1. 08 Jul, 2018 5 commits
    • Linus Torvalds's avatar
      Merge tag 'pci-v4.18-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · 8979319f
      Linus Torvalds authored
      Pull PCI fixes from Bjorn Helgaas:
      
       - Fix a use-after-free in the endpoint code (Dan Carpenter)
      
       - Stop defaulting CONFIG_PCIE_DW_PLAT_HOST to yes (Geert Uytterhoeven)
      
       - Fix an nfp regression caused by a change in how we limit the number
         of VFs we can enable (Jakub Kicinski)
      
       - Fix failure path cleanup issues in the new R-Car gen3 PHY support
         (Marek Vasut)
      
       - Fix leaks of OF nodes in faraday, xilinx-nwl, xilinx (Nicholas Mc
         Guire)
      
      * tag 'pci-v4.18-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        nfp: stop limiting VFs to 0
        PCI/IOV: Reset total_VFs limit after detaching PF driver
        PCI: faraday: Add missing of_node_put()
        PCI: xilinx-nwl: Add missing of_node_put()
        PCI: xilinx: Add missing of_node_put()
        PCI: endpoint: Use after free in pci_epf_unregister_driver()
        PCI: controller: dwc: Do not let PCIE_DW_PLAT_HOST default to yes
        PCI: rcar: Clean up PHY init on failure
        PCI: rcar: Shut the PHY down in failpath
      8979319f
    • Linus Torvalds's avatar
      Merge tag '4.18-rc3-smb3fixes' of git://git.samba.org/sfrench/cifs-2.6 · b2d44d14
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
       "Five smb3/cifs fixes for stable (including for some leaks and memory
        overwrites) and also a few fixes for recent regressions in packet
        signing.
      
        Additional testing at the recent SMB3 test event, and some good work
        by Paulo and others spotted the issues fixed here. In addition to my
        xfstest runs on these, Aurelien and Stefano did additional test runs
        to verify this set"
      
      * tag '4.18-rc3-smb3fixes' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: Fix stack out-of-bounds in smb{2,3}_create_lease_buf()
        cifs: Fix infinite loop when using hard mount option
        cifs: Fix slab-out-of-bounds in send_set_info() on SMB2 ACE setting
        cifs: Fix memory leak in smb2_set_ea()
        cifs: fix SMB1 breakage
        cifs: Fix validation of signed data in smb2
        cifs: Fix validation of signed data in smb3+
        cifs: Fix use after free of a mid_q_entry
      b2d44d14
    • Linus Torvalds's avatar
      Merge tag 'dma-mapping-4.18-3' of git://git.infradead.org/users/hch/dma-mapping · 4f572efd
      Linus Torvalds authored
      Pull dma-mapping fix from Christoph Hellwig:
       "Revert an incorrect dma-mapping commit for 4.18-rc"
      
      * tag 'dma-mapping-4.18-3' of git://git.infradead.org/users/hch/dma-mapping:
        Revert "iommu/intel-iommu: Enable CONFIG_DMA_DIRECT_OPS=y and clean up intel_{alloc,free}_coherent()"
      4f572efd
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-fix-4.18-rc4' of git://git.infradead.org/users/vkoul/slave-dma · 89ac2233
      Linus Torvalds authored
      Pull dmaengine fixes from Vinod Koul:
       "We have few odd driver fixes and one email update change for you this
        time:
      
         - Driver fixes for k3dma (off by one), pl330 (burst residue
           granularity) and omap-dma (incorrect residue_granularity)
      
         - Sinan's email update"
      
      * tag 'dmaengine-fix-4.18-rc4' of git://git.infradead.org/users/vkoul/slave-dma:
        dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate()
        dmaengine: pl330: report BURST residue granularity
        MAINTAINERS: Update email-id of Sinan Kaya
        dmaengine: ti: omap-dma: Fix OMAP1510 incorrect residue_granularity
      89ac2233
    • Linus Torvalds's avatar
      Merge tag 'for-linus-4.18-2' of git://github.com/cminyard/linux-ipmi · ea9561cf
      Linus Torvalds authored
      Pull IPMI fixes from Corey Minyard:
       "A couple of small fixes: one to the BMC side of things that fixes an
        interrupt issue, and one oops fix if init fails in a certain way on
        the client driver"
      
      * tag 'for-linus-4.18-2' of git://github.com/cminyard/linux-ipmi:
        ipmi: kcs_bmc: fix IRQ exception if the channel is not open
        ipmi: Cleanup oops on initialization failure
      ea9561cf
  2. 07 Jul, 2018 3 commits
  3. 06 Jul, 2018 9 commits
  4. 05 Jul, 2018 21 commits
    • Linus Torvalds's avatar
      Fix up non-directory creation in SGID directories · 0fa3ecd8
      Linus Torvalds authored
      sgid directories have special semantics, making newly created files in
      the directory belong to the group of the directory, and newly created
      subdirectories will also become sgid.  This is historically used for
      group-shared directories.
      
      But group directories writable by non-group members should not imply
      that such non-group members can magically join the group, so make sure
      to clear the sgid bit on non-directories for non-members (but remember
      that sgid without group execute means "mandatory locking", just to
      confuse things even more).
      Reported-by: default avatarJann Horn <jannh@google.com>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      0fa3ecd8
    • Christoph Hellwig's avatar
      Revert "iommu/intel-iommu: Enable CONFIG_DMA_DIRECT_OPS=y and clean up... · 7ec916f8
      Christoph Hellwig authored
      Revert "iommu/intel-iommu: Enable CONFIG_DMA_DIRECT_OPS=y and clean up intel_{alloc,free}_coherent()"
      
      This commit may cause a less than required dma mask to be used for
      some allocations, which apparently leads to module load failures for
      iwlwifi sometimes.
      
      This reverts commit d657c5c7.
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Reported-by: default avatarFabio Coatti <fabio.coatti@gmail.com>
      Tested-by: default avatarFabio Coatti <fabio.coatti@gmail.com>
      7ec916f8
    • Stefano Brivio's avatar
      cifs: Fix stack out-of-bounds in smb{2,3}_create_lease_buf() · 729c0c9d
      Stefano Brivio authored
      smb{2,3}_create_lease_buf() store a lease key in the lease
      context for later usage on a lease break.
      
      In most paths, the key is currently sourced from data that
      happens to be on the stack near local variables for oplock in
      SMB2_open() callers, e.g. from open_shroot(), whereas
      smb2_open_file() properly allocates space on its stack for it.
      
      The address of those local variables holding the oplock is then
      passed to create_lease_buf handlers via SMB2_open(), and 16
      bytes near oplock are used. This causes a stack out-of-bounds
      access as reported by KASAN on SMB2.1 and SMB3 mounts (first
      out-of-bounds access is shown here):
      
      [  111.528823] BUG: KASAN: stack-out-of-bounds in smb3_create_lease_buf+0x399/0x3b0 [cifs]
      [  111.530815] Read of size 8 at addr ffff88010829f249 by task mount.cifs/985
      [  111.532838] CPU: 3 PID: 985 Comm: mount.cifs Not tainted 4.18.0-rc3+ #91
      [  111.534656] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
      [  111.536838] Call Trace:
      [  111.537528]  dump_stack+0xc2/0x16b
      [  111.540890]  print_address_description+0x6a/0x270
      [  111.542185]  kasan_report+0x258/0x380
      [  111.544701]  smb3_create_lease_buf+0x399/0x3b0 [cifs]
      [  111.546134]  SMB2_open+0x1ef8/0x4b70 [cifs]
      [  111.575883]  open_shroot+0x339/0x550 [cifs]
      [  111.591969]  smb3_qfs_tcon+0x32c/0x1e60 [cifs]
      [  111.617405]  cifs_mount+0x4f3/0x2fc0 [cifs]
      [  111.674332]  cifs_smb3_do_mount+0x263/0xf10 [cifs]
      [  111.677915]  mount_fs+0x55/0x2b0
      [  111.679504]  vfs_kern_mount.part.22+0xaa/0x430
      [  111.684511]  do_mount+0xc40/0x2660
      [  111.698301]  ksys_mount+0x80/0xd0
      [  111.701541]  do_syscall_64+0x14e/0x4b0
      [  111.711807]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [  111.713665] RIP: 0033:0x7f372385b5fa
      [  111.715311] Code: 48 8b 0d 99 78 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 66 78 2c 00 f7 d8 64 89 01 48
      [  111.720330] RSP: 002b:00007ffff27049d8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
      [  111.722601] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f372385b5fa
      [  111.724842] RDX: 000055c2ecdc73b2 RSI: 000055c2ecdc73f9 RDI: 00007ffff270580f
      [  111.727083] RBP: 00007ffff2705804 R08: 000055c2ee976060 R09: 0000000000001000
      [  111.729319] R10: 0000000000000000 R11: 0000000000000206 R12: 00007f3723f4d000
      [  111.731615] R13: 000055c2ee976060 R14: 00007f3723f4f90f R15: 0000000000000000
      
      [  111.735448] The buggy address belongs to the page:
      [  111.737420] page:ffffea000420a7c0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
      [  111.739890] flags: 0x17ffffc0000000()
      [  111.741750] raw: 0017ffffc0000000 0000000000000000 dead000000000200 0000000000000000
      [  111.744216] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
      [  111.746679] page dumped because: kasan: bad access detected
      
      [  111.750482] Memory state around the buggy address:
      [  111.752562]  ffff88010829f100: 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00
      [  111.754991]  ffff88010829f180: 00 00 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00
      [  111.757401] >ffff88010829f200: 00 00 00 00 00 f1 f1 f1 f1 01 f2 f2 f2 f2 f2 f2
      [  111.759801]                                               ^
      [  111.762034]  ffff88010829f280: f2 02 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00
      [  111.764486]  ffff88010829f300: f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  111.766913] ==================================================================
      
      Lease keys are however already generated and stored in fid data
      on open and create paths: pass them down to the lease context
      creation handlers and use them.
      Suggested-by: default avatarAurélien Aptel <aaptel@suse.com>
      Reviewed-by: default avatarAurelien Aptel <aaptel@suse.com>
      Fixes: b8c32dbb ("CIFS: Request SMB2.1 leases")
      Signed-off-by: default avatarStefano Brivio <sbrivio@redhat.com>
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      729c0c9d
    • Paulo Alcantara's avatar
      cifs: Fix infinite loop when using hard mount option · 7ffbe655
      Paulo Alcantara authored
      For every request we send, whether it is SMB1 or SMB2+, we attempt to
      reconnect tcon (cifs_reconnect_tcon or smb2_reconnect) before carrying
      out the request.
      
      So, while server->tcpStatus != CifsNeedReconnect, we wait for the
      reconnection to succeed on wait_event_interruptible_timeout(). If it
      returns, that means that either the condition was evaluated to true, or
      timeout elapsed, or it was interrupted by a signal.
      
      Since we're not handling the case where the process woke up due to a
      received signal (-ERESTARTSYS), the next call to
      wait_event_interruptible_timeout() will _always_ fail and we end up
      looping forever inside either cifs_reconnect_tcon() or smb2_reconnect().
      
      Here's an example of how to trigger that:
      
      $ mount.cifs //foo/share /mnt/test -o
      username=foo,password=foo,vers=1.0,hard
      
      (break connection to server before executing bellow cmd)
      $ stat -f /mnt/test & sleep 140
      [1] 2511
      
      $ ps -aux -q 2511
      USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
      root      2511  0.0  0.0  12892  1008 pts/0    S    12:24   0:00 stat -f
      /mnt/test
      
      $ kill -9 2511
      
      (wait for a while; process is stuck in the kernel)
      $ ps -aux -q 2511
      USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
      root      2511 83.2  0.0  12892  1008 pts/0    R    12:24  30:01 stat -f
      /mnt/test
      
      By using 'hard' mount point means that cifs.ko will keep retrying
      indefinitely, however we must allow the process to be killed otherwise
      it would hang the system.
      Signed-off-by: default avatarPaulo Alcantara <palcantara@suse.de>
      Cc: stable@vger.kernel.org
      Reviewed-by: default avatarAurelien Aptel <aaptel@suse.com>
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      7ffbe655
    • Stefano Brivio's avatar
      cifs: Fix slab-out-of-bounds in send_set_info() on SMB2 ACE setting · f46ecbd9
      Stefano Brivio authored
      A "small" CIFS buffer is not big enough in general to hold a
      setacl request for SMB2, and we end up overflowing the buffer in
      send_set_info(). For instance:
      
       # mount.cifs //127.0.0.1/test /mnt/test -o username=test,password=test,nounix,cifsacl
       # touch /mnt/test/acltest
       # getcifsacl /mnt/test/acltest
       REVISION:0x1
       CONTROL:0x9004
       OWNER:S-1-5-21-2926364953-924364008-418108241-1000
       GROUP:S-1-22-2-1001
       ACL:S-1-5-21-2926364953-924364008-418108241-1000:ALLOWED/0x0/0x1e01ff
       ACL:S-1-22-2-1001:ALLOWED/0x0/R
       ACL:S-1-22-2-1001:ALLOWED/0x0/R
       ACL:S-1-5-21-2926364953-924364008-418108241-1000:ALLOWED/0x0/0x1e01ff
       ACL:S-1-1-0:ALLOWED/0x0/R
       # setcifsacl -a "ACL:S-1-22-2-1004:ALLOWED/0x0/R" /mnt/test/acltest
      
      this setacl will cause the following KASAN splat:
      
      [  330.777927] BUG: KASAN: slab-out-of-bounds in send_set_info+0x4dd/0xc20 [cifs]
      [  330.779696] Write of size 696 at addr ffff88010d5e2860 by task setcifsacl/1012
      
      [  330.781882] CPU: 1 PID: 1012 Comm: setcifsacl Not tainted 4.18.0-rc2+ #2
      [  330.783140] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
      [  330.784395] Call Trace:
      [  330.784789]  dump_stack+0xc2/0x16b
      [  330.786777]  print_address_description+0x6a/0x270
      [  330.787520]  kasan_report+0x258/0x380
      [  330.788845]  memcpy+0x34/0x50
      [  330.789369]  send_set_info+0x4dd/0xc20 [cifs]
      [  330.799511]  SMB2_set_acl+0x76/0xa0 [cifs]
      [  330.801395]  set_smb2_acl+0x7ac/0xf30 [cifs]
      [  330.830888]  cifs_xattr_set+0x963/0xe40 [cifs]
      [  330.840367]  __vfs_setxattr+0x84/0xb0
      [  330.842060]  __vfs_setxattr_noperm+0xe6/0x370
      [  330.843848]  vfs_setxattr+0xc2/0xd0
      [  330.845519]  setxattr+0x258/0x320
      [  330.859211]  path_setxattr+0x15b/0x1b0
      [  330.864392]  __x64_sys_setxattr+0xc0/0x160
      [  330.866133]  do_syscall_64+0x14e/0x4b0
      [  330.876631]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [  330.878503] RIP: 0033:0x7ff2e507db0a
      [  330.880151] Code: 48 8b 0d 89 93 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 bc 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 56 93 2c 00 f7 d8 64 89 01 48
      [  330.885358] RSP: 002b:00007ffdc4903c18 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
      [  330.887733] RAX: ffffffffffffffda RBX: 000055d1170de140 RCX: 00007ff2e507db0a
      [  330.890067] RDX: 000055d1170de7d0 RSI: 000055d115b39184 RDI: 00007ffdc4904818
      [  330.892410] RBP: 0000000000000001 R08: 0000000000000000 R09: 000055d1170de7e4
      [  330.894785] R10: 00000000000002b8 R11: 0000000000000246 R12: 0000000000000007
      [  330.897148] R13: 000055d1170de0c0 R14: 0000000000000008 R15: 000055d1170de550
      
      [  330.901057] Allocated by task 1012:
      [  330.902888]  kasan_kmalloc+0xa0/0xd0
      [  330.904714]  kmem_cache_alloc+0xc8/0x1d0
      [  330.906615]  mempool_alloc+0x11e/0x380
      [  330.908496]  cifs_small_buf_get+0x35/0x60 [cifs]
      [  330.910510]  smb2_plain_req_init+0x4a/0xd60 [cifs]
      [  330.912551]  send_set_info+0x198/0xc20 [cifs]
      [  330.914535]  SMB2_set_acl+0x76/0xa0 [cifs]
      [  330.916465]  set_smb2_acl+0x7ac/0xf30 [cifs]
      [  330.918453]  cifs_xattr_set+0x963/0xe40 [cifs]
      [  330.920426]  __vfs_setxattr+0x84/0xb0
      [  330.922284]  __vfs_setxattr_noperm+0xe6/0x370
      [  330.924213]  vfs_setxattr+0xc2/0xd0
      [  330.926008]  setxattr+0x258/0x320
      [  330.927762]  path_setxattr+0x15b/0x1b0
      [  330.929592]  __x64_sys_setxattr+0xc0/0x160
      [  330.931459]  do_syscall_64+0x14e/0x4b0
      [  330.933314]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      [  330.936843] Freed by task 0:
      [  330.938588] (stack is not available)
      
      [  330.941886] The buggy address belongs to the object at ffff88010d5e2800
       which belongs to the cache cifs_small_rq of size 448
      [  330.946362] The buggy address is located 96 bytes inside of
       448-byte region [ffff88010d5e2800, ffff88010d5e29c0)
      [  330.950722] The buggy address belongs to the page:
      [  330.952789] page:ffffea0004357880 count:1 mapcount:0 mapping:ffff880108fdca80 index:0x0 compound_mapcount: 0
      [  330.955665] flags: 0x17ffffc0008100(slab|head)
      [  330.957760] raw: 0017ffffc0008100 dead000000000100 dead000000000200 ffff880108fdca80
      [  330.960356] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
      [  330.963005] page dumped because: kasan: bad access detected
      
      [  330.967039] Memory state around the buggy address:
      [  330.969255]  ffff88010d5e2880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  330.971833]  ffff88010d5e2900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  330.974397] >ffff88010d5e2980: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
      [  330.976956]                                            ^
      [  330.979226]  ffff88010d5e2a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [  330.981755]  ffff88010d5e2a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [  330.984225] ==================================================================
      
      Fix this by allocating a regular CIFS buffer in
      smb2_plain_req_init() if the request command is SMB2_SET_INFO.
      Reported-by: default avatarJianhong Yin <jiyin@redhat.com>
      Fixes: 366ed846 ("cifs: Use smb 2 - 3 and cifsacl mount options setacl function")
      CC: Stable <stable@vger.kernel.org>
      Signed-off-by: default avatarStefano Brivio <sbrivio@redhat.com>
      Reviewed-and-tested-by: default avatarAurelien Aptel <aaptel@suse.com>
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      f46ecbd9
    • Paulo Alcantara's avatar
      cifs: Fix memory leak in smb2_set_ea() · 6aa0c114
      Paulo Alcantara authored
      This patch fixes a memory leak when doing a setxattr(2) in SMB2+.
      Signed-off-by: default avatarPaulo Alcantara <palcantara@suse.de>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      Reviewed-by: default avatarAurelien Aptel <aaptel@suse.com>
      6aa0c114
    • Ronnie Sahlberg's avatar
      cifs: fix SMB1 breakage · 81f39f95
      Ronnie Sahlberg authored
      SMB1 mounting broke in commit 35e2cc1b
      ("cifs: Use correct packet length in SMB2_TRANSFORM header")
      Fix it and also rename smb2_rqst_len to smb_rqst_len
      to make it less unobvious that the function is also called from
      CIFS/SMB1
      
      Good job by Paulo reviewing and cleaning up Ronnie's original patch.
      Signed-off-by: default avatarRonnie Sahlberg <lsahlber@redhat.com>
      Reviewed-by: default avatarPaulo Alcantara <palcantara@suse.de>
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      81f39f95
    • Paulo Alcantara's avatar
      cifs: Fix validation of signed data in smb2 · 8de8c460
      Paulo Alcantara authored
      Fixes: c713c877 ("cifs: push rfc1002 generation down the stack")
      
      We failed to validate signed data returned by the server because
      __cifs_calc_signature() now expects to sign the actual data in iov but
      we were also passing down the rfc1002 length.
      
      Fix smb3_calc_signature() to calculate signature of rfc1002 length prior
      to passing only the actual data iov[1-N] to __cifs_calc_signature(). In
      addition, there are a few cases where no rfc1002 length is passed so we
      make sure there's one (iov_len == 4).
      Signed-off-by: default avatarPaulo Alcantara <palcantara@suse.de>
      Reviewed-by: default avatarRonnie Sahlberg <lsahlber@redhat.com>
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      8de8c460
    • Paulo Alcantara's avatar
      cifs: Fix validation of signed data in smb3+ · 27c32b49
      Paulo Alcantara authored
      Fixes: c713c877 ("cifs: push rfc1002 generation down the stack")
      
      We failed to validate signed data returned by the server because
      __cifs_calc_signature() now expects to sign the actual data in iov but
      we were also passing down the rfc1002 length.
      
      Fix smb3_calc_signature() to calculate signature of rfc1002 length prior
      to passing only the actual data iov[1-N] to __cifs_calc_signature(). In
      addition, there are a few cases where no rfc1002 length is passed so we
      make sure there's one (iov_len == 4).
      Signed-off-by: default avatarPaulo Alcantara <palcantara@suse.de>
      Reviewed-by: default avatarRonnie Sahlberg <lsahlber@redhat.com>
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      27c32b49
    • Lars Persson's avatar
      cifs: Fix use after free of a mid_q_entry · 696e420b
      Lars Persson authored
      With protocol version 2.0 mounts we have seen crashes with corrupt mid
      entries. Either the server->pending_mid_q list becomes corrupt with a
      cyclic reference in one element or a mid object fetched by the
      demultiplexer thread becomes overwritten during use.
      
      Code review identified a race between the demultiplexer thread and the
      request issuing thread. The demultiplexer thread seems to be written
      with the assumption that it is the sole user of the mid object until
      it calls the mid callback which either wakes the issuer task or
      deletes the mid.
      
      This assumption is not true because the issuer task can be woken up
      earlier by a signal. If the demultiplexer thread has proceeded as far
      as setting the mid_state to MID_RESPONSE_RECEIVED then the issuer
      thread will happily end up calling cifs_delete_mid while the
      demultiplexer thread still is using the mid object.
      
      Inserting a delay in the cifs demultiplexer thread widens the race
      window and makes reproduction of the race very easy:
      
      		if (server->large_buf)
      			buf = server->bigbuf;
      
      +		usleep_range(500, 4000);
      
      		server->lstrp = jiffies;
      
      To resolve this I think the proper solution involves putting a
      reference count on the mid object. This patch makes sure that the
      demultiplexer thread holds a reference until it has finished
      processing the transaction.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLars Persson <larper@axis.com>
      Acked-by: default avatarPaulo Alcantara <palcantara@suse.de>
      Reviewed-by: default avatarRonnie Sahlberg <lsahlber@redhat.com>
      Reviewed-by: default avatarPavel Shilovsky <pshilov@microsoft.com>
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      696e420b
    • Linus Torvalds's avatar
      autofs: rename 'autofs' module back to 'autofs4' · d02d21ea
      Linus Torvalds authored
      It turns out that systemd has a bug: it wants to load the autofs module
      early because of some initialization ordering with udev, and it doesn't
      do that correctly.  Everywhere else it does the proper "look up module
      name" that does the proper alias resolution, but in that early code, it
      just uses a hardcoded "autofs4" for the module name.
      
      The result of that is that as of commit a2225d93 ("autofs: remove
      left-over autofs4 stubs"), you get
      
          systemd[1]: Failed to insert module 'autofs4': No such file or directory
      
      in the system logs, and a lack of module loading.  All this despite the
      fact that we had very clearly marked 'autofs4' as an alias for this
      module.
      
      What's so ridiculous about this is that literally everything else does
      the module alias handling correctly, including really old versions of
      systemd (that just used 'modprobe' to do this), and even all the other
      systemd module loading code.
      
      Only that special systemd early module load code is broken, hardcoding
      the module names for not just 'autofs4', but also "ipv6", "unix",
      "ip_tables" and "virtio_rng".  Very annoying.
      
      Instead of creating an _additional_ separate compatibility 'autofs4'
      module, just rely on the fact that everybody else gets this right, and
      just call the module 'autofs4' for compatibility reasons, with 'autofs'
      as the alias name.
      
      That will allow the systemd people to fix their bugs, adding the proper
      alias handling, and maybe even fix the name of the module to be just
      "autofs" (so that they can _test_ the alias handling).  And eventually,
      we can revert this silly compatibility hack.
      
      See also
      
          https://github.com/systemd/systemd/issues/9501
          https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=902946
      
      for the systemd bug reports upstream and in the Debian bug tracker
      respectively.
      
      Fixes: a2225d93 ("autofs: remove left-over autofs4 stubs")
      Reported-by: default avatarBen Hutchings <ben@decadent.org.uk>
      Reported-by: default avatarMichael Biebl <biebl@debian.org>
      Cc: Ian Kent <raven@themaw.net>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d02d21ea
    • Greg Hackmann's avatar
      arm64: remove no-op -p linker flag · 1a381d4a
      Greg Hackmann authored
      Linking the ARM64 defconfig kernel with LLVM lld fails with the error:
      
        ld.lld: error: unknown argument: -p
        Makefile:1015: recipe for target 'vmlinux' failed
      
      Without this flag, the ARM64 defconfig kernel successfully links with
      lld and boots on Dragonboard 410c.
      
      After digging through binutils source and changelogs, it turns out that
      -p is only relevant to ancient binutils installations targeting 32-bit
      ARM.  binutils accepts -p for AArch64 too, but it's always been
      undocumented and silently ignored.  A comment in
      ld/emultempl/aarch64elf.em explains that it's "Only here for backwards
      compatibility".
      
      Since this flag is a no-op on ARM64, we can safely drop it.
      Acked-by: default avatarWill Deacon <will.deacon@arm.com>
      Reviewed-by: default avatarNick Desaulniers <ndesaulniers@google.com>
      Signed-off-by: default avatarGreg Hackmann <ghackmann@google.com>
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      1a381d4a
    • Linus Torvalds's avatar
      Merge tag 'acpi-4.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 06c85639
      Linus Torvalds authored
      Pull ACPI fixes from Rafael Wysocki:
       "These fix a recent ACPICA regression, fix a battery driver regression
        introduced during the 4.17 cycle and fix up the recently added support
        for the PPTT ACPI table.
      
        Specifics:
      
         - Revert part of a recent ACPICA regression fix that added leading
           newlines to ACPICA error messages and made the kernel log look
           broken (Rafael Wysocki).
      
         - Fix an ACPI battery driver regression introduced during the 4.17
           cycle due to incorrect error handling that made Thinkpad 13 laptops
           crash on boot (Jouke Witteveen).
      
         - Fix up the recently added PPTT ACPI table support by covering the
           case when a PPTT structure represents a processors group correctly
           (Sudeep Holla)"
      
      * tag 'acpi-4.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI / battery: Safe unregistering of hooks
        ACPI / PPTT: use ACPI ID whenever ACPI_PPTT_ACPI_PROCESSOR_ID_VALID is set
        ACPICA: Drop leading newlines from error messages
      06c85639
    • Linus Torvalds's avatar
      Merge tag 'pm-4.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 90dc8b65
      Linus Torvalds authored
      Pull power management fixes from Rafael Wysocki:
       "These fix a PCI power management regression introduced during the 4.17
        cycle and fix up the recently added support for devices in multiple
        power domains.
      
        Specifics:
      
         - Resume parallel PCI (non-PCIe) bridges on suspend-to-RAM (ACP S3)
           to avoid confusing the platform firmware which started to happen
           after a core power management regression fix that went in during
           the 4.17 cycle (Rafael Wysocki).
      
         - Fix up the recently added support for devices in multiple power
           domains by avoiding to power up the entire domain unnecessarily
           when attaching a device to it (Ulf Hansson)"
      
      * tag 'pm-4.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        PM / Domains: Don't power on at attach for the multi PM domain case
        PCI / ACPI / PM: Resume bridges w/o drivers on suspend-to-RAM
      90dc8b65
    • Linus Torvalds's avatar
      Merge tag 'riscv-for-linus-4.18-rc4' of... · b19b9282
      Linus Torvalds authored
      Merge tag 'riscv-for-linus-4.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux
      
      Pull RISC-V fixes from Palmer Dabbelt:
       "This contains a handful of fixes for the RISC-V port:
      
         - A fix to R_RISCV_ADD32/R_RISCV_SUB32 relocations that allows
           modules that use these to load correctly.
      
         - The removal of of_platform_populate(), which is obselete.
      
         - The removal of irq-riscv-intc.h, which is obselete.
      
         - A fix to PTRACE_SETREGSET.
      
         - Fixes that allow the RV32I kernel to build (at least for Zong, I've
           got another patch on the mailing list that's necessary on my setup :)).
      
        I've just given these a defconfig build test"
      
      * tag 'riscv-for-linus-4.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux:
        RISC-V: Fix PTRACE_SETREGSET bug.
        RISC-V: Don't include irq-riscv-intc.h
        riscv: remove unnecessary of_platform_populate call
        RISC-V: fix R_RISCV_ADD32/R_RISCV_SUB32 relocations
        RISC-V: Change variable type for 32-bit compatible
        RISC-V: Add definiion of extract symbol's index and type for 32-bit
        RISC-V: Select GENERIC_UCMPDI2 on RV32I
        RISC-V: Add conditional macro for zone of DMA32
      b19b9282
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu · 760885f2
      Linus Torvalds authored
      Pull m68knommu fix from Greg Ungerer:
       "A single fix for breakage introduced in this merge window"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
        m68k: fix "bad page state" oops on ColdFire boot
      760885f2
    • Mikita Lipski's avatar
      drm/amd/display: add a check for display depth validity · 413ff0b9
      Mikita Lipski authored
      [why]
      HDMI 2.0 fails to validate 4K@60 timing with 10 bpc
      [how]
      Adding a helper function that would verify if the display depth
      assigned would pass a bandwidth validation.
      Drop the display depth by one level till calculated pixel clk
      is lower than maximum TMDS clk.
      
      Bugzilla: https://bugs.freedesktop.org/106959Tested-by: default avatarMike Lothian <mike@fireburn.co.uk>
      Reviewed-by: default avatarHarry Wentland <harry.wentland@amd.com>
      Signed-off-by: default avatarMikita Lipski <mikita.lipski@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      413ff0b9
    • Mikita Lipski's avatar
      drm/amd/display: adding ycbcr420 pixel encoding for hdmi · a6311be8
      Mikita Lipski authored
      [why]
      HDMI EDID's VSDB contains spectial timings for specifically
      YCbCr 4:2:0 colour space. In those cases we need to verify
      if the mode provided is one of the special ones has to use
      YCbCr 4:2:0 pixel encoding for display info.
      [how]
      Verify if the mode is using specific ycbcr420 colour space with
      the help of DRM helper function and assign the mode to use
      ycbcr420 pixel encoding.
      Tested-by: default avatarMike Lothian <mike@fireburn.co.uk>
      Reviewed-by: default avatarHarry Wentland <harry.wentland@amd.com>
      Signed-off-by: default avatarMikita Lipski <mikita.lipski@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      a6311be8
    • Rafael J. Wysocki's avatar
      Merge branches 'acpi-tables' and 'acpica' · df958569
      Rafael J. Wysocki authored
      Merge ACPICA regression fix and a fix for the recently added PPTT
      support.
      
      * acpi-tables:
        ACPI / PPTT: use ACPI ID whenever ACPI_PPTT_ACPI_PROCESSOR_ID_VALID is set
      
      * acpica:
        ACPICA: Drop leading newlines from error messages
      df958569
    • Rafael J. Wysocki's avatar
      Merge branch 'pm-pci' · 88b96088
      Rafael J. Wysocki authored
      Merge a PCI power management regression fix.
      
      * pm-pci:
        PCI / ACPI / PM: Resume bridges w/o drivers on suspend-to-RAM
      88b96088
    • Mikulas Patocka's avatar
      drm/udl: fix display corruption of the last line · 99ec9e77
      Mikulas Patocka authored
      The displaylink hardware has such a peculiarity that it doesn't render a
      command until next command is received. This produces occasional
      corruption, such as when setting 22x11 font on the console, only the first
      line of the cursor will be blinking if the cursor is located at some
      specific columns.
      
      When we end up with a repeating pixel, the driver has a bug that it leaves
      one uninitialized byte after the command (and this byte is enough to flush
      the command and render it - thus it fixes the screen corruption), however
      whe we end up with a non-repeating pixel, there is no byte appended and
      this results in temporary screen corruption.
      
      This patch fixes the screen corruption by always appending a byte 0xAF at
      the end of URB. It also removes the uninitialized byte.
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      99ec9e77
  5. 04 Jul, 2018 2 commits
    • Masahiro Yamada's avatar
      arm64: add endianness option to LDFLAGS instead of LD · 2893af07
      Masahiro Yamada authored
      With the recent syntax extension, Kconfig is now able to evaluate the
      compiler / toolchain capability.
      
      However, accumulating flags to 'LD' is not compatible with the way
      it works; 'LD' must be passed to Kconfig to call $(ld-option,...)
      from Kconfig files.  If you tweak 'LD' in arch Makefile depending on
      CONFIG_CPU_BIG_ENDIAN, this would end up with circular dependency
      between Makefile and Kconfig.
      Acked-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarMasahiro Yamada <yamada.masahiro@socionext.com>
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      2893af07
    • Palmer Dabbelt's avatar
      RISC-V: Fix the rv32i kernel build · 9a6a5115
      Palmer Dabbelt authored
      These patches for building 32-bit RISC-V kernel.
       - Fix the compile errors and warnings on RV32I.
       - Fix some incompatible problem on RV32I.
       - Add format.h for compatible of print format.
      
      The fixed width integer types format for Elf_Addr will move to
      generic header by another patch. For now, there are some warning
      about unexpected argument of type on RV32I.
      
      Change in v1:
       - Fix some error in v1
       - Remove implementation of fixed width integer types format for Elf_Addr.
      9a6a5115