1. 18 Oct, 2017 4 commits
    • Takashi Iwai's avatar
      ALSA: hda - Fix incorrect TLV callback check introduced during set_fs() removal · a91d6612
      Takashi Iwai authored
      The commit 99b5c5bb ("ALSA: hda - Remove the use of set_fs()")
      converted the get_kctl_0dB_offset() call for killing set_fs() usage in
      HD-audio codec code.  The conversion assumed that the TLV callback
      used in HD-audio code is only snd_hda_mixer_amp() and applies the TLV
      calculation locally.
      
      Although this assumption is correct, and all slave kctls are actually
      with that callback, the current code is still utterly buggy; it
      doesn't hit this condition and falls back to the next check.  It's
      because the function gets called after adding slave kctls to vmaster.
      By assigning a slave kctl, the slave kctl object is faked inside
      vmaster code, and the whole kctl ops are overridden.  Thus the
      callback op points to a different value from what we've assumed.
      
      More badly, as reported by the KERNEXEC and UDEREF features of PaX,
      the code flow turns into the unexpected pitfall.  The next fallback
      check is SNDRV_CTL_ELEM_ACCESS_TLV_READ access bit, and this always
      hits for each kctl with TLV.  Then it evaluates the callback function
      pointer wrongly as if it were a TLV array.  Although currently its
      side-effect is fairly limited, this incorrect reference may lead to an
      unpleasant result.
      
      For addressing the regression, this patch introduces a new helper to
      vmaster code, snd_ctl_apply_vmaster_slaves().  This works similarly
      like the existing map_slaves() in hda_codec.c: it loops over the slave
      list of the given master, and applies the given function to each
      slave.  Then the initializer function receives the right kctl object
      and we can compare the correct pointer instead of the faked one.
      
      Also, for catching the similar breakage in future, give an error
      message when the unexpected TLV callback is found and bail out
      immediately.
      
      Fixes: 99b5c5bb ("ALSA: hda - Remove the use of set_fs()")
      Reported-by: default avatarPaX Team <pageexec@freemail.hu>
      Cc: <stable@vger.kernel.org> # v4.13
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      a91d6612
    • Takashi Iwai's avatar
      ALSA: hda: Remove superfluous '-' added by printk conversion · 6bf88a34
      Takashi Iwai authored
      While converting the error messages to the standard macros in the
      commit 4e76a883 ("ALSA: hda - Replace with standard printk"), a
      superfluous '-' slipped in the code mistakenly.  Its influence is
      almost negligible, merely shows a dB value as negative integer instead
      of positive integer (or vice versa) in the rare error message.
      So let's kill this embarrassing byte to show more correct value.
      
      Fixes: 4e76a883 ("ALSA: hda - Replace with standard printk")
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      6bf88a34
    • Takashi Iwai's avatar
      ALSA: hda: Abort capability probe at invalid register read · 098a0a62
      Takashi Iwai authored
      The loop in snd_hdac_bus_parse_capabilities() may go to nirvana when
      it hits an invalid register value read:
      
       BUG: unable to handle kernel paging request at ffffad5dc41f3fff
       IP: pci_azx_readl+0x5/0x10 [snd_hda_intel]
       Call Trace:
        snd_hdac_bus_parse_capabilities+0x3c/0x1f0 [snd_hda_core]
        azx_probe_continue+0x7d5/0x940 [snd_hda_intel]
        .....
      
      This happened on a new Intel machine, and we need to check the value
      and abort the loop accordingly.
      
      [Note: the fixes tag below indicates only the commit where this patch
       can be applied; the original problem was introduced even before that
       commit]
      
      Fixes: 6720b384 ("ALSA: hda - move bus_parse_capabilities to core")
      Cc: <stable@vger.kernel.org>
      Acked-by: default avatarVinod Koul <vinod.koul@intel.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      098a0a62
    • Ben Hutchings's avatar
      ALSA: seq: Enable 'use' locking in all configurations · 8009d506
      Ben Hutchings authored
      The 'use' locking macros are no-ops if neither SMP or SND_DEBUG is
      enabled.  This might once have been OK in non-preemptible
      configurations, but even in that case snd_seq_read() may sleep while
      relying on a 'use' lock.  So always use the proper implementations.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      8009d506
  2. 16 Oct, 2017 1 commit
  3. 11 Oct, 2017 2 commits
    • Takashi Iwai's avatar
      ALSA: caiaq: Fix stray URB at probe error path · 99fee508
      Takashi Iwai authored
      caiaq driver doesn't kill the URB properly at its error path during
      the probe, which may lead to a use-after-free error later.  This patch
      addresses it.
      Reported-by: default avatarJohan Hovold <johan@kernel.org>
      Reviewed-by: default avatarJohan Hovold <johan@kernel.org>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      99fee508
    • Takashi Iwai's avatar
      ALSA: seq: Fix use-after-free at creating a port · 71105998
      Takashi Iwai authored
      There is a potential race window opened at creating and deleting a
      port via ioctl, as spotted by fuzzing.  snd_seq_create_port() creates
      a port object and returns its pointer, but it doesn't take the
      refcount, thus it can be deleted immediately by another thread.
      Meanwhile, snd_seq_ioctl_create_port() still calls the function
      snd_seq_system_client_ev_port_start() with the created port object
      that is being deleted, and this triggers use-after-free like:
      
       BUG: KASAN: use-after-free in snd_seq_ioctl_create_port+0x504/0x630 [snd_seq] at addr ffff8801f2241cb1
       =============================================================================
       BUG kmalloc-512 (Tainted: G    B          ): kasan: bad access detected
       -----------------------------------------------------------------------------
       INFO: Allocated in snd_seq_create_port+0x94/0x9b0 [snd_seq] age=1 cpu=3 pid=4511
       	___slab_alloc+0x425/0x460
       	__slab_alloc+0x20/0x40
        	kmem_cache_alloc_trace+0x150/0x190
      	snd_seq_create_port+0x94/0x9b0 [snd_seq]
      	snd_seq_ioctl_create_port+0xd1/0x630 [snd_seq]
       	snd_seq_do_ioctl+0x11c/0x190 [snd_seq]
       	snd_seq_ioctl+0x40/0x80 [snd_seq]
       	do_vfs_ioctl+0x54b/0xda0
       	SyS_ioctl+0x79/0x90
       	entry_SYSCALL_64_fastpath+0x16/0x75
       INFO: Freed in port_delete+0x136/0x1a0 [snd_seq] age=1 cpu=2 pid=4717
       	__slab_free+0x204/0x310
       	kfree+0x15f/0x180
       	port_delete+0x136/0x1a0 [snd_seq]
       	snd_seq_delete_port+0x235/0x350 [snd_seq]
       	snd_seq_ioctl_delete_port+0xc8/0x180 [snd_seq]
       	snd_seq_do_ioctl+0x11c/0x190 [snd_seq]
       	snd_seq_ioctl+0x40/0x80 [snd_seq]
       	do_vfs_ioctl+0x54b/0xda0
       	SyS_ioctl+0x79/0x90
       	entry_SYSCALL_64_fastpath+0x16/0x75
       Call Trace:
        [<ffffffff81b03781>] dump_stack+0x63/0x82
        [<ffffffff81531b3b>] print_trailer+0xfb/0x160
        [<ffffffff81536db4>] object_err+0x34/0x40
        [<ffffffff815392d3>] kasan_report.part.2+0x223/0x520
        [<ffffffffa07aadf4>] ? snd_seq_ioctl_create_port+0x504/0x630 [snd_seq]
        [<ffffffff815395fe>] __asan_report_load1_noabort+0x2e/0x30
        [<ffffffffa07aadf4>] snd_seq_ioctl_create_port+0x504/0x630 [snd_seq]
        [<ffffffffa07aa8f0>] ? snd_seq_ioctl_delete_port+0x180/0x180 [snd_seq]
        [<ffffffff8136be50>] ? taskstats_exit+0xbc0/0xbc0
        [<ffffffffa07abc5c>] snd_seq_do_ioctl+0x11c/0x190 [snd_seq]
        [<ffffffffa07abd10>] snd_seq_ioctl+0x40/0x80 [snd_seq]
        [<ffffffff8136d433>] ? acct_account_cputime+0x63/0x80
        [<ffffffff815b515b>] do_vfs_ioctl+0x54b/0xda0
        .....
      
      We may fix this in a few different ways, and in this patch, it's fixed
      simply by taking the refcount properly at snd_seq_create_port() and
      letting the caller unref the object after use.  Also, there is another
      potential use-after-free by sprintf() call in snd_seq_create_port(),
      and this is moved inside the lock.
      
      This fix covers CVE-2017-15265.
      Reported-and-tested-by: default avatarMichael23 Yu <ycqzsy@gmail.com>
      Suggested-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      71105998
  4. 10 Oct, 2017 1 commit
    • Takashi Iwai's avatar
      ALSA: usb-audio: Kill stray URB at exiting · 124751d5
      Takashi Iwai authored
      USB-audio driver may leave a stray URB for the mixer interrupt when it
      exits by some error during probe.  This leads to a use-after-free
      error as spotted by syzkaller like:
        ==================================================================
        BUG: KASAN: use-after-free in snd_usb_mixer_interrupt+0x604/0x6f0
        Call Trace:
         <IRQ>
         __dump_stack lib/dump_stack.c:16
         dump_stack+0x292/0x395 lib/dump_stack.c:52
         print_address_description+0x78/0x280 mm/kasan/report.c:252
         kasan_report_error mm/kasan/report.c:351
         kasan_report+0x23d/0x350 mm/kasan/report.c:409
         __asan_report_load8_noabort+0x19/0x20 mm/kasan/report.c:430
         snd_usb_mixer_interrupt+0x604/0x6f0 sound/usb/mixer.c:2490
         __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779
         ....
      
        Allocated by task 1484:
         save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59
         save_stack+0x43/0xd0 mm/kasan/kasan.c:447
         set_track mm/kasan/kasan.c:459
         kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
         kmem_cache_alloc_trace+0x11e/0x2d0 mm/slub.c:2772
         kmalloc ./include/linux/slab.h:493
         kzalloc ./include/linux/slab.h:666
         snd_usb_create_mixer+0x145/0x1010 sound/usb/mixer.c:2540
         create_standard_mixer_quirk+0x58/0x80 sound/usb/quirks.c:516
         snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560
         create_composite_quirk+0x1c4/0x3e0 sound/usb/quirks.c:59
         snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560
         usb_audio_probe+0x1040/0x2c10 sound/usb/card.c:618
         ....
      
        Freed by task 1484:
         save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59
         save_stack+0x43/0xd0 mm/kasan/kasan.c:447
         set_track mm/kasan/kasan.c:459
         kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:524
         slab_free_hook mm/slub.c:1390
         slab_free_freelist_hook mm/slub.c:1412
         slab_free mm/slub.c:2988
         kfree+0xf6/0x2f0 mm/slub.c:3919
         snd_usb_mixer_free+0x11a/0x160 sound/usb/mixer.c:2244
         snd_usb_mixer_dev_free+0x36/0x50 sound/usb/mixer.c:2250
         __snd_device_free+0x1ff/0x380 sound/core/device.c:91
         snd_device_free_all+0x8f/0xe0 sound/core/device.c:244
         snd_card_do_free sound/core/init.c:461
         release_card_device+0x47/0x170 sound/core/init.c:181
         device_release+0x13f/0x210 drivers/base/core.c:814
         ....
      
      Actually such a URB is killed properly at disconnection when the
      device gets probed successfully, and what we need is to apply it for
      the error-path, too.
      
      In this patch, we apply snd_usb_mixer_disconnect() at releasing.
      Also introduce a new flag, disconnected, to struct usb_mixer_interface
      for not performing the disconnection procedure twice.
      Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Tested-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      124751d5
  5. 09 Oct, 2017 6 commits
    • Takashi Iwai's avatar
      ALSA: line6: Fix leftover URB at error-path during probe · c95072b3
      Takashi Iwai authored
      While line6_probe() may kick off URB for a control MIDI endpoint, the
      function doesn't clean up it properly at its error path.  This results
      in a leftover URB action that is eventually triggered later and causes
      an Oops like:
        general protection fault: 0000 [#1] PREEMPT SMP KASAN
        CPU: 1 PID: 0 Comm: swapper/1 Not tainted
        RIP: 0010:usb_fill_bulk_urb ./include/linux/usb.h:1619
        RIP: 0010:line6_start_listen+0x3fe/0x9e0 sound/usb/line6/driver.c:76
        Call Trace:
         <IRQ>
         line6_data_received+0x1f7/0x470 sound/usb/line6/driver.c:326
         __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779
         usb_hcd_giveback_urb+0x337/0x420 drivers/usb/core/hcd.c:1845
         dummy_timer+0xba9/0x39f0 drivers/usb/gadget/udc/dummy_hcd.c:1965
         call_timer_fn+0x2a2/0x940 kernel/time/timer.c:1281
         ....
      
      Since the whole clean-up procedure is done in line6_disconnect()
      callback, we can simply call it in the error path instead of
      open-coding the whole again.  It'll fix such an issue automagically.
      
      The bug was spotted by syzkaller.
      
      Fixes: eedd0e95 ("ALSA: line6: Don't forget to call driver's destructor at error path")
      Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Tested-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      c95072b3
    • Takashi Iwai's avatar
      ALSA: line6: Fix NULL dereference at podhd_disconnect() · 54a4b2b4
      Takashi Iwai authored
      When podhd_init() failed with the acquiring a ctrl i/f, the line6
      helper still calls the disconnect callback that eventually calls again
      usb_driver_release_interface() with the NULL intf.
      
      Put the proper NULL check before calling it for avoiding an Oops.
      
      Fixes: fc90172b ("ALSA: line6: Claim pod x3 usb data interface")
      Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Tested-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      54a4b2b4
    • Takashi Iwai's avatar
      ALSA: line6: Fix missing initialization before error path · cb02ffc7
      Takashi Iwai authored
      The error path in podhd_init() tries to clear the pending timer, while
      the timer object is initialized at the end of init sequence, thus it
      may hit the uninitialized object, as spotted by syzkaller:
      
        INFO: trying to register non-static key.
        the code is fine but needs lockdep annotation.
        turning off the locking correctness validator.
        CPU: 1 PID: 1845 Comm: kworker/1:2 Not tainted
        4.14.0-rc2-42613-g1488251d1a98 #238
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
        Workqueue: usb_hub_wq hub_event
        Call Trace:
         __dump_stack lib/dump_stack.c:16
         dump_stack+0x292/0x395 lib/dump_stack.c:52
         register_lock_class+0x6c4/0x1a00 kernel/locking/lockdep.c:769
         __lock_acquire+0x27e/0x4550 kernel/locking/lockdep.c:3385
         lock_acquire+0x259/0x620 kernel/locking/lockdep.c:4002
         del_timer_sync+0x12c/0x280 kernel/time/timer.c:1237
         podhd_disconnect+0x8c/0x160 sound/usb/line6/podhd.c:299
         line6_probe+0x844/0x1310 sound/usb/line6/driver.c:783
         podhd_probe+0x64/0x70 sound/usb/line6/podhd.c:474
         ....
      
      For addressing it, assure the initializations of timer and work by
      moving them to the beginning of podhd_init().
      
      Fixes: 790869da ("ALSA: line6: Add support for POD X3")
      Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Tested-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      cb02ffc7
    • Takashi Iwai's avatar
      ALSA: seq: Fix copy_from_user() call inside lock · 5803b023
      Takashi Iwai authored
      The event handler in the virmidi sequencer code takes a read-lock for
      the linked list traverse, while it's calling snd_seq_dump_var_event()
      in the loop.  The latter function may expand the user-space data
      depending on the event type.  It eventually invokes copy_from_user(),
      which might be a potential dead-lock.
      
      The sequencer core guarantees that the user-space data is passed only
      with atomic=0 argument, but snd_virmidi_dev_receive_event() ignores it
      and always takes read-lock().  For avoiding the problem above, this
      patch introduces rwsem for non-atomic case, while keeping rwlock for
      atomic case.
      
      Also while we're at it: the superfluous irq flags is dropped in
      snd_virmidi_input_open().
      Reported-by: default avatarJia-Ju Bai <baijiaju1990@163.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      5803b023
    • Kai-Heng Feng's avatar
      ALSA: usb-audio: Add sample rate quirk for Plantronics P610 · c247487c
      Kai-Heng Feng authored
      Like other Plantronics devices, P610 does not support sample
      rate reading. Apply sample rate quirk to it.
      
      BugLink: https://bugs.launchpad.net/bugs/1719853Signed-off-by: default avatarKai-Heng Feng <kai.heng.feng@canonical.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      c247487c
    • Linus Torvalds's avatar
      Linux 4.14-rc4 · 8a5776a5
      Linus Torvalds authored
      8a5776a5
  6. 07 Oct, 2017 4 commits
  7. 06 Oct, 2017 20 commits
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · dbeb1a8f
      Linus Torvalds authored
      Pull clk fixes from Stephen Boyd:
      
       - build fix to export the clk_bulk_prepare() symbol
      
       - suspend fix for Samsung Exynos SoCs where we need to keep clks on
         across suspend
      
       - two critical clk markings for clks that shouldn't ever turn off on
         Rockchip SoCs
      
       - a fix for a copy-paste mistake on Rockchip rk3128 causing some clks
         to touch the same bit and trample over one another
      
      * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
        clk: samsung: exynos4: Enable VPLL and EPLL clocks for suspend/resume cycle
        clk: Export clk_bulk_prepare()
        clk: rockchip: add sclk_timer5 as critical clock on rk3128
        clk: rockchip: fix up rk3128 pvtm and mipi_24m gate regs error
        clk: rockchip: add pclk_pmu as critical clock on rk3128
      dbeb1a8f
    • Linus Torvalds's avatar
      Merge tag 'arc-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc · ed0f72f4
      Linus Torvalds authored
      Pull ARC udpates from Vineet Gupta:
      
       - updates for various platforms
      
       - boot log updates for upcoming HS48 family of cores (dual issue)
      
      * tag 'arc-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
        ARC: [plat-hsdk]: Add reset controller node to manage ethernet reset
        ARC: [plat-hsdk]: Temporary fix to set CPU frequency to 1GHz
        ARC: fix allnoconfig build warning
        ARCv2: boot log: identify HS48 cores (dual issue)
        ARC: boot log: decontaminate ARCv2 ISA_CONFIG register
        arc: remove redundant UTS_MACHINE define in arch/arc/Makefile
        ARC: [plat-eznps] Update platform maintainer as Noam left
        ARC: [plat-hsdk] use actual clk driver to manage cpu clk
        ARC: [*defconfig] Reenable soft lock-up detector
        ARC: [plat-axs10x] sdio: Temporary fix of sdio ciu frequency
        ARC: [plat-hsdk] sdio: Temporary fix of sdio ciu frequency
        ARC: [plat-axs103] Add temporary quirk to reset ethernet IP
      ed0f72f4
    • Linus Torvalds's avatar
      Merge tag 'xfs-4.14-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · eab26ad1
      Linus Torvalds authored
      Pull xfs fixes from Darrick Wong:
      
       - fix a race between overlapping copy on write aio
      
       - fix cow fork swapping when we defragment reflinked files
      
      * tag 'xfs-4.14-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: handle racy AIO in xfs_reflink_end_cow
        xfs: always swap the cow forks when swapping extents
      eab26ad1
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · 17d084c8
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A collection of fixes for this series. This contains:
      
         - NVMe pull request from Christoph, one uuid attribute fix, and one
           fix for the controller memory buffer address for remapped BARs.
      
         - use-after-free fix for bsg, from Benjamin Block.
      
         - bcache race/use-after-free fix for a list traversal, fixing a
           regression in this merge window. From Coly Li.
      
         - null_blk change configfs dependency change from a 'depends' to a
           'select'. This is a change from this merge window as well. From me.
      
         - nbd signal fix from Josef, fixing a regression introduced with the
           status code changes.
      
         - nbd MAINTAINERS mailing list entry update.
      
         - blk-throttle stall fix from Joseph Qi.
      
         - blk-mq-debugfs fix from Omar, fixing an issue where we don't
           register the IO scheduler debugfs directory, if the driver is
           loaded with it. Only shows up if you switch through the sysfs
           interface"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        bsg-lib: fix use-after-free under memory-pressure
        nvme-pci: Use PCI bus address for data/queues in CMB
        blk-mq-debugfs: fix device sched directory for default scheduler
        null_blk: change configfs dependency to select
        blk-throttle: fix possible io stall when upgrade to max
        MAINTAINERS: update list for NBD
        nbd: fix -ERESTARTSYS handling
        nvme: fix visibility of "uuid" ns attribute
        bcache: use llist_for_each_entry_safe() in __closure_wake_up()
      17d084c8
    • Linus Torvalds's avatar
      Merge tag 'pci-v4.14-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · 80cf1f8c
      Linus Torvalds authored
      Pull PCI fixes from Bjorn Helgaas:
       "Fix legacy IDE probe issues exposed by recent PCI core IRQ mapping
        changes (Bartlomiej Zolnierkiewicz, Lorenzo Pieralisi)"
      
      * tag 'pci-v4.14-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        ide: fix IRQ assignment for PCI bus order probing
        ide: pci: free PCI BARs on initialization failure
        ide: free hwif->portdev on hwif_init() failure
      80cf1f8c
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · 27549068
      Linus Torvalds authored
      Pull arm64 fixes from Catalin Marinas:
      
       - Bring initialisation of user space undefined instruction handling
         early (core_initcall) since late_initcall() happens after modprobe in
         initramfs is invoked. Similar fix for fpsimd initialisation
      
       - Increase the kernel stack when KASAN is enabled
      
       - Bring the PCI ACS enabling earlier via the
         iort_init_platform_devices()
      
       - Fix misleading data abort address printing (decimal vs hex)
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: Ensure fpsimd support is ready before userspace is active
        arm64: Ensure the instruction emulation is ready for userspace
        arm64: Use larger stacks when KASAN is selected
        ACPI/IORT: Fix PCI ACS enablement
        arm64: fix misleading data abort decoding
      27549068
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 8d473320
      Linus Torvalds authored
      Pull KVM fixes from Radim Krčmář:
      
       - fix PPC XIVE interrupt delivery
      
       - fix x86 RCU breakage from asynchronous page faults when built without
         PREEMPT_COUNT
      
       - fix x86 build with -frecord-gcc-switches
      
       - fix x86 build without X86_LOCAL_APIC
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: add X86_LOCAL_APIC dependency
        x86/kvm: Move kvm_fastop_exception to .fixup section
        kvm/x86: Avoid async PF preempting the kernel incorrectly
        KVM: PPC: Book3S: Fix server always zero from kvmppc_xive_get_xive()
      8d473320
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma · d109d83f
      Linus Torvalds authored
      Pull rdma fixes from Doug Ledford:
       "This is a pretty small pull request. Only 6 patches in total. There
        are no outstanding -rc patches on the mailing list after this pull
        request, so only if some new issues are discovered in the remainder of
        the rc cycles will you hear from me again.
      
        Summary:
         - a fix for iwpm netlink usage
         - a fix for error unwinding in mlx5
         - two fixes to vlan handling in qedr
         - a couple small i40iw fixes"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:
        i40iw: Fix port number for query QP
        i40iw: Add missing memory barriers
        RDMA/qedr: Parse vlan priority as sl
        RDMA/qedr: Parse VLAN ID correctly and ignore the value of zero
        IB/mlx5: Fix label order in error path handling
        RDMA/iwpm: Properly mark end of NL messages
      d109d83f
    • Linus Torvalds's avatar
      Merge branch 'for-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · bf2db0b9
      Linus Torvalds authored
      Pull btrfs fixes from David Sterba:
       "Two more fixes for bugs introduced in 4.13.
      
        The sector_t problem with 32bit architecture and !LBDAF config seems
        serious but the number of affected deployments is hopefully low.
      
        The clashing status bits could lead to a confusing in-memory state of
        the whole-filesystem operations if used with the quota override sysfs
        knob"
      
      * 'for-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        Btrfs: fix overlap of fs_info::flags values
        btrfs: avoid overflow when sector_t is 32 bit
      bf2db0b9
    • Linus Torvalds's avatar
      Merge tag 'ceph-for-4.14-rc4' of git://github.com/ceph/ceph-client · b77779b9
      Linus Torvalds authored
      Pull ceph fixes from Ilya Dryomov:
       "Two fixups for CephFS snapshot-handling patches in -rc1"
      
      * tag 'ceph-for-4.14-rc4' of git://github.com/ceph/ceph-client:
        ceph: fix __choose_mds() for LSSNAP request
        ceph: properly queue cap snap for newly created snap realm
      b77779b9
    • Eugeniy Paltsev's avatar
      ARC: [plat-hsdk]: Add reset controller node to manage ethernet reset · ab8eb7db
      Eugeniy Paltsev authored
      DW ethernet controller on HSDK hangs sometimes after SW reset, so
      add reset node to make possible to reset DW ethernet controller HW.
      Signed-off-by: default avatarEugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
      Signed-off-by: default avatarVineet Gupta <vgupta@synopsys.com>
      ab8eb7db
    • Linus Torvalds's avatar
      Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs · 8d4ef4e1
      Linus Torvalds authored
      Pull overlayfs fixes from Miklos Szeredi:
       "Fix a regression in 4.14 and one in 4.13. The latter is a case when
        Docker is doing something it really shouldn't and gets away with it.
        We now print a warning instead of erroring out.
      
        There are also fixes to several error paths"
      
      * 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:
        ovl: fix regression caused by exclusive upper/work dir protection
        ovl: fix missing unlock_rename() in ovl_do_copy_up()
        ovl: fix dentry leak in ovl_indexdir_cleanup()
        ovl: fix dput() of ERR_PTR in ovl_cleanup_index()
        ovl: fix error value printed in ovl_lookup_index()
        ovl: fix may_write_real() for overlayfs directories
      8d4ef4e1
    • Linus Torvalds's avatar
      Merge tag 'powerpc-4.14-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 1249b571
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
       "Nine small fixes, really nothing that stands out.
      
        A work-around for a spurious MCE on Power9. A CXL fault handling fix,
        some fixes to the new XIVE code, and a fix to the new 32-bit
        STRICT_KERNEL_RWX code.
      
        Fixes for old code/stable: an fix to an incorrect TLB flush on boot
        but not on any current machines, a compile error on 4xx and a fix to
        memory hotplug when using radix (Power9).
      
        Thanks to: Anton Blanchard, Cédric Le Goater, Christian Lamparter,
        Christophe Leroy, Christophe Lombard, Guenter Roeck, Jeremy Kerr,
        Michael Neuling, Nicholas Piggin"
      
      * tag 'powerpc-4.14-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/powernv: Increase memory block size to 1GB on radix
        powerpc/mm: Call flush_tlb_kernel_range with interrupts enabled
        powerpc/xive: Clear XIVE internal structures when a CPU is removed
        powerpc/xive: Fix IPI reset
        powerpc/4xx: Fix compile error with 64K pages on 40x, 44x
        powerpc: Fix action argument for cpufeatures-based TLB flush
        cxl: Fix memory page not handled
        powerpc: Fix workaround for spurious MCE on POWER9
        powerpc: Handle MCE on POWER9 with only DSISR bit 30 set
      1249b571
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-for-v4.14-rc4' of git://people.freedesktop.org/~airlied/linux · 9c0c1ada
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Some i915 fixes from the last two weeks (as they were on a strange
        base and I just waited for rc3), also a single sun4i hdmi fix"
      
      * tag 'drm-fixes-for-v4.14-rc4' of git://people.freedesktop.org/~airlied/linux:
        drm/i915/glk: Fix DMC/DC state idleness calculation
        drm/i915/cnl: Reprogram DMC firmware after S3/S4 resume
        drm/i915: Fix DDI PHY init if it was already on
        drm/sun4i: hdmi: Disable clks in bind function error path and unbind function
        drm/i915/bios: ignore HDMI on port A
        drm/i915: remove redundant variable hw_check
        drm/i915: always update ELD connector type after get modes
      9c0c1ada
    • Linus Torvalds's avatar
      Merge branch 'core-watchdog-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 27efed3e
      Linus Torvalds authored
      Pull watchddog clean-up and fixes from Thomas Gleixner:
       "The watchdog (hard/softlockup detector) code is pretty much broken in
        its current state. The patch series addresses this by removing all
        duct tape and refactoring it into a workable state.
      
        The reasons why I ask for inclusion that late in the cycle are:
      
         1) The code causes lockdep splats vs. hotplug locking which get
            reported over and over. Unfortunately there is no easy fix.
      
         2) The risk of breakage is minimal because it's already broken
      
         3) As 4.14 is a long term stable kernel, I prefer to have working
            watchdog code in that and the lockdep issues resolved. I wouldn't
            ask you to pull if 4.14 wouldn't be a LTS kernel or if the
            solution would be easy to backport.
      
         4) The series was around before the merge window opened, but then got
            delayed due to the UP failure caused by the for_each_cpu()
            surprise which we discussed recently.
      
        Changes vs. V1:
      
         - Addressed your review points
      
         - Addressed the warning in the powerpc code which was discovered late
      
         - Changed two function names which made sense up to a certain point
           in the series. Now they match what they do in the end.
      
         - Fixed a 'unused variable' warning, which got not detected by the
           intel robot. I triggered it when trying all possible related config
           combinations manually. Randconfig testing seems not random enough.
      
        The changes have been tested by and reviewed by Don Zickus and tested
        and acked by Micheal Ellerman for powerpc"
      
      * 'core-watchdog-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (36 commits)
        watchdog/core: Put softlockup_threads_initialized under ifdef guard
        watchdog/core: Rename some softlockup_* functions
        powerpc/watchdog: Make use of watchdog_nmi_probe()
        watchdog/core, powerpc: Lock cpus across reconfiguration
        watchdog/core, powerpc: Replace watchdog_nmi_reconfigure()
        watchdog/hardlockup/perf: Fix spelling mistake: "permanetely" -> "permanently"
        watchdog/hardlockup/perf: Cure UP damage
        watchdog/hardlockup: Clean up hotplug locking mess
        watchdog/hardlockup/perf: Simplify deferred event destroy
        watchdog/hardlockup/perf: Use new perf CPU enable mechanism
        watchdog/hardlockup/perf: Implement CPU enable replacement
        watchdog/hardlockup/perf: Implement init time detection of perf
        watchdog/hardlockup/perf: Implement init time perf validation
        watchdog/core: Get rid of the racy update loop
        watchdog/core, powerpc: Make watchdog_nmi_reconfigure() two stage
        watchdog/sysctl: Clean up sysctl variable name space
        watchdog/sysctl: Get rid of the #ifdeffery
        watchdog/core: Clean up header mess
        watchdog/core: Further simplify sysctl handling
        watchdog/core: Get rid of the thread teardown/setup dance
        ...
      27efed3e
    • Suzuki K Poulose's avatar
      arm64: Ensure fpsimd support is ready before userspace is active · ae2e972d
      Suzuki K Poulose authored
      We register the pm/hotplug callbacks for FPSIMD as late_initcall,
      which happens after the userspace is active (from initramfs via
      populate_rootfs, a rootfs_initcall). Make sure we are ready even
      before the userspace could potentially use it, by promoting to
      a core_initcall.
      
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: Mark Rutland <mark.rutland@arm.com>
      Cc: Dave Martin <dave.martin@arm.com>
      Signed-off-by: default avatarSuzuki K Poulose <suzuki.poulose@arm.com>
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      ae2e972d
    • Suzuki K Poulose's avatar
      arm64: Ensure the instruction emulation is ready for userspace · c0d8832e
      Suzuki K Poulose authored
      We trap and emulate some instructions (e.g, mrs, deprecated instructions)
      for the userspace. However the handlers for these are registered as
      late_initcalls and the userspace could be up and running from the initramfs
      by that time (with populate_rootfs, which is a rootfs_initcall()). This
      could cause problems for the early applications ending up in failure
      like :
      
      [   11.152061] modprobe[93]: undefined instruction: pc=0000ffff8ca48ff4
      
      This patch promotes the specific calls to core_initcalls, which are
      guaranteed to be completed before we hit userspace.
      
      Cc: stable@vger.kernel.org
      Cc: Dave Martin <dave.martin@arm.com>
      Cc: Matthias Brugger <mbrugger@suse.com>
      Cc: James Morse <james.morse@arm.com>
      Reported-by: default avatarMatwey V. Kornilov <matwey.kornilov@gmail.com>
      Signed-off-by: default avatarSuzuki K Poulose <suzuki.poulose@arm.com>
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      c0d8832e
    • Anton Blanchard's avatar
      powerpc/powernv: Increase memory block size to 1GB on radix · 53ecde0b
      Anton Blanchard authored
      Memory hot unplug on PowerNV radix hosts is broken. Our memory block
      size is 256MB but since we map the linear region with very large
      pages, each pte we tear down maps 1GB.
      
      A hot unplug of one 256MB memory block results in 768MB of memory
      getting unintentionally unmapped. At this point we are likely to oops.
      
      Fix this by increasing our memory block size to 1GB on PowerNV radix
      hosts.
      
      Fixes: 4b5d62ca ("powerpc/mm: add radix__remove_section_mapping()")
      Cc: stable@vger.kernel.org # v4.11+
      Signed-off-by: default avatarAnton Blanchard <anton@samba.org>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      53ecde0b
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2017-10-05' of git://anongit.freedesktop.org/git/drm-misc into drm-fixes · baf7c1f7
      Dave Airlie authored
      One bugfix in sun4i for 4.14
      
      * tag 'drm-misc-fixes-2017-10-05' of git://anongit.freedesktop.org/git/drm-misc:
        drm/sun4i: hdmi: Disable clks in bind function error path and unbind function
      baf7c1f7
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2017-10-04' of... · 00bb09c4
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2017-10-04' of git://anongit.freedesktop.org/git/drm-intel into drm-fixes
      
      drm/i915 fixes for 4.14-rc4:
      
      All 3 highest GLK bugs fixed by Imre:
      - GLK drv reload - Fix DDI Phy init if it was already on.
      - GLK suspend resume - Reprogram DMC firmware after s3/s4.
      - GLK DC states - Fix idleness calculation.
      
      * tag 'drm-intel-fixes-2017-10-04' of git://anongit.freedesktop.org/git/drm-intel:
        drm/i915/glk: Fix DMC/DC state idleness calculation
        drm/i915/cnl: Reprogram DMC firmware after S3/S4 resume
        drm/i915: Fix DDI PHY init if it was already on
      00bb09c4
  8. 05 Oct, 2017 2 commits