1. 09 Sep, 2017 9 commits
    • Colin Ian King's avatar
      staging/rts5208: fix incorrect shift to extract upper nybble · a55273d7
      Colin Ian King authored
      commit 34ff1bf4 upstream.
      
      The mask of sns_key_info1 suggests the upper nybble is being extracted
      however the following shift of 8 bits is too large and always results in
      0.  Fix this by shifting only by 4 bits to correctly get the upper nybble.
      
      Detected by CoverityScan, CID#142891 ("Operands don't affect result")
      
      Fixes: fa590c22 ("staging: rts5208: add support for rts5208 and rts5288")
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      a55273d7
    • Douglas Anderson's avatar
      USB: core: Avoid race of async_completed() w/ usbdev_release() · 9bf12567
      Douglas Anderson authored
      commit ed62ca2f upstream.
      
      While running reboot tests w/ a specific set of USB devices (and
      slub_debug enabled), I found that once every few hours my device would
      be crashed with a stack that looked like this:
      
      [   14.012445] BUG: spinlock bad magic on CPU#0, modprobe/2091
      [   14.012460]  lock: 0xffffffc0cb055978, .magic: ffffffc0, .owner: cryption contexts: %lu/%lu
      [   14.012460] /1025536097, .owner_cpu: 0
      [   14.012466] CPU: 0 PID: 2091 Comm: modprobe Not tainted 4.4.79 #352
      [   14.012468] Hardware name: Google Kevin (DT)
      [   14.012471] Call trace:
      [   14.012483] [<....>] dump_backtrace+0x0/0x160
      [   14.012487] [<....>] show_stack+0x20/0x28
      [   14.012494] [<....>] dump_stack+0xb4/0xf0
      [   14.012500] [<....>] spin_dump+0x8c/0x98
      [   14.012504] [<....>] spin_bug+0x30/0x3c
      [   14.012508] [<....>] do_raw_spin_lock+0x40/0x164
      [   14.012515] [<....>] _raw_spin_lock_irqsave+0x64/0x74
      [   14.012521] [<....>] __wake_up+0x2c/0x60
      [   14.012528] [<....>] async_completed+0x2d0/0x300
      [   14.012534] [<....>] __usb_hcd_giveback_urb+0xc4/0x138
      [   14.012538] [<....>] usb_hcd_giveback_urb+0x54/0xf0
      [   14.012544] [<....>] xhci_irq+0x1314/0x1348
      [   14.012548] [<....>] usb_hcd_irq+0x40/0x50
      [   14.012553] [<....>] handle_irq_event_percpu+0x1b4/0x3f0
      [   14.012556] [<....>] handle_irq_event+0x4c/0x7c
      [   14.012561] [<....>] handle_fasteoi_irq+0x158/0x1c8
      [   14.012564] [<....>] generic_handle_irq+0x30/0x44
      [   14.012568] [<....>] __handle_domain_irq+0x90/0xbc
      [   14.012572] [<....>] gic_handle_irq+0xcc/0x18c
      
      Investigation using kgdb() found that the wait queue that was passed
      into wake_up() had been freed (it was filled with slub_debug poison).
      
      I analyzed and instrumented the code and reproduced.  My current
      belief is that this is happening:
      
      1. async_completed() is called (from IRQ).  Moves "as" onto the
         completed list.
      2. On another CPU, proc_reapurbnonblock_compat() calls
         async_getcompleted().  Blocks on spinlock.
      3. async_completed() releases the lock; keeps running; gets blocked
         midway through wake_up().
      4. proc_reapurbnonblock_compat() => async_getcompleted() gets the
         lock; removes "as" from completed list and frees it.
      5. usbdev_release() is called.  Frees "ps".
      6. async_completed() finally continues running wake_up().  ...but
         wake_up() has a pointer to the freed "ps".
      
      The instrumentation that led me to believe this was based on adding
      some trace_printk() calls in a select few functions and then using
      kdb's "ftdump" at crash time.  The trace follows (NOTE: in the trace
      below I cheated a little bit and added a udelay(1000) in
      async_completed() after releasing the spinlock because I wanted it to
      trigger quicker):
      
      <...>-2104   0d.h2 13759034us!: async_completed at start: as=ffffffc0cc638200
      mtpd-2055    3.... 13759356us : async_getcompleted before spin_lock_irqsave
      mtpd-2055    3d..1 13759362us : async_getcompleted after list_del_init: as=ffffffc0cc638200
      mtpd-2055    3.... 13759371us+: proc_reapurbnonblock_compat: free_async(ffffffc0cc638200)
      mtpd-2055    3.... 13759422us+: async_getcompleted before spin_lock_irqsave
      mtpd-2055    3.... 13759479us : usbdev_release at start: ps=ffffffc0cc042080
      mtpd-2055    3.... 13759487us : async_getcompleted before spin_lock_irqsave
      mtpd-2055    3.... 13759497us!: usbdev_release after kfree(ps): ps=ffffffc0cc042080
      <...>-2104   0d.h2 13760294us : async_completed before wake_up(): as=ffffffc0cc638200
      
      To fix this problem we can just move the wake_up() under the ps->lock.
      There should be no issues there that I'm aware of.
      Signed-off-by: default avatarDouglas Anderson <dianders@chromium.org>
      Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      9bf12567
    • Martijn Coenen's avatar
      ANDROID: binder: add hwbinder,vndbinder to BINDER_DEVICES. · 5da7c0ce
      Martijn Coenen authored
      commit 9e18d0c8 upstream.
      
      These will be required going forward.
      Signed-off-by: default avatarMartijn Coenen <maco@android.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      5da7c0ce
    • Martijn Coenen's avatar
      ANDROID: binder: add padding to binder_fd_array_object. · df338972
      Martijn Coenen authored
      commit 5cdcf4c6 upstream.
      
      binder_fd_array_object starts with a 4-byte header,
      followed by a few fields that are 8 bytes when
      ANDROID_BINDER_IPC_32BIT=N.
      
      This can cause alignment issues in a 64-bit kernel
      with a 32-bit userspace, as on x86_32 an 8-byte primitive
      may be aligned to a 4-byte address. Pad with a __u32
      to fix this.
      Signed-off-by: default avatarMartijn Coenen <maco@android.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      df338972
    • Johan Hovold's avatar
      USB: musb: fix external abort on suspend · 26be1058
      Johan Hovold authored
      commit 082df8be upstream.
      
      Make sure that the controller is runtime resumed when system suspending
      to avoid an external abort when accessing the interrupt registers:
      
        Unhandled fault: external abort on non-linefetch (0x1008) at 0xd025840a
        ...
        [<c05481a4>] (musb_default_readb) from [<c0545abc>] (musb_disable_interrupts+0x84/0xa8)
        [<c0545abc>] (musb_disable_interrupts) from [<c0546b08>] (musb_suspend+0x38/0xb8)
        [<c0546b08>] (musb_suspend) from [<c04a57f8>] (platform_pm_suspend+0x3c/0x64)
      
      This is easily reproduced on a BBB by enabling the peripheral port only
      (as the host port may enable the shared clock) and keeping it
      disconnected so that the controller is runtime suspended. (Well, you
      would also need to the not-yet-merged am33xx-suspend patches by Dave
      Gerlach to be able to suspend the BBB.)
      
      This is a regression that was introduced by commit 1c4d0b4e ("usb:
      musb: Remove pm_runtime_set_irq_safe") which allowed the parent glue
      device to runtime suspend and thereby exposed a couple of older issues:
      
      Register accesses without explicitly making sure the controller is
      runtime resumed during suspend was first introduced by commit c338412b
      ("usb: musb: unconditionally save and restore the context on suspend")
      in 3.14.
      
      Commit a1fc1920 ("usb: musb: core: make sure musb is in RPM_ACTIVE on
      resume") later started setting the RPM status to active during resume,
      and this was also implicitly relying on the parent always being active.
      Since commit 71723f95 ("PM / runtime: print error when activating a
      child to unactive parent") this now also results in the following
      warning:
      
        musb-hdrc musb-hdrc.0: runtime PM trying to activate child device
          musb-hdrc.0 but parent (47401400.usb) is not active
      
      This patch has been verified on 4.13-rc2, 4.12 and 4.9 using a BBB
      (the dsps glue would always be active also in 4.8).
      
      Fixes: c338412b ("usb: musb: unconditionally save and restore the context on suspend")
      Fixes: a1fc1920 ("usb: musb: core: make sure musb is in RPM_ACTIVE on resume")
      Fixes: 1c4d0b4e ("usb: musb: Remove pm_runtime_set_irq_safe")
      Cc: Alan Stern <stern@rowland.harvard.edu>
      Cc: Daniel Mack <zonque@gmail.com>
      Cc: Dave Gerlach <d-gerlach@ti.com>
      Cc: Rafael J. Wysocki <rjw@rjwysocki.net>
      Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
      Cc: Tony Lindgren <tony@atomide.com>
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarBin Liu <b-liu@ti.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      26be1058
    • Sandeep Singh's avatar
      usb:xhci:Fix regression when ATI chipsets detected · 02fa8722
      Sandeep Singh authored
      commit e6b422b8 upstream.
      
      The following commit cause a regression on ATI chipsets.
      'commit e788787e ("usb:xhci:Add quirk for Certain
      failing HP keyboard on reset after resume")'
      
      This causes pinfo->smbus_dev to be wrongly set to NULL on
      systems with the ATI chipset that this function checks for first.
      
      Added conditional check for AMD chipsets to avoid the overwriting
      pinfo->smbus_dev.
      Reported-by: default avatarBen Hutchings <ben@decadent.org.uk>
      Fixes: e788787e ("usb:xhci:Add quirk for Certain
      failing HP keyboard on reset after resume")
      cc: Nehal Shah <Nehal-bakulchandra.Shah@amd.com>
      Signed-off-by: default avatarSandeep Singh <Sandeep.Singh@amd.com>
      Signed-off-by: default avatarShyam Sundar S K <Shyam-sundar.S-k@amd.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      02fa8722
    • Dmitry Fleytman's avatar
      usb: Add device quirk for Logitech HD Pro Webcam C920-C · f6f8eb10
      Dmitry Fleytman authored
      commit a1279ef7 upstream.
      
      Commit e0429362
      ("usb: Add device quirk for Logitech HD Pro Webcams C920 and C930e")
      introduced quirk to workaround an issue with some Logitech webcams.
      
      Apparently model C920-C has the same issue so applying
      the same quirk as well.
      
      See aforementioned commit message for detailed explanation of the problem.
      Signed-off-by: default avatarDmitry Fleytman <dmitry@daynix.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      f6f8eb10
    • Maciej S. Szmigiero's avatar
      USB: serial: option: add support for D-Link DWM-157 C1 · 520369b7
      Maciej S. Szmigiero authored
      commit 169e8654 upstream.
      
      This commit adds support (an ID, really) for D-Link DWM-157 hardware
      version C1 USB modem to option driver.
      
      According to manufacturer-provided Windows INF file the device has four
      serial ports:
      "D-Link HSPA+DataCard Diagnostics Interface" (interface 2; modem port),
      "D-Link HSPA+DataCard NMEA Device" (interface 3),
      "D-Link HSPA+DataCard Speech Port" (interface 4),
      "D-Link HSPA+DataCard Debug Port" (interface 5).
      
      usb-devices output:
      T:  Bus=05 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#=  3 Spd=480 MxCh= 0
      D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=2001 ProdID=7d0e Rev=03.00
      S:  Manufacturer=D-Link,Inc
      S:  Product=D-Link DWM-157
      C:  #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
      I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
      I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
      I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=02 Prot=01 Driver=option
      I:  If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
      I:  If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
      I:  If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
      I:  If#= 6 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
      Signed-off-by: default avatarMaciej S. Szmigiero <mail@maciej.szmigiero.name>
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      520369b7
    • Kai-Heng Feng's avatar
      usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard · 970974a7
      Kai-Heng Feng authored
      commit de3af5bf upstream.
      
      Corsair Strafe RGB keyboard has trouble to initialize:
      
      [ 1.679455] usb 3-6: new full-speed USB device number 4 using xhci_hcd
      [ 6.871136] usb 3-6: unable to read config index 0 descriptor/all
      [ 6.871138] usb 3-6: can't read configurations, error -110
      [ 6.991019] usb 3-6: new full-speed USB device number 5 using xhci_hcd
      [ 12.246642] usb 3-6: unable to read config index 0 descriptor/all
      [ 12.246644] usb 3-6: can't read configurations, error -110
      [ 12.366555] usb 3-6: new full-speed USB device number 6 using xhci_hcd
      [ 17.622145] usb 3-6: unable to read config index 0 descriptor/all
      [ 17.622147] usb 3-6: can't read configurations, error -110
      [ 17.742093] usb 3-6: new full-speed USB device number 7 using xhci_hcd
      [ 22.997715] usb 3-6: unable to read config index 0 descriptor/all
      [ 22.997716] usb 3-6: can't read configurations, error -110
      
      Although it may work after several times unpluging/pluging:
      
      [ 68.195240] usb 3-6: new full-speed USB device number 11 using xhci_hcd
      [ 68.337459] usb 3-6: New USB device found, idVendor=1b1c, idProduct=1b20
      [ 68.337463] usb 3-6: New USB device strings: Mfr=1, Product=2, SerialNumber=3
      [ 68.337466] usb 3-6: Product: Corsair STRAFE RGB Gaming Keyboard
      [ 68.337468] usb 3-6: Manufacturer: Corsair
      [ 68.337470] usb 3-6: SerialNumber: 0F013021AEB8046755A93ED3F5001941
      
      Tried three quirks: USB_QUIRK_DELAY_INIT, USB_QUIRK_NO_LPM and
      USB_QUIRK_DEVICE_QUALIFIER, user confirmed that USB_QUIRK_DELAY_INIT alone
      can workaround this issue. Hence add the quirk for Corsair Strafe RGB.
      
      BugLink: https://bugs.launchpad.net/bugs/1678477Signed-off-by: default avatarKai-Heng Feng <kai.heng.feng@canonical.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      970974a7
  2. 03 Sep, 2017 5 commits
  3. 02 Sep, 2017 2 commits
  4. 01 Sep, 2017 20 commits
    • Olof Johansson's avatar
      Merge tag 'mvebu-fixes-4.13-3' of git://git.infradead.org/linux-mvebu into fixes · 6f71a925
      Olof Johansson authored
      mvebu fixes for 4.13 (part 3)
      
      Fix number of GPIOs in AP806 description for Armada 7K/8K
      
      * tag 'mvebu-fixes-4.13-3' of git://git.infradead.org/linux-mvebu:
        arm64: dts: marvell: fix number of GPIOs in Armada AP806 description
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      6f71a925
    • Linus Torvalds's avatar
      Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · f8c6d724
      Linus Torvalds authored
      Pull i2c fixes from Wolfram Sang:
       "The ismt driver had a problem with a rarely used transaction type and
        the designware driver was made even more robust against non standard
        ACPI tables"
      
      * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: designware: Round down ACPI provided clk to nearest supported clk
        i2c: ismt: Return EMSGSIZE for block reads with bogus length
        i2c: ismt: Don't duplicate the receive length for block reads
      f8c6d724
    • Oleg Nesterov's avatar
      epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove() · 138e4ad6
      Oleg Nesterov authored
      The race was introduced by me in commit 971316f0 ("epoll:
      ep_unregister_pollwait() can use the freed pwq->whead").  I did not
      realize that nothing can protect eventpoll after ep_poll_callback() sets
      ->whead = NULL, only whead->lock can save us from the race with
      ep_free() or ep_remove().
      
      Move ->whead = NULL to the end of ep_poll_callback() and add the
      necessary barriers.
      
      TODO: cleanup the ewake/EPOLLEXCLUSIVE logic, it was confusing even
      before this patch.
      
      Hopefully this explains use-after-free reported by syzcaller:
      
      	BUG: KASAN: use-after-free in debug_spin_lock_before
      	...
      	 _raw_spin_lock_irqsave+0x4a/0x60 kernel/locking/spinlock.c:159
      	 ep_poll_callback+0x29f/0xff0 fs/eventpoll.c:1148
      
      this is spin_lock(eventpoll->lock),
      
      	...
      	Freed by task 17774:
      	...
      	 kfree+0xe8/0x2c0 mm/slub.c:3883
      	 ep_free+0x22c/0x2a0 fs/eventpoll.c:865
      
      Fixes: 971316f0 ("epoll: ep_unregister_pollwait() can use the freed pwq->whead")
      Reported-by: default avatar范龙飞 <long7573@126.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      138e4ad6
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 8cf9f2a2
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix handling of pinned BPF map nodes in hash of maps, from Daniel
          Borkmann.
      
       2) IPSEC ESP error paths leak memory, from Steffen Klassert.
      
       3) We need an RCU grace period before freeing fib6_node objects, from
          Wei Wang.
      
       4) Must check skb_put_padto() return value in HSR driver, from FLorian
          Fainelli.
      
       5) Fix oops on PHY probe failure in ftgmac100 driver, from Andrew
          Jeffery.
      
       6) Fix infinite loop in UDP queue when using SO_PEEK_OFF, from Eric
          Dumazet.
      
       7) Use after free when tcf_chain_destroy() called multiple times, from
          Jiri Pirko.
      
       8) Fix KSZ DSA tag layer multiple free of SKBS, from Florian Fainelli.
      
       9) Fix leak of uninitialized memory in sctp_get_sctp_info(),
          inet_diag_msg_sctpladdrs_fill() and inet_diag_msg_sctpaddrs_fill().
          From Stefano Brivio.
      
      10) L2TP tunnel refcount fixes from Guillaume Nault.
      
      11) Don't leak UDP secpath in udp_set_dev_scratch(), from Yossi
          Kauperman.
      
      12) Revert a PHY layer change wrt. handling of PHY_HALTED state in
          phy_stop_machine(), it causes regressions for multiple people. From
          Florian Fainelli.
      
      13) When packets are sent out of br0 we have to clear the
          offload_fwdq_mark value.
      
      14) Several NULL pointer deref fixes in packet schedulers when their
          ->init() routine fails. From Nikolay Aleksandrov.
      
      15) Aquantium devices cannot checksum offload correctly when the packet
          is <= 60 bytes. From Pavel Belous.
      
      16) Fix vnet header access past end of buffer in AF_PACKET, from
          Benjamin Poirier.
      
      17) Double free in probe error paths of nfp driver, from Dan Carpenter.
      
      18) QOS capability not checked properly in DCB init paths of mlx5
          driver, from Huy Nguyen.
      
      19) Fix conflicts between firmware load failure and health_care timer in
          mlx5, also from Huy Nguyen.
      
      20) Fix dangling page pointer when DMA mapping errors occur in mlx5,
          from Eran Ben ELisha.
      
      21) ->ndo_setup_tc() in bnxt_en driver doesn't count rings properly,
          from Michael Chan.
      
      22) Missing MSIX vector free in bnxt_en, also from Michael Chan.
      
      23) Refcount leak in xfrm layer when using sk_policy, from Lorenzo
          Colitti.
      
      24) Fix copy of uninitialized data in qlge driver, from Arnd Bergmann.
      
      25) bpf_setsockopts() erroneously always returns -EINVAL even on
          success. Fix from Yuchung Cheng.
      
      26) tipc_rcv() needs to linearize the SKB before parsing the inner
          headers, from Parthasarathy Bhuvaragan.
      
      27) Fix deadlock between link status updates and link removal in netvsc
          driver, from Stephen Hemminger.
      
      28) Missed locking of page fragment handling in ESP output, from Steffen
          Klassert.
      
      29) Fix refcnt leak in ebpf congestion control code, from Sabrina
          Dubroca.
      
      30) sxgbe_probe_config_dt() doesn't check devm_kzalloc()'s return value,
          from Christophe Jaillet.
      
      31) Fix missing ipv6 rx_dst_cookie update when rx_dst is updated during
          early demux, from Paolo Abeni.
      
      32) Several info leaks in xfrm_user layer, from Mathias Krause.
      
      33) Fix out of bounds read in cxgb4 driver, from Stefano Brivio.
      
      34) Properly propagate obsolete state of route upwards in ipv6 so that
          upper holders like xfrm can see it. From Xin Long.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (118 commits)
        udp: fix secpath leak
        bridge: switchdev: Clear forward mark when transmitting packet
        mlxsw: spectrum: Forbid linking to devices that have uppers
        wl1251: add a missing spin_lock_init()
        Revert "net: phy: Correctly process PHY_HALTED in phy_stop_machine()"
        net: dsa: bcm_sf2: Fix number of CFP entries for BCM7278
        kcm: do not attach PF_KCM sockets to avoid deadlock
        sch_tbf: fix two null pointer dereferences on init failure
        sch_sfq: fix null pointer dereference on init failure
        sch_netem: avoid null pointer deref on init failure
        sch_fq_codel: avoid double free on init failure
        sch_cbq: fix null pointer dereferences on init failure
        sch_hfsc: fix null pointer deref and double free on init failure
        sch_hhf: fix null pointer dereference on init failure
        sch_multiq: fix double free on init failure
        sch_htb: fix crash on init failure
        net/mlx5e: Fix CQ moderation mode not set properly
        net/mlx5e: Fix inline header size for small packets
        net/mlx5: E-Switch, Unload the representors in the correct order
        net/mlx5e: Properly resolve TC offloaded ipv6 vxlan tunnel source address
        ...
      8cf9f2a2
    • Linus Torvalds's avatar
      Merge tag 'ceph-for-4.13-rc8' of git://github.com/ceph/ceph-client · b8a78bb4
      Linus Torvalds authored
      Pull ceph fix from Ilya Dryomov:
       "ceph fscache page locking fix from Zheng, marked for stable"
      
      * tag 'ceph-for-4.13-rc8' of git://github.com/ceph/ceph-client:
        ceph: fix readpage from fscache
      b8a78bb4
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 3e1d79c8
      Linus Torvalds authored
      Pull input fixes from Dmitry Torokhov:
       "Just a couple drivers fixes (Synaptics PS/2, Xpad)"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: xpad - fix PowerA init quirk for some gamepad models
        Input: synaptics - fix device info appearing different on reconnect
      3e1d79c8
    • Linus Torvalds's avatar
      Merge tag 'mmc-v4.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · d7e44b86
      Linus Torvalds authored
      Pull two more MMC fixes from Ulf Hansson:
       "MMC core:
         - Fix block status codes
      
        MMC host:
         - sdhci-xenon: Fix SD bus voltage select"
      
      * tag 'mmc-v4.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: sdhci-xenon: add set_power callback
        mmc: block: Fix block status codes
      d7e44b86
    • Linus Torvalds's avatar
      Merge tag 'sound-4.13-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 381cce59
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "Three regression fixes that should be addressed before the final
        release: a missing mutex call in OSS PCM emulation ioctl, ASoC rt5670
        headset detection breakage, and a regression in simple-card parser
        code"
      
      * tag 'sound-4.13-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ASoC: simple_card_utils: fix fallback when "label" property isn't present
        ALSA: pcm: Fix power lock unbalance via OSS emulation
        ASoC: rt5670: Fix GPIO headset detection regression
      381cce59
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · bba2a5b8
      Linus Torvalds authored
      Pull s390 fixes from Martin Schwidefsky:
       "Three more bug fixes for v4.13.
      
        The two memory management related fixes are quite new, they fix kernel
        crashes that can be triggered by user space.
      
        The third commit fixes a bug in the vfio ccw translation code"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        s390/mm: fix BUG_ON in crst_table_upgrade
        s390/mm: fork vs. 5 level page tabel
        vfio: ccw: fix bad ptr math for TIC cda translation
      bba2a5b8
    • Linus Torvalds's avatar
      Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · a1c516a6
      Linus Torvalds authored
      Pull crypto fixes from Herbert Xu:
       "This fixes the following issues:
      
         - Regression in chacha20 handling of chunked input
      
         - Crash in algif_skcipher when used with async io
      
         - Potential bogus pointer dereference in lib/mpi"
      
      * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        crypto: algif_skcipher - only call put_page on referenced and used pages
        crypto: testmgr - add chunked test cases for chacha20
        crypto: chacha20 - fix handling of chunked input
        lib/mpi: kunmap after finishing accessing buffer
      a1c516a6
    • Yossi Kuperman's avatar
      udp: fix secpath leak · e8a732d1
      Yossi Kuperman authored
      After commit dce4551c ("udp: preserve head state for IP_CMSG_PASSSEC")
      we preserve the secpath for the whole skb lifecycle, but we also
      end up leaking a reference to it.
      
      We must clear the head state on skb reception, if secpath is
      present.
      
      Fixes: dce4551c ("udp: preserve head state for IP_CMSG_PASSSEC")
      Signed-off-by: default avatarYossi Kuperman <yossiku@mellanox.com>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e8a732d1
    • Ido Schimmel's avatar
      bridge: switchdev: Clear forward mark when transmitting packet · 79e99bdd
      Ido Schimmel authored
      Commit 6bc506b4 ("bridge: switchdev: Add forward mark support for
      stacked devices") added the 'offload_fwd_mark' bit to the skb in order
      to allow drivers to indicate to the bridge driver that they already
      forwarded the packet in L2.
      
      In case the bit is set, before transmitting the packet from each port,
      the port's mark is compared with the mark stored in the skb's control
      block. If both marks are equal, we know the packet arrived from a switch
      device that already forwarded the packet and it's not re-transmitted.
      
      However, if the packet is transmitted from the bridge device itself
      (e.g., br0), we should clear the 'offload_fwd_mark' bit as the mark
      stored in the skb's control block isn't valid.
      
      This scenario can happen in rare cases where a packet was trapped during
      L3 forwarding and forwarded by the kernel to a bridge device.
      
      Fixes: 6bc506b4 ("bridge: switchdev: Add forward mark support for stacked devices")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Reported-by: default avatarYotam Gigi <yotamg@mellanox.com>
      Tested-by: default avatarYotam Gigi <yotamg@mellanox.com>
      Reviewed-by: default avatarJiri Pirko <jiri@mellanox.com>
      Acked-by: default avatarNikolay Aleksandrov <nikolay@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      79e99bdd
    • Ido Schimmel's avatar
      mlxsw: spectrum: Forbid linking to devices that have uppers · 25cc72a3
      Ido Schimmel authored
      The mlxsw driver relies on NETDEV_CHANGEUPPER events to configure the
      device in case a port is enslaved to a master netdev such as bridge or
      bond.
      
      Since the driver ignores events unrelated to its ports and their
      uppers, it's possible to engineer situations in which the device's data
      path differs from the kernel's.
      
      One example to such a situation is when a port is enslaved to a bond
      that is already enslaved to a bridge. When the bond was enslaved the
      driver ignored the event - as the bond wasn't one of its uppers - and
      therefore a bridge port instance isn't created in the device.
      
      Until such configurations are supported forbid them by checking that the
      upper device doesn't have uppers of its own.
      
      Fixes: 0d65fc13 ("mlxsw: spectrum: Implement LAG port join/leave")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Reported-by: default avatarNogah Frankel <nogahf@mellanox.com>
      Tested-by: default avatarNogah Frankel <nogahf@mellanox.com>
      Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      25cc72a3
    • Steve French's avatar
      Fix warning messages when mounting to older servers · 7e682f76
      Steve French authored
      When mounting to older servers, such as Windows XP (or even Windows 7),
      the limited error messages that can be passed back to user space can
      get confusing since the default dialect has changed from SMB1 (CIFS) to
      more secure SMB3 dialect. Log additional information when the user chooses
      to use the default dialects and when the server does not support the
      dialect requested.
      Signed-off-by: default avatarSteve French <smfrench@gmail.com>
      Reviewed-by: default avatarRonnie Sahlberg <lsahlber@redhat.com>
      Acked-by: default avatarPavel Shilovsky <pshilov@microsoft.com>
      7e682f76
    • Linus Torvalds's avatar
      Merge tag 'cifs-fixes-for-4.13-rc7-and-stable' of git://git.samba.org/sfrench/cifs-2.6 · e89ce1f8
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
       "Two cifs bug fixes for stable"
      
      * tag 'cifs-fixes-for-4.13-rc7-and-stable' of git://git.samba.org/sfrench/cifs-2.6:
        CIFS: remove endian related sparse warning
        CIFS: Fix maximum SMB2 header size
      e89ce1f8
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · 501d9f79
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "Unfortunately a few issues that warrant sending another pull request,
        even if I had hoped to avoid it. This contains:
      
         - A fix for multiqueue xen-blkback, on tear down / disconnect.
      
         - A few fixups for NVMe, including a wrong bit definition, fix for
           host memory buffers, and an nvme rdma page size fix"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        nvme: fix the definition of the doorbell buffer config support bit
        nvme-pci: use dma memory for the host memory buffer descriptors
        nvme-rdma: default MR page size to 4k
        xen-blkback: stop blkback thread of every queue in xen_blkif_disconnect
      501d9f79
    • Linus Torvalds's avatar
      Merge tag 'for-4.13/dm-fixes-2' of... · 73adb8c5
      Linus Torvalds authored
      Merge tag 'for-4.13/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
      
      Pull device mapper fixes from Mike Snitzer:
      
       - A couple fixes for bugs introduced as part of the blk_status_t block
         layer changes during the 4.13 merge window
      
       - A printk throttling fix to use discrete rate limiting state for each
         DM log level
      
       - A stable@ fix for DM multipath that delays request requeueing to
         avoid CPU lockup if/when the request queue is "dying"
      
      * tag 'for-4.13/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
        dm mpath: do not lock up a CPU with requeuing activity
        dm: fix printk() rate limiting code
        dm mpath: retry BLK_STS_RESOURCE errors
        dm: fix the second dec_pending() argument in __split_and_process_bio()
      73adb8c5
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · 1b2614f1
      Linus Torvalds authored
      Merge more fixes from Andrew Morton:
       "6 fixes"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        scripts/dtc: fix '%zx' warning
        include/linux/compiler.h: don't perform compiletime_assert with -O0
        mm, madvise: ensure poisoned pages are removed from per-cpu lists
        mm, uprobes: fix multiple free of ->uprobes_state.xol_area
        kernel/kthread.c: kthread_worker: don't hog the cpu
        mm,page_alloc: don't call __node_reclaim() with oom_lock held.
      1b2614f1
    • Linus Torvalds's avatar
      Merge branch 'mmu_notifier_fixes' · ea25c431
      Linus Torvalds authored
      Merge mmu_notifier fixes from Jérôme Glisse:
       "The invalidate_page callback suffered from 2 pitfalls. First it used
        to happen after page table lock was release and thus a new page might
        have been setup for the virtual address before the call to
        invalidate_page().
      
        This is in a weird way fixed by commit c7ab0d2f ("mm: convert
        try_to_unmap_one() to use page_vma_mapped_walk()") which moved the
        callback under the page table lock. Which also broke several existing
        user of the mmu_notifier API that assumed they could sleep inside this
        callback.
      
        The second pitfall was invalidate_page being the only callback not
        taking a range of address in respect to invalidation but was giving an
        address and a page. Lot of the callback implementer assumed this could
        never be THP and thus failed to invalidate the appropriate range for
        THP pages.
      
        By killing this callback we unify the mmu_notifier callback API to
        always take a virtual address range as input.
      
        There is now two clear API (I am not mentioning the youngess API which
        is seldomly used):
      
         - invalidate_range_start()/end() callback (which allow you to sleep)
      
         - invalidate_range() where you can not sleep but happen right after
           page table update under page table lock
      
        Note that a lot of existing user feels broken in respect to
        range_start/ range_end. Many user only have range_start() callback but
        there is nothing preventing them to undo what was invalidated in their
        range_start() callback after it returns but before any CPU page table
        update take place.
      
        The code pattern use in kvm or umem odp is an example on how to
        properly avoid such race. In a nutshell use some kind of sequence
        number and active range invalidation counter to block anything that
        might undo what the range_start() callback did.
      
        If you do not care about keeping fully in sync with CPU page table (ie
        you can live with CPU page table pointing to new different page for a
        given virtual address) then you can take a reference on the pages
        inside the range_start callback and drop it in range_end or when your
        driver is done with those pages.
      
        Last alternative is to use invalidate_range() if you can do
        invalidation without sleeping as invalidate_range() callback happens
        under the CPU page table spinlock right after the page table is
        updated.
      
        The first two patches convert existing mmu_notifier_invalidate_page()
        calls to mmu_notifier_invalidate_range() and bracket those call with
        call to mmu_notifier_invalidate_range_start()/end().
      
        The next ten patches remove existing invalidate_page() callback as it
        can no longer happen.
      
        Finally the last page remove the invalidate_page() callback completely
        so it can RIP.
      
        Changes since v1:
         - remove more dead code in kvm (no testing impact)
         - more accurate end address computation (patch 2) in page_mkclean_one
           and try_to_unmap_one
         - added tested-by/reviewed-by gotten so far"
      
      * emailed patches from Jérôme Glisse <jglisse@redhat.com>:
        mm/mmu_notifier: kill invalidate_page
        KVM: update to new mmu_notifier semantic v2
        xen/gntdev: update to new mmu_notifier semantic
        sgi-gru: update to new mmu_notifier semantic
        misc/mic/scif: update to new mmu_notifier semantic
        iommu/intel: update to new mmu_notifier semantic
        iommu/amd: update to new mmu_notifier semantic
        IB/hfi1: update to new mmu_notifier semantic
        IB/umem: update to new mmu_notifier semantic
        drm/amdgpu: update to new mmu_notifier semantic
        powerpc/powernv: update to new mmu_notifier semantic
        mm/rmap: update to new mmu_notifier semantic v2
        dax: update to new mmu_notifier semantic
      ea25c431
    • Dave Kleikamp's avatar
      jfs should use MAX_LFS_FILESIZE when calculating s_maxbytes · c227390c
      Dave Kleikamp authored
      jfs had previously avoided the use of MAX_LFS_FILESIZE because it hadn't
      accounted for the whole 32-bit index range on 32-bit systems.  That has
      been fixed by commit 0cc3b0ec ("Clarify (and fix) MAX_LFS_FILESIZE
      macros"), so we can simplify the code now.
      
      Suggested by Andreas Dilger.
      Signed-off-by: default avatarDave Kleikamp <dave.kleikamp@oracle.com>
      Reviewed-by: default avatarAndreas Dilger <adilger@dilger.ca>
      Cc: jfs-discussion@lists.sourceforge.net
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c227390c
  5. 31 Aug, 2017 4 commits
    • Russell King's avatar
      scripts/dtc: fix '%zx' warning · e6618692
      Russell King authored
      dtc uses an incorrect format specifier for printing a uint64_t value.
      uint64_t may be either 'unsigned long' or 'unsigned long long' depending
      on the host architecture.
      
      Fix this by using %llx and casting to unsigned long long, which ensures
      that we always have a wide enough variable to print 64 bits of hex.
      
          HOSTCC  scripts/dtc/checks.o
        scripts/dtc/checks.c: In function 'check_simple_bus_reg':
        scripts/dtc/checks.c:876:2: warning: format '%zx' expects argument of type 'size_t', but argument 4 has type 'uint64_t' [-Wformat=]
          snprintf(unit_addr, sizeof(unit_addr), "%zx", reg);
          ^
        scripts/dtc/checks.c:876:2: warning: format '%zx' expects argument of type 'size_t', but argument 4 has type 'uint64_t' [-Wformat=]
      
      Link: http://lkml.kernel.org/r/20170829222034.GJ20805@n2100.armlinux.org.uk
      Fixes: 828d4cdd ("dtc: check.c fix compile error")
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Cc: Rob Herring <robh+dt@kernel.org>
      Cc: Frank Rowand <frowand.list@gmail.com>
      Cc: Shuah Khan <shuahkh@osg.samsung.com>
      Cc: David Gibson <david@gibson.dropbear.id.au>
      Cc: Michal Marek <mmarek@suse.cz>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e6618692
    • Joe Stringer's avatar
      include/linux/compiler.h: don't perform compiletime_assert with -O0 · c03567a8
      Joe Stringer authored
      Commit c7acec71 ("kernel.h: handle pointers to arrays better in
      container_of()") made use of __compiletime_assert() from container_of()
      thus increasing the usage of this macro, allowing developers to notice
      type conflicts in usage of container_of() at compile time.
      
      However, the implementation of __compiletime_assert relies on compiler
      optimizations to report an error.  This means that if a developer uses
      "-O0" with any code that performs container_of(), the compiler will always
      report an error regardless of whether there is an actual problem in the
      code.
      
      This patch disables compile_time_assert when optimizations are disabled to
      allow such code to compile with CFLAGS="-O0".
      
      Example compilation failure:
      
      ./include/linux/compiler.h:547:38: error: call to `__compiletime_assert_94' declared with attribute error: pointer type mismatch in container_of()
        _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__)
                                            ^
      ./include/linux/compiler.h:530:4: note: in definition of macro `__compiletime_assert'
          prefix ## suffix();    \
          ^~~~~~
      ./include/linux/compiler.h:547:2: note: in expansion of macro `_compiletime_assert'
        _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__)
        ^~~~~~~~~~~~~~~~~~~
      ./include/linux/build_bug.h:46:37: note: in expansion of macro `compiletime_assert'
       #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
                                           ^~~~~~~~~~~~~~~~~~
      ./include/linux/kernel.h:860:2: note: in expansion of macro `BUILD_BUG_ON_MSG'
        BUILD_BUG_ON_MSG(!__same_type(*(ptr), ((type *)0)->member) && \
        ^~~~~~~~~~~~~~~~
      
      [akpm@linux-foundation.org: use do{}while(0), per Michal]
      Link: http://lkml.kernel.org/r/20170829230114.11662-1-joe@ovn.org
      Fixes: c7acec71 ("kernel.h: handle pointers to arrays better in container_of()")
      Signed-off-by: default avatarJoe Stringer <joe@ovn.org>
      Cc: Ian Abbott <abbotti@mev.co.uk>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Michal Nazarewicz <mina86@mina86.com>
      Cc: Kees Cook <keescook@chromium.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c03567a8
    • Mel Gorman's avatar
      mm, madvise: ensure poisoned pages are removed from per-cpu lists · c461ad6a
      Mel Gorman authored
      Wendy Wang reported off-list that a RAS HWPOISON-SOFT test case failed
      and bisected it to the commit 479f854a ("mm, page_alloc: defer
      debugging checks of pages allocated from the PCP").
      
      The problem is that a page that was poisoned with madvise() is reused.
      The commit removed a check that would trigger if DEBUG_VM was enabled
      but re-enabling the check only fixes the problem as a side-effect by
      printing a bad_page warning and recovering.
      
      The root of the problem is that an madvise() can leave a poisoned page
      on the per-cpu list.  This patch drains all per-cpu lists after pages
      are poisoned so that they will not be reused.  Wendy reports that the
      test case in question passes with this patch applied.  While this could
      be done in a targeted fashion, it is over-complicated for such a rare
      operation.
      
      Link: http://lkml.kernel.org/r/20170828133414.7qro57jbepdcyz5x@techsingularity.net
      Fixes: 479f854a ("mm, page_alloc: defer debugging checks of pages allocated from the PCP")
      Signed-off-by: default avatarMel Gorman <mgorman@techsingularity.net>
      Reported-by: default avatarWang, Wendy <wendy.wang@intel.com>
      Tested-by: default avatarWang, Wendy <wendy.wang@intel.com>
      Acked-by: default avatarDavid Rientjes <rientjes@google.com>
      Acked-by: default avatarVlastimil Babka <vbabka@suse.cz>
      Cc: "Hansen, Dave" <dave.hansen@intel.com>
      Cc: "Luck, Tony" <tony.luck@intel.com>
      Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c461ad6a
    • Eric Biggers's avatar
      mm, uprobes: fix multiple free of ->uprobes_state.xol_area · 355627f5
      Eric Biggers authored
      Commit 7c051267 ("mm, fork: make dup_mmap wait for mmap_sem for
      write killable") made it possible to kill a forking task while it is
      waiting to acquire its ->mmap_sem for write, in dup_mmap().
      
      However, it was overlooked that this introduced an new error path before
      the new mm_struct's ->uprobes_state.xol_area has been set to NULL after
      being copied from the old mm_struct by the memcpy in dup_mm().  For a
      task that has previously hit a uprobe tracepoint, this resulted in the
      'struct xol_area' being freed multiple times if the task was killed at
      just the right time while forking.
      
      Fix it by setting ->uprobes_state.xol_area to NULL in mm_init() rather
      than in uprobe_dup_mmap().
      
      With CONFIG_UPROBE_EVENTS=y, the bug can be reproduced by the same C
      program given by commit 2b7e8665 ("fork: fix incorrect fput of
      ->exe_file causing use-after-free"), provided that a uprobe tracepoint
      has been set on the fork_thread() function.  For example:
      
          $ gcc reproducer.c -o reproducer -lpthread
          $ nm reproducer | grep fork_thread
          0000000000400719 t fork_thread
          $ echo "p $PWD/reproducer:0x719" > /sys/kernel/debug/tracing/uprobe_events
          $ echo 1 > /sys/kernel/debug/tracing/events/uprobes/enable
          $ ./reproducer
      
      Here is the use-after-free reported by KASAN:
      
          BUG: KASAN: use-after-free in uprobe_clear_state+0x1c4/0x200
          Read of size 8 at addr ffff8800320a8b88 by task reproducer/198
      
          CPU: 1 PID: 198 Comm: reproducer Not tainted 4.13.0-rc7-00015-g36fde05f #255
          Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-20170228_101828-anatol 04/01/2014
          Call Trace:
           dump_stack+0xdb/0x185
           print_address_description+0x7e/0x290
           kasan_report+0x23b/0x350
           __asan_report_load8_noabort+0x19/0x20
           uprobe_clear_state+0x1c4/0x200
           mmput+0xd6/0x360
           do_exit+0x740/0x1670
           do_group_exit+0x13f/0x380
           get_signal+0x597/0x17d0
           do_signal+0x99/0x1df0
           exit_to_usermode_loop+0x166/0x1e0
           syscall_return_slowpath+0x258/0x2c0
           entry_SYSCALL_64_fastpath+0xbc/0xbe
      
          ...
      
          Allocated by task 199:
           save_stack_trace+0x1b/0x20
           kasan_kmalloc+0xfc/0x180
           kmem_cache_alloc_trace+0xf3/0x330
           __create_xol_area+0x10f/0x780
           uprobe_notify_resume+0x1674/0x2210
           exit_to_usermode_loop+0x150/0x1e0
           prepare_exit_to_usermode+0x14b/0x180
           retint_user+0x8/0x20
      
          Freed by task 199:
           save_stack_trace+0x1b/0x20
           kasan_slab_free+0xa8/0x1a0
           kfree+0xba/0x210
           uprobe_clear_state+0x151/0x200
           mmput+0xd6/0x360
           copy_process.part.8+0x605f/0x65d0
           _do_fork+0x1a5/0xbd0
           SyS_clone+0x19/0x20
           do_syscall_64+0x22f/0x660
           return_from_SYSCALL_64+0x0/0x7a
      
      Note: without KASAN, you may instead see a "Bad page state" message, or
      simply a general protection fault.
      
      Link: http://lkml.kernel.org/r/20170830033303.17927-1-ebiggers3@gmail.com
      Fixes: 7c051267 ("mm, fork: make dup_mmap wait for mmap_sem for write killable")
      Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
      Reported-by: default avatarOleg Nesterov <oleg@redhat.com>
      Acked-by: default avatarOleg Nesterov <oleg@redhat.com>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Konstantin Khlebnikov <koct9i@gmail.com>
      Cc: Mark Rutland <mark.rutland@arm.com>
      Cc: Michal Hocko <mhocko@suse.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Cc: <stable@vger.kernel.org>    [4.7+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      355627f5