1. 08 Nov, 2016 7 commits
  2. 07 Nov, 2016 4 commits
  3. 06 Nov, 2016 1 commit
    • Guenter Roeck's avatar
      openrisc: Define __ro_after_init to avoid crash · 2c7a5c5c
      Guenter Roeck authored
      openrisc qemu tests fail with the following crash.
      
      Unable to handle kernel access at virtual address 0xc0300c34
      
      Oops#: 0001
      CPU #: 0
         PC: c016c710    SR: 0000ae67    SP: c1017e04
         GPR00: 00000000 GPR01: c1017e04 GPR02: c0300c34 GPR03: c0300c34
         GPR04: 00000000 GPR05: c0300cb0 GPR06: c0300c34 GPR07: 000000ff
         GPR08: c107f074 GPR09: c0199ef4 GPR10: c1016000 GPR11: 00000000
         GPR12: 00000000 GPR13: c107f044 GPR14: c0473774 GPR15: 07ce0000
         GPR16: 00000000 GPR17: c107ed8a GPR18: 00009600 GPR19: c107f044
         GPR20: c107ee74 GPR21: 00000003 GPR22: c0473770 GPR23: 00000033
         GPR24: 000000bf GPR25: 00000019 GPR26: c046400c GPR27: 00000001
         GPR28: c0464028 GPR29: c1018000 GPR30: 00000006 GPR31: ccf37483
           RES: 00000000 oGPR11: ffffffff
           Process swapper (pid: 1, stackpage=c1001960)
      
           Stack: Stack dump [0xc1017cf8]:
           sp + 00: 0xc1017e04
           sp + 04: 0xc0300c34
           sp + 08: 0xc0300c34
           sp + 12: 0x00000000
      ...
      
      Bisect points to commit d2ec3f77 ("pty: make ptmx file ops read-only
      after init"). Fix by defining __ro_after_init for the openrisc
      architecture, similar to parisc.
      
      Fixes: d2ec3f77 ("pty: make ptmx file ops read-only after init")
      Cc: Kees Cook <keescook@chromium.org>
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Acked-by: default avatarStafford Horne <shorne@gmail.com>
      2c7a5c5c
  4. 05 Nov, 2016 21 commits
  5. 04 Nov, 2016 7 commits
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-for-v4.9-rc4' of git://people.freedesktop.org/~airlied/linux · d4c5f43d
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Fixes for amdgpu, radeon, intel, imx and virtio-gpu.
      
        This is a bit larger than I'd like, but I had some stuff I meant to
        send for -rc3 but was waiting for the PAT regression fix to land. So
        this is really fixes for rc3 and rc4 in one go.
      
        There are a set of fixes for an oops we've been seeing around MST
        display unplug, along with more suspend/resume and shutdown fixes for
        amdgpu, one power management follow on fix for nouveau, and set of imx
        fixes, and a single virtio-gpu regression fix"
      
      * tag 'drm-fixes-for-v4.9-rc4' of git://people.freedesktop.org/~airlied/linux: (54 commits)
        virtio-gpu: fix vblank events
        drm/nouveau/acpi: fix check for power resources support
        drm/i915: Fix SKL+ 90/270 degree rotated plane coordinate computation
        drm/i915: Remove two invalid warns
        drm/i915: Rotated view does not need a fence
        drm/i915/fbc: fix CFB size calculation for gen8+
        drm: i915: Wait for fences on new fb, not old
        drm/i915: Clean up DDI DDC/AUX CH sanitation
        drm/i915: Respect alternate_aux_channel for all DDI ports
        drm/i915/gen9: fix watermarks when using the pipe scaler
        drm/i915: Fix mismatched INIT power domain disabling during suspend
        drm/i915: fix a read size argument
        drm/i915: Use fence_write() from rpm resume
        drm/i915/gen9: fix DDB partitioning for multi-screen cases
        drm/i915: workaround sparse warning on variable length arrays
        drm/i915: keep declarations in i915_drv.h
        drm/amd/powerplay: fix bug get wrong evv voltage of Polaris.
        drm/amdgpu/si_dpm: workaround for SI kickers
        drm/radeon/si_dpm: workaround for SI kickers
        drm/amdgpu: fix s3 resume back, uvd dpm randomly can't disable.
        ...
      d4c5f43d
    • Niklas Cassel's avatar
      PCI: designware: Check for iATU unroll support after initializing host · 416379f9
      Niklas Cassel authored
      dw_pcie_iatu_unroll_enabled() reads a dbi_base register.  Reading any
      dbi_base register before pp->ops->host_init has been called causes
      "imprecise external abort" on platforms like ARTPEC-6, where the PCIe
      module is disabled at boot and first enabled in pp->ops->host_init.  Move
      dw_pcie_iatu_unroll_enabled() to dw_pcie_setup_rc(), since it is after
      pp->ops->host_init, but before pp->iatu_unroll_enabled is actually used.
      
      Fixes: a0601a47 ("PCI: designware: Add iATU Unroll feature")
      Tested-by: default avatarJames Le Cuirot <chewi@gentoo.org>
      Signed-off-by: default avatarNiklas Cassel <niklas.cassel@axis.com>
      Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
      Acked-by: default avatarJoao Pinto <jpinto@synopsys.com>
      Acked-by: default avatarOlof Johansson <olof@lixom.net>
      416379f9
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 66cecb67
      Linus Torvalds authored
      Pull KVM updates from Paolo Bonzini:
       "One NULL pointer dereference, and two fixes for regressions introduced
        during the merge window.
      
        The rest are fixes for MIPS, s390 and nested VMX"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        kvm: x86: Check memopp before dereference (CVE-2016-8630)
        kvm: nVMX: VMCLEAR an active shadow VMCS after last use
        KVM: x86: drop TSC offsetting kvm_x86_ops to fix KVM_GET/SET_CLOCK
        KVM: x86: fix wbinvd_dirty_mask use-after-free
        kvm/x86: Show WRMSR data is in hex
        kvm: nVMX: Fix kernel panics induced by illegal INVEPT/INVVPID types
        KVM: document lock orders
        KVM: fix OOPS on flush_work
        KVM: s390: Fix STHYI buffer alignment for diag224
        KVM: MIPS: Precalculate MMIO load resume PC
        KVM: MIPS: Make ERET handle ERL before EXL
        KVM: MIPS: Fix lazy user ASID regenerate for SMP
      66cecb67
    • Linus Torvalds's avatar
      Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus · 34c510b2
      Linus Torvalds authored
      Pull MIPS fixes from Ralf Baechle:
       "A set of MIPS fixes for 4.9:
      
         - lots of fixes for printk continuations
         - six fixes for FP related code.
         - fix max_low_pfn with disabled highmem
         - fix KASLR handling of NULL FDT and KASLR for generic kernels
         - fix build of compressed image
         - provide default mips_cpc_default_phys_base to ignore CPC
         - fix reboot on Malta"
      
      * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
        MIPS: Fix max_low_pfn with disabled highmem
        MIPS: Correct MIPS I FP sigcontext layout
        MIPS: Fix ISA I/II FP signal context offsets
        MIPS: Remove FIR from ISA I FP signal context
        MIPS: Fix ISA I FP sigcontext access violation handling
        MIPS: Fix FCSR Cause bit handling for correct SIGFPE issue
        MIPS: ptrace: Also initialize the FP context on individual FCSR writes
        MIPS: dump_tlb: Fix printk continuations
        MIPS: Fix __show_regs() output
        MIPS: traps: Fix output of show_code
        MIPS: traps: Fix output of show_stacktrace
        MIPS: traps: Fix output of show_backtrace
        MIPS: Fix build of compressed image
        MIPS: generic: Fix KASLR for generic kernel.
        MIPS: KASLR: Fix handling of NULL FDT
        MIPS: Malta: Fixup reboot
        MIPS: CPC: Provide default mips_cpc_default_phys_base to ignore CPC
      34c510b2
    • Linus Torvalds's avatar
      Merge branch 'parisc-4.9-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux · f7df76e6
      Linus Torvalds authored
      Pull parisc updates from Helge Deller:
       "The first three patches are trivial and add some required KERN_CONT,
        ignore the new pkey syscalls on parisc and use the LINUX_GATEWAY_ADDR
        define instead of hardcoded values.
      
        The two patches from Dave Anglin are important.
      
        The first one avoids trashing the sr2 and sr3 space registers in the
        Light-weight syscall path. Especially the usage of sr3 is critical
        since it may get trashed by the interrupt handler.
      
        The second patch is even more important and tagged for stable series.
        It protects one critical section in the syscall entry path by
        disabling local interrupts. Without disabling interrupts, the sr7
        space register may not be in sync with the current stack setup and
        thus an incoming hardware interrupt may destroy memory in random
        userspace areas"
      
      * 'parisc-4.9-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
        parisc: Ignore the pkey system calls for now
        parisc: Use LINUX_GATEWAY_ADDR define instead of hardcoded value
        parisc: Ensure consistent state when switching to kernel stack at syscall entry
        parisc: Avoid trashing sr2 and sr3 in LWS code
        parisc: use KERN_CONT when printing device inventory
      f7df76e6
    • Vladimir Zapolskiy's avatar
      i2c: core: fix NULL pointer dereference under race condition · 147b36d5
      Vladimir Zapolskiy authored
      Race condition between registering an I2C device driver and
      deregistering an I2C adapter device which is assumed to manage that
      I2C device may lead to a NULL pointer dereference due to the
      uninitialized list head of driver clients.
      
      The root cause of the issue is that the I2C bus may know about the
      registered device driver and thus it is matched by bus_for_each_drv(),
      but the list of clients is not initialized and commonly it is NULL,
      because I2C device drivers define struct i2c_driver as static and
      clients field is expected to be initialized by I2C core:
      
        i2c_register_driver()             i2c_del_adapter()
          driver_register()                 ...
            bus_add_driver()                ...
              ...                           bus_for_each_drv(..., __process_removed_adapter)
            ...                               i2c_do_del_adapter()
          ...                                   list_for_each_entry_safe(..., &driver->clients, ...)
          INIT_LIST_HEAD(&driver->clients);
      
      To solve the problem it is sufficient to do clients list head
      initialization before calling driver_register().
      
      The problem was found while using an I2C device driver with a sluggish
      registration routine on a bus provided by a physically detachable I2C
      master controller, but practically the oops may be reproduced under
      the race between arbitraty I2C device driver registration and managing
      I2C bus device removal e.g. by unbinding the latter over sysfs:
      
      % echo 21a4000.i2c > /sys/bus/platform/drivers/imx-i2c/unbind
        Unable to handle kernel NULL pointer dereference at virtual address 00000000
        Internal error: Oops: 17 [#1] SMP ARM
        CPU: 2 PID: 533 Comm: sh Not tainted 4.9.0-rc3+ #61
        Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
        task: e5ada400 task.stack: e4936000
        PC is at i2c_do_del_adapter+0x20/0xcc
        LR is at __process_removed_adapter+0x14/0x1c
        Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
        Control: 10c5387d  Table: 35bd004a  DAC: 00000051
        Process sh (pid: 533, stack limit = 0xe4936210)
        Stack: (0xe4937d28 to 0xe4938000)
        Backtrace:
        [<c0667be0>] (i2c_do_del_adapter) from [<c0667cc0>] (__process_removed_adapter+0x14/0x1c)
        [<c0667cac>] (__process_removed_adapter) from [<c0516998>] (bus_for_each_drv+0x6c/0xa0)
        [<c051692c>] (bus_for_each_drv) from [<c06685ec>] (i2c_del_adapter+0xbc/0x284)
        [<c0668530>] (i2c_del_adapter) from [<bf0110ec>] (i2c_imx_remove+0x44/0x164 [i2c_imx])
        [<bf0110a8>] (i2c_imx_remove [i2c_imx]) from [<c051a838>] (platform_drv_remove+0x2c/0x44)
        [<c051a80c>] (platform_drv_remove) from [<c05183d8>] (__device_release_driver+0x90/0x12c)
        [<c0518348>] (__device_release_driver) from [<c051849c>] (device_release_driver+0x28/0x34)
        [<c0518474>] (device_release_driver) from [<c0517150>] (unbind_store+0x80/0x104)
        [<c05170d0>] (unbind_store) from [<c0516520>] (drv_attr_store+0x28/0x34)
        [<c05164f8>] (drv_attr_store) from [<c0298acc>] (sysfs_kf_write+0x50/0x54)
        [<c0298a7c>] (sysfs_kf_write) from [<c029801c>] (kernfs_fop_write+0x100/0x214)
        [<c0297f1c>] (kernfs_fop_write) from [<c0220130>] (__vfs_write+0x34/0x120)
        [<c02200fc>] (__vfs_write) from [<c0221088>] (vfs_write+0xa8/0x170)
        [<c0220fe0>] (vfs_write) from [<c0221e74>] (SyS_write+0x4c/0xa8)
        [<c0221e28>] (SyS_write) from [<c0108a20>] (ret_fast_syscall+0x0/0x1c)
      Signed-off-by: default avatarVladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
      Signed-off-by: default avatarWolfram Sang <wsa@the-dreams.de>
      Cc: stable@kernel.org
      147b36d5
    • James Hogan's avatar
      MIPS: Fix max_low_pfn with disabled highmem · 16a767ec
      James Hogan authored
      When low memory doesn't reach HIGHMEM_START (e.g. up to 256MB at PA=0 is
      common) and highmem is present above HIGHMEM_START (e.g. on Malta the
      RAM overlayed by the IO region is aliased at PA=0x90000000), max_low_pfn
      will be initially calculated very large and then clipped down to
      HIGHMEM_START.
      
      This causes crashes when reading /sys/kernel/mm/page_idle/bitmap
      (i.e. CONFIG_IDLE_PAGE_TRACKING=y) when highmem is disabled. pfn_valid()
      will compare against max_mapnr which is derived from max_low_pfn when
      there is no highend_pfn set up, and will return true for PFNs right up
      to HIGHMEM_START, even though they are beyond the end of low memory and
      no page structs will actually exist for these PFNs.
      
      This is fixed by skipping high memory regions when initially calculating
      max_low_pfn if highmem is disabled, so it doesn't get clipped too high.
      We also clip regions which overlap the highmem boundary when highmem is
      disabled, so that max_pfn doesn't extend into highmem either.
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: Paul Burton <paul.burton@imgtec.com>
      Cc: linux-mips@linux-mips.org
      Patchwork: https://patchwork.linux-mips.org/patch/14490/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      16a767ec