Merge tag 'renesas-defconfig-for-v4.18' of https://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into next/defconfig

Renesas ARM Based SoC Defconfig Updates for v4.18

* Enable in shmobile and multi_v7 defconfigs to give wider test coverage:

  - Recently mainlined support for RZ/G1C (r8a77470) SoC

  - Renesas Watchdog (RENESAS_WDT) which is used on
    R-Car Gen2 and RZ/G1 platforms.

* Disable in shmobile and multi_v7 defconfigs to avoid unecessary bloat:

  FB_SH_MOBILE_MERAM the last user of which was removed in v4.1 by
  a521422e ("ARM: shmobile: mackerel: Remove Legacy C board
  code").

* tag 'renesas-defconfig-for-v4.18' of https://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
  ARM: multi_v7_defconfig: Enable RENESAS_WDT
  ARM: shmobile: defconfig: Enable RENESAS_WDT_GEN
  ARM: multi_v7_defconfig: Disable CONFIG_FB_SH_MOBILE_MERAM
  ARM: shmobile: defconfig: Disable CONFIG_FB_SH_MOBILE_MERAM
  ARM: multi_v7_defconfig: Enable r8a77470 SoC
  ARM: shmobile: defconfig: Enable r8a77470 SoC
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'qcom-arm64-defconfig-for-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/agross/linux into next/defconfig

Qualcomm ARM64 Based defconfig Updates for v4.18

* Enable UFS and PCIe for Qualcomm msm8996/db820c

* tag 'qcom-arm64-defconfig-for-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/agross/linux:
  arm64: defconfig: Enable PCIe on msm8996 and db820c
  arm64: defconfig: Enable UFS on msm8996
Signed-off-by: Olof Johansson <olof@lixom.net>

ARM64: hisilicon: defconfig updates for 4.18

- Enable the support of ethernet, eMMC, Combo/INNO phy
  and PCIe for Hi3798CV200
- Enable the LPC for hip06 and hip07

* tag 'hisi-defconfig-for-4.18v3' of git://github.com/hisilicon/linux-hisi:
  arm64: defconfig: Enable HISILICON_LPC
  arm64: defconfig: enable drivers for Poplar support
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'imx-defconfig-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into next/defconfig

i.MX defconfig update for 4.18:
 - Enable i.MX6SLL SoC support.
 - Build in GPIO_MAX732X support as the GPIO expanders are used on
   i.MX6 SabreAuto boards.
 - Enable driver for RN5T618 PMIC and Marvell MWIFIEX support which
   are found on i.MX6/7 Colibri boards.
 - Build in OCOTP NVMEM driver for Vybrid (vf610) SoCs.

* tag 'imx-defconfig-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
  ARM: imx_v6_v7_defconfig: Select CONFIG_GPIO_MAX732X by default
  ARM: imx_v6_v7_defconfig: enable imx6sll by default
  ARM: imx_v6_v7_defconfig: enable Vybrid OCOTP driver
  ARM: imx_v6_v7_defconfig: add mwifiex driver
  ARM: imx_v6_v7_defconfig: add RN5T618 PMIC family support
Signed-off-by: Olof Johansson <olof@lixom.net>

The msm8996 PCIe sits behind the "agnoc0", which is represented as a
simple-pm-bus, so enable support for this. Then enable the QMP phy
driver.

Also enable the atl1c ethernet driver and ath10k wlan driver to support
these components on the DragonBoard820c.
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Andy Gross <andy.gross@linaro.org>

Now that the driver has been merged for the HiSilicon
LPC host, enable the relevant config.

Turning on this config will also enable config
INDIRECT_PIO, which would have not been enabled
previously - see config info for more details.
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>

It enables driver support of Ethernet, eMMC, Combo/INNO phy and PCIe
for Hi3798CV200 Poplar platform.
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>

mvebu arm64 for 4.18 (part 1)

Adding thermal for Armada 7K/8K and SPI for Armada 3700

* tag 'mvebu-arm64-4.18-1' of git://git.infradead.org/linux-mvebu:
  arm64: defconfig: enable the Armada thermal driver
  arm64: defconfig: enable CONFIG_SPI_ARMADA_3700
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'renesas-arm64-defconfig-for-v4.18' of https://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into next/defconfig

Renesas ARM64 Based SoC Defconfig Updates for v4.18

* Enable in ARM64 defconfig:
  - Recently mainlined support for R-Car E3 (r8a77990) SoC

  - HDMI sound and depdencies.

    HDMI sound is used by R-Car Gen 3.  These options are enabled as
    modules to avoid unnecesesarily enlarging the kernel image.

* tag 'renesas-arm64-defconfig-for-v4.18' of https://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
  arm64: defconfig: enable R8A77990 SoC
  arm64: defconfig: Enable CONFIG_SND_AUDIO_GRAPH_CARD
  arm64: defconfig: makes SND_SIMPLE_CARD to module
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'davinci-for-v4.18/defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci into next/defconfig

Enable DA8XX remoteproc driver support in davinci_all_defconfig

* tag 'davinci-for-v4.18/defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci:
  ARM: davinci_all_defconfig: enable support for remoteproc drivers
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'amlogic-defconfig' of https://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-amlogic into next/defconfig

Amlogic: defconfig updates for v4.18
- multi_v7_defconfig: enable meson PWM, I2C drivers

* tag 'amlogic-defconfig' of https://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-amlogic:
  ARM: multi_v7_defconfig: enable the Meson PWM controller
  arm: multi_v7_defconfig: enable the Amlogic Meson I2C driver
Signed-off-by: Olof Johansson <olof@lixom.net>

Enable GLINK RPM so that we get RPM regulators and clocks and enable the
UFS host controller driver and the Qualcomm UFS platform driver. The UFS
phy is selected by the Qualcomm UFS driver.

The simple ondemand devfreq governor must be builtin, as there's no
mechanism for automatically loading it, causing UFS HCD initialization
to fail.
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Andy Gross <andy.gross@linaro.org>

This patch enables the Armada thermal driver to support thermal
management on Marvell EBU Armada SoCs (7K,8K).
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>

R-Car Gen2 and RZ/G1 platforms come with a watchdog IP, therefore enable
its driver by default. It is enabled as a module to avoid increasing
the kernel image size.
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

R-Car Gen2 and RZ/G1 platforms come with a watchdog IP, therefore enable
its driver by default.
Signed-off-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
Signed-off-by: Ramesh Shanmugasundaram <ramesh.shanmugasundaram@bp.renesas.com>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>

Enable the Renesas R-Car E3 (R8A77990) SoC in the ARM64 defconfig.
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>

Merge tag 'v4.18-rockchip-defconfig64-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into next/defconfig

Enablement of Rockchip-specific efuse, io-domain and typec drivers
as well as general cros-ec, hid, touchscreen bluetooth and wifi-drivers
on 64bit arm platforms.

* tag 'v4.18-rockchip-defconfig64-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip:
  arm64: defconfig: enable rockchip efuse
  arm64: defconfig: Enable bluetooth USB support
  arm64: defconfig: Enable Marvell WiFi-Ex PCIe driver
  arm64: defconfig: Enable Atmel Maxtouch driver
  arm64: defconfig: Enable HID over I2C drivers
  arm64: defconfig: Enable ChromeOS EC drivers for supported Chromebooks.
  arm64: defconfig: Enable Rockchip io-domain driver
  arm64: defconfig: Enable typec-phy and extcon-usbc-cros-ec for rk3399
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'v4.17-next-defconfig' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux into next/defconfig

enable mt7622 pinctrl to fix boot issue

* tag 'v4.17-next-defconfig' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux:
  arm64: defconfig: Enable CONFIG_PINCTRL_MT7622 by default
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'samsung-defconfig-4.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into next/defconfig

Samsung defconfig changes for v4.18

1. Enable Samsung S6E63J0X03 DSI panel.

* tag 'samsung-defconfig-4.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux:
  ARM: multi_v7_config: enable S6E63J0X03 panel driver
  ARM: exynos_defconfig: enable S6E63J0X03 panel driver
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'arm-soc/for-4.18/defconfig-arm64' of https://github.com/Broadcom/stblinux into next/defconfig

This pull request contains Broadcom ARM64-based SoCs defconfig changes
for 4.18, please pull the following:

- Stefan provides a set of updates targeting the Raspberry Pi 3 B+
  platform: LAN7515 USB Ethernet driver, Cypress CYW43455 Bluetooth when
  using the Pi 3 B+ in AArch64 boot mode. He also updates the ARM64
  defconfig to create a bigger default CMA region to let the VideoCore 4
  driver initialize correctly.

* tag 'arm-soc/for-4.18/defconfig-arm64' of https://github.com/Broadcom/stblinux:
  arm64: defconfig: Increase CMA size for VC4
  arm64: defconfig: Enable LAN and BT support for RPi 3 B+
Signed-off-by: Olof Johansson <olof@lixom.net>

This pull request contains Broadcom ARM-based SoCs defconfig changes for
4.18, please pull the following:

- Stefan provides a set of updates targeting the Raspberry Pi 3 B+
  platform: LAN7515 USB Ethernet driver, Cypress CYW43455 Bluetooth and
  he also enables the VCHIQ driver to help with continous testing on
  kernelci.org.

* tag 'arm-soc/for-4.18/defconfig' of https://github.com/Broadcom/stblinux:
  ARM: multi_v7_defconfig: Enable LAN and BT for RPi 3 B+
  ARM: bcm2835_defconfig: Enable VCHIQ driver
  ARM: bcm2835_defconfig: Enable LAN78XX driver
Signed-off-by: Olof Johansson <olof@lixom.net>

This patch adds STM32F7 I2C support to multi_v7_defconfig and
enable the STM32 USB PHY Controller (USBPHYC) driver, implemented on
STM32MP1 SoC.
Signed-off-by: Pierre-Yves MORDRET <pierre-yves.mordret@st.com>
Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com>
Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
Signed-off-by: Olof Johansson <olof@lixom.net>

Pull x86/pti updates from Thomas Gleixner:
 "A mixed bag of fixes and updates for the ghosts which are hunting us.

  The scheduler fixes have been pulled into that branch to avoid
  conflicts.

   - A set of fixes to address a khread_parkme() race which caused lost
     wakeups and loss of state.

   - A deadlock fix for stop_machine() solved by moving the wakeups
     outside of the stopper_lock held region.

   - A set of Spectre V1 array access restrictions. The possible
     problematic spots were discuvered by Dan Carpenters new checks in
     smatch.

   - Removal of an unused file which was forgotten when the rest of that
     functionality was removed"

* 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/vdso: Remove unused file
  perf/x86/cstate: Fix possible Spectre-v1 indexing for pkg_msr
  perf/x86/msr: Fix possible Spectre-v1 indexing in the MSR driver
  perf/x86: Fix possible Spectre-v1 indexing for x86_pmu::event_map()
  perf/x86: Fix possible Spectre-v1 indexing for hw_perf_event cache_*
  perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[]
  sched/autogroup: Fix possible Spectre-v1 indexing for sched_prio_to_weight[]
  sched/core: Fix possible Spectre-v1 indexing for sched_prio_to_weight[]
  sched/core: Introduce set_special_state()
  kthread, sched/wait: Fix kthread_parkme() completion issue
  kthread, sched/wait: Fix kthread_parkme() wait-loop
  sched/fair: Fix the update of blocked load when newly idle
  stop_machine, sched: Fix migrate_swap() vs. active_balance() deadlock

Pull scheduler fix from Thomas Gleixner:
 "Revert the new NUMA aware placement approach which turned out to
  create more problems than it solved"

* 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  Revert "sched/numa: Delay retrying placement for automatic NUMA balance after wake_affine()"

Pull perf tooling fixes from Thomas Gleixner:
 "Another small set of perf tooling fixes and updates:

   - Revert "perf pmu: Fix pmu events parsing rule", as it broke Intel
     PT event description parsing (Arnaldo Carvalho de Melo)

   - Sync x86's cpufeatures.h and kvm UAPI headers with the kernel
     sources, suppressing the ABI drift warnings (Arnaldo Carvalho de
     Melo)

   - Remove duplicated entry for westmereep-dp in Intel's mapfile.csv
     (William Cohen)

   - Fix typo in 'perf bench numa' options description (Yisheng Xie)"

* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  Revert "perf pmu: Fix pmu events parsing rule"
  tools headers kvm: Sync ARM UAPI headers with the kernel sources
  tools headers kvm: Sync uapi/linux/kvm.h with the kernel sources
  tools headers: Sync x86 cpufeatures.h with the kernel sources
  perf vendor events intel: Remove duplicated entry for westmereep-dp in mapfile.csv
  perf bench numa: Fix typo in options

Pull dma-mapping fix from Christoph Hellwig:
 "Just one little fix from Jean to avoid a harmless but very annoying
  warning, especially for the drm code"

* tag 'dma-mapping-4.17-5' of git://git.infradead.org/users/hch/dma-mapping:
  swiotlb: silent unwanted warning "buffer is full"

The VC4 needs more memory than the default setting (16 MB):

  vc4-drm soc:gpu: swiotlb: coherent allocation failed, size=16777216
  [drm:vc4_bo_create [vc4]] *ERROR* Failed to allocate from CMA:
  vc4_v3d 3fc00000.v3d: Failed to allocate memory for tile binning: -12.
    You may need to enable CMA or give it more memory.
  vc4-drm soc:gpu: failed to bind 3fc00000.v3d (ops vc4_v3d_ops [vc4]): -12
  vc4-drm soc:gpu: master bind failed: -12
  vc4-drm: probe of soc:gpu failed with error -12

So increase the value to 32 MB and fix this issue.
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>

Pull cifs fixes from Steve French:
 "Some small SMB3 fixes for 4.17-rc5, some for stable"

* tag '4.17-rc4-SMB3-Fixes' of git://git.samba.org/sfrench/cifs-2.6:
  smb3: directory sync should not return an error
  cifs: smb2ops: Fix listxattr() when there are no EAs
  cifs: smbd: Enable signing with smbdirect
  cifs: Allocate validate negotiation request through kmalloc

Pull thermal fixes from Zhang Rui:

 - fix NULL pointer dereference on module load/probe for int3403_thermal
   driver

 - fix an emergency shutdown issue on exynos thermal driver

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux:
  thermal: exynos: Propagate error value from tmu_read()
  thermal: exynos: Reading temperature makes sense only when TMU is turned on
  thermal: int3403_thermal: Fix NULL pointer deref on module load / probe

Pull block fixes from Jens Axboe:
 "Just a few NVMe fixes this round - one fixing a use-after-free, one
  fixes the return value after controller reset, and the last one fixes
  an issue where some drives will spuriously EIO. We should get these
  into 4.17"

* tag 'for-linus-20180511' of git://git.kernel.dk/linux-block:
  nvme: add quirk to force medium priority for SQ creation
  nvme: Fix sync controller reset return
  nvme: fix use-after-free in nvme_free_ns_head

If DMA_ATTR_NO_WARN is passed to swiotlb_alloc_buffer(), it should be
passed further down to swiotlb_tbl_map_single(). Otherwise we escape
half of the warnings but still log the other half.

This is one of the multiple causes of spurious warnings reported at:
https://bugs.freedesktop.org/show_bug.cgi?id=104082Signed-off-by: Jean Delvare <jdelvare@suse.de>
Fixes: 0176adb0 ("swiotlb: refactor coherent buffer allocation")
Cc: Christoph Hellwig <hch@lst.de>
Cc: Christian König <christian.koenig@amd.com>
Cc: Michel Dänzer <michel@daenzer.net>
Cc: Takashi Iwai <tiwai@suse.de>
Cc: stable@vger.kernel.org # v4.16

This reverts commit 7347fc87.

Srikar Dronamra pointed out that while the commit in question did show
a performance improvement on ppc64, it did so at the cost of disabling
active CPU migration by automatic NUMA balancing which was not the intent.
The issue was that a serious flaw in the logic failed to ever active balance
if SD_WAKE_AFFINE was disabled on scheduler domains. Even when it's enabled,
the logic is still bizarre and against the original intent.

Investigation showed that fixing the patch in either the way he suggested,
using the correct comparison for jiffies values or introducing a new
numa_migrate_deferred variable in task_struct all perform similarly to a
revert with a mix of gains and losses depending on the workload, machine
and socket count.

The original intent of the commit was to handle a problem whereby
wake_affine, idle balancing and automatic NUMA balancing disagree on the
appropriate placement for a task. This was particularly true for cases where
a single task was a massive waker of tasks but where wake_wide logic did
not apply.  This was particularly noticeable when a futex (a barrier) woke
all worker threads and tried pulling the wakees to the waker nodes. In that
specific case, it could be handled by tuning MPI or openMP appropriately,
but the behavior is not illogical and was worth attempting to fix. However,
the approach was wrong. Given that we're at rc4 and a fix is not obvious,
it's better to play safe, revert this commit and retry later.
Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: efault@gmx.de
Cc: ggherdovich@suse.cz
Cc: hpa@zytor.com
Cc: matt@codeblueprint.co.uk
Cc: mpe@ellerman.id.au
Link: http://lkml.kernel.org/r/20180509163115.6fnnyeg4vdm2ct4v@techsingularity.netSigned-off-by: Ingo Molnar <mingo@kernel.org>

Merge misc fixes from Andrew Morton:
 "13 fixes"

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  rbtree: include rcu.h
  scripts/faddr2line: fix error when addr2line output contains discriminator
  ocfs2: take inode cluster lock before moving reflinked inode from orphan dir
  mm, oom: fix concurrent munlock and oom reaper unmap, v3
  mm: migrate: fix double call of radix_tree_replace_slot()
  proc/kcore: don't bounds check against address 0
  mm: don't show nr_indirectly_reclaimable in /proc/vmstat
  mm: sections are not offlined during memory hotremove
  z3fold: fix reclaim lock-ups
  init: fix false positives in W+X checking
  lib/find_bit_benchmark.c: avoid soft lockup in test_find_first_bit()
  KASAN: prohibit KASAN+STRUCTLEAK combination
  MAINTAINERS: update Shuah's email address

Since commit c1adf200 ("Introduce rb_replace_node_rcu()")
rbtree_augmented.h uses RCU related data structures but does not include
the header file.  It works as long as it gets somehow included before
that and fails otherwise.

Link: http://lkml.kernel.org/r/20180504103159.19938-1-bigeasy@linutronix.deSigned-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

When addr2line output contains discriminator, the current awk script
cannot parse it.  This patch fixes it by extracting key words using
regex which is more reliable.

  $ scripts/faddr2line vmlinux tlb_flush_mmu_free+0x26
  tlb_flush_mmu_free+0x26/0x50:
  tlb_flush_mmu_free at mm/memory.c:258 (discriminator 3)
  scripts/faddr2line: eval: line 173: unexpected EOF while looking for matching `)'

Link: http://lkml.kernel.org/r/1525323379-25193-1-git-send-email-changbin.du@intel.com
Fixes: 6870c016 ("scripts/faddr2line: show the code context")
Signed-off-by: Changbin Du <changbin.du@intel.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Philippe Ombredanne <pombredanne@nexb.com>
Cc: NeilBrown <neilb@suse.com>
Cc: Richard Weinberger <richard@nod.at>
Cc: Kate Stewart <kstewart@linuxfoundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

While reflinking an inode, we create a new inode in orphan directory,
then take EX lock on it, reflink the original inode to orphan inode and
release EX lock.  Once the lock is released another node could request
it in EX mode from ocfs2_recover_orphans() which causes downconvert of
the lock, on this node, to NL mode.

Later we attempt to initialize security acl for the orphan inode and
move it to the reflink destination.  However, while doing this we dont
take EX lock on the inode.  This could potentially cause problems
because we could be starting transaction, accessing journal and
modifying metadata of the inode while holding NL lock and with another
node holding EX lock on the inode.

Fix this by taking orphan inode cluster lock in EX mode before
initializing security and moving orphan inode to reflink destination.
Use the __tracker variant while taking inode lock to avoid recursive
locking in the ocfs2_init_security_and_acl() call chain.

Link: http://lkml.kernel.org/r/1523475107-7639-1-git-send-email-ashish.samant@oracle.comSigned-off-by: Ashish Samant <ashish.samant@oracle.com>
Reviewed-by: Joseph Qi <jiangqi903@gmail.com>
Reviewed-by: Junxiao Bi <junxiao.bi@oracle.com>
Acked-by: Jun Piao <piaojun@huawei.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Changwei Ge <ge.changwei@h3c.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Since exit_mmap() is done without the protection of mm->mmap_sem, it is
possible for the oom reaper to concurrently operate on an mm until
MMF_OOM_SKIP is set.

This allows munlock_vma_pages_all() to concurrently run while the oom
reaper is operating on a vma.  Since munlock_vma_pages_range() depends
on clearing VM_LOCKED from vm_flags before actually doing the munlock to
determine if any other vmas are locking the same memory, the check for
VM_LOCKED in the oom reaper is racy.

This is especially noticeable on architectures such as powerpc where
clearing a huge pmd requires serialize_against_pte_lookup().  If the pmd
is zapped by the oom reaper during follow_page_mask() after the check
for pmd_none() is bypassed, this ends up deferencing a NULL ptl or a
kernel oops.

Fix this by manually freeing all possible memory from the mm before
doing the munlock and then setting MMF_OOM_SKIP.  The oom reaper can not
run on the mm anymore so the munlock is safe to do in exit_mmap().  It
also matches the logic that the oom reaper currently uses for
determining when to set MMF_OOM_SKIP itself, so there's no new risk of
excessive oom killing.

This issue fixes CVE-2018-1000200.

Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1804241526320.238665@chino.kir.corp.google.com
Fixes: 21292580 ("mm: oom: let oom_reap_task and exit_mmap run concurrently")
Signed-off-by: David Rientjes <rientjes@google.com>
Suggested-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: <stable@vger.kernel.org>	[4.14+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

radix_tree_replace_slot() is called twice for head page, it's obviously
a bug.  Let's fix it.

Link: http://lkml.kernel.org/r/20180423072101.GA12157@hori1.linux.bs1.fc.nec.co.jp
Fixes: e71769ae ("mm: enable thp migration for shmem thp")
Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Reported-by: Matthew Wilcox <willy@infradead.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
Cc: Zi Yan <zi.yan@sent.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The existing kcore code checks for bad addresses against __va(0) with
the assumption that this is the lowest address on the system.  This may
not hold true on some systems (e.g.  arm64) and produce overflows and
crashes.  Switch to using other functions to validate the address range.

It's currently only seen on arm64 and it's not clear if anyone wants to
use that particular combination on a stable release.  So this is not
urgent for stable.

Link: http://lkml.kernel.org/r/20180501201143.15121-1-labbott@redhat.comSigned-off-by: Laura Abbott <labbott@redhat.com>
Tested-by: Dave Anderson <anderson@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Alexey Dobriyan <adobriyan@gmail.com>a
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>