Commit Graph

796143 Commits

Author SHA1 Message Date
Alistair Delva
45a6d3f518 ANDROID: gki_defconfig: Set IKHEADERS back to =m
This partially reverts I56e59e1a6232dada090d720f43e0d1036f43d064.

The build/runtime vintf check validates that CONFIG_IKHEADERS=m, it is
not allowed to be set to =y. While we figure out what the right course
of action is here, modify it back to =m.

Bug: 139431025
Test: TreeHugger
Change-Id: I3624fa4eb40a8aa726275027aa2b2d5bd635ceda
Signed-off-by: Alistair Delva <adelva@google.com>
2020-01-26 14:58:02 -08:00
Kenny Root
89a7be58e8 ANDROID: gki_defconfig: enable NVDIMM/PMEM options
Options needed for the virtual platform and physical platforms via DT
to define PMEM regions for resume-on-reboot feature

Bug: 146400078
Change-Id: Icaffbd3a7425ac3d9914378fb356d32f9393eec0
Signed-off-by: Kenny Root <kroot@google.com>
2020-01-26 19:05:05 +00:00
Pankaj Gupta
748a437c5c UPSTREAM: virtio-pmem: Add virtio pmem driver
This patch adds virtio-pmem driver for KVM guest.

Guest reads the persistent memory range information from
Qemu over VIRTIO and registers it on nvdimm_bus. It also
creates a nd_region object with the persistent memory
range information so that existing 'nvdimm/pmem' driver
can reserve this into system memory map. This way
'virtio-pmem' driver uses existing functionality of pmem
driver to register persistent memory compatible for DAX
capable filesystems.

This also provides function to perform guest flush over
VIRTIO from 'pmem' driver when userspace performs flush
on DAX memory range.

Signed-off-by: Pankaj Gupta <pagupta@redhat.com>
Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jakub Staron <jstaron@google.com>
Tested-by: Jakub Staron <jstaron@google.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
(cherry picked from commit 6e84200c0a)
Bug: 146400078
Bug: 148297388
Change-Id: Ie3457fe184f29984d181bc0afa9267e2567a2caf
Signed-off-by: Alistair Delva <adelva@google.com>
2020-01-26 19:04:57 +00:00
Pankaj Gupta
d1e787071f UPSTREAM: libnvdimm: nd_region flush callback support
This patch adds functionality to perform flush from guest
to host over VIRTIO. We are registering a callback based
on 'nd_region' type. virtio_pmem driver requires this special
flush function. For rest of the region types we are registering
existing flush function. Report error returned by host fsync
failure to userspace.

Signed-off-by: Pankaj Gupta <pagupta@redhat.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
(cherry picked from commit c5d4355d10)
Bug: 146400078
Bug: 148297388
Change-Id: Icf6ff5327b3c74455a4d53d2d37ac7fef7fbda85
Signed-off-by: Alistair Delva <adelva@google.com>
2020-01-26 19:04:49 +00:00
Aneesh Kumar K.V
4921f55708 UPSTREAM: libnvdimm/of_pmem: Provide a unique name for bus provider
ndctl binaries, v66 and older, mistakenly require the ndbus to have
unique names. If not while enumerating the bus in userspace it drops bus
with similar names.  This results in us not listing devices beneath the
bus.

Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
Tested-by: Vaibhav Jain <vaibhav@linux.ibm.com>
Link: https://lore.kernel.org/r/20190807040029.11344-1-aneesh.kumar@linux.ibm.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
(cherry picked from commit 49bddc73d1)
Bug: 146400078
Bug: 148297388
Change-Id: Ieda4557bbda63e554e2eda6b87d7ba2a6e149e3b
Signed-off-by: Alistair Delva <adelva@google.com>
2020-01-26 19:04:40 +00:00
YueHaibing
e9bc6a61e4 UPSTREAM: libnvdimm/of_pmem: Fix platform_no_drv_owner.cocci warnings
Remove .owner field if calls are used which set it automatically
Generated by: scripts/coccinelle/api/platform_no_drv_owner.cocci

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
(cherry picked from commit 316720b9c2)
Bug: 146400078
Bug: 148297388
Change-Id: I16e7543bcb786e20e96ea4250a809bb3b7f1ec32
Signed-off-by: Alistair Delva <adelva@google.com>
2020-01-26 19:04:31 +00:00
Sami Tolvanen
2a2a01cd99 ANDROID: x86: gki_defconfig: enable LTO and CFI
Bug: 145297900
Change-Id: I9d7d5d158cd28f39808b9f60d391ae7d149e8099
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2020-01-24 21:16:27 +00:00
Sami Tolvanen
b54083c5cb ANDROID: x86: map CFI jump tables in pti_clone_entry_text
Allow CFI enabled entry code to make indirect calls by also mapping
CFI jump tables, and add a check to ensure the jump table section is
not empty.

Bug: 145297900
Change-Id: I1204c50a139ba62234f3bb4699c50921a831162b
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2020-01-24 21:16:24 +00:00
Sami Tolvanen
10d14862f3 ANDROID: BACKPORT: x86, module: Ignore __typeid__ relocations
Also ignore these relocations when loading modules.

Bug: 145297900
Change-Id: I3d00f93deb3cf370ce25f8672f90e410e87ab79e
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2020-01-24 21:16:20 +00:00
Kees Cook
5ff816cb64 ANDROID: BACKPORT: x86, relocs: Ignore __typeid__ relocations
The __typeid__* symbols aren't actually relocations, so they can be
ignored during relocation generation.

Bug: 145297900
Change-Id: I41d0e093b3cdc3665be1722551011da5ec3eb940
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2020-01-24 21:16:00 +00:00
Kees Cook
5f2b3c57b9 ANDROID: BACKPORT: x86/extable: Do not mark exception callback as CFI
The exception table entries are constructed out of a relative offset
and point to the actual function, not the CFI table entry. For now,
just mark the caller as not checking CFI. The failure is most visible
at boot with CONFIG_DEBUG_RODATA_TEST=y.

Bug: 145297900
Change-Id: Ia5e9da358c41b8e8a08e253926ed31775817a4e6
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2020-01-24 21:15:52 +00:00
Kees Cook
abb0969398 FROMLIST: crypto, x86/sha: Eliminate casts on asm implementations
In order to avoid CFI function prototype mismatches, this removes the
casts on assembly implementations of sha1/256/512 accelerators. The
safety checks from BUILD_BUG_ON() remain.

Additionally, this renames various arguments for clarity, as suggested
by Eric Biggers.

Signed-off-by: Kees Cook <keescook@chromium.org>
(am from https://lore.kernel.org/patchwork/patch/1179963/)
Link: https://lore.kernel.org/lkml/202001141955.C4136E9C5@keescook
Bug: 145297900
Change-Id: I331d710f11775b66229acedc59861876a2d6708b
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2020-01-24 21:15:47 +00:00
Hans de Goede
214f4e7195 UPSTREAM: crypto: x86 - Rename functions to avoid conflict with crypto/sha256.h
Rename static / file-local functions so that they do not conflict with
the functions declared in crypto/sha256.h.

This is a preparation patch for folding crypto/sha256.h into crypto/sha.h.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
(cherry picked from commit eb7d6ba882)
Bug: 145297900
Change-Id: I71c660caea1b28089d57e85ee94aad454e0e8d02
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2020-01-24 21:15:34 +00:00
Kees Cook
f35d62d35a UPSTREAM: x86/vmlinux: Actually use _etext for the end of the text segment
Various calculations are using the end of the exception table (which
does not need to be executable) as the end of the text segment. Instead,
in preparation for moving the exception table into RO_DATA, move _etext
after the exception table and update the calculations.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: linux-alpha@vger.kernel.org
Cc: linux-arch@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-c6x-dev@linux-c6x.org
Cc: linux-ia64@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Cc: linux-s390@vger.kernel.org
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Michal Simek <monstr@monstr.eu>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rick Edgecombe <rick.p.edgecombe@intel.com>
Cc: Ross Zwisler <zwisler@chromium.org>
Cc: Segher Boessenkool <segher@kernel.crashing.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Thomas Lendacky <Thomas.Lendacky@amd.com>
Cc: Will Deacon <will@kernel.org>
Cc: x86-ml <x86@kernel.org>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Link: https://lkml.kernel.org/r/20191029211351.13243-16-keescook@chromium.org
(cherry picked from commit b907693883)
Bug: 145297900
Change-Id: I922603ddd5c9db930059c682526c51d2181b858a
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2020-01-24 21:15:27 +00:00
Eric Biggers
679986ce7f ANDROID: update ABI following inline crypto changes
Leaf changes summary: 13 artifacts changed
Changed leaf types summary: 7 leaf types changed
Removed/Changed/Added functions summary: 6 Removed, 0 Changed, 0 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable

6 Removed functions:

  [D] 'function dentry* debugfs_create_dir(const char*, dentry*)'
  [D] 'function dentry* debugfs_create_file(const char*, umode_t, dentry*, void*, const file_operations*)'
  [D] 'function dentry* debugfs_create_x32(const char*, umode_t, dentry*, u32*)'
  [D] 'function void debugfs_remove(dentry*)'
  [D] 'function void debugfs_remove_recursive(dentry*)'
  [D] 'function int drm_debugfs_create_files(const drm_info_list*, int, dentry*, drm_minor*)'

'struct backing_dev_info at backing-dev-defs.h:167:1' changed:
  type size changed from 7936 to 7808 (in bits)
  2 data member deletions:
    'dentry* backing_dev_info::debug_dir', at offset 7808 (in bits) at backing-dev-defs.h:205:1

    'dentry* backing_dev_info::debug_stats', at offset 7872 (in bits) at backing-dev-defs.h:206:1

  43 impacted interfaces:
    function gendisk* __alloc_disk_node(int, int)
    function void __blk_mq_end_request(request*, blk_status_t)
    function void blk_cleanup_queue(request_queue*)
    function void blk_execute_rq(request_queue*, gendisk*, request*, int)
    function bool blk_get_queue(request_queue*)
    function request* blk_get_request(request_queue*, unsigned int, blk_mq_req_flags_t)
    function int blk_mq_alloc_tag_set(blk_mq_tag_set*)
    function void blk_mq_complete_request(request*)
    function void blk_mq_end_request(request*, blk_status_t)
    function void blk_mq_free_tag_set(blk_mq_tag_set*)
    function request_queue* blk_mq_init_queue(blk_mq_tag_set*)
    function void blk_mq_quiesce_queue(request_queue*)
    function void blk_mq_requeue_request(request*, bool)
    function void blk_mq_run_hw_queues(request_queue*, bool)
    function void blk_mq_start_request(request*)
    function void blk_mq_start_stopped_hw_queues(request_queue*, bool)
    function void blk_mq_stop_hw_queue(blk_mq_hw_ctx*)
    function void blk_mq_unquiesce_queue(request_queue*)
    function int blk_mq_virtio_map_queues(blk_mq_tag_set*, virtio_device*, int)
    function void blk_put_queue(request_queue*)
    function void blk_put_request(request*)
    function void blk_queue_alignment_offset(request_queue*, unsigned int)
    function void blk_queue_bounce_limit(request_queue*, u64)
    function void blk_queue_flag_clear(unsigned int, request_queue*)
    function void blk_queue_flag_set(unsigned int, request_queue*)
    function void blk_queue_io_min(request_queue*, unsigned int)
    function void blk_queue_io_opt(request_queue*, unsigned int)
    function void blk_queue_logical_block_size(request_queue*, unsigned int)
    function void blk_queue_max_discard_sectors(request_queue*, unsigned int)
    function void blk_queue_max_hw_sectors(request_queue*, unsigned int)
    function void blk_queue_max_segment_size(request_queue*, unsigned int)
    function void blk_queue_max_segments(request_queue*, unsigned short int)
    function void blk_queue_physical_block_size(request_queue*, unsigned int)
    function void blk_queue_rq_timeout(request_queue*, unsigned int)
    function void blk_queue_write_cache(request_queue*, bool, bool)
    function int blk_rq_map_kern(request_queue*, request*, void*, unsigned int, gfp_t)
    function int blk_rq_map_sg(request_queue*, request*, scatterlist*)
    function bool blk_update_request(request*, blk_status_t, unsigned int)
    function void del_gendisk(gendisk*)
    function void device_add_disk(device*, gendisk*)
    function void put_disk(gendisk*)
    function int revalidate_disk(gendisk*)
    function void set_disk_ro(gendisk*, int)

'struct bio at blk_types.h:145:1' changed:
  type size changed from 1216 to 1280 (in bits)
  1 data member insertion:
    'bool bio::bi_skip_dm_default_key', at offset 1024 (in bits) at blk_types.h:190:1
  there are data member changes:
   'unsigned short int bio::bi_vcnt' offset changed from 1024 to 1040 (in bits) (by +16 bits)
   offset changed from 1024 to 1032 (in bits) (by +8 bits)
   'unsigned short int bio::bi_max_vecs' offset changed from 1040 to 1056 (in bits) (by +16 bits)
   'atomic_t bio::__bi_cnt' offset changed from 1056 to 1088 (in bits) (by +32 bits)
   'bio_vec* bio::bi_io_vec' offset changed from 1088 to 1152 (in bits) (by +64 bits)
   'bio_set* bio::bi_pool' offset changed from 1152 to 1216 (in bits) (by +64 bits)
   'bio_vec bio::bi_inline_vecs[]' offset changed from 1216 to 1280 (in bits) (by +64 bits)

  43 impacted interfaces:
    function gendisk* __alloc_disk_node(int, int)
    function void __blk_mq_end_request(request*, blk_status_t)
    function void blk_cleanup_queue(request_queue*)
    function void blk_execute_rq(request_queue*, gendisk*, request*, int)
    function bool blk_get_queue(request_queue*)
    function request* blk_get_request(request_queue*, unsigned int, blk_mq_req_flags_t)
    function int blk_mq_alloc_tag_set(blk_mq_tag_set*)
    function void blk_mq_complete_request(request*)
    function void blk_mq_end_request(request*, blk_status_t)
    function void blk_mq_free_tag_set(blk_mq_tag_set*)
    function request_queue* blk_mq_init_queue(blk_mq_tag_set*)
    function void blk_mq_quiesce_queue(request_queue*)
    function void blk_mq_requeue_request(request*, bool)
    function void blk_mq_run_hw_queues(request_queue*, bool)
    function void blk_mq_start_request(request*)
    function void blk_mq_start_stopped_hw_queues(request_queue*, bool)
    function void blk_mq_stop_hw_queue(blk_mq_hw_ctx*)
    function void blk_mq_unquiesce_queue(request_queue*)
    function int blk_mq_virtio_map_queues(blk_mq_tag_set*, virtio_device*, int)
    function void blk_put_queue(request_queue*)
    function void blk_put_request(request*)
    function void blk_queue_alignment_offset(request_queue*, unsigned int)
    function void blk_queue_bounce_limit(request_queue*, u64)
    function void blk_queue_flag_clear(unsigned int, request_queue*)
    function void blk_queue_flag_set(unsigned int, request_queue*)
    function void blk_queue_io_min(request_queue*, unsigned int)
    function void blk_queue_io_opt(request_queue*, unsigned int)
    function void blk_queue_logical_block_size(request_queue*, unsigned int)
    function void blk_queue_max_discard_sectors(request_queue*, unsigned int)
    function void blk_queue_max_hw_sectors(request_queue*, unsigned int)
    function void blk_queue_max_segment_size(request_queue*, unsigned int)
    function void blk_queue_max_segments(request_queue*, unsigned short int)
    function void blk_queue_physical_block_size(request_queue*, unsigned int)
    function void blk_queue_rq_timeout(request_queue*, unsigned int)
    function void blk_queue_write_cache(request_queue*, bool, bool)
    function int blk_rq_map_kern(request_queue*, request*, void*, unsigned int, gfp_t)
    function int blk_rq_map_sg(request_queue*, request*, scatterlist*)
    function bool blk_update_request(request*, blk_status_t, unsigned int)
    function void del_gendisk(gendisk*)
    function void device_add_disk(device*, gendisk*)
    function void put_disk(gendisk*)
    function int revalidate_disk(gendisk*)
    function void set_disk_ro(gendisk*, int)

'struct blk_mq_hw_ctx at blk-mq.h:15:1' changed:
  type size hasn't changed
  2 data member deletions:
    'dentry* blk_mq_hw_ctx::debugfs_dir', at offset 4160 (in bits) at blk-mq.h:69:1

    'dentry* blk_mq_hw_ctx::sched_debugfs_dir', at offset 4224 (in bits) at blk-mq.h:70:1

  there are data member changes:
   'srcu_struct blk_mq_hw_ctx::srcu[]' offset changed from 4288 to 4160 (in bits) (by -128 bits)

  one impacted interface:
    function void blk_mq_stop_hw_queue(blk_mq_hw_ctx*)

'struct drm_crtc at drm_crtc.h:816:1' changed:
  type size changed from 9856 to 9792 (in bits)
  1 data member deletion:
    'dentry* drm_crtc::debugfs_entry', at offset 8832 (in bits) at drm_crtc.h:1007:1

  there are data member changes:
   'drm_crtc_crc drm_crtc::crc' offset changed from 8896 to 8832 (in bits) (by -64 bits)
   'unsigned int drm_crtc::fence_context' offset changed from 9472 to 9408 (in bits) (by -64 bits)
   'spinlock_t drm_crtc::fence_lock' offset changed from 9504 to 9440 (in bits) (by -64 bits)
   'unsigned long int drm_crtc::fence_seqno' offset changed from 9536 to 9472 (in bits) (by -64 bits)
   'char drm_crtc::timeline_name[32]' offset changed from 9600 to 9536 (in bits) (by -64 bits)

  65 impacted interfaces:
    function int drm_add_edid_modes(drm_connector*, edid*)
    function int drm_add_modes_noedid(drm_connector*, int, int)
    function int drm_atomic_helper_check(drm_device*, drm_atomic_state*)
    function void drm_atomic_helper_cleanup_planes(drm_device*, drm_atomic_state*)
    function int drm_atomic_helper_commit(drm_device*, drm_atomic_state*, bool)
    function void drm_atomic_helper_commit_hw_done(drm_atomic_state*)
    function void drm_atomic_helper_commit_modeset_disables(drm_device*, drm_atomic_state*)
    function void drm_atomic_helper_commit_modeset_enables(drm_device*, drm_atomic_state*)
    function void drm_atomic_helper_commit_planes(drm_device*, drm_atomic_state*, uint32_t)
    function void drm_atomic_helper_connector_destroy_state(drm_connector*, drm_connector_state*)
    function drm_connector_state* drm_atomic_helper_connector_duplicate_state(drm_connector*)
    function void drm_atomic_helper_connector_reset(drm_connector*)
    function void drm_atomic_helper_crtc_destroy_state(drm_crtc*, drm_crtc_state*)
    function drm_crtc_state* drm_atomic_helper_crtc_duplicate_state(drm_crtc*)
    function void drm_atomic_helper_crtc_reset(drm_crtc*)
    function int drm_atomic_helper_disable_plane(drm_plane*, drm_modeset_acquire_ctx*)
    function int drm_atomic_helper_page_flip(drm_crtc*, drm_framebuffer*, drm_pending_vblank_event*, uint32_t, drm_modeset_acquire_ctx*)
    function void drm_atomic_helper_plane_destroy_state(drm_plane*, drm_plane_state*)
    function drm_plane_state* drm_atomic_helper_plane_duplicate_state(drm_plane*)
    function void drm_atomic_helper_plane_reset(drm_plane*)
    function int drm_atomic_helper_set_config(drm_mode_set*, drm_modeset_acquire_ctx*)
    function void drm_atomic_helper_shutdown(drm_device*)
    function int drm_atomic_helper_update_plane(drm_plane*, drm_crtc*, drm_framebuffer*, int, int, unsigned int, unsigned int, uint32_t, uint32_t, uint32_t, uint32_t, drm_modeset_acquire_ctx*)
    function void drm_atomic_helper_wait_for_vblanks(drm_device*, drm_atomic_state*)
    function void drm_connector_attach_edid_property(drm_connector*)
    function int drm_connector_attach_encoder(drm_connector*, drm_encoder*)
    function void drm_connector_cleanup(drm_connector*)
    function int drm_connector_init(drm_device*, drm_connector*, const drm_connector_funcs*, int)
    function int drm_connector_register(drm_connector*)
    function void drm_connector_unregister(drm_connector*)
    function int drm_connector_update_edid_property(drm_connector*, const edid*)
    function void drm_crtc_cleanup(drm_crtc*)
    function int drm_crtc_init_with_planes(drm_device*, drm_crtc*, drm_plane*, drm_plane*, const drm_crtc_funcs*, const char*, ...)
    function void drm_crtc_send_vblank_event(drm_crtc*, drm_pending_vblank_event*)
    function drm_display_mode* drm_cvt_mode(drm_device*, int, int, int, bool, bool, bool)
    function drm_device* drm_dev_alloc(drm_driver*, device*)
    function void drm_dev_put(drm_device*)
    function int drm_dev_register(drm_device*, unsigned long int)
    function int drm_dev_set_unique(drm_device*, const char*)
    function edid* drm_do_get_edid(drm_connector*, void ()*, void*)
    function void drm_encoder_cleanup(drm_encoder*)
    function int drm_encoder_init(drm_device*, drm_encoder*, const drm_encoder_funcs*, int, const char*, ...)
    function int drm_framebuffer_init(drm_device*, drm_framebuffer*, const drm_framebuffer_funcs*)
    function int drm_gem_handle_create(drm_file*, drm_gem_object*, u32*)
    function int drm_gem_object_init(drm_device*, drm_gem_object*, size_t)
    function drm_gem_object* drm_gem_object_lookup(drm_file*, u32)
    function void drm_gem_object_put_unlocked(drm_gem_object*)
    function void drm_gem_object_release(drm_gem_object*)
    function dma_buf* drm_gem_prime_export(drm_device*, drm_gem_object*, int)
    function int drm_gem_prime_fd_to_handle(drm_device*, drm_file*, int, uint32_t*)
    function int drm_gem_prime_handle_to_fd(drm_device*, drm_file*, uint32_t, uint32_t, int*)
    function drm_gem_object* drm_gem_prime_import(drm_device*, dma_buf*)
    function int drm_gem_prime_mmap(drm_gem_object*, vm_area_struct*)
    function bool drm_helper_hpd_irq_event(drm_device*)
    function void drm_helper_mode_fill_fb_struct(drm_device*, drm_framebuffer*, const drm_mode_fb_cmd2*)
    function int drm_helper_probe_single_connector_modes(drm_connector*, uint32_t, uint32_t)
    function void drm_kms_helper_hotplug_event(drm_device*)
    function void drm_mode_config_cleanup(drm_device*)
    function void drm_mode_config_init(drm_device*)
    function void drm_mode_config_reset(drm_device*)
    function void drm_mode_probed_add(drm_connector*, drm_display_mode*)
    function void drm_plane_cleanup(drm_plane*)
    function void drm_put_dev(drm_device*)
    function void drm_set_preferred_mode(drm_connector*, int, int)
    function int drm_universal_plane_init(drm_device*, drm_plane*, uint32_t, const drm_plane_funcs*, const uint32_t*, unsigned int, const uint64_t*, drm_plane_type, const char*, ...)

'struct elevator_type at elevator.h:135:1' changed:
  type size changed from 2496 to 2304 (in bits)
  2 data member deletions:
    'const blk_mq_debugfs_attr* elevator_type::queue_debugfs_attrs', at offset 2048 (in bits) at elevator.h:153:1

    'const blk_mq_debugfs_attr* elevator_type::hctx_debugfs_attrs', at offset 2112 (in bits) at elevator.h:154:1

  there are data member changes:
   'char elevator_type::icq_cache_name[22]' offset changed from 2176 to 1992 (in bits) (by -184 bits)
   'list_head elevator_type::list' offset changed from 2368 to 2176 (in bits) (by -192 bits)

  43 impacted interfaces:
    function gendisk* __alloc_disk_node(int, int)
    function void __blk_mq_end_request(request*, blk_status_t)
    function void blk_cleanup_queue(request_queue*)
    function void blk_execute_rq(request_queue*, gendisk*, request*, int)
    function bool blk_get_queue(request_queue*)
    function request* blk_get_request(request_queue*, unsigned int, blk_mq_req_flags_t)
    function int blk_mq_alloc_tag_set(blk_mq_tag_set*)
    function void blk_mq_complete_request(request*)
    function void blk_mq_end_request(request*, blk_status_t)
    function void blk_mq_free_tag_set(blk_mq_tag_set*)
    function request_queue* blk_mq_init_queue(blk_mq_tag_set*)
    function void blk_mq_quiesce_queue(request_queue*)
    function void blk_mq_requeue_request(request*, bool)
    function void blk_mq_run_hw_queues(request_queue*, bool)
    function void blk_mq_start_request(request*)
    function void blk_mq_start_stopped_hw_queues(request_queue*, bool)
    function void blk_mq_stop_hw_queue(blk_mq_hw_ctx*)
    function void blk_mq_unquiesce_queue(request_queue*)
    function int blk_mq_virtio_map_queues(blk_mq_tag_set*, virtio_device*, int)
    function void blk_put_queue(request_queue*)
    function void blk_put_request(request*)
    function void blk_queue_alignment_offset(request_queue*, unsigned int)
    function void blk_queue_bounce_limit(request_queue*, u64)
    function void blk_queue_flag_clear(unsigned int, request_queue*)
    function void blk_queue_flag_set(unsigned int, request_queue*)
    function void blk_queue_io_min(request_queue*, unsigned int)
    function void blk_queue_io_opt(request_queue*, unsigned int)
    function void blk_queue_logical_block_size(request_queue*, unsigned int)
    function void blk_queue_max_discard_sectors(request_queue*, unsigned int)
    function void blk_queue_max_hw_sectors(request_queue*, unsigned int)
    function void blk_queue_max_segment_size(request_queue*, unsigned int)
    function void blk_queue_max_segments(request_queue*, unsigned short int)
    function void blk_queue_physical_block_size(request_queue*, unsigned int)
    function void blk_queue_rq_timeout(request_queue*, unsigned int)
    function void blk_queue_write_cache(request_queue*, bool, bool)
    function int blk_rq_map_kern(request_queue*, request*, void*, unsigned int, gfp_t)
    function int blk_rq_map_sg(request_queue*, request*, scatterlist*)
    function bool blk_update_request(request*, blk_status_t, unsigned int)
    function void del_gendisk(gendisk*)
    function void device_add_disk(device*, gendisk*)
    function void put_disk(gendisk*)
    function int revalidate_disk(gendisk*)
    function void set_disk_ro(gendisk*, int)

'struct request_queue at blkdev.h:434:1' changed:
  type size changed from 18048 to 17920 (in bits)
  2 data member deletions:
    'dentry* request_queue::debugfs_dir', at offset 17152 (in bits) at blkdev.h:668:1

    'dentry* request_queue::sched_debugfs_dir', at offset 17216 (in bits) at blkdev.h:669:1

  there are data member changes:
   'bool request_queue::mq_sysfs_init_done' offset changed from 17280 to 17152 (in bits) (by -128 bits)
   'size_t request_queue::cmd_size' offset changed from 17344 to 17216 (in bits) (by -128 bits)
   'void* request_queue::rq_alloc_data' offset changed from 17408 to 17280 (in bits) (by -128 bits)
   'work_struct request_queue::release_work' offset changed from 17472 to 17344 (in bits) (by -128 bits)
   'u64 request_queue::write_hints[5]' offset changed from 17728 to 17600 (in bits) (by -128 bits)

  43 impacted interfaces:
    function gendisk* __alloc_disk_node(int, int)
    function void __blk_mq_end_request(request*, blk_status_t)
    function void blk_cleanup_queue(request_queue*)
    function void blk_execute_rq(request_queue*, gendisk*, request*, int)
    function bool blk_get_queue(request_queue*)
    function request* blk_get_request(request_queue*, unsigned int, blk_mq_req_flags_t)
    function int blk_mq_alloc_tag_set(blk_mq_tag_set*)
    function void blk_mq_complete_request(request*)
    function void blk_mq_end_request(request*, blk_status_t)
    function void blk_mq_free_tag_set(blk_mq_tag_set*)
    function request_queue* blk_mq_init_queue(blk_mq_tag_set*)
    function void blk_mq_quiesce_queue(request_queue*)
    function void blk_mq_requeue_request(request*, bool)
    function void blk_mq_run_hw_queues(request_queue*, bool)
    function void blk_mq_start_request(request*)
    function void blk_mq_start_stopped_hw_queues(request_queue*, bool)
    function void blk_mq_stop_hw_queue(blk_mq_hw_ctx*)
    function void blk_mq_unquiesce_queue(request_queue*)
    function int blk_mq_virtio_map_queues(blk_mq_tag_set*, virtio_device*, int)
    function void blk_put_queue(request_queue*)
    function void blk_put_request(request*)
    function void blk_queue_alignment_offset(request_queue*, unsigned int)
    function void blk_queue_bounce_limit(request_queue*, u64)
    function void blk_queue_flag_clear(unsigned int, request_queue*)
    function void blk_queue_flag_set(unsigned int, request_queue*)
    function void blk_queue_io_min(request_queue*, unsigned int)
    function void blk_queue_io_opt(request_queue*, unsigned int)
    function void blk_queue_logical_block_size(request_queue*, unsigned int)
    function void blk_queue_max_discard_sectors(request_queue*, unsigned int)
    function void blk_queue_max_hw_sectors(request_queue*, unsigned int)
    function void blk_queue_max_segment_size(request_queue*, unsigned int)
    function void blk_queue_max_segments(request_queue*, unsigned short int)
    function void blk_queue_physical_block_size(request_queue*, unsigned int)
    function void blk_queue_rq_timeout(request_queue*, unsigned int)
    function void blk_queue_write_cache(request_queue*, bool, bool)
    function int blk_rq_map_kern(request_queue*, request*, void*, unsigned int, gfp_t)
    function int blk_rq_map_sg(request_queue*, request*, scatterlist*)
    function bool blk_update_request(request*, blk_status_t, unsigned int)
    function void del_gendisk(gendisk*)
    function void device_add_disk(device*, gendisk*)
    function void put_disk(gendisk*)
    function int revalidate_disk(gendisk*)
    function void set_disk_ro(gendisk*, int)

'struct sync_file at sync_file.h:35:1' changed:
  type size changed from 960 to 832 (in bits)
  1 data member deletion:
    'list_head sync_file::sync_file_list', at offset 320 (in bits) at sync_file.h:46:1

  there are data member changes:
   'wait_queue_head_t sync_file::wq' offset changed from 448 to 320 (in bits) (by -128 bits)
   'unsigned long int sync_file::flags' offset changed from 640 to 512 (in bits) (by -128 bits)
   'dma_fence* sync_file::fence' offset changed from 704 to 576 (in bits) (by -128 bits)
   'dma_fence_cb sync_file::cb' offset changed from 768 to 640 (in bits) (by -128 bits)

  one impacted interface:
    function sync_file* sync_file_create(dma_fence*)

Bug: 137270441
Change-Id: I24a32d241b8055c51a22af7c552f575f9d596843
Signed-off-by: Eric Biggers <ebiggers@google.com>
2020-01-24 12:06:49 -08:00
Eric Biggers
3d7bea608b ANDROID: gki_defconfig: enable dm-default-key
dm-default-key is needed for metadata encryption
(https://source.android.com/security/encryption/metadata).

The new version of dm-default-key is vendor-independent and can be used
both with and without inline encryption hardware.

Bug: 137270441
Bug: 147814592
Change-Id: I92ce45c4b1543ff8bc5cdb5ebe4ddcdb740c2dc7
Signed-off-by: Eric Biggers <ebiggers@google.com>
2020-01-24 12:02:45 -08:00
Eric Biggers
b32863f17f ANDROID: dm: add dm-default-key target for metadata encryption
Add a device-mapper target "dm-default-key" which assigns an encryption
key to bios that aren't for the contents of an encrypted file.

This ensures that all blocks on-disk will be encrypted with some key,
without the performance hit of file contents being encrypted twice when
fscrypt (File-Based Encryption) is used.

It is only appropriate to use dm-default-key when key configuration is
tightly controlled, like it is in Android, such that all fscrypt keys
are at least as hard to compromise as the default key.

Compared to the original version of dm-default-key, this has been
modified to use the new vendor-independent inline encryption framework
(which works even when no inline encryption hardware is present), the
table syntax has been changed to match dm-crypt, and support for
specifying Adiantum encryption has been added.  These changes also mean
that dm-default-key now always explicitly specifies the DUN (the IV).

Also, to handle f2fs moving blocks of encrypted files around without the
key, and to handle ext4 and f2fs filesystems mounted without
'-o inlinecrypt', the mapping logic is no longer "set a key on the bio
if it doesn't have one already", but rather "set a key on the bio unless
the bio has the bi_skip_dm_default_key flag set".  Filesystems set this
flag on *all* bios for encrypted file contents, regardless of whether
they are encrypting/decrypting the file using inline encryption or the
traditional filesystem-layer encryption, or moving the raw data.

For the bi_skip_dm_default_key flag, a new field in struct bio is used
rather than a bit in bi_opf so that fscrypt_set_bio_crypt_ctx() can set
the flag, minimizing the changes needed to filesystems.  (bi_opf is
usually overwritten after fscrypt_set_bio_crypt_ctx() is called.)

Bug: 137270441
Bug: 147814592
Change-Id: I69c9cd1e968ccf990e4ad96e5115b662237f5095
Signed-off-by: Eric Biggers <ebiggers@google.com>
2020-01-24 10:49:09 -08:00
Eric Biggers
94706caf62 ANDROID: dm: enable may_passthrough_inline_crypto on some targets
dm-linear obviously can pass through inline crypto support.

In addition, we need dm-bow to pass through inline crypto support, as
the userdata partition in Android may be located on top of dm-bow.

Bug: 137270441
Change-Id: Ib9b0f67b77391fa450394568ceed441c1508de6e
Signed-off-by: Eric Biggers <ebiggers@google.com>
2020-01-24 10:49:09 -08:00
Eric Biggers
44e1174c18 ANDROID: dm: add support for passing through inline crypto support
Update the device-mapper core to support exposing the inline crypto
support of the underlying device(s) through the device-mapper device.

This works by creating a "passthrough keyslot manager" for the dm
device, which declares support for the set of (crypto_mode,
data_unit_size) combos which all the underlying devices support.  When a
supported combo is used, the bio cloning code handles cloning the crypto
context to the bios for all the underlying devices.  When an unsupported
combo is used, the blk-crypto fallback is used as usual.

Crypto support on each underlying device is ignored unless the
corresponding dm target opts into exposing it.  This is needed because
for inline crypto to semantically operate on the original bio, the data
must not be transformed by the dm target.  Thus, targets like dm-linear
can expose crypto support of the underlying device, but targets like
dm-crypt can't.  (dm-crypt could use inline crypto itself, though.)

When a key is evicted from the dm device, it is evicted from all
underlying devices.

Bug: 137270441
Bug: 147814592
Change-Id: If28b574f2e28268db5eb9f325d4cf8f96cb63e3f
Signed-off-by: Eric Biggers <ebiggers@google.com>
2020-01-24 10:49:09 -08:00
Satya Tangirala
e65d08ae68 ANDROID: block: Introduce passthrough keyslot manager
The regular keyslot manager is designed for devices that have a small
number of keyslots that need to be programmed with keys ahead of time,
and bios that are sent to the device need to be tagged with a keyslot
index.

Some inline encryption hardware may not have any limitations on the
number of keyslot, and may instead allow each bio to be tagged with
a raw key, data unit number, etc. rather than a pre-programmed keyslot's
index. These devices don't need any sort of keyslot management, and it's
better for these devices not to have to allocate a regular keyslot
manager with some fixed number of keyslots. These devices can instead
set up a passthrough keyslot manager in their request queue, which
require less resources than regular keyslot managers, as they simply
do no-ops when trying to program keys into slots.

Separately, the device mapper may map over devices that have inline
encryption hardware, and it wants to pass the key along to the
underlying hardware. While the DM layer can expose inline encryption
capabilities by setting up a regular keyslot manager with some fixed
number of keyslots in the dm device's request queue, this only wastes
memory since the keys programmed into the dm device's request queue
will never be used. Instead, it's better to set up a passthrough
keyslot manager for dm devices.

Bug: 137270441
Bug: 147814592
Change-Id: I6d91e83e86a73b0d6066873c8a9117cf2c089234
Signed-off-by: Satya Tangirala <satyat@google.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
2020-01-24 10:49:09 -08:00
Eric Biggers
8f48f6657d ANDROID: ext4, f2fs: enable direct I/O with inline encryption
ext4 and f2fs have traditionally not supported direct I/O on encrypted
files, since it's difficult to implement with the traditional
filesystem-layer encryption.  But when inline encryption is used
instead, it's straightforward to support direct I/O, as long as the I/O
is fully filesystem-block-aligned.  Add support for it by:

- Making the two generic direct I/O implementations in the kernel,
  __blockdev_direct_IO() and iomap_dio_rw(), set the encryption context
  on bios for inline-encrypted files.  __blockdev_direct_IO() is used by
  f2fs, and was used by ext4 in kernel v5.4 and earlier.  iomap_dio_rw()
  is used by ext4 in kernel v5.5 and later.

- Making ext4 and f2fs allow direct I/O to encrypted files (rather the
  current behavior of falling back to buffered I/O) when the file is
  using inline encryption and the I/O is fully filesystem-block-aligned.

Bug: 137270441
Change-Id: I4c8f7497eb8f829d03611d24281113d68c21d4d1
Signed-off-by: Eric Biggers <ebiggers@google.com>
2020-01-24 10:49:09 -08:00
Eric Biggers
bbee78199f FROMLIST: scsi: ufs: add program_key() variant op
On Snapdragon SoCs, the Linux kernel isn't permitted to directly access
the standard UFS crypto configuration registers.  Instead, programming
and evicting keys must be done through vendor-specific SMC calls.

To support this hardware, add a ->program_key() method to
'struct ufs_hba_variant_ops'.  This allows overriding the UFS standard
key programming procedure.

Link: https://lore.kernel.org/r/20200110061634.46742-5-ebiggers@kernel.org
Bug: 137270441
Bug: 147259927
Change-Id: Ia561d5a51421baaf78de52a1eaec496093a0d0ad
Signed-off-by: Eric Biggers <ebiggers@google.com>
2020-01-24 10:49:09 -08:00
Eric Biggers
0f1c72a2f5 ANDROID: block: export symbols needed for modules to use inline crypto
Export the blk-crypto symbols needed for modules to use inline crypto.

These would have already been exported, except that so far they've only
been used by fs/crypto/, which is no longer modular.

Bug: 137270441
Bug: 147814592
Change-Id: I64bf98aecabe891c188b30dd50124aacb1e008ca
Signed-off-by: Eric Biggers <ebiggers@google.com>
2020-01-24 10:49:09 -08:00
Eric Biggers
35b62551b9 ANDROID: block: fix some inline crypto bugs
While we're waiting for v7 of the inline crypto patchset, fix some bugs
that made it into the v6 patchset, including one that caused bios with
an encryption context to never be merged, and one that could cause
non-contiguous pages to incorrectly added to a bio.

Bug: 137270441
Change-Id: I3911fcd6c76b5c9063b86d6af6267ad990a46718
Signed-off-by: Eric Biggers <ebiggers@google.com>
2020-01-24 10:49:09 -08:00
Minchan Kim
5b18331d27 UPSTREAM: mm/page_io.c: annotate refault stalls from swap_readpage
If a block device supports rw_page operation, it doesn't submit bios so
the annotation in submit_bio() for refault stall doesn't work.  It
happens with zram in android, especially swap read path which could
consume CPU cycle for decompress.  It is also a problem for zswap which
uses frontswap.

Annotate swap_readpage() to account the synchronous IO overhead to
prevent underreport memory pressure.

[akpm@linux-foundation.org: add comment, per Johannes]
Link: http://lkml.kernel.org/r/20191010152134.38545-1-minchan@kernel.org
Signed-off-by: Minchan Kim <minchan@google.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Shakeel Butt <shakeelb@google.com>
Cc: Seth Jennings <sjenning@redhat.com>
Cc: Dan Streetman <ddstreet@ieee.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

(cherry picked from commit 937790699b)
Bug: 142418748
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: Ibb3ca48ad331af38a99ea428dcfbd78a26758739
2020-01-24 17:54:49 +00:00
Laura Abbott
4dcb40753b UPSTREAM: lib/test_meminit.c: add bulk alloc/free tests
Upstream commit dc5c5ad79f ("lib/test_meminit.c: add bulk alloc/free
tests").

kmem_cache_alloc_bulk/kmem_cache_free_bulk are used to make multiple
allocations of the same size to avoid the overhead of multiple
kmalloc/kfree calls.  Extend the kmem_cache tests to make some calls to
these APIs.

Link: http://lkml.kernel.org/r/20191107191447.23058-1-labbott@redhat.com
Signed-off-by: Laura Abbott <labbott@redhat.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Tested-by: Alexander Potapenko <glider@google.com>
Cc: Laura Abbott <labbott@redhat.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Kostya Serebryany <kcc@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Sandeep Patil <sspatil@android.com>
Cc: Jann Horn <jannh@google.com>
Cc: Marco Elver <elver@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Bug: 138435492
Test: Boot an ARM64 mobile device with and without init_on_alloc=1
Change-Id: I78e767949384359a00c9aaf893d725649bd1732c
Signed-off-by: Alexander Potapenko <glider@google.com>
2020-01-24 13:46:13 +01:00
Alexander Potapenko
2689307b65 UPSTREAM: lib/test_meminit: add a kmem_cache_alloc_bulk() test
Upstream commit 03a9349ac0 ("lib/test_meminit: add a kmem_cache_alloc_bulk()
test").

Make sure allocations from kmem_cache_alloc_bulk() and
kmem_cache_free_bulk() are properly initialized.

Link: http://lkml.kernel.org/r/20191007091605.30530-2-glider@google.com
Signed-off-by: Alexander Potapenko <glider@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Christoph Lameter <cl@linux.com>
Cc: Laura Abbott <labbott@redhat.com>
Cc: Thibaut Sautereau <thibaut@sautereau.fr>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Bug: 138435492
Test: Boot an ARM64 mobile device with and without init_on_alloc=1
Change-Id: I59a742796d1dba97fdbd17b1ffec4830ee91a390
Signed-off-by: Alexander Potapenko <glider@google.com>
2020-01-24 13:46:06 +01:00
Alexander Potapenko
6a6bb41535 UPSTREAM: mm/slub.c: init_on_free=1 should wipe freelist ptr for bulk allocations
Upstream commit 0f181f9fbe ("mm/slub.c: init_on_free=1 should wipe freelist
ptr for bulk allocations").

slab_alloc_node() already zeroed out the freelist pointer if
init_on_free was on.  Thibaut Sautereau noticed that the same needs to
be done for kmem_cache_alloc_bulk(), which performs the allocations
separately.

kmem_cache_alloc_bulk() is currently used in two places in the kernel,
so this change is unlikely to have a major performance impact.

SLAB doesn't require a similar change, as auto-initialization makes the
allocator store the freelist pointers off-slab.

Link: http://lkml.kernel.org/r/20191007091605.30530-1-glider@google.com
Fixes: 6471384af2 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options")
Signed-off-by: Alexander Potapenko <glider@google.com>
Reported-by: Thibaut Sautereau <thibaut@sautereau.fr>
Reported-by: Kees Cook <keescook@chromium.org>
Cc: Christoph Lameter <cl@linux.com>
Cc: Laura Abbott <labbott@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Bug: 138435492
Test: Boot an ARM64 mobile device with and without init_on_alloc=1
Change-Id: Iec7e3ab5c536f62183ad5a1e6003a56e49012286
Signed-off-by: Alexander Potapenko <glider@google.com>
2020-01-24 13:45:59 +01:00
Hridya Valsaraju
983e2cdf34 ANDROID: mm/cma.c: Export symbols
Export the symbols cma_get_name, cma_alloc, cma_release
and cma_for_each_area.

These are required to modularize the ion driver.

Test: build
Bug: 147914088

Change-Id: I873fd346265be1395d2ba738aca6b9dee03700e2
Signed-off-by: Hridya Valsaraju <hridya@google.com>
2020-01-23 15:37:36 -08:00
Hridya Valsaraju
b2af33d051 ANDROID: gki_defconfig: Set CONFIG_ION=m
Test: build, boot and video playback works on cuttlefish
Bug: 147914088

Change-Id: I6143f0def4047a84eb0f7a4c33df1c1cf3b6ffe2
Signed-off-by: Hridya Valsaraju <hridya@google.com>
2020-01-23 15:37:27 -08:00
Hridya Valsaraju
266b4d3045 ANDROID: lib/plist: Export symbol plist_add
The symbol is required by the ion driver when modularized.

Test: build, boot
Bug: 147914088

Change-Id: I667866e809cb00c5ad0f39ed82b20f5fc3397a0f
Signed-off-by: Hridya Valsaraju <hridya@google.com>
2020-01-23 15:37:21 -08:00
Hridya Valsaraju
f64a8b79c0 ANDROID: staging: android: ion: enable modularizing the ion driver
This patch enable setting CONFIG_ION=m.

Bug: 147914088
Test: Build, boot, video playback is successful.
Change-Id: I014046fec793a10a61669faa18aa655048d5aaa4
Signed-off-by: Hridya Valsaraju <hridya@google.com>
2020-01-23 15:37:13 -08:00
Jeff Vander Stoep
025a1ee618 Revert "ANDROID: security,perf: Allow further restriction of perf_event_open"
Unfork Android.

This reverts commit 8e5e42d5ae.

Perf_event_paranoid=3 is no longer needed on Android. Access control
of perf events is now done by selinux. See:
https://patchwork.kernel.org/patch/11185793/

Bug: 120445712
Bug: 137092007
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Change-Id: Iba493424174b30baff460caaa25a54a472c87bd4
2020-01-23 22:02:46 +00:00
Jeff Vander Stoep
c3f91ecb17 ANDROID: selinux: modify RTM_GETLINK permission
Map the permission gating RTM_GETLINK messages to a new permission so
that it can be distinguished from the other netlink route permissions
in selinux policy.

This is a temporary Android-only patch that will be deprecated in
newer kernels once the long-term solution lands as discusssed on the
mailing list [1]. The maintainer's recommended solution is more
general, much more complex, and likely not suitable for backporting.
This patch provides the minimal change needed for Android including
the userspace settable trigger which ensures that the permission
change is only applied to the newest version of Android which
contains the changes needed for userpace compatibility.

[1]: https://lore.kernel.org/selinux/20200116142653.61738-1-jeffv@google.com/

Bug: 141455849
Bug: 148218425

Test: CtsSelinuxTargetSdkCurrentTestCases
Test: atest bionic-unit-tests-static
Test: atest NetworkInterfaceTest
Test: Connect to Wi-Fi network
Test: Set up hotspot
Test: Cast from device
Test: Pair Bluetooth device
Test: Call getifaddrs() directly from within an app.
Test: Call NetworkInterface#getNetworkInterfaces() from within an app.

Change-Id: I7b44ce60ad98f858c412722d41b9842f8577151f
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
2020-01-23 21:58:44 +00:00
Hridya Valsaraju
1d794c2702 FROMLIST: security: selinux: allow per-file labelling for binderfs
This patch allows genfscon per-file labeling for binderfs.
This is required to have separate permissions to allow
access to binder, hwbinder and vndbinder devices which are
relocating to binderfs.

Acked-by: Jeff Vander Stoep <jeffv@google.com>
Acked-by: Mark Salyzyn <salyzyn@android.com>
Signed-off-by: Hridya Valsaraju <hridya@google.com>

Bug: 136497735
(cherry picked from commit 7a4b519474
git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git
master)
Link: https://lore.kernel.org/patchwork/patch/1175776/
Change-Id: I105cc54b30ddd4120dc23a363bddc2f9d00e4dc4
2020-01-23 19:46:51 +00:00
Kusanagi Kouichi
3ccf82e899 BACKPORT: tracing: Remove unnecessary DEBUG_FS dependency
Tracing replaced debugfs with tracefs.

Signed-off-by: Kusanagi Kouichi <slash@ac.auone-net.jp>
Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Link: https://lore.kernel.org/r/20191120104350753.EWCT.12796.ppp.dion.ne.jp@dmta0009.auone-net.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 0e4a459f56)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Id61dddcb804cf7a5d62d2d04a455d8b84097c967
2020-01-23 11:16:22 +01:00
Kusanagi Kouichi
ff06463d09 BACKPORT: debugfs: Fix !DEBUG_FS debugfs_create_automount
If DEBUG_FS=n, compile fails with the following error:

kernel/trace/trace.c: In function 'tracing_init_dentry':
kernel/trace/trace.c:8658:9: error: passing argument 3 of 'debugfs_create_automount' from incompatible pointer type [-Werror=incompatible-pointer-types]
 8658 |         trace_automount, NULL);
      |         ^~~~~~~~~~~~~~~
      |         |
      |         struct vfsmount * (*)(struct dentry *, void *)
In file included from kernel/trace/trace.c:24:
./include/linux/debugfs.h:206:25: note: expected 'struct vfsmount * (*)(void *)' but argument is of type 'struct vfsmount * (*)(struct dentry *, void *)'
  206 |      struct vfsmount *(*f)(void *),
      |      ~~~~~~~~~~~~~~~~~~~^~~~~~~~~~

Signed-off-by: Kusanagi Kouichi <slash@ac.auone-net.jp>
Link: https://lore.kernel.org/r/20191121102021787.MLMY.25002.ppp.dion.ne.jp@dmta0003.auone-net.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 4250b04703)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ifddd54e40956f8cdeca8a1a24d0754cda47b91e9
2020-01-23 11:16:22 +01:00
Greg Kroah-Hartman
ec7e6a4eef ANDROID: update abi for 4.19.98
Leaf changes summary: 3 artifacts changed
Changed leaf types summary: 2 leaf types changed
Removed/Changed/Added functions summary: 0 Removed, 1 Changed, 0 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable

1 function with some sub-type change:

  [C]'function void blk_queue_logical_block_size(request_queue*, unsigned short int)' at blk-settings.c:382:1 has some sub-type changes:
    parameter 2 of type 'unsigned short int' changed:
    type name changed from 'unsigned short int' to 'unsigned int'
    type size changed from 16 to 32 (in bits)

'struct queue_limits at blkdev.h:365:1' changed:
  type size hasn't changed
  there are data member changes:
   'unsigned int queue_limits::alignment_offset' offset changed from 384 to 416 (in bits) (by +32 bits)
   'unsigned int queue_limits::io_min' offset changed from 416 to 448 (in bits) (by +32 bits)
   'unsigned int queue_limits::io_opt' offset changed from 448 to 480 (in bits) (by +32 bits)
   'unsigned int queue_limits::max_discard_sectors' offset changed from 480 to 512 (in bits) (by +32 bits)
   'unsigned int queue_limits::max_hw_discard_sectors' offset changed from 512 to 544 (in bits) (by +32 bits)
   'unsigned int queue_limits::max_write_same_sectors' offset changed from 544 to 576 (in bits) (by +32 bits)
   'unsigned int queue_limits::max_write_zeroes_sectors' offset changed from 576 to 608 (in bits) (by +32 bits)
   'unsigned int queue_limits::discard_granularity' offset changed from 608 to 640 (in bits) (by +32 bits)
   'unsigned int queue_limits::discard_alignment' offset changed from 640 to 672 (in bits) (by +32 bits)
   type 'unsigned short int' of 'queue_limits::logical_block_size' changed:
     type name changed from 'unsigned short int' to 'unsigned int'
     type size changed from 16 to 32 (in bits)
, offset changed from 672 to 384 (in bits) (by -288 bits), size changed from 16 to 32 (in bits) (by +16 bits)
   'unsigned short int queue_limits::max_segments' offset changed from 688 to 704 (in bits) (by +16 bits)
   'unsigned short int queue_limits::max_integrity_segments' offset changed from 704 to 720 (in bits) (by +16 bits)
   'unsigned short int queue_limits::max_discard_segments' offset changed from 720 to 736 (in bits) (by +16 bits)
   'unsigned char queue_limits::misaligned' offset changed from 736 to 752 (in bits) (by +16 bits)
   'unsigned char queue_limits::discard_misaligned' offset changed from 744 to 760 (in bits) (by +16 bits)
   'unsigned char queue_limits::cluster' offset changed from 752 to 768 (in bits) (by +16 bits)
   'unsigned char queue_limits::raid_partial_stripes_expensive' offset changed from 760 to 776 (in bits) (by +16 bits)
   'blk_zoned_model queue_limits::zoned' offset changed from 768 to 800 (in bits) (by +32 bits)

  37 impacted interfaces

'struct request_queue at blkdev.h:434:1' changed:
  type size hasn't changed
  there are data member changes:
   type 'struct queue_limits' of 'request_queue::limits' changed as reported earlier

  37 impacted interfaces

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5d948f629b31c74f5d3c3d5a65a92b59b7798390
2020-01-23 09:38:49 +01:00
Greg Kroah-Hartman
8cb4870403 Merge 4.19.98 into android-4.19
Changes in 4.19.98
	ARM: dts: meson8: fix the size of the PMU registers
	clk: qcom: gcc-sdm845: Add missing flag to votable GDSCs
	dt-bindings: reset: meson8b: fix duplicate reset IDs
	ARM: dts: imx6q-dhcom: fix rtc compatible
	clk: Don't try to enable critical clocks if prepare failed
	ASoC: msm8916-wcd-digital: Reset RX interpolation path after use
	iio: buffer: align the size of scan bytes to size of the largest element
	USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx
	USB: serial: option: Add support for Quectel RM500Q
	USB: serial: opticon: fix control-message timeouts
	USB: serial: option: add support for Quectel RM500Q in QDL mode
	USB: serial: suppress driver bind attributes
	USB: serial: ch341: handle unbound port at reset_resume
	USB: serial: io_edgeport: handle unbound ports on URB completion
	USB: serial: io_edgeport: add missing active-port sanity check
	USB: serial: keyspan: handle unbound ports
	USB: serial: quatech2: handle unbound ports
	scsi: fnic: fix invalid stack access
	scsi: mptfusion: Fix double fetch bug in ioctl
	ASoC: msm8916-wcd-analog: Fix selected events for MIC BIAS External1
	ASoC: msm8916-wcd-analog: Fix MIC BIAS Internal1
	ARM: dts: imx6q-dhcom: Fix SGTL5000 VDDIO regulator connection
	ALSA: dice: fix fallback from protocol extension into limited functionality
	ALSA: seq: Fix racy access for queue timer in proc read
	ALSA: usb-audio: fix sync-ep altsetting sanity check
	arm64: dts: allwinner: a64: olinuxino: Fix SDIO supply regulator
	Fix built-in early-load Intel microcode alignment
	block: fix an integer overflow in logical block size
	ARM: dts: am571x-idk: Fix gpios property to have the correct gpio number
	LSM: generalize flag passing to security_capable
	ptrace: reintroduce usage of subjective credentials in ptrace_has_cap()
	usb: core: hub: Improved device recognition on remote wakeup
	x86/resctrl: Fix an imbalance in domain_remove_cpu()
	x86/CPU/AMD: Ensure clearing of SME/SEV features is maintained
	x86/efistub: Disable paging at mixed mode entry
	drm/i915: Add missing include file <linux/math64.h>
	x86/resctrl: Fix potential memory leak
	perf hists: Fix variable name's inconsistency in hists__for_each() macro
	perf report: Fix incorrectly added dimensions as switch perf data file
	mm/shmem.c: thp, shmem: fix conflict of above-47bit hint address and PMD alignment
	mm: memcg/slab: call flush_memcg_workqueue() only if memcg workqueue is valid
	btrfs: rework arguments of btrfs_unlink_subvol
	btrfs: fix invalid removal of root ref
	btrfs: do not delete mismatched root refs
	btrfs: fix memory leak in qgroup accounting
	mm/page-writeback.c: avoid potential division by zero in wb_min_max_ratio()
	ARM: dts: imx6qdl: Add Engicam i.Core 1.5 MX6
	ARM: dts: imx6q-icore-mipi: Use 1.5 version of i.Core MX6DL
	ARM: dts: imx7: Fix Toradex Colibri iMX7S 256MB NAND flash support
	net: stmmac: 16KB buffer must be 16 byte aligned
	net: stmmac: Enable 16KB buffer size
	mm/huge_memory.c: make __thp_get_unmapped_area static
	mm/huge_memory.c: thp: fix conflict of above-47bit hint address and PMD alignment
	arm64: dts: agilex/stratix10: fix pmu interrupt numbers
	bpf: Fix incorrect verifier simulation of ARSH under ALU32
	cfg80211: fix deadlocks in autodisconnect work
	cfg80211: fix memory leak in cfg80211_cqm_rssi_update
	cfg80211: fix page refcount issue in A-MSDU decap
	netfilter: fix a use-after-free in mtype_destroy()
	netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct
	netfilter: nft_tunnel: fix null-attribute check
	netfilter: nf_tables: remove WARN and add NLA_STRING upper limits
	netfilter: nf_tables: store transaction list locally while requesting module
	netfilter: nf_tables: fix flowtable list del corruption
	NFC: pn533: fix bulk-message timeout
	batman-adv: Fix DAT candidate selection on little endian systems
	macvlan: use skb_reset_mac_header() in macvlan_queue_xmit()
	hv_netvsc: Fix memory leak when removing rndis device
	net: dsa: tag_qca: fix doubled Tx statistics
	net: hns: fix soft lockup when there is not enough memory
	net: usb: lan78xx: limit size of local TSO packets
	net/wan/fsl_ucc_hdlc: fix out of bounds write on array utdm_info
	ptp: free ptp device pin descriptors properly
	r8152: add missing endpoint sanity check
	tcp: fix marked lost packets not being retransmitted
	sh_eth: check sh_eth_cpu_data::dual_port when dumping registers
	mlxsw: spectrum: Wipe xstats.backlog of down ports
	mlxsw: spectrum_qdisc: Include MC TCs in Qdisc counters
	xen/blkfront: Adjust indentation in xlvbd_alloc_gendisk
	tcp: refine rule to allow EPOLLOUT generation under mem pressure
	irqchip: Place CONFIG_SIFIVE_PLIC into the menu
	cw1200: Fix a signedness bug in cw1200_load_firmware()
	arm64: dts: meson-gxl-s905x-khadas-vim: fix gpio-keys-polled node
	cfg80211: check for set_wiphy_params
	tick/sched: Annotate lockless access to last_jiffies_update
	arm64: dts: marvell: Fix CP110 NAND controller node multi-line comment alignment
	Revert "arm64: dts: juno: add dma-ranges property"
	mtd: devices: fix mchp23k256 read and write
	drm/nouveau/bar/nv50: check bar1 vmm return value
	drm/nouveau/bar/gf100: ensure BAR is mapped
	drm/nouveau/mmu: qualify vmm during dtor
	reiserfs: fix handling of -EOPNOTSUPP in reiserfs_for_each_xattr
	scsi: esas2r: unlock on error in esas2r_nvram_read_direct()
	scsi: qla4xxx: fix double free bug
	scsi: bnx2i: fix potential use after free
	scsi: target: core: Fix a pr_debug() argument
	scsi: qla2xxx: Fix qla2x00_request_irqs() for MSI
	scsi: qla2xxx: fix rports not being mark as lost in sync fabric scan
	scsi: core: scsi_trace: Use get_unaligned_be*()
	perf probe: Fix wrong address verification
	clk: sprd: Use IS_ERR() to validate the return value of syscon_regmap_lookup_by_phandle()
	regulator: ab8500: Remove SYSCLKREQ from enum ab8505_regulator_id
	hwmon: (pmbus/ibm-cffps) Switch LEDs to blocking brightness call
	Linux 4.19.98

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I74a43a9e60734aec6d24b10374ba97de89172eca
2020-01-23 08:36:16 +01:00
Greg Kroah-Hartman
d183c8e264 Linux 4.19.98 2020-01-23 08:21:39 +01:00
Eddie James
fbab369859 hwmon: (pmbus/ibm-cffps) Switch LEDs to blocking brightness call
commit 9861ff954c upstream.

Since i2c_smbus functions can sleep, the brightness setting function
for this driver must be the blocking version to avoid scheduling while
atomic.

Signed-off-by: Eddie James <eajames@linux.ibm.com>
Link: https://lore.kernel.org/r/20191106200106.29519-2-eajames@linux.ibm.com
Fixes: ef9e1cdf41 ("hwmon: (pmbus/cffps) Add led class device for power supply fault led")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-23 08:21:39 +01:00
Stephan Gerhold
0b7cd89c95 regulator: ab8500: Remove SYSCLKREQ from enum ab8505_regulator_id
commit 458ea3ad03 upstream.

Those regulators are not actually supported by the AB8500 regulator
driver. There is no ab8500_regulator_info for them and no entry in
ab8505_regulator_match.

As such, they cannot be registered successfully, and looking them
up in ab8505_regulator_match causes an out-of-bounds array read.

Fixes: 547f384f33 ("regulator: ab8500: add support for ab8505")
Cc: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20191106173125.14496-2-stephan@gerhold.net
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-23 08:21:39 +01:00
Baolin Wang
8e94de44ea clk: sprd: Use IS_ERR() to validate the return value of syscon_regmap_lookup_by_phandle()
commit 9629dbdabd upstream.

The syscon_regmap_lookup_by_phandle() will never return NULL, thus use
IS_ERR() to validate the return value instead of IS_ERR_OR_NULL().

Fixes: d41f59fd92 ("clk: sprd: Add common infrastructure")
Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
Link: https://lkml.kernel.org/r/1995139bee5248ff3e9d46dc715968f212cfc4cc.1570520268.git.baolin.wang@linaro.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-23 08:21:39 +01:00
Masami Hiramatsu
eaac3dc7be perf probe: Fix wrong address verification
commit 07d3698578 upstream.

Since there are some DIE which has only ranges instead of the
combination of entrypc/highpc, address verification must use
dwarf_haspc() instead of dwarf_entrypc/dwarf_highpc.

Also, the ranges only DIE will have a partial code in different section
(e.g. unlikely code will be in text.unlikely as "FUNC.cold" symbol). In
that case, we can not use dwarf_entrypc() or die_entrypc(), because the
offset from original DIE can be a minus value.

Instead, this simply gets the symbol and offset from symtab.

Without this patch;

  # perf probe -D clear_tasks_mm_cpumask:1
  Failed to get entry address of clear_tasks_mm_cpumask
    Error: Failed to add events.

And with this patch:

  # perf probe -D clear_tasks_mm_cpumask:1
  p:probe/clear_tasks_mm_cpumask clear_tasks_mm_cpumask+0
  p:probe/clear_tasks_mm_cpumask_1 clear_tasks_mm_cpumask+5
  p:probe/clear_tasks_mm_cpumask_2 clear_tasks_mm_cpumask+8
  p:probe/clear_tasks_mm_cpumask_3 clear_tasks_mm_cpumask+16
  p:probe/clear_tasks_mm_cpumask_4 clear_tasks_mm_cpumask+82

Committer testing:

I managed to reproduce the above:

  [root@quaco ~]# perf probe -D clear_tasks_mm_cpumask:1
  p:probe/clear_tasks_mm_cpumask _text+919968
  p:probe/clear_tasks_mm_cpumask_1 _text+919973
  p:probe/clear_tasks_mm_cpumask_2 _text+919976
  [root@quaco ~]#

But then when trying to actually put the probe in place, it fails if I
use :0 as the offset:

  [root@quaco ~]# perf probe -L clear_tasks_mm_cpumask | head -5
  <clear_tasks_mm_cpumask@/usr/src/debug/kernel-5.2.fc30/linux-5.2.18-200.fc30.x86_64/kernel/cpu.c:0>
        0  void clear_tasks_mm_cpumask(int cpu)
        1  {
        2  	struct task_struct *p;

  [root@quaco ~]# perf probe clear_tasks_mm_cpumask:0
  Probe point 'clear_tasks_mm_cpumask' not found.
    Error: Failed to add events.
  [root@quaco

The next patch is needed to fix this case.

Fixes: 576b523721 ("perf probe: Fix probing symbols with optimization suffix")
Reported-by: Arnaldo Carvalho de Melo <acme@kernel.org>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Link: http://lore.kernel.org/lkml/157199318513.8075.10463906803299647907.stgit@devnote2
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-23 08:21:39 +01:00
Bart Van Assche
223dfefed3 scsi: core: scsi_trace: Use get_unaligned_be*()
commit b1335f5b04 upstream.

This patch fixes an unintended sign extension on left shifts. From Colin
King: "Shifting a u8 left will cause the value to be promoted to an
integer. If the top bit of the u8 is set then the following conversion to
an u64 will sign extend the value causing the upper 32 bits to be set in
the result."

Fix this by using get_unaligned_be*() instead.

Fixes: bf81623542 ("[SCSI] add scsi trace core functions and put trace points")
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Douglas Gilbert <dgilbert@interlog.com>
Link: https://lore.kernel.org/r/20191101211447.187151-1-bvanassche@acm.org
Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-23 08:21:38 +01:00
Martin Wilck
f78f18c34e scsi: qla2xxx: fix rports not being mark as lost in sync fabric scan
commit d341e9a8f2 upstream.

In qla2x00_find_all_fabric_devs(), fcport->flags & FCF_LOGIN_NEEDED is a
necessary condition for logging into new rports, but not for dropping lost
ones.

Fixes: 726b854870 ("qla2xxx: Add framework for async fabric discovery")
Link: https://lore.kernel.org/r/20191122221912.20100-2-martin.wilck@suse.com
Tested-by: David Bond <dbond@suse.com>
Signed-off-by: Martin Wilck <mwilck@suse.com>
Acked-by: Himanshu Madhani <hmadhani@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-23 08:21:38 +01:00
Huacai Chen
216e517ca8 scsi: qla2xxx: Fix qla2x00_request_irqs() for MSI
commit 45dc8f2d9c upstream.

Commit 4fa1834559 ("scsi: qla2xxx: Utilize pci_alloc_irq_vectors/
pci_free_irq_vectors calls.") use pci_alloc_irq_vectors() to replace
pci_enable_msi() but it didn't handle the return value correctly. This bug
make qla2x00 always fail to setup MSI if MSI-X fail, so fix it.

BTW, improve the log message of return value in qla2x00_request_irqs() to
avoid confusion.

Fixes: 4fa1834559 ("scsi: qla2xxx: Utilize pci_alloc_irq_vectors/pci_free_irq_vectors calls.")
Cc: Michael Hernandez <michael.hernandez@cavium.com>
Link: https://lore.kernel.org/r/1574314847-14280-1-git-send-email-chenhc@lemote.com
Signed-off-by: Huacai Chen <chenhc@lemote.com>
Acked-by: Himanshu Madhani <hmadhani@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-23 08:21:38 +01:00
Bart Van Assche
d27b78caf3 scsi: target: core: Fix a pr_debug() argument
commit c941e0d172 upstream.

Print the string for which conversion failed instead of printing the
function name twice.

Fixes: 2650d71e24 ("target: move transport ID handling to the core")
Cc: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20191107215525.64415-1-bvanassche@acm.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-23 08:21:38 +01:00
Pan Bian
295a863b91 scsi: bnx2i: fix potential use after free
commit 29d28f2b8d upstream.

The member hba->pcidev may be used after its reference is dropped. Move the
put function to where it is never used to avoid potential use after free
issues.

Fixes: a771718065 ("[SCSI] bnx2i: Removed the reference to the netdev->base_addr")
Link: https://lore.kernel.org/r/1573043541-19126-1-git-send-email-bianpan2016@163.com
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-23 08:21:38 +01:00
Pan Bian
e3c9310b66 scsi: qla4xxx: fix double free bug
commit 3fe3d2428b upstream.

The variable init_fw_cb is released twice, resulting in a double free
bug. The call to the function dma_free_coherent() before goto is removed to
get rid of potential double free.

Fixes: 2a49a78ed3 ("[SCSI] qla4xxx: added IPv6 support.")
Link: https://lore.kernel.org/r/1572945927-27796-1-git-send-email-bianpan2016@163.com
Signed-off-by: Pan Bian <bianpan2016@163.com>
Acked-by: Manish Rangankar <mrangankar@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-23 08:21:38 +01:00