1. 12 Jun, 2018 13 commits
    • Kees Cook's avatar
      treewide: kzalloc() -> kcalloc() · 6396bb22
      Kees Cook authored
      The kzalloc() function has a 2-factor argument form, kcalloc(). This
      patch replaces cases of:
      
              kzalloc(a * b, gfp)
      
      with:
              kcalloc(a * b, gfp)
      
      as well as handling cases of:
      
              kzalloc(a * b * c, gfp)
      
      with:
      
              kzalloc(array3_size(a, b, c), gfp)
      
      as it's slightly less ugly than:
      
              kzalloc_array(array_size(a, b), c, gfp)
      
      This does, however, attempt to ignore constant size factors like:
      
              kzalloc(4 * 1024, gfp)
      
      though any constants defined via macros get caught up in the conversion.
      
      Any factors with a sizeof() of "unsigned char", "char", and "u8" were
      dropped, since they're redundant.
      
      The Coccinelle script used for this was:
      
      // Fix redundant parens around sizeof().
      @@
      type TYPE;
      expression THING, E;
      @@
      
      (
        kzalloc(
      -	(sizeof(TYPE)) * E
      +	sizeof(TYPE) * E
        , ...)
      |
        kzalloc(
      -	(sizeof(THING)) * E
      +	sizeof(THING) * E
        , ...)
      )
      
      // Drop single-byte sizes and redundant parens.
      @@
      expression COUNT;
      typedef u8;
      typedef __u8;
      @@
      
      (
        kzalloc(
      -	sizeof(u8) * (COUNT)
      +	COUNT
        , ...)
      |
        kzalloc(
      -	sizeof(__u8) * (COUNT)
      +	COUNT
        , ...)
      |
        kzalloc(
      -	sizeof(char) * (COUNT)
      +	COUNT
        , ...)
      |
        kzalloc(
      -	sizeof(unsigned char) * (COUNT)
      +	COUNT
        , ...)
      |
        kzalloc(
      -	sizeof(u8) * COUNT
      +	COUNT
        , ...)
      |
        kzalloc(
      -	sizeof(__u8) * COUNT
      +	COUNT
        , ...)
      |
        kzalloc(
      -	sizeof(char) * COUNT
      +	COUNT
        , ...)
      |
        kzalloc(
      -	sizeof(unsigned char) * COUNT
      +	COUNT
        , ...)
      )
      
      // 2-factor product with sizeof(type/expression) and identifier or constant.
      @@
      type TYPE;
      expression THING;
      identifier COUNT_ID;
      constant COUNT_CONST;
      @@
      
      (
      - kzalloc
      + kcalloc
        (
      -	sizeof(TYPE) * (COUNT_ID)
      +	COUNT_ID, sizeof(TYPE)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(TYPE) * COUNT_ID
      +	COUNT_ID, sizeof(TYPE)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(TYPE) * (COUNT_CONST)
      +	COUNT_CONST, sizeof(TYPE)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(TYPE) * COUNT_CONST
      +	COUNT_CONST, sizeof(TYPE)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(THING) * (COUNT_ID)
      +	COUNT_ID, sizeof(THING)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(THING) * COUNT_ID
      +	COUNT_ID, sizeof(THING)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(THING) * (COUNT_CONST)
      +	COUNT_CONST, sizeof(THING)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(THING) * COUNT_CONST
      +	COUNT_CONST, sizeof(THING)
        , ...)
      )
      
      // 2-factor product, only identifiers.
      @@
      identifier SIZE, COUNT;
      @@
      
      - kzalloc
      + kcalloc
        (
      -	SIZE * COUNT
      +	COUNT, SIZE
        , ...)
      
      // 3-factor product with 1 sizeof(type) or sizeof(expression), with
      // redundant parens removed.
      @@
      expression THING;
      identifier STRIDE, COUNT;
      type TYPE;
      @@
      
      (
        kzalloc(
      -	sizeof(TYPE) * (COUNT) * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kzalloc(
      -	sizeof(TYPE) * (COUNT) * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kzalloc(
      -	sizeof(TYPE) * COUNT * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kzalloc(
      -	sizeof(TYPE) * COUNT * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kzalloc(
      -	sizeof(THING) * (COUNT) * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        kzalloc(
      -	sizeof(THING) * (COUNT) * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        kzalloc(
      -	sizeof(THING) * COUNT * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        kzalloc(
      -	sizeof(THING) * COUNT * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      )
      
      // 3-factor product with 2 sizeof(variable), with redundant parens removed.
      @@
      expression THING1, THING2;
      identifier COUNT;
      type TYPE1, TYPE2;
      @@
      
      (
        kzalloc(
      -	sizeof(TYPE1) * sizeof(TYPE2) * COUNT
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
        , ...)
      |
        kzalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
        , ...)
      |
        kzalloc(
      -	sizeof(THING1) * sizeof(THING2) * COUNT
      +	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
        , ...)
      |
        kzalloc(
      -	sizeof(THING1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
        , ...)
      |
        kzalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * COUNT
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
        , ...)
      |
        kzalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
        , ...)
      )
      
      // 3-factor product, only identifiers, with redundant parens removed.
      @@
      identifier STRIDE, SIZE, COUNT;
      @@
      
      (
        kzalloc(
      -	(COUNT) * STRIDE * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kzalloc(
      -	COUNT * (STRIDE) * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kzalloc(
      -	COUNT * STRIDE * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kzalloc(
      -	(COUNT) * (STRIDE) * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kzalloc(
      -	COUNT * (STRIDE) * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kzalloc(
      -	(COUNT) * STRIDE * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kzalloc(
      -	(COUNT) * (STRIDE) * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kzalloc(
      -	COUNT * STRIDE * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      )
      
      // Any remaining multi-factor products, first at least 3-factor products,
      // when they're not all constants...
      @@
      expression E1, E2, E3;
      constant C1, C2, C3;
      @@
      
      (
        kzalloc(C1 * C2 * C3, ...)
      |
        kzalloc(
      -	(E1) * E2 * E3
      +	array3_size(E1, E2, E3)
        , ...)
      |
        kzalloc(
      -	(E1) * (E2) * E3
      +	array3_size(E1, E2, E3)
        , ...)
      |
        kzalloc(
      -	(E1) * (E2) * (E3)
      +	array3_size(E1, E2, E3)
        , ...)
      |
        kzalloc(
      -	E1 * E2 * E3
      +	array3_size(E1, E2, E3)
        , ...)
      )
      
      // And then all remaining 2 factors products when they're not all constants,
      // keeping sizeof() as the second factor argument.
      @@
      expression THING, E1, E2;
      type TYPE;
      constant C1, C2, C3;
      @@
      
      (
        kzalloc(sizeof(THING) * C2, ...)
      |
        kzalloc(sizeof(TYPE) * C2, ...)
      |
        kzalloc(C1 * C2 * C3, ...)
      |
        kzalloc(C1 * C2, ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(TYPE) * (E2)
      +	E2, sizeof(TYPE)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(TYPE) * E2
      +	E2, sizeof(TYPE)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(THING) * (E2)
      +	E2, sizeof(THING)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(THING) * E2
      +	E2, sizeof(THING)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	(E1) * E2
      +	E1, E2
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	(E1) * (E2)
      +	E1, E2
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	E1 * E2
      +	E1, E2
        , ...)
      )
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      6396bb22
    • Kees Cook's avatar
      treewide: kmalloc() -> kmalloc_array() · 6da2ec56
      Kees Cook authored
      The kmalloc() function has a 2-factor argument form, kmalloc_array(). This
      patch replaces cases of:
      
              kmalloc(a * b, gfp)
      
      with:
              kmalloc_array(a * b, gfp)
      
      as well as handling cases of:
      
              kmalloc(a * b * c, gfp)
      
      with:
      
              kmalloc(array3_size(a, b, c), gfp)
      
      as it's slightly less ugly than:
      
              kmalloc_array(array_size(a, b), c, gfp)
      
      This does, however, attempt to ignore constant size factors like:
      
              kmalloc(4 * 1024, gfp)
      
      though any constants defined via macros get caught up in the conversion.
      
      Any factors with a sizeof() of "unsigned char", "char", and "u8" were
      dropped, since they're redundant.
      
      The tools/ directory was manually excluded, since it has its own
      implementation of kmalloc().
      
      The Coccinelle script used for this was:
      
      // Fix redundant parens around sizeof().
      @@
      type TYPE;
      expression THING, E;
      @@
      
      (
        kmalloc(
      -	(sizeof(TYPE)) * E
      +	sizeof(TYPE) * E
        , ...)
      |
        kmalloc(
      -	(sizeof(THING)) * E
      +	sizeof(THING) * E
        , ...)
      )
      
      // Drop single-byte sizes and redundant parens.
      @@
      expression COUNT;
      typedef u8;
      typedef __u8;
      @@
      
      (
        kmalloc(
      -	sizeof(u8) * (COUNT)
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(__u8) * (COUNT)
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(char) * (COUNT)
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(unsigned char) * (COUNT)
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(u8) * COUNT
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(__u8) * COUNT
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(char) * COUNT
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(unsigned char) * COUNT
      +	COUNT
        , ...)
      )
      
      // 2-factor product with sizeof(type/expression) and identifier or constant.
      @@
      type TYPE;
      expression THING;
      identifier COUNT_ID;
      constant COUNT_CONST;
      @@
      
      (
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * (COUNT_ID)
      +	COUNT_ID, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * COUNT_ID
      +	COUNT_ID, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * (COUNT_CONST)
      +	COUNT_CONST, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * COUNT_CONST
      +	COUNT_CONST, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * (COUNT_ID)
      +	COUNT_ID, sizeof(THING)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * COUNT_ID
      +	COUNT_ID, sizeof(THING)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * (COUNT_CONST)
      +	COUNT_CONST, sizeof(THING)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * COUNT_CONST
      +	COUNT_CONST, sizeof(THING)
        , ...)
      )
      
      // 2-factor product, only identifiers.
      @@
      identifier SIZE, COUNT;
      @@
      
      - kmalloc
      + kmalloc_array
        (
      -	SIZE * COUNT
      +	COUNT, SIZE
        , ...)
      
      // 3-factor product with 1 sizeof(type) or sizeof(expression), with
      // redundant parens removed.
      @@
      expression THING;
      identifier STRIDE, COUNT;
      type TYPE;
      @@
      
      (
        kmalloc(
      -	sizeof(TYPE) * (COUNT) * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE) * (COUNT) * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE) * COUNT * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE) * COUNT * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kmalloc(
      -	sizeof(THING) * (COUNT) * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        kmalloc(
      -	sizeof(THING) * (COUNT) * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        kmalloc(
      -	sizeof(THING) * COUNT * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        kmalloc(
      -	sizeof(THING) * COUNT * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      )
      
      // 3-factor product with 2 sizeof(variable), with redundant parens removed.
      @@
      expression THING1, THING2;
      identifier COUNT;
      type TYPE1, TYPE2;
      @@
      
      (
        kmalloc(
      -	sizeof(TYPE1) * sizeof(TYPE2) * COUNT
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
        , ...)
      |
        kmalloc(
      -	sizeof(THING1) * sizeof(THING2) * COUNT
      +	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
        , ...)
      |
        kmalloc(
      -	sizeof(THING1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * COUNT
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
        , ...)
      )
      
      // 3-factor product, only identifiers, with redundant parens removed.
      @@
      identifier STRIDE, SIZE, COUNT;
      @@
      
      (
        kmalloc(
      -	(COUNT) * STRIDE * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	COUNT * (STRIDE) * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	COUNT * STRIDE * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	(COUNT) * (STRIDE) * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	COUNT * (STRIDE) * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	(COUNT) * STRIDE * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	(COUNT) * (STRIDE) * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	COUNT * STRIDE * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      )
      
      // Any remaining multi-factor products, first at least 3-factor products,
      // when they're not all constants...
      @@
      expression E1, E2, E3;
      constant C1, C2, C3;
      @@
      
      (
        kmalloc(C1 * C2 * C3, ...)
      |
        kmalloc(
      -	(E1) * E2 * E3
      +	array3_size(E1, E2, E3)
        , ...)
      |
        kmalloc(
      -	(E1) * (E2) * E3
      +	array3_size(E1, E2, E3)
        , ...)
      |
        kmalloc(
      -	(E1) * (E2) * (E3)
      +	array3_size(E1, E2, E3)
        , ...)
      |
        kmalloc(
      -	E1 * E2 * E3
      +	array3_size(E1, E2, E3)
        , ...)
      )
      
      // And then all remaining 2 factors products when they're not all constants,
      // keeping sizeof() as the second factor argument.
      @@
      expression THING, E1, E2;
      type TYPE;
      constant C1, C2, C3;
      @@
      
      (
        kmalloc(sizeof(THING) * C2, ...)
      |
        kmalloc(sizeof(TYPE) * C2, ...)
      |
        kmalloc(C1 * C2 * C3, ...)
      |
        kmalloc(C1 * C2, ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * (E2)
      +	E2, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * E2
      +	E2, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * (E2)
      +	E2, sizeof(THING)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * E2
      +	E2, sizeof(THING)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	(E1) * E2
      +	E1, E2
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	(E1) * (E2)
      +	E1, E2
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	E1 * E2
      +	E1, E2
        , ...)
      )
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      6da2ec56
    • Kees Cook's avatar
      mm: Introduce kvcalloc() · 1c542f38
      Kees Cook authored
      The kv*alloc()-family was missing kvcalloc(). Adding this allows for
      2-argument multiplication conversions of kvzalloc(a * b, ...) into
      kvcalloc(a, b, ...).
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      1c542f38
    • Kees Cook's avatar
      video: uvesafb: Fix integer overflow in allocation · 9f645bcc
      Kees Cook authored
      cmap->len can get close to INT_MAX/2, allowing for an integer overflow in
      allocation. This uses kmalloc_array() instead to catch the condition.
      Reported-by: Silvio Cesare's avatarDr Silvio Cesare of InfoSect <silvio.cesare@gmail.com>
      Fixes: 8bdb3a2d ("uvesafb: the driver core")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      9f645bcc
    • Silvio Cesare's avatar
      UBIFS: Fix potential integer overflow in allocation · 353748a3
      Silvio Cesare authored
      There is potential for the size and len fields in ubifs_data_node to be
      too large causing either a negative value for the length fields or an
      integer overflow leading to an incorrect memory allocation. Likewise,
      when the len field is small, an integer underflow may occur.
      Signed-off-by: Silvio Cesare's avatarSilvio Cesare <silvio.cesare@gmail.com>
      Fixes: 1e51764a ("UBIFS: add new flash file system")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      353748a3
    • Kees Cook's avatar
      leds: Use struct_size() in allocation · f3278e3f
      Kees Cook authored
      This case got missed by the earlier treewide struct_size() conversions.
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      f3278e3f
    • Matthew Wilcox's avatar
      Convert intel uncore to struct_size · 6566f907
      Matthew Wilcox authored
      Need to do a bit of rearranging to make this work.
      Signed-off-by: default avatarMatthew Wilcox <mawilcox@microsoft.com>
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      6566f907
    • Matthew Wilcox's avatar
      Convert jffs2 acl to struct_size · a3ac9730
      Matthew Wilcox authored
      Need to tell the compiler that the acl entries follow the acl header.
      Signed-off-by: default avatarMatthew Wilcox <mawilcox@microsoft.com>
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      a3ac9730
    • Matthew Wilcox's avatar
      Convert vhost to struct_size · b2303d7b
      Matthew Wilcox authored
      Signed-off-by: default avatarMatthew Wilcox <mawilcox@microsoft.com>
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      b2303d7b
    • Matthew Wilcox's avatar
      c817e6cc
    • Matthew Wilcox's avatar
      Convert infiniband uverbs to struct_size · 7654cb1b
      Matthew Wilcox authored
      The flows were hidden from the C compiler; expose them as a zero-length
      array to allow struct_size to work.
      Signed-off-by: default avatarMatthew Wilcox <mawilcox@microsoft.com>
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      7654cb1b
    • Matthew Wilcox's avatar
      5b572e25
    • Dan Carpenter's avatar
      test_overflow: fix an IS_ERR() vs NULL bug · 8958fd41
      Dan Carpenter authored
      root_device_register() returns error pointers, it never returns NULL.
      
      Fixes: ca90800a ("test_overflow: Add memory allocation overflow tests")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      8958fd41
  2. 11 Jun, 2018 12 commits
    • Linus Torvalds's avatar
      Merge tag 'f2fs-for-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs · d54d35c5
      Linus Torvalds authored
      Pull f2fs updates from Jaegeuk Kim:
       "In this round, we've mainly focused on discard, aka unmap, control
        along with fstrim for Android-specific usage model. In addition, we've
        fixed writepage flow which returned EAGAIN previously resulting in EIO
        of fsync(2) due to mapping's error state. In order to avoid old MM bug
        [1], we decided not to use __GFP_ZERO for the mapping for node and
        meta page caches. As always, we've cleaned up many places for future
        fsverity and symbol conflicts.
      
        Enhancements:
         - do discard/fstrim in lower priority considering fs utilization
         - split large discard commands into smaller ones for better responsiveness
         - add more sanity checks to address syzbot reports
         - add a mount option, fsync_mode=nobarrier, which can reduce # of cache flushes
         - clean up symbol namespace with modified function names
         - be strict on block allocation and IO control in corner cases
      
        Bug fixes:
         - don't use __GFP_ZERO for mappings
         - fix error reports in writepage to avoid fsync() failure
         - avoid selinux denial on CAP_RESOURCE on resgid/resuid
         - fix some subtle race conditions in GC/atomic writes/shutdown
         - fix overflow bugs in sanity_check_raw_super
         - fix missing bits on get_flags
      
        Clean-ups:
         - prepare the generic flow for future fsverity integration
         - fix some broken coding standard"
      
      [1] https://lkml.org/lkml/2018/4/8/661
      
      * tag 'f2fs-for-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (79 commits)
        f2fs: fix to clear FI_VOLATILE_FILE correctly
        f2fs: let sync node IO interrupt async one
        f2fs: don't change wbc->sync_mode
        f2fs: fix to update mtime correctly
        fs: f2fs: insert space around that ':' and ', '
        fs: f2fs: add missing blank lines after declarations
        fs: f2fs: changed variable type of offset "unsigned" to "loff_t"
        f2fs: clean up symbol namespace
        f2fs: make set_de_type() static
        f2fs: make __f2fs_write_data_pages() static
        f2fs: fix to avoid accessing cross the boundary
        f2fs: fix to let caller retry allocating block address
        disable loading f2fs module on PAGE_SIZE > 4KB
        f2fs: fix error path of move_data_page
        f2fs: don't drop dentry pages after fs shutdown
        f2fs: fix to avoid race during access gc_thread pointer
        f2fs: clean up with clear_radix_tree_dirty_tag
        f2fs: fix to don't trigger writeback during recovery
        f2fs: clear discard_wake earlier
        f2fs: let discard thread wait a little longer if dev is busy
        ...
      d54d35c5
    • Linus Torvalds's avatar
      autofs: remove left-over autofs4 stubs · a2225d93
      Linus Torvalds authored
      There's no need to retain the fs/autofs4 directory for backward
      compatibility.
      
      Adding an AUTOFS4_FS fragment to the autofs Kconfig and a module alias
      for autofs4 is sufficient for almost all cases. Not keeping fs/autofs4
      remnants will prevent "insmod <path>/autofs4/autofs4.ko" from working
      but this shouldn't be used in automation scripts rather than
      modprobe(8).
      
      There were some comments about things to look out for with the module
      rename in the fs/autofs4/Kconfig that is removed by this patch, see the
      commit patch if you are interested.
      
      One potential problem with this change is that when the
      fs/autofs/Kconfig fragment for AUTOFS4_FS is removed any AUTOFS4_FS
      entries will be removed from the kernel config, resulting in no autofs
      file system being built if there is no AUTOFS_FS entry also.
      
      This would have also happened if the fs/autofs4 remnants had remained
      and is most likely to be a problem with automated builds.
      
      Please check your build configurations before the removal which will
      occur after the next couple of kernel releases.
      Acked-by: default avatarIan Kent <raven@themaw.net>
      [ With edits and commit message from Ian Kent ]
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a2225d93
    • Linus Torvalds's avatar
      Merge tag 'backlight-next-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight · 0f105cf4
      Linus Torvalds authored
      Pull backlight updates from Lee Jones:
       "Core Frameworks
         - Provide helpers to enable/disable backlight
         - Provide standard and devres versions OF find helpers
      
        New Drivers:
         - Add support for the Zodiac Inflight Innovations RAVE Supervisory
           Processor
      
        New Functionality:
         - Allow pwm-on/pwm-off delay to be specified via DT
      
        Bug Fixes:
         - Fix ordering of the power {en,dis}able and PWM {en,dis}able
           signals
         - Fix Device Tree node look-up"
      
      * tag 'backlight-next-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
        backlight: as3711_bl: Fix Device Tree node leaks
        backlight: tps65217_bl: Fix Device Tree node lookup
        backlight: max8925_bl: Fix Device Tree node lookup
        backlight: as3711_bl: Fix Device Tree node lookup
        MAINTAINERS: Add dri-devel for backlight subsystem patches
        backlight: Nuke BL_CORE_DRIVER1
        staging: fbtft: Stop using BL_CORE_DRIVER1
        backlight: pandora: Stop using BL_CORE_DRIVER1
        backlight: generic-bl: Remove DRIVER1 state
        backlight: Nuke unused backlight.props.state states
        backlight: otm3225a: Add support for ORISE OTM3225A LCD SoC
        backlight: pwm_bl: Don't use GPIOF_* with gpiod_get_direction
        pwm-backlight: Add support for PWM delays proprieties.
        dt-bindings: pwm-backlight: Add PWM delay proprieties.
        pwm-backlight: Enable/disable the PWM before/after LCD enable toggle.
        dt-bindings: backlight: Add binding for RAVE SP backlight driver
        backlight: Add RAVE SP backlight driver
      0f105cf4
    • Linus Torvalds's avatar
      Merge tag 'mfd-next-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd · 883cad5b
      Linus Torvalds authored
      Pull MFD updates from Lee Jones:
       "New Device Support:
         - Add support for AXP813 ADC to AXP20x
         - Add support for PM8005, PM8998 and PMI8998
      
        New Functionality:
         - Add support for Battery Power Supply to AXP813
         - Add support for SYSCON to SPARD SC27XX SPI
         - Add support for RTC to ChromeOS Embedded-Controller
      
        Fix-ups:
         - Remove unused code; exynos{4,5}-pmu, cros_ec, cros_ec_acpi_gpe
         - Remove duplicate error messages (-ENOMEM, etc); htc-i2cpld,
              janz-cmodio, max8997, rc5t583, sm501, smsc-ece1099, abx500-core,
              si476x-i2c, ti_am335x_tscadc, tps65090, tps6586x, tps65910,
              tps80031, twl6030-irq, viperboard
         - Succinctly use ptr to struct in sizeof(); rc5t583, abx500-core,
              sm501, smsc-ece1099
         - Simplify syntax for NULL ptr checking; abx500-core, sm501
         - No not unnecessarily initialise variables; tps65910, tps65910
         - Reorganise and simplify driver data; omap-usb-tll
         - Move to SPDX license statement; tps68470
         - Probe ADCs via DT; axp20x
         - Use new GPIOD API; arizona-core
         - Constify things; axp20x
         - Reduce code-size (use MACROS, etc); axp20x, omap-usb-host
         - Add DT support/docs; motorola-cpcap
         - Remove VLAs; rave-sp
         - Use devm_* managed resources; cros_ec
         - Interrogate HW for firmware version; rave-sp
         - Provide ACPI support for ChromeOS Embedded-Controller
      
        Bug Fixes:
         - Reorder ordered (enum) device list; tps65218
         - Only accept valid data from the offset; rave-sp
         - Refrain from copying junk from failed SPI read; cros_ec_dev
         - Fix potential memory leaks; pcf50633-core
         - Fix clock initialisation; twl-core
         - Fix build-issue; tps65911
         - Fix off-by-one error; tps65911
         - Fix code ordering issues; intel-lpss
         - Fix COMPILE_TEST related issues; pwm-stm32
         - Fix broken MMC card detection; asic3
         - Fix clocking related issues; intel-lpss-pci"
      
      * tag 'mfd-next-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (84 commits)
        mfd: cros_ec: Remove unused __remove function
        mfd: wm97xx-core: Platform data can be NULL
        mfd: cros_ec_dev: Don't advertise junk features on failure
        mfd: cros_ec: Use devm_kzalloc for private data
        mfd: intel-lpss: Fix Intel Cannon Lake LPSS I2C input clock
        mfd: asic3: Fix broken MMC card detection
        mfd: timberdale: Fix spelling mistake "Uknown" -> "Unknown"
        mfd: omap-usb-host: Use match_string() helper
        mfd: stm32-timers: Fix pwm-stm32 linker issue with COMPILE_TEST
        pwm: stm32: Initialize raw local variables
        mfd: arizona: Update DT doc to support more standard Reset binding
        dt-bindings: mfd: Add bindings for DA9063L
        mfd: intel-lpss: Correct names of RESETS register bits
        mfd: qcom-spmi-pmic: Add support for pm8005, pm8998 and pmi8998
        mfd: intel-lpss: Program REMAP register in PIO mode
        mfd: cros_ec_i2c: Moving the system sleep pm ops to late
        mfd: cros_ec_i2c: Add ACPI module device table
        mfd: cros_ec_dev: Register shutdown function for debugfs
        mfd: cros_ec_dev: Register cros-ec-rtc driver as a subdevice
        mfd: cros_ec: Don't try to grab log when suspended
        ...
      883cad5b
    • Linus Torvalds's avatar
      Merge tag 'drm-next-2018-06-11' of git://anongit.freedesktop.org/drm/drm · 8d08c055
      Linus Torvalds authored
      Pull drm msm updates and misc fixes from Dave Airlie:
       "I looked at Rob's msm tree, he kept it small due to being late, and it
        was in -next for a while before he was ill, so I think it should be
        fine.
      
        Otherwise this contains a set of i915 fixes and a v3d build fix, and
        vc4 leak fix"
      
      * tag 'drm-next-2018-06-11' of git://anongit.freedesktop.org/drm/drm: (31 commits)
        drm/i915/icl: Don't update enabled dbuf slices struct until updated in hw
        drm/i915/icl: fix icl_unmap/map_plls_to_ports
        drm/i915: Remove bogus NV12 PLANE_COLOR_CTL setup
        drm/msm: Fix NULL deref on bind/probe deferral
        drm/msm: Switch to atomic_helper_commit()
        drm/msm: Remove msm_commit/worker, use atomic helper commit
        drm/msm: Issue queued events when disabling crtc
        drm/msm: Move implicit sync handling to prepare_fb
        drm/msm: Refactor complete_commit() to look more the helpers
        drm/msm: Don't subclass drm_atomic_state anymore
        drm/msm/mdp5: Use the new private_obj state
        drm/msm/mdp5: Add global state as a private atomic object
        drm/msm: use correct aspace pointer in msm_gem_put_iova()
        drm/msm: remove unbalanced mutex unlock
        drm/msm: don't deref error pointer in the msm_fbdev_create error path
        drm/msm/dsi: use correct enum in dsi_get_cmd_fmt
        drm/msm: Fix possible null dereference on failure of get_pages()
        drm/msm: Add modifier to mdp_get_format arguments
        drm/msm: Mark the crtc->state->event consumed
        drm/msm/dsi: implement auto PHY timing calculator for 10nm PHY
        ...
      8d08c055
    • Johan Hovold's avatar
      backlight: as3711_bl: Fix Device Tree node leaks · d5318d30
      Johan Hovold authored
      Two framebuffer device-node names were looked up during probe, but were
      only used as flags to indicate the presence of two framebuffer device.
      
      Drop the unused framebuffer name along with a likewise unused device
      pointer from the driver data, and update the platform data to pass in
      booleans instead of the framebuffer strings. This allows us do drop the
      node references acquired during probe, which would otherwise leak.
      
      Note that there are no other in-kernel users of the modified
      platform-data fields.
      
      Fixes: 59eb2b5e ("drivers/video/backlight/as3711_bl.c: add OF support")
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Acked-by: default avatarDaniel Thompson <daniel.thompson@linaro.org>
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      d5318d30
    • Johan Hovold's avatar
      backlight: tps65217_bl: Fix Device Tree node lookup · 2b12dfa1
      Johan Hovold authored
      Fix child-node lookup during probe, which ended up searching the whole
      device tree depth-first starting at the parent rather than just matching
      on its children.
      
      This would only cause trouble if the child node is missing while there
      is an unrelated node named "backlight" elsewhere in the tree.
      
      Cc: stable <stable@vger.kernel.org>     # 3.7
      Fixes: eebfdc17 ("backlight: Add TPS65217 WLED driver")
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Acked-by: default avatarDaniel Thompson <daniel.thompson@linaro.org>
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      2b12dfa1
    • Johan Hovold's avatar
      backlight: max8925_bl: Fix Device Tree node lookup · d1cc0ec3
      Johan Hovold authored
      Fix child-node lookup during probe, which ended up searching the whole
      device tree depth-first starting at the parent rather than just matching
      on its children.
      
      To make things worse, the parent mfd node was also prematurely freed,
      while the child backlight node was leaked.
      
      Cc: stable <stable@vger.kernel.org>     # 3.9
      Fixes: 47ec340c ("mfd: max8925: Support dt for backlight")
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Acked-by: default avatarDaniel Thompson <daniel.thompson@linaro.org>
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      d1cc0ec3
    • Johan Hovold's avatar
      backlight: as3711_bl: Fix Device Tree node lookup · 4a9c8bb2
      Johan Hovold authored
      Fix child-node lookup during probe, which ended up searching the whole
      device tree depth-first starting at the parent rather than just matching
      on its children.
      
      To make things worse, the parent mfd node was also prematurely freed.
      
      Cc: stable <stable@vger.kernel.org>     # 3.10
      Fixes: 59eb2b5e ("drivers/video/backlight/as3711_bl.c: add OF support")
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Acked-by: default avatarDaniel Thompson <daniel.thompson@linaro.org>
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      4a9c8bb2
    • Arnd Bergmann's avatar
      mfd: cros_ec: Remove unused __remove function · 556c2420
      Arnd Bergmann authored
      This function is no longer called, so we get a harmless
      warning until it is removed as well:
      
      drivers/mfd/cros_ec_dev.c:265:13: error: '__remove' defined but not used [-Werror=unused-function]
      
      Fixes: 3aa2177e ("mfd: cros_ec: Use devm_kzalloc for private data")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      556c2420
    • Robert Jarzmik's avatar
      mfd: wm97xx-core: Platform data can be NULL · 46f107d0
      Robert Jarzmik authored
      It is not mandatory that platform data is passed along the ac97
      codec. Actually there are configuration without a battery connected to
      the ADC of the codec.
      
      This is for example the case for the PXA zylonite platform, so fix the
      NULL dereferencing by adding a test.
      
      Fixes: a5c6951c ("mfd: wm97xx-core: core support for wm97xx Codec")
      Signed-off-by: default avatarRobert Jarzmik <robert.jarzmik@free.fr>
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      46f107d0
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · f0dc7f9c
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix several bpfilter/UMH bugs, in particular make the UMH build not
          depend upon X86 specific Kconfig symbols. From Alexei Starovoitov.
      
       2) Fix handling of modified context pointer in bpf verifier, from
          Daniel Borkmann.
      
       3) Kill regression in ifdown/ifup sequences for hv_netvsc driver, from
          Dexuan Cui.
      
       4) When the bonding primary member name changes, we have to re-evaluate
          the bond->force_primary setting, from Xiangning Yu.
      
       5) Eliminate possible padding beyone end of SKB in cdc_ncm driver, from
          Bjørn Mork.
      
       6) RX queue length reported for UDP sockets in procfs and socket diag
          are inaccurate, from Paolo Abeni.
      
       7) Fix br_fdb_find_port() locking, from Petr Machata.
      
       8) Limit sk_rcvlowat values properly in TCP, from Soheil Hassas
          Yeganeh.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (23 commits)
        tcp: limit sk_rcvlowat by the maximum receive buffer
        net: phy: dp83822: use BMCR_ANENABLE instead of BMSR_ANEGCAPABLE for DP83620
        socket: close race condition between sock_close() and sockfs_setattr()
        net: bridge: Fix locking in br_fdb_find_port()
        udp: fix rx queue len reported by diag and proc interface
        cdc_ncm: avoid padding beyond end of skb
        net/sched: act_simple: fix parsing of TCA_DEF_DATA
        net: fddi: fix a possible null-ptr-deref
        net: aquantia: fix unsigned numvecs comparison with less than zero
        net: stmmac: fix build failure due to missing COMMON_CLK dependency
        bpfilter: fix race in pipe access
        bpf, xdp: fix crash in xdp_umem_unaccount_pages
        xsk: Fix umem fill/completion queue mmap on 32-bit
        tools/bpf: fix selftest get_cgroup_id_user
        bpfilter: fix OUTPUT_FORMAT
        umh: fix race condition
        net: mscc: ocelot: Fix uninitialized error in ocelot_netdevice_event()
        bonding: re-evaluate force_primary when the primary slave name changes
        ip_tunnel: Fix name string concatenate in __ip_tunnel_create()
        hv_netvsc: Fix a network regression after ifdown/ifup
        ...
      f0dc7f9c
  3. 10 Jun, 2018 15 commits
    • Linus Torvalds's avatar
      Merge tag 'rtc-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux · 1aaccb5f
      Linus Torvalds authored
      Pull RTC updates from Alexandre Belloni:
       "Setting the supported range from drivers for RTCs failing soon has
        started. A few fixes are developed along the way. Some drivers have
        been switched to SPDX by their maintainers.
      
        Subsystem:
      
         - rework of the rtc-test driver which allows to test the core more
           thoroughly
      
         - rtc_set_alarm() now fails early when alarms are not supported
      
        Drivers:
      
         - mktime() is now replaced by mktime64()
      
         - RTC range added for 88pm80x, ab-b5ze-s3, at91rm9200,
           brcmstb-waketimer, ds1685, ftrtc010, ls1x, mxc_v2, rx8581, sprd,
           st-lpc, tps6586x, tps65910 and vr41xx
      
         - fixed a possible race condition in probe functions
      
         - pxa: fix the probe function that is broken since v4.3
      
         - stm32: now supports stm32mp1"
      
      * tag 'rtc-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (78 commits)
        rtc: pxa: fix probe function
        rtc: cros-ec: Switch to SPDX identifier.
        rtc: cros-ec: Make license text and module license match.
        rtc: ensure rtc_set_alarm fails when alarms are not supported
        rtc: test: remove alarm support from the first device
        rtc: test: convert to devm_rtc_allocate_device
        rtc: ftrtc010: let the core handle range
        rtc: ftrtc010: handle dates after 2106
        rtc: ftrtc010: switch to devm_rtc_allocate_device
        rtc: mrst: switch to devm functions
        rtc: sunxi: fix possible race condition
        rtc: test: remove irq sysfs file
        rtc: test: emulate alarms using timers
        rtc: test: store time as an offset to system time
        rtc: test: allow registering many devices
        rtc: test: remove useless proc info
        rtc: ds1685: Add range
        rtc: ds1685: fix possible race condition
        rtc: sprd: Add new RTC power down check method
        rtc: sun6i: Fix bit_idx value for clk_register_gate
        ...
      1aaccb5f
    • Linus Torvalds's avatar
      Merge tag 'upstream-4.18-rc1' of git://git.infradead.org/linux-ubifs · ab0b2e59
      Linus Torvalds authored
      Pull UBI and UBIFS updates from Richard Weinberger:
      
       - the UBI on-disk format header file is now dual licensed
      
       - new way to detect Fastmap problems during runtime
      
       - bugfix for Fastmap
      
       - minor updates for UBIFS (spelling, comments, vm_fault_t, ...)
      
      * tag 'upstream-4.18-rc1' of git://git.infradead.org/linux-ubifs:
        mtd: ubi: Update ubi-media.h to dual license
        ubi: fastmap: Detect EBA mismatches on-the-fly
        ubi: fastmap: Check each mapping only once
        ubi: fastmap: Correctly handle interrupted erasures in EBA
        ubi: fastmap: Cancel work upon detach
        ubifs: lpt: Fix wrong pnode number range in comment
        ubifs: gc: Fix typo
        ubifs: log: Some spelling fixes
        ubifs: Spelling fix someting -> something
        ubifs: journal: Remove wrong comment
        ubifs: remove set but never used variable
        ubifs, xattr: remove misguided quota flags
        fs: ubifs: Adding new return type vm_fault_t
      ab0b2e59
    • Soheil Hassas Yeganeh's avatar
      tcp: limit sk_rcvlowat by the maximum receive buffer · 867f816b
      Soheil Hassas Yeganeh authored
      The user-provided value to setsockopt(SO_RCVLOWAT) can be
      larger than the maximum possible receive buffer. Such values
      mute POLLIN signals on the socket which can stall progress
      on the socket.
      
      Limit the user-provided value to half of the maximum receive
      buffer, i.e., half of sk_rcvbuf when the receive buffer size
      is set by the user, or otherwise half of sysctl_tcp_rmem[2].
      
      Fixes: d1361840 ("tcp: fix SO_RCVLOWAT and RCVBUF autotuning")
      Signed-off-by: default avatarSoheil Hassas Yeganeh <soheil@google.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reviewed-by: default avatarNeal Cardwell <ncardwell@google.com>
      Acked-by: default avatarWillem de Bruijn <willemb@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      867f816b
    • Linus Torvalds's avatar
      Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 5f85942c
      Linus Torvalds authored
      Pull SCSI updates from James Bottomley:
       "This is mostly updates to the usual drivers: ufs, qedf, mpt3sas, lpfc,
        xfcp, hisi_sas, cxlflash, qla2xxx.
      
        In the absence of Nic, we're also taking target updates which are
        mostly minor except for the tcmu refactor.
      
        The only real core change to worry about is the removal of high page
        bouncing (in sas, storvsc and iscsi). This has been well tested and no
        problems have shown up so far"
      
      * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (268 commits)
        scsi: lpfc: update driver version to 12.0.0.4
        scsi: lpfc: Fix port initialization failure.
        scsi: lpfc: Fix 16gb hbas failing cq create.
        scsi: lpfc: Fix crash in blk_mq layer when executing modprobe -r lpfc
        scsi: lpfc: correct oversubscription of nvme io requests for an adapter
        scsi: lpfc: Fix MDS diagnostics failure (Rx < Tx)
        scsi: hisi_sas: Mark PHY as in reset for nexus reset
        scsi: hisi_sas: Fix return value when get_free_slot() failed
        scsi: hisi_sas: Terminate STP reject quickly for v2 hw
        scsi: hisi_sas: Add v2 hw force PHY function for internal ATA command
        scsi: hisi_sas: Include TMF elements in struct hisi_sas_slot
        scsi: hisi_sas: Try wait commands before before controller reset
        scsi: hisi_sas: Init disks after controller reset
        scsi: hisi_sas: Create a scsi_host_template per HW module
        scsi: hisi_sas: Reset disks when discovered
        scsi: hisi_sas: Add LED feature for v3 hw
        scsi: hisi_sas: Change common allocation mode of device id
        scsi: hisi_sas: change slot index allocation mode
        scsi: hisi_sas: Introduce hisi_sas_phy_set_linkrate()
        scsi: hisi_sas: fix a typo in hisi_sas_task_prep()
        ...
      5f85942c
    • Alvaro Gamez Machado's avatar
      net: phy: dp83822: use BMCR_ANENABLE instead of BMSR_ANEGCAPABLE for DP83620 · b718e8c8
      Alvaro Gamez Machado authored
      DP83620 register set is compatible with the DP83848, but it also supports
      100base-FX. When the hardware is configured such as that fiber mode is
      enabled, autonegotiation is not possible.
      
      The chip, however, doesn't expose this information via BMSR_ANEGCAPABLE.
      Instead, this bit is always set high, even if the particular hardware
      configuration makes it so that auto negotiation is not possible [1]. Under
      these circumstances, the phy subsystem keeps trying for autonegotiation to
      happen, without success.
      
      Hereby, we inspect BMCR_ANENABLE bit after genphy_config_init, which on
      reset is set to 0 when auto negotiation is disabled, and so we use this
      value instead of BMSR_ANEGCAPABLE.
      
      [1] https://e2e.ti.com/support/interface/ethernet/f/903/p/697165/2571170Signed-off-by: default avatarAlvaro Gamez Machado <alvaro.gamez@hazent.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b718e8c8
    • Cong Wang's avatar
      socket: close race condition between sock_close() and sockfs_setattr() · 6d8c50dc
      Cong Wang authored
      fchownat() doesn't even hold refcnt of fd until it figures out
      fd is really needed (otherwise is ignored) and releases it after
      it resolves the path. This means sock_close() could race with
      sockfs_setattr(), which leads to a NULL pointer dereference
      since typically we set sock->sk to NULL in ->release().
      
      As pointed out by Al, this is unique to sockfs. So we can fix this
      in socket layer by acquiring inode_lock in sock_close() and
      checking against NULL in sockfs_setattr().
      
      sock_release() is called in many places, only the sock_close()
      path matters here. And fortunately, this should not affect normal
      sock_close() as it is only called when the last fd refcnt is gone.
      It only affects sock_close() with a parallel sockfs_setattr() in
      progress, which is not common.
      
      Fixes: 86741ec2 ("net: core: Add a UID field to struct sock.")
      Reported-by: default avatarshankarapailoor <shankarapailoor@gmail.com>
      Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
      Cc: Lorenzo Colitti <lorenzo@google.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6d8c50dc
    • Linus Torvalds's avatar
      Merge tag '4.18-fixes-smb3' of git://git.samba.org/sfrench/cifs-2.6 · 0c14e43a
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
      
       - one smb3 (ACL related) fix for stable
      
       - one SMB3 security enhancement (when mounting -t smb3 forbid less
         secure dialects)
      
       - some RDMA and compounding fixes
      
      * tag '4.18-fixes-smb3' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: fix a buffer leak in smb2_query_symlink
        smb3: do not allow insecure cifs mounts when using smb3
        CIFS: Fix NULL ptr deref
        CIFS: fix encryption in SMB3.1.1
        CIFS: Pass page offset for encrypting
        CIFS: Pass page offset for calculating signature
        CIFS: SMBD: Support page offset in memory registration
        CIFS: SMBD: Support page offset in RDMA recv
        CIFS: SMBD: Support page offset in RDMA send
        CIFS: When sending data on socket, pass the correct page offset
        CIFS: Introduce helper function to get page offset and length in smb_rqst
        CIFS: Calculate the correct request length based on page offset and tail size
        cifs: For SMB2 security informaion query, check for minimum sized security descriptor instead of sizeof FileAllInformation class
        CIFS: Fix signing for SMB2/3
      0c14e43a
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20180610' of git://git.kernel.dk/linux-block · bbaa1013
      Linus Torvalds authored
      Pull block flush handling fix from Jens Axboe:
       "Single fix that we should merge now, fixing a regression in queuing
        flush request, accessing request flags after calling the end_request
        handler"
      
      * tag 'for-linus-20180610' of git://git.kernel.dk/linux-block:
        block: fix use-after-free in block flush handling
      bbaa1013
    • Linus Torvalds's avatar
      Merge branch 'core-rseq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · d82991a8
      Linus Torvalds authored
      Pull restartable sequence support from Thomas Gleixner:
       "The restartable sequences syscall (finally):
      
        After a lot of back and forth discussion and massive delays caused by
        the speculative distraction of maintainers, the core set of
        restartable sequences has finally reached a consensus.
      
        It comes with the basic non disputed core implementation along with
        support for arm, powerpc and x86 and a full set of selftests
      
        It was exposed to linux-next earlier this week, so it does not fully
        comply with the merge window requirements, but there is really no
        point to drag it out for yet another cycle"
      
      * 'core-rseq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        rseq/selftests: Provide Makefile, scripts, gitignore
        rseq/selftests: Provide parametrized tests
        rseq/selftests: Provide basic percpu ops test
        rseq/selftests: Provide basic test
        rseq/selftests: Provide rseq library
        selftests/lib.mk: Introduce OVERRIDE_TARGETS
        powerpc: Wire up restartable sequences system call
        powerpc: Add syscall detection for restartable sequences
        powerpc: Add support for restartable sequences
        x86: Wire up restartable sequence system call
        x86: Add support for restartable sequences
        arm: Wire up restartable sequences system call
        arm: Add syscall detection for restartable sequences
        arm: Add restartable sequences support
        rseq: Introduce restartable sequences system call
        uapi/headers: Provide types_32_64.h
      d82991a8
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · f4e5b30d
      Linus Torvalds authored
      Pull x86 updates and fixes from Thomas Gleixner:
      
       - Fix the (late) fallout from the vector management rework causing
         hlist corruption and irq descriptor reference leaks caused by a
         missing sanity check.
      
         The straight forward fix triggered another long standing issue to
         surface. The pre rework code hid the issue due to being way slower,
         but now the chance that user space sees an EBUSY error return when
         updating irq affinities is way higher, though quite a bunch of
         userspace tools do not handle it properly despite the fact that EBUSY
         could be returned for at least 10 years.
      
         It turned out that the EBUSY return can be avoided completely by
         utilizing the existing delayed affinity update mechanism for irq
         remapped scenarios as well. That's a bit more error handling in the
         kernel, but avoids fruitless fingerpointing discussions with tool
         developers.
      
       - Decouple PHYSICAL_MASK from AMD SME as its going to be required for
         the upcoming Intel memory encryption support as well.
      
       - Handle legacy device ACPI detection properly for newer platforms
      
       - Fix the wrong argument ordering in the vector allocation tracepoint
      
       - Simplify the IDT setup code for the APIC=n case
      
       - Use the proper string helpers in the MTRR code
      
       - Remove a stale unused VDSO source file
      
       - Convert the microcode update lock to a raw spinlock as its used in
         atomic context.
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/intel_rdt: Enable CMT and MBM on new Skylake stepping
        x86/apic/vector: Print APIC control bits in debugfs
        genirq/affinity: Defer affinity setting if irq chip is busy
        x86/platform/uv: Use apic_ack_irq()
        x86/ioapic: Use apic_ack_irq()
        irq_remapping: Use apic_ack_irq()
        x86/apic: Provide apic_ack_irq()
        genirq/migration: Avoid out of line call if pending is not set
        genirq/generic_pending: Do not lose pending affinity update
        x86/apic/vector: Prevent hlist corruption and leaks
        x86/vector: Fix the args of vector_alloc tracepoint
        x86/idt: Simplify the idt_setup_apic_and_irq_gates()
        x86/platform/uv: Remove extra parentheses
        x86/mm: Decouple dynamic __PHYSICAL_MASK from AMD SME
        x86: Mark native_set_p4d() as __always_inline
        x86/microcode: Make the late update update_lock a raw lock for RT
        x86/mtrr: Convert to use strncpy_from_user() helper
        x86/mtrr: Convert to use match_string() helper
        x86/vdso: Remove unused file
        x86/i8237: Register device based on FADT legacy boot flag
      f4e5b30d
    • Linus Torvalds's avatar
      Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · a2211de0
      Linus Torvalds authored
      Pull x86 pti updates from Thomas Gleixner:
       "Three small commits updating the SSB mitigation to take the updated
        AMD mitigation variants into account"
      
      * 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/bugs: Switch the selection of mitigation from CPU vendor to CPU features
        x86/bugs: Add AMD's SPEC_CTRL MSR usage
        x86/bugs: Add AMD's variant of SSB_NO
      a2211de0
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 2322d6c5
      Linus Torvalds authored
      Pull more perf tooling updates from Thomas Gleixner:
       "Perf tool updates and fixes:
      
        perf stat:
      
         - Display user and system time for workload targets (Jiri Olsa)
      
        perf record:
      
         - Enable arbitrary event names thru name= modifier (Alexey Budankov)
      
        PowerPC:
      
         - Add a python script for hypervisor call statistics (Ravi Bangoria)
      
        Intel PT: (Adrian Hunter)
      
         - Fix sync_switch INTEL_PT_SS_NOT_TRACING
      
         - Fix decoding to accept CBR between FUP and corresponding TIP
      
         - Fix MTC timing after overflow
      
         - Fix "Unexpected indirect branch" error
      
        perf test:
      
         - record+probe_libc_inet_pton:
            - To get the symbol table for dynamic shared objects on ubuntu we
              need to pass the -D/--dynamic command line option, unlike with
              the fedora distros (Arnaldo Carvalho de Melo)
      
         - code-reading:
            - Fix perf_env setup for PTI entry trampolines (Adrian Hunter)
      
         - kmod-path:
            - Add tests for vdso32 and vdsox32 (Adrian Hunter)
      
         - Use header file util/debug.h (Thomas Richter)
      
        perf annotate:
      
         - Make the various UI backends (stdio, TUI, gtk) use more
           consistently structs with annotation options as specified by the
           user (Arnaldo Carvalho de Melo)
      
         - Move annotation specific knobs from the symbol_conf global kitchen
           sink to the annotation option structs (Arnaldo Carvalho de Melo)
      
        perf script:
      
         - Add more PMU fields to python scripts event handler dict (Jin Yao)
      
        Core:
      
         - Fix misleading error for some unparsable events mentioning PMUs
           when those are not involved in the problem (Jiri Olsa)
      
         - Consider BSS symbols when processing /proc/kallsyms ('B' and 'b')
           (Arnaldo Carvalho de Melo)
      
         - Be more robust when trying to use per-symbol histograms, checking
           for unlikely but possible cases where the space for the histograms
           wasn't allocated, print a debug message for such cases (Arnaldo
           Carvalho de Melo)
      
         - Fix symbol and object code resolution for vdso32 and vdsox32
           (Adrian Hunter)
      
         - No need to check for null when passing pointers to foo__get() style
           refcount grabbing helpers, just like in the kernel and with free(),
           its safe to pass a NULL pointer to avoid having to check it before
           each and every foo__get() call (Arnaldo Carvalho de Melo)
      
         - Remove some dead code (quote.[ch]) (Arnaldo Carvalho de Melo)
      
         - Remove some needless globals, making them local (Arnaldo Carvalho
           de Melo)
      
         - Reduce usage of symbol_conf.use_callchain, using other means of
           finding out if callchains are in use or available for specific
           events, as we evolved this codebase to allow requesting callchains
           for just a subset of the monitored events. In time it will help
           polish recording and showing mixed sets accross the various tools:
      
              perf record -e cycles/call-graph=fp/,cache-misses/call-graph=dwarf/,instructions'
      
           (Arnaldo Carvalho de Melo)
      
         - Consider PTI entry trampolines in map__rip_2objdump() (Adrian
           Hunter)"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (50 commits)
        perf script python: Add dict fields introduction to Documentation
        perf script python: Add more PMU fields to event handler dict
        perf script python: Move dsoname code to a new function
        perf symbols: Add BSS symbols when reading from /proc/kallsyms
        perf annnotate: Make __symbol__inc_addr_samples handle src->histograms == NULL
        perf intel-pt: Fix "Unexpected indirect branch" error
        perf intel-pt: Fix MTC timing after overflow
        perf intel-pt: Fix decoding to accept CBR between FUP and corresponding TIP
        perf intel-pt: Fix sync_switch INTEL_PT_SS_NOT_TRACING
        perf script powerpc: Python script for hypervisor call statistics
        perf test record+probe_libc_inet_pton: Ask 'nm' for dynamic symbols
        perf map: Consider PTI entry trampolines in rip_2objdump()
        perf test code-reading: Fix perf_env setup for PTI entry trampolines
        perf tools: Fix pmu events parsing rule
        perf stat: Display user and system time
        perf record: Enable arbitrary event names thru name= modifier
        perf tools: Fix symbol and object code resolution for vdso32 and vdsox32
        perf tests kmod-path: Add tests for vdso32 and vdsox32
        perf hists: Check if a hist_entry has callchains before using them
        perf hists: Introduce hist_entry__has_callchain() method
        ...
      2322d6c5
    • Linus Torvalds's avatar
      Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 9f3fbe85
      Linus Torvalds authored
      Pull irq fixes from Thomas Gleixner:
       "Two small fixlets:
      
         - Add the missing iomu mapping call in the Freescale/NXP/Qualcomm/
           whoever owns it now/ SCFG MSI irqchip driver. Otherwise IRQs wont
           work at all.
      
         - Fix a SMP=n build warning in the STM32 irq chip driver"
      
      * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        irqchip/ls-scfg-msi: Map MSIs in the iommu
        irqchip/stm32: Fix non-SMP build warning
      9f3fbe85
    • Linus Torvalds's avatar
      Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · a8a4021b
      Linus Torvalds authored
      Pull core fixes from Thomas Gleixner:
       "A small set of core updates:
      
         - Make objtool cope with GCC8 oddities some more
      
         - Remove a stale local_irq_save/restore sequence in the signal code
           along with the stale comment in the RCU code. The underlying issue
           which led to this has been solved long time ago, but nobody cared
           to cleanup the hackarounds"
      
      * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        signal: Remove no longer required irqsave/restore
        rcu: Update documentation of rcu_read_unlock()
        objtool: Fix GCC 8 cold subfunction detection for aliased functions
      a8a4021b
    • Anna-Maria Gleixner's avatar
      signal: Remove no longer required irqsave/restore · 59dc6f3c
      Anna-Maria Gleixner authored
      Commit a841796f ("signal: align __lock_task_sighand() irq disabling and
      RCU") introduced a rcu read side critical section with interrupts
      disabled. The changelog suggested that a better long-term fix would be "to
      make rt_mutex_unlock() disable irqs when acquiring the rt_mutex structure's
      ->wait_lock".
      
      This long-term fix has been made in commit b4abf910 ("rtmutex: Make
      wait_lock irq safe") for a different reason.
      
      Therefore revert commit a841796f ("signal: align >
      __lock_task_sighand() irq disabling and RCU") as the interrupt disable
      dance is not longer required.
      
      The change was tested on the base of b4abf910 ("rtmutex: Make wait_lock
      irq safe") with a four hour run of rcutorture scenario TREE03 with lockdep
      enabled as suggested by Paul McKenney.
      Signed-off-by: default avatarAnna-Maria Gleixner <anna-maria@linutronix.de>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Acked-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Acked-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
      Cc: bigeasy@linutronix.de
      Link: https://lkml.kernel.org/r/20180525090507.22248-3-anna-maria@linutronix.de
      59dc6f3c