1. 29 Jun, 2019 10 commits
  2. 28 Jun, 2019 8 commits
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · 556e2f60
      Linus Torvalds authored
      Pull clk fixes from Stephen Boyd:
       "A handful of clk driver fixes and one core framework fix
      
         - Do a DT/firmware lookup in clk_core_get() even when the DT index is
           a nonsensical value
      
         - Fix some clk data typos in the Amlogic DT headers/code
      
         - Avoid returning junk in the TI clk driver when an invalid clk is
           looked for
      
         - Fix dividers for the emac clks on Stratix10 SoCs
      
         - Fix default HDA rates on Tegra210 to correct distorted audio"
      
      * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
        clk: socfpga: stratix10: fix divider entry for the emac clocks
        clk: Do a DT parent lookup even when index < 0
        clk: tegra210: Fix default rates for HDA clocks
        clk: ti: clkctrl: Fix returning uninitialized data
        clk: meson: meson8b: fix a typo in the VPU parent names array variable
        clk: meson: fix MPLL 50M binding id typo
      556e2f60
    • Linus Torvalds's avatar
      Merge tag 'for-5.2/dm-fixes-2' of... · 65ee21eb
      Linus Torvalds authored
      Merge tag 'for-5.2/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
      
      Pull device mapper fixes from Mike Snitzer:
      
       - Fix incorrect uses of kstrndup and DM logging macros in DM's early
         init code.
      
       - Fix DM log-writes target's handling of super block sectors so updates
         are made in order through use of completion.
      
       - Fix DM core's argument splitting code to avoid undefined behaviour
         reported as a side-effect of UBSAN analysis on ppc64le.
      
       - Fix DM verity target to limit the amount of error messages that can
         result from a corrupt block being found.
      
      * tag 'for-5.2/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
        dm verity: use message limit for data block corruption message
        dm table: don't copy from a NULL pointer in realloc_argv()
        dm log writes: make sure super sector log updates are written in order
        dm init: remove trailing newline from calls to DMERR() and DMINFO()
        dm init: fix incorrect uses of kstrndup()
      65ee21eb
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20190627' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux · 7a702b4e
      Linus Torvalds authored
      Pull pidfd fixes from Christian Brauner:
       "Userspace tools and libraries such as strace or glibc need a cheap and
        reliable way to tell whether CLONE_PIDFD is supported. The easiest way
        is to pass an invalid fd value in the return argument, perform the
        syscall and verify the value in the return argument has been changed
        to a valid fd.
      
        However, if CLONE_PIDFD is specified we currently check if pidfd == 0
        and return EINVAL if not.
      
        The check for pidfd == 0 was originally added to enable us to abuse
        the return argument for passing additional flags along with
        CLONE_PIDFD in the future.
      
        However, extending legacy clone this way would be a terrible idea and
        with clone3 on the horizon and the ability to reuse CLONE_DETACHED
        with CLONE_PIDFD there's no real need for this clutch. So remove the
        pidfd == 0 check and help userspace out.
      
        Also, accordig to Al, anon_inode_getfd() should only be used past the
        point of no failure and ksys_close() should not be used at all since
        it is far too easy to get wrong. Al's motto being "basically, once
        it's in descriptor table, it's out of your control". So Al's patch
        switches back to what we already had in v1 of the original patchset
        and uses a anon_inode_getfile() + put_user() + fd_install() sequence
        in the success path and a fput() + put_unused_fd() in the failure
        path.
      
        The other two changes should be trivial"
      
      * tag 'for-linus-20190627' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux:
        proc: remove useless d_is_dir() check
        copy_process(): don't use ksys_close() on cleanups
        samples: make pidfd-metadata fail gracefully on older kernels
        fork: don't check parent_tidptr with CLONE_PIDFD
      7a702b4e
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid · 763cf1f2
      Linus Torvalds authored
      Pull HID fixes from Jiri Kosina:
      
       - fix for one corner case in HID++ protocol with respect to handling
         very long reports, from Hans de Goede
      
       - power management fix in Intel-ISH driver, from Hyungwoo Yang
      
       - use-after-free fix in Intel-ISH driver, from Dan Carpenter
      
       - a couple of new device IDs/quirks from Kai-Heng Feng, Kyle Godbey and
         Oleksandr Natalenko
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
        HID: intel-ish-hid: fix wrong driver_data usage
        HID: multitouch: Add pointstick support for ALPS Touchpad
        HID: logitech-dj: Fix forwarding of very long HID++ reports
        HID: uclogic: Add support for Huion HS64 tablet
        HID: chicony: add another quirk for PixArt mouse
        HID: intel-ish-hid: Fix a use after free in load_fw_from_host()
      763cf1f2
    • Linus Torvalds's avatar
      Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc · fe2da896
      Linus Torvalds authored
      Pull ARM SoC fixes from Olof Johansson:
       "A smaller batch of fixes, nothing that stands out as risky or scary.
      
        Mostly DTS tweaks for a few issues:
      
         - GPU fixlets for Meson
      
         - CPU idle fix for LS1028A
      
         - PWM interrupt fixes for i.MX6UL
      
        Also, enable a driver (FSL_EDMA) on arm64 defconfig, and a warning and
        two MAINTAINER tweaks"
      
      * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
        ARM: dts: imx6ul: fix PWM[1-4] interrupts
        ARM: omap2: remove incorrect __init annotation
        ARM: dts: gemini Fix up DNS-313 compatible string
        ARM: dts: Blank D-Link DIR-685 console
        arm64: defconfig: Enable FSL_EDMA driver
        arm64: dts: ls1028a: Fix CPU idle fail.
        MAINTAINERS: BCM53573: Add internal Broadcom mailing list
        MAINTAINERS: BCM2835: Add internal Broadcom mailing list
        ARM: dts: meson8b: fix the operating voltage of the Mali GPU
        ARM: dts: meson8b: drop undocumented property from the Mali GPU node
        ARM: dts: meson8: fix GPU interrupts and drop an undocumented property
      fe2da896
    • Linus Torvalds's avatar
      Merge tag 'afs-fixes-20190620' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs · cd0f3aae
      Linus Torvalds authored
      Pull AFS fixes from David Howells:
       "The in-kernel AFS client has been undergoing testing on opendev.org on
        one of their mirror machines. They are using AFS to hold data that is
        then served via apache, and Ian Wienand had reported seeing oopses,
        spontaneous machine reboots and updates to volumes going missing. This
        patch series appears to have fixed the problem, very probably due to
        patch (2), but it's not 100% certain.
      
        (1) Fix the printing of the "vnode modified" warning to exclude checks
            on files for which we don't have a callback promise from the
            server (and so don't expect the server to tell us when it
            changes).
      
            Without this, for every file or directory for which we still have
            an in-core inode that gets changed on the server, we may get a
            message logged when we next look at it. This can happen in bulk
            if, for instance, someone does "vos release" to update a R/O
            volume from a R/W volume and a whole set of files are all changed
            together.
      
            We only really want to log a message if the file changed and the
            server didn't tell us about it or we failed to track the state
            internally.
      
        (2) Fix accidental corruption of either afs_vlserver struct objects or
            the the following memory locations (which could hold anything).
            The issue is caused by a union that points to two different
            structs in struct afs_call (to save space in the struct). The call
            cleanup code assumes that it can simply call the cleanup for one
            of those structs if not NULL - when it might be actually pointing
            to the other struct.
      
            This means that every Volume Location RPC op is going to corrupt
            something.
      
        (3) Fix an uninitialised spinlock. This isn't too bad, it just causes
            a one-off warning if lockdep is enabled when "vos release" is
            called, but the spinlock still behaves correctly.
      
        (4) Fix the setting of i_block in the inode. This causes du, for
            example, to produce incorrect results, but otherwise should not be
            dangerous to the kernel"
      
      * tag 'afs-fixes-20190620' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs:
        afs: Fix setting of i_blocks
        afs: Fix uninitialised spinlock afs_volume::cb_break_lock
        afs: Fix vlserver record corruption
        afs: Fix over zealous "vnode modified" warnings
      cd0f3aae
    • Linus Torvalds's avatar
      Merge tag 'csky-for-linus-5.2-fixup-gcc-unwind' of git://github.com/c-sky/csky-linux · 139ca258
      Linus Torvalds authored
      Pull arch/csky fixup from Guo Ren:
       "A fixup patch for rt_sigframe in signal.c"
      
      * tag 'csky-for-linus-5.2-fixup-gcc-unwind' of git://github.com/c-sky/csky-linux:
        csky: Fixup libgcc unwind error
      139ca258
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · c84afab0
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix ppp_mppe crypto soft dependencies, from Takashi Iawi.
      
       2) Fix TX completion to be finite, from Sergej Benilov.
      
       3) Use register_pernet_device to avoid a dst leak in tipc, from Xin
          Long.
      
       4) Double free of TX cleanup in Dirk van der Merwe.
      
       5) Memory leak in packet_set_ring(), from Eric Dumazet.
      
       6) Out of bounds read in qmi_wwan, from Bjørn Mork.
      
       7) Fix iif used in mcast/bcast looped back packets, from Stephen
          Suryaputra.
      
       8) Fix neighbour resolution on raw ipv6 sockets, from Nicolas Dichtel.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (25 commits)
        af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET
        sctp: change to hold sk after auth shkey is created successfully
        ipv6: fix neighbour resolution with raw socket
        ipv6: constify rt6_nexthop()
        net: dsa: microchip: Use gpiod_set_value_cansleep()
        net: aquantia: fix vlans not working over bridged network
        ipv4: reset rt_iif for recirculated mcast/bcast out pkts
        team: Always enable vlan tx offload
        net/smc: Fix error path in smc_init
        net/smc: hold conns_lock before calling smc_lgr_register_conn()
        bonding: Always enable vlan tx offload
        net/ipv6: Fix misuse of proc_dointvec "skip_notify_on_dev_down"
        ipv4: Use return value of inet_iif() for __raw_v4_lookup in the while loop
        qmi_wwan: Fix out-of-bounds read
        tipc: check msg->req data len in tipc_nl_compat_bearer_disable
        net: macb: do not copy the mac address if NULL
        net/packet: fix memory leak in packet_set_ring()
        net/tls: fix page double free on TX cleanup
        net/sched: cbs: Fix error path of cbs_module_init
        tipc: change to use register_pernet_device
        ...
      c84afab0
  3. 27 Jun, 2019 4 commits
    • Christian Brauner's avatar
      proc: remove useless d_is_dir() check · 30d158b1
      Christian Brauner authored
      Remove the d_is_dir() check from tgid_pidfd_to_pid().
      
      It is pointless since you should never get &proc_tgid_base_operations
      for f_op on a non-directory.
      Suggested-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarChristian Brauner <christian@brauner.io>
      30d158b1
    • Al Viro's avatar
      copy_process(): don't use ksys_close() on cleanups · 6fd2fe49
      Al Viro authored
      anon_inode_getfd() should be used *ONLY* in situations when we are
      guaranteed to be past the last failure point (including copying the
      descriptor number to userland, at that).  And ksys_close() should
      not be used for cleanups at all.
      
      anon_inode_getfile() is there for all nontrivial cases like that.
      Just use that...
      
      Fixes: b3e58382 ("clone: add CLONE_PIDFD")
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Reviewed-by: default avatarJann Horn <jannh@google.com>
      Signed-off-by: default avatarChristian Brauner <christian@brauner.io>
      6fd2fe49
    • Neil Horman's avatar
      af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET · 89ed5b51
      Neil Horman authored
      When an application is run that:
      a) Sets its scheduler to be SCHED_FIFO
      and
      b) Opens a memory mapped AF_PACKET socket, and sends frames with the
      MSG_DONTWAIT flag cleared, its possible for the application to hang
      forever in the kernel.  This occurs because when waiting, the code in
      tpacket_snd calls schedule, which under normal circumstances allows
      other tasks to run, including ksoftirqd, which in some cases is
      responsible for freeing the transmitted skb (which in AF_PACKET calls a
      destructor that flips the status bit of the transmitted frame back to
      available, allowing the transmitting task to complete).
      
      However, when the calling application is SCHED_FIFO, its priority is
      such that the schedule call immediately places the task back on the cpu,
      preventing ksoftirqd from freeing the skb, which in turn prevents the
      transmitting task from detecting that the transmission is complete.
      
      We can fix this by converting the schedule call to a completion
      mechanism.  By using a completion queue, we force the calling task, when
      it detects there are no more frames to send, to schedule itself off the
      cpu until such time as the last transmitted skb is freed, allowing
      forward progress to be made.
      
      Tested by myself and the reporter, with good results
      
      Change Notes:
      
      V1->V2:
      	Enhance the sleep logic to support being interruptible and
      allowing for honoring to SK_SNDTIMEO (Willem de Bruijn)
      
      V2->V3:
      	Rearrage the point at which we wait for the completion queue, to
      avoid needing to check for ph/skb being null at the end of the loop.
      Also move the complete call to the skb destructor to avoid needing to
      modify __packet_set_status.  Also gate calling complete on
      packet_read_pending returning zero to avoid multiple calls to complete.
      (Willem de Bruijn)
      
      	Move timeo computation within loop, to re-fetch the socket
      timeout since we also use the timeo variable to record the return code
      from the wait_for_complete call (Neil Horman)
      
      V3->V4:
      	Willem has requested that the control flow be restored to the
      previous state.  Doing so lets us eliminate the need for the
      po->wait_on_complete flag variable, and lets us get rid of the
      packet_next_frame function, but introduces another complexity.
      Specifically, but using the packet pending count, we can, if an
      applications calls sendmsg multiple times with MSG_DONTWAIT set, each
      set of transmitted frames, when complete, will cause
      tpacket_destruct_skb to issue a complete call, for which there will
      never be a wait_on_completion call.  This imbalance will lead to any
      future call to wait_for_completion here to return early, when the frames
      they sent may not have completed.  To correct this, we need to re-init
      the completion queue on every call to tpacket_snd before we enter the
      loop so as to ensure we wait properly for the frames we send in this
      iteration.
      
      	Change the timeout and interrupted gotos to out_put rather than
      out_status so that we don't try to free a non-existant skb
      	Clean up some extra newlines (Willem de Bruijn)
      Reviewed-by: default avatarWillem de Bruijn <willemb@google.com>
      Signed-off-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Reported-by: default avatarMatteo Croce <mcroce@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      89ed5b51
    • Xin Long's avatar
      sctp: change to hold sk after auth shkey is created successfully · 25bff6d5
      Xin Long authored
      Now in sctp_endpoint_init(), it holds the sk then creates auth
      shkey. But when the creation fails, it doesn't release the sk,
      which causes a sk defcnf leak,
      
      Here to fix it by only holding the sk when auth shkey is created
      successfully.
      
      Fixes: a29a5bd4 ("[SCTP]: Implement SCTP-AUTH initializations.")
      Reported-by: syzbot+afabda3890cc2f765041@syzkaller.appspotmail.com
      Reported-by: syzbot+276ca1c77a19977c0130@syzkaller.appspotmail.com
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Acked-by: default avatarNeil Horman <nhorman@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      25bff6d5
  4. 26 Jun, 2019 18 commits