OSDN Git Service
Linux Build Service Account [Sun, 14 Oct 2018 04:40:23 +0000 (21:40 -0700)]
Merge "soc: hab: add size checking when hab import buffer"
Linux Build Service Account [Fri, 12 Oct 2018 12:30:16 +0000 (05:30 -0700)]
Merge "Merge android-4.4.159 (
624c095) into msm-4.4"
Yajun Li [Fri, 21 Sep 2018 10:15:22 +0000 (18:15 +0800)]
soc: hab: add size checking when hab import buffer
If the input size of import buffer isn't equal to
the real size of this buffer, hab should reject this
import function.
Change-Id: I184a0752d37e9f1bf6a8705ccf8f2fdfd6796d5e
Signed-off-by: Yajun Li <yajunl@codeaurora.org>
Linux Build Service Account [Thu, 11 Oct 2018 14:01:22 +0000 (07:01 -0700)]
Merge "soc: hab: recycle mmid from qcpe to video"
Linux Build Service Account [Thu, 11 Oct 2018 14:01:21 +0000 (07:01 -0700)]
Merge "ARM: dts: msm: Enable wlan ramdump for msm8996_gvmq"
Linux Build Service Account [Thu, 11 Oct 2018 14:01:20 +0000 (07:01 -0700)]
Merge "ARM: dts: msm: update the DSI bit clock for DSI panel on SDM660"
Linux Build Service Account [Thu, 11 Oct 2018 14:01:19 +0000 (07:01 -0700)]
Merge "cnss2: Add QMI updates for Genoa PCIe"
Linux Build Service Account [Thu, 11 Oct 2018 14:01:18 +0000 (07:01 -0700)]
Merge "i2c-msm-v2: Handle Null pointer de-reference"
Shiju Mathew [Thu, 4 Oct 2018 00:18:58 +0000 (20:18 -0400)]
soc: hab: recycle mmid from qcpe to video
Add new mmid for video and other minor logging
and efficiency fixes.
Change-Id: I0ebbfadff76e7efb7f9afff9896dadf1bd8df9a1
Signed-off-by: Shiju Mathew <shijum@codeaurora.org>
Nijun Gong [Sun, 30 Sep 2018 10:50:00 +0000 (18:50 +0800)]
ARM: dts: msm: Enable wlan ramdump for msm8996_gvmq
Add dts node to let wlan ramdump work for msm8996_gvmq.
Change-Id: Ie47b83c2dc12849d4831f1c053db4f3d997449ff
Signed-off-by: Nijun Gong <ngong@codeaurora.org>
Jayachandran Sreekumaran [Wed, 4 Jul 2018 08:54:26 +0000 (14:24 +0530)]
cnss2: Add QMI updates for Genoa PCIe
Add qmi updates to pass the msi config for copy engine and
host memory information for CE to update the read index.
Change-Id: I8861659e54cfb25ae64a23a3f02f1e0fce6d372d
Signed-off-by: Jayachandran Sreekumaran <jsreekum@codeaurora.org>
Linux Build Service Account [Tue, 9 Oct 2018 23:32:19 +0000 (16:32 -0700)]
Merge "sdcardfs: Fix the format prints in sdcardfs"
Linux Build Service Account [Tue, 9 Oct 2018 23:32:18 +0000 (16:32 -0700)]
Merge "wcnss: fix integer underflow in wcnss_wlan"
Linux Build Service Account [Tue, 9 Oct 2018 23:32:17 +0000 (16:32 -0700)]
Merge "cnss2: Add force wake support"
Linux Build Service Account [Tue, 9 Oct 2018 16:43:44 +0000 (09:43 -0700)]
Merge "soc: msm: add sensor dsp dynamic calibration support for anc"
Linux Build Service Account [Tue, 9 Oct 2018 16:43:43 +0000 (09:43 -0700)]
Merge "msm: mdss: dsi: fix slab-out-of-bounds issue"
Linux Build Service Account [Tue, 9 Oct 2018 16:43:41 +0000 (09:43 -0700)]
Merge "ARM: dts: msm: enable dynamic bit clock for SDM660 MTP panel"
Linux Build Service Account [Tue, 9 Oct 2018 16:43:40 +0000 (09:43 -0700)]
Merge "soc: qcom: subsystem_notif_virt: Add a NULL check and fix a data type"
Linux Build Service Account [Tue, 9 Oct 2018 16:43:37 +0000 (09:43 -0700)]
Merge "msm: kgsl: Add a property to find if secure context is supported"
Linux Build Service Account [Tue, 9 Oct 2018 16:43:36 +0000 (09:43 -0700)]
Merge "usb: misc: Add USB_QCOM_IPC_BRIDGE config"
Linux Build Service Account [Tue, 9 Oct 2018 16:43:34 +0000 (09:43 -0700)]
Merge "ARM: dts: msm: remove HOME gpio key for qrd devices"
Linux Build Service Account [Tue, 9 Oct 2018 16:43:32 +0000 (09:43 -0700)]
Merge "soc: hab: refine codes to support multi import"
Sandeep Singh [Thu, 4 Oct 2018 10:23:23 +0000 (15:53 +0530)]
wcnss: fix integer underflow in wcnss_wlan
Fix integer underflow which may eventually results in an buffer
overread in wcnss_nvbin_dnld when the firmware file size is less
than 4 Byte. Add a check on file size before performing
arithmetic operation which avoids buffer underflow.
CRs-Fixed:
2279226
Change-Id: Ia7fdb859e8c999f8a2e81c957c7cab35ef312844
Signed-off-by: Sandeep Singh <sandsing@codeaurora.org>
Anant Goel [Mon, 8 Oct 2018 18:06:13 +0000 (11:06 -0700)]
soc: qcom: subsystem_notif_virt: Add a NULL check and fix a data type
A NULL pointer check is added to prevent a NULL pointer
exception. A data type is fixed to prevent a type conversion
before an error check.
Change-Id: If4f6f70c8770ad48432e466e1b6a7e9bf4b62258
Signed-off-by: Anant Goel <anantg@codeaurora.org>
Ritesh Harjani [Sat, 21 Jul 2018 06:50:55 +0000 (12:20 +0530)]
sdcardfs: Fix the format prints in sdcardfs
Fix the %p format prints with %pK.
Change-Id: I5fbe70350d7b4d986a2b070c9a2602d9d7680dc9
Signed-off-by: Ritesh Harjani <riteshh@codeaurora.org>
Yue Ma [Tue, 7 Aug 2018 23:47:09 +0000 (16:47 -0700)]
cnss2: Add force wake support
As part of PCIe power management for new WLAN devices, it requires
asserting WAKE register before accessing any MMIO registers outside
first 4K range. Add the support in CNSS driver and expose the APIs
for WLAN host driver.
Change-Id: I69688c229121c12575dde4938961d60bc067751f
Signed-off-by: Yue Ma <yuem@codeaurora.org>
Sunil Khatri [Fri, 10 Aug 2018 06:16:58 +0000 (11:46 +0530)]
msm: kgsl: Add a property to find if secure context is supported
Add a property to determine if a target support secure context
for use cases like CPZ.
This property can be used by userspace application to create
a secure context if its supported on the target.
Change-Id: I1ccc824378fb8fbd2cfbc7b811c6c3fdcd17803e
Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>
Sunil Khatri [Thu, 19 Jul 2018 11:40:39 +0000 (17:10 +0530)]
msm: kgsl: Add a property to find alignment of secure buffers
Add a property to determine the hardware alignment
constraint on secure buffers. XPUv2 and below
have a minimum requirement of 1 MBytes alignment
and hence driver should allocate memory with minimum
alignment on size.
Change-Id: Ie3ca5da489bc94ae57ddc6695e402463fd7a88c2
Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>
Padmanabhan Komanduru [Mon, 8 Oct 2018 12:34:18 +0000 (18:04 +0530)]
ARM: dts: msm: update the DSI bit clock for DSI panel on SDM660
Update the DSI bit clock frequencies supported for the NT35597
video mode panel on SDM660 for dynamic bit clock feature.
Change-Id: I597bb43bf8f93aa6d98afff5d5b8973689460b41
Signed-off-by: Padmanabhan Komanduru <pkomandu@codeaurora.org>
Vipin Deep Kaur [Mon, 8 Oct 2018 11:38:43 +0000 (17:08 +0530)]
i2c-msm-v2: Handle Null pointer de-reference
Zero message may be passed causing null pointer de-reference.
Adding check on the number of messages passed to handle the issue.
Change-Id: I7cef6dd2070c5eaaa748698c45540f8aa1d96116
Signed-off-by: Vipin Deep Kaur <vkaur@codeaurora.org>
Fei Mao [Fri, 28 Sep 2018 10:44:25 +0000 (18:44 +0800)]
ARM: dts: msm: remove HOME gpio key for qrd devices
For qrd devices, remove HOME gpio key to fix driver probe issue.
Change-Id: I46ba4ef05c795fced67f2db59a3f5ce183bdeba8
Signed-off-by: Fei Mao <feim1@codeaurora.org>
Srinivasarao P [Mon, 8 Oct 2018 05:24:11 +0000 (10:54 +0530)]
Merge android-4.4.159 (
624c095) into msm-4.4
* refs/heads/tmp-
624c095
Linux 4.4.159
iw_cxgb4: only allow 1 flush on user qps
HID: sony: Support DS4 dongle
HID: sony: Update device ids
arm64: Add trace_hardirqs_off annotation in ret_to_user
ext4: don't mark mmp buffer head dirty
ext4: fix online resizing for bigalloc file systems with a 1k block size
ext4: fix online resize's handling of a too-small final block group
ext4: recalucate superblock checksum after updating free blocks/inodes
ext4: avoid divide by zero fault when deleting corrupted inline directories
tty: vt_ioctl: fix potential Spectre v1
drm/nouveau/drm/nouveau: Use pm_runtime_get_noresume() in connector_detect()
ocfs2: fix ocfs2 read block panic
scsi: target: iscsi: Use hex2bin instead of a re-implementation
neighbour: confirm neigh entries when ARP packet is received
net: hp100: fix always-true check for link up state
net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT
ipv6: fix possible use-after-free in ip6_xmit()
gso_segment: Reset skb->mac_len after modifying network header
mm: shmem.c: Correctly annotate new inodes for lockdep
ring-buffer: Allow for rescheduling when removing pages
xen/x86/vpmu: Zero struct pt_regs before calling into sample handling code
xen/netfront: don't bug in case of too many frags
platform/x86: alienware-wmi: Correct a memory leak
ALSA: emu10k1: fix possible info leak to userspace on SNDRV_EMU10K1_IOCTL_INFO
ALSA: bebob: use address returned by kmalloc() instead of kernel stack for streaming DMA mapping
ASoC: cs4265: fix MMTLR Data switch control
NFC: Fix the number of pipes
NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
ANDROID: restrict store of prefer_idle as boolean
f2fs: readahead encrypted block during GC
f2fs: avoid fi->i_gc_rwsem[WRITE] lock in f2fs_gc
f2fs: fix performance issue observed with multi-thread sequential read
f2fs: fix to skip verifying block address for non-regular inode
f2fs: rework fault injection handling to avoid a warning
f2fs: support fault_type mount option
f2fs: fix to return success when trimming meta area
f2fs: fix use-after-free of dicard command entry
f2fs: support discard submission error injection
f2fs: split discard command in prior to block layer
f2fs: wake up gc thread immediately when gc_urgent is set
f2fs: fix incorrect range->len in f2fs_trim_fs()
f2fs: refresh recent accessed nat entry in lru list
f2fs: fix avoid race between truncate and background GC
f2fs: avoid race between zero_range and background GC
f2fs: fix to do sanity check with block address in main area v2
f2fs: fix to do sanity check with inline flags
f2fs: fix to reset i_gc_failures correctly
f2fs: fix invalid memory access
f2fs: fix to avoid broken of dnode block list
f2fs: use true and false for boolean values
f2fs: fix to do sanity check with cp_pack_start_sum
f2fs: avoid f2fs_bug_on() in cp_error case
f2fs: fix to clear PG_checked flag in set_page_dirty()
f2fs: fix to active page in lru list for read path
f2fs: don't keep meta pages used for block migration
f2fs: fix to restrict mount condition when without CONFIG_QUOTA
f2fs: quota: do not mount as RDWR without QUOTA if quota feature enabled
f2fs: quota: fix incorrect comments
f2fs: add proc entry to show victim_secmap bitmap
f2fs: let checkpoint flush dnode page of regular
f2fs: issue discard align to section in LFS mode
f2fs: don't allow any writes on aborted atomic writes
f2fs: restrict setting up inode.i_advise
f2fs: fix wrong kernel message when recover fsync data on ro fs
f2fs: clean up ioctl interface naming
f2fs: clean up with f2fs_is_{atomic,volatile}_file()
f2fs: clean up with f2fs_encrypted_inode()
f2fs: clean up with get_current_nat_page
f2fs: kill EXT_TREE_VEC_SIZE
f2fs: avoid duplicated permission check for "trusted." xattrs
f2fs: fix to propagate error from __get_meta_page()
f2fs: fix to do sanity check with i_extra_isize
f2fs: blk_finish_plug of submit_bio in lfs mode
f2fs: do not set free of current section
f2fs: Keep alloc_valid_block_count in sync
f2fs: issue small discard by LBA order
f2fs: stop issuing discard immediately if there is queued IO
f2fs: clean up with IS_INODE()
f2fs: detect bug_on in f2fs_wait_discard_bios
f2fs: fix defined but not used build warnings
f2fs: enable real-time discard by default
f2fs: fix to detect looped node chain correctly
f2fs: fix to do sanity check with block address in main area
f2fs: fix to skip GC if type in SSA and SIT is inconsistent
f2fs: try grabbing node page lock aggressively in sync scenario
f2fs: show the fsync_mode=nobarrier mount option
f2fs: check the right return value of memory alloc function
f2fs: Replace strncpy with memcpy
f2fs: avoid the global name 'fault_name'
f2fs: fix to do sanity check with reserved blkaddr of inline inode
f2fs: fix to do sanity check with node footer and iblocks
f2fs: Allocate and stat mem used by free nid bitmap more accurately
f2fs: fix to do sanity check with user_block_count
f2fs: fix to do sanity check with extra_attr feature
f2fs: fix to correct return value of f2fs_trim_fs
f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize
f2fs: fix to do sanity check with secs_per_zone
f2fs: disable f2fs_check_rb_tree_consistence
f2fs: introduce and spread verify_blkaddr
f2fs: use timespec64 for inode timestamps
f2fs: fix to wait on page writeback before updating page
f2fs: assign REQ_RAHEAD to bio for ->readpages
f2fs: fix a hungtask problem caused by congestion_wait
f2fs: Fix uninitialized return in f2fs_ioc_shutdown()
f2fs: don't issue discard commands in online discard is on
f2fs: fix to propagate return value of scan_nat_page()
f2fs: support in-memory inode checksum when checking consistency
f2fs: fix error path of fill_super
f2fs: relocate readdir_ra configure initialization
f2fs: move s_res{u,g}id initialization to default_options()
f2fs: don't acquire orphan ino during recovery
f2fs: avoid potential deadlock in f2fs_sbi_store
f2fs: indicate shutdown f2fs to allow unmount successfully
f2fs: keep meta pages in cp_error state
f2fs: do checkpoint in kill_sb
f2fs: allow wrong configured dio to buffered write
f2fs: flush journal nat entries for nat_bits during unmount
Conflicts:
drivers/hid/hid-core.c
Change-Id: Idc486f778059ca65307ab08678f3b1e23c4ec15f
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Yajun Li [Tue, 18 Sep 2018 11:16:22 +0000 (19:16 +0800)]
soc: hab: refine codes to support multi import
Make HAB clients have chance to import the
same export id to fd and uva before unimport
happens.
Change-Id: I59fdc701dcdc086e58865fa216b10f9fe6a45e29
Signed-off-by: Yajun Li <yajunl@codeaurora.org>
Yao Jiang [Thu, 27 Sep 2018 07:31:11 +0000 (15:31 +0800)]
soc: qcom: hab: fix the leak risk in hab_vchan_get
When getting a vchan after receiving a message, it has probability that
this vchan is closed concurrently. So when refcount is increased by
kref_get_unless_zero, but flag vchan->otherend_closed or vchan->closed
is true at this time, it will return vchan as NULL, and the hab_vchan_put
will not be called in hab_msg_rev. So adjust the timing here can avoid the
leak risk.
Change-Id: If78c1c41bc4fd05b3288c0324bb9e0aed8493c5f
Signed-off-by: Yao Jiang <yaojia@codeaurora.org>
Yao Jiang [Thu, 27 Sep 2018 03:53:55 +0000 (11:53 +0800)]
soc: qcom: hab: replace kref_get with kref_get_unless_zero
If refcount was 0 before increment, it maybe has a race condition that
this kref is freeing by some other thread right now. In this case we should
not increments refcount, so replace with kref_get_unless_zero.
Change-Id: Ic15eaefc111770a966094d05b19eca2a04d52fc2
Signed-off-by: Yao Jiang <yaojia@codeaurora.org>
Linux Build Service Account [Sat, 6 Oct 2018 10:46:09 +0000 (03:46 -0700)]
Merge "Merge android-4.4.158 (
f9e4134) into msm-4.4"
Linux Build Service Account [Sat, 6 Oct 2018 10:46:06 +0000 (03:46 -0700)]
Merge "ARM: dts: Add new memlat freq map for sdm455"
Linux Build Service Account [Sat, 6 Oct 2018 10:46:05 +0000 (03:46 -0700)]
Merge "clk: qcom: mdss: avoid release of the dynamic fps PLL code memory"
Linux Build Service Account [Fri, 5 Oct 2018 18:28:20 +0000 (11:28 -0700)]
Merge "msm: ipa: Protect ipa default routing table"
Linux Build Service Account [Fri, 5 Oct 2018 18:28:15 +0000 (11:28 -0700)]
Merge "dwc3: Preserve TxFIFO of IN/INT EP for UDC without tx-fifo-resize"
Ajay Agarwal [Fri, 5 Oct 2018 12:23:06 +0000 (17:53 +0530)]
usb: misc: Add USB_QCOM_IPC_BRIDGE config
Add USB_QCOM_IPC_BRIDGE config which is required to enable
MSM_IPC_ROUTER_HSIC_XPRT config.
Change-Id: I78f4aeea5f392f76f80410aaff0d5f72760e2494
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Padmanabhan Komanduru [Fri, 5 Oct 2018 10:40:04 +0000 (16:10 +0530)]
clk: qcom: mdss: avoid release of the dynamic fps PLL code memory
Avoid the release of memory for dynamic fps PLL codes. The memory
is part of the continuous splash memory region and will be freed
eventually as part of the splash screen memory cleanup routine.
Change-Id: I67afb46057770298668ae5790637e8b4b08fd030
Signed-off-by: Padmanabhan Komanduru <pkomandu@codeaurora.org>
Santosh Mardi [Fri, 5 Oct 2018 10:40:02 +0000 (16:10 +0530)]
ARM: dts: Add new memlat freq map for sdm455
Add new freq map for memlat node for sdm455.
Change-Id: I536b7f3e41610ca78d5cfae08ecbfc1e82b8fe5b
Signed-off-by: Biao long <blong@codeaurora.org>
Signed-off-by: Santosh Mardi <gsantosh@codeaurora.org>
Narender Ankam [Thu, 30 Aug 2018 16:15:59 +0000 (21:45 +0530)]
msm: mdss: dsi: fix slab-out-of-bounds issue
While handling dsi_gen_read_status, status buffer
was xlogging without checking for its max size.
Add proper conditional check to xlog status buffer.
Change-Id: Ia5a1fe18de123d2911c31ae79492b96f67e1273d
Signed-off-by: Narender Ankam <nankam@codeaurora.org>
Linux Build Service Account [Fri, 5 Oct 2018 08:30:08 +0000 (01:30 -0700)]
Merge "mdss: mdp: Fix access after null check"
Linux Build Service Account [Fri, 5 Oct 2018 08:30:07 +0000 (01:30 -0700)]
Merge "drm: msm: update cpu1 hotplug by using cpu_device node"
Linux Build Service Account [Fri, 5 Oct 2018 08:30:06 +0000 (01:30 -0700)]
Merge "mdss: mdp: Add error check for split ctl"
Linux Build Service Account [Thu, 4 Oct 2018 21:58:31 +0000 (14:58 -0700)]
Merge "ion: Ensure non-HLOS memory cannot be mapped by CPU"
Linux Build Service Account [Thu, 4 Oct 2018 21:58:29 +0000 (14:58 -0700)]
Merge "fbdev/msm: sanitize debugfs inputs when reading mdp memory"
Linux Build Service Account [Thu, 4 Oct 2018 21:58:24 +0000 (14:58 -0700)]
Merge "drm/msm: add checksum for HDR infoframe"
Mohammed Javid [Fri, 21 Sep 2018 06:12:40 +0000 (11:42 +0530)]
msm: ipa: Protect ipa default routing table
Protect ipa default routing table from
addition, deletion and modification once after
default rule added by ipa-driver.
Change-Id: I045d9c29fed23edf796d826e440b81124e1f666a
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>
Linux Build Service Account [Thu, 4 Oct 2018 02:21:11 +0000 (19:21 -0700)]
Merge "cnss2: Add support for genoa pcie"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:10 +0000 (19:21 -0700)]
Merge "soc: qcom: hab: fix the soft lockup in vchan free schedule"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:09 +0000 (19:21 -0700)]
Merge "soc: hab: change lifecycle of exp_id from vchan to ctx"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:08 +0000 (19:21 -0700)]
Merge "soc: hab: fix mmap failure issue when hab import"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:07 +0000 (19:21 -0700)]
Merge "ARM: dts: msm: Add pin control settings for UFS reset on SDM660"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:06 +0000 (19:21 -0700)]
Merge "pinctrl: qcom: Add UFS_RESET pin data for sdm660"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:05 +0000 (19:21 -0700)]
Merge "dwc3: resize txfifo of IN/INT endpoint before enabling it"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:04 +0000 (19:21 -0700)]
Merge "Merge android-4.4.157 (
c139ea66) into msm-4.4"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:03 +0000 (19:21 -0700)]
Merge "Merge android-4.4.156 (
7eb7037) into msm-4.4"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:03 +0000 (19:21 -0700)]
Merge "drm/msm: add additional HDR state transition"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:02 +0000 (19:21 -0700)]
Merge "ARM: dts: msm: Enable Native SSR for WLAN on GVMQ"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:01 +0000 (19:21 -0700)]
Merge "clk: qcom: mdss: add support for dynamic refresh on DSI 14nm PLL"
Linux Build Service Account [Thu, 4 Oct 2018 02:20:59 +0000 (19:20 -0700)]
Merge "page-flags: define PG_locked behavior on compound pages"
Linux Build Service Account [Thu, 4 Oct 2018 02:20:57 +0000 (19:20 -0700)]
Merge "drm/msm: clear colorimetry block info for HDMI"
Linux Build Service Account [Thu, 4 Oct 2018 02:20:56 +0000 (19:20 -0700)]
Merge "msm: vidc: copy the crop info during dequeue buf"
Linux Build Service Account [Thu, 4 Oct 2018 02:20:55 +0000 (19:20 -0700)]
Merge "usb: dwc3-msm: Release PM wakelock in host mode only for auto targets"
Abhinav Kumar [Sat, 22 Sep 2018 06:51:50 +0000 (23:51 -0700)]
drm/msm: add checksum for HDR infoframe
Checksum for the HDR infoframe is set to zero by default
as this is not a mandatory field as per the HDMI spec.
However certain HDMI sinks still expect a non-zero
checksum. Otherwise they disregard the infoframe
and the sink does not enter HDR mode despite other fields
of the infoframe being valid.
Add a valid checksum to the HDR infoframe to improve
interoperability of our HDR solution for HDMI.
Change-Id: Ie826e5e637fc1f053203bdcf6a829d0246a9ed67
Signed-off-by: Abhinav Kumar <abhinavk@codeaurora.org>
Yao Jiang [Thu, 27 Sep 2018 01:43:32 +0000 (09:43 +0800)]
soc: qcom: hab: fix the soft lockup in vchan free schedule
With a certain probability soft lockup when do hab vchan free schedule.
one vchan do the local hab close while another vchan in the same context
through softirq also try to acquire write lock in the free schedule at the
same time, it will cause watchdog bite. Disable local softirq could avoid
race condition handling between tasklet and process context.
Change-Id: I4ee9b980dab7ecb1986af1d61f70157fc30d1048
Signed-off-by: Yao Jiang <yaojia@codeaurora.org>
Jayachandran Sreekumaran [Tue, 3 Jul 2018 13:24:07 +0000 (18:54 +0530)]
cnss2: Add support for genoa pcie
Add genoa pcie specific qmi and power up/down handling.
Change-Id: I08e640f775de5436071b457225a8b61f13574d01
CRs-fixed:
2272303
Signed-off-by: Jayachandran Sreekumaran <jsreekum@codeaurora.org>
Abhinav Kumar [Wed, 19 Sep 2018 01:59:12 +0000 (18:59 -0700)]
drm/msm: add additional HDR state transition
Add an additional HDR state transition to cover the HDR
teardown sequence case.
This will avoid the HDR infoframe to be programmed repeatedly
if there is no change in its contents.
Change-Id: Ic2f077f0c2ff01e19db5a59b218c4d824e039773
Signed-off-by: Abhinav Kumar <abhinavk@codeaurora.org>
Signed-off-by: Navid Bahrani <nbahrani@codeaurora.org>
Liam Mark [Thu, 6 Sep 2018 23:15:41 +0000 (16:15 -0700)]
ion: Ensure non-HLOS memory cannot be mapped by CPU
Currently it is possible for an ION client to allocate non-HLOS memory
(ie memory which isn't assigned to the HLOS vmid), map this memory, and
then attempt to access this memory from the CPU.
Attempting to access non-HLOS memory from the CPU will cause a
stage-2 fault.
Fix ION so that non-HLOS memory cannot be mapped by the CPU.
Change-Id: Ifb51de2eabc076cddc744c13f01ef97b4a7c6874
Signed-off-by: Liam Mark <lmark@codeaurora.org>
Srinivasarao P [Thu, 27 Sep 2018 08:38:40 +0000 (14:08 +0530)]
pinctrl: qcom: Add UFS_RESET pin data for sdm660
UFS_RESET is a single purpose output only pin which can be used to
send reset to connected UFS device. This change adds UFS_RESET
pin data.
Change-Id: I539ae2bef003bccf8aa9c23fb5dde0b263844629
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Padmanabhan Komanduru [Tue, 25 Sep 2018 02:43:20 +0000 (08:13 +0530)]
ARM: dts: msm: enable dynamic bit clock for SDM660 MTP panel
Add DT properties to enable support for dynamic DSI bit clock
feature on NT35597 dual DSI video mode panel on SDM660.
Change-Id: I9b382a7a79ba546c8f99889a5a14d2733ea8771f
Signed-off-by: Padmanabhan Komanduru <pkomandu@codeaurora.org>
Padmanabhan Komanduru [Tue, 25 Sep 2018 02:17:48 +0000 (07:47 +0530)]
msm: mdss: add support to switch the DSI clock dynamically
Add change to support changing the DSI bit clock dynamically
for video mode panels. This helps to avoid interference of
DSI clock with other subsystems runtime.
Change-Id: I05790a6dd9d8a2fc3cf31727d032e5220d6164e5
Signed-off-by: Padmanabhan Komanduru <pkomandu@codeaurora.org>
Kirill A. Shutemov [Sat, 16 Jan 2016 00:51:24 +0000 (16:51 -0800)]
page-flags: define PG_locked behavior on compound pages
lock_page() must operate on the whole compound page. It doesn't make
much sense to lock part of compound page. Change code to use head
page's PG_locked, if tail page is passed.
This patch also gets rid of custom helper functions --
__set_page_locked() and __clear_page_locked(). They are replaced with
helpers generated by __SETPAGEFLAG/__CLEARPAGEFLAG. Tail pages to these
helper would trigger VM_BUG_ON().
SLUB uses PG_locked as a bit spin locked. IIUC, tail pages should never
appear there. VM_BUG_ON() is added to make sure that this assumption is
correct.
[akpm@linux-foundation.org: fix fs/cifs/file.c]
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Rik van Riel <riel@redhat.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Christoph Lameter <cl@linux.com>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: Steve Capper <steve.capper@linaro.org>
Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Jerome Marchand <jmarchan@redhat.com>
Cc: Jérôme Glisse <jglisse@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Change-Id: Ifeeb98c789880ff34b286383568db60e08672205
Git-Commit:
48c935ad88f5be20eb5445a77c171351b1eb5111
Git-Repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
Kirill A. Shutemov [Sat, 16 Jan 2016 00:51:21 +0000 (16:51 -0800)]
page-flags: introduce page flags policies wrt compound pages
This patch adds a third argument to macros which create function
definitions for page flags. This argument defines how page-flags
helpers behave on compound functions.
For now we define four policies:
- PF_ANY: the helper function operates on the page it gets, regardless
if it's non-compound, head or tail.
- PF_HEAD: the helper function operates on the head page of the
compound page if it gets tail page.
- PF_NO_TAIL: only head and non-compond pages are acceptable for this
helper function.
- PF_NO_COMPOUND: only non-compound pages are acceptable for this
helper function.
For now we use policy PF_ANY for all helpers, which matches current
behaviour.
We do not enforce the policy for TESTPAGEFLAG, because we have flags
checked for random pages all over the kernel. Noticeable exception to
this is PageTransHuge() which triggers VM_BUG_ON() for tail page.
Change-Id: I7b7847a06d9ddaa91ec8fabbbf36772dd4501fb2
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Rik van Riel <riel@redhat.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Christoph Lameter <cl@linux.com>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: Steve Capper <steve.capper@linaro.org>
Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Jerome Marchand <jmarchan@redhat.com>
Cc: Jérôme Glisse <jglisse@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-Commit:
95ad97554ac81b31139d4fe5ed8757a07087cd90
Git-Repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
Kirill A. Shutemov [Sat, 16 Jan 2016 00:51:17 +0000 (16:51 -0800)]
page-flags: move code around
The preparation patch: we are going to use compound_head(), PageTail()
and PageCompound() to define page-flags helpers.
Let's define them before macros.
We cannot user PageHead() helper in PageCompound() as it's not yet
defined -- use test_bit(PG_head, &page->flags) instead.
Change-Id: I7b6fb5e29c571f740a6390af87794496c5b4d240
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Rik van Riel <riel@redhat.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Christoph Lameter <cl@linux.com>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: Steve Capper <steve.capper@linaro.org>
Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Jerome Marchand <jmarchan@redhat.com>
Cc: Jérôme Glisse <jglisse@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-Commit:
0e6d31a7336f41ef0375f5398c79e54de8e219b6
Git-Repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
Ajay Agarwal [Wed, 1 Nov 2017 10:28:59 +0000 (15:58 +0530)]
dwc3: Preserve TxFIFO of IN/INT EP for UDC without tx-fifo-resize
We are clearing existing allocated TxFIFO during set_config
even if a controller does not have tx-fifo-resize flag set
in the DT. Also we do not resize the FIFOs for such controller.
As a result, the FIFO depths for the IN/INT EPs (excpet 0 IN)
of the controller are 0 and it cannot work in device mode.
Fix this issue by not clearing the default TxFIFO if
tx-fifo-resize flag is not set.
Change-Id: I5cf7d2eb017b8ed55348e578c10856d62a3e282e
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Ajay Agarwal [Wed, 1 Nov 2017 05:50:03 +0000 (11:20 +0530)]
USB: dwc3: gadget: Fix TxFIFO resizing logic
The TxFIFO RAM start address for some USB controller
might be non-zero. The current FIFO resizing logic in
place always considers that this start address is 0x0000
and writes the RAM start address for subsequent TxFIFOs
with the last FIFO depth only, leading to the controller
not functioning properly.
To make the controller work, start address of GTXFIFOSIZ(#n)
should be written with the start address of GTXFIFOSIZ(0)
+ last FIFO depth. Fix the resizing logic accordingly.
Change-Id: Ia83edef7165b980828f2a43832493be2349ae0dc
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Mayank Rana [Tue, 25 Apr 2017 20:48:46 +0000 (13:48 -0700)]
dwc3: resize txfifo of IN/INT endpoint before enabling it
USB IN/INT endpoint stalls when performing TX FIFO resize functionality
when IN/INT endpoint is already active i.e. usb endpoint is enabled and
usb request is pending with it. Fix this issue by making sure that TX
FIFO resize is performed before enabling endpoint which shall happen
after set_alt(1) and before any function queues request with its allocated
USB endpoint.
CRs-Fixed:
2039310
Change-Id: I13a590f87ab8492f7c95a15b2da9f00c9c63c4f9
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Greg Kroah-Hartman [Sat, 29 Sep 2018 14:51:37 +0000 (07:51 -0700)]
Merge 4.4.159 into android-4.4
Changes in 4.4.159
NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
NFC: Fix the number of pipes
ASoC: cs4265: fix MMTLR Data switch control
ALSA: bebob: use address returned by kmalloc() instead of kernel stack for streaming DMA mapping
ALSA: emu10k1: fix possible info leak to userspace on SNDRV_EMU10K1_IOCTL_INFO
platform/x86: alienware-wmi: Correct a memory leak
xen/netfront: don't bug in case of too many frags
xen/x86/vpmu: Zero struct pt_regs before calling into sample handling code
ring-buffer: Allow for rescheduling when removing pages
mm: shmem.c: Correctly annotate new inodes for lockdep
gso_segment: Reset skb->mac_len after modifying network header
ipv6: fix possible use-after-free in ip6_xmit()
net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT
net: hp100: fix always-true check for link up state
neighbour: confirm neigh entries when ARP packet is received
scsi: target: iscsi: Use hex2bin instead of a re-implementation
ocfs2: fix ocfs2 read block panic
drm/nouveau/drm/nouveau: Use pm_runtime_get_noresume() in connector_detect()
tty: vt_ioctl: fix potential Spectre v1
ext4: avoid divide by zero fault when deleting corrupted inline directories
ext4: recalucate superblock checksum after updating free blocks/inodes
ext4: fix online resize's handling of a too-small final block group
ext4: fix online resizing for bigalloc file systems with a 1k block size
ext4: don't mark mmp buffer head dirty
arm64: Add trace_hardirqs_off annotation in ret_to_user
HID: sony: Update device ids
HID: sony: Support DS4 dongle
iw_cxgb4: only allow 1 flush on user qps
Linux 4.4.159
Change-Id: I98239ca60783ca69147f2f11034138fc22e2af65
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Greg Kroah-Hartman [Sat, 29 Sep 2018 10:08:55 +0000 (03:08 -0700)]
Linux 4.4.159
Steve Wise [Fri, 31 Aug 2018 14:15:56 +0000 (07:15 -0700)]
iw_cxgb4: only allow 1 flush on user qps
commit
308aa2b8f7b7db3332a7d41099fd37851fb793b2 upstream.
Once the qp has been flushed, it cannot be flushed again. The user qp
flush logic wasn't enforcing it however. The bug can cause
touch-after-free crashes like:
Unable to handle kernel paging request for data at address 0x000001ec
Faulting instruction address: 0xc008000016069100
Oops: Kernel access of bad area, sig: 11 [#1]
...
NIP [
c008000016069100] flush_qp+0x80/0x480 [iw_cxgb4]
LR [
c00800001606cd6c] c4iw_modify_qp+0x71c/0x11d0 [iw_cxgb4]
Call Trace:
[
c00800001606cd6c] c4iw_modify_qp+0x71c/0x11d0 [iw_cxgb4]
[
c00800001606e868] c4iw_ib_modify_qp+0x118/0x200 [iw_cxgb4]
[
c0080000119eae80] ib_security_modify_qp+0xd0/0x3d0 [ib_core]
[
c0080000119c4e24] ib_modify_qp+0xc4/0x2c0 [ib_core]
[
c008000011df0284] iwcm_modify_qp_err+0x44/0x70 [iw_cm]
[
c008000011df0fec] destroy_cm_id+0xcc/0x370 [iw_cm]
[
c008000011ed4358] rdma_destroy_id+0x3c8/0x520 [rdma_cm]
[
c0080000134b0540] ucma_close+0x90/0x1b0 [rdma_ucm]
[
c000000000444da4] __fput+0xe4/0x2f0
So fix flush_qp() to only flush the wq once.
Cc: stable@vger.kernel.org
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Roderick Colenbrander [Wed, 23 Nov 2016 22:07:11 +0000 (14:07 -0800)]
HID: sony: Support DS4 dongle
commit
de66a1a04c25f2560a8dca7a95e2a150b0d5e17e upstream.
Add support for USB based DS4 dongle device, which allows connecting
a DS4 through Bluetooth, but hides Bluetooth from the host system.
Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Roderick Colenbrander [Fri, 7 Oct 2016 19:39:40 +0000 (12:39 -0700)]
HID: sony: Update device ids
commit
cf1015d65d7c8a5504a4c03afb60fb86bff0f032 upstream.
Support additional DS4 model.
Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Catalin Marinas [Fri, 4 Dec 2015 12:42:29 +0000 (12:42 +0000)]
arm64: Add trace_hardirqs_off annotation in ret_to_user
commit
db3899a6477a4dccd26cbfb7f408b6be2cc068e0 upstream.
When a kernel is built with CONFIG_TRACE_IRQFLAGS the following warning
is produced when entering userspace for the first time:
WARNING: at /work/Linux/linux-2.6-aarch64/kernel/locking/lockdep.c:3519
Modules linked in:
CPU: 1 PID: 1 Comm: systemd Not tainted 4.4.0-rc3+ #639
Hardware name: Juno (DT)
task:
ffffffc9768a0000 ti:
ffffffc9768a8000 task.ti:
ffffffc9768a8000
PC is at check_flags.part.22+0x19c/0x1a8
LR is at check_flags.part.22+0x19c/0x1a8
pc : [<
ffffffc0000fba6c>] lr : [<
ffffffc0000fba6c>] pstate:
600001c5
sp :
ffffffc9768abe10
x29:
ffffffc9768abe10 x28:
ffffffc9768a8000
x27:
0000000000000000 x26:
0000000000000001
x25:
00000000000000a6 x24:
ffffffc00064be6c
x23:
ffffffc0009f249e x22:
ffffffc9768a0000
x21:
ffffffc97fea5480 x20:
00000000000001c0
x19:
ffffffc00169a000 x18:
0000005558cc7b58
x17:
0000007fb78e3180 x16:
0000005558d2e238
x15:
ffffffffffffffff x14:
0ffffffffffffffd
x13:
0000000000000008 x12:
0101010101010101
x11:
7f7f7f7f7f7f7f7f x10:
fefefefefefeff63
x9 :
7f7f7f7f7f7f7f7f x8 :
6e655f7371726964
x7 :
0000000000000001 x6 :
ffffffc0001079c4
x5 :
0000000000000000 x4 :
0000000000000001
x3 :
ffffffc001698438 x2 :
0000000000000000
x1 :
ffffffc9768a0000 x0 :
000000000000002e
Call trace:
[<
ffffffc0000fba6c>] check_flags.part.22+0x19c/0x1a8
[<
ffffffc0000fc440>] lock_is_held+0x80/0x98
[<
ffffffc00064bafc>] __schedule+0x404/0x730
[<
ffffffc00064be6c>] schedule+0x44/0xb8
[<
ffffffc000085bb0>] ret_to_user+0x0/0x24
possible reason: unannotated irqs-off.
irq event stamp: 502169
hardirqs last enabled at (502169): [<
ffffffc000085a98>] el0_irq_naked+0x1c/0x24
hardirqs last disabled at (502167): [<
ffffffc0000bb3bc>] __do_softirq+0x17c/0x298
softirqs last enabled at (502168): [<
ffffffc0000bb43c>] __do_softirq+0x1fc/0x298
softirqs last disabled at (502143): [<
ffffffc0000bb830>] irq_exit+0xa0/0xf0
This happens because we disable interrupts in ret_to_user before calling
schedule() in work_resched. This patch adds the necessary
trace_hardirqs_off annotation.
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Reported-by: Mark Rutland <mark.rutland@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Li Dongyang [Sat, 15 Sep 2018 21:11:25 +0000 (17:11 -0400)]
ext4: don't mark mmp buffer head dirty
commit
fe18d649891d813964d3aaeebad873f281627fbc upstream.
Marking mmp bh dirty before writing it will make writeback
pick up mmp block later and submit a write, we don't want the
duplicate write as kmmpd thread should have full control of
reading and writing the mmp block.
Another reason is we will also have random I/O error on
the writeback request when blk integrity is enabled, because
kmmpd could modify the content of the mmp block(e.g. setting
new seq and time) while the mmp block is under I/O requested
by writeback.
Signed-off-by: Li Dongyang <dongyangli@ddn.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Theodore Ts'o [Tue, 4 Sep 2018 02:25:01 +0000 (22:25 -0400)]
ext4: fix online resizing for bigalloc file systems with a 1k block size
commit
5f8c10936fab2b69a487400f2872902e597dd320 upstream.
An online resize of a file system with the bigalloc feature enabled
and a 1k block size would be refused since ext4_resize_begin() did not
understand s_first_data_block is 0 for all bigalloc file systems, even
when the block size is 1k.
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Theodore Ts'o [Tue, 4 Sep 2018 02:19:43 +0000 (22:19 -0400)]
ext4: fix online resize's handling of a too-small final block group
commit
f0a459dec5495a3580f8d784555e6f8f3bf7f263 upstream.
Avoid growing the file system to an extent so that the last block
group is too small to hold all of the metadata that must be stored in
the block group.
This problem can be triggered with the following reproducer:
umount /mnt
mke2fs -F -m0 -b 4096 -t ext4 -O resize_inode,^has_journal \
-E resize=
1073741824 /tmp/foo.img 128M
mount /tmp/foo.img /mnt
truncate --size 1708M /tmp/foo.img
resize2fs /dev/loop0 295400
umount /mnt
e2fsck -fy /tmp/foo.img
Reported-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Theodore Ts'o [Sat, 1 Sep 2018 18:42:14 +0000 (14:42 -0400)]
ext4: recalucate superblock checksum after updating free blocks/inodes
commit
4274f516d4bc50648a4d97e4f67ecbd7b65cde4a upstream.
When mounting the superblock, ext4_fill_super() calculates the free
blocks and free inodes and stores them in the superblock. It's not
strictly necessary, since we don't use them any more, but it's nice to
keep them roughly aligned to reality.
Since it's not critical for file system correctness, the code doesn't
call ext4_commit_super(). The problem is that it's in
ext4_commit_super() that we recalculate the superblock checksum. So
if we're not going to call ext4_commit_super(), we need to call
ext4_superblock_csum_set() to make sure the superblock checksum is
consistent.
Most of the time, this doesn't matter, since we end up calling
ext4_commit_super() very soon thereafter, and definitely by the time
the file system is unmounted. However, it doesn't work in this
sequence:
mke2fs -Fq -t ext4 /dev/vdc 128M
mount /dev/vdc /vdc
cp xfstests/git-versions /vdc
godown /vdc
umount /vdc
mount /dev/vdc
tune2fs -l /dev/vdc
With this commit, the "tune2fs -l" no longer fails.
Reported-by: Chengguang Xu <cgxu519@gmx.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Theodore Ts'o [Mon, 27 Aug 2018 13:22:45 +0000 (09:22 -0400)]
ext4: avoid divide by zero fault when deleting corrupted inline directories
commit
4d982e25d0bdc83d8c64e66fdeca0b89240b3b85 upstream.
A specially crafted file system can trick empty_inline_dir() into
reading past the last valid entry in a inline directory, and then run
into the end of xattr marker. This will trigger a divide by zero
fault. Fix this by using the size of the inline directory instead of
dir->i_size.
Also clean up error reporting in __ext4_check_dir_entry so that the
message is clearer and more understandable --- and avoids the division
by zero trap if the size passed in is zero. (I'm not sure why we
coded it that way in the first place; printing offset % size is
actually more confusing and less useful.)
https://bugzilla.kernel.org/show_bug.cgi?id=200933
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reported-by: Wen Xu <wen.xu@gatech.edu>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Gustavo A. R. Silva [Thu, 16 Aug 2018 20:30:38 +0000 (15:30 -0500)]
tty: vt_ioctl: fix potential Spectre v1
commit
e97267cb4d1ee01ca0929638ec0fcbb0904f903d upstream.
vsa.console is indirectly controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.
This issue was detected with the help of Smatch:
drivers/tty/vt/vt_ioctl.c:711 vt_ioctl() warn: potential spectre issue
'vc_cons' [r]
Fix this by sanitizing vsa.console before using it to index vc_cons
Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].
[1] https://marc.info/?l=linux-kernel&m=
152449131114778&w=2
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Reviewed-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Lyude Paul [Wed, 15 Aug 2018 19:00:14 +0000 (15:00 -0400)]
drm/nouveau/drm/nouveau: Use pm_runtime_get_noresume() in connector_detect()
commit
6833fb1ec120bf078e1a527c573a09d4de286224 upstream.
It's true we can't resume the device from poll workers in
nouveau_connector_detect(). We can however, prevent the autosuspend
timer from elapsing immediately if it hasn't already without risking any
sort of deadlock with the runtime suspend/resume operations. So do that
instead of entirely avoiding grabbing a power reference.
Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Karol Herbst <kherbst@redhat.com>
Acked-by: Daniel Vetter <daniel@ffwll.ch>
Cc: stable@vger.kernel.org
Cc: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Junxiao Bi [Thu, 20 Sep 2018 19:22:51 +0000 (12:22 -0700)]
ocfs2: fix ocfs2 read block panic
commit
234b69e3e089d850a98e7b3145bd00e9b52b1111 upstream.
While reading block, it is possible that io error return due to underlying
storage issue, in this case, BH_NeedsValidate was left in the buffer head.
Then when reading the very block next time, if it was already linked into
journal, that will trigger the following panic.
[203748.702517] kernel BUG at fs/ocfs2/buffer_head_io.c:342!
[203748.702533] invalid opcode: 0000 [#1] SMP
[203748.702561] Modules linked in: ocfs2 ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs sunrpc dm_switch dm_queue_length dm_multipath bonding be2iscsi iscsi_boot_sysfs bnx2i cnic uio cxgb4i iw_cxgb4 cxgb4 cxgb3i libcxgbi iw_cxgb3 cxgb3 mdio ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr ipv6 iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ipmi_devintf iTCO_wdt iTCO_vendor_support dcdbas ipmi_ssif i2c_core ipmi_si ipmi_msghandler acpi_pad pcspkr sb_edac edac_core lpc_ich mfd_core shpchp sg tg3 ptp pps_core ext4 jbd2 mbcache2 sr_mod cdrom sd_mod ahci libahci megaraid_sas wmi dm_mirror dm_region_hash dm_log dm_mod
[203748.703024] CPU: 7 PID: 38369 Comm: touch Not tainted 4.1.12-124.18.6.el6uek.x86_64 #2
[203748.703045] Hardware name: Dell Inc. PowerEdge R620/0PXXHP, BIOS 2.5.2 01/28/2015
[203748.703067] task:
ffff880768139c00 ti:
ffff88006ff48000 task.ti:
ffff88006ff48000
[203748.703088] RIP: 0010:[<
ffffffffa05e9f09>] [<
ffffffffa05e9f09>] ocfs2_read_blocks+0x669/0x7f0 [ocfs2]
[203748.703130] RSP: 0018:
ffff88006ff4b818 EFLAGS:
00010206
[203748.703389] RAX:
0000000008620029 RBX:
ffff88006ff4b910 RCX:
0000000000000000
[203748.703885] RDX:
0000000000000001 RSI:
0000000000000000 RDI:
00000000023079fe
[203748.704382] RBP:
ffff88006ff4b8d8 R08:
0000000000000000 R09:
ffff8807578c25b0
[203748.704877] R10:
000000000f637376 R11:
000000003030322e R12:
0000000000000000
[203748.705373] R13:
ffff88006ff4b910 R14:
ffff880732fe38f0 R15:
0000000000000000
[203748.705871] FS:
00007f401992c700(0000) GS:
ffff880bfebc0000(0000) knlGS:
0000000000000000
[203748.706370] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
[203748.706627] CR2:
00007f4019252440 CR3:
00000000a621e000 CR4:
0000000000060670
[203748.707124] Stack:
[203748.707371]
ffff88006ff4b828 ffffffffa0609f52 ffff88006ff4b838 0000000000000001
[203748.707885]
0000000000000000 0000000000000000 ffff880bf67c3800 ffffffffa05eca00
[203748.708399]
00000000023079ff ffffffff81c58b80 0000000000000000 0000000000000000
[203748.708915] Call Trace:
[203748.709175] [<
ffffffffa0609f52>] ? ocfs2_inode_cache_io_unlock+0x12/0x20 [ocfs2]
[203748.709680] [<
ffffffffa05eca00>] ? ocfs2_empty_dir_filldir+0x80/0x80 [ocfs2]
[203748.710185] [<
ffffffffa05ec0cb>] ocfs2_read_dir_block_direct+0x3b/0x200 [ocfs2]
[203748.710691] [<
ffffffffa05f0fbf>] ocfs2_prepare_dx_dir_for_insert.isra.57+0x19f/0xf60 [ocfs2]
[203748.711204] [<
ffffffffa065660f>] ? ocfs2_metadata_cache_io_unlock+0x1f/0x30 [ocfs2]
[203748.711716] [<
ffffffffa05f4f3a>] ocfs2_prepare_dir_for_insert+0x13a/0x890 [ocfs2]
[203748.712227] [<
ffffffffa05f442e>] ? ocfs2_check_dir_for_entry+0x8e/0x140 [ocfs2]
[203748.712737] [<
ffffffffa061b2f2>] ocfs2_mknod+0x4b2/0x1370 [ocfs2]
[203748.713003] [<
ffffffffa061c385>] ocfs2_create+0x65/0x170 [ocfs2]
[203748.713263] [<
ffffffff8121714b>] vfs_create+0xdb/0x150
[203748.713518] [<
ffffffff8121b225>] do_last+0x815/0x1210
[203748.713772] [<
ffffffff812192e9>] ? path_init+0xb9/0x450
[203748.714123] [<
ffffffff8121bca0>] path_openat+0x80/0x600
[203748.714378] [<
ffffffff811bcd45>] ? handle_pte_fault+0xd15/0x1620
[203748.714634] [<
ffffffff8121d7ba>] do_filp_open+0x3a/0xb0
[203748.714888] [<
ffffffff8122a767>] ? __alloc_fd+0xa7/0x130
[203748.715143] [<
ffffffff81209ffc>] do_sys_open+0x12c/0x220
[203748.715403] [<
ffffffff81026ddb>] ? syscall_trace_enter_phase1+0x11b/0x180
[203748.715668] [<
ffffffff816f0c9f>] ? system_call_after_swapgs+0xe9/0x190
[203748.715928] [<
ffffffff8120a10e>] SyS_open+0x1e/0x20
[203748.716184] [<
ffffffff816f0d5e>] system_call_fastpath+0x18/0xd7
[203748.716440] Code: 00 00 48 8b 7b 08 48 83 c3 10 45 89 f8 44 89 e1 44 89 f2 4c 89 ee e8 07 06 11 e1 48 8b 03 48 85 c0 75 df 8b 5d c8 e9 4d fa ff ff <0f> 0b 48 8b 7d a0 e8 dc c6 06 00 48 b8 00 00 00 00 00 00 00 10
[203748.717505] RIP [<
ffffffffa05e9f09>] ocfs2_read_blocks+0x669/0x7f0 [ocfs2]
[203748.717775] RSP <
ffff88006ff4b818>
Joesph ever reported a similar panic.
Link: https://oss.oracle.com/pipermail/ocfs2-devel/2013-May/008931.html
Link: http://lkml.kernel.org/r/20180912063207.29484-1-junxiao.bi@oracle.com
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Joseph Qi <jiangqi903@gmail.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Changwei Ge <ge.changwei@h3c.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Vincent Pelletier [Sun, 9 Sep 2018 04:09:26 +0000 (04:09 +0000)]
scsi: target: iscsi: Use hex2bin instead of a re-implementation
commit
1816494330a83f2a064499d8ed2797045641f92c upstream.
This change has the following effects, in order of descreasing importance:
1) Prevent a stack buffer overflow
2) Do not append an unnecessary NULL to an anyway binary buffer, which
is writing one byte past client_digest when caller is:
chap_string_to_hex(client_digest, chap_r, strlen(chap_r));
The latter was found by KASAN (see below) when input value hes expected size
(32 hex chars), and further analysis revealed a stack buffer overflow can
happen when network-received value is longer, allowing an unauthenticated
remote attacker to smash up to 17 bytes after destination buffer (16 bytes
attacker-controlled and one null). As switching to hex2bin requires
specifying destination buffer length, and does not internally append any null,
it solves both issues.
This addresses CVE-2018-14633.
Beyond this:
- Validate received value length and check hex2bin accepted the input, to log
this rejection reason instead of just failing authentication.
- Only log received CHAP_R and CHAP_C values once they passed sanity checks.
==================================================================
BUG: KASAN: stack-out-of-bounds in chap_string_to_hex+0x32/0x60 [iscsi_target_mod]
Write of size 1 at addr
ffff8801090ef7c8 by task kworker/0:0/1021
CPU: 0 PID: 1021 Comm: kworker/0:0 Tainted: G O 4.17.8kasan.sess.connops+ #2
Hardware name: To be filled by O.E.M. To be filled by O.E.M./Aptio CRB, BIOS 5.6.5 05/19/2014
Workqueue: events iscsi_target_do_login_rx [iscsi_target_mod]
Call Trace:
dump_stack+0x71/0xac
print_address_description+0x65/0x22e
? chap_string_to_hex+0x32/0x60 [iscsi_target_mod]
kasan_report.cold.6+0x241/0x2fd
chap_string_to_hex+0x32/0x60 [iscsi_target_mod]
chap_server_compute_md5.isra.2+0x2cb/0x860 [iscsi_target_mod]
? chap_binaryhex_to_asciihex.constprop.5+0x50/0x50 [iscsi_target_mod]
? ftrace_caller_op_ptr+0xe/0xe
? __orc_find+0x6f/0xc0
? unwind_next_frame+0x231/0x850
? kthread+0x1a0/0x1c0
? ret_from_fork+0x35/0x40
? ret_from_fork+0x35/0x40
? iscsi_target_do_login_rx+0x3bc/0x4c0 [iscsi_target_mod]
? deref_stack_reg+0xd0/0xd0
? iscsi_target_do_login_rx+0x3bc/0x4c0 [iscsi_target_mod]
? is_module_text_address+0xa/0x11
? kernel_text_address+0x4c/0x110
? __save_stack_trace+0x82/0x100
? ret_from_fork+0x35/0x40
? save_stack+0x8c/0xb0
? 0xffffffffc1660000
? iscsi_target_do_login+0x155/0x8d0 [iscsi_target_mod]
? iscsi_target_do_login_rx+0x3bc/0x4c0 [iscsi_target_mod]
? process_one_work+0x35c/0x640
? worker_thread+0x66/0x5d0
? kthread+0x1a0/0x1c0
? ret_from_fork+0x35/0x40
? iscsi_update_param_value+0x80/0x80 [iscsi_target_mod]
? iscsit_release_cmd+0x170/0x170 [iscsi_target_mod]
chap_main_loop+0x172/0x570 [iscsi_target_mod]
? chap_server_compute_md5.isra.2+0x860/0x860 [iscsi_target_mod]
? rx_data+0xd6/0x120 [iscsi_target_mod]
? iscsit_print_session_params+0xd0/0xd0 [iscsi_target_mod]
? cyc2ns_read_begin.part.2+0x90/0x90
? _raw_spin_lock_irqsave+0x25/0x50
? memcmp+0x45/0x70
iscsi_target_do_login+0x875/0x8d0 [iscsi_target_mod]
? iscsi_target_check_first_request.isra.5+0x1a0/0x1a0 [iscsi_target_mod]
? del_timer+0xe0/0xe0
? memset+0x1f/0x40
? flush_sigqueue+0x29/0xd0
iscsi_target_do_login_rx+0x3bc/0x4c0 [iscsi_target_mod]
? iscsi_target_nego_release+0x80/0x80 [iscsi_target_mod]
? iscsi_target_restore_sock_callbacks+0x130/0x130 [iscsi_target_mod]
process_one_work+0x35c/0x640
worker_thread+0x66/0x5d0
? flush_rcu_work+0x40/0x40
kthread+0x1a0/0x1c0
? kthread_bind+0x30/0x30
ret_from_fork+0x35/0x40
The buggy address belongs to the page:
page:
ffffea0004243bc0 count:0 mapcount:0 mapping:
0000000000000000 index:0x0
flags: 0x17fffc000000000()
raw:
017fffc000000000 0000000000000000 0000000000000000 00000000ffffffff
raw:
ffffea0004243c20 ffffea0004243ba0 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8801090ef680: f2 f2 f2 f2 f2 f2 f2 01 f2 f2 f2 f2 f2 f2 f2 00
ffff8801090ef700: f2 f2 f2 f2 f2 f2 f2 00 02 f2 f2 f2 f2 f2 f2 00
>
ffff8801090ef780: 00 f2 f2 f2 f2 f2 f2 00 00 f2 f2 f2 f2 f2 f2 00
^
ffff8801090ef800: 00 f2 f2 f2 f2 f2 f2 00 00 00 00 02 f2 f2 f2 f2
ffff8801090ef880: f2 f2 f2 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00
==================================================================
Signed-off-by: Vincent Pelletier <plr.vincent@gmail.com>
Reviewed-by: Mike Christie <mchristi@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Vasily Khoruzhick [Thu, 13 Sep 2018 18:12:03 +0000 (11:12 -0700)]
neighbour: confirm neigh entries when ARP packet is received
[ Upstream commit
f0e0d04413fcce9bc76388839099aee93cd0d33b ]
Update 'confirmed' timestamp when ARP packet is received. It shouldn't
affect locktime logic and anyway entry can be confirmed by any higher-layer
protocol. Thus it makes sense to confirm it when ARP packet is received.
Fixes:
77d7123342dc ("neighbour: update neigh timestamps iff update is effective")
Signed-off-by: Vasily Khoruzhick <vasilykh@arista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Colin Ian King [Fri, 14 Sep 2018 16:39:53 +0000 (17:39 +0100)]
net: hp100: fix always-true check for link up state
[ Upstream commit
a7f38002fb69b44f8fc622ecb838665d0b8666af ]
The operation ~(p100_inb(VG_LAN_CFG_1) & HP100_LINK_UP) returns a value
that is always non-zero and hence the wait for the link to drop always
terminates prematurely. Fix this by using a logical not operator instead
of a bitwise complement. This issue has been in the driver since
pre-2.6.12-rc2.
Detected by CoverityScan, CID#114157 ("Logical vs. bitwise operator")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Willy Tarreau [Wed, 12 Sep 2018 05:36:35 +0000 (07:36 +0200)]
net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT
[ Upstream commit
9824dfae5741275473a23a7ed5756c7b6efacc9d ]
Fields ->dev and ->next of struct ipddp_route may be copied to
userspace on the SIOCFINDIPDDPRT ioctl. This is only accessible
to CAP_NET_ADMIN though. Let's manually copy the relevant fields
instead of using memcpy().
BugLink: http://blog.infosectcbr.com.au/2018/09/linux-kernel-infoleaks.html
Cc: Jann Horn <jannh@google.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Eric Dumazet [Fri, 14 Sep 2018 19:02:31 +0000 (12:02 -0700)]
ipv6: fix possible use-after-free in ip6_xmit()
[ Upstream commit
bbd6528d28c1b8e80832b3b018ec402b6f5c3215 ]
In the unlikely case ip6_xmit() has to call skb_realloc_headroom(),
we need to call skb_set_owner_w() before consuming original skb,
otherwise we risk a use-after-free.
Bring IPv6 in line with what we do in IPv4 to fix this.
Fixes:
1da177e4c3f41 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>