- Linux-stable-mirror - lists.linaro.org

[PATCH 4.4.y] Bluetooth: Fix decrementing reference count twice in releasing socket

by Zubin Mithra

From: Myungho Jung <mhjungk(a)gmail.com> commit e20a2e9c42c9e4002d9e338d74e7819e88d77162 upstream When releasing socket, it is possible to enter hci_sock_release() and hci_sock_dev_event(HCI_DEV_UNREG) at the same time in different thread. The reference count of hdev should be decremented only once from one of them but if storing hdev to local variable in hci_sock_release() before detached from socket and setting to NULL in hci_sock_dev_event(), hci_dev_put(hdev) is unexpectedly called twice. This is resolved by referencing hdev from socket after bt_sock_unlink() in hci_sock_release(). Reported-by: syzbot+fdc00003f4efff43bc5b(a)syzkaller.appspotmail.com Signed-off-by: Myungho Jung <mhjungk(a)gmail.com> Signed-off-by: Marcel Holtmann <marcel(a)holtmann.org> Signed-off-by: Zubin Mithra <zsm(a)chromium.org> --- Notes: * Syzkaller reported a UAF read with the following call trace when fuzzing a 4.4 kernel. Call Trace: [<ffffffff8198c89a>] __dump_stack lib/dump_stack.c:15 [inline] [<ffffffff8198c89a>] dump_stack+0xbf/0x113 lib/dump_stack.c:51 [<ffffffff8146d0d8>] print_trailer+0x14c/0x155 mm/slub.c:658 [<ffffffff814542cd>] check_bytes_and_report+0xa8/0xe9 mm/slub.c:725 [<ffffffff814546d2>] check_object+0x108/0x1eb mm/slub.c:846 [<ffffffff81454f84>] alloc_debug_processing+0x65/0x103 mm/slub.c:1057 [<ffffffff8145519a>] ___slab_alloc.constprop.68+0x178/0x3c3 mm/slub.c:2421 [<ffffffff8145542d>] __slab_alloc.isra.63.constprop.67+0x48/0x79 mm/slub.c:2450 [<ffffffff814558f4>] slab_alloc_node mm/slub.c:2513 [inline] [<ffffffff814558f4>] slab_alloc mm/slub.c:2555 [inline] [<ffffffff814558f4>] __kmalloc+0xb6/0x170 mm/slub.c:3521 [<ffffffff82f97bf4>] kmalloc include/linux/slab.h:481 [inline] [<ffffffff82f97bf4>] kzalloc.constprop.17+0x1c/0x1e include/linux/slab.h:620 [<ffffffff82f97c15>] hci_alloc_dev+0x1f/0x156c net/bluetooth/hci_core.c:2945 [<ffffffff827ce5ab>] __vhci_create_device+0x8c/0x3f9 drivers/bluetooth/hci_vhci.c:114 [<ffffffff827cebe0>] vhci_create_device drivers/bluetooth/hci_vhci.c:163 [inline] [<ffffffff827cebe0>] vhci_get_user drivers/bluetooth/hci_vhci.c:219 [inline] [<ffffffff827cebe0>] vhci_write+0x2c8/0x317 drivers/bluetooth/hci_vhci.c:299 [<ffffffff81473309>] new_sync_write fs/read_write.c:478 [inline] [<ffffffff81473309>] __vfs_write+0x22c/0x2dd fs/read_write.c:491 [<ffffffff81474724>] vfs_write+0x14c/0x182 fs/read_write.c:538 [<ffffffff814759e1>] SYSC_write fs/read_write.c:585 [inline] [<ffffffff814759e1>] SyS_write+0xdf/0x163 fs/read_write.c:577 [<ffffffff832c56ba>] entry_SYSCALL_64_fastpath+0x31/0xb3 * This commit is present in 4.9.y. * Applying the original upstream commit causes a conflict as there is a change in the surrounding code. * Tests run: Chrome OS tryjobs, Syzkaller reproducer net/bluetooth/hci_sock.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c index c842f40c1173..ea1cd8b21708 100644 --- a/net/bluetooth/hci_sock.c +++ b/net/bluetooth/hci_sock.c @@ -558,13 +558,12 @@ static int hci_sock_release(struct socket *sock) if (!sk) return 0; - hdev = hci_pi(sk)->hdev; - if (hci_pi(sk)->channel == HCI_CHANNEL_MONITOR) atomic_dec(&monitor_promisc); bt_sock_unlink(&hci_sk_list, sk); + hdev = hci_pi(sk)->hdev; if (hdev) { if (hci_pi(sk)->channel == HCI_CHANNEL_USER) { /* When releasing an user channel exclusive access, -- 2.21.0.392.gf8f6787159e-goog

6 years, 7 months

2
1
0 0

[PATCH] i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA

by Connor O'Brien

From: Jeremy Compostella <jeremy.compostella(a)intel.com> commit 89c6efa61f5709327ecfa24bff18e57a4e80c7fa upstream. On a I2C_SMBUS_I2C_BLOCK_DATA read request, if data->block[0] is greater than I2C_SMBUS_BLOCK_MAX + 1, the underlying I2C driver writes data out of the msgbuf1 array boundary. It is possible from a user application to run into that issue by calling the I2C_SMBUS ioctl with data.block[0] greater than I2C_SMBUS_BLOCK_MAX + 1. This patch makes the code compliant with Documentation/i2c/dev-interface by raising an error when the requested size is larger than 32 bytes. Call Trace: [<ffffffff8139f695>] dump_stack+0x67/0x92 [<ffffffff811802a4>] panic+0xc5/0x1eb [<ffffffff810ecb5f>] ? vprintk_default+0x1f/0x30 [<ffffffff817456d3>] ? i2cdev_ioctl_smbus+0x303/0x320 [<ffffffff8109a68b>] __stack_chk_fail+0x1b/0x20 [<ffffffff817456d3>] i2cdev_ioctl_smbus+0x303/0x320 [<ffffffff81745aed>] i2cdev_ioctl+0x4d/0x1e0 [<ffffffff811f761a>] do_vfs_ioctl+0x2ba/0x490 [<ffffffff81336e43>] ? security_file_ioctl+0x43/0x60 [<ffffffff811f7869>] SyS_ioctl+0x79/0x90 [<ffffffff81a22e97>] entry_SYSCALL_64_fastpath+0x12/0x6a Signed-off-by: Jeremy Compostella <jeremy.compostella(a)intel.com> Signed-off-by: Wolfram Sang <wsa(a)the-dreams.de> Cc: stable(a)kernel.org [connoro(a)google.com: 4.9 backport: adjust filename] Signed-off-by: Connor O'Brien <connoro(a)google.com> --- drivers/i2c/i2c-core.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c index 7484aac1e14d..80d82c6792d8 100644 --- a/drivers/i2c/i2c-core.c +++ b/drivers/i2c/i2c-core.c @@ -3250,16 +3250,16 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr, the underlying bus driver */ break; case I2C_SMBUS_I2C_BLOCK_DATA: + if (data->block[0] > I2C_SMBUS_BLOCK_MAX) { + dev_err(&adapter->dev, "Invalid block %s size %d\n", + read_write == I2C_SMBUS_READ ? "read" : "write", + data->block[0]); + return -EINVAL; + } if (read_write == I2C_SMBUS_READ) { msg[1].len = data->block[0]; } else { msg[0].len = data->block[0] + 1; - if (msg[0].len > I2C_SMBUS_BLOCK_MAX + 1) { - dev_err(&adapter->dev, - "Invalid block write size %d\n", - data->block[0]); - return -EINVAL; - } for (i = 1; i <= data->block[0]; i++) msgbuf0[i] = data->block[i]; } -- 2.21.0.392.gf8f6787159e-goog

6 years, 7 months

2
1
0 0

Re: [4.14-stable PATCH] mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified

by Greg KH

On Tue, Apr 02, 2019 at 07:16:20AM +0800, Yang Shi wrote: > commit a7f40cfe3b7ada57af9b62fd28430eeb4a7cfcb7 upstream > > When MPOL_MF_STRICT was specified and an existing page was already on a > node that does not follow the policy, mbind() should return -EIO. But > commit 6f4576e3687b ("mempolicy: apply page table walker on > queue_pages_range()") broke the rule. > > And commit c8633798497c ("mm: mempolicy: mbind and migrate_pages support > thp migration") didn't return the correct value for THP mbind() too. > > If MPOL_MF_STRICT is set, ignore vma_migratable() to make sure it > reaches queue_pages_to_pte_range() or queue_pages_pmd() to check if an > existing page was already on a node that does not follow the policy. > And, non-migratable vma may be used, return -EIO too if MPOL_MF_MOVE or > MPOL_MF_MOVE_ALL was specified. > > Tested with https://github.com/metan-ucw/ltp/blob/master/testcases/kernel/syscalls/mbin… > > [akpm(a)linux-foundation.org: tweak code comment] > Link: http://lkml.kernel.org/r/1553020556-38583-1-git-send-email-yang.shi@linux.a… > Fixes: 6f4576e3687b ("mempolicy: apply page table walker on queue_pages_range()") > Signed-off-by: Yang Shi <yang.shi(a)linux.alibaba.com> > Signed-off-by: Oscar Salvador <osalvador(a)suse.de> > Reported-by: Cyril Hrubis <chrubis(a)suse.cz> > Suggested-by: Kirill A. Shutemov <kirill(a)shutemov.name> > Acked-by: Rafael Aquini <aquini(a)redhat.com> > Reviewed-by: Oscar Salvador <osalvador(a)suse.de> > Acked-by: David Rientjes <rientjes(a)google.com> > Cc: Vlastimil Babka <vbabka(a)suse.cz> > Cc: <stable(a)vger.kernel.org> > Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> > Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> > --- > mm/mempolicy.c | 40 +++++++++++++++++++++++++++++++++------- > 1 file changed, 33 insertions(+), 7 deletions(-) All 3 of these now queued up, thanks. greg k-h

6 years, 7 months

1
0
0 0

[PATCH 4.19 BACKPORT] arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals

by Will Deacon

Commit b9a4b9d084d978f80eb9210727c81804588b42ff upstream. FAR_EL1 is UNKNOWN for all debug exceptions other than those caused by taking a hardware watchpoint. Unfortunately, if a debug handler returns a non-zero value, then we will propagate the UNKNOWN FAR value to userspace via the si_addr field of the SIGTRAP siginfo_t. Instead, let's set si_addr to take on the PC of the faulting instruction, which we have available in the current pt_regs. Cc: <stable(a)vger.kernel.org> # 4.19.y Reviewed-by: Mark Rutland <mark.rutland(a)arm.com> Signed-off-by: Will Deacon <will.deacon(a)arm.com> Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> --- arch/arm64/mm/fault.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 50b30ff30de4..a4c134677285 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -827,11 +827,12 @@ void __init hook_debug_fault_code(int nr, debug_fault_info[nr].name = name; } -asmlinkage int __exception do_debug_exception(unsigned long addr, +asmlinkage int __exception do_debug_exception(unsigned long addr_if_watchpoint, unsigned int esr, struct pt_regs *regs) { const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr); + unsigned long pc = instruction_pointer(regs); int rv; /* @@ -841,10 +842,10 @@ asmlinkage int __exception do_debug_exception(unsigned long addr, if (interrupts_enabled(regs)) trace_hardirqs_off(); - if (user_mode(regs) && instruction_pointer(regs) > TASK_SIZE) + if (user_mode(regs) && pc > TASK_SIZE) arm64_apply_bp_hardening(); - if (!inf->fn(addr, esr, regs)) { + if (!inf->fn(addr_if_watchpoint, esr, regs)) { rv = 1; } else { struct siginfo info; @@ -853,7 +854,7 @@ asmlinkage int __exception do_debug_exception(unsigned long addr, info.si_signo = inf->sig; info.si_errno = 0; info.si_code = inf->code; - info.si_addr = (void __user *)addr; + info.si_addr = (void __user *)pc; arm64_notify_die(inf->name, regs, &info, esr); rv = 0; } -- 2.11.0

6 years, 7 months

2
1
0 0

[PATCH 4.4 000/131] 4.4.178-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.4.178 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed Apr 3 16:59:39 UTC 2019. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.178-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.4.178-rc1 Geert Uytterhoeven <geert(a)linux-m68k.org> stm class: Hide STM-specific options if STM is disabled Mathieu Poirier <mathieu.poirier(a)linaro.org> coresight: removing bind/unbind options from sysfs Eric Biggers <ebiggers(a)google.com> arm64: support keyctl() system call in 32-bit mode Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "USB: core: only clean up what we allocated" Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: Fix port resume done detection for SS ports with LPM enabled Sean Christopherson <sean.j.christopherson(a)intel.com> KVM: Reject device ioctls from processes other than the VM's creator Thomas Gleixner <tglx(a)linutronix.de> x86/smp: Enforce CONFIG_HOTPLUG_CPU when SMP=y Adrian Hunter <adrian.hunter(a)intel.com> perf intel-pt: Fix TSC slip Axel Lin <axel.lin(a)ingics.com> gpio: adnp: Fix testing wrong value in adnp_gpio_direction_input YueHaibing <yuehaibing(a)huawei.com> fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links Wentao Wang <witallwang(a)gmail.com> Disable kgdboc failed by echo space to /sys/module/kgdboc/parameters/kgdboc Bjørn Mork <bjorn(a)mork.no> USB: serial: option: add Olicard 600 Mans Rullgard <mans(a)mansr.com> USB: serial: option: set driver_info for SIM5218 and compatibles Lin Yi <teroincn(a)163.com> USB: serial: mos7720: fix mos_parport refcount imbalance on error path George McCollister <george.mccollister(a)gmail.com> USB: serial: ftdi_sio: add additional NovaTech products Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> USB: serial: cp210x: add new device id Hoan Nguyen An <na-hoan(a)jinso.co.jp> serial: sh-sci: Fix setting SCSCR_TIE while transferring data Aditya Pakki <pakki001(a)umn.edu> serial: max310x: Fix to avoid potential NULL pointer dereference Malcolm Priestley <tvboxspy(a)gmail.com> staging: vt6655: Fix interrupt race condition on device start up. Malcolm Priestley <tvboxspy(a)gmail.com> staging: vt6655: Remove vif check from vnt_interrupt Kangjie Lu <kjlu(a)umn.edu> tty: atmel_serial: fix a potential NULL pointer dereference Steffen Maier <maier(a)linux.ibm.com> scsi: zfcp: fix scsi_eh host reset with port_forced ERP for non-NPIV FCP devices Steffen Maier <maier(a)linux.ibm.com> scsi: zfcp: fix rport unblock if deleted SCSI devices on Scsi_Host Bart Van Assche <bvanassche(a)acm.org> scsi: sd: Fix a race between closing an sd device and sd I/O Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Don't suspend stream in unrecoverable PCM state Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Fix possible OOB access in PCM oss plugins Gustavo A. R. Silva <gustavo(a)embeddedor.com> ALSA: seq: oss: Fix Spectre v1 vulnerability Gustavo A. R. Silva <gustavo(a)embeddedor.com> ALSA: rawmidi: Fix potential Spectre v1 vulnerability Ravindra Lokhande <rlokhande(a)nvidia.com> ALSA: compress: add support for 32bit calls in a 64bit kernel Kohji Okuno <okuno.kohji(a)jp.panasonic.com> ARM: imx6q: cpuidle: fix bug that CPU might not wake up at expected time Andrea Righi <andrea.righi(a)canonical.com> btrfs: raid56: properly unmap parity page in finish_parity_scrub() Josef Bacik <josef(a)toxicpanda.com> btrfs: remove WARN_ON in log_dir_items Finn Thain <fthain(a)telegraphics.com.au> mac8390: Fix mmio access size probe Xin Long <lucien.xin(a)gmail.com> sctp: get sctphdr by offset in sctp_compute_cksum Zhiqiang Liu <liuzhiqiang26(a)huawei.com> vxlan: Don't call gro_cells_destroy() before device is unregistered Eric Dumazet <edumazet(a)google.com> tcp: do not use ipv6 header for ipv4 flow Maxime Chevallier <maxime.chevallier(a)bootlin.com> packets: Always register packet sk in the same order David S. Miller <davem(a)davemloft.net> Add hlist_add_tail_rcu() (Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net) Eric Dumazet <edumazet(a)google.com> net: rose: fix a possible stack overflow Christoph Paasch <cpaasch(a)apple.com> net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec Bjorn Helgaas <bhelgaas(a)google.com> mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S Eric Dumazet <edumazet(a)google.com> dccp: do not use ipv6 header for ipv4 flow Bhadram Varka <vbhadram(a)nvidia.com> stmmac: copy unicast mac address to MAC registers Johannes Berg <johannes.berg(a)intel.com> cfg80211: size various nl80211 messages correctly Chaotian Jing <chaotian.jing(a)mediatek.com> mmc: mmc: fix switch timeout issue caused by jiffies precision Ezequiel Garcia <ezequiel(a)vanguardiasur.com.ar> arm64: kconfig: drop CONFIG_RTC_LIB dependency Christoffer Dall <christoffer.dall(a)linaro.org> video: fbdev: Set pixclock = 0 in goldfishfb Lianwei Wang <lianwei.wang(a)gmail.com> cpu/hotplug: Handle unbalanced hotplug enable/disable Xerox Lin <xerox_lin(a)htc.com> usb: gadget: rndis: free response queue during REMOTE_NDIS_RESET_MSG Winter Wang <wente.wang(a)nxp.com> usb: gadget: configfs: add mutex lock before unregister gadget Hannes Frederic Sowa <hannes(a)stressinduktion.org> ipv6: fix endianness error in icmpv6_err Alexander Shishkin <alexander.shishkin(a)linux.intel.com> stm class: Fix stm device initialization order Alexander Shishkin <alexander.shishkin(a)linux.intel.com> stm class: Do not leak the chrdev in error path James Morse <james.morse(a)arm.com> PM / Hibernate: Call flush_icache_range() on pages restored in-place James Morse <james.morse(a)arm.com> arm64: kernel: Include _AC definition in page.h Alexander Shishkin <alexander.shishkin(a)linux.intel.com> perf/ring_buffer: Refuse to begin AUX transaction after rb->aux_mmap_count drops Jeff Mahoney <jeffm(a)suse.com> mac80211: fix "warning: ‘target_metric’ may be used uninitialized" Ard Biesheuvel <ard.biesheuvel(a)linaro.org> arm64/kernel: fix incorrect EL0 check in inv_entry macro Lorenzo Pieralisi <lorenzo.pieralisi(a)arm.com> ARM: 8510/1: rework ARM_CPU_SUSPEND dependencies Greg Hackmann <ghackmann(a)google.com> staging: goldfish: audio: fix compiliation on arm Rajmal Menariya <rajmal.menariya(a)spreadtrum.com> staging: ion: Set minimum carveout heap allocation order to PAGE_SHIFT Rom Lemarchand <romlem(a)android.com> staging: ashmem: Add missing include Laura Abbott <lauraa(a)codeaurora.org> staging: ashmem: Avoid deadlock with mmap/shrink Mark Rutland <mark.rutland(a)arm.com> asm-generic: Fix local variable shadow in __set_fixmap_offset Eric Long <eric.long(a)linaro.org> coresight: etm4x: Check every parameter used by dma_xx_coherent. Eric Long <eric.long(a)linaro.org> coresight: "DEVICE_ATTR_RO" should defined as static. Alexander Shishkin <alexander.shishkin(a)linux.intel.com> stm class: Fix a race in unlinking Alexander Shishkin <alexander.shishkin(a)linux.intel.com> stm class: Fix unbalanced module/device refcounting Alexander Shishkin <alexander.shishkin(a)linux.intel.com> stm class: Guard output assignment against concurrency Alexander Shishkin <alexander.shishkin(a)linux.intel.com> stm class: Fix unlocking braino in the error path Alexander Shishkin <alexander.shishkin(a)linux.intel.com> stm class: Support devices with multiple instances Alexander Shishkin <alexander.shishkin(a)linux.intel.com> stm class: Prevent user-controllable allocations Alexander Shishkin <alexander.shishkin(a)linux.intel.com> stm class: Fix link list locking Alexander Shishkin <alexander.shishkin(a)linux.intel.com> stm class: Fix locking in unbinding policy path Mathieu Poirier <mathieu.poirier(a)linaro.org> coresight: remove csdev's link from topology Mathieu Poirier <mathieu.poirier(a)linaro.org> coresight: release reference taken by 'bus_find_device()' Mathieu Poirier <mathieu.poirier(a)linaro.org> coresight: coresight_unregister() function cleanup Mathieu Poirier <mathieu.poirier(a)linaro.org> coresight: fixing lockdep error Tahsin Erdogan <tahsin(a)google.com> writeback: initialize inode members that track writeback history Ulf Hansson <ulf.hansson(a)linaro.org> Revert "mmc: block: don't use parameter prefix if built as module" Eric Dumazet <edumazet(a)google.com> net: diag: support v4mapped sockets in inet_diag_find_one_icsk() Alexander Shishkin <alexander.shishkin(a)linux.intel.com> perf: Synchronously free aux pages in case of allocation failure Ard Biesheuvel <ard.biesheuvel(a)linaro.org> arm64: hide __efistub_ aliases from kallsyms Nicolas Pitre <nicolas.pitre(a)linaro.org> hid-sensor-hub.c: fix wrong do_div() usage Christoph Lameter <cl(a)linux.com> vmstat: make vmstat_updater deferrable again and shut down on idle Dmitry Torokhov <dtor(a)chromium.org> android: unconditionally remove callbacks in sync_fence_free() Jungseung Lee <js07.lee(a)samsung.com> ARM: 8494/1: mm: Enable PXN when running non-LPAE kernel on LPAE processor Arnd Bergmann <arnd(a)arndb.de> ARM: 8458/1: bL_switcher: add GIC dependency Ard Biesheuvel <ard.biesheuvel(a)linaro.org> efi: stub: define DISABLE_BRANCH_PROFILING for all architectures Yury Norov <ynorov(a)caviumnetworks.com> arm64: fix COMPAT_SHMLBA definition for large pages Colin Cross <ccross(a)android.com> mmc: block: Allow more than 8 partitions per card Yuyang Du <yuyang.du(a)intel.com> sched/fair: Fix new task's load avg removed from source CPU in wake_up_new_task() Marcel Holtmann <marcel(a)holtmann.org> Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer Marcel Holtmann <marcel(a)holtmann.org> Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt Arnd Bergmann <arnd(a)arndb.de> ath10k: avoid possible string overflow Baolin Wang <baolin.wang(a)linaro.org> rtc: Fix overflow when converting time64_t to rtc_time Andrey Konovalov <andreyknvl(a)google.com> USB: core: only clean up what we allocated Peter Zijlstra <peterz(a)infradead.org> lib/int_sqrt: optimize small argument Lanqing Liu <lanqing.liu(a)spreadtrum.com> serial: sprd: clear timeout interrupt only rather than all interrupts Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> usb: renesas_usbhs: gadget: fix unused-but-set-variable warning Qiao Zhou <qiaozhou(a)asrmicro.com> arm64: traps: disable irq in die() Al Viro <viro(a)ZenIV.linux.org.uk> Hang/soft lockup in d_invalidate with simultaneous calls Wei Qiao <wei.qiao(a)spreadtrum.com> serial: sprd: adjust TIMEOUT to a big value Eric Dumazet <edumazet(a)google.com> tcp/dccp: drop SYN packets if accept queue is full Baolin Wang <baolin.wang(a)linaro.org> usb: gadget: Add the gserial port checking in gs_start_tx() Peter Chen <peter.chen(a)nxp.com> usb: gadget: composite: fix dereference after null check coverify warning Wolfram Sang <wsa(a)the-dreams.de> kbuild: setlocalversion: print error to STDERR Roger Quadros <rogerq(a)ti.com> extcon: usb-gpio: Don't miss event during suspend/resume Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru> mm/rmap: replace BUG_ON(anon_vma->degree) with VM_WARN_ON Dong Aisheng <aisheng.dong(a)nxp.com> mmc: core: fix using wrong io voltage if mmc_select_hs200 fails James Morse <james.morse(a)arm.com> arm64: mm: Add trace_irqflags annotations to do_debug_exception() Roger Quadros <rogerq(a)ti.com> usb: dwc3: gadget: Fix suspend/resume during device mode Russell King <rmk+kernel(a)arm.linux.org.uk> mmc: core: shut up "voltage-ranges unspecified" pr_info() Wolfram Sang <wsa+renesas(a)sang-engineering.com> mmc: sanitize 'bus width' in debug output Wolfram Sang <wsa+renesas(a)sang-engineering.com> mmc: make MAN_BKOPS_EN message a debug Chuanxiao Dong <chuanxiao.dong(a)intel.com> mmc: debugfs: Add a restriction to mmc debugfs clock setting Martin Fuzzey <mfuzzey(a)parkeon.com> mmc: pwrseq_simple: Make reset-gpios optional to match doc Hui Wang <hui.wang(a)canonical.com> ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec Takashi Iwai <tiwai(a)suse.de> ALSA: hda - Record the current power state before suspend/resume calls Waiman Long <longman(a)redhat.com> locking/lockdep: Add debug_locks check in __lock_downgrade() Hans Verkuil <hverkuil(a)xs4all.nl> media: v4l2-ctrls.c/uvc: zero v4l2_event Sergei Shtylyov <sergei.shtylyov(a)cogentembedded.com> mmc: tmio_mmc_core: don't claim spurious interrupts zhangyi (F) <yi.zhang(a)huawei.com> ext4: brelse all indirect buffer in ext4_ind_remove_space() Lukas Czerner <lczerner(a)redhat.com> ext4: fix data corruption caused by unaligned direct AIO Jiufei Xue <jiufei.xue(a)linux.alibaba.com> ext4: fix NULL pointer dereference while journal is aborted Chen Jie <chenjie6(a)huawei.com> futex: Ensure that futex address is aligned in handle_futex_death() Archer Yan <ayan(a)wavecomp.com> MIPS: Fix kernel crash for R6 in jump label branch function Yifeng Li <tomli(a)tomli.me> mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction. Jan Kara <jack(a)suse.cz> udf: Fix crash on IO error during truncate Thomas Zimmermann <tzimmermann(a)suse.de> drm/vmwgfx: Don't double-free the mode stored in par->set_mode Arnd Bergmann <arnd(a)arndb.de> mmc: pxamci: fix enum type confusion ------------- Diffstat: Documentation/virtual/kvm/api.txt | 16 ++- Makefile | 4 +- arch/arm/Kconfig | 6 +- arch/arm/mach-imx/cpuidle-imx6q.c | 27 ++-- arch/arm/mm/mmu.c | 2 +- arch/arm64/Kconfig | 5 +- arch/arm64/include/asm/page.h | 2 + arch/arm64/include/asm/shmparam.h | 2 +- arch/arm64/kernel/entry.S | 2 +- arch/arm64/kernel/image.h | 40 +++--- arch/arm64/kernel/traps.c | 8 +- arch/arm64/mm/fault.c | 33 +++-- arch/mips/include/asm/jump_label.h | 8 +- arch/mips/loongson64/lemote-2f/irq.c | 2 +- arch/x86/Kconfig | 8 +- drivers/extcon/extcon-usb-gpio.c | 3 + drivers/firmware/efi/libstub/Makefile | 4 +- drivers/gpio/gpio-adnp.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 12 +- drivers/hid/hid-sensor-hub.c | 3 +- drivers/hwtracing/coresight/coresight-etb10.c | 11 +- drivers/hwtracing/coresight/coresight-etm3x.c | 13 +- drivers/hwtracing/coresight/coresight-etm4x.c | 15 +-- drivers/hwtracing/coresight/coresight-funnel.c | 10 +- .../coresight/coresight-replicator-qcom.c | 11 +- drivers/hwtracing/coresight/coresight-replicator.c | 16 +-- drivers/hwtracing/coresight/coresight-tmc.c | 19 +-- drivers/hwtracing/coresight/coresight-tpiu.c | 10 +- drivers/hwtracing/coresight/coresight.c | 55 +++++++- drivers/hwtracing/coresight/of_coresight.c | 2 +- drivers/hwtracing/stm/Kconfig | 4 + drivers/hwtracing/stm/core.c | 148 ++++++++++++++++----- drivers/hwtracing/stm/policy.c | 25 +++- drivers/hwtracing/stm/stm.h | 2 + drivers/isdn/hardware/mISDN/hfcmulti.c | 3 +- drivers/media/usb/uvc/uvc_ctrl.c | 2 +- drivers/media/v4l2-core/v4l2-ctrls.c | 2 +- drivers/mmc/card/block.c | 10 +- drivers/mmc/core/core.c | 10 +- drivers/mmc/core/debugfs.c | 2 +- drivers/mmc/core/mmc.c | 16 ++- drivers/mmc/core/mmc_ops.c | 2 +- drivers/mmc/core/pwrseq_simple.c | 22 +-- drivers/mmc/host/pxamci.c | 2 +- drivers/mmc/host/tmio_mmc_pio.c | 8 +- drivers/net/ethernet/8390/mac8390.c | 19 ++- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 16 ++- drivers/net/vxlan.c | 4 +- drivers/net/wireless/ath/ath10k/wmi.c | 2 +- drivers/rtc/rtc-lib.c | 6 +- drivers/s390/scsi/zfcp_erp.c | 17 +++ drivers/s390/scsi/zfcp_ext.h | 2 + drivers/s390/scsi/zfcp_scsi.c | 4 + drivers/scsi/sd.c | 19 ++- drivers/staging/android/ashmem.c | 4 +- drivers/staging/android/ion/ion_carveout_heap.c | 2 +- drivers/staging/android/sync.c | 6 +- drivers/staging/android/uapi/ashmem.h | 1 + drivers/staging/goldfish/goldfish_audio.c | 1 + drivers/staging/vt6655/device_main.c | 11 +- drivers/tty/serial/atmel_serial.c | 4 + drivers/tty/serial/kgdboc.c | 4 +- drivers/tty/serial/max310x.c | 2 + drivers/tty/serial/sh-sci.c | 12 +- drivers/tty/serial/sprd_serial.c | 6 +- drivers/usb/dwc3/gadget.c | 6 + drivers/usb/gadget/composite.c | 2 + drivers/usb/gadget/configfs.c | 2 + drivers/usb/gadget/function/rndis.c | 6 + drivers/usb/gadget/function/u_serial.c | 7 +- drivers/usb/host/xhci-ring.c | 9 +- drivers/usb/host/xhci.h | 1 + drivers/usb/renesas_usbhs/mod_gadget.c | 5 +- drivers/usb/serial/cp210x.c | 1 + drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 4 +- drivers/usb/serial/mos7720.c | 4 +- drivers/usb/serial/option.c | 13 +- drivers/video/fbdev/goldfishfb.c | 2 +- fs/btrfs/raid56.c | 3 +- fs/btrfs/tree-log.c | 11 +- fs/dcache.c | 10 +- fs/ext4/ext4_jbd2.h | 2 +- fs/ext4/file.c | 2 +- fs/ext4/indirect.c | 12 +- fs/inode.c | 6 + fs/proc/proc_sysctl.c | 3 +- fs/udf/truncate.c | 3 + include/asm-generic/fixmap.h | 12 +- include/linux/rculist.h | 36 +++++ include/linux/vmstat.h | 2 + include/net/inet_connection_sock.h | 5 - include/net/sctp/checksum.h | 2 +- include/net/sock.h | 6 + kernel/cpu.c | 11 +- kernel/events/ring_buffer.c | 47 ++++--- kernel/futex.c | 4 + kernel/locking/lockdep.c | 3 + kernel/power/swap.c | 18 +++ kernel/sched/fair.c | 38 ++++-- kernel/sched/idle.c | 1 + lib/int_sqrt.c | 3 + mm/rmap.c | 2 +- mm/vmstat.c | 69 ++++++---- net/bluetooth/l2cap_core.c | 83 +++++++----- net/dccp/ipv4.c | 8 +- net/dccp/ipv6.c | 6 +- net/ipv4/inet_diag.c | 21 ++- net/ipv4/tcp_input.c | 8 +- net/ipv6/icmp.c | 2 +- net/ipv6/tcp_ipv6.c | 8 +- net/mac80211/mesh_hwmp.c | 2 +- net/packet/af_packet.c | 4 +- net/rose/rose_subr.c | 21 +-- net/wireless/nl80211.c | 16 +-- scripts/setlocalversion | 2 +- sound/core/compress_offload.c | 13 ++ sound/core/oss/pcm_oss.c | 43 +++--- sound/core/pcm_native.c | 9 +- sound/core/rawmidi.c | 2 + sound/core/seq/oss/seq_oss_synth.c | 7 +- sound/pci/hda/hda_codec.c | 57 +++++++- .../perf/util/intel-pt-decoder/intel-pt-decoder.c | 20 ++- virt/kvm/kvm_main.c | 3 + 124 files changed, 935 insertions(+), 530 deletions(-)

6 years, 7 months

9
143
0 0

[PATCH] hwmon: pwm-fan: Disable PWM if fetching cooling data fails

by Stefan Wahren

In case pwm_fan_of_get_cooling_data() fails we should disable the PWM just like in the other error cases. Reported-by: Guenter Rock <linux(a)roeck-us.net> Signed-off-by: Stefan Wahren <stefan.wahren(a)i2se.com> Fixes: 2e5219c77183 ("hwmon: (pwm-fan) Read PWM FAN configuration from device tree") Cc: <stable(a)vger.kernel.org> # 4.14 --- drivers/hwmon/pwm-fan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c index 167221c..e4c5197 100644 --- a/drivers/hwmon/pwm-fan.c +++ b/drivers/hwmon/pwm-fan.c @@ -271,7 +271,7 @@ static int pwm_fan_probe(struct platform_device *pdev) ret = pwm_fan_of_get_cooling_data(&pdev->dev, ctx); if (ret) - return ret; + goto err_pwm_disable; ctx->pwm_fan_state = ctx->pwm_fan_max_state; if (IS_ENABLED(CONFIG_THERMAL)) { -- 2.7.4

6 years, 7 months

2
1
0 0

[PATCH AUTOSEL 4.14 01/37] gpio: pxa: handle corner case of unprobed device

by Sasha Levin

From: Robert Jarzmik <robert.jarzmik(a)free.fr> [ Upstream commit 9ce3ebe973bf4073426f35f282c6b955ed802765 ] In the corner case where the gpio driver probe fails, for whatever reason, the suspend and resume handlers will still be called as they have to be registered as syscore operations. This applies as well when no probe was called while the driver has been built in the kernel. Nicolas tracked this in : https://bugzilla.kernel.org/show_bug.cgi?id=200905 Therefore, add a failsafe in these function, and test if a proper probe succeeded and the driver is functional. Signed-off-by: Robert Jarzmik <robert.jarzmik(a)free.fr> Reported-by: Nicolas Chauvet <kwizart(a)gmail.com> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpio/gpio-pxa.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c index 2943dfc4c470..822ad220f0af 100644 --- a/drivers/gpio/gpio-pxa.c +++ b/drivers/gpio/gpio-pxa.c @@ -776,6 +776,9 @@ static int pxa_gpio_suspend(void) struct pxa_gpio_bank *c; int gpio; + if (!pchip) + return 0; + for_each_gpio_bank(gpio, c, pchip) { c->saved_gplr = readl_relaxed(c->regbase + GPLR_OFFSET); c->saved_gpdr = readl_relaxed(c->regbase + GPDR_OFFSET); @@ -794,6 +797,9 @@ static void pxa_gpio_resume(void) struct pxa_gpio_bank *c; int gpio; + if (!pchip) + return; + for_each_gpio_bank(gpio, c, pchip) { /* restore level with set/clear */ writel_relaxed(c->saved_gplr, c->regbase + GPSR_OFFSET); -- 2.19.1

6 years, 7 months

2
28
0 0

v4.14.110 build: 0 failures 1 warnings (v4.14.110)

by Build bot for Mark Brown

Tree/Branch: v4.14.110 Git describe: v4.14.110 Commit: 80bf6c64d5 Linux 4.14.110 Build Time: 113 min 16 sec Passed: 11 / 11 (100.00 %) Failed: 0 / 11 ( 0.00 %) Errors: 0 Warnings: 1 Section Mismatches: 0 ------------------------------------------------------------------------------- defconfigs with issues (other than build errors): 1 warnings 0 mismatches : x86_64-allmodconfig 1 warnings 0 mismatches : x86_64-defconfig ------------------------------------------------------------------------------- Warnings Summary: 1 2 ../fs/proc/task_mmu.c:761:7: warning: 'last_vma' may be used uninitialized in this function [-Wmaybe-uninitialized] =============================================================================== Detailed per-defconfig build reports below: ------------------------------------------------------------------------------- x86_64-allmodconfig : PASS, 0 errors, 1 warnings, 0 section mismatches Warnings: ../fs/proc/task_mmu.c:761:7: warning: 'last_vma' may be used uninitialized in this function [-Wmaybe-uninitialized] ------------------------------------------------------------------------------- x86_64-defconfig : PASS, 0 errors, 1 warnings, 0 section mismatches Warnings: ../fs/proc/task_mmu.c:761:7: warning: 'last_vma' may be used uninitialized in this function [-Wmaybe-uninitialized] ------------------------------------------------------------------------------- Passed with no errors, warnings or mismatches: arm64-allnoconfig arm64-allmodconfig arm-multi_v5_defconfig arm-multi_v7_defconfig arm-allmodconfig arm-allnoconfig x86_64-allnoconfig arm-multi_v4t_defconfig arm64-defconfig

6 years, 7 months

1
0
0 0

Re: [PATCH v2] ARM: dts: imx: Fix the AR803X phy-mode

by Adam Ford

On Wed, Apr 3, 2019 at 7:29 AM Sasha Levin <sashal(a)kernel.org> wrote: > > Hi, > > [This is an automated email] > > This commit has been processed because it contains a -stable tag. > The stable tag indicates that it's relevant for the following trees: 4.9+ > > The bot has tested the following trees: v5.0.5, v4.19.32, v4.14.109, v4.9.166. Support for the LogicPD i.MX6QD EVM wasn't added until recently. I would expect it's OK to ignore it. It's not present in anything older than 5.1-RCx adam > > v5.0.5: Failed to apply! Possible dependencies: > 1c207f911fe9 ("ARM: dts: imx: Add support for Logic PD i.MX6QD EVM") > > v4.19.32: Failed to apply! Possible dependencies: > 1c207f911fe9 ("ARM: dts: imx: Add support for Logic PD i.MX6QD EVM") > 29988e867cb1 ("ARM: dts: imx7: Fix memory node duplication") > 4edbe6aa46d1 ("ARM: dts: imx7d-pico-pi: Move SoM related part to imx7d-pico.dtsi") > 50536c661194 ("ARM: dts: imx7d-pico: Do not harcode the memory size") > > v4.14.109: Failed to apply! Possible dependencies: > 1bf52b98ae1c ("ARM: dts: imx6sx-sabreauto: add external 24MHz clock source") > 1c207f911fe9 ("ARM: dts: imx: Add support for Logic PD i.MX6QD EVM") > 221aaa198e70 ("ARM: dts: imx6sx-sabreauto: drop board specific pinctrl container node") > 37accf72e04b ("ARM: dts: imx6sx-sabreauto: add fec support") > 41bbeadceb03 ("ARM: dts: imx7d-pico-pi: Separate into cpu and baseboard dts") > 4edbe6aa46d1 ("ARM: dts: imx7d-pico-pi: Move SoM related part to imx7d-pico.dtsi") > 76dc340e7585 ("ARM: dts: imx6qdl: SolidRun: move AR8035 into microsom") > 8dccafaa281a ("arm: dts: fix unit-address leading 0s") > 99a52450c707 ("ARM: dts: imx7d-pico: Add Wifi support") > d9e246cc2880 ("ARM: dts: imx6sx-sabreauto: add PMIC support") > > v4.9.166: Failed to apply! Possible dependencies: > 12de44f55dcd ("ARM: dts: imx: Fix Ethernet PHY reset polarity") > 1317efa1699f ("ARM: dts: imx6ul: Add DTS for liteSOM module") > 13283626c889 ("ARM: dts: imx/vf: Correct license text") > 1bf52b98ae1c ("ARM: dts: imx6sx-sabreauto: add external 24MHz clock source") > 1c207f911fe9 ("ARM: dts: imx: Add support for Logic PD i.MX6QD EVM") > 221aaa198e70 ("ARM: dts: imx6sx-sabreauto: drop board specific pinctrl container node") > 23c787a99ff7 ("ARM: dts: imx7d-pico: Add initial support") > 26ca8b52d6e1 ("ARM: dts: add support for Turris Omnia") > 37accf72e04b ("ARM: dts: imx6sx-sabreauto: add fec support") > 3faa1bb2e89c ("ARM: dts: imx: add Boundary Devices Nitrogen6_SOM2 support") > 41bbeadceb03 ("ARM: dts: imx7d-pico-pi: Separate into cpu and baseboard dts") > 478c9440b328 ("ARM: dts: imx6ul: Add DTS for liteBoard") > 4edbe6aa46d1 ("ARM: dts: imx7d-pico-pi: Move SoM related part to imx7d-pico.dtsi") > 6df11287f7c9 ("ARM: dts: imx6q: Add Engicam i.CoreM6 Quad/Dual initial support") > 76dc340e7585 ("ARM: dts: imx6qdl: SolidRun: move AR8035 into microsom") > 8dccafaa281a ("arm: dts: fix unit-address leading 0s") > 99a52450c707 ("ARM: dts: imx7d-pico: Add Wifi support") > 9daee3076940 ("ARM: dts: imx6q: Add Engicam i.CoreM6 DualLite/Solo initial support") > a58d73340b0e ("ARM: dts: armada-385-synology-ds116: add support for Synology DS116 NAS") > c201369d4aa5 ("ARM: dts: imx6ull: add imx6ull support") > d9e246cc2880 ("ARM: dts: imx6sx-sabreauto: add PMIC support") > fc48e76489fd ("ARM: dts: imx6: Add support for Toradex Colibri iMX6 module") > > > How should we proceed with this patch? > > -- > Thanks, > Sasha > > _______________________________________________ > linux-arm-kernel mailing list > linux-arm-kernel(a)lists.infradead.org > http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

6 years, 7 months

2
1
0 0

[PATCH 4.9/4.14 BACKPORT 1/2] arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals

by Will Deacon

Commit b9a4b9d084d978f80eb9210727c81804588b42ff upstream. FAR_EL1 is UNKNOWN for all debug exceptions other than those caused by taking a hardware watchpoint. Unfortunately, if a debug handler returns a non-zero value, then we will propagate the UNKNOWN FAR value to userspace via the si_addr field of the SIGTRAP siginfo_t. Instead, let's set si_addr to take on the PC of the faulting instruction, which we have available in the current pt_regs. Cc: <stable(a)vger.kernel.org> # 4.9.y and 4.14.y Reviewed-by: Mark Rutland <mark.rutland(a)arm.com> Signed-off-by: Will Deacon <will.deacon(a)arm.com> Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> --- arch/arm64/mm/fault.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index ad49ae8f3967..051b32084776 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -673,11 +673,12 @@ void __init hook_debug_fault_code(int nr, debug_fault_info[nr].name = name; } -asmlinkage int __exception do_debug_exception(unsigned long addr, +asmlinkage int __exception do_debug_exception(unsigned long addr_if_watchpoint, unsigned int esr, struct pt_regs *regs) { const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr); + unsigned long pc = instruction_pointer(regs); struct siginfo info; int rv; @@ -688,19 +689,19 @@ asmlinkage int __exception do_debug_exception(unsigned long addr, if (interrupts_enabled(regs)) trace_hardirqs_off(); - if (user_mode(regs) && instruction_pointer(regs) > TASK_SIZE) + if (user_mode(regs) && pc > TASK_SIZE) arm64_apply_bp_hardening(); - if (!inf->fn(addr, esr, regs)) { + if (!inf->fn(addr_if_watchpoint, esr, regs)) { rv = 1; } else { pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n", - inf->name, esr, addr); + inf->name, esr, pc); info.si_signo = inf->sig; info.si_errno = 0; info.si_code = inf->code; - info.si_addr = (void __user *)addr; + info.si_addr = (void __user *)pc; arm64_notify_die("", regs, &info, 0); rv = 0; } -- 2.11.0

6 years, 7 months

1
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror