Commit Graph

611107 Commits

Author SHA1 Message Date
Ganesh Mahendran
031c1ad088 UPSTREAM: android: binder: use VM_ALLOC to get vm area
VM_IOREMAP is used to access hardware through a mechanism called
I/O mapped memory. Android binder is a IPC machanism which will
not access I/O memory.

And VM_IOREMAP has alignment requiement which may not needed in
binder.
    __get_vm_area_node()
    {
    ...
        if (flags & VM_IOREMAP)
            align = 1ul << clamp_t(int, fls_long(size),
               PAGE_SHIFT, IOREMAP_MAX_ORDER);
    ...
    }

This patch will save some kernel vm area, especially for 32bit os.

In 32bit OS, kernel vm area is only 240MB. We may got below
error when launching a app:

<3>[ 4482.440053] binder_alloc: binder_alloc_mmap_handler: 15728 8ce67000-8cf65000 get_vm_area failed -12
<3>[ 4483.218817] binder_alloc: binder_alloc_mmap_handler: 15745 8ce67000-8cf65000 get_vm_area failed -12

Signed-off-by: Ganesh Mahendran <opensource.ganesh@gmail.com>
Acked-by: Martijn Coenen <maco@android.com>
Acked-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org>

----
V3: update comments
V2: update comments
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit aac6830ec1)

Change-Id: Ide458abc6a4d3ec07973733aa223c4247eef20e6
2018-07-19 22:00:56 +05:30
Gustavo A. R. Silva
d39ff4dd92 UPSTREAM: android: binder: Use true and false for boolean values
Assign true or false to boolean variables instead of an integer value.

This issue was detected with the help of Coccinelle.

Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Cc: Todd Kjos <tkjos@android.com>
Cc: Martijn Coenen <maco@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 197410ad88)

Change-Id: I30bed831d6b6ff2e9e3e521ccc5d6836f0b30944
2018-07-19 22:00:44 +05:30
Harsh Shandilya
9a6d1886c9 UPSTREAM: android: binder: Use octal permissions
checkpatch warns against the use of symbolic permissions,
this patch migrates all symbolic permissions in the binder
driver to octal permissions.

Test: debugfs nodes created by binder have the same unix
permissions prior to and after this patch was applied.

Signed-off-by: Harsh Shandilya <harsh@prjkt.io>
Cc: "Arve Hjønnevåg" <arve@android.com>
Cc: Todd Kjos <tkjos@android.com>
Cc: Martijn Coenen <maco@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 21d02ddf71)

Change-Id: I8152fe280ead1d04d89593e813a722f9eb5def27
2018-07-19 22:00:34 +05:30
Elad Wexler
fc81853d8c UPSTREAM: android: binder: Prefer __func__ to using hardcoded function name
Coding style fixup

Signed-off-by: Elad Wexler <elad.wexler@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 00c41cddeb)

Change-Id: I795e2a9f525c4a8df5cd0a81842a88529ba54f21
2018-07-19 22:00:23 +05:30
Xiongwei Song
2bff8f14c1 UPSTREAM: ANDROID: binder: make binder_alloc_new_buf_locked static and indent its arguments
The function binder_alloc_new_buf_locked() is only used in this file, so
make it static. Also clean up sparse warning:

drivers/android/binder_alloc.c:330:23: warning: no previous prototype
for ‘binder_alloc_new_buf_locked’ [-Wmissing-prototypes]

In addition, the line of the function name exceeds 80 characters when
add static for this function, hence indent its arguments anew.

Signed-off-by: Xiongwei Song <sxwjean@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 3f82724546)

Change-Id: I6b379df815d30f9b3e9f1dd50334375123b25bbc
2018-07-19 22:00:12 +05:30
Tetsuo Handa
dc0d5c5694 UPSTREAM: android: binder: Check for errors in binder_alloc_shrinker_init().
Both list_lru_init() and register_shrinker() might return an error.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Sherry Yang <sherryy@android.com>
Cc: Michal Hocko <mhocko@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 533dfb250d)

Change-Id: I5325ccaf34a04179ef3dae73dd8f3abfd6e21565
2018-07-19 21:59:59 +05:30
Artem Borisov
2bbbaa8b28 cpufreq: Kconfig: Remove CPU_FREQ_DEFAULT_GOV_SCHED
Sched governor was removed in df147c9e33
and this probably was left here by mistake. Remove it to avoid confusion.

Signed-off-by: Artem Borisov <dedsa2002@gmail.com>
2018-07-19 21:59:47 +05:30
Patrik Torstensson
4ab0d1112d ANDROID: Add kconfig to make dm-verity check_at_most_once default enabled
This change adds a kernel config for default enable
the check_at_most_once dm-verity option. This is to give us
the ability to enforce the usage of at_most_once
for entry-level phones.

Change-Id: Id40416672c4c2209a9866997d8c164b5de5dc7dc
Signed-off-by: Patrik Torstensson <totte@google.com>
Bug: 72664474
2018-07-19 21:59:32 +05:30
Lianjun Huang
7dccf52f64 ANDROID: sdcardfs: fix potential crash when reserved_mb is not zero
sdcardfs_mkdir() calls check_min_free_space(). When reserved_mb is not zero, a negative dentry will be passed to
ext4_statfs() at last and ext4_statfs() will crash. The parent dentry is positive. So we use the parent dentry to
check free space.

Change-Id: I80ab9623fe59ba911f4cc9f0e029a1c6f7ee421b
Signed-off-by: Lianjun Huang <huanglianjun@vivo.com>
2018-07-19 21:59:20 +05:30
Roman Kiryanov
a18709156f ANDROID: Update arm64 ranchu64_defconfig
======== Summary =========
Device Manifest?    GOOD
Device Matrix?      GOOD
Framework Manifest? GOOD
Framework Matrix?   GOOD
Device HAL Manifest <==> Framework Compatibility Matrix? GOOD
Framework HAL Manifest <==> Device Compatibility Matrix? GOOD
Runtime info <==> Framework Compatibility Matrix?        GOOD
VintfObject::CheckCompatibility?                         GOOD

Bug: 109735735
Test: emulator -verbose -show-kernel -kernel /tmp/qemu-kernel-arm64-ranchu/kernel-qemu
Change-Id: I459e73fea6ba00a35446da856a18ebe3e530bd04
Signed-off-by: Roman Kiryanov <rkir@google.com>
2018-07-19 21:59:09 +05:30
Mark Brown
4666c98da7 Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android 2018-07-19 14:53:51 +01:00
Mark Brown
e9ac663441 Merge tag 'v4.4.142' into linux-linaro-lsk-v4.4
This is the 4.4.142 stable release
2018-07-19 14:53:44 +01:00
Greg Kroah-Hartman
ecb9989751 Linux 4.4.142 2018-07-19 15:35:58 +02:00
Arnaldo Carvalho de Melo
60904a5788 perf tools: Move syscall number fallbacks from perf-sys.h to tools/arch/x86/include/asm/
commit cec07f53c3 upstream.

And remove the empty tools/arch/x86/include/asm/unistd_{32,64}.h files
introduced by eae7a755ee ("perf tools, x86: Build perf on older
user-space as well").

This way we get closer to mirroring the kernel for cases where __NR_
can't be found for some include path/_GNU_SOURCE/whatever scenario.

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Link: http://lkml.kernel.org/n/tip-kpj6m3mbjw82kg6krk2z529e@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-19 15:35:57 +02:00
Andy Lutomirski
654ee679e1 x86/cpu: Probe CPUID leaf 6 even when cpuid_level == 6
commit 3df8d92085 upstream.

A typo (or mis-merge?) resulted in leaf 6 only being probed if
cpuid_level >= 7.

Fixes: 2ccd71f1b2 ("x86/cpufeature: Move some of the scattered feature bits to x86_capability")
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Link: http://lkml.kernel.org/r/6ea30c0e9daec21e488b54761881a6dfcf3e04d0.1481825597.git.luto@kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Brad Spengler <spender@grsecurity.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-19 15:35:57 +02:00
Rasmus Villemoes
40ecc0aff2 Kbuild: fix # escaping in .cmd files for future Make
commit 9564a8cf42 upstream.

I tried building using a freshly built Make (4.2.1-69-g8a731d1), but
already the objtool build broke with

orc_dump.c: In function ‘orc_dump’:
orc_dump.c:106:2: error: ‘elf_getshnum’ is deprecated [-Werror=deprecated-declarations]
  if (elf_getshdrnum(elf, &nr_sections)) {

Turns out that with that new Make, the backslash was not removed, so cpp
didn't see a #include directive, grep found nothing, and
-DLIBELF_USE_DEPRECATED was wrongly put in CFLAGS.

Now, that new Make behaviour is documented in their NEWS file:

  * WARNING: Backward-incompatibility!
    Number signs (#) appearing inside a macro reference or function invocation
    no longer introduce comments and should not be escaped with backslashes:
    thus a call such as:
      foo := $(shell echo '#')
    is legal.  Previously the number sign needed to be escaped, for example:
      foo := $(shell echo '\#')
    Now this latter will resolve to "\#".  If you want to write makefiles
    portable to both versions, assign the number sign to a variable:
      C := \#
      foo := $(shell echo '$C')
    This was claimed to be fixed in 3.81, but wasn't, for some reason.
    To detect this change search for 'nocomment' in the .FEATURES variable.

This also fixes up the two make-cmd instances to replace # with $(pound)
rather than with \#. There might very well be other places that need
similar fixup in preparation for whatever future Make release contains
the above change, but at least this builds an x86_64 defconfig with the
new make.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=197847
Cc: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-19 15:35:57 +02:00
William Wu
34ef2afe59 arm64: dts: rockchip: add usic node for rk3399
Add usic node for rk3399 USB 2.0 EHCI controller
with usic phy.

Change-Id: Ibb4179ff1479816daa3b8455b0229f8a7a05bbdf
Signed-off-by: William Wu <william.wu@rock-chips.com>
2018-07-19 18:37:43 +08:00
William Wu
e5708aad7f USB: ehci-platform: support EHCIs with usic phy
Some EHCI controllers use usic phy (e.g rk3399/rk3288),
in order to enable these controllers, we need to set
some additional EHCI vendor-specific registers.

Support this feature in device tree when using the ehci
platform driver by adding a new property for it.

Change-Id: I279ccfdb5866df49828825bfd41b39fcd58a2832
Signed-off-by: William Wu <william.wu@rock-chips.com>
2018-07-19 18:37:43 +08:00
William Wu
8c47ad3c7b usb: dwc3: rockchip: Don't reset otg logic if device connect
During dwc3 resume, it shoudn't reset otg controller logic
if device is connecting with the otg port, because it will
cause device to be reenumerated. More seriously, it may
cause the otg_work to enter disconnect process and power
down usb3 controller power domain, at the same time, if
the xHCI driver is accessing the controller asynchronously,
it will cause system hang.

Change-Id: Id546277bd4082b7baeff830788643a800330ae8e
Signed-off-by: William Wu <william.wu@rock-chips.com>
2018-07-19 18:28:43 +08:00
William Wu
04da766284 usb: dwc3: Don't reset core in host mode
When do core init, only reset the core for device mode.
Becasue in host mode, xHCI driver will reset the core
and its host block via usbcmd.hcrst. If we do core reset
in dwc3_core_init() for host mode, it will reset both
the dwc3 core registers and xHCI registers, and cause
device to be reenumerated when usb suspend/resume.

Change-Id: If723ce8a771975e9757d28cb2c114d6269581677
Signed-off-by: William Wu <william.wu@rock-chips.com>
2018-07-19 18:28:43 +08:00
Xing Zheng
46dcb4d5f8 arm64: dts: rockchip: enable Bluetooth PCM sound for RK3308 EVB Boards
By default, only using lrck_tx for PCM by hardware,
therefore, we need to use I2S_CKR_TRCM_TXONLY.

Change-Id: I6c4077e7e7e65b8a3a21416fd61d5900b3b72f42
Signed-off-by: Xing Zheng <zhengxing@rock-chips.com>
2018-07-19 16:17:50 +08:00
Xing Zheng
3e056d403d arm64: dts: rockchip: add bluetooth pcm node for RK3308 EVB V10/V11
This patch using PCM rising late1 and slave mode for
Bluetooth HFP.

Change-Id: I4a0188134d7d0ef0690c6c7c9f94fc8ec50c1671
Signed-off-by: Xing Zheng <zhengxing@rock-chips.com>
2018-07-19 16:17:50 +08:00
Xing Zheng
1dc24c8e2c ASoC: rockchip: i2s: add 'rockchip,clk-trcm' property
Change-Id: I0756185c677b5cb9512ff25b69ceba5b248ec031
Signed-off-by: Xing Zheng <zhengxing@rock-chips.com>
2018-07-19 16:17:50 +08:00
Xing Zheng
b73b288508 ASoC: rockchip: i2s: add support 'rockchip,clk-trcm' property
If there is only one lrck (tx or rx) by hardware, we need to
use 'rockchip,clk-trcm' specify which lrck can be used.

Change-Id: I3bf8d87a6bc8c45e183040012d87d8be21a4c133
Signed-off-by: Xing Zheng <zhengxing@rock-chips.com>
2018-07-19 16:17:50 +08:00
Hu Kejun
bb7bcb0a02 media: rk-isp10: modify for af function
add af funtion first time

Change-Id: I91fc8c532e47987cc63694b242f5bac7ef1bc59c
Signed-off-by: Hu Kejun <william.hu@rock-chips.com>
2018-07-19 14:44:39 +08:00
Hu Kejun
347d89b653 media: rk-isp10: remove "Measurement late" check
Change-Id: I6cbabc0faff7003c591142570270475e7afd8dde
Signed-off-by: Hu Kejun <william.hu@rock-chips.com>
2018-07-19 14:44:39 +08:00
Hu Kejun
71f641cab4 media: rk-isp10: modify for dumpsys tool
Change-Id: I53df81d70fb730634c7600e2a7a18f93b62191df
Signed-off-by: Hu Kejun <william.hu@rock-chips.com>
2018-07-19 14:44:39 +08:00
Hu Kejun
6976e95c0a media: rk-isp10: fix write fmt is not correct when setting mi_ctrl
Change-Id: I55b4c3ced65d690a2f27755e09c3933dfc265ee7
Signed-off-by: Hu Kejun <william.hu@rock-chips.com>
2018-07-19 14:44:39 +08:00
Hu Kejun
bd5d042b1a media: rk-isp10: fix owned_by_drv_count is not 0 when stop stream
Change-Id: Iec72be86e515c2f29dfb12a6004db443769edd9f
Signed-off-by: Hu Kejun <william.hu@rock-chips.com>
2018-07-19 14:44:39 +08:00
Shunqian Zheng
41c170c42f scripts: make gcc-wrapper.py compatible with python 2.7 and 3
Python 3 requires parentheses in call to 'print', meanwhile
the 'line' could be bytes-like, let's decoding to str as utf-8.

This makes the gcc-wrapper.py compatible with both 2.7 and 3.

For example, a bytes-like string as below,
 b'kernel/reboot.c:47:13: error: function declaration isn\xe2\x80\x99t a
 prototype [-Werror=strict-prototypes]\n'
 b' static void no_use()\n'
 b'             ^~~~~~\n'

After decoding, it looks like,
 kernel/reboot.c:47:13: error: function declaration isn’t a prototype
 [-Werror=strict-prototypes]
  static void no_use()
              ^~~~~~

Change-Id: Icacdbe2ca7b7ab674ab90e54b79d3176e0061ac6
Signed-off-by: Shunqian Zheng <zhengsq@rock-chips.com>
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
2018-07-19 11:58:45 +08:00
Finley Xiao
0658b84702 soc: rockchip: pvtm: Add support to show temperature
Change-Id: Ibdf09a5a043e7f1a6d203513a6f22172e9e24c09
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>
2018-07-19 09:14:52 +08:00
Mark Brown
408ef7d17b Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android 2018-07-18 13:38:21 +01:00
Mark Brown
1d7b931a1b Merge tag 'v4.4.141' into linux-linaro-lsk-v4.4
This is the 4.4.141 stable release
2018-07-18 13:38:10 +01:00
Tao Huang
d20c557078 Input: rmi4 - remove unused synaptics s3202 driver
Change-Id: If377d7af56ad443a905947a585ff826b6c1625b2
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
2018-07-18 19:23:06 +08:00
Dingqiang Lin
a9558e9bdf rockchip: rkflash: fix compile error if !NAND
Change-Id: I890ff638ff3b6fe3e9fb8fc43f4fa4522bd75c11
Signed-off-by: Dingqiang Lin <jon.lin@rock-chips.com>
2018-07-18 19:02:23 +08:00
Cliff Chen
2093a9abe6 f2fs: add a new limit for reserve root
The reserved root blocks is not enough for booting Android due to
the limit of 0.2% if the fs size too small. so we add a new mini-
mum limit is 128MB.

Change-Id: I5af3b182001d27e4d18b4090c5270bbb2ac6253b
Signed-off-by: Cliff Chen <cliff.chen@rock-chips.com>
2018-07-18 11:12:22 +08:00
Zhou weixin
6b600c5baa input: sensors: accel: lsm303d: add data convert
Change-Id: Ied735816cb86cf73ebef76522f0882dbb19a9eb3
Signed-off-by: Weixin Zhou <zwx@rock-chips.com>
2018-07-18 10:16:35 +08:00
Xing Zheng
7ea4433197 ASoC: rk3308_codec: fix incorrect idx with loopback_grp
Here should use the mapped grp as a reference, not idx.

Change-Id: Ia40dafc11f4f5f077f764f49985bb8d3ec800c28
Reported-by: Lin Jianhua <linjh@rock-chips.com>
Signed-off-by: Xing Zheng <zhengxing@rock-chips.com>
2018-07-17 21:08:14 +08:00
Zhou weixin
5e823aa985 arm64: dts: rockchip: add rk3326 86v board
Change-Id: I533b3243aae6e43151a1db2a454fb67c7423af12
Signed-off-by: Zhou weixin <zwx@rock-chips.com>
2018-07-17 18:54:37 +08:00
Greg Kroah-Hartman
b3c6be58aa Linux 4.4.141 2018-07-17 11:31:46 +02:00
Tetsuo Handa
43991e916e loop: remember whether sysfs_create_group() was done
commit d3349b6b3c upstream.

syzbot is hitting WARN() triggered by memory allocation fault
injection [1] because loop module is calling sysfs_remove_group()
when sysfs_create_group() failed.
Fix this by remembering whether sysfs_create_group() succeeded.

[1] https://syzkaller.appspot.com/bug?id=3f86c0edf75c86d2633aeb9dd69eccc70bc7e90b

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: syzbot <syzbot+9f03168400f56df89dbc6f1751f4458fe739ff29@syzkaller.appspotmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Renamed sysfs_ready -> sysfs_inited.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:46 +02:00
Leon Romanovsky
28db2b23f4 RDMA/ucm: Mark UCM interface as BROKEN
commit 7a8690ed6f upstream.

In commit 357d23c811a7 ("Remove the obsolete libibcm library")
in rdma-core [1], we removed obsolete library which used the
/dev/infiniband/ucmX interface.

Following multiple syzkaller reports about non-sanitized
user input in the UCMA module, the short audit reveals the same
issues in UCM module too.

It is better to disable this interface in the kernel,
before syzkaller team invests time and energy to harden
this unused interface.

[1] https://github.com/linux-rdma/rdma-core/pull/279

Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:46 +02:00
Tetsuo Handa
a4ae35d678 PM / hibernate: Fix oops at snapshot_write()
commit fc14eebfc2 upstream.

syzbot is reporting NULL pointer dereference at snapshot_write() [1].
This is because data->handle is zero-cleared by ioctl(SNAPSHOT_FREE).
Fix this by checking data_of(data->handle) != NULL before using it.

[1] https://syzkaller.appspot.com/bug?id=828a3c71bd344a6de8b6a31233d51a72099f27fd

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: syzbot <syzbot+ae590932da6e45d6564d@syzkaller.appspotmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:46 +02:00
Theodore Ts'o
2250809623 loop: add recursion validation to LOOP_CHANGE_FD
commit d2ac838e4c upstream.

Refactor the validation code used in LOOP_SET_FD so it is also used in
LOOP_CHANGE_FD.  Otherwise it is possible to construct a set of loop
devices that all refer to each other.  This can lead to a infinite
loop in starting with "while (is_loop_device(f)) .." in loop_set_fd().

Fix this by refactoring out the validation code and using it for
LOOP_CHANGE_FD as well as LOOP_SET_FD.

Reported-by: syzbot+4349872271ece473a7c91190b68b4bac7c5dbc87@syzkaller.appspotmail.com
Reported-by: syzbot+40bd32c4d9a3cc12a339@syzkaller.appspotmail.com
Reported-by: syzbot+769c54e66f994b041be7@syzkaller.appspotmail.com
Reported-by: syzbot+0a89a9ce473936c57065@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:46 +02:00
Florian Westphal
0319892f56 netfilter: x_tables: initialise match/target check parameter struct
commit c568503ef0 upstream.

syzbot reports following splat:

BUG: KMSAN: uninit-value in ebt_stp_mt_check+0x24b/0x450
 net/bridge/netfilter/ebt_stp.c:162
 ebt_stp_mt_check+0x24b/0x450 net/bridge/netfilter/ebt_stp.c:162
 xt_check_match+0x1438/0x1650 net/netfilter/x_tables.c:506
 ebt_check_match net/bridge/netfilter/ebtables.c:372 [inline]
 ebt_check_entry net/bridge/netfilter/ebtables.c:702 [inline]

The uninitialised access is
   xt_mtchk_param->nft_compat

... which should be set to 0.
Fix it by zeroing the struct beforehand, same for tgchk.

ip(6)tables targetinfo uses c99-style initialiser, so no change
needed there.

Reported-by: syzbot+da4494182233c23a5fcf@syzkaller.appspotmail.com
Fixes: 55917a21d0 ("netfilter: x_tables: add context to know if extension runs from nft_compat")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:46 +02:00
Eric Dumazet
2e80015330 netfilter: nf_queue: augment nfqa_cfg_policy
commit ba062ebb2c upstream.

Three attributes are currently not verified, thus can trigger KMSAN
warnings such as :

BUG: KMSAN: uninit-value in __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline]
BUG: KMSAN: uninit-value in __fswab32 include/uapi/linux/swab.h:59 [inline]
BUG: KMSAN: uninit-value in nfqnl_recv_config+0x939/0x17d0 net/netfilter/nfnetlink_queue.c:1268
CPU: 1 PID: 4521 Comm: syz-executor120 Not tainted 4.17.0+ #5
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:113
 kmsan_report+0x188/0x2a0 mm/kmsan/kmsan.c:1117
 __msan_warning_32+0x70/0xc0 mm/kmsan/kmsan_instr.c:620
 __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline]
 __fswab32 include/uapi/linux/swab.h:59 [inline]
 nfqnl_recv_config+0x939/0x17d0 net/netfilter/nfnetlink_queue.c:1268
 nfnetlink_rcv_msg+0xb2e/0xc80 net/netfilter/nfnetlink.c:212
 netlink_rcv_skb+0x37e/0x600 net/netlink/af_netlink.c:2448
 nfnetlink_rcv+0x2fe/0x680 net/netfilter/nfnetlink.c:513
 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
 netlink_unicast+0x1680/0x1750 net/netlink/af_netlink.c:1336
 netlink_sendmsg+0x104f/0x1350 net/netlink/af_netlink.c:1901
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg net/socket.c:639 [inline]
 ___sys_sendmsg+0xec8/0x1320 net/socket.c:2117
 __sys_sendmsg net/socket.c:2155 [inline]
 __do_sys_sendmsg net/socket.c:2164 [inline]
 __se_sys_sendmsg net/socket.c:2162 [inline]
 __x64_sys_sendmsg+0x331/0x460 net/socket.c:2162
 do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x43fd59
RSP: 002b:00007ffde0e30d28 EFLAGS: 00000213 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fd59
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8
R10: 00000000004002c8 R11: 0000000000000213 R12: 0000000000401680
R13: 0000000000401710 R14: 0000000000000000 R15: 0000000000000000

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279 [inline]
 kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:189
 kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:315
 kmsan_slab_alloc+0x10/0x20 mm/kmsan/kmsan.c:322
 slab_post_alloc_hook mm/slab.h:446 [inline]
 slab_alloc_node mm/slub.c:2753 [inline]
 __kmalloc_node_track_caller+0xb35/0x11b0 mm/slub.c:4395
 __kmalloc_reserve net/core/skbuff.c:138 [inline]
 __alloc_skb+0x2cb/0x9e0 net/core/skbuff.c:206
 alloc_skb include/linux/skbuff.h:988 [inline]
 netlink_alloc_large_skb net/netlink/af_netlink.c:1182 [inline]
 netlink_sendmsg+0x76e/0x1350 net/netlink/af_netlink.c:1876
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg net/socket.c:639 [inline]
 ___sys_sendmsg+0xec8/0x1320 net/socket.c:2117
 __sys_sendmsg net/socket.c:2155 [inline]
 __do_sys_sendmsg net/socket.c:2164 [inline]
 __se_sys_sendmsg net/socket.c:2162 [inline]
 __x64_sys_sendmsg+0x331/0x460 net/socket.c:2162
 do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: fdb694a01f ("netfilter: Add fail-open support")
Fixes: 829e17a1a6 ("[NETFILTER]: nfnetlink_queue: allow changing queue length through netlink")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:46 +02:00
Oleg Nesterov
e353bf5f4c uprobes/x86: Remove incorrect WARN_ON() in uprobe_init_insn()
commit 90718e32e1 upstream.

insn_get_length() has the side-effect of processing the entire instruction
but only if it was decoded successfully, otherwise insn_complete() can fail
and in this case we need to just return an error without warning.

Reported-by: syzbot+30d675e3ca03c1c351e7@syzkaller.appspotmail.com
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: syzkaller-bugs@googlegroups.com
Link: https://lkml.kernel.org/lkml/20180518162739.GA5559@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:45 +02:00
Dave Hansen
b7e37d9a90 x86/cpufeature: Add helper macro for mask check macros
commit 8eda072e9d upstream

Every time we add a word to our cpu features, we need to add
something like this in two places:

	(((bit)>>5)==16 && (1UL<<((bit)&31) & REQUIRED_MASK16))

The trick is getting the "16" in this case in both places.  I've
now screwed this up twice, so as pennance, I've come up with
this patch to keep me and other poor souls from doing the same.

I also commented the logic behind the bit manipulation showcased
above.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave@sr71.net>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20160629200110.1BA8949E@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
Reviewed-by: Matt Helsley (VMware) <matt.helsley@gmail.com>
Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>
Reviewed-by: Bo Gan <ganb@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:45 +02:00
Dave Hansen
8ebab07946 x86/cpufeature: Make sure DISABLED/REQUIRED macros are updated
commit 1e61f78baf upstream

x86 has two macros which allow us to evaluate some CPUID-based
features at compile time:

	REQUIRED_MASK_BIT_SET()
	DISABLED_MASK_BIT_SET()

They're both defined by having the compiler check the bit
argument against some constant masks of features.

But, when adding new CPUID leaves, we need to check new words
for these macros.  So make sure that those macros and the
REQUIRED_MASK* and DISABLED_MASK* get updated when necessary.

This looks kinda silly to have an open-coded value ("18" in
this case) open-coded in 5 places in the code.  But, we really do
need 5 places updated when NCAPINTS gets bumped, so now we just
force the issue.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave@sr71.net>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20160629200108.92466F6F@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
Reviewed-by: Matt Helsley (VMware) <matt.helsley@gmail.com>
Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>
Reviewed-by: Bo Gan <ganb@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:45 +02:00
Dave Hansen
febdf817e7 x86/cpufeature: Update cpufeaure macros
commit 6e17cb9c2d upstream

We had a new CPUID "NCAPINT" word added, but the REQUIRED_MASK and
DISABLED_MASK macros did not get updated.  Update them.

None of the features was needed in these masks, so there was no
harm, but we should keep them updated anyway.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave@sr71.net>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20160629200107.8D3C9A31@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
Reviewed-by: Matt Helsley (VMware) <matt.helsley@gmail.com>
Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>
Reviewed-by: Bo Gan <ganb@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:45 +02:00