1. 03 6月, 2018 11 次提交
  2. 02 6月, 2018 1 次提交
  3. 01 6月, 2018 3 次提交
  4. 31 5月, 2018 8 次提交
    • L
      Merge tag 'platform-drivers-x86-v4.17-4' of git://git.infradead.org/linux-platform-drivers-x86 · dd52cb87
      Linus Torvalds 提交于
      Pull x86 platform driver fix from Andy Shevchenko:
       "Fix NULL pointer dereference in asus-wmi on rfkill cleanup.
      
        The effective change is just one new condition - two lines of code.
        But it required moving one static helper function, which is why the
        diff looks a bit bigger"
      
      * tag 'platform-drivers-x86-v4.17-4' of git://git.infradead.org/linux-platform-drivers-x86:
        platform/x86: asus-wmi: Fix NULL pointer dereference
      dd52cb87
    • J
      platform/x86: asus-wmi: Fix NULL pointer dereference · 32ffd6e8
      João Paulo Rechi Vita 提交于
      Do not perform the rfkill cleanup routine when
      (asus->driver->wlan_ctrl_by_user && ashs_present()) is true, since
      nothing is registered with the rfkill subsystem in that case. Doing so
      leads to the following kernel NULL pointer dereference:
      
        BUG: unable to handle kernel NULL pointer dereference at           (null)
        IP: [<ffffffff816c7348>] __mutex_lock_slowpath+0x98/0x120
        PGD 1a3aa8067
        PUD 1a3b3d067
        PMD 0
      
        Oops: 0002 [#1] PREEMPT SMP
        Modules linked in: bnep ccm binfmt_misc uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core hid_a4tech videodev x86_pkg_temp_thermal intel_powerclamp coretemp ath3k btusb btrtl btintel bluetooth kvm_intel snd_hda_codec_hdmi kvm snd_hda_codec_realtek snd_hda_codec_generic irqbypass crc32c_intel arc4 i915 snd_hda_intel snd_hda_codec ath9k ath9k_common ath9k_hw ath i2c_algo_bit snd_hwdep mac80211 ghash_clmulni_intel snd_hda_core snd_pcm snd_timer cfg80211 ehci_pci xhci_pci drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm xhci_hcd ehci_hcd asus_nb_wmi(-) asus_wmi sparse_keymap r8169 rfkill mxm_wmi serio_raw snd mii mei_me lpc_ich i2c_i801 video soundcore mei i2c_smbus wmi i2c_core mfd_core
        CPU: 3 PID: 3275 Comm: modprobe Not tainted 4.9.34-gentoo #34
        Hardware name: ASUSTeK COMPUTER INC. K56CM/K56CM, BIOS K56CM.206 08/21/2012
        task: ffff8801a639ba00 task.stack: ffffc900014cc000
        RIP: 0010:[<ffffffff816c7348>]  [<ffffffff816c7348>] __mutex_lock_slowpath+0x98/0x120
        RSP: 0018:ffffc900014cfce0  EFLAGS: 00010282
        RAX: 0000000000000000 RBX: ffff8801a54315b0 RCX: 00000000c0000100
        RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff8801a54315b4
        RBP: ffffc900014cfd30 R08: 0000000000000000 R09: 0000000000000002
        R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801a54315b4
        R13: ffff8801a639ba00 R14: 00000000ffffffff R15: ffff8801a54315b8
        FS:  00007faa254fb700(0000) GS:ffff8801aef80000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 0000000000000000 CR3: 00000001a3b1b000 CR4: 00000000001406e0
        Stack:
         ffff8801a54315b8 0000000000000000 ffffffff814733ae ffffc900014cfd28
         ffffffff8146a28c ffff8801a54315b0 0000000000000000 ffff8801a54315b0
         ffff8801a66f3820 0000000000000000 ffffc900014cfd48 ffffffff816c73e7
        Call Trace:
         [<ffffffff814733ae>] ? acpi_ut_release_mutex+0x5d/0x61
         [<ffffffff8146a28c>] ? acpi_ns_get_node+0x49/0x52
         [<ffffffff816c73e7>] mutex_lock+0x17/0x30
         [<ffffffffa00a3bb4>] asus_rfkill_hotplug+0x24/0x1a0 [asus_wmi]
         [<ffffffffa00a4421>] asus_wmi_rfkill_exit+0x61/0x150 [asus_wmi]
         [<ffffffffa00a49f1>] asus_wmi_remove+0x61/0xb0 [asus_wmi]
         [<ffffffff814a5128>] platform_drv_remove+0x28/0x40
         [<ffffffff814a2901>] __device_release_driver+0xa1/0x160
         [<ffffffff814a29e3>] device_release_driver+0x23/0x30
         [<ffffffff814a1ffd>] bus_remove_device+0xfd/0x170
         [<ffffffff8149e5a9>] device_del+0x139/0x270
         [<ffffffff814a5028>] platform_device_del+0x28/0x90
         [<ffffffff814a50a2>] platform_device_unregister+0x12/0x30
         [<ffffffffa00a4209>] asus_wmi_unregister_driver+0x19/0x30 [asus_wmi]
         [<ffffffffa00da0ea>] asus_nb_wmi_exit+0x10/0xf26 [asus_nb_wmi]
         [<ffffffff8110c692>] SyS_delete_module+0x192/0x270
         [<ffffffff810022b2>] ? exit_to_usermode_loop+0x92/0xa0
         [<ffffffff816ca560>] entry_SYSCALL_64_fastpath+0x13/0x94
        Code: e8 5e 30 00 00 8b 03 83 f8 01 0f 84 93 00 00 00 48 8b 43 10 4c 8d 7b 08 48 89 63 10 41 be ff ff ff ff 4c 89 3c 24 48 89 44 24 08 <48> 89 20 4c 89 6c 24 10 eb 1d 4c 89 e7 49 c7 45 08 02 00 00 00
        RIP  [<ffffffff816c7348>] __mutex_lock_slowpath+0x98/0x120
         RSP <ffffc900014cfce0>
        CR2: 0000000000000000
        ---[ end trace 8d484233fa7cb512 ]---
        note: modprobe[3275] exited with preempt_count 2
      
      https://bugzilla.kernel.org/show_bug.cgi?id=196467
      
      Reported-by: red.f0xyz@gmail.com
      Signed-off-by: NJoão Paulo Rechi Vita <jprvita@endlessm.com>
      Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      32ffd6e8
    • D
      fs: clear writeback errors in inode_init_always · 829bc787
      Darrick J. Wong 提交于
      In inode_init_always(), we clear the inode mapping flags, which clears
      any retained error (AS_EIO, AS_ENOSPC) bits.  Unfortunately, we do not
      also clear wb_err, which means that old mapping errors can leak through
      to new inodes.
      
      This is crucial for the XFS inode allocation path because we recycle old
      in-core inodes and we do not want error state from an old file to leak
      into the new file.  This bug was discovered by running generic/036 and
      generic/047 in a loop and noticing that the EIOs generated by the
      collision of direct and buffered writes in generic/036 would survive the
      remount between 036 and 047, and get reported to the fsyncs (on
      different files!) in generic/047.
      Signed-off-by: NDarrick J. Wong <darrick.wong@oracle.com>
      Reviewed-by: NJeff Layton <jlayton@kernel.org>
      Reviewed-by: NBrian Foster <bfoster@redhat.com>
      829bc787
    • D
      Merge tag 'drm-misc-fixes-2018-05-30' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes · 0e333751
      Dave Airlie 提交于
      dw-hdmi: Fix Oops regression from rc1 (Neil)
      
      Cc: Neil Armstrong <narmstrong@baylibre.com>
      
      * tag 'drm-misc-fixes-2018-05-30' of git://anongit.freedesktop.org/drm/drm-misc:
        drm/bridge/synopsys: dw-hdmi: fix dw_hdmi_setup_rx_sense
      0e333751
    • L
      Merge tag 'for-linus-20180530' of git://git.kernel.dk/linux-block · 88a86765
      Linus Torvalds 提交于
      Pull block fix from Jens Axboe:
       "Just a single fix that should make it into this release, fixing a
        regression with T10-DIF on NVMe"
      
      * tag 'for-linus-20180530' of git://git.kernel.dk/linux-block:
        nvme: fix extended data LBA supported setting
      88a86765
    • L
      Merge tag 'selinux-pr-20180530' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux · 943cf9f3
      Linus Torvalds 提交于
      Pull SELinux fix from Paul Moore:
       "One more small fix for SELinux: a small string length fix found by
        KASAN.
      
        I dislike sending patches this late in the release cycle, but this
        patch fixes a legitimate problem, is very small, limited in scope, and
        well understood.
      
        There are two threads with more information on the problem, the latest
        is linked below:
      
          https://marc.info/?t=152723737400001&r=1&w=2
      
        Stephen points out in the thread linked above:
      
         'Such a setxattr() call can only be performed by a process with
          CAP_MAC_ADMIN that is also allowed mac_admin permission in SELinux
          policy. Consequently, this is never possible on Android (no process
          is allowed mac_admin permission, always enforcing) and is only
          possible in Fedora/RHEL for a few domains (if enforcing)'"
      
      * tag 'selinux-pr-20180530' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
        selinux: KASAN: slab-out-of-bounds in xattr_getsecurity
      943cf9f3
    • L
      Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · c462f16b
      Linus Torvalds 提交于
      Pull crypto fix from Herbert Xu:
       "This fixes a potential kernel panic in the inside-secure driver"
      
      * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        crypto: inside-secure - do not use memset on MMIO
      c462f16b
    • N
      drm/bridge/synopsys: dw-hdmi: fix dw_hdmi_setup_rx_sense · c32048d9
      Neil Armstrong 提交于
      The dw_hdmi_setup_rx_sense exported function should not use struct device
      to recover the dw-hdmi context using drvdata, but take struct dw_hdmi
      directly like other exported functions.
      
      This caused a regression using Meson DRM on S905X since v4.17-rc1 :
      
      Internal error: Oops: 96000007 [#1] PREEMPT SMP
      [...]
      CPU: 0 PID: 124 Comm: irq/32-dw_hdmi_ Not tainted 4.17.0-rc7 #2
      Hardware name: Libre Technology CC (DT)
      [...]
      pc : osq_lock+0x54/0x188
      lr : __mutex_lock.isra.0+0x74/0x530
      [...]
      Process irq/32-dw_hdmi_ (pid: 124, stack limit = 0x00000000adf418cb)
      Call trace:
        osq_lock+0x54/0x188
        __mutex_lock_slowpath+0x10/0x18
        mutex_lock+0x30/0x38
        __dw_hdmi_setup_rx_sense+0x28/0x98
        dw_hdmi_setup_rx_sense+0x10/0x18
        dw_hdmi_top_thread_irq+0x2c/0x50
        irq_thread_fn+0x28/0x68
        irq_thread+0x10c/0x1a0
        kthread+0x128/0x130
        ret_from_fork+0x10/0x18
       Code: 34000964 d00050a2 51000484 9135c042 (f864d844)
       ---[ end trace 945641e1fbbc07da ]---
       note: irq/32-dw_hdmi_[124] exited with preempt_count 1
       genirq: exiting task "irq/32-dw_hdmi_" (124) is an active IRQ thread (irq 32)
      
      Fixes: eea034af ("drm/bridge/synopsys: dw-hdmi: don't clobber drvdata")
      Signed-off-by: NNeil Armstrong <narmstrong@baylibre.com>
      Tested-by: NKoen Kooi <koen@dominion.thruhere.net>
      Signed-off-by: NSean Paul <seanpaul@chromium.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/1527673438-20643-1-git-send-email-narmstrong@baylibre.com
      c32048d9
  5. 30 5月, 2018 12 次提交
  6. 29 5月, 2018 4 次提交
    • L
      Merge tag 'trace-v4.17-rc4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 3d661e2a
      Linus Torvalds 提交于
      Pull tracing fixes from Steven Rostedt:
       "While writing selftests for a new feature, I triggered two existing
        bugs that deal with triggers and instances.
      
         - a generic trigger bug where the triggers are not removed from a
           linked list properly when deleting an instance.
      
         - a bug specific to snapshots, where the snapshot is done in the top
           level buffer, when it is supposed to snapshot the buffer associated
           to the instance the snapshot trigger exists in"
      
      * tag 'trace-v4.17-rc4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Make the snapshot trigger work with instances
        tracing: Fix crash when freeing instances with event triggers
      3d661e2a
    • C
      drm/i915/query: nospec expects no more than an unsigned long · 65b3bdc8
      Chris Wilson 提交于
      nospec quite reasonably asserts that it will never be used with an index
      larger than unsigned long (that being the largest possibly index into an
      C array). However, our ubi uses the convention of u64 for any large
      integer, running afoul of the assertion on 32b. Reduce our index to an
      unsigned long, checking for type overflow first.
      
        drivers/gpu/drm/i915/i915_query.c: In function 'i915_query_ioctl':
        include/linux/compiler.h:339:38: error: call to '__compiletime_assert_119' declared with attribute error: BUILD_BUG_ON failed: sizeof(_s) > sizeof(long)
      
      Reported-by: kbuild-all@01.org
      Fixes: 84b510e2 ("drm/i915/query: Protect tainted function pointer lookup")
      Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
      Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
      Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Reviewed-by: NLionel Landwerlin <lionel.g.landwerlin@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20180522121018.15199-1-chris@chris-wilson.co.uk
      (cherry picked from commit a33b1dc8)
      Signed-off-by: NJoonas Lahtinen <joonas.lahtinen@linux.intel.com>
      65b3bdc8
    • S
      tracing: Make the snapshot trigger work with instances · 2824f503
      Steven Rostedt (VMware) 提交于
      The snapshot trigger currently only affects the main ring buffer, even when
      it is used by the instances. This can be confusing as the snapshot trigger
      is listed in the instance.
      
       > # cd /sys/kernel/tracing
       > # mkdir instances/foo
       > # echo snapshot > instances/foo/events/syscalls/sys_enter_fchownat/trigger
       > # echo top buffer > trace_marker
       > # echo foo buffer > instances/foo/trace_marker
       > # touch /tmp/bar
       > # chown rostedt /tmp/bar
       > # cat instances/foo/snapshot
       # tracer: nop
       #
       #
       # * Snapshot is freed *
       #
       # Snapshot commands:
       # echo 0 > snapshot : Clears and frees snapshot buffer
       # echo 1 > snapshot : Allocates snapshot buffer, if not already allocated.
       #                      Takes a snapshot of the main buffer.
       # echo 2 > snapshot : Clears snapshot buffer (but does not allocate or free)
       #                      (Doesn't have to be '2' works with any number that
       #                       is not a '0' or '1')
      
       > # cat snapshot
       # tracer: nop
       #
       #                              _-----=> irqs-off
       #                             / _----=> need-resched
       #                            | / _---=> hardirq/softirq
       #                            || / _--=> preempt-depth
       #                            ||| /     delay
       #           TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION
       #              | |       |   ||||       |         |
                   bash-1189  [000] ....   111.488323: tracing_mark_write: top buffer
      
      Not only did the snapshot occur in the top level buffer, but the instance
      snapshot buffer should have been allocated, and it is still free.
      
      Cc: stable@vger.kernel.org
      Fixes: 85f2b082 ("tracing: Add basic event trigger framework")
      Signed-off-by: NSteven Rostedt (VMware) <rostedt@goodmis.org>
      2824f503
    • A
      IB: Revert "remove redundant INFINIBAND kconfig dependencies" · 533d1dae
      Arnd Bergmann 提交于
      Several subsystems depend on INFINIBAND_ADDR_TRANS, which in turn depends
      on INFINIBAND. However, when with CONFIG_INIFIBAND=m, this leads to a
      link error when another driver using it is built-in. The
      INFINIBAND_ADDR_TRANS dependency is insufficient here as this is
      a 'bool' symbol that does not force anything to be a module in turn.
      
      fs/cifs/smbdirect.o: In function `smbd_disconnect_rdma_work':
      smbdirect.c:(.text+0x1e4): undefined reference to `rdma_disconnect'
      net/9p/trans_rdma.o: In function `rdma_request':
      trans_rdma.c:(.text+0x7bc): undefined reference to `rdma_disconnect'
      net/9p/trans_rdma.o: In function `rdma_destroy_trans':
      trans_rdma.c:(.text+0x830): undefined reference to `ib_destroy_qp'
      trans_rdma.c:(.text+0x858): undefined reference to `ib_dealloc_pd'
      
      Fixes: 9533b292 ("IB: remove redundant INFINIBAND kconfig dependencies")
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Acked-by: NGreg Thelen <gthelen@google.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      533d1dae
  7. 28 5月, 2018 1 次提交
    • L
      Merge tag 'nds32-for-linus-4.17-fixes' of... · 786b71f5
      Linus Torvalds 提交于
      Merge tag 'nds32-for-linus-4.17-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/greentime/linux
      
      Pull nds32 fixes from Greentime Hu:
       "Bug fixes and build error fixes for nds32"
      
      * tag 'nds32-for-linus-4.17-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/greentime/linux:
        nds32: Fix compiler warning, Wstringop-overflow, in vdso.c
        nds32: Disable local irq before calling cpu_dcache_wb_page in copy_user_highpage
        nds32: Flush the cache of the page at vmaddr instead of kaddr in flush_anon_page
        nds32: Correct flush_dcache_page function
        nds32: Fix the unaligned access handler
        nds32: Renaming the file for unaligned access
        nds32: To fix a cache inconsistency issue by setting correct cacheability of NTC
        nds32: To refine readability of INT_MASK_INITAIAL_VAL
        nds32: Fix the virtual address may map too much range by tlbop issue.
        nds32: Fix the allmodconfig build. To make sure CONFIG_CPU_LITTLE_ENDIAN is default y
        nds32: Fix build failed because arch_trace_hardirqs_off is changed to trace_hardirqs_off.
        nds32: Fix the unknown type u8 issue.
        nds32: Fix the symbols undefined issue by exporting them.
        nds32: Fix xfs_buf built failed by export invalidate_kernel_vmap_range and flush_kernel_vmap_range
        nds32: Fix drivers/gpu/drm/udl/udl_fb.c building error by defining PAGE_SHARED
        nds32: Fix building error of crypto/xor.c by adding xor.h
        nds32: Fix building error when CONFIG_FREEZE is enabled.
        nds32: lib: To use generic lib instead of libgcc to prevent the symbol undefined issue.
      786b71f5