OSDN Git Service
Linux Build Service Account [Tue, 11 Sep 2018 16:46:30 +0000 (09:46 -0700)]
Merge "ARM: dts: msm: Add support for complete subsystem ramdump for SDM660"
Linux Build Service Account [Tue, 11 Sep 2018 16:46:29 +0000 (09:46 -0700)]
Merge "aio: hold an extra file reference over AIO read/write operations"
Naitik Bharadiya [Mon, 10 Sep 2018 11:41:55 +0000 (17:11 +0530)]
ARM: dts: msm: Add support for complete subsystem ramdump for SDM660
Add support to dump complete ramdump of subsystem from start of first
segment to end of last segment without leaving any hole in between.
Change-Id: I0bcab1d4e04748d3934b7a4d99eec59727c3afb1
Signed-off-by: Naitik Bharadiya <bharad@codeaurora.org>
Linux Build Service Account [Tue, 11 Sep 2018 09:04:20 +0000 (02:04 -0700)]
Merge "mdio: Add support for mdio drivers."
Linux Build Service Account [Tue, 11 Sep 2018 09:04:19 +0000 (02:04 -0700)]
Merge "drm/msm-hyp: expand display type enumeration"
Hardik Arya [Wed, 8 Aug 2018 04:58:34 +0000 (10:28 +0530)]
soc: qcom: glink_spi_xprt: Validate fifo read index of remote side
Since message received from spi cannot be trusted there is possibility
of out-of-bound read if received read_id is not in range of fifo.
The patch validate rx_fifo_read index of edge info for remote side.
Change-Id: I3d3fa749935f477e5f98f986adc24e6e6a682d4d
Signed-off-by: Hardik Arya <harya@codeaurora.org>
Camus Wong [Mon, 27 Aug 2018 21:09:48 +0000 (17:09 -0400)]
drm/msm-hyp: expand display type enumeration
Expand display type/id enumeration up to eight types.
Change-Id: I19c47e6b4aa57dc94020f909260e1de2218ca82d
Signed-off-by: Camus Wong <camusw@codeaurora.org>
Andrew Lunn [Wed, 6 Jan 2016 19:11:26 +0000 (20:11 +0100)]
mdio: Add support for mdio drivers.
Not all devices on an MDIO bus are PHYs. Meaning not all MDIO drivers
are PHY drivers. Add support for generic MDIO drivers.
Change-Id: I65c7c8a497bbac9ef67b3d21c869818a09378e3c
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-Commit:
a9049e0c513c4521dbfaa302af8ed08b3366b41f
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Anthony Mah <amah@codeaurora.org>
Christoph Hellwig [Sun, 30 Oct 2016 16:42:01 +0000 (11:42 -0500)]
aio: hold an extra file reference over AIO read/write operations
Otherwise we might dereference an already freed file and/or inode
when aio_complete is called before we return from the read_iter or
write_iter method.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
(cherry picked from commit
0b944d3a4bba6b25f43aed530f4fa85c04d162a6)
Change-Id: I628a87b5036ba1ba5ba5152fa0329d02999d3649
Git-Commit:
0b944d3a4bba6b25f43aed530f4fa85c04d162a6
Git-Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
[riteshh@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Ritesh Harjani <riteshh@codeaurora.org>
Linux Build Service Account [Mon, 10 Sep 2018 05:08:35 +0000 (22:08 -0700)]
Merge "Revert "msm: adsprpc: DSP device node to provide restricted access to ADSP/SLPI""
Linux Build Service Account [Sun, 9 Sep 2018 06:45:06 +0000 (23:45 -0700)]
Merge "clk: msm: add uninterruptible flag in hab receiving for virtual reset."
Linux Build Service Account [Sun, 9 Sep 2018 06:45:04 +0000 (23:45 -0700)]
Merge "ARM: dts: msm: Invert polarity of PMD_MPP_08 for msm8996 CV2X"
Linux Build Service Account [Sat, 8 Sep 2018 19:33:58 +0000 (12:33 -0700)]
Merge "USB: pd: Notify selfpowered state based on type C current"
Linux Build Service Account [Fri, 7 Sep 2018 17:15:55 +0000 (10:15 -0700)]
Merge "kthread/smpboot: Serialize kthread parking against wakeup"
Linux Build Service Account [Fri, 7 Sep 2018 17:15:44 +0000 (10:15 -0700)]
Merge "f_qc_rndis: Call rndis_ipa_init() from rndis_qc_bind()"
Linux Build Service Account [Fri, 7 Sep 2018 17:15:43 +0000 (10:15 -0700)]
Merge "mm: Kconfig: Add support for config size of purging vmap_area"
Gaurav Kohli [Tue, 24 Apr 2018 06:43:34 +0000 (12:13 +0530)]
kthread/smpboot: Serialize kthread parking against wakeup
The control cpu thread which initiates hotplug calls kthread_park()
for hotplug thread and sets KTHREAD_SHOULD_PARK. After this control
thread wakes up the hotplug thread. There is a chance that wakeup
code sees the hotplug thread (running on AP core) in INTERRUPTIBLE
state, but sets its state to RUNNING after hotplug thread has entered
kthread_parkme() and changed its state to TASK_PARKED. This can result
in panic later on in kthread_unpark(), as it sees KTHREAD_IS_PARKED
flag set but fails to rebind the kthread, due to it being not in
TASK_PARKED state. Fix this, by serializing wakeup state change,
against state change before parking the kthread.
Below is the possible race:
Control thread Hotplug Thread
kthread_park()
set KTHREAD_SHOULD_PARK
smpboot_thread_fn
set_current_state(TASK_INTERRUPTIBLE);
kthread_parkme
wake_up_process()
raw_spin_lock_irqsave(&p->pi_lock, flags);
if (!(p->state & state)) -> this will fail
goto out;
__kthread_parkme
__set_current_state(TASK_PARKED);
if (p->on_rq && ttwu_remote(p, wake_flags))
ttwu_remote()
p->state = TASK_RUNNING;
schedule();
So to avoid this race, take pi_lock to serial state changes.
Change-Id: Ie71645d37046f7ee74df880dbead29efbaad199a
Suggested-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>
Signed-off-by: Gaurav Kohli <gkohli@codeaurora.org>
Zhiqiang Tu [Fri, 7 Sep 2018 07:38:17 +0000 (15:38 +0800)]
clk: msm: add uninterruptible flag in hab receiving for virtual reset.
Add uninterruptible flag in hab receiving for virtual reset controller
to avoid being interrupted by signal.
Change-Id: Iddca4134eec082537110bd7735e0e282cd5c7454
Signed-off-by: Zhiqiang Tu <ztu@codeaurora.org>
Vijayavardhan Vennapusa [Tue, 28 Aug 2018 07:10:30 +0000 (12:40 +0530)]
f_qc_rndis: Call rndis_ipa_init() from rndis_qc_bind()
During composition switch, current driver ends up calling
rndis_ipa_cleanup twice without calling rndis_ipa_init() in between.
This could cause spinbug in IPA driver due to uninitialized spin lock.
Hence fix the issue by moving rndis_ipa_init() to bind() callback and
calling rndis_ipa_cleanup() in unbind() callback.
Change-Id: I1be18de9137ba61cf0f004c7edeac54235617d33
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Zhenhua Huang [Thu, 21 Jun 2018 04:54:40 +0000 (12:54 +0800)]
mm: Kconfig: Add support for config size of purging vmap_area
This size is the maximum amount of virtual address space we gather
up before attempting to purge with a TLB flush. It is 128M in most cases.
With repeated and high size vmalloc operations, it may easily generate
more fragments. This is wasting limited vmalloc area, for 32bits.
So make it configable and the default multiplier as 8, 32bits only.
Change-Id: I68a75acb16d3cff05f8b13c05ae78922269e219f
Signed-off-by: Zhenhua Huang <zhenhuah@codeaurora.org>
Aditya Mathur [Thu, 6 Sep 2018 23:46:27 +0000 (16:46 -0700)]
ARM: dts: msm: Invert polarity of PMD_MPP_08 for msm8996 CV2X
Invert the polarity of PMD_MPP_08 on msm8996 CV2X
to properly power on and off the external
modem as required.
Change-Id: I56226f4d14a2e21331bacf0a7125dc06bfd91aac
Signed-off-by: Aditya Mathur <aditmath@codeaurora.org>
Linux Build Service Account [Thu, 6 Sep 2018 21:14:26 +0000 (14:14 -0700)]
Merge "drm/msm/hdmi: add rgb flag for HDMI customized mode"
Linux Build Service Account [Thu, 6 Sep 2018 21:14:25 +0000 (14:14 -0700)]
Merge "Merge android-4.4.153 (
5e24b4e) into msm-4.4"
Linux Build Service Account [Thu, 6 Sep 2018 14:25:59 +0000 (07:25 -0700)]
Merge "printk: Make the console flush configurable in hotplug path"
Linux Build Service Account [Thu, 6 Sep 2018 14:25:58 +0000 (07:25 -0700)]
Merge "adv7481: Modify EDID array to support 1080p60Hz"
Linux Build Service Account [Thu, 6 Sep 2018 14:25:57 +0000 (07:25 -0700)]
Merge "audio: qdsp6v2: check EINTR when retry for habmm_socket_recv"
Linux Build Service Account [Thu, 6 Sep 2018 14:25:56 +0000 (07:25 -0700)]
Merge "cnss: comment cnss_msm_pcie_pm_control at GreenHills platform"
Mohammed Khajapasha [Fri, 4 Sep 2015 15:03:31 +0000 (20:33 +0530)]
printk: Make the console flush configurable in hotplug path
The thread which initiates the hot plug can get scheduled
out, while trying to acquire the console lock,
thus increasing the hot plug latency. This option
allows to selectively disable the console flush and
in turn reduce the hot plug latency.
Change-Id: I42507804d321b29b7761146a6c175d959bf79925
Signed-off-by: Mohammed Khajapasha <mkhaja@codeaurora.org>
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>
Linux Build Service Account [Thu, 6 Sep 2018 05:13:30 +0000 (22:13 -0700)]
Merge "soc: qcom: subsystem_notif_virt: Fix error condition check"
Linux Build Service Account [Thu, 6 Sep 2018 05:13:23 +0000 (22:13 -0700)]
Merge "msm: mdss: Fix Gamma LUT bounds condition"
Suprith Malligere Shankaregowda [Fri, 31 Aug 2018 13:52:30 +0000 (19:22 +0530)]
adv7481: Modify EDID array to support 1080p60Hz
1080p60Hz HDMI_OUT(PC) not displayed in TIF due to wrong clock value,
So increasing clock value to 148.5MHz in Detailed Timing Descriptor
And reorder video data block to support 1080p60Hz.
Change-Id: I91ffc02f97c9b4fa5362444382af1b91af9c03b6
Signed-off-by: Suprith Malligere Shankaregowda <supgow@codeaurora.org>
Tony Han [Wed, 5 Sep 2018 11:28:10 +0000 (19:28 +0800)]
audio: qdsp6v2: check EINTR when retry for habmm_socket_recv
HAB returns -EINTR instead of -EAGAIN to request a retry from the
habmm_socket_recv() call.
Change-Id: I61bcef5c11048a3947b8079d1591937d7b83602a
Signed-off-by: Tony Han <xiahan@codeaurora.org>
Yunyun Cao [Thu, 6 Sep 2018 03:37:11 +0000 (11:37 +0800)]
drm/msm/hdmi: add rgb flag for HDMI customized mode
Add rgb flag to make sure HDMI customized mode pass
the format check.
Change-Id: I2d1df731bef493e15f83dac569673589e2408c68
Signed-off-by: Yunyun Cao <yunyunc@codeaurora.org>
Gerrit - the friendly Code Review server [Wed, 5 Sep 2018 18:56:52 +0000 (11:56 -0700)]
Merge changes into msm-4.4
Anant Goel [Tue, 4 Sep 2018 21:42:20 +0000 (14:42 -0700)]
soc: qcom: subsystem_notif_virt: Fix error condition check
An error check casts an integer to a pointer. Fix the error
check so that the integer is not casted to a pointer.
Change-Id: Ib15634745cc2243e4fe54557d6670956d8349e93
Signed-off-by: Anant Goel <anantg@codeaurora.org>
Linux Build Service Account [Wed, 5 Sep 2018 11:32:32 +0000 (04:32 -0700)]
Merge "nl80211: nl80211_update_ft_ies to validate NL80211_ATTR_IE"
Vijayavardhan Vennapusa [Tue, 28 Aug 2018 05:36:16 +0000 (11:06 +0530)]
USB: pd: Notify selfpowered state based on type C current
It is required to notify device as selfpowered and bmaxpower as zero
even for non PD capable devices based on Type C current. Hence notify
as selfpowerer in bMattributes of configuation descriptor in case of
medium or high Type C current.
Change-Id: Ie552560d93a8195f4c69fdaf6086ef3a52b31d39
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Arunk Khandavalli [Wed, 5 Sep 2018 07:11:22 +0000 (12:41 +0530)]
nl80211: nl80211_update_ft_ies to validate NL80211_ATTR_IE
Current nl80211_update_ft_ies doesn't validate NL80211_ATTR_IE
before dereferencing it, which leads to a null pointer exception
if not passed.
This commit validates this attribute too.
Change-Id: Ia40b02fc218bc26a07bc6b2153f425b8cae3bd82
CRs-Fixed:
2261685
Signed-off-by: Arunk Khandavalli <akhandav@codeaurora.org>
Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
Linux Build Service Account [Wed, 5 Sep 2018 04:18:58 +0000 (21:18 -0700)]
Merge "net: Include additional rmnet header in flow_dissector"
Chaoli Zhou [Fri, 31 Aug 2018 06:05:26 +0000 (14:05 +0800)]
cnss: comment cnss_msm_pcie_pm_control at GreenHills platform
It doesn't support virtualized clock currently,
so we cannot disable/enable clock while do PCIE link
suspend/resume from Linux side at Greenhills platform,
so comment the API cnss_msm_pcie_pm_control to prevent
doing PCIE link suspend/resume.
Change-Id: Ie10d781042ff3e85b3206fd300e9ec3f71897479
Signed-off-by: Chaoli Zhou <zchaoli@codeaurora.org>
Gustavo Solaira [Fri, 24 Aug 2018 22:03:55 +0000 (15:03 -0700)]
net: Include additional rmnet header in flow_dissector
Add an additional header in flow_dissector since it
provides some structs that are needed for it.
Change-Id: I654ce9838f704c71b5c5015ef30d88a01a528f0b
Signed-off-by: Gustavo Solaira <gustavos@codeaurora.org>
Gustavo Solaira [Fri, 24 Aug 2018 22:02:24 +0000 (15:02 -0700)]
diag: Only include MHI headers if it is enabled
Only include the MHI header file if CONFIG_MSM_MHI
is enabled, avoid compilation errors if the platform
does not support MHI.
Change-Id: Ic2d84a8bbd066d0d8e50711a7499ae9a959a0b71
Signed-off-by: Gustavo Solaira <gustavos@codeaurora.org>
Linux Build Service Account [Tue, 4 Sep 2018 18:41:12 +0000 (11:41 -0700)]
Merge "asoc : msm: Fix zero size pointer issue"
Linux Build Service Account [Tue, 4 Sep 2018 18:41:11 +0000 (11:41 -0700)]
Merge "net: hns: Fix a skb used after free bug"
Soumya Managoli [Tue, 31 Jul 2018 13:08:29 +0000 (18:38 +0530)]
asoc : msm: Fix zero size pointer issue
APPS crashes randomly due to invalid memory allocation
in q6asm_audio_client_buf_free_contiguous.
Added check to return error if memory allocation size is 0.
Change-Id: I40f49aa147d513b29b56224a5ee77ccbb2dcc110
CRs-Fixed:
2285272
Signed-off-by: Soumya Managoli <smanag@codeaurora.org>
Yunsheng Lin [Thu, 6 Jul 2017 02:22:00 +0000 (10:22 +0800)]
net: hns: Fix a skb used after free bug
skb maybe freed in hns_nic_net_xmit_hw() and return NETDEV_TX_OK,
which cause hns_nic_net_xmit to use a freed skb.
BUG: KASAN: use-after-free in hns_nic_net_xmit_hw+0x62c/0x940...
[17659.112635] alloc_debug_processing+0x18c/0x1a0
[17659.117208] __slab_alloc+0x52c/0x560
[17659.120909] kmem_cache_alloc_node+0xac/0x2c0
[17659.125309] __alloc_skb+0x6c/0x260
[17659.128837] tcp_send_ack+0x8c/0x280
[17659.132449] __tcp_ack_snd_check+0x9c/0xf0
[17659.136587] tcp_rcv_established+0x5a4/0xa70
[17659.140899] tcp_v4_do_rcv+0x27c/0x620
[17659.144687] tcp_prequeue_process+0x108/0x170
[17659.149085] tcp_recvmsg+0x940/0x1020
[17659.152787] inet_recvmsg+0x124/0x180
[17659.156488] sock_recvmsg+0x64/0x80
[17659.160012] SyS_recvfrom+0xd8/0x180
[17659.163626] __sys_trace_return+0x0/0x4
[17659.167506] INFO: Freed in kfree_skbmem+0xa0/0xb0 age=23 cpu=1 pid=13
[17659.174000] free_debug_processing+0x1d4/0x2c0
[17659.178486] __slab_free+0x240/0x390
[17659.182100] kmem_cache_free+0x24c/0x270
[17659.186062] kfree_skbmem+0xa0/0xb0
[17659.189587] __kfree_skb+0x28/0x40
[17659.193025] napi_gro_receive+0x168/0x1c0
[17659.197074] hns_nic_rx_up_pro+0x58/0x90
[17659.201038] hns_nic_rx_poll_one+0x518/0xbc0
[17659.205352] hns_nic_common_poll+0x94/0x140
[17659.209576] net_rx_action+0x458/0x5e0
[17659.213363] __do_softirq+0x1b8/0x480
[17659.217062] run_ksoftirqd+0x64/0x80
[17659.220679] smpboot_thread_fn+0x224/0x310
[17659.224821] kthread+0x150/0x170
[17659.228084] ret_from_fork+0x10/0x40
BUG: KASAN: use-after-free in hns_nic_net_xmit+0x8c/0xc0...
[17751.080490] __slab_alloc+0x52c/0x560
[17751.084188] kmem_cache_alloc+0x244/0x280
[17751.088238] __build_skb+0x40/0x150
[17751.091764] build_skb+0x28/0x100
[17751.095115] __alloc_rx_skb+0x94/0x150
[17751.098900] __napi_alloc_skb+0x34/0x90
[17751.102776] hns_nic_rx_poll_one+0x180/0xbc0
[17751.107097] hns_nic_common_poll+0x94/0x140
[17751.111333] net_rx_action+0x458/0x5e0
[17751.115123] __do_softirq+0x1b8/0x480
[17751.118823] run_ksoftirqd+0x64/0x80
[17751.122437] smpboot_thread_fn+0x224/0x310
[17751.126575] kthread+0x150/0x170
[17751.129838] ret_from_fork+0x10/0x40
[17751.133454] INFO: Freed in kfree_skbmem+0xa0/0xb0 age=19 cpu=7 pid=43
[17751.139951] free_debug_processing+0x1d4/0x2c0
[17751.144436] __slab_free+0x240/0x390
[17751.148051] kmem_cache_free+0x24c/0x270
[17751.152014] kfree_skbmem+0xa0/0xb0
[17751.155543] __kfree_skb+0x28/0x40
[17751.159022] napi_gro_receive+0x168/0x1c0
[17751.163074] hns_nic_rx_up_pro+0x58/0x90
[17751.167041] hns_nic_rx_poll_one+0x518/0xbc0
[17751.171358] hns_nic_common_poll+0x94/0x140
[17751.175585] net_rx_action+0x458/0x5e0
[17751.179373] __do_softirq+0x1b8/0x480
[17751.183076] run_ksoftirqd+0x64/0x80
[17751.186691] smpboot_thread_fn+0x224/0x310
[17751.190826] kthread+0x150/0x170
[17751.194093] ret_from_fork+0x10/0x40
Change-Id: I5fbdea5d0264c79dbcc91f8519cda1004b667866
Fixes:
13ac695e7ea1 ("net:hns: Add support of Hip06 SoC to the Hislicon Network Subsystem")
Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: lipeng <lipeng321@huawei.com>
Reported-by: Jun He <hjat2005@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Git-commit:
27463ad99f738ed93c7c8b3e2e5bc8c4853a2ff2
Signed-off-by: Dennis Cagle <dcagle@codeaurora.org>
Acked-By: Chinmay Agarwal <chinagar@qti.qualcomm.com>
[ tejaswit@codeaurora.org : resolved minor conflicts ]
Signed-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>
Akhil P Oommen [Fri, 6 Jul 2018 09:56:11 +0000 (15:26 +0530)]
msm: kgsl: Replace scm call api with its atomic version
scm_call2() API can block indefinitely if another client is using
this API. This is due to a mutex in this API to serialize calls to
the TZ. This blocks the GPU wake up which in turn can result in
kgsl fence timeouts. Since CPZ register programing is handled at
the hypervisor, we can safely avoid this serialization by using
scm_call2_atomic() API which doesn't block.
Change-Id: I48ba3e1a682e1027463a1c6b067e6cfcb4a0e8bc
Signed-off-by: Akhil P Oommen <akhilpo@codeaurora.org>
Ch Ganesh Kumar [Mon, 20 Aug 2018 08:05:37 +0000 (13:35 +0530)]
msm: mdss: Fix Gamma LUT bounds condition
Validate the Gamma correction feature with all bound condition.
This change corrects the Gamma LUT block bound condition.
Change-Id: I3fc460b6a6e2e76f7c07b649e1db1e01ce208476
Signed-off-by: Ch Ganesh Kumar <chganesh@codeaurora.org>
Linux Build Service Account [Mon, 3 Sep 2018 01:27:50 +0000 (18:27 -0700)]
Merge "ARM: dts: msm: Add 8GB DDR device tree for msm8996 ivi vplatform"
Linux Build Service Account [Sat, 1 Sep 2018 23:12:40 +0000 (16:12 -0700)]
Merge "drm: Pass CRTC ID in userspace vblank events"
Linux Build Service Account [Sat, 1 Sep 2018 23:12:37 +0000 (16:12 -0700)]
Merge "cnss: Use the nosync API in cnss when disabling irq"
Linux Build Service Account [Sat, 1 Sep 2018 23:12:34 +0000 (16:12 -0700)]
Merge "diag: Add protection before accessing md_session_map"
Linux Build Service Account [Sat, 1 Sep 2018 04:18:41 +0000 (21:18 -0700)]
Merge "drm: msm: sde: Fix SMMU fault during DRM test"
Linux Build Service Account [Fri, 31 Aug 2018 19:34:15 +0000 (12:34 -0700)]
Merge "Merge android-4.4.150 (
5541782) into msm-4.4"
Linux Build Service Account [Thu, 30 Aug 2018 20:05:57 +0000 (13:05 -0700)]
Merge "icnss: Add a flag to indicare FW rejuvenate"
Linux Build Service Account [Thu, 30 Aug 2018 20:05:56 +0000 (13:05 -0700)]
Merge "msm:ais:Handling bigger value than upper bound in msm_cpp_irq api"
Linux Build Service Account [Thu, 30 Aug 2018 20:05:55 +0000 (13:05 -0700)]
Merge "USB: core: only clean up what we allocated"
Anurag Chouhan [Thu, 30 Aug 2018 08:59:14 +0000 (14:29 +0530)]
icnss: Add a flag to indicare FW rejuvenate
Add a flag to maintain fw rejuvenate state,
set if fw rejuvenate happens and reset at fw ready.
export an API to the wlan host driver to distinguish the
case of ssr or pdr with the FW rejuventae.
Change-Id: I7a01cc4996f68f78aa13eacf36648331a701882a
Signed-off-by: Anurag Chouhan <achouhan@codeaurora.org>
Linux Build Service Account [Thu, 30 Aug 2018 09:20:54 +0000 (02:20 -0700)]
Merge "Revert "power: wakeup_reason: send uevent to user space""
Zhiqiang Tu [Tue, 21 Aug 2018 06:23:58 +0000 (14:23 +0800)]
ARM: dts: msm: Add 8GB DDR device tree for msm8996 ivi vplatform
Add a new device tree to support 8GB DDR target for msm8996 IVI
virtual platform.
Change-Id: Ia3be942de1c3064aecc59560743849335e8ff60d
Signed-off-by: Anant Goel <anantg@codeaurora.org>
Signed-off-by: Zhiqiang Tu <ztu@codeaurora.org>
Linux Build Service Account [Thu, 30 Aug 2018 00:20:36 +0000 (17:20 -0700)]
Merge "msm: ipa3: Add mutex to prevent race condition"
Linux Build Service Account [Thu, 30 Aug 2018 00:20:35 +0000 (17:20 -0700)]
Merge "msm:ipa: Prevent NAT table deletion only if public ip is not assigned"
Mohammed Javid [Fri, 8 Jun 2018 11:25:32 +0000 (16:55 +0530)]
msm: ipa3: Add mutex to prevent race condition
There is a race condition between ipa3_nat_init_cmd
and ipa_read_nat4. The two thread will R/W the critical
global variables. This will result in race conditions
and possibly buffer overread/ overwrite issues. Add code
to prevent this race condition.
Change-Id: I6bf9a837ae941cf3ad9413da6e44821916acf196
Acked-by: Pooja Kumari <kumarip@qti.qualcomm.com>
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>
Linux Build Service Account [Wed, 29 Aug 2018 04:19:00 +0000 (21:19 -0700)]
Merge "defconfig : Enable Hibernation support for msm8996AU."
Atul Raut [Mon, 2 Apr 2018 23:25:42 +0000 (16:25 -0700)]
defconfig : Enable Hibernation support for msm8996AU.
Add support to Hibernation for msm8996AU based auto
platform.
Change-Id: I6db195dbf33a146c01b3d097ef9b34cb11019f60
Signed-off-by: Atul Raut <araut@codeaurora.org>
Linux Build Service Account [Tue, 28 Aug 2018 19:48:51 +0000 (12:48 -0700)]
Merge "diag: Update msg mask's ranges properly"
Linux Build Service Account [Tue, 28 Aug 2018 19:48:50 +0000 (12:48 -0700)]
Merge "msm: ipa: Validate routing rule id"
Mohammed Javid [Mon, 27 Aug 2018 10:02:35 +0000 (15:32 +0530)]
msm:ipa: Prevent NAT table deletion only if public ip is not assigned
Currnetly NAT table is not deleted even if public ip is assigned to
NAT table. Add check to prevent deletion only if public ip is not assigned.
Change-Id: I4855b21472d3f6bf541d07733b18592e9e677ce6
Acked-by: Pooja Kumari <kumarip@qti.qualcomm.com>
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>
Srinivasarao P [Tue, 28 Aug 2018 11:57:24 +0000 (17:27 +0530)]
Merge android-4.4.153 (
5e24b4e) into msm-4.4
* refs/heads/tmp-
5e24b4e
Linux 4.4.153
ovl: warn instead of error if d_type is not supported
ovl: Do d_type check only if work dir creation was successful
ovl: Ensure upper filesystem supports d_type
x86/mm: Fix use-after-free of ldt_struct
x86/mm/pat: Fix L1TF stable backport for CPA
ANDROID: x86_64_cuttlefish_defconfig: Enable lz4 compression for zram
UPSTREAM: drivers/block/zram/zram_drv.c: fix bug storing backing_dev
BACKPORT: zram: introduce zram memory tracking
BACKPORT: zram: record accessed second
BACKPORT: zram: mark incompressible page as ZRAM_HUGE
UPSTREAM: zram: correct flag name of ZRAM_ACCESS
UPSTREAM: zram: Delete gendisk before cleaning up the request queue
UPSTREAM: drivers/block/zram/zram_drv.c: make zram_page_end_io() static
BACKPORT: zram: set BDI_CAP_STABLE_WRITES once
UPSTREAM: zram: fix null dereference of handle
UPSTREAM: zram: add config and doc file for writeback feature
BACKPORT: zram: read page from backing device
BACKPORT: zram: write incompressible pages to backing device
BACKPORT: zram: identify asynchronous IO's return value
BACKPORT: zram: add free space management in backing device
UPSTREAM: zram: add interface to specif backing device
UPSTREAM: zram: rename zram_decompress_page to __zram_bvec_read
UPSTREAM: zram: inline zram_compress
UPSTREAM: zram: clean up duplicated codes in __zram_bvec_write
Linux 4.4.152
reiserfs: fix broken xattr handling (heap corruption, bad retval)
i2c: imx: Fix race condition in dma read
PCI: pciehp: Fix use-after-free on unplug
PCI: Skip MPS logic for Virtual Functions (VFs)
PCI: hotplug: Don't leak pci_slot on registration failure
parisc: Remove unnecessary barriers from spinlock.h
bridge: Propagate vlan add failure to user
packet: refine ring v3 block size test to hold one frame
netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state
xfrm_user: prevent leaking 2 bytes of kernel memory
parisc: Remove ordered stores from syscall.S
ext4: fix spectre gadget in ext4_mb_regular_allocator()
KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer
staging: android: ion: check for kref overflow
tcp: identify cryptic messages as TCP seq # bugs
net: qca_spi: Fix log level if probe fails
net: qca_spi: Make sure the QCA7000 reset is triggered
net: qca_spi: Avoid packet drop during initial sync
net: usb: rtl8150: demote allmulti message to dev_dbg()
net/ethernet/freescale/fman: fix cross-build error
drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply()
tcp: remove DELAYED ACK events in DCTCP
qlogic: check kstrtoul() for errors
packet: reset network header if packet shorter than ll reserved space
ixgbe: Be more careful when modifying MAC filters
ARM: dts: am3517.dtsi: Disable reference to OMAP3 OTG controller
ARM: 8780/1: ftrace: Only set kernel memory back to read-only after boot
perf llvm-utils: Remove bashism from kernel include fetch script
bnxt_en: Fix for system hang if request_irq fails
drm/armada: fix colorkey mode property
ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem
ieee802154: at86rf230: use __func__ macro for debug messages
ieee802154: at86rf230: switch from BUG_ON() to WARN_ON() on problem
ARM: pxa: irq: fix handling of ICMR registers in suspend/resume
netfilter: x_tables: set module owner for icmp(6) matches
smsc75xx: Add workaround for gigabit link up hardware errata.
kasan: fix shadow_size calculation error in kasan_module_alloc
tracing: Use __printf markup to silence compiler
ARM: imx_v4_v5_defconfig: Select ULPI support
ARM: imx_v6_v7_defconfig: Select ULPI support
HID: wacom: Correct touch maximum XY of 2nd-gen Intuos
m68k: fix "bad page state" oops on ColdFire boot
bnx2x: Fix receiving tx-timeout in error or recovery state.
drm/exynos: decon5433: Fix WINCONx reset value
drm/exynos: decon5433: Fix per-plane global alpha for XRGB modes
drm/exynos: gsc: Fix support for NV16/61, YUV420/YVU420 and YUV422 modes
md/raid10: fix that replacement cannot complete recovery after reassemble
dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate()
ARM: dts: da850: Fix interrups property for gpio
selftests/x86/sigreturn/64: Fix spurious failures on AMD CPUs
perf report powerpc: Fix crash if callchain is empty
perf test session topology: Fix test on s390
usb: xhci: increase CRS timeout value
ARM: dts: am437x: make edt-ft5x06 a wakeup source
brcmfmac: stop watchdog before detach and free everything
cxgb4: when disabling dcb set txq dcb priority to 0
Smack: Mark inode instant in smack_task_to_inode
ipv6: mcast: fix unsolicited report interval after receiving querys
locking/lockdep: Do not record IRQ state within lockdep code
net: davinci_emac: match the mdio device against its compatible if possible
ARC: Enable machine_desc->init_per_cpu for !CONFIG_SMP
net: propagate dev_get_valid_name return code
net: hamradio: use eth_broadcast_addr
enic: initialize enic->rfs_h.lock in enic_probe
qed: Add sanity check for SIMD fastpath handler.
arm64: make secondary_start_kernel() notrace
scsi: xen-scsifront: add error handling for xenbus_printf
usb: gadget: dwc2: fix memory leak in gadget_init()
usb: gadget: composite: fix delayed_status race condition when set_interface
usb: dwc2: fix isoc split in transfer with no data
ARM: dts: Cygnus: Fix I2C controller interrupt type
selftests: sync: add config fragment for testing sync framework
selftests: zram: return Kselftest Skip code for skipped tests
selftests: user: return Kselftest Skip code for skipped tests
selftests: static_keys: return Kselftest Skip code for skipped tests
selftests: pstore: return Kselftest Skip code for skipped tests
netfilter: ipv6: nf_defrag: reduce struct net memory waste
ARC: Explicitly add -mmedium-calls to CFLAGS
ANDROID: x86_64_cuttlefish_defconfig: Enable zram and zstd
BACKPORT: crypto: zstd - Add zstd support
UPSTREAM: zram: add zstd to the supported algorithms list
UPSTREAM: lib: Add zstd modules
UPSTREAM: lib: Add xxhash module
UPSTREAM: zram: rework copy of compressor name in comp_algorithm_store()
UPSTREAM: zram: constify attribute_group structures.
UPSTREAM: zram: count same page write as page_stored
UPSTREAM: zram: reduce load operation in page_same_filled
UPSTREAM: zram: use zram_free_page instead of open-coded
UPSTREAM: zram: introduce zram data accessor
UPSTREAM: zram: remove zram_meta structure
UPSTREAM: zram: use zram_slot_lock instead of raw bit_spin_lock op
BACKPORT: zram: partial IO refactoring
BACKPORT: zram: handle multiple pages attached bio's bvec
UPSTREAM: zram: fix operator precedence to get offset
BACKPORT: zram: extend zero pages to same element pages
BACKPORT: zram: remove waitqueue for IO done
UPSTREAM: zram: remove obsolete sysfs attrs
UPSTREAM: zram: support BDI_CAP_STABLE_WRITES
UPSTREAM: zram: revalidate disk under init_lock
BACKPORT: mm: support anonymous stable page
UPSTREAM: zram: use __GFP_MOVABLE for memory allocation
UPSTREAM: zram: drop gfp_t from zcomp_strm_alloc()
UPSTREAM: zram: add more compression algorithms
UPSTREAM: zram: delete custom lzo/lz4
UPSTREAM: zram: cosmetic: cleanup documentation
UPSTREAM: zram: use crypto api to check alg availability
BACKPORT: zram: switch to crypto compress API
UPSTREAM: zram: rename zstrm find-release functions
UPSTREAM: zram: introduce per-device debug_stat sysfs node
UPSTREAM: zram: remove max_comp_streams internals
UPSTREAM: zram: user per-cpu compression streams
BACKPORT: zsmalloc: require GFP in zs_malloc()
UPSTREAM: zram/zcomp: do not zero out zcomp private pages
UPSTREAM: zram: pass gfp from zcomp frontend to backend
UPSTREAM: socket: close race condition between sock_close() and sockfs_setattr()
ANDROID: Refresh x86_64_cuttlefish_defconfig
Linux 4.4.151
isdn: Disable IIOCDBGVAR
Bluetooth: avoid killing an already killed socket
x86/mm: Simplify p[g4um]d_page() macros
serial: 8250_dw: always set baud rate in dw8250_set_termios
ACPI / PM: save NVS memory for ASUS 1025C laptop
ACPI: save NVS memory for Lenovo G50-45
USB: option: add support for DW5821e
USB: serial: sierra: fix potential deadlock at close
ALSA: vxpocket: Fix invalid endian conversions
ALSA: memalloc: Don't exceed over the requested size
ALSA: hda: Correct Asrock B85M-ITX power_save blacklist entry
ALSA: cs5535audio: Fix invalid endian conversion
ALSA: virmidi: Fix too long output trigger loop
ALSA: vx222: Fix invalid endian conversions
ALSA: hda - Turn CX8200 into D3 as well upon reboot
ALSA: hda - Sleep for 10ms after entering D3 on Conexant codecs
net_sched: fix NULL pointer dereference when delete tcindex filter
vsock: split dwork to avoid reinitializations
net_sched: Fix missing res info when create new tc_index filter
llc: use refcount_inc_not_zero() for llc_sap_find()
l2tp: use sk_dst_check() to avoid race on sk->sk_dst_cache
dccp: fix undefined behavior with 'cwnd' shift in ccid2_cwnd_restart()
Conflicts:
drivers/block/zram/zram_drv.c
drivers/staging/android/ion/ion.c
include/linux/swap.h
mm/zsmalloc.c
Change-Id: I1c437ac5133503a939d06d51ec778b65371df6d1
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Hardik Arya [Wed, 8 Aug 2018 09:16:20 +0000 (14:46 +0530)]
diag: Update msg mask's ranges properly
There is a possibility of out-of-bound read if msg mask
ranges received from peripheral are more than max ssid per
range. Cap msg mask's ssid ranges to MAX_SSID_PER_RANGE if
ranges received from peripheral are greater than the same.
Change-Id: I886692ad223e16678bfaecbe381c62fdf3503cb5
Signed-off-by: Hardik Arya <harya@codeaurora.org>
Srinivasarao P [Tue, 28 Aug 2018 11:10:15 +0000 (16:40 +0530)]
Merge android-4.4.150 (
5541782) into msm-4.4
* refs/heads/tmp-
5541782
Linux 4.4.150
x86/speculation/l1tf: Exempt zeroed PTEs from inversion
Linux 4.4.149
x86/mm: Add TLB purge to free pmd/pte page interfaces
ioremap: Update pgtable free interfaces with addr
Bluetooth: hidp: buffer overflow in hidp_process_report
ASoC: Intel: cht_bsw_max98090_ti: Fix jack initialization
crypto: ablkcipher - fix crash flushing dcache in error path
crypto: blkcipher - fix crash flushing dcache in error path
crypto: vmac - separate tfm and request context
crypto: vmac - require a block cipher with 128-bit block size
kbuild: verify that $DEPMOD is installed
i2c: ismt: fix wrong device address when unmap the data buffer
kasan: don't emit builtin calls when sanitization is off
tcp: Fix missing range_truesize enlargement in the backport
x86/mm: Disable ioremap free page handling on x86-PAE
Conflicts:
Makefile
Change-Id: I9cbfedbeb3bdb1df021d4f192a2a7392010cd627
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Linux Build Service Account [Tue, 28 Aug 2018 11:03:01 +0000 (04:03 -0700)]
Merge "soc: qcom: subsystem_notif_virt: Added support for virtual subsystems"
Linux Build Service Account [Tue, 28 Aug 2018 11:03:00 +0000 (04:03 -0700)]
Merge "diag: Prevent out of bound access while initializing msg mask"
Linux Build Service Account [Tue, 28 Aug 2018 11:02:59 +0000 (04:02 -0700)]
Merge "defconfig: msm: Disable configs for GVM platforms"
Linux Build Service Account [Tue, 28 Aug 2018 11:02:58 +0000 (04:02 -0700)]
Merge "diag: Fix HSIC read complete work function"
Linux Build Service Account [Tue, 28 Aug 2018 11:02:57 +0000 (04:02 -0700)]
Merge "ARM: dts: msm: Modify subsys notif virtualization on msm8996 vplatform"
Linux Build Service Account [Tue, 28 Aug 2018 11:02:56 +0000 (04:02 -0700)]
Merge "net: memset smsg to avoid the padding data"
Linux Build Service Account [Tue, 28 Aug 2018 11:02:54 +0000 (04:02 -0700)]
Merge "drm: msm: remove hdcp related error messages"
Mohammed Javid [Mon, 6 Aug 2018 07:28:30 +0000 (12:58 +0530)]
msm: ipa: Validate routing rule id
IPA driver expose routing rule id IOCTL's to user space.
There is a chance of getting invalid routing rule-id.
Validate it before committing it to IPA hardware.
Change-Id: If80b94d3a055f9212d25aff9a57d1b45001ba586
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>
Suprith Malligere Shankaregowda [Thu, 23 Aug 2018 07:39:50 +0000 (13:09 +0530)]
msm:ais:Handling bigger value than upper bound in msm_cpp_irq api
In msm_cpp_irq function, tx_level is read using msm_carmera_io_r(),
However, this value is never verified to lower than
MSM_CPP_TX_FIFO_LEVEL (16), As tx_level is used as the upper bound
for the following loop, any value bigger than 16 will result in a
buffer overflow. Hence handling this case as error with error log.
Change-Id: I13222b315c3c9ee46bedb8b4e8e161179fea321d
Signed-off-by: Suprith Malligere Shankaregowda <supgow@codeaurora.org>
Greg Kroah-Hartman [Tue, 28 Aug 2018 06:04:41 +0000 (08:04 +0200)]
Merge 4.4.153 into android-4.4
Changes in 4.4.153
x86/mm/pat: Fix L1TF stable backport for CPA
x86/mm: Fix use-after-free of ldt_struct
ovl: Ensure upper filesystem supports d_type
ovl: Do d_type check only if work dir creation was successful
ovl: warn instead of error if d_type is not supported
Linux 4.4.153
Change-Id: I9876acd1c6799c9016edac4adf15dd3818866903
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Greg Kroah-Hartman [Tue, 28 Aug 2018 05:23:44 +0000 (07:23 +0200)]
Linux 4.4.153
Vivek Goyal [Fri, 1 Jul 2016 14:02:44 +0000 (10:02 -0400)]
ovl: warn instead of error if d_type is not supported
commit
e7c0b5991dd1be7b6f6dc2b54a15a0f47b64b007 upstream.
overlay needs underlying fs to support d_type. Recently I put in a
patch in to detect this condition and started failing mount if
underlying fs did not support d_type.
But this breaks existing configurations over kernel upgrade. Those who
are running docker (partially broken configuration) with xfs not
supporting d_type, are surprised that after kernel upgrade docker does
not run anymore.
https://github.com/docker/docker/issues/22937#issuecomment-
229881315
So instead of erroring out, detect broken configuration and warn
about it. This should allow existing docker setups to continue
working after kernel upgrade.
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Fixes:
45aebeaf4f67 ("ovl: Ensure upper filesystem supports d_type")
Cc: <stable@vger.kernel.org> 4.6
Signed-off-by: SZ Lin (林上智) <sz.lin@moxa.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Vivek Goyal [Fri, 20 May 2016 13:04:26 +0000 (09:04 -0400)]
ovl: Do d_type check only if work dir creation was successful
commit
21765194cecf2e4514ad75244df459f188140a0f upstream.
d_type check requires successful creation of workdir as iterates
through work dir and expects work dir to be present in it. If that's
not the case, this check will always return d_type not supported even
if underlying filesystem might be supporting it.
So don't do this check if work dir creation failed in previous step.
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: SZ Lin (林上智) <sz.lin@moxa.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Vivek Goyal [Mon, 22 Feb 2016 14:28:34 +0000 (09:28 -0500)]
ovl: Ensure upper filesystem supports d_type
commit
45aebeaf4f67468f76bedf62923a576a519a9b68 upstream.
In some instances xfs has been created with ftype=0 and there if a file
on lower fs is removed, overlay leaves a whiteout in upper fs but that
whiteout does not get filtered out and is visible to overlayfs users.
And reason it does not get filtered out because upper filesystem does
not report file type of whiteout as DT_CHR during iterate_dir().
So it seems to be a requirement that upper filesystem support d_type for
overlayfs to work properly. Do this check during mount and fail if d_type
is not supported.
Suggested-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: SZ Lin (林上智) <sz.lin@moxa.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Eric Biggers [Thu, 24 Aug 2017 17:50:29 +0000 (10:50 -0700)]
x86/mm: Fix use-after-free of ldt_struct
commit
ccd5b3235180eef3cfec337df1c8554ab151b5cc upstream.
The following commit:
39a0526fb3f7 ("x86/mm: Factor out LDT init from context init")
renamed init_new_context() to init_new_context_ldt() and added a new
init_new_context() which calls init_new_context_ldt(). However, the
error code of init_new_context_ldt() was ignored. Consequently, if a
memory allocation in alloc_ldt_struct() failed during a fork(), the
->context.ldt of the new task remained the same as that of the old task
(due to the memcpy() in dup_mm()). ldt_struct's are not intended to be
shared, so a use-after-free occurred after one task exited.
Fix the bug by making init_new_context() pass through the error code of
init_new_context_ldt().
This bug was found by syzkaller, which encountered the following splat:
BUG: KASAN: use-after-free in free_ldt_struct.part.2+0x10a/0x150 arch/x86/kernel/ldt.c:116
Read of size 4 at addr
ffff88006d2cb7c8 by task kworker/u9:0/3710
CPU: 1 PID: 3710 Comm: kworker/u9:0 Not tainted 4.13.0-rc4-next-
20170811 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
print_address_description+0x73/0x250 mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report+0x24e/0x340 mm/kasan/report.c:409
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429
free_ldt_struct.part.2+0x10a/0x150 arch/x86/kernel/ldt.c:116
free_ldt_struct arch/x86/kernel/ldt.c:173 [inline]
destroy_context_ldt+0x60/0x80 arch/x86/kernel/ldt.c:171
destroy_context arch/x86/include/asm/mmu_context.h:157 [inline]
__mmdrop+0xe9/0x530 kernel/fork.c:889
mmdrop include/linux/sched/mm.h:42 [inline]
exec_mmap fs/exec.c:1061 [inline]
flush_old_exec+0x173c/0x1ff0 fs/exec.c:1291
load_elf_binary+0x81f/0x4ba0 fs/binfmt_elf.c:855
search_binary_handler+0x142/0x6b0 fs/exec.c:1652
exec_binprm fs/exec.c:1694 [inline]
do_execveat_common.isra.33+0x1746/0x22e0 fs/exec.c:1816
do_execve+0x31/0x40 fs/exec.c:1860
call_usermodehelper_exec_async+0x457/0x8f0 kernel/umh.c:100
ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
Allocated by task 3700:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
kmem_cache_alloc_trace+0x136/0x750 mm/slab.c:3627
kmalloc include/linux/slab.h:493 [inline]
alloc_ldt_struct+0x52/0x140 arch/x86/kernel/ldt.c:67
write_ldt+0x7b7/0xab0 arch/x86/kernel/ldt.c:277
sys_modify_ldt+0x1ef/0x240 arch/x86/kernel/ldt.c:307
entry_SYSCALL_64_fastpath+0x1f/0xbe
Freed by task 3700:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3503 [inline]
kfree+0xca/0x250 mm/slab.c:3820
free_ldt_struct.part.2+0xdd/0x150 arch/x86/kernel/ldt.c:121
free_ldt_struct arch/x86/kernel/ldt.c:173 [inline]
destroy_context_ldt+0x60/0x80 arch/x86/kernel/ldt.c:171
destroy_context arch/x86/include/asm/mmu_context.h:157 [inline]
__mmdrop+0xe9/0x530 kernel/fork.c:889
mmdrop include/linux/sched/mm.h:42 [inline]
__mmput kernel/fork.c:916 [inline]
mmput+0x541/0x6e0 kernel/fork.c:927
copy_process.part.36+0x22e1/0x4af0 kernel/fork.c:1931
copy_process kernel/fork.c:1546 [inline]
_do_fork+0x1ef/0xfb0 kernel/fork.c:2025
SYSC_clone kernel/fork.c:2135 [inline]
SyS_clone+0x37/0x50 kernel/fork.c:2129
do_syscall_64+0x26c/0x8c0 arch/x86/entry/common.c:287
return_from_SYSCALL_64+0x0/0x7a
Here is a C reproducer:
#include <asm/ldt.h>
#include <pthread.h>
#include <signal.h>
#include <stdlib.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <unistd.h>
static void *fork_thread(void *_arg)
{
fork();
}
int main(void)
{
struct user_desc desc = { .entry_number = 8191 };
syscall(__NR_modify_ldt, 1, &desc, sizeof(desc));
for (;;) {
if (fork() == 0) {
pthread_t t;
srand(getpid());
pthread_create(&t, NULL, fork_thread, NULL);
usleep(rand() % 10000);
syscall(__NR_exit_group, 0);
}
wait(NULL);
}
}
Note: the reproducer takes advantage of the fact that alloc_ldt_struct()
may use vmalloc() to allocate a large ->entries array, and after
commit:
5d17a73a2ebe ("vmalloc: back off when the current task is killed")
it is possible for userspace to fail a task's vmalloc() by
sending a fatal signal, e.g. via exit_group(). It would be more
difficult to reproduce this bug on kernels without that commit.
This bug only affected kernels with CONFIG_MODIFY_LDT_SYSCALL=y.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: <stable@vger.kernel.org> [v4.6+]
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-mm@kvack.org
Fixes:
39a0526fb3f7 ("x86/mm: Factor out LDT init from context init")
Link: http://lkml.kernel.org/r/20170824175029.76040-1-ebiggers3@gmail.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Andi Kleen [Sat, 25 Aug 2018 13:50:15 +0000 (06:50 -0700)]
x86/mm/pat: Fix L1TF stable backport for CPA
Patch for stable only to fix boot resets caused by the L1TF patches.
Stable trees reverted the following patch
Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
This reverts commit
87e2bd898d3a79a8c609f183180adac47879a2a4 which is
commit
edc3b9129cecd0f0857112136f5b8b1bc1d45918 upstream.
but the L1TF patch backported here
x86/mm/pat: Make set_memory_np() L1TF safe
commit
958f79b9ee55dfaf00c8106ed1c22a2919e0028b upstream
set_memory_np() is used to mark kernel mappings not present, but it has
it's own open coded mechanism which does not have the L1TF protection of
inverting the address bits.
assumed that cpa->pfn contains a PFN. With the above patch reverted
it does not, which causes the PMD to be set to an incorrect address
shifted by 12 bits, which can cause early boot reset on some
systems, like an Apollo Lake embedded system.
Convert the address to a PFN before passing it to pmd_pfn()
Thanks to Bernhard for bisecting and testing.
Cc: stable@vger.kernel.org # 4.4 and 4.9
Reported-by: Bernhard Kaindl <bernhard.kaindl@thalesgroup.com>
Tested-by: Bernhard Kaindl <bernhard.kaindl@thalesgroup.com>
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Anant Goel [Tue, 5 Jun 2018 02:08:21 +0000 (19:08 -0700)]
soc: qcom: subsystem_notif_virt: Added support for virtual subsystems
The driver is modified to allow communication between a virtual
subsystem, and its native clients.
Change-Id: I40854327431f3691f76df9d781dbd0a24090594e
Signed-off-by: Anant Goel <anantg@codeaurora.org>
Anant Goel [Tue, 21 Aug 2018 23:26:57 +0000 (16:26 -0700)]
defconfig: msm: Disable configs for GVM platforms
Remove configs for SMD, SMEM and SMP2P. These configs
are not required for the GVM platform.
Change-Id: I93d154085c6f249cd26949b40a953e66f010e72b
Signed-off-by: Anant Goel <anantg@codeaurora.org>
Linux Build Service Account [Tue, 28 Aug 2018 01:28:20 +0000 (18:28 -0700)]
Merge "drm/msm: check HDMI HFVSDB block before adding formats"
Linux Build Service Account [Tue, 28 Aug 2018 01:28:19 +0000 (18:28 -0700)]
Merge "msm: ais: Fix out-of-bounds read in string class name"
Linux Build Service Account [Tue, 28 Aug 2018 01:28:18 +0000 (18:28 -0700)]
Merge "ARM: dts: msm: Add a reset gpio for ethernet on msm8996 CV2X boards"
Linux Build Service Account [Tue, 28 Aug 2018 01:28:17 +0000 (18:28 -0700)]
Merge "cfg80211: never ignore user regulatory hint"
Linux Build Service Account [Tue, 28 Aug 2018 01:28:16 +0000 (18:28 -0700)]
Merge "Merge android-4.4.148 (
f057ff9) into msm-4.4"
Linux Build Service Account [Tue, 28 Aug 2018 01:28:15 +0000 (18:28 -0700)]
Merge "icnss: Clear ICNSS_MSA0_ASSIGNED flag in cap failure case"
Linux Build Service Account [Tue, 28 Aug 2018 01:28:14 +0000 (18:28 -0700)]
Merge "msm: ais: change csid to avoid overflow"
Anant Goel [Tue, 5 Jun 2018 01:58:24 +0000 (18:58 -0700)]
ARM: dts: msm: Modify subsys notif virtualization on msm8996 vplatform
Modify subsys_notif_virt device to enable communication between
subsystems and their registered clients.
Change-Id: Id44081a391c55f1326082e6b629e69b7de5dbb9e
Signed-off-by: Anant Goel <anantg@codeaurora.org>
Manoj Prabhu B [Thu, 16 Aug 2018 09:22:04 +0000 (14:52 +0530)]
diag: Prevent out of bound access while initializing msg mask
Move the mask_info mutex initialization outside mask structure
to facilitate prevention of out of bound access while initializing
msg mask during md session creation. Use separate msg_mask_tbl_count
for ODL session msg mask and regular msg mask to prevent out of
bound access in a possible race condition of accessing mask ranges.
Change-Id: I87497c67daff8cc1797a1266d50456bdbd3a9c23
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
Aditya Mathur [Fri, 24 Aug 2018 19:12:04 +0000 (12:12 -0700)]
ARM: dts: msm: Add a reset gpio for ethernet on msm8996 CV2X boards
Enable reset gpio for Neutrino ethernet for
msm8996 CV2X boards
Change-Id: I6b00a76640184d34feee382cd1c6de1427464719
Signed-off-by: Aditya Mathur <aditmath@codeaurora.org>
Peter Kalauskas [Fri, 24 Aug 2018 19:27:10 +0000 (12:27 -0700)]
ANDROID: x86_64_cuttlefish_defconfig: Enable lz4 compression for zram
Signed-off-by: Peter Kalauskas <peskal@google.com>
Bug:
112488418
Change-Id: Iab302cdf63691a3cc3124b5826206b9f6bd4adfb
Signed-off-by: Peter Kalauskas <peskal@google.com>