1. 31 Oct, 2017 1 commit
  2. 18 Oct, 2017 1 commit
  3. 17 Oct, 2017 5 commits
  4. 13 Oct, 2017 2 commits
  5. 12 Oct, 2017 11 commits
  6. 11 Oct, 2017 20 commits
    • Sakari Ailus's avatar
      ACPI: properties: Fix __acpi_node_get_property_reference() return codes · 51858a27
      Sakari Ailus authored
      Fix more return codes for device property: Align return codes of
      __acpi_node_get_property_reference().
      
      In particular, what was missed previously:
      
       -EPROTO could be returned in certain cases, now -EINVAL;
       -EINVAL was returned if the property was not found, now -ENOENT;
       -EINVAL was returned also if the index was higher than the number of
               entries in a package, now -ENOENT.
      Reported-by: default avatarHyungwoo Yang <hyungwoo.yang@intel.com>
      Fixes: 3e3119d3 (device property: Introduce fwnode_property_get_reference_args)
      Signed-off-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
      Tested-by: default avatarHyungwoo Yang <hyungwoo.yang@intel.com>
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      51858a27
    • Sakari Ailus's avatar
      ACPI: properties: Align return codes of __acpi_node_get_property_reference() · c343bc2c
      Sakari Ailus authored
      acpi_fwnode_get_reference_args(), the function implementing ACPI
      support for fwnode_property_get_reference_args(), returns directly
      error codes from __acpi_node_get_property_reference(). The latter
      uses different error codes than the OF implementation. In particular,
      the OF implementation uses -ENOENT to indicate that the property is
      not found, a reference entry is empty and there are no more
      references.
      
      Document and align the error codes for property for
      fwnode_property_get_reference_args() so that they match with
      of_parse_phandle_with_args().
      
      Fixes: 3e3119d3 (device property: Introduce fwnode_property_get_reference_args)
      Signed-off-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      c343bc2c
    • Linus Torvalds's avatar
      Merge tag 'rpmsg-v4.14-fixes' of git://github.com/andersson/remoteproc · ff5abbe7
      Linus Torvalds authored
      Pull rpmsg fixes from Bjorn Andersson:
       "This corrects two mistakes in the Qualcomm GLINK SMEM driver"
      
      * tag 'rpmsg-v4.14-fixes' of git://github.com/andersson/remoteproc:
        rpmsg: glink: Fix memory leak in qcom_glink_alloc_intent()
        rpmsg: glink: Unlock on error in qcom_glink_request_intent()
      ff5abbe7
    • Linus Torvalds's avatar
      Merge tag 'rproc-v4.14-fixes' of git://github.com/andersson/remoteproc · 9add7e3e
      Linus Torvalds authored
      Pull remoteproc fixes from Bjorn Andersson:
       "This fixes a couple of issues in the imx_rproc driver and corrects the
        Kconfig dependencies of the Qualcomm remoteproc drivers"
      
      * tag 'rproc-v4.14-fixes' of git://github.com/andersson/remoteproc:
        remoteproc: imx_rproc: fix return value check in imx_rproc_addr_init()
        remoteproc: qcom: fix RPMSG_QCOM_GLINK_SMEM dependencies
        remoteproc: imx_rproc: fix a couple off by one bugs
      9add7e3e
    • Wei Yongjun's avatar
      remoteproc: imx_rproc: fix return value check in imx_rproc_addr_init() · 68a39a3e
      Wei Yongjun authored
      In case of error, the function devm_ioremap() returns NULL pointer
      not ERR_PTR(). The IS_ERR() test in the return value check should
      be replaced with NULL test.
      Reviewed-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
      Signed-off-by: default avatarWei Yongjun <weiyongjun1@huawei.com>
      Signed-off-by: default avatarBjorn Andersson <bjorn.andersson@linaro.org>
      68a39a3e
    • Eric Sandeen's avatar
      xfs: handle error if xfs_btree_get_bufs fails · 93e8befc
      Eric Sandeen authored
      Jason reported that a corrupted filesystem failed to replay
      the log with a metadata block out of bounds warning:
      
      XFS (dm-2): _xfs_buf_find: Block out of range: block 0x80270fff8, EOFS 0x9c40000
      
      _xfs_buf_find() and xfs_btree_get_bufs() return NULL if
      that happens, and then when xfs_alloc_fix_freelist() calls
      xfs_trans_binval() on that NULL bp, we oops with:
      
      BUG: unable to handle kernel NULL pointer dereference at 00000000000000f8
      
      We don't handle _xfs_buf_find errors very well, every
      caller higher up the stack gets to guess at why it failed.
      But we should at least handle it somehow, so return
      EFSCORRUPTED here.
      Reported-by: default avatarJason L Tibbitts III <tibbs@math.uh.edu>
      Signed-off-by: default avatarEric Sandeen <sandeen@redhat.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      93e8befc
    • Brian Foster's avatar
      xfs: reinit btree pointer on attr tree inactivation walk · f35c5e10
      Brian Foster authored
      xfs_attr3_root_inactive() walks the attr fork tree to invalidate the
      associated blocks. xfs_attr3_node_inactive() recursively descends
      from internal blocks to leaf blocks, caching block address values
      along the way to revisit parent blocks, locate the next entry and
      descend down that branch of the tree.
      
      The code that attempts to reread the parent block is unsafe because
      it assumes that the local xfs_da_node_entry pointer remains valid
      after an xfs_trans_brelse() and re-read of the parent buffer. Under
      heavy memory pressure, it is possible that the buffer has been
      reclaimed and reallocated by the time the parent block is reread.
      This means that 'btree' can point to an invalid memory address, lead
      to a random/garbage value for child_fsb and cause the subsequent
      read of the attr fork to go off the rails and return a NULL buffer
      for an attr fork offset that is most likely not allocated.
      
      Note that this problem can be manufactured by setting
      XFS_ATTR_BTREE_REF to 0 to prevent LRU caching of attr buffers,
      creating a file with a multi-level attr fork and removing it to
      trigger inactivation.
      
      To address this problem, reinit the node/btree pointers to the
      parent buffer after it has been re-read. This ensures btree points
      to a valid record and allows the walk to proceed.
      Signed-off-by: default avatarBrian Foster <bfoster@redhat.com>
      Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      f35c5e10
    • Thomas Meyer's avatar
      xfs: Fix bool initialization/comparison · 749f24f3
      Thomas Meyer authored
      Bool initializations should use true and false. Bool tests don't need
      comparisons.
      Signed-off-by: default avatarThomas Meyer <thomas@m3y3r.de>
      Reviewed-by: default avatarBrian Foster <bfoster@redhat.com>
      Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      749f24f3
    • Dave Chinner's avatar
      xfs: don't change inode mode if ACL update fails · 67f2ffe3
      Dave Chinner authored
      If we get ENOSPC half way through setting the ACL, the inode mode
      can still be changed even though the ACL does not exist. Reorder the
      operation to only change the mode of the inode if the ACL is set
      correctly.
      
      Whilst this does not fix the problem with crash consistency (that requires
      attribute addition to be a deferred op) it does prevent ENOSPC and other
      non-fatal errors setting an xattr to be handled sanely.
      
      This fixes xfstests generic/449.
      Signed-Off-By: default avatarDave Chinner <dchinner@redhat.com>
      Reviewed-by: default avatarBrian Foster <bfoster@redhat.com>
      Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      67f2ffe3
    • Dave Chinner's avatar
      xfs: move more RT specific code under CONFIG_XFS_RT · bb9c2e54
      Dave Chinner authored
      Various utility functions and interfaces that iterate internal
      devices try to reference the realtime device even when RT support is
      not compiled into the kernel.
      
      Make sure this code is excluded from the CONFIG_XFS_RT=n build,
      and where appropriate stub functions to return fatal errors if
      they ever get called when RT support is not present.
      Signed-Off-By: default avatarDave Chinner <dchinner@redhat.com>
      Reviewed-by: default avatarBrian Foster <bfoster@redhat.com>
      Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      bb9c2e54
    • Dave Chinner's avatar
      xfs: Don't log uninitialised fields in inode structures · 20413e37
      Dave Chinner authored
      Prevent kmemcheck from throwing warnings about reading uninitialised
      memory when formatting inodes into the incore log buffer. There are
      several issues here - we don't always log all the fields in the
      inode log format item, and we never log the inode the
      di_next_unlinked field.
      
      In the case of the inode log format item, this is exacerbated
      by the old xfs_inode_log_format structure padding issue. Hence make
      the padded, 64 bit aligned version of the structure the one we always
      use for formatting the log and get rid of the 64 bit variant. This
      means we'll always log the 64-bit version and so recovery only needs
      to convert from the unpadded 32 bit version from older 32 bit
      kernels.
      Signed-Off-By: default avatarDave Chinner <dchinner@redhat.com>
      Tested-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Reviewed-by: default avatarBrian Foster <bfoster@redhat.com>
      Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      20413e37
    • Alexander Levin's avatar
      9p: set page uptodate when required in write_end() · 56ae414e
      Alexander Levin authored
      Commit 77469c3f prevented setting the page as uptodate when we wrote
      the right amount of data, fix that.
      
      Fixes: 77469c3f ("9p: saner ->write_end() on failing copy into non-uptodate page")
      Reviewed-by: default avatarJan Kara <jack@suse.com>
      Signed-off-by: default avatarAlexander Levin <alexander.levin@verizon.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      56ae414e
    • Linus Torvalds's avatar
      Merge tag 'gpio-v4.14-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · a0db2890
      Linus Torvalds authored
      Pull GPIO fixes from Linus Walleij:
       "Here are some smallish GPIO fixes for v4.14. Like with pin control:
        some build/Kconfig noise and one serious bug in a specific driver.
      
         - Three Kconfig/build warning fixes
      
         - A fix for lost edge IRQs in the OMAP driver"
      
      * tag 'gpio-v4.14-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpio: omap: Fix lost edge interrupts
        gpio: omap: omap_gpio_show_rev is not __init
        gpio: acpi: work around false-positive -Wstring-overflow warning
        gpio: thunderx: select IRQ_DOMAIN_HIERARCHY instead of depends on
      a0db2890
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-v4.14-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl · cc74613b
      Linus Torvalds authored
      Pull pin control fixes from Linus Walleij:
       "Two small things and a slightly larger thing in the Intel Cherryview.
      
         - Fix two build problems
      
         - Fix a regression on the Intel Cherryview interrupt path"
      
      * tag 'pinctrl-v4.14-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinctrl: cherryview: fix issues caused by dynamic gpio irqs mapping
        pinctrl/amd: Fix build dependency on pinmux code
        pinctrl: bcm2835: fix build warning in bcm2835_gpio_irq_handle_bank
      cc74613b
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · ce386181
      Linus Torvalds authored
      Pull vfs fixes from Al Viro:
       "Fairly old DIO bug caught by Andreas (3.10+) and several slightly
        younger blk_rq_map_user_iov() bugs, both on map and copy codepaths
        (Vitaly and me)"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        bio_copy_user_iov(): don't ignore ->iov_offset
        more bio_map_user_iov() leak fixes
        fix unbalanced page refcounting in bio_map_user_iov
        direct-io: Prevent NULL pointer access in submit_page_section
      ce386181
    • Takashi Iwai's avatar
      ALSA: caiaq: Fix stray URB at probe error path · 99fee508
      Takashi Iwai authored
      caiaq driver doesn't kill the URB properly at its error path during
      the probe, which may lead to a use-after-free error later.  This patch
      addresses it.
      Reported-by: default avatarJohan Hovold <johan@kernel.org>
      Reviewed-by: default avatarJohan Hovold <johan@kernel.org>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      99fee508
    • Alex Manoussakis's avatar
      HID: hid-elecom: extend to fix descriptor for HUGE trackball · a0933a45
      Alex Manoussakis authored
      In addition to DEFT, Elecom introduced a larger trackball called HUGE, in
      both wired (M-HT1URBK) and wireless (M-HT1DRBK) versions. It has the same
      buttons and behavior as the DEFT. This patch adds the two relevant USB IDs
      to enable operation of the three Fn buttons on the top of the device.
      
      Cc: Diego Elio Petteno <flameeyes@flameeyes.eu>
      Signed-off-by: default avatarAlex Manoussakis <amanou@gnu.org>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      a0933a45
    • Jaejoong Kim's avatar
      HID: usbhid: fix out-of-bounds bug · f043bfc9
      Jaejoong Kim authored
      The hid descriptor identifies the length and type of subordinate
      descriptors for a device. If the received hid descriptor is smaller than
      the size of the struct hid_descriptor, it is possible to cause
      out-of-bounds.
      
      In addition, if bNumDescriptors of the hid descriptor have an incorrect
      value, this can also cause out-of-bounds while approaching hdesc->desc[n].
      
      So check the size of hid descriptor and bNumDescriptors.
      
      	BUG: KASAN: slab-out-of-bounds in usbhid_parse+0x9b1/0xa20
      	Read of size 1 at addr ffff88006c5f8edf by task kworker/1:2/1261
      
      	CPU: 1 PID: 1261 Comm: kworker/1:2 Not tainted
      	4.14.0-rc1-42251-gebb2c243 #169
      	Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
      	Workqueue: usb_hub_wq hub_event
      	Call Trace:
      	__dump_stack lib/dump_stack.c:16
      	dump_stack+0x292/0x395 lib/dump_stack.c:52
      	print_address_description+0x78/0x280 mm/kasan/report.c:252
      	kasan_report_error mm/kasan/report.c:351
      	kasan_report+0x22f/0x340 mm/kasan/report.c:409
      	__asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:427
      	usbhid_parse+0x9b1/0xa20 drivers/hid/usbhid/hid-core.c:1004
      	hid_add_device+0x16b/0xb30 drivers/hid/hid-core.c:2944
      	usbhid_probe+0xc28/0x1100 drivers/hid/usbhid/hid-core.c:1369
      	usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361
      	really_probe drivers/base/dd.c:413
      	driver_probe_device+0x610/0xa00 drivers/base/dd.c:557
      	__device_attach_driver+0x230/0x290 drivers/base/dd.c:653
      	bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463
      	__device_attach+0x26e/0x3d0 drivers/base/dd.c:710
      	device_initial_probe+0x1f/0x30 drivers/base/dd.c:757
      	bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523
      	device_add+0xd0b/0x1660 drivers/base/core.c:1835
      	usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932
      	generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174
      	usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266
      	really_probe drivers/base/dd.c:413
      	driver_probe_device+0x610/0xa00 drivers/base/dd.c:557
      	__device_attach_driver+0x230/0x290 drivers/base/dd.c:653
      	bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463
      	__device_attach+0x26e/0x3d0 drivers/base/dd.c:710
      	device_initial_probe+0x1f/0x30 drivers/base/dd.c:757
      	bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523
      	device_add+0xd0b/0x1660 drivers/base/core.c:1835
      	usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457
      	hub_port_connect drivers/usb/core/hub.c:4903
      	hub_port_connect_change drivers/usb/core/hub.c:5009
      	port_event drivers/usb/core/hub.c:5115
      	hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195
      	process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119
      	worker_thread+0x221/0x1850 kernel/workqueue.c:2253
      	kthread+0x3a1/0x470 kernel/kthread.c:231
      	ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
      
      Cc: stable@vger.kernel.org
      Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Signed-off-by: default avatarJaejoong Kim <climbbb.kim@gmail.com>
      Tested-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      f043bfc9
    • Joe Lawrence's avatar
      livepatch: unpatch all klp_objects if klp_module_coming fails · ef8daf8e
      Joe Lawrence authored
      When an incoming module is considered for livepatching by
      klp_module_coming(), it iterates over multiple patches and multiple
      kernel objects in this order:
      
      	list_for_each_entry(patch, &klp_patches, list) {
      		klp_for_each_object(patch, obj) {
      
      which means that if one of the kernel objects fails to patch,
      klp_module_coming()'s error path needs to unpatch and cleanup any kernel
      objects that were already patched by a previous patch.
      Reported-by: default avatarMiroslav Benes <mbenes@suse.cz>
      Suggested-by: default avatarPetr Mladek <pmladek@suse.com>
      Signed-off-by: default avatarJoe Lawrence <joe.lawrence@redhat.com>
      Acked-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
      Reviewed-by: default avatarPetr Mladek <pmladek@suse.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      ef8daf8e
    • Takashi Iwai's avatar
      ALSA: seq: Fix use-after-free at creating a port · 71105998
      Takashi Iwai authored
      There is a potential race window opened at creating and deleting a
      port via ioctl, as spotted by fuzzing.  snd_seq_create_port() creates
      a port object and returns its pointer, but it doesn't take the
      refcount, thus it can be deleted immediately by another thread.
      Meanwhile, snd_seq_ioctl_create_port() still calls the function
      snd_seq_system_client_ev_port_start() with the created port object
      that is being deleted, and this triggers use-after-free like:
      
       BUG: KASAN: use-after-free in snd_seq_ioctl_create_port+0x504/0x630 [snd_seq] at addr ffff8801f2241cb1
       =============================================================================
       BUG kmalloc-512 (Tainted: G    B          ): kasan: bad access detected
       -----------------------------------------------------------------------------
       INFO: Allocated in snd_seq_create_port+0x94/0x9b0 [snd_seq] age=1 cpu=3 pid=4511
       	___slab_alloc+0x425/0x460
       	__slab_alloc+0x20/0x40
        	kmem_cache_alloc_trace+0x150/0x190
      	snd_seq_create_port+0x94/0x9b0 [snd_seq]
      	snd_seq_ioctl_create_port+0xd1/0x630 [snd_seq]
       	snd_seq_do_ioctl+0x11c/0x190 [snd_seq]
       	snd_seq_ioctl+0x40/0x80 [snd_seq]
       	do_vfs_ioctl+0x54b/0xda0
       	SyS_ioctl+0x79/0x90
       	entry_SYSCALL_64_fastpath+0x16/0x75
       INFO: Freed in port_delete+0x136/0x1a0 [snd_seq] age=1 cpu=2 pid=4717
       	__slab_free+0x204/0x310
       	kfree+0x15f/0x180
       	port_delete+0x136/0x1a0 [snd_seq]
       	snd_seq_delete_port+0x235/0x350 [snd_seq]
       	snd_seq_ioctl_delete_port+0xc8/0x180 [snd_seq]
       	snd_seq_do_ioctl+0x11c/0x190 [snd_seq]
       	snd_seq_ioctl+0x40/0x80 [snd_seq]
       	do_vfs_ioctl+0x54b/0xda0
       	SyS_ioctl+0x79/0x90
       	entry_SYSCALL_64_fastpath+0x16/0x75
       Call Trace:
        [<ffffffff81b03781>] dump_stack+0x63/0x82
        [<ffffffff81531b3b>] print_trailer+0xfb/0x160
        [<ffffffff81536db4>] object_err+0x34/0x40
        [<ffffffff815392d3>] kasan_report.part.2+0x223/0x520
        [<ffffffffa07aadf4>] ? snd_seq_ioctl_create_port+0x504/0x630 [snd_seq]
        [<ffffffff815395fe>] __asan_report_load1_noabort+0x2e/0x30
        [<ffffffffa07aadf4>] snd_seq_ioctl_create_port+0x504/0x630 [snd_seq]
        [<ffffffffa07aa8f0>] ? snd_seq_ioctl_delete_port+0x180/0x180 [snd_seq]
        [<ffffffff8136be50>] ? taskstats_exit+0xbc0/0xbc0
        [<ffffffffa07abc5c>] snd_seq_do_ioctl+0x11c/0x190 [snd_seq]
        [<ffffffffa07abd10>] snd_seq_ioctl+0x40/0x80 [snd_seq]
        [<ffffffff8136d433>] ? acct_account_cputime+0x63/0x80
        [<ffffffff815b515b>] do_vfs_ioctl+0x54b/0xda0
        .....
      
      We may fix this in a few different ways, and in this patch, it's fixed
      simply by taking the refcount properly at snd_seq_create_port() and
      letting the caller unref the object after use.  Also, there is another
      potential use-after-free by sprintf() call in snd_seq_create_port(),
      and this is moved inside the lock.
      
      This fix covers CVE-2017-15265.
      Reported-and-tested-by: default avatarMichael23 Yu <ycqzsy@gmail.com>
      Suggested-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      71105998