1. 30 Nov, 2018 31 commits
    • Luis Chamberlain's avatar
      lib/test_kmod.c: fix rmmod double free · 5618cf03
      Luis Chamberlain authored
      We free the misc device string twice on rmmod; fix this.  Without this
      we cannot remove the module without crashing.
      
      Link: http://lkml.kernel.org/r/20181124050500.5257-1-mcgrof@kernel.orgSigned-off-by: default avatarLuis Chamberlain <mcgrof@kernel.org>
      Reported-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Cc: <stable@vger.kernel.org>	[4.12+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      5618cf03
    • Pan Bian's avatar
      hfsplus: do not free node before using · c7d7d620
      Pan Bian authored
      hfs_bmap_free() frees node via hfs_bnode_put(node).  However it then
      reads node->this when dumping error message on an error path, which may
      result in a use-after-free bug.  This patch frees node only when it is
      never used.
      
      Link: http://lkml.kernel.org/r/1543053441-66942-1-git-send-email-bianpan2016@163.comSigned-off-by: default avatarPan Bian <bianpan2016@163.com>
      Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Cc: Ernesto A. Fernandez <ernesto.mnd.fernandez@gmail.com>
      Cc: Joe Perches <joe@perches.com>
      Cc: Viacheslav Dubeyko <slava@dubeyko.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c7d7d620
    • Pan Bian's avatar
      hfs: do not free node before using · ce96a407
      Pan Bian authored
      hfs_bmap_free() frees the node via hfs_bnode_put(node).  However, it
      then reads node->this when dumping error message on an error path, which
      may result in a use-after-free bug.  This patch frees the node only when
      it is never again used.
      
      Link: http://lkml.kernel.org/r/1542963889-128825-1-git-send-email-bianpan2016@163.com
      Fixes: a1185ffa2fc ("HFS rewrite")
      Signed-off-by: default avatarPan Bian <bianpan2016@163.com>
      Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Cc: Joe Perches <joe@perches.com>
      Cc: Ernesto A. Fernandez <ernesto.mnd.fernandez@gmail.com>
      Cc: Viacheslav Dubeyko <slava@dubeyko.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ce96a407
    • Alexey Dobriyan's avatar
      proc: update MAINTAINERS with proc.txt · 94570a41
      Alexey Dobriyan authored
      Turns out that /proc has official documentation and people even trying
      to keep it uptodate.
      
      Link: http://lkml.kernel.org/r/20181116134630.GA8004@avx2Signed-off-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
      Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      94570a41
    • Wei Yang's avatar
      mm/page_alloc.c: fix calculation of pgdat->nr_zones · 8f416836
      Wei Yang authored
      init_currently_empty_zone() will adjust pgdat->nr_zones and set it to
      'zone_idx(zone) + 1' unconditionally.  This is correct in the normal
      case, while not exact in hot-plug situation.
      
      This function is used in two places:
      
        * free_area_init_core()
        * move_pfn_range_to_zone()
      
      In the first case, we are sure zone index increase monotonically.  While
      in the second one, this is under users control.
      
      One way to reproduce this is:
      ----------------------------
      
      1. create a virtual machine with empty node1
      
         -m 4G,slots=32,maxmem=32G \
         -smp 4,maxcpus=8          \
         -numa node,nodeid=0,mem=4G,cpus=0-3 \
         -numa node,nodeid=1,mem=0G,cpus=4-7
      
      2. hot-add cpu 3-7
      
         cpu-add [3-7]
      
      2. hot-add memory to nod1
      
         object_add memory-backend-ram,id=ram0,size=1G
         device_add pc-dimm,id=dimm0,memdev=ram0,node=1
      
      3. online memory with following order
      
         echo online_movable > memory47/state
         echo online > memory40/state
      
      After this, node1 will have its nr_zones equals to (ZONE_NORMAL + 1)
      instead of (ZONE_MOVABLE + 1).
      
      Michal said:
       "Having an incorrect nr_zones might result in all sorts of problems
        which would be quite hard to debug (e.g. reclaim not considering the
        movable zone). I do not expect many users would suffer from this it
        but still this is trivial and obviously right thing to do so
        backporting to the stable tree shouldn't be harmful (last famous
        words)"
      
      Link: http://lkml.kernel.org/r/20181117022022.9956-1-richard.weiyang@gmail.com
      Fixes: f1dd2cd1 ("mm, memory_hotplug: do not associate hotadded memory to zones until online")
      Signed-off-by: default avatarWei Yang <richard.weiyang@gmail.com>
      Acked-by: default avatarMichal Hocko <mhocko@suse.com>
      Reviewed-by: default avatarOscar Salvador <osalvador@suse.de>
      Cc: Anshuman Khandual <anshuman.khandual@arm.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8f416836
    • Yu Zhao's avatar
      mm: use swp_offset as key in shmem_replace_page() · c1cb20d4
      Yu Zhao authored
      We changed the key of swap cache tree from swp_entry_t.val to
      swp_offset.  We need to do so in shmem_replace_page() as well.
      
      Hugh said:
       "shmem_replace_page() has been wrong since the day I wrote it: good
        enough to work on swap "type" 0, which is all most people ever use
        (especially those few who need shmem_replace_page() at all), but
        broken once there are any non-0 swp_type bits set in the higher order
        bits"
      
      Link: http://lkml.kernel.org/r/20181121215442.138545-1-yuzhao@google.com
      Fixes: f6ab1f7f ("mm, swap: use offset of swap entry as key of swap cache")
      Signed-off-by: default avatarYu Zhao <yuzhao@google.com>
      Reviewed-by: default avatarMatthew Wilcox <willy@infradead.org>
      Acked-by: default avatarHugh Dickins <hughd@google.com>
      Cc: <stable@vger.kernel.org>	[4.9+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c1cb20d4
    • Pavel Tikhomirov's avatar
      mm: cleancache: fix corruption on missed inode invalidation · 6ff38bd4
      Pavel Tikhomirov authored
      If all pages are deleted from the mapping by memory reclaim and also
      moved to the cleancache:
      
      __delete_from_page_cache
        (no shadow case)
        unaccount_page_cache_page
          cleancache_put_page
        page_cache_delete
          mapping->nrpages -= nr
          (nrpages becomes 0)
      
      We don't clean the cleancache for an inode after final file truncation
      (removal).
      
      truncate_inode_pages_final
        check (nrpages || nrexceptional) is false
          no truncate_inode_pages
            no cleancache_invalidate_inode(mapping)
      
      These way when reading the new file created with same inode we may get
      these trash leftover pages from cleancache and see wrong data instead of
      the contents of the new file.
      
      Fix it by always doing truncate_inode_pages which is already ready for
      nrpages == 0 && nrexceptional == 0 case and just invalidates inode.
      
      [akpm@linux-foundation.org: add comment, per Jan]
      Link: http://lkml.kernel.org/r/20181112095734.17979-1-ptikhomirov@virtuozzo.com
      Fixes: commit 91b0abe3 ("mm + fs: store shadow entries in page cache")
      Signed-off-by: default avatarPavel Tikhomirov <ptikhomirov@virtuozzo.com>
      Reviewed-by: default avatarVasily Averin <vvs@virtuozzo.com>
      Reviewed-by: default avatarAndrey Ryabinin <aryabinin@virtuozzo.com>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Cc: Mel Gorman <mgorman@techsingularity.net>
      Cc: Matthew Wilcox <willy@infradead.org>
      Cc: Andi Kleen <ak@linux.intel.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6ff38bd4
    • Larry Chen's avatar
      ocfs2: fix deadlock caused by ocfs2_defrag_extent() · e21e5744
      Larry Chen authored
      ocfs2_defrag_extent may fall into deadlock.
      
      ocfs2_ioctl_move_extents
          ocfs2_ioctl_move_extents
            ocfs2_move_extents
              ocfs2_defrag_extent
                ocfs2_lock_allocators_move_extents
      
                  ocfs2_reserve_clusters
                    inode_lock GLOBAL_BITMAP_SYSTEM_INODE
      
      	  __ocfs2_flush_truncate_log
                    inode_lock GLOBAL_BITMAP_SYSTEM_INODE
      
      As backtrace shows above, ocfs2_reserve_clusters() will call inode_lock
      against the global bitmap if local allocator has not sufficient cluters.
      Once global bitmap could meet the demand, ocfs2_reserve_cluster will
      return success with global bitmap locked.
      
      After ocfs2_reserve_cluster(), if truncate log is full,
      __ocfs2_flush_truncate_log() will definitely fall into deadlock because
      it needs to inode_lock global bitmap, which has already been locked.
      
      To fix this bug, we could remove from
      ocfs2_lock_allocators_move_extents() the code which intends to lock
      global allocator, and put the removed code after
      __ocfs2_flush_truncate_log().
      
      ocfs2_lock_allocators_move_extents() is referred by 2 places, one is
      here, the other does not need the data allocator context, which means
      this patch does not affect the caller so far.
      
      Link: http://lkml.kernel.org/r/20181101071422.14470-1-lchen@suse.comSigned-off-by: default avatarLarry Chen <lchen@suse.com>
      Reviewed-by: default avatarChangwei Ge <ge.changwei@h3c.com>
      Cc: Mark Fasheh <mark@fasheh.com>
      Cc: Joel Becker <jlbec@evilplan.org>
      Cc: Junxiao Bi <junxiao.bi@oracle.com>
      Cc: Joseph Qi <jiangqi903@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e21e5744
    • John Hubbard's avatar
      mm/gup: finish consolidating error handling · 08be37b7
      John Hubbard authored
      Commit df06b37f ("mm/gup: cache dev_pagemap while pinning pages")
      attempted to operate on each page that get_user_pages had retrieved.  In
      order to do that, it created a common exit point from the routine.
      However, one case was missed, which this patch fixes up.
      
      Also, there was still an unnecessary shadow declaration (with a
      different type) of the "ret" variable, which this patch removes.
      
      Keith's description of the situation is:
      
        This also fixes a potentially leaked dev_pagemap reference count if a
        failure occurs when an iteration crosses a vma boundary.  I don't think
        it's normal to have different vma's on a users mapped zone device
        memory, but good to fix anyway.
      
      I actually thought that this code:
      
          /* first iteration or cross vma bound */
          if (!vma || start >= vma->vm_end) {
      	        vma = find_extend_vma(mm, start);
      	        if (!vma && in_gate_area(mm, start)) {
      		            ret = get_gate_page(mm, start & PAGE_MASK,
      		                    gup_flags, &vma,
      		                    pages ? &pages[i] : NULL);
      		            if (ret)
      		                goto out;
      
      dealt with the "you're trying to pin the gate page, as part of this
      call", rather than the generic case of crossing a vma boundary.  (I
      think there's a fine point that I must be overlooking.) But it's still a
      valid case, either way.
      
      Link: http://lkml.kernel.org/r/20181121081402.29641-2-jhubbard@nvidia.com
      Fixes: df06b37f ("mm/gup: cache dev_pagemap while pinning pages")
      Signed-off-by: default avatarJohn Hubbard <jhubbard@nvidia.com>
      Reviewed-by: default avatarKeith Busch <keith.busch@intel.com>
      Cc: Dan Williams <dan.j.williams@intel.com>
      Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      08be37b7
    • Luis Chamberlain's avatar
      MAINTAINERS: name change for Luis · 12457e63
      Luis Chamberlain authored
      My name has changed, works better than Global Entry I tell ya.
      
      Link: http://lkml.kernel.org/r/20181122003138.7752-1-mcgrof@kernel.orgSigned-off-by: default avatarLuis Chamberlain <mcgrof@kernel.org>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      12457e63
    • Linus Torvalds's avatar
      Merge tag 'char-misc-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · b6839ef2
      Linus Torvalds authored
      Pull char/misc fixes from Greg KH:
       "Here are a few small char/misc driver fixes for 4.20-rc5 that resolve
        a number of reported issues.
      
        The "largest" here is the thunderbolt patch, which resolves an issue
        with NVM upgrade, the smallest being some fsi driver fixes. There's
        also a hyperv bugfix, and the usual binder bugfixes.
      
        All of these have been in linux-next with no reported issues"
      
      * tag 'char-misc-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
        thunderbolt: Prevent root port runtime suspend during NVM upgrade
        Drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl()
        binder: fix race that allows malicious free of live buffer
        fsi: fsi-scom.c: Remove duplicate header
        fsi: master-ast-cf: select GENERIC_ALLOCATOR
      b6839ef2
    • Linus Torvalds's avatar
      Merge tag 'driver-core-4.20-rc5' of... · d7aca8a7
      Linus Torvalds authored
      Merge tag 'driver-core-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
      
      Pull driver core fix from Greg KH:
       "Here is a single driver core fix for 4.20-rc5
      
        It resolves an issue with the data alignment in 'struct devres' for
        the ARC platform. The full details are in the commit changelog, but
        the short summary is the change is a single line:
      
      	-       unsigned long long              data[]; /* guarantee ull alignment */
      	+       u8 __aligned(ARCH_KMALLOC_MINALIGN) data[];
      
        This has been in linux-next for a while with no reported issues"
      
      * tag 'driver-core-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        devres: Align data[] to ARCH_KMALLOC_MINALIGN
      d7aca8a7
    • Linus Torvalds's avatar
      Merge tag 'staging-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · cd9a0433
      Linus Torvalds authored
      Pull staging and IIO driver fixes from Greg KH:
       "Here are some small IIO and staging driver fixes for 4.20-rc5.
      
        Nothing major, the IIO fix ended up touching the HID drivers at the
        same time, but the HID maintainer acked it. The staging fixes are all
        minor patches for reported issues and regressions, full details are in
        the shortlog.
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'staging-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        iio/hid-sensors: Fix IIO_CHAN_INFO_RAW returning wrong values for signed numbers
        staging: vchiq_arm: fix compat VCHIQ_IOC_AWAIT_COMPLETION
        staging: mt7621-pinctrl: fix uninitialized variable ngroups
        staging: rtl8723bs: Add missing return for cfg80211_rtw_get_station
        staging: most: use format specifier "%s" in snprintf
        staging: rtl8723bs: Fix incorrect sense of ether_addr_equal
        staging: mt7621-dma: fix potentially dereferencing uninitialized 'tx_desc'
        staging: comedi: clarify/unify macros for NI macro-defined terminals
        drivers: staging: cedrus: find ctx before dereferencing it ctx
        staging: rtl8723bs: Fix the return value in case of error in 'rtw_wx_read32()'
        staging: comedi: ni_mio_common: scale ao INSN_CONFIG_GET_CMD_TIMING_CONSTRAINTS
        iio:st_magn: Fix enable device after trigger
      cd9a0433
    • Linus Torvalds's avatar
      Merge tag 'usb-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 40ebba2a
      Linus Torvalds authored
      Pull USB/PHY driver fixes from Greg KH:
       "Here are some small USB and PHY driver fixes for 4.20-rc5
      
        Nothing big at all, just the usual handful of USB fixes for reported
        issues, along with some gadget and PHY driver bug fixes.
      
        All of these have been in linux-next with no reported issues. Note,
        the USB gadget fixes were in linux-next on its own branch, not in
        mine, it just got merged into here yesterday and missed linux-next of
        today"
      
      * tag 'usb-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        usb: gadget: u_ether: fix unsafe list iteration
        USB: omap_udc: fix rejection of out transfers when DMA is used
        USB: omap_udc: fix USB gadget functionality on Palm Tungsten E
        USB: omap_udc: fix omap_udc_start() on 15xx machines
        USB: omap_udc: fix crashes on probe error and module removal
        USB: omap_udc: use devm_request_irq()
        usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series
        USB: usb-storage: Add new IDs to ums-realtek
        Revert "usb: dwc3: gadget: skip Set/Clear Halt when invalid"
        phy: qcom-qusb2: Fix HSTX_TRIM tuning with fused value for SDM845
        phy: qcom-qusb2: Use HSTX_TRIM fused value as is
        dt-bindings: phy-qcom-qmp: Fix several mistakes from prior commits
        phy: uniphier-pcie: Depend on HAS_IOMEM
      40ebba2a
    • Linus Torvalds's avatar
      Merge tag 'mtd/fixes-for-4.20-rc5' of git://git.infradead.org/linux-mtd · da59f180
      Linus Torvalds authored
      Pull mtd fixes from Boris Brezillon:
       "NAND fix:
         - Fix BBT cache allocation done in nanddev_bbt_init()
      
        SPI NOR fixes:
         - Fix the erase type selection logic"
      
      * tag 'mtd/fixes-for-4.20-rc5' of git://git.infradead.org/linux-mtd:
        mtd: nand: Fix memory allocation in nanddev_bbt_init()
        mtd: spi-nor: fix erase_type array to indicate current map conf
      da59f180
    • Linus Torvalds's avatar
      test_hexdump: use memcpy instead of strncpy · b1286ed7
      Linus Torvalds authored
      New versions of gcc reasonably warn about the odd pattern of
      
      	strncpy(p, q, strlen(q));
      
      which really doesn't make sense: the strncpy() ends up being just a slow
      and odd way to write memcpy() in this case.
      
      Apparently there was a patch for this floating around earlier, but it
      got lost.
      Acked-again-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b1286ed7
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 1ec63573
      Linus Torvalds authored
      Pull x86 fixes from Ingo Molnar:
       "Misc fixes:
      
         - MCE related boot crash fix on certain AMD systems
      
         - FPU exception handling fix
      
         - FPU handling race fix
      
         - revert+rewrite of the RSDP boot protocol extension, use boot_params
           instead
      
         - documentation fix"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/MCE/AMD: Fix the thresholding machinery initialization order
        x86/fpu: Use the correct exception table macro in the XSTATE_OP wrapper
        x86/fpu: Disable bottom halves while loading FPU registers
        x86/acpi, x86/boot: Take RSDP address from boot params if available
        x86/boot: Mostly revert commit ae7e1238 ("Add ACPI RSDP address to setup_header")
        x86/ptrace: Fix documentation for tracehook_report_syscall_entry()
      1ec63573
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · a1b3cf6d
      Linus Torvalds authored
      Pull perf fixes from Ingo Molnar:
       "Misc fixes:
      
         - counter freezing related regression fix
      
         - uprobes race fix
      
         - Intel PMU unusual event combination fix
      
         - .. and diverse tooling fixes"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        uprobes: Fix handle_swbp() vs. unregister() + register() race once more
        perf/x86/intel: Disallow precise_ip on BTS events
        perf/x86/intel: Add generic branch tracing check to intel_pmu_has_bts()
        perf/x86/intel: Move branch tracing setup to the Intel-specific source file
        perf/x86/intel: Fix regression by default disabling perfmon v4 interrupt handling
        perf tools beauty ioctl: Support new ISO7816 commands
        tools uapi asm-generic: Synchronize ioctls.h
        tools arch x86: Update tools's copy of cpufeatures.h
        tools headers uapi: Synchronize i915_drm.h
        perf tools: Restore proper cwd on return from mnt namespace
        tools build feature: Check if get_current_dir_name() is available
        perf tools: Fix crash on synthesizing the unit
      a1b3cf6d
    • Linus Torvalds's avatar
      Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 8d9f412d
      Linus Torvalds authored
      Pull EFI fix from Ingo Molnar:
       "An arm64 warning fix"
      
      * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        efi: Prevent GICv3 WARN() by mapping the memreserve table before first use
      8d9f412d
    • Linus Torvalds's avatar
      Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 575d7d0d
      Linus Torvalds authored
      Pull objtool fixes from Ingo Molnar:
       "Two fixes for boundary conditions"
      
      * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        objtool: Fix segfault in .cold detection with -ffunction-sections
        objtool: Fix double-free in .cold detection error path
      575d7d0d
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 5f1ca5c6
      Linus Torvalds authored
      Pull vfs fixes from Al Viro:
       "Assorted fixes all over the place.
      
        The iov_iter one is this cycle regression (splice from UDP triggering
        WARN_ON()), the rest is older"
      
      * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        afs: Use d_instantiate() rather than d_add() and don't d_drop()
        afs: Fix missing net error handling
        afs: Fix validation/callback interaction
        iov_iter: teach csum_and_copy_to_iter() to handle pipe-backed ones
        exportfs: do not read dentry after free
        exportfs: fix 'passing zero to ERR_PTR()' warning
        aio: fix failure to put the file pointer
        sysv: return 'err' instead of 0 in __sysv_write_inode
      5f1ca5c6
    • Linus Torvalds's avatar
      Merge tag 'trace-v4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 49afe661
      Linus Torvalds authored
      Pull more tracing fixes from Steven Rostedt:
       "Two more fixes:
      
         - Change idx variable in DO_TRACE macro to __idx to avoid name
           conflicts. A kvm event had "idx" as a parameter and it confused the
           macro.
      
         - Fix a race where interrupts would be traced when set_graph_function
           was set. The previous patch set increased a race window that
           tricked the function graph tracer to think it should trace
           interrupts when it really should not have.
      
           The bug has been there before, but was seldom hit. Only the last
           patch series made it more common"
      
      * tag 'trace-v4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing/fgraph: Fix set_graph_function from showing interrupts
        tracepoint: Use __idx instead of idx in DO_TRACE macro to make it unique
      49afe661
    • Linus Torvalds's avatar
      Merge tag 'trace-v4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 0f1f6923
      Linus Torvalds authored
      Pull tracing fixes from Steven Rostedt:
       "While rewriting the function graph tracer, I discovered a design flaw
        that was introduced by a patch that tried to fix one bug, but by doing
        so created another bug.
      
        As both bugs corrupt the output (but they do not crash the kernel), I
        decided to fix the design such that it could have both bugs fixed. The
        original fix, fixed time reporting of the function graph tracer when
        doing a max_depth of one. This was code that can test how much the
        kernel interferes with userspace. But in doing so, it could corrupt
        the time keeping of the function profiler.
      
        The issue is that the curr_ret_stack variable was being used for two
        different meanings. One was to keep track of the stack pointer on the
        ret_stack (shadow stack used by the function graph tracer), and the
        other use case was the graph call depth. Although, the two may be
        closely related, where they got updated was the issue that lead to the
        two different bugs that required the two use cases to be updated
        differently.
      
        The big issue with this fix is that it requires changing each
        architecture. The good news is, I was able to remove a lot of code
        that was duplicated within the architectures and place it into a
        single location. Then I could make the fix in one place.
      
        I pushed this code into linux-next to let it settle over a week, and
        before doing so, I cross compiled all the affected architectures to
        make sure that they built fine.
      
        In the mean time, I also pulled in a patch that fixes the sched_switch
        previous tasks state output, that was not actually correct"
      
      * tag 'trace-v4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        sched, trace: Fix prev_state output in sched_switch tracepoint
        function_graph: Have profiler use curr_ret_stack and not depth
        function_graph: Reverse the order of pushing the ret_stack and the callback
        function_graph: Move return callback before update of curr_ret_stack
        function_graph: Use new curr_ret_depth to manage depth instead of curr_ret_stack
        function_graph: Make ftrace_push_return_trace() static
        sparc/function_graph: Simplify with function_graph_enter()
        sh/function_graph: Simplify with function_graph_enter()
        s390/function_graph: Simplify with function_graph_enter()
        riscv/function_graph: Simplify with function_graph_enter()
        powerpc/function_graph: Simplify with function_graph_enter()
        parisc: function_graph: Simplify with function_graph_enter()
        nds32: function_graph: Simplify with function_graph_enter()
        MIPS: function_graph: Simplify with function_graph_enter()
        microblaze: function_graph: Simplify with function_graph_enter()
        arm64: function_graph: Simplify with function_graph_enter()
        ARM: function_graph: Simplify with function_graph_enter()
        x86/function_graph: Simplify with function_graph_enter()
        function_graph: Create function_graph_enter() to consolidate architecture code
      0f1f6923
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2018-11-30' of git://anongit.freedesktop.org/drm/drm · 570a3743
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "This weeks instalment of fixes. Looks fairly like business as usual
        and everything seems to rolling along. There was one MST fix applied
        and reverted in the misc tree, but otherwise nothing too strange in
        here.
      
        core:
         - incorrect master setting on error fix
      
        i915:
         - only GVT fixes this week:
            * one MOCS register load
            * rpm lock fix
            * use after free
      
        rcar-du:
         - regression fix for group start
      
        amdgpu:
         - DP MST fix
         - GPUVM fix for huge pages
         - RLC fix for vega20
      
        ast:
         - fix EDID reading stability
         - ioreg free fix
      
        meson:
         - sleep in irq fix
         - vblank fixes
         - array boundary fix"
      
      * tag 'drm-fixes-2018-11-30' of git://anongit.freedesktop.org/drm/drm:
        drm/ast: fixed reading monitor EDID not stable issue
        drm/ast: Fix incorrect free on ioregs
        Revert "drm/dp_mst: Skip validating ports during destruction, just ref"
        drm/amdgpu: Add delay after enable RLC ucode
        drm/amdgpu: Avoid endless loop in GPUVM fragment processing
        drm/amdgpu: Cast to uint64_t before left shift
        drm/meson: add support for 1080p25 mode
        drm/meson: Fix OOB memory accesses in meson_viu_set_osd_lut()
        drm/meson: Enable fast_io in meson_dw_hdmi_regmap_config
        drm/meson: Fixes for drm_crtc_vblank_on/off support
        drm: set is_master to 0 upon drm_new_set_master() failure
        drm/dp_mst: Skip validating ports during destruction, just ref
        drm: rcar-du: Fix DU3 start/stop on M3-N
        drm/amd/dm: Understand why attaching path/tile properties are needed
        drm/amd/dm: Don't forget to attach MST encoders
        drm/i915/gvt: Avoid use-after-free iterating the gtt list
        drm/i915/gvt: ensure gpu is powered before do i915_gem_gtt_insert
        drm/i915/gvt: not to touch undefined MOCS registers
      570a3743
    • Linus Torvalds's avatar
      Merge tag 'pstore-v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux · e9eaf72e
      Linus Torvalds authored
      Pull pstore fix from Kees Cook:
       "Fix corrupted compression due to unlucky size choice with ECC"
      
      * tag 'pstore-v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
        pstore/ram: Correctly calculate usable PRZ bytes
      e9eaf72e
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · 2b17992f
      Linus Torvalds authored
      Pull rdma fixes from Jason Gunthorpe:
       "This is a bit later than usual for our first -rc but I'm not seeing
        anything worry-some in the RDMA tree right now. Quiet so far this -rc
        cycle, only a few internal driver related bugs and a small series
        fixing ODP bugs found by more advanced testing.
      
        A set of small driver and core code fixes:
      
         - Small series fixing longtime user triggerable bugs in the ODP
           processing inside mlx5 and core code
      
         - Various small driver malfunctions and crashes (use after, free,
           error unwind, implementation bugs)
      
         - A misfunction of the RDMA GID cache that can be triggered by the
           administrator"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        RDMA/mlx5: Initialize return variable in case pagefault was skipped
        IB/mlx5: Fix page fault handling for MW
        IB/umem: Set correct address to the invalidation function
        IB/mlx5: Skip non-ODP MR when handling a page fault
        RDMA/hns: Bugfix pbl configuration for rereg mr
        iser: set sector for ambiguous mr status errors
        RDMA/rdmavt: Fix rvt_create_ah function signature
        IB/mlx5: Avoid load failure due to unknown link width
        IB/mlx5: Fix XRC QP support after introducing extended atomic
        RDMA/bnxt_re: Avoid accessing the device structure after it is freed
        RDMA/bnxt_re: Fix system hang when registration with L2 driver fails
        RDMA/core: Add GIDs while changing MAC addr only for registered ndev
        RDMA/mlx5: Fix fence type for IB_WR_LOCAL_INV WR
        net/mlx5: Fix XRC SRQ umem valid bits
      2b17992f
    • Steven Rostedt (VMware)'s avatar
      tracing/fgraph: Fix set_graph_function from showing interrupts · 5cf99a0f
      Steven Rostedt (VMware) authored
      The tracefs file set_graph_function is used to only function graph functions
      that are listed in that file (or all functions if the file is empty). The
      way this is implemented is that the function graph tracer looks at every
      function, and if the current depth is zero and the function matches
      something in the file then it will trace that function. When other functions
      are called, the depth will be greater than zero (because the original
      function will be at depth zero), and all functions will be traced where the
      depth is greater than zero.
      
      The issue is that when a function is first entered, and the handler that
      checks this logic is called, the depth is set to zero. If an interrupt comes
      in and a function in the interrupt handler is traced, its depth will be
      greater than zero and it will automatically be traced, even if the original
      function was not. But because the logic only looks at depth it may trace
      interrupts when it should not be.
      
      The recent design change of the function graph tracer to fix other bugs
      caused the depth to be zero while the function graph callback handler is
      being called for a longer time, widening the race of this happening. This
      bug was actually there for a longer time, but because the race window was so
      small it seldom happened. The Fixes tag below is for the commit that widen
      the race window, because that commit belongs to a series that will also help
      fix the original bug.
      
      Cc: stable@kernel.org
      Fixes: 39eb456d ("function_graph: Use new curr_ret_depth to manage depth instead of curr_ret_stack")
      Reported-by: default avatarJoe Lawrence <joe.lawrence@redhat.com>
      Tested-by: default avatarJoe Lawrence <joe.lawrence@redhat.com>
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      5cf99a0f
    • Zenghui Yu's avatar
      tracepoint: Use __idx instead of idx in DO_TRACE macro to make it unique · 0c7a52e4
      Zenghui Yu authored
      After enabling KVM event tracing, almost all of trace_kvm_exit()'s
      printk shows
      
      	"kvm_exit: IRQ: ..."
      
      even if the actual exception_type is NOT IRQ.  More specifically,
      trace_kvm_exit() is defined in virt/kvm/arm/trace.h by TRACE_EVENT.
      
      This slight problem may have existed after commit e6753f23
      ("tracepoint: Make rcuidle tracepoint callers use SRCU"). There are
      two variables in trace_kvm_exit() and __DO_TRACE() which have the
      same name, *idx*. Thus the actual value of *idx* will be overwritten
      when tracing. Fix it by adding a simple prefix.
      
      Cc: Joel Fernandes <joel@joelfernandes.org>
      Cc: Wang Haibin <wanghaibin.wang@huawei.com>
      Cc: linux-trace-devel@vger.kernel.org
      Cc: stable@vger.kernel.org
      Fixes: e6753f23 ("tracepoint: Make rcuidle tracepoint callers use SRCU")
      Reviewed-by: default avatarJoel Fernandes (Google) <joel@joelfernandes.org>
      Signed-off-by: default avatarZenghui Yu <yuzenghui@huawei.com>
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      0c7a52e4
    • David Howells's avatar
      afs: Use d_instantiate() rather than d_add() and don't d_drop() · 73116df7
      David Howells authored
      Use d_instantiate() rather than d_add() and don't d_drop() in
      afs_vnode_new_inode().  The dentry shouldn't be removed as it's not
      changing its name.
      Reported-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      73116df7
    • David Howells's avatar
      afs: Fix missing net error handling · 4584ae96
      David Howells authored
      kAFS can be given certain network errors (EADDRNOTAVAIL, EHOSTDOWN and
      ERFKILL) that it doesn't handle in its server/address rotation algorithms.
      They cause the probing and rotation to abort immediately rather than
      rotating.
      
      Fix this by:
      
       (1) Abstracting out the error prioritisation from the VL and FS rotation
           algorithms into a common function and expand usage into the server
           probing code.
      
           When multiple errors are available, this code selects the one we'd
           prefer to return.
      
       (2) Add handling for EADDRNOTAVAIL, EHOSTDOWN and ERFKILL.
      
      Fixes: 0fafdc9f ("afs: Fix file locking")
      Fixes: 0338747d8454 ("afs: Probe multiple fileservers simultaneously")
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      4584ae96
    • David Howells's avatar
      afs: Fix validation/callback interaction · ae3b7361
      David Howells authored
      When afs_validate() is called to validate a vnode (inode), there are two
      unhandled cases in the fastpath at the top of the function:
      
       (1) If the vnode is promised (AFS_VNODE_CB_PROMISED is set), the break
           counters match and the data has expired, then there's an implicit case
           in which the vnode needs revalidating.
      
           This has no consequences since the default "valid = false" set at the
           top of the function happens to do the right thing.
      
       (2) If the vnode is not promised and it hasn't been deleted
           (AFS_VNODE_DELETED is not set) then there's a default case we're not
           handling in which the vnode is invalid.  If the vnode is invalid, we
           need to bring cb_s_break and cb_v_break up to date before we refetch
           the status.
      
           As a consequence, once the server loses track of the client
           (ie. sufficient time has passed since we last sent it an operation),
           it will send us a CB.InitCallBackState* operation when we next try to
           talk to it.  This calls afs_init_callback_state() which increments
           afs_server::cb_s_break, but this then doesn't propagate to the
           afs_vnode record.
      
           The result being that every afs_validate() call thereafter sends a
           status fetch operation to the server.
      
      Clarify and fix this by:
      
       (A) Setting valid in all the branches rather than initialising it at the
           top so that the compiler catches where we've missed.
      
       (B) Restructuring the logic in the 'promised' branch so that we set valid
           to false if the callback is due to expire (or has expired) and so that
           the final case is that the vnode is still valid.
      
       (C) Adding an else-statement that ups cb_s_break and cb_v_break if the
           promised and deleted cases don't match.
      
      Fixes: c435ee34 ("afs: Overhaul the callback handling")
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      ae3b7361
  2. 29 Nov, 2018 9 commits
    • Linus Torvalds's avatar
      Merge tag 'acpi-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 94f371cb
      Linus Torvalds authored
      Pull ACPI fix from Rafael Wysocki:
       "Fix a recent regression in ACPICA releted to the Generic Serial Bus
        protocol handling and causing it to read or write too little or too
        much data in some cases, so incorrect data may be written to hardware
        as a result (Hans de Goede)"
      
      * tag 'acpi-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPICA: Fix handling of buffer-size in acpi_ex_write_data_to_field()
      94f371cb
    • Linus Torvalds's avatar
      Merge tag 'pm-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 2f840689
      Linus Torvalds authored
      Pull power management fixes from Rafael Wysocki:
       "These fix two issues in the operating performance points (OPP)
        framework.
      
        Specifics:
      
         - Fix the handling of the "operating-points-v2" property to avoid
           failures if multiple phandles are present in it which is legitimate
           (Viresh Kumar).
      
         - Drop the unnecessary static initialization of the .owner field in
           the ti_opp_supply_driver structure (YueHaibing)"
      
      * tag 'pm-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        OPP: Fix parsing of multiple phandles in "operating-points-v2" property
        opp: ti-opp-supply: Fix platform_no_drv_owner.cocci warnings
      2f840689
    • Leon Romanovsky's avatar
      RDMA/mlx5: Initialize return variable in case pagefault was skipped · 7bca603a
      Leon Romanovsky authored
      Pagefaults occurred in non-ODP MR are completely valid events, so
      initialize return variable to 0.
      
      Fixes: 4d5422a3 ("IB/mlx5: Skip non-ODP MR when handling a page fault")
      Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      7bca603a
    • Kees Cook's avatar
      pstore/ram: Correctly calculate usable PRZ bytes · 89d328f6
      Kees Cook authored
      The actual number of bytes stored in a PRZ is smaller than the
      bytes requested by platform data, since there is a header on each
      PRZ. Additionally, if ECC is enabled, there are trailing bytes used
      as well. Normally this mismatch doesn't matter since PRZs are circular
      buffers and the leading "overflow" bytes are just thrown away. However, in
      the case of a compressed record, this rather badly corrupts the results.
      
      This corruption was visible with "ramoops.mem_size=204800 ramoops.ecc=1".
      Any stored crashes would not be uncompressable (producing a pstorefs
      "dmesg-*.enc.z" file), and triggering errors at boot:
      
        [    2.790759] pstore: crypto_comp_decompress failed, ret = -22!
      
      Backporting this depends on commit 70ad35db ("pstore: Convert console
      write to use ->write_buf")
      Reported-by: default avatarJoel Fernandes <joel@joelfernandes.org>
      Fixes: b0aad7a9 ("pstore: Add compression support to pstore")
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      Reviewed-by: default avatarJoel Fernandes (Google) <joel@joelfernandes.org>
      89d328f6
    • Rafael J. Wysocki's avatar
      Merge branch 'acpica-fixes' · c4f78426
      Rafael J. Wysocki authored
      * acpica-fixes:
        ACPICA: Fix handling of buffer-size in acpi_ex_write_data_to_field()
      c4f78426
    • Linus Torvalds's avatar
      Merge tag 'selinux-pr-20181129' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux · f92a2ebb
      Linus Torvalds authored
      Pull SELinux fix from Paul Moore:
       "One more SELinux fix for v4.20: add some missing netlink message to
        SELinux permission mappings. The netlink messages were added in v4.19,
        but unfortunately we didn't catch it then because the mechanism to
        catch these things was bypassed.
      
        In addition to adding the mappings, we're adding some comments to the
        code to hopefully prevent bypasses in the future"
      
      * tag 'selinux-pr-20181129' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
        selinux: add support for RTM_NEWCHAIN, RTM_DELCHAIN, and RTM_GETCHAIN
      f92a2ebb
    • Linus Torvalds's avatar
      Merge tag 's390-4.20-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · 3578f191
      Linus Torvalds authored
      Pull s390 updates from Martin Schwidefsky:
      
       - Add two missing kfree calls on error paths in the vfio-ccw code
      
       - Make sure that all data structures of a mediated vfio-ccw device are
         initialized before registering it
      
       - Fix a sparse warning in vfio-ccw
      
       - A followup patch for the pgtable_bytes accounting, the page table
         downgrade for compat processes missed a mm_dec_nr_pmds()
      
       - Reject sampling requests in the PMU init function of the CPU
         measurement counter facility
      
       - With the vfio AP driver an AP queue needs to be reset on every device
         probe as the alternative driver could have modified the device state
      
      * tag 's390-4.20-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        s390/mm: correct pgtable_bytes on page table downgrade
        s390/zcrypt: reinit ap queue state machine during device probe
        s390/cpum_cf: Reject request for sampling in event initialization
        s390/cio: Fix cleanup when unsupported IDA format is used
        s390/cio: Fix cleanup of pfn_array alloc failure
        vfio: ccw: Register mediated device once all structures are initialized
        s390/cio: make vfio_ccw_io_region static
      3578f191
    • Linus Torvalds's avatar
      Merge tag 'sound-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · b905e2db
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "As a usual pattern, we've got relatively large updates at rc5:
      
         - A fix for races in ALSA control user elements
      
         - ASoC DAPM regression due to component refactoring
      
         - A fix in error handling of ASoC iteration macro
      
         - ASoC Intel SST Skylake kconfig fix; a new Kconfig will appear as a
           consequence, but in the end it's a good cleanup
      
         - HD-audio and USB-audio quirks as always
      
         - Assort of ASoC driver fixes (pcm186x, Intel cht, rockchip, pcm3060,
           rsnd, omap, wm_adsp, qcom, sunxi, stm32)"
      
      * tag 'sound-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (34 commits)
        ALSA: usb-audio: Add vendor and product name for Dell WD19 Dock
        ALSA: hda/realtek - Support ALC300
        ALSA: hda/realtek - Add auto-mute quirk for HP Spectre x360 laptop
        ALSA: hda/realtek - fix the pop noise on headphone for lenovo laptops
        ALSA: control: Fix race between adding and removing a user element
        ALSA: sparc: Fix invalid snd_free_pages() at error path
        ALSA: wss: Fix invalid snd_free_pages() at error path
        ALSA: hda/realtek - fix headset mic detection for MSI MS-B171
        ALSA: hda: Add ASRock N68C-S UCC the power_save blacklist
        ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write
        ASoC: omap-dmic: Add pm_qos handling to avoid overruns with CPU_IDLE
        ASoC: omap-mcpdm: Add pm_qos handling to avoid under/overruns with CPU_IDLE
        ASoC: omap-mcbsp: Fix latency value calculation for pm_qos
        ASoC: acpi: fix: continue searching when machine is ignored
        ASoC: Intel: Skylake: fix Kconfigs, make HDaudio codec optional
        MAINTAINERS: add ASoC maintainers for sound dt-bindings
        ASoC: pcm186x: Fix device reset-registers trigger value
        ASoC: dapm: Recalculate audio map forcely when card instantiated
        ASoC: omap-abe-twl6040: Fix missing audio card caused by deferred probing
        ASoC: pcm3060: Rename output widgets
        ...
      b905e2db
    • Linus Torvalds's avatar
      Merge tag 'fixes_for_v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs · 9af33b57
      Linus Torvalds authored
      Pull ext2 and udf fixes from Jan Kara:
       "Three small ext2 and udf fixes"
      
      * tag 'fixes_for_v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
        ext2: fix potential use after free
        ext2: initialize opts.s_mount_opt as zero before using it
        udf: Allow mounting volumes with incorrect identification strings
      9af33b57