Commit Graph

707889 Commits

Author SHA1 Message Date
Igor Russkikh 5d8d84e91d net: aquantia: Add queue restarts stats counter
Queue stat strings are cleaned up, duplicate stat name strings removed,
queue restarts counter added

Signed-off-by: Pavel Belous <pavel.belous@aquantia.com>
Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-21 12:32:24 +01:00
Igor Russkikh 65e665e68d net: aquantia: Reset nic statistics on interface up/down
Internal statistics system on chip never gets reset until hardware
reboot. This is quite inconvenient in terms of ethtool statistics usage.

This patch implements incremental statistics update inside of
service callback.

Upon nic initialization, first request is done to fetch
initial stat data, current collected stat data gets cleared.
Internal statistics mailbox readout is improved to save space and
increase readability

Signed-off-by: Pavel Belous <pavel.belous@aquantia.com>
Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-21 12:32:24 +01:00
Sherry Yang ae65c8510f android: binder: Fix null ptr dereference in debug msg
Don't access next->data in kernel debug message when the
next buffer is null.

Acked-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Sherry Yang <sherryy@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-21 10:14:20 +02:00
Sherry Yang a0c2baaf81 android: binder: Don't get mm from task
Use binder_alloc struct's mm_struct rather than getting
a reference to the mm struct through get_task_mm to
avoid a potential deadlock between lru lock, task lock and
dentry lock, since a thread can be holding the task lock
and the dentry lock while trying to acquire the lru lock.

Acked-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Sherry Yang <sherryy@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-21 10:14:20 +02:00
Matteo Croce 197df02cb3 udp: make some messages more descriptive
In the UDP code there are two leftover error messages with very few meaning.
Replace them with a more descriptive error message as some users
reported them as "strange network error".

Signed-off-by: Matteo Croce <mcroce@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-21 02:52:35 +01:00
Stefano Brivio 772e97b57a geneve: Fix function matching VNI and tunnel ID on big-endian
On big-endian machines, functions converting between tunnel ID
and VNI use the three LSBs of tunnel ID storage to map VNI.

The comparison function eq_tun_id_and_vni(), on the other hand,
attempted to map the VNI from the three MSBs. Fix it by using
the same check implemented on LE, which maps VNI from the three
LSBs of tunnel ID.

Fixes: 2e0b26e103 ("geneve: Optimize geneve device lookup.")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: Jakub Sitnicki <jkbs@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-21 02:50:42 +01:00
David S. Miller c69d75ae15 linux-can-fixes-for-4.14-20171019
-----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCgAxFiEE4bay/IylYqM/npjQHv7KIOw4HPYFAlnohyMTHG1rbEBwZW5n
 dXRyb25peC5kZQAKCRAe/sog7Dgc9jRFCACmSBz2H1yW5VfjrN3ZgoEoUo8P5qCZ
 7mXvTstTASF20T7kFqNS2K94CMVjBYRUIHvihp0LmPmPAmpmQRNedAssWuZpMflw
 xhaH8T8YWbyzHU2MBZP9WtTjrTilPEPcjvFSgYw6wpHW7VC3S/ffEN8Mj3ymR6bW
 KRw7gemXpvYUxPrGGCzyvFy4G+KptyPcAD6I8ceDUtdkwK4TXGYqEAoSqxtAIUHX
 dgRLzheOv8sDh+dM+ZNpH6UUkzK0gVHQ40lgXydZazEwPPq9zdj2Ec/6qpR5fkUH
 dnCIhzLNiCJOMGSfzkf0Esef1zBpU8oJmILbgf97CdayaW9cA1EUleGW
 =HYTx
 -----END PGP SIGNATURE-----

Merge tag 'linux-can-fixes-for-4.14-20171019' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can

Marc Kleine-Budde says:

====================
pull-request: can 2017-10-19

this is a pull request of 11 patches for the upcoming 4.14 release.

There are 6 patches by ZHU Yi for the flexcan driver, that work around
the CAN error handling state transition problems found in various
incarnations of the flexcan IP core.

The patch by Colin Ian King fixes a potential NULL pointer deref in the
CAN broad cast manager (bcm). One patch by me replaces a direct deref of a RCU
protected pointer by rcu_access_pointer. My second patch adds missing
OOM error handling in af_can. A patch by Stefan Mätje for the esd_usb2
driver fixes the dlc in received RTR frames. And the last patch is by
Wolfgang Grandegger, it fixes a busy loop in the gs_usb driver in case
it runs out of TX contexts.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-21 02:30:31 +01:00
Dexuan Cui b4562ca792 hv_sock: add locking in the open/close/release code paths
Without the patch, when hvs_open_connection() hasn't completely established
a connection (e.g. it has changed sk->sk_state to SS_CONNECTED, but hasn't
inserted the sock into the connected queue), vsock_stream_connect() may see
the sk_state change and return the connection to the userspace, and next
when the userspace closes the connection quickly, hvs_release() may not see
the connection in the connected queue; finally hvs_open_connection()
inserts the connection into the queue, but we won't be able to purge the
connection for ever.

Signed-off-by: Dexuan Cui <decui@microsoft.com>
Cc: K. Y. Srinivasan <kys@microsoft.com>
Cc: Haiyang Zhang <haiyangz@microsoft.com>
Cc: Stephen Hemminger <sthemmin@microsoft.com>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Cc: Cathy Avery <cavery@redhat.com>
Cc: Rolf Neugebauer <rolf.neugebauer@docker.com>
Cc: Marcelo Cerri <marcelo.cerri@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-21 02:21:08 +01:00
Gavin Shan 0a90e25198 net/ncsi: Fix length of GVI response packet
The length of GVI (GetVersionInfo) response packet should be 40 instead
of 36. This issue was found from /sys/kernel/debug/ncsi/eth0/stats.

 # ethtool --ncsi eth0 swstats
     :
 RESPONSE     OK       TIMEOUT  ERROR
 =======================================
 GVI          0        0        2

With this applied, no error reported on GVI response packets:

 # ethtool --ncsi eth0 swstats
     :
 RESPONSE     OK       TIMEOUT  ERROR
 =======================================
 GVI          2        0        0

Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-21 01:56:38 +01:00
Gavin Shan 52b4c8627f net/ncsi: Enforce failover on link monitor timeout
The NCSI channel has been configured to provide service if its link
monitor timer is enabled, regardless of its state (inactive or active).
So the timeout event on the link monitor indicates the out-of-service
on that channel, for which a failover is needed.

This sets NCSI_DEV_RESHUFFLE flag to enforce failover on link monitor
timeout, regardless the channel's original state (inactive or active).
Also, the link is put into "down" state to give the failing channel
lowest priority when selecting for the active channel. The state of
failing channel should be set to active in order for deinitialization
and failover to be done.

Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-21 01:56:38 +01:00
Gavin Shan 100ef01f3e net/ncsi: Disable HWA mode when no channels are found
When there are no NCSI channels probed, HWA (Hardware Arbitration)
mode is enabled. It's not correct because HWA depends on the fact:
NCSI channels exist and all of them support HWA mode. This disables
HWA when no channels are probed.

Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-21 01:56:38 +01:00
Samuel Mendoza-Jonas 0795fb2021 net/ncsi: Stop monitor if channel times out or is inactive
ncsi_channel_monitor() misses stopping the channel monitor in several
places that it should, causing a WARN_ON_ONCE() to trigger when the
monitor is re-started later, eg:

[  459.040000] WARNING: CPU: 0 PID: 1093 at net/ncsi/ncsi-manage.c:269 ncsi_start_channel_monitor+0x7c/0x90
[  459.040000] CPU: 0 PID: 1093 Comm: kworker/0:3 Not tainted 4.10.17-gaca2fdd #140
[  459.040000] Hardware name: ASpeed SoC
[  459.040000] Workqueue: events ncsi_dev_work
[  459.040000] [<80010094>] (unwind_backtrace) from [<8000d950>] (show_stack+0x20/0x24)
[  459.040000] [<8000d950>] (show_stack) from [<801dbf70>] (dump_stack+0x20/0x28)
[  459.040000] [<801dbf70>] (dump_stack) from [<80018d7c>] (__warn+0xe0/0x108)
[  459.040000] [<80018d7c>] (__warn) from [<80018e70>] (warn_slowpath_null+0x30/0x38)
[  459.040000] [<80018e70>] (warn_slowpath_null) from [<803f6a08>] (ncsi_start_channel_monitor+0x7c/0x90)
[  459.040000] [<803f6a08>] (ncsi_start_channel_monitor) from [<803f7664>] (ncsi_configure_channel+0xdc/0x5fc)
[  459.040000] [<803f7664>] (ncsi_configure_channel) from [<803f8160>] (ncsi_dev_work+0xac/0x474)
[  459.040000] [<803f8160>] (ncsi_dev_work) from [<8002d244>] (process_one_work+0x1e0/0x450)
[  459.040000] [<8002d244>] (process_one_work) from [<8002d510>] (worker_thread+0x5c/0x570)
[  459.040000] [<8002d510>] (worker_thread) from [<80033614>] (kthread+0x124/0x164)
[  459.040000] [<80033614>] (kthread) from [<8000a5e8>] (ret_from_fork+0x14/0x2c)

This also updates the monitor instead of just returning if
ncsi_xmit_cmd() fails to send the get-link-status command so that the
monitor properly times out.

Fixes: e6f44ed6d0 "net/ncsi: Package and channel management"

Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-21 01:56:38 +01:00
Samuel Mendoza-Jonas 6850d0f8b2 net/ncsi: Fix AEN HNCDSC packet length
Correct the value of the HNCDSC AEN packet.
Fixes: 7a82ecf4cf "net/ncsi: NCSI AEN packet handler"

Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-21 01:56:38 +01:00
Eric Dumazet 509c7a1ecc packet: avoid panic in packet_getsockopt()
syzkaller got crashes in packet_getsockopt() processing
PACKET_ROLLOVER_STATS command while another thread was managing
to change po->rollover

Using RCU will fix this bug. We might later add proper RCU annotations
for sparse sake.

In v2: I replaced kfree(rollover) in fanout_add() to kfree_rcu()
variant, as spotted by John.

Fixes: a9b6391814 ("packet: rollover statistics")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: John Sperbeck <jsperbeck@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-21 01:51:34 +01:00
Eric Dumazet c92e8c02fe tcp/dccp: fix ireq->opt races
syzkaller found another bug in DCCP/TCP stacks [1]

For the reasons explained in commit ce1050089c ("tcp/dccp: fix
ireq->pktopts race"), we need to make sure we do not access
ireq->opt unless we own the request sock.

Note the opt field is renamed to ireq_opt to ease grep games.

[1]
BUG: KASAN: use-after-free in ip_queue_xmit+0x1687/0x18e0 net/ipv4/ip_output.c:474
Read of size 1 at addr ffff8801c951039c by task syz-executor5/3295

CPU: 1 PID: 3295 Comm: syz-executor5 Not tainted 4.14.0-rc4+ #80
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:52
 print_address_description+0x73/0x250 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report+0x25b/0x340 mm/kasan/report.c:409
 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:427
 ip_queue_xmit+0x1687/0x18e0 net/ipv4/ip_output.c:474
 tcp_transmit_skb+0x1ab7/0x3840 net/ipv4/tcp_output.c:1135
 tcp_send_ack.part.37+0x3bb/0x650 net/ipv4/tcp_output.c:3587
 tcp_send_ack+0x49/0x60 net/ipv4/tcp_output.c:3557
 __tcp_ack_snd_check+0x2c6/0x4b0 net/ipv4/tcp_input.c:5072
 tcp_ack_snd_check net/ipv4/tcp_input.c:5085 [inline]
 tcp_rcv_state_process+0x2eff/0x4850 net/ipv4/tcp_input.c:6071
 tcp_child_process+0x342/0x990 net/ipv4/tcp_minisocks.c:816
 tcp_v4_rcv+0x1827/0x2f80 net/ipv4/tcp_ipv4.c:1682
 ip_local_deliver_finish+0x2e2/0xba0 net/ipv4/ip_input.c:216
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_local_deliver+0x1ce/0x6e0 net/ipv4/ip_input.c:257
 dst_input include/net/dst.h:464 [inline]
 ip_rcv_finish+0x887/0x19a0 net/ipv4/ip_input.c:397
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_rcv+0xc3f/0x1820 net/ipv4/ip_input.c:493
 __netif_receive_skb_core+0x1a3e/0x34b0 net/core/dev.c:4476
 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4514
 netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4587
 netif_receive_skb+0xae/0x390 net/core/dev.c:4611
 tun_rx_batched.isra.50+0x5ed/0x860 drivers/net/tun.c:1372
 tun_get_user+0x249c/0x36d0 drivers/net/tun.c:1766
 tun_chr_write_iter+0xbf/0x160 drivers/net/tun.c:1792
 call_write_iter include/linux/fs.h:1770 [inline]
 new_sync_write fs/read_write.c:468 [inline]
 __vfs_write+0x68a/0x970 fs/read_write.c:481
 vfs_write+0x18f/0x510 fs/read_write.c:543
 SYSC_write fs/read_write.c:588 [inline]
 SyS_write+0xef/0x220 fs/read_write.c:580
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x40c341
RSP: 002b:00007f469523ec10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c341
RDX: 0000000000000037 RSI: 0000000020004000 RDI: 0000000000000015
RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b7fd1
R13: 00000000ffffffff R14: 0000000020000000 R15: 0000000000025000

Allocated by task 3295:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
 __do_kmalloc mm/slab.c:3725 [inline]
 __kmalloc+0x162/0x760 mm/slab.c:3734
 kmalloc include/linux/slab.h:498 [inline]
 tcp_v4_save_options include/net/tcp.h:1962 [inline]
 tcp_v4_init_req+0x2d3/0x3e0 net/ipv4/tcp_ipv4.c:1271
 tcp_conn_request+0xf6d/0x3410 net/ipv4/tcp_input.c:6283
 tcp_v4_conn_request+0x157/0x210 net/ipv4/tcp_ipv4.c:1313
 tcp_rcv_state_process+0x8ea/0x4850 net/ipv4/tcp_input.c:5857
 tcp_v4_do_rcv+0x55c/0x7d0 net/ipv4/tcp_ipv4.c:1482
 tcp_v4_rcv+0x2d10/0x2f80 net/ipv4/tcp_ipv4.c:1711
 ip_local_deliver_finish+0x2e2/0xba0 net/ipv4/ip_input.c:216
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_local_deliver+0x1ce/0x6e0 net/ipv4/ip_input.c:257
 dst_input include/net/dst.h:464 [inline]
 ip_rcv_finish+0x887/0x19a0 net/ipv4/ip_input.c:397
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_rcv+0xc3f/0x1820 net/ipv4/ip_input.c:493
 __netif_receive_skb_core+0x1a3e/0x34b0 net/core/dev.c:4476
 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4514
 netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4587
 netif_receive_skb+0xae/0x390 net/core/dev.c:4611
 tun_rx_batched.isra.50+0x5ed/0x860 drivers/net/tun.c:1372
 tun_get_user+0x249c/0x36d0 drivers/net/tun.c:1766
 tun_chr_write_iter+0xbf/0x160 drivers/net/tun.c:1792
 call_write_iter include/linux/fs.h:1770 [inline]
 new_sync_write fs/read_write.c:468 [inline]
 __vfs_write+0x68a/0x970 fs/read_write.c:481
 vfs_write+0x18f/0x510 fs/read_write.c:543
 SYSC_write fs/read_write.c:588 [inline]
 SyS_write+0xef/0x220 fs/read_write.c:580
 entry_SYSCALL_64_fastpath+0x1f/0xbe

Freed by task 3306:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3503 [inline]
 kfree+0xca/0x250 mm/slab.c:3820
 inet_sock_destruct+0x59d/0x950 net/ipv4/af_inet.c:157
 __sk_destruct+0xfd/0x910 net/core/sock.c:1560
 sk_destruct+0x47/0x80 net/core/sock.c:1595
 __sk_free+0x57/0x230 net/core/sock.c:1603
 sk_free+0x2a/0x40 net/core/sock.c:1614
 sock_put include/net/sock.h:1652 [inline]
 inet_csk_complete_hashdance+0xd5/0xf0 net/ipv4/inet_connection_sock.c:959
 tcp_check_req+0xf4d/0x1620 net/ipv4/tcp_minisocks.c:765
 tcp_v4_rcv+0x17f6/0x2f80 net/ipv4/tcp_ipv4.c:1675
 ip_local_deliver_finish+0x2e2/0xba0 net/ipv4/ip_input.c:216
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_local_deliver+0x1ce/0x6e0 net/ipv4/ip_input.c:257
 dst_input include/net/dst.h:464 [inline]
 ip_rcv_finish+0x887/0x19a0 net/ipv4/ip_input.c:397
 NF_HOOK include/linux/netfilter.h:249 [inline]
 ip_rcv+0xc3f/0x1820 net/ipv4/ip_input.c:493
 __netif_receive_skb_core+0x1a3e/0x34b0 net/core/dev.c:4476
 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4514
 netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4587
 netif_receive_skb+0xae/0x390 net/core/dev.c:4611
 tun_rx_batched.isra.50+0x5ed/0x860 drivers/net/tun.c:1372
 tun_get_user+0x249c/0x36d0 drivers/net/tun.c:1766
 tun_chr_write_iter+0xbf/0x160 drivers/net/tun.c:1792
 call_write_iter include/linux/fs.h:1770 [inline]
 new_sync_write fs/read_write.c:468 [inline]
 __vfs_write+0x68a/0x970 fs/read_write.c:481
 vfs_write+0x18f/0x510 fs/read_write.c:543
 SYSC_write fs/read_write.c:588 [inline]
 SyS_write+0xef/0x220 fs/read_write.c:580
 entry_SYSCALL_64_fastpath+0x1f/0xbe

Fixes: e994b2f0fb ("tcp: do not lock listener to process SYN packets")
Fixes: 079096f103 ("tcp/dccp: install syn_recv requests into ehash table")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-21 01:33:19 +01:00
Linus Torvalds 9c323bff13 Merge branch 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm
Pull ARM fixes from Russell King:
 "Three fixes this time around:

   - ensure sparse realises that we're building for a 32-bit arch on
     64-bit hosts.

   - use the correct instruction for semihosting on v7m (nommu) CPUs.

   - reserve address 0 to prevent the first page of memory being used on
     nommu systems"

* 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm:
  ARM: 8704/1: semihosting: use proper instruction on v7m processors
  ARM: 8701/1: fix sparse flags for build on 64bit machines
  ARM: 8700/1: nommu: always reserve address 0 away
2017-10-20 18:20:17 -04:00
Linus Torvalds 545ea16f7c ARM: SoC fixes for 4.14
Here is another set of bugfixes for ARM SoCs, mostly harmless:
 
  - A boot regression fix on ux500
  - PCIe interrupts on NXP i.MX7 and on Marvell Armada 7K/8K were
    wired up wrong, in different ways
  - Armada XP support for large memory never worked
  - The socfpga reset controller now builds on 64-bit
  - minor device tree corrections on gemini, mvebu, r-pi 3,
    rockchip and at91
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIVAwUAWeppyWCrR//JCVInAQIfVQ//cQDz9jv//4tMhBJeLxpcTe62U0HL3gG/
 pCUXUxUKQxTTuvUm2Ecx+YpeFfS4hDEOAVi8wDAgJ6yBhW+jrIasiVq5XaspR6/C
 DicscLdW3YJ6hjBfk87mbC7F6wu8aTzZa4xkwjJ1L0XbNSq7oOBaoff8dhMNnzC8
 w1HuLu/laAaTEhiHZ1M/hkjx9VxA2j0AQvhdV7Ebrh3Wk+2wYB1QhWngLgHBIZsC
 1VVOtHCtRtfrIBSnHjjx/Wvcwln6fUNUXJGgp3K/oJeNE6M2D2FxA0ylB6YiYmmf
 jRdXypqiE6xjRJa7yru/Q1LfLzt5dQibSQYNsU+ljJ7Wp/3V9F1Ms43hXROunPRN
 Exebvi7BDjGO+/MxgD/FLFltndJRsmnZPD0+M8+zWcHIrC1N1ULrBO8HfdIWxm/x
 nNOvx17dEUCg8azwFlmfjxXIq4p/4qv+LzbkFVPOlPf1y4xzvMthkAyKiN1vGVoO
 d5O7HeTc4ciPG/qxcL4zdwDo4qgeMTDJNrTRJ+4oxjkKxHDHH3gpYXKdKWCFXT+W
 5/Y+kIYEQChNNRdXqQ1Xx4xgdZaHfu6J3QrfNs0291yjLDUyCjk4FtDZBzlWO/SH
 F8rE79QOwYbZGgth2b/RqX4/IxAzE7wviUVlBUja4NcPcDkwk2hPHqiyfkYmXaTn
 a80A7sWIjSM=
 =M8dW
 -----END PGP SIGNATURE-----

Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

Pull ARM SoC fixes from Arnd Bergmann:
 "Here is another set of bugfixes for ARM SoCs, mostly harmless:

   - a boot regression fix on ux500

   - PCIe interrupts on NXP i.MX7 and on Marvell Armada 7K/8K were wired
     up wrong, in different ways

   - Armada XP support for large memory never worked

   - the socfpga reset controller now builds on 64-bit

   - minor device tree corrections on gemini, mvebu, r-pi 3, rockchip
     and at91"

* tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: ux500: Fix regression while init PM domains
  ARM: dts: fix PCLK name on Gemini and MOXA ART
  arm64: dts: rockchip: fix typo in iommu nodes
  arm64: dts: rockchip: correct vqmmc voltage for rk3399 platforms
  ARM: dts: imx7d: Invert legacy PCI irq mapping
  bus: mbus: fix window size calculation for 4GB windows
  ARM: dts: at91: sama5d2: add ADC hw trigger edge type
  ARM: dts: at91: sama5d2_xplained: enable ADTRG pin
  ARM: dts: at91: at91-sama5d27_som1: fix PHY ID
  ARM: dts: bcm283x: Fix console path on RPi3
  reset: socfpga: fix for 64-bit compilation
  ARM: dts: Fix I2C repeated start issue on Armada-38x
  arm64: dts: marvell: fix interrupt-map property for Armada CP110 PCIe controller
  arm64: dts: salvator-common: add 12V regulator to backlight
  ARM: dts: sun6i: Fix endpoint IDs in second display pipeline
  arm64: allwinner: a64: pine64: Use dcdc1 regulator for mmc0
2017-10-20 18:17:43 -04:00
Arnd Bergmann 6bf99a6cb6 Allwinner fixes for 4.14
Two fixes, one for the A31 DRM binding, and one for a missing regulator on
 the pine MMC controller.
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJZ6axFAAoJEBx+YmzsjxAgRPQQAL8SNIbznqcV1ncW1SXBH/hg
 W1UCfclJfCJ1nrctsfXIgDpIJAGjVR+PEh8kBHgyqknqLJ6bQpJOqfHzSZk+SWF4
 1NuosdxLMW9V9wrwzNUUYD6Jh3VoJAgKDcWBPeY9eUvvLq6wnzXmSXPBtTUlXuNp
 XcXoT7TCSlUZ0rvJKPe2ON+BH1hjYhNnHs07TN2x2lbYQMbEcLLzqBOyfxESzQ5w
 hAb8gpJhGSDAk2pJXtyviSNokx5fqSePnKmfPNG42QHXq+cvt6aCcosqZ9u3OuAx
 eNTVTZPlvnQ/GfjEouG4NTjYbv5cXdN8itqaSypMeN+8xpOJ/mFDa8K/vzyzF2Kr
 6svpe4SC0YB6z4YtKFLR0Q6a/MlgMNq02WW5l+oq8e44pwyPRYFeTNNP8yD9ZO0k
 xlhgNyo+/KIXGx6XBga27x3IyaWopGslLK/UjG4El0jOAPISiuZcbF6GCsFht7dk
 YSVEVQ842v2iX817kaDy1zGTOy0b9j9/AOu6ctZlsP9XM9YaMxi7pFrb+UFu6FSJ
 yRR8TNZjjrSMsuDc8yrbH0/nWcgkmQtYXa2iQ4/2ILlW63zrm2yM7w8CKygyZ25D
 NhuK/yQ+PEsKYDAJ3s3T3hUbirAmQx3KUmv6Jr7UUPaj6V5a62Jl/pt5+oSlGQm7
 EBkvmIV+XXwmqng7Y/WF
 =Cvge
 -----END PGP SIGNATURE-----

Merge tag 'sunxi-fixes-for-4.14' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into fixes

Pull "Allwinner fixes for 4.14" from Maxime Ripard:

Two fixes, one for the A31 DRM binding, and one for a missing regulator on
the pine MMC controller.

* tag 'sunxi-fixes-for-4.14' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:
  ARM: dts: sun6i: Fix endpoint IDs in second display pipeline
  arm64: allwinner: a64: pine64: Use dcdc1 regulator for mmc0
2017-10-20 22:24:48 +02:00
Kees Cook 1c9fec470b waitid(): Avoid unbalanced user_access_end() on access_ok() error
As pointed out by Linus and David, the earlier waitid() fix resulted in
a (currently harmless) unbalanced user_access_end() call.  This fixes it
to just directly return EFAULT on access_ok() failure.

Fixes: 96ca579a1e ("waitid(): Add missing access_ok() checks")
Acked-by: David Daney <david.daney@cavium.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-10-20 15:32:54 -04:00
Dexuan Cui 9d35593b4f vmbus: hvsock: add proper sync for vmbus_hvsock_device_unregister()
Without the patch, vmbus_hvsock_device_unregister() can destroy the device
prematurely when close() is called, and can cause NULl dereferencing or
potential data loss (the last portion of the data stream may be dropped
prematurely).

Signed-off-by: Dexuan Cui <decui@microsoft.com>
Cc: Haiyang Zhang <haiyangz@microsoft.com>
Cc: Stephen Hemminger <sthemmin@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 14:56:25 +02:00
David S. Miller e95c6cf447 Merge branch 'sockmap-fixes'
John Fastabend says:

====================
sockmap fixes for net

The following implements a set of fixes for sockmap and changes the
API slightly in a few places to reduce preempt_disable/enable scope.
We do this here in net because it requires an API change and this
avoids getting stuck with legacy API going forward.

The short description:

Access to skb mark is removed, it is problematic when we add
features in the future because mark is a union and used by the
TCP/socket code internally. We don't want to expose this to the
BPF programs or let programs change the values.

The other change is caching metadata in the skb itself between
when the BPF program returns a redirect code and the core code
implements the redirect. This avoids having per cpu metadata.

Finally, tighten restriction on using sockmap to CAP_NET_ADMIN and
only SOCK_STREAM sockets.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-20 13:01:30 +01:00
John Fastabend 9ef2a8cd5c bpf: require CAP_NET_ADMIN when using devmap
Devmap is used with XDP which requires CAP_NET_ADMIN so lets also
make CAP_NET_ADMIN required to use the map.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-20 13:01:29 +01:00
John Fastabend fb50df8d32 bpf: require CAP_NET_ADMIN when using sockmap maps
Restrict sockmap to CAP_NET_ADMIN.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-20 13:01:29 +01:00
John Fastabend f7e9cb1ecb bpf: remove mark access for SK_SKB program types
The skb->mark field is a union with reserved_tailroom which is used
in the TCP code paths from stream memory allocation. Allowing SK_SKB
programs to set this field creates a conflict with future code
optimizations, such as "gifting" the skb to the egress path instead
of creating a new skb and doing a memcpy.

Because we do not have a released version of SK_SKB yet lets just
remove it for now. A more appropriate scratch pad to use at the
socket layer is dev_scratch, but lets add that in future kernels
when needed.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-20 13:01:29 +01:00
John Fastabend 34f79502bb bpf: avoid preempt enable/disable in sockmap using tcp_skb_cb region
SK_SKB BPF programs are run from the socket/tcp context but early in
the stack before much of the TCP metadata is needed in tcp_skb_cb. So
we can use some unused fields to place BPF metadata needed for SK_SKB
programs when implementing the redirect function.

This allows us to drop the preempt disable logic. It does however
require an API change so sk_redirect_map() has been updated to
additionally provide ctx_ptr to skb. Note, we do however continue to
disable/enable preemption around actual BPF program running to account
for map updates.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-20 13:01:29 +01:00
John Fastabend 435bf0d3f9 bpf: enforce TCP only support for sockmap
Only TCP sockets have been tested and at the moment the state change
callback only handles TCP sockets. This adds a check to ensure that
sockets actually being added are TCP sockets.

For net-next we can consider UDP support.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-20 13:01:29 +01:00
Xin Long 1cc276cec9 sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect
Now sctp processes icmp redirect packet in sctp_icmp_redirect where
it calls sctp_transport_dst_check in which tp->dst can be released.

The problem is before calling sctp_transport_dst_check, it doesn't
check sock_owned_by_user, which means tp->dst could be freed while
a process is accessing it with owning the socket.

An use-after-free issue could be triggered by this.

This patch is to fix it by checking sock_owned_by_user before calling
sctp_transport_dst_check in sctp_icmp_redirect, so that it would not
release tp->dst if users still hold sock lock.

Besides, the same issue fixed in commit 45caeaa5ac ("dccp/tcp: fix
routing redirect race") on sctp also needs this check.

Fixes: 55be7a9c60 ("ipv4: Add redirect support to all protocol icmp error handlers")
Reported-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-20 12:53:45 +01:00
David Kozub eb39a7c035 clockevents/drivers/cs5535: Improve resilience to spurious interrupts
The interrupt handler mfgpt_tick() is not robust versus spurious interrupts
which happen before the clock event device is registered and fully
initialized.

The reason is that the safe guard against spurious interrupts solely checks
for the clockevents shutdown state, but lacks a check for detached
state. If the interrupt hits while the device is in detached state it
passes the safe guard and dereferences the event handler call back which is
NULL.

Add the missing state check.

Fixes: 8f9327cbb6 ("clockevents/drivers/cs5535: Migrate to new 'set-state' interface")
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Kozub <zub@linux.fjfi.cvut.cz>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20171020093103.3317F6004D@linux.fjfi.cvut.cz
2017-10-20 13:41:52 +02:00
Linus Torvalds 9a27ded219 xen: fix for 4.14-rc6
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQEcBAABAgAGBQJZ6bO8AAoJELDendYovxMvzJgH/3QHVFMmmZnEpqpet6Om/h3Z
 YuhrLTuXRL/dz6IA9u0PXOL83k3qnQKzmy4OZJL/BuT+ZGXZAJge0nLhC+sHc5CR
 SrWFSee0Ut1qM1Khenfi2rn4M3F/Hc3m9lLU5KsewEflJ+MMw86RSKAPD3Xc6w0u
 Kq6ejczfBvFNz1KErCO+IRc5A25ouNJZDNVwrMrJ5QXXJ2rPGFS+3TIilwu51kfQ
 ux/s3frm2bNxFabkOtAZzxkYMYj9RRTDewBZocGhPmih0WWkquVbhwuxl9mf2nd0
 AeFWbvMnZcq86Ra9zhtLQg1Gu7SSI/0vq7JnZtIsZw8b5YThG3V9s14fkWhJrgE=
 =xWgh
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-4.14c-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen fix from Juergen Gross:
 "A fix for the Xen pv network drivers (frontend and backend) avoiding
  the network connection to become unusable due to an illegal MTU"

* tag 'for-linus-4.14c-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen-netfront, xen-netback: Use correct minimum MTU values
2017-10-20 06:58:43 -04:00
Martijn Coenen 66b83a4cdd binder: call poll_wait() unconditionally.
Because we're not guaranteed that subsequent calls
to poll() will have a poll_table_struct parameter
with _qproc set. When _qproc is not set, poll_wait()
is a noop, and we won't be woken up correctly.

Signed-off-by: Martijn Coenen <maco@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 12:53:43 +02:00
Linus Torvalds c925e0ea50 MMC host:
- sdhci-pci: Fix default d3_retune for Intel host controllers
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJZ6bFsAAoJEP4mhCVzWIwpFEsP/3C3ZGudAZeVzrCIhCzP/hdm
 Bior/PuFVxAXfZS0rp76/5vWkJMpJYdUsi9aL4+Qme8j5LoMn/d7faClwfHN9vOW
 Diug1UDB/TKmcYsmZCtSkv+30gxZtMMtS6U7J9QlUcjsWdusbJM3DMZllx/nCA+u
 wzbYufJl7ckLpL/yqWNpSJn0xnkH3/IAElUy1FJIIfgT2HEMKsrOIx99OM6w5nPW
 EcF5crKJFLB8UyGj8SwWgxZOYr7GvCMVNvxEzQ2zIvhq7lpCisjzn/CYWUveDatr
 mHkx8VYwgP1spwgfyHv2KRV1E4T6D7pbe9vMZEl8gXxJ8JQrEEPljd+P4tVMF9iM
 XmZ8Cpm5IBCdmJnuVPekOTNA4lisCIqP9wz25ExWQ6PzNxZGft7pcwNKxOjUVc4h
 Rh6r6GZcezgd87i4hbWubPLtpIMo7+Daje4earB1AGHmGw6G7IoIIGXnXrEg6bEo
 0UoX8TeGdalGR6p6I6Bqo591PZs3PdF5iltVQnrSx5Bg46lNCuQVPMhxPtdRMq/q
 PfAozDsSZBWRFWhZttjWlAA8S7a5iTFdI1DCwwitf3jmJ/L3AM7c+vifJidE33SZ
 oVReVGZRkHBWBfgvU8DeXm8u2blGPO1AKVI9JH1y6peUkIbrsT6v4A7Fj/XmJf7V
 VTnX7bfuzPpk1x0JCQgZ
 =gDOy
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC fix from Ulf Hansson:
 "sdhci-pci: Fix default d3_retune for Intel host controllers"

* tag 'mmc-v4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: sdhci-pci: Fix default d3_retune for Intel host controllers
2017-10-20 06:52:05 -04:00
Linus Torvalds d92116a089 amdgpu, nouveau, i915 and exynos fixes
-----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJZ6Y+3AAoJEAx081l5xIa+dEIP/j5tjawx4ada7etPbAblFjmD
 cs0LUFM6SgamUtgi5slJn+3jV1bXJpgcmCXI0S6Ln7xjLLvjcTnauJFidrBgT1lG
 dJOrzz8zgBF2jpc0oC/a3ercum3vncqxAbUbDQ6RwDrxuhwBB3L31ix263z/+Yr8
 fy655TSpxTiaokiVxws2mOfpte9yWcSeQUChrzRjNSS480O4qd/AJZl+FhiBNySw
 2kAW9zbTFEV/9qfANHToAeUsCOo2VoTBXqgpvPiUKJG2gow8yT0Wf5Al4HcagZCt
 9JtIbNlHxnuSYR0CCfx4r+/igWQt52O2GgmlPkaxvGjVz13n9m9RngYyyZksZWjQ
 9wBJEQI4pvCUIBHpic+90b9AKTIub52bImigNzckEDvvXXEIO4SUc23s6pkOKXD8
 V4ZO+pHtzV6/T9vGpntrbODcwp7/h397Zr6SKP+YjRl12Gh5/922xz3bQDnEgYF/
 o/q/stEm5Jqncz4WR+wZ2a7gocPxuexv6T/hZwvT+08l/QR5DR0sUhlJ+j3QaSqk
 ELqn5tNEGQiOEDLHmBnjiHZJFYAAlbOkPoVPIMuFt/xRZtDb2ZCN457OgSubmPqw
 1i00XLd6ZoEVI+nBcGJbyQhqZmcTftWXXvcCixBqvK9mEYFqQoe222bytaIoiPpo
 WT3Zt2E6jgoQxtX3PftU
 =wFHG
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-for-v4.14-rc6' of git://people.freedesktop.org/~airlied/linux

Pull drm fixes from Dave Airlie:
 "Standard fixes pull for rc6: one regression fix for amdgpu, a bunch of
  nouveau fixes that I'd missed a pull req for from Ben last week, some
  exynos regression fixes, and a few fixes for i915"

* tag 'drm-fixes-for-v4.14-rc6' of git://people.freedesktop.org/~airlied/linux:
  drm/nouveau/fbcon: fix oops without fbdev emulation
  Revert "drm/amdgpu: discard commands of killed processes"
  drm/i915: Use a mask when applying WaProgramL3SqcReg1Default
  drm/i915: Report -EFAULT before pwrite fast path into shmemfs
  drm/i915/cnl: Fix PLL initialization for HDMI.
  drm/i915/cnl: Fix PLL mapping.
  drm/i915: Use bdw_ddi_translations_fdi for Broadwell
  drm/i915: Fix eviction when the GGTT is idle but full
  drm/i915/gvt: Fix GPU hang after reusing vGPU instance across different guest OS
  drm/exynos: Clear drvdata after component unbind
  drm/exynos: Fix potential NULL pointer dereference in suspend/resume paths
  drm/nouveau/kms/nv50: fix oops during DP IRQ handling on non-MST boards
  drm/nouveau/bsp/g92: disable by default
  drm/nouveau/mmu: flush tlbs before deleting page tables
2017-10-20 06:38:56 -04:00
Linus Torvalds eb62722a06 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
Pull i2c fixes from Wolfram Sang:
 "A couple of bugfixes for I2C drivers.

  Because the changes for the piix4 driver are larger than usual, the
  patches have been in linux-next for more than a week with no reports
  coming in. The rest is usual stuff"

* 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: omap: Fix error handling for clk_get()
  i2c: piix4: Disable completely the IMC during SMBUS_BLOCK_DATA
  i2c: piix4: Fix SMBus port selection for AMD Family 17h chips
  i2c: imx: fix misleading bus recovery debug message
  i2c: imx: use IRQF_SHARED mode to request IRQ
  i2c: ismt: Separate I2C block read from SMBus block read
2017-10-20 06:32:26 -04:00
Linus Torvalds 03b652e5c0 Merge branch 'fixes-v4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
Pull key handling fixes from James Morris:
 "This includes a fix for the capabilities code from Colin King, and a
  set of further fixes for the keys subsystem. From David:

   - Fix a bunch of places where kernel drivers may access revoked
     user-type keys and don't do it correctly.

   - Fix some ecryptfs bits.

   - Fix big_key to require CONFIG_CRYPTO.

   - Fix a couple of bugs in the asymmetric key type.

   - Fix a race between updating and finding negative keys.

   - Prevent add_key() from updating uninstantiated keys.

   - Make loading of key flags and expiry time atomic when not holding
     locks"

* 'fixes-v4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  commoncap: move assignment of fs_ns to avoid null pointer dereference
  pkcs7: Prevent NULL pointer dereference, since sinfo is not always set.
  KEYS: load key flags and expiry time atomically in proc_keys_show()
  KEYS: Load key expiry time atomically in keyring_search_iterator()
  KEYS: load key flags and expiry time atomically in key_validate()
  KEYS: don't let add_key() update an uninstantiated key
  KEYS: Fix race between updating and finding a negative key
  KEYS: checking the input id parameters before finding asymmetric key
  KEYS: Fix the wrong index when checking the existence of second id
  security/keys: BIG_KEY requires CONFIG_CRYPTO
  ecryptfs: fix dereference of NULL user_key_payload
  fscrypt: fix dereference of NULL user_key_payload
  lib/digsig: fix dereference of NULL user_key_payload
  FS-Cache: fix dereference of NULL user_key_payload
  KEYS: encrypted: fix dereference of NULL user_key_payload
2017-10-20 06:19:38 -04:00
Jaejoong Kim 1c236d411d usb: misc: usbtest: remove duplicate & operation
usb_endpoint_maxp() has an inline keyword and searches for bits[10:0]
by & operation with 0x7ff. So, we can remove the duplicate & operation
with 0x7ff.

Signed-off-by: Jaejoong Kim <climbbb.kim@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2017-10-20 11:19:39 +03:00
Jaejoong Kim 7521d47960 usb: gadget: udc: gr: remove duplicate & operation
usb_endpoint_maxp() has an inline keyword and searches for bits[10:0]
by & operation with 0x7ff. So, we can remove the duplicate & operation
with 0x7ff.

Signed-off-by: Jaejoong Kim <climbbb.kim@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2017-10-20 11:19:32 +03:00
Jaejoong Kim 99bcb23851 usb: gadget: udc: remove duplicate & operation
usb_endpoint_maxp() has an inline keyword and searches for bits[10:0]
by & operation with 0x7ff. So, we can remove the duplicate & operation
with 0x7ff.

Signed-off-by: Jaejoong Kim <climbbb.kim@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2017-10-20 11:19:24 +03:00
Craig Bergstrom ce56a86e2a x86/mm: Limit mmap() of /dev/mem to valid physical addresses
Currently, it is possible to mmap() any offset from /dev/mem.  If a
program mmaps() /dev/mem offsets outside of the addressable limits
of a system, the page table can be corrupted by setting reserved bits.

For example if you mmap() offset 0x0001000000000000 of /dev/mem on an
x86_64 system with a 48-bit bus, the page fault handler will be called
with error_code set to RSVD.  The kernel then crashes with a page table
corruption error.

This change prevents this page table corruption on x86 by refusing
to mmap offsets higher than the highest valid address in the system.

Signed-off-by: Craig Bergstrom <craigb@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Luis R. Rodriguez <mcgrof@suse.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Toshi Kani <toshi.kani@hp.com>
Cc: dsafonov@virtuozzo.com
Cc: kirill.shutemov@linux.intel.com
Cc: mhocko@suse.com
Cc: oleg@redhat.com
Link: http://lkml.kernel.org/r/20171019192856.39672-1-craigb@google.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-10-20 09:48:00 +02:00
Kamalesh Babulal b703798386 objtool: Fix memory leak in decode_instructions()
When an error occurs before adding an allocated insn to the list, free
it before returning.

Signed-off-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/336da800bf6070eae11f4e0a3b9ca64c27658114.1508430423.git.jpoimboe@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-10-20 09:43:21 +02:00
Ingo Molnar 275d34b825 perf/urgent fixes:
- Fix crash in perf_hpp__reset_output_field() (Jiri Olsa)
 
 - Fix eBPF file/vendor events ambiguity in event specification (Jiri Olsa)
 
 - Fix closing evsel fd in 'perf stat' (Jin Yao)
 
 - Make perf test shell trace+probe_libc_inet_pton.sh pass in Debian/Ubuntu (Li Zhijian)
 
 - Fix 'perf buildid-list --with-hits' crash when processing PERF_RECORD_NAMESPACE (Namhyung Kim)
 
 - Fix documentation for a inexistent option 'perf record -l' (Taeung Song)
 
 - Add long time reviewers to MAINTAINERS (Arnaldo Carvalho de Melo)
 
 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEELb9bqkb7Te0zijNb1lAW81NSqkAFAlno4cEACgkQ1lAW81NS
 qkBAlhAAk9LUUvFLLB2R2U33qoLskEL+r88wTdTPQSNf8caCr01m/ae+WiB69MpX
 80WaHzGPXue0NBuWQhaND8/R0muKvDgCDWKSL3yic2Qk2hRe2g1a6I6cjp01hQix
 ajfNu15w2p3awKuXi6xOBRjQM7MiW0zioEURNEuyKlBOKC7VivMHOUJAyZSOkAce
 uFNqfYwS8EPM3FobV+iL7P0R86JdaGc0VZ172gqs9uLgdROtsXms3bbbj/ixTIKG
 Uwl34SUJMhpgk4q1lMJBtps3Ntjtop/0TWJdhhEWRxEQqti8q2JnfXfQHp9miLPu
 k85IH4x3Kxq7ZxNzCqlKFGpLsTq3NQEiT6QDYIjBYcVz7HGgYLzrLAcsIO5+Sh2P
 3iFwALfUGfgTIQoKBz5fVClDDnbCf1GAuZUOUetJSsGzU3dj15R6oMKRZWV12qFr
 rNYWQ+voOV38mCvcGNBCZ8quZelixrLdOACU8mzP0ePWElGnuW4Q7ecIHZuluET+
 9r2pKrPH8Ze3/0w+0CkdxXLB6ZfFS4cxCLR2j0UZxgO/vQKODbwWS6Vak+b6xM50
 TQLS224PIJL0EVC/WTReVkWli3ksTTzcr/E/siv778rD3xhZfEdlUZGuBDZTj3pZ
 Hr0jQsVTWhQNVt1t+xOpRHsL7JZIXNWIT/PSJZAKU9godtoNqp0=
 =nqkB
 -----END PGP SIGNATURE-----

Merge tag 'perf-urgent-for-mingo-4.14-20171019' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent

Pull perf/urgent fixes from Arnaldo Carvalho de Melo:

- Fix crash in perf_hpp__reset_output_field() (Jiri Olsa)

- Fix eBPF file/vendor events ambiguity in event specification (Jiri Olsa)

- Fix closing evsel fd in 'perf stat' (Jin Yao)

- Make perf test shell trace+probe_libc_inet_pton.sh pass in Debian/Ubuntu (Li Zhijian)

- Fix 'perf buildid-list --with-hits' crash when processing PERF_RECORD_NAMESPACE (Namhyung Kim)

- Fix documentation for an inexistent option 'perf record -l' (Taeung Song)

- Add long time reviewers to MAINTAINERS (Arnaldo Carvalho de Melo)

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-10-20 09:14:06 +02:00
Stefan Roese c5709d3769 dmaengine: altera: Use IRQ-safe spinlock calls in the error paths as well
The patch edf10919 [dmaengine: altera: fix spinlock usage] missed to
change 2 occurrences of spin_unlock_bh() to spin_unlock_irqrestore().
This patch fixes this by moving to the IRQ-safe call in the error
paths as well.

Fixes: edf10919 (dmaengine: altera: fix spinlock usage)
Signed-off-by: Stefan Roese <sr@denx.de>
Reviewed-by: Sylvain Lesne <lesne@alse-fr.com>
[add fixes tag and fix typo in log]
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2017-10-20 11:51:10 +05:30
Linus Torvalds ce43f4fd6f Power management fix for v4.14-rc6
This reverts a problematic commit modifying the turbostat
 utility that went in during the 4.13 cycle (Len Brown).
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJZ6Sp6AAoJEILEb/54YlRxt+4QAIZUZUiOgnm+xnTt/jO+RFqn
 QhemEUf5pJFvt0HGdIOaA4VzicyAaSnA1+QoSiHJhIk8itsVCnI9COpfb0BwYvnU
 B26gtT0+H+pvu2PVSVrihZZ27S5zJfIZ+3bfSqMUB/uvvIkRVD0g7OMBNPPttGVz
 iF1HRWOgK4w88zy2MNyvdmqagOwAdnptMB3RCasAIh4HlOkdAeJ0qGsru0UKxKd1
 mZGp2WxHE66cTNAheX/ONyK0N1X+4WiCcxuUTGa0O3YyT6Ll3FbWbxsh7GcmJ7aa
 +UpOXDPKBzsZzjHUB+a8rECChbtrzEAJ1AJc2QB0ZPw2Id1Fo6rxgkMCs+YoNDiz
 mBqhGAF9VcD9az9DqbMEHwkWHiOTEjgsUwKAVFEYV23nm5sTGIBVc5W/0StG8Kz7
 IQeeapN9kqc2ty+lD8cCfC+NU1EVn3Ca5s85vnWnK3bmmolHEVpzdUzLc9vYrFnP
 JKkNA2n3/9UvC3DRDr7ykD0wro77yA/mcjRLHmMxleLo7YEKZF1aPmsiOlgJiP5K
 LTnkpnhUSIz7W/9v1Gh2pYpiwppJBgp5RXZGXGY/vTA42t0HZeZquGgNub5b0ys7
 +JPrb5jlgYmg4DXXWT2htq8cjTisxJI+6uAtD7oULondtMISZCWtm0CMxgksmATA
 567h1DJHd0zvO7r7mlRa
 =i876
 -----END PGP SIGNATURE-----

Merge tag 'pm-4.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management fix from Rafael Wysocki:
 "This reverts a problematic commit modifying the turbostat utility that
  went in during the 4.13 cycle (Len Brown)"

* tag 'pm-4.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  Revert "tools/power turbostat: stop migrating, unless '-m'"
2017-10-19 22:49:21 -04:00
Paul E. McKenney 27fdb35fe9 doc: Fix various RCU docbook comment-header problems
Because many of RCU's files have not been included into docbook, a
number of errors have accumulated.  This commit fixes them.

Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-10-19 22:26:11 -04:00
Paul E. McKenney 533966c8ad doc: Fix RCU's docbook options
Commit 764f80798b ("doc: Add RCU files to docbook-generation files")
added :external: options for RCU source files in the file
Documentation/core-api/kernel-api.rst.  However, this now means nothing,
so this commit removes them.

Reported-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: Akira Yokosawa <akiyks@gmail.com>
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-10-19 22:26:11 -04:00
Mathieu Desnoyers a961e40917 membarrier: Provide register expedited private command
This introduces a "register private expedited" membarrier command which
allows eventual removal of important memory barrier constraints on the
scheduler fast-paths. It changes how the "private expedited" membarrier
command (new to 4.14) is used from user-space.

This new command allows processes to register their intent to use the
private expedited command.  This affects how the expedited private
command introduced in 4.14-rc is meant to be used, and should be merged
before 4.14 final.

Processes are now required to register before using
MEMBARRIER_CMD_PRIVATE_EXPEDITED, otherwise that command returns EPERM.

This fixes a problem that arose when designing requested extensions to
sys_membarrier() to allow JITs to efficiently flush old code from
instruction caches.  Several potential algorithms are much less painful
if the user register intent to use this functionality early on, for
example, before the process spawns the second thread.  Registering at
this time removes the need to interrupt each and every thread in that
process at the first expedited sys_membarrier() system call.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-10-19 22:13:40 -04:00
Dmitry Torokhov ea04efee76 Input: ims-psu - check if CDC union descriptor is sane
Before trying to use CDC union descriptor, try to validate whether that it
is sane by checking that intf->altsetting->extra is big enough and that
descriptor bLength is not too big and not too small.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2017-10-19 17:20:06 -07:00
Roderick Colenbrander 20ac95d52a Input: joydev - blacklist ds3/ds4/udraw motion sensors
Introduce a device table used for blacklisting devices. We currently
blacklist the motion sensor subdevice of THQ Udraw and Sony ds3/ds4.

Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
[dtor: siwtched to blacklist built on input_device_id and using
input_match_device_id()]
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2017-10-19 16:55:39 -07:00
Dmitry Torokhov 8724ecb072 Input: allow matching device IDs on property bits
Let's allow matching input devices on their property bits, both in-kernel
and when generating module aliases.

Tested-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2017-10-19 16:54:49 -07:00
Dmitry Torokhov 55dfce873d Input: factor out and export input_device_id matching code
Factor out and export input_match_device_id() so that modules may use it.
It will be needed by joydev to blacklist accelerometers in composite
devices.

Tested-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2017-10-19 16:53:34 -07:00
Paul Cercueil 9b5db7aab4 Input: goodix - poll the 'buffer status' bit before reading data
The Goodix panel triggers an interrupt on touch events. However, its
registers will contain the valid values a short time after the
interrupt, and not when it's raised. At that moment, the 'buffer status'
bit is set.

Previously, if the 'buffer status' bit was not set when the registers
were read, the data was discarded and no input event was emitted,
causing "finger down" or "finger up" events to be missed sometimes.

This went unnoticed until v4.9, as the DesignWare I2C driver commonly
used with this driver had enough latency for that bug to never trigger
until commit 2702ea7dbe ("i2c: designware: wait for disable/enable only
if necessary").

Now, in the IRQ handler we will poll (with a timeout) the 'buffer status'
bit and process the data of the panel as soon as this bit gets set.

Note that the Goodix panel will send a few spurious interrupts after the
'finger up' event, in which the 'buffer status' bit will never be set.

Cc: Bastien Nocera <hadess@hadess.net>
Cc: russianneuromancer@ya.ru
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
[hdegoede@redhat.com: Change poll loop to use jiffies,
                      add comment about typical poll time]
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
[dtor: rearranged control flow a bit to avoid explicit goto and double
check]
Reviewed-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2017-10-19 16:50:39 -07:00