)]}' { "log": [ { "commit": "b0d04fb56b3173626a15406d69f3026ca313057f", "tree": "959884c578b16c2ce041ecaf17ee77ccd382c0b0", "parents": [ "14dbc56aa27d8b3f7cf99fa06e77fdc592b577c1", "485734f3fc77c1eb77ffe138c027b9a4bf0178f3" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 20 15:04:23 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 20 15:04:23 2018 +0200" }, "message": "Merge branch \u0027x86-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nIngo writes:\n \"x86 fixes:\n\n It\u0027s 4 misc fixes, 3 build warning fixes and 3 comment fixes.\n\n In hindsight I\u0027d have left out the 3 comment fixes to make the pull\n request look less scary at such a late point in the cycle. :-/\"\n\n* \u0027x86-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/swiotlb: Enable swiotlb for \u003e 4GiG RAM on 32-bit kernels\n x86/fpu: Fix i486 + no387 boot crash by only saving FPU registers on context switch if there is an FPU\n x86/fpu: Remove second definition of fpu in __fpu__restore_sig()\n x86/entry/64: Further improve paranoid_entry comments\n x86/entry/32: Clear the CS high bits\n x86/boot: Add -Wno-pointer-sign to KBUILD_CFLAGS\n x86/time: Correct the attribute on jiffies\u0027 definition\n x86/entry: Add some paranoid entry/exit CR3 handling comments\n x86/percpu: Fix this_cpu_read()\n x86/tsc: Force inlining of cyc2ns bits\n" }, { "commit": "14dbc56aa27d8b3f7cf99fa06e77fdc592b577c1", "tree": "71456ce7ed9031067190a5717d91bbf336a714c4", "parents": [ "9b00eb8ac2738b27a1469046f2ca76449dcdf04a", "9845c49cc9bbb317a0bc9e9cf78d8e09d54c9af0" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 20 15:03:45 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 20 15:03:45 2018 +0200" }, "message": "Merge branch \u0027sched-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nIngo writes:\n \"scheduler fixes:\n\n Two fixes: a CFS-throttling bug fix, and an interactivity fix.\"\n\n* \u0027sched-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/fair: Fix the min_vruntime update logic in dequeue_entity()\n sched/fair: Fix throttle_list starvation with low CFS quota\n" }, { "commit": "9b00eb8ac2738b27a1469046f2ca76449dcdf04a", "tree": "6a385f0ad652d414fa4e845b86f27a82b63f8928", "parents": [ "270b77a0f30e7bc61a9081b86d74dbb62fa6a69d", "20e8e72d0fa8e26202932c30d592bade73fdc701" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 20 15:02:51 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 20 15:02:51 2018 +0200" }, "message": "Merge branch \u0027perf-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nIngo writes:\n \"perf fixes:\n\n Misc perf tooling fixes.\"\n\n* \u0027perf-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf tools: Stop fallbacking to kallsyms for vdso symbols lookup\n perf tools: Pass build flags to traceevent build\n perf report: Don\u0027t crash on invalid inline debug information\n perf cpu_map: Align cpu map synthesized events properly.\n perf tools: Fix tracing_path_mount proper path\n perf tools: Fix use of alternatives to find JDIR\n perf evsel: Store ids for events with their own cpus perf_event__synthesize_event_update_cpus\n perf vendor events intel: Fix wrong filter_band* values for uncore events\n Revert \"perf tools: Fix PMU term format max value calculation\"\n tools headers uapi: Sync kvm.h copy\n tools arch uapi: Sync the x86 kvm.h copy\n" }, { "commit": "270b77a0f30e7bc61a9081b86d74dbb62fa6a69d", "tree": "22ab0d2cdf84d98b0fcc6f9bbcfcefd28d91163d", "parents": [ "6b5201c21d4022e71058cbd87b9dfe3116143af1", "fe7acd1e303d74584040a902d78726ba5a4b9b4a" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 20 09:23:12 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 20 09:23:12 2018 +0200" }, "message": "Merge tag \u0027drm-fixes-2018-10-20-1\u0027 of git://anongit.freedesktop.org/drm/drm\n\nDave writes:\n \"drm fixes for 4.19 final (part 2)\n\n Looked like two stragglers snuck in, one very urgent the pageflipping\n was missing a reference that could result in a GPF on non-i915\n drivers, the other is an overflow in the sun4i dotclock calcs\n resulting in a mode not getting set.\"\n\n* tag \u0027drm-fixes-2018-10-20-1\u0027 of git://anongit.freedesktop.org/drm/drm:\n drm/sun4i: Fix an ulong overflow in the dotclock driver\n drm: Get ref on CRTC commit object when waiting for flip_done\n" }, { "commit": "6b5201c21d4022e71058cbd87b9dfe3116143af1", "tree": "6ded3a278fe1103f2ea180d9b9e39e47b1a5670a", "parents": [ "d4ec49d332aba29827504cc666205aef91a281c7", "ba0e41ca81b935b958006c7120466e2217357827" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 20 09:20:48 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 20 09:20:48 2018 +0200" }, "message": "Merge tag \u0027trace-v4.19-rc8-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace\n\nSteven writes:\n \"tracing: A few small fixes to synthetic events\n\n Masami found some issues with the creation of synthetic events. The\n first two patches fix handling of unsigned type, and handling of a\n space before an ending semi-colon.\n\n The third patch adds a selftest to test the processing of synthetic\n events.\"\n\n* tag \u0027trace-v4.19-rc8-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:\n selftests: ftrace: Add synthetic event syntax testcase\n tracing: Fix synthetic event to allow semicolon at end\n tracing: Fix synthetic event to accept unsigned modifier\n" }, { "commit": "d4ec49d332aba29827504cc666205aef91a281c7", "tree": "726ccbedd45239364923f54c97108770de236742", "parents": [ "c7b70a641df26002e8f26e2b8122fcb6a1d815a1", "13c1c5e4d7f887cba36c5e3df3faa22071c1469f" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 20 08:42:56 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 20 08:42:56 2018 +0200" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nDmitry writes:\n \"Input updates for 4.19-rc8\n\n Just an addition to elan touchpad driver ACPI table.\"\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15IGM\n" }, { "commit": "fe7acd1e303d74584040a902d78726ba5a4b9b4a", "tree": "e5b0c5ecc5cca0db9c9b44526c8b569851b9c9ee", "parents": [ "f8e6e1b6f0ae3bb91cdcd08213d36a0ce6e98535", "e84cb605e02f1b3d0aee8d7157419cd8aaa06038" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Oct 20 07:18:12 2018 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Oct 20 12:26:26 2018 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2018-10-19\u0027 of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes\n\nSecond pull request for v4.19:\n- Fix ulong overflow in sun4i\n- Fix a serious GPF in waiting for flip_done from commit_tail().\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maarten Lankhorst \u003cmaarten.lankhorst@linux.intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/97d1ed42-1d99-fcc5-291e-cd1dc29a4252@linux.intel.com\n" }, { "commit": "ba0e41ca81b935b958006c7120466e2217357827", "tree": "cbe730707c893da70f7a2a8488d60a3ce112cc95", "parents": [ "a360d9e4016c1fcf41553b37ad496870dc5723d0" ], "author": { "name": "Masami Hiramatsu", "email": "mhiramat@kernel.org", "time": "Thu Oct 18 22:13:02 2018 +0900" }, "committer": { "name": "Steven Rostedt (VMware)", "email": "rostedt@goodmis.org", "time": "Fri Oct 19 17:25:12 2018 -0400" }, "message": "selftests: ftrace: Add synthetic event syntax testcase\n\nAdd a testcase to check the syntax and field types for\nsynthetic_events interface.\n\nLink: http://lkml.kernel.org/r/153986838264.18251.16627517536956299922.stgit@devbox\n\nAcked-by: Shuah Khan \u003cshuah@kernel.org\u003e\nSigned-off-by: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt (VMware) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "a360d9e4016c1fcf41553b37ad496870dc5723d0", "tree": "20feec7b3cf625dcd19172ce8c7daf4cc2fb675d", "parents": [ "282447ba6b00c64678ffdf964f44e5c8b1c68377" ], "author": { "name": "Masami Hiramatsu", "email": "mhiramat@kernel.org", "time": "Thu Oct 18 22:12:34 2018 +0900" }, "committer": { "name": "Steven Rostedt (VMware)", "email": "rostedt@goodmis.org", "time": "Fri Oct 19 17:25:11 2018 -0400" }, "message": "tracing: Fix synthetic event to allow semicolon at end\n\nFix synthetic event to allow independent semicolon at end.\n\nThe synthetic_events interface accepts a semicolon after the\nlast word if there is no space.\n\n # echo \"myevent u64 var;\" \u003e\u003e synthetic_events\n\nBut if there is a space, it returns an error.\n\n # echo \"myevent u64 var ;\" \u003e synthetic_events\n sh: write error: Invalid argument\n\nThis behavior is difficult for users to understand. Let\u0027s\nallow the last independent semicolon too.\n\nLink: http://lkml.kernel.org/r/153986835420.18251.2191216690677025744.stgit@devbox\n\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nCc: Tom Zanussi \u003ctom.zanussi@linux.intel.com\u003e\nCc: stable@vger.kernel.org\nFixes: commit 4b147936fa50 (\"tracing: Add support for \u0027synthetic\u0027 events\")\nSigned-off-by: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt (VMware) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "282447ba6b00c64678ffdf964f44e5c8b1c68377", "tree": "714c828c90e180455a59524f44688f860ba25d62", "parents": [ "12ad0cb2123aed30241a14792ef5bef9efcccbcd" ], "author": { "name": "Masami Hiramatsu", "email": "mhiramat@kernel.org", "time": "Thu Oct 18 22:12:05 2018 +0900" }, "committer": { "name": "Steven Rostedt (VMware)", "email": "rostedt@goodmis.org", "time": "Fri Oct 19 17:25:11 2018 -0400" }, "message": "tracing: Fix synthetic event to accept unsigned modifier\n\nFix synthetic event to accept unsigned modifier for its field type\ncorrectly.\n\nCurrently, synthetic_events interface returns error for \"unsigned\"\nmodifiers as below;\n\n # echo \"myevent unsigned long var\" \u003e\u003e synthetic_events\n sh: write error: Invalid argument\n\nThis is because argv_split() breaks \"unsigned long\" into \"unsigned\"\nand \"long\", but parse_synth_field() doesn\u0027t expected it.\n\nWith this fix, synthetic_events can handle the \"unsigned long\"\ncorrectly like as below;\n\n # echo \"myevent unsigned long var\" \u003e\u003e synthetic_events\n # cat synthetic_events\n myevent\tunsigned long var\n\nLink: http://lkml.kernel.org/r/153986832571.18251.8448135724590496531.stgit@devbox\n\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nCc: Tom Zanussi \u003ctom.zanussi@linux.intel.com\u003e\nCc: stable@vger.kernel.org\nFixes: commit 4b147936fa50 (\"tracing: Add support for \u0027synthetic\u0027 events\")\nSigned-off-by: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt (VMware) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "c7b70a641df26002e8f26e2b8122fcb6a1d815a1", "tree": "a67b6e7500320cd5499b5af928d94c56ec0a473f", "parents": [ "b2a205ff49b9c55d4bdda1bdb10ad19ebd646221", "9ae24af3669111d418242caec8dd4ebd9ba26860" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 19 19:25:44 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 19 19:25:44 2018 +0200" }, "message": "Merge tag \u0027usb-4.19-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nI wrote:\n \"USB fixes for 4.19-final\n\n Here are a small number of last-minute USB driver fixes\n\n Included here are:\n - spectre fix for usb storage gadgets\n - xhci fixes\n - cdc-acm fixes\n - usbip fixes for reported problems\n\n All of these have been in linux-next with no reported issues.\"\n\n* tag \u0027usb-4.19-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:\n usb: gadget: storage: Fix Spectre v1 vulnerability\n USB: fix the usbfs flag sanitization for control transfers\n usb: xhci: pci: Enable Intel USB role mux on Apollo Lake platforms\n usb: roles: intel_xhci: Fix Unbalanced pm_runtime_enable\n cdc-acm: correct counting of UART states in serial state notification\n cdc-acm: do not reset notification buffer index upon urb unlinking\n cdc-acm: fix race between reset and control messaging\n usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control()\n selftests: usbip: add wait after attach and before checking port status\n" }, { "commit": "b2a205ff49b9c55d4bdda1bdb10ad19ebd646221", "tree": "37e3821d811f74f67c84d7082b9ad8959c5b32a1", "parents": [ "91b15613ce7fb3e724ca0d433eef8e6bf15322af", "744889b7cbb56a64f957e65ade7cb65fe3f35714" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 19 18:51:07 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 19 18:51:07 2018 +0200" }, "message": "Merge tag \u0027for-linus-20181019\u0027 of git://git.kernel.dk/linux-block\n\nJens writes:\n \"Block fixes for 4.19-final\n\n Two small fixes that should go into this release.\"\n\n* tag \u0027for-linus-20181019\u0027 of git://git.kernel.dk/linux-block:\n block: don\u0027t deal with discard limit in blkdev_issue_discard()\n nvme: remove ns sibling before clearing path\n" }, { "commit": "e84cb605e02f1b3d0aee8d7157419cd8aaa06038", "tree": "a479bb12e9d290e8f14da3402ad48fcabf9cf6d0", "parents": [ "4364bcb2cd21d042bde4776448417ddffbc54045" ], "author": { "name": "Boris Brezillon", "email": "boris.brezillon@bootlin.com", "time": "Thu Oct 18 12:02:50 2018 +0200" }, "committer": { "name": "Maxime Ripard", "email": "maxime.ripard@bootlin.com", "time": "Fri Oct 19 11:50:25 2018 +0200" }, "message": "drm/sun4i: Fix an ulong overflow in the dotclock driver\n\nThe calculated ideal rate can easily overflow an unsigned long, thus\nmaking the best div selection buggy as soon as no ideal match is found\nbefore the overflow occurs.\n\nFixes: 4731a72df273 (\"drm/sun4i: request exact rates to our parents\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Boris Brezillon \u003cboris.brezillon@bootlin.com\u003e\nAcked-by: Maxime Ripard \u003cmaxime.ripard@bootlin.com\u003e\nSigned-off-by: Maxime Ripard \u003cmaxime.ripard@bootlin.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20181018100250.12565-1-boris.brezillon@bootlin.com\n" }, { "commit": "91b15613ce7fb3e724ca0d433eef8e6bf15322af", "tree": "e35e961ff6776eaef1505c2241ee7de84376edb8", "parents": [ "2a96661054452c3016c377d72a38c6d4948ea6ae", "d4d576f5ab7edcb757bb33e6a5600666a0b1232d" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 19 09:16:20 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 19 09:16:20 2018 +0200" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nDavid writes:\n \"Networking\n\n 1) Fix gro_cells leak in xfrm layer, from Li RongQing.\n\n 2) BPF selftests change RLIMIT_MEMLOCK blindly, don\u0027t do that. From\n Eric Dumazet.\n\n 3) AF_XDP calls synchronize_net() under RCU lock, fix from Björn\n Töpel.\n\n 4) Out of bounds packet access in _decode_session6(), from Alexei\n Starovoitov.\n\n 5) Several ethtool bugs, where we copy a struct into the kernel twice\n and our validations of the values in the first copy can be\n invalidated by the second copy due to asynchronous updates to the\n memory by the user. From Wenwen Wang.\n\n 6) Missing netlink attribute validation in cls_api, from Davide\n Caratti.\n\n 7) LLC SAP sockets neet to be SOCK_RCU FREE, from Cong Wang.\n\n 8) rxrpc operates on wrong kvec, from Yue Haibing.\n\n 9) A regression was introduced by the disassosciation of route\n neighbour references in rt6_probe(), causing probe for\n neighbourless routes to not be properly rate limited. Fix from\n Sabrina Dubroca.\n\n 10) Unsafe RCU locking in tipc, from Tung Nguyen.\n\n 11) Use after free in inet6_mc_check(), from Eric Dumazet.\n\n 12) PMTU from icmp packets should update the SCTP transport pathmtu,\n from Xin Long.\n\n 13) Missing peer put on error in rxrpc, from David Howells.\n\n 14) Fix pedit in nfp driver, from Pieter Jansen van Vuuren.\n\n 15) Fix overflowing shift statement in qla3xxx driver, from Nathan\n Chancellor.\n\n 16) Fix Spectre v1 in ptp code, from Gustavo A. R. Silva.\n\n 17) udp6_unicast_rcv_skb() interprets udpv6_queue_rcv_skb() return\n value in an inverted manner, fix from Paolo Abeni.\n\n 18) Fix missed unresolved entries in ipmr dumps, from Nikolay\n Aleksandrov.\n\n 19) Fix NAPI handling under high load, we can completely miss events\n when NAPI has to loop more than one time in a cycle. From Heiner\n Kallweit.\"\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (49 commits)\n ip6_tunnel: Fix encapsulation layout\n tipc: fix info leak from kernel tipc_event\n net: socket: fix a missing-check bug\n net: sched: Fix for duplicate class dump\n r8169: fix NAPI handling under high load\n net: ipmr: fix unresolved entry dumps\n net: mscc: ocelot: Fix comment in ocelot_vlant_wait_for_completion()\n sctp: fix the data size calculation in sctp_data_size\n virtio_net: avoid using netif_tx_disable() for serializing tx routine\n udp6: fix encap return code for resubmitting\n mlxsw: core: Fix use-after-free when flashing firmware during init\n sctp: not free the new asoc when sctp_wait_for_connect returns err\n sctp: fix race on sctp_id2asoc\n r8169: re-enable MSI-X on RTL8168g\n net: bpfilter: use get_pid_task instead of pid_task\n ptp: fix Spectre v1 vulnerability\n net: qla3xxx: Remove overflowing shift statement\n geneve, vxlan: Don\u0027t set exceptions if skb-\u003elen \u003c mtu\n geneve, vxlan: Don\u0027t check skb_dst() twice\n sctp: get pr_assoc and pr_stream all status with SCTP_PR_SCTP_ALL instead\n ...\n" }, { "commit": "2a96661054452c3016c377d72a38c6d4948ea6ae", "tree": "4319eb265b72589cf58e076de58f1a9a1a76c278", "parents": [ "7555c5d5a87973fbdee201ff63d2edd748933177", "27faeebd00813cd52a140e8944b6b32729b50e61" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 19 09:15:12 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 19 09:15:12 2018 +0200" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc\n\nDavid writes:\n \"Sparc fixes:\n\n The main bit here is fixing how fallback system calls are handled in\n the sparc vDSO.\n\n Unfortunately, I fat fingered the commit and some perf debugging\n hacks slipped into the vDSO fix, which I revert in the very next\n commit.\"\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:\n sparc: Revert unintended perf changes.\n sparc: vDSO: Silence an uninitialized variable warning\n sparc: Fix syscall fallback bugs in VDSO.\n" }, { "commit": "7555c5d5a87973fbdee201ff63d2edd748933177", "tree": "a8744fc2f94c04dc32ffecada5ffb14a47558eda", "parents": [ "eb6d938ffa486dd89331cbfa2137038df6c912d2", "f8e6e1b6f0ae3bb91cdcd08213d36a0ce6e98535" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 19 08:31:22 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 19 08:31:22 2018 +0200" }, "message": "Merge tag \u0027drm-fixes-2018-10-19\u0027 of git://anongit.freedesktop.org/drm/drm\n\nDave writes:\n \"drm fixes for 4.19 final\n\n Just a last set of misc core fixes for final.\n\n 4 fixes, one use after free, one fb integration fix, one EDID fix,\n and one laptop panel quirk,\"\n\n* tag \u0027drm-fixes-2018-10-19\u0027 of git://anongit.freedesktop.org/drm/drm:\n drm/edid: VSDB yCBCr420 Deep Color mode bit definitions\n drm: fix use of freed memory in drm_mode_setcrtc\n drm: fb-helper: Reject all pixel format changing requests\n drm/edid: Add 6 bpc quirk for BOE panel in HP Pavilion 15-n233sl\n" }, { "commit": "eb6d938ffa486dd89331cbfa2137038df6c912d2", "tree": "2e2b57d0495113db52c491da2d3c7717bce71143", "parents": [ "fa520c47eaa15b9baa8ad66ac18da4a31679693b", "a3671a4f973ee9d9621d60166cc3b037c397d604" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 19 08:30:35 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 19 08:30:35 2018 +0200" }, "message": "Merge tag \u0027for-gkh\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma\n\nDoug writes:\n \"Really final for-rc pull request for 4.19\n\n Ok, so last week I thought we had sent our final pull request for\n 4.19. Well, wouldn\u0027t ya know someone went and found a couple Spectre\n v1 fixes were needed :-/. So, a couple *very* small specter patches\n for this (hopefully) final -rc week.\"\n\n* tag \u0027for-gkh\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:\n RDMA/ucma: Fix Spectre v1 vulnerability\n IB/ucm: Fix Spectre v1 vulnerability\n" }, { "commit": "485734f3fc77c1eb77ffe138c027b9a4bf0178f3", "tree": "504317805872a16d0f6d406eb0869b8717150e99", "parents": [ "2224d616528194b02424c91c2ee254b3d29942c3" ], "author": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Sun Oct 14 09:52:08 2018 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Oct 19 07:49:32 2018 +0200" }, "message": "x86/swiotlb: Enable swiotlb for \u003e 4GiG RAM on 32-bit kernels\n\nWe already build the swiotlb code for 32-bit kernels with PAE support,\nbut the code to actually use swiotlb has only been enabled for 64-bit\nkernels for an unknown reason.\n\nBefore Linux v4.18 we paper over this fact because the networking code,\nthe SCSI layer and some random block drivers implemented their own\nbounce buffering scheme.\n\n[ mingo: Changelog fixes. ]\n\nFixes: 21e07dba9fb1 (\"scsi: reduce use of block bounce buffers\")\nFixes: ab74cfebafa3 (\"net: remove the PCI_DMA_BUS_IS_PHYS check in illegal_highdma\")\nReported-by: Matthew Whitehead \u003ctedheadster@gmail.com\u003e\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nTested-by: Matthew Whitehead \u003ctedheadster@gmail.com\u003e\nCc: konrad.wilk@oracle.com\nCc: iommu@lists.linux-foundation.org\nCc: stable@vger.kernel.org\nLink: https://lkml.kernel.org/r/20181014075208.2715-1-hch@lst.de\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "f8e6e1b6f0ae3bb91cdcd08213d36a0ce6e98535", "tree": "44c5aed65fb2e435e514b900822cd752fad28424", "parents": [ "35a7f35ad1b150ddf59a41dcac7b2fa32982be0e", "9068e02f58740778d8270840657f1e250a2cc60f" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 19 13:51:55 2018 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 19 13:52:03 2018 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2018-10-18\u0027 of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes\n\ndrm-misc-fixes for v4.19:\n- Fix use of freed memory in drm_mode_setcrtc.\n- Reject pixel format changing requests in fb helper.\n- Add 6 bpc quirk for HP Pavilion 15-n233sl\n- Fix VSDB yCBCr420 Deep Color mode bit definitions\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maarten Lankhorst \u003cmaarten.lankhorst@linux.intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/647fe5d0-4ec5-57cc-9f23-a4836b29e278@linux.intel.com\n" }, { "commit": "d4d576f5ab7edcb757bb33e6a5600666a0b1232d", "tree": "e177391e44be90fea333bbc905025c0abb00bc14", "parents": [ "b06f9d9f1a907dd03f203e2ce9e27e318c22ba01" ], "author": { "name": "Stefano Brivio", "email": "sbrivio@redhat.com", "time": "Thu Oct 18 21:25:07 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 18 16:54:40 2018 -0700" }, "message": "ip6_tunnel: Fix encapsulation layout\n\nCommit 058214a4d1df (\"ip6_tun: Add infrastructure for doing\nencapsulation\") added the ip6_tnl_encap() call in ip6_tnl_xmit(), before\nthe call to ipv6_push_frag_opts() to append the IPv6 Tunnel Encapsulation\nLimit option (option 4, RFC 2473, par. 5.1) to the outer IPv6 header.\n\nAs long as the option didn\u0027t actually end up in generated packets, this\nwasn\u0027t an issue. Then commit 89a23c8b528b (\"ip6_tunnel: Fix missing tunnel\nencapsulation limit option\") fixed sending of this option, and the\nresulting layout, e.g. for FoU, is:\n\n.-------------------.------------.----------.-------------------.----- - -\n| Outer IPv6 Header | UDP header | Option 4 | Inner IPv6 Header | Payload\n\u0027-------------------\u0027------------\u0027----------\u0027-------------------\u0027----- - -\n\nNeedless to say, FoU and GUE (at least) won\u0027t work over IPv6. The option\nis appended by default, and I couldn\u0027t find a way to disable it with the\ncurrent iproute2.\n\nTurn this into a more reasonable:\n\n.-------------------.----------.------------.-------------------.----- - -\n| Outer IPv6 Header | Option 4 | UDP header | Inner IPv6 Header | Payload\n\u0027-------------------\u0027----------\u0027------------\u0027-------------------\u0027----- - -\n\nWith this, and with 84dad55951b0 (\"udp6: fix encap return code for\nresubmitting\"), FoU and GUE work again over IPv6.\n\nFixes: 058214a4d1df (\"ip6_tun: Add infrastructure for doing encapsulation\")\nSigned-off-by: Stefano Brivio \u003csbrivio@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b06f9d9f1a907dd03f203e2ce9e27e318c22ba01", "tree": "cf28a0414f8274c894c184aa833bb38bbb0af7c2", "parents": [ "b6168562c8ce2bd5a30e213021650422e08764dc" ], "author": { "name": "Jon Maloy", "email": "jon.maloy@ericsson.com", "time": "Thu Oct 18 17:38:29 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 18 16:49:53 2018 -0700" }, "message": "tipc: fix info leak from kernel tipc_event\n\nWe initialize a struct tipc_event allocated on the kernel stack to\nzero to avert info leak to user space.\n\nReported-by: syzbot+057458894bc8cada4dee@syzkaller.appspotmail.com\nSigned-off-by: Jon Maloy \u003cjon.maloy@ericsson.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b6168562c8ce2bd5a30e213021650422e08764dc", "tree": "3c6b632a4886b00d77368e615c78590a5b89eb1e", "parents": [ "3c53ed8fef6881a864f0ee8240ed2793ef73ad0d" ], "author": { "name": "Wenwen Wang", "email": "wang6495@umn.edu", "time": "Thu Oct 18 09:36:46 2018 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 18 16:43:06 2018 -0700" }, "message": "net: socket: fix a missing-check bug\n\nIn ethtool_ioctl(), the ioctl command \u0027ethcmd\u0027 is checked through a switch\nstatement to see whether it is necessary to pre-process the ethtool\nstructure, because, as mentioned in the comment, the structure\nethtool_rxnfc is defined with padding. If yes, a user-space buffer \u0027rxnfc\u0027\nis allocated through compat_alloc_user_space(). One thing to note here is\nthat, if \u0027ethcmd\u0027 is ETHTOOL_GRXCLSRLALL, the size of the buffer \u0027rxnfc\u0027 is\npartially determined by \u0027rule_cnt\u0027, which is actually acquired from the\nuser-space buffer \u0027compat_rxnfc\u0027, i.e., \u0027compat_rxnfc-\u003erule_cnt\u0027, through\nget_user(). After \u0027rxnfc\u0027 is allocated, the data in the original user-space\nbuffer \u0027compat_rxnfc\u0027 is then copied to \u0027rxnfc\u0027 through copy_in_user(),\nincluding the \u0027rule_cnt\u0027 field. However, after this copy, no check is\nre-enforced on \u0027rxnfc-\u003erule_cnt\u0027. So it is possible that a malicious user\nrace to change the value in the \u0027compat_rxnfc-\u003erule_cnt\u0027 between these two\ncopies. Through this way, the attacker can bypass the previous check on\n\u0027rule_cnt\u0027 and inject malicious data. This can cause undefined behavior of\nthe kernel and introduce potential security risk.\n\nThis patch avoids the above issue via copying the value acquired by\nget_user() to \u0027rxnfc-\u003erule_cn\u0027, if \u0027ethcmd\u0027 is ETHTOOL_GRXCLSRLALL.\n\nSigned-off-by: Wenwen Wang \u003cwang6495@umn.edu\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "3c53ed8fef6881a864f0ee8240ed2793ef73ad0d", "tree": "919d4fbb499bbca7812fa8fb1d4a37d544eb586b", "parents": [ "6b839b6cf9eada30b086effb51e5d6076bafc761" ], "author": { "name": "Phil Sutter", "email": "phil@nwl.cc", "time": "Thu Oct 18 10:34:26 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 18 16:00:02 2018 -0700" }, "message": "net: sched: Fix for duplicate class dump\n\nWhen dumping classes by parent, kernel would return classes twice:\n\n| # tc qdisc add dev lo root prio\n| # tc class show dev lo\n| class prio 8001:1 parent 8001:\n| class prio 8001:2 parent 8001:\n| class prio 8001:3 parent 8001:\n| # tc class show dev lo parent 8001:\n| class prio 8001:1 parent 8001:\n| class prio 8001:2 parent 8001:\n| class prio 8001:3 parent 8001:\n| class prio 8001:1 parent 8001:\n| class prio 8001:2 parent 8001:\n| class prio 8001:3 parent 8001:\n\nThis comes from qdisc_match_from_root() potentially returning the root\nqdisc itself if its handle matched. Though in that case, root\u0027s classes\nwere already dumped a few lines above.\n\nFixes: cb395b2010879 (\"net: sched: optimize class dumps\")\nSigned-off-by: Phil Sutter \u003cphil@nwl.cc\u003e\nReviewed-by: Jiri Pirko \u003cjiri@mellanox.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "6b839b6cf9eada30b086effb51e5d6076bafc761", "tree": "ff03cc172c8ac189df65e1134bc6400a88907217", "parents": [ "2ee653f644ab203364724cac85a7efd371367979" ], "author": { "name": "Heiner Kallweit", "email": "hkallweit1@gmail.com", "time": "Thu Oct 18 19:56:01 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 18 11:33:29 2018 -0700" }, "message": "r8169: fix NAPI handling under high load\n\nrtl_rx() and rtl_tx() are called only if the respective bits are set\nin the interrupt status register. Under high load NAPI may not be\nable to process all data (work_done \u003d\u003d budget) and it will schedule\nsubsequent calls to the poll callback.\nrtl_ack_events() however resets the bits in the interrupt status\nregister, therefore subsequent calls to rtl8169_poll() won\u0027t call\nrtl_rx() and rtl_tx() - chip interrupts are still disabled.\n\nFix this by calling rtl_rx() and rtl_tx() independent of the bits\nset in the interrupt status register. Both functions will detect\nif there\u0027s nothing to do for them.\n\nFixes: da78dbff2e05 (\"r8169: remove work from irq handler.\")\nSigned-off-by: Heiner Kallweit \u003chkallweit1@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "27faeebd00813cd52a140e8944b6b32729b50e61", "tree": "b263130cc20d4d586085aa12bd9e032bc39def0c", "parents": [ "62d6f3b7b85e9ba79c96bfd36f501f180908e623" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 18 11:32:29 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 18 11:32:29 2018 -0700" }, "message": "sparc: Revert unintended perf changes.\n\nSome local debugging hacks accidently slipped into the VDSO commit.\n\nSorry!\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4364bcb2cd21d042bde4776448417ddffbc54045", "tree": "9b1e2b1404d790499d184d99d20480ddb5e32c7a", "parents": [ "9068e02f58740778d8270840657f1e250a2cc60f" ], "author": { "name": "Leo Li", "email": "sunpeng.li@amd.com", "time": "Mon Oct 15 09:46:40 2018 -0400" }, "committer": { "name": "Harry Wentland", "email": "harry.wentland@amd.com", "time": "Thu Oct 18 14:23:13 2018 -0400" }, "message": "drm: Get ref on CRTC commit object when waiting for flip_done\n\nThis fixes a general protection fault, caused by accessing the contents\nof a flip_done completion object that has already been freed. It occurs\ndue to the preemption of a non-blocking commit worker thread W by\nanother commit thread X. X continues to clear its atomic state at the\nend, destroying the CRTC commit object that W still needs. Switching\nback to W and accessing the commit objects then leads to bad results.\n\nWorker W becomes preemptable when waiting for flip_done to complete. At\nthis point, a frequently occurring commit thread X can take over. Here\u0027s\nan example where W is a worker thread that flips on both CRTCs, and X\ndoes a legacy cursor update on both CRTCs:\n\n ...\n 1. W does flip work\n 2. W runs commit_hw_done()\n 3. W waits for flip_done on CRTC 1\n 4. \u003e flip_done for CRTC 1 completes\n 5. W finishes waiting for CRTC 1\n 6. W waits for flip_done on CRTC 2\n\n 7. \u003e Preempted by X\n 8. \u003e flip_done for CRTC 2 completes\n 9. X atomic_check: hw_done and flip_done are complete on all CRTCs\n 10. X updates cursor on both CRTCs\n 11. X destroys atomic state\n 12. X done\n\n 13. \u003e Switch back to W\n 14. W waits for flip_done on CRTC 2\n 15. W raises general protection fault\n\nThe error looks like so:\n\n general protection fault: 0000 [#1] PREEMPT SMP PTI\n **snip**\n Call Trace:\n lock_acquire+0xa2/0x1b0\n _raw_spin_lock_irq+0x39/0x70\n wait_for_completion_timeout+0x31/0x130\n drm_atomic_helper_wait_for_flip_done+0x64/0x90 [drm_kms_helper]\n amdgpu_dm_atomic_commit_tail+0xcae/0xdd0 [amdgpu]\n commit_tail+0x3d/0x70 [drm_kms_helper]\n process_one_work+0x212/0x650\n worker_thread+0x49/0x420\n kthread+0xfb/0x130\n ret_from_fork+0x3a/0x50\n Modules linked in: x86_pkg_temp_thermal amdgpu(O) chash(O)\n gpu_sched(O) drm_kms_helper(O) syscopyarea sysfillrect sysimgblt\n fb_sys_fops ttm(O) drm(O)\n\nNote that i915 has this issue masked, since hw_done is signaled after\nwaiting for flip_done. Doing so will block the cursor update from\nhappening until hw_done is signaled, preventing the cursor commit from\ndestroying the state.\n\nv2: The reference on the commit object needs to be obtained before\n hw_done() is signaled, since that\u0027s the point where another commit\n is allowed to modify the state. Assuming that the\n new_crtc_state-\u003ecommit object still exists within flip_done() is\n incorrect.\n\n Fix by getting a reference in setup_commit(), and releasing it\n during default_clear().\n\nSigned-off-by: Leo Li \u003csunpeng.li@amd.com\u003e\nReviewed-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nSigned-off-by: Harry Wentland \u003charry.wentland@amd.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/1539611200-6184-1-git-send-email-sunpeng.li@amd.com\n" }, { "commit": "2ee653f644ab203364724cac85a7efd371367979", "tree": "ef4bec49238cf32b0eb32624c2db14daa2edaf8b", "parents": [ "eddf016b910486d2123675a6b5fd7d64f77cdca8", "9dffff200fd178f11dd50eb1fd8ccd0650c9284e" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 18 09:55:08 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 18 09:55:08 2018 -0700" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec\n\nSteffen Klassert says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull request (net): ipsec 2018-10-18\n\n1) Free the xfrm interface gro_cells when deleting the\n interface, otherwise we leak it. From Li RongQing.\n\n2) net/core/flow.c does not exist anymore, so remove it\n from the MAINTAINERS file.\n\n3) Fix a slab-out-of-bounds in _decode_session6.\n From Alexei Starovoitov.\n\n4) Fix RCU protection when policies inserted into\n thei bydst lists. From Florian Westphal.\n\nPlease pull or let me know if there are problems.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "744889b7cbb56a64f957e65ade7cb65fe3f35714", "tree": "65972a4045c33b737862a4522271ec5705f41e2c", "parents": [ "7a7080b53467ad96c0b371e9d2a2a312f96f99c2" ], "author": { "name": "Ming Lei", "email": "ming.lei@redhat.com", "time": "Fri Oct 12 15:53:10 2018 +0800" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Oct 18 07:23:40 2018 -0600" }, "message": "block: don\u0027t deal with discard limit in blkdev_issue_discard()\n\nblk_queue_split() does respect this limit via bio splitting, so no\nneed to do that in blkdev_issue_discard(), then we can align to\nnormal bio submit(bio_add_page() \u0026 submit_bio()).\n\nMore importantly, this patch fixes one issue introduced in a22c4d7e34402cc\n(\"block: re-add discard_granularity and alignment checks\"), in which\nzero discard bio may be generated in case of zero alignment.\n\nFixes: a22c4d7e34402ccdf3 (\"block: re-add discard_granularity and alignment checks\")\nCc: stable@vger.kernel.org\nCc: Ming Lin \u003cming.l@ssi.samsung.com\u003e\nCc: Mike Snitzer \u003csnitzer@redhat.com\u003e\nCc: Christoph Hellwig \u003chch@lst.de\u003e\nCc: Xiao Ni \u003cxni@redhat.com\u003e\nTested-by: Mariusz Dabrowski \u003cmariusz.dabrowski@intel.com\u003e\nSigned-off-by: Ming Lei \u003cming.lei@redhat.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "fa520c47eaa15b9baa8ad66ac18da4a31679693b", "tree": "b5e4f0f10a806b70c69de4938466cb9cd78b6b16", "parents": [ "1ff22883b0b2f7a73eb2609ffe879c9fd96f6328" ], "author": { "name": "Eric Sandeen", "email": "sandeen@redhat.com", "time": "Wed Oct 17 15:23:59 2018 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 18 11:32:21 2018 +0200" }, "message": "fscache: Fix out of bound read in long cookie keys\n\nfscache_set_key() can incur an out-of-bounds read, reported by KASAN:\n\n BUG: KASAN: slab-out-of-bounds in fscache_alloc_cookie+0x5b3/0x680 [fscache]\n Read of size 4 at addr ffff88084ff056d4 by task mount.nfs/32615\n\nand also reported by syzbot at https://lkml.org/lkml/2018/7/8/236\n\n BUG: KASAN: slab-out-of-bounds in fscache_set_key fs/fscache/cookie.c:120 [inline]\n BUG: KASAN: slab-out-of-bounds in fscache_alloc_cookie+0x7a9/0x880 fs/fscache/cookie.c:171\n Read of size 4 at addr ffff8801d3cc8bb4 by task syz-executor907/4466\n\nThis happens for any index_key_len which is not divisible by 4 and is\nlarger than the size of the inline key, because the code allocates exactly\nindex_key_len for the key buffer, but the hashing loop is stepping through\nit 4 bytes (u32) at a time in the buf[] array.\n\nFix this by calculating how many u32 buffers we\u0027ll need by using\nDIV_ROUND_UP, and then using kcalloc() to allocate a precleared allocation\nbuffer to hold the index_key, then using that same count as the hashing\nindex limit.\n\nFixes: ec0328e46d6e (\"fscache: Maintain a catalogue of allocated cookies\")\nReported-by: syzbot+a95b989b2dde8e806af8@syzkaller.appspotmail.com\nSigned-off-by: Eric Sandeen \u003csandeen@redhat.com\u003e\nCc: stable \u003cstable@vger.kernel.org\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1ff22883b0b2f7a73eb2609ffe879c9fd96f6328", "tree": "113747086e8d148ccd64a1cfcec97f10f558071e", "parents": [ "169b803397499be85bdd1e3d07d6f5e3d4bd669e" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Oct 17 15:23:45 2018 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 18 11:32:21 2018 +0200" }, "message": "fscache: Fix incomplete initialisation of inline key space\n\nThe inline key in struct rxrpc_cookie is insufficiently initialized,\nzeroing only 3 of the 4 slots, therefore an index_key_len between 13 and 15\nbytes will end up hashing uninitialized memory because the memcpy only\npartially fills the last buf[] element.\n\nFix this by clearing fscache_cookie objects on allocation rather than using\nthe slab constructor to initialise them. We\u0027re going to pretty much fill\nin the entire struct anyway, so bringing it into our dcache writably\nshouldn\u0027t incur much overhead.\n\nThis removes the need to do clearance in fscache_set_key() (where we aren\u0027t\ndoing it correctly anyway).\n\nAlso, we don\u0027t need to set cookie-\u003ekey_len in fscache_set_key() as we\nalready did it in the only caller, so remove that.\n\nFixes: ec0328e46d6e (\"fscache: Maintain a catalogue of allocated cookies\")\nReported-by: syzbot+a95b989b2dde8e806af8@syzkaller.appspotmail.com\nReported-by: Eric Sandeen \u003csandeen@redhat.com\u003e\nCc: stable \u003cstable@vger.kernel.org\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "169b803397499be85bdd1e3d07d6f5e3d4bd669e", "tree": "ada4c2e05d320dd3a275f71058bca9daad15d970", "parents": [ "eb66ae030829605d61fbef1909ce310e29f78821" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Oct 17 15:23:26 2018 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 18 11:32:21 2018 +0200" }, "message": "cachefiles: fix the race between cachefiles_bury_object() and rmdir(2)\n\nthe victim might\u0027ve been rmdir\u0027ed just before the lock_rename();\nunlike the normal callers, we do not look the source up after the\nparents are locked - we know it beforehand and just recheck that it\u0027s\nstill the child of what used to be its parent. Unfortunately,\nthe check is too weak - we don\u0027t spot a dead directory since its\n-\u003ed_parent is unchanged, dentry is positive, etc. So we sail all\nthe way to -\u003erename(), with hosting filesystems _not_ expecting\nto be asked renaming an rmdir\u0027ed subdirectory.\n\nThe fix is easy, fortunately - the lock on parent is sufficient for\nmaking IS_DEADDIR() on child safe.\n\nCc: stable@vger.kernel.org\nFixes: 9ae326a69004 (CacheFiles: A cache that backs onto a mounted filesystem)\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "eb66ae030829605d61fbef1909ce310e29f78821", "tree": "8807b57c5bfd28b6c9b689a124e0c37257ba002f", "parents": [ "19e6420e4170acce7a8651dfb87195dff5adbe72" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 12 15:22:59 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 18 11:30:52 2018 +0200" }, "message": "mremap: properly flush TLB before releasing the page\n\nJann Horn points out that our TLB flushing was subtly wrong for the\nmremap() case. What makes mremap() special is that we don\u0027t follow the\nusual \"add page to list of pages to be freed, then flush tlb, and then\nfree pages\". No, mremap() obviously just _moves_ the page from one page\ntable location to another.\n\nThat matters, because mremap() thus doesn\u0027t directly control the\nlifetime of the moved page with a freelist: instead, the lifetime of the\npage is controlled by the page table locking, that serializes access to\nthe entry.\n\nAs a result, we need to flush the TLB not just before releasing the lock\nfor the source location (to avoid any concurrent accesses to the entry),\nbut also before we release the destination page table lock (to avoid the\nTLB being flushed after somebody else has already done something to that\npage).\n\nThis also makes the whole \"need_flush\" logic unnecessary, since we now\nalways end up flushing the TLB for every valid entry.\n\nReported-and-tested-by: Jann Horn \u003cjannh@google.com\u003e\nAcked-by: Will Deacon \u003cwill.deacon@arm.com\u003e\nTested-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nAcked-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "19e6420e4170acce7a8651dfb87195dff5adbe72", "tree": "c9d0087d52e7fe8d08f8d8cdedafb3bd442c4819", "parents": [ "ca9f672f7c6b4f23b9b88600aaa285f35f07386e" ], "author": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Thu Oct 18 08:22:39 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 18 11:28:50 2018 +0200" }, "message": "LICENSES: Remove CC-BY-SA-4.0 license text\n\nUsing non-GPL licenses for our documentation is rather problematic,\nas it can directly include other files, which generally are GPLv2\nlicensed and thus not compatible.\n\nRemove this license now that the only user (idr.rst) is gone to avoid\npeople semi-accidentally using it again.\n\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ca9f672f7c6b4f23b9b88600aaa285f35f07386e", "tree": "8806e0d233be62d39f831c9d5881247ac434d4a3", "parents": [ "9bd871df56a752029b07dde326d799648994b992", "a309d5db58793d4d91f5a346e3fa58aa6bf60b12" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 18 11:24:32 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 18 11:24:32 2018 +0200" }, "message": "Merge branch \u0027ida-fixes-4.19-rc8\u0027 of git://git.infradead.org/users/willy/linux-dax\n\nMatthew writes:\n \"IDA/IDR fixes for 4.19\n\n I have two tiny fixes, one for the IDA test-suite and one for the IDR\n documentation license.\"\n\n* \u0027ida-fixes-4.19-rc8\u0027 of git://git.infradead.org/users/willy/linux-dax:\n idr: Change documentation license\n test_ida: Fix lockdep warning\n" }, { "commit": "20e8e72d0fa8e26202932c30d592bade73fdc701", "tree": "33b0ddcd564bf5b06b9fb02ee9e6f2f92046f4c2", "parents": [ "b955a910d7fde877e068f68fada5aac02e3a073d", "edeb0c90df3581b821a764052d185df985f8b8dc" ], "author": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Thu Oct 18 07:41:29 2018 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Thu Oct 18 07:41:29 2018 +0200" }, "message": "Merge tag \u0027perf-urgent-for-mingo-4.19-20181017\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent\n\nPull perf/urgent fixes from Arnaldo Carvalho de Melo:\n\n- Stop falling back to kallsyms for vDSO symbols lookup, this wasn\u0027t\n being really used and is not valid in arches such as Sparc, where\n user and kernel space don\u0027t share the address space, relying only on\n cpumode to figure out what DSOs to lookup (Arnaldo Carvalho de Melo)\n\n- Align CPU map synthesized events properly, fixing SIGBUS in\n CPUs like Sparc (David Miller)\n\n- Fix use of alternatives to find JDIR (Jarod Wilson)\n\n- Store IDs for events with their own CPUs when synthesizing user\n level event details (scale, unit, etc) events, fixing a crash\n when recording a PMU event with a cpumask defined (Jiri Olsa)\n\n- Fix wrong filter_band* values for uncore Intel vendor events (Jiri Olsa)\n\n- Fix detection of tracefs path in systems without tracefs, where\n that path should be the debugfs mountpoint plus \"/tracing/\" (Jiri Olsa)\n\n- Pass build flags to traceevent build, allowing using alternative\n flags in distro packages, RPM, for instance (Jiri Olsa)\n\n- Fix \u0027perf report\u0027 crash on invalid inline debug information (Milian Wolff)\n\n- Synch KVM UAPI copies (Arnaldo Carvalho de Melo)\n\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "eddf016b910486d2123675a6b5fd7d64f77cdca8", "tree": "cb22890e3b2e6d84060ef74398364db06279302d", "parents": [ "06a36ecb5d0ee4b379845a5687f83084d3187521" ], "author": { "name": "Nikolay Aleksandrov", "email": "nikolay@cumulusnetworks.com", "time": "Wed Oct 17 22:34:34 2018 +0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 22:35:42 2018 -0700" }, "message": "net: ipmr: fix unresolved entry dumps\n\nIf the skb space ends in an unresolved entry while dumping we\u0027ll miss\nsome unresolved entries. The reason is due to zeroing the entry counter\nbetween dumping resolved and unresolved mfc entries. We should just\nkeep counting until the whole table is dumped and zero when we move to\nthe next as we have a separate table counter.\n\nReported-by: Colin Ian King \u003ccolin.king@canonical.com\u003e\nFixes: 8fb472c09b9d (\"ipmr: improve hash scalability\")\nSigned-off-by: Nikolay Aleksandrov \u003cnikolay@cumulusnetworks.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "06a36ecb5d0ee4b379845a5687f83084d3187521", "tree": "c9dc3de5d18b0d511b933f5abe911f7e133f46ce", "parents": [ "5660b9d9d6a29c2c3cc12f62ae44bfb56b0a15a9" ], "author": { "name": "Gregory CLEMENT", "email": "gregory.clement@bootlin.com", "time": "Wed Oct 17 17:26:35 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 22:33:43 2018 -0700" }, "message": "net: mscc: ocelot: Fix comment in ocelot_vlant_wait_for_completion()\n\nThe ocelot_vlant_wait_for_completion() function is very similar to the\nocelot_mact_wait_for_completion(). It seemed to have be copied but the\ncomment was not updated, so let\u0027s fix it.\n\nSigned-off-by: Gregory CLEMENT \u003cgregory.clement@bootlin.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5660b9d9d6a29c2c3cc12f62ae44bfb56b0a15a9", "tree": "50cedf7d6c8e57a558190dfff589bc25c9e553a2", "parents": [ "05c998b738fdd3e5d6a257bcacc8f34b6284d795" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Wed Oct 17 21:11:27 2018 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 22:32:21 2018 -0700" }, "message": "sctp: fix the data size calculation in sctp_data_size\n\nsctp data size should be calculated by subtracting data chunk header\u0027s\nlength from chunk_hdr-\u003elength, not just data header.\n\nFixes: 668c9beb9020 (\"sctp: implement assign_number for sctp_stream_interleave\")\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nAcked-by: Marcelo Ricardo Leitner \u003cmarcelo.leitner@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "05c998b738fdd3e5d6a257bcacc8f34b6284d795", "tree": "07d022a2799373d700ce72650a95b51c7af70bf8", "parents": [ "84dad55951b0d009372ec21760b650634246e144" ], "author": { "name": "Ake Koomsin", "email": "ake@igel.co.jp", "time": "Wed Oct 17 19:44:12 2018 +0900" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 22:29:30 2018 -0700" }, "message": "virtio_net: avoid using netif_tx_disable() for serializing tx routine\n\nCommit 713a98d90c5e (\"virtio-net: serialize tx routine during reset\")\nintroduces netif_tx_disable() after netif_device_detach() in order to\navoid use-after-free of tx queues. However, there are two issues.\n\n1) Its operation is redundant with netif_device_detach() in case the\n interface is running.\n2) In case of the interface is not running before suspending and\n resuming, the tx does not get resumed by netif_device_attach().\n This results in losing network connectivity.\n\nIt is better to use netif_tx_lock_bh()/netif_tx_unlock_bh() instead for\nserializing tx routine during reset. This also preserves the symmetry\nof netif_device_detach() and netif_device_attach().\n\nFixes commit 713a98d90c5e (\"virtio-net: serialize tx routine during reset\")\nSigned-off-by: Ake Koomsin \u003cake@igel.co.jp\u003e\nAcked-by: Jason Wang \u003cjasowang@redhat.com\u003e\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9bd871df56a752029b07dde326d799648994b992", "tree": "ce407ad9aec3e77792dc8692d5e5e93dba07f54c", "parents": [ "c343db455eb3105f11bb5ac290d77ab2006b0209", "12ad0cb2123aed30241a14792ef5bef9efcccbcd" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 18 07:29:05 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 18 07:29:05 2018 +0200" }, "message": "Merge tag \u0027trace-v4.19-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace\n\nSteven writes:\n \"tracing: Two fixes for 4.19\n\n This fixes two bugs:\n - Fix size mismatch of tracepoint array\n - Have preemptirq test module use same clock source of the selftest\"\n\n* tag \u0027trace-v4.19-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:\n tracing: Use trace_clock_local() for looping in preemptirq_delay_test.c\n tracepoint: Fix tracepoint array element size mismatch\n" }, { "commit": "84dad55951b0d009372ec21760b650634246e144", "tree": "2762dbbeef8ffd2fdde75889b5a77c277879afc2", "parents": [ "9b3bc7db759e64c33471025721817467f8c3ecd4" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 17 11:44:04 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 22:26:53 2018 -0700" }, "message": "udp6: fix encap return code for resubmitting\n\nThe commit eb63f2964dbe (\"udp6: add missing checks on edumux packet\nprocessing\") used the same return code convention of the ipv4 counterpart,\nbut ipv6 uses the opposite one: positive values means resubmit.\n\nThis change addresses the issue, using positive return value for\nresubmitting. Also update the related comment, which was broken, too.\n\nFixes: eb63f2964dbe (\"udp6: add missing checks on edumux packet processing\")\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9b3bc7db759e64c33471025721817467f8c3ecd4", "tree": "3dab97b9c58de87c8587db412b4b43802b81ed06", "parents": [ "c863850ce22e1b0bb365d49cadf51f4765153ae4" ], "author": { "name": "Ido Schimmel", "email": "idosch@mellanox.com", "time": "Wed Oct 17 08:05:45 2018 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 22:25:45 2018 -0700" }, "message": "mlxsw: core: Fix use-after-free when flashing firmware during init\n\nWhen the switch driver (e.g., mlxsw_spectrum) determines it needs to\nflash a new firmware version it resets the ASIC after the flashing\nprocess. The bus driver (e.g., mlxsw_pci) then registers itself again\nwith mlxsw_core which means (among other things) that the device\nregisters itself again with the hwmon subsystem again.\n\nSince the device was registered with the hwmon subsystem using\ndevm_hwmon_device_register_with_groups(), then the old hwmon device\n(registered before the flashing) was never unregistered and was\nreferencing stale data, resulting in a use-after free.\n\nFix by removing reliance on device managed APIs in mlxsw_hwmon_init().\n\nFixes: c86d62cc410c (\"mlxsw: spectrum: Reset FW after flash\")\nSigned-off-by: Ido Schimmel \u003cidosch@mellanox.com\u003e\nReported-by: Alexander Petrovskiy \u003calexpe@mellanox.com\u003e\nTested-by: Alexander Petrovskiy \u003calexpe@mellanox.com\u003e\nReviewed-by: Petr Machata \u003cpetrm@mellanox.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c863850ce22e1b0bb365d49cadf51f4765153ae4", "tree": "4767e39744e554450fb419b8d28a3b548d669c6d", "parents": [ "b336decab22158937975293aea79396525f92bb3" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Wed Oct 17 03:06:12 2018 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 22:12:46 2018 -0700" }, "message": "sctp: not free the new asoc when sctp_wait_for_connect returns err\n\nWhen sctp_wait_for_connect is called to wait for connect ready\nfor sp-\u003estrm_interleave in sctp_sendmsg_to_asoc, a panic could\nbe triggered if cpu is scheduled out and the new asoc is freed\nelsewhere, as it will return err and later the asoc gets freed\nagain in sctp_sendmsg.\n\n[ 285.840764] list_del corruption, ffff9f0f7b284078-\u003enext is LIST_POISON1 (dead000000000100)\n[ 285.843590] WARNING: CPU: 1 PID: 8861 at lib/list_debug.c:47 __list_del_entry_valid+0x50/0xa0\n[ 285.846193] Kernel panic - not syncing: panic_on_warn set ...\n[ 285.846193]\n[ 285.848206] CPU: 1 PID: 8861 Comm: sctp_ndata Kdump: loaded Not tainted 4.19.0-rc7.label #584\n[ 285.850559] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n[ 285.852164] Call Trace:\n...\n[ 285.872210] ? __list_del_entry_valid+0x50/0xa0\n[ 285.872894] sctp_association_free+0x42/0x2d0 [sctp]\n[ 285.873612] sctp_sendmsg+0x5a4/0x6b0 [sctp]\n[ 285.874236] sock_sendmsg+0x30/0x40\n[ 285.874741] ___sys_sendmsg+0x27a/0x290\n[ 285.875304] ? __switch_to_asm+0x34/0x70\n[ 285.875872] ? __switch_to_asm+0x40/0x70\n[ 285.876438] ? ptep_set_access_flags+0x2a/0x30\n[ 285.877083] ? do_wp_page+0x151/0x540\n[ 285.877614] __sys_sendmsg+0x58/0xa0\n[ 285.878138] do_syscall_64+0x55/0x180\n[ 285.878669] entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nThis is a similar issue with the one fixed in Commit ca3af4dd28cf\n(\"sctp: do not free asoc when it is already dead in sctp_sendmsg\").\nBut this one can\u0027t be fixed by returning -ESRCH for the dead asoc\nin sctp_wait_for_connect, as it will break sctp_connect\u0027s return\nvalue to users.\n\nThis patch is to simply set err to -ESRCH before it returns to\nsctp_sendmsg when any err is returned by sctp_wait_for_connect\nfor sp-\u003estrm_interleave, so that no asoc would be freed due to\nthis.\n\nWhen users see this error, they will know the packet hasn\u0027t been\nsent. And it also makes sense to not free asoc because waiting\nconnect fails, like the second call for sctp_wait_for_connect in\nsctp_sendmsg_to_asoc.\n\nFixes: 668c9beb9020 (\"sctp: implement assign_number for sctp_stream_interleave\")\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nAcked-by: Marcelo Ricardo Leitner \u003cmarcelo.leitner@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b336decab22158937975293aea79396525f92bb3", "tree": "377447f6b7b0a37a2f117c1308bc22a5fa906250", "parents": [ "9675931e6b65d160d16bcc9472c1acef15524def" ], "author": { "name": "Marcelo Ricardo Leitner", "email": "marcelo.leitner@gmail.com", "time": "Tue Oct 16 15:18:17 2018 -0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 22:11:14 2018 -0700" }, "message": "sctp: fix race on sctp_id2asoc\n\nsyzbot reported an use-after-free involving sctp_id2asoc. Dmitry Vyukov\nhelped to root cause it and it is because of reading the asoc after it\nwas freed:\n\n CPU 1 CPU 2\n(working on socket 1) (working on socket 2)\n\t sctp_association_destroy\nsctp_id2asoc\n spin lock\n grab the asoc from idr\n spin unlock\n spin lock\n\t\t\t\t remove asoc from idr\n\t\t\t\t spin unlock\n\t\t\t\t free(asoc)\n if asoc-\u003ebase.sk !\u003d sk ... [*]\n\nThis can only be hit if trying to fetch asocs from different sockets. As\nwe have a single IDR for all asocs, in all SCTP sockets, their id is\nunique on the system. An application can try to send stuff on an id\nthat matches on another socket, and the if in [*] will protect from such\nusage. But it didn\u0027t consider that as that asoc may belong to another\nsocket, it may be freed in parallel (read: under another socket lock).\n\nWe fix it by moving the checks in [*] into the protected region. This\nfixes it because the asoc cannot be freed while the lock is held.\n\nReported-by: syzbot+c7dd55d7aec49d48e49a@syzkaller.appspotmail.com\nAcked-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: Marcelo Ricardo Leitner \u003cmarcelo.leitner@gmail.com\u003e\nAcked-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9675931e6b65d160d16bcc9472c1acef15524def", "tree": "e71cc422beee0d1e8fbb8decf2ab20431d522ee5", "parents": [ "84258438e8ce12d6888b68a1238bba9cb25307e2" ], "author": { "name": "Heiner Kallweit", "email": "hkallweit1@gmail.com", "time": "Tue Oct 16 19:35:17 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 22:10:33 2018 -0700" }, "message": "r8169: re-enable MSI-X on RTL8168g\n\nSimilar to d49c88d7677b (\"r8169: Enable MSI-X on RTL8106e\") after\ne9d0ba506ea8 (\"PCI: Reprogram bridge prefetch registers on resume\")\nwe can safely assume that this also fixes the root cause of\nthe issue worked around by 7c53a722459c (\"r8169: don\u0027t use MSI-X on\nRTL8168g\"). So let\u0027s revert it.\n\nFixes: 7c53a722459c (\"r8169: don\u0027t use MSI-X on RTL8168g\")\nSigned-off-by: Heiner Kallweit \u003chkallweit1@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "84258438e8ce12d6888b68a1238bba9cb25307e2", "tree": "a67b1dc0cd68316ccf42f8b124a1887930e2d2a2", "parents": [ "efa61c8cf2950ab5c0e66cff3cabe2a2b24e81ba" ], "author": { "name": "Taehee Yoo", "email": "ap420073@gmail.com", "time": "Wed Oct 17 00:35:10 2018 +0900" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 22:03:40 2018 -0700" }, "message": "net: bpfilter: use get_pid_task instead of pid_task\n\npid_task() dereferences rcu protected tasks array.\nBut there is no rcu_read_lock() in shutdown_umh() routine so that\nrcu_read_lock() is needed.\nget_pid_task() is wrapper function of pid_task. it holds rcu_read_lock()\nthen calls pid_task(). if task isn\u0027t NULL, it increases reference count\nof task.\n\ntest commands:\n %modprobe bpfilter\n %modprobe -rv bpfilter\n\nsplat looks like:\n[15102.030932] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[15102.030957] WARNING: suspicious RCU usage\n[15102.030985] 4.19.0-rc7+ #21 Not tainted\n[15102.031010] -----------------------------\n[15102.031038] kernel/pid.c:330 suspicious rcu_dereference_check() usage!\n[15102.031063]\n\t other info that might help us debug this:\n\n[15102.031332]\n\t rcu_scheduler_active \u003d 2, debug_locks \u003d 1\n[15102.031363] 1 lock held by modprobe/1570:\n[15102.031389] #0: 00000000580ef2b0 (bpfilter_lock){+.+.}, at: stop_umh+0x13/0x52 [bpfilter]\n[15102.031552]\n stack backtrace:\n[15102.031583] CPU: 1 PID: 1570 Comm: modprobe Not tainted 4.19.0-rc7+ #21\n[15102.031607] Hardware name: To be filled by O.E.M. To be filled by O.E.M./Aptio CRB, BIOS 5.6.5 07/08/2015\n[15102.031628] Call Trace:\n[15102.031676] dump_stack+0xc9/0x16b\n[15102.031723] ? show_regs_print_info+0x5/0x5\n[15102.031801] ? lockdep_rcu_suspicious+0x117/0x160\n[15102.031855] pid_task+0x134/0x160\n[15102.031900] ? find_vpid+0xf0/0xf0\n[15102.032017] shutdown_umh.constprop.1+0x1e/0x53 [bpfilter]\n[15102.032055] stop_umh+0x46/0x52 [bpfilter]\n[15102.032092] __x64_sys_delete_module+0x47e/0x570\n[ ... ]\n\nFixes: d2ba09c17a06 (\"net: add skeleton of bpfilter kernel module\")\nSigned-off-by: Taehee Yoo \u003cap420073@gmail.com\u003e\nAcked-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "efa61c8cf2950ab5c0e66cff3cabe2a2b24e81ba", "tree": "aca302d3439f23b8282062a9c738485372d7ea9f", "parents": [ "8c3bf9b62b667456a57aefcf1689e826df146159" ], "author": { "name": "Gustavo A. R. Silva", "email": "gustavo@embeddedor.com", "time": "Tue Oct 16 15:06:41 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 22:00:22 2018 -0700" }, "message": "ptp: fix Spectre v1 vulnerability\n\npin_index can be indirectly controlled by user-space, hence leading\nto a potential exploitation of the Spectre variant 1 vulnerability.\n\nThis issue was detected with the help of Smatch:\n\ndrivers/ptp/ptp_chardev.c:253 ptp_ioctl() warn: potential spectre issue\n\u0027ops-\u003epin_config\u0027 [r] (local cap)\n\nFix this by sanitizing pin_index before using it to index\nops-\u003epin_config, and before passing it as an argument to\nfunction ptp_set_pinfunc(), in which it is used to index\ninfo-\u003epin_config.\n\nNotice that given that speculation windows are large, the policy is\nto kill the speculation on the first load and not worry if it can be\ncompleted with a dependent load/store [1].\n\n[1] https://marc.info/?l\u003dlinux-kernel\u0026m\u003d152449131114778\u0026w\u003d2\n\nCc: stable@vger.kernel.org\nSigned-off-by: Gustavo A. R. Silva \u003cgustavo@embeddedor.com\u003e\nAcked-by: Richard Cochran \u003crichardcochran@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "62d6f3b7b85e9ba79c96bfd36f501f180908e623", "tree": "f7c87ebde04faf3148ce301c8ee6bb312b024e30", "parents": [ "776ca1543b5fe673aaf1beb244fcc2429d378083" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Sat Oct 13 13:26:53 2018 +0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 21:55:02 2018 -0700" }, "message": "sparc: vDSO: Silence an uninitialized variable warning\n\nSmatch complains that \"val\" would be uninitialized if kstrtoul() fails.\n\nFixes: 9a08862a5d2e (\"vDSO for sparc\")\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8c3bf9b62b667456a57aefcf1689e826df146159", "tree": "72fa781c083b785755bf1415b43dc45b7331071e", "parents": [ "dc6d0f0b4340ef6814d5345dbeaa5e909395dd1d" ], "author": { "name": "Nathan Chancellor", "email": "natechancellor@gmail.com", "time": "Fri Oct 12 19:14:58 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 21:52:40 2018 -0700" }, "message": "net: qla3xxx: Remove overflowing shift statement\n\nClang currently warns:\n\ndrivers/net/ethernet/qlogic/qla3xxx.c:384:24: warning: signed shift\nresult (0xF00000000) requires 37 bits to represent, but \u0027int\u0027 only has\n32 bits [-Wshift-overflow]\n ((ISP_NVRAM_MASK \u003c\u003c 16) | qdev-\u003eeeprom_cmd_data));\n ~~~~~~~~~~~~~~ ^ ~~\n1 warning generated.\n\nThe warning is certainly accurate since ISP_NVRAM_MASK is defined as\n(0x000F \u003c\u003c 16) which is then shifted by 16, resulting in 64424509440,\nwell above UINT_MAX.\n\nGiven that this is the only location in this driver where ISP_NVRAM_MASK\nis shifted again, it seems likely that ISP_NVRAM_MASK was originally\ndefined without a shift and during the move of the shift to the\ndefinition, this statement wasn\u0027t properly removed (since ISP_NVRAM_MASK\nis used in the statenent right above this). Only the maintainers can\nconfirm this since this statment has been here since the driver was\nfirst added to the kernel.\n\nLink: https://github.com/ClangBuiltLinux/linux/issues/127\nSigned-off-by: Nathan Chancellor \u003cnatechancellor@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "dc6d0f0b4340ef6814d5345dbeaa5e909395dd1d", "tree": "8446305611f6d7e76b1470f1ca91f8bdb822b7bf", "parents": [ "0ac1077e3a549bf8d35971613e2be05bdbb41a00", "6b4f92af3d59e882d3ba04c44a815266890d188f" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 21:51:14 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 21:51:14 2018 -0700" }, "message": "Merge branch \u0027geneve-vxlan-mtu\u0027\n\nStefano Brivio says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ngeneve, vxlan: Don\u0027t set exceptions if skb-\u003elen \u003c mtu\n\nThis series fixes the exception abuse described in 2/2, and 1/2\nis just a preparatory change to make 2/2 less ugly.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "6b4f92af3d59e882d3ba04c44a815266890d188f", "tree": "8446305611f6d7e76b1470f1ca91f8bdb822b7bf", "parents": [ "7463e4f9b99c089cc962033b46349ff29f466e40" ], "author": { "name": "Stefano Brivio", "email": "sbrivio@redhat.com", "time": "Fri Oct 12 23:53:59 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 21:51:13 2018 -0700" }, "message": "geneve, vxlan: Don\u0027t set exceptions if skb-\u003elen \u003c mtu\n\nWe shouldn\u0027t abuse exceptions: if the destination MTU is already higher\nthan what we\u0027re transmitting, no exception should be created.\n\nFixes: 52a589d51f10 (\"geneve: update skb dst pmtu on tx path\")\nFixes: a93bf0ff4490 (\"vxlan: update skb dst pmtu on tx path\")\nSigned-off-by: Stefano Brivio \u003csbrivio@redhat.com\u003e\nReviewed-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7463e4f9b99c089cc962033b46349ff29f466e40", "tree": "6fbeefca60c20be0d9a94de89e1c14294f7a2f9d", "parents": [ "0ac1077e3a549bf8d35971613e2be05bdbb41a00" ], "author": { "name": "Stefano Brivio", "email": "sbrivio@redhat.com", "time": "Fri Oct 12 23:53:58 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 21:51:13 2018 -0700" }, "message": "geneve, vxlan: Don\u0027t check skb_dst() twice\n\nCommit f15ca723c1eb (\"net: don\u0027t call update_pmtu unconditionally\") avoids\nthat we try updating PMTU for a non-existent destination, but didn\u0027t clean\nup cases where the check was already explicit. Drop those redundant checks.\n\nSigned-off-by: Stefano Brivio \u003csbrivio@redhat.com\u003e\nReviewed-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "776ca1543b5fe673aaf1beb244fcc2429d378083", "tree": "c40d5e40a9a3746b21520c2d57a45d0de01ed6fe", "parents": [ "c343db455eb3105f11bb5ac290d77ab2006b0209" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 21:28:01 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 17 21:29:23 2018 -0700" }, "message": "sparc: Fix syscall fallback bugs in VDSO.\n\nFirst, the trap number for 32-bit syscalls is 0x10.\n\nAlso, only negate the return value when syscall error is indicated by\nthe carry bit being set.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "12ad0cb2123aed30241a14792ef5bef9efcccbcd", "tree": "a6497cdd033e48ff272019a7f11cbbda669b94bd", "parents": [ "9c0be3f6b5d776dfe3ed249862c244a4486414dc" ], "author": { "name": "Steven Rostedt (VMware)", "email": "rostedt@goodmis.org", "time": "Mon Oct 15 23:31:42 2018 -0400" }, "committer": { "name": "Steven Rostedt (VMware)", "email": "rostedt@goodmis.org", "time": "Wed Oct 17 15:35:33 2018 -0400" }, "message": "tracing: Use trace_clock_local() for looping in preemptirq_delay_test.c\n\nThe preemptirq_delay_test module is used for the ftrace selftest code that\ntests the latency tracers. The problem is that it uses ktime for the delay\nloop, and then checks the tracer to see if the delay loop is caught, but the\ntracer uses trace_clock_local() which uses various different other clocks to\nmeasure the latency. As ktime uses the clock cycles, and the code then\nconverts that to nanoseconds, it causes rounding errors, and the preemptirq\nlatency tests are failing due to being off by 1 (it expects to see a delay\nof 500000 us, but the delay is only 499999 us). This is happening due to a\nrounding error in the ktime (which is totally legit). The purpose of the\ntest is to see if it can catch the delay, not to test the accuracy between\ntrace_clock_local() and ktime_get(). Best to use apples to apples, and have\nthe delay loop use the same clock as the latency tracer does.\n\nCc: stable@vger.kernel.org\nFixes: f96e8577da102 (\"lib: Add module for testing preemptoff/irqsoff latency tracers\")\nAcked-by: Joel Fernandes (Google) \u003cjoel@joelfernandes.org\u003e\nSigned-off-by: Steven Rostedt (VMware) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "9c0be3f6b5d776dfe3ed249862c244a4486414dc", "tree": "7bf3f3e4b90045293c299b0a7747adfe60e4b055", "parents": [ "62165600ae73ebd76e2d9b992b36360408d570d8" ], "author": { "name": "Mathieu Desnoyers", "email": "mathieu.desnoyers@efficios.com", "time": "Sat Oct 13 15:10:50 2018 -0400" }, "committer": { "name": "Steven Rostedt (VMware)", "email": "rostedt@goodmis.org", "time": "Wed Oct 17 15:35:29 2018 -0400" }, "message": "tracepoint: Fix tracepoint array element size mismatch\n\ncommit 46e0c9be206f (\"kernel: tracepoints: add support for relative\nreferences\") changes the layout of the __tracepoint_ptrs section on\narchitectures supporting relative references. However, it does so\nwithout turning struct tracepoint * const into const int elsewhere in\nthe tracepoint code, which has the following side-effect:\n\nSetting mod-\u003enum_tracepoints is done in by module.c:\n\n mod-\u003etracepoints_ptrs \u003d section_objs(info, \"__tracepoints_ptrs\",\n sizeof(*mod-\u003etracepoints_ptrs),\n \u0026mod-\u003enum_tracepoints);\n\nBasically, since sizeof(*mod-\u003etracepoints_ptrs) is a pointer size\n(rather than sizeof(int)), num_tracepoints is erroneously set to half the\nsize it should be on 64-bit arch. So a module with an odd number of\ntracepoints misses the last tracepoint due to effect of integer\ndivision.\n\nSo in the module going notifier:\n\n for_each_tracepoint_range(mod-\u003etracepoints_ptrs,\n mod-\u003etracepoints_ptrs + mod-\u003enum_tracepoints,\n tp_module_going_check_quiescent, NULL);\n\nthe expression (mod-\u003etracepoints_ptrs + mod-\u003enum_tracepoints) actually\nevaluates to something within the bounds of the array, but miss the\nlast tracepoint if the number of tracepoints is odd on 64-bit arch.\n\nFix this by introducing a new typedef: tracepoint_ptr_t, which\nis either \"const int\" on architectures that have PREL32 relocations,\nor \"struct tracepoint * const\" on architectures that does not have\nthis feature.\n\nAlso provide a new tracepoint_ptr_defer() static inline to\nencapsulate deferencing this type rather than duplicate code and\nugly idefs within the for_each_tracepoint_range() implementation.\n\nThis issue appears in 4.19-rc kernels, and should ideally be fixed\nbefore the end of the rc cycle.\n\nAcked-by: Ard Biesheuvel \u003card.biesheuvel@linaro.org\u003e\nAcked-by: Jessica Yu \u003cjeyu@kernel.org\u003e\nLink: http://lkml.kernel.org/r/20181013191050.22389-1-mathieu.desnoyers@efficios.com\nLink: http://lkml.kernel.org/r/20180704083651.24360-7-ard.biesheuvel@linaro.org\nCc: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Ard Biesheuvel \u003card.biesheuvel@linaro.org\u003e\nCc: Arnd Bergmann \u003carnd@arndb.de\u003e\nCc: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nCc: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nCc: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: James Morris \u003cjames.morris@microsoft.com\u003e\nCc: James Morris \u003cjmorris@namei.org\u003e\nCc: Josh Poimboeuf \u003cjpoimboe@redhat.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Nicolas Pitre \u003cnico@linaro.org\u003e\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: Petr Mladek \u003cpmladek@suse.com\u003e\nCc: Russell King \u003clinux@armlinux.org.uk\u003e\nCc: \"Serge E. Hallyn\" \u003cserge@hallyn.com\u003e\nCc: Sergey Senozhatsky \u003csergey.senozhatsky@gmail.com\u003e\nCc: Thomas Garnier \u003cthgarnie@google.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Will Deacon \u003cwill.deacon@arm.com\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nSigned-off-by: Steven Rostedt (VMware) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "9ae24af3669111d418242caec8dd4ebd9ba26860", "tree": "8101ff2b63f87ade850be0cd1424b5b493ccf69d", "parents": [ "665c365a77fbfeabe52694aedf3446d5f2f1ce42" ], "author": { "name": "Gustavo A. R. Silva", "email": "gustavo@embeddedor.com", "time": "Tue Oct 16 12:16:45 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 17 20:57:55 2018 +0200" }, "message": "usb: gadget: storage: Fix Spectre v1 vulnerability\n\nnum can be indirectly controlled by user-space, hence leading to\na potential exploitation of the Spectre variant 1 vulnerability.\n\nThis issue was detected with the help of Smatch:\n\ndrivers/usb/gadget/function/f_mass_storage.c:3177 fsg_lun_make() warn:\npotential spectre issue \u0027fsg_opts-\u003ecommon-\u003eluns\u0027 [r] (local cap)\n\nFix this by sanitizing num before using it to index\nfsg_opts-\u003ecommon-\u003eluns\n\nNotice that given that speculation windows are large, the policy is\nto kill the speculation on the first load and not worry if it can be\ncompleted with a dependent load/store [1].\n\n[1] https://marc.info/?l\u003dlinux-kernel\u0026m\u003d152449131114778\u0026w\u003d2\n\nCc: stable@vger.kernel.org\nSigned-off-by: Gustavo A. R. Silva \u003cgustavo@embeddedor.com\u003e\nAcked-by: Felipe Balbi \u003cfelipe.balbi@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "edeb0c90df3581b821a764052d185df985f8b8dc", "tree": "4aca9a757c81c9edcc50dee23dda20e2d16cf827", "parents": [ "298faf53200fc02af38d32715697df6e661c1257" ], "author": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Tue Oct 16 17:08:29 2018 -0300" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Wed Oct 17 15:56:15 2018 -0300" }, "message": "perf tools: Stop fallbacking to kallsyms for vdso symbols lookup\n\nDavid reports that:\n\n\u003cquote\u003e\nPerf has this hack where it uses the kernel symbol map as a backup when\na symbol can\u0027t be found in the user\u0027s symbol table(s).\n\nThis causes problems because the tests driving this code path use\nmachine__kernel_ip(), and that is completely meaningless on Sparc. On\nsparc64 the kernel and user live in physically separate virtual address\nspaces, rather than a shared one. And the kernel lives at a virtual\naddress that overlaps common userspace addresses. So this test passes\nalmost all the time when a user symbol lookup fails.\n\nThe consequence of this is that, if the unfound user virtual address in\nthe sample doesn\u0027t match up to a kernel symbol either, we trigger things\nlike this code in builtin-top.c:\n\n\tif (al.sym \u003d\u003d NULL \u0026\u0026 al.map !\u003d NULL) {\n\t\tconst char *msg \u003d \"Kernel samples will not be resolved.\\n\";\n\t\t/*\n\t\t * As we do lazy loading of symtabs we only will know if the\n\t\t * specified vmlinux file is invalid when we actually have a\n\t\t * hit in kernel space and then try to load it. So if we get\n\t\t * here and there are _no_ symbols in the DSO backing the\n\t\t * kernel map, bail out.\n\t\t *\n\t\t * We may never get here, for instance, if we use -K/\n\t\t * --hide-kernel-symbols, even if the user specifies an\n\t\t * invalid --vmlinux ;-)\n\t\t */\n\t\tif (!machine-\u003ekptr_restrict_warned \u0026\u0026 !top-\u003evmlinux_warned \u0026\u0026\n\t\t __map__is_kernel(al.map) \u0026\u0026 map__has_symbols(al.map)) {\n\t\t\tif (symbol_conf.vmlinux_name) {\n\t\t\t\tchar serr[256];\n\t\t\t\tdso__strerror_load(al.map-\u003edso, serr, sizeof(serr));\n\t\t\t\tui__warning(\"The %s file can\u0027t be used: %s\\n%s\",\n\t\t\t\t\t symbol_conf.vmlinux_name, serr, msg);\n\t\t\t} else {\n\t\t\t\tui__warning(\"A vmlinux file was not found.\\n%s\",\n\t\t\t\t\t msg);\n\t\t\t}\n\n\t\t\tif (use_browser \u003c\u003d 0)\n\t\t\t\tsleep(5);\n\t\t\ttop-\u003evmlinux_warned \u003d true;\n\t\t}\n\t}\n\nWhen I fire up a compilation on sparc, this triggers immediately.\n\nI\u0027m trying to figure out what the \"backup to kernel map\" code is\naccomplishing.\n\nI see some language in the current code and in the changes that have\nhappened in this area talking about vdso. Does that really happen?\n\nThe vdso is mapped into userspace virtual addresses, not kernel ones.\n\nMore history. This didn\u0027t cause problems on sparc some time ago,\nbecause the kernel IP check used to be \"ip \u003c 0\" :-) Sparc kernel\naddresses are not negative. But now with machine__kernel_ip(), which\nworks using the symbol table determined kernel address range, it does\ntrigger.\n\nWhat it all boils down to is that on architectures like sparc,\nmachine__kernel_ip() should always return false in this scenerio, and\ntherefore this kind of logic:\n\n\t\tif (cpumode \u003d\u003d PERF_RECORD_MISC_USER \u0026\u0026 machine \u0026\u0026\n\t\t mg !\u003d \u0026machine-\u003ekmaps \u0026\u0026\n\t\t machine__kernel_ip(machine, al-\u003eaddr)) {\n\nis basically invalid. PERF_RECORD_MISC_USER implies no kernel address\ncan possibly match for the sample/event in question (no matter how\nhard you try!) :-)\n\u003c/\u003e\n\nSo, I thought something had changed and in the past we would somehow\nfind that address in the kallsyms, but I couldn\u0027t find anything to back\nthat up, the patch introducing this is over a decade old, lots of things\nchanged, so I was just thinking I was missing something.\n\nI tried a gtod busy loop to generate vdso activity and added a \u0027perf\nprobe\u0027 at that branch, on x86_64 to see if it ever gets hit:\n\nMade thread__find_map() noinline, as \u0027perf probe\u0027 in lines of inline\nfunctions seems to not be working, only at function start. (Masami?)\n\n # perf probe -x ~/bin/perf -L thread__find_map:57\n \u003cthread__find_map@/home/acme/git/perf/tools/perf/util/event.c:57\u003e\n 57 if (cpumode \u003d\u003d PERF_RECORD_MISC_USER \u0026\u0026 machine \u0026\u0026\n 58 mg !\u003d \u0026machine-\u003ekmaps \u0026\u0026\n 59 machine__kernel_ip(machine, al-\u003eaddr)) {\n 60 mg \u003d \u0026machine-\u003ekmaps;\n 61 load_map \u003d true;\n 62 goto try_again;\n }\n } else {\n /*\n * Kernel maps might be changed when loading\n * symbols so loading\n * must be done prior to using kernel maps.\n */\n 69 if (load_map)\n 70 map__load(al-\u003emap);\n 71 al-\u003eaddr \u003d al-\u003emap-\u003emap_ip(al-\u003emap, al-\u003eaddr);\n\n # perf probe -x ~/bin/perf thread__find_map:60\n Added new event:\n probe_perf:thread__find_map (on thread__find_map:60 in /home/acme/bin/perf)\n\n You can now use it in all perf tools, such as:\n\n\tperf record -e probe_perf:thread__find_map -aR sleep 1\n\n #\n\n Then used this to see if, system wide, those probe points were being hit:\n\n # perf trace -e *perf:thread*/max-stack\u003d8/\n ^C[root@jouet ~]#\n\n No hits when running \u0027perf top\u0027 and:\n\n # cat gtod.c\n #include \u003csys/time.h\u003e\n\n int main(void)\n {\n\tstruct timeval tv;\n\n\twhile (1)\n\t\tgettimeofday(\u0026tv, 0);\n\n\treturn 0;\n }\n [root@jouet c]# ./gtod\n ^C\n\n Pressed \u0027P\u0027 in \u0027perf top\u0027 and the [vdso] samples are there:\n\n 62.84% [vdso] [.] __vdso_gettimeofday\n 8.13% gtod [.] main\n 7.51% [vdso] [.] 0x0000000000000914\n 5.78% [vdso] [.] 0x0000000000000917\n 5.43% gtod [.] _init\n 2.71% [vdso] [.] 0x000000000000092d\n 0.35% [kernel] [k] native_io_delay\n 0.33% libc-2.26.so [.] __memmove_avx_unaligned_erms\n 0.20% [vdso] [.] 0x000000000000091d\n 0.17% [i2c_i801] [k] i801_access\n 0.06% firefox [.] free\n 0.06% libglib-2.0.so.0.5400.3 [.] g_source_iter_next\n 0.05% [vdso] [.] 0x0000000000000919\n 0.05% libpthread-2.26.so [.] __pthread_mutex_lock\n 0.05% libpixman-1.so.0.34.0 [.] 0x000000000006d3a7\n 0.04% [kernel] [k] entry_SYSCALL_64_trampoline\n 0.04% libxul.so [.] style::dom_apis::query_selector_slow\n 0.04% [kernel] [k] module_get_kallsym\n 0.04% firefox [.] malloc\n 0.04% [vdso] [.] 0x0000000000000910\n\n I added a \u0027perf probe\u0027 to thread__find_map:69, and that surely got tons\n of hits, i.e. for every map found, just to make sure the \u0027perf probe\u0027\n command was really working.\n\n In the process I noticed a bug, we\u0027re only have records for \u0027[vdso]\u0027 for\n pre-existing commands, i.e. ones that are running when we start \u0027perf top\u0027,\n when we will generate the PERF_RECORD_MMAP by looking at /perf/PID/maps.\n\n I.e. like this, for preexisting processes with a vdso map, again,\n tracing for all the system, only pre-existing processes get a [vdso] map\n (when having one):\n\n [root@jouet ~]# perf probe -x ~/bin/perf __machine__addnew_vdso\n Added new event:\n probe_perf:__machine__addnew_vdso (on __machine__addnew_vdso in /home/acme/bin/perf)\n\n You can now use it in all perf tools, such as:\n\n\tperf record -e probe_perf:__machine__addnew_vdso -aR sleep 1\n\n [root@jouet ~]# perf trace -e probe_perf:__machine__addnew_vdso/max-stack\u003d8/\n 0.000 probe_perf:__machine__addnew_vdso:(568eb3)\n __machine__addnew_vdso (/home/acme/bin/perf)\n map__new (/home/acme/bin/perf)\n machine__process_mmap2_event (/home/acme/bin/perf)\n machine__process_event (/home/acme/bin/perf)\n perf_event__process (/home/acme/bin/perf)\n perf_tool__process_synth_event (/home/acme/bin/perf)\n perf_event__synthesize_mmap_events (/home/acme/bin/perf)\n __event__synthesize_thread (/home/acme/bin/perf)\n\nThe kernel is generating a PERF_RECORD_MMAP for vDSOs, but somehow\n\u0027perf top\u0027 is not getting those records while \u0027perf record\u0027 is:\n\n # perf record ~acme/c/gtod\n ^C[ perf record: Woken up 1 times to write data ]\n [ perf record: Captured and wrote 0.076 MB perf.data (1499 samples) ]\n\n # perf report -D | grep PERF_RECORD_MMAP2\n 71293612401913 0x11b48 [0x70]: PERF_RECORD_MMAP2 25484/25484: [0x400000(0x1000) @ 0 fd:02 1137 541179306]: r-xp /home/acme/c/gtod\n 71293612419012 0x11be0 [0x70]: PERF_RECORD_MMAP2 25484/25484: [0x7fa4a2783000(0x227000) @ 0 fd:00 3146370 854107250]: r-xp /usr/lib64/ld-2.26.so\n 71293612432110 0x11c50 [0x60]: PERF_RECORD_MMAP2 25484/25484: [0x7ffcdb53a000(0x2000) @ 0 00:00 0 0]: r-xp [vdso]\n 71293612509944 0x11cb0 [0x70]: PERF_RECORD_MMAP2 25484/25484: [0x7fa4a23cd000(0x3b6000) @ 0 fd:00 3149723 262067164]: r-xp /usr/lib64/libc-2.26.so\n #\n # perf script | grep vdso | head\n gtod 25484 71293.612768: 2485554 cycles:ppp: 7ffcdb53a914 [unknown] ([vdso])\n gtod 25484 71293.613576: 2149343 cycles:ppp: 7ffcdb53a917 [unknown] ([vdso])\n gtod 25484 71293.614274: 1814652 cycles:ppp: 7ffcdb53aca8 __vdso_gettimeofday+0x98 ([vdso])\n gtod 25484 71293.614862: 1669070 cycles:ppp: 7ffcdb53acc5 __vdso_gettimeofday+0xb5 ([vdso])\n gtod 25484 71293.615404: 1451589 cycles:ppp: 7ffcdb53acc5 __vdso_gettimeofday+0xb5 ([vdso])\n gtod 25484 71293.615999: 1269941 cycles:ppp: 7ffcdb53ace6 __vdso_gettimeofday+0xd6 ([vdso])\n gtod 25484 71293.616405: 1177946 cycles:ppp: 7ffcdb53a914 [unknown] ([vdso])\n gtod 25484 71293.616775: 1121290 cycles:ppp: 7ffcdb53ac47 __vdso_gettimeofday+0x37 ([vdso])\n gtod 25484 71293.617150: 1037721 cycles:ppp: 7ffcdb53ace6 __vdso_gettimeofday+0xd6 ([vdso])\n gtod 25484 71293.617478: 994526 cycles:ppp: 7ffcdb53ace6 __vdso_gettimeofday+0xd6 ([vdso])\n #\n\nThe patch is the obvious one and with it we also continue to resolve\nvdso symbols for pre-existing processes in \u0027perf top\u0027 and for all\nprocesses in \u0027perf record\u0027 + \u0027perf report/script\u0027.\n\nSuggested-by: David Miller \u003cdavem@davemloft.net\u003e\nAcked-by: David Miller \u003cdavem@davemloft.net\u003e\nCc: Adrian Hunter \u003cadrian.hunter@intel.com\u003e\nCc: David Ahern \u003cdsahern@gmail.com\u003e\nCc: Jiri Olsa \u003cjolsa@kernel.org\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Wang Nan \u003cwangnan0@huawei.com\u003e\nLink: https://lkml.kernel.org/n/tip-cs7skq9pp0kjypiju6o7trse@git.kernel.org\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "7a7080b53467ad96c0b371e9d2a2a312f96f99c2", "tree": "071f901799bb74de0b723b53f5159e4bf2e90fb9", "parents": [ "5e65a20341e02df637d1c16cd487858d2c6a876a", "48f78be3326052a7718678ff9a78d6d884a50323" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Wed Oct 17 09:45:49 2018 -0600" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Wed Oct 17 09:45:49 2018 -0600" }, "message": "Merge branch \u0027nvme-4.19\u0027 of git://git.infradead.org/nvme into for-linus\n\nPull single NVMe fix from Christoph.\n\n* \u0027nvme-4.19\u0027 of git://git.infradead.org/nvme:\n nvme: remove ns sibling before clearing path\n" }, { "commit": "c343db455eb3105f11bb5ac290d77ab2006b0209", "tree": "4b92c690553062462742a3d41bdb3fac727b9b83", "parents": [ "c0cff31be705014ce127d6a6570b02f8515de3e2", "cf8afe5c53621eda385be961bc72329a2adcd767" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 17 14:01:00 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 17 14:01:00 2018 +0200" }, "message": "Merge branch \u0027parisc-4.19-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux\n\nHelge writes:\n \"parisc fix:\n\n Fix an unitialized variable usage in the parisc unwind code.\"\n\n* \u0027parisc-4.19-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:\n parisc: Fix uninitialized variable usage in unwind.c\n" }, { "commit": "c0cff31be705014ce127d6a6570b02f8515de3e2", "tree": "23b9b3f032a90b9730e657a6e77763a56cafe94c", "parents": [ "b955a910d7fde877e068f68fada5aac02e3a073d", "02621216e1d8a13abf1d040ff3b7ccf41b2df578" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 17 13:40:10 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 17 13:40:10 2018 +0200" }, "message": "Merge tag \u0027clk-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux\n\nStephen writes:\n \"clk fixes for v4.19-rc8\n\n One fix for the Allwinner A10 SoC\u0027s audio PLL that wasn\u0027t properly\n set and generating noise.\"\n\n* tag \u0027clk-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:\n clk: sunxi-ng: sun4i: Set VCO and PLL bias current to lowest setting\n" }, { "commit": "2224d616528194b02424c91c2ee254b3d29942c3", "tree": "6598026698d14cee35e22bbc3c9ff0f902269d6a", "parents": [ "6aa676761d4c1acfa31320e55fa1f83f3fcbbc7a" ], "author": { "name": "Sebastian Andrzej Siewior", "email": "bigeasy@linutronix.de", "time": "Tue Oct 16 22:25:25 2018 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Wed Oct 17 12:30:38 2018 +0200" }, "message": "x86/fpu: Fix i486 + no387 boot crash by only saving FPU registers on context switch if there is an FPU\n\nBooting an i486 with \"no387 nofxsr\" ends with with the following crash:\n\n math_emulate: 0060:c101987d\n Kernel panic - not syncing: Math emulation needed in kernel\n\non the first context switch in user land.\n\nThe reason is that copy_fpregs_to_fpstate() tries FNSAVE which does not work\nas the FPU is turned off.\n\nThis bug was introduced in:\n\n f1c8cd0176078 (\"x86/fpu: Change fpu-\u003efpregs_active users to fpu-\u003efpstate_active\")\n\nAdd a check for X86_FEATURE_FPU before trying to save FPU registers (we\nhave such a check in switch_fpu_finish() already).\n\nSigned-off-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nReviewed-by: Andy Lutomirski \u003cluto@kernel.org\u003e\nCc: Borislav Petkov \u003cbp@alien8.de\u003e\nCc: Dave Hansen \u003cdave.hansen@linux.intel.com\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: stable@vger.kernel.org\nFixes: f1c8cd0176078 (\"x86/fpu: Change fpu-\u003efpregs_active users to fpu-\u003efpstate_active\")\nLink: http://lkml.kernel.org/r/20181016202525.29437-4-bigeasy@linutronix.de\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "6aa676761d4c1acfa31320e55fa1f83f3fcbbc7a", "tree": "1f0d6ad72f974da261b0fb212a9be944725cf447", "parents": [ "ae852495be365f6be433dde6629d3f0316f8efde" ], "author": { "name": "Sebastian Andrzej Siewior", "email": "bigeasy@linutronix.de", "time": "Tue Oct 16 22:25:24 2018 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Wed Oct 17 12:30:31 2018 +0200" }, "message": "x86/fpu: Remove second definition of fpu in __fpu__restore_sig()\n\nCommit:\n\n c5bedc6847c3b (\"x86/fpu: Get rid of PF_USED_MATH usage, convert it to fpu-\u003efpstate_active\")\n\nintroduced the \u0027fpu\u0027 variable at top of __restore_xstate_sig(),\nwhich now shadows the other definition:\n\n arch/x86/kernel/fpu/signal.c:318:28: warning: symbol \u0027fpu\u0027 shadows an earlier one\n arch/x86/kernel/fpu/signal.c:271:20: originally declared here\n\nRemove the shadowed definition of \u0027fpu\u0027, as the two definitions are the same.\n\nSigned-off-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nReviewed-by: Andy Lutomirski \u003cluto@kernel.org\u003e\nCc: Borislav Petkov \u003cbp@alien8.de\u003e\nCc: Dave Hansen \u003cdave.hansen@linux.intel.com\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nFixes: c5bedc6847c3b (\"x86/fpu: Get rid of PF_USED_MATH usage, convert it to fpu-\u003efpstate_active\")\nLink: http://lkml.kernel.org/r/20181016202525.29437-3-bigeasy@linutronix.de\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "ae852495be365f6be433dde6629d3f0316f8efde", "tree": "0b7b8e8b15d0948ccf59f24d000831b7354fea28", "parents": [ "04f4f954b69526d7af8ffb8e5780f08b8a6cda2d" ], "author": { "name": "Andy Lutomirski", "email": "luto@kernel.org", "time": "Sun Oct 14 11:38:18 2018 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Wed Oct 17 12:30:27 2018 +0200" }, "message": "x86/entry/64: Further improve paranoid_entry comments\n\nCommit:\n\n 16561f27f94e (\"x86/entry: Add some paranoid entry/exit CR3 handling comments\")\n\n... added some comments. This improves them a bit:\n\n - When I first read the new comments, it was unclear to me whether\n they were referring to the case where paranoid_entry interrupted\n other entry code or where paranoid_entry was itself interrupted.\n Clarify it.\n\n - Remove the EBX comment. We no longer use EBX as a SWAPGS\n indicator.\n\nSigned-off-by: Andy Lutomirski \u003cluto@kernel.org\u003e\nAcked-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Borislav Petkov \u003cbp@alien8.de\u003e\nCc: Dave Hansen \u003cdave.hansen@linux.intel.com\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/c47daa1888dc2298e7e1d3f82bd76b776ea33393.1539542111.git.luto@kernel.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "04f4f954b69526d7af8ffb8e5780f08b8a6cda2d", "tree": "2a3f3fc150400381d8e65bc958d42066cf155706", "parents": [ "dca5203e3fe2f5d8bc8157b205d766142d3a6b77" ], "author": { "name": "Jan Kiszka", "email": "jan.kiszka@siemens.com", "time": "Mon Oct 15 16:09:29 2018 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Wed Oct 17 12:30:20 2018 +0200" }, "message": "x86/entry/32: Clear the CS high bits\n\nEven if not on an entry stack, the CS\u0027s high bits must be\ninitialized because they are unconditionally evaluated in\nPARANOID_EXIT_TO_KERNEL_MODE.\n\nFailing to do so broke the boot on Galileo Gen2 and IOT2000 boards.\n\n [ bp: Make the commit message tone passive and impartial. ]\n\nFixes: b92a165df17e (\"x86/entry/32: Handle Entry from Kernel-Mode on Entry-Stack\")\nSigned-off-by: Jan Kiszka \u003cjan.kiszka@siemens.com\u003e\nSigned-off-by: Borislav Petkov \u003cbp@suse.de\u003e\nReviewed-by: Joerg Roedel \u003cjroedel@suse.de\u003e\nAcked-by: Joerg Roedel \u003cjroedel@suse.de\u003e\nCC: \"H. Peter Anvin\" \u003chpa@zytor.com\u003e\nCC: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCC: Andy Lutomirski \u003cluto@kernel.org\u003e\nCC: Boris Ostrovsky \u003cboris.ostrovsky@oracle.com\u003e\nCC: Brian Gerst \u003cbrgerst@gmail.com\u003e\nCC: Dave Hansen \u003cdave.hansen@intel.com\u003e\nCC: David Laight \u003cDavid.Laight@aculab.com\u003e\nCC: Denys Vlasenko \u003cdvlasenk@redhat.com\u003e\nCC: Eduardo Valentin \u003ceduval@amazon.com\u003e\nCC: Greg KH \u003cgregkh@linuxfoundation.org\u003e\nCC: Ingo Molnar \u003cmingo@kernel.org\u003e\nCC: Jiri Kosina \u003cjkosina@suse.cz\u003e\nCC: Josh Poimboeuf \u003cjpoimboe@redhat.com\u003e\nCC: Juergen Gross \u003cjgross@suse.com\u003e\nCC: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCC: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCC: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCC: Will Deacon \u003cwill.deacon@arm.com\u003e\nCC: aliguori@amazon.com\nCC: daniel.gruss@iaik.tugraz.at\nCC: hughd@google.com\nCC: keescook@google.com\nCC: linux-mm \u003clinux-mm@kvack.org\u003e\nCC: x86-ml \u003cx86@kernel.org\u003e\nLink: http://lkml.kernel.org/r/f271c747-1714-5a5b-a71f-ae189a093b8d@siemens.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "298faf53200fc02af38d32715697df6e661c1257", "tree": "8446ec5345277ab2f736af60453041c60c094d96", "parents": [ "d4046e8e17b9f378cb861982ef71c63911b5dff3" ], "author": { "name": "Jiri Olsa", "email": "jolsa@kernel.org", "time": "Tue Oct 16 17:06:07 2018 +0200" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Tue Oct 16 14:57:59 2018 -0300" }, "message": "perf tools: Pass build flags to traceevent build\n\nSo the extra user build flags are propagated to libtraceevent.\n\nSigned-off-by: Jiri Olsa \u003cjolsa@kernel.org\u003e\nCc: \"Herton R. Krzesinski\" \u003cherton@redhat.com\u003e\nCc: Steven Rostedt (VMware) \u003crostedt@goodmis.org\u003e\nCc: Tzvetomir Stoyanov (VMware) \u003ctz.stoyanov@gmail.com\u003e\nCc: Yordan Karadzhov (VMware) \u003cy.karadz@gmail.com\u003e\nLink: http://lkml.kernel.org/r/20181016150614.21260-3-jolsa@kernel.org\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "d4046e8e17b9f378cb861982ef71c63911b5dff3", "tree": "01e6b6cad56665d32cab28ebd2883122a043b9ad", "parents": [ "0ed149cf5239cc6e7e65bf00f769e8f1e91076c0" ], "author": { "name": "Milian Wolff", "email": "milian.wolff@kdab.com", "time": "Wed Sep 26 15:52:07 2018 +0200" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Tue Oct 16 14:52:21 2018 -0300" }, "message": "perf report: Don\u0027t crash on invalid inline debug information\n\nWhen the function name for an inline frame is invalid, we must not try\nto demangle this symbol, otherwise we crash with:\n\n #0 0x0000555555895c01 in bfd_demangle ()\n #1 0x0000555555823262 in demangle_sym (dso\u003d0x555555d92b90, elf_name\u003d0x0, kmodule\u003d0) at util/symbol-elf.c:215\n #2 dso__demangle_sym (dso\u003ddso@entry\u003d0x555555d92b90, kmodule\u003d\u003coptimized out\u003e, kmodule@entry\u003d0, elf_name\u003delf_name@entry\u003d0x0) at util/symbol-elf.c:400\n #3 0x00005555557fef4b in new_inline_sym (funcname\u003d0x0, base_sym\u003d0x555555d92b90, dso\u003d0x555555d92b90) at util/srcline.c:89\n #4 inline_list__append_dso_a2l (dso\u003ddso@entry\u003d0x555555c7bb00, node\u003dnode@entry\u003d0x555555e31810, sym\u003dsym@entry\u003d0x555555d92b90) at util/srcline.c:264\n #5 0x00005555557ff27f in addr2line (dso_name\u003ddso_name@entry\u003d0x555555d92430 \"/home/milian/.debug/.build-id/f7/186d14bb94f3c6161c010926da66033d24fce5/elf\", addr\u003daddr@entry\u003d2888, file\u003dfile@entry\u003d0x0,\n line\u003dline@entry\u003d0x0, dso\u003ddso@entry\u003d0x555555c7bb00, unwind_inlines\u003dunwind_inlines@entry\u003dtrue, node\u003d0x555555e31810, sym\u003d0x555555d92b90) at util/srcline.c:313\n #6 0x00005555557ffe7c in addr2inlines (sym\u003d0x555555d92b90, dso\u003d0x555555c7bb00, addr\u003d2888, dso_name\u003d0x555555d92430 \"/home/milian/.debug/.build-id/f7/186d14bb94f3c6161c010926da66033d24fce5/elf\")\n at util/srcline.c:358\n\nSo instead handle the case where we get invalid function names for\ninlined frames and use a fallback \u0027??\u0027 function name instead.\n\nWhile this crash was originally reported by Hadrien for rust code, I can\nnow also reproduce it with trivial C++ code. Indeed, it seems like\nlibbfd fails to interpret the debug information for the inline frame\nsymbol name:\n\n $ addr2line -e /home/milian/.debug/.build-id/f7/186d14bb94f3c6161c010926da66033d24fce5/elf -if b48\n main\n /usr/include/c++/8.2.1/complex:610\n ??\n /usr/include/c++/8.2.1/complex:618\n ??\n /usr/include/c++/8.2.1/complex:675\n ??\n /usr/include/c++/8.2.1/complex:685\n main\n /home/milian/projects/kdab/rnd/hotspot/tests/test-clients/cpp-inlining/main.cpp:39\n\nI\u0027ve reported this bug upstream and also attached a patch there which\nshould fix this issue:\n\nhttps://sourceware.org/bugzilla/show_bug.cgi?id\u003d23715\n\nReported-by: Hadrien Grasland \u003cgrasland@lal.in2p3.fr\u003e\nSigned-off-by: Milian Wolff \u003cmilian.wolff@kdab.com\u003e\nCc: Jin Yao \u003cyao.jin@linux.intel.com\u003e\nCc: Jiri Olsa \u003cjolsa@kernel.org\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nFixes: a64489c56c30 (\"perf report: Find the inline stack for a given address\")\n[ The above \u0027Fixes:\u0027 cset is where originally the problem was\n introduced, i.e. using a2l-\u003efuncname without checking if it is NULL,\n but this current patch fixes the current codebase, i.e. multiple csets\n were applied after a64489c56c30 before the problem was reported by Hadrien ]\nLink: http://lkml.kernel.org/r/20180926135207.30263-3-milian.wolff@kdab.com\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "0ac1077e3a549bf8d35971613e2be05bdbb41a00", "tree": "7fafd2ee6ab581c498d0c6b660417102939c2115", "parents": [ "bd8be2cf8b69573707f837786474c00ff7423a0f" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Tue Oct 16 15:52:02 2018 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Oct 16 09:58:49 2018 -0700" }, "message": "sctp: get pr_assoc and pr_stream all status with SCTP_PR_SCTP_ALL instead\n\nAccording to rfc7496 section 4.3 or 4.4:\n\n sprstat_policy: This parameter indicates for which PR-SCTP policy\n the user wants the information. It is an error to use\n SCTP_PR_SCTP_NONE in sprstat_policy. If SCTP_PR_SCTP_ALL is used,\n the counters provided are aggregated over all supported policies.\n\nWe change to dump pr_assoc and pr_stream all status by SCTP_PR_SCTP_ALL\ninstead, and return error for SCTP_PR_SCTP_NONE, as it also said \"It is\nan error to use SCTP_PR_SCTP_NONE in sprstat_policy. \"\n\nFixes: 826d253d57b1 (\"sctp: add SCTP_PR_ASSOC_STATUS on sctp sockopt\")\nFixes: d229d48d183f (\"sctp: add SCTP_PR_STREAM_STATUS sockopt for prsctp\")\nReported-by: Ying Xu \u003cyinxu@redhat.com\u003e\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nAcked-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b955a910d7fde877e068f68fada5aac02e3a073d", "tree": "277d2a7265fde3a96c0c743476efb25fe7563d80", "parents": [ "a886199872db1d65e88e2a5b015016ab75b5b168", "a06ecbfe784ceb22e56ae3cd75fe77138e7cfa0b" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 16 18:53:31 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 16 18:53:31 2018 +0200" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc\n\nDavid writes:\n \"Sparc fixes\n\n 1) Revert the %pOF change, it causes regressions.\n\n 2) Wire up io_pgetevents().\n\n 3) Fix perf events on single-PCR sparc64 cpus.\n\n 4) Do proper perf event throttling like arm and x86.\"\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:\n Revert \"sparc: Convert to using %pOFn instead of device_node.name\"\n sparc64: Set %l4 properly on trap return after handling signals.\n sparc64: Make proc_id signed.\n sparc: Throttle perf events properly.\n sparc: Fix single-pcr perf event counter management.\n sparc: Wire up io_pgetevents system call.\n sunvdc: Remove VLA usage\n" }, { "commit": "a886199872db1d65e88e2a5b015016ab75b5b168", "tree": "be10437317e83ba6f2ebaa5c24f1c0f3b7ab4a03", "parents": [ "f0a7d1883d9f78ae7bf15fc258bf9a2b20f35b76", "073c1a781e4a1217d572506621434cd6d750969b" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 16 18:52:00 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 16 18:52:00 2018 +0200" }, "message": "Merge tag \u0027selinux-pr-20181015\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux\n\nPaul writes:\n \"SELinux fixes for v4.19\n\n We\u0027ve got one SELinux \"fix\" that I\u0027d like to get into v4.19 if\n possible. I\u0027m using double quotes on \"fix\" as this is just an update\n to the MAINTAINERS file and not a code change. From my perspective,\n MAINTAINERS updates generally don\u0027t warrant inclusion during the -rcX\n phase, but this is a change to the mailing list location so it seemed\n prudent to get this in before v4.19 is released\"\n\n* tag \u0027selinux-pr-20181015\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:\n MAINTAINERS: update the SELinux mailing list location\n" }, { "commit": "a3671a4f973ee9d9621d60166cc3b037c397d604", "tree": "ef3c0975d7284a25fd265d63793c5edcee2d322f", "parents": [ "0295e39595e1146522f2722715dba7f7fba42217" ], "author": { "name": "Gustavo A. R. Silva", "email": "gustavo@embeddedor.com", "time": "Tue Oct 16 16:59:01 2018 +0200" }, "committer": { "name": "Doug Ledford", "email": "dledford@redhat.com", "time": "Tue Oct 16 12:47:40 2018 -0400" }, "message": "RDMA/ucma: Fix Spectre v1 vulnerability\n\nhdr.cmd can be indirectly controlled by user-space, hence leading to\na potential exploitation of the Spectre variant 1 vulnerability.\n\nThis issue was detected with the help of Smatch:\n\ndrivers/infiniband/core/ucma.c:1686 ucma_write() warn: potential\nspectre issue \u0027ucma_cmd_table\u0027 [r] (local cap)\n\nFix this by sanitizing hdr.cmd before using it to index\nucm_cmd_table.\n\nNotice that given that speculation windows are large, the policy is\nto kill the speculation on the first load and not worry if it can be\ncompleted with a dependent load/store [1].\n\n[1] https://marc.info/?l\u003dlinux-kernel\u0026m\u003d152449131114778\u0026w\u003d2\n\nCc: stable@vger.kernel.org\nSigned-off-by: Gustavo A. R. Silva \u003cgustavo@embeddedor.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\n" }, { "commit": "0295e39595e1146522f2722715dba7f7fba42217", "tree": "705287d26046659b333c3d1fb06612f94d319584", "parents": [ "dd9a403495704fc80fb9f399003013ef2be2ee23" ], "author": { "name": "Gustavo A. R. Silva", "email": "gustavo@embeddedor.com", "time": "Tue Oct 16 16:32:40 2018 +0200" }, "committer": { "name": "Doug Ledford", "email": "dledford@redhat.com", "time": "Tue Oct 16 11:32:40 2018 -0400" }, "message": "IB/ucm: Fix Spectre v1 vulnerability\n\nhdr.cmd can be indirectly controlled by user-space, hence leading to\na potential exploitation of the Spectre variant 1 vulnerability.\n\nThis issue was detected with the help of Smatch:\n\ndrivers/infiniband/core/ucm.c:1127 ib_ucm_write() warn: potential\nspectre issue \u0027ucm_cmd_table\u0027 [r] (local cap)\n\nFix this by sanitizing hdr.cmd before using it to index\nucm_cmd_table.\n\nNotice that given that speculation windows are large, the policy is\nto kill the speculation on the first load and not worry if it can be\ncompleted with a dependent load/store [1].\n\n[1] https://marc.info/?l\u003dlinux-kernel\u0026m\u003d152449131114778\u0026w\u003d2\n\nCc: stable@vger.kernel.org\nSigned-off-by: Gustavo A. R. Silva \u003cgustavo@embeddedor.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\n" }, { "commit": "0ed149cf5239cc6e7e65bf00f769e8f1e91076c0", "tree": "f8537e09d76a587f32f4585e573cd8bc5d5de308", "parents": [ "c458a6206d2a8600934617ccf88ba7d3a030faba" ], "author": { "name": "David Miller", "email": "davem@davemloft.net", "time": "Thu Oct 11 22:46:55 2018 -0700" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Tue Oct 16 12:30:03 2018 -0300" }, "message": "perf cpu_map: Align cpu map synthesized events properly.\n\nThe size of the resulting cpu map can be smaller than a multiple of\nsizeof(u64), resulting in SIGBUS on cpus like Sparc as the next event\nwill not be aligned properly.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Jiri Olsa \u003cjolsa@kernel.org\u003e\nCc: Kan Liang \u003ckan.liang@intel.com\u003e\nFixes: 6c872901af07 (\"perf cpu_map: Add cpu_map event synthesize function\")\nLink: http://lkml.kernel.org/r/20181011.224655.716771175766946817.davem@davemloft.net\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "c458a6206d2a8600934617ccf88ba7d3a030faba", "tree": "29da2b92a54539667495e707d1e305c7fc1f9af4", "parents": [ "36b8d4628d3cc8f5a748e508cce8673bc00fc63c" ], "author": { "name": "Jiri Olsa", "email": "jolsa@kernel.org", "time": "Tue Oct 16 13:48:18 2018 +0200" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Tue Oct 16 12:27:46 2018 -0300" }, "message": "perf tools: Fix tracing_path_mount proper path\n\nIf there\u0027s no tracefs (RHEL7) support the tracing_path_mount\nreturns debugfs path which results in following fail:\n\n # perf probe sys_write\n kprobe_events file does not exist - please rebuild kernel with CONFIG_KPROBE_EVENTS.\n Error: Failed to add events.\n\nIn tracing_path_debugfs_mount function we need to return the\n\u0027tracing\u0027 path instead of just the mount to make it work:\n\n # perf probe sys_write\n Added new event:\n probe:sys_write (on sys_write)\n\n You can now use it in all perf tools, such as:\n\n perf record -e probe:sys_write -aR sleep 1\n\nAdding the \u0027return tracing_path;\u0027 also to tracing_path_tracefs_mount\nfunction just for consistency with tracing_path_debugfs_mount.\n\nUpstream keeps working, because it has the tracefs support.\n\nLink: http://lkml.kernel.org/n/tip-yiwkzexq9fk1ey1xg3gnjlw4@git.kernel.org\nSigned-off-by: Jiri Olsa \u003cjolsa@kernel.org\u003e\nCc: Alexander Shishkin \u003calexander.shishkin@linux.intel.com\u003e\nCc: Michael Petlan \u003cmpetlan@redhat.com\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Steven Rostedt \u003crostedt@goodmis.org\u003e\nFixes: 23773ca18b39 (\"perf tools: Make perf aware of tracefs\")\nLink: http://lkml.kernel.org/r/20181016114818.3595-1-jolsa@kernel.org\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "36b8d4628d3cc8f5a748e508cce8673bc00fc63c", "tree": "fe8260d967ca4e6d33a80c6293feb3ed026d1d31", "parents": [ "4ab8455f8bd83298bf7f67ab9357e3b1cc765c7d" ], "author": { "name": "Jarod Wilson", "email": "jarod@redhat.com", "time": "Thu Sep 06 18:18:12 2018 -0400" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Tue Oct 16 12:06:47 2018 -0300" }, "message": "perf tools: Fix use of alternatives to find JDIR\n\nWhen a build is run from something like a cron job, the user\u0027s $PATH is\nrather minimal, of note, not including /usr/sbin in my own case. Because\nof that, an automated rpm package build ultimately fails to find\nlibperf-jvmti.so, because somewhere within the build, this happens...\n\n /bin/sh: alternatives: command not found\n /bin/sh: alternatives: command not found\n Makefile.config:849: No openjdk development package found, please install\n JDK package, e.g. openjdk-8-jdk, java-1.8.0-openjdk-devel\n\n...and while the build continues, libperf-jvmti.so isn\u0027t built, and\nthings fall down when rpm tries to find all the %files specified. Exact\nsame system builds everything just fine when the job is launched from a\nlogin shell instead of a cron job, since alternatives is in $PATH, so\nopenjdk is actually found.\n\nThe test required to get into this section of code actually specifies\nthe full path, as does a block just above it, so let\u0027s do that here too.\n\nSigned-off-by: Jarod Wilson \u003cjarod@redhat.com\u003e\nAcked-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Alexander Shishkin \u003calexander.shishkin@linux.intel.com\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Stephane Eranian \u003ceranian@google.com\u003e\nCc: William Cohen \u003cwcohen@redhat.com\u003e\nFixes: d4dfdf00d43e (\"perf jvmti: Plug compilation into perf build\")\nLink: http://lkml.kernel.org/r/20180906221812.11167-1-jarod@redhat.com\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "9068e02f58740778d8270840657f1e250a2cc60f", "tree": "b9c12dc545d07049335d35d3324bc3816bb7c2c3", "parents": [ "064253c1c0625efd0362a0b7ecdbe8bee2a2904d" ], "author": { "name": "Clint Taylor", "email": "clinton.a.taylor@intel.com", "time": "Fri Oct 05 14:52:15 2018 -0700" }, "committer": { "name": "Jani Nikula", "email": "jani.nikula@intel.com", "time": "Tue Oct 16 16:38:16 2018 +0300" }, "message": "drm/edid: VSDB yCBCr420 Deep Color mode bit definitions\n\nHDMI Forum VSDB YCBCR420 deep color capability bits are 2:0. Correct\ndefinitions in the header for the mask to work correctly.\n\nFixes: e6a9a2c3dc43 (\"drm/edid: parse ycbcr 420 deep color information\")\nBugzilla: https://bugs.freedesktop.org/show_bug.cgi?id\u003d107893\nCc: \u003cstable@vger.kernel.org\u003e # v4.14+\nSigned-off-by: Clint Taylor \u003cclinton.a.taylor@intel.com\u003e\nReviewed-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\nReviewed-by: Shashank Sharma \u003cshashank.sharma@intel.com\u003e\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/1538776335-12569-1-git-send-email-clinton.a.taylor@intel.com\n" }, { "commit": "4ab8455f8bd83298bf7f67ab9357e3b1cc765c7d", "tree": "d0fdcf3410fabf4cf5cc9e48399207a8427e64ee", "parents": [ "94aafb74cee0002e2f2eb6dc5376f54d5951ab4d" ], "author": { "name": "Jiri Olsa", "email": "jolsa@redhat.com", "time": "Wed Oct 03 23:20:52 2018 +0200" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Tue Oct 16 08:18:52 2018 -0300" }, "message": "perf evsel: Store ids for events with their own cpus perf_event__synthesize_event_update_cpus\n\nJohn reported crash when recording on an event under PMU with cpumask defined:\n\n root@localhost:~# ./perf_debug_ record -e armv8_pmuv3_0/br_mis_pred/ sleep 1\n perf: Segmentation fault\n Obtained 9 stack frames.\n ./perf_debug_() [0x4c5ef8]\n [0xffff82ba267c]\n ./perf_debug_() [0x4bc5a8]\n ./perf_debug_() [0x419550]\n ./perf_debug_() [0x41a928]\n ./perf_debug_() [0x472f58]\n ./perf_debug_() [0x473210]\n ./perf_debug_() [0x4070f4]\n /lib/aarch64-linux-gnu/libc.so.6(__libc_start_main+0xe0) [0xffff8294c8a0]\n Segmentation fault (core dumped)\n\nWe synthesize an update event that needs to touch the evsel id array, which is\nnot defined at that time. Fixing this by forcing the id allocation for events\nwith their own cpus.\n\nReported-by: John Garry \u003cjohn.garry@huawei.com\u003e\nSigned-off-by: Jiri Olsa \u003cjolsa@kernel.org\u003e\nTested-by: John Garry \u003cjohn.garry@huawei.com\u003e\nCc: Alexander Shishkin \u003calexander.shishkin@linux.intel.com\u003e\nCc: Andi Kleen \u003cak@linux.intel.com\u003e\nCc: Mark Rutland \u003cmark.rutland@arm.com\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Will Deacon \u003cwill.deacon@arm.com\u003e\nCc: linux-arm-kernel@lists.infradead.org\nCc: linuxarm@huawei.com\nFixes: bfd8f72c2778 (\"perf record: Synthesize unit/scale/... in event update\")\nLink: http://lkml.kernel.org/r/20181003212052.GA32371@krava\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "665c365a77fbfeabe52694aedf3446d5f2f1ce42", "tree": "ff6a03294a000077f970491d8e6db196b99b1ff2", "parents": [ "c02588a352defaf985fc1816eb6232663159e1b8" ], "author": { "name": "Alan Stern", "email": "stern@rowland.harvard.edu", "time": "Mon Oct 15 16:55:04 2018 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 16 13:09:36 2018 +0200" }, "message": "USB: fix the usbfs flag sanitization for control transfers\n\nCommit 7a68d9fb8510 (\"USB: usbdevfs: sanitize flags more\") checks the\ntransfer flags for URBs submitted from userspace via usbfs. However,\nthe check for whether the USBDEVFS_URB_SHORT_NOT_OK flag should be\nallowed for a control transfer was added in the wrong place, before\nthe code has properly determined the direction of the control\ntransfer. (Control transfers are special because for them, the\ndirection is set by the bRequestType byte of the Setup packet rather\nthan direction bit of the endpoint address.)\n\nThis patch moves code which sets up the allow_short flag for control\ntransfers down after is_in has been set to the correct value.\n\nSigned-off-by: Alan Stern \u003cstern@rowland.harvard.edu\u003e\nReported-and-tested-by: syzbot+24a30223a4b609bb802e@syzkaller.appspotmail.com\nFixes: 7a68d9fb8510 (\"USB: usbdevfs: sanitize flags more\")\nCC: Oliver Neukum \u003coneukum@suse.com\u003e\nCC: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "cf8afe5c53621eda385be961bc72329a2adcd767", "tree": "4c7025a57124babc92d9916ad9f19b5976a1496a", "parents": [ "57361846b52bc686112da6ca5368d11210796804" ], "author": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Tue Oct 16 08:21:48 2018 +0200" }, "committer": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Tue Oct 16 11:37:29 2018 +0200" }, "message": "parisc: Fix uninitialized variable usage in unwind.c\n\nAs noticed by Dave Anglin, the last commit introduced a small bug where\nthe potentially uninitialized r struct is used instead of the regs\npointer as input for unwind_frame_init(). Fix it.\n\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\nReported-by: John David Anglin \u003cdave.anglin@bell.net\u003e\n" }, { "commit": "9845c49cc9bbb317a0bc9e9cf78d8e09d54c9af0", "tree": "60ad2ff322aa6fef86deffc68288014f557524ad", "parents": [ "baa9be4ffb55876923dc9716abc0a448e510ba30" ], "author": { "name": "Song Muchun", "email": "smuchun@gmail.com", "time": "Sun Oct 14 19:26:12 2018 +0800" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Tue Oct 16 09:36:01 2018 +0200" }, "message": "sched/fair: Fix the min_vruntime update logic in dequeue_entity()\n\nThe comment and the code around the update_min_vruntime() call in\ndequeue_entity() are not in agreement.\n\nFrom commit:\n\n b60205c7c558 (\"sched/fair: Fix min_vruntime tracking\")\n\nI think that we want to update min_vruntime when a task is sleeping/migrating.\nSo, the check is inverted there - fix it.\n\nSigned-off-by: Song Muchun \u003csmuchun@gmail.com\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Mike Galbraith \u003cefault@gmx.de\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nFixes: b60205c7c558 (\"sched/fair: Fix min_vruntime tracking\")\nLink: http://lkml.kernel.org/r/20181014112612.2614-1-smuchun@gmail.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "bd8be2cf8b69573707f837786474c00ff7423a0f", "tree": "d9045222d4b3dda9bf3292f5f16fe305ccb1fa0f", "parents": [ "1890fea7936ad9be0b7caf6a94146b0d905c4b60", "140b6abac26d799f75d772ab5e969b34ad8d68f1" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 23:17:25 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 23:17:25 2018 -0700" }, "message": "Merge branch \u0027nfp-fix-pedit-set-action-offloads\u0027\n\nJakub Kicinski says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnfp: fix pedit set action offloads\n\nPieter says:\n\nThis set fixes set actions when using multiple pedit actions with\npartial masks and with multiple keys per pedit action. Additionally\nit fixes set ipv6 pedit action offloads when using it in combination\nwith other header keys.\n\nThe problem would only trigger if one combines multiple pedit actions\nof the same type with partial masks, e.g.:\n\n$ tc filter add dev netdev protocol ip parent ffff: \\\n flower indev netdev \\\n ip_proto tcp \\\n action pedit ex munge \\\n ip src set 11.11.11.11 retain 65535 munge \\\n ip src set 22.22.22.22 retain 4294901760 pipe \\\n csum ip and tcp pipe \\\n mirred egress redirect dev netdev\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "140b6abac26d799f75d772ab5e969b34ad8d68f1", "tree": "d9045222d4b3dda9bf3292f5f16fe305ccb1fa0f", "parents": [ "d08c9e589300b015e72e5b41ff4dfed6eb8e7421" ], "author": { "name": "Pieter Jansen van Vuuren", "email": "pieter.jansenvanvuuren@netronome.com", "time": "Mon Oct 15 16:52:25 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 23:17:25 2018 -0700" }, "message": "nfp: flower: use offsets provided by pedit instead of index for ipv6\n\nPreviously when populating the set ipv6 address action, we incorrectly\nmade use of pedit\u0027s key index to determine which 32bit word should be\nset. We now calculate which word has been selected based on the offset\nprovided by the pedit action.\n\nFixes: 354b82bb320e (\"nfp: add set ipv6 source and destination address\")\nSigned-off-by: Pieter Jansen van Vuuren \u003cpieter.jansenvanvuuren@netronome.com\u003e\nReviewed-by: Jakub Kicinski \u003cjakub.kicinski@netronome.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d08c9e589300b015e72e5b41ff4dfed6eb8e7421", "tree": "7876c2a2b19597ef241f08baad4fb1583c098b87", "parents": [ "8913806f166e47c6b3fe8253e9cfb9caabe64341" ], "author": { "name": "Pieter Jansen van Vuuren", "email": "pieter.jansenvanvuuren@netronome.com", "time": "Mon Oct 15 16:52:24 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 23:17:24 2018 -0700" }, "message": "nfp: flower: fix multiple keys per pedit action\n\nPreviously we only allowed a single header key per pedit action to\nchange the header. This used to result in the last header key in the\npedit action to overwrite previous headers. We now keep track of them\nand allow multiple header keys per pedit action.\n\nFixes: c0b1bd9a8b8a (\"nfp: add set ipv4 header action flower offload\")\nFixes: 354b82bb320e (\"nfp: add set ipv6 source and destination address\")\nFixes: f8b7b0a6b113 (\"nfp: add set tcp and udp header action flower offload\")\nSigned-off-by: Pieter Jansen van Vuuren \u003cpieter.jansenvanvuuren@netronome.com\u003e\nReviewed-by: Jakub Kicinski \u003cjakub.kicinski@netronome.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8913806f166e47c6b3fe8253e9cfb9caabe64341", "tree": "9411eae29df9abaaca8b07c76c14de4397455f90", "parents": [ "1890fea7936ad9be0b7caf6a94146b0d905c4b60" ], "author": { "name": "Pieter Jansen van Vuuren", "email": "pieter.jansenvanvuuren@netronome.com", "time": "Mon Oct 15 16:52:23 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 23:17:24 2018 -0700" }, "message": "nfp: flower: fix pedit set actions for multiple partial masks\n\nPreviously we did not correctly change headers when using multiple\npedit actions with partial masks. We now take this into account and\nno longer just commit the last pedit action.\n\nFixes: c0b1bd9a8b8a (\"nfp: add set ipv4 header action flower offload\")\nSigned-off-by: Pieter Jansen van Vuuren \u003cpieter.jansenvanvuuren@netronome.com\u003e\nReviewed-by: Jakub Kicinski \u003cjakub.kicinski@netronome.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "1890fea7936ad9be0b7caf6a94146b0d905c4b60", "tree": "f97ce997c4250d28edb65e9e77397ec00a161de1", "parents": [ "d805397c3822d57ca3884d4bea37b2291fc40992" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Mon Oct 15 22:37:21 2018 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 23:13:42 2018 -0700" }, "message": "rxrpc: Fix a missing rxrpc_put_peer() in the error_report handler\n\nFix a missing call to rxrpc_put_peer() on the main path through the\nrxrpc_error_report() function. This manifests itself as a ref leak\nwhenever an ICMP packet or other error comes in.\n\nIn commit f334430316e7, the hand-off of the ref to a work item was removed\nand was not replaced with a put.\n\nFixes: f334430316e7 (\"rxrpc: Fix error distribution\")\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d805397c3822d57ca3884d4bea37b2291fc40992", "tree": "26a590ccde4580779a2428d6071b87bdc967bfae", "parents": [ "ec20a63aa8b8ec3223fb25cdb2a49f9f9dfda88c" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Mon Oct 15 19:58:29 2018 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 22:54:20 2018 -0700" }, "message": "sctp: use the pmtu from the icmp packet to update transport pathmtu\n\nOther than asoc pmtu sync from all transports, sctp_assoc_sync_pmtu\nis also processing transport pmtu_pending by icmp packets. But it\u0027s\nmeaningless to use sctp_dst_mtu(t-\u003edst) as new pmtu for a transport.\n\nThe right pmtu value should come from the icmp packet, and it would\nbe saved into transport-\u003emtu_info in this patch and used later when\nthe pmtu sync happens in sctp_sendmsg_to_asoc or sctp_packet_config.\n\nBesides, without this patch, as pmtu can only be updated correctly\nwhen receiving a icmp packet and no place is holding sock lock, it\nwill take long time if the sock is busy with sending packets.\n\nNote that it doesn\u0027t process transport-\u003emtu_info in .release_cb(),\nas there is no enough information for pmtu update, like for which\nasoc or transport. It is not worth traversing all asocs to check\npmtu_pending. So unlike tcp, sctp does this in tx path, for which\nmtu_info needs to be atomic_t.\n\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nAcked-by: Marcelo Ricardo Leitner \u003cmarcelo.leitner@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ec20a63aa8b8ec3223fb25cdb2a49f9f9dfda88c", "tree": "6eef69aee045c42bdc7c42933dc4f18369d6a4e8", "parents": [ "fbe1222c63b805e946c3af29b0bfbfee4c2fbeff" ], "author": { "name": "Fugang Duan", "email": "fugang.duan@nxp.com", "time": "Mon Oct 15 05:19:00 2018 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 22:52:18 2018 -0700" }, "message": "net: fec: don\u0027t dump RX FIFO register when not available\n\nCommit db65f35f50e0 (\"net: fec: add support of ethtool get_regs\") introduce\nethool \"--register-dump\" interface to dump all FEC registers.\n\nBut not all silicon implementations of the Freescale FEC hardware module\nhave the FRBR (FIFO Receive Bound Register) and FRSR (FIFO Receive Start\nRegister) register, so we should not be trying to dump them on those that\ndon\u0027t.\n\nTo fix it we create a quirk flag, FEC_QUIRK_HAS_RFREG, and check it before\ndump those RX FIFO registers.\n\nSigned-off-by: Fugang Duan \u003cfugang.duan@nxp.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "fbe1222c63b805e946c3af29b0bfbfee4c2fbeff", "tree": "8d60efa78bdd9515817050ddbb7a6f2b12700dc2", "parents": [ "dc012f3628eaecfb5ba68404a5c30ef501daf63d" ], "author": { "name": "Colin Ian King", "email": "colin.king@canonical.com", "time": "Sat Oct 13 16:48:25 2018 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 22:40:27 2018 -0700" }, "message": "qed: fix spelling mistake \"Ireelevant\" -\u003e \"Irrelevant\"\n\nTrivial fix to spelling mistake in DP_INFO message\n\nSigned-off-by: Colin Ian King \u003ccolin.king@canonical.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "dc012f3628eaecfb5ba68404a5c30ef501daf63d", "tree": "81d25eb25bf7e6560aa24a78c66f5b2ad0de57a6", "parents": [ "d3092b2efca1cd1d492d0b08499a2066c5ca8cec" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Oct 12 18:58:53 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 22:38:55 2018 -0700" }, "message": "ipv6: mcast: fix a use-after-free in inet6_mc_check\n\nsyzbot found a use-after-free in inet6_mc_check [1]\n\nThe problem here is that inet6_mc_check() uses rcu\nand read_lock(\u0026iml-\u003esflock)\n\nSo the fact that ip6_mc_leave_src() is called under RTNL\nand the socket lock does not help us, we need to acquire\niml-\u003esflock in write mode.\n\nIn the future, we should convert all this stuff to RCU.\n\n[1]\nBUG: KASAN: use-after-free in ipv6_addr_equal include/net/ipv6.h:521 [inline]\nBUG: KASAN: use-after-free in inet6_mc_check+0xae7/0xb40 net/ipv6/mcast.c:649\nRead of size 8 at addr ffff8801ce7f2510 by task syz-executor0/22432\n\nCPU: 1 PID: 22432 Comm: syz-executor0 Not tainted 4.19.0-rc7+ #280\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113\n print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256\n kasan_report_error mm/kasan/report.c:354 [inline]\n kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412\n __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433\n ipv6_addr_equal include/net/ipv6.h:521 [inline]\n inet6_mc_check+0xae7/0xb40 net/ipv6/mcast.c:649\n __raw_v6_lookup+0x320/0x3f0 net/ipv6/raw.c:98\n ipv6_raw_deliver net/ipv6/raw.c:183 [inline]\n raw6_local_deliver+0x3d3/0xcb0 net/ipv6/raw.c:240\n ip6_input_finish+0x467/0x1aa0 net/ipv6/ip6_input.c:345\n NF_HOOK include/linux/netfilter.h:289 [inline]\n ip6_input+0xe9/0x600 net/ipv6/ip6_input.c:426\n ip6_mc_input+0x48a/0xd20 net/ipv6/ip6_input.c:503\n dst_input include/net/dst.h:450 [inline]\n ip6_rcv_finish+0x17a/0x330 net/ipv6/ip6_input.c:76\n NF_HOOK include/linux/netfilter.h:289 [inline]\n ipv6_rcv+0x120/0x640 net/ipv6/ip6_input.c:271\n __netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4913\n __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5023\n netif_receive_skb_internal+0x12c/0x620 net/core/dev.c:5126\n napi_frags_finish net/core/dev.c:5664 [inline]\n napi_gro_frags+0x75a/0xc90 net/core/dev.c:5737\n tun_get_user+0x3189/0x4250 drivers/net/tun.c:1923\n tun_chr_write_iter+0xb9/0x154 drivers/net/tun.c:1968\n call_write_iter include/linux/fs.h:1808 [inline]\n do_iter_readv_writev+0x8b0/0xa80 fs/read_write.c:680\n do_iter_write+0x185/0x5f0 fs/read_write.c:959\n vfs_writev+0x1f1/0x360 fs/read_write.c:1004\n do_writev+0x11a/0x310 fs/read_write.c:1039\n __do_sys_writev fs/read_write.c:1112 [inline]\n __se_sys_writev fs/read_write.c:1109 [inline]\n __x64_sys_writev+0x75/0xb0 fs/read_write.c:1109\n do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\nRIP: 0033:0x457421\nCode: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 b5 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 \u003c48\u003e 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01\nRSP: 002b:00007f2d30ecaba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014\nRAX: ffffffffffffffda RBX: 000000000000003e RCX: 0000000000457421\nRDX: 0000000000000001 RSI: 00007f2d30ecabf0 RDI: 00000000000000f0\nRBP: 0000000020000500 R08: 00000000000000f0 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000293 R12: 00007f2d30ecb6d4\nR13: 00000000004c4890 R14: 00000000004d7b90 R15: 00000000ffffffff\n\nAllocated by task 22437:\n save_stack+0x43/0xd0 mm/kasan/kasan.c:448\n set_track mm/kasan/kasan.c:460 [inline]\n kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553\n __do_kmalloc mm/slab.c:3718 [inline]\n __kmalloc+0x14e/0x760 mm/slab.c:3727\n kmalloc include/linux/slab.h:518 [inline]\n sock_kmalloc+0x15a/0x1f0 net/core/sock.c:1983\n ip6_mc_source+0x14dd/0x1960 net/ipv6/mcast.c:427\n do_ipv6_setsockopt.isra.9+0x3afb/0x45d0 net/ipv6/ipv6_sockglue.c:743\n ipv6_setsockopt+0xbd/0x170 net/ipv6/ipv6_sockglue.c:933\n rawv6_setsockopt+0x59/0x140 net/ipv6/raw.c:1069\n sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3038\n __sys_setsockopt+0x1ba/0x3c0 net/socket.c:1902\n __do_sys_setsockopt net/socket.c:1913 [inline]\n __se_sys_setsockopt net/socket.c:1910 [inline]\n __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1910\n do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\n\nFreed by task 22430:\n save_stack+0x43/0xd0 mm/kasan/kasan.c:448\n set_track mm/kasan/kasan.c:460 [inline]\n __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521\n kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528\n __cache_free mm/slab.c:3498 [inline]\n kfree+0xcf/0x230 mm/slab.c:3813\n __sock_kfree_s net/core/sock.c:2004 [inline]\n sock_kfree_s+0x29/0x60 net/core/sock.c:2010\n ip6_mc_leave_src+0x11a/0x1d0 net/ipv6/mcast.c:2448\n __ipv6_sock_mc_close+0x20b/0x4e0 net/ipv6/mcast.c:310\n ipv6_sock_mc_close+0x158/0x1d0 net/ipv6/mcast.c:328\n inet6_release+0x40/0x70 net/ipv6/af_inet6.c:452\n __sock_release+0xd7/0x250 net/socket.c:579\n sock_close+0x19/0x20 net/socket.c:1141\n __fput+0x385/0xa30 fs/file_table.c:278\n ____fput+0x15/0x20 fs/file_table.c:309\n task_work_run+0x1e8/0x2a0 kernel/task_work.c:113\n tracehook_notify_resume include/linux/tracehook.h:193 [inline]\n exit_to_usermode_loop+0x318/0x380 arch/x86/entry/common.c:166\n prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]\n syscall_return_slowpath arch/x86/entry/common.c:268 [inline]\n do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\n\nThe buggy address belongs to the object at ffff8801ce7f2500\n which belongs to the cache kmalloc-192 of size 192\nThe buggy address is located 16 bytes inside of\n 192-byte region [ffff8801ce7f2500, ffff8801ce7f25c0)\nThe buggy address belongs to the page:\npage:ffffea000739fc80 count:1 mapcount:0 mapping:ffff8801da800040 index:0x0\nflags: 0x2fffc0000000100(slab)\nraw: 02fffc0000000100 ffffea0006f6e548 ffffea000737b948 ffff8801da800040\nraw: 0000000000000000 ffff8801ce7f2000 0000000100000010 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff8801ce7f2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff8801ce7f2480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc\n\u003effff8801ce7f2500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ^\n ffff8801ce7f2580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc\n ffff8801ce7f2600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReported-by: syzbot \u003csyzkaller@googlegroups.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d3092b2efca1cd1d492d0b08499a2066c5ca8cec", "tree": "9840478f060772c97d0379312224889e5953e94e", "parents": [ "7ec8dc96e1cb45693f28f1287802ef6f2888dae0" ], "author": { "name": "Tung Nguyen", "email": "tung.q.nguyen@dektech.com.au", "time": "Fri Oct 12 22:46:55 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 22:33:27 2018 -0700" }, "message": "tipc: fix unsafe rcu locking when accessing publication list\n\nThe binding table\u0027s \u0027cluster_scope\u0027 list is rcu protected to handle\nraces between threads changing the list and those traversing the list at\nthe same moment. We have now found that the function named_distribute()\nuses the regular list_for_each() macro to traverse the said list.\nLikewise, the function tipc_named_withdraw() is removing items from the\nsame list using the regular list_del() call. When these two functions\nexecute in parallel we see occasional crashes.\n\nThis commit fixes this by adding the missing _rcu() suffixes.\n\nSigned-off-by: Tung Nguyen \u003ctung.q.nguyen@dektech.com.au\u003e\nSigned-off-by: Jon Maloy \u003cjon.maloy@ericsson.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7ec8dc96e1cb45693f28f1287802ef6f2888dae0", "tree": "c845678183b9ea210eebb7d73f40de813b4a39db", "parents": [ "f547fac624be53ad8b07e9ebca7654a7827ba61b" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Oct 12 16:38:36 2018 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 22:19:46 2018 -0700" }, "message": "rxrpc: Fix incorrect conditional on IPV6\n\nThe udpv6_encap_enable() function is part of the ipv6 code, and if that is\nconfigured as a loadable module and rxrpc is built in then a build failure\nwill occur because the conditional check is wrong:\n\n net/rxrpc/local_object.o: In function `rxrpc_lookup_local\u0027:\n local_object.c:(.text+0x2688): undefined reference to `udpv6_encap_enable\u0027\n\nUse the correct config symbol (CONFIG_AF_RXRPC_IPV6) in the conditional\ncheck rather than CONFIG_IPV6 as that will do the right thing.\n\nFixes: 5271953cad31 (\"rxrpc: Use the UDP encap_rcv hook\")\nReported-by: kbuild-all@01.org\nReported-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f547fac624be53ad8b07e9ebca7654a7827ba61b", "tree": "e8d39c6b9c62085154052363f89245575ded7282", "parents": [ "64bd9c8135751b561f27edaaffe93d07093f81af" ], "author": { "name": "Sabrina Dubroca", "email": "sd@queasysnail.net", "time": "Fri Oct 12 16:22:47 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 22:18:27 2018 -0700" }, "message": "ipv6: rate-limit probes for neighbourless routes\n\nWhen commit 270972554c91 (\"[IPV6]: ROUTE: Add Router Reachability\nProbing (RFC4191).\") introduced router probing, the rt6_probe() function\nrequired that a neighbour entry existed. This neighbour entry is used to\nrecord the timestamp of the last probe via the -\u003eupdated field.\n\nLater, commit 2152caea7196 (\"ipv6: Do not depend on rt-\u003en in rt6_probe().\")\nremoved the requirement for a neighbour entry. Neighbourless routes skip\nthe interval check and are not rate-limited.\n\nThis patch adds rate-limiting for neighbourless routes, by recording the\ntimestamp of the last probe in the fib6_info itself.\n\nFixes: 2152caea7196 (\"ipv6: Do not depend on rt-\u003en in rt6_probe().\")\nSigned-off-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nReviewed-by: Stefano Brivio \u003csbrivio@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "64bd9c8135751b561f27edaaffe93d07093f81af", "tree": "63c938edeb3043479e7ab3b3d0b416345534a45a", "parents": [ "d6672a5a97918f92bf2f3a2591f25d02bb0897a4" ], "author": { "name": "Florian Fainelli", "email": "f.fainelli@gmail.com", "time": "Thu Oct 11 15:06:33 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 22:10:21 2018 -0700" }, "message": "net: bcmgenet: Poll internal PHY for GENETv5\n\nOn GENETv5, there is a hardware issue which prevents the GENET hardware\nfrom generating a link UP interrupt when the link is operating at\n10Mbits/sec. Since we do not have any way to configure the link\ndetection logic, fallback to polling in that case.\n\nFixes: 421380856d9c (\"net: bcmgenet: add support for the GENETv5 hardware\")\nSigned-off-by: Florian Fainelli \u003cf.fainelli@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d6672a5a97918f92bf2f3a2591f25d02bb0897a4", "tree": "c43c74539fbe59ddbc5d3ef773ed1262680285ff", "parents": [ "d7b4c24f45d2efe51b8f213da4593fefd49240ba" ], "author": { "name": "YueHaibing", "email": "yuehaibing@huawei.com", "time": "Thu Oct 11 22:32:39 2018 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 22:08:17 2018 -0700" }, "message": "rxrpc: use correct kvec num when sending BUSY response packet\n\nFixes gcc \u0027-Wunused-but-set-variable\u0027 warning:\n\nnet/rxrpc/output.c: In function \u0027rxrpc_reject_packets\u0027:\nnet/rxrpc/output.c:527:11: warning:\n variable \u0027ioc\u0027 set but not used [-Wunused-but-set-variable]\n\n\u0027ioc\u0027 is the correct kvec num when sending a BUSY (or an ABORT) response\npacket.\n\nFixes: ece64fec164f (\"rxrpc: Emit BUSY packets when supposed to rather than ABORTs\")\nSigned-off-by: YueHaibing \u003cyuehaibing@huawei.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d7b4c24f45d2efe51b8f213da4593fefd49240ba", "tree": "91aabd787a14e2b08b7b64b55ac2f8bb19b37855", "parents": [ "4af00f4cc1ba34da4654ac31830843cae871642d" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Oct 11 22:32:31 2018 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 22:07:36 2018 -0700" }, "message": "rxrpc: Fix an uninitialised variable\n\nFix an uninitialised variable introduced by the last patch. This can cause\na crash when a new call comes in to a local service, such as when an AFS\nfileserver calls back to the local cache manager.\n\nFixes: c1e15b4944c9 (\"rxrpc: Fix the packet reception routine\")\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4af00f4cc1ba34da4654ac31830843cae871642d", "tree": "ba81a3cb69ca6ac7fe4af9eb537091862d8da4b6", "parents": [ "5a8e7aea953bdb6d4da13aff6f1e7f9c62023499" ], "author": { "name": "Jon Maloy", "email": "jon.maloy@ericsson.com", "time": "Thu Oct 11 22:02:29 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 22:03:34 2018 -0700" }, "message": "tipc: initialize broadcast link stale counter correctly\n\nIn the commit referred to below we added link tolerance as an additional\ncriteria for declaring broadcast transmission \"stale\" and resetting the\nunicast links to the affected node.\n\nUnfortunately, this \u0027improvement\u0027 introduced two bugs, which each and\none alone cause only limited problems, but combined lead to seemingly\nstochastic unicast link resets, depending on the amount of broadcast\ntraffic transmitted.\n\nThe first issue, a missing initialization of the \u0027tolerance\u0027 field of\nthe receiver broadcast link, was recently fixed by commit 047491ea334a\n(\"tipc: set link tolerance correctly in broadcast link\").\n\nThs second issue, where we omit to reset the \u0027stale_cnt\u0027 field of\nthe same link after a \u0027stale\u0027 period is over, leads to this counter\naccumulating over time, and in the absence of the \u0027tolerance\u0027 criteria\nleads to the above described symptoms. This commit adds the missing\ninitialization.\n\nFixes: a4dc70d46cf1 (\"tipc: extend link reset criteria for stale packet retransmission\")\nSigned-off-by: Jon Maloy \u003cjon.maloy@ericsson.com\u003e\nAcked-by: Ying Xue \u003cying.xue@windriver.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5a8e7aea953bdb6d4da13aff6f1e7f9c62023499", "tree": "eadd98d8a321daa8892ba298d62000ed3eb86fca", "parents": [ "d0f068e5720ac4eea13e184bb7526848f189f909" ], "author": { "name": "Cong Wang", "email": "xiyou.wangcong@gmail.com", "time": "Thu Oct 11 11:15:13 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 22:01:37 2018 -0700" }, "message": "llc: set SOCK_RCU_FREE in llc_sap_add_socket()\n\nWHen an llc sock is added into the sk_laddr_hash of an llc_sap,\nit is not marked with SOCK_RCU_FREE.\n\nThis causes that the sock could be freed while it is still being\nread by __llc_lookup_established() with RCU read lock. sock is\nrefcounted, but with RCU read lock, nothing prevents the readers\ngetting a zero refcnt.\n\nFix it by setting SOCK_RCU_FREE in llc_sap_add_socket().\n\nReported-by: syzbot+11e05f04c15e03be5254@syzkaller.appspotmail.com\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d0f068e5720ac4eea13e184bb7526848f189f909", "tree": "8f1199321444eedefa7b29561aed02664f418ae5", "parents": [ "e331473fee3d500bb0d2582a1fe598df3326d8cd", "37fdffb217a45609edccbb8b407d031143f551c0" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 21:51:28 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 21:51:28 2018 -0700" }, "message": "Merge tag \u0027mlx5-fixes-2018-10-10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux\n\nSaeed Mahameed says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nMellanox, mlx5 fixes 2018-10-10\n\nThis pull request includes some fixes to mlx5 driver,\nPlease pull and let me know if there\u0027s any problem.\n\nFor -stable v4.11:\n(\u0027net/mlx5: Take only bit 24-26 of wqe.pftype_wq for page fault type\u0027)\nFor -stable v4.17:\n(\u0027net/mlx5: Fix memory leak when setting fpga ipsec caps\u0027)\nFor -stable v4.18:\n(\u0027net/mlx5: WQ, fixes for fragmented WQ buffers API\u0027)\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e331473fee3d500bb0d2582a1fe598df3326d8cd", "tree": "5233db75fb1b9795b27e8cca5c5981a076f8427e", "parents": [ "58f5bbe331c566f49c9559568f982202a278aa78" ], "author": { "name": "Davide Caratti", "email": "dcaratti@redhat.com", "time": "Wed Oct 10 22:00:58 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 21:48:44 2018 -0700" }, "message": "net/sched: cls_api: add missing validation of netlink attributes\n\nSimilarly to what has been done in 8b4c3cdd9dd8 (\"net: sched: Add policy\nvalidation for tc attributes\"), fix classifier code to add validation of\nTCA_CHAIN and TCA_KIND netlink attributes.\n\ntested with:\n # ./tdc.py -c filter\n\nv2: Let sch_api and cls_api share nla_policy they have in common, thanks\n to David Ahern.\nv3: Avoid EXPORT_SYMBOL(), as validation of those attributes is not done\n by TC modules, thanks to Cong Wang.\n While at it, restore the \u0027Delete / get qdisc\u0027 comment to its orginal\n position, just above tc_get_qdisc() function prototype.\n\nFixes: 5bc1701881e39 (\"net: sched: introduce multichain support for filters\")\nSigned-off-by: Davide Caratti \u003cdcaratti@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "58f5bbe331c566f49c9559568f982202a278aa78", "tree": "013be2c5db2e21cdfafe6a249d6dac5790627c47", "parents": [ "2bb3207dbbd4d30e96dd0e1c8e013104193bd59c" ], "author": { "name": "Wenwen Wang", "email": "wang6495@umn.edu", "time": "Mon Oct 08 10:49:35 2018 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 21:37:58 2018 -0700" }, "message": "ethtool: fix a privilege escalation bug\n\nIn dev_ethtool(), the eth command \u0027ethcmd\u0027 is firstly copied from the\nuse-space buffer \u0027useraddr\u0027 and checked to see whether it is\nETHTOOL_PERQUEUE. If yes, the sub-command \u0027sub_cmd\u0027 is further copied from\nthe user space. Otherwise, \u0027sub_cmd\u0027 is the same as \u0027ethcmd\u0027. Next,\naccording to \u0027sub_cmd\u0027, a permission check is enforced through the function\nns_capable(). For example, the permission check is required if \u0027sub_cmd\u0027 is\nETHTOOL_SCOALESCE, but it is not necessary if \u0027sub_cmd\u0027 is\nETHTOOL_GCOALESCE, as suggested in the comment \"Allow some commands to be\ndone by anyone\". The following execution invokes different handlers\naccording to \u0027ethcmd\u0027. Specifically, if \u0027ethcmd\u0027 is ETHTOOL_PERQUEUE,\nethtool_set_per_queue() is called. In ethtool_set_per_queue(), the kernel\nobject \u0027per_queue_opt\u0027 is copied again from the user-space buffer\n\u0027useraddr\u0027 and \u0027per_queue_opt.sub_command\u0027 is used to determine which\noperation should be performed. Given that the buffer \u0027useraddr\u0027 is in the\nuser space, a malicious user can race to change the sub-command between the\ntwo copies. In particular, the attacker can supply ETHTOOL_PERQUEUE and\nETHTOOL_GCOALESCE to bypass the permission check in dev_ethtool(). Then\nbefore ethtool_set_per_queue() is called, the attacker changes\nETHTOOL_GCOALESCE to ETHTOOL_SCOALESCE. In this way, the attacker can\nbypass the permission check and execute ETHTOOL_SCOALESCE.\n\nThis patch enforces a check in ethtool_set_per_queue() after the second\ncopy from \u0027useraddr\u0027. If the sub-command is different from the one obtained\nin the first copy in dev_ethtool(), an error code EINVAL will be returned.\n\nFixes: f38d138a7da6 (\"net/ethtool: support set coalesce per queue\")\nSigned-off-by: Wenwen Wang \u003cwang6495@umn.edu\u003e\nReviewed-by: Michal Kubecek \u003cmkubecek@suse.cz\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "2bb3207dbbd4d30e96dd0e1c8e013104193bd59c", "tree": "78456187a2e91ef89a8ef0780dd793447e967ee7", "parents": [ "d49c88d7677ba737e9d2759a87db0402d5ab2607" ], "author": { "name": "Wenwen Wang", "email": "wang6495@umn.edu", "time": "Tue Oct 09 08:15:38 2018 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 15 21:37:01 2018 -0700" }, "message": "ethtool: fix a missing-check bug\n\nIn ethtool_get_rxnfc(), the eth command \u0027cmd\u0027 is compared against\n\u0027ETHTOOL_GRXFH\u0027 to see whether it is necessary to adjust the variable\n\u0027info_size\u0027. Then the whole structure of \u0027info\u0027 is copied from the\nuser-space buffer \u0027useraddr\u0027 with \u0027info_size\u0027 bytes. In the following\nexecution, \u0027info\u0027 may be copied again from the buffer \u0027useraddr\u0027 depending\non the \u0027cmd\u0027 and the \u0027info.flow_type\u0027. However, after these two copies,\nthere is no check between \u0027cmd\u0027 and \u0027info.cmd\u0027. In fact, \u0027cmd\u0027 is also\ncopied from the buffer \u0027useraddr\u0027 in dev_ethtool(), which is the caller\nfunction of ethtool_get_rxnfc(). Given that \u0027useraddr\u0027 is in the user\nspace, a malicious user can race to change the eth command in the buffer\nbetween these copies. By doing so, the attacker can supply inconsistent\ndata and cause undefined behavior because in the following execution \u0027info\u0027\nwill be passed to ops-\u003eget_rxnfc().\n\nThis patch adds a necessary check on \u0027info.cmd\u0027 and \u0027cmd\u0027 to confirm that\nthey are still same after the two copies in ethtool_get_rxnfc(). Otherwise,\nan error code EINVAL will be returned.\n\nSigned-off-by: Wenwen Wang \u003cwang6495@umn.edu\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" } ], "next": "d49c88d7677ba737e9d2759a87db0402d5ab2607" }