aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* defconfig: enable chacha20 algoMister Oyster2017-12-141-0/+1
|
* UPSTREAM: crypto: chacha20 - Add a generic ChaCha20 stream cipher implementationMartin Willi2017-12-143-0/+230
| | | | | | | | | | | | | | | | | | ChaCha20 is a high speed 256-bit key size stream cipher algorithm designed by Daniel J. Bernstein. It is further specified in RFC7539 for use in IETF protocols as a building block for the ChaCha20-Poly1305 AEAD. This is a portable C implementation without any architecture specific optimizations. It uses a 16-byte IV, which includes the 12-byte ChaCha20 nonce prepended by the initial block counter. Some algorithms require an explicit counter value, for example the mentioned AEAD construction. Signed-off-by: Martin Willi <martin@strongswan.org> Acked-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> (cherry picked from commit c08d0e647305c3f8f640010a56c9e4bafb9488d3) Change-Id: I5892b1451e46f915c0ed8e711bdded9e6f4a4aae Signed-off-by: Eric Biggers <ebiggers@google.com>
* UPSTREAM: android: binder: fix type mismatch warningArnd Bergmann2017-12-141-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allowing binder to expose the 64-bit API on 32-bit kernels caused a build warning: drivers/android/binder.c: In function 'binder_transaction_buffer_release': drivers/android/binder.c:2220:15: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] fd_array = (u32 *)(parent_buffer + fda->parent_offset); ^ drivers/android/binder.c: In function 'binder_translate_fd_array': drivers/android/binder.c:2445:13: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] fd_array = (u32 *)(parent_buffer + fda->parent_offset); ^ drivers/android/binder.c: In function 'binder_fixup_parent': drivers/android/binder.c:2511:18: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] This adds extra type casts to avoid the warning. However, there is another problem with the Kconfig option: turning it on or off creates two incompatible ABI versions, a kernel that has this enabled cannot run user space that was built without it or vice versa. A better solution might be to leave the option hidden until the binder code is fixed to deal with both ABI versions. Fixes: e8d2ed7db7c3 ("Revert "staging: Fix build issues with new binder API"") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 1c363eaece2752c5f8b1b874cb4ae435de06aa66) Change-Id: Id09185a6f86905926699e92a2b30201b8a5e83e5
* binder: fix proc->files use-after-freeTodd Kjos2017-12-141-13/+31
| | | | | | | | | | | | | | | | | proc->files cleanup is initiated by binder_vma_close. Therefore a reference on the binder_proc is not enough to prevent the files_struct from being released while the binder_proc still has a reference. This can lead to an attempt to dereference the stale pointer obtained from proc->files prior to proc->files cleanup. This has been seen once in task_get_unused_fd_flags() when __alloc_fd() is called with a stale "files". The fix is to protect proc->files with a mutex to prevent cleanup while in use. Bug: 69164715 Change-Id: I90fc117e004ecefc5336779cd7cd24faad37bd86 Signed-off-by: Todd Kjos <tkjos@google.com>
* crypto: ablk_helper - Fix cryptd reorderingHerbert Xu2017-12-141-2/+4
| | | | | | | | | | | | This patch fixes an old bug where requests can be reordered because some are processed by cryptd while others are processed directly in softirq context. The fix is to always postpone to cryptd if there are currently requests outstanding from the same tfm. Change-Id: I7d2d507392c25991cf3b4544e40eb352df54b3eb Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* crypto: cryptd - Add helpers to check whether a tfm is queuedHerbert Xu2017-12-142-19/+119
| | | | | | | | | | | | | | This patch adds helpers to check whether a given tfm is currently queued. This is meant to be used by ablk_helper and similar entities to ensure that no reordering is introduced because of requests queued in cryptd with respect to requests being processed in softirq context. The per-cpu queue length limit is also increased to 1000 in line with network limits. Change-Id: I59aa3397d701a80dcff257d26635c83038839d93 Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* crypto: af_alg - Forbid the use internal algorithmsHerbert Xu2017-12-141-1/+4
| | | | | | | | | | | | | The bit CRYPTO_ALG_INTERNAL was added to stop af_alg from accessing internal algorithms. However, af_alg itself was never modified to actually stop that bit from being used by the user. Therefore the user could always override it by specifying the relevant bit in the type and/or mask. This patch silently discards the bit in both type and mask. Change-Id: Ia07e574c69389da594155bfdf83f7937c55026c8 Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* crypto: cryptd - process CRYPTO_ALG_INTERNALStephan Mueller2017-12-142-9/+43
| | | | | | | | | | The cryptd is used as a wrapper around internal ciphers. Therefore, the cryptd must process the internal cipher by marking cryptd as internal if the underlying cipher is an internal cipher. Change-Id: I0c35f3b981337ae6427e8737a9a6f8d3016ccefc Signed-off-by: Stephan Mueller <smueller@chronox.de> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* crypto: testmgr - use CRYPTO_ALG_INTERNALStephan Mueller2017-12-141-6/+6
| | | | | | | | | | | Allocate the ciphers irrespectively if they are marked as internal or not. As all ciphers, including the internal ciphers will be processed by the testmgr, it needs to be able to allocate those ciphers. Change-Id: Ic5d813099b950cdb9b04e8eebbd01a4f34139eb7 Signed-off-by: Stephan Mueller <smueller@chronox.de> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* crypto: api - prevent helper ciphers from being usedStephan Mueller2017-12-142-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Several hardware related cipher implementations are implemented as follows: a "helper" cipher implementation is registered with the kernel crypto API. Such helper ciphers are never intended to be called by normal users. In some cases, calling them via the normal crypto API may even cause failures including kernel crashes. In a normal case, the "wrapping" ciphers that use the helpers ensure that these helpers are invoked such that they cannot cause any calamity. Considering the AF_ALG user space interface, unprivileged users can call all ciphers registered with the crypto API, including these helper ciphers that are not intended to be called directly. That means, with AF_ALG user space may invoke these helper ciphers and may cause undefined states or side effects. To avoid any potential side effects with such helpers, the patch prevents the helpers to be called directly. A new cipher type flag is added: CRYPTO_ALG_INTERNAL. This flag shall be used to mark helper ciphers. These ciphers can only be used if the caller invoke the cipher with CRYPTO_ALG_INTERNAL in the type and mask field. Change-Id: I5fd76b3e7c83d064cce9f61340d57bdaa14171ba Signed-off-by: Stephan Mueller <smueller@chronox.de> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* Fix arch/arm/crypto/sha256_glue.cSami Tolvanen2017-12-141-1/+1
| | | | | | | | MODULE_ALIAS_CRYPTO is not defined, use MODULE_ALIAS. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Change-Id: I24803dbbbf7ac7889bc027f69af371b594eca835 (cherry picked from 5eb3cca16fcf9c62753058aaf73bb12b71acba79)
* mtk: ged: heapoverflow fixlulu22017-12-131-5/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Patch Type: Customer Request CR ID: ALPS03342077 Severity: Critical Description: [Buganizer]Security Vulnerability 37205193 - A ***6797 driver bug(ged_HeapOverflow) [[Title for Customer]] [Buganizer]Security Vulnerability 37205193 - A ***6797 driver bug(ged_HeapOverflow) [[Problem Description]] [Buganizer]Security Vulnerability 37205193 - A ***6797 driver bug(ged_HeapOverflow) [[Potential Impa*** of the solution]] N/A [[Modules to be verified after taking p***h]] N/A [[問題標題]] [Buganizer]Security Vulnerability 37205193 - A ***6797 driver bug(ged_HeapOverflow) [[問題現象]] [Buganizer]Security Vulnerability 37205193 - A ***6797 driver bug(ged_HeapOverflow) [[解法可能帶來的影響]] (請填寫於此行下方，並描述如果合入這個p***h可能會有什麼trade off的改變，如perfo******e降低、UI改變等等) N/A [[建議驗證模塊]] (請填寫於此行下方，並建議客戶合了此p***h後要驗證哪些module或feature) N/A [[Title for Customer]] Security Vulnerability [[Problem Description]] ged_HeapOverflow / kernel exception [[Potential Impa*** of the solution]] none [[Modules to be verified after taking p***h]] OpenGL|ES releated [[問題標題]] Security Vulnerability [[問題現象]] ged_HeapOverflow / kernel exception [[解法可能帶來的影響]] (請填寫於此行下方，並描述如果合入這個p***h可能會有什麼trade off的改變，如perfo******e降低、UI改變等等) 無 [[建議驗證模塊]] (請填寫於此行下方，並建議客戶合了此p***h後要驗證哪些module或feature) OpenGL|ES 相關N/A Associated Files: kernel-3.18/drivers/misc/mediatek/gpu/ged/src/ged_main.c Signed-off-by: Mister Oyster <oysterized@gmail.com>
* power: mediatek: add voltage_now battery propertyTodd Poynor2017-12-131-0/+4
| | | | | | | | | Add battery property voltage_now, in units of uV per power_supply standard. healthd and Android will use this value instead of the existing batt_vol property (which is unepxectedly in mV units). Change-Id: Ida25d702c30507ecedba4818a84be9baf66f67e0 Signed-off-by: Todd Poynor <toddpoynor@google.com>
* power: mediatek: send battery cold/overheat health status to userspaceTodd Poynor2017-12-131-1/+11
| | | | | Change-Id: I4daba069df9fe64f44f4ef064478e7b3a37f9f13 Signed-off-by: Todd Poynor <toddpoynor@google.com>
* power: mediatek: remove wireless power_supply if no kernel supportTodd Poynor2017-12-131-0/+14
| | | | | | | | Remove wireless power_supply entry if CONFIG_MTK_WIRELESS_CHARGER_SUPPORT is not enabled. Change-Id: I9cbb1d59c29b70c1adf314bf4a93e9e0c02cd431 Signed-off-by: Todd Poynor <toddpoynor@google.com>
* power: mediatek: use POWER_SUPPLY_STATUS_DISCHARGINGTodd Poynor2017-12-131-1/+1
| | | | | | | | | Battery discharging use "discharging" status instead of "not charging" (which is normally used for charger connected but not charging due to overtemperature or other battery health concerns). Change-Id: I836e7c6435f7a14695975b0df8364ed4671ee9ed Signed-off-by: Todd Poynor <toddpoynor@google.com>
* UPSTREAM: sctp: do not peel off an assoc from one netns to another oneXin Long2017-12-131-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now when peeling off an association to the sock in another netns, all transports in this assoc are not to be rehashed and keep use the old key in hashtable. As a transport uses sk->net as the hash key to insert into hashtable, it would miss removing these transports from hashtable due to the new netns when closing the sock and all transports are being freeed, then later an use-after-free issue could be caused when looking up an asoc and dereferencing those transports. This is a very old issue since very beginning, ChunYu found it with syzkaller fuzz testing with this series: socket$inet6_sctp() bind$inet6() sendto$inet6() unshare(0x40000000) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST() getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF() This patch is to block this call when peeling one assoc off from one netns to another one, so that the netns of all transport would not go out-sync with the key in hashtable. Note that this patch didn't fix it by rehashing transports, as it's difficult to handle the situation when the tuple is already in use in the new netns. Besides, no one would like to peel off one assoc to another netns, considering ipaddrs, ifaces, etc. are usually different. Bug: 70217214 Reported-by: ChunYu Wang <chunwang@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit df80cd9b28b9ebaa284a41df611dbf3a2d05ca74) Signed-off-by: Greg Hackmann <ghackmann@google.com> Change-Id: I0efd280bb7563bd76a2553233ce1a82e7a03be3e
* cpuset: Add allow_attach hook for cpusets on android.Riley Andrews2017-12-111-0/+18
| | | | Change-Id: Ic1b61b2bbb7ce74c9e9422b5e22ee9078251de21
* cpuset: Make cpusets restore on hotplugRiley Andrews2017-12-111-15/+33
| | | | | | | | | | | | This deliberately changes the behavior of the per-cpuset cpus file to not be effected by hotplug. When a cpu is offlined, it will be removed from the cpuset/cpus file. When a cpu is onlined, if the cpuset originally requested that that cpu was part of the cpuset, that cpu will be restored to the cpuset. The cpus files still have to be hierachical, but the ranges no longer have to be out of the currently online cpus, just the physically present cpus. Change-Id: I3efbae24a1f6384be1e603fb56f0d3baef61d924
* ext4: fix data corruption for mmap writesgregkh@linuxfoundation.org2017-12-101-5/+19
| | | | | | | | | | | | | | | | | | | | | | | | | 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jan Kara <jack@suse.cz> commit a056bdaae7a181f7dcc876cfab2f94538e508709 upstream. mpage_submit_page() can race with another process growing i_size and writing data via mmap to the written-back page. As mpage_submit_page() samples i_size too early, it may happen that ext4_bio_write_page() zeroes out too large tail of the page and thus corrupts user data. Fix the problem by sampling i_size only after the page has been write-protected in page tables by clear_page_dirty_for_io() call. Reported-by: Michael Zimmer <michael@swarm64.com> CC: stable@vger.kernel.org Fixes: cb20d5188366f04d96d2e07b1240cc92170ade40 Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* BACKPORT: dm bufio: don't take the lock in dm_bufio_shrink_countMikulas Patocka2017-12-101-8/+8
| | | | | | | | | | | | | | | | dm_bufio_shrink_count() is called from do_shrink_slab to find out how many freeable objects are there. The reported value doesn't have to be precise, so we don't need to take the dm-bufio lock. Suggested-by: David Rientjes <rientjes@google.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Bug: 64122284 Change-Id: Id2c3446e03e865f424be8666b1ee0822b9e33a63 (cherry picked from commit d12067f428c037b4575aaeb2be00847fc214c24a) Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>
* BACKPORT: dm bufio: avoid sleeping while holding the dm_bufio lockDouglas Anderson2017-12-101-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We've seen in-field reports showing _lots_ (18 in one case, 41 in another) of tasks all sitting there blocked on: mutex_lock+0x4c/0x68 dm_bufio_shrink_count+0x38/0x78 shrink_slab.part.54.constprop.65+0x100/0x464 shrink_zone+0xa8/0x198 In the two cases analyzed, we see one task that looks like this: Workqueue: kverityd verity_prefetch_io __switch_to+0x9c/0xa8 __schedule+0x440/0x6d8 schedule+0x94/0xb4 schedule_timeout+0x204/0x27c schedule_timeout_uninterruptible+0x44/0x50 wait_iff_congested+0x9c/0x1f0 shrink_inactive_list+0x3a0/0x4cc shrink_lruvec+0x418/0x5cc shrink_zone+0x88/0x198 try_to_free_pages+0x51c/0x588 __alloc_pages_nodemask+0x648/0xa88 __get_free_pages+0x34/0x7c alloc_buffer+0xa4/0x144 __bufio_new+0x84/0x278 dm_bufio_prefetch+0x9c/0x154 verity_prefetch_io+0xe8/0x10c process_one_work+0x240/0x424 worker_thread+0x2fc/0x424 kthread+0x10c/0x114 ...and that looks to be the one holding the mutex. The problem has been reproduced on fairly easily: 0. Be running Chrome OS w/ verity enabled on the root filesystem 1. Pick test patch: http://crosreview.com/412360 2. Install launchBalloons.sh and balloon.arm from http://crbug.com/468342 ...that's just a memory stress test app. 3. On a 4GB rk3399 machine, run nice ./launchBalloons.sh 4 900 100000 ...that tries to eat 4 * 900 MB of memory and keep accessing. 4. Login to the Chrome web browser and restore many tabs With that, I've seen printouts like: DOUG: long bufio 90758 ms ...and stack trace always show's we're in dm_bufio_prefetch(). The problem is that we try to allocate memory with GFP_NOIO while we're holding the dm_bufio lock. Instead we should be using GFP_NOWAIT. Using GFP_NOIO can cause us to sleep while holding the lock and that causes the above problems. The current behavior explained by David Rientjes: It will still try reclaim initially because __GFP_WAIT (or __GFP_KSWAPD_RECLAIM) is set by GFP_NOIO. This is the cause of contention on dm_bufio_lock() that the thread holds. You want to pass GFP_NOWAIT instead of GFP_NOIO to alloc_buffer() when holding a mutex that can be contended by a concurrent slab shrinker (if count_objects didn't use a trylock, this pattern would trivially deadlock). This change significantly increases responsiveness of the system while in this state. It makes a real difference because it unblocks kswapd. In the bug report analyzed, kswapd was hung: kswapd0 D ffffffc000204fd8 0 72 2 0x00000000 Call trace: [<ffffffc000204fd8>] __switch_to+0x9c/0xa8 [<ffffffc00090b794>] __schedule+0x440/0x6d8 [<ffffffc00090bac0>] schedule+0x94/0xb4 [<ffffffc00090be44>] schedule_preempt_disabled+0x28/0x44 [<ffffffc00090d900>] __mutex_lock_slowpath+0x120/0x1ac [<ffffffc00090d9d8>] mutex_lock+0x4c/0x68 [<ffffffc000708e7c>] dm_bufio_shrink_count+0x38/0x78 [<ffffffc00030b268>] shrink_slab.part.54.constprop.65+0x100/0x464 [<ffffffc00030dbd8>] shrink_zone+0xa8/0x198 [<ffffffc00030e578>] balance_pgdat+0x328/0x508 [<ffffffc00030eb7c>] kswapd+0x424/0x51c [<ffffffc00023f06c>] kthread+0x10c/0x114 [<ffffffc000203dd0>] ret_from_fork+0x10/0x40 By unblocking kswapd memory pressure should be reduced. Suggested-by: David Rientjes <rientjes@google.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Bug: 64122284 Change-Id: I1ce9367c921d7ab07ca9e3d403c95cd0d333915c (cherry picked from commit 9ea61cac0b1ad0c09022f39fd97e9b99a2cfc2dc) Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>
* UPSTREAM: ALSA: timer: Call notifier in the same spinlockTakashi Iwai2017-12-081-118/+102
| | | | | | | | | | | | | | | snd_timer_notify1() is called outside the spinlock and it retakes the lock after the unlock. This is rather racy, and it's safer to move snd_timer_notify() call inside the main spinlock. The patch also contains a slight refactoring / cleanup of the code. Now all start/stop/continue/pause look more symmetric and a bit better readable. Bug: 37240993 Change-Id: Ib90099f88c8b04928a8cdd2808cd9e16da6d519c Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Siqi Lin <siqilin@google.com>
* BACKPORT: ALSA: timer: Fix race at concurrent readsTakashi Iwai2017-12-081-19/+15
| | | | | | | | | | | | | | snd_timer_user_read() has a potential race among parallel reads, as qhead and qused are updated outside the critical section due to copy_to_user() calls. Move them into the critical section, and also sanitize the relevant code a bit. Bug: 37240993 Change-Id: I7358a57638ef23eb7f97341eaee1f0dd4ba2795a Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Siqi Lin <siqilin@google.com> (cherry picked from commit 4dff5c7b7093b19c19d3a100f8a3ad87cb7cd9e7)
* BACKPORT: dentry name snapshotsAl Viro2017-12-086-42/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 49d31c2f389acfe83417083e1208422b4091cd9e upstream. take_dentry_name_snapshot() takes a safe snapshot of dentry name; if the name is a short one, it gets copied into caller-supplied structure, otherwise an extra reference to external name is grabbed (those are never modified). In either case the pointer to stable string is stored into the same structure. dentry must be held by the caller of take_dentry_name_snapshot(), but may be freely dropped afterwards - the snapshot will stay until destroyed by release_dentry_name_snapshot(). Intended use: struct name_snapshot s; take_dentry_name_snapshot(&s, dentry); ... access s.name ... release_dentry_name_snapshot(&s); Replaces fsnotify_oldname_...(), gets used in fsnotify to obtain the name to pass down with event. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> [carnil: backport 4.9: adjust context] [bwh: Backported to 3.16: - External names are not ref-counted, so copy them - Adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> [ghackmann@google.com: backported to 3.10: adjust context] Signed-off-by: Greg Hackmann <ghackmann@google.com> Change-Id: I612e687cbffa1a03107331a6b3f00911ffbebd8e Bug: 63689921
* BACKPORT: ALSA: timer: Handle disconnection more safelyTakashi Iwai2017-12-081-0/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 230323dac060123c340cf75997971145a42661ee ] Currently ALSA timer device doesn't take the disconnection into account very well; it merely unlinks the timer device at disconnection callback but does nothing else. Because of this, when an application accessing the timer device is disconnected, it may release the resource before actually closed. In most cases, it results in a warning message indicating a leftover timer instance like: ALSA: timer xxxx is busy? But basically this is an open race. This patch tries to address it. The strategy is like other ALSA devices: namely, - Manage card's refcount at each open/close - Wake up the pending tasks at disconnection - Check the shutdown flag appropriately at each possible call Note that this patch has one ugly hack to handle the wakeup of pending tasks. It'd be cleaner to introduce a new disconnect op to snd_timer_instance ops. But since it would lead to internal ABI breakage and it eventually increase my own work when backporting to stable kernels, I took a different path to implement locally in timer.c. A cleanup patch will follow at next for 4.5 kernel. Bug: 37240993 Change-Id: I05c7f0e7d28b63fc343091f800ceae9ec2afe4a4 Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=109431 Cc: <stable@vger.kernel.org> # v3.15+ Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Siqi Lin <siqilin@google.com> (cherry picked from commit 230323dac060123c340cf75997971145a42661ee)
* UPSTREAM: ALSA: timer: Fix missing queue indices reset at ↵Takashi Iwai2017-12-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SNDRV_TIMER_IOCTL_SELECT snd_timer_user_tselect() reallocates the queue buffer dynamically, but it forgot to reset its indices. Since the read may happen concurrently with ioctl and snd_timer_user_tselect() allocates the buffer via kmalloc(), this may lead to the leak of uninitialized kernel-space data, as spotted via KMSAN: BUG: KMSAN: use of unitialized memory in snd_timer_user_read+0x6c4/0xa10 CPU: 0 PID: 1037 Comm: probe Not tainted 4.11.0-rc5+ #2739 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 dump_stack+0x143/0x1b0 lib/dump_stack.c:52 kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:1007 kmsan_check_memory+0xc2/0x140 mm/kmsan/kmsan.c:1086 copy_to_user ./arch/x86/include/asm/uaccess.h:725 snd_timer_user_read+0x6c4/0xa10 sound/core/timer.c:2004 do_loop_readv_writev fs/read_write.c:716 __do_readv_writev+0x94c/0x1380 fs/read_write.c:864 do_readv_writev fs/read_write.c:894 vfs_readv fs/read_write.c:908 do_readv+0x52a/0x5d0 fs/read_write.c:934 SYSC_readv+0xb6/0xd0 fs/read_write.c:1021 SyS_readv+0x87/0xb0 fs/read_write.c:1018 This patch adds the missing reset of queue indices. Together with the previous fix for the ioctl/read race, we cover the whole problem. Reported-by: Alexander Potapenko <glider@google.com> Tested-by: Alexander Potapenko <glider@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> (cherry picked from commit ba3021b2c79b2fa9114f92790a99deb27a65b728) Signed-off-by: Connor O'Brien <connoro@google.com> Bug: 62201221 Change-Id: I8d3d97bb0e6c2eefd050bf46b860dd603fe3f4c6
* BACKPORT: ALSA: timer: Fix race between read and ioctlTakashi Iwai2017-12-081-0/+4
| | | | | | | | | | | | | | | | | | | | | | | The read from ALSA timer device, the function snd_timer_user_tread(), may access to an uninitialized struct snd_timer_user fields when the read is concurrently performed while the ioctl like snd_timer_user_tselect() is invoked. We have already fixed the races among ioctls via a mutex, but we seem to have forgotten the race between read vs ioctl. This patch simply applies (more exactly extends the already applied range of) tu->ioctl_lock in snd_timer_user_tread() for closing the race window. Reported-by: Alexander Potapenko <glider@google.com> Tested-by: Alexander Potapenko <glider@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> (cherry picked from commit d11662f4f798b50d8c8743f433842c3e40fe3378) Signed-off-by: Connor O'Brien <connoro@google.com> Bug: 62201221 Change-Id: I67a3b5153c39ce9f6d7571b5aa8faabe5e3dbb83
* ANDROID: scsi: Add segment checking in sg_readRoberto Pereira2017-12-081-0/+3
| | | | | | Bug: 65023233 Signed-off-by: Roberto Pereira <rpere@google.com> Change-Id: Ib45f402cf304f9b8bf18884738f92b9c3db55573
* ANDROID: usb: gadget: f_mtp: Return error if count is negativeJerry Zhang2017-12-081-0/+10
| | | | | | | | | | | | | | | If the user passes in a negative file size in a int64, this will compare to be smaller than buffer length, and it will get truncated to form a read length that is larger than the buffer length. To fix, return -EINVAL if the count argument is negative, so the loop will never happen. Bug: 37429972 Test: Test with PoC Change-Id: I5d52e38e6fbe2c17eb8c493f9eb81df6cfd780a4 Signed-off-by: Jerry Zhang <zhangjerry@google.com>
* cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODESrinivas Dasari2017-12-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | Buffer overread may happen as nl80211_set_station() reads 4 bytes from the attribute NL80211_ATTR_LOCAL_MESH_POWER_MODE without validating the size of data received when userspace sends less than 4 bytes of data with NL80211_ATTR_LOCAL_MESH_POWER_MODE. Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE to avoid the buffer overread. Fixes: 3b1c5a5307f ("{cfg,nl}80211: mesh power mode primitives and userspace access") Cc: stable@vger.kernel.org Bug: 36819059 Signed-off-by: Srinivas Dasari <dasaris@qti.qualcomm.com> Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git Git-commit: 8feb69c7bd89513be80eb19198d48f154b254021 Change-Id: Ie20993309501fd242782311b9fe787931f716116 CRs-Fixed: 2055013 Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org> (cherry picked from commit ac4f175b41aef6a924d0a8f1a79bca89b6ea62e0)
* drivers: mtk: move to /vendor/etc/firmwareMister Oyster2017-12-0812-23/+23
| | | | | | partially revert moving wifi to vendor/firmware : https://github.com/Moyster/android_kernel_m2note/commit/7bafe483fbd70668252f724ec04fa950fec4db3f
* f2fs: trace f2fs_lookupChao Yu2017-12-062-17/+88
| | | | | | | This patch adds trace for f2fs_lookup. Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: skip searching non-exist range in truncate_holeWeichao Guo2017-12-061-1/+1
| | | | | | | | | Let's skip entire non-exist area to speed up truncate_hole by using get_next_page_offset. Signed-off-by: Weichao Guo <guoweichao@huawei.com> Reviewed-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: expose some sectors to user in inline data or dentry caseJaegeuk Kim2017-12-061-0/+6
| | | | | | | | | | | If there's some data written through inline data or dentry, we need to shouw st_blocks. This fixes reporting zero blocks even though there is small written data. Cc: stable@vger.kernel.org Reviewed-by: Chao Yu <yuchao0@huawei.com> [Jaegeuk Kim: avoid link file for quotacheck] Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* Revert "FROMLIST: f2fs: expose some sectors to user in inline data or dentry ↵Mister Oyster2017-12-061-5/+0
| | | | | | case" This reverts commit 792a3af24945910b2e239bd4e43f878ea2908d9c.
* f2fs: avoid stale fi->gdirty_list pointerJaegeuk Kim2017-12-061-1/+3
| | | | | | | | When doing fault injection test, f2fs_evict_inode() didn't remove gdirty_list which incurs a kernel panic due to wrong pointer access. Reviewed-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs/crypto: drop crypto key at evict_inode onlyJaegeuk Kim2017-12-061-1/+0
| | | | | | | | This patch avoids dropping crypto key in f2fs_drop_inode, so we can guarantee it happens only at evict_inode. Reviewed-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: fix to avoid race when accessing last_disk_sizeChao Yu2017-12-063-2/+15
| | | | | | | | | last_disk_size could be wrong due to concurrently updating, so using i_sem semaphore to make last_disk_size updating exclusive to fix this issue. Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: Fix bool initialization/comparisonThomas Meyer2017-12-061-2/+2
| | | | | | | | Bool initializations should use true and false. Bool tests don't need comparisons. Signed-off-by: Thomas Meyer <thomas@m3y3r.de> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: give up CP_TRIMMED_FLAG if it drops discardsChao Yu2017-12-063-6/+14
| | | | | | | | In ->umount, once we drop remained discard entries, we should not set CP_TRIMMED_FLAG with another checkpoint. Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: trace f2fs_remove_discardChao Yu2017-12-062-0/+9
| | | | | | | This patch adds tracepoint to trace f2fs_remove_discard. Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: reduce cmd_lock coverage in __issue_discard_cmdChao Yu2017-12-061-8/+10
| | | | | | | | | __submit_discard_cmd may lead long latency due to exhaustion of I/O request resource in block layer, so issuing all discard under cmd_lock may lead to hangtask, in order to avoid that, let's reduce it's coverage. Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: split discard policyChao Yu2017-12-064-96/+88
| | | | | | | | | | | | | | There are many different scenarios such as fstrim, umount, urgent or background where we will issue discards, actually, they need use different policy in aspect of io aware, discard granularity, delay interval and so on. But now they just share one common discard policy, so there will be race when changing policy in between these scenarios, the interference of changing discard policy will be very serious. This patch changes to split discard policy for different scenarios. Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: wrap discard policyChao Yu2017-12-062-10/+40
| | | | | | | | | | | | | | | | | | | | This patch wraps scattered optional parameters into discard policy as below, later, with it we expect that we can adjust these parameters with proper strategy in different scenario. struct discard_policy { unsigned int min_interval; /* used for candidates exist */ unsigned int max_interval; /* used for candidates not exist */ unsigned int max_requests; /* # of discards issued per round */ unsigned int io_aware_gran; /* minimum granularity discard not be aware of I/O */ bool io_aware; /* issue discard in idle time */ bool sync; /* submit discard with REQ_SYNC flag */ }; This patch doesn't change any logic of codes. Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: support issuing/waiting discard in rangeChao Yu2017-12-063-23/+109
| | | | | | | | | | | | | | Fstrim intends to trim invalid blocks of filesystem only with specified range and granularity, but actually, it will issue all previous cached discard commands which may be out-of-range and be with unmatched granularity, it's unneeded. In order to fix above issues, this patch introduces new helps to support to issue and wait discard in range and adds a new fstrim_list for tracking in-flight discard from ->fstrim. Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: fix to flush multiple device in checkpointChao Yu2017-12-064-0/+41
| | | | | | | | | | If f2fs manages multiple devices, in checkpoint, we need to issue flush in those devices which contain dirty data/node in their cache before we write checkpoint region, otherwise, filesystem metadata could be corrupted if hitting SPO after checkpoint. Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: enhance multiple device flushChao Yu2017-12-069-21/+86
| | | | | | | | | | | | | When multiple device feature is enabled, during ->fsync we will issue flush in all devices to make sure node/data of the file being persisted into storage. But some flushes of device could be unneeded as file's data may be not writebacked into those devices. So this patch adds and manage bitmap per inode in global cache to indicate which device is dirty and it needs to issue flush during ->fsync, hence, we could improve performance of fsync in scenario of multiple device. Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: fix to show ino management cache size correctlyChao Yu2017-12-061-1/+1
| | | | | | | | | It needs to stat size of ino management cache with all type instead of orphan ino type. Fixes: 652be55162dc ("f2fs: show # of orphan inodes") Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
* f2fs: drop FI_UPDATE_WRITE tag after f2fs_issue_flushChao Yu2017-12-061-2/+4
| | | | | | | | If we failed to issue flush in ->fsync, we need to keep FI_UPDATE_WRITE flag to make sure triggering flush in next ->fsync. Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-03-17 17:32:09 +0000