Commit Graph

29242 Commits

Author SHA1 Message Date
Huacai Chen
d39c24f5c2 UPSTREAM: timekeeping/vsyscall: Update VDSO data unconditionally
The update of the VDSO data is depending on __arch_use_vsyscall() returning
True. This is a leftover from the attempt to map the features of various
architectures 1:1 into generic code.

The usage of __arch_use_vsyscall() in the actual vsyscall implementations
got dropped and replaced by the requirement for the architecture code to
return U64_MAX if the global clocksource is not usable in the VDSO.

But the __arch_use_vsyscall() check in the update code stayed which causes
the VDSO data to be stale or invalid when an architecture actually
implements that function and returns False when the current clocksource is
not usable in the VDSO.

As a consequence the VDSO implementations of clock_getres(), time(),
clock_gettime(CLOCK_.*_COARSE) operate on invalid data and return bogus
information.

Remove the __arch_use_vsyscall() check from the VDSO update function and
update the VDSO data unconditionally.

[ tglx: Massaged changelog and removed the now useless implementations in
  	asm-generic/ARM64/MIPS ]

Fixes: 44f57d788e ("timekeeping: Provide a generic update_vsyscall() implementation")
Signed-off-by: Huacai Chen <chenhc@lemote.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Paul Burton <paul.burton@mips.com>
Cc: linux-mips@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/1571887709-11447-1-git-send-email-chenhc@lemote.com
(cherry picked from commit 52338415cf)
Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Bug: 158635600
Bug: 154668398
Bug: 157925983
Change-Id: I71691d3011a96256d1ce01718d3f0fdc0778920e
2020-06-15 15:23:37 +00:00
Greg Kroah-Hartman
d8cc60ec42 This is the 4.19.128 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7hNfEACgkQONu9yGCS
 aT5aTxAAtqnRa7AYVX4u/pXURNOTJ4pWjI0kL2P9GBncphzLWVuvJ2GgXg12L5ZO
 gqZww3Qha9XRYtx+6KBOnG6BaH+4xVhAh1SxbVxrpkfjwQTCd/+3kI6YszKxnKV8
 eg0lf8ZMaF9zZkEqlMUINASvQfS0yJu68VsiCKuJOTiakVBdxNbCKAxhzdcVat3w
 JKUYR3M+EF4kEgytL2qr0rhyiEKCOu7zf1KDgQvuqJDiB68gepsyRPDDJzO8ttDd
 NWxyTb0JPu19AVZjlAG+YhnFrQRKrhD+ToQ44t3ze3/TXZ2PqsgYa2MqvZDLBOEe
 JxGV+3k7BINlCoz/1T9wm9JJKTanvWAFd9URmxcqwZRKddcX2gumbzpObEQ/o/Xg
 I/AjXAcNV3jWSCeVXkiXe598RPvJpn65Khg8NBojUSTN0prZCwGw9BrISKtIWhT3
 CBjzaXfbCQjMgetMoChVQzHzVPIZ80VrX0QXFOy4mJ6qixKmLU6UZPE7IeGc2MT8
 okVN+QxCkKE5TKF0YTepT8MNiKdmphEIRG266V+wZn9546NB2iQRq+6TgvvPhtSh
 9q9e0Z37ynTHaYFAUYM9u5VEzaGB1+cuq1mz1RVLwfU6aFhw2pcsSzWeroWODGKO
 Fm8YbEOFXNb6riHlQrdUrOoZ7uHg4/m40lv0GM90l2BsMRqPrhY=
 =w9Sc
 -----END PGP SIGNATURE-----

Merge 4.19.128 into android-4.19-stable

Changes in 4.19.128
	devinet: fix memleak in inetdev_init()
	l2tp: add sk_family checks to l2tp_validate_socket
	l2tp: do not use inet_hash()/inet_unhash()
	net: usb: qmi_wwan: add Telit LE910C1-EUX composition
	NFC: st21nfca: add missed kfree_skb() in an error path
	vsock: fix timeout in vsock_accept()
	net: check untrusted gso_size at kernel entry
	USB: serial: qcserial: add DW5816e QDL support
	USB: serial: usb_wwan: do not resubmit rx urb on fatal errors
	USB: serial: option: add Telit LE910C1-EUX compositions
	iio: vcnl4000: Fix i2c swapped word reading.
	usb: musb: start session in resume for host port
	usb: musb: Fix runtime PM imbalance on error
	vt: keyboard: avoid signed integer overflow in k_ascii
	tty: hvc_console, fix crashes on parallel open/close
	staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK
	CDC-ACM: heed quirk also in error handling
	nvmem: qfprom: remove incorrect write support
	x86/cpu: Add a steppings field to struct x86_cpu_id
	x86/cpu: Add 'table' argument to cpu_matches()
	x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation
	x86/speculation: Add SRBDS vulnerability and mitigation documentation
	x86/speculation: Add Ivy Bridge to affected list
	uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned
	Revert "net/mlx5: Annotate mutex destroy for root ns"
	Linux 4.19.128

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: If3a899efc4809d24257107dd0016a97beb3cb6e9
2020-06-11 09:16:29 +02:00
Oleg Nesterov
0f008dc311 uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned
commit 013b2deba9 upstream.

uprobe_write_opcode() must not cross page boundary; prepare_uprobe()
relies on arch_uprobe_analyze_insn() which should validate "vaddr" but
some architectures (csky, s390, and sparc) don't do this.

We can remove the BUG_ON() check in prepare_uprobe() and validate the
offset early in __uprobe_register(). The new IS_ALIGNED() check matches
the alignment check in arch_prepare_kprobe() on supported architectures,
so I think that all insns must be aligned to UPROBE_SWBP_INSN_SIZE.

Another problem is __update_ref_ctr() which was wrong from the very
beginning, it can read/write outside of kmap'ed page unless "vaddr" is
aligned to sizeof(short), __uprobe_register() should check this too.

Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
Tested-by: Sven Schnelle <svens@linux.ibm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[ check for ref_ctr_offset removed for backport - gregkh ]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-06-10 21:35:01 +02:00
Greg Kroah-Hartman
8f1ab4ae37 This is the 4.19.127 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7czOcACgkQONu9yGCS
 aT4XBBAAvMwls1yBK2I/9kWES9aZv0zjHIGl9LimzsTysEDo+4gFGJU8fZoIH2T/
 pFbUtmFMyvnAYXTg7QbDBGnzriflufekyBKlPlNqDmq3zv6kD9x6VklowZmW4c4m
 TkIeXTyhiZVLpYhJy5LGwmzEAJ8ZABbqq2YghSqWhvldYdDLT/bfXe+jEKildM7h
 4YVtudfDrryK2pLo8rI3acWfoVnbRiuX7B77DJ+3qI0r1vps25Ht7lg957wvqMqC
 LbSrnrOxp3WaSgnCqBEUvMTP2G+JPgXeFF9LdmktjwiWT5yGsBPHb6EDeEZ4to9d
 WuSWttlRjAkwK1oe2Z0Er5Hahb98ZrIFmQsjuNpMGO29pT0IGbmOS6KJMz4uGhC0
 5NUcf6Fcnez05B9Pi2XljlwaCLv/xyz4lPyqSs/KHyu4GxsOeeHrVpnHY5Ei41N2
 Ujglqy0tNV1rgRZZCEQA7rGzvLta0JC3SEqeqcJFahvL+NYLRP/WK7eCGuzOUuMs
 vv727ewOj5znb9f4UHCLFB9au0YsjaPvsEhw9pfoePVMpOt+25kS96z872VnUsUV
 tESAK7+BAIQDV6Q63S9MrNEJPBLUEFnA4J2WrwE9+6v19Az0usH8hlB0Swxhn7xn
 B6q4d17FhNSyXFbqJYjcT0ddWVv5qDIyuLbTB8EdxH3D+cRfuAM=
 =+xz9
 -----END PGP SIGNATURE-----

Merge 4.19.127 into android-4.19-stable

Changes in 4.19.127
	Revert "cgroup: Add memory barriers to plug cgroup_rstat_updated() race window"
	libnvdimm: Fix endian conversion issues 
	mm: Fix mremap not considering huge pmd devmap
	HID: sony: Fix for broken buttons on DS3 USB dongles
	HID: i2c-hid: add Schneider SCL142ALM to descriptor override
	p54usb: add AirVasT USB stick device-id
	kernel/relay.c: handle alloc_percpu returning NULL in relay_open
	mmc: fix compilation of user API
	scsi: ufs: Release clock if DMA map fails
	net: dsa: mt7530: set CPU port to fallback mode
	airo: Fix read overflows sending packets
	drm/i915: fix port checks for MST support on gen >= 11
	scsi: hisi_sas: Check sas_port before using it
	powerpc/powernv: Avoid re-registration of imc debugfs directory
	spi: dw: use "smp_mb()" to avoid sending spi data error
	s390/ftrace: save traced function caller
	ARC: Fix ICCM & DCCM runtime size checks
	ARC: [plat-eznps]: Restrict to CONFIG_ISA_ARCOMPACT
	evm: Fix RCU list related warnings
	i2c: altera: Fix race between xfer_msg and isr thread
	x86/mmiotrace: Use cpumask_available() for cpumask_var_t variables
	net: bmac: Fix read of MAC address from ROM
	drm/edid: Add Oculus Rift S to non-desktop list
	s390/mm: fix set_huge_pte_at() for empty ptes
	null_blk: return error for invalid zone size
	net/ethernet/freescale: rework quiesce/activate for ucc_geth
	net: ethernet: stmmac: Enable interface clocks on probe for IPQ806x
	net: smsc911x: Fix runtime PM imbalance on error
	Linux 4.19.127

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I0ba65b19a1f1d3d1767e8f5cccef4b2f320cdd59
2020-06-07 14:25:43 +02:00
Daniel Axtens
8b5dfa53ee kernel/relay.c: handle alloc_percpu returning NULL in relay_open
commit 54e200ab40 upstream.

alloc_percpu() may return NULL, which means chan->buf may be set to NULL.
In that case, when we do *per_cpu_ptr(chan->buf, ...), we dereference an
invalid pointer:

  BUG: Unable to handle kernel data access at 0x7dae0000
  Faulting instruction address: 0xc0000000003f3fec
  ...
  NIP relay_open+0x29c/0x600
  LR relay_open+0x270/0x600
  Call Trace:
     relay_open+0x264/0x600 (unreliable)
     __blk_trace_setup+0x254/0x600
     blk_trace_setup+0x68/0xa0
     sg_ioctl+0x7bc/0x2e80
     do_vfs_ioctl+0x13c/0x1300
     ksys_ioctl+0x94/0x130
     sys_ioctl+0x48/0xb0
     system_call+0x5c/0x68

Check if alloc_percpu returns NULL.

This was found by syzkaller both on x86 and powerpc, and the reproducer
it found on powerpc is capable of hitting the issue as an unprivileged
user.

Fixes: 017c59c042 ("relay: Use per CPU constructs for the relay channel buffer pointers")
Reported-by: syzbot+1e925b4b836afe85a1c6@syzkaller-ppc64.appspotmail.com
Reported-by: syzbot+587b2421926808309d21@syzkaller-ppc64.appspotmail.com
Reported-by: syzbot+58320b7171734bf79d26@syzkaller.appspotmail.com
Reported-by: syzbot+d6074fb08bdb2e010520@syzkaller.appspotmail.com
Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Michael Ellerman <mpe@ellerman.id.au>
Reviewed-by: Andrew Donnellan <ajd@linux.ibm.com>
Acked-by: David Rientjes <rientjes@google.com>
Cc: Akash Goel <akash.goel@intel.com>
Cc: Andrew Donnellan <ajd@linux.ibm.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Salvatore Bonaccorso <carnil@debian.org>
Cc: <stable@vger.kernel.org>	[4.10+]
Link: http://lkml.kernel.org/r/20191219121256.26480-1-dja@axtens.net
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-06-07 13:17:54 +02:00
Tejun Heo
7cbf0e5cea Revert "cgroup: Add memory barriers to plug cgroup_rstat_updated() race window"
[ Upstream commit d8ef4b38cb ]

This reverts commit 9a9e97b2f1 ("cgroup: Add memory barriers to plug
cgroup_rstat_updated() race window").

The commit was added in anticipation of memcg rstat conversion which needed
synchronous accounting for the event counters (e.g. oom kill count). However,
the conversion didn't get merged due to percpu memory overhead concern which
couldn't be addressed at the time.

Unfortunately, the patch's addition of smp_mb() to cgroup_rstat_updated()
meant that every scheduling event now had to go through an additional full
barrier and Mel Gorman noticed it as 1% regression in netperf UDP_STREAM test.

There's no need to have this barrier in tree now and even if we need
synchronous accounting in the future, the right thing to do is separating that
out to a separate function so that hot paths which don't care about
synchronous behavior don't have to pay the overhead of the full barrier. Let's
revert.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Mel Gorman <mgorman@techsingularity.net>
Link: http://lkml.kernel.org/r/20200409154413.GK3818@techsingularity.net
Cc: v4.18+
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-06-07 13:17:53 +02:00
Neal Liu
993c7bb78b ANDROID: modules: fix lockprove warning
Need to disable preemption before using rcu_dereference_sched().

Bug: 157383682
Change-Id: I5f7c0a222bac35c5fa58cdd9f4cf71cb422a01cd
Signed-off-by: Neal Liu <neal.liu@mediatek.com>
2020-06-02 16:12:24 +00:00
Greg Kroah-Hartman
a483478041 This is the 4.19.125 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7OiwEACgkQONu9yGCS
 aT6VuBAA041WkiGELfxgOZM4dsjl4h+q91tJb4Hg8labIH3psp762dnQDF41xO+v
 mXUQ84y8cSUAY9/KJ1Bf/4vPPJKI3+/Ce2lD/tjBArbj/GL25QBlQbH22UtU255X
 Km7lpEwjcsRu+y99f31DhASE41QQRSAeY11YgCdFVC3P8npTGX8YnlwsP/pNEBkB
 mVclgabmNsZ7IuF/NhUGJoQJarFJRQ3lIJxOJSS/9tcewsuTQLoDUz7q9eo7K6Oe
 OC3kgtfgN9I+afjcjx47PzurvG9HlZQNBSkh3XSE46LGzgULxd1eMZ04CAFAAhvY
 V8YjoSXQxtKxLkNuah0nyW/1ej9B8nMtRcfjfbHTaDr5+I0gssDvuypkJx2VVHKL
 G0JdZhOwsUOVxecZ1uQ8W9GtERZvyBQF4kWoD2UYMw9CIlz5ZYAGAQ+SMqv49Fkx
 BIBA8LWXN7Z62GAw2tYcylElXfImUZjCq6GbZM3+iR2G9LC7dPothUldhGRgtxSb
 CzKBwwEIGdDIaVTVdnRF+UKdQhyRe3YgkvzFJGT9FoiXuw/50BGIEJZw0iai4VZo
 0+IxM0a+mvsA3IID4M0SQBC0+CxR0PoWI7CxeOInmlGz9QDjPwKSpJXHuO51lycD
 uGT0DLjP3VMNaalB13EJvsh98ddFgB1utumn/IdLzP477F3uBiw=
 =0DXr
 -----END PGP SIGNATURE-----

Merge 4.19.125 into android-4.19-stable

Changes in 4.19.125
	x86/uaccess, ubsan: Fix UBSAN vs. SMAP
	ubsan: build ubsan.c more conservatively
	i2c: dev: Fix the race between the release of i2c_dev and cdev
	KVM: SVM: Fix potential memory leak in svm_cpu_init()
	riscv: set max_pfn to the PFN of the last page
	ima: Set file->f_mode instead of file->f_flags in ima_calc_file_hash()
	evm: Check also if *tfm is an error pointer in init_desc()
	ima: Fix return value of ima_write_policy()
	mtd: spinand: Propagate ECC information to the MTD structure
	fix multiplication overflow in copy_fdtable()
	ubifs: remove broken lazytime support
	iommu/amd: Fix over-read of ACPI UID from IVRS table
	i2c: mux: demux-pinctrl: Fix an error handling path in 'i2c_demux_pinctrl_probe()'
	ubi: Fix seq_file usage in detailed_erase_block_info debugfs file
	gcc-common.h: Update for GCC 10
	HID: multitouch: add eGalaxTouch P80H84 support
	HID: alps: Add AUI1657 device ID
	HID: alps: ALPS_1657 is too specific; use U1_UNICORN_LEGACY instead
	scsi: qla2xxx: Fix hang when issuing nvme disconnect-all in NPIV
	scsi: qla2xxx: Delete all sessions before unregister local nvme port
	configfs: fix config_item refcnt leak in configfs_rmdir()
	vhost/vsock: fix packet delivery order to monitoring devices
	aquantia: Fix the media type of AQC100 ethernet controller in the driver
	component: Silence bind error on -EPROBE_DEFER
	scsi: ibmvscsi: Fix WARN_ON during event pool release
	HID: i2c-hid: reset Synaptics SYNA2393 on resume
	x86/apic: Move TSC deadline timer debug printk
	gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp()
	HID: quirks: Add HID_QUIRK_NO_INIT_REPORTS quirk for Dell K12A keyboard-dock
	ceph: fix double unlock in handle_cap_export()
	stmmac: fix pointer check after utilization in stmmac_interrupt
	USB: core: Fix misleading driver bug report
	platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA
	ARM: futex: Address build warning
	padata: Replace delayed timer with immediate workqueue in padata_reorder
	padata: initialize pd->cpu with effective cpumask
	padata: purge get_cpu and reorder_via_wq from padata_do_serial
	ALSA: iec1712: Initialize STDSP24 properly when using the model=staudio option
	ALSA: pcm: fix incorrect hw_base increase
	ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Xtreme
	ALSA: hda/realtek - Add more fixup entries for Clevo machines
	drm/etnaviv: fix perfmon domain interation
	apparmor: Fix use-after-free in aa_audit_rule_init
	apparmor: fix potential label refcnt leak in aa_change_profile
	apparmor: Fix aa_label refcnt leak in policy_update
	dmaengine: tegra210-adma: Fix an error handling path in 'tegra_adma_probe()'
	dmaengine: owl: Use correct lock in owl_dma_get_pchan()
	drm/i915/gvt: Init DPLL/DDI vreg for virtual display instead of inheritance.
	powerpc: Remove STRICT_KERNEL_RWX incompatibility with RELOCATABLE
	powerpc/64s: Disable STRICT_KERNEL_RWX
	nfit: Add Hyper-V NVDIMM DSM command set to white list
	libnvdimm/btt: Remove unnecessary code in btt_freelist_init
	libnvdimm/btt: Fix LBA masking during 'free list' population
	staging: most: core: replace strcpy() by strscpy()
	thunderbolt: Drop duplicated get_switch_at_route()
	media: fdp1: Fix R-Car M3-N naming in debug message
	Revert "net/ibmvnic: Fix EOI when running in XIVE mode"
	net: bcmgenet: code movement
	net: bcmgenet: abort suspend on error
	cxgb4: free mac_hlist properly
	cxgb4/cxgb4vf: Fix mac_hlist initialization and free
	tty: serial: qcom_geni_serial: Fix wrap around of TX buffer
	brcmfmac: abort and release host after error
	Revert "gfs2: Don't demote a glock until its revokes are written"
	staging: iio: ad2s1210: Fix SPI reading
	staging: greybus: Fix uninitialized scalar variable
	iio: sca3000: Remove an erroneous 'get_device()'
	iio: dac: vf610: Fix an error handling path in 'vf610_dac_probe()'
	misc: rtsx: Add short delay after exit from ASPM
	mei: release me_cl object reference
	ipack: tpci200: fix error return code in tpci200_register()
	rapidio: fix an error in get_user_pages_fast() error handling
	rxrpc: Fix a memory leak in rxkad_verify_response()
	x86/unwind/orc: Fix unwind_get_return_address_ptr() for inactive tasks
	iio: adc: stm32-adc: Use dma_request_chan() instead dma_request_slave_channel()
	iio: adc: stm32-adc: fix device used to request dma
	iio: adc: stm32-dfsdm: Use dma_request_chan() instead dma_request_slave_channel()
	iio: adc: stm32-dfsdm: fix device used to request dma
	rxrpc: Trace discarded ACKs
	rxrpc: Fix ack discard
	Linux 4.19.125

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I7ef4b874ed2ce4f234e2333c751b5dd401746358
2020-05-28 12:20:07 +02:00
Daniel Jordan
189b4cfafe padata: purge get_cpu and reorder_via_wq from padata_do_serial
[ Upstream commit 065cf57713 ]

With the removal of the padata timer, padata_do_serial no longer
needs special CPU handling, so remove it.

Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: linux-crypto@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-05-27 17:37:36 +02:00
Daniel Jordan
1538674cee padata: initialize pd->cpu with effective cpumask
[ Upstream commit ec9c7d1933 ]

Exercising CPU hotplug on a 5.2 kernel with recent padata fixes from
cryptodev-2.6.git in an 8-CPU kvm guest...

    # modprobe tcrypt alg="pcrypt(rfc4106(gcm(aes)))" type=3
    # echo 0 > /sys/devices/system/cpu/cpu1/online
    # echo c > /sys/kernel/pcrypt/pencrypt/parallel_cpumask
    # modprobe tcrypt mode=215

...caused the following crash:

    BUG: kernel NULL pointer dereference, address: 0000000000000000
    #PF: supervisor read access in kernel mode
    #PF: error_code(0x0000) - not-present page
    PGD 0 P4D 0
    Oops: 0000 [#1] SMP PTI
    CPU: 2 PID: 134 Comm: kworker/2:2 Not tainted 5.2.0-padata-base+ #7
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-<snip>
    Workqueue: pencrypt padata_parallel_worker
    RIP: 0010:padata_reorder+0xcb/0x180
    ...
    Call Trace:
     padata_do_serial+0x57/0x60
     pcrypt_aead_enc+0x3a/0x50 [pcrypt]
     padata_parallel_worker+0x9b/0xe0
     process_one_work+0x1b5/0x3f0
     worker_thread+0x4a/0x3c0
     ...

In padata_alloc_pd, pd->cpu is set using the user-supplied cpumask
instead of the effective cpumask, and in this case cpumask_first picked
an offline CPU.

The offline CPU's reorder->list.next is NULL in padata_reorder because
the list wasn't initialized in padata_init_pqueues, which only operates
on CPUs in the effective mask.

Fix by using the effective mask in padata_alloc_pd.

Fixes: 6fc4dbcf02 ("padata: Replace delayed timer with immediate workqueue in padata_reorder")
Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: linux-crypto@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-05-27 17:37:35 +02:00
Herbert Xu
4252abf742 padata: Replace delayed timer with immediate workqueue in padata_reorder
[ Upstream commit 6fc4dbcf02 ]

The function padata_reorder will use a timer when it cannot progress
while completed jobs are outstanding (pd->reorder_objects > 0).  This
is suboptimal as if we do end up using the timer then it would have
introduced a gratuitous delay of one second.

In fact we can easily distinguish between whether completed jobs
are outstanding and whether we can make progress.  All we have to
do is look at the next pqueue list.

This patch does that by replacing pd->processed with pd->cpu so
that the next pqueue is more accessible.

A work queue is used instead of the original try_again to avoid
hogging the CPU.

Note that we don't bother removing the work queue in
padata_flush_queues because the whole premise is broken.  You
cannot flush async crypto requests so it makes no sense to even
try.  A subsequent patch will fix it by replacing it with a ref
counting scheme.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
[dj: - adjust context
     - corrected setup_timer -> timer_setup to delete hunk
     - skip padata_flush_queues() hunk, function already removed
       in 4.19]
Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-05-27 17:37:35 +02:00
Linus Torvalds
ec22322218 Stop the ad-hoc games with -Wno-maybe-initialized
commit 78a5255ffb upstream.

We have some rather random rules about when we accept the
"maybe-initialized" warnings, and when we don't.

For example, we consider it unreliable for gcc versions < 4.9, but also
if -O3 is enabled, or if optimizing for size.  And then various kernel
config options disabled it, because they know that they trigger that
warning by confusing gcc sufficiently (ie PROFILE_ALL_BRANCHES).

And now gcc-10 seems to be introducing a lot of those warnings too, so
it falls under the same heading as 4.9 did.

At the same time, we have a very straightforward way to _enable_ that
warning when wanted: use "W=2" to enable more warnings.

So stop playing these ad-hoc games, and just disable that warning by
default, with the known and straight-forward "if you want to work on the
extra compiler warnings, use W=123".

Would it be great to have code that is always so obvious that it never
confuses the compiler whether a variable is used initialized or not?
Yes, it would.  In a perfect world, the compilers would be smarter, and
our source code would be simpler.

That's currently not the world we live in, though.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-20 08:18:45 +02:00
Masahiro Yamada
9088569b56 kbuild: compute false-positive -Wmaybe-uninitialized cases in Kconfig
commit b303c6df80 upstream.

Since -Wmaybe-uninitialized was introduced by GCC 4.7, we have patched
various false positives:

 - commit e74fc973b6 ("Turn off -Wmaybe-uninitialized when building
   with -Os") turned off this option for -Os.

 - commit 815eb71e71 ("Kbuild: disable 'maybe-uninitialized' warning
   for CONFIG_PROFILE_ALL_BRANCHES") turned off this option for
   CONFIG_PROFILE_ALL_BRANCHES

 - commit a76bcf557e ("Kbuild: enable -Wmaybe-uninitialized warning
   for "make W=1"") turned off this option for GCC < 4.9
   Arnd provided more explanation in https://lkml.org/lkml/2017/3/14/903

I think this looks better by shifting the logic from Makefile to Kconfig.

Link: https://github.com/ClangBuiltLinux/linux/issues/350
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-20 08:18:45 +02:00
Greg Kroah-Hartman
bedd88210d This is the 4.19.123 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl683cUACgkQONu9yGCS
 aT5x4w//UnAlC9sNBtBJwPEYwVlt5pS1+RvCbhS8MBmBvJ0f7noquOqMQ07c0lRI
 Ku9XUUHRYu9/EjvM7hQ319qxX5iwnfJLRnmhYuCQN1gI6w9zJNBEzQrBfr+qvvpI
 2l8/io4uqqI8Yq7y9X59Vx3g+8IHiXyte6zBGpj3sdxUm5crxDyUfNnQhVDQ2Gx9
 JpGre1Gf8uhlcLdzX5HwS4zeGIIpAF+P+OR4xOp2BXWdxH9BoGKCcmebaIoM5phP
 bfWvk/z6i4WFFqfueJS8nY4cjchPhDH6U+O/TSCw82QWRd9WXt9N/m+pg0WVRMyd
 MVWhyVLZbJNFL6b/xHSf810jeglmLgv/diZ/YY73qBVrAyzNHv5NvpQyJcpkxKHR
 UyXWcaNEOgzXogtwm5diZ6KDicHmrDADC5DsnoD7XmxzLytMcvSD/e707a3NFvBp
 7oC96SI7u8tWyxnqVB7POE0DG1+daOhwvZdixe/7onoKZAuCCp/TyzAIbBn06uy4
 +qOKbZqVbGbLZC7HsVtXP8jx/uC/+DCsEc+9d896uy2uIiA84QAmD94TOvYqapXV
 G5CfR+SuQYKAUZdFPyGJW6pyJCxULhbBJIMWgMjlaaOIEJfYP40EUM56qlN9eW4k
 JNBLEVpLjjf53JDUfSB5ErPb0GhLTYxvDSLc4vZBkkbiiDDd5CI=
 =GpM7
 -----END PGP SIGNATURE-----

Merge 4.19.123 into android-4.19

Changes in 4.19.123
	USB: serial: qcserial: Add DW5816e support
	tracing/kprobes: Fix a double initialization typo
	vt: fix unicode console freeing with a common interface
	dp83640: reverse arguments to list_add_tail
	fq_codel: fix TCA_FQ_CODEL_DROP_BATCH_SIZE sanity checks
	net: macsec: preserve ingress frame ordering
	net/mlx4_core: Fix use of ENOSPC around mlx4_counter_alloc()
	net_sched: sch_skbprio: add message validation to skbprio_change()
	net: usb: qmi_wwan: add support for DW5816e
	sch_choke: avoid potential panic in choke_reset()
	sch_sfq: validate silly quantum values
	tipc: fix partial topology connection closure
	bnxt_en: Fix VLAN acceleration handling in bnxt_fix_features().
	net/mlx5: Fix forced completion access non initialized command entry
	net/mlx5: Fix command entry leak in Internal Error State
	bnxt_en: Improve AER slot reset.
	bnxt_en: Fix VF anti-spoof filter setup.
	net: stricter validation of untrusted gso packets
	HID: wacom: Read HID_DG_CONTACTMAX directly for non-generic devices
	sctp: Fix bundling of SHUTDOWN with COOKIE-ACK
	HID: usbhid: Fix race between usbhid_close() and usbhid_stop()
	USB: uas: add quirk for LaCie 2Big Quadra
	USB: serial: garmin_gps: add sanity checking for data length
	tracing: Add a vmalloc_sync_mappings() for safe measure
	KVM: arm: vgic: Fix limit condition when writing to GICD_I[CS]ACTIVER
	KVM: arm64: Fix 32bit PC wrap-around
	arm64: hugetlb: avoid potential NULL dereference
	mm/page_alloc: fix watchdog soft lockups during set_zone_contiguous()
	staging: gasket: Check the return value of gasket_get_bar_index()
	coredump: fix crash when umh is disabled
	KVM: VMX: Explicitly reference RCX as the vmx_vcpu pointer in asm blobs
	KVM: VMX: Mark RCX, RDX and RSI as clobbered in vmx_vcpu_run()'s asm blob
	batman-adv: fix batadv_nc_random_weight_tq
	batman-adv: Fix refcnt leak in batadv_show_throughput_override
	batman-adv: Fix refcnt leak in batadv_store_throughput_override
	batman-adv: Fix refcnt leak in batadv_v_ogm_process
	x86/entry/64: Fix unwind hints in register clearing code
	x86/entry/64: Fix unwind hints in kernel exit path
	x86/entry/64: Fix unwind hints in rewind_stack_do_exit()
	x86/unwind/orc: Don't skip the first frame for inactive tasks
	x86/unwind/orc: Prevent unwinding before ORC initialization
	x86/unwind/orc: Fix error path for bad ORC entry type
	x86/unwind/orc: Fix premature unwind stoppage due to IRET frames
	netfilter: nat: never update the UDP checksum when it's 0
	netfilter: nf_osf: avoid passing pointer to local var
	objtool: Fix stack offset tracking for indirect CFAs
	scripts/decodecode: fix trapping instruction formatting
	ipc/mqueue.c: change __do_notify() to bypass check_kill_permission()
	Linux 4.19.123

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib87d493c94816aa0a0754530669a8bd688964987
2020-05-14 08:54:02 +02:00
Luis Chamberlain
f3a6bc0d47 coredump: fix crash when umh is disabled
commit 3740d93e37 upstream.

Commit 64e90a8acb ("Introduce STATIC_USERMODEHELPER to mediate
call_usermodehelper()") added the optiont to disable all
call_usermodehelper() calls by setting STATIC_USERMODEHELPER_PATH to
an empty string. When this is done, and crashdump is triggered, it
will crash on null pointer dereference, since we make assumptions
over what call_usermodehelper_exec() did.

This has been reported by Sergey when one triggers a a coredump
with the following configuration:

```
CONFIG_STATIC_USERMODEHELPER=y
CONFIG_STATIC_USERMODEHELPER_PATH=""
kernel.core_pattern = |/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e
```

The way disabling the umh was designed was that call_usermodehelper_exec()
would just return early, without an error. But coredump assumes
certain variables are set up for us when this happens, and calls
ile_start_write(cprm.file) with a NULL file.

[    2.819676] BUG: kernel NULL pointer dereference, address: 0000000000000020
[    2.819859] #PF: supervisor read access in kernel mode
[    2.820035] #PF: error_code(0x0000) - not-present page
[    2.820188] PGD 0 P4D 0
[    2.820305] Oops: 0000 [#1] SMP PTI
[    2.820436] CPU: 2 PID: 89 Comm: a Not tainted 5.7.0-rc1+ #7
[    2.820680] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190711_202441-buildvm-armv7-10.arm.fedoraproject.org-2.fc31 04/01/2014
[    2.821150] RIP: 0010:do_coredump+0xd80/0x1060
[    2.821385] Code: e8 95 11 ed ff 48 c7 c6 cc a7 b4 81 48 8d bd 28 ff
ff ff 89 c2 e8 70 f1 ff ff 41 89 c2 85 c0 0f 84 72 f7 ff ff e9 b4 fe ff
ff <48> 8b 57 20 0f b7 02 66 25 00 f0 66 3d 00 8
0 0f 84 9c 01 00 00 44
[    2.822014] RSP: 0000:ffffc9000029bcb8 EFLAGS: 00010246
[    2.822339] RAX: 0000000000000000 RBX: ffff88803f860000 RCX: 000000000000000a
[    2.822746] RDX: 0000000000000009 RSI: 0000000000000282 RDI: 0000000000000000
[    2.823141] RBP: ffffc9000029bde8 R08: 0000000000000000 R09: ffffc9000029bc00
[    2.823508] R10: 0000000000000001 R11: ffff88803dec90be R12: ffffffff81c39da0
[    2.823902] R13: ffff88803de84400 R14: 0000000000000000 R15: 0000000000000000
[    2.824285] FS:  00007fee08183540(0000) GS:ffff88803e480000(0000) knlGS:0000000000000000
[    2.824767] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    2.825111] CR2: 0000000000000020 CR3: 000000003f856005 CR4: 0000000000060ea0
[    2.825479] Call Trace:
[    2.825790]  get_signal+0x11e/0x720
[    2.826087]  do_signal+0x1d/0x670
[    2.826361]  ? force_sig_info_to_task+0xc1/0xf0
[    2.826691]  ? force_sig_fault+0x3c/0x40
[    2.826996]  ? do_trap+0xc9/0x100
[    2.827179]  exit_to_usermode_loop+0x49/0x90
[    2.827359]  prepare_exit_to_usermode+0x77/0xb0
[    2.827559]  ? invalid_op+0xa/0x30
[    2.827747]  ret_from_intr+0x20/0x20
[    2.827921] RIP: 0033:0x55e2c76d2129
[    2.828107] Code: 2d ff ff ff e8 68 ff ff ff 5d c6 05 18 2f 00 00 01
c3 0f 1f 80 00 00 00 00 c3 0f 1f 80 00 00 00 00 e9 7b ff ff ff 55 48 89
e5 <0f> 0b b8 00 00 00 00 5d c3 66 2e 0f 1f 84 0
0 00 00 00 00 0f 1f 40
[    2.828603] RSP: 002b:00007fffeba5e080 EFLAGS: 00010246
[    2.828801] RAX: 000055e2c76d2125 RBX: 0000000000000000 RCX: 00007fee0817c718
[    2.829034] RDX: 00007fffeba5e188 RSI: 00007fffeba5e178 RDI: 0000000000000001
[    2.829257] RBP: 00007fffeba5e080 R08: 0000000000000000 R09: 00007fee08193c00
[    2.829482] R10: 0000000000000009 R11: 0000000000000000 R12: 000055e2c76d2040
[    2.829727] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[    2.829964] CR2: 0000000000000020
[    2.830149] ---[ end trace ceed83d8c68a1bf1 ]---
```

Cc: <stable@vger.kernel.org> # v4.11+
Fixes: 64e90a8acb ("Introduce STATIC_USERMODEHELPER to mediate call_usermodehelper()")
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=199795
Reported-by: Tony Vroon <chainsaw@gentoo.org>
Reported-by: Sergey Kvachonok <ravenexp@gmail.com>
Tested-by: Sergei Trofimovich <slyfox@gentoo.org>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Link: https://lore.kernel.org/r/20200416162859.26518-1-mcgrof@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-14 07:57:21 +02:00
Steven Rostedt (VMware)
e52aece880 tracing: Add a vmalloc_sync_mappings() for safe measure
commit 11f5efc3ab upstream.

x86_64 lazily maps in the vmalloc pages, and the way this works with per_cpu
areas can be complex, to say the least. Mappings may happen at boot up, and
if nothing synchronizes the page tables, those page mappings may not be
synced till they are used. This causes issues for anything that might touch
one of those mappings in the path of the page fault handler. When one of
those unmapped mappings is touched in the page fault handler, it will cause
another page fault, which in turn will cause a page fault, and leave us in
a loop of page faults.

Commit 763802b53a ("x86/mm: split vmalloc_sync_all()") split
vmalloc_sync_all() into vmalloc_sync_unmappings() and
vmalloc_sync_mappings(), as on system exit, it did not need to do a full
sync on x86_64 (although it still needed to be done on x86_32). By chance,
the vmalloc_sync_all() would synchronize the page mappings done at boot up
and prevent the per cpu area from being a problem for tracing in the page
fault handler. But when that synchronization in the exit of a task became a
nop, it caused the problem to appear.

Link: https://lore.kernel.org/r/20200429054857.66e8e333@oasis.local.home

Cc: stable@vger.kernel.org
Fixes: 737223fbca ("tracing: Consolidate buffer allocation code")
Reported-by: "Tzvetomir Stoyanov (VMware)" <tz.stoyanov@gmail.com>
Suggested-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-14 07:57:20 +02:00
Masami Hiramatsu
84a50dc471 tracing/kprobes: Fix a double initialization typo
[ Upstream commit dcbd21c9fc ]

Fix a typo that resulted in an unnecessary double
initialization to addr.

Link: http://lkml.kernel.org/r/158779374968.6082.2337484008464939919.stgit@devnote2

Cc: Tom Zanussi <zanussi@kernel.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: stable@vger.kernel.org
Fixes: c7411a1a12 ("tracing/kprobe: Check whether the non-suffixed symbol is notrace")
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-05-14 07:57:16 +02:00
Greg Kroah-Hartman
c8d83f4d50 This is the 4.19.121 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl6yVZMACgkQONu9yGCS
 aT7+oBAApTDE7RPVMZ3k1p3fg01Fpa26WUQmmG8QtRYtH9CTjux0BfbA7zFuWOSO
 qIm/oCvrfdPmO3CcAwYdwU/fiBiUR/jXFM1VolUvKAtP+jaTKZ48TI4Bz9TjMtZE
 2h3XPiMrbtOzKwqWJCcksQPbtGZBxg1PFc2lm4bFatnI+HsZmJMkib2/3g64Jcdy
 aZ9hcPvH2WW9+nxig8FtDCAhZ/019P+74ji5E/FzhmUONkMzXg5iRcJLhBjzYMiv
 5Y7J+ONPAkxkmm+Zze32lue1FP2iZwruNrlk5BJaCof2zJfmbcW06r65X5OX5bAi
 XMkxgEmrnQxxMyEz7TMw8McFQG1vpA728glTWzsW3Y/kNeTy+dt6DfTa+cjGn2Ky
 k2EOSZqf+G9bd/LjUldfkkGJa+Tv7a+J7A+IVnrOeg1VvI/6/JgI5pyyQVLlH6t3
 DfcyMG32Y85QB0Am08lSobV0CxZ6plNLsIuIN1b1iCbq64y7BHf4oeo48VnaFGFR
 F83HeSxOo8fXoxaMZyJ/bVdC8vrn9QNWWEfmdqXnFhLXqdllSIDG8KRPxbgciZWS
 ShabaEsXZxtyf+8e0VxpXx0A7THsPWbJ/4REpS6mPpfIWpi0gcHnpsT+k6sbtJ68
 8uJrouDLXDei7ll1E5FZWhKbEfwUpBRmFKW+YDjZKeg5R/FuQug=
 =giKj
 -----END PGP SIGNATURE-----

Merge 4.19.121 into android-4.19

Changes in 4.19.121
	drm/edid: Fix off-by-one in DispID DTD pixel clock
	drm/qxl: qxl_release leak in qxl_draw_dirty_fb()
	drm/qxl: qxl_release leak in qxl_hw_surface_alloc()
	drm/qxl: qxl_release use after free
	btrfs: fix block group leak when removing fails
	ALSA: hda/realtek - Two front mics on a Lenovo ThinkCenter
	ALSA: usb-audio: Correct a typo of NuPrime DAC-10 USB ID
	ALSA: hda/hdmi: fix without unlocked before return
	ALSA: pcm: oss: Place the plugin buffer overflow checks correctly
	PM: ACPI: Output correct message on target power state
	PM: hibernate: Freeze kernel threads in software_resume()
	dm verity fec: fix hash block number in verity_fec_decode
	dm writecache: fix data corruption when reloading the target
	dm multipath: use updated MPATHF_QUEUE_IO on mapping for bio-based mpath
	scsi: qla2xxx: set UNLOADING before waiting for session deletion
	scsi: qla2xxx: check UNLOADING before posting async work
	RDMA/mlx5: Set GRH fields in query QP on RoCE
	RDMA/mlx4: Initialize ib_spec on the stack
	RDMA/core: Prevent mixed use of FDs between shared ufiles
	RDMA/core: Fix race between destroy and release FD object
	vfio: avoid possible overflow in vfio_iommu_type1_pin_pages
	vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn()
	iommu/qcom: Fix local_base status check
	scsi: target/iblock: fix WRITE SAME zeroing
	iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled system
	ALSA: opti9xx: shut up gcc-10 range warning
	nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl
	dmaengine: dmatest: Fix iteration non-stop logic
	selinux: properly handle multiple messages in selinux_netlink_send()
	btrfs: fix partial loss of prealloc extent past i_size after fsync
	btrfs: transaction: Avoid deadlock due to bad initialization timing of fs_info::journal_info
	mmc: cqhci: Avoid false "cqhci: CQE stuck on" by not open-coding timeout loop
	mmc: sdhci-xenon: fix annoying 1.8V regulator warning
	mmc: sdhci-pci: Fix eMMC driver strength for BYT-based controllers
	mmc: sdhci-msm: Enable host capabilities pertains to R1b response
	mmc: meson-mx-sdio: Set MMC_CAP_WAIT_WHILE_BUSY
	mmc: meson-mx-sdio: remove the broken ->card_busy() op
	Linux 4.19.121

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iba9e535d8be8646d141c60515e02989eb64397ab
2020-05-06 09:03:15 +02:00
Dexuan Cui
3904bdf082 PM: hibernate: Freeze kernel threads in software_resume()
commit 2351f8d295 upstream.

Currently the kernel threads are not frozen in software_resume(), so
between dpm_suspend_start(PMSG_QUIESCE) and resume_target_kernel(),
system_freezable_power_efficient_wq can still try to submit SCSI
commands and this can cause a panic since the low level SCSI driver
(e.g. hv_storvsc) has quiesced the SCSI adapter and can not accept
any SCSI commands: https://lkml.org/lkml/2020/4/10/47

At first I posted a fix (https://lkml.org/lkml/2020/4/21/1318) trying
to resolve the issue from hv_storvsc, but with the help of
Bart Van Assche, I realized it's better to fix software_resume(),
since this looks like a generic issue, not only pertaining to SCSI.

Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Dexuan Cui <decui@microsoft.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-06 08:13:28 +02:00
Greg Kroah-Hartman
de1774a9d2 This is the 4.19.120 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl6tkQkACgkQONu9yGCS
 aT5q+BAAjQ9jNM1XW0xRndVo09cMEami0ACKbbZRu3EtrVwVjnZFOxr2gD+ofBBc
 lJpjVCHpghkxQ/8OfW8beRbLIeh3iF8KmBDOdjVQK13klnX22zviot9XW9XOTkT4
 p902zqqj+Oxl5L3xdDQXLbmxKemFQl1X6iiQlxmNW4eGYmHsUpeghKHKrf5k4vMi
 KVz8rCyYa/qUrRrIdwGvrA1B7xXRTbhPY54ss34WExt7xKjaofHsMGzQa5kpLUa0
 7wAw6wZhIjKb7YRfsdtxS9YUUZl2OdK0KEOrGS57s9qS2aZKpbVLj+1jAdFxRnL3
 txNPrQB913smB3CLtmgBApePR7IRkWXfvujAXEylAxiYVxbHGCCB8UTeEomitrkl
 BVpGcUlFGkpWvfr2kqWp+AP0E/EFguSG6eG3fSxhGX7pWYYzucrBkuCalS65XICQ
 f4v7RsUjMrdBAQKKKPKIrcpMFekQWIQLvWU/RLLdbOMoAR++ZtBW+24OJgvYTtCI
 YEFn6ko5E1SmyfboqMFQS1EKEFk1f8LanmdkBYP+xb9LzJIgXrNsDa2KhHApBsLF
 QtQBOzw3WfdOiaeIT4jY2891WrXyjeGM/q0x8lsSWzJvOv3AGMgdA0A+U78dfFmY
 IkyIRyk6iK3jQYrdvfgggjGv6st46Gp43u96E/F7TjV4EGu/UFI=
 =3ZxP
 -----END PGP SIGNATURE-----

Merge 4.19.120 into android-4.19

Changes in 4.19.120
	remoteproc: Fix wrong rvring index computation
	mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer
	include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap
	binder: take read mode of mmap_sem in binder_alloc_free_page()
	usb: dwc3: gadget: Do link recovery for SS and SSP
	usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete
	iio:ad7797: Use correct attribute_group
	ASoC: q6dsp6: q6afe-dai: add missing channels to MI2S DAIs
	ASoC: tas571x: disable regulators on failed probe
	ASoC: wm8960: Fix wrong clock after suspend & resume
	nfsd: memory corruption in nfsd4_lock()
	i2c: altera: use proper variable to hold errno
	rxrpc: Fix DATA Tx to disable nofrag for UDP on AF_INET6 socket
	net/cxgb4: Check the return from t4_query_params properly
	xfs: acquire superblock freeze protection on eofblocks scans
	svcrdma: Fix trace point use-after-free race
	svcrdma: Fix leak of svc_rdma_recv_ctxt objects
	PCI: Avoid ASMedia XHCI USB PME# from D0 defect
	PCI: Move Apex Edge TPU class quirk to fix BAR assignment
	ARM: dts: bcm283x: Disable dsi0 node
	cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled
	net/mlx5: Fix failing fw tracer allocation on s390
	perf/core: fix parent pid/tid in task exit events
	bpf, x86_32: Fix incorrect encoding in BPF_LDX zero-extension
	mm: shmem: disable interrupt when acquiring info->lock in userfaultfd_copy path
	xfs: clear PF_MEMALLOC before exiting xfsaild thread
	bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B
	net: fec: set GPR bit on suspend by DT configuration.
	x86: hyperv: report value of misc_features
	xfs: fix partially uninitialized structure in xfs_reflink_remap_extent
	ALSA: hda: Keep the controller initialization even if no codecs found
	ALSA: hda: Explicitly permit using autosuspend if runtime PM is supported
	scsi: target: fix PR IN / READ FULL STATUS for FC
	scsi: target: tcmu: reset_ring should reset TCMU_DEV_BIT_BROKEN
	objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings
	objtool: Support Clang non-section symbols in ORC dump
	xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status
	ALSA: hda: call runtime_allow() for all hda controllers
	arm64: Delete the space separator in __emit_inst
	ext4: use matching invalidatepage in ext4_writepage
	ext4: increase wait time needed before reuse of deleted inode numbers
	ext4: convert BUG_ON's to WARN_ON's in mballoc.c
	hwmon: (jc42) Fix name to have no illegal characters
	bpf, x86_32: Fix clobbering of dst for BPF_JSET
	qed: Fix use after free in qed_chain_free
	ext4: check for non-zero journal inum in ext4_calculate_overhead
	propagate_one(): mnt_set_mountpoint() needs mount_lock
	Linux 4.19.120

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ied3c507eb5bd85c39aff278827e534cf150e2cc0
2020-05-03 08:48:02 +02:00
Ian Rogers
5f8370cdc6 perf/core: fix parent pid/tid in task exit events
commit f3bed55e85 upstream.

Current logic yields the child task as the parent.

Before:
$ perf record bash -c "perf list > /dev/null"
$ perf script -D |grep 'FORK\|EXIT'
4387036190981094 0x5a70 [0x30]: PERF_RECORD_FORK(10472:10472):(10470:10470)
4387036606207580 0xf050 [0x30]: PERF_RECORD_EXIT(10472:10472):(10472:10472)
4387036607103839 0x17150 [0x30]: PERF_RECORD_EXIT(10470:10470):(10470:10470)
                                                   ^
  Note the repeated values here -------------------/

After:
383281514043 0x9d8 [0x30]: PERF_RECORD_FORK(2268:2268):(2266:2266)
383442003996 0x2180 [0x30]: PERF_RECORD_EXIT(2268:2268):(2266:2266)
383451297778 0xb70 [0x30]: PERF_RECORD_EXIT(2266:2266):(2265:2265)

Fixes: 94d5d1b2d8 ("perf_counter: Report the cloning task as parent on perf_counter_fork()")
Reported-by: KP Singh <kpsingh@google.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20200417182842.12522-1-irogers@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-02 17:25:53 +02:00
Toke Høiland-Jørgensen
1fc9f6c1b5 cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled
commit bc23d0e3f7 upstream.

When the kernel is built with CONFIG_DEBUG_PER_CPU_MAPS, the cpumap code
can trigger a spurious warning if CONFIG_CPUMASK_OFFSTACK is also set. This
happens because in this configuration, NR_CPUS can be larger than
nr_cpumask_bits, so the initial check in cpu_map_alloc() is not sufficient
to guard against hitting the warning in cpumask_check().

Fix this by explicitly checking the supplied key against the
nr_cpumask_bits variable before calling cpu_possible().

Fixes: 6710e11269 ("bpf: introduce new bpf cpu map type BPF_MAP_TYPE_CPUMAP")
Reported-by: Xiumei Mu <xmu@redhat.com>
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Tested-by: Xiumei Mu <xmu@redhat.com>
Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
Acked-by: Song Liu <songliubraving@fb.com>
Link: https://lore.kernel.org/bpf/20200416083120.453718-1-toke@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-02 17:25:53 +02:00
Liam Mark
dfc0e46bcf ANDROID: GKI: common: dma-mapping: make dma_common_contiguous_remap more robust
Large allocations can result in the dma_common_contiguous_remap
call not being able to succeed because it can't find enough
contiguous memory to setup the mapping.
Make dma_common_contiguous_remap more robust by using vmalloc
as a fallback.

Change-Id: I12ca710b4c24f4ef24bc33a0d1d4922196fb7492
Signed-off-by: Liam Mark <lmark@codeaurora.org>
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>
Signed-off-by: Charan Teja Reddy <charante@codeaurora.org>
(cherry picked from commit b4c505ac103c032e8ff567c085f0bced4a9bf43c)
Bug: 155522481
Signed-off-by: Mark Salyzyn <salyzyn@google.com>
[saravanak rolled in int to unsigned long conversion from another patch]
Signed-off-by: Saravana Kannan <saravanak@google.com>
2020-05-01 21:57:17 -07:00
Liam Mark
a3c0807605 ANDROID: GKI: dma-coherent: Expose device base address and size
Allow clients to be able to determine the device base address and
size of a dma coherent memory region.

This is required for clients that want to explicitly manage that memory.

Change-Id: I3e5b721d9d318526422ec26995cc1af7b7f04077
Signed-off-by: Liam Mark <lmark@codeaurora.org>
(cherry picked from commit 63585739d1881d987c0c0f06199cf749ad62c6d1)
Bug: 155522481
Signed-off-by: Mark Salyzyn <salyzyn@google.com>
[saravanak conflict resolution due to file move and Change EXPORT_SYMBOL
to EXPORT_SYMBOL_GPL]
Signed-off-by: Saravana Kannan <saravanak@google.com>
2020-05-01 21:57:17 -07:00
Liam Mark
9257548d3c ANDROID: GKI: dma-mapping: Add dma_remap functions
After getting an allocation from dma_alloc_coherent, there
may be cases where it is necessary to remap the handle
into the CPU's address space (e.g. no CPU side mapping was
requested at allocation time but now one is needed). Add
APIs to bring a handle into the CPU address space again.

Change-Id: Ieb9231c5f24d45aeb7436f643c9b87b93871f85d
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>
[lmark@codeaurora.org: fix additional call to dma_common_free_remap]
Signed-off-by: Liam Mark <lmark@codeaurora.org>
Bug: 155522481
(cherry picked from commit 36e68e773c134cffe047cb1d95ebebeb91f6fbfb)
Signed-off-by: Mark Salyzyn <salyzyn@google.com>
[saravanak minor conflict fixes]
Signed-off-by: Saravana Kannan <saravanak@google.com>
2020-05-01 21:57:16 -07:00
Quentin Perret
1cdc6a7088 BACKPORT: sched/core: Fix reset-on-fork from RT with uclamp
uclamp_fork() resets the uclamp values to their default when the
reset-on-fork flag is set. It also checks whether the task has a RT
policy, and sets its uclamp.min to 1024 accordingly. However, during
reset-on-fork, the task's policy is lowered to SCHED_NORMAL right after,
hence leading to an erroneous uclamp.min setting for the new task if it
was forked from RT.

Fix this by removing the unnecessary check on rt_task() in
uclamp_fork() as this doesn't make sense if the reset-on-fork flag is
set.

[ qperret: BACKPORT because of a conflict with the Android-specific
  SUGOV_RT_MAX_FREQ sched_feat, which is equally unnecessary in this
  path ]

Bug: 120440300
Fixes: 1a00d99997 ("sched/uclamp: Set default clamps for RT tasks")
Reported-by: Chitti Babu Theegala <ctheegal@codeaurora.org>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Patrick Bellasi <patrick.bellasi@matbug.net>
Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Link: https://lkml.kernel.org/r/20200416085956.217587-1-qperret@google.com
(cherry picked from commit eaf5a92ebd)
Signed-off-by: Quentin Perret <qperret@google.com>
Change-Id: I9a19ac5474d0508b8437e4a1d859573b4106ed08
2020-05-01 07:34:40 +00:00
Greg Kroah-Hartman
fe28410e4e ANDROID: cfi: fix export symbol types
In commit d71a92631c51 ("ANDROID: add support for Clang's Control Flow
Integrity (CFI)") some new symbols were exported, but they should have
been set as _GPL symbols.

Fix this up by properly.

Bug: 145210207
Cc: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I6ecbb0f3b33f7c02c9b75bb7d80c35ce80e553f3
2020-04-29 19:16:15 +02:00
Greg Kroah-Hartman
7f86a29040 ANDROID: bpf: fix export symbol type
In commit ff5bf35998cc ("ANDROID: bpf: validate bpf_func when BPF_JIT is
enabled with CFI") a new symbol was exported, but it should have been
set as a _GPL symbol.

Fix this up by properly.

Bug: 145210207
Cc: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I7239bb8e0ef329cd7eac6afcd06c341b17ea680b
2020-04-29 19:16:15 +02:00
Greg Kroah-Hartman
be3bb0daac This is the 4.19.119 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl6pj8gACgkQONu9yGCS
 aT5mKxAAvzC4s4XHwDDckvvu57/sED2oEtp7MgmLuyK4Ih55GyyLGx9zg1A2z+rs
 wQSsVW+/WeurCj4CuVciakkCvgBeY494cbnghr2lohhJZ918/XnYmPODLJhlvtcV
 gZ4vxk5euNqpWGsmu+X+DRBG6QuU5GYf4ox39NZdtKm5I+kt5Lw44AHSNlFP0q3y
 drRFc49cqSxa4WkVRixJJOTQbSHARNWiayOG4uLb4zoZFvJOTDAp7+yX5LYD7lxY
 3FsQLVMSp7c/whppeGySVX0oJF/12weR9OQJZVxxhlMNggmGREwDxayBaPYqA4pa
 0OO83rO1aP9j2VK3HFiK4OwatKHcu0GvGV9I4rP3u8hWvJyUzTAfdcVUXHl6of12
 6hXG7F3f0TVY/OP6J2WepcQG5IbkiiAY1J0wlqbqo5MvOqESJZ/J0pGuFD1qzQ8n
 zaMnj2zhJHkJEfyP7Dvjo4y72eM9tWnFxKfm/PtuHWGovpP15rrsuHcs343U92Z7
 zQ/Ak10tA8FpSM7dXaTd98/3FkVdQbkImkEUOpWzPjiJFGyuk8j6/ZE9rCWtlNR1
 HP9cLgKB/PF/a3+kwtgGAhAHBVIA8trhSm1jRqEU7ki9sBQnV/2iR5b7UJ8xn4uA
 dl9HlxpiDYvIjRhHfMh6GXIhdO2T8coFzxKRztjxrM0dbaQeVKQ=
 =31Y5
 -----END PGP SIGNATURE-----

Merge 4.19.119 into android-4.19

Changes in 4.19.119
	ext4: fix extent_status fragmentation for plain files
	drm/msm: Use the correct dma_sync calls harder
	bpftool: Fix printing incorrect pointer in btf_dump_ptr
	crypto: mxs-dcp - make symbols 'sha1_null_hash' and 'sha256_null_hash' static
	vti4: removed duplicate log message.
	arm64: Add part number for Neoverse N1
	arm64: errata: Hide CTR_EL0.DIC on systems affected by Neoverse-N1 #1542419
	arm64: Fake the IminLine size on systems affected by Neoverse-N1 #1542419
	arm64: compat: Workaround Neoverse-N1 #1542419 for compat user-space
	arm64: Silence clang warning on mismatched value/register sizes
	watchdog: reset last_hw_keepalive time at start
	scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login
	scsi: lpfc: Fix crash in target side cable pulls hitting WAIT_FOR_UNREG
	ceph: return ceph_mdsc_do_request() errors from __get_parent()
	ceph: don't skip updating wanted caps when cap is stale
	pwm: rcar: Fix late Runtime PM enablement
	scsi: iscsi: Report unbind session event when the target has been removed
	ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map()
	nvme: fix deadlock caused by ANA update wrong locking
	kernel/gcov/fs.c: gcov_seq_next() should increase position index
	selftests: kmod: fix handling test numbers above 9
	ipc/util.c: sysvipc_find_ipc() should increase position index
	kconfig: qconf: Fix a few alignment issues
	s390/cio: avoid duplicated 'ADD' uevents
	loop: Better discard support for block devices
	Revert "powerpc/64: irq_work avoid interrupt when called with hardware irqs enabled"
	pwm: renesas-tpu: Fix late Runtime PM enablement
	pwm: bcm2835: Dynamically allocate base
	perf/core: Disable page faults when getting phys address
	ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN MPWIN895CL tablet
	xhci: Ensure link state is U3 after setting USB_SS_PORT_LS_U3
	drm/amd/display: Not doing optimize bandwidth if flip pending.
	tracing/selftests: Turn off timeout setting
	virtio-blk: improve virtqueue error to BLK_STS
	scsi: smartpqi: fix call trace in device discovery
	PCI/ASPM: Allow re-enabling Clock PM
	net: ipv6: add net argument to ip6_dst_lookup_flow
	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
	blktrace: Protect q->blk_trace with RCU
	blktrace: fix dereference after null check
	f2fs: fix to avoid memory leakage in f2fs_listxattr
	KVM: VMX: Zero out *all* general purpose registers after VM-Exit
	KVM: nVMX: Always sync GUEST_BNDCFGS when it comes from vmcs01
	KVM: Introduce a new guest mapping API
	kvm: fix compilation on aarch64
	kvm: fix compilation on s390
	kvm: fix compile on s390 part 2
	KVM: Properly check if "page" is valid in kvm_vcpu_unmap
	x86/kvm: Introduce kvm_(un)map_gfn()
	x86/kvm: Cache gfn to pfn translation
	x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed
	x86/KVM: Clean up host's steal time structure
	cxgb4: fix adapter crash due to wrong MC size
	cxgb4: fix large delays in PTP synchronization
	ipv6: fix restrict IPV6_ADDRFORM operation
	macsec: avoid to set wrong mtu
	macvlan: fix null dereference in macvlan_device_event()
	net: bcmgenet: correct per TX/RX ring statistics
	net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
	net: stmmac: dwmac-meson8b: Add missing boundary to RGMII TX clock array
	net/x25: Fix x25_neigh refcnt leak when receiving frame
	sched: etf: do not assume all sockets are full blown
	tcp: cache line align MAX_TCP_HEADER
	team: fix hang in team_mode_get()
	vrf: Fix IPv6 with qdisc and xfrm
	net: dsa: b53: Lookup VID in ARL searches when VLAN is enabled
	net: dsa: b53: Fix ARL register definitions
	net: dsa: b53: Rework ARL bin logic
	net: dsa: b53: b53_arl_rw_op() needs to select IVL or SVL
	xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish
	vrf: Check skb for XFRM_TRANSFORMED flag
	mlxsw: Fix some IS_ERR() vs NULL bugs
	KEYS: Avoid false positive ENOMEM error on key read
	ALSA: hda: Remove ASUS ROG Zenith from the blacklist
	ALSA: usb-audio: Add static mapping table for ALC1220-VB-based mobos
	ALSA: usb-audio: Add connector notifier delegation
	iio: core: remove extra semi-colon from devm_iio_device_register() macro
	iio: st_sensors: rely on odr mask to know if odr can be set
	iio: adc: stm32-adc: fix sleep in atomic context
	iio: xilinx-xadc: Fix ADC-B powerdown
	iio: xilinx-xadc: Fix clearing interrupt when enabling trigger
	iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode
	iio: xilinx-xadc: Make sure not exceed maximum samplerate
	fs/namespace.c: fix mountpoint reference counter race
	USB: sisusbvga: Change port variable from signed to unsigned
	USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70 RGB RAPIDFIRE
	USB: early: Handle AMD's spec-compliant identifiers, too
	USB: core: Fix free-while-in-use bug in the USB S-Glibrary
	USB: hub: Fix handling of connect changes during sleep
	vmalloc: fix remap_vmalloc_range() bounds checks
	mm/hugetlb: fix a addressing exception caused by huge_pte_offset
	mm/ksm: fix NULL pointer dereference when KSM zero page is enabled
	tools/vm: fix cross-compile build
	ALSA: usx2y: Fix potential NULL dereference
	ALSA: hda/realtek - Fix unexpected init_amp override
	ALSA: hda/realtek - Add new codec supported for ALC245
	ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif
	ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices
	tpm/tpm_tis: Free IRQ if probing fails
	tpm: ibmvtpm: retry on H_CLOSED in tpm_ibmvtpm_send()
	KVM: s390: Return last valid slot if approx index is out-of-bounds
	KVM: Check validity of resolved slot when searching memslots
	KVM: VMX: Enable machine check support for 32bit targets
	tty: hvc: fix buffer overflow during hvc_alloc().
	tty: rocket, avoid OOB access
	usb-storage: Add unusual_devs entry for JMicron JMS566
	audit: check the length of userspace generated audit records
	ASoC: dapm: fixup dapm kcontrol widget
	iwlwifi: pcie: actually release queue memory in TVQM
	iwlwifi: mvm: beacon statistics shouldn't go backwards
	ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y
	powerpc/setup_64: Set cache-line-size based on cache-block-size
	staging: comedi: dt2815: fix writing hi byte of analog output
	staging: comedi: Fix comedi_device refcnt leak in comedi_open
	vt: don't hardcode the mem allocation upper bound
	vt: don't use kmalloc() for the unicode screen buffer
	staging: vt6656: Don't set RCR_MULTICAST or RCR_BROADCAST by default.
	staging: vt6656: Fix calling conditions of vnt_set_bss_mode
	staging: vt6656: Fix drivers TBTT timing counter.
	staging: vt6656: Fix pairwise key entry save.
	staging: vt6656: Power save stop wake_up_count wrap around.
	cdc-acm: close race betrween suspend() and acm_softint
	cdc-acm: introduce a cool down
	UAS: no use logging any details in case of ENODEV
	UAS: fix deadlock in error handling and PM flushing work
	usb: dwc3: gadget: Fix request completion check
	usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset()
	xhci: prevent bus suspend if a roothub port detected a over-current condition
	serial: sh-sci: Make sure status register SCxSR is read in correct sequence
	xfs: Fix deadlock between AGI and AGF with RENAME_WHITEOUT
	s390/mm: fix page table upgrade vs 2ndary address mode accesses
	Linux 4.19.119

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I4b16db8472367d135a4ff68d2863c634bf093ef5
2020-04-29 17:26:17 +02:00
Paul Moore
64c0c48324 audit: check the length of userspace generated audit records
commit 763dafc520 upstream.

Commit 7561252892 ("audit: always check the netlink payload length
in audit_receive_msg()") fixed a number of missing message length
checks, but forgot to check the length of userspace generated audit
records.  The good news is that you need CAP_AUDIT_WRITE to submit
userspace audit records, which is generally only given to trusted
processes, so the impact should be limited.

Cc: stable@vger.kernel.org
Fixes: 7561252892 ("audit: always check the netlink payload length in audit_receive_msg()")
Reported-by: syzbot+49e69b4d71a420ceda3e@syzkaller.appspotmail.com
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-29 16:31:31 +02:00
Cengiz Can
6d1444dbf9 blktrace: fix dereference after null check
commit 153031a301 upstream.

There was a recent change in blktrace.c that added a RCU protection to
`q->blk_trace` in order to fix a use-after-free issue during access.

However the change missed an edge case that can lead to dereferencing of
`bt` pointer even when it's NULL:

Coverity static analyzer marked this as a FORWARD_NULL issue with CID
1460458.

```
/kernel/trace/blktrace.c: 1904 in sysfs_blk_trace_attr_store()
1898            ret = 0;
1899            if (bt == NULL)
1900                    ret = blk_trace_setup_queue(q, bdev);
1901
1902            if (ret == 0) {
1903                    if (attr == &dev_attr_act_mask)
>>>     CID 1460458:  Null pointer dereferences  (FORWARD_NULL)
>>>     Dereferencing null pointer "bt".
1904                            bt->act_mask = value;
1905                    else if (attr == &dev_attr_pid)
1906                            bt->pid = value;
1907                    else if (attr == &dev_attr_start_lba)
1908                            bt->start_lba = value;
1909                    else if (attr == &dev_attr_end_lba)
```

Added a reassignment with RCU annotation to fix the issue.

Fixes: c780e86dd4 ("blktrace: Protect q->blk_trace with RCU")
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Bob Liu <bob.liu@oracle.com>
Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Cengiz Can <cengiz@kernel.wtf>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-04-29 16:31:17 +02:00
Jan Kara
473d7f5ed7 blktrace: Protect q->blk_trace with RCU
commit c780e86dd4 upstream.

KASAN is reporting that __blk_add_trace() has a use-after-free issue
when accessing q->blk_trace. Indeed the switching of block tracing (and
thus eventual freeing of q->blk_trace) is completely unsynchronized with
the currently running tracing and thus it can happen that the blk_trace
structure is being freed just while __blk_add_trace() works on it.
Protect accesses to q->blk_trace by RCU during tracing and make sure we
wait for the end of RCU grace period when shutting down tracing. Luckily
that is rare enough event that we can afford that. Note that postponing
the freeing of blk_trace to an RCU callback should better be avoided as
it could have unexpected user visible side-effects as debugfs files
would be still existing for a short while block tracing has been shut
down.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=205711
CC: stable@vger.kernel.org
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Tested-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reported-by: Tristan Madani <tristmd@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[bwh: Backported to 4.19: adjust context]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-04-29 16:31:17 +02:00
Jiri Olsa
0cb5f1e1a0 perf/core: Disable page faults when getting phys address
[ Upstream commit d3296fb372 ]

We hit following warning when running tests on kernel
compiled with CONFIG_DEBUG_ATOMIC_SLEEP=y:

 WARNING: CPU: 19 PID: 4472 at mm/gup.c:2381 __get_user_pages_fast+0x1a4/0x200
 CPU: 19 PID: 4472 Comm: dummy Not tainted 5.6.0-rc6+ #3
 RIP: 0010:__get_user_pages_fast+0x1a4/0x200
 ...
 Call Trace:
  perf_prepare_sample+0xff1/0x1d90
  perf_event_output_forward+0xe8/0x210
  __perf_event_overflow+0x11a/0x310
  __intel_pmu_pebs_event+0x657/0x850
  intel_pmu_drain_pebs_nhm+0x7de/0x11d0
  handle_pmi_common+0x1b2/0x650
  intel_pmu_handle_irq+0x17b/0x370
  perf_event_nmi_handler+0x40/0x60
  nmi_handle+0x192/0x590
  default_do_nmi+0x6d/0x150
  do_nmi+0x2f9/0x3c0
  nmi+0x8e/0xd7

While __get_user_pages_fast() is IRQ-safe, it calls access_ok(),
which warns on:

  WARN_ON_ONCE(!in_task() && !pagefault_disabled())

Peter suggested disabling page faults around __get_user_pages_fast(),
which gets rid of the warning in access_ok() call.

Suggested-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lkml.kernel.org/r/20200407141427.3184722-1-jolsa@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-04-29 16:31:14 +02:00
Vasily Averin
99e811d8d7 kernel/gcov/fs.c: gcov_seq_next() should increase position index
[ Upstream commit f4d74ef622 ]

If seq_file .next function does not change position index, read after
some lseek can generate unexpected output.

https://bugzilla.kernel.org/show_bug.cgi?id=206283
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: NeilBrown <neilb@suse.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Waiman Long <longman@redhat.com>
Link: http://lkml.kernel.org/r/f65c6ee7-bd00-f910-2f8a-37cc67e4ff88@virtuozzo.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-04-29 16:31:12 +02:00
Vincenzo Frascino
adde606515 UPSTREAM: timekeeping: Provide a generic update_vsyscall() implementation
The new generic VDSO library allows to unify the update_vsyscall[_tz]()
implementations.

Provide a generic implementation based on the x86 code and the bindings
which need to be implemented in architecture specific code.

[ tglx: Moved it into kernel/time where it belongs. Removed the pointless
  	line breaks in the stub functions. Massaged changelog ]

Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Shijith Thotton <sthotton@marvell.com>
Tested-by: Andre Przywara <andre.przywara@arm.com>
Cc: linux-arch@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-mips@vger.kernel.org
Cc: linux-kselftest@vger.kernel.org
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Paul Burton <paul.burton@mips.com>
Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
Cc: Mark Salyzyn <salyzyn@android.com>
Cc: Peter Collingbourne <pcc@google.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Dmitry Safonov <0x7f454c46@gmail.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Huw Davies <huw@codeweavers.com>
Link: https://lkml.kernel.org/r/20190621095252.32307-4-vincenzo.frascino@arm.com
(cherry picked from commit 44f57d788e)
Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Bug: 154668398
Change-Id: I2a85e391be80f58f6516eb7d8e6448f522fc3013
2020-04-27 22:51:55 -07:00
Kelly Rossmoyer
51dd650781 ANDROID: fix wakeup reason findings
The 0-day test bot found three minor issues in the wakeup_reason
enhancements patch, including two undeclared functions that should have
been static, an allegedly uninitialized pointer (which is actually set
in the line immediately prior to cppcheck's complaint), and a type
mismatch when printing timespec64 fields on a 32-bit build.

These changes address those findings.

Fixes: e7b509cf04 ("ANDROID: power: wakeup_reason: wake reason
enhancements")
Bug: 153727431
Reported-by: kbuild test robot <lkp@intel.com>
Change-Id: I9194f85d0ca7921461866b73dc24e1783b1da6c6
Signed-off-by: Kelly Rossmoyer <krossmo@google.com>
2020-04-24 01:05:45 +00:00
Greg Kroah-Hartman
a13256124f This is the 4.19.118 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl6hUzYACgkQONu9yGCS
 aT60dw//aKFE0n+vIK9fv24SMkVfleVVFeU1hYNJAUDy4CZF6vbZYAVg+w740fMD
 1rgOgk138kkFufC/Mlk1CcPkwVdTob9KhhuRDQS5+ncuPHlzmf0JF9Y0yQ4Y7BRm
 mDPvVVNQCdL26voReKf5rT+6YWIpVrwWOLxhboFmVE8fWwIxKAKYav/KCYFxHDZi
 Yu0C2qpKLs7fPoEDrcyQCHxo+lv/GFTNkFwGez1uB+ejZfGd/eQSsqEfRlHZlx5y
 XdqfbAuOJdIyPJjZZ9B6bFC0Q1w9Rs16DkfpEU2E7Ksx8UTY226wrKaQI0n419fy
 //ZEVv+fim/GHtfq9Eeo/IIWNADF6qL/5yx5xzJ9cZDVe4SAOsUo9QlVaYgqE+Fy
 AMtnspS4e0iKiUzbIAwqXBV/VPVUnkPgsuDVs/sKCjhVs8g7SsTxu6daxDcamXFh
 yTH2reH78n41WHOSvR23QnnuFO/+fc+vDIhVLvyUsrSeNPFODuJOQjNBeOJxNrrn
 550n10NwJc8DW5QiEQ11D2R9qSOYT7o98SuxDS3iyfwhBSN2nwRJMP4z1lvYn1dR
 nqWxNT8cIL2cCzLlfN9bHga3Tx7Ix4TXcI9iMbY4s4gJRG5m9TBNl6dNX2PIhiKg
 Arjq4OA3t+k4FYmUIDXvvqYb/qX+1oWMvZMmU9PveZSxQ/7szZo=
 =C4om
 -----END PGP SIGNATURE-----

Merge 4.19.118 into android-4.19

Changes in 4.19.118
	arm, bpf: Fix offset overflow for BPF_MEM BPF_DW
	objtool: Fix switch table detection in .text.unlikely
	scsi: sg: add sg_remove_request in sg_common_write
	ext4: use non-movable memory for superblock readahead
	watchdog: sp805: fix restart handler
	arm, bpf: Fix bugs with ALU64 {RSH, ARSH} BPF_K shift by 0
	ARM: dts: imx6: Use gpc for FEC interrupt controller to fix wake on LAN.
	netfilter: nf_tables: report EOPNOTSUPP on unsupported flags/object type
	irqchip/mbigen: Free msi_desc on device teardown
	ALSA: hda: Don't release card at firmware loading error
	of: unittest: kmemleak on changeset destroy
	of: unittest: kmemleak in of_unittest_platform_populate()
	of: unittest: kmemleak in of_unittest_overlay_high_level()
	of: overlay: kmemleak in dup_and_fixup_symbol_prop()
	x86/Hyper-V: Report crash register data or kmsg before running crash kernel
	lib/raid6: use vdupq_n_u8 to avoid endianness warnings
	video: fbdev: sis: Remove unnecessary parentheses and commented code
	rbd: avoid a deadlock on header_rwsem when flushing notifies
	rbd: call rbd_dev_unprobe() after unwatching and flushing notifies
	xsk: Add missing check on user supplied headroom size
	x86/Hyper-V: Unload vmbus channel in hv panic callback
	x86/Hyper-V: Free hv_panic_page when fail to register kmsg dump
	x86/Hyper-V: Trigger crash enlightenment only once during system crash.
	x86/Hyper-V: Report crash register data when sysctl_record_panic_msg is not set
	x86/Hyper-V: Report crash data in die() when panic_on_oops is set
	clk: at91: usb: continue if clk_hw_round_rate() return zero
	power: supply: bq27xxx_battery: Silence deferred-probe error
	clk: tegra: Fix Tegra PMC clock out parents
	soc: imx: gpc: fix power up sequencing
	rtc: 88pm860x: fix possible race condition
	NFSv4/pnfs: Return valid stateids in nfs_layout_find_inode_by_stateid()
	NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context fails
	s390/cpuinfo: fix wrong output when CPU0 is offline
	powerpc/maple: Fix declaration made after definition
	s390/cpum_sf: Fix wrong page count in error message
	ext4: do not commit super on read-only bdev
	um: ubd: Prevent buffer overrun on command completion
	cifs: Allocate encryption header through kmalloc
	include/linux/swapops.h: correct guards for non_swap_entry()
	percpu_counter: fix a data race at vm_committed_as
	compiler.h: fix error in BUILD_BUG_ON() reporting
	KVM: s390: vsie: Fix possible race when shadowing region 3 tables
	x86: ACPI: fix CPU hotplug deadlock
	drm/amdkfd: kfree the wrong pointer
	NFS: Fix memory leaks in nfs_pageio_stop_mirroring()
	f2fs: fix NULL pointer dereference in f2fs_write_begin()
	drm/vc4: Fix HDMI mode validation
	iommu/vt-d: Fix mm reference leak
	ext2: fix empty body warnings when -Wextra is used
	ext2: fix debug reference to ext2_xattr_cache
	power: supply: axp288_fuel_gauge: Broaden vendor check for Intel Compute Sticks.
	libnvdimm: Out of bounds read in __nd_ioctl()
	iommu/amd: Fix the configuration of GCR3 table root pointer
	f2fs: fix to wait all node page writeback
	net: dsa: bcm_sf2: Fix overflow checks
	fbdev: potential information leak in do_fb_ioctl()
	iio: si1133: read 24-bit signed integer for measurement
	tty: evh_bytechan: Fix out of bounds accesses
	locktorture: Print ratio of acquisitions, not failures
	mtd: spinand: Explicitly use MTD_OPS_RAW to write the bad block marker to OOB
	mtd: lpddr: Fix a double free in probe()
	mtd: phram: fix a double free issue in error path
	KEYS: Don't write out to userspace while holding key semaphore
	bpf: fix buggy r0 retval refinement for tracing helpers
	Linux 4.19.118

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ife34f739f719c332c7b1d22b1832179be6a16800
2020-04-23 11:07:54 +02:00
Daniel Borkmann
e0b80b7d64 bpf: fix buggy r0 retval refinement for tracing helpers
[ no upstream commit ]

See the glory details in 100605035e ("bpf: Verifier, do_refine_retval_range
may clamp umin to 0 incorrectly") for why 849fa50662 ("bpf/verifier: refine
retval R0 state for bpf_get_stack helper") is buggy. The whole series however
is not suitable for stable since it adds significant amount [0] of verifier
complexity in order to add 32bit subreg tracking. Something simpler is needed.

Unfortunately, reverting 849fa50662 ("bpf/verifier: refine retval R0 state
for bpf_get_stack helper") or just cherry-picking 100605035e ("bpf: Verifier,
do_refine_retval_range may clamp umin to 0 incorrectly") is not an option since
it will break existing tracing programs badly (at least those that are using
bpf_get_stack() and bpf_probe_read_str() helpers). Not fixing it in stable is
also not an option since on 4.19 kernels an error will cause a soft-lockup due
to hitting dead-code sanitized branch since we don't hard-wire such branches
in old kernels yet. But even then for 5.x 849fa50662 ("bpf/verifier: refine
retval R0 state for bpf_get_stack helper") would cause wrong bounds on the
verifier simluation when an error is hit.

In one of the earlier iterations of mentioned patch series for upstream there
was the concern that just using smax_value in do_refine_retval_range() would
nuke bounds by subsequent <<32 >>32 shifts before the comparison against 0 [1]
which eventually led to the 32bit subreg tracking in the first place. While I
initially went for implementing the idea [1] to pattern match the two shift
operations, it turned out to be more complex than actually needed, meaning, we
could simply treat do_refine_retval_range() similarly to how we branch off
verification for conditionals or under speculation, that is, pushing a new
reg state to the stack for later verification. This means, instead of verifying
the current path with the ret_reg in [S32MIN, msize_max_value] interval where
later bounds would get nuked, we split this into two: i) for the success case
where ret_reg can be in [0, msize_max_value], and ii) for the error case with
ret_reg known to be in interval [S32MIN, -1]. Latter will preserve the bounds
during these shift patterns and can match reg < 0 test. test_progs also succeed
with this approach.

  [0] https://lore.kernel.org/bpf/158507130343.15666.8018068546764556975.stgit@john-Precision-5820-Tower/
  [1] https://lore.kernel.org/bpf/158015334199.28573.4940395881683556537.stgit@john-XPS-13-9370/T/#m2e0ad1d5949131014748b6daa48a3495e7f0456d

Fixes: 849fa50662 ("bpf/verifier: refine retval R0 state for bpf_get_stack helper")
Reported-by: Lorenzo Fontana <fontanalorenz@gmail.com>
Reported-by: Leonardo Di Donato <leodidonato@gmail.com>
Reported-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Tested-by: John Fastabend <john.fastabend@gmail.com>
Tested-by: Lorenzo Fontana <fontanalorenz@gmail.com>
Tested-by: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-23 10:30:24 +02:00
Paul E. McKenney
9c85fc004e locktorture: Print ratio of acquisitions, not failures
commit 80c503e0e6 upstream.

The __torture_print_stats() function in locktorture.c carefully
initializes local variable "min" to statp[0].n_lock_acquired, but
then compares it to statp[i].n_lock_fail.  Given that the .n_lock_fail
field should normally be zero, and given the initialization, it seems
reasonable to display the maximum and minimum number acquisitions
instead of miscomputing the maximum and minimum number of failures.
This commit therefore switches from failures to acquisitions.

And this turns out to be not only a day-zero bug, but entirely my
own fault.  I hate it when that happens!

Fixes: 0af3fe1efa ("locktorture: Add a lock-torture kernel module")
Reported-by: Will Deacon <will@kernel.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Acked-by: Will Deacon <will@kernel.org>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Josh Triplett <josh@joshtriplett.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-23 10:30:23 +02:00
Anil Kumar Mamidala
8660cb6674 ANDROID: GKI: qos: Register irq notify after adding the qos request
Before adding the irq affinity based qos request to the list, if
the affinity of the interrupt changes it will trigger notify call.
This notifier call will try to update the qos request. Accessing
the qos request which is not yet added to the list leads to a
NULL pointer exception.

Avoid this race by registering the notifier after adding the
qos request.

Test: build, boot
Bug: 150901210
Change-Id: I99869cc233573b5db10e4f3224d65c29511050ea
Signed-off-by: Anil Kumar Mamidala <amami@codeaurora.org>
(cherry picked from commit 5db62557cb0e0fb88a638bd300295d1adb8f5bd7)
Signed-off-by: Hridya Valsaraju <hridya@google.com>
2020-04-23 00:35:53 +00:00
Greg Kroah-Hartman
fd8a9d61cf This is the 4.19.117 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl6emrgACgkQONu9yGCS
 aT7KHhAAnWFfpGr89QEPUIDcdYNqmjnBlf7WRmVqQxbM+umD5AWo8fdLkKA43Fsx
 nNdMP6POYUwMqXahNOYwxCfRuw5sqsz/5bZO8O5p6fIXk1WhtW6Nzw78DHmDpQSj
 Cdfo92dJVhRcsCOElhrdsIypuBr7LoAOFjTGIzx4OZVXM3VJhWPpIgDEtU5yy/+S
 ym9TSU1RyQ9C/mIev3z6AXTAzAzWKdHXKtkWf3YW/7Mgr2QCcwmZxDlp9L1+L6e3
 lLn2IMcFH91Wj0hJX98OhkmjA0EJ/LNU4LaaIe/DxGBEtzyLjn+aoxGIEREnU/Y6
 36+3neWC3tJmUIzgyoRgVby+Jti3APEq3ncD0xzD8MAKitxihru7vKdTyfSWwmY0
 xSz2UbCbbF1BeG3MZQNzgdSQCn4o21Iyxu+aQVGSvVd4k43x4jbtNedLqA6mHmkz
 7I/V7UXyyzztDwlgT+DZa3LT6j4iv8VI6rPl7Evm3b5Iu9un3KLjnOEsXnvxjx9D
 o8dsPkK/pqbIW75bfThkoo8llmm/SsQ0n5GTKbITx9x0jU9E3VlQNHv+DUkT2CEn
 1cY4hsVNql475RsOabhXbfOXI7+uwUCxKEOVN7DysT8UGARGIXZOkrGLr4UqjQHI
 B4J8oKBPPS5ZQKEIC7j/h4V/exqtSZYTQ1GWUNj4uo9X7KnJ+K4=
 =kytQ
 -----END PGP SIGNATURE-----

Merge 4.19.117 into android-4.19

Changes in 4.19.117
	amd-xgbe: Use __napi_schedule() in BH context
	hsr: check protocol version in hsr_newlink()
	net: ipv4: devinet: Fix crash when add/del multicast IP with autojoin
	net: ipv6: do not consider routes via gateways for anycast address check
	net: qrtr: send msgs from local of same id as broadcast
	net: revert default NAPI poll timeout to 2 jiffies
	net: stmmac: dwmac-sunxi: Provide TX and RX fifo sizes
	net: dsa: mt7530: fix tagged frames pass-through in VLAN-unaware mode
	ovl: fix value of i_ino for lower hardlink corner case
	scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic
	jbd2: improve comments about freeing data buffers whose page mapping is NULL
	pwm: pca9685: Fix PWM/GPIO inter-operation
	ext4: fix incorrect group count in ext4_fill_super error message
	ext4: fix incorrect inodes per group in error message
	ASoC: Intel: mrfld: fix incorrect check on p->sink
	ASoC: Intel: mrfld: return error codes when an error occurs
	ALSA: usb-audio: Filter error from connector kctl ops, too
	ALSA: usb-audio: Don't override ignore_ctl_error value from the map
	ALSA: usb-audio: Don't create jack controls for PCM terminals
	ALSA: usb-audio: Check mapping at creating connector controls, too
	keys: Fix proc_keys_next to increase position index
	tracing: Fix the race between registering 'snapshot' event trigger and triggering 'snapshot' operation
	btrfs: check commit root generation in should_ignore_root
	mac80211_hwsim: Use kstrndup() in place of kasprintf()
	usb: dwc3: gadget: don't enable interrupt when disabling endpoint
	usb: dwc3: gadget: Don't clear flags before transfer ended
	drm/amd/powerplay: force the trim of the mclk dpm_levels if OD is enabled
	ext4: do not zeroout extents beyond i_disksize
	kvm: x86: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD
	scsi: target: remove boilerplate code
	scsi: target: fix hang when multiple threads try to destroy the same iscsi session
	x86/microcode/AMD: Increase microcode PATCH_MAX_SIZE
	x86/resctrl: Preserve CDP enable over CPU hotplug
	x86/resctrl: Fix invalid attempt at removing the default resource group
	wil6210: check rx_buff_mgmt before accessing it
	wil6210: ignore HALP ICR if already handled
	wil6210: add general initialization/size checks
	wil6210: make sure Rx ring sizes are correlated
	wil6210: remove reset file from debugfs
	mm/vmalloc.c: move 'area->pages' after if statement
	Linux 4.19.117

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib4ab9aa34c22c034887be15902a625ecc5622b35
2020-04-21 10:20:12 +02:00
Xiao Yang
57f2a2ad73 tracing: Fix the race between registering 'snapshot' event trigger and triggering 'snapshot' operation
commit 0bbe7f7199 upstream.

Traced event can trigger 'snapshot' operation(i.e. calls snapshot_trigger()
or snapshot_count_trigger()) when register_snapshot_trigger() has completed
registration but doesn't allocate buffer for 'snapshot' event trigger.  In
the rare case, 'snapshot' operation always detects the lack of allocated
buffer so make register_snapshot_trigger() allocate buffer first.

trigger-snapshot.tc in kselftest reproduces the issue on slow vm:
-----------------------------------------------------------
cat trace
...
ftracetest-3028  [002] ....   236.784290: sched_process_fork: comm=ftracetest pid=3028 child_comm=ftracetest child_pid=3036
     <...>-2875  [003] ....   240.460335: tracing_snapshot_instance_cond: *** SNAPSHOT NOT ALLOCATED ***
     <...>-2875  [003] ....   240.460338: tracing_snapshot_instance_cond: *** stopping trace here!   ***
-----------------------------------------------------------

Link: http://lkml.kernel.org/r/20200414015145.66236-1-yangx.jy@cn.fujitsu.com

Cc: stable@vger.kernel.org
Fixes: 93e31ffbf4 ("tracing: Add 'snapshot' event trigger command")
Signed-off-by: Xiao Yang <yangx.jy@cn.fujitsu.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-21 09:03:09 +02:00
Greg Kroah-Hartman
95bff4cdab This is the 4.19.116 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl6ZbYYACgkQONu9yGCS
 aT76ohAAn4lIjSuMRCILy/lq0DXVWDy7q6YdfyzNBITxc86tVfnfjMeQxUBviE/1
 OzShWgMRXeqrb0xJTJ5Rv6mt5Kf9a3DpPWt2jwo1iqWkl4AihDtDV7Z2Bh+QdnSX
 +lQ1xGPqDi4MMgoYlpMtlFc3wq/pJV0i8Q7amXC/KbsDkt5dlDrQYeEZHe2P7pR9
 ZljKLHEdGRE3uGqXmEM8qb6aLjQudnHmH/9uChP4UX6b+ZADDCc05DMhEkhEoCZT
 jdxiqVZvRdiiXTc1r6ckGv0xae77s0IAAZMQAd+24zFK94QByi6d9Cw0y6qyyDi7
 1rfHIWSjvetY3+4DCQDOu/k2/pLt/Vqh9zuvtaf8Tu8cKM9rxow0Hl9FlL3fZpBN
 btpqeCY6twFxApHoAp9ZDK6otaVEOtbg1MCsmpUbVxWIF9IR8cPqMGyYK3lR2Ao1
 HgdKEFkYOycAOu51ujuHsDLx/9k2ZqeSPyh0yrdVpFUVvMV/YqoYP9X3jzGRVllL
 hgYfFcywgrVgxK4c02/6cPiJNbFskTpLllDPVVXGIjO+9R4vTRUgJ74CNrqL25aT
 ioSFWJA00UvXObnbCDdA+otYYWAmYOJX7HVvEieb0oDqPYHZHa1UW6+1WlYSAQLm
 WAsHiejOv6PwzRmCDI6RyuZKQjjX6bppAWFq0/RLPO0uEqjXlxc=
 =Iq3k
 -----END PGP SIGNATURE-----

Merge 4.19.116 into android-4.19

Changes in 4.19.116
	ARM: dts: sun8i-a83t-tbs-a711: HM5065 doesn't like such a high voltage
	bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads
	net: vxge: fix wrong __VA_ARGS__ usage
	hinic: fix a bug of waitting for IO stopped
	hinic: fix wrong para of wait_for_completion_timeout
	cxgb4/ptp: pass the sign of offset delta in FW CMD
	qlcnic: Fix bad kzalloc null test
	i2c: st: fix missing struct parameter description
	cpufreq: imx6q: Fixes unwanted cpu overclocking on i.MX6ULL
	media: venus: hfi_parser: Ignore HEVC encoding for V1
	firmware: arm_sdei: fix double-lock on hibernate with shared events
	null_blk: Fix the null_add_dev() error path
	null_blk: Handle null_add_dev() failures properly
	null_blk: fix spurious IO errors after failed past-wp access
	xhci: bail out early if driver can't accress host in resume
	x86: Don't let pgprot_modify() change the page encryption bit
	block: keep bdi->io_pages in sync with max_sectors_kb for stacked devices
	irqchip/versatile-fpga: Handle chained IRQs properly
	sched: Avoid scale real weight down to zero
	selftests/x86/ptrace_syscall_32: Fix no-vDSO segfault
	PCI/switchtec: Fix init_completion race condition with poll_wait()
	media: i2c: video-i2c: fix build errors due to 'imply hwmon'
	libata: Remove extra scsi_host_put() in ata_scsi_add_hosts()
	pstore/platform: fix potential mem leak if pstore_init_fs failed
	gfs2: Don't demote a glock until its revokes are written
	x86/boot: Use unsigned comparison for addresses
	efi/x86: Ignore the memory attributes table on i386
	genirq/irqdomain: Check pointer in irq_domain_alloc_irqs_hierarchy()
	block: Fix use-after-free issue accessing struct io_cq
	media: i2c: ov5695: Fix power on and off sequences
	usb: dwc3: core: add support for disabling SS instances in park mode
	irqchip/gic-v4: Provide irq_retrigger to avoid circular locking dependency
	md: check arrays is suspended in mddev_detach before call quiesce operations
	firmware: fix a double abort case with fw_load_sysfs_fallback
	locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps()
	block, bfq: fix use-after-free in bfq_idle_slice_timer_body
	btrfs: qgroup: ensure qgroup_rescan_running is only set when the worker is at least queued
	btrfs: remove a BUG_ON() from merge_reloc_roots()
	btrfs: track reloc roots based on their commit root bytenr
	IB/mlx5: Replace tunnel mpls capability bits for tunnel_offloads
	uapi: rename ext2_swab() to swab() and share globally in swab.h
	slub: improve bit diffusion for freelist ptr obfuscation
	ASoC: fix regwmask
	ASoC: dapm: connect virtual mux with default value
	ASoC: dpcm: allow start or stop during pause for backend
	ASoC: topology: use name_prefix for new kcontrol
	usb: gadget: f_fs: Fix use after free issue as part of queue failure
	usb: gadget: composite: Inform controller driver of self-powered
	ALSA: usb-audio: Add mixer workaround for TRX40 and co
	ALSA: hda: Add driver blacklist
	ALSA: hda: Fix potential access overflow in beep helper
	ALSA: ice1724: Fix invalid access for enumerated ctl items
	ALSA: pcm: oss: Fix regression by buffer overflow fix
	ALSA: doc: Document PC Beep Hidden Register on Realtek ALC256
	ALSA: hda/realtek - Set principled PC Beep configuration for ALC256
	ALSA: hda/realtek - Remove now-unnecessary XPS 13 headphone noise fixups
	ALSA: hda/realtek - Add quirk for MSI GL63
	media: ti-vpe: cal: fix disable_irqs to only the intended target
	acpi/x86: ignore unspecified bit positions in the ACPI global lock field
	thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n
	nvme-fc: Revert "add module to ops template to allow module references"
	nvme: Treat discovery subsystems as unique subsystems
	PCI: pciehp: Fix indefinite wait on sysfs requests
	PCI/ASPM: Clear the correct bits when enabling L1 substates
	PCI: Add boot interrupt quirk mechanism for Xeon chipsets
	PCI: endpoint: Fix for concurrent memory allocation in OB address region
	tpm: Don't make log failures fatal
	tpm: tpm1_bios_measurements_next should increase position index
	tpm: tpm2_bios_measurements_next should increase position index
	KEYS: reaching the keys quotas correctly
	irqchip/versatile-fpga: Apply clear-mask earlier
	pstore: pstore_ftrace_seq_next should increase position index
	MIPS/tlbex: Fix LDDIR usage in setup_pw() for Loongson-3
	MIPS: OCTEON: irq: Fix potential NULL pointer dereference
	ath9k: Handle txpower changes even when TPC is disabled
	signal: Extend exec_id to 64bits
	x86/entry/32: Add missing ASM_CLAC to general_protection entry
	KVM: nVMX: Properly handle userspace interrupt window request
	KVM: s390: vsie: Fix region 1 ASCE sanity shadow address checks
	KVM: s390: vsie: Fix delivery of addressing exceptions
	KVM: x86: Allocate new rmap and large page tracking when moving memslot
	KVM: VMX: Always VMCLEAR in-use VMCSes during crash with kexec support
	KVM: x86: Gracefully handle __vmalloc() failure during VM allocation
	KVM: VMX: fix crash cleanup when KVM wasn't used
	CIFS: Fix bug which the return value by asynchronous read is error
	mtd: spinand: Stop using spinand->oobbuf for buffering bad block markers
	mtd: spinand: Do not erase the block before writing a bad block marker
	Btrfs: fix crash during unmount due to race with delayed inode workers
	btrfs: set update the uuid generation as soon as possible
	btrfs: drop block from cache on error in relocation
	btrfs: fix missing file extent item for hole after ranged fsync
	btrfs: fix missing semaphore unlock in btrfs_sync_file
	crypto: mxs-dcp - fix scatterlist linearization for hash
	erofs: correct the remaining shrink objects
	powerpc/pseries: Drop pointless static qualifier in vpa_debugfs_init()
	x86/speculation: Remove redundant arch_smt_update() invocation
	tools: gpio: Fix out-of-tree build regression
	mm: Use fixed constant in page_frag_alloc instead of size + 1
	net: qualcomm: rmnet: Allow configuration updates to existing devices
	arm64: dts: allwinner: h6: Fix PMU compatible
	dm writecache: add cond_resched to avoid CPU hangs
	dm verity fec: fix memory leak in verity_fec_dtr
	scsi: zfcp: fix missing erp_lock in port recovery trigger for point-to-point
	arm64: armv8_deprecated: Fix undef_hook mask for thumb setend
	selftests: vm: drop dependencies on page flags from mlock2 tests
	rtc: omap: Use define directive for PIN_CONFIG_ACTIVE_HIGH
	drm/etnaviv: rework perfmon query infrastructure
	powerpc/pseries: Avoid NULL pointer dereference when drmem is unavailable
	NFS: Fix a page leak in nfs_destroy_unlinked_subrequests()
	ext4: fix a data race at inode->i_blocks
	fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()
	ocfs2: no need try to truncate file beyond i_size
	perf tools: Support Python 3.8+ in Makefile
	s390/diag: fix display of diagnose call statistics
	Input: i8042 - add Acer Aspire 5738z to nomux list
	clk: ingenic/jz4770: Exit with error if CGU init failed
	kmod: make request_module() return an error when autoloading is disabled
	cpufreq: powernv: Fix use-after-free
	hfsplus: fix crash and filesystem corruption when deleting files
	libata: Return correct status in sata_pmp_eh_recover_pm() when ATA_DFLAG_DETACH is set
	ipmi: fix hung processes in __get_guid()
	xen/blkfront: fix memory allocation flags in blkfront_setup_indirect()
	powerpc/powernv/idle: Restore AMR/UAMOR/AMOR after idle
	powerpc/64/tm: Don't let userspace set regs->trap via sigreturn
	powerpc/hash64/devmap: Use H_PAGE_THP_HUGE when setting up huge devmap PTE entries
	powerpc/xive: Use XIVE_BAD_IRQ instead of zero to catch non configured IPIs
	powerpc/kprobes: Ignore traps that happened in real mode
	scsi: mpt3sas: Fix kernel panic observed on soft HBA unplug
	powerpc: Add attributes for setjmp/longjmp
	powerpc: Make setjmp/longjmp signature standard
	btrfs: use nofs allocations for running delayed items
	dm zoned: remove duplicate nr_rnd_zones increase in dmz_init_zone()
	crypto: caam - update xts sector size for large input length
	crypto: ccree - improve error handling
	crypto: ccree - zero out internal struct before use
	crypto: ccree - don't mangle the request assoclen
	crypto: ccree - dec auth tag size from cryptlen map
	crypto: ccree - only try to map auth tag if needed
	Revert "drm/dp_mst: Remove VCPI while disabling topology mgr"
	drm/dp_mst: Fix clearing payload state on topology disable
	drm: Remove PageReserved manipulation from drm_pci_alloc
	ftrace/kprobe: Show the maxactive number on kprobe_events
	powerpc/fsl_booke: Avoid creating duplicate tlb1 entry
	misc: echo: Remove unnecessary parentheses and simplify check for zero
	etnaviv: perfmon: fix total and idle HI cyleces readout
	mfd: dln2: Fix sanity checking for endpoints
	efi/x86: Fix the deletion of variables in mixed mode
	Linux 4.19.116

Change-Id: If09fbb53fcb11ea01eaaa7fee7ed21ed6234f352
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-04-18 13:33:51 +02:00
Minchan Kim
c27ea19ea4 ANDROID: GKI: attribute page lock and waitqueue functions as sched
trace_sched_blocked_trace in CFS is really useful for debugging via
trace because it tell where the process was stuck on callstack.

For example,
           <...>-6143  ( 6136) [005] d..2    50.278987: sched_blocked_reason: pid=6136 iowait=0 caller=SyS_mprotect+0x88/0x208
           <...>-6136  ( 6136) [005] d..2    50.278990: sched_blocked_reason: pid=6142 iowait=0 caller=do_page_fault+0x1f4/0x3b0
           <...>-6142  ( 6136) [006] d..2    50.278996: sched_blocked_reason: pid=6144 iowait=0 caller=SyS_prctl+0x52c/0xb58
           <...>-6144  ( 6136) [006] d..2    50.279007: sched_blocked_reason: pid=6136 iowait=0 caller=vm_mmap_pgoff+0x74/0x104

However, sometime it gives pointless information like this.
    RenderThread-2322  ( 1805) [006] d.s3    50.319046: sched_blocked_reason: pid=6136 iowait=1 caller=__lock_page_killable+0x17c/0x220
     logd.writer-594   (  587) [002] d.s3    50.334011: sched_blocked_reason: pid=6126 iowait=1 caller=wait_on_page_bit+0x194/0x208
  kworker/u16:13-333   (  333) [007] d.s4    50.343161: sched_blocked_reason: pid=6136 iowait=1 caller=__lock_page_killable+0x17c/0x220

Such wait_on_page_bit, __lock_page_killable are pointless because it doesn't
carry on higher information to identify the callstack.

The reason is page_lock and waitqueue are special synchronization method unlike
other normal locks(mutex, spinlock).
Let's mark them as "__sched" so get_wchan which used in trace_sched_blocked_trace
could detect it and skip them. It will produce more meaningful callstack
function like this.

           <...>-2867  ( 1068) [002] d.h4   124.209701: sched_blocked_reason: pid=329 iowait=0 caller=worker_thread+0x378/0x470
           <...>-2867  ( 1068) [002] d.s3   124.209763: sched_blocked_reason: pid=8454 iowait=1 caller=__filemap_fdatawait_range+0xa0/0x104
           <...>-2867  ( 1068) [002] d.s4   124.209803: sched_blocked_reason: pid=869 iowait=0 caller=worker_thread+0x378/0x470
 ScreenDecoratio-2364  ( 1867) [002] d.s3   124.209973: sched_blocked_reason: pid=8454 iowait=1 caller=f2fs_wait_on_page_writeback+0x84/0xcc
 ScreenDecoratio-2364  ( 1867) [002] d.s4   124.209986: sched_blocked_reason: pid=869 iowait=0 caller=worker_thread+0x378/0x470
           <...>-329   (  329) [000] d..3   124.210435: sched_blocked_reason: pid=538 iowait=0 caller=worker_thread+0x378/0x470
  kworker/u16:13-538   (  538) [007] d..3   124.210450: sched_blocked_reason: pid=6 iowait=0 caller=worker_thread+0x378/0x470

Bug: 144961676
Bug: 144713689
Change-Id: I30397400c5d056946bdfbc86c9ef5f4d7e6c98fe
Signed-off-by: Minchan Kim <minchan@google.com>
Signed-off-by: Jimmy Shiu <jimmyshiu@google.com>
Bug: 152417756
(cherry picked from commit 8a780c0eb6800cecbfce21362c2d2a3bcab14e1c)
Signed-off-by: Saravana Kannan <saravanak@google.com>
2020-04-17 22:51:44 -07:00
Masami Hiramatsu
52f1c4257c ftrace/kprobe: Show the maxactive number on kprobe_events
[ Upstream commit 6a13a0d7b4 ]

Show maxactive parameter on kprobe_events.
This allows user to save the current configuration and
restore it without losing maxactive parameter.

Link: http://lkml.kernel.org/r/4762764a-6df7-bc93-ed60-e336146dce1f@gmail.com
Link: http://lkml.kernel.org/r/158503528846.22706.5549974121212526020.stgit@devnote2

Cc: stable@vger.kernel.org
Fixes: 696ced4fb1 ("tracing/kprobes: expose maxactive for kretprobe in kprobe_events")
Reported-by: Taeung Song <treeze.taeung@gmail.com>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-04-17 10:48:55 +02:00
Eric Biggers
2a87b491b7 kmod: make request_module() return an error when autoloading is disabled
commit d7d27cfc5c upstream.

Patch series "module autoloading fixes and cleanups", v5.

This series fixes a bug where request_module() was reporting success to
kernel code when module autoloading had been completely disabled via
'echo > /proc/sys/kernel/modprobe'.

It also addresses the issues raised on the original thread
(https://lkml.kernel.org/lkml/20200310223731.126894-1-ebiggers@kernel.org/T/#u)
bydocumenting the modprobe sysctl, adding a self-test for the empty path
case, and downgrading a user-reachable WARN_ONCE().

This patch (of 4):

It's long been possible to disable kernel module autoloading completely
(while still allowing manual module insertion) by setting
/proc/sys/kernel/modprobe to the empty string.

This can be preferable to setting it to a nonexistent file since it
avoids the overhead of an attempted execve(), avoids potential
deadlocks, and avoids the call to security_kernel_module_request() and
thus on SELinux-based systems eliminates the need to write SELinux rules
to dontaudit module_request.

However, when module autoloading is disabled in this way,
request_module() returns 0.  This is broken because callers expect 0 to
mean that the module was successfully loaded.

Apparently this was never noticed because this method of disabling
module autoloading isn't used much, and also most callers don't use the
return value of request_module() since it's always necessary to check
whether the module registered its functionality or not anyway.

But improperly returning 0 can indeed confuse a few callers, for example
get_fs_type() in fs/filesystems.c where it causes a WARNING to be hit:

	if (!fs && (request_module("fs-%.*s", len, name) == 0)) {
		fs = __get_fs_type(name, len);
		WARN_ONCE(!fs, "request_module fs-%.*s succeeded, but still no fs?\n", len, name);
	}

This is easily reproduced with:

	echo > /proc/sys/kernel/modprobe
	mount -t NONEXISTENT none /

It causes:

	request_module fs-NONEXISTENT succeeded, but still no fs?
	WARNING: CPU: 1 PID: 1106 at fs/filesystems.c:275 get_fs_type+0xd6/0xf0
	[...]

This should actually use pr_warn_once() rather than WARN_ONCE(), since
it's also user-reachable if userspace immediately unloads the module.
Regardless, request_module() should correctly return an error when it
fails.  So let's make it return -ENOENT, which matches the error when
the modprobe binary doesn't exist.

I've also sent patches to document and test this case.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Jessica Yu <jeyu@kernel.org>
Acked-by: Luis Chamberlain <mcgrof@kernel.org>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jeff Vander Stoep <jeffv@google.com>
Cc: Ben Hutchings <benh@debian.org>
Cc: Josh Triplett <josh@joshtriplett.org>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20200310223731.126894-1-ebiggers@kernel.org
Link: http://lkml.kernel.org/r/20200312202552.241885-1-ebiggers@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-17 10:48:52 +02:00
Zhenzhong Duan
6209e0981b x86/speculation: Remove redundant arch_smt_update() invocation
commit 34d66caf25 upstream.

With commit a74cfffb03 ("x86/speculation: Rework SMT state change"),
arch_smt_update() is invoked from each individual CPU hotplug function.

Therefore the extra arch_smt_update() call in the sysfs SMT control is
redundant.

Fixes: a74cfffb03 ("x86/speculation: Rework SMT state change")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: <konrad.wilk@oracle.com>
Cc: <dwmw@amazon.co.uk>
Cc: <bp@suse.de>
Cc: <srinivas.eeda@oracle.com>
Cc: <peterz@infradead.org>
Cc: <hpa@zytor.com>
Link: https://lkml.kernel.org/r/e2e064f2-e8ef-42ca-bf4f-76b612964752@default
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-17 10:48:50 +02:00
Eric W. Biederman
a2a1be2de7 signal: Extend exec_id to 64bits
commit d1e7fd6462 upstream.

Replace the 32bit exec_id with a 64bit exec_id to make it impossible
to wrap the exec_id counter.  With care an attacker can cause exec_id
wrap and send arbitrary signals to a newly exec'd parent.  This
bypasses the signal sending checks if the parent changes their
credentials during exec.

The severity of this problem can been seen that in my limited testing
of a 32bit exec_id it can take as little as 19s to exec 65536 times.
Which means that it can take as little as 14 days to wrap a 32bit
exec_id.  Adam Zabrocki has succeeded wrapping the self_exe_id in 7
days.  Even my slower timing is in the uptime of a typical server.
Which means self_exec_id is simply a speed bump today, and if exec
gets noticably faster self_exec_id won't even be a speed bump.

Extending self_exec_id to 64bits introduces a problem on 32bit
architectures where reading self_exec_id is no longer atomic and can
take two read instructions.  Which means that is is possible to hit
a window where the read value of exec_id does not match the written
value.  So with very lucky timing after this change this still
remains expoiltable.

I have updated the update of exec_id on exec to use WRITE_ONCE
and the read of exec_id in do_notify_parent to use READ_ONCE
to make it clear that there is no locking between these two
locations.

Link: https://lore.kernel.org/kernel-hardening/20200324215049.GA3710@pi3.com.pl
Fixes: 2.3.23pre2
Cc: stable@vger.kernel.org
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-17 10:48:47 +02:00
Boqun Feng
c6090fe788 locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps()
[ Upstream commit 25016bd7f4 ]

Qian Cai reported a bug when PROVE_RCU_LIST=y, and read on /proc/lockdep
triggered a warning:

  [ ] DEBUG_LOCKS_WARN_ON(current->hardirqs_enabled)
  ...
  [ ] Call Trace:
  [ ]  lock_is_held_type+0x5d/0x150
  [ ]  ? rcu_lockdep_current_cpu_online+0x64/0x80
  [ ]  rcu_read_lock_any_held+0xac/0x100
  [ ]  ? rcu_read_lock_held+0xc0/0xc0
  [ ]  ? __slab_free+0x421/0x540
  [ ]  ? kasan_kmalloc+0x9/0x10
  [ ]  ? __kmalloc_node+0x1d7/0x320
  [ ]  ? kvmalloc_node+0x6f/0x80
  [ ]  __bfs+0x28a/0x3c0
  [ ]  ? class_equal+0x30/0x30
  [ ]  lockdep_count_forward_deps+0x11a/0x1a0

The warning got triggered because lockdep_count_forward_deps() call
__bfs() without current->lockdep_recursion being set, as a result
a lockdep internal function (__bfs()) is checked by lockdep, which is
unexpected, and the inconsistency between the irq-off state and the
state traced by lockdep caused the warning.

Apart from this warning, lockdep internal functions like __bfs() should
always be protected by current->lockdep_recursion to avoid potential
deadlocks and data inconsistency, therefore add the
current->lockdep_recursion on-and-off section to protect __bfs() in both
lockdep_count_forward_deps() and lockdep_count_backward_deps()

Reported-by: Qian Cai <cai@lca.pw>
Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20200312151258.128036-1-boqun.feng@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-04-17 10:48:42 +02:00
Alexander Sverdlin
1b16ddb28b genirq/irqdomain: Check pointer in irq_domain_alloc_irqs_hierarchy()
[ Upstream commit 87f2d1c662 ]

irq_domain_alloc_irqs_hierarchy() has 3 call sites in the compilation unit
but only one of them checks for the pointer which is being dereferenced
inside the called function. Move the check into the function. This allows
for catching the error instead of the following crash:

Unable to handle kernel NULL pointer dereference at virtual address 00000000
PC is at 0x0
LR is at gpiochip_hierarchy_irq_domain_alloc+0x11f/0x140
...
[<c06c23ff>] (gpiochip_hierarchy_irq_domain_alloc)
[<c0462a89>] (__irq_domain_alloc_irqs)
[<c0462dad>] (irq_create_fwspec_mapping)
[<c06c2251>] (gpiochip_to_irq)
[<c06c1c9b>] (gpiod_to_irq)
[<bf973073>] (gpio_irqs_init [gpio_irqs])
[<bf974048>] (gpio_irqs_exit+0xecc/0xe84 [gpio_irqs])
Code: bad PC value

Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/20200306174720.82604-1-alexander.sverdlin@nokia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-04-17 10:48:41 +02:00