Commit Graph

406623 Commits

Author SHA1 Message Date
Zheng Yang
4e642b3d5d ARM: dts: rk3228: hdmi: add pinctrl and pclk_hdmi_phy
Change-Id: I5570a3bf1970e6f8748cab55fea06a11af5c4f3e
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>
2015-10-27 17:57:42 +08:00
Huang, Tao
800979108b Merge branch 'android-3.10'
Exclude:
ext4 crypto
nl80211: fix scheduled scan RSSI matchset attribute confusion
mmc
Add wlan platform partial_resume handler
wlan: Add WLAN_PLAT_AP_FLAG for SOFTAP country code
ipc
zram
2015-10-27 17:35:20 +08:00
Ruchi Kandoi
d7670225d3 uid_cputime: Check for the range while removing range of UIDs.
Checking if the uid_entry->uid matches the uid intended to be removed will
prevent deleting unwanted uid_entry.
Type cast the key for the hashtable to the same size, as when they were
inserted. This will make sure that we can find the uid_entry we want.

Bug: 25195548
Change-Id: I567942123cfb20e4b61ad624da19ec4cc84642c1
Signed-off: Ruchi kandoi <kandoiruchi@google.com>
(cherry picked from commit 170458885df2e4e081d3f8489cfd4f66a9598995)
2015-10-27 17:22:46 +08:00
Riley Andrews
35d9cc3d71 Revert "android: binder: Change binder mutex to rtmutex."
This reverts commit ebce7cd30b.

This ends up doing more damage than good on most devices. Go back to
using a standard mutex.

(cherry picked from commit ea93186577de4fae3a2273c296bfcf1839048df0)
2015-10-27 17:14:39 +08:00
Eric Dumazet
4582a29e6b ipv6: inet6_sk() should use sk_fullsock()
SYN_RECV & TIMEWAIT sockets are not full blown, they do not have a pinet6
pointer.

Bug: 24163529
Change-Id: I6ce67a190d67d200c6ebeb81d2daeb9c86cd7581
Fixes: ca6fb06518 ("tcp: attach SYNACK messages to request sockets instead of listener")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
(cherry picked from commit feee3c175c23ae72ed17154caaa82a3002de0023)
2015-10-27 17:14:21 +08:00
Eric Dumazet
d1d2a95cc6 net: add sk_fullsock() helper
We have many places where we want to check if a socket is
not a timewait or request socket. Use a helper to avoid
hard coding this.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

[backported from net-next 1d0ab25387]
[lorenzo@google.com: removed TCPF_NEW_SYN_RECV, and added a comment to add it back.]

Signed-off-by: Lorenzo Colitti <lorenzo@google.com>

Bug: 24163529
Change-Id: Ibf09017e1ab00af5e6925273117c335d7f515d73
(cherry picked from commit cdab04e3612c55f0906c84c3c05996a0507eab7d)
2015-10-27 17:14:07 +08:00
Martijn Coenen
4937dd7952 lowmemorykiller: trace kill events.
Allows for capturing lmk kill events and
their rationale.

Change-Id: Ibe215db5bb9806fc550c72c0b9832c85cbd56bf6
Signed-off-by: Martijn Coenen <maco@google.com>
(cherry picked from commit 6cfb58f07af4b913508f087fe551a08f5a21eb88)
2015-10-27 16:48:44 +08:00
Ard Biesheuvel
53a95fc774 arm64/crypto: use crypto instructions to generate AES key schedule
(cherry pick from commit 12ac3efe74)

This patch implements the AES key schedule generation using ARMv8
Crypto Instructions. It replaces the table based C implementation
in aes_generic.ko, which means we can drop the dependency on that
module.

Tested-by: Steve Capper <steve.capper@linaro.org>
Acked-by: Steve Capper <steve.capper@linaro.org>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Bug: 23181629
(cherry picked from commit 60b9dd6043fdc26860d850c364fd92b1f4e170fc)
2015-10-27 16:48:16 +08:00
Riley Andrews
d2d46598ca arm64: crypto: Change priority of arm64 aes cipher.
(cherry pick from commit d802476e8db2eb616d47d0a06310276532cc2ffa)

Change-Id: I0c614e0eca71b65945ff8bd17c65b03a02918b18
Signed-off-by: Riley Andrews <riandrews@google.com>
Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Bug: 23181629
(cherry picked from commit 52d464160266101140ce95992256c25cc03e2bb3)
2015-10-27 16:47:58 +08:00
Jeff Vander Stoep
3841b3185d selinux: do not check open perm on ftruncate call
Use the ATTR_FILE attribute to distinguish between truncate()
and ftruncate() system calls. The two other cases where
do_truncate is called with a filp (and therefore ATTR_FILE is set)
are for coredump files and for open(O_TRUNC). In both of those cases
the open permission has already been checked during file open and
therefore does not need to be repeated.

Commit 95dbf73931 ("SELinux: check OPEN on truncate calls")
fixed a major issue where domains were allowed to truncate files
without the open permission. However, it introduced a new bug where
a domain with the write permission can no longer ftruncate files
without the open permission, even when they receive an already open
file.

(cherry picked from commit b21800f304392ee5d20f411c37470183cc779f11)

Bug: 22567870
Change-Id: Id7c305e46beba5091c2c777529bd468216aae1c3

Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <pmoore@redhat.com>
(cherry picked from commit df46bc83c1fc9b64b2e86290935a3ad550b2e56e)
2015-10-27 16:47:05 +08:00
Lorenzo Colitti
abe081915c Fix NULL pointer dereference in tcp_nuke_addr.
tcp_nuke addr only grabs the bottom half socket lock, but not the
userspace socket lock. This allows a userspace program to call
close() while the socket is running, which causes a NULL pointer
dereference in inet_put_port.

Bug: 23663111
Bug: 24072792
Change-Id: Iecb63af68c2db4764c74785153d1c9054f76b94f
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
(cherry picked from commit 74d66ee756afcc3269e4c1341f793c52be629af9)
2015-10-27 16:46:47 +08:00
Amit Pundir
0f5728d8fa usb: phy: fix dual role sysfs build if kernel modules are supported
Add a missing ";" after EXPORT_SYMBOL() otherwise we run
into following build error if Kernel Modules are supported:
----------
  CC      drivers/usb/phy/class-dual-role.o
drivers/usb/phy/class-dual-role.c:91:1: error: expected ',' or ';' before 'int'
 int dual_role_get_property(struct dual_role_phy_instance *dual_role,
 ^
make[3]: *** [drivers/usb/phy/class-dual-role.o] Error 1
----------

Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
(cherry picked from commit 9ff158f4c245c2fecb1489a4aae62ca67c0846a1)

Change-Id: I7ec77584b3a753448ddc50a74204a20f4636f8a4
(cherry picked from commit f5af56b478111455ce9041d958b83f13bc742af6)
2015-10-27 16:45:44 +08:00
Vinil Cheeramvelil
a7858114c4 ion: Handle the memory mapping correctly on x86
This patch modifies the ion page pool code to address
limitation in x86 PAT. When one physical page is mapped
to multiple virtual pages, the same cache policy
should be used. Add set_memory_wc/uc call to avoid aliases.
If not, all mappings will be cached(write back).

Change-Id: I98ee8902df0c80135dddfa998c4ca4c2bb44e40e
Signed-off-by: Zhebin Jin <zhebin.jin@intel.com>
Signed-off-by: Vinil Cheeramvelil <vinil.cheeramvelil@intel.com>
(cherry picked from commit 6db47cc7e2f1d8dd8fc84912202ed749d6781a76)

Conflicts:
	drivers/staging/android/ion/Kconfig
	drivers/staging/android/ion/ion_priv.h
2015-10-27 16:42:39 +08:00
Badhri Jagan Sridharan
20a191e67f usb: phy: Dual role sysfs class definition
This CL adds a new class to monitor and change
dual role usb ports from userspace. The usb
phy drivers can register to the dual_role_usb
class and expose the capabilities of the ports.
The phy drivers can decide on whether a specific
attribute can be changed from userspace by
choosing to implement the appropriate callback.

Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Bug: 21615151
Change-Id: I121b4a94437972b5abe8f781e3007efa8531978
(cherry picked from commit f3061b9d608ce2314f24088281131ebadafa3985)
2015-10-27 16:38:24 +08:00
Jin Qian
16467c9593 trace/events: fix compilation error
include/trace/events/filemap.h: In function 'ftrace_raw_output_mm_filemap_find_page_cache_miss':
include/trace/ftrace.h:232:9: error: format '%lu' expects argument of type 'long unsigned int', but argument 5 has type 'size_t' [-Werror=format=]

Change-Id: Ic2d76f18fc8802cf1e2246f96d84a06d267a30ad
Signed-off-by: Jin Qian <jinqian@google.com>
(cherry picked from commit c91e2d317307431283b96ce040e8aefd44b0b286)
2015-10-27 16:36:47 +08:00
Amir Goldstein
3cd879a2e4 sysrq: Emergency Remount R/O in reverse order
This change fixes a problem where reboot on Android panics the kernel
almost every time when file systems are mounted over loop devices.

Android reboot command does:
- sync
- echo u > /proc/sysrq-trigger
- syscall_reboot

The problem is with sysrq emergency remount R/O trying to remount-ro
in wrong order.
since /data is re-mounted ro before loop devices, loop device
remount-ro fails to flush the journal and panics the kernel:

  EXT4-fs (loop0): Remounting filesystem read-only
  EXT4-fs (loop0): previous I/O error to superblock detected
  loop: Write error at byte offset 0, length 4096.
  Buffer I/O error on device loop0, logical block 0
  lost page write due to I/O error on loop0
  Kernel panic - not syncing: EXT4-fs panic from previous error

The fix is quite simple. In do_emergency_remount(), use
list_for_each_entry_reverse() on sb list instead of list_for_each_entry().
It makes a lot of sense to umount the file systems in reverse order in
which they were added to sb list.

Change-Id: I4370e39b5873bd16ade5d5f9ddb2704beb02a2bb
Signed-off-by: Amir Goldstein <amir@cellrox.com>
Acked-by: Oren Laadan <orenl@cellrox.com>
(cherry picked from commit 334cc257d864f112b64fb885be908e6cdd644c08)
2015-10-27 16:36:15 +08:00
Mark Salyzyn
9f55a4566d pstore: pmsg: return -ENOMEM on vmalloc failure
Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Bug: 23385441
Change-Id: I294cb72c25bddafbba4e64fdb0a18ae46655a05d
(cherry picked from commit 62bb84973c1d55a4cc35cc4d95cb723ce0aa2c0b)
2015-10-27 16:36:01 +08:00
Daniel Campello
63dbcf66cd Page cache miss tracing using ftrace on mm/filemap
This patch includes two trace events on generic_perform_write and
do_generic_file_read to check on the address_space mapping for the
pages to be accessed by the request.

Change-Id: Ib319b9b2c971b9e5c76645be6cfd995ef9465d77
Signed-off-by: Daniel Campello <campello@google.com>
(cherry picked from commit d3952c50853166bd04562766c9603ed86ab0da75)

Conflicts:
	include/linux/pagemap.h
2015-10-27 16:35:08 +08:00
Ruchi Kandoi
2d5778b3fa wakeup_reason: use vsnprintf instead of snsprintf for vargs.
Bug: 22368519
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit 26dfa1394af4da60bf8ce7c5e56168b1ad8f2179)
2015-10-27 16:28:33 +08:00
Ruchi Kandoi
ba53469fa9 uid_cputime: Iterates over all the threads instead of processes.
Bug: 22833116
Change-Id: I775a18f61bd2f4df2bec23d01bd49421d0969f87
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit eb9cf7d0d416edc93edfe6e784189f02c82701a1)
2015-10-27 16:28:27 +08:00
Erik Kline
4375ac61a0 ipv6: sysctl to restrict candidate source addresses
Per RFC 6724, section 4, "Candidate Source Addresses":

    It is RECOMMENDED that the candidate source addresses be the set
    of unicast addresses assigned to the interface that will be used
    to send to the destination (the "outgoing" interface).

Add a sysctl to enable this behaviour.

Signed-off-by: Erik Kline <ek@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

[Simplified back-port of net-next 3985e8a361]

Bug: 19470192
Bug: 21832279
Bug: 22464419
Change-Id: Ib74ef945dcabe64215064f15ee1660b6524d65ce
(cherry picked from commit 0633924e7776754ccb473d649e5fa9ee45617a46)
2015-10-27 16:28:21 +08:00
Jin Qian
69923ebd71 uid_cputime: fix cputime overflow
Converting cputime_t to usec caused overflow when the value is greater
than 1 hour. Use msec and convert to unsigned long long to support bigger
range.

Bug: 22461683

Change-Id: I853fe3e8e7dbf0d3e2cc5c6f9688a5a6e1f1fb3e
Signed-off-by: Jin Qian <jinqian@google.com>
(cherry picked from commit 75bf23fe4bfb1805b411965b5ce3c4b81b957898)
2015-10-27 16:28:15 +08:00
Rom Lemarchand
6cb6484943 initramfs: Add skip_initramfs command line option
Add a skip_initramfs option to allow choosing whether to boot using
the initramfs or not at runtime.

Change-Id: If30428fa748c1d4d3d7b9d97c1f781de5e4558c3
Signed-off-by: Rom Lemarchand <romlem@google.com>
(cherry picked from commit 6f36227aa43c9e4b17a2dcda6a38e79d1b00d1b5)
2015-10-27 16:28:09 +08:00
Ruchi Kandoi
4fd5475f2e cpu_power: Avoids race condition when the task exits.
When the task is terminated, the cpu_power for that particular task is
added to the terminated tasks. cpu_power is set to ULLONG_MAX at this
point to avoid double accounting of the power. It is possible that before the
task releases all the resources, cpu reschedules the task or a timer
interrupt is fired. At this point we will try to add the additional time
to the process, which will cause the accounting to be skewed. This
avoids the case where we change the cpu_power when it is already set to
ULLONG_MAX.

Bug: 22064385
Change-Id: I405733725d535b0a864088516bf52fa3638ee6aa
Signed-off-by: Jin Qian <jinqian@google.com>
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit fd72341df7e6e8b834f5d4ec86a30f248eb96385)
2015-10-27 16:28:04 +08:00
Sami Tolvanen
0512cdb54e Fix arch/arm/crypto/sha256_glue.c
MODULE_ALIAS_CRYPTO is not defined, use MODULE_ALIAS.

Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Change-Id: I24803dbbbf7ac7889bc027f69af371b594eca835
(cherry picked from 5eb3cca16fcf9c62753058aaf73bb12b71acba79)

(cherry picked from commit 9645fcee58b4af5f9f9a530f0fb514e7245012a8)
2015-10-27 16:27:59 +08:00
Alexander Shiyan
9565a65b88 of: add empty of_find_node_by_path() for !OF
Add an empty version of of_find_node_by_path().
This fixes following build error for asoc tree:
sound/soc/fsl/fsl_ssi.c: In function 'fsl_ssi_probe':
sound/soc/fsl/fsl_ssi.c:1471:2: error: implicit declaration of function 'of_find_node_by_path' [-Werror=implicit-function-declaration]
  sprop = of_get_property(of_find_node_by_path("/"), "compatible", NULL);

Change-Id: Ib635dffb97877a2820fb80b99db96a285a6d2d14
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
Signed-off-by: Rob Herring <robh@kernel.org>
(cherry picked from commit 9e7f1b065a312062eb8acdb1c505ddb3792b7583)
2015-10-27 16:27:54 +08:00
Ruchi Kandoi
9092bf1d95 uid_cputime: Avoids double accounting of process stime, utime and cpu_power in
task exit.

This avoids the race where a particular process is terminating and we
read the show_uid_stats. At this time since the task_struct still exists
and we will account for the terminating process as one of the active
task, where as the stats would have been added in the task exit
callback.

Bug: 22064385
Change-Id: Id2ae04b33fcd230eda9683a41b6019d4dd8f5d85
Signed-off-by: Jin Qian <jinqian@google.com>
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit ddd9aac59e0aea3d5a4df485173115e8ecb3e17d)
2015-10-27 16:27:50 +08:00
Tobias Lindskog
04e3d27696 Shrink ashmem directly through shmem_fallocate
When ashmem_shrink is called from direct reclaim on a user thread, a
call to do_fallocate will check for permissions against the security
policy of that user thread.  It can thus fail by chance if called on a
thread that isn't permitted to modify the relevant ashmem areas.

Because we know that we have a shmem file underneath, call the shmem
implementation of fallocate directly instead of going through the
user-space interface for fallocate.

FIX=DMS06243560
Area: Kernel/Linux Kernel

Bug: 21951515
Change-Id: Ie98fff18a2bdeb535cd24d4fbdd13677e12681a7
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
(cherry picked from commit 2ecc7f173a30ee7df10240d6944108252a5f5b7d)
2015-10-27 16:27:39 +08:00
Ruchi Kandoi
9b48fbb685 cpufreq: Iterate over all the possible cpus to create powerstats.
For architectures which support a single policy for multiple cpus,
powerstats will not be initalized for all the cores. This change will
make sure powerstats is initialized for all the cores.

Also minor changes to increase code readability.

Bug: 21498425
Change-Id: I938f45e92ff6d5371c32c4d0e37274e6de66769c
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit 5862c50d1970886b5b5a57b5b52ecfd6feb95ebd)
2015-10-27 16:27:25 +08:00
Huang, Tao
f40cf81b65 Merge tag 'v3.10.92'
This is the 3.10.92 stable release
2015-10-27 14:09:58 +08:00
Huang, Tao
743bc6e18a Merge tag 'lsk-v3.10-15.10-android'
LSK Android 15.10 v3.10
2015-10-27 14:07:45 +08:00
David Wu
ca3cf578d4 uart: rockchip: add uart supported for rk3228
Change-Id: I86b49f20954a739645b9277e45d6b75058ff9c2b
Signed-off-by: David Wu <wdc@rock-chips.com>
2015-10-27 11:07:27 +08:00
zhangqing
aa27e726b9 ARM: dts: rk3228: tsadc: support tsadc for rk3228
add rk3228 tsadc parameter for dtsi.

Change-Id: I74cc9b6c2e4d53aa5e3391d5a820937925f07077
Signed-off-by: zhangqing <zhangqing@rock-chips.com>
2015-10-27 02:54:03 -07:00
Greg Kroah-Hartman
d17332ebfb Linux 3.10.92 2015-10-27 09:45:05 +09:00
Ilya Dryomov
f22714069f rbd: fix double free on rbd_dev->header_name
commit 3ebe138ac6 upstream.

If rbd_dev_image_probe() in rbd_dev_probe_parent() fails, header_name
is freed twice: once in rbd_dev_probe_parent() and then in its caller
rbd_dev_image_probe() (rbd_dev_image_probe() is called recursively to
handle parent images).

rbd_dev_probe_parent() is responsible for probing the parent, so it
shouldn't muck with clone's fields.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-27 09:44:51 +09:00
Mike Snitzer
ad824a8286 dm thin: fix missing pool reference count decrement in pool_ctr error path
commit ba30670f4d upstream.

Fixes: ac8c3f3df ("dm thin: generate event when metadata threshold passed")
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-27 09:44:50 +09:00
Shaohua Li
334c94072f workqueue: make sure delayed work run in local cpu
commit 874bbfe600 upstream.

My system keeps crashing with below message. vmstat_update() schedules a delayed
work in current cpu and expects the work runs in the cpu.
schedule_delayed_work() is expected to make delayed work run in local cpu. The
problem is timer can be migrated with NO_HZ. __queue_work() queues work in
timer handler, which could run in a different cpu other than where the delayed
work is scheduled. The end result is the delayed work runs in different cpu.
The patch makes __queue_delayed_work records local cpu earlier. Where the timer
runs doesn't change where the work runs with the change.

[   28.010131] ------------[ cut here ]------------
[   28.010609] kernel BUG at ../mm/vmstat.c:1392!
[   28.011099] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN
[   28.011860] Modules linked in:
[   28.012245] CPU: 0 PID: 289 Comm: kworker/0:3 Tainted: G        W4.3.0-rc3+ #634
[   28.013065] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153802- 04/01/2014
[   28.014160] Workqueue: events vmstat_update
[   28.014571] task: ffff880117682580 ti: ffff8800ba428000 task.ti: ffff8800ba428000
[   28.015445] RIP: 0010:[<ffffffff8115f921>]  [<ffffffff8115f921>]vmstat_update+0x31/0x80
[   28.016282] RSP: 0018:ffff8800ba42fd80  EFLAGS: 00010297
[   28.016812] RAX: 0000000000000000 RBX: ffff88011a858dc0 RCX:0000000000000000
[   28.017585] RDX: ffff880117682580 RSI: ffffffff81f14d8c RDI:ffffffff81f4df8d
[   28.018366] RBP: ffff8800ba42fd90 R08: 0000000000000001 R09:0000000000000000
[   28.019169] R10: 0000000000000000 R11: 0000000000000121 R12:ffff8800baa9f640
[   28.019947] R13: ffff88011a81e340 R14: ffff88011a823700 R15:0000000000000000
[   28.020071] FS:  0000000000000000(0000) GS:ffff88011a800000(0000)knlGS:0000000000000000
[   28.020071] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[   28.020071] CR2: 00007ff6144b01d0 CR3: 00000000b8e93000 CR4:00000000000006f0
[   28.020071] Stack:
[   28.020071]  ffff88011a858dc0 ffff8800baa9f640 ffff8800ba42fe00ffffffff8106bd88
[   28.020071]  ffffffff8106bd0b 0000000000000096 0000000000000000ffffffff82f9b1e8
[   28.020071]  ffffffff829f0b10 0000000000000000 ffffffff81f18460ffff88011a81e340
[   28.020071] Call Trace:
[   28.020071]  [<ffffffff8106bd88>] process_one_work+0x1c8/0x540
[   28.020071]  [<ffffffff8106bd0b>] ? process_one_work+0x14b/0x540
[   28.020071]  [<ffffffff8106c214>] worker_thread+0x114/0x460
[   28.020071]  [<ffffffff8106c100>] ? process_one_work+0x540/0x540
[   28.020071]  [<ffffffff81071bf8>] kthread+0xf8/0x110
[   28.020071]  [<ffffffff81071b00>] ?kthread_create_on_node+0x200/0x200
[   28.020071]  [<ffffffff81a6522f>] ret_from_fork+0x3f/0x70
[   28.020071]  [<ffffffff81071b00>] ?kthread_create_on_node+0x200/0x200

Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-27 09:44:50 +09:00
Wolfram Sang
49d851cea0 i2c: rcar: enable RuntimePM before registering to the core
commit 4f7effddf4 upstream.

The core may register clients attached to this master which may use
funtionality from the master. So, RuntimePM must be enabled before, otherwise
this will fail. While here, move drvdata, too.

Reported-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-27 09:44:50 +09:00
Russell King
2aafe811b0 crypto: ahash - ensure statesize is non-zero
commit 8996eafdcb upstream.

Unlike shash algorithms, ahash drivers must implement export
and import as their descriptors may contain hardware state and
cannot be exported as is.  Unfortunately some ahash drivers did
not provide them and end up causing crashes with algif_hash.

This patch adds a check to prevent these drivers from registering
ahash algorithms until they are fixed.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-27 09:44:50 +09:00
Dave Kleikamp
29e5b42437 crypto: sparc - initialize blkcipher.ivsize
commit a66d7f724a upstream.

Some of the crypto algorithms write to the initialization vector,
but no space has been allocated for it. This clobbers adjacent memory.

Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-27 09:44:49 +09:00
Geert Uytterhoeven
31e29b7bfc m68k/uaccess: Fix asm constraints for userspace access
commit 631d8b674f upstream.

When compiling a MMU kernel with CPU_HAS_ADDRESS_SPACES=n (e.g. "MMU=y
allnoconfig": "echo CONFIG_MMU=y > allno.config && make KCONFIG_ALLCONFIG=1
allnoconfig"), we use plain "move" instead of "moves", and I got:

  CC      arch/m68k/lib/uaccess.o
{standard input}: Assembler messages:
{standard input}:47: Error: operands mismatch -- statement `move.b %a0,(%a1)' ignored

This happens because plain "move" doesn't support byte transfers between
memory and address registers, while "moves" does.

Fix the asm constraints for __generic_copy_from_user(),
__generic_copy_to_user(), and __clear_user() to only use data registers
when accessing userspace.

Also, relax the asm constraints for 16-bit userspace accesses in
__put_user() and __get_user(), as both "move" and "moves" do support
such transfers between memory and address registers.

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-27 09:44:49 +09:00
Charles Keepax
37673fd3fb asix: Do full reset during ax88772_bind
[ Upstream commit 436c2a5036 ]

commit 3cc81d85ee ("asix: Don't reset PHY on if_up for ASIX 88772")
causes the ethernet on Arndale to no longer function. This appears to
be because the Arndale ethernet requires a full reset before it will
function correctly, however simply reverting the above patch causes
problems with ethtool settings getting reset.

It seems the problem is that the ethernet is not properly reset during
bind, and indeed the code in ax88772_bind that resets the device is a
very small subset of the actual ax88772_reset function. This patch uses
ax88772_reset in place of the existing reset code in ax88772_bind which
removes some code duplication and fixes the ethernet on Arndale.

It is still possible that the original patch causes some issues with
suspend and resume but that seems like a separate issue and I haven't
had a chance to test that yet.

Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Tested-by: Riku Voipio <riku.voipio@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-27 09:44:49 +09:00
Michel Stam
d54ee99a9d asix: Don't reset PHY on if_up for ASIX 88772
[ Upstream commit 3cc81d85ee ]

I've noticed every time the interface is set to 'up,', the kernel
reports that the link speed is set to 100 Mbps/Full Duplex, even
when ethtool is used to set autonegotiation to 'off', half
duplex, 10 Mbps.
It can be tested by:
 ifconfig eth0 down
 ethtool -s eth0 autoneg off speed 10 duplex half
 ifconfig eth0 up

Then checking 'dmesg' for the link speed.

Signed-off-by: Michel Stam <m.stam@fugro.nl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-27 09:44:49 +09:00
Joe Perches
c4fc18ccc4 ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings
[ Upstream commit 077cb37fcf ]

It seems that kernel memory can leak into userspace by a
kmalloc, ethtool_get_strings, then copy_to_user sequence.

Avoid this by using kcalloc to zero fill the copied buffer.

Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-27 09:44:49 +09:00
Guillaume Nault
9db7ed146a ppp: don't override sk->sk_state in pppoe_flush_dev()
[ Upstream commit e6740165b8 ]

Since commit 2b018d57ff ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release"),
pppoe_release() calls dev_put(po->pppoe_dev) if sk is in the
PPPOX_ZOMBIE state. But pppoe_flush_dev() can set sk->sk_state to
PPPOX_ZOMBIE _and_ reset po->pppoe_dev to NULL. This leads to the
following oops:

[  570.140800] BUG: unable to handle kernel NULL pointer dereference at 00000000000004e0
[  570.142931] IP: [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
[  570.144601] PGD 3d119067 PUD 3dbc1067 PMD 0
[  570.144601] Oops: 0000 [#1] SMP
[  570.144601] Modules linked in: l2tp_ppp l2tp_netlink l2tp_core ip6_udp_tunnel udp_tunnel pppoe pppox ppp_generic slhc loop crc32c_intel ghash_clmulni_intel jitterentropy_rng sha256_generic hmac drbg ansi_cprng aesni_intel aes_x86_64 ablk_helper cryptd lrw gf128mul glue_helper acpi_cpufreq evdev serio_raw processor button ext4 crc16 mbcache jbd2 virtio_net virtio_blk virtio_pci virtio_ring virtio
[  570.144601] CPU: 1 PID: 15738 Comm: ppp-apitest Not tainted 4.2.0 #1
[  570.144601] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014
[  570.144601] task: ffff88003d30d600 ti: ffff880036b60000 task.ti: ffff880036b60000
[  570.144601] RIP: 0010:[<ffffffffa018c701>]  [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
[  570.144601] RSP: 0018:ffff880036b63e08  EFLAGS: 00010202
[  570.144601] RAX: 0000000000000000 RBX: ffff880034340000 RCX: 0000000000000206
[  570.144601] RDX: 0000000000000006 RSI: ffff88003d30dd20 RDI: ffff88003d30dd20
[  570.144601] RBP: ffff880036b63e28 R08: 0000000000000001 R09: 0000000000000000
[  570.144601] R10: 00007ffee9b50420 R11: ffff880034340078 R12: ffff8800387ec780
[  570.144601] R13: ffff8800387ec7b0 R14: ffff88003e222aa0 R15: ffff8800387ec7b0
[  570.144601] FS:  00007f5672f48700(0000) GS:ffff88003fc80000(0000) knlGS:0000000000000000
[  570.144601] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  570.144601] CR2: 00000000000004e0 CR3: 0000000037f7e000 CR4: 00000000000406a0
[  570.144601] Stack:
[  570.144601]  ffffffffa018f240 ffff8800387ec780 ffffffffa018f240 ffff8800387ec7b0
[  570.144601]  ffff880036b63e48 ffffffff812caabe ffff880039e4e000 0000000000000008
[  570.144601]  ffff880036b63e58 ffffffff812cabad ffff880036b63ea8 ffffffff811347f5
[  570.144601] Call Trace:
[  570.144601]  [<ffffffff812caabe>] sock_release+0x1a/0x75
[  570.144601]  [<ffffffff812cabad>] sock_close+0xd/0x11
[  570.144601]  [<ffffffff811347f5>] __fput+0xff/0x1a5
[  570.144601]  [<ffffffff811348cb>] ____fput+0x9/0xb
[  570.144601]  [<ffffffff81056682>] task_work_run+0x66/0x90
[  570.144601]  [<ffffffff8100189e>] prepare_exit_to_usermode+0x8c/0xa7
[  570.144601]  [<ffffffff81001a26>] syscall_return_slowpath+0x16d/0x19b
[  570.144601]  [<ffffffff813babb1>] int_ret_from_sys_call+0x25/0x9f
[  570.144601] Code: 48 8b 83 c8 01 00 00 a8 01 74 12 48 89 df e8 8b 27 14 e1 b8 f7 ff ff ff e9 b7 00 00 00 8a 43 12 a8 0b 74 1c 48 8b 83 a8 04 00 00 <48> 8b 80 e0 04 00 00 65 ff 08 48 c7 83 a8 04 00 00 00 00 00 00
[  570.144601] RIP  [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
[  570.144601]  RSP <ffff880036b63e08>
[  570.144601] CR2: 00000000000004e0
[  570.200518] ---[ end trace 46956baf17349563 ]---

pppoe_flush_dev() has no reason to override sk->sk_state with
PPPOX_ZOMBIE. pppox_unbind_sock() already sets sk->sk_state to
PPPOX_DEAD, which is the correct state given that sk is unbound and
po->pppoe_dev is NULL.

Fixes: 2b018d57ff ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release")
Tested-by: Oleksii Berezhniak <core@irc.lg.ua>
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-27 09:44:48 +09:00
Eric Dumazet
dec23a559f net: add pfmemalloc check in sk_add_backlog()
[ Upstream commit c7c49b8fde ]

Greg reported crashes hitting the following check in __sk_backlog_rcv()

	BUG_ON(!sock_flag(sk, SOCK_MEMALLOC));

The pfmemalloc bit is currently checked in sk_filter().

This works correctly for TCP, because sk_filter() is ran in
tcp_v[46]_rcv() before hitting the prequeue or backlog checks.

For UDP or other protocols, this does not work, because the sk_filter()
is ran from sock_queue_rcv_skb(), which might be called _after_ backlog
queuing if socket is owned by user by the time packet is processed by
softirq handler.

Fixes: b4b9e35585 ("netvm: set PF_MEMALLOC as appropriate during SKB processing")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Greg Thelen <gthelen@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-27 09:44:48 +09:00
Pravin B Shelar
f03a8061b5 skbuff: Fix skb checksum partial check.
[ Upstream commit 31b33dfb0a ]

Earlier patch 6ae459bda tried to detect void ckecksum partial
skb by comparing pull length to checksum offset. But it does
not work for all cases since checksum-offset depends on
updates to skb->data.

Following patch fixes it by validating checksum start offset
after skb-data pointer is updated. Negative value of checksum
offset start means there is no need to checksum.

Fixes: 6ae459bda ("skbuff: Fix skb checksum flag on skb pull")
Reported-by: Andrew Vagin <avagin@odin.com>
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-27 09:44:48 +09:00
Pravin B Shelar
275ceb01d2 skbuff: Fix skb checksum flag on skb pull
[ Upstream commit 6ae459bdaa ]

VXLAN device can receive skb with checksum partial. But the checksum
offset could be in outer header which is pulled on receive. This results
in negative checksum offset for the skb. Such skb can cause the assert
failure in skb_checksum_help(). Following patch fixes the bug by setting
checksum-none while pulling outer header.

Following is the kernel panic msg from old kernel hitting the bug.

------------[ cut here ]------------
kernel BUG at net/core/dev.c:1906!
RIP: 0010:[<ffffffff81518034>] skb_checksum_help+0x144/0x150
Call Trace:
<IRQ>
[<ffffffffa0164c28>] queue_userspace_packet+0x408/0x470 [openvswitch]
[<ffffffffa016614d>] ovs_dp_upcall+0x5d/0x60 [openvswitch]
[<ffffffffa0166236>] ovs_dp_process_packet_with_key+0xe6/0x100 [openvswitch]
[<ffffffffa016629b>] ovs_dp_process_received_packet+0x4b/0x80 [openvswitch]
[<ffffffffa016c51a>] ovs_vport_receive+0x2a/0x30 [openvswitch]
[<ffffffffa0171383>] vxlan_rcv+0x53/0x60 [openvswitch]
[<ffffffffa01734cb>] vxlan_udp_encap_recv+0x8b/0xf0 [openvswitch]
[<ffffffff8157addc>] udp_queue_rcv_skb+0x2dc/0x3b0
[<ffffffff8157b56f>] __udp4_lib_rcv+0x1cf/0x6c0
[<ffffffff8157ba7a>] udp_rcv+0x1a/0x20
[<ffffffff8154fdbd>] ip_local_deliver_finish+0xdd/0x280
[<ffffffff81550128>] ip_local_deliver+0x88/0x90
[<ffffffff8154fa7d>] ip_rcv_finish+0x10d/0x370
[<ffffffff81550365>] ip_rcv+0x235/0x300
[<ffffffff8151ba1d>] __netif_receive_skb+0x55d/0x620
[<ffffffff8151c360>] netif_receive_skb+0x80/0x90
[<ffffffff81459935>] virtnet_poll+0x555/0x6f0
[<ffffffff8151cd04>] net_rx_action+0x134/0x290
[<ffffffff810683d8>] __do_softirq+0xa8/0x210
[<ffffffff8162fe6c>] call_softirq+0x1c/0x30
[<ffffffff810161a5>] do_softirq+0x65/0xa0
[<ffffffff810687be>] irq_exit+0x8e/0xb0
[<ffffffff81630733>] do_IRQ+0x63/0xe0
[<ffffffff81625f2e>] common_interrupt+0x6e/0x6e

Reported-by: Anupam Chanda <achanda@vmware.com>
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Acked-by: Tom Herbert <tom@herbertland.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-27 09:44:48 +09:00
Aaron Conole
1f21dc672d af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag
[ Upstream commit 9f389e3567 ]

AF_UNIX sockets now return multiple skbs from recv() when MSG_PEEK flag
is set.

This is referenced in kernel bugzilla #12323 @
https://bugzilla.kernel.org/show_bug.cgi?id=12323

As described both in the BZ and lkml thread @
http://lkml.org/lkml/2008/1/8/444 calling recv() with MSG_PEEK on an
AF_UNIX socket only reads a single skb, where the desired effect is
to return as much skb data has been queued, until hitting the recv
buffer size (whichever comes first).

The modified MSG_PEEK path will now move to the next skb in the tree
and jump to the again: label, rather than following the natural loop
structure. This requires duplicating some of the loop head actions.

This was tested using the python socketpair python code attached to
the bugzilla issue.

Signed-off-by: Aaron Conole <aconole@bytheb.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-27 09:44:47 +09:00
Aaron Conole
f9b8d11b31 af_unix: Convert the unix_sk macro to an inline function for type safety
[ Upstream commit 4613012db1 ]

As suggested by Eric Dumazet this change replaces the
#define with a static inline function to enjoy
complaints by the compiler when misusing the API.

Signed-off-by: Aaron Conole <aconole@bytheb.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-27 09:44:47 +09:00