OSDN Git Service
Umang Agrawal [Mon, 16 Apr 2018 09:11:11 +0000 (14:41 +0530)]
power: smb-lib: Add support for SW based OV detection
Add support for software based USBIN OV detection, once
OV condition is detected, software will force USBIN to 5V
and continue charging with 5V.
Change-Id: Ie8f00f69db4ac6330d9da82b3455e4efab43861a
Signed-off-by: Umang Agrawal <uagrawal@codeaurora.org>
Umang Agrawal [Tue, 8 May 2018 11:42:30 +0000 (17:12 +0530)]
smb-lib: add support of DP/DM pulsing for fix 5V, 9V and 12V
This change will enable userspace to control adapter's output
voltage. Userspace can force adapter's output voltage to
5V/9V/12V.
Change-Id: I4a60a681c136df6864294dbd19849503a2be2e7b
Signed-off-by: Umang Agrawal <uagrawal@codeaurora.org>
Linux Build Service Account [Mon, 7 May 2018 17:03:56 +0000 (10:03 -0700)]
Merge "ARM: dts: msm: update mem region on msm8996 auto boards"
Linux Build Service Account [Mon, 7 May 2018 07:58:54 +0000 (00:58 -0700)]
Merge "Android.bp: Initial header export bp for Android (qseecom only)"
Linux Build Service Account [Sun, 6 May 2018 09:07:13 +0000 (02:07 -0700)]
Merge "ASoC: msm: qdsp6v2 : Add AFE port validation for MULTICHAN_HDMI_RX"
Linux Build Service Account [Sun, 6 May 2018 09:07:12 +0000 (02:07 -0700)]
Merge "ASoC: sdm660_cdc: Fix pop after PDR on SDM660 internal codec"
Linux Build Service Account [Sun, 6 May 2018 09:07:10 +0000 (02:07 -0700)]
Merge "ASoC: msm: add TDM routing for DTMF driver and dtmf fe dai to apq8096"
Linux Build Service Account [Sun, 6 May 2018 09:07:09 +0000 (02:07 -0700)]
Merge "ASoC: msm: qdsp6v2: enable DMA channel control"
Linux Build Service Account [Sun, 6 May 2018 09:07:07 +0000 (02:07 -0700)]
Merge "ARM: dts: msm: enable sensor node on msm8996 and apq8096"
David Ng [Fri, 4 May 2018 02:36:14 +0000 (19:36 -0700)]
Android.bp: Initial header export bp for Android (qseecom only)
Initial Android blueprint makefile for kernel header export;
qseecom.h UAPI for now.
Change-Id: Ia0af480167e19d099789548a2229b46abbd977f8
Signed-off-by: David Ng <dave@codeaurora.org>
Guchun Chen [Wed, 25 Apr 2018 13:48:39 +0000 (21:48 +0800)]
ARM: dts: msm: update mem region on msm8996 auto boards
Due to early RVC will continue running during the whole device
bootup period, so RVC's reserved memory should be updated to
contiguous-region to avoid smmu fault.
CRs-Fixed:
2225630
Change-Id: I5d1510f4e9079f6ddd5630b0b736d0d49bc0992b
Signed-off-by: Guchun Chen <guchunc@codeaurora.org>
Guchun Chen [Thu, 12 Apr 2018 09:16:35 +0000 (17:16 +0800)]
ARM: dts: msm: add reserved plane node on msm8996 auto boards
Early RVC will enable vig0 layer if it's on in bootloader. So to
meet the purpose LK and kernel can access display hardware at the
same time, this pipe should be reserved in LK and set to not available
to others before RVC exits.
CRs-Fixed:
2225630
Change-Id: I1398db5750c01523e4b755fb4744a6fc976ee8da
Signed-off-by: Guchun Chen <guchunc@codeaurora.org>
Linux Build Service Account [Fri, 4 May 2018 23:11:21 +0000 (16:11 -0700)]
Merge "drm/msm/hdmi: partial revert for hdmi->power_on changes"
Linux Build Service Account [Fri, 4 May 2018 02:58:45 +0000 (19:58 -0700)]
Merge "ARM: dts: msm: Enable 802.11ad wifi device on msm8996 platform"
Timothy Sham [Thu, 26 Apr 2018 20:20:57 +0000 (16:20 -0400)]
ASoC: msm: add TDM routing for DTMF driver and dtmf fe dai to apq8096
Added DTMF mixer routing for QUAT_TDM_RX2 for automotive. Also added
the DTMF front-end dai to apq8096 driver.
Change-Id: I3652efd939774ff8cb7c40445747f0edbf6b3c7f
Signed-off-by: Timothy Sham <tsham@codeaurora.org>
Linux Build Service Account [Thu, 3 May 2018 18:23:20 +0000 (11:23 -0700)]
Merge "sched/walt: Fix use after free in trace_sched_update_task_ravg()"
Linux Build Service Account [Thu, 3 May 2018 09:07:35 +0000 (02:07 -0700)]
Merge "msm: ais: isp: Handling buffer use after getting it freed"
Linux Build Service Account [Thu, 3 May 2018 09:07:34 +0000 (02:07 -0700)]
Merge "gpio: No NULL owner"
Linux Build Service Account [Thu, 3 May 2018 09:07:28 +0000 (02:07 -0700)]
Merge "defconfig: Enable preemptirq tracing for msm8998 and sdm660"
Gerrit - the friendly Code Review server [Thu, 3 May 2018 07:33:44 +0000 (00:33 -0700)]
Merge changes into msm-4.4
Zhaoyang Liu [Wed, 18 Apr 2018 08:57:51 +0000 (16:57 +0800)]
ARM: dts: msm: Enable 802.11ad wifi device on msm8996 platform
Enable IEEE802.11AD WiFi device wil6210.
Change wil6210 PCIe parent for MSM8996 platform.
Change-Id: I58919c766c0e6f0090d309492de1ecf12718824d
Signed-off-by: Zhaoyang Liu <zhaoyang@codeaurora.org>
Pavankumar Kondeti [Tue, 13 Mar 2018 10:33:15 +0000 (16:03 +0530)]
sched/walt: Fix use after free in trace_sched_update_task_ravg()
commit
4d09122c1868 ("sched: Fix spinlock recursion in sched_exit()")
moved freeing of task's current and previous window arrays outside
the rq->lock. These arrays can be accessed from another CPU in parallel
and end up using freed memory. For example,
CPU#0 CPU#1
---------------------------------- -------------------------------
sched_exit() try_to_wake_up()--> The task wakes
up on CPU#0
task_rq_lock() set_task_cpu()
fixup_busy_time() --> waiting for
CPU#0's rq->lock
task_rq_unlock() fixup_busy_time()-->lock acquired
free_task_load_ptrs()
kfree(p->ravg.curr_window_cpu) update_task_ravg()-->called on
current of CPU#0
trace_sched_update_task_ravg()
--> access freed memory
p->ravg.curr_window_cpu = NULL;
To fix this issue, window array pointers must be set to NULL before
freeing the memory. Since this happens outside the lock, memory barriers
are needed on write and read paths. A much simpler alternative would be
skipping update_task_ravg() trace point for tasks that are marked as dead.
The window stats of dead tasks are not updated any ways. While at it, skip
this trace point for newly created tasks for which also window stats are
not updated.
Change-Id: I4d7cb8a3cf7cf84270b09721140d35205643b7ab
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
[spathi@codeaurora.org: moved changes to hmp.c since EAS is not supported]
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Linus Walleij [Tue, 16 Jan 2018 07:42:12 +0000 (08:42 +0100)]
gpio: No NULL owner
Sometimes a GPIO is fetched with NULL as parent device, and
that is just fine. So under these circumstances, avoid using
dev_name() to provide a name for the GPIO line.
Change-Id: Iacf2ef35d50118cd755e26ed4211c3c4b1289ff2
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Git-commit:
7d18f0a14aa6a0d6bad39111c1fb655f07f71d59
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Linux Build Service Account [Wed, 2 May 2018 20:38:40 +0000 (13:38 -0700)]
Merge "Merge android-4.4.129 (
b1c4836) into msm-4.4"
Linux Build Service Account [Wed, 2 May 2018 20:38:39 +0000 (13:38 -0700)]
Merge "ANDROID: sound: rawmidi: Hold lock around realloc"
Linux Build Service Account [Wed, 2 May 2018 20:38:38 +0000 (13:38 -0700)]
Merge "msm: ipa: using debug logging instead of error logging"
Linux Build Service Account [Wed, 2 May 2018 20:38:37 +0000 (13:38 -0700)]
Merge "mmc: core: power cycle card when sd card switch voltage operation fails"
Linux Build Service Account [Wed, 2 May 2018 20:38:36 +0000 (13:38 -0700)]
Merge "mmc: card: WARN_ON in cmdq completion context"
Linux Build Service Account [Wed, 2 May 2018 20:38:35 +0000 (13:38 -0700)]
Merge "defconfig: Enable cellular hints in regulatory cfg80211"
Daniel Rosenberg [Tue, 31 Oct 2017 23:55:26 +0000 (16:55 -0700)]
ANDROID: sound: rawmidi: Hold lock around realloc
The SNDRV_RAWMIDI_STREAM_{OUTPUT,INPUT} ioctls may reallocate
runtime->buffer while other kernel threads are accessing it. If the
underlying krealloc() call frees the original buffer, then this can turn
into a use-after-free.
Most of these accesses happen while the thread is holding runtime->lock,
and can be fixed by just holding the same lock while replacing
runtime->buffer, however we can't hold this spinlock while
snd_rawmidi_kernel_{read1,write1} are copying to/from userspace. We
need to add and acquire a new mutex to prevent this from happening
concurrently with reallocation. We hold this mutex during the entire
reallocation process, to also prevent multiple concurrent reallocations
leading to a double-free.
Signed-off-by: Daniel Rosenberg <drosen@google.com>
bug:
64315347
Change-Id: I05764d4f1a38f373eb7c0ac1c98607ee5ff0eded
[dcagle@codeaurora.org: Resolve trivial merge conflict]
Git-repo: https://android.googlesource.com/kernel/msm
Git-commit:
d7193540482d11ff0ad3a07fc18717811641c6eb
Signed-off-by: Dennis Cagle <dcagle@codeaurora.org>
Linux Build Service Account [Wed, 2 May 2018 11:54:42 +0000 (04:54 -0700)]
Merge "leds: qpnp-flash-v2: Modify current code calculation"
Linux Build Service Account [Wed, 2 May 2018 11:54:41 +0000 (04:54 -0700)]
Merge "hab: import/export between remote buffer and dmafd"
Linux Build Service Account [Wed, 2 May 2018 11:54:40 +0000 (04:54 -0700)]
Merge "i2c-msm-v2: Add support for suspend to disk"
Linux Build Service Account [Wed, 2 May 2018 11:54:39 +0000 (04:54 -0700)]
Merge "diag: Validate query dci event and log mask size properly"
Linux Build Service Account [Wed, 2 May 2018 11:54:38 +0000 (04:54 -0700)]
Merge "Merge android-4.4.128 (
89904cc) into msm-4.4"
Linux Build Service Account [Wed, 2 May 2018 11:54:36 +0000 (04:54 -0700)]
Merge "usb: gadget: ffs: Multi-instance fix for use after free case"
Linux Build Service Account [Wed, 2 May 2018 11:54:35 +0000 (04:54 -0700)]
Merge "tracing: always define trace_{irq,preempt}_{enable_disable}"
Linux Build Service Account [Wed, 2 May 2018 11:54:34 +0000 (04:54 -0700)]
Merge "cpuidle: lpm-levels: Fix snprintf string format"
Linux Build Service Account [Wed, 2 May 2018 11:54:32 +0000 (04:54 -0700)]
Merge "soc: qcom: rpm_stats: Fix snprintf string format"
Mohammed Javid [Wed, 3 Jan 2018 11:59:57 +0000 (17:29 +0530)]
msm: ipa: using debug logging instead of error logging
Adding code changes to controlling logs printing
on the console changing error logging to debug logging
Change-Id: I35f4c0e3380ad700899808d9cd6c260befb8be8f
Acked-by: Ashok Vuyyuru <avuyyuru@qti.qualcomm.com>
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>
Ram Prakash Gupta [Thu, 26 Apr 2018 10:54:46 +0000 (16:24 +0530)]
mmc: core: power cycle card when sd card switch voltage operation fails
As per the sd card spec, mmc need to power cycle sd card in case sd
card voltage switch operation fails. Currently we are directly going
for low speed mode without power cycle, which is in violation of sd
card spec. Now we will retry for 10 times in case timeout happens
while switching voltage and at last, in case, it did not succeed in
switching sd card voltage, mmc would go for low speed mode.
Change-Id: Icece08732b8d52104e0890dce81ad16844265edd
Signed-off-by: Ram Prakash Gupta <rampraka@codeaurora.org>
Pradeep P V K [Thu, 19 Apr 2018 09:12:44 +0000 (14:42 +0530)]
mmc: card: WARN_ON in cmdq completion context
Due to command queuing, there is a possibility of servicing
completion of multiple requests from hw irq context. So in
this case, hw irq will launch softirq for all requests which
were completed (irrespective of whether it was success or failure).
If one of the requests failed, then the softirq corresponding
to error ed request will set current cmdq state to CMDQ_STATE_ERR.
Because of this, subsequent completion softirqs for successful
requests will BUG_ON.
We should let higher layers know of completion of successful
requests. Hence change the BUG_ON to WARN_ON and skip
blk_end_request() only if the corresponding request has
an error (instead of checking if the cmdq state is in error)
Change-Id: Ieb7f9d12ba04b6ab6499bf29f3716b0ddfb880fb
Signed-off-by: Pradeep P V K <ppvk@codeaurora.org>
Suprith Malligere Shankaregowda [Wed, 25 Apr 2018 05:47:30 +0000 (11:17 +0530)]
msm: ais: isp: Handling buffer use after getting it freed
In the code, start_fetch can try to access the buffer
pointer variable after free, as the same pointer can
can be freed at RELEASE_BUF call too at the same time.
Hence fixing this race condition.
Change-Id: I05825fb3423f95bc251e79416de50dc32cf086dc
Signed-off-by: Suprith Malligere Shankaregowda <supgow@codeaurora.org>
Linux Build Service Account [Wed, 2 May 2018 00:00:41 +0000 (17:00 -0700)]
Merge "usb: dwc3-msm: Resume PHY before notify_connect on start_host"
Linux Build Service Account [Wed, 2 May 2018 00:00:38 +0000 (17:00 -0700)]
Merge "ASoC: msm: move tdm grp mgt to afe for anc support"
Amar Singhal [Tue, 17 Apr 2018 18:32:26 +0000 (11:32 -0700)]
defconfig: Enable cellular hints in regulatory cfg80211
The user-space may send regulatory hint that has cellular sub-type
enabled. To process such events, enable
CONFIG_CFG80211_REG_CELLULAR_HINTS.
Signed-off-by: Amar Singhal <asinghal@codeaurora.org>
Change-Id: I79aceece8e7f17bbcf8186b03c74d82be82c5a4c
CRs-Fixed:
2201959
Vatsal Bucha [Mon, 30 Apr 2018 07:19:34 +0000 (12:49 +0530)]
ASoC: sdm660_cdc: Fix pop after PDR on SDM660 internal codec
Pop is heard after PDR is triggered. This is
resolved by disable PA before boost is discharged.
CRs-Fixed:
2186640
Change-Id: Ie48668725f5162251cf09215f9448a6965fac3e2
Signed-off-by: Vatsal Bucha <vbucha@codeaurora.org>
Linux Build Service Account [Tue, 1 May 2018 13:26:41 +0000 (06:26 -0700)]
Merge "drm/msm/sde: increase gpu input fence timeout to 10 seconds"
Linux Build Service Account [Tue, 1 May 2018 13:26:39 +0000 (06:26 -0700)]
Merge "drm: msm: add uevent handler to release pipes"
Linux Build Service Account [Tue, 1 May 2018 13:26:38 +0000 (06:26 -0700)]
Merge "drm: msm: add early splash support on triple displays"
Linux Build Service Account [Tue, 1 May 2018 13:26:37 +0000 (06:26 -0700)]
Merge "msm: ipa: rmnet: Make code changes with respect to CR#
2046006"
Linux Build Service Account [Tue, 1 May 2018 13:26:36 +0000 (06:26 -0700)]
Merge "Revert "adv7481: return error when PLL lock fails""
Linux Build Service Account [Tue, 1 May 2018 13:26:35 +0000 (06:26 -0700)]
Merge "ath10k: update wowlan config and rekey data store method"
Linux Build Service Account [Tue, 1 May 2018 13:26:34 +0000 (06:26 -0700)]
Merge "net: ipc_router: Remove wakeup-source for Sensor ports"
Linux Build Service Account [Tue, 1 May 2018 13:26:33 +0000 (06:26 -0700)]
Merge "ASoC: msm: Update channel mixer weight mixer control"
Linux Build Service Account [Tue, 1 May 2018 13:26:31 +0000 (06:26 -0700)]
Merge "soc: msm: add apr sensor domain support"
Linux Build Service Account [Tue, 1 May 2018 13:26:29 +0000 (06:26 -0700)]
Merge "audio: qdsp6v2: add retry when EAGAIN for habmm_socket_recv"
Linux Build Service Account [Tue, 1 May 2018 04:09:08 +0000 (21:09 -0700)]
Merge "msm: camera: sensor: Adjust csiphy skew filter setting"
Linux Build Service Account [Tue, 1 May 2018 04:09:07 +0000 (21:09 -0700)]
Merge "msm: camera: Change data type of data rate"
Linux Build Service Account [Tue, 1 May 2018 04:09:03 +0000 (21:09 -0700)]
Merge "esoc: Use standard reset time for mdm9x55 atomic reset"
Derek Chen [Mon, 30 Oct 2017 19:37:30 +0000 (15:37 -0400)]
ARM: dts: msm: enable sensor node on msm8996 and apq8096
Enable sensor device node to allow Anti-Noise
Cancellation (ANC) algorithm to be running on
sensor subsystem for automotive msm8996 and
apq8096 platforms.
CRs-fixed:
2153236
Change-Id: I213c2eb94f6fe01e7c2ceca2d9033616817db38b
Signed-off-by: Derek Chen <chenche@codeaurora.org>
Derek Chen [Thu, 19 Oct 2017 22:06:35 +0000 (18:06 -0400)]
soc: msm: add sensor dsp framework support for anc
Add Sensor DSP framework support for Active
Engine Noise Cancellation (ANC).
CRs-fixed:
2153236
Signed-off-by: Derek Chen <chenche@codeaurora.org>
Change-Id: I4cd28ac1bbfd3fcd21174e0216c70cd664cfa319
Ramu Gottipati [Thu, 26 Apr 2018 11:25:41 +0000 (16:55 +0530)]
ASoC: msm: qdsp6v2 : Add AFE port validation for MULTICHAN_HDMI_RX
validate port doesn't handle MULTICHAN_HDMI_RX
and causes failure to set afe params.
Included MULTICHAN_HDMI_RX in port validation
Change-Id: I3603ec2a3d392970cb48be1658b6030d3f4107f2
Signed-off-by: Ramu Gottipati <ramug@codeaurora.org>
Mohammed Javid [Thu, 19 Apr 2018 08:11:16 +0000 (13:41 +0530)]
msm: ipa: rmnet: Make code changes with respect to CR#
2046006
Check for CAP_NET_ADMIN capability of the user
space application who tries to access rmnet driver IOCTL.
Change-Id: If6bb4b54659306c5103b5e34bf02c7234c851e0a
CRs-Fixed:
2226355
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>
Vijay kumar Tumati [Wed, 25 Apr 2018 05:38:30 +0000 (11:08 +0530)]
msm: camera: sensor: Adjust csiphy skew filter setting
Change camera csiphy skew filter setting to match HPG.
Change-Id: I21d63daa95bd1901b6343e7ff47f05e259a1a8a1
Signed-off-by: Vijay kumar Tumati <vtumati@codeaurora.org>
Linux Build Service Account [Mon, 30 Apr 2018 04:09:50 +0000 (21:09 -0700)]
Merge "msm: Allocate fd with O_CLOEXEC flag"
Linux Build Service Account [Mon, 30 Apr 2018 04:09:49 +0000 (21:09 -0700)]
Merge "ASoC: msm: update listen service dai to low latency pcm"
Linux Build Service Account [Mon, 30 Apr 2018 04:09:47 +0000 (21:09 -0700)]
Merge "clk: qcom: Retrieve pre_div from freq_tbl for shared RCG"
Derek Chen [Thu, 5 Oct 2017 22:48:45 +0000 (18:48 -0400)]
ASoC: msm: qdsp6v2: enable DMA channel control
Enable AFE driver to request and release
LPASS DMA channel indices.
CRs-fixed:
2126719
Signed-off-by: Derek Chen <chenche@codeaurora.org>
Change-Id: Ic40bbf9aa7170d2c91cef45ddca7a86ccd27c4b0
Sachin Bhayare [Tue, 3 Apr 2018 14:39:12 +0000 (20:09 +0530)]
msm: Allocate fd with O_CLOEXEC flag
(cherry-pick from 'commit
580ec70acac4 ("fbdev: msm: Allocate fd
with O_CLOEXEC flag")') and made similar changes
for MDP3.
When fd is requested during get_metadata call, create
fd using O_CLOEXEC flag.
Change-Id: Iaa55927ac04b019ea45fbdfe9c64b10d1f0e3ceb
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
Signed-off-by: Sachin Bhayare <sachin.bhayare@codeaurora.org>
Suprith Malligere Shankaregowda [Wed, 11 Apr 2018 19:11:31 +0000 (00:41 +0530)]
Revert "adv7481: return error when PLL lock fails"
This reverts commit
44d8abb6e009123c8535cf85157be4377a895049.
If we return error on PLL lock failure, it results in open_stream
failure for TIF. So, if we open the TV app first and then connect
HDMI cable, it will not start streaming. Therefore reverting this
change.
Change-Id: Ic99a6986a3138bc3abb9e65eb598a743f1634c5c
Signed-off-by: Suprith Malligere Shankaregowda <supgow@codeaurora.org>
Samyukta Mogily [Mon, 23 Apr 2018 10:47:17 +0000 (16:17 +0530)]
msm: camera: Change data type of data rate
Change data rate to uint64, to ensure that the value sent
to kernel is not corrupted.
Change-Id: I692c1c3e591cbac24931078e0fb8938900fc991c
Signed-off-by: Samyukta Mogily <smogily@codeaurora.org>
Subbaraman Narayanamurthy [Mon, 16 Apr 2018 21:00:12 +0000 (14:00 -0700)]
leds: qpnp-flash-v2: Modify current code calculation
Currently, the code calculated for a desired target current and
IRES is rounded up since DIV_ROUND_UP is used in the calculation.
With a higher IRES (12.5 mA), code can be configured to a higher
value. Fix this by using DIV_ROUND_CLOSEST so that the optimal
code can be obtained.
Change-Id: I51c1b15fff3ff2a23cb256f2ae1d341f5271adf2
Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Ajay Agarwal [Mon, 16 Apr 2018 14:10:02 +0000 (19:40 +0530)]
usb: dwc3-msm: Resume PHY before notify_connect on start_host
Currently as a part of host cable connection, we are notifying
cable connect to phy driver first and then resuming the PHY. This
leads to bus resume case running instead of the cable connect
case resume, hence the phy driver does not vote for the LDOs. As
a result, PHY goes into bad state. Fix this by first resuming PHY
so that cable connect case resume runs.
Change-Id: Ica5b16e420c38b920688b86a24af396644487a6b
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Yajun Li [Mon, 15 Jan 2018 02:36:45 +0000 (10:36 +0800)]
hab: import/export between remote buffer and dmafd
currently hab only supports importing remote buffer
to cpu address, which can't be shared to other process.
Therefore we add dma_buf import/export function in hab
Change-Id: I156c925d7c0cefef5bf146ad8cff38de9c4b3bee
Signed-off-by: Yajun Li <yajunl@codeaurora.org>
Hardik Arya [Fri, 6 Apr 2018 09:40:36 +0000 (15:10 +0530)]
diag: Validate query dci event and log mask size properly
Currently there is possibility of out-of-bound read due to
incorrect validation of received dci event and log mask for
query. The patch update the validation for the same.
Change-Id: I4266eb0f69fdbfa48c5aacc17744dec83995e9e6
Signed-off-by: Hardik Arya <harya@codeaurora.org>
Sarada Prasanna Garnayak [Wed, 18 Apr 2018 09:58:42 +0000 (15:28 +0530)]
ath10k: update wowlan config and rekey data store method
In wow suspend method clean up the old configured wow events
before enabling the WLAN offloads and wakeup wow events.
The rekey data set ops is not part of the ieee80211 power
management ops so remove the rekey data set method from wow
and add it in ath10k mac layer.
CRs-Fixed:
2226944
Change-Id: Ida7592097f949734b5880c470845780295a695af
Signed-off-by: Sarada Prasanna Garnayak <sgarna@codeaurora.org>
Arun Kumar Neelakantam [Thu, 19 Apr 2018 12:40:47 +0000 (18:10 +0530)]
net: ipc_router: Remove wakeup-source for Sensor ports
In high speed sensor data stream case system is not entering into
suspend state due to edge and port specific wake-up sources.
Add flag to check and avoid the wakeup sources for all sensor ports.
CRs-Fixed:
2196601
Change-Id: Ibf642619b969925dc96e8a57e11f7e349b85c024
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
Srinivasarao P [Tue, 24 Apr 2018 13:37:31 +0000 (19:07 +0530)]
Merge android-4.4.129 (
b1c4836) into msm-4.4
* refs/heads/tmp-
b1c4836
Linux 4.4.129
writeback: safer lock nesting
fanotify: fix logic of events on child
ext4: bugfix for mmaped pages in mpage_release_unused_pages()
mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
mm: allow GFP_{FS,IO} for page_cache_read page cache allocation
autofs: mount point create should honour passed in mode
Don't leak MNT_INTERNAL away from internal mounts
rpc_pipefs: fix double-dput()
hypfs_kill_super(): deal with failed allocations
jffs2_kill_sb(): deal with failed allocations
powerpc/lib: Fix off-by-one in alternate feature patching
powerpc/eeh: Fix enabling bridge MMIO windows
MIPS: memset.S: Fix clobber of v1 in last_fixup
MIPS: memset.S: Fix return of __clear_user from Lpartial_fixup
MIPS: memset.S: EVA & fault support for small_memset
MIPS: uaccess: Add micromips clobbers to bzero invocation
HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device
ALSA: hda - New VIA controller suppor no-snoop path
ALSA: rawmidi: Fix missing input substream checks in compat ioctls
ALSA: line6: Use correct endpoint type for midi output
ext4: fix deadlock between inline_data and ext4_expand_extra_isize_ea()
ext4: fix crashes in dioread_nolock mode
drm/radeon: Fix PCIe lane width calculation
ext4: don't allow r/w mounts if metadata blocks overlap the superblock
vfio/pci: Virtualize Maximum Read Request Size
vfio/pci: Virtualize Maximum Payload Size
vfio-pci: Virtualize PCIe & AF FLR
ALSA: pcm: Fix endless loop for XRUN recovery in OSS emulation
ALSA: pcm: Fix mutex unbalance in OSS emulation ioctls
ALSA: pcm: Return -EBUSY for OSS ioctls changing busy streams
ALSA: pcm: Avoid potential races between OSS ioctls and read/write
ALSA: pcm: Use ERESTARTSYS instead of EINTR in OSS emulation
ALSA: oss: consolidate kmalloc/memset 0 call to kzalloc
watchdog: f71808e_wdt: Fix WD_EN register read
thermal: imx: Fix race condition in imx_thermal_probe()
clk: bcm2835: De-assert/assert PLL reset signal when appropriate
clk: mvebu: armada-38x: add support for missing clocks
clk: mvebu: armada-38x: add support for 1866MHz variants
mmc: jz4740: Fix race condition in IRQ mask update
iommu/vt-d: Fix a potential memory leak
um: Use POSIX ucontext_t instead of struct ucontext
dmaengine: at_xdmac: fix rare residue corruption
IB/srp: Fix completion vector assignment algorithm
IB/srp: Fix srp_abort()
ALSA: pcm: Fix UAF at PCM release via PCM timer access
RDMA/ucma: Don't allow setting RDMA_OPTION_IB_PATH without an RDMA device
ext4: fail ext4_iget for root directory if unallocated
ext4: don't update checksum of new initialized bitmaps
jbd2: if the journal is aborted then don't allow update of the log tail
random: use a tighter cap in credit_entropy_bits_safe()
thunderbolt: Resume control channel after hibernation image is created
ASoC: ssm2602: Replace reg_default_raw with reg_default
HID: core: Fix size as type u32
HID: Fix hid_report_len usage
powerpc/powernv: Fix OPAL NVRAM driver OPAL_BUSY loops
powerpc/powernv: define a standard delay for OPAL_BUSY type retry loops
powerpc/64: Fix smp_wmb barrier definition use use lwsync consistently
powerpc/powernv: Handle unknown OPAL errors in opal_nvram_write()
HID: i2c-hid: fix size check and type usage
usb: dwc3: pci: Properly cleanup resource
USB:fix USB3 devices behind USB3 hubs not resuming at hibernate thaw
ACPI / hotplug / PCI: Check presence of slot itself in get_slot_status()
ACPI / video: Add quirk to force acpi-video backlight on Samsung 670Z5E
regmap: Fix reversed bounds check in regmap_raw_write()
xen-netfront: Fix hang on device removal
ARM: dts: at91: sama5d4: fix pinctrl compatible string
ARM: dts: at91: at91sam9g25: fix mux-mask pinctrl property
usb: musb: gadget: misplaced out of bounds check
mm, slab: reschedule cache_reap() on the same CPU
ipc/shm: fix use-after-free of shm file via remap_file_pages()
resource: fix integer overflow at reallocation
fs/reiserfs/journal.c: add missing resierfs_warning() arg
ubi: Reject MLC NAND
ubi: Fix error for write access
ubi: fastmap: Don't flush fastmap work on detach
ubifs: Check ubifs_wbuf_sync() return code
tty: make n_tty_read() always abort if hangup is in progress
x86/hweight: Don't clobber %rdi
x86/hweight: Get rid of the special calling convention
lan78xx: Correctly indicate invalid OTP
slip: Check if rstate is initialized before uncompressing
cdc_ether: flag the Cinterion AHS8 modem by gemalto as WWAN
hwmon: (ina2xx) Fix access to uninitialized mutex
rtl8187: Fix NULL pointer dereference in priv->conf_mutex
getname_kernel() needs to make sure that ->name != ->iname in long case
s390/ipl: ensure loadparm valid flag is set
s390/qdio: don't merge ERROR output buffers
s390/qdio: don't retry EQBS after CCQ 96
block/loop: fix deadlock after loop_set_status
Revert "perf tests: Decompress kernel module before objdump"
radeon: hide pointless #warning when compile testing
perf intel-pt: Fix timestamp following overflow
perf intel-pt: Fix error recovery from missing TIP packet
perf intel-pt: Fix sync_switch
perf intel-pt: Fix overlap detection to identify consecutive buffers correctly
parisc: Fix out of array access in match_pci_device()
media: v4l2-compat-ioctl32: don't oops on overlay
f2fs: check cap_resource only for data blocks
Revert "f2fs: introduce f2fs_set_page_dirty_nobuffer"
f2fs: clear PageError on writepage
UPSTREAM: timer: Export destroy_hrtimer_on_stack()
BACKPORT: dm verity: add 'check_at_most_once' option to only validate hashes once
f2fs: call unlock_new_inode() before d_instantiate()
f2fs: refactor read path to allow multiple postprocessing steps
fscrypt: allow synchronous bio decryption
Change-Id: I45f4ac10734d92023b53118d83dcd6c83974a283
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Greg Kroah-Hartman [Tue, 24 Apr 2018 08:42:34 +0000 (10:42 +0200)]
Merge 4.4.129 into android-4.4
Changes in 4.4.129
media: v4l2-compat-ioctl32: don't oops on overlay
parisc: Fix out of array access in match_pci_device()
perf intel-pt: Fix overlap detection to identify consecutive buffers correctly
perf intel-pt: Fix sync_switch
perf intel-pt: Fix error recovery from missing TIP packet
perf intel-pt: Fix timestamp following overflow
radeon: hide pointless #warning when compile testing
Revert "perf tests: Decompress kernel module before objdump"
block/loop: fix deadlock after loop_set_status
s390/qdio: don't retry EQBS after CCQ 96
s390/qdio: don't merge ERROR output buffers
s390/ipl: ensure loadparm valid flag is set
getname_kernel() needs to make sure that ->name != ->iname in long case
rtl8187: Fix NULL pointer dereference in priv->conf_mutex
hwmon: (ina2xx) Fix access to uninitialized mutex
cdc_ether: flag the Cinterion AHS8 modem by gemalto as WWAN
slip: Check if rstate is initialized before uncompressing
lan78xx: Correctly indicate invalid OTP
x86/hweight: Get rid of the special calling convention
x86/hweight: Don't clobber %rdi
tty: make n_tty_read() always abort if hangup is in progress
ubifs: Check ubifs_wbuf_sync() return code
ubi: fastmap: Don't flush fastmap work on detach
ubi: Fix error for write access
ubi: Reject MLC NAND
fs/reiserfs/journal.c: add missing resierfs_warning() arg
resource: fix integer overflow at reallocation
ipc/shm: fix use-after-free of shm file via remap_file_pages()
mm, slab: reschedule cache_reap() on the same CPU
usb: musb: gadget: misplaced out of bounds check
ARM: dts: at91: at91sam9g25: fix mux-mask pinctrl property
ARM: dts: at91: sama5d4: fix pinctrl compatible string
xen-netfront: Fix hang on device removal
regmap: Fix reversed bounds check in regmap_raw_write()
ACPI / video: Add quirk to force acpi-video backlight on Samsung 670Z5E
ACPI / hotplug / PCI: Check presence of slot itself in get_slot_status()
USB:fix USB3 devices behind USB3 hubs not resuming at hibernate thaw
usb: dwc3: pci: Properly cleanup resource
HID: i2c-hid: fix size check and type usage
powerpc/powernv: Handle unknown OPAL errors in opal_nvram_write()
powerpc/64: Fix smp_wmb barrier definition use use lwsync consistently
powerpc/powernv: define a standard delay for OPAL_BUSY type retry loops
powerpc/powernv: Fix OPAL NVRAM driver OPAL_BUSY loops
HID: Fix hid_report_len usage
HID: core: Fix size as type u32
ASoC: ssm2602: Replace reg_default_raw with reg_default
thunderbolt: Resume control channel after hibernation image is created
random: use a tighter cap in credit_entropy_bits_safe()
jbd2: if the journal is aborted then don't allow update of the log tail
ext4: don't update checksum of new initialized bitmaps
ext4: fail ext4_iget for root directory if unallocated
RDMA/ucma: Don't allow setting RDMA_OPTION_IB_PATH without an RDMA device
ALSA: pcm: Fix UAF at PCM release via PCM timer access
IB/srp: Fix srp_abort()
IB/srp: Fix completion vector assignment algorithm
dmaengine: at_xdmac: fix rare residue corruption
um: Use POSIX ucontext_t instead of struct ucontext
iommu/vt-d: Fix a potential memory leak
mmc: jz4740: Fix race condition in IRQ mask update
clk: mvebu: armada-38x: add support for 1866MHz variants
clk: mvebu: armada-38x: add support for missing clocks
clk: bcm2835: De-assert/assert PLL reset signal when appropriate
thermal: imx: Fix race condition in imx_thermal_probe()
watchdog: f71808e_wdt: Fix WD_EN register read
ALSA: oss: consolidate kmalloc/memset 0 call to kzalloc
ALSA: pcm: Use ERESTARTSYS instead of EINTR in OSS emulation
ALSA: pcm: Avoid potential races between OSS ioctls and read/write
ALSA: pcm: Return -EBUSY for OSS ioctls changing busy streams
ALSA: pcm: Fix mutex unbalance in OSS emulation ioctls
ALSA: pcm: Fix endless loop for XRUN recovery in OSS emulation
vfio-pci: Virtualize PCIe & AF FLR
vfio/pci: Virtualize Maximum Payload Size
vfio/pci: Virtualize Maximum Read Request Size
ext4: don't allow r/w mounts if metadata blocks overlap the superblock
drm/radeon: Fix PCIe lane width calculation
ext4: fix crashes in dioread_nolock mode
ext4: fix deadlock between inline_data and ext4_expand_extra_isize_ea()
ALSA: line6: Use correct endpoint type for midi output
ALSA: rawmidi: Fix missing input substream checks in compat ioctls
ALSA: hda - New VIA controller suppor no-snoop path
HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device
MIPS: uaccess: Add micromips clobbers to bzero invocation
MIPS: memset.S: EVA & fault support for small_memset
MIPS: memset.S: Fix return of __clear_user from Lpartial_fixup
MIPS: memset.S: Fix clobber of v1 in last_fixup
powerpc/eeh: Fix enabling bridge MMIO windows
powerpc/lib: Fix off-by-one in alternate feature patching
jffs2_kill_sb(): deal with failed allocations
hypfs_kill_super(): deal with failed allocations
rpc_pipefs: fix double-dput()
Don't leak MNT_INTERNAL away from internal mounts
autofs: mount point create should honour passed in mode
mm: allow GFP_{FS,IO} for page_cache_read page cache allocation
mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
ext4: bugfix for mmaped pages in mpage_release_unused_pages()
fanotify: fix logic of events on child
writeback: safer lock nesting
Linux 4.4.129
Change-Id: I8806d2cc92fe512f27a349e8f630ced0cac9a8d7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Greg Kroah-Hartman [Tue, 24 Apr 2018 07:32:12 +0000 (09:32 +0200)]
Linux 4.4.129
Greg Thelen [Fri, 20 Apr 2018 21:55:42 +0000 (14:55 -0700)]
writeback: safer lock nesting
commit
2e898e4c0a3897ccd434adac5abb8330194f527b upstream.
lock_page_memcg()/unlock_page_memcg() use spin_lock_irqsave/restore() if
the page's memcg is undergoing move accounting, which occurs when a
process leaves its memcg for a new one that has
memory.move_charge_at_immigrate set.
unlocked_inode_to_wb_begin,end() use spin_lock_irq/spin_unlock_irq() if
the given inode is switching writeback domains. Switches occur when
enough writes are issued from a new domain.
This existing pattern is thus suspicious:
lock_page_memcg(page);
unlocked_inode_to_wb_begin(inode, &locked);
...
unlocked_inode_to_wb_end(inode, locked);
unlock_page_memcg(page);
If both inode switch and process memcg migration are both in-flight then
unlocked_inode_to_wb_end() will unconditionally enable interrupts while
still holding the lock_page_memcg() irq spinlock. This suggests the
possibility of deadlock if an interrupt occurs before unlock_page_memcg().
truncate
__cancel_dirty_page
lock_page_memcg
unlocked_inode_to_wb_begin
unlocked_inode_to_wb_end
<interrupts mistakenly enabled>
<interrupt>
end_page_writeback
test_clear_page_writeback
lock_page_memcg
<deadlock>
unlock_page_memcg
Due to configuration limitations this deadlock is not currently possible
because we don't mix cgroup writeback (a cgroupv2 feature) and
memory.move_charge_at_immigrate (a cgroupv1 feature).
If the kernel is hacked to always claim inode switching and memcg
moving_account, then this script triggers lockup in less than a minute:
cd /mnt/cgroup/memory
mkdir a b
echo 1 > a/memory.move_charge_at_immigrate
echo 1 > b/memory.move_charge_at_immigrate
(
echo $BASHPID > a/cgroup.procs
while true; do
dd if=/dev/zero of=/mnt/big bs=1M count=256
done
) &
while true; do
sync
done &
sleep 1h &
SLEEP=$!
while true; do
echo $SLEEP > a/cgroup.procs
echo $SLEEP > b/cgroup.procs
done
The deadlock does not seem possible, so it's debatable if there's any
reason to modify the kernel. I suggest we should to prevent future
surprises. And Wang Long said "this deadlock occurs three times in our
environment", so there's more reason to apply this, even to stable.
Stable 4.4 has minor conflicts applying this patch. For a clean 4.4 patch
see "[PATCH for-4.4] writeback: safer lock nesting"
https://lkml.org/lkml/2018/4/11/146
Wang Long said "this deadlock occurs three times in our environment"
[gthelen@google.com: v4]
Link: http://lkml.kernel.org/r/20180411084653.254724-1-gthelen@google.com
[akpm@linux-foundation.org: comment tweaks, struct initialization simplification]
Change-Id: Ibb773e8045852978f6207074491d262f1b3fb613
Link: http://lkml.kernel.org/r/20180410005908.167976-1-gthelen@google.com
Fixes:
682aa8e1a6a1 ("writeback: implement unlocked_inode_to_wb transaction and use it for stat updates")
Signed-off-by: Greg Thelen <gthelen@google.com>
Reported-by: Wang Long <wanglong19@meituan.com>
Acked-by: Wang Long <wanglong19@meituan.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: <stable@vger.kernel.org> [v4.2+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[natechancellor: Applied to 4.4 based on Greg's backport on lkml.org]
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Amir Goldstein [Wed, 4 Apr 2018 20:42:18 +0000 (23:42 +0300)]
fanotify: fix logic of events on child
commit
54a307ba8d3cd00a3902337ffaae28f436eeb1a4 upstream.
When event on child inodes are sent to the parent inode mark and
parent inode mark was not marked with FAN_EVENT_ON_CHILD, the event
will not be delivered to the listener process. However, if the same
process also has a mount mark, the event to the parent inode will be
delivered regadless of the mount mark mask.
This behavior is incorrect in the case where the mount mark mask does
not contain the specific event type. For example, the process adds
a mark on a directory with mask FAN_MODIFY (without FAN_EVENT_ON_CHILD)
and a mount mark with mask FAN_CLOSE_NOWRITE (without FAN_ONDIR).
A modify event on a file inside that directory (and inside that mount)
should not create a FAN_MODIFY event, because neither of the marks
requested to get that event on the file.
Fixes:
1968f5eed54c ("fanotify: use both marks when possible")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
[natechancellor: Fix small conflict due to lack of
3cd5eca8d7a2f]
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
wangguang [Thu, 15 Sep 2016 15:32:46 +0000 (11:32 -0400)]
ext4: bugfix for mmaped pages in mpage_release_unused_pages()
commit
4e800c0359d9a53e6bf0ab216954971b2515247f upstream.
Pages clear buffers after ext4 delayed block allocation failed,
However, it does not clean its pte_dirty flag.
if the pages unmap ,in cording to the pte_dirty ,
unmap_page_range may try to call __set_page_dirty,
which may lead to the bugon at
mpage_prepare_extent_to_map:head = page_buffers(page);.
This patch just call clear_page_dirty_for_io to clean pte_dirty
at mpage_release_unused_pages for pages mmaped.
Steps to reproduce the bug:
(1) mmap a file in ext4
addr = (char *)mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_SHARED,
fd, 0);
memset(addr, 'i', 4096);
(2) return EIO at
ext4_writepages->mpage_map_and_submit_extent->mpage_map_one_extent
which causes this log message to be print:
ext4_msg(sb, KERN_CRIT,
"Delayed block allocation failed for "
"inode %lu at logical offset %llu with"
" max blocks %u with error %d",
inode->i_ino,
(unsigned long long)map->m_lblk,
(unsigned)map->m_len, -err);
(3)Unmap the addr cause warning at
__set_page_dirty:WARN_ON_ONCE(warn && !PageUptodate(page));
(4) wait for a minute,then bugon happen.
Cc: stable@vger.kernel.org
Signed-off-by: wangguang <wangguang03@zte.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
[@nathanchance: Resolved conflict from lack of
09cbfeaf1a5a6]
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Matthew Wilcox [Fri, 20 Apr 2018 21:56:20 +0000 (14:56 -0700)]
mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
commit
abc1be13fd113ddef5e2d807a466286b864caed3 upstream.
f2fs specifies the __GFP_ZERO flag for allocating some of its pages.
Unfortunately, the page cache also uses the mapping's GFP flags for
allocating radix tree nodes. It always masked off the __GFP_HIGHMEM
flag, and masks off __GFP_ZERO in some paths, but not all. That causes
radix tree nodes to be allocated with a NULL list_head, which causes
backtraces like:
__list_del_entry+0x30/0xd0
list_lru_del+0xac/0x1ac
page_cache_tree_insert+0xd8/0x110
The __GFP_DMA and __GFP_DMA32 flags would also be able to sneak through
if they are ever used. Fix them all by using GFP_RECLAIM_MASK at the
innermost location, and remove it from earlier in the callchain.
Link: http://lkml.kernel.org/r/20180411060320.14458-2-willy@infradead.org
Fixes:
449dd6984d0e ("mm: keep page cache radix tree nodes in check")
Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
Reported-by: Chris Fries <cfries@google.com>
Debugged-by: Minchan Kim <minchan@kernel.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Michal Hocko [Thu, 14 Jan 2016 23:20:12 +0000 (15:20 -0800)]
mm: allow GFP_{FS,IO} for page_cache_read page cache allocation
commit
c20cd45eb01748f0fba77a504f956b000df4ea73 upstream.
page_cache_read has been historically using page_cache_alloc_cold to
allocate a new page. This means that mapping_gfp_mask is used as the
base for the gfp_mask. Many filesystems are setting this mask to
GFP_NOFS to prevent from fs recursion issues. page_cache_read is called
from the vm_operations_struct::fault() context during the page fault.
This context doesn't need the reclaim protection normally.
ceph and ocfs2 which call filemap_fault from their fault handlers seem
to be OK because they are not taking any fs lock before invoking generic
implementation. xfs which takes XFS_MMAPLOCK_SHARED is safe from the
reclaim recursion POV because this lock serializes truncate and punch
hole with the page faults and it doesn't get involved in the reclaim.
There is simply no reason to deliberately use a weaker allocation
context when a __GFP_FS | __GFP_IO can be used. The GFP_NOFS protection
might be even harmful. There is a push to fail GFP_NOFS allocations
rather than loop within allocator indefinitely with a very limited
reclaim ability. Once we start failing those requests the OOM killer
might be triggered prematurely because the page cache allocation failure
is propagated up the page fault path and end up in
pagefault_out_of_memory.
We cannot play with mapping_gfp_mask directly because that would be racy
wrt. parallel page faults and it might interfere with other users who
really rely on NOFS semantic from the stored gfp_mask. The mask is also
inode proper so it would even be a layering violation. What we can do
instead is to push the gfp_mask into struct vm_fault and allow fs layer
to overwrite it should the callback need to be called with a different
allocation context.
Initialize the default to (mapping_gfp_mask | __GFP_FS | __GFP_IO)
because this should be safe from the page fault path normally. Why do
we care about mapping_gfp_mask at all then? Because this doesn't hold
only reclaim protection flags but it also might contain zone and
movability restrictions (GFP_DMA32, __GFP_MOVABLE and others) so we have
to respect those.
Signed-off-by: Michal Hocko <mhocko@suse.com>
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Jan Kara <jack@suse.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Dave Chinner <david@fromorbit.com>
Cc: Mark Fasheh <mfasheh@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Ian Kent [Fri, 20 Apr 2018 21:55:59 +0000 (14:55 -0700)]
autofs: mount point create should honour passed in mode
commit
1e6306652ba18723015d1b4967fe9de55f042499 upstream.
The autofs file system mkdir inode operation blindly sets the created
directory mode to S_IFDIR | 0555, ingoring the passed in mode, which can
cause selinux dac_override denials.
But the function also checks if the caller is the daemon (as no-one else
should be able to do anything here) so there's no point in not honouring
the passed in mode, allowing the daemon to set appropriate mode when
required.
Link: http://lkml.kernel.org/r/152361593601.8051.14014139124905996173.stgit@pluto.themaw.net
Signed-off-by: Ian Kent <raven@themaw.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Al Viro [Fri, 20 Apr 2018 02:03:08 +0000 (22:03 -0400)]
Don't leak MNT_INTERNAL away from internal mounts
commit
16a34adb9392b2fe4195267475ab5b472e55292c upstream.
We want it only for the stuff created by SB_KERNMOUNT mounts, *not* for
their copies. As it is, creating a deep stack of bindings of /proc/*/ns/*
somewhere in a new namespace and exiting yields a stack overflow.
Cc: stable@kernel.org
Reported-by: Alexander Aring <aring@mojatatu.com>
Bisected-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Tested-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Tested-by: Alexander Aring <aring@mojatatu.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Al Viro [Tue, 3 Apr 2018 05:15:46 +0000 (01:15 -0400)]
rpc_pipefs: fix double-dput()
commit
4a3877c4cedd95543f8726b0a98743ed8db0c0fb upstream.
if we ever hit rpc_gssd_dummy_depopulate() dentry passed to
it has refcount equal to 1. __rpc_rmpipe() drops it and
dput() done after that hits an already freed dentry.
Cc: stable@kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Al Viro [Tue, 3 Apr 2018 03:50:31 +0000 (23:50 -0400)]
hypfs_kill_super(): deal with failed allocations
commit
a24cd490739586a7d2da3549a1844e1d7c4f4fc4 upstream.
hypfs_fill_super() might fail to allocate sbi; hypfs_kill_super()
should not oops on that.
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Al Viro [Tue, 3 Apr 2018 03:56:44 +0000 (23:56 -0400)]
jffs2_kill_sb(): deal with failed allocations
commit
c66b23c2840446a82c389e4cb1a12eb2a71fa2e4 upstream.
jffs2_fill_super() might fail to allocate jffs2_sb_info;
jffs2_kill_sb() must survive that.
Cc: stable@kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Michael Ellerman [Mon, 16 Apr 2018 13:25:19 +0000 (23:25 +1000)]
powerpc/lib: Fix off-by-one in alternate feature patching
commit
b8858581febb050688e276b956796bc4a78299ed upstream.
When we patch an alternate feature section, we have to adjust any
relative branches that branch out of the alternate section.
But currently we have a bug if we have a branch that points to past
the last instruction of the alternate section, eg:
FTR_SECTION_ELSE
1: b 2f
or 6,6,6
2:
ALT_FTR_SECTION_END(...)
nop
This will result in a relative branch at 1 with a target that equals
the end of the alternate section.
That branch does not need adjusting when it's moved to the non-else
location. Currently we do adjust it, resulting in a branch that goes
off into the link-time location of the else section, which is junk.
The fix is to not patch branches that have a target == end of the
alternate section.
Fixes:
d20fe50a7b3c ("KVM: PPC: Book3S HV: Branch inside feature section")
Fixes:
9b1a735de64c ("powerpc: Add logic to patch alternative feature sections")
Cc: stable@vger.kernel.org # v2.6.27+
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Michael Neuling [Wed, 11 Apr 2018 03:37:58 +0000 (13:37 +1000)]
powerpc/eeh: Fix enabling bridge MMIO windows
commit
13a83eac373c49c0a081cbcd137e79210fe78acd upstream.
On boot we save the configuration space of PCIe bridges. We do this so
when we get an EEH event and everything gets reset that we can restore
them.
Unfortunately we save this state before we've enabled the MMIO space
on the bridges. Hence if we have to reset the bridge when we come back
MMIO is not enabled and we end up taking an PE freeze when the driver
starts accessing again.
This patch forces the memory/MMIO and bus mastering on when restoring
bridges on EEH. Ideally we'd do this correctly by saving the
configuration space writes later, but that will have to come later in
a larger EEH rewrite. For now we have this simple fix.
The original bug can be triggered on a boston machine by doing:
echo 0x8000000000000000 > /sys/kernel/debug/powerpc/PCI0001/err_injct_outbound
On boston, this PHB has a PCIe switch on it. Without this patch,
you'll see two EEH events, 1 expected and 1 the failure we are fixing
here. The second EEH event causes the anything under the PHB to
disappear (i.e. the i40e eth).
With this patch, only 1 EEH event occurs and devices properly recover.
Fixes:
652defed4875 ("powerpc/eeh: Check PCIe link after reset")
Cc: stable@vger.kernel.org # v3.11+
Reported-by: Pridhiviraj Paidipeddi <ppaidipe@linux.vnet.ibm.com>
Signed-off-by: Michael Neuling <mikey@neuling.org>
Acked-by: Russell Currey <ruscur@russell.cc>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Matt Redfearn [Tue, 17 Apr 2018 15:40:00 +0000 (16:40 +0100)]
MIPS: memset.S: Fix clobber of v1 in last_fixup
commit
c96eebf07692e53bf4dd5987510d8b550e793598 upstream.
The label .Llast_fixup\@ is jumped to on page fault within the final
byte set loop of memset (on < MIPSR6 architectures). For some reason, in
this fault handler, the v1 register is randomly set to a2 & STORMASK.
This clobbers v1 for the calling function. This can be observed with the
following test code:
static int __init __attribute__((optimize("O0"))) test_clear_user(void)
{
register int t asm("v1");
char *test;
int j, k;
pr_info("\n\n\nTesting clear_user\n");
test = vmalloc(PAGE_SIZE);
for (j = 256; j < 512; j++) {
t = 0xa5a5a5a5;
if ((k = clear_user(test + PAGE_SIZE - 256, j)) != j - 256) {
pr_err("clear_user (%px %d) returned %d\n", test + PAGE_SIZE - 256, j, k);
}
if (t != 0xa5a5a5a5) {
pr_err("v1 was clobbered to 0x%x!\n", t);
}
}
return 0;
}
late_initcall(test_clear_user);
Which demonstrates that v1 is indeed clobbered (MIPS64):
Testing clear_user
v1 was clobbered to 0x1!
v1 was clobbered to 0x2!
v1 was clobbered to 0x3!
v1 was clobbered to 0x4!
v1 was clobbered to 0x5!
v1 was clobbered to 0x6!
v1 was clobbered to 0x7!
Since the number of bytes that could not be set is already contained in
a2, the andi placing a value in v1 is not necessary and actively
harmful in clobbering v1.
Reported-by: James Hogan <jhogan@kernel.org>
Signed-off-by: Matt Redfearn <matt.redfearn@mips.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Cc: stable@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/19109/
Signed-off-by: James Hogan <jhogan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Matt Redfearn [Tue, 17 Apr 2018 14:52:21 +0000 (15:52 +0100)]
MIPS: memset.S: Fix return of __clear_user from Lpartial_fixup
commit
daf70d89f80c6e1772233da9e020114b1254e7e0 upstream.
The __clear_user function is defined to return the number of bytes that
could not be cleared. From the underlying memset / bzero implementation
this means setting register a2 to that number on return. Currently if a
page fault is triggered within the memset_partial block, the value
loaded into a2 on return is meaningless.
The label .Lpartial_fixup\@ is jumped to on page fault. In order to work
out how many bytes failed to copy, the exception handler should find how
many bytes left in the partial block (andi a2, STORMASK), add that to
the partial block end address (a2), and subtract the faulting address to
get the remainder. Currently it incorrectly subtracts the partial block
start address (t1), which has additionally been clobbered to generate a
jump target in memset_partial. Fix this by adding the block end address
instead.
This issue was found with the following test code:
int j, k;
for (j = 0; j < 512; j++) {
if ((k = clear_user(NULL, j)) != j) {
pr_err("clear_user (NULL %d) returned %d\n", j, k);
}
}
Which now passes on Creator Ci40 (MIPS32) and Cavium Octeon II (MIPS64).
Suggested-by: James Hogan <jhogan@kernel.org>
Signed-off-by: Matt Redfearn <matt.redfearn@mips.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Cc: stable@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/19108/
Signed-off-by: James Hogan <jhogan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Matt Redfearn [Thu, 29 Mar 2018 09:28:23 +0000 (10:28 +0100)]
MIPS: memset.S: EVA & fault support for small_memset
commit
8a8158c85e1e774a44fbe81106fa41138580dfd1 upstream.
The MIPS kernel memset / bzero implementation includes a small_memset
branch which is used when the region to be set is smaller than a long (4
bytes on 32bit, 8 bytes on 64bit). The current small_memset
implementation uses a simple store byte loop to write the destination.
There are 2 issues with this implementation:
1. When EVA mode is active, user and kernel address spaces may overlap.
Currently the use of the sb instruction means kernel mode addressing is
always used and an intended write to userspace may actually overwrite
some critical kernel data.
2. If the write triggers a page fault, for example by calling
__clear_user(NULL, 2), instead of gracefully handling the fault, an OOPS
is triggered.
Fix these issues by replacing the sb instruction with the EX() macro,
which will emit EVA compatible instuctions as required. Additionally
implement a fault fixup for small_memset which sets a2 to the number of
bytes that could not be cleared (as defined by __clear_user).
Reported-by: Chuanhua Lei <chuanhua.lei@intel.com>
Signed-off-by: Matt Redfearn <matt.redfearn@mips.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Cc: stable@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/18975/
Signed-off-by: James Hogan <jhogan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Matt Redfearn [Tue, 17 Apr 2018 15:40:01 +0000 (16:40 +0100)]
MIPS: uaccess: Add micromips clobbers to bzero invocation
commit
b3d7e55c3f886493235bfee08e1e5a4a27cbcce8 upstream.
The micromips implementation of bzero additionally clobbers registers t7
& t8. Specify this in the clobbers list when invoking bzero.
Fixes:
26c5e07d1478 ("MIPS: microMIPS: Optimise 'memset' core library function.")
Reported-by: James Hogan <jhogan@kernel.org>
Signed-off-by: Matt Redfearn <matt.redfearn@mips.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Cc: <stable@vger.kernel.org> # 3.10+
Patchwork: https://patchwork.linux-mips.org/patch/19110/
Signed-off-by: James Hogan <jhogan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Rodrigo Rivas Costa [Thu, 5 Apr 2018 23:09:36 +0000 (01:09 +0200)]
HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device
commit
a955358d54695e4ad9f7d6489a7ac4d69a8fc711 upstream.
Doing `ioctl(HIDIOCGFEATURE)` in a tight loop on a hidraw device
and then disconnecting the device, or unloading the driver, can
cause a NULL pointer dereference.
When a hidraw device is destroyed it sets 0 to `dev->exist`.
Most functions check 'dev->exist' before doing its work, but
`hidraw_get_report()` was missing that check.
Cc: stable@vger.kernel.org
Signed-off-by: Rodrigo Rivas Costa <rodrigorivascosta@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
David Wang [Mon, 16 Apr 2018 09:48:09 +0000 (17:48 +0800)]
ALSA: hda - New VIA controller suppor no-snoop path
commit
af52f9982e410edac21ca4b49563053ffc9da1eb upstream.
This patch is used to tell kernel that new VIA HDAC controller also
support no-snoop path.
[ minor coding style fix by tiwai ]
Signed-off-by: David Wang <davidwang@zhaoxin.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Takashi Iwai [Thu, 19 Apr 2018 16:16:15 +0000 (18:16 +0200)]
ALSA: rawmidi: Fix missing input substream checks in compat ioctls
commit
8a56ef4f3ffba9ebf4967b61ef600b0a7ba10f11 upstream.
Some rawmidi compat ioctls lack of the input substream checks
(although they do check only for rfile->output). This many eventually
lead to an Oops as NULL substream is passed to the rawmidi core
functions.
Fix it by adding the proper checks before each function call.
The bug was spotted by syzkaller.
Reported-by: syzbot+f7a0348affc3b67bc617@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>