summaryrefslogtreecommitdiff
path: root/fs/xfs
AgeCommit message (Collapse)Author
2022-02-04Merge remote-tracking branch 'google/common/android-4.4-p' into ↵Michael Bestas
lineage-18.1-caf-msm8998 * google/common/android-4.4-p: Linux 4.4.302 Input: i8042 - Fix misplaced backport of "add ASUS Zenbook Flip to noselftest list" KVM: x86: Fix misplaced backport of "work around leak of uninitialized stack contents" Revert "tc358743: fix register i2c_rd/wr function fix" Revert "drm/radeon/ci: disable mclk switching for high refresh rates (v2)" Bluetooth: MGMT: Fix misplaced BT_HS check ipv4: tcp: send zero IPID in SYNACK messages ipv4: raw: lock the socket in raw_bind() hwmon: (lm90) Reduce maximum conversion rate for G781 drm/msm: Fix wrong size calculation net-procfs: show net devices bound packet types ipv4: avoid using shared IP generator for connected sockets net: fix information leakage in /proc/net/ptype ipv6_tunnel: Rate limit warning messages scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() USB: core: Fix hang in usb_kill_urb by adding memory barriers usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge tty: Add support for Brainboxes UC cards. tty: n_gsm: fix SW flow control encoding/handling serial: stm32: fix software flow control transfer PM: wakeup: simplify the output logic of pm_show_wakelocks() udf: Fix NULL ptr deref when converting from inline format udf: Restore i_lenAlloc when inode expansion fails scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices s390/hypfs: include z/VM guests with access control group set Bluetooth: refactor malicious adv data check can: bcm: fix UAF of bcm op Linux 4.4.301 drm/i915: Flush TLBs before releasing backing store Linux 4.4.300 lib82596: Fix IRQ check in sni_82596_probe bcmgenet: add WOL IRQ check net_sched: restore "mpu xxx" handling dmaengine: at_xdmac: Fix at_xdmac_lld struct definition dmaengine: at_xdmac: Fix lld view setting dmaengine: at_xdmac: Print debug message after realeasing the lock dmaengine: at_xdmac: Don't start transactions at tx_submit level netns: add schedule point in ops_exit_list() net: axienet: fix number of TX ring slots for available check net: axienet: Wait for PhyRstCmplt after core reset af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses ext4: don't use the orphan list when migrating an inode ext4: Fix BUG_ON in ext4_bread when write quota data ext4: set csum seed in tmp inode while migrating to extents ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers power: bq25890: Enable continuous conversion for ADC at charging scsi: sr: Don't use GFP_DMA MIPS: Octeon: Fix build errors using clang i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters ALSA: seq: Set upper limit of processed events w1: Misuse of get_user()/put_user() reported by sparse i2c: mpc: Correct I2C reset procedure powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING i2c: i801: Don't silently correct invalid transfer size powerpc/btext: add missing of_node_put powerpc/cell: add missing of_node_put powerpc/powernv: add missing of_node_put powerpc/6xx: add missing of_node_put parisc: Avoid calling faulthandler_disabled() twice serial: core: Keep mctrl register state and cached copy in sync serial: pl010: Drop CR register reset on set_termios dm space map common: add bounds check to sm_ll_lookup_bitmap() dm btree: add a defensive bounds check to insert_at() net: mdio: Demote probed message to debug print btrfs: remove BUG_ON(!eie) in find_parent_nodes btrfs: remove BUG_ON() in find_parent_nodes() ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() ACPICA: Utilities: Avoid deleting the same object twice in a row um: registers: Rename function names to avoid conflicts and build problems ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() media: igorplugusb: receiver overflow should be reported net: bonding: debug: avoid printing debug logs when bond is not notifying peers iwlwifi: mvm: synchronize with FW after multicast commands media: m920x: don't use stack on USB reads media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() floppy: Add max size check for user space request mwifiex: Fix skb_over_panic in mwifiex_usb_recv() HSI: core: Fix return freed object in hsi_new_client media: b2c2: Add missing check in flexcop_pci_isr: usb: gadget: f_fs: Use stream_open() for endpoint files ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply fs: dlm: filter user dlm messages for kernel locks Bluetooth: Fix debugfs entry leak in hci_register_dev() RDMA/cxgb4: Set queue pair state when being queried mips: bcm63xx: add support for clk_set_parent() mips: lantiq: add support for clk_set_parent() misc: lattice-ecp3-config: Fix task hung when firmware load failed ASoC: samsung: idma: Check of ioremap return value dmaengine: pxa/mmp: stop referencing config->slave_id RDMA/core: Let ib_find_gid() continue search even after empty entry char/mwave: Adjust io port register size ALSA: oss: fix compile error when OSS_DEBUG is enabled powerpc/prom_init: Fix improper check of prom_getprop() ALSA: hda: Add missing rwsem around snd_ctl_remove() calls ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls ALSA: jack: Add missing rwsem around snd_ctl_remove() calls ext4: avoid trim error on fs with small groups net: mcs7830: handle usb read errors properly pcmcia: fix setting of kthread task states can: xilinx_can: xcan_probe(): check for error irq can: softing: softing_startstop(): fix set but not used variable warning spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe ppp: ensure minimum packet size in ppp_write() pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() usb: ftdi-elan: fix memory leak on device disconnect media: msi001: fix possible null-ptr-deref in msi001_probe() media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() media: dib8000: Fix a memleak in dib8000_init() floppy: Fix hang in watchdog when disk is ejected serial: amba-pl011: do not request memory region twice drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() arm64: dts: qcom: msm8916: fix MMC controller aliases netfilter: bridge: add support for pppoe filtering tty: serial: atmel: Call dma_async_issue_pending() tty: serial: atmel: Check return code of dmaengine_submit() crypto: qce - fix uaf on qce_ahash_register_one Bluetooth: stop proccessing malicious adv data Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller can: softing_cs: softingcs_probe(): fix memleak on registration failure media: stk1160: fix control-message timeouts media: pvrusb2: fix control-message timeouts media: dib0700: fix undefined behavior in tuner shutdown media: em28xx: fix control-message timeouts media: mceusb: fix control-message timeouts rtc: cmos: take rtc_lock while reading from CMOS nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() HID: uhid: Fix worker destroying device without any protection rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled media: uvcvideo: fix division by zero at stream start drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk() can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved} can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe() USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status USB: core: Fix bug in resuming hub's handling of wakeup requests Bluetooth: bfusb: fix division by zero in send path Linux 4.4.299 power: reset: ltc2952: Fix use of floating point literals mISDN: change function names to avoid conflicts net: udp: fix alignment problem in udp4_seq_show() ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() phonet: refcount leak in pep_sock_accep rndis_host: support Hytera digital radios xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc i40e: Fix incorrect netdev's real number of RX/TX queues mac80211: initialize variable have_higher_than_11mbit ieee802154: atusb: fix uninit value in atusb_set_extended_addr Bluetooth: btusb: Apply QCA Rome patches for some ATH3012 models bpf, test: fix ld_abs + vlan push/pop stress test Linux 4.4.298 net: fix use-after-free in tw_timer_handler Input: spaceball - fix parsing of movement data packets Input: appletouch - initialize work before device registration scsi: vmw_pvscsi: Set residual data length conditionally usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set. uapi: fix linux/nfc.h userspace compilation errors nfc: uapi: use kernel size_t to fix user-space builds selinux: initialize proto variable in selinux_ip_postroute_compat() recordmcount.pl: fix typo in s390 mcount regex platform/x86: apple-gmux: use resource_size() with res Linux 4.4.297 phonet/pep: refuse to enable an unbound pipe hamradio: improve the incomplete fix to avoid NPD hamradio: defer ax25 kfree after unregister_netdev ax25: NPD bug when detaching AX25 device xen/blkfront: fix bug in backported patch ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling ALSA: drivers: opl3: Fix incorrect use of vp->state ALSA: jack: Check the return value of kstrdup() hwmon: (lm90) Fix usage of CONFIG2 register in detect function drivers: net: smc911x: Check for error irq bonding: fix ad_actor_system option setting to default qlcnic: potential dereference null pointer of rx_queue->page_ring IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() HID: holtek: fix mouse probing can: kvaser_usb: get CAN clock frequency from device net: usb: lan78xx: add Allied Telesis AT29M2-AF Conflicts: drivers/usb/gadget/function/f_fs.c Change-Id: Iabc390c3c9160c7a2864ffe1125d73412ffdb31d
2022-01-11xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocateDarrick J. Wong
commit 983d8e60f50806f90534cc5373d0ce867e5aaf79 upstream. The old ALLOCSP/FREESP ioctls in XFS can be used to preallocate space at the end of files, just like fallocate and RESVSP. Make the behavior consistent with the other ioctls. Reported-by: Kirill Tkhai <ktkhai@virtuozzo.com> Signed-off-by: Darrick J. Wong <djwong@kernel.org> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Dave Chinner <dchinner@redhat.com> Reviewed-by: Eric Sandeen <sandeen@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-03-17Merge branch 'android-4.4-p' of ↵Michael Bestas
https://android.googlesource.com/kernel/common into lineage-18.1-caf-msm8998 This brings LA.UM.9.2.r1-02700-SDMxx0.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 58bc8e0469d08 Merge 4.4.261 into android-4.4-p Conflicts: drivers/block/zram/zram_drv.c drivers/block/zram/zram_drv.h mm/zsmalloc.c Change-Id: I451bffa685eaaea04938bc6d0b8e3f4bb0f869e9
2021-03-07xfs: Fix assert failure in xfs_setattr_size()Yumei Huang
commit 88a9e03beef22cc5fabea344f54b9a0dfe63de08 upstream. An assert failure is triggered by syzkaller test due to ATTR_KILL_PRIV is not cleared before xfs_setattr_size. As ATTR_KILL_PRIV is not checked/used by xfs_setattr_size, just remove it from the assert. Signed-off-by: Yumei Huang <yuhuang@redhat.com> Reviewed-by: Brian Foster <bfoster@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Darrick J. Wong <djwong@kernel.org> Signed-off-by: Darrick J. Wong <djwong@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-09Merge branch 'android-4.4-p' of ↵Michael Bestas
https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-06200-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 4cb652f2d058e ANDROID: cuttlefish_defconfig: Disable CONFIG_KSM Conflicts: arch/arm64/include/asm/mmu_context.h arch/powerpc/include/asm/uaccess.h drivers/scsi/ufs/ufshcd.c Change-Id: I25e090fc1a5a7d379aa8f681371e9918b3adeda6
2020-11-22xfs: validate cached inodes are free when allocatedDave Chinner
commit afca6c5b2595fc44383919fba740c194b0b76aff upstream A recent fuzzed filesystem image cached random dcache corruption when the reproducer was run. This often showed up as panics in lookup_slow() on a null inode->i_ops pointer when doing pathwalks. BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 .... Call Trace: lookup_slow+0x44/0x60 walk_component+0x3dd/0x9f0 link_path_walk+0x4a7/0x830 path_lookupat+0xc1/0x470 filename_lookup+0x129/0x270 user_path_at_empty+0x36/0x40 path_listxattr+0x98/0x110 SyS_listxattr+0x13/0x20 do_syscall_64+0xf5/0x280 entry_SYSCALL_64_after_hwframe+0x42/0xb7 but had many different failure modes including deadlocks trying to lock the inode that was just allocated or KASAN reports of use-after-free violations. The cause of the problem was a corrupt INOBT on a v4 fs where the root inode was marked as free in the inobt record. Hence when we allocated an inode, it chose the root inode to allocate, found it in the cache and re-initialised it. We recently fixed a similar inode allocation issue caused by inobt record corruption problem in xfs_iget_cache_miss() in commit ee457001ed6c ("xfs: catch inode allocation state mismatch corruption"). This change adds similar checks to the cache-hit path to catch it, and turns the reproducer into a corruption shutdown situation. Reported-by: Wen Xu <wen.xu@gatech.edu> Signed-Off-By: Dave Chinner <dchinner@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> [darrick: fix typos in comment] Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> [sudip: use ip->i_d.di_mode instead of VFS_I(ip)->i_mode] Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-22xfs: catch inode allocation state mismatch corruptionDave Chinner
commit ee457001ed6c6f31ddad69c24c1da8f377d8472d upstream We recently came across a V4 filesystem causing memory corruption due to a newly allocated inode being setup twice and being added to the superblock inode list twice. From code inspection, the only way this could happen is if a newly allocated inode was not marked as free on disk (i.e. di_mode wasn't zero). Running the metadump on an upstream debug kernel fails during inode allocation like so: XFS: Assertion failed: ip->i_d.di_nblocks == 0, file: fs/xfs/xfs_inod= e.c, line: 838 ------------[ cut here ]------------ kernel BUG at fs/xfs/xfs_message.c:114! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 11 PID: 3496 Comm: mkdir Not tainted 4.16.0-rc5-dgc #442 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/0= 1/2014 RIP: 0010:assfail+0x28/0x30 RSP: 0018:ffffc9000236fc80 EFLAGS: 00010202 RAX: 00000000ffffffea RBX: 0000000000004000 RCX: 0000000000000000 RDX: 00000000ffffffc0 RSI: 000000000000000a RDI: ffffffff8227211b RBP: ffffc9000236fce8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000bec R11: f000000000000000 R12: ffffc9000236fd30 R13: ffff8805c76bab80 R14: ffff8805c77ac800 R15: ffff88083fb12e10 FS: 00007fac8cbff040(0000) GS:ffff88083fd00000(0000) knlGS:0000000000000= 000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fffa6783ff8 CR3: 00000005c6e2b003 CR4: 00000000000606e0 Call Trace: xfs_ialloc+0x383/0x570 xfs_dir_ialloc+0x6a/0x2a0 xfs_create+0x412/0x670 xfs_generic_create+0x1f7/0x2c0 ? capable_wrt_inode_uidgid+0x3f/0x50 vfs_mkdir+0xfb/0x1b0 SyS_mkdir+0xcf/0xf0 do_syscall_64+0x73/0x1a0 entry_SYSCALL_64_after_hwframe+0x42/0xb7 Extracting the inode number we crashed on from an event trace and looking at it with xfs_db: xfs_db> inode 184452204 xfs_db> p core.magic = 0x494e core.mode = 0100644 core.version = 2 core.format = 2 (extents) core.nlinkv2 = 1 core.onlink = 0 ..... Confirms that it is not a free inode on disk. xfs_repair also trips over this inode: ..... zero length extent (off = 0, fsbno = 0) in ino 184452204 correcting nextents for inode 184452204 bad attribute fork in inode 184452204, would clear attr fork bad nblocks 1 for inode 184452204, would reset to 0 bad anextents 1 for inode 184452204, would reset to 0 imap claims in-use inode 184452204 is free, would correct imap would have cleared inode 184452204 ..... disconnected inode 184452204, would move to lost+found And so we have a situation where the directory structure and the inobt thinks the inode is free, but the inode on disk thinks it is still in use. Where this corruption came from is not possible to diagnose, but we can detect it and prevent the kernel from oopsing on lookup. The reproducer now results in: $ sudo mkdir /mnt/scratch/{0,1,2,3,4,5}{0,1,2,3,4,5} mkdir: cannot create directory =E2=80=98/mnt/scratch/00=E2=80=99: File ex= ists mkdir: cannot create directory =E2=80=98/mnt/scratch/01=E2=80=99: File ex= ists mkdir: cannot create directory =E2=80=98/mnt/scratch/03=E2=80=99: Structu= re needs cleaning mkdir: cannot create directory =E2=80=98/mnt/scratch/04=E2=80=99: Input/o= utput error mkdir: cannot create directory =E2=80=98/mnt/scratch/05=E2=80=99: Input/o= utput error .... And this corruption shutdown: [ 54.843517] XFS (loop0): Corruption detected! Free inode 0xafe846c not= marked free on disk [ 54.845885] XFS (loop0): Internal error xfs_trans_cancel at line 1023 = of file fs/xfs/xfs_trans.c. Caller xfs_create+0x425/0x670 [ 54.848994] CPU: 10 PID: 3541 Comm: mkdir Not tainted 4.16.0-rc5-dgc #= 443 [ 54.850753] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIO= S 1.10.2-1 04/01/2014 [ 54.852859] Call Trace: [ 54.853531] dump_stack+0x85/0xc5 [ 54.854385] xfs_trans_cancel+0x197/0x1c0 [ 54.855421] xfs_create+0x425/0x670 [ 54.856314] xfs_generic_create+0x1f7/0x2c0 [ 54.857390] ? capable_wrt_inode_uidgid+0x3f/0x50 [ 54.858586] vfs_mkdir+0xfb/0x1b0 [ 54.859458] SyS_mkdir+0xcf/0xf0 [ 54.860254] do_syscall_64+0x73/0x1a0 [ 54.861193] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 54.862492] RIP: 0033:0x7fb73bddf547 [ 54.863358] RSP: 002b:00007ffdaa553338 EFLAGS: 00000246 ORIG_RAX: 0000= 000000000053 [ 54.865133] RAX: ffffffffffffffda RBX: 00007ffdaa55449a RCX: 00007fb73= bddf547 [ 54.866766] RDX: 0000000000000001 RSI: 00000000000001ff RDI: 00007ffda= a55449a [ 54.868432] RBP: 00007ffdaa55449a R08: 00000000000001ff R09: 00005623a= 8670dd0 [ 54.870110] R10: 00007fb73be72d5b R11: 0000000000000246 R12: 000000000= 00001ff [ 54.871752] R13: 00007ffdaa5534b0 R14: 0000000000000000 R15: 00007ffda= a553500 [ 54.873429] XFS (loop0): xfs_do_force_shutdown(0x8) called from line 1= 024 of file fs/xfs/xfs_trans.c. Return address = ffffffff814cd050 [ 54.882790] XFS (loop0): Corruption of in-memory data detected. Shutt= ing down filesystem [ 54.884597] XFS (loop0): Please umount the filesystem and rectify the = problem(s) Note that this crash is only possible on v4 filesystemsi or v5 filesystems mounted with the ikeep mount option. For all other V5 filesystems, this problem cannot occur because we don't read inodes we are allocating from disk - we simply overwrite them with the new inode information. Signed-Off-By: Dave Chinner <dchinner@redhat.com> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Tested-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> [sudip: use ip->i_d.di_mode instead of VFS_I(ip)->i_mode] Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-18xfs: fix a missing unlock on error in xfs_fs_map_blocksChristoph Hellwig
[ Upstream commit 2bd3fa793aaa7e98b74e3653fdcc72fa753913b5 ] We also need to drop the iolock when invalidate_inode_pages2 fails, not only on all other error or successful cases. Fixes: 527851124d10 ("xfs: implement pNFS export operations") Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-11-15Merge branch 'android-4.4-p' of ↵Michael Bestas
https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.2.r1-07400-sdm660.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 34b1d1174c2c7 UPSTREAM: arm64: kaslr: Fix up the kernel image alignment Conflicts: scripts/setlocalversion Change-Id: Id2981587a6e92eb10cfdc9b6d13cd4bd2abb5670
2020-11-10xfs: fix realtime bitmap/summary file truncation when growing rt volumeDarrick J. Wong
[ Upstream commit f4c32e87de7d66074d5612567c5eac7325024428 ] The realtime bitmap and summary files are regular files that are hidden away from the directory tree. Since they're regular files, inode inactivation will try to purge what it thinks are speculative preallocations beyond the incore size of the file. Unfortunately, xfs_growfs_rt forgets to update the incore size when it resizes the inodes, with the result that inactivating the rt inodes at unmount time will cause their contents to be truncated. Fix this by updating the incore size when we change the ondisk size as part of updating the superblock. Note that we don't do this when we're allocating blocks to the rt inodes because we actually want those blocks to get purged if the growfs fails. This fixes corruption complaints from the online rtsummary checker when running xfs/233. Since that test requires rmap, one can also trigger this by growing an rt volume, cycling the mount, and creating rt files. Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Chandan Babu R <chandanrlinux@gmail.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-29xfs: make sure the rt allocator doesn't run off the endDarrick J. Wong
[ Upstream commit 2a6ca4baed620303d414934aa1b7b0a8e7bab05f ] There's an overflow bug in the realtime allocator. If the rt volume is large enough to handle a single allocation request that is larger than the maximum bmap extent length and the rt bitmap ends exactly on a bitmap block boundary, it's possible that the near allocator will try to check the freeness of a range that extends past the end of the bitmap. This fails with a corruption error and shuts down the fs. Therefore, constrain maxlen so that the range scan cannot run off the end of the rt bitmap. Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-23Merge branch 'android-4.4-p' of ↵Michael Bestas
https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-06000-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 7a9986e91f909 UPSTREAM: binder: fix UAF when releasing todo list Conflicts: fs/eventpoll.c Change-Id: I77260d03cb539d7e7eefcea360aee2d59bb9e0cb
2020-10-01xfs: fix attr leaf header freemap.size underflowBrian Foster
[ Upstream commit 2a2b5932db67586bacc560cc065d62faece5b996 ] The leaf format xattr addition helper xfs_attr3_leaf_add_work() adjusts the block freemap in a couple places. The first update drops the size of the freemap that the caller had already selected to place the xattr name/value data. Before the function returns, it also checks whether the entries array has encroached on a freemap range by virtue of the new entry addition. This is necessary because the entries array grows from the start of the block (but end of the block header) towards the end of the block while the name/value data grows from the end of the block in the opposite direction. If the associated freemap is already empty, however, size is zero and the subtraction underflows the field and causes corruption. This is reproduced rarely by generic/070. The observed behavior is that a smaller sized freemap is aligned to the end of the entries list, several subsequent xattr additions land in larger freemaps and the entries list expands into the smaller freemap until it is fully consumed and then underflows. Note that it is not otherwise a corruption for the entries array to consume an empty freemap because the nameval list (i.e. the firstused pointer in the xattr header) starts beyond the end of the corrupted freemap. Update the freemap size modification to account for the fact that the freemap entry can be empty and thus stale. Signed-off-by: Brian Foster <bfoster@redhat.com> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-09-23xfs: initialize the shortform attr header padding entryDarrick J. Wong
[ Upstream commit 125eac243806e021f33a1fdea3687eccbb9f7636 ] Don't leak kernel memory contents into the shortform attr fork. Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Eric Sandeen <sandeen@redhat.com> Reviewed-by: Dave Chinner <dchinner@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-09-19Merge branch 'android-4.4-p' of ↵Michael Bestas
https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-05900-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 5fd2d19eeb976 Merge 4.4.236 into android-4.4-p Conflicts: drivers/scsi/ufs/ufshcd.c Change-Id: I22282a0d571bdb72f50d3fc1e2cee4443de1f7f4
2020-08-26xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_initEiichi Tsukata
[ Upstream commit 96cf2a2c75567ff56195fe3126d497a2e7e4379f ] If xfs_sysfs_init is called with parent_kobj == NULL, UBSAN shows the following warning: UBSAN: null-ptr-deref in ./fs/xfs/xfs_sysfs.h:37:23 member access within null pointer of type 'struct xfs_kobj' Call Trace: dump_stack+0x10e/0x195 ubsan_type_mismatch_common+0x241/0x280 __ubsan_handle_type_mismatch_v1+0x32/0x40 init_xfs_fs+0x12b/0x28f do_one_initcall+0xdd/0x1d0 do_initcall_level+0x151/0x1b6 do_initcalls+0x50/0x8f do_basic_setup+0x29/0x2b kernel_init_freeable+0x19f/0x20b kernel_init+0x11/0x1e0 ret_from_fork+0x22/0x30 Fix it by checking parent_kobj before the code accesses its member. Signed-off-by: Eiichi Tsukata <devel@etsukata.com> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> [darrick: minor whitespace edits] Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-08-26xfs: fix inode quota reservation checksDarrick J. Wong
[ Upstream commit f959b5d037e71a4d69b5bf71faffa065d9269b4a ] xfs_trans_dqresv is the function that we use to make reservations against resource quotas. Each resource contains two counters: the q_core counter, which tracks resources allocated on disk; and the dquot reservation counter, which tracks how much of that resource has either been allocated or reserved by threads that are working on metadata updates. For disk blocks, we compare the proposed reservation counter against the hard and soft limits to decide if we're going to fail the operation. However, for inodes we inexplicably compare against the q_core counter, not the incore reservation count. Since the q_core counter is always lower than the reservation count and we unlock the dquot between reservation and transaction commit, this means that multiple threads can reserve the last inode count before we hit the hard limit, and when they commit, we'll be well over the hard limit. Fix this by checking against the incore inode reservation counter, since we would appear to maintain that correctly (and that's what we report in GETQUOTA). Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Allison Collins <allison.henderson@oracle.com> Reviewed-by: Chandan Babu R <chandanrlinux@gmail.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-08-23Merge branch 'android-4.4-p' of ↵Michael Bestas
https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-05900-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 59f04f292e871 ANDROID: fix a bug in quota2 Conflicts: Makefile fs/ext4/inode.c fs/f2fs/dir.c Change-Id: Ic71b44a02908cf633d96114f0ff745cf1e1186de
2020-08-21xfs: don't call xfs_da_shrink_inode with NULL bpEric Sandeen
[ Upstream commit bb3d48dcf86a97dc25fe9fc2c11938e19cb4399a ] xfs_attr3_leaf_create may have errored out before instantiating a buffer, for example if the blkno is out of range. In that case there is no work to do to remove it, and in fact xfs_da_shrink_inode will lead to an oops if we try. This also seems to fix a flaw where the original error from xfs_attr3_leaf_create gets overwritten in the cleanup case, and it removes a pointless assignment to bp which isn't used after this. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199969 Reported-by: Xu, Wen <wen.xu@gatech.edu> Tested-by: Xu, Wen <wen.xu@gatech.edu> Signed-off-by: Eric Sandeen <sandeen@redhat.com> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-07-31xfs: set format back to extents if xfs_bmap_extents_to_btreeEric Sandeen
commit 2c4306f719b083d17df2963bc761777576b8ad1b upstream. If xfs_bmap_extents_to_btree fails in a mode where we call xfs_iroot_realloc(-1) to de-allocate the root, set the format back to extents. Otherwise we can assume we can dereference ifp->if_broot based on the XFS_DINODE_FMT_BTREE format, and crash. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199423 Signed-off-by: Eric Sandeen <sandeen@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> [iwamatsu: backported to 4.4.y] Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-08Merge branch 'android-4.4-p' of ↵Michael Bestas
https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-05200-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 4db1ebdd40ec0 FROMLIST: HID: nintendo: add nintendo switch controller driver Conflicts: arch/arm64/boot/Makefile arch/arm64/kernel/psci.c arch/x86/configs/x86_64_cuttlefish_defconfig drivers/md/dm.c drivers/of/Kconfig drivers/thermal/thermal_core.c fs/proc/meminfo.c kernel/locking/spinlock_debug.c kernel/time/hrtimer.c net/wireless/util.c Change-Id: I5b5163497b7c6ab8487ffbb2d036e4cda01ed670
2020-01-29xfs: Sanity check flags of Q_XQUOTARM callJan Kara
commit 3dd4d40b420846dd35869ccc8f8627feef2cff32 upstream. Flags passed to Q_XQUOTARM were not sanity checked for invalid values. Fix that. Fixes: 9da93f9b7cdf ("xfs: fix Q_XQUOTARM ioctl") Reported-by: Yang Xu <xuyang2018.jy@cn.fujitsu.com> Signed-off-by: Jan Kara <jack@suse.cz> Reviewed-by: Eric Sandeen <sandeen@redhat.com> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-12xfs: fix mount failure crash on invalid iclog memory accessBrian Foster
[ Upstream commit 798a9cada4694ca8d970259f216cec47e675bfd5 ] syzbot (via KASAN) reports a use-after-free in the error path of xlog_alloc_log(). Specifically, the iclog freeing loop doesn't handle the case of a fully initialized ->l_iclog linked list. Instead, it assumes that the list is partially constructed and NULL terminated. This bug manifested because there was no possible error scenario after iclog list setup when the original code was added. Subsequent code and associated error conditions were added some time later, while the original error handling code was never updated. Fix up the error loop to terminate either on a NULL iclog or reaching the end of the list. Reported-by: syzbot+c732f8644185de340492@syzkaller.appspotmail.com Signed-off-by: Brian Foster <bfoster@redhat.com> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-12-05xfs: Align compat attrlist_by_handle with native implementation.Nick Bowler
[ Upstream commit c456d64449efe37da50832b63d91652a85ea1d20 ] While inspecting the ioctl implementations, I noticed that the compat implementation of XFS_IOC_ATTRLIST_BY_HANDLE does not do exactly the same thing as the native implementation. Specifically, the "cursor" does not appear to be written out to userspace on the compat path, like it is on the native path. This adjusts the compat implementation to copy out the cursor just like the native implementation does. The attrlist cursor does not require any special compat handling. This fixes xfstests xfs/269 on both IA-32 and x32 userspace, when running on an amd64 kernel. Signed-off-by: Nick Bowler <nbowler@draconx.ca> Fixes: 0facef7fb053b ("xfs: in _attrlist_by_handle, copy the cursor back to userspace") Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-12-05xfs: require both realtime inodes to mountDarrick J. Wong
[ Upstream commit 64bafd2f1e484e27071e7584642005d56516cb77 ] Since mkfs always formats the filesystem with the realtime bitmap and summary inodes immediately after the root directory, we should expect that both of them are present and loadable, even if there isn't a realtime volume attached. There's no reason to skip this if rbmino == NULLFSINO; in fact, this causes an immediate crash if the there /is/ a realtime volume and someone writes to it. Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Bill O'Donnell <billodo@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-11-11Merge android-4.4-p.199 (3f5703c) into msm-4.4Srinivasarao P
* refs/heads/tmp-3f5703c Linux 4.4.199 Revert "ALSA: hda: Flush interrupts on disabling" xfs: Correctly invert xfs_buftarg LRU isolation logic sctp: not bind the socket in sctp_connect sctp: fix the issue that flags are ignored when using kernel_connect sch_netem: fix rcu splat in netem_enqueue() net: usb: sr9800: fix uninitialized local variable bonding: fix potential NULL deref in bond_update_slave_arr llc: fix sk_buff leak in llc_conn_service() llc: fix sk_buff leak in llc_sap_state_process() rtlwifi: Fix potential overflow on P2P code s390/cmm: fix information leak in cmm_timeout_handler() nl80211: fix validation of mesh path nexthop HID: fix error message in hid_open_report() HID: Fix assumption that devices have inputs USB: serial: whiteheat: fix line-speed endianness USB: serial: whiteheat: fix potential slab corruption USB: ldusb: fix control-message timeout USB: ldusb: fix ring-buffer locking USB: gadget: Reject endpoints with 0 maxpacket value UAS: Revert commit 3ae62a42090f ("UAS: fix alignment of scatter/gather segments") ALSA: bebob: Fix prototype of helper function to return negative value fuse: truncate pending writes on O_TRUNC fuse: flush dirty data/metadata before non-truncate setattr ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe() thunderbolt: Use 32-bit writes when writing ring producer/consumer USB: legousbtower: fix a signedness bug in tower_probe() tracing: Initialize iter->seq after zeroing in tracing_read_pipe() NFSv4: Fix leak of clp->cl_acceptor string MIPS: fw: sni: Fix out of bounds init of o32 stack fs: ocfs2: fix a possible null-pointer dereference in ocfs2_info_scan_inode_alloc() fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry() efi/x86: Do not clean dummy variable in kexec path efi/cper: Fix endianness of PCIe class code serial: mctrl_gpio: Check for NULL pointer fs: cifs: mute -Wunused-const-variable message RDMA/iwcm: Fix a lock inversion issue perf map: Fix overlapped map handling iio: fix center temperature of bmc150-accel-core exec: load_script: Do not exec truncated interpreter path usb: handle warm-reset port requests on hub resume scripts/setlocalversion: Improve -dirty check with git-status --no-optional-locks x86/cpu: Add Atom Tremont (Jacobsville) sc16is7xx: Fix for "Unexpected interrupt: 8" dm: Use kzalloc for all structs with embedded biosets/mempools dm snapshot: rework COW throttling to fix deadlock dm snapshot: introduce account_start_copy() and account_end_copy() dm snapshot: use mutex instead of rw_semaphore ANDROID: cpufreq: times: add /proc/uid_concurrent_{active,policy}_time Conflicts: drivers/cpufreq/cpufreq_times.c Change-Id: I2c27599db8577afa4853222b11d9aec20071e752 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2019-11-06xfs: Correctly invert xfs_buftarg LRU isolation logicVratislav Bendel
commit 19957a181608d25c8f4136652d0ea00b3738972d upstream. Due to an inverted logic mistake in xfs_buftarg_isolate() the xfs_buffers with zero b_lru_ref will take another trip around LRU, while isolating buffers with non-zero b_lru_ref. Additionally those isolated buffers end up right back on the LRU once they are released, because b_lru_ref remains elevated. Fix that circuitous route by leaving them on the LRU as originally intended. Signed-off-by: Vratislav Bendel <vbendel@redhat.com> Reviewed-by: Brian Foster <bfoster@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Alex Lyakas <alex@zadara.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-30Merge android-4.4-p.197 (93ec8fb) into msm-4.4Srinivasarao P
* refs/heads/tmp-93ec8fb Linux 4.4.197 xfs: clear sb->s_fs_info on mount failure x86/asm: Fix MWAITX C-state hint value tracing: Get trace_array reference for available_tracers files media: stkwebcam: fix runtime PM after driver unbind CIFS: Force revalidate inode when dentry is stale cifs: Check uniqueid for SMB2+ and return -ESTALE if necessary Staging: fbtft: fix memory leak in fbtft_framebuffer_alloc arm64: Rename cpuid_feature field extract routines arm64: capabilities: Handle sign of the feature bit kernel/sysctl.c: do not override max_threads provided by userspace CIFS: Force reval dentry if LOOKUP_REVAL flag is set CIFS: Gracefully handle QueryInfo errors during open perf llvm: Don't access out-of-scope array iio: light: opt3001: fix mutex unlock race iio: adc: ad799x: fix probe error handling staging: vt6655: Fix memory leak in vt6655_probe USB: legousbtower: fix use-after-free on release USB: legousbtower: fix open after failed reset request USB: legousbtower: fix potential NULL-deref on disconnect USB: legousbtower: fix deadlock on disconnect USB: legousbtower: fix slab info leak at probe usb: renesas_usbhs: gadget: Fix usb_ep_set_{halt,wedge}() behavior usb: renesas_usbhs: gadget: Do not discard queues in usb_ep_set_{halt,wedge}() USB: dummy-hcd: fix power budget for SuperSpeed mode USB: microtek: fix info-leak at probe USB: usblcd: fix I/O after disconnect USB: serial: fix runtime PM after driver unbind USB: serial: option: add support for Cinterion CLS8 devices USB: serial: option: add Telit FN980 compositions USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20 USB: serial: keyspan: fix NULL-derefs on open() and write() serial: uartlite: fix exit path null pointer USB: ldusb: fix NULL-derefs on driver unbind USB: chaoskey: fix use-after-free on release USB: usblp: fix runtime PM after driver unbind USB: iowarrior: fix use-after-free after driver unbind USB: iowarrior: fix use-after-free on release USB: iowarrior: fix use-after-free on disconnect USB: adutux: fix use-after-free on release USB: adutux: fix NULL-derefs on disconnect USB: adutux: fix use-after-free on disconnect USB: adutux: remove redundant variable minor xhci: Increase STS_SAVE timeout in xhci_suspend() usb: xhci: wait for CNR controller not ready bit in xhci resume xhci: Check all endpoints for LPM timeout xhci: Prevent device initiated U1/U2 link pm if exit latency is too long USB: usb-skeleton: fix NULL-deref on disconnect USB: usb-skeleton: fix runtime PM after driver unbind USB: yurex: fix NULL-derefs on disconnect USB: yurex: Don't retry on unexpected errors USB: rio500: Remove Rio 500 kernel driver panic: ensure preemption is disabled during panic() ASoC: sgtl5000: Improve VAG power and mute control nl80211: validate beacon head cfg80211: Use const more consistently in for_each_element macros cfg80211: add and use strongly typed element iteration macros crypto: caam - fix concurrency issue in givencrypt descriptor perf stat: Fix a segmentation fault when using repeat forever tools lib traceevent: Do not free tep->cmdlines in add_new_comm() on failure kernel/elfcore.c: include proper prototypes fuse: fix memleak in cuse_channel_open thermal: Fix use-after-free when unregistering thermal zone device drm/amdgpu: Check for valid number of registers to read ceph: fix directories inode i_blkbits initialization xen/pci: reserve MCFG areas earlier 9p: avoid attaching writeback_fid on mmap with type PRIVATE fs: nfs: Fix possible null-pointer dereferences in encode_attrs() ima: always return negative code for error cfg80211: initialize on-stack chandefs ieee802154: atusb: fix use-after-free at disconnect crypto: qat - Silence smp_processor_id() warning can: mcp251x: mcp251x_hw_reset(): allow more time after a reset powerpc/powernv: Restrict OPAL symbol map to only be readable by root ASoC: Define a set of DAPM pre/post-up events KVM: nVMX: handle page fault in vmread fix s390/cio: exclude subchannels with no parent from pseudo check s390/cio: avoid calling strlen on null pointer s390/topology: avoid firing events before kobjs are created KVM: s390: Test for bad access register and size at the start of S390_MEM_OP Change-Id: I948ef653eafcff32197e1886e13548b32be2d0ad Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2019-10-17xfs: clear sb->s_fs_info on mount failureDave Chinner
commit c9fbd7bbc23dbdd73364be4d045e5d3612cf6e82 upstream. We recently had an oops reported on a 4.14 kernel in xfs_reclaim_inodes_count() where sb->s_fs_info pointed to garbage and so the m_perag_tree lookup walked into lala land. Essentially, the machine was under memory pressure when the mount was being run, xfs_fs_fill_super() failed after allocating the xfs_mount and attaching it to sb->s_fs_info. It then cleaned up and freed the xfs_mount, but the sb->s_fs_info field still pointed to the freed memory. Hence when the superblock shrinker then ran it fell off the bad pointer. With the superblock shrinker problem fixed at teh VFS level, this stale s_fs_info pointer is still a problem - we use it unconditionally in ->put_super when the superblock is being torn down, and hence we can still trip over it after a ->fill_super call failure. Hence we need to clear s_fs_info if xfs-fs_fill_super() fails, and we need to check if it's valid in the places it can potentially be dereferenced after a ->fill_super failure. Signed-Off-By: Dave Chinner <dchinner@redhat.com> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Ajay Kaher <akaher@vmware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-29Merge android-4.4.172 (b3e9e81) into msm-4.4Srinivasarao P
* refs/heads/tmp-b3e9e81 Linux 4.4.172 ipmi:ssif: Fix handling of multi-part return messages net: speed up skb_rbtree_purge() mm, proc: be more verbose about unstable VMA flags in /proc/<pid>/smaps mm/page-writeback.c: don't break integrity writeback on ->writepage() error ocfs2: fix panic due to unrecovered local alloc scsi: megaraid: fix out-of-bound array accesses sysfs: Disable lockdep for driver bind/unbind files ALSA: bebob: fix model-id of unit for Apogee Ensemble dm snapshot: Fix excessive memory usage and workqueue stalls dm kcopyd: Fix bug causing workqueue stalls perf parse-events: Fix unchecked usage of strncpy() perf svghelper: Fix unchecked usage of strncpy() perf intel-pt: Fix error with config term "pt=0" mmc: atmel-mci: do not assume idle after atmci_request_end kconfig: fix memory leak when EOF is encountered in quotation kconfig: fix file name and line number of warn_ignored_character() clk: imx6q: reset exclusive gates on init scsi: target: use consistent left-aligned ASCII INQUIRY data net: call sk_dst_reset when set SO_DONTROUTE media: firewire: Fix app_info parameter type in avc_ca{,_app}_info powerpc/pseries/cpuidle: Fix preempt warning pstore/ram: Do not treat empty buffers as valid jffs2: Fix use of uninitialized delayed_work, lockdep breakage arm64: perf: set suppress_bind_attrs flag to true MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur writeback: don't decrement wb->refcnt if !wb->bdi e1000e: allow non-monotonic SYSTIM readings platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey xfs: don't fail when converting shortform attr to long form during ATTR_REPLACE ipv6: Take rcu_read_lock in __inet6_bind for mapped addresses ipv6: Consider sk_bound_dev_if when binding a socket to a v4 mapped address r8169: Add support for new Realtek Ethernet media: vb2: be sure to unlock mutex on errors drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl() loop: Get rid of loop_index_mutex loop: Fold __loop_release into loop_release block/loop: Use global lock for ioctl() operation. tipc: fix uninit-value in tipc_nl_compat_doit tipc: fix uninit-value in tipc_nl_compat_name_table_dump tipc: fix uninit-value in tipc_nl_compat_link_set tipc: fix uninit-value in tipc_nl_compat_bearer_enable tipc: fix uninit-value in tipc_nl_compat_link_reset_stats sctp: allocate sctp_sockaddr_entry with kzalloc selinux: fix GPF on invalid policy sunrpc: handle ENOMEM in rpcb_getport_async media: vb2: vb2_mmap: move lock up LSM: Check for NULL cred-security on free media: vivid: set min width/height to a value > 0 media: vivid: fix error handling of kthread_run omap2fb: Fix stack memory disclosure Disable MSI also when pcie-octeon.pcie_disable on mfd: tps6586x: Handle interrupts on suspend mips: fix n32 compat_ipc_parse_version scsi: sd: Fix cache_type_store() Yama: Check for pid death before checking ancestry btrfs: wait on ordered extents on abort cleanup crypto: authenc - fix parsing key with misaligned rta_len crypto: authencesn - Avoid twice completion call in decrypt path ip: on queued skb use skb_header_pointer instead of pskb_may_pull packet: Do not leak dev refcounts on error exit net: bridge: fix a bug on using a neighbour cache entry without checking its state ipv6: fix kernel-infoleak in ipv6_local_error() arm64: Don't trap host pointer auth use to EL2 arm64/kvm: consistently handle host HCR_EL2 flags proc: Remove empty line in /proc/self/status media: em28xx: Fix misplaced reset of dev->v4l::field_count f2fs: fix validation of the block count in sanity_check_raw_super f2fs: fix missing up_read f2fs: fix invalid memory access f2fs: fix to do sanity check with cp_pack_start_sum f2fs: fix to do sanity check with block address in main area v2 f2fs: fix to do sanity check with block address in main area f2fs: fix to do sanity check with reserved blkaddr of inline inode f2fs: fix to do sanity check with node footer and iblocks f2fs: Add sanity_check_inode() function f2fs: fix to do sanity check with user_block_count f2fs: fix to do sanity check with secs_per_zone f2fs: introduce and spread verify_blkaddr f2fs: clean up with is_valid_blkaddr() f2fs: enhance sanity_check_raw_super() to avoid potential overflow f2fs: sanity check on sit entry f2fs: check blkaddr more accuratly before issue a bio f2fs: return error during fill_super f2fs: fix race condition in between free nid allocator/initializer f2fs: free meta pages if sanity check for ckpt is failed f2fs: detect wrong layout f2fs: fix to determine start_cp_addr by sbi->cur_cp_pack f2fs: put directory inodes before checkpoint in roll-forward recovery f2fs: introduce get_checkpoint_version for cleanup f2fs: use crc and cp version to determine roll-forward recovery f2fs: avoid unneeded loop in build_sit_entries f2fs: not allow to write illegal blkaddr f2fs: fix to avoid reading out encrypted data in page cache f2fs: fix inode cache leak f2fs: factor out fsync inode entry operations f2fs: remove an obsolete variable f2fs: give -EINVAL for norecovery and rw mount f2fs: fix to convert inline directory correctly f2fs: move sanity checking of cp into get_valid_checkpoint f2fs: cover more area with nat_tree_lock f2fs: clean up argument of recover_data can: gw: ensure DLC boundaries after CAN frame modification tty/ldsem: Wake up readers after timed out down_write() UPSTREAM: dm: do not allow readahead to limit IO size UPSTREAM: readahead: stricter check for bdi io_pages UPSTREAM: mm: don't cap request size based on read-ahead setting ANDROID: Fix cuttlefish redundant vsock connection. UPSTREAM: loop: drop caches if offset or block_size are changed Conflicts: arch/arm64/kvm/hyp.S Fixed compilation issue due to variable 'backing_dev_info', which got changed to pointer in downstream. Change-Id: I8baa569fe9fc13ed5a7e863e5ad1fb8cf1cd469e Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2019-01-26xfs: don't fail when converting shortform attr to long form during ATTR_REPLACEDarrick J. Wong
commit 7b38460dc8e4eafba06c78f8e37099d3b34d473c upstream. Kanda Motohiro reported that expanding a tiny xattr into a large xattr fails on XFS because we remove the tiny xattr from a shortform fork and then try to re-add it after converting the fork to extents format having not removed the ATTR_REPLACE flag. This fails because the attr is no longer present, causing a fs shutdown. This is derived from the patch in his bug report, but we really shouldn't ignore a nonzero retval from the remove call. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199119 Reported-by: kanda.motohiro@gmail.com Reviewed-by: Dave Chinner <dchinner@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Cc: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-27Merge android-4.4.137 (a2e2217) into msm-4.4Srinivasarao P
* refs/heads/tmp-a2e2217 Linux 4.4.137 net: metrics: add proper netlink validation net: phy: broadcom: Fix bcm_write_exp() rtnetlink: validate attributes in do_setlink() team: use netdev_features_t instead of u32 net/mlx4: Fix irq-unsafe spinlock usage qed: Fix mask for physical address in ILT entry packet: fix reserve calculation net: usb: cdc_mbim: add flag FLAG_SEND_ZLP net/packet: refine check for priv area size netdev-FAQ: clarify DaveM's position for stable backports isdn: eicon: fix a missing-check bug ipv4: remove warning in ip_recv_error ip6mr: only set ip6mr_table from setsockopt when ip6mr_new_table succeeds enic: set DMA mask to 47 bit dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect() bnx2x: use the right constant brcmfmac: Fix check for ISO3166 code drm: set FMODE_UNSIGNED_OFFSET for drm files xfs: fix incorrect log_flushed on fsync kconfig: Avoid format overflow warning from GCC 8.1 mmap: relax file size limit for regular files mmap: introduce sane default mmap limits tpm: self test failure should not cause suspend to fail tpm: do not suspend/resume if power stays on ANDROID: Update arm64 ranchu64_defconfig Linux 4.4.136 sparc64: Fix build warnings with gcc 7. mm: fix the NULL mapping case in __isolate_lru_page() fix io_destroy()/aio_complete() race Kbuild: change CC_OPTIMIZE_FOR_SIZE definition drm/i915: Disable LVDS on Radiant P845 hwtracing: stm: fix build error on some arches stm class: Use vmalloc for the master map scsi: scsi_transport_srp: Fix shost to rport translation MIPS: prctl: Disallow FRE without FR with PR_SET_FP_MODE requests MIPS: ptrace: Fix PTRACE_PEEKUSR requests for 64-bit FGRs iio:kfifo_buf: check for uint overflow dmaengine: usb-dmac: fix endless loop in usb_dmac_chan_terminate_all() i2c: rcar: revoke START request early i2c: rcar: check master irqs before slave irqs i2c: rcar: don't issue stop when HW does it automatically i2c: rcar: init new messages in irq i2c: rcar: refactor setup of a msg i2c: rcar: remove spinlock i2c: rcar: remove unused IOERROR state i2c: rcar: rework hw init i2c: rcar: make sure clocks are on when doing clock calculation tcp: avoid integer overflows in tcp_rcv_space_adjust() irda: fix overly long udelay() ASoC: Intel: sst: remove redundant variable dma_dev_name rtlwifi: rtl8192cu: Remove variable self-assignment in rf.c cfg80211: further limit wiphy names to 64 bytes selinux: KASAN: slab-out-of-bounds in xattr_getsecurity tracing: Fix crash when freeing instances with event triggers Input: elan_i2c_smbus - fix corrupted stack Revert "ima: limit file hash setting by user to fix and log modes" xfs: detect agfl count corruption and reset agfl sh: New gcc support USB: serial: cp210x: use tcflag_t to fix incompatible pointer type powerpc/64s: Clear PCR on boot arm64: lse: Add early clobbers to some input/output asm operands FROMLIST: f2fs: run fstrim asynchronously if runtime discard is on goldfish: pipe: ANDROID: address must be written as __pa(x), not x goldfish: pipe: ANDROID: add missing check for memory allocated goldfish: pipe: ANDROID: remove redundant blank lines Update arch/x86/configs/x86_64_ranchu_defconfig ANDROID: x86_64_cuttlefish_defconfig: Enable F2FS ANDROID: Update x86_64_cuttlefish_defconfig FROMLIST: f2fs: early updates queued for v4.18-rc1 Change-Id: I314254168cd5ad06a7c6bca2fa68c8a6ae6c257d Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2018-06-27Merge android-4.4.135 (c9d74f2) into msm-4.4Srinivasarao P
* refs/heads/tmp-c9d74f2 Linux 4.4.135 Revert "vti4: Don't override MTU passed on link creation via IFLA_MTU" Revert "vti4: Don't override MTU passed on link creation via IFLA_MTU" Linux 4.4.134 s390/ftrace: use expoline for indirect branches kdb: make "mdr" command repeat Bluetooth: btusb: Add device ID for RTL8822BE ASoC: samsung: i2s: Ensure the RCLK rate is properly determined regulator: of: Add a missing 'of_node_put()' in an error handling path of 'of_regulator_match()' scsi: lpfc: Fix frequency of Release WQE CQEs scsi: lpfc: Fix soft lockup in lpfc worker thread during LIP testing scsi: lpfc: Fix issue_lip if link is disabled netlabel: If PF_INET6, check sk_buff ip header version selftests/net: fixes psock_fanout eBPF test case perf report: Fix memory corruption in --branch-history mode --branch-history perf tests: Use arch__compare_symbol_names to compare symbols x86/apic: Set up through-local-APIC mode on the boot CPU if 'noapic' specified drm/rockchip: Respect page offset for PRIME mmap calls MIPS: Octeon: Fix logging messages with spurious periods after newlines audit: return on memory error to avoid null pointer dereference crypto: sunxi-ss - Add MODULE_ALIAS to sun4i-ss clk: samsung: exynos3250: Fix PLL rates clk: samsung: exynos5250: Fix PLL rates clk: samsung: exynos5433: Fix PLL rates clk: samsung: exynos5260: Fix PLL rates clk: samsung: s3c2410: Fix PLL rates media: cx25821: prevent out-of-bounds read on array card udf: Provide saner default for invalid uid / gid PCI: Add function 1 DMA alias quirk for Marvell 88SE9220 serial: arc_uart: Fix out-of-bounds access through DT alias serial: fsl_lpuart: Fix out-of-bounds access through DT alias serial: imx: Fix out-of-bounds access through serial port index serial: mxs-auart: Fix out-of-bounds access through serial port index serial: samsung: Fix out-of-bounds access through serial port index serial: xuartps: Fix out-of-bounds access through DT alias rtc: tx4939: avoid unintended sign extension on a 24 bit shift staging: rtl8192u: return -ENOMEM on failed allocation of priv->oldaddr hwrng: stm32 - add reset during probe enic: enable rq before updating rq descriptors clk: rockchip: Prevent calculating mmc phase if clock rate is zero media: em28xx: USB bulk packet size fix dmaengine: pl330: fix a race condition in case of threaded irqs media: s3c-camif: fix out-of-bounds array access media: cx23885: Set subdev host data to clk_freq pointer media: cx23885: Override 888 ImpactVCBe crystal frequency ALSA: vmaster: Propagate slave error x86/devicetree: Fix device IRQ settings in DT x86/devicetree: Initialize device tree before using it usb: gadget: composite: fix incorrect handling of OS desc requests usb: gadget: udc: change comparison to bitshift when dealing with a mask gfs2: Fix fallocate chunk size cdrom: do not call check_disk_change() inside cdrom_open() hwmon: (pmbus/adm1275) Accept negative page register values hwmon: (pmbus/max8688) Accept negative page register values perf/core: Fix perf_output_read_group() ASoC: topology: create TLV data for dapm widgets powerpc: Add missing prototype for arch_irq_work_raise() usb: gadget: ffs: Execute copy_to_user() with USER_DS set usb: gadget: ffs: Let setup() return USB_GADGET_DELAYED_STATUS usb: dwc2: Fix interval type issue ipmi_ssif: Fix kernel panic at msg_done_handler PCI: Restore config space on runtime resume despite being unbound MIPS: ath79: Fix AR724X_PLL_REG_PCIE_CONFIG offset xhci: zero usb device slot_id member when disabling and freeing a xhci slot KVM: lapic: stop advertising DIRECTED_EOI when in-kernel IOAPIC is in use i2c: mv64xxx: Apply errata delay only in standard mode ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c ACPICA: Events: add a return on failure from acpi_hw_register_read bcache: quit dc->writeback_thread when BCACHE_DEV_DETACHING is set zorro: Set up z->dev.dma_mask for the DMA API clk: Don't show the incorrect clock phase cpufreq: cppc_cpufreq: Fix cppc_cpufreq_init() failure path usb: dwc3: Update DWC_usb31 GTXFIFOSIZ reg fields arm: dts: socfpga: fix GIC PPI warning virtio-net: Fix operstate for virtio when no VIRTIO_NET_F_STATUS ima: Fallback to the builtin hash algorithm ima: Fix Kconfig to select TPM 2.0 CRB interface ath10k: Fix kernel panic while using worker (ath10k_sta_rc_update_wk) net/mlx5: Protect from command bit overflow selftests: Print the test we're running to /dev/kmsg tools/thermal: tmon: fix for segfault powerpc/perf: Fix kernel address leak via sampling registers powerpc/perf: Prevent kernel address leak to userspace via BHRB buffer rtc: hctosys: Ensure system time doesn't overflow time_t hwmon: (nct6775) Fix writing pwmX_mode parisc/pci: Switch LBA PCI bus from Hard Fail to Soft Fail mode m68k: set dma and coherent masks for platform FEC ethernets powerpc/mpic: Check if cpu_possible() in mpic_physmask() ACPI: acpi_pad: Fix memory leak in power saving threads xen/acpi: off by one in read_acpi_id() btrfs: fix lockdep splat in btrfs_alloc_subvolume_writers Btrfs: fix copy_items() return value when logging an inode btrfs: tests/qgroup: Fix wrong tree backref level Bluetooth: btusb: Add USB ID 7392:a611 for Edimax EW-7611ULB net: bgmac: Fix endian access in bgmac_dma_tx_ring_free() rtc: snvs: Fix usage of snvs_rtc_enable sparc64: Make atomic_xchg() an inline function rather than a macro. fscache: Fix hanging wait on page discarded by writeback KVM: VMX: raise internal error for exception during invalid protected mode state sched/rt: Fix rq->clock_update_flags < RQCF_ACT_SKIP warning ocfs2/dlm: don't handle migrate lockres if already in shutdown btrfs: Fix possible softlock on single core machines Btrfs: fix NULL pointer dereference in log_dir_items Btrfs: bail out on error during replay_dir_deletes mm: fix races between address_space dereference and free in page_evicatable mm/ksm: fix interaction with THP dp83640: Ensure against premature access to PHY registers after reset scsi: aacraid: Insure command thread is not recursively stopped cpufreq: CPPC: Initialize shared perf capabilities of CPUs Force log to disk before reading the AGF during a fstrim sr: get/drop reference to device in revalidate and check_events swap: divide-by-zero when zero length swap file on ssd fs/proc/proc_sysctl.c: fix potential page fault while unregistering sysctl table x86/pgtable: Don't set huge PUD/PMD on non-leaf entries sh: fix debug trap failure to process signals before return to user net: mvneta: fix enable of all initialized RXQs net: Fix untag for vlan packets without ethernet header mm/kmemleak.c: wait for scan completion before disabling free llc: properly handle dev_queue_xmit() return value net-usb: add qmi_wwan if on lte modem wistron neweb d18q1 net/usb/qmi_wwan.c: Add USB id for lt4120 modem net: qmi_wwan: add BroadMobi BM806U 2020:2033 ARM: 8748/1: mm: Define vdso_start, vdso_end as array batman-adv: fix packet loss for broadcasted DHCP packets to a server batman-adv: fix multicast-via-unicast transmission with AP isolation selftests: ftrace: Add a testcase for probepoint selftests: ftrace: Add a testcase for string type with kprobe_event selftests: ftrace: Add probe event argument syntax testcase mm/mempolicy.c: avoid use uninitialized preferred_node RDMA/ucma: Correct option size check using optlen perf/cgroup: Fix child event counting bug vti4: Don't override MTU passed on link creation via IFLA_MTU vti4: Don't count header length twice on tunnel setup batman-adv: fix header size check in batadv_dbg_arp() net: Fix vlan untag for bridge and vlan_dev with reorder_hdr off sunvnet: does not support GSO for sctp ipv4: lock mtu in fnhe when received PMTU < net.ipv4.route.min_pmtu workqueue: use put_device() instead of kfree() bnxt_en: Check valid VNIC ID in bnxt_hwrm_vnic_set_tpa(). netfilter: ebtables: fix erroneous reject of last rule USB: OHCI: Fix NULL dereference in HCDs using HCD_LOCAL_MEM xen: xenbus: use put_device() instead of kfree() fbdev: Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in sbusfb_ioctl_helper(). scsi: sd: Keep disk read-only when re-reading partition scsi: mpt3sas: Do not mark fw_event workqueue as WQ_MEM_RECLAIM usb: musb: call pm_runtime_{get,put}_sync before reading vbus registers e1000e: allocate ring descriptors with dma_zalloc_coherent e1000e: Fix check_for_link return value with autoneg off watchdog: f71808e_wdt: Fix magic close handling KVM: PPC: Book3S HV: Fix VRMA initialization with 2MB or 1GB memory backing selftests/powerpc: Skip the subpage_prot tests if the syscall is unavailable Btrfs: send, fix issuing write op when processing hole in no data mode xen/pirq: fix error path cleanup when binding MSIs net/tcp/illinois: replace broken algorithm reference link gianfar: Fix Rx byte accounting for ndev stats sit: fix IFLA_MTU ignored on NEWLINK bcache: fix kcrashes with fio in RAID5 backend dev dmaengine: rcar-dmac: fix max_chunk_size for R-Car Gen3 virtio-gpu: fix ioctl and expose the fixed status to userspace. r8152: fix tx packets accounting clocksource/drivers/fsl_ftm_timer: Fix error return checking nvme-pci: Fix nvme queue cleanup if IRQ setup fails netfilter: ebtables: convert BUG_ONs to WARN_ONs batman-adv: invalidate checksum on fragment reassembly batman-adv: fix packet checksum in receive path md/raid1: fix NULL pointer dereference media: dmxdev: fix error code for invalid ioctls x86/topology: Update the 'cpu cores' field in /proc/cpuinfo correctly across CPU hotplug operations locking/xchg/alpha: Fix xchg() and cmpxchg() memory ordering bugs regulatory: add NUL to request alpha2 smsc75xx: fix smsc75xx_set_features() ARM: OMAP: Fix dmtimer init for omap1 s390/cio: clear timer when terminating driver I/O s390/cio: fix return code after missing interrupt powerpc/bpf/jit: Fix 32-bit JIT for seccomp_data access kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZE md: raid5: avoid string overflow warning locking/xchg/alpha: Add unconditional memory barrier to cmpxchg() usb: musb: fix enumeration after resume drm/exynos: fix comparison to bitshift when dealing with a mask md raid10: fix NULL deference in handle_write_completed() mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple of 4 NFC: llcp: Limit size of SDP URI ARM: OMAP1: clock: Fix debugfs_create_*() usage ARM: OMAP3: Fix prm wake interrupt for resume ARM: OMAP2+: timer: fix a kmemleak caused in omap_get_timer_dt scsi: qla4xxx: skip error recovery in case of register disconnect. scsi: aacraid: fix shutdown crash when init fails scsi: storvsc: Increase cmd_per_lun for higher speed devices selftests: memfd: add config fragment for fuse usb: dwc2: Fix dwc2_hsotg_core_init_disconnected() usb: gadget: fsl_udc_core: fix ep valid checks usb: gadget: f_uac2: fix bFirstInterface in composite gadget ARC: Fix malformed ARC_EMUL_UNALIGNED default scsi: qla2xxx: Avoid triggering undefined behavior in qla2x00_mbx_completion() scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo() scsi: sym53c8xx_2: iterator underflow in sym_getsync() scsi: bnx2fc: Fix check in SCSI completion handler for timed out request scsi: ufs: Enable quirk to ignore sending WRITE_SAME command irqchip/gic-v3: Change pr_debug message to pr_devel locking/qspinlock: Ensure node->count is updated before initialising node tools/libbpf: handle issues with bpf ELF objects containing .eh_frames bcache: return attach error when no cache set exist bcache: fix for data collapse after re-attaching an attached device bcache: fix for allocator and register thread race bcache: properly set task state in bch_writeback_thread() cifs: silence compiler warnings showing up with gcc-8.0.0 proc: fix /proc/*/map_files lookup arm64: spinlock: Fix theoretical trylock() A-B-A with LSE atomics RDS: IB: Fix null pointer issue xen/grant-table: Use put_page instead of free_page xen-netfront: Fix race between device setup and open MIPS: TXx9: use IS_BUILTIN() for CONFIG_LEDS_CLASS bpf: fix selftests/bpf test_kmod.sh failure when CONFIG_BPF_JIT_ALWAYS_ON=y ACPI: processor_perflib: Do not send _PPC change notification if not ready firmware: dmi_scan: Fix handling of empty DMI strings x86/power: Fix swsusp_arch_resume prototype IB/ipoib: Fix for potential no-carrier state mm: pin address_space before dereferencing it while isolating an LRU page asm-generic: provide generic_pmdp_establish() mm/mempolicy: add nodes_empty check in SYSC_migrate_pages mm/mempolicy: fix the check of nodemask from user ocfs2: return error when we attempt to access a dirty bh in jbd2 ocfs2/acl: use 'ip_xattr_sem' to protect getting extended attribute ocfs2: return -EROFS to mount.ocfs2 if inode block is invalid ntb_transport: Fix bug with max_mw_size parameter RDMA/mlx5: Avoid memory leak in case of XRCD dealloc failure powerpc/numa: Ensure nodes initialized for hotplug powerpc/numa: Use ibm,max-associativity-domains to discover possible nodes jffs2: Fix use-after-free bug in jffs2_iget()'s error handling path HID: roccat: prevent an out of bounds read in kovaplus_profile_activated() scsi: fas216: fix sense buffer initialization Btrfs: fix scrub to repair raid6 corruption btrfs: Fix out of bounds access in btrfs_search_slot Btrfs: set plug for fsync ipmi/powernv: Fix error return code in ipmi_powernv_probe() mac80211_hwsim: fix possible memory leak in hwsim_new_radio_nl() kconfig: Fix expr_free() E_NOT leak kconfig: Fix automatic menu creation mem leak kconfig: Don't leak main menus during parsing watchdog: sp5100_tco: Fix watchdog disable bit nfs: Do not convert nfs_idmap_cache_timeout to jiffies dm thin: fix documentation relative to low water mark threshold tools lib traceevent: Fix get_field_str() for dynamic strings perf callchain: Fix attr.sample_max_stack setting tools lib traceevent: Simplify pointer print logic and fix %pF PCI: Add function 1 DMA alias quirk for Marvell 9128 tracing/hrtimer: Fix tracing bugs by taking all clock bases and modes into account kvm: x86: fix KVM_XEN_HVM_CONFIG ioctl ASoC: au1x: Fix timeout tests in au1xac97c_ac97_read() ALSA: hda - Use IS_REACHABLE() for dependency on input NFSv4: always set NFS_LOCK_LOST when a lock is lost. firewire-ohci: work around oversized DMA reads on JMicron controllers do d_instantiate/unlock_new_inode combinations safely xfs: remove racy hasattr check from attr ops kernel/signal.c: avoid undefined behaviour in kill_something_info kernel/sys.c: fix potential Spectre v1 issue kasan: fix memory hotplug during boot ipc/shm: fix shmat() nil address after round-down when remapping Revert "ipc/shm: Fix shmat mmap nil-page protection" xen-swiotlb: fix the check condition for xen_swiotlb_free_coherent libata: blacklist Micron 500IT SSD with MU01 firmware libata: Blacklist some Sandisk SSDs for NCQ mmc: sdhci-iproc: fix 32bit writes for TRANSFER_MODE register ALSA: timer: Fix pause event notification aio: fix io_destroy(2) vs. lookup_ioctx() race affs_lookup(): close a race with affs_remove_link() KVM: Fix spelling mistake: "cop_unsuable" -> "cop_unusable" MIPS: Fix ptrace(2) PTRACE_PEEKUSR and PTRACE_POKEUSR accesses to o32 FGRs MIPS: ptrace: Expose FIR register through FP regset UPSTREAM: sched/fair: Consider RT/IRQ pressure in capacity_spare_wake Conflicts: drivers/media/dvb-core/dmxdev.c drivers/scsi/sd.c drivers/scsi/ufs/ufshcd.c drivers/usb/gadget/function/f_fs.c fs/ecryptfs/inode.c Change-Id: I15751ed8c82ec65ba7eedcb0d385b9f803c333f7 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2018-06-13xfs: fix incorrect log_flushed on fsyncAmir Goldstein
commit 47c7d0b19502583120c3f396c7559e7a77288a68 upstream. When calling into _xfs_log_force{,_lsn}() with a pointer to log_flushed variable, log_flushed will be set to 1 if: 1. xlog_sync() is called to flush the active log buffer AND/OR 2. xlog_wait() is called to wait on a syncing log buffers xfs_file_fsync() checks the value of log_flushed after _xfs_log_force_lsn() call to optimize away an explicit PREFLUSH request to the data block device after writing out all the file's pages to disk. This optimization is incorrect in the following sequence of events: Task A Task B ------------------------------------------------------- xfs_file_fsync() _xfs_log_force_lsn() xlog_sync() [submit PREFLUSH] xfs_file_fsync() file_write_and_wait_range() [submit WRITE X] [endio WRITE X] _xfs_log_force_lsn() xlog_wait() [endio PREFLUSH] The write X is not guarantied to be on persistent storage when PREFLUSH request in completed, because write A was submitted after the PREFLUSH request, but xfs_file_fsync() of task A will be notified of log_flushed=1 and will skip explicit flush. If the system crashes after fsync of task A, write X may not be present on disk after reboot. This bug was discovered and demonstrated using Josef Bacik's dm-log-writes target, which can be used to record block io operations and then replay a subset of these operations onto the target device. The test goes something like this: - Use fsx to execute ops of a file and record ops on log device - Every now and then fsync the file, store md5 of file and mark the location in the log - Then replay log onto device for each mark, mount fs and compare md5 of file to stored value Cc: Christoph Hellwig <hch@lst.de> Cc: Josef Bacik <jbacik@fb.com> Cc: <stable@vger.kernel.org> Signed-off-by: Amir Goldstein <amir73il@gmail.com> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-06xfs: detect agfl count corruption and reset agflBrian Foster
commit a27ba2607e60312554cbcd43fc660b2c7f29dc9c upstream. The struct xfs_agfl v5 header was originally introduced with unexpected padding that caused the AGFL to operate with one less slot than intended. The header has since been packed, but the fix left an incompatibility for users who upgrade from an old kernel with the unpacked header to a newer kernel with the packed header while the AGFL happens to wrap around the end. The newer kernel recognizes one extra slot at the physical end of the AGFL that the previous kernel did not. The new kernel will eventually attempt to allocate a block from that slot, which contains invalid data, and cause a crash. This condition can be detected by comparing the active range of the AGFL to the count. While this detects a padding mismatch, it can also trigger false positives for unrelated flcount corruption. Since we cannot distinguish a size mismatch due to padding from unrelated corruption, we can't trust the AGFL enough to simply repopulate the empty slot. Instead, avoid unnecessarily complex detection logic and and use a solution that can handle any form of flcount corruption that slips through read verifiers: distrust the entire AGFL and reset it to an empty state. Any valid blocks within the AGFL are intentionally leaked. This requires xfs_repair to rectify (which was already necessary based on the state the AGFL was found in). The reset mitigates the side effect of the padding mismatch problem from a filesystem crash to a free space accounting inconsistency. The generic approach also means that this patch can be safely backported to kernels with or without a packed struct xfs_agfl. Check the AGF for an invalid freelist count on initial read from disk. If detected, set a flag on the xfs_perag to indicate that a reset is required before the AGFL can be used. In the first transaction that attempts to use a flagged AGFL, reset it to empty, warn the user about the inconsistency and allow the freelist fixup code to repopulate the AGFL with new blocks. The xfs_perag flag is cleared to eliminate the need for repeated checks on each block allocation operation. This allows kernels that include the packing fix commit 96f859d52bcb ("libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct") to handle older unpacked AGFL formats without a filesystem crash. Suggested-by: Dave Chinner <david@fromorbit.com> Signed-off-by: Brian Foster <bfoster@redhat.com> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by Dave Chiluk <chiluk+linuxxfs@indeed.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Dave Chiluk <chiluk+linuxxfs@indeed.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-30Force log to disk before reading the AGF during a fstrimCarlos Maiolino
[ Upstream commit 8c81dd46ef3c416b3b95e3020fb90dbd44e6140b ] Forcing the log to disk after reading the agf is wrong, we might be calling xfs_log_force with XFS_LOG_SYNC with a metadata lock held. This can cause a deadlock when racing a fstrim with a filesystem shutdown. The deadlock has been identified due a miscalculation bug in device-mapper dm-thin, which returns lack of space to its users earlier than the device itself really runs out of space, changing the device-mapper volume into an error state. The problem happened while filling the filesystem with a single file, triggering the bug in device-mapper, consequently causing an IO error and shutting down the filesystem. If such file is removed, and fstrim executed before the XFS finishes the shut down process, the fstrim process will end up holding the buffer lock, and going to sleep on the cil wait queue. At this point, the shut down process will try to wake up all the threads waiting on the cil wait queue, but for this, it will try to hold the same buffer log already held my the fstrim, locking up the filesystem. Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-30xfs: remove racy hasattr check from attr opsBrian Foster
commit 5a93790d4e2df73e30c965ec6e49be82fc3ccfce upstream. xfs_attr_[get|remove]() have unlocked attribute fork checks to optimize away a lock cycle in cases where the fork does not exist or is otherwise empty. This check is not safe, however, because an attribute fork short form to extent format conversion includes a transient state that causes the xfs_inode_hasattr() check to fail. Specifically, xfs_attr_shortform_to_leaf() creates an empty extent format attribute fork and then adds the existing shortform attributes to it. This means that lookup of an existing xattr can spuriously return -ENOATTR when racing against a setxattr that causes the associated format conversion. This was originally reproduced by an untar on a particularly configured glusterfs volume, but can also be reproduced on demand with properly crafted xattr requests. The format conversion occurs under the exclusive ilock. xfs_attr_get() and xfs_attr_remove() already have the proper locking and checks further down in the functions to handle this situation correctly. Drop the unlocked checks to avoid the spurious failure and rely on the existing logic. Signed-off-by: Brian Foster <bfoster@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Cc: Daniel Sangorrin <daniel.sangorrin@toshiba.co.jp> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-22Merge android-4.4.132 (46155cc) into msm-4.4Srinivasarao P
* refs/heads/tmp-46155cc Linux 4.4.132 perf/x86: Fix possible Spectre-v1 indexing for x86_pmu::event_map() perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[] perf/x86/msr: Fix possible Spectre-v1 indexing in the MSR driver perf/x86/cstate: Fix possible Spectre-v1 indexing for pkg_msr perf/x86: Fix possible Spectre-v1 indexing for hw_perf_event cache_* tracing/uprobe_event: Fix strncpy corner case Revert "Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174" atm: zatm: Fix potential Spectre v1 net: atm: Fix potential Spectre v1 can: kvaser_usb: Increase correct stats counter in kvaser_usb_rx_can_msg() tracing: Fix regex_match_front() to not over compare the test string libata: Apply NOLPM quirk for SanDisk SD7UB3Q*G1001 SSDs rfkill: gpio: fix memory leak in probe error path xfrm_user: fix return value from xfrm_user_rcv_msg f2fs: fix a dead loop in f2fs_fiemap() bdi: Fix oops in wb_workfn() tcp: fix TCP_REPAIR_QUEUE bound checking perf: Remove superfluous allocation error check soreuseport: initialise timewait reuseport field dccp: initialize ireq->ir_mark net: fix uninit-value in __hw_addr_add_ex() net: initialize skb->peeked when cloning net: fix rtnh_ok() netlink: fix uninit-value in netlink_sendmsg crypto: af_alg - fix possible uninit-value in alg_bind() ipvs: fix rtnl_lock lockups caused by start_sync_thread usb: musb: host: fix potential NULL pointer dereference USB: serial: option: adding support for ublox R410M USB: serial: option: reimplement interface masking USB: Accept bulk endpoints with 1024-byte maxpacket USB: serial: visor: handle potential invalid device configuration test_firmware: fix setting old custom fw path back on exit, second try drm/vmwgfx: Fix a buffer object leak IB/mlx5: Use unlimited rate when static rate is not supported NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2 RDMA/mlx5: Protect from shift operand overflow RDMA/ucma: Allow resolving address w/o specifying source address xfs: prevent creating negative-sized file via INSERT_RANGE Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro Input: leds - fix out of bound access tracepoint: Do not warn on ENOMEM ALSA: aloop: Add missing cable lock to ctl API callbacks ALSA: aloop: Mark paused device as inactive ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger() ALSA: pcm: Check PCM state at xfern compat ioctl USB: serial: option: Add support for Quectel EP06 gpmi-nand: Handle ECC Errors in erased pages ath10k: rebuild crypto header in rx data frames ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode mac80211: Add RX flag to indicate ICV stripped mac80211: allow same PN for AMSDU sub-frames mac80211: allow not sending MIC up from driver for HW crypto percpu: include linux/sched.h for cond_resched() KVM: s390: Enable all facility bits that are known good for passthrough bpf: map_get_next_key to return first key on NULL perf/core: Fix the perf_cpu_time_max_percent check goldfish: pipe: ANDROID: mark local functions static Revert "goldfish: pipe: ANDROID: Allocate memory with GFP_KERNEL." UPSTREAM: ANDROID: binder: prevent transactions into own process. goldfish: pipe: ANDROID: Add DMA support UPSTREAM: f2fs: clear PageError on writepage - part 2 UPSTREAM: f2fs: avoid fsync() failure caused by EAGAIN in writepage() ANDROID: build.config: enforce trace_printk check ANDROID: x86_64_cuttlefish_defconfig: Disable KPTI UPSTREAM: mac80211: ibss: Fix channel type enum in ieee80211_sta_join_ibss() UPSTREAM: mac80211: Fix clang warning about constant operand in logical operation UPSTREAM: nl80211: Fix enum type of variable in nl80211_put_sta_rate() UPSTREAM: sysfs: remove signedness from sysfs_get_dirent UPSTREAM: tracing: Use cpumask_available() to check if cpumask variable may be used BACKPORT: clocksource: Use GENMASK_ULL in definition of CLOCKSOURCE_MASK UPSTREAM: netpoll: Fix device name check in netpoll_setup() FROMLIST: staging: Fix sparse warnings in vsoc driver. FROMLIST: staging: vsoc: Fix a i386-randconfig warning. FROMLIST: staging: vsoc: Create wc kernel mapping for region shm. Revert "goldfish: pipe: ANDROID: remove a redundant target" goldfish: pipe: ANDROID: Replace writel with gf_write_ptr goldfish: pipe: ANDROID: Use dev_ logging instead of pr_ goldfish: pipe: ANDROID: fix checkpatch warnings goldfish: pipe: ANDROID: Update module license Conflicts: drivers/net/wireless/ath/ath10k/core.c drivers/net/wireless/ath/ath10k/core.h drivers/net/wireless/ath/ath10k/htt_rx.c Change-Id: If2ede1dea6a07b3fd498724e83071fd547170e1c [spathi@codeaurora.org: resolved compilation errors in ath10k by rebuilding crypto header in rx data frames] Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2018-05-16xfs: prevent creating negative-sized file via INSERT_RANGEDarrick J. Wong
commit 7d83fb14258b9961920cd86f0b921caaeb3ebe85 upstream. During the "insert range" fallocate operation, i_size grows by the specified 'len' bytes. XFS verifies that i_size + len < s_maxbytes, as it should. But this comparison is done using the signed 'loff_t', and 'i_size + len' can wrap around to a negative value, causing the check to incorrectly pass, resulting in an inode with "negative" i_size. This is possible on 64-bit platforms, where XFS sets s_maxbytes = LLONG_MAX. ext4 and f2fs don't run into this because they set a smaller s_maxbytes. Fix it by using subtraction instead. Reproducer: xfs_io -f file -c "truncate $(((1<<63)-1))" -c "finsert 0 4096" Fixes: a904b1ca5751 ("xfs: Add support FALLOC_FL_INSERT_RANGE for fallocate") Cc: <stable@vger.kernel.org> # v4.1+ Originally-From: Eric Biggers <ebiggers@google.com> Signed-off-by: Eric Biggers <ebiggers@google.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> [darrick: fix signed integer addition overflow too] Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-08Merge android-4.4.120 (d63fdf6) into msm-4.4Srinivasarao P
* refs/heads/tmp-d63fdf6 Linux 4.4.120 MIPS: Implement __multi3 for GCC7 MIPS64r6 builds net: gianfar_ptp: move set_fipers() to spinlock protecting area sctp: make use of pre-calculated len xen/gntdev: Fix partial gntdev_mmap() cleanup xen/gntdev: Fix off-by-one error when unmapping with holes SolutionEngine771x: fix Ether platform data mdio-sun4i: Fix a memory leak xen-netfront: enable device after manual module load bnxt_en: Fix the 'Invalid VF' id check in bnxt_vf_ndo_prep routine. can: flex_can: Correct the checking for frame length in flexcan_start_xmit() mac80211: mesh: drop frames appearing to be from us drm/ttm: check the return value of kzalloc e1000: fix disabling already-disabled warning xfs: quota: check result of register_shrinker() xfs: quota: fix missed destroy of qi_tree_lock IB/ipoib: Fix race condition in neigh creation IB/mlx4: Fix mlx4_ib_alloc_mr error flow s390/dasd: fix wrongly assigned configuration data led: core: Fix brightness setting when setting delay_off=0 bnx2x: Improve reliability in case of nested PCI errors tg3: Enable PHY reset in MTU change path for 5720 tg3: Add workaround to restrict 5762 MRRS to 2048 lib/mpi: Fix umul_ppmm() for MIPS64r6 ARM: dts: ls1021a: fix incorrect clock references scsi: storvsc: Fix scsi_cmd error assignments in storvsc_handle_error net: arc_emac: fix arc_emac_rx() error paths spi: atmel: fixed spin_lock usage inside atmel_spi_remove drm/nouveau/pci: do a msi rearm on init sget(): handle failures of register_shrinker() ARM: 8731/1: Fix csum_partial_copy_from_user() stack mismatch ipv6: icmp6: Allow icmp messages to be looped back mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM f2fs: fix a bug caused by NULL extent tree hrtimer: Ensure POSIX compliance (relative CLOCK_REALTIME hrtimers) ANDROID: keychord: Check for write data size Revert "binder: add missing binder_unlock()" Linux 4.4.119 binder: add missing binder_unlock() drm/amdgpu: Avoid leaking PM domain on driver unbind (v2) usb: renesas_usbhs: missed the "running" flag in usb_dmac with rx path usb: gadget: f_fs: Process all descriptors during bind usb: ldusb: add PIDs for new CASSY devices supported by this driver usb: dwc3: gadget: Set maxpacket size for ep0 IN drm/edid: Add 6 bpc quirk for CPT panel in Asus UX303LA Add delay-init quirk for Corsair K70 RGB keyboards arm64: Disable unhandled signal log messages by default usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks() irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq() x86/oprofile: Fix bogus GCC-8 warning in nmi_setup() iio: adis_lib: Initialize trigger before requesting interrupt iio: buffer: check if a buffer has been set up when poll is called cfg80211: fix cfg80211_beacon_dup scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info ip_tunnel: fix preempt warning in ip tunnel creation/updating ip_tunnel: replace dst_cache with generic implementation PCI: keystone: Fix interrupt-controller-node lookup powerpc/64s: Fix RFI flush dependency on HARDLOCKUP_DETECTOR netfilter: drop outermost socket lock in getsockopt() ANDROID: sdcardfs: Set num in extension_details during make_item Conflicts: drivers/usb/gadget/function/f_fs.c Change-Id: I594b9686fd64d4b62ebef4452d4f1ccca4f5a77b Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2018-03-03xfs: quota: check result of register_shrinker()Aliaksei Karaliou
[ Upstream commit 3a3882ff26fbdbaf5f7e13f6a0bccfbf7121041d ] xfs_qm_init_quotainfo() does not check result of register_shrinker() which was tagged as __must_check recently, reported by sparse. Signed-off-by: Aliaksei Karaliou <akaraliou.dev@gmail.com> [darrick: move xfs_qm_destroy_quotainos nearer xfs_qm_init_quotainos] Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-03xfs: quota: fix missed destroy of qi_tree_lockAliaksei Karaliou
[ Upstream commit 2196881566225f3c3428d1a5f847a992944daa5b ] xfs_qm_destroy_quotainfo() does not destroy quotainfo->qi_tree_lock while destroys quotainfo->qi_quotaofflock. Signed-off-by: Aliaksei Karaliou <akaraliou.dev@gmail.com> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-05Merge android-4.4.115 (aa856bd) into msm-4.4Srinivasarao P
* refs/heads/tmp-aa856bd Linux 4.4.115 spi: imx: do not access registers while clocks disabled serial: imx: Only wakeup via RTSDEN bit if the system has RTS/CTS selinux: general protection fault in sock_has_perm usb: uas: unconditionally bring back host after reset usb: f_fs: Prevent gadget unbind if it is already unbound USB: serial: simple: add Motorola Tetra driver usbip: list: don't list devices attached to vhci_hcd usbip: prevent bind loops on devices attached to vhci_hcd USB: serial: io_edgeport: fix possible sleep-in-atomic CDC-ACM: apply quirk for card reader USB: cdc-acm: Do not log urb submission errors on disconnect USB: serial: pl2303: new device id for Chilitag usb: option: Add support for FS040U modem staging: rtl8188eu: Fix incorrect response to SIOCGIWESSID usb: gadget: don't dereference g until after it has been null checked media: usbtv: add a new usbid scsi: ufs: ufshcd: fix potential NULL pointer dereference in ufshcd_config_vreg scsi: aacraid: Prevent crash in case of free interrupt during scsi EH path xfs: ubsan fixes drm/omap: Fix error handling path in 'omap_dmm_probe()' kmemleak: add scheduling point to kmemleak_scan() SUNRPC: Allow connect to return EHOSTUNREACH quota: Check for register_shrinker() failure. net: ethernet: xilinx: Mark XILINX_LL_TEMAC broken on 64-bit hwmon: (pmbus) Use 64bit math for DIRECT format values lockd: fix "list_add double add" caused by legacy signal interface nfsd: check for use of the closed special stateid grace: replace BUG_ON by WARN_ONCE in exit_net hook nfsd: Ensure we check stateid validity in the seqid operation checks nfsd: CLOSE SHOULD return the invalid special stateid for NFSv4.x (x>0) xen-netfront: remove warning when unloading module KVM: VMX: Fix rflags cache during vCPU reset btrfs: fix deadlock when writing out space cache mac80211: fix the update of path metric for RANN frame openvswitch: fix the incorrect flow action alloc size drm/amdkfd: Fix SDMA oversubsription handling drm/amdkfd: Fix SDMA ring buffer size calculation drm/amdgpu: Fix SDMA load/unload sequence on HWS disabled mode bcache: check return value of register_shrinker cpufreq: Add Loongson machine dependencies ACPI / bus: Leave modalias empty for devices which are not present KVM: x86: ioapic: Preserve read-only values in the redirection table KVM: x86: ioapic: Clear Remote IRR when entry is switched to edge-triggered KVM: x86: ioapic: Fix level-triggered EOI and IOAPIC reconfigure race KVM: X86: Fix operand/address-size during instruction decoding KVM: x86: Don't re-execute instruction when not passing CR2 value KVM: x86: emulator: Return to user-mode on L1 CPL=0 emulation failure igb: Free IRQs when device is hotplugged mtd: nand: denali_pci: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE gpio: ath79: add missing MODULE_DESCRIPTION/LICENSE gpio: iop: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE power: reset: zx-reboot: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE crypto: af_alg - whitelist mask and type crypto: aesni - handle zero length dst buffer ALSA: seq: Make ioctls race-free kaiser: fix intel_bts perf crashes x86/pti: Make unpoison of pgd for trusted boot work for real bpf: reject stores into ctx via st and xadd bpf: fix 32-bit divide by zero bpf: fix divides by zero bpf: avoid false sharing of map refcount with max_entries bpf: arsh is not supported in 32 bit alu thus reject it bpf: introduce BPF_JIT_ALWAYS_ON config bpf: fix bpf_tail_call() x64 JIT x86: bpf_jit: small optimization in emit_bpf_tail_call() bpf: fix branch pruning logic loop: fix concurrent lo_open/lo_release ANDROID: sdcardfs: Protect set_top ANDROID: fsnotify: Notify lower fs of open Revert "ANDROID: sdcardfs: notify lower file of opens" ANDROID: sdcardfs: Use lower getattr times/size ANDROID: sched/rt: schedtune: Add boost retention to RT Conflicts: arch/x86/Kconfig kernel/sched/rt.c Change-Id: I91b08e1b8e0a1c6ca9c245597acad0bf197f9527 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2018-02-03xfs: ubsan fixesDarrick J. Wong
[ Upstream commit 22a6c83777ac7c17d6c63891beeeac24cf5da450 ] Fix some complaints from the UBSAN about signed integer addition overflows. Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Brian Foster <bfoster@redhat.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-01-18Merge android-4.4.107 (79f138a) into msm-4.4Srinivasarao P
* refs/heads/tmp-79f138a Linux 4.4.107 ath9k: fix tx99 potential info leak IB/ipoib: Grab rtnl lock on heavy flush when calling ndo_open/stop RDMA/cma: Avoid triggering undefined behavior macvlan: Only deliver one copy of the frame to the macvlan interface udf: Avoid overflow when session starts at large offset scsi: bfa: integer overflow in debugfs scsi: sd: change allow_restart to bool in sysfs interface scsi: sd: change manage_start_stop to bool in sysfs interface vt6655: Fix a possible sleep-in-atomic bug in vt6655_suspend scsi: scsi_devinfo: Add REPORTLUN2 to EMC SYMMETRIX blacklist entry raid5: Set R5_Expanded on parity devices as well as data. pinctrl: adi2: Fix Kconfig build problem usb: musb: da8xx: fix babble condition handling tty fix oops when rmmod 8250 powerpc/perf/hv-24x7: Fix incorrect comparison in memord scsi: hpsa: destroy sas transport properties before scsi_host scsi: hpsa: cleanup sas_phy structures in sysfs when unloading PCI: Detach driver before procfs & sysfs teardown on device remove xfs: fix incorrect extent state in xfs_bmap_add_extent_unwritten_real xfs: fix log block underflow during recovery cycle verification l2tp: cleanup l2tp_tunnel_delete calls bcache: fix wrong cache_misses statistics bcache: explicitly destroy mutex while exiting GFS2: Take inode off order_write list when setting jdata flag thermal/drivers/step_wise: Fix temperature regulation misbehavior ppp: Destroy the mutex when cleanup clk: tegra: Fix cclk_lp divisor register clk: imx6: refine hdmi_isfr's parent to make HDMI work on i.MX6 SoCs w/o VPU clk: mediatek: add the option for determining PLL source clock mm: Handle 0 flags in _calc_vm_trans() macro crypto: tcrypt - fix buffer lengths in test_aead_speed() arm-ccn: perf: Prevent module unload while PMU is in use target/file: Do not return error for UNMAP if length is zero target:fix condition return in core_pr_dump_initiator_port() iscsi-target: fix memory leak in lio_target_tiqn_addtpg() target/iscsi: Fix a race condition in iscsit_add_reject_from_cmd() powerpc/ipic: Fix status get and status clear powerpc/opal: Fix EBUSY bug in acquiring tokens netfilter: ipvs: Fix inappropriate output of procfs powerpc/powernv/cpufreq: Fix the frequency read by /proc/cpuinfo PCI/PME: Handle invalid data when reading Root Status dmaengine: ti-dma-crossbar: Correct am335x/am43xx mux value type rtc: pcf8563: fix output clock rate video: fbdev: au1200fb: Return an error code if a memory allocation fails video: fbdev: au1200fb: Release some resources if a memory allocation fails video: udlfb: Fix read EDID timeout fbdev: controlfb: Add missing modes to fix out of bounds access sfc: don't warn on successful change of MAC target: fix race during implicit transition work flushes target: fix ALUA transition timeout handling target: Use system workqueue for ALUA transitions btrfs: add missing memset while reading compressed inline extents NFSv4.1 respect server's max size in CREATE_SESSION efi/esrt: Cleanup bad memory map log messages perf symbols: Fix symbols__fixup_end heuristic for corner cases net/mlx4_core: Avoid delays during VF driver device shutdown afs: Fix afs_kill_pages() afs: Fix page leak in afs_write_begin() afs: Populate and use client modification time afs: Fix the maths in afs_fs_store_data() afs: Prevent callback expiry timer overflow afs: Migrate vlocation fields to 64-bit afs: Flush outstanding writes when an fd is closed afs: Adjust mode bits processing afs: Populate group ID from vnode status afs: Fix missing put_page() drm/radeon: reinstate oland workaround for sclk mmc: mediatek: Fixed bug where clock frequency could be set wrong sched/deadline: Use deadline instead of period when calculating overflow sched/deadline: Throttle a constrained deadline task activated after the deadline sched/deadline: Make sure the replenishment timer fires in the next period drm/radeon/si: add dpm quirk for Oland fjes: Fix wrong netdevice feature flags scsi: hpsa: limit outstanding rescans scsi: hpsa: update check for logical volume status openrisc: fix issue handling 8 byte get_user calls intel_th: pci: Add Gemini Lake support mlxsw: reg: Fix SPVMLR max record count mlxsw: reg: Fix SPVM max record count net: Resend IGMP memberships upon peer notification. dmaengine: Fix array index out of bounds warning in __get_unmap_pool() net: wimax/i2400m: fix NULL-deref at probe writeback: fix memory leak in wb_queue_work() netfilter: bridge: honor frag_max_size when refragmenting drm/omap: fix dmabuf mmap for dma_alloc'ed buffers Input: i8042 - add TUXEDO BU1406 (N24_25BU) to the nomux list NFSD: fix nfsd_reset_versions for NFSv4. NFSD: fix nfsd_minorversion(.., NFSD_AVAIL) net: bcmgenet: Power up the internal PHY before probing the MII net: bcmgenet: power down internal phy if open or resume fails net: bcmgenet: reserved phy revisions must be checked first net: bcmgenet: correct MIB access of UniMAC RUNT counters net: bcmgenet: correct the RBUF_OVFL_CNT and RBUF_ERR_CNT MIB values net: initialize msg.msg_flags in recvfrom userfaultfd: selftest: vm: allow to build in vm/ directory userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE md-cluster: free md_cluster_info if node leave cluster usb: phy: isp1301: Add OF device ID table mac80211: Fix addition of mesh configuration element KEYS: add missing permission check for request_key() destination ext4: fix crash when a directory's i_size is too small ext4: fix fdatasync(2) after fallocate(2) operation dmaengine: dmatest: move callback wait queue to thread context sched/rt: Do not pull from current CPU if only one CPU to pull xhci: Don't add a virt_dev to the devs array before it's fully allocated Bluetooth: btusb: driver to enable the usb-wakeup feature ceph: drop negative child dentries before try pruning inode's alias usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer USB: core: prevent malicious bNumInterfaces overflow USB: uas and storage: Add US_FL_BROKEN_FUA for another JMicron JMS567 ID tracing: Allocate mask_str buffer dynamically autofs: fix careless error in recent commit crypto: salsa20 - fix blkcipher_walk API usage crypto: hmac - require that the underlying hash algorithm is unkeyed UPSTREAM: arm64: setup: introduce kaslr_offset() UPSTREAM: kcov: fix comparison callback signature UPSTREAM: kcov: support comparison operands collection UPSTREAM: kcov: remove pointless current != NULL check UPSTREAM: kcov: support compat processes UPSTREAM: kcov: simplify interrupt check UPSTREAM: kcov: make kcov work properly with KASLR enabled UPSTREAM: kcov: add more missing includes UPSTREAM: kcov: add missing #include <linux/sched.h> UPSTREAM: kcov: properly check if we are in an interrupt UPSTREAM: kcov: don't profile branches in kcov UPSTREAM: kcov: don't trace the code coverage code BACKPORT: kernel: add kcov code coverage Conflicts: Makefile mm/kasan/Makefile scripts/Makefile.lib Change-Id: Ic19953706ea2e700621b0ba94d1c90bbffa4f471 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2017-12-20xfs: fix incorrect extent state in xfs_bmap_add_extent_unwritten_realChristoph Hellwig
[ Upstream commit 5e422f5e4fd71d18bc6b851eeb3864477b3d842e ] There was one spot in xfs_bmap_add_extent_unwritten_real that didn't use the passed in new extent state but always converted to normal, leading to wrong behavior when converting from normal to unwritten. Only found by code inspection, it seems like this code path to move partial extent from written to unwritten while merging it with the next extent is rarely exercised. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Brian Foster <bfoster@redhat.com> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-12-20xfs: fix log block underflow during recovery cycle verificationBrian Foster
[ Upstream commit 9f2a4505800607e537e9dd9dea4f55c4b0c30c7a ] It is possible for mkfs to format very small filesystems with too small of an internal log with respect to the various minimum size and block count requirements. If this occurs when the log happens to be smaller than the scan window used for cycle verification and the scan wraps the end of the log, the start_blk calculation in xlog_find_head() underflows and leads to an attempt to scan an invalid range of log blocks. This results in log recovery failure and a failed mount. Since there may be filesystems out in the wild with this kind of geometry, we cannot simply refuse to mount. Instead, cap the scan window for cycle verification to the size of the physical log. This ensures that the cycle verification proceeds as expected when the scan wraps the end of the log. Reported-by: Zorro Lang <zlang@redhat.com> Signed-off-by: Brian Foster <bfoster@redhat.com> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20Merge android-4.4@73a2b70 (v4.4.92) into msm-4.4Blagovest Kolenichev
* refs/heads/tmp-73a2b70 Linux 4.4.92 ext4: don't allow encrypted operations without keys ext4: Don't clear SGID when inheriting ACLs ext4: fix data corruption for mmap writes sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs nvme: protect against simultaneous shutdown invocations drm/i915/bios: ignore HDMI on port A brcmfmac: setup passive scan if requested by user-space uwb: ensure that endpoint is interrupt uwb: properly check kthread_run return value iio: adc: mcp320x: Fix oops on module unload iio: adc: mcp320x: Fix readout of negative voltages iio: ad7793: Fix the serial interface reset iio: core: Return error for failed read_reg staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack. iio: ad_sigma_delta: Implement a dedicated reset function iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of 'twl4030_madc_probe()' iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()' xhci: fix finding correct bus_state structure for USB 3.1 hosts USB: fix out-of-bounds in usb_set_configuration usb: Increase quirk delay for USB devices USB: core: harden cdc_parse_cdc_header USB: uas: fix bug in handling of alternate settings scsi: sd: Do not override max_sectors_kb sysfs setting iwlwifi: add workaround to disable wide channels in 5GHz HID: i2c-hid: allocate hid buffers for real worst case ftrace: Fix kmemleak in unregister_ftrace_graph stm class: Fix a use-after-free Drivers: hv: fcopy: restore correct transfer length driver core: platform: Don't read past the end of "driver_override" buffer ALSA: usx2y: Suppress kernel warning at page allocation failures ALSA: compress: Remove unused variable lsm: fix smack_inode_removexattr and xattr_getsecurity memleak USB: g_mass_storage: Fix deadlock when driver is unbound usb: gadget: mass_storage: set msg_registered after msg registered USB: devio: Don't corrupt user memory USB: dummy-hcd: Fix erroneous synchronization change USB: dummy-hcd: fix infinite-loop resubmission bug USB: dummy-hcd: fix connection failures (wrong speed) usb: pci-quirks.c: Corrected timeout values used in handshake ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives usb: gadget: udc: atmel: set vbus irqflags explicitly USB: gadgetfs: fix copy_to_user while holding spinlock USB: gadgetfs: Fix crash caused by inadequate synchronization usb: gadget: inode.c: fix unbalanced spin_lock in ep0_write ANDROID: binder: init desired_prio.sched_policy before use it BACKPORT: net: xfrm: support setting an output mark. UPSTREAM: xfrm: Only add l3mdev oif to dst lookups UPSTREAM: net: l3mdev: Add master device lookup by index Linux 4.4.91 ttpci: address stringop overflow warning ALSA: au88x0: avoid theoretical uninitialized access ARM: remove duplicate 'const' annotations' IB/qib: fix false-postive maybe-uninitialized warning drivers: firmware: psci: drop duplicate const from psci_of_match libata: transport: Remove circular dependency at free time xfs: remove kmem_zalloc_greedy i2c: meson: fix wrong variable usage in meson_i2c_put_data md/raid10: submit bio directly to replacement disk rds: ib: add error handle iommu/io-pgtable-arm: Check for leaf entry before dereferencing it parisc: perf: Fix potential NULL pointer dereference netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max exynos-gsc: Do not swap cb/cr for semi planar formats MIPS: IRQ Stack: Unwind IRQ stack onto task stack netfilter: invoke synchronize_rcu after set the _hook_ to NULL bridge: netlink: register netdevice before executing changelink mmc: sdio: fix alignment issue in struct sdio_func usb: plusb: Add support for PL-27A1 team: fix memory leaks net/packet: check length in getsockopt() called with PACKET_HDRLEN net: core: Prevent from dereferencing null pointer when releasing SKB MIPS: Lantiq: Fix another request_mem_region() return code check ASoC: dapm: fix some pointer error handling usb: chipidea: vbus event may exist before starting gadget audit: log 32-bit socketcalls ASoC: dapm: handle probe deferrals partitions/efi: Fix integer overflow in GPT size calculation USB: serial: mos7840: fix control-message error handling USB: serial: mos7720: fix control-message error handling drm/amdkfd: fix improper return value on error IB/ipoib: Replace list_del of the neigh->list with list_del_init IB/ipoib: rtnl_unlock can not come after free_netdev IB/ipoib: Fix deadlock over vlan_mutex tty: goldfish: Fix a parameter of a call to free_irq ARM: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM iio: adc: hx711: Add DT binding for avia,hx711 iio: adc: axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes sh_eth: use correct name for ECMR_MPDE bit extcon: axp288: Use vbus-valid instead of -present to determine cable presence igb: re-assign hw address pointer on reset after PCI error MIPS: ralink: Fix incorrect assignment on ralink_soc MIPS: Ensure bss section ends on a long-aligned address ARM: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes RDS: RDMA: Fix the composite message user notification GFS2: Fix reference to ERR_PTR in gfs2_glock_iter_next drm: bridge: add DT bindings for TI ths8135 drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define FROMLIST: tracing: Add support for preempt and irq enable/disable events FROMLIST: tracing: Prepare to add preempt and irq trace events ANDROID: binder: fix transaction leak. ANDROID: binder: Add tracing for binder priority inheritance. Linux 4.4.90 fix xen_swiotlb_dma_mmap prototype swiotlb-xen: implement xen_swiotlb_dma_mmap callback video: fbdev: aty: do not leak uninitialized padding in clk to userspace KVM: VMX: use cmpxchg64 ARM: pxa: fix the number of DMA requestor lines ARM: pxa: add the number of DMA requestor lines dmaengine: mmp-pdma: add number of requestors cxl: Fix driver use count KVM: VMX: remove WARN_ON_ONCE in kvm_vcpu_trigger_posted_interrupt KVM: VMX: do not change SN bit in vmx_update_pi_irte() timer/sysclt: Restrict timer migration sysctl values to 0 and 1 gfs2: Fix debugfs glocks dump x86/fpu: Don't let userspace set bogus xcomp_bv btrfs: prevent to set invalid default subvolid btrfs: propagate error to btrfs_cmp_data_prepare caller btrfs: fix NULL pointer dereference from free_reloc_roots() PCI: Fix race condition with driver_override kvm: nVMX: Don't allow L2 to access the hardware CR8 KVM: VMX: Do not BUG() on out-of-bounds guest IRQ arm64: fault: Route pte translation faults via do_translation_fault arm64: Make sure SPsel is always set seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter() bsg-lib: don't free job in bsg_prepare_job nl80211: check for the required netlink attributes presence vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets SMB3: Don't ignore O_SYNC/O_DSYNC and O_DIRECT flags SMB: Validate negotiate (to protect against downgrade) even if signing off Fix SMB3.1.1 guest authentication to Samba powerpc/pseries: Fix parent_dn reference leak in add_dt_node() KEYS: prevent KEYCTL_READ on negative key KEYS: prevent creating a different user's keyrings KEYS: fix writing past end of user-supplied buffer in keyring_read() crypto: talitos - fix sha224 crypto: talitos - Don't provide setkey for non hmac hashing algs. scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly md/raid5: preserve STRIPE_ON_UNPLUG_LIST in break_stripe_batch_list md/raid5: fix a race condition in stripe batch tracing: Erase irqsoff trace with empty write tracing: Fix trace_pipe behavior for instance traces KVM: PPC: Book3S: Fix race and leak in kvm_vm_ioctl_create_spapr_tce() mac80211: flush hw_roc_start work before cancelling the ROC cifs: release auth_key.response for reconnect. f2fs: catch up to v4.14-rc1 UPSTREAM: cpufreq: schedutil: use now as reference when aggregating shared policy requests ANDROID: add script to fetch android kernel config fragments f2fs: reorganize stat information f2fs: clean up flush/discard command namings f2fs: check in-memory sit version bitmap f2fs: check in-memory nat version bitmap f2fs: check in-memory block bitmap f2fs: introduce FI_ATOMIC_COMMIT f2fs: clean up with list_{first, last}_entry f2fs: return fs_trim if there is no candidate f2fs: avoid needless checkpoint in f2fs_trim_fs f2fs: relax async discard commands more f2fs: drop exist_data for inline_data when truncated to 0 f2fs: don't allow encrypted operations without keys f2fs: show the max number of atomic operations f2fs: get io size bit from mount option f2fs: support IO alignment for DATA and NODE writes f2fs: add submit_bio tracepoint f2fs: reassign new segment for mode=lfs f2fs: fix a missing discard prefree segments f2fs: use rb_entry_safe f2fs: add a case of no need to read a page in write begin f2fs: fix a problem of using memory after free f2fs: remove unneeded condition f2fs: don't cache nat entry if out of memory f2fs: remove unused values in recover_fsync_data f2fs: support async discard based on v4.9 f2fs: resolve op and op_flags confilcts f2fs: remove wrong backported codes FROMLIST: binder: fix use-after-free in binder_transaction() UPSTREAM: ipv6: fib: Unlink replaced routes from their nodes Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org> Conflicts: fs/f2fs/crypto_key.c fs/f2fs/f2fs_crypto.h net/wireless/nl80211.c sound/usb/card.c Change-Id: I742aeaec84c7892165976b7bea3e07bdd6881d93 Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
2017-10-08xfs: remove kmem_zalloc_greedyDarrick J. Wong
[ Upstream commit 08b005f1333154ae5b404ca28766e0ffb9f1c150 ] The sole remaining caller of kmem_zalloc_greedy is bulkstat, which uses it to grab 1-4 pages for staging of inobt records. The infinite loop in the greedy allocation function is causing hangs[1] in generic/269, so just get rid of the greedy allocator in favor of kmem_zalloc_large. This makes bulkstat somewhat more likely to ENOMEM if there's really no pages to spare, but eliminates a source of hangs. [1] http://lkml.kernel.org/r/20170301044634.rgidgdqqiiwsmfpj%40XZHOUW.usersys.redhat.com Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-09-21Merge android-4.4@29d0b65 (v4.4.88) into msm-4.4Blagovest Kolenichev
* refs/heads/tmp-29d0b65 Linux 4.4.88 xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present NFS: Fix 2 use after free issues in the I/O code ARM: 8692/1: mm: abort uaccess retries upon fatal signal Bluetooth: Properly check L2CAP config option output buffer length ALSA: msnd: Optimize / harden DSP and MIDI loops locktorture: Fix potential memory leak with rw lock test btrfs: resume qgroup rescan on rw remount drm/bridge: adv7511: Re-write the i2c address before EDID probing drm/bridge: adv7511: Switch to using drm_kms_helper_hotplug_event() drm/bridge: adv7511: Use work_struct to defer hotplug handing to out of irq context drm/bridge: adv7511: Fix mutex deadlock when interrupts are disabled drm: adv7511: really enable interrupts for EDID detection scsi: sg: recheck MMAP_IO request length with lock held scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE cs5536: add support for IDE controller variant workqueue: Fix flag collision drm/nouveau/pci/msi: disable MSI on big-endian platforms by default mwifiex: correct channel stat buffer overflows dlm: avoid double-free on error path in dlm_device_{register,unregister} Bluetooth: Add support of 13d3:3494 RTL8723BE device rtlwifi: rtl_pci_probe: Fix fail path of _rtl_pci_find_adapter Input: trackpoint - assume 3 buttons when buttons detection fails ath10k: fix memory leak in rx ring buffer allocation intel_th: pci: Add Cannon Lake PCH-LP support intel_th: pci: Add Cannon Lake PCH-H support driver core: bus: Fix a potential double free staging/rts5208: fix incorrect shift to extract upper nybble USB: core: Avoid race of async_completed() w/ usbdev_release() usb:xhci:Fix regression when ATI chipsets detected usb: Add device quirk for Logitech HD Pro Webcam C920-C USB: serial: option: add support for D-Link DWM-157 C1 usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard ANDROID: sdcardfs: Add missing break ANDROID: Sdcardfs: Move gid derivation under flag ANDROID: mnt: Fix freeing of mount data drivers: cpufreq: checks to avoid kernel crash in cpufreq_interactive ANDROID: Use sk_uid to replace uid get from socket file ANDROID: nf: xt_qtaguid: fix handling for cases where tunnels are used. Revert "ANDROID: Use sk_uid to replace uid get from socket file" ANDROID: fiq_debugger: Fix minor bug in code Conflicts: drivers/cpufreq/cpufreq_interactive.c drivers/net/wireless/ath/ath10k/core.c drivers/staging/android/fiq_debugger/fiq_debugger.c net/netfilter/xt_qtaguid.c Change-Id: I49c67ff84d4bee0799691cc1ee0a023e2dd13e66 Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-16 15:17:24 +0000