1. 25 Apr, 2019 11 commits
  2. 04 Apr, 2019 14 commits
  3. 01 Apr, 2019 3 commits
    • Tetsuo Handa's avatar
      kobject: Don't trigger kobject_uevent(KOBJ_REMOVE) twice. · c03a0fd0
      Tetsuo Handa authored
      syzbot is hitting use-after-free bug in uinput module [1]. This is because
      kobject_uevent(KOBJ_REMOVE) is called again due to commit 0f4dafc0
      ("Kobject: auto-cleanup on final unref") after memory allocation fault
      injection made kobject_uevent(KOBJ_REMOVE) from device_del() from
      input_unregister_device() fail, while uinput_destroy_device() is expecting
      that kobject_uevent(KOBJ_REMOVE) is not called after device_del() from
      input_unregister_device() completed.
      
      That commit intended to catch cases where nobody even attempted to send
      "remove" uevents. But there is no guarantee that an event will ultimately
      be sent. We are at the point of no return as far as the rest of the kernel
      is concerned; there are no repeats or do-overs.
      
      Also, it is not clear whether some subsystem depends on that commit.
      If no subsystem depends on that commit, it will be better to remove
      the state_{add,remove}_uevent_sent logic. But we don't want to risk
      a regression (in a patch which will be backported) by trying to remove
      that logic. Therefore, as a first step, let's avoid the use-after-free bug
      by making sure that kobject_uevent(KOBJ_REMOVE) won't be triggered twice.
      
      [1] https://syzkaller.appspot.com/bug?id=8b17c134fe938bbddd75a45afaa9e68af43a362dReported-by: default avatarsyzbot <syzbot+f648cfb7e0b52bf7ae32@syzkaller.appspotmail.com>
      Analyzed-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      Fixes: 0f4dafc0 ("Kobject: auto-cleanup on final unref")
      Cc: Kay Sievers <kay@vrfy.org>
      Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c03a0fd0
    • Geert Uytterhoeven's avatar
      driver: base: Disable CONFIG_UEVENT_HELPER by default · 1be01d4a
      Geert Uytterhoeven authored
      Since commit 7934779a ("Driver-Core: disable /sbin/hotplug by
      default"), the help text for the /sbin/hotplug fork-bomb says
      "This should not be used today [...] creates a high system load, or
      [...] out-of-memory situations during bootup".  The rationale for this
      was that no recent mainstream system used this anymore (in 2010!).
      
      A few years later, the complete uevent helper support was made optional
      in commit 86d56134 ("kobject: Make support for uevent_helper
      optional.").  However, if was still left enabled by default, to support
      ancient userland.
      
      Time passed by, and nothing should use this anymore, so it can be
      disabled by default.
      Signed-off-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      1be01d4a
    • Greg Kroah-Hartman's avatar
      device.h: reorganize struct device · 159ef31e
      Greg Kroah-Hartman authored
      struct device is big, around 760 bytes on x86_64.  It's not a critical
      structure, but it is embedded everywhere, so making it smaller is always
      a good thing.
      
      With a recent patch that moved a field from struct device to the private
      structure, some benchmarks showed a very odd regression, despite this
      structure having nothing to do with those benchmarks.  That caused me to
      look into the layout of the structure.  Using 'pahole', it showed a
      number of holes and ways that the structure could be reordered in order
      to align some cachelines better, as well as reduce the size of the
      overall structure.
      
      Move 'struct kobj' to the start of the structure, to keep that access
      in the first cacheline, and try to organize things a bit more compactly
      where possible
      
      By doing these few moves, the result removes at least 8 bytes from
      'struct device' on a 64bit system.  Given we know there are systems with
      at least 30k devices in memory at once, every little byte counts, and
      this change could be a savings of 240k of kernel memory for them.  On
      "normal" systems the overall memory savings would be much less.
      
      Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
      Cc: Johan Hovold <johan@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      159ef31e
  4. 31 Mar, 2019 9 commits
    • Linus Torvalds's avatar
      Linux 5.1-rc3 · 79a3aaa7
      Linus Torvalds authored
      79a3aaa7
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 63fc9c23
      Linus Torvalds authored
      Pull KVM fixes from Paolo Bonzini:
       "A collection of x86 and ARM bugfixes, and some improvements to
        documentation.
      
        On top of this, a cleanup of kvm_para.h headers, which were exported
        by some architectures even though they not support KVM at all. This is
        responsible for all the Kbuild changes in the diffstat"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (28 commits)
        Documentation: kvm: clarify KVM_SET_USER_MEMORY_REGION
        KVM: doc: Document the life cycle of a VM and its resources
        KVM: selftests: complete IO before migrating guest state
        KVM: selftests: disable stack protector for all KVM tests
        KVM: selftests: explicitly disable PIE for tests
        KVM: selftests: assert on exit reason in CR4/cpuid sync test
        KVM: x86: update %rip after emulating IO
        x86/kvm/hyper-v: avoid spurious pending stimer on vCPU init
        kvm/x86: Move MSR_IA32_ARCH_CAPABILITIES to array emulated_msrs
        KVM: x86: Emulate MSR_IA32_ARCH_CAPABILITIES on AMD hosts
        kvm: don't redefine flags as something else
        kvm: mmu: Used range based flushing in slot_handle_level_range
        KVM: export <linux/kvm_para.h> and <asm/kvm_para.h> iif KVM is supported
        KVM: x86: remove check on nr_mmu_pages in kvm_arch_commit_memory_region()
        kvm: nVMX: Add a vmentry check for HOST_SYSENTER_ESP and HOST_SYSENTER_EIP fields
        KVM: SVM: Workaround errata#1096 (insn_len maybe zero on SMAP violation)
        KVM: Reject device ioctls from processes other than the VM's creator
        KVM: doc: Fix incorrect word ordering regarding supported use of APIs
        KVM: x86: fix handling of role.cr4_pae and rename it to 'gpte_size'
        KVM: nVMX: Do not inherit quadrant and invalid for the root shadow EPT
        ...
      63fc9c23
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 915ee0da
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
       "A pile of x86 updates:
      
         - Prevent exceeding he valid physical address space in the /dev/mem
           limit checks.
      
         - Move all header content inside the header guard to prevent compile
           failures.
      
         - Fix the bogus __percpu annotation in this_cpu_has() which makes
           sparse very noisy.
      
         - Disable switch jump tables completely when retpolines are enabled.
      
         - Prevent leaking the trampoline address"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/realmode: Make set_real_mode_mem() static inline
        x86/cpufeature: Fix __percpu annotation in this_cpu_has()
        x86/mm: Don't exceed the valid physical address space
        x86/retpolines: Disable switch jump tables when retpolines are enabled
        x86/realmode: Don't leak the trampoline kernel address
        x86/boot: Fix incorrect ifdeffery scope
        x86/resctrl: Remove unused variable
      915ee0da
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 590627f7
      Linus Torvalds authored
      Pull perf tooling fixes from Thomas Gleixner:
       "Core libraries:
         - Fix max perf_event_attr.precise_ip detection.
         - Fix parser error for uncore event alias
         - Fixup ordering of kernel maps after obtaining the main kernel map
           address.
      
        Intel PT:
         - Fix TSC slip where A TSC packet can slip past MTC packets so that
           the timestamp appears to go backwards.
         - Fixes for exported-sql-viewer GUI conversion to python3.
      
        ARM coresight:
         - Fix the build by adding a missing case value for enumeration value
           introduced in newer library, that now is the required one.
      
        tool headers:
         - Syncronize kernel headers with the kernel, getting new io_uring and
           pidfd_send_signal syscalls so that 'perf trace' can handle them"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf pmu: Fix parser error for uncore event alias
        perf scripts python: exported-sql-viewer.py: Fix python3 support
        perf scripts python: exported-sql-viewer.py: Fix never-ending loop
        perf machine: Update kernel map address and re-order properly
        tools headers uapi: Sync powerpc's asm/kvm.h copy with the kernel sources
        tools headers: Update x86's syscall_64.tbl and uapi/asm-generic/unistd
        tools headers uapi: Update drm/i915_drm.h
        tools arch x86: Sync asm/cpufeatures.h with the kernel sources
        tools headers uapi: Sync linux/fcntl.h to get the F_SEAL_FUTURE_WRITE addition
        tools headers uapi: Sync asm-generic/mman-common.h and linux/mman.h
        perf evsel: Fix max perf_event_attr.precise_ip detection
        perf intel-pt: Fix TSC slip
        perf cs-etm: Add missing case value
      590627f7
    • Linus Torvalds's avatar
      Merge branch 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · c29d8541
      Linus Torvalds authored
      Pull CPU hotplug fixes from Thomas Gleixner:
       "Two SMT/hotplug related fixes:
      
         - Prevent crash when HOTPLUG_CPU is disabled and the CPU bringup
           aborts. This is triggered with the 'nosmt' command line option, but
           can happen by any abort condition. As the real unplug code is not
           compiled in, prevent the fail by keeping the CPU in zombie state.
      
         - Enforce HOTPLUG_CPU for SMP on x86 to avoid the above situation
           completely. With 'nosmt' being a popular option it's required to
           unplug the half brought up sibling CPUs (due to the MCE wreckage)
           completely"
      
      * 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/smp: Enforce CONFIG_HOTPLUG_CPU when SMP=y
        cpu/hotplug: Prevent crash when CPU bringup fails on CONFIG_HOTPLUG_CPU=n
      c29d8541
    • Linus Torvalds's avatar
      Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 573efdc5
      Linus Torvalds authored
      Pull locking fixlet from Thomas Gleixner:
       "Trivial update to the maintainers file"
      
      * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        MAINTAINERS: Remove deleted file from futex file pattern
      573efdc5
    • Linus Torvalds's avatar
      Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · f78b5be2
      Linus Torvalds authored
      Pull core fixes from Thomas Gleixner:
       "A small set of core updates:
      
         - Make the watchdog respect the selected CPU mask again. That was
           broken by the rework of the watchdog thread management and caused
           inconsistent state and NMI watchdog being unstoppable.
      
         - Ensure that the objtool build can find the libelf location.
      
         - Remove dead kcore stub code"
      
      * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        watchdog: Respect watchdog cpumask on CPU hotplug
        objtool: Query pkg-config for libelf location
        proc/kcore: Remove unused kclist_add_remap()
      f78b5be2
    • Linus Torvalds's avatar
      Merge tag 'powerpc-5.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 6536c5f2
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
       "Three non-regression fixes.
      
         - Our optimised memcmp could read past the end of one of the buffers
           and potentially trigger a page fault leading to an oops.
      
         - Some of our code to read energy management data on PowerVM had an
           endian bug leading to bogus results.
      
         - When reporting a machine check exception we incorrectly reported
           TLB multihits as D-Cache multhits due to a missing entry in the
           array of causes.
      
        Thanks to: Chandan Rajendra, Gautham R. Shenoy, Mahesh Salgaonkar,
        Segher Boessenkool, Vaidyanathan Srinivasan"
      
      * tag 'powerpc-5.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/pseries/mce: Fix misleading print for TLB mutlihit
        powerpc/pseries/energy: Use OF accessor functions to read ibm,drc-indexes
        powerpc/64: Fix memcmp reading past the end of src/dest
      6536c5f2
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-fix-5.1-rc3' of git://git.infradead.org/users/vkoul/slave-dma · c877b3df
      Linus Torvalds authored
      Pull dmaengine fixes from Vinod Koul:
      
       - Revert "dmaengine: stm32-mdma: Add a check on read_u32_array" as that
         caused regression
      
       - Fix MAINTAINER file uniphier-mdmac.c file path
      
      * tag 'dmaengine-fix-5.1-rc3' of git://git.infradead.org/users/vkoul/slave-dma:
        MAINTAINERS: Fix uniphier-mdmac.c file path
        dmaengine: stm32-mdma: Revert "dmaengine: stm32-mdma: Add a check on read_u32_array"
      c877b3df
  5. 30 Mar, 2019 3 commits
    • Linus Torvalds's avatar
      Merge tag 'led-fixes-for-5.1-rc3' of... · b5c8314f
      Linus Torvalds authored
      Merge tag 'led-fixes-for-5.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds
      
      Pull LED fixes from Jacek Anaszewski:
      
       - fix refcnt leak on interface rename
      
       - use memcpy in device_name_store() to avoid including garbage from a
         previous, longer value in the device_name
      
       - fix a potential NULL pointer dereference in case of_match_device()
         cannot find a match
      
      * tag 'led-fixes-for-5.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds:
        leds: trigger: netdev: use memcpy in device_name_store
        leds: pca9532: fix a potential NULL pointer dereference
        leds: trigger: netdev: fix refcnt leak on interface rename
      b5c8314f
    • Linus Torvalds's avatar
      Merge tag 'gpio-v5.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · 3af9a525
      Linus Torvalds authored
      Pull GPIO fixes from Linus Walleij:
       "As you can see [in the git history] I was away on leave and Bartosz
        kindly stepped in and collected a slew of fixes, I pulled them into my
        tree in two sets and merged some two more fixes (fixing my own caused
        bugs) on top.
      
        Summary:
      
         - Revert the extended use of gpio_set_config() and think about how we
           can do this properly.
      
         - Fix up the SPI CS GPIO handling so it now works properly on the SPI
           bus children, as intended.
      
         - Error paths and driver fixes"
      
      * tag 'gpio-v5.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpio: mockup: use simple_read_from_buffer() in debugfs read callback
        gpio: of: Fix of_gpiochip_add() error path
        gpio: of: Check for "spi-cs-high" in child instead of parent node
        gpio: of: Check propname before applying "cs-gpios" quirks
        gpio: mockup: fix debugfs read
        Revert "gpio: use new gpio_set_config() helper in more places"
        gpio: aspeed: fix a potential NULL pointer dereference
        gpio: amd-fch: Fix bogus SPDX identifier
        gpio: adnp: Fix testing wrong value in adnp_gpio_direction_input
        gpio: exar: add a check for the return value of ida_simple_get fails
      3af9a525
    • Rasmus Villemoes's avatar
      leds: trigger: netdev: use memcpy in device_name_store · 90934643
      Rasmus Villemoes authored
      If userspace doesn't end the input with a newline (which can easily
      happen if the write happens from a C program that does write(fd,
      iface, strlen(iface))), we may end up including garbage from a
      previous, longer value in the device_name. For example
      
      # cat device_name
      
      # printf 'eth12' > device_name
      # cat device_name
      eth12
      # printf 'eth3' > device_name
      # cat device_name
      eth32
      
      I highly doubt anybody is relying on this behaviour, so switch to
      simply copying the bytes (we've already checked that size is <
      IFNAMSIZ) and unconditionally zero-terminate it; of course, we also
      still have to strip a trailing newline.
      
      This is also preparation for future patches.
      
      Fixes: 06f502f5 ("leds: trigger: Introduce a NETDEV trigger")
      Signed-off-by: default avatarRasmus Villemoes <linux@rasmusvillemoes.dk>
      Acked-by: default avatarPavel Machek <pavel@ucw.cz>
      Signed-off-by: default avatarJacek Anaszewski <jacek.anaszewski@gmail.com>
      90934643