1. 03 Jun, 2018 5 commits
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 325e14f9
      Linus Torvalds authored
      Pull vfs fixes from Al Viro.
      
       - fix io_destroy()/aio_complete() race
      
       - the vfs_open() change to get rid of open_check_o_direct() boilerplate
         was nice, but buggy. Al has a patch avoiding a revert, but that's
         definitely not a last-day fodder, so for now revert it is...
      
      * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        Revert "fs: fold open_check_o_direct into do_dentry_open"
        fix io_destroy()/aio_complete() race
      325e14f9
    • Al Viro's avatar
      Revert "fs: fold open_check_o_direct into do_dentry_open" · af04fadc
      Al Viro authored
      This reverts commit cab64df1.
      
      Having vfs_open() in some cases drop the reference to
      struct file combined with
      
      	error = vfs_open(path, f, cred);
      	if (error) {
      		put_filp(f);
      		return ERR_PTR(error);
      	}
      	return f;
      
      is flat-out wrong.  It used to be
      
      		error = vfs_open(path, f, cred);
      		if (!error) {
      			/* from now on we need fput() to dispose of f */
      			error = open_check_o_direct(f);
      			if (error) {
      				fput(f);
      				f = ERR_PTR(error);
      			}
      		} else {
      			put_filp(f);
      			f = ERR_PTR(error);
      		}
      
      and sure, having that open_check_o_direct() boilerplate gotten rid of is
      nice, but not that way...
      
      Worse, another call chain (via finish_open()) is FUBAR now wrt
      FILE_OPENED handling - in that case we get error returned, with file
      already hit by fput() *AND* FILE_OPENED not set.  Guess what happens in
      path_openat(), when it hits
      
      	if (!(opened & FILE_OPENED)) {
      		BUG_ON(!error);
      		put_filp(file);
      	}
      
      The root cause of all that crap is that the callers of do_dentry_open()
      have no way to tell which way did it fail; while that could be fixed up
      (by passing something like int *opened to do_dentry_open() and have it
      marked if we'd called ->open()), it's probably much too late in the
      cycle to do so right now.
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      af04fadc
    • Linus Torvalds's avatar
      Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 874cd339
      Linus Torvalds authored
      Pull scheduler fixes from Thomas Gleixner:
      
       - two patches addressing the problem that the scheduler allows under
         certain conditions user space tasks to be scheduled on CPUs which are
         not yet fully booted which causes a few subtle and hard to debug
         issue
      
       - add a missing runqueue clock update in the deadline scheduler which
         triggers a warning under certain circumstances
      
       - fix a silly typo in the scheduler header file
      
      * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/headers: Fix typo
        sched/deadline: Fix missing clock update
        sched/core: Require cpu_active() in select_task_rq(), for user tasks
        sched/core: Fix rules for running on online && !active CPUs
      874cd339
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 26bdace7
      Linus Torvalds authored
      Pull perf tooling fixes from Thomas Gleixner:
      
       - fix 'perf test Session topology' segfault on s390 (Thomas Richter)
      
       - fix NULL return handling in bpf__prepare_load() (YueHaibing)
      
       - fix indexing on Coresight ETM packet queue decoder (Mathieu Poirier)
      
       - fix perf.data format description of NRCPUS header (Arnaldo Carvalho
         de Melo)
      
       - update perf.data documentation section on cpu topology
      
       - handle uncore event aliases in small groups properly (Kan Liang)
      
       - add missing perf_sample.addr into python sample dictionary (Leo Yan)
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf tools: Fix perf.data format description of NRCPUS header
        perf script python: Add addr into perf sample dict
        perf data: Update documentation section on cpu topology
        perf cs-etm: Fix indexing for decoder packet queue
        perf bpf: Fix NULL return handling in bpf__prepare_load()
        perf test: "Session topology" dumps core on s390
        perf parse-events: Handle uncore event aliases in small groups properly
      26bdace7
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 918fe1b3
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Infinite loop in _decode_session6(), from Eric Dumazet.
      
       2) Pass correct argument to nla_strlcpy() in netfilter, also from Eric
          Dumazet.
      
       3) Out of bounds memory access in ipv6 srh code, from Mathieu Xhonneux.
      
       4) NULL deref in XDP_REDIRECT handling of tun driver, from Toshiaki
          Makita.
      
       5) Incorrect idr release in cls_flower, from Paul Blakey.
      
       6) Probe error handling fix in davinci_emac, from Dan Carpenter.
      
       7) Memory leak in XPS configuration, from Alexander Duyck.
      
       8) Use after free with cloned sockets in kcm, from Kirill Tkhai.
      
       9) MTU handling fixes fo ip_tunnel and ip6_tunnel, from Nicolas
          Dichtel.
      
      10) Fix UAPI hole in bpf data structure for 32-bit compat applications,
          from Daniel Borkmann.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (33 commits)
        bpf: fix uapi hole for 32 bit compat applications
        net: usb: cdc_mbim: add flag FLAG_SEND_ZLP
        ip6_tunnel: remove magic mtu value 0xFFF8
        ip_tunnel: restore binding to ifaces with a large mtu
        net: dsa: b53: Add BCM5389 support
        kcm: Fix use-after-free caused by clonned sockets
        net-sysfs: Fix memory leak in XPS configuration
        ixgbe: fix parsing of TC actions for HW offload
        net: ethernet: davinci_emac: fix error handling in probe()
        net/ncsi: Fix array size in dumpit handler
        cls_flower: Fix incorrect idr release when failing to modify rule
        net/sonic: Use dma_mapping_error()
        xfrm Fix potential error pointer dereference in xfrm_bundle_create.
        vhost_net: flush batched heads before trying to busy polling
        tun: Fix NULL pointer dereference in XDP redirect
        be2net: Fix error detection logic for BE3
        net: qmi_wwan: Add Netgear Aircard 779S
        mlxsw: spectrum: Forbid creation of VLAN 1 over port/LAG
        atm: zatm: fix memcmp casting
        iwlwifi: pcie: compare with number of IRQs requested for, not number of CPUs
        ...
      918fe1b3
  2. 02 Jun, 2018 15 commits
  3. 01 Jun, 2018 9 commits
  4. 31 May, 2018 11 commits
    • Linus Torvalds's avatar
      Merge tag 'xfs-4.17-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · 0512e013
      Linus Torvalds authored
      Pull xfs fix from Darrick Wong:
       "Clear out i_mapping error state when we're reinitializing inodes.
      
        This last minute fix prevents writeback error state from persisting
        past the end of the in-core inode lifecycle and causing EIO errors to
        be reported to userspace when no error has occurred.
      
        This fix for the behavioral regression has been soaking in for-next
        for a while, but various fs developers persuaded me to try to get it
        upstream for 4.17 because the patch that broke things was introduced
        in 4.17-rc4"
      
      * tag 'xfs-4.17-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        fs: clear writeback errors in inode_init_always
      0512e013
    • Dan Carpenter's avatar
      net: ethernet: davinci_emac: fix error handling in probe() · 8005b09d
      Dan Carpenter authored
      The current error handling code has an issue where it does:
      
      	if (priv->txchan)
      		cpdma_chan_destroy(priv->txchan);
      
      The problem is that ->txchan is either valid or an error pointer (which
      would lead to an Oops).  I've changed it to use multiple error labels so
      that the test can be removed.
      
      Also there were some missing calls to netif_napi_del().
      
      Fixes: 3ef0fdb2 ("net: davinci_emac: switch to new cpdma layer")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8005b09d
    • Samuel Mendoza-Jonas's avatar
      net/ncsi: Fix array size in dumpit handler · 0f51f358
      Samuel Mendoza-Jonas authored
      With CONFIG_CC_STACKPROTECTOR enabled the kernel panics as below when
      parsing a NCSI_CMD_PKG_INFO command:
      
      [  150.149711] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: 805cff08
      [  150.149711]
      [  150.159919] CPU: 0 PID: 1301 Comm: ncsi-netlink Not tainted 4.13.16-468cbec6d2c91239332cb91b1f0a73aafcb6f0c6 #1
      [  150.170004] Hardware name: Generic DT based system
      [  150.174852] [<80109930>] (unwind_backtrace) from [<80106bc4>] (show_stack+0x20/0x24)
      [  150.182641] [<80106bc4>] (show_stack) from [<805d36e4>] (dump_stack+0x20/0x28)
      [  150.189888] [<805d36e4>] (dump_stack) from [<801163ac>] (panic+0xdc/0x278)
      [  150.196780] [<801163ac>] (panic) from [<801162cc>] (__stack_chk_fail+0x20/0x24)
      [  150.204111] [<801162cc>] (__stack_chk_fail) from [<805cff08>] (ncsi_pkg_info_all_nl+0x244/0x258)
      [  150.212912] [<805cff08>] (ncsi_pkg_info_all_nl) from [<804f939c>] (genl_lock_dumpit+0x3c/0x54)
      [  150.221535] [<804f939c>] (genl_lock_dumpit) from [<804f873c>] (netlink_dump+0xf8/0x284)
      [  150.229550] [<804f873c>] (netlink_dump) from [<804f8d44>] (__netlink_dump_start+0x124/0x17c)
      [  150.237992] [<804f8d44>] (__netlink_dump_start) from [<804f9880>] (genl_rcv_msg+0x1c8/0x3d4)
      [  150.246440] [<804f9880>] (genl_rcv_msg) from [<804f9174>] (netlink_rcv_skb+0xd8/0x134)
      [  150.254361] [<804f9174>] (netlink_rcv_skb) from [<804f96a4>] (genl_rcv+0x30/0x44)
      [  150.261850] [<804f96a4>] (genl_rcv) from [<804f7790>] (netlink_unicast+0x198/0x234)
      [  150.269511] [<804f7790>] (netlink_unicast) from [<804f7ffc>] (netlink_sendmsg+0x368/0x3b0)
      [  150.277783] [<804f7ffc>] (netlink_sendmsg) from [<804abea4>] (sock_sendmsg+0x24/0x34)
      [  150.285625] [<804abea4>] (sock_sendmsg) from [<804ac1dc>] (___sys_sendmsg+0x244/0x260)
      [  150.293556] [<804ac1dc>] (___sys_sendmsg) from [<804ad98c>] (__sys_sendmsg+0x5c/0x9c)
      [  150.301400] [<804ad98c>] (__sys_sendmsg) from [<804ad9e4>] (SyS_sendmsg+0x18/0x1c)
      [  150.308984] [<804ad9e4>] (SyS_sendmsg) from [<80102640>] (ret_fast_syscall+0x0/0x3c)
      [  150.316743] ---[ end Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: 805cff08
      
      This turns out to be because the attrs array in ncsi_pkg_info_all_nl()
      is initialised to a length of NCSI_ATTR_MAX which is the maximum
      attribute number, not the number of attributes.
      
      Fixes: 955dc68c ("net/ncsi: Add generic netlink family")
      Signed-off-by: default avatarSamuel Mendoza-Jonas <sam@mendozajonas.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0f51f358
    • David S. Miller's avatar
      Merge tag 'wireless-drivers-for-davem-2018-05-30' of... · be20f28f
      David S. Miller authored
      Merge tag 'wireless-drivers-for-davem-2018-05-30' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
      
      Kalle Valo says:
      
      ====================
      wireless-drivers fixes for 4.17
      
      Two last minute fixes, hopefully they make it to 4.17 still.
      
      rt2x00
      
      * revert a fix which caused even more problems
      
      iwlwifi
      
      * fix a crash when there are 16 or more logical CPUs
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      be20f28f
    • Paul Blakey's avatar
      cls_flower: Fix incorrect idr release when failing to modify rule · 8258d2da
      Paul Blakey authored
      When we fail to modify a rule, we incorrectly release the idr handle
      of the unmodified old rule.
      
      Fix that by checking if we need to release it.
      
      Fixes: fe2502e4 ("net_sched: remove cls_flower idr on failure")
      Reported-by: default avatarVlad Buslov <vladbu@mellanox.com>
      Reviewed-by: default avatarRoi Dayan <roid@mellanox.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarPaul Blakey <paulb@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8258d2da
    • Finn Thain's avatar
      net/sonic: Use dma_mapping_error() · 26de0b76
      Finn Thain authored
      With CONFIG_DMA_API_DEBUG=y, calling sonic_open() produces the
      message, "DMA-API: device driver failed to check map error".
      Add the missing dma_mapping_error() call.
      
      Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
      Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
      Acked-by: default avatarThomas Bogendoerfer <tsbogend@alpha.franken.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      26de0b76
    • Leo (Sunpeng) Li's avatar
      drm/amd/display: Update color props when modeset is required · bc13f2f8
      Leo (Sunpeng) Li authored
      This fixes issues where color management properties don't persist
      over DPMS on/off, or when the CRTC is moved across connectors.
      Signed-off-by: default avatarLeo (Sunpeng) Li <sunpeng.li@amd.com>
      Reviewed-by: default avatarHarry Wentland <Harry.Wentland@amd.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      bc13f2f8
    • David Francis's avatar
      drm/amd/display: Make atomic-check validate underscan changes · a9e8d275
      David Francis authored
      When the underscan state was changed, atomic-check was triggering a
      validation but passing the old underscan values.  This change adds a
      somewhat hacky check in dm_update_crtcs_state that will update the
      stream if old and newunderscan values are different.
      This was causing 4k on Fiji to allow underscan when it wasn't permitted.
      Signed-off-by: default avatarDavid Francis <David.Francis@amd.com>
      Reviewed-by: default avatarDavid Francis <David.Francis@amd.com>
      Acked-by: default avatarHarry Wentland <harry.wentland@amd.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      a9e8d275
    • Linus Torvalds's avatar
      Merge tag 'platform-drivers-x86-v4.17-4' of git://git.infradead.org/linux-platform-drivers-x86 · dd52cb87
      Linus Torvalds authored
      Pull x86 platform driver fix from Andy Shevchenko:
       "Fix NULL pointer dereference in asus-wmi on rfkill cleanup.
      
        The effective change is just one new condition - two lines of code.
        But it required moving one static helper function, which is why the
        diff looks a bit bigger"
      
      * tag 'platform-drivers-x86-v4.17-4' of git://git.infradead.org/linux-platform-drivers-x86:
        platform/x86: asus-wmi: Fix NULL pointer dereference
      dd52cb87
    • João Paulo Rechi Vita's avatar
      platform/x86: asus-wmi: Fix NULL pointer dereference · 32ffd6e8
      João Paulo Rechi Vita authored
      Do not perform the rfkill cleanup routine when
      (asus->driver->wlan_ctrl_by_user && ashs_present()) is true, since
      nothing is registered with the rfkill subsystem in that case. Doing so
      leads to the following kernel NULL pointer dereference:
      
        BUG: unable to handle kernel NULL pointer dereference at           (null)
        IP: [<ffffffff816c7348>] __mutex_lock_slowpath+0x98/0x120
        PGD 1a3aa8067
        PUD 1a3b3d067
        PMD 0
      
        Oops: 0002 [#1] PREEMPT SMP
        Modules linked in: bnep ccm binfmt_misc uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core hid_a4tech videodev x86_pkg_temp_thermal intel_powerclamp coretemp ath3k btusb btrtl btintel bluetooth kvm_intel snd_hda_codec_hdmi kvm snd_hda_codec_realtek snd_hda_codec_generic irqbypass crc32c_intel arc4 i915 snd_hda_intel snd_hda_codec ath9k ath9k_common ath9k_hw ath i2c_algo_bit snd_hwdep mac80211 ghash_clmulni_intel snd_hda_core snd_pcm snd_timer cfg80211 ehci_pci xhci_pci drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm xhci_hcd ehci_hcd asus_nb_wmi(-) asus_wmi sparse_keymap r8169 rfkill mxm_wmi serio_raw snd mii mei_me lpc_ich i2c_i801 video soundcore mei i2c_smbus wmi i2c_core mfd_core
        CPU: 3 PID: 3275 Comm: modprobe Not tainted 4.9.34-gentoo #34
        Hardware name: ASUSTeK COMPUTER INC. K56CM/K56CM, BIOS K56CM.206 08/21/2012
        task: ffff8801a639ba00 task.stack: ffffc900014cc000
        RIP: 0010:[<ffffffff816c7348>]  [<ffffffff816c7348>] __mutex_lock_slowpath+0x98/0x120
        RSP: 0018:ffffc900014cfce0  EFLAGS: 00010282
        RAX: 0000000000000000 RBX: ffff8801a54315b0 RCX: 00000000c0000100
        RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff8801a54315b4
        RBP: ffffc900014cfd30 R08: 0000000000000000 R09: 0000000000000002
        R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801a54315b4
        R13: ffff8801a639ba00 R14: 00000000ffffffff R15: ffff8801a54315b8
        FS:  00007faa254fb700(0000) GS:ffff8801aef80000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 0000000000000000 CR3: 00000001a3b1b000 CR4: 00000000001406e0
        Stack:
         ffff8801a54315b8 0000000000000000 ffffffff814733ae ffffc900014cfd28
         ffffffff8146a28c ffff8801a54315b0 0000000000000000 ffff8801a54315b0
         ffff8801a66f3820 0000000000000000 ffffc900014cfd48 ffffffff816c73e7
        Call Trace:
         [<ffffffff814733ae>] ? acpi_ut_release_mutex+0x5d/0x61
         [<ffffffff8146a28c>] ? acpi_ns_get_node+0x49/0x52
         [<ffffffff816c73e7>] mutex_lock+0x17/0x30
         [<ffffffffa00a3bb4>] asus_rfkill_hotplug+0x24/0x1a0 [asus_wmi]
         [<ffffffffa00a4421>] asus_wmi_rfkill_exit+0x61/0x150 [asus_wmi]
         [<ffffffffa00a49f1>] asus_wmi_remove+0x61/0xb0 [asus_wmi]
         [<ffffffff814a5128>] platform_drv_remove+0x28/0x40
         [<ffffffff814a2901>] __device_release_driver+0xa1/0x160
         [<ffffffff814a29e3>] device_release_driver+0x23/0x30
         [<ffffffff814a1ffd>] bus_remove_device+0xfd/0x170
         [<ffffffff8149e5a9>] device_del+0x139/0x270
         [<ffffffff814a5028>] platform_device_del+0x28/0x90
         [<ffffffff814a50a2>] platform_device_unregister+0x12/0x30
         [<ffffffffa00a4209>] asus_wmi_unregister_driver+0x19/0x30 [asus_wmi]
         [<ffffffffa00da0ea>] asus_nb_wmi_exit+0x10/0xf26 [asus_nb_wmi]
         [<ffffffff8110c692>] SyS_delete_module+0x192/0x270
         [<ffffffff810022b2>] ? exit_to_usermode_loop+0x92/0xa0
         [<ffffffff816ca560>] entry_SYSCALL_64_fastpath+0x13/0x94
        Code: e8 5e 30 00 00 8b 03 83 f8 01 0f 84 93 00 00 00 48 8b 43 10 4c 8d 7b 08 48 89 63 10 41 be ff ff ff ff 4c 89 3c 24 48 89 44 24 08 <48> 89 20 4c 89 6c 24 10 eb 1d 4c 89 e7 49 c7 45 08 02 00 00 00
        RIP  [<ffffffff816c7348>] __mutex_lock_slowpath+0x98/0x120
         RSP <ffffc900014cfce0>
        CR2: 0000000000000000
        ---[ end trace 8d484233fa7cb512 ]---
        note: modprobe[3275] exited with preempt_count 2
      
      https://bugzilla.kernel.org/show_bug.cgi?id=196467
      
      Reported-by: red.f0xyz@gmail.com
      Signed-off-by: default avatarJoão Paulo Rechi Vita <jprvita@endlessm.com>
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      32ffd6e8
    • Ingo Molnar's avatar
      Merge tag 'perf-urgent-for-mingo-4.17-20180531' of... · 6497bbc3
      Ingo Molnar authored
      Merge tag 'perf-urgent-for-mingo-4.17-20180531' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent
      
      Pull perf/urgent fixes from Arnaldo Carvalho de Melo:
      
      - Fix 'perf test Session topology' segfault on s390 (Thomas Richter)
      
      - Fix NULL return handling in bpf__prepare_load() (YueHaibing)
      
      - Fix indexing on Coresight ETM packet queue decoder (Mathieu Poirier)
      
      - Fix perf.data format description of NRCPUS header (Arnaldo Carvalho de Melo)
      
      - Update perf.data documentation section on cpu topology
      
      - Handle uncore event aliases in small groups properly (Kan Liang)
      
      - Add missing perf_sample.addr into python sample dictionary (Leo Yan)
      Signed-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      6497bbc3