Skip to content
  1. Mar 30, 2017
    • Helge Deller's avatar
      parisc: Avoid stalled CPU warnings after system shutdown · 476e75a4
      Helge Deller authored
      
      
      Commit 73580dac ("parisc: Fix system shutdown halt") introduced an endless
      loop for systems which don't provide a software power off function.  But the
      soft lockup detector will detect this and report stalled CPUs after some time.
      Avoid those unwanted warnings by disabling the soft lockup detector.
      
      Fixes: 73580dac ("parisc: Fix system shutdown halt")
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      Cc: stable@vger.kernel.org # 4.9+
      476e75a4
    • Helge Deller's avatar
      parisc: Clean up fixup routines for get_user()/put_user() · d19f5e41
      Helge Deller authored
      
      
      Al Viro noticed that userspace accesses via get_user()/put_user() can be
      simplified a lot with regard to usage of the exception handling.
      
      This patch implements a fixup routine for get_user() and put_user() in such
      that the exception handler will automatically load -EFAULT into the register
      %r8 (the error value) in case on a fault on userspace.  Additionally the fixup
      routine will zero the target register on fault in case of a get_user() call.
      The target register is extracted out of the faulting assembly instruction.
      
      This patch brings a few benefits over the old implementation:
      1. Exception handling gets much cleaner, easier and smaller in size.
      2. Helper functions like fixup_get_user_skip_1 (all of fixup.S) can be dropped.
      3. No need to hardcode %r9 as target register for get_user() any longer. This
         helps the compiler register allocator and thus creates less assembler
         statements.
      4. No dependency on the exception_data contents any longer.
      5. Nested faults will be handled cleanly.
      
      Reported-by: default avatarAl Viro <viro@ZenIV.linux.org.uk>
      Cc: <stable@vger.kernel.org> # v4.9+
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      d19f5e41
    • Helge Deller's avatar
      parisc: Fix access fault handling in pa_memcpy() · 554bfece
      Helge Deller authored
      
      
      pa_memcpy() is the major memcpy implementation in the parisc kernel which is
      used to do any kind of userspace/kernel memory copies.
      
      Al Viro noticed various bugs in the implementation of pa_mempcy(), most notably
      that in case of faults it may report back to have copied more bytes than it
      actually did.
      
      Fixing those bugs is quite hard in the C-implementation, because the compiler
      is messing around with the registers and we are not guaranteed that specific
      variables are always in the same processor registers. This makes proper fault
      handling complicated.
      
      This patch implements pa_memcpy() in assembler. That way we have correct fault
      handling and adding a 64-bit copy routine was quite easy.
      
      Runtime tested with 32- and 64bit kernels.
      
      Reported-by: default avatarAl Viro <viro@ZenIV.linux.org.uk>
      Cc: <stable@vger.kernel.org> # v4.9+
      Signed-off-by: default avatarJohn David Anglin <dave.anglin@bell.net>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      554bfece
  2. Mar 29, 2017
    • Linus Torvalds's avatar
      Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost · fe82203b
      Linus Torvalds authored
      Pull virtio fixes from Michael Tsirkin:
       "Fixes to multiple issues in virtio.
      
        Most notably a regression fix for crashes reported by Fedora users.
        Hibernate is still reportedly broken, working on it"
      
      * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
        virtio_balloon: prevent uninitialized variable use
        virtio-balloon: use actual number of stats for stats queue buffers
        virtio_balloon: init 1st buffer in stats vq
        virtio_pci: fix out of bound access for msix_names
      fe82203b
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 050fc52d
      Linus Torvalds authored
      Pull KVM fixes from Paolo Bonzini:
       "All x86-specific, apart from some arch-independent syzkaller fixes"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: x86: cleanup the page tracking SRCU instance
        KVM: nVMX: fix nested EPT detection
        KVM: pci-assign: do not map smm memory slot pages in vt-d page tables
        KVM: kvm_io_bus_unregister_dev() should never fail
        KVM: VMX: Fix enable VPID conditions
        KVM: nVMX: Fix nested VPID vmx exec control
        KVM: x86: correct async page present tracepoint
        kvm: vmx: Flush TLB when the APIC-access address changes
        KVM: x86: use pic/ioapic destructor when destroy vm
        KVM: x86: check existance before destroy
        KVM: x86: clear bus pointer when destroyed
        KVM: Documentation: document MCE ioctls
        KVM: nVMX: don't reset kvm mmu twice
        PTP: fix ptr_ret.cocci warnings
        kvm: fix usage of uninit spinlock in avic_vm_destroy()
        KVM: VMX: downgrade warning on unexpected exit code
      050fc52d
    • Arnd Bergmann's avatar
      virtio_balloon: prevent uninitialized variable use · f0bb2d50
      Arnd Bergmann authored
      
      
      The latest gcc-7.0.1 snapshot reports a new warning:
      
      virtio/virtio_balloon.c: In function 'update_balloon_stats':
      virtio/virtio_balloon.c:258:26: error: 'events[2]' is used uninitialized in this function [-Werror=uninitialized]
      virtio/virtio_balloon.c:260:26: error: 'events[3]' is used uninitialized in this function [-Werror=uninitialized]
      virtio/virtio_balloon.c:261:56: error: 'events[18]' is used uninitialized in this function [-Werror=uninitialized]
      virtio/virtio_balloon.c:262:56: error: 'events[17]' is used uninitialized in this function [-Werror=uninitialized]
      
      This seems absolutely right, so we should add an extra check to
      prevent copying uninitialized stack data into the statistics.
      >From all I can tell, this has been broken since the statistics code
      was originally added in 2.6.34.
      
      Fixes: 9564e138 ("virtio: Add memory statistics reporting to the balloon driver (V4)")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarLadi Prosek <lprosek@redhat.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      f0bb2d50
    • Ladi Prosek's avatar
      virtio-balloon: use actual number of stats for stats queue buffers · 9646b26e
      Ladi Prosek authored
      
      
      The virtio balloon driver contained a not-so-obvious invariant that
      update_balloon_stats has to update exactly VIRTIO_BALLOON_S_NR counters
      in order to send valid stats to the host. This commit fixes it by having
      update_balloon_stats return the actual number of counters, and its
      callers use it when pushing buffers to the stats virtqueue.
      
      Note that it is still out of spec to change the number of counters
      at run-time. "Driver MUST supply the same subset of statistics in all
      buffers submitted to the statsq."
      
      Suggested-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarLadi Prosek <lprosek@redhat.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      9646b26e
    • Ladi Prosek's avatar
      virtio_balloon: init 1st buffer in stats vq · fc865322
      Ladi Prosek authored
      
      
      When init_vqs runs, virtio_balloon.stats is either uninitialized or
      contains stale values. The host updates its state with garbage data
      because it has no way of knowing that this is just a marker buffer
      used for signaling.
      
      This patch updates the stats before pushing the initial buffer.
      
      Alternative fixes:
      * Push an empty buffer in init_vqs. Not easily done with the current
        virtio implementation and violates the spec "Driver MUST supply the
        same subset of statistics in all buffers submitted to the statsq".
      * Push a buffer with invalid tags in init_vqs. Violates the same
        spec clause, plus "invalid tag" is not really defined.
      
      Note: the spec says:
      	When using the legacy interface, the device SHOULD ignore all values in
      	the first buffer in the statsq supplied by the driver after device
      	initialization. Note: Historically, drivers supplied an uninitialized
      	buffer in the first buffer.
      
      Unfortunately QEMU does not seem to implement the recommendation
      even for the legacy interface.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLadi Prosek <lprosek@redhat.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      fc865322
    • Jason Wang's avatar
      virtio_pci: fix out of bound access for msix_names · de85ec8b
      Jason Wang authored
      Fedora has received multiple reports of crashes when running
      4.11 as a guest
      
      https://bugzilla.redhat.com/show_bug.cgi?id=1430297
      https://bugzilla.redhat.com/show_bug.cgi?id=1434462
      https://bugzilla.kernel.org/show_bug.cgi?id=194911
      https://bugzilla.redhat.com/show_bug.cgi?id=1433899
      
      
      
      The crashes are not always consistent but they are generally
      some flavor of oops or GPF in virtio related code. Multiple people
      have done bisections (Thank you Thorsten Leemhuis and
      Richard W.M. Jones) and found this commit to be at fault
      
      07ec5148 is the first bad commit
      commit 07ec5148
      Author: Christoph Hellwig <hch@lst.de>
      Date:   Sun Feb 5 18:15:19 2017 +0100
      
          virtio_pci: use shared interrupts for virtqueues
      
      The issue seems to be an out of bounds access to the msix_names
      array corrupting kernel memory.
      
      Fixes: 07ec5148 ("virtio_pci: use shared interrupts for virtqueues")
      Reported-by: default avatarLaura Abbott <labbott@redhat.com>
      Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Tested-by: default avatarRichard W.M. Jones <rjones@redhat.com>
      Tested-by: default avatarThorsten Leemhuis <linux@leemhuis.info>
      de85ec8b
  3. Mar 28, 2017
  4. Mar 27, 2017
    • Linus Torvalds's avatar
      Linux 4.11-rc4 · c02ed2e7
      Linus Torvalds authored
      c02ed2e7
    • Linus Torvalds's avatar
      Merge tag 'char-misc-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · 0dc82fa5
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "A smattering of different small fixes for some random driver
        subsystems. Nothing all that major, just resolutions for reported
        issues and bugs.
      
        All have been in linux-next with no reported issues"
      
      * tag 'char-misc-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (21 commits)
        extcon: int3496: Set the id pin to direction-input if necessary
        extcon: int3496: Use gpiod_get instead of gpiod_get_index
        extcon: int3496: Add dependency on X86 as it's Intel specific
        extcon: int3496: Add GPIO ACPI mapping table
        extcon: int3496: Rename GPIO pins in accordance with binding
        vmw_vmci: handle the return value from pci_alloc_irq_vectors correctly
        ppdev: fix registering same device name
        parport: fix attempt to write duplicate procfiles
        auxdisplay: img-ascii-lcd: add missing sentinel entry in img_ascii_lcd_matches
        Drivers: hv: vmbus: Don't leak memory when a channel is rescinded
        Drivers: hv: vmbus: Don't leak channel ids
        Drivers: hv: util: don't forget to init host_ts.lock
        Drivers: hv: util: move waiting for release to hv_utils_transport itself
        vmbus: remove hv_event_tasklet_disable/enable
        vmbus: use rcu for per-cpu channel list
        mei: don't wait for os version message reply
        mei: fix deadlock on mei reset
        intel_th: pci: Add Gemini Lake support
        intel_th: pci: Add Denverton SOC support
        intel_th: Don't leak module refcount on failure to activate
        ...
      0dc82fa5
    • Linus Torvalds's avatar
      Merge tag 'driver-core-4.11-rc4' of... · 9e54ef9d
      Linus Torvalds authored
      Merge tag 'driver-core-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
      
      Pull driver core fix from Greg KH:
       "Here is a single kernfs fix for 4.11-rc4 that resolves a reported
        issue.
      
        It has been in linux-next with no reported issues"
      
      * tag 'driver-core-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        kernfs: Check KERNFS_HAS_RELEASE before calling kernfs_release_file()
      9e54ef9d
    • Linus Torvalds's avatar
      Merge tag 'tty-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · f1638fc6
      Linus Torvalds authored
      Pull tty/serial driver fixes from Greg KH:
       "Here are some tty and serial driver fixes for 4.11-rc4.
      
        One of these fix a long-standing issue in the ldisc code that was
        found by Dmitry Vyukov with his great fuzzing work. The other fixes
        resolve other reported issues, and there is one revert of a patch in
        4.11-rc1 that wasn't correct.
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'tty-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        tty: fix data race in tty_ldisc_ref_wait()
        tty: don't panic on OOM in tty_set_ldisc()
        Revert "tty: serial: pl011: add ttyAMA for matching pl011 console"
        tty: acpi/spcr: QDF2400 E44 checks for wrong OEM revision
        serial: 8250_dw: Fix breakage when HAVE_CLK=n
        serial: 8250_dw: Honor clk_round_rate errors in dw8250_set_termios
      f1638fc6
    • Linus Torvalds's avatar
      Merge tag 'staging-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 53b4d591
      Linus Torvalds authored
      Pull IIO driver fixes from Greg KH:
       "Here are some small IIO driver fixes for 4.11-rc4 that resolve a
        number of tiny reported issues. All of these have been in linux-next
        for a while with no reported issues"
      
      * tag 'staging-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        iio: imu: st_lsm6dsx: fix FIFO_CTRL2 overwrite during watermark configuration
        iio: adc: ti_am335x_adc: fix fifo overrun recovery
        iio: sw-device: Fix config group initialization
        iio: magnetometer: ak8974: remove incorrect __exit markups
        iio: hid-sensor-trigger: Change get poll value function order to avoid sensor properties losing after resume from S3
      53b4d591
    • Linus Torvalds's avatar
      Merge tag 'usb-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · e431e0e4
      Linus Torvalds authored
      Pull USB/PHY fixes from Greg KH:
       "Here are a number of small USB and PHY driver fixes for 4.11-rc4.
      
        Nothing major here, just an bunch of small fixes, and a handfull of
        good fixes from Johan for devices with crazy descriptors. There are a
        few new device ids in here as well.
      
        All of these have been in linux-next with no reported issues"
      
      * tag 'usb-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (26 commits)
        usb: gadget: f_hid: fix: Don't access hidg->req without spinlock held
        usb: gadget: udc: remove pointer dereference after free
        usb: gadget: f_uvc: Sanity check wMaxPacketSize for SuperSpeed
        usb: gadget: f_uvc: Fix SuperSpeed companion descriptor's wBytesPerInterval
        usb: gadget: acm: fix endianness in notifications
        usb: dwc3: gadget: delay unmap of bounced requests
        USB: serial: qcserial: add Dell DW5811e
        usb: hub: Fix crash after failure to read BOS descriptor
        ACM gadget: fix endianness in notifications
        USB: usbtmc: fix probe error path
        USB: usbtmc: add missing endpoint sanity check
        USB: serial: option: add Quectel UC15, UC20, EC21, and EC25 modems
        usb: musb: fix possible spinlock deadlock
        usb: musb: dsps: fix iounmap in error and exit paths
        usb: musb: cppi41: don't check early-TX-interrupt for Isoch transfer
        usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk
        uwb: i1480-dfu: fix NULL-deref at probe
        uwb: hwa-rc: fix NULL-deref at probe
        USB: wusbcore: fix NULL-deref at probe
        USB: uss720: fix NULL-deref at probe
        ...
      e431e0e4
    • Linus Torvalds's avatar
      Merge tag 'powerpc-4.11-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 42234bf8
      Linus Torvalds authored
      Pull more powerpc fixes from Michael Ellerman:
       "These are all pretty minor. The fix for idle wakeup would be a bad bug
        but has not been observed in practice.
      
        The update to the gcc-plugins docs was Cc'ed to Kees and Jon, Kees
        OK'ed it going via powerpc and I didn't hear from Jon.
      
         - cxl: Route eeh events to all slices for pci_channel_io_perm_failure state
      
         - powerpc/64s: Fix idle wakeup potential to clobber registers
      
         - Revert "powerpc/64: Disable use of radix under a hypervisor"
      
         - gcc-plugins: update architecture list in documentation
      
        Thanks to: Andrew Donnellan, Nicholas Piggin, Paul Mackerras, Vaibhav
        Jain"
      
      * tag 'powerpc-4.11-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        gcc-plugins: update architecture list in documentation
        Revert "powerpc/64: Disable use of radix under a hypervisor"
        powerpc/64s: Fix idle wakeup potential to clobber registers
        cxl: Route eeh events to all slices for pci_channel_io_perm_failure state
      42234bf8
    • Linus Torvalds's avatar
      Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · 1c23de63
      Linus Torvalds authored
      Pull ext4 fixes from Ted Ts'o:
       "Fix a memory leak on an error path, and two races when modifying
        inodes relating to the inline_data and metadata checksum features"
      
      * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4: fix two spelling nits
        ext4: lock the xattr block before checksuming it
        jbd2: don't leak memory if setting up journal fails
        ext4: mark inode dirty after converting inline directory
      1c23de63
  5. Mar 26, 2017
  6. Mar 25, 2017