aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* drivers/tty/n_hdlc.c: replace kmalloc/memset by kzallocFabian Frederick2017-04-111-3/+1
| | | | | | | Change-Id: Ie5a8c08ec3e1cdaada7f9c9181730ff4a353ee97 Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Fabian Frederick <fabf@skynet.be> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* fmradio: cleanupMister Oyster2017-04-111-1/+0
|
* drv_wlan: remove meizu/mtk debugMister Oyster2017-04-116-30/+0
|
* lib: lzo: cleanupMister Oyster2017-04-111-10/+9
|
* accdet: remove meizu log ifdefsMister Oyster2017-04-111-4/+0
|
* drivers: mediatek: wdt: Reduce unnecessary logsTim Kryger2017-04-111-4/+0
| | | | | | | | Avoid logging every start or stop of the WDT as this clutters the log. Bug: 27767950 Change-Id: I29e603b2514392fb1cf2168f89ff105eace6fc8e Signed-off-by: Tim Kryger <tkryger@google.com>
* leds: remove meizu logMoyster2017-04-111-4/+0
|
* Get rid of __cpuinitMoyster2017-04-11328-1016/+1016
| | | | | | | | | | | | | | | | | | | | | This commit is the result of find . -name '*.c' | xargs sed -i 's/ __cpuinit / /g' find . -name '*.c' | xargs sed -i 's/ __cpuexit / /g' find . -name '*.c' | xargs sed -i 's/ __cpuinitdata / /g' find . -name '*.c' | xargs sed -i 's/ __cpuinit$//g' find ./arch/ -name '*.h' | xargs sed -i 's/ __cpuinit//g' find . -name '*.c' | xargs sed -i 's/^__cpuinit //g' find . -name '*.c' | xargs sed -i 's/^__cpuinitdata //g' find . -name '*.c' | xargs sed -i 's/\*__cpuinit /\*/g' find . -name '*.c' | xargs sed -i 's/ __cpuinitconst / /g' find . -name '*.h' | xargs sed -i 's/ __cpuinit / /g' find . -name '*.h' | xargs sed -i 's/ __cpuinitdata / /g' git add . git reset include/linux/init.h git checkout -- include/linux/init.h based off : https://github.com/jollaman999/jolla-kernel_bullhead/commit/bc15db84a622eed7d61d3ece579b577154d0ec29
* tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.cKosuke Tatsukawa2017-04-111-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit e81107d4c6bd098878af9796b24edc8d4a9524fd upstream. My colleague ran into a program stall on a x86_64 server, where n_tty_read() was waiting for data even if there was data in the buffer in the pty. kernel stack for the stuck process looks like below. #0 [ffff88303d107b58] __schedule at ffffffff815c4b20 #1 [ffff88303d107bd0] schedule at ffffffff815c513e #2 [ffff88303d107bf0] schedule_timeout at ffffffff815c7818 #3 [ffff88303d107ca0] wait_woken at ffffffff81096bd2 #4 [ffff88303d107ce0] n_tty_read at ffffffff8136fa23 #5 [ffff88303d107dd0] tty_read at ffffffff81368013 #6 [ffff88303d107e20] __vfs_read at ffffffff811a3704 #7 [ffff88303d107ec0] vfs_read at ffffffff811a3a57 #8 [ffff88303d107f00] sys_read at ffffffff811a4306 #9 [ffff88303d107f50] entry_SYSCALL_64_fastpath at ffffffff815c86d7 There seems to be two problems causing this issue. First, in drivers/tty/n_tty.c, __receive_buf() stores the data and updates ldata->commit_head using smp_store_release() and then checks the wait queue using waitqueue_active(). However, since there is no memory barrier, __receive_buf() could return without calling wake_up_interactive_poll(), and at the same time, n_tty_read() could start to wait in wait_woken() as in the following chart. __receive_buf() n_tty_read() ------------------------------------------------------------------------ if (waitqueue_active(&tty->read_wait)) /* Memory operations issued after the RELEASE may be completed before the RELEASE operation has completed */ add_wait_queue(&tty->read_wait, &wait); ... if (!input_available_p(tty, 0)) { smp_store_release(&ldata->commit_head, ldata->read_head); ... timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout); ------------------------------------------------------------------------ The second problem is that n_tty_read() also lacks a memory barrier call and could also cause __receive_buf() to return without calling wake_up_interactive_poll(), and n_tty_read() to wait in wait_woken() as in the chart below. __receive_buf() n_tty_read() ------------------------------------------------------------------------ spin_lock_irqsave(&q->lock, flags); /* from add_wait_queue() */ ... if (!input_available_p(tty, 0)) { /* Memory operations issued after the RELEASE may be completed before the RELEASE operation has completed */ smp_store_release(&ldata->commit_head, ldata->read_head); if (waitqueue_active(&tty->read_wait)) __add_wait_queue(q, wait); spin_unlock_irqrestore(&q->lock,flags); /* from add_wait_queue() */ ... timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout); ------------------------------------------------------------------------ There are also other places in drivers/tty/n_tty.c which have similar calls to waitqueue_active(), so instead of adding many memory barrier calls, this patch simply removes the call to waitqueue_active(), leaving just wake_up*() behind. This fixes both problems because, even though the memory access before or after the spinlocks in both wake_up*() and add_wait_queue() can sneak into the critical section, it cannot go past it and the critical section assures that they will be serialized (please see "INTER-CPU ACQUIRING BARRIER EFFECTS" in Documentation/memory-barriers.txt for a better explanation). Moreover, the resulting code is much simpler. Latency measurement using a ping-pong test over a pty doesn't show any visible performance drop. Change-Id: I1bbb699d6f844ca9d47b8000f5fddc4e3bc5332b Signed-off-by: Kosuke Tatsukawa <tatsu@ab.jp.nec.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [lizf: Backported to 3.4: - adjust context - s/wake_up_interruptible_poll/wake_up_interruptible/ - drop changes to __receive_buf() and n_tty_set_termios()] Signed-off-by: Zefan Li <lizefan@huawei.com>
* net: skb_orphan() changesEric Dumazet2017-04-111-3/+4
| | | | | | | | | | | | | It is illegal to set skb->sk without corresponding destructor. Its therefore safe for skb_orphan() to not clear skb->sk if skb->destructor is not set. Also avoid clearing skb->destructor if already NULL. Change-Id: I3edddb522d5f0c81e9c09e01946ab2f68f4b68ad Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* tty: n_hdlc: get rid of racy n_hdlc.tbufAlexander Popov2017-04-111-63/+69
| | | | | | | | | | | | | | | | | | | | | | commit 82f2341c94d270421f383641b7cd670e474db56b upstream. Currently N_HDLC line discipline uses a self-made singly linked list for data buffers and has n_hdlc.tbuf pointer for buffer retransmitting after an error. The commit be10eb7589337e5defbe214dae038a53dd21add8 ("tty: n_hdlc add buffer flushing") introduced racy access to n_hdlc.tbuf. After tx error concurrent flush_tx_queue() and n_hdlc_send_frames() can put one data buffer to tx_free_buf_list twice. That causes double free in n_hdlc_release(). Let's use standard kernel linked list and get rid of n_hdlc.tbuf: in case of tx error put current data buffer after the head of tx_buf_list. Change-Id: I82071092f122d8c26fe22ce1835812427cc5d282 Signed-off-by: Alexander Popov <alex.popov@linux.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* TTY: n_hdlc, fix lockdep false positiveJiri Slaby2017-04-111-15/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit e9b736d88af1a143530565929390cadf036dc799 upstream. The class of 4 n_hdls buf locks is the same because a single function n_hdlc_buf_list_init is used to init all the locks. But since flush_tx_queue takes n_hdlc->tx_buf_list.spinlock and then calls n_hdlc_buf_put which takes n_hdlc->tx_free_buf_list.spinlock, lockdep emits a warning: ============================================= [ INFO: possible recursive locking detected ] 4.3.0-25.g91e30a7-default #1 Not tainted --------------------------------------------- a.out/1248 is trying to acquire lock: (&(&list->spinlock)->rlock){......}, at: [<ffffffffa01fd020>] n_hdlc_buf_put+0x20/0x60 [n_hdlc] but task is already holding lock: (&(&list->spinlock)->rlock){......}, at: [<ffffffffa01fdc07>] n_hdlc_tty_ioctl+0x127/0x1d0 [n_hdlc] other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&(&list->spinlock)->rlock); lock(&(&list->spinlock)->rlock); *** DEADLOCK *** May be due to missing lock nesting notation 2 locks held by a.out/1248: #0: (&tty->ldisc_sem){++++++}, at: [<ffffffff814c9eb0>] tty_ldisc_ref_wait+0x20/0x50 #1: (&(&list->spinlock)->rlock){......}, at: [<ffffffffa01fdc07>] n_hdlc_tty_ioctl+0x127/0x1d0 [n_hdlc] ... Call Trace: ... [<ffffffff81738fd0>] _raw_spin_lock_irqsave+0x50/0x70 [<ffffffffa01fd020>] n_hdlc_buf_put+0x20/0x60 [n_hdlc] [<ffffffffa01fdc24>] n_hdlc_tty_ioctl+0x144/0x1d0 [n_hdlc] [<ffffffff814c25c1>] tty_ioctl+0x3f1/0xe40 ... Fix it by initializing the spin_locks separately. This removes also reduntand memset of a freshly kzallocated space. Change-Id: Iddbfb4fd69a00fb0e1cb1239a8badfdfa05f7898 Signed-off-by: Jiri Slaby <jslaby@suse.cz> Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* masp: remove unused filp related functions.tadd.kao2017-04-1194-13613/+0
| | | | | | | | | | | | | [Detail] Open file in kernel space is not a secure way. [Solution] Remove the file operation in kernel since they are not used. [Feature] Secure Boot BUG=23460645 Change-Id: I79bd3f4f29ca1b1b3aa4ca43b8e8d60382341dbc Signed-off-by: tadd.kao <tadd.kao@mediatek.com> CR-Id: ALPS02363269
* UPSTREAM: lib/string.c: introduce strreplace()Rasmus Villemoes2017-04-112-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | Strings are sometimes sanitized by replacing a certain character (often '/') by another (often '!'). In a few places, this is done the same way Schlemiel the Painter would do it. Others are slightly smarter but still do multiple strchr() calls. Introduce strreplace() to do this using a single function call and a single pass over the string. One would expect the return value to be one of three things: void, s, or the number of replacements made. I chose the fourth, returning a pointer to the end of the string. This is more likely to be useful (for example allowing the caller to avoid a strlen call). BUG: 27175947 Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> Cc: "Theodore Ts'o" <tytso@mit.edu> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Neil Brown <neilb@suse.de> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Joe Perches <joe@perches.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Change-Id: I1ddb88534a189f2e78ae1b5b074c0662781c7665
* lib/decompress: set the compressor name to NULL on errorAneesh Kumar K.V2017-04-111-1/+4
| | | | | | | | | | | | Without this we end up using the previous name of the compressor in the loop in unpack_rootfs. For example we get errors like "compression method gzip not configured" even when we have CONFIG_DECOMPRESS_GZIP enabled. Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* lib/decompress.c: consistency of compress formats for kernel imageHaesung Kim2017-04-111-2/+2
| | | | | | | | | | | | Magic number of compress formats for kernel image is defined by two bytes. These numbers are written in hexadecimal number, nevertheless magic number for only gunzip is written in octal number. The formats should be consistent for readability. Therefore, magic numbers for gunzip are also defined by hexadecimal number. Signed-off-by: Haesung Kim <matia.kim@lge.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* arm: mediate; remove file open apissu-ying hung2017-04-114-75/+50
| | | | | | | User request_firmware api to read CONNSYS patch binary instead of file_open apiq Change-Id: I87982afa8b47958e899a7af8ab0d04a72e3f771a Signed-off-by: ssu-ying hung <ssu-ying.hung@mediatek.com>
* wakeup: Add last wake up source logging for suspend abort reason.Ruchi Kandoi2017-04-111-3/+19
| | | | | | | | | | | | There is a possibility that a wakeup source event is received after the device prepares to suspend which might cause the suspend to abort. This patch adds the functionality of reporting the last active wakeup source which is currently not active but caused the suspend to abort reason via the /sys/kernel/power/last_wakeup_reason file. Change-Id: I1760d462f497b33e425f5565cb6cff5973932ec3 Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
* Power: Report suspend times from last_suspend_timejinqian2017-04-112-0/+52
| | | | | | | | | This node epxorts two values separated by space. From left to right: 1. time spent in suspend/resume process 2. time spent sleep in suspend state Change-Id: I2cb9a9408a5fd12166aaec11b935a0fd6a408c63
* net: ping: Return EAFNOSUPPORT when appropriate.Lorenzo Colitti2017-04-112-3/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. For an IPv4 ping socket, ping_check_bind_addr does not check the family of the socket address that's passed in. Instead, make it behave like inet_bind, which enforces either that the address family is AF_INET, or that the family is AF_UNSPEC and the address is 0.0.0.0. 2. For an IPv6 ping socket, ping_check_bind_addr returns EINVAL if the socket family is not AF_INET6. Return EAFNOSUPPORT instead, for consistency with inet6_bind. 3. Make ping_v4_sendmsg and ping_v6_sendmsg return EAFNOSUPPORT instead of EINVAL if an incorrect socket address structure is passed in. 4. Make IPv6 ping sockets be IPv6-only. The code does not support IPv4, and it cannot easily be made to support IPv4 because the protocol numbers for ICMP and ICMPv6 are different. This makes connect(::ffff:192.0.2.1) fail with EAFNOSUPPORT instead of making the socket unusable. Among other things, this fixes an oops that can be triggered by: int s = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP); struct sockaddr_in6 sin6 = { .sin6_family = AF_INET6, .sin6_addr = in6addr_any, }; bind(s, (struct sockaddr *) &sin6, sizeof(sin6)); [backport of net 9145736d4862145684009d6a72a6e61324a9439e] Change-Id: If06ca86d9f1e4593c0d6df174caca3487c57a241 Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* proc: make oom adjustment files user read-onlyRom Lemarchand2017-04-111-2/+2
| | | | | | | | Make oom_adj and oom_score_adj user read-only. Bug: 19636629 Change-Id: I055bb172d5b4d3d856e25918f3c5de8edf31e4a3 Signed-off-by: Rom Lemarchand <romlem@google.com>
* remove filp_open in bt driverStanley Yeh2017-04-111-57/+0
| | | | Change-Id: I0c8d1539891af9370ba8b364c6eaab8473c8ca0c
* Wireless regulatory rules file is emptyEddie Chen2017-04-111-16/+1239
| | | | | | | | CONFIG_CFG80211_INTERNAL_REGDB=y needs rules in db.txt Use official release on http://drvbp1.linux-foundation.org/~mcgrof/rel-html/wireless-regdb/ Fix the empty db.txt problem. Signed-off-by: Eddie Chen <eddie.chen@mediatek.com>
* drivers: mediatek: battery_meter: Reduce debug logTim Kryger2017-04-111-1/+1
| | | | | | | | Reduce the amount of information printed to the kernel log. Bug: 27767950 Change-Id: Ibd3b84615bc50bdc82673ee7fc2ff07e97a45c37 Signed-off-by: Tim Kryger <tkryger@google.com>
* PM: Disable unnecessary loggingTim Kryger2017-04-111-2/+0
| | | | | | | | Switch off extra debug prints that clutters the log. Bug: 27767950 Change-Id: I5344729b8c34d8121b334f2f84bb0afa1e64c583 Signed-off-by: Tim Kryger <tkryger@google.com>
* A2DP performance improvement.David Chu2017-04-111-2/+2
| | | | | | | Replaced busy udelay loop with usleep_range to reduce CPU usage in stp_sdio_tx_rx. Bug: 27713674
* arm:mediatek: Resolve wmtFunCtrl wakelock issuessu-ying hung2017-04-114-13/+91
| | | | | | | | 1.add the unlock step in some error case 2.add a timer to control the abnormal flow Change-Id: Ief9108eae213214123c8c68aaa83eafc7101bec9 Signed-off-by: ssu-ying hung <ssu-ying.hung@mediatek.com>
* perf: Do not double freePeter Zijlstra2017-04-111-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | In case of: err_file: fput(event_file), we'll end up calling perf_release() which in turn will free the event. Do not then free the event _again_. Change-Id: Ic1de33d0e29e577a1fc2e00c35bf44df26d96ab6 Tested-by: Alexander Shishkin <alexander.shishkin@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: dvyukov@google.com Cc: eranian@google.com Cc: oleg@redhat.com Cc: panand@redhat.com Cc: sasha.levin@oracle.com Cc: vince@deater.net Link: http://lkml.kernel.org/r/20160224174947.697350349@infradead.org Signed-off-by: Ingo Molnar <mingo@kernel.org> [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* power: align wakeup_sources formatyangdongdong2017-04-111-2/+2
| | | | | | | | This aligns every column of elements in wakeup_sources to conveniently check any specific column for suspicious power consumption wakeup source or for other easily human readable purpose. Signed-off-by: yangdongdong <yangdongdong@xiaomi.com>
* lib/xz: enable all filters by default in KconfigLasse Collin2017-04-111-12/+12
| | | | | | | | | | | | | | | | This restores the old behavior that existed before 2013-02-22, when changes were made by 64dbfb444c150 ("decompressors: drop dependency on CONFIG_EXPERT") and 5dc49c75a2 ("decompressors: make the default XZ_DEC_* config match the selected architecture"). Disabling the filters only makes sense on embedded systems. Signed-off-by: Lasse Collin <lasse.collin@tukaani.org> Acked-by: Kyle McMartin <kyle@infradead.org> Cc: Florian Fainelli <f.fainelli@gmail.com> Cc: Phillip Lougher <phillip@lougher.demon.co.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* lib/xz: add comments for the intentionally missing break statementsLasse Collin2017-04-111-0/+4
| | | | | | Signed-off-by: Lasse Collin <lasse.collin@tukaani.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* cpuidle: don't disable cpuidle when entering suspendTim Murray2017-04-111-3/+0
| | | | | | | | | | cpuidle was disabled while entering suspend as part of commit 8651f97bd951d0bb1c10fa24e3fa3455193f3548 in order to work around some ACPI bugs. However, there's no reason to do this on modern platforms. Leaving cpuidle enabled can result in improved power consumption if dpm_resume_noirq runs for a significant time. Change-Id: Ie182785b176f448698c0264eba554d1e315e8a06
* Revert "netfilter: use jump_label for nf_hooks"jollaman9992017-04-112-33/+6
| | | | | | | This breaks tethering and some apps that use filtering when CONFIG_JUMP_LABEL is enabled. This reverts commit a2d7ec58ac09f30ab726f216827f7c7095b2a98f.
* defconfig: enable LMK ADJ RBTREEMoyster2017-04-111-0/+1
|
* drivers:lmk: implement task's adj rbtreeYi-wei Zhao2017-04-113-0/+118
| | | | | | | | | | | | | | | | | | | | | | | | | | Based on the current LMK implementation, LMK has to scan all processes to select the correct task to kill during low memory. The basic idea for the optimization is to : queue all tasks with oom_score_adj priority, and then LMK just selects the proper task from the queue(rbtree) to kill. performance improvement: current: average time to find a task to kill : 1004us optimized: average time to find a task to kill: 43us Change-Id: I32504e9f2f370d58c038eea7457d95c8ed8b6b9b Signed-off-by: Hong-Mei Li <a21834@motorola.com> Signed-off-by: Yi-wei Zhao <gbjc64@motorola.com> Reviewed-on: http://gerrit.mot.com/701205 SLTApproved: Slta Waiver <sltawvr@motorola.com> Tested-by: Jira Key <jirakey@motorola.com> Submit-Approved: Jira Key <jirakey@motorola.com> Conflicts: drivers/staging/android/Kconfig include/linux/sched.h
* fs: support task's adj rbtreeYi-wei Zhao2017-04-112-0/+12
| | | | | | | | | | | | | Add (or del) a task to (or from) task's adj rbtree when its oom_score_adj is modified. Change-Id: I8a9490c6f30f42f6e4ed8f7fa9249f6da6177ae2 Signed-off-by: Hong-Mei Li <a21834@motorola.com> Signed-off-by: Yi-wei Zhao <gbjc64@motorola.com> Reviewed-on: http://gerrit.mot.com/701206 SLTApproved: Slta Waiver <sltawvr@motorola.com> Tested-by: Jira Key <jirakey@motorola.com> Submit-Approved: Jira Key <jirakey@motorola.com>
* kernel: support task's adj rbtreeYi-wei Zhao2017-04-112-0/+2
| | | | | | | | | | | | | Add (or del) a task to (or from) task's adj rbtree when a task is created or exit. Change-Id: Ic63e03355a1fed8c500097bad223c59c742a2346 Signed-off-by: Hong-Mei Li <a21834@motorola.com> Signed-off-by: Yi-wei Zhao <gbjc64@motorola.com> Reviewed-on: http://gerrit.mot.com/701207 SLTApproved: Slta Waiver <sltawvr@motorola.com> Tested-by: Jira Key <jirakey@motorola.com> Submit-Approved: Jira Key <jirakey@motorola.com>
* defconfig: disable config_jump_label for stabilityMoyster2017-04-111-1/+1
|
* binder: use group leader instead of open threadMartijn Coenen2017-04-111-3/+3
| | | | | | | | | | | | | | | The binder allocator assumes that the thread that called binder_open will never die for the lifetime of that proc. That thread is normally the group_leader, however it may not be. Use the group_leader instead of current. Bug: 35707103 Test: Created test case to open with temporary thread Change-Id: Id693f74b3591f3524a8c6e9508e70f3e5a80c588 Signed-off-by: Todd Kjos <tkjos@google.com> Signed-off-by: Martijn Coenen <maco@android.com>
* input: evdev: Move wake_lock_destroy callAnurag Singh2017-04-111-1/+1
| | | | | | | | | | | | | | Calling wake_lock_destroy from inside a spinlock protected region (or, in general, from atomic context) leads to a 'scheduling while atomic bug' because the internal wakeup source deletion logic calls synchronize_rcu, which can sleep. Moreover, since the interal lists are already protected with RCUs and spinlocks, putting the wake_lock_destroy call in a spinlock is redundant. Change-Id: I10a2239b664a5f43e54495f24fe588fb09282305 Signed-off-by: Anurag Singh <anursing@codeaurora.org>
* UPSTREAM staging: ion: Fix error handling in ion_buffer_createRohit kumar2017-04-111-10/+4
| | | | | | | | | | | | | | | | This patch fixes error handling case when buffer->pages allocation fails. Also, it removes unreachable code of checking ret variable although it is not updated. Signed-off-by: Rohit kumar <rohit.kr@samsung.com> Reviewed-by: Laura Abbott <labbott@redhat.com> Suggested-by: Pintu Kumar <pintu.k@samsung.com> Reviewed-by: Pintu Kumar <pintu.k@samsung.com> Reviewed-by: Gioh Kim <gioh.kim@lge.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit a56d092aa94ebcc9452ddaa47423b9a478aa6aa5) Change-Id: Ic38b8e3ef0a21de4e38e58b4bb942535fe671ae5 Bug: 34283718
* UPSTREAM: regulator: core: Fix regualtor_ena_gpio_free not to access pin ↵Seung-Woo Kim2017-04-111-0/+2
| | | | | | | | | | | | after freeing After freeing pin from regulator_ena_gpio_free, loop can access the pin. So this patch fixes not to access pin after freeing. Bug: 35399757 Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com> Signed-off-by: Mark Brown <broonie@kernel.org> (cherry picked from commit 60a2362f769cf549dc466134efe71c8bf9fbaaba)
* crypto: arm - ignore generated SHA2 assembly filesBaruch Siach2017-04-111-0/+2
| | | | | | | | | | | These files are generated since commits f2f770d74a8d (crypto: arm/sha256 - Add optimized SHA-256/224, 2015-04-03) and c80ae7ca3726 (crypto: arm/sha512 - accelerated SHA-512 using ARM generic ASM and NEON, 2015-05-08). Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Signed-off-by: Baruch Siach <baruch@tkos.co.il> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* ANDROID: sched: add a counter to track fsyncJin Qian2017-04-114-0/+12
| | | | | Change-Id: I6c138de5b2332eea70f57e098134d1d141247b3f Signed-off-by: Jin Qian <jinqian@google.com>
* tcp: initialize tp->copied_seq in case of cross SYN connectionEric Dumazet2017-04-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 142a2e7ece8d8ac0e818eb2c91f99ca894730e2a ] Dmitry provided a syzkaller (http://github.com/google/syzkaller) generated program that triggers the WARNING at net/ipv4/tcp.c:1729 in tcp_recvmsg() : WARN_ON(tp->copied_seq != tp->rcv_nxt && !(flags & (MSG_PEEK | MSG_TRUNC))); His program is specifically attempting a Cross SYN TCP exchange, that we support (for the pleasure of hackers ?), but it looks we lack proper tcp->copied_seq initialization. Thanks again Dmitry for your report and testings. Change-Id: If950abf82188c20925eecfa8b9bceee90ccc2e78 Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Dmitry Vyukov <dvyukov@google.com> Tested-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* net/llc: avoid BUG_ON() in skb_orphan()Eric Dumazet2017-04-112-0/+6
| | | | | | | | | | | | | | | | | | | | | It seems nobody used LLC since linux-3.12. Fortunately fuzzers like syzkaller still know how to run this code, otherwise it would be no fun. Setting skb->sk without skb->destructor leads to all kinds of bugs, we now prefer to be very strict about it. Ideally here we would use skb_set_owner() but this helper does not exist yet, only CAN seems to have a private helper for that. Fixes: 376c7311bdb6 ("net: add a temporary sanity check in skb_orphan()") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit 8b74d439e1697110c5e5c600643e823eb1dd0762) Change-Id: I17412f0afe525d556ab072a7b89d5839845a2ce7
* sctp: deny peeloff operation on asocs with threads sleeping on itMarcelo Ricardo Leitner2017-04-111-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 2dcab5984841 ("sctp: avoid BUG_ON on sctp_wait_for_sndbuf") attempted to avoid a BUG_ON call when the association being used for a sendmsg() is blocked waiting for more sndbuf and another thread did a peeloff operation on such asoc, moving it to another socket. As Ben Hutchings noticed, then in such case it would return without locking back the socket and would cause two unlocks in a row. Further analysis also revealed that it could allow a double free if the application managed to peeloff the asoc that is created during the sendmsg call, because then sctp_sendmsg() would try to free the asoc that was created only for that call. This patch takes another approach. It will deny the peeloff operation if there is a thread sleeping on the asoc, so this situation doesn't exist anymore. This avoids the issues described above and also honors the syscalls that are already being handled (it can be multiple sendmsg calls). Joint work with Xin Long. Fixes: 2dcab5984841 ("sctp: avoid BUG_ON on sctp_wait_for_sndbuf") Cc: Alexander Popov <alex.popov@linux.com> Cc: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit dfcb9f4f99f1e9a49e43398a7bfbf56927544af1) Change-Id: I6a2e7a0dd378ff13adae64ebf7856d9962de7e8a
* ALSA: Remove transfer_ack_{begin,end} callbacks from struct snd_pcm_runtimeLars-Peter Clausen2017-04-113-26/+2
| | | | | | | | | | | | | | | | | While there is nothing wrong with the transfer_ack_begin and transfer_ack_end callbacks per-se, the last documented user was part of the alsa-driver 0.5.12a package, which was released 14 years ago and even predates the upstream integration of the ALSA core and has subsequently been superseded by newer alsa-driver releases. This seems to indicate that there is no need for having these callbacks and they are just cruft that can be removed. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Takashi Iwai <tiwai@suse.de> (cherry picked from commit 53e597b1d194910bef53ed0632da329fef497904) Change-Id: Ifa69c873640b171aa1843335b2b3cb856d29bb1a
* ipc/shm: Fix shmat mmap nil-page protectionDavidlohr Bueso2017-04-111-4/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The issue is described here, with a nice testcase: https://bugzilla.kernel.org/show_bug.cgi?id=192931 The problem is that shmat() calls do_mmap_pgoff() with MAP_FIXED, and the address rounded down to 0. For the regular mmap case, the protection mentioned above is that the kernel gets to generate the address -- arch_get_unmapped_area() will always check for MAP_FIXED and return that address. So by the time we do security_mmap_addr(0) things get funky for shmat(). The testcase itself shows that while a regular user crashes, root will not have a problem attaching a nil-page. There are two possible fixes to this. The first, and which this patch does, is to simply allow root to crash as well -- this is also regular mmap behavior, ie when hacking up the testcase and adding mmap(... |MAP_FIXED). While this approach is the safer option, the second alternative is to ignore SHM_RND if the rounded address is 0, thus only having MAP_SHARED flags. This makes the behavior of shmat() identical to the mmap() case. The downside of this is obviously user visible, but does make sense in that it maintains semantics after the round-down wrt 0 address and mmap. Passes shm related ltp tests. Change-Id: I47b065f965427409642892fb139d89fb5603b187 Link: http://lkml.kernel.org/r/1486050195-18629-1-git-send-email-dave@stgolabs.net Signed-off-by: Davidlohr Bueso <dbueso@suse.de> Reported-by: Gareth Evans <gareth.evans@contextis.co.uk> Cc: Manfred Spraul <manfred@colorfullife.com> Cc: Michael Kerrisk <mtk.manpages@googlemail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* BACKPORT: tcp: avoid infinite loop in tcp_splice_read()Eric Dumazet2017-04-111-0/+6
| | | | | | | | | | | | | | | | | | | | Splicing from TCP socket is vulnerable when a packet with URG flag is received and stored into receive queue. __tcp_splice_read() returns 0, and sk_wait_data() immediately returns since there is the problematic skb in queue. This is a nice way to burn cpu (aka infinite loop) and trigger soft lockups. Again, this gem was found by syzkaller tool. Fixes: 9c55e01c0cc8 ("[TCP]: Splice receive support.") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: Willy Tarreau <w@1wt.eu> Signed-off-by: David S. Miller <davem@davemloft.net> Change-Id: Ic8000917deb6ce7ca4ce2af0c8ce951355051ec9
generated by cgit v1.2.3 (git 2.39.1) at 2026-03-26 03:18:21 +0000