Commit Graph

29423 Commits

Author SHA1 Message Date
Tao Huang
5647c1d492 Merge tag 'ASB-2020-12-05_4.19-stable' of https://android.googlesource.com/kernel/common
https://source.android.com/security/bulletin/2020-12-01
CVE-2020-0444
CVE-2020-0465
CVE-2020-0466

* tag 'ASB-2020-12-05_4.19-stable': (636 commits)
  ANDROID: kbuild: use grep -F instead of fgrep
  ANDROID: GKI: usb: gadget: support claiming indexed endpoints by name
  UPSTREAM: arm64: sysreg: Clean up instructions for modifying PSTATE fields
  Revert "Revert "ANDROID: clang: update to 11.0.5""
  ANDROID: kbuild: speed up ksym_dep_filter
  Revert "drm/atomic_helper: Stop modesets on unregistered connectors harder"
  Linux 4.19.161
  USB: core: Fix regression in Hercules audio card
  x86/resctrl: Add necessary kernfs_put() calls to prevent refcount leak
  x86/resctrl: Remove superfluous kernfs_get() calls to prevent refcount leak
  x86/speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb
  usb: gadget: Fix memleak in gadgetfs_fill_super
  USB: quirks: Add USB_QUIRK_DISCONNECT_SUSPEND quirk for Lenovo A630Z TIO built-in usb-audio card
  usb: gadget: f_midi: Fix memleak in f_midi_alloc
  USB: core: Change %pK for __user pointers to %px
  perf probe: Fix to die_entrypc() returns error correctly
  can: m_can: fix nominal bitiming tseg2 min for version >= 3.1
  platform/x86: toshiba_acpi: Fix the wrong variable assignment
  platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup time
  can: gs_usb: fix endianess problem with candleLight firmware
  ...

Change-Id: I82ccfc3d6561d3ef3b1b06ac98d48fac997c8fb6

Conflicts:
	drivers/pinctrl/pinctrl-rockchip.c
	drivers/usb/dwc3/gadget.c
	drivers/usb/host/xhci.c
	drivers/usb/host/xhci.h
2020-12-29 16:10:48 +08:00
Quentin Perret
444683e9df BACKPORT: sched/fair: Fix overutilized update in enqueue_task_fair()
[ Upstream commit 8e1ac4299a ]

enqueue_task_fair() attempts to skip the overutilized update for new
tasks as their util_avg is not accurate yet. However, the flag we check
to do so is overwritten earlier on in the function, which makes the
condition pretty much a nop.

Fix this by saving the flag early on.

Fixes: 2802bf3cd9 ("sched/fair: Add over-utilization/tipping point indicator")
Reported-by: Rick Yiu <rickyiu@google.com>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Link: https://lkml.kernel.org/r/20201112111201.2081902-1-qperret@google.com
Change-Id: I04a99c7db2d0559e838343762a928ac6caa1a9c4
2020-11-24 16:51:57 +00:00
Greg Kroah-Hartman
f8d9d560b9 This is the 4.19.160 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl+8/EkACgkQONu9yGCS
 aT6g6xAAxZs2sTi6peZpLHhzTgMUZtZYJf9rgAWeF3wwIT1DeEVi8dpOuQbu6j17
 bK65D/qJjmiZGJbFG+Mjt5GcQBOnQz+hQ+EaaADk3HOt6G9oFB99Bybmg6JP94TH
 184JkzUMBnHWj9O4wBtF9IjqPoN5iDIz07D8RArxAqXW8+IWX6BjY2Qzd/dO2vns
 UufBBoKznAC1HWwI1WGyMTki+DHtk1m8hV4+H0G4wHrux4cQRXWzxZx3Zfnmkjqh
 v7Ig90GzVegxHjreYc7RnxDi4XCgOhRqevB+0uf5jms7mzd4spxz1kaAZqO5r/DQ
 tTn/90CL2n7+LC6HGZSGnD5WdKawEZwgbimjpsAQ8uygWyzTJ23hL71ZiGxFaKPc
 Yc7UqVMsSsFCAxUc+ri7ZLrKqBEn3NFZNNjAlqZRW4k1ayjuNz7EdP6CS9T6AZih
 vqmeygmnALbKaX/VPDk/GChWtcpSOfNRA4d3XkSdANavIsNoI114tKZOwwLUQQjd
 D/8h2gng7gnX6TquMQSLyQmYTTV3UxK8UW1Ipi00KLMfmYVHMSI0gn2fGDUwOyfJ
 vkwi/15GJXKQ+GJAvkuyJEDTwFE0iU/+gM28Jv56L9Kv25vWu7vdQVcDU6vslEhY
 bbPMzkOA8zSwOkTZTWS8k6cpMMeiWbIZyxHKovXsU84n0nSf6Hs=
 =IcSi
 -----END PGP SIGNATURE-----

Merge 4.19.160 into android-4.19-stable

Changes in 4.19.160
	ah6: fix error return code in ah6_input()
	atm: nicstar: Unmap DMA on send error
	bnxt_en: read EEPROM A2h address using page 0
	devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill()
	inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()
	lan743x: fix issue causing intermittent kernel log warnings
	lan743x: prevent entire kernel HANG on open, for some platforms
	mlxsw: core: Use variable timeout for EMAD retries
	net: b44: fix error return code in b44_init_one()
	net: bridge: add missing counters to ndo_get_stats64 callback
	net: dsa: mv88e6xxx: Avoid VTU corruption on 6097
	net: Have netpoll bring-up DSA management interface
	netlabel: fix our progress tracking in netlbl_unlabel_staticlist()
	netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()
	net/mlx4_core: Fix init_hca fields offset
	net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup
	net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request
	page_frag: Recover from memory pressure
	qed: fix error return code in qed_iwarp_ll2_start()
	qlcnic: fix error return code in qlcnic_83xx_restart_hw()
	sctp: change to hold/put transport for proto_unreach_timer
	tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate
	net/mlx5: Disable QoS when min_rates on all VFs are zero
	net: usb: qmi_wwan: Set DTR quirk for MR400
	net/ncsi: Fix netlink registration
	net: ftgmac100: Fix crash when removing driver
	pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq
	scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold()
	selftests: kvm: Fix the segment descriptor layout to match the actual layout
	ACPI: button: Add DMI quirk for Medion Akoya E2228T
	arm64: psci: Avoid printing in cpu_psci_cpu_die()
	vfs: remove lockdep bogosity in __sb_start_write
	arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node
	arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node
	ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix ethernet node
	Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high"
	ARM: dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on Ethernet PHY
	ARM: dts: sun8i: a83t: Enable both RGMII RX/TX delay on Ethernet PHY
	arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY
	Input: adxl34x - clean up a data type in adxl34x_probe()
	MIPS: export has_transparent_hugepage() for modules
	arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node
	arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy
	ARM: dts: imx50-evk: Fix the chip select 1 IOMUX
	Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER
	perf lock: Don't free "lock_seq_stat" if read_count isn't zero
	ip_tunnels: Set tunnel option flag when tunnel metadata is present
	can: af_can: prevent potential access of uninitialized member in can_rcv()
	can: af_can: prevent potential access of uninitialized member in canfd_rcv()
	can: dev: can_restart(): post buffer from the right context
	can: ti_hecc: Fix memleak in ti_hecc_probe
	can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb()
	can: peak_usb: fix potential integer overflow on shift of a int
	can: m_can: m_can_handle_state_change(): fix state change
	ASoC: qcom: lpass-platform: Fix memory leak
	MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu
	drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind()
	can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits
	xfs: fix the minrecs logic when dealing with inode root child blocks
	xfs: strengthen rmap record flags checking
	regulator: ti-abb: Fix array out of bound read access on the first transition
	fail_function: Remove a redundant mutex unlock
	xfs: revert "xfs: fix rmap key and record comparison functions"
	efi/x86: Free efi_pgd with free_pages()
	libfs: fix error cast of negative value in simple_attr_write()
	speakup: Do not let the line discipline be used several times
	ALSA: firewire: Clean up a locking issue in copy_resp_to_buf()
	ALSA: usb-audio: Add delay quirk for all Logitech USB devices
	ALSA: ctl: fix error path at adding user-defined element set
	ALSA: mixart: Fix mutex deadlock
	ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220)
	tty: serial: imx: keep console clocks always on
	efivarfs: fix memory leak in efivarfs_create()
	staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids
	ext4: fix bogus warning in ext4_update_dx_flag()
	iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum
	iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode
	regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200}
	regulator: fix memory leak with repeated set_machine_constraints()
	regulator: avoid resolve_supply() infinite recursion
	regulator: workaround self-referent regulators
	xtensa: disable preemption around cache alias management calls
	mac80211: minstrel: remove deferred sampling code
	mac80211: minstrel: fix tx status processing corner case
	mac80211: free sta in sta_info_insert_finish() on errors
	s390/cpum_sf.c: fix file permission for cpum_sfb_size
	s390/dasd: fix null pointer dereference for ERP requests
	ptrace: Set PF_SUPERPRIV when checking capability
	seccomp: Set PF_SUPERPRIV when checking capability
	x86/microcode/intel: Check patch signature before saving microcode for early loading
	mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault()
	Linux 4.19.160

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I3a7304be6687f4ffe96f0e765da0c0ec7dcb971d
2020-11-24 14:57:17 +01:00
Mickaël Salaün
3863935f06 seccomp: Set PF_SUPERPRIV when checking capability
commit fb14528e44 upstream.

Replace the use of security_capable(current_cred(), ...) with
ns_capable_noaudit() which set PF_SUPERPRIV.

Since commit 98f368e9e2 ("kernel: Add noaudit variant of
ns_capable()"), a new ns_capable_noaudit() helper is available.  Let's
use it!

Cc: Jann Horn <jannh@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Tyler Hicks <tyhicks@linux.microsoft.com>
Cc: Will Drewry <wad@chromium.org>
Cc: stable@vger.kernel.org
Fixes: e2cfabdfd0 ("seccomp: add system call filtering using BPF")
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
Reviewed-by: Jann Horn <jannh@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20201030123849.770769-3-mic@digikod.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-24 13:27:26 +01:00
Mickaël Salaün
26c5606ff7 ptrace: Set PF_SUPERPRIV when checking capability
commit cf23705244 upstream.

Commit 69f594a389 ("ptrace: do not audit capability check when outputing
/proc/pid/stat") replaced the use of ns_capable() with
has_ns_capability{,_noaudit}() which doesn't set PF_SUPERPRIV.

Commit 6b3ad6649a ("ptrace: reintroduce usage of subjective credentials in
ptrace_has_cap()") replaced has_ns_capability{,_noaudit}() with
security_capable(), which doesn't set PF_SUPERPRIV neither.

Since commit 98f368e9e2 ("kernel: Add noaudit variant of ns_capable()"), a
new ns_capable_noaudit() helper is available.  Let's use it!

As a result, the signature of ptrace_has_cap() is restored to its original one.

Cc: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Eric Paris <eparis@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Serge E. Hallyn <serge@hallyn.com>
Cc: Tyler Hicks <tyhicks@linux.microsoft.com>
Cc: stable@vger.kernel.org
Fixes: 6b3ad6649a ("ptrace: reintroduce usage of subjective credentials in ptrace_has_cap()")
Fixes: 69f594a389 ("ptrace: do not audit capability check when outputing /proc/pid/stat")
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
Reviewed-by: Jann Horn <jannh@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20201030123849.770769-2-mic@digikod.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-24 13:27:26 +01:00
Luo Meng
730b192ad2 fail_function: Remove a redundant mutex unlock
[ Upstream commit 2801a5da5b ]

Fix a mutex_unlock() issue where before copy_from_user() is
not called mutex_locked.

Fixes: 4b1a29a7f5 ("error-injection: Support fault injection framework")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Luo Meng <luomeng12@huawei.com>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Link: https://lore.kernel.org/bpf/160570737118.263807.8358435412898356284.stgit@devnote2
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-11-24 13:27:23 +01:00
Greg Kroah-Hartman
67730020fa Merge 4.19.158 into android-4.19-stable
Changes in 4.19.158
	regulator: defer probe when trying to get voltage from unresolved supply
	time: Prevent undefined behaviour in timespec64_to_ns()
	nbd: don't update block size after device is started
	usb: dwc3: gadget: Continue to process pending requests
	usb: dwc3: gadget: Reclaim extra TRBs after request completion
	btrfs: sysfs: init devices outside of the chunk_mutex
	btrfs: reschedule when cloning lots of extents
	genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY
	hv_balloon: disable warning when floor reached
	net: xfrm: fix a race condition during allocing spi
	xfs: set xefi_discard when creating a deferred agfl free log intent item
	netfilter: ipset: Update byte and packet counters regardless of whether they match
	perf tools: Add missing swap for ino_generation
	ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link()
	can: rx-offload: don't call kfree_skb() from IRQ context
	can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
	can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames
	can: can_create_echo_skb(): fix echo skb generation: always use skb_clone()
	can: peak_usb: add range checking in decode operations
	can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping
	can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on
	can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for LS1021A
	xfs: flush new eof page on truncate to avoid post-eof corruption
	xfs: fix scrub flagging rtinherit even if there is no rt device
	tpm: efi: Don't create binary_bios_measurements file for an empty log
	Btrfs: fix missing error return if writeback for extent buffer never started
	ath9k_htc: Use appropriate rs_datalen type
	netfilter: use actual socket sk rather than skb sk when routing harder
	crypto: arm64/aes-modes - get rid of literal load of addend vector
	usb: gadget: goku_udc: fix potential crashes in probe
	gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
	gfs2: Add missing truncate_inode_pages_final for sd_aspace
	gfs2: check for live vs. read-only file system in gfs2_fitrim
	scsi: hpsa: Fix memory leak in hpsa_init_one()
	drm/amdgpu: perform srbm soft reset always on SDMA resume
	drm/amd/pm: perform SMC reset on suspend/hibernation
	drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running
	mac80211: fix use of skb payload instead of header
	cfg80211: regulatory: Fix inconsistent format argument
	scsi: scsi_dh_alua: Avoid crash during alua_bus_detach()
	iommu/amd: Increase interrupt remapping table limit to 512 entries
	s390/smp: move rcu_cpu_starting() earlier
	vfio: platform: fix reference leak in vfio_platform_open
	selftests: proc: fix warning: _GNU_SOURCE redefined
	tpm_tis: Disable interrupts on ThinkPad T490s
	tick/common: Touch watchdog in tick_unfreeze() on all CPUs
	mfd: sprd: Add wakeup capability for PMIC IRQ
	pinctrl: intel: Set default bias in case no particular value given
	ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe template
	pinctrl: aspeed: Fix GPI only function problem.
	nbd: fix a block_device refcount leak in nbd_release
	xfs: fix flags argument to rmap lookup when converting shared file rmaps
	xfs: set the unwritten bit in rmap lookup flags in xchk_bmap_get_rmapextents
	xfs: fix rmap key and record comparison functions
	xfs: fix brainos in the refcount scrubber's rmap fragment processor
	lan743x: fix "BUG: invalid wait context" when setting rx mode
	xfs: fix a missing unlock on error in xfs_fs_map_blocks
	of/address: Fix of_node memory leak in of_dma_is_coherent
	cosa: Add missing kfree in error path of cosa_write
	perf: Fix get_recursion_context()
	ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA
	ext4: unlock xattr_sem properly in ext4_inline_data_truncate()
	btrfs: ref-verify: fix memory leak in btrfs_ref_tree_mod
	btrfs: dev-replace: fail mount if we don't have replace item with target device
	thunderbolt: Fix memory leak if ida_simple_get() fails in enumerate_services()
	thunderbolt: Add the missed ida_simple_remove() in ring_request_msix()
	uio: Fix use-after-free in uio_unregister_device()
	usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode
	xhci: hisilicon: fix refercence leak in xhci_histb_probe
	mei: protect mei_cl_mtu from null dereference
	futex: Don't enable IRQs unconditionally in put_pi_state()
	ocfs2: initialize ip_next_orphan
	btrfs: fix potential overflow in cluster_pages_for_defrag on 32bit arch
	selinux: Fix error return code in sel_ib_pkey_sid_slow()
	gpio: pcie-idio-24: Fix irq mask when masking
	gpio: pcie-idio-24: Fix IRQ Enable Register value
	gpio: pcie-idio-24: Enable PEX8311 interrupts
	mmc: renesas_sdhi_core: Add missing tmio_mmc_host_free() at remove
	don't dump the threads that had been already exiting when zapped.
	drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[]
	pinctrl: amd: use higher precision for 512 RtcClk
	pinctrl: amd: fix incorrect way to disable debounce filter
	erofs: derive atime instead of leaving it empty
	swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb"
	IPv6: Set SIT tunnel hard_header_len to zero
	net/af_iucv: fix null pointer dereference on shutdown
	net: Update window_clamp if SOCK_RCVBUF is set
	net/x25: Fix null-ptr-deref in x25_connect
	tipc: fix memory leak in tipc_topsrv_start()
	vrf: Fix fast path output packet handling with async Netfilter rules
	r8169: fix potential skb double free in an error path
	random32: make prandom_u32() output unpredictable
	x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP
	perf scripting python: Avoid declaring function pointers with a visibility attribute
	perf/core: Fix race in the perf_mmap_close() function
	Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint"
	reboot: fix overflow parsing reboot cpu number
	net: sch_generic: fix the missing new qdisc assignment bug
	Convert trailing spaces and periods in path components
	Linux 4.19.158

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic626f4e05969543a701587d14bce4476cb146303
2020-11-19 12:25:33 +01:00
Matteo Croce
2e021b7197 reboot: fix overflow parsing reboot cpu number
commit df5b0ab3e0 upstream.

Limit the CPU number to num_possible_cpus(), because setting it to a
value lower than INT_MAX but higher than NR_CPUS produces the following
error on reboot and shutdown:

    BUG: unable to handle page fault for address: ffffffff90ab1bb0
    #PF: supervisor read access in kernel mode
    #PF: error_code(0x0000) - not-present page
    PGD 1c09067 P4D 1c09067 PUD 1c0a063 PMD 0
    Oops: 0000 [#1] SMP
    CPU: 1 PID: 1 Comm: systemd-shutdow Not tainted 5.9.0-rc8-kvm #110
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014
    RIP: 0010:migrate_to_reboot_cpu+0xe/0x60
    Code: ea ea 00 48 89 fa 48 c7 c7 30 57 f1 81 e9 fa ef ff ff 66 2e 0f 1f 84 00 00 00 00 00 53 8b 1d d5 ea ea 00 e8 14 33 fe ff 89 da <48> 0f a3 15 ea fc bd 00 48 89 d0 73 29 89 c2 c1 e8 06 65 48 8b 3c
    RSP: 0018:ffffc90000013e08 EFLAGS: 00010246
    RAX: ffff88801f0a0000 RBX: 0000000077359400 RCX: 0000000000000000
    RDX: 0000000077359400 RSI: 0000000000000002 RDI: ffffffff81c199e0
    RBP: ffffffff81c1e3c0 R08: ffff88801f41f000 R09: ffffffff81c1e348
    R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
    R13: 00007f32bedf8830 R14: 00000000fee1dead R15: 0000000000000000
    FS:  00007f32bedf8980(0000) GS:ffff88801f480000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: ffffffff90ab1bb0 CR3: 000000001d057000 CR4: 00000000000006a0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
      __do_sys_reboot.cold+0x34/0x5b
      do_syscall_64+0x2d/0x40

Fixes: 1b3a5d02ee ("reboot: move arch/x86 reboot= handling to generic kernel")
Signed-off-by: Matteo Croce <mcroce@microsoft.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Fabian Frederick <fabf@skynet.be>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Kees Cook <keescook@chromium.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Pavel Tatashin <pasha.tatashin@soleen.com>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Robin Holt <robinmholt@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20201103214025.116799-3-mcroce@linux.microsoft.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[sudip: use reboot_mode instead of mode]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-18 19:18:52 +01:00
Matteo Croce
9a6cea8220 Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint"
commit 8b92c4ff44 upstream.

Patch series "fix parsing of reboot= cmdline", v3.

The parsing of the reboot= cmdline has two major errors:

 - a missing bound check can crash the system on reboot

 - parsing of the cpu number only works if specified last

Fix both.

This patch (of 2):

This reverts commit 616feab753.

kstrtoint() and simple_strtoul() have a subtle difference which makes
them non interchangeable: if a non digit character is found amid the
parsing, the former will return an error, while the latter will just
stop parsing, e.g.  simple_strtoul("123xyx") = 123.

The kernel cmdline reboot= argument allows to specify the CPU used for
rebooting, with the syntax `s####` among the other flags, e.g.
"reboot=warm,s31,force", so if this flag is not the last given, it's
silently ignored as well as the subsequent ones.

Fixes: 616feab753 ("kernel/reboot.c: convert simple_strtoul to kstrtoint")
Signed-off-by: Matteo Croce <mcroce@microsoft.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Pavel Tatashin <pasha.tatashin@soleen.com>
Cc: Robin Holt <robinmholt@gmail.com>
Cc: Fabian Frederick <fabf@skynet.be>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20201103214025.116799-2-mcroce@linux.microsoft.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[sudip: use reboot_mode instead of mode]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-18 19:18:52 +01:00
Jiri Olsa
1cbfb60332 perf/core: Fix race in the perf_mmap_close() function
commit f91072ed1b upstream.

There's a possible race in perf_mmap_close() when checking ring buffer's
mmap_count refcount value. The problem is that the mmap_count check is
not atomic because we call atomic_dec() and atomic_read() separately.

  perf_mmap_close:
  ...
   atomic_dec(&rb->mmap_count);
   ...
   if (atomic_read(&rb->mmap_count))
      goto out_put;

   <ring buffer detach>
   free_uid

out_put:
  ring_buffer_put(rb); /* could be last */

The race can happen when we have two (or more) events sharing same ring
buffer and they go through atomic_dec() and then they both see 0 as refcount
value later in atomic_read(). Then both will go on and execute code which
is meant to be run just once.

The code that detaches ring buffer is probably fine to be executed more
than once, but the problem is in calling free_uid(), which will later on
demonstrate in related crashes and refcount warnings, like:

  refcount_t: addition on 0; use-after-free.
  ...
  RIP: 0010:refcount_warn_saturate+0x6d/0xf
  ...
  Call Trace:
  prepare_creds+0x190/0x1e0
  copy_creds+0x35/0x172
  copy_process+0x471/0x1a80
  _do_fork+0x83/0x3a0
  __do_sys_wait4+0x83/0x90
  __do_sys_clone+0x85/0xa0
  do_syscall_64+0x5b/0x1e0
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Using atomic decrease and check instead of separated calls.

Tested-by: Michael Petlan <mpetlan@redhat.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Acked-by: Wade Mealing <wmealing@redhat.com>
Fixes: 9bb5d40cd9 ("perf: Fix mmap() accounting hole");
Link: https://lore.kernel.org/r/20200916115311.GE2301783@krava
[sudip: used ring_buffer]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-18 19:18:52 +01:00
George Spelvin
81d7c56d6f random32: make prandom_u32() output unpredictable
commit c51f8f88d7 upstream.

Non-cryptographic PRNGs may have great statistical properties, but
are usually trivially predictable to someone who knows the algorithm,
given a small sample of their output.  An LFSR like prandom_u32() is
particularly simple, even if the sample is widely scattered bits.

It turns out the network stack uses prandom_u32() for some things like
random port numbers which it would prefer are *not* trivially predictable.
Predictability led to a practical DNS spoofing attack.  Oops.

This patch replaces the LFSR with a homebrew cryptographic PRNG based
on the SipHash round function, which is in turn seeded with 128 bits
of strong random key.  (The authors of SipHash have *not* been consulted
about this abuse of their algorithm.)  Speed is prioritized over security;
attacks are rare, while performance is always wanted.

Replacing all callers of prandom_u32() is the quick fix.
Whether to reinstate a weaker PRNG for uses which can tolerate it
is an open question.

Commit f227e3ec3b ("random32: update the net random state on interrupt
and activity") was an earlier attempt at a solution.  This patch replaces
it.

Reported-by: Amit Klein <aksecurity@gmail.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: Eric Dumazet <edumazet@google.com>
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: tytso@mit.edu
Cc: Florian Westphal <fw@strlen.de>
Cc: Marc Plumb <lkml.mplumb@gmail.com>
Fixes: f227e3ec3b ("random32: update the net random state on interrupt and activity")
Signed-off-by: George Spelvin <lkml@sdf.org>
Link: https://lore.kernel.org/netdev/20200808152628.GA27941@SDF.ORG/
[ willy: partial reversal of f227e3ec3b5c; moved SIPROUND definitions
  to prandom.h for later use; merged George's prandom_seed() proposal;
  inlined siprand_u32(); replaced the net_rand_state[] array with 4
  members to fix a build issue; cosmetic cleanups to make checkpatch
  happy; fixed RANDOM32_SELFTEST build ]
[wt: backported to 4.19 -- various context adjustments]
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-18 19:18:52 +01:00
Stefano Stabellini
02ee0fe622 swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb"
commit e9696d259d upstream.

kernel/dma/swiotlb.c:swiotlb_init gets called first and tries to
allocate a buffer for the swiotlb. It does so by calling

  memblock_alloc_low(PAGE_ALIGN(bytes), PAGE_SIZE);

If the allocation must fail, no_iotlb_memory is set.

Later during initialization swiotlb-xen comes in
(drivers/xen/swiotlb-xen.c:xen_swiotlb_init) and given that io_tlb_start
is != 0, it thinks the memory is ready to use when actually it is not.

When the swiotlb is actually needed, swiotlb_tbl_map_single gets called
and since no_iotlb_memory is set the kernel panics.

Instead, if swiotlb-xen.c:xen_swiotlb_init knew the swiotlb hadn't been
initialized, it would do the initialization itself, which might still
succeed.

Fix the panic by setting io_tlb_start to 0 on swiotlb initialization
failure, and also by setting no_iotlb_memory to false on swiotlb
initialization success.

Fixes: ac2cbab21f ("x86: Don't panic if can not alloc buffer for swiotlb")

Reported-by: Elliott Mitchell <ehem+xen@m5p.com>
Tested-by: Elliott Mitchell <ehem+xen@m5p.com>
Signed-off-by: Stefano Stabellini <stefano.stabellini@xilinx.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-18 19:18:51 +01:00
Al Viro
9bb7c38254 don't dump the threads that had been already exiting when zapped.
commit 77f6ab8b77 upstream.

Coredump logics needs to report not only the registers of the dumping
thread, but (since 2.5.43) those of other threads getting killed.

Doing that might require extra state saved on the stack in asm glue at
kernel entry; signal delivery logics does that (we need to be able to
save sigcontext there, at the very least) and so does seccomp.

That covers all callers of do_coredump().  Secondary threads get hit with
SIGKILL and caught as soon as they reach exit_mm(), which normally happens
in signal delivery, so those are also fine most of the time.  Unfortunately,
it is possible to end up with secondary zapped when it has already entered
exit(2) (or, worse yet, is oopsing).  In those cases we reach exit_mm()
when mm->core_state is already set, but the stack contents is not what
we would have in signal delivery.

At least on two architectures (alpha and m68k) it leads to infoleaks - we
end up with a chunk of kernel stack written into coredump, with the contents
consisting of normal C stack frames of the call chain leading to exit_mm()
instead of the expected copy of userland registers.  In case of alpha we
leak 312 bytes of stack.  Other architectures (including the regset-using
ones) might have similar problems - the normal user of regsets is ptrace
and the state of tracee at the time of such calls is special in the same
way signal delivery is.

Note that had the zapper gotten to the exiting thread slightly later,
it wouldn't have been included into coredump anyway - we skip the threads
that have already cleared their ->mm.  So let's pretend that zapper always
loses the race.  IOW, have exit_mm() only insert into the dumper list if
we'd gotten there from handling a fatal signal[*]

As the result, the callers of do_exit() that have *not* gone through get_signal()
are not seen by coredump logics as secondary threads.  Which excludes voluntary
exit()/oopsen/traps/etc.  The dumper thread itself is unaffected by that,
so seccomp is fine.

[*] originally I intended to add a new flag in tsk->flags, but ebiederman pointed
out that PF_SIGNALED is already doing just what we need.

Cc: stable@vger.kernel.org
Fixes: d89f3847def4 ("[PATCH] thread-aware coredumps, 2.5.43-C3")
History-tree: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-18 19:18:50 +01:00
Dan Carpenter
3f7277405f futex: Don't enable IRQs unconditionally in put_pi_state()
commit 1e106aa350 upstream.

The exit_pi_state_list() function calls put_pi_state() with IRQs disabled
and is not expecting that IRQs will be enabled inside the function.

Use the _irqsave() variant so that IRQs are restored to the original state
instead of being enabled unconditionally.

Fixes: 153fbd1226 ("futex: Fix more put_pi_state() vs. exit_pi_state_list() races")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201106085205.GA1159983@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-18 19:18:49 +01:00
Peter Zijlstra
0f4eb125c5 perf: Fix get_recursion_context()
[ Upstream commit ce0f17fc93 ]

One should use in_serving_softirq() to detect SoftIRQ context.

Fixes: 96f6d44443 ("perf_counter: avoid recursion")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20201030151955.120572175@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-11-18 19:18:48 +01:00
Chunyan Zhang
880d94c781 tick/common: Touch watchdog in tick_unfreeze() on all CPUs
commit 5167c506d6 upstream.

Suspend to IDLE invokes tick_unfreeze() on resume. tick_unfreeze() on the
first resuming CPU resumes timekeeping, which also has the side effect of
resetting the softlockup watchdog on this CPU.

But on the secondary CPUs the watchdog is not reset in the resume /
unfreeze() path, which can result in false softlockup warnings on those
CPUs depending on the time spent in suspend.

Prevent this by clearing the softlock watchdog in the unfreeze path also
on the secondary resuming CPUs.

[ tglx: Massaged changelog ]

Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20200110083902.27276-1-chunyan.zhang@unisoc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-18 19:18:46 +01:00
Marc Zyngier
9d9c830b50 genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY
[ Upstream commit 151a535171 ]

kernel/irq/ipi.c otherwise fails to compile if nothing else
selects it.

Fixes: 379b656446 ("genirq: Add GENERIC_IRQ_IPI Kconfig symbol")
Reported-by: Pavel Machek <pavel@ucw.cz>
Tested-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20201015101222.GA32747@amd
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-11-18 19:18:41 +01:00
Zeng Tao
68e51bf376 time: Prevent undefined behaviour in timespec64_to_ns()
[ Upstream commit cb47755725 ]

UBSAN reports:

Undefined behaviour in ./include/linux/time64.h:127:27
signed integer overflow:
17179869187 * 1000000000 cannot be represented in type 'long long int'
Call Trace:
 timespec64_to_ns include/linux/time64.h:127 [inline]
 set_cpu_itimer+0x65c/0x880 kernel/time/itimer.c:180
 do_setitimer+0x8e/0x740 kernel/time/itimer.c:245
 __x64_sys_setitimer+0x14c/0x2c0 kernel/time/itimer.c:336
 do_syscall_64+0xa1/0x540 arch/x86/entry/common.c:295

Commit bd40a17576 ("y2038: itimer: change implementation to timespec64")
replaced the original conversion which handled time clamping correctly with
timespec64_to_ns() which has no overflow protection.

Fix it in timespec64_to_ns() as this is not necessarily limited to the
usage in itimers.

[ tglx: Added comment and adjusted the fixes tag ]

Fixes: 361a3bf005 ("time64: Add time64.h header and define struct timespec64")
Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/1598952616-6416-1-git-send-email-prime.zeng@hisilicon.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-11-18 19:18:40 +01:00
Tejun Heo
472105fcb7 UPSTREAM: cgroup: Move cgroup_parse_float() implementation out of CONFIG_SYSFS
a5e112e642 ("cgroup: add cgroup_parse_float()") accidentally added
cgroup_parse_float() inside CONFIG_SYSFS block.  Move it outside so
that it doesn't cause failures on !CONFIG_SYSFS builds.

Signed-off-by: Tejun Heo <tj@kernel.org>
Fixes: a5e112e642 ("cgroup: add cgroup_parse_float()")
(cherry picked from commit 38cf3a687f)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Icbd35d6b73b2f7d05a23ad84880c447a6035fa11
2020-11-16 09:22:35 +01:00
Dmitry V. Levin
e0ceb10136 UPSTREAM: fork: don't check parent_tidptr with CLONE_PIDFD
Give userspace a cheap and reliable way to tell whether CLONE_PIDFD is
supported by the kernel or not. The easiest way is to pass an invalid
file descriptor value in parent_tidptr, perform the syscall and verify
that parent_tidptr has been changed to a valid file descriptor value.

CLONE_PIDFD uses parent_tidptr to return pidfds. CLONE_PARENT_SETTID
will use parent_tidptr to return the tid of the parent. The two flags
cannot be used together. Old kernels that only support
CLONE_PARENT_SETTID will not verify the value pointed to by
parent_tidptr. This behavior is unchanged even with the introduction of
CLONE_PIDFD.
However, if CLONE_PIDFD is specified the kernel will currently check the
value pointed to by parent_tidptr before placing the pidfd in the memory
pointed to. EINVAL will be returned if the value in parent_tidptr is not
0.

If CLONE_PIDFD is supported and fd 0 is closed, then the returned pidfd
can and likely will be 0 and parent_tidptr will be unchanged. This means
userspace must either check CLONE_PIDFD support beforehand or check that
fd 0 is not closed when invoking CLONE_PIDFD.

The check for pidfd == 0 was introduced during the v5.2 merge window by
commit b3e5838252 ("clone: add CLONE_PIDFD") to ensure that
CLONE_PIDFD could be potentially extended by passing in flags through
the return argument.

However, that extension would look horrible, and with the upcoming
introduction of the clone3 syscall in v5.3 there is no need to extend
legacy clone syscall this way. (Even if it would need to be extended,
CLONE_DETACHED can be reused with CLONE_PIDFD.)

So remove the pidfd == 0 check. Userspace that needs to be portable to
kernels without CLONE_PIDFD support can then be advised to initialize
pidfd to -1 and check the pidfd value returned by CLONE_PIDFD.

Fixes: b3e5838252 ("clone: add CLONE_PIDFD")
Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
Signed-off-by: Christian Brauner <christian@brauner.io>
(cherry picked from commit 9014143bab)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ifc531d94c3b9d3b08a6570d5f7779858dd1d6976
2020-11-16 09:22:35 +01:00
Arnd Bergmann
4f973dff40 UPSTREAM: timekeeping/vsyscall: Use __iter_div_u64_rem()
On 32-bit x86 when building with clang-9, the 'division' loop gets turned
back into an inefficient division that causes a link error:

kernel/time/vsyscall.o: In function `update_vsyscall':
vsyscall.c:(.text+0xe3): undefined reference to `__udivdi3'

Use the existing __iter_div_u64_rem() function which is used to address the
same issue in other places.

Fixes: 44f57d788e ("timekeeping: Provide a generic update_vsyscall() implementation")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Tested-by: Nathan Chancellor <natechancellor@gmail.com>
Link: https://lkml.kernel.org/r/20190710130206.1670830-1-arnd@arndb.de
(cherry picked from commit 0df1c9868c)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ia4f87df23b07dd0835ca5f1a6eb49ad2f757aefd
2020-11-16 09:22:35 +01:00
Thomas Gleixner
f8fc36851c UPSTREAM: timekeeping/vsyscall: Prevent math overflow in BOOTTIME update
The VDSO update for CLOCK_BOOTTIME has a overflow issue as it shifts the
nanoseconds based boot time offset left by the clocksource shift. That
overflows once the boot time offset becomes large enough. As a consequence
CLOCK_BOOTTIME in the VDSO becomes a random number causing applications to
misbehave.

Fix it by storing a timespec64 representation of the offset when boot time
is adjusted and add that to the MONOTONIC base time value in the vdso data
page. Using the timespec64 representation avoids a 64bit division in the
update code.

Fixes: 44f57d788e ("timekeeping: Provide a generic update_vsyscall() implementation")
Reported-by: Chris Clayton <chris2553@googlemail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Chris Clayton <chris2553@googlemail.com>
Tested-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1908221257580.1983@nanos.tec.linutronix.de

(cherry picked from commit b99328a60a)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I61f5da6821a95b4cb855f737ef0dc94acbb1ccfe
2020-11-16 09:22:35 +01:00
Valentin Schneider
2ffafc7ac5 UPSTREAM: sched/topology: Allow sched_asym_cpucapacity to be disabled
While the static key is correctly initialized as being disabled, it will
remain forever enabled once turned on. This means that if we start with an
asymmetric system and hotplug out enough CPUs to end up with an SMP system,
the static key will remain set - which is obviously wrong. We should detect
this and turn off things like misfit migration and capacity aware wakeups.

As Quentin pointed out, having separate root domains makes this slightly
trickier. We could have exclusive cpusets that create an SMP island - IOW,
the domains within this root domain will not see any asymmetry. This means
we can't just disable the key on domain destruction, we need to count how
many asymmetric root domains we have.

Consider the following example using Juno r0 which is 2+4 big.LITTLE, where
two identical cpusets are created: they both span both big and LITTLE CPUs:

    asym0    asym1
  [       ][       ]
   L  L  B  L  L  B

  $ cgcreate -g cpuset:asym0
  $ cgset -r cpuset.cpus=0,1,3 asym0
  $ cgset -r cpuset.mems=0 asym0
  $ cgset -r cpuset.cpu_exclusive=1 asym0

  $ cgcreate -g cpuset:asym1
  $ cgset -r cpuset.cpus=2,4,5 asym1
  $ cgset -r cpuset.mems=0 asym1
  $ cgset -r cpuset.cpu_exclusive=1 asym1

  $ cgset -r cpuset.sched_load_balance=0 .

(the CPU numbering may look odd because on the Juno LITTLEs are CPUs 0,3-5
and bigs are CPUs 1-2)

If we make one of those SMP (IOW remove asymmetry) by e.g. hotplugging its
big core, we would end up with an SMP cpuset and an asymmetric cpuset - the
static key must remain set, because we still have one asymmetric root domain.

With the above example, this could be done with:

  $ echo 0 > /sys/devices/system/cpu/cpu2/online

Which would result in:

    asym0   asym1
  [       ][    ]
   L  L  B  L  L

When both SMP and asymmetric cpusets are present, all CPUs will observe
sched_asym_cpucapacity being set (it is system-wide), but not all CPUs
observe asymmetry in their sched domain hierarchy:

  per_cpu(sd_asym_cpucapacity, <any CPU in asym0>) == <some SD at DIE level>
  per_cpu(sd_asym_cpucapacity, <any CPU in asym1>) == NULL

Change the simple key enablement to an increment, and decrement the key
counter when destroying domains that cover asymmetric CPUs.

Signed-off-by: Valentin Schneider <valentin.schneider@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Cc: Dietmar.Eggemann@arm.com
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: hannes@cmpxchg.org
Cc: lizefan@huawei.com
Cc: morten.rasmussen@arm.com
Cc: qperret@google.com
Cc: tj@kernel.org
Cc: vincent.guittot@linaro.org
Fixes: df054e8445 ("sched/topology: Add static_key for asymmetric CPU capacity optimizations")
Link: https://lkml.kernel.org/r/20191023153745.19515-3-valentin.schneider@arm.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
(cherry picked from commit e284df705c)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I40c72d879144df86ca58d4fe83e5d41c4fe292a0
2020-11-16 09:22:34 +01:00
Luc Van Oostenryck
58b98784f1 UPSTREAM: fork: fix pidfd_poll()'s return type
pidfd_poll() is defined as returning 'unsigned int' but the
.poll method is declared as returning '__poll_t', a bitwise type.

Fix this by using the proper return type and using the EPOLL
constants instead of the POLL ones, as required for __poll_t.

Fixes: b53b0b9d9a ("pidfd: add polling support")
Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
Cc: stable@vger.kernel.org # 5.3
Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
Reviewed-by: Christian Brauner <christian.brauner@ubuntu.com>
Link: https://lore.kernel.org/r/20191120003320.31138-1-luc.vanoostenryck@gmail.com
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
(cherry picked from commit 9e77716a75)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I4cb4824929500d28f8f3165289a59eb4122e04ab
2020-11-16 09:22:34 +01:00
Alexander Potapenko
b8dc994624 UPSTREAM: PM: hibernate: fix crashes with init_on_free=1
Upon resuming from hibernation, free pages may contain stale data from
the kernel that initiated the resume. This breaks the invariant
inflicted by init_on_free=1 that freed pages must be zeroed.

To deal with this problem, make clear_free_pages() also clear the free
pages when init_on_free is enabled.

Fixes: 6471384af2 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options")
Reported-by: Johannes Stezenbach <js@sig21.net>
Signed-off-by: Alexander Potapenko <glider@google.com>
Cc: 5.3+ <stable@vger.kernel.org> # 5.3+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
(cherry picked from commit 18451f9f9e)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I32c22a60082bb3b49eae7de3c7d9d5ae2b965dc5
2020-11-16 09:22:34 +01:00
Greg Kroah-Hartman
bc09bee25e This is the 4.19.156 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl+qe0EACgkQONu9yGCS
 aT6MSw//TZRP6iLK2RhIrZu2jKD8jfYbHMT9JgKV2QCw7meg9q0JMj+SNP9CPbiL
 oOYtsXsRFRnAh98aBXNMFmzV7Zm0uUu0XGeFGxnf8y2X7EI1nZ6plvrCUYD8dCiF
 IPR67yyc5MojNQTfm0XDvQ3C7bKx5PuheRCLwhSuKclnrDxi8FNjS2NSBxi5G32j
 B7NzateeG7m/zE9fG1RkiJzfwu8/k0PKKecEYFwjRSC5QrXwvtEKdz/X/HkoXsck
 345wWHCTObpcDbDWkkUF5VuR36kCWMP+uYT4lNihZTV9+9b8Gz9ghhanDIuVCoU1
 biEsJnCORe/PV/xcgGJNkpEtabbDQNJ5Dn3wLKSuRAbBOkN2/nwzZa4EDoXWQSTv
 PDhzbLDjFjMu8Yb9PKrylhYGTmlNS4mA3hMszF4QNszhRyxTyDGln4MbUkpKg4sO
 HgU4JLvDOCfkCsGTBJ4XGTBcH+6ZxZwm1b+e4uy3FFZW2CEqSetZ3TCyIBxdLupa
 8JYmfqQjmaj0KUiUV9l1SJ6uHcIyg/FoNuCAdtDl7mLuzZdwtEhk3TeaZn4iwxWJ
 Ku+2qY0X6wsePOTfIA7puWBbK+IonM24Q3oIDVqjA+2yrmLJGlYuaQJrSPzEJHoh
 upHznwsU2W7MIfA6hJIcQeWIvzM4w5GSKUr3YeknVPIStP1ZqRg=
 =trRk
 -----END PGP SIGNATURE-----

Merge 4.19.156 into android-4.19-stable

Changes in 4.19.156
	drm/i915: Break up error capture compression loops with cond_resched()
	tipc: fix use-after-free in tipc_bcast_get_mode
	ptrace: fix task_join_group_stop() for the case when current is traced
	cadence: force nonlinear buffers to be cloned
	chelsio/chtls: fix memory leaks caused by a race
	chelsio/chtls: fix always leaking ctrl_skb
	gianfar: Replace skb_realloc_headroom with skb_cow_head for PTP
	gianfar: Account for Tx PTP timestamp in the skb headroom
	net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition
	sctp: Fix COMM_LOST/CANT_STR_ASSOC err reporting on big-endian platforms
	sfp: Fix error handing in sfp_probe()
	blktrace: fix debugfs use after free
	btrfs: extent_io: Kill the forward declaration of flush_write_bio
	btrfs: extent_io: Move the BUG_ON() in flush_write_bio() one level up
	Revert "btrfs: flush write bio if we loop in extent_write_cache_pages"
	btrfs: flush write bio if we loop in extent_write_cache_pages
	btrfs: extent_io: Handle errors better in extent_write_full_page()
	btrfs: extent_io: Handle errors better in btree_write_cache_pages()
	btrfs: extent_io: add proper error handling to lock_extent_buffer_for_io()
	Btrfs: fix unwritten extent buffers and hangs on future writeback attempts
	btrfs: Don't submit any btree write bio if the fs has errors
	btrfs: Move btrfs_check_chunk_valid() to tree-check.[ch] and export it
	btrfs: tree-checker: Make chunk item checker messages more readable
	btrfs: tree-checker: Make btrfs_check_chunk_valid() return EUCLEAN instead of EIO
	btrfs: tree-checker: Check chunk item at tree block read time
	btrfs: tree-checker: Verify dev item
	btrfs: tree-checker: Fix wrong check on max devid
	btrfs: tree-checker: Enhance chunk checker to validate chunk profile
	btrfs: tree-checker: Verify inode item
	btrfs: tree-checker: fix the error message for transid error
	Fonts: Replace discarded const qualifier
	ALSA: usb-audio: Add implicit feedback quirk for Zoom UAC-2
	ALSA: usb-audio: add usb vendor id as DSD-capable for Khadas devices
	ALSA: usb-audio: Add implicit feedback quirk for Qu-16
	ALSA: usb-audio: Add implicit feedback quirk for MODX
	mm: mempolicy: fix potential pte_unmap_unlock pte error
	lib/crc32test: remove extra local_irq_disable/enable
	kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled
	mm: always have io_remap_pfn_range() set pgprot_decrypted()
	gfs2: Wake up when sd_glock_disposal becomes zero
	ring-buffer: Fix recursion protection transitions between interrupt context
	ftrace: Fix recursion check for NMI test
	ftrace: Handle tracing when switching between context
	tracing: Fix out of bounds write in get_trace_buf
	futex: Handle transient "ownerless" rtmutex state correctly
	ARM: dts: sun4i-a10: fix cpu_alert temperature
	x86/kexec: Use up-to-dated screen_info copy to fill boot params
	of: Fix reserved-memory overlap detection
	blk-cgroup: Fix memleak on error path
	blk-cgroup: Pre-allocate tree node on blkg_conf_prep
	scsi: core: Don't start concurrent async scan on same host
	vsock: use ns_capable_noaudit() on socket create
	drm/vc4: drv: Add error handding for bind
	ACPI: NFIT: Fix comparison to '-ENXIO'
	vt: Disable KD_FONT_OP_COPY
	fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent
	serial: 8250_mtk: Fix uart_get_baud_rate warning
	serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init
	USB: serial: cyberjack: fix write-URB completion race
	USB: serial: option: add Quectel EC200T module support
	USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231
	USB: serial: option: add Telit FN980 composition 0x1055
	USB: Add NO_LPM quirk for Kingston flash drive
	usb: mtu3: fix panic in mtu3_gadget_stop()
	ARC: stack unwinding: avoid indefinite looping
	Revert "ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE"
	PM: runtime: Resume the device earlier in __device_release_driver()
	perf/core: Fix a memory leak in perf_event_parse_addr_filter()
	tools: perf: Fix build error in v4.19.y
	net: dsa: read mac address from DT for slave device
	arm64: dts: marvell: espressobin: Add ethernet switch aliases
	Linux 4.19.156

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I87af8871465f54de0332fa74bc1f342b7fe99061
2020-11-10 13:23:09 +01:00
kiyin(尹亮)
29a975bcc1 perf/core: Fix a memory leak in perf_event_parse_addr_filter()
commit 7bdb157cde upstream.

As shown through runtime testing, the "filename" allocation is not
always freed in perf_event_parse_addr_filter().

There are three possible ways that this could happen:

 - It could be allocated twice on subsequent iterations through the loop,
 - or leaked on the success path,
 - or on the failure path.

Clean up the code flow to make it obvious that 'filename' is always
freed in the reallocation path and in the two return paths as well.

We rely on the fact that kfree(NULL) is NOP and filename is initialized
with NULL.

This fixes the leak. No other side effects expected.

[ Dan Carpenter: cleaned up the code flow & added a changelog. ]
[ Ingo Molnar: updated the changelog some more. ]

Fixes: 375637bc52 ("perf/core: Introduce address range filtering")
Signed-off-by: "kiyin(尹亮)" <kiyin@tencent.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: "Srivatsa S. Bhat" <srivatsa@csail.mit.edu>
Cc: Anthony Liguori <aliguori@amazon.com>
--
 kernel/events/core.c |   12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-10 12:36:02 +01:00
Eddy Wu
b177d2d915 fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent
commit b4e00444ca upstream.

current->group_leader->exit_signal may change during copy_process() if
current->real_parent exits.

Move the assignment inside tasklist_lock to avoid the race.

Signed-off-by: Eddy Wu <eddy_wu@trendmicro.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-10 12:36:00 +01:00
Mike Galbraith
c096a3d44e futex: Handle transient "ownerless" rtmutex state correctly
commit 9f5d1c336a upstream.

Gratian managed to trigger the BUG_ON(!newowner) in fixup_pi_state_owner().
This is one possible chain of events leading to this:

Task Prio       Operation
T1   120	lock(F)
T2   120	lock(F)   -> blocks (top waiter)
T3   50 (RT)	lock(F)   -> boosts T1 and blocks (new top waiter)
XX   		timeout/  -> wakes T2
		signal
T1   50		unlock(F) -> wakes T3 (rtmutex->owner == NULL, waiter bit is set)
T2   120	cleanup   -> try_to_take_mutex() fails because T3 is the top waiter
     			     and the lower priority T2 cannot steal the lock.
     			  -> fixup_pi_state_owner() sees newowner == NULL -> BUG_ON()

The comment states that this is invalid and rt_mutex_real_owner() must
return a non NULL owner when the trylock failed, but in case of a queued
and woken up waiter rt_mutex_real_owner() == NULL is a valid transient
state. The higher priority waiter has simply not yet managed to take over
the rtmutex.

The BUG_ON() is therefore wrong and this is just another retry condition in
fixup_pi_state_owner().

Drop the locks, so that T3 can make progress, and then try the fixup again.

Gratian provided a great analysis, traces and a reproducer. The analysis is
to the point, but it confused the hell out of that tglx dude who had to
page in all the futex horrors again. Condensed version is above.

[ tglx: Wrote comment and changelog ]

Fixes: c1e2f0eaf0 ("futex: Avoid violating the 10th rule of futex")
Reported-by: Gratian Crisan <gratian.crisan@ni.com>
Signed-off-by: Mike Galbraith <efault@gmx.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/87a6w6x7bb.fsf@ni.com
Link: https://lore.kernel.org/r/87sg9pkvf7.fsf@nanos.tec.linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-10 12:35:58 +01:00
Qiujun Huang
7e4eeff7da tracing: Fix out of bounds write in get_trace_buf
commit c1acb4ac1a upstream.

The nesting count of trace_printk allows for 4 levels of nesting. The
nesting counter starts at zero and is incremented before being used to
retrieve the current context's buffer. But the index to the buffer uses the
nesting counter after it was incremented, and not its original number,
which in needs to do.

Link: https://lkml.kernel.org/r/20201029161905.4269-1-hqjagain@gmail.com

Cc: stable@vger.kernel.org
Fixes: 3d9622c12c ("tracing: Add barrier to trace_printk() buffer nesting modification")
Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-10 12:35:58 +01:00
Steven Rostedt (VMware)
2de780dfbe ftrace: Handle tracing when switching between context
commit 726b3d3f14 upstream.

When an interrupt or NMI comes in and switches the context, there's a delay
from when the preempt_count() shows the update. As the preempt_count() is
used to detect recursion having each context have its own bit get set when
tracing starts, and if that bit is already set, it is considered a recursion
and the function exits. But if this happens in that section where context
has changed but preempt_count() has not been updated, this will be
incorrectly flagged as a recursion.

To handle this case, create another bit call TRANSITION and test it if the
current context bit is already set. Flag the call as a recursion if the
TRANSITION bit is already set, and if not, set it and continue. The
TRANSITION bit will be cleared normally on the return of the function that
set it, or if the current context bit is clear, set it and clear the
TRANSITION bit to allow for another transition between the current context
and an even higher one.

Cc: stable@vger.kernel.org
Fixes: edc15cafcb ("tracing: Avoid unnecessary multiple recursion checks")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-10 12:35:58 +01:00
Steven Rostedt (VMware)
ee2b95c085 ftrace: Fix recursion check for NMI test
commit ee11b93f95 upstream.

The code that checks recursion will work to only do the recursion check once
if there's nested checks. The top one will do the check, the other nested
checks will see recursion was already checked and return zero for its "bit".
On the return side, nothing will be done if the "bit" is zero.

The problem is that zero is returned for the "good" bit when in NMI context.
This will set the bit for NMIs making it look like *all* NMI tracing is
recursing, and prevent tracing of anything in NMI context!

The simple fix is to return "bit + 1" and subtract that bit on the end to
get the real bit.

Cc: stable@vger.kernel.org
Fixes: edc15cafcb ("tracing: Avoid unnecessary multiple recursion checks")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-10 12:35:58 +01:00
Steven Rostedt (VMware)
b410d07e96 ring-buffer: Fix recursion protection transitions between interrupt context
commit b02414c8f0 upstream.

The recursion protection of the ring buffer depends on preempt_count() to be
correct. But it is possible that the ring buffer gets called after an
interrupt comes in but before it updates the preempt_count(). This will
trigger a false positive in the recursion code.

Use the same trick from the ftrace function callback recursion code which
uses a "transition" bit that gets set, to allow for a single recursion for
to handle transitions between contexts.

Cc: stable@vger.kernel.org
Fixes: 567cd4da54 ("ring-buffer: User context bit recursion checking")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-10 12:35:58 +01:00
Zqiang
68e8b8ed78 kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled
commit 6993d0fdbe upstream.

There is a small race window when a delayed work is being canceled and
the work still might be queued from the timer_fn:

	CPU0						CPU1
kthread_cancel_delayed_work_sync()
   __kthread_cancel_work_sync()
     __kthread_cancel_work()
        work->canceling++;
					      kthread_delayed_work_timer_fn()
						   kthread_insert_work();

BUG: kthread_insert_work() should not get called when work->canceling is
set.

Signed-off-by: Zqiang <qiang.zhang@windriver.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Acked-by: Tejun Heo <tj@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20201014083030.16895-1-qiang.zhang@windriver.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-10 12:35:58 +01:00
Luis Chamberlain
8a78b4c0d6 blktrace: fix debugfs use after free
commit bad8e64fb1 upstream.

On commit 6ac93117ab ("blktrace: use existing disk debugfs directory")
merged on v4.12 Omar fixed the original blktrace code for request-based
drivers (multiqueue). This however left in place a possible crash, if you
happen to abuse blktrace while racing to remove / add a device.

We used to use asynchronous removal of the request_queue, and with that
the issue was easier to reproduce. Now that we have reverted to
synchronous removal of the request_queue, the issue is still possible to
reproduce, its however just a bit more difficult.

We essentially run two instances of break-blktrace which add/remove
a loop device, and setup a blktrace and just never tear the blktrace
down. We do this twice in parallel. This is easily reproduced with the
script run_0004.sh from break-blktrace [0].

We can end up with two types of panics each reflecting where we
race, one a failed blktrace setup:

[  252.426751] debugfs: Directory 'loop0' with parent 'block' already present!
[  252.432265] BUG: kernel NULL pointer dereference, address: 00000000000000a0
[  252.436592] #PF: supervisor write access in kernel mode
[  252.439822] #PF: error_code(0x0002) - not-present page
[  252.442967] PGD 0 P4D 0
[  252.444656] Oops: 0002 [#1] SMP NOPTI
[  252.446972] CPU: 10 PID: 1153 Comm: break-blktrace Tainted: G            E     5.7.0-rc2-next-20200420+ #164
[  252.452673] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1 04/01/2014
[  252.456343] RIP: 0010:down_write+0x15/0x40
[  252.458146] Code: eb ca e8 ae 22 8d ff cc cc cc cc cc cc cc cc cc cc cc cc
               cc cc 0f 1f 44 00 00 55 48 89 fd e8 52 db ff ff 31 c0 ba 01 00
               00 00 <f0> 48 0f b1 55 00 75 0f 48 8b 04 25 c0 8b 01 00 48 89
               45 08 5d
[  252.463638] RSP: 0018:ffffa626415abcc8 EFLAGS: 00010246
[  252.464950] RAX: 0000000000000000 RBX: ffff958c25f0f5c0 RCX: ffffff8100000000
[  252.466727] RDX: 0000000000000001 RSI: ffffff8100000000 RDI: 00000000000000a0
[  252.468482] RBP: 00000000000000a0 R08: 0000000000000000 R09: 0000000000000001
[  252.470014] R10: 0000000000000000 R11: ffff958d1f9227ff R12: 0000000000000000
[  252.471473] R13: ffff958c25ea5380 R14: ffffffff8cce15f1 R15: 00000000000000a0
[  252.473346] FS:  00007f2e69dee540(0000) GS:ffff958c2fc80000(0000) knlGS:0000000000000000
[  252.475225] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  252.476267] CR2: 00000000000000a0 CR3: 0000000427d10004 CR4: 0000000000360ee0
[  252.477526] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  252.478776] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  252.479866] Call Trace:
[  252.480322]  simple_recursive_removal+0x4e/0x2e0
[  252.481078]  ? debugfs_remove+0x60/0x60
[  252.481725]  ? relay_destroy_buf+0x77/0xb0
[  252.482662]  debugfs_remove+0x40/0x60
[  252.483518]  blk_remove_buf_file_callback+0x5/0x10
[  252.484328]  relay_close_buf+0x2e/0x60
[  252.484930]  relay_open+0x1ce/0x2c0
[  252.485520]  do_blk_trace_setup+0x14f/0x2b0
[  252.486187]  __blk_trace_setup+0x54/0xb0
[  252.486803]  blk_trace_ioctl+0x90/0x140
[  252.487423]  ? do_sys_openat2+0x1ab/0x2d0
[  252.488053]  blkdev_ioctl+0x4d/0x260
[  252.488636]  block_ioctl+0x39/0x40
[  252.489139]  ksys_ioctl+0x87/0xc0
[  252.489675]  __x64_sys_ioctl+0x16/0x20
[  252.490380]  do_syscall_64+0x52/0x180
[  252.491032]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

And the other on the device removal:

[  128.528940] debugfs: Directory 'loop0' with parent 'block' already present!
[  128.615325] BUG: kernel NULL pointer dereference, address: 00000000000000a0
[  128.619537] #PF: supervisor write access in kernel mode
[  128.622700] #PF: error_code(0x0002) - not-present page
[  128.625842] PGD 0 P4D 0
[  128.627585] Oops: 0002 [#1] SMP NOPTI
[  128.629871] CPU: 12 PID: 544 Comm: break-blktrace Tainted: G            E     5.7.0-rc2-next-20200420+ #164
[  128.635595] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1 04/01/2014
[  128.640471] RIP: 0010:down_write+0x15/0x40
[  128.643041] Code: eb ca e8 ae 22 8d ff cc cc cc cc cc cc cc cc cc cc cc cc
               cc cc 0f 1f 44 00 00 55 48 89 fd e8 52 db ff ff 31 c0 ba 01 00
               00 00 <f0> 48 0f b1 55 00 75 0f 65 48 8b 04 25 c0 8b 01 00 48 89
               45 08 5d
[  128.650180] RSP: 0018:ffffa9c3c05ebd78 EFLAGS: 00010246
[  128.651820] RAX: 0000000000000000 RBX: ffff8ae9a6370240 RCX: ffffff8100000000
[  128.653942] RDX: 0000000000000001 RSI: ffffff8100000000 RDI: 00000000000000a0
[  128.655720] RBP: 00000000000000a0 R08: 0000000000000002 R09: ffff8ae9afd2d3d0
[  128.657400] R10: 0000000000000056 R11: 0000000000000000 R12: 0000000000000000
[  128.659099] R13: 0000000000000000 R14: 0000000000000003 R15: 00000000000000a0
[  128.660500] FS:  00007febfd995540(0000) GS:ffff8ae9afd00000(0000) knlGS:0000000000000000
[  128.662204] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  128.663426] CR2: 00000000000000a0 CR3: 0000000420042003 CR4: 0000000000360ee0
[  128.664776] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  128.666022] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  128.667282] Call Trace:
[  128.667801]  simple_recursive_removal+0x4e/0x2e0
[  128.668663]  ? debugfs_remove+0x60/0x60
[  128.669368]  debugfs_remove+0x40/0x60
[  128.669985]  blk_trace_free+0xd/0x50
[  128.670593]  __blk_trace_remove+0x27/0x40
[  128.671274]  blk_trace_shutdown+0x30/0x40
[  128.671935]  blk_release_queue+0x95/0xf0
[  128.672589]  kobject_put+0xa5/0x1b0
[  128.673188]  disk_release+0xa2/0xc0
[  128.673786]  device_release+0x28/0x80
[  128.674376]  kobject_put+0xa5/0x1b0
[  128.674915]  loop_remove+0x39/0x50 [loop]
[  128.675511]  loop_control_ioctl+0x113/0x130 [loop]
[  128.676199]  ksys_ioctl+0x87/0xc0
[  128.676708]  __x64_sys_ioctl+0x16/0x20
[  128.677274]  do_syscall_64+0x52/0x180
[  128.677823]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

The common theme here is:

debugfs: Directory 'loop0' with parent 'block' already present

This crash happens because of how blktrace uses the debugfs directory
where it places its files. Upon init we always create the same directory
which would be needed by blktrace but we only do this for make_request
drivers (multiqueue) block drivers. When you race a removal of these
devices with a blktrace setup you end up in a situation where the
make_request recursive debugfs removal will sweep away the blktrace
files and then later blktrace will also try to remove individual
dentries which are already NULL. The inverse is also possible and hence
the two types of use after frees.

We don't create the block debugfs directory on init for these types of
block devices:

  * request-based block driver block devices
  * every possible partition
  * scsi-generic

And so, this race should in theory only be possible with make_request
drivers.

We can fix the UAF by simply re-using the debugfs directory for
make_request drivers (multiqueue) and only creating the ephemeral
directory for the other type of block devices. The new clarifications
on relying on the q->blk_trace_mutex *and* also checking for q->blk_trace
*prior* to processing a blktrace ensures the debugfs directories are
only created if no possible directory name clashes are possible.

This goes tested with:

  o nvme partitions
  o ISCSI with tgt, and blktracing against scsi-generic with:
    o block
    o tape
    o cdrom
    o media changer
  o blktests

This patch is part of the work which disputes the severity of
CVE-2019-19770 which shows this issue is not a core debugfs issue, but
a misuse of debugfs within blktace.

Fixes: 6ac93117ab ("blktrace: use existing disk debugfs directory")
Reported-by: syzbot+603294af2d01acfdd6da@syzkaller.appspotmail.com
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: Bart Van Assche <bvanassche@acm.org>
Cc: Omar Sandoval <osandov@fb.com>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Nicolai Stange <nstange@suse.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: yu kuai <yukuai3@huawei.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[bwh: Backported to 4.19: open-code queue_is_mq()]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-10 12:35:54 +01:00
Oleg Nesterov
caf8f9c19a ptrace: fix task_join_group_stop() for the case when current is traced
commit 7b3c36fc4c upstream.

This testcase

	#include <stdio.h>
	#include <unistd.h>
	#include <signal.h>
	#include <sys/ptrace.h>
	#include <sys/wait.h>
	#include <pthread.h>
	#include <assert.h>

	void *tf(void *arg)
	{
		return NULL;
	}

	int main(void)
	{
		int pid = fork();
		if (!pid) {
			kill(getpid(), SIGSTOP);

			pthread_t th;
			pthread_create(&th, NULL, tf, NULL);

			return 0;
		}

		waitpid(pid, NULL, WSTOPPED);

		ptrace(PTRACE_SEIZE, pid, 0, PTRACE_O_TRACECLONE);
		waitpid(pid, NULL, 0);

		ptrace(PTRACE_CONT, pid, 0,0);
		waitpid(pid, NULL, 0);

		int status;
		int thread = waitpid(-1, &status, 0);
		assert(thread > 0 && thread != pid);
		assert(status == 0x80137f);

		return 0;
	}

fails and triggers WARN_ON_ONCE(!signr) in do_jobctl_trap().

This is because task_join_group_stop() has 2 problems when current is traced:

	1. We can't rely on the "JOBCTL_STOP_PENDING" check, a stopped tracee
	   can be woken up by debugger and it can clone another thread which
	   should join the group-stop.

	   We need to check group_stop_count || SIGNAL_STOP_STOPPED.

	2. If SIGNAL_STOP_STOPPED is already set, we should not increment
	   sig->group_stop_count and add JOBCTL_STOP_CONSUME. The new thread
	   should stop without another do_notify_parent_cldstop() report.

To clarify, the problem is very old and we should blame
ptrace_init_task().  But now that we have task_join_group_stop() it makes
more sense to fix this helper to avoid the code duplication.

Reported-by: syzbot+3485e3773f7da290eecc@syzkaller.appspotmail.com
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Christian Brauner <christian@brauner.io>
Cc: "Eric W . Biederman" <ebiederm@xmission.com>
Cc: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20201019134237.GA18810@redhat.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-10 12:35:53 +01:00
Greg Kroah-Hartman
d1253c75a8 This is the 4.19.155 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl+jz0oACgkQONu9yGCS
 aT4hPA//Xp0LuMofylz77cZMkWiagSQ5k/4oKn2O2iEISKfdcFMzjcJbRBMmTFFP
 r1T0Uu5N2gZQ8ZAV67itpaA/KV9YlytbDrwRBKQ/mxNMP7xaX+hC43hbPrx72Qc5
 on6v3z9xTxMB2+HwFlJZpsmYrrjqg1ruGtxR5UMZ37Jt7KUYDRbHDbqMEXRkKHko
 pWtZ/8GkY8UG3GNpiPlka9BfDK9X0k5m65r3vscbmgCd7bQFQi9rbp930N0y7MMX
 e/YIBss699EZp6r7hpH1+ETBP6Z2qHxRFY86kcL9I3NcZnI3NrX0pKql0hWlqPOm
 CeR3z6fpW9Xyf1CqQOkyDBCMfvMLsMarwQ+bb8d+zIQD/I4W12whPhGM4eh6rYcu
 2WL4gwiyhju0OuPK7ZcCzMOEPUwWQYvyvwoBnoywZfN5L8702Xi4eN8QqP5l7Hcd
 lcZH5gv/v1z0Xb6pU4AMthbLB+VcQ5w5g3DfvF/A9kOyzmP0YvKa39y8J379mwdJ
 6DXu8DRvee5bYW8LObszzKqshnF79eia+xcf7YFJn1Y2cwh63AQgOcSzaEc5q7/2
 kuWNfrZJCyvt41j48bO7MtTEULeCAtPkuKvVrZuCO7Q4J2wFSWuGCUQTg3bm8dQd
 5B9V6jQKaCIOn3+/dPXg5N6yaRKZR4dHIUsWpKOs1tOQuucpVmw=
 =2s9n
 -----END PGP SIGNATURE-----

Merge 4.19.155 into android-4.19-stable

Changes in 4.19.155
	objtool: Support Clang non-section symbols in ORC generation
	scripts/setlocalversion: make git describe output more reliable
	arm64: Run ARCH_WORKAROUND_1 enabling code on all CPUs
	arm64: link with -z norelro regardless of CONFIG_RELOCATABLE
	x86/PCI: Fix intel_mid_pci.c build error when ACPI is not enabled
	efivarfs: Replace invalid slashes with exclamation marks in dentries.
	chelsio/chtls: fix deadlock issue
	chelsio/chtls: fix memory leaks in CPL handlers
	chelsio/chtls: fix tls record info to user
	gtp: fix an use-before-init in gtp_newlink()
	mlxsw: core: Fix memory leak on module removal
	netem: fix zero division in tabledist
	ravb: Fix bit fields checking in ravb_hwtstamp_get()
	tcp: Prevent low rmem stalls with SO_RCVLOWAT.
	tipc: fix memory leak caused by tipc_buf_append()
	r8169: fix issue with forced threading in combination with shared interrupts
	cxgb4: set up filter action after rewrites
	arch/x86/amd/ibs: Fix re-arming IBS Fetch
	x86/xen: disable Firmware First mode for correctable memory errors
	fuse: fix page dereference after free
	bpf: Fix comment for helper bpf_current_task_under_cgroup()
	evm: Check size of security.evm before using it
	p54: avoid accessing the data mapped to streaming DMA
	cxl: Rework error message for incompatible slots
	RDMA/addr: Fix race with netevent_callback()/rdma_addr_cancel()
	mtd: lpddr: Fix bad logic in print_drs_error
	serial: pl011: Fix lockdep splat when handling magic-sysrq interrupt
	ata: sata_rcar: Fix DMA boundary mask
	fscrypt: return -EXDEV for incompatible rename or link into encrypted dir
	fscrypt: clean up and improve dentry revalidation
	fscrypt: fix race allowing rename() and link() of ciphertext dentries
	fs, fscrypt: clear DCACHE_ENCRYPTED_NAME when unaliasing directory
	fscrypt: only set dentry_operations on ciphertext dentries
	fscrypt: fix race where ->lookup() marks plaintext dentry as ciphertext
	Revert "block: ratelimit handle_bad_sector() message"
	xen/events: don't use chip_data for legacy IRQs
	xen/events: avoid removing an event channel while handling it
	xen/events: add a proper barrier to 2-level uevent unmasking
	xen/events: fix race in evtchn_fifo_unmask()
	xen/events: add a new "late EOI" evtchn framework
	xen/blkback: use lateeoi irq binding
	xen/netback: use lateeoi irq binding
	xen/scsiback: use lateeoi irq binding
	xen/pvcallsback: use lateeoi irq binding
	xen/pciback: use lateeoi irq binding
	xen/events: switch user event channels to lateeoi model
	xen/events: use a common cpu hotplug hook for event channels
	xen/events: defer eoi in case of excessive number of events
	xen/events: block rogue events for some time
	x86/unwind/orc: Fix inactive tasks with stack pointer in %sp on GCC 10 compiled kernels
	mlxsw: core: Fix use-after-free in mlxsw_emad_trans_finish()
	RDMA/qedr: Fix memory leak in iWARP CM
	ata: sata_nv: Fix retrieving of active qcs
	futex: Fix incorrect should_fail_futex() handling
	powerpc/powernv/smp: Fix spurious DBG() warning
	mm: fix exec activate_mm vs TLB shootdown and lazy tlb switching race
	powerpc: select ARCH_WANT_IRQS_OFF_ACTIVATE_MM
	sparc64: remove mm_cpumask clearing to fix kthread_use_mm race
	f2fs: add trace exit in exception path
	f2fs: fix uninit-value in f2fs_lookup
	f2fs: fix to check segment boundary during SIT page readahead
	um: change sigio_spinlock to a mutex
	ARM: 8997/2: hw_breakpoint: Handle inexact watchpoint addresses
	power: supply: bq27xxx: report "not charging" on all types
	xfs: fix realtime bitmap/summary file truncation when growing rt volume
	video: fbdev: pvr2fb: initialize variables
	ath10k: start recovery process when payload length exceeds max htc length for sdio
	ath10k: fix VHT NSS calculation when STBC is enabled
	drm/brige/megachips: Add checking if ge_b850v3_lvds_init() is working correctly
	media: videodev2.h: RGB BT2020 and HSV are always full range
	media: platform: Improve queue set up flow for bug fixing
	usb: typec: tcpm: During PR_SWAP, source caps should be sent only after tSwapSourceStart
	media: tw5864: check status of tw5864_frameinterval_get
	media: imx274: fix frame interval handling
	mmc: via-sdmmc: Fix data race bug
	drm/bridge/synopsys: dsi: add support for non-continuous HS clock
	arm64: topology: Stop using MPIDR for topology information
	printk: reduce LOG_BUF_SHIFT range for H8300
	ia64: kprobes: Use generic kretprobe trampoline handler
	kgdb: Make "kgdbcon" work properly with "kgdb_earlycon"
	media: uvcvideo: Fix dereference of out-of-bound list iterator
	riscv: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO
	cpufreq: sti-cpufreq: add stih418 support
	USB: adutux: fix debugging
	uio: free uio id after uio file node is freed
	usb: xhci: omit duplicate actions when suspending a runtime suspended host.
	arm64/mm: return cpu_all_mask when node is NUMA_NO_NODE
	xfs: don't free rt blocks when we're doing a REMAP bunmapi call
	ACPI: Add out of bounds and numa_off protections to pxm_to_node()
	drivers/net/wan/hdlc_fr: Correctly handle special skb->protocol values
	bus/fsl_mc: Do not rely on caller to provide non NULL mc_io
	power: supply: test_power: add missing newlines when printing parameters by sysfs
	drm/amd/display: HDMI remote sink need mode validation for Linux
	btrfs: fix replace of seed device
	md/bitmap: md_bitmap_get_counter returns wrong blocks
	bnxt_en: Log unknown link speed appropriately.
	rpmsg: glink: Use complete_all for open states
	clk: ti: clockdomain: fix static checker warning
	net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid
	drivers: watchdog: rdc321x_wdt: Fix race condition bugs
	ext4: Detect already used quota file early
	gfs2: add validation checks for size of superblock
	cifs: handle -EINTR in cifs_setattr
	arm64: dts: renesas: ulcb: add full-pwr-cycle-in-suspend into eMMC nodes
	ARM: dts: omap4: Fix sgx clock rate for 4430
	memory: emif: Remove bogus debugfs error handling
	ARM: dts: s5pv210: remove DMA controller bus node name to fix dtschema warnings
	ARM: dts: s5pv210: move PMU node out of clock controller
	ARM: dts: s5pv210: remove dedicated 'audio-subsystem' node
	nbd: make the config put is called before the notifying the waiter
	sgl_alloc_order: fix memory leak
	nvme-rdma: fix crash when connect rejected
	md/raid5: fix oops during stripe resizing
	mmc: sdhci-acpi: AMDI0040: Set SDHCI_QUIRK2_PRESET_VALUE_BROKEN
	perf/x86/amd/ibs: Don't include randomized bits in get_ibs_op_count()
	perf/x86/amd/ibs: Fix raw sample data accumulation
	leds: bcm6328, bcm6358: use devres LED registering function
	media: uvcvideo: Fix uvc_ctrl_fixup_xu_info() not having any effect
	fs: Don't invalidate page buffers in block_write_full_page()
	NFS: fix nfs_path in case of a rename retry
	ACPI: button: fix handling lid state changes when input device closed
	ACPI / extlog: Check for RDMSR failure
	ACPI: video: use ACPI backlight for HP 635 Notebook
	ACPI: debug: don't allow debugging when ACPI is disabled
	acpi-cpufreq: Honor _PSD table setting on new AMD CPUs
	w1: mxc_w1: Fix timeout resolution problem leading to bus error
	scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()
	scsi: qla2xxx: Fix crash on session cleanup with unload
	btrfs: qgroup: fix wrong qgroup metadata reserve for delayed inode
	btrfs: improve device scanning messages
	btrfs: reschedule if necessary when logging directory items
	btrfs: send, recompute reference path after orphanization of a directory
	btrfs: use kvzalloc() to allocate clone_roots in btrfs_ioctl_send()
	btrfs: cleanup cow block on error
	btrfs: fix use-after-free on readahead extent after failure to create it
	usb: xhci: Workaround for S3 issue on AMD SNPS 3.0 xHC
	usb: dwc3: ep0: Fix ZLP for OUT ep0 requests
	usb: dwc3: gadget: Check MPS of the request length
	usb: dwc3: core: add phy cleanup for probe error handling
	usb: dwc3: core: don't trigger runtime pm when remove driver
	usb: cdc-acm: fix cooldown mechanism
	usb: typec: tcpm: reset hard_reset_count for any disconnect
	usb: host: fsl-mph-dr-of: check return of dma_set_mask()
	drm/i915: Force VT'd workarounds when running as a guest OS
	vt: keyboard, simplify vt_kdgkbsent
	vt: keyboard, extend func_buf_lock to readers
	HID: wacom: Avoid entering wacom_wac_pen_report for pad / battery
	udf: Fix memory leak when mounting
	dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status
	iio:light:si1145: Fix timestamp alignment and prevent data leak.
	iio:adc:ti-adc0832 Fix alignment issue with timestamp
	iio:adc:ti-adc12138 Fix alignment issue with timestamp
	iio:gyro:itg3200: Fix timestamp alignment and prevent data leak.
	powerpc/drmem: Make lmb_size 64 bit
	s390/stp: add locking to sysfs functions
	powerpc/rtas: Restrict RTAS requests from userspace
	powerpc: Warn about use of smt_snooze_delay
	powerpc/powernv/elog: Fix race while processing OPAL error log event.
	powerpc: Fix undetected data corruption with P9N DD2.1 VSX CI load emulation
	NFSv4.2: support EXCHGID4_FLAG_SUPP_FENCE_OPS 4.2 EXCHANGE_ID flag
	NFSD: Add missing NFSv2 .pc_func methods
	ubifs: dent: Fix some potential memory leaks while iterating entries
	perf python scripting: Fix printable strings in python3 scripts
	ubi: check kthread_should_stop() after the setting of task state
	ia64: fix build error with !COREDUMP
	i2c: imx: Fix external abort on interrupt in exit paths
	drm/amdgpu: don't map BO in reserved region
	drm/amd/display: Don't invoke kgdb_breakpoint() unconditionally
	ceph: promote to unsigned long long before shifting
	libceph: clear con->out_msg on Policy::stateful_server faults
	9P: Cast to loff_t before multiplying
	ring-buffer: Return 0 on success from ring_buffer_resize()
	vringh: fix __vringh_iov() when riov and wiov are different
	ext4: fix leaking sysfs kobject after failed mount
	ext4: fix error handling code in add_new_gdb
	ext4: fix invalid inode checksum
	drm/ttm: fix eviction valuable range check.
	rtc: rx8010: don't modify the global rtc ops
	tty: make FONTX ioctl use the tty pointer they were actually passed
	arm64: berlin: Select DW_APB_TIMER_OF
	cachefiles: Handle readpage error correctly
	hil/parisc: Disable HIL driver when it gets stuck
	arm: dts: mt7623: add missing pause for switchport
	ARM: samsung: fix PM debug build with DEBUG_LL but !MMU
	ARM: s3c24xx: fix missing system reset
	device property: Keep secondary firmware node secondary by type
	device property: Don't clear secondary pointer for shared primary firmware node
	KVM: arm64: Fix AArch32 handling of DBGD{CCINT,SCRext} and DBGVCR
	staging: comedi: cb_pcidas: Allow 2-channel commands for AO subdevice
	staging: octeon: repair "fixed-link" support
	staging: octeon: Drop on uncorrectable alignment or FCS error
	Linux 4.19.155

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I18fefb5bfaa4d05772c61c2975340d0f089b8e3e
2020-11-05 14:02:27 +01:00
Qiujun Huang
57ebe91029 ring-buffer: Return 0 on success from ring_buffer_resize()
commit 0a1754b2a9 upstream.

We don't need to check the new buffer size, and the return value
had confused resize_buffer_duplicate_size().
...
	ret = ring_buffer_resize(trace_buf->buffer,
		per_cpu_ptr(size_buf->data,cpu_id)->entries, cpu_id);
	if (ret == 0)
		per_cpu_ptr(trace_buf->data, cpu_id)->entries =
			per_cpu_ptr(size_buf->data, cpu_id)->entries;
...

Link: https://lkml.kernel.org/r/20201019142242.11560-1-hqjagain@gmail.com

Cc: stable@vger.kernel.org
Fixes: d60da506cb ("tracing: Add a resize function to make one buffer equivalent to another buffer")
Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-05 11:08:53 +01:00
Douglas Anderson
cbc03dedec kgdb: Make "kgdbcon" work properly with "kgdb_earlycon"
[ Upstream commit b18b099e04 ]

On my system the kernel processes the "kgdb_earlycon" parameter before
the "kgdbcon" parameter.  When we setup "kgdb_earlycon" we'll end up
in kgdb_register_callbacks() and "kgdb_use_con" won't have been set
yet so we'll never get around to starting "kgdbcon".  Let's remedy
this by detecting that the IO module was already registered when
setting "kgdb_use_con" and registering the console then.

As part of this, to avoid pre-declaring things, move the handling of
the "kgdbcon" further down in the file.

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20200630151422.1.I4aa062751ff5e281f5116655c976dff545c09a46@changeid
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-11-05 11:08:41 +01:00
Mateusz Nosek
ae5aa5685c futex: Fix incorrect should_fail_futex() handling
[ Upstream commit 921c7ebd13 ]

If should_futex_fail() returns true in futex_wake_pi(), then the 'ret'
variable is set to -EFAULT and then immediately overwritten. So the failure
injection is non-functional.

Fix it by actually leaving the function and returning -EFAULT.

The Fixes tag is kinda blury because the initial commit which introduced
failure injection was already sloppy, but the below mentioned commit broke
it completely.

[ tglx: Massaged changelog ]

Fixes: 6b4f4bc9cb ("locking/futex: Allow low-level atomic operations to return -EAGAIN")
Signed-off-by: Mateusz Nosek <mateusznosek0@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20200927000858.24219-1-mateusznosek0@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-11-05 11:08:38 +01:00
Tao Huang
439d4e9999 Merge tag 'ASB-2020-11-05_4.19-stable' of https://android.googlesource.com/kernel/common
https://source.android.com/security/bulletin/2020-11-01
CVE-2020-0423

* tag 'ASB-2020-11-05_4.19-stable': (529 commits)
  ANDROID: GKI: Enable DEBUG_INFO_DWARF4
  UPSTREAM: mm/sl[uo]b: export __kmalloc_track(_node)_caller
  BACKPORT: xfrm/compat: Translate 32-bit user_policy from sockptr
  BACKPORT: xfrm/compat: Add 32=>64-bit messages translator
  UPSTREAM: xfrm/compat: Attach xfrm dumps to 64=>32 bit translator
  UPSTREAM: xfrm/compat: Add 64=>32-bit messages translator
  BACKPORT: xfrm: Provide API to register translator module
  ANDROID: Publish uncompressed Image on aarch64
  FROMLIST: crypto: arm64/poly1305-neon - reorder PAC authentication with SP update
  UPSTREAM: crypto: arm64/chacha - fix chacha_4block_xor_neon() for big endian
  UPSTREAM: crypto: arm64/chacha - fix hchacha_block_neon() for big endian
  Linux 4.19.154
  usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets.
  eeprom: at25: set minimum read/write access stride to 1
  USB: cdc-wdm: Make wdm_flush() interruptible and add wdm_fsync().
  usb: cdc-acm: add quirk to blacklist ETAS ES58X devices
  tty: serial: fsl_lpuart: fix lpuart32_poll_get_char
  net: korina: cast KSEG0 address to pointer in kfree
  ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n()
  scsi: ufs: ufs-qcom: Fix race conditions caused by ufs_qcom_testbus_config()
  ...

Change-Id: I797efa1149f557c1dfab7856813cc40d1a4d60b2

Conflicts:
	drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
	mm/page_alloc.c
2020-11-03 18:36:42 +08:00
Greg Kroah-Hartman
ac43e7e5e4 This is the 4.19.154 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl+b3x4ACgkQONu9yGCS
 aT4V5A//Zjotx9tNhbPFY/P06seBYbrrgqDQT87CkPn4L0PN50Yv4yWjvP0lKw1k
 hE71dndlI0A+6EIJLFFthh0bmLK+TINjJy5bW+uLJM6i9Fa2IhHJaMjgb3W6iK/j
 Iqi8GFyLAacckSJSV+DYz54di4dXc/cp/WpeKwGVBJCvFh3H9uLZUU+nAQ5X1tpY
 PBP0hYFmkuRbGDsXjgiDxwTqeaqBXL9EG5QPj/HVF3Uxa9HjavOHRZHidI3HqA0h
 svzNrvvstgi/r4anMGpaWg0rXdnnLr7q79Ox1b7doSMn0OQFliLdJ9/RTMhsb4rw
 9Iki8ZkUPCj86xCW4jBkja4AVEhP0Ep/5+dQUpMOYe115dfuREl8DkiZeh0HC+bh
 hoZk6GIbzxCTzUkVgDCL46BbBGSkTcOuaE8uriIPJlUCc9r/KrkB63tWRpL8wVuC
 u49MmAZBjlzV9/j9nYJzBha1v9px+vw56kH9LmQHLTm+nG4BrAmiPzb2mjrMo8iv
 PfVuUXSgTZNKDYKkTL6sz7nzrGESrKD5M1h3TN7f+vgYcaXqWT+pKPvhkvcRB3tR
 iwzs/A+s1jL+wjstUgUVia6z5DtNEiNQ2pou2U1EK0UuGeUMbqu8d9924NcHf60u
 Opg9dUWRLQTorl7dM2CsuDKFF5N+Vg08BfbAC2JNj0uFZBNL//0=
 =DCvO
 -----END PGP SIGNATURE-----

Merge 4.19.154 into android-4.19-stable

Changes in 4.19.154
	powerpc/tau: Check processor type before enabling TAU interrupt
	powerpc/tau: Disable TAU between measurements
	powerpc/64s/radix: Fix mm_cpumask trimming race vs kthread_use_mm
	RDMA/cma: Remove dead code for kernel rdmacm multicast
	RDMA/cma: Consolidate the destruction of a cma_multicast in one place
	perf intel-pt: Fix "context_switch event has no tid" error
	RDMA/hns: Set the unsupported wr opcode
	RDMA/hns: Fix missing sq_sig_type when querying QP
	kdb: Fix pager search for multi-line strings
	overflow: Include header file with SIZE_MAX declaration
	powerpc/perf: Exclude pmc5/6 from the irrelevant PMU group constraints
	powerpc/perf/hv-gpci: Fix starting index value
	cpufreq: powernv: Fix frame-size-overflow in powernv_cpufreq_reboot_notifier
	IB/rdmavt: Fix sizeof mismatch
	f2fs: wait for sysfs kobject removal before freeing f2fs_sb_info
	lib/crc32.c: fix trivial typo in preprocessor condition
	ramfs: fix nommu mmap with gaps in the page cache
	rapidio: fix error handling path
	rapidio: fix the missed put_device() for rio_mport_add_riodev
	mailbox: avoid timer start from callback
	i2c: rcar: Auto select RESET_CONTROLLER
	PCI: iproc: Set affinity mask on MSI interrupts
	rpmsg: smd: Fix a kobj leak in in qcom_smd_parse_edge()
	pwm: img: Fix null pointer access in probe
	clk: rockchip: Initialize hw to error to avoid undefined behavior
	clk: at91: clk-main: update key before writing AT91_CKGR_MOR
	clk: bcm2835: add missing release if devm_clk_hw_register fails
	watchdog: Fix memleak in watchdog_cdev_register
	watchdog: Use put_device on error
	watchdog: sp5100: Fix definition of EFCH_PM_DECODEEN3
	svcrdma: fix bounce buffers for unaligned offsets and multiple pages
	ext4: limit entries returned when counting fsmap records
	vfio/pci: Clear token on bypass registration failure
	vfio iommu type1: Fix memory leak in vfio_iommu_type1_pin_pages
	SUNRPC: fix copying of multiple pages in gss_read_proxy_verf()
	Input: imx6ul_tsc - clean up some errors in imx6ul_tsc_resume()
	Input: stmfts - fix a & vs && typo
	Input: ep93xx_keypad - fix handling of platform_get_irq() error
	Input: omap4-keypad - fix handling of platform_get_irq() error
	Input: twl4030_keypad - fix handling of platform_get_irq() error
	Input: sun4i-ps2 - fix handling of platform_get_irq() error
	KVM: x86: emulating RDPID failure shall return #UD rather than #GP
	netfilter: conntrack: connection timeout after re-register
	netfilter: nf_fwd_netdev: clear timestamp in forwarding path
	ARM: dts: imx6sl: fix rng node
	ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix dcdc1 regulator
	memory: omap-gpmc: Fix a couple off by ones
	memory: omap-gpmc: Fix build error without CONFIG_OF
	memory: fsl-corenet-cf: Fix handling of platform_get_irq() error
	arm64: dts: qcom: pm8916: Remove invalid reg size from wcd_codec
	arm64: dts: qcom: msm8916: Fix MDP/DSI interrupts
	ARM: dts: owl-s500: Fix incorrect PPI interrupt specifiers
	arm64: dts: zynqmp: Remove additional compatible string for i2c IPs
	powerpc/powernv/dump: Fix race while processing OPAL dump
	nvmet: fix uninitialized work for zero kato
	NTB: hw: amd: fix an issue about leak system resources
	sched/features: Fix !CONFIG_JUMP_LABEL case
	perf: correct SNOOPX field offset
	i2c: core: Restore acpi_walk_dep_device_list() getting called after registering the ACPI i2c devs
	block: ratelimit handle_bad_sector() message
	crypto: ccp - fix error handling
	media: firewire: fix memory leak
	media: ati_remote: sanity check for both endpoints
	media: st-delta: Fix reference count leak in delta_run_work
	media: sti: Fix reference count leaks
	media: exynos4-is: Fix several reference count leaks due to pm_runtime_get_sync
	media: exynos4-is: Fix a reference count leak due to pm_runtime_get_sync
	media: exynos4-is: Fix a reference count leak
	media: vsp1: Fix runtime PM imbalance on error
	media: platform: s3c-camif: Fix runtime PM imbalance on error
	media: platform: sti: hva: Fix runtime PM imbalance on error
	media: bdisp: Fix runtime PM imbalance on error
	media: media/pci: prevent memory leak in bttv_probe
	media: uvcvideo: Ensure all probed info is returned to v4l2
	mmc: sdio: Check for CISTPL_VERS_1 buffer size
	media: saa7134: avoid a shift overflow
	fs: dlm: fix configfs memory leak
	media: venus: core: Fix runtime PM imbalance in venus_probe
	ntfs: add check for mft record size in superblock
	ip_gre: set dev->hard_header_len and dev->needed_headroom properly
	mac80211: handle lack of sband->bitrates in rates
	PM: hibernate: remove the bogus call to get_gendisk() in software_resume()
	scsi: mvumi: Fix error return in mvumi_io_attach()
	scsi: target: core: Add CONTROL field for trace events
	mic: vop: copy data to kernel space then write to io memory
	misc: vop: add round_up(x,4) for vring_size to avoid kernel panic
	usb: gadget: function: printer: fix use-after-free in __lock_acquire
	udf: Limit sparing table size
	udf: Avoid accessing uninitialized data on failed inode read
	USB: cdc-acm: handle broken union descriptors
	usb: dwc3: simple: add support for Hikey 970
	can: flexcan: flexcan_chip_stop(): add error handling and propagate error value
	ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs()
	misc: rtsx: Fix memory leak in rtsx_pci_probe
	reiserfs: only call unlock_new_inode() if I_NEW
	xfs: make sure the rt allocator doesn't run off the end
	usb: ohci: Default to per-port over-current protection
	Bluetooth: Only mark socket zapped after unlocking
	scsi: ibmvfc: Fix error return in ibmvfc_probe()
	brcmsmac: fix memory leak in wlc_phy_attach_lcnphy
	rtl8xxxu: prevent potential memory leak
	Fix use after free in get_capset_info callback.
	scsi: qedi: Protect active command list to avoid list corruption
	scsi: qedi: Fix list_del corruption while removing active I/O
	tty: ipwireless: fix error handling
	ipvs: Fix uninit-value in do_ip_vs_set_ctl()
	reiserfs: Fix memory leak in reiserfs_parse_options()
	mwifiex: don't call del_timer_sync() on uninitialized timer
	brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach
	usb: core: Solve race condition in anchor cleanup functions
	scsi: ufs: ufs-qcom: Fix race conditions caused by ufs_qcom_testbus_config()
	ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n()
	net: korina: cast KSEG0 address to pointer in kfree
	tty: serial: fsl_lpuart: fix lpuart32_poll_get_char
	usb: cdc-acm: add quirk to blacklist ETAS ES58X devices
	USB: cdc-wdm: Make wdm_flush() interruptible and add wdm_fsync().
	eeprom: at25: set minimum read/write access stride to 1
	usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets.
	Linux 4.19.154

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I242a1afee6c5297423afd0f11e81f9a9f14ded77
2020-10-30 11:43:26 +01:00
Christoph Hellwig
e8db1c3496 PM: hibernate: remove the bogus call to get_gendisk() in software_resume()
[ Upstream commit 428805c0c5 ]

get_gendisk grabs a reference on the disk and file operation, so this
code will leak both of them while having absolutely no use for the
gendisk itself.

This effectively reverts commit 2df83fa4bc ("PM / Hibernate: Use
get_gendisk to verify partition if resume_file is integer format")

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-30 10:38:28 +01:00
Juri Lelli
2e2f41a960 sched/features: Fix !CONFIG_JUMP_LABEL case
[ Upstream commit a73f863af4 ]

Commit:

  765cc3a4b2 ("sched/core: Optimize sched_feat() for !CONFIG_SCHED_DEBUG builds")

made sched features static for !CONFIG_SCHED_DEBUG configurations, but
overlooked the CONFIG_SCHED_DEBUG=y and !CONFIG_JUMP_LABEL cases.

For the latter echoing changes to /sys/kernel/debug/sched_features has
the nasty effect of effectively changing what sched_features reports,
but without actually changing the scheduler behaviour (since different
translation units get different sysctl_sched_features).

Fix CONFIG_SCHED_DEBUG=y and !CONFIG_JUMP_LABEL configurations by properly
restructuring ifdefs.

Fixes: 765cc3a4b2 ("sched/core: Optimize sched_feat() for !CONFIG_SCHED_DEBUG builds")
Co-developed-by: Daniel Bristot de Oliveira <bristot@redhat.com>
Signed-off-by: Daniel Bristot de Oliveira <bristot@redhat.com>
Signed-off-by: Juri Lelli <juri.lelli@redhat.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Patrick Bellasi <patrick.bellasi@matbug.net>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Link: https://lore.kernel.org/r/20201013053114.160628-1-juri.lelli@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-30 10:38:25 +01:00
Daniel Thompson
e8b33f91ce kdb: Fix pager search for multi-line strings
[ Upstream commit d081a6e353 ]

Currently using forward search doesn't handle multi-line strings correctly.
The search routine replaces line breaks with \0 during the search and, for
regular searches ("help | grep Common\n"), there is code after the line
has been discarded or printed to replace the break character.

However during a pager search ("help\n" followed by "/Common\n") when the
string is matched we will immediately return to normal output and the code
that should restore the \n becomes unreachable. Fix this by restoring the
replaced character when we disable the search mode and update the comment
accordingly.

Fixes: fb6daa7520 ("kdb: Provide forward search at more prompt")
Link: https://lore.kernel.org/r/20200909141708.338273-1-daniel.thompson@linaro.org
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-30 10:38:20 +01:00
Greg Kroah-Hartman
b9a942466b This is the 4.19.153 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl+ag5UACgkQONu9yGCS
 aT5O3w//RaOcwQdi47/UJz8zyja1ZG8MSSCGibpwvaDwrsXu9es1QtqLAC38H10o
 ygxNLBZQHxhScsRpicNc+Dy87+lcSj8cF1ed7sd1LU8rvmQ18uIeFUZxfzYth8jW
 i6erzas0Ojw8IMy566GDxkfAC6n5GhJuJTVFQWUQpoEbsb5rXcGCLx3u+S3Ew+5t
 Xb9qE6r5cImYymvMkMy7RQ4Db2qgOwjkaCj+Ol+4BSR0bF4OweMQLPJs9gN8pJpr
 o2nxHg7wdO8SKJZCBVw8ZmfO4zF6czcKy+KzFajn+4LA2oT5mgiV8y21cd9CWYeQ
 JQK1jZGwwl/xljrM1yLd+crG8i11DhCStY90+4bxD68r8H+g1kwZ8jELmCwuuyx6
 dk1s7jOxyKl9qAnMt6r2HqrjgxGD+2hL+2S84jPGRBow5IYjrdD0REXZjyk1R7Rp
 8k00lRk1ATEy7H2lj4JW34tcsTEEDcn8PqUFx7MRKtCUI2uo4Gr5HXqf6wTJDp6S
 BsDe8mm77jd81vtw/AZ8Fv7Fg42QIPt7G1QV9wBbFvDmKmDa7Gj6SuQqTeu75oU9
 M++aWSwyOb08wZEE0y94wsm6r4raN3A8o70Df9FltNFTALowuIcR+CVtOnQfHEuL
 BUBJcWg3SDsIxkXYgvQ9jO5h38i6dhAIVGAcU4VB0rgP/ePKMQs=
 =GiLo
 -----END PGP SIGNATURE-----

Merge 4.19.153 into android-4.19-stable

Changes in 4.19.153
	ibmveth: Switch order of ibmveth_helper calls.
	ibmveth: Identify ingress large send packets.
	ipv4: Restore flowi4_oif update before call to xfrm_lookup_route
	mlx4: handle non-napi callers to napi_poll
	net: fec: Fix phy_device lookup for phy_reset_after_clk_enable()
	net: fec: Fix PHY init after phy_reset_after_clk_enable()
	net: fix pos incrementment in ipv6_route_seq_next
	net/smc: fix valid DMBE buffer sizes
	net: usb: qmi_wwan: add Cellient MPL200 card
	tipc: fix the skb_unshare() in tipc_buf_append()
	net/ipv4: always honour route mtu during forwarding
	r8169: fix data corruption issue on RTL8402
	net/tls: sendfile fails with ktls offload
	binder: fix UAF when releasing todo list
	ALSA: bebob: potential info leak in hwdep_read()
	chelsio/chtls: fix socket lock
	chelsio/chtls: correct netdevice for vlan interface
	chelsio/chtls: correct function return and return type
	net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device
	net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling ether_setup
	net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels
	nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download()
	tcp: fix to update snd_wl1 in bulk receiver fast path
	r8169: fix operation under forced interrupt threading
	icmp: randomize the global rate limiter
	ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887
	cifs: remove bogus debug code
	cifs: Return the error from crypt_message when enc/dec key not found.
	KVM: x86/mmu: Commit zap of remaining invalid pages when recovering lpages
	KVM: SVM: Initialize prev_ga_tag before use
	ima: Don't ignore errors from crypto_shash_update()
	crypto: algif_aead - Do not set MAY_BACKLOG on the async path
	EDAC/i5100: Fix error handling order in i5100_init_one()
	EDAC/ti: Fix handling of platform_get_irq() error
	x86/fpu: Allow multiple bits in clearcpuid= parameter
	drivers/perf: xgene_pmu: Fix uninitialized resource struct
	x86/nmi: Fix nmi_handle() duration miscalculation
	x86/events/amd/iommu: Fix sizeof mismatch
	crypto: algif_skcipher - EBUSY on aio should be an error
	crypto: mediatek - Fix wrong return value in mtk_desc_ring_alloc()
	crypto: ixp4xx - Fix the size used in a 'dma_free_coherent()' call
	crypto: picoxcell - Fix potential race condition bug
	media: tuner-simple: fix regression in simple_set_radio_freq
	media: Revert "media: exynos4-is: Add missed check for pinctrl_lookup_state()"
	media: m5mols: Check function pointer in m5mols_sensor_power
	media: uvcvideo: Set media controller entity functions
	media: uvcvideo: Silence shift-out-of-bounds warning
	media: omap3isp: Fix memleak in isp_probe
	crypto: omap-sham - fix digcnt register handling with export/import
	hwmon: (pmbus/max34440) Fix status register reads for MAX344{51,60,61}
	cypto: mediatek - fix leaks in mtk_desc_ring_alloc
	media: mx2_emmaprp: Fix memleak in emmaprp_probe
	media: tc358743: initialize variable
	media: tc358743: cleanup tc358743_cec_isr
	media: rcar-vin: Fix a reference count leak.
	media: rockchip/rga: Fix a reference count leak.
	media: platform: fcp: Fix a reference count leak.
	media: camss: Fix a reference count leak.
	media: s5p-mfc: Fix a reference count leak
	media: stm32-dcmi: Fix a reference count leak
	media: ti-vpe: Fix a missing check and reference count leak
	regulator: resolve supply after creating regulator
	pinctrl: bcm: fix kconfig dependency warning when !GPIOLIB
	spi: spi-s3c64xx: swap s3c64xx_spi_set_cs() and s3c64xx_enable_datapath()
	spi: spi-s3c64xx: Check return values
	ath10k: provide survey info as accumulated data
	Bluetooth: hci_uart: Cancel init work before unregistering
	ath6kl: prevent potential array overflow in ath6kl_add_new_sta()
	ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb()
	ath10k: Fix the size used in a 'dma_free_coherent()' call in an error handling path
	wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680
	ASoC: qcom: lpass-platform: fix memory leak
	ASoC: qcom: lpass-cpu: fix concurrency issue
	brcmfmac: check ndev pointer
	mwifiex: Do not use GFP_KERNEL in atomic context
	staging: rtl8192u: Do not use GFP_KERNEL in atomic context
	drm/gma500: fix error check
	scsi: qla4xxx: Fix an error handling path in 'qla4xxx_get_host_stats()'
	scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba()
	scsi: csiostor: Fix wrong return value in csio_hw_prep_fw()
	backlight: sky81452-backlight: Fix refcount imbalance on error
	VMCI: check return value of get_user_pages_fast() for errors
	tty: serial: earlycon dependency
	tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup()
	pty: do tty_flip_buffer_push without port->lock in pty_write
	pwm: lpss: Fix off by one error in base_unit math in pwm_lpss_prepare()
	pwm: lpss: Add range limit check for the base_unit register value
	drivers/virt/fsl_hypervisor: Fix error handling path
	video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error
	video: fbdev: sis: fix null ptr dereference
	video: fbdev: radeon: Fix memleak in radeonfb_pci_register
	HID: roccat: add bounds checking in kone_sysfs_write_settings()
	pinctrl: mcp23s08: Fix mcp23x17_regmap initialiser
	pinctrl: mcp23s08: Fix mcp23x17 precious range
	net/mlx5: Don't call timecounter cyc2time directly from 1PPS flow
	net: stmmac: use netif_tx_start|stop_all_queues() function
	cpufreq: armada-37xx: Add missing MODULE_DEVICE_TABLE
	net: dsa: rtl8366: Check validity of passed VLANs
	net: dsa: rtl8366: Refactor VLAN/PVID init
	net: dsa: rtl8366: Skip PVID setting if not requested
	net: dsa: rtl8366rb: Support all 4096 VLANs
	ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd()
	misc: mic: scif: Fix error handling path
	ALSA: seq: oss: Avoid mutex lock for a long-time ioctl
	usb: dwc2: Fix parameter type in function pointer prototype
	quota: clear padding in v2r1_mem2diskdqb()
	slimbus: core: check get_addr before removing laddr ida
	slimbus: core: do not enter to clock pause mode in core
	slimbus: qcom-ngd-ctrl: disable ngd in qmi server down callback
	HID: hid-input: fix stylus battery reporting
	qtnfmac: fix resource leaks on unsupported iftype error return path
	net: enic: Cure the enic api locking trainwreck
	mfd: sm501: Fix leaks in probe()
	iwlwifi: mvm: split a print to avoid a WARNING in ROC
	usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above.
	usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well
	nl80211: fix non-split wiphy information
	usb: dwc2: Fix INTR OUT transfers in DDMA mode.
	scsi: target: tcmu: Fix warning: 'page' may be used uninitialized
	scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs()
	platform/x86: mlx-platform: Remove PSU EEPROM configuration
	mwifiex: fix double free
	ipvs: clear skb->tstamp in forwarding path
	net: korina: fix kfree of rx/tx descriptor array
	netfilter: nf_log: missing vlan offload tag and proto
	mm/memcg: fix device private memcg accounting
	mm, oom_adj: don't loop through tasks in __set_oom_adj when not necessary
	IB/mlx4: Fix starvation in paravirt mux/demux
	IB/mlx4: Adjust delayed work when a dup is observed
	powerpc/pseries: Fix missing of_node_put() in rng_init()
	powerpc/icp-hv: Fix missing of_node_put() in success path
	RDMA/ucma: Fix locking for ctx->events_reported
	RDMA/ucma: Add missing locking around rdma_leave_multicast()
	mtd: lpddr: fix excessive stack usage with clang
	powerpc/pseries: explicitly reschedule during drmem_lmb list traversal
	mtd: mtdoops: Don't write panic data twice
	ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT values
	arc: plat-hsdk: fix kconfig dependency warning when !RESET_CONTROLLER
	xfs: limit entries returned when counting fsmap records
	xfs: fix high key handling in the rt allocator's query_range function
	RDMA/qedr: Fix use of uninitialized field
	RDMA/qedr: Fix inline size returned for iWARP
	powerpc/tau: Use appropriate temperature sample interval
	powerpc/tau: Convert from timer to workqueue
	powerpc/tau: Remove duplicated set_thresholds() call
	Linux 4.19.153

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9e85e8ca67ab8e28d04a77339f80fdbf3c568956
2020-10-29 11:36:20 +01:00
Suren Baghdasaryan
a3d0ceee71 mm, oom_adj: don't loop through tasks in __set_oom_adj when not necessary
[ Upstream commit 67197a4f28 ]

Currently __set_oom_adj loops through all processes in the system to keep
oom_score_adj and oom_score_adj_min in sync between processes sharing
their mm.  This is done for any task with more that one mm_users, which
includes processes with multiple threads (sharing mm and signals).
However for such processes the loop is unnecessary because their signal
structure is shared as well.

Android updates oom_score_adj whenever a tasks changes its role
(background/foreground/...) or binds to/unbinds from a service, making it
more/less important.  Such operation can happen frequently.  We noticed
that updates to oom_score_adj became more expensive and after further
investigation found out that the patch mentioned in "Fixes" introduced a
regression.  Using Pixel 4 with a typical Android workload, write time to
oom_score_adj increased from ~3.57us to ~362us.  Moreover this regression
linearly depends on the number of multi-threaded processes running on the
system.

Mark the mm with a new MMF_MULTIPROCESS flag bit when task is created with
(CLONE_VM && !CLONE_THREAD && !CLONE_VFORK).  Change __set_oom_adj to use
MMF_MULTIPROCESS instead of mm_users to decide whether oom_score_adj
update should be synchronized between multiple processes.  To prevent
races between clone() and __set_oom_adj(), when oom_score_adj of the
process being cloned might be modified from userspace, we use
oom_adj_mutex.  Its scope is changed to global.

The combination of (CLONE_VM && !CLONE_THREAD) is rarely used except for
the case of vfork().  To prevent performance regressions of vfork(), we
skip taking oom_adj_mutex and setting MMF_MULTIPROCESS when CLONE_VFORK is
specified.  Clearing the MMF_MULTIPROCESS flag (when the last process
sharing the mm exits) is left out of this patch to keep it simple and
because it is believed that this threading model is rare.  Should there
ever be a need for optimizing that case as well, it can be done by hooking
into the exit path, likely following the mm_update_next_owner pattern.

With the combination of (CLONE_VM && !CLONE_THREAD && !CLONE_VFORK) being
quite rare, the regression is gone after the change is applied.

[surenb@google.com: v3]
  Link: https://lkml.kernel.org/r/20200902012558.2335613-1-surenb@google.com

Fixes: 44a70adec9 ("mm, oom_adj: make sure processes sharing mm have same view of oom_score_adj")
Reported-by: Tim Murray <timmurray@google.com>
Suggested-by: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Eugene Syromiatnikov <esyr@redhat.com>
Cc: Christian Kellner <christian@kellner.me>
Cc: Adrian Reber <areber@redhat.com>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Aleksa Sarai <cyphar@cyphar.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Alexey Gladkov <gladkov.alexey@gmail.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Daniel Jordan <daniel.m.jordan@oracle.com>
Cc: Andrei Vagin <avagin@gmail.com>
Cc: Bernd Edlinger <bernd.edlinger@hotmail.de>
Cc: John Johansen <john.johansen@canonical.com>
Cc: Yafang Shao <laoar.shao@gmail.com>
Link: https://lkml.kernel.org/r/20200824153036.3201505-1-surenb@google.com
Debugged-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-29 09:55:15 +01:00
Greg Kroah-Hartman
9f80205d66 This is the 4.19.151 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl+Gt3oACgkQONu9yGCS
 aT4MAQ/+NmMSJHbPu5DRX4qfg+toj9SRdDJfv0H6+dmJ/Wabeogq3GF6VB5ku8fJ
 N5uJLVb+iz/n4cbvTvE1sI+5WEPzK/nRVRnwUUH3SDycB+tCk4loKbGwV+gZTvYi
 PsHqHQ9UUKpdBs4gJm9I/FCOlA4mtcdK2W0JDMfdCmZc3ACyCWo+y83ESAfjOcO9
 vda/1xaeqNPaPFxteVKpmXujlHQw3meH8ZzpkQi7t1HeZ6bnpoObMIy8c1gtYjSt
 jeLvw9pnvgQEpAidIZb3MwVyxHE/mFGRcoQmI0WYoWWXOnRAHUfFQTsK7ZWbTYAF
 MUvJlGg3zchhBetfo2523rdGM9/AHMnwmGAuTs5PkZdPDRwLaWjeFs2u8njmjEk9
 R8SrtF+2zxuO92SPp37jXqRUb7G69vPnlZ6IIcMpr61qeUAf78dWN67VW0kVMs/K
 hMHsl0E1Ax3K9GV9ZSQc7oe7/fMj+xXabpeuDZ/5lxvbBKrIP/UZLMJeZg28y+91
 0JbFhMfEN71sTfCHXpxe9bAvmI1XKlYh37RLAOJtNQRqwKsP2Tuim5C+tJsREmF9
 eAPZq0QrjjTb1t8wii7HKXyjnrSfTpOS7HUPsGbeiU4JSVmWGeLy6IxmjZh1fjY+
 WLr+Hn0Q62w5OGXBxS7rEfq3FMnAEkT/27a5IwrDPoGje+rO6WY=
 =TSOP
 -----END PGP SIGNATURE-----

Merge 4.19.151 into android-4.19-stable

Changes in 4.19.151
	fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h
	Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts
	fbcon: Fix global-out-of-bounds read in fbcon_get_font()
	Revert "ravb: Fixed to be able to unload modules"
	net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key()
	drm/nouveau/mem: guard against NULL pointer access in mem_del
	usermodehelper: reset umask to default before executing user process
	platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on the HP Pavilion 11 x360
	platform/x86: thinkpad_acpi: initialize tp_nvram_state variable
	platform/x86: intel-vbtn: Switch to an allow-list for SW_TABLET_MODE reporting
	platform/x86: thinkpad_acpi: re-initialize ACPI buffer size when reuse
	driver core: Fix probe_count imbalance in really_probe()
	perf top: Fix stdio interface input handling with glibc 2.28+
	i2c: i801: Exclude device from suspend direct complete optimization
	mtd: rawnand: sunxi: Fix the probe error path
	arm64: dts: stratix10: add status to qspi dts node
	nvme-core: put ctrl ref when module ref get fail
	macsec: avoid use-after-free in macsec_handle_frame()
	mm/khugepaged: fix filemap page_to_pgoff(page) != offset
	xfrmi: drop ignore_df check before updating pmtu
	cifs: Fix incomplete memory allocation on setxattr path
	i2c: meson: fix clock setting overwrite
	i2c: meson: fixup rate calculation with filter delay
	i2c: owl: Clear NACK and BUS error bits
	sctp: fix sctp_auth_init_hmacs() error path
	team: set dev->needed_headroom in team_setup_by_port()
	net: team: fix memory leak in __team_options_register
	openvswitch: handle DNAT tuple collision
	drm/amdgpu: prevent double kfree ttm->sg
	xfrm: clone XFRMA_SET_MARK in xfrm_do_migrate
	xfrm: clone XFRMA_REPLAY_ESN_VAL in xfrm_do_migrate
	xfrm: clone XFRMA_SEC_CTX in xfrm_do_migrate
	xfrm: clone whole liftime_cur structure in xfrm_do_migrate
	net: stmmac: removed enabling eee in EEE set callback
	platform/x86: fix kconfig dependency warning for FUJITSU_LAPTOP
	xfrm: Use correct address family in xfrm_state_find
	bonding: set dev->needed_headroom in bond_setup_by_slave()
	mdio: fix mdio-thunder.c dependency & build error
	net: usb: ax88179_178a: fix missing stop entry in driver_info
	net/mlx5e: Fix VLAN cleanup flow
	net/mlx5e: Fix VLAN create flow
	rxrpc: Fix rxkad token xdr encoding
	rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read()
	rxrpc: Fix some missing _bh annotations on locking conn->state_lock
	rxrpc: Fix server keyring leak
	perf: Fix task_function_call() error handling
	mmc: core: don't set limits.discard_granularity as 0
	mm: khugepaged: recalculate min_free_kbytes after memory hotplug as expected by khugepaged
	net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails
	Linux 4.19.151

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9ee2b0fc4fc39f27be6ae680529e1046f249a3e6
2020-10-14 12:11:08 +02:00
Kajol Jain
80e745b672 perf: Fix task_function_call() error handling
[ Upstream commit 6d6b8b9f4f ]

The error handling introduced by commit:

  2ed6edd33a ("perf: Add cond_resched() to task_function_call()")

looses any return value from smp_call_function_single() that is not
{0, -EINVAL}. This is a problem because it will return -EXNIO when the
target CPU is offline. Worse, in that case it'll turn into an infinite
loop.

Fixes: 2ed6edd33a ("perf: Add cond_resched() to task_function_call()")
Reported-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Signed-off-by: Kajol Jain <kjain@linux.ibm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Barret Rhoden <brho@google.com>
Tested-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Link: https://lkml.kernel.org/r/20200827064732.20860-1-kjain@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-14 10:31:26 +02:00
Linus Torvalds
33acb78c85 usermodehelper: reset umask to default before executing user process
commit 4013c1496c upstream.

Kernel threads intentionally do CLONE_FS in order to follow any changes
that 'init' does to set up the root directory (or cwd).

It is admittedly a bit odd, but it avoids the situation where 'init'
does some extensive setup to initialize the system environment, and then
we execute a usermode helper program, and it uses the original FS setup
from boot time that may be very limited and incomplete.

[ Both Al Viro and Eric Biederman point out that 'pivot_root()' will
  follow the root regardless, since it fixes up other users of root (see
  chroot_fs_refs() for details), but overmounting root and doing a
  chroot() would not. ]

However, Vegard Nossum noticed that the CLONE_FS not only means that we
follow the root and current working directories, it also means we share
umask with whatever init changed it to. That wasn't intentional.

Just reset umask to the original default (0022) before actually starting
the usermode helper program.

Reported-by: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-14 10:31:21 +02:00