- Linux-stable-mirror - lists.linaro.org

[PATCH] ALSA: dice: fix kernel NULL pointer dereference due to invalid calculation for array index

by Takashi Sakamoto

At a commit f91c9d7610a ('ALSA: firewire-lib: cache maximum length of payload to reduce function calls'), maximum size of payload for tx isochronous packet is cached to reduce the number of function calls. This cache was programmed to updated at a first callback of ohci1394 IR context. However, the maximum size is required to queueing packets before starting the isochronous context. As a result, the cached value is reused to queue packets in next time to starting the isochronous context. Then the cache is updated in a first callback of the isochronous context. This can cause kernel NULL pointer dereference in a below call graph: (sound/firewire/amdtp-stream.c) amdtp_stream_start() ->queue_in_packet() ->queue_packet() (drivers/firewire/core-iso.c) ->fw_iso_context_queue() ->struct fw_card_driver.queue_iso() (drivers/firewire/ohci.c) = ohci_queue_iso() ->queue_iso_packet_per_buffer() buffer->pages[page] The issued dereference occurs in a case that: - target unit supports different stream formats for sampling transmission frequency. - maximum length of payload for tx stream in a first trial is bigger than the length in a second trial. In this case, correct number of pages are allocated for DMA and the 'pages' array has enough elements, while index of the element is wrongly calculated according to the old value of length of payload in a call of 'queue_in_packet()'. Then it causes the issue. This commit fixes the critical bug. This affects all of drivers in ALSA firewire stack in Linux kernel v4.12 or later. [12665.302360] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 [12665.302415] IP: ohci_queue_iso+0x47c/0x800 [firewire_ohci] [12665.302439] PGD 0 [12665.302440] P4D 0 [12665.302450] [12665.302470] Oops: 0000 [#1] SMP PTI [12665.302487] Modules linked in: ... [12665.303096] CPU: 1 PID: 12760 Comm: jackd Tainted: P OE 4.13.0-38-generic #43-Ubuntu [12665.303154] Hardware name: /DH77DF, BIOS KCH7710H.86A.0069.2012.0224.1825 02/24/2012 [12665.303215] task: ffff9ce87da2ae80 task.stack: ffffb5b8823d0000 [12665.303258] RIP: 0010:ohci_queue_iso+0x47c/0x800 [firewire_ohci] [12665.303301] RSP: 0018:ffffb5b8823d3ab8 EFLAGS: 00010086 [12665.303337] RAX: ffff9ce4f4876930 RBX: 0000000000000008 RCX: ffff9ce88a3955e0 [12665.303384] RDX: 0000000000000000 RSI: 0000000034877f00 RDI: 0000000000000000 [12665.303427] RBP: ffffb5b8823d3b68 R08: ffff9ce8ccb390a0 R09: ffff9ce877639ab0 [12665.303475] R10: 0000000000000108 R11: 0000000000000000 R12: 0000000000000003 [12665.303513] R13: 0000000000000000 R14: ffff9ce4f4876950 R15: 0000000000000000 [12665.303554] FS: 00007f2ec467f8c0(0000) GS:ffff9ce8df280000(0000) knlGS:0000000000000000 [12665.303600] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [12665.303633] CR2: 0000000000000030 CR3: 00000002dcf90004 CR4: 00000000000606e0 [12665.303674] Call Trace: [12665.303698] fw_iso_context_queue+0x18/0x20 [firewire_core] [12665.303735] queue_packet+0x88/0xe0 [snd_firewire_lib] [12665.303770] amdtp_stream_start+0x19b/0x270 [snd_firewire_lib] [12665.303811] start_streams+0x276/0x3c0 [snd_dice] [12665.303840] snd_dice_stream_start_duplex+0x1bf/0x480 [snd_dice] [12665.303882] ? vma_gap_callbacks_rotate+0x1e/0x30 [12665.303914] ? __rb_insert_augmented+0xab/0x240 [12665.303936] capture_prepare+0x3c/0x70 [snd_dice] [12665.303961] snd_pcm_do_prepare+0x1d/0x30 [snd_pcm] [12665.303985] snd_pcm_action_single+0x3b/0x90 [snd_pcm] [12665.304009] snd_pcm_action_nonatomic+0x68/0x70 [snd_pcm] [12665.304035] snd_pcm_prepare+0x68/0x90 [snd_pcm] [12665.304058] snd_pcm_common_ioctl1+0x4c0/0x940 [snd_pcm] [12665.304083] snd_pcm_capture_ioctl1+0x19b/0x250 [snd_pcm] [12665.304108] snd_pcm_capture_ioctl+0x27/0x40 [snd_pcm] [12665.304131] do_vfs_ioctl+0xa8/0x630 [12665.304148] ? entry_SYSCALL_64_after_hwframe+0xe9/0x139 [12665.304172] ? entry_SYSCALL_64_after_hwframe+0xe2/0x139 [12665.304195] ? entry_SYSCALL_64_after_hwframe+0xdb/0x139 [12665.304218] ? entry_SYSCALL_64_after_hwframe+0xd4/0x139 [12665.304242] ? entry_SYSCALL_64_after_hwframe+0xcd/0x139 [12665.304265] ? entry_SYSCALL_64_after_hwframe+0xc6/0x139 [12665.304288] ? entry_SYSCALL_64_after_hwframe+0xbf/0x139 [12665.304312] ? entry_SYSCALL_64_after_hwframe+0xb8/0x139 [12665.304335] ? entry_SYSCALL_64_after_hwframe+0xb1/0x139 [12665.304358] SyS_ioctl+0x79/0x90 [12665.304374] ? entry_SYSCALL_64_after_hwframe+0x72/0x139 [12665.304397] entry_SYSCALL_64_fastpath+0x24/0xab [12665.304417] RIP: 0033:0x7f2ec3750ef7 [12665.304433] RSP: 002b:00007fff99e31388 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [12665.304465] RAX: ffffffffffffffda RBX: 00007fff99e312f0 RCX: 00007f2ec3750ef7 [12665.304494] RDX: 0000000000000000 RSI: 0000000000004140 RDI: 0000000000000007 [12665.304522] RBP: 0000556ebc63fd60 R08: 0000556ebc640560 R09: 0000000000000000 [12665.304553] R10: 0000000000000001 R11: 0000000000000246 R12: 0000556ebc63fcf0 [12665.304584] R13: 0000000000000000 R14: 0000000000000007 R15: 0000000000000000 [12665.304612] Code: 01 00 00 44 89 eb 45 31 ed 45 31 db 66 41 89 1e 66 41 89 5e 0c 66 45 89 5e 0e 49 8b 49 08 49 63 d4 4d 85 c0 49 63 ff 48 8b 14 d1 <48> 8b 72 30 41 8d 14 37 41 89 56 04 48 63 d3 0f 84 ce 00 00 00 [12665.304713] RIP: ohci_queue_iso+0x47c/0x800 [firewire_ohci] RSP: ffffb5b8823d3ab8 [12665.304743] CR2: 0000000000000030 [12665.317701] ---[ end trace 9d55b056dd52a19f ]--- Fixes: f91c9d7610a ('ALSA: firewire-lib: cache maximum length of payload to reduce function calls') Cc: <stable(a)vger.kernel.org> # v4.12+ Signed-off-by: Takashi Sakamoto <o-takashi(a)sakamocchi.jp> --- sound/firewire/amdtp-stream.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c index 4a1dc145327b..cb9acfe60f6a 100644 --- a/sound/firewire/amdtp-stream.c +++ b/sound/firewire/amdtp-stream.c @@ -773,8 +773,6 @@ static void amdtp_stream_first_callback(struct fw_iso_context *context, u32 cycle; unsigned int packets; - s->max_payload_length = amdtp_stream_get_max_payload(s); - /* * For in-stream, first packet has come. * For out-stream, prepared to transmit first packet @@ -879,6 +877,9 @@ int amdtp_stream_start(struct amdtp_stream *s, int channel, int speed) amdtp_stream_update(s); + if (s->direction == AMDTP_IN_STREAM) + s->max_payload_length = amdtp_stream_get_max_payload(s); + if (s->flags & CIP_NO_HEADER) s->tag = TAG_NO_CIP_HEADER; else -- 2.14.1

7 years, 8 months

2
1
0 0

[PATCH 4.16 00/81] 4.16.6-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.16.6 release. There are 81 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun Apr 29 13:57:21 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.16.6-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.16.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.16.6-rc1 Hans de Goede <hdegoede(a)redhat.com> ACPI / video: Only default only_lcd to true on Win8-ready _desktops_ Thomas Richter <tmricht(a)linux.ibm.com> kprobes: Fix random address output of blacklist file André Wild <wild(a)linux.ibm.com> s390/cpum_cf: rename IBM z13/z14 counter names Heiko Carstens <heiko.carstens(a)de.ibm.com> s390/uprobes: implement arch_uretprobe_is_alive() Stefan Haberland <sth(a)linux.vnet.ibm.com> s390/dasd: fix IO error for newly defined devices Sebastian Ott <sebott(a)linux.ibm.com> s390/cio: update chpid descriptor after resource accessibility event Guenter Roeck <linux(a)roeck-us.net> hwmon: (k10temp) Add support for AMD Ryzen w/ Vega graphics Guenter Roeck <linux(a)roeck-us.net> hwmon: (k10temp) Add temperature offset for Ryzen 2700X Peter Xu <peterx(a)redhat.com> tracing: Fix missing tab for hwlat_detector print format Finn Thain <fthain(a)telegraphics.com.au> block/swim: Fix IO error at end of medium Finn Thain <fthain(a)telegraphics.com.au> block/swim: Fix array bounds check Finn Thain <fthain(a)telegraphics.com.au> block/swim: Select appropriate drive on device open Finn Thain <fthain(a)telegraphics.com.au> block/swim: Rename macros to avoid inconsistent inverted logic Finn Thain <fthain(a)telegraphics.com.au> block/swim: Remove extra put_disk() call from error path Finn Thain <fthain(a)telegraphics.com.au> block/swim: Don't log an error message for an invalid ioctl Finn Thain <fthain(a)telegraphics.com.au> block/swim: Check drive type Finn Thain <fthain(a)telegraphics.com.au> m68k/mac: Don't remap SWIM MMIO region Robert Kolchmeyer <rkolchmeyer(a)google.com> fsnotify: Fix fsnotify_mark_connector race Dan Carpenter <dan.carpenter(a)oracle.com> cdrom: information leak in cdrom_ioctl_media_changed() Martin K. Petersen <martin.petersen(a)oracle.com> scsi: mptsas: Disable WRITE SAME Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> commoncap: Handle memory allocation failure. Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "mm/hmm: fix header file if/else/endif maze" Michael S. Tsirkin <mst(a)redhat.com> virtio_net: fix adding vids on big-endian Michael S. Tsirkin <mst(a)redhat.com> virtio_net: split out ctrl buffer Igor Russkikh <igor.russkikh(a)aquantia.com> net: aquantia: oops when shutdown on already stopped device Bjørn Mork <bjorn(a)mork.no> tun: fix vlan packet truncation Igor Russkikh <igor.russkikh(a)aquantia.com> net: aquantia: Regression on reset with 1.x firmware Stefan Hajnoczi <stefanha(a)redhat.com> VSOCK: make af_vsock.ko removable again Jason Wang <jasowang(a)redhat.com> virtio-net: add missing virtqueue kick when flushing packets Vasundhara Volam <vasundhara-v.volam(a)broadcom.com> bnxt_en: Fix memory fault in bnxt_ethtool_init() Eric Dumazet <edumazet(a)google.com> net: validate attribute sizes in neigh_dump_table() Ivan Khoronzhuk <ivan.khoronzhuk(a)linaro.org> net: ethernet: ti: cpsw: fix tx vlan priority mapping Julian Wiedmann <jwi(a)linux.ibm.com> s390/qeth: handle failure on workqueue creation Julian Wiedmann <jwi(a)linux.vnet.ibm.com> s390/qeth: avoid control IO completion stalls Julian Wiedmann <jwi(a)linux.vnet.ibm.com> s390/qeth: fix error handling in adapter command callbacks Cong Wang <xiyou.wangcong(a)gmail.com> llc: fix NULL pointer deref for SOCK_ZAPPED Cong Wang <xiyou.wangcong(a)gmail.com> llc: hold llc_sap before release_sock() Guillaume Nault <g.nault(a)alphalink.fr> l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow Guillaume Nault <g.nault(a)alphalink.fr> l2tp: hold reference on tunnels printed in l2tp/tunnels debugfs file Guillaume Nault <g.nault(a)alphalink.fr> l2tp: hold reference on tunnels printed in pppol2tp proc file Guillaume Nault <g.nault(a)alphalink.fr> l2tp: hold reference on tunnels in netlink dumps Alexander Aring <aring(a)mojatatu.com> net: sched: ife: check on metadata length Alexander Aring <aring(a)mojatatu.com> net: sched: ife: handle malformed tlv length Alexander Aring <aring(a)mojatatu.com> net: sched: ife: signal not finding metaid Tom Lendacky <thomas.lendacky(a)amd.com> amd-xgbe: Only use the SFP supported transceiver signals Tom Lendacky <thomas.lendacky(a)amd.com> amd-xgbe: Improve KR auto-negotiation and training Tom Lendacky <thomas.lendacky(a)amd.com> amd-xgbe: Add pre/post auto-negotiation phy hooks Ronak Doshi <doshir(a)vmware.com> vmxnet3: fix incorrect dereference when rxvlan is disabled Toshiaki Makita <makita.toshiaki(a)lab.ntt.co.jp> vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi Eric Dumazet <edumazet(a)google.com> tipc: add policy for TIPC_NLA_NET_ADDR Xin Long <lucien.xin(a)gmail.com> team: fix netconsole setup over team Paolo Abeni <pabeni(a)redhat.com> team: avoid adding twice the same option to the event list Eric Dumazet <edumazet(a)google.com> tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets Jann Horn <jannh(a)google.com> tcp: don't read out-of-bounds opsize Soheil Hassas Yeganeh <soheil(a)google.com> tcp: clear tp->packets_out when purging write queue Doron Roberts-Kedes <doronrk(a)fb.com> strparser: Fix incorrect strp->need_bytes value. Doron Roberts-Kedes <doronrk(a)fb.com> strparser: Do not call mod_delayed_work with a timeout of LONG_MAX Xin Long <lucien.xin(a)gmail.com> sctp: do not check port in sctp_inet6_cmp_addr Dan Carpenter <dan.carpenter(a)oracle.com> Revert "macsec: missing dev_put() on error in macsec_newlink()" Guillaume Nault <g.nault(a)alphalink.fr> pppoe: check sockaddr length in pppoe_connect() Willem de Bruijn <willemb(a)google.com> packet: fix bitfield update race Jose Abreu <Jose.Abreu(a)synopsys.com> net: stmmac: Disable ACS Feature for GMAC >= 4 Ursula Braun <ubraun(a)linux.vnet.ibm.com> net/smc: fix shutdown in state SMC_LISTEN Pawel Dembicki <paweldembicki(a)gmail.com> net: qmi_wwan: add Wistron Neweb D19Q1 Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: mvpp2: Fix DMA address mask size Wolfgang Bumiller <w.bumiller(a)proxmox.com> net: fix deadlock while clearing neighbor proxy table Eric Dumazet <edumazet(a)google.com> net: af_packet: fix race in PACKET_{R|T}X_RING Cong Wang <xiyou.wangcong(a)gmail.com> llc: delete timers synchronously in llc_sk_free() Guillaume Nault <g.nault(a)alphalink.fr> l2tp: check sockaddr length in pppol2tp_connect() Eric Biggers <ebiggers(a)google.com> KEYS: DNS: limit the length of option strings Ahmed Abdelsalam <amsalam20(a)gmail.com> ipv6: sr: fix NULL pointer dereference in seg6_do_srh_encap()- v4 pkts Eric Dumazet <edumazet(a)google.com> ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy Olivier Gayot <olivier.gayot(a)sigexec.com> docs: ip-sysctl.txt: fix name of some ipv6 variables Xin Long <lucien.xin(a)gmail.com> bonding: do not set slave_dev npinfo before slave_enable_netpoll in bond_enslave Karthikeyan Periyasamy <periyasa(a)codeaurora.org> Revert "ath10k: send (re)assoc peer command when NSS changed" James Bottomley <James.Bottomley(a)HansenPartnership.com> tpm: add retry logic Winkler, Tomas <tomas.winkler(a)intel.com> tpm: tpm-interface: fix tpm_transmit/_cmd kdoc Tomas Winkler <tomas.winkler(a)intel.com> tpm: cmd_ready command can be issued only after granting locality Paweł Jabłoński <pawel.jablonski(a)intel.com> i40e: Fix attach VF to VM issue Neil Armstrong <narmstrong(a)baylibre.com> drm: bridge: dw-hdmi: Fix overflow workaround for Amlogic Meson GX SoCs Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "pinctrl: intel: Initialize GPIO properly when used through irqchip" ------------- Diffstat: Documentation/networking/ip-sysctl.txt | 8 +- Makefile | 4 +- arch/s390/kernel/perf_cpum_cf_events.c | 8 +- arch/s390/kernel/uprobes.c | 9 + drivers/acpi/acpi_video.c | 27 ++- drivers/block/swim.c | 49 +++--- drivers/block/swim3.c | 6 +- drivers/cdrom/cdrom.c | 2 +- drivers/char/tpm/tpm-interface.c | 131 +++++++++++--- drivers/char/tpm/tpm.h | 1 + drivers/char/tpm/tpm_crb.c | 108 ++++++++---- drivers/char/tpm/tpm_tis_core.c | 4 +- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 3 + drivers/hwmon/k10temp.c | 17 +- drivers/message/fusion/mptsas.c | 1 + drivers/net/bonding/bond_main.c | 3 +- drivers/net/ethernet/amd/xgbe/xgbe-common.h | 8 + drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c | 16 ++ drivers/net/ethernet/amd/xgbe/xgbe-main.c | 1 + drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 24 ++- drivers/net/ethernet/amd/xgbe/xgbe-pci.c | 2 + drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 196 +++++++++++++++++++-- drivers/net/ethernet/amd/xgbe/xgbe.h | 9 + drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 8 +- .../aquantia/atlantic/hw_atl/hw_atl_utils.c | 16 ++ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 49 +++--- drivers/net/ethernet/broadcom/bnxt/bnxt_nvm_defs.h | 2 - drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 11 ++ drivers/net/ethernet/marvell/mvpp2.c | 12 +- drivers/net/ethernet/stmicro/stmmac/dwmac4.h | 2 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 7 - drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 7 +- drivers/net/ethernet/ti/cpsw.c | 2 +- drivers/net/macsec.c | 5 +- drivers/net/ppp/pppoe.c | 4 + drivers/net/team/team.c | 38 +++- drivers/net/tun.c | 7 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/virtio_net.c | 79 +++++---- drivers/net/vmxnet3/vmxnet3_drv.c | 17 +- drivers/net/vmxnet3/vmxnet3_int.h | 4 +- drivers/net/wireless/ath/ath10k/mac.c | 5 +- drivers/pinctrl/intel/pinctrl-intel.c | 23 +-- drivers/s390/block/dasd_alias.c | 13 +- drivers/s390/cio/chsc.c | 14 +- drivers/s390/net/qeth_core.h | 2 - drivers/s390/net/qeth_core_main.c | 115 ++++++------ include/linux/fsnotify_backend.h | 4 +- include/linux/hmm.h | 9 +- include/linux/if_vlan.h | 7 +- include/linux/tpm.h | 2 +- include/net/ife.h | 3 +- include/net/llc_conn.h | 1 + kernel/kprobes.c | 2 +- kernel/trace/trace_entries.h | 2 +- net/core/dev.c | 2 +- net/core/neighbour.c | 40 +++-- net/dns_resolver/dns_key.c | 12 +- net/ife/ife.c | 38 +++- net/ipv4/tcp.c | 8 +- net/ipv4/tcp_input.c | 7 +- net/ipv6/route.c | 2 + net/ipv6/seg6_iptunnel.c | 2 +- net/l2tp/l2tp_core.c | 40 ++--- net/l2tp/l2tp_core.h | 3 +- net/l2tp/l2tp_debugfs.c | 18 +- net/l2tp/l2tp_netlink.c | 11 +- net/l2tp/l2tp_ppp.c | 34 +++- net/llc/af_llc.c | 14 +- net/llc/llc_c_ac.c | 9 +- net/llc/llc_conn.c | 22 ++- net/packet/af_packet.c | 83 ++++++--- net/packet/internal.h | 10 +- net/sched/act_ife.c | 9 +- net/sctp/ipv6.c | 60 +++---- net/smc/af_smc.c | 10 +- net/strparser/strparser.c | 9 +- net/tipc/netlink.c | 3 +- net/vmw_vsock/af_vsock.c | 6 + security/commoncap.c | 2 + 80 files changed, 1084 insertions(+), 480 deletions(-)

7 years, 8 months

4
78
0 0

[PATCH 4.16 000/196] 4.16.4-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.16.4 release. There are 196 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue Apr 24 13:50:16 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.16.4-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.16.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.16.4-rc1 Greg Thelen <gthelen(a)google.com> writeback: safer lock nesting Jiri Kosina <jkosina(a)suse.cz> HID: i2c-hid: fix inverted return value from i2c_hid_command() Weinan Li <weinan.z.li(a)intel.com> drm/i915/gvt: init mmio by lri command in vgpu inhibit context Matthew Wilcox <mawilcox(a)microsoft.com> mm/filemap.c: fix NULL pointer in page_cache_tree_insert() Ian Kent <raven(a)themaw.net> autofs: mount point create should honour passed in mode Dave Jiang <dave.jiang(a)intel.com> device-dax: allow MAP_SYNC to succeed Dan Williams <dan.j.williams(a)intel.com> libnvdimm, dimm: handle EACCES failures from label reads Al Viro <viro(a)zeniv.linux.org.uk> Don't leak MNT_INTERNAL away from internal mounts Al Viro <viro(a)zeniv.linux.org.uk> rpc_pipefs: fix double-dput() Al Viro <viro(a)zeniv.linux.org.uk> orangefs_kill_sb(): deal with allocation failures Al Viro <viro(a)zeniv.linux.org.uk> hypfs_kill_super(): deal with failed allocations Al Viro <viro(a)zeniv.linux.org.uk> jffs2_kill_sb(): deal with failed allocations Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Correctly handle limited range YCbCr data on VLV/CHV Imre Deak <imre.deak(a)intel.com> drm/i915: Fix hibernation with ACPI S0 target state Daniel Kurtz <djkurtz(a)chromium.org> mmc: sdhci-pci: Only do AMD tuning for HS200 Amir Goldstein <amir73il(a)gmail.com> fanotify: fix logic of events on child Jan Kara <jack(a)suse.cz> udf: Fix leak of UTF-16 surrogates into encoded strings Michael Ellerman <mpe(a)ellerman.id.au> powerpc/lib: Fix off-by-one in alternate feature patching Benjamin Herrenschmidt <benh(a)kernel.crashing.org> powerpc/xive: Fix trying to "push" an already active pool VP Michael Neuling <mikey(a)neuling.org> powerpc/eeh: Fix enabling bridge MMIO windows Matt Redfearn <matt.redfearn(a)mips.com> MIPS: memset.S: Fix clobber of v1 in last_fixup Matt Redfearn <matt.redfearn(a)mips.com> MIPS: memset.S: Fix return of __clear_user from Lpartial_fixup Matt Redfearn <matt.redfearn(a)mips.com> MIPS: memset.S: EVA & fault support for small_memset Matt Redfearn <matt.redfearn(a)mips.com> MIPS: uaccess: Add micromips clobbers to bzero invocation Heiko Carstens <heiko.carstens(a)de.ibm.com> s390: add support for IBM z14 Model ZR1 Aaron Armstrong Skomra <skomra(a)gmail.com> HID: wacom: bluetooth: send exit report for recent Bluetooth devices Rodrigo Rivas Costa <rodrigorivascosta(a)gmail.com> HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> HID: input: fix battery level reporting on BT mice Aaron Ma <aaron.ma(a)canonical.com> HID: i2c-hid: Fix resume issue on Raydium touchscreen device Theodore Ts'o <tytso(a)mit.edu> random: add new ioctl RNDRESEEDCRNG Theodore Ts'o <tytso(a)mit.edu> random: crng_reseed() should lock the crng instance that it is modifying Theodore Ts'o <tytso(a)mit.edu> random: set up the NUMA crng instances after the CRNG is fully initialized Theodore Ts'o <tytso(a)mit.edu> random: use a different mixing algorithm for add_device_randomness() Theodore Ts'o <tytso(a)mit.edu> random: fix crng_ready() test Hui Wang <hui.wang(a)canonical.com> ALSA: hda/realtek - adjust the location of one mic Hui Wang <hui.wang(a)canonical.com> ALSA: hda/realtek - set PINCFG_HEADSET_MIC to parse_flags David Wang <davidwang(a)zhaoxin.com> ALSA: hda - New VIA controller suppor no-snoop path Takashi Iwai <tiwai(a)suse.de> ALSA: rawmidi: Fix missing input substream checks in compat ioctls Fabián Inostroza <soulsonceonfire(a)gmail.com> ALSA: line6: Use correct endpoint type for midi output Paul Parsons <lost.distance(a)yahoo.com> drm/radeon: Fix PCIe lane width calculation Nico Sneck <nicosneck(a)hotmail.com> drm/radeon: add PX quirk for Asus K73TK Marc Zyngier <marc.zyngier(a)arm.com> drm/rockchip: Clear all interrupts before requesting the IRQ Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/si: implement get/set pcie_lanes asic callback Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: Fix PCIe lane width calculation Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma: fix mask in emit_pipeline_sync Bas Nieuwenhuizen <basni(a)chromium.org> drm/amdgpu: Fix always_valid bos multiple LRU insertions. Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: Add an ATPX quirk for hybrid laptop Igor Pylypiv <igor.pylypiv(a)gmail.com> watchdog: f71808e_wdt: Fix WD_EN register read Sean Wang <sean.wang(a)mediatek.com> dt-bindings: clock: mediatek: add binding for fixed-factor clock axisel_d4 Mikhail Lappo <mikhail.lappo(a)esrlabs.com> thermal: imx: Fix race condition in imx_thermal_probe() Sean Wang <sean.wang(a)mediatek.com> pwm: mediatek: Improve precision in rate calculation Sean Wang <sean.wang(a)mediatek.com> pwm: mediatek: Fix up PWM4 and PWM5 malfunction on MT7623 Ryo Kodama <ryo.kodama.vz(a)renesas.com> pwm: rcar: Fix a condition to prevent mismatch value setting to duty Dmitry Osipenko <digetx(a)gmail.com> clk: tegra: Mark HCLK, SCLK and EMC as critical Boris Brezillon <boris.brezillon(a)bootlin.com> clk: bcm2835: De-assert/assert PLL reset signal when appropriate Sean Wang <sean.wang(a)mediatek.com> clk: mediatek: fix PWM clock source by adding a fixed-factor clock Arnd Bergmann <arnd(a)arndb.de> clk: fix false-positive Wmaybe-uninitialized warning Richard Genoud <richard.genoud(a)gmail.com> clk: mvebu: armada-38x: add support for missing clocks Sinan Kaya <okaya(a)codeaurora.org> PCI: Mark Broadcom HT1100 and HT2000 Root Port Extended Tags as broken Ravi Bangoria <ravi.bangoria(a)linux.vnet.ibm.com> trace_uprobe: Use %lx to display offset Charlene Liu <charlene.liu(a)amd.com> drm/amd/display: HDMI has no sound after Panel power off/on Harry Wentland <harry.wentland(a)amd.com> Revert "drm/amd/display: disable CRTCs with NULL FB on their primary plane (V2)" Harry Wentland <harry.wentland(a)amd.com> Revert "drm/amd/display: fix dereferencing possible ERR_PTR()" Masaharu Hayakawa <masaharu.hayakawa.ry(a)renesas.com> mmc: tmio: Fix error handling when issuing CMD23 Alex Smith <alex.smith(a)imgtec.com> mmc: jz4740: Fix race condition in IRQ mask update Alexander Kappner <agk(a)godking.net> mmc: core: Prevent bus reference leak in mmc_blk_init() Lu Baolu <baolu.lu(a)linux.intel.com> iommu/vt-d: Fix a potential memory leak Krzysztof Mazur <krzysiek(a)podlesie.net> um: Use POSIX ucontext_t instead of struct ucontext Jason A. Donenfeld <Jason(a)zx2c4.com> um: Compile with modern headers Steven Rostedt (VMware) <rostedt(a)goodmis.org> ring-buffer: Check if memory is available before allocation Dan Williams <dan.j.williams(a)intel.com> nfit: skip region registration for incomplete control regions Dan Williams <dan.j.williams(a)intel.com> nfit, address-range-scrub: fix scrub in-progress reporting Steven Rostedt (VMware) <rostedt(a)goodmis.org> vsprintf: Do not preprocess non-dereferenced pointers for bprintf (%px and %pK) Dan Williams <dan.j.williams(a)intel.com> libnvdimm, namespace: use a safe lookup for dimm device name Dan Williams <dan.j.williams(a)intel.com> libnvdimm, dimm: fix dpa reservation vs uninitialized label area Chris Chiu <chiu(a)endlessm.com> tpm: self test failure should not cause suspend to fail Frederic Barrat <fbarrat(a)linux.vnet.ibm.com> cxl: Fix possible deadlock when processing page faults from cxllib Maxime Jayat <maxime.jayat(a)mobile-devices.fr> dmaengine: at_xdmac: fix rare residue corruption Heinz Mauelshagen <heinzm(a)redhat.com> dm raid: fix nosync status Andrew Morton <akpm(a)linux-foundation.org> drivers/infiniband/ulp/srpt/ib_srpt.c: fix build with gcc-4.4.4 Andrew Morton <akpm(a)linux-foundation.org> drivers/infiniband/core/verbs.c: fix build with gcc-4.4.4 Bart Van Assche <bart.vanassche(a)wdc.com> IB/srpt: Fix an out-of-bounds stack access in srpt_zerolength_write() Bart Van Assche <bart.vanassche(a)wdc.com> IB/srp: Fix completion vector assignment algorithm Bart Van Assche <bart.vanassche(a)wdc.com> IB/srp: Fix srp_abort() Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Fix endless loop for XRUN recovery in OSS emulation Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Fix UAF at PCM release via PCM timer access Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Fix mutex unbalance in OSS emulation ioctls Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Return -EBUSY for OSS ioctls changing busy streams Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Avoid potential races between OSS ioctls and read/write Chuck Lever <chuck.lever(a)oracle.com> xprtrdma: Fix corner cases when handling device removal Chuck Lever <chuck.lever(a)oracle.com> xprtrdma: Fix latency regression on NUMA NFS/RDMA clients Bart Van Assche <bart.vanassche(a)wdc.com> RDMA/core: Avoid that ib_drain_qp() triggers an out-of-bounds stack access Bart Van Assche <bart.vanassche(a)wdc.com> RDMA/rxe: Fix an out-of-bounds read Leon Romanovsky <leonro(a)mellanox.com> RDMA/mlx5: Protect from NULL pointer derefence Roland Dreier <roland(a)purestorage.com> RDMA/ucma: Don't allow setting RDMA_OPTION_IB_PATH without an RDMA device Mikulas Patocka <mpatocka(a)redhat.com> dm crypt: limit the number of allocated pages Mike Snitzer <snitzer(a)redhat.com> dm: backfill abnormal IO support to non-splitting IO submission Theodore Ts'o <tytso(a)mit.edu> ext4: force revalidation of directory pointer after seekdir(2) Theodore Ts'o <tytso(a)mit.edu> ext4: add extra checks to ext4_xattr_block_get() Theodore Ts'o <tytso(a)mit.edu> ext4: add bounds checking to ext4_xattr_find_entry() Theodore Ts'o <tytso(a)mit.edu> ext4: move call to ext4_error() into ext4_xattr_check_block() Theodore Ts'o <tytso(a)mit.edu> ext4: don't allow r/w mounts if metadata blocks overlap the superblock Theodore Ts'o <tytso(a)mit.edu> ext4: always initialize the crc32c checksum driver Theodore Ts'o <tytso(a)mit.edu> ext4: fail ext4_iget for root directory if unallocated Eric Biggers <ebiggers(a)google.com> ext4: limit xattr size to INT_MAX Theodore Ts'o <tytso(a)mit.edu> ext4: add validity checks for bitmap block numbers Jiri Slaby <jslaby(a)suse.cz> ext4: fix offset overflow on 32-bit archs in ext4_iomap_begin() Eryu Guan <guaneryu(a)gmail.com> ext4: protect i_disksize update by i_data_sem in direct write path Theodore Ts'o <tytso(a)mit.edu> ext4: don't update checksum of new initialized bitmaps Theodore Ts'o <tytso(a)mit.edu> ext4: pass -ESHUTDOWN code to jbd2 layer Theodore Ts'o <tytso(a)mit.edu> ext4: eliminate sleep from shutdown ioctl Theodore Ts'o <tytso(a)mit.edu> ext4: shutdown should not prevent get_write_access Theodore Ts'o <tytso(a)mit.edu> jbd2: if the journal is aborted then don't allow update of the log tail Mikulas Patocka <mpatocka(a)redhat.com> block: use 32-bit blk_status_t on Alpha Hans de Goede <hdegoede(a)redhat.com> extcon: intel-cht-wc: Set direction and drv flags for V5 boost GPIO Theodore Ts'o <tytso(a)mit.edu> random: use a tighter cap in credit_entropy_bits_safe() Aniruddha Banerjee <aniruddhab(a)nvidia.com> irqchip/gic: Take lock when updating irq type Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Prevent crash when ICM firmware is not running Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Handle connecting device in place of host properly Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Resume control channel after hibernation image is created Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Serialize PCIe tunnel creation with PCI rescan Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Wait a bit longer for ICM to authenticate the active NVM Liam Girdwood <liam.r.girdwood(a)linux.intel.com> ASoC: topology: Fix kcontrol name string handling James Kelly <jamespeterkelly(a)gmail.com> ASoC: ssm2602: Replace reg_default_raw with reg_default Sean Wang <sean.wang(a)mediatek.com> soc: mediatek: fix the mistaken pointer accessed when subdomains are added Aaron Ma <aaron.ma(a)canonical.com> HID: core: Fix size as type u32 Aaron Ma <aaron.ma(a)canonical.com> HID: Fix hid_report_len usage Yan, Zheng <zyan(a)redhat.com> ceph: always update atime/mtime/ctime for new inode Michael Ellerman <mpe(a)ellerman.id.au> powerpc/mm/radix: Fix checkstops caused by invalid tlbiel Nicholas Piggin <npiggin(a)gmail.com> powerpc/powernv: Fix OPAL NVRAM driver OPAL_BUSY loops Thiago Jung Bauermann <bauerman(a)linux.vnet.ibm.com> powerpc/kexec_file: Fix error code when trying to load kdump kernel Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com> powerpc/kprobes: Fix call trace due to incorrect preempt count Nicholas Piggin <npiggin(a)gmail.com> powerpc/64: Fix smp_wmb barrier definition use use lwsync consistently Paul Mackerras <paulus(a)ozlabs.org> powerpc/64: Call H_REGISTER_PROC_TBL when running as a HPT guest on POWER9 Nicholas Piggin <npiggin(a)gmail.com> powerpc/64s: Fix dt_cpu_ftrs to have restore_cpu clear unwanted LPCR bits Michael Neuling <mikey(a)neuling.org> powerpc/eeh: Fix race with driver un/bind Nicholas Piggin <npiggin(a)gmail.com> powerpc/powernv: Handle unknown OPAL errors in opal_nvram_write() Nicholas Piggin <npiggin(a)gmail.com> powerpc/64s: Fix pkey support in dt_cpu_ftrs, add CPU_FTR_PKEY bit Takashi Iwai <tiwai(a)suse.de> swiotlb: fix unexpected swiotlb_alloc_coherent failures Gustavo A. R. Silva <gustavo(a)embeddedor.com> CIFS: fix sha512 check in cifs_crypto_secmech_release Aurelien Aptel <aaptel(a)suse.com> CIFS: implement v3.11 preauth integrity Aurelien Aptel <aaptel(a)suse.com> CIFS: add sha512 secmech Aurelien Aptel <aaptel(a)suse.com> CIFS: refactor crypto shash/sdesc allocation&free Jean Delvare <jdelvare(a)suse.de> i2c: i801: Restore configuration at shutdown Jean Delvare <jdelvare(a)suse.de> i2c: i801: Save register SMBSLVCMD value only once Aaron Ma <aaron.ma(a)canonical.com> HID: i2c-hid: fix size check and type usage Steve French <stfrench(a)microsoft.com> smb3: Fix root directory when server returns inode number of zero Long Li <longli(a)microsoft.com> cifs: smbd: disconnect transport on RDMA errors Long Li <longli(a)microsoft.com> cifs: smbd: avoid reconnect lockup Steve French <smfrench(a)gmail.com> Tree connect for SMB3.1.1 must be signed for non-encrypted shares Ronnie Sahlberg <lsahlber(a)redhat.com> fix smb3-encryption breakage when CONFIG_DEBUG_SG=y Ronnie Sahlberg <lsahlber(a)redhat.com> cifs: fix memory leak in SMB2_open() Felipe Balbi <felipe.balbi(a)linux.intel.com> usb: dwc3: gadget: never call ->complete() from ->ep_queue() Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: pci: Properly cleanup resource Roger Quadros <rogerq(a)ti.com> usb: dwc3: prevent setting PRTCAP to OTG from debugfs Zhengjun Xing <zhengjun.xing(a)linux.intel.com> USB:fix USB3 devices behind USB3 hubs not resuming at hibernate thaw Yavuz, Tuba <tuba(a)ece.ufl.edu> USB: gadget: f_midi: fixing a possible double-free in f_midi Dan Williams <dan.j.williams(a)intel.com> acpi, nfit: rework NVDIMM leaf method detection Mika Westerberg <mika.westerberg(a)linux.intel.com> ACPI / hotplug / PCI: Check presence of slot itself in get_slot_status() Hans de Goede <hdegoede(a)redhat.com> ACPI / video: Add quirk to force acpi-video backlight on Samsung 670Z5E Dan Carpenter <dan.carpenter(a)oracle.com> regmap: Fix reversed bounds check in regmap_raw_write() Jason Andryuk <jandryuk(a)gmail.com> x86/xen: Delay get_cpu_cap until stack canary is established Kieran Bingham <kieran.bingham(a)ideasonboard.com> media: vsp1: Fix BRx conditional path in WPF Sakari Ailus <sakari.ailus(a)linux.intel.com> media: vb2: core: Finish buffers at the end of the stream Hans Verkuil <hverkuil(a)xs4all.nl> media: vivid: check if the cec_adapter is valid Hans Verkuil <hverkuil(a)xs4all.nl> media: atomisp_fops.c: disable atomisp_compat_ioctl32 Sean Young <sean(a)mess.org> media: rc: oops in ir_timer_keyup after device unplug Jarkko Nikula <jarkko.nikula(a)linux.intel.com> spi: Fix unregistration of controller with fixed SPI bus number Maxime Chevallier <maxime.chevallier(a)bootlin.com> spi: Fix scatterlist elements size in spi_map_buf Eugen Hristev <eugen.hristev(a)microchip.com> spi: atmel: init FIFOs before spi enable Santiago Esteban <Santiago.Esteban(a)microchip.com> ARM: dts: at91: sama5d4: fix pinctrl compatible string Marek Szyprowski <m.szyprowski(a)samsung.com> ARM: dts: exynos: Fix IOMMU support for GScaler devices on Exynos5250 Nicolas Ferre <nicolas.ferre(a)microchip.com> ARM: dts: at91: at91sam9g25: fix mux-mask pinctrl property Sean Wang <sean.wang(a)mediatek.com> arm: dts: mt7623: fix USB initialization fails on bananapi-r2 Marek Szyprowski <m.szyprowski(a)samsung.com> ARM: EXYNOS: Fix coupled CPU idle freeze on Exynos4210 Marc Zyngier <marc.zyngier(a)arm.com> KVM: arm/arm64: vgic-its: Fix potential overrun in vgic_copy_lpi_list Jerome Brunet <jbrunet(a)baylibre.com> ARM64: dts: meson: reduce odroid-c2 eMMC maximum rate Felipe Balbi <felipe.balbi(a)linux.intel.com> usb: gadget: udc: core: update usb_ep_queue() documentation Chen-Yu Tsai <wens(a)csie.org> phy: allwinner: sun4i-usb: poll vbus changes on A23/A33 when driving VBUS Heinrich Schuchardt <xypron.glpk(a)gmx.de> usb: musb: gadget: misplaced out of bounds check Vlastimil Babka <vbabka(a)suse.cz> mm, slab: reschedule cache_reap() on the same CPU Eric Biggers <ebiggers(a)google.com> ipc/shm: fix use-after-free of shm file via remap_file_pages() Takashi Iwai <tiwai(a)suse.de> resource: fix integer overflow at reallocation Andrew Morton <akpm(a)linux-foundation.org> fs/reiserfs/journal.c: add missing resierfs_warning() arg Kees Cook <keescook(a)chromium.org> task_struct: only use anon struct under randstruct plugin Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com> mm: hwpoison: disable memory error handling on 1GB hugepage Jérôme Glisse <jglisse(a)redhat.com> mm/hmm: hmm_pfns_bad() was accessing wrong struct Jérôme Glisse <jglisse(a)redhat.com> mm/hmm: fix header file if/else/endif maze Claudio Imbrenda <imbrenda(a)linux.vnet.ibm.com> mm/ksm.c: fix inconsistent accounting of zero pages Richard Weinberger <richard(a)nod.at> ubi: Reject MLC NAND Romain Izard <romain.izard.pro(a)gmail.com> ubi: Fix error for write access Richard Weinberger <richard(a)nod.at> ubi: fastmap: Don't flush fastmap work on detach Richard Weinberger <richard(a)nod.at> ubifs: Check ubifs_wbuf_sync() return code Gregory CLEMENT <gregory.clement(a)bootlin.com> cpufreq: armada-37xx: Fix clock leak George Cherian <george.cherian(a)cavium.com> cpufreq: CPPC: Use transition_delay_us depending transition_latency Hans de Goede <hdegoede(a)redhat.com> Bluetooth: hci_bcm: Add irq_polarity module option ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/at91sam9g25.dtsi | 2 +- arch/arm/boot/dts/exynos5250.dtsi | 8 +- arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts | 24 ++- arch/arm/boot/dts/sama5d4.dtsi | 2 +- arch/arm/mach-exynos/pm.c | 6 +- .../arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts | 2 +- arch/mips/include/asm/uaccess.h | 11 +- arch/mips/lib/memset.S | 11 +- arch/powerpc/include/asm/barrier.h | 3 +- arch/powerpc/include/asm/synch.h | 4 - arch/powerpc/kernel/dt_cpu_ftrs.c | 19 +- arch/powerpc/kernel/eeh_driver.c | 68 ++++--- arch/powerpc/kernel/eeh_pe.c | 3 +- arch/powerpc/kernel/kprobes.c | 30 +-- arch/powerpc/kernel/machine_kexec_file_64.c | 2 +- arch/powerpc/lib/feature-fixups.c | 2 +- arch/powerpc/mm/hash_utils_64.c | 6 + arch/powerpc/mm/tlb-radix.c | 5 +- arch/powerpc/platforms/powernv/opal-nvram.c | 11 +- arch/powerpc/platforms/pseries/lpar.c | 8 +- arch/powerpc/sysdev/xive/native.c | 4 + arch/s390/Kconfig | 8 +- arch/s390/hypfs/inode.c | 2 +- arch/s390/kernel/perf_cpum_cf_events.c | 1 + arch/s390/kernel/setup.c | 1 + arch/um/os-Linux/file.c | 1 + arch/um/os-Linux/signal.c | 3 +- arch/x86/um/stub_segv.c | 3 +- arch/x86/xen/enlighten_pv.c | 8 +- drivers/acpi/nfit/core.c | 59 +++--- drivers/acpi/nfit/nfit.h | 5 +- drivers/acpi/video_detect.c | 9 + drivers/base/regmap/regmap.c | 2 +- drivers/bluetooth/hci_bcm.c | 20 +- drivers/char/random.c | 130 +++++++++---- drivers/char/tpm/tpm-interface.c | 4 + drivers/clk/bcm/clk-bcm2835.c | 8 +- drivers/clk/mediatek/clk-mt2701.c | 15 +- drivers/clk/mvebu/armada-38x.c | 14 +- drivers/clk/renesas/clk-sh73a0.c | 6 +- drivers/clk/tegra/clk-emc.c | 2 +- drivers/clk/tegra/clk-tegra-periph.c | 2 +- drivers/clk/tegra/clk-tegra-super-gen4.c | 8 +- drivers/clk/tegra/clk-tegra114.c | 3 +- drivers/clk/tegra/clk-tegra124.c | 7 +- drivers/clk/tegra/clk-tegra20.c | 23 +-- drivers/clk/tegra/clk-tegra210.c | 3 +- drivers/clk/tegra/clk-tegra30.c | 14 +- drivers/cpufreq/armada-37xx-cpufreq.c | 2 + drivers/cpufreq/cppc_cpufreq.c | 3 + drivers/dax/device.c | 2 + drivers/dma/at_xdmac.c | 4 +- drivers/extcon/extcon-intel-cht-wc.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- drivers/gpu/drm/amd/amdgpu/cik_sdma.c | 2 +- drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c | 2 +- drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/si.c | 67 +++++++ drivers/gpu/drm/amd/amdgpu/si_dpm.c | 4 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 31 --- .../drm/amd/display/dc/dce/dce_stream_encoder.c | 2 + drivers/gpu/drm/i915/gvt/gvt.h | 5 +- drivers/gpu/drm/i915/gvt/mmio_context.c | 210 +++++++++++++++++++-- drivers/gpu/drm/i915/gvt/mmio_context.h | 5 + drivers/gpu/drm/i915/gvt/scheduler.c | 5 + drivers/gpu/drm/i915/i915_drv.c | 22 +-- drivers/gpu/drm/i915/i915_drv.h | 2 +- drivers/gpu/drm/i915/i915_reg.h | 10 + drivers/gpu/drm/i915/intel_sprite.c | 81 ++++++-- drivers/gpu/drm/radeon/radeon_device.c | 4 + drivers/gpu/drm/radeon/si_dpm.c | 4 +- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 23 +-- drivers/hid/hid-core.c | 10 +- drivers/hid/hid-ids.h | 3 + drivers/hid/hid-input.c | 27 ++- drivers/hid/hid-multitouch.c | 5 +- drivers/hid/hid-rmi.c | 4 +- drivers/hid/hidraw.c | 5 + drivers/hid/i2c-hid/i2c-hid.c | 26 ++- drivers/hid/wacom_sys.c | 4 +- drivers/hid/wacom_wac.c | 76 +++++--- drivers/i2c/busses/i2c-i801.c | 16 +- drivers/infiniband/core/ucma.c | 3 + drivers/infiniband/core/verbs.c | 12 +- drivers/infiniband/hw/mlx5/mr.c | 2 + drivers/infiniband/sw/rxe/rxe_verbs.c | 5 +- drivers/infiniband/ulp/srp/ib_srp.c | 18 +- drivers/infiniband/ulp/srpt/ib_srpt.c | 16 +- drivers/iommu/intel-svm.c | 1 + drivers/irqchip/irq-gic-common.c | 9 +- drivers/md/dm-crypt.c | 66 ++++++- drivers/md/dm-raid.c | 3 +- drivers/md/dm.c | 30 ++- drivers/media/common/videobuf2/videobuf2-core.c | 9 + drivers/media/platform/vivid/vivid-vid-common.c | 3 +- drivers/media/platform/vsp1/vsp1_wpf.c | 2 +- drivers/media/rc/rc-main.c | 6 +- drivers/misc/cxl/cxllib.c | 85 ++++++--- drivers/mmc/core/block.c | 1 + drivers/mmc/host/jz4740_mmc.c | 2 +- drivers/mmc/host/sdhci-pci-core.c | 25 ++- drivers/mmc/host/tmio_mmc_core.c | 2 +- drivers/mtd/ubi/block.c | 2 +- drivers/mtd/ubi/build.c | 11 ++ drivers/mtd/ubi/fastmap-wl.c | 1 - drivers/nvdimm/dimm.c | 8 +- drivers/nvdimm/dimm_devs.c | 22 ++- drivers/nvdimm/namespace_devs.c | 4 +- drivers/pci/hotplug/acpiphp_glue.c | 23 ++- drivers/pci/quirks.c | 4 + drivers/phy/allwinner/phy-sun4i-usb.c | 10 +- drivers/pwm/pwm-mediatek.c | 35 +++- drivers/pwm/pwm-rcar.c | 8 +- drivers/soc/mediatek/mtk-scpsys.c | 2 +- drivers/spi/spi-atmel.c | 8 +- drivers/spi/spi.c | 19 +- .../media/atomisp/pci/atomisp2/atomisp_fops.c | 6 + drivers/thermal/imx_thermal.c | 6 +- drivers/thunderbolt/icm.c | 36 ++-- drivers/thunderbolt/nhi.c | 1 + drivers/thunderbolt/switch.c | 9 + drivers/usb/core/generic.c | 9 +- drivers/usb/dwc3/core.c | 3 + drivers/usb/dwc3/dwc3-pci.c | 2 +- drivers/usb/dwc3/gadget.c | 43 +++-- drivers/usb/gadget/function/f_midi.c | 3 +- drivers/usb/gadget/u_f.h | 2 + drivers/usb/gadget/udc/core.c | 3 + drivers/usb/musb/musb_gadget_ep0.c | 14 +- drivers/watchdog/f71808e_wdt.c | 2 +- fs/autofs4/root.c | 2 +- fs/ceph/inode.c | 10 +- fs/cifs/Kconfig | 1 + fs/cifs/cifsencrypt.c | 85 ++------- fs/cifs/cifsfs.c | 1 + fs/cifs/cifsglob.h | 8 +- fs/cifs/cifsproto.h | 5 + fs/cifs/inode.c | 33 ++++ fs/cifs/link.c | 27 +-- fs/cifs/misc.c | 54 ++++++ fs/cifs/smb2misc.c | 64 +++++++ fs/cifs/smb2ops.c | 15 +- fs/cifs/smb2pdu.c | 38 +++- fs/cifs/smb2pdu.h | 1 + fs/cifs/smb2proto.h | 5 + fs/cifs/smb2transport.c | 97 ++++------ fs/cifs/smbdirect.c | 19 +- fs/cifs/smbencrypt.c | 27 +-- fs/cifs/transport.c | 17 ++ fs/ext4/balloc.c | 19 +- fs/ext4/dir.c | 8 +- fs/ext4/ext4_jbd2.c | 7 - fs/ext4/ialloc.c | 54 +----- fs/ext4/inode.c | 13 +- fs/ext4/ioctl.c | 8 +- fs/ext4/super.c | 21 ++- fs/ext4/xattr.c | 121 ++++++------ fs/ext4/xattr.h | 11 ++ fs/fs-writeback.c | 7 +- fs/jbd2/journal.c | 30 ++- fs/jffs2/super.c | 2 +- fs/namespace.c | 3 +- fs/notify/fanotify/fanotify.c | 34 ++-- fs/orangefs/super.c | 5 + fs/reiserfs/journal.c | 2 +- fs/ubifs/super.c | 14 +- fs/udf/unicode.c | 6 + include/dt-bindings/clock/mt2701-clk.h | 3 +- include/linux/backing-dev-defs.h | 5 + include/linux/backing-dev.h | 30 +-- include/linux/blk_types.h | 5 + include/linux/compiler-clang.h | 3 - include/linux/compiler-gcc.h | 12 +- include/linux/hid.h | 15 +- include/linux/hmm.h | 9 +- include/linux/mm.h | 1 + include/sound/pcm_oss.h | 1 + include/uapi/linux/random.h | 3 + ipc/shm.c | 23 ++- kernel/resource.c | 3 +- kernel/trace/ring_buffer.c | 5 + kernel/trace/trace_uprobe.c | 2 +- lib/swiotlb.c | 2 +- lib/vsprintf.c | 4 + mm/filemap.c | 9 +- mm/hmm.c | 3 +- mm/ksm.c | 7 + mm/memory-failure.c | 16 ++ mm/page-writeback.c | 18 +- mm/slab.c | 3 +- net/sunrpc/rpc_pipe.c | 1 + net/sunrpc/xprtrdma/rpc_rdma.c | 2 +- net/sunrpc/xprtrdma/transport.c | 2 - net/sunrpc/xprtrdma/verbs.c | 13 +- net/sunrpc/xprtrdma/xprt_rdma.h | 1 - sound/core/oss/pcm_oss.c | 186 ++++++++++++++---- sound/core/pcm.c | 8 +- sound/core/rawmidi_compat.c | 18 +- sound/pci/hda/hda_intel.c | 3 +- sound/pci/hda/patch_realtek.c | 3 + sound/soc/codecs/ssm2602.c | 19 +- sound/soc/soc-topology.c | 23 ++- sound/usb/line6/midi.c | 2 +- virt/kvm/arm/vgic/vgic-its.c | 15 +- 208 files changed, 2213 insertions(+), 1021 deletions(-)

7 years, 8 months

6
198
0 0

[PATCH 4.14 00/80] 4.14.38-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.38 release. There are 80 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun Apr 29 13:57:13 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.38-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.38-rc1 Hans de Goede <hdegoede(a)redhat.com> ACPI / video: Only default only_lcd to true on Win8-ready _desktops_ Heiko Carstens <heiko.carstens(a)de.ibm.com> s390/uprobes: implement arch_uretprobe_is_alive() Stefan Haberland <sth(a)linux.vnet.ibm.com> s390/dasd: fix IO error for newly defined devices Sebastian Ott <sebott(a)linux.ibm.com> s390/cio: update chpid descriptor after resource accessibility event Peter Xu <peterx(a)redhat.com> tracing: Fix missing tab for hwlat_detector print format Finn Thain <fthain(a)telegraphics.com.au> block/swim: Fix IO error at end of medium Finn Thain <fthain(a)telegraphics.com.au> block/swim: Fix array bounds check Finn Thain <fthain(a)telegraphics.com.au> block/swim: Select appropriate drive on device open Finn Thain <fthain(a)telegraphics.com.au> block/swim: Rename macros to avoid inconsistent inverted logic Finn Thain <fthain(a)telegraphics.com.au> block/swim: Remove extra put_disk() call from error path Finn Thain <fthain(a)telegraphics.com.au> block/swim: Don't log an error message for an invalid ioctl Finn Thain <fthain(a)telegraphics.com.au> block/swim: Check drive type Finn Thain <fthain(a)telegraphics.com.au> m68k/mac: Don't remap SWIM MMIO region Robert Kolchmeyer <rkolchmeyer(a)google.com> fsnotify: Fix fsnotify_mark_connector race Dan Carpenter <dan.carpenter(a)oracle.com> cdrom: information leak in cdrom_ioctl_media_changed() Martin K. Petersen <martin.petersen(a)oracle.com> scsi: mptsas: Disable WRITE SAME Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> commoncap: Handle memory allocation failure. Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "mm/hmm: fix header file if/else/endif maze" Klaus Goger <klaus.goger(a)theobroma-systems.com> arm64: dts: rockchip: remove vdd_log from rk3399-puma Michal Simek <michal.simek(a)xilinx.com> microblaze: Setup dependencies for ASM optimized lib functions Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: correct module section names for expoline code revert Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: correct nospec auto detection init order Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: add sysfs attributes for spectre Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: report spectre mitigation via syslog Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: add automatic detection of the spectre defense Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: move nobp parameter functions to nospec-branch.c Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390/entry.S: fix spurious zeroing of r0 Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: do not bypass BPENTER for interrupt system calls Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) Martin Schwidefsky <schwidefsky(a)de.ibm.com> KVM: s390: force bp isolation for VSIE Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: introduce execute-trampolines for branches Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: run user space and KVM guests with modified branch prediction Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: add options to change branch prediction behaviour for the kernel Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390/alternative: use a copy of the facility bit mask Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: add optimized array_index_mask_nospec Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: scrub registers on kernel entry and KVM exit Martin Schwidefsky <schwidefsky(a)de.ibm.com> KVM: s390: wire up bpb feature Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: enable CPU alternatives unconditionally Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: introduce CPU alternatives Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "microblaze: fix endian handling" Michael S. Tsirkin <mst(a)redhat.com> virtio_net: fix adding vids on big-endian Michael S. Tsirkin <mst(a)redhat.com> virtio_net: split out ctrl buffer Ivan Khoronzhuk <ivan.khoronzhuk(a)linaro.org> net: ethernet: ti: cpsw: fix tx vlan priority mapping Cong Wang <xiyou.wangcong(a)gmail.com> llc: fix NULL pointer deref for SOCK_ZAPPED Cong Wang <xiyou.wangcong(a)gmail.com> llc: hold llc_sap before release_sock() Alexander Aring <aring(a)mojatatu.com> net: sched: ife: check on metadata length Alexander Aring <aring(a)mojatatu.com> net: sched: ife: handle malformed tlv length Soheil Hassas Yeganeh <soheil(a)google.com> tcp: clear tp->packets_out when purging write queue Alexander Aring <aring(a)mojatatu.com> net: sched: ife: signal not finding metaid Doron Roberts-Kedes <doronrk(a)fb.com> strparser: Fix incorrect strp->need_bytes value. Tom Lendacky <thomas.lendacky(a)amd.com> amd-xgbe: Only use the SFP supported transceiver signals Doron Roberts-Kedes <doronrk(a)fb.com> strparser: Do not call mod_delayed_work with a timeout of LONG_MAX Tom Lendacky <thomas.lendacky(a)amd.com> amd-xgbe: Improve KR auto-negotiation and training Xin Long <lucien.xin(a)gmail.com> sctp: do not check port in sctp_inet6_cmp_addr Tom Lendacky <thomas.lendacky(a)amd.com> amd-xgbe: Add pre/post auto-negotiation phy hooks Toshiaki Makita <makita.toshiaki(a)lab.ntt.co.jp> vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi Guillaume Nault <g.nault(a)alphalink.fr> pppoe: check sockaddr length in pppoe_connect() Eric Dumazet <edumazet(a)google.com> tipc: add policy for TIPC_NLA_NET_ADDR Willem de Bruijn <willemb(a)google.com> packet: fix bitfield update race Xin Long <lucien.xin(a)gmail.com> team: fix netconsole setup over team Ursula Braun <ubraun(a)linux.vnet.ibm.com> net/smc: fix shutdown in state SMC_LISTEN Paolo Abeni <pabeni(a)redhat.com> team: avoid adding twice the same option to the event list Wolfgang Bumiller <w.bumiller(a)proxmox.com> net: fix deadlock while clearing neighbor proxy table Eric Dumazet <edumazet(a)google.com> tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets Eric Dumazet <edumazet(a)google.com> net: af_packet: fix race in PACKET_{R|T}X_RING Jann Horn <jannh(a)google.com> tcp: don't read out-of-bounds opsize Cong Wang <xiyou.wangcong(a)gmail.com> llc: delete timers synchronously in llc_sk_free() Eric Dumazet <edumazet(a)google.com> net: validate attribute sizes in neigh_dump_table() Guillaume Nault <g.nault(a)alphalink.fr> l2tp: check sockaddr length in pppol2tp_connect() Eric Biggers <ebiggers(a)google.com> KEYS: DNS: limit the length of option strings Ahmed Abdelsalam <amsalam20(a)gmail.com> ipv6: sr: fix NULL pointer dereference in seg6_do_srh_encap()- v4 pkts Eric Dumazet <edumazet(a)google.com> ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy Xin Long <lucien.xin(a)gmail.com> bonding: do not set slave_dev npinfo before slave_enable_netpoll in bond_enslave Karthikeyan Periyasamy <periyasa(a)codeaurora.org> Revert "ath10k: send (re)assoc peer command when NSS changed" James Bottomley <James.Bottomley(a)HansenPartnership.com> tpm: add retry logic Winkler, Tomas <tomas.winkler(a)intel.com> tpm: tpm-interface: fix tpm_transmit/_cmd kdoc Tomas Winkler <tomas.winkler(a)intel.com> tpm: cmd_ready command can be issued only after granting locality Paweł Jabłoński <pawel.jablonski(a)intel.com> i40e: Fix attach VF to VM issue Neil Armstrong <narmstrong(a)baylibre.com> drm: bridge: dw-hdmi: Fix overflow workaround for Amlogic Meson GX SoCs Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "pinctrl: intel: Initialize GPIO properly when used through irqchip" ------------- Diffstat: Documentation/admin-guide/kernel-parameters.txt | 3 + Makefile | 4 +- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 11 - arch/microblaze/Kconfig.platform | 1 + arch/microblaze/Makefile | 17 +- arch/microblaze/lib/fastcopy.S | 4 - arch/s390/Kconfig | 47 ++++ arch/s390/Makefile | 10 + arch/s390/include/asm/alternative.h | 149 ++++++++++++ arch/s390/include/asm/barrier.h | 24 ++ arch/s390/include/asm/facility.h | 18 ++ arch/s390/include/asm/kvm_host.h | 3 +- arch/s390/include/asm/lowcore.h | 7 +- arch/s390/include/asm/nospec-branch.h | 17 ++ arch/s390/include/asm/processor.h | 4 + arch/s390/include/asm/thread_info.h | 4 + arch/s390/include/uapi/asm/kvm.h | 5 +- arch/s390/kernel/Makefile | 6 +- arch/s390/kernel/alternative.c | 112 +++++++++ arch/s390/kernel/early.c | 5 + arch/s390/kernel/entry.S | 250 ++++++++++++++++++--- arch/s390/kernel/ipl.c | 1 + arch/s390/kernel/module.c | 65 +++++- arch/s390/kernel/nospec-branch.c | 169 ++++++++++++++ arch/s390/kernel/processor.c | 18 ++ arch/s390/kernel/setup.c | 14 +- arch/s390/kernel/smp.c | 7 +- arch/s390/kernel/uprobes.c | 9 + arch/s390/kernel/vmlinux.lds.S | 37 +++ arch/s390/kvm/kvm-s390.c | 12 + arch/s390/kvm/vsie.c | 30 +++ drivers/acpi/acpi_video.c | 27 ++- drivers/block/swim.c | 49 ++-- drivers/block/swim3.c | 6 +- drivers/cdrom/cdrom.c | 2 +- drivers/char/tpm/tpm-interface.c | 131 ++++++++--- drivers/char/tpm/tpm.h | 1 + drivers/char/tpm/tpm_crb.c | 108 ++++++--- drivers/char/tpm/tpm_tis_core.c | 4 +- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 3 + drivers/message/fusion/mptsas.c | 1 + drivers/net/bonding/bond_main.c | 3 +- drivers/net/ethernet/amd/xgbe/xgbe-common.h | 8 + drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c | 16 ++ drivers/net/ethernet/amd/xgbe/xgbe-main.c | 1 + drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 24 +- drivers/net/ethernet/amd/xgbe/xgbe-pci.c | 2 + drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 196 ++++++++++++++-- drivers/net/ethernet/amd/xgbe/xgbe.h | 9 + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 11 + drivers/net/ethernet/ti/cpsw.c | 2 +- drivers/net/ppp/pppoe.c | 4 + drivers/net/team/team.c | 38 +++- drivers/net/virtio_net.c | 68 +++--- drivers/net/wireless/ath/ath10k/mac.c | 5 +- drivers/pinctrl/intel/pinctrl-intel.c | 23 +- drivers/s390/block/dasd_alias.c | 13 +- drivers/s390/char/Makefile | 2 + drivers/s390/cio/chsc.c | 14 +- include/linux/fsnotify_backend.h | 4 +- include/linux/hmm.h | 9 +- include/linux/if_vlan.h | 7 +- include/linux/tpm.h | 2 +- include/net/ife.h | 3 +- include/net/llc_conn.h | 1 + include/net/tcp.h | 1 + include/uapi/linux/kvm.h | 1 + kernel/trace/trace_entries.h | 2 +- net/core/dev.c | 2 +- net/core/neighbour.c | 40 ++-- net/dns_resolver/dns_key.c | 13 +- net/ife/ife.c | 38 +++- net/ipv4/tcp.c | 7 +- net/ipv4/tcp_input.c | 7 +- net/ipv6/route.c | 2 + net/ipv6/seg6_iptunnel.c | 2 +- net/l2tp/l2tp_ppp.c | 7 + net/llc/af_llc.c | 14 +- net/llc/llc_c_ac.c | 9 +- net/llc/llc_conn.c | 22 +- net/packet/af_packet.c | 83 ++++--- net/packet/internal.h | 10 +- net/sched/act_ife.c | 9 +- net/sctp/ipv6.c | 60 ++--- net/smc/af_smc.c | 10 +- net/strparser/strparser.c | 9 +- net/tipc/netlink.c | 3 +- security/commoncap.c | 2 + 88 files changed, 1842 insertions(+), 371 deletions(-)

7 years, 8 months

5
83
0 0

[PATCH 4.9 00/74] 4.9.97-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.9.97 release. There are 74 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun Apr 29 13:56:52 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.97-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.9.97-rc1 Hans de Goede <hdegoede(a)redhat.com> ACPI / video: Only default only_lcd to true on Win8-ready _desktops_ Heiko Carstens <heiko.carstens(a)de.ibm.com> s390/uprobes: implement arch_uretprobe_is_alive() Stefan Haberland <sth(a)linux.vnet.ibm.com> s390/dasd: fix IO error for newly defined devices Sebastian Ott <sebott(a)linux.ibm.com> s390/cio: update chpid descriptor after resource accessibility event Dan Carpenter <dan.carpenter(a)oracle.com> cdrom: information leak in cdrom_ioctl_media_changed() Martin K. Petersen <martin.petersen(a)oracle.com> scsi: mptsas: Disable WRITE SAME Doron Roberts-Kedes <doronrk(a)fb.com> strparser: Fix incorrect strp->need_bytes value. Eric Dumazet <edumazet(a)google.com> ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy Eric Dumazet <edumazet(a)google.com> net: af_packet: fix race in PACKET_{R|T}X_RING Eric Dumazet <edumazet(a)google.com> tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets Wolfgang Bumiller <w.bumiller(a)proxmox.com> net: fix deadlock while clearing neighbor proxy table Ivan Khoronzhuk <ivan.khoronzhuk(a)linaro.org> net: ethernet: ti: cpsw: fix tx vlan priority mapping Cong Wang <xiyou.wangcong(a)gmail.com> llc: fix NULL pointer deref for SOCK_ZAPPED Cong Wang <xiyou.wangcong(a)gmail.com> llc: hold llc_sap before release_sock() Alexander Aring <aring(a)mojatatu.com> net: sched: ife: signal not finding metaid Xin Long <lucien.xin(a)gmail.com> sctp: do not check port in sctp_inet6_cmp_addr Toshiaki Makita <makita.toshiaki(a)lab.ntt.co.jp> vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi Guillaume Nault <g.nault(a)alphalink.fr> pppoe: check sockaddr length in pppoe_connect() Eric Dumazet <edumazet(a)google.com> tipc: add policy for TIPC_NLA_NET_ADDR Willem de Bruijn <willemb(a)google.com> packet: fix bitfield update race Xin Long <lucien.xin(a)gmail.com> team: fix netconsole setup over team Paolo Abeni <pabeni(a)redhat.com> team: avoid adding twice the same option to the event list Jann Horn <jannh(a)google.com> tcp: don't read out-of-bounds opsize Cong Wang <xiyou.wangcong(a)gmail.com> llc: delete timers synchronously in llc_sk_free() Eric Dumazet <edumazet(a)google.com> net: validate attribute sizes in neigh_dump_table() Guillaume Nault <g.nault(a)alphalink.fr> l2tp: check sockaddr length in pppol2tp_connect() Eric Biggers <ebiggers(a)google.com> KEYS: DNS: limit the length of option strings Xin Long <lucien.xin(a)gmail.com> bonding: do not set slave_dev npinfo before slave_enable_netpoll in bond_enslave Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: correct module section names for expoline code revert Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: correct nospec auto detection init order Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: add sysfs attributes for spectre Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: report spectre mitigation via syslog Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: add automatic detection of the spectre defense Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: move nobp parameter functions to nospec-branch.c Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390/entry.S: fix spurious zeroing of r0 Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: do not bypass BPENTER for interrupt system calls Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) Martin Schwidefsky <schwidefsky(a)de.ibm.com> KVM: s390: force bp isolation for VSIE Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: introduce execute-trampolines for branches Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: run user space and KVM guests with modified branch prediction Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: add options to change branch prediction behaviour for the kernel Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390/alternative: use a copy of the facility bit mask Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: add optimized array_index_mask_nospec Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: scrub registers on kernel entry and KVM exit Martin Schwidefsky <schwidefsky(a)de.ibm.com> KVM: s390: wire up bpb feature Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: enable CPU alternatives unconditionally Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390: introduce CPU alternatives Sinan Kaya <okaya(a)codeaurora.org> PCI: Wait up to 60 seconds for device to become ready after FLR Karthikeyan Periyasamy <periyasa(a)codeaurora.org> Revert "ath10k: send (re)assoc peer command when NSS changed" Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "pinctrl: intel: Initialize GPIO properly when used through irqchip" Grant Grundler <grundler(a)chromium.org> r8152: add Linksys USB3GIGV1 id Benjamin Beichler <benjamin.beichler(a)uni-rostock.de> mac80211_hwsim: fix use-after-free bug in hwsim_exit_net Imre Deak <imre.deak(a)intel.com> drm/i915/bxt, glk: Increase PCODE timeouts during CDCLK freq changing Leon Romanovsky <leonro(a)mellanox.com> RDMA/mlx5: Fix NULL dereference while accessing XRC_TGT QPs Jiri Olsa <jolsa(a)kernel.org> perf: Return proper values for user stack errors Jiri Olsa <jolsa(a)kernel.org> perf: Fix sample_max_stack maximum check Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "perf tools: Decompress kernel module when reading DSO data" Sahitya Tummala <stummala(a)codeaurora.org> jbd2: fix use after free in kjournald2() Felix Fietkau <nbd(a)nbd.name> ath9k_hw: check if the chip failed to wake up Paul Burton <paul.burton(a)imgtec.com> OF: Prevent unaligned access in of_alias_scan() Dan Carpenter <dan.carpenter(a)oracle.com> stk-webcam: fix an endian bug in stk_camera_read_reg() Colin Ian King <colin.king(a)canonical.com> power: supply: bq2415x: check for NULL acpi_id to avoid null pointer dereference Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: drv260x - fix initializing overdrive voltage Matt Redfearn <matt.redfearn(a)imgtec.com> MIPS: Generic: Fix big endian CPUs on generic machine Merlijn Wajer <merlijn(a)wizzup.org> usb: musb: Fix external abort in musb_remove on omap2430 Merlijn Wajer <merlijn(a)wizzup.org> usb: musb: call pm_runtime_{get,put}_sync before reading vbus registers Andreas Kemnade <andreas(a)kemnade.info> usb: musb: fix enumeration after resume Jean Delvare <jdelvare(a)suse.de> i2c: i801: Restore configuration at shutdown Jean Delvare <jdelvare(a)suse.de> i2c: i801: Save register SMBSLVCMD value only once Benjamin Tissoires <benjamin.tissoires(a)redhat.com> i2c: i801: store and restore the SLVCMD register at load and unload Imre Deak <imre.deak(a)intel.com> drm/i915: Fix LSPCON TMDS output buffer enabling from low-power state Daniel J Blueman <daniel(a)quora.org> drm/vc4: Fix memory leak during BO teardown Xiaoming Gao <gxm.linux.kernel(a)gmail.com> x86/tsc: Prevent 32bit truncation in calc_hpet_ref() Steve French <smfrench(a)gmail.com> cifs: do not allow creating sockets except with SMB1 posix exensions ------------- Diffstat: Documentation/kernel-parameters.txt | 3 + Makefile | 4 +- arch/mips/Kconfig | 1 + arch/s390/Kconfig | 47 ++++++ arch/s390/Makefile | 10 ++ arch/s390/include/asm/alternative.h | 149 +++++++++++++++++ arch/s390/include/asm/barrier.h | 24 +++ arch/s390/include/asm/facility.h | 18 +++ arch/s390/include/asm/kvm_host.h | 3 +- arch/s390/include/asm/lowcore.h | 7 +- arch/s390/include/asm/nospec-branch.h | 17 ++ arch/s390/include/asm/processor.h | 4 + arch/s390/include/asm/thread_info.h | 4 + arch/s390/include/uapi/asm/kvm.h | 5 +- arch/s390/kernel/Makefile | 6 +- arch/s390/kernel/alternative.c | 112 +++++++++++++ arch/s390/kernel/early.c | 5 + arch/s390/kernel/entry.S | 250 ++++++++++++++++++++++++++--- arch/s390/kernel/ipl.c | 1 + arch/s390/kernel/module.c | 65 +++++++- arch/s390/kernel/nospec-branch.c | 169 +++++++++++++++++++ arch/s390/kernel/processor.c | 18 +++ arch/s390/kernel/setup.c | 14 +- arch/s390/kernel/smp.c | 7 +- arch/s390/kernel/uprobes.c | 9 ++ arch/s390/kernel/vmlinux.lds.S | 37 +++++ arch/s390/kvm/kvm-s390.c | 13 +- arch/s390/kvm/vsie.c | 30 ++++ arch/x86/kernel/tsc.c | 2 +- drivers/acpi/acpi_video.c | 27 +++- drivers/cdrom/cdrom.c | 2 +- drivers/gpu/drm/drm_dp_dual_mode_helper.c | 39 ++++- drivers/gpu/drm/i915/i915_drv.h | 6 +- drivers/gpu/drm/i915/intel_display.c | 9 +- drivers/gpu/drm/i915/intel_pm.c | 6 +- drivers/gpu/drm/vc4/vc4_bo.c | 2 + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 1 + drivers/i2c/busses/i2c-i801.c | 29 +++- drivers/infiniband/hw/mlx5/qp.c | 3 +- drivers/input/misc/drv260x.c | 2 +- drivers/media/usb/stkwebcam/stk-sensor.c | 6 +- drivers/media/usb/stkwebcam/stk-webcam.c | 11 +- drivers/media/usb/stkwebcam/stk-webcam.h | 2 +- drivers/message/fusion/mptsas.c | 1 + drivers/net/bonding/bond_main.c | 3 +- drivers/net/ethernet/ti/cpsw.c | 2 +- drivers/net/ppp/pppoe.c | 4 + drivers/net/team/team.c | 38 ++++- drivers/net/usb/cdc_ether.c | 10 ++ drivers/net/usb/r8152.c | 2 + drivers/net/wireless/ath/ath10k/mac.c | 5 +- drivers/net/wireless/ath/ath9k/hw.c | 4 + drivers/net/wireless/mac80211_hwsim.c | 7 +- drivers/of/base.c | 2 +- drivers/pci/pci.c | 52 ++++-- drivers/pinctrl/intel/pinctrl-intel.c | 23 +-- drivers/power/supply/bq2415x_charger.c | 5 + drivers/s390/block/dasd_alias.c | 13 +- drivers/s390/char/Makefile | 2 + drivers/s390/cio/chsc.c | 14 +- drivers/usb/musb/musb_core.c | 8 +- fs/cifs/dir.c | 9 +- fs/jbd2/journal.c | 2 +- include/linux/if_vlan.h | 7 +- include/net/llc_conn.h | 1 + include/uapi/linux/kvm.h | 1 + kernel/events/callchain.c | 21 +-- kernel/events/core.c | 4 +- net/core/dev.c | 2 +- net/core/neighbour.c | 40 +++-- net/dns_resolver/dns_key.c | 13 +- net/ipv4/tcp.c | 6 +- net/ipv4/tcp_input.c | 7 +- net/ipv6/route.c | 2 + net/l2tp/l2tp_ppp.c | 7 + net/llc/af_llc.c | 14 +- net/llc/llc_c_ac.c | 9 +- net/llc/llc_conn.c | 22 ++- net/packet/af_packet.c | 82 +++++++--- net/packet/internal.h | 10 +- net/sched/act_ife.c | 2 +- net/sctp/ipv6.c | 60 +++---- net/strparser/strparser.c | 7 +- net/tipc/netlink.c | 3 +- tools/perf/util/dso.c | 16 -- 85 files changed, 1459 insertions(+), 262 deletions(-)

7 years, 8 months

4
72
0 0

[PATCH 3.18 00/24] 3.18.107-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 3.18.107 release. There are 24 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun Apr 29 13:56:20 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.107-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 3.18.107-rc1 Dan Carpenter <dan.carpenter(a)oracle.com> cdrom: information leak in cdrom_ioctl_media_changed() Martin K. Petersen <martin.petersen(a)oracle.com> scsi: mptsas: Disable WRITE SAME Eric Dumazet <edumazet(a)google.com> ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy Cong Wang <xiyou.wangcong(a)gmail.com> llc: delete timers synchronously in llc_sk_free() Eric Dumazet <edumazet(a)google.com> net: af_packet: fix race in PACKET_{R|T}X_RING Eric Dumazet <edumazet(a)google.com> tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets Willem de Bruijn <willemb(a)google.com> packet: fix bitfield update race Cong Wang <xiyou.wangcong(a)gmail.com> llc: fix NULL pointer deref for SOCK_ZAPPED Cong Wang <xiyou.wangcong(a)gmail.com> llc: hold llc_sap before release_sock() Guillaume Nault <g.nault(a)alphalink.fr> pppoe: check sockaddr length in pppoe_connect() Xin Long <lucien.xin(a)gmail.com> team: fix netconsole setup over team Paolo Abeni <pabeni(a)redhat.com> team: avoid adding twice the same option to the event list Jann Horn <jannh(a)google.com> tcp: don't read out-of-bounds opsize Guillaume Nault <g.nault(a)alphalink.fr> l2tp: check sockaddr length in pppol2tp_connect() Eric Biggers <ebiggers(a)google.com> KEYS: DNS: limit the length of option strings Xin Long <lucien.xin(a)gmail.com> bonding: do not set slave_dev npinfo before slave_enable_netpoll in bond_enslave Sahitya Tummala <stummala(a)codeaurora.org> jbd2: fix use after free in kjournald2() Matthew Wilcox <mawilcox(a)microsoft.com> mm/filemap.c: fix NULL pointer in page_cache_tree_insert() Jiri Olsa <jolsa(a)kernel.org> perf: Return proper values for user stack errors Theodore Ts'o <tytso(a)mit.edu> ext4: don't update checksum of new initialized bitmaps wangguang <wang.guang55(a)zte.com.cn> ext4: bugfix for mmaped pages in mpage_release_unused_pages() Theodore Ts'o <tytso(a)mit.edu> ext4: fix deadlock between inline_data and ext4_expand_extra_isize_ea() Xiaoming Gao <gxm.linux.kernel(a)gmail.com> x86/tsc: Prevent 32bit truncation in calc_hpet_ref() Steve French <smfrench(a)gmail.com> cifs: do not allow creating sockets except with SMB1 posix exensions ------------- Diffstat: Makefile | 4 +- arch/x86/kernel/tsc.c | 2 +- drivers/cdrom/cdrom.c | 2 +- drivers/message/fusion/mptsas.c | 1 + drivers/net/bonding/bond_main.c | 3 +- drivers/net/ppp/pppoe.c | 4 ++ drivers/net/team/team.c | 38 ++++++++++++++---- fs/cifs/dir.c | 9 +++-- fs/ext4/balloc.c | 3 +- fs/ext4/ialloc.c | 43 ++------------------ fs/ext4/inline.c | 66 ++++++++++++++----------------- fs/ext4/inode.c | 2 + fs/ext4/xattr.c | 30 ++++++-------- fs/ext4/xattr.h | 32 +++++++++++++++ fs/jbd2/journal.c | 2 +- include/net/llc_conn.h | 1 + kernel/events/core.c | 4 +- mm/filemap.c | 4 +- net/dns_resolver/dns_key.c | 13 +++--- net/ipv4/tcp.c | 6 ++- net/ipv4/tcp_input.c | 7 +--- net/ipv6/route.c | 2 + net/l2tp/l2tp_ppp.c | 7 ++++ net/llc/af_llc.c | 14 ++++++- net/llc/llc_c_ac.c | 9 +---- net/llc/llc_conn.c | 22 ++++++++++- net/packet/af_packet.c | 88 +++++++++++++++++++++++++++++------------ net/packet/internal.h | 10 ++--- 28 files changed, 254 insertions(+), 174 deletions(-)

7 years, 8 months

6
32
0 0

[PATCH v4 0/7] kprobes: Fix %p in kprobes

by Masami Hiramatsu

Hi, This 4th version of the series which fixes %p uses in kprobes. Some by replacing with %pS, some by replacing with %px but masking with kallsyms_show_value(). I've read the thread about %pK and if I understand correctly we shouldn't print kernel addresses. However, kprobes debugfs interface can not stop to show the actual probe address because it should be compared with addresses in kallsyms for debugging. So, it depends on that kallsyms_show_value() allows to show address to user, because if it returns true, anyway that user can dump /proc/kallsyms. Other error messages are replaced it with %pS or just removed. This series also including fixes for arch ports too. Changes in this version; [1/7] Fix "list" file's mode too. [2/7] Do not use local variables and fix comment. [4/7] Use WARN_ONCE() for single bug. [5/7] Just remove %p. Thank you, --- Masami Hiramatsu (7): kprobes: Make list and blacklist root user read only kprobes: Show blacklist addresses as same as kallsyms does kprobes: Show address of kprobes if kallsyms does kprobes: Replace %p with other pointer types kprobes/x86: Fix %p uses in error messages kprobes/arm: Fix %p uses in error messages kprobes/arm64: Fix %p uses in error messages arch/arm/probes/kprobes/core.c | 10 +++---- arch/arm/probes/kprobes/test-core.c | 1 - arch/arm64/kernel/probes/kprobes.c | 4 +-- arch/x86/kernel/kprobes/core.c | 13 +++------ kernel/kprobes.c | 52 +++++++++++++++++++++-------------- 5 files changed, 42 insertions(+), 38 deletions(-) -- Masami Hiramatsu (Linaro) <mhiramat(a)kernel.org>

7 years, 8 months

1
7
0 0

[PATCH V3] cpufreq: powernv: Fix the hardlockup by synchronus smp_call in timer interrupt

by Shilpasri G Bhat

gpstate_timer_handler() uses synchronous smp_call to set the pstate on the requested core. This causes the below hard lockup: [c000003fe566b320] [c0000000001d5340] smp_call_function_single+0x110/0x180 (unreliable) [c000003fe566b390] [c0000000001d55e0] smp_call_function_any+0x180/0x250 [c000003fe566b3f0] [c000000000acd3e8] gpstate_timer_handler+0x1e8/0x580 [c000003fe566b4a0] [c0000000001b46b0] call_timer_fn+0x50/0x1c0 [c000003fe566b520] [c0000000001b4958] expire_timers+0x138/0x1f0 [c000003fe566b590] [c0000000001b4bf8] run_timer_softirq+0x1e8/0x270 [c000003fe566b630] [c000000000d0d6c8] __do_softirq+0x158/0x3e4 [c000003fe566b710] [c000000000114be8] irq_exit+0xe8/0x120 [c000003fe566b730] [c000000000024d0c] timer_interrupt+0x9c/0xe0 [c000003fe566b760] [c000000000009014] decrementer_common+0x114/0x120 -- interrupt: 901 at doorbell_global_ipi+0x34/0x50 LR = arch_send_call_function_ipi_mask+0x120/0x130 [c000003fe566ba50] [c00000000004876c] arch_send_call_function_ipi_mask+0x4c/0x130 [c000003fe566ba90] [c0000000001d59f0] smp_call_function_many+0x340/0x450 [c000003fe566bb00] [c000000000075f18] pmdp_invalidate+0x98/0xe0 [c000003fe566bb30] [c0000000003a1120] change_huge_pmd+0xe0/0x270 [c000003fe566bba0] [c000000000349278] change_protection_range+0xb88/0xe40 [c000003fe566bcf0] [c0000000003496c0] mprotect_fixup+0x140/0x340 [c000003fe566bdb0] [c000000000349a74] SyS_mprotect+0x1b4/0x350 [c000003fe566be30] [c00000000000b184] system_call+0x58/0x6c One way to avoid this is removing the smp-call. We can ensure that the timer always runs on one of the policy-cpus. If the timer gets migrated to a cpu outside the policy then re-queue it back on the policy->cpus. This way we can get rid of the smp-call which was being used to set the pstate on the policy->cpus. Fixes: 7bc54b652f13 (timers, cpufreq/powernv: Initialize the gpstate timer as pinned) Cc: <stable(a)vger.kernel.org> [4.8+] Reported-by: Nicholas Piggin <npiggin(a)gmail.com> Reported-by: Pridhiviraj Paidipeddi <ppaidipe(a)linux.vnet.ibm.com> Signed-off-by: Shilpasri G Bhat <shilpa.bhat(a)linux.vnet.ibm.com> --- Changes from V2: - Remove the check for active policy while requeing the migrated timer Changes from V1: - Remove smp_call in the pstate handler. drivers/cpufreq/powernv-cpufreq.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c index 71f8682..e368e1f 100644 --- a/drivers/cpufreq/powernv-cpufreq.c +++ b/drivers/cpufreq/powernv-cpufreq.c @@ -679,6 +679,16 @@ void gpstate_timer_handler(struct timer_list *t) if (!spin_trylock(&gpstates->gpstate_lock)) return; + /* + * If the timer has migrated to the different cpu then bring + * it back to one of the policy->cpus + */ + if (!cpumask_test_cpu(raw_smp_processor_id(), policy->cpus)) { + gpstates->timer.expires = jiffies + msecs_to_jiffies(1); + add_timer_on(&gpstates->timer, cpumask_first(policy->cpus)); + spin_unlock(&gpstates->gpstate_lock); + return; + } /* * If PMCR was last updated was using fast_swtich then @@ -718,10 +728,8 @@ void gpstate_timer_handler(struct timer_list *t) if (gpstate_idx != gpstates->last_lpstate_idx) queue_gpstate_timer(gpstates); + set_pstate(&freq_data); spin_unlock(&gpstates->gpstate_lock); - - /* Timer may get migrated to a different cpu on cpu hot unplug */ - smp_call_function_any(policy->cpus, set_pstate, &freq_data, 1); } /* -- 1.8.3.1

7 years, 8 months

5
4
0 0

[fixed Patch] KVM: s390: wire up bpb feature

by Christian Borntraeger

From: Christian Borntraeger <borntraeger(a)de.ibm.com> [ Upstream commit 35b3fde6203b932b2b1a5b53b3d8808abc9c4f60 ] The new firmware interfaces for branch prediction behaviour changes are transparently available for the guest. Nevertheless, there is new state attached that should be migrated and properly resetted. Provide a mechanism for handling reset, migration and VSIE. Signed-off-by: Christian Borntraeger <borntraeger(a)de.ibm.com> Reviewed-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Cornelia Huck <cohuck(a)redhat.com> [Changed capability number to 152. - Radim] Signed-off-by: Radim Krčmář <rkrcmar(a)redhat.com> --- arch/s390/include/asm/kvm_host.h | 3 ++- arch/s390/include/uapi/asm/kvm.h | 3 +++ arch/s390/kvm/kvm-s390.c | 13 ++++++++++++- include/uapi/linux/kvm.h | 1 + 4 files changed, 18 insertions(+), 2 deletions(-) Index: linux/arch/s390/include/asm/kvm_host.h =================================================================== --- linux.orig/arch/s390/include/asm/kvm_host.h +++ linux/arch/s390/include/asm/kvm_host.h @@ -136,7 +136,8 @@ struct kvm_s390_sie_block { __u16 ipa; /* 0x0056 */ __u32 ipb; /* 0x0058 */ __u32 scaoh; /* 0x005c */ - __u8 reserved60; /* 0x0060 */ +#define FPF_BPBC 0x20 + __u8 fpf; /* 0x0060 */ __u8 ecb; /* 0x0061 */ __u8 ecb2; /* 0x0062 */ #define ECB3_AES 0x04 Index: linux/arch/s390/include/uapi/asm/kvm.h =================================================================== --- linux.orig/arch/s390/include/uapi/asm/kvm.h +++ linux/arch/s390/include/uapi/asm/kvm.h @@ -151,6 +151,7 @@ struct kvm_guest_debug_arch { #define KVM_SYNC_ARCH0 (1UL << 4) #define KVM_SYNC_PFAULT (1UL << 5) #define KVM_SYNC_VRS (1UL << 6) +#define KVM_SYNC_BPBC (1UL << 10) /* definition of registers in kvm_run */ struct kvm_sync_regs { __u64 prefix; /* prefix register */ @@ -168,6 +169,8 @@ struct kvm_sync_regs { __u64 vrs[32][2]; /* vector registers */ __u8 reserved[512]; /* for future vector expansion */ __u32 fpc; /* only valid with vector registers */ + __u8 bpbc : 1; /* bp mode */ + __u8 reserved2 : 7; }; #define KVM_REG_S390_TODPR (KVM_REG_S390 | KVM_REG_SIZE_U32 | 0x1) Index: linux/arch/s390/kvm/kvm-s390.c =================================================================== --- linux.orig/arch/s390/kvm/kvm-s390.c +++ linux/arch/s390/kvm/kvm-s390.c @@ -257,6 +257,9 @@ int kvm_vm_ioctl_check_extension(struct case KVM_CAP_S390_VECTOR_REGISTERS: r = MACHINE_HAS_VX; break; + case KVM_CAP_S390_BPB: + r = test_facility(82); + break; default: r = 0; } @@ -1264,6 +1267,8 @@ int kvm_arch_vcpu_init(struct kvm_vcpu * KVM_SYNC_PFAULT; if (test_kvm_facility(vcpu->kvm, 129)) vcpu->run->kvm_valid_regs |= KVM_SYNC_VRS; + if (test_kvm_facility(vcpu->kvm, 82)) + vcpu->run->kvm_valid_regs |= KVM_SYNC_BPBC; if (kvm_is_ucontrol(vcpu->kvm)) return __kvm_ucontrol_vcpu_init(vcpu); @@ -1327,6 +1332,7 @@ static void kvm_s390_vcpu_initial_reset( current->thread.fpu.fpc = 0; vcpu->arch.sie_block->gbea = 1; vcpu->arch.sie_block->pp = 0; + vcpu->arch.sie_block->fpf &= ~FPF_BPBC; vcpu->arch.pfault_token = KVM_S390_PFAULT_TOKEN_INVALID; kvm_clear_async_pf_completion_queue(vcpu); if (!kvm_s390_user_cpu_state_ctrl(vcpu->kvm)) @@ -2145,6 +2151,11 @@ static void sync_regs(struct kvm_vcpu *v if (vcpu->arch.pfault_token == KVM_S390_PFAULT_TOKEN_INVALID) kvm_clear_async_pf_completion_queue(vcpu); } + if ((kvm_run->kvm_dirty_regs & KVM_SYNC_BPBC) && + test_kvm_facility(vcpu->kvm, 82)) { + vcpu->arch.sie_block->fpf &= ~FPF_BPBC; + vcpu->arch.sie_block->fpf |= kvm_run->s.regs.bpbc ? FPF_BPBC : 0; + } kvm_run->kvm_dirty_regs = 0; } @@ -2162,6 +2173,7 @@ static void store_regs(struct kvm_vcpu * kvm_run->s.regs.pft = vcpu->arch.pfault_token; kvm_run->s.regs.pfs = vcpu->arch.pfault_select; kvm_run->s.regs.pfc = vcpu->arch.pfault_compare; + kvm_run->s.regs.bpbc = (vcpu->arch.sie_block->fpf & FPF_BPBC) == FPF_BPBC; } int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) Index: linux/include/uapi/linux/kvm.h =================================================================== --- linux.orig/include/uapi/linux/kvm.h +++ linux/include/uapi/linux/kvm.h @@ -831,6 +831,7 @@ struct kvm_ppc_smmu_info { #define KVM_CAP_GUEST_DEBUG_HW_WPS 120 #define KVM_CAP_SPLIT_IRQCHIP 121 #define KVM_CAP_IOEVENTFD_ANY_LENGTH 122 +#define KVM_CAP_S390_BPB 152 #ifdef KVM_CAP_IRQ_ROUTING

7 years, 8 months

2
1
0 0

[PATCH] powerpc/eeh: Fix race with driver un/bind

by Michael Neuling

commit f0295e047fcf52ccb42561fb7de6942f5201b676 upstream. The current EEH callbacks can race with a driver unbind. This can result in a backtraces like this: EEH: Frozen PHB#0-PE#1fc detected EEH: PE location: S000009, PHB location: N/A CPU: 2 PID: 2312 Comm: kworker/u258:3 Not tainted 4.15.6-openpower1 #2 Workqueue: nvme-wq nvme_reset_work [nvme] Call Trace: dump_stack+0x9c/0xd0 (unreliable) eeh_dev_check_failure+0x420/0x470 eeh_check_failure+0xa0/0xa4 nvme_reset_work+0x138/0x1414 [nvme] process_one_work+0x1ec/0x328 worker_thread+0x2e4/0x3a8 kthread+0x14c/0x154 ret_from_kernel_thread+0x5c/0xc8 nvme nvme1: Removing after probe failure status: -19 <snip> cpu 0x23: Vector: 300 (Data Access) at [c000000ff50f3800] pc: c0080000089a0eb0: nvme_error_detected+0x4c/0x90 [nvme] lr: c000000000026564: eeh_report_error+0xe0/0x110 sp: c000000ff50f3a80 msr: 9000000000009033 dar: 400 dsisr: 40000000 current = 0xc000000ff507c000 paca = 0xc00000000fdc9d80 softe: 0 irq_happened: 0x01 pid = 782, comm = eehd Linux version 4.15.6-openpower1 (smc@smc-desktop) (gcc version 6.4.0 (Buildroot 2017.11.2-00008-g4b6188e)) #2 SM P Tue Feb 27 12:33:27 PST 2018 enter ? for help eeh_report_error+0xe0/0x110 eeh_pe_dev_traverse+0xc0/0xdc eeh_handle_normal_event+0x184/0x4c4 eeh_handle_event+0x30/0x288 eeh_event_handler+0x124/0x170 kthread+0x14c/0x154 ret_from_kernel_thread+0x5c/0xc8 The first part is an EEH (on boot), the second half is the resulting crash. nvme probe starts the nvme_reset_work() worker thread. This worker thread starts touching the device which see a device error (EEH) and hence queues up an event in the powerpc EEH worker thread. nvme_reset_work() then continues and runs nvme_remove_dead_ctrl_work() which results in unbinding the driver from the device and hence releases all resources. At the same time, the EEH worker thread starts doing the EEH .error_detected() driver callback, which no longer works since the resources have been freed. This fixes the problem in the same way the generic PCIe AER code (in drivers/pci/pcie/aer/aerdrv_core.c) does. It makes the EEH code hold the device_lock() while performing the driver EEH callbacks and associated code. This ensures either the callbacks are no longer register, or if they are registered the driver will not be removed from underneath us. This has been broken forever. The EEH call backs were first introduced in 2005 (in 77bd7415610) but it's not clear if a lock was needed back then. Fixes: 77bd74156101 ("[PATCH] powerpc: PCI Error Recovery: PPC64 core recovery routines") Cc: stable(a)vger.kernel.org # v4.9, v4.14 Signed-off-by: Michael Neuling <mikey(a)neuling.org> Reviewed-by: Benjamin Herrenschmidt <benh(a)kernel.crashing.org> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> --- Greg, > And it breaks the build on the 4.14.y tree: > arch/powerpc/kernel/eeh_driver.c: In function 'eeh_report_resume': > arch/powerpc/kernel/eeh_driver.c:395:13: error: 'struct eeh_ops' has no member named 'notify_resume' This fixes the build issue from the last try. Sorry again, Mikey --- arch/powerpc/kernel/eeh_driver.c | 61 +++++++++++++++++++++++++--------------- 1 file changed, 38 insertions(+), 23 deletions(-) diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c index 8b840191df..ca2243df9c 100644 --- a/arch/powerpc/kernel/eeh_driver.c +++ b/arch/powerpc/kernel/eeh_driver.c @@ -207,18 +207,18 @@ static void *eeh_report_error(void *data, void *userdata) if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe)) return NULL; + + device_lock(&dev->dev); dev->error_state = pci_channel_io_frozen; driver = eeh_pcid_get(dev); - if (!driver) return NULL; + if (!driver) goto out_no_dev; eeh_disable_irq(dev); if (!driver->err_handler || - !driver->err_handler->error_detected) { - eeh_pcid_put(dev); - return NULL; - } + !driver->err_handler->error_detected) + goto out; rc = driver->err_handler->error_detected(dev, pci_channel_io_frozen); @@ -227,7 +227,10 @@ static void *eeh_report_error(void *data, void *userdata) if (*res == PCI_ERS_RESULT_NONE) *res = rc; edev->in_error = true; +out: eeh_pcid_put(dev); +out_no_dev: + device_unlock(&dev->dev); return NULL; } @@ -250,15 +253,14 @@ static void *eeh_report_mmio_enabled(void *data, void *userdata) if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe)) return NULL; + device_lock(&dev->dev); driver = eeh_pcid_get(dev); - if (!driver) return NULL; + if (!driver) goto out_no_dev; if (!driver->err_handler || !driver->err_handler->mmio_enabled || - (edev->mode & EEH_DEV_NO_HANDLER)) { - eeh_pcid_put(dev); - return NULL; - } + (edev->mode & EEH_DEV_NO_HANDLER)) + goto out; rc = driver->err_handler->mmio_enabled(dev); @@ -266,7 +268,10 @@ static void *eeh_report_mmio_enabled(void *data, void *userdata) if (rc == PCI_ERS_RESULT_NEED_RESET) *res = rc; if (*res == PCI_ERS_RESULT_NONE) *res = rc; +out: eeh_pcid_put(dev); +out_no_dev: + device_unlock(&dev->dev); return NULL; } @@ -289,20 +294,20 @@ static void *eeh_report_reset(void *data, void *userdata) if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe)) return NULL; + + device_lock(&dev->dev); dev->error_state = pci_channel_io_normal; driver = eeh_pcid_get(dev); - if (!driver) return NULL; + if (!driver) goto out_no_dev; eeh_enable_irq(dev); if (!driver->err_handler || !driver->err_handler->slot_reset || (edev->mode & EEH_DEV_NO_HANDLER) || - (!edev->in_error)) { - eeh_pcid_put(dev); - return NULL; - } + (!edev->in_error)) + goto out; rc = driver->err_handler->slot_reset(dev); if ((*res == PCI_ERS_RESULT_NONE) || @@ -310,7 +315,10 @@ static void *eeh_report_reset(void *data, void *userdata) if (*res == PCI_ERS_RESULT_DISCONNECT && rc == PCI_ERS_RESULT_NEED_RESET) *res = rc; +out: eeh_pcid_put(dev); +out_no_dev: + device_unlock(&dev->dev); return NULL; } @@ -361,10 +369,12 @@ static void *eeh_report_resume(void *data, void *userdata) if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe)) return NULL; + + device_lock(&dev->dev); dev->error_state = pci_channel_io_normal; driver = eeh_pcid_get(dev); - if (!driver) return NULL; + if (!driver) goto out_no_dev; was_in_error = edev->in_error; edev->in_error = false; @@ -374,13 +384,15 @@ static void *eeh_report_resume(void *data, void *userdata) !driver->err_handler->resume || (edev->mode & EEH_DEV_NO_HANDLER) || !was_in_error) { edev->mode &= ~EEH_DEV_NO_HANDLER; - eeh_pcid_put(dev); - return NULL; + goto out; } driver->err_handler->resume(dev); +out: eeh_pcid_put(dev); +out_no_dev: + device_unlock(&dev->dev); return NULL; } @@ -400,22 +412,25 @@ static void *eeh_report_failure(void *data, void *userdata) if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe)) return NULL; + + device_lock(&dev->dev); dev->error_state = pci_channel_io_perm_failure; driver = eeh_pcid_get(dev); - if (!driver) return NULL; + if (!driver) goto out_no_dev; eeh_disable_irq(dev); if (!driver->err_handler || - !driver->err_handler->error_detected) { - eeh_pcid_put(dev); - return NULL; - } + !driver->err_handler->error_detected) + goto out; driver->err_handler->error_detected(dev, pci_channel_io_perm_failure); +out: eeh_pcid_put(dev); +out_no_dev: + device_unlock(&dev->dev); return NULL; } -- 2.14.1

7 years, 8 months

2
1
0 0

[PATCH] powerpc/eeh: Fix race with driver un/bind

by Michael Neuling

commit f0295e047fcf52ccb42561fb7de6942f5201b676 upstream. The current EEH callbacks can race with a driver unbind. This can result in a backtraces like this: EEH: Frozen PHB#0-PE#1fc detected EEH: PE location: S000009, PHB location: N/A CPU: 2 PID: 2312 Comm: kworker/u258:3 Not tainted 4.15.6-openpower1 #2 Workqueue: nvme-wq nvme_reset_work [nvme] Call Trace: dump_stack+0x9c/0xd0 (unreliable) eeh_dev_check_failure+0x420/0x470 eeh_check_failure+0xa0/0xa4 nvme_reset_work+0x138/0x1414 [nvme] process_one_work+0x1ec/0x328 worker_thread+0x2e4/0x3a8 kthread+0x14c/0x154 ret_from_kernel_thread+0x5c/0xc8 nvme nvme1: Removing after probe failure status: -19 <snip> cpu 0x23: Vector: 300 (Data Access) at [c000000ff50f3800] pc: c0080000089a0eb0: nvme_error_detected+0x4c/0x90 [nvme] lr: c000000000026564: eeh_report_error+0xe0/0x110 sp: c000000ff50f3a80 msr: 9000000000009033 dar: 400 dsisr: 40000000 current = 0xc000000ff507c000 paca = 0xc00000000fdc9d80 softe: 0 irq_happened: 0x01 pid = 782, comm = eehd Linux version 4.15.6-openpower1 (smc@smc-desktop) (gcc version 6.4.0 (Buildroot 2017.11.2-00008-g4b6188e)) #2 SM P Tue Feb 27 12:33:27 PST 2018 enter ? for help eeh_report_error+0xe0/0x110 eeh_pe_dev_traverse+0xc0/0xdc eeh_handle_normal_event+0x184/0x4c4 eeh_handle_event+0x30/0x288 eeh_event_handler+0x124/0x170 kthread+0x14c/0x154 ret_from_kernel_thread+0x5c/0xc8 The first part is an EEH (on boot), the second half is the resulting crash. nvme probe starts the nvme_reset_work() worker thread. This worker thread starts touching the device which see a device error (EEH) and hence queues up an event in the powerpc EEH worker thread. nvme_reset_work() then continues and runs nvme_remove_dead_ctrl_work() which results in unbinding the driver from the device and hence releases all resources. At the same time, the EEH worker thread starts doing the EEH .error_detected() driver callback, which no longer works since the resources have been freed. This fixes the problem in the same way the generic PCIe AER code (in drivers/pci/pcie/aer/aerdrv_core.c) does. It makes the EEH code hold the device_lock() while performing the driver EEH callbacks and associated code. This ensures either the callbacks are no longer register, or if they are registered the driver will not be removed from underneath us. This has been broken forever. The EEH call backs were first introduced in 2005 (in 77bd7415610) but it's not clear if a lock was needed back then. Fixes: 77bd74156101 ("[PATCH] powerpc: PCI Error Recovery: PPC64 core recovery routines") Cc: stable(a)vger.kernel.org # v4.9, v4.14 Signed-off-by: Michael Neuling <mikey(a)neuling.org> Reviewed-by: Benjamin Herrenschmidt <benh(a)kernel.crashing.org> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> --- Greg, this is a backport since the upstream patch didn't apply to v4.9 and v4.14. mikey --- arch/powerpc/kernel/eeh_driver.c | 65 ++++++++++++++++++++++++++-------------- 1 file changed, 42 insertions(+), 23 deletions(-) diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c index 8b840191df..0a88e6b595 100644 --- a/arch/powerpc/kernel/eeh_driver.c +++ b/arch/powerpc/kernel/eeh_driver.c @@ -207,18 +207,18 @@ static void *eeh_report_error(void *data, void *userdata) if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe)) return NULL; + + device_lock(&dev->dev); dev->error_state = pci_channel_io_frozen; driver = eeh_pcid_get(dev); - if (!driver) return NULL; + if (!driver) goto out_no_dev; eeh_disable_irq(dev); if (!driver->err_handler || - !driver->err_handler->error_detected) { - eeh_pcid_put(dev); - return NULL; - } + !driver->err_handler->error_detected) + goto out; rc = driver->err_handler->error_detected(dev, pci_channel_io_frozen); @@ -227,7 +227,10 @@ static void *eeh_report_error(void *data, void *userdata) if (*res == PCI_ERS_RESULT_NONE) *res = rc; edev->in_error = true; +out: eeh_pcid_put(dev); +out_no_dev: + device_unlock(&dev->dev); return NULL; } @@ -250,15 +253,14 @@ static void *eeh_report_mmio_enabled(void *data, void *userdata) if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe)) return NULL; + device_lock(&dev->dev); driver = eeh_pcid_get(dev); - if (!driver) return NULL; + if (!driver) goto out_no_dev; if (!driver->err_handler || !driver->err_handler->mmio_enabled || - (edev->mode & EEH_DEV_NO_HANDLER)) { - eeh_pcid_put(dev); - return NULL; - } + (edev->mode & EEH_DEV_NO_HANDLER)) + goto out; rc = driver->err_handler->mmio_enabled(dev); @@ -266,7 +268,10 @@ static void *eeh_report_mmio_enabled(void *data, void *userdata) if (rc == PCI_ERS_RESULT_NEED_RESET) *res = rc; if (*res == PCI_ERS_RESULT_NONE) *res = rc; +out: eeh_pcid_put(dev); +out_no_dev: + device_unlock(&dev->dev); return NULL; } @@ -289,20 +294,20 @@ static void *eeh_report_reset(void *data, void *userdata) if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe)) return NULL; + + device_lock(&dev->dev); dev->error_state = pci_channel_io_normal; driver = eeh_pcid_get(dev); - if (!driver) return NULL; + if (!driver) goto out_no_dev; eeh_enable_irq(dev); if (!driver->err_handler || !driver->err_handler->slot_reset || (edev->mode & EEH_DEV_NO_HANDLER) || - (!edev->in_error)) { - eeh_pcid_put(dev); - return NULL; - } + (!edev->in_error)) + goto out; rc = driver->err_handler->slot_reset(dev); if ((*res == PCI_ERS_RESULT_NONE) || @@ -310,7 +315,10 @@ static void *eeh_report_reset(void *data, void *userdata) if (*res == PCI_ERS_RESULT_DISCONNECT && rc == PCI_ERS_RESULT_NEED_RESET) *res = rc; +out: eeh_pcid_put(dev); +out_no_dev: + device_unlock(&dev->dev); return NULL; } @@ -361,10 +369,12 @@ static void *eeh_report_resume(void *data, void *userdata) if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe)) return NULL; + + device_lock(&dev->dev); dev->error_state = pci_channel_io_normal; driver = eeh_pcid_get(dev); - if (!driver) return NULL; + if (!driver) goto out_no_dev; was_in_error = edev->in_error; edev->in_error = false; @@ -374,13 +384,19 @@ static void *eeh_report_resume(void *data, void *userdata) !driver->err_handler->resume || (edev->mode & EEH_DEV_NO_HANDLER) || !was_in_error) { edev->mode &= ~EEH_DEV_NO_HANDLER; - eeh_pcid_put(dev); - return NULL; + goto out; } driver->err_handler->resume(dev); +out: eeh_pcid_put(dev); +#ifdef CONFIG_PCI_IOV + if (eeh_ops->notify_resume && eeh_dev_to_pdn(edev)) + eeh_ops->notify_resume(eeh_dev_to_pdn(edev)); +#endif +out_no_dev: + device_unlock(&dev->dev); return NULL; } @@ -400,22 +416,25 @@ static void *eeh_report_failure(void *data, void *userdata) if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe)) return NULL; + + device_lock(&dev->dev); dev->error_state = pci_channel_io_perm_failure; driver = eeh_pcid_get(dev); - if (!driver) return NULL; + if (!driver) goto out_no_dev; eeh_disable_irq(dev); if (!driver->err_handler || - !driver->err_handler->error_detected) { - eeh_pcid_put(dev); - return NULL; - } + !driver->err_handler->error_detected) + goto out; driver->err_handler->error_detected(dev, pci_channel_io_perm_failure); +out: eeh_pcid_put(dev); +out_no_dev: + device_unlock(&dev->dev); return NULL; } -- 2.14.1

7 years, 8 months

2
4
0 0

[PATCH] tty: serdev: fix missing static modifier on DEVICE_ATTR_RO(modalias)

by David Lechner

This fixes the compile error "multiple definition of `dev_attr_modalias'" by adding the static modifier to DEVICE_ATTR_RO(modalias). This change was made in the mainline kernel in 2460942f51f1 ("serdev: do not generate modaliases for controllers") along with some other changes. Fixes: 4fe99816a1ab ("tty: serdev: use dev_groups and not dev_attrs for bus_type") Cc: Hans de Goede <hdegoede(a)redhat.com> Cc: Johan Hovold <johan(a)kernel.org> Cc: Sebastian Reichel <sebastian.reichel(a)collabora.co.uk> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: <stable(a)vger.kernel.org> # 4.14.x Signed-off-by: David Lechner <david(a)lechnology.com> --- Should we pick up the patch 2460942f51f1 ("serdev: do not generate modaliases for controllers") for stable or is this patch good enough? drivers/tty/serdev/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/serdev/core.c b/drivers/tty/serdev/core.c index 97db76afced2..25298b7b2419 100644 --- a/drivers/tty/serdev/core.c +++ b/drivers/tty/serdev/core.c @@ -276,7 +276,7 @@ static ssize_t modalias_show(struct device *dev, { return of_device_modalias(dev, buf, PAGE_SIZE); } -DEVICE_ATTR_RO(modalias); +static DEVICE_ATTR_RO(modalias); static struct attribute *serdev_device_attrs[] = { &dev_attr_modalias.attr, -- 2.17.0

7 years, 8 months

2
3
0 0

[PATCH v3 0/7] kprobes: Fix %p in kprobes

by Masami Hiramatsu

Hi, This 3rd version of the series which fixes %p uses in kprobes. Some by replacing with %pS, some by replacing with %px but masking with kallsyms_show_value(). I've read the thread about %pK and if I understand correctly we shouldn't print kernel addresses. However, kprobes debugfs interface can not stop to show the actual probe address because it should be compared with addresses in kallsyms for debugging. So, it depends on that kallsyms_show_value() allows to show address to user, because if it returns true, anyway that user can dump /proc/kallsyms. Other error messages are replaced it with %pS or just removed. This series also including some fixes for arch ports too. Changes in this version; - [2/7]: Updated for the latest linus tree. - [4/7][5/7]: Do not use %px. Thank you, --- Masami Hiramatsu (7): kprobes: Make blacklist root user read only kprobes: Show blacklist addresses as same as kallsyms does kprobes: Show address of kprobes if kallsyms does kprobes: Replace %p with other pointer types kprobes/x86: Fix %p uses in error messages kprobes/arm: Fix %p uses in error messages kprobes/arm64: Fix %p uses in error messages arch/arm/probes/kprobes/core.c | 10 ++++--- arch/arm/probes/kprobes/test-core.c | 1 - arch/arm64/kernel/probes/kprobes.c | 4 +-- arch/x86/kernel/kprobes/core.c | 12 +++------ kernel/kprobes.c | 48 ++++++++++++++++++++++------------- 5 files changed, 41 insertions(+), 34 deletions(-) -- Masami Hiramatsu (Linaro) <mhiramat(a)kernel.org>

7 years, 8 months

3
18
0 0

[PATCH V3 09/10] MIPS: Loongson-3: Fix CPU UART irq delivery problem

by Huacai Chen

Masking/unmasking the CPU UART irq in CP0_Status (and redirecting it to other CPUs) may cause interrupts be lost, especially in multi-package machines (Package-0's UART irq cannot be delivered to others). So make mask_loongson_irq() and unmask_loongson_irq() be no-ops. The original problem (UART IRQ may deliver to any core) is also because of masking/unmasking the CPU UART irq in CP0_Status. So it is safe to remove all of the stuff. Cc: stable(a)vger.kernel.org Signed-off-by: Huacai Chen <chenhc(a)lemote.com> --- arch/mips/loongson64/loongson-3/irq.c | 41 ++--------------------------------- 1 file changed, 2 insertions(+), 39 deletions(-) diff --git a/arch/mips/loongson64/loongson-3/irq.c b/arch/mips/loongson64/loongson-3/irq.c index cbeb20f..e8381ec 100644 --- a/arch/mips/loongson64/loongson-3/irq.c +++ b/arch/mips/loongson64/loongson-3/irq.c @@ -102,45 +102,8 @@ static struct irqaction cascade_irqaction = { .name = "cascade", }; -static inline void mask_loongson_irq(struct irq_data *d) -{ - clear_c0_status(0x100 << (d->irq - MIPS_CPU_IRQ_BASE)); - irq_disable_hazard(); - - /* Workaround: UART IRQ may deliver to any core */ - if (d->irq == LOONGSON_UART_IRQ) { - int cpu = smp_processor_id(); - int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node; - int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node; - u64 intenclr_addr = smp_group[node_id] | - (u64)(&LOONGSON_INT_ROUTER_INTENCLR); - u64 introuter_lpc_addr = smp_group[node_id] | - (u64)(&LOONGSON_INT_ROUTER_LPC); - - *(volatile u32 *)intenclr_addr = 1 << 10; - *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<<core_id); - } -} - -static inline void unmask_loongson_irq(struct irq_data *d) -{ - /* Workaround: UART IRQ may deliver to any core */ - if (d->irq == LOONGSON_UART_IRQ) { - int cpu = smp_processor_id(); - int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node; - int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node; - u64 intenset_addr = smp_group[node_id] | - (u64)(&LOONGSON_INT_ROUTER_INTENSET); - u64 introuter_lpc_addr = smp_group[node_id] | - (u64)(&LOONGSON_INT_ROUTER_LPC); - - *(volatile u32 *)intenset_addr = 1 << 10; - *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<<core_id); - } - - set_c0_status(0x100 << (d->irq - MIPS_CPU_IRQ_BASE)); - irq_enable_hazard(); -} +static inline void mask_loongson_irq(struct irq_data *d) { } +static inline void unmask_loongson_irq(struct irq_data *d) { } /* For MIPS IRQs which shared by all cores */ static struct irq_chip loongson_irq_chip = { -- 2.7.0

7 years, 8 months

1
0
0 0

[PATCH V3 07/10] MIPS: Align kernel load address to 64KB

by Huacai Chen

KEXEC needs the new kernel's load address to be aligned on a page boundary (see sanity_check_segment_list()), but on MIPS the default vmlinuz load address is only explicitly aligned to 16 bytes. Since the largest PAGE_SIZE supported by MIPS kernels is 64KB, increase the alignment calculated by calc_vmlinuz_load_addr to 64KB. Cc: <stable(a)vger.kernel.org> # 2.6.36+ Signed-off-by: Huacai Chen <chenhc(a)lemote.com> --- arch/mips/boot/compressed/calc_vmlinuz_load_addr.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c index 37fe58c..542c3ed 100644 --- a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c +++ b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c @@ -13,6 +13,7 @@ #include <stdint.h> #include <stdio.h> #include <stdlib.h> +#include "../../../../include/linux/sizes.h" int main(int argc, char *argv[]) { @@ -45,11 +46,11 @@ int main(int argc, char *argv[]) vmlinuz_load_addr = vmlinux_load_addr + vmlinux_size; /* - * Align with 16 bytes: "greater than that used for any standard data - * types by a MIPS compiler." -- See MIPS Run Linux (Second Edition). + * Align with 64KB: KEXEC needs load sections to be aligned to PAGE_SIZE, + * which may be as large as 64KB depending on the kernel configuration. */ - vmlinuz_load_addr += (16 - vmlinux_size % 16); + vmlinuz_load_addr += (SZ_64K - vmlinux_size % SZ_64K); printf("0x%llx\n", vmlinuz_load_addr); -- 2.7.0

7 years, 8 months

1
0
0 0

[PATCH V3 05/10] MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()

by Huacai Chen

This patch is borrowed from ARM64 to ensure pmd_present() returns false after pmd_mknotpresent(). This is needed for THP. Cc: <stable(a)vger.kernel.org> # 3.8+ References: 5bb1cc0ff9a6 ("arm64: Ensure pmd_present() returns false after pmd_mknotpresent()") Reviewed-by: James Hogan <jhogan(a)kernel.org> Signed-off-by: Huacai Chen <chenhc(a)lemote.com> --- arch/mips/include/asm/pgtable-64.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/mips/include/asm/pgtable-64.h b/arch/mips/include/asm/pgtable-64.h index 0036ea0..93a9dce 100644 --- a/arch/mips/include/asm/pgtable-64.h +++ b/arch/mips/include/asm/pgtable-64.h @@ -265,6 +265,11 @@ static inline int pmd_bad(pmd_t pmd) static inline int pmd_present(pmd_t pmd) { +#ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT + if (unlikely(pmd_val(pmd) & _PAGE_HUGE)) + return pmd_val(pmd) & _PAGE_PRESENT; +#endif + return pmd_val(pmd) != (unsigned long) invalid_pte_table; } -- 2.7.0

7 years, 8 months

1
0
0 0

[PATCH V3 04/10] MIPS: c-r4k: Add r4k_blast_scache_node for Loongson-3

by Huacai Chen

For multi-node Loongson-3 (NUMA configuration), r4k_blast_scache() can only flush Node-0's scache. So we add r4k_blast_scache_node() by using (CAC_BASE | (node_id << NODE_ADDRSPACE_SHIFT)) instead of CKSEG0 as the start address. Cc: <stable(a)vger.kernel.org> # 3.15+ Signed-off-by: Huacai Chen <chenhc(a)lemote.com> --- arch/mips/include/asm/mach-loongson64/mmzone.h | 1 + arch/mips/include/asm/mmzone.h | 8 +++++ arch/mips/include/asm/r4kcache.h | 25 +++++++++++++++ arch/mips/mm/c-r4k.c | 44 ++++++++++++++++++++++---- 4 files changed, 71 insertions(+), 7 deletions(-) diff --git a/arch/mips/include/asm/mach-loongson64/mmzone.h b/arch/mips/include/asm/mach-loongson64/mmzone.h index c9f7e23..59c8b11 100644 --- a/arch/mips/include/asm/mach-loongson64/mmzone.h +++ b/arch/mips/include/asm/mach-loongson64/mmzone.h @@ -21,6 +21,7 @@ #define NODE3_ADDRSPACE_OFFSET 0x300000000000UL #define pa_to_nid(addr) (((addr) & 0xf00000000000) >> NODE_ADDRSPACE_SHIFT) +#define nid_to_addrbase(nid) ((nid) << NODE_ADDRSPACE_SHIFT) #define LEVELS_PER_SLICE 128 diff --git a/arch/mips/include/asm/mmzone.h b/arch/mips/include/asm/mmzone.h index f085fba..2a0fe1d 100644 --- a/arch/mips/include/asm/mmzone.h +++ b/arch/mips/include/asm/mmzone.h @@ -9,6 +9,14 @@ #include <asm/page.h> #include <mmzone.h> +#ifndef pa_to_nid +#define pa_to_nid(addr) 0 +#endif + +#ifndef nid_to_addrbase +#define nid_to_addrbase(nid) 0 +#endif + #ifdef CONFIG_DISCONTIGMEM #define pfn_to_nid(pfn) pa_to_nid((pfn) << PAGE_SHIFT) diff --git a/arch/mips/include/asm/r4kcache.h b/arch/mips/include/asm/r4kcache.h index 7f12d7e..e3f70dc 100644 --- a/arch/mips/include/asm/r4kcache.h +++ b/arch/mips/include/asm/r4kcache.h @@ -747,4 +747,29 @@ __BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, , ) __BUILD_BLAST_CACHE_RANGE(inv_d, dcache, Hit_Invalidate_D, , ) __BUILD_BLAST_CACHE_RANGE(inv_s, scache, Hit_Invalidate_SD, , ) +/* Currently, this is very specific to Loongson-3 */ +#define __BUILD_BLAST_CACHE_NODE(pfx, desc, indexop, hitop, lsize) \ +static inline void blast_##pfx##cache##lsize##_node(long node) \ +{ \ + unsigned long start = CAC_BASE | nid_to_addrbase(node); \ + unsigned long end = start + current_cpu_data.desc.waysize; \ + unsigned long ws_inc = 1UL << current_cpu_data.desc.waybit; \ + unsigned long ws_end = current_cpu_data.desc.ways << \ + current_cpu_data.desc.waybit; \ + unsigned long ws, addr; \ + \ + __##pfx##flush_prologue \ + \ + for (ws = 0; ws < ws_end; ws += ws_inc) \ + for (addr = start; addr < end; addr += lsize * 32) \ + cache##lsize##_unroll32(addr|ws, indexop); \ + \ + __##pfx##flush_epilogue \ +} + +__BUILD_BLAST_CACHE_NODE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 16) +__BUILD_BLAST_CACHE_NODE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 32) +__BUILD_BLAST_CACHE_NODE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 64) +__BUILD_BLAST_CACHE_NODE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 128) + #endif /* _ASM_R4KCACHE_H */ diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c index 6f534b20..2f5abc2 100644 --- a/arch/mips/mm/c-r4k.c +++ b/arch/mips/mm/c-r4k.c @@ -459,11 +459,28 @@ static void r4k_blast_scache_setup(void) r4k_blast_scache = blast_scache128; } +static void (*r4k_blast_scache_node)(long node); + +static void r4k_blast_scache_node_setup(void) +{ + unsigned long sc_lsize = cpu_scache_line_size(); + + if (current_cpu_type() != CPU_LOONGSON3) + r4k_blast_scache_node = (void *)cache_noop; + else if (sc_lsize == 16) + r4k_blast_scache_node = blast_scache16_node; + else if (sc_lsize == 32) + r4k_blast_scache_node = blast_scache32_node; + else if (sc_lsize == 64) + r4k_blast_scache_node = blast_scache64_node; + else if (sc_lsize == 128) + r4k_blast_scache_node = blast_scache128_node; +} + static inline void local_r4k___flush_cache_all(void * args) { switch (current_cpu_type()) { case CPU_LOONGSON2: - case CPU_LOONGSON3: case CPU_R4000SC: case CPU_R4000MC: case CPU_R4400SC: @@ -480,6 +497,11 @@ static inline void local_r4k___flush_cache_all(void * args) r4k_blast_scache(); break; + case CPU_LOONGSON3: + /* Use get_ebase_cpunum() for both NUMA=y/n */ + r4k_blast_scache_node(get_ebase_cpunum() >> 2); + break; + case CPU_BMIPS5000: r4k_blast_scache(); __sync(); @@ -839,10 +861,14 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size) preempt_disable(); if (cpu_has_inclusive_pcaches) { - if (size >= scache_size) - r4k_blast_scache(); - else + if (size >= scache_size) { + if (current_cpu_type() != CPU_LOONGSON3) + r4k_blast_scache(); + else + r4k_blast_scache_node(pa_to_nid(addr)); + } else { blast_scache_range(addr, addr + size); + } preempt_enable(); __sync(); return; @@ -872,9 +898,12 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size) preempt_disable(); if (cpu_has_inclusive_pcaches) { - if (size >= scache_size) - r4k_blast_scache(); - else { + if (size >= scache_size) { + if (current_cpu_type() != CPU_LOONGSON3) + r4k_blast_scache(); + else + r4k_blast_scache_node(pa_to_nid(addr)); + } else { /* * There is no clearly documented alignment requirement * for the cache instruction on MIPS processors and @@ -1905,6 +1934,7 @@ void r4k_cache_init(void) r4k_blast_scache_page_setup(); r4k_blast_scache_page_indexed_setup(); r4k_blast_scache_setup(); + r4k_blast_scache_node_setup(); #ifdef CONFIG_EVA r4k_blast_dcache_user_page_setup(); r4k_blast_icache_user_page_setup(); -- 2.7.0

7 years, 8 months

1
0
0 0

Re: [PATCH] arm64: export tishift functions to modules

by Jason A. Donenfeld

On Tue, Apr 24, 2018 at 3:34 PM, Will Deacon <will.deacon(a)arm.com> wrote: > I've not run into any build issues here -- is this specifically with some > out-of-tree module? I received a bug report email about this. I'm not sure which specific module, and I assumed from the email that it was actually a result of in-tree configuration options rather than an out-of-tree module, but I'm not sure exactly. Either way, I was able to reproduce the problem by coding up a little PoC out-of-tree module, so it is certainly a real problem. > It would be better not to introduce a new header file just for this, I > think. How about compiler.h instead? I could, but actually after I wrote this email I noticed that this is a widespread convention: zx2c4@thinkpad ~/Projects/linux $ subfind asm-prototypes ./arch/s390/include/asm/asm-prototypes.h ./arch/alpha/include/asm/asm-prototypes.h ./arch/powerpc/include/asm/asm-prototypes.h ./arch/m68k/include/asm/asm-prototypes.h ./arch/mips/include/asm/asm-prototypes.h ./arch/x86/include/asm/asm-prototypes.h ./arch/sparc/include/asm/asm-prototypes.h ./arch/ia64/include/asm/asm-prototypes.h ./arch/um/include/asm/asm-prototypes.h ./include/asm-generic/asm-prototypes.h > > We normally export asm symbols via arm64ksyms.c. In fact, would doing that > remove the need for the explicit declarations completely? I'm pretty sure it still needs the declaration; otherwise the module hashing will get confused. Also, the EXPORT_SYMBOL macro is a different one when called from assembly versus from C, though not sure that makes a substantive difference. It seems like this is what other architectures are doing: zx2c4@thinkpad ~/Projects/linux $ rg 'EXPORT_SYMBOL.*__.*[std]i[0-9]' -g '*.S' arch/m68k/lib/modsi3.S 111: EXPORT_SYMBOL(__modsi3) arch/m68k/lib/umodsi3.S 108: EXPORT_SYMBOL(__umodsi3) arch/m68k/lib/udivsi3.S 157: EXPORT_SYMBOL(__udivsi3) arch/m68k/lib/divsi3.S 123: EXPORT_SYMBOL(__divsi3) arch/m68k/lib/mulsi3.S 105: EXPORT_SYMBOL(__mulsi3) arch/powerpc/kernel/misc_32.S 529:EXPORT_SYMBOL(__ashrdi3) 541:EXPORT_SYMBOL(__ashldi3) 553:EXPORT_SYMBOL(__lshrdi3) 569:EXPORT_SYMBOL(__cmpdi2) 584:EXPORT_SYMBOL(__ucmpdi2) 596:EXPORT_SYMBOL(__bswapdi2) arch/powerpc/kernel/misc_64.S 211:EXPORT_SYMBOL(__bswapdi2) arch/sparc/lib/lshrdi3.S 30:EXPORT_SYMBOL(__lshrdi3) arch/sparc/lib/muldi3.S 78:EXPORT_SYMBOL(__muldi3) arch/sparc/lib/divdi3.S 283:EXPORT_SYMBOL(__divdi3) arch/sparc/lib/ashrdi3.S 40:EXPORT_SYMBOL(__ashrdi3) arch/sparc/lib/multi3.S 36:EXPORT_SYMBOL(__multi3) arch/sparc/lib/ashldi3.S 38:EXPORT_SYMBOL(__ashldi3)

7 years, 8 months

2
4
0 0

[merged] fix-null-pointer-in-page_cache_tree_insert.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm/filemap.c: fix NULL pointer in page_cache_tree_insert() has been removed from the -mm tree. Its filename was fix-null-pointer-in-page_cache_tree_insert.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Matthew Wilcox <mawilcox(a)microsoft.com> Subject: mm/filemap.c: fix NULL pointer in page_cache_tree_insert() f2fs specifies the __GFP_ZERO flag for allocating some of its pages. Unfortunately, the page cache also uses the mapping's GFP flags for allocating radix tree nodes. It always masked off the __GFP_HIGHMEM flag, and masks off __GFP_ZERO in some paths, but not all. That causes radix tree nodes to be allocated with a NULL list_head, which causes backtraces like: [<ffffff80086f4de0>] __list_del_entry+0x30/0xd0 [<ffffff8008362018>] list_lru_del+0xac/0x1ac [<ffffff800830f04c>] page_cache_tree_insert+0xd8/0x110 The __GFP_DMA and __GFP_DMA32 flags would also be able to sneak through if they are ever used. Fix them all by using GFP_RECLAIM_MASK at the innermost location, and remove it from earlier in the callchain. Link: http://lkml.kernel.org/r/20180411060320.14458-2-willy@infradead.org Fixes: 449dd6984d0e ("mm: keep page cache radix tree nodes in check") Signed-off-by: Matthew Wilcox <mawilcox(a)microsoft.com> Reported-by: Chris Fries <cfries(a)google.com> Debugged-by: Minchan Kim <minchan(a)kernel.org> Acked-by: Johannes Weiner <hannes(a)cmpxchg.org> Acked-by: Michal Hocko <mhocko(a)suse.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/filemap.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff -puN mm/filemap.c~fix-null-pointer-in-page_cache_tree_insert mm/filemap.c --- a/mm/filemap.c~fix-null-pointer-in-page_cache_tree_insert +++ a/mm/filemap.c @@ -786,7 +786,7 @@ int replace_page_cache_page(struct page VM_BUG_ON_PAGE(!PageLocked(new), new); VM_BUG_ON_PAGE(new->mapping, new); - error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM); + error = radix_tree_preload(gfp_mask & GFP_RECLAIM_MASK); if (!error) { struct address_space *mapping = old->mapping; void (*freepage)(struct page *); @@ -842,7 +842,7 @@ static int __add_to_page_cache_locked(st return error; } - error = radix_tree_maybe_preload(gfp_mask & ~__GFP_HIGHMEM); + error = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK); if (error) { if (!huge) mem_cgroup_cancel_charge(page, memcg, false); @@ -1585,8 +1585,7 @@ no_page: if (fgp_flags & FGP_ACCESSED) __SetPageReferenced(page); - err = add_to_page_cache_lru(page, mapping, offset, - gfp_mask & GFP_RECLAIM_MASK); + err = add_to_page_cache_lru(page, mapping, offset, gfp_mask); if (unlikely(err)) { put_page(page); page = NULL; @@ -2387,7 +2386,7 @@ static int page_cache_read(struct file * if (!page) return -ENOMEM; - ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask & GFP_KERNEL); + ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask); if (ret == 0) ret = mapping->a_ops->readpage(file, page); else if (ret == -EEXIST) _ Patches currently in -mm which might be from mawilcox(a)microsoft.com are slab-__gfp_zero-is-incompatible-with-a-constructor.patch ida-remove-simple_ida_lock.patch

7 years, 8 months

1
0
0 0

[merged] autofs-mount-point-create-should-honour-passed-in-mode.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: autofs: mount point create should honour passed in mode has been removed from the -mm tree. Its filename was autofs-mount-point-create-should-honour-passed-in-mode.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Ian Kent <raven(a)themaw.net> Subject: autofs: mount point create should honour passed in mode The autofs file system mkdir inode operation blindly sets the created directory mode to S_IFDIR | 0555, ingoring the passed in mode, which can cause selinux dac_override denials. But the function also checks if the caller is the daemon (as no-one else should be able to do anything here) so there's no point in not honouring the passed in mode, allowing the daemon to set appropriate mode when required. Link: http://lkml.kernel.org/r/152361593601.8051.14014139124905996173.stgit@pluto… Signed-off-by: Ian Kent <raven(a)themaw.net> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/autofs4/root.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff -puN fs/autofs4/root.c~autofs-mount-point-create-should-honour-passed-in-mode fs/autofs4/root.c --- a/fs/autofs4/root.c~autofs-mount-point-create-should-honour-passed-in-mode +++ a/fs/autofs4/root.c @@ -749,7 +749,7 @@ static int autofs4_dir_mkdir(struct inod autofs4_del_active(dentry); - inode = autofs4_get_inode(dir->i_sb, S_IFDIR | 0555); + inode = autofs4_get_inode(dir->i_sb, S_IFDIR | mode); if (!inode) return -ENOMEM; d_add(dentry, inode); _ Patches currently in -mm which might be from raven(a)themaw.net are

7 years, 8 months

1
0
0 0

[merged] rapidio-fix-rio_dma_transfer-error-handling.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: rapidio: fix rio_dma_transfer error handling has been removed from the -mm tree. Its filename was rapidio-fix-rio_dma_transfer-error-handling.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Ioan Nicu <ioan.nicu.ext(a)nokia.com> Subject: rapidio: fix rio_dma_transfer error handling Some of the mport_dma_req structure members were initialized late inside the do_dma_request() function, just before submitting the request to the dma engine. But we have some error branches before that. In case of such an error, the code would return on the error path and trigger the calling of dma_req_free() with a req structure which is not completely initialized. This causes a NULL pointer dereference in dma_req_free(). This patch fixes these error branches by making sure that all necessary mport_dma_req structure members are initialized in rio_dma_transfer() immediately after the request structure gets allocated. Link: http://lkml.kernel.org/r/20180412150605.GA31409@nokia.com Fixes: bbd876adb8c72 ("rapidio: use a reference count for struct mport_dma_req") Signed-off-by: Ioan Nicu <ioan.nicu.ext(a)nokia.com> Tested-by: Alexander Sverdlin <alexander.sverdlin(a)nokia.com> Acked-by: Alexandre Bounine <alex.bou9(a)gmail.com> Cc: Barry Wood <barry.wood(a)idt.com> Cc: Matt Porter <mporter(a)kernel.crashing.org> Cc: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Cc: Logan Gunthorpe <logang(a)deltatee.com> Cc: Chris Wilson <chris(a)chris-wilson.co.uk> Cc: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com> Cc: Frank Kunz <frank.kunz(a)nokia.com> Cc: <stable(a)vger.kernel.org> [4.6+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- drivers/rapidio/devices/rio_mport_cdev.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff -puN drivers/rapidio/devices/rio_mport_cdev.c~rapidio-fix-rio_dma_transfer-error-handling drivers/rapidio/devices/rio_mport_cdev.c --- a/drivers/rapidio/devices/rio_mport_cdev.c~rapidio-fix-rio_dma_transfer-error-handling +++ a/drivers/rapidio/devices/rio_mport_cdev.c @@ -740,10 +740,7 @@ static int do_dma_request(struct mport_d tx->callback = dma_xfer_callback; tx->callback_param = req; - req->dmach = chan; - req->sync = sync; req->status = DMA_IN_PROGRESS; - init_completion(&req->req_comp); kref_get(&req->refcount); cookie = dmaengine_submit(tx); @@ -831,13 +828,20 @@ rio_dma_transfer(struct file *filp, u32 if (!req) return -ENOMEM; - kref_init(&req->refcount); - ret = get_dma_channel(priv); if (ret) { kfree(req); return ret; } + chan = priv->dmach; + + kref_init(&req->refcount); + init_completion(&req->req_comp); + req->dir = dir; + req->filp = filp; + req->priv = priv; + req->dmach = chan; + req->sync = sync; /* * If parameter loc_addr != NULL, we are transferring data from/to @@ -925,11 +929,6 @@ rio_dma_transfer(struct file *filp, u32 xfer->offset, xfer->length); } - req->dir = dir; - req->filp = filp; - req->priv = priv; - chan = priv->dmach; - nents = dma_map_sg(chan->device->dev, req->sgt.sgl, req->sgt.nents, dir); if (nents == 0) { _ Patches currently in -mm which might be from ioan.nicu.ext(a)nokia.com are

7 years, 8 months

1
0
0 0

[merged] writeback-safer-lock-nesting.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: writeback: safer lock nesting has been removed from the -mm tree. Its filename was writeback-safer-lock-nesting.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Greg Thelen <gthelen(a)google.com> Subject: writeback: safer lock nesting lock_page_memcg()/unlock_page_memcg() use spin_lock_irqsave/restore() if the page's memcg is undergoing move accounting, which occurs when a process leaves its memcg for a new one that has memory.move_charge_at_immigrate set. unlocked_inode_to_wb_begin,end() use spin_lock_irq/spin_unlock_irq() if the given inode is switching writeback domains. Switches occur when enough writes are issued from a new domain. This existing pattern is thus suspicious: lock_page_memcg(page); unlocked_inode_to_wb_begin(inode, &locked); ... unlocked_inode_to_wb_end(inode, locked); unlock_page_memcg(page); If both inode switch and process memcg migration are both in-flight then unlocked_inode_to_wb_end() will unconditionally enable interrupts while still holding the lock_page_memcg() irq spinlock. This suggests the possibility of deadlock if an interrupt occurs before unlock_page_memcg(). truncate __cancel_dirty_page lock_page_memcg unlocked_inode_to_wb_begin unlocked_inode_to_wb_end <interrupts mistakenly enabled> <interrupt> end_page_writeback test_clear_page_writeback lock_page_memcg <deadlock> unlock_page_memcg Due to configuration limitations this deadlock is not currently possible because we don't mix cgroup writeback (a cgroupv2 feature) and memory.move_charge_at_immigrate (a cgroupv1 feature). If the kernel is hacked to always claim inode switching and memcg moving_account, then this script triggers lockup in less than a minute: cd /mnt/cgroup/memory mkdir a b echo 1 > a/memory.move_charge_at_immigrate echo 1 > b/memory.move_charge_at_immigrate ( echo $BASHPID > a/cgroup.procs while true; do dd if=/dev/zero of=/mnt/big bs=1M count=256 done ) & while true; do sync done & sleep 1h & SLEEP=$! while true; do echo $SLEEP > a/cgroup.procs echo $SLEEP > b/cgroup.procs done The deadlock does not seem possible, so it's debatable if there's any reason to modify the kernel. I suggest we should to prevent future surprises. And Wang Long said "this deadlock occurs three times in our environment", so there's more reason to apply this, even to stable. Stable 4.4 has minor conflicts applying this patch. For a clean 4.4 patch see "[PATCH for-4.4] writeback: safer lock nesting" https://lkml.org/lkml/2018/4/11/146 Wang Long said "this deadlock occurs three times in our environment" [gthelen(a)google.com: v4] Link: http://lkml.kernel.org/r/20180411084653.254724-1-gthelen@google.com [akpm(a)linux-foundation.org: comment tweaks, struct initialization simplification] Change-Id: Ibb773e8045852978f6207074491d262f1b3fb613 Link: http://lkml.kernel.org/r/20180410005908.167976-1-gthelen@google.com Fixes: 682aa8e1a6a1 ("writeback: implement unlocked_inode_to_wb transaction and use it for stat updates") Signed-off-by: Greg Thelen <gthelen(a)google.com> Reported-by: Wang Long <wanglong19(a)meituan.com> Acked-by: Wang Long <wanglong19(a)meituan.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Tejun Heo <tj(a)kernel.org> Cc: Nicholas Piggin <npiggin(a)gmail.com> Cc: <stable(a)vger.kernel.org> [v4.2+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/fs-writeback.c | 7 +++--- include/linux/backing-dev-defs.h | 5 ++++ include/linux/backing-dev.h | 30 +++++++++++++++-------------- mm/page-writeback.c | 18 ++++++++--------- 4 files changed, 34 insertions(+), 26 deletions(-) diff -puN fs/fs-writeback.c~writeback-safer-lock-nesting fs/fs-writeback.c --- a/fs/fs-writeback.c~writeback-safer-lock-nesting +++ a/fs/fs-writeback.c @@ -745,11 +745,12 @@ int inode_congested(struct inode *inode, */ if (inode && inode_to_wb_is_valid(inode)) { struct bdi_writeback *wb; - bool locked, congested; + struct wb_lock_cookie lock_cookie = {}; + bool congested; - wb = unlocked_inode_to_wb_begin(inode, &locked); + wb = unlocked_inode_to_wb_begin(inode, &lock_cookie); congested = wb_congested(wb, cong_bits); - unlocked_inode_to_wb_end(inode, locked); + unlocked_inode_to_wb_end(inode, &lock_cookie); return congested; } diff -puN include/linux/backing-dev-defs.h~writeback-safer-lock-nesting include/linux/backing-dev-defs.h --- a/include/linux/backing-dev-defs.h~writeback-safer-lock-nesting +++ a/include/linux/backing-dev-defs.h @@ -223,6 +223,11 @@ static inline void set_bdi_congested(str set_wb_congested(bdi->wb.congested, sync); } +struct wb_lock_cookie { + bool locked; + unsigned long flags; +}; + #ifdef CONFIG_CGROUP_WRITEBACK /** diff -puN include/linux/backing-dev.h~writeback-safer-lock-nesting include/linux/backing-dev.h --- a/include/linux/backing-dev.h~writeback-safer-lock-nesting +++ a/include/linux/backing-dev.h @@ -347,7 +347,7 @@ static inline struct bdi_writeback *inod /** * unlocked_inode_to_wb_begin - begin unlocked inode wb access transaction * @inode: target inode - * @lockedp: temp bool output param, to be passed to the end function + * @cookie: output param, to be passed to the end function * * The caller wants to access the wb associated with @inode but isn't * holding inode->i_lock, the i_pages lock or wb->list_lock. This @@ -355,12 +355,12 @@ static inline struct bdi_writeback *inod * association doesn't change until the transaction is finished with * unlocked_inode_to_wb_end(). * - * The caller must call unlocked_inode_to_wb_end() with *@lockdep - * afterwards and can't sleep during transaction. IRQ may or may not be - * disabled on return. + * The caller must call unlocked_inode_to_wb_end() with *@cookie afterwards and + * can't sleep during the transaction. IRQs may or may not be disabled on + * return. */ static inline struct bdi_writeback * -unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp) +unlocked_inode_to_wb_begin(struct inode *inode, struct wb_lock_cookie *cookie) { rcu_read_lock(); @@ -368,10 +368,10 @@ unlocked_inode_to_wb_begin(struct inode * Paired with store_release in inode_switch_wb_work_fn() and * ensures that we see the new wb if we see cleared I_WB_SWITCH. */ - *lockedp = smp_load_acquire(&inode->i_state) & I_WB_SWITCH; + cookie->locked = smp_load_acquire(&inode->i_state) & I_WB_SWITCH; - if (unlikely(*lockedp)) - xa_lock_irq(&inode->i_mapping->i_pages); + if (unlikely(cookie->locked)) + xa_lock_irqsave(&inode->i_mapping->i_pages, cookie->flags); /* * Protected by either !I_WB_SWITCH + rcu_read_lock() or the i_pages @@ -383,12 +383,13 @@ unlocked_inode_to_wb_begin(struct inode /** * unlocked_inode_to_wb_end - end inode wb access transaction * @inode: target inode - * @locked: *@lockedp from unlocked_inode_to_wb_begin() + * @cookie: @cookie from unlocked_inode_to_wb_begin() */ -static inline void unlocked_inode_to_wb_end(struct inode *inode, bool locked) +static inline void unlocked_inode_to_wb_end(struct inode *inode, + struct wb_lock_cookie *cookie) { - if (unlikely(locked)) - xa_unlock_irq(&inode->i_mapping->i_pages); + if (unlikely(cookie->locked)) + xa_unlock_irqrestore(&inode->i_mapping->i_pages, cookie->flags); rcu_read_unlock(); } @@ -435,12 +436,13 @@ static inline struct bdi_writeback *inod } static inline struct bdi_writeback * -unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp) +unlocked_inode_to_wb_begin(struct inode *inode, struct wb_lock_cookie *cookie) { return inode_to_wb(inode); } -static inline void unlocked_inode_to_wb_end(struct inode *inode, bool locked) +static inline void unlocked_inode_to_wb_end(struct inode *inode, + struct wb_lock_cookie *cookie) { } diff -puN mm/page-writeback.c~writeback-safer-lock-nesting mm/page-writeback.c --- a/mm/page-writeback.c~writeback-safer-lock-nesting +++ a/mm/page-writeback.c @@ -2502,13 +2502,13 @@ void account_page_redirty(struct page *p if (mapping && mapping_cap_account_dirty(mapping)) { struct inode *inode = mapping->host; struct bdi_writeback *wb; - bool locked; + struct wb_lock_cookie cookie = {}; - wb = unlocked_inode_to_wb_begin(inode, &locked); + wb = unlocked_inode_to_wb_begin(inode, &cookie); current->nr_dirtied--; dec_node_page_state(page, NR_DIRTIED); dec_wb_stat(wb, WB_DIRTIED); - unlocked_inode_to_wb_end(inode, locked); + unlocked_inode_to_wb_end(inode, &cookie); } } EXPORT_SYMBOL(account_page_redirty); @@ -2614,15 +2614,15 @@ void __cancel_dirty_page(struct page *pa if (mapping_cap_account_dirty(mapping)) { struct inode *inode = mapping->host; struct bdi_writeback *wb; - bool locked; + struct wb_lock_cookie cookie = {}; lock_page_memcg(page); - wb = unlocked_inode_to_wb_begin(inode, &locked); + wb = unlocked_inode_to_wb_begin(inode, &cookie); if (TestClearPageDirty(page)) account_page_cleaned(page, mapping, wb); - unlocked_inode_to_wb_end(inode, locked); + unlocked_inode_to_wb_end(inode, &cookie); unlock_page_memcg(page); } else { ClearPageDirty(page); @@ -2654,7 +2654,7 @@ int clear_page_dirty_for_io(struct page if (mapping && mapping_cap_account_dirty(mapping)) { struct inode *inode = mapping->host; struct bdi_writeback *wb; - bool locked; + struct wb_lock_cookie cookie = {}; /* * Yes, Virginia, this is indeed insane. @@ -2691,14 +2691,14 @@ int clear_page_dirty_for_io(struct page * always locked coming in here, so we get the desired * exclusion. */ - wb = unlocked_inode_to_wb_begin(inode, &locked); + wb = unlocked_inode_to_wb_begin(inode, &cookie); if (TestClearPageDirty(page)) { dec_lruvec_page_state(page, NR_FILE_DIRTY); dec_zone_page_state(page, NR_ZONE_WRITE_PENDING); dec_wb_stat(wb, WB_RECLAIMABLE); ret = 1; } - unlocked_inode_to_wb_end(inode, locked); + unlocked_inode_to_wb_end(inode, &cookie); return ret; } return TestClearPageDirty(page); _ Patches currently in -mm which might be from gthelen(a)google.com are

7 years, 8 months

1
0
0 0

[PATCH] Revert "x86/mm: implement free pmd/pte page interfaces"

by Joerg Roedel

From: Joerg Roedel <jroedel(a)suse.de> This reverts commit 28ee90fe6048fa7b7ceaeb8831c0e4e454a4cf89. This commit is broken for x86, as it unmaps the PTE and PMD pages and immediatly frees them without doing a TLB flush. Further this lacks synchronization with other page-tables in the system when the PMD pages are not shared between mm_structs. On x86-32 with PAE and PTI patches on-top this patch triggers the BUG_ON in vmalloc_sync_one() because the kernel and the process page-table were not synchronized. Signed-off-by: Joerg Roedel <jroedel(a)suse.de> --- arch/x86/mm/pgtable.c | 28 ++-------------------------- 1 file changed, 2 insertions(+), 26 deletions(-) diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c index ae98d4c5e32a..fd02a537a80f 100644 --- a/arch/x86/mm/pgtable.c +++ b/arch/x86/mm/pgtable.c @@ -787,22 +787,7 @@ int pmd_clear_huge(pmd_t *pmd) */ int pud_free_pmd_page(pud_t *pud) { - pmd_t *pmd; - int i; - - if (pud_none(*pud)) - return 1; - - pmd = (pmd_t *)pud_page_vaddr(*pud); - - for (i = 0; i < PTRS_PER_PMD; i++) - if (!pmd_free_pte_page(&pmd[i])) - return 0; - - pud_clear(pud); - free_page((unsigned long)pmd); - - return 1; + return pud_none(*pud); } /** @@ -814,15 +799,6 @@ int pud_free_pmd_page(pud_t *pud) */ int pmd_free_pte_page(pmd_t *pmd) { - pte_t *pte; - - if (pmd_none(*pmd)) - return 1; - - pte = (pte_t *)pmd_page_vaddr(*pmd); - pmd_clear(pmd); - free_page((unsigned long)pte); - - return 1; + return pmd_none(*pmd); } #endif /* CONFIG_HAVE_ARCH_HUGE_VMAP */ -- 2.13.6

7 years, 8 months

5
5
0 0

[PATCH 4/9] x86, pkeys: override pkey when moving away from PROT_EXEC

by Dave Hansen

From: Dave Hansen <dave.hansen(a)linux.intel.com> I got a bug report that the following code (roughly) was causing a SIGSEGV: mprotect(ptr, size, PROT_EXEC); mprotect(ptr, size, PROT_NONE); mprotect(ptr, size, PROT_READ); *ptr = 100; The problem is hit when the mprotect(PROT_EXEC) is implicitly assigned a protection key to the VMA, and made that key ACCESS_DENY|WRITE_DENY. The PROT_NONE mprotect() failed to remove the protection key, and the PROT_NONE-> PROT_READ left the PTE usable, but the pkey still in place and left the memory inaccessible. To fix this, we ensure that we always "override" the pkee at mprotect() if the VMA does not have execute-only permissions, but the VMA has the execute-only pkey. We had a check for PROT_READ/WRITE, but it did not work for PROT_NONE. This entirely removes the PROT_* checks, which ensures that PROT_NONE now works. Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com> Fixes: 62b5f7d013f ("mm/core, x86/mm/pkeys: Add execute-only protection keys support") Reported-by: Shakeel Butt <shakeelb(a)google.com> Cc: stable(a)vger.kernel.org Cc: Ram Pai <linuxram(a)us.ibm.com> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: Dave Hansen <dave.hansen(a)intel.com> Cc: Michael Ellermen <mpe(a)ellerman.id.au> Cc: Ingo Molnar <mingo(a)kernel.org> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: Shuah Khan <shuah(a)kernel.org> --- b/arch/x86/include/asm/pkeys.h | 12 +++++++++++- b/arch/x86/mm/pkeys.c | 21 +++++++++++---------- 2 files changed, 22 insertions(+), 11 deletions(-) diff -puN arch/x86/include/asm/pkeys.h~pkeys-abandon-exec-only-pkey-more-aggressively arch/x86/include/asm/pkeys.h --- a/arch/x86/include/asm/pkeys.h~pkeys-abandon-exec-only-pkey-more-aggressively 2018-04-26 10:42:18.971487371 -0700 +++ b/arch/x86/include/asm/pkeys.h 2018-04-26 10:42:18.977487371 -0700 @@ -2,6 +2,8 @@ #ifndef _ASM_X86_PKEYS_H #define _ASM_X86_PKEYS_H +#define ARCH_DEFAULT_PKEY 0 + #define arch_max_pkey() (boot_cpu_has(X86_FEATURE_OSPKE) ? 16 : 1) extern int arch_set_user_pkey_access(struct task_struct *tsk, int pkey, @@ -15,7 +17,7 @@ extern int __execute_only_pkey(struct mm static inline int execute_only_pkey(struct mm_struct *mm) { if (!boot_cpu_has(X86_FEATURE_OSPKE)) - return 0; + return ARCH_DEFAULT_PKEY; return __execute_only_pkey(mm); } @@ -56,6 +58,14 @@ bool mm_pkey_is_allocated(struct mm_stru return false; if (pkey >= arch_max_pkey()) return false; + /* + * The exec-only pkey is set in the allocation map, but + * is not available to any of the user interfaces like + * mprotect_pkey(). + */ + if (pkey == mm->context.execute_only_pkey) + return false; + return mm_pkey_allocation_map(mm) & (1U << pkey); } diff -puN arch/x86/mm/pkeys.c~pkeys-abandon-exec-only-pkey-more-aggressively arch/x86/mm/pkeys.c --- a/arch/x86/mm/pkeys.c~pkeys-abandon-exec-only-pkey-more-aggressively 2018-04-26 10:42:18.973487371 -0700 +++ b/arch/x86/mm/pkeys.c 2018-04-26 10:47:34.806486584 -0700 @@ -94,26 +94,27 @@ int __arch_override_mprotect_pkey(struct */ if (pkey != -1) return pkey; - /* - * Look for a protection-key-drive execute-only mapping - * which is now being given permissions that are not - * execute-only. Move it back to the default pkey. - */ - if (vma_is_pkey_exec_only(vma) && - (prot & (PROT_READ|PROT_WRITE))) { - return 0; - } + /* * The mapping is execute-only. Go try to get the * execute-only protection key. If we fail to do that, * fall through as if we do not have execute-only - * support. + * support in this mm. */ if (prot == PROT_EXEC) { pkey = execute_only_pkey(vma->vm_mm); if (pkey > 0) return pkey; + } else if (vma_is_pkey_exec_only(vma)) { + /* + * Protections are *not* PROT_EXEC, but the mapping + * is using the exec-only pkey. This mapping was + * PROT_EXEC and will no longer be. Move back to + * the default pkey. + */ + return ARCH_DEFAULT_PKEY; } + /* * This is a vanilla, non-pkey mprotect (or we failed to * setup execute-only), inherit the pkey from the VMA we _

7 years, 8 months

1
0
0 0

[PATCH 1/9] x86, pkeys: do not special case protection key 0

by Dave Hansen

From: Dave Hansen <dave.hansen(a)linux.intel.com> mm_pkey_is_allocated() treats pkey 0 as unallocated. That is inconsistent with the manpages, and also inconsistent with mm->context.pkey_allocation_map. Stop special casing it and only disallow values that are actually bad (< 0). The end-user visible effect of this is that you can now use mprotect_pkey() to set pkey=0. This is a bit nicer than what Ram proposed because it is simpler and removes special-casing for pkey 0. On the other hand, it does allow applciations to pkey_free() pkey-0, but that's just a silly thing to do, so we are not going to protect against it. Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com> Fixes: 58ab9a088dda ("x86/pkeys: Check against max pkey to avoid overflows") Cc: stable(a)kernel.org Cc: Ram Pai <linuxram(a)us.ibm.com> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: Dave Hansen <dave.hansen(a)intel.com> Cc: Michael Ellermen <mpe(a)ellerman.id.au> Cc: Ingo Molnar <mingo(a)kernel.org> Cc: Andrew Morton <akpm(a)linux-foundation.org>p Cc: Shuah Khan <shuah(a)kernel.org> --- b/arch/x86/include/asm/mmu_context.h | 2 +- b/arch/x86/include/asm/pkeys.h | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff -puN arch/x86/include/asm/mmu_context.h~x86-pkey-0-default-allocated arch/x86/include/asm/mmu_context.h --- a/arch/x86/include/asm/mmu_context.h~x86-pkey-0-default-allocated 2018-03-26 10:22:33.742170197 -0700 +++ b/arch/x86/include/asm/mmu_context.h 2018-03-26 10:22:33.747170197 -0700 @@ -192,7 +192,7 @@ static inline int init_new_context(struc #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS if (cpu_feature_enabled(X86_FEATURE_OSPKE)) { - /* pkey 0 is the default and always allocated */ + /* pkey 0 is the default and allocated implicitly */ mm->context.pkey_allocation_map = 0x1; /* -1 means unallocated or invalid */ mm->context.execute_only_pkey = -1; diff -puN arch/x86/include/asm/pkeys.h~x86-pkey-0-default-allocated arch/x86/include/asm/pkeys.h --- a/arch/x86/include/asm/pkeys.h~x86-pkey-0-default-allocated 2018-03-26 10:22:33.744170197 -0700 +++ b/arch/x86/include/asm/pkeys.h 2018-03-26 10:22:33.747170197 -0700 @@ -49,10 +49,10 @@ bool mm_pkey_is_allocated(struct mm_stru { /* * "Allocated" pkeys are those that have been returned - * from pkey_alloc(). pkey 0 is special, and never - * returned from pkey_alloc(). + * from pkey_alloc() or pkey 0 which is allocated + * implicitly when the mm is created. */ - if (pkey <= 0) + if (pkey < 0) return false; if (pkey >= arch_max_pkey()) return false; _

7 years, 8 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror