707779 Commits

Author SHA1 Message Date
Eric Dumazet
c92e8c02fe tcp/dccp: fix ireq->opt races
syzkaller found another bug in DCCP/TCP stacks [1]

For the reasons explained in commit ce1050089c96 ("tcp/dccp: fix
ireq->pktopts race"), we need to make sure we do not access
ireq->opt unless we own the request sock.

Note the opt field is renamed to ireq_opt to ease grep games.

[1]
BUG: KASAN: use-after-free in ip_queue_xmit+0x1687/0x18e0 net/ipv4/ip_output.c:474
Read of size 1 at addr ffff8801c951039c by task syz-executor5/3295

CPU: 1 PID: 3295 Comm: syz-executor5 Not tainted 4.14.0-rc4+ #80
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:52
 print_address_description+0x73/0x250 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report+0x25b/0x340 mm/kasan/report.c:409
 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:427
 ip_queue_xmit+0x1687/0x18e0 net/ipv4/ip_output.c:474
 tcp_transmit_skb+0x1ab7/0x3840 net/ipv4/tcp_output.c:1135
 tcp_send_ack.part.37+0x3bb/0x650 net/ipv4/tcp_output.c:3587
 tcp_send_ack+0x49/0x60 net/ipv4/tcp_output.c:3557
 __tcp_ack_snd_check+0x2c6/0x4b0 net/ipv4/tcp_input.c:5072
 tcp_ack_snd_check net/ipv4/tcp_input.c:5085 [inline]
 tcp_rcv_state_process+0x2eff/0x4850 net/ipv4/tcp_input.c:6071
 tcp_child_process+0x342/0x990 net/ipv4/tcp_minisocks.c:816
 tcp_v4_rcv+0x1827/0x2f80 net/ipv4/tcp_ipv4.c:1682
 ip_local_deliver_finish+0x2e2/0xba0 net/ipv4/ip_input.c:216
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_local_deliver+0x1ce/0x6e0 net/ipv4/ip_input.c:257
 dst_input include/net/dst.h:464 [inline]
 ip_rcv_finish+0x887/0x19a0 net/ipv4/ip_input.c:397
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_rcv+0xc3f/0x1820 net/ipv4/ip_input.c:493
 __netif_receive_skb_core+0x1a3e/0x34b0 net/core/dev.c:4476
 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4514
 netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4587
 netif_receive_skb+0xae/0x390 net/core/dev.c:4611
 tun_rx_batched.isra.50+0x5ed/0x860 drivers/net/tun.c:1372
 tun_get_user+0x249c/0x36d0 drivers/net/tun.c:1766
 tun_chr_write_iter+0xbf/0x160 drivers/net/tun.c:1792
 call_write_iter include/linux/fs.h:1770 [inline]
 new_sync_write fs/read_write.c:468 [inline]
 __vfs_write+0x68a/0x970 fs/read_write.c:481
 vfs_write+0x18f/0x510 fs/read_write.c:543
 SYSC_write fs/read_write.c:588 [inline]
 SyS_write+0xef/0x220 fs/read_write.c:580
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x40c341
RSP: 002b:00007f469523ec10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c341
RDX: 0000000000000037 RSI: 0000000020004000 RDI: 0000000000000015
RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b7fd1
R13: 00000000ffffffff R14: 0000000020000000 R15: 0000000000025000

Allocated by task 3295:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
 __do_kmalloc mm/slab.c:3725 [inline]
 __kmalloc+0x162/0x760 mm/slab.c:3734
 kmalloc include/linux/slab.h:498 [inline]
 tcp_v4_save_options include/net/tcp.h:1962 [inline]
 tcp_v4_init_req+0x2d3/0x3e0 net/ipv4/tcp_ipv4.c:1271
 tcp_conn_request+0xf6d/0x3410 net/ipv4/tcp_input.c:6283
 tcp_v4_conn_request+0x157/0x210 net/ipv4/tcp_ipv4.c:1313
 tcp_rcv_state_process+0x8ea/0x4850 net/ipv4/tcp_input.c:5857
 tcp_v4_do_rcv+0x55c/0x7d0 net/ipv4/tcp_ipv4.c:1482
 tcp_v4_rcv+0x2d10/0x2f80 net/ipv4/tcp_ipv4.c:1711
 ip_local_deliver_finish+0x2e2/0xba0 net/ipv4/ip_input.c:216
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_local_deliver+0x1ce/0x6e0 net/ipv4/ip_input.c:257
 dst_input include/net/dst.h:464 [inline]
 ip_rcv_finish+0x887/0x19a0 net/ipv4/ip_input.c:397
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_rcv+0xc3f/0x1820 net/ipv4/ip_input.c:493
 __netif_receive_skb_core+0x1a3e/0x34b0 net/core/dev.c:4476
 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4514
 netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4587
 netif_receive_skb+0xae/0x390 net/core/dev.c:4611
 tun_rx_batched.isra.50+0x5ed/0x860 drivers/net/tun.c:1372
 tun_get_user+0x249c/0x36d0 drivers/net/tun.c:1766
 tun_chr_write_iter+0xbf/0x160 drivers/net/tun.c:1792
 call_write_iter include/linux/fs.h:1770 [inline]
 new_sync_write fs/read_write.c:468 [inline]
 __vfs_write+0x68a/0x970 fs/read_write.c:481
 vfs_write+0x18f/0x510 fs/read_write.c:543
 SYSC_write fs/read_write.c:588 [inline]
 SyS_write+0xef/0x220 fs/read_write.c:580
 entry_SYSCALL_64_fastpath+0x1f/0xbe

Freed by task 3306:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3503 [inline]
 kfree+0xca/0x250 mm/slab.c:3820
 inet_sock_destruct+0x59d/0x950 net/ipv4/af_inet.c:157
 __sk_destruct+0xfd/0x910 net/core/sock.c:1560
 sk_destruct+0x47/0x80 net/core/sock.c:1595
 __sk_free+0x57/0x230 net/core/sock.c:1603
 sk_free+0x2a/0x40 net/core/sock.c:1614
 sock_put include/net/sock.h:1652 [inline]
 inet_csk_complete_hashdance+0xd5/0xf0 net/ipv4/inet_connection_sock.c:959
 tcp_check_req+0xf4d/0x1620 net/ipv4/tcp_minisocks.c:765
 tcp_v4_rcv+0x17f6/0x2f80 net/ipv4/tcp_ipv4.c:1675
 ip_local_deliver_finish+0x2e2/0xba0 net/ipv4/ip_input.c:216
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_local_deliver+0x1ce/0x6e0 net/ipv4/ip_input.c:257
 dst_input include/net/dst.h:464 [inline]
 ip_rcv_finish+0x887/0x19a0 net/ipv4/ip_input.c:397
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_rcv+0xc3f/0x1820 net/ipv4/ip_input.c:493
 __netif_receive_skb_core+0x1a3e/0x34b0 net/core/dev.c:4476
 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4514
 netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4587
 netif_receive_skb+0xae/0x390 net/core/dev.c:4611
 tun_rx_batched.isra.50+0x5ed/0x860 drivers/net/tun.c:1372
 tun_get_user+0x249c/0x36d0 drivers/net/tun.c:1766
 tun_chr_write_iter+0xbf/0x160 drivers/net/tun.c:1792
 call_write_iter include/linux/fs.h:1770 [inline]
 new_sync_write fs/read_write.c:468 [inline]
 __vfs_write+0x68a/0x970 fs/read_write.c:481
 vfs_write+0x18f/0x510 fs/read_write.c:543
 SYSC_write fs/read_write.c:588 [inline]
 SyS_write+0xef/0x220 fs/read_write.c:580
 entry_SYSCALL_64_fastpath+0x1f/0xbe

Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets")
Fixes: 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-21 01:33:19 +01:00
Linus Torvalds
9c323bff13 Merge branch 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm
Pull ARM fixes from Russell King:
 "Three fixes this time around:

   - ensure sparse realises that we're building for a 32-bit arch on
     64-bit hosts.

   - use the correct instruction for semihosting on v7m (nommu) CPUs.

   - reserve address 0 to prevent the first page of memory being used on
     nommu systems"

* 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm:
  ARM: 8704/1: semihosting: use proper instruction on v7m processors
  ARM: 8701/1: fix sparse flags for build on 64bit machines
  ARM: 8700/1: nommu: always reserve address 0 away
2017-10-20 18:20:17 -04:00
Linus Torvalds
545ea16f7c ARM: SoC fixes for 4.14
Here is another set of bugfixes for ARM SoCs, mostly harmless:
 
  - A boot regression fix on ux500
  - PCIe interrupts on NXP i.MX7 and on Marvell Armada 7K/8K were
    wired up wrong, in different ways
  - Armada XP support for large memory never worked
  - The socfpga reset controller now builds on 64-bit
  - minor device tree corrections on gemini, mvebu, r-pi 3,
    rockchip and at91
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIVAwUAWeppyWCrR//JCVInAQIfVQ//cQDz9jv//4tMhBJeLxpcTe62U0HL3gG/
 pCUXUxUKQxTTuvUm2Ecx+YpeFfS4hDEOAVi8wDAgJ6yBhW+jrIasiVq5XaspR6/C
 DicscLdW3YJ6hjBfk87mbC7F6wu8aTzZa4xkwjJ1L0XbNSq7oOBaoff8dhMNnzC8
 w1HuLu/laAaTEhiHZ1M/hkjx9VxA2j0AQvhdV7Ebrh3Wk+2wYB1QhWngLgHBIZsC
 1VVOtHCtRtfrIBSnHjjx/Wvcwln6fUNUXJGgp3K/oJeNE6M2D2FxA0ylB6YiYmmf
 jRdXypqiE6xjRJa7yru/Q1LfLzt5dQibSQYNsU+ljJ7Wp/3V9F1Ms43hXROunPRN
 Exebvi7BDjGO+/MxgD/FLFltndJRsmnZPD0+M8+zWcHIrC1N1ULrBO8HfdIWxm/x
 nNOvx17dEUCg8azwFlmfjxXIq4p/4qv+LzbkFVPOlPf1y4xzvMthkAyKiN1vGVoO
 d5O7HeTc4ciPG/qxcL4zdwDo4qgeMTDJNrTRJ+4oxjkKxHDHH3gpYXKdKWCFXT+W
 5/Y+kIYEQChNNRdXqQ1Xx4xgdZaHfu6J3QrfNs0291yjLDUyCjk4FtDZBzlWO/SH
 F8rE79QOwYbZGgth2b/RqX4/IxAzE7wviUVlBUja4NcPcDkwk2hPHqiyfkYmXaTn
 a80A7sWIjSM=
 =M8dW
 -----END PGP SIGNATURE-----

Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

Pull ARM SoC fixes from Arnd Bergmann:
 "Here is another set of bugfixes for ARM SoCs, mostly harmless:

   - a boot regression fix on ux500

   - PCIe interrupts on NXP i.MX7 and on Marvell Armada 7K/8K were wired
     up wrong, in different ways

   - Armada XP support for large memory never worked

   - the socfpga reset controller now builds on 64-bit

   - minor device tree corrections on gemini, mvebu, r-pi 3, rockchip
     and at91"

* tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: ux500: Fix regression while init PM domains
  ARM: dts: fix PCLK name on Gemini and MOXA ART
  arm64: dts: rockchip: fix typo in iommu nodes
  arm64: dts: rockchip: correct vqmmc voltage for rk3399 platforms
  ARM: dts: imx7d: Invert legacy PCI irq mapping
  bus: mbus: fix window size calculation for 4GB windows
  ARM: dts: at91: sama5d2: add ADC hw trigger edge type
  ARM: dts: at91: sama5d2_xplained: enable ADTRG pin
  ARM: dts: at91: at91-sama5d27_som1: fix PHY ID
  ARM: dts: bcm283x: Fix console path on RPi3
  reset: socfpga: fix for 64-bit compilation
  ARM: dts: Fix I2C repeated start issue on Armada-38x
  arm64: dts: marvell: fix interrupt-map property for Armada CP110 PCIe controller
  arm64: dts: salvator-common: add 12V regulator to backlight
  ARM: dts: sun6i: Fix endpoint IDs in second display pipeline
  arm64: allwinner: a64: pine64: Use dcdc1 regulator for mmc0
2017-10-20 18:17:43 -04:00
Arnd Bergmann
6bf99a6cb6 Allwinner fixes for 4.14
Two fixes, one for the A31 DRM binding, and one for a missing regulator on
 the pine MMC controller.
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJZ6axFAAoJEBx+YmzsjxAgRPQQAL8SNIbznqcV1ncW1SXBH/hg
 W1UCfclJfCJ1nrctsfXIgDpIJAGjVR+PEh8kBHgyqknqLJ6bQpJOqfHzSZk+SWF4
 1NuosdxLMW9V9wrwzNUUYD6Jh3VoJAgKDcWBPeY9eUvvLq6wnzXmSXPBtTUlXuNp
 XcXoT7TCSlUZ0rvJKPe2ON+BH1hjYhNnHs07TN2x2lbYQMbEcLLzqBOyfxESzQ5w
 hAb8gpJhGSDAk2pJXtyviSNokx5fqSePnKmfPNG42QHXq+cvt6aCcosqZ9u3OuAx
 eNTVTZPlvnQ/GfjEouG4NTjYbv5cXdN8itqaSypMeN+8xpOJ/mFDa8K/vzyzF2Kr
 6svpe4SC0YB6z4YtKFLR0Q6a/MlgMNq02WW5l+oq8e44pwyPRYFeTNNP8yD9ZO0k
 xlhgNyo+/KIXGx6XBga27x3IyaWopGslLK/UjG4El0jOAPISiuZcbF6GCsFht7dk
 YSVEVQ842v2iX817kaDy1zGTOy0b9j9/AOu6ctZlsP9XM9YaMxi7pFrb+UFu6FSJ
 yRR8TNZjjrSMsuDc8yrbH0/nWcgkmQtYXa2iQ4/2ILlW63zrm2yM7w8CKygyZ25D
 NhuK/yQ+PEsKYDAJ3s3T3hUbirAmQx3KUmv6Jr7UUPaj6V5a62Jl/pt5+oSlGQm7
 EBkvmIV+XXwmqng7Y/WF
 =Cvge
 -----END PGP SIGNATURE-----

Merge tag 'sunxi-fixes-for-4.14' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into fixes

Pull "Allwinner fixes for 4.14" from Maxime Ripard:

Two fixes, one for the A31 DRM binding, and one for a missing regulator on
the pine MMC controller.

* tag 'sunxi-fixes-for-4.14' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:
  ARM: dts: sun6i: Fix endpoint IDs in second display pipeline
  arm64: allwinner: a64: pine64: Use dcdc1 regulator for mmc0
2017-10-20 22:24:48 +02:00
Kees Cook
1c9fec470b waitid(): Avoid unbalanced user_access_end() on access_ok() error
As pointed out by Linus and David, the earlier waitid() fix resulted in
a (currently harmless) unbalanced user_access_end() call.  This fixes it
to just directly return EFAULT on access_ok() failure.

Fixes: 96ca579a1ecc ("waitid(): Add missing access_ok() checks")
Acked-by: David Daney <david.daney@cavium.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-10-20 15:32:54 -04:00
Kees Cook
75f98b7ab7 lkdtm: Constify the crashtypes table
Since nothing in the crashtypes table ever changes, mark it const. Adds
some missing "static" markings as well.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 15:51:39 +02:00
Kees Cook
31c5c870a1 lkdtm: Convert from jprobe to kprobe
The jprobe subsystem is being removed, so convert to using kprobe instead.

Cc: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 15:50:55 +02:00
Martin Blumenstingl
8caef1fa91 nvmem: add a driver for the Amlogic Meson6/Meson8/Meson8b SoCs
This adds a driver to access the efuse on Amlogic Meson6, Meson8 and
Meson8b SoCs.
These SoCs are accessing the efuse IP block directly through the
registers in the "secbus" region. This makes it different from the Meson
GX efuse driver which uses the "secure monitor" firmware to access the
efuse.

The efuse on Meson6 can only read one byte at a time, while the efuse on
Meson8 and Meson8b always reads 4 bytes at a time. The new driver
supports both, but due to lack of hardware Meson6 support was not tested.

The hardware also supports writing. However, this is currently not
supported by the driver.

Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 15:38:02 +02:00
Martin Blumenstingl
9593ad32b8 nvmem: meson-efuse: indicate that this driver is only for Meson GX SoCs
The current Amlogic Meson eFuse driver only supports the 64-bit SoCs
(GXBB and newer). Older SoCs cannot be supported by the same driver
because they do not use the meson secure monitor firmware to access the
hardware.

Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 15:38:02 +02:00
Martin Blumenstingl
41e0434989 dt-bindings: nvmem: Describe the Amlogic Meson6/Meson8/Meson8b efuse
Amlogic Meson6, Meson8 and Meson8b SoCs have an efuse which contains
calibration data from the factory (for the internal temperature sensor
and some CVBS connector settings). Some manufacturers also store the MAC
address or serial number in the efuse.

This documents the devicetree bindings for the efuse on these SoCs.

Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 15:38:02 +02:00
Romain Perier
7a15cf2af4 nvmem: rockchip: add support for RK3368
This adds the necessary function for handling support on RK3368 SoCs

Signed-off-by: Romain Perier <romain.perier@collabora.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 15:38:02 +02:00
Stephen Hemminger
33d426a957 vmbus: initialize reserved fields in messages
Make sure and initialize reserved fields in messages to host,
rather than passing stack junk.

Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 15:27:24 +02:00
Greg Kroah-Hartman
ad146e37d2 VME Subsystem changes for master v4.14-rc4:
- Corrections across the VME subsystem to better align with the preferred
    kernel coding style.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJZ4SrIAAoJEE12cGh4ILCUrx0QAKnbzriglz5v8WqKcH7Z0IRT
 d6+3hRsot7TvEKbcsDU0dql3njI1LM1owPXsIEaFCmx1mP2D+1MFp7IuxEfNdiFo
 rO2gmvXvfv4nyaW/LYCu/7aiC/R+0f1RSj9K6e+jc0o31VGL6EG+mBN+XZ6G5PV0
 RCVz87BBtulU4zt/tbKpKmpJucbVAToUoAhnU3mIU/rDy/U9zuzfepzkGmtRzoid
 fCSrC87Me+Wq++1b3FOQpAKR3pd9eLqevMRwOe5c8JBD1qy4KyeQPVq44beGf3uy
 bWDTYGkn4NiVlJQEJQfnXbvFxo7zuuqUO9fBNsTbvaVzwiyoAq6u4vZZRqMQghL+
 GG5lskyUZCqlOOdjy8HyNGYiHelELgnU0YaJk3/vl5kjsfpApuAkHBH9X7ztFPQi
 t0QrqkX3/cYhI2AmBoddR6cEEBvZN23rjhe2zReln+Aq5Se7k5DZnogVWkM9QwDD
 agnhAB3LhOYoxeDKfDtbVieV6//UdOQtsmadgeOihfZ5AWxel+Jh0w4dv2xrjqpS
 8Xwt1AtUPG+h+OAmUpTgrWDs1osV1eHBQ7MtuVosB1ofn5vdinTXEalqPEHQCOU8
 Ab5R4qEm9srEsoMZ8GCr8d6irDU5w/Uk39KHOKycz9g1+o7jexSDHJ9xbePrOSR9
 +r7NuSYReExa8XBNUyO1
 =gprQ
 -----END PGP SIGNATURE-----

Merge tag 'vme-next-4.14-rc4' of https://gitlab.collabora.com/martyn/linux into char-misc-next

Martyn writes:

VME Subsystem changes for master v4.14-rc4:

 - Corrections across the VME subsystem to better align with the preferred
   kernel coding style.
2017-10-20 15:24:34 +02:00
Arvind Yadav
f7f84fded6 binder: pr_err() strings should end with newlines
pr_err() messages should terminated with a new-line to avoid
other messages being concatenated onto the end.

Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 15:18:27 +02:00
Sherry Yang
de7bbe3d1b android: binder: Change binder_shrinker to static
binder_shrinker struct is not used anywhere outside of
binder_alloc.c and should be static.

Acked-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Sherry Yang <sherryy@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 15:17:44 +02:00
Sherry Yang
6ae33b9c05 android: binder: Remove unused vma argument
The vma argument in update_page_range is no longer
used after 74310e06 ("android: binder: Move buffer
out of area shared with user space"), since mmap_handler
no longer calls update_page_range with a vma.

Acked-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Sherry Yang <sherryy@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 15:17:44 +02:00
Bhumika Goyal
c932806c65 parport: make parport_ip32_ops const and __initconst
Make this const as it is only used during a copy operation. This usage
is inside init function and the structure is not referenced after
initialisation, so make it __initconst too.

Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 15:17:44 +02:00
Steven Rostedt (VMware)
421eb12ead tracing, mei: Remove unused trace event mei_pci_cfg_write
Commit a96c548291 ("mei: trace pci configuration space io") added the
trace event mei_pci_cfg_write but never used it. As trace events that
are defined take up space for data structures and functions created for
them, it is a waste of memory to have one defined but not used. Remove
this trace event.

Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 15:17:44 +02:00
Kees Cook
35c3f85f5a pcmcia: m32r: Convert timers to use timer_setup()
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Cc: linux-pcmcia@lists.infradead.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 15:17:44 +02:00
Kees Cook
9577924bb3 char: pcmcia: Convert timers to use timer_setup()
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Harald Welte <laforge@gnumonks.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jarod Wilson <jarod@redhat.com>
Cc: Stephen Hemminger <stephen@networkplumber.org>
Cc: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 15:17:44 +02:00
Leo Yan
24f0d316fd doc: coresight: correct usage for disabling idle states
In the coresight CPU debug document it suggests to use 'echo' command
to set latency request to /dev/cpu_dma_latency so can disable all CPU
idle states, but in fact this doesn't work.

This is because when the command 'echo' exits, it releases the device
node's file descriptor and the kernel release function removes the QoS
constraint; finally when the command 'echo' finished there have no
constraint imposed on cpu_dma_latency.

This patch changes to use 'exec' to access '/dev/cpu_dma_latency', the
command 'exec' can avoid the file descriptor to be closed so we can
keep the constraint on cpu_dma_latency.

This patch also adds the info for reference docs for PM QoS and cpuidle
sysfs.

Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Sudeep Holla <sudeep.holla@arm.com>
Reported-by: Kim Phillips <kim.phillips@arm.com>
Suggested-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Leo Yan <leo.yan@linaro.org>
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 15:03:06 +02:00
Suzuki K Poulose
0bbb194c0c coresight: Extend the PIDR mask to cover relevant bits in PIDR2
As per coresight standards, PIDR2 register has the following format :

 [2-0]	- JEP106_bits6to4
 [3]	- JEDEC, designer ID is specified by JEDEC.

However some of the drivers only use mask of 0x3 for the PIDR2 leaving
bits [3-2] unchecked, which could potentially match the component for
a different device altogether. This patch fixes the mask and the
corresponding id bits for the existing devices.

Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 15:03:06 +02:00
Dexuan Cui
9d35593b4f vmbus: hvsock: add proper sync for vmbus_hvsock_device_unregister()
Without the patch, vmbus_hvsock_device_unregister() can destroy the device
prematurely when close() is called, and can cause NULl dereferencing or
potential data loss (the last portion of the data stream may be dropped
prematurely).

Signed-off-by: Dexuan Cui <decui@microsoft.com>
Cc: Haiyang Zhang <haiyangz@microsoft.com>
Cc: Stephen Hemminger <sthemmin@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 14:56:25 +02:00
David S. Miller
e95c6cf447 Merge branch 'sockmap-fixes'
John Fastabend says:

====================
sockmap fixes for net

The following implements a set of fixes for sockmap and changes the
API slightly in a few places to reduce preempt_disable/enable scope.
We do this here in net because it requires an API change and this
avoids getting stuck with legacy API going forward.

The short description:

Access to skb mark is removed, it is problematic when we add
features in the future because mark is a union and used by the
TCP/socket code internally. We don't want to expose this to the
BPF programs or let programs change the values.

The other change is caching metadata in the skb itself between
when the BPF program returns a redirect code and the core code
implements the redirect. This avoids having per cpu metadata.

Finally, tighten restriction on using sockmap to CAP_NET_ADMIN and
only SOCK_STREAM sockets.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-20 13:01:30 +01:00
John Fastabend
9ef2a8cd5c bpf: require CAP_NET_ADMIN when using devmap
Devmap is used with XDP which requires CAP_NET_ADMIN so lets also
make CAP_NET_ADMIN required to use the map.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-20 13:01:29 +01:00
John Fastabend
fb50df8d32 bpf: require CAP_NET_ADMIN when using sockmap maps
Restrict sockmap to CAP_NET_ADMIN.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-20 13:01:29 +01:00
John Fastabend
f7e9cb1ecb bpf: remove mark access for SK_SKB program types
The skb->mark field is a union with reserved_tailroom which is used
in the TCP code paths from stream memory allocation. Allowing SK_SKB
programs to set this field creates a conflict with future code
optimizations, such as "gifting" the skb to the egress path instead
of creating a new skb and doing a memcpy.

Because we do not have a released version of SK_SKB yet lets just
remove it for now. A more appropriate scratch pad to use at the
socket layer is dev_scratch, but lets add that in future kernels
when needed.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-20 13:01:29 +01:00
John Fastabend
34f79502bb bpf: avoid preempt enable/disable in sockmap using tcp_skb_cb region
SK_SKB BPF programs are run from the socket/tcp context but early in
the stack before much of the TCP metadata is needed in tcp_skb_cb. So
we can use some unused fields to place BPF metadata needed for SK_SKB
programs when implementing the redirect function.

This allows us to drop the preempt disable logic. It does however
require an API change so sk_redirect_map() has been updated to
additionally provide ctx_ptr to skb. Note, we do however continue to
disable/enable preemption around actual BPF program running to account
for map updates.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-20 13:01:29 +01:00
John Fastabend
435bf0d3f9 bpf: enforce TCP only support for sockmap
Only TCP sockets have been tested and at the moment the state change
callback only handles TCP sockets. This adds a check to ensure that
sockets actually being added are TCP sockets.

For net-next we can consider UDP support.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-20 13:01:29 +01:00
Xin Long
1cc276cec9 sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect
Now sctp processes icmp redirect packet in sctp_icmp_redirect where
it calls sctp_transport_dst_check in which tp->dst can be released.

The problem is before calling sctp_transport_dst_check, it doesn't
check sock_owned_by_user, which means tp->dst could be freed while
a process is accessing it with owning the socket.

An use-after-free issue could be triggered by this.

This patch is to fix it by checking sock_owned_by_user before calling
sctp_transport_dst_check in sctp_icmp_redirect, so that it would not
release tp->dst if users still hold sock lock.

Besides, the same issue fixed in commit 45caeaa5ac0b ("dccp/tcp: fix
routing redirect race") on sctp also needs this check.

Fixes: 55be7a9c6074 ("ipv4: Add redirect support to all protocol icmp error handlers")
Reported-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-20 12:53:45 +01:00
David Kozub
eb39a7c035 clockevents/drivers/cs5535: Improve resilience to spurious interrupts
The interrupt handler mfgpt_tick() is not robust versus spurious interrupts
which happen before the clock event device is registered and fully
initialized.

The reason is that the safe guard against spurious interrupts solely checks
for the clockevents shutdown state, but lacks a check for detached
state. If the interrupt hits while the device is in detached state it
passes the safe guard and dereferences the event handler call back which is
NULL.

Add the missing state check.

Fixes: 8f9327cbb6e8 ("clockevents/drivers/cs5535: Migrate to new 'set-state' interface")
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Kozub <zub@linux.fjfi.cvut.cz>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20171020093103.3317F6004D@linux.fjfi.cvut.cz
2017-10-20 13:41:52 +02:00
Linus Torvalds
9a27ded219 xen: fix for 4.14-rc6
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQEcBAABAgAGBQJZ6bO8AAoJELDendYovxMvzJgH/3QHVFMmmZnEpqpet6Om/h3Z
 YuhrLTuXRL/dz6IA9u0PXOL83k3qnQKzmy4OZJL/BuT+ZGXZAJge0nLhC+sHc5CR
 SrWFSee0Ut1qM1Khenfi2rn4M3F/Hc3m9lLU5KsewEflJ+MMw86RSKAPD3Xc6w0u
 Kq6ejczfBvFNz1KErCO+IRc5A25ouNJZDNVwrMrJ5QXXJ2rPGFS+3TIilwu51kfQ
 ux/s3frm2bNxFabkOtAZzxkYMYj9RRTDewBZocGhPmih0WWkquVbhwuxl9mf2nd0
 AeFWbvMnZcq86Ra9zhtLQg1Gu7SSI/0vq7JnZtIsZw8b5YThG3V9s14fkWhJrgE=
 =xWgh
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-4.14c-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen fix from Juergen Gross:
 "A fix for the Xen pv network drivers (frontend and backend) avoiding
  the network connection to become unusable due to an illegal MTU"

* tag 'for-linus-4.14c-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen-netfront, xen-netback: Use correct minimum MTU values
2017-10-20 06:58:43 -04:00
Martijn Coenen
66b83a4cdd binder: call poll_wait() unconditionally.
Because we're not guaranteed that subsequent calls
to poll() will have a poll_table_struct parameter
with _qproc set. When _qproc is not set, poll_wait()
is a noop, and we won't be woken up correctly.

Signed-off-by: Martijn Coenen <maco@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 12:53:43 +02:00
Linus Torvalds
c925e0ea50 MMC host:
- sdhci-pci: Fix default d3_retune for Intel host controllers
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJZ6bFsAAoJEP4mhCVzWIwpFEsP/3C3ZGudAZeVzrCIhCzP/hdm
 Bior/PuFVxAXfZS0rp76/5vWkJMpJYdUsi9aL4+Qme8j5LoMn/d7faClwfHN9vOW
 Diug1UDB/TKmcYsmZCtSkv+30gxZtMMtS6U7J9QlUcjsWdusbJM3DMZllx/nCA+u
 wzbYufJl7ckLpL/yqWNpSJn0xnkH3/IAElUy1FJIIfgT2HEMKsrOIx99OM6w5nPW
 EcF5crKJFLB8UyGj8SwWgxZOYr7GvCMVNvxEzQ2zIvhq7lpCisjzn/CYWUveDatr
 mHkx8VYwgP1spwgfyHv2KRV1E4T6D7pbe9vMZEl8gXxJ8JQrEEPljd+P4tVMF9iM
 XmZ8Cpm5IBCdmJnuVPekOTNA4lisCIqP9wz25ExWQ6PzNxZGft7pcwNKxOjUVc4h
 Rh6r6GZcezgd87i4hbWubPLtpIMo7+Daje4earB1AGHmGw6G7IoIIGXnXrEg6bEo
 0UoX8TeGdalGR6p6I6Bqo591PZs3PdF5iltVQnrSx5Bg46lNCuQVPMhxPtdRMq/q
 PfAozDsSZBWRFWhZttjWlAA8S7a5iTFdI1DCwwitf3jmJ/L3AM7c+vifJidE33SZ
 oVReVGZRkHBWBfgvU8DeXm8u2blGPO1AKVI9JH1y6peUkIbrsT6v4A7Fj/XmJf7V
 VTnX7bfuzPpk1x0JCQgZ
 =gDOy
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC fix from Ulf Hansson:
 "sdhci-pci: Fix default d3_retune for Intel host controllers"

* tag 'mmc-v4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: sdhci-pci: Fix default d3_retune for Intel host controllers
2017-10-20 06:52:05 -04:00
Linus Torvalds
d92116a089 amdgpu, nouveau, i915 and exynos fixes
-----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJZ6Y+3AAoJEAx081l5xIa+dEIP/j5tjawx4ada7etPbAblFjmD
 cs0LUFM6SgamUtgi5slJn+3jV1bXJpgcmCXI0S6Ln7xjLLvjcTnauJFidrBgT1lG
 dJOrzz8zgBF2jpc0oC/a3ercum3vncqxAbUbDQ6RwDrxuhwBB3L31ix263z/+Yr8
 fy655TSpxTiaokiVxws2mOfpte9yWcSeQUChrzRjNSS480O4qd/AJZl+FhiBNySw
 2kAW9zbTFEV/9qfANHToAeUsCOo2VoTBXqgpvPiUKJG2gow8yT0Wf5Al4HcagZCt
 9JtIbNlHxnuSYR0CCfx4r+/igWQt52O2GgmlPkaxvGjVz13n9m9RngYyyZksZWjQ
 9wBJEQI4pvCUIBHpic+90b9AKTIub52bImigNzckEDvvXXEIO4SUc23s6pkOKXD8
 V4ZO+pHtzV6/T9vGpntrbODcwp7/h397Zr6SKP+YjRl12Gh5/922xz3bQDnEgYF/
 o/q/stEm5Jqncz4WR+wZ2a7gocPxuexv6T/hZwvT+08l/QR5DR0sUhlJ+j3QaSqk
 ELqn5tNEGQiOEDLHmBnjiHZJFYAAlbOkPoVPIMuFt/xRZtDb2ZCN457OgSubmPqw
 1i00XLd6ZoEVI+nBcGJbyQhqZmcTftWXXvcCixBqvK9mEYFqQoe222bytaIoiPpo
 WT3Zt2E6jgoQxtX3PftU
 =wFHG
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-for-v4.14-rc6' of git://people.freedesktop.org/~airlied/linux

Pull drm fixes from Dave Airlie:
 "Standard fixes pull for rc6: one regression fix for amdgpu, a bunch of
  nouveau fixes that I'd missed a pull req for from Ben last week, some
  exynos regression fixes, and a few fixes for i915"

* tag 'drm-fixes-for-v4.14-rc6' of git://people.freedesktop.org/~airlied/linux:
  drm/nouveau/fbcon: fix oops without fbdev emulation
  Revert "drm/amdgpu: discard commands of killed processes"
  drm/i915: Use a mask when applying WaProgramL3SqcReg1Default
  drm/i915: Report -EFAULT before pwrite fast path into shmemfs
  drm/i915/cnl: Fix PLL initialization for HDMI.
  drm/i915/cnl: Fix PLL mapping.
  drm/i915: Use bdw_ddi_translations_fdi for Broadwell
  drm/i915: Fix eviction when the GGTT is idle but full
  drm/i915/gvt: Fix GPU hang after reusing vGPU instance across different guest OS
  drm/exynos: Clear drvdata after component unbind
  drm/exynos: Fix potential NULL pointer dereference in suspend/resume paths
  drm/nouveau/kms/nv50: fix oops during DP IRQ handling on non-MST boards
  drm/nouveau/bsp/g92: disable by default
  drm/nouveau/mmu: flush tlbs before deleting page tables
2017-10-20 06:38:56 -04:00
Linus Torvalds
eb62722a06 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
Pull i2c fixes from Wolfram Sang:
 "A couple of bugfixes for I2C drivers.

  Because the changes for the piix4 driver are larger than usual, the
  patches have been in linux-next for more than a week with no reports
  coming in. The rest is usual stuff"

* 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: omap: Fix error handling for clk_get()
  i2c: piix4: Disable completely the IMC during SMBUS_BLOCK_DATA
  i2c: piix4: Fix SMBus port selection for AMD Family 17h chips
  i2c: imx: fix misleading bus recovery debug message
  i2c: imx: use IRQF_SHARED mode to request IRQ
  i2c: ismt: Separate I2C block read from SMBus block read
2017-10-20 06:32:26 -04:00
Linus Torvalds
03b652e5c0 Merge branch 'fixes-v4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
Pull key handling fixes from James Morris:
 "This includes a fix for the capabilities code from Colin King, and a
  set of further fixes for the keys subsystem. From David:

   - Fix a bunch of places where kernel drivers may access revoked
     user-type keys and don't do it correctly.

   - Fix some ecryptfs bits.

   - Fix big_key to require CONFIG_CRYPTO.

   - Fix a couple of bugs in the asymmetric key type.

   - Fix a race between updating and finding negative keys.

   - Prevent add_key() from updating uninstantiated keys.

   - Make loading of key flags and expiry time atomic when not holding
     locks"

* 'fixes-v4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  commoncap: move assignment of fs_ns to avoid null pointer dereference
  pkcs7: Prevent NULL pointer dereference, since sinfo is not always set.
  KEYS: load key flags and expiry time atomically in proc_keys_show()
  KEYS: Load key expiry time atomically in keyring_search_iterator()
  KEYS: load key flags and expiry time atomically in key_validate()
  KEYS: don't let add_key() update an uninstantiated key
  KEYS: Fix race between updating and finding a negative key
  KEYS: checking the input id parameters before finding asymmetric key
  KEYS: Fix the wrong index when checking the existence of second id
  security/keys: BIG_KEY requires CONFIG_CRYPTO
  ecryptfs: fix dereference of NULL user_key_payload
  fscrypt: fix dereference of NULL user_key_payload
  lib/digsig: fix dereference of NULL user_key_payload
  FS-Cache: fix dereference of NULL user_key_payload
  KEYS: encrypted: fix dereference of NULL user_key_payload
2017-10-20 06:19:38 -04:00
Craig Bergstrom
ce56a86e2a x86/mm: Limit mmap() of /dev/mem to valid physical addresses
Currently, it is possible to mmap() any offset from /dev/mem.  If a
program mmaps() /dev/mem offsets outside of the addressable limits
of a system, the page table can be corrupted by setting reserved bits.

For example if you mmap() offset 0x0001000000000000 of /dev/mem on an
x86_64 system with a 48-bit bus, the page fault handler will be called
with error_code set to RSVD.  The kernel then crashes with a page table
corruption error.

This change prevents this page table corruption on x86 by refusing
to mmap offsets higher than the highest valid address in the system.

Signed-off-by: Craig Bergstrom <craigb@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Luis R. Rodriguez <mcgrof@suse.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Toshi Kani <toshi.kani@hp.com>
Cc: dsafonov@virtuozzo.com
Cc: kirill.shutemov@linux.intel.com
Cc: mhocko@suse.com
Cc: oleg@redhat.com
Link: http://lkml.kernel.org/r/20171019192856.39672-1-craigb@google.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-10-20 09:48:00 +02:00
Kamalesh Babulal
b703798386 objtool: Fix memory leak in decode_instructions()
When an error occurs before adding an allocated insn to the list, free
it before returning.

Signed-off-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/336da800bf6070eae11f4e0a3b9ca64c27658114.1508430423.git.jpoimboe@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-10-20 09:43:21 +02:00
Ingo Molnar
275d34b825 perf/urgent fixes:
- Fix crash in perf_hpp__reset_output_field() (Jiri Olsa)
 
 - Fix eBPF file/vendor events ambiguity in event specification (Jiri Olsa)
 
 - Fix closing evsel fd in 'perf stat' (Jin Yao)
 
 - Make perf test shell trace+probe_libc_inet_pton.sh pass in Debian/Ubuntu (Li Zhijian)
 
 - Fix 'perf buildid-list --with-hits' crash when processing PERF_RECORD_NAMESPACE (Namhyung Kim)
 
 - Fix documentation for a inexistent option 'perf record -l' (Taeung Song)
 
 - Add long time reviewers to MAINTAINERS (Arnaldo Carvalho de Melo)
 
 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEELb9bqkb7Te0zijNb1lAW81NSqkAFAlno4cEACgkQ1lAW81NS
 qkBAlhAAk9LUUvFLLB2R2U33qoLskEL+r88wTdTPQSNf8caCr01m/ae+WiB69MpX
 80WaHzGPXue0NBuWQhaND8/R0muKvDgCDWKSL3yic2Qk2hRe2g1a6I6cjp01hQix
 ajfNu15w2p3awKuXi6xOBRjQM7MiW0zioEURNEuyKlBOKC7VivMHOUJAyZSOkAce
 uFNqfYwS8EPM3FobV+iL7P0R86JdaGc0VZ172gqs9uLgdROtsXms3bbbj/ixTIKG
 Uwl34SUJMhpgk4q1lMJBtps3Ntjtop/0TWJdhhEWRxEQqti8q2JnfXfQHp9miLPu
 k85IH4x3Kxq7ZxNzCqlKFGpLsTq3NQEiT6QDYIjBYcVz7HGgYLzrLAcsIO5+Sh2P
 3iFwALfUGfgTIQoKBz5fVClDDnbCf1GAuZUOUetJSsGzU3dj15R6oMKRZWV12qFr
 rNYWQ+voOV38mCvcGNBCZ8quZelixrLdOACU8mzP0ePWElGnuW4Q7ecIHZuluET+
 9r2pKrPH8Ze3/0w+0CkdxXLB6ZfFS4cxCLR2j0UZxgO/vQKODbwWS6Vak+b6xM50
 TQLS224PIJL0EVC/WTReVkWli3ksTTzcr/E/siv778rD3xhZfEdlUZGuBDZTj3pZ
 Hr0jQsVTWhQNVt1t+xOpRHsL7JZIXNWIT/PSJZAKU9godtoNqp0=
 =nqkB
 -----END PGP SIGNATURE-----

Merge tag 'perf-urgent-for-mingo-4.14-20171019' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent

Pull perf/urgent fixes from Arnaldo Carvalho de Melo:

- Fix crash in perf_hpp__reset_output_field() (Jiri Olsa)

- Fix eBPF file/vendor events ambiguity in event specification (Jiri Olsa)

- Fix closing evsel fd in 'perf stat' (Jin Yao)

- Make perf test shell trace+probe_libc_inet_pton.sh pass in Debian/Ubuntu (Li Zhijian)

- Fix 'perf buildid-list --with-hits' crash when processing PERF_RECORD_NAMESPACE (Namhyung Kim)

- Fix documentation for an inexistent option 'perf record -l' (Taeung Song)

- Add long time reviewers to MAINTAINERS (Arnaldo Carvalho de Melo)

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-10-20 09:14:06 +02:00
Stefan Roese
c5709d3769 dmaengine: altera: Use IRQ-safe spinlock calls in the error paths as well
The patch edf10919 [dmaengine: altera: fix spinlock usage] missed to
change 2 occurrences of spin_unlock_bh() to spin_unlock_irqrestore().
This patch fixes this by moving to the IRQ-safe call in the error
paths as well.

Fixes: edf10919 (dmaengine: altera: fix spinlock usage)
Signed-off-by: Stefan Roese <sr@denx.de>
Reviewed-by: Sylvain Lesne <lesne@alse-fr.com>
[add fixes tag and fix typo in log]
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2017-10-20 11:51:10 +05:30
Linus Torvalds
ce43f4fd6f Power management fix for v4.14-rc6
This reverts a problematic commit modifying the turbostat
 utility that went in during the 4.13 cycle (Len Brown).
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJZ6Sp6AAoJEILEb/54YlRxt+4QAIZUZUiOgnm+xnTt/jO+RFqn
 QhemEUf5pJFvt0HGdIOaA4VzicyAaSnA1+QoSiHJhIk8itsVCnI9COpfb0BwYvnU
 B26gtT0+H+pvu2PVSVrihZZ27S5zJfIZ+3bfSqMUB/uvvIkRVD0g7OMBNPPttGVz
 iF1HRWOgK4w88zy2MNyvdmqagOwAdnptMB3RCasAIh4HlOkdAeJ0qGsru0UKxKd1
 mZGp2WxHE66cTNAheX/ONyK0N1X+4WiCcxuUTGa0O3YyT6Ll3FbWbxsh7GcmJ7aa
 +UpOXDPKBzsZzjHUB+a8rECChbtrzEAJ1AJc2QB0ZPw2Id1Fo6rxgkMCs+YoNDiz
 mBqhGAF9VcD9az9DqbMEHwkWHiOTEjgsUwKAVFEYV23nm5sTGIBVc5W/0StG8Kz7
 IQeeapN9kqc2ty+lD8cCfC+NU1EVn3Ca5s85vnWnK3bmmolHEVpzdUzLc9vYrFnP
 JKkNA2n3/9UvC3DRDr7ykD0wro77yA/mcjRLHmMxleLo7YEKZF1aPmsiOlgJiP5K
 LTnkpnhUSIz7W/9v1Gh2pYpiwppJBgp5RXZGXGY/vTA42t0HZeZquGgNub5b0ys7
 +JPrb5jlgYmg4DXXWT2htq8cjTisxJI+6uAtD7oULondtMISZCWtm0CMxgksmATA
 567h1DJHd0zvO7r7mlRa
 =i876
 -----END PGP SIGNATURE-----

Merge tag 'pm-4.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management fix from Rafael Wysocki:
 "This reverts a problematic commit modifying the turbostat utility that
  went in during the 4.13 cycle (Len Brown)"

* tag 'pm-4.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  Revert "tools/power turbostat: stop migrating, unless '-m'"
2017-10-19 22:49:21 -04:00
Paul E. McKenney
27fdb35fe9 doc: Fix various RCU docbook comment-header problems
Because many of RCU's files have not been included into docbook, a
number of errors have accumulated.  This commit fixes them.

Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-10-19 22:26:11 -04:00
Paul E. McKenney
533966c8ad doc: Fix RCU's docbook options
Commit 764f80798b95 ("doc: Add RCU files to docbook-generation files")
added :external: options for RCU source files in the file
Documentation/core-api/kernel-api.rst.  However, this now means nothing,
so this commit removes them.

Reported-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: Akira Yokosawa <akiyks@gmail.com>
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-10-19 22:26:11 -04:00
Mathieu Desnoyers
a961e40917 membarrier: Provide register expedited private command
This introduces a "register private expedited" membarrier command which
allows eventual removal of important memory barrier constraints on the
scheduler fast-paths. It changes how the "private expedited" membarrier
command (new to 4.14) is used from user-space.

This new command allows processes to register their intent to use the
private expedited command.  This affects how the expedited private
command introduced in 4.14-rc is meant to be used, and should be merged
before 4.14 final.

Processes are now required to register before using
MEMBARRIER_CMD_PRIVATE_EXPEDITED, otherwise that command returns EPERM.

This fixes a problem that arose when designing requested extensions to
sys_membarrier() to allow JITs to efficiently flush old code from
instruction caches.  Several potential algorithms are much less painful
if the user register intent to use this functionality early on, for
example, before the process spawns the second thread.  Registering at
this time removes the need to interrupt each and every thread in that
process at the first expedited sys_membarrier() system call.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-10-19 22:13:40 -04:00
Dmitry Torokhov
ea04efee76 Input: ims-psu - check if CDC union descriptor is sane
Before trying to use CDC union descriptor, try to validate whether that it
is sane by checking that intf->altsetting->extra is big enough and that
descriptor bLength is not too big and not too small.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2017-10-19 17:20:06 -07:00
Roderick Colenbrander
20ac95d52a Input: joydev - blacklist ds3/ds4/udraw motion sensors
Introduce a device table used for blacklisting devices. We currently
blacklist the motion sensor subdevice of THQ Udraw and Sony ds3/ds4.

Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
[dtor: siwtched to blacklist built on input_device_id and using
input_match_device_id()]
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2017-10-19 16:55:39 -07:00
Dmitry Torokhov
8724ecb072 Input: allow matching device IDs on property bits
Let's allow matching input devices on their property bits, both in-kernel
and when generating module aliases.

Tested-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2017-10-19 16:54:49 -07:00
Dmitry Torokhov
55dfce873d Input: factor out and export input_device_id matching code
Factor out and export input_match_device_id() so that modules may use it.
It will be needed by joydev to blacklist accelerometers in composite
devices.

Tested-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2017-10-19 16:53:34 -07:00
Paul Cercueil
9b5db7aab4 Input: goodix - poll the 'buffer status' bit before reading data
The Goodix panel triggers an interrupt on touch events. However, its
registers will contain the valid values a short time after the
interrupt, and not when it's raised. At that moment, the 'buffer status'
bit is set.

Previously, if the 'buffer status' bit was not set when the registers
were read, the data was discarded and no input event was emitted,
causing "finger down" or "finger up" events to be missed sometimes.

This went unnoticed until v4.9, as the DesignWare I2C driver commonly
used with this driver had enough latency for that bug to never trigger
until commit 2702ea7dbec5 ("i2c: designware: wait for disable/enable only
if necessary").

Now, in the IRQ handler we will poll (with a timeout) the 'buffer status'
bit and process the data of the panel as soon as this bit gets set.

Note that the Goodix panel will send a few spurious interrupts after the
'finger up' event, in which the 'buffer status' bit will never be set.

Cc: Bastien Nocera <hadess@hadess.net>
Cc: russianneuromancer@ya.ru
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
[hdegoede@redhat.com: Change poll loop to use jiffies,
                      add comment about typical poll time]
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
[dtor: rearranged control flow a bit to avoid explicit goto and double
check]
Reviewed-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2017-10-19 16:50:39 -07:00