OSDN Git Service
Linux Build Service Account [Sat, 9 Jun 2018 01:42:15 +0000 (18:42 -0700)]
Merge "drm: msm: Fix blue screen glitch problem on DSI"
Linux Build Service Account [Sat, 9 Jun 2018 01:42:14 +0000 (18:42 -0700)]
Merge "ais: sensor: fixing invalid address access issue during cci read"
Linux Build Service Account [Fri, 8 Jun 2018 17:20:26 +0000 (10:20 -0700)]
Merge "diag: Prevent accessing uninitialized diag_md_info member"
Linux Build Service Account [Fri, 8 Jun 2018 17:20:25 +0000 (10:20 -0700)]
Merge "q6asm: retry asm open in case of session id conflict"
Linux Build Service Account [Fri, 8 Jun 2018 17:20:24 +0000 (10:20 -0700)]
Merge "power: smb-lib: Modify usb max voltage reflected for QC 3.0 charger"
Linux Build Service Account [Fri, 8 Jun 2018 17:20:23 +0000 (10:20 -0700)]
Merge "ARM: SMMU: clear page table ops of attached device"
Manoj Prabhu B [Fri, 8 Jun 2018 07:11:15 +0000 (12:41 +0530)]
diag: Prevent accessing uninitialized diag_md_info member
The patch prevents accessing uninitialized diag_md_info
struct with a check on variable set only upon structure
initialization.
Change-Id: Ie0b5ece24fbacfabac876aa4bf2295354374ed57
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
Andy Sun [Thu, 7 Jun 2018 06:33:04 +0000 (14:33 +0800)]
ais: sensor: fixing invalid address access issue during cci read
Should use copy_to_user to pass data to userspace pointer.
Change-Id: Ide5fe1b1f4c76e5c75cfa634ac6913b0908e0d72
Signed-off-by: Andy Sun <bins@codeaurora.org>
jiad [Thu, 7 Jun 2018 03:34:00 +0000 (11:34 +0800)]
cnss2: Fix PCIe D3hot for WLAN suspend
Setting D3hot is newly added for Napier platform. And system hang is
observed on legacy Rome platform. In previous implementations for Rome
PCIe platforms, setting D3hot is not needed.
Fix is to not set D3hot for legacy platforms.
Change-Id: I1fce39eff4aa674553a214e7d0f99a81b0e6b93d
CRs-Fixed:
2255872
Signed-off-by: Jia Ding <jiad@codeaurora.org>
Gerrit - the friendly Code Review server [Thu, 7 Jun 2018 05:56:16 +0000 (22:56 -0700)]
Merge changes into msm-4.4
Umang Agrawal [Thu, 7 Jun 2018 04:10:30 +0000 (09:40 +0530)]
power: smb-lib: Modify usb max voltage reflected for QC 3.0 charger
Modify usb VOLTAGE_MAX property's reporting function to add support
for QC 3.0 chargers to reflect maximum VBUS voltage that can be attained
by QC3.0 chargers.
Change-Id: I45c15b4d8daab6eeec5c0bc5b0c19c4baa4ca15f
Signed-off-by: Umang Agrawal <uagrawal@codeaurora.org>
Linux Build Service Account [Wed, 6 Jun 2018 21:16:16 +0000 (14:16 -0700)]
Merge "soc: qcom: scm_qcpe: use uninterruptible habmm_socket_recv()"
Gerrit - the friendly Code Review server [Wed, 6 Jun 2018 20:58:49 +0000 (13:58 -0700)]
Merge changes into msm-4.4
Linux Build Service Account [Wed, 6 Jun 2018 13:27:44 +0000 (06:27 -0700)]
Merge "ARM: dts: msm: Add WLAN SSR support on msm8996 vplatform"
Linux Build Service Account [Wed, 6 Jun 2018 13:27:39 +0000 (06:27 -0700)]
Merge "mmc: sdhci-msm: Add boot marker"
Yong Ding [Mon, 4 Jun 2018 09:26:59 +0000 (17:26 +0800)]
soc: qcom: scm_qcpe: use uninterruptible habmm_socket_recv()
This is necessary to support scm call in system shutdown
procedure. With interruptible habmm_socket_recv(), it will
return immediately without blocking until the response
arrives.
Change-Id: Ia7ef95e4c6878a149ec373c8d2b5ae19a36f4125
Signed-off-by: Yong Ding <yongding@codeaurora.org>
Ferry Zhou [Tue, 5 Jun 2018 09:22:17 +0000 (17:22 +0800)]
ARM: dts: msm: Add WLAN SSR support on msm8996 vplatform
Add WLAN SSR support on msm8996 vplatform for Android GVM based
on the subsystem notification virtualization.
Change-Id: I5008b09053fff5866ab26c9558cf2fccafabd670
Signed-off-by: Ferry Zhou <tianguiz@codeaurora.org>
Linux Build Service Account [Wed, 6 Jun 2018 03:30:52 +0000 (20:30 -0700)]
Merge "ASoC: msm: Add mixer controls for module enabling"
Linux Build Service Account [Tue, 5 Jun 2018 18:30:47 +0000 (11:30 -0700)]
Merge "adv7481: Support 1080p60 in EDID"
Linux Build Service Account [Tue, 5 Jun 2018 09:26:46 +0000 (02:26 -0700)]
Merge "ARM: dts: msm: add wifi cnss ramdump support on msm8996 vplatform"
vkakani [Tue, 29 May 2018 10:11:04 +0000 (15:41 +0530)]
ARM: SMMU: clear page table ops of attached device
incase of error during dynamic attach,
added smmu attach device cleanup along with
free page table ops
Change-Id: Id8984d05002700014307a905fc7166702fa64a7d
Signed-off-by: vkakani <vkakani@codeaurora.org>
Linux Build Service Account [Mon, 4 Jun 2018 20:49:04 +0000 (13:49 -0700)]
Merge "usb: core: Resume the devices on pm restore"
Linux Build Service Account [Mon, 4 Jun 2018 20:49:03 +0000 (13:49 -0700)]
Merge "msm: pcie: change PCIe to suspend after suspend_noirq"
Suprith Malligere Shankaregowda [Tue, 29 May 2018 17:14:31 +0000 (22:44 +0530)]
adv7481: Support 1080p60 in EDID
Add 1080p60 support in EDID.
Change-Id: I03d3dacbf5af9fde519de66f9eb9c1ad24279d1c
Signed-off-by: Suprith Malligere Shankaregowda <supgow@codeaurora.org>
Linux Build Service Account [Mon, 4 Jun 2018 11:30:58 +0000 (04:30 -0700)]
Merge "qmp-phy: Power down PHY durng disconnect to avoid leakage"
Linux Build Service Account [Mon, 4 Jun 2018 11:30:57 +0000 (04:30 -0700)]
Merge "soc: qcom: boot_marker: add mpm timer interface"
Linux Build Service Account [Mon, 4 Jun 2018 11:30:56 +0000 (04:30 -0700)]
Merge "hbtp_inpu.c: add 800s power down uevent in suspend func"
Linux Build Service Account [Mon, 4 Jun 2018 11:30:54 +0000 (04:30 -0700)]
Merge "soc: qcom: hab: add performance test mechanism for HAB"
Vijayavardhan Vennapusa [Thu, 17 May 2018 12:26:01 +0000 (17:56 +0530)]
qmp-phy: Power down PHY durng disconnect to avoid leakage
Currently driver is not powering down QMP PHY if target is booted
up without cable connected. Due to this, 0.3mA leakage current is seen
during standby mode if power measured after bootup. Fix this by
putting QMP PHY in power down state during disconnect.
Change-Id: Idbf7e06ca14649797c50853cf3b9ee182f70749e
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Han Lu [Tue, 9 Jan 2018 12:24:47 +0000 (20:24 +0800)]
q6asm: retry asm open in case of session id conflict
The ADSP asm session ids are managed by the kernel driver. It's all right
for native use cases. But for virtualization use cases, there's no way to
synchronize the session ids' status among virtual machines. Playing back
in one virtual machine is probably failed, because the session id may had
been occupied by a use case in another virtual machine.
The patch allowed audio playback stream to try all available session ids
in case of session id conflict error, to support concurrent playback from
multiple virtual machines.
Change-Id: If98d05898cec3f05d80c750ec8a014add3b1f34c
Signed-off-by: Han Lu <hanlu@codeaurora.org>
Tony Truong [Sat, 21 Jan 2017 01:25:58 +0000 (17:25 -0800)]
msm: pcie: change PCIe to suspend after suspend_noirq
Some PCIe clients support suspend_noirq and need the PCIe
link to be up. Change PCIe to have its power down sequence
after clients suspend_noirq.
Change-Id: I32063f6adf795f8a49cd7d9fe340403ffaf6fd94
Signed-off-by: Tony Truong <truong@codeaurora.org>
Linux Build Service Account [Mon, 4 Jun 2018 02:10:46 +0000 (19:10 -0700)]
Merge "soc: msm: add size check to fix out of bounds on ANC"
Linux Build Service Account [Sat, 2 Jun 2018 08:13:34 +0000 (01:13 -0700)]
Merge "Merge android-4.4.133 (
3f51ea2) into msm-4.4"
Linux Build Service Account [Fri, 1 Jun 2018 21:39:22 +0000 (14:39 -0700)]
Merge "spi: spi_qsd: add boot marker"
Linux Build Service Account [Fri, 1 Jun 2018 21:39:20 +0000 (14:39 -0700)]
Merge "serial: msm_serial_hs: add boot marker"
Timothy Sham [Mon, 28 May 2018 21:17:41 +0000 (17:17 -0400)]
soc: msm: add size check to fix out of bounds on ANC
Before calling audio ANC ioctl functions, compare the
allocated buffer size to the size of the header and ANC cmd header
to ensure the buffer is big enough.
Change-Id: I8fcd0a830853d802bbb11fc243a4d392fbe384f3
Signed-off-by: Timothy Sham <tsham@codeaurora.org>
Linux Build Service Account [Fri, 1 Jun 2018 13:35:14 +0000 (06:35 -0700)]
Merge "ARM: dts: msm: remove USB3 device in msm8996-ivi-lv-mt vplatform"
Sriharsha Allenki [Thu, 17 May 2018 05:55:06 +0000 (11:25 +0530)]
usb: core: Resume the devices on pm restore
On system restoring from hibernation to reset-resume
the connected USB devices, resume the devices
on pm restore irrespective of the skip_resume
flag.
Change-Id: I56e46c579db572e39eabdc6d2be95b00f2c7d9cb
Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Sriharsha Allenki [Thu, 17 May 2018 06:04:11 +0000 (11:34 +0530)]
xhci-plat: Add hibernation support to xhci platform
Add hibernation support to xhci platform by adding
the proper PM ops freeze and restore.
Also set the hibernated argument to xhci_resume which
will trigger the reset-resume of the connected
root-hubs and the devices.
Change-Id: Ib536bb2485928326f34bfc3422b672cc62309efe
Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Sriharsha Allenki [Wed, 25 Apr 2018 13:43:44 +0000 (19:13 +0530)]
usb: dwc3: Add support for USB hibernation in host mode
Add support for hibernation of USB in host mode and
cable disconnected mode by adding proper pm operations
freeze and restore.
Change-Id: Ie1761a8afb0bb44a37d6ed4d046e8a09e1f53c5c
Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Zhiqiang Tu [Tue, 22 May 2018 07:44:52 +0000 (15:44 +0800)]
spi: spi_qsd: add boot marker
Add boot marker for booting KPI measurement
Change-Id: I8ba79f1b0e71e662ad20fcded128d43363e8302f
Signed-off-by: Zhiqiang Tu <ztu@codeaurora.org>
Zhiqiang Tu [Tue, 22 May 2018 07:34:41 +0000 (15:34 +0800)]
serial: msm_serial_hs: add boot marker
Add boot marker for booting KPI measurement.
Change-Id: Ia54411a901cc09493f2085af42c3a2188438e29d
Signed-off-by: Zhiqiang Tu <ztu@codeaurora.org>
Zhiqiang Tu [Fri, 1 Jun 2018 06:34:56 +0000 (14:34 +0800)]
soc: qcom: boot_marker: add mpm timer interface
Provide a debugfs interface to get count of mpm timer.
Change-Id: I24e927b6219b8bd4c2f4ddecb8f51518f0db663a
Signed-off-by: Zhiqiang Tu <ztu@codeaurora.org>
Yong Ding [Mon, 14 May 2018 04:58:35 +0000 (12:58 +0800)]
ARM: dts: msm: remove USB3 device in msm8996-ivi-lv-mt vplatform
In the latest multiple GVMs(Guest Virtual Machines)
environment, USB3 is expected to be used by LA GVM with
the passthrough mode. So it is necessary to remove its
access from LV GVM, or there will be conflict.
Change-Id: I8409a81a636ca38e64b8e00e25170c064549dc61
Signed-off-by: Yong Ding <yongding@codeaurora.org>
Linux Build Service Account [Thu, 31 May 2018 23:44:27 +0000 (16:44 -0700)]
Merge "defconfig: msm: Enable CONFIG_CGROUP_DEBUG"
Linux Build Service Account [Thu, 31 May 2018 12:11:46 +0000 (05:11 -0700)]
Merge "adv7481: Add support for AVI Infoframe"
Linux Build Service Account [Thu, 31 May 2018 12:11:45 +0000 (05:11 -0700)]
Merge "soc: qcom: scm_qcpe: Close hab socket on error"
Linux Build Service Account [Thu, 31 May 2018 12:11:44 +0000 (05:11 -0700)]
Merge "selinux: KASAN: slab-out-of-bounds in xattr_getsecurity"
Linux Build Service Account [Thu, 31 May 2018 12:11:43 +0000 (05:11 -0700)]
Merge "defconfig: msm: Disable config EXT2_FS and EXT3_FS for sdm660"
Linux Build Service Account [Thu, 31 May 2018 12:11:41 +0000 (05:11 -0700)]
Merge "soc: qcom: boot_stats: Fix compilation issue"
Linux Build Service Account [Thu, 31 May 2018 12:11:40 +0000 (05:11 -0700)]
Merge "ARM: dts: msm: Add support for new speed bin for SDM660"
Linux Build Service Account [Thu, 31 May 2018 12:11:39 +0000 (05:11 -0700)]
Merge "clk: qcom: Add support for 585MHz GPU frequency"
Linux Build Service Account [Thu, 31 May 2018 12:11:33 +0000 (05:11 -0700)]
Merge "audit: Checks valid value of audit_signals and tsk->audit_context"
Linux Build Service Account [Thu, 31 May 2018 12:11:29 +0000 (05:11 -0700)]
Merge "defconfig: Sync automotive gvm defconfig with metal defconfig"
Linux Build Service Account [Thu, 31 May 2018 12:11:26 +0000 (05:11 -0700)]
Merge "defconfig: reduce HZ value from 250 to 100"
Srinivasarao P [Tue, 29 May 2018 07:08:25 +0000 (12:38 +0530)]
defconfig: msm: Enable CONFIG_CGROUP_DEBUG
Enable CONFIG_CGROUP_DEBUG to address the compatibility issue with
AOSP.
Change-Id: I30aa2341535bc53982034e7f8ef430137c102177
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Srinivasarao P [Tue, 29 May 2018 06:41:09 +0000 (12:11 +0530)]
Merge android-4.4.133 (
3f51ea2) into msm-4.4
* refs/heads/tmp-
3f51ea2
Linux 4.4.133
x86/kexec: Avoid double free_page() upon do_kexec_load() failure
hfsplus: stop workqueue when fill_super() failed
cfg80211: limit wiphy names to 128 bytes
gpio: rcar: Add Runtime PM handling for interrupts
time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting
dmaengine: ensure dmaengine helpers check valid callback
scsi: zfcp: fix infinite iteration on ERP ready list
scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()
scsi: libsas: defer ata device eh commands to libata
s390: use expoline thunks in the BPF JIT
s390: extend expoline to BC instructions
s390: move spectre sysfs attribute code
s390/kernel: use expoline for indirect branches
s390/lib: use expoline for indirect branches
s390: move expoline assembler macros to a header
s390: add assembler macros for CPU alternatives
ext2: fix a block leak
tcp: purge write queue in tcp_connect_init()
sock_diag: fix use-after-free read in __sk_free
packet: in packet_snd start writing at link layer allocation
net: test tailroom before appending to linear skb
btrfs: fix reading stale metadata blocks after degraded raid1 mounts
btrfs: fix crash when trying to resume balance without the resume flag
Btrfs: fix xattr loss after power failure
ARM: 8772/1: kprobes: Prohibit kprobes on get_user functions
ARM: 8770/1: kprobes: Prohibit probing on optimized_callback
ARM: 8769/1: kprobes: Fix to use get_kprobe_ctlblk after irq-disabed
tick/broadcast: Use for_each_cpu() specially on UP kernels
ARM: 8771/1: kprobes: Prohibit kprobes on do_undefinstr
efi: Avoid potential crashes, fix the 'struct efi_pci_io_protocol_32' definition for mixed mode
s390: remove indirect branch from do_softirq_own_stack
s390/qdio: don't release memory in qdio_setup_irq()
s390/cpum_sf: ensure sample frequency of perf event attributes is non-zero
s390/qdio: fix access to uninitialized qdio_q fields
mm: don't allow deferred pages with NEED_PER_CPU_KM
powerpc/powernv: Fix NVRAM sleep in invalid context when crashing
procfs: fix pthread cross-thread naming if !PR_DUMPABLE
proc read mm's {arg,env}_{start,end} with mmap semaphore taken.
tracing/x86/xen: Remove zero data size trace events trace_xen_mmu_flush_tlb{_all}
cpufreq: intel_pstate: Enable HWP by default
signals: avoid unnecessary taking of sighand->siglock
mm: filemap: avoid unnecessary calls to lock_page when waiting for IO to complete during a read
mm: filemap: remove redundant code in do_read_cache_page
proc: meminfo: estimate available memory more conservatively
vmscan: do not force-scan file lru if its absolute size is small
powerpc: Don't preempt_disable() in show_cpuinfo()
cpuidle: coupled: remove unused define cpuidle_coupled_lock
powerpc/powernv: remove FW_FEATURE_OPALv3 and just use FW_FEATURE_OPAL
powerpc/powernv: Remove OPALv2 firmware define and references
powerpc/powernv: panic() on OPAL < V3
spi: pxa2xx: Allow 64-bit DMA
ALSA: control: fix a redundant-copy issue
ALSA: hda: Add Lenovo C50 All in one to the power_save blacklist
ALSA: usb: mixer: volume quirk for CM102-A+/102S+
usbip: usbip_host: fix bad unlock balance during stub_probe()
usbip: usbip_host: fix NULL-ptr deref and use-after-free errors
usbip: usbip_host: run rebind from exit when module is removed
usbip: usbip_host: delete device from busid_table after rebind
usbip: usbip_host: refine probe and disconnect debug msgs to be useful
kernel/exit.c: avoid undefined behaviour when calling wait4()
futex: futex_wake_op, fix sign_extend32 sign bits
pipe: cap initial pipe capacity according to pipe-max-size limit
l2tp: revert "l2tp: fix missing print session offset info"
Revert "ARM: dts: imx6qdl-wandboard: Fix audio channel swap"
lockd: lost rollback of set_grace_period() in lockd_down_net()
xfrm: fix xfrm_do_migrate() with AEAD e.g(AES-GCM)
futex: Remove duplicated code and fix undefined behaviour
futex: Remove unnecessary warning from get_futex_key
arm64: Add work around for Arm Cortex-A55 Erratum
1024718
arm64: introduce mov_q macro to move a constant into a 64-bit register
audit: move calcs after alloc and check when logging set loginuid
ALSA: timer: Call notifier in the same spinlock
sctp: delay the authentication for the duplicated cookie-echo chunk
sctp: fix the issue that the cookie-ack with auth can't get processed
tcp: ignore Fast Open on repair mode
bonding: do not allow rlb updates to invalid mac
tg3: Fix vunmap() BUG_ON() triggered from tg3_free_consistent().
sctp: use the old asoc when making the cookie-ack chunk in dupcook_d
sctp: handle two v4 addrs comparison in sctp_inet6_cmp_addr
r8169: fix powering up RTL8168h
qmi_wwan: do not steal interfaces from class drivers
openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found
net: support compat 64-bit time in {s,g}etsockopt
net_sched: fq: take care of throttled flows before reuse
net/mlx4_en: Verify coalescing parameters are in range
net: ethernet: sun: niu set correct packet size in skb
llc: better deal with too small mtu
ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg
dccp: fix tasklet usage
bridge: check iface upper dev when setting master via ioctl
8139too: Use disable_irq_nosync() in rtl8139_poll_controller()
BACKPORT, FROMLIST: fscrypt: add Speck128/256 support
cgroup: Disable IRQs while holding css_set_lock
Revert "cgroup: Disable IRQs while holding css_set_lock"
cgroup: Disable IRQs while holding css_set_lock
ANDROID: proc: fix undefined behavior in proc_uid_base_readdir
x86: vdso: Fix leaky vdso linker with CC=clang.
ANDROID: build: cuttlefish: Upgrade clang to newer version.
ANDROID: build: cuttlefish: Upgrade clang to newer version.
ANDROID: build: cuttlefish: Fix path to clang.
UPSTREAM: dm bufio: avoid sleeping while holding the dm_bufio lock
ANDROID: sdcardfs: Don't d_drop in d_revalidate
Conflicts:
arch/arm64/include/asm/cputype.h
fs/ext4/crypto.c
fs/ext4/ext4.h
kernel/cgroup.c
mm/vmscan.c
Change-Id: Ic10c5722b6439af1cf423fd949c493f786764d7e
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Sachin Grover [Thu, 24 May 2018 17:18:55 +0000 (22:48 +0530)]
selinux: KASAN: slab-out-of-bounds in xattr_getsecurity
Call trace:
[<
ffffff9203a8d7a8>] dump_backtrace+0x0/0x428
[<
ffffff9203a8dbf8>] show_stack+0x28/0x38
[<
ffffff920409bfb8>] dump_stack+0xd4/0x124
[<
ffffff9203d187e8>] print_address_description+0x68/0x258
[<
ffffff9203d18c00>] kasan_report.part.2+0x228/0x2f0
[<
ffffff9203d1927c>] kasan_report+0x5c/0x70
[<
ffffff9203d1776c>] check_memory_region+0x12c/0x1c0
[<
ffffff9203d17cdc>] memcpy+0x34/0x68
[<
ffffff9203d75348>] xattr_getsecurity+0xe0/0x160
[<
ffffff9203d75490>] vfs_getxattr+0xc8/0x120
[<
ffffff9203d75d68>] getxattr+0x100/0x2c8
[<
ffffff9203d76fb4>] SyS_fgetxattr+0x64/0xa0
[<
ffffff9203a83f70>] el0_svc_naked+0x24/0x28
If user get root access and calls security.selinux setxattr() with an
embedded NUL on a file and then if some process performs a getxattr()
on that file with a length greater than the actual length of the string,
it would result in a panic.
To fix this, add the actual length of the string to the security context
instead of the length passed by the userspace process.
Change-Id: Ie0b8bfc7c96bc12282b955fb3adf41b3c2d011cd
Signed-off-by: Sachin Grover <sgrover@codeaurora.org>
Suprith Malligere Shankaregowda [Tue, 22 May 2018 19:41:23 +0000 (01:11 +0530)]
adv7481: Add support for AVI Infoframe
AVI Infoframe provides the aspect ratio and video
identification code information. Add support to read
this from ADV7481 registers and to return it to user space
through an ioctl call.
Change-Id: Ia64fbc736b548633b34a9bd96f7a78700afb3db5
Signed-off-by: Suprith Malligere Shankaregowda <supgow@codeaurora.org>
Linux Build Service Account [Thu, 31 May 2018 04:10:30 +0000 (21:10 -0700)]
Merge "mmc: card: Update multi_cmd_ioctl path to support cmdq"
Linux Build Service Account [Wed, 30 May 2018 17:21:01 +0000 (10:21 -0700)]
Merge "drm: sde: Check commit's validity when starting splash handoff"
Amit Blay [Wed, 30 May 2018 15:08:45 +0000 (18:08 +0300)]
soc: qcom: scm_qcpe: Close hab socket on error
Close the open hab socket after receiving an error status from
the hab.
Change-Id: Ia56c7ce49d0e61661c9f133d35540e48f3707e01
Signed-off-by: Amit Blay <ablay@codeaurora.org>
Taniya Das [Tue, 24 Apr 2018 09:12:07 +0000 (14:42 +0530)]
ARM: dts: msm: Add support for new speed bin for SDM660
New cpu speed bin of 4 is added to support 1.9/1.8GHz.
Change-Id: Ic0dffc7c46e82748bf9f40de7f478ec073142dd1
Signed-off-by: Taniya Das <tdas@codeaurora.org>
Taniya Das [Tue, 24 Apr 2018 09:10:08 +0000 (14:40 +0530)]
clk: qcom: Add support for 585MHz GPU frequency
On SDM660 there is a new frequency requirement of 585MHz, so add support
for the same.
Change-Id: I9b55b18d6befdc8f5a7d9dac6bcb832eda338497
Signed-off-by: Taniya Das <tdas@codeaurora.org>
Zhiqiang Tu [Wed, 30 May 2018 08:51:56 +0000 (16:51 +0800)]
soc: qcom: boot_stats: Fix compilation issue
Fix the multiple definition issue of msm_timer_get_sclk_ticks
when CONFIG_MSM_BOOT_STATS is disabled.
Change-Id: Id2c263c48cec038be4354894fa57b203a5f764c6
Signed-off-by: Zhiqiang Tu <ztu@codeaurora.org>
Chetan C R [Tue, 15 May 2018 12:38:38 +0000 (18:08 +0530)]
audit: Checks valid value of audit_signals and tsk->audit_context
There can be a case when current task's audit context
may be NULL or even if it is not NULL, it can have
invalid non-zero value of dummy variable and also
we should audit the signal only if we have non-zero
value of audit_signals.
Issue has been seen during power on/off tests. So
better to add explicit check on these variables.
Change-Id: I2f3e17d933fca8e3b8f4013f44f942f11c68f440
Signed-off-by: Chetan C R <cravin@codeaurora.org>
Lei wang [Tue, 22 May 2018 09:45:25 +0000 (17:45 +0800)]
defconfig: Sync automotive gvm defconfig with metal defconfig
Sync automotive gvm defconfig with metal, cleanup some unused config
Change-Id: Ic0f6f5e1d274692886da237f52c13b587e43a779
Signed-off-by: Lei wang <leiwan@codeaurora.org>
Linux Build Service Account [Tue, 29 May 2018 20:57:07 +0000 (13:57 -0700)]
Merge "msm: kgsl: Don't dump GPMU registers on non GPMU devices"
Linux Build Service Account [Tue, 29 May 2018 12:07:37 +0000 (05:07 -0700)]
Merge "ASoC: msm: add boot marker for mi2s and auto sound card"
Veerabhadrarao Badiganti [Mon, 16 Apr 2018 15:23:33 +0000 (20:53 +0530)]
mmc: card: Update multi_cmd_ioctl path to support cmdq
Halt cmdq in multi_cmd_ioctl path before processing IOCTL
commands and un-halt it once it has done with IOCTL processing.
Without this change, the mmc driver would try to process legacy
commands when host & card are in cmdq mode which may result
in unexpected interrupt / illegal command errors.
Change-Id: I254a1a752f770ffd03331c4856aa9f54867092dc
Signed-off-by: Veerabhadrarao Badiganti <vbadigan@codeaurora.org>
Linux Build Service Account [Sun, 27 May 2018 16:11:15 +0000 (09:11 -0700)]
Merge "defconfig: msm: enable lpass resource mgr for msm8996-auto"
Linux Build Service Account [Sun, 27 May 2018 16:11:14 +0000 (09:11 -0700)]
Merge "ARM: dts: msm: add lpass resource mgr on automotive msm8996"
Linux Build Service Account [Sun, 27 May 2018 16:11:12 +0000 (09:11 -0700)]
Merge "defconfig: msm: enable Sensor DSP framework"
Rahul Sharma [Thu, 17 May 2018 11:28:47 +0000 (16:58 +0530)]
ASoC: msm: Add mixer controls for module enabling
Mixer controls are added to enable or disable
ADSP modules.
Change-Id: Ia2471c3fc25429001ccf19d6b30d34d6e2cf9d27
Signed-off-by: Rahul Sharma <rahsha@codeaurora.org>
Linux Build Service Account [Sun, 27 May 2018 09:06:58 +0000 (02:06 -0700)]
Merge "msm: ipa: fix to not allow NAT DMA command without device initialization"
Linux Build Service Account [Sat, 26 May 2018 20:26:54 +0000 (13:26 -0700)]
Merge "defconfig: msmcortex: Enable INET_UDP_DIAG"
Linux Build Service Account [Sat, 26 May 2018 20:26:53 +0000 (13:26 -0700)]
Merge "defconfig: sdm660: Enable INET_UDP_DIAG"
Linux Build Service Account [Sat, 26 May 2018 20:26:52 +0000 (13:26 -0700)]
Merge "asoc: msm8998: Add configuration for adaptive bitrate."
Mohammed Javid [Fri, 11 May 2018 08:24:54 +0000 (13:54 +0530)]
msm: ipa: fix to not allow NAT DMA command without device initialization
Without NAT device initialization sending NAT DMA
commands leads to XPU violation. Added checks to
verify device initialized or not before sending DMA
command.
Change-Id: I7440abc14a81e1621573f0e2808a410d60b2458d
Acked-by: Ashok Vuyyuru <avuyyuru@qti.qualcomm.com>
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>
Greg Kroah-Hartman [Sat, 26 May 2018 08:12:26 +0000 (10:12 +0200)]
Merge 4.4.133 into android-4.4
Changes in 4.4.133
8139too: Use disable_irq_nosync() in rtl8139_poll_controller()
bridge: check iface upper dev when setting master via ioctl
dccp: fix tasklet usage
ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg
llc: better deal with too small mtu
net: ethernet: sun: niu set correct packet size in skb
net/mlx4_en: Verify coalescing parameters are in range
net_sched: fq: take care of throttled flows before reuse
net: support compat 64-bit time in {s,g}etsockopt
openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found
qmi_wwan: do not steal interfaces from class drivers
r8169: fix powering up RTL8168h
sctp: handle two v4 addrs comparison in sctp_inet6_cmp_addr
sctp: use the old asoc when making the cookie-ack chunk in dupcook_d
tg3: Fix vunmap() BUG_ON() triggered from tg3_free_consistent().
bonding: do not allow rlb updates to invalid mac
tcp: ignore Fast Open on repair mode
sctp: fix the issue that the cookie-ack with auth can't get processed
sctp: delay the authentication for the duplicated cookie-echo chunk
ALSA: timer: Call notifier in the same spinlock
audit: move calcs after alloc and check when logging set loginuid
arm64: introduce mov_q macro to move a constant into a 64-bit register
arm64: Add work around for Arm Cortex-A55 Erratum
1024718
futex: Remove unnecessary warning from get_futex_key
futex: Remove duplicated code and fix undefined behaviour
xfrm: fix xfrm_do_migrate() with AEAD e.g(AES-GCM)
lockd: lost rollback of set_grace_period() in lockd_down_net()
Revert "ARM: dts: imx6qdl-wandboard: Fix audio channel swap"
l2tp: revert "l2tp: fix missing print session offset info"
pipe: cap initial pipe capacity according to pipe-max-size limit
futex: futex_wake_op, fix sign_extend32 sign bits
kernel/exit.c: avoid undefined behaviour when calling wait4()
usbip: usbip_host: refine probe and disconnect debug msgs to be useful
usbip: usbip_host: delete device from busid_table after rebind
usbip: usbip_host: run rebind from exit when module is removed
usbip: usbip_host: fix NULL-ptr deref and use-after-free errors
usbip: usbip_host: fix bad unlock balance during stub_probe()
ALSA: usb: mixer: volume quirk for CM102-A+/102S+
ALSA: hda: Add Lenovo C50 All in one to the power_save blacklist
ALSA: control: fix a redundant-copy issue
spi: pxa2xx: Allow 64-bit DMA
powerpc/powernv: panic() on OPAL < V3
powerpc/powernv: Remove OPALv2 firmware define and references
powerpc/powernv: remove FW_FEATURE_OPALv3 and just use FW_FEATURE_OPAL
cpuidle: coupled: remove unused define cpuidle_coupled_lock
powerpc: Don't preempt_disable() in show_cpuinfo()
vmscan: do not force-scan file lru if its absolute size is small
proc: meminfo: estimate available memory more conservatively
mm: filemap: remove redundant code in do_read_cache_page
mm: filemap: avoid unnecessary calls to lock_page when waiting for IO to complete during a read
signals: avoid unnecessary taking of sighand->siglock
cpufreq: intel_pstate: Enable HWP by default
tracing/x86/xen: Remove zero data size trace events trace_xen_mmu_flush_tlb{_all}
proc read mm's {arg,env}_{start,end} with mmap semaphore taken.
procfs: fix pthread cross-thread naming if !PR_DUMPABLE
powerpc/powernv: Fix NVRAM sleep in invalid context when crashing
mm: don't allow deferred pages with NEED_PER_CPU_KM
s390/qdio: fix access to uninitialized qdio_q fields
s390/cpum_sf: ensure sample frequency of perf event attributes is non-zero
s390/qdio: don't release memory in qdio_setup_irq()
s390: remove indirect branch from do_softirq_own_stack
efi: Avoid potential crashes, fix the 'struct efi_pci_io_protocol_32' definition for mixed mode
ARM: 8771/1: kprobes: Prohibit kprobes on do_undefinstr
tick/broadcast: Use for_each_cpu() specially on UP kernels
ARM: 8769/1: kprobes: Fix to use get_kprobe_ctlblk after irq-disabed
ARM: 8770/1: kprobes: Prohibit probing on optimized_callback
ARM: 8772/1: kprobes: Prohibit kprobes on get_user functions
Btrfs: fix xattr loss after power failure
btrfs: fix crash when trying to resume balance without the resume flag
btrfs: fix reading stale metadata blocks after degraded raid1 mounts
net: test tailroom before appending to linear skb
packet: in packet_snd start writing at link layer allocation
sock_diag: fix use-after-free read in __sk_free
tcp: purge write queue in tcp_connect_init()
ext2: fix a block leak
s390: add assembler macros for CPU alternatives
s390: move expoline assembler macros to a header
s390/lib: use expoline for indirect branches
s390/kernel: use expoline for indirect branches
s390: move spectre sysfs attribute code
s390: extend expoline to BC instructions
s390: use expoline thunks in the BPF JIT
scsi: libsas: defer ata device eh commands to libata
scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()
scsi: zfcp: fix infinite iteration on ERP ready list
dmaengine: ensure dmaengine helpers check valid callback
time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting
gpio: rcar: Add Runtime PM handling for interrupts
cfg80211: limit wiphy names to 128 bytes
hfsplus: stop workqueue when fill_super() failed
x86/kexec: Avoid double free_page() upon do_kexec_load() failure
Linux 4.4.133
Change-Id: I0554b12889bc91add2a444da95f18d59c6fb9cdb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Greg Kroah-Hartman [Sat, 26 May 2018 06:49:01 +0000 (08:49 +0200)]
Linux 4.4.133
Tetsuo Handa [Wed, 9 May 2018 10:42:20 +0000 (19:42 +0900)]
x86/kexec: Avoid double free_page() upon do_kexec_load() failure
commit
a466ef76b815b86748d9870ef2a430af7b39c710 upstream.
>From
ff82bedd3e12f0d3353282054ae48c3bd8c72012 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date: Wed, 9 May 2018 12:12:39 +0900
Subject: x86/kexec: Avoid double free_page() upon do_kexec_load() failure
syzbot is reporting crashes after memory allocation failure inside
do_kexec_load() [1]. This is because free_transition_pgtable() is called
by both init_transition_pgtable() and machine_kexec_cleanup() when memory
allocation failed inside init_transition_pgtable().
Regarding 32bit code, machine_kexec_free_page_tables() is called by both
machine_kexec_alloc_page_tables() and machine_kexec_cleanup() when memory
allocation failed inside machine_kexec_alloc_page_tables().
Fix this by leaving the error handling to machine_kexec_cleanup()
(and optionally setting NULL after free_page()).
[1] https://syzkaller.appspot.com/bug?id=
91e52396168cf2bdd572fe1e1bc0bc645c1c6b40
Fixes:
f5deb79679af6eb4 ("x86: kexec: Use one page table in x86_64 machine_kexec")
Fixes:
92be3d6bdf2cb349 ("kexec/i386: allocate page table pages dynamically")
Reported-by: syzbot <syzbot+d96f60296ef613fe1d69@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Baoquan He <bhe@redhat.com>
Cc: thomas.lendacky@amd.com
Cc: prudo@linux.vnet.ibm.com
Cc: Huang Ying <ying.huang@intel.com>
Cc: syzkaller-bugs@googlegroups.com
Cc: takahiro.akashi@linaro.org
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: akpm@linux-foundation.org
Cc: dyoung@redhat.com
Cc: kirill.shutemov@linux.intel.com
Link: https://lkml.kernel.org/r/201805091942.DGG12448.tMFVFSJFQOOLHO@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Tetsuo Handa [Fri, 18 May 2018 23:09:16 +0000 (16:09 -0700)]
hfsplus: stop workqueue when fill_super() failed
commit
66072c29328717072fd84aaff3e070e3f008ba77 upstream.
syzbot is reporting ODEBUG messages at hfsplus_fill_super() [1]. This
is because hfsplus_fill_super() forgot to call cancel_delayed_work_sync().
As far as I can see, it is hfsplus_mark_mdb_dirty() from
hfsplus_new_inode() in hfsplus_fill_super() that calls
queue_delayed_work(). Therefore, I assume that hfsplus_new_inode() does
not fail if queue_delayed_work() was called, and the out_put_hidden_dir
label is the appropriate location to call cancel_delayed_work_sync().
[1] https://syzkaller.appspot.com/bug?id=
a66f45e96fdbeb76b796bf46eb25ea878c42a6c9
Link: http://lkml.kernel.org/r/964a8b27-cd69-357c-fe78-76b066056201@I-love.SAKURA.ne.jp
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: syzbot <syzbot+4f2e5f086147d543ab03@syzkaller.appspotmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: David Howells <dhowells@redhat.com>
Cc: Ernesto A. Fernandez <ernesto.mnd.fernandez@gmail.com>
Cc: Vyacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Johannes Berg [Tue, 3 Apr 2018 12:33:49 +0000 (14:33 +0200)]
cfg80211: limit wiphy names to 128 bytes
commit
a7cfebcb7594a24609268f91299ab85ba064bf82 upstream.
There's currently no limit on wiphy names, other than netlink
message size and memory limitations, but that causes issues when,
for example, the wiphy name is used in a uevent, e.g. in rfkill
where we use the same name for the rfkill instance, and then the
buffer there is "only" 2k for the environment variables.
This was reported by syzkaller, which used a 4k name.
Limit the name to something reasonable, I randomly picked 128.
Reported-by: syzbot+230d9e642a85d3fec29c@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Geert Uytterhoeven [Thu, 18 Feb 2016 16:06:30 +0000 (17:06 +0100)]
gpio: rcar: Add Runtime PM handling for interrupts
commit
b26a719bdba9aa926ceaadecc66e07623d2b8a53 upstream.
The R-Car GPIO driver handles Runtime PM for requested GPIOs only.
When using a GPIO purely as an interrupt source, no Runtime PM handling
is done, and the GPIO module's clock may not be enabled.
To fix this:
- Add .irq_request_resources() and .irq_release_resources() callbacks
to handle Runtime PM when an interrupt is requested,
- Add irq_bus_lock() and sync_unlock() callbacks to handle Runtime PM
when e.g. disabling/enabling an interrupt, or configuring the
interrupt type.
Fixes:
d5c3d84657db57bd "net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS"
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
[fabrizio: cherry-pick to v4.4.y. Use container_of instead of
gpiochip_get_data.]
Signed-off-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
Reviewed-by: Biju Das <biju.das@bp.renesas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
John Stultz [Thu, 8 Jun 2017 23:44:21 +0000 (16:44 -0700)]
time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting
commit
3d88d56c5873f6eebe23e05c3da701960146b801 upstream.
Due to how the MONOTONIC_RAW accumulation logic was handled,
there is the potential for a 1ns discontinuity when we do
accumulations. This small discontinuity has for the most part
gone un-noticed, but since ARM64 enabled CLOCK_MONOTONIC_RAW
in their vDSO clock_gettime implementation, we've seen failures
with the inconsistency-check test in kselftest.
This patch addresses the issue by using the same sub-ns
accumulation handling that CLOCK_MONOTONIC uses, which avoids
the issue for in-kernel users.
Since the ARM64 vDSO implementation has its own clock_gettime
calculation logic, this patch reduces the frequency of errors,
but failures are still seen. The ARM64 vDSO will need to be
updated to include the sub-nanosecond xtime_nsec values in its
calculation for this issue to be completely fixed.
Signed-off-by: John Stultz <john.stultz@linaro.org>
Tested-by: Daniel Mentz <danielmentz@google.com>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Kevin Brodsky <kevin.brodsky@arm.com>
Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Stephen Boyd <stephen.boyd@linaro.org>
Cc: Will Deacon <will.deacon@arm.com>
Cc: "stable #4 . 8+" <stable@vger.kernel.org>
Cc: Miroslav Lichvar <mlichvar@redhat.com>
Link: http://lkml.kernel.org/r/1496965462-20003-3-git-send-email-john.stultz@linaro.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[fabrizio: cherry-pick to 4.4. Kept cycle_t type for function
logarithmic_accumulation local variable "interval". Dropped
casting of "interval" variable]
Signed-off-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
Signed-off-by: Biju Das <biju.das@bp.renesas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Vinod Koul [Tue, 12 Apr 2016 15:37:06 +0000 (21:07 +0530)]
dmaengine: ensure dmaengine helpers check valid callback
commit
757d12e5849be549076901b0d33c60d5f360269c upstream.
dmaengine has various device callbacks and exposes helper
functions to invoke these. These helpers should check if channel,
device and callback is valid or not before invoking them.
Reported-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
Signed-off-by: Jianming Qiao <jianming.qiao@bp.renesas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jens Remus [Thu, 3 May 2018 11:52:47 +0000 (13:52 +0200)]
scsi: zfcp: fix infinite iteration on ERP ready list
commit
fa89adba1941e4f3b213399b81732a5c12fd9131 upstream.
zfcp_erp_adapter_reopen() schedules blocking of all of the adapter's
rports via zfcp_scsi_schedule_rports_block() and enqueues a reopen
adapter ERP action via zfcp_erp_action_enqueue(). Both are separately
processed asynchronously and concurrently.
Blocking of rports is done in a kworker by zfcp_scsi_rport_work(). It
calls zfcp_scsi_rport_block(), which then traces a DBF REC "scpdely" via
zfcp_dbf_rec_trig(). zfcp_dbf_rec_trig() acquires the DBF REC spin lock
and then iterates with list_for_each() over the adapter's ERP ready list
without holding the ERP lock. This opens a race window in which the
current list entry can be moved to another list, causing list_for_each()
to iterate forever on the wrong list, as the erp_ready_head is never
encountered as terminal condition.
Meanwhile the ERP action can be processed in the ERP thread by
zfcp_erp_thread(). It calls zfcp_erp_strategy(), which acquires the ERP
lock and then calls zfcp_erp_action_to_running() to move the ERP action
from the ready to the running list. zfcp_erp_action_to_running() can
move the ERP action using list_move() just during the aforementioned
race window. It then traces a REC RUN "erator1" via zfcp_dbf_rec_run().
zfcp_dbf_rec_run() tries to acquire the DBF REC spin lock. If this is
held by the infinitely looping kworker, it effectively spins forever.
Example Sequence Diagram:
Process ERP Thread rport_work
------------------- ------------------- -------------------
zfcp_erp_adapter_reopen()
zfcp_erp_adapter_block()
zfcp_scsi_schedule_rports_block()
lock ERP zfcp_scsi_rport_work()
zfcp_erp_action_enqueue(ZFCP_ERP_ACTION_REOPEN_ADAPTER)
list_add_tail() on ready !(rport_task==RPORT_ADD)
wake_up() ERP thread zfcp_scsi_rport_block()
zfcp_dbf_rec_trig() zfcp_erp_strategy() zfcp_dbf_rec_trig()
unlock ERP lock DBF REC
zfcp_erp_wait() lock ERP
| zfcp_erp_action_to_running()
| list_for_each() ready
| list_move() current entry
| ready to running
| zfcp_dbf_rec_run() endless loop over running
| zfcp_dbf_rec_run_lvl()
| lock DBF REC spins forever
Any adapter recovery can trigger this, such as setting the device offline
or reboot.
V4.9 commit
4eeaa4f3f1d6 ("zfcp: close window with unblocked rport
during rport gone") introduced additional tracing of (un)blocking of
rports. It missed that the adapter->erp_lock must be held when calling
zfcp_dbf_rec_trig().
This fix uses the approach formerly introduced by commit
aa0fec62391c
("[SCSI] zfcp: Fix sparse warning by providing new entry in dbf") that got
later removed by commit
ae0904f60fab ("[SCSI] zfcp: Redesign of the debug
tracing for recovery actions.").
Introduce zfcp_dbf_rec_trig_lock(), a wrapper for zfcp_dbf_rec_trig() that
acquires and releases the adapter->erp_lock for read.
Reported-by: Sebastian Ott <sebott@linux.ibm.com>
Signed-off-by: Jens Remus <jremus@linux.ibm.com>
Fixes:
4eeaa4f3f1d6 ("zfcp: close window with unblocked rport during rport gone")
Cc: <stable@vger.kernel.org> # 2.6.32+
Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Alexander Potapenko [Fri, 18 May 2018 14:23:18 +0000 (16:23 +0200)]
scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()
commit
a45b599ad808c3c982fdcdc12b0b8611c2f92824 upstream.
This shall help avoid copying uninitialized memory to the userspace when
calling ioctl(fd, SG_IO) with an empty command.
Reported-by: syzbot+7d26fc1eea198488deab@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Alexander Potapenko <glider@google.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jason Yan [Thu, 8 Mar 2018 02:34:53 +0000 (10:34 +0800)]
scsi: libsas: defer ata device eh commands to libata
commit
318aaf34f1179b39fa9c30fa0f3288b645beee39 upstream.
When ata device doing EH, some commands still attached with tasks are
not passed to libata when abort failed or recover failed, so libata did
not handle these commands. After these commands done, sas task is freed,
but ata qc is not freed. This will cause ata qc leak and trigger a
warning like below:
WARNING: CPU: 0 PID: 28512 at drivers/ata/libata-eh.c:4037
ata_eh_finish+0xb4/0xcc
CPU: 0 PID: 28512 Comm: kworker/u32:2 Tainted: G W OE 4.14.0#1
......
Call trace:
[<
ffff0000088b7bd0>] ata_eh_finish+0xb4/0xcc
[<
ffff0000088b8420>] ata_do_eh+0xc4/0xd8
[<
ffff0000088b8478>] ata_std_error_handler+0x44/0x8c
[<
ffff0000088b8068>] ata_scsi_port_error_handler+0x480/0x694
[<
ffff000008875fc4>] async_sas_ata_eh+0x4c/0x80
[<
ffff0000080f6be8>] async_run_entry_fn+0x4c/0x170
[<
ffff0000080ebd70>] process_one_work+0x144/0x390
[<
ffff0000080ec100>] worker_thread+0x144/0x418
[<
ffff0000080f2c98>] kthread+0x10c/0x138
[<
ffff0000080855dc>] ret_from_fork+0x10/0x18
If ata qc leaked too many, ata tag allocation will fail and io blocked
for ever.
As suggested by Dan Williams, defer ata device commands to libata and
merge sas_eh_finish_cmd() with sas_eh_defer_cmd(). libata will handle
ata qcs correctly after this.
Signed-off-by: Jason Yan <yanaijie@huawei.com>
CC: Xiaofei Tan <tanxiaofei@huawei.com>
CC: John Garry <john.garry@huawei.com>
CC: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Martin Schwidefsky [Wed, 23 May 2018 16:21:36 +0000 (18:21 +0200)]
s390: use expoline thunks in the BPF JIT
[ Upstream commit
de5cb6eb514ebe241e3edeb290cb41deb380b81d ]
The BPF JIT need safe guarding against spectre v2 in the sk_load_xxx
assembler stubs and the indirect branches generated by the JIT itself
need to be converted to expolines.
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Martin Schwidefsky [Wed, 23 May 2018 16:21:35 +0000 (18:21 +0200)]
s390: extend expoline to BC instructions
[ Upstream commit
6deaa3bbca804b2a3627fd685f75de64da7be535 ]
The BPF JIT uses a 'b <disp>(%r<x>)' instruction in the definition
of the sk_load_word and sk_load_half functions.
Add support for branch-on-condition instructions contained in the
thunk code of an expoline.
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Martin Schwidefsky [Wed, 23 May 2018 16:21:33 +0000 (18:21 +0200)]
s390: move spectre sysfs attribute code
[ Upstream commit
4253b0e0627ee3461e64c2495c616f1c8f6b127b ]
The nospec-branch.c file is compiled without the gcc options to
generate expoline thunks. The return branch of the sysfs show
functions cpu_show_spectre_v1 and cpu_show_spectre_v2 is an indirect
branch as well. These need to be compiled with expolines.
Move the sysfs functions for spectre reporting to a separate file
and loose an '.' for one of the messages.
Cc: stable@vger.kernel.org # 4.16
Fixes:
d424986f1d ("s390: add sysfs attributes for spectre")
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Martin Schwidefsky [Wed, 23 May 2018 16:21:32 +0000 (18:21 +0200)]
s390/kernel: use expoline for indirect branches
[ Upstream commit
c50c84c3ac4d5db683904bdb3257798b6ef980ae ]
The assember code in arch/s390/kernel uses a few more indirect branches
which need to be done with execute trampolines for CONFIG_EXPOLINE=y.
Cc: stable@vger.kernel.org # 4.16
Fixes:
f19fbd5ed6 ("s390: introduce execute-trampolines for branches")
Reviewed-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Martin Schwidefsky [Wed, 23 May 2018 16:21:30 +0000 (18:21 +0200)]
s390/lib: use expoline for indirect branches
[ Upstream commit
97489e0663fa700d6e7febddc43b58df98d7bcda ]
The return from the memmove, memset, memcpy, __memset16, __memset32 and
__memset64 functions are done with "br %r14". These are indirect branches
as well and need to use execute trampolines for CONFIG_EXPOLINE=y.
Cc: stable@vger.kernel.org # 4.16
Fixes:
f19fbd5ed6 ("s390: introduce execute-trampolines for branches")
Reviewed-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Martin Schwidefsky [Wed, 23 May 2018 16:21:29 +0000 (18:21 +0200)]
s390: move expoline assembler macros to a header
[ Upstream commit
6dd85fbb87d1d6b87a3b1f02ca28d7b2abd2e7ba ]
To be able to use the expoline branches in different assembler
files move the associated macros from entry.S to a new header
nospec-insn.h.
While we are at it make the macros a bit nicer to use.
Cc: stable@vger.kernel.org # 4.16
Fixes:
f19fbd5ed6 ("s390: introduce execute-trampolines for branches")
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Martin Schwidefsky [Wed, 23 May 2018 16:21:28 +0000 (18:21 +0200)]
s390: add assembler macros for CPU alternatives
[ Upstream commit
fba9eb7946251d6e420df3bdf7bc45195be7be9a ]
Add a header with macros usable in assembler files to emit alternative
code sequences. It works analog to the alternatives for inline assmeblies
in C files, with the same restrictions and capabilities.
The syntax is
ALTERNATIVE "<default instructions sequence>", \
"<alternative instructions sequence>", \
"<features-bit>"
and
ALTERNATIVE_2 "<default instructions sequence>", \
"<alternative instructions sqeuence #1>", \
"<feature-bit #1>",
"<alternative instructions sqeuence #2>", \
"<feature-bit #2>"
Reviewed-by: Vasily Gorbik <gor@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Al Viro [Thu, 17 May 2018 21:18:30 +0000 (17:18 -0400)]
ext2: fix a block leak
commit
5aa1437d2d9a068c0334bd7c9dafa8ec4f97f13b upstream.
open file, unlink it, then use ioctl(2) to make it immutable or
append only. Now close it and watch the blocks *not* freed...
Immutable/append-only checks belong in ->setattr().
Note: the bug is old and backport to anything prior to
737f2e93b972
("ext2: convert to use the new truncate convention") will need
these checks lifted into ext2_setattr().
Cc: stable@kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Eric Dumazet [Tue, 15 May 2018 04:14:26 +0000 (21:14 -0700)]
tcp: purge write queue in tcp_connect_init()
[ Upstream commit
7f582b248d0a86bae5788c548d7bb5bca6f7691a ]
syzkaller found a reliable way to crash the host, hitting a BUG()
in __tcp_retransmit_skb()
Malicous MSG_FASTOPEN is the root cause. We need to purge write queue
in tcp_connect_init() at the point we init snd_una/write_seq.
This patch also replaces the BUG() by a less intrusive WARN_ON_ONCE()
kernel BUG at net/ipv4/tcp_output.c:2837!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 5276 Comm: syz-executor0 Not tainted 4.17.0-rc3+ #51
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__tcp_retransmit_skb+0x2992/0x2eb0 net/ipv4/tcp_output.c:2837
RSP: 0000:
ffff8801dae06ff8 EFLAGS:
00010206
RAX:
ffff8801b9fe61c0 RBX:
00000000ffc18a16 RCX:
ffffffff864e1a49
RDX:
0000000000000100 RSI:
ffffffff864e2e12 RDI:
0000000000000005
RBP:
ffff8801dae073a0 R08:
ffff8801b9fe61c0 R09:
ffffed0039c40dd2
R10:
ffffed0039c40dd2 R11:
ffff8801ce206e93 R12:
00000000421eeaad
R13:
ffff8801ce206d4e R14:
ffff8801ce206cc0 R15:
ffff8801cd4f4a80
FS:
0000000000000000(0000) GS:
ffff8801dae00000(0063) knlGS:
00000000096bc900
CS: 0010 DS: 002b ES: 002b CR0:
0000000080050033
CR2:
0000000020000000 CR3:
00000001c47b6000 CR4:
00000000001406f0
DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
DR3:
0000000000000000 DR6:
00000000fffe0ff0 DR7:
0000000000000400
Call Trace:
<IRQ>
tcp_retransmit_skb+0x2e/0x250 net/ipv4/tcp_output.c:2923
tcp_retransmit_timer+0xc50/0x3060 net/ipv4/tcp_timer.c:488
tcp_write_timer_handler+0x339/0x960 net/ipv4/tcp_timer.c:573
tcp_write_timer+0x111/0x1d0 net/ipv4/tcp_timer.c:593
call_timer_fn+0x230/0x940 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x79e/0xc50 kernel/time/timer.c:1666
run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
__do_softirq+0x2e0/0xaf5 kernel/softirq.c:285
invoke_softirq kernel/softirq.c:365 [inline]
irq_exit+0x1d1/0x200 kernel/softirq.c:405
exiting_irq arch/x86/include/asm/apic.h:525 [inline]
smp_apic_timer_interrupt+0x17e/0x710 arch/x86/kernel/apic/apic.c:1052
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
Fixes:
cf60af03ca4e ("net-tcp: Fast Open client - sendmsg(MSG_FASTOPEN)")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Eric Dumazet [Fri, 18 May 2018 11:47:55 +0000 (04:47 -0700)]
sock_diag: fix use-after-free read in __sk_free
[ Upstream commit
9709020c86f6bf8439ca3effc58cfca49a5de192 ]
We must not call sock_diag_has_destroy_listeners(sk) on a socket
that has no reference on net structure.
BUG: KASAN: use-after-free in sock_diag_has_destroy_listeners include/linux/sock_diag.h:75 [inline]
BUG: KASAN: use-after-free in __sk_free+0x329/0x340 net/core/sock.c:1609
Read of size 8 at addr
ffff88018a02e3a0 by task swapper/1/0
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.17.0-rc5+ #54
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b9/0x294 lib/dump_stack.c:113
print_address_description+0x6c/0x20b mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
sock_diag_has_destroy_listeners include/linux/sock_diag.h:75 [inline]
__sk_free+0x329/0x340 net/core/sock.c:1609
sk_free+0x42/0x50 net/core/sock.c:1623
sock_put include/net/sock.h:1664 [inline]
reqsk_free include/net/request_sock.h:116 [inline]
reqsk_put include/net/request_sock.h:124 [inline]
inet_csk_reqsk_queue_drop_and_put net/ipv4/inet_connection_sock.c:672 [inline]
reqsk_timer_handler+0xe27/0x10e0 net/ipv4/inet_connection_sock.c:739
call_timer_fn+0x230/0x940 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x79e/0xc50 kernel/time/timer.c:1666
run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
__do_softirq+0x2e0/0xaf5 kernel/softirq.c:285
invoke_softirq kernel/softirq.c:365 [inline]
irq_exit+0x1d1/0x200 kernel/softirq.c:405
exiting_irq arch/x86/include/asm/apic.h:525 [inline]
smp_apic_timer_interrupt+0x17e/0x710 arch/x86/kernel/apic/apic.c:1052
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
</IRQ>
RIP: 0010:native_safe_halt+0x6/0x10 arch/x86/include/asm/irqflags.h:54
RSP: 0018:
ffff8801d9ae7c38 EFLAGS:
00000282 ORIG_RAX:
ffffffffffffff13
RAX:
dffffc0000000000 RBX:
1ffff1003b35cf8a RCX:
0000000000000000
RDX:
1ffffffff11a30d0 RSI:
0000000000000001 RDI:
ffffffff88d18680
RBP:
ffff8801d9ae7c38 R08:
ffffed003b5e46c3 R09:
0000000000000000
R10:
0000000000000000 R11:
0000000000000000 R12:
0000000000000001
R13:
ffff8801d9ae7cf0 R14:
ffffffff897bef20 R15:
0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline]
default_idle+0xc2/0x440 arch/x86/kernel/process.c:354
arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:345
default_idle_call+0x6d/0x90 kernel/sched/idle.c:93
cpuidle_idle_call kernel/sched/idle.c:153 [inline]
do_idle+0x395/0x560 kernel/sched/idle.c:262
cpu_startup_entry+0x104/0x120 kernel/sched/idle.c:368
start_secondary+0x426/0x5b0 arch/x86/kernel/smpboot.c:269
secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:242
Allocated by task 4557:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
kmem_cache_alloc+0x12e/0x760 mm/slab.c:3554
kmem_cache_zalloc include/linux/slab.h:691 [inline]
net_alloc net/core/net_namespace.c:383 [inline]
copy_net_ns+0x159/0x4c0 net/core/net_namespace.c:423
create_new_namespaces+0x69d/0x8f0 kernel/nsproxy.c:107
unshare_nsproxy_namespaces+0xc3/0x1f0 kernel/nsproxy.c:206
ksys_unshare+0x708/0xf90 kernel/fork.c:2408
__do_sys_unshare kernel/fork.c:2476 [inline]
__se_sys_unshare kernel/fork.c:2474 [inline]
__x64_sys_unshare+0x31/0x40 kernel/fork.c:2474
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 69:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3498 [inline]
kmem_cache_free+0x86/0x2d0 mm/slab.c:3756
net_free net/core/net_namespace.c:399 [inline]
net_drop_ns.part.14+0x11a/0x130 net/core/net_namespace.c:406
net_drop_ns net/core/net_namespace.c:405 [inline]
cleanup_net+0x6a1/0xb20 net/core/net_namespace.c:541
process_one_work+0xc1e/0x1b50 kernel/workqueue.c:2145
worker_thread+0x1cc/0x1440 kernel/workqueue.c:2279
kthread+0x345/0x410 kernel/kthread.c:240
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
The buggy address belongs to the object at
ffff88018a02c140
which belongs to the cache net_namespace of size 8832
The buggy address is located 8800 bytes inside of
8832-byte region [
ffff88018a02c140,
ffff88018a02e3c0)
The buggy address belongs to the page:
page:
ffffea0006280b00 count:1 mapcount:0 mapping:
ffff88018a02c140 index:0x0 compound_mapcount: 0
flags: 0x2fffc0000008100(slab|head)
raw:
02fffc0000008100 ffff88018a02c140 0000000000000000 0000000100000001
raw:
ffffea00062a1320 ffffea0006268020 ffff8801d9bdde40 0000000000000000
page dumped because: kasan: bad access detected
Fixes:
b922622ec6ef ("sock_diag: don't broadcast kernel sockets")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Craig Gallek <kraig@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>