1. 05 4月, 2019 13 次提交
  2. 01 4月, 2019 1 次提交
    • G
      driver: base: Disable CONFIG_UEVENT_HELPER by default · 1be01d4a
      Geert Uytterhoeven 提交于
      Since commit 7934779a ("Driver-Core: disable /sbin/hotplug by
      default"), the help text for the /sbin/hotplug fork-bomb says
      "This should not be used today [...] creates a high system load, or
      [...] out-of-memory situations during bootup".  The rationale for this
      was that no recent mainstream system used this anymore (in 2010!).
      
      A few years later, the complete uevent helper support was made optional
      in commit 86d56134 ("kobject: Make support for uevent_helper
      optional.").  However, if was still left enabled by default, to support
      ancient userland.
      
      Time passed by, and nothing should use this anymore, so it can be
      disabled by default.
      Signed-off-by: NGeert Uytterhoeven <geert+renesas@glider.be>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      1be01d4a
  3. 31 3月, 2019 2 次提交
  4. 30 3月, 2019 5 次提交
    • M
      drivers/block/zram/zram_drv.c: fix idle/writeback string compare · 0bc9f5d1
      Minchan Kim 提交于
      Makoto report a below KASAN error: zram does out-of-bounds read.  Because
      strscpy copies from source up to count bytes unconditionally.  It could
      cause out-of-bounds read on next object in slab.
      
      To prevent it, use strlcpy which checks source's length automatically.
      
         BUG: KASAN: slab-out-of-bounds in strscpy+0x68/0x154
         Read of size 8 at addr ffffffc0c3495a00 by task system_server/1314
         ..
         Call trace:
           strscpy+0x68/0x154
           idle_store+0xc4/0x34c
           dev_attr_store+0x50/0x6c
           sysfs_kf_write+0x98/0xb4
           kernfs_fop_write+0x198/0x260
           __vfs_write+0x10c/0x338
           vfs_write+0x114/0x238
           SyS_write+0xc8/0x168
           __sys_trace_return+0x0/0x4
      
         Allocated by task 1314:
          __kmalloc+0x280/0x318
          kernfs_fop_write+0xac/0x260
          __vfs_write+0x10c/0x338
          vfs_write+0x114/0x238
          SyS_write+0xc8/0x168
          __sys_trace_return+0x0/0x4
      
         Freed by task 2855:
          kfree+0x138/0x630
          kernfs_put_open_node+0x10c/0x124
          kernfs_fop_release+0xd8/0x114
          __fput+0x130/0x2a4
          ____fput+0x1c/0x28
          task_work_run+0x16c/0x1c8
          do_notify_resume+0x2bc/0x107c
          work_pending+0x8/0x10
      
         The buggy address belongs to the object at ffffffc0c3495a00
          which belongs to the cache kmalloc-128 of size 128
         The buggy address is located 0 bytes inside of
          128-byte region [ffffffc0c3495a00, ffffffc0c3495a80)
         The buggy address belongs to the page:
         page:ffffffbf030d2500 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
         flags: 0x4000000000010200(slab|head)
         page dumped because: kasan: bad access detected
      
         Memory state around the buggy address:
          ffffffc0c3495900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
          ffffffc0c3495980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
         >ffffffc0c3495a00: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                            ^
          ffffffc0c3495a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
          ffffffc0c3495b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      
      Link: http://lkml.kernel.org/r/20190319231911.145968-1-minchan@kernel.org
      Cc: <stable@vger.kernel.org>	[5.0]
      Signed-off-by: NMinchan Kim <minchan@kernel.org>
      Reported-by: NMakoto Wu <makotowu@google.com>
      Reviewed-by: NSergey Senozhatsky <sergey.senozhatsky@gmail.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      0bc9f5d1
    • N
      iommu/io-pgtable-arm-v7s: request DMA32 memory, and improve debugging · 0a352554
      Nicolas Boichat 提交于
      IOMMUs using ARMv7 short-descriptor format require page tables (level 1
      and 2) to be allocated within the first 4GB of RAM, even on 64-bit
      systems.
      
      For level 1/2 pages, ensure GFP_DMA32 is used if CONFIG_ZONE_DMA32 is
      defined (e.g.  on arm64 platforms).
      
      For level 2 pages, allocate a slab cache in SLAB_CACHE_DMA32.  Note that
      we do not explicitly pass GFP_DMA[32] to kmem_cache_zalloc, as this is
      not strictly necessary, and would cause a warning in mm/sl*b.c, as we
      did not update GFP_SLAB_BUG_MASK.
      
      Also, print an error when the physical address does not fit in
      32-bit, to make debugging easier in the future.
      
      Link: http://lkml.kernel.org/r/20181210011504.122604-3-drinkcat@chromium.org
      Fixes: ad67f5a6 ("arm64: replace ZONE_DMA with ZONE_DMA32")
      Signed-off-by: NNicolas Boichat <drinkcat@chromium.org>
      Acked-by: NWill Deacon <will.deacon@arm.com>
      Cc: Christoph Hellwig <hch@infradead.org>
      Cc: Christoph Lameter <cl@linux.com>
      Cc: David Rientjes <rientjes@google.com>
      Cc: Hsin-Yi Wang <hsinyi@chromium.org>
      Cc: Huaisheng Ye <yehs1@lenovo.com>
      Cc: Joerg Roedel <joro@8bytes.org>
      Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
      Cc: Matthew Wilcox <willy@infradead.org>
      Cc: Matthias Brugger <matthias.bgg@gmail.com>
      Cc: Mel Gorman <mgorman@techsingularity.net>
      Cc: Michal Hocko <mhocko@suse.com>
      Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
      Cc: Pekka Enberg <penberg@kernel.org>
      Cc: Robin Murphy <robin.murphy@arm.com>
      Cc: Sasha Levin <Alexander.Levin@microsoft.com>
      Cc: Tomasz Figa <tfiga@google.com>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Cc: Yingjoe Chen <yingjoe.chen@mediatek.com>
      Cc: Yong Wu <yong.wu@mediatek.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      0a352554
    • M
      staging: vt6655: Remove vif check from vnt_interrupt · cc26358f
      Malcolm Priestley 提交于
      A check for vif is made in vnt_interrupt_work.
      
      There is a small chance of leaving interrupt disabled while vif
      is NULL and the work hasn't been scheduled.
      Signed-off-by: NMalcolm Priestley <tvboxspy@gmail.com>
      CC: stable@vger.kernel.org # v4.2+
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      cc26358f
    • G
      staging: erofs: keep corrupted fs from crashing kernel in erofs_readdir() · 33bac912
      Gao Xiang 提交于
      After commit 419d6efc, kernel cannot be crashed in the namei
      path. However, corrupted nameoff can do harm in the process of
      readdir for scenerios without dm-verity as well. Fix it now.
      
      Fixes: 3aa8ec71 ("staging: erofs: add directory operations")
      Cc: <stable@vger.kernel.org> # 4.19+
      Signed-off-by: NGao Xiang <gaoxiang25@huawei.com>
      Reviewed-by: NChao Yu <yuchao0@huawei.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      33bac912
    • J
      iommu/amd: Reserve exclusion range in iova-domain · 8aafaaf2
      Joerg Roedel 提交于
      If a device has an exclusion range specified in the IVRS
      table, this region needs to be reserved in the iova-domain
      of that device. This hasn't happened until now and can cause
      data corruption on data transfered with these devices.
      
      Treat exclusion ranges as reserved regions in the iommu-core
      to fix the problem.
      
      Fixes: be2a022c ('x86, AMD IOMMU: add functions to parse IOMMU memory mapping requirements for devices')
      Signed-off-by: NJoerg Roedel <jroedel@suse.de>
      Reviewed-by: NGary R Hook <gary.hook@amd.com>
      8aafaaf2
  5. 29 3月, 2019 8 次提交
  6. 28 3月, 2019 11 次提交
    • R
      libata: fix using DMA buffers on stack · dd08a8d9
      raymond pang 提交于
      When CONFIG_VMAP_STACK=y, __pa() returns incorrect physical address for
      a stack virtual address. Stack DMA buffers must be avoided.
      Signed-off-by: Nraymond pang <raymondpangxd@gmail.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      dd08a8d9
    • J
      drm/i915/icl: Fix VEBOX mismatch BUG_ON() · 26cdaac4
      José Roberto de Souza 提交于
      GT VEBOX DISABLE is only 4 bits wide but it was using a 8 bits wide
      mask, the remaning reserved bits is set to 0 causing 4 more
      nonexistent VEBOX engines being detected as enabled, triggering the
      BUG_ON() because of mismatch between vebox_mask and newly added
      VEBOX_MASK().
      
      [   64.081621] [drm:intel_device_info_init_mmio [i915]] vdbox enable: 0005, instances: 0005
      [   64.081763] [drm:intel_device_info_init_mmio [i915]] vebox enable: 00f1, instances: 0001
      [   64.081825] intel_device_info_init_mmio:925 GEM_BUG_ON(vebox_mask != ({ unsigned int first__ = (VECS0); unsigned int count__ = (2); ((&(dev_priv)->__info)->engine_mask & (((~0UL) - (1UL << (first__)) + 1) & (~0UL >> (64 - 1 - (first__ + count__ - 1))))) >> first__; }))
      [   64.082047] ------------[ cut here ]------------
      [   64.082054] kernel BUG at drivers/gpu/drm/i915/intel_device_info.c:925!
      
      BSpec: 20680
      Fixes: 26376a7e ("drm/i915/icl: Check for fused-off VDBOX and VEBOX instances")
      Cc: Chris Wilson <chris@chris-wilson.co.uk>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Cc: Oscar Mateo <oscar.mateo@intel.com>
      Signed-off-by: NJosé Roberto de Souza <jose.souza@intel.com>
      Reviewed-by: NTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190326230223.26336-1-jose.souza@intel.com
      (cherry picked from commit 547fcf9b)
      Signed-off-by: NJani Nikula <jani.nikula@intel.com>
      26cdaac4
    • V
      cpufreq: scpi: Fix use after free · 31d4c528
      Vincent Stehlé 提交于
      Free the priv structure only after we are done using it.
      
      Fixes: 1690d8bb ("cpufreq: scpi/scmi: Fix freeing of dynamic OPPs")
      Signed-off-by: NVincent Stehlé <vincent.stehle@laposte.net>
      Cc: 4.20+ <stable@vger.kernel.org> # 4.20+
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      31d4c528
    • B
      USB: serial: option: add Olicard 600 · 84f3b43f
      Bjørn Mork 提交于
      This is a Qualcomm based device with a QMI function on interface 4.
      It is mode switched from 2020:2030 using a standard eject message.
      
      T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  6 Spd=480  MxCh= 0
      D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
      P:  Vendor=2020 ProdID=2031 Rev= 2.32
      S:  Manufacturer=Mobile Connect
      S:  Product=Mobile Connect
      S:  SerialNumber=0123456789ABCDEF
      C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA
      I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
      E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
      E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
      E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
      E:  Ad=85(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
      E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
      E:  Ad=87(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
      E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
      E:  Ad=89(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
      E:  Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none)
      E:  Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us
      
      Cc: stable@vger.kernel.org
      Signed-off-by: NBjørn Mork <bjorn@mork.no>
      [ johan: use tabs to align comments in adjacent lines ]
      Signed-off-by: NJohan Hovold <johan@kernel.org>
      84f3b43f
    • G
      USB: serial: cp210x: add new device id · a595ecdd
      Greg Kroah-Hartman 提交于
      Lorenz Messtechnik has a device that is controlled by the cp210x driver,
      so add the device id to the driver.  The device id was provided by
      Silicon-Labs for the devices from this vendor.
      Reported-by: NUli <t9cpu@web.de>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: NJohan Hovold <johan@kernel.org>
      a595ecdd
    • T
      scsi: ibmvfc: Clean up transport events · d6e2635b
      Tyrel Datwyler 提交于
      No change to functionality. Simply make transport event messages a little
      clearer, and rework CRQ format enums such that we have separate enums for
      INIT messages and XPORT events.
      
      [mkp: typo]
      Signed-off-by: NTyrel Datwyler <tyreld@linux.vnet.ibm.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      d6e2635b
    • T
      scsi: ibmvfc: Byte swap status and error codes when logging · 3e6f7de4
      Tyrel Datwyler 提交于
      Status and error codes are returned in big endian from the VIOS. The values
      are translated into a human readable format when logged, but the values are
      also logged. This patch byte swaps those values so that they are consistent
      between BE and LE platforms.
      Signed-off-by: NTyrel Datwyler <tyreld@linux.vnet.ibm.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      3e6f7de4
    • T
      scsi: ibmvfc: Add failed PRLI to cmd_status lookup array · 95237c25
      Tyrel Datwyler 提交于
      The VIOS uses the SCSI_ERROR class to report PRLI failures. These errors
      are indicated with the combination of a IBMVFC_FC_SCSI_ERROR return status
      and 0x8000 error code. Add these codes to cmd_status[] with appropriate
      human readable error message.
      Signed-off-by: NTyrel Datwyler <tyreld@linux.vnet.ibm.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      95237c25
    • T
      scsi: ibmvfc: Remove "failed" from logged errors · 6dc6a944
      Tyrel Datwyler 提交于
      The text of messages logged with ibmvfc_log_error() always contain the term
      "failed". In the case of cancelled commands during EH they are reported
      back by the VIOS using error codes. This can be confusing to somebody
      looking at these log messages as to whether a command was successfully
      cancelled. The following real log message for example it is unclear if the
      transaction was actaully cancelled.
      
      <6>sd 0:0:1:1: Cancelling outstanding commands.
      <3>sd 0:0:1:1: [sde] Command (28) failed: transaction cancelled (2:6) flags: 0 fcp_rsp: 0, resid=0, scsi_status: 0
      
      Remove prefixing of "failed" to all error logged messages. The
      ibmvfc_log_error() function translates the returned error/status codes to a
      human readable message already.
      Signed-off-by: NTyrel Datwyler <tyreld@linux.vnet.ibm.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      6dc6a944
    • S
      scsi: zfcp: reduce flood of fcrscn1 trace records on multi-element RSCN · c8206579
      Steffen Maier 提交于
      If an incoming ELS of type RSCN contains more than one element, zfcp
      suboptimally causes repeated erp trigger NOP trace records for each
      previously failed port. These could be ports that went away.  It loops over
      each RSCN element, and for each of those in an inner loop over all
      zfcp_ports.
      
      The trigger to recover failed ports should be just the reception of some
      RSCN, no matter how many elements it has. So we can loop over failed ports
      separately, and only then loop over each RSCN element to handle the
      non-failed ports.
      
      The call chain was:
      
        zfcp_fc_incoming_rscn
          for (i = 1; i < no_entries; i++)
            _zfcp_fc_incoming_rscn
              list_for_each_entry(port, &adapter->port_list, list)
                if (masked port->d_id match) zfcp_fc_test_link
                if (!port->d_id) zfcp_erp_port_reopen "fcrscn1"   <===
      
      In order the reduce the "flooding" of the REC trace area in such cases, we
      factor out handling the failed ports to be outside of the entries loop:
      
        zfcp_fc_incoming_rscn
          if (no_entries > 1)                                     <===
            list_for_each_entry(port, &adapter->port_list, list)  <===
              if (!port->d_id) zfcp_erp_port_reopen "fcrscn1"     <===
          for (i = 1; i < no_entries; i++)
            _zfcp_fc_incoming_rscn
              list_for_each_entry(port, &adapter->port_list, list)
                if (masked port->d_id match) zfcp_fc_test_link
      
      Abbreviated example trace records before this code change:
      
      Tag            : fcrscn1
      WWPN           : 0x500507630310d327
      ERP want       : 0x02
      ERP need       : 0x02
      
      Tag            : fcrscn1
      WWPN           : 0x500507630310d327
      ERP want       : 0x02
      ERP need       : 0x00                 NOP => superfluous trace record
      
      The last trace entry repeats if there are more than 2 RSCN elements.
      Signed-off-by: NSteffen Maier <maier@linux.ibm.com>
      Reviewed-by: NBenjamin Block <bblock@linux.ibm.com>
      Reviewed-by: NJens Remus <jremus@linux.ibm.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      c8206579
    • S
      scsi: zfcp: fix scsi_eh host reset with port_forced ERP for non-NPIV FCP devices · 242ec145
      Steffen Maier 提交于
      Suppose more than one non-NPIV FCP device is active on the same channel.
      Send I/O to storage and have some of the pending I/O run into a SCSI
      command timeout, e.g. due to bit errors on the fibre. Now the error
      situation stops. However, we saw FCP requests continue to timeout in the
      channel. The abort will be successful, but the subsequent TUR fails.
      Scsi_eh starts. The LUN reset fails. The target reset fails.  The host
      reset only did an FCP device recovery. However, for non-NPIV FCP devices,
      this does not close and reopen ports on the SAN-side if other non-NPIV FCP
      device(s) share the same open ports.
      
      In order to resolve the continuing FCP request timeouts, we need to
      explicitly close and reopen ports on the SAN-side.
      
      This was missing since the beginning of zfcp in v2.6.0 history commit
      ea127f975424 ("[PATCH] s390 (7/7): zfcp host adapter.").
      
      Note: The FSF requests for forced port reopen could run into FSF request
      timeouts due to other reasons. This would trigger an internal FCP device
      recovery. Pending forced port reopen recoveries would get dismissed. So
      some ports might not get fully reopened during this host reset handler.
      However, subsequent I/O would trigger the above described escalation and
      eventually all ports would be forced reopen to resolve any continuing FCP
      request timeouts due to earlier bit errors.
      Signed-off-by: NSteffen Maier <maier@linux.ibm.com>
      Fixes: 1da177e4 ("Linux-2.6.12-rc2")
      Cc: <stable@vger.kernel.org> #3.0+
      Reviewed-by: NJens Remus <jremus@linux.ibm.com>
      Reviewed-by: NBenjamin Block <bblock@linux.ibm.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      242ec145