kernel_google_b1c1

Author	SHA1	Message	Date
Tyler Nijmeh	abb394b133	timers: Disable the migration of timers among CPUs Usually, when a timer is created on one CPU, it would be able to be migrated to another CPU. However, this increases realtime latencies and scheduling interrupts. It can be turned off. Signed-off-by: Tyler Nijmeh <tylernij@gmail.com>	2024-08-13 23:01:43 +05:30
lucaswei	f09d91fe02	Merge android-4.9-q (4.9.248) into android-msm-pixel-4.9-lts Merge 4.9.248 into android-4.9-q Linux 4.9.248 x86/uprobes: Do not use prefixes.nbytes when looping over prefixes.bytes Input: i8042 - fix error return code in i8042_setup_aux() i2c: qup: Fix error return code in qup_i2c_bam_schedule_desc() gfs2: check for empty rgrp tree in gfs2_ri_update * tracing: Fix userstacktrace option for instances kernel/trace/trace.c kernel/trace/trace.h spi: bcm2835: Release the DMA channel if probe fails after dma_init spi: bcm2835: Fix use-after-free on unbind spi: bcm-qspi: Fix use-after-free on unbind * spi: Introduce device-managed SPI controller allocation drivers/spi/spi.c include/linux/spi/spi.h iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs i2c: imx: Check for I2SR_IAL after every byte i2c: imx: Fix reset of I2SR_IAL flag cifs: fix potential use-after-free in cifs_echo_request() ftrace: Fix updating FTRACE_FL_TRAMP * tty: Fix ->session locking drivers/tty/tty_io.c include/linux/tty.h ALSA: hda/generic: Add option to enforce preferred_dacs pairs ALSA: hda/realtek - Add new codec supported for ALC897 * tty: Fix ->pgrp locking in tiocspgrp() drivers/tty/tty_io.c USB: serial: option: add support for Thales Cinterion EXS82 USB: serial: option: add Fibocom NL668 variants USB: serial: ch341: sort device-id entries USB: serial: ch341: add new Product ID for CH341A USB: serial: kl5kusb105: fix memleak on open * usb: gadget: f_fs: Use local copy of descriptors for userspace copy drivers/usb/gadget/function/f_fs.c * vlan: consolidate VLAN parsing code and limit max parsing depth include/linux/if_vlan.h include/net/inet_ecn.h pinctrl: baytrail: Fix pin being driven low for a while on gpiod_get(..., GPIOD_OUT_HIGH) pinctrl: baytrail: Replace WARN with dev_info_once when setting direct-irq pin to output btrfs: sysfs: init devices outside of the chunk_mutex RDMA/i40iw: Address an mmap handler exploit in i40iw * spi: Fix controller unregister order harder drivers/spi/spi.c Input: i8042 - add ByteSpeed touchpad to noloop table * Input: xpad - support Ardwiino Controllers drivers/input/joystick/xpad.c dt-bindings: net: correct interrupt flags in examples net/mlx5: Fix wrong address reclaim when command interface is down net: pasemi: fix error return code in pasemi_mac_open() cxgb3: fix error return code in t3_sge_alloc_qset() net/x25: prevent a couple of overflows ibmvnic: Fix TX completion error handling ibmvnic: Ensure that SCRQ entry reads are correctly ordered netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal * bonding: wait for sysfs kobject destruction before freeing struct slave drivers/net/bonding/bond_main.c drivers/net/bonding/bond_sysfs_slave.c include/net/bonding.h usbnet: ipheth: fix connectivity with iOS 14 rose: Fix Null pointer dereference in rose_send_frame() net/af_iucv: set correct sk_protocol for child sockets ANDROID: cuttlefish_defconfig: Disable CONFIG_KSM Merge 4.9.247 into android-4.9-q Linux 4.9.247 * USB: core: Fix regression in Hercules audio card drivers/usb/core/quirks.c * USB: core: add endpoint-blacklist quirk drivers/usb/core/config.c drivers/usb/core/quirks.c drivers/usb/core/usb.h include/linux/usb/quirks.h * regulator: workaround self-referent regulators drivers/regulator/core.c * regulator: avoid resolve_supply() infinite recursion drivers/regulator/core.c x86/speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb usb: gadget: Fix memleak in gadgetfs_fill_super * usb: gadget: f_midi: Fix memleak in f_midi_alloc drivers/usb/gadget/function/f_midi.c * USB: core: Change %pK for __user pointers to %px drivers/usb/core/devio.c perf probe: Fix to die_entrypc() returns error correctly platform/x86: toshiba_acpi: Fix the wrong variable assignment can: gs_usb: fix endianess problem with candleLight firmware efivarfs: revert "fix memory leak in efivarfs_create()" ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq net: ena: set initial DMA width to avoid intel iommu issue nfc: s3fwrn5: use signed integer for parsing GPIO numbers IB/mthca: fix return value of error branch in mthca_init_cq() bnxt_en: Release PCI regions when DMA mask setup fails during probe. video: hyperv_fb: Fix the cache type when mapping the VRAM bnxt_en: fix error return code in bnxt_init_board() * scsi: ufs: Fix race between shutdown and runtime resume flow drivers/scsi/ufs/ufshcd.c batman-adv: set .owner to THIS_MODULE phy: tegra: xusb: Fix dangling pointer on probe failure perf/x86: fix sysfs type mismatches scsi: target: iscsi: Fix cmd abort fabric stop race scsi: libiscsi: Fix NOP race condition dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size * proc: don't allow async path resolution of /proc/self components fs/proc/self.c x86/xen: don't unbind uninitialized lock_kicker_irq dmaengine: xilinx_dma: use readl_poll_timeout_atomic variant HID: hid-sensor-hub: Fix issue with devices with no report ID Input: i8042 - allow insmod to succeed on devices without an i8042 controller * HID: cypress: Support Varmilo Keyboards' media hotkeys drivers/hid/hid-ids.h ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close ALSA: hda/hdmi: Use single mutex unlock in error paths * arm64: pgtable: Fix pte_accessible() arch/arm64/include/asm/pgtable.h btrfs: inode: Verify inode mode to avoid NULL pointer dereference btrfs: tree-checker: Enhance chunk checker to validate chunk profile * PCI: Add device even if driver attach failed drivers/pci/bus.c btrfs: fix lockdep splat when reading qgroup config on mount mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() perf event: Check ref_reloc_sym before using it * BACKPORT: arm64: SW PAN: Point saved ttbr0 at the zero page when switching to init_mm arch/arm64/include/asm/efi.h arch/arm64/include/asm/mmu_context.h Merge 4.9.246 into android-4.9-q Linux 4.9.246 x86/microcode/intel: Check patch signature before saving microcode for early loading s390/cpum_sf.c: fix file permission for cpum_sfb_size mac80211: free sta in sta_info_insert_finish() on errors mac80211: minstrel: fix tx status processing corner case mac80211: minstrel: remove deferred sampling code xtensa: disable preemption around cache alias management calls * regulator: fix memory leak with repeated set_machine_constraints() drivers/regulator/core.c iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum * ext4: fix bogus warning in ext4_update_dx_flag() fs/ext4/ext4.h efivarfs: fix memory leak in efivarfs_create() tty: serial: imx: keep console clocks always on ALSA: mixart: Fix mutex deadlock * ALSA: ctl: fix error path at adding user-defined element set sound/core/control.c powerpc/uaccess-flush: fix missing includes in kup-radix.h * libfs: fix error cast of negative value in simple_attr_write() fs/libfs.c xfs: revert "xfs: fix rmap key and record comparison functions" regulator: ti-abb: Fix array out of bound read access on the first transition MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu can: m_can: m_can_handle_state_change(): fix state change can: peak_usb: fix potential integer overflow on shift of a int can: dev: can_restart(): post buffer from the right context perf lock: Don't free "lock_seq_stat" if read_count isn't zero ARM: dts: imx50-evk: Fix the chip select 1 IOMUX arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy MIPS: export has_transparent_hugepage() for modules Input: adxl34x - clean up a data type in adxl34x_probe() * vfs: remove lockdep bogosity in __sb_start_write fs/super.c * arm64: psci: Avoid printing in cpu_psci_cpu_die() arch/arm64/kernel/psci.c pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq mlxsw: core: Use variable timeout for EMAD retries net: ftgmac100: Fix crash when removing driver tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate net: usb: qmi_wwan: Set DTR quirk for MR400 sctp: change to hold/put transport for proto_unreach_timer qlcnic: fix error return code in qlcnic_83xx_restart_hw() net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request net/mlx4_core: Fix init_hca fields offset * netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist() net/netlabel/netlabel_unlabeled.c * netlabel: fix our progress tracking in netlbl_unlabel_staticlist() net/netlabel/netlabel_unlabeled.c net: Have netpoll bring-up DSA management interface * net: bridge: add missing counters to ndo_get_stats64 callback net/bridge/br_device.c net: b44: fix error return code in b44_init_one() * inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() net/ipv4/inet_diag.c devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() bnxt_en: read EEPROM A2h address using page 0 atm: nicstar: Unmap DMA on send error * ah6: fix error return code in ah6_input() net/ipv6/ah6.c Merge 4.9.245 into android-4.9-q Linux 4.9.245 ACPI: GED: fix -Wformat KVM: x86: clflushopt should be treated as a no-op by emulation mac80211: always wind down STA state Input: sunkbd - avoid use-after-free in teardown paths powerpc/8xx: Always fault when _PAGE_ACCESSED is not set i2c: mux: pca954x: Add missing pca9546 definition to chip_desc i2c: imx: Fix external abort on interrupt in exit paths i2c: imx: use clk notifier for rate changes powerpc/64s: flush L1D after user accesses powerpc/uaccess: Evaluate macro arguments once, before user access is allowed powerpc: Fix __clear_user() with KUAP enabled powerpc: Implement user_access_begin and friends powerpc: Add a framework for user access tracking powerpc/64s: flush L1D on kernel entry powerpc/64s: move some exception handlers out of line powerpc/64s: Define MASKABLE_RELON_EXCEPTION_PSERIES_OOL Linux 4.9.244 Convert trailing spaces and periods in path components * ext4: fix leaking sysfs kobject after failed mount fs/ext4/super.c * reboot: fix overflow parsing reboot cpu number kernel/reboot.c * Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint" kernel/reboot.c * perf/core: Fix race in the perf_mmap_close() function kernel/events/core.c xen/events: block rogue events for some time xen/events: defer eoi in case of excessive number of events xen/events: use a common cpu hotplug hook for event channels xen/events: switch user event channels to lateeoi model xen/pciback: use lateeoi irq binding xen/scsiback: use lateeoi irq binding xen/netback: use lateeoi irq binding xen/blkback: use lateeoi irq binding xen/events: add a new "late EOI" evtchn framework xen/events: fix race in evtchn_fifo_unmask() xen/events: add a proper barrier to 2-level uevent unmasking xen/events: avoid removing an event channel while handling it * perf/core: Fix a memory leak in perf_event_parse_addr_filter() kernel/events/core.c * perf/core: Fix crash when using HW tracing kernel filters kernel/events/core.c * perf/core: Fix bad use of igrab() include/linux/perf_event.h kernel/events/core.c x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP * random32: make prandom_u32() output unpredictable drivers/char/random.c include/linux/prandom.h kernel/time/timer.c lib/random32.c net: Update window_clamp if SOCK_RCVBUF is set net/x25: Fix null-ptr-deref in x25_connect net/af_iucv: fix null pointer dereference on shutdown * IPv6: Set SIT tunnel hard_header_len to zero net/ipv6/sit.c * swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb" lib/swiotlb.c pinctrl: amd: fix incorrect way to disable debounce filter pinctrl: amd: use higher precision for 512 RtcClk drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[] * don't dump the threads that had been already exiting when zapped. kernel/exit.c ocfs2: initialize ip_next_orphan mei: protect mei_cl_mtu from null dereference usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode * ext4: unlock xattr_sem properly in ext4_inline_data_truncate() fs/ext4/inline.c * ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA fs/ext4/super.c * perf: Fix get_recursion_context() kernel/events/internal.h cosa: Add missing kfree in error path of cosa_write * of/address: Fix of_node memory leak in of_dma_is_coherent drivers/of/address.c xfs: fix a missing unlock on error in xfs_fs_map_blocks xfs: fix rmap key and record comparison functions xfs: fix flags argument to rmap lookup when converting shared file rmaps pinctrl: aspeed: Fix GPI only function problem. iommu/amd: Increase interrupt remapping table limit to 512 entries scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() * cfg80211: regulatory: Fix inconsistent format argument net/wireless/reg.c mac80211: fix use of skb payload instead of header drm/amdgpu: perform srbm soft reset always on SDMA resume scsi: hpsa: Fix memory leak in hpsa_init_one() gfs2: check for live vs. read-only file system in gfs2_fitrim gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free usb: gadget: goku_udc: fix potential crashes in probe ath9k_htc: Use appropriate rs_datalen type geneve: add transport ports in route lookup for geneve i40e: Memory leak in i40e_config_iwarp_qvlist i40e: Fix of memory leak and integer truncation in i40e_virtchnl.c i40e: Wrong truncation from u16 to u8 i40e: add num_vectors checker in iwarp handler i40e: Fix a potential NULL pointer dereference * pinctrl: devicetree: Avoid taking direct reference to device name string drivers/pinctrl/devicetree.c Btrfs: fix missing error return if writeback for extent buffer never started xfs: flush new eof page on truncate to avoid post-eof corruption can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping can: peak_usb: add range checking in decode operations can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() perf tools: Add missing swap for ino_generation * net: xfrm: fix a race condition during allocing spi net/xfrm/xfrm_state.c * genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY kernel/irq/Kconfig btrfs: reschedule when cloning lots of extents * time: Prevent undefined behaviour in timespec64_to_ns() include/linux/time64.h mm: mempolicy: fix potential pte_unmap_unlock pte error gfs2: Wake up when sd_glock_disposal becomes zero * ring-buffer: Fix recursion protection transitions between interrupt context kernel/trace/ring_buffer.c * regulator: defer probe when trying to get voltage from unresolved supply drivers/regulator/core.c UPSTREAM: thermal/drivers/hisi: Remove bogus const from function return type * UPSTREAM: net/ipv6: don't reinitialize ndev->cnf.addr_gen_mode on new inet6_dev net/ipv6/addrconf.c UPSTREAM: tee: shm: fix use-after-free via temporarily dropped reference UPSTREAM: Documentation: ip-sysctl.txt: document addr_gen_mode UPSTREAM: net: crypto set sk to NULL when af_alg_release. * UPSTREAM: ipv6: don't auto-add link-local address to lag ports net/ipv6/addrconf.c * UPSTREAM: ipv6: ndisc: RFC-ietf-6man-ra-pref64-09 is now published as RFC8781 include/net/ndisc.h * UPSTREAM: binder: fix incorrect cmd to binder_stat_br drivers/android/binder.c * UPSTREAM: arm64: SW PAN: Update saved ttbr0 value on enter_lazy_tlb arch/arm64/include/asm/mmu_context.h UPSTREAM: staging: android: vsoc: fix copy_from_user overrun Merge 4.9.243 into android-4.9-q Linux 4.9.243 powercap: restrict energy meter to root access Merge 4.9.242 into android-4.9-q Linux 4.9.242 Revert "ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE" ARC: stack unwinding: avoid indefinite looping * USB: Add NO_LPM quirk for Kingston flash drive drivers/usb/core/quirks.c USB: serial: option: add Telit FN980 composition 0x1055 USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231 USB: serial: cyberjack: fix write-URB completion race serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init serial: 8250_mtk: Fix uart_get_baud_rate warning * fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent kernel/fork.c * vt: Disable KD_FONT_OP_COPY drivers/tty/vt/vt.c ACPI: NFIT: Fix comparison to '-ENXIO' vsock: use ns_capable_noaudit() on socket create * scsi: core: Don't start concurrent async scan on same host drivers/scsi/scsi_scan.c * of: Fix reserved-memory overlap detection drivers/of/of_reserved_mem.c x86/kexec: Use up-to-dated screen_info copy to fill boot params ARM: dts: sun4i-a10: fix cpu_alert temperature * tracing: Fix out of bounds write in get_trace_buf kernel/trace/trace.c * ftrace: Handle tracing when switching between context kernel/trace/trace.h * ftrace: Fix recursion check for NMI test kernel/trace/trace.h * kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled kernel/kthread.c * ALSA: usb-audio: Add implicit feedback quirk for Qu-16 sound/usb/pcm.c Fonts: Replace discarded const qualifier gianfar: Account for Tx PTP timestamp in the skb headroom gianfar: Replace skb_realloc_headroom with skb_cow_head for PTP tipc: fix use-after-free in tipc_bcast_get_mode xen/events: don't use chip_data for legacy IRQs staging: octeon: Drop on uncorrectable alignment or FCS error staging: octeon: repair "fixed-link" support staging: comedi: cb_pcidas: Allow 2-channel commands for AO subdevice * KVM: arm64: Fix AArch32 handling of DBGD{CCINT,SCRext} and DBGVCR arch/arm64/include/asm/kvm_host.h * device property: Don't clear secondary pointer for shared primary firmware node drivers/base/core.c * device property: Keep secondary firmware node secondary by type drivers/base/core.c ARM: s3c24xx: fix missing system reset ARM: samsung: fix PM debug build with DEBUG_LL but !MMU hil/parisc: Disable HIL driver when it gets stuck cachefiles: Handle readpage error correctly * arm64: berlin: Select DW_APB_TIMER_OF arch/arm64/Kconfig.platforms * tty: make FONTX ioctl use the tty pointer they were actually passed drivers/tty/vt/vt_ioctl.c rtc: rx8010: don't modify the global rtc ops vringh: fix __vringh_iov() when riov and wiov are different * ring-buffer: Return 0 on success from ring_buffer_resize() kernel/trace/ring_buffer.c 9P: Cast to loff_t before multiplying libceph: clear con->out_msg on Policy::stateful_server faults ceph: promote to unsigned long long before shifting ia64: fix build error with !COREDUMP ubi: check kthread_should_stop() after the setting of task state ubifs: dent: Fix some potential memory leaks while iterating entries powerpc/powernv/elog: Fix race while processing OPAL error log event. powerpc: Warn about use of smt_snooze_delay iio:gyro:itg3200: Fix timestamp alignment and prevent data leak. iio:adc:ti-adc12138 Fix alignment issue with timestamp iio:light:si1145: Fix timestamp alignment and prevent data leak. dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status * vt: keyboard, extend func_buf_lock to readers drivers/tty/vt/keyboard.c * vt: keyboard, simplify vt_kdgkbsent drivers/tty/vt/keyboard.c usb: host: fsl-mph-dr-of: check return of dma_set_mask() * usb: dwc3: core: don't trigger runtime pm when remove driver drivers/usb/dwc3/core.c * usb: dwc3: core: add phy cleanup for probe error handling drivers/usb/dwc3/core.c btrfs: fix use-after-free on readahead extent after failure to create it btrfs: cleanup cow block on error btrfs: reschedule if necessary when logging directory items scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove() w1: mxc_w1: Fix timeout resolution problem leading to bus error acpi-cpufreq: Honor _PSD table setting on new AMD CPUs ACPI: debug: don't allow debugging when ACPI is disabled ACPI: video: use ACPI backlight for HP 635 Notebook ACPI / extlog: Check for RDMSR failure NFS: fix nfs_path in case of a rename retry * fs: Don't invalidate page buffers in block_write_full_page() fs/buffer.c leds: bcm6328, bcm6358: use devres LED registering function perf/x86/amd/ibs: Fix raw sample data accumulation perf/x86/amd/ibs: Don't include randomized bits in get_ibs_op_count() md/raid5: fix oops during stripe resizing ARM: dts: s5pv210: remove dedicated 'audio-subsystem' node ARM: dts: s5pv210: move PMU node out of clock controller ARM: dts: s5pv210: remove DMA controller bus node name to fix dtschema warnings memory: emif: Remove bogus debugfs error handling gfs2: add validation checks for size of superblock * ext4: Detect already used quota file early fs/ext4/super.c drivers: watchdog: rdc321x_wdt: Fix race condition bugs net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid clk: ti: clockdomain: fix static checker warning md/bitmap: md_bitmap_get_counter returns wrong blocks power: supply: test_power: add missing newlines when printing parameters by sysfs bus/fsl_mc: Do not rely on caller to provide non NULL mc_io drivers/net/wan/hdlc_fr: Correctly handle special skb->protocol values * arm64/mm: return cpu_all_mask when node is NUMA_NO_NODE arch/arm64/include/asm/numa.h USB: adutux: fix debugging cpufreq: sti-cpufreq: add stih418 support * kgdb: Make "kgdbcon" work properly with "kgdb_earlycon" kernel/debug/debug_core.c * printk: reduce LOG_BUF_SHIFT range for H8300 init/Kconfig mmc: via-sdmmc: Fix data race bug media: tw5864: check status of tw5864_frameinterval_get ath10k: fix VHT NSS calculation when STBC is enabled video: fbdev: pvr2fb: initialize variables xfs: fix realtime bitmap/summary file truncation when growing rt volume ARM: 8997/2: hw_breakpoint: Handle inexact watchpoint addresses um: change sigio_spinlock to a mutex * f2fs: fix to check segment boundary during SIT page readahead fs/f2fs/checkpoint.c * f2fs: add trace exit in exception path fs/f2fs/checkpoint.c sparc64: remove mm_cpumask clearing to fix kthread_use_mm race powerpc/powernv/smp: Fix spurious DBG() warning mlxsw: core: Fix use-after-free in mlxsw_emad_trans_finish() * fscrypt: use EEXIST when file already uses different policy fs/crypto/policy.c * fscrypto: move ioctl processing more fully into common code fs/crypto/policy.c fs/ext4/ext4.h fs/ext4/ioctl.c fs/f2fs/f2fs.h fs/f2fs/file.c * fscrypt: return -EXDEV for incompatible rename or link into encrypted dir fs/crypto/policy.c fs/ext4/namei.c fs/f2fs/namei.c ata: sata_rcar: Fix DMA boundary mask mtd: lpddr: Fix bad logic in print_drs_error p54: avoid accessing the data mapped to streaming DMA * fuse: fix page dereference after free fs/fuse/dev.c arch/x86/amd/ibs: Fix re-arming IBS Fetch tipc: fix memory leak caused by tipc_buf_append() ravb: Fix bit fields checking in ravb_hwtstamp_get() efivarfs: Replace invalid slashes with exclamation marks in dentries. powerpc/powernv/opal-dump : Use IRQ_HANDLED instead of numbers in interrupt handler * scripts/setlocalversion: make git describe output more reliable scripts/setlocalversion SUNRPC: ECONNREFUSED should cause a rebind. * ANDROID: Temporarily disable XFRM_USER_COMPAT filtering net/xfrm/xfrm_state.c net/xfrm/xfrm_user.c * BACKPORT: xfrm/compat: Translate 32-bit user_policy from sockptr include/net/xfrm.h net/xfrm/xfrm_state.c * BACKPORT: xfrm/compat: Add 32=>64-bit messages translator include/net/xfrm.h net/xfrm/Kconfig net/xfrm/xfrm_user.c * UPSTREAM: xfrm/compat: Attach xfrm dumps to 64=>32 bit translator net/xfrm/xfrm_user.c * BACKPORT: xfrm/compat: Add 64=>32-bit messages translator include/net/xfrm.h net/xfrm/xfrm_user.c * BACKPORT: xfrm: Provide API to register translator module include/net/xfrm.h net/xfrm/Kconfig net/xfrm/Makefile net/xfrm/xfrm_state.c * UPSTREAM: mm/sl[uo]b: export __kmalloc_track(_node)_caller mm/slub.c ANDROID: Publish uncompressed Image on aarch64 * ANDROID: Makefile: append BUILD_NUMBER to version string when defined Makefile Change-Id: I345c9bde484cf008679253982f61b2a833527c3e Signed-off-by: Lucas Wei <lucaswei@google.com>	2021-01-25 15:50:07 +08:00
George Spelvin	29da3bb1a8	random32: make prandom_u32() output unpredictable commit c51f8f88d705e06bd696d7510aff22b33eb8e638 upstream. Non-cryptographic PRNGs may have great statistical properties, but are usually trivially predictable to someone who knows the algorithm, given a small sample of their output. An LFSR like prandom_u32() is particularly simple, even if the sample is widely scattered bits. It turns out the network stack uses prandom_u32() for some things like random port numbers which it would prefer are not trivially predictable. Predictability led to a practical DNS spoofing attack. Oops. This patch replaces the LFSR with a homebrew cryptographic PRNG based on the SipHash round function, which is in turn seeded with 128 bits of strong random key. (The authors of SipHash have not been consulted about this abuse of their algorithm.) Speed is prioritized over security; attacks are rare, while performance is always wanted. Replacing all callers of prandom_u32() is the quick fix. Whether to reinstate a weaker PRNG for uses which can tolerate it is an open question. Commit f227e3ec3b5c ("random32: update the net random state on interrupt and activity") was an earlier attempt at a solution. This patch replaces it. Reported-by: Amit Klein <aksecurity@gmail.com> Cc: Willy Tarreau <w@1wt.eu> Cc: Eric Dumazet <edumazet@google.com> Cc: "Jason A. Donenfeld" <Jason@zx2c4.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Kees Cook <keescook@chromium.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: tytso@mit.edu Cc: Florian Westphal <fw@strlen.de> Cc: Marc Plumb <lkml.mplumb@gmail.com> Fixes: f227e3ec3b5c ("random32: update the net random state on interrupt and activity") Signed-off-by: George Spelvin <lkml@sdf.org> Link: https://lore.kernel.org/netdev/20200808152628.GA27941@SDF.ORG/ [ willy: partial reversal of f227e3ec3b5c; moved SIPROUND definitions to prandom.h for later use; merged George's prandom_seed() proposal; inlined siprand_u32(); replaced the net_rand_state[] array with 4 members to fix a build issue; cosmetic cleanups to make checkpatch happy; fixed RANDOM32_SELFTEST build ] [wt: backported to 4.9 -- various context adjustments; timer API change] Signed-off-by: Willy Tarreau <w@1wt.eu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-11-18 18:26:29 +01:00
lucaswei	28f89a6c66	Merge android-4.9-q (4.9.234) into android-msm-pixel-4.9-lts Merge 4.9.234 into android-4.9-q Linux 4.9.234 KVM: arm/arm64: Don't reschedule in unmap_stage2_range() xen: don't reschedule in preemption off sections mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible * do_epoll_ctl(): clean the failure exits up a bit fs/eventpoll.c * epoll: Keep a reference on files added to the check list fs/eventpoll.c powerpc: Allow 4224 bytes of stack expansion for the signal frame powerpc/pseries: Do not initiate shutdown when system is running on UPS net: dsa: b53: check for timeout ASoC: intel: Fix memleak in sst_media_open net: fec: correct the error path for regulator disable in probe i40e: Set RX_ONLY mode for unicast promiscuous on VLAN * ext4: fix potential negative array index in do_split() fs/ext4/namei.c alpha: fix annotation of io{read,write}{16,32}be() xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init virtio_ring: Avoid loop when vq is broken in virtqueue_poll scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases jffs2: fix UAF problem xfs: fix inode quota reservation checks m68knommu: fix overwriting of bits in ColdFire V3 cache control Input: psmouse - add a newline when printing 'proto' by sysfs media: vpss: clean up resources in init media: budget-core: Improve exception handling in budget_register() * scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices drivers/scsi/ufs/ufs_quirks.h drivers/scsi/ufs/ufshcd.c * ext4: fix checking of directory entry validity for inline directories fs/ext4/namei.c * ext4: clean up ext4_match() and callers fs/ext4/namei.c * mm, page_alloc: fix core hung in free_pcppages_bulk() mm/page_alloc.c * mm: include CMA pages in lowmem_reserve at boot mm/page_alloc.c kernel/relay.c: fix memleak on destroy relay channel romfs: fix uninitialized memory leak in romfs_dev_read() btrfs: don't show full path of bind mounts in subvol= btrfs: export helpers for subvolume name/id resolution khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter() khugepaged: khugepaged_test_exit() check mmget_still_valid() tracing/hwlat: Honor the tracing_cpumask tracing: Clean up the hwlat binding code perf probe: Fix memory leakage when the probe point is not found drm/imx: imx-ldb: Disable both channels for split mode in enc->disable() x86/asm: Add instruction suffixes to bitops x86/asm: Remove unnecessary \n\t in front of CC_SET() from asm templates * ANDROID: fix a bug in quota2 net/netfilter/xt_quota2.c Merge 4.9.233 into android-4.9-q * UPSTREAM: binder: Prevent context manager from incrementing ref 0 drivers/android/binder.c Linux 4.9.233 * mm: Avoid calling build_all_zonelists_init under hotplug context include/linux/mmzone.h init/main.c mm/page_alloc.c khugepaged: retract_page_tables() remember to test exit sh: landisk: Add missing initialization of sh_io_port_base ALSA: echoaudio: Fix potential Oops in snd_echo_resume() mfd: dln2: Run event handler loop under spinlock fs/ufs: avoid potential u32 multiplication overflow nfs: Fix getxattr kernel panic and memory overflow net: qcom/emac: add missed clk_disable_unprepare in error path of emac_clks_phase1_init drm/vmwgfx: Fix two list_for_each loop exit tests Input: sentelic - fix error return when fsp_reg_write fails pwm: bcm-iproc: handle clk_get_rate() return clk: clk-atlas6: fix return value check in atlas6_clk_init() i2c: rcar: slave: only send STOP event when we have been addressed iommu/vt-d: Enforce PASID devTLB field mask iommu/omap: Check for failure of a call to omap_iommu_dump_ctx gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq handlers USB: serial: ftdi_sio: clean up receive processing USB: serial: ftdi_sio: make process-packet buffer unsigned mfd: arizona: Ensure 32k clock is put on driver unbind and error pseries: Fix 64 bit logical memory block panic watchdog: f71808e_wdt: clear watchdog timeout occurred flag watchdog: f71808e_wdt: remove use of wrong watchdog_info option watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in watchdog_info.options kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler ftrace: Setup correct FTRACE_FL_REGS flags for module ocfs2: change slot number type s16 to u16 ext2: fix missing percpu_counter_inc MIPS: CPU#0 is not hotpluggable mac80211: fix misplaced while instead of if bcache: allocate meta data pages as compound pages md/raid5: Fix Force reconstruct-write io stuck in degraded raid5 * net/compat: Add missing sock updates for SCM_RIGHTS include/net/sock.h net/compat.c net/core/sock.c net: stmmac: dwmac1000: provide multicast filter fallback net: ethernet: stmmac: Disable hardware multicast filter powerpc: Fix circular dependency between percpu.h and mmu.h xtensa: fix xtensa_pmu_setup prototype iio: dac: ad5592r: fix unbalanced mutex unlocks in ad5592r_read_raw() btrfs: fix memory leaks after failure to lookup checksums during inode logging btrfs: only search for left_info if there is no right_info in try_merge_free_space btrfs: don't allocate anonymous block device for user invisible roots PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context() smb3: warn on confusing error scenario with sec=krb5 xen/balloon: make the balloon wait interruptible xen/balloon: fix accounting in alloc_xenballooned_pages error path ARM: 8992/1: Fix unwind_frame for clang-built kernels parisc: mask out enable and reserved bits from sba imask 9p: Fix memory leak in v9fs_mount * ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109 sound/usb/card.h sound/usb/pcm.c sound/usb/quirks.c sound/usb/stream.c fs/minix: reject too-large maximum file size fs/minix: don't allow getting deleted inodes fs/minix: check return value of sb_getblk() crypto: ccp - Fix use of merged scatterlists crypto: qat - fix double free in qat_uclo_create_batch_init_list * ALSA: usb-audio: add quirk for Pioneer DDJ-RB sound/usb/quirks-table.h * ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109 sound/usb/quirks-table.h * ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support sound/usb/mixer_quirks.c USB: serial: cp210x: enable usb generic throttle/unthrottle USB: serial: cp210x: re-enable auto-RTS on open * net: Set fput_needed iff FDPUT_FPUT is set net/socket.c net/nfc/rawsock.c: add CAP_NET_RAW check. drivers/net/wan/lapbether: Added needed_headroom and a skb->len check pinctrl-single: fix pcs_parse_pinconf() return value dlm: Fix kobject memleak fsl/fman: fix eth hash table allocation fsl/fman: check dereferencing null pointer fsl/fman: fix unreachable code fsl/fman: fix dereference null return value fsl/fman: use 32-bit unsigned integer net: spider_net: Fix the size used in a 'dma_free_coherent()' call wl1251: fix always return 0 error s390/qeth: don't process empty bridge port events selftests/powerpc: Fix online CPU selection selftests/powerpc: Fix CPU affinity for child process power: supply: check if calc_soc succeeded in pm860x_init_battery * Smack: prevent underflow in smk_set_cipso() security/smack/smackfs.c * Smack: fix another vsscanf out of bounds security/smack/smackfs.c scsi: mesh: Fix panic after host or bus reset usb: dwc2: Fix error path in gadget registration USB: serial: iuu_phoenix: fix led-activity helpers drm/imx: tve: fix regulator_disable error path PCI/ASPM: Add missing newline in sysfs 'policy' staging: rtl8192u: fix a dubious looking mask before a shift powerpc/vdso: Fix vdso cpu truncation mwifiex: Prevent memory corruption handling keys scsi: scsi_debug: Add check for sdebug_max_queue during module init drm: panel: simple: Fix bpc for LG LB070WV8 panel * leds: core: Flush scheduled work for system suspend drivers/leds/led-class.c * PCI: Fix pci_cfg_wait queue locking problem drivers/pci/access.c xfs: fix reflink quota reservation accounting error media: exynos4-is: Add missed check for pinctrl_lookup_state() media: firewire: Using uninitialized values in node_probe() scsi: eesox: Fix different dev_id between request_irq() and free_irq() scsi: powertec: Fix different dev_id between request_irq() and free_irq() drm/radeon: fix array out-of-bounds read and write issues cxl: Fix kobject memleak * drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline drivers/gpu/drm/drm_mipi_dsi.c scsi: cumana_2: Fix different dev_id between request_irq() and free_irq() media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities() leds: lm355x: avoid enum conversion warning iio: improve IIO_CONCENTRATION channel type description video: pxafb: Fix the function used to balance a 'dma_alloc_coherent()' call console: newport_con: fix an issue about leak related system resources video: fbdev: sm712fb: fix an issue about iounmap for a wrong address agp/intel: Fix a memory leak on module initialisation failure ACPICA: Do not increment operation_region reference counts for field units bcache: fix super block seq numbers comparision in register_cache_set() * dyndbg: fix a BUG_ON in ddebug_describe_flags lib/dynamic_debug.c bdc: Fix bug causing crash after multiple disconnects usb: gadget: net2280: fix memory leak on probe error handling paths iwlegacy: Check the return value of pcie_capability_read_() brcmfmac: To fix Bss Info flag definition Bug mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls mm/mmap.c * drm/debugfs: fix plain echo to connector "force" attribute drivers/gpu/drm/drm_debugfs.c drm/nouveau: fix multiple instances of reference count leaks md-cluster: fix wild pointer of unlock_all_bitmaps() video: fbdev: neofb: fix memory leak in neo_scan_monitor() drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls Bluetooth: add a mutex lock to avoid UAF in do_enale_set drm/tilcdc: fix leak & null ref in panel_connector_get_modes ARM: socfpga: PM: add missing put_device() call in socfpga_setup_ocram_self_refresh() ARM: at91: pm: add missing put_device() call in at91_pm_sram_init() platform/x86: intel-vbtn: Fix return value check in check_acpi_dev() platform/x86: intel-hid: Fix return value check in check_acpi_dev() m68k: mac: Fix IOP status/control register writes m68k: mac: Don't send IOP message until channel is idle arm64: dts: exynos: Fix silent hang after boot on Espresso arm64: dts: qcom: msm8916: Replace invalid bias-pull-none property * EDAC: Fix reference count leaks drivers/edac/edac_device_sysfs.c drivers/edac/edac_pci_sysfs.c * cgroup: add missing skcd->no_refcnt check in cgroup_sk_clone() kernel/cgroup.c * gpio: fix oops resulting from calling of_get_named_gpio(NULL, ...) drivers/gpio/gpiolib-of.c * tracepoint: Mark __tracepoint_string's __used include/linux/tracepoint.h * Smack: fix use-after-free in smk_write_relabel_self() security/smack/smackfs.c usb: hso: check for return value in hso_serial_common_create() Revert "vxlan: fix tos value before xmit" net: lan78xx: replace bogus endpoint lookup vxlan: Ensure FDB dump is performed under RCU * ipv6: fix memory leaks on IPV6_ADDRFORM path include/net/addrconf.h net/ipv6/anycast.c net/ipv6/ipv6_sockglue.c * ipv4: Silence suspicious RCU usage warning net/ipv4/fib_trie.c * binder: Prevent context manager from incrementing ref 0 drivers/android/binder.c * xattr: break delegations in {set,remove}xattr fs/xattr.c include/linux/xattr.h tools lib traceevent: Fix memory leak in process_dynamic_array_len atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent igb: reinit_locked() should be called with rtnl_lock * cfg80211: check vendor command doit pointer before use net/wireless/nl80211.c drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason net/9p: validate fds in p9_fd_open leds: 88pm860x: fix use-after-free on unbind leds: lm3533: fix use-after-free on unbind leds: da903x: fix use-after-free on unbind leds: wm831x-status: fix use-after-free on unbind mtd: properly check all write ioctls for permissions vgacon: Fix for missing check in scrollback handling omapfb: dss: Fix max fclk divider for omap36xx * Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt() net/bluetooth/hci_event.c * Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt() net/bluetooth/hci_event.c * Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt() net/bluetooth/hci_event.c ALSA: seq: oss: Serialize ioctls net/mlx5e: Don't support phys switch id if not in switchdev mode USB: serial: qcserial: add EM7305 QDL product ID * ext4: fix direct I/O read error fs/ext4/inode.c * random32: move the pseudo-random 32-bit definitions to prandom.h include/linux/prandom.h include/linux/random.h * random32: remove net_rand_state from the latent entropy gcc plugin include/linux/random.h lib/random32.c * random: fix circular include dependency on arm64 after addition of percpu.h include/linux/random.h ARM: percpu.h: fix build error * random32: update the net random state on interrupt and activity drivers/char/random.c include/linux/random.h kernel/time/timer.c lib/random32.c x86/i8259: Use printk_deferred() to prevent deadlock KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled xen-netfront: fix potential deadlock in xennet_remove() Revert "i2c: cadence: Fix the hold bit setting" net: ethernet: ravb: exit if re-initialization fails in tx timeout parisc: add support for cmpxchg on u8 pointers nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame qed: Disable "MFW indication via attention" SPAM every 5 minutes usb: hso: Fix debug compile warning on sparc32 * arm64: csum: Fix handling of bad packets arch/arm64/include/asm/checksum.h mac80211: mesh: Free pending skb when destroying a mpath mac80211: mesh: Free ie data when leaving mesh ibmvnic: Fix IRQ mapping disposal in error path mlxsw: core: Free EMAD transactions using kfree_rcu() mlxsw: core: Increase scope of RCU read-side critical section mlx4: disable device on shutdown net: lan78xx: fix transfer-buffer memory leak net: lan78xx: add missing endpoint sanity check sh: Fix validation of system call number net/x25: Fix null-ptr-deref in x25_disconnect net/x25: Fix x25_neigh refcnt leak when x25 disconnect install several missing uapi headers * uapi: includes linux/types.h before exporting files include/uapi/linux/cryptouser.h include/uapi/linux/pr.h xfs: fix missed wakeup on l_flush_wait rds: Prevent kernel-infoleak in rds_notify_queue_get() fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins. * x86, vmlinux.lds: Page-align end of ..page_aligned sections include/asm-generic/vmlinux.lds.h x86/build/lto: Fix truncated .bss with -fdata-sections 9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work 9p/trans_fd: abort p9_read_work if req status changed * f2fs: check if file namelen exceeds max value fs/f2fs/dir.c * f2fs: check memory boundary by insane namelen fs/f2fs/dir.c * drm: hold gem reference until object is no longer accessed drivers/gpu/drm/drm_gem.c drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl() ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints * PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge drivers/pci/quirks.c ath9k: release allocated buffer if timed out ath9k_htc: release allocated buffer if timed out media: rc: prevent memory leak in cx23888_ir_probe crypto: ccp - Release all allocated memory if sha type is invalid net: phy: mdio-bcm-unimac: fix potential NULL dereference in unimac_mdio_probe() xfs: don't call xfs_da_shrink_inode with NULL bp xfs: validate cached inodes are free when allocated xfs: catch inode allocation state mismatch corruption * BACKPORT: loop: Fix wrong masking of status flags drivers/block/loop.c * BACKPORT: loop: Add LOOP_CONFIGURE ioctl drivers/block/loop.c include/uapi/linux/loop.h * BACKPORT: loop: Clean up LOOP_SET_STATUS lo_flags handling drivers/block/loop.c include/uapi/linux/loop.h * BACKPORT: loop: Rework lo_ioctl() __user argument casting drivers/block/loop.c * BACKPORT: loop: Move loop_set_status_from_info() and friends up drivers/block/loop.c * BACKPORT: loop: Factor out configuring loop from status drivers/block/loop.c * BACKPORT: loop: Remove figure_loop_size() drivers/block/loop.c * BACKPORT: loop: Refactor loop_set_status() size calculation drivers/block/loop.c * BACKPORT: loop: Factor out setting loop device size drivers/block/loop.c * BACKPORT: loop: Remove sector_t truncation checks drivers/block/loop.c * BACKPORT: loop: Call loop_config_discard() only after new config is applied drivers/block/loop.c Change-Id: Ic8aad76543057de6fe453c1790dd17f9df90955c Signed-off-by: lucaswei <lucaswei@google.com>	2020-09-09 11:45:07 +08:00
Willy Tarreau	5aa78397e2	random32: update the net random state on interrupt and activity commit f227e3ec3b5cad859ad15666874405e8c1bbc1d4 upstream. This modifies the first 32 bits out of the 128 bits of a random CPU's net_rand_state on interrupt or CPU activity to complicate remote observations that could lead to guessing the network RNG's internal state. Note that depending on some network devices' interrupt rate moderation or binding, this re-seeding might happen on every packet or even almost never. In addition, with NOHZ some CPUs might not even get timer interrupts, leaving their local state rarely updated, while they are running networked processes making use of the random state. For this reason, we also perform this update in update_process_times() in order to at least update the state when there is user or system activity, since it's the only case we care about. Reported-by: Amit Klein <aksecurity@gmail.com> Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Eric Dumazet <edumazet@google.com> Cc: "Jason A. Donenfeld" <Jason@zx2c4.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Kees Cook <keescook@chromium.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: <stable@vger.kernel.org> Signed-off-by: Willy Tarreau <w@1wt.eu> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-08-21 11:01:52 +02:00
lucaswei	2b5e67e8a2	Merge android-4.9-q (4.9.232) into android-msm-pixel-4.9-lts Merge 4.9.232 into android-4.9-q Linux 4.9.232 perf: Make perf able to build with latest libbfd perf tools: Fix snprint warnings for gcc 8 perf annotate: Use asprintf when formatting objdump command line perf probe: Fix to check blacklist address correctly xfs: set format back to extents if xfs_bmap_extents_to_btree * regmap: debugfs: check count when read regmap file drivers/base/regmap/regmap-debugfs.c drivers/net/wan/x25_asy: Fix to make it work ip6_gre: fix null-ptr-deref in ip6gre_init_net() * tcp: allow at most one TLP probe per flight include/linux/tcp.h net/ipv4/tcp_input.c net/ipv4/tcp_output.c AX.25: Prevent integer overflows in connect and sendmsg rxrpc: Fix sendmsg() returning EPIPE due to recvmsg() returning ENODATA * net: udp: Fix wrong clean up for IS_UDPLITE macro net/ipv4/udp.c net/ipv6/udp.c * net-sysfs: add a newline when printing 'tx_timeout' by sysfs net/core/net-sysfs.c * dev: Defer free of skbs in flush_backlog net/core/dev.c AX.25: Prevent out-of-bounds read in ax25_sendmsg() AX.25: Fix out-of-bounds read in ax25_connect() ath9k: Fix regression with Atheros 9271 ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb parisc: Add atomic64_set_release() define to avoid CPU soft lockups io-mapping: indicate mapping failure * mm/memcg: fix refcount error while moving and swapping mm/memcontrol.c * Makefile: Fix GCC_TOOLCHAIN_DIR prefix for Clang cross compilation Makefile * vt: Reject zero-sized screen buffer size. drivers/tty/vt/vt.c serial: 8250_mtk: Fix high-speed baud rates clamping serial: 8250: fix null-ptr-deref in serial8250_start_tx() staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG shift staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG shift staging: wlan-ng: properly check endpoint types Revert "cifs: Fix the target file was deleted when rename failed." * usb: xhci: Fix ASM2142/ASM3142 DMA addressing drivers/usb/host/xhci-pci.c usb: xhci-mtk: fix the failure of bandwidth allocation x86: math-emu: Fix up 'cmp' insn for clang ias * arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP arch/arm64/kernel/debug-monitors.c usb: gadget: udc: gr_udc: fix memleak on error handling path in gr_ep_init() dmaengine: ioat setting ioat timeout as module parameter * regmap: dev_get_regmap_match(): fix string comparison drivers/base/regmap/regmap.c dmaengine: tegra210-adma: Fix runtime PM imbalance on error * HID: apple: Disable Fn-key key-re-mapping on clone keyboards drivers/hid/hid-apple.c HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override scripts/decode_stacktrace: strip basepath from all paths net: smc91x: Fix possible memory leak in smc_drv_probe() net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual configuration * ax88172a: fix ax88172a_unbind() failures drivers/net/usb/ax88172a.c hippi: Fix a size used in a 'pci_free_consistent()' in an error handling path bnxt_en: Fix race when modifying pause settings. btrfs: fix mount failure caused by race with umount btrfs: fix double free on ulist after backref resolution failure ASoC: rt5670: Correct RT5670_LDO_SEL_MASK * ALSA: info: Drop WARN_ON() from buffer NULL sanity check sound/core/info.c uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct IO compeletion") drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout net: sky2: initialize return of gm_phy_read drivers/net/wan/lapbether: Fixed the value of hard_header_len xtensa: update pos in cpuinfo_op.next xtensa: fix __sync_fetch_and_{and,or}_4 declarations scsi: scsi_transport_spi: Fix function pointer check mac80211: allow rx of mesh eapol frames with default rx key pinctrl: amd: fix npins for uart0 in kerncz_groups UPSTREAM: xtables: extend matches and targets with .usersize net/netfilter/xt_CT.c net/netfilter/xt_TEE.c net/netfilter/xt_bpf.c net/netfilter/xt_connlimit.c net/netfilter/xt_hashlimit.c net/netfilter/xt_limit.c net/netfilter/xt_quota.c net/netfilter/xt_string.c * UPSTREAM: ip6tables: use match, target and data copy_to_user helpers net/ipv6/netfilter/ip6_tables.c * UPSTREAM: iptables: use match, target and data copy_to_user helpers net/ipv4/netfilter/ip_tables.c * UPSTREAM: xtables: add xt_match, xt_target and data copy_to_user functions include/linux/netfilter/x_tables.h net/netfilter/x_tables.c Merge 4.9.231 into android-4.9-q Linux 4.9.231 x86/cpu: Move x86_cache_bits settings * irqchip/gic: Atomically update affinity drivers/irqchip/irq-gic.c * sched/fair: handle case of task_h_load() returning 0 kernel/sched/fair.c * arm64: ptrace: Override SPSR.SS when single-stepping is enabled arch/arm64/include/asm/debug-monitors.h arch/arm64/kernel/debug-monitors.c arch/arm64/kernel/ptrace.c misc: atmel-ssc: lock with mutex instead of spinlock dmaengine: fsl-edma: Fix NULL pointer exception in fsl_edma_tx_handler hwmon: (emc2103) fix unable to change fan pwm1_enable attribute MIPS: Fix build for LTS kernel caused by backporting lpj adjustment * timer: Fix wheel index calculation on last level kernel/time/timer.c uio_pdrv_genirq: fix use without device tree and no interrupt Input: i8042 - add Lenovo XiaoXin Air 12 to i8042 nomux list mei: bus: don't clean driver pointer * fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS fs/fuse/file.c virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc serial USB: serial: option: add Quectel EG95 LTE modem USB: serial: option: add GosunCn GM500 series USB: serial: ch341: add new Product ID for CH340 USB: serial: cypress_m8: enable Simply Automated UPB PIM USB: serial: iuu_phoenix: fix memory corruption usb: gadget: function: fix missing spinlock in f_uac1_legacy usb: chipidea: core: add wakeup support for extcon usb: dwc2: Fix shutdown callback in platform USB: c67x00: fix use after free in c67x00_giveback_urb * ALSA: usb-audio: Fix race against the error recovery URB submission sound/usb/midi.c ALSA: line6: Perform sanity check for each URB creation * usb: core: Add a helper function to check the validity of EP type in URB drivers/usb/core/urb.c include/linux/usb.h * HID: magicmouse: do not set up autorepeat drivers/hid/hid-magicmouse.c mtd: rawnand: brcmnand: fix CS0 layout perf stat: Zero all the 'ena' and 'run' array slot stats for interval mode ARM: dts: socfpga: Align L2 cache-controller nodename with dtschema Revert "thermal: mediatek: fix register index error" staging: comedi: verify array index is correct before using it usb: gadget: udc: atmel: fix uninitialized read in debug printk spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate iio:health:afe4404 Fix timestamp alignment and prevent data leak. Revert "usb/ohci-platform: Fix a warning when hibernating" * Revert "usb/xhci-plat: Set PM runtime as active on resume" drivers/usb/host/xhci-plat.c Revert "usb/ehci-platform: Set PM runtime as active on resume" net: dsa: bcm_sf2: Fix node reference count spi: fix initial SPI_SR value in spi-fsl-dspi iio:health:afe4403 Fix timestamp alignment and prevent data leak. iio:pressure:ms5611 Fix buffer element alignment iio: pressure: zpa2326: handle pm_runtime_get_sync failure iio: mma8452: Add missed iio_device_unregister() call in mma8452_probe() iio: magnetometer: ak8974: Fix runtime PM imbalance on error iio:magnetometer:ak8974: Fix alignment and data leak issues i2c: eg20t: Load module automatically if ID matches * cgroup: Fix sock_cgroup_data on big-endian. include/linux/cgroup-defs.h * cgroup: fix cgroup_sk_alloc() for sk_clone_lock() include/linux/cgroup-defs.h include/linux/cgroup.h kernel/cgroup.c net/core/sock.c * tcp: md5: allow changing MD5 keys in all socket states net/ipv4/tcp.c * tcp: md5: do not send silly options in SYNCOOKIES net/ipv4/tcp_output.c * tcp: make sure listeners don't initialize congestion-control state net/ipv4/tcp.c net/ipv4/tcp_cong.c * genetlink: remove genl_bind include/net/genetlink.h net/netlink/genetlink.c * tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers net/ipv4/tcp.c net/ipv4/tcp_ipv4.c * tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key() net/ipv4/tcp.c net/ipv4/tcp_ipv4.c net: usb: qmi_wwan: add support for Quectel EG95 LTE modem * net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb include/net/dst.h llc: make sure applications use ARPHRD_ETHER * l2tp: remove skb_dst_set() from l2tp_xmit_skb() net/l2tp/l2tp_core.c * ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg net/ipv4/ping.c s390/mm: fix huge pte soft dirty copying ARC: elf: use right ELF_ARCH ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE drm/radeon: fix double free btrfs: fix fatal extent_buffer readahead vs releasepage race Revert "ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb" KVM: x86: bit 8 of non-leaf PDPEs is not reserved * KVM: arm64: Fix definition of PAGE_HYP_DEVICE arch/arm64/include/asm/pgtable-prot.h * ALSA: usb-audio: add quirk for MacroSilicon MS2109 sound/usb/quirks-table.h ALSA: hda - let hs_mic be picked ahead of hp_mic ALSA: opl3: fix infoleak in opl3 net: macb: mark device wake capable when "magic-packet" property present bnxt_en: fix NULL dereference in case SR-IOV configuration fails * arm64: kgdb: Fix single-step exception handling oops arch/arm64/kernel/kgdb.c * ALSA: compress: fix partial_drain completion state include/sound/compress_driver.h sound/core/compress_offload.c smsc95xx: avoid memory leak in smsc95xx_bind smsc95xx: check return value of smsc95xx_reset net: cxgb4: fix return error value in t4_prep_fw scsi: mptscsih: Fix read sense data size ARM: imx6: add missing put_device() call in imx6q_suspend_init() cifs: update ctime and mtime during truncate s390/kasan: fix early pgm check handler execution * spi: spidev: fix a potential use-after-free in spidev_release() drivers/spi/spidev.c * spi: spidev: fix a race between spidev_release and spidev_remove drivers/spi/spidev.c gpu: host1x: Detach driver on unregister KVM: s390: reduce number of IO pins to 1 ANDROID: cuttlefish_defconfig: Drop built-in cmdline (except nopti) Merge 4.9.230 into android-4.9-q Linux 4.9.230 * efi: Make it possible to disable efivar_ssdt entirely drivers/firmware/efi/Kconfig * netfilter: nf_conntrack_h323: lost .data_len definition for Q.931/ipv6 net/netfilter/nf_conntrack_h323_main.c MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen cifs: Fix the target file was deleted when rename failed. SMB3: Honor persistent/resilient handle flags for multiuser mounts SMB3: Honor 'seal' flag for multiuser mounts * Revert "ALSA: usb-audio: Improve frames size computation" sound/usb/card.h sound/usb/endpoint.c sound/usb/endpoint.h sound/usb/pcm.c i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665 virtio-blk: free vblk-vqs in error path of virtblk_probe() hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add() hwmon: (max6697) Make sure the OVERT mask is set correctly cxgb4: parse TC-U32 key values and masks natively * sched/rt: Show the 'sched_rr_timeslice' SCHED_RR timeslice tuning knob in milliseconds include/linux/sched/sysctl.h kernel/sched/core.c kernel/sched/rt.c kernel/sysctl.c crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() * kgdb: Avoid suspicious RCU usage warning kernel/debug/debug_core.c usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect * mm/slub: fix stack overruns with SLUB_STATS mm/slub.c * mm/slub.c: fix corrupted freechain in deactivate_slab() mm/slub.c usbnet: smsc95xx: Fix use-after-free after removal EDAC/amd64: Read back the scrub rate PCI register on F15h * mm: fix swap cache node allocation mask mm/swap_state.c btrfs: fix data block group relocation failure due to concurrent scrub btrfs: cow_file_range() num_bytes and disk_num_bytes are same btrfs: fix a block group ref counter leak after failure to remove block group Merge 4.9.229 into android-4.9-q Linux 4.9.229 Revert "tty: hvc: Fix data abort due to race in hvc_open" xfs: add agf freeblocks verify in xfs_agf_verify NFSv4 fix CLOSE not waiting for direct IO compeletion pNFS/flexfiles: Fix list corruption if the mirror count changes SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment() sunrpc: fixed rollback in rpc_gssd_dummy_populate() drm/radeon: fix fb_div check in ni_init_smc_spll_table() * tracing: Fix event trigger to accept redundant spaces kernel/trace/trace_events_trigger.c * arm64: perf: Report the PC value in REGS_ABI_32 mode arch/arm64/kernel/perf_regs.c ocfs2: fix panic on nfs server over ocfs2 ocfs2: fix value of OCFS2_INVALID_SLOT ocfs2: load global_inode_alloc * mm/slab: use memzero_explicit() in kzfree() mm/slab_common.c KVM: X86: Fix MSR range of APIC registers in X2APIC mode ACPI: sysfs: Fix pm_profile_attr type ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table * blktrace: break out of blktrace setup on concurrent calls kernel/trace/blktrace.c * kbuild: improve cc-option to clean up all temporary files scripts/Kbuild.include s390/ptrace: fix setting syscall number net: alx: fix race condition in alx_remove ata/libata: Fix usage of page address by page_address in ata_scsi_mode_select_xlat function * sched/core: Fix PI boosting between RT and DEADLINE tasks kernel/sched/core.c netfilter: ipset: fix unaligned atomic access usb: gadget: udc: Potential Oops in error handling code ARM: imx5: add missing put_device() call in imx_suspend_alloc_ocram() net: qed: fix excessive QM ILT lines consumption net: qed: fix NVMe login fails over VFs net: qed: fix left elements count calculation RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads() efi/esrt: Fix reference count leak in esre_create_sysfs_entry. cifs/smb3: Fix data inconsistent when zero file range cifs/smb3: Fix data inconsistent when punch hole * xhci: Poll for U0 after disabling USB2 LPM drivers/usb/host/xhci.c * ALSA: usb-audio: Fix OOB access of mixer element list sound/usb/mixer.c sound/usb/mixer.h sound/usb/mixer_quirks.c * ALSA: usb-audio: Clean up mixer element list traverse sound/usb/mixer.c sound/usb/mixer.h sound/usb/mixer_quirks.c sound/usb/mixer_scarlett.c * ALSA: usb-audio: uac1: Invalidate ctl on interrupt sound/usb/mixer.c cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip * xhci: Fix enumeration issue when setting max packet size for FS devices. drivers/usb/host/xhci.c * xhci: Fix incorrect EP_STATE_MASK drivers/usb/host/xhci.h * ALSA: usb-audio: add quirk for Denon DCD-1500RE sound/usb/quirks.c usb: host: ehci-exynos: Fix error check in exynos_ehci_probe() USB: ehci: reopen solution for Synopsys HC bug * usb: add USB_QUIRK_DELAY_INIT for Logitech C922 drivers/usb/core/quirks.c usb: dwc2: Postponed gadget registration to the udc class driver USB: ohci-sm501: Add missed iounmap() in remove * net: core: reduce recursion limit value include/linux/netdevice.h * net: Do not clear the sock TX queue in sk_set_socket() include/net/sock.h net/core/sock.c * net: Fix the arp error in some cases net/ipv4/fib_semantics.c * sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket include/net/sctp/constants.h * tcp: grow window for OOO packets only for SACK flows net/ipv4/tcp_input.c ip6_gre: fix use-after-free in ip6gre_tunnel_lookup() * tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT net/ipv4/tcp_cubic.c * ip_tunnel: fix use-after-free in ip_tunnel_lookup() net/ipv4/ip_tunnel.c tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes rxrpc: Fix notification call on completion of discarded calls rocker: fix incorrect error handling in dma_rings_init * net: usb: ax88179_178a: fix packet alignment padding drivers/net/usb/ax88179_178a.c * net: fix memleak in register_netdevice() net/core/dev.c * mld: fix memory leak in ipv6_mc_destroy_dev() net/ipv6/mcast.c fix a braino in "sparc32: fix register window handling in genregs32_[gs]et()" * net: sched: export __netdev_watchdog_up() net/sched/sch_generic.c * l2tp: Allow duplicate session creation with UDP net/l2tp/l2tp_core.c * scsi: scsi_devinfo: handle non-terminated strings drivers/scsi/scsi_devinfo.c mtd: rawnand: tmio: Fix the probe error path mtd: rawnand: mtk: Fix the probe error path mtd: rawnand: plat_nand: Fix the probe error path mtd: rawnand: socrates: Fix the probe error path mtd: rawnand: orion: Fix the probe error path mtd: rawnand: xway: Fix the probe error path mtd: rawnand: sharpsl: Fix the probe error path mtd: rawnand: diskonchip: Fix the probe error path mtd: rawnand: Pass a nand_chip object to nand_release() * media: dvb_frontend: fix return error code drivers/media/dvb-core/dvb_frontend.c * media: dvb_frontend: fix wrong cast in compat_ioctl drivers/media/dvb-core/dvb_frontend.c * media: dvb_frontend: Add commands implementation for compat ioct drivers/media/dvb-core/dvb_frontend.c * media: dvb_frontend: Add compat_ioctl callback drivers/media/dvb-core/dvb_frontend.c fs/compat_ioctl.c * media: dvb_frontend: Add unlocked_ioctl in dvb_frontend.c drivers/media/dvb-core/dvb_frontend.c * media: dvb_frontend: be sure to init dvb_frontend_handle_ioctl() return code drivers/media/dvb-core/dvb_frontend.c * media: dvb_frontend: dtv_property_process_set() cleanups drivers/media/dvb-core/dvb_frontend.c * media: dvb_frontend: fix return values for FE_SET_PROPERTY drivers/media/dvb-core/dvb_frontend.c include/uapi/linux/dvb/frontend.h * media: dvb_frontend: better document the -EPERM condition drivers/media/dvb-core/dvb_frontend.c * media: dvb_frontend: get rid of property cache's state drivers/media/dvb-core/dvb_frontend.c drivers/media/dvb-core/dvb_frontend.h * media: dvb_frontend: cleanup ioctl handling logic drivers/media/dvb-core/dvb_frontend.c * media: dvb_frontend: cleanup dvb_frontend_ioctl_properties() drivers/media/dvb-core/dvb_frontend.c * media: dvb_frontend: get rid of set_property() callback drivers/media/dvb-core/dvb_frontend.c drivers/media/dvb-core/dvb_frontend.h media: friio-fe: get rid of set_property() media: stv6110: get rid of a srate dead code media: stv0288: get rid of set_property boilerplate * media: dvb_frontend: get rid of get_property() callback drivers/media/dvb-core/dvb_frontend.c drivers/media/dvb-core/dvb_frontend.h * media: dvb/frontend.h: document the uAPI file include/uapi/linux/dvb/frontend.h * media: dvb/frontend.h: move out a private internal structure drivers/media/dvb-core/dvb_frontend.c include/uapi/linux/dvb/frontend.h * media: dvb_frontend: initialize variable s with FE_NONE instead of 0 drivers/media/dvb-core/dvb_frontend.c * net: core: device_rename: Use rwsem instead of a seqcount net/core/dev.c * sched/rt, net: Use CONFIG_PREEMPTION.patch net/core/dev.c e1000e: Do not wake up the system via WOL if device wakeup is disabled * kretprobe: Prevent triggering kretprobe from within kprobe_flush_task include/linux/kprobes.h x86/kprobes: Avoid kretprobe recursion bug powerpc/kprobes: Fixes for kprobe_lookup_name() on BE kprobes: Fix to protect kick_kprobe_optimizer() by kprobe_mutex * crypto: algboss - don't wait during notifier callback crypto/algboss.c drm/i915: Whitelist context-local timestamp in the gen9 cmdparser s390: fix syscall_get_error for compat processes * block: nr_sects_write(): Disable preemption on seqcount write include/linux/genhd.h x86/boot/compressed: Relax sed symbol type regex for LLVM ld.lld * drm/dp_mst: Increase ACT retry timeout to 3s drivers/gpu/drm/drm_dp_mst_topology.c * ext4: fix partial cluster initialization when splitting extent fs/ext4/extents.c * selinux: fix double free security/selinux/ss/services.c drm/qxl: Use correct notify port address when creating cursor ring * drm/dp_mst: Reformat drm_dp_check_act_status() a bit drivers/gpu/drm/drm_dp_mst_topology.c * drm: encoder_slave: fix refcouting error for modules drivers/gpu/drm/drm_encoder_slave.c libata: Use per port sync for detach * block: Fix use-after-free in blkdev_get() fs/block_dev.c bcache: fix potential deadlock problem in btree_gc_coalesce perf report: Fix NULL pointer dereference in hists__fprintf_nr_sample_events() usb/ehci-platform: Set PM runtime as active on resume * usb/xhci-plat: Set PM runtime as active on resume drivers/usb/host/xhci-plat.c scsi: acornscsi: Fix an error handling path in acornscsi_probe() selftests/net: in timestamping, strncpy needs to preserve null byte selftests/vm/pkeys: fix alloc_random_pkey() to make it really random * elfnote: mark all .note sections SHF_ALLOC include/linux/elfnote.h * include/linux/bitops.h: avoid clang shift-count-overflow warnings include/linux/bitops.h * lib/zlib: remove outdated and incorrect pre-increment optimization lib/zlib_inflate/inffast.c crypto: omap-sham - add proper load balancing support for multicore pinctrl: imxl: Fix an error handling path in 'imx1_pinctrl_core_probe()' scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj gfs2: Allow lock_nolock mount to specify jid=X openrisc: Fix issue with argument clobbering for clone/fork ASoC: fsl_asrc_dma: Fix dma_chan leak when config DMA channel failed extcon: adc-jack: Fix an error handling path in 'adc_jack_probe()' NFSv4.1 fix rpc_call_done assignment for BIND_CONN_TO_SESSION net: sunrpc: Fix off-by-one issues in 'rpc_ntop6' clk: bcm2835: Fix return type of bcm2835_register_gate * usb: gadget: Fix issue with config_ep_by_speed function drivers/usb/gadget/composite.c include/linux/usb/composite.h usb: gadget: fix potential double-free in m66592_probe. usb: gadget: lpc32xx_udc: don't dereference ep pointer before null check USB: gadget: udc: s3c2410_udc: Remove pointless NULL check in s3c2410_udc_nuke usb: dwc2: gadget: move gadget resume after the core is in L0 state watchdog: da9062: No need to ping manually before setting timeout IB/cma: Fix ports memory leak in cma_configfs PCI/PTM: Inherit Switch Downstream Port PTM settings from Upstream Port powerpc/64s/pgtable: fix an undefined behaviour clk: samsung: exynos5433: Add IGNORE_UNUSED flag to sclk_i2s1 tty: n_gsm: Fix bogus i++ in gsm_data_kick USB: host: ehci-mxc: Add error handling in ehci_mxc_drv_probe() drm/msm/mdp5: Fix mdp5_init error path for failed mdp5_kms allocation usb/ohci-platform: Fix a warning when hibernating vfio-pci: Mask cap zero powerpc/ps3: Fix kexec shutdown hang powerpc/pseries/ras: Fix FWNMI_VALID off by one tty: n_gsm: Fix waking up upper tty layer when room available tty: n_gsm: Fix SOF skipping clk: ti: composite: fix memory leak dlm: remove BUG() before panic() scsi: mpt3sas: Fix double free warnings power: supply: smb347-charger: IRQSTAT_D is volatile power: supply: lp8788: Fix an error handling path in 'lp8788_charger_probe()' PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges PCI: rcar: Fix incorrect programming of OB windows * drivers: base: Fix NULL pointer exception in __platform_driver_probe() if a driver developer is foolish drivers/base/platform.c serial: amba-pl011: Make sure we initialize the port.lock spinlock i2c: pxa: fix i2c_pxa_scream_blue_murder() debug output staging: sm750fb: add missing case while setting FB_VISUAL tty: hvc: Fix data abort due to race in hvc_open s390/qdio: put thinint indicator after early error * ALSA: usb-audio: Improve frames size computation sound/usb/card.h sound/usb/endpoint.c sound/usb/endpoint.h sound/usb/pcm.c scsi: ibmvscsi: Don't send host info in adapter info MAD after LPM scsi: sr: Fix sr_probe() missing deallocate of device minor * mksysmap: Fix the mismatch of '.L' symbols in System.map scripts/mksysmap yam: fix possible memory leak in yam_init_driver powerpc/crashkernel: Take "mem=" option into account nfsd: Fix svc_xprt refcnt leak when setup callback client failed powerpc/perf/hv-24x7: Fix inconsistent output values incase multiple hv-24x7 events run clk: clk-flexgen: fix clock-critical handling scsi: lpfc: Fix lpfc_nodelist leak when processing unsolicited event mfd: wm8994: Fix driver operation if loaded as modules vfio/pci: fix memory leaks in alloc_perm_bits() ps3disk: use the default segment boundary PCI: aardvark: Don't blindly enable ASPM L0s and don't write to read-only register usblp: poison URBs upon disconnect i2c: pxa: clear all master action bits in i2c_pxa_stop_message() iio: bmp280: fix compensation of humidity scsi: qla2xxx: Fix issue with adapter's stopping state ALSA: isa/wavefront: prevent out of bounds write in ioctl ARM: integrator: Add some Kconfig selections backlight: lp855x: Ensure regulators are disabled on probe failure clk: qcom: msm8916: Fix the address location of pll->config_reg iio: pressure: bmp280: Tolerate IRQ before registering i2c: piix4: Detect secondary SMBus controller on AMD AM4 chipsets clk: sunxi: Fix incorrect usage of round_down() * power: supply: bq24257_charger: Replace depends on REGMAP_I2C with select drivers/power/supply/Kconfig Change-Id: I9fdac4691b013061a19d375293b7049b999830d0 Signed-off-by: lucaswei <lucaswei@google.com>	2020-08-11 20:25:36 +08:00
Frederic Weisbecker	b1ba1298d5	timer: Fix wheel index calculation on last level commit e2a71bdea81690b6ef11f4368261ec6f5b6891aa upstream. When an expiration delta falls into the last level of the wheel, that delta has be compared against the maximum possible delay and reduced to fit in if necessary. However instead of comparing the delta against the maximum, the code compares the actual expiry against the maximum. Then instead of fixing the delta to fit in, it sets the maximum delta as the expiry value. This can result in various undesired outcomes, the worst possible one being a timer expiring 15 days ahead to fire immediately. Fixes: `500462a9de` ("timers: Switch to a non-cascading wheel") Signed-off-by: Frederic Weisbecker <frederic@kernel.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20200717140551.29076-2-frederic@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-07-22 09:10:53 +02:00
lucaswei	fe4d25c70e	Merge android-4.9-q (4.9.200) into android-msm-pixel-4.9-lts Merge 4.9.200 into android-4.9-q Linux 4.9.200 * alarmtimer: Change remaining ENOTSUPP to EOPNOTSUPP kernel/time/alarmtimer.c dmaengine: qcom: bam_dma: Fix resource leak * net/flow_dissector: switch to siphash include/linux/skbuff.h include/net/flow_dissector.h net/core/flow_dissector.c net/sched/sch_fq_codel.c * kbuild: add -fcf-protection=none when using retpoline flags Makefile * kbuild: use -fmacro-prefix-map to make __FILE__ a relative path Makefile * Kbuild: make designated_init attribute fatal Makefile * inet: stop leaking jiffies on the wire net/ipv4/datagram.c net/ipv4/tcp_ipv4.c net/mlx4_core: Dynamically set guaranteed amount of counters per VF vxlan: check tun_info options_len properly net: bcmgenet: reset 40nm EPHY on energy detect net: dsa: fix switch tree list * net: add READ_ONCE() annotation in __skb_wait_for_more_packets() net/core/datagram.c selftests: net: reuseport_dualstack: fix uninitalized parameter * net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol() net/core/ethtool.c net: hisilicon: Fix ping latency when deal with high throughput * net: fix sk_page_frag() recursion from memory reclaim include/linux/gfp.h include/net/sock.h dccp: do not leak jiffies on the wire cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs MIPS: bmips: mark exception vectors as char arrays of: unittest: fix memory leak in unittest_data_add scsi: target: core: Do not overwrite CDB byte 1 ARM: davinci: dm365: Fix McBSP dma_slave_map entry perf kmem: Fix memory leak in compact_gfp_flags() ARM: dts: imx7s: Correct GPT's ipg clock source * scsi: fix kconfig dependency warning related to 53C700_LE_ON_BE drivers/scsi/Kconfig scsi: sni_53c710: fix compilation error scsi: scsi_dh_alua: handle RTPG sense code correctly during state transitions ARM: mm: fix alignment handler faults under memory pressure pinctrl: ns2: Fix off by one bugs in ns2_pinmux_enable() ARM: dts: logicpd-torpedo-som: Remove twl_keypad ASoc: rockchip: i2s: Fix RPM imbalance ASoC: wm_adsp: Don't generate kcontrols without READ flags regulator: pfuze100-regulator: Variable "val" in pfuze100_regulator_probe() could be uninitialized regulator: ti-abb: Fix timeout in ti_abb_wait_txdone/ti_abb_clear_all_txdone UPSTREAM: HID: steam: fix deadlock with input devices. UPSTREAM: HID: steam: fix boot loop with bluetooth firmware UPSTREAM: HID: steam: remove input device when a hid client is running. UPSTREAM: HID: steam: use hid_device.driver_data instead of hid_set_drvdata() UPSTREAM: HID: steam: add missing fields in client initialization UPSTREAM: HID: steam: add battery device. * UPSTREAM: HID: add driver for Valve Steam Controller drivers/hid/Kconfig drivers/hid/Makefile drivers/hid/hid-core.c drivers/hid/hid-ids.h include/linux/hid.h * UPSTREAM: HID: sony: Fix memory corruption issue on cleanup. drivers/hid/hid-sony.c * UPSTREAM: HID: sony: Fix race condition between rumble and device remove. drivers/hid/hid-sony.c Merge 4.9.199 into android-4.9-q Linux 4.9.199 Revert "ALSA: hda: Flush interrupts on disabling" * ALSA: timer: Fix mutex deadlock at releasing card sound/core/timer.c * ALSA: timer: Simplify error path in snd_timer_open() sound/core/timer.c * ALSA: timer: Limit max instances per timer include/sound/timer.h sound/core/timer.c * ALSA: timer: Follow standard EXPORT_SYMBOL() declarations sound/core/timer.c xfs: Correctly invert xfs_buftarg LRU isolation logic sctp: not bind the socket in sctp_connect * sctp: fix the issue that flags are ignored when using kernel_connect include/net/sctp/sctp.h * sch_netem: fix rcu splat in netem_enqueue() include/net/sch_generic.h net/sched/sch_netem.c net: usb: sr9800: fix uninitialized local variable * bonding: fix potential NULL deref in bond_update_slave_arr drivers/net/bonding/bond_main.c llc: fix sk_buff leak in llc_conn_service() llc: fix sk_buff leak in llc_sap_state_process() dmaengine: cppi41: Fix cppi41_dma_prep_slave_sg() when idle rtlwifi: Fix potential overflow on P2P code s390/cmm: fix information leak in cmm_timeout_handler() * nl80211: fix validation of mesh path nexthop net/wireless/nl80211.c * HID: fix error message in hid_open_report() drivers/hid/hid-core.c * HID: Fix assumption that devices have inputs drivers/hid/hid-dr.c drivers/hid/hid-gaff.c drivers/hid/hid-sony.c HID: i2c-hid: add Trekstor Primebook C11B to descriptor override USB: serial: whiteheat: fix line-speed endianness USB: serial: whiteheat: fix potential slab corruption USB: ldusb: fix control-message timeout USB: ldusb: fix ring-buffer locking * usb-storage: Revert commit 747668dbc061 ("usb-storage: Set virt_boundary_mask to avoid SG overflows") drivers/usb/storage/scsiglue.c * USB: gadget: Reject endpoints with 0 maxpacket value drivers/usb/gadget/udc/core.c UAS: Revert commit 3ae62a42090f ("UAS: fix alignment of scatter/gather segments") ALSA: bebob: Fix prototype of helper function to return negative value * fuse: truncate pending writes on O_TRUNC fs/fuse/file.c * fuse: flush dirty data/metadata before non-truncate setattr fs/fuse/dir.c ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe() thunderbolt: Use 32-bit writes when writing ring producer/consumer USB: legousbtower: fix a signedness bug in tower_probe() * tracing: Initialize iter->seq after zeroing in tracing_read_pipe() kernel/trace/trace.c s390/uaccess: avoid (false positive) compiler warnings NFSv4: Fix leak of clp->cl_acceptor string MIPS: fw: sni: Fix out of bounds init of o32 stack fs: ocfs2: fix a possible null-pointer dereference in ocfs2_info_scan_inode_alloc() fs: ocfs2: fix a possible null-pointer dereference in ocfs2_write_end_nolock() fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry() ocfs2: clear zero in unaligned direct IO efi/x86: Do not clean dummy variable in kexec path efi/cper: Fix endianness of PCIe class code serial: mctrl_gpio: Check for NULL pointer fs: cifs: mute -Wunused-const-variable message gpio: max77620: Use correct unit for debounce times RDMA/iwcm: Fix a lock inversion issue staging: rtl8188eu: fix null dereference when kzalloc fails perf jevents: Fix period for Intel fixed counters perf map: Fix overlapped map handling iio: fix center temperature of bmc150-accel-core * exec: load_script: Do not exec truncated interpreter path fs/binfmt_script.c rtc: pcf8523: set xtal load capacitance from DT * usb: handle warm-reset port requests on hub resume drivers/usb/core/hub.c * scripts/setlocalversion: Improve -dirty check with git-status --no-optional-locks scripts/setlocalversion HID: i2c-hid: Add Odys Winbook 13 to descriptor override x86/cpu: Add Atom Tremont (Jacobsville) HID: i2c-hid: add Direkt-Tek DTLAPY133-1 to descriptor override sc16is7xx: Fix for "Unexpected interrupt: 8" * dm: Use kzalloc for all structs with embedded biosets/mempools drivers/md/dm-io.c drivers/md/dm-kcopyd.c dm snapshot: rework COW throttling to fix deadlock dm snapshot: introduce account_start_copy() and account_end_copy() dm snapshot: use mutex instead of rw_semaphore * binder: binder: fix possible UAF when freeing buffer drivers/android/binder.c * BACKPORT: dm bufio: introduce a global cache replacement drivers/md/dm-bufio.c * BACKPORT: dm bufio: remove old-style buffer cleanup drivers/md/dm-bufio.c * BACKPORT: dm bufio: introduce a global queue drivers/md/dm-bufio.c * BACKPORT: dm bufio: refactor adjust_total_allocated drivers/md/dm-bufio.c * BACKPORT: dm bufio: call adjust_total_allocated from __link_buffer and __unlink_buffer drivers/md/dm-bufio.c cuttlefish-4.9: Enable CONFIG_DM_SNAPSHOT Merge 4.9.198 into android-4.9-q Linux 4.9.198 RDMA/cxgb4: Do not dma memory off of the stack * Revert "net: sit: fix memory leak in sit_init_net()" net/ipv6/sit.c * PCI: PM: Fix pci_power_up() drivers/pci/pci.c xen/netback: fix error path of xenvif_connect_data() * cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown drivers/base/core.c drivers/cpufreq/cpufreq.c memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()' btrfs: block-group: Fix a memory leak due to missing btrfs_put_block_group() CIFS: avoid using MID 0xFFFF parisc: Fix vmap memory leak in ioremap()/iounmap() xtensa: drop EXPORT_SYMBOL for outs/ins * mm/slub: fix a deadlock in show_slab_objects() mm/slub.c scsi: zfcp: fix reaction on bit error threshold notification * drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50 drivers/gpu/drm/drm_edid.c mac80211: Reject malformed SSID elements cfg80211: wext: avoid copying malformed SSIDs ASoC: rsnd: Reinitialize bit clock inversion flag for every format setting Input: da9063 - fix capability and drop KEY_SLEEP * scsi: core: try to get module before removing device drivers/scsi/scsi_sysfs.c staging: wlan-ng: fix exit return when sme->key_idx >= NUM_WEPKEYS MIPS: tlbex: Fix build_restore_pagemask KScratch restore USB: ldusb: fix read info leaks USB: usblp: fix use-after-free on disconnect USB: ldusb: fix memleak on disconnect USB: serial: ti_usb_3410_5052: fix port-close races usb: udc: lpc32xx: fix bad bit shift operation ALSA: hda/realtek - Add support for ALC711 USB: legousbtower: fix memleak on disconnect * memfd: Fix locking when tagging pins mm/shmem.c * ipv4: Return -ENETUNREACH if we can't create route but saddr is valid net/ipv4/route.c * net: avoid potential infinite loop in tc_ctl_action() net/sched/act_api.c sctp: change sctp_prot .no_autobind with true net: bcmgenet: Set phydev->dev_flags only for internal PHYs net: bcmgenet: Fix RGMII_MODE_EN value for GENET v1/2/3 * loop: Add LOOP_SET_DIRECT_IO to compat ioctl drivers/block/loop.c ocfs2: fix panic due to ocfs2_wq is null Revert "drm/radeon: Fix EEH during kexec" namespace: fix namespace.pl script to support relative paths net: hisilicon: Fix usage of uninitialized variable in function mdio_sc_cfg_reg_write() mips: Loongson: Fix the link time qualifier of 'serial_exit()' mac80211: fix txq null pointer dereference * nl80211: fix null pointer dereference net/wireless/nl80211.c MIPS: dts: ar9331: fix interrupt-controller size ARM: dts: am4372: Set memory bandwidth limit for DISPC ARM: OMAP2+: Fix missing reset done flag for am3 and am43 scsi: qla2xxx: Fix unbound sleep in fcport delete path. scsi: megaraid: disable device when probe failed after enabled device * scsi: ufs: skip shutdown if hba is not powered drivers/scsi/ufs/ufshcd.c rtlwifi: Fix potential overflow on P2P code ANDROID: clang: update to 9.0.8 based on r365631c * ANDROID: move up spin_unlock_bh() ahead of remove_proc_entry() net/netfilter/xt_quota2.c ANDROID: refactor build.config files to remove duplication Merge 4.9.197 into android-4.9-q Linux 4.9.197 xfs: clear sb->s_fs_info on mount failure x86/asm: Fix MWAITX C-state hint value * tracing: Get trace_array reference for available_tracers files kernel/trace/trace.c tracing/hwlat: Don't ignore outer-loop duration when calculating max_latency tracing/hwlat: Report total time spent in all NMIs during the sample media: stkwebcam: fix runtime PM after driver unbind * Fix the locking in dcache_readdir() and friends fs/libfs.c MIPS: Disable Loongson MMI instructions for kernel build Staging: fbtft: fix memory leak in fbtft_framebuffer_alloc staging: fbtft: Stop using BL_CORE_DRIVER1 * kernel/sysctl.c: do not override max_threads provided by userspace kernel/fork.c CIFS: Force reval dentry if LOOKUP_REVAL flag is set CIFS: Force revalidate inode when dentry is stale CIFS: Gracefully handle QueryInfo errors during open perf inject jit: Fix JIT_CODE_MOVE filename perf llvm: Don't access out-of-scope array efivar/ssdt: Don't iterate over EFI vars if no SSDT override was specified iio: light: opt3001: fix mutex unlock race iio: adc: ad799x: fix probe error handling staging: vt6655: Fix memory leak in vt6655_probe USB: legousbtower: fix use-after-free on release USB: legousbtower: fix open after failed reset request USB: legousbtower: fix potential NULL-deref on disconnect USB: legousbtower: fix deadlock on disconnect USB: legousbtower: fix slab info leak at probe usb: renesas_usbhs: gadget: Fix usb_ep_set_{halt,wedge}() behavior usb: renesas_usbhs: gadget: Do not discard queues in usb_ep_set_{halt,wedge}() USB: dummy-hcd: fix power budget for SuperSpeed mode USB: microtek: fix info-leak at probe USB: usblcd: fix I/O after disconnect USB: serial: fix runtime PM after driver unbind USB: serial: option: add support for Cinterion CLS8 devices USB: serial: option: add Telit FN980 compositions USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20 USB: serial: keyspan: fix NULL-derefs on open() and write() serial: uartlite: fix exit path null pointer USB: ldusb: fix NULL-derefs on driver unbind USB: chaoskey: fix use-after-free on release USB: usblp: fix runtime PM after driver unbind USB: iowarrior: fix use-after-free after driver unbind USB: iowarrior: fix use-after-free on release USB: iowarrior: fix use-after-free on disconnect USB: adutux: fix use-after-free on release USB: adutux: fix NULL-derefs on disconnect USB: adutux: fix use-after-free on disconnect USB: adutux: remove redundant variable minor * xhci: Increase STS_SAVE timeout in xhci_suspend() drivers/usb/host/xhci.c * usb: xhci: wait for CNR controller not ready bit in xhci resume drivers/usb/host/xhci.c * xhci: Check all endpoints for LPM timeout drivers/usb/host/xhci.c * xhci: Prevent device initiated U1/U2 link pm if exit latency is too long drivers/usb/host/xhci.c * xhci: Fix false warning message about wrong bounce buffer write length drivers/usb/host/xhci-ring.c USB: usb-skeleton: fix NULL-deref on disconnect USB: usb-skeleton: fix runtime PM after driver unbind USB: yurex: fix NULL-derefs on disconnect USB: yurex: Don't retry on unexpected errors * USB: rio500: Remove Rio 500 kernel driver drivers/usb/misc/Kconfig drivers/usb/misc/Makefile * panic: ensure preemption is disabled during panic() kernel/panic.c ASoC: sgtl5000: Improve VAG power and mute control * nl80211: validate beacon head net/wireless/nl80211.c * cfg80211: Use const more consistently in for_each_element macros include/linux/ieee80211.h * cfg80211: add and use strongly typed element iteration macros include/linux/ieee80211.h net/wireless/scan.c coresight: etm4x: Use explicit barriers on enable/disable crypto: caam - fix concurrency issue in givencrypt descriptor perf stat: Reset previous counts on repeat with interval perf stat: Fix a segmentation fault when using repeat forever perf tools: Fix segfault in cpu_cache_level__read() tools lib traceevent: Do not free tep->cmdlines in add_new_comm() on failure * kernel/elfcore.c: include proper prototypes kernel/elfcore.c * sched/core: Fix migration to invalid CPU in __set_cpus_allowed_ptr() kernel/sched/core.c fuse: fix memleak in cuse_channel_open * thermal: Fix use-after-free when unregistering thermal zone device drivers/thermal/thermal_core.c drm/amdgpu: Check for valid number of registers to read ceph: reconnect connection if session hang in opening state ceph: fix directories inode i_blkbits initialization xen/pci: reserve MCFG areas earlier 9p: avoid attaching writeback_fid on mmap with type PRIVATE fs: nfs: Fix possible null-pointer dereferences in encode_attrs() ima: always return negative code for error * cfg80211: initialize on-stack chandefs net/wireless/nl80211.c net/wireless/reg.c ieee802154: atusb: fix use-after-free at disconnect watchdog: imx2_wdt: fix min() calculation in imx2_wdt_set_timeout * timer: Read jiffies once when forwarding base clk kernel/time/timer.c * usercopy: Avoid HIGHMEM pfn warning mm/usercopy.c crypto: qat - Silence smp_processor_id() warning can: mcp251x: mcp251x_hw_reset(): allow more time after a reset powerpc/powernv: Restrict OPAL symbol map to only be readable by root * ASoC: Define a set of DAPM pre/post-up events include/sound/soc-dapm.h KVM: nVMX: handle page fault in vmread fix s390/cio: exclude subchannels with no parent from pseudo check s390/cio: avoid calling strlen on null pointer s390/topology: avoid firing events before kobjs are created KVM: s390: Test for bad access register and size at the start of S390_MEM_OP ANDROID: cuttlefish_defconfig: Enable BPF_JIT and BPF_JIT_ALWAYS_ON Change-Id: Ie9c99a9fcb1ee411aea4da0b1c4a454989142343 Signed-off-by: lucaswei <lucaswei@google.com>	2019-11-22 13:45:46 +08:00
Li RongQing	75be612c1e	timer: Read jiffies once when forwarding base clk commit e430d802d6a3aaf61bd3ed03d9404888a29b9bf9 upstream. The timer delayed for more than 3 seconds warning was triggered during testing. Workqueue: events_unbound sched_tick_remote RIP: 0010:sched_tick_remote+0xee/0x100 ... Call Trace: process_one_work+0x18c/0x3a0 worker_thread+0x30/0x380 kthread+0x113/0x130 ret_from_fork+0x22/0x40 The reason is that the code in collect_expired_timers() uses jiffies unprotected: if (next_event > jiffies) base->clk = jiffies; As the compiler is allowed to reload the value base->clk can advance between the check and the store and in the worst case advance farther than next event. That causes the timer expiry to be delayed until the wheel pointer wraps around. Convert the code to use READ_ONCE() Fixes: `236968383c` ("timers: Optimize collect_expired_timers() for NOHZ") Signed-off-by: Li RongQing <lirongqing@baidu.com> Signed-off-by: Liang ZhiCheng <liangzhicheng@baidu.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/1568894687-14499-1-git-send-email-lirongqing@baidu.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-10-17 13:42:06 -07:00
Petri Gynther	3a43cd6da1	Merge 4.9.128 into android-msm-bluecross-4.9-lts Linux 4.9.128 * mm: get rid of vmacache_flush_all() entirely include/linux/mm_types.h include/linux/sched.h include/linux/vm_event_item.h include/linux/vmacache.h mm/debug.c mm/vmacache.c autofs: fix autofs_sbi() does not check super block type mtd: ubi: wl: Fix error return code in ubi_wl_init() * netfilter: x_tables: avoid stack-out-of-bounds read in xt_copy_counters_from_user net/netfilter/x_tables.c * xhci: Fix use-after-free in xhci_free_virt_device drivers/usb/host/xhci.c RDMA/cma: Do not ignore net namespace for unbound cm_id MIPS: WARN_ON invalid DMA cache maintenance, not BUG_ON NFSv4.1: Fix a potential layoutget/layoutrecall deadlock * f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize fs/f2fs/super.c mfd: ti_am335x_tscadc: Fix struct clk memory leak iommu/ipmmu-vmsa: Fix allocation in atomic context * f2fs: Fix uninitialized return in f2fs_ioc_shutdown() fs/f2fs/file.c media: helene: fix xtal frequency setting at power on partitions/aix: fix usage of uninitialized lv_info and lvname structures partitions/aix: append null character to print data from disk media: s5p-mfc: Fix buffer look up in s5p_mfc_handle_frame_{new, copy_time} functions Input: atmel_mxt_ts - only use first T9 instance net: dcb: For wild-card lookups, use priority -1, not 0 MIPS: generic: fix missing of_node_put() MIPS: Octeon: add missing of_node_put() * f2fs: fix to do sanity check with reserved blkaddr of inline inode fs/f2fs/inline.c tpm/tpm_i2c_infineon: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT) tpm_tis_spi: Pass the SPI IRQ down to the driver * f2fs: fix to skip GC if type in SSA and SIT is inconsistent fs/f2fs/gc.c * f2fs: try grabbing node page lock aggressively in sync scenario fs/f2fs/node.c net: mvneta: fix mtu change on port without link gpio: ml-ioh: Fix buffer underwrite on probe error path x86/mm: Remove in_nmi() warning from vmalloc_fault() Bluetooth: hidp: Fix handling of strncpy for hid->name information ath10k: disable bundle mgmt tx completion event support scsi: 3ware: fix return 0 on the error path of probe ata: libahci: Correct setting of DEVSLP register MIPS: Fix ISA virt/bus conversion for non-zero PHYS_OFFSET wlcore: Set rx_status boottime_ns field on rx ath10k: prevent active scans on potential unusable channels ath9k_hw: fix channel maximum power level test ath9k: report tx status on EOSP macintosh/via-pmu: Add missing mmio accessors NFSv4.0 fix client reference leak in callback perf tools: Allow overriding MAX_NR_CPUS at compile time * f2fs: do not set free of current section fs/f2fs/segment.h tty: rocket: Fix possible buffer overwrite on register_PCI * uio: potential double frees if __uio_register_device() fails drivers/uio/uio.c misc: ti-st: Fix memory leak in the error path of probe() * timers: Clear timer_base::must_forward_clk with timer_base::lock held kernel/time/timer.c md/raid5: fix data corruption of replacements after originals dropped scsi: target: fix __transport_register_session locking net: phy: Fix the register offsets in Broadcom iProc mdio mux driver gpio: tegra: Move driver registration to subsys_init level * Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV drivers/bluetooth/Kconfig * ethtool: Remove trailing semicolon for static inline include/uapi/linux/ethtool.h misc: mic: SCIF Fix scif_get_new_port() error handling ARC: [plat-axs]: Enable SWAP mm: remove seemingly spurious reclaimability check from laptop_mode gating mm/vmscan.c * mm, vmscan: clear PGDAT_WRITEBACK when zone is balanced mm/vmscan.c * locking/osq_lock: Fix osq_lock queue corruption kernel/locking/osq_lock.c * selinux: use GFP_NOWAIT in the AVC kmem_caches security/selinux/avc.c * locking/rwsem-xadd: Fix missed wakeup due to reordering of load kernel/locking/rwsem-xadd.c * nl80211: fix null-ptr dereference on invalid mesh configuration net/wireless/nl80211.c * block,blkcg: use __GFP_NOWARN for best-effort allocations in blkcg block/cfq-iosched.c IB/rxe: do not copy extra stack memory to skb staging/rts5208: Fix read overflow in memcpy staging: rt5208: Fix a sleep-in-atomic bug in xd_copy_page kthread: fix boot hang (regression) on MIPS/OpenRISC * kthread: Fix use-after-free if kthread fork fails kernel/fork.c * cfq: Give a chance for arming slice idle timer in case of group_idle block/cfq-iosched.c ALSA: hda - Fix cancel_work_sync() stall from jackpoll work KVM: s390: vsie: copy wrapping keys to right place i2c: i801: fix DNV's SMBCTRL register offset i2c: xiic: Make the start and the byte count write atomic Change-Id: I03ae26089478b4bb59bee9384a2cf47840a8c9ad Signed-off-by: Petri Gynther <pgynther@google.com>	2018-12-18 19:45:42 -08:00
Gaurav Kohli	05cb385f95	timers: Clear timer_base::must_forward_clk with timer_base::lock held [ Upstream commit 363e934d8811d799c88faffc5bfca782fd728334 ] timer_base::must_forward_clock is indicating that the base clock might be stale due to a long idle sleep. The forwarding of the base clock takes place in the timer softirq or when a timer is enqueued to a base which is idle. If the enqueue of timer to an idle base happens from a remote CPU, then the following race can happen: CPU0 CPU1 run_timer_softirq mod_timer base = lock_timer_base(timer); base->must_forward_clk = false if (base->must_forward_clk) forward(base); -> skipped enqueue_timer(base, timer, idx); -> idx is calculated high due to stale base unlock_timer_base(timer); base = lock_timer_base(timer); forward(base); The root cause is that timer_base::must_forward_clk is cleared outside the timer_base::lock held region, so the remote queuing CPU observes it as cleared, but the base clock is still stale. This can cause large granularity values for timers, i.e. the accuracy of the expiry time suffers. Prevent this by clearing the flag with timer_base::lock held, so that the forwarding takes place before the cleared flag is observable by a remote CPU. Signed-off-by: Gaurav Kohli <gkohli@codeaurora.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: john.stultz@linaro.org Cc: sboyd@kernel.org Cc: linux-arm-msm@vger.kernel.org Link: https://lkml.kernel.org/r/1533199863-22748-1-git-send-email-gkohli@codeaurora.org Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-09-19 22:47:13 +02:00
Rick Yiu	03b77bf9f1	timers: Change cpu_relax() in del_timer_sync() to udelay(1) instead There is lock contention found between del_timer_sync() and __mod_timer() as well as del_timer_sync() and expire_timers(). The root cause and workaround is pretty much the same as b/79694843, where cpu_relax is not effective to break the contention. Therefore, use udelay(1) instead. Bug: 110056388 Test: manual - flash device and check using a trace Change-Id: I32d798b0713d9a58b15fc00049de780c6ad52dcb Signed-off-by: Rick Yiu <rickyiu@google.com>	2018-06-15 17:44:42 +00:00
Blagovest Kolenichev	16b6ed19fc	Merge android-4.9.87 (`a290494`) into msm-4.9 * refs/heads/tmp-a290494: Linux 4.9.87 btrfs: preserve i_mode if __btrfs_set_acl() fails bpf, ppc64: fix out of bounds access in tail call bpf: add schedule points in percpu arrays management bpf, arm64: fix out of bounds access in tail call bpf, x64: implement retpoline for tail call bpf: fix mlock precharge on arraymaps bpf: fix wrong exposure of map_flags into fdinfo for lpm mpls, nospec: Sanitize array index in mpls_label_ok() net: mpls: Pull common label check into helper sctp: verify size of a new chunk in _sctp_make_chunk() s390/qeth: fix IPA command submission race s390/qeth: fix IP address lookup for L3 devices s390/qeth: fix double-free on IP add/remove race s390/qeth: fix IP removal on offline cards s390/qeth: fix overestimated count of buffer elements s390/qeth: fix SETIP command handling s390/qeth: fix underestimated count of buffer elements sctp: fix dst refcnt leak in sctp_v6_get_dst() tcp_bbr: better deal with suboptimal GSO rxrpc: Fix send in rxrpc_send_data_packet() tcp: Honor the eor bit in tcp_mtu_probe net: phy: fix phy_start to consider PHY_IGNORE_INTERRUPT mlxsw: spectrum_switchdev: Check success of FDB add operation sctp: fix dst refcnt leak in sctp_v4_get_dst udplite: fix partial checksum initialization ppp: prevent unregistered channels from connecting to PPP units netlink: ensure to loop over all netns in genlmsg_multicast_allns() net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68 net: fix race on decreasing number of TX queues ipv6 sit: work around bogus gcc-8 -Wrestrict warning hdlc_ppp: carrier detect ok, don't turn off negotiation fib_semantics: Don't match route with mismatching tclassid bridge: check brport attr show in brport_show x86/apic/vector: Handle legacy irq data correctly netlink: put module reference if dump start fails md: only allow remove_and_add_spares when no sync_thread running. x86/speculation: Use Indirect Branch Prediction Barrier in context switch x86/mm: Give each mm TLB flush generation a unique ID ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux ARM: dts: LogicPD SOM-LV: Fix I2C1 pinmux dm io: fix duplicate bio completion due to missing ref count PCI/ASPM: Deal with missing root ports in link state handling KVM/VMX: Optimize vmx_vcpu_run() and svm_vcpu_run() by marking the RDMSR path as unlikely() KVM/x86: Remove indirect MSR op calls from SPEC_CTRL KVM: mmu: Fix overlap between public and private memslots ARM: kvm: fix building with gcc-8 ARM: mvebu: Fix broken PL310_ERRATA_753970 selects nospec: Allow index argument to have const-qualified type media: m88ds3103: don't call a non-initalized function x86/platform/intel-mid: Handle Intel Edison reboot correctly x86/xen: Zero MSR_IA32_SPEC_CTRL before suspend dax: fix vma_is_fsdax() helper cpufreq: s3c24xx: Fix broken s3c_cpufreq_init() parisc: Fix ordering of cache and TLB flushes timers: Forward timer base before migrating timers ALSA: hda - Fix pincfg at resume on Lenovo T470 dock ALSA: hda: Add a power_save blacklist ALSA: usb-audio: Add a quirck for B&W PX headphones tpm-dev-common: Reject too short writes tpm_tis_spi: Use DMA-safe memory for SPI transfers tpm: constify transmit data pointers tpm_tis: fix potential buffer overruns caused by bit glitches on the bus tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus FROMLIST: ARM: amba: Don't read past the end of sysfs "driver_override" buffer UPSTREAM: ANDROID: binder: remove WARN() for redundant txn error Conflicts: kernel/time/timer.c Change-Id: I302546c52a480e9a4c661accf021766c499739b9 Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>	2018-04-17 10:39:47 -07:00
Lingutla Chandrasekhar	13e75c74cd	timers: Forward timer base before migrating timers commit c52232a49e203a65a6e1a670cd5262f59e9364a0 upstream. On CPU hotunplug the enqueued timers of the unplugged CPU are migrated to a live CPU. This happens from the control thread which initiated the unplug. If the CPU on which the control thread runs came out from a longer idle period then the base clock of that CPU might be stale because the control thread runs prior to any event which forwards the clock. In such a case the timers from the unplugged CPU are queued on the live CPU based on the stale clock which can cause large delays due to increased granularity of the outer timer wheels which are far away from base:;clock. But there is a worse problem than that. The following sequence of events illustrates it: - CPU0 timer1 is queued expires = 59969 and base->clk = 59131. The timer is queued at wheel level 2, with resulting expiry time = 60032 (due to level granularity). - CPU1 enters idle @60007, with next timer expiry @60020. - CPU0 is hotplugged at @60009 - CPU1 exits idle and runs the control thread which migrates the timers from CPU0 timer1 is now queued in level 0 for immediate handling in the next softirq because the requested expiry time 59969 is before CPU1 base->clk 60007 - CPU1 runs code which forwards the base clock which succeeds because the next expiring timer. which was collected at idle entry time is still set to 60020. So it forwards beyond 60007 and therefore misses to expire the migrated timer1. That timer gets expired when the wheel wraps around again, which takes between 63 and 630ms depending on the HZ setting. Address both problems by invoking forward_timer_base() for the control CPUs timer base. All other places, which might run into a similar problem (mod_timer()/add_timer_on()) already invoke forward_timer_base() to avoid that. [ tglx: Massaged comment and changelog ] Fixes: `a683f390b9` ("timers: Forward the wheel clock whenever possible") Co-developed-by: Neeraj Upadhyay <neeraju@codeaurora.org> Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org> Signed-off-by: Lingutla Chandrasekhar <clingutla@codeaurora.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Anna-Maria Gleixner <anna-maria@linutronix.de> Cc: linux-arm-msm@vger.kernel.org Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20180118115022.6368-1-clingutla@codeaurora.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-03-11 16:21:28 +01:00
Lingutla Chandrasekhar	ea6a32473b	Revert "time: Run deferrable timers on other CPUs when tick_do_timer_cpu is busy" Only Watchdog was using deferrable timers, but it is not using deferrable any more. So reverting the change and let tick_do_timer_cpu run the deferrable timers. This reverts 'commit `4fe122d73b` ("time: Run deferrable timers on other CPUs when tick_do_timer_cpu is busy")' Change-Id: I59fcd7cdb216230864cd948d242d563ade6437c8 Signed-off-by: Lingutla Chandrasekhar <clingutla@codeaurora.org>	2018-03-02 13:24:22 +05:30
Linux Build Service Account	b7e257f0a6	Merge "Merge android-4.9-o.80 (`a9fd318`) into msm-4.9"	2018-02-09 16:29:04 -08:00
Pavankumar Kondeti	4fe122d73b	time: Run deferrable timers on other CPUs when tick_do_timer_cpu is busy The deferrable timers processing is done by the tick_do_timer_cpu. If softirqs are deferred to the ksoftirqd task on this CPU, it may take longer time to process the deferrable timers under heavy load scenarios. Allow deferrable timers to be processed on other CPUs when ksoftirqd is active on the tick_do_timer_cpu. Change-Id: Ic7b39415b5efd3239a28e41460708a3bcfdb47b2 Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>	2018-02-06 12:18:17 +05:30
Blagovest Kolenichev	ec23108aed	Merge android-4.9-o.78 (`bf3b339`) into msm-4.9 * refs/heads/tmp-bf3b339: Linux 4.9.78 MIPS: AR7: ensure the port type's FCR value is used x86/retpoline: Optimize inline assembler for vmexit_fill_RSB x86/pti: Document fix wrong index kprobes/x86: Disable optimizing on the function jumps to indirect thunk kprobes/x86: Blacklist indirect thunk functions for kprobes retpoline: Introduce start/end markers of indirect thunk x86/mce: Make machine check speculation protected usbip: fix warning in vhci_hcd_probe/lockdep_init_map x86/cpu, x86/pti: Do not enable PTI on AMD processors arm64: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls dm thin metadata: THIN_MAX_CONCURRENT_LOCKS should be 6 dm btree: fix serious bug in btree_split_beneath() workqueue: avoid hard lockups in show_workqueue_state() libata: apply MAX_SEC_1024 to all LITEON EP1 series devices proc: fix coredump vs read /proc/*/stat race scripts/gdb/linux/tasks.py: fix get_thread_info can: peak: fix potential bug in packet fragmentation ARM: dts: kirkwood: fix pin-muxing of MPP7 on OpenBlocks A7 ARM: sunxi_defconfig: Enable CMA phy: work around 'phys' references to usb-nop-xceiv devices tracing: Fix converting enum's from the map in trace_event_eval_update() Input: twl4030-vibra - fix sibling-node lookup Input: twl6040-vibra - fix child-node lookup Input: 88pm860x-ts - fix child-node lookup Input: ALPS - fix multi-touch decoding on SS4 plus touchpads perf tools: Fix build with ARCH=x86_64 x86/apic/vector: Fix off by one in error path pipe: avoid round_pipe_size() nr_pages overflow on 32-bit x86/tsc: Fix erroneous TSC rate on Skylake Xeon x86/mm/pkeys: Fix fill_sig_info_pkey module: Add retpoline tag to VERMAGIC x86/cpufeature: Move processor tracing out of scattered features objtool: Improve error message for bad file argument x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros x86/retpoline: Fill RSB on context switch for affected CPUs sched/deadline: Zero out positive runtime after throttling constrained tasks scsi: hpsa: fix volume offline state iser-target: Fix possible use-after-free in connection establishment error af_key: fix buffer overread in parse_exthdrs() af_key: fix buffer overread in verify_address_len() timers: Unconditionally check deferrable base ALSA: hda - Apply the existing quirk to iMac 14,1 ALSA: hda - Apply headphone noise quirk for another Dell XPS 13 variant ALSA: pcm: Remove yet superfluous WARN_ON() ALSA: seq: Make ioctls race-free futex: Prevent overflow by strengthen input validation scsi: sg: disable SET_FORCE_LOW_DMA libnvdimm, btt: Fix an incompatibility in the log layout FROMLIST: arm64: kpti: Fix the interaction between ASID switching and software PAN FROMLIST: arm64: Move post_ttbr_update_workaround to C code Conflicts: arch/arm64/include/asm/efi.h arch/arm64/include/asm/mmu_context.h arch/arm64/mm/context.c drivers/scsi/sg.c kernel/workqueue.c Change-Id: Icbdef53178fe3e325386cbae73edea918d23f519 Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>	2018-01-24 08:33:10 -08:00
Thomas Gleixner	676109b28c	timers: Unconditionally check deferrable base commit ed4bbf7910b28ce3c691aef28d245585eaabda06 upstream. When the timer base is checked for expired timers then the deferrable base must be checked as well. This was missed when making the deferrable base independent of base::nohz_active. Fixes: ced6d5c11d3e ("timers: Use deferrable base independent of base::nohz_active") Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Anna-Maria Gleixner <anna-maria@linutronix.de> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Sebastian Siewior <bigeasy@linutronix.de> Cc: Paul McKenney <paulmck@linux.vnet.ibm.com> Cc: rt@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-01-23 19:57:04 +01:00
Blagovest Kolenichev	42d425962e	Merge android-4.9-o.74 (`127372f`) into msm-4.9 * refs/heads/tmp-127372f: Linux 4.9.74 mm/vmstat: Make NR_TLB_REMOTE_FLUSH_RECEIVED available even on UP tty: fix tty_ldisc_receive_buf() documentation n_tty: fix EXTPROC vs ICANON interaction with TIOCINQ (aka FIONREAD) x86/smpboot: Remove stale TLB flush invocations nohz: Prevent a timer interrupt storm in tick_nohz_stop_sched_tick() timers: Reinitialize per cpu bases on hotplug timers: Invoke timer_start_debug() where it makes sense timers: Use deferrable base independent of base::nohz_active usb: xhci: Add XHCI_TRUST_TX_LENGTH for Renesas uPD720201 USB: Fix off by one in type-specific length check of BOS SSP capability usb: add RESET_RESUME for ELSA MicroLink 56K usb: Add device quirk for Logitech HD Pro Webcam C925e USB: serial: option: adding support for YUGA CLM920-NC5 USB: serial: option: add support for Telit ME910 PID 0x1101 USB: serial: qcserial: add Sierra Wireless EM7565 USB: serial: ftdi_sio: add id for Airbus DS P8GR usbip: vhci: stop printing kernel pointer addresses in messages usbip: stub: stop printing kernel pointer addresses in messages usbip: prevent leaking socket pointer address in messages usbip: fix usbip bind writing random string after command in match_busid s390/qeth: update takeover IPs after configuration change s390/qeth: lock IP table while applying takeover changes s390/qeth: don't apply takeover changes to RXIP s390/qeth: apply takeover changes when mode is toggled net/mlx5: Fix error flow in CREATE_QP command net/mlx5e: Prevent possible races in VXLAN control flow net/mlx5e: Add refcount to VXLAN structure net/mlx5e: Fix possible deadlock of VXLAN lock net/mlx5e: Fix features check of IPv6 traffic net/mlx5: Fix rate limit packet pacing naming and struct tcp: invalidate rate samples during SACK reneging sock: free skb in skb_complete_tx_timestamp on error net: phy: micrel: ksz9031: reconfigure autoneg after phy autoneg workaround net: Fix double free and memory corruption in get_net_ns_by_id() net: fec: Allow reception of frames bigger than 1522 bytes net: bridge: fix early call to br_stp_change_bridge_id and plug newlink leaks ipv4: Fix use-after-free when flushing FIB tables adding missing rcu_read_unlock in ipxip6_rcv sctp: Replace use of sockets_allocated with specified macro. net: mvmdio: disable/unprepare clocks in EPROBE_DEFER case net: ipv4: fix for a race condition in raw_sendmsg tg3: Fix rx hang on MTU change with 5717/5719 tcp md5sig: Use skb's saddr when replying to an incoming segment tcp_bbr: record "full bw reached" decision in new full_bw_reached bit RDS: Check cmsg_len before dereferencing CMSG_DATA ptr_ring: add barriers net: reevalulate autoflowlabel setting after sysctl setting net: qmi_wwan: add Sierra EM7565 1199:9091 netlink: Add netns check on taps net: igmp: Use correct source address on IGMPv3 reports net: fec: unmap the xmit buffer that are not transferred by DMA ipv6: mcast: better catch silly mtu values ipv4: igmp: guard against silly MTU values kbuild: add '-fno-stack-check' to kernel build options x86/mm/64: Fix reboot interaction with CR4.PCIDE x86/mm: Enable CR4.PCIDE on supported systems x86/mm: Add the 'nopcid' boot option to turn off PCID x86/mm: Disable PCID on 32-bit kernels x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code x86/mm: Reimplement flush_tlb_page() using flush_tlb_mm_range() x86/mm: Make flush_tlb_mm_range() more predictable x86/mm: Remove flush_tlb() and flush_tlb_current_task() x86/vm86/32: Switch to flush_tlb_mm_range() in mark_screen_rdonly() ALSA: hda - fix headset mic detection issue on a Dell machine ALSA: hda: Drop useless WARN_ON() ASoC: tlv320aic31xx: Fix GPIO1 register definition ASoC: twl4030: fix child-node lookup ASoC: fsl_ssi: AC'97 ops need regmap, clock and cleaning up on failure ASoC: da7218: fix fix child-node lookup ASoC: wm_adsp: Fix validation of firmware and coeff lengths iw_cxgb4: Only validate the MSN for successful completions ring-buffer: Mask out the info bits when returning buffer page length tracing: Fix crash when it fails to alloc ring buffer tracing: Fix possible double free on failure of allocating trace buffer tracing: Remove extra zeroing out of the ring buffer page sync objtool's copy of x86-opcode-map.txt Conflicts: include/linux/cpuhotplug.h kernel/time/timer.c Change-Id: I0198e2b75715d13acd86237321966774cd6d9f1d Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>	2018-01-18 07:01:08 -08:00
Thomas Gleixner	249d4a9b32	timers: Reinitialize per cpu bases on hotplug commit 26456f87aca7157c057de65c9414b37f1ab881d1 upstream. The timer wheel bases are not (re)initialized on CPU hotplug. That leaves them with a potentially stale clk and next_expiry valuem, which can cause trouble then the CPU is plugged. Add a prepare callback which forwards the clock, sets next_expiry to far in the future and reset the control flags to a known state. Set base->must_forward_clk so the first timer which is queued will try to forward the clock to current jiffies. Fixes: `500462a9de` ("timers: Switch to a non-cascading wheel") Reported-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Sebastian Siewior <bigeasy@linutronix.de> Cc: Anna-Maria Gleixner <anna-maria@linutronix.de> Link: https://lkml.kernel.org/r/alpine.DEB.2.20.1712272152200.2431@nanos Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-01-02 20:35:17 +01:00
Thomas Gleixner	574e543ff9	timers: Invoke timer_start_debug() where it makes sense commit fd45bb77ad682be728d1002431d77b8c73342836 upstream. The timer start debug function is called before the proper timer base is set. As a consequence the trace data contains the stale CPU and flags values. Call the debug function after setting the new base and flags. Fixes: `500462a9de` ("timers: Switch to a non-cascading wheel") Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Sebastian Siewior <bigeasy@linutronix.de> Cc: rt@linutronix.de Cc: Paul McKenney <paulmck@linux.vnet.ibm.com> Cc: Anna-Maria Gleixner <anna-maria@linutronix.de> Link: https://lkml.kernel.org/r/20171222145337.792907137@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-01-02 20:35:17 +01:00
Anna-Maria Gleixner	d840687aa8	timers: Use deferrable base independent of base::nohz_active commit ced6d5c11d3e7b342f1a80f908e6756ebd4b8ddd upstream. During boot and before base::nohz_active is set in the timer bases, deferrable timers are enqueued into the standard timer base. This works correctly as long as base::nohz_active is false. Once it base::nohz_active is set and a timer which was enqueued before that is accessed the lock selector code choses the lock of the deferred base. This causes unlocked access to the standard base and in case the timer is removed it does not clear the pending flag in the standard base bitmap which causes get_next_timer_interrupt() to return bogus values. To prevent that, the deferrable timers must be enqueued in the deferrable base, even when base::nohz_active is not set. Those deferrable timers also need to be expired unconditional. Fixes: `500462a9de` ("timers: Switch to a non-cascading wheel") Signed-off-by: Anna-Maria Gleixner <anna-maria@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Frederic Weisbecker <fweisbec@gmail.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Sebastian Siewior <bigeasy@linutronix.de> Cc: rt@linutronix.de Cc: Paul McKenney <paulmck@linux.vnet.ibm.com> Link: https://lkml.kernel.org/r/20171222145337.633328378@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-01-02 20:35:17 +01:00
Maria Yu	219fe504c6	kernel: time: Fix low resolution timer not fire in 32bit case Low resolution timer is not fired to run at given expired time which is equal to this cpu's base clk time. This is caused by 32bit intergar overflow. When pos_up is 0, and pos_down is -1, with unsigned add, it will not seen pos_up + clk is bigger than pos_down + clk. So add an cast to u64 to have the expected result. Change-Id: I45777a1fd282d8f70ba94528b04fce2f0436d7e4 Signed-off-by: Maria Yu <aiquny@codeaurora.org>	2017-11-09 15:45:27 +08:00
Kyle Yan	cd02e634b8	Merge remote-tracking branch '4.9/tmp-379e3b2' into 4.9 * 4.9/tmp-379e3b2: ANDROID: binder: fix transaction leak. ANDROID: binder: Add tracing for binder priority inheritance. Linux 4.9.53 swiotlb-xen: implement xen_swiotlb_dma_mmap callback video: fbdev: aty: do not leak uninitialized padding in clk to userspace KVM: VMX: use cmpxchg64 cxl: Fix driver use count KVM: VMX: remove WARN_ON_ONCE in kvm_vcpu_trigger_posted_interrupt KVM: VMX: do not change SN bit in vmx_update_pi_irte() timer/sysclt: Restrict timer migration sysctl values to 0 and 1 gfs2: Fix debugfs glocks dump x86/fpu: Don't let userspace set bogus xcomp_bv x86/mm: Fix fault error path using unsafe vma pointer btrfs: prevent to set invalid default subvolid btrfs: propagate error to btrfs_cmp_data_prepare caller btrfs: fix NULL pointer dereference from free_reloc_roots() PCI: Fix race condition with driver_override etnaviv: fix gem object list corruption xfs: validate bdev support for DAX inode flag kvm: nVMX: Don't allow L2 to access the hardware CR8 KVM: VMX: Do not BUG() on out-of-bounds guest IRQ kvm/x86: Handle async PF in RCU read-side critical sections KVM: VMX: simplify and fix vmx_vcpu_pi_load KVM: VMX: avoid double list add with VT-d posted interrupts KVM: VMX: extract __pi_post_block arm64: fault: Route pte translation faults via do_translation_fault arm64: Make sure SPsel is always set seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter() selftests/seccomp: Support glibc 2.26 siginfo_t.h iw_cxgb4: put ep reference in pass_accept_req() iw_cxgb4: remove the stid on listen create failure bsg-lib: don't free job in bsg_prepare_job nl80211: check for the required netlink attributes presence vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets SMB3: Don't ignore O_SYNC/O_DSYNC and O_DIRECT flags SMB: Validate negotiate (to protect against downgrade) even if signing off SMB3: Warn user if trying to sign connection that authenticated as guest Fix SMB3.1.1 guest authentication to Samba PM: core: Fix device_pm_check_callbacks() s390/mm: fix write access check in gup_huge_pmd() powerpc/ftrace: Pass the correct stack pointer for DYNAMIC_FTRACE_WITH_REGS powerpc/tm: Flush TM only if CPU has TM feature powerpc/pseries: Fix parent_dn reference leak in add_dt_node() KEYS: prevent KEYCTL_READ on negative key KEYS: prevent creating a different user's keyrings KEYS: fix writing past end of user-supplied buffer in keyring_read() security/keys: rewrite all of big_key crypto security/keys: properly zero out sensitive key material in big_key crypto: talitos - fix hashing crypto: talitos - fix sha224 crypto: talitos - Don't provide setkey for non hmac hashing algs. crypto: drbg - fix freeing of resources drm/radeon: disable hard reset in hibernate for APUs scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly md/raid5: preserve STRIPE_ON_UNPLUG_LIST in break_stripe_batch_list md/raid5: fix a race condition in stripe batch tracing: Erase irqsoff trace with empty write tracing: Fix trace_pipe behavior for instance traces KVM: PPC: Book3S HV: Protect updates to spapr_tce_tables list KVM: PPC: Book3S: Fix race and leak in kvm_vm_ioctl_create_spapr_tce() genirq: Make sparse_irq_lock protect what it should protect mac80211: flush hw_roc_start work before cancelling the ROC mac80211_hwsim: Use proper TX power mac80211: fix VLAN handling with TXQs fs/proc: Report eip/esp in /prod/PID/stat for coredumping cifs: release auth_key.response for reconnect. cifs: release cifs root_cred after exit_cifs ANDROID: add script to fetch android kernel config fragments FROMLIST: binder: fix use-after-free in binder_transaction() UPSTREAM: ipv6: fib: Unlink replaced routes from their nodes Linux 4.9.52 bcache: fix bch_hprint crash and improve output bcache: fix for gc and write-back race bcache: Correct return value for sysfs attach errors bcache: correct cache_dirty_target in __update_writeback_rate() bcache: do not subtract sectors_to_gc for bypassed IO bcache: Fix leak of bdev reference bcache: initialize dirty stripes in flash_dev_run() PM / devfreq: Fix memory leak when fail to register device media: uvcvideo: Prevent heap overflow when accessing mapped controls media: v4l2-compat-ioctl32: Fix timespec conversion s390/mm: fix race on mm->context.flush_mm s390/mm: fix local TLB flushing vs. detach of an mm address space net/netfilter/nf_conntrack_core: Fix net_conntrack_lock() PCI: pciehp: Report power fault only once until we clear it PCI: shpchp: Enable bridge bus mastering if MSI is enabled ARC: Re-enable MMU upon Machine Check exception tracing: Apply trace_clock changes to instance max buffer tracing: Add barrier to trace_printk() buffer nesting modification ftrace: Fix memleak when unregistering dynamic ops when tracing disabled ftrace: Fix selftest goto location on error scsi: qla2xxx: Fix an integer overflow in sysfs code scsi: qla2xxx: Correction to vha->vref_count timeout scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE scsi: sg: factor out sg_fill_request_table() scsi: sg: off by one in sg_ioctl() scsi: sg: use standard lists for sg_requests scsi: sg: remove 'save_scat_len' scsi: storvsc: fix memory leak on ring buffer busy scsi: megaraid_sas: Return pended IOCTLs with cmd_status MFI_STAT_WRONG_STATE in case adapter is dead scsi: megaraid_sas: Check valid aen class range to avoid kernel panic scsi: megaraid_sas: set minimum value of resetwaittime to be 1 secs scsi: zfcp: trace high part of "new" 64 bit SCSI LUN scsi: zfcp: trace HBA FSF response by default on dismiss or timedout late response scsi: zfcp: fix payload with full FCP_RSP IU in SCSI trace records scsi: zfcp: fix missing trace records for early returns in TMF eh handlers scsi: zfcp: fix passing fsf_req to SCSI trace on TMF to correlate with HBA scsi: zfcp: fix capping of unsuccessful GPN_FT SAN response trace records scsi: zfcp: add handling for FCP_RESID_OVER to the fcp ingress path scsi: zfcp: fix queuecommand for scsi_eh commands when DIX enabled skd: Submit requests to firmware before triggering the doorbell skd: Avoid that module unloading triggers a use-after-free md/bitmap: disable bitmap_resize for file-backed bitmaps. block: Relax a check in blk_start_queue() powerpc: Fix DAR reporting when alignment handler faults ext4: fix quota inconsistency during orphan cleanup for read-only mounts ext4: fix incorrect quotaoff if the quota feature is enabled crypto: AF_ALG - remove SGL terminator indicator when chaining crypto: ccp - Fix XTS-AES-128 support on v5 CCPs MIPS: math-emu: <MADDF\|MSUBF>.D: Fix accuracy (64-bit case) MIPS: math-emu: <MADDF\|MSUBF>.S: Fix accuracy (32-bit case) MIPS: math-emu: <MADDF\|MSUBF>.<D\|S>: Clean up "maddf_flags" enumeration MIPS: math-emu: <MADDF\|MSUBF>.<D\|S>: Fix some cases of zero inputs MIPS: math-emu: <MADDF\|MSUBF>.<D\|S>: Fix some cases of infinite inputs MIPS: math-emu: <MADDF\|MSUBF>.<D\|S>: Fix NaN propagation MIPS: math-emu: Handle zero accumulator case in MADDF and MSUBF separately MIPS: math-emu: MINA.<D\|S>: Fix some cases of infinity and zero inputs MIPS: math-emu: <MAXA\|MINA>.<D\|S>: Fix cases of both infinite inputs MIPS: math-emu: <MAXA\|MINA>.<D\|S>: Fix cases of input values with opposite signs MIPS: math-emu: <MAX\|MIN>.<D\|S>: Fix cases of both inputs negative MIPS: math-emu: <MAX\|MAXA\|MIN\|MINA>.<D\|S>: Fix cases of both inputs zero MIPS: math-emu: <MAX\|MAXA\|MIN\|MINA>.<D\|S>: Fix quiet NaN propagation Input: i8042 - add Gigabyte P57 to the keyboard reset table pinctrl/amd: save pin registers over suspend/resume tty: fix __tty_insert_flip_char regression tty: improve tty_insert_flip_char() slow path tty: improve tty_insert_flip_char() fast path IB/addr: Fix setting source address in addr6_resolve() drm/sun4i: Implement drm_driver lastclose to restore fbdev console IB/{qib, hfi1}: Avoid flow control testing for RDMA write operation orangefs: Don't clear SGID when inheriting ACLs mm: prevent double decrease of nr_reserved_highatomic NFSv4: Fix callback server shutdown SUNRPC: Refactor svc_set_num_threads() UPSTREAM: drm/atomic: Handle -EDEADLK with out-fences correctly UPSTREAM: sched/fair: Fix FTQ noise bench regression UPSTREAM: fib_rules: fix error return code UPSTREAM: ipv4: add missing initialization for flowi4_uid ANDROID: Squashfs: optimize reading uncompressed data ANDROID: Squashfs: implement .readpages() ANDROID: Squashfs: replace buffer_head with BIO ANDROID: Squashfs: refactor page_actor ANDROID: Squashfs: remove the FILE_CACHE option FROMLIST: android: binder: Don't get mm from task FROMLIST: android: binder: Remove unused vma argument FROMLIST: android: binder: Drop lru lock in isolate callback ANDROID: Use sk_uid to replace uid get from socket file ANDROID: nf: xt_qtaguid: fix handling for cases where tunnels are used. Revert "ANDROID: Use sk_uid to replace uid get from socket file" ANDROID: USB gadget: mtp: Fix hang in ioctl(MTP_RECEIVE_FILE) for WritePartialObject Conflicts: drivers/android/binder_alloc.c drivers/media/v4l2-core/v4l2-compat-ioctl32.c drivers/scsi/sg.c drivers/usb/gadget/function/f_mtp.c net/netfilter/xt_qtaguid.c net/wireless/nl80211.c Change-Id: I6af673bd4b920bb229fe238a3e96b2330fa18263 Signed-off-by: Kyle Yan <kyan@codeaurora.org>	2017-10-17 14:48:18 -07:00
Myungho Jung	4c00015385	timer/sysclt: Restrict timer migration sysctl values to 0 and 1 commit b94bf594cf8ed67cdd0439e70fa939783471597a upstream. timer_migration sysctl acts as a boolean switch, so the allowed values should be restricted to 0 and 1. Add the necessary extra fields to the sysctl table entry to enforce that. [ tglx: Rewrote changelog ] Signed-off-by: Myungho Jung <mhjungk@gmail.com> Link: http://lkml.kernel.org/r/1492640690-3550-1-git-send-email-mhjungk@gmail.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Kazuhiro Hayashi <kazuhiro3.hayashi@toshiba.co.jp> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2017-10-05 09:44:04 +02:00
Kyle Yan	7d337cc7f9	Merge remote-tracking branch '4.9/tmp-85e1c01' into 4.9 * 4.9/tmp-85e1c01: Linux 4.9.48 epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove() kvm: arm/arm64: Force reading uncached stage2 PGD drm/ttm: Fix accounting error when fail to get pages for pool xfrm: policy: check policy direction value lib/mpi: kunmap after finishing accessing buffer wl1251: add a missing spin_lock_init() CIFS: remove endian related sparse warning CIFS: Fix maximum SMB2 header size alpha: uapi: Add support for __SANE_USERSPACE_TYPES__ cpuset: Fix incorrect memory_pressure control file mapping cpumask: fix spurious cpumask_of_node() on non-NUMA multi-node configs ceph: fix readpage from fscache mm, madvise: ensure poisoned pages are removed from per-cpu lists mm, uprobes: fix multiple free of ->uprobes_state.xol_area crypto: algif_skcipher - only call put_page on referenced and used pages i2c: ismt: Return EMSGSIZE for block reads with bogus length i2c: ismt: Don't duplicate the receive length for block reads irqchip: mips-gic: SYNC after enabling GIC region ANDROID: fiq_debugger: Fix minor bug in code ANDROID: configs: remove requirement for CONFIG_SYNC FROMLIST: binder: fix an ret value override FROMLIST: binder: fix memory corruption in binder_transaction binder Linux 4.9.47 lz4: fix bogus gcc warning scsi: sg: reset 'res_in_use' after unlinking reserved array scsi: sg: protect accesses to 'reserved' page array locking/spinlock/debug: Remove spinlock lockup detection code arm64: fpsimd: Prevent registers leaking across exec x86/io: Add "memory" clobber to insb/insw/insl/outsb/outsw/outsl arm64: mm: abort uaccess retries upon fatal signal kvm: arm/arm64: Fix race in resetting stage2 PGD gcov: support GCC 7.1 staging: wilc1000: simplify vif[i]->ndev accesses scsi: isci: avoid array subscript warning p54: memset(0) whole array FROMLIST: android: binder: Add page usage in binder stats FROMLIST: android: binder: Add shrinker tracepoints FROMLIST: android: binder: Add global lru shrinker to binder FROMLIST: android: binder: Move buffer out of area shared with user space FROMLIST: android: binder: Add allocator selftest FROMLIST: android: binder: Refactor prev and next buffer into a helper function android: android-base.config: enable IP6_NF_MATCH_RPFILTER Linux 4.9.46 powerpc/mm: Ensure cpumask update is ordered ACPI: EC: Fix regression related to wrong ECDT initialization order ACPI / APEI: Add missing synchronize_rcu() on NOTIFY_SCI removal ACPI: ioapic: Clear on-stack resource before using it ntb: transport shouldn't disable link due to bogus values in SPADs ntb: ntb_test: ensure the link is up before trying to configure the mws ntb: no sleep in ntb_async_tx_submit NTB: ntb_test: fix bug printing ntb_perf results ntb_transport: fix bug calculating num_qps_mw ntb_transport: fix qp count bug Clarify (and fix) MAX_LFS_FILESIZE macros staging: rtl8188eu: add RNX-N150NUB support iio: hid-sensor-trigger: Fix the race with user space powering up sensors iio: imu: adis16480: Fix acceleration scale factor for adis16480 ANDROID: binder: fix proc->tsk check. binder: Use wake up hint for synchronous transactions. binder: use group leader instead of open thread Revert "android: binder: Sanity check at binder ioctl" Bluetooth: bnep: fix possible might sleep error in bnep_session Bluetooth: cmtp: fix possible might sleep error in cmtp_session Bluetooth: hidp: fix possible might sleep error in hidp_session_thread netfilter: nat: fix src map lookup Revert "leds: handle suspend/resume in heartbeat trigger" net: sunrpc: svcsock: fix NULL-pointer exception x86/mm: Fix use-after-free of ldt_struct timers: Fix excessive granularity of new timers after a nohz idle perf/x86/intel/rapl: Make package handling more robust perf probe: Fix --funcs to show correct symbols for offline module perf/core: Fix group {cpu,task} validation ftrace: Check for null ret_stack on profile function graph entry function nfsd: Limit end of page list when decoding NFSv4 WRITE cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup() cifs: Fix df output for users with quota limits kbuild: linker script do not match C names unless LD_DEAD_CODE_DATA_ELIMINATION is configured tracing: Fix freeing of filter in create_filter() when set_str is false tracing: Fix kmemleak in tracing_map_array_free() tracing: Call clear_boot_tracer() at lateinit_sync drm: rcar-du: Fix H/V sync signal polarity configuration drm: rcar-du: Fix display timing controller parameter drm: rcar-du: Fix crash in encoder failure error path drm/atomic: If the atomic check fails, return its value first drm: Release driver tracking before making the object available again mm/memblock.c: reversed logic in memblock_discard() fork: fix incorrect fput of ->exe_file causing use-after-free mm/madvise.c: fix freeing of locked page with MADV_FREE i2c: designware: Fix system suspend mm, shmem: fix handling /sys/kernel/mm/transparent_hugepage/shmem_enabled ARCv2: PAE40: Explicitly set MSB counterpart of SLC region ops addresses ALSA: firewire: fix NULL pointer dereference when releasing uninitialized data of iso-resource ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978) ALSA: core: Fix unexpected error at replacing user TLV ALSA: usb-audio: Add delay quirk for H650e/Jabra 550a USB headsets KVM: x86: block guest protection keys unless the host has them enabled KVM: s390: sthyi: fix specification exception detection KVM: s390: sthyi: fix sthyi inline assembly Input: ALPS - fix two-finger scroll breakage in right side on ALPS touchpad Input: elan_i2c - add ELAN0602 ACPI ID to support Lenovo Yoga310 Input: trackpoint - add new trackpoint firmware ID bpf/verifier: fix min/max handling in BPF_SUB bpf: fix mixed signed/unsigned derived min/max value bounds bpf, verifier: fix alu ops against map_value{, _adj} register types bpf: adjust verifier heuristics bpf, verifier: add additional patterns to evaluate_reg_imm_alu net_sched: fix order of queue length updates in qdisc_replace() net: sched: fix NULL pointer dereference when action calls some targets irda: do not leak initialized list.dev to userspace net/mlx4_core: Enable 4K UAR if SRIOV module parameter is not enabled tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP ipv6: repair fib6 tree in failure case ipv6: reset fn->rr_ptr when replacing route tipc: fix use-after-free sctp: fully initialize the IPv6 address in sctp_v6_to_addr() nfp: fix infinite loop on umapping cleanup ipv4: better IP_MAX_MTU enforcement ptr_ring: use kmalloc_array() openvswitch: fix skb_panic due to the incorrect actions attrlen bpf: fix bpf_trace_printk on 32 bit archs net_sched: remove warning from qdisc_hash_add net_sched/sfq: update hierarchical backlog when drop packet ipv4: fix NULL dereference in free_fib_info_rcu() dccp: defer ccid_hc_tx_delete() at dismantle time dccp: purge write queue in dccp_destroy_sock() af_key: do not use GFP_KERNEL in atomic contexts sparc64: remove unnecessary log message ANDROID: NFC: st21nfca: Fix memory OOB and leak issues in connectivity events handler Linux 4.9.45 usb: qmi_wwan: add D-Link DWM-222 device ID usb: optimize acpi companion search for usb port devices pids: make task_tgid_nr_ns() safe Sanitize 'move_pages()' permission checks genirq/ipi: Fixup checks against nr_cpu_ids genirq: Restore trigger settings in irq_modify_status() irqchip/atmel-aic: Fix unbalanced refcount in aic_common_rtc_irq_fixup() irqchip/atmel-aic: Fix unbalanced of_node_put() in aic_common_irq_fixup() x86/asm/64: Clear AC on NMI entries xen-blkfront: use a right index when checking requests powerpc: Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC blk-mq-pci: add a fallback when pci_irq_get_affinity returns NULL xen: fix bio vec merging mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes mm/mempolicy: fix use after free when calling get_mempolicy mm: fix double mmap_sem unlock on MMF_UNSTABLE enforced SIGBUS mm: discard memblock data later ALSA: usb-audio: Add mute TLV for playback volumes on C-Media devices ALSA: usb-audio: Apply sample rate quirk to Sennheiser headset ALSA: seq: 2nd attempt at fixing race creating a queue Input: elan_i2c - Add antoher Lenovo ACPI ID for upcoming Lenovo NB Input: elan_i2c - add ELAN0608 to the ACPI table crypto: x86/sha1 - Fix reads beyond the number of blocks passed crypto: ixp4xx - Fix error handling path in 'aead_perform()' parisc: pci memory bar assignment fails with 64bit kernels on dino/cujo audit: Fix use after free in audit_remove_watch_rule() netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_unregister ANDROID: check dir value of xfrm_userpolicy_id ANDROID: NFC: Fix possible memory corruption when handling SHDLC I-Frame commands ANDROID: nfc: fdp: Fix possible buffer overflow in WCS4000 NFC driver ANDROID: NFC: st21nfca: Fix out of bounds kernel access when handling ATR_REQ ANDROID: usb: gadget: assign no-op request complete callbacks ANDROID: usb: gadget: configfs: fix null ptr in android_disconnect ANDROID: uid_sys_stats: Fix implicit declaration of get_cmdline() uid_sys_stats: log task io with a debug flag Linux 4.9.44 MIPS: DEC: Fix an int-handler.S CPU_DADDI_WORKAROUNDS regression pinctrl: meson-gxbb: Add missing GPIODV_18 pin entry pinctrl: samsung: Remove bogus irq_[un]mask from resource management pinctrl: uniphier: fix WARN_ON() of pingroups dump on LD20 pinctrl: uniphier: fix WARN_ON() of pingroups dump on LD11 pinctrl: intel: merrifield: Correct UART pin lists pinctrl: sunxi: add a missing function of A10/A20 pinctrl driver pnfs/blocklayout: require 64-bit sector_t iio: adc: vf610_adc: Fix VALT selection value for REFSEL bits usb:xhci:Add quirk for Certain failing HP keyboard on reset after resume usb: quirks: Add no-lpm quirk for Moshi USB to Ethernet Adapter usb: core: unlink urbs from the tail of the endpoint's urb_list USB: Check for dropped connection before switching to full speed usb: renesas_usbhs: Fix UGCTRL2 value for R-Car Gen3 usb: gadget: udc: renesas_usb3: Fix usb_gadget_giveback_request() calling uas: Add US_FL_IGNORE_RESIDUE for Initio Corporation INIC-3069 staging: comedi: comedi_fops: do not call blocking ops when !TASK_RUNNING iio: light: tsl2563: use correct event code iio: accel: bmc150: Always restore device to normal mode after suspend-resume staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read USB: hcd: Mark secondary HCD as dead if the primary one died usb: musb: fix tx fifo flush handling again USB: serial: pl2303: add new ATEN device id USB: serial: cp210x: add support for Qivicon USB ZigBee dongle USB: serial: option: add D-Link DWM-222 device ID drm/i915: Fix out-of-bounds array access in bdw_load_gamma_lut drm/etnaviv: Fix off-by-one error in reloc checking nfs/flexfiles: fix leak of nfs4_ff_ds_version arrays mmc: mmc: correct the logic for setting HS400ES signal voltage nand: fix wrong default oob layout for small pages using soft ecc fuse: initialize the flock flag in fuse_file on allocation target: Fix node_acl demo-mode + uncached dynamic shutdown regression iscsi-target: Fix iscsi_np reset hung task during parallel delete iscsi-target: fix memory leak in iscsit_setup_text_cmd() mtd: nand: Fix timing setup for NANDs that do not support SET FEATURES xtensa: don't limit csum_partial export by CONFIG_NET xtensa: mm/cache: add missing EXPORT_SYMBOLs xtensa: fix cache aliasing handling code for WT cache futex: Remove unnecessary warning from get_futex_key mm: fix list corruptions on shmem shrinklist mm: ratelimit PFNs busy info message ANDROID: Use sk_uid to replace uid get from socket file Linux 4.9.43 Revert "ARM: dts: sun8i: Support DTB build for NanoPi M1" KVM: arm/arm64: Handle hva aging while destroying the vm sparc64: Prevent perf from running during super critical sections udp: consistently apply ufo or fragmentation revert "ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output" revert "net: account for current skb length when deciding about UFO" packet: fix tp_reserve race in packet_set_ring igmp: Fix regression caused by igmp sysctl namespace code. net: avoid skb_warn_bad_offload false positives on UFO tcp: fastopen: tcp_connect() must refresh the route net: sched: set xt_tgchk_param par.nft_compat as 0 in ipt_init_target net/mlx4_en: don't set CHECKSUM_COMPLETE on SCTP packets bpf, s390: fix jit branch offset related to ldimm64 net: fix keepalive code vs TCP_FASTOPEN_CONNECT tcp: avoid setting cwnd to invalid ssthresh after cwnd reduction states ppp: fix xmit recursion detection on ppp channels ppp: Fix false xmit recursion detect with two ppp devices Linux 4.9.42 workqueue: implicit ordered attribute should be overridable net: phy: Fix PHY unbind crash net: account for current skb length when deciding about UFO ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output net/mlx5: E-Switch, Re-enable RoCE on mode change only after FDB destroy mm: don't dereference struct page fields of invalid pages signal: protect SIGNAL_UNKILLABLE from unintentional clearing. lib/Kconfig.debug: fix frv build failure mm, slab: make sure that KMALLOC_MAX_SIZE will fit into MAX_ORDER ARM: 8632/1: ftrace: fix syscall name matching virtio_blk: fix panic in initialization error path nbd: blk_mq_init_queue returns an error code on failure, not NULL iw_cxgb4: do not send RX_DATA_ACK CPLs after close/abort ARM: dts: sunxi: Change node name for pwrseq pin on Olinuxino-lime2-emmc ARM: dts: sun8i: Support DTB build for NanoPi M1 drm/virtio: fix framebuffer sparse warning scsi: qla2xxx: Get mutex lock before checking optrom_state clk/samsung: exynos542x: mark some clocks as critical ipv4: make tcp_notsent_lowat sysctl knob behave as true unsigned int phy state machine: failsafe leave invalid RUNNING state netfilter: use fwmark_reflect in nf_send_reset ASoC: rt5645: set sel_i2s_pre_div1 to 2 spi: spi-axi: Free resources on error path x86/boot: Add missing declaration of string functions tg3: Fix race condition in tg3_get_stats64(). net: phy: dp83867: fix irq generation sh_eth: R8A7740 supports packet shecksumming sh_eth: fix EESIPR values for SH77{34\|63} wext: handle NULL extra data in iwe_stream_add_point better sparc64: Fix exception handling in UltraSPARC-III memcpy. sparc64: Measure receiver forward progress to avoid send mondo timeout xen-netback: correctly schedule rate-limited queues net: phy: Correctly process PHY_HALTED in phy_stop_machine() net/mlx5e: Schedule overflow check work to mlx5e workqueue net/mlx5e: Fix wrong delay calculation for overflow check scheduling net/mlx5e: Fix outer_header_zero() check size net/mlx5: Fix command bad flow on command entry allocation failure net/mlx5: Consider tx_enabled in all modes on remap sctp: fix the check for _sctp_walk_params and _sctp_walk_errors sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}() dccp: fix a memleak for dccp_feat_init err process dccp: fix a memleak that dccp_ipv4 doesn't put reqsk properly dccp: fix a memleak that dccp_ipv6 doesn't put reqsk properly net: ethernet: nb8800: Handle all 4 RGMII modes identically ipv6: Don't increase IPSTATS_MIB_FRAGFAILS twice in ip6_fragment() packet: fix use-after-free in prb_retire_rx_blk_timer_expired() openvswitch: fix potential out of bound access in parse_ct mcs7780: Fix initialization when CONFIG_VMAP_STACK is enabled rtnetlink: allocate more memory for dev_set_mac_address() ipv4: initialize fib_trie prior to register_netdev_notifier call. net: dsa: b53: Add missing ARL entries for BCM53125 ipv6: avoid overflow of offset in ip6_find_1stfragopt net: Zero terminate ifr_name in dev_ifname(). ipv4: ipv6: initialize treq->txhash in cookie_v[46]_check() tcp_bbr: init pacing rate on first RTT sample tcp_bbr: remove sk_pacing_rate=0 transient during init tcp_bbr: introduce bbr_init_pacing_rate_from_rtt() helper tcp_bbr: introduce bbr_bw_to_pacing_rate() helper tcp_bbr: cut pacing rate only if filled pipe saa7164: fix double fetch PCIe access condition Btrfs: fix early ENOSPC due to delalloc f2fs: sanity check checkpoint segno and blkoff media: lirc: LIRC_GET_REC_RESOLUTION should return microseconds mmc: core: Use device_property_read instead of of_property_read mmc: dw_mmc: Use device_property_read instead of of_property_read iscsi-target: Fix initial login PDU asynchronous socket close OOPs media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl ARM: dts: tango4: Request RGMII RX and TX clock delays ARM: dts: armada-38x: Fix irq type for pca955 ext4: fix overflow caused by missing cast in ext4_resize_fs() ext4: fix SEEK_HOLE/SEEK_DATA for blocksize < pagesize gpiolib: skip unwanted events, don't convert them to opposite edge iommu/amd: Enable ga_log_intr when enabling guest_mode powerpc/64: Fix __check_irq_replay missing decrementer interrupt powerpc/tm: Fix saving of TM SPRs in core dump timers: Fix overflow in get_next_timer_interrupt mm/page_alloc: Remove kernel address exposure in free_reserved_area() KVM: async_pf: make rcu irq exit if not triggered from idle task ASoC: do not close shared backend dailink drm/amdgpu: Fix undue fallthroughs in golden registers initialization ALSA: hda - Fix speaker output from VAIO VPCL14M1R cpuset: fix a deadlock due to incomplete patching of cpusets_enabled() mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries mmc: core: Fix access to HS400-ES devices device property: Make dev_fwnode() public mmc: sdhci-of-at91: force card detect value for non removable devices NFSv4: Fix EXCHANGE_ID corrupt verifier issue brcmfmac: fix memleak due to calling brcmf_sdiod_sgtable_alloc() twice iwlwifi: dvm: prevent an out of bounds access workqueue: restore WQ_UNBOUND/max_active==1 to be ordered libata: array underflow in ata_find_dev() cgroup: fix error return value from cgroup_subtree_control() cgroup: create dfl_root files on subsys registration parisc: Handle vma's whose context is not current in flush_cache_range ANDROID: binder: don't queue async transactions to thread. ANDROID: binder: don't enqueue death notifications to thread todo. ANDROID: binder: call poll_wait() unconditionally. ANDROID: keychord: Fix for a memory leak in keychord. ANDROID: keychord: Fix races in keychord_write. android: configs: move quota-related configs to recommended ANDROID: sdcardfs: override credential for ioctl to lower fs ANDROID: xt_qtaguid: handle properly request sockets Conflicts: drivers/staging/android/fiq_debugger/fiq_debugger.c include/linux/sched.h kernel/locking/spinlock_debug.c sound/soc/soc-pcm.c Change-Id: I163a8c98f1737eeb01b9c8a0636a91d552ef349f Signed-off-by: Kyle Yan <kyan@codeaurora.org>	2017-09-07 14:32:09 -07:00
Nicholas Piggin	70b3fd5ce2	timers: Fix excessive granularity of new timers after a nohz idle commit 2fe59f507a65dbd734b990a11ebc7488f6f87a24 upstream. When a timer base is idle, it is forwarded when a new timer is added to ensure that granularity does not become excessive. When not idle, the timer tick is expected to increment the base. However there are several problems: - If an existing timer is modified, the base is forwarded only after the index is calculated. - The base is not forwarded by add_timer_on. - There is a window after a timer is restarted from a nohz idle, after it is marked not-idle and before the timer tick on this CPU, where a timer may be added but the ancient base does not get forwarded. These result in excessive granularity (a 1 jiffy timeout can blow out to 100s of jiffies), which cause the rcu lockup detector to trigger, among other things. Fix this by keeping track of whether the timer base has been idle since it was last run or forwarded, and if so then forward it before adding a new timer. There is still a case where mod_timer optimises the case of a pending timer mod with the same expiry time, where the timer can see excessive granularity relative to the new, shorter interval. A comment is added, but it's not changed because it is an important fastpath for networking. This has been tested and found to fix the RCU softlockup messages. Testing was also done with tracing to measure requested versus achieved wakeup latencies for all non-deferrable timers in an idle system (with no lockup watchdogs running). Wakeup latency relative to absolute latency is calculated (note this suffers from round-up skew at low absolute times) and analysed: max avg std upstream 506.0 1.20 4.68 patched 2.0 1.08 0.15 The bug was noticed due to the lockup detector Kconfig changes dropping it out of people's .configs and resulting in larger base clk skew When the lockup detectors are enabled, no CPU can go idle for longer than 4 seconds, which limits the granularity errors. Sub-optimal timer behaviour is observable on a smaller scale in that case: max avg std upstream 9.0 1.05 0.19 patched 2.0 1.04 0.11 Fixes: Fixes: `a683f390b9` ("timers: Forward the wheel clock whenever possible") Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Tested-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Tested-by: David Miller <davem@davemloft.net> Cc: dzickus@redhat.com Cc: sfr@canb.auug.org.au Cc: mpe@ellerman.id.au Cc: Stephen Boyd <sboyd@codeaurora.org> Cc: linuxarm@huawei.com Cc: abdhalee@linux.vnet.ibm.com Cc: John Stultz <john.stultz@linaro.org> Cc: akpm@linux-foundation.org Cc: paulmck@linux.vnet.ibm.com Cc: torvalds@linux-foundation.org Link: http://lkml.kernel.org/r/20170822084348.21436-1-npiggin@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2017-08-30 10:21:51 +02:00
Channagoud Kadabi	ce49c27f13	kernel: time: Fix accuracy for low resolution timer timer wheel calculates the index for any timer based on the expiry value and level granularity of the timer. Due to the level granularity timer will not fire at the exact time instead expire at a time value expires + granularity. This is done in the timer code when the index for each timer is calculated based on the expiry and granularity at each level: expires = (expires + LVL_GRAN(lvl)) >> LVL_SHIFT(lvl); For devfreq drivers the requirement is to fire the timer at the exact time. If the timer does not expire at the exact time then it'll take much longer to react and increase the device frequency. Devfreq driver registers timer for 10ms expiry and due to slack in timer code the expirty happens at 20 ms. For eg: Frame rendering time is 16ms. If devfreq driver reacts after 20ms instead of 10ms, that's way past a frame rendering time. Timers with 10ms to 630ms expiry fall under level 0, to overcome the granularity issue for level 0 with low expirty values do not add the granularity by introducing a new function calc_index_min_granularity. With the above approach if the timer interrupt on the cpu is delayed for a long time then there is a chance of missing the timer if base clk is forwarded to jiffies. In order to account for this corner case modify the nex_pending_bucket function to choose the least of expiry. The next_pending_bucket starts at the index based on base clk value and increments till the end of the bucket. ------------------------------ \| \| \| \| \| \| \| 0 \| 1 \| -----------\| \| 63 \| \| \| \| \| \| \| ------------------------------ ^ [start] \| [pos] [end] Above pos is the position based on the current base clk value, current code looks for first pending timer from pos to end. But there is a chance that there is pending timer from start to pos which could have lesser expiry. Modify the implementation to pick the least of the expiries. Change-Id: I60f6f4394de4b5f409829de9734645e1a0d7659e Signed-off-by: Channagoud Kadabi <ckadabi@codeaurora.org>	2017-08-29 13:57:12 -07:00
Matija Glavinic Pecotic	9ef8b23b94	timers: Fix overflow in get_next_timer_interrupt commit 34f41c0316ed52b0b44542491d89278efdaa70e4 upstream. For e.g. HZ=100, timer being 430 jiffies in the future, and 32 bit unsigned int, there is an overflow on unsigned int right-hand side of the expression which results with wrong values being returned. Type cast the multiplier to 64bit to avoid that issue. Fixes: `46c8f0b077` ("timers: Fix get_next_timer_interrupt() computation") Signed-off-by: Matija Glavinic Pecotic <matija.glavinic-pecotic.ext@nokia.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Alexander Sverdlin <alexander.sverdlin@nokia.com> Cc: khilman@baylibre.com Cc: akpm@linux-foundation.org Link: http://lkml.kernel.org/r/a7900f04-2a21-c9fd-67be-ab334d459ee5@nokia.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2017-08-11 08:49:30 -07:00
Prasad Sodagudi	602c4e27af	sched: Add a check for cpu unbound deferrable timers Add a check for cpu unbound deferrable timer expiry and raise softirq for handling the expired timers so that the CPU can process the cpu unbound deferrable times as early as possible when a cpu tries to enter/exit idle loop. Change-Id: Ieffa74fa22a4d25493f5590b5ac1e0d784fcbbad Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>	2017-07-17 19:23:35 -07:00
Kees Cook	a967be8dec	time: Remove CONFIG_TIMER_STATS Currently CONFIG_TIMER_STATS exposes process information across namespaces: kernel/time/timer_list.c print_timer(): SEQ_printf(m, ", %s/%d", tmp, timer->start_pid); /proc/timer_list: #11: <0000000000000000>, hrtimer_wakeup, S:01, do_nanosleep, cron/2570 Given that the tracer can give the same information, this patch entirely removes CONFIG_TIMER_STATS. Change-Id: I66e06ae2d6e32c309824310d3d9bf54d1047eab1 Suggested-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: John Stultz <john.stultz@linaro.org> Cc: Nicolas Pitre <nicolas.pitre@linaro.org> Cc: linux-doc@vger.kernel.org Cc: Lai Jiangshan <jiangshanlai@gmail.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Xing Gao <xgao01@email.wm.edu> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Jessica Frazelle <me@jessfraz.com> Cc: kernel-hardening@lists.openwall.com Cc: Nicolas Iooss <nicolas.iooss_linux@m4x.org> Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com> Cc: Petr Mladek <pmladek@suse.com> Cc: Richard Cochran <richardcochran@gmail.com> Cc: Tejun Heo <tj@kernel.org> Cc: Michal Marek <mmarek@suse.com> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Oleg Nesterov <oleg@redhat.com> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Cc: Olof Johansson <olof@lixom.net> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: linux-api@vger.kernel.org Cc: Arjan van de Ven <arjan@linux.intel.com> Link: http://lkml.kernel.org/r/20170208192659.GA32582@beast Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Git-commit: dfb4357da6ddbdf57d583ba64361c9d792b0e0b1 Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git [ohaugan@codeaurora.org: Fixed merge conflicts] Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>	2017-05-11 13:26:42 -07:00
Vikram Mulukutla	78a643ea96	timer: Update code that migrates timers and hrtimers during isolation __migrate_timers() can be called from both hotplug and isolation contexts. When called from the isolation context, we might sometimes encounter running timers. This is OK since the currently running or just expired timers are off of the timer wheel and so everything else can be migrated off. In the case of hrtimers, we must wait until all callbacks have finished. However, a udelay is important while waiting to allow for store-exclusive fairness when run_hrtimer is attempting to grab the hrtimer base lock. Change-Id: I4dccc66e09819a44b2f9597408a6a3ac4e11f5d7 Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org> Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>	2017-04-24 11:38:30 -07:00
Kyle Yan	df06519aa2	timer: Fix incorrect parenthesis in timer timer code was missing parenthesis in one of the checks to differentiate between global deferrable timer and percpu deferrable timer. Change-Id: I6894da3c3ca8ba01fe267d35aa22f2ec4303cd88 Signed-off-by: Kyle Yan <kyan@codeaurora.org>	2017-03-13 17:11:21 -07:00
Kyle Yan	e980f1e966	timer: Initialize global deferrable timer Initialize timer_base_deferrable variables properly along with the initialization of the per cpu timers. Change-Id: I14599cb6ab2fcc657edc7489ee1a55535183e3db Signed-off-by: Kyle Yan <kyan@codeaurora.org>	2017-03-07 15:04:20 -08:00
Kyle Yan	c1f109ce0a	timer: Add a global deferrable timer Add a global deferrable timer in addition to the per-cpu deferrable timer to allow deferrable timers without the TIMER_PINNED flag to run on any active CPU. Change-Id: I8e6b77cef972589912ad18f324c46c936fbbb96f Signed-off-by: Kyle Yan <kyan@codeaurora.org>	2017-03-02 13:43:20 -08:00
Olav Haugan	0f3f78edd7	timer: Do not require CPUSETS to be enabled for migration Do not require CPUSETS to be enabled to allow migration of timers and hrtimers. Change-Id: Ib911a0d34c250c4df020bdb265b92d2b8df8db93 Signed-off-by: Olav Haugan <ohaugan@codeaurora.org> [rameezmustafa@codeaurora.org: Port to msm-4.9] Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>	2017-02-07 14:50:20 -08:00
Santosh Shukla	e92935e2b4	timer: Add function to migrate timers Add function to migrate timer that will be used by later patch set. Change-Id: I370e404001344e635a663822b07557abbe0f6f52 Signed-off-by: Santosh Shukla <santosh.shukla@linaro.org> [ohaugan@codeaurora.org: Updated commit text and fixed trivial merge conflict] Git-commit: 3633b88d8fcb4273807574c27c328b6908a741e5 Git-repo: git://git.linaro.org/people/mike.holmes/santosh.shukla/lng-isol.git Signed-off-by: Olav Haugan <ohaugan@codeaurora.org> [rameezmustafa@codeaurora.org: Port to msm-4.9] Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>	2017-02-07 14:50:19 -08:00
Viresh Kumar	9536efe77a	timer: create timer_quiesce_cpu() to isolate CPU from timers To isolate CPUs (isolate from timers) from sysfs using cpusets, we need some support from the timer core. i.e. A routine timer_quiesce_cpu() which would migrates away all the unpinned timers, but shouldn't touch the pinned ones. This patch creates this routine. Change-Id: I8624e0659b86b7b8fa425a3fafdb0784fe005124 Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> [forward port to 3.18] Signed-off-by: Santosh Shukla <santosh.shukla@linaro.org> [ohaugan@codeaurora.org: Port to 4.4. Fixes for compilation error] Git-commit: 313910b70ea0c73f8789d9189c11e1f339080646 Git-repo: git://git.linaro.org/people/mike.holmes/santosh.shukla/lng-isol.git Signed-off-by: Olav Haugan <ohaugan@codeaurora.org> [rameezmustafa@codeaurora.org: Port to msm-4.9 and rebase to change patch dependency order.] Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>	2017-02-07 14:50:13 -08:00
Thomas Gleixner	6bad6bccf2	timers: Prevent base clock corruption when forwarding When a timer is enqueued we try to forward the timer base clock. This mechanism has two issues: 1) Forwarding a remote base unlocked The forwarding function is called from get_target_base() with the current timer base lock held. But if the new target base is a different base than the current base (can happen with NOHZ, sigh!) then the forwarding is done on an unlocked base. This can lead to corruption of base->clk. Solution is simple: Invoke the forwarding after the target base is locked. 2) Possible corruption due to jiffies advancing This is similar to the issue in get_net_timer_interrupt() which was fixed in the previous patch. jiffies can advance between check and assignement and therefore advancing base->clk beyond the next expiry value. So we need to read jiffies into a local variable once and do the checks and assignment with the local copy. Fixes: a683f390b93f("timers: Forward the wheel clock whenever possible") Reported-by: Ashton Holmes <scoopta@gmail.com> Reported-by: Michael Thayer <michael.thayer@oracle.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Michal Necasek <michal.necasek@oracle.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: knut.osmundsen@oracle.com Cc: stable@vger.kernel.org Cc: stern@rowland.harvard.edu Cc: rt@linutronix.de Link: http://lkml.kernel.org/r/20161022110552.253640125@linutronix.de Signed-off-by: Thomas Gleixner <tglx@linutronix.de>	2016-10-25 16:32:50 +02:00
Thomas Gleixner	041ad7bc75	timers: Prevent base clock rewind when forwarding clock Ashton and Michael reported, that kernel versions 4.8 and later suffer from USB timeouts which are caused by the timer wheel rework. This is caused by a bug in the base clock forwarding mechanism, which leads to timers expiring early. The scenario which leads to this is: run_timers() while (jiffies >= base->clk) { collect_expired_timers(); base->clk++; expire_timers(); } So base->clk = jiffies + 1. Now the cpu goes idle: idle() get_next_timer_interrupt() nextevt = __next_time_interrupt(); if (time_after(nextevt, base->clk)) base->clk = jiffies; jiffies has not advanced since run_timers(), so this assignment effectively decrements base->clk by one. base->clk is the index into the timer wheel arrays. So let's assume the following state after the base->clk increment in run_timers(): jiffies = 0 base->clk = 1 A timer gets enqueued with an expiry delta of 63 ticks (which is the case with the USB timeout and HZ=250) so the resulting bucket index is: base->clk + delta = 1 + 63 = 64 The timer goes into the first wheel level. The array size is 64 so it ends up in bucket 0, which is correct as it takes 63 ticks to advance base->clk to index into bucket 0 again. If the cpu goes idle before jiffies advance, then the bug in the forwarding mechanism sets base->clk back to 0, so the next invocation of run_timers() at the next tick will index into bucket 0 and therefore expire the timer 62 ticks too early. Instead of blindly setting base->clk to jiffies we must make the forwarding conditional on jiffies > base->clk, but we cannot use jiffies for this as we might run into the following issue: if (time_after(jiffies, base->clk) { if (time_after(nextevt, base->clk)) base->clk = jiffies; jiffies can increment between the check and the assigment far enough to advance beyond nextevt. So we need to use a stable value for checking. get_next_timer_interrupt() has the basej argument which is the jiffies value snapshot taken in the calling code. So we can just that. Thanks to Ashton for bisecting and providing trace data! Fixes: `a683f390b9` ("timers: Forward the wheel clock whenever possible") Reported-by: Ashton Holmes <scoopta@gmail.com> Reported-by: Michael Thayer <michael.thayer@oracle.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Michal Necasek <michal.necasek@oracle.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: knut.osmundsen@oracle.com Cc: stable@vger.kernel.org Cc: stern@rowland.harvard.edu Cc: rt@linutronix.de Link: http://lkml.kernel.org/r/20161022110552.175308322@linutronix.de Signed-off-by: Thomas Gleixner <tglx@linutronix.de>	2016-10-25 16:32:50 +02:00
Thomas Gleixner	4da9152a43	timers: Lock base for same bucket optimization Linus stumbled over the unlocked modification of the timer expiry value in mod_timer() which is an optimization for timers which stay in the same bucket - due to the bucket granularity - despite their expiry time getting updated. The optimization itself still makes sense even if we take the lock, because in case that the bucket stays the same, we avoid the pointless queue/enqueue dance. Make the check and the modification of timer->expires protected by the base lock and shuffle the remaining code around so we can keep the lock held when we actually have to requeue the timer to a different bucket. Fixes: `f00c0afdfa` ("timers: Implement optimization for same expiry time in mod_timer()") Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1610241711220.4983@nanos Cc: stable@vger.kernel.org Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org>	2016-10-25 16:27:39 +02:00
Thomas Gleixner	b831275a35	timers: Plug locking race vs. timer migration Linus noticed that lock_timer_base() lacks a READ_ONCE() for accessing the timer flags. As a consequence the compiler is allowed to reload the flags between the initial check for TIMER_MIGRATION and the following timer base computation and the spin lock of the base. While this has not been observed (yet), we need to make sure that it never happens. Fixes: `0eeda71bc3` ("timer: Replace timer base by a cpu index") Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1610241711220.4983@nanos Cc: stable@vger.kernel.org Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org>	2016-10-25 16:27:39 +02:00
Emese Revfy	0766f788eb	latent_entropy: Mark functions with __latent_entropy The __latent_entropy gcc attribute can be used only on functions and variables. If it is on a function then the plugin will instrument it for gathering control-flow entropy. If the attribute is on a variable then the plugin will initialize it with random contents. The variable must be an integer, an integer array type or a structure with integer fields. These specific functions have been selected because they are init functions (to help gather boot-time entropy), are called at unpredictable times, or they have variable loops, each of which provide some level of latent entropy. Signed-off-by: Emese Revfy <re.emese@gmail.com> [kees: expanded commit message] Signed-off-by: Kees Cook <keescook@chromium.org>	2016-10-10 14:51:45 -07:00
Chris Metcalf	46c8f0b077	timers: Fix get_next_timer_interrupt() computation The tick_nohz_stop_sched_tick() routine is not properly canceling the sched timer when nothing is pending, because get_next_timer_interrupt() is no longer returning KTIME_MAX in that case. This causes periodic interrupts when none are needed. When determining the next interrupt time, we first use __next_timer_interrupt() to get the first expiring timer in the timer wheel. If no timer is found, we return the base clock value plus NEXT_TIMER_MAX_DELTA to indicate there is no timer in the timer wheel. Back in get_next_timer_interrupt(), we set the "expires" value by converting the timer wheel expiry (in ticks) to a nsec value. But we don't want to do this if the timer wheel expiry value indicates no timer; we want to return KTIME_MAX. Prior to commit `500462a9de` ("timers: Switch to a non-cascading wheel") we checked base->active_timers to see if any timers were active, and if not, we didn't touch the expiry value and so properly returned KTIME_MAX. Now we don't have active_timers. To fix this, we now just check the timer wheel expiry value to see if it is "now + NEXT_TIMER_MAX_DELTA", and if it is, we don't try to compute a new value based on it, but instead simply let the KTIME_MAX value in expires remain. Fixes: `500462a9de` "timers: Switch to a non-cascading wheel" Signed-off-by: Chris Metcalf <cmetcalf@mellanox.com> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Christoph Lameter <cl@linux.com> Cc: John Stultz <john.stultz@linaro.org> Link: http://lkml.kernel.org/r/1470688147-22287-1-git-send-email-cmetcalf@mellanox.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de>	2016-08-09 09:31:55 +02:00
Richard Cochran	24f73b9971	timers/core: Convert to hotplug state machine When tearing down, call timers_dead_cpu() before notify_dead(). There is a hidden dependency between: - timers - block multiqueue - rcutree If timers_dead_cpu() comes later than blk_mq_queue_reinit_notify() that latter function causes a RCU stall. Signed-off-by: Richard Cochran <rcochran@linutronix.de> Signed-off-by: Anna-Maria Gleixner <anna-maria@linutronix.de> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Cc: John Stultz <john.stultz@linaro.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: rt@linutronix.de Link: http://lkml.kernel.org/r/20160713153337.566790058@linutronix.de Signed-off-by: Ingo Molnar <mingo@kernel.org>	2016-07-15 10:41:42 +02:00
Ingo Molnar	4b4b20852d	Merge branch 'timers/fast-wheel' into timers/core	2016-07-07 10:35:28 +02:00
Anna-Maria Gleixner	f00c0afdfa	timers: Implement optimization for same expiry time in mod_timer() The existing optimization for same expiry time in mod_timer() checks whether the timer expiry time is the same as the new requested expiry time. In the old timer wheel implementation this does not take the slack batching into account, neither does the new implementation evaluate whether the new expiry time will requeue the timer to the same bucket. To optimize that, we can calculate the resulting bucket and check if the new expiry time is different from the current expiry time. This calculation happens outside the base lock held region. If the resulting bucket is the same we can avoid taking the base lock and requeueing the timer. If the timer needs to be requeued then we have to check under the base lock whether the base time has changed between the lockless calculation and taking the lock. If it has changed we need to recalculate under the lock. This optimization takes effect for timers which are enqueued into the less granular wheel levels (1 and above). With a simple test case the functionality has been verified: Before After Match: 5.5% 86.6% Requeue: 94.5% 13.4% Recalc: <0.01% In the non optimized case the timer is requeued in 94.5% of the cases. With the index optimization in place the requeue rate drops to 13.4%. The case where the lockless index calculation has to be redone is less than 0.01%. With a real world test case (networking) we observed the following changes: Before After Match: 97.8% 99.7% Requeue: 2.2% 0.3% Recalc: <0.001% That means two percent fewer lock/requeue/unlock operations done in one of the hot path use cases of timers. Signed-off-by: Anna-Maria Gleixner <anna-maria@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Arjan van de Ven <arjan@infradead.org> Cc: Chris Mason <clm@fb.com> Cc: Eric Dumazet <edumazet@google.com> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: George Spelvin <linux@sciencehorizons.net> Cc: Josh Triplett <josh@joshtriplett.org> Cc: Len Brown <lenb@kernel.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Rik van Riel <riel@redhat.com> Cc: rt@linutronix.de Link: http://lkml.kernel.org/r/20160704094342.778527749@linutronix.de Signed-off-by: Ingo Molnar <mingo@kernel.org>	2016-07-07 10:35:12 +02:00
Anna-Maria Gleixner	ffdf047728	timers: Split out index calculation For further optimizations we need to seperate index calculation from queueing. No functional change. Signed-off-by: Anna-Maria Gleixner <anna-maria@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Arjan van de Ven <arjan@infradead.org> Cc: Chris Mason <clm@fb.com> Cc: Eric Dumazet <edumazet@google.com> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: George Spelvin <linux@sciencehorizons.net> Cc: Josh Triplett <josh@joshtriplett.org> Cc: Len Brown <lenb@kernel.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Rik van Riel <riel@redhat.com> Cc: rt@linutronix.de Link: http://lkml.kernel.org/r/20160704094342.691159619@linutronix.de Signed-off-by: Ingo Molnar <mingo@kernel.org>	2016-07-07 10:35:12 +02:00
Thomas Gleixner	4e85876a9d	timers: Only wake softirq if necessary With the wheel forwading in place and with the HZ=1000 4ms folding we can avoid running the softirq at all. Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Arjan van de Ven <arjan@infradead.org> Cc: Chris Mason <clm@fb.com> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: George Spelvin <linux@sciencehorizons.net> Cc: Josh Triplett <josh@joshtriplett.org> Cc: Len Brown <lenb@kernel.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Paul McKenney <paulmck@linux.vnet.ibm.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Rik van Riel <riel@redhat.com> Cc: rt@linutronix.de Link: http://lkml.kernel.org/r/20160704094342.607650550@linutronix.de Signed-off-by: Ingo Molnar <mingo@kernel.org>	2016-07-07 10:35:11 +02:00

1 2

91 Commits