aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* f2fs: adjust the way of calculating nat blockFan Li2017-05-211-3/+6
| | | | | | | use a slightly simpler expression to calculate nat block with nid. Signed-off-by: Fan Li <fanofcode.li@samsung.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: add fault injection on f2fs_truncateJaegeuk Kim2017-05-213-0/+8
| | | | | | | Inject a fault during f2fs_truncate(). Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: check range before defragmentSheng Yong2017-05-211-0/+6
| | | | | | | | | This patch checks the parameter range passed by ioctl to void that range exceeds the max_file_blocks limit. Signed-off-by: Sheng Yong <shengyong1@huawei.com> Reviewed-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: use parameter max_items instead of PIDVEC_SIZESheng Yong2017-05-211-1/+1
| | | | | | Signed-off-by: Sheng Yong <shengyong1@huawei.com> Reviewed-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: add a punch discard command functionYunlei He2017-05-211-2/+20
| | | | | | | | | This patch add a function to punch discard command if one segment reuse before discard. Split this segment from multi-segments discard range, and discard the left bigger range. Signed-off-by: Yunlei He <heyunlei@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: allocate a bio for discarding when actually issuing itJaegeuk Kim2017-05-212-93/+105
| | | | | | | | | | Let's allocate a bio when issuing discard commands later. Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Conflicts: fs/f2fs/f2fs.h fs/f2fs/segment.c
* f2fs: skip writeback meta pages if cp_mutex acquire failedYunlei He2017-05-211-3/+4
| | | | | | | | | Skip writeback meta pages if cp_mutex lock acquire failed, cp will flush dirty pages instead. Signed-off-by: Yunlei He <heyunlei@huawei.com> Reviewed-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: show more precise message on orphan recovery failureJaegeuk Kim2017-05-211-1/+1
| | | | | | This case is not caused by fsck.f2fs. User needs to retry mount. Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: remove dead macro PGOFS_OF_NEXT_DNODEKinglong Mee2017-05-211-6/+0
| | | | | | Fixes: 3cf4574705 ("f2fs: introduce get_next_page_offset to speed up SEEK_DATA") Signed-off-by: Kinglong Mee <kinglongmee@gmail.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: drop duplicate radix tree lookup of nat_entry_setKinglong Mee2017-05-211-12/+6
| | | | | | | | | The nat entry is listed from the set list for freeing, it's duplicate to do radix tree lookup again. Signed-off-by: Kinglong Mee <kinglongmee@gmail.com> [Jaegeuk Kim: remove unnecessary f2fs_bug_on] Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: make sure trace all f2fs_issue_flushKinglong Mee2017-05-212-15/+20
| | | | | | | | | | The root device's issue flush trace is missing, add it and tracing the result from submit. Fixes d50aaeec90 ("f2fs: show actual device info in tracepoints") Signed-off-by: Kinglong Mee <kinglongmee@gmail.com> Reviewed-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: don't allow volatile writes for non-regular fileChao Yu2017-05-211-0/+3
| | | | | | | Now f2fs only supports volatile writes for journal db regular file. Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: don't allow atomic writes for not regular filesJaegeuk Kim2017-05-211-0/+3
| | | | | | The atomic writes only supports regular files for database. Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: fix stale ATOMIC_WRITTEN_PAGE private pointerJaegeuk Kim2017-05-214-1/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When I forced to enable atomic operations intentionally, I could hit the below panic, since we didn't clear page->private in f2fs_invalidate_page called by file truncation. The panic occurs due to NULL mapping having page->private. BUG: unable to handle kernel paging request at ffffffffffffffff IP: drop_buffers+0x38/0xe0 PGD 5d00c067 PUD 5d00e067 PMD 0 CPU: 3 PID: 1648 Comm: fsstress Tainted: G D OE 4.10.0+ #5 Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 task: ffff9151952863c0 task.stack: ffffaaec40db4000 RIP: 0010:drop_buffers+0x38/0xe0 RSP: 0018:ffffaaec40db74c8 EFLAGS: 00010292 Call Trace: ? page_referenced+0x8b/0x170 try_to_free_buffers+0xc5/0xe0 try_to_release_page+0x49/0x50 shrink_page_list+0x8bc/0x9f0 shrink_inactive_list+0x1dd/0x500 ? shrink_active_list+0x2c0/0x430 shrink_node_memcg+0x5eb/0x7c0 shrink_node+0xe1/0x320 do_try_to_free_pages+0xef/0x2e0 try_to_free_pages+0xe9/0x190 __alloc_pages_slowpath+0x390/0xe70 __alloc_pages_nodemask+0x291/0x2b0 alloc_pages_current+0x95/0x140 __page_cache_alloc+0xc4/0xe0 pagecache_get_page+0xab/0x2a0 grab_cache_page_write_begin+0x20/0x40 get_read_data_page+0x2e6/0x4c0 [f2fs] ? f2fs_mark_inode_dirty_sync+0x16/0x30 [f2fs] ? truncate_data_blocks_range+0x238/0x2b0 [f2fs] get_lock_data_page+0x30/0x190 [f2fs] __exchange_data_block+0xaaf/0xf40 [f2fs] f2fs_fallocate+0x418/0xd00 [f2fs] vfs_fallocate+0x157/0x220 SyS_fallocate+0x48/0x80 Signed-off-by: Yunlei He <heyunlei@huawei.com> Signed-off-by: Chao Yu <yuchao0@huawei.com> [Chao Yu: use INMEM_INVALIDATE for better tracing] Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Conflicts: include/trace/events/f2fs.h
* f2fs: build stat_info before orphan inode recoveryJaegeuk Kim2017-05-211-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | f2fs_sync_fs() -> write_checkpoint() calls stat_inc_cp_count(sbi->stat_info), which needs stat_info allocation. Otherwise, we can hit: [254042.598623] ? count_shadow_nodes+0xa0/0xa0 [254042.598633] f2fs_sync_fs+0x65/0xd0 [f2fs] [254042.598645] f2fs_balance_fs_bg+0xe4/0x1c0 [f2fs] [254042.598657] f2fs_write_node_pages+0x34/0x1a0 [f2fs] [254042.598664] ? pagevec_lookup_entries+0x1e/0x30 [254042.598673] do_writepages+0x1e/0x30 [254042.598682] __writeback_single_inode+0x45/0x330 [254042.598688] writeback_single_inode+0xd7/0x190 [254042.598694] write_inode_now+0x86/0xa0 [254042.598699] iput+0x122/0x200 [254042.598709] f2fs_fill_super+0xd4a/0x14d0 [f2fs] [254042.598717] mount_bdev+0x184/0x1c0 [254042.598934] ? f2fs_commit_super+0x100/0x100 [f2fs] [254042.599142] f2fs_mount+0x15/0x20 [f2fs] [254042.599349] mount_fs+0x39/0x160 [254042.599554] ? __alloc_percpu+0x15/0x20 [254042.599759] vfs_kern_mount+0x67/0x110 [254042.599972] do_mount+0x1bb/0xc80 [254042.600175] ? memdup_user+0x42/0x60 [254042.600380] SyS_mount+0x83/0xd0 [254042.600583] entry_SYSCALL_64_fastpath+0x1e/0xad Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: fix the fault of calculating blkstart twiceKinglong Mee2017-05-211-1/+2
| | | | | | | | | When the zone type is BLK_ZONE_TYPE_CONVENTIONAL, the blkstart is calculated twice. Signed-off-by: Kinglong Mee <kinglongmee@gmail.com> Reviewed-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: fix the fault of checking F2FS_LINK_MAX for rename inodeKinglong Mee2017-05-211-2/+2
| | | | | | | | The parent directory's nlink will change, not the inode. Signed-off-by: Kinglong Mee <kinglongmee@gmail.com> Reviewed-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: don't allow to get pino when filename is encryptedJaegeuk Kim2017-05-211-0/+3
| | | | | | | After renaming an encrypted file, we have no way to get its encrypted filename from its dentry. Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: fix wrong error injection for evict_inodeJaegeuk Kim2017-05-211-7/+6
| | | | | | | | The previous one was not a proper location to inject an error, since there is no point to get errors. Instead, we can emulate EIO during truncation, and the below logic should handle it correctly. Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: le32_to_cpu for ckpt->cp_pack_total_block_countKinglong Mee2017-05-211-1/+2
| | | | | | Fixes: 22ad0b6ab4 ("f2fs: add bitmaps for empty or full NAT blocks") Signed-off-by: Kinglong Mee <kinglongmee@gmail.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: combine nat_bits and free_nid_bitmap cacheChao Yu2017-05-211-78/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Both nat_bits cache and free_nid_bitmap cache provide same functionality as a intermediate cache between free nid cache and disk, but with different granularity of indicating free nid range, and different persistence policy. nat_bits cache provides better persistence ability, and free_nid_bitmap provides better granularity. In this patch we combine advantage of both caches, so finally policy of the intermediate cache would be: - init: load free nid status from nat_bits into free_nid_bitmap - lookup: scan free_nid_bitmap before load NAT blocks - update: update free_nid_bitmap in real-time - persistence: udpate and persist nat_bits in checkpoint This patch also resolves performance regression reported by lkp-robot. commit: 4ac912427c4214d8031d9ad6fbc3bc75e71512df ("f2fs: introduce free nid bitmap") d00030cf9cd0bb96fdccc41e33d3c91dcbb672ba ("f2fs: use __set{__clear}_bit_le") 1382c0f3f9d3f936c8bc42ed1591cf7a593ef9f7 ("f2fs: combine nat_bits and free_nid_bitmap cache") 4ac912427c4214d8 d00030cf9cd0bb96fdccc41e33 1382c0f3f9d3f936c8bc42ed15 ---------------- -------------------------- -------------------------- %stddev %change %stddev %change %stddev \ | \ | \ 77863 ± 0% +2.1% 79485 ± 1% +50.8% 117404 ± 0% aim7.jobs-per-min 231.63 ± 0% -2.0% 227.01 ± 1% -33.6% 153.80 ± 0% aim7.time.elapsed_time 231.63 ± 0% -2.0% 227.01 ± 1% -33.6% 153.80 ± 0% aim7.time.elapsed_time.max 896604 ± 0% -0.8% 889221 ± 3% -20.2% 715260 ± 1% aim7.time.involuntary_context_switches 2394 ± 1% +4.6% 2503 ± 1% +3.7% 2481 ± 2% aim7.time.maximum_resident_set_size 6240 ± 0% -1.5% 6145 ± 1% -14.1% 5360 ± 1% aim7.time.system_time 1111357 ± 3% +1.9% 1132509 ± 2% -6.2% 1041932 ± 2% aim7.time.voluntary_context_switches ... Signed-off-by: Chao Yu <yuchao0@huawei.com> Tested-by: Xiaolong Ye <xiaolong.ye@intel.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: skip scanning free nid bitmap of full NAT blocksChao Yu2017-05-213-6/+31
| | | | | | | | | | | | This patch adds to account free nids for each NAT blocks, and while scanning all free nid bitmap, do check count and skip lookuping in full NAT block. Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Conflicts: fs/f2fs/node.c
* FROMLIST: pstore: drop pmsg bounce bufferMark Salyzyn2017-05-206-35/+119
| | | | | | | | | | | | | | | | | | (from https://lkml.org/lkml/2016/9/1/428) (cherry pick from android-3.10 commit b58133100b38f2bf83cad2d7097417a3a196ed0b) Removing a bounce buffer copy operation in the pmsg driver path is always better. We also gain in overall performance by not requesting a vmalloc on every write as this can cause precious RT tasks, such as user facing media operation, to stall while memory is being reclaimed. Added a write_buf_user to the pstore functions, a backup platform write_buf_user that uses the small buffer that is part of the instance, and implemented a ramoops write_buf_user that only supports PSTORE_TYPE_PMSG. Signed-off-by: Mark Salyzyn <salyzyn@google.com> Bug: 31057326 Change-Id: I4cdee1cd31467aa3e6c605bce2fbd4de5b0f8caa
* fs/pstore: fix compilation warningPatrick Tjin2017-05-201-3/+1
| | | | | | | | fs/pstore/ram.c: In function 'ramoops_probe': fs/pstore/ram.c:526:6: error: void value not ignored as it ought to be Change-Id: I8ad52a8955486df59bb8f7d09757fcb8b1a4e036 Signed-off-by: Patrick Tjin <pattjin@google.com>
* pstore: Fix the ramoops module parameters updateWang Long2017-05-201-0/+3
| | | | | | | | | | | | | | In the function ramoops_probe, the console_size, pmsg_size, ftrace_size may be update because the value is not the power of two. We should update the module parameter variables as well so they are visible through /sys/module/ramoops/parameters correctly. Change-Id: I18b89758c2e928b29a9e14edecadc80a3c40d8fb Signed-off-by: Wang Long <long.wanglong@huawei.com> Acked-by: Mark Salyzyn <salyzyn@android.com> Acked-by: Kees Cook <keescook@chromium.org> Signed-off-by: Tony Luck <tony.luck@intel.com>
* fs/pstore: initialize pmsg from device treePatrick Tjin2017-05-201-1/+20
| | | | | | | | | | | - Add pmsg initialization - or_property_read_u32 does not set *out value if case missing. Must initialize _all_ output vars before call. Based on: I5c9bcb7bd43af5a80addecf824f14dd7d63b0064 Change-Id: I2723d407be1ae77d45ad5486a2ddd13b82c5c588 Signed-off-by: Patrick Tjin <pattjin@google.com>
* fs:pstore:ramoops: config mem from dtYi-wei Zhao2017-05-201-1/+62
| | | | | | | | | | | | | | | configure the start & size of ramoops memory using device tree. the "dummy" device is no harm as long as initial mem_size is zero. Conflicts: fs/pstore/ram.c Cherry-picked from: bc4df1ea67057fa2117aa6f5b5a967d2ca2cc846 Change-Id: I756e933bea072399cb80ffd78dc79a42b448fed9 Signed-off-by: Yi-wei Zhao <gbjc64@motorola.com> Reviewed-by: Jeffrey Carlyle <jeff.carlyle@motorola.com> Signed-off-by: Patrick Tjin <pattjin@google.com>
* shmem: fix shm fallocate() list corruptionLinus Torvalds2017-05-201-1/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The shmem hole punching with fallocate(FALLOC_FL_PUNCH_HOLE) does not want to race with generating new pages by faulting them in. However, the wait-queue used to delay the page faulting has a serious problem: the wait queue head (in shmem_fallocate()) is allocated on the stack, and the code expects that "wake_up_all()" will make sure that all the queue entries are gone before the stack frame is de-allocated. And that is not at all necessarily the case. Yes, a normal wake-up sequence will remove the wait-queue entry that caused the wakeup (see "autoremove_wake_function()"), but the key wording there is "that caused the wakeup". When there are multiple possible wakeup sources, the wait queue entry may well stay around. And _particularly_ in a page fault path, we may be faulting in new pages from user space while we also have other things going on, and there may well be other pending wakeups. So despite the "wake_up_all()", it's not at all guaranteed that all list entries are removed from the wait queue head on the stack. Fix this by introducing a new wakeup function that removes the list entry unconditionally, even if the target process had already woken up for other reasons. Use that "synchronous" function to set up the waiters in shmem_fault(). This problem has never been seen in the wild afaik, but Dave Jones has reported it on and off while running trinity. We thought we fixed the stack corruption with the blk-mq rq_list locking fix (commit 7fe311302f7d: "blk-mq: update hardware and software queues for sleeping alloc"), but it turns out there was _another_ stack corruptor hiding in the trinity runs. Vegard Nossum (also running trinity) was able to trigger this one fairly consistently, and made us look once again at the shmem code due to the faults often being in that area. Change-Id: I9b8e00b36bbbcb8a5bf9586fff65e9f6727f258e Reported-and-tested-by: Vegard Nossum <vegard.nossum@oracle.com>. Reported-by: Dave Jones <davej@codemonkey.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* mtk: mlog: fix build without lmkMister Oyster2017-05-201-0/+4
|
* defconfig: cleanupMister Oyster2017-05-201-2/+1
|
* zram: do not use copy_page with non-page aligned addressMinchan Kim2017-05-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit d72e9a7a93e4f8e9e52491921d99e0c8aa89eb4e upstream. The copy_page is optimized memcpy for page-alinged address. If it is used with non-page aligned address, it can corrupt memory which means system corruption. With zram, it can happen with 1. 64K architecture 2. partial IO 3. slub debug Partial IO need to allocate a page and zram allocates it via kmalloc. With slub debug, kmalloc(PAGE_SIZE) doesn't return page-size aligned address. And finally, copy_page(mem, cmem) corrupts memory. So, this patch changes it to memcpy. Actuaully, we don't need to change zram_bvec_write part because zsmalloc returns page-aligned address in case of PAGE_SIZE class but it's not good to rely on the internal of zsmalloc. Note: When this patch is merged to stable, clear_page should be fixed, too. Unfortunately, recent zram removes it by "same page merge" feature so it's hard to backport this patch to -stable tree. I will handle it when I receive the mail from stable tree maintainer to merge this patch to backport. Fixes: 42e99bd ("zram: optimize memory operations with clear_page()/copy_page()") Link: http://lkml.kernel.org/r/1492042622-12074-2-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim <minchan@kernel.org> Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Joe Maples <joe@frap129.org>
* defconfig: kill LMK and enable MEMCGNathan Chancellor2017-05-201-4/+7
| | | | | | | This should switch us over to userspace's LMK Signed-off-by: Joe Maples <joe@frap129.org> Signed-off-by: Moyster <oysterized@gmail.com>
* give up on gcc ilog2() constant optimizationsLinus Torvalds2017-05-201-11/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | gcc-7 has an "optimization" pass that completely screws up, and generates the code expansion for the (impossible) case of calling ilog2() with a zero constant, even when the code gcc compiles does not actually have a zero constant. And we try to generate a compile-time error for anybody doing ilog2() on a constant where that doesn't make sense (be it zero or negative). So now gcc7 will fail the build due to our sanity checking, because it created that constant-zero case that didn't actually exist in the source code. There's a whole long discussion on the kernel mailing about how to work around this gcc bug. The gcc people themselevs have discussed their "feature" in https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72785 but it's all water under the bridge, because while it looked at one point like it would be solved by the time gcc7 was released, that was not to be. So now we have to deal with this compiler braindamage. And the only simple approach seems to be to just delete the code that tries to warn about bad uses of ilog2(). So now "ilog2()" will just return 0 not just for the value 1, but for any non-positive value too. It's not like I can recall anybody having ever actually tried to use this function on any invalid value, but maybe the sanity check just meant that such code never made it out in public. Reported-by: Laura Abbott <labbott@redhat.com> Cc: John Stultz <john.stultz@linaro.org>, Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Joe Maples <joe@frap129.org>
* UPSTREAM: tracing: Fix trace_printk() to print when not using bprintk()Joe Maples2017-05-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The trace_printk() code will allocate extra buffers if the compile detects that a trace_printk() is used. To do this, the format of the trace_printk() is saved to the __trace_printk_fmt section, and if that section is bigger than zero, the buffers are allocated (along with a message that this has happened). If trace_printk() uses a format that is not a constant, and thus something not guaranteed to be around when the print happens, the compiler optimizes the fmt out, as it is not used, and the __trace_printk_fmt section is not filled. This means the kernel will not allocate the special buffers needed for the trace_printk() and the trace_printk() will not write anything to the tracing buffer. Adding a "__used" to the variable in the __trace_printk_fmt section will keep it around, even though it is set to NULL. This will keep the string from being printed in the debugfs/tracing/printk_formats section as it is not needed. Reported-by: Vlastimil Babka <vbabka@suse.cz> Fixes: 07d777fe8c398 "tracing: Add percpu buffers for trace_printk()" Cc: stable@vger.kernel.org # v3.5+ Bug: 34277115 Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Change-Id: I10ce56caa41c7644d9d290d9ed272a6d156c938c Signed-off-by: Joe Maples <joe@frap129.org>
* ANDROID: Add untag hacks to inet_release functionChenbo Feng2017-05-205-59/+63
| | | | | | | | | | | | | | | | | To prevent protential risk of memory leak caused by closing socket with out untag it from qtaguid module, the qtaguid module now do not hold any socket file reference count. Instead, it will increase the sk_refcnt of the sk struct to prevent a reuse of the socket pointer. And when a socket is released. It will delete the tag if the socket is previously tagged so no more resources is held by xt_qtaguid moudle. A flag is added to the untag process to prevent possible kernel crash caused by fail to delete corresponding socket_tag_entry list. Bug: 36374484 Test: compile and run test under system/extra/test/iptables, run cts -m CtsNetTestCases -t android.net.cts.SocketRefCntTest Signed-off-by: Chenbo Feng <fengc@google.com> Change-Id: Iea7c3bf0c59b9774a5114af905b2405f6bc9ee52
* KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyringsEric Biggers2017-05-202-24/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | commit c9f838d104fed6f2f61d68164712e3204bf5271b upstream. This fixes CVE-2017-7472. Running the following program as an unprivileged user exhausts kernel memory by leaking thread keyrings: #include <keyutils.h> int main() { for (;;) keyctl_set_reqkey_keyring(KEY_REQKEY_DEFL_THREAD_KEYRING); } Fix it by only creating a new thread keyring if there wasn't one before. To make things more consistent, make install_thread_keyring_to_cred() and install_process_keyring_to_cred() both return 0 if the corresponding keyring is already present. Fixes: d84f4f992cbd ("CRED: Inaugurate COW credentials") Change-Id: I06eab1b34d56d23af7481f74d7b7a48887609dc7 Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* packet: fix races in fanout_add()Eric Dumazet2017-05-201-12/+14
| | | | | | | | | | | | | | | | | | | | | | [ Upstream commit d199fab63c11998a602205f7ee7ff7c05c97164b ] Multiple threads can call fanout_add() at the same time. We need to grab fanout_mutex earlier to avoid races that could lead to one thread freeing po->rollover that was set by another thread. Do the same in fanout_release(), for peace of mind, and to help us finding lockdep issues earlier. [js] no rollover in 3.12 Fixes: dc99f600698d ("packet: Add fanout support.") Fixes: 0648ab70afe6 ("packet: rollover prepare: per-socket state") Change-Id: I0418252031431ab0f17c5a33073257d2c3106144 Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Jiri Slaby <jslaby@suse.cz>
* ANDROID: sdcardfs: Add linux/kref.h includeDmitry Shmidt2017-05-181-0/+1
| | | | | Change-Id: I8be0f6fc7aa6dc1d639d2d22b230783c68574389 Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
* ANDROID: sdcardfs: Move top to its own structDaniel Rosenberg2017-05-188-135/+231
| | | | | | | | | | Move top, and the associated data, to its own struct. This way, we can properly track refcounts on top without interfering with the inode's accounting. Signed-off-by: Daniel Rosenberg <drosen@google.com> Bug: 38045152 Change-Id: I1968e480d966c3f234800b72e43670ca11e1d3fd
* defconfig: more defconfigMister Oyster2017-05-111-25/+31
|
* defconfig: regenMister Oyster2017-05-111-4/+3
|
* wlan: disable CONFIG_CFG80211_WEXT in kernel configAnmin Hsu2017-05-112-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [Detail] 1. Driver/kernel will report tons of RTM_NEWLINK event even driver scan done if kernel configured with CONFIG_CFG80211_WEXT, which will make userspace threads busy processing the RTM_NEWLINK event. Userspace threads will get strange state if cannot handle so much RTM_NEWLINK event. 2. Kernel Kconfig has post comments for CONFIG_CFG80211_WEXT: help Enable this option if you need old userspace for wireless extensions with cfg80211-based drivers. Android userspace app support the new CFG80211 API like wpa_supplicant/hostapd, not need CONFIG_CFG80211_WEXT anymore. [Solution] 1. Remove CONFIG_CFG80211_WEXT in kernel config. [Feature] WLAN MTK-Commit-Id: c146f3f2b2c42d049bcf4fd37579a380f0926550 Change-Id: I020a886d125612b1cc6423afcd8d85a2fcdfa4ea Signed-off-by: Peiyong Feng <peiyong.feng@mediatek.com> CR-Id: ALPS02216715
* cam: Sync code from L1.Mp10Anmin Hsu2017-05-111-0/+1
| | | | | | | | | | | | | | [Detail] sync code from L1.MP10 [Solution] manual sync in 1 commit [Feature] Camcorder Application MTK-Commit-Id: 7009349bf8a23dd0377dad6759af3da264f6b863 Change-Id: Idba37e1f05a9b05d7da6200c28da114d63f5c33d Signed-off-by: John.Wei <john.wei@mediatek.com> CR-Id: ALPS02321162
* Fuel Gauge: fix suspend/resume calculationAnmin Hsu2017-05-111-20/+2
| | | | | | | | | | | | | | | | | | | [Detail] 1. bat volt is wrong in the fuel gauge algorithm of suspend/resume 2. fuel gauge log cannot print out [Solution] 1. fix correct bat volt in resume 2. fix fuel gauge log level [Feature] Battery Management MTK-Commit-Id: 81ea0e76922c6280d1f7dcdb601d6ba04cf21369 Change-Id: Ibfd975bc72a373c8b15a0737361c50b7054fa865 Signed-off-by: Hsin-Hsiung Wang <hsin-hsiung.wang@mediatek.com> CR-Id: ALPS02314143 (cherry picked from commit bd1c50b3720b0e12f3e6b8d0fb32dcab1ca41461) Backported for 3.10 Signed-off-by: Mister Oyster <oysterized@gmail.com>
* defconfig: disable AEE stuff that ain't called 'AEE stuff' because fck yeahMister Oyster2017-05-111-1/+1
|
* aee: enable mt_dump flowAnmin Hsu2017-05-111-0/+11
| | | | | | | | | | | | | | | | | | | [Detail] ipanic flow need to use mt_dump flow to avoid reserve memory for preloader/lk [Solution] 1.Enable mt_dump ke flow 2.remove preloader/lk memory reserve in MT6735 [Feature] CTS(*) MTK-Commit-Id: aff7a2ce6a1c6bd805b2acdeaef7c8c28a0cd613 Change-Id: I2264b0544d3219b4ed2dd53483a134182d76aa17 Signed-off-by: Ji Zhang <ji.zhang@mediatek.com> CR-Id: ALPS02296880 (cherry picked from commit abaf1e786c9856e1a048e55714faa7f98309b96d)
* AEE: fix code defects.Anmin Hsu2017-05-112-1/+7
| | | | | | | | | | | | | | | [Detail] defects found out by Coverity: memroy leak risk. related files:aee kernel driver aed-debug.c & aed-main.c [Solution] fix the defects with kfree(). [Feature] Android Exception Engine(AEE) MTK-Commit-Id: 3c664402362bd16414b09e9050b91f45849b6a3f Change-Id: Ib4a67f16d5552a5c5c1096eedef1e8b4ef8faece Signed-off-by: Zhiyong Wang <zhiyong.wang@mediatek.com> CR-Id: ALPS02319644
* ANDROID: make PF_KEY SHA256 use RFC-compliant truncation.Lorenzo Colitti2017-05-111-1/+1
| | | | | | | | | | | | | | | | | When using the PF_KEY interface, SHA-256 hashes are hardcoded to use 96-bit truncation. This is a violation of RFC4868, which specifies 128-bit truncation, but will not be fixed upstream due to backwards compatibility concerns and because the PF_KEY interface is deprecated in favour of netlink XFRM (which allows the app to specify an arbitrary truncation length). Change the hardcoded truncation length from 96 to 128 so that PF_KEY apps such as racoon will work with standards-compliant VPN servers. Bug: 34114242 Change-Id: Ie46bff4b6358f18117d0be241171d677d31d33f7 Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
* ANDROID: sdcardfs: fix sdcardfs_destroy_inode for the inode RCU approachGao Xiang2017-05-111-1/+8
| | | | | | | | | | | According to the following commits, fs: icache RCU free inodes vfs: fix the stupidity with i_dentry in inode destructors sdcardfs_destroy_inode should be fixed for the fast path safety. Signed-off-by: Gao Xiang <gaoxiang25@huawei.com> Change-Id: I84f43c599209d23737c7e28b499dd121cb43636d
* Revert "BACKPORT: [UPSTREAM] ext2: convert to mbcache2"Mister Oyster2017-05-114-92/+100
| | | | This reverts commit 10661068710757517fbe120a5d0d73f9d9d0e4ee.
generated by cgit v1.2.3 (git 2.39.1) at 2026-03-22 11:55:06 +0000