1. 01 Jul, 2019 1 commit
    • Christian Brauner's avatar
      fork: return proper negative error code · 28dd29c0
      Christian Brauner authored
      Make sure to return a proper negative error code from copy_process()
      when anon_inode_getfile() fails with CLONE_PIDFD.
      Otherwise _do_fork() will not detect an error and get_task_pid() will
      operator on a nonsensical pointer:
      
      R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc2c
      R13: 00007ffc15fbb0ff R14: 00007ff07e47e9c0 R15: 0000000000000000
      kasan: CONFIG_KASAN_INLINE enabled
      kasan: GPF could be caused by NULL-ptr deref or user memory access
      general protection fault: 0000 [#1] PREEMPT SMP KASAN
      CPU: 1 PID: 7990 Comm: syz-executor290 Not tainted 5.2.0-rc6+ #9
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
      Google 01/01/2011
      RIP: 0010:__read_once_size include/linux/compiler.h:194 [inline]
      RIP: 0010:get_task_pid+0xe1/0x210 kernel/pid.c:372
      Code: 89 ff e8 62 27 5f 00 49 8b 07 44 89 f1 4c 8d bc c8 90 01 00 00 eb 0c
      e8 0d fe 25 00 49 81 c7 38 05 00 00 4c 89 f8 48 c1 e8 03 <80> 3c 18 00 74
      08 4c 89 ff e8 31 27 5f 00 4d 8b 37 e8 f9 47 12 00
      RSP: 0018:ffff88808a4a7d78 EFLAGS: 00010203
      RAX: 00000000000000a7 RBX: dffffc0000000000 RCX: ffff888088180600
      RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
      RBP: ffff88808a4a7d90 R08: ffffffff814fb3a8 R09: ffffed1015d66bf8
      R10: ffffed1015d66bf8 R11: 1ffff11015d66bf7 R12: 0000000000041ffc
      R13: 1ffff11011494fbc R14: 0000000000000000 R15: 000000000000053d
      FS:  00007ff07e47e700(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00000000004b5100 CR3: 0000000094df2000 CR4: 00000000001406e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
        _do_fork+0x1b9/0x5f0 kernel/fork.c:2360
        __do_sys_clone kernel/fork.c:2454 [inline]
        __se_sys_clone kernel/fork.c:2448 [inline]
        __x64_sys_clone+0xc1/0xd0 kernel/fork.c:2448
        do_syscall_64+0xfe/0x140 arch/x86/entry/common.c:301
        entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      Link: https://lore.kernel.org/lkml/000000000000e0dc0d058c9e7142@google.com
      Reported-and-tested-by: syzbot+002e636502bc4b64eb5c@syzkaller.appspotmail.com
      Fixes: 6fd2fe49 ("copy_process(): don't use ksys_close() on cleanups")
      Cc: Jann Horn <jannh@google.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarChristian Brauner <christian@brauner.io>
      28dd29c0
  2. 30 Jun, 2019 3 commits
  3. 29 Jun, 2019 29 commits
  4. 28 Jun, 2019 7 commits
    • Trond Myklebust's avatar
      NFS/flexfiles: Use the correct TCP timeout for flexfiles I/O · 68f46159
      Trond Myklebust authored
      Fix a typo where we're confusing the default TCP retrans value
      (NFS_DEF_TCP_RETRANS) for the default TCP timeout value.
      
      Fixes: 15d03055 ("pNFS/flexfiles: Set reasonable default ...")
      Cc: stable@vger.kernel.org # 4.8+
      Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
      Signed-off-by: default avatarAnna Schumaker <Anna.Schumaker@Netapp.com>
      68f46159
    • Trond Myklebust's avatar
      SUNRPC: Fix up calculation of client message length · 7e3d3620
      Trond Myklebust authored
      In the case where a record marker was used, xs_sendpages() needs
      to return the length of the payload + record marker so that we
      operate correctly in the case of a partial transmission.
      When the callers check return value, they therefore need to
      take into account the record marker length.
      
      Fixes: 06b5fc3a ("Merge tag 'nfs-rdma-for-5.1-1'...")
      Cc: stable@vger.kernel.org # 5.1+
      Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
      Signed-off-by: default avatarAnna Schumaker <Anna.Schumaker@Netapp.com>
      7e3d3620
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · 556e2f60
      Linus Torvalds authored
      Pull clk fixes from Stephen Boyd:
       "A handful of clk driver fixes and one core framework fix
      
         - Do a DT/firmware lookup in clk_core_get() even when the DT index is
           a nonsensical value
      
         - Fix some clk data typos in the Amlogic DT headers/code
      
         - Avoid returning junk in the TI clk driver when an invalid clk is
           looked for
      
         - Fix dividers for the emac clks on Stratix10 SoCs
      
         - Fix default HDA rates on Tegra210 to correct distorted audio"
      
      * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
        clk: socfpga: stratix10: fix divider entry for the emac clocks
        clk: Do a DT parent lookup even when index < 0
        clk: tegra210: Fix default rates for HDA clocks
        clk: ti: clkctrl: Fix returning uninitialized data
        clk: meson: meson8b: fix a typo in the VPU parent names array variable
        clk: meson: fix MPLL 50M binding id typo
      556e2f60
    • Linus Torvalds's avatar
      Merge tag 'for-5.2/dm-fixes-2' of... · 65ee21eb
      Linus Torvalds authored
      Merge tag 'for-5.2/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
      
      Pull device mapper fixes from Mike Snitzer:
      
       - Fix incorrect uses of kstrndup and DM logging macros in DM's early
         init code.
      
       - Fix DM log-writes target's handling of super block sectors so updates
         are made in order through use of completion.
      
       - Fix DM core's argument splitting code to avoid undefined behaviour
         reported as a side-effect of UBSAN analysis on ppc64le.
      
       - Fix DM verity target to limit the amount of error messages that can
         result from a corrupt block being found.
      
      * tag 'for-5.2/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
        dm verity: use message limit for data block corruption message
        dm table: don't copy from a NULL pointer in realloc_argv()
        dm log writes: make sure super sector log updates are written in order
        dm init: remove trailing newline from calls to DMERR() and DMINFO()
        dm init: fix incorrect uses of kstrndup()
      65ee21eb
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20190627' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux · 7a702b4e
      Linus Torvalds authored
      Pull pidfd fixes from Christian Brauner:
       "Userspace tools and libraries such as strace or glibc need a cheap and
        reliable way to tell whether CLONE_PIDFD is supported. The easiest way
        is to pass an invalid fd value in the return argument, perform the
        syscall and verify the value in the return argument has been changed
        to a valid fd.
      
        However, if CLONE_PIDFD is specified we currently check if pidfd == 0
        and return EINVAL if not.
      
        The check for pidfd == 0 was originally added to enable us to abuse
        the return argument for passing additional flags along with
        CLONE_PIDFD in the future.
      
        However, extending legacy clone this way would be a terrible idea and
        with clone3 on the horizon and the ability to reuse CLONE_DETACHED
        with CLONE_PIDFD there's no real need for this clutch. So remove the
        pidfd == 0 check and help userspace out.
      
        Also, accordig to Al, anon_inode_getfd() should only be used past the
        point of no failure and ksys_close() should not be used at all since
        it is far too easy to get wrong. Al's motto being "basically, once
        it's in descriptor table, it's out of your control". So Al's patch
        switches back to what we already had in v1 of the original patchset
        and uses a anon_inode_getfile() + put_user() + fd_install() sequence
        in the success path and a fput() + put_unused_fd() in the failure
        path.
      
        The other two changes should be trivial"
      
      * tag 'for-linus-20190627' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux:
        proc: remove useless d_is_dir() check
        copy_process(): don't use ksys_close() on cleanups
        samples: make pidfd-metadata fail gracefully on older kernels
        fork: don't check parent_tidptr with CLONE_PIDFD
      7a702b4e
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid · 763cf1f2
      Linus Torvalds authored
      Pull HID fixes from Jiri Kosina:
      
       - fix for one corner case in HID++ protocol with respect to handling
         very long reports, from Hans de Goede
      
       - power management fix in Intel-ISH driver, from Hyungwoo Yang
      
       - use-after-free fix in Intel-ISH driver, from Dan Carpenter
      
       - a couple of new device IDs/quirks from Kai-Heng Feng, Kyle Godbey and
         Oleksandr Natalenko
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
        HID: intel-ish-hid: fix wrong driver_data usage
        HID: multitouch: Add pointstick support for ALPS Touchpad
        HID: logitech-dj: Fix forwarding of very long HID++ reports
        HID: uclogic: Add support for Huion HS64 tablet
        HID: chicony: add another quirk for PixArt mouse
        HID: intel-ish-hid: Fix a use after free in load_fw_from_host()
      763cf1f2
    • Linus Torvalds's avatar
      Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc · fe2da896
      Linus Torvalds authored
      Pull ARM SoC fixes from Olof Johansson:
       "A smaller batch of fixes, nothing that stands out as risky or scary.
      
        Mostly DTS tweaks for a few issues:
      
         - GPU fixlets for Meson
      
         - CPU idle fix for LS1028A
      
         - PWM interrupt fixes for i.MX6UL
      
        Also, enable a driver (FSL_EDMA) on arm64 defconfig, and a warning and
        two MAINTAINER tweaks"
      
      * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
        ARM: dts: imx6ul: fix PWM[1-4] interrupts
        ARM: omap2: remove incorrect __init annotation
        ARM: dts: gemini Fix up DNS-313 compatible string
        ARM: dts: Blank D-Link DIR-685 console
        arm64: defconfig: Enable FSL_EDMA driver
        arm64: dts: ls1028a: Fix CPU idle fail.
        MAINTAINERS: BCM53573: Add internal Broadcom mailing list
        MAINTAINERS: BCM2835: Add internal Broadcom mailing list
        ARM: dts: meson8b: fix the operating voltage of the Mali GPU
        ARM: dts: meson8b: drop undocumented property from the Mali GPU node
        ARM: dts: meson8: fix GPU interrupts and drop an undocumented property
      fe2da896