 1700 at c0009414 (msr=1000) Oops: Unrecoverable exception, sig: 6 [#1] BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=2 PowerMac Modules linked in: CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.7.0-pmac-00043-gd5f545e1a8593 #5 NIP: c0009414 LR: c0009414 CTR: c00116fc REGS: c0799eb8 TRAP: 1700 Not tainted (5.7.0-pmac-00043-gd5f545e1a8593) MSR: 00001000 <ME> CR: 22000228 XER: 00000100 GPR00: 00000000 c0799f70 c076e300 00800000 0291c0ac 00e00000 c076e300 00049032 GPR08: 00000001 c00116fc 00000000 dfbd3200 ffffffff 007f80a8 00000000 00000000 GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 c075ce04 GPR24: c075ce04 dfff8880 c07b0000 c075ce04 00080000 00000001 c079ef98 c079ef5c NIP [c0009414] arch_cpu_idle+0x24/0x6c LR [c0009414] arch_cpu_idle+0x24/0x6c Call Trace: [c0799f70] [00000001] 0x1 (unreliable) [c0799f80] [c0060990] do_idle+0xd8/0x17c [c0799fa0] [c0060ba4] cpu_startup_entry+0x20/0x28 [c0799fb0] [c072d220] start_kernel+0x434/0x44c [c0799ff0] [00003860] 0x3860 Instruction dump: XXXXXXXX XXXXXXXX XXXXXXXX 3d20c07b XXXXXXXX XXXXXXXX XXXXXXXX 7c0802a6 XXXXXXXX XXXXXXXX XXXXXXXX 4e800421 XXXXXXXX XXXXXXXX XXXXXXXX 7d2000a6 ---[ end trace 3a0c9b5cb216db6b ]--- Resolve this problem by disabling each THRMn comparator when handling the associated THRMn interrupt and by disabling the TAU entirely when updating THRMn thresholds. Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/5a0ba3dc5612c7aac596727331284a3676c08472.1599260540.git.fthain@telegraphics.com.au Signed-off-by: Sasha Levin <sashal@kernel.org>
| | * powerpc/tau: Remove duplicated set_thresholds() callFinn Thain2020-10-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 420ab2bc7544d978a5d0762ee736412fe9c796ab ] The commentary at the call site seems to disagree with the code. The conditional prevents calling set_thresholds() via the exception handler, which appears to crash. Perhaps that's because it immediately triggers another TAU exception. Anyway, calling set_thresholds() from TAUupdate() is redundant because tau_timeout() does so. Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/d7c7ee33232cf72a6a6bbb6ef05838b2e2b113c0.1599260540.git.fthain@telegraphics.com.au Signed-off-by: Sasha Levin <sashal@kernel.org>
| | * powerpc/tau: Use appropriate temperature sample intervalFinn Thain2020-10-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 66943005cc41f48e4d05614e8f76c0ca1812f0fd ] According to the MPC750 Users Manual, the SITV value in Thermal Management Register 3 is 13 bits long. The present code calculates the SITV value as 60 * 500 cycles. This would overflow to give 10 us on a 500 MHz CPU rather than the intended 60 us. (But according to the Microprocessor Datasheet, there is also a factor of 266 that has to be applied to this value on certain parts i.e. speed sort above 266 MHz.) Always use the maximum cycle count, as recommended by the Datasheet. Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/896f542e5f0f1d6cf8218524c2b67d79f3d69b3c.1599260540.git.fthain@telegraphics.com.au Signed-off-by: Sasha Levin <sashal@kernel.org>
* | | Merge branch 'android-4.4-p' of ↵Michael Bestas2020-10-23
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-06000-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 7a9986e91f909 UPSTREAM: binder: fix UAF when releasing todo list Conflicts: fs/eventpoll.c Change-Id: I77260d03cb539d7e7eefcea360aee2d59bb9e0cb
| * | Merge 4.4.237 into android-4.4-pGreg Kroah-Hartman2020-09-23
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.237 ARM: dts: socfpga: fix register entry for timer3 on Arria10 scsi: libsas: Set data_dir as DMA_NONE if libata marks qc as NODATA drivers/net/wan/lapbether: Added needed_tailroom firestream: Fix memleak in fs_open drivers/net/wan/lapbether: Set network_header before transmitting xfs: initialize the shortform attr header padding entry drivers/net/wan/hdlc_cisco: Add hard_header_len ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled gcov: Disable gcov build with GCC 10 iio: adc: mcp3422: fix locking scope iio: adc: mcp3422: fix locking on error path iio:light:ltr501 Fix timestamp alignment issue. iio:accel:bmc150-accel: Fix timestamp alignment and prevent data leak. iio:accel:mma8452: Fix timestamp alignment and prevent data leak. USB: core: add helpers to retrieve endpoints staging: wlan-ng: fix out of bounds read in prism2sta_probe_usb() btrfs: fix wrong address when faulting in pages in the search ioctl scsi: target: iscsi: Fix hang in iscsit_access_np() when getting tpg->np_login_sem rbd: require global CAP_SYS_ADMIN for mapping and unmapping fbcon: remove soft scrollback code fbcon: remove now unusued 'softback_lines' cursor() argument vgacon: remove software scrollback support KVM: VMX: Don't freeze guest when event delivery causes an APIC-access exit video: fbdev: fix OOB read in vga_8planes_imageblit() USB: serial: ftdi_sio: add IDs for Xsens Mti USB converter USB: serial: option: add support for SIM7070/SIM7080/SIM7090 modules usb: Fix out of sync data toggle if a configured device is reconfigured gcov: add support for GCC 10.1 NFSv4.1 handle ERR_DELAY error reclaiming locking state on delegation recall scsi: pm8001: Fix memleak in pm8001_exec_internal_task_abort scsi: lpfc: Fix FLOGI/PLOGI receive race condition in pt2pt discovery SUNRPC: stop printk reading past end of string rapidio: Replace 'select' DMAENGINES 'with depends on' i2c: algo: pca: Reapply i2c bus settings after reset MIPS: SNI: Fix MIPS_L1_CACHE_SHIFT perf test: Free formats for perf pmu parse test fbcon: Fix user font detection test at fbcon_resize(). MIPS: SNI: Fix spurious interrupts USB: quirks: Add USB_QUIRK_IGNORE_REMOTE_WAKEUP quirk for BYD zhaoxin notebook USB: UAS: fix disconnect by unplugging a hub usblp: fix race between disconnect() and read() Input: i8042 - add Entroware Proteus EL07R4 to nomux and reset lists serial: 8250_pci: Add Realtek 816a and 816b ehci-hcd: Move include to keep CRC stable powerpc/dma: Fix dma_map_ops::get_required_mask x86/defconfig: Enable CONFIG_USB_XHCI_HCD=y Linux 4.4.237 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: If3f7701823084090849a6866ba1e52a0276c9621
| | * powerpc/dma: Fix dma_map_ops::get_required_maskAlexey Kardashevskiy2020-09-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 437ef802e0adc9f162a95213a3488e8646e5fc03 upstream. There are 2 problems with it: 1. "<" vs expected "<<" 2. the shift number is an IOMMU page number mask, not an address mask as the IOMMU page shift is missing. This did not hit us before f1565c24b596 ("powerpc: use the generic dma_ops_bypass mode") because we had additional code to handle bypass mask so this chunk (almost?) never executed.However there were reports that aacraid does not work with "iommu=nobypass". After f1565c24b596, aacraid (and probably others which call dma_get_required_mask() before setting the mask) was unable to enable 64bit DMA and fall back to using IOMMU which was known not to work, one of the problems is double free of an IOMMU page. This fixes DMA for aacraid, both with and without "iommu=nobypass" in the kernel command line. Verified with "stress-ng -d 4". Fixes: 6a5c7be5e484 ("powerpc: Override dma_get_required_mask by platform hook and ops") Cc: stable@vger.kernel.org # v3.2+ Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20200908015106.79661-1-aik@ozlabs.ru Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge branch 'android-4.4-p' of ↵Michael Bestas2020-08-23
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-05900-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 59f04f292e871 ANDROID: fix a bug in quota2 Conflicts: Makefile fs/ext4/inode.c fs/f2fs/dir.c Change-Id: Ic71b44a02908cf633d96114f0ff745cf1e1186de
| * | Merge 4.4.233 into android-4.4-pGreg Kroah-Hartman2020-08-21
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.233 xfs: don't call xfs_da_shrink_inode with NULL bp net: phy: mdio-bcm-unimac: fix potential NULL dereference in unimac_mdio_probe() media: rc: prevent memory leak in cx23888_ir_probe ath9k_htc: release allocated buffer if timed out ath9k: release allocated buffer if timed out nfs: Move call to security_inode_listsecurity into nfs_listxattr PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl() drm: hold gem reference until object is no longer accessed f2fs: check memory boundary by insane namelen f2fs: check if file namelen exceeds max value ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins. rds: Prevent kernel-infoleak in rds_notify_queue_get() net/x25: Fix x25_neigh refcnt leak when x25 disconnect net/x25: Fix null-ptr-deref in x25_disconnect sh: Fix validation of system call number net: lan78xx: add missing endpoint sanity check net: lan78xx: fix transfer-buffer memory leak mlxsw: core: Increase scope of RCU read-side critical section mac80211: mesh: Free ie data when leaving mesh nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame net: ethernet: ravb: exit if re-initialization fails in tx timeout Revert "i2c: cadence: Fix the hold bit setting" xen-netfront: fix potential deadlock in xennet_remove() x86/i8259: Use printk_deferred() to prevent deadlock random32: update the net random state on interrupt and activity ARM: percpu.h: fix build error random: fix circular include dependency on arm64 after addition of percpu.h random32: remove net_rand_state from the latent entropy gcc plugin random32: move the pseudo-random 32-bit definitions to prandom.h ext4: fix direct I/O read error USB: serial: qcserial: add EM7305 QDL product ID ALSA: seq: oss: Serialize ioctls Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt() Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt() Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt() vgacon: Fix for missing check in scrollback handling mtd: properly check all write ioctls for permissions net/9p: validate fds in p9_fd_open drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason cfg80211: check vendor command doit pointer before use igb: reinit_locked() should be called with rtnl_lock atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent tools lib traceevent: Fix memory leak in process_dynamic_array_len binder: Prevent context manager from incrementing ref 0 ipv4: Silence suspicious RCU usage warning ipv6: fix memory leaks on IPV6_ADDRFORM path Revert "vxlan: fix tos value before xmit" net: lan78xx: replace bogus endpoint lookup usb: hso: check for return value in hso_serial_common_create() vxlan: Ensure FDB dump is performed under RCU Smack: fix use-after-free in smk_write_relabel_self() tracepoint: Mark __tracepoint_string's __used udp: drop corrupt packets earlier to avoid data corruption gpio: fix oops resulting from calling of_get_named_gpio(NULL, ...) EDAC: Fix reference count leaks m68k: mac: Don't send IOP message until channel is idle m68k: mac: Fix IOP status/control register writes ARM: at91: pm: add missing put_device() call in at91_pm_sram_init() ARM: socfpga: PM: add missing put_device() call in socfpga_setup_ocram_self_refresh() drm/tilcdc: fix leak & null ref in panel_connector_get_modes Bluetooth: add a mutex lock to avoid UAF in do_enale_set fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync video: fbdev: neofb: fix memory leak in neo_scan_monitor() drm/nouveau: fix multiple instances of reference count leaks drm/debugfs: fix plain echo to connector "force" attribute mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls brcmfmac: To fix Bss Info flag definition Bug iwlegacy: Check the return value of pcie_capability_read_*() usb: gadget: net2280: fix memory leak on probe error handling paths bdc: Fix bug causing crash after multiple disconnects dyndbg: fix a BUG_ON in ddebug_describe_flags bcache: fix super block seq numbers comparision in register_cache_set() ACPICA: Do not increment operation_region reference counts for field units agp/intel: Fix a memory leak on module initialisation failure video: fbdev: sm712fb: fix an issue about iounmap for a wrong address console: newport_con: fix an issue about leak related system resources iio: improve IIO_CONCENTRATION channel type description leds: lm355x: avoid enum conversion warning media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities() scsi: cumana_2: Fix different dev_id between request_irq() and free_irq() cxl: Fix kobject memleak drm/radeon: fix array out-of-bounds read and write issues scsi: powertec: Fix different dev_id between request_irq() and free_irq() scsi: eesox: Fix different dev_id between request_irq() and free_irq() media: firewire: Using uninitialized values in node_probe() media: exynos4-is: Add missed check for pinctrl_lookup_state() drm: panel: simple: Fix bpc for LG LB070WV8 panel mwifiex: Prevent memory corruption handling keys powerpc/vdso: Fix vdso cpu truncation PCI/ASPM: Add missing newline in sysfs 'policy' usb: dwc2: Fix error path in gadget registration scsi: mesh: Fix panic after host or bus reset Smack: fix another vsscanf out of bounds Smack: prevent underflow in smk_set_cipso() power: supply: check if calc_soc succeeded in pm860x_init_battery s390/qeth: don't process empty bridge port events wl1251: fix always return 0 error net: spider_net: Fix the size used in a 'dma_free_coherent()' call dlm: Fix kobject memleak pinctrl-single: fix pcs_parse_pinconf() return value drivers/net/wan/lapbether: Added needed_headroom and a skb->len check net/nfc/rawsock.c: add CAP_NET_RAW check. net: Set fput_needed iff FDPUT_FPUT is set ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109 ALSA: usb-audio: add quirk for Pioneer DDJ-RB crypto: qat - fix double free in qat_uclo_create_batch_init_list fs/minix: check return value of sb_getblk() fs/minix: don't allow getting deleted inodes fs/minix: reject too-large maximum file size ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109 9p: Fix memory leak in v9fs_mount parisc: mask out enable and reserved bits from sba imask ARM: 8992/1: Fix unwind_frame for clang-built kernels xen/balloon: fix accounting in alloc_xenballooned_pages error path xen/balloon: make the balloon wait interruptible PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context() btrfs: only search for left_info if there is no right_info in try_merge_free_space btrfs: fix memory leaks after failure to lookup checksums during inode logging powerpc: Fix circular dependency between percpu.h and mmu.h net: ethernet: stmmac: Disable hardware multicast filter net: stmmac: dwmac1000: provide multicast filter fallback md/raid5: Fix Force reconstruct-write io stuck in degraded raid5 bcache: allocate meta data pages as compound pages mac80211: fix misplaced while instead of if MIPS: CPU#0 is not hotpluggable ext2: fix missing percpu_counter_inc ocfs2: change slot number type s16 to u16 kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler pseries: Fix 64 bit logical memory block panic USB: serial: ftdi_sio: make process-packet buffer unsigned USB: serial: ftdi_sio: clean up receive processing iommu/omap: Check for failure of a call to omap_iommu_dump_ctx iommu/vt-d: Enforce PASID devTLB field mask i2c: rcar: slave: only send STOP event when we have been addressed clk: clk-atlas6: fix return value check in atlas6_clk_init() Input: sentelic - fix error return when fsp_reg_write fails drm/vmwgfx: Fix two list_for_each loop exit tests nfs: Fix getxattr kernel panic and memory overflow fs/ufs: avoid potential u32 multiplication overflow mfd: dln2: Run event handler loop under spinlock ALSA: echoaudio: Fix potential Oops in snd_echo_resume() sh: landisk: Add missing initialization of sh_io_port_base ipv6: check skb->protocol before lookup for nexthop Linux 4.4.233 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iec7dcf69361bcc247996f3de2e20ba64ed0ce3a8
| | * powerpc/vdso: Fix vdso cpu truncationMilton Miller2020-08-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit a9f675f950a07d5c1dbcbb97aabac56f5ed085e3 ] The code in vdso_cpu_init that exposes the cpu and numa node to userspace via SPRG_VDSO incorrctly masks the cpu to 12 bits. This means that any kernel running on a box with more than 4096 threads (NR_CPUS advertises a limit of of 8192 cpus) would expose userspace to two cpu contexts running at the same time with the same cpu number. Note: I'm not aware of any distro shipping a kernel with support for more than 4096 threads today, nor of any system image that currently exceeds 4096 threads. Found via code browsing. Fixes: 18ad51dd342a7eb09dbcd059d0b451b616d4dafc ("powerpc: Add VDSO version of getcpu") Signed-off-by: Milton Miller <miltonm@us.ibm.com> Signed-off-by: Anton Blanchard <anton@linux.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20200715233704.1352257-1-anton@ozlabs.org Signed-off-by: Sasha Levin <sashal@kernel.org>
* | | Merge branch 'android-4.4-p' of ↵Michael Bestas2020-07-24
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-05700-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 8476df741c780 BACKPORT: xtables: extend matches and targets with .usersize Conflicts: drivers/usb/gadget/function/f_uac1.c net/netlink/genetlink.c sound/core/compress_offload.c Change-Id: Id7b2fdf3942f1986edec869dcd965df632cc1c5f
| * | Merge 4.4.229 into android-4.4-pGreg Kroah-Hartman2020-07-01
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.229 s390: fix syscall_get_error for compat processes clk: sunxi: Fix incorrect usage of round_down() i2c: piix4: Detect secondary SMBus controller on AMD AM4 chipsets clk: qcom: msm8916: Fix the address location of pll->config_reg ALSA: isa/wavefront: prevent out of bounds write in ioctl scsi: qla2xxx: Fix issue with adapter's stopping state i2c: pxa: clear all master action bits in i2c_pxa_stop_message() usblp: poison URBs upon disconnect ps3disk: use the default segment boundary vfio/pci: fix memory leaks in alloc_perm_bits() mfd: wm8994: Fix driver operation if loaded as modules scsi: lpfc: Fix lpfc_nodelist leak when processing unsolicited event nfsd: Fix svc_xprt refcnt leak when setup callback client failed powerpc/crashkernel: Take "mem=" option into account yam: fix possible memory leak in yam_init_driver mksysmap: Fix the mismatch of '.L' symbols in System.map scsi: sr: Fix sr_probe() missing deallocate of device minor scsi: ibmvscsi: Don't send host info in adapter info MAD after LPM ALSA: usb-audio: Improve frames size computation s390/qdio: put thinint indicator after early error tty: hvc: Fix data abort due to race in hvc_open staging: sm750fb: add missing case while setting FB_VISUAL i2c: pxa: fix i2c_pxa_scream_blue_murder() debug output serial: amba-pl011: Make sure we initialize the port.lock spinlock drivers: base: Fix NULL pointer exception in __platform_driver_probe() if a driver developer is foolish PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges power: supply: smb347-charger: IRQSTAT_D is volatile scsi: mpt3sas: Fix double free warnings dlm: remove BUG() before panic() clk: ti: composite: fix memory leak tty: n_gsm: Fix SOF skipping tty: n_gsm: Fix waking up upper tty layer when room available powerpc/pseries/ras: Fix FWNMI_VALID off by one powerpc/ps3: Fix kexec shutdown hang vfio-pci: Mask cap zero usb/ohci-platform: Fix a warning when hibernating USB: host: ehci-mxc: Add error handling in ehci_mxc_drv_probe() tty: n_gsm: Fix bogus i++ in gsm_data_kick clk: samsung: exynos5433: Add IGNORE_UNUSED flag to sclk_i2s1 watchdog: da9062: No need to ping manually before setting timeout usb: dwc2: gadget: move gadget resume after the core is in L0 state USB: gadget: udc: s3c2410_udc: Remove pointless NULL check in s3c2410_udc_nuke usb: gadget: lpc32xx_udc: don't dereference ep pointer before null check usb: gadget: fix potential double-free in m66592_probe. net: sunrpc: Fix off-by-one issues in 'rpc_ntop6' ASoC: fsl_asrc_dma: Fix dma_chan leak when config DMA channel failed openrisc: Fix issue with argument clobbering for clone/fork gfs2: Allow lock_nolock mount to specify jid=X scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj lib/zlib: remove outdated and incorrect pre-increment optimization include/linux/bitops.h: avoid clang shift-count-overflow warnings elfnote: mark all .note sections SHF_ALLOC selftests/net: in timestamping, strncpy needs to preserve null byte scsi: acornscsi: Fix an error handling path in acornscsi_probe() usb/xhci-plat: Set PM runtime as active on resume usb/ehci-platform: Set PM runtime as active on resume perf report: Fix NULL pointer dereference in hists__fprintf_nr_sample_events() bcache: fix potential deadlock problem in btree_gc_coalesce block: Fix use-after-free in blkdev_get() libata: Use per port sync for detach drm: encoder_slave: fix refcouting error for modules drm/dp_mst: Reformat drm_dp_check_act_status() a bit drm/qxl: Use correct notify port address when creating cursor ring selinux: fix double free ext4: fix partial cluster initialization when splitting extent drm/dp_mst: Increase ACT retry timeout to 3s sparc64: fix misuses of access_process_vm() in genregs32_[sg]et() block: nr_sects_write(): Disable preemption on seqcount write crypto: algboss - don't wait during notifier callback kprobes: Fix to protect kick_kprobe_optimizer() by kprobe_mutex powerpc/kprobes: Fixes for kprobe_lookup_name() on BE x86/kprobes: Avoid kretprobe recursion bug kretprobe: Prevent triggering kretprobe from within kprobe_flush_task e1000e: Do not wake up the system via WOL if device wakeup is disabled sched/rt, net: Use CONFIG_PREEMPTION.patch net: core: device_rename: Use rwsem instead of a seqcount net: Revert "pkt_sched: fq: use proper locking in fq_dump_stats()" scsi: scsi_devinfo: handle non-terminated strings l2tp: Allow duplicate session creation with UDP net: sched: export __netdev_watchdog_up() fix a braino in "sparc32: fix register window handling in genregs32_[gs]et()" net: fix memleak in register_netdevice() net: usb: ax88179_178a: fix packet alignment padding tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes ip_tunnel: fix use-after-free in ip_tunnel_lookup() tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT ip6_gre: fix use-after-free in ip6gre_tunnel_lookup() tcp: grow window for OOO packets only for SACK flows sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket net: Fix the arp error in some cases net: Do not clear the sock TX queue in sk_set_socket() net: core: reduce recursion limit value mld: fix memory leak in ipv6_mc_destroy_dev() USB: ohci-sm501: Add missed iounmap() in remove usb: dwc2: Postponed gadget registration to the udc class driver usb: add USB_QUIRK_DELAY_INIT for Logitech C922 PCI: Disable MSI for HiSilicon Hip06/Hip07 Root Ports USB: ehci: reopen solution for Synopsys HC bug usb: host: ehci-exynos: Fix error check in exynos_ehci_probe() ALSA: usb-audio: add quirk for Denon DCD-1500RE xhci: Fix incorrect EP_STATE_MASK xhci: Fix enumeration issue when setting max packet size for FS devices. cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip ALSA: usb-audio: uac1: Invalidate ctl on interrupt ALSA: usb-audio: allow clock source validity interrupts ALSA: usb-audio: Clean up mixer element list traverse ALSA: usb-audio: Fix OOB access of mixer element list xhci: Poll for U0 after disabling USB2 LPM cifs/smb3: Fix data inconsistent when punch hole cifs/smb3: Fix data inconsistent when zero file range efi/esrt: Fix reference count leak in esre_create_sysfs_entry. RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads() ARM: imx5: add missing put_device() call in imx_suspend_alloc_ocram() usb: gadget: udc: Potential Oops in error handling code netfilter: ipset: fix unaligned atomic access sched/core: Fix PI boosting between RT and DEADLINE tasks net: alx: fix race condition in alx_remove kbuild: improve cc-option to clean up all temporary files blktrace: break out of blktrace setup on concurrent calls ACPI: sysfs: Fix pm_profile_attr type KVM: X86: Fix MSR range of APIC registers in X2APIC mode mm/slab: use memzero_explicit() in kzfree() ocfs2: load global_inode_alloc ocfs2: fix value of OCFS2_INVALID_SLOT ocfs2: fix panic on nfs server over ocfs2 arm64: perf: Report the PC value in REGS_ABI_32 mode tracing: Fix event trigger to accept redundant spaces drm/radeon: fix fb_div check in ni_init_smc_spll_table() sunrpc: fixed rollback in rpc_gssd_dummy_populate() SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment() pNFS/flexfiles: Fix list corruption if the mirror count changes NFSv4 fix CLOSE not waiting for direct IO compeletion PCI: Disable MSI for HiSilicon Hip06/Hip07 only in Root Port mode ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate() Linux 4.4.229 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic510bbcf5c6e701c747c612876e3ce141757a34a
| | * powerpc/crashkernel: Take "mem=" option into accountPingfan Liu2020-06-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit be5470e0c285a68dc3afdea965032f5ddc8269d7 ] 'mem=" option is an easy way to put high pressure on memory during some test. Hence after applying the memory limit, instead of total mem, the actual usable memory should be considered when reserving mem for crashkernel. Otherwise the boot up may experience OOM issue. E.g. it would reserve 4G prior to the change and 512M afterward, if passing crashkernel="2G-4G:384M,4G-16G:512M,16G-64G:1G,64G-128G:2G,128G-:4G", and mem=5G on a 256G machine. This issue is powerpc specific because it puts higher priority on fadump and kdump reservation than on "mem=". Referring the following code: if (fadump_reserve_mem() == 0) reserve_crashkernel(); ... /* Ensure that total memory size is page-aligned. */ limit = ALIGN(memory_limit ?: memblock_phys_mem_size(), PAGE_SIZE); memblock_enforce_memory_limit(limit); While on other arches, the effect of "mem=" takes a higher priority and pass through memblock_phys_mem_size() before calling reserve_crashkernel(). Signed-off-by: Pingfan Liu <kernelfans@gmail.com> Reviewed-by: Hari Bathini <hbathini@linux.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/1585749644-4148-1-git-send-email-kernelfans@gmail.com Signed-off-by: Sasha Levin <sashal@kernel.org>
* | | Merge branch 'android-4.4-p' of ↵Michael Bestas2020-06-04
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-05500-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 60fca75727065 Merge 4.4.226 into android-4.4-p Conflicts: drivers/base/firmware_class.c drivers/gpu/drm/msm/msm_gem.c drivers/mmc/host/sdhci.c drivers/net/wireless/ath/ath10k/core.c kernel/trace/blktrace.c net/socket.c sound/core/rawmidi.c sound/usb/mixer.c Change-Id: Ic8599e865656da72a9405c45f27091ec1ddc168c
| * | Merge 4.4.223 into android-4.4-pGreg Kroah-Hartman2020-05-11
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.223 mwifiex: fix PCIe register information for 8997 chipset drm/qxl: qxl_release use after free drm/qxl: qxl_release leak in qxl_draw_dirty_fb() staging: rtl8192u: Fix crash due to pointers being "confusing" usb: gadget: f_acm: Fix configfs attr name usb: gadged: pch_udc: get rid of redundant assignments usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock usb: gadget: udc: core: don't starve DMA resources MIPS: Fix macro typo MIPS: ptrace: Drop cp0_tcstatus from regoffset_table[] MIPS: BMIPS: Fix PRID_IMP_BMIPS5000 masking for BMIPS5200 MIPS: smp-cps: Stop printing EJTAG exceptions to UART MIPS: scall: Handle seccomp filters which redirect syscalls MIPS: BMIPS: BMIPS5000 has I cache filing from D cache MIPS: BMIPS: Clear MIPS_CACHE_ALIASES earlier MIPS: BMIPS: local_r4k___flush_cache_all needs to blast S-cache MIPS: BMIPS: Pretty print BMIPS5200 processor name MIPS: Fix HTW config on XPA kernel without LPA enabled MIPS: BMIPS: Adjust mips-hpt-frequency for BCM7435 MIPS: math-emu: Fix BC1{EQ,NE}Z emulation MIPS: Fix BC1{EQ,NE}Z return offset calculation MIPS: perf: Fix I6400 event numbers MIPS: KVM: Fix translation of MFC0 ErrCtl MIPS: SMP: Update cpu_foreign_map on CPU disable MIPS: c-r4k: Fix protected_writeback_scache_line for EVA MIPS: Octeon: Off by one in octeon_irq_gpio_map() bpf, mips: fix off-by-one in ctx offset allocation MIPS: RM7000: Double locking bug in rm7k_tc_disable() MIPS: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO mips/panic: replace smp_send_stop() with kdump friendly version in panic path ARM: dts: armadillo800eva Correct extal1 frequency to 24 MHz ARM: imx: select SRC for i.MX7 ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wxl/wsxl ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wvl/vl ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wxl/wsxl ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wvl/vl ARM: dts: orion5x: gpio pin fixes for linkstation lswtgl ARM: dts: orion5x: fix the missing mtd flash on linkstation lswtgl ARM: dts: kirkwood: use unique machine name for ds112 ARM: dts: kirkwood: add kirkwood-ds112.dtb to Makefile ARM: OMAP2+: hwmod: fix _idle() hwmod state sanity check sequence perf/x86: Fix filter_events() bug with event mappings x86/LDT: Print the real LDT base address x86/apic/uv: Silence a shift wrapping warning ALSA: fm801: explicitly free IRQ line ALSA: fm801: propagate TUNER_ONLY bit when autodetected ALSA: fm801: detect FM-only card earlier netfilter: nfnetlink: use original skbuff when acking batches xfrm: fix crash in XFRM_MSG_GETSA netlink handler mwifiex: fix IBSS data path issue. mwifiex: add missing check for PCIe8997 chipset iwlwifi: set max firmware version of 7265 to 17 Bluetooth: btmrvl: fix hung task warning dump dccp: limit sk_filter trim to payload net/mlx4_core: Do not BUG_ON during reset when PCI is offline mlxsw: pci: Correctly determine if descriptor queue is full PCI: Supply CPU physical address (not bus address) to iomem_is_exclusive() net/mlx4_core: Implement pci_resume callback alpha/PCI: Call iomem_is_exclusive() for IORESOURCE_MEM, but not IORESOURCE_IO vfio/pci: Allow VPD short read brcmfmac: add eth_type_trans back for PCIe full dongle mlxsw: Treat local port 64 as valid IB/mlx4: Initialize hop_limit when creating address handle ovs/gre,geneve: fix error path when creating an iface GRE: Disable segmentation offloads w/ CSUM and we are encapsulated via FOU powerpc/pci/of: Parse unassigned resources firmware: actually return NULL on failed request_firmware_nowait() c8sectpfe: Rework firmware loading mechanism net/mlx5: Avoid passing dma address 0 to firmware IB/mlx5: Fix RC transport send queue overhead computation net/mlx5: Make command timeout way shorter IB/mlx5: Fix FW version diaplay in sysfs net/mlx5e: Fix MLX5E_100BASE_T define net/mlx5: Fix the size of modify QP mailbox net/mlx5: Fix masking of reserved bits in XRCD number net/mlx5e: Fix blue flame quota logic net/mlx5: use mlx5_buf_alloc_node instead of mlx5_buf_alloc in mlx5_wq_ll_create net/mlx5: Avoid calling sleeping function by the health poll thread net/mlx5: Fix wait_vital for VFs and remove fixed sleep net/mlx5: Fix potential deadlock in command mode change net/mlx5: Add timeout handle to commands with callback net/mlx5: Fix pci error recovery flow net/mlx5e: Copy all L2 headers into inline segment net_sched: keep backlog updated with qlen sch_drr: update backlog as well sch_hfsc: always keep backlog updated sch_prio: update backlog as well sch_qfq: keep backlog updated with qlen sch_sfb: keep backlog updated with qlen sch_tbf: update backlog as well btrfs: cleaner_kthread() doesn't need explicit freeze irda: Free skb on irda_accept error path. phy: fix device reference leaks bonding: prevent out of bound accesses mtd: nand: fix ONFI parameter page layout ath10k: free cached fw bin contents when get board id fails xprtrdma: checking for NULL instead of IS_ERR() xprtrdma: Fix additional uses of spin_lock_irqsave(rb_lock) xprtrdma: xprt_rdma_free() must not release backchannel reqs xprtrdma: rpcrdma_bc_receive_call() should init rq_private_buf.len RDMA/cxgb3: device driver frees DMA memory with different size mlxsw: spectrum: Don't forward packets when STP state is DISABLED mlxsw: spectrum: Disable learning according to STP state mlxsw: spectrum: Don't count internal TX header bytes to stats mlxsw: spectrum: Indicate support for autonegotiation mlxsw: spectrum: Fix misuse of hard_header_len net: tcp_memcontrol: properly detect ancestor socket pressure tcp: do not set rtt_min to 1 RDS:TCP: Synchronize rds_tcp_accept_one with rds_send_xmit when resetting t_sock net: ipv6: tcp reset, icmp need to consider L3 domain batman-adv: Fix lockdep annotation of batadv_tlv_container_remove batman-adv: replace WARN with rate limited output on non-existing VLAN tty: serial: msm: Support more bauds serial: samsung: Fix possible out of bounds access on non-DT platform Drivers: hv: utils: use memdup_user in hvt_op_write isa: Call isa_bus_init before dependent ISA bus drivers register Btrfs: clean up an error code in btrfs_init_space_info() Input: gpio-keys - fix check for disabling unsupported keys Input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key xfrm_user: propagate sec ctx allocation errors xfrm: Fix memory leak of aead algorithm name mac80211: fix mgmt-tx abort cookie and leak mac80211: TDLS: always downgrade invalid chandefs mac80211: TDLS: change BW calculation for WIDER_BW peers mac80211: Fix BW upgrade for TDLS peers NFS: Fix an LOCK/OPEN race when unlinking an open file net: get rid of an signed integer overflow in ip_idents_reserve() mtd: nand: denali: add missing nand_release() call in denali_remove() ASoC: Intel: pass correct parameter in sst_alloc_stream_mrfld() ASoC: tegra_alc5632: check return value ASoC: fsl_ssi: mark SACNT register volatile Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()" mmc: sdhci: restore behavior when setting VDD via external regulator mmc: sd: limit SD card power limit according to cards capabilities mmc: debugfs: correct wrong voltage value mmc: block: return error on failed mmc_blk_get() clk: rockchip: Revert "clk: rockchip: reset init state before mmc card initialization" mmc: dw_mmc: rockchip: Set the drive phase properly mmc: moxart: fix wait_for_completion_interruptible_timeout return variable type mmc: sdhci: Fix regression setting power on Trats2 board perf tools: Fix perf regs mask generation powerpc/tm: Fix stack pointer corruption in __tm_recheckpoint() powerpc/book3s: Fix MCE console messages for unrecoverable MCE. sctp: fix the transports round robin issue when init is retransmitted sunrpc: Update RPCBIND_MAXNETIDLEN NFC: nci: memory leak in nci_core_conn_create() net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS net: phy: Fix phy_mac_interrupt() net: phy: bcm7xxx: Fix shadow mode 2 disabling of_mdio: fix node leak in of_phy_register_fixed_link error path phy: micrel: Fix finding PHY properties in MAC node for KSZ9031. net: dsa: slave: fix of-node leak and phy priority drivers: net: cpsw: don't ignore phy-mode if phy-handle is used iommu/dma: Respect IOMMU aperture when allocating mdio-sun4i: oops in error handling in probe iio:ad7797: Use correct attribute_group selftests/ipc: Fix test failure seen after initial test run wimax/i2400m: Fix potential urb refcnt leak cifs: protect updating server->dstaddr with a spinlock scripts/config: allow colons in option strings for sed lib/mpi: Fix building for powerpc with clang net: bcmgenet: suppress warnings on failed Rx SKB allocations net: systemport: suppress warnings on failed Rx SKB allocations rc: allow rc modules to be loaded if rc-main is not a module lirc_imon: do not leave imon_probe() with mutex held am437x-vpfe: fix an uninitialized variable bug cx23885: uninitialized variable in cx23885_av_work_handler() ath9k_htc: check for underflow in ath9k_htc_rx_msg() VFIO: platform: reset: fix a warning message condition net: moxa: fix an error code mfd: lp8788-irq: Uninitialized variable in irq handler ethernet: micrel: fix some error codes power: ipaq-micro-battery: freeing the wrong variable i40e: fix an uninitialized variable bug qede: uninitialized variable in qede_start_xmit() qlcnic: potential NULL dereference in qlcnic_83xx_get_minidump_template() qlcnic: use the correct ring in qlcnic_83xx_process_rcv_ring_diag() target: Fix a memory leak in target_dev_lba_map_store() memory/tegra: Add number of TLB lines for Tegra124 pinctrl: bcm2835: Fix memory leak in error path be2net: Don't leak iomapped memory on removal. ipv4: Fix memory leak in exception case for splitting tries flow_dissector: Check for IP fragmentation even if not using IPv4 address ipv4: fix checksum annotation in udp4_csum_init ipv4: do not abuse GFP_ATOMIC in inet_netconf_notify_devconf() ipv4: accept u8 in IP_TOS ancillary data net: vrf: Fix dev refcnt leak due to IPv6 prefix route ipv6: fix checksum annotation in udp6_csum_init ipv6: do not abuse GFP_ATOMIC in inet6_netconf_notify_devconf() ipv6: add missing netconf notif when 'all' is updated net: ipv6: Fix processing of RAs in presence of VRF netfilter: nf_tables: fix a wrong check to skip the inactive rules netfilter: nft_dynset: fix panic if NFT_SET_HASH is not enabled netfilter: nf_tables: destroy the set if fail to add transaction netfilter: nft_dup: do not use sreg_dev if the user doesn't specify it udp: restore UDPlite many-cast delivery clk: st: avoid uninitialized variable use clk: gpio: handle error codes for of_clk_get_parent_count() clk: ti: omap3+: dpll: use non-locking version of clk_get_rate clk: multiplier: Prevent the multiplier from under / over flowing clk: imx: clk-pllv3: fix incorrect handle of enet powerdown bit clk: xgene: Don't call __pa on ioremaped address cls_bpf: reset class and reuse major in da arm64: bpf: jit JMP_JSET_{X,K} bpf, trace: check event type in bpf_perf_event_read bpf: fix map not being uncharged during map creation failure net/mlx4_core: Fix potential corruption in counters database net/mlx4_core: Fix access to uninitialized index net/mlx4_en: Fix the return value of a failure in VLAN VID add/kill net/mlx4_core: Check device state before unregistering it net/mlx4_core: Fix the resource-type enum in res tracker to conform to FW spec net/mlx4_en: Process all completions in RX rings after port goes up net/mlx4_core: Do not access comm channel if it has not yet been initialized net/mlx4_en: Fix potential deadlock in port statistics flow net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode to device managed flow steering net/mlx4_core: Fix QUERY FUNC CAP flags mlxsw: switchx2: Fix misuse of hard_header_len mlxsw: switchx2: Fix ethernet port initialization sched/fair: Fix calc_cfs_shares() fixed point arithmetics width confusion net_sched: flower: Avoid dissection of unmasked keys pkt_sched: fq: use proper locking in fq_dump_stats() sched/preempt: Fix preempt_count manipulations power: bq27xxx: fix reading for bq27000 and bq27010 power: bq27xxx: fix register numbers of bq27500 power: test_power: correctly handle empty writes power: bq27xxx_battery: Fix bq27541 AveragePower register address power_supply: tps65217-charger: Fix NULL deref during property export net: vrf: Fix dst reference counting net: Don't delete routes in different VRFs vti6: fix input path ipv4: Fix table id reference in fib_sync_down_addr mlx4: do not call napi_schedule() without care xprtrdma: Fix backchannel allocation of extra rpcrdma_reps ALSA: fm801: Initialize chip after IRQ handler is registered bonding: fix length of actor system MIPS: perf: Remove incorrect odd/even counter handling for I6400 Revert "cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT" net: dsa: mv88e6xxx: unlock DSA and CPU ports gfs2: fix flock panic issue blk-mq: fix undefined behaviour in order_to_size() dm: fix second blk_delay_queue() parameter to be in msec units not jiffies dmaengine: edma: Add probe callback to edma_tptc_driver openvswitch: update checksum in {push,pop}_mpls cxgb4/cxgb4vf: Fixes regression in perf when tx vlan offload is disabled net: bcmgenet: fix skb_len in bcmgenet_xmit_single() net: bcmgenet: device stats are unsigned long ovs/gre: fix rtnl notifications on iface deletion gre: do not assign header_ops in collect metadata mode gre: build header correctly for collect metadata tunnels gre: reject GUE and FOU in collect metadata mode sfc: fix potential stack corruption from running past stat bitmask sfc: clear napi_hash state when copying channels net: bcmsysport: Device stats are unsigned long cxgbi: fix uninitialized flowi6 net: macb: add missing free_netdev() on error in macb_probe() macvtap: segmented packet is consumed tipc: fix the error handling in tipc_udp_enable() net: icmp6_send should use dst dev to determine L3 domain et131x: Fix logical vs bitwise check in et131x_tx_timeout() net: ethernet: stmmac: dwmac-sti: fix probe error path rtnl: reset calcit fptr in rtnl_unregister() net: ethernet: stmmac: dwmac-rk: fix probe error path fq_codel: return non zero qlen in class dumps net: ethernet: stmmac: dwmac-generic: fix probe error path ovs/geneve: fix rtnl notifications on iface deletion bnxt: add a missing rcu synchronization qdisc: fix a module refcount leak in qdisc_create_dflt() net: axienet: Fix return value check in axienet_probe() bnxt_en: Remove locking around txr->dev_state net: ethernet: davinci_emac: Fix devioctl while in fixed link net: ethernet: mvneta: Remove IFF_UNICAST_FLT which is not implemented net: ethernet: ti: cpsw: fix device and of_node leaks net: ethernet: ti: cpsw: fix secondary-emac probe error path net: hns: fix device reference leaks net: bridge: don't increment tx_dropped in br_do_proxy_arp net: dsa: mv88e6xxx: enable SA learning on DSA ports net: ehea: avoid null pointer dereference l2tp: fix use-after-free during module unload hwrng: exynos - Disable runtime PM on driver unbind net: icmp_route_lookup should use rt dev to determine L3 domain net: mvneta: fix trivial cut-off issue in mvneta_ethtool_update_stats net: macb: replace macb_writel() call by queue_writel() to update queue ISR ravb: Add missing free_irq() call to ravb_close() mvpp2: use correct size for memset net: vxlan: lwt: Fix vxlan local traffic. net: ethoc: Fix early error paths ovs/vxlan: fix rtnl notifications on iface deletion net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets. regulator: core: Rely on regulator_dev_release to free constraints net: dsa: mv88e6xxx: fix port VLAN maps at803x: fix reset handling cxl: Fix DAR check & use REGION_ID instead of opencoding net: ethernet: davinci_emac: Fix platform_data overwrite ata: sata_dwc_460ex: remove incorrect locking pinctrl: tegra: Correctly check the supported configuration brcmfmac: add fallback for devices that do not report per-chain values brcmfmac: restore stopping netdev queue when bus clogs up bridge: Fix problems around fdb entries pointing to the bridge device bna: add missing per queue ethtool stat net: skbuff: Remove errornous length validation in skb_vlan_pop() net: ep93xx_eth: Do not crash unloading module macvlan: Fix potential use-after free for broadcasts sctp: Fix SHUTDOWN CTSN Ack in the peer restart case ALSA: hda: Match both PCI ID and SSID for driver blacklist mac80211: add ieee80211_is_any_nullfunc() Linux 4.4.223 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ie7caca39501fe5e82b947964cc474ed1c786d756
| | * powerpc/book3s: Fix MCE console messages for unrecoverable MCE.Mahesh Salgaonkar2020-05-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit c74dd88e77d3ecbc9e55c78796d82c9aa21cabad upstream. When machine check occurs with MSR(RI=0), it means MC interrupt is unrecoverable and kernel goes down to panic path. But the console message still shows it as recovered. This patch fixes the MCE console messages. Fixes: 36df96f8acaf ("powerpc/book3s: Decode and save machine check event.") Signed-off-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * powerpc/tm: Fix stack pointer corruption in __tm_recheckpoint()Michael Neuling2020-05-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 6bcb80143e792becfd2b9cc6a339ce523e4e2219 upstream. At the start of __tm_recheckpoint() we save the kernel stack pointer (r1) in SPRG SCRATCH0 (SPRG2) so that we can restore it after the trecheckpoint. Unfortunately, the same SPRG is used in the SLB miss handler. If an SLB miss is taken between the save and restore of r1 to the SPRG, the SPRG is changed and hence r1 is also corrupted. We can end up with the following crash when we start using r1 again after the restore from the SPRG: Oops: Bad kernel stack pointer, sig: 6 [#1] SMP NR_CPUS=2048 NUMA pSeries CPU: 658 PID: 143777 Comm: htm_demo Tainted: G EL X 4.4.13-0-default #1 task: c0000b56993a7810 ti: c00000000cfec000 task.ti: c0000b56993bc000 NIP: c00000000004f188 LR: 00000000100040b8 CTR: 0000000010002570 REGS: c00000000cfefd40 TRAP: 0300 Tainted: G EL X (4.4.13-0-default) MSR: 8000000300001033 <SF,ME,IR,DR,RI,LE> CR: 02000424 XER: 20000000 CFAR: c000000000008468 DAR: 00003ffd84e66880 DSISR: 40000000 SOFTE: 0 PACATMSCRATCH: 00003ffbc865e680 GPR00: fffffffcfabc4268 00003ffd84e667a0 00000000100d8c38 000000030544bb80 GPR04: 0000000000000002 00000000100cf200 0000000000000449 00000000100cf100 GPR08: 000000000000c350 0000000000002569 0000000000002569 00000000100d6c30 GPR12: 00000000100d6c28 c00000000e6a6b00 00003ffd84660000 0000000000000000 GPR16: 0000000000000003 0000000000000449 0000000010002570 0000010009684f20 GPR20: 0000000000800000 00003ffd84e5f110 00003ffd84e5f7a0 00000000100d0f40 GPR24: 0000000000000000 0000000000000000 0000000000000000 00003ffff0673f50 GPR28: 00003ffd84e5e960 00000000003d0f00 00003ffd84e667a0 00003ffd84e5e680 NIP [c00000000004f188] restore_gprs+0x110/0x17c LR [00000000100040b8] 0x100040b8 Call Trace: Instruction dump: f8a1fff0 e8e700a8 38a00000 7ca10164 e8a1fff8 e821fff0 7c0007dd 7c421378 7db142a6 7c3242a6 38800002 7c810164 <e9c100e0> e9e100e8 ea0100f0 ea2100f8 We hit this on large memory machines (> 2TB) but it can also be hit on smaller machines when 1TB segments are disabled. To hit this, you also need to be virtualised to ensure SLBs are periodically removed by the hypervisor. This patches moves the saving of r1 to the SPRG to the region where we are guaranteed not to take any further SLB misses. Fixes: 98ae22e15b43 ("powerpc: Add helper functions for transactional memory context switching") Cc: stable@vger.kernel.org # v3.9+ Signed-off-by: Michael Neuling <mikey@neuling.org> Acked-by: Cyril Bur <cyrilbur@gmail.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * powerpc/pci/of: Parse unassigned resourcesAlexey Kardashevskiy2020-05-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit dead1c845dbe97e0061dae2017eaf3bd8f8f06ee upstream. The pseries platform uses the PCI_PROBE_DEVTREE method of PCI probing which reads "assigned-addresses" of every PCI device and initializes the device resources. However if the property is missing or zero sized, then there is no fallback of any kind and the PCI resources remain undiscovered, i.e. pdev->resource[] array remains empty. This adds a fallback which parses the "reg" property in pretty much same way except it marks resources as "unset" which later make Linux assign those resources proper addresses. This has an effect when: 1. a hypervisor failed to assign any resource for a device; 2. /chosen/linux,pci-probe-only=0 is in the DT so the system may try assigning a resource. Neither is likely to happen under PowerVM. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Cc: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge branch 'android-4.4-p' of ↵Michael Bestas2020-05-14
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-05400-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 96b09cba55905 UPSTREAM: net: socket: set sock->sk to NULL after calling proto_ops::release() Conflicts: drivers/scsi/ufs/ufshcd.c drivers/usb/gadget/composite.c drivers/usb/gadget/function/f_fs.c Change-Id: I3e79c0d20e3eb3246a50c9a1e815cdf030a4232e
| * | Merge 4.4.220 into android-4.4-pGreg Kroah-Hartman2020-04-24
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.220 bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads net: vxge: fix wrong __VA_ARGS__ usage qlcnic: Fix bad kzalloc null test i2c: st: fix missing struct parameter description irqchip/versatile-fpga: Handle chained IRQs properly selftests/x86/ptrace_syscall_32: Fix no-vDSO segfault libata: Remove extra scsi_host_put() in ata_scsi_add_hosts() gfs2: Don't demote a glock until its revokes are written x86/boot: Use unsigned comparison for addresses locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps() btrfs: remove a BUG_ON() from merge_reloc_roots() btrfs: track reloc roots based on their commit root bytenr misc: rtsx: set correct pcr_ops for rts522A ASoC: fix regwmask ASoC: dapm: connect virtual mux with default value ASoC: dpcm: allow start or stop during pause for backend ASoC: topology: use name_prefix for new kcontrol usb: gadget: f_fs: Fix use after free issue as part of queue failure usb: gadget: composite: Inform controller driver of self-powered ALSA: usb-audio: Add mixer workaround for TRX40 and co ALSA: hda: Add driver blacklist ALSA: hda: Fix potential access overflow in beep helper ALSA: ice1724: Fix invalid access for enumerated ctl items ALSA: pcm: oss: Fix regression by buffer overflow fix acpi/x86: ignore unspecified bit positions in the ACPI global lock field thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n KEYS: reaching the keys quotas correctly irqchip/versatile-fpga: Apply clear-mask earlier MIPS: OCTEON: irq: Fix potential NULL pointer dereference ath9k: Handle txpower changes even when TPC is disabled signal: Extend exec_id to 64bits x86/entry/32: Add missing ASM_CLAC to general_protection entry KVM: x86: Allocate new rmap and large page tracking when moving memslot crypto: mxs-dcp - fix scatterlist linearization for hash futex: futex_wake_op, do not fail on invalid op xen-netfront: Rework the fix for Rx stall during OOM and network stress ALSA: hda: Initialize power_state field properly Btrfs: incremental send, fix invalid memory access IB/ipoib: Fix lockdep issue found on ipoib_ib_dev_heavy_flush scsi: zfcp: fix missing erp_lock in port recovery trigger for point-to-point arm64: armv8_deprecated: Fix undef_hook mask for thumb setend ext4: fix a data race at inode->i_blocks ocfs2: no need try to truncate file beyond i_size s390/diag: fix display of diagnose call statistics Input: i8042 - add Acer Aspire 5738z to nomux list kmod: make request_module() return an error when autoloading is disabled hfsplus: fix crash and filesystem corruption when deleting files libata: Return correct status in sata_pmp_eh_recover_pm() when ATA_DFLAG_DETACH is set powerpc/64/tm: Don't let userspace set regs->trap via sigreturn Btrfs: fix crash during unmount due to race with delayed inode workers drm/dp_mst: Fix clearing payload state on topology disable ipmi: fix hung processes in __get_guid() powerpc/fsl_booke: Avoid creating duplicate tlb1 entry misc: echo: Remove unnecessary parentheses and simplify check for zero mfd: dln2: Fix sanity checking for endpoints net: ipv4: devinet: Fix crash when add/del multicast IP with autojoin net: ipv6: do not consider routes via gateways for anycast address check scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic jbd2: improve comments about freeing data buffers whose page mapping is NULL ext4: fix incorrect group count in ext4_fill_super error message ext4: fix incorrect inodes per group in error message ASoC: Intel: mrfld: fix incorrect check on p->sink ASoC: Intel: mrfld: return error codes when an error occurs ALSA: usb-audio: Don't override ignore_ctl_error value from the map mac80211_hwsim: Use kstrndup() in place of kasprintf() ext4: do not zeroout extents beyond i_disksize dm flakey: check for null arg_name in parse_features() kvm: x86: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD x86/mitigations: Clear CPU buffers on the SYSCALL fast path tracing: Fix the race between registering 'snapshot' event trigger and triggering 'snapshot' operation scsi: sg: add sg_remove_request in sg_common_write ALSA: hda: Don't release card at firmware loading error video: fbdev: sis: Remove unnecessary parentheses and commented code drm: NULL pointer dereference [null-pointer-deref] (CWE 476) problem wil6210: increase firmware ready timeout wil6210: fix temperature debugfs scsi: ufs: ufs-qcom: remove broken hci version quirk wil6210: rate limit wil_rx_refill error rtc: pm8xxx: Fix issue in RTC write path soc: qcom: smem: Use le32_to_cpu for comparison of: fix missing kobject init for !SYSFS && OF_DYNAMIC config of: unittest: kmemleak in of_unittest_platform_populate() clk: at91: usb: continue if clk_hw_round_rate() return zero clk: tegra: Fix Tegra PMC clock out parents NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context fails ext4: do not commit super on read-only bdev percpu_counter: fix a data race at vm_committed_as compiler.h: fix error in BUILD_BUG_ON() reporting NFS: Fix memory leaks in nfs_pageio_stop_mirroring() ext2: fix empty body warnings when -Wextra is used iommu/amd: Fix the configuration of GCR3 table root pointer fbdev: potential information leak in do_fb_ioctl() tty: evh_bytechan: Fix out of bounds accesses locktorture: Print ratio of acquisitions, not failures mtd: lpddr: Fix a double free in probe() mtd: phram: fix a double free issue in error path x86/CPU: Add native CPUID variants returning a single datum x86/microcode/intel: replace sync_core() with native_cpuid_reg(eax) x86/vdso: Fix lsl operand order Linux 4.4.220 Change-Id: Ic931642c95ad95eb2755c3c20f6802e04283e68b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * powerpc/64/tm: Don't let userspace set regs->trap via sigreturnMichael Ellerman2020-04-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit c7def7fbdeaa25feaa19caf4a27c5d10bd8789e4 upstream. In restore_tm_sigcontexts() we take the trap value directly from the user sigcontext with no checking: err |= __get_user(regs->trap, &sc->gp_regs[PT_TRAP]); This means we can be in the kernel with an arbitrary regs->trap value. Although that's not immediately problematic, there is a risk we could trigger one of the uses of CHECK_FULL_REGS(): #define CHECK_FULL_REGS(regs) BUG_ON(regs->trap & 1) It can also cause us to unnecessarily save non-volatile GPRs again in save_nvgprs(), which shouldn't be problematic but is still wrong. It's also possible it could trick the syscall restart machinery, which relies on regs->trap not being == 0xc00 (see 9a81c16b5275 ("powerpc: fix double syscall restarts")), though I haven't been able to make that happen. Finally it doesn't match the behaviour of the non-TM case, in restore_sigcontext() which zeroes regs->trap. So change restore_tm_sigcontexts() to zero regs->trap. This was discovered while testing Nick's upcoming rewrite of the syscall entry path. In that series the call to save_nvgprs() prior to signal handling (do_notify_resume()) is removed, which leaves the low-bit of regs->trap uncleared which can then trigger the FULL_REGS() WARNs in setup_tm_sigcontexts(). Fixes: 2b0a576d15e0 ("powerpc: Add new transactional memory state to the signal context") Cc: stable@vger.kernel.org # v3.9+ Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20200401023836.3286664-1-mpe@ellerman.id.au Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge branch 'android-4.4-p' of ↵Michael Bestas2020-04-14
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-05300-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: f9991115f0793 Merge 4.4.219 into android-4.4-p Conflicts: drivers/clk/qcom/clk-rcg2.c drivers/scsi/sd.c drivers/usb/gadget/function/f_fs.c drivers/usb/gadget/function/u_serial.c Change-Id: Ifed3db0ddda828c1697e57e9f73c1b73354bebf7
| * | Merge 4.4.218 into android-4.4-pGreg Kroah-Hartman2020-04-02
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.218 spi: qup: call spi_qup_pm_resume_runtime before suspending powerpc: Include .BTF section ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes spi/zynqmp: remove entry that causes a cs glitch drm/exynos: dsi: propagate error value and silence meaningless warning drm/exynos: dsi: fix workaround for the legacy clock name altera-stapl: altera_get_note: prevent write beyond end of 'key' USB: Disable LPM on WD19's Realtek Hub usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters USB: serial: option: add ME910G1 ECM composition 0x110b usb: host: xhci-plat: add a shutdown USB: serial: pl2303: add device-id for HP LD381 ALSA: line6: Fix endless MIDI read loop ALSA: seq: virmidi: Fix running status after receiving sysex ALSA: seq: oss: Fix running status after receiving sysex ALSA: pcm: oss: Avoid plugin buffer overflow ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks staging: rtl8188eu: Add device id for MERCUSYS MW150US v2 staging/speakup: fix get_word non-space look-ahead intel_th: Fix user-visible error codes rtc: max8907: add missing select REGMAP_IRQ memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event mm: slub: be more careful about the double cmpxchg of freelist mm, slub: prevent kmalloc_node crashes and memory leaks x86/mm: split vmalloc_sync_all() USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL USB: cdc-acm: fix rounding error in TIOCSSERIAL kbuild: Disable -Wpointer-to-enum-cast futex: Fix inode life-time issue futex: Unbreak futex hashing ALSA: hda/realtek: Fix pop noise on ALC225 arm64: smp: fix smp_send_stop() behaviour Revert "drm/dp_mst: Skip validating ports during destruction, just ref" hsr: fix general protection fault in hsr_addr_is_self() net: dsa: Fix duplicate frames flooded by learning net_sched: cls_route: remove the right filter from hashtable net_sched: keep alloc_hash updated after hash allocation NFC: fdp: Fix a signedness bug in fdp_nci_send_patch() slcan: not call free_netdev before rtnl_unlock in slcan_open vxlan: check return value of gro_cells_init() hsr: use rcu_read_lock() in hsr_get_node_{list/status}() hsr: add restart routine into hsr_get_node_list() hsr: set .netnsok flag vhost: Check docket sk_family instead of call getname IB/ipoib: Do not warn if IPoIB debugfs doesn't exist uapi glibc compat: fix outer guard of net device flags enum KVM: VMX: Do not allow reexecute_instruction() when skipping MMIO instr drivers/hwspinlock: use correct radix tree API net: ipv4: don't let PMTU updates increase route MTU cpupower: avoid multiple definition with gcc -fno-common dt-bindings: net: FMan erratum A050385 scsi: ipr: Fix softlockup when rescanning devices in petitboot mac80211: Do not send mesh HWMP PREQ if HWMP is disabled sxgbe: Fix off by one in samsung driver strncpy size arg i2c: hix5hd2: add missed clk_disable_unprepare in remove perf probe: Do not depend on dwfl_module_addrsym() scripts/dtc: Remove redundant YYLOC global declaration scsi: sd: Fix optimal I/O size for devices that change reported values mac80211: mark station unauthorized before key removal genirq: Fix reference leaks on irq affinity notifiers vti[6]: fix packet tx through bpf_redirect() in XinY cases xfrm: fix uctx len check in verify_sec_ctx_len xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire xfrm: policy: Fix doulbe free in xfrm_policy_timer vti6: Fix memory leak of skb if input policy check fails tools: Let O= makes handle a relative path with -C option USB: serial: option: add support for ASKEY WWHC050 USB: serial: option: add BroadMobi BM806U USB: serial: option: add Wistron Neweb D19Q1 USB: cdc-acm: restore capability check order USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback usb: musb: fix crash with highmen PIO and usbmon media: flexcop-usb: fix endpoint sanity check media: usbtv: fix control-message timeouts staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback libfs: fix infoleak in simple_attr_read() media: ov519: add missing endpoint sanity checks media: dib0700: fix rc endpoint lookup media: stv06xx: add missing descriptor sanity checks media: xirlink_cit: add missing descriptor sanity checks vt: selection, introduce vc_is_sel vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines vt: switch vt_dont_switch to bool vt: vt_ioctl: remove unnecessary console allocation checks vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console locking/atomic, kref: Add kref_read() vt: vt_ioctl: fix use-after-free in vt_in_use() bpf: Explicitly memset the bpf_attr structure net: ks8851-ml: Fix IO operations, again perf map: Fix off by one in strncpy() size argument Linux 4.4.218 Change-Id: I8de6cf91805269943a4c08f8b08e6a0b8539c08e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * powerpc: Include .BTF sectionNaveen N. Rao2020-04-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit cb0cc635c7a9fa8a3a0f75d4d896721819c63add ] Selecting CONFIG_DEBUG_INFO_BTF results in the below warning from ld: ld: warning: orphan section `.BTF' from `.btf.vmlinux.bin.o' being placed in section `.BTF' Include .BTF section in vmlinux explicitly to fix the same. Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20200220113132.857132-1-naveen.n.rao@linux.vnet.ibm.com Signed-off-by: Sasha Levin <sashal@kernel.org>
| * | Merge 4.4.216 into android-4.4-pGreg Kroah-Hartman2020-03-11
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.216 iwlwifi: pcie: fix rb_allocator workqueue allocation ext4: fix potential race between online resizing and write operations ext4: fix potential race between s_flex_groups online resizing and access ext4: fix potential race between s_group_info online resizing and access ipmi:ssif: Handle a possible NULL pointer reference mac80211: consider more elements in parsing CRC cfg80211: check wiphy driver existence for drvinfo report cifs: Fix mode output in debugging statements cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE sysrq: Restore original console_loglevel when sysrq disabled sysrq: Remove duplicated sysrq message net: fib_rules: Correctly set table field when table number exceeds 8 bits net: phy: restore mdio regs in the iproc mdio driver ipv6: Fix nlmsg_flags when splitting a multipath route ipv6: Fix route replacement with dev-only route sctp: move the format error check out of __sctp_sf_do_9_1_abort nfc: pn544: Fix occasional HW initialization failure net: sched: correct flower port blocking ext4: potential crash on allocation error in ext4_alloc_flex_bg_array() audit: fix error handling in audit_data_to_entry() HID: core: fix off-by-one memset in hid_report_raw_event() HID: core: increase HID report buffer size to 8KiB HID: hiddev: Fix race in in hiddev_disconnect() MIPS: VPE: Fix a double free and a memory leak in 'release_vpe()' i2c: jz4780: silence log flood on txabrt ecryptfs: Fix up bad backport of fe2e082f5da5b4a0a92ae32978f81507ef37ec66 include/linux/bitops.h: introduce BITS_PER_TYPE net: netlink: cap max groups which will be considered in netlink_bind() namei: only return -ECHILD from follow_dotdot_rcu() KVM: Check for a bad hva before dropping into the ghc slow path slip: stop double free sl->dev in slip_open mm: make page ref count overflow check tighter and more explicit mm: add 'try_get_page()' helper function mm, gup: remove broken VM_BUG_ON_PAGE compound check for hugepages mm, gup: ensure real head page is ref-counted when using hugepages mm: prevent get_user_pages() from overflowing page refcount pipe: add pipe_buf_get() helper fs: prevent page refcount overflow in pipe_buf_get audit: always check the netlink payload length in audit_receive_msg() serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags usb: gadget: serial: fix Tx stall after buffer overflow drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI drm/msm/dsi: save pll state before dsi host is powered off net: ks8851-ml: Remove 8-bit bus accessors net: ks8851-ml: Fix 16-bit data access net: ks8851-ml: Fix 16-bit IO operation watchdog: da9062: do not ping the hw during stop() s390/cio: cio_ignore_proc_seq_next should increase position index cifs: don't leak -EAGAIN for stat() during reconnect usb: storage: Add quirk for Samsung Fit flash usb: quirks: add NO_LPM quirk for Logitech Screen Share usb: core: hub: do error out if usb_autopm_get_interface() fails usb: core: port: do error out if usb_autopm_get_interface() fails vgacon: Fix a UAF in vgacon_invert_region fat: fix uninit-memory access for partial initialized inode vt: selection, close sel_buffer race vt: selection, push console lock down vt: selection, push sel_lock up dmaengine: tegra-apb: Fix use-after-free dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path ASoC: dapm: Correct DAPM handling of active widgets during shutdown RDMA/iwcm: Fix iwcm work deallocation RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen() ARM: imx: build v7_cpu_resume() unconditionally hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT() dmaengine: coh901318: Fix a double lock bug in dma_tc_handle() powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems dm cache: fix a crash due to incorrect work item cancelling crypto: algif_skcipher - use ZERO_OR_NULL_PTR in skcipher_recvmsg_async Linux 4.4.216 Change-Id: I9b747fb2a39b1137ee4ec9c5bb2c1aac2419e97b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systemsDesnes A. Nunes do Rosario2020-03-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit fc37a1632d40c80c067eb1bc235139f5867a2667 upstream. PowerVM systems running compatibility mode on a few Power8 revisions are still vulnerable to the hardware defect that loses PMU exceptions arriving prior to a context switch. The software fix for this issue is enabled through the CPU_FTR_PMAO_BUG cpu_feature bit, nevertheless this bit also needs to be set for PowerVM compatibility mode systems. Fixes: 68f2f0d431d9ea4 ("powerpc: Add a cpu feature CPU_FTR_PMAO_BUG") Signed-off-by: Desnes A. Nunes do Rosario <desnesn@linux.ibm.com> Reviewed-by: Leonardo Bras <leonardo@linux.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20200227134715.9715-1-desnesn@linux.ibm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge branch 'android-4.4-p' of ↵Michael Bestas2020-03-08
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-05200-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 4db1ebdd40ec0 FROMLIST: HID: nintendo: add nintendo switch controller driver Conflicts: arch/arm64/boot/Makefile arch/arm64/kernel/psci.c arch/x86/configs/x86_64_cuttlefish_defconfig drivers/md/dm.c drivers/of/Kconfig drivers/thermal/thermal_core.c fs/proc/meminfo.c kernel/locking/spinlock_debug.c kernel/time/hrtimer.c net/wireless/util.c Change-Id: I5b5163497b7c6ab8487ffbb2d036e4cda01ed670