1. 02 May, 2019 4 commits
    • Arnaldo Carvalho de Melo's avatar
      tools uapi x86: Sync vmx.h with the kernel · 24e45b49
      Arnaldo Carvalho de Melo authored
      To pick up the changes from:
      
        2b27924b ("KVM: nVMX: always use early vmcs check when EPT is disabled")
      
      That causes this object in the tools/perf build process to be rebuilt:
      
        CC       /tmp/build/perf/arch/x86/util/kvm-stat.o
      
      But it isn't using VMX_ABORT_ prefixed constants, so no change in
      behaviour.
      
      This silences this perf build warning:
      
        Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/vmx.h' differs from latest version at 'arch/x86/include/uapi/asm/vmx.h'
        diff -u tools/arch/x86/include/uapi/asm/vmx.h arch/x86/include/uapi/asm/vmx.h
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Link: https://lkml.kernel.org/n/tip-bjbo3zc0r8i8oa0udpvftya6@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      24e45b49
    • Bo YU's avatar
      perf bpf: Return value with unlocking in perf_env__find_btf() · 2e712675
      Bo YU authored
      In perf_env__find_btf(), we're returning without unlocking
      "env->bpf_progs.lock". There may be cause lockdep issue.
      
      Detected by CoversityScan, CID# 1444762:(program hangs(LOCK))
      Signed-off-by: default avatarBo YU <tsu.yubo@gmail.com>
      Acked-by: default avatarJiri Olsa <jolsa@kernel.org>
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Alexei Starovoitov <ast@kernel.org>
      Cc: Daniel Borkmann <daniel@iogearbox.net>
      Cc: Martin KaFai Lau <kafai@fb.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Song Liu <songliubraving@fb.com>
      Cc: Yonghong Song <yhs@fb.com>
      Cc: bpf@vger.kernel.org
      Cc: netdev@vger.kernel.org
      Fixes: 2db7b1e0: (perf bpf: Return NULL when RB tree lookup fails in perf_env__find_btf())
      Link: http://lkml.kernel.org/r/20190422080138.10088-1-tsu.yubo@gmail.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      2e712675
    • Kim Phillips's avatar
      MAINTAINERS: Include vendor specific files under arch/*/events/* · 1804569d
      Kim Phillips authored
      Add an explicit subdirectory specification for arch/x86/events/amd to
      the MAINTAINERS file, to distinguish it from its parent. This will
      produce the correct set of maintainers for the files found therein.
      Signed-off-by: default avatarKim Phillips <kim.phillips@amd.com>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Gary Hook <Gary.Hook@amd.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Janakarajan Natarajan <Janakarajan.Natarajan@amd.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Martin Liška <mliska@suse.cz>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Pu Wen <puwen@hygon.cn>
      Cc: Stephane Eranian <eranian@google.com>
      Cc: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Thomas Lendacky <Thomas.Lendacky@amd.com>
      Cc: Vince Weaver <vincent.weaver@maine.edu>
      Cc: linux-kernel@vger.kernel.org
      Fixes: 39b0332a ("perf/x86: Move perf_event_amd.c ........... => x86/events/amd/core.c")
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      1804569d
    • Kim Phillips's avatar
      perf/x86/amd: Update generic hardware cache events for Family 17h · 0e3b74e2
      Kim Phillips authored
      Add a new amd_hw_cache_event_ids_f17h assignment structure set
      for AMD families 17h and above, since a lot has changed.  Specifically:
      
      L1 Data Cache
      
      The data cache access counter remains the same on Family 17h.
      
      For DC misses, PMCx041's definition changes with Family 17h,
      so instead we use the L2 cache accesses from L1 data cache
      misses counter (PMCx060,umask=0xc8).
      
      For DC hardware prefetch events, Family 17h breaks compatibility
      for PMCx067 "Data Prefetcher", so instead, we use PMCx05a "Hardware
      Prefetch DC Fills."
      
      L1 Instruction Cache
      
      PMCs 0x80 and 0x81 (32-byte IC fetches and misses) are backward
      compatible on Family 17h.
      
      For prefetches, we remove the erroneous PMCx04B assignment which
      counts how many software data cache prefetch load instructions were
      dispatched.
      
      LL - Last Level Cache
      
      Removing PMCs 7D, 7E, and 7F assignments, as they do not exist
      on Family 17h, where the last level cache is L3.  L3 counters
      can be accessed using the existing AMD Uncore driver.
      
      Data TLB
      
      On Intel machines, data TLB accesses ("dTLB-loads") are assigned
      to counters that count load/store instructions retired.  This
      is inconsistent with instruction TLB accesses, where Intel
      implementations report iTLB misses that hit in the STLB.
      
      Ideally, dTLB-loads would count higher level dTLB misses that hit
      in lower level TLBs, and dTLB-load-misses would report those
      that also missed in those lower-level TLBs, therefore causing
      a page table walk.  That would be consistent with instruction
      TLB operation, remove the redundancy between dTLB-loads and
      L1-dcache-loads, and prevent perf from producing artificially
      low percentage ratios, i.e. the "0.01%" below:
      
              42,550,869      L1-dcache-loads
              41,591,860      dTLB-loads
                   4,802      dTLB-load-misses          #    0.01% of all dTLB cache hits
               7,283,682      L1-dcache-stores
               7,912,392      dTLB-stores
                     310      dTLB-store-misses
      
      On AMD Families prior to 17h, the "Data Cache Accesses" counter is
      used, which is slightly better than load/store instructions retired,
      but still counts in terms of individual load/store operations
      instead of TLB operations.
      
      So, for AMD Families 17h and higher, this patch assigns "dTLB-loads"
      to a counter for L1 dTLB misses that hit in the L2 dTLB, and
      "dTLB-load-misses" to a counter for L1 DTLB misses that caused
      L2 DTLB misses and therefore also caused page table walks.  This
      results in a much more accurate view of data TLB performance:
      
              60,961,781      L1-dcache-loads
                   4,601      dTLB-loads
                     963      dTLB-load-misses          #   20.93% of all dTLB cache hits
      
      Note that for all AMD families, data loads and stores are combined
      in a single accesses counter, so no 'L1-dcache-stores' are reported
      separately, and stores are counted with loads in 'L1-dcache-loads'.
      
      Also note that the "% of all dTLB cache hits" string is misleading
      because (a) "dTLB cache": although TLBs can be considered caches for
      page tables, in this context, it can be misinterpreted as data cache
      hits because the figures are similar (at least on Intel), and (b) not
      all those loads (technically accesses) technically "hit" at that
      hardware level.  "% of all dTLB accesses" would be more clear/accurate.
      
      Instruction TLB
      
      On Intel machines, 'iTLB-loads' measure iTLB misses that hit in the
      STLB, and 'iTLB-load-misses' measure iTLB misses that also missed in
      the STLB and completed a page table walk.
      
      For AMD Family 17h and above, for 'iTLB-loads' we replace the
      erroneous instruction cache fetches counter with PMCx084
      "L1 ITLB Miss, L2 ITLB Hit".
      
      For 'iTLB-load-misses' we still use PMCx085 "L1 ITLB Miss,
      L2 ITLB Miss", but set a 0xff umask because without it the event
      does not get counted.
      
      Branch Predictor (BPU)
      
      PMCs 0xc2 and 0xc3 continue to be valid across all AMD Families.
      
      Node Level Events
      
      Family 17h does not have a PMCx0e9 counter, and corresponding counters
      have not been made available publicly, so for now, we mark them as
      unsupported for Families 17h and above.
      
      Reference:
      
        "Open-Source Register Reference For AMD Family 17h Processors Models 00h-2Fh"
        Released 7/17/2018, Publication #56255, Revision 3.03:
        https://www.amd.com/system/files/TechDocs/56255_OSRR.pdf
      
      [ mingo: tidied up the line breaks. ]
      Signed-off-by: default avatarKim Phillips <kim.phillips@amd.com>
      Cc: <stable@vger.kernel.org> # v4.9+
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Janakarajan Natarajan <Janakarajan.Natarajan@amd.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Martin Liška <mliska@suse.cz>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Pu Wen <puwen@hygon.cn>
      Cc: Stephane Eranian <eranian@google.com>
      Cc: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Thomas Lendacky <Thomas.Lendacky@amd.com>
      Cc: Vince Weaver <vincent.weaver@maine.edu>
      Cc: linux-kernel@vger.kernel.org
      Cc: linux-perf-users@vger.kernel.org
      Fixes: e40ed154 ("perf/x86: Add perf support for AMD family-17h processors")
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      0e3b74e2
  2. 01 May, 2019 7 commits
  3. 30 Apr, 2019 4 commits
  4. 29 Apr, 2019 5 commits
    • Linus Torvalds's avatar
      Merge tag 'seccomp-v5.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux · 83a50840
      Linus Torvalds authored
      Pull seccomp fixes from Kees Cook:
       "Syzbot found a use-after-free bug in seccomp due to flags that should
        not be allowed to be used together.
      
        Tycho fixed this, I updated the self-tests, and the syzkaller PoC has
        been running for several days without triggering KASan (before this
        fix, it would reproduce). These patches have also been in -next for
        almost a week, just to be sure.
      
         - Add logic for making some seccomp flags exclusive (Tycho)
      
         - Update selftests for exclusivity testing (Kees)"
      
      * tag 'seccomp-v5.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
        seccomp: Make NEW_LISTENER and TSYNC flags exclusive
        selftests/seccomp: Prepare for exclusive seccomp flags
      83a50840
    • Linus Torvalds's avatar
      x86: make ZERO_PAGE() at least parse its argument · 80871482
      Linus Torvalds authored
      This doesn't really do anything, but at least we now parse teh
      ZERO_PAGE() address argument so that we'll catch the most obvious errors
      in usage next time they'll happen.
      
      See commit 6a5c5d26 ("rdma: fix build errors on s390 and MIPS due to
      bad ZERO_PAGE use") what happens when we don't have any use of the macro
      argument at all.
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      80871482
    • Linus Torvalds's avatar
      rdma: fix build errors on s390 and MIPS due to bad ZERO_PAGE use · 6a5c5d26
      Linus Torvalds authored
      The parameter to ZERO_PAGE() was wrong, but since all architectures
      except for MIPS and s390 ignore it, it wasn't noticed until 0-day
      reported the build error.
      
      Fixes: 67f269b3 ("RDMA/ucontext: Fix regression with disassociate")
      Cc: stable@vger.kernel.org
      Cc: Andrea Arcangeli <aarcange@redhat.com>
      Cc: Leon Romanovsky <leonro@mellanox.com>
      Cc: Jason Gunthorpe <jgg@mellanox.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6a5c5d26
    • Paulo Alcantara's avatar
      selinux: use kernel linux/socket.h for genheaders and mdp · dfbd199a
      Paulo Alcantara authored
      When compiling genheaders and mdp from a newer host kernel, the
      following error happens:
      
          In file included from scripts/selinux/genheaders/genheaders.c:18:
          ./security/selinux/include/classmap.h:238:2: error: #error New
          address family defined, please update secclass_map.  #error New
          address family defined, please update secclass_map.  ^~~~~
          make[3]: *** [scripts/Makefile.host:107:
          scripts/selinux/genheaders/genheaders] Error 1 make[2]: ***
          [scripts/Makefile.build:599: scripts/selinux/genheaders] Error 2
          make[1]: *** [scripts/Makefile.build:599: scripts/selinux] Error 2
          make[1]: *** Waiting for unfinished jobs....
      
      Instead of relying on the host definition, include linux/socket.h in
      classmap.h to have PF_MAX.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarPaulo Alcantara <paulo@paulo.ac>
      Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
      [PM: manually merge in mdp.c, subject line tweaks]
      Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
      dfbd199a
    • Linus Torvalds's avatar
      Linux 5.1-rc7 · 37624b58
      Linus Torvalds authored
      37624b58
  5. 28 Apr, 2019 6 commits
    • Jan Kara's avatar
      fsnotify: Fix NULL ptr deref in fanotify_get_fsid() · b1da6a51
      Jan Kara authored
      fanotify_get_fsid() is reading mark->connector->fsid under srcu. It can
      happen that it sees mark not fully initialized or mark that is already
      detached from the object list. In these cases mark->connector
      can be NULL leading to NULL ptr dereference. Fix the problem by
      being careful when reading mark->connector and check it for being NULL.
      Also use WRITE_ONCE when writing the mark just to prevent compiler from
      doing something stupid.
      
      Reported-by: syzbot+15927486a4f1bfcbaf91@syzkaller.appspotmail.com
      Fixes: 77115225 ("fanotify: cache fsid in fsnotify_mark_connector")
      Signed-off-by: default avatarJan Kara <jack@suse.cz>
      b1da6a51
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm · 9520b532
      Linus Torvalds authored
      Pull ARM fixes from Russell King:
       "A small number of ARM fixes
      
         - Fix function tracer and unwinder dependencies so that we don't end
           up building kernels that will crash
      
         - Fix ARMv7M nommu initialisation (missing register initialisation)
      
         - Fix EFI decompressor entry (ensuring barrier instructions are
           enabled prior to use)"
      
      * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm:
        ARM: 8857/1: efi: enable CP15 DMB instructions before cleaning the cache
        ARM: 8856/1: NOMMU: Fix CCR register faulty initialization when MPU is disabled
        ARM: fix function graph tracer and unwinder dependencies
      9520b532
    • Linus Torvalds's avatar
      Merge tag 'powerpc-5.1-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 0d82044e
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
       "A one-liner to make our Radix MMU support depend on HUGETLB_PAGE. We
        use some of the hugetlb inlines (eg. pud_huge()) when operating on the
        linear mapping and if they're compiled into empty wrappers we can
        corrupt memory.
      
        Then two fixes to our VFIO IOMMU code. The first is not a regression
        but fixes the locking to avoid a user-triggerable deadlock.
      
        The second does fix a regression since rc1, and depends on the first
        fix. It makes it possible to run guests with large amounts of memory
        again (~256GB).
      
        Thanks to Alexey Kardashevskiy"
      
      * tag 'powerpc-5.1-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/mm_iommu: Allow pinning large regions
        powerpc/mm_iommu: Fix potential deadlock
        powerpc/mm/radix: Make Radix require HUGETLB_PAGE
      0d82044e
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20190428' of git://git.kernel.dk/linux-block · 975a0f40
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A set of io_uring fixes that should go into this release. In
        particular, this contains:
      
         - The mutex lock vs ctx ref count fix (me)
      
         - Removal of a dead variable (me)
      
         - Two race fixes (Stefan)
      
         - Ring head/tail condition fix for poll full SQ detection (Stefan)"
      
      * tag 'for-linus-20190428' of git://git.kernel.dk/linux-block:
        io_uring: remove 'state' argument from io_{read,write} path
        io_uring: fix poll full SQ detection
        io_uring: fix race condition when sq threads goes sleeping
        io_uring: fix race condition reading SQ entries
        io_uring: fail io_uring_register(2) on a dying io_uring instance
      975a0f40
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · 14f974d7
      Linus Torvalds authored
      Pull rdma fixes from Jason Gunthorpe:
       "One core bug fix and a few driver ones
      
         - FRWR memory registration for hfi1/qib didn't work with with some
           iovas causing a NFSoRDMA failure regression due to a fix in the NFS
           side
      
         - A command flow error in mlx5 allowed user space to send a corrupt
           command (and also smash the kernel stack we've since learned)
      
         - Fix a regression and some bugs with device hot unplug that was
           discovered while reviewing Andrea's patches
      
         - hns has a failure if the user asks for certain QP configurations"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        RDMA/hns: Bugfix for mapping user db
        RDMA/ucontext: Fix regression with disassociate
        RDMA/mlx5: Use rdma_user_map_io for mapping BAR pages
        RDMA/mlx5: Do not allow the user to write to the clock page
        IB/mlx5: Fix scatter to CQE in DCT QP creation
        IB/rdmavt: Fix frwr memory registration
      14f974d7
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-fix-5.1-rc7' of git://git.infradead.org/users/vkoul/slave-dma · 72a6e35d
      Linus Torvalds authored
      Pull dmaengine fixes from Vinod Koul:
      
       - fix for wrong register use in mediatek driver
      
       - fix in sh driver for glitch is tx_status and treating 0 a valid
         residue for cyclic
      
       - fix in bcm driver for using right memory allocation flag
      
      * tag 'dmaengine-fix-5.1-rc7' of git://git.infradead.org/users/vkoul/slave-dma:
        dmaengine: mediatek-cqdma: fix wrong register usage in mtk_cqdma_start
        dmaengine: sh: rcar-dmac: Fix glitch in dmaengine_tx_status
        dmaengine: sh: rcar-dmac: With cyclic DMA residue 0 is valid
        dmaengine: bcm2835: Avoid GFP_KERNEL in device_prep_slave_sg
      72a6e35d
  6. 27 Apr, 2019 7 commits
  7. 26 Apr, 2019 7 commits
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · 857e17c2
      Linus Torvalds authored
      Pull arm64 fixes from Catalin Marinas:
      
       - keep the tail of an unaligned initrd reserved
      
       - adjust ftrace_make_call() to deal with the relative nature of PLTs
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64/module: ftrace: deal with place relative nature of PLTs
        arm64: mm: Ensure tail of unaligned initrd is reserved
      857e17c2
    • Linus Torvalds's avatar
      Merge tag 'trace-v5.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · e9e1a2e7
      Linus Torvalds authored
      Pull tracing fixes from Steven Rostedt:
       "Three tracing fixes:
      
         - Use "nosteal" for ring buffer splice pages
      
         - Memory leak fix in error path of trace_pid_write()
      
         - Fix preempt_enable_no_resched() (use preempt_enable()) in ring
           buffer code"
      
      * tag 'trace-v5.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        trace: Fix preempt_enable_no_resched() abuse
        tracing: Fix a memory leak by early error exit in trace_pid_write()
        tracing: Fix buffer_ref pipe ops
      e9e1a2e7
    • Linus Torvalds's avatar
      Merge tag 'gpio-v5.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · 29279d21
      Linus Torvalds authored
      Pull GPIO fixes from Linus Walleij:
       "Not much to say about them, regular fixes:
      
         - Fix a bug on the errorpath of gpiochip_add_data_with_key()
      
         - IRQ type setting on the spreadtrum GPIO driver"
      
      * tag 'gpio-v5.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpio: Fix gpiochip_add_data_with_key() error path
        gpio: eic: sprd: Fix incorrect irq type setting for the sync EIC
      29279d21
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2019-04-26' of git://anongit.freedesktop.org/drm/drm · 4e40f0f3
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Regular drm fixes, nothing too outstanding, I'm guessing Easter was
        slowing people down.
      
        i915:
         - FEC enable fix
         - BXT display lanes fix
      
        ttm:
         - fix reinit for reloading drivers regression
      
        imx:
         - DP CSC fix
      
        sun4i:
         - module unload/load fix
      
        vc4:
         - memory leak fix
         - compile fix
      
        dw-hdmi:
         - rockchip scdc overflow fix
      
        sched:
         - docs fix
      
        vmwgfx:
         - dma api layering fix"
      
      * tag 'drm-fixes-2019-04-26' of git://anongit.freedesktop.org/drm/drm:
        drm/bridge: dw-hdmi: fix SCDC configuration for ddc-i2c-bus
        drm/vmwgfx: Fix dma API layer violation
        drm/vc4: Fix compilation error reported by kbuild test bot
        drm/sun4i: Unbind components before releasing DRM and memory
        drm/vc4: Fix memory leak during gpu reset.
        drm/sched: Fix description of drm_sched_stop
        drm/imx: don't skip DP channel disable for background plane
        gpu: ipu-v3: dp: fix CSC handling
        drm/ttm: fix re-init of global structures
        drm/sun4i: Fix component unbinding and component master deletion
        drm/sun4i: Set device driver data at bind time for use in unbind
        drm/sun4i: Add missing drm_atomic_helper_shutdown at driver unbind
        drm/i915: Restore correct bxt_ddi_phy_calc_lane_lat_optim_mask() calculation
        drm/i915: Do not enable FEC without DSC
        drm: bridge: dw-hdmi: Fix overflow workaround for Rockchip SoCs
      4e40f0f3
    • Linus Torvalds's avatar
      Merge tag 'for-5.1-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · d0473f97
      Linus Torvalds authored
      Pull btrfs fix from David Sterba:
       "One patch to fix a crash in io submission path, due to memory
        allocation errors.
      
        In short, the multipage bio work that landed in 5.1 caused larger bios
        that in turn require larger temporary memory for checksums. The patch
        is a workaround, we're going to rework the allocation so it does not
        require the vmalloc fallback.
      
        It took a while to identify that it's caused by patches in 5.1 and not
        a patchset that did some changes in error handling in the code. I've
        tested it on various memory/cpu combinations, it could hit OOM but
        does not crash.
      
        The timestamp of the patch is less than a day due to updates in the
        changelog, tests were running meanwhile"
      
      * tag 'for-5.1-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        btrfs: Switch memory allocations in async csum calculation path to kvmalloc
      d0473f97
    • Linus Torvalds's avatar
      Merge tag '5.1-rc6-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 · 58130235
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
       "Three small SMB3 fixes (all for stable as well): two leaks and a
        rename bug"
      
      * tag '5.1-rc6-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: fix page reference leak with readv/writev
        cifs: do not attempt cifs operation on smb2+ rename error
        cifs: fix memory leak in SMB2_read
      58130235
    • YueHaibing's avatar
      fs/proc/proc_sysctl.c: Fix a NULL pointer dereference · 89189557
      YueHaibing authored
      Syzkaller report this:
      
        sysctl could not get directory: /net//bridge -12
        kasan: CONFIG_KASAN_INLINE enabled
        kasan: GPF could be caused by NULL-ptr deref or user memory access
        general protection fault: 0000 [#1] SMP KASAN PTI
        CPU: 1 PID: 7027 Comm: syz-executor.0 Tainted: G         C        5.1.0-rc3+ #8
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
        RIP: 0010:__write_once_size include/linux/compiler.h:220 [inline]
        RIP: 0010:__rb_change_child include/linux/rbtree_augmented.h:144 [inline]
        RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:186 [inline]
        RIP: 0010:rb_erase+0x5f4/0x19f0 lib/rbtree.c:459
        Code: 00 0f 85 60 13 00 00 48 89 1a 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 89 f2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 75 0c 00 00 4d 85 ed 4c 89 2e 74 ce 4c 89 ea 48
        RSP: 0018:ffff8881bb507778 EFLAGS: 00010206
        RAX: dffffc0000000000 RBX: ffff8881f224b5b8 RCX: ffffffff818f3f6a
        RDX: 000000000000000a RSI: 0000000000000050 RDI: ffff8881f224b568
        RBP: 0000000000000000 R08: ffffed10376a0ef4 R09: ffffed10376a0ef4
        R10: 0000000000000001 R11: ffffed10376a0ef4 R12: ffff8881f224b558
        R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
        FS:  00007f3e7ce13700(0000) GS:ffff8881f7300000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 00007fd60fbe9398 CR3: 00000001cb55c001 CR4: 00000000007606e0
        DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
        DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
        PKRU: 55555554
        Call Trace:
         erase_entry fs/proc/proc_sysctl.c:178 [inline]
         erase_header+0xe3/0x160 fs/proc/proc_sysctl.c:207
         start_unregistering fs/proc/proc_sysctl.c:331 [inline]
         drop_sysctl_table+0x558/0x880 fs/proc/proc_sysctl.c:1631
         get_subdir fs/proc/proc_sysctl.c:1022 [inline]
         __register_sysctl_table+0xd65/0x1090 fs/proc/proc_sysctl.c:1335
         br_netfilter_init+0x68/0x1000 [br_netfilter]
         do_one_initcall+0xbc/0x47d init/main.c:901
         do_init_module+0x1b5/0x547 kernel/module.c:3456
         load_module+0x6405/0x8c10 kernel/module.c:3804
         __do_sys_finit_module+0x162/0x190 kernel/module.c:3898
         do_syscall_64+0x9f/0x450 arch/x86/entry/common.c:290
         entry_SYSCALL_64_after_hwframe+0x49/0xbe
        Modules linked in: br_netfilter(+) backlight comedi(C) hid_sensor_hub max3100 ti_ads8688 udc_core fddi snd_mona leds_gpio rc_streamzap mtd pata_netcell nf_log_common rc_winfast udp_tunnel snd_usbmidi_lib snd_usb_toneport snd_usb_line6 snd_rawmidi snd_seq_device snd_hwdep videobuf2_v4l2 videobuf2_common videodev media videobuf2_vmalloc videobuf2_memops rc_gadmei_rm008z 8250_of smm665 hid_tmff hid_saitek hwmon_vid rc_ati_tv_wonder_hd_600 rc_core pata_pdc202xx_old dn_rtmsg as3722 ad714x_i2c ad714x snd_soc_cs4265 hid_kensington panel_ilitek_ili9322 drm drm_panel_orientation_quirks ipack cdc_phonet usbcore phonet hid_jabra hid extcon_arizona can_dev industrialio_triggered_buffer kfifo_buf industrialio adm1031 i2c_mux_ltc4306 i2c_mux ipmi_msghandler mlxsw_core snd_soc_cs35l34 snd_soc_core snd_pcm_dmaengine snd_pcm snd_timer ac97_bus snd_compress snd soundcore gpio_da9055 uio ecdh_generic mdio_thunder of_mdio fixed_phy libphy mdio_cavium iptable_security iptable_raw iptable_mangle
         iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bpfilter ip6_vti ip_vti ip_gre ipip sit tunnel4 ip_tunnel hsr veth netdevsim vxcan batman_adv cfg80211 rfkill chnl_net caif nlmon dummy team bonding vcan bridge stp llc ip6_gre gre ip6_tunnel tunnel6 tun joydev mousedev ppdev tpm kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel ide_pci_generic piix aes_x86_64 crypto_simd cryptd ide_core glue_helper input_leds psmouse intel_agp intel_gtt serio_raw ata_generic i2c_piix4 agpgart pata_acpi parport_pc parport floppy rtc_cmos sch_fq_codel ip_tables x_tables sha1_ssse3 sha1_generic ipv6 [last unloaded: br_netfilter]
        Dumping ftrace buffer:
           (ftrace buffer empty)
        ---[ end trace 68741688d5fbfe85 ]---
      
      commit 23da9588 ("fs/proc/proc_sysctl.c: fix NULL pointer
      dereference in put_links") forgot to handle start_unregistering() case,
      while header->parent is NULL, it calls erase_header() and as seen in the
      above syzkaller call trace, accessing &header->parent->root will trigger
      a NULL pointer dereference.
      
      As that commit explained, there is also no need to call
      start_unregistering() if header->parent is NULL.
      
      Link: http://lkml.kernel.org/r/20190409153622.28112-1-yuehaibing@huawei.com
      Fixes: 23da9588 ("fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links")
      Fixes: 0e47c99d ("sysctl: Replace root_list with links between sysctl_table_sets")
      Signed-off-by: default avatarYueHaibing <yuehaibing@huawei.com>
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Reviewed-by: default avatarKees Cook <keescook@chromium.org>
      Cc: Luis Chamberlain <mcgrof@kernel.org>
      Cc: Alexey Dobriyan <adobriyan@gmail.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: "Eric W. Biederman" <ebiederm@xmission.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      89189557