1. 25 Jan, 2019 2 commits
    • Takashi Iwai's avatar
      ALSA: pcm: Fix tight loop of OSS capture stream · e190161f
      Takashi Iwai authored
      When the trigger=off is passed for a PCM OSS stream, it sets the
      start_threshold of the given substream to the boundary size, so that
      it won't be automatically started.  This can be problematic for a
      capture stream, unfortunately, as detected by syzkaller.  The scenario
      is like the following:
      
      - In __snd_pcm_lib_xfer() that is invoked from snd_pcm_oss_read()
        loop, we have a check whether the stream was already started or the
        stream can be auto-started.
      - The function at this check returns 0 with trigger=off since we
        explicitly disable the auto-start.
      - The loop continues and repeats calling __snd_pcm_lib_xfer() tightly,
        which may lead to an RCU stall.
      
      This patch fixes the bug by simply allowing the wait for non-started
      stream in the case of OSS capture.  For native usages, it's supposed
      to be done by the caller side (which is user-space), hence it returns
      zero like before.
      
      (In theory, __snd_pcm_lib_xfer() could wait even for the native API
       usage cases, too; but I'd like to stay in a safer side for not
       breaking the existing stuff for now.)
      
      Reported-by: syzbot+fbe0496f92a0ce7b786c@syzkaller.appspotmail.com
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      e190161f
    • Olek Poplavsky's avatar
      ALSA: usb-audio: Add Opus #3 to quirks for native DSD support · 9e696664
      Olek Poplavsky authored
      This patch adds quirk VID/PID IDs for the Opus #3 DAP (made by 'The Bit')
      in order to enable Native DSD support.
      
      [ NOTE: this could be handled in the generic way with fp->dvd_raw if
        we add 0x10cb to the vendor whitelist, but since 0x10cb shows a
        different vendor name (Erantech), put to the individual entry at
        this time -- tiwai ]
      Signed-off-by: default avatarOlek Poplavsky <woodenbits@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      9e696664
  2. 21 Jan, 2019 1 commit
  3. 18 Jan, 2019 1 commit
    • Takashi Iwai's avatar
      Merge tag 'asoc-fix-v5.0-rc2' of... · b3c4014c
      Takashi Iwai authored
      Merge tag 'asoc-fix-v5.0-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
      
      ASoC: Fixes for v5.0
      
      Quite a big batch of fixes here.  There's a couple of things going on,
      the main one is that we found some issues with not deferring probe when
      we should, causing us to skip some driver initialization.  The fixes for
      this then in turn exposed some issues with how we were searching for
      components which had previously gone unnoticed due to the original
      issue.
      
      There's also been the normal driver specific stuff and there's been what
      looks like several batches of automated scanning for issues which have
      generated quite a large set of smaller fixes for potential crashes and
      missed error handling.
      b3c4014c
  4. 15 Jan, 2019 7 commits
    • Gustavo A. R. Silva's avatar
      ASoC: amd: Fix potential NULL pointer dereference · 4cb79ef9
      Gustavo A. R. Silva authored
      Check return value from call to devm_kzalloc() in order to prevent a
      potential NULL pointer dereference.
      
      Also, notice that it makes no sense to allocate any resources if
      res = platform_get_resource(pdev, IORESOURCE_MEM, 0); fails,
      so move the call to devm_kzalloc() below the mentioned code.
      
      Lastly, improve the use of sizeof in the call to devm_kzalloc() by
      changing it from sizeof(struct i2s_dev_data) to sizeof(*adata)
      
      This issue was detected with the help of Coccinelle.
      
      Fixes: ac289c7e ("ASoC: amd: add ACP3x PCM platform driver")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarGustavo A. R. Silva <gustavo@embeddedor.com>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      4cb79ef9
    • Silvio Cesare's avatar
      ASoC: imx-audmux: change snprintf to scnprintf for possible overflow · c407cd00
      Silvio Cesare authored
      Change snprintf to scnprintf. There are generally two cases where using
      snprintf causes problems.
      
      1) Uses of size += snprintf(buf, SIZE - size, fmt, ...)
      In this case, if snprintf would have written more characters than what the
      buffer size (SIZE) is, then size will end up larger than SIZE. In later
      uses of snprintf, SIZE - size will result in a negative number, leading
      to problems. Note that size might already be too large by using
      size = snprintf before the code reaches a case of size += snprintf.
      
      2) If size is ultimately used as a length parameter for a copy back to user
      space, then it will potentially allow for a buffer overflow and information
      disclosure when size is greater than SIZE. When the size is used to index
      the buffer directly, we can have memory corruption. This also means when
      size = snprintf... is used, it may also cause problems since size may become
      large.  Copying to userspace is mitigated by the HARDENED_USERCOPY kernel
      configuration.
      
      The solution to these issues is to use scnprintf which returns the number of
      characters actually written to the buffer, so the size variable will never
      exceed SIZE.
      Signed-off-by: default avatarSilvio Cesare <silvio.cesare@gmail.com>
      Cc: Timur Tabi <timur@kernel.org>
      Cc: Nicolin Chen <nicoleotsuka@gmail.com>
      Cc: Mark Brown <broonie@kernel.org>
      Cc: Xiubo Li <Xiubo.Lee@gmail.com>
      Cc: Fabio Estevam <fabio.estevam@nxp.com>
      Cc: Dan Carpenter <dan.carpenter@oracle.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: Greg KH <greg@kroah.com>
      Signed-off-by: default avatarWilly Tarreau <w@1wt.eu>
      Acked-by: default avatarNicolin Chen <nicoleotsuka@gmail.com>
      Reviewed-by: default avatarKees Cook <keescook@chromium.org>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      c407cd00
    • Gustavo A. R. Silva's avatar
      ASoC: rt5514-spi: Fix potential NULL pointer dereference · 060d0bf4
      Gustavo A. R. Silva authored
      There is a potential NULL pointer dereference in case devm_kzalloc()
      fails and returns NULL.
      
      Fix this by adding a NULL check on rt5514_dsp.
      
      This issue was detected with the help of Coccinelle.
      
      Fixes: 6eebf35b ("ASoC: rt5514: add rt5514 SPI driver")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarGustavo A. R. Silva <gustavo@embeddedor.com>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      060d0bf4
    • Silvio Cesare's avatar
      ASoC: dapm: change snprintf to scnprintf for possible overflow · e581e151
      Silvio Cesare authored
      Change snprintf to scnprintf. There are generally two cases where using
      snprintf causes problems.
      
      1) Uses of size += snprintf(buf, SIZE - size, fmt, ...)
      In this case, if snprintf would have written more characters than what the
      buffer size (SIZE) is, then size will end up larger than SIZE. In later
      uses of snprintf, SIZE - size will result in a negative number, leading
      to problems. Note that size might already be too large by using
      size = snprintf before the code reaches a case of size += snprintf.
      
      2) If size is ultimately used as a length parameter for a copy back to user
      space, then it will potentially allow for a buffer overflow and information
      disclosure when size is greater than SIZE. When the size is used to index
      the buffer directly, we can have memory corruption. This also means when
      size = snprintf... is used, it may also cause problems since size may become
      large.  Copying to userspace is mitigated by the HARDENED_USERCOPY kernel
      configuration.
      
      The solution to these issues is to use scnprintf which returns the number of
      characters actually written to the buffer, so the size variable will never
      exceed SIZE.
      Signed-off-by: default avatarSilvio Cesare <silvio.cesare@gmail.com>
      Cc: Liam Girdwood <lgirdwood@gmail.com>
      Cc: Mark Brown <broonie@kernel.org>
      Cc: Dan Carpenter <dan.carpenter@oracle.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: Greg KH <greg@kroah.com>
      Signed-off-by: default avatarWilly Tarreau <w@1wt.eu>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      e581e151
    • Shuming Fan's avatar
      ASoC: rt5682: Fix PLL source register definitions · ee7ea2a9
      Shuming Fan authored
      Fix typo which causes headphone no sound while using BCLK
      as PLL source.
      Signed-off-by: default avatarShuming Fan <shumingf@realtek.com>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      ee7ea2a9
    • Matthias Reichl's avatar
      ASoC: core: Don't defer probe on optional, NULL components · 2833548e
      Matthias Reichl authored
      cpu and platform are optional components in DAI links. For example
      codec-codec links usually have no platform set.
      
      Call snd_soc_find_component only if the name or of_node of
      a cpu or platform is set. Otherwise it will return NULL and
      soc_init_dai_link bails out immediately with -EPROBE_DEFER,
      meaning registering a card with NULL cpu or platform in DAI links
      can never succeed.
      
      Fixes: 8780cf11 ("ASoC: soc-core: defer card probe until all component is added to list")
      Signed-off-by: default avatarMatthias Reichl <hias@horus.com>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      2833548e
    • Mark Brown's avatar
      ASoC: core: Make snd_soc_find_component() more robust · 5a7b2aab
      Mark Brown authored
      There are some use cases where you're checking for a lot of things on a
      card and it makes sense that you might end up trying to call
      snd_soc_find_component() without either a name or an of_node.  Currently
      in that case we try to dereference the name and crash but it's more
      useful to allow the caller to just treat that as a case where we don't
      find anything, that error handling will already exist.
      
      Inspired by a patch from Ajit Pandey fixing some callers.
      
      Fixes: 8780cf11 ("ASoC: soc-core: defer card probe until all component is added to list")
      Reported-by: default avatarPierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      5a7b2aab
  5. 14 Jan, 2019 3 commits
    • Curtis Malainey's avatar
      ASoC: soc-core: fix init platform memory handling · 09ac6a81
      Curtis Malainey authored
      snd_soc_init_platform initializes pointers to snd_soc_dai_link which is
      statically allocated and it does this by devm_kzalloc. In the event of
      an EPROBE_DEFER the memory will be freed and the pointers are left
      dangling. snd_soc_init_platform sees the dangling pointers and assumes
      they are pointing to initialized memory and does not reallocate them on
      the second probe attempt which results in a use after free bug since
      devm has freed the memory from the first probe attempt.
      
      Since the intention for snd_soc_dai_link->platform is that it can be set
      statically by the machine driver we need to respect the pointer in the
      event we did not set it but still catch dangling pointers. The solution
      is to add a flag to track whether the pointer was dynamically allocated
      or not.
      Signed-off-by: default avatarCurtis Malainey <cujomalainey@chromium.org>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      09ac6a81
    • Takashi Iwai's avatar
      ASoC: intel: skl: Fix display power regression · 687ae9e2
      Takashi Iwai authored
      Since the refactoring of HD-audio display power management, the
      display power status is managed per domain.  Meanwhile the ASoC
      hdac_hdmi driver still keeps and relies (incorrectly) on the
      refcounting together with ASoC skl driver, and this leads to the
      display state always on.
      
      This patch is an attempt to address the regression by simplifying the
      PM code of ASoC skl and hdac_hdmi drivers.  Basically, since the
      refactoring, we don't have to manage the display power at HD-audio
      controller suspend / resume but only at HD-audio HDMI codec suspend /
      resume.  So the patch drops the superfluous snd_hdac_display_power()
      calls in skl driver.
      
      Meanwhile, in hdac_hdmi side, we rewrite the PM call just to re-use
      the runtime PM callbacks like other drivers do.  Now the logic is
      simple: turn off at suspend and turn on at resume.
      
      The patch also fixes the possibly missing display-power off at skl
      driver removal as well as some error paths at probe.
      
      Fixes: 029d92c2 ("ALSA: hda: Refactor display power management")
      Reported-by: default avatarLibin Yang <libin.yang@intel.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      687ae9e2
    • Kailang Yang's avatar
      ALSA: hda/realtek - Fix typo for ALC225 model · 82aa0d7e
      Kailang Yang authored
      Fix typo for model alc255-dell1 to alc225-dell1.
      
      Enable headset mode support for new WYSE NB platform.
      
      Fixes: a26d96c7 ("ALSA: hda/realtek - Comprehensive model list for ALC259 & co")
      Signed-off-by: default avatarKailang Yang <kailang@realtek.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      82aa0d7e
  6. 10 Jan, 2019 1 commit
  7. 09 Jan, 2019 4 commits
  8. 08 Jan, 2019 2 commits
  9. 07 Jan, 2019 10 commits
    • Kangjie Lu's avatar
      ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages · 44fabd8c
      Kangjie Lu authored
      snd_pcm_lib_malloc_pages() may fail, so let's check its status and
      return its error code upstream.
      Signed-off-by: default avatarKangjie Lu <kjlu@umn.edu>
      Acked-by: default avatarPierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      Cc: stable@vger.kernel.org
      44fabd8c
    • b-ak's avatar
      ASoC: tlv320aic32x4: Kernel OOPS while entering DAPM standby mode · 667e9334
      b-ak authored
      During the bootup of the kernel, the DAPM bias level is in the OFF
      state. As soon as the DAPM framework kicks in it pushes the codec
      into STANDBY state.
      
      The probe function doesn't prepare the clock, and STANDBY state
      does a clk_disable_unprepare() without checking the previous state.
      This leads to an OOPS.
      
      Not transitioning from an OFF state to the STANDBY state fixes the
      problem.
      Signed-off-by: default avatarb-ak <anur.bhargav@gmail.com>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      Cc: stable@vger.kernel.org
      667e9334
    • Kailang Yang's avatar
      ALSA: hda/realtek - Support Dell headset mode for New AIO platform · c2a7c55a
      Kailang Yang authored
      Dell has new platform for ALC274.
      This will support to enable headset mode.
      Signed-off-by: default avatarKailang Yang <kailang@realtek.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      c2a7c55a
    • Hui Peng's avatar
      ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks · cbb2ebf7
      Hui Peng authored
      In `create_composite_quirk`, the terminating condition of for loops is
      `quirk->ifnum < 0`. So any composite quirks should end with `struct
      snd_usb_audio_quirk` object with ifnum < 0.
      
          for (quirk = quirk_comp->data; quirk->ifnum >= 0; ++quirk) {
      
          	.....
          }
      
      the data field of Bower's & Wilkins PX headphones usb device device quirks
      do not end with {.ifnum = -1}, wihch may result in out-of-bound read.
      
      This Patch fix the bug by adding an ending quirk object.
      
      Fixes: 240a8af9 ("ALSA: usb-audio: Add a quirck for B&W PX headphones")
      Signed-off-by: default avatarHui Peng <benquike@163.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      cbb2ebf7
    • Takashi Iwai's avatar
      ALSA: usb-audio: Always check descriptor sizes in parser code · 3e96d728
      Takashi Iwai authored
      There are a few places where we access the data without checking the
      actual object size from the USB audio descriptor.  This may result in
      OOB access, as recently reported.
      
      This patch addresses these missing checks.  Most of added codes are
      simple bLength checks in the caller side.  For the input and output
      terminal parsers, we put the length check in the parser functions.
      For the input terminal, a new argument is added to distinguish between
      UAC1 and the rest, as they treat different objects.
      Reported-by: default avatarMathias Payer <mathias.payer@nebelwelt.net>
      Reported-by: default avatarHui Peng <benquike@163.com>
      Tested-by: default avatarHui Peng <benquike@163.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      3e96d728
    • Takashi Iwai's avatar
      ALSA: usb-audio: Check mixer unit descriptors more strictly · 0bfe5e43
      Takashi Iwai authored
      We've had some sanity checks of the mixer unit descriptors but they
      are too loose and some corner cases are overlooked.  Add more strict
      checks in uac_mixer_unit_get_channels() for avoiding possible OOB
      accesses by malformed descriptors.
      
      This also changes the semantics of uac_mixer_unit_get_channels()
      slightly.  Now it returns zero for the cases where the descriptor
      lacks of bmControls instead of -EINVAL.  Then the caller side skips
      the mixer creation for such unit while it keeps parsing it.
      This corresponds to the case like Maya44.
      
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      0bfe5e43
    • Takashi Iwai's avatar
      ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit() · f4351a19
      Takashi Iwai authored
      The parser for the processing unit reads bNrInPins field before the
      bLength sanity check, which may lead to an out-of-bound access when a
      malformed descriptor is given.  Fix it by assignment after the bLength
      check.
      
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      f4351a19
    • Linus Torvalds's avatar
      Linux 5.0-rc1 · bfeffd15
      Linus Torvalds authored
      bfeffd15
    • Linus Torvalds's avatar
      Merge tag 'kbuild-v4.21-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild · 85e1ffbd
      Linus Torvalds authored
      Pull more Kbuild updates from Masahiro Yamada:
      
       - improve boolinit.cocci and use_after_iter.cocci semantic patches
      
       - fix alignment for kallsyms
      
       - move 'asm goto' compiler test to Kconfig and clean up jump_label
         CONFIG option
      
       - generate asm-generic wrappers automatically if arch does not
         implement mandatory UAPI headers
      
       - remove redundant generic-y defines
      
       - misc cleanups
      
      * tag 'kbuild-v4.21-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
        kconfig: rename generated .*conf-cfg to *conf-cfg
        kbuild: remove unnecessary stubs for archheader and archscripts
        kbuild: use assignment instead of define ... endef for filechk_* rules
        arch: remove redundant UAPI generic-y defines
        kbuild: generate asm-generic wrappers if mandatory headers are missing
        arch: remove stale comments "UAPI Header export list"
        riscv: remove redundant kernel-space generic-y
        kbuild: change filechk to surround the given command with { }
        kbuild: remove redundant target cleaning on failure
        kbuild: clean up rule_dtc_dt_yaml
        kbuild: remove UIMAGE_IN and UIMAGE_OUT
        jump_label: move 'asm goto' support test to Kconfig
        kallsyms: lower alignment on ARM
        scripts: coccinelle: boolinit: drop warnings on named constants
        scripts: coccinelle: check for redeclaration
        kconfig: remove unused "file" field of yylval union
        nds32: remove redundant kernel-space generic-y
        nios2: remove unneeded HAS_DMA define
      85e1ffbd
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · ac5eed2b
      Linus Torvalds authored
      Pull perf tooling updates form Ingo Molnar:
       "A final batch of perf tooling changes: mostly fixes and small
        improvements"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (29 commits)
        perf session: Add comment for perf_session__register_idle_thread()
        perf thread-stack: Fix thread stack processing for the idle task
        perf thread-stack: Allocate an array of thread stacks
        perf thread-stack: Factor out thread_stack__init()
        perf thread-stack: Allow for a thread stack array
        perf thread-stack: Avoid direct reference to the thread's stack
        perf thread-stack: Tidy thread_stack__bottom() usage
        perf thread-stack: Simplify some code in thread_stack__process()
        tools gpio: Allow overriding CFLAGS
        tools power turbostat: Override CFLAGS assignments and add LDFLAGS to build command
        tools thermal tmon: Allow overriding CFLAGS assignments
        tools power x86_energy_perf_policy: Override CFLAGS assignments and add LDFLAGS to build command
        perf c2c: Increase the HITM ratio limit for displayed cachelines
        perf c2c: Change the default coalesce setup
        perf trace beauty ioctl: Beautify USBDEVFS_ commands
        perf trace beauty: Export function to get the files for a thread
        perf trace: Wire up ioctl's USBDEBFS_ cmd table generator
        perf beauty ioctl: Add generator for USBDEVFS_ ioctl commands
        tools headers uapi: Grab a copy of usbdevice_fs.h
        perf trace: Store the major number for a file when storing its pathname
        ...
      ac5eed2b
  10. 06 Jan, 2019 9 commits
    • Linus Torvalds's avatar
      Change mincore() to count "mapped" pages rather than "cached" pages · 574823bf
      Linus Torvalds authored
      The semantics of what "in core" means for the mincore() system call are
      somewhat unclear, but Linux has always (since 2.3.52, which is when
      mincore() was initially done) treated it as "page is available in page
      cache" rather than "page is mapped in the mapping".
      
      The problem with that traditional semantic is that it exposes a lot of
      system cache state that it really probably shouldn't, and that users
      shouldn't really even care about.
      
      So let's try to avoid that information leak by simply changing the
      semantics to be that mincore() counts actual mapped pages, not pages
      that might be cheaply mapped if they were faulted (note the "might be"
      part of the old semantics: being in the cache doesn't actually guarantee
      that you can access them without IO anyway, since things like network
      filesystems may have to revalidate the cache before use).
      
      In many ways the old semantics were somewhat insane even aside from the
      information leak issue.  From the very beginning (and that beginning is
      a long time ago: 2.3.52 was released in March 2000, I think), the code
      had a comment saying
      
        Later we can get more picky about what "in core" means precisely.
      
      and this is that "later".  Admittedly it is much later than is really
      comfortable.
      
      NOTE! This is a real semantic change, and it is for example known to
      change the output of "fincore", since that program literally does a
      mmmap without populating it, and then doing "mincore()" on that mapping
      that doesn't actually have any pages in it.
      
      I'm hoping that nobody actually has any workflow that cares, and the
      info leak is real.
      
      We may have to do something different if it turns out that people have
      valid reasons to want the old semantics, and if we can limit the
      information leak sanely.
      
      Cc: Kevin Easton <kevin@guarana.org>
      Cc: Jiri Kosina <jikos@kernel.org>
      Cc: Masatake YAMATO <yamato@redhat.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Michal Hocko <mhocko@suse.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      574823bf
    • Linus Torvalds's avatar
      Fix 'acccess_ok()' on alpha and SH · 94bd8a05
      Linus Torvalds authored
      Commit 594cc251 ("make 'user_access_begin()' do 'access_ok()'")
      broke both alpha and SH booting in qemu, as noticed by Guenter Roeck.
      
      It turns out that the bug wasn't actually in that commit itself (which
      would have been surprising: it was mostly a no-op), but in how the
      addition of access_ok() to the strncpy_from_user() and strnlen_user()
      functions now triggered the case where those functions would test the
      access of the very last byte of the user address space.
      
      The string functions actually did that user range test before too, but
      they did it manually by just comparing against user_addr_max().  But
      with user_access_begin() doing the check (using "access_ok()"), it now
      exposed problems in the architecture implementations of that function.
      
      For example, on alpha, the access_ok() helper macro looked like this:
      
        #define __access_ok(addr, size) \
              ((get_fs().seg & (addr | size | (addr+size))) == 0)
      
      and what it basically tests is of any of the high bits get set (the
      USER_DS masking value is 0xfffffc0000000000).
      
      And that's completely wrong for the "addr+size" check.  Because it's
      off-by-one for the case where we check to the very end of the user
      address space, which is exactly what the strn*_user() functions do.
      
      Why? Because "addr+size" will be exactly the size of the address space,
      so trying to access the last byte of the user address space will fail
      the __access_ok() check, even though it shouldn't.  As a result, the
      user string accessor functions failed consistently - because they
      literally don't know how long the string is going to be, and the max
      access is going to be that last byte of the user address space.
      
      Side note: that alpha macro is buggy for another reason too - it re-uses
      the arguments twice.
      
      And SH has another version of almost the exact same bug:
      
        #define __addr_ok(addr) \
              ((unsigned long __force)(addr) < current_thread_info()->addr_limit.seg)
      
      so far so good: yes, a user address must be below the limit.  But then:
      
        #define __access_ok(addr, size)         \
              (__addr_ok((addr) + (size)))
      
      is wrong with the exact same off-by-one case: the case when "addr+size"
      is exactly _equal_ to the limit is actually perfectly fine (think "one
      byte access at the last address of the user address space")
      
      The SH version is actually seriously buggy in another way: it doesn't
      actually check for overflow, even though it did copy the _comment_ that
      talks about overflow.
      
      So it turns out that both SH and alpha actually have completely buggy
      implementations of access_ok(), but they happened to work in practice
      (although the SH overflow one is a serious serious security bug, not
      that anybody likely cares about SH security).
      
      This fixes the problems by using a similar macro on both alpha and SH.
      It isn't trying to be clever, the end address is based on this logic:
      
              unsigned long __ao_end = __ao_a + __ao_b - !!__ao_b;
      
      which basically says "add start and length, and then subtract one unless
      the length was zero".  We can't subtract one for a zero length, or we'd
      just hit an underflow instead.
      
      For a lot of access_ok() users the length is a constant, so this isn't
      actually as expensive as it initially looks.
      Reported-and-tested-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Cc: Matt Turner <mattst88@gmail.com>
      Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      94bd8a05
    • Linus Torvalds's avatar
      Merge tag 'fscrypt_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/fscrypt · baa67073
      Linus Torvalds authored
      Pull fscrypt updates from Ted Ts'o:
       "Add Adiantum support for fscrypt"
      
      * tag 'fscrypt_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/fscrypt:
        fscrypt: add Adiantum support
      baa67073
    • Linus Torvalds's avatar
      Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · 21524046
      Linus Torvalds authored
      Pull ext4 bug fixes from Ted Ts'o:
       "Fix a number of ext4 bugs"
      
      * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4: fix special inode number checks in __ext4_iget()
        ext4: track writeback errors using the generic tracking infrastructure
        ext4: use ext4_write_inode() when fsyncing w/o a journal
        ext4: avoid kernel warning when writing the superblock to a dead device
        ext4: fix a potential fiemap/page fault deadlock w/ inline_data
        ext4: make sure enough credits are reserved for dioread_nolock writes
      21524046
    • Linus Torvalds's avatar
      Merge tag 'dma-mapping-4.21-1' of git://git.infradead.org/users/hch/dma-mapping · e2b745f4
      Linus Torvalds authored
      Pull dma-mapping fixes from Christoph Hellwig:
       "Fix various regressions introduced in this cycles:
      
         - fix dma-debug tracking for the map_page / map_single
           consolidatation
      
         - properly stub out DMA mapping symbols for !HAS_DMA builds to avoid
           link failures
      
         - fix AMD Gart direct mappings
      
         - setup the dma address for no kernel mappings using the remap
           allocator"
      
      * tag 'dma-mapping-4.21-1' of git://git.infradead.org/users/hch/dma-mapping:
        dma-direct: fix DMA_ATTR_NO_KERNEL_MAPPING for remapped allocations
        x86/amd_gart: fix unmapping of non-GART mappings
        dma-mapping: remove a few unused exports
        dma-mapping: properly stub out the DMA API for !CONFIG_HAS_DMA
        dma-mapping: remove dmam_{declare,release}_coherent_memory
        dma-mapping: implement dmam_alloc_coherent using dmam_alloc_attrs
        dma-mapping: implement dma_map_single_attrs using dma_map_page_attrs
      e2b745f4
    • Linus Torvalds's avatar
      Merge tag 'tag-chrome-platform-for-v4.21' of... · 12133258
      Linus Torvalds authored
      Merge tag 'tag-chrome-platform-for-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/bleung/chrome-platform
      
      Pull chrome platform updates from Benson Leung:
      
       - Changes for EC_MKBP_EVENT_SENSOR_FIFO handling.
      
       - Also, maintainership changes. Olofj out, Enric balletbo in.
      
      * tag 'tag-chrome-platform-for-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/bleung/chrome-platform:
        MAINTAINERS: add maintainers for ChromeOS EC sub-drivers
        MAINTAINERS: platform/chrome: Add Enric as a maintainer
        MAINTAINERS: platform/chrome: remove myself as maintainer
        platform/chrome: don't report EC_MKBP_EVENT_SENSOR_FIFO as wakeup
        platform/chrome: straighten out cros_ec_get_{next,host}_event() error codes
      12133258
    • Linus Torvalds's avatar
      Merge tag 'hwlock-v4.21' of git://github.com/andersson/remoteproc · 66e012f6
      Linus Torvalds authored
      Pull hwspinlock updates from Bjorn Andersson:
       "This adds support for the hardware semaphores found in STM32MP1"
      
      * tag 'hwlock-v4.21' of git://github.com/andersson/remoteproc:
        hwspinlock: fix return value check in stm32_hwspinlock_probe()
        hwspinlock: add STM32 hwspinlock device
        dt-bindings: hwlock: Document STM32 hwspinlock bindings
      66e012f6
    • Eric Biggers's avatar
      fscrypt: add Adiantum support · 8094c3ce
      Eric Biggers authored
      Add support for the Adiantum encryption mode to fscrypt.  Adiantum is a
      tweakable, length-preserving encryption mode with security provably
      reducible to that of XChaCha12 and AES-256, subject to a security bound.
      It's also a true wide-block mode, unlike XTS.  See the paper
      "Adiantum: length-preserving encryption for entry-level processors"
      (https://eprint.iacr.org/2018/720.pdf) for more details.  Also see
      commit 059c2a4d ("crypto: adiantum - add Adiantum support").
      
      On sufficiently long messages, Adiantum's bottlenecks are XChaCha12 and
      the NH hash function.  These algorithms are fast even on processors
      without dedicated crypto instructions.  Adiantum makes it feasible to
      enable storage encryption on low-end mobile devices that lack AES
      instructions; currently such devices are unencrypted.  On ARM Cortex-A7,
      on 4096-byte messages Adiantum encryption is about 4 times faster than
      AES-256-XTS encryption; decryption is about 5 times faster.
      
      In fscrypt, Adiantum is suitable for encrypting both file contents and
      names.  With filenames, it fixes a known weakness: when two filenames in
      a directory share a common prefix of >= 16 bytes, with CTS-CBC their
      encrypted filenames share a common prefix too, leaking information.
      Adiantum does not have this problem.
      
      Since Adiantum also accepts long tweaks (IVs), it's also safe to use the
      master key directly for Adiantum encryption rather than deriving
      per-file keys, provided that the per-file nonce is included in the IVs
      and the master key isn't used for any other encryption mode.  This
      configuration saves memory and improves performance.  A new fscrypt
      policy flag is added to allow users to opt-in to this configuration.
      Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      8094c3ce
    • Linus Torvalds's avatar
      Merge tag 'docs-5.0-fixes' of git://git.lwn.net/linux · b5aef86e
      Linus Torvalds authored
      Pull documentation fixes from Jonathan Corbet:
       "A handful of late-arriving documentation fixes"
      
      * tag 'docs-5.0-fixes' of git://git.lwn.net/linux:
        doc: filesystems: fix bad references to nonexistent ext4.rst file
        Documentation/admin-guide: update URL of LKML information link
        Docs/kernel-api.rst: Remove blk-tag.c reference
      b5aef86e