Commit Graph

3908 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
291d853dff This is the 4.19.88 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl3owgEACgkQONu9yGCS
 aT43zw//SS1As83XXuHr4mdWIVDjXo6RMJ6Ib7YbRi/uhBmQuUuGVFcqGxUIA9Kl
 eSXu5Kt8TNmInzHq9AMYgegrELAEwPD2XfptALGDwiUHonQuiFaqOQn/bltJOm1L
 PsG15A7+/gFhuhPJDp2ZfNBmZGdpXdIwD27oUDqF1XD64dMa/HPbFUVgxWn3HHkd
 sm0J6Ez0eNA+BmLnHXYDiSaEYIiwvy1nN6XpyIfOyb2Tz6kPoe0vVWU00Cmy8KAU
 EIWB+TBRunspgMsShL5Cl1MSFOxf9QOmgnZxcrODAQfb1TbLMACB1FGMjK4nLm+3
 wPlSnC7L49ARl/pvmN5NOUrjHi8S8qq/Od9QW+UIckRI6KzOU832h99v4gFuHjSC
 KFiLi5K9+uTIMgNOETmINBiKKUcUzYXYVajvm4tuAUq3HO8wy6jeALtt34OiJZQZ
 DV8wyBdL9NDUFqBymFaMFA4Us/fGIREzvPgI0E0jth2ANuLFLtScrnStuWv8buwJ
 JT3V9xCxHZtZ3Ctevx/Jp6OaQtnbSnWjMjrO0UDzZ6N7+g5UKmh9/R3xL6sBpFVU
 Vu49J+qWU3VmbY3EIulel+yARNe7xS4ExK185JmNzpYFyOpXum14FHhhtQ6xNSeu
 dRqyITI0KYP7jWtBDKCgVAWF5jC9gHP1ksrHSZMhyGrv1dC1XZM=
 =KnJW
 -----END PGP SIGNATURE-----

Merge 4.19.88 into android-4.19

Changes in 4.19.88
	clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate
	clocksource/drivers/mediatek: Fix error handling
	ASoC: msm8916-wcd-analog: Fix RX1 selection in RDAC2 MUX
	ASoC: compress: fix unsigned integer overflow check
	reset: Fix memory leak in reset_control_array_put()
	clk: samsung: exynos5433: Fix error paths
	ASoC: kirkwood: fix external clock probe defer
	ASoC: kirkwood: fix device remove ordering
	clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume
	pinctrl: cherryview: Allocate IRQ chip dynamic
	ARM: dts: imx6qdl-sabreauto: Fix storm of accelerometer interrupts
	reset: fix reset_control_ops kerneldoc comment
	clk: at91: avoid sleeping early
	clk: sunxi: Fix operator precedence in sunxi_divs_clk_setup
	clk: sunxi-ng: a80: fix the zero'ing of bits 16 and 18
	ARM: dts: sun8i-a83t-tbs-a711: Fix WiFi resume from suspend
	samples/bpf: fix build by setting HAVE_ATTR_TEST to zero
	powerpc/bpf: Fix tail call implementation
	idr: Fix integer overflow in idr_for_each_entry
	idr: Fix idr_alloc_u32 on 32-bit systems
	x86/resctrl: Prevent NULL pointer dereference when reading mondata
	clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call
	clk: ti: clkctrl: Fix failed to enable error with double udelay timeout
	net: fec: add missed clk_disable_unprepare in remove
	bridge: ebtables: don't crash when using dnat target in output chains
	can: peak_usb: report bus recovery as well
	can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on open
	can: rx-offload: can_rx_offload_queue_tail(): fix error handling, avoid skb mem leak
	can: rx-offload: can_rx_offload_offload_one(): do not increase the skb_queue beyond skb_queue_len_max
	can: rx-offload: can_rx_offload_offload_one(): increment rx_fifo_errors on queue overflow or OOM
	can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to propagate error value in case of errors
	can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on error
	can: rx-offload: can_rx_offload_irq_offload_fifo(): continue on error
	can: flexcan: increase error counters if skb enqueueing via can_rx_offload_queue_sorted() fails
	can: mcp251x: mcp251x_restart_work_handler(): Fix potential force_quit race condition
	watchdog: meson: Fix the wrong value of left time
	ASoC: stm32: sai: add restriction on mmap support
	scripts/gdb: fix debugging modules compiled with hot/cold partitioning
	net: bcmgenet: use RGMII loopback for MAC reset
	net: bcmgenet: reapply manual settings to the PHY
	net: mscc: ocelot: fix __ocelot_rmw_ix prototype
	ceph: return -EINVAL if given fsc mount option on kernel w/o support
	net/fq_impl: Switch to kvmalloc() for memory allocation
	mac80211: fix station inactive_time shortly after boot
	block: drbd: remove a stray unlock in __drbd_send_protocol()
	pwm: bcm-iproc: Prevent unloading the driver module while in use
	scsi: target/tcmu: Fix queue_cmd_ring() declaration
	scsi: lpfc: Fix kernel Oops due to null pring pointers
	scsi: lpfc: Fix dif and first burst use in write commands
	ARM: dts: Fix up SQ201 flash access
	tracing: Lock event_mutex before synth_event_mutex
	ARM: debug-imx: only define DEBUG_IMX_UART_PORT if needed
	ARM: dts: imx51: Fix memory node duplication
	ARM: dts: imx53: Fix memory node duplication
	ARM: dts: imx31: Fix memory node duplication
	ARM: dts: imx35: Fix memory node duplication
	ARM: dts: imx7: Fix memory node duplication
	ARM: dts: imx6ul: Fix memory node duplication
	ARM: dts: imx6sx: Fix memory node duplication
	ARM: dts: imx6sl: Fix memory node duplication
	ARM: dts: imx50: Fix memory node duplication
	ARM: dts: imx23: Fix memory node duplication
	ARM: dts: imx1: Fix memory node duplication
	ARM: dts: imx27: Fix memory node duplication
	ARM: dts: imx25: Fix memory node duplication
	ARM: dts: imx53-voipac-dmm-668: Fix memory node duplication
	parisc: Fix serio address output
	parisc: Fix HP SDC hpa address output
	ARM: dts: Fix hsi gdd range for omap4
	arm64: mm: Prevent mismatched 52-bit VA support
	arm64: smp: Handle errors reported by the firmware
	bus: ti-sysc: Check for no-reset and no-idle flags at the child level
	platform/x86: mlx-platform: Fix LED configuration
	ARM: OMAP1: fix USB configuration for device-only setups
	RDMA/hns: Fix the bug while use multi-hop of pbl
	arm64: preempt: Fix big-endian when checking preempt count in assembly
	RDMA/vmw_pvrdma: Use atomic memory allocation in create AH
	PM / AVS: SmartReflex: NULL check before some freeing functions is not needed
	xfs: zero length symlinks are not valid
	ARM: ks8695: fix section mismatch warning
	ACPI / LPSS: Ignore acpi_device_fix_up_power() return value
	scsi: lpfc: Enable Management features for IF_TYPE=6
	scsi: qla2xxx: Fix NPIV handling for FC-NVMe
	scsi: qla2xxx: Fix for FC-NVMe discovery for NPIV port
	nvme: provide fallback for discard alloc failure
	s390/zcrypt: make sysfs reset attribute trigger queue reset
	crypto: user - support incremental algorithm dumps
	arm64: dts: renesas: draak: Fix CVBS input
	mwifiex: fix potential NULL dereference and use after free
	mwifiex: debugfs: correct histogram spacing, formatting
	brcmfmac: set F2 watermark to 256 for 4373
	brcmfmac: set SDIO F1 MesBusyCtrl for CYW4373
	rtl818x: fix potential use after free
	bcache: do not check if debug dentry is ERR or NULL explicitly on remove
	bcache: do not mark writeback_running too early
	xfs: require both realtime inodes to mount
	nvme: fix kernel paging oops
	ubifs: Fix default compression selection in ubifs
	ubi: Put MTD device after it is not used
	ubi: Do not drop UBI device reference before using
	microblaze: adjust the help to the real behavior
	microblaze: move "... is ready" messages to arch/microblaze/Makefile
	microblaze: fix multiple bugs in arch/microblaze/boot/Makefile
	iwlwifi: move iwl_nvm_check_version() into dvm
	iwlwifi: mvm: force TCM re-evaluation on TCM resume
	iwlwifi: pcie: fix erroneous print
	iwlwifi: pcie: set cmd_len in the correct place
	gpio: pca953x: Fix AI overflow on PCAL6524
	gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB
	kvm: vmx: Set IA32_TSC_AUX for legacy mode guests
	Revert "KVM: nVMX: reset cache/shadows when switching loaded VMCS"
	Revert "KVM: nVMX: move check_vmentry_postreqs() call to nested_vmx_enter_non_root_mode()"
	crypto/chelsio/chtls: listen fails with multiadapt
	VSOCK: bind to random port for VMADDR_PORT_ANY
	mmc: meson-gx: make sure the descriptor is stopped on errors
	mtd: rawnand: sunxi: Write pageprog related opcodes to WCMD_SET
	usb: ehci-omap: Fix deferred probe for phy handling
	btrfs: Check for missing device before bio submission in btrfs_map_bio
	btrfs: fix ncopies raid_attr for RAID56
	btrfs: dev-replace: set result code of cancel by status of scrub
	Btrfs: allow clear_extent_dirty() to receive a cached extent state record
	btrfs: only track ref_heads in delayed_ref_updates
	serial: sh-sci: Fix crash in rx_timer_fn() on PIO fallback
	HID: intel-ish-hid: fixes incorrect error handling
	gpio: raspberrypi-exp: decrease refcount on firmware dt node
	serial: 8250: Rate limit serial port rx interrupts during input overruns
	kprobes/x86/xen: blacklist non-attachable xen interrupt functions
	xen/pciback: Check dev_data before using it
	kprobes: Blacklist symbols in arch-defined prohibited area
	kprobes/x86: Show x86-64 specific blacklisted symbols correctly
	vfio-mdev/samples: Use u8 instead of char for handle functions
	memory: omap-gpmc: Get the header of the enum
	pinctrl: xway: fix gpio-hog related boot issues
	net/mlx5: Continue driver initialization despite debugfs failure
	netfilter: nf_nat_sip: fix RTP/RTCP source port translations
	exofs_mount(): fix leaks on failure exits
	bnxt_en: Return linux standard errors in bnxt_ethtool.c
	bnxt_en: Save ring statistics before reset.
	bnxt_en: query force speeds before disabling autoneg mode.
	KVM: s390: unregister debug feature on failing arch init
	pinctrl: sh-pfc: r8a77990: Fix MOD_SEL0 SEL_I2C1 field width
	pinctrl: sh-pfc: sh7264: Fix PFCR3 and PFCR0 register configuration
	pinctrl: sh-pfc: sh7734: Fix shifted values in IPSR10
	HID: doc: fix wrong data structure reference for UHID_OUTPUT
	dm flakey: Properly corrupt multi-page bios.
	gfs2: take jdata unstuff into account in do_grow
	dm raid: fix false -EBUSY when handling check/repair message
	xfs: Align compat attrlist_by_handle with native implementation.
	xfs: Fix bulkstat compat ioctls on x32 userspace.
	IB/qib: Fix an error code in qib_sdma_verbs_send()
	clocksource/drivers/fttmr010: Fix invalid interrupt register access
	vxlan: Fix error path in __vxlan_dev_create()
	powerpc/book3s/32: fix number of bats in p/v_block_mapped()
	powerpc/xmon: fix dump_segments()
	drivers/regulator: fix a missing check of return value
	Bluetooth: hci_bcm: Handle specific unknown packets after firmware loading
	serial: max310x: Fix tx_empty() callback
	openrisc: Fix broken paths to arch/or32
	RDMA/srp: Propagate ib_post_send() failures to the SCSI mid-layer
	scsi: qla2xxx: deadlock by configfs_depend_item
	scsi: csiostor: fix incorrect dma device in case of vport
	brcmfmac: Fix access point mode
	ath6kl: Only use match sets when firmware supports it
	ath6kl: Fix off by one error in scan completion
	powerpc/perf: Fix unit_sel/cache_sel checks
	powerpc/32: Avoid unsupported flags with clang
	powerpc/prom: fix early DEBUG messages
	powerpc/mm: Make NULL pointer deferences explicit on bad page faults.
	powerpc/44x/bamboo: Fix PCI range
	vfio/spapr_tce: Get rid of possible infinite loop
	powerpc/powernv/eeh/npu: Fix uninitialized variables in opal_pci_eeh_freeze_status
	drbd: ignore "all zero" peer volume sizes in handshake
	drbd: reject attach of unsuitable uuids even if connected
	drbd: do not block when adjusting "disk-options" while IO is frozen
	drbd: fix print_st_err()'s prototype to match the definition
	IB/rxe: Make counters thread safe
	bpf/cpumap: make sure frame_size for build_skb is aligned if headroom isn't
	regulator: tps65910: fix a missing check of return value
	powerpc/83xx: handle machine check caused by watchdog timer
	powerpc/pseries: Fix node leak in update_lmb_associativity_index()
	powerpc: Fix HMIs on big-endian with CONFIG_RELOCATABLE=y
	crypto: mxc-scc - fix build warnings on ARM64
	pwm: clps711x: Fix period calculation
	net/netlink_compat: Fix a missing check of nla_parse_nested
	net/net_namespace: Check the return value of register_pernet_subsys()
	f2fs: fix block address for __check_sit_bitmap
	f2fs: fix to dirty inode synchronously
	um: Include sys/uio.h to have writev()
	um: Make GCOV depend on !KCOV
	net: (cpts) fix a missing check of clk_prepare
	net: stmicro: fix a missing check of clk_prepare
	net: dsa: bcm_sf2: Propagate error value from mdio_write
	atl1e: checking the status of atl1e_write_phy_reg
	tipc: fix a missing check of genlmsg_put
	net: marvell: fix a missing check of acpi_match_device
	net/wan/fsl_ucc_hdlc: Avoid double free in ucc_hdlc_probe()
	ocfs2: clear journal dirty flag after shutdown journal
	vmscan: return NODE_RECLAIM_NOSCAN in node_reclaim() when CONFIG_NUMA is n
	mm/page_alloc.c: free order-0 pages through PCP in page_frag_free()
	mm/page_alloc.c: use a single function to free page
	mm/page_alloc.c: deduplicate __memblock_free_early() and memblock_free()
	tools/vm/page-types.c: fix "kpagecount returned fewer pages than expected" failures
	netfilter: nf_tables: fix a missing check of nla_put_failure
	xprtrdma: Prevent leak of rpcrdma_rep objects
	infiniband: bnxt_re: qplib: Check the return value of send_message
	infiniband/qedr: Potential null ptr dereference of qp
	firmware: arm_sdei: fix wrong of_node_put() in init function
	firmware: arm_sdei: Fix DT platform device creation
	lib/genalloc.c: fix allocation of aligned buffer from non-aligned chunk
	lib/genalloc.c: use vzalloc_node() to allocate the bitmap
	fork: fix some -Wmissing-prototypes warnings
	drivers/base/platform.c: kmemleak ignore a known leak
	lib/genalloc.c: include vmalloc.h
	mtd: Check add_mtd_device() ret code
	tipc: fix memory leak in tipc_nl_compat_publ_dump
	net/core/neighbour: tell kmemleak about hash tables
	ata: ahci: mvebu: do Armada 38x configuration only on relevant SoCs
	PCI/MSI: Return -ENOSPC from pci_alloc_irq_vectors_affinity()
	net/core/neighbour: fix kmemleak minimal reference count for hash tables
	serial: 8250: Fix serial8250 initialization crash
	gpu: ipu-v3: pre: don't trigger update if buffer address doesn't change
	sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe
	ip_tunnel: Make none-tunnel-dst tunnel port work with lwtunnel
	decnet: fix DN_IFREQ_SIZE
	net/smc: prevent races between smc_lgr_terminate() and smc_conn_free()
	net/smc: don't wait for send buffer space when data was already sent
	mm/hotplug: invalid PFNs from pfn_to_online_page()
	xfs: end sync buffer I/O properly on shutdown error
	net/smc: fix sender_free computation
	blktrace: Show requests without sector
	net/smc: fix byte_order for rx_curs_confirmed
	tipc: fix skb may be leaky in tipc_link_input
	ASoC: samsung: i2s: Fix prescaler setting for the secondary DAI
	sfc: initialise found bitmap in efx_ef10_mtd_probe
	geneve: change NET_UDP_TUNNEL dependency to select
	net: fix possible overflow in __sk_mem_raise_allocated()
	net: ip_gre: do not report erspan_ver for gre or gretap
	net: ip6_gre: do not report erspan_ver for ip6gre or ip6gretap
	sctp: don't compare hb_timer expire date before starting it
	bpf: decrease usercnt if bpf_map_new_fd() fails in bpf_map_get_fd_by_id()
	mmc: core: align max segment size with logical block size
	net: dev: Use unsigned integer as an argument to left-shift
	kvm: properly check debugfs dentry before using it
	bpf: drop refcount if bpf_map_new_fd() fails in map_create()
	net: hns3: Change fw error code NOT_EXEC to NOT_SUPPORTED
	net: hns3: fix PFC not setting problem for DCB module
	net: hns3: fix an issue for hclgevf_ae_get_hdev
	net: hns3: fix an issue for hns3_update_new_int_gl
	iommu/amd: Fix NULL dereference bug in match_hid_uid
	apparmor: delete the dentry in aafs_remove() to avoid a leak
	scsi: libsas: Support SATA PHY connection rate unmatch fixing during discovery
	ACPI / APEI: Don't wait to serialise with oops messages when panic()ing
	ACPI / APEI: Switch estatus pool to use vmalloc memory
	scsi: hisi_sas: shutdown axi bus to avoid exception CQ returned
	scsi: libsas: Check SMP PHY control function result
	RDMA/hns: Fix the bug with updating rq head pointer when flush cqe
	RDMA/hns: Bugfix for the scene without receiver queue
	RDMA/hns: Fix the state of rereg mr
	RDMA/hns: Use GFP_ATOMIC in hns_roce_v2_modify_qp
	ASoC: rt5645: Headphone Jack sense inverts on the LattePanda board
	powerpc/pseries/dlpar: Fix a missing check in dlpar_parse_cc_property()
	xdp: fix cpumap redirect SKB creation bug
	mtd: Remove a debug trace in mtdpart.c
	mm, gup: add missing refcount overflow checks on s390
	clk: at91: fix update bit maps on CFG_MOR write
	clk: at91: generated: set audio_pll_allowed in at91_clk_register_generated()
	usb: dwc2: use a longer core rest timeout in dwc2_core_reset()
	staging: rtl8192e: fix potential use after free
	staging: rtl8723bs: Drop ACPI device ids
	staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids
	USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P
	mei: bus: prefix device names on bus with the bus name
	mei: me: add comet point V device id
	thunderbolt: Power cycle the router if NVM authentication fails
	xfrm: Fix memleak on xfrm state destroy
	media: v4l2-ctrl: fix flags for DO_WHITE_BALANCE
	net: macb: fix error format in dev_err()
	pwm: Clear chip_data in pwm_put()
	media: atmel: atmel-isc: fix asd memory allocation
	media: atmel: atmel-isc: fix INIT_WORK misplacement
	macvlan: schedule bc_work even if error
	net: psample: fix skb_over_panic
	openvswitch: fix flow command message size
	sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook
	slip: Fix use-after-free Read in slip_open
	openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info()
	openvswitch: remove another BUG_ON()
	selftests: bpf: test_sockmap: handle file creation failures gracefully
	tipc: fix link name length check
	sctp: cache netns in sctp_ep_common
	net: sched: fix `tc -s class show` no bstats on class with nolock subqueues
	net: macb: add missed tasklet_kill
	ext4: add more paranoia checking in ext4_expand_extra_isize handling
	watchdog: sama5d4: fix WDD value to be always set to max
	net: macb: Fix SUBNS increment and increase resolution
	net: macb driver, check for SKBTX_HW_TSTAMP
	mtd: rawnand: atmel: Fix spelling mistake in error message
	mtd: rawnand: atmel: fix possible object reference leak
	mtd: spi-nor: cast to u64 to avoid uint overflows
	drm/atmel-hlcdc: revert shift by 8
	mailbox: stm32_ipcc: add spinlock to fix channels concurrent access
	tcp: exit if nothing to retransmit on RTO timeout
	HID: core: check whether Usage Page item is after Usage ID items
	crypto: stm32/hash - Fix hmac issue more than 256 bytes
	media: stm32-dcmi: fix DMA corruption when stopping streaming
	media: stm32-dcmi: fix check of pm_runtime_get_sync return value
	hwrng: stm32 - fix unbalanced pm_runtime_enable
	clk: stm32mp1: fix HSI divider flag
	clk: stm32mp1: fix mcu divider table
	clk: stm32mp1: add CLK_SET_RATE_NO_REPARENT to Kernel clocks
	clk: stm32mp1: parent clocks update
	mailbox: mailbox-test: fix null pointer if no mmio
	pinctrl: stm32: fix memory leak issue
	ASoC: stm32: i2s: fix dma configuration
	ASoC: stm32: i2s: fix 16 bit format support
	ASoC: stm32: i2s: fix IRQ clearing
	ASoC: stm32: sai: add missing put_device()
	dmaengine: stm32-dma: check whether length is aligned on FIFO threshold
	platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer
	platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size
	net: fec: fix clock count mis-match
	Linux 4.19.88

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ifd3801a77cb551be72788031e7fcfc8a1d4fd197
2019-12-05 12:02:49 +01:00
Masami Hiramatsu
dee3f77032 tracing: Lock event_mutex before synth_event_mutex
[ Upstream commit fc800a10be ]

synthetic event is using synth_event_mutex for protecting
synth_event_list, and event_trigger_write() path acquires
locks as below order.

event_trigger_write(event_mutex)
  ->trigger_process_regex(trigger_cmd_mutex)
    ->event_hist_trigger_func(synth_event_mutex)

On the other hand, synthetic event creation and deletion paths
call trace_add_event_call() and trace_remove_event_call()
which acquires event_mutex. In that case, if we keep the
synth_event_mutex locked while registering/unregistering synthetic
events, its dependency will be inversed.

To avoid this issue, current synthetic event is using a 2 phase
process to create/delete events. For example, it searches existing
events under synth_event_mutex to check for event-name conflicts, and
unlocks synth_event_mutex, then registers a new event under event_mutex
locked. Finally, it locks synth_event_mutex and tries to add the
new event to the list. But it can introduce complexity and a chance
for name conflicts.

To solve this simpler, this introduces trace_add_event_call_nolock()
and trace_remove_event_call_nolock() which don't acquire
event_mutex inside. synthetic event can lock event_mutex before
synth_event_mutex to solve the lock dependency issue simpler.

Link: http://lkml.kernel.org/r/154140844377.17322.13781091165954002713.stgit@devbox

Reviewed-by: Tom Zanussi <tom.zanussi@linux.intel.com>
Tested-by: Tom Zanussi <tom.zanussi@linux.intel.com>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-12-05 09:19:49 +01:00
Greg Kroah-Hartman
96267fbb74 This is the 4.19.83 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl3H5i0ACgkQONu9yGCS
 aT7XGRAAoLPz4+PgbqKbF348hKVf30UD3LUH4sI4/wzfyW5WvbY/sqe3ccLqOuJA
 VeixBf6P12eljER8M+vQz5S7rK9kaFJ43B+CrUhFA1mKbySNpMdmWMwktQ0UrD19
 sSG1OH6R3aw7OfRMwNxfnZUzqZKKJ5GPa9Xzyxh42qhnhaBtcLUm0UrFzyi84ofP
 T4ab6BeT3tXzIaGZprWEoTs34vpfNoz4qFYxtbe2ym7z7EAHmUGj0VeYTPNoFLZE
 Sv7T0FHuBzdQhsKfi4SEByh+RxVYiMxF8SArYmlbIZHboCvAaMRoNS8lgala1dRc
 XVLIBjh32kVh/VZIIE3iPWPaWxYpfLnrlXjEFirUcOC/ImPV0eHp0kzYKJey/k6X
 4SYd8Dc3l4dCy+/sHOj1QCJX32Ah+oTIWHCTc3HcCv/g3ysLr0bxafAHxKR1xXW3
 4coa80cPN5YvFZcIdy4RgmU0DpFI8QAtDyWgkvvCKV3rSusYLuvfFVAK3kwTqGge
 wqZBughADqCzz1rPdHxflAbwrPrhwdT+us9s+AZosrfiCEN+1+CtFYPbgaTw8IgY
 8qzlw8NKdgTG3qUTzRsAi364wOdH6djpT7dCkTxXorvTEAzUmbtyKQyvtQcr6C4f
 HZALbPsof8vnSDshATr7vzmImmTPoFfdLClZrIimXVG96k/ur5A=
 =syEV
 -----END PGP SIGNATURE-----

Merge 4.19.83 into android-4.19

Changes in 4.19.83
	kbuild: add -fcf-protection=none when using retpoline flags
	regulator: of: fix suspend-min/max-voltage parsing
	ASoC: wm8994: Do not register inapplicable controls for WM1811
	arm64: dts: allwinner: a64: pine64-plus: Add PHY regulator delay
	arm64: dts: allwinner: a64: sopine-baseboard: Add PHY regulator delay
	arm64: dts: Fix gpio to pinmux mapping
	regulator: ti-abb: Fix timeout in ti_abb_wait_txdone/ti_abb_clear_all_txdone
	ASoC: rt5682: add NULL handler to set_jack function
	regulator: pfuze100-regulator: Variable "val" in pfuze100_regulator_probe() could be uninitialized
	ASoC: wm_adsp: Don't generate kcontrols without READ flags
	ASoc: rockchip: i2s: Fix RPM imbalance
	ARM: dts: logicpd-torpedo-som: Remove twl_keypad
	pinctrl: ns2: Fix off by one bugs in ns2_pinmux_enable()
	ARM: mm: fix alignment handler faults under memory pressure
	scsi: qla2xxx: fix a potential NULL pointer dereference
	scsi: scsi_dh_alua: handle RTPG sense code correctly during state transitions
	scsi: sni_53c710: fix compilation error
	scsi: fix kconfig dependency warning related to 53C700_LE_ON_BE
	ARM: dts: imx7s: Correct GPT's ipg clock source
	perf c2c: Fix memory leak in build_cl_output()
	8250-men-mcb: fix error checking when get_num_ports returns -ENODEV
	perf kmem: Fix memory leak in compact_gfp_flags()
	ARM: davinci: dm365: Fix McBSP dma_slave_map entry
	drm/amdgpu: fix potential VM faults
	scsi: target: core: Do not overwrite CDB byte 1
	tracing: Fix "gfp_t" format for synthetic events
	ARM: 8926/1: v7m: remove register save to stack before svc
	of: unittest: fix memory leak in unittest_data_add
	MIPS: bmips: mark exception vectors as char arrays
	irqchip/gic-v3-its: Use the exact ITSList for VMOVP
	i2c: stm32f7: fix first byte to send in slave mode
	i2c: stm32f7: fix a race in slave mode with arbitration loss irq
	i2c: stm32f7: remove warning when compiling with W=1
	cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs
	nbd: protect cmd->status with cmd->lock
	nbd: handle racing with error'ed out commands
	cxgb4: fix panic when attaching to ULD fail
	dccp: do not leak jiffies on the wire
	erspan: fix the tun_info options_len check for erspan
	inet: stop leaking jiffies on the wire
	net: annotate accesses to sk->sk_incoming_cpu
	net: annotate lockless accesses to sk->sk_napi_id
	net: dsa: bcm_sf2: Fix IMP setup for port different than 8
	net: ethernet: ftgmac100: Fix DMA coherency issue with SW checksum
	net: fix sk_page_frag() recursion from memory reclaim
	net: hisilicon: Fix ping latency when deal with high throughput
	net/mlx4_core: Dynamically set guaranteed amount of counters per VF
	netns: fix GFP flags in rtnl_net_notifyid()
	net: usb: lan78xx: Disable interrupts before calling generic_handle_irq()
	net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()
	selftests: net: reuseport_dualstack: fix uninitalized parameter
	udp: fix data-race in udp_set_dev_scratch()
	vxlan: check tun_info options_len properly
	net: add skb_queue_empty_lockless()
	udp: use skb_queue_empty_lockless()
	net: use skb_queue_empty_lockless() in poll() handlers
	net: use skb_queue_empty_lockless() in busy poll contexts
	net: add READ_ONCE() annotation in __skb_wait_for_more_packets()
	ipv4: fix route update on metric change.
	selftests: fib_tests: add more tests for metric update
	net/mlx5e: Fix handling of compressed CQEs in case of low NAPI budget
	r8169: fix wrong PHY ID issue with RTL8168dp
	net/mlx5e: Fix ethtool self test: link speed
	net: dsa: b53: Do not clear existing mirrored port mask
	net: bcmgenet: don't set phydev->link from MAC
	net: phy: bcm7xxx: define soft_reset for 40nm EPHY
	net: bcmgenet: reset 40nm EPHY on energy detect
	net: usb: lan78xx: Connect PHY before registering MAC
	net: dsa: fix switch tree list
	r8152: add device id for Lenovo ThinkPad USB-C Dock Gen 2
	net/flow_dissector: switch to siphash
	wireless: Skip directory when generating certificates
	platform/x86: pmc_atom: Add Siemens SIMATIC IPC227E to critclk_systems DMI table
	powerpc/mm: Fixup tlbie vs mtpidr/mtlpidr ordering issue on POWER9
	selftests/powerpc: Add test case for tlbie vs mtpidr ordering issue
	selftests/powerpc: Fix compile error on tlbie_test due to newer gcc
	ASoC: pcm3168a: The codec does not support S32_LE
	arm64: dts: ti: k3-am65-main: Fix gic-its node unit-address
	usb: gadget: udc: core: Fix segfault if udc_bind_to_driver() for pending driver fails
	Linux 4.19.83

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib7f556bb3ee4310e9ff430220b36986e45266f81
2019-11-10 16:00:46 +01:00
Zhengjun Xing
fa18f803d1 tracing: Fix "gfp_t" format for synthetic events
[ Upstream commit 9fa8c9c647 ]

In the format of synthetic events, the "gfp_t" is shown as "signed:1",
but in fact the "gfp_t" is "unsigned", should be shown as "signed:0".

The issue can be reproduced by the following commands:

echo 'memlatency u64 lat; unsigned int order; gfp_t gfp_flags; int migratetype' > /sys/kernel/debug/tracing/synthetic_events
cat  /sys/kernel/debug/tracing/events/synthetic/memlatency/format

name: memlatency
ID: 2233
format:
        field:unsigned short common_type;       offset:0;       size:2; signed:0;
        field:unsigned char common_flags;       offset:2;       size:1; signed:0;
        field:unsigned char common_preempt_count;       offset:3;       size:1; signed:0;
        field:int common_pid;   offset:4;       size:4; signed:1;

        field:u64 lat;  offset:8;       size:8; signed:0;
        field:unsigned int order;       offset:16;      size:4; signed:0;
        field:gfp_t gfp_flags;  offset:24;      size:4; signed:1;
        field:int migratetype;  offset:32;      size:4; signed:1;

print fmt: "lat=%llu, order=%u, gfp_flags=%x, migratetype=%d", REC->lat, REC->order, REC->gfp_flags, REC->migratetype

Link: http://lkml.kernel.org/r/20191018012034.6404-1-zhengjun.xing@linux.intel.com

Reviewed-by: Tom Zanussi <tom.zanussi@linux.intel.com>
Signed-off-by: Zhengjun Xing <zhengjun.xing@linux.intel.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-11-10 11:27:28 +01:00
Greg Kroah-Hartman
aa4d6b3489 This is the 4.19.82 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl3Ct0gACgkQONu9yGCS
 aT46EQ//SsO3zq9K1P9HVRCQh5+ZPrk2uynVQIlMunhvhix8+SA+UopfNWwqM30n
 aEUPHk9snHTiRm5VRCBip8ea3/uZCpLTAwm/L0OKSyHpZ/GDGIQxNP5svjMQePYp
 57mmhVEV387gHoJiXxi8OiOYuPagscw809UkMBTIgl1g3B+vicy6IYEjlvmwr+vy
 6ghqEDkrR+2+25n/yrPPfesL+rlpE4nB6QvNkYnDSzyJTTKP76Wh21bP4r0mV2RN
 U4X5irbdfTSEYcK5DbNTUgMsUEk1ixxY6vHy7yWSe8ED9oMHdfjzfUS15pjbyrxD
 GLXw3o7Lv/ES7HGZpG073QLIp9oJPtvhrFHvIwBicE2pvBE3++zmmCFdQMx/tY25
 sUUctWvpeizX0qD+7mH6VrMXZB7DbHTUGfxdtfPJfk3l+c4NtSxe6hPaOC1MDJaY
 qBj7tDCoeB1HkLSqKkCGlMu9v1/V6+8E0Gqb6DbPC3IRwezHLq0U/LDCoTf874Qs
 0Fx5t+9Fxk5oeG6ifEmaYP0xT9untUi5EfFAYGCdEGYv5GZskmQgi7BLrnzUCfqM
 T+oruajADfSfe0ylgcXp9vdVkVWx/arbftOH3IVAZhe6Qj1jq57sMmSaLii7QyCC
 Z+rRwGNCO3WhkobBbLpF75uLMYulMqtlsep0Y2JIxdhcticiQbE=
 =1W43
 -----END PGP SIGNATURE-----

Merge 4.19.82 into android-4.19

Changes in 4.19.82
	zram: fix race between backing_dev_show and backing_dev_store
	dm snapshot: introduce account_start_copy() and account_end_copy()
	dm snapshot: rework COW throttling to fix deadlock
	Btrfs: fix inode cache block reserve leak on failure to allocate data space
	Btrfs: fix memory leak due to concurrent append writes with fiemap
	btrfs: qgroup: Always free PREALLOC META reserve in btrfs_delalloc_release_extents()
	btrfs: tracepoints: Fix wrong parameter order for qgroup events
	wil6210: fix freeing of rx buffers in EDMA mode
	f2fs: flush quota blocks after turnning it off
	scsi: lpfc: Fix a duplicate 0711 log message number.
	sc16is7xx: Fix for "Unexpected interrupt: 8"
	powerpc/powernv: hold device_hotplug_lock when calling memtrace_offline_pages()
	f2fs: fix to recover inode's i_gc_failures during POR
	f2fs: fix to recover inode->i_flags of inode block during POR
	HID: i2c-hid: add Direkt-Tek DTLAPY133-1 to descriptor override
	usb: dwc2: fix unbalanced use of external vbus-supply
	tools/power turbostat: fix goldmont C-state limit decoding
	x86/cpu: Add Atom Tremont (Jacobsville)
	drm/msm/dpu: handle failures while initializing displays
	bcache: fix input overflow to writeback_rate_minimum
	PCI: Fix Switchtec DMA aliasing quirk dmesg noise
	Btrfs: fix deadlock on tree root leaf when finding free extent
	netfilter: ipset: Make invalid MAC address checks consistent
	HID: i2c-hid: Disable runtime PM for LG touchscreen
	HID: i2c-hid: Ignore input report if there's no data present on Elan touchpanels
	HID: i2c-hid: Add Odys Winbook 13 to descriptor override
	platform/x86: Add the VLV ISP PCI ID to atomisp2_pm
	platform/x86: Fix config space access for intel_atomisp2_pm
	ath10k: assign 'n_cipher_suites = 11' for WCN3990 to enable WPA3
	clk: boston: unregister clks on failure in clk_boston_setup()
	scripts/setlocalversion: Improve -dirty check with git-status --no-optional-locks
	staging: mt7621-pinctrl: use pinconf-generic for 'dt_node_to_map' and 'dt_free_map'
	HID: Add ASUS T100CHI keyboard dock battery quirks
	NFSv4: Ensure that the state manager exits the loop on SIGKILL
	HID: steam: fix boot loop with bluetooth firmware
	HID: steam: fix deadlock with input devices.
	samples: bpf: fix: seg fault with NULL pointer arg
	usb: dwc3: gadget: early giveback if End Transfer already completed
	usb: dwc3: gadget: clear DWC3_EP_TRANSFER_STARTED on cmd complete
	ALSA: usb-audio: Cleanup DSD whitelist
	usb: handle warm-reset port requests on hub resume
	rtc: pcf8523: set xtal load capacitance from DT
	arm64: Add MIDR encoding for HiSilicon Taishan CPUs
	arm64: kpti: Whitelist HiSilicon Taishan v110 CPUs
	mlxsw: spectrum: Set LAG port collector only when active
	scsi: lpfc: Correct localport timeout duration error
	CIFS: Respect SMB2 hdr preamble size in read responses
	cifs: add credits from unmatched responses/messages
	ALSA: hda/realtek - Apply ALC294 hp init also for S4 resume
	media: vimc: Remove unused but set variables
	ext4: disallow files with EXT4_JOURNAL_DATA_FL from EXT4_IOC_SWAP_BOOT
	exec: load_script: Do not exec truncated interpreter path
	net: dsa: mv88e6xxx: Release lock while requesting IRQ
	PCI/PME: Fix possible use-after-free on remove
	drm/amd/display: fix odm combine pipe reset
	power: supply: max14656: fix potential use-after-free
	iio: adc: meson_saradc: Fix memory allocation order
	iio: fix center temperature of bmc150-accel-core
	libsubcmd: Make _FORTIFY_SOURCE defines dependent on the feature
	perf tests: Avoid raising SEGV using an obvious NULL dereference
	perf map: Fix overlapped map handling
	perf script brstackinsn: Fix recovery from LBR/binary mismatch
	perf jevents: Fix period for Intel fixed counters
	perf tools: Propagate get_cpuid() error
	perf annotate: Propagate perf_env__arch() error
	perf annotate: Fix the signedness of failure returns
	perf annotate: Propagate the symbol__annotate() error return
	perf annotate: Return appropriate error code for allocation failures
	staging: rtl8188eu: fix null dereference when kzalloc fails
	RDMA/hfi1: Prevent memory leak in sdma_init
	RDMA/iwcm: Fix a lock inversion issue
	HID: hyperv: Use in-place iterator API in the channel callback
	nfs: Fix nfsi->nrequests count error on nfs_inode_remove_request
	arm64: ftrace: Ensure synchronisation in PLT setup for Neoverse-N1 #1542419
	tty: serial: owl: Fix the link time qualifier of 'owl_uart_exit()'
	tty: n_hdlc: fix build on SPARC
	gpio: max77620: Use correct unit for debounce times
	fs: cifs: mute -Wunused-const-variable message
	serial: mctrl_gpio: Check for NULL pointer
	efi/cper: Fix endianness of PCIe class code
	efi/x86: Do not clean dummy variable in kexec path
	MIPS: include: Mark __cmpxchg as __always_inline
	x86/xen: Return from panic notifier
	ocfs2: clear zero in unaligned direct IO
	fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry()
	fs: ocfs2: fix a possible null-pointer dereference in ocfs2_write_end_nolock()
	fs: ocfs2: fix a possible null-pointer dereference in ocfs2_info_scan_inode_alloc()
	arm64: armv8_deprecated: Checking return value for memory allocation
	x86/cpu: Add Comet Lake to the Intel CPU models header
	sched/vtime: Fix guest/system mis-accounting on task switch
	perf/x86/amd: Change/fix NMI latency mitigation to use a timestamp
	drm/amdgpu: fix memory leak
	iio: imu: adis16400: release allocated memory on failure
	MIPS: include: Mark __xchg as __always_inline
	MIPS: fw: sni: Fix out of bounds init of o32 stack
	virt: vbox: fix memory leak in hgcm_call_preprocess_linaddr
	nbd: fix possible sysfs duplicate warning
	NFSv4: Fix leak of clp->cl_acceptor string
	s390/uaccess: avoid (false positive) compiler warnings
	tracing: Initialize iter->seq after zeroing in tracing_read_pipe()
	ARM: 8914/1: NOMMU: Fix exc_ret for XIP
	ALSA: hda/realtek: Reduce the Headphone static noise on XPS 9350/9360
	iwlwifi: exclude GEO SAR support for 3168
	nbd: verify socket is supported during setup
	USB: legousbtower: fix a signedness bug in tower_probe()
	thunderbolt: Use 32-bit writes when writing ring producer/consumer
	ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe()
	fuse: flush dirty data/metadata before non-truncate setattr
	fuse: truncate pending writes on O_TRUNC
	ALSA: bebob: Fix prototype of helper function to return negative value
	ALSA: hda/realtek - Fix 2 front mics of codec 0x623
	ALSA: hda/realtek - Add support for ALC623
	UAS: Revert commit 3ae62a4209 ("UAS: fix alignment of scatter/gather segments")
	USB: gadget: Reject endpoints with 0 maxpacket value
	usb-storage: Revert commit 747668dbc0 ("usb-storage: Set virt_boundary_mask to avoid SG overflows")
	USB: ldusb: fix ring-buffer locking
	USB: ldusb: fix control-message timeout
	usb: xhci: fix __le32/__le64 accessors in debugfs code
	USB: serial: whiteheat: fix potential slab corruption
	USB: serial: whiteheat: fix line-speed endianness
	scsi: target: cxgbit: Fix cxgbit_fw4_ack()
	HID: i2c-hid: add Trekstor Primebook C11B to descriptor override
	HID: Fix assumption that devices have inputs
	HID: fix error message in hid_open_report()
	nl80211: fix validation of mesh path nexthop
	s390/cmm: fix information leak in cmm_timeout_handler()
	s390/idle: fix cpu idle time calculation
	arm64: Ensure VM_WRITE|VM_SHARED ptes are clean by default
	rtlwifi: Fix potential overflow on P2P code
	dmaengine: qcom: bam_dma: Fix resource leak
	dmaengine: cppi41: Fix cppi41_dma_prep_slave_sg() when idle
	drm/amdgpu/powerplay/vega10: allow undervolting in p7
	NFS: Fix an RCU lock leak in nfs4_refresh_delegation_stateid()
	batman-adv: Avoid free/alloc race when handling OGM buffer
	llc: fix sk_buff leak in llc_sap_state_process()
	llc: fix sk_buff leak in llc_conn_service()
	rxrpc: Fix call ref leak
	rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record
	rxrpc: Fix trace-after-put looking at the put peer record
	NFC: pn533: fix use-after-free and memleaks
	bonding: fix potential NULL deref in bond_update_slave_arr
	net: usb: sr9800: fix uninitialized local variable
	sch_netem: fix rcu splat in netem_enqueue()
	ALSA: timer: Simplify error path in snd_timer_open()
	ALSA: timer: Fix mutex deadlock at releasing card
	ALSA: usb-audio: DSD auto-detection for Playback Designs
	ALSA: usb-audio: Update DSD support quirks for Oppo and Rotel
	ALSA: usb-audio: Add DSD support for Gustard U16/X26 USB Interface
	powerpc/powernv: Fix CPU idle to be called with IRQs disabled
	Revert "ALSA: hda: Flush interrupts on disabling"
	Linux 4.19.82

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I79ced3dcffed0086af7d8a77116e8061915677a1
2019-11-06 13:21:58 +01:00
Petr Mladek
394c90d9ce tracing: Initialize iter->seq after zeroing in tracing_read_pipe()
[ Upstream commit d303de1fcf ]

A customer reported the following softlockup:

[899688.160002] NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [test.sh:16464]
[899688.160002] CPU: 0 PID: 16464 Comm: test.sh Not tainted 4.12.14-6.23-azure #1 SLE12-SP4
[899688.160002] RIP: 0010:up_write+0x1a/0x30
[899688.160002] Kernel panic - not syncing: softlockup: hung tasks
[899688.160002] RIP: 0010:up_write+0x1a/0x30
[899688.160002] RSP: 0018:ffffa86784d4fde8 EFLAGS: 00000257 ORIG_RAX: ffffffffffffff12
[899688.160002] RAX: ffffffff970fea00 RBX: 0000000000000001 RCX: 0000000000000000
[899688.160002] RDX: ffffffff00000001 RSI: 0000000000000080 RDI: ffffffff970fea00
[899688.160002] RBP: ffffffffffffffff R08: ffffffffffffffff R09: 0000000000000000
[899688.160002] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8b59014720d8
[899688.160002] R13: ffff8b59014720c0 R14: ffff8b5901471090 R15: ffff8b5901470000
[899688.160002]  tracing_read_pipe+0x336/0x3c0
[899688.160002]  __vfs_read+0x26/0x140
[899688.160002]  vfs_read+0x87/0x130
[899688.160002]  SyS_read+0x42/0x90
[899688.160002]  do_syscall_64+0x74/0x160

It caught the process in the middle of trace_access_unlock(). There is
no loop. So, it must be looping in the caller tracing_read_pipe()
via the "waitagain" label.

Crashdump analyze uncovered that iter->seq was completely zeroed
at this point, including iter->seq.seq.size. It means that
print_trace_line() was never able to print anything and
there was no forward progress.

The culprit seems to be in the code:

	/* reset all but tr, trace, and overruns */
	memset(&iter->seq, 0,
	       sizeof(struct trace_iterator) -
	       offsetof(struct trace_iterator, seq));

It was added by the commit 53d0aa7730 ("ftrace:
add logic to record overruns"). It was v2.6.27-rc1.
It was the time when iter->seq looked like:

     struct trace_seq {
	unsigned char		buffer[PAGE_SIZE];
	unsigned int		len;
     };

There was no "size" variable and zeroing was perfectly fine.

The solution is to reinitialize the structure after or without
zeroing.

Link: http://lkml.kernel.org/r/20191011142134.11997-1-pmladek@suse.com

Signed-off-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-11-06 13:06:09 +01:00
Greg Kroah-Hartman
c8532f7af6 This is the 4.19.81 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl239joACgkQONu9yGCS
 aT4C8g//docfwEU2Ezqy7G2049bm0ulF99clghNoT47idndkBGgrZp1fJ9X8H7dO
 dxR12NoKQcYtlxdLvY1XTrHYXnxhMgECjltLeI0sd2sA90hteWx9lXS9DDcWcwWr
 zE4vtteCEE6b7DlMtMV3IeSqtkLIAewdlYYepmsX2xNVnRJXwCbEbvQ0TVHan0P/
 1QtuiiiO97q8NkPAOAJCqfs6l+LFfWMuKN1cESBQ7fVUg0PppP+dfqrBhyJ/C98S
 kA+iFkFKkRdYr7052sJtm0mSvOrBmCU9KGixHzQ9gmN7LlfxgfnQqH5i1qCL/mC2
 +/9jozmZ2vhyH75VV2CT3hsVgyseptURudrmOcQC/iiCF8nDypcqrcYBYYNMNg8z
 u4b4bvxxXv+XzJQkgIWjiKPa1+BQh3JBubbNHxVhJecxyd6dwHH498z/9t3e1XRn
 9pdW7YdVDWNI5HgxVJRTmaN157N0mQSg9ghEDQ10G/KOhY7+pbCGCEIOursSvou3
 ov01uMeip2TE+OcjcEMyspcKJZkxaEvfS0iAvCYsXebPjyVwtVrT9Nph8MTJ1zPw
 W3YN5wt/kT3pJII2owR5SG3ti+LindvaK+jAEKsLcA9CZ3DeS2tSjwr5KQR0w8Px
 5wtfVo5yFG7YRQCXKq3mhuZEeXHXOXASNEuxD4fmgXqSYwj2SZU=
 =bugE
 -----END PGP SIGNATURE-----

Merge 4.19.81 into android-4.19

Changes in 4.19.81
	nvme-pci: Fix a race in controller removal
	scsi: ufs: skip shutdown if hba is not powered
	scsi: megaraid: disable device when probe failed after enabled device
	scsi: qla2xxx: Fix unbound sleep in fcport delete path.
	ARM: OMAP2+: Fix missing reset done flag for am3 and am43
	ARM: OMAP2+: Fix warnings with broken omap2_set_init_voltage()
	ieee802154: ca8210: prevent memory leak
	ARM: dts: am4372: Set memory bandwidth limit for DISPC
	net: dsa: qca8k: Use up to 7 ports for all operations
	MIPS: dts: ar9331: fix interrupt-controller size
	xen/efi: Set nonblocking callbacks
	nl80211: fix null pointer dereference
	mac80211: fix txq null pointer dereference
	netfilter: nft_connlimit: disable bh on garbage collection
	net: dsa: rtl8366rb: add missing of_node_put after calling of_get_child_by_name
	mips: Loongson: Fix the link time qualifier of 'serial_exit()'
	net: hisilicon: Fix usage of uninitialized variable in function mdio_sc_cfg_reg_write()
	lib: textsearch: fix escapes in example code
	r8152: Set macpassthru in reset_resume callback
	namespace: fix namespace.pl script to support relative paths
	libata/ahci: Fix PCS quirk application
	md/raid0: fix warning message for parameter default_layout
	Revert "drm/radeon: Fix EEH during kexec"
	ocfs2: fix panic due to ocfs2_wq is null
	ipv4: fix race condition between route lookup and invalidation
	ipv4: Return -ENETUNREACH if we can't create route but saddr is valid
	net: avoid potential infinite loop in tc_ctl_action()
	net: bcmgenet: Fix RGMII_MODE_EN value for GENET v1/2/3
	net: bcmgenet: Set phydev->dev_flags only for internal PHYs
	net: i82596: fix dma_alloc_attr for sni_82596
	net/ibmvnic: Fix EOI when running in XIVE mode.
	net: ipv6: fix listify ip6_rcv_finish in case of forwarding
	net: stmmac: disable/enable ptp_ref_clk in suspend/resume flow
	sctp: change sctp_prot .no_autobind with true
	memfd: Fix locking when tagging pins
	USB: legousbtower: fix memleak on disconnect
	ALSA: hda/realtek - Add support for ALC711
	ALSA: hda/realtek - Enable headset mic on Asus MJ401TA
	ALSA: usb-audio: Disable quirks for BOSS Katana amplifiers
	ALSA: hda - Force runtime PM on Nvidia HDMI codecs
	usb: udc: lpc32xx: fix bad bit shift operation
	USB: serial: ti_usb_3410_5052: fix port-close races
	USB: ldusb: fix memleak on disconnect
	USB: usblp: fix use-after-free on disconnect
	USB: ldusb: fix read info leaks
	MIPS: tlbex: Fix build_restore_pagemask KScratch restore
	staging: wlan-ng: fix exit return when sme->key_idx >= NUM_WEPKEYS
	scsi: zfcp: fix reaction on bit error threshold notification
	scsi: sd: Ignore a failure to sync cache due to lack of authorization
	scsi: core: save/restore command resid for error handling
	scsi: core: try to get module before removing device
	scsi: ch: Make it possible to open a ch device multiple times again
	Input: da9063 - fix capability and drop KEY_SLEEP
	Input: synaptics-rmi4 - avoid processing unknown IRQs
	ASoC: rsnd: Reinitialize bit clock inversion flag for every format setting
	ACPI: CPPC: Set pcc_data[pcc_ss_id] to NULL in acpi_cppc_processor_exit()
	cfg80211: wext: avoid copying malformed SSIDs
	mac80211: Reject malformed SSID elements
	drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50
	drm/ttm: Restore ttm prefaulting
	drm/amdgpu: Bail earlier when amdgpu.cik_/si_support is not set to 1
	drivers/base/memory.c: don't access uninitialized memmaps in soft_offline_page_store()
	fs/proc/page.c: don't access uninitialized memmaps in fs/proc/page.c
	mmc: cqhci: Commit descriptors before setting the doorbell
	mm/memory-failure.c: don't access uninitialized memmaps in memory_failure()
	mm/slub: fix a deadlock in show_slab_objects()
	mm/page_owner: don't access uninitialized memmaps when reading /proc/pagetypeinfo
	hugetlbfs: don't access uninitialized memmaps in pfn_range_valid_gigantic()
	mm/memory-failure: poison read receives SIGKILL instead of SIGBUS if mmaped more than once
	xtensa: drop EXPORT_SYMBOL for outs*/ins*
	parisc: Fix vmap memory leak in ioremap()/iounmap()
	EDAC/ghes: Fix Use after free in ghes_edac remove path
	arm64: Enable workaround for Cavium TX2 erratum 219 when running SMT
	CIFS: avoid using MID 0xFFFF
	CIFS: Fix use after free of file info structures
	perf/aux: Fix AUX output stopping
	tracing: Fix race in perf_trace_buf initialization
	dm cache: fix bugs when a GFP_NOWAIT allocation fails
	x86/boot/64: Make level2_kernel_pgt pages invalid outside kernel area
	x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu
	pinctrl: cherryview: restore Strago DMI workaround for all versions
	pinctrl: armada-37xx: fix control of pins 32 and up
	pinctrl: armada-37xx: swap polarity on LED group
	btrfs: block-group: Fix a memory leak due to missing btrfs_put_block_group()
	Btrfs: add missing extents release on file extent cluster relocation error
	Btrfs: check for the full sync flag while holding the inode lock during fsync
	btrfs: tracepoints: Fix bad entry members of qgroup events
	memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()'
	cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown
	xen/netback: fix error path of xenvif_connect_data()
	PCI: PM: Fix pci_power_up()
	blk-rq-qos: fix first node deletion of rq_qos_del()
	RDMA/cxgb4: Do not dma memory off of the stack
	Linux 4.19.81

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I96ed6b6f11919bc6dd4b560b160b8e7059ec574e
2019-10-29 09:41:48 +01:00
Prateek Sood
5ce7528c4d tracing: Fix race in perf_trace_buf initialization
commit 6b1340cc00 upstream.

A race condition exists while initialiazing perf_trace_buf from
perf_trace_init() and perf_kprobe_init().

      CPU0                                        CPU1
perf_trace_init()
  mutex_lock(&event_mutex)
    perf_trace_event_init()
      perf_trace_event_reg()
        total_ref_count == 0
	buf = alloc_percpu()
        perf_trace_buf[i] = buf
        tp_event->class->reg() //fails       perf_kprobe_init()
	goto fail                              perf_trace_event_init()
                                                 perf_trace_event_reg()
        fail:
	  total_ref_count == 0

                                                   total_ref_count == 0
                                                   buf = alloc_percpu()
                                                   perf_trace_buf[i] = buf
                                                   tp_event->class->reg()
                                                   total_ref_count++

          free_percpu(perf_trace_buf[i])
          perf_trace_buf[i] = NULL

Any subsequent call to perf_trace_event_reg() will observe total_ref_count > 0,
causing the perf_trace_buf to be always NULL. This can result in perf_trace_buf
getting accessed from perf_trace_buf_alloc() without being initialized. Acquiring
event_mutex in perf_kprobe_init() before calling perf_trace_event_init() should
fix this race.

The race caused the following bug:

 Unable to handle kernel paging request at virtual address 0000003106f2003c
 Mem abort info:
   ESR = 0x96000045
   Exception class = DABT (current EL), IL = 32 bits
   SET = 0, FnV = 0
   EA = 0, S1PTW = 0
 Data abort info:
   ISV = 0, ISS = 0x00000045
   CM = 0, WnR = 1
 user pgtable: 4k pages, 39-bit VAs, pgdp = ffffffc034b9b000
 [0000003106f2003c] pgd=0000000000000000, pud=0000000000000000
 Internal error: Oops: 96000045 [#1] PREEMPT SMP
 Process syz-executor (pid: 18393, stack limit = 0xffffffc093190000)
 pstate: 80400005 (Nzcv daif +PAN -UAO)
 pc : __memset+0x20/0x1ac
 lr : memset+0x3c/0x50
 sp : ffffffc09319fc50

  __memset+0x20/0x1ac
  perf_trace_buf_alloc+0x140/0x1a0
  perf_trace_sys_enter+0x158/0x310
  syscall_trace_enter+0x348/0x7c0
  el0_svc_common+0x11c/0x368
  el0_svc_handler+0x12c/0x198
  el0_svc+0x8/0xc

Ramdumps showed the following:
  total_ref_count = 3
  perf_trace_buf = (
      0x0 -> NULL,
      0x0 -> NULL,
      0x0 -> NULL,
      0x0 -> NULL)

Link: http://lkml.kernel.org/r/1571120245-4186-1-git-send-email-prsood@codeaurora.org

Cc: stable@vger.kernel.org
Fixes: e12f03d703 ("perf/core: Implement the 'perf_kprobe' PMU")
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Prateek Sood <prsood@codeaurora.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-29 09:20:03 +01:00
Greg Kroah-Hartman
d8a623cfbb This is the 4.19.80 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl2o0vkACgkQONu9yGCS
 aT50rQ//So/ShGy5+D6cmsPVbd8p/9X0fM5D6VjgJ2pj+HbalxW7JhJ0tyVdfkO1
 AS6p/24bmUMWI3pxJBbJjfggbyleV2UFqlHIei+SjfHd0sghZ+E/XY7mLdcKvx0a
 dGdXuxF+enb18pNiUKUrJUgqksgfO40yMXyZhjGf5A+/JmYsNaJhkyCWgPfGIB5i
 YuowOWC4Rkds/CQxyRSRJl+YSQWh8j7Ke0tdjhMQxnmyzFD0wcE5vUtq2vIP7yxO
 ypPrz9zWTase3y1yCcPsXd0m4Ji1VpF99hlgAr0HLFNcZn2kNYFpyblfOrI/zfoK
 RqUJgVVlZaWvhMOrueQO+XbebXdCWTJHiNTUDxIFakEAPNz+XkTQQf6LvzOjcFxB
 oLHnp1qBCn72y6o6Q3XmauFcmYBokyfBvXDAJsXYr+X5B4akn/fpyzzBCInX0h+r
 og5zpLbXDLszG3j76TPSpcjd+t4xqMy+MG+jkH/mLtMAFyaVi2sfMzsZJAQCACr2
 wNHRFQQGjDmQjovkwSRYENQBUuITSj+VrBUD0M7lnfA/Fni3BAJaxY5I6WeEvbeW
 ejzPVFZB8dfEy7hAKKiVEuI8/akcp8MUXfLJOfTxytLIpYllOBoVC4LtjgO5FYu3
 grSbRuowjrlUCtnCU9H18avLE1ScFFEGTmPOqI6xDqKiZf59QsQ=
 =sKVA
 -----END PGP SIGNATURE-----

Merge 4.19.80 into android-4.19

Changes in 4.19.80
	panic: ensure preemption is disabled during panic()
	f2fs: use EINVAL for superblock with invalid magic
	USB: rio500: Remove Rio 500 kernel driver
	USB: yurex: Don't retry on unexpected errors
	USB: yurex: fix NULL-derefs on disconnect
	USB: usb-skeleton: fix runtime PM after driver unbind
	USB: usb-skeleton: fix NULL-deref on disconnect
	xhci: Fix false warning message about wrong bounce buffer write length
	xhci: Prevent device initiated U1/U2 link pm if exit latency is too long
	xhci: Check all endpoints for LPM timeout
	xhci: Fix USB 3.1 capability detection on early xHCI 1.1 spec based hosts
	usb: xhci: wait for CNR controller not ready bit in xhci resume
	xhci: Prevent deadlock when xhci adapter breaks during init
	xhci: Increase STS_SAVE timeout in xhci_suspend()
	USB: adutux: fix use-after-free on disconnect
	USB: adutux: fix NULL-derefs on disconnect
	USB: adutux: fix use-after-free on release
	USB: iowarrior: fix use-after-free on disconnect
	USB: iowarrior: fix use-after-free on release
	USB: iowarrior: fix use-after-free after driver unbind
	USB: usblp: fix runtime PM after driver unbind
	USB: chaoskey: fix use-after-free on release
	USB: ldusb: fix NULL-derefs on driver unbind
	serial: uartlite: fix exit path null pointer
	USB: serial: keyspan: fix NULL-derefs on open() and write()
	USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20
	USB: serial: option: add Telit FN980 compositions
	USB: serial: option: add support for Cinterion CLS8 devices
	USB: serial: fix runtime PM after driver unbind
	USB: usblcd: fix I/O after disconnect
	USB: microtek: fix info-leak at probe
	USB: dummy-hcd: fix power budget for SuperSpeed mode
	usb: renesas_usbhs: gadget: Do not discard queues in usb_ep_set_{halt,wedge}()
	usb: renesas_usbhs: gadget: Fix usb_ep_set_{halt,wedge}() behavior
	USB: legousbtower: fix slab info leak at probe
	USB: legousbtower: fix deadlock on disconnect
	USB: legousbtower: fix potential NULL-deref on disconnect
	USB: legousbtower: fix open after failed reset request
	USB: legousbtower: fix use-after-free on release
	mei: me: add comet point (lake) LP device ids
	mei: avoid FW version request on Ibex Peak and earlier
	gpio: eic: sprd: Fix the incorrect EIC offset when toggling
	Staging: fbtft: fix memory leak in fbtft_framebuffer_alloc
	staging: vt6655: Fix memory leak in vt6655_probe
	iio: adc: hx711: fix bug in sampling of data
	iio: adc: ad799x: fix probe error handling
	iio: adc: axp288: Override TS pin bias current for some models
	iio: light: opt3001: fix mutex unlock race
	efivar/ssdt: Don't iterate over EFI vars if no SSDT override was specified
	perf llvm: Don't access out-of-scope array
	perf inject jit: Fix JIT_CODE_MOVE filename
	blk-wbt: fix performance regression in wbt scale_up/scale_down
	CIFS: Gracefully handle QueryInfo errors during open
	CIFS: Force revalidate inode when dentry is stale
	CIFS: Force reval dentry if LOOKUP_REVAL flag is set
	kernel/sysctl.c: do not override max_threads provided by userspace
	mm/vmpressure.c: fix a signedness bug in vmpressure_register_event()
	firmware: google: increment VPD key_len properly
	gpiolib: don't clear FLAG_IS_OUT when emulating open-drain/open-source
	iio: adc: stm32-adc: move registers definitions
	iio: adc: stm32-adc: fix a race when using several adcs with dma and irq
	cifs: use cifsInodeInfo->open_file_lock while iterating to avoid a panic
	btrfs: fix incorrect updating of log root tree
	btrfs: fix uninitialized ret in ref-verify
	NFS: Fix O_DIRECT accounting of number of bytes read/written
	MIPS: Disable Loongson MMI instructions for kernel build
	MIPS: elf_hwcap: Export userspace ASEs
	ACPICA: ACPI 6.3: PPTT add additional fields in Processor Structure Flags
	ACPI/PPTT: Add support for ACPI 6.3 thread flag
	arm64: topology: Use PPTT to determine if PE is a thread
	Fix the locking in dcache_readdir() and friends
	media: stkwebcam: fix runtime PM after driver unbind
	arm64/sve: Fix wrong free for task->thread.sve_state
	tracing/hwlat: Report total time spent in all NMIs during the sample
	tracing/hwlat: Don't ignore outer-loop duration when calculating max_latency
	ftrace: Get a reference counter for the trace_array on filter files
	tracing: Get trace_array reference for available_tracers files
	hwmon: Fix HWMON_P_MIN_ALARM mask
	x86/asm: Fix MWAITX C-state hint value
	PCI: vmd: Fix config addressing when using bus offsets
	perf/hw_breakpoint: Fix arch_hw_breakpoint use-before-initialization
	Linux 4.19.80

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8ef1835585f79b752712a835852a4bc960ae3b97
2019-10-17 15:33:07 -07:00
Steven Rostedt (VMware)
b9040fab5f tracing: Get trace_array reference for available_tracers files
commit 194c2c74f5 upstream.

As instances may have different tracers available, we need to look at the
trace_array descriptor that shows the list of the available tracers for the
instance. But there's a race between opening the file and an admin
deleting the instance. The trace_array_get() needs to be called before
accessing the trace_array.

Cc: stable@vger.kernel.org
Fixes: 607e2ea167 ("tracing: Set up infrastructure to allow tracers for instances")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-17 13:45:41 -07:00
Steven Rostedt (VMware)
a6c9fb2c2c ftrace: Get a reference counter for the trace_array on filter files
commit 9ef16693af upstream.

The ftrace set_ftrace_filter and set_ftrace_notrace files are specific for
an instance now. They need to take a reference to the instance otherwise
there could be a race between accessing the files and deleting the instance.

It wasn't until the :mod: caching where these file operations started
referencing the trace_array directly.

Cc: stable@vger.kernel.org
Fixes: 673feb9d76 ("ftrace: Add :mod: caching infrastructure to trace_array")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-17 13:45:40 -07:00
Srivatsa S. Bhat (VMware)
b7f758631d tracing/hwlat: Don't ignore outer-loop duration when calculating max_latency
commit fc64e4ad80 upstream.

max_latency is intended to record the maximum ever observed hardware
latency, which may occur in either part of the loop (inner/outer). So
we need to also consider the outer-loop sample when updating
max_latency.

Link: http://lkml.kernel.org/r/157073345463.17189.18124025522664682811.stgit@srivatsa-ubuntu

Fixes: e7c15cd8a1 ("tracing: Added hardware latency tracer")
Cc: stable@vger.kernel.org
Signed-off-by: Srivatsa S. Bhat (VMware) <srivatsa@csail.mit.edu>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-17 13:45:39 -07:00
Srivatsa S. Bhat (VMware)
6271cbff93 tracing/hwlat: Report total time spent in all NMIs during the sample
commit 98dc19c114 upstream.

nmi_total_ts is supposed to record the total time spent in *all* NMIs
that occur on the given CPU during the (active portion of the)
sampling window. However, the code seems to be overwriting this
variable for each NMI, thereby only recording the time spent in the
most recent NMI. Fix it by accumulating the duration instead.

Link: http://lkml.kernel.org/r/157073343544.17189.13911783866738671133.stgit@srivatsa-ubuntu

Fixes: 7b2c862501 ("tracing: Add NMI tracing in hwlat detector")
Cc: stable@vger.kernel.org
Signed-off-by: Srivatsa S. Bhat (VMware) <srivatsa@csail.mit.edu>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-17 13:45:38 -07:00
Greg Kroah-Hartman
ef55d5261c This is the 4.19.79 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl2grBgACgkQONu9yGCS
 aT6xRBAA0pTW2W/VvzBHBLeVlmNtwQZb8x7civVb72iZkltKR9tTPim90PULpz/P
 iO7kh8KqkgVUqdgBE0VzkHGWUSThggfSTQiqzCqOgTwV8WQWqSF8ET0HU8zbglYB
 5pXSojoRYmurGVznd4Ll6aWa5brXIKwf1mDSrFHagOyOLxQmyggHaTRSLx36BSfj
 gunE2ideB1oTaPmd/2aTI03CU3jRwXmowe8rZIDa8pJEpplZPFdk0YOPXg2t6uRI
 bjJGO8bhfR/14r/3h76IwsEiVVXIcCeEVm0fos/H6NUypedfi7jlT0Ldzg1/zZti
 mUMkbPGHcJbOWfBYPQq8xQzviCa+MFraA4Tek5h/Lf7kf3NpjE20AnH3pb9TaqQf
 mJYUGziCoOOOz8k+0eNtIjIZiCysOnf9sI5rGhMYb9qfZoZGG6RiitqyVYNa+rzJ
 wvIUQZ4vSnYmQMAXqxyayfSZvFbMxv6pAdeH0NrXVRgFF6dnKG9TSsCnIuQaJxAE
 OQRaYEJktMUBs81hS0IjnJNDFLW3r++s87xEYvCt4L7XGSrxMJ3jW6xLZlmET68G
 4UIddJ81zIuqpGY1qoWdWZAp3nfRfSX4ehOnoNmIDyC9pRhiCKc+N6j5rX8gBNO/
 SO8YOaNf9RTphhEG6Op7u4ZbU+UR4pYP+rjKveyT2HKPH6D/Tv0=
 =wt6H
 -----END PGP SIGNATURE-----

Merge 4.19.79 into android-4.19

Changes in 4.19.79
	s390/process: avoid potential reading of freed stack
	KVM: s390: Test for bad access register and size at the start of S390_MEM_OP
	s390/topology: avoid firing events before kobjs are created
	s390/cio: exclude subchannels with no parent from pseudo check
	KVM: PPC: Book3S HV: Fix race in re-enabling XIVE escalation interrupts
	KVM: PPC: Book3S HV: Check for MMU ready on piggybacked virtual cores
	KVM: PPC: Book3S HV: Don't lose pending doorbell request on migration on P9
	KVM: X86: Fix userspace set invalid CR4
	KVM: nVMX: handle page fault in vmread fix
	nbd: fix max number of supported devs
	PM / devfreq: tegra: Fix kHz to Hz conversion
	ASoC: Define a set of DAPM pre/post-up events
	ASoC: sgtl5000: Improve VAG power and mute control
	powerpc/mce: Fix MCE handling for huge pages
	powerpc/mce: Schedule work from irq_work
	powerpc/powernv: Restrict OPAL symbol map to only be readable by root
	powerpc/powernv/ioda: Fix race in TCE level allocation
	powerpc/book3s64/mm: Don't do tlbie fixup for some hardware revisions
	can: mcp251x: mcp251x_hw_reset(): allow more time after a reset
	tools lib traceevent: Fix "robust" test of do_generate_dynamic_list_file
	crypto: qat - Silence smp_processor_id() warning
	crypto: skcipher - Unmap pages after an external error
	crypto: cavium/zip - Add missing single_release()
	crypto: caam - fix concurrency issue in givencrypt descriptor
	crypto: ccree - account for TEE not ready to report
	crypto: ccree - use the full crypt length value
	MIPS: Treat Loongson Extensions as ASEs
	power: supply: sbs-battery: use correct flags field
	power: supply: sbs-battery: only return health when battery present
	tracing: Make sure variable reference alias has correct var_ref_idx
	usercopy: Avoid HIGHMEM pfn warning
	timer: Read jiffies once when forwarding base clk
	PCI: vmd: Fix shadow offsets to reflect spec changes
	PCI: Restore Resizable BAR size bits correctly for 1MB BARs
	watchdog: imx2_wdt: fix min() calculation in imx2_wdt_set_timeout
	perf stat: Fix a segmentation fault when using repeat forever
	drm/omap: fix max fclk divider for omap36xx
	drm/msm/dsi: Fix return value check for clk_get_parent
	drm/nouveau/kms/nv50-: Don't create MSTMs for eDP connectors
	drm/i915/gvt: update vgpu workload head pointer correctly
	mmc: sdhci: improve ADMA error reporting
	mmc: sdhci-of-esdhc: set DMA snooping based on DMA coherence
	Revert "locking/pvqspinlock: Don't wait if vCPU is preempted"
	xen/xenbus: fix self-deadlock after killing user process
	ieee802154: atusb: fix use-after-free at disconnect
	s390/cio: avoid calling strlen on null pointer
	cfg80211: initialize on-stack chandefs
	arm64: cpufeature: Detect SSBS and advertise to userspace
	ima: always return negative code for error
	ima: fix freeing ongoing ahash_request
	fs: nfs: Fix possible null-pointer dereferences in encode_attrs()
	9p: Transport error uninitialized
	9p: avoid attaching writeback_fid on mmap with type PRIVATE
	xen/pci: reserve MCFG areas earlier
	ceph: fix directories inode i_blkbits initialization
	ceph: reconnect connection if session hang in opening state
	watchdog: aspeed: Add support for AST2600
	netfilter: nf_tables: allow lookups in dynamic sets
	drm/amdgpu: Fix KFD-related kernel oops on Hawaii
	drm/amdgpu: Check for valid number of registers to read
	pNFS: Ensure we do clear the return-on-close layout stateid on fatal errors
	pwm: stm32-lp: Add check in case requested period cannot be achieved
	x86/purgatory: Disable the stackleak GCC plugin for the purgatory
	ntb: point to right memory window index
	thermal: Fix use-after-free when unregistering thermal zone device
	thermal_hwmon: Sanitize thermal_zone type
	libnvdimm/region: Initialize bad block for volatile namespaces
	fuse: fix memleak in cuse_channel_open
	libnvdimm/nfit_test: Fix acpi_handle redefinition
	sched/membarrier: Call sync_core only before usermode for same mm
	sched/membarrier: Fix private expedited registration check
	sched/core: Fix migration to invalid CPU in __set_cpus_allowed_ptr()
	perf build: Add detection of java-11-openjdk-devel package
	kernel/elfcore.c: include proper prototypes
	perf unwind: Fix libunwind build failure on i386 systems
	nfp: flower: fix memory leak in nfp_flower_spawn_vnic_reprs
	drm/radeon: Bail earlier when radeon.cik_/si_support=0 is passed
	KVM: PPC: Book3S HV: XIVE: Free escalation interrupts before disabling the VP
	KVM: nVMX: Fix consistency check on injected exception error code
	nbd: fix crash when the blksize is zero
	powerpc/pseries: Fix cpu_hotplug_lock acquisition in resize_hpt()
	powerpc/book3s64/radix: Rename CPU_FTR_P9_TLBIE_BUG feature flag
	tools lib traceevent: Do not free tep->cmdlines in add_new_comm() on failure
	tick: broadcast-hrtimer: Fix a race in bc_set_next
	perf tools: Fix segfault in cpu_cache_level__read()
	perf stat: Reset previous counts on repeat with interval
	riscv: Avoid interrupts being erroneously enabled in handle_exception()
	arm64: ssbd: Add support for PSTATE.SSBS rather than trapping to EL3
	KVM: arm64: Set SCTLR_EL2.DSSBS if SSBD is forcefully disabled and !vhe
	arm64: docs: Document SSBS HWCAP
	arm64: fix SSBS sanitization
	arm64: Add sysfs vulnerability show for spectre-v1
	arm64: add sysfs vulnerability show for meltdown
	arm64: enable generic CPU vulnerabilites support
	arm64: Always enable ssb vulnerability detection
	arm64: Provide a command line to disable spectre_v2 mitigation
	arm64: Advertise mitigation of Spectre-v2, or lack thereof
	arm64: Always enable spectre-v2 vulnerability detection
	arm64: add sysfs vulnerability show for spectre-v2
	arm64: add sysfs vulnerability show for speculative store bypass
	arm64: ssbs: Don't treat CPUs with SSBS as unaffected by SSB
	arm64: Force SSBS on context switch
	arm64: Use firmware to detect CPUs that are not affected by Spectre-v2
	arm64/speculation: Support 'mitigations=' cmdline option
	vfs: Fix EOVERFLOW testing in put_compat_statfs64
	coresight: etm4x: Use explicit barriers on enable/disable
	staging: erofs: fix an error handling in erofs_readdir()
	staging: erofs: some compressed cluster should be submitted for corrupted images
	staging: erofs: add two missing erofs_workgroup_put for corrupted images
	staging: erofs: detect potential multiref due to corrupted images
	cfg80211: add and use strongly typed element iteration macros
	cfg80211: Use const more consistently in for_each_element macros
	nl80211: validate beacon head
	Linux 4.19.79

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ie4f85994b5f3e53658c42833d0dc712575d0902e
2019-10-11 19:13:57 +02:00
Tom Zanussi
e010c98351 tracing: Make sure variable reference alias has correct var_ref_idx
commit 17f8607a16 upstream.

Original changelog from Steve Rostedt (except last sentence which
explains the problem, and the Fixes: tag):

I performed a three way histogram with the following commands:

echo 'irq_lat u64 lat pid_t pid' > synthetic_events
echo 'wake_lat u64 lat u64 irqlat pid_t pid' >> synthetic_events
echo 'hist:keys=common_pid:irqts=common_timestamp.usecs if function == 0xffffffff81200580' > events/timer/hrtimer_start/trigger
echo 'hist:keys=common_pid:lat=common_timestamp.usecs-$irqts:onmatch(timer.hrtimer_start).irq_lat($lat,pid) if common_flags & 1' > events/sched/sched_waking/trigger
echo 'hist:keys=pid:wakets=common_timestamp.usecs,irqlat=lat' > events/synthetic/irq_lat/trigger
echo 'hist:keys=next_pid:lat=common_timestamp.usecs-$wakets,irqlat=$irqlat:onmatch(synthetic.irq_lat).wake_lat($lat,$irqlat,next_pid)' > events/sched/sched_switch/trigger
echo 1 > events/synthetic/wake_lat/enable

Basically I wanted to see:

 hrtimer_start (calling function tick_sched_timer)

Note:

  # grep tick_sched_timer /proc/kallsyms
ffffffff81200580 t tick_sched_timer

And save the time of that, and then record sched_waking if it is called
in interrupt context and with the same pid as the hrtimer_start, it
will record the latency between that and the waking event.

I then look at when the task that is woken is scheduled in, and record
the latency between the wakeup and the task running.

At the end, the wake_lat synthetic event will show the wakeup to
scheduled latency, as well as the irq latency in from hritmer_start to
the wakeup. The problem is that I found this:

          <idle>-0     [007] d...   190.485261: wake_lat: lat=27 irqlat=190485230 pid=698
          <idle>-0     [005] d...   190.485283: wake_lat: lat=40 irqlat=190485239 pid=10
          <idle>-0     [002] d...   190.488327: wake_lat: lat=56 irqlat=190488266 pid=335
          <idle>-0     [005] d...   190.489330: wake_lat: lat=64 irqlat=190489262 pid=10
          <idle>-0     [003] d...   190.490312: wake_lat: lat=43 irqlat=190490265 pid=77
          <idle>-0     [005] d...   190.493322: wake_lat: lat=54 irqlat=190493262 pid=10
          <idle>-0     [005] d...   190.497305: wake_lat: lat=35 irqlat=190497267 pid=10
          <idle>-0     [005] d...   190.501319: wake_lat: lat=50 irqlat=190501264 pid=10

The irqlat seemed quite large! Investigating this further, if I had
enabled the irq_lat synthetic event, I noticed this:

          <idle>-0     [002] d.s.   249.429308: irq_lat: lat=164968 pid=335
          <idle>-0     [002] d...   249.429369: wake_lat: lat=55 irqlat=249429308 pid=335

Notice that the timestamp of the irq_lat "249.429308" is awfully
similar to the reported irqlat variable. In fact, all instances were
like this. It appeared that:

  irqlat=$irqlat

Wasn't assigning the old $irqlat to the new irqlat variable, but
instead was assigning the $irqts to it.

The issue is that assigning the old $irqlat to the new irqlat variable
creates a variable reference alias, but the alias creation code
forgets to make sure the alias uses the same var_ref_idx to access the
reference.

Link: http://lkml.kernel.org/r/1567375321.5282.12.camel@kernel.org

Cc: Linux Trace Devel <linux-trace-devel@vger.kernel.org>
Cc: linux-rt-users <linux-rt-users@vger.kernel.org>
Cc: stable@vger.kernel.org
Fixes: 7e8b88a30b ("tracing: Add hist trigger support for variable reference aliases")
Reported-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Tom Zanussi <zanussi@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-11 18:20:57 +02:00
Greg Kroah-Hartman
6b1f307bd0 This is the 4.19.70 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl1yF0AACgkQONu9yGCS
 aT64ew/6AzJDRMcmnx1COeRP8tfQ5A8ghjnp6REEca1MYJWjDlqd0X+EMd/7zorZ
 YkBzb1ND1c/9KeGQzdx8lJ5lcNRVJcD7tT6irT5zMnBcyR9uPamAaVgmVHXxuorK
 el4nvX9g/MxBLsuqLHxGr5pNXi7mHu6zfXyQ86TJzlez7yHlPuiJb8bDpHnCRJ1P
 n/MemPq/nQgC5jPBQRhT+IpqC1MTIHNhRaHHg/5Gdrrz+eVumnk+1zbWqtBRuJKS
 qS7RL1pI0Su00i5bY1r76iSkoRkGw9SoeIgz3sycbtAvGo9TI16/hZPvWAsYOAjL
 2DQS0rMPSnM4QV0odbUImFt86f0YJiAL7xYS8EYCc4GX/eLbNRtP8yLq+8rlo4Oa
 36HbiNhGSEjRxenfVRUD/STgBYzfVeQOMEyFJNRtfNDP/l66sLk/pEOEd83j06H4
 G87BJgKFC35dv5QrbCmJO8P1IXLs5QaChD3dL6R9/hbvCU2A/MOqhPL16JCXWA20
 +hOWn8ryrtBa5Dt0avAkrrnUNC8cVWyD44uAm+Hu/49CZpkTasZMB7Z81VSIsuvO
 xoT1Jx0J1W/LtHwCghSkui/fjQjVpkP3xnB7zVGem73Mpcm68g6mLajKaUrLnJHp
 /sz2mppF7gZob43anTtUhSV9OvrzqftkR+iFg3rCKSJyQE1o48o=
 =hMvg
 -----END PGP SIGNATURE-----

Merge 4.19.70 into android-4.19

Changes in 4.19.70
	dmaengine: ste_dma40: fix unneeded variable warning
	nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns
	afs: Fix the CB.ProbeUuid service handler to reply correctly
	afs: Fix loop index mixup in afs_deliver_vl_get_entry_by_name_u()
	fs: afs: Fix a possible null-pointer dereference in afs_put_read()
	afs: Only update d_fsdata if different in afs_d_revalidate()
	nvmet-loop: Flush nvme_delete_wq when removing the port
	nvme: fix a possible deadlock when passthru commands sent to a multipath device
	nvme-pci: Fix async probe remove race
	soundwire: cadence_master: fix register definition for SLAVE_STATE
	soundwire: cadence_master: fix definitions for INTSTAT0/1
	auxdisplay: panel: need to delete scan_timer when misc_register fails in panel_attach
	dmaengine: stm32-mdma: Fix a possible null-pointer dereference in stm32_mdma_irq_handler()
	omap-dma/omap_vout_vrfb: fix off-by-one fi value
	iommu/dma: Handle SG length overflow better
	usb: gadget: composite: Clear "suspended" on reset/disconnect
	usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt
	xen/blkback: fix memory leaks
	arm64: cpufeature: Don't treat granule sizes as strict
	i2c: rcar: avoid race when unregistering slave client
	i2c: emev2: avoid race when unregistering slave client
	drm/ast: Fixed reboot test may cause system hanged
	usb: host: fotg2: restart hcd after port reset
	tools: hv: fixed Python pep8/flake8 warnings for lsvmbus
	tools: hv: fix KVP and VSS daemons exit code
	drm/i915: fix broadwell EU computation
	watchdog: bcm2835_wdt: Fix module autoload
	drm/bridge: tfp410: fix memleak in get_modes()
	scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value
	drm/tilcdc: Register cpufreq notifier after we have initialized crtc
	net/tls: Fixed return value when tls_complete_pending_work() fails
	net/tls: swap sk_write_space on close
	net: tls, fix sk_write_space NULL write when tx disabled
	ipv6/addrconf: allow adding multicast addr if IFA_F_MCAUTOJOIN is set
	ipv6: Default fib6_type to RTN_UNICAST when not set
	net/smc: make sure EPOLLOUT is raised
	tcp: make sure EPOLLOUT wont be missed
	ipv4/icmp: fix rt dst dev null pointer dereference
	mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n
	ALSA: usb-audio: Check mixer unit bitmap yet more strictly
	ALSA: line6: Fix memory leak at line6_init_pcm() error path
	ALSA: hda - Fixes inverted Conexant GPIO mic mute led
	ALSA: seq: Fix potential concurrent access to the deleted pool
	ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate()
	ALSA: usb-audio: Add implicit fb quirk for Behringer UFX1604
	kvm: x86: skip populating logical dest map if apic is not sw enabled
	KVM: x86: Don't update RIP or do single-step on faulting emulation
	uprobes/x86: Fix detection of 32-bit user mode
	x86/apic: Do not initialize LDR and DFR for bigsmp
	x86/apic: Include the LDR when clearing out APIC registers
	ftrace: Fix NULL pointer dereference in t_probe_next()
	ftrace: Check for successful allocation of hash
	ftrace: Check for empty hash and comment the race with registering probes
	usb-storage: Add new JMS567 revision to unusual_devs
	USB: cdc-wdm: fix race between write and disconnect due to flag abuse
	usb: hcd: use managed device resources
	usb: chipidea: udc: don't do hardware access if gadget has stopped
	usb: host: ohci: fix a race condition between shutdown and irq
	usb: host: xhci: rcar: Fix typo in compatible string matching
	USB: storage: ums-realtek: Update module parameter description for auto_delink_en
	USB: storage: ums-realtek: Whitelist auto-delink support
	mei: me: add Tiger Lake point LP device ID
	mmc: sdhci-of-at91: add quirk for broken HS200
	mmc: core: Fix init of SD cards reporting an invalid VDD range
	stm class: Fix a double free of stm_source_device
	intel_th: pci: Add support for another Lewisburg PCH
	intel_th: pci: Add Tiger Lake support
	typec: tcpm: fix a typo in the comparison of pdo_max_voltage
	fsi: scom: Don't abort operations for minor errors
	lib: logic_pio: Fix RCU usage
	lib: logic_pio: Avoid possible overlap for unregistering regions
	lib: logic_pio: Add logic_pio_unregister_range()
	drm/amdgpu: Add APTX quirk for Dell Latitude 5495
	drm/i915: Don't deballoon unused ggtt drm_mm_node in linux guest
	drm/i915: Call dma_set_max_seg_size() in i915_driver_hw_probe()
	bus: hisi_lpc: Unregister logical PIO range to avoid potential use-after-free
	bus: hisi_lpc: Add .remove method to avoid driver unbind crash
	VMCI: Release resource if the work is already queued
	crypto: ccp - Ignore unconfigured CCP device on suspend/resume
	Revert "cfg80211: fix processing world regdomain when non modular"
	mac80211: fix possible sta leak
	mac80211: Don't memset RXCB prior to PAE intercept
	mac80211: Correctly set noencrypt for PAE frames
	KVM: PPC: Book3S: Fix incorrect guest-to-user-translation error handling
	KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is long
	KVM: arm/arm64: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI
	NFS: Clean up list moves of struct nfs_page
	NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
	NFS: Pass error information to the pgio error cleanup routine
	NFS: Ensure O_DIRECT reports an error if the bytes read/written is 0
	i2c: piix4: Fix port selection for AMD Family 16h Model 30h
	x86/ptrace: fix up botched merge of spectrev1 fix
	mt76: mt76x0u: do not reset radio on resume
	Revert "ASoC: Fail card instantiation if DAI format setup fails"
	Linux 4.19.70

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I35ff8a403a05a8c66d87cb4b542997e63c422288
2019-09-06 12:08:42 +02:00
Steven Rostedt (VMware)
8ea639525d ftrace: Check for empty hash and comment the race with registering probes
commit 372e0d01da upstream.

The race between adding a function probe and reading the probes that exist
is very subtle. It needs a comment. Also, the issue can also happen if the
probe has has the EMPTY_HASH as its func_hash.

Cc: stable@vger.kernel.org
Fixes: 7b60f3d876 ("ftrace: Dynamically create the probe ftrace_ops for the trace_array")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-09-06 10:22:13 +02:00
Naveen N. Rao
9d98e0f485 ftrace: Check for successful allocation of hash
commit 5b0022dd32 upstream.

In register_ftrace_function_probe(), we are not checking the return
value of alloc_and_copy_ftrace_hash(). The subsequent call to
ftrace_match_records() may end up dereferencing the same. Add a check to
ensure this doesn't happen.

Link: http://lkml.kernel.org/r/26e92574f25ad23e7cafa3cf5f7a819de1832cbe.1562249521.git.naveen.n.rao@linux.vnet.ibm.com

Cc: stable@vger.kernel.org
Fixes: 1ec3a81a0c ("ftrace: Have each function probe use its own ftrace_ops")
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-09-06 10:22:13 +02:00
Naveen N. Rao
f184b16748 ftrace: Fix NULL pointer dereference in t_probe_next()
commit 7bd46644ea upstream.

LTP testsuite on powerpc results in the below crash:

  Unable to handle kernel paging request for data at address 0x00000000
  Faulting instruction address: 0xc00000000029d800
  Oops: Kernel access of bad area, sig: 11 [#1]
  LE SMP NR_CPUS=2048 NUMA PowerNV
  ...
  CPU: 68 PID: 96584 Comm: cat Kdump: loaded Tainted: G        W
  NIP:  c00000000029d800 LR: c00000000029dac4 CTR: c0000000001e6ad0
  REGS: c0002017fae8ba10 TRAP: 0300   Tainted: G        W
  MSR:  9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE>  CR: 28022422  XER: 20040000
  CFAR: c00000000029d90c DAR: 0000000000000000 DSISR: 40000000 IRQMASK: 0
  ...
  NIP [c00000000029d800] t_probe_next+0x60/0x180
  LR [c00000000029dac4] t_mod_start+0x1a4/0x1f0
  Call Trace:
  [c0002017fae8bc90] [c000000000cdbc40] _cond_resched+0x10/0xb0 (unreliable)
  [c0002017fae8bce0] [c0000000002a15b0] t_start+0xf0/0x1c0
  [c0002017fae8bd30] [c0000000004ec2b4] seq_read+0x184/0x640
  [c0002017fae8bdd0] [c0000000004a57bc] sys_read+0x10c/0x300
  [c0002017fae8be30] [c00000000000b388] system_call+0x5c/0x70

The test (ftrace_set_ftrace_filter.sh) is part of ftrace stress tests
and the crash happens when the test does 'cat
$TRACING_PATH/set_ftrace_filter'.

The address points to the second line below, in t_probe_next(), where
filter_hash is dereferenced:
  hash = iter->probe->ops.func_hash->filter_hash;
  size = 1 << hash->size_bits;

This happens due to a race with register_ftrace_function_probe(). A new
ftrace_func_probe is created and added into the func_probes list in
trace_array under ftrace_lock. However, before initializing the filter,
we drop ftrace_lock, and re-acquire it after acquiring regex_lock. If
another process is trying to read set_ftrace_filter, it will be able to
acquire ftrace_lock during this window and it will end up seeing a NULL
filter_hash.

Fix this by just checking for a NULL filter_hash in t_probe_next(). If
the filter_hash is NULL, then this probe is just being added and we can
simply return from here.

Link: http://lkml.kernel.org/r/05e021f757625cbbb006fad41380323dbe4e3b43.1562249521.git.naveen.n.rao@linux.vnet.ibm.com

Cc: stable@vger.kernel.org
Fixes: 7b60f3d876 ("ftrace: Dynamically create the probe ftrace_ops for the trace_array")
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-09-06 10:22:12 +02:00
Greg Kroah-Hartman
de4c70d6a9 This is the 4.19.65 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl1Js7MACgkQONu9yGCS
 aT4PQxAAo7xa4kYvDxc1RjUY/yIlp6lQ3rpYAAfZB0t8vN+dqivnJZ7m6JHeWX1Y
 CMcxg85zxLVFeuiXdP821Zj68AB5zqlWMhX0bXm2lhw/Eo9+XHzXtnrLZHhz0/Xd
 M5cmfIPmoyPCUQQfzSfUMvch+ZpwzEt5op5pUfSjckSpjHQZ0HFj1WJ4D8Hn9jAJ
 y4+DAKDZgtqhb3GvpS6MoVnBJgcPk9+mBiDkSb12L392+FvHqfeBi3tDRhvyiZAO
 iJrk747SPds7NlNmuRnj7YyUSDhBzaceRCz0Jsv9FT5EKXoPErXdsL3Bkfa9TREM
 pH0OaMgNr6WSXLO9qIMcfxMeaKVIvIbotqBTkBTzhEAGPkHA75dhi0lpixXXFExg
 MaqhLfmHO0dOEr9FrvYGe7f2wUA1Rdw/qRTM3KPEKmHxMqBS7eufIWMHwie1n9Oe
 cYoP6UkxUIvhUyFV2BlMRFdMfaDbtR0iqy8Dqh36NISD6PAYaUGSoVeSO1fEg4Jy
 5GgrKPg6rcz2XNY2cVbsm2zLpqY4dY58SFK9ORfuULdKUQvScvFGrdSSW0CgX+uc
 F/5NmPutUoboHVxFraDPx7yo46pHf1RW0Me4xZ0aJ3e9ituLAN4fmJ9u46nofb5M
 thPelQlMVt30O41uViJ0ADkOjCsiBr3AxOFvc76Ct9Q/BJVxhLk=
 =JVBv
 -----END PGP SIGNATURE-----

Merge 4.19.65 into android-4.19

Changes in 4.19.65
	ARM: riscpc: fix DMA
	ARM: dts: rockchip: Make rk3288-veyron-minnie run at hs200
	ARM: dts: rockchip: Make rk3288-veyron-mickey's emmc work again
	ARM: dts: rockchip: Mark that the rk3288 timer might stop in suspend
	ftrace: Enable trampoline when rec count returns back to one
	dmaengine: tegra-apb: Error out if DMA_PREP_INTERRUPT flag is unset
	arm64: dts: rockchip: fix isp iommu clocks and power domain
	kernel/module.c: Only return -EEXIST for modules that have finished loading
	firmware/psci: psci_checker: Park kthreads before stopping them
	MIPS: lantiq: Fix bitfield masking
	dmaengine: rcar-dmac: Reject zero-length slave DMA requests
	clk: tegra210: fix PLLU and PLLU_OUT1
	fs/adfs: super: fix use-after-free bug
	clk: sprd: Add check for return value of sprd_clk_regmap_init()
	btrfs: fix minimum number of chunk errors for DUP
	btrfs: qgroup: Don't hold qgroup_ioctl_lock in btrfs_qgroup_inherit()
	cifs: Fix a race condition with cifs_echo_request
	ceph: fix improper use of smp_mb__before_atomic()
	ceph: return -ERANGE if virtual xattr value didn't fit in buffer
	ACPI: blacklist: fix clang warning for unused DMI table
	scsi: zfcp: fix GCC compiler warning emitted with -Wmaybe-uninitialized
	perf version: Fix segfault due to missing OPT_END()
	x86: kvm: avoid constant-conversion warning
	ACPI: fix false-positive -Wuninitialized warning
	be2net: Signal that the device cannot transmit during reconfiguration
	x86/apic: Silence -Wtype-limits compiler warnings
	x86: math-emu: Hide clang warnings for 16-bit overflow
	mm/cma.c: fail if fixed declaration can't be honored
	lib/test_overflow.c: avoid tainting the kernel and fix wrap size
	lib/test_string.c: avoid masking memset16/32/64 failures
	coda: add error handling for fget
	coda: fix build using bare-metal toolchain
	uapi linux/coda_psdev.h: move upc_req definition from uapi to kernel side headers
	drivers/rapidio/devices/rio_mport_cdev.c: NUL terminate some strings
	ipc/mqueue.c: only perform resource calculation if user valid
	mlxsw: spectrum_dcb: Configure DSCP map as the last rule is removed
	xen/pv: Fix a boot up hang revealed by int3 self test
	x86/kvm: Don't call kvm_spurious_fault() from .fixup
	x86/paravirt: Fix callee-saved function ELF sizes
	x86, boot: Remove multiple copy of static function sanitize_boot_params()
	drm/nouveau: fix memory leak in nouveau_conn_reset()
	kconfig: Clear "written" flag to avoid data loss
	kbuild: initialize CLANG_FLAGS correctly in the top Makefile
	Btrfs: fix incremental send failure after deduplication
	Btrfs: fix race leading to fs corruption after transaction abort
	mmc: dw_mmc: Fix occasional hang after tuning on eMMC
	mmc: meson-mx-sdio: Fix misuse of GENMASK macro
	gpiolib: fix incorrect IRQ requesting of an active-low lineevent
	IB/hfi1: Fix Spectre v1 vulnerability
	mtd: rawnand: micron: handle on-die "ECC-off" devices correctly
	selinux: fix memory leak in policydb_init()
	ALSA: hda: Fix 1-minute detection delay when i915 module is not available
	mm: vmscan: check if mem cgroup is disabled or not before calling memcg slab shrinker
	s390/dasd: fix endless loop after read unit address configuration
	cgroup: kselftest: relax fs_spec checks
	parisc: Fix build of compressed kernel even with debug enabled
	drivers/perf: arm_pmu: Fix failure path in PM notifier
	arm64: compat: Allow single-byte watchpoints on all addresses
	arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG}
	nbd: replace kill_bdev() with __invalidate_device() again
	xen/swiotlb: fix condition for calling xen_destroy_contiguous_region()
	IB/mlx5: Fix unreg_umr to ignore the mkey state
	IB/mlx5: Use direct mkey destroy command upon UMR unreg failure
	IB/mlx5: Move MRs to a kernel PD when freeing them to the MR cache
	IB/mlx5: Fix clean_mr() to work in the expected order
	IB/mlx5: Fix RSS Toeplitz setup to be aligned with the HW specification
	IB/hfi1: Check for error on call to alloc_rsm_map_table
	drm/i915/gvt: fix incorrect cache entry for guest page mapping
	eeprom: at24: make spd world-readable again
	ARC: enable uboot support unconditionally
	objtool: Support GCC 9 cold subfunction naming scheme
	gcc-9: properly declare the {pv,hv}clock_page storage
	x86/vdso: Prevent segfaults due to hoisted vclock reads
	scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA
	x86/cpufeatures: Carve out CQM features retrieval
	x86/cpufeatures: Combine word 11 and 12 into a new scattered features word
	x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations
	x86/speculation: Enable Spectre v1 swapgs mitigations
	x86/entry/64: Use JMP instead of JMPQ
	x86/speculation/swapgs: Exclude ATOMs from speculation through SWAPGS
	Documentation: Add swapgs description to the Spectre v1 documentation
	Linux 4.19.65

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iceeabdb164657e0a616db618e6aa8445d56b0dc1
2019-08-06 20:08:18 +02:00
Cheng Jian
f486088d38 ftrace: Enable trampoline when rec count returns back to one
[ Upstream commit a124692b69 ]

Custom trampolines can only be enabled if there is only a single ops
attached to it. If there's only a single callback registered to a function,
and the ops has a trampoline registered for it, then we can call the
trampoline directly. This is very useful for improving the performance of
ftrace and livepatch.

If more than one callback is registered to a function, the general
trampoline is used, and the custom trampoline is not restored back to the
direct call even if all the other callbacks were unregistered and we are
back to one callback for the function.

To fix this, set FTRACE_FL_TRAMP flag if rec count is decremented
to one, and the ops that left has a trampoline.

Testing After this patch :

insmod livepatch_unshare_files.ko
cat /sys/kernel/debug/tracing/enabled_functions

	unshare_files (1) R I	tramp: 0xffffffffc0000000(klp_ftrace_handler+0x0/0xa0) ->ftrace_ops_assist_func+0x0/0xf0

echo unshare_files > /sys/kernel/debug/tracing/set_ftrace_filter
echo function > /sys/kernel/debug/tracing/current_tracer
cat /sys/kernel/debug/tracing/enabled_functions

	unshare_files (2) R I ->ftrace_ops_list_func+0x0/0x150

echo nop > /sys/kernel/debug/tracing/current_tracer
cat /sys/kernel/debug/tracing/enabled_functions

	unshare_files (1) R I	tramp: 0xffffffffc0000000(klp_ftrace_handler+0x0/0xa0) ->ftrace_ops_assist_func+0x0/0xf0

Link: http://lkml.kernel.org/r/1556969979-111047-1-git-send-email-cj.chengjian@huawei.com

Signed-off-by: Cheng Jian <cj.chengjian@huawei.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-08-06 19:06:46 +02:00
Greg Kroah-Hartman
5ad6eeba58 This is the 4.19.58 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl0lmYwACgkQONu9yGCS
 aT4h5w//ZG0BYEwxoa4Qc8rwvncnk78miK/VRH5JVTiToDqTuttHZQoMp+NLD2fQ
 V679f/2+VqEPn8o6yJsrbM8uea0iIratI8U6L2OEt6TKPbar3CPcRUPJeqlPWkej
 tf3qjAtvNNjLcl7xCYt9JNvpF4RwA8rLWWP5hZyYMi7xcMiB0FOriTlVJYHJ0PLK
 Iqg+edkBxKwx7mvFlZnJkT0ln5hCqT4QBq2XrOYGUfy2Ans5Ytg5dhhp41QDD6iu
 oE4mS+fybCzNOR3BWl7pfpeJRg8TKq4XNzYsQr9ftt2e3OZxOi3Jg+RLsgzjJB9P
 1aTsuSzSeMXVGrAwRpBAot7TC+8F88sci0gibh4pg5N0ujGdvRW4gyzYHtdKhsTc
 wmjYMKbAxJWwz0vkRp1aSnUMSRur4Wo3qCWaOWpjkP4xhSBTTER5e5cqeuVSWde5
 FaD8s0yjnQsUaH3oxZ7zDL//MR0N+C4Izs9c2A8HkdksWTdTvI7YX8c766iIZgrm
 JFV0FIZYIHAyuXT04W9n3VSvV4tLS+ouwYZpgG09oK0lBA8NT6RyZWzijY3VE0ed
 Kl+t6iu02qZgZrvnq4pHUVnLQtw7KfyL3mzeljVxEeaTbGODPOJfypY1OMfhWYw+
 dIlmsmfa2aANf5wttl8CjLkAIIG3JmuWO2exMQidvXlGCE+rKVM=
 =u7q2
 -----END PGP SIGNATURE-----

Merge 4.19.58 into android-4.19

Changes in 4.19.58
	Bluetooth: Fix faulty expression for minimum encryption key size check
	block: Fix a NULL pointer dereference in generic_make_request()
	md/raid0: Do not bypass blocking queue entered for raid0 bios
	netfilter: nf_flow_table: ignore DF bit setting
	netfilter: nft_flow_offload: set liberal tracking mode for tcp
	netfilter: nft_flow_offload: don't offload when sequence numbers need adjustment
	netfilter: nft_flow_offload: IPCB is only valid for ipv4 family
	ASoC : cs4265 : readable register too low
	ASoC: ak4458: add return value for ak4458_probe
	ASoC: soc-pcm: BE dai needs prepare when pause release after resume
	ASoC: ak4458: rstn_control - return a non-zero on error only
	spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
	drm/mediatek: fix unbind functions
	drm/mediatek: unbind components in mtk_drm_unbind()
	drm/mediatek: call drm_atomic_helper_shutdown() when unbinding driver
	drm/mediatek: clear num_pipes when unbind driver
	drm/mediatek: call mtk_dsi_stop() after mtk_drm_crtc_atomic_disable()
	ASoC: max98090: remove 24-bit format support if RJ is 0
	ASoC: sun4i-i2s: Fix sun8i tx channel offset mask
	ASoC: sun4i-i2s: Add offset to RX channel select
	x86/CPU: Add more Icelake model numbers
	usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i]
	usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC
	ALSA: hdac: fix memory release for SST and SOF drivers
	SoC: rt274: Fix internal jack assignment in set_jack callback
	scsi: hpsa: correct ioaccel2 chaining
	drm: panel-orientation-quirks: Add quirk for GPD pocket2
	drm: panel-orientation-quirks: Add quirk for GPD MicroPC
	platform/x86: asus-wmi: Only Tell EC the OS will handle display hotkeys from asus_nb_wmi
	platform/x86: intel-vbtn: Report switch events when event wakes device
	platform/x86: mlx-platform: Fix parent device in i2c-mux-reg device registration
	platform/mellanox: mlxreg-hotplug: Add devm_free_irq call to remove flow
	i2c: pca-platform: Fix GPIO lookup code
	cpuset: restore sanity to cpuset_cpus_allowed_fallback()
	scripts/decode_stacktrace.sh: prefix addr2line with $CROSS_COMPILE
	mm/mlock.c: change count_mm_mlocked_page_nr return type
	tracing: avoid build warning with HAVE_NOP_MCOUNT
	module: Fix livepatch/ftrace module text permissions race
	ftrace: Fix NULL pointer dereference in free_ftrace_func_mapper()
	drm/i915/dmc: protect against reading random memory
	ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME
	crypto: user - prevent operating on larval algorithms
	crypto: cryptd - Fix skcipher instance memory leak
	ALSA: seq: fix incorrect order of dest_client/dest_ports arguments
	ALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages
	ALSA: line6: Fix write on zero-sized buffer
	ALSA: usb-audio: fix sign unintended sign extension on left shifts
	ALSA: hda/realtek: Add quirks for several Clevo notebook barebones
	ALSA: hda/realtek - Change front mic location for Lenovo M710q
	lib/mpi: Fix karactx leak in mpi_powm
	fs/userfaultfd.c: disable irqs for fault_pending and event locks
	tracing/snapshot: Resize spare buffer if size changed
	ARM: dts: armada-xp-98dx3236: Switch to armada-38x-uart serial node
	arm64: kaslr: keep modules inside module region when KASAN is enabled
	drm/amd/powerplay: use hardware fan control if no powerplay fan table
	drm/amdgpu/gfx9: use reset default for PA_SC_FIFO_SIZE
	drm/etnaviv: add missing failure path to destroy suballoc
	drm/imx: notify drm core before sending event during crtc disable
	drm/imx: only send event on crtc disable if kept disabled
	ftrace/x86: Remove possible deadlock between register_kprobe() and ftrace_run_update_code()
	mm/vmscan.c: prevent useless kswapd loops
	btrfs: Ensure replaced device doesn't have pending chunk allocation
	tty: rocket: fix incorrect forward declaration of 'rp_init()'
	mlxsw: spectrum: Handle VLAN device unlinking
	net/smc: move unhash before release of clcsock
	media: s5p-mfc: fix incorrect bus assignment in virtual child device
	drm/fb-helper: generic: Don't take module ref for fbcon
	f2fs: don't access node/meta inode mapping after iput
	mac80211: mesh: fix missing unlock on error in table_path_del()
	scsi: tcmu: fix use after free
	selftests: fib_rule_tests: Fix icmp proto with ipv6
	x86/boot/compressed/64: Do not corrupt EDX on EFER.LME=1 setting
	net: hns: Fixes the missing put_device in positive leg for roce reset
	ALSA: hda: Initialize power_state field properly
	rds: Fix warning.
	ip6: fix skb leak in ip6frag_expire_frag_queue()
	netfilter: ipv6: nf_defrag: fix leakage of unqueued fragments
	sc16is7xx: move label 'err_spi' to correct section
	net: hns: fix unsigned comparison to less than zero
	bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K
	netfilter: ipv6: nf_defrag: accept duplicate fragments again
	KVM: x86: degrade WARN to pr_warn_ratelimited
	KVM: LAPIC: Fix pending interrupt in IRR blocked by software disable LAPIC
	nfsd: Fix overflow causing non-working mounts on 1 TB machines
	svcrdma: Ignore source port when computing DRC hash
	MIPS: Fix bounds check virt_addr_valid
	MIPS: Add missing EHB in mtc0 -> mfc0 sequence.
	MIPS: have "plain" make calls build dtbs for selected platforms
	dmaengine: qcom: bam_dma: Fix completed descriptors count
	dmaengine: imx-sdma: remove BD_INTR for channel0
	Linux 4.19.58

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-07-10 11:40:00 +02:00
Petr Mladek
c854d9b6ef ftrace/x86: Remove possible deadlock between register_kprobe() and ftrace_run_update_code()
commit d5b844a2cf upstream.

The commit 9f255b632b ("module: Fix livepatch/ftrace module text
permissions race") causes a possible deadlock between register_kprobe()
and ftrace_run_update_code() when ftrace is using stop_machine().

The existing dependency chain (in reverse order) is:

-> #1 (text_mutex){+.+.}:
       validate_chain.isra.21+0xb32/0xd70
       __lock_acquire+0x4b8/0x928
       lock_acquire+0x102/0x230
       __mutex_lock+0x88/0x908
       mutex_lock_nested+0x32/0x40
       register_kprobe+0x254/0x658
       init_kprobes+0x11a/0x168
       do_one_initcall+0x70/0x318
       kernel_init_freeable+0x456/0x508
       kernel_init+0x22/0x150
       ret_from_fork+0x30/0x34
       kernel_thread_starter+0x0/0xc

-> #0 (cpu_hotplug_lock.rw_sem){++++}:
       check_prev_add+0x90c/0xde0
       validate_chain.isra.21+0xb32/0xd70
       __lock_acquire+0x4b8/0x928
       lock_acquire+0x102/0x230
       cpus_read_lock+0x62/0xd0
       stop_machine+0x2e/0x60
       arch_ftrace_update_code+0x2e/0x40
       ftrace_run_update_code+0x40/0xa0
       ftrace_startup+0xb2/0x168
       register_ftrace_function+0x64/0x88
       klp_patch_object+0x1a2/0x290
       klp_enable_patch+0x554/0x980
       do_one_initcall+0x70/0x318
       do_init_module+0x6e/0x250
       load_module+0x1782/0x1990
       __s390x_sys_finit_module+0xaa/0xf0
       system_call+0xd8/0x2d0

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(text_mutex);
                               lock(cpu_hotplug_lock.rw_sem);
                               lock(text_mutex);
  lock(cpu_hotplug_lock.rw_sem);

It is similar problem that has been solved by the commit 2d1e38f566
("kprobes: Cure hotplug lock ordering issues"). Many locks are involved.
To be on the safe side, text_mutex must become a low level lock taken
after cpu_hotplug_lock.rw_sem.

This can't be achieved easily with the current ftrace design.
For example, arm calls set_all_modules_text_rw() already in
ftrace_arch_code_modify_prepare(), see arch/arm/kernel/ftrace.c.
This functions is called:

  + outside stop_machine() from ftrace_run_update_code()
  + without stop_machine() from ftrace_module_enable()

Fortunately, the problematic fix is needed only on x86_64. It is
the only architecture that calls set_all_modules_text_rw()
in ftrace path and supports livepatching at the same time.

Therefore it is enough to move text_mutex handling from the generic
kernel/trace/ftrace.c into arch/x86/kernel/ftrace.c:

   ftrace_arch_code_modify_prepare()
   ftrace_arch_code_modify_post_process()

This patch basically reverts the ftrace part of the problematic
commit 9f255b632b ("module: Fix livepatch/ftrace module
text permissions race"). And provides x86_64 specific-fix.

Some refactoring of the ftrace code will be needed when livepatching
is implemented for arm or nds32. These architectures call
set_all_modules_text_rw() and use stop_machine() at the same time.

Link: http://lkml.kernel.org/r/20190627081334.12793-1-pmladek@suse.com

Fixes: 9f255b632b ("module: Fix livepatch/ftrace module text permissions race")
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Reported-by: Miroslav Benes <mbenes@suse.cz>
Reviewed-by: Miroslav Benes <mbenes@suse.cz>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
[
  As reviewed by Miroslav Benes <mbenes@suse.cz>, removed return value of
  ftrace_run_update_code() as it is a void function.
]
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-07-10 09:53:44 +02:00
Eiichi Tsukata
c8790d7f76 tracing/snapshot: Resize spare buffer if size changed
commit 46cc0b4442 upstream.

Current snapshot implementation swaps two ring_buffers even though their
sizes are different from each other, that can cause an inconsistency
between the contents of buffer_size_kb file and the current buffer size.

For example:

  # cat buffer_size_kb
  7 (expanded: 1408)
  # echo 1 > events/enable
  # grep bytes per_cpu/cpu0/stats
  bytes: 1441020
  # echo 1 > snapshot             // current:1408, spare:1408
  # echo 123 > buffer_size_kb     // current:123,  spare:1408
  # echo 1 > snapshot             // current:1408, spare:123
  # grep bytes per_cpu/cpu0/stats
  bytes: 1443700
  # cat buffer_size_kb
  123                             // != current:1408

And also, a similar per-cpu case hits the following WARNING:

Reproducer:

  # echo 1 > per_cpu/cpu0/snapshot
  # echo 123 > buffer_size_kb
  # echo 1 > per_cpu/cpu0/snapshot

WARNING:

  WARNING: CPU: 0 PID: 1946 at kernel/trace/trace.c:1607 update_max_tr_single.part.0+0x2b8/0x380
  Modules linked in:
  CPU: 0 PID: 1946 Comm: bash Not tainted 5.2.0-rc6 #20
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-2.fc30 04/01/2014
  RIP: 0010:update_max_tr_single.part.0+0x2b8/0x380
  Code: ff e8 dc da f9 ff 0f 0b e9 88 fe ff ff e8 d0 da f9 ff 44 89 ee bf f5 ff ff ff e8 33 dc f9 ff 41 83 fd f5 74 96 e8 b8 da f9 ff <0f> 0b eb 8d e8 af da f9 ff 0f 0b e9 bf fd ff ff e8 a3 da f9 ff 48
  RSP: 0018:ffff888063e4fca0 EFLAGS: 00010093
  RAX: ffff888066214380 RBX: ffffffff99850fe0 RCX: ffffffff964298a8
  RDX: 0000000000000000 RSI: 00000000fffffff5 RDI: 0000000000000005
  RBP: 1ffff1100c7c9f96 R08: ffff888066214380 R09: ffffed100c7c9f9b
  R10: ffffed100c7c9f9a R11: 0000000000000003 R12: 0000000000000000
  R13: 00000000ffffffea R14: ffff888066214380 R15: ffffffff99851060
  FS:  00007f9f8173c700(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000000714dc0 CR3: 0000000066fa6000 CR4: 00000000000006f0
  Call Trace:
   ? trace_array_printk_buf+0x140/0x140
   ? __mutex_lock_slowpath+0x10/0x10
   tracing_snapshot_write+0x4c8/0x7f0
   ? trace_printk_init_buffers+0x60/0x60
   ? selinux_file_permission+0x3b/0x540
   ? tracer_preempt_off+0x38/0x506
   ? trace_printk_init_buffers+0x60/0x60
   __vfs_write+0x81/0x100
   vfs_write+0x1e1/0x560
   ksys_write+0x126/0x250
   ? __ia32_sys_read+0xb0/0xb0
   ? do_syscall_64+0x1f/0x390
   do_syscall_64+0xc1/0x390
   entry_SYSCALL_64_after_hwframe+0x49/0xbe

This patch adds resize_buffer_duplicate_size() to check if there is a
difference between current/spare buffer sizes and resize a spare buffer
if necessary.

Link: http://lkml.kernel.org/r/20190625012910.13109-1-devel@etsukata.com

Cc: stable@vger.kernel.org
Fixes: ad909e21bb ("tracing: Add internal tracing_snapshot() functions")
Signed-off-by: Eiichi Tsukata <devel@etsukata.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-07-10 09:53:43 +02:00
Wei Li
2b39351e38 ftrace: Fix NULL pointer dereference in free_ftrace_func_mapper()
[ Upstream commit 04e03d9a61 ]

The mapper may be NULL when called from register_ftrace_function_probe()
with probe->data == NULL.

This issue can be reproduced as follow (it may be covered by compiler
optimization sometime):

/ # cat /sys/kernel/debug/tracing/set_ftrace_filter
#### all functions enabled ####
/ # echo foo_bar:dump > /sys/kernel/debug/tracing/set_ftrace_filter
[  206.949100] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[  206.952402] Mem abort info:
[  206.952819]   ESR = 0x96000006
[  206.955326]   Exception class = DABT (current EL), IL = 32 bits
[  206.955844]   SET = 0, FnV = 0
[  206.956272]   EA = 0, S1PTW = 0
[  206.956652] Data abort info:
[  206.957320]   ISV = 0, ISS = 0x00000006
[  206.959271]   CM = 0, WnR = 0
[  206.959938] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000419f3a000
[  206.960483] [0000000000000000] pgd=0000000411a87003, pud=0000000411a83003, pmd=0000000000000000
[  206.964953] Internal error: Oops: 96000006 [#1] SMP
[  206.971122] Dumping ftrace buffer:
[  206.973677]    (ftrace buffer empty)
[  206.975258] Modules linked in:
[  206.976631] Process sh (pid: 281, stack limit = 0x(____ptrval____))
[  206.978449] CPU: 10 PID: 281 Comm: sh Not tainted 5.2.0-rc1+ #17
[  206.978955] Hardware name: linux,dummy-virt (DT)
[  206.979883] pstate: 60000005 (nZCv daif -PAN -UAO)
[  206.980499] pc : free_ftrace_func_mapper+0x2c/0x118
[  206.980874] lr : ftrace_count_free+0x68/0x80
[  206.982539] sp : ffff0000182f3ab0
[  206.983102] x29: ffff0000182f3ab0 x28: ffff8003d0ec1700
[  206.983632] x27: ffff000013054b40 x26: 0000000000000001
[  206.984000] x25: ffff00001385f000 x24: 0000000000000000
[  206.984394] x23: ffff000013453000 x22: ffff000013054000
[  206.984775] x21: 0000000000000000 x20: ffff00001385fe28
[  206.986575] x19: ffff000013872c30 x18: 0000000000000000
[  206.987111] x17: 0000000000000000 x16: 0000000000000000
[  206.987491] x15: ffffffffffffffb0 x14: 0000000000000000
[  206.987850] x13: 000000000017430e x12: 0000000000000580
[  206.988251] x11: 0000000000000000 x10: cccccccccccccccc
[  206.988740] x9 : 0000000000000000 x8 : ffff000013917550
[  206.990198] x7 : ffff000012fac2e8 x6 : ffff000012fac000
[  206.991008] x5 : ffff0000103da588 x4 : 0000000000000001
[  206.991395] x3 : 0000000000000001 x2 : ffff000013872a28
[  206.991771] x1 : 0000000000000000 x0 : 0000000000000000
[  206.992557] Call trace:
[  206.993101]  free_ftrace_func_mapper+0x2c/0x118
[  206.994827]  ftrace_count_free+0x68/0x80
[  206.995238]  release_probe+0xfc/0x1d0
[  206.995555]  register_ftrace_function_probe+0x4a8/0x868
[  206.995923]  ftrace_trace_probe_callback.isra.4+0xb8/0x180
[  206.996330]  ftrace_dump_callback+0x50/0x70
[  206.996663]  ftrace_regex_write.isra.29+0x290/0x3a8
[  206.997157]  ftrace_filter_write+0x44/0x60
[  206.998971]  __vfs_write+0x64/0xf0
[  206.999285]  vfs_write+0x14c/0x2f0
[  206.999591]  ksys_write+0xbc/0x1b0
[  206.999888]  __arm64_sys_write+0x3c/0x58
[  207.000246]  el0_svc_common.constprop.0+0x408/0x5f0
[  207.000607]  el0_svc_handler+0x144/0x1c8
[  207.000916]  el0_svc+0x8/0xc
[  207.003699] Code: aa0003f8 a9025bf5 aa0103f5 f946ea80 (f9400303)
[  207.008388] ---[ end trace 7b6d11b5f542bdf1 ]---
[  207.010126] Kernel panic - not syncing: Fatal exception
[  207.011322] SMP: stopping secondary CPUs
[  207.013956] Dumping ftrace buffer:
[  207.014595]    (ftrace buffer empty)
[  207.015632] Kernel Offset: disabled
[  207.017187] CPU features: 0x002,20006008
[  207.017985] Memory Limit: none
[  207.019825] ---[ end Kernel panic - not syncing: Fatal exception ]---

Link: http://lkml.kernel.org/r/20190606031754.10798-1-liwei391@huawei.com

Signed-off-by: Wei Li <liwei391@huawei.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-07-10 09:53:40 +02:00
Josh Poimboeuf
9380441719 module: Fix livepatch/ftrace module text permissions race
[ Upstream commit 9f255b632b ]

It's possible for livepatch and ftrace to be toggling a module's text
permissions at the same time, resulting in the following panic:

  BUG: unable to handle page fault for address: ffffffffc005b1d9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0003) - permissions violation
  PGD 3ea0c067 P4D 3ea0c067 PUD 3ea0e067 PMD 3cc13067 PTE 3b8a1061
  Oops: 0003 [#1] PREEMPT SMP PTI
  CPU: 1 PID: 453 Comm: insmod Tainted: G           O  K   5.2.0-rc1-a188339ca5 #1
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-20181126_142135-anatol 04/01/2014
  RIP: 0010:apply_relocate_add+0xbe/0x14c
  Code: fa 0b 74 21 48 83 fa 18 74 38 48 83 fa 0a 75 40 eb 08 48 83 38 00 74 33 eb 53 83 38 00 75 4e 89 08 89 c8 eb 0a 83 38 00 75 43 <89> 08 48 63 c1 48 39 c8 74 2e eb 48 83 38 00 75 32 48 29 c1 89 08
  RSP: 0018:ffffb223c00dbb10 EFLAGS: 00010246
  RAX: ffffffffc005b1d9 RBX: 0000000000000000 RCX: ffffffff8b200060
  RDX: 000000000000000b RSI: 0000004b0000000b RDI: ffff96bdfcd33000
  RBP: ffffb223c00dbb38 R08: ffffffffc005d040 R09: ffffffffc005c1f0
  R10: ffff96bdfcd33c40 R11: ffff96bdfcd33b80 R12: 0000000000000018
  R13: ffffffffc005c1f0 R14: ffffffffc005e708 R15: ffffffff8b2fbc74
  FS:  00007f5f447beba8(0000) GS:ffff96bdff900000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: ffffffffc005b1d9 CR3: 000000003cedc002 CR4: 0000000000360ea0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Call Trace:
   klp_init_object_loaded+0x10f/0x219
   ? preempt_latency_start+0x21/0x57
   klp_enable_patch+0x662/0x809
   ? virt_to_head_page+0x3a/0x3c
   ? kfree+0x8c/0x126
   patch_init+0x2ed/0x1000 [livepatch_test02]
   ? 0xffffffffc0060000
   do_one_initcall+0x9f/0x1c5
   ? kmem_cache_alloc_trace+0xc4/0xd4
   ? do_init_module+0x27/0x210
   do_init_module+0x5f/0x210
   load_module+0x1c41/0x2290
   ? fsnotify_path+0x3b/0x42
   ? strstarts+0x2b/0x2b
   ? kernel_read+0x58/0x65
   __do_sys_finit_module+0x9f/0xc3
   ? __do_sys_finit_module+0x9f/0xc3
   __x64_sys_finit_module+0x1a/0x1c
   do_syscall_64+0x52/0x61
   entry_SYSCALL_64_after_hwframe+0x44/0xa9

The above panic occurs when loading two modules at the same time with
ftrace enabled, where at least one of the modules is a livepatch module:

CPU0					CPU1
klp_enable_patch()
  klp_init_object_loaded()
    module_disable_ro()
    					ftrace_module_enable()
					  ftrace_arch_code_modify_post_process()
				    	    set_all_modules_text_ro()
      klp_write_object_relocations()
        apply_relocate_add()
	  *patches read-only code* - BOOM

A similar race exists when toggling ftrace while loading a livepatch
module.

Fix it by ensuring that the livepatch and ftrace code patching
operations -- and their respective permissions changes -- are protected
by the text_mutex.

Link: http://lkml.kernel.org/r/ab43d56ab909469ac5d2520c5d944ad6d4abd476.1560474114.git.jpoimboe@redhat.com

Reported-by: Johannes Erdfelt <johannes@erdfelt.com>
Fixes: 444d13ff10 ("modules: add ro_after_init support")
Acked-by: Jessica Yu <jeyu@kernel.org>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Reviewed-by: Miroslav Benes <mbenes@suse.cz>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-07-10 09:53:40 +02:00
Vasily Gorbik
220adcc0e0 tracing: avoid build warning with HAVE_NOP_MCOUNT
[ Upstream commit cbdaeaf050 ]

Selecting HAVE_NOP_MCOUNT enables -mnop-mcount (if gcc supports it)
and sets CC_USING_NOP_MCOUNT. Reuse __is_defined (which is suitable for
testing CC_USING_* defines) to avoid conditional compilation and fix
the following gcc 9 warning on s390:

kernel/trace/ftrace.c:2514:1: warning: ‘ftrace_code_disable’ defined
but not used [-Wunused-function]

Link: http://lkml.kernel.org/r/patch.git-1a82d13f33ac.your-ad-here.call-01559732716-ext-6629@work.hours

Fixes: 2f4df0017b ("tracing: Add -mcount-nop option support")
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-07-10 09:53:40 +02:00
Greg Kroah-Hartman
5b2dde5e0b This is the 4.19.57 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl0cjioACgkQONu9yGCS
 aT4TNg//Sr2cN3HmcbJrjfNAifpjT1XRix0Qy0EOYMhieCh26SbHyB0yo/N0UMCK
 iGv4ThqoBE+goK9bfb1F4CL0iMo88RM11lTy7UbemSQg2+MNJb8mvaq8YkpexTdw
 SRgXT1kyOPoHVGCypTgQcKHLdLAuOkQQGCxccU0n+Vc006nLPI0b9yRvgUnUwzvY
 EO9zLSfMLQhCcsLVoXLqaJ0AeU+VG5mkILjHZjcNElT+0T/LwoPO+VBLkuQt3KLp
 BWe+N11xsc2ZR53jptpl9UU2aaUGIKeYttKgwj7rcqUuigk4hQ0AIZmZuQWzhgBu
 6ERnKRgKARKQt4igxL5IsbIJiSK4/VJvuaR+26Sobc6zfDPQ0qfOuJaZeLYQjRQe
 SXjLNXzozA1SV593o1atLhFeY+tGMRQ4dlFCE9x/gJ68v5dya+f0e7X+zP8+HV+v
 u7pfgHT3Jb43D/G6H4sHE0VZZF4vh3Ba675Xp4NzOQOaFHJtQQUPCROiyYjJF6+H
 2fgkwsokE8oFPgqWrYuOIzV9t5THjSNqhT7lyZ/LNDJiMTnJytqfQ01zbHoaHCAb
 i5QB09x+72L7L/U9B9BGH+zEPTC2myw3dKmMv7kUxNx/3QKVDb/6cVnLnTWs4zrJ
 lw52HzgB2aV8pRtvgg0OeHedJ8UGVYfVq2/YHUHbiukgZ61n3J8=
 =OkFp
 -----END PGP SIGNATURE-----

Merge 4.19.57 into android-4.19

Changes in 4.19.57
	perf ui helpline: Use strlcpy() as a shorter form of strncpy() + explicit set nul
	perf help: Remove needless use of strncpy()
	perf header: Fix unchecked usage of strncpy()
	arm64: Don't unconditionally add -Wno-psabi to KBUILD_CFLAGS
	Revert "x86/uaccess, ftrace: Fix ftrace_likely_update() vs. SMAP"
	IB/hfi1: Close PSM sdma_progress sleep window
	9p/xen: fix check for xenbus_read error in front_probe
	9p: Use a slab for allocating requests
	9p: embed fcall in req to round down buffer allocs
	9p: add a per-client fcall kmem_cache
	9p: rename p9_free_req() function
	9p: Add refcount to p9_req_t
	9p/rdma: do not disconnect on down_interruptible EAGAIN
	9p: Rename req to rreq in trans_fd
	9p: acl: fix uninitialized iattr access
	9p/rdma: remove useless check in cm_event_handler
	9p: p9dirent_read: check network-provided name length
	9p: potential NULL dereference
	9p/trans_fd: abort p9_read_work if req status changed
	9p/trans_fd: put worker reqs on destroy
	net/9p: include trans_common.h to fix missing prototype warning.
	qmi_wwan: Fix out-of-bounds read
	Revert "usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup"
	usb: dwc3: gadget: combine unaligned and zero flags
	usb: dwc3: gadget: track number of TRBs per request
	usb: dwc3: gadget: use num_trbs when skipping TRBs on ->dequeue()
	usb: dwc3: gadget: extract dwc3_gadget_ep_skip_trbs()
	usb: dwc3: gadget: introduce cancelled_list
	usb: dwc3: gadget: move requests to cancelled_list
	usb: dwc3: gadget: remove wait_end_transfer
	usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup
	fs/proc/array.c: allow reporting eip/esp for all coredumping threads
	mm/mempolicy.c: fix an incorrect rebind node in mpol_rebind_nodemask
	fs/binfmt_flat.c: make load_flat_shared_library() work
	clk: socfpga: stratix10: fix divider entry for the emac clocks
	mm: soft-offline: return -EBUSY if set_hwpoison_free_buddy_page() fails
	mm: hugetlb: soft-offline: dissolve_free_huge_page() return zero on !PageHuge
	mm/page_idle.c: fix oops because end_pfn is larger than max_pfn
	dm log writes: make sure super sector log updates are written in order
	scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck()
	x86/speculation: Allow guests to use SSBD even if host does not
	x86/microcode: Fix the microcode load on CPU hotplug for real
	x86/resctrl: Prevent possible overrun during bitmap operations
	KVM: x86/mmu: Allocate PAE root array when using SVM's 32-bit NPT
	NFS/flexfiles: Use the correct TCP timeout for flexfiles I/O
	cpu/speculation: Warn on unsupported mitigations= parameter
	SUNRPC: Clean up initialisation of the struct rpc_rqst
	irqchip/mips-gic: Use the correct local interrupt map registers
	eeprom: at24: fix unexpected timeout under high load
	af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET
	bonding: Always enable vlan tx offload
	ipv4: Use return value of inet_iif() for __raw_v4_lookup in the while loop
	net/packet: fix memory leak in packet_set_ring()
	net: remove duplicate fetch in sock_getsockopt
	net: stmmac: fixed new system time seconds value calculation
	net: stmmac: set IC bit when transmitting frames with HW timestamp
	sctp: change to hold sk after auth shkey is created successfully
	team: Always enable vlan tx offload
	tipc: change to use register_pernet_device
	tipc: check msg->req data len in tipc_nl_compat_bearer_disable
	tun: wake up waitqueues after IFF_UP is set
	bpf: simplify definition of BPF_FIB_LOOKUP related flags
	bpf: lpm_trie: check left child of last leftmost node for NULL
	bpf: fix nested bpf tracepoints with per-cpu data
	bpf: fix unconnected udp hooks
	bpf: udp: Avoid calling reuseport's bpf_prog from udp_gro
	bpf: udp: ipv6: Avoid running reuseport's bpf_prog from __udp6_lib_err
	arm64: futex: Avoid copying out uninitialised stack in failed cmpxchg()
	bpf, arm64: use more scalable stadd over ldxr / stxr loop in xadd
	futex: Update comments and docs about return values of arch futex code
	RDMA: Directly cast the sockaddr union to sockaddr
	tipc: pass tunnel dev as NULL to udp_tunnel(6)_xmit_skb
	usb: dwc3: Reset num_trbs after skipping
	arm64: insn: Fix ldadd instruction encoding
	Linux 4.19.57

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-07-03 13:19:45 +02:00
Matt Mullins
a7177b94af bpf: fix nested bpf tracepoints with per-cpu data
commit 9594dc3c7e upstream.

BPF_PROG_TYPE_RAW_TRACEPOINTs can be executed nested on the same CPU, as
they do not increment bpf_prog_active while executing.

This enables three levels of nesting, to support
  - a kprobe or raw tp or perf event,
  - another one of the above that irq context happens to call, and
  - another one in nmi context
(at most one of which may be a kprobe or perf event).

Fixes: 20b9d7ac48 ("bpf: avoid excessive stack usage for perf_sample_data")
Signed-off-by: Matt Mullins <mmullins@fb.com>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-07-03 13:14:48 +02:00
Sasha Levin
fec1a13bdf Revert "x86/uaccess, ftrace: Fix ftrace_likely_update() vs. SMAP"
This reverts commit 1a3188d737, which was
upstream commit 4a6c91fbde.

On Tue, Jun 25, 2019 at 09:39:45AM +0200, Sebastian Andrzej Siewior wrote:
>Please backport commit e74deb1193 to
>stable _or_ revert the backport of commit 4a6c91fbde ("x86/uaccess,
>ftrace: Fix ftrace_likely_update() vs. SMAP"). It uses
>user_access_{save|restore}() which has been introduced in the following
>commit.

Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-07-03 13:14:41 +02:00
Greg Kroah-Hartman
e5304c6929 This is the 4.19.56 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl0RlqIACgkQONu9yGCS
 aT5MEQ/9Ftd5Y4EmSSeuRYZle8Dx9t15sR3mBtaKTdKk96KtVvlQNJhFEsm4IdrS
 O7IlUrR40ED3bqhOcFMUSvJOFiTnqJeMr0l5ukUMilszV6KO3Nhe0OX1huIA63bY
 EgoS+4YFcI0aDuVytTbI6wnW3f0KjxmCSWF0RgN7fQMgWa9ulBTjfXhUlQsnAVIM
 zVWS3K6VDjmxskTP6qmrt6OGgSFFy95drYoHG2wYiqGxIH1gCyHQAchWu6CPn92s
 rbzgzVeEYLpKGHlfWUfbIYSYOprVm4WXISqLABT4vDiWGFWey/g1dlIqI7gslLmN
 DpcSphYZo7xiW0Fh76zwh/n61lo7W2loho8k9VxxQR1hmgiYrMFEN7T1SyL7OgQ8
 eplY50JOZN0OgW6HGa0ad2noUImKQccufGwsOCVlTxxAIn7qVgaGu2LtuBGb2P1o
 C6rBOSQ1LyRikOw1/ElIWxwnBJ9p+JjFhEH94HoFB7wyaROFfl+9LJvXt9zLop0E
 G0oG2QIp/+cusYY3h+eeMtw8gqa0oOnvwiaEbd7y1JVandjFBR01O0Uv0h+VKwSC
 HsBGnj2BpF8p3FYNXRVb4Wiii0QyWYjnDbrtndzLFj/fLOvR8bDb8HKBLOStm1UC
 8PUc0w+sFo2tZ60Z4kXgkLL2yiiE/rQcDF0SsEgtFe4RTr7Feys=
 =GLuP
 -----END PGP SIGNATURE-----

Merge 4.19.56 into android-4.19

Changes in 4.19.56
	tracing: Silence GCC 9 array bounds warning
	objtool: Support per-function rodata sections
	gcc-9: silence 'address-of-packed-member' warning
	ovl: support the FS_IOC_FS[SG]ETXATTR ioctls
	ovl: fix wrong flags check in FS_IOC_FS[SG]ETXATTR ioctls
	ovl: make i_ino consistent with st_ino in more cases
	ovl: detect overlapping layers
	ovl: don't fail with disconnected lower NFS
	ovl: fix bogus -Wmaybe-unitialized warning
	s390/jump_label: Use "jdd" constraint on gcc9
	s390/ap: rework assembler functions to use unions for in/out register variables
	mmc: sdhci: sdhci-pci-o2micro: Correctly set bus width when tuning
	mmc: core: API to temporarily disable retuning for SDIO CRC errors
	mmc: core: Add sdio_retune_hold_now() and sdio_retune_release()
	mmc: core: Prevent processing SDIO IRQs when the card is suspended
	scsi: ufs: Avoid runtime suspend possibly being blocked forever
	usb: chipidea: udc: workaround for endpoint conflict issue
	xhci: detect USB 3.2 capable host controllers correctly
	usb: xhci: Don't try to recover an endpoint if port is in error state.
	IB/hfi1: Validate fault injection opcode user input
	IB/hfi1: Silence txreq allocation warnings
	iio: temperature: mlx90632 Relax the compatibility check
	Input: synaptics - enable SMBus on ThinkPad E480 and E580
	Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD
	Input: silead - add MSSL0017 to acpi_device_id
	apparmor: fix PROFILE_MEDIATES for untrusted input
	apparmor: enforce nullbyte at end of tag string
	brcmfmac: sdio: Disable auto-tuning around commands expected to fail
	brcmfmac: sdio: Don't tune while the card is off
	ARC: fix build warnings
	dmaengine: dw-axi-dmac: fix null dereference when pointer first is null
	dmaengine: sprd: Fix block length overflow
	ARC: [plat-hsdk]: Add missing multicast filter bins number to GMAC node
	ARC: [plat-hsdk]: Add missing FIFO size entry in GMAC node
	fpga: dfl: afu: Pass the correct device to dma_mapping_error()
	fpga: dfl: Add lockdep classes for pdata->lock
	parport: Fix mem leak in parport_register_dev_model
	parisc: Fix compiler warnings in float emulation code
	IB/rdmavt: Fix alloc_qpn() WARN_ON()
	IB/hfi1: Insure freeze_work work_struct is canceled on shutdown
	IB/{qib, hfi1, rdmavt}: Correct ibv_devinfo max_mr value
	IB/hfi1: Validate page aligned for a given virtual address
	MIPS: uprobes: remove set but not used variable 'epc'
	xtensa: Fix section mismatch between memblock_reserve and mem_reserve
	kselftest/cgroup: fix unexpected testing failure on test_memcontrol
	kselftest/cgroup: fix unexpected testing failure on test_core
	kselftest/cgroup: fix incorrect test_core skip
	selftests: vm: install test_vmalloc.sh for run_vmtests
	net: dsa: mv88e6xxx: avoid error message on remove from VLAN 0
	net: hns: Fix loopback test failed at copper ports
	mdesc: fix a missing-check bug in get_vdev_port_node_info()
	sparc: perf: fix updated event period in response to PERF_EVENT_IOC_PERIOD
	net: ethernet: mediatek: Use hw_feature to judge if HWLRO is supported
	net: ethernet: mediatek: Use NET_IP_ALIGN to judge if HW RX_2BYTE_OFFSET is enabled
	drm/arm/mali-dp: Add a loop around the second set CVAL and try 5 times
	drm/arm/hdlcd: Actually validate CRTC modes
	drm/arm/hdlcd: Allow a bit of clock tolerance
	nvmet: fix data_len to 0 for bdev-backed write_zeroes
	scripts/checkstack.pl: Fix arm64 wrong or unknown architecture
	scsi: ufs: Check that space was properly alloced in copy_query_response
	scsi: smartpqi: unlock on error in pqi_submit_raid_request_synchronous()
	net: ipvlan: Fix ipvlan device tso disabled while NETIF_F_IP_CSUM is set
	s390/qeth: fix VLAN attribute in bridge_hostnotify udev event
	hwmon: (core) add thermal sensors only if dev->of_node is present
	hwmon: (pmbus/core) Treat parameters as paged if on multiple pages
	arm64: Silence gcc warnings about arch ABI drift
	nvme: Fix u32 overflow in the number of namespace list calculation
	btrfs: start readahead also in seed devices
	can: xilinx_can: use correct bittiming_const for CAN FD core
	can: flexcan: fix timeout when set small bitrate
	can: purge socket error queue on sock destruct
	riscv: mm: synchronize MMU after pte change
	powerpc/bpf: use unsigned division instruction for 64-bit operations
	ARM: imx: cpuidle-imx6sx: Restrict the SW2ISO increase to i.MX6SX
	ARM: dts: dra76x: Update MMC2_HS200_MANUAL1 iodelay values
	ARM: dts: am57xx-idk: Remove support for voltage switching for SD card
	arm64/sve: <uapi/asm/ptrace.h> should not depend on <uapi/linux/prctl.h>
	arm64: ssbd: explicitly depend on <linux/prctl.h>
	drm/vmwgfx: Use the backdoor port if the HB port is not available
	staging: erofs: add requirements field in superblock
	Bluetooth: Align minimum encryption key size for LE and BR/EDR connections
	Bluetooth: Fix regression with minimum encryption key size alignment
	SMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write
	cfg80211: fix memory leak of wiphy device name
	mac80211: drop robust management frames from unknown TA
	{nl,mac}80211: allow 4addr AP operation on crypto controlled devices
	mac80211: handle deauthentication/disassociation from TDLS peer
	nl80211: fix station_info pertid memory leak
	mac80211: Do not use stack memory with scatterlist for GMAC
	x86/resctrl: Don't stop walking closids when a locksetup group is found
	powerpc/mm/64s/hash: Reallocate context ids on fork
	Linux 4.19.56

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-06-25 15:46:46 +08:00
Miguel Ojeda
c493ead38a tracing: Silence GCC 9 array bounds warning
commit 0c97bf863e upstream.

Starting with GCC 9, -Warray-bounds detects cases when memset is called
starting on a member of a struct but the size to be cleared ends up
writing over further members.

Such a call happens in the trace code to clear, at once, all members
after and including `seq` on struct trace_iterator:

    In function 'memset',
        inlined from 'ftrace_dump' at kernel/trace/trace.c:8914:3:
    ./include/linux/string.h:344:9: warning: '__builtin_memset' offset
    [8505, 8560] from the object at 'iter' is out of the bounds of
    referenced subobject 'seq' with type 'struct trace_seq' at offset
    4368 [-Warray-bounds]
      344 |  return __builtin_memset(p, c, size);
          |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~

In order to avoid GCC complaining about it, we compute the address
ourselves by adding the offsetof distance instead of referring
directly to the member.

Since there are two places doing this clear (trace.c and trace_kdb.c),
take the chance to move the workaround into a single place in
the internal header.

Link: http://lkml.kernel.org/r/20190523124535.GA12931@gmail.com

Signed-off-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
[ Removed unnecessary parenthesis around "iter" ]
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-06-25 11:35:52 +08:00
Greg Kroah-Hartman
f613e8938d This is the 4.19.53 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl0J4rgACgkQONu9yGCS
 aT6JVhAAouXsxBjKDxMlJkMrcCFPVHTgWyrHMJ0aeV3jWACGoKbd+RBZtEoNrD4n
 X5/AJdDMvSPuPMWqE8BO/+Q1e4YQYRoHQyQ24aRkq66a8+UpybRMpshFb+tfGQO+
 ysVypoBg97Y+8ao0MFKxu79+rrJor566f8jXznrxvFG3MnI0Kq3BBGq59UcQTu4z
 e1jd2OJjQxttZovOlA6v9rRTdHdzoI/84DZfYgqV1pUoC8pwjg7UO0+1cwnKlqem
 No4iWGP4lmfXN/VuzRpBs9a6kqE14GL5Ah13U3uhYXk9Dd2iLkS2fPKPiaDpiHql
 /SIL/3q4BCJVDZePIZuLoRe9qKLDh7rdNziIDhSUskW1H1tHAhsJUktWo0HarZW2
 6Z5K10S/MsXAxWoFnY1TMBhZg+h+f/pHxy6FqZdvV4DGsx7uDWoVhn+o4Qw5WTSG
 7KGMvvyDE7EyciwXVkQoN3hwX9pcxBwDtMswzSbW1VM9h3nYOzfY6OwSc/GDbM+f
 9zQb+sgLIu1K5FUqyYNMfV/YXGGHpml181ZRWm3bZ4N63odDKMwzWfkc5RlIlDoM
 kqmMZKvpTSA4MeRzGzcUMsIpXv8SeNvR3cotCBqau+IRAIkLX8tZClJL+4FilLIN
 PkOjXtuEt648ZDybVGZykmAPIVuWreosWdtIH79ZOmnpveRQN7I=
 =DiXP
 -----END PGP SIGNATURE-----

Merge 4.19.53 into android-4.19

Changes in 4.19.53
	drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3)
	nouveau: Fix build with CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT disabled
	HID: multitouch: handle faulty Elo touch device
	HID: wacom: Don't set tool type until we're in range
	HID: wacom: Don't report anything prior to the tool entering range
	HID: wacom: Send BTN_TOUCH in response to INTUOSP2_BT eraser contact
	HID: wacom: Correct button numbering 2nd-gen Intuos Pro over Bluetooth
	HID: wacom: Sync INTUOSP2_BT touch state after each frame if necessary
	Revert "ALSA: hda/realtek - Improve the headset mic for Acer Aspire laptops"
	ALSA: oxfw: allow PCM capture for Stanton SCS.1m
	ALSA: hda/realtek - Update headset mode for ALC256
	ALSA: firewire-motu: fix destruction of data for isochronous resources
	libata: Extend quirks for the ST1000LM024 drives with NOLPM quirk
	mm/list_lru.c: fix memory leak in __memcg_init_list_lru_node
	fs/ocfs2: fix race in ocfs2_dentry_attach_lock()
	mm/vmscan.c: fix trying to reclaim unevictable LRU page
	signal/ptrace: Don't leak unitialized kernel memory with PTRACE_PEEK_SIGINFO
	ptrace: restore smp_rmb() in __ptrace_may_access()
	iommu/arm-smmu: Avoid constant zero in TLBI writes
	i2c: acorn: fix i2c warning
	bcache: fix stack corruption by PRECEDING_KEY()
	bcache: only set BCACHE_DEV_WB_RUNNING when cached device attached
	cgroup: Use css_tryget() instead of css_tryget_online() in task_get_css()
	ASoC: cs42xx8: Add regcache mask dirty
	ASoC: fsl_asrc: Fix the issue about unsupported rate
	drm/i915/sdvo: Implement proper HDMI audio support for SDVO
	x86/uaccess, kcov: Disable stack protector
	ALSA: seq: Protect in-kernel ioctl calls with mutex
	ALSA: seq: Fix race of get-subscription call vs port-delete ioctls
	Revert "ALSA: seq: Protect in-kernel ioctl calls with mutex"
	s390/kasan: fix strncpy_from_user kasan checks
	Drivers: misc: fix out-of-bounds access in function param_set_kgdbts_var
	f2fs: fix to avoid accessing xattr across the boundary
	scsi: qedi: remove memset/memcpy to nfunc and use func instead
	scsi: qedi: remove set but not used variables 'cdev' and 'udev'
	scsi: lpfc: correct rcu unlock issue in lpfc_nvme_info_show
	scsi: lpfc: add check for loss of ndlp when sending RRQ
	arm64/mm: Inhibit huge-vmap with ptdump
	nvme: fix srcu locking on error return in nvme_get_ns_from_disk
	nvme: remove the ifdef around nvme_nvm_ioctl
	nvme: merge nvme_ns_ioctl into nvme_ioctl
	nvme: release namespace SRCU protection before performing controller ioctls
	nvme: fix memory leak for power latency tolerance
	platform/x86: pmc_atom: Add Lex 3I380D industrial PC to critclk_systems DMI table
	platform/x86: pmc_atom: Add several Beckhoff Automation boards to critclk_systems DMI table
	scsi: bnx2fc: fix incorrect cast to u64 on shift operation
	libnvdimm: Fix compilation warnings with W=1
	selftests: fib_rule_tests: fix local IPv4 address typo
	selftests/timers: Add missing fflush(stdout) calls
	tracing: Prevent hist_field_var_ref() from accessing NULL tracing_map_elts
	usbnet: ipheth: fix racing condition
	KVM: arm/arm64: Move cc/it checks under hyp's Makefile to avoid instrumentation
	KVM: x86/pmu: mask the result of rdpmc according to the width of the counters
	KVM: x86/pmu: do not mask the value that is written to fixed PMUs
	KVM: s390: fix memory slot handling for KVM_SET_USER_MEMORY_REGION
	tools/kvm_stat: fix fields filter for child events
	drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read
	drm/vmwgfx: NULL pointer dereference from vmw_cmd_dx_view_define()
	usb: dwc2: Fix DMA cache alignment issues
	usb: dwc2: host: Fix wMaxPacketSize handling (fix webcam regression)
	USB: Fix chipmunk-like voice when using Logitech C270 for recording audio.
	USB: usb-storage: Add new ID to ums-realtek
	USB: serial: pl2303: add Allied Telesis VT-Kit3
	USB: serial: option: add support for Simcom SIM7500/SIM7600 RNDIS mode
	USB: serial: option: add Telit 0x1260 and 0x1261 compositions
	timekeeping: Repair ktime_get_coarse*() granularity
	RAS/CEC: Convert the timer callback to a workqueue
	RAS/CEC: Fix binary search function
	x86/microcode, cpuhotplug: Add a microcode loader CPU hotplug callback
	x86/kasan: Fix boot with 5-level paging and KASAN
	x86/mm/KASLR: Compute the size of the vmemmap section properly
	x86/resctrl: Prevent NULL pointer dereference when local MBM is disabled
	drm/edid: abstract override/firmware EDID retrieval
	drm: add fallback override/firmware EDID modes workaround
	rtc: pcf8523: don't return invalid date when battery is low
	Linux 4.19.53

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-06-19 10:10:24 +02:00
Tom Zanussi
8689509062 tracing: Prevent hist_field_var_ref() from accessing NULL tracing_map_elts
[ Upstream commit 55267c88c0 ]

hist_field_var_ref() is an implementation of hist_field_fn_t(), which
can be called with a null tracing_map_elt elt param when assembling a
key in event_hist_trigger().

In the case of hist_field_var_ref() this doesn't make sense, because a
variable can only be resolved by looking it up using an already
assembled key i.e. a variable can't be used to assemble a key since
the key is required in order to access the variable.

Upper layers should prevent the user from constructing a key using a
variable in the first place, but in case one slips through, it
shouldn't cause a NULL pointer dereference.  Also if one does slip
through, we want to know about it, so emit a one-time warning in that
case.

Link: http://lkml.kernel.org/r/64ec8dc15c14d305295b64cdfcc6b2b9dd14753f.1555597045.git.tom.zanussi@linux.intel.com

Reported-by: Vincent Bernat <vincent@bernat.ch>
Signed-off-by: Tom Zanussi <tom.zanussi@linux.intel.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-06-19 08:18:04 +02:00
Greg Kroah-Hartman
3f534fa2fc This is the 4.19.49 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlz8soUACgkQONu9yGCS
 aT5o7w//cc+XhbVg3ro68Rq2byYVuntdiKtYDYlEQtv5DORELdX29g6gBlLlO+ma
 J29W/8quC9fi8EERG14TRvhh8MJNlQCv5g+Afvqr42zCOBowUFL4q3o06dON2e3v
 qhKsEhwcvHH/dR+ixtw1zpSNl6bIdG87C5gxYpWvpjCHpVpVDwLHfRK7GbSS/ioe
 Ys2uJwtbB4ZpileCoA4O61alYNLq/zP/gJiKraMbrwfOPfY3dmDIqo6KMniUyFs3
 0E0w6AKp2PalsoVxyl6mD0KGFFChWz0AfSE6b3IdlzXC2qOZkWlAKPWxpQMHWdme
 HVGXHxrW6aDVk+RGOmIk1dKWDdVqTZJ1Cx1RscrtIQsQwuXqR/STgoqu1hbQ/B4W
 /jMak4BICuyfnOzsmuQbIhOWaf8KTIokYfQ92SAEDQl+xRhxqe2VTSCkl0gVE+Yr
 KxMoyzyZTYidpWRedUGJiACNjlgogYp3L9xiJjHz2dlQD9r4GTsHXo2CbzV1jYrL
 HKqmkz6angoHx3Vw6tffCe9117KFKkOxX8MG3xRMZMfRglRbNd3m8Uo+YGOWcscU
 e1mUE+71woj89TquN7cTg5hY5/kRiGwVJBqihSuWzeJsf0LPab9Txv7ipHKuzh84
 i8e3Isi3eoZR55ZsU7Jl8QeDIZ2OSNprUy9ldvaI2K4fg/VxpA4=
 =hIeN
 -----END PGP SIGNATURE-----

Merge 4.19.49 into android-4.19

Changes in 4.19.49
	sparc64: Fix regression in non-hypervisor TLB flush xcall
	include/linux/bitops.h: sanitize rotate primitives
	xhci: update bounce buffer with correct sg num
	xhci: Use %zu for printing size_t type
	xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic()
	usb: xhci: avoid null pointer deref when bos field is NULL
	usbip: usbip_host: fix BUG: sleeping function called from invalid context
	usbip: usbip_host: fix stub_dev lock context imbalance regression
	USB: Fix slab-out-of-bounds write in usb_get_bos_descriptor
	USB: sisusbvga: fix oops in error path of sisusb_probe
	USB: Add LPM quirk for Surface Dock GigE adapter
	USB: rio500: refuse more than one device at a time
	USB: rio500: fix memory leak in close after disconnect
	media: usb: siano: Fix general protection fault in smsusb
	media: usb: siano: Fix false-positive "uninitialized variable" warning
	media: smsusb: better handle optional alignment
	brcmfmac: fix NULL pointer derefence during USB disconnect
	scsi: zfcp: fix missing zfcp_port reference put on -EBUSY from port_remove
	scsi: zfcp: fix to prevent port_remove with pure auto scan LUNs (only sdevs)
	tracing: Avoid memory leak in predicate_parse()
	Btrfs: fix wrong ctime and mtime of a directory after log replay
	Btrfs: fix race updating log root item during fsync
	Btrfs: fix fsync not persisting changed attributes of a directory
	Btrfs: incremental send, fix file corruption when no-holes feature is enabled
	iio: dac: ds4422/ds4424 fix chip verification
	iio: adc: ti-ads8688: fix timestamp is not updated in buffer
	s390/crypto: fix gcm-aes-s390 selftest failures
	s390/crypto: fix possible sleep during spinlock aquired
	KVM: PPC: Book3S HV: XIVE: Do not clear IRQ data of passthrough interrupts
	powerpc/perf: Fix MMCRA corruption by bhrb_filter
	ALSA: line6: Assure canceling delayed work at disconnection
	ALSA: hda/realtek - Set default power save node to 0
	ALSA: hda/realtek - Improve the headset mic for Acer Aspire laptops
	KVM: s390: Do not report unusabled IDs via KVM_CAP_MAX_VCPU_ID
	drm/nouveau/i2c: Disable i2c bus access after ->fini()
	i2c: mlxcpld: Fix wrong initialization order in probe
	i2c: synquacer: fix synquacer_i2c_doxfer() return value
	tty: serial: msm_serial: Fix XON/XOFF
	tty: max310x: Fix external crystal register setup
	memcg: make it work on sparse non-0-node systems
	kernel/signal.c: trace_signal_deliver when signal_group_exit
	arm64: Fix the arm64_personality() syscall wrapper redirection
	docs: Fix conf.py for Sphinx 2.0
	doc: Cope with the deprecation of AutoReporter
	doc: Cope with Sphinx logging deprecations
	ima: show rules with IMA_INMASK correctly
	evm: check hash algorithm passed to init_desc()
	vt/fbcon: deinitialize resources in visual_init() after failed memory allocation
	serial: sh-sci: disable DMA for uart_console
	staging: vc04_services: prevent integer overflow in create_pagelist()
	staging: wlan-ng: fix adapter initialization failure
	cifs: fix memory leak of pneg_inbuf on -EOPNOTSUPP ioctl case
	CIFS: cifs_read_allocate_pages: don't iterate through whole page array on ENOMEM
	Revert "lockd: Show pid of lockd for remote locks"
	gcc-plugins: Fix build failures under Darwin host
	drm/tegra: gem: Fix CPU-cache maintenance for BO's allocated using get_pages()
	drm/vmwgfx: Don't send drm sysfs hotplug events on initial master set
	drm/sun4i: Fix sun8i HDMI PHY clock initialization
	drm/sun4i: Fix sun8i HDMI PHY configuration for > 148.5 MHz
	drm/rockchip: shutdown drm subsystem on shutdown
	drm/lease: Make sure implicit planes are leased
	Compiler Attributes: add support for __copy (gcc >= 9)
	include/linux/module.h: copy __init/__exit attrs to init/cleanup_module
	Revert "x86/build: Move _etext to actual end of .text"
	Revert "binder: fix handling of misaligned binder object"
	binder: fix race between munmap() and direct reclaim
	x86/ftrace: Do not call function graph from dynamic trampolines
	x86/ftrace: Set trampoline pages as executable
	x86/kprobes: Set instruction page as executable
	scsi: lpfc: Fix backport of faf5a744f4 ("scsi: lpfc: avoid uninitialized variable warning")
	of: overlay: validate overlay properties #address-cells and #size-cells
	of: overlay: set node fields from properties when add new overlay node
	media: uvcvideo: Fix uvc_alloc_entity() allocation alignment
	Linux 4.19.49

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-06-09 09:27:18 +02:00
Tomas Bortoli
da32e0303d tracing: Avoid memory leak in predicate_parse()
commit dfb4a6f219 upstream.

In case of errors, predicate_parse() goes to the out_free label
to free memory and to return an error code.

However, predicate_parse() does not free the predicates of the
temporary prog_stack array, thence leaking them.

Link: http://lkml.kernel.org/r/20190528154338.29976-1-tomasbortoli@gmail.com

Cc: stable@vger.kernel.org
Fixes: 80765597bc ("tracing: Rewrite filter logic to be simpler and faster")
Reported-by: syzbot+6b8e0fb820e570c59e19@syzkaller.appspotmail.com
Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
[ Added protection around freeing prog_stack[i].pred ]
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-06-09 09:17:14 +02:00
Greg Kroah-Hartman
cab4399ebf This is the 4.19.47 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlzxMDsACgkQONu9yGCS
 aT6kjxAAvyKCDNGaQgBXGXe6xvBK7ad+mk+MU6WVycN+PIQzA8zVfR7RcGJgEP8t
 65QrePyacMe5bmSgTnUKGz6DpwpWbCMamyftjoaPWIhxDFmQy7FB9ANOVoPDBw49
 +jKT30ioBSI6LYQDU4xhxDO01HVEXmmLZquqYDfLoHOMLeXCivfTlM7PQPfxMZzn
 fdeLtvfCnfMiftkXZjGqaWoUAnrlTmncQk9nXMcDgxrGy9pHJ6B1WWE5ygqr4Z5s
 MaKfHotCSYD/eP8JsyIdJg+iMESv5Z0ZDCjbVslm81fCLeUD6atdnmpYxCphmT7Q
 ifN23i4FJrXBX4xLpD9RYzavH3+hQzqb2pt02aBZRW0OLFK0qjYrkdayjwWGOIUI
 zK9bgfHiiNKtoyvakQJ09uMhpO2thWeTMh8a6iBLTQ5Koi60adW1l5GrPuTTZYG7
 V8xNB2cLsUktDsAr1I/kwrCMlE/oNFgy2La5zMzmELnFTUJRlMAoAGaa1DPcOFLt
 QVdT8luJMu+1KTeMZPoK/7QQGszMDTAot4+Ys56KyPQ6zN/rGr2vm7kHYn41FyEp
 KXpyeIm0/RKxUysz2Fyx+dL75e4ZhBof+amQ7Kotz6bF45o+ZwJ7THT6XKIOoln5
 E7iI5RhQMZ2WuVIHLKa0QFBRn4RPpzie1lwOXWAAF6oqNgewXHw=
 =fjPE
 -----END PGP SIGNATURE-----

Merge 4.19.47 into android-4.19

Changes in 4.19.47
	x86: Hide the int3_emulate_call/jmp functions from UML
	ext4: do not delete unlinked inode from orphan list on failed truncate
	ext4: wait for outstanding dio during truncate in nojournal mode
	f2fs: Fix use of number of devices
	KVM: x86: fix return value for reserved EFER
	bio: fix improper use of smp_mb__before_atomic()
	sbitmap: fix improper use of smp_mb__before_atomic()
	Revert "scsi: sd: Keep disk read-only when re-reading partition"
	crypto: vmx - CTR: always increment IV as quadword
	mmc: sdhci-iproc: cygnus: Set NO_HISPD bit to fix HS50 data hold time problem
	mmc: sdhci-iproc: Set NO_HISPD bit to fix HS50 data hold time problem
	kvm: svm/avic: fix off-by-one in checking host APIC ID
	libnvdimm/pmem: Bypass CONFIG_HARDENED_USERCOPY overhead
	arm64/kernel: kaslr: reduce module randomization range to 2 GB
	arm64/iommu: handle non-remapped addresses in ->mmap and ->get_sgtable
	gfs2: Fix sign extension bug in gfs2_update_stats
	btrfs: don't double unlock on error in btrfs_punch_hole
	Btrfs: do not abort transaction at btrfs_update_root() after failure to COW path
	Btrfs: avoid fallback to transaction commit during fsync of files with holes
	Btrfs: fix race between ranged fsync and writeback of adjacent ranges
	btrfs: sysfs: Fix error path kobject memory leak
	btrfs: sysfs: don't leak memory when failing add fsid
	udlfb: fix some inconsistent NULL checking
	fbdev: fix divide error in fb_var_to_videomode
	NFSv4.2 fix unnecessary retry in nfs4_copy_file_range
	NFSv4.1 fix incorrect return value in copy_file_range
	bpf: add bpf_jit_limit knob to restrict unpriv allocations
	brcmfmac: assure SSID length from firmware is limited
	brcmfmac: add subtype check for event handling in data path
	arm64: errata: Add workaround for Cortex-A76 erratum #1463225
	btrfs: honor path->skip_locking in backref code
	ovl: relax WARN_ON() for overlapping layers use case
	fbdev: fix WARNING in __alloc_pages_nodemask bug
	media: cpia2: Fix use-after-free in cpia2_exit
	media: serial_ir: Fix use-after-free in serial_ir_init_module
	media: vb2: add waiting_in_dqbuf flag
	media: vivid: use vfree() instead of kfree() for dev->bitmap_cap
	ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit
	bpf: devmap: fix use-after-free Read in __dev_map_entry_free
	batman-adv: mcast: fix multicast tt/tvlv worker locking
	at76c50x-usb: Don't register led_trigger if usb_register_driver failed
	acct_on(): don't mess with freeze protection
	Revert "btrfs: Honour FITRIM range constraints during free space trim"
	gfs2: Fix lru_count going negative
	cxgb4: Fix error path in cxgb4_init_module
	NFS: make nfs_match_client killable
	IB/hfi1: Fix WQ_MEM_RECLAIM warning
	gfs2: Fix occasional glock use-after-free
	mmc: core: Verify SD bus width
	tools/bpf: fix perf build error with uClibc (seen on ARC)
	selftests/bpf: set RLIMIT_MEMLOCK properly for test_libbpf_open.c
	bpftool: exclude bash-completion/bpftool from .gitignore pattern
	dmaengine: tegra210-dma: free dma controller in remove()
	net: ena: gcc 8: fix compilation warning
	hv_netvsc: fix race that may miss tx queue wakeup
	Bluetooth: Ignore CC events not matching the last HCI command
	pinctrl: zte: fix leaked of_node references
	ASoC: Intel: kbl_da7219_max98357a: Map BTN_0 to KEY_PLAYPAUSE
	usb: dwc2: gadget: Increase descriptors count for ISOC's
	usb: dwc3: move synchronize_irq() out of the spinlock protected block
	ASoC: hdmi-codec: unlock the device on startup errors
	powerpc/perf: Return accordingly on invalid chip-id in
	powerpc/boot: Fix missing check of lseek() return value
	powerpc/perf: Fix loop exit condition in nest_imc_event_init
	ASoC: imx: fix fiq dependencies
	spi: pxa2xx: fix SCR (divisor) calculation
	brcm80211: potential NULL dereference in brcmf_cfg80211_vndr_cmds_dcmd_handler()
	ACPI / property: fix handling of data_nodes in acpi_get_next_subnode()
	drm/nouveau/bar/nv50: ensure BAR is mapped
	media: stm32-dcmi: return appropriate error codes during probe
	ARM: vdso: Remove dependency with the arch_timer driver internals
	arm64: Fix compiler warning from pte_unmap() with -Wunused-but-set-variable
	powerpc/watchdog: Use hrtimers for per-CPU heartbeat
	sched/cpufreq: Fix kobject memleak
	scsi: qla2xxx: Fix a qla24xx_enable_msix() error path
	scsi: qla2xxx: Fix abort handling in tcm_qla2xxx_write_pending()
	scsi: qla2xxx: Avoid that lockdep complains about unsafe locking in tcm_qla2xxx_close_session()
	scsi: qla2xxx: Fix hardirq-unsafe locking
	x86/modules: Avoid breaking W^X while loading modules
	Btrfs: fix data bytes_may_use underflow with fallocate due to failed quota reserve
	btrfs: fix panic during relocation after ENOSPC before writeback happens
	btrfs: Don't panic when we can't find a root key
	iwlwifi: pcie: don't crash on invalid RX interrupt
	rtc: 88pm860x: prevent use-after-free on device remove
	rtc: stm32: manage the get_irq probe defer case
	scsi: qedi: Abort ep termination if offload not scheduled
	s390/kexec_file: Fix detection of text segment in ELF loader
	sched/nohz: Run NOHZ idle load balancer on HK_FLAG_MISC CPUs
	w1: fix the resume command API
	s390: qeth: address type mismatch warning
	dmaengine: pl330: _stop: clear interrupt status
	mac80211/cfg80211: update bss channel on channel switch
	libbpf: fix samples/bpf build failure due to undefined UINT32_MAX
	slimbus: fix a potential NULL pointer dereference in of_qcom_slim_ngd_register
	ASoC: fsl_sai: Update is_slave_mode with correct value
	mwifiex: prevent an array overflow
	rsi: Fix NULL pointer dereference in kmalloc
	net: cw1200: fix a NULL pointer dereference
	nvme: set 0 capacity if namespace block size exceeds PAGE_SIZE
	nvme-rdma: fix a NULL deref when an admin connect times out
	crypto: sun4i-ss - Fix invalid calculation of hash end
	bcache: avoid potential memleak of list of journal_replay(s) in the CACHE_SYNC branch of run_cache_set
	bcache: return error immediately in bch_journal_replay()
	bcache: fix failure in journal relplay
	bcache: add failure check to run_cache_set() for journal replay
	bcache: avoid clang -Wunintialized warning
	RDMA/cma: Consider scope_id while binding to ipv6 ll address
	vfio-ccw: Do not call flush_workqueue while holding the spinlock
	vfio-ccw: Release any channel program when releasing/removing vfio-ccw mdev
	x86/build: Move _etext to actual end of .text
	smpboot: Place the __percpu annotation correctly
	x86/mm: Remove in_nmi() warning from 64-bit implementation of vmalloc_fault()
	mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC versions
	Bluetooth: hci_qca: Give enough time to ROME controller to bootup.
	HID: logitech-hidpp: use RAP instead of FAP to get the protocol version
	pinctrl: pistachio: fix leaked of_node references
	pinctrl: samsung: fix leaked of_node references
	clk: rockchip: undo several noc and special clocks as critical on rk3288
	perf/arm-cci: Remove broken race mitigation
	dmaengine: at_xdmac: remove BUG_ON macro in tasklet
	media: coda: clear error return value before picture run
	media: ov6650: Move v4l2_clk_get() to ov6650_video_probe() helper
	media: au0828: stop video streaming only when last user stops
	media: ov2659: make S_FMT succeed even if requested format doesn't match
	audit: fix a memory leak bug
	media: stm32-dcmi: fix crash when subdev do not expose any formats
	media: au0828: Fix NULL pointer dereference in au0828_analog_stream_enable()
	media: pvrusb2: Prevent a buffer overflow
	iio: adc: stm32-dfsdm: fix unmet direct dependencies detected
	block: fix use-after-free on gendisk
	powerpc/numa: improve control of topology updates
	powerpc/64: Fix booting large kernels with STRICT_KERNEL_RWX
	random: fix CRNG initialization when random.trust_cpu=1
	random: add a spinlock_t to struct batched_entropy
	cgroup: protect cgroup->nr_(dying_)descendants by css_set_lock
	sched/core: Check quota and period overflow at usec to nsec conversion
	sched/rt: Check integer overflow at usec to nsec conversion
	sched/core: Handle overflow in cpu_shares_write_u64
	staging: vc04_services: handle kzalloc failure
	drm/msm: a5xx: fix possible object reference leak
	irq_work: Do not raise an IPI when queueing work on the local CPU
	thunderbolt: Take domain lock in switch sysfs attribute callbacks
	s390/qeth: handle error from qeth_update_from_chp_desc()
	USB: core: Don't unbind interfaces following device reset failure
	x86/irq/64: Limit IST stack overflow check to #DB stack
	drm: etnaviv: avoid DMA API warning when importing buffers
	phy: sun4i-usb: Make sure to disable PHY0 passby for peripheral mode
	phy: mapphone-mdm6600: add gpiolib dependency
	i40e: Able to add up to 16 MAC filters on an untrusted VF
	i40e: don't allow changes to HW VLAN stripping on active port VLANs
	ACPI/IORT: Reject platform device creation on NUMA node mapping failure
	arm64: vdso: Fix clock_getres() for CLOCK_REALTIME
	RDMA/cxgb4: Fix null pointer dereference on alloc_skb failure
	perf/x86/msr: Add Icelake support
	perf/x86/intel/rapl: Add Icelake support
	perf/x86/intel/cstate: Add Icelake support
	hwmon: (vt1211) Use request_muxed_region for Super-IO accesses
	hwmon: (smsc47m1) Use request_muxed_region for Super-IO accesses
	hwmon: (smsc47b397) Use request_muxed_region for Super-IO accesses
	hwmon: (pc87427) Use request_muxed_region for Super-IO accesses
	hwmon: (f71805f) Use request_muxed_region for Super-IO accesses
	scsi: libsas: Do discovery on empty PHY to update PHY info
	mmc: core: make pwrseq_emmc (partially) support sleepy GPIO controllers
	mmc_spi: add a status check for spi_sync_locked
	mmc: sdhci-of-esdhc: add erratum eSDHC5 support
	mmc: sdhci-of-esdhc: add erratum A-009204 support
	mmc: sdhci-of-esdhc: add erratum eSDHC-A001 and A-008358 support
	drm/amdgpu: fix old fence check in amdgpu_fence_emit
	PM / core: Propagate dev->power.wakeup_path when no callbacks
	clk: rockchip: Fix video codec clocks on rk3288
	extcon: arizona: Disable mic detect if running when driver is removed
	clk: rockchip: Make rkpwm a critical clock on rk3288
	s390: zcrypt: initialize variables before_use
	x86/microcode: Fix the ancient deprecated microcode loading method
	s390/mm: silence compiler warning when compiling without CONFIG_PGSTE
	s390: cio: fix cio_irb declaration
	selftests: cgroup: fix cleanup path in test_memcg_subtree_control()
	qmi_wwan: Add quirk for Quectel dynamic config
	cpufreq: ppc_cbe: fix possible object reference leak
	cpufreq/pasemi: fix possible object reference leak
	cpufreq: pmac32: fix possible object reference leak
	cpufreq: kirkwood: fix possible object reference leak
	block: sed-opal: fix IOC_OPAL_ENABLE_DISABLE_MBR
	x86/build: Keep local relocations with ld.lld
	drm/pl111: fix possible object reference leak
	iio: ad_sigma_delta: Properly handle SPI bus locking vs CS assertion
	iio: hmc5843: fix potential NULL pointer dereferences
	iio: common: ssp_sensors: Initialize calculated_time in ssp_common_process_data
	iio: adc: ti-ads7950: Fix improper use of mlock
	selftests/bpf: ksym_search won't check symbols exists
	rtlwifi: fix a potential NULL pointer dereference
	mwifiex: Fix mem leak in mwifiex_tm_cmd
	brcmfmac: fix missing checks for kmemdup
	b43: shut up clang -Wuninitialized variable warning
	brcmfmac: convert dev_init_lock mutex to completion
	brcmfmac: fix WARNING during USB disconnect in case of unempty psq
	brcmfmac: fix race during disconnect when USB completion is in progress
	brcmfmac: fix Oops when bringing up interface during USB disconnect
	rtc: xgene: fix possible race condition
	rtlwifi: fix potential NULL pointer dereference
	scsi: ufs: Fix regulator load and icc-level configuration
	scsi: ufs: Avoid configuring regulator with undefined voltage range
	drm/panel: otm8009a: Add delay at the end of initialization
	arm64: cpu_ops: fix a leaked reference by adding missing of_node_put
	wil6210: fix return code of wmi_mgmt_tx and wmi_mgmt_tx_ext
	x86/uaccess, ftrace: Fix ftrace_likely_update() vs. SMAP
	x86/uaccess, signal: Fix AC=1 bloat
	x86/ia32: Fix ia32_restore_sigcontext() AC leak
	x86/uaccess: Fix up the fixup
	chardev: add additional check for minor range overlap
	RDMA/hns: Fix bad endianess of port_pd variable
	sh: sh7786: Add explicit I/O cast to sh7786_mm_sel()
	HID: core: move Usage Page concatenation to Main item
	ASoC: eukrea-tlv320: fix a leaked reference by adding missing of_node_put
	ASoC: fsl_utils: fix a leaked reference by adding missing of_node_put
	cxgb3/l2t: Fix undefined behaviour
	HID: logitech-hidpp: change low battery level threshold from 31 to 30 percent
	spi: tegra114: reset controller on probe
	kobject: Don't trigger kobject_uevent(KOBJ_REMOVE) twice.
	media: video-mux: fix null pointer dereferences
	media: wl128x: prevent two potential buffer overflows
	media: gspca: Kill URBs on USB device disconnect
	efifb: Omit memory map check on legacy boot
	thunderbolt: property: Fix a missing check of kzalloc
	thunderbolt: Fix to check the return value of kmemdup
	timekeeping: Force upper bound for setting CLOCK_REALTIME
	scsi: qedf: Add missing return in qedf_post_io_req() in the fcport offload check
	virtio_console: initialize vtermno value for ports
	tty: ipwireless: fix missing checks for ioremap
	overflow: Fix -Wtype-limits compilation warnings
	x86/mce: Fix machine_check_poll() tests for error types
	rcutorture: Fix cleanup path for invalid torture_type strings
	x86/mce: Handle varying MCA bank counts
	rcuperf: Fix cleanup path for invalid perf_type strings
	usb: core: Add PM runtime calls to usb_hcd_platform_shutdown
	scsi: qla4xxx: avoid freeing unallocated dma memory
	scsi: lpfc: avoid uninitialized variable warning
	selinux: avoid uninitialized variable warning
	batman-adv: allow updating DAT entry timeouts on incoming ARP Replies
	dmaengine: tegra210-adma: use devm_clk_*() helpers
	hwrng: omap - Set default quality
	thunderbolt: Fix to check return value of ida_simple_get
	thunderbolt: Fix to check for kmemdup failure
	drm/amd/display: fix releasing planes when exiting odm
	thunderbolt: property: Fix a NULL pointer dereference
	e1000e: Disable runtime PM on CNP+
	tinydrm/mipi-dbi: Use dma-safe buffers for all SPI transfers
	igb: Exclude device from suspend direct complete optimization
	media: si2165: fix a missing check of return value
	media: dvbsky: Avoid leaking dvb frontend
	media: m88ds3103: serialize reset messages in m88ds3103_set_frontend
	media: staging: davinci_vpfe: disallow building with COMPILE_TEST
	drm/amd/display: Fix Divide by 0 in memory calculations
	drm/amd/display: Set stream->mode_changed when connectors change
	scsi: ufs: fix a missing check of devm_reset_control_get
	media: vimc: stream: fix thread state before sleep
	media: gspca: do not resubmit URBs when streaming has stopped
	media: go7007: avoid clang frame overflow warning with KASAN
	media: vimc: zero the media_device on probe
	scsi: lpfc: Fix FDMI manufacturer attribute value
	scsi: lpfc: Fix fc4type information for FDMI
	media: saa7146: avoid high stack usage with clang
	scsi: lpfc: Fix SLI3 commands being issued on SLI4 devices
	spi : spi-topcliff-pch: Fix to handle empty DMA buffers
	drm/omap: dsi: Fix PM for display blank with paired dss_pll calls
	spi: rspi: Fix sequencer reset during initialization
	spi: imx: stop buffer overflow in RX FIFO flush
	spi: Fix zero length xfer bug
	ASoC: davinci-mcasp: Fix clang warning without CONFIG_PM
	drm/v3d: Handle errors from IRQ setup.
	drm/drv: Hold ref on parent device during drm_device lifetime
	drm: Wake up next in drm_read() chain if we are forced to putback the event
	drm/sun4i: dsi: Change the start delay calculation
	vfio-ccw: Prevent quiesce function going into an infinite loop
	drm/sun4i: dsi: Enforce boundaries on the start delay
	NFS: Fix a double unlock from nfs_match,get_client
	Linux 4.19.47

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-05-31 08:14:29 -07:00
Peter Zijlstra
1a3188d737 x86/uaccess, ftrace: Fix ftrace_likely_update() vs. SMAP
[ Upstream commit 4a6c91fbde ]

For CONFIG_TRACE_BRANCH_PROFILING=y the likely/unlikely things get
overloaded and generate callouts to this code, and thus also when
AC=1.

Make it safe.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-05-31 06:46:27 -07:00
Greg Kroah-Hartman
aa07ecba6f This is the 4.19.46 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlzpbCYACgkQONu9yGCS
 aT6aJhAAjh1h5q6oRAWZ7k3CTbx7abpi3FwqlGsrinxRkwdDvy6TXTo8gBn0emS0
 8TEiQXLm/6M3IGyR8m7w2TGxThyk5xtUqEbxldHwzU/wsZzJ8KegnQUbpmdmJtrh
 BnvPygwOSldm8fqNZsFNWNCwt0m9LqPm5m57lHOj4PsxRFkr6jVYjtrynTbyDBus
 fT4Dec/jD/0hZbP2aeS5YWNee1ElgiiRewU5q5+Dn8yIDlaX81hkiu+J/EUS/97n
 8Irn7Zs7wgjEwVe9xz1SEqAO0TtDH7wgxV2JMcXMRCbj45vmiUPh9IrSqqhvjqbf
 Gr36rGyuA2AIlMlzppEgP8ZiL6b5/2+e0mZFVfV4Ck3zThWq/pi8xrNk/AGVbXSA
 yE7j7PMVC0Pr9zFOBEsdb6HEOkwy4drGlSWiGkN5jZ5/yexGT4LhEpoMwqSd6tZ8
 p12OdVmrEYZyasKOEGyOLFvUWKDT+aClFXcnB0Vi3GNtw6K4aHJU1dtPcpeD+PvO
 qMY2ePAj3GXKcg+r4dQPcbO+xEer8JZS/clTXNVwArGMQ/KII6hz2XCeSXe+aVnA
 5SJZQnyimgaEev1Y1C7VVYBa4T+S54O+tjvKhv4fuX4vL622rLkUmMJyb2XWNSIC
 HagZOcEN7PY9KWqaMiP5GtcumfAUQCtNfXY0QMYhR+9B2Sl2zGg=
 =P21c
 -----END PGP SIGNATURE-----

Merge 4.19.46 into android-4.19

Changes in 4.19.46
	ipv6: fix src addr routing with the exception table
	ipv6: prevent possible fib6 leaks
	net: Always descend into dsa/
	net: avoid weird emergency message
	net/mlx4_core: Change the error print to info print
	net: test nouarg before dereferencing zerocopy pointers
	net: usb: qmi_wwan: add Telit 0x1260 and 0x1261 compositions
	nfp: flower: add rcu locks when accessing netdev for tunnels
	ppp: deflate: Fix possible crash in deflate_init
	rtnetlink: always put IFLA_LINK for links with a link-netnsid
	tipc: switch order of device registration to fix a crash
	vsock/virtio: free packets during the socket release
	tipc: fix modprobe tipc failed after switch order of device registration
	vsock/virtio: Initialize core virtio vsock before registering the driver
	net/mlx5: Imply MLXFW in mlx5_core
	net/mlx5e: Fix ethtool rxfh commands when CONFIG_MLX5_EN_RXNFC is disabled
	parisc: Export running_on_qemu symbol for modules
	parisc: Skip registering LED when running in QEMU
	parisc: Use PA_ASM_LEVEL in boot code
	parisc: Rename LEVEL to PA_ASM_LEVEL to avoid name clash with DRBD code
	stm class: Fix channel free in stm output free path
	stm class: Fix channel bitmap on 32-bit systems
	brd: re-enable __GFP_HIGHMEM in brd_insert_page()
	proc: prevent changes to overridden credentials
	Revert "MD: fix lock contention for flush bios"
	md: batch flush requests.
	md: add mddev->pers to avoid potential NULL pointer dereference
	dcache: sort the freeing-without-RCU-delay mess for good.
	intel_th: msu: Fix single mode with IOMMU
	p54: drop device reference count if fails to enable device
	of: fix clang -Wunsequenced for be32_to_cpu()
	cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level()
	phy: ti-pipe3: fix missing bit-wise or operator when assigning val
	media: ov6650: Fix sensor possibly not detected on probe
	media: imx: csi: Allow unknown nearest upstream entities
	media: imx: Clear fwnode link struct for each endpoint iteration
	NFS4: Fix v4.0 client state corruption when mount
	PNFS fallback to MDS if no deviceid found
	clk: hi3660: Mark clk_gate_ufs_subsys as critical
	clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider
	clk: mediatek: Disable tuner_en before change PLL rate
	clk: rockchip: fix wrong clock definitions for rk3328
	udlfb: delete the unused parameter for dlfb_handle_damage
	udlfb: fix sleeping inside spinlock
	udlfb: introduce a rendering mutex
	fuse: fix writepages on 32bit
	fuse: honor RLIMIT_FSIZE in fuse_file_fallocate
	ovl: fix missing upper fs freeze protection on copy up for ioctl
	iommu/tegra-smmu: Fix invalid ASID bits on Tegra30/114
	ceph: flush dirty inodes before proceeding with remount
	x86_64: Add gap to int3 to allow for call emulation
	x86_64: Allow breakpoints to emulate call instructions
	ftrace/x86_64: Emulate call function while updating in breakpoint handler
	tracing: Fix partial reading of trace event's id file
	memory: tegra: Fix integer overflow on tick value calculation
	perf intel-pt: Fix instructions sampling rate
	perf intel-pt: Fix improved sample timestamp
	perf intel-pt: Fix sample timestamp wrt non-taken branches
	MIPS: perf: Fix build with CONFIG_CPU_BMIPS5000 enabled
	objtool: Allow AR to be overridden with HOSTAR
	fbdev/efifb: Ignore framebuffer memmap entries that lack any memory types
	fbdev: sm712fb: fix brightness control on reboot, don't set SR30
	fbdev: sm712fb: fix VRAM detection, don't set SR70/71/74/75
	fbdev: sm712fb: fix white screen of death on reboot, don't set CR3B-CR3F
	fbdev: sm712fb: fix boot screen glitch when sm712fb replaces VGA
	fbdev: sm712fb: fix crashes during framebuffer writes by correctly mapping VRAM
	fbdev: sm712fb: fix support for 1024x768-16 mode
	fbdev: sm712fb: use 1024x768 by default on non-MIPS, fix garbled display
	fbdev: sm712fb: fix crashes and garbled display during DPMS modesetting
	PCI: Mark AMD Stoney Radeon R7 GPU ATS as broken
	PCI: Mark Atheros AR9462 to avoid bus reset
	PCI: Init PCIe feature bits for managed host bridge alloc
	PCI/AER: Change pci_aer_init() stub to return void
	PCI: rcar: Add the initialization of PCIe link in resume_noirq()
	PCI: Factor out pcie_retrain_link() function
	PCI: Work around Pericom PCIe-to-PCI bridge Retrain Link erratum
	dm cache metadata: Fix loading discard bitset
	dm zoned: Fix zone report handling
	dm delay: fix a crash when invalid device is specified
	dm integrity: correctly calculate the size of metadata area
	dm mpath: always free attached_handler_name in parse_path()
	fuse: Add FOPEN_STREAM to use stream_open()
	xfrm: policy: Fix out-of-bound array accesses in __xfrm_policy_unlink
	xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module
	vti4: ipip tunnel deregistration fixes.
	xfrm: clean up xfrm protocol checks
	esp4: add length check for UDP encapsulation
	xfrm: Honor original L3 slave device in xfrmi policy lookup
	xfrm4: Fix uninitialized memory read in _decode_session4
	clk: sunxi-ng: nkmp: Avoid GENMASK(-1, 0)
	power: supply: cpcap-battery: Fix division by zero
	securityfs: fix use-after-free on symlink traversal
	apparmorfs: fix use-after-free on symlink traversal
	PCI: Fix issue with "pci=disable_acs_redir" parameter being ignored
	x86: kvm: hyper-v: deal with buggy TLB flush requests from WS2012
	mac80211: Fix kernel panic due to use of txq after free
	net: ieee802154: fix missing checks for regmap_update_bits
	KVM: arm/arm64: Ensure vcpu target is unset on reset failure
	power: supply: sysfs: prevent endless uevent loop with CONFIG_POWER_SUPPLY_DEBUG
	bpf: Fix preempt_enable_no_resched() abuse
	qmi_wwan: new Wistron, ZTE and D-Link devices
	iwlwifi: mvm: check for length correctness in iwl_mvm_create_skb()
	sched/cpufreq: Fix kobject memleak
	x86/mm/mem_encrypt: Disable all instrumentation for early SME setup
	ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour
	perf bench numa: Add define for RUSAGE_THREAD if not present
	perf/x86/intel: Fix race in intel_pmu_disable_event()
	Revert "Don't jump to compute_result state from check_result state"
	md/raid: raid5 preserve the writeback action after the parity check
	driver core: Postpone DMA tear-down until after devres release for probe failure
	Revert "selftests/bpf: skip verifier tests for unsupported program types"
	bpf: relax inode permission check for retrieving bpf program
	bpf: add map_lookup_elem_sys_only for lookups from syscall side
	bpf, lru: avoid messing with eviction heuristics upon syscall lookup
	fbdev: sm712fb: fix memory frequency by avoiding a switch/case fallthrough
	Linux 4.19.46

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-05-25 19:09:59 +02:00
Elazar Leibovich
fb8c9c900d tracing: Fix partial reading of trace event's id file
commit cbe08bcbbe upstream.

When reading only part of the id file, the ppos isn't tracked correctly.
This is taken care by simple_read_from_buffer.

Reading a single byte, and then the next byte would result EOF.

While this seems like not a big deal, this breaks abstractions that
reads information from files unbuffered. See for example
https://github.com/golang/go/issues/29399

This code was mentioned as problematic in
commit cd458ba9d5
("tracing: Do not (ab)use trace_seq in event_id_read()")

An example C code that show this bug is:

  #include <stdio.h>
  #include <stdint.h>

  #include <sys/types.h>
  #include <sys/stat.h>
  #include <fcntl.h>
  #include <unistd.h>

  int main(int argc, char **argv) {
    if (argc < 2)
      return 1;
    int fd = open(argv[1], O_RDONLY);
    char c;
    read(fd, &c, 1);
    printf("First  %c\n", c);
    read(fd, &c, 1);
    printf("Second %c\n", c);
  }

Then run with, e.g.

  sudo ./a.out /sys/kernel/debug/tracing/events/tcp/tcp_set_state/id

You'll notice you're getting the first character twice, instead of the
first two characters in the id file.

Link: http://lkml.kernel.org/r/20181231115837.4932-1-elazar@lightbitslabs.com

Cc: Orit Wasserman <orit.was@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: stable@vger.kernel.org
Fixes: 23725aeeab ("ftrace: provide an id file for each event")
Signed-off-by: Elazar Leibovich <elazar@lightbitslabs.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-25 18:23:32 +02:00
Sami Tolvanen
b4a47b3387 ANDROID: ftrace: fix function type mismatches
This change fixes indirect call mismatches with function and function
graph tracing, which trip Control-Flow Integrity (CFI) checking.

Bug: 79510107
Bug: 67506682
Bug: 133186739
Change-Id: I5de08c113fb970ffefedce93c58e0161f22c7ca2
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2019-05-20 17:46:45 -07:00
Sami Tolvanen
c274f8308e FROMLIST: kbuild: fix dynamic ftrace with clang LTO
With CONFIG_LTO_CLANG enabled, LLVM IR won't be compiled into object
files until modpost_link. This change postpones calls to recordmcount
until after this step.

In order to exclude ftrace_process_locs from inspection, we add a new
code section .text..ftrace, which we tell recordmcount to ignore, and
a __norecordmcount attribute for moving functions to this section.

Bug: 62093296
Bug: 67506682
Bug: 133186739
Change-Id: Iba2c053968206acf533fadab1eb34a743b5088ee
(am from https://patchwork.kernel.org/patch/10060327/)
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2019-05-20 17:43:20 -07:00
Matthew Wilcox
0311ff82b7 fs: prevent page refcount overflow in pipe_buf_get
commit 15fab63e1e upstream.

Change pipe_buf_get() to return a bool indicating whether it succeeded
in raising the refcount of the page (if the thing in the pipe is a page).
This removes another mechanism for overflowing the page refcount.  All
callers converted to handle a failure.

Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Matthew Wilcox <willy@infradead.org>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-04 09:20:11 +02:00
Peter Zijlstra
d0264d10ae trace: Fix preempt_enable_no_resched() abuse
commit d6097c9e44 upstream.

Unless the very next line is schedule(), or implies it, one must not use
preempt_enable_no_resched(). It can cause a preemption to go missing and
thereby cause arbitrary delays, breaking the PREEMPT=y invariant.

Link: http://lkml.kernel.org/r/20190423200318.GY14281@hirez.programming.kicks-ass.net

Cc: Waiman Long <longman@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: the arch/x86 maintainers <x86@kernel.org>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Tim Chen <tim.c.chen@linux.intel.com>
Cc: huang ying <huang.ying.caritas@gmail.com>
Cc: Roman Gushchin <guro@fb.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: stable@vger.kernel.org
Fixes: 2c2d7329d8 ("tracing/ftrace: use preempt_enable_no_resched_notrace in ring_buffer_time_stamp()")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-02 09:58:54 +02:00
Jann Horn
cffeb9c84d tracing: Fix buffer_ref pipe ops
commit b987222654 upstream.

This fixes multiple issues in buffer_pipe_buf_ops:

 - The ->steal() handler must not return zero unless the pipe buffer has
   the only reference to the page. But generic_pipe_buf_steal() assumes
   that every reference to the pipe is tracked by the page's refcount,
   which isn't true for these buffers - buffer_pipe_buf_get(), which
   duplicates a buffer, doesn't touch the page's refcount.
   Fix it by using generic_pipe_buf_nosteal(), which refuses every
   attempted theft. It should be easy to actually support ->steal, but the
   only current users of pipe_buf_steal() are the virtio console and FUSE,
   and they also only use it as an optimization. So it's probably not worth
   the effort.
 - The ->get() and ->release() handlers can be invoked concurrently on pipe
   buffers backed by the same struct buffer_ref. Make them safe against
   concurrency by using refcount_t.
 - The pointers stored in ->private were only zeroed out when the last
   reference to the buffer_ref was dropped. As far as I know, this
   shouldn't be necessary anyway, but if we do it, let's always do it.

Link: http://lkml.kernel.org/r/20190404215925.253531-1-jannh@google.com

Cc: Ingo Molnar <mingo@redhat.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: stable@vger.kernel.org
Fixes: 73a757e631 ("ring-buffer: Return reader page back into existing ring buffer")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-02 09:58:53 +02:00
Wenwen Wang
0e78e92da2 tracing: Fix a memory leak by early error exit in trace_pid_write()
commit 91862cc786 upstream.

In trace_pid_write(), the buffer for trace parser is allocated through
kmalloc() in trace_parser_get_init(). Later on, after the buffer is used,
it is then freed through kfree() in trace_parser_put(). However, it is
possible that trace_pid_write() is terminated due to unexpected errors,
e.g., ENOMEM. In that case, the allocated buffer will not be freed, which
is a memory leak bug.

To fix this issue, free the allocated buffer when an error is encountered.

Link: http://lkml.kernel.org/r/1555726979-15633-1-git-send-email-wang6495@umn.edu

Fixes: f4d34a87e9 ("tracing: Use pid bitmap instead of a pid array for set_event_pid")
Cc: stable@vger.kernel.org
Signed-off-by: Wenwen Wang <wang6495@umn.edu>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-02 09:58:53 +02:00
Masami Hiramatsu
426e2a8024 kprobes: Mark ftrace mcount handler functions nokprobe
commit fabe38ab6b upstream.

Mark ftrace mcount handler functions nokprobe since
probing on these functions with kretprobe pushes
return address incorrectly on kretprobe shadow stack.

Reported-by: Francis Deslauriers <francis.deslauriers@efficios.com>
Tested-by: Andrea Righi <righi.andrea@gmail.com>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Acked-by: Steven Rostedt <rostedt@goodmis.org>
Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/155094062044.6137.6419622920568680640.stgit@devbox
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-04-27 09:36:37 +02:00
Douglas Anderson
b73c7d0204 tracing: kdb: Fix ftdump to not sleep
[ Upstream commit 31b265b3ba ]

As reported back in 2016-11 [1], the "ftdump" kdb command triggers a
BUG for "sleeping function called from invalid context".

kdb's "ftdump" command wants to call ring_buffer_read_prepare() in
atomic context.  A very simple solution for this is to add allocation
flags to ring_buffer_read_prepare() so kdb can call it without
triggering the allocation error.  This patch does that.

Note that in the original email thread about this, it was suggested
that perhaps the solution for kdb was to either preallocate the buffer
ahead of time or create our own iterator.  I'm hoping that this
alternative of adding allocation flags to ring_buffer_read_prepare()
can be considered since it means I don't need to duplicate more of the
core trace code into "trace_kdb.c" (for either creating my own
iterator or re-preparing a ring allocator whose memory was already
allocated).

NOTE: another option for kdb is to actually figure out how to make it
reuse the existing ftrace_dump() function and totally eliminate the
duplication.  This sounds very appealing and actually works (the "sr
z" command can be seen to properly dump the ftrace buffer).  The
downside here is that ftrace_dump() fully consumes the trace buffer.
Unless that is changed I'd rather not use it because it means "ftdump
| grep xyz" won't be very useful to search the ftrace buffer since it
will throw away the whole trace on the first grep.  A future patch to
dump only the last few lines of the buffer will also be hard to
implement.

[1] https://lkml.kernel.org/r/20161117191605.GA21459@google.com

Link: http://lkml.kernel.org/r/20190308193205.213659-1-dianders@chromium.org

Reported-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-04-05 22:32:56 +02:00
Jann Horn
24d5097655 tracing/perf: Use strndup_user() instead of buggy open-coded version
commit 83540fbc88 upstream.

The first version of this method was missing the check for
`ret == PATH_MAX`; then such a check was added, but it didn't call kfree()
on error, so there was still a small memory leak in the error case.
Fix it by using strndup_user() instead of open-coding it.

Link: http://lkml.kernel.org/r/20190220165443.152385-1-jannh@google.com

Cc: Ingo Molnar <mingo@kernel.org>
Cc: stable@vger.kernel.org
Fixes: 0eadcc7a7b ("perf/core: Fix perf_uprobe_init()")
Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-23 20:09:56 +01:00
zhangyi (F)
f27077e5f5 tracing: Do not free iter->trace in fail path of tracing_open_pipe()
commit e7f0c424d0 upstream.

Commit d716ff71dd ("tracing: Remove taking of trace_types_lock in
pipe files") use the current tracer instead of the copy in
tracing_open_pipe(), but it forget to remove the freeing sentence in
the error path.

There's an error path that can call kfree(iter->trace) after the iter->trace
was assigned to tr->current_trace, which would be bad to free.

Link: http://lkml.kernel.org/r/1550060946-45984-1-git-send-email-yi.zhang@huawei.com

Cc: stable@vger.kernel.org
Fixes: d716ff71dd ("tracing: Remove taking of trace_types_lock in pipe files")
Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-23 20:09:56 +01:00