1. 11 Sep, 2015 4 commits
    • Jann Horn's avatar
      CIFS: fix type confusion in copy offload ioctl · 4c17a6d5
      Jann Horn authored
      This might lead to local privilege escalation (code execution as
      kernel) for systems where the following conditions are met:
      
       - CONFIG_CIFS_SMB2 and CONFIG_CIFS_POSIX are enabled
       - a cifs filesystem is mounted where:
        - the mount option "vers" was used and set to a value >=2.0
        - the attacker has write access to at least one file on the filesystem
      
      To attack this, an attacker would have to guess the target_tcon
      pointer (but guessing wrong doesn't cause a crash, it just returns an
      error code) and win a narrow race.
      
      CC: Stable <stable@vger.kernel.org>
      Signed-off-by: default avatarJann Horn <jann@thejh.net>
      Signed-off-by: default avatarSteve French <smfrench@gmail.com>
      4c17a6d5
    • Linus Torvalds's avatar
      Merge branch 'for-4.3/blkcg' of git://git.kernel.dk/linux-block · b0a1ea51
      Linus Torvalds authored
      Pull blk-cg updates from Jens Axboe:
       "A bit later in the cycle, but this has been in the block tree for a a
        while.  This is basically four patchsets from Tejun, that improve our
        buffered cgroup writeback.  It was dependent on the other cgroup
        changes, but they went in earlier in this cycle.
      
        Series 1 is set of 5 patches that has cgroup writeback updates:
      
         - bdi_writeback iteration fix which could lead to some wb's being
           skipped or repeated during e.g. sync under memory pressure.
      
         - Simplification of wb work wait mechanism.
      
         - Writeback tracepoints updated to report cgroup.
      
        Series 2 is is a set of updates for the CFQ cgroup writeback handling:
      
           cfq has always charged all async IOs to the root cgroup.  It didn't
           have much choice as writeback didn't know about cgroups and there
           was no way to tell who to blame for a given writeback IO.
           writeback finally grew support for cgroups and now tags each
           writeback IO with the appropriate cgroup to charge it against.
      
           This patchset updates cfq so that it follows the blkcg each bio is
           tagged with.  Async cfq_queues are now shared across cfq_group,
           which is per-cgroup, instead of per-request_queue cfq_data.  This
           makes all IOs follow the weight based IO resource distribution
           implemented by cfq.
      
           - Switched from GFP_ATOMIC to GFP_NOWAIT as suggested by Jeff.
      
           - Other misc review points addressed, acks added and rebased.
      
        Series 3 is the blkcg policy cleanup patches:
      
           This patchset contains assorted cleanups for blkcg_policy methods
           and blk[c]g_policy_data handling.
      
           - alloc/free added for blkg_policy_data.  exit dropped.
      
           - alloc/free added for blkcg_policy_data.
      
           - blk-throttle's async percpu allocation is replaced with direct
             allocation.
      
           - all methods now take blk[c]g_policy_data instead of blkcg_gq or
             blkcg.
      
        And finally, series 4 is a set of patches cleaning up the blkcg stats
        handling:
      
          blkcg's stats have always been somwhat of a mess.  This patchset
          tries to improve the situation a bit.
      
           - The following patches added to consolidate blkcg entry point and
             blkg creation.  This is in itself is an improvement and helps
             colllecting common stats on bio issue.
      
           - per-blkg stats now accounted on bio issue rather than request
             completion so that bio based and request based drivers can behave
             the same way.  The issue was spotted by Vivek.
      
           - cfq-iosched implements custom recursive stats and blk-throttle
             implements custom per-cpu stats.  This patchset make blkcg core
             support both by default.
      
           - cfq-iosched and blk-throttle keep track of the same stats
             multiple times.  Unify them"
      
      * 'for-4.3/blkcg' of git://git.kernel.dk/linux-block: (45 commits)
        blkcg: use CGROUP_WEIGHT_* scale for io.weight on the unified hierarchy
        blkcg: s/CFQ_WEIGHT_*/CFQ_WEIGHT_LEGACY_*/
        blkcg: implement interface for the unified hierarchy
        blkcg: misc preparations for unified hierarchy interface
        blkcg: separate out tg_conf_updated() from tg_set_conf()
        blkcg: move body parsing from blkg_conf_prep() to its callers
        blkcg: mark existing cftypes as legacy
        blkcg: rename subsystem name from blkio to io
        blkcg: refine error codes returned during blkcg configuration
        blkcg: remove unnecessary NULL checks from __cfqg_set_weight_device()
        blkcg: reduce stack usage of blkg_rwstat_recursive_sum()
        blkcg: remove cfqg_stats->sectors
        blkcg: move io_service_bytes and io_serviced stats into blkcg_gq
        blkcg: make blkg_[rw]stat_recursive_sum() to be able to index into blkcg_gq
        blkcg: make blkcg_[rw]stat per-cpu
        blkcg: add blkg_[rw]stat->aux_cnt and replace cfq_group->dead_stats with it
        blkcg: consolidate blkg creation in blkcg_bio_issue_check()
        blk-throttle: improve queue bypass handling
        blkcg: move root blkg lookup optimization from throtl_lookup_tg() to __blkg_lookup()
        blkcg: inline [__]blkg_lookup()
        ...
      b0a1ea51
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · 33e247c7
      Linus Torvalds authored
      Merge third patch-bomb from Andrew Morton:
      
       - even more of the rest of MM
      
       - lib/ updates
      
       - checkpatch updates
      
       - small changes to a few scruffy filesystems
      
       - kmod fixes/cleanups
      
       - kexec updates
      
       - a dma-mapping cleanup series from hch
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>: (81 commits)
        dma-mapping: consolidate dma_set_mask
        dma-mapping: consolidate dma_supported
        dma-mapping: cosolidate dma_mapping_error
        dma-mapping: consolidate dma_{alloc,free}_noncoherent
        dma-mapping: consolidate dma_{alloc,free}_{attrs,coherent}
        mm: use vma_is_anonymous() in create_huge_pmd() and wp_huge_pmd()
        mm: make sure all file VMAs have ->vm_ops set
        mm, mpx: add "vm_flags_t vm_flags" arg to do_mmap_pgoff()
        mm: mark most vm_operations_struct const
        namei: fix warning while make xmldocs caused by namei.c
        ipc: convert invalid scenarios to use WARN_ON
        zlib_deflate/deftree: remove bi_reverse()
        lib/decompress_unlzma: Do a NULL check for pointer
        lib/decompressors: use real out buf size for gunzip with kernel
        fs/affs: make root lookup from blkdev logical size
        sysctl: fix int -> unsigned long assignments in INT_MIN case
        kexec: export KERNEL_IMAGE_SIZE to vmcoreinfo
        kexec: align crash_notes allocation to make it be inside one physical page
        kexec: remove unnecessary test in kimage_alloc_crash_control_pages()
        kexec: split kexec_load syscall from kexec core code
        ...
      33e247c7
    • Linus Torvalds's avatar
      Merge tag 'armsoc-late' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · d71fc239
      Linus Torvalds authored
      Pull late ARM SoC updates from Kevin Hilman:
       "This is a collection of a few late fixes and other misc stuff that had
        dependencies on things being merged from other trees.
      
        The bulk of the changes are for samsung/exynos SoCs for some changes
        that needed a few minor reworks so ended up a bit late.  The others
        are mainly for qcom SoCs: a couple fixes and some DTS updates"
      
      * tag 'armsoc-late' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (37 commits)
        ARM: multi_v7_defconfig: Enable PBIAS regulator
        soc: qcom: smd: Correct fBLOCKREADINTR handling
        soc: qcom: smd: Use correct remote processor ID
        soc: qcom: smem: Fix errant private access
        ARM: dts: qcom: msm8974-sony-xperia-honami: Use stdout-path
        ARM: dts: qcom: msm8960-cdp: Use stdout-path
        ARM: dts: qcom: msm8660-surf: Use stdout-path
        ARM: dts: qcom: ipq8064-ap148: Use stdout-path
        ARM: dts: qcom: apq8084-mtp: Use stdout-path
        ARM: dts: qcom: apq8084-ifc6540: Use stdout-path
        ARM: dts: qcom: apq8074-dragonboard: Use stdout-path
        ARM: dts: qcom: apq8064-ifc6410: Use stdout-path
        ARM: dts: qcom: apq8064-cm-qs600: Use stdout-path
        ARM: dts: qcom: Label serial nodes for aliasing and stdout-path
        reset: ath79: Fix missing spin_lock_init
        reset: Add (devm_)reset_control_get stub functions
        ARM: EXYNOS: switch to using generic cpufreq driver for exynos4x12
        cpufreq: exynos: Remove unselectable rule for arm-exynos-cpufreq.o
        ARM: dts: add iommu property to JPEG device for exynos4
        ARM: dts: enable SPI1 for exynos4412-odroidu3
        ...
      d71fc239
  2. 10 Sep, 2015 36 commits
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 519f526d
      Linus Torvalds authored
      Pull more kvm updates from Paolo Bonzini:
       "ARM:
         - Full debug support for arm64
         - Active state switching for timer interrupts
         - Lazy FP/SIMD save/restore for arm64
         - Generic ARMv8 target
      
        PPC:
         - Book3S: A few bug fixes
         - Book3S: Allow micro-threading on POWER8
      
        x86:
         - Compiler warnings
      
        Generic:
         - Adaptive polling for guest halt"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (49 commits)
        kvm: irqchip: fix memory leak
        kvm: move new trace event outside #ifdef CONFIG_KVM_ASYNC_PF
        KVM: trace kvm_halt_poll_ns grow/shrink
        KVM: dynamic halt-polling
        KVM: make halt_poll_ns per-vCPU
        Silence compiler warning in arch/x86/kvm/emulate.c
        kvm: compile process_smi_save_seg_64() only for x86_64
        KVM: x86: avoid uninitialized variable warning
        KVM: PPC: Book3S: Fix typo in top comment about locking
        KVM: PPC: Book3S: Fix size of the PSPB register
        KVM: PPC: Book3S HV: Exit on H_DOORBELL if HOST_IPI is set
        KVM: PPC: Book3S HV: Fix race in starting secondary threads
        KVM: PPC: Book3S: correct width in XER handling
        KVM: PPC: Book3S HV: Fix preempted vcore stolen time calculation
        KVM: PPC: Book3S HV: Fix preempted vcore list locking
        KVM: PPC: Book3S HV: Implement H_CLEAR_REF and H_CLEAR_MOD
        KVM: PPC: Book3S HV: Fix bug in dirty page tracking
        KVM: PPC: Book3S HV: Fix race in reading change bit when removing HPTE
        KVM: PPC: Book3S HV: Implement dynamic micro-threading on POWER8
        KVM: PPC: Book3S HV: Make use of unused threads when running guests
        ...
      519f526d
    • Linus Torvalds's avatar
      Merge tag 'for-linus-4.3-rc0b-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · 06ab838c
      Linus Torvalds authored
      Pull xen terminology fixes from David Vrabel:
       "Use the correct GFN/BFN terms more consistently"
      
      * tag 'for-linus-4.3-rc0b-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        xen/xenbus: Rename the variable xen_store_mfn to xen_store_gfn
        xen/privcmd: Further s/MFN/GFN/ clean-up
        hvc/xen: Further s/MFN/GFN clean-up
        video/xen-fbfront: Further s/MFN/GFN clean-up
        xen/tmem: Use xen_page_to_gfn rather than pfn_to_gfn
        xen: Use correctly the Xen memory terminologies
        arm/xen: implement correctly pfn_to_mfn
        xen: Make clear that swiotlb and biomerge are dealing with DMA address
      06ab838c
    • Linus Torvalds's avatar
      Merge branch 'next' of git://git.monstr.eu/linux-2.6-microblaze · 573c577a
      Linus Torvalds authored
      Pull microblaze update from Michal Simek.
      
      * 'next' of git://git.monstr.eu/linux-2.6-microblaze:
        elf-em.h: move EM_MICROBLAZE to the common header
      573c577a
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rkuo/linux-hexagon-kernel · 0cdf5a46
      Linus Torvalds authored
      Pull hexagon updates from Richard Kuo:
       "Just two fixes -- one for a uapi header and one for a timer interface"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rkuo/linux-hexagon-kernel:
        Revert "Hexagon: fix signal.c compile error"
        hexagon/time: Migrate to new 'set-state' interface
      0cdf5a46
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 65c61bc5
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix out-of-bounds array access in netfilter ipset, from Jozsef
          Kadlecsik.
      
       2) Use correct free operation on netfilter conntrack templates, from
          Daniel Borkmann.
      
       3) Fix route leak in SCTP, from Marcelo Ricardo Leitner.
      
       4) Fix sizeof(pointer) in mac80211, from Thierry Reding.
      
       5) Fix cache pointer comparison in ip6mr leading to missed unlock of
          mrt_lock.  From Richard Laing.
      
       6) rds_conn_lookup() needs to consider network namespace in key
          comparison, from Sowmini Varadhan.
      
       7) Fix deadlock in TIPC code wrt broadcast link wakeups, from Kolmakov
          Dmitriy.
      
       8) Fix fd leaks in bpf syscall, from Daniel Borkmann.
      
       9) Fix error recovery when installing ipv6 multipath routes, we would
          delete the old route before we would know if we could fully commit
          to the new set of nexthops.  Fix from Roopa Prabhu.
      
      10) Fix run-time suspend problems in r8152, from Hayes Wang.
      
      11) In fec, don't program the MAC address into the chip when the clocks
          are gated off.  From Fugang Duan.
      
      12) Fix poll behavior for netlink sockets when using rx ring mmap, from
          Daniel Borkmann.
      
      13) Don't allocate memory with GFP_KERNEL from get_stats64 in r8169
          driver, from Corinna Vinschen.
      
      14) In TCP Cubic congestion control, handle idle periods better where we
          are application limited, in order to keep cwnd from growing out of
          control.  From Eric Dumzet.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (65 commits)
        tcp_cubic: better follow cubic curve after idle period
        tcp: generate CA_EVENT_TX_START on data frames
        xen-netfront: respect user provided max_queues
        xen-netback: respect user provided max_queues
        r8169: Fix sleeping function called during get_stats64, v2
        ether: add IEEE 1722 ethertype - TSN
        netlink, mmap: fix edge-case leakages in nf queue zero-copy
        netlink, mmap: don't walk rx ring on poll if receive queue non-empty
        cxgb4: changes for new firmware 1.14.4.0
        net: fec: add netif status check before set mac address
        r8152: fix the runtime suspend issues
        r8152: split DRIVER_VERSION
        ipv6: fix ifnullfree.cocci warnings
        add microchip LAN88xx phy driver
        stmmac: fix check for phydev being open
        net: qlcnic: delete redundant memsets
        net: mv643xx_eth: use kzalloc
        net: jme: use kzalloc() instead of kmalloc+memset
        net: cavium: liquidio: use kzalloc in setup_glist()
        net: ipv6: use common fib_default_rule_pref
        ...
      65c61bc5
    • Christoph Hellwig's avatar
      dma-mapping: consolidate dma_set_mask · 452e06af
      Christoph Hellwig authored
      Almost everyone implements dma_set_mask the same way, although some time
      that's hidden in ->set_dma_mask methods.
      
      This patch consolidates those into a common implementation that either
      calls ->set_dma_mask if present or otherwise uses the default
      implementation.  Some architectures used to only call ->set_dma_mask
      after the initial checks, and those instance have been fixed to do the
      full work.  h8300 implemented dma_set_mask bogusly as a no-ops and has
      been fixed.
      
      Unfortunately some architectures overload unrelated semantics like changing
      the dma_ops into it so we still need to allow for an architecture override
      for now.
      
      [jcmvbkbc@gmail.com: fix xtensa]
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Russell King <linux@arm.linux.org.uk>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
      Cc: Michal Simek <monstr@monstr.eu>
      Cc: Jonas Bonn <jonas@southpole.se>
      Cc: Chris Metcalf <cmetcalf@ezchip.com>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Ingo Molnar <mingo@elte.hu>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
      Signed-off-by: default avatarMax Filippov <jcmvbkbc@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      452e06af
    • Christoph Hellwig's avatar
      dma-mapping: consolidate dma_supported · ee196371
      Christoph Hellwig authored
      Most architectures just call into ->dma_supported, but some also return 1
      if the method is not present, or 0 if no dma ops are present (although
      that should never happeb). Consolidate this more broad version into
      common code.
      
      Also fix h8300 which inorrectly always returned 0, which would have been
      a problem if it's dma_set_mask implementation wasn't a similarly buggy
      noop.
      
      As a few architectures have much more elaborate implementations, we
      still allow for arch overrides.
      
      [jcmvbkbc@gmail.com: fix xtensa]
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Russell King <linux@arm.linux.org.uk>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
      Cc: Michal Simek <monstr@monstr.eu>
      Cc: Jonas Bonn <jonas@southpole.se>
      Cc: Chris Metcalf <cmetcalf@ezchip.com>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Ingo Molnar <mingo@elte.hu>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
      Signed-off-by: default avatarMax Filippov <jcmvbkbc@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ee196371
    • Christoph Hellwig's avatar
      dma-mapping: cosolidate dma_mapping_error · efa21e43
      Christoph Hellwig authored
      Currently there are three valid implementations of dma_mapping_error:
      
       (1) call ->mapping_error
       (2) check for a hardcoded error code
       (3) always return 0
      
      This patch provides a common implementation that calls ->mapping_error
      if present, then checks for DMA_ERROR_CODE if defined or otherwise
      returns 0.
      
      [jcmvbkbc@gmail.com: fix xtensa]
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Russell King <linux@arm.linux.org.uk>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
      Cc: Michal Simek <monstr@monstr.eu>
      Cc: Jonas Bonn <jonas@southpole.se>
      Cc: Chris Metcalf <cmetcalf@ezchip.com>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Ingo Molnar <mingo@elte.hu>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
      Signed-off-by: default avatarMax Filippov <jcmvbkbc@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      efa21e43
    • Christoph Hellwig's avatar
      dma-mapping: consolidate dma_{alloc,free}_noncoherent · 1e893752
      Christoph Hellwig authored
      Most architectures do not support non-coherent allocations and either
      define dma_{alloc,free}_noncoherent to their coherent versions or stub
      them out.
      
      Openrisc uses dma_{alloc,free}_attrs to implement them, and only Mips
      implements them directly.
      
      This patch moves the Openrisc version to common code, and handles the
      DMA_ATTR_NON_CONSISTENT case in the mips dma_map_ops instance.
      
      Note that actual non-coherent allocations require a dma_cache_sync
      implementation, so if non-coherent allocations didn't work on
      an architecture before this patch they still won't work after it.
      
      [jcmvbkbc@gmail.com: fix xtensa]
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Russell King <linux@arm.linux.org.uk>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
      Cc: Michal Simek <monstr@monstr.eu>
      Cc: Jonas Bonn <jonas@southpole.se>
      Cc: Chris Metcalf <cmetcalf@ezchip.com>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Ingo Molnar <mingo@elte.hu>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
      Signed-off-by: default avatarMax Filippov <jcmvbkbc@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1e893752
    • Christoph Hellwig's avatar
      dma-mapping: consolidate dma_{alloc,free}_{attrs,coherent} · 6894258e
      Christoph Hellwig authored
      Since 2009 we have a nice asm-generic header implementing lots of DMA API
      functions for architectures using struct dma_map_ops, but unfortunately
      it's still missing a lot of APIs that all architectures still have to
      duplicate.
      
      This series consolidates the remaining functions, although we still need
      arch opt outs for two of them as a few architectures have very
      non-standard implementations.
      
      This patch (of 5):
      
      The coherent DMA allocator works the same over all architectures supporting
      dma_map operations.
      
      This patch consolidates them and converges the minor differences:
      
       - the debug_dma helpers are now called from all architectures, including
         those that were previously missing them
       - dma_alloc_from_coherent and dma_release_from_coherent are now always
         called from the generic alloc/free routines instead of the ops
         dma-mapping-common.h always includes dma-coherent.h to get the defintions
         for them, or the stubs if the architecture doesn't support this feature
       - checks for ->alloc / ->free presence are removed.  There is only one
         magic instead of dma_map_ops without them (mic_dma_ops) and that one
         is x86 only anyway.
      
      Besides that only x86 needs special treatment to replace a default devices
      if none is passed and tweak the gfp_flags.  An optional arch hook is provided
      for that.
      
      [linux@roeck-us.net: fix build]
      [jcmvbkbc@gmail.com: fix xtensa]
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Russell King <linux@arm.linux.org.uk>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
      Cc: Michal Simek <monstr@monstr.eu>
      Cc: Jonas Bonn <jonas@southpole.se>
      Cc: Chris Metcalf <cmetcalf@ezchip.com>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Ingo Molnar <mingo@elte.hu>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Signed-off-by: default avatarMax Filippov <jcmvbkbc@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6894258e
    • Kirill A. Shutemov's avatar
      mm: use vma_is_anonymous() in create_huge_pmd() and wp_huge_pmd() · fb6dd5fa
      Kirill A. Shutemov authored
      Let's use helper rather than direct check of vma->vm_ops to distinguish
      anonymous VMA.
      Signed-off-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Reviewed-by: default avatarOleg Nesterov <oleg@redhat.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: Ingo Molnar <mingo@elte.hu>
      Cc: Minchan Kim <minchan@kernel.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      fb6dd5fa
    • Kirill A. Shutemov's avatar
      mm: make sure all file VMAs have ->vm_ops set · 6dc296e7
      Kirill A. Shutemov authored
      We rely on vma->vm_ops == NULL to detect anonymous VMA: see
      vma_is_anonymous(), but some drivers doesn't set ->vm_ops.
      
      As a result we can end up with anonymous page in private file mapping.
      That should not lead to serious misbehaviour, but nevertheless is wrong.
      
      Let's fix by setting up dummy ->vm_ops for file mmapping if f_op->mmap()
      didn't set its own.
      
      The patch also adds sanity check into __vma_link_rb(). It will help
      catch broken VMAs which inserted directly into mm_struct via
      insert_vm_struct().
      Signed-off-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Reviewed-by: default avatarOleg Nesterov <oleg@redhat.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: Ingo Molnar <mingo@elte.hu>
      Cc: Minchan Kim <minchan@kernel.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6dc296e7
    • Oleg Nesterov's avatar
      mm, mpx: add "vm_flags_t vm_flags" arg to do_mmap_pgoff() · 1fcfd8db
      Oleg Nesterov authored
      Add the additional "vm_flags_t vm_flags" argument to do_mmap_pgoff(),
      rename it to do_mmap(), and re-introduce do_mmap_pgoff() as a simple
      wrapper on top of do_mmap().  Perhaps we should update the callers of
      do_mmap_pgoff() and kill it later.
      
      This way mpx_mmap() can simply call do_mmap(vm_flags => VM_MPX) and do not
      play with vm internals.
      
      After this change mmap_region() has a single user outside of mmap.c,
      arch/tile/mm/elf.c:arch_setup_additional_pages().  It would be nice to
      change arch/tile/ and unexport mmap_region().
      
      [kirill@shutemov.name: fix build]
      [akpm@linux-foundation.org: coding-style fixes]
      Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
      Acked-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
      Tested-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
      Signed-off-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Ingo Molnar <mingo@elte.hu>
      Cc: Minchan Kim <minchan@kernel.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1fcfd8db
    • Kirill A. Shutemov's avatar
      mm: mark most vm_operations_struct const · 7cbea8dc
      Kirill A. Shutemov authored
      With two exceptions (drm/qxl and drm/radeon) all vm_operations_struct
      structs should be constant.
      Signed-off-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Reviewed-by: default avatarOleg Nesterov <oleg@redhat.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: Ingo Molnar <mingo@elte.hu>
      Cc: Minchan Kim <minchan@kernel.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      7cbea8dc
    • Masanari Iida's avatar
      namei: fix warning while make xmldocs caused by namei.c · 2a78b857
      Masanari Iida authored
      Fix the following warnings:
      
      Warning(.//fs/namei.c:2422): No description found for parameter 'nd'
      Warning(.//fs/namei.c:2422): Excess function parameter 'nameidata'
      description in 'path_mountpoint'
      Signed-off-by: default avatarMasanari Iida <standby24x7@gmail.com>
      Acked-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      2a78b857
    • Davidlohr Bueso's avatar
      ipc: convert invalid scenarios to use WARN_ON · d0edd852
      Davidlohr Bueso authored
      Considering Linus' past rants about the (ab)use of BUG in the kernel, I
      took a look at how we deal with such calls in ipc.  Given that any errors
      or corruption in ipc code are most likely contained within the set of
      processes participating in the broken mechanisms, there aren't really many
      strong fatal system failure scenarios that would require a BUG call.
      Also, if something is seriously wrong, ipc might not be the place for such
      a BUG either.
      
      1. For example, recently, a customer hit one of these BUG_ONs in shm
         after failing shm_lock().  A busted ID imho does not merit a BUG_ON,
         and WARN would have been better.
      
      2. MSG_COPY functionality of posix msgrcv(2) for checkpoint/restore.
         I don't see how we can hit this anyway -- at least it should be IS_ERR.
          The 'copy' arg from do_msgrcv is always set by calling prepare_copy()
         first and foremost.  We could also probably drop this check altogether.
          Either way, it does not merit a BUG_ON.
      
      3. No ->fault() callback for the fs getting the corresponding page --
         seems selfish to make the system unusable.
      Signed-off-by: default avatarDavidlohr Bueso <dbueso@suse.de>
      Cc: Manfred Spraul <manfred@colorfullife.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d0edd852
    • yalin wang's avatar
      zlib_deflate/deftree: remove bi_reverse() · 8b235f2f
      yalin wang authored
      Remove bi_reverse() and use generic bitrev32() instead - it should have
      better performance on some platforms.
      Signed-off-by: default avataryalin wang <yalin.wang2010@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8b235f2f
    • Fabio Estevam's avatar
      lib/decompress_unlzma: Do a NULL check for pointer · e4e29dc4
      Fabio Estevam authored
      Compare pointer-typed values to NULL rather than 0.
      
      The semantic patch that makes this change is available
      in scripts/coccinelle/null/badzero.cocci.
      Signed-off-by: default avatarFabio Estevam <fabio.estevam@freescale.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e4e29dc4
    • Yinghai Lu's avatar
      lib/decompressors: use real out buf size for gunzip with kernel · 2d3862d2
      Yinghai Lu authored
      When loading x86 64bit kernel above 4GiB with patched grub2, got kernel
      gunzip error.
      
      | early console in decompress_kernel
      | decompress_kernel:
      |       input: [0x807f2143b4-0x807ff61aee]
      |      output: [0x807cc00000-0x807f3ea29b] 0x027ea29c: output_len
      | boot via startup_64
      | KASLR using RDTSC...
      |  new output: [0x46fe000000-0x470138cfff] 0x0338d000: output_run_size
      |  decompress: [0x46fe000000-0x47007ea29b] <=== [0x807f2143b4-0x807ff61aee]
      |
      | Decompressing Linux... gz...
      |
      | uncompression error
      |
      | -- System halted
      
      the new buffer is at 0x46fe000000ULL, decompressor_gzip is using
      0xffffffb901ffffff as out_len.  gunzip in lib/zlib_inflate/inflate.c cap
      that len to 0x01ffffff and decompress fails later.
      
      We could hit this problem with crashkernel booting that uses kexec loading
      kernel above 4GiB.
      
      We have decompress_* support:
          1. inbuf[]/outbuf[] for kernel preboot.
          2. inbuf[]/flush() for initramfs
          3. fill()/flush() for initrd.
      This bug only affect kernel preboot path that use outbuf[].
      
      Add __decompress and take real out_buf_len for gunzip instead of guessing
      wrong buf size.
      
      Fixes: 1431574a (lib/decompressors: fix "no limit" output buffer length)
      Signed-off-by: default avatarYinghai Lu <yinghai@kernel.org>
      Cc: Alexandre Courbot <acourbot@nvidia.com>
      Cc: Jon Medhurst <tixy@linaro.org>
      Cc: Stephen Warren <swarren@wwwdotorg.org>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      2d3862d2
    • Pranay Kr. Srivastava's avatar
      fs/affs: make root lookup from blkdev logical size · e852d82a
      Pranay Kr. Srivastava authored
      This patch resolves https://bugzilla.kernel.org/show_bug.cgi?id=16531.
      
      When logical blkdev size > 512 then sector numbers become larger than the
      device can support.
      
      Make affs start lookup based on the device's logical sector size instead
      of 512.
      Reported-by: default avatarMark <markk@clara.co.uk>
      Suggested-by: default avatarMark <markk@clara.co.uk>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e852d82a
    • Ilya Dryomov's avatar
      sysctl: fix int -> unsigned long assignments in INT_MIN case · 9a5bc726
      Ilya Dryomov authored
      The following
      
          if (val < 0)
              *lvalp = (unsigned long)-val;
      
      is incorrect because the compiler is free to assume -val to be positive
      and use a sign-extend instruction for extending the bit pattern.  This is
      a problem if val == INT_MIN:
      
          # echo -2147483648 >/proc/sys/dev/scsi/logging_level
          # cat /proc/sys/dev/scsi/logging_level
          -18446744071562067968
      
      Cast to unsigned long before negation - that way we first sign-extend and
      then negate an unsigned, which is well defined.  With this:
      
          # cat /proc/sys/dev/scsi/logging_level
          -2147483648
      Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
      Cc: Mikulas Patocka <mikulas@twibright.com>
      Cc: Robert Xiao <nneonneo@gmail.com>
      Cc: "Eric W. Biederman" <ebiederm@xmission.com>
      Cc: Kees Cook <keescook@chromium.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      9a5bc726
    • Baoquan He's avatar
      kexec: export KERNEL_IMAGE_SIZE to vmcoreinfo · 1303a27c
      Baoquan He authored
      In x86_64, since v2.6.26 the KERNEL_IMAGE_SIZE is changed to 512M, and
      accordingly the MODULES_VADDR is changed to 0xffffffffa0000000.  However,
      in v3.12 Kees Cook introduced kaslr to randomise the location of kernel.
      And the kernel text mapping addr space is enlarged from 512M to 1G.  That
      means now KERNEL_IMAGE_SIZE is variable, its value is 512M when kaslr
      support is not compiled in and 1G when kaslr support is compiled in.
      Accordingly the MODULES_VADDR is changed too to be:
      
          #define MODULES_VADDR    (__START_KERNEL_map + KERNEL_IMAGE_SIZE)
      
      So when kaslr is compiled in and enabled, the kernel text mapping addr
      space and modules vaddr space need be adjusted.  Otherwise makedumpfile
      will collapse since the addr for some symbols is not correct.
      
      Hence KERNEL_IMAGE_SIZE need be exported to vmcoreinfo and got in
      makedumpfile to help calculate MODULES_VADDR.
      Signed-off-by: default avatarBaoquan He <bhe@redhat.com>
      Acked-by: default avatarKees Cook <keescook@chromium.org>
      Acked-by: default avatarVivek Goyal <vgoyal@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1303a27c
    • Baoquan He's avatar
      kexec: align crash_notes allocation to make it be inside one physical page · bbb78b8f
      Baoquan He authored
      People reported that crash_notes in /proc/vmcore were corrupted and this
      cause crash kdump failure.  With code debugging and log we got the root
      cause.  This is because percpu variable crash_notes are allocated in 2
      vmalloc pages.  Currently percpu is based on vmalloc by default.  Vmalloc
      can't guarantee 2 continuous vmalloc pages are also on 2 continuous
      physical pages.  So when 1st kernel exports the starting address and size
      of crash_notes through sysfs like below:
      
      /sys/devices/system/cpu/cpux/crash_notes
      /sys/devices/system/cpu/cpux/crash_notes_size
      
      kdump kernel use them to get the content of crash_notes.  However the 2nd
      part may not be in the next neighbouring physical page as we expected if
      crash_notes are allocated accross 2 vmalloc pages.  That's why
      nhdr_ptr->n_namesz or nhdr_ptr->n_descsz could be very huge in
      update_note_header_size_elf64() and cause note header merging failure or
      some warnings.
      
      In this patch change to call __alloc_percpu() to passed in the align value
      by rounding crash_notes_size up to the nearest power of two.  This makes
      sure the crash_notes is allocated inside one physical page since
      sizeof(note_buf_t) in all ARCHS is smaller than PAGE_SIZE.  Meanwhile add
      a BUILD_BUG_ON to break compile if size is bigger than PAGE_SIZE since
      crash_notes definitely will be in 2 pages.  That need be avoided, and need
      be reported if it's unavoidable.
      
      [akpm@linux-foundation.org: use correct comment layout]
      Signed-off-by: default avatarBaoquan He <bhe@redhat.com>
      Cc: Eric W. Biederman <ebiederm@xmission.com>
      Cc: Vivek Goyal <vgoyal@redhat.com>
      Cc: Dave Young <dyoung@redhat.com>
      Cc: Lisa Mitchell <lisa.mitchell@hp.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      bbb78b8f
    • Minfei Huang's avatar
      kexec: remove unnecessary test in kimage_alloc_crash_control_pages() · 04e9949b
      Minfei Huang authored
      Transforming PFN(Page Frame Number) to struct page is never failure, so we
      can simplify the code logic to do the image->control_page assignment
      directly in the loop, and remove the unnecessary conditional judgement.
      Signed-off-by: default avatarMinfei Huang <mnfhuang@gmail.com>
      Acked-by: default avatarDave Young <dyoung@redhat.com>
      Acked-by: default avatarVivek Goyal <vgoyal@redhat.com>
      Cc: Simon Horman <horms@verge.net.au>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      04e9949b
    • Dave Young's avatar
      kexec: split kexec_load syscall from kexec core code · 2965faa5
      Dave Young authored
      There are two kexec load syscalls, kexec_load another and kexec_file_load.
       kexec_file_load has been splited as kernel/kexec_file.c.  In this patch I
      split kexec_load syscall code to kernel/kexec.c.
      
      And add a new kconfig option KEXEC_CORE, so we can disable kexec_load and
      use kexec_file_load only, or vice verse.
      
      The original requirement is from Ted Ts'o, he want kexec kernel signature
      being checked with CONFIG_KEXEC_VERIFY_SIG enabled.  But kexec-tools use
      kexec_load syscall can bypass the checking.
      
      Vivek Goyal proposed to create a common kconfig option so user can compile
      in only one syscall for loading kexec kernel.  KEXEC/KEXEC_FILE selects
      KEXEC_CORE so that old config files still work.
      
      Because there's general code need CONFIG_KEXEC_CORE, so I updated all the
      architecture Kconfig with a new option KEXEC_CORE, and let KEXEC selects
      KEXEC_CORE in arch Kconfig.  Also updated general kernel code with to
      kexec_load syscall.
      
      [akpm@linux-foundation.org: coding-style fixes]
      Signed-off-by: default avatarDave Young <dyoung@redhat.com>
      Cc: Eric W. Biederman <ebiederm@xmission.com>
      Cc: Vivek Goyal <vgoyal@redhat.com>
      Cc: Petr Tesarik <ptesarik@suse.cz>
      Cc: Theodore Ts'o <tytso@mit.edu>
      Cc: Josh Boyer <jwboyer@fedoraproject.org>
      Cc: David Howells <dhowells@redhat.com>
      Cc: Geert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      2965faa5
    • Dave Young's avatar
      kexec: split kexec_file syscall code to kexec_file.c · a43cac0d
      Dave Young authored
      Split kexec_file syscall related code to another file kernel/kexec_file.c
      so that the #ifdef CONFIG_KEXEC_FILE in kexec.c can be dropped.
      
      Sharing variables and functions are moved to kernel/kexec_internal.h per
      suggestion from Vivek and Petr.
      
      [akpm@linux-foundation.org: fix bisectability]
      [akpm@linux-foundation.org: declare the various arch_kexec functions]
      [akpm@linux-foundation.org: fix build]
      Signed-off-by: default avatarDave Young <dyoung@redhat.com>
      Cc: Eric W. Biederman <ebiederm@xmission.com>
      Cc: Vivek Goyal <vgoyal@redhat.com>
      Cc: Petr Tesarik <ptesarik@suse.cz>
      Cc: Theodore Ts'o <tytso@mit.edu>
      Cc: Josh Boyer <jwboyer@fedoraproject.org>
      Cc: David Howells <dhowells@redhat.com>
      Cc: Geert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a43cac0d
    • Andy Shevchenko's avatar
      drivers/net/wireless/ath/wil6210: use seq_hex_dump() to dump buffers · a202fbbf
      Andy Shevchenko authored
      Instead of custom approach let's use recently introduced seq_hex_dump()
      helper.
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Cc: Alexander Viro <viro@zeniv.linux.org.uk>
      Cc: Joe Perches <joe@perches.com>
      Cc: Tadeusz Struk <tadeusz.struk@intel.com>
      Cc: Helge Deller <deller@gmx.de>
      Cc: Ingo Tuchscherer <ingo.tuchscherer@de.ibm.com>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a202fbbf
    • Andy Shevchenko's avatar
      kmemleak: use seq_hex_dump() to dump buffers · 6fc37c49
      Andy Shevchenko authored
      Instead of custom approach let's use recently introduced seq_hex_dump()
      helper.
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Cc: Alexander Viro <viro@zeniv.linux.org.uk>
      Cc: Joe Perches <joe@perches.com>
      Cc: Tadeusz Struk <tadeusz.struk@intel.com>
      Cc: Helge Deller <deller@gmx.de>
      Cc: Ingo Tuchscherer <ingo.tuchscherer@de.ibm.com>
      Acked-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      Cc: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6fc37c49
    • Andy Shevchenko's avatar
      drivers/s390/crypto/zcrypt_api.c: use seq_hex_dump() to dump buffers · 5d2fe875
      Andy Shevchenko authored
      Instead of custom approach let's use recently introduced seq_hex_dump()
      helper.
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Acked-by: default avatarIngo Tuchscherer <ingo.tuchscherer@de.ibm.com>
      Cc: Alexander Viro <viro@zeniv.linux.org.uk>
      Cc: Joe Perches <joe@perches.com>
      Cc: Tadeusz Struk <tadeusz.struk@intel.com>
      Cc: Helge Deller <deller@gmx.de>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      5d2fe875
    • Andy Shevchenko's avatar
      parisc: use seq_hex_dump() to dump buffers · b342a65d
      Andy Shevchenko authored
      Instead of custom approach let's use recently introduced seq_hex_dump()
      helper.
      
      In one case it changes the output from
      	1111111122222222333333334444444455555555666666667777777788888888
      to
      	11111111 22222222 33333333 44444444 55555555 66666666 77777777 88888888
      
      though it seems it prints same data (by meaning) in both cases.  I decide
      to choose to use the space divided one.
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Acked-by: default avatarHelge Deller <deller@gmx.de>
      Cc: Alexander Viro <viro@zeniv.linux.org.uk>
      Cc: Joe Perches <joe@perches.com>
      Cc: Tadeusz Struk <tadeusz.struk@intel.com>
      Cc: Ingo Tuchscherer <ingo.tuchscherer@de.ibm.com>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b342a65d
    • Andy Shevchenko's avatar
      drivers/crypto/qat: use seq_hex_dump() to dump buffers · d0cce062
      Andy Shevchenko authored
      Instead of custom approach let's use recently introduced seq_hex_dump()
      helper.
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Acked-by: default avatarTadeusz Struk <tadeusz.struk@intel.com>
      Cc: Alexander Viro <viro@zeniv.linux.org.uk>
      Cc: Joe Perches <joe@perches.com>
      Cc: Helge Deller <deller@gmx.de>
      Cc: Ingo Tuchscherer <ingo.tuchscherer@de.ibm.com>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d0cce062
    • Andy Shevchenko's avatar
      seq_file: provide an analogue of print_hex_dump() · 37607102
      Andy Shevchenko authored
      This introduces a new helper and switches current users to use it.  All
      patches are compiled tested. kmemleak is tested via its own test suite.
      
      This patch (of 6):
      
      The new seq_hex_dump() is a complete analogue of print_hex_dump().
      
      We have few users of this functionality already. It allows to reduce their
      codebase.
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Cc: Alexander Viro <viro@zeniv.linux.org.uk>
      Cc: Joe Perches <joe@perches.com>
      Cc: Tadeusz Struk <tadeusz.struk@intel.com>
      Cc: Helge Deller <deller@gmx.de>
      Cc: Ingo Tuchscherer <ingo.tuchscherer@de.ibm.com>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      37607102
    • Jann Horn's avatar
      fs: Don't dump core if the corefile would become world-readable. · 40f705a7
      Jann Horn authored
      On a filesystem like vfat, all files are created with the same owner
      and mode independent of who created the file. When a vfat filesystem
      is mounted with root as owner of all files and read access for everyone,
      root's processes left world-readable coredumps on it (but other
      users' processes only left empty corefiles when given write access
      because of the uid mismatch).
      
      Given that the old behavior was inconsistent and insecure, I don't see
      a problem with changing it. Now, all processes refuse to dump core unless
      the resulting corefile will only be readable by their owner.
      Signed-off-by: default avatarJann Horn <jann@thejh.net>
      Acked-by: default avatarKees Cook <keescook@chromium.org>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      40f705a7
    • Jann Horn's avatar
      fs: if a coredump already exists, unlink and recreate with O_EXCL · fbb18169
      Jann Horn authored
      It was possible for an attacking user to trick root (or another user) into
      writing his coredumps into an attacker-readable, pre-existing file using
      rename() or link(), causing the disclosure of secret data from the victim
      process' virtual memory.  Depending on the configuration, it was also
      possible to trick root into overwriting system files with coredumps.  Fix
      that issue by never writing coredumps into existing files.
      
      Requirements for the attack:
       - The attack only applies if the victim's process has a nonzero
         RLIMIT_CORE and is dumpable.
       - The attacker can trick the victim into coredumping into an
         attacker-writable directory D, either because the core_pattern is
         relative and the victim's cwd is attacker-writable or because an
         absolute core_pattern pointing to a world-writable directory is used.
       - The attacker has one of these:
        A: on a system with protected_hardlinks=0:
           execute access to a folder containing a victim-owned,
           attacker-readable file on the same partition as D, and the
           victim-owned file will be deleted before the main part of the attack
           takes place. (In practice, there are lots of files that fulfill
           this condition, e.g. entries in Debian's /var/lib/dpkg/info/.)
           This does not apply to most Linux systems because most distros set
           protected_hardlinks=1.
        B: on a system with protected_hardlinks=1:
           execute access to a folder containing a victim-owned,
           attacker-readable and attacker-writable file on the same partition
           as D, and the victim-owned file will be deleted before the main part
           of the attack takes place.
           (This seems to be uncommon.)
        C: on any system, independent of protected_hardlinks:
           write access to a non-sticky folder containing a victim-owned,
           attacker-readable file on the same partition as D
           (This seems to be uncommon.)
      
      The basic idea is that the attacker moves the victim-owned file to where
      he expects the victim process to dump its core.  The victim process dumps
      its core into the existing file, and the attacker reads the coredump from
      it.
      
      If the attacker can't move the file because he does not have write access
      to the containing directory, he can instead link the file to a directory
      he controls, then wait for the original link to the file to be deleted
      (because the kernel checks that the link count of the corefile is 1).
      
      A less reliable variant that requires D to be non-sticky works with link()
      and does not require deletion of the original link: link() the file into
      D, but then unlink() it directly before the kernel performs the link count
      check.
      
      On systems with protected_hardlinks=0, this variant allows an attacker to
      not only gain information from coredumps, but also clobber existing,
      victim-writable files with coredumps.  (This could theoretically lead to a
      privilege escalation.)
      Signed-off-by: default avatarJann Horn <jann@thejh.net>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      fbb18169
    • Frederic Weisbecker's avatar
      kmod: handle UMH_WAIT_PROC from system unbound workqueue · bb304a5c
      Frederic Weisbecker authored
      The UMH_WAIT_PROC handler runs in its own thread in order to make sure
      that waiting for the exec kernel thread completion won't block other
      usermodehelper queued jobs.
      
      On older workqueue implementations, worklets couldn't sleep without
      blocking the rest of the queue.  But now the workqueue subsystem handles
      that.  Khelper still had the older limitation due to its singlethread
      properties but we replaced it to system unbound workqueues.
      
      Those are affine to the current node and can block up to some number of
      instances.
      
      They are a good candidate to handle UMH_WAIT_PROC assuming that we have
      enough system unbound workers to handle lots of parallel usermodehelper
      jobs.
      Signed-off-by: default avatarFrederic Weisbecker <fweisbec@gmail.com>
      Cc: Rik van Riel <riel@redhat.com>
      Reviewed-by: default avatarOleg Nesterov <oleg@redhat.com>
      Cc: Christoph Lameter <cl@linux.com>
      Cc: Tejun Heo <tj@kernel.org>
      Cc: Rusty Russell <rusty@rustcorp.com.au>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      bb304a5c
    • Frederic Weisbecker's avatar
      kmod: use system_unbound_wq instead of khelper · 90f02303
      Frederic Weisbecker authored
      We need to launch the usermodehelper kernel threads with the widest
      affinity and this is partly why we use khelper.  This workqueue has
      unbound properties and thus a wide affinity inherited by all its children.
      
      Now khelper also has special properties that we aren't much interested in:
      ordered and singlethread.  There is really no need about ordering as all
      we do is creating kernel threads.  This can be done concurrently.  And
      singlethread is a useless limitation as well.
      
      The workqueue engine already proposes generic unbound workqueues that
      don't share these useless properties and handle well parallel jobs.
      
      The only worrysome specific is their affinity to the node of the current
      CPU.  It's fine for creating the usermodehelper kernel threads but those
      inherit this affinity for longer jobs such as requesting modules.
      
      This patch proposes to use these node affine unbound workqueues assuming
      that a node is sufficient to handle several parallel usermodehelper
      requests.
      Signed-off-by: default avatarFrederic Weisbecker <fweisbec@gmail.com>
      Cc: Rik van Riel <riel@redhat.com>
      Reviewed-by: default avatarOleg Nesterov <oleg@redhat.com>
      Cc: Christoph Lameter <cl@linux.com>
      Cc: Tejun Heo <tj@kernel.org>
      Cc: Rusty Russell <rusty@rustcorp.com.au>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      90f02303