aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2017-08-23cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup()Ronnie Sahlberg1-6/+12
Add checking for the path component length and verify it is <= the maximum that the server advertizes via FileFsAttributeInformation. With this patch cifs.ko will now return ENAMETOOLONG instead of ENOENT when users to access an overlong path. To test this, try to cd into a (non-existing) directory on a CIFS share that has a too long name: cd /mnt/aaaaaaaaaaaaaaa... and it now should show a good error message from the shell: bash: cd: /mnt/aaaaaaaaaaaaaaaa...aaaaaa: File name too long rh bz 1153996 Signed-off-by: Ronnie Sahlberg <[email protected]> Signed-off-by: Steve French <[email protected]> Cc: <[email protected]>
2017-08-23Merge tag 'scsi-fixes' of ↵Linus Torvalds11-13/+47
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Six minor and error leg fixes, plus one major change: the reversion of scsi-mq as the default. We're doing the latter temporarily (with a backport to stable) to give us time to fix all the issues that turned up with this default before trying again" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: cxgb4i: call neigh_event_send() to update MAC address Revert "scsi: default to scsi-mq" scsi: sd_zbc: Write unlock zone from sd_uninit_cmnd() scsi: aacraid: Fix out of bounds in aac_get_name_resp scsi: csiostor: fail probe if fw does not support FCoE scsi: megaraid_sas: fix error handle in megasas_probe_one
2017-08-23cifs: Fix df output for users with quota limitsSachin Prabhu1-2/+2
The df for a SMB2 share triggers a GetInfo call for FS_FULL_SIZE_INFORMATION. The values returned are used to populate struct statfs. The problem is that none of the information returned by the call contains the total blocks available on the filesystem. Instead we use the blocks available to the user ie. quota limitation when filling out statfs.f_blocks. The information returned does contain Actual free units on the filesystem and is used to populate statfs.f_bfree. For users with quota enabled, it can lead to situations where the total free space reported is more than the total blocks on the system ending up with df reports like the following # df -h /mnt/a Filesystem Size Used Avail Use% Mounted on //192.168.22.10/a 2.5G -2.3G 2.5G - /mnt/a To fix this problem, we instead populate both statfs.f_bfree with the same value as statfs.f_bavail ie. CallerAvailableAllocationUnits. This is similar to what is done already in the code for cifs and df now reports the quota information for the user used to mount the share. # df --si /mnt/a Filesystem Size Used Avail Use% Mounted on //192.168.22.10/a 2.7G 101M 2.6G 4% /mnt/a Signed-off-by: Sachin Prabhu <[email protected]> Signed-off-by: Pierguido Lambri <[email protected]> Signed-off-by: Steve French <[email protected]> Cc: <[email protected]>
2017-08-23ARM: at91: don't select CONFIG_ARM_CPU_SUSPEND for old platformsArnd Bergmann2-1/+13
My previous patch fixed a link error for all at91 platforms when CONFIG_ARM_CPU_SUSPEND was not set, however this caused another problem on a configuration that enabled CONFIG_ARCH_AT91 but none of the individual SoCs, and that also enabled CPU_ARM720 as the only CPU: warning: (ARCH_AT91 && SOC_IMX23 && SOC_IMX28 && ARCH_PXA && MACH_MVEBU_V7 && SOC_IMX6 && ARCH_OMAP3 && ARCH_OMAP4 && SOC_OMAP5 && SOC_AM33XX && SOC_DRA7XX && ARCH_EXYNOS3 && ARCH_EXYNOS4 && EXYNOS5420_MCPM && EXYNOS_CPU_SUSPEND && ARCH_VEXPRESS_TC2_PM && ARM_BIG_LITTLE_CPUIDLE && ARM_HIGHBANK_CPUIDLE && QCOM_PM) selects ARM_CPU_SUSPEND which has unmet direct dependencies (ARCH_SUSPEND_POSSIBLE) arch/arm/kernel/sleep.o: In function `cpu_resume': (.text+0xf0): undefined reference to `cpu_arm720_suspend_size' arch/arm/kernel/suspend.o: In function `__cpu_suspend_save': suspend.c:(.text+0x134): undefined reference to `cpu_arm720_do_suspend' This improves the hack some more by only selecting ARM_CPU_SUSPEND for the part that requires it, and changing pm.c to drop the contents of unused init functions so we no longer refer to cpu_resume on at91 platforms that don't need it. Fixes: cc7a938f5f30 ("ARM: at91: select CONFIG_ARM_CPU_SUSPEND") Acked-by: Alexandre Belloni <[email protected]> Signed-off-by: Arnd Bergmann <[email protected]>
2017-08-23Merge tag 'gvt-fixes-2017-08-23' of https://github.com/01org/gvt-linux into ↵Jani Nikula1-1/+1
drm-intel-fixes gvt-fixes-2017-08-23 - Fix possible null ptr reference in error path (Fred) Signed-off-by: Jani Nikula <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2017-08-23ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978)Takashi Iwai1-0/+1
Lenovo G50-70 (17aa:3978) with Conexant codec chip requires the similar workaround for the inverted stereo dmic like other Lenovo models. Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1020657 Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2017-08-23drm/i915/gvt: Fix the kernel null pointer errorfred gao1-1/+1
once error happens in shadow_indirect_ctx function, the variable wa_ctx->indirect_ctx.obj is not initialized but accessed, so the kernel null point panic occurs. Fixes: 894cf7d15634 ("drm/i915/gvt: i915_gem_object_create() returns an error pointer") Cc: [email protected] # v4.8+ Signed-off-by: fred gao <[email protected]> Signed-off-by: Zhenyu Wang <[email protected]>
2017-08-22Merge tag 'ext4_for_linus_stable' of ↵Linus Torvalds2-4/+9
git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Fix a clang build regression and an potential xattr corruption bug" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: add missing xattr hash update ext4: fix clang build regression
2017-08-22ANDROID: binder: fix proc->tsk check.Martijn Coenen1-1/+1
Commit c4ea41ba195d ("binder: use group leader instead of open thread")' was incomplete and didn't update a check in binder_mmap(), causing all mmap() calls into the binder driver to fail. Signed-off-by: Martijn Coenen <[email protected]> Tested-by: John Stultz <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2017-08-22ACPI: device property: Fix node lookup in acpi_graph_get_child_prop_value()Sakari Ailus1-1/+1
acpi_graph_get_child_prop_value() is intended to find a child node with a certain property value pair. The check if (!fwnode_property_read_u32(fwnode, prop_name, &nr)) continue; is faulty: fwnode_property_read_u32() returns zero on success, not on failure, leading to comparing values only if the searched property was not found. Moreover, the check is made against the parent device node instead of the child one as it should be. Fixes: 79389a83bc38 (ACPI / property: Add support for remote endpoints) Reported-by: Hyungwoo Yang <[email protected]> Signed-off-by: Sakari Ailus <[email protected]> Cc: 4.12+ <[email protected]> # 4.12+ [ rjw: Changelog ] Signed-off-by: Rafael J. Wysocki <[email protected]>
2017-08-22ACPICA: Fix acpi_evaluate_object_typed()Rafael J. Wysocki1-3/+7
Commit 2d2a954375a0 (ACPICA: Update two error messages to emit control method name) causes acpi_evaluate_object_typed() to fail if its pathname argument is NULL, but some callers of that function in the kernel, particularly acpi_nondev_subnode_data_ok(), pass NULL as pathname to it and expect it to work. For this reason, make acpi_evaluate_object_typed() check if its pathname argument is NULL and fall back to using the pathname of its handle argument if that is the case. Reported-by: Sakari Ailus <[email protected]> Tested-by: Yang, Hyungwoo <[email protected]> Fixes: 2d2a954375a0 (ACPICA: Update two error messages to emit control method name) Signed-off-by: Rafael J. Wysocki <[email protected]>
2017-08-22RDMA/uverbs: Initialize cq_context appropriatelyBharat Potnuri1-1/+1
Initializing cq_context with ev_queue in create_cq(), leads to NULL pointer dereference in ib_uverbs_comp_handler(), if application doesnot use completion channel. This patch fixes the cq_context initialization. Fixes: 1e7710f3f65 ("IB/core: Change completion channel to use the reworked") Cc: [email protected] # 4.12 Signed-off-by: Potnuri Bharat Teja <[email protected]> Reviewed-by: Matan Barak <[email protected]> Signed-off-by: Doug Ledford <[email protected]> (cherry picked from commit 699a2d5b1b880b4e4e1c7d55fa25659322cf5b51)
2017-08-22Merge tag 'mfd-fixes-4.13' of ↵Linus Torvalds1-0/+6
git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD fix from Lee Jones: "Revert duplicate commit in da9062-core" * tag 'mfd-fixes-4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: Revert "mfd: da9061: Fix to remove BBAT_CONT register from chip model"
2017-08-22arm64: kaslr: Adjust the offset to avoid Image across alignment boundaryCatalin Marinas1-7/+3
With 16KB pages and a kernel Image larger than 16MB, the current kaslr_early_init() logic for avoiding mappings across swapper table boundaries fails since increasing the offset by kimg_sz just moves the problem to the next boundary. This patch rounds the offset down to (1 << SWAPPER_TABLE_SHIFT) if the Image crosses a PMD_SIZE boundary. Fixes: afd0e5a87670 ("arm64: kaslr: Fix up the kernel image alignment") Cc: Ard Biesheuvel <[email protected]> Cc: Mark Rutland <[email protected]> Cc: Will Deacon <[email protected]> Cc: Neeraj Upadhyay <[email protected]> Signed-off-by: Catalin Marinas <[email protected]> Signed-off-by: Will Deacon <[email protected]>
2017-08-22arm64: kaslr: ignore modulo offset when validating virtual displacementArd Biesheuvel2-4/+9
In the KASLR setup routine, we ensure that the early virtual mapping of the kernel image does not cover more than a single table entry at the level above the swapper block level, so that the assembler routines involved in setting up this mapping can remain simple. In this calculation we add the proposed KASLR offset to the values of the _text and _end markers, and reject it if they would end up falling in different swapper table sized windows. However, when taking the addresses of _text and _end, the modulo offset (the physical displacement modulo 2 MB) is already accounted for, and so adding it again results in incorrect results. So disregard the modulo offset from the calculation. Fixes: 08cdac619c81 ("arm64: relocatable: deal with physically misaligned ...") Reviewed-by: Catalin Marinas <[email protected]> Tested-by: Catalin Marinas <[email protected]> Signed-off-by: Ard Biesheuvel <[email protected]> Signed-off-by: Will Deacon <[email protected]>
2017-08-22arm64: mm: abort uaccess retries upon fatal signalMark Rutland1-1/+4
When there's a fatal signal pending, arm64's do_page_fault() implementation returns 0. The intent is that we'll return to the faulting userspace instruction, delivering the signal on the way. However, if we take a fatal signal during fixing up a uaccess, this results in a return to the faulting kernel instruction, which will be instantly retried, resulting in the same fault being taken forever. As the task never reaches userspace, the signal is not delivered, and the task is left unkillable. While the task is stuck in this state, it can inhibit the forward progress of the system. To avoid this, we must ensure that when a fatal signal is pending, we apply any necessary fixup for a faulting kernel instruction. Thus we will return to an error path, and it is up to that code to make forward progress towards delivering the fatal signal. Cc: Catalin Marinas <[email protected]> Cc: Laura Abbott <[email protected]> Cc: [email protected] Reviewed-by: Steve Capper <[email protected]> Tested-by: Steve Capper <[email protected]> Reviewed-by: James Morse <[email protected]> Tested-by: James Morse <[email protected]> Signed-off-by: Mark Rutland <[email protected]> Signed-off-by: Will Deacon <[email protected]>
2017-08-22arm64: fpsimd: Prevent registers leaking across execDave Martin1-0/+2
There are some tricky dependencies between the different stages of flushing the FPSIMD register state during exec, and these can race with context switch in ways that can cause the old task's regs to leak across. In particular, a context switch during the memset() can cause some of the task's old FPSIMD registers to reappear. Disabling preemption for this small window would be no big deal for performance: preemption is already disabled for similar scenarios like updating the FPSIMD registers in sigreturn. So, instead of rearranging things in ways that might swap existing subtle bugs for new ones, this patch just disables preemption around the FPSIMD state flushing so that races of this type can't occur here. This brings fpsimd_flush_thread() into line with other code paths. Cc: [email protected] Fixes: 674c242c9323 ("arm64: flush FP/SIMD state correctly after execve()") Reviewed-by: Ard Biesheuvel <[email protected]> Signed-off-by: Dave Martin <[email protected]> Signed-off-by: Will Deacon <[email protected]>
2017-08-22perf tools: Fix static linking with libunwindKonstantin Khlebnikov1-1/+5
* libunwind-x86_64 must be linked before libunwind * libunwind requires liblzma * static libunwind conflicts with static libgcc_eh Signed-off-by: Konstantin Khlebnikov <[email protected]> Cc: Alexander Shishkin <[email protected]> Cc: Peter Zijlstra <[email protected]> Link: http://lkml.kernel.org/r/150322917247.129799.14247751517961953155.stgit@buzz Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
2017-08-22perf tools: Fix static linking with libdw from elfutilsKonstantin Khlebnikov1-5/+5
Fix feature test for static libdw: link required dependencies. Backends of libebl are not statically linked thus libdl is required. In Debian/Ubuntu libdw-dev includes libebl.a starting from 0.166-1. Signed-off-by: Konstantin Khlebnikov <[email protected]> Cc: Alexander Shishkin <[email protected]> Cc: Peter Zijlstra <[email protected]> Link: http://lkml.kernel.org/r/150322916720.129772.7959925864494283854.stgit@buzz Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
2017-08-22perf: Fix documentation for sysctls perf_event_paranoid and perf_event_mlock_kbKonstantin Khlebnikov2-2/+15
Fix misprint CAP_IOC_LOCK -> CAP_IPC_LOCK. This capability have nothing to do with raw tracepoints. This part is about bypassing mlock limits. Sysctl kernel.perf_event_paranoid = -1 allows raw and ftrace function tracepoints without CAP_SYS_ADMIN. Signed-off-by: Konstantin Khlebnikov <[email protected]> Cc: Alexander Shishkin <[email protected]> Cc: Peter Zijlstra <[email protected]> Link: http://lkml.kernel.org/r/150322916080.129746.11285255474738558340.stgit@buzz Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
2017-08-22perf tools: Really install manpages via 'make install-man'Konstantin Khlebnikov1-1/+1
Target install-man builds them but forget to install. Signed-off-by: Konstantin Khlebnikov <[email protected]> Cc: Alexander Shishkin <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Peter Zijlstra <[email protected]> Fixes: af3df2cf17f5 ("perf tools: Try to build Documentation when installing") Link: http://lkml.kernel.org/r/150322915300.129715.13645857235229756834.stgit@buzz Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
2017-08-22perf test: Add test cases for new data source encodingAndi Kleen4-0/+62
Add some simple tests to perf test to test data source printing. v2: Make the tests actually checked for the correct name of Forward v3: Adjust to new encoding Committer notes: Avoid the in place declaration to make this build with older compilers, for instance, in Debian 7 we get: tests/mem.c: In function 'test__mem': tests/mem.c:30:5: error: missing initializer [-Werror=missing-field-initializers] tests/mem.c:30:5: error: (near initialization for '(anonymous).<anonymous>.mem_snoop') [-Werror=missing-field-initializers] So just zero a struct, then go on building the unions as needed, reusing settings from the previous test, i.e. local -> remote, etc. Signed-off-by: Andi Kleen <[email protected]> Acked-by: Peter Zijlstra <[email protected]> Cc: Jiri Olsa <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
2017-08-22perf tools: Add support for printing new mem_info encodingsAndi Kleen2-5/+68
Add decoding for the new "lvlx" and "snoopx" meminfo fields added earlier to the kernel so that "perf mem report" and other tools can print it properly. v2: Merge with persistent memory patch. Switch to new bit encoding for each combination. v3: Switch to generic lvlnum field. Signed-off-by: Andi Kleen <[email protected]> Acked-by: Peter Zijlstra <[email protected]> Cc: Jiri Olsa <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
2017-08-22perf vendor events: Add Skylake server uncore event listAndi Kleen2-0/+1328
Add JSON uncore events for Skylake Server to perf. Based on JSON list V1.01 This is a much fuller list than with earlier uncores, including more low level (but also harder to understand) events. It does not include the "experimential" events. The previous high level metric (LLC_* etc.) are still available when applicable. C state power events are not included at this point. Signed-off-by: Andi Kleen <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
2017-08-22perf vendor events: Add core event list for Skylake ServerAndi Kleen8-0/+4945
Based on JSON list version v1.01 Signed-off-by: Andi Kleen <[email protected]> Link: http://lkml.kernel.org/r/3269ae458a883139110ec82bc895423bd8843d65 Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
2017-08-22perf tools: Dedup events in expression parsingAndi Kleen1-1/+14
Avoid adding redundant events while parsing an expression. When we add an "other" event check first if it already exists. v2: Fix perf test failure. Signed-off-by: Andi Kleen <[email protected]> Acked-by: Jiri Olsa <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
2017-08-22perf tools: Increase maximum number of events in expressionsAndi Kleen1-1/+1
Some of the upcoming metrics need more than 8 events. Increase the maximum number the parser supports. Signed-off-by: Andi Kleen <[email protected]> Acked-by: Jiri Olsa <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
2017-08-22perf tools: Expression parser enhancements for metricsAndi Kleen2-6/+60
Enhance the expression parser for more complex metric formulas. - Support python style IF ELSE operators - Add an #SMT_On magic variable for formulas that depend on the SMT status. Example: 4 *( CPU_CLK_UNHALTED.THREAD_ANY / 2 ) if #SMT_on else cycles - Support MIN/MAX operations Example: min(1 , IDQ.MITE_UOPS / ( UPI * 16 * ( ICACHE.HIT + ICACHE.MISSES ) / 4.0 ) ) This is useful to fix up problems caused by multiplexing. - Support | & ^ operators - Minor cleanups and fixes - Support an \ escape for operators. This allows to specify event names like c2-residency - Support @ as an alternative for / to be able to specify pmus without conflicts with operators (like msr/tsc/ as msr@tsc@) Example: (cstate_core@c3\\-residency@ / msr@tsc@) * 100 Signed-off-by: Andi Kleen <[email protected]> Acked-by: Jiri Olsa <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
2017-08-22perf tools: Add utility function to detect SMT statusAndi Kleen3-0/+51
Add an smt_on() function to return if SMT is enabled or disabled. Used in the next patch. Signed-off-by: Andi Kleen <[email protected]> Acked-by: Jiri Olsa <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
2017-08-22perf bpf: Tighten detection of BPF eventsAndi Kleen1-4/+19
perf stat -e cpu/uops_executed.core,cmask=1/ would be detected as a BPF source event because the .c matches the .c source BPF pattern. v2: Originally I tried to use lex lookahead, but it doesn't seem to work. This now extends the BPF pattern to match longer events, but then does an extra check in the C code to reject BPF matches that do not end with .c/.o/.obj This uses REJECT, which makes the flex scanner slower, but that shouldn't be a big problem for the perf events. Committer testing: # perf trace -e write -e /home/acme/bpf/tracepoint.c cat /etc/passwd > /dev/null 0.000 ( 0.006 ms): cat/18485 write(fd: 1, buf: 0x7f59eebe1000, count: 3494 ) ... 0.006 ( ): raw_syscalls:sys_enter:NR 1 (1, 7f59eebe1000, da6, 22, 7f59eebe0010, 0)) 0.008 ( ): perf_bpf_probe:_write:(ffffffff9626b2c0)) 0.000 ( 0.010 ms): cat/18485 ... [continued]: write()) = 3494 # It continues doing what was expected, i.e. identifying /home/acme/bpf/tracepoint.c as a BPF event and activates the clang machinery to build an eBPF object and then uses sys_bpf() to hook it up to the raw_syscalls:sys_enter tracepoint, etc. Andi forgot to add Wang to the CC list, fix it. Signed-off-by: Andi Kleen <[email protected]> Acked-by: Jiri Olsa <[email protected]> Tested-by: Arnaldo Carvalho de Melo <[email protected]> Cc: Wang Nan <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
2017-08-22perf evsel: Fix buffer overflow while freeing eventsAndi Kleen5-40/+20
Fix buffer overflow for: % perf stat -e msr/tsc/,cstate_core/c7-residency/ true that causes glibc free list corruption. For some reason it doesn't trigger in valgrind, but it is visible in AS: ================================================================= ==32681==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000003f5c at pc 0x0000005671ef bp 0x7ffdaaac9ac0 sp 0x7ffdaaac9ab0 READ of size 4 at 0x603000003f5c thread T0 #0 0x5671ee in perf_evsel__close_fd util/evsel.c:1196 #1 0x56c57a in perf_evsel__close util/evsel.c:1717 #2 0x55ed5f in perf_evlist__close util/evlist.c:1631 #3 0x4647e1 in __run_perf_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:749 #4 0x4648e3 in run_perf_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:767 #5 0x46e1bc in cmd_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:2785 #6 0x52f83d in run_builtin /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:296 #7 0x52fd49 in handle_internal_command /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:348 #8 0x5300de in run_argv /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:392 #9 0x5308f3 in main /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:530 #10 0x7f0672d13400 in __libc_start_main (/lib64/libc.so.6+0x20400) #11 0x428419 in _start (/home/ak/hle/obj-perf/perf+0x428419) 0x603000003f5c is located 0 bytes to the right of 28-byte region [0x603000003f40,0x603000003f5c) allocated by thread T0 here: #0 0x7f0675139020 in calloc (/lib64/libasan.so.3+0xc7020) #1 0x648a2d in zalloc util/util.h:23 #2 0x648a88 in xyarray__new util/xyarray.c:9 #3 0x566419 in perf_evsel__alloc_fd util/evsel.c:1039 #4 0x56b427 in perf_evsel__open util/evsel.c:1529 #5 0x56c620 in perf_evsel__open_per_thread util/evsel.c:1730 #6 0x461dea in create_perf_stat_counter /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:263 #7 0x4637d7 in __run_perf_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:600 #8 0x4648e3 in run_perf_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:767 #9 0x46e1bc in cmd_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:2785 #10 0x52f83d in run_builtin /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:296 #11 0x52fd49 in handle_internal_command /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:348 #12 0x5300de in run_argv /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:392 #13 0x5308f3 in main /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:530 #14 0x7f0672d13400 in __libc_start_main (/lib64/libc.so.6+0x20400) The event is allocated with cpus == 1, but freed with cpus == real number When the evsel close function walks the file descriptors it exceeds the fd xyarray boundaries and reads random memory. v2: Now that xyarrays save their original dimensions we can use these to iterate the two dimensional fd arrays. Fix some users (close, ioctl) in evsel.c to use these fields directly. This allows simplifying the code and dropping quite a few function arguments. Adjust all callers by removing the unneeded arguments. The actual perf event reading still uses the original values from the evsel list. Signed-off-by: Andi Kleen <[email protected]> Acked-by: Jiri Olsa <[email protected]> Link: http://lkml.kernel.org/r/[email protected] [ Fix up xy_max_[xy]() -> xyarray__max_[xy]() ] Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
2017-08-22perf xyarray: Save max_x, max_yAndi Kleen2-0/+14
Save the original array dimensions in xyarrays, so that users can retrieve them later. Add some inline functions to access these fields. Signed-off-by: Andi Kleen <[email protected]> Acked-by: Jiri Olsa <[email protected]> Link: http://lkml.kernel.org/r/[email protected] [ As noticed by Jiri, fix up namespacing: xy__method() -> xyarray__method() ] Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
2017-08-22ALSA: core: Fix unexpected error at replacing user TLVTakashi Iwai1-1/+1
When user tries to replace the user-defined control TLV, the kernel checks the change of its content via memcmp(). The problem is that the kernel passes the return value from memcmp() as is. memcmp() gives a non-zero negative value depending on the comparison result, and this shall be recognized as an error code. The patch covers that corner-case, return 1 properly for the changed TLV. Fixes: 8aa9b586e420 ("[ALSA] Control API - more robust TLV implementation") Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2017-08-22Merge tag 'at91-ab-4.13-drivers-fixes' of ↵Arnd Bergmann2-5/+7
git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux into fixes Pull "Driver fixes for 4.13" from Alexandre Belloni: - Multiple EBI/SMC timing setting/calculation fixes * tag 'at91-ab-4.13-drivers-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: memory: atmel-ebi: Fix smc cycle xlate converter memory: atmel-ebi: Allow t_DF timings of zero ns memory: atmel-ebi: Fix smc timing return value evaluation
2017-08-22drm: Release driver tracking before making the object available againChris Wilson1-3/+3
This is the same bug as we fixed in commit f6cd7daecff5 ("drm: Release driver references to handle before making it available again"), but now the exposure is via the PRIME lookup tables. If we remove the object/handle from the PRIME lut, then a new request for the same object/fd will generate a new handle, thus for a short window that object is known to userspace by two different handles. Fix this by releasing the driver tracking before PRIME. Fixes: 0ff926c7d4f0 ("drm/prime: add exported buffers to current fprivs imported buffer list (v2)") Signed-off-by: Chris Wilson <[email protected]> Cc: David Airlie <[email protected]> Cc: Daniel Vetter <[email protected]> Cc: Rob Clark <[email protected]> Cc: Ville Syrjälä <[email protected]> Cc: Thierry Reding <[email protected]> Cc: [email protected] Reviewed-by: Daniel Vetter <[email protected]> Signed-off-by: Joonas Lahtinen <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2017-08-22Merge tag 'perf-core-for-mingo-4.14-20170821' of ↵Ingo Molnar13-158/+159
git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo: - Support --show-nr-samples in annotate's --stdio and --tui, using the existing 't' toggle to circulate 'percent', 'total-period' and 'nr-samples' as the first column (Taeung Song) - Support FCMask and PortMask in JSON vendor events (Andi Kleen) - Fix off by one string allocation problem in 'perf trace' (Arnaldo Carvalho de Melo) - Use just one parse events state struct in yyparse(), fixing one reported segfault when a routine received a different data struct, smaller than the one it expected to use (Arnaldo Carvalho de Melo) - Remove unused cpu_relax() macros, they stopped being used when tools/perf lived in Documentation/ (Arnaldo Carvalho de Melo) - Fix double file test in libbpf's Makefile (Daniel Díaz): Signed-off-by: Arnaldo Carvalho de Melo <[email protected]> Signed-off-by: Ingo Molnar <[email protected]>
2017-08-22ALSA: usb-audio: Add delay quirk for H650e/Jabra 550a USB headsetsJoakim Tjernlund1-3/+6
These headsets reports a lot of: cannot set freq 44100 to ep 0x81 and need a small delay between sample rate settings, just like Zoom R16/24. Add both headsets to the Zoom R16/24 quirk for a 1 ms delay between control msgs. Signed-off-by: Joakim Tjernlund <[email protected]> Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2017-08-22Revert "mfd: da9061: Fix to remove BBAT_CONT register from chip model"Lee Jones1-0/+6
This patch was applied to the MFD twice, causing unwanted behavour. This reverts commit b77eb79acca3203883e8d8dbc7f2b842def1bff8. Fixes: b77eb79acca3 ("mfd: da9061: Fix to remove BBAT_CONT register from chip model") Reported-by: Steve Twiss <[email protected]> Reviewed-by: Steve Twiss <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2017-08-22Merge tag 'drm-misc-fixes-2017-08-18' of ↵Dave Airlie3-5/+19
git://anongit.freedesktop.org/git/drm-misc into drm-fixes Core Changes: - Fix framebuffer leak in setplane error condition (Nikil) - Prevent BUG in atomic_ioctl by properly resetting state on EDEADLK (Maarten) - Add missing return in atomic_check_only if atomic_check fails (Maarten) Driver Changes: - rockchip: Don't try to suspend if device not initialized (Jeffy) Cc: Jeffy Chen <[email protected]> Cc: Nikhil Mahale <[email protected]> Cc: Maarten Lankhorst <[email protected]> * tag 'drm-misc-fixes-2017-08-18' of git://anongit.freedesktop.org/git/drm-misc: drm/atomic: If the atomic check fails, return its value first drm/atomic: Handle -EDEADLK with out-fences correctly drm: Fix framebuffer leak drm/rockchip: Fix suspend crash when drm is not bound
2017-08-22Merge tag 'imx-drm-fixes-2017-08-18' of ↵Dave Airlie2-4/+3
git://git.pengutronix.de/git/pza/linux into drm-fixes drm/imx: fix YUV primary plane and IPUv3 build corner case - Enable color space conversion on the primary plane when the framebuffer format is a YUV format. - The IPUv3 base driver now uses drm_format_info in the PRE/PRG code. The PRE/PRG parts are already disabled if DRM is not available. Enforce that if DRM is built as a module, IPUv3 must be built as a module, too. * tag 'imx-drm-fixes-2017-08-18' of git://git.pengutronix.de/git/pza/linux: drm/imx: ipuv3-plane: fix YUV framebuffer scanout on the base plane gpu: ipu-v3: add DRM dependency
2017-08-22Merge tag 'sunxi-drm-fixes-for-4.13' of ↵Dave Airlie1-0/+8
https://git.kernel.org/pub/scm/linux/kernel/git/mripard/linux into drm-fixes Allwinner DRM fixes for 4.13 A single commit to restore the framebuffer console when there's no DRM users left. * tag 'sunxi-drm-fixes-for-4.13' of https://git.kernel.org/pub/scm/linux/kernel/git/mripard/linux: drm/sun4i: Implement drm_driver lastclose to restore fbdev console
2017-08-21Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparcLinus Torvalds4-15/+15
Pull sparc fixes from David Miller: "Just a couple small fixes, two of which have to do with gcc-7: 1) Don't clobber kernel fixed registers in __multi4 libgcc helper. 2) Fix a new uninitialized variable warning on sparc32 with gcc-7, from Thomas Petazzoni. 3) Adjust pmd_t initializer on sparc32 to make gcc happy. 4) If ATU isn't available, don't bark in the logs. From Tushar Dave" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc: kernel/pcic: silence gcc 7.x warning in pcibios_fixup_bus() sparc64: remove unnecessary log message sparc64: Don't clibber fixed registers in __multi4. mm: add pmd_t initializer __pmd() to work around a GCC bug.
2017-08-21sparc: kernel/pcic: silence gcc 7.x warning in pcibios_fixup_bus()Thomas Petazzoni1-1/+1
When building the kernel for Sparc using gcc 7.x, the build fails with: arch/sparc/kernel/pcic.c: In function ‘pcibios_fixup_bus’: arch/sparc/kernel/pcic.c:647:8: error: ‘cmd’ may be used uninitialized in this function [-Werror=maybe-uninitialized] cmd |= PCI_COMMAND_IO; ^~ The simplified code looks like this: unsigned int cmd; [...] pcic_read_config(dev->bus, dev->devfn, PCI_COMMAND, 2, &cmd); [...] cmd |= PCI_COMMAND_IO; I.e, the code assumes that pcic_read_config() will always initialize cmd. But it's not the case. Looking at pcic_read_config(), if bus->number is != 0 or if the size is not one of 1, 2 or 4, *val will not be initialized. As a simple fix, we initialize cmd to zero at the beginning of pcibios_fixup_bus. Signed-off-by: Thomas Petazzoni <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2017-08-21Merge tag 'arc-4.13-rc7-fixes' of ↵Linus Torvalds25-70/+153
git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fixes from Vineet Gupta: - PAE40 related updates - SLC errata for region ops - intc line masking by default * tag 'arc-4.13-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: arc: Mask individual IRQ lines during core INTC init ARCv2: PAE40: set MSB even if !CONFIG_ARC_HAS_PAE40 but PAE exists in SoC ARCv2: PAE40: Explicitly set MSB counterpart of SLC region ops addresses ARC: dma: implement dma_unmap_page and sg variant ARCv2: SLC: Make sure busy bit is set properly for region ops ARC: [plat-sim] Include this platform unconditionally ARC: [plat-axs10x]: prepare dts files for enabling PAE40 on axs103 ARC: defconfig: Cleanup from old Kconfig options
2017-08-21Merge tag 'rtc-4.13-fixes' of ↵Linus Torvalds1-1/+0
git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC fix from Alexandre Belloni: "Fix regmap configuration for ds1307" * tag 'rtc-4.13-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: ds1307: fix regmap config
2017-08-21Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds31-72/+144
Pull networking fixes from David Miller: 1) Fix IGMP handling wrt VRF, from David Ahern. 2) Fix timer access to freed object in dccp, from Eric Dumazet. 3) Use kmalloc_array() in ptr_ring to avoid overflow cases which are triggerable by userspace. Also from Eric Dumazet. 4) Fix infinite loop in unmapping cleanup of nfp driver, from Colin Ian King. 5) Correct datagram peek handling of empty SKBs, from Matthew Dawson. 6) Fix use after free in TIPC, from Eric Dumazet. 7) When replacing a route in ipv6 we need to reset the round robin pointer, from Wei Wang. 8) Fix bug in pci_find_pcie_root_port() which was unearthed by the relaxed ordering changes, from Thierry Redding. I made sure to get an explicit ACK from Bjorn this time around :-) * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (27 commits) ipv6: repair fib6 tree in failure case net_sched: fix order of queue length updates in qdisc_replace() tools lib bpf: improve warning switchdev: documentation: minor typo fixes bpf, doc: also add s390x as arch to sysctl description net: sched: fix NULL pointer dereference when action calls some targets rxrpc: Fix oops when discarding a preallocated service call irda: do not leak initialized list.dev to userspace net/mlx4_core: Enable 4K UAR if SRIOV module parameter is not enabled PCI: Allow PCI express root ports to find themselves tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP net: check and errout if res->fi is NULL when RTM_F_FIB_MATCH is set ipv6: reset fn->rr_ptr when replacing route sctp: fully initialize the IPv6 address in sctp_v6_to_addr() tipc: fix use-after-free tun: handle register_netdevice() failures properly datagram: When peeking datagrams with offset < 0 don't skip empty skbs bpf, doc: improve sysctl knob description netxen: fix incorrect loop counter decrement nfp: fix infinite loop on umapping cleanup ...
2017-08-21pids: make task_tgid_nr_ns() safeOleg Nesterov3-32/+34
This was reported many times, and this was even mentioned in commit 52ee2dfdd4f5 ("pids: refactor vnr/nr_ns helpers to make them safe") but somehow nobody bothered to fix the obvious problem: task_tgid_nr_ns() is not safe because task->group_leader points to nowhere after the exiting task passes exit_notify(), rcu_read_lock() can not help. We really need to change __unhash_process() to nullify group_leader, parent, and real_parent, but this needs some cleanups. Until then we can turn task_tgid_nr_ns() into another user of __task_pid_nr_ns() and fix the problem. Reported-by: Troy Kensinger <[email protected]> Signed-off-by: Oleg Nesterov <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2017-08-21Merge tag 'kvm-s390-master-4.13-2' of ↵Radim Krčmář1-2/+5
git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux KVM: s390: two fixes for sthyi emulation - missing inline assembly constraint - wrong exception handling
2017-08-21objtool: Fix '-mtune=atom' decoding support in objtool 2.0Josh Poimboeuf1-1/+25
With '-mtune=atom', which is enabled with CONFIG_MATOM=y, GCC uses some unusual instructions for setting up the stack. Instead of: mov %rsp, %rbp it does: lea (%rsp), %rbp And instead of: add imm, %rsp it does: lea disp(%rsp), %rsp Add support for these instructions to the objtool decoder. Reported-by: Arnd Bergmann <[email protected]> Signed-off-by: Josh Poimboeuf <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Thomas Gleixner <[email protected]> Fixes: baa41469a7b9 ("objtool: Implement stack validation 2.0") Link: http://lkml.kernel.org/r/4ea1db896e821226efe1f8e09f270771bde47e65.1501188854.git.jpoimboe@redhat.com [ This is a cherry-picked version of upcoming commit 5b8de48e82ba. ] Signed-off-by: Ingo Molnar <[email protected]>
2017-08-21KVM: s390: sthyi: fix specification exception detectionHeiko Carstens1-1/+4
sthyi should only generate a specification exception if the function code is zero and the response buffer is not on a 4k boundary. The current code would also test for unknown function codes if the response buffer, that is currently only defined for function code 0, is not on a 4k boundary and incorrectly inject a specification exception instead of returning with condition code 3 and return code 4 (unsupported function code). Fix this by moving the boundary check. Fixes: 95ca2cb57985 ("KVM: s390: Add sthyi emulation") Cc: <[email protected]> # 4.8+ Reviewed-by: Janosch Frank <[email protected]> Signed-off-by: Heiko Carstens <[email protected]> Reviewed-by: David Hildenbrand <[email protected]> Reviewed-by: Cornelia Huck <[email protected]> Signed-off-by: Christian Borntraeger <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.