)]}' { "log": [ { "commit": "bee797529d7c1ea4e2803fda067d20edbc00bc3d", "tree": "9a19b34411360d1299e0f9a270b779e746a959bd", "parents": [ "9ce8654323d69273b4977f76f11c9e2d345ab130", "11799564fc7eedff50801950090773928f867996" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 23 08:20:49 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 23 08:20:49 2018 -0700" }, "message": "Merge tag \u0027mfd-fixes-4.17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd\n\nPull MFD fix from Lee Jones:\n \"A single cros_ec_spi fix correcting the handling for long-running\n commands\"\n\n* tag \u0027mfd-fixes-4.17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd:\n mfd: cros_ec: Retry commands when EC is known to be busy\n" }, { "commit": "9ce8654323d69273b4977f76f11c9e2d345ab130", "tree": "598a849fd4b1ccbf9809daba271a0255e33653b2", "parents": [ "a048a07d7f4535baa4cbad6bc024f175317ab938", "92d7223a74235054f2aa7227d207d9c57f84dca0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 23 08:18:33 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 23 08:18:33 2018 -0700" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha\n\nPull alpha fixes from Matt Turner:\n \"A few small changes for alpha\"\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha:\n alpha: io: reorder barriers to guarantee writeX() and iowriteX() ordering #2\n alpha: simplify get_arch_dma_ops\n alpha: use dma_direct_ops for jensen\n" }, { "commit": "11799564fc7eedff50801950090773928f867996", "tree": "900623616bd4d55b38798be4325376e916649b57", "parents": [ "771c577c23bac90597c685971d7297ea00f99d11" ], "author": { "name": "Brian Norris", "email": "briannorris@chromium.org", "time": "Tue May 22 17:23:10 2018 -0700" }, "committer": { "name": "Lee Jones", "email": "lee.jones@linaro.org", "time": "Wed May 23 06:59:00 2018 +0100" }, "message": "mfd: cros_ec: Retry commands when EC is known to be busy\n\nCommit 001dde9400d5 (\"mfd: cros ec: spi: Fix \"in progress\" error\nsignaling\") pointed out some bad code, but its analysis and conclusion\nwas not 100% correct.\n\nIt *is* correct that we should not propagate result\u003d\u003dEC_RES_IN_PROGRESS\nfor transport errors, because this has a special meaning -- that we\nshould follow up with EC_CMD_GET_COMMS_STATUS until the EC is no longer\nbusy. This is definitely the wrong thing for many commands, because\namong other problems, EC_CMD_GET_COMMS_STATUS doesn\u0027t actually retrieve\nany RX data from the EC, so commands that expected some data back will\ninstead start processing junk.\n\nFor such commands, the right answer is to either propagate the error\n(and return that error to the caller) or resend the original command\n(*not* EC_CMD_GET_COMMS_STATUS).\n\nUnfortunately, commit 001dde9400d5 forgets a crucial point: that for\nsome long-running operations, the EC physically cannot respond to\ncommands any more. For example, with EC_CMD_FLASH_ERASE, the EC may be\nre-flashing its own code regions, so it can\u0027t respond to SPI interrupts.\nInstead, the EC prepares us ahead of time for being busy for a \"long\"\ntime, and fills its hardware buffer with EC_SPI_PAST_END. Thus, we\nexpect to see several \"transport\" errors (or, messages filled with\nEC_SPI_PAST_END). So we should really translate that to a retryable\nerror (-EAGAIN) and continue sending EC_CMD_GET_COMMS_STATUS until we\nget a ready status.\n\nIOW, it is actually important to treat some of these \"junk\" values as\nretryable errors.\n\nTogether with commit 001dde9400d5, this resolves bugs like the\nfollowing:\n\n1. EC_CMD_FLASH_ERASE now works again (with commit 001dde9400d5, we\n would abort the first time we saw EC_SPI_PAST_END)\n2. Before commit 001dde9400d5, transport errors (e.g.,\n EC_SPI_RX_BAD_DATA) seen in other commands (e.g.,\n EC_CMD_RTC_GET_VALUE) used to yield junk data in the RX buffer; they\n will now yield -EAGAIN return values, and tools like \u0027hwclock\u0027 will\n simply fail instead of retrieving and re-programming undefined time\n values\n\nFixes: 001dde9400d5 (\"mfd: cros ec: spi: Fix \"in progress\" error signaling\")\nSigned-off-by: Brian Norris \u003cbriannorris@chromium.org\u003e\nSigned-off-by: Lee Jones \u003clee.jones@linaro.org\u003e\n" }, { "commit": "92d7223a74235054f2aa7227d207d9c57f84dca0", "tree": "5334ad1c8c2a41f1133ae7d3905a5163043184ee", "parents": [ "f5e82fa26063e6fad10624ff600457d878fa6e41" ], "author": { "name": "Sinan Kaya", "email": "okaya@codeaurora.org", "time": "Mon Apr 16 18:16:56 2018 -0400" }, "committer": { "name": "Matt Turner", "email": "mattst88@gmail.com", "time": "Tue May 22 18:10:36 2018 -0700" }, "message": "alpha: io: reorder barriers to guarantee writeX() and iowriteX() ordering #2\n\nmemory-barriers.txt has been updated with the following requirement.\n\n\"When using writel(), a prior wmb() is not needed to guarantee that the\ncache coherent memory writes have completed before writing to the MMIO\nregion.\"\n\nCurrent writeX() and iowriteX() implementations on alpha are not\nsatisfying this requirement as the barrier is after the register write.\n\nMove mb() in writeX() and iowriteX() functions to guarantee that HW\nobserves memory changes before performing register operations.\n\nSigned-off-by: Sinan Kaya \u003cokaya@codeaurora.org\u003e\nReported-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nSigned-off-by: Matt Turner \u003cmattst88@gmail.com\u003e\n" }, { "commit": "f5e82fa26063e6fad10624ff600457d878fa6e41", "tree": "e29365055b72187db0533578a80ca2dd3952569e", "parents": [ "6db615431a21b6057f68ed87583a663ee69f7601" ], "author": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Wed May 09 16:04:52 2018 +0200" }, "committer": { "name": "Matt Turner", "email": "mattst88@gmail.com", "time": "Tue May 22 18:10:36 2018 -0700" }, "message": "alpha: simplify get_arch_dma_ops\n\nRemove the dma_ops indirection.\n\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Matt Turner \u003cmattst88@gmail.com\u003e\n" }, { "commit": "6db615431a21b6057f68ed87583a663ee69f7601", "tree": "b785afbe9eb7ebfda71fc8ff452714a25e549119", "parents": [ "c61a56ababa404961fa769a2b24229f18e461961" ], "author": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Wed May 09 16:04:51 2018 +0200" }, "committer": { "name": "Matt Turner", "email": "mattst88@gmail.com", "time": "Tue May 22 18:10:36 2018 -0700" }, "message": "alpha: use dma_direct_ops for jensen\n\nThe generic dma_direct implementation does the same thing as the alpha\npci-noop implementation, just with more bells and whistles. And unlike\nthe current code it at least has a theoretical chance to actually compile.\n\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Matt Turner \u003cmattst88@gmail.com\u003e\n" }, { "commit": "a048a07d7f4535baa4cbad6bc024f175317ab938", "tree": "3ae572e2057a26a151957ccada417251121f41aa", "parents": [ "c85061e6e0ee07e131b929e6a17bb2e20d19b321" ], "author": { "name": "Nicholas Piggin", "email": "npiggin@gmail.com", "time": "Tue May 22 09:00:00 2018 +1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 21 20:45:31 2018 -0700" }, "message": "powerpc/64s: Add support for a store forwarding barrier at kernel entry/exit\n\nOn some CPUs we can prevent a vulnerability related to store-to-load\nforwarding by preventing store forwarding between privilege domains,\nby inserting a barrier in kernel entry and exit paths.\n\nThis is known to be the case on at least Power7, Power8 and Power9\npowerpc CPUs.\n\nBarriers must be inserted generally before the first load after moving\nto a higher privilege, and after the last store before moving to a\nlower privilege, HV and PR privilege transitions must be protected.\n\nBarriers are added as patch sections, with all kernel/hypervisor entry\npoints patched, and the exit points to lower privilge levels patched\nsimilarly to the RFI flush patching.\n\nFirmware advertisement is not implemented yet, so CPU flush types\nare hard coded.\n\nThanks to Michal Suchánek for bug fixes and review.\n\nSigned-off-by: Nicholas Piggin \u003cnpiggin@gmail.com\u003e\nSigned-off-by: Mauricio Faria de Oliveira \u003cmauricfo@linux.vnet.ibm.com\u003e\nSigned-off-by: Michael Neuling \u003cmikey@neuling.org\u003e\nSigned-off-by: Michal Suchánek \u003cmsuchanek@suse.de\u003e\nSigned-off-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c85061e6e0ee07e131b929e6a17bb2e20d19b321", "tree": "c0c59dfd8c2beaba79c293952a4ab96173bd11a0", "parents": [ "5997aab0a11ea27ee8e520ecc551ed18fd3e8296", "a45b599ad808c3c982fdcdc12b0b8611c2f92824" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 21 17:39:32 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 21 17:39:32 2018 -0700" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Two driver fixes (zfcp and target core), one information leak in sg\n and one build clean up\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()\n scsi: core: clean up generated file scsi_devinfo_tbl.c\n scsi: target: tcmu: fix error resetting qfull_time_out to default\n scsi: zfcp: fix infinite iteration on ERP ready list\n" }, { "commit": "5997aab0a11ea27ee8e520ecc551ed18fd3e8296", "tree": "671f8ec1616f646614f2994537fc32704251465d", "parents": [ "3b78ce4a34b761c7fe13520de822984019ff1a8f", "baf10564fbb66ea222cae66fbff11c444590ffd9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 21 11:54:57 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 21 11:54:57 2018 -0700" }, "message": "Merge branch \u0027fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs\n\nPull vfs fixes from Al Viro:\n \"Assorted fixes all over the place\"\n\n* \u0027fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:\n aio: fix io_destroy(2) vs. lookup_ioctx() race\n ext2: fix a block leak\n nfsd: vfs_mkdir() might succeed leaving dentry negative unhashed\n cachefiles: vfs_mkdir() might succeed leaving dentry negative unhashed\n unfuck sysfs_mount()\n kernfs: deal with kernfs_fill_super() failures\n cramfs: Fix IS_ENABLED typo\n befs_lookup(): use d_splice_alias()\n affs_lookup: switch to d_splice_alias()\n affs_lookup(): close a race with affs_remove_link()\n fix breakage caused by d_find_alias() semantics change\n fs: don\u0027t scan the inode cache before SB_BORN is set\n do d_instantiate/unlock_new_inode combinations safely\n iov_iter: fix memory leak in pipe_get_pages_alloc()\n iov_iter: fix return type of __pipe_get_pages()\n" }, { "commit": "baf10564fbb66ea222cae66fbff11c444590ffd9", "tree": "370e6152860a08700e15624074de22dcbf73e023", "parents": [ "5aa1437d2d9a068c0334bd7c9dafa8ec4f97f13b" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun May 20 16:46:23 2018 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 21 14:30:11 2018 -0400" }, "message": "aio: fix io_destroy(2) vs. lookup_ioctx() race\n\nkill_ioctx() used to have an explicit RCU delay between removing the\nreference from -\u003eioctx_table and percpu_ref_kill() dropping the refcount.\nAt some point that delay had been removed, on the theory that\npercpu_ref_kill() itself contained an RCU delay. Unfortunately, that was\nthe wrong kind of RCU delay and it didn\u0027t care about rcu_read_lock() used\nby lookup_ioctx(). As the result, we could get ctx freed right under\nlookup_ioctx(). Tejun has fixed that in a6d7cff472e (\"fs/aio: Add explicit\nRCU grace period when freeing kioctx\"); however, that fix is not enough.\n\nSuppose io_destroy() from one thread races with e.g. io_setup() from another;\nCPU1 removes the reference from current-\u003emm-\u003eioctx_table[...] just as CPU2\nhas picked it (under rcu_read_lock()). Then CPU1 proceeds to drop the\nrefcount, getting it to 0 and triggering a call of free_ioctx_users(),\nwhich proceeds to drop the secondary refcount and once that reaches zero\ncalls free_ioctx_reqs(). That does\n INIT_RCU_WORK(\u0026ctx-\u003efree_rwork, free_ioctx);\n queue_rcu_work(system_wq, \u0026ctx-\u003efree_rwork);\nand schedules freeing the whole thing after RCU delay.\n\nIn the meanwhile CPU2 has gotten around to percpu_ref_get(), bumping the\nrefcount from 0 to 1 and returned the reference to io_setup().\n\nTejun\u0027s fix (that queue_rcu_work() in there) guarantees that ctx won\u0027t get\nfreed until after percpu_ref_get(). Sure, we\u0027d increment the counter before\nctx can be freed. Now we are out of rcu_read_lock() and there\u0027s nothing to\nstop freeing of the whole thing. Unfortunately, CPU2 assumes that since it\nhas grabbed the reference, ctx is *NOT* going away until it gets around to\ndropping that reference.\n\nThe fix is obvious - use percpu_ref_tryget_live() and treat failure as miss.\nIt\u0027s not costlier than what we currently do in normal case, it\u0027s safe to\ncall since freeing *is* delayed and it closes the race window - either\nlookup_ioctx() comes before percpu_ref_kill() (in which case ctx-\u003eusers\nwon\u0027t reach 0 until the caller of lookup_ioctx() drops it) or lookup_ioctx()\nfails, ctx-\u003eusers is unaffected and caller of lookup_ioctx() doesn\u0027t see\nthe object in question at all.\n\nCc: stable@kernel.org\nFixes: a6d7cff472e \"fs/aio: Add explicit RCU grace period when freeing kioctx\"\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "5aa1437d2d9a068c0334bd7c9dafa8ec4f97f13b", "tree": "1f8e9a78b800f50fef4277a7971415c1412fb6c4", "parents": [ "3819bb0d79f50b05910db5bdc6d9ef512184e3b1" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu May 17 17:18:30 2018 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 21 14:30:11 2018 -0400" }, "message": "ext2: fix a block leak\n\nopen file, unlink it, then use ioctl(2) to make it immutable or\nappend only. Now close it and watch the blocks *not* freed...\n\nImmutable/append-only checks belong in -\u003esetattr().\nNote: the bug is old and backport to anything prior to 737f2e93b972\n(\"ext2: convert to use the new truncate convention\") will need\nthese checks lifted into ext2_setattr().\n\nCc: stable@kernel.org\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "3819bb0d79f50b05910db5bdc6d9ef512184e3b1", "tree": "471f4930a15a15c6e482fc0284fef824e02dcee4", "parents": [ "9c3e9025a3f7ed25c99a0add8af65431c8043800" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri May 11 17:03:19 2018 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 21 14:30:10 2018 -0400" }, "message": "nfsd: vfs_mkdir() might succeed leaving dentry negative unhashed\n\nThat can (and does, on some filesystems) happen - -\u003emkdir() (and thus\nvfs_mkdir()) can legitimately leave its argument negative and just\nunhash it, counting upon the lookup to pick the object we\u0027d created\nnext time we try to look at that name.\n\nSome vfs_mkdir() callers forget about that possibility...\n\nAcked-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "9c3e9025a3f7ed25c99a0add8af65431c8043800", "tree": "d8f892f5750d1aea00dcef9d9f7ea1719f11a6ce", "parents": [ "7b745a4e4051e1bbce40e0b1c2cf636c70583aa4" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu May 10 22:59:45 2018 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 21 14:30:10 2018 -0400" }, "message": "cachefiles: vfs_mkdir() might succeed leaving dentry negative unhashed\n\nThat can (and does, on some filesystems) happen - -\u003emkdir() (and thus\nvfs_mkdir()) can legitimately leave its argument negative and just\nunhash it, counting upon the lookup to pick the object we\u0027d created\nnext time we try to look at that name.\n\nSome vfs_mkdir() callers forget about that possibility...\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "7b745a4e4051e1bbce40e0b1c2cf636c70583aa4", "tree": "c5fd8a796d75053bccf60ee4376b4872d10e7918", "parents": [ "82382acec0c97b91830fff7130d0acce4ac4f3f3" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 14 00:03:34 2018 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 21 14:30:09 2018 -0400" }, "message": "unfuck sysfs_mount()\n\nnew_sb is left uninitialized in case of early failures in kernfs_mount_ns(),\nand while IS_ERR(root) is true in all such cases, using IS_ERR(root) || !new_sb\nis not a solution - IS_ERR(root) is true in some cases when new_sb is true.\n\nMake sure new_sb is initialized (and matches the reality) in all cases and\nfix the condition for dropping kobj reference - we want it done precisely\nin those situations where the reference has not been transferred into a new\nsuper_block instance.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "82382acec0c97b91830fff7130d0acce4ac4f3f3", "tree": "916207a3a6819177f57c5509e81d7446dd47aba2", "parents": [ "08a8f3086880325433d66b2dc9cdfb3f095adddf" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Apr 03 00:22:29 2018 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 21 14:30:08 2018 -0400" }, "message": "kernfs: deal with kernfs_fill_super() failures\n\nmake sure that info-\u003enode is initialized early, so that kernfs_kill_sb()\ncan list_del() it safely.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "08a8f3086880325433d66b2dc9cdfb3f095adddf", "tree": "2c1ae0f1105952715c146377103d7b22af7149dd", "parents": [ "f4e4d434fe3f5eceea470bf821683677dabe39c4" ], "author": { "name": "Joe Perches", "email": "joe@perches.com", "time": "Sun May 13 15:05:47 2018 -0700" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 21 14:30:08 2018 -0400" }, "message": "cramfs: Fix IS_ENABLED typo\n\nThere\u0027s an extra C here...\n\nFixes: 99c18ce580c6 (\"cramfs: direct memory access support\")\nAcked-by: Nicolas Pitre \u003cnico@linaro.org\u003e\nSigned-off-by: Joe Perches \u003cjoe@perches.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "f4e4d434fe3f5eceea470bf821683677dabe39c4", "tree": "20c52d934ddbb0dc24757197ab85b92e812a26b5", "parents": [ "87fbd639c02ec96d67738e40b6521fb070ed7168" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Apr 30 19:02:02 2018 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 21 14:30:07 2018 -0400" }, "message": "befs_lookup(): use d_splice_alias()\n\nRTFS(Documentation/filesystems/nfs/Exporting) if you try to make\nsomething exportable.\n\nFixes: ac632f5b6301 \"befs: add NFS export support\"\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "87fbd639c02ec96d67738e40b6521fb070ed7168", "tree": "a11ad3f7b598cddf1a18236ed13f4a86d16e288e", "parents": [ "30da870ce4a4e007c901858a96e9e394a1daa74a" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun May 06 12:20:40 2018 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 21 14:29:12 2018 -0400" }, "message": "affs_lookup: switch to d_splice_alias()\n\nMaking something exportable takes more than providing -\u003es_export_ops.\nIn particular, -\u003elookup() *MUST* use d_splice_alias() instead of\nd_add().\n\nReading Documentation/filesystems/nfs/Exporting would\u0027ve been a good idea;\nas it is, exporting AFFS is badly (and exploitably) broken.\n\nPartially-Fixes: ed4433d72394 \"fs/affs: make affs exportable\"\nAcked-by: David Sterba \u003cdsterba@suse.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "30da870ce4a4e007c901858a96e9e394a1daa74a", "tree": "d75869642ea5ce962ed9aa442db2784d3779ca2e", "parents": [ "b127125d9db23e4856156a7c909a3c8e18b69f99" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun May 06 12:15:20 2018 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 21 14:27:45 2018 -0400" }, "message": "affs_lookup(): close a race with affs_remove_link()\n\nwe unlock the directory hash too early - if we are looking at secondary\nlink and primary (in another directory) gets removed just as we unlock,\nwe could have the old primary moved in place of the secondary, leaving\nus to look into freed entry (and leaving our dentry with -\u003ed_fsdata\npointing to a freed entry).\n\nCc: stable@vger.kernel.org # 2.4.4+\nAcked-by: David Sterba \u003cdsterba@suse.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "3b78ce4a34b761c7fe13520de822984019ff1a8f", "tree": "63b93664a184c2d561a70c7f8d16a388750739f7", "parents": [ "6741c4bb389da103c0d79ad1961884628900bfe6", "af86ca4e3088fe5eacf2f7e58c01fa68ca067672" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 21 11:23:26 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 21 11:23:26 2018 -0700" }, "message": "Merge branch \u0027speck-v20\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nMerge speculative store buffer bypass fixes from Thomas Gleixner:\n\n - rework of the SPEC_CTRL MSR management to accomodate the new fancy\n SSBD (Speculative Store Bypass Disable) bit handling.\n\n - the CPU bug and sysfs infrastructure for the exciting new Speculative\n Store Bypass \u0027feature\u0027.\n\n - support for disabling SSB via LS_CFG MSR on AMD CPUs including\n Hyperthread synchronization on ZEN.\n\n - PRCTL support for dynamic runtime control of SSB\n\n - SECCOMP integration to automatically disable SSB for sandboxed\n processes with a filter flag for opt-out.\n\n - KVM integration to allow guests fiddling with SSBD including the new\n software MSR VIRT_SPEC_CTRL to handle the LS_CFG based oddities on\n AMD.\n\n - BPF protection against SSB\n\n.. this is just the core and x86 side, other architecture support will\ncome separately.\n\n* \u0027speck-v20\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (49 commits)\n bpf: Prevent memory disambiguation attack\n x86/bugs: Rename SSBD_NO to SSB_NO\n KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD\n x86/speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG\n x86/bugs: Rework spec_ctrl base and mask logic\n x86/bugs: Remove x86_spec_ctrl_set()\n x86/bugs: Expose x86_spec_ctrl_base directly\n x86/bugs: Unify x86_spec_ctrl_{set_guest,restore_host}\n x86/speculation: Rework speculative_store_bypass_update()\n x86/speculation: Add virtualized speculative store bypass disable support\n x86/bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL\n x86/speculation: Handle HT correctly on AMD\n x86/cpufeatures: Add FEATURE_ZEN\n x86/cpufeatures: Disentangle SSBD enumeration\n x86/cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS\n x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP\n KVM: SVM: Move spec control call after restore of GS\n x86/cpu: Make alternative_msr_write work for 32-bit code\n x86/bugs: Fix the parameters alignment and missing void\n x86/bugs: Make cpu_show_common() static\n ...\n" }, { "commit": "6741c4bb389da103c0d79ad1961884628900bfe6", "tree": "fd5142b15ad372c8fb67a40a10c33a01722142cf", "parents": [ "5aef268ace7436d8a25d41ee3837ecadb0115917", "9a3a92ccfe3620743d4ae57c987dc8e9c5f88996" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 21 08:58:00 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 21 08:58:00 2018 -0700" }, "message": "Merge tag \u0027mips_fixes_4.17_2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/mips\n\nPull MIPS fixes from James Hogan:\n\n - fix build with DEBUG_ZBOOT and MACH_JZ4770 (4.16)\n\n - include xilfpga FDT in fitImage and stop generating dtb.o (4.15)\n\n - fix software IO coherence on CM SMP systems (4.8)\n\n - ptrace: Fix PEEKUSR/POKEUSR to o32 FGRs (3.14)\n\n - ptrace: Expose FIR register through FP regset (3.13)\n\n - fix typo in KVM debugfs file name (3.10)\n\n* tag \u0027mips_fixes_4.17_2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/mips:\n MIPS: Fix ptrace(2) PTRACE_PEEKUSR and PTRACE_POKEUSR accesses to o32 FGRs\n MIPS: xilfpga: Actually include FDT in fitImage\n MIPS: xilfpga: Stop generating useless dtb.o\n KVM: Fix spelling mistake: \"cop_unsuable\" -\u003e \"cop_unusable\"\n MIPS: ptrace: Expose FIR register through FP regset\n MIPS: Fix build with DEBUG_ZBOOT and MACH_JZ4770\n MIPS: c-r4k: Fix data corruption related to cache coherence\n" }, { "commit": "5aef268ace7436d8a25d41ee3837ecadb0115917", "tree": "efa69470ccffa4f7655102b57118ab81de788be5", "parents": [ "771c577c23bac90597c685971d7297ea00f99d11", "b80d0b93b991e551a32157e0d9d38fc5bc9348a7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 21 08:37:48 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 21 08:37:48 2018 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nPull networking fixes from David Miller:\n\n 1) Fix refcounting bug for connections in on-packet scheduling mode of\n IPVS, from Julian Anastasov.\n\n 2) Set network header properly in AF_PACKET\u0027s packet_snd, from Willem\n de Bruijn.\n\n 3) Fix regressions in 3c59x by converting to generic DMA API. It was\n relying upon the hack that the PCI DMA interfaces would accept NULL\n for EISA devices. From Christoph Hellwig.\n\n 4) Remove RDMA devices before unregistering netdev in QEDE driver, from\n Michal Kalderon.\n\n 5) Use after free in TUN driver ptr_ring usage, from Jason Wang.\n\n 6) Properly check for missing netlink attributes in SMC_PNETID\n requests, from Eric Biggers.\n\n 7) Set DMA mask before performaing any DMA operations in vmxnet3\n driver, from Regis Duchesne.\n\n 8) Fix mlx5 build with SMP\u003dn, from Saeed Mahameed.\n\n 9) Classifier fixes in bcm_sf2 driver from Florian Fainelli.\n\n10) Tuntap use after free during release, from Jason Wang.\n\n11) Don\u0027t use stack memory in scatterlists in tls code, from Matt\n Mullins.\n\n12) Not fully initialized flow key object in ipv4 routing code, from\n David Ahern.\n\n13) Various packet headroom bug fixes in ip6_gre driver, from Petr\n Machata.\n\n14) Remove queues from XPS maps using correct index, from Amritha\n Nambiar.\n\n15) Fix use after free in sock_diag, from Eric Dumazet.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (64 commits)\n net: ip6_gre: fix tunnel metadata device sharing.\n cxgb4: fix offset in collecting TX rate limit info\n net: sched: red: avoid hashing NULL child\n sock_diag: fix use-after-free read in __sk_free\n sh_eth: Change platform check to CONFIG_ARCH_RENESAS\n net: dsa: Do not register devlink for unused ports\n net: Fix a bug in removing queues from XPS map\n bpf: fix truncated jump targets on heavy expansions\n bpf: parse and verdict prog attach may race with bpf map update\n bpf: sockmap update rollback on error can incorrectly dec prog refcnt\n net: test tailroom before appending to linear skb\n net: ip6_gre: Fix ip6erspan hlen calculation\n net: ip6_gre: Split up ip6gre_changelink()\n net: ip6_gre: Split up ip6gre_newlink()\n net: ip6_gre: Split up ip6gre_tnl_change()\n net: ip6_gre: Split up ip6gre_tnl_link_config()\n net: ip6_gre: Fix headroom request in ip6erspan_tunnel_xmit()\n net: ip6_gre: Request headroom in __gre6_xmit()\n selftests/bpf: check return value of fopen in test_verifier.c\n erspan: fix invalid erspan version.\n ...\n" }, { "commit": "771c577c23bac90597c685971d7297ea00f99d11", "tree": "b921010b4c5157c1e1a1cbc25c8a493e666cdaf5", "parents": [ "6fd5a36a46c0caf288f3acd90d608ffefa17f234" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 15:31:38 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 15:31:38 2018 -0700" }, "message": "Linux 4.17-rc6\n" }, { "commit": "6fd5a36a46c0caf288f3acd90d608ffefa17f234", "tree": "14b815741e2c944545a62f1aa7d0a2fd4f760c2c", "parents": [ "e5e03ad9e0f04cb3f478b914a3bf9c8f77ee9e94", "8a922814ccfed70d35a725f47c0bf12b50fd223c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 12:44:07 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 12:44:07 2018 -0700" }, "message": "Merge branch \u0027parisc-4.17-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux\n\nPull parisc fixlets from Helge Deller:\n \"Three small section mismatch fixes, one of them was found by 0-day\n test infrastructure\"\n\n* \u0027parisc-4.17-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:\n parisc: Move ccio_cujo20_fixup() into init section\n parisc: Move setup_profiling_timer() out of init section\n parisc: Move find_pa_parent_type() out of init section\n" }, { "commit": "e5e03ad9e0f04cb3f478b914a3bf9c8f77ee9e94", "tree": "92effb8535e6f0f977403b4e534efb68a8febdad", "parents": [ "132ce5d43adfd9b5da27ad17cc28a01cd2310f0a", "02ee654d3a04563c67bfe658a05384548b9bb105" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 12:04:27 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 12:04:27 2018 -0700" }, "message": "Merge tag \u0027for-4.17-rc5-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n \"We\u0027ve accumulated some fixes during the last week, some of them were\n in the works for a longer time but there are some newer ones too.\n\n Most of the fixes have a reproducer and fix user visible problems,\n also candidates for stable kernels. They IMHO qualify for a late rc,\n though I did not expect that many\"\n\n* tag \u0027for-4.17-rc5-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: fix crash when trying to resume balance without the resume flag\n btrfs: Fix delalloc inodes invalidation during transaction abort\n btrfs: Split btrfs_del_delalloc_inode into 2 functions\n btrfs: fix reading stale metadata blocks after degraded raid1 mounts\n btrfs: property: Set incompat flag if lzo/zstd compression is set\n Btrfs: fix duplicate extents after fsync of file with prealloc extents\n Btrfs: fix xattr loss after power failure\n Btrfs: send, fix invalid access to commit roots due to concurrent snapshotting\n" }, { "commit": "132ce5d43adfd9b5da27ad17cc28a01cd2310f0a", "tree": "20c16a85244277cb2d7c7e122d5cca4094c78379", "parents": [ "8a6bd2f40e96fb4d96749ab029c61f0df218b003", "92d44a42af81e850a038c38278ff4f434b2871df" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 11:50:27 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 11:50:27 2018 -0700" }, "message": "Merge branch \u0027fixes\u0027 of git://git.armlinux.org.uk/~rmk/linux-arm\n\nPull ARM fixes from Russell King:\n\n - Łukasz Stelmach spotted a couple of issues with the decompressor.\n\n - a couple of kdump fixes found while testing kdump\n\n - replace some perl with shell code\n\n - resolve SIGFPE breakage\n\n - kprobes fixes\n\n* \u0027fixes\u0027 of git://git.armlinux.org.uk/~rmk/linux-arm:\n ARM: fix kill( ,SIGFPE) breakage\n ARM: 8772/1: kprobes: Prohibit kprobes on get_user functions\n ARM: 8771/1: kprobes: Prohibit kprobes on do_undefinstr\n ARM: 8770/1: kprobes: Prohibit probing on optimized_callback\n ARM: 8769/1: kprobes: Fix to use get_kprobe_ctlblk after irq-disabed\n ARM: replace unnecessary perl with sed and the shell $(( )) operator\n ARM: kexec: record parent context registers for non-crash CPUs\n ARM: kexec: fix kdump register saving on panic()\n ARM: 8758/1: decompressor: restore r1 and r2 just before jumping to the kernel\n ARM: 8753/1: decompressor: add a missing parameter to the addruart macro\n" }, { "commit": "8a6bd2f40e96fb4d96749ab029c61f0df218b003", "tree": "33bbe31fad29d88c066f91fb577c92496f659122", "parents": [ "b9aad92236391f681083fa4045083d5b846b59e0", "acf46020012ccbca1172e9c7aeab399c950d9212" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 11:28:32 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 11:28:32 2018 -0700" }, "message": "Merge branch \u0027x86-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Thomas Gleixner:\n \"An unfortunately larger set of fixes, but a large portion is\n selftests:\n\n - Fix the missing clusterid initializaiton for x2apic cluster\n management which caused boot failures due to IPIs being sent to the\n wrong cluster\n\n - Drop TX_COMPAT when a 64bit executable is exec()\u0027ed from a compat\n task\n\n - Wrap access to __supported_pte_mask in __startup_64() where clang\n compile fails due to a non PC relative access being generated.\n\n - Two fixes for 5 level paging fallout in the decompressor:\n\n - Handle GOT correctly for paging_prepare() and\n cleanup_trampoline()\n\n - Fix the page table handling in cleanup_trampoline() to avoid\n page table corruption.\n\n - Stop special casing protection key 0 as this is inconsistent with\n the manpage and also inconsistent with the allocation map handling.\n\n - Override the protection key wen moving away from PROT_EXEC to\n prevent inaccessible memory.\n\n - Fix and update the protection key selftests to address breakage and\n to cover the above issue\n\n - Add a MOV SS self test\"\n\n[ Part of the x86 fixes were in the earlier core pull due to dependencies ]\n\n* \u0027x86-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (21 commits)\n x86/mm: Drop TS_COMPAT on 64-bit exec() syscall\n x86/apic/x2apic: Initialize cluster ID properly\n x86/boot/compressed/64: Fix moving page table out of trampoline memory\n x86/boot/compressed/64: Set up GOT for paging_prepare() and cleanup_trampoline()\n x86/pkeys: Do not special case protection key 0\n x86/pkeys/selftests: Add a test for pkey 0\n x86/pkeys/selftests: Save off \u0027prot\u0027 for allocations\n x86/pkeys/selftests: Fix pointer math\n x86/pkeys: Override pkey when moving away from PROT_EXEC\n x86/pkeys/selftests: Fix pkey exhaustion test off-by-one\n x86/pkeys/selftests: Add PROT_EXEC test\n x86/pkeys/selftests: Factor out \"instruction page\"\n x86/pkeys/selftests: Allow faults on unknown keys\n x86/pkeys/selftests: Avoid printf-in-signal deadlocks\n x86/pkeys/selftests: Remove dead debugging code, fix dprint_in_signal\n x86/pkeys/selftests: Stop using assert()\n x86/pkeys/selftests: Give better unexpected fault error messages\n x86/selftests: Add mov_to_ss test\n x86/mpx/selftests: Adjust the self-test to fresh distros that export the MPX ABI\n x86/pkeys/selftests: Adjust the self-test to fresh distros that export the pkeys ABI\n ...\n" }, { "commit": "b9aad92236391f681083fa4045083d5b846b59e0", "tree": "12c19ea09f2a2a4f592baf2892d88a077b681043", "parents": [ "441cab960d991897ec0e739dffee018bb2479c45", "5596fe34495cf0f645f417eb928ef224df3e3cb4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 11:25:54 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 11:25:54 2018 -0700" }, "message": "Merge branch \u0027timers-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull UP timer fix from Thomas Gleixner:\n \"Work around the for_each_cpu() oddity on UP kernels in the tick\n broadcast code which causes boot failures because the CPU0 bit is\n always reported as set independent of the cpumask content\"\n\n* \u0027timers-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n tick/broadcast: Use for_each_cpu() specially on UP kernels\n" }, { "commit": "441cab960d991897ec0e739dffee018bb2479c45", "tree": "f8ceb4e56cb0cb8d70aa705e05dbce7ed2e42e8c", "parents": [ "74cce52f9f92b64febd7c84ed68f5a5607c779b6", "cd33d8803bfa3f5e6e5d7a4bb03fc8cc32c40fb6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 11:23:34 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 11:23:34 2018 -0700" }, "message": "Merge branch \u0027sched-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fixlets from Thomas Gleixner:\n \"Three trivial fixlets for the scheduler:\n\n - move print_rt_rq() and print_dl_rq() declarations to the right\n place\n\n - make grub_reclaim() static\n\n - fix the bogus documentation reference in Kconfig\"\n\n* \u0027sched-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/fair: Fix documentation file path\n sched/deadline: Make the grub_reclaim() function static\n sched/debug: Move the print_rt_rq() and print_dl_rq() declarations to kernel/sched/sched.h\n" }, { "commit": "74cce52f9f92b64febd7c84ed68f5a5607c779b6", "tree": "e363cb137b0f8cf3f8fd271b56b7d0748a302d3a", "parents": [ "95bcce4d42400d136060daadc56e1564200c3713", "78ce241099bb363b19dbd0245442e66c8de8f567" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 11:20:40 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 11:20:40 2018 -0700" }, "message": "Merge branch \u0027ras-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull RAS fix from Thomas Gleixner:\n \"Fix a regression in the new AMD SMCA code which issues an SMP function\n call from the early interrupt disabled region of CPU hotplug. To avoid\n that, use cached block addresses which can be used directly\"\n\n* \u0027ras-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/MCE/AMD: Cache SMCA MISC block addresses\n" }, { "commit": "95bcce4d42400d136060daadc56e1564200c3713", "tree": "d6655ea1a9d8a7dda3948a2eef055b6188d00026", "parents": [ "4b65f455c787eeca1a6eb8cc8f590ade6cecb179", "f3903c9161f0d636a7b0ff03841628928457e64c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 11:18:42 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 11:18:42 2018 -0700" }, "message": "Merge branch \u0027perf-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf tooling fixes from Thomas Gleixner:\n\n - fix segfault when processing unknown threads in cs-etm\n\n - fix \"perf test inet_pton\" on s390 failing due to missing inline\n\n - display all available events on \u0027perf annotate --stdio\u0027\n\n - add missing newline when parsing an empty BPF program\n\n* \u0027perf-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf tools: Add missing newline when parsing empty BPF proggie\n perf cs-etm: Remove redundant space\n perf cs-etm: Support unknown_thread in cs_etm_auxtrace\n perf annotate: Display all available events on --stdio\n perf test: \"probe libc\u0027s inet_pton\" fails on s390 due to missing inline\n" }, { "commit": "4b65f455c787eeca1a6eb8cc8f590ade6cecb179", "tree": "0a190c14dd0ac463b97fdb41e37ff6920d1d74f5", "parents": [ "056ad121c26db1cfc8253222e2297fb7b7577fe8", "5a817641f68a6399a5fac8b7d2da67a73698ffed" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 10:43:27 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 10:43:27 2018 -0700" }, "message": "Merge branch \u0027locking-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull locking fixes from Thomas Gleixner:\n \"Two fixes to address shortcomings of the rwsem/percpu-rwsem lock\n debugging code which emits false positive warnings when the rwsem is\n anonymously locked and unlocked\"\n\n* \u0027locking-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n locking/percpu-rwsem: Annotate rwsem ownership transfer by setting RWSEM_OWNER_UNKNOWN\n locking/rwsem: Add a new RWSEM_ANONYMOUSLY_OWNED flag\n" }, { "commit": "056ad121c26db1cfc8253222e2297fb7b7577fe8", "tree": "803bb45495247af78dd8be3306cc51ed4974af3f", "parents": [ "583dbad34098fd2891dcc850744e7c80063dd8a4", "4f74d72aa7067e75af92fbab077e6d7d0210be66" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 10:36:52 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 10:36:52 2018 -0700" }, "message": "Merge branch \u0027efi-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull EFI fixes from Thomas Gleixner:\n\n - Use explicitely sized type for the romimage pointer in the 32bit EFI\n protocol struct so a 64bit kernel does not expand it to 64bit. Ditto\n for the 64bit struct to avoid the reverse issue on 32bit kernels.\n\n - Handle randomized tex offset correctly in the ARM64 EFI stub to avoid\n unaligned data resulting in stack corruption and other hard to\n diagnose wreckage.\n\n* \u0027efi-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n efi/libstub/arm64: Handle randomized TEXT_OFFSET\n efi: Avoid potential crashes, fix the \u0027struct efi_pci_io_protocol_32\u0027 definition for mixed mode\n" }, { "commit": "583dbad34098fd2891dcc850744e7c80063dd8a4", "tree": "6c1041c3eaf761d414bd81f6f12ad58fcd3a7b3d", "parents": [ "203ec2fed17ade9582277570eb234be52085f8c5", "7dec80ccbe310fb7e225bf21c48c672bb780ce7b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 10:01:38 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 20 10:01:38 2018 -0700" }, "message": "Merge branch \u0027core-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull core fixes from Thomas Gleixner:\n\n - Unbreak the BPF compilation which got broken by the unconditional\n requirement of asm-goto, which is not supported by clang.\n\n - Prevent probing on exception masking instructions in uprobes and\n kprobes to avoid the issues of the delayed exceptions instead of\n having an ugly workaround.\n\n - Prevent a double free_page() in the error path of do_kexec_load()\n\n - A set of objtool updates addressing various issues mostly related to\n switch tables and the noreturn detection for recursive sibling calls\n\n - Header sync for tools.\n\n* \u0027core-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n objtool: Detect RIP-relative switch table references, part 2\n objtool: Detect RIP-relative switch table references\n objtool: Support GCC 8 switch tables\n objtool: Support GCC 8\u0027s cold subfunctions\n objtool: Fix \"noreturn\" detection for recursive sibling calls\n objtool, kprobes/x86: Sync the latest \u003casm/insn.h\u003e header with tools/objtool/arch/x86/include/asm/insn.h\n x86/cpufeature: Guard asm_volatile_goto usage for BPF compilation\n uprobes/x86: Prohibit probing on MOV SS instruction\n kprobes/x86: Prohibit probing on exception masking instructions\n x86/kexec: Avoid double free_page() upon do_kexec_load() failure\n" }, { "commit": "b80d0b93b991e551a32157e0d9d38fc5bc9348a7", "tree": "e36f7168049247c5950f6ba3465a74ec11b17d78", "parents": [ "d775f26b295a0a303f7a73d7da46e04296484fe7" ], "author": { "name": "William Tu", "email": "u9012063@gmail.com", "time": "Fri May 18 19:22:28 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat May 19 23:32:12 2018 -0400" }, "message": "net: ip6_gre: fix tunnel metadata device sharing.\n\nCurrently ip6gre and ip6erspan share single metadata mode device,\nusing \u0027collect_md_tun\u0027. Thus, when doing:\n ip link add dev ip6gre11 type ip6gretap external\n ip link add dev ip6erspan12 type ip6erspan external\n RTNETLINK answers: File exists\nsimply fails due to the 2nd tries to create the same collect_md_tun.\n\nThe patch fixes it by adding a separate collect md tunnel device\nfor the ip6erspan, \u0027collect_md_tun_erspan\u0027. As a result, a couple\nof places need to refactor/split up in order to distinguish ip6gre\nand ip6erspan.\n\nFirst, move the collect_md check at ip6gre_tunnel_{unlink,link} and\ncreate separate function {ip6gre,ip6ersapn}_tunnel_{link_md,unlink_md}.\nThen before link/unlink, make sure the link_md/unlink_md is called.\nFinally, a separate ndo_uninit is created for ip6erspan. Tested it\nusing the samples/bpf/test_tunnel_bpf.sh.\n\nFixes: ef7baf5e083c (\"ip6_gre: add ip6 erspan collect_md mode\")\nSigned-off-by: William Tu \u003cu9012063@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "203ec2fed17ade9582277570eb234be52085f8c5", "tree": "124a02703beedb88b9603904d17aa44737233e2e", "parents": [ "0b449a441dac919444face9e3b6ca6aaec30791d", "709f490d5b594b9548577d2285ffeaad8a278b10" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 19 19:56:15 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 19 19:56:15 2018 -0700" }, "message": "Merge tag \u0027armsoc-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc\n\nPull ARM SoC fixes from Olof Johansson:\n \"A handful of fixes. I\u0027ve been queuing them up a bit too long so the\n list is longer than it otherwise would have been spread out across a\n few -rcs.\n\n In general, it\u0027s a scattering of fixes across several platforms,\n nothing truly serious enough to point out.\n\n There\u0027s a slightly larger batch of them for the Davinci platforms due\n to work to bring them back to life after some time, so there\u0027s a\n handful of regressions, some of them going back very far, others more\n recent.\n\n There\u0027s also a few patches fixing DT on Renesas platforms since they\n changed some bindings without remaining backwards compatible,\n splitting up describing LVDS as a proper bridge instead of having it\n as part of the display unit.\n\n We could push for them to be backwards compatible with old device\n trees, but it\u0027s likely to regress eventually if nobody\u0027s actually\n using said compatibility\"\n\n* tag \u0027armsoc-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (36 commits)\n ARM: davinci: board-dm646x-evm: set VPIF capture card name\n ARM: davinci: board-dm646x-evm: pass correct I2C adapter id for VPIF\n ARM: davinci: dm646x: fix timer interrupt generation\n ARM: keystone: fix platform_domain_notifier array overrun\n arm64: dts: exynos: Fix interrupt type for I2S1 device on Exynos5433\n ARM: dts: imx51-zii-rdu1: fix touchscreen bindings\n firmware: arm_scmi: Use after free in scmi_create_protocol_device()\n ARM: dts: cygnus: fix irq type for arm global timer\n Revert \"ARM: dts: logicpd-som-lv: Fix pinmux controller references\"\n tee: check shm references are consistent in offset/size\n tee: shm: fix use-after-free via temporarily dropped reference\n ARM: dts: imx7s: Pass the \u0027fsl,sec-era\u0027 property\n ARM: dts: tegra20: Revert \"Fix ULPI regression on Tegra20\"\n ARM: dts: correct missing \"compatible\" entry for ti81xx SoCs\n ARM: OMAP1: ams-delta: fix deferred_fiq handler\n arm64: tegra: Make BCM89610 PHY interrupt as active low\n ARM: davinci: fix GPIO lookup for I2C\n ARM: dts: logicpd-som-lv: Fix pinmux controller references\n ARM: dts: logicpd-som-lv: Fix Audio Mute\n ARM: dts: logicpd-som-lv: Fix WL127x Startup Issues\n ...\n" }, { "commit": "709f490d5b594b9548577d2285ffeaad8a278b10", "tree": "040131774cefab01680aa8b3950d0947fe8e9bbb", "parents": [ "a7be67b381ade36bf190601bdc5d6f44bae3cefe", "9df50ba76ac1485b844beffa1f3f5d9659d9cdaf" ], "author": { "name": "Olof Johansson", "email": "olof@lixom.net", "time": "Sat May 19 17:58:32 2018 -0700" }, "committer": { "name": "Olof Johansson", "email": "olof@lixom.net", "time": "Sat May 19 17:58:32 2018 -0700" }, "message": "Merge tag \u0027tegra-for-4.17-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into fixes\n\narm64: tegra: Device tree fixes for v4.17\n\nThis contains a one-line update to the device tree of the Tegra186 P3310\nprocessor module, fixing the polarity of the PHY interrupt. Originally,\nthis was queued to go into v4.18, but the PHY ID matching patch has now\nfound its way into v4.17-rc5, which means that the PHY driver will know\nhow to identify the PHY on this board and try to use the interrupt. This\nwill unfortunately cause networking to break on P3310, hence why I think\nthis should go into v4.17.\n\n* tag \u0027tegra-for-4.17-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux:\n arm64: tegra: Make BCM89610 PHY interrupt as active low\n\nSigned-off-by: Olof Johansson \u003colof@lixom.net\u003e\n" }, { "commit": "af86ca4e3088fe5eacf2f7e58c01fa68ca067672", "tree": "d01711e5fe7b1674c2929c473ead8047001ba886", "parents": [ "240da953fcc6a9008c92fae5b1f727ee5ed167ab" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Tue May 15 09:27:05 2018 -0700" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Sat May 19 20:44:24 2018 +0200" }, "message": "bpf: Prevent memory disambiguation attack\n\nDetect code patterns where malicious \u0027speculative store bypass\u0027 can be used\nand sanitize such patterns.\n\n 39: (bf) r3 \u003d r10\n 40: (07) r3 +\u003d -216\n 41: (79) r8 \u003d *(u64 *)(r7 +0) // slow read\n 42: (7a) *(u64 *)(r10 -72) \u003d 0 // verifier inserts this instruction\n 43: (7b) *(u64 *)(r8 +0) \u003d r3 // this store becomes slow due to r8\n 44: (79) r1 \u003d *(u64 *)(r6 +0) // cpu speculatively executes this load\n 45: (71) r2 \u003d *(u8 *)(r1 +0) // speculatively arbitrary \u0027load byte\u0027\n // is now sanitized\n\nAbove code after x86 JIT becomes:\n e5: mov %rbp,%rdx\n e8: add $0xffffffffffffff28,%rdx\n ef: mov 0x0(%r13),%r14\n f3: movq $0x0,-0x48(%rbp)\n fb: mov %rdx,0x0(%r14)\n ff: mov 0x0(%rbx),%rdi\n103: movzbq 0x0(%rdi),%rsi\n\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n" }, { "commit": "92d44a42af81e850a038c38278ff4f434b2871df", "tree": "28d02280bc3f6780c466adc64912e8db5239b4c6", "parents": [ "0d73c3f8e7f6ee2aab1bb350f60c180f5ae21a2c" ], "author": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Fri Apr 13 00:22:47 2018 +0100" }, "committer": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Sat May 19 18:49:43 2018 +0100" }, "message": "ARM: fix kill( ,SIGFPE) breakage\n\nCommit 7771c6645700 (\"signal/arm: Document conflicts with SI_USER and\nSIGFPE\") broke the siginfo structure for userspace triggered signals,\ncausing the strace testsuite to regress. Fix this by eliminating\nthe FPE_FIXME definition (which is at the root of the breakage) and\nuse FPE_FLTINV instead for the case where the hardware appears to be\nreporting nonsense.\n\nFixes: 7771c6645700 (\"signal/arm: Document conflicts with SI_USER and SIGFPE\")\nSuggested-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "0b449a441dac919444face9e3b6ca6aaec30791d", "tree": "34e73a4f46c465c1c6408df681a4c8e08942ef9c", "parents": [ "423913ad4ae5b3e8fb8983f70969fb522261ba26", "dbad41e7bb5f4b9949ff5ea1d76c20711f326308" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 19 09:54:02 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 19 09:54:02 2018 -0700" }, "message": "Merge tag \u0027dmaengine-fix-4.17-rc6\u0027 of git://git.infradead.org/users/vkoul/slave-dma\n\nPull dmaengine fix from Vinod Koul:\n\n - qcom bam runtime_pm fix\n\n - email update for Vinod\n\n* tag \u0027dmaengine-fix-4.17-rc6\u0027 of git://git.infradead.org/users/vkoul/slave-dma:\n dmaengine: qcom: bam_dma: check if the runtime pm enabled\n dmaengine: Update email address for Vinod\n" }, { "commit": "423913ad4ae5b3e8fb8983f70969fb522261ba26", "tree": "7b0834548e4604757172a64d706f0411430ff03e", "parents": [ "73fcb1a370c76b202d406e95d9dabb76eaccf484" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 19 09:29:11 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 19 09:29:11 2018 -0700" }, "message": "mmap: relax file size limit for regular files\n\nCommit be83bbf80682 (\"mmap: introduce sane default mmap limits\") was\nintroduced to catch problems in various ad-hoc character device drivers\ndoing mmap and getting the size limits wrong. In the process, it used\n\"known good\" limits for the normal cases of mapping regular files and\nblock device drivers.\n\nIt turns out that the \"s_maxbytes\" limit was less \"known good\" than I\nthought. In particular, /proc doesn\u0027t set it, but exposes one regular\nfile to mmap: /proc/vmcore. As a result, that file got limited to the\ndefault MAX_INT s_maxbytes value.\n\nThis went unnoticed for a while, because apparently the only thing that\nneeds it is the s390 kernel zfcpdump, but there might be other tools\nthat use this too.\n\nVasily suggested just changing s_maxbytes for all of /proc, which isn\u0027t\nwrong, but makes me nervous at this stage. So instead, just make the\nnew mmap limit always be MAX_LFS_FILESIZE for regular files, which won\u0027t\naffect anything else. It wasn\u0027t the regular file case I was worried\nabout.\n\nI\u0027d really prefer for maxsize to have been per-inode, but that is not\nhow things are today.\n\nFixes: be83bbf80682 (\"mmap: introduce sane default mmap limits\")\nReported-by: Vasily Gorbik \u003cgor@linux.ibm.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "78ce241099bb363b19dbd0245442e66c8de8f567", "tree": "735340ca194fc1472f9671f4012fae06b3ce93f5", "parents": [ "73fcb1a370c76b202d406e95d9dabb76eaccf484" ], "author": { "name": "Borislav Petkov", "email": "bp@suse.de", "time": "Thu May 17 10:46:26 2018 +0200" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Sat May 19 15:19:30 2018 +0200" }, "message": "x86/MCE/AMD: Cache SMCA MISC block addresses\n\n... into a global, two-dimensional array and service subsequent reads from\nthat cache to avoid rdmsr_on_cpu() calls during CPU hotplug (IPIs with IRQs\ndisabled).\n\nIn addition, this fixes a KASAN slab-out-of-bounds read due to wrong usage\nof the bank-\u003eblocks pointer.\n\nFixes: 27bd59502702 (\"x86/mce/AMD: Get address from already initialized block\")\nReported-by: Johannes Hirte \u003cjohannes.hirte@datenkhaos.de\u003e\nTested-by: Johannes Hirte \u003cjohannes.hirte@datenkhaos.de\u003e\nSigned-off-by: Borislav Petkov \u003cbp@suse.de\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Yazen Ghannam \u003cyazen.ghannam@amd.com\u003e\nLink: http://lkml.kernel.org/r/20180414004230.GA2033@probook\n" }, { "commit": "0d73c3f8e7f6ee2aab1bb350f60c180f5ae21a2c", "tree": "1157529f1984e2f576326efb9fcc5dda67a9da86", "parents": [ "eb0146daefdde65665b7f076fbff7b49dade95b9" ], "author": { "name": "Masami Hiramatsu", "email": "mhiramat@kernel.org", "time": "Sun May 13 05:04:29 2018 +0100" }, "committer": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Sat May 19 11:35:56 2018 +0100" }, "message": "ARM: 8772/1: kprobes: Prohibit kprobes on get_user functions\n\nSince do_undefinstr() uses get_user to get the undefined\ninstruction, it can be called before kprobes processes\nrecursive check. This can cause an infinit recursive\nexception.\nProhibit probing on get_user functions.\n\nFixes: 24ba613c9d6c (\"ARM kprobes: core code\")\nSigned-off-by: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "eb0146daefdde65665b7f076fbff7b49dade95b9", "tree": "b7e478904c9cd985c4349977d67b92178369392d", "parents": [ "70948c05fdde0aac32f9667856a88725c192fa40" ], "author": { "name": "Masami Hiramatsu", "email": "mhiramat@kernel.org", "time": "Sun May 13 05:04:16 2018 +0100" }, "committer": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Sat May 19 11:35:56 2018 +0100" }, "message": "ARM: 8771/1: kprobes: Prohibit kprobes on do_undefinstr\n\nProhibit kprobes on do_undefinstr because kprobes on\narm is implemented by undefined instruction. This means\nif we probe do_undefinstr(), it can cause infinit\nrecursive exception.\n\nFixes: 24ba613c9d6c (\"ARM kprobes: core code\")\nSigned-off-by: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "70948c05fdde0aac32f9667856a88725c192fa40", "tree": "438853e99d5d6ab02ef59df38856f858eb8b0f19", "parents": [ "69af7e23a6870df2ea6fa79ca16493d59b3eebeb" ], "author": { "name": "Masami Hiramatsu", "email": "mhiramat@kernel.org", "time": "Sun May 13 05:04:10 2018 +0100" }, "committer": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Sat May 19 11:35:56 2018 +0100" }, "message": "ARM: 8770/1: kprobes: Prohibit probing on optimized_callback\n\nProhibit probing on optimized_callback() because\nit is called from kprobes itself. If we put a kprobes\non it, that will cause a recursive call loop.\nMark it NOKPROBE_SYMBOL.\n\nFixes: 0dc016dbd820 (\"ARM: kprobes: enable OPTPROBES for ARM 32\")\nSigned-off-by: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "69af7e23a6870df2ea6fa79ca16493d59b3eebeb", "tree": "30d7b2868bf335d2df7154f7f5956b9e3b88bc7f", "parents": [ "6cea14f55474ec71f1098228e0ae5dd2a8f22c0a" ], "author": { "name": "Masami Hiramatsu", "email": "mhiramat@kernel.org", "time": "Sun May 13 05:03:54 2018 +0100" }, "committer": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Sat May 19 11:35:56 2018 +0100" }, "message": "ARM: 8769/1: kprobes: Fix to use get_kprobe_ctlblk after irq-disabed\n\nSince get_kprobe_ctlblk() uses smp_processor_id() to access\nper-cpu variable, it hits smp_processor_id sanity check as below.\n\n[ 7.006928] BUG: using smp_processor_id() in preemptible [00000000] code: swapper/0/1\n[ 7.007859] caller is debug_smp_processor_id+0x20/0x24\n[ 7.008438] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.16.0-rc1-00192-g4eb17253e4b5 #1\n[ 7.008890] Hardware name: Generic DT based system\n[ 7.009917] [\u003cc0313f0c\u003e] (unwind_backtrace) from [\u003cc030e6d8\u003e] (show_stack+0x20/0x24)\n[ 7.010473] [\u003cc030e6d8\u003e] (show_stack) from [\u003cc0c64694\u003e] (dump_stack+0x84/0x98)\n[ 7.010990] [\u003cc0c64694\u003e] (dump_stack) from [\u003cc071ca5c\u003e] (check_preemption_disabled+0x138/0x13c)\n[ 7.011592] [\u003cc071ca5c\u003e] (check_preemption_disabled) from [\u003cc071ca80\u003e] (debug_smp_processor_id+0x20/0x24)\n[ 7.012214] [\u003cc071ca80\u003e] (debug_smp_processor_id) from [\u003cc03335e0\u003e] (optimized_callback+0x2c/0xe4)\n[ 7.013077] [\u003cc03335e0\u003e] (optimized_callback) from [\u003cbf0021b0\u003e] (0xbf0021b0)\n\nTo fix this issue, call get_kprobe_ctlblk() right after\nirq-disabled since that disables preemption.\n\nFixes: 0dc016dbd820 (\"ARM: kprobes: enable OPTPROBES for ARM 32\")\nSigned-off-by: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "6cea14f55474ec71f1098228e0ae5dd2a8f22c0a", "tree": "019ca00ca099ce5c9fbda6d3a7b21511aed75c3b", "parents": [ "1c37963b1a1600b9686c4a99857ddcb6028be884" ], "author": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Mon Apr 16 13:21:54 2018 +0100" }, "committer": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Sat May 19 11:35:56 2018 +0100" }, "message": "ARM: replace unnecessary perl with sed and the shell $(( )) operator\n\nYou can build a kernel in a cross compiling environment that doesn\u0027t\nhave perl in the $PATH. Commit 429f7a062e3b broke that for 32 bit\nARM. Fix it.\n\nAs reported by Stephen Rothwell, it appears that the symbols can be\neither part of the BSS section or absolute symbols depending on the\nbinutils version. When they\u0027re an absolute symbol, the $(( ))\noperator errors out and the build fails. Fix this as well.\n\nFixes: 429f7a062e3b (\"ARM: decompressor: fix BSS size calculation\")\nReported-by: Rob Landley \u003crob@landley.net\u003e\nReported-by: Stephen Rothwell \u003csfr@canb.auug.org.au\u003e\nAcked-by: Rob Landley \u003crob@landley.net\u003e\nSigned-off-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "1c37963b1a1600b9686c4a99857ddcb6028be884", "tree": "64fc17a95c9c4f6b8345c9cb8e23c2bfd4a7602c", "parents": [ "2d7b3c64431245c95b05a441669c074da10db943" ], "author": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Wed Apr 11 19:35:19 2018 +0100" }, "committer": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Sat May 19 11:35:56 2018 +0100" }, "message": "ARM: kexec: record parent context registers for non-crash CPUs\n\nHow we got to machine_crash_nonpanic_core() (iow, from an IPI, etc) is\nnot interesting for debugging a crash. The more interesting context\nis the parent context prior to the IPI being received.\n\nRecord the parent context register state rather than the register state\nin machine_crash_nonpanic_core(), which is more relevant to the failing\ncondition.\n\nSigned-off-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "2d7b3c64431245c95b05a441669c074da10db943", "tree": "8fe887d96dfe0fc4cda343ad253431ffff80476e", "parents": [ "f2ae9de019e4e2807d812ec4fe1df7c34788a0a0" ], "author": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Wed Apr 11 18:24:01 2018 +0100" }, "committer": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Sat May 19 11:35:56 2018 +0100" }, "message": "ARM: kexec: fix kdump register saving on panic()\n\nWhen a panic() occurs, the kexec code uses smp_send_stop() to stop\nthe other CPUs, but this results in the CPU register state not being\nsaved, and gdb is unable to inspect the state of other CPUs.\n\nCommit 0ee59413c967 (\"x86/panic: replace smp_send_stop() with kdump\nfriendly version in panic path\") addressed the issue on x86, but\nignored other architectures. Address the issue on ARM by splitting\nout the crash stop implementation to crash_smp_send_stop() and\nadding the necessary protection.\n\nSigned-off-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "f2ae9de019e4e2807d812ec4fe1df7c34788a0a0", "tree": "ae15ff60082dd9499cc35eb513184956b0453285", "parents": [ "e07e3c33b9c0b5751ade624f44325c9bf2487ea6" ], "author": { "name": "Łukasz Stelmach", "email": "l.stelmach@samsung.com", "time": "Wed Apr 04 08:46:58 2018 +0100" }, "committer": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Sat May 19 11:35:56 2018 +0100" }, "message": "ARM: 8758/1: decompressor: restore r1 and r2 just before jumping to the kernel\n\nThe hypervisor setup before __enter_kernel destroys the value\nsotred in r1. The value needs to be restored just before the jump.\n\nFixes: 6b52f7bdb888 (\"ARM: hyp-stub: Use r1 for the soft-restart address\")\nSigned-off-by: Łukasz Stelmach \u003cl.stelmach@samsung.com\u003e\nSigned-off-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "e07e3c33b9c0b5751ade624f44325c9bf2487ea6", "tree": "7f5c7bd5ea61b04701f04f7fe924b588e3f7f444", "parents": [ "60cc43fc888428bb2f18f08997432d426a243338" ], "author": { "name": "Łukasz Stelmach", "email": "l.stelmach@samsung.com", "time": "Tue Apr 03 09:04:57 2018 +0100" }, "committer": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Sat May 19 11:35:56 2018 +0100" }, "message": "ARM: 8753/1: decompressor: add a missing parameter to the addruart macro\n\nIn commit 639da5ee374b (\"ARM: add an extra temp register to the low\nlevel debugging addruart macro\") an additional temporary register was\nadded to the addruart macro, but the decompressor code wasn\u0027t updated.\n\nFixes: 639da5ee374b (\"ARM: add an extra temp register to the low level debugging addruart macro\")\nSigned-off-by: Łukasz Stelmach \u003cl.stelmach@samsung.com\u003e\nSigned-off-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "acf46020012ccbca1172e9c7aeab399c950d9212", "tree": "d056dd2d22539a590a818c96f2aed68488087f69", "parents": [ "fed71f7d98795ed0fa1d431910787f0f4a68324f" ], "author": { "name": "Dmitry Safonov", "email": "dima@arista.com", "time": "Fri May 18 00:35:10 2018 +0100" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Sat May 19 12:31:05 2018 +0200" }, "message": "x86/mm: Drop TS_COMPAT on 64-bit exec() syscall\n\nThe x86 mmap() code selects the mmap base for an allocation depending on\nthe bitness of the syscall. For 64bit sycalls it select mm-\u003emmap_base and\nfor 32bit mm-\u003emmap_compat_base.\n\nexec() calls mmap() which in turn uses in_compat_syscall() to check whether\nthe mapping is for a 32bit or a 64bit task. The decision is made on the\nfollowing criteria:\n\n ia32 child-\u003ethread.status \u0026 TS_COMPAT\n x32 child-\u003ept_regs.orig_ax \u0026 __X32_SYSCALL_BIT\n ia64 !ia32 \u0026\u0026 !x32\n\n__set_personality_x32() was dropping TS_COMPAT flag, but\nset_personality_64bit() has kept compat syscall flag making\nin_compat_syscall() return true during the first exec() syscall.\n\nWhich in result has user-visible effects, mentioned by Alexey:\n1) It breaks ASAN\n$ gcc -fsanitize\u003daddress wrap.c -o wrap-asan\n$ ./wrap32 ./wrap-asan true\n\u003d\u003d1217\u003d\u003dShadow memory range interleaves with an existing memory mapping. ASan cannot proceed correctly. ABORTING.\n\u003d\u003d1217\u003d\u003dASan shadow was supposed to be located in the [0x00007fff7000-0x10007fff7fff] range.\n\u003d\u003d1217\u003d\u003dProcess memory map follows:\n 0x000000400000-0x000000401000 /home/izbyshev/test/gcc/asan-exec-from-32bit/wrap-asan\n 0x000000600000-0x000000601000 /home/izbyshev/test/gcc/asan-exec-from-32bit/wrap-asan\n 0x000000601000-0x000000602000 /home/izbyshev/test/gcc/asan-exec-from-32bit/wrap-asan\n 0x0000f7dbd000-0x0000f7de2000 /lib64/ld-2.27.so\n 0x0000f7fe2000-0x0000f7fe3000 /lib64/ld-2.27.so\n 0x0000f7fe3000-0x0000f7fe4000 /lib64/ld-2.27.so\n 0x0000f7fe4000-0x0000f7fe5000\n 0x7fed9abff000-0x7fed9af54000\n 0x7fed9af54000-0x7fed9af6b000 /lib64/libgcc_s.so.1\n[snip]\n\n2) It doesn\u0027t seem to be great for security if an attacker always knows\nthat ld.so is going to be mapped into the first 4GB in this case\n(the same thing happens for PIEs as well).\n\nThe testcase:\n$ cat wrap.c\n\nint main(int argc, char *argv[]) {\n execvp(argv[1], \u0026argv[1]);\n return 127;\n}\n\n$ gcc wrap.c -o wrap\n$ LD_SHOW_AUXV\u003d1 ./wrap ./wrap true |\u0026 grep AT_BASE\nAT_BASE: 0x7f63b8309000\nAT_BASE: 0x7faec143c000\nAT_BASE: 0x7fbdb25fa000\n\n$ gcc -m32 wrap.c -o wrap32\n$ LD_SHOW_AUXV\u003d1 ./wrap32 ./wrap true |\u0026 grep AT_BASE\nAT_BASE: 0xf7eff000\nAT_BASE: 0xf7cee000\nAT_BASE: 0x7f8b9774e000\n\nFixes: 1b028f784e8c (\"x86/mm: Introduce mmap_compat_base() for 32-bit mmap()\")\nFixes: ada26481dfe6 (\"x86/mm: Make in_compat_syscall() work during exec\")\nReported-by: Alexey Izbyshev \u003cizbyshev@ispras.ru\u003e\nBisected-by: Alexander Monakov \u003camonakov@ispras.ru\u003e\nInvestigated-by: Andy Lutomirski \u003cluto@kernel.org\u003e\nSigned-off-by: Dmitry Safonov \u003cdima@arista.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nReviewed-by: Cyrill Gorcunov \u003cgorcunov@openvz.org\u003e\nCc: Borislav Petkov \u003cbp@suse.de\u003e\nCc: Alexander Monakov \u003camonakov@ispras.ru\u003e\nCc: Dmitry Safonov \u003c0x7f454c46@gmail.com\u003e\nCc: stable@vger.kernel.org\nCc: linux-mm@kvack.org\nCc: Andy Lutomirski \u003cluto@kernel.org\u003e\nCc: \"H. Peter Anvin\" \u003chpa@zytor.com\u003e\nCc: Cyrill Gorcunov \u003cgorcunov@openvz.org\u003e\nCc: \"Kirill A. Shutemov\" \u003ckirill.shutemov@linux.intel.com\u003e\nLink: https://lkml.kernel.org/r/20180517233510.24996-1-dima@arista.com\n" }, { "commit": "7dec80ccbe310fb7e225bf21c48c672bb780ce7b", "tree": "f3347e1337b03e89b27c6db8e1c5fe0b84e8171b", "parents": [ "6f5ec2993b1f39aed12fa6fd56e8dc2272ee8a33" ], "author": { "name": "Josh Poimboeuf", "email": "jpoimboe@redhat.com", "time": "Fri May 18 15:10:34 2018 -0500" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Sat May 19 08:10:04 2018 +0200" }, "message": "objtool: Detect RIP-relative switch table references, part 2\n\nWith the following commit:\n\n fd35c88b7417 (\"objtool: Support GCC 8 switch tables\")\n\nI added a \"can\u0027t find switch jump table\" warning, to stop covering up\nsilent failures if add_switch_table() can\u0027t find anything.\n\nThat warning found yet another bug in the objtool switch table detection\nlogic. For cases 1 and 2 (as described in the comments of\nfind_switch_table()), the find_symbol_containing() check doesn\u0027t adjust\nthe offset for RIP-relative switch jumps.\n\nIncidentally, this bug was already fixed for case 3 with:\n\n 6f5ec2993b1f (\"objtool: Detect RIP-relative switch table references\")\n\nHowever, that commit missed the fix for cases 1 and 2.\n\nThe different cases are now starting to look more and more alike. So\nfix the bug by consolidating them into a single case, by checking the\noriginal dynamic jump instruction in the case 3 loop.\n\nThis also simplifies the code and makes it more robust against future\nswitch table detection issues -- of which I\u0027m sure there will be many...\n\nSwitch table detection has been the most fragile area of objtool, by\nfar. I long for the day when we\u0027ll have a GCC plugin for annotating\nswitch tables. Linus asked me to delay such a plugin due to the\nflakiness of the plugin infrastructure in older versions of GCC, so this\nrickety code is what we\u0027re stuck with for now. At least the code is now\na little simpler than it was.\n\nReported-by: kbuild test robot \u003clkp@intel.com\u003e\nSigned-off-by: Josh Poimboeuf \u003cjpoimboe@redhat.com\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nLink: http://lkml.kernel.org/r/f400541613d45689086329432f3095119ffbc328.1526674218.git.jpoimboe@redhat.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "4f74d72aa7067e75af92fbab077e6d7d0210be66", "tree": "47e38263afc0c1de290c0fdf1c80c07cb0c7f3dc", "parents": [ "0b3225ab9407f557a8e20f23f37aa7236c10a9b1" ], "author": { "name": "Mark Rutland", "email": "mark.rutland@arm.com", "time": "Fri May 18 16:08:41 2018 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Sat May 19 08:07:56 2018 +0200" }, "message": "efi/libstub/arm64: Handle randomized TEXT_OFFSET\n\nWhen CONFIG_RANDOMIZE_TEXT_OFFSET\u003dy, TEXT_OFFSET is an arbitrary\nmultiple of PAGE_SIZE in the interval [0, 2MB).\n\nThe EFI stub does not account for the potential misalignment of\nTEXT_OFFSET relative to EFI_KIMG_ALIGN, and produces a randomized\nphysical offset which is always a round multiple of EFI_KIMG_ALIGN.\nThis may result in statically allocated objects whose alignment exceeds\nPAGE_SIZE to appear misaligned in memory. This has been observed to\nresult in spurious stack overflow reports and failure to make use of\nthe IRQ stacks, and theoretically could result in a number of other\nissues.\n\nWe can OR in the low bits of TEXT_OFFSET to ensure that we have the\nnecessary offset (and hence preserve the misalignment of TEXT_OFFSET\nrelative to EFI_KIMG_ALIGN), so let\u0027s do that.\n\nReported-by: Kim Phillips \u003ckim.phillips@arm.com\u003e\nTested-by: Kim Phillips \u003ckim.phillips@arm.com\u003e\n[ardb: clarify comment and commit log, drop unneeded parens]\nSigned-off-by: Mark Rutland \u003cmark.rutland@arm.com\u003e\nSigned-off-by: Ard Biesheuvel \u003card.biesheuvel@linaro.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: linux-efi@vger.kernel.org\nFixes: 6f26b3671184c36d (\"arm64: kaslr: increase randomization granularity\")\nLink: http://lkml.kernel.org/r/20180518140841.9731-2-ard.biesheuvel@linaro.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "73fcb1a370c76b202d406e95d9dabb76eaccf484", "tree": "78997fee9c78677955d414a699ce965fb8a21065", "parents": [ "10a2f87485b9fb7bec1a50305d4a3ec74aa8058c", "66072c29328717072fd84aaff3e070e3f008ba77" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 21:24:26 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 21:24:26 2018 -0700" }, "message": "Merge branch \u0027akpm\u0027 (patches from Andrew)\n\nMerge misc fixes from Andrew Morton:\n \"10 fixes\"\n\n* emailed patches from Andrew Morton \u003cakpm@linux-foundation.org\u003e:\n hfsplus: stop workqueue when fill_super() failed\n mm: don\u0027t allow deferred pages with NEED_PER_CPU_KM\n MAINTAINERS: add Q: entry to kselftest for patchwork project\n radix tree: fix multi-order iteration race\n radix tree test suite: multi-order iteration race\n radix tree test suite: add item_delete_rcu()\n radix tree test suite: fix compilation issue\n radix tree test suite: fix mapshift build target\n include/linux/mm.h: add new inline function vmf_error()\n lib/test_bitmap.c: fix bitmap optimisation tests to report errors correctly\n" }, { "commit": "10a2f87485b9fb7bec1a50305d4a3ec74aa8058c", "tree": "10f884376866352aac581e8ea583a901c1d60519", "parents": [ "f65cfecfa1181232cd7298243bcb3c535f09c4da", "54940fa60ad3728c592f62dadb558165495a6938" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 21:22:16 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 21:22:16 2018 -0700" }, "message": "Merge tag \u0027platform-drivers-x86-v4.17-3\u0027 of git://git.infradead.org/linux-platform-drivers-x86\n\nPull x86 platform driver fix from Darren Hart:\n \"Remove the last of the \"select DELL_SMBIOS\" references in the Kconfig\"\n\n* tag \u0027platform-drivers-x86-v4.17-3\u0027 of git://git.infradead.org/linux-platform-drivers-x86:\n platform/x86: DELL_WMI use depends on instead of select for DELL_SMBIOS\n" }, { "commit": "f65cfecfa1181232cd7298243bcb3c535f09c4da", "tree": "f4b8e8ba7ac4c07507c70cae589896d22a8a18b3", "parents": [ "6d16db0093936c382f74ed3d076fc7d025671297", "9a160601f3fb6ffa196b87d1b5643646be486405" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 21:19:02 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 21:19:02 2018 -0700" }, "message": "Merge tag \u0027clk-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux\n\nPull clk fixes from Stephen Boyd:\n\n - a modified revert of a patch that made new choices come out for a\n couple stm32 clk drivers that really always need to be there when\n that particular machine is compiled in\n\n - boot fix on i.MX for Stefan who noticed odd behavior from the\n critical flag patch that came in during the merge window\n\n* tag \u0027clk-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:\n clk: stm32: fix: stm32 clock drivers are not compiled by default\n clk: imx6ull: use OSC clock during AXI rate change\n" }, { "commit": "6d16db0093936c382f74ed3d076fc7d025671297", "tree": "3d86894f9fe561b8ba545dc6f7b8be4731e5e3b7", "parents": [ "2c71d338bef2cc8a2e5f8ebe70788eeff246fcd8", "22aac3eb0c465dd9ea7f06ee1ed8ad933890f2a3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 18:02:01 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 18:02:01 2018 -0700" }, "message": "Merge branch \u0027i2c/for-current-fixed\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fixes from Wolfram Sang:\n \"A bunch of driver bugfixes and a MAINTAINERS addition\"\n\n* \u0027i2c/for-current-fixed\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n MAINTAINERS: add entry for STM32 I2C driver\n i2c: viperboard: return message count on master_xfer success\n i2c: pmcmsp: fix error return from master_xfer\n i2c: pmcmsp: return message count on master_xfer success\n i2c: designware: fix poll-after-enable regression\n eeprom: at24: fix retrieving the at24_chip_data structure\n i2c: core: ACPI: Log device not acking errors at dbg loglevel\n i2c: core: ACPI: Improve OpRegion read errors\n" }, { "commit": "66072c29328717072fd84aaff3e070e3f008ba77", "tree": "26193f71ea5b450475dcfec2cb4487a0e0ca3316", "parents": [ "ab1e8d8960b68f54af42b6484b5950bd13a4054b" ], "author": { "name": "Tetsuo Handa", "email": "penguin-kernel@I-love.SAKURA.ne.jp", "time": "Fri May 18 16:09:16 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 17:17:12 2018 -0700" }, "message": "hfsplus: stop workqueue when fill_super() failed\n\nsyzbot is reporting ODEBUG messages at hfsplus_fill_super() [1]. This\nis because hfsplus_fill_super() forgot to call cancel_delayed_work_sync().\n\nAs far as I can see, it is hfsplus_mark_mdb_dirty() from\nhfsplus_new_inode() in hfsplus_fill_super() that calls\nqueue_delayed_work(). Therefore, I assume that hfsplus_new_inode() does\nnot fail if queue_delayed_work() was called, and the out_put_hidden_dir\nlabel is the appropriate location to call cancel_delayed_work_sync().\n\n[1] https://syzkaller.appspot.com/bug?id\u003da66f45e96fdbeb76b796bf46eb25ea878c42a6c9\n\nLink: http://lkml.kernel.org/r/964a8b27-cd69-357c-fe78-76b066056201@I-love.SAKURA.ne.jp\nSigned-off-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nReported-by: syzbot \u003csyzbot+4f2e5f086147d543ab03@syzkaller.appspotmail.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: David Howells \u003cdhowells@redhat.com\u003e\nCc: Ernesto A. Fernandez \u003cernesto.mnd.fernandez@gmail.com\u003e\nCc: Vyacheslav Dubeyko \u003cslava@dubeyko.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "ab1e8d8960b68f54af42b6484b5950bd13a4054b", "tree": "6baeef153138ad59c38d8466bb4014dcb2e00628", "parents": [ "f3d8d3cfc1c00d1ebdb53ee96aa53aa822209003" ], "author": { "name": "Pavel Tatashin", "email": "pasha.tatashin@oracle.com", "time": "Fri May 18 16:09:13 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 17:17:12 2018 -0700" }, "message": "mm: don\u0027t allow deferred pages with NEED_PER_CPU_KM\n\nIt is unsafe to do virtual to physical translations before mm_init() is\ncalled if struct page is needed in order to determine the memory section\nnumber (see SECTION_IN_PAGE_FLAGS). This is because only in mm_init()\nwe initialize struct pages for all the allocated memory when deferred\nstruct pages are used.\n\nMy recent fix in commit c9e97a1997 (\"mm: initialize pages on demand\nduring boot\") exposed this problem, because it greatly reduced number of\npages that are initialized before mm_init(), but the problem existed\neven before my fix, as Fengguang Wu found.\n\nBelow is a more detailed explanation of the problem.\n\nWe initialize struct pages in four places:\n\n1. Early in boot a small set of struct pages is initialized to fill the\n first section, and lower zones.\n\n2. During mm_init() we initialize \"struct pages\" for all the memory that\n is allocated, i.e reserved in memblock.\n\n3. Using on-demand logic when pages are allocated after mm_init call\n (when memblock is finished)\n\n4. After smp_init() when the rest free deferred pages are initialized.\n\nThe problem occurs if we try to do va to phys translation of a memory\nbetween steps 1 and 2. Because we have not yet initialized struct pages\nfor all the reserved pages, it is inherently unsafe to do va to phys if\nthe translation itself requires access of \"struct page\" as in case of\nthis combination: CONFIG_SPARSE \u0026\u0026 !CONFIG_SPARSE_VMEMMAP\n\nThe following path exposes the problem:\n\n start_kernel()\n trap_init()\n setup_cpu_entry_areas()\n setup_cpu_entry_area(cpu)\n get_cpu_gdt_paddr(cpu)\n per_cpu_ptr_to_phys(addr)\n pcpu_addr_to_page(addr)\n virt_to_page(addr)\n pfn_to_page(__pa(addr) \u003e\u003e PAGE_SHIFT)\n\nWe disable this path by not allowing NEED_PER_CPU_KM with deferred\nstruct pages feature.\n\nThe problems are discussed in these threads:\n http://lkml.kernel.org/r/20180418135300.inazvpxjxowogyge@wfg-t540p.sh.intel.com\n http://lkml.kernel.org/r/20180419013128.iurzouiqxvcnpbvz@wfg-t540p.sh.intel.com\n http://lkml.kernel.org/r/20180426202619.2768-1-pasha.tatashin@oracle.com\n\nLink: http://lkml.kernel.org/r/20180515175124.1770-1-pasha.tatashin@oracle.com\nFixes: 3a80a7fa7989 (\"mm: meminit: initialise a subset of struct pages if CONFIG_DEFERRED_STRUCT_PAGE_INIT is set\")\nSigned-off-by: Pavel Tatashin \u003cpasha.tatashin@oracle.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nReviewed-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Steven Sistare \u003csteven.sistare@oracle.com\u003e\nCc: Daniel Jordan \u003cdaniel.m.jordan@oracle.com\u003e\nCc: Mel Gorman \u003cmgorman@techsingularity.net\u003e\nCc: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nCc: Dennis Zhou \u003cdennisszhou@gmail.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "f3d8d3cfc1c00d1ebdb53ee96aa53aa822209003", "tree": "6a8ebd7ec1a8f72d196124fd8940b6739dd62780", "parents": [ "9f418224e8114156d995b98fa4e0f4fd21f685fe" ], "author": { "name": "Shuah Khan (Samsung OSG)", "email": "shuah@kernel.org", "time": "Fri May 18 16:09:09 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 17:17:12 2018 -0700" }, "message": "MAINTAINERS: add Q: entry to kselftest for patchwork project\n\nA new patchwork project is created to track kselftest patches. Update\nthe kselftest entry in the MAINTAINERS file adding \u0027Q:\u0027 entry:\n\n https://patchwork.kernel.org/project/linux-kselftest/list/\n\nLink: http://lkml.kernel.org/r/20180515164427.12201-1-shuah@kernel.org\nSigned-off-by: Shuah Khan (Samsung OSG) \u003cshuah@kernel.org\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Mauro Carvalho Chehab \u003cmchehab+samsung@kernel.org\u003e\nCc: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nCc: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nCc: Randy Dunlap \u003crdunlap@infradead.org\u003e\nCc: Joe Perches \u003cjoe@perches.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "9f418224e8114156d995b98fa4e0f4fd21f685fe", "tree": "0102d058dd3eb6eb89e809ab5652e8d325b98f2b", "parents": [ "fd8f58c40b703e47697c9f12bc16c31f14c161f1" ], "author": { "name": "Ross Zwisler", "email": "ross.zwisler@linux.intel.com", "time": "Fri May 18 16:09:06 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 17:17:12 2018 -0700" }, "message": "radix tree: fix multi-order iteration race\n\nFix a race in the multi-order iteration code which causes the kernel to\nhit a GP fault. This was first seen with a production v4.15 based\nkernel (4.15.6-300.fc27.x86_64) utilizing a DAX workload which used\norder 9 PMD DAX entries.\n\nThe race has to do with how we tear down multi-order sibling entries\nwhen we are removing an item from the tree. Remember for example that\nan order 2 entry looks like this:\n\n struct radix_tree_node.slots[] \u003d [entry][sibling][sibling][sibling]\n\nwhere \u0027entry\u0027 is in some slot in the struct radix_tree_node, and the\nthree slots following \u0027entry\u0027 contain sibling pointers which point back\nto \u0027entry.\u0027\n\nWhen we delete \u0027entry\u0027 from the tree, we call :\n\n radix_tree_delete()\n radix_tree_delete_item()\n __radix_tree_delete()\n replace_slot()\n\nreplace_slot() first removes the siblings in order from the first to the\nlast, then at then replaces \u0027entry\u0027 with NULL. This means that for a\nbrief period of time we end up with one or more of the siblings removed,\nso:\n\n struct radix_tree_node.slots[] \u003d [entry][NULL][sibling][sibling]\n\nThis causes an issue if you have a reader iterating over the slots in\nthe tree via radix_tree_for_each_slot() while only under\nrcu_read_lock()/rcu_read_unlock() protection. This is a common case in\nmm/filemap.c.\n\nThe issue is that when __radix_tree_next_slot() \u003d\u003e skip_siblings() tries\nto skip over the sibling entries in the slots, it currently does so with\nan exact match on the slot directly preceding our current slot.\nNormally this works:\n\n V preceding slot\n struct radix_tree_node.slots[] \u003d [entry][sibling][sibling][sibling]\n ^ current slot\n\nThis lets you find the first sibling, and you skip them all in order.\n\nBut in the case where one of the siblings is NULL, that slot is skipped\nand then our sibling detection is interrupted:\n\n V preceding slot\n struct radix_tree_node.slots[] \u003d [entry][NULL][sibling][sibling]\n ^ current slot\n\nThis means that the sibling pointers aren\u0027t recognized since they point\nall the way back to \u0027entry\u0027, so we think that they are normal internal\nradix tree pointers. This causes us to think we need to walk down to a\nstruct radix_tree_node starting at the address of \u0027entry\u0027.\n\nIn a real running kernel this will crash the thread with a GP fault when\nyou try and dereference the slots in your broken node starting at\n\u0027entry\u0027.\n\nWe fix this race by fixing the way that skip_siblings() detects sibling\nnodes. Instead of testing against the preceding slot we instead look\nfor siblings via is_sibling_entry() which compares against the position\nof the struct radix_tree_node.slots[] array. This ensures that sibling\nentries are properly identified, even if they are no longer contiguous\nwith the \u0027entry\u0027 they point to.\n\nLink: http://lkml.kernel.org/r/20180503192430.7582-6-ross.zwisler@linux.intel.com\nFixes: 148deab223b2 (\"radix-tree: improve multiorder iterators\")\nSigned-off-by: Ross Zwisler \u003cross.zwisler@linux.intel.com\u003e\nReported-by: CR, Sapthagirish \u003csapthagirish.cr@intel.com\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nCc: Matthew Wilcox \u003cwilly@infradead.org\u003e\nCc: Christoph Hellwig \u003chch@lst.de\u003e\nCc: Dan Williams \u003cdan.j.williams@intel.com\u003e\nCc: Dave Chinner \u003cdavid@fromorbit.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "fd8f58c40b703e47697c9f12bc16c31f14c161f1", "tree": "d93502102793c414d75fd915edffdf54fb72592c", "parents": [ "3e252fa7d4f711798e7a3f5ff2d7b62f0e2987ce" ], "author": { "name": "Ross Zwisler", "email": "ross.zwisler@linux.intel.com", "time": "Fri May 18 16:09:01 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 17:17:12 2018 -0700" }, "message": "radix tree test suite: multi-order iteration race\n\nAdd a test which shows a race in the multi-order iteration code. This\ntest reliably hits the race in under a second on my machine, and is the\nresult of a real bug report against kernel a production v4.15 based\nkernel (4.15.6-300.fc27.x86_64). With a real kernel this issue is hit\nwhen using order 9 PMD DAX radix tree entries.\n\nThe race has to do with how we tear down multi-order sibling entries\nwhen we are removing an item from the tree. Remember that an order 2\nentry looks like this:\n\n struct radix_tree_node.slots[] \u003d [entry][sibling][sibling][sibling]\n\nwhere \u0027entry\u0027 is in some slot in the struct radix_tree_node, and the\nthree slots following \u0027entry\u0027 contain sibling pointers which point back\nto \u0027entry.\u0027\n\nWhen we delete \u0027entry\u0027 from the tree, we call :\n\n radix_tree_delete()\n radix_tree_delete_item()\n __radix_tree_delete()\n replace_slot()\n\nreplace_slot() first removes the siblings in order from the first to the\nlast, then at then replaces \u0027entry\u0027 with NULL. This means that for a\nbrief period of time we end up with one or more of the siblings removed,\nso:\n\n struct radix_tree_node.slots[] \u003d [entry][NULL][sibling][sibling]\n\nThis causes an issue if you have a reader iterating over the slots in\nthe tree via radix_tree_for_each_slot() while only under\nrcu_read_lock()/rcu_read_unlock() protection. This is a common case in\nmm/filemap.c.\n\nThe issue is that when __radix_tree_next_slot() \u003d\u003e skip_siblings() tries\nto skip over the sibling entries in the slots, it currently does so with\nan exact match on the slot directly preceding our current slot.\nNormally this works:\n\n V preceding slot\n struct radix_tree_node.slots[] \u003d [entry][sibling][sibling][sibling]\n ^ current slot\n\nThis lets you find the first sibling, and you skip them all in order.\n\nBut in the case where one of the siblings is NULL, that slot is skipped\nand then our sibling detection is interrupted:\n\n V preceding slot\n struct radix_tree_node.slots[] \u003d [entry][NULL][sibling][sibling]\n ^ current slot\n\nThis means that the sibling pointers aren\u0027t recognized since they point\nall the way back to \u0027entry\u0027, so we think that they are normal internal\nradix tree pointers. This causes us to think we need to walk down to a\nstruct radix_tree_node starting at the address of \u0027entry\u0027.\n\nIn a real running kernel this will crash the thread with a GP fault when\nyou try and dereference the slots in your broken node starting at\n\u0027entry\u0027.\n\nIn the radix tree test suite this will be caught by the address\nsanitizer:\n\n \u003d\u003d27063\u003d\u003dERROR: AddressSanitizer: heap-buffer-overflow on address\n 0x60c0008ae400 at pc 0x00000040ce4f bp 0x7fa89b8fcad0 sp 0x7fa89b8fcac0\n READ of size 8 at 0x60c0008ae400 thread T3\n #0 0x40ce4e in __radix_tree_next_slot /home/rzwisler/project/linux/tools/testing/radix-tree/radix-tree.c:1660\n #1 0x4022cc in radix_tree_next_slot linux/../../../../include/linux/radix-tree.h:567\n #2 0x4022cc in iterator_func /home/rzwisler/project/linux/tools/testing/radix-tree/multiorder.c:655\n #3 0x7fa8a088d50a in start_thread (/lib64/libpthread.so.0+0x750a)\n #4 0x7fa8a03bd16e in clone (/lib64/libc.so.6+0xf516e)\n\nLink: http://lkml.kernel.org/r/20180503192430.7582-5-ross.zwisler@linux.intel.com\nSigned-off-by: Ross Zwisler \u003cross.zwisler@linux.intel.com\u003e\nCc: Christoph Hellwig \u003chch@lst.de\u003e\nCc: CR, Sapthagirish \u003csapthagirish.cr@intel.com\u003e\nCc: Dan Williams \u003cdan.j.williams@intel.com\u003e\nCc: Dave Chinner \u003cdavid@fromorbit.com\u003e\nCc: Jan Kara \u003cjack@suse.cz\u003e\nCc: Matthew Wilcox \u003cwilly@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "3e252fa7d4f711798e7a3f5ff2d7b62f0e2987ce", "tree": "37f3020acab7655b6db8f04c434e2a7094ac4691", "parents": [ "dcbbf25adb31410c95ce844f80d372ed38b68b24" ], "author": { "name": "Ross Zwisler", "email": "ross.zwisler@linux.intel.com", "time": "Fri May 18 16:08:58 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 17:17:12 2018 -0700" }, "message": "radix tree test suite: add item_delete_rcu()\n\nCurrently the lifetime of \"struct item\" entries in the radix tree are\nnot controlled by RCU, but are instead deleted inline as they are\nremoved from the tree.\n\nIn the following patches we add a test which has threads iterating over\nitems pulled from the tree and verifying them in an\nrcu_read_lock()/rcu_read_unlock() section. This means that though an\nitem has been removed from the tree it could still be being worked on by\nother threads until the RCU grace period expires. So, we need to\nactually free the \"struct item\" structures at the end of the grace\nperiod, just as we do with \"struct radix_tree_node\" items.\n\nLink: http://lkml.kernel.org/r/20180503192430.7582-4-ross.zwisler@linux.intel.com\nSigned-off-by: Ross Zwisler \u003cross.zwisler@linux.intel.com\u003e\nCc: Christoph Hellwig \u003chch@lst.de\u003e\nCc: CR, Sapthagirish \u003csapthagirish.cr@intel.com\u003e\nCc: Dan Williams \u003cdan.j.williams@intel.com\u003e\nCc: Dave Chinner \u003cdavid@fromorbit.com\u003e\nCc: Jan Kara \u003cjack@suse.cz\u003e\nCc: Matthew Wilcox \u003cwilly@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "dcbbf25adb31410c95ce844f80d372ed38b68b24", "tree": "da918c2cc5570327a1ae1fccb4fe7e8e76276e1f", "parents": [ "8d9fa88edd5e360b71765feeadb915d4066c9684" ], "author": { "name": "Ross Zwisler", "email": "ross.zwisler@linux.intel.com", "time": "Fri May 18 16:08:54 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 17:17:12 2018 -0700" }, "message": "radix tree test suite: fix compilation issue\n\nPulled from a patch from Matthew Wilcox entitled \"xarray: Add definition\nof struct xarray\":\n\n\u003e From: Matthew Wilcox \u003cmawilcox@microsoft.com\u003e\n\u003e Signed-off-by: Matthew Wilcox \u003cmawilcox@microsoft.com\u003e\n\n https://patchwork.kernel.org/patch/10341249/\n\nThese defines fix this compilation error:\n\n In file included from ./linux/radix-tree.h:6:0,\n from ./linux/../../../../include/linux/idr.h:15,\n from ./linux/idr.h:1,\n from idr.c:4:\n ./linux/../../../../include/linux/idr.h: In function `idr_init_base\u0027:\n ./linux/../../../../include/linux/radix-tree.h:129:2: warning: implicit declaration of function `spin_lock_init\u0027; did you mean `spinlock_t\u0027? [-Wimplicit-function-declaration]\n spin_lock_init(\u0026(root)-\u003exa_lock); \\\n ^\n ./linux/../../../../include/linux/idr.h:126:2: note: in expansion of macro `INIT_RADIX_TREE\u0027\n INIT_RADIX_TREE(\u0026idr-\u003eidr_rt, IDR_RT_MARKER);\n ^~~~~~~~~~~~~~~\n\nby providing a spin_lock_init() wrapper for the v4.17-rc* version of the\nradix tree test suite.\n\nLink: http://lkml.kernel.org/r/20180503192430.7582-3-ross.zwisler@linux.intel.com\nSigned-off-by: Ross Zwisler \u003cross.zwisler@linux.intel.com\u003e\nCc: Christoph Hellwig \u003chch@lst.de\u003e\nCc: CR, Sapthagirish \u003csapthagirish.cr@intel.com\u003e\nCc: Dan Williams \u003cdan.j.williams@intel.com\u003e\nCc: Dave Chinner \u003cdavid@fromorbit.com\u003e\nCc: Jan Kara \u003cjack@suse.cz\u003e\nCc: Matthew Wilcox \u003cwilly@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "8d9fa88edd5e360b71765feeadb915d4066c9684", "tree": "2c48b7f56ca34fe71b1954903e0ac3eef4c92cf3", "parents": [ "d97baf9470b0668904aa96865abe7db4000dc3ba" ], "author": { "name": "Ross Zwisler", "email": "ross.zwisler@linux.intel.com", "time": "Fri May 18 16:08:51 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 17:17:12 2018 -0700" }, "message": "radix tree test suite: fix mapshift build target\n\nCommit c6ce3e2fe3da (\"radix tree test suite: Add config option for map\nshift\") introduced a phony makefile target called \u0027mapshift\u0027 that ends\nup generating the file generated/map-shift.h. This phony target was\nthen added as a dependency of the top level \u0027targets\u0027 build target,\nwhich is what is run when you go to tools/testing/radix-tree and just\ntype \u0027make\u0027.\n\nUnfortunately, this phony target doesn\u0027t actually work as a dependency,\nso you end up getting:\n\n $ make\n make: *** No rule to make target \u0027generated/map-shift.h\u0027, needed by \u0027main.o\u0027. Stop.\n make: *** Waiting for unfinished jobs....\n\nFix this by making the file generated/map-shift.h our real makefile\ntarget, and add this a dependency of the top level build target.\n\nLink: http://lkml.kernel.org/r/20180503192430.7582-2-ross.zwisler@linux.intel.com\nSigned-off-by: Ross Zwisler \u003cross.zwisler@linux.intel.com\u003e\nCc: Christoph Hellwig \u003chch@lst.de\u003e\nCc: CR, Sapthagirish \u003csapthagirish.cr@intel.com\u003e\nCc: Dan Williams \u003cdan.j.williams@intel.com\u003e\nCc: Dave Chinner \u003cdavid@fromorbit.com\u003e\nCc: Jan Kara \u003cjack@suse.cz\u003e\nCc: Matthew Wilcox \u003cwilly@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "d97baf9470b0668904aa96865abe7db4000dc3ba", "tree": "5e5b57321d40ca296575b35f9bd5064736f7a944", "parents": [ "1e3054b98c5415d5cb5f8824fc33b548ae5644c3" ], "author": { "name": "Souptick Joarder", "email": "jrdr.linux@gmail.com", "time": "Fri May 18 16:08:47 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 17:17:12 2018 -0700" }, "message": "include/linux/mm.h: add new inline function vmf_error()\n\nMany places in drivers/ file systems, error was handled in a common way\nlike below:\n\n\tret \u003d (ret \u003d\u003d -ENOMEM) ? VM_FAULT_OOM : VM_FAULT_SIGBUS;\n\nvmf_error() will replace this and return vm_fault_t type err.\n\nA lot of drivers and filesystems currently have a rather complex mapping\nof errno-to-VM_FAULT code. We have been able to eliminate a lot of it\nby just returning VM_FAULT codes directly from functions which are\ncalled exclusively from the fault handling path.\n\nSome functions can be called both from the fault handler and other\ncontext which are expecting an errno, so they have to continue to return\nan errno. Some users still need to choose different behaviour for\ndifferent errnos, but vmf_error() captures the essential error\ntranslation that\u0027s common to all users, and those that need to handle\nadditional errors can handle them first.\n\nLink: http://lkml.kernel.org/r/20180510174826.GA14268@jordon-HP-15-Notebook-PC\nSigned-off-by: Souptick Joarder \u003cjrdr.linux@gmail.com\u003e\nReviewed-by: Matthew Wilcox \u003cmawilcox@microsoft.com\u003e\nReviewed-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "1e3054b98c5415d5cb5f8824fc33b548ae5644c3", "tree": "7dbee021ba882eb5a101cbb158a196fc5539818b", "parents": [ "2c71d338bef2cc8a2e5f8ebe70788eeff246fcd8" ], "author": { "name": "Matthew Wilcox", "email": "mawilcox@microsoft.com", "time": "Fri May 18 16:08:44 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 17:17:12 2018 -0700" }, "message": "lib/test_bitmap.c: fix bitmap optimisation tests to report errors correctly\n\nI had neglected to increment the error counter when the tests failed,\nwhich made the tests noisy when they fail, but not actually return an\nerror code.\n\nLink: http://lkml.kernel.org/r/20180509114328.9887-1-mpe@ellerman.id.au\nFixes: 3cc78125a081 (\"lib/test_bitmap.c: add optimisation tests\")\nSigned-off-by: Matthew Wilcox \u003cmawilcox@microsoft.com\u003e\nSigned-off-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nReported-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nTested-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nReviewed-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Yury Norov \u003cynorov@caviumnetworks.com\u003e\nCc: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nCc: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[4.13+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "54940fa60ad3728c592f62dadb558165495a6938", "tree": "1f48e6ffbf96d9c95e6211557c53b52a06a717bf", "parents": [ "7fe3fa3b5ec8e75389cce4bf5d052a52e6198d59" ], "author": { "name": "Darren Hart", "email": "dvhart@infradead.org", "time": "Sat May 12 12:10:07 2018 -0700" }, "committer": { "name": "Darren Hart (VMware)", "email": "dvhart@infradead.org", "time": "Fri May 18 15:49:26 2018 -0700" }, "message": "platform/x86: DELL_WMI use depends on instead of select for DELL_SMBIOS\n\nIf DELL_WMI \"select\"s DELL_SMBIOS, the DELL_SMBIOS dependencies are\nignored and it is still possible to end up with unmet direct\ndependencies.\n\nChange the select to a depends on.\n\nTested-by: Randy Dunlap \u003crdunlap@infradead.org\u003e\nSigned-off-by: Darren Hart (VMware) \u003cdvhart@infradead.org\u003e\n" }, { "commit": "d775f26b295a0a303f7a73d7da46e04296484fe7", "tree": "6173edee4d7650284e93c23880791941a399428f", "parents": [ "44a63b137f7b6e4c7bd6c9cc21615941cb36509d" ], "author": { "name": "Rahul Lakkireddy", "email": "rahul.lakkireddy@chelsio.com", "time": "Fri May 18 19:13:37 2018 +0530" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri May 18 13:54:48 2018 -0400" }, "message": "cxgb4: fix offset in collecting TX rate limit info\n\nCorrect the indirect register offsets in collecting TX rate limit info\nin UP CIM logs.\n\nAlso, T5 doesn\u0027t support these indirect register offsets, so remove\nthem from collection logic.\n\nFixes: be6e36d916b1 (\"cxgb4: collect TX rate limit info in UP CIM logs\")\nSigned-off-by: Rahul Lakkireddy \u003crahul.lakkireddy@chelsio.com\u003e\nSigned-off-by: Ganesh Goudar \u003cganeshgr@chelsio.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "44a63b137f7b6e4c7bd6c9cc21615941cb36509d", "tree": "57f47fe6df85c56eee04eb5b369f52476d4deae9", "parents": [ "9709020c86f6bf8439ca3effc58cfca49a5de192" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri May 18 14:51:44 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri May 18 13:52:32 2018 -0400" }, "message": "net: sched: red: avoid hashing NULL child\n\nHangbin reported an Oops triggered by the syzkaller qdisc rules:\n\n kasan: GPF could be caused by NULL-ptr deref or user memory access\n general protection fault: 0000 [#1] SMP KASAN PTI\n Modules linked in: sch_red\n CPU: 0 PID: 28699 Comm: syz-executor5 Not tainted 4.17.0-rc4.kcov #1\n Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n RIP: 0010:qdisc_hash_add+0x26/0xa0\n RSP: 0018:ffff8800589cf470 EFLAGS: 00010203\n RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff824ad971\n RDX: 0000000000000007 RSI: ffffc9000ce9f000 RDI: 000000000000003c\n RBP: 0000000000000001 R08: ffffed000b139ea2 R09: ffff8800589cf4f0\n R10: ffff8800589cf50f R11: ffffed000b139ea2 R12: ffff880054019fc0\n R13: ffff880054019fb4 R14: ffff88005c0af600 R15: ffff880054019fb0\n FS: 00007fa6edcb1700(0000) GS:ffff88005ce00000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000020000740 CR3: 000000000fc16000 CR4: 00000000000006f0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n red_change+0x2d2/0xed0 [sch_red]\n qdisc_create+0x57e/0xef0\n tc_modify_qdisc+0x47f/0x14e0\n rtnetlink_rcv_msg+0x6a8/0x920\n netlink_rcv_skb+0x2a2/0x3c0\n netlink_unicast+0x511/0x740\n netlink_sendmsg+0x825/0xc30\n sock_sendmsg+0xc5/0x100\n ___sys_sendmsg+0x778/0x8e0\n __sys_sendmsg+0xf5/0x1b0\n do_syscall_64+0xbd/0x3b0\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n RIP: 0033:0x450869\n RSP: 002b:00007fa6edcb0c48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\n RAX: ffffffffffffffda RBX: 00007fa6edcb16b4 RCX: 0000000000450869\n RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000013\n RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff\n R13: 0000000000008778 R14: 0000000000702838 R15: 00007fa6edcb1700\n Code: e9 0b fe ff ff 0f 1f 44 00 00 55 53 48 89 fb 89 f5 e8 3f 07 f3 fe 48 8d 7b 3c 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 \u003c0f\u003e b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 51\n RIP: qdisc_hash_add+0x26/0xa0 RSP: ffff8800589cf470\n\nWhen a red qdisc is updated with a 0 limit, the child qdisc is left\nunmodified, no additional scheduler is created in red_change(),\nthe \u0027child\u0027 local variable is rightfully NULL and must not add it\nto the hash table.\n\nThis change addresses the above issue moving qdisc_hash_add() right\nafter the child qdisc creation. It additionally removes unneeded checks\nfor noop_qdisc.\n\nReported-by: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nFixes: 49b499718fa1 (\"net: sched: make default fifo qdiscs appear in the dump\")\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nAcked-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9709020c86f6bf8439ca3effc58cfca49a5de192", "tree": "d3fb43cf4ced60fd69c548e927d750363ee1897b", "parents": [ "b16a960ddbf0d4fd6aaabee42d7ec4c4c3ec836d" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri May 18 04:47:55 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri May 18 13:47:01 2018 -0400" }, "message": "sock_diag: fix use-after-free read in __sk_free\n\nWe must not call sock_diag_has_destroy_listeners(sk) on a socket\nthat has no reference on net structure.\n\nBUG: KASAN: use-after-free in sock_diag_has_destroy_listeners include/linux/sock_diag.h:75 [inline]\nBUG: KASAN: use-after-free in __sk_free+0x329/0x340 net/core/sock.c:1609\nRead of size 8 at addr ffff88018a02e3a0 by task swapper/1/0\n\nCPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.17.0-rc5+ #54\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n \u003cIRQ\u003e\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x1b9/0x294 lib/dump_stack.c:113\n print_address_description+0x6c/0x20b mm/kasan/report.c:256\n kasan_report_error mm/kasan/report.c:354 [inline]\n kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412\n __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433\n sock_diag_has_destroy_listeners include/linux/sock_diag.h:75 [inline]\n __sk_free+0x329/0x340 net/core/sock.c:1609\n sk_free+0x42/0x50 net/core/sock.c:1623\n sock_put include/net/sock.h:1664 [inline]\n reqsk_free include/net/request_sock.h:116 [inline]\n reqsk_put include/net/request_sock.h:124 [inline]\n inet_csk_reqsk_queue_drop_and_put net/ipv4/inet_connection_sock.c:672 [inline]\n reqsk_timer_handler+0xe27/0x10e0 net/ipv4/inet_connection_sock.c:739\n call_timer_fn+0x230/0x940 kernel/time/timer.c:1326\n expire_timers kernel/time/timer.c:1363 [inline]\n __run_timers+0x79e/0xc50 kernel/time/timer.c:1666\n run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692\n __do_softirq+0x2e0/0xaf5 kernel/softirq.c:285\n invoke_softirq kernel/softirq.c:365 [inline]\n irq_exit+0x1d1/0x200 kernel/softirq.c:405\n exiting_irq arch/x86/include/asm/apic.h:525 [inline]\n smp_apic_timer_interrupt+0x17e/0x710 arch/x86/kernel/apic/apic.c:1052\n apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863\n \u003c/IRQ\u003e\nRIP: 0010:native_safe_halt+0x6/0x10 arch/x86/include/asm/irqflags.h:54\nRSP: 0018:ffff8801d9ae7c38 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13\nRAX: dffffc0000000000 RBX: 1ffff1003b35cf8a RCX: 0000000000000000\nRDX: 1ffffffff11a30d0 RSI: 0000000000000001 RDI: ffffffff88d18680\nRBP: ffff8801d9ae7c38 R08: ffffed003b5e46c3 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001\nR13: ffff8801d9ae7cf0 R14: ffffffff897bef20 R15: 0000000000000000\n arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline]\n default_idle+0xc2/0x440 arch/x86/kernel/process.c:354\n arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:345\n default_idle_call+0x6d/0x90 kernel/sched/idle.c:93\n cpuidle_idle_call kernel/sched/idle.c:153 [inline]\n do_idle+0x395/0x560 kernel/sched/idle.c:262\n cpu_startup_entry+0x104/0x120 kernel/sched/idle.c:368\n start_secondary+0x426/0x5b0 arch/x86/kernel/smpboot.c:269\n secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:242\n\nAllocated by task 4557:\n save_stack+0x43/0xd0 mm/kasan/kasan.c:448\n set_track mm/kasan/kasan.c:460 [inline]\n kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553\n kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490\n kmem_cache_alloc+0x12e/0x760 mm/slab.c:3554\n kmem_cache_zalloc include/linux/slab.h:691 [inline]\n net_alloc net/core/net_namespace.c:383 [inline]\n copy_net_ns+0x159/0x4c0 net/core/net_namespace.c:423\n create_new_namespaces+0x69d/0x8f0 kernel/nsproxy.c:107\n unshare_nsproxy_namespaces+0xc3/0x1f0 kernel/nsproxy.c:206\n ksys_unshare+0x708/0xf90 kernel/fork.c:2408\n __do_sys_unshare kernel/fork.c:2476 [inline]\n __se_sys_unshare kernel/fork.c:2474 [inline]\n __x64_sys_unshare+0x31/0x40 kernel/fork.c:2474\n do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\n\nFreed by task 69:\n save_stack+0x43/0xd0 mm/kasan/kasan.c:448\n set_track mm/kasan/kasan.c:460 [inline]\n __kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521\n kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528\n __cache_free mm/slab.c:3498 [inline]\n kmem_cache_free+0x86/0x2d0 mm/slab.c:3756\n net_free net/core/net_namespace.c:399 [inline]\n net_drop_ns.part.14+0x11a/0x130 net/core/net_namespace.c:406\n net_drop_ns net/core/net_namespace.c:405 [inline]\n cleanup_net+0x6a1/0xb20 net/core/net_namespace.c:541\n process_one_work+0xc1e/0x1b50 kernel/workqueue.c:2145\n worker_thread+0x1cc/0x1440 kernel/workqueue.c:2279\n kthread+0x345/0x410 kernel/kthread.c:240\n ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412\n\nThe buggy address belongs to the object at ffff88018a02c140\n which belongs to the cache net_namespace of size 8832\nThe buggy address is located 8800 bytes inside of\n 8832-byte region [ffff88018a02c140, ffff88018a02e3c0)\nThe buggy address belongs to the page:\npage:ffffea0006280b00 count:1 mapcount:0 mapping:ffff88018a02c140 index:0x0 compound_mapcount: 0\nflags: 0x2fffc0000008100(slab|head)\nraw: 02fffc0000008100 ffff88018a02c140 0000000000000000 0000000100000001\nraw: ffffea00062a1320 ffffea0006268020 ffff8801d9bdde40 0000000000000000\npage dumped because: kasan: bad access detected\n\nFixes: b922622ec6ef (\"sock_diag: don\u0027t broadcast kernel sockets\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Craig Gallek \u003ckraig@google.com\u003e\nReported-by: syzbot \u003csyzkaller@googlegroups.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b16a960ddbf0d4fd6aaabee42d7ec4c4c3ec836d", "tree": "8e1c75f9869969f1de96a9ec72aff409dcf7ad41", "parents": [ "5447d78623da2eded06d4cd9469d1a71eba43bc4" ], "author": { "name": "Geert Uytterhoeven", "email": "geert+renesas@glider.be", "time": "Fri May 18 12:52:51 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri May 18 13:45:48 2018 -0400" }, "message": "sh_eth: Change platform check to CONFIG_ARCH_RENESAS\n\nSince commit 9b5ba0df4ea4f940 (\"ARM: shmobile: Introduce ARCH_RENESAS\")\nis CONFIG_ARCH_RENESAS a more appropriate platform check than the legacy\nCONFIG_ARCH_SHMOBILE, hence use the former.\n\nRenesas SuperH SH-Mobile SoCs are still covered by the CONFIG_CPU_SH4\ncheck.\n\nThis will allow to drop ARCH_SHMOBILE on ARM and ARM64 in the near\nfuture.\n\nSigned-off-by: Geert Uytterhoeven \u003cgeert+renesas@glider.be\u003e\nAcked-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nAcked-by: Sergei Shtylyov \u003csergei.shtylyov@cogentembedded.com\u003e\nReviewed-by: Simon Horman \u003chorms+renesas@verge.net.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "2c71d338bef2cc8a2e5f8ebe70788eeff246fcd8", "tree": "27614afca1a4f8b966124ed01586189ab7331889", "parents": [ "d3154821686531964735a17ee0466c832e69d6d5", "c1d2a31397ec51f0370f6bd17b19b39152c263cb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 10:24:03 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 10:24:03 2018 -0700" }, "message": "Merge tag \u0027powerpc-4.17-6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc fixes from Michael Ellerman:\n \"Just three commits.\n\n The two cxl ones are not fixes per se, but they modify code that was\n added this cycle so that it will work with a recent firmware change.\n\n And then a fix for a recent commit that added sleeps in the NVRAM\n code, which needs to be more careful and not sleep if eg. we\u0027re called\n in the panic() path.\n\n Thanks to Nicholas Piggin, Philippe Bergheaud, Christophe Lombard\"\n\n* tag \u0027powerpc-4.17-6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:\n powerpc/powernv: Fix NVRAM sleep in invalid context when crashing\n cxl: Report the tunneled operations status\n cxl: Set the PBCQ Tunnel BAR register when enabling capi mode\n" }, { "commit": "d3154821686531964735a17ee0466c832e69d6d5", "tree": "8e437ace10803631b6d2cc3115f368fbd2f1308a", "parents": [ "477e2c6f34a4c7c6dd9d796420979214c5b4ade7", "7b34c0fb1b51a6377752fc971e57577eeb102d60" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 10:21:03 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 10:21:03 2018 -0700" }, "message": "Merge tag \u0027acpi-4.17-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI fix from Rafael Wysocki:\n \"Fix an ACPICA regression introduced in this cycle and related to the\n handling of package objects loaded by the Load and loadTable AML\n operators that are not initialized properly after recent changes (Bob\n Moore)\"\n\n* tag \u0027acpi-4.17-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n ACPICA: Add deferred package support for the Load and loadTable operators\n" }, { "commit": "477e2c6f34a4c7c6dd9d796420979214c5b4ade7", "tree": "52c5f6d3cc2c447786e7650c8de0a155aef57fa5", "parents": [ "0e273f9edcea9b6893aed90b4ccf8b400dd838ea", "0cf442c6bcf572e04f5690340d5b8e62afcee2ca" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 10:14:42 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 10:14:42 2018 -0700" }, "message": "Merge tag \u0027pm-4.17-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fix from Rafael Wysocki:\n \"Fix Kconfig dependencies of the armada-37xx cpufreq driver (Miquel\n Raynal)\"\n\n* tag \u0027pm-4.17-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n cpufreq: armada-37xx: driver relies on cpufreq-dt\n" }, { "commit": "0e273f9edcea9b6893aed90b4ccf8b400dd838ea", "tree": "6f69c70955d855da8dbbb48b92c8799b5548b003", "parents": [ "61c2ad9a2e223962735b6ff6a5de85f1adcc892b", "c171654caa875919be3c533d3518da8be5be966e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 10:12:30 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 10:12:30 2018 -0700" }, "message": "Merge tag \u0027usb-4.17-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB fixes from Greg KH:\n \"Here are some USB driver fixes fro 4.17-rc6.\n\n They resolve some reported bugs in the musb driver, the xhci driver,\n and a number of small fixes for the usbip driver.\n\n All of these have been in linux-next with no reported issues\"\n\n* tag \u0027usb-4.17-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:\n usbip: usbip_host: fix bad unlock balance during stub_probe()\n usbip: usbip_host: fix NULL-ptr deref and use-after-free errors\n usbip: usbip_host: run rebind from exit when module is removed\n usbip: usbip_host: delete device from busid_table after rebind\n usbip: usbip_host: refine probe and disconnect debug msgs to be useful\n usb: musb: fix remote wakeup racing with suspend\n xhci: Fix USB3 NULL pointer dereference at logical disconnect.\n" }, { "commit": "61c2ad9a2e223962735b6ff6a5de85f1adcc892b", "tree": "fc95c85aabca93f7d2e12ed6e128a586f2977746", "parents": [ "8ccaecd014bcb52cd6651fb8be15dca6e6b9e04f", "1c1a2ee1b53b006754073eefc65d2b2cedb5264b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 10:10:43 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 10:10:43 2018 -0700" }, "message": "Merge tag \u0027for-linus-20180518\u0027 of git://git.kernel.dk/linux-block\n\nPull block fix from Jens Axboe:\n \"Single fix this time, from Coly, fixing a failure case when\n CONFIG_DEBUGFS isn\u0027t enabled\"\n\n* tag \u0027for-linus-20180518\u0027 of git://git.kernel.dk/linux-block:\n bcache: return 0 from bch_debug_init() if CONFIG_DEBUG_FS\u003dn\n" }, { "commit": "8ccaecd014bcb52cd6651fb8be15dca6e6b9e04f", "tree": "53cea8c0d4c42ba056388940bae6a9c61bb84449", "parents": [ "163ced613c37a504f8ed94676fd21c85183d8e8c", "bc519d9574618e47a0c788000fb78da95e18d953" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 10:09:20 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 10:09:20 2018 -0700" }, "message": "Merge tag \u0027spi-fix-v4.17-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"A small collection of fixes accumilated since the merge window, all\n fairly small and driver specific\"\n\n* tag \u0027spi-fix-v4.17-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: bcm2835aux: ensure interrupts are enabled for shared handler\n spi: bcm-qspi: Always read and set BSPI_MAST_N_BOOT_CTRL\n spi: bcm-qspi: Avoid setting MSPI_CDRAM_PCS for spi-nor master\n spi: pxa2xx: Allow 64-bit DMA\n spi: cadence: Add usleep_range() for cdns_spi_fill_tx_fifo()\n spi: sh-msiof: Fix bit field overflow writes to TSCR/RSCR\n spi: imx: Update MODULE_DESCRIPTION to \"SPI Controller driver\"\n" }, { "commit": "163ced613c37a504f8ed94676fd21c85183d8e8c", "tree": "85320d1392100d7d644d1b7d872446746c87884f", "parents": [ "d90eb183e3d1ee82563a5f46db7ddfd73dbfbff9", "9f825e74d761c13b0cfaa5f65344d64ff970e252" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 09:58:29 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 09:58:29 2018 -0700" }, "message": "Merge tag \u0027mtd/fixes-for-4.17-rc6\u0027 of git://git.infradead.org/linux-mtd\n\nPull mtd fixes from Boris Brezillon:\n \"NAND fixes:\n - Fix read path of the Marvell NAND driver\n - Make sure we don\u0027t pass a u64 to ndelay()\n\n CFI fix:\n - Fix the map_word_andequal() implementation\"\n\n* tag \u0027mtd/fixes-for-4.17-rc6\u0027 of git://git.infradead.org/linux-mtd:\n mtd: rawnand: Fix return type of __DIVIDE() when called with 32-bit\n mtd: rawnand: marvell: Fix read logic for layouts with -\u003enchunks \u003e 2\n mtd: Fix comparison in map_word_andequal()\n" }, { "commit": "d90eb183e3d1ee82563a5f46db7ddfd73dbfbff9", "tree": "c06ad4f50429b8503edcfb226a74c4ab7fc47123", "parents": [ "3acf4e395260e3bd30a6fa29ba7eada4bf7566ca", "1827cad96d624ec127853a71cb931c74024e57d6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 09:24:52 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 09:24:52 2018 -0700" }, "message": "Merge tag \u0027drm-fixes-for-v4.17-rc6\u0027 of git://people.freedesktop.org/~airlied/linux\n\nPull drm fixes from Dave Airlie:\n \"Pretty quiet week again: one vmwgfx regression fix, one core buffer\n overflow fix, one vc4 leak fix and three i915 fixes\"\n\n* tag \u0027drm-fixes-for-v4.17-rc6\u0027 of git://people.freedesktop.org/~airlied/linux:\n drm/dumb-buffers: Integer overflow in drm_mode_create_ioctl()\n drm/i915/gen9: Add WaClearHIZ_WM_CHICKEN3 for bxt and glk\n drm/vmwgfx: Set dmabuf_size when vmw_dmabuf_init is successful\n drm/vc4: Fix leak of the file_priv that stored the perfmon.\n drm/i915/execlists: Use rmb() to order CSB reads\n drm/i915/userptr: reject zero user_size\n drm: Match sysfs name in link removal to link creation\n" }, { "commit": "5447d78623da2eded06d4cd9469d1a71eba43bc4", "tree": "9592be73df93dd131eb22ca88355861626549d6a", "parents": [ "6358d49ac23995fdfe157cc8747ab0f274d3954b" ], "author": { "name": "Florian Fainelli", "email": "f.fainelli@gmail.com", "time": "Thu May 17 16:55:39 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri May 18 12:08:25 2018 -0400" }, "message": "net: dsa: Do not register devlink for unused ports\n\nEven if commit 1d27732f411d (\"net: dsa: setup and teardown ports\") indicated\nthat registering a devlink instance for unused ports is not a problem, and this\nis true, this can be confusing nonetheless, so let\u0027s not do it.\n\nFixes: 1d27732f411d (\"net: dsa: setup and teardown ports\")\nReported-by: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Florian Fainelli \u003cf.fainelli@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "6358d49ac23995fdfe157cc8747ab0f274d3954b", "tree": "aae74219e91e2887c81052c17ae60006f10d70e3", "parents": [ "6caf9fb3bda17df59de4ed6ed4950c43ca1361e3" ], "author": { "name": "Amritha Nambiar", "email": "amritha.nambiar@intel.com", "time": "Thu May 17 14:50:44 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri May 18 12:06:22 2018 -0400" }, "message": "net: Fix a bug in removing queues from XPS map\n\nWhile removing queues from the XPS map, the individual CPU ID\nalone was used to index the CPUs map, this should be changed to also\nfactor in the traffic class mapping for the CPU-to-queue lookup.\n\nFixes: 184c449f91fe (\"net: Add support for XPS with QoS via traffic classes\")\nSigned-off-by: Amritha Nambiar \u003camritha.nambiar@intel.com\u003e\nAcked-by: Alexander Duyck \u003calexander.h.duyck@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a45b599ad808c3c982fdcdc12b0b8611c2f92824", "tree": "d040e498b435b3a9b17c7c2569bf1d7993f8dd7f", "parents": [ "a406b0a0693eafc6f6b3a633d25749370bf40d8c" ], "author": { "name": "Alexander Potapenko", "email": "glider@google.com", "time": "Fri May 18 16:23:18 2018 +0200" }, "committer": { "name": "Martin K. Petersen", "email": "martin.petersen@oracle.com", "time": "Fri May 18 10:26:01 2018 -0400" }, "message": "scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()\n\nThis shall help avoid copying uninitialized memory to the userspace when\ncalling ioctl(fd, SG_IO) with an empty command.\n\nReported-by: syzbot+7d26fc1eea198488deab@syzkaller.appspotmail.com\nCc: stable@vger.kernel.org\nSigned-off-by: Alexander Potapenko \u003cglider@google.com\u003e\nAcked-by: Douglas Gilbert \u003cdgilbert@interlog.com\u003e\nReviewed-by: Johannes Thumshirn \u003cjthumshirn@suse.de\u003e\nSigned-off-by: Martin K. Petersen \u003cmartin.petersen@oracle.com\u003e\n" }, { "commit": "8a922814ccfed70d35a725f47c0bf12b50fd223c", "tree": "45f196d1484ad34da62172c8ba2891ab5801d5a1", "parents": [ "01f56832cfb6fcc204e7203f46841b6185ebd574" ], "author": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Fri May 18 16:16:34 2018 +0200" }, "committer": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Fri May 18 16:21:49 2018 +0200" }, "message": "parisc: Move ccio_cujo20_fixup() into init section\n\nccio_cujo20_fixup() is called by dino_probe() only, which is in init\nsection already.\n\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\n" }, { "commit": "01f56832cfb6fcc204e7203f46841b6185ebd574", "tree": "ecff4869736a874e75e557686ab7ad5eb7ed691e", "parents": [ "3faf5246f0cd2c1fe82a2c4ba5ad857fa6941909" ], "author": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Fri May 18 16:12:12 2018 +0200" }, "committer": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Fri May 18 16:21:49 2018 +0200" }, "message": "parisc: Move setup_profiling_timer() out of init section\n\nNo other architecture has setup_profiling_timer() in the init section,\nthus on parisc we face this section mismatch warning:\n Reference from the function devm_device_add_group() to the function .init.text:setup_profiling_timer()\n\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\n" }, { "commit": "3faf5246f0cd2c1fe82a2c4ba5ad857fa6941909", "tree": "63c8df3b09878ecbd124d6ad46742b88cea077dd", "parents": [ "3acf4e395260e3bd30a6fa29ba7eada4bf7566ca" ], "author": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Fri May 18 16:08:10 2018 +0200" }, "committer": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Fri May 18 16:21:48 2018 +0200" }, "message": "parisc: Move find_pa_parent_type() out of init section\n\nThe 0-DAY kernel test infrastructure reported that inet_put_port() may\nreference the find_pa_parent_type() function, so it can\u0027t be moved into the\ninit section.\n\nFixes: b86db40e1ecc (\"parisc: Move various functions and strings to init section\")\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\n" }, { "commit": "240da953fcc6a9008c92fae5b1f727ee5ed167ab", "tree": "7d2220f310b3a8a4a03ecc6c5b39a6571ad3280e", "parents": [ "bc226f07dcd3c9ef0b7f6236fe356ea4a9cb4769" ], "author": { "name": "Konrad Rzeszutek Wilk", "email": "konrad.wilk@oracle.com", "time": "Wed May 16 23:18:09 2018 -0400" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri May 18 11:17:30 2018 +0200" }, "message": "x86/bugs: Rename SSBD_NO to SSB_NO\n\nThe \"336996 Speculative Execution Side Channel Mitigations\" from\nMay defines this as SSB_NO, hence lets sync-up.\n\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n" }, { "commit": "cd33d8803bfa3f5e6e5d7a4bb03fc8cc32c40fb6", "tree": "d9d37c3dd42bc28bc4855b87e76d207b43a3d22c", "parents": [ "3febfc8a219a036633b57a34c6678e21b6a0580d" ], "author": { "name": "Sebastian Andrzej Siewior", "email": "bigeasy@linutronix.de", "time": "Tue May 15 18:53:28 2018 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri May 18 09:05:28 2018 +0200" }, "message": "sched/fair: Fix documentation file path\n\nThe \u0027tip\u0027 prefix probably referred to the -tip tree and is not required,\nremove it.\n\nSigned-off-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nAcked-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Paul Turner \u003cpjt@google.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nLink: http://lkml.kernel.org/r/20180515165328.24899-1-bigeasy@linutronix.de\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "3febfc8a219a036633b57a34c6678e21b6a0580d", "tree": "0b4492b6a2e51ab037c9731fb81fcd2e87b601f3", "parents": [ "f6a3463063f42d9fb2c78f386437a822e0ad1792" ], "author": { "name": "Mathieu Malaterre", "email": "malat@debian.org", "time": "Wed May 16 22:09:02 2018 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri May 18 09:05:22 2018 +0200" }, "message": "sched/deadline: Make the grub_reclaim() function static\n\nSince the grub_reclaim() function can be made static, make it so.\n\nSilences the following GCC warning (W\u003d1):\n\n kernel/sched/deadline.c:1120:5: warning: no previous prototype for ‘grub_reclaim’ [-Wmissing-prototypes]\n\nSigned-off-by: Mathieu Malaterre \u003cmalat@debian.org\u003e\nAcked-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nLink: http://lkml.kernel.org/r/20180516200902.959-1-malat@debian.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "f6a3463063f42d9fb2c78f386437a822e0ad1792", "tree": "284a5c7d817cf6d75b6c11fb7391663f997fa856", "parents": [ "3acf4e395260e3bd30a6fa29ba7eada4bf7566ca" ], "author": { "name": "Mathieu Malaterre", "email": "malat@debian.org", "time": "Wed May 16 21:53:47 2018 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri May 18 09:05:14 2018 +0200" }, "message": "sched/debug: Move the print_rt_rq() and print_dl_rq() declarations to kernel/sched/sched.h\n\nIn the following commit:\n\n 6b55c9654fcc (\"sched/debug: Move print_cfs_rq() declaration to kernel/sched/sched.h\")\n\nthe print_cfs_rq() prototype was added to \u003ckernel/sched/sched.h\u003e,\nright next to the prototypes for print_cfs_stats(), print_rt_stats()\nand print_dl_stats().\n\nFinish this previous commit and also move related prototypes for\nprint_rt_rq() and print_dl_rq().\n\nRemove existing extern declarations now that they not needed anymore.\n\nSilences the following GCC warning, triggered by W\u003d1:\n\n kernel/sched/debug.c:573:6: warning: no previous prototype for ‘print_rt_rq’ [-Wmissing-prototypes]\n kernel/sched/debug.c:603:6: warning: no previous prototype for ‘print_dl_rq’ [-Wmissing-prototypes]\n\nSigned-off-by: Mathieu Malaterre \u003cmalat@debian.org\u003e\nAcked-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Srikar Dronamraju \u003csrikar@linux.vnet.ibm.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nLink: http://lkml.kernel.org/r/20180516195348.30426-1-malat@debian.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "6caf9fb3bda17df59de4ed6ed4950c43ca1361e3", "tree": "f8a69e825b9e240972566dbd8e5af0ec49d9dae9", "parents": [ "113f99c3358564a0647d444c2ae34e8b1abfd5b9", "050fad7c4534c13c8eb1d9c2ba66012e014773cb" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu May 17 23:33:52 2018 -0400" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu May 17 23:33:52 2018 -0400" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nDaniel Borkmann says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: bpf 2018-05-18\n\nThe following pull-request contains BPF updates for your *net* tree.\n\nThe main changes are:\n\n1) Fix two bugs in sockmap, a use after free in sockmap\u0027s error path\n from sock_map_ctx_update_elem() where we mistakenly drop a reference\n we didn\u0027t take prior to that, and in the same function fix a race\n in bpf_prog_inc_not_zero() where we didn\u0027t use the progs from prior\n READ_ONCE(), from John.\n\n2) Reject program expansions once we figure out that their jump target\n which crosses patchlet boundaries could otherwise get truncated in\n insn-\u003eoff space, from Daniel.\n\n3) Check the return value of fopen() in BPF selftest\u0027s test_verifier\n where we determine whether unpriv BPF is disabled, and iff we do\n fail there then just assume it is disabled. This fixes a segfault\n when used with older kernels, from Jesper.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "1827cad96d624ec127853a71cb931c74024e57d6", "tree": "51fae2bc006a675db181412b90e45af851d62f5b", "parents": [ "bc91d1810f70ed0b31df1c5ac879c43e35b9e330", "b579f924a90f42fa561afd8201514fc216b71949" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 18 12:01:49 2018 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 18 12:01:49 2018 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2018-05-17\u0027 of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes\n\n- Userptr IOCTL zero size check (Matt)\n- Two hardware quirk fixes (Michel \u0026 Chris)\n\n* tag \u0027drm-intel-fixes-2018-05-17\u0027 of git://anongit.freedesktop.org/drm/drm-intel:\n drm/i915/gen9: Add WaClearHIZ_WM_CHICKEN3 for bxt and glk\n drm/i915/execlists: Use rmb() to order CSB reads\n drm/i915/userptr: reject zero user_size\n" }, { "commit": "050fad7c4534c13c8eb1d9c2ba66012e014773cb", "tree": "2a5273ddd08ba61ab57f12d6a3d4702fca8c0bf3", "parents": [ "9617456054a6160f5e11e892b713fade78aea2e9" ], "author": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Thu May 17 01:44:11 2018 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu May 17 16:05:35 2018 -0700" }, "message": "bpf: fix truncated jump targets on heavy expansions\n\nRecently during testing, I ran into the following panic:\n\n [ 207.892422] Internal error: Accessing user space memory outside uaccess.h routines: 96000004 [#1] SMP\n [ 207.901637] Modules linked in: binfmt_misc [...]\n [ 207.966530] CPU: 45 PID: 2256 Comm: test_verifier Tainted: G W 4.17.0-rc3+ #7\n [ 207.974956] Hardware name: FOXCONN R2-1221R-A4/C2U4N_MB, BIOS G31FB18A 03/31/2017\n [ 207.982428] pstate: 60400005 (nZCv daif +PAN -UAO)\n [ 207.987214] pc : bpf_skb_load_helper_8_no_cache+0x34/0xc0\n [ 207.992603] lr : 0xffff000000bdb754\n [ 207.996080] sp : ffff000013703ca0\n [ 207.999384] x29: ffff000013703ca0 x28: 0000000000000001\n [ 208.004688] x27: 0000000000000001 x26: 0000000000000000\n [ 208.009992] x25: ffff000013703ce0 x24: ffff800fb4afcb00\n [ 208.015295] x23: ffff00007d2f5038 x22: ffff00007d2f5000\n [ 208.020599] x21: fffffffffeff2a6f x20: 000000000000000a\n [ 208.025903] x19: ffff000009578000 x18: 0000000000000a03\n [ 208.031206] x17: 0000000000000000 x16: 0000000000000000\n [ 208.036510] x15: 0000ffff9de83000 x14: 0000000000000000\n [ 208.041813] x13: 0000000000000000 x12: 0000000000000000\n [ 208.047116] x11: 0000000000000001 x10: ffff0000089e7f18\n [ 208.052419] x9 : fffffffffeff2a6f x8 : 0000000000000000\n [ 208.057723] x7 : 000000000000000a x6 : 00280c6160000000\n [ 208.063026] x5 : 0000000000000018 x4 : 0000000000007db6\n [ 208.068329] x3 : 000000000008647a x2 : 19868179b1484500\n [ 208.073632] x1 : 0000000000000000 x0 : ffff000009578c08\n [ 208.078938] Process test_verifier (pid: 2256, stack limit \u003d 0x0000000049ca7974)\n [ 208.086235] Call trace:\n [ 208.088672] bpf_skb_load_helper_8_no_cache+0x34/0xc0\n [ 208.093713] 0xffff000000bdb754\n [ 208.096845] bpf_test_run+0x78/0xf8\n [ 208.100324] bpf_prog_test_run_skb+0x148/0x230\n [ 208.104758] sys_bpf+0x314/0x1198\n [ 208.108064] el0_svc_naked+0x30/0x34\n [ 208.111632] Code: 91302260 f9400001 f9001fa1 d2800001 (29500680)\n [ 208.117717] ---[ end trace 263cb8a59b5bf29f ]---\n\nThe program itself which caused this had a long jump over the whole\ninstruction sequence where all of the inner instructions required\nheavy expansions into multiple BPF instructions. Additionally, I also\nhad BPF hardening enabled which requires once more rewrites of all\nconstant values in order to blind them. Each time we rewrite insns,\nbpf_adj_branches() would need to potentially adjust branch targets\nwhich cross the patchlet boundary to accommodate for the additional\ndelta. Eventually that lead to the case where the target offset could\nnot fit into insn-\u003eoff\u0027s upper 0x7fff limit anymore where then offset\nwraps around becoming negative (in s16 universe), or vice versa\ndepending on the jump direction.\n\nTherefore it becomes necessary to detect and reject any such occasions\nin a generic way for native eBPF and cBPF to eBPF migrations. For\nthe latter we can simply check bounds in the bpf_convert_filter()\u0027s\nBPF_EMIT_JMP helper macro and bail out once we surpass limits. The\nbpf_patch_insn_single() for native eBPF (and cBPF to eBPF in case\nof subsequent hardening) is a bit more complex in that we need to\ndetect such truncations before hitting the bpf_prog_realloc(). Thus\nthe latter is split into an extra pass to probe problematic offsets\non the original program in order to fail early. With that in place\nand carefully tested I no longer hit the panic and the rewrites are\nrejected properly. The above example panic I\u0027ve seen on bpf-next,\nthough the issue itself is generic in that a guard against this issue\nin bpf seems more appropriate in this case.\n\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nAcked-by: Martin KaFai Lau \u003ckafai@fb.com\u003e\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "3acf4e395260e3bd30a6fa29ba7eada4bf7566ca", "tree": "1b8e3641d63895bf8f4aa67a69f8009684f66179", "parents": [ "58ddfe6c3af91d320cf5d0aba33143e7c1d8dc35", "3b031622f598481970400519bd5abc2a16708282" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 17 15:58:12 2018 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 17 15:58:12 2018 -0700" }, "message": "Merge tag \u0027hwmon-for-linus-v4.17-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n \"Two k10temp fixes:\n\n - fix race condition when accessing System Management Network\n registers\n\n - fix reading critical temperatures on F15h M60h and M70h\n\n Also add PCI ID\u0027s for the AMD Raven Ridge root bridge\"\n\n* tag \u0027hwmon-for-linus-v4.17-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n hwmon: (k10temp) Use API function to access System Management Network\n x86/amd_nb: Add support for Raven Ridge CPUs\n hwmon: (k10temp) Fix reading critical temperature register\n" }, { "commit": "9617456054a6160f5e11e892b713fade78aea2e9", "tree": "4ffb5e9bb6704ddbd7b609cc878e096770c831c0", "parents": [ "a593f70831b68740fb7db69e0556ca72dac8c7a8" ], "author": { "name": "John Fastabend", "email": "john.fastabend@gmail.com", "time": "Thu May 17 14:06:40 2018 -0700" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Fri May 18 00:27:37 2018 +0200" }, "message": "bpf: parse and verdict prog attach may race with bpf map update\n\nIn the sockmap design BPF programs (SK_SKB_STREAM_PARSER,\nSK_SKB_STREAM_VERDICT and SK_MSG_VERDICT) are attached to the sockmap\nmap type and when a sock is added to the map the programs are used by\nthe socket. However, sockmap updates from both userspace and BPF\nprograms can happen concurrently with the attach and detach of these\nprograms.\n\nTo resolve this we use the bpf_prog_inc_not_zero and a READ_ONCE()\nprimitive to ensure the program pointer is not refeched and\npossibly NULL\u0027d before the refcnt increment. This happens inside\na RCU critical section so although the pointer reference in the map\nobject may be NULL (by a concurrent detach operation) the reference\nfrom READ_ONCE will not be free\u0027d until after grace period. This\nensures the object returned by READ_ONCE() is valid through the\nRCU criticl section and safe to use as long as we \"know\" it may\nbe free\u0027d shortly.\n\nDaniel spotted a case in the sock update API where instead of using\nthe READ_ONCE() program reference we used the pointer from the\noriginal map, stab-\u003ebpf_{verdict|parse|txmsg}. The problem with this\nis the logic checks the object returned from the READ_ONCE() is not\nNULL and then tries to reference the object again but using the\nabove map pointer, which may have already been NULL\u0027d by a parallel\ndetach operation. If this happened bpf_porg_inc_not_zero could\ndereference a NULL pointer.\n\nFix this by using variable returned by READ_ONCE() that is checked\nfor NULL.\n\nFixes: 2f857d04601a (\"bpf: sockmap, remove STRPARSER map_flags and add multi-map support\")\nReported-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nSigned-off-by: John Fastabend \u003cjohn.fastabend@gmail.com\u003e\nAcked-by: Martin KaFai Lau \u003ckafai@fb.com\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\n" }, { "commit": "a593f70831b68740fb7db69e0556ca72dac8c7a8", "tree": "1e5780ac1e66e6cb26d999fe70a9e0980e793d66", "parents": [ "deea81228ba1c6e77722f534a3d63c50e1757877" ], "author": { "name": "John Fastabend", "email": "john.fastabend@gmail.com", "time": "Thu May 17 14:06:35 2018 -0700" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Fri May 18 00:27:37 2018 +0200" }, "message": "bpf: sockmap update rollback on error can incorrectly dec prog refcnt\n\nIf the user were to only attach one of the parse or verdict programs\nthen it is possible a subsequent sockmap update could incorrectly\ndecrement the refcnt on the program. This happens because in the\nrollback logic, after an error, we have to decrement the program\nreference count when its been incremented. However, we only increment\nthe program reference count if the user has both a verdict and a\nparse program. The reason for this is because, at least at the\nmoment, both are required for any one to be meaningful. The problem\nfixed here is in the rollback path we decrement the program refcnt\neven if only one existing. But we never incremented the refcnt in\nthe first place creating an imbalance.\n\nThis patch fixes the error path to handle this case.\n\nFixes: 2f857d04601a (\"bpf: sockmap, remove STRPARSER map_flags and add multi-map support\")\nReported-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nSigned-off-by: John Fastabend \u003cjohn.fastabend@gmail.com\u003e\nAcked-by: Martin KaFai Lau \u003ckafai@fb.com\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\n" }, { "commit": "113f99c3358564a0647d444c2ae34e8b1abfd5b9", "tree": "9f8a2ef799de5be76bb83fb73524b2575a5759af", "parents": [ "374edea4aaedb92964d35f68318c094b6d5c0f63" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Thu May 17 13:13:29 2018 -0400" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu May 17 17:05:01 2018 -0400" }, "message": "net: test tailroom before appending to linear skb\n\nDevice features may change during transmission. In particular with\ncorking, a device may toggle scatter-gather in between allocating\nand writing to an skb.\n\nDo not unconditionally assume that !NETIF_F_SG at write time implies\nthat the same held at alloc time and thus the skb has sufficient\ntailroom.\n\nThis issue predates git history.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "374edea4aaedb92964d35f68318c094b6d5c0f63", "tree": "69b5c67423f30b1a6dccb2c152a15fec0195d19b", "parents": [ "02f99df1875c11330cd0be69a40fa8ccd14749b2", "2d665034f239412927b1e71329f20f001c92da09" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu May 17 16:50:20 2018 -0400" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu May 17 16:50:20 2018 -0400" }, "message": "Merge branch \u0027ip6_gre-Fixes-in-headroom-handling\u0027\n\nPetr Machata says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: ip6_gre: Fixes in headroom handling\n\nThis series mends some problems in headroom management in ip6_gre\nmodule. The current code base has the following three closely-related\nproblems:\n\n- ip6gretap tunnels neglect to ensure there\u0027s enough writable headroom\n before pushing GRE headers.\n\n- ip6erspan does this, but assumes that dev-\u003eneeded_headroom is primed.\n But that doesn\u0027t happen until ip6_tnl_xmit() is called later. Thus for\n the first packet, ip6erspan actually behaves like ip6gretap above.\n\n- ip6erspan shares some of the code with ip6gretap, including\n calculations of needed header length. While there is custom\n ERSPAN-specific code for calculating the headroom, the computed\n values are overwritten by the ip6gretap code.\n\nThe first two issues lead to a kernel panic in situations where a packet\nis mirrored from a veth device to the device in question. They are\nfixed, respectively, in patches #1 and #2, which include the full panic\ntrace and a reproducer.\n\nThe rest of the patchset deals with the last issue. In patches #3 to #6,\nseveral functions are split up into reusable parts. Finally in patch #7\nthese blocks are used to compose ERSPAN-specific callbacks where\nnecessary to fix the hlen calculation.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "2d665034f239412927b1e71329f20f001c92da09", "tree": "69b5c67423f30b1a6dccb2c152a15fec0195d19b", "parents": [ "c8632fc30bb03aa0c3bd7bcce85355a10feb8149" ], "author": { "name": "Petr Machata", "email": "petrm@mellanox.com", "time": "Thu May 17 16:36:51 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu May 17 16:50:06 2018 -0400" }, "message": "net: ip6_gre: Fix ip6erspan hlen calculation\n\nEven though ip6erspan_tap_init() sets up hlen and tun_hlen according to\nwhat ERSPAN needs, it goes ahead to call ip6gre_tnl_link_config() which\noverwrites these settings with GRE-specific ones.\n\nSimilarly for changelink callbacks, which are handled by\nip6gre_changelink() calls ip6gre_tnl_change() calls\nip6gre_tnl_link_config() as well.\n\nThe difference ends up being 12 vs. 20 bytes, and this is generally not\na problem, because a 12-byte request likely ends up allocating more and\nthe extra 8 bytes are thus available. However correct it is not.\n\nSo replace the newlink and changelink callbacks with an ERSPAN-specific\nones, reusing the newly-introduced _common() functions.\n\nFixes: 5a963eb61b7c (\"ip6_gre: Add ERSPAN native tunnel support\")\nSigned-off-by: Petr Machata \u003cpetrm@mellanox.com\u003e\nAcked-by: William Tu \u003cu9012063@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" } ], "next": "c8632fc30bb03aa0c3bd7bcce85355a10feb8149" }