1. 07 Jun, 2018 6 commits
  2. 03 Jun, 2018 6 commits
    • Linus Torvalds's avatar
      Linux 4.17 · 29dcea88
      Linus Torvalds authored
      29dcea88
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 325e14f9
      Linus Torvalds authored
      Pull vfs fixes from Al Viro.
      
       - fix io_destroy()/aio_complete() race
      
       - the vfs_open() change to get rid of open_check_o_direct() boilerplate
         was nice, but buggy. Al has a patch avoiding a revert, but that's
         definitely not a last-day fodder, so for now revert it is...
      
      * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        Revert "fs: fold open_check_o_direct into do_dentry_open"
        fix io_destroy()/aio_complete() race
      325e14f9
    • Al Viro's avatar
      Revert "fs: fold open_check_o_direct into do_dentry_open" · af04fadc
      Al Viro authored
      This reverts commit cab64df1.
      
      Having vfs_open() in some cases drop the reference to
      struct file combined with
      
      	error = vfs_open(path, f, cred);
      	if (error) {
      		put_filp(f);
      		return ERR_PTR(error);
      	}
      	return f;
      
      is flat-out wrong.  It used to be
      
      		error = vfs_open(path, f, cred);
      		if (!error) {
      			/* from now on we need fput() to dispose of f */
      			error = open_check_o_direct(f);
      			if (error) {
      				fput(f);
      				f = ERR_PTR(error);
      			}
      		} else {
      			put_filp(f);
      			f = ERR_PTR(error);
      		}
      
      and sure, having that open_check_o_direct() boilerplate gotten rid of is
      nice, but not that way...
      
      Worse, another call chain (via finish_open()) is FUBAR now wrt
      FILE_OPENED handling - in that case we get error returned, with file
      already hit by fput() *AND* FILE_OPENED not set.  Guess what happens in
      path_openat(), when it hits
      
      	if (!(opened & FILE_OPENED)) {
      		BUG_ON(!error);
      		put_filp(file);
      	}
      
      The root cause of all that crap is that the callers of do_dentry_open()
      have no way to tell which way did it fail; while that could be fixed up
      (by passing something like int *opened to do_dentry_open() and have it
      marked if we'd called ->open()), it's probably much too late in the
      cycle to do so right now.
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      af04fadc
    • Linus Torvalds's avatar
      Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 874cd339
      Linus Torvalds authored
      Pull scheduler fixes from Thomas Gleixner:
      
       - two patches addressing the problem that the scheduler allows under
         certain conditions user space tasks to be scheduled on CPUs which are
         not yet fully booted which causes a few subtle and hard to debug
         issue
      
       - add a missing runqueue clock update in the deadline scheduler which
         triggers a warning under certain circumstances
      
       - fix a silly typo in the scheduler header file
      
      * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/headers: Fix typo
        sched/deadline: Fix missing clock update
        sched/core: Require cpu_active() in select_task_rq(), for user tasks
        sched/core: Fix rules for running on online && !active CPUs
      874cd339
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 26bdace7
      Linus Torvalds authored
      Pull perf tooling fixes from Thomas Gleixner:
      
       - fix 'perf test Session topology' segfault on s390 (Thomas Richter)
      
       - fix NULL return handling in bpf__prepare_load() (YueHaibing)
      
       - fix indexing on Coresight ETM packet queue decoder (Mathieu Poirier)
      
       - fix perf.data format description of NRCPUS header (Arnaldo Carvalho
         de Melo)
      
       - update perf.data documentation section on cpu topology
      
       - handle uncore event aliases in small groups properly (Kan Liang)
      
       - add missing perf_sample.addr into python sample dictionary (Leo Yan)
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf tools: Fix perf.data format description of NRCPUS header
        perf script python: Add addr into perf sample dict
        perf data: Update documentation section on cpu topology
        perf cs-etm: Fix indexing for decoder packet queue
        perf bpf: Fix NULL return handling in bpf__prepare_load()
        perf test: "Session topology" dumps core on s390
        perf parse-events: Handle uncore event aliases in small groups properly
      26bdace7
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 918fe1b3
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Infinite loop in _decode_session6(), from Eric Dumazet.
      
       2) Pass correct argument to nla_strlcpy() in netfilter, also from Eric
          Dumazet.
      
       3) Out of bounds memory access in ipv6 srh code, from Mathieu Xhonneux.
      
       4) NULL deref in XDP_REDIRECT handling of tun driver, from Toshiaki
          Makita.
      
       5) Incorrect idr release in cls_flower, from Paul Blakey.
      
       6) Probe error handling fix in davinci_emac, from Dan Carpenter.
      
       7) Memory leak in XPS configuration, from Alexander Duyck.
      
       8) Use after free with cloned sockets in kcm, from Kirill Tkhai.
      
       9) MTU handling fixes fo ip_tunnel and ip6_tunnel, from Nicolas
          Dichtel.
      
      10) Fix UAPI hole in bpf data structure for 32-bit compat applications,
          from Daniel Borkmann.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (33 commits)
        bpf: fix uapi hole for 32 bit compat applications
        net: usb: cdc_mbim: add flag FLAG_SEND_ZLP
        ip6_tunnel: remove magic mtu value 0xFFF8
        ip_tunnel: restore binding to ifaces with a large mtu
        net: dsa: b53: Add BCM5389 support
        kcm: Fix use-after-free caused by clonned sockets
        net-sysfs: Fix memory leak in XPS configuration
        ixgbe: fix parsing of TC actions for HW offload
        net: ethernet: davinci_emac: fix error handling in probe()
        net/ncsi: Fix array size in dumpit handler
        cls_flower: Fix incorrect idr release when failing to modify rule
        net/sonic: Use dma_mapping_error()
        xfrm Fix potential error pointer dereference in xfrm_bundle_create.
        vhost_net: flush batched heads before trying to busy polling
        tun: Fix NULL pointer dereference in XDP redirect
        be2net: Fix error detection logic for BE3
        net: qmi_wwan: Add Netgear Aircard 779S
        mlxsw: spectrum: Forbid creation of VLAN 1 over port/LAG
        atm: zatm: fix memcmp casting
        iwlwifi: pcie: compare with number of IRQs requested for, not number of CPUs
        ...
      918fe1b3
  3. 02 Jun, 2018 15 commits
  4. 01 Jun, 2018 9 commits
  5. 31 May, 2018 4 commits
    • Linus Torvalds's avatar
      Merge tag 'xfs-4.17-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · 0512e013
      Linus Torvalds authored
      Pull xfs fix from Darrick Wong:
       "Clear out i_mapping error state when we're reinitializing inodes.
      
        This last minute fix prevents writeback error state from persisting
        past the end of the in-core inode lifecycle and causing EIO errors to
        be reported to userspace when no error has occurred.
      
        This fix for the behavioral regression has been soaking in for-next
        for a while, but various fs developers persuaded me to try to get it
        upstream for 4.17 because the patch that broke things was introduced
        in 4.17-rc4"
      
      * tag 'xfs-4.17-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        fs: clear writeback errors in inode_init_always
      0512e013
    • Dan Carpenter's avatar
      net: ethernet: davinci_emac: fix error handling in probe() · 8005b09d
      Dan Carpenter authored
      The current error handling code has an issue where it does:
      
      	if (priv->txchan)
      		cpdma_chan_destroy(priv->txchan);
      
      The problem is that ->txchan is either valid or an error pointer (which
      would lead to an Oops).  I've changed it to use multiple error labels so
      that the test can be removed.
      
      Also there were some missing calls to netif_napi_del().
      
      Fixes: 3ef0fdb2 ("net: davinci_emac: switch to new cpdma layer")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8005b09d
    • Samuel Mendoza-Jonas's avatar
      net/ncsi: Fix array size in dumpit handler · 0f51f358
      Samuel Mendoza-Jonas authored
      With CONFIG_CC_STACKPROTECTOR enabled the kernel panics as below when
      parsing a NCSI_CMD_PKG_INFO command:
      
      [  150.149711] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: 805cff08
      [  150.149711]
      [  150.159919] CPU: 0 PID: 1301 Comm: ncsi-netlink Not tainted 4.13.16-468cbec6d2c91239332cb91b1f0a73aafcb6f0c6 #1
      [  150.170004] Hardware name: Generic DT based system
      [  150.174852] [<80109930>] (unwind_backtrace) from [<80106bc4>] (show_stack+0x20/0x24)
      [  150.182641] [<80106bc4>] (show_stack) from [<805d36e4>] (dump_stack+0x20/0x28)
      [  150.189888] [<805d36e4>] (dump_stack) from [<801163ac>] (panic+0xdc/0x278)
      [  150.196780] [<801163ac>] (panic) from [<801162cc>] (__stack_chk_fail+0x20/0x24)
      [  150.204111] [<801162cc>] (__stack_chk_fail) from [<805cff08>] (ncsi_pkg_info_all_nl+0x244/0x258)
      [  150.212912] [<805cff08>] (ncsi_pkg_info_all_nl) from [<804f939c>] (genl_lock_dumpit+0x3c/0x54)
      [  150.221535] [<804f939c>] (genl_lock_dumpit) from [<804f873c>] (netlink_dump+0xf8/0x284)
      [  150.229550] [<804f873c>] (netlink_dump) from [<804f8d44>] (__netlink_dump_start+0x124/0x17c)
      [  150.237992] [<804f8d44>] (__netlink_dump_start) from [<804f9880>] (genl_rcv_msg+0x1c8/0x3d4)
      [  150.246440] [<804f9880>] (genl_rcv_msg) from [<804f9174>] (netlink_rcv_skb+0xd8/0x134)
      [  150.254361] [<804f9174>] (netlink_rcv_skb) from [<804f96a4>] (genl_rcv+0x30/0x44)
      [  150.261850] [<804f96a4>] (genl_rcv) from [<804f7790>] (netlink_unicast+0x198/0x234)
      [  150.269511] [<804f7790>] (netlink_unicast) from [<804f7ffc>] (netlink_sendmsg+0x368/0x3b0)
      [  150.277783] [<804f7ffc>] (netlink_sendmsg) from [<804abea4>] (sock_sendmsg+0x24/0x34)
      [  150.285625] [<804abea4>] (sock_sendmsg) from [<804ac1dc>] (___sys_sendmsg+0x244/0x260)
      [  150.293556] [<804ac1dc>] (___sys_sendmsg) from [<804ad98c>] (__sys_sendmsg+0x5c/0x9c)
      [  150.301400] [<804ad98c>] (__sys_sendmsg) from [<804ad9e4>] (SyS_sendmsg+0x18/0x1c)
      [  150.308984] [<804ad9e4>] (SyS_sendmsg) from [<80102640>] (ret_fast_syscall+0x0/0x3c)
      [  150.316743] ---[ end Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: 805cff08
      
      This turns out to be because the attrs array in ncsi_pkg_info_all_nl()
      is initialised to a length of NCSI_ATTR_MAX which is the maximum
      attribute number, not the number of attributes.
      
      Fixes: 955dc68c ("net/ncsi: Add generic netlink family")
      Signed-off-by: default avatarSamuel Mendoza-Jonas <sam@mendozajonas.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0f51f358
    • David S. Miller's avatar
      Merge tag 'wireless-drivers-for-davem-2018-05-30' of... · be20f28f
      David S. Miller authored
      Merge tag 'wireless-drivers-for-davem-2018-05-30' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
      
      Kalle Valo says:
      
      ====================
      wireless-drivers fixes for 4.17
      
      Two last minute fixes, hopefully they make it to 4.17 still.
      
      rt2x00
      
      * revert a fix which caused even more problems
      
      iwlwifi
      
      * fix a crash when there are 16 or more logical CPUs
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      be20f28f