1. 21 4月, 2018 1 次提交
    • L
      Merge tag 'for_v4.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs · 0d9cf33b
      Linus Torvalds 提交于
       - isofs memory leak fix
      
       - two fsnotify fixes of event mask handling
      
       - udf fix of UTF-16 handling
      
       - couple other smaller cleanups
      
      * tag 'for_v4.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
        udf: Fix leak of UTF-16 surrogates into encoded strings
        fs: ext2: Adding new return type vm_fault_t
        isofs: fix potential memory leak in mount option parsing
        MAINTAINERS: add an entry for FSNOTIFY infrastructure
        fsnotify: fix typo in a comment about mark->g_list
        fsnotify: fix ignore mask logic in send_to_group()
        isofs compress: Remove VLA usage
        fs: quota: Replace GFP_ATOMIC with GFP_KERNEL in dquot_init
        fanotify: fix logic of events on child
      0d9cf33b
  2. 20 4月, 2018 6 次提交
    • L
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid · 4d189053
      Linus Torvalds 提交于
      Pull HID updates from Jiri Kosina:
      
       - suspend/resume handling fix for Raydium I2C-connected touchscreen
         from Aaron Ma
      
       - protocol fixup for certain BT-connected Wacoms from Aaron Armstrong
         Skomra
      
       - battery level reporting fix on BT-connected mice from Dmitry Torokhov
      
       - hidraw race condition fix from Rodrigo Rivas Costa
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
        HID: i2c-hid: fix inverted return value from i2c_hid_command()
        HID: i2c-hid: Fix resume issue on Raydium touchscreen device
        HID: wacom: bluetooth: send exit report for recent Bluetooth devices
        HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device
        HID: input: fix battery level reporting on BT mice
      4d189053
    • L
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching · 41e3bef5
      Linus Torvalds 提交于
      Pull livepatching fix from Jiri Kosina:
       "Shadow variable API list_head initialization fix from Petr Mladek"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching:
        livepatch: Allow to call a custom callback when freeing shadow variables
        livepatch: Initialize shadow variables safely by a custom callback
      41e3bef5
    • L
      Merge tag 'for-linus-4.17-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · 36e584de
      Linus Torvalds 提交于
      Pull xen fixes from Juergen Gross:
      
       - some fixes of kmalloc() flags
      
       - one fix of the xenbus driver
      
       - an update of the pv sound driver interface needed for a driver which
         will go through the sound tree
      
      * tag 'for-linus-4.17-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        xen: xenbus_dev_frontend: Really return response string
        xen/sndif: Sync up with the canonical definition in Xen
        xen: xen-pciback: Replace GFP_ATOMIC with GFP_KERNEL in pcistub_reg_add
        xen: xen-pciback: Replace GFP_ATOMIC with GFP_KERNEL in xen_pcibk_config_quirks_init
        xen: xen-pciback: Replace GFP_ATOMIC with GFP_KERNEL in pcistub_device_alloc
        xen: xen-pciback: Replace GFP_ATOMIC with GFP_KERNEL in pcistub_init_device
        xen: xen-pciback: Replace GFP_ATOMIC with GFP_KERNEL in pcistub_probe
      36e584de
    • L
      Merge tag 'mips_fixes_4.17_1' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/mips · 854da238
      Linus Torvalds 提交于
      Pull MIPS fixes from James Hogan:
      
       - io: Add barriers to read*() & write*()
      
       - dts: Fix boston PCI bus DTC warnings (4.17)
      
       - memset: Several corner case fixes (one 3.10, others longer)
      
      * tag 'mips_fixes_4.17_1' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/mips:
        MIPS: uaccess: Add micromips clobbers to bzero invocation
        MIPS: memset.S: Fix clobber of v1 in last_fixup
        MIPS: memset.S: Fix return of __clear_user from Lpartial_fixup
        MIPS: memset.S: EVA & fault support for small_memset
        MIPS: dts: Boston: Fix PCI bus dtc warnings:
        MIPS: io: Add barrier after register read in readX()
        MIPS: io: Prevent compiler reordering writeX()
      854da238
    • L
      Merge tag 'powerpc-4.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · d08de37b
      Linus Torvalds 提交于
      Pull powerpc fixes from Michael Ellerman:
      
       - Fix an off-by-one bug in our alternative asm patching which leads to
         incorrectly patched code. This bug lay dormant for nearly 10 years
         but we finally hit it due to a recent change.
      
       - Fix lockups when running KVM guests on Power8 due to a missing check
         when a thread that's running KVM comes out of idle.
      
       - Fix an out-of-spec behaviour in the XIVE code (P9 interrupt
         controller).
      
       - Fix EEH handling of bridge MMIO windows.
      
       - Prevent crashes in our RFI fallback flush handler if firmware didn't
         tell us the size of the L1 cache (only seen on simulators).
      
      Thanks to: Benjamin Herrenschmidt, Madhavan Srinivasan, Michael Neuling.
      
      * tag 'powerpc-4.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/kvm: Fix lockups when running KVM guests on Power8
        powerpc/eeh: Fix enabling bridge MMIO windows
        powerpc/xive: Fix trying to "push" an already active pool VP
        powerpc/64s: Default l1d_size to 64K in RFI fallback flush
        powerpc/lib: Fix off-by-one in alternate feature patching
      d08de37b
    • L
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · c2d94c52
      Linus Torvalds 提交于
      Pull s390 fixes and kexec-file-load from Martin Schwidefsky:
       "After the common code kexec patches went in via Andrew we can now push
        the architecture parts to implement the kexec-file-load system call.
      
        Plus a few more bug fixes and cleanups, this includes an update to the
        default configurations"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        s390/signal: cleanup uapi struct sigaction
        s390: rename default_defconfig to debug_defconfig
        s390: remove gcov defconfig
        s390: update defconfig
        s390: add support for IBM z14 Model ZR1
        s390: remove couple of duplicate includes
        s390/boot: remove unused COMPILE_VERSION and ccflags-y
        s390/nospec: include cpu.h
        s390/decompressor: Ignore file vmlinux.bin.full
        s390/kexec_file: add generated files to .gitignore
        s390/Kconfig: Move kexec config options to "Processor type and features"
        s390/kexec_file: Add ELF loader
        s390/kexec_file: Add crash support to image loader
        s390/kexec_file: Add image loader
        s390/kexec_file: Add kexec_file_load system call
        s390/kexec_file: Add purgatory
        s390/kexec_file: Prepare setup.h for kexec_file_load
        s390/smsgiucv: disable SMSG on module unload
        s390/sclp: avoid potential usage of uninitialized value
      c2d94c52
  3. 19 4月, 2018 6 次提交
    • J
      HID: i2c-hid: fix inverted return value from i2c_hid_command() · b658912c
      Jiri Kosina 提交于
      i2c_hid_command() returns non-zero in error cases (the actual
      errno). Error handling in for I2C_HID_QUIRK_RESEND_REPORT_DESCR
      case in i2c_hid_resume() had the check inverted; fix that.
      
      Fixes: 3e83eda4 ("HID: i2c-hid: Fix resume issue on Raydium touchscreen device")
      Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      b658912c
    • M
      powerpc/kvm: Fix lockups when running KVM guests on Power8 · 56376c58
      Michael Ellerman 提交于
      When running KVM guests on Power8 we can see a lockup where one CPU
      stops responding. This often leads to a message such as:
      
        watchdog: CPU 136 detected hard LOCKUP on other CPUs 72
        Task dump for CPU 72:
        qemu-system-ppc R  running task    10560 20917  20908 0x00040004
      
      And then backtraces on other CPUs, such as:
      
        Task dump for CPU 48:
        ksmd            R  running task    10032  1519      2 0x00000804
        Call Trace:
          ...
          --- interrupt: 901 at smp_call_function_many+0x3c8/0x460
              LR = smp_call_function_many+0x37c/0x460
          pmdp_invalidate+0x100/0x1b0
          __split_huge_pmd+0x52c/0xdb0
          try_to_unmap_one+0x764/0x8b0
          rmap_walk_anon+0x15c/0x370
          try_to_unmap+0xb4/0x170
          split_huge_page_to_list+0x148/0xa30
          try_to_merge_one_page+0xc8/0x990
          try_to_merge_with_ksm_page+0x74/0xf0
          ksm_scan_thread+0x10ec/0x1ac0
          kthread+0x160/0x1a0
          ret_from_kernel_thread+0x5c/0x78
      
      This is caused by commit 8c1c7fb0 ("powerpc/64s/idle: avoid sync
      for KVM state when waking from idle"), which added a check in
      pnv_powersave_wakeup() to see if the kvm_hstate.hwthread_state is
      already set to KVM_HWTHREAD_IN_KERNEL, and if so to skip the store and
      test of kvm_hstate.hwthread_req.
      
      The problem is that the primary does not set KVM_HWTHREAD_IN_KVM when
      entering the guest, so it can then come out to cede with
      KVM_HWTHREAD_IN_KERNEL set. It can then go idle in kvm_do_nap after
      setting hwthread_req to 1, but because hwthread_state is still
      KVM_HWTHREAD_IN_KERNEL we will skip the test of hwthread_req when we
      wake up from idle and won't go to kvm_start_guest. From there the
      thread will return somewhere garbage and crash.
      
      Fix it by skipping the store of hwthread_state, but not the test of
      hwthread_req, when coming out of idle. It's OK to skip the sync in
      that case because hwthread_req will have been set on the same thread,
      so there is no synchronisation required.
      
      Fixes: 8c1c7fb0 ("powerpc/64s/idle: avoid sync for KVM state when waking from idle")
      Signed-off-by: NMichael Ellerman <mpe@ellerman.id.au>
      56376c58
    • M
      powerpc/eeh: Fix enabling bridge MMIO windows · 13a83eac
      Michael Neuling 提交于
      On boot we save the configuration space of PCIe bridges. We do this so
      when we get an EEH event and everything gets reset that we can restore
      them.
      
      Unfortunately we save this state before we've enabled the MMIO space
      on the bridges. Hence if we have to reset the bridge when we come back
      MMIO is not enabled and we end up taking an PE freeze when the driver
      starts accessing again.
      
      This patch forces the memory/MMIO and bus mastering on when restoring
      bridges on EEH. Ideally we'd do this correctly by saving the
      configuration space writes later, but that will have to come later in
      a larger EEH rewrite. For now we have this simple fix.
      
      The original bug can be triggered on a boston machine by doing:
        echo 0x8000000000000000 > /sys/kernel/debug/powerpc/PCI0001/err_injct_outbound
      On boston, this PHB has a PCIe switch on it.  Without this patch,
      you'll see two EEH events, 1 expected and 1 the failure we are fixing
      here. The second EEH event causes the anything under the PHB to
      disappear (i.e. the i40e eth).
      
      With this patch, only 1 EEH event occurs and devices properly recover.
      
      Fixes: 652defed ("powerpc/eeh: Check PCIe link after reset")
      Cc: stable@vger.kernel.org # v3.11+
      Reported-by: NPridhiviraj Paidipeddi <ppaidipe@linux.vnet.ibm.com>
      Signed-off-by: NMichael Neuling <mikey@neuling.org>
      Acked-by: NRussell Currey <ruscur@russell.cc>
      Signed-off-by: NMichael Ellerman <mpe@ellerman.id.au>
      13a83eac
    • M
      MIPS: uaccess: Add micromips clobbers to bzero invocation · b3d7e55c
      Matt Redfearn 提交于
      The micromips implementation of bzero additionally clobbers registers t7
      & t8. Specify this in the clobbers list when invoking bzero.
      
      Fixes: 26c5e07d ("MIPS: microMIPS: Optimise 'memset' core library function.")
      Reported-by: NJames Hogan <jhogan@kernel.org>
      Signed-off-by: NMatt Redfearn <matt.redfearn@mips.com>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: linux-mips@linux-mips.org
      Cc: <stable@vger.kernel.org> # 3.10+
      Patchwork: https://patchwork.linux-mips.org/patch/19110/Signed-off-by: NJames Hogan <jhogan@kernel.org>
      b3d7e55c
    • M
      MIPS: memset.S: Fix clobber of v1 in last_fixup · c96eebf0
      Matt Redfearn 提交于
      The label .Llast_fixup\@ is jumped to on page fault within the final
      byte set loop of memset (on < MIPSR6 architectures). For some reason, in
      this fault handler, the v1 register is randomly set to a2 & STORMASK.
      This clobbers v1 for the calling function. This can be observed with the
      following test code:
      
      static int __init __attribute__((optimize("O0"))) test_clear_user(void)
      {
        register int t asm("v1");
        char *test;
        int j, k;
      
        pr_info("\n\n\nTesting clear_user\n");
        test = vmalloc(PAGE_SIZE);
      
        for (j = 256; j < 512; j++) {
          t = 0xa5a5a5a5;
          if ((k = clear_user(test + PAGE_SIZE - 256, j)) != j - 256) {
              pr_err("clear_user (%px %d) returned %d\n", test + PAGE_SIZE - 256, j, k);
          }
          if (t != 0xa5a5a5a5) {
             pr_err("v1 was clobbered to 0x%x!\n", t);
          }
        }
      
        return 0;
      }
      late_initcall(test_clear_user);
      
      Which demonstrates that v1 is indeed clobbered (MIPS64):
      
      Testing clear_user
      v1 was clobbered to 0x1!
      v1 was clobbered to 0x2!
      v1 was clobbered to 0x3!
      v1 was clobbered to 0x4!
      v1 was clobbered to 0x5!
      v1 was clobbered to 0x6!
      v1 was clobbered to 0x7!
      
      Since the number of bytes that could not be set is already contained in
      a2, the andi placing a value in v1 is not necessary and actively
      harmful in clobbering v1.
      Reported-by: NJames Hogan <jhogan@kernel.org>
      Signed-off-by: NMatt Redfearn <matt.redfearn@mips.com>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: linux-mips@linux-mips.org
      Cc: stable@vger.kernel.org
      Patchwork: https://patchwork.linux-mips.org/patch/19109/Signed-off-by: NJames Hogan <jhogan@kernel.org>
      c96eebf0
    • L
      Merge tag 'ceph-for-4.17-rc2' of git://github.com/ceph/ceph-client · 87ef1202
      Linus Torvalds 提交于
      Pull ceph fixes from Ilya Dryomov:
       "A couple of follow-up patches for -rc1 changes in rbd, support for a
        timeout on waiting for the acquisition of exclusive lock and a fix for
        uninitialized memory access in CephFS, marked for stable"
      
      * tag 'ceph-for-4.17-rc2' of git://github.com/ceph/ceph-client:
        rbd: notrim map option
        rbd: adjust queue limits for "fancy" striping
        rbd: avoid Wreturn-type warnings
        ceph: always update atime/mtime/ctime for new inode
        rbd: support timeout in rbd_wait_state_locked()
        rbd: refactor rbd_wait_state_locked()
      87ef1202
  4. 18 4月, 2018 2 次提交
    • B
      powerpc/xive: Fix trying to "push" an already active pool VP · b32e56e5
      Benjamin Herrenschmidt 提交于
      When setting up a CPU, we "push" (activate) a pool VP for it.
      
      However it's an error to do so if it already has an active
      pool VP.
      
      This happens when doing soft CPU hotplug on powernv since we
      don't tear down the CPU on unplug. The HW flags the error which
      gets captured by the diagnostics.
      
      Fix this by making sure to "pull" out any already active pool
      first.
      
      Fixes: 243e2511 ("powerpc/xive: Native exploitation of the XIVE interrupt controller")
      Cc: stable@vger.kernel.org # v4.12+
      Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: NMichael Ellerman <mpe@ellerman.id.au>
      b32e56e5
    • J
      udf: Fix leak of UTF-16 surrogates into encoded strings · 44f06ba8
      Jan Kara 提交于
      OSTA UDF specification does not mention whether the CS0 charset in case
      of two bytes per character encoding should be treated in UTF-16 or
      UCS-2. The sample code in the standard does not treat UTF-16 surrogates
      in any special way but on systems such as Windows which work in UTF-16
      internally, filenames would be treated as being in UTF-16 effectively.
      In Linux it is more difficult to handle characters outside of Base
      Multilingual plane (beyond 0xffff) as NLS framework works with 2-byte
      characters only. Just make sure we don't leak UTF-16 surrogates into the
      resulting string when loading names from the filesystem for now.
      
      CC: stable@vger.kernel.org # >= v4.6
      Reported-by: NMingye Wang <arthur200126@gmail.com>
      Signed-off-by: NJan Kara <jack@suse.cz>
      44f06ba8
  5. 17 4月, 2018 12 次提交
    • M
      MIPS: memset.S: Fix return of __clear_user from Lpartial_fixup · daf70d89
      Matt Redfearn 提交于
      The __clear_user function is defined to return the number of bytes that
      could not be cleared. From the underlying memset / bzero implementation
      this means setting register a2 to that number on return. Currently if a
      page fault is triggered within the memset_partial block, the value
      loaded into a2 on return is meaningless.
      
      The label .Lpartial_fixup\@ is jumped to on page fault. In order to work
      out how many bytes failed to copy, the exception handler should find how
      many bytes left in the partial block (andi a2, STORMASK), add that to
      the partial block end address (a2), and subtract the faulting address to
      get the remainder. Currently it incorrectly subtracts the partial block
      start address (t1), which has additionally been clobbered to generate a
      jump target in memset_partial. Fix this by adding the block end address
      instead.
      
      This issue was found with the following test code:
            int j, k;
            for (j = 0; j < 512; j++) {
              if ((k = clear_user(NULL, j)) != j) {
                 pr_err("clear_user (NULL %d) returned %d\n", j, k);
              }
            }
      Which now passes on Creator Ci40 (MIPS32) and Cavium Octeon II (MIPS64).
      Suggested-by: NJames Hogan <jhogan@kernel.org>
      Signed-off-by: NMatt Redfearn <matt.redfearn@mips.com>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: linux-mips@linux-mips.org
      Cc: stable@vger.kernel.org
      Patchwork: https://patchwork.linux-mips.org/patch/19108/Signed-off-by: NJames Hogan <jhogan@kernel.org>
      daf70d89
    • S
      xen: xenbus_dev_frontend: Really return response string · ebf04f33
      Simon Gaiser 提交于
      xenbus_command_reply() did not actually copy the response string and
      leaked stack content instead.
      
      Fixes: 9a6161fe ("xen: return xenstore command failures via response instead of rc")
      Signed-off-by: NSimon Gaiser <simon@invisiblethingslab.com>
      Reviewed-by: NJuergen Gross <jgross@suse.com>
      Signed-off-by: NBoris Ostrovsky <boris.ostrovsky@oracle.com>
      ebf04f33
    • O
      xen/sndif: Sync up with the canonical definition in Xen · cd6e992b
      Oleksandr Andrushchenko 提交于
      This is the sync up with the canonical definition of the sound
      protocol in Xen:
      
      1. Protocol version was referenced in the protocol description,
         but missed its definition. Fixed by adding a constant
         for current protocol version.
      
      2. Some of the request descriptions have "reserved" fields
         missed: fixed by adding corresponding entries.
      
      3. Extend the size of the requests and responses to 64 octets.
         Bump protocol version to 2.
      
      4. Add explicit back and front synchronization
         In order to provide explicit synchronization between backend and
         frontend the following changes are introduced in the protocol:
          - add new ring buffer for sending asynchronous events from
            backend to frontend to report number of bytes played by the
            frontend (XENSND_EVT_CUR_POS)
          - introduce trigger events for playback control: start/stop/pause/resume
          - add "req-" prefix to event-channel and ring-ref to unify naming
            of the Xen event channels for requests and events
      
      5. Add explicit back and front parameter negotiation
         In order to provide explicit stream parameter negotiation between
         backend and frontend the following changes are introduced in the protocol:
         add XENSND_OP_HW_PARAM_QUERY request to read/update
         configuration space for the parameters given: request passes
         desired parameter's intervals/masks and the response to this request
         returns allowed min/max intervals/masks to be used.
      Signed-off-by: NOleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
      Signed-off-by: NOleksandr Grytsov <oleksandr_grytsov@epam.com>
      Reviewed-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Reviewed-by: NBoris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Cc: Takashi Iwai <tiwai@suse.de>
      Signed-off-by: NBoris Ostrovsky <boris.ostrovsky@oracle.com>
      cd6e992b
    • P
      livepatch: Allow to call a custom callback when freeing shadow variables · 3b2c77d0
      Petr Mladek 提交于
      We might need to do some actions before the shadow variable is freed.
      For example, we might need to remove it from a list or free some data
      that it points to.
      
      This is already possible now. The user can get the shadow variable
      by klp_shadow_get(), do the necessary actions, and then call
      klp_shadow_free().
      
      This patch allows to do it a more elegant way. The user could implement
      the needed actions in a callback that is passed to klp_shadow_free()
      as a parameter. The callback usually does reverse operations to
      the constructor callback that can be called by klp_shadow_*alloc().
      
      It is especially useful for klp_shadow_free_all(). There we need to do
      these extra actions for each found shadow variable with the given ID.
      
      Note that the memory used by the shadow variable itself is still released
      later by rcu callback. It is needed to protect internal structures that
      keep all shadow variables. But the destructor is called immediately.
      The shadow variable must not be access anyway after klp_shadow_free()
      is called. The user is responsible to protect this any suitable way.
      
      Be aware that the destructor is called under klp_shadow_lock. It is
      the same as for the contructor in klp_shadow_alloc().
      Signed-off-by: NPetr Mladek <pmladek@suse.com>
      Acked-by: NJosh Poimboeuf <jpoimboe@redhat.com>
      Acked-by: NMiroslav Benes <mbenes@suse.cz>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      3b2c77d0
    • P
      livepatch: Initialize shadow variables safely by a custom callback · e91c2518
      Petr Mladek 提交于
      The existing API allows to pass a sample data to initialize the shadow
      data. It works well when the data are position independent. But it fails
      miserably when we need to set a pointer to the shadow structure itself.
      
      Unfortunately, we might need to initialize the pointer surprisingly
      often because of struct list_head. It is even worse because the list
      might be hidden in other common structures, for example, struct mutex,
      struct wait_queue_head.
      
      For example, this was needed to fix races in ALSA sequencer. It required
      to add mutex into struct snd_seq_client. See commit b3defb79
      ("ALSA: seq: Make ioctls race-free") and commit d15d662e
      ("ALSA: seq: Fix racy pool initializations")
      
      This patch makes the API more safe. A custom constructor function and data
      are passed to klp_shadow_*alloc() functions instead of the sample data.
      
      Note that ctor_data are no longer a template for shadow->data. It might
      point to any data that might be necessary when the constructor is called.
      
      Also note that the constructor is called under klp_shadow_lock. It is
      an internal spin_lock that synchronizes alloc() vs. get() operations,
      see klp_shadow_get_or_alloc(). On one hand, this adds a risk of ABBA
      deadlocks. On the other hand, it allows to do some operations safely.
      For example, we could add the new structure into an existing list.
      This must be done only once when the structure is allocated.
      Reported-by: NNicolai Stange <nstange@suse.de>
      Signed-off-by: NPetr Mladek <pmladek@suse.com>
      Acked-by: NJosh Poimboeuf <jpoimboe@redhat.com>
      Acked-by: NMiroslav Benes <mbenes@suse.cz>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      e91c2518
    • M
      powerpc/64s: Default l1d_size to 64K in RFI fallback flush · 9dfbf78e
      Madhavan Srinivasan 提交于
      If there is no d-cache-size property in the device tree, l1d_size could
      be zero. We don't actually expect that to happen, it's only been seen
      on mambo (simulator) in some configurations.
      
      A zero-size l1d_size leads to the loop in the asm wrapping around to
      2^64-1, and then walking off the end of the fallback area and
      eventually causing a page fault which is fatal.
      
      Just default to 64K which is correct on some CPUs, and sane enough to
      not cause a crash on others.
      
      Fixes: aa8a5e00 ('powerpc/64s: Add support for RFI flush of L1-D cache')
      Signed-off-by: NMadhavan Srinivasan <maddy@linux.vnet.ibm.com>
      [mpe: Rewrite comment and change log]
      Signed-off-by: NMichael Ellerman <mpe@ellerman.id.au>
      9dfbf78e
    • M
      s390/signal: cleanup uapi struct sigaction · fae76491
      Martin Schwidefsky 提交于
      The struct sigaction for user space in arch/s390/include/uapi/asm/signal.h
      is ill defined. The kernel uses two structures 'struct sigaction' and
      'struct old_sigaction', the correlation in the kernel for both 31 and
      64 bit is as follows
      
          sys_sigaction -> struct old_sigaction
          sys_rt_sigaction -> struct sigaction
      
      The correlation of the (single) uapi definition for 'struct sigaction'
      under '#ifndef __KERNEL__':
      
          31-bit: sys_sigaction -> uapi struct sigaction
          31-bit: sys_rt_sigaction -> no structure available
      
          64-bit: sys_sigaction -> no structure available
          64-bit: sys_rt_sigaction -> uapi struct sigaction
      
      This is quite confusing. To make it a bit less confusing make the
      uapi definition of 'struct sigaction' usable for sys_rt_sigaction for
      both 31-bit and 64-bit.
      Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>
      fae76491
    • L
      Merge branch 'parisc-4.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux · a27fc142
      Linus Torvalds 提交于
      Pull parisc build fix from Helge Deller:
       "Fix build error because of missing binfmt_elf32.o file which is still
        mentioned in the Makefile"
      
      * 'parisc-4.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
        parisc: Fix missing binfmt_elf32.o build error
      a27fc142
    • M
      MIPS: memset.S: EVA & fault support for small_memset · 8a8158c8
      Matt Redfearn 提交于
      The MIPS kernel memset / bzero implementation includes a small_memset
      branch which is used when the region to be set is smaller than a long (4
      bytes on 32bit, 8 bytes on 64bit). The current small_memset
      implementation uses a simple store byte loop to write the destination.
      There are 2 issues with this implementation:
      
      1. When EVA mode is active, user and kernel address spaces may overlap.
      Currently the use of the sb instruction means kernel mode addressing is
      always used and an intended write to userspace may actually overwrite
      some critical kernel data.
      
      2. If the write triggers a page fault, for example by calling
      __clear_user(NULL, 2), instead of gracefully handling the fault, an OOPS
      is triggered.
      
      Fix these issues by replacing the sb instruction with the EX() macro,
      which will emit EVA compatible instuctions as required. Additionally
      implement a fault fixup for small_memset which sets a2 to the number of
      bytes that could not be cleared (as defined by __clear_user).
      Reported-by: NChuanhua Lei <chuanhua.lei@intel.com>
      Signed-off-by: NMatt Redfearn <matt.redfearn@mips.com>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: linux-mips@linux-mips.org
      Cc: stable@vger.kernel.org
      Patchwork: https://patchwork.linux-mips.org/patch/18975/Signed-off-by: NJames Hogan <jhogan@kernel.org>
      8a8158c8
    • L
      Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · d95c8844
      Linus Torvalds 提交于
      Pull missed timer updates from Thomas Gleixner:
       "This is a branch which got forgotten during the merge window, but it
        contains only fixes and hardware enablement. No fundamental changes.
      
         - Various fixes for the imx-tpm clocksource driver
      
         - A new timer driver for the NCPM7xx SoC family"
      
      * 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        clocksource/drivers/imx-tpm: Add different counter width support
        clocksource/drivers/imx-tpm: Correct some registers operation flow
        clocksource/drivers/imx-tpm: Fix typo of clock name
        dt-bindings: timer: tpm: fix typo of clock name
        clocksource/drivers/npcm: Add NPCM7xx timer driver
        dt-binding: timer: document NPCM7xx timer DT bindings
      d95c8844
    • L
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · e6d9bfde
      Linus Torvalds 提交于
      Pull kvm fixes from Paolo Bonzini:
       "Bug fixes, plus a new test case and the associated infrastructure for
        writing nested virtualization tests"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        kvm: selftests: add vmx_tsc_adjust_test
        kvm: x86: move MSR_IA32_TSC handling to x86.c
        X86/KVM: Properly update 'tsc_offset' to represent the running guest
        kvm: selftests: add -std=gnu99 cflags
        x86: Add check for APIC access address for vmentry of L2 guests
        KVM: X86: fix incorrect reference of trace_kvm_pi_irte_update
        X86/KVM: Do not allow DISABLE_EXITS_MWAIT when LAPIC ARAT is not available
        kvm: selftests: fix spelling mistake: "divisable" and "divisible"
        X86/VMX: Disable VMX preemption timer if MWAIT is not intercepted
      e6d9bfde
    • J
      x86/ldt: Fix support_pte_mask filtering in map_ldt_struct() · e6f39e87
      Joerg Roedel 提交于
      The |= operator will let us end up with an invalid PTE. Use
      the correct &= instead.
      
      [ The bug was also independently reported by Shuah Khan ]
      
      Fixes: fb43d6cb ('x86/mm: Do not auto-massage page protections')
      Acked-by: NAndy Lutomirski <luto@kernel.org>
      Acked-by: NDave Hansen <dave.hansen@linux.intel.com>
      Signed-off-by: NJoerg Roedel <jroedel@suse.de>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      e6f39e87
  6. 16 4月, 2018 13 次提交