shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-04-01 10:42:58 +09:00
Code Issues Packages Projects Releases Wiki Activity
661,685 Commits 55 Branches 2,486 Tags
16ce487b86fe055ee2efb84ab53cd12802dc509e
Commit Graph

1647 Commits

Author SHA1 Message Date
Helge Deller
aeca673cc2 parisc: Fix ptrace check on syscall return 
commit 8779e05ba8 upstream.

The TIF_XXX flags are stored in the flags field in the thread_info
struct (TI_FLAGS), not in the flags field of the task_struct structure
(TASK_FLAGS).

It seems this bug didn't generate any important side-effects, otherwise it
wouldn't have went unnoticed for 12 years (since v2.6.32).

Signed-off-by: Helge Deller <deller@gmx.de>
Fixes: ecd3d4bc06 ("parisc: stop using task->ptrace for {single,block}step flags")
Cc: Kyle McMartin <kyle@mcmartin.ca>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-16 12:09:00 +09:00
Helge Deller
d82a911238 parisc: Use absolute_pointer() to define PAGE0 
[ Upstream commit 90cc7bed1e ]

Use absolute_pointer() wrapper for PAGE0 to avoid this compiler warning:

  arch/parisc/kernel/setup.c: In function 'start_parisc':
  error: '__builtin_memcmp_eq' specified bound 8 exceeds source size 0

Signed-off-by: Helge Deller <deller@gmx.de>
Co-Developed-by: Guenter Roeck <linux@roeck-us.net>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-05-16 11:53:28 +09:00
Mikulas Patocka
60f100a3cd parisc: fix crash with signals and alloca 
commit 030f653078 upstream.

I was debugging some crashes on parisc and I found out that there is a
crash possibility if a function using alloca is interrupted by a signal.
The reason for the crash is that the gcc alloca implementation leaves
garbage in the upper 32 bits of the sp register. This normally doesn't
matter (the upper bits are ignored because the PSW W-bit is clear),
however the signal delivery routine in the kernel uses full 64 bits of sp
and it fails with -EFAULT if the upper 32 bits are not zero.

I created this program that demonstrates the problem:

#include <stdlib.h>
#include <unistd.h>
#include <signal.h>
#include <alloca.h>

static __attribute__((noinline,noclone)) void aa(int *size)
{
	void * volatile p = alloca(-*size);
	while (1) ;
}

static void handler(int sig)
{
	write(1, "signal delivered\n", 17);
	_exit(0);
}

int main(void)
{
	int size = -0x100;
	signal(SIGALRM, handler);
	alarm(1);
	aa(&size);
}

If you compile it with optimizations, it will crash.
The "aa" function has this disassembly:

000106a0 <aa>:
   106a0:       08 03 02 41     copy r3,r1
   106a4:       08 1e 02 43     copy sp,r3
   106a8:       6f c1 00 80     stw,ma r1,40(sp)
   106ac:       37 dc 3f c1     ldo -20(sp),ret0
   106b0:       0c 7c 12 90     stw ret0,8(r3)
   106b4:       0f 40 10 9c     ldw 0(r26),ret0		; ret0 = 0x00000000FFFFFF00
   106b8:       97 9c 00 7e     subi 3f,ret0,ret0	; ret0 = 0xFFFFFFFF0000013F
   106bc:       d7 80 1c 1a     depwi 0,31,6,ret0	; ret0 = 0xFFFFFFFF00000100
   106c0:       0b 9e 0a 1e     add,l sp,ret0,sp	;   sp = 0xFFFFFFFFxxxxxxxx
   106c4:       e8 1f 1f f7     b,l,n 106c4 <aa+0x24>,r0

This patch fixes the bug by truncating the "usp" variable to 32 bits.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-16 11:46:29 +09:00
Gao Xiang
d42c46f3fb parisc: avoid a warning on u8 cast for cmpxchg on u8 pointers 
commit 4d752e5af6 upstream.

commit b344d6a83d ("parisc: add support for cmpxchg on u8 pointers")
can generate a sparse warning ("cast truncates bits from constant
value"), which has been reported several times [1] [2] [3].

The original code worked as expected, but anyway, let silence such
sparse warning as what others did [4].

[1] https://lore.kernel.org/r/202104061220.nRMBwCXw-lkp@intel.com
[2] https://lore.kernel.org/r/202012291914.T5Agcn99-lkp@intel.com
[3] https://lore.kernel.org/r/202008210829.KVwn7Xeh%25lkp@intel.com
[4] https://lore.kernel.org/r/20210315131512.133720-2-jacopo+renesas@jmondi.org
Cc: Liam Beguin <liambeguin@gmail.com>
Cc: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org # v5.8+
Signed-off-by: Gao Xiang <hsiangkao@redhat.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-16 10:51:37 +09:00
Liam Beguin
a2587870ba parisc: add support for cmpxchg on u8 pointers 
[ Upstream commit b344d6a83d ]

The kernel test bot reported[1] that using set_mask_bits on a u8 causes
the following issue on parisc:

	hppa-linux-ld: drivers/phy/ti/phy-tusb1210.o: in function `tusb1210_probe':
	>> (.text+0x2f4): undefined reference to `__cmpxchg_called_with_bad_pointer'
	>> hppa-linux-ld: (.text+0x324): undefined reference to `__cmpxchg_called_with_bad_pointer'
	hppa-linux-ld: (.text+0x354): undefined reference to `__cmpxchg_called_with_bad_pointer'

Add support for cmpxchg on u8 pointers.

[1] https://lore.kernel.org/patchwork/patch/1272617/#1468946

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Liam Beguin <liambeguin@gmail.com>
Tested-by: Dave Anglin <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-05-16 08:44:32 +09:00
John David Anglin
beb59f93b1 parisc: Add atomic64_set_release() define to avoid CPU soft lockups 
commit be6577af0c upstream.

Stalls are quite frequent with recent kernels. I enabled
CONFIG_SOFTLOCKUP_DETECTOR and I caught the following stall:

watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [cc1:22803]
CPU: 0 PID: 22803 Comm: cc1 Not tainted 5.6.17+ #3
Hardware name: 9000/800/rp3440
 IAOQ[0]: d_alloc_parallel+0x384/0x688
 IAOQ[1]: d_alloc_parallel+0x388/0x688
 RP(r2): d_alloc_parallel+0x134/0x688
Backtrace:
 [<000000004036974c>] __lookup_slow+0xa4/0x200
 [<0000000040369fc8>] walk_component+0x288/0x458
 [<000000004036a9a0>] path_lookupat+0x88/0x198
 [<000000004036e748>] filename_lookup+0xa0/0x168
 [<000000004036e95c>] user_path_at_empty+0x64/0x80
 [<000000004035d93c>] vfs_statx+0x104/0x158
 [<000000004035dfcc>] __do_sys_lstat64+0x44/0x80
 [<000000004035e5a0>] sys_lstat64+0x20/0x38
 [<0000000040180054>] syscall_exit+0x0/0x14

The code was stuck in this loop in d_alloc_parallel:

    4037d414:   0e 00 10 dc     ldd 0(r16),ret0
    4037d418:   c7 fc 5f ed     bb,< ret0,1f,4037d414 <d_alloc_parallel+0x384>
    4037d41c:   08 00 02 40     nop

This is the inner loop of bit_spin_lock which is called by hlist_bl_unlock in
d_alloc_parallel:

static inline void bit_spin_lock(int bitnum, unsigned long *addr)
{
        /*
         * Assuming the lock is uncontended, this never enters
         * the body of the outer loop. If it is contended, then
         * within the inner loop a non-atomic test is used to
         * busywait with less bus contention for a good time to
         * attempt to acquire the lock bit.
         */
        preempt_disable();
#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
        while (unlikely(test_and_set_bit_lock(bitnum, addr))) {
                preempt_enable();
                do {
                        cpu_relax();
                } while (test_bit(bitnum, addr));
                preempt_disable();
        }
#endif
        __acquire(bitlock);
}

After consideration, I realized that we must be losing bit unlocks.
Then, I noticed that we missed defining atomic64_set_release().
Adding this define fixes the stalls in bit operations.

Signed-off-by: Dave Anglin <dave.anglin@bell.net>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-16 08:38:48 +09:00
Helge Deller
b79f191695 parisc: Fix kernel panic in mem_init() 
commit bf71bc16e0 upstream.

The Debian kernel v5.6 triggers this kernel panic:

 Kernel panic - not syncing: Bad Address (null pointer deref?)
 Bad Address (null pointer deref?): Code=26 (Data memory access rights trap) at addr 0000000000000000
 CPU: 0 PID: 0 Comm: swapper Not tainted 5.6.0-2-parisc64 #1 Debian 5.6.14-1
  IAOQ[0]: mem_init+0xb0/0x150
  IAOQ[1]: mem_init+0xb4/0x150
  RP(r2): start_kernel+0x6c8/0x1190
 Backtrace:
  [<0000000040101ab4>] start_kernel+0x6c8/0x1190
  [<0000000040108574>] start_parisc+0x158/0x1b8

on a HP-PARISC rp3440 machine with this memory layout:
 Memory Ranges:
  0) Start 0x0000000000000000 End 0x000000003fffffff Size   1024 MB
  1) Start 0x0000004040000000 End 0x00000040ffdfffff Size   3070 MB

Fix the crash by avoiding virt_to_page() and similar functions in
mem_init() until the memory zones have been fully set up.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org # v5.0+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-15 17:30:23 +09:00
Helge Deller
c5463d35d2 parisc: Fix compiler warnings in debug_core.c 
[ Upstream commit 75cf979700 ]

Fix this compiler warning:
kernel/debug/debug_core.c: In function ‘kgdb_cpu_enter’:
arch/parisc/include/asm/cmpxchg.h:48:3: warning: value computed is not used [-Wunused-value]
   48 |  ((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr))))
arch/parisc/include/asm/atomic.h:78:30: note: in expansion of macro ‘xchg’
   78 | #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
      |                              ^~~~
kernel/debug/debug_core.c:596:4: note: in expansion of macro ‘atomic_xchg’
  596 |    atomic_xchg(&kgdb_active, cpu);
      |    ^~~~~~~~~~~

Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-05-15 16:32:39 +09:00
Helge Deller
1203e8565c parisc: Fix vmap memory leak in ioremap()/iounmap() 
commit 513f7f747e upstream.

Sven noticed that calling ioremap() and iounmap() multiple times leads
to a vmap memory leak:
	vmap allocation for size 4198400 failed:
	use vmalloc=<size> to increase size

It seems we missed calling vunmap() in iounmap().

Signed-off-by: Helge Deller <deller@gmx.de>
Noticed-by: Sven Schnelle <svens@stackframe.org>
Cc: <stable@vger.kernel.org> # v3.16+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-15 14:50:56 +09:00
Helge Deller
3a516c4d2b parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1 
commit 10835c8546 upstream.

On parisc the privilege level of a process is stored in the lowest two bits of
the instruction pointers (IAOQ0 and IAOQ1). On Linux we use privilege level 0
for the kernel and privilege level 3 for user-space. So userspace should not be
allowed to modify IAOQ0 or IAOQ1 of a ptraced process to change it's privilege
level to e.g. 0 to try to gain kernel privileges.

This patch prevents such modifications by always setting the two lowest bits to
one (which relates to privilege level 3 for user-space) if IAOQ0 or IAOQ1 are
modified via ptrace calls in the native and compat ptrace paths.

Link: https://bugs.gentoo.org/481768
Reported-by: Jeroen Roovers <jer@gentoo.org>
Cc: <stable@vger.kernel.org>
Tested-by: Rolf Eike Beer <eike-kernel@sf-tec.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-15 14:02:53 +09:00
Helge Deller
18a4b2335f parisc: Ensure userspace privilege for ptraced processes in regset functions 
commit 34c32fc603 upstream.

On parisc the privilege level of a process is stored in the lowest two bits of
the instruction pointers (IAOQ0 and IAOQ1). On Linux we use privilege level 0
for the kernel and privilege level 3 for user-space. So userspace should not be
allowed to modify IAOQ0 or IAOQ1 of a ptraced process to change it's privilege
level to e.g. 0 to try to gain kernel privileges.

This patch prevents such modifications in the regset support functions by
always setting the two lowest bits to one (which relates to privilege level 3
for user-space) if IAOQ0 or IAOQ1 are modified via ptrace regset calls.

Link: https://bugs.gentoo.org/481768
Cc: <stable@vger.kernel.org> # v4.7+
Tested-by: Rolf Eike Beer <eike-kernel@sf-tec.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-15 14:02:51 +09:00
Helge Deller
9779765098 parisc: Fix compiler warnings in float emulation code 
[ Upstream commit 6b98d9134e ]

Avoid such compiler warnings:
arch/parisc/math-emu/cnv_float.h:71:27: warning: ‘<<’ in boolean context, did you mean ‘<’ ? [-Wint-in-bool-context]
     ((Dintp1(dint_valueA) << 33 - SGL_EXP_LENGTH) || Dintp2(dint_valueB))
arch/parisc/math-emu/fcnvxf.c:257:6: note: in expansion of macro ‘Dint_isinexact_to_sgl’
  if (Dint_isinexact_to_sgl(srcp1,srcp2)) {

Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-05-15 13:54:48 +09:00
Helge Deller
d3c689b933 parisc: Rename LEVEL to PA_ASM_LEVEL to avoid name clash with DRBD code 
commit 1829dda0e8 upstream.

LEVEL is a very common word, and now after many years it suddenly
clashed with another LEVEL define in the DRBD code.
Rename it to PA_ASM_LEVEL instead.

Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-15 12:52:25 +09:00
Helge Deller
0d92b94c70 parisc: Export running_on_qemu symbol for modules 
commit 3e1120f4b5 upstream.

Signed-off-by: Helge Deller <deller@gmx.de>
CC: stable@vger.kernel.org # v4.9+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-15 12:52:22 +09:00
Helge Deller
725c6e0302 parisc: Use cr16 interval timers unconditionally on qemu 
commit 5ffa851885 upstream.

When running on qemu we know that the (emulated) cr16 cpu-internal
clocks are syncronized. So let's use them unconditionally on qemu.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org # 4.14+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-15 12:22:47 +09:00
Helge Deller
c12c101241 parisc: Detect QEMU earlier in boot process 
commit d006e95b55 upstream.

While adding LASI support to QEMU, I noticed that the QEMU detection in
the kernel happens much too late. For example, when a LASI chip is found
by the kernel, it registers the LASI LED driver as well.  But when we
run on QEMU it makes sense to avoid spending unnecessary CPU cycles, so
we need to access the running_on_QEMU flag earlier than before.

This patch now makes the QEMU detection the fist task of the Linux
kernel by moving it to where the kernel enters the C-coding.

Fixes: 310d82784f ("parisc: qemu idle sleep support")
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org # v4.14+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-15 12:22:41 +09:00
Dmitry V. Levin
ef172a5400 parisc: Fix ptrace syscall number modification 
commit b7dc5a071d upstream.

Commit 910cd32e55 ("parisc: Fix and enable seccomp filter support")
introduced a regression in ptrace-based syscall tampering: when tracer
changes syscall number to -1, the kernel fails to initialize %r28 with
-ENOSYS and subsequently fails to return the error code of the failed
syscall to userspace.

This erroneous behaviour could be observed with a simple strace syscall
fault injection command which is expected to print something like this:

$ strace -a0 -ewrite -einject=write:error=enospc echo hello
write(1, "hello\n", 6) = -1 ENOSPC (No space left on device) (INJECTED)
write(2, "echo: ", 6) = -1 ENOSPC (No space left on device) (INJECTED)
write(2, "write error", 11) = -1 ENOSPC (No space left on device) (INJECTED)
write(2, "\n", 1) = -1 ENOSPC (No space left on device) (INJECTED)
+++ exited with 1 +++

After commit 910cd32e55 it loops printing
something like this instead:

write(1, "hello\n", 6../strace: Failed to tamper with process 12345: unexpectedly got no error (return value 0, error 0)
) = 0 (INJECTED)

This bug was found by strace test suite.

Fixes: 910cd32e55 ("parisc: Fix and enable seccomp filter support")
Cc: stable@vger.kernel.org # v4.5+
Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
Tested-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-15 11:45:05 +09:00
Helge Deller
080d57cda1 parisc: Fix exported address of os_hpmc handler 
[ Upstream commit 99a3ae51d5 ]

In the C-code we need to put the physical address of the hpmc handler in
the interrupt vector table (IVA) in order to get HPMCs working.  Since
on parisc64 function pointers are indirect (in fact they are function
descriptors) we instead export the address as variable and not as
function.

This reverts a small part of commit f39cce654f ("parisc: Add
cfi_startproc and cfi_endproc to assembly code").

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org>    [4.9+]
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-05-15 09:26:51 +09:00
Helge Deller
c34f240b1e parisc: Fix HPMC handler by increasing size to multiple of 16 bytes 
[ Upstream commit d5654e156b ]

Make sure that the HPMC (High Priority Machine Check) handler is 16-byte
aligned and that it's length in the IVT is a multiple of 16 bytes.
Otherwise PDC may decide not to call the HPMC crash handler.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-05-15 09:26:50 +09:00
Helge Deller
4a22e34b7d parisc: Align os_hpmc_size on word boundary 
[ Upstream commit 0ed9d3de5f ]

The os_hpmc_size variable sometimes wasn't aligned at word boundary and thus
triggered the unaligned fault handler at startup.
Fix it by aligning it properly.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org> # v4.14+
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-05-15 09:26:49 +09:00
Helge Deller
c8372417f2 parisc: Fix map_pages() to not overwrite existing pte entries 
commit 3c229b3f2d upstream.

Fix a long-existing small nasty bug in the map_pages() implementation which
leads to overwriting already written pte entries with zero, *if* map_pages() is
called a second time with an end address which isn't aligned on a pmd boundry.
This happens for example if we want to remap only the text segment read/write
in order to run alternative patching on the code. Exiting the loop when we
reach the end address fixes this.

Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-15 09:18:58 +09:00
John David Anglin
7a2b97c674 parisc: Fix address in HPMC IVA 
commit 1138b6718f upstream.

Helge noticed that the address of the os_hpmc handler was not being
correctly calculated in the hpmc macro.  As a result, PDCE_CHECK would
fail to call os_hpmc:

<Cpu2> e800009802e00000  0000000000000000  CC_ERR_CHECK_HPMC
<Cpu2> 37000f7302e00000  8040004000000000  CC_ERR_CPU_CHECK_SUMMARY
<Cpu2> f600105e02e00000  fffffff0f0c00000  CC_MC_HPMC_MONARCH_SELECTED
<Cpu2> 140003b202e00000  000000000000000b  CC_ERR_HPMC_STATE_ENTRY
<Cpu2> 5600100b02e00000  00000000000001a0  CC_MC_OS_HPMC_LEN_ERR
<Cpu2> 5600106402e00000  fffffff0f0438e70  CC_MC_BR_TO_OS_HPMC_FAILED
<Cpu2> e800009802e00000  0000000000000000  CC_ERR_CHECK_HPMC
<Cpu2> 37000f7302e00000  8040004000000000  CC_ERR_CPU_CHECK_SUMMARY
<Cpu2> 4000109f02e00000  0000000000000000  CC_MC_HPMC_INITIATED
<Cpu2> 4000101902e00000  0000000000000000  CC_MC_MULTIPLE_HPMCS
<Cpu2> 030010d502e00000  0000000000000000  CC_CPU_STOP

The address problem can be seen by dumping the fault vector:

0000000040159000 <fault_vector_20>:
    40159000:   63 6f 77 73     stb r15,-2447(dp)
    40159004:   20 63 61 6e     ldil L%b747000,r3
    40159008:   20 66 6c 79     ldil L%-1c3b3000,r3
        ...
    40159020:   08 00 02 40     nop
    40159024:   20 6e 60 02     ldil L%15d000,r3
    40159028:   34 63 00 00     ldo 0(r3),r3
    4015902c:   e8 60 c0 02     bv,n r0(r3)
    40159030:   08 00 02 40     nop
    40159034:   00 00 00 00     break 0,0
    40159038:   c0 00 70 00     bb,*< r0,sar,40159840 <fault_vector_20+0x840>
    4015903c:   00 00 00 00     break 0,0

Location 40159038 should contain the physical address of os_hpmc:

000000004015d000 <os_hpmc>:
    4015d000:   08 1a 02 43     copy r26,r3
    4015d004:   01 c0 08 a4     mfctl iva,r4
    4015d008:   48 85 00 68     ldw 34(r4),r5

This patch moves the address setup into initialize_ivt to resolve the
above problem.  I tested the change by dumping the HPMC entry after setup:

0000000040209020:  8000240
0000000040209024: 206a2004
0000000040209028: 34630ac0
000000004020902c: e860c002
0000000040209030:  8000240
0000000040209034: 1bdddce6
0000000040209038:   15d000
000000004020903c:      1a0

Signed-off-by: John David Anglin <dave.anglin@bell.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-15 09:18:57 +09:00
John David Anglin
01be60d66a parisc: Remove unnecessary barriers from spinlock.h 
commit 3b885ac1dc upstream.

Now that mb() is an instruction barrier, it will slow performance if we issue
unnecessary barriers.

The spinlock defines have a number of unnecessary barriers.  The __ldcw()
define is both a hardware and compiler barrier.  The mb() barriers in the
routines using __ldcw() serve no purpose.

The only barrier needed is the one in arch_spin_unlock().  We need to ensure
all accesses are complete prior to releasing the lock.

Signed-off-by: John David Anglin <dave.anglin@bell.net>
Cc: stable@vger.kernel.org # 4.0+
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-12 17:07:57 +09:00
John David Anglin
698df6e939 parisc: Remove ordered stores from syscall.S 
commit 7797167ffd upstream.

Now that we use a sync prior to releasing the locks in syscall.S, we don't need
the PA 2.0 ordered stores used to release some locks.  Using an ordered store,
potentially slows the release and subsequent code.

There are a number of other ordered stores and loads that serve no purpose.  I
have converted these to normal stores.

Signed-off-by: John David Anglin <dave.anglin@bell.net>
Cc: stable@vger.kernel.org # 4.0+
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-12 17:07:48 +09:00
John David Anglin
700349754e parisc: Define mb() and add memory barriers to assembler unlock sequences 
commit fedb8da963 upstream.

For years I thought all parisc machines executed loads and stores in
order. However, Jeff Law recently indicated on gcc-patches that this is
not correct. There are various degrees of out-of-order execution all the
way back to the PA7xxx processor series (hit-under-miss). The PA8xxx
series has full out-of-order execution for both integer operations, and
loads and stores.

This is described in the following article:
http://web.archive.org/web/20040214092531/http://www.cpus.hp.com/technical_references/advperf.shtml

For this reason, we need to define mb() and to insert a memory barrier
before the store unlocking spinlocks. This ensures that all memory
accesses are complete prior to unlocking. The ldcw instruction performs
the same function on entry.

Signed-off-by: John David Anglin <dave.anglin@bell.net>
Cc: stable@vger.kernel.org # 4.0+
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-12 16:46:36 +09:00
Helge Deller
cca098c503 parisc: Enable CONFIG_MLONGCALLS by default 
commit 66509a276c upstream.

Enable the -mlong-calls compiler option by default, because otherwise in most
cases linking the vmlinux binary fails due to truncations of R_PARISC_PCREL22F
relocations. This fixes building the 64-bit defconfig.

Cc: stable@vger.kernel.org # 4.0+
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-12 16:46:34 +09:00
Greg Kroah-Hartman
aef17a58e8 Merge 4.9.101 into android-4.9 
Changes in 4.9.101
	8139too: Use disable_irq_nosync() in rtl8139_poll_controller()
	bridge: check iface upper dev when setting master via ioctl
	dccp: fix tasklet usage
	ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg
	llc: better deal with too small mtu
	net: ethernet: sun: niu set correct packet size in skb
	net: ethernet: ti: cpsw: fix packet leaking in dual_mac mode
	net/mlx4_en: Verify coalescing parameters are in range
	net/mlx5: E-Switch, Include VF RDMA stats in vport statistics
	net_sched: fq: take care of throttled flows before reuse
	net: support compat 64-bit time in {s,g}etsockopt
	openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found
	qmi_wwan: do not steal interfaces from class drivers
	r8169: fix powering up RTL8168h
	sctp: handle two v4 addrs comparison in sctp_inet6_cmp_addr
	sctp: remove sctp_chunk_put from fail_mark err path in sctp_ulpevent_make_rcvmsg
	sctp: use the old asoc when making the cookie-ack chunk in dupcook_d
	tcp_bbr: fix to zero idle_restart only upon S/ACKed data
	tg3: Fix vunmap() BUG_ON() triggered from tg3_free_consistent().
	bonding: do not allow rlb updates to invalid mac
	net/mlx5: Avoid cleaning flow steering table twice during error flow
	bonding: send learning packets for vlans on slave
	tcp: ignore Fast Open on repair mode
	sctp: fix the issue that the cookie-ack with auth can't get processed
	sctp: delay the authentication for the duplicated cookie-echo chunk
	serial: sccnxp: Fix error handling in sccnxp_probe()
	futex: Remove duplicated code and fix undefined behaviour
	xfrm: fix xfrm_do_migrate() with AEAD e.g(AES-GCM)
	lockd: lost rollback of set_grace_period() in lockd_down_net()
	Revert "ARM: dts: imx6qdl-wandboard: Fix audio channel swap"
	l2tp: revert "l2tp: fix missing print session offset info"
	nfp: TX time stamp packets before HW doorbell is rung
	proc: do not access cmdline nor environ from file-backed areas
	futex: futex_wake_op, fix sign_extend32 sign bits
	kernel/exit.c: avoid undefined behaviour when calling wait4()
	Linux 4.9.101

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2018-05-19 14:06:17 +02:00
Jiri Slaby
81da9f87ad futex: Remove duplicated code and fix undefined behaviour 
commit 30d6e0a419 upstream.

There is code duplicated over all architecture's headers for
futex_atomic_op_inuser. Namely op decoding, access_ok check for uaddr,
and comparison of the result.

Remove this duplication and leave up to the arches only the needed
assembly which is now in arch_futex_atomic_op_inuser.

This effectively distributes the Will Deacon's arm64 fix for undefined
behaviour reported by UBSAN to all architectures. The fix was done in
commit 5f16a046f8 (arm64: futex: Fix undefined behaviour with
FUTEX_OP_OPARG_SHIFT usage). Look there for an example dump.

And as suggested by Thomas, check for negative oparg too, because it was
also reported to cause undefined behaviour report.

Note that s390 removed access_ok check in d12a29703 ("s390/uaccess:
remove pointless access_ok() checks") as access_ok there returns true.
We introduce it back to the helper for the sake of simplicity (it gets
optimized away anyway).

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Russell King <rmk+kernel@armlinux.org.uk>
Acked-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc)
Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com> [s390]
Acked-by: Chris Metcalf <cmetcalf@mellanox.com> [for tile]
Reviewed-by: Darren Hart (VMware) <dvhart@infradead.org>
Reviewed-by: Will Deacon <will.deacon@arm.com> [core/arm64]
Cc: linux-mips@linux-mips.org
Cc: Rich Felker <dalias@libc.org>
Cc: linux-ia64@vger.kernel.org
Cc: linux-sh@vger.kernel.org
Cc: peterz@infradead.org
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Max Filippov <jcmvbkbc@gmail.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: sparclinux@vger.kernel.org
Cc: Jonas Bonn <jonas@southpole.se>
Cc: linux-s390@vger.kernel.org
Cc: linux-arch@vger.kernel.org
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: linux-hexagon@vger.kernel.org
Cc: Helge Deller <deller@gmx.de>
Cc: "James E.J. Bottomley" <jejb@parisc-linux.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Matt Turner <mattst88@gmail.com>
Cc: linux-snps-arc@lists.infradead.org
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: linux-xtensa@linux-xtensa.org
Cc: Stefan Kristiansson <stefan.kristiansson@saunalahti.fi>
Cc: openrisc@lists.librecores.org
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Stafford Horne <shorne@gmail.com>
Cc: linux-arm-kernel@lists.infradead.org
Cc: Richard Henderson <rth@twiddle.net>
Cc: Chris Zankel <chris@zankel.net>
Cc: Michal Simek <monstr@monstr.eu>
Cc: Tony Luck <tony.luck@intel.com>
Cc: linux-parisc@vger.kernel.org
Cc: Vineet Gupta <vgupta@synopsys.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Richard Kuo <rkuo@codeaurora.org>
Cc: linux-alpha@vger.kernel.org
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: linuxppc-dev@lists.ozlabs.org
Cc: "David S. Miller" <davem@davemloft.net>
Link: http://lkml.kernel.org/r/20170824073105.3901-1-jslaby@suse.cz
Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-05-19 10:27:00 +02:00
Greg Hackmann
b4c14c25fd Merge tag 'v4.9.95' into android-4.9.95 
This is the 4.9.95 stable release

Change-Id: I7b8c0b5f4ea5afaddbf9b77813efe675332bced0
Signed-off-by: Greg Hackmann <ghackmann@google.com>
 2018-04-20 10:06:49 -07:00
Helge Deller
68401e8b68 parisc: Fix out of array access in match_pci_device() 
commit 615b2665fd upstream.

As found by the ubsan checker, the value of the 'index' variable can be
out of range for the bc[] array:

UBSAN: Undefined behaviour in arch/parisc/kernel/drivers.c:655:21
index 6 is out of range for type 'char [6]'
Backtrace:
 [<104fa850>] __ubsan_handle_out_of_bounds+0x68/0x80
 [<1019d83c>] check_parent+0xc0/0x170
 [<1019d91c>] descend_children+0x30/0x6c
 [<1059e164>] device_for_each_child+0x60/0x98
 [<1019cd54>] parse_tree_node+0x40/0x54
 [<1019d86c>] check_parent+0xf0/0x170
 [<1019d91c>] descend_children+0x30/0x6c
 [<1059e164>] device_for_each_child+0x60/0x98
 [<1019d938>] descend_children+0x4c/0x6c
 [<1059e164>] device_for_each_child+0x60/0x98
 [<1019cd54>] parse_tree_node+0x40/0x54
 [<1019cffc>] hwpath_to_device+0xa4/0xc4

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-04-20 08:20:40 +02:00
Greg Kroah-Hartman
960923fdc2 Merge 4.9.89 into android-4.9 
Changes in 4.9.89
	blkcg: fix double free of new_blkg in blkcg_init_queue
	Input: tsc2007 - check for presence and power down tsc2007 during probe
	perf stat: Issue a HW watchdog disable hint
	staging: speakup: Replace BUG_ON() with WARN_ON().
	staging: wilc1000: add check for kmalloc allocation failure.
	HID: reject input outside logical range only if null state is set
	drm: qxl: Don't alloc fbdev if emulation is not supported
	ARM: dts: r8a7791: Remove unit-address and reg from integrated cache
	ARM: dts: r8a7792: Remove unit-address and reg from integrated cache
	ARM: dts: r8a7793: Remove unit-address and reg from integrated cache
	ARM: dts: r8a7794: Remove unit-address and reg from integrated cache
	arm64: dts: r8a7796: Remove unit-address and reg from integrated cache
	drm/sun4i: Fix up error path cleanup for master bind function
	drm/sun4i: Set drm_crtc.port to the underlying TCON's output port node
	ath10k: fix a warning during channel switch with multiple vaps
	drm/sun4i: Fix TCON clock and regmap initialization sequence
	PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown()
	selinux: check for address length in selinux_socket_bind()
	x86/mm: Make mmap(MAP_32BIT) work correctly
	perf sort: Fix segfault with basic block 'cycles' sort dimension
	x86/mce: Handle broadcasted MCE gracefully with kexec
	eventpoll.h: fix epoll event masks
	i40e: Acquire NVM lock before reads on all devices
	i40e: fix ethtool to get EEPROM data from X722 interface
	perf tools: Make perf_event__synthesize_mmap_events() scale
	ARM: brcmstb: Enable ZONE_DMA for non 64-bit capable peripherals
	drivers: net: xgene: Fix hardware checksum setting
	drivers: net: phy: xgene: Fix mdio write
	drivers: net: xgene: Fix wrong logical operation
	drivers: net: xgene: Fix Rx checksum validation logic
	drm: Defer disabling the vblank IRQ until the next interrupt (for instant-off)
	ath10k: disallow DFS simulation if DFS channel is not enabled
	ath10k: fix fetching channel during potential radar detection
	usb: misc: lvs: fix race condition in disconnect handling
	ARM: bcm2835: Enable missing CMA settings for VC4 driver
	net: ethernet: bgmac: Allow MAC address to be specified in DTB
	netem: apply correct delay when rate throttling
	x86/mce: Init some CPU features early
	omapfb: dss: Handle return errors in dss_init_ports()
	perf probe: Fix concat_probe_trace_events
	perf probe: Return errno when not hitting any event
	HID: clamp input to logical range if no null state
	net/8021q: create device with all possible features in wanted_features
	ARM: dts: Adjust moxart IRQ controller and flags
	qed: Always publish VF link from leading hwfn
	s390/topology: fix typo in early topology code
	zd1211rw: fix NULL-deref at probe
	batman-adv: handle race condition for claims between gateways
	of: fix of_device_get_modalias returned length when truncating buffers
	solo6x10: release vb2 buffers in solo_stop_streaming()
	x86/boot/32: Defer resyncing initial_page_table until per-cpu is set up
	scsi: fnic: Fix for "Number of Active IOs" in fnicstats becoming negative
	scsi: ipr: Fix missed EH wakeup
	media: i2c/soc_camera: fix ov6650 sensor getting wrong clock
	timers, sched_clock: Update timeout for clock wrap
	sysrq: Reset the watchdog timers while displaying high-resolution timers
	Input: qt1070 - add OF device ID table
	sched: act_csum: don't mangle TCP and UDP GSO packets
	PCI: hv: Properly handle PCI bus remove
	PCI: hv: Lock PCI bus on device eject
	ASoC: rcar: ssi: don't set SSICR.CKDV = 000 with SSIWSR.CONT
	spi: omap2-mcspi: poll OMAP2_MCSPI_CHSTAT_RXS for PIO transfer
	tcp: sysctl: Fix a race to avoid unexpected 0 window from space
	dmaengine: imx-sdma: add 1ms delay to ensure SDMA channel is stopped
	usb: dwc3: make sure UX_EXIT_PX is cleared
	ARM: dts: bcm2835: add index to the ethernet alias
	perf annotate: Fix a bug following symbolic link of a build-id file
	perf buildid: Do not assume that readlink() returns a null terminated string
	i40e/i40evf: Fix use after free in Rx cleanup path
	scsi: be2iscsi: Check tag in beiscsi_mccq_compl_wait
	driver: (adm1275) set the m,b and R coefficients correctly for power
	bonding: make speed, duplex setting consistent with link state
	mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative()
	ALSA: firewire-lib: add a quirk of packet without valid EOH in CIP format
	ARM: dts: r8a7794: Add DU1 clock to device tree
	ARM: dts: r8a7794: Correct clock of DU1
	ARM: dts: silk: Correct clock of DU1
	blk-throttle: make sure expire time isn't too big
	regulator: core: Limit propagation of parent voltage count and list
	perf trace: Handle unpaired raw_syscalls:sys_exit event
	f2fs: relax node version check for victim data in gc
	drm/ttm: never add BO that failed to validate to the LRU list
	bonding: refine bond_fold_stats() wrap detection
	PCI: Apply Cavium ACS quirk only to CN81xx/CN83xx/CN88xx devices
	powerpc/mm/hugetlb: Filter out hugepage size not supported by page table layout
	braille-console: Fix value returned by _braille_console_setup
	drm/vmwgfx: Fixes to vmwgfx_fb
	vxlan: vxlan dev should inherit lowerdev's gso_max_size
	NFC: nfcmrvl: Include unaligned.h instead of access_ok.h
	NFC: nfcmrvl: double free on error path
	NFC: pn533: change order of free_irq and dev unregistration
	ARM: dts: r7s72100: fix ethernet clock parent
	ARM: dts: r8a7790: Correct parent of SSI[0-9] clocks
	ARM: dts: r8a7791: Correct parent of SSI[0-9] clocks
	ARM: dts: r8a7793: Correct parent of SSI[0-9] clocks
	powerpc: Avoid taking a data miss on every userspace instruction miss
	net: hns: Correct HNS RSS key set function
	net/faraday: Add missing include of of.h
	qed: Fix TM block ILT allocation
	rtmutex: Fix PI chain order integrity
	printk: Correctly handle preemption in console_unlock()
	drm: rcar-du: Handle event when disabling CRTCs
	ARM: dts: koelsch: Correct clock frequency of X2 DU clock input
	reiserfs: Make cancel_old_flush() reliable
	ASoC: rt5677: Add OF device ID table
	IB/hfi1: Check for QSFP presence before attempting reads
	ALSA: firewire-digi00x: add support for console models of Digi00x series
	ALSA: firewire-digi00x: handle all MIDI messages on streaming packets
	fm10k: correctly check if interface is removed
	EDAC, altera: Fix peripheral warnings for Cyclone5
	scsi: ses: don't get power status of SES device slot on probe
	qed: Correct MSI-x for storage
	apparmor: Make path_max parameter readonly
	iommu/iova: Fix underflow bug in __alloc_and_insert_iova_range
	kvm/svm: Setup MCG_CAP on AMD properly
	kvm: nVMX: Disallow userspace-injected exceptions in guest mode
	video: ARM CLCD: fix dma allocation size
	drm/radeon: Fail fb creation from imported dma-bufs.
	drm/amdgpu: Fail fb creation from imported dma-bufs. (v2)
	drm/rockchip: vop: Enable pm domain before vop_initial
	i40e: only register client on iWarp-capable devices
	coresight: Fixes coresight DT parse to get correct output port ID.
	lkdtm: turn off kcov for lkdtm_rodata_do_nothing:
	tty: amba-pl011: Fix spurious TX interrupts
	serial: imx: setup DCEDTE early and ensure DCD and RI irqs to be off
	MIPS: BPF: Quit clobbering callee saved registers in JIT code.
	MIPS: BPF: Fix multiple problems in JIT skb access helpers.
	MIPS: r2-on-r6-emu: Fix BLEZL and BGTZL identification
	MIPS: r2-on-r6-emu: Clear BLTZALL and BGEZALL debugfs counters
	v4l: vsp1: Prevent multiple streamon race commencing pipeline early
	v4l: vsp1: Register pipe with output WPF
	regulator: isl9305: fix array size
	md/raid6: Fix anomily when recovering a single device in RAID6.
	md.c:didn't unlock the mddev before return EINVAL in array_size_store
	powerpc/nohash: Fix use of mmu_has_feature() in setup_initial_memory_limit()
	usb: dwc2: Make sure we disconnect the gadget state
	usb: gadget: dummy_hcd: Fix wrong power status bit clear/reset in dummy_hub_control()
	perf evsel: Return exact sub event which failed with EPERM for wildcards
	iwlwifi: mvm: fix RX SKB header size and align it properly
	drivers/perf: arm_pmu: handle no platform_device
	perf inject: Copy events when reordering events in pipe mode
	net: fec: add phy-reset-gpios PROBE_DEFER check
	perf session: Don't rely on evlist in pipe mode
	vfio/powerpc/spapr_tce: Enforce IOMMU type compatibility check
	vfio/spapr_tce: Check kzalloc() return when preregistering memory
	scsi: sg: check for valid direction before starting the request
	scsi: sg: close race condition in sg_remove_sfp_usercontext()
	ALSA: hda: Add Geminilake id to SKL_PLUS
	kprobes/x86: Fix kprobe-booster not to boost far call instructions
	kprobes/x86: Set kprobes pages read-only
	pwm: tegra: Increase precision in PWM rate calculation
	clk: qcom: msm8996: Fix the vfe1 powerdomain name
	Bluetooth: Avoid bt_accept_unlink() double unlinking
	Bluetooth: 6lowpan: fix delay work init in add_peer_chan()
	mac80211_hwsim: use per-interface power level
	ath10k: fix compile time sanity check for CE4 buffer size
	wil6210: fix protection against connections during reset
	wil6210: fix memory access violation in wil_memcpy_from/toio_32
	perf stat: Fix bug in handling events in error state
	mwifiex: Fix invalid port issue
	drm/edid: set ELD connector type in drm_edid_to_eld()
	video/hdmi: Allow "empty" HDMI infoframes
	HID: elo: clear BTN_LEFT mapping
	iwlwifi: mvm: rs: don't override the rate history in the search cycle
	clk: meson: gxbb: fix wrong clock for SARADC/SANA
	ARM: dts: exynos: Correct Trats2 panel reset line
	sched: Stop switched_to_rt() from sending IPIs to offline CPUs
	sched: Stop resched_cpu() from sending IPIs to offline CPUs
	test_firmware: fix setting old custom fw path back on exit
	net: ieee802154: adf7242: Fix bug if defined DEBUG
	net: xfrm: allow clearing socket xfrm policies.
	mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]()
	net: thunderx: Set max queue count taking XDP_TX into account
	ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin
	ARM: dts: omap3-n900: Fix the audio CODEC's reset pin
	mtd: nand: ifc: update bufnum mask for ver >= 2.0.0
	userns: Don't fail follow_automount based on s_user_ns
	leds: pm8058: Silence pointer to integer size warning
	power: supply: ab8500_charger: Fix an error handling path
	power: supply: ab8500_charger: Bail out in case of error in 'ab8500_charger_init_hw_registers()'
	ath10k: update tdls teardown state to target
	scsi: ses: don't ask for diagnostic pages repeatedly during probe
	pwm: stmpe: Fix wrong register offset for hwpwm=2 case
	clk: qcom: msm8916: fix mnd_width for codec_digcodec
	mwifiex: cfg80211: do not change virtual interface during scan processing
	ath10k: fix invalid STS_CAP_OFFSET_MASK
	tools/usbip: fixes build with musl libc toolchain
	spi: sun6i: disable/unprepare clocks on remove
	bnxt_en: Don't print "Link speed -1 no longer supported" messages.
	scsi: core: scsi_get_device_flags_keyed(): Always return device flags
	scsi: devinfo: apply to HP XP the same flags as Hitachi VSP
	scsi: dh: add new rdac devices
	media: vsp1: Prevent suspending and resuming DRM pipelines
	media: cpia2: Fix a couple off by one bugs
	veth: set peer GSO values
	drm/amdkfd: Fix memory leaks in kfd topology
	powerpc/modules: Don't try to restore r2 after a sibling call
	agp/intel: Flush all chipset writes after updating the GGTT
	mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED
	mac80211: remove BUG() when interface type is invalid
	ASoC: nuc900: Fix a loop timeout test
	ipvlan: add L2 check for packets arriving via virtual devices
	rcutorture/configinit: Fix build directory error message
	locking/locktorture: Fix num reader/writer corner cases
	ima: relax requiring a file signature for new files with zero length
	net: hns: Some checkpatch.pl script & warning fixes
	x86/boot/32: Fix UP boot on Quark and possibly other platforms
	x86/cpufeatures: Add Intel PCONFIG cpufeature
	selftests/x86/entry_from_vm86: Exit with 1 if we fail
	selftests/x86: Add tests for User-Mode Instruction Prevention
	selftests/x86: Add tests for the STR and SLDT instructions
	selftests/x86/entry_from_vm86: Add test cases for POPF
	x86/vm86/32: Fix POPF emulation
	x86/speculation, objtool: Annotate indirect calls/jumps for objtool on 32-bit kernels
	x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist
	x86/mm: Fix vmalloc_fault to use pXd_large
	parisc: Handle case where flush_cache_range is called with no context
	ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats()
	ALSA: hda - Revert power_save option default value
	ALSA: seq: Fix possible UAF in snd_seq_check_queue()
	ALSA: seq: Clear client entry before deleting else at closing
	drm/amdgpu: fix prime teardown order
	drm/amdgpu/dce: Don't turn off DP sink when disconnected
	fs: Teach path_connected to handle nfs filesystems with multiple roots.
	lock_parent() needs to recheck if dentry got __dentry_kill'ed under it
	fs/aio: Add explicit RCU grace period when freeing kioctx
	fs/aio: Use RCU accessors for kioctx_table->table[]
	irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis
	scsi: sg: fix SG_DXFER_FROM_DEV transfers
	scsi: sg: fix static checker warning in sg_is_valid_dxfer
	scsi: sg: only check for dxfer_len greater than 256M
	btrfs: alloc_chunk: fix DUP stripe size handling
	btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device
	scsi: qla2xxx: Fix extraneous ref on sp's after adapter break
	USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe()
	usb: dwc3: Fix GDBGFIFOSPACE_TYPE values
	usb: gadget: bdc: 64-bit pointer capability check
	Linux 4.9.89

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2018-03-22 09:54:47 +01:00
John David Anglin
8f6cfbea4e parisc: Handle case where flush_cache_range is called with no context 
commit 9ef0f88fe5 upstream.

Just when I had decided that flush_cache_range() was always called with
a valid context, Helge reported two cases where the
"BUG_ON(!vma->vm_mm->context);" was hit on the phantom buildd:

 kernel BUG at /mnt/sdb6/linux/linux-4.15.4/arch/parisc/kernel/cache.c:587!
 CPU: 1 PID: 3254 Comm: kworker/1:2 Tainted: G D 4.15.0-1-parisc64-smp #1 Debian 4.15.4-1+b1
 Workqueue: events free_ioctx
  IAOQ[0]: flush_cache_range+0x164/0x168
  IAOQ[1]: flush_cache_page+0x0/0x1c8
  RP(r2): unmap_page_range+0xae8/0xb88
 Backtrace:
  [<00000000404a6980>] unmap_page_range+0xae8/0xb88
  [<00000000404a6ae0>] unmap_single_vma+0xc0/0x188
  [<00000000404a6cdc>] zap_page_range_single+0x134/0x1f8
  [<00000000404a702c>] unmap_mapping_range+0x1cc/0x208
  [<0000000040461518>] truncate_pagecache+0x98/0x108
  [<0000000040461624>] truncate_setsize+0x9c/0xb8
  [<00000000405d7f30>] put_aio_ring_file+0x80/0x100
  [<00000000405d803c>] aio_free_ring+0x8c/0x290
  [<00000000405d82c0>] free_ioctx+0x80/0x180
  [<0000000040284e6c>] process_one_work+0x21c/0x668
  [<00000000402854c4>] worker_thread+0x20c/0x778
  [<0000000040291d44>] kthread+0x2d4/0x2e0
  [<0000000040204020>] end_fault_vector+0x20/0xc0

This indicates that we need to handle the no context case in
flush_cache_range() as we do in flush_cache_mm().

In thinking about this, I realized that we don't need to flush the TLB
when there is no context.  So, I added context checks to the large flush
cases in flush_cache_mm() and flush_cache_range().  The large flush case
occurs frequently in flush_cache_mm() and the change should improve fork
performance.

The v2 version of this change removes the BUG_ON from flush_cache_page()
by skipping the TLB flush when there is no context.  I also added code
to flush the TLB in flush_cache_mm() and flush_cache_range() when we
have a context that's not current.  Now all three routines handle TLB
flushes in a similar manner.

Signed-off-by: John David Anglin <dave.anglin@bell.net>
Cc: stable@vger.kernel.org # 4.9+
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-03-22 09:17:59 +01:00
Greg Kroah-Hartman
a2904940bd Merge 4.9.87 into android-4.9 
Changes in 4.9.87
	tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus
	tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus
	tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus
	tpm_tis: fix potential buffer overruns caused by bit glitches on the bus
	tpm: constify transmit data pointers
	tpm_tis_spi: Use DMA-safe memory for SPI transfers
	tpm-dev-common: Reject too short writes
	ALSA: usb-audio: Add a quirck for B&W PX headphones
	ALSA: hda: Add a power_save blacklist
	ALSA: hda - Fix pincfg at resume on Lenovo T470 dock
	timers: Forward timer base before migrating timers
	parisc: Fix ordering of cache and TLB flushes
	cpufreq: s3c24xx: Fix broken s3c_cpufreq_init()
	dax: fix vma_is_fsdax() helper
	x86/xen: Zero MSR_IA32_SPEC_CTRL before suspend
	x86/platform/intel-mid: Handle Intel Edison reboot correctly
	media: m88ds3103: don't call a non-initalized function
	nospec: Allow index argument to have const-qualified type
	ARM: mvebu: Fix broken PL310_ERRATA_753970 selects
	ARM: kvm: fix building with gcc-8
	KVM: mmu: Fix overlap between public and private memslots
	KVM/x86: Remove indirect MSR op calls from SPEC_CTRL
	KVM/VMX: Optimize vmx_vcpu_run() and svm_vcpu_run() by marking the RDMSR path as unlikely()
	PCI/ASPM: Deal with missing root ports in link state handling
	dm io: fix duplicate bio completion due to missing ref count
	ARM: dts: LogicPD SOM-LV: Fix I2C1 pinmux
	ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux
	x86/mm: Give each mm TLB flush generation a unique ID
	x86/speculation: Use Indirect Branch Prediction Barrier in context switch
	md: only allow remove_and_add_spares when no sync_thread running.
	netlink: put module reference if dump start fails
	x86/apic/vector: Handle legacy irq data correctly
	bridge: check brport attr show in brport_show
	fib_semantics: Don't match route with mismatching tclassid
	hdlc_ppp: carrier detect ok, don't turn off negotiation
	ipv6 sit: work around bogus gcc-8 -Wrestrict warning
	net: fix race on decreasing number of TX queues
	net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68
	netlink: ensure to loop over all netns in genlmsg_multicast_allns()
	ppp: prevent unregistered channels from connecting to PPP units
	udplite: fix partial checksum initialization
	sctp: fix dst refcnt leak in sctp_v4_get_dst
	mlxsw: spectrum_switchdev: Check success of FDB add operation
	net: phy: fix phy_start to consider PHY_IGNORE_INTERRUPT
	tcp: Honor the eor bit in tcp_mtu_probe
	rxrpc: Fix send in rxrpc_send_data_packet()
	tcp_bbr: better deal with suboptimal GSO
	sctp: fix dst refcnt leak in sctp_v6_get_dst()
	s390/qeth: fix underestimated count of buffer elements
	s390/qeth: fix SETIP command handling
	s390/qeth: fix overestimated count of buffer elements
	s390/qeth: fix IP removal on offline cards
	s390/qeth: fix double-free on IP add/remove race
	s390/qeth: fix IP address lookup for L3 devices
	s390/qeth: fix IPA command submission race
	sctp: verify size of a new chunk in _sctp_make_chunk()
	net: mpls: Pull common label check into helper
	mpls, nospec: Sanitize array index in mpls_label_ok()
	bpf: fix wrong exposure of map_flags into fdinfo for lpm
	bpf: fix mlock precharge on arraymaps
	bpf, x64: implement retpoline for tail call
	bpf, arm64: fix out of bounds access in tail call
	bpf: add schedule points in percpu arrays management
	bpf, ppc64: fix out of bounds access in tail call
	btrfs: preserve i_mode if __btrfs_set_acl() fails
	Linux 4.9.87

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2018-03-11 17:38:31 +01:00
John David Anglin
12efc91591 parisc: Fix ordering of cache and TLB flushes 
commit 0adb24e03a upstream.

The change to flush_kernel_vmap_range() wasn't sufficient to avoid the
SMP stalls.  The problem is some drivers call these routines with
interrupts disabled.  Interrupts need to be enabled for flush_tlb_all()
and flush_cache_all() to work.  This version adds checks to ensure
interrupts are not disabled before calling routines that need IPI
interrupts.  When interrupts are disabled, we now drop into slower code.

The attached change fixes the ordering of cache and TLB flushes in
several cases.  When we flush the cache using the existing PTE/TLB
entries, we need to flush the TLB after doing the cache flush.  We don't
need to do this when we flush the entire instruction and data caches as
these flushes don't use the existing TLB entries.  The same is true for
tmpalias region flushes.

The flush_kernel_vmap_range() and invalidate_kernel_vmap_range()
routines have been updated.

Secondly, we added a new purge_kernel_dcache_range_asm() routine to
pacache.S and use it in invalidate_kernel_vmap_range().  Nominally,
purges are faster than flushes as the cache lines don't have to be
written back to memory.

Hopefully, this is sufficient to resolve the remaining problems due to
cache speculation.  So far, testing indicates that this is the case.  I
did work up a patch using tmpalias flushes, but there is a performance
hit because we need the physical address for each page, and we also need
to sequence access to the tmpalias flush code.  This increases the
probability of stalls.

Signed-off-by: John David Anglin <dave.anglin@bell.net>
Cc: stable@vger.kernel.org # 4.9+
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-03-11 16:21:28 +01:00
Greg Kroah-Hartman
91549408ce Merge 4.9.76 into android-4.9 
Changes in 4.9.76
	kernel/acct.c: fix the acct->needcheck check in check_free_space()
	crypto: n2 - cure use after free
	crypto: chacha20poly1305 - validate the digest size
	crypto: pcrypt - fix freeing pcrypt instances
	sunxi-rsb: Include OF based modalias in device uevent
	fscache: Fix the default for fscache_maybe_release_page()
	nbd: fix use-after-free of rq/bio in the xmit path
	kernel: make groups_sort calling a responsibility group_info allocators
	kernel/signal.c: protect the traced SIGNAL_UNKILLABLE tasks from SIGKILL
	kernel/signal.c: protect the SIGNAL_UNKILLABLE tasks from !sig_kernel_only() signals
	kernel/signal.c: remove the no longer needed SIGNAL_UNKILLABLE check in complete_signal()
	iommu/arm-smmu-v3: Don't free page table ops twice
	iommu/arm-smmu-v3: Cope with duplicated Stream IDs
	ARC: uaccess: dont use "l" gcc inline asm constraint modifier
	Input: elantech - add new icbody type 15
	x86/microcode/AMD: Add support for fam17h microcode loading
	parisc: Fix alignment of pa_tlb_lock in assembly on 32-bit SMP kernel
	parisc: qemu idle sleep support
	x86/tlb: Drop the _GPL from the cpu_tlbstate export
	Map the vsyscall page with _PAGE_USER
	mtd: nand: pxa3xx: Fix READOOB implementation
	Linux 4.9.76

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2018-01-10 09:51:38 +01:00
Helge Deller
91dfc41e75 parisc: qemu idle sleep support 
commit 310d82784f upstream.

Add qemu idle sleep support when running under qemu with SeaBIOS PDC
firmware.

Like the power architecture we use the "or" assembler instructions,
which translate to nops on real hardware, to indicate that qemu shall
idle sleep.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: Richard Henderson <rth@twiddle.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-01-10 09:29:54 +01:00
Helge Deller
14c06206b9 parisc: Fix alignment of pa_tlb_lock in assembly on 32-bit SMP kernel 
commit 88776c0e70 upstream.

Qemu for PARISC reported on a 32bit SMP parisc kernel strange failures
about "Not-handled unaligned insn 0x0e8011d6 and 0x0c2011c9."

Those opcodes evaluate to the ldcw() assembly instruction which requires
(on 32bit) an alignment of 16 bytes to ensure atomicity.

As it turns out, qemu is correct and in our assembly code in entry.S and
pacache.S we don't pay attention to the required alignment.

This patch fixes the problem by aligning the lock offset in assembly
code in the same manner as we do in our C-code.

Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-01-10 09:29:54 +01:00
Greg Kroah-Hartman
c1a286429a Merge 4.9.66 into android-4.9 
Changes in 4.9.66
	s390: fix transactional execution control register handling
	s390/runtime instrumention: fix possible memory corruption
	s390/disassembler: add missing end marker for e7 table
	s390/disassembler: increase show_code buffer size
	ACPI / EC: Fix regression related to triggering source of EC event handling
	x86/mm: fix use-after-free of vma during userfaultfd fault
	ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER
	vsock: use new wait API for vsock_stream_sendmsg()
	sched: Make resched_cpu() unconditional
	lib/mpi: call cond_resched() from mpi_powm() loop
	x86/decoder: Add new TEST instruction pattern
	x86/entry/64: Add missing irqflags tracing to native_load_gs_index()
	arm64: Implement arch-specific pte_access_permitted()
	ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE
	ARM: 8721/1: mm: dump: check hardware RO bit for LPAE
	MIPS: ralink: Fix MT7628 pinmux
	MIPS: ralink: Fix typo in mt7628 pinmux function
	PCI: Set Cavium ACS capability quirk flags to assert RR/CR/SV/UF
	ALSA: hda: Add Raven PCI ID
	dm bufio: fix integer overflow when limiting maximum cache size
	dm: allocate struct mapped_device with kvzalloc
	MIPS: pci: Remove KERN_WARN instance inside the mt7620 driver
	dm: fix race between dm_get_from_kobject() and __dm_destroy()
	MIPS: Fix odd fp register warnings with MIPS64r2
	MIPS: dts: remove bogus bcm96358nb4ser.dtb from dtb-y entry
	MIPS: Fix an n32 core file generation regset support regression
	MIPS: BCM47XX: Fix LED inversion for WRT54GSv1
	rt2x00usb: mark device removed when get ENOENT usb error
	autofs: don't fail mount for transient error
	nilfs2: fix race condition that causes file system corruption
	eCryptfs: use after free in ecryptfs_release_messaging()
	libceph: don't WARN() if user tries to add invalid key
	bcache: check ca->alloc_thread initialized before wake up it
	isofs: fix timestamps beyond 2027
	NFS: Fix typo in nomigration mount option
	nfs: Fix ugly referral attributes
	NFS: Avoid RCU usage in tracepoints
	nfsd: deal with revoked delegations appropriately
	rtlwifi: rtl8192ee: Fix memory leak when loading firmware
	rtlwifi: fix uninitialized rtlhal->last_suspend_sec time
	ata: fixes kernel crash while tracing ata_eh_link_autopsy event
	ext4: fix interaction between i_size, fallocate, and delalloc after a crash
	ALSA: pcm: update tstamp only if audio_tstamp changed
	ALSA: usb-audio: Add sanity checks to FE parser
	ALSA: usb-audio: Fix potential out-of-bound access at parsing SU
	ALSA: usb-audio: Add sanity checks in v2 clock parsers
	ALSA: timer: Remove kernel warning at compat ioctl error paths
	ALSA: hda: Fix too short HDMI/DP chmap reporting
	ALSA: hda/realtek - Fix ALC700 family no sound issue
	fix a page leak in vhost_scsi_iov_to_sgl() error recovery
	fs/9p: Compare qid.path in v9fs_test_inode
	iscsi-target: Fix non-immediate TMR reference leak
	target: Fix QUEUE_FULL + SCSI task attribute handling
	mtd: nand: omap2: Fix subpage write
	mtd: nand: Fix writing mtdoops to nand flash.
	mtd: nand: mtk: fix infinite ECC decode IRQ issue
	p54: don't unregister leds when they are not initialized
	block: Fix a race between blk_cleanup_queue() and timeout handling
	irqchip/gic-v3: Fix ppi-partitions lookup
	lockd: double unregister of inetaddr notifiers
	KVM: nVMX: set IDTR and GDTR limits when loading L1 host state
	KVM: SVM: obey guest PAT
	SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status
	clk: ti: dra7-atl-clock: fix child-node lookups
	libnvdimm, pfn: make 'resource' attribute only readable by root
	libnvdimm, namespace: fix label initialization to use valid seq numbers
	libnvdimm, namespace: make 'resource' attribute only readable by root
	IB/srpt: Do not accept invalid initiator port names
	IB/srp: Avoid that a cable pull can trigger a kernel crash
	NFC: fix device-allocation error return
	i40e: Use smp_rmb rather than read_barrier_depends
	igb: Use smp_rmb rather than read_barrier_depends
	igbvf: Use smp_rmb rather than read_barrier_depends
	ixgbevf: Use smp_rmb rather than read_barrier_depends
	i40evf: Use smp_rmb rather than read_barrier_depends
	fm10k: Use smp_rmb rather than read_barrier_depends
	ixgbe: Fix skb list corruption on Power systems
	parisc: Fix validity check of pointer size argument in new CAS implementation
	powerpc/signal: Properly handle return value from uprobe_deny_signal()
	media: Don't do DMA on stack for firmware upload in the AS102 driver
	media: rc: check for integer overflow
	cx231xx-cards: fix NULL-deref on missing association descriptor
	media: v4l2-ctrl: Fix flags field on Control events
	sched/rt: Simplify the IPI based RT balancing logic
	fscrypt: lock mutex before checking for bounce page pool
	net/9p: Switch to wait_event_killable()
	PM / OPP: Add missing of_node_put(np)
	Revert "drm/i915: Do not rely on wm preservation for ILK watermarks"
	e1000e: Fix error path in link detection
	e1000e: Fix return value test
	e1000e: Separate signaling for link check/link up
	e1000e: Avoid receiver overrun interrupt bursts
	RDS: make message size limit compliant with spec
	RDS: RDMA: return appropriate error on rdma map failures
	RDS: RDMA: fix the ib_map_mr_sg_zbva() argument
	PCI: Apply _HPX settings only to relevant devices
	drm/sun4i: Fix a return value in case of error
	clk: sunxi-ng: A31: Fix spdif clock register
	clk: sunxi-ng: fix PLL_CPUX adjusting on A33
	dmaengine: zx: set DMA_CYCLIC cap_mask bit
	fscrypt: use ENOKEY when file cannot be created w/o key
	fscrypt: use ENOTDIR when setting encryption policy on nondirectory
	net: Allow IP_MULTICAST_IF to set index to L3 slave
	net: 3com: typhoon: typhoon_init_one: make return values more specific
	net: 3com: typhoon: typhoon_init_one: fix incorrect return values
	drm/armada: Fix compile fail
	rt2800: set minimum MPDU and PSDU lengths to sane values
	adm80211: return an error if adm8211_alloc_rings() fails
	mwifiex: sdio: fix use after free issue for save_adapter
	ath10k: fix incorrect txpower set by P2P_DEVICE interface
	ath10k: ignore configuring the incorrect board_id
	ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats()
	pinctrl: sirf: atlas7: Add missing 'of_node_put()'
	bnxt_en: Set default completion ring for async events.
	ath10k: set CTS protection VDEV param only if VDEV is up
	ALSA: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE
	gpio: mockup: dynamically allocate memory for chip name
	drm: Apply range restriction after color adjustment when allocation
	clk: qcom: ipq4019: Add all the frequencies for apss cpu
	drm/mediatek: don't use drm_put_dev
	mac80211: Remove invalid flag operations in mesh TSF synchronization
	mac80211: Suppress NEW_PEER_CANDIDATE event if no room
	adm80211: add checks for dma mapping errors
	iio: light: fix improper return value
	staging: iio: cdc: fix improper return value
	spi: SPI_FSL_DSPI should depend on HAS_DMA
	netfilter: nft_queue: use raw_smp_processor_id()
	netfilter: nf_tables: fix oob access
	ASoC: rsnd: don't double free kctrl
	crypto: marvell - Copy IVDIG before launching partial DMA ahash requests
	btrfs: return the actual error value from from btrfs_uuid_tree_iterate
	ASoC: wm_adsp: Don't overrun firmware file buffer when reading region data
	s390/kbuild: enable modversions for symbols exported from asm
	cec: when canceling a message, don't overwrite old status info
	cec: CEC_MSG_GIVE_FEATURES should abort for CEC version < 2
	cec: update log_addr[] before finishing configuration
	nvmet: fix KATO offset in Set Features
	xen: xenbus driver must not accept invalid transaction ids
	Linux 4.9.66

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2017-11-30 16:24:14 +00:00
John David Anglin
03d1bba87a parisc: Fix validity check of pointer size argument in new CAS implementation 
commit 05f016d2ca upstream.

As noted by Christoph Biedl, passing a pointer size of 4 in the new CAS
implementation causes a kernel crash.  The attached patch corrects the
off by one error in the argument validity check.

In reviewing the code, I noticed that we only perform word operations
with the pointer size argument.  The subi instruction intentionally uses
a word condition on 64-bit kernels.  Nullification was used instead of a
cmpib instruction as the branch should never be taken.  The shlw
pseudo-operation generates a depw,z instruction and it clears the target
before doing a shift left word deposit.  Thus, we don't need to clip the
upper 32 bits of this argument on 64-bit kernels.

Tested with a gcc testsuite run with a 64-bit kernel.  The gcc atomic
code in libgcc is the only direct user of the new CAS implementation
that I am aware of.

Signed-off-by: John David Anglin <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-11-30 08:39:08 +00:00
Greg Kroah-Hartman
16cc920a0f Merge 4.9.59 into android-4.9 
Changes in 4.9.59
	USB: devio: Revert "USB: devio: Don't corrupt user memory"
	USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor()
	USB: serial: metro-usb: add MS7820 device id
	usb: cdc_acm: Add quirk for Elatec TWN3
	usb: quirks: add quirk for WORLDE MINI MIDI keyboard
	usb: hub: Allow reset retry for USB2 devices on connect bounce
	ALSA: usb-audio: Add native DSD support for Pro-Ject Pre Box S2 Digital
	can: gs_usb: fix busy loop if no more TX context is available
	parisc: Fix double-word compare and exchange in LWS code on 32-bit kernels
	iio: dummy: events: Add missing break
	usb: musb: sunxi: Explicitly release USB PHY on exit
	usb: musb: Check for host-mode using is_host_active() on reset interrupt
	xhci: Identify USB 3.1 capable hosts by their port protocol capability
	can: esd_usb2: Fix can_dlc value for received RTR, frames
	drm/nouveau/bsp/g92: disable by default
	drm/nouveau/mmu: flush tlbs before deleting page tables
	ALSA: seq: Enable 'use' locking in all configurations
	ALSA: hda: Remove superfluous '-' added by printk conversion
	ALSA: hda: Abort capability probe at invalid register read
	i2c: ismt: Separate I2C block read from SMBus block read
	i2c: piix4: Fix SMBus port selection for AMD Family 17h chips
	brcmfmac: Add check for short event packets
	brcmsmac: make some local variables 'static const' to reduce stack size
	bus: mbus: fix window size calculation for 4GB windows
	clockevents/drivers/cs5535: Improve resilience to spurious interrupts
	rtlwifi: rtl8821ae: Fix connection lost problem
	x86/microcode/intel: Disable late loading on model 79
	KEYS: encrypted: fix dereference of NULL user_key_payload
	lib/digsig: fix dereference of NULL user_key_payload
	KEYS: don't let add_key() update an uninstantiated key
	pkcs7: Prevent NULL pointer dereference, since sinfo is not always set.
	vmbus: fix missing signaling in hv_signal_on_read()
	xfs: don't unconditionally clear the reflink flag on zero-block files
	xfs: evict CoW fork extents when performing finsert/fcollapse
	fs/xfs: Use %pS printk format for direct addresses
	xfs: report zeroed or not correctly in xfs_zero_range()
	xfs: update i_size after unwritten conversion in dio completion
	xfs: perag initialization should only touch m_ag_max_usable for AG 0
	xfs: Capture state of the right inode in xfs_iflush_done
	xfs: always swap the cow forks when swapping extents
	xfs: handle racy AIO in xfs_reflink_end_cow
	xfs: Don't log uninitialised fields in inode structures
	xfs: move more RT specific code under CONFIG_XFS_RT
	xfs: don't change inode mode if ACL update fails
	xfs: reinit btree pointer on attr tree inactivation walk
	xfs: handle error if xfs_btree_get_bufs fails
	xfs: cancel dirty pages on invalidation
	xfs: trim writepage mapping to within eof
	fscrypt: fix dereference of NULL user_key_payload
	KEYS: Fix race between updating and finding a negative key
	FS-Cache: fix dereference of NULL user_key_payload
	Linux 4.9.59

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2017-10-30 09:27:09 +01:00
John David Anglin
6bb16fa581 parisc: Fix double-word compare and exchange in LWS code on 32-bit kernels 
commit 374b3bf8e8 upstream.

As discussed on the debian-hppa list, double-wordcompare and exchange
operations fail on 32-bit kernels.  Looking at the code, I realized that
the ",ma" completer does the wrong thing in the  "ldw,ma  4(%r26), %r29"
instruction.  This increments %r26 and causes the following store to
write to the wrong location.

Note by Helge Deller:
The patch applies cleanly to stable kernel series if this upstream
commit is merged in advance:
f4125cfdb3 ("parisc: Avoid trashing sr2 and sr3 in LWS code").

Signed-off-by: John David Anglin <dave.anglin@bell.net>
Tested-by: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>
Fixes: 8920649120 ("parisc: Implement new LWS CAS supporting 64 bit operations.")
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-10-27 10:38:06 +02:00
Greg Kroah-Hartman
e5eba30388 Merge 4.9.54 into android-4.9 
Changes in 4.9.54
	drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define
	drm: bridge: add DT bindings for TI ths8135
	GFS2: Fix reference to ERR_PTR in gfs2_glock_iter_next
	drm/i915: Fix the overlay frontbuffer tracking
	ARM: dts: exynos: Add CPU OPPs for Exynos4412 Prime
	clk: sunxi-ng: fix PLL_CPUX adjusting on H3
	RDS: RDMA: Fix the composite message user notification
	ARM: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes
	MIPS: Ensure bss section ends on a long-aligned address
	MIPS: ralink: Fix a typo in the pinmux setup.
	MIPS: ralink: Fix incorrect assignment on ralink_soc
	power: supply: axp288_fuel_gauge: Fix fuel_gauge_reg_readb return on error
	scsi: be2iscsi: Add checks to validate CID alloc/free
	ARM: dts: am335x-chilisom: Wakeup from RTC-only state by power on event
	igb: re-assign hw address pointer on reset after PCI error
	extcon: axp288: Use vbus-valid instead of -present to determine cable presence
	reset: ti_syscon: fix a ti_syscon_reset_status issue
	sh_eth: use correct name for ECMR_MPDE bit
	clk/axs10x: Clear init field in driver probe
	usb: make the MTK XHCI driver compile for older MIPS SoCs
	hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes
	iio: adc: imx25-gcq: Fix module autoload
	iio: adc: axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications
	iio: adc: hx711: Add DT binding for avia,hx711
	IB/rxe: Add a runtime check in alloc_index()
	IB/rxe: Fix a MR reference leak in check_rkey()
	ARM: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM
	drm/i915/psr: disable psr2 for resolution greater than 32X20
	serial: 8250: moxa: Store num_ports in brd
	tty: goldfish: Fix a parameter of a call to free_irq
	serial: 8250_port: Remove dangerous pr_debug()
	IB/ipoib: Fix deadlock over vlan_mutex
	IB/ipoib: rtnl_unlock can not come after free_netdev
	IB/ipoib: Replace list_del of the neigh->list with list_del_init
	arm: dts: mt2701: Add subsystem clock controller device nodes
	drm/amdkfd: fix improper return value on error
	USB: serial: mos7720: fix control-message error handling
	USB: serial: mos7840: fix control-message error handling
	sfc: get PIO buffer size from the NIC
	partitions/efi: Fix integer overflow in GPT size calculation
	ASoC: dapm: handle probe deferrals
	audit: log 32-bit socketcalls
	ath10k: prevent sta pointer rcu violation
	spi: pxa2xx: Add support for Intel Gemini Lake
	iommu/arm-smmu: Set privileged attribute to 'default' instead of 'unprivileged'
	usb: chipidea: vbus event may exist before starting gadget
	rtl8xxxu: Add additional USB IDs for rtl8192eu devices
	ASoC: dapm: fix some pointer error handling
	drm: mali-dp: Fix destination size handling when rotating
	drm: mali-dp: Fix transposed horizontal/vertical flip
	HID: wacom: release the resources before leaving despite devm
	MIPS: Lantiq: Fix another request_mem_region() return code check
	mips: ath79: clock:- Unmap region obtained by of_iomap
	lkdtm: Fix Oops when unloading the module
	net: core: Prevent from dereferencing null pointer when releasing SKB
	net/packet: check length in getsockopt() called with PACKET_HDRLEN
	team: fix memory leaks
	usb: plusb: Add support for PL-27A1
	udp: disable inner UDP checksum offloads in IPsec case
	net: dsa: b53: Include IMP/CPU port in dumb forwarding mode
	qed: Fix possible system hang in the dcbnl-getdcbx() path.
	mmc: sdio: fix alignment issue in struct sdio_func
	bridge: netlink: register netdevice before executing changelink
	Btrfs: fix segmentation fault when doing dio read
	Btrfs: fix potential use-after-free for cloned bio
	sata_via: Enable hotplug only on VT6421
	hugetlbfs: initialize shared policy as part of inode allocation
	kasan: do not sanitize kexec purgatory
	drivers/rapidio/devices/tsi721.c: make module parameter variable name unique
	netfilter: invoke synchronize_rcu after set the _hook_ to NULL
	MIPS: IRQ Stack: Unwind IRQ stack onto task stack
	iommu/exynos: Block SYSMMU while invalidating FLPD cache
	exynos-gsc: Do not swap cb/cr for semi planar formats
	MIPS: smp-cps: Fix retrieval of VPE mask on big endian CPUs
	nvme-rdma: handle cpu unplug when re-establishing the controller
	netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max
	parisc: perf: Fix potential NULL pointer dereference
	nfs: make nfs4_cb_sv_ops static
	ibmvnic: Free tx/rx scrq pointer array when releasing sub-crqs
	cpufreq: intel_pstate: Update pid_params.sample_rate_ns in pid_param_set()
	x86/acpi: Restore the order of CPU IDs
	iommu/io-pgtable-arm: Check for leaf entry before dereferencing it
	mm/cgroup: avoid panic when init with low memory
	rds: ib: add error handle
	md/raid10: submit bio directly to replacement disk
	netfilter: nf_tables: set pktinfo->thoff at AH header if found
	i2c: meson: fix wrong variable usage in meson_i2c_put_data
	xfs: remove kmem_zalloc_greedy
	ASoC: wm_adsp: Return an error on write to a disabled volatile control
	libata: transport: Remove circular dependency at free time
	ARM: dts: BCM5301X: Fix memory start address
	tools/power turbostat: bugfix: GFXMHz column not changing
	IB/qib: fix false-postive maybe-uninitialized warning
	ARM: remove duplicate 'const' annotations'
	ASoC: rt5514: fix gcc-7 warning
	ASoC: rt5659: drop double const
	ASoC: rt5660: remove double const
	ALSA: au88x0: avoid theoretical uninitialized access
	ttpci: address stringop overflow warning
	s390/mm: make pmdp_invalidate() do invalidation only
	Linux 4.9.54

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2017-10-08 10:49:06 +02:00
Arvind Yadav
1cf8f9467e parisc: perf: Fix potential NULL pointer dereference 
[ Upstream commit 74e3f6e63d ]

Fix potential NULL pointer dereference and clean up
coding style errors (code indent, trailing whitespaces).

Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-10-08 10:26:10 +02:00
Greg Kroah-Hartman
02f29ab1b9 Merge 4.9.42 into android-4.9 
Changes in 4.9.42
	parisc: Handle vma's whose context is not current in flush_cache_range
	cgroup: create dfl_root files on subsys registration
	cgroup: fix error return value from cgroup_subtree_control()
	libata: array underflow in ata_find_dev()
	workqueue: restore WQ_UNBOUND/max_active==1 to be ordered
	iwlwifi: dvm: prevent an out of bounds access
	brcmfmac: fix memleak due to calling brcmf_sdiod_sgtable_alloc() twice
	NFSv4: Fix EXCHANGE_ID corrupt verifier issue
	mmc: sdhci-of-at91: force card detect value for non removable devices
	device property: Make dev_fwnode() public
	mmc: core: Fix access to HS400-ES devices
	mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries
	cpuset: fix a deadlock due to incomplete patching of cpusets_enabled()
	ALSA: hda - Fix speaker output from VAIO VPCL14M1R
	drm/amdgpu: Fix undue fallthroughs in golden registers initialization
	ASoC: do not close shared backend dailink
	KVM: async_pf: make rcu irq exit if not triggered from idle task
	mm/page_alloc: Remove kernel address exposure in free_reserved_area()
	timers: Fix overflow in get_next_timer_interrupt
	powerpc/tm: Fix saving of TM SPRs in core dump
	powerpc/64: Fix __check_irq_replay missing decrementer interrupt
	iommu/amd: Enable ga_log_intr when enabling guest_mode
	gpiolib: skip unwanted events, don't convert them to opposite edge
	ext4: fix SEEK_HOLE/SEEK_DATA for blocksize < pagesize
	ext4: fix overflow caused by missing cast in ext4_resize_fs()
	ARM: dts: armada-38x: Fix irq type for pca955
	ARM: dts: tango4: Request RGMII RX and TX clock delays
	media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl
	iscsi-target: Fix initial login PDU asynchronous socket close OOPs
	mmc: dw_mmc: Use device_property_read instead of of_property_read
	mmc: core: Use device_property_read instead of of_property_read
	media: lirc: LIRC_GET_REC_RESOLUTION should return microseconds
	f2fs: sanity check checkpoint segno and blkoff
	Btrfs: fix early ENOSPC due to delalloc
	saa7164: fix double fetch PCIe access condition
	tcp_bbr: cut pacing rate only if filled pipe
	tcp_bbr: introduce bbr_bw_to_pacing_rate() helper
	tcp_bbr: introduce bbr_init_pacing_rate_from_rtt() helper
	tcp_bbr: remove sk_pacing_rate=0 transient during init
	tcp_bbr: init pacing rate on first RTT sample
	ipv4: ipv6: initialize treq->txhash in cookie_v[46]_check()
	net: Zero terminate ifr_name in dev_ifname().
	ipv6: avoid overflow of offset in ip6_find_1stfragopt
	net: dsa: b53: Add missing ARL entries for BCM53125
	ipv4: initialize fib_trie prior to register_netdev_notifier call.
	rtnetlink: allocate more memory for dev_set_mac_address()
	mcs7780: Fix initialization when CONFIG_VMAP_STACK is enabled
	openvswitch: fix potential out of bound access in parse_ct
	packet: fix use-after-free in prb_retire_rx_blk_timer_expired()
	ipv6: Don't increase IPSTATS_MIB_FRAGFAILS twice in ip6_fragment()
	net: ethernet: nb8800: Handle all 4 RGMII modes identically
	dccp: fix a memleak that dccp_ipv6 doesn't put reqsk properly
	dccp: fix a memleak that dccp_ipv4 doesn't put reqsk properly
	dccp: fix a memleak for dccp_feat_init err process
	sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()
	sctp: fix the check for _sctp_walk_params and _sctp_walk_errors
	net/mlx5: Consider tx_enabled in all modes on remap
	net/mlx5: Fix command bad flow on command entry allocation failure
	net/mlx5e: Fix outer_header_zero() check size
	net/mlx5e: Fix wrong delay calculation for overflow check scheduling
	net/mlx5e: Schedule overflow check work to mlx5e workqueue
	net: phy: Correctly process PHY_HALTED in phy_stop_machine()
	xen-netback: correctly schedule rate-limited queues
	sparc64: Measure receiver forward progress to avoid send mondo timeout
	sparc64: Fix exception handling in UltraSPARC-III memcpy.
	wext: handle NULL extra data in iwe_stream_add_point better
	sh_eth: fix EESIPR values for SH77{34|63}
	sh_eth: R8A7740 supports packet shecksumming
	net: phy: dp83867: fix irq generation
	tg3: Fix race condition in tg3_get_stats64().
	x86/boot: Add missing declaration of string functions
	spi: spi-axi: Free resources on error path
	ASoC: rt5645: set sel_i2s_pre_div1 to 2
	netfilter: use fwmark_reflect in nf_send_reset
	phy state machine: failsafe leave invalid RUNNING state
	ipv4: make tcp_notsent_lowat sysctl knob behave as true unsigned int
	clk/samsung: exynos542x: mark some clocks as critical
	scsi: qla2xxx: Get mutex lock before checking optrom_state
	drm/virtio: fix framebuffer sparse warning
	ARM: dts: sun8i: Support DTB build for NanoPi M1
	ARM: dts: sunxi: Change node name for pwrseq pin on Olinuxino-lime2-emmc
	iw_cxgb4: do not send RX_DATA_ACK CPLs after close/abort
	nbd: blk_mq_init_queue returns an error code on failure, not NULL
	virtio_blk: fix panic in initialization error path
	ARM: 8632/1: ftrace: fix syscall name matching
	mm, slab: make sure that KMALLOC_MAX_SIZE will fit into MAX_ORDER
	lib/Kconfig.debug: fix frv build failure
	signal: protect SIGNAL_UNKILLABLE from unintentional clearing.
	mm: don't dereference struct page fields of invalid pages
	net/mlx5: E-Switch, Re-enable RoCE on mode change only after FDB destroy
	ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output
	net: account for current skb length when deciding about UFO
	net: phy: Fix PHY unbind crash
	workqueue: implicit ordered attribute should be overridable
	Linux 4.9.42

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2017-08-11 13:55:02 -07:00
John David Anglin
5d23e4f3a3 parisc: Handle vma's whose context is not current in flush_cache_range 
commit 13d57093c1 upstream.

In testing James' patch to drivers/parisc/pdc_stable.c, I hit the BUG
statement in flush_cache_range() during a system shutdown:

kernel BUG at arch/parisc/kernel/cache.c:595!
CPU: 2 PID: 6532 Comm: kworker/2:0 Not tainted 4.13.0-rc2+ #1
Workqueue: events free_ioctx

 IAOQ[0]: flush_cache_range+0x144/0x148
 IAOQ[1]: flush_cache_page+0x0/0x1a8
 RP(r2): flush_cache_range+0xec/0x148
Backtrace:
 [<00000000402910ac>] unmap_page_range+0x84/0x880
 [<00000000402918f4>] unmap_single_vma+0x4c/0x60
 [<0000000040291a18>] zap_page_range_single+0x110/0x160
 [<0000000040291c34>] unmap_mapping_range+0x174/0x1a8
 [<000000004026ccd8>] truncate_pagecache+0x50/0xa8
 [<000000004026cd84>] truncate_setsize+0x54/0x70
 [<000000004033d534>] put_aio_ring_file+0x44/0xb0
 [<000000004033d5d8>] aio_free_ring+0x38/0x140
 [<000000004033d714>] free_ioctx+0x34/0xa8
 [<00000000401b0028>] process_one_work+0x1b8/0x4d0
 [<00000000401b04f4>] worker_thread+0x1b4/0x648
 [<00000000401b9128>] kthread+0x1b0/0x208
 [<0000000040150020>] end_fault_vector+0x20/0x28
 [<0000000040639518>] nf_ip_reroute+0x50/0xa8
 [<0000000040638ed0>] nf_ip_route+0x10/0x78
 [<0000000040638c90>] xfrm4_mode_tunnel_input+0x180/0x1f8

CPU: 2 PID: 6532 Comm: kworker/2:0 Not tainted 4.13.0-rc2+ #1
Workqueue: events free_ioctx
Backtrace:
 [<0000000040163bf0>] show_stack+0x20/0x38
 [<0000000040688480>] dump_stack+0xa8/0x120
 [<0000000040163dc4>] die_if_kernel+0x19c/0x2b0
 [<0000000040164d0c>] handle_interruption+0xa24/0xa48

This patch modifies flush_cache_range() to handle non current contexts.
In as much as this occurs infrequently, the simplest approach is to
flush the entire cache when this happens.

Signed-off-by: John David Anglin <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-08-11 08:49:27 -07:00
Greg Kroah-Hartman
e6b0c64f6f Merge 4.9.41 into android-4.9 
Changes in 4.9.41
	af_key: Add lock to key dump
	pstore: Make spinlock per zone instead of global
	net: reduce skb_warn_bad_offload() noise
	jfs: Don't clear SGID when inheriting ACLs
	ALSA: fm801: Initialize chip after IRQ handler is registered
	ALSA: hda - Add missing NVIDIA GPU codec IDs to patch table
	parisc: Prevent TLB speculation on flushed pages on CPUs that only support equivalent aliases
	parisc: Extend disabled preemption in copy_user_page
	parisc: Suspend lockup detectors before system halt
	powerpc/pseries: Fix of_node_put() underflow during reconfig remove
	NFS: invalidate file size when taking a lock.
	NFSv4.1: Fix a race where CB_NOTIFY_LOCK fails to wake a waiter
	crypto: authencesn - Fix digest_null crash
	KVM: PPC: Book3S HV: Enable TM before accessing TM registers
	md/raid5: add thread_group worker async_tx_issue_pending_all
	drm/vmwgfx: Fix gcc-7.1.1 warning
	drm/nouveau/disp/nv50-: bump max chans to 21
	drm/nouveau/bar/gf100: fix access to upper half of BAR2
	KVM: PPC: Book3S HV: Restore critical SPRs to host values on guest exit
	KVM: PPC: Book3S HV: Save/restore host values of debug registers
	Revert "powerpc/numa: Fix percpu allocations to be NUMA aware"
	Staging: comedi: comedi_fops: Avoid orphaned proc entry
	drm: rcar-du: Simplify and fix probe error handling
	smp/hotplug: Move unparking of percpu threads to the control CPU
	smp/hotplug: Replace BUG_ON and react useful
	nfc: Fix hangup of RC-S380* in port100_send_ack()
	nfc: fdp: fix NULL pointer dereference
	net: phy: Do not perform software reset for Generic PHY
	isdn: Fix a sleep-in-atomic bug
	isdn/i4l: fix buffer overflow
	ath10k: fix null deref on wmi-tlv when trying spectral scan
	wil6210: fix deadlock when using fw_no_recovery option
	mailbox: always wait in mbox_send_message for blocking Tx mode
	mailbox: skip complete wait event if timer expired
	mailbox: handle empty message in tx_tick
	sched/cgroup: Move sched_online_group() back into css_online() to fix crash
	RDMA/uverbs: Fix the check for port number
	ipmi/watchdog: fix watchdog timeout set on reboot
	dentry name snapshots
	v4l: s5c73m3: fix negation operator
	pstore: Allow prz to control need for locking
	pstore: Correctly initialize spinlock and flags
	pstore: Use dynamic spinlock initializer
	net: skb_needs_check() accepts CHECKSUM_NONE for tx
	device-dax: fix sysfs duplicate warnings
	x86/mce/AMD: Make the init code more robust
	r8169: add support for RTL8168 series add-on card.
	ARM: omap2+: fixing wrong strcat for Non-NULL terminated string
	dt-bindings: power/supply: Update TPS65217 properties
	dt-bindings: input: Specify the interrupt number of TPS65217 power button
	ARM: dts: am57xx-idk: Put USB2 port in peripheral mode
	ARM: dts: n900: Mark eMMC slot with no-sdio and no-sd flags
	net/mlx5: Disable RoCE on the e-switch management port under switchdev mode
	ipv6: Should use consistent conditional judgement for ip6 fragment between __ip6_append_data and ip6_finish_output
	net/mlx4_core: Use-after-free causes a resource leak in flow-steering detach
	net/mlx4: Remove BUG_ON from ICM allocation routine
	net/mlx4_core: Fix raw qp flow steering rules under SRIOV
	drm/msm: Ensure that the hardware write pointer is valid
	drm/msm: Put back the vaddr in submit_reloc()
	drm/msm: Verify that MSM_SUBMIT_BO_FLAGS are set
	vfio-pci: use 32-bit comparisons for register address for gcc-4.5
	irqchip/keystone: Fix "scheduling while atomic" on rt
	ASoC: tlv320aic3x: Mark the RESET register as volatile
	spi: dw: Make debugfs name unique between instances
	ASoC: nau8825: fix invalid configuration in Pre-Scalar of FLL
	irqchip/mxs: Enable SKIP_SET_WAKE and MASK_ON_SUSPEND
	openrisc: Add _text symbol to fix ksym build error
	dmaengine: ioatdma: Add Skylake PCI Dev ID
	dmaengine: ioatdma: workaround SKX ioatdma version
	l2tp: consider '::' as wildcard address in l2tp_ip6 socket lookup
	dmaengine: ti-dma-crossbar: Add some 'of_node_put()' in error path.
	usb: dwc3: omap: fix race of pm runtime with irq handler in probe
	ARM64: zynqmp: Fix W=1 dtc 1.4 warnings
	ARM64: zynqmp: Fix i2c node's compatible string
	perf probe: Fix to get correct modname from elf header
	ARM: s3c2410_defconfig: Fix invalid values for NF_CT_PROTO_*
	ACPI / scan: Prefer devices without _HID/_CID for _ADR matching
	usb: gadget: Fix copy/pasted error message
	Btrfs: use down_read_nested to make lockdep silent
	Btrfs: fix lockdep warning about log_mutex
	benet: stricter vxlan offloading check in be_features_check
	Btrfs: adjust outstanding_extents counter properly when dio write is split
	Xen: ARM: Zero reserved fields of xatp before making hypervisor call
	tools lib traceevent: Fix prev/next_prio for deadline tasks
	xfrm: Don't use sk_family for socket policy lookups
	perf tools: Install tools/lib/traceevent plugins with install-bin
	perf symbols: Robustify reading of build-id from sysfs
	video: fbdev: cobalt_lcdfb: Handle return NULL error from devm_ioremap
	vfio-pci: Handle error from pci_iomap
	arm64: mm: fix show_pte KERN_CONT fallout
	nvmem: imx-ocotp: Fix wrong register size
	net: usb: asix_devices: add .reset_resume for USB PM
	ASoC: fsl_ssi: set fifo watermark to more reliable value
	sh_eth: enable RX descriptor word 0 shift on SH7734
	ARCv2: IRQ: Call entry/exit functions for chained handlers in MCIP
	ALSA: usb-audio: test EP_FLAG_RUNNING at urb completion
	x86/platform/intel-mid: Rename 'spidev' to 'mrfld_spidev'
	perf/x86: Set pmu->module in Intel PMU modules
	ASoC: Intel: bytcr-rt5640: fix settings in internal clock mode
	HID: ignore Petzl USB headlamp
	scsi: fnic: Avoid sending reset to firmware when another reset is in progress
	scsi: snic: Return error code on memory allocation failure
	scsi: bfa: Increase requested firmware version to 3.2.5.1
	ASoC: Intel: Skylake: Release FW ctx in cleanup
	ASoC: dpcm: Avoid putting stream state to STOP when FE stream is paused
	Linux 4.9.41

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2017-08-07 14:21:32 -07:00
Helge Deller
fa2aa76efe parisc: Suspend lockup detectors before system halt 
commit 56188832a5 upstream.

Some machines can't power off the machine, so disable the lockup detectors to
avoid this watchdog BUG to show up every few seconds:
watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [systemd-shutdow:1]

Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-08-06 18:59:40 -07:00
John David Anglin
f0d23fa632 parisc: Extend disabled preemption in copy_user_page 
commit 56008c04eb upstream.

It's always bothered me that we only disable preemption in
copy_user_page around the call to flush_dcache_page_asm.
This patch extends this to after the copy.

Signed-off-by: John David Anglin <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-08-06 18:59:40 -07:00
John David Anglin
afe9fc012b parisc: Prevent TLB speculation on flushed pages on CPUs that only support equivalent aliases 
commit ae7a609c34 upstream.

Helge noticed that we flush the TLB page in flush_cache_page but not in
flush_cache_range or flush_cache_mm.

For a long time, we have had random segmentation faults building
packages on machines with PA8800/8900 processors.  These machines only
support equivalent aliases.  We don't see these faults on machines that
don't require strict coherency.  So, it appears TLB speculation
sometimes leads to cache corruption on machines that require coherency.

This patch adds TLB flushes to flush_cache_range and flush_cache_mm when
coherency is required.  We only flush the TLB in flush_cache_page when
coherency is required.

The patch also optimizes flush_cache_range.  It turns out we always have
the right context to use flush_user_dcache_range_asm and
flush_user_icache_range_asm.

The patch has been tested for some time on rp3440, rp3410 and A500-44.
It's been boot tested on c8000.  No random segmentation faults were
observed during testing.

Signed-off-by: John David Anglin <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-08-06 18:59:39 -07:00
Greg Kroah-Hartman
14accea70e Merge 4.9.39 into android-4.9 
Changes in 4.9.39
	xen-netfront: Rework the fix for Rx stall during OOM and network stress
	net_sched: fix error recovery at qdisc creation
	net: sched: Fix one possible panic when no destroy callback
	net/phy: micrel: configure intterupts after autoneg workaround
	ipv6: avoid unregistering inet6_dev for loopback
	net: dp83640: Avoid NULL pointer dereference.
	tcp: reset sk_rx_dst in tcp_disconnect()
	net: prevent sign extension in dev_get_stats()
	bridge: mdb: fix leak on complete_info ptr on fail path
	rocker: move dereference before free
	bpf: prevent leaking pointer via xadd on unpriviledged
	net: handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish()
	net/mlx5: Cancel delayed recovery work when unloading the driver
	liquidio: fix bug in soft reset failure detection
	net/mlx5e: Fix TX carrier errors report in get stats ndo
	ipv6: dad: don't remove dynamic addresses if link is down
	vxlan: fix hlist corruption
	net: core: Fix slab-out-of-bounds in netdev_stats_to_stats64
	net: ipv6: Compare lwstate in detecting duplicate nexthops
	vrf: fix bug_on triggered by rx when destroying a vrf
	rds: tcp: use sock_create_lite() to create the accept socket
	brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()
	brcmfmac: Fix a memory leak in error handling path in 'brcmf_cfg80211_attach'
	brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain
	sfc: don't read beyond unicast address list
	cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE
	cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES
	cfg80211: Check if PMKID attribute is of expected size
	cfg80211: Check if NAN service ID is of expected size
	irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity
	parisc: Report SIGSEGV instead of SIGBUS when running out of stack
	parisc: use compat_sys_keyctl()
	parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs
	parisc/mm: Ensure IRQs are off in switch_mm()
	tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/: Depth
	thp, mm: fix crash due race in MADV_FREE handling
	kernel/extable.c: mark core_kernel_text notrace
	mm/list_lru.c: fix list_lru_count_node() to be race free
	fs/dcache.c: fix spin lockup issue on nlru->lock
	checkpatch: silence perl 5.26.0 unescaped left brace warnings
	binfmt_elf: use ELF_ET_DYN_BASE only for PIE
	arm: move ELF_ET_DYN_BASE to 4MB
	arm64: move ELF_ET_DYN_BASE to 4GB / 4MB
	powerpc: move ELF_ET_DYN_BASE to 4GB / 4MB
	s390: reduce ELF_ET_DYN_BASE
	exec: Limit arg stack to at most 75% of _STK_LIM
	ARM64: dts: marvell: armada37xx: Fix timer interrupt specifiers
	vt: fix unchecked __put_user() in tioclinux ioctls
	rcu: Add memory barriers for NOCB leader wakeup
	nvmem: core: fix leaks on registration errors
	mnt: In umount propagation reparent in a separate pass
	mnt: In propgate_umount handle visiting mounts in any order
	mnt: Make propagate_umount less slow for overlapping mount propagation trees
	selftests/capabilities: Fix the test_execve test
	mm: fix overflow check in expand_upwards()
	crypto: talitos - Extend max key length for SHA384/512-HMAC and AEAD
	crypto: atmel - only treat EBUSY as transient if backlog
	crypto: sha1-ssse3 - Disable avx2
	crypto: caam - properly set IV after {en,de}crypt
	crypto: caam - fix signals handling
	Revert "sched/core: Optimize SCHED_SMT"
	sched/fair, cpumask: Export for_each_cpu_wrap()
	sched/topology: Fix building of overlapping sched-groups
	sched/topology: Optimize build_group_mask()
	sched/topology: Fix overlapping sched_group_mask
	PM / wakeirq: Convert to SRCU
	PM / QoS: return -EINVAL for bogus strings
	tracing: Use SOFTIRQ_OFFSET for softirq dectection for more accurate results
	kvm: vmx: Do not disable intercepts for BNDCFGS
	kvm: x86: Guest BNDCFGS requires guest MPX support
	kvm: vmx: Check value written to IA32_BNDCFGS
	kvm: vmx: allow host to access guest MSR_IA32_BNDCFGS
	4.9.39

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2017-07-21 08:55:50 +02:00