OSDN Git Service
Rashi Bindra [Mon, 24 Sep 2018 11:18:48 +0000 (16:48 +0530)]
ARM: dts: msm: Add support for FHD+ video mode panel
Change to add support for FHD+ Video mode panel node for
sdm630 MTP and CDP platform.
Change-Id: I3c6b1298e754ac9419fe132374bb7f9e35395aca
Signed-off-by: Rashi Bindra <rbindra@codeaurora.org>
Linux Build Service Account [Fri, 21 Sep 2018 16:14:57 +0000 (09:14 -0700)]
Merge "msm: gvmq: avoid uninitialized access for data member"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:56 +0000 (09:14 -0700)]
Merge "wcnss: Fix buffer overflow in wcnss_prealloc_get"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:55 +0000 (09:14 -0700)]
Merge "ARM: dts: msm: Display changes for SDM455"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:54 +0000 (09:14 -0700)]
Merge "icnss: Add check for rejuvenate in fw_down"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:53 +0000 (09:14 -0700)]
Merge "soc: hab: add bootmarker for hab driver"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:51 +0000 (09:14 -0700)]
Merge "Merge android-4.4.155 (
b3f777e) into msm-4.4"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:50 +0000 (09:14 -0700)]
Merge "diag: Update the logging codes of events, logs and msgs"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:49 +0000 (09:14 -0700)]
Merge "ARM: dts: msm: Add support for speed bin 3 for SDM630"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:48 +0000 (09:14 -0700)]
Merge "Merge remote-tracking branch 'origin/caf/BosSen-msm-44/master' into msm-4.4"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:47 +0000 (09:14 -0700)]
Merge "drm: msm: Fix kernel panic error"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:44 +0000 (09:14 -0700)]
Merge "qseecom: fix kclient free issue in qseecom_remove"
Venkata Rao Kakani [Fri, 21 Sep 2018 09:07:40 +0000 (14:37 +0530)]
msm: gvmq: avoid uninitialized access for data member
Resolve Uninitalized access of data member with initialization
of same.
Change-Id: Ie2ba7ac47e55e55daf6e1dc3b8c8ce73a20320de
Signed-off-by: Venkata Rao Kakani <vkakani@codeaurora.org>
Anurag Chouhan [Wed, 19 Sep 2018 07:45:13 +0000 (13:15 +0530)]
wcnss: Fix buffer overflow in wcnss_prealloc_get
There is potential integer truncation in the wcnss_prealloc_get api.
size_t is 8 byte on x64 platform and "unsigned int" is 4 byte.
To avoid this integer truncation, pass size as size_t instead
of unsigned int.
CRs-Fixed:
2269610
Change-Id: I14b274dd7cad98b55fdce1aaa27783272231afde
Signed-off-by: Anurag Chouhan <achouhan@codeaurora.org>
Nirmal Abraham [Tue, 18 Sep 2018 12:47:52 +0000 (18:17 +0530)]
ARM: dts: msm: Display changes for SDM455
Disable 'assertive display', 'destination scaler' and
'display port' support for SDM455.
Change-Id: I4de89658a6c5b20c97e9fc0f611aaa81f701a9d7
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
Taniya Das [Fri, 31 Aug 2018 18:06:22 +0000 (23:36 +0530)]
ARM: dts: msm: Add support for speed bin 3 for SDM630
New speed bin 3 for CPU frequency added to be able to scale to 2GHz.
Change-Id: I60bacc458c295d924a061a042aea058fbb2eb085
Signed-off-by: Taniya Das <tdas@codeaurora.org>
puneet [Wed, 19 Sep 2018 10:15:33 +0000 (15:45 +0530)]
Merge remote-tracking branch 'origin/caf/BosSen-msm-44/master' into msm-4.4
* origin/caf/BosSen-msm-44/master:
Added support for BMI160.
Fixed bmi160 compile conflicts
added new base source files
Changed chipID
Updated directory structure
Finalized disclaimer information.
CRs-Fixed:
2318425
Change-Id: I8606d46a26f03baac3940162546f507de76bdb9a
Signed-off-by: puneet <puneet@codeaurora.org>
Anurag Chouhan [Wed, 19 Sep 2018 07:06:13 +0000 (12:36 +0530)]
icnss: Add check for rejuvenate in fw_down
Currently, fw_down is not getting set in case of rejuvenate
since the qmi server never exit or arrive in case of rejuvenate.
Add ICNSS_REJUVENATE flag to take care of rejuvenate.
Change-Id: If85e8048cbad9a15e1c94af1c8d0012e004e6150
Signed-off-by: Anurag Chouhan <achouhan@codeaurora.org>
Manoj Prabhu B [Mon, 17 Sep 2018 10:28:25 +0000 (15:58 +0530)]
diag: Update the logging codes of events, logs and msgs
New msg SSIDs, log and event mask codes for different subsystems
are added as a new requirement for enable logging.
Change-Id: I31e784307e6de388e1de0806baacf00116360c30
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
Yajun Li [Mon, 17 Sep 2018 07:20:16 +0000 (15:20 +0800)]
soc: hab: add bootmarker for hab driver
To measure the boot kpi of hab driver,so add
bootmarker in hab_init function
Change-Id: Ib755e77e7a6768d028279331c4bf3e92c10141a4
Signed-off-by: Yajun Li <yajunl@codeaurora.org>
Linux Build Service Account [Tue, 18 Sep 2018 16:44:51 +0000 (09:44 -0700)]
Merge "drivers: soc: qcom: qcpe: Fix return values"
Linux Build Service Account [Tue, 18 Sep 2018 16:44:50 +0000 (09:44 -0700)]
Merge "defconfig: Disable CONFIG_INET_LRO to avoid pop up"
Linux Build Service Account [Tue, 18 Sep 2018 16:44:49 +0000 (09:44 -0700)]
Merge "arm64: Silence first allocation with CONFIG_ARM64_MODULE_PLTS=y"
Linux Build Service Account [Tue, 18 Sep 2018 16:44:48 +0000 (09:44 -0700)]
Merge "mm: Silence vmap() allocation failures based on caller gfp_flags"
Linux Build Service Account [Tue, 18 Sep 2018 16:44:46 +0000 (09:44 -0700)]
Merge "soc: qcom: glink: Fix not sending READ_NOTIF command issue"
Linux Build Service Account [Tue, 18 Sep 2018 16:44:45 +0000 (09:44 -0700)]
Merge "ARM: Silence first allocation with CONFIG_ARM_MODULE_PLTS=y"
Linux Build Service Account [Tue, 18 Sep 2018 16:44:43 +0000 (09:44 -0700)]
Merge "clk: qcom: check for change in RCG configuration during set_rate"
Vara Prasad A V S G [Wed, 8 Aug 2018 17:31:00 +0000 (23:01 +0530)]
defconfig: Disable CONFIG_INET_LRO to avoid pop up
Disable CONFIG_INET_LRO in sdm660_defconfig
and sdm660-perf_defconfig to avoid pop up.
Change-Id: I62069b3f8df27812f714e9875a0e7b7e20e31d4c
Signed-off-by: Vara Prasad A V S G <vavsg@codeaurora.org>
Signed-off-by: Naitik Bharadiya <bharad@codeaurora.org>
Florian Fainelli [Thu, 27 Apr 2017 18:19:00 +0000 (11:19 -0700)]
mm: Silence vmap() allocation failures based on caller gfp_flags
If the caller has set __GFP_NOWARN don't print the following message:
vmap allocation for size
15736832 failed: use vmalloc=<size> to increase
size.
This can happen with the ARM/Linux or ARM64/Linux module loader built
with CONFIG_ARM{,64}_MODULE_PLTS=y which does a first attempt at loading
a large module from module space, then falls back to vmalloc space.
Change-Id: Ib907156055959e22a419b79fb424772baea556d0
Acked-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Git-Commit:
03497d761c55438144fd63534d4223418fdfd345
Git-Repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
Florian Fainelli [Thu, 27 Apr 2017 18:19:01 +0000 (11:19 -0700)]
ARM: Silence first allocation with CONFIG_ARM_MODULE_PLTS=y
When CONFIG_ARM_MODULE_PLTS is enabled, the first allocation using the
module space fails, because the module is too big, and then the module
allocation is attempted from vmalloc space. Silence the first allocation
failure in that case by setting __GFP_NOWARN.
Change-Id: I94ed69d0cb42b16f68b08354f6f62dc22851d84a
Acked-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Git-commit:
75d24d968af8913f641c612930c96acc5399e427
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
Florian Fainelli [Thu, 27 Apr 2017 18:19:02 +0000 (11:19 -0700)]
arm64: Silence first allocation with CONFIG_ARM64_MODULE_PLTS=y
When CONFIG_ARM64_MODULE_PLTS is enabled, the first allocation using the
module space fails, because the module is too big, and then the module
allocation is attempted from vmalloc space. Silence the first allocation
failure in that case by setting __GFP_NOWARN.
Change-Id: I15999e9fb0405dbd76e74dde5b2f94025899d875
Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Git-Repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Git-commit:
0c2cf6d9487cb90be6ad7fac66044dfa8e8e5243
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
Linux Build Service Account [Tue, 18 Sep 2018 07:58:34 +0000 (00:58 -0700)]
Merge "defconfig: msm8998: align with android config requirement"
Arun Kumar Neelakantam [Thu, 8 Feb 2018 10:56:16 +0000 (16:26 +0530)]
soc: qcom: glink: Fix not sending READ_NOTIF command issue
The "tx_blocked_signal_sent" flag is not reset correctly after receiving
the interrupt from the remote side. Hence further READ_NOTIF commands are
not written into FIFO in FIFO full case.
Reset the "tx_blocked_signal_sent" correctly after write space available
in FIFO.
CRs-Fixed:
2175526
Change-Id: I236da2a2b984b3f3cce8400b50f72ce1016d7e40
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
Linux Build Service Account [Mon, 17 Sep 2018 21:15:32 +0000 (14:15 -0700)]
Merge "ASoC: msm: qdsp6v2: Handle invalid session for dtmf enable"
Linux Build Service Account [Mon, 17 Sep 2018 21:15:31 +0000 (14:15 -0700)]
Merge "soc: qcom: hab: add IRQF_NO_SUSPEND to irq flags."
Amit Blay [Sun, 16 Sep 2018 07:23:19 +0000 (10:23 +0300)]
drivers: soc: qcom: qcpe: Fix return values
In some of the SCM APIs implememnted by the QCPE front end,
some return values were not propagated correctly.
Change-Id: I2b0aa7f5511eac384db82a65b380a5d964514e57
Signed-off-by: Amit Blay <ablay@codeaurora.org>
Soumya Managoli [Thu, 6 Sep 2018 10:25:58 +0000 (15:55 +0530)]
ASoC: msm: qdsp6v2: Handle invalid session for dtmf enable
If session id is invalid then dtmf voice info will also
be invalid.
Add check to return error if session id is invalid.
CRs-Fixed:
2306771
Change-Id: I362340f9f666c95949eaa94d0ced4cb3a1b9abab
Signed-off-by: Soumya Managoli <smanag@codeaurora.org>
Yimin Peng [Tue, 11 Sep 2018 06:52:09 +0000 (14:52 +0800)]
soc: qcom: hab: add IRQF_NO_SUSPEND to irq flags.
The virtclk can disable clocks by hab in suspend flow. If hab irq is
disabled then, the power manage task will stick in uninterruptable hab
receive function.
Change-Id: I780ecede7494346953f5f77d665dd77c2cc6d28a
Signed-off-by: Yimin Peng <yiminp@codeaurora.org>
Teng Fei Fan [Tue, 4 Sep 2018 03:53:15 +0000 (11:53 +0800)]
ARM: dts: msm: add initial dts support for SDM455 CDP devices
Add initial devices trees for SDM455 CDP devices
Change-Id: I33bf922baf1dcd5c214f0be81affba25eab0c70c
Signed-off-by: Teng Fei Fan <tengfei@codeaurora.org>
Teng Fei Fan [Mon, 3 Sep 2018 03:46:00 +0000 (11:46 +0800)]
ARM: dts: msm: add initial dts support for SDM455 QRD devices
Add initial devices trees for SDM455 QRD devices
Change-Id: I7107029ac33f47f1866d7907ff9086d98c466039
Signed-off-by: Teng Fei Fan <tengfei@codeaurora.org>
Rahul Sharma [Tue, 4 Sep 2018 10:44:24 +0000 (16:14 +0530)]
drm: msm: Fix kernel panic error
HDMI non_pluggable is only specific to auto dts setting.
If it's not presented in other products' dts entry, as
hdmi is null, calling hdmi_i2c_destroy() will cause null
pointer access and kernel panic would happen. So remove
the calling of such code.
Change-Id: I37bdd281f5b231831ae87f2ba344b01d3cdfaef7
Signed-off-by: Rahul Sharma <rahsha@codeaurora.org>
Teng Fei Fan [Mon, 3 Sep 2018 02:39:20 +0000 (10:39 +0800)]
ARM: dts: msm: add initial dts support for SDM455 MTP devices
Add initial device trees for SDM455 MTP devices
Change-Id: I8b8f3038ae435db9ea87c7e6a72d79e82f72806f
Signed-off-by: Teng Fei Fan <tengfei@codeaurora.org>
Linux Build Service Account [Sat, 15 Sep 2018 06:53:12 +0000 (23:53 -0700)]
Merge "cnss2: Clear CNSS_DEV_ERR_NOTIFY after collecting firmware dump"
Gerrit - the friendly Code Review server [Fri, 14 Sep 2018 23:44:05 +0000 (16:44 -0700)]
Merge changes into msm-4.4
Yue Ma [Tue, 11 Sep 2018 00:27:01 +0000 (17:27 -0700)]
cnss2: Clear CNSS_DEV_ERR_NOTIFY after collecting firmware dump
CNSS_DEV_ERR_NOTIFY should not be cleared before collecting firmware
dump as device is still in asserted state. Clear it after collecting
firmware dump.
Change-Id: Ic57c65d8ffa1806a0af83e653d6573f19ab1e705
Signed-off-by: Yue Ma <yuem@codeaurora.org>
Linux Build Service Account [Fri, 14 Sep 2018 17:02:38 +0000 (10:02 -0700)]
Merge "drivers: dma-removed: fix signedness issue"
Linux Build Service Account [Fri, 14 Sep 2018 17:02:36 +0000 (10:02 -0700)]
Merge "rtc: qpnp-rtc: Read ALARM_EN and update to alarm enabled status"
Linux Build Service Account [Fri, 14 Sep 2018 17:02:34 +0000 (10:02 -0700)]
Merge "soc: qcom: socinfo: Add support for SDM455 soc-id"
Linux Build Service Account [Fri, 14 Sep 2018 17:02:32 +0000 (10:02 -0700)]
Merge "fbdev: msm: try recovering from PP timeout without panic"
Linux Build Service Account [Fri, 14 Sep 2018 07:53:24 +0000 (00:53 -0700)]
Merge "soc: qcom: secure_buffer: Fix the parameter passing to dmac_flush_range"
Srinivasarao P [Mon, 13 Aug 2018 12:21:11 +0000 (17:51 +0530)]
drivers: dma-removed: fix signedness issue
Large values returned by bitmap_find_next_zero_area() can overflow
and become negative when stored in signed variable 'pageno' that
can lead to failure of condition 'pageno < dma_mem->nr_pages'.
Due to this, Use-after-free issue is observed in bitmap_set(),
When user requests to allocate large size buffer using ion calls.
BUG: KASAN: use-after-free in bitmap_set+0x9c/0xd4 at addr
ffffffe774946cc0
Read of size 8 by task syz-executor0/19717
page:
ffffffbe5dd25180 count:0 mapcount:-127 mapping:(null)
index:0xffffffe774947000 flags: 0x0()
page dumped because: kasan: bad access detected
page_owner info is not active (free page?)
CPU: 3 PID: 19717 Comm: syz-executor0 Tainted: G W 4.4.78+ #1
Call trace:
[<
ffffffa10c68b6fc>] dump_backtrace+0x0/0x2fc
[<
ffffffa10c68ba1c>] show_stack+0x24/0x30
[<
ffffffa10cc29a34>] dump_stack+0xdc/0x134
[<
ffffffa10c8b2c10>] kasan_report+0x380/0x508
[<
ffffffa10c8b1f38>] __asan_load8+0x24/0x80
[<
ffffffa10cc42218>] bitmap_set+0x9c/0xd4
[<
ffffffa10d15941c>] removed_alloc+0x188/0x5e4
[<
ffffffa10dba4f40>] ion_cma_allocate+0x164/0x3e0
[<
ffffffa10db9cef4>] __ion_alloc+0x368/0x1044
[<
ffffffa10db9e0c8>] ion_ioctl+0x25c/0x6ac
[<
ffffffa10c8e2f40>] do_vfs_ioctl+0x844/0x9a8
[<
ffffffa10c8e311c>] SyS_ioctl+0x78/0xbc
[<
ffffffa10c683730>] el0_svc_naked+0x24/0x28
Change-Id: Ibbaa451250bdfa9ce2a6e2cb9d2ee357ee0c8385
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Zhenhua Huang [Thu, 6 Sep 2018 06:27:14 +0000 (14:27 +0800)]
soc: qcom: secure_buffer: Fix the parameter passing to dmac_flush_range
For "chunk_list + chunk_list_len", if the chunk_list is type of u32*,
the chunk_list_len will be 4 * of original size. So we flushed a wrong
area size. In some condition like we enabled CONFIG_DEBUG_PAGEALLOC, it
may flush out of page bound of the invalid pte page.
Fix it by manually convert it as void* when doing the addition.
CRs-Fixed:
2309993
Change-Id: I2b88d78ba73d9904fa2bf6106937001715b6037f
Signed-off-by: Zhenhua Huang <zhenhuah@codeaurora.org>
Linux Build Service Account [Thu, 13 Sep 2018 22:57:39 +0000 (15:57 -0700)]
Merge "cnss2: Add API to check if WLAN PCIe device is down"
Yue Ma [Tue, 11 Sep 2018 00:20:54 +0000 (17:20 -0700)]
cnss2: Add API to check if WLAN PCIe device is down
API provision for WLAN host driver to check if WLAN PCIe device
is down.
Change-Id: I91efcd781af67c72b787c89e6b619c4cc49da34b
Signed-off-by: Yue Ma <yuem@codeaurora.org>
Linux Build Service Account [Thu, 13 Sep 2018 10:11:30 +0000 (03:11 -0700)]
Merge "rtac: Add mutex lock to ensure proper fops access"
Linux Build Service Account [Wed, 12 Sep 2018 18:08:36 +0000 (11:08 -0700)]
Merge "dt: msm: gvmq: enable virtual ssr for adsp and wlan"
Venkata Rao Kakani [Wed, 12 Sep 2018 06:51:10 +0000 (12:21 +0530)]
dt: msm: gvmq: enable virtual ssr for adsp and wlan
Subsystem notification for adsp and wlan in guest.
Change-Id: I49e3e0a160a2434ba9df8008a5ad5051fbeed194
Signed-off-by: Venkata Rao Kakani <vkakani@codeaurora.org>
Mao Jinlong [Wed, 2 Aug 2017 08:14:19 +0000 (16:14 +0800)]
rtc: qpnp-rtc: Read ALARM_EN and update to alarm enabled status
ALARM_EN status is retained in PMIC register after device shutdown
if poweron_alarm is enabled. Read it to make sure the driver has
consistent value with the register status.
Change-Id: Iee0a19ba5126265b36a353c1d1b249d09185564a
Signed-off-by: Mao Jinlong <c_jmao@codeaurora.org>
Linux Build Service Account [Wed, 12 Sep 2018 05:43:33 +0000 (22:43 -0700)]
Merge "ARM: dts: msm: Add CPR support for SDM630 speed-bin 3"
Srinivasarao P [Wed, 12 Sep 2018 05:22:49 +0000 (10:52 +0530)]
Merge android-4.4.155 (
b3f777e) into msm-4.4
* refs/heads/tmp-
b3f777e
Linux 4.4.155
drm/drivers: add support for using the arch wc mapping API.
x86/io: add interface to reserve io memtype for a resource range. (v1.1)
fs/quota: Fix spectre gadget in do_quotactl
perf auxtrace: Fix queue resize
bcache: release dc->writeback_lock properly in bch_writeback_thread()
getxattr: use correct xattr length
udlfb: set optimal write delay
fb: fix lost console when the user unplugs a USB adapter
pwm: tiehrpwm: Fix disabling of output of PWMs
ubifs: Fix synced_i_size calculation for xattr inodes
ubifs: Check data node size before truncate
Revert "UBIFS: Fix potential integer overflow in allocation"
ubifs: Fix memory leak in lprobs self-check
userns: move user access out of the mutex
sys: don't hold uts_sem while accessing userspace memory
osf_getdomainname(): use copy_to_user()
iommu/vt-d: Fix dev iotlb pfsid use
iommu/vt-d: Add definitions for PFSID
mm/tlb: Remove tlb_remove_table() non-concurrent condition
ARM: tegra: Fix Tegra30 Cardhu PCA954x reset
pnfs/blocklayout: off by one in bl_map_stripe()
PM / sleep: wakeup: Fix build error caused by missing SRCU support
9p: fix multiple NULL-pointer-dereferences
uprobes: Use synchronize_rcu() not synchronize_sched()
kthread, tracing: Don't expose half-written comm when creating kthreads
tracing/blktrace: Fix to allow setting same value
tracing: Do not call start/stop() functions when tracing_on does not change
vmw_balloon: fix VMCI use when balloon built into kernel
vmw_balloon: VMCI_DOORBELL_SET does not check status
vmw_balloon: do not use 2MB without batching
vmw_balloon: fix inflation of 64-bit GFNs
iio: ad9523: Fix return value for ad952x_store()
iio: ad9523: Fix displayed phase
dm cache metadata: save in-core policy_hint_size to on-disk superblock
x86/mm/pat: Fix L1TF stable backport for CPA, 2nd call
net/9p/trans_fd.c: fix race-condition by flushing workqueue before the kfree()
net/9p/client.c: version pointer uninitialized
9p/virtio: fix off-by-one error in sg list bounds check
fs/9p/xattr.c: catch the error of p9_client_clunk when setting xattr failed
powerpc/pseries: Fix endianness while restoring of r3 in MCE handler.
powerpc/fadump: handle crash memory ranges array index overflow
drm/i915/userptr: reject zero user_size
spi: davinci: fix a NULL pointer dereference
net: lan78xx: Fix misplaced tasklet_schedule() call
9p/net: Fix zero-copy path in the 9p virtio transport
net: mac802154: tx: expand tailroom if necessary
net: 6lowpan: fix reserved space for single frames
BACKPORT: arm64/vdso: Fix nsec handling for CLOCK_MONOTONIC_RAW
ANDROID: arm64: mm: fix 4.4.154 merge
Change-Id: Id5969245c97b88f9618cb6123e992ea4540ca434
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Srinivasarao P [Wed, 12 Sep 2018 05:18:45 +0000 (10:48 +0530)]
Merge android-4.4.154 (
d762e28) into msm-4.4
* refs/heads/tmp-
d762e28
Linux 4.4.154
cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status
iscsi target: fix session creation failure handling
scsi: core: Avoid that SCSI device removal through sysfs triggers a deadlock
scsi: sysfs: Introduce sysfs_{un,}break_active_protection()
MIPS: lib: Provide MIPS64r6 __multi3() for GCC < 7
MIPS: Correct the 64-bit DSP accumulator register size
kprobes: Make list and blacklist root user read only
s390/pci: fix out of bounds access during irq setup
s390/qdio: reset old sbal_state flags
s390: fix br_r1_trampoline for machines without exrl
x86/spectre: Add missing family 6 check to microcode check
x86/irqflags: Mark native_restore_fl extern inline
pinctrl: freescale: off by one in imx1_pinconf_group_dbg_show()
ASoC: sirf: Fix potential NULL pointer dereference
ASoC: dpcm: don't merge format from invalid codec dai
udl-kms: fix crash due to uninitialized memory
udl-kms: handle allocation failure
udl-kms: change down_interruptible to down
fuse: Add missed unlock_page() to fuse_readpages_fill()
fuse: Fix oops at process_init_reply()
fuse: umount should wait for all requests
fuse: fix unlocked access to processing queue
fuse: fix double request_end()
fuse: Don't access pipe->buffers without pipe_lock()
x86/process: Re-export start_thread()
x86/speculation/l1tf: Suggest what to do on systems with too much RAM
x86/speculation/l1tf: Fix off-by-one error when warning that system has too much RAM
x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit
KVM: arm/arm64: Skip updating PMD entry if no change
KVM: arm/arm64: Skip updating PTE entry if no change
arm64: mm: check for upper PAGE_SHIFT bits in pfn_valid()
ext4: reset error code in ext4_find_entry in fallback
ext4: sysfs: print ext4_super_block fields as little-endian
ext4: check for NUL characters in extended attribute's name
s390/kvm: fix deadlock when killed by oom
btrfs: don't leak ret from do_chunk_alloc
smb3: don't request leases in symlink creation and query
smb3: Do not send SMB3 SET_INFO if nothing changed
cifs: check kmalloc before use
cifs: add missing debug entries for kconfig options
mm/memory.c: check return value of ioremap_prot
scsi: vmw_pvscsi: Return DID_RESET for status SAM_STAT_COMMAND_TERMINATED
scsi: fcoe: drop frames in ELS LOGO error path
drivers: net: lmc: fix case value for target abort error
arc: fix type warnings in arc/mm/cache.c
arc: fix build errors in arc/include/asm/delay.h
enic: handle mtu change for vf properly
Revert "MIPS: BCM47XX: Enable 74K Core ExternalSync for PCIe erratum"
tools/power turbostat: Read extended processor family from CPUID
zswap: re-check zswap_is_full() after do zswap_shrink()
selftests/ftrace: Add snapshot and tracing_on test case
cachefiles: Wait rather than BUG'ing on "Unexpected object collision"
cachefiles: Fix refcounting bug in backing-file read monitoring
fscache: Allow cancelled operations to be enqueued
net: axienet: Fix double deregister of mdio
bnx2x: Fix invalid memory access in rss hash config path.
media: staging: omap4iss: Include asm/cacheflush.h after generic includes
i2c: davinci: Avoid zero value of CLKH
can: mpc5xxx_can: check of_iomap return before use
net: prevent ISA drivers from building on PPC32
atl1c: reserve min skb headroom
qed: Fix possible race for the link state value.
net: caif: Add a missing rcu_read_unlock() in caif_flow_cb
tools/power turbostat: fix -S on UP systems
usb: gadget: f_uac2: fix endianness of 'struct cntrl_*_lay3'
tools: usb: ffs-test: Fix build on big endian systems
usb/phy: fix PPC64 build errors in phy-fsl-usb.c
usb: gadget: r8a66597: Fix a possible sleep-in-atomic-context bugs in r8a66597_queue()
usb: gadget: r8a66597: Fix two possible sleep-in-atomic-context bugs in init_controller()
drm/imx: imx-ldb: check if channel is enabled before printing warning
drm/imx: imx-ldb: disable LDB on driver bind
scsi: libiscsi: fix possible NULL pointer dereference in case of TMF
drm/bridge: adv7511: Reset registers on hotplug
nl80211: Add a missing break in parse_station_flags
mac80211: add stations tied to AP_VLANs during hw reconfig
xfrm: free skb if nlsk pointer is NULL
xfrm: fix missing dst_release() after policy blocking lbcast and multicast
vti6: fix PMTU caching and reporting on xmit
Cipso: cipso_v4_optptr enter infinite loop
sched/sysctl: Check user input value of sysctl_sched_time_avg
BACKPORT: zram: drop max_zpage_size and use zs_huge_class_size()
BACKPORT: zsmalloc: introduce zs_huge_class_size()
ANDROID: tracing: fix race condition reading saved tgids
Conflicts:
mm/zsmalloc.c
Change-Id: I1add2f0311c887c135ddc6160963702beeb7bb88
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Zhen Kong [Fri, 13 Jul 2018 19:02:32 +0000 (12:02 -0700)]
qseecom: fix kclient free issue in qseecom_remove
Remove kzfree() after kclient list iteration to avoid invalid
pointer deference.
Change-Id: I78922269e219fcb16d3cff05f8b168a75a3c05ae
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Linux Build Service Account [Tue, 11 Sep 2018 16:46:30 +0000 (09:46 -0700)]
Merge "ARM: dts: msm: Add support for complete subsystem ramdump for SDM660"
Linux Build Service Account [Tue, 11 Sep 2018 16:46:29 +0000 (09:46 -0700)]
Merge "aio: hold an extra file reference over AIO read/write operations"
Anirudh Ghayal [Mon, 3 Sep 2018 05:34:29 +0000 (11:04 +0530)]
ARM: dts: msm: Add CPR support for SDM630 speed-bin 3
Add the CPR configuration of Speed-bin 3 for the power
and performance cluster of SDM630.
Change-Id: I6bf9a837ae941cf3ad9413da6e44821916acf197
Signed-off-by: Anirudh Ghayal <aghayal@codeaurora.org>
Tanya Dixit [Tue, 11 Sep 2018 12:29:29 +0000 (17:59 +0530)]
rtac: Add mutex lock to ensure proper fops access
Add mutex lock in rtac_open and rtac_release
to avoid usage count discrepancies leading
to multiple calls to unmap memory resulting in
null pointer dereference.
CRs-Fixed:
2271712
Change-Id: Ie6da28837c352030b8d7e377d68a70cf04e7072a
Signed-off-by: Tanya Dixit <tdixit@codeaurora.org>
Naitik Bharadiya [Mon, 10 Sep 2018 11:41:55 +0000 (17:11 +0530)]
ARM: dts: msm: Add support for complete subsystem ramdump for SDM660
Add support to dump complete ramdump of subsystem from start of first
segment to end of last segment without leaving any hole in between.
Change-Id: I0bcab1d4e04748d3934b7a4d99eec59727c3afb1
Signed-off-by: Naitik Bharadiya <bharad@codeaurora.org>
Linux Build Service Account [Tue, 11 Sep 2018 09:04:20 +0000 (02:04 -0700)]
Merge "mdio: Add support for mdio drivers."
Linux Build Service Account [Tue, 11 Sep 2018 09:04:19 +0000 (02:04 -0700)]
Merge "drm/msm-hyp: expand display type enumeration"
Hardik Arya [Wed, 8 Aug 2018 04:58:34 +0000 (10:28 +0530)]
soc: qcom: glink_spi_xprt: Validate fifo read index of remote side
Since message received from spi cannot be trusted there is possibility
of out-of-bound read if received read_id is not in range of fifo.
The patch validate rx_fifo_read index of edge info for remote side.
Change-Id: I3d3fa749935f477e5f98f986adc24e6e6a682d4d
Signed-off-by: Hardik Arya <harya@codeaurora.org>
Bosch Sensortec [Tue, 11 Sep 2018 06:00:15 +0000 (08:00 +0200)]
Added support for BMI160.
Camus Wong [Mon, 27 Aug 2018 21:09:48 +0000 (17:09 -0400)]
drm/msm-hyp: expand display type enumeration
Expand display type/id enumeration up to eight types.
Change-Id: I19c47e6b4aa57dc94020f909260e1de2218ca82d
Signed-off-by: Camus Wong <camusw@codeaurora.org>
Andrew Lunn [Wed, 6 Jan 2016 19:11:26 +0000 (20:11 +0100)]
mdio: Add support for mdio drivers.
Not all devices on an MDIO bus are PHYs. Meaning not all MDIO drivers
are PHY drivers. Add support for generic MDIO drivers.
Change-Id: I65c7c8a497bbac9ef67b3d21c869818a09378e3c
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-Commit:
a9049e0c513c4521dbfaa302af8ed08b3366b41f
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Anthony Mah <amah@codeaurora.org>
Christoph Hellwig [Sun, 30 Oct 2016 16:42:01 +0000 (11:42 -0500)]
aio: hold an extra file reference over AIO read/write operations
Otherwise we might dereference an already freed file and/or inode
when aio_complete is called before we return from the read_iter or
write_iter method.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
(cherry picked from commit
0b944d3a4bba6b25f43aed530f4fa85c04d162a6)
Change-Id: I628a87b5036ba1ba5ba5152fa0329d02999d3649
Git-Commit:
0b944d3a4bba6b25f43aed530f4fa85c04d162a6
Git-Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
[riteshh@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Ritesh Harjani <riteshh@codeaurora.org>
Naitik Bharadiya [Mon, 10 Sep 2018 05:31:08 +0000 (11:01 +0530)]
defconfig: msm8998: align with android config requirement
Align with android-base.cfg which is android kernel config
requirement for msm8998_defconfig.
Change-Id: I69cbca16705d25b5505792b11ae4f054be09457f
Signed-off-by: Naitik Bharadiya <bharad@codeaurora.org>
Greg Kroah-Hartman [Mon, 10 Sep 2018 07:19:25 +0000 (09:19 +0200)]
Merge 4.4.155 into android-4.4
Changes in 4.4.155
net: 6lowpan: fix reserved space for single frames
net: mac802154: tx: expand tailroom if necessary
9p/net: Fix zero-copy path in the 9p virtio transport
net: lan78xx: Fix misplaced tasklet_schedule() call
spi: davinci: fix a NULL pointer dereference
drm/i915/userptr: reject zero user_size
powerpc/fadump: handle crash memory ranges array index overflow
powerpc/pseries: Fix endianness while restoring of r3 in MCE handler.
fs/9p/xattr.c: catch the error of p9_client_clunk when setting xattr failed
9p/virtio: fix off-by-one error in sg list bounds check
net/9p/client.c: version pointer uninitialized
net/9p/trans_fd.c: fix race-condition by flushing workqueue before the kfree()
x86/mm/pat: Fix L1TF stable backport for CPA, 2nd call
dm cache metadata: save in-core policy_hint_size to on-disk superblock
iio: ad9523: Fix displayed phase
iio: ad9523: Fix return value for ad952x_store()
vmw_balloon: fix inflation of 64-bit GFNs
vmw_balloon: do not use 2MB without batching
vmw_balloon: VMCI_DOORBELL_SET does not check status
vmw_balloon: fix VMCI use when balloon built into kernel
tracing: Do not call start/stop() functions when tracing_on does not change
tracing/blktrace: Fix to allow setting same value
kthread, tracing: Don't expose half-written comm when creating kthreads
uprobes: Use synchronize_rcu() not synchronize_sched()
9p: fix multiple NULL-pointer-dereferences
PM / sleep: wakeup: Fix build error caused by missing SRCU support
pnfs/blocklayout: off by one in bl_map_stripe()
ARM: tegra: Fix Tegra30 Cardhu PCA954x reset
mm/tlb: Remove tlb_remove_table() non-concurrent condition
iommu/vt-d: Add definitions for PFSID
iommu/vt-d: Fix dev iotlb pfsid use
osf_getdomainname(): use copy_to_user()
sys: don't hold uts_sem while accessing userspace memory
userns: move user access out of the mutex
ubifs: Fix memory leak in lprobs self-check
Revert "UBIFS: Fix potential integer overflow in allocation"
ubifs: Check data node size before truncate
ubifs: Fix synced_i_size calculation for xattr inodes
pwm: tiehrpwm: Fix disabling of output of PWMs
fb: fix lost console when the user unplugs a USB adapter
udlfb: set optimal write delay
getxattr: use correct xattr length
bcache: release dc->writeback_lock properly in bch_writeback_thread()
perf auxtrace: Fix queue resize
fs/quota: Fix spectre gadget in do_quotactl
x86/io: add interface to reserve io memtype for a resource range. (v1.1)
drm/drivers: add support for using the arch wc mapping API.
Linux 4.4.155
Change-Id: Ie455609e00dd70d3fa723cd254f544109db8a788
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Linux Build Service Account [Mon, 10 Sep 2018 05:08:35 +0000 (22:08 -0700)]
Merge "Revert "msm: adsprpc: DSP device node to provide restricted access to ADSP/SLPI""
Teng Fei Fan [Mon, 3 Sep 2018 07:46:47 +0000 (15:46 +0800)]
soc: qcom: socinfo: Add support for SDM455 soc-id
Add socinfo support for SDM455 Soc and update the
bindings fot the same.
Change-Id: I9b30795e202d84ae06020983b2d656772fb4f313
Signed-off-by: Teng Fei Fan <tengfei@codeaurora.org>
Greg Kroah-Hartman [Sun, 9 Sep 2018 18:04:37 +0000 (20:04 +0200)]
Linux 4.4.155
Dave Airlie [Mon, 24 Oct 2016 05:37:48 +0000 (15:37 +1000)]
drm/drivers: add support for using the arch wc mapping API.
commit
7cf321d118a825c1541b43ca45294126fd474efa upstream.
This fixes a regression in all these drivers since the cache
mode tracking was fixed for mixed mappings. It uses the new
arch API to add the VRAM range to the PAT mapping tracking
tables.
Fixes:
87744ab3832 (mm: fix cache mode tracking in vm_insert_mixed())
Reviewed-by: Christian König <christian.koenig@amd.com>.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Dave Airlie [Mon, 24 Oct 2016 05:27:59 +0000 (15:27 +1000)]
x86/io: add interface to reserve io memtype for a resource range. (v1.1)
commit
8ef4227615e158faa4ee85a1d6466782f7e22f2f upstream.
A recent change to the mm code in:
87744ab3832b mm: fix cache mode tracking in vm_insert_mixed()
started enforcing checking the memory type against the registered list for
amixed pfn insertion mappings. It happens that the drm drivers for a number
of gpus relied on this being broken. Currently the driver only inserted
VRAM mappings into the tracking table when they came from the kernel,
and userspace mappings never landed in the table. This led to a regression
where all the mapping end up as UC instead of WC now.
I've considered a number of solutions but since this needs to be fixed
in fixes and not next, and some of the solutions were going to introduce
overhead that hadn't been there before I didn't consider them viable at
this stage. These mainly concerned hooking into the TTM io reserve APIs,
but these API have a bunch of fast paths I didn't want to unwind to add
this to.
The solution I've decided on is to add a new API like the arch_phys_wc
APIs (these would have worked but wc_del didn't take a range), and
use them from the drivers to add a WC compatible mapping to the table
for all VRAM on those GPUs. This means we can then create userspace
mapping that won't get degraded to UC.
v1.1: use CONFIG_X86_PAT + add some comments in io.h
Cc: Toshi Kani <toshi.kani@hp.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: x86@kernel.org
Cc: mcgrof@suse.com
Cc: Dan Williams <dan.j.williams@intel.com>
Acked-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jeremy Cline [Tue, 31 Jul 2018 01:37:31 +0000 (01:37 +0000)]
fs/quota: Fix spectre gadget in do_quotactl
commit
7b6924d94a60c6b8c1279ca003e8744e6cd9e8b1 upstream.
'type' is user-controlled, so sanitize it after the bounds check to
avoid using it in speculative execution. This covers the following
potential gadgets detected with the help of smatch:
* fs/ext4/super.c:5741 ext4_quota_read() warn: potential spectre issue
'sb_dqopt(sb)->files' [r]
* fs/ext4/super.c:5778 ext4_quota_write() warn: potential spectre issue
'sb_dqopt(sb)->files' [r]
* fs/f2fs/super.c:1552 f2fs_quota_read() warn: potential spectre issue
'sb_dqopt(sb)->files' [r]
* fs/f2fs/super.c:1608 f2fs_quota_write() warn: potential spectre issue
'sb_dqopt(sb)->files' [r]
* fs/quota/dquot.c:412 mark_info_dirty() warn: potential spectre issue
'sb_dqopt(sb)->info' [w]
* fs/quota/dquot.c:933 dqinit_needed() warn: potential spectre issue
'dquots' [r]
* fs/quota/dquot.c:2112 dquot_commit_info() warn: potential spectre
issue 'dqopt->ops' [r]
* fs/quota/dquot.c:2362 vfs_load_quota_inode() warn: potential spectre
issue 'dqopt->files' [w] (local cap)
* fs/quota/dquot.c:2369 vfs_load_quota_inode() warn: potential spectre
issue 'dqopt->ops' [w] (local cap)
* fs/quota/dquot.c:2370 vfs_load_quota_inode() warn: potential spectre
issue 'dqopt->info' [w] (local cap)
* fs/quota/quota.c:110 quota_getfmt() warn: potential spectre issue
'sb_dqopt(sb)->info' [r]
* fs/quota/quota_v2.c:84 v2_check_quota_file() warn: potential spectre
issue 'quota_magics' [w]
* fs/quota/quota_v2.c:85 v2_check_quota_file() warn: potential spectre
issue 'quota_versions' [w]
* fs/quota/quota_v2.c:96 v2_read_file_info() warn: potential spectre
issue 'dqopt->info' [r]
* fs/quota/quota_v2.c:172 v2_write_file_info() warn: potential spectre
issue 'dqopt->info' [r]
Additionally, a quick inspection indicates there are array accesses with
'type' in quota_on() and quota_off() functions which are also addressed
by this.
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Adrian Hunter [Tue, 14 Aug 2018 08:46:08 +0000 (11:46 +0300)]
perf auxtrace: Fix queue resize
commit
99cbbe56eb8bede625f410ab62ba34673ffa7d21 upstream.
When the number of queues grows beyond 32, the array of queues is
resized but not all members were being copied. Fix by also copying
'tid', 'cpu' and 'set'.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: stable@vger.kernel.org
Fixes:
e502789302a6e ("perf auxtrace: Add helpers for queuing AUX area tracing data")
Link: http://lkml.kernel.org/r/20180814084608.6563-1-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Shan Hai [Wed, 22 Aug 2018 18:02:56 +0000 (02:02 +0800)]
bcache: release dc->writeback_lock properly in bch_writeback_thread()
commit
3943b040f11ed0cc6d4585fd286a623ca8634547 upstream.
The writeback thread would exit with a lock held when the cache device
is detached via sysfs interface, fix it by releasing the held lock
before exiting the while-loop.
Fixes:
fadd94e05c02 (bcache: quit dc->writeback_thread when BCACHE_DEV_DETACHING is set)
Signed-off-by: Shan Hai <shan.hai@oracle.com>
Signed-off-by: Coly Li <colyli@suse.de>
Tested-by: Shenghui Wang <shhuiw@foxmail.com>
Cc: stable@vger.kernel.org #4.17+
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Christian Brauner [Thu, 7 Jun 2018 11:43:48 +0000 (13:43 +0200)]
getxattr: use correct xattr length
commit
82c9a927bc5df6e06b72d206d24a9d10cced4eb5 upstream.
When running in a container with a user namespace, if you call getxattr
with name = "system.posix_acl_access" and size % 8 != 4, then getxattr
silently skips the user namespace fixup that it normally does resulting in
un-fixed-up data being returned.
This is caused by posix_acl_fix_xattr_to_user() being passed the total
buffer size and not the actual size of the xattr as returned by
vfs_getxattr().
This commit passes the actual length of the xattr as returned by
vfs_getxattr() down.
A reproducer for the issue is:
touch acl_posix
setfacl -m user:0:rwx acl_posix
and the compile:
#define _GNU_SOURCE
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <unistd.h>
#include <attr/xattr.h>
/* Run in user namespace with nsuid 0 mapped to uid != 0 on the host. */
int main(int argc, void **argv)
{
ssize_t ret1, ret2;
char buf1[128], buf2[132];
int fret = EXIT_SUCCESS;
char *file;
if (argc < 2) {
fprintf(stderr,
"Please specify a file with "
"\"system.posix_acl_access\" permissions set\n");
_exit(EXIT_FAILURE);
}
file = argv[1];
ret1 = getxattr(file, "system.posix_acl_access",
buf1, sizeof(buf1));
if (ret1 < 0) {
fprintf(stderr, "%s - Failed to retrieve "
"\"system.posix_acl_access\" "
"from \"%s\"\n", strerror(errno), file);
_exit(EXIT_FAILURE);
}
ret2 = getxattr(file, "system.posix_acl_access",
buf2, sizeof(buf2));
if (ret2 < 0) {
fprintf(stderr, "%s - Failed to retrieve "
"\"system.posix_acl_access\" "
"from \"%s\"\n", strerror(errno), file);
_exit(EXIT_FAILURE);
}
if (ret1 != ret2) {
fprintf(stderr, "The value of \"system.posix_acl_"
"access\" for file \"%s\" changed "
"between two successive calls\n", file);
_exit(EXIT_FAILURE);
}
for (ssize_t i = 0; i < ret2; i++) {
if (buf1[i] == buf2[i])
continue;
fprintf(stderr,
"Unexpected different in byte %zd: "
"%02x != %02x\n", i, buf1[i], buf2[i]);
fret = EXIT_FAILURE;
}
if (fret == EXIT_SUCCESS)
fprintf(stderr, "Test passed\n");
else
fprintf(stderr, "Test failed\n");
_exit(fret);
}
and run:
./tester acl_posix
On a non-fixed up kernel this should return something like:
root@c1:/# ./t
Unexpected different in byte 16:
ffffffa0 != 00
Unexpected different in byte 17:
ffffff86 != 00
Unexpected different in byte 18: 01 != 00
and on a fixed kernel:
root@c1:~# ./t
Test passed
Cc: stable@vger.kernel.org
Fixes:
2f6f0654ab61 ("userns: Convert vfs posix_acl support to use kuids and kgids")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=199945
Reported-by: Colin Watson <cjwatson@ubuntu.com>
Signed-off-by: Christian Brauner <christian@brauner.io>
Acked-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Mikulas Patocka [Wed, 25 Jul 2018 13:41:55 +0000 (15:41 +0200)]
udlfb: set optimal write delay
commit
bb24153a3f13dd0dbc1f8055ad97fe346d598f66 upstream.
The default delay 5 jiffies is too much when the kernel is compiled with
HZ=100 - it results in jumpy cursor in Xwindow.
In order to find out the optimal delay, I benchmarked the driver on
1280x720x30fps video. I found out that with HZ=1000, 10ms is acceptable,
but with HZ=250 or HZ=300, we need 4ms, so that the video is played
without any frame skips.
This patch changes the delay to this value.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Mikulas Patocka [Wed, 25 Jul 2018 13:41:54 +0000 (15:41 +0200)]
fb: fix lost console when the user unplugs a USB adapter
commit
8c5b044299951acd91e830a688dd920477ea1eda upstream.
I have a USB display adapter using the udlfb driver and I use it on an ARM
board that doesn't have any graphics card. When I plug the adapter in, the
console is properly displayed, however when I unplug and re-plug the
adapter, the console is not displayed and I can't access it until I reboot
the board.
The reason is this:
When the adapter is unplugged, dlfb_usb_disconnect calls
unlink_framebuffer, then it waits until the reference count drops to zero
and then it deallocates the framebuffer. However, the console that is
attached to the framebuffer device keeps the reference count non-zero, so
the framebuffer device is never destroyed. When the USB adapter is plugged
again, it creates a new device /dev/fb1 and the console is not attached to
it.
This patch fixes the bug by unbinding the console from unlink_framebuffer.
The code to unbind the console is moved from do_unregister_framebuffer to
a function unbind_console. When the console is unbound, the reference
count drops to zero and the udlfb driver frees the framebuffer. When the
adapter is plugged back, a new framebuffer is created and the console is
attached to it.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Bernie Thompson <bernie@plugable.com>
Cc: Ladislav Michl <ladis@linux-mips.org>
Cc: stable@vger.kernel.org
[b.zolnierkie: preserve old behavior for do_unregister_framebuffer()]
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Vignesh R [Mon, 11 Jun 2018 06:09:56 +0000 (11:39 +0530)]
pwm: tiehrpwm: Fix disabling of output of PWMs
commit
38dabd91ff0bde33352ca3cc65ef515599b77a05 upstream.
pwm-tiehrpwm driver disables PWM output by putting it in low output
state via active AQCSFRC register in ehrpwm_pwm_disable(). But, the
AQCSFRC shadow register is not updated. Therefore, when shadow AQCSFRC
register is re-enabled in ehrpwm_pwm_enable() (say to enable second PWM
output), previous settings are lost as shadow register value is loaded
into active register. This results in things like PWMA getting enabled
automatically, when PWMB is enabled and vice versa. Fix this by
updating AQCSFRC shadow register as well during ehrpwm_pwm_disable().
Fixes:
19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
Cc: stable@vger.kernel.org
Signed-off-by: Vignesh R <vigneshr@ti.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Richard Weinberger [Mon, 11 Jun 2018 22:52:28 +0000 (00:52 +0200)]
ubifs: Fix synced_i_size calculation for xattr inodes
commit
59965593205fa4044850d35ee3557cf0b7edcd14 upstream.
In ubifs_jnl_update() we sync parent and child inodes to the flash,
in case of xattrs, the parent inode (AKA host inode) has a non-zero
data_len. Therefore we need to adjust synced_i_size too.
This issue was reported by ubifs self tests unter a xattr related work
load.
UBIFS error (ubi0:0 pid 1896): dbg_check_synced_i_size: ui_size is 4, synced_i_size is 0, but inode is clean
UBIFS error (ubi0:0 pid 1896): dbg_check_synced_i_size: i_ino 65, i_mode 0x81a4, i_size 4
Cc: <stable@vger.kernel.org>
Fixes:
1e51764a3c2a ("UBIFS: add new flash file system")
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Richard Weinberger [Sun, 1 Jul 2018 21:20:51 +0000 (23:20 +0200)]
ubifs: Check data node size before truncate
commit
95a22d2084d72ea067d8323cc85677dba5d97cae upstream.
Check whether the size is within bounds before using it.
If the size is not correct, abort and dump the bad data node.
Cc: Kees Cook <keescook@chromium.org>
Cc: Silvio Cesare <silvio.cesare@gmail.com>
Cc: stable@vger.kernel.org
Fixes:
1e51764a3c2ac ("UBIFS: add new flash file system")
Reported-by: Silvio Cesare <silvio.cesare@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Richard Weinberger [Sun, 1 Jul 2018 21:20:50 +0000 (23:20 +0200)]
Revert "UBIFS: Fix potential integer overflow in allocation"
commit
08acbdd6fd736b90f8d725da5a0de4de2dd6de62 upstream.
This reverts commit
353748a359f1821ee934afc579cf04572406b420.
It bypassed the linux-mtd review process and fixes the issue not as it
should.
Cc: Kees Cook <keescook@chromium.org>
Cc: Silvio Cesare <silvio.cesare@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Richard Weinberger [Tue, 12 Jun 2018 18:49:45 +0000 (20:49 +0200)]
ubifs: Fix memory leak in lprobs self-check
commit
eef19816ada3abd56d9f20c88794cc2fea83ebb2 upstream.
Allocate the buffer after we return early.
Otherwise memory is being leaked.
Cc: <stable@vger.kernel.org>
Fixes:
1e51764a3c2a ("UBIFS: add new flash file system")
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jann Horn [Mon, 25 Jun 2018 16:34:19 +0000 (18:34 +0200)]
userns: move user access out of the mutex
commit
5820f140edef111a9ea2ef414ab2428b8cb805b1 upstream.
The old code would hold the userns_state_mutex indefinitely if
memdup_user_nul stalled due to e.g. a userfault region. Prevent that by
moving the memdup_user_nul in front of the mutex_lock().
Note: This changes the error precedence of invalid buf/count/*ppos vs
map already written / capabilities missing.
Fixes:
22d917d80e84 ("userns: Rework the user_namespace adding uid/gid...")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Christian Brauner <christian@brauner.io>
Acked-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jann Horn [Mon, 25 Jun 2018 16:34:10 +0000 (18:34 +0200)]
sys: don't hold uts_sem while accessing userspace memory
commit
42a0cc3478584d4d63f68f2f5af021ddbea771fa upstream.
Holding uts_sem as a writer while accessing userspace memory allows a
namespace admin to stall all processes that attempt to take uts_sem.
Instead, move data through stack buffers and don't access userspace memory
while uts_sem is held.
Cc: stable@vger.kernel.org
Fixes:
1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Al Viro [Sun, 14 May 2017 01:39:49 +0000 (21:39 -0400)]
osf_getdomainname(): use copy_to_user()
commit
9ba3eb5103cf56f0daaf07de4507df76e7813ed7 upstream.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jacob Pan [Thu, 7 Jun 2018 16:57:00 +0000 (09:57 -0700)]
iommu/vt-d: Fix dev iotlb pfsid use
commit
1c48db44924298ad0cb5a6386b88017539be8822 upstream.
PFSID should be used in the invalidation descriptor for flushing
device IOTLBs on SRIOV VFs.
Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
Cc: stable@vger.kernel.org
Cc: "Ashok Raj" <ashok.raj@intel.com>
Cc: "Lu Baolu" <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jacob Pan [Thu, 7 Jun 2018 16:56:59 +0000 (09:56 -0700)]
iommu/vt-d: Add definitions for PFSID
commit
0f725561e168485eff7277d683405c05b192f537 upstream.
When SRIOV VF device IOTLB is invalidated, we need to provide
the PF source ID such that IOMMU hardware can gauge the depth
of invalidation queue which is shared among VFs. This is needed
when device invalidation throttle (DIT) capability is supported.
This patch adds bit definitions for checking and tracking PFSID.
Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
Cc: stable@vger.kernel.org
Cc: "Ashok Raj" <ashok.raj@intel.com>
Cc: "Lu Baolu" <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Zijlstra [Wed, 22 Aug 2018 15:30:14 +0000 (17:30 +0200)]
mm/tlb: Remove tlb_remove_table() non-concurrent condition
commit
a6f572084fbee8b30f91465f4a085d7a90901c57 upstream.
Will noted that only checking mm_users is incorrect; we should also
check mm_count in order to cover CPUs that have a lazy reference to
this mm (and could do speculative TLB operations).
If removing this turns out to be a performance issue, we can
re-instate a more complete check, but in tlb_table_flush() eliding the
call_rcu_sched().
Fixes:
267239116987 ("mm, powerpc: move the RCU page-table freeing into generic code")
Reported-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Rik van Riel <riel@surriel.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: David Miller <davem@davemloft.net>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jon Hunter [Tue, 3 Jul 2018 08:59:47 +0000 (09:59 +0100)]
ARM: tegra: Fix Tegra30 Cardhu PCA954x reset
commit
6e1811900b6fe6f2b4665dba6bd6ed32c6b98575 upstream.
On all versions of Tegra30 Cardhu, the reset signal to the NXP PCA9546
I2C mux is connected to the Tegra GPIO BB0. Currently, this pin on the
Tegra is not configured as a GPIO but as a special-function IO (SFIO)
that is multiplexing the pin to an I2S controller. On exiting system
suspend, I2C commands sent to the PCA9546 are failing because there is
no ACK. Although it is not possible to see exactly what is happening
to the reset during suspend, by ensuring it is configured as a GPIO
and driven high, to de-assert the reset, the failures are no longer
seen.
Please note that this GPIO is also used to drive the reset signal
going to the camera connector on the board. However, given that there
is no camera support currently for Cardhu, this should not have any
impact.
Fixes:
40431d16ff11 ("ARM: tegra: enable PCA9546 on Cardhu")
Cc: stable@vger.kernel.org
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Dan Carpenter [Wed, 4 Jul 2018 09:59:58 +0000 (12:59 +0300)]
pnfs/blocklayout: off by one in bl_map_stripe()
commit
0914bb965e38a055e9245637aed117efbe976e91 upstream.
"dev->nr_children" is the number of children which were parsed
successfully in bl_parse_stripe(). It could be all of them and then, in
that case, it is equal to v->stripe.volumes_count. Either way, the >
should be >= so that we don't go beyond the end of what we're supposed
to.
Fixes:
5c83746a0cf2 ("pnfs/blocklayout: in-kernel GETDEVICEINFO XDR parsing")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org # 3.17+
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>