Evolution-X-Devices/kernel_google_msm-4.14
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
805,988 Commits 3 Branches 0 Tags
bka
Commit Graph

73 Commits

Author SHA1 Message Date
Rick Edgecombe
d4a7ec904b UPSTREAM: mm/vmalloc: Add flag for freeing of special permsissions 
Add a new flag VM_FLUSH_RESET_PERMS, for enabling vfree operations to
immediately clear executable TLB entries before freeing pages, and handle
resetting permissions on the directmap. This flag is useful for any kind
of memory with elevated permissions, or where there can be related
permissions changes on the directmap. Today this is RO+X and RO memory.

Although this enables directly vfreeing non-writeable memory now,
non-writable memory cannot be freed in an interrupt because the allocation
itself is used as a node on deferred free list. So when RO memory needs to
be freed in an interrupt the code doing the vfree needs to have its own
work queue, as was the case before the deferred vfree list was added to
vmalloc.

For architectures with set_direct_map_ implementations this whole operation
can be done with one TLB flush when centralized like this. For others with
directmap permissions, currently only arm64, a backup method using
set_memory functions is used to reset the directmap. When arm64 adds
set_direct_map_ functions, this backup can be removed.

When the TLB is flushed to both remove TLB entries for the vmalloc range
mapping and the direct map permissions, the lazy purge operation could be
done to try to save a TLB flush later. However today vm_unmap_aliases
could flush a TLB range that does not include the directmap. So a helper
is added with extra parameters that can allow both the vmalloc address and
the direct mapping to be flushed during this operation. The behavior of the
normal vm_unmap_aliases function is unchanged.

Suggested-by: Dave Hansen <dave.hansen@intel.com>
Suggested-by: Andy Lutomirski <luto@kernel.org>
Suggested-by: Will Deacon <will.deacon@arm.com>
Change-Id: I914f605f3601bde21f194069dd31e658c9a22fcd
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: <akpm@linux-foundation.org>
Cc: <ard.biesheuvel@linaro.org>
Cc: <deneen.t.dock@intel.com>
Cc: <kernel-hardening@lists.openwall.com>
Cc: <kristen@linux.intel.com>
Cc: <linux_dti@icloud.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Nadav Amit <nadav.amit@gmail.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/20190426001143.4983-17-namit@vmware.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
 2025-10-10 05:02:47 +03:00
Kees Cook
d39bbbb342 UPSTREAM: mm: Use overflow helpers in kvmalloc() 
Instead of open-coded multiplication and bounds checking, use the new
overflow helper. Additionally prepare for vmalloc() users to add
array_size()-family helpers in the future.

Change-Id: I38470b8d03d0506a39ca6bd343d3e6771a050493
Signed-off-by: Kees Cook <keescook@chromium.org>
 2025-10-10 04:55:49 +03:00
lucaswei
5736f5570e Merge android-4.14-q (4.14.180) into android-msm-floral-4.14-lts 
Merge 4.14.180 into android-4.14-q
Linux 4.14.180
    cgroup, netclassid: remove double cond_resched
  * mac80211: add ieee80211_is_any_nullfunc()
      include/linux/ieee80211.h
    ALSA: hda: Match both PCI ID and SSID for driver blacklist
  * tracing: Reverse the order of trace_types_lock and event_mutex
      kernel/trace/trace.c
      kernel/trace/trace_events.c
    sctp: Fix SHUTDOWN CTSN Ack in the peer restart case
    net: systemport: suppress warnings on failed Rx SKB allocations
    net: bcmgenet: suppress warnings on failed Rx SKB allocations
  * lib/mpi: Fix building for powerpc with clang
      lib/mpi/longlong.h
    net: dsa: b53: Rework ARL bin logic
    scripts/config: allow colons in option strings for sed
    s390/ftrace: fix potential crashes when switching tracers
    cifs: protect updating server->dstaddr with a spinlock
    net: stmmac: Fix sub-second increment
    net: stmmac: fix enabling socfpga's ptp_ref_clock
    wimax/i2400m: Fix potential urb refcnt leak
    ASoC: codecs: hdac_hdmi: Fix incorrect use of list_for_each_entry
    ASoC: rsnd: Fix HDMI channel mapping for multi-SSI mode
    ASoC: sgtl5000: Fix VAG power-on handling
    selftests/ipc: Fix test failure seen after initial test run
    ASoC: topology: Check return value of pcm_new_ver
    powerpc/pci/of: Parse unassigned resources
    vhost: vsock: kick send_pkt worker once device is started
    Merge 4.14.179 into android-4.14-q
Linux 4.14.179
  * selinux: properly handle multiple messages in selinux_netlink_send()
      security/selinux/hooks.c
    dmaengine: dmatest: Fix iteration non-stop logic
    nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl
    ALSA: opti9xx: shut up gcc-10 range warning
    iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled system
    scsi: target/iblock: fix WRITE SAME zeroing
    iommu/qcom: Fix local_base status check
    vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn()
    vfio: avoid possible overflow in vfio_iommu_type1_pin_pages
    RDMA/mlx4: Initialize ib_spec on the stack
    RDMA/mlx5: Set GRH fields in query QP on RoCE
  * dm verity fec: fix hash block number in verity_fec_decode
      drivers/md/dm-verity-fec.c
    PM: hibernate: Freeze kernel threads in software_resume()
    PM: ACPI: Output correct message on target power state
    ALSA: pcm: oss: Place the plugin buffer overflow checks correctly
    ALSA: hda/hdmi: fix without unlocked before return
    ALSA: hda/realtek - Two front mics on a Lenovo ThinkCenter
    mmc: sdhci-pci: Fix eMMC driver strength for BYT-based controllers
    mmc: sdhci-xenon: fix annoying 1.8V regulator warning
    btrfs: fix partial loss of prealloc extent past i_size after fsync
    btrfs: fix block group leak when removing fails
    drm/qxl: qxl_release use after free
    drm/qxl: qxl_release leak in qxl_hw_surface_alloc()
    drm/qxl: qxl_release leak in qxl_draw_dirty_fb()
  * drm/edid: Fix off-by-one in DispID DTD pixel clock
      drivers/gpu/drm/drm_edid.c
  * ext4: fix special inode number checks in __ext4_iget()
      fs/ext4/inode.c
    Merge 4.14.178 into android-4.14-q
Linux 4.14.178
  * propagate_one(): mnt_set_mountpoint() needs mount_lock
      fs/pnode.c
  * ext4: check for non-zero journal inum in ext4_calculate_overhead
      fs/ext4/super.c
    qed: Fix use after free in qed_chain_free
  * ext4: unsigned int compared against zero
      fs/ext4/block_validity.c
  * ext4: fix block validity checks for journal inodes using indirect blocks
      fs/ext4/block_validity.c
  * ext4: don't perform block validity checks on the journal inode
      fs/ext4/extents.c
  * ext4: protect journal inode's blocks using block_validity
      fs/ext4/block_validity.c
      fs/ext4/inode.c
  * ext4: avoid declaring fs inconsistent due to invalid file handles
      fs/ext4/ext4.h
      fs/ext4/ialloc.c
      fs/ext4/inode.c
      fs/ext4/ioctl.c
      fs/ext4/namei.c
      fs/ext4/resize.c
      fs/ext4/super.c
      fs/ext4/xattr.c
    hwmon: (jc42) Fix name to have no illegal characters
  * ext4: convert BUG_ON's to WARN_ON's in mballoc.c
      fs/ext4/mballoc.c
  * ext4: increase wait time needed before reuse of deleted inode numbers
      fs/ext4/ialloc.c
  * ext4: use matching invalidatepage in ext4_writepage
      fs/ext4/inode.c
  * arm64: Delete the space separator in __emit_inst
      arch/arm64/include/asm/sysreg.h
    xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status
    objtool: Support Clang non-section symbols in ORC dump
    objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings
    scsi: target: fix PR IN / READ FULL STATUS for FC
    xfs: fix partially uninitialized structure in xfs_reflink_remap_extent
    x86: hyperv: report value of misc_features
    bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B
  * mm: shmem: disable interrupt when acquiring info->lock in userfaultfd_copy path
      mm/shmem.c
  * perf/core: fix parent pid/tid in task exit events
      kernel/events/core.c
    ARM: dts: bcm283x: Disable dsi0 node
    net/cxgb4: Check the return from t4_query_params properly
    i2c: altera: use proper variable to hold errno
    nfsd: memory corruption in nfsd4_lock()
    iio:ad7797: Use correct attribute_group
    usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete
  * usb: dwc3: gadget: Do link recovery for SS and SSP
      drivers/usb/dwc3/gadget.c
  * binder: take read mode of mmap_sem in binder_alloc_free_page()
      drivers/android/binder_alloc.c
  * include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap
      include/uapi/linux/swab.h
    mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer
    remoteproc: Fix wrong rvring index computation
    xfs: Fix deadlock between AGI and AGF with RENAME_WHITEOUT
    xfs: validate sb_logsunit is a multiple of the fs blocksize
    serial: sh-sci: Make sure status register SCxSR is read in correct sequence
  * usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset()
      drivers/usb/gadget/function/f_fs.c
    UAS: fix deadlock in error handling and PM flushing work
    UAS: no use logging any details in case of ENODEV
    cdc-acm: introduce a cool down
    cdc-acm: close race betrween suspend() and acm_softint
    staging: vt6656: Power save stop wake_up_count wrap around.
    staging: vt6656: Fix pairwise key entry save.
    staging: vt6656: Fix drivers TBTT timing counter.
    staging: vt6656: Fix calling conditions of vnt_set_bss_mode
    staging: vt6656: Don't set RCR_MULTICAST or RCR_BROADCAST by default.
  * vt: don't hardcode the mem allocation upper bound
      drivers/tty/vt/vt.c
    staging: comedi: Fix comedi_device refcnt leak in comedi_open
    staging: comedi: dt2815: fix writing hi byte of analog output
    powerpc/setup_64: Set cache-line-size based on cache-block-size
    ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y
    iwlwifi: pcie: actually release queue memory in TVQM
  * ASoC: dapm: fixup dapm kcontrol widget
      sound/soc/soc-dapm.c
  * audit: check the length of userspace generated audit records
      kernel/audit.c
  * usb-storage: Add unusual_devs entry for JMicron JMS566
      drivers/usb/storage/unusual_devs.h
    tty: rocket, avoid OOB access
    tty: hvc: fix buffer overflow during hvc_alloc().
    KVM: VMX: Enable machine check support for 32bit targets
  * KVM: Check validity of resolved slot when searching memslots
      include/linux/kvm_host.h
    tpm: ibmvtpm: retry on H_CLOSED in tpm_ibmvtpm_send()
    tpm/tpm_tis: Free IRQ if probing fails
  * ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices
      sound/usb/format.c
  * ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif
      sound/usb/mixer_quirks.c
    ALSA: hda/realtek - Add new codec supported for ALC245
    ALSA: usx2y: Fix potential NULL dereference
    tools/vm: fix cross-compile build
    mm/ksm: fix NULL pointer dereference when KSM zero page is enabled
    mm/hugetlb: fix a addressing exception caused by huge_pte_offset
  * vmalloc: fix remap_vmalloc_range() bounds checks
      include/linux/vmalloc.h
      mm/vmalloc.c
  * overflow.h: Add arithmetic shift helper
      include/linux/overflow.h
  * USB: hub: Fix handling of connect changes during sleep
      drivers/usb/core/hub.c
  * USB: core: Fix free-while-in-use bug in the USB S-Glibrary
      drivers/usb/core/message.c
    USB: early: Handle AMD's spec-compliant identifiers, too
  * USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70 RGB RAPIDFIRE
      drivers/usb/core/quirks.c
    USB: sisusbvga: Change port variable from signed to unsigned
  * fs/namespace.c: fix mountpoint reference counter race
      fs/namespace.c
    iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode
    iio: xilinx-xadc: Fix clearing interrupt when enabling trigger
    iio: xilinx-xadc: Fix ADC-B powerdown
    iio: adc: stm32-adc: fix sleep in atomic context
    ALSA: hda: Remove ASUS ROG Zenith from the blacklist
  * KEYS: Avoid false positive ENOMEM error on key read
      security/keys/internal.h
      security/keys/keyctl.c
    vrf: Check skb for XFRM_TRANSFORMED flag
  * xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish
      net/ipv4/xfrm4_output.c
      net/ipv6/xfrm6_output.c
    net: dsa: b53: Fix ARL register definitions
    team: fix hang in team_mode_get()
  * tcp: cache line align MAX_TCP_HEADER
      include/net/tcp.h
    net/x25: Fix x25_neigh refcnt leak when receiving frame
    net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
    net: bcmgenet: correct per TX/RX ring statistics
    macvlan: fix null dereference in macvlan_device_event()
    macsec: avoid to set wrong mtu
  * ipv6: fix restrict IPV6_ADDRFORM operation
      net/ipv6/ipv6_sockglue.c
    cxgb4: fix large delays in PTP synchronization
  * mm, slub: restore the original intention of prefetch_freepointer()
      mm/slub.c
    PCI/ASPM: Allow re-enabling Clock PM
  * perf/core: Disable page faults when getting phys address
      kernel/events/core.c
    pwm: bcm2835: Dynamically allocate base
    pwm: renesas-tpu: Fix late Runtime PM enablement
    s390/cio: avoid duplicated 'ADD' uevents
    ipc/util.c: sysvipc_find_ipc() should increase position index
    selftests: kmod: fix handling test numbers above 9
    kernel/gcov/fs.c: gcov_seq_next() should increase position index
    ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map()
    scsi: iscsi: Report unbind session event when the target has been removed
    pwm: rcar: Fix late Runtime PM enablement
    ceph: don't skip updating wanted caps when cap is stale
    ceph: return ceph_mdsc_do_request() errors from __get_parent()
    scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login
  * watchdog: reset last_hw_keepalive time at start
      drivers/watchdog/watchdog_dev.c
  * vti4: removed duplicate log message.
      net/ipv4/ip_vti.c
    crypto: mxs-dcp - make symbols 'sha1_null_hash' and 'sha256_null_hash' static
  * drm/msm: Use the correct dma_sync calls harder
      drivers/gpu/drm/msm/msm_gem.c
  * keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h
      include/uapi/linux/keyctl.h
  * net: ipv4: avoid unused variable warning for sysctl
      net/ipv4/route.c
  * net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg()
      net/ipv4/raw.c
  * ext4: fix extent_status fragmentation for plain files
      fs/ext4/extents.c
    ANDROID: cuttlefish_defconfig: Fix dm-verity related options
  * BACKPORT: loop: Add LOOP_SET_BLOCK_SIZE in compat ioctl
      drivers/block/loop.c
  * BACKPORT: loop: change queue block size to match when using DIO
      drivers/block/loop.c
    Merge 4.14.177 into android-4.14-q
Linux 4.14.177
  * KEYS: Don't write out to userspace while holding key semaphore
      include/keys/user-type.h
      include/linux/key-type.h
      net/dns_resolver/dns_key.c
      security/keys/keyctl.c
      security/keys/keyring.c
      security/keys/request_key_auth.c
      security/keys/user_defined.c
    KEYS: Use individual pages in big_key for crypto buffers
    mtd: phram: fix a double free issue in error path
    mtd: lpddr: Fix a double free in probe()
    locktorture: Print ratio of acquisitions, not failures
    tty: evh_bytechan: Fix out of bounds accesses
  * fbdev: potential information leak in do_fb_ioctl()
      drivers/video/fbdev/core/fbmem.c
    net: dsa: bcm_sf2: Fix overflow checks
    iommu/amd: Fix the configuration of GCR3 table root pointer
    libnvdimm: Out of bounds read in __nd_ioctl()
    ext2: fix debug reference to ext2_xattr_cache
    ext2: fix empty body warnings when -Wextra is used
    iommu/vt-d: Fix mm reference leak
    NFS: Fix memory leaks in nfs_pageio_stop_mirroring()
    drm/amdkfd: kfree the wrong pointer
    x86: ACPI: fix CPU hotplug deadlock
    KVM: s390: vsie: Fix possible race when shadowing region 3 tables
  * compiler.h: fix error in BUILD_BUG_ON() reporting
      include/linux/compiler.h
  * percpu_counter: fix a data race at vm_committed_as
      include/linux/percpu_counter.h
  * include/linux/swapops.h: correct guards for non_swap_entry()
      include/linux/swapops.h
  * ext4: do not commit super on read-only bdev
      fs/ext4/super.c
    powerpc/maple: Fix declaration made after definition
    s390/cpuinfo: fix wrong output when CPU0 is offline
    NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context fails
    NFSv4/pnfs: Return valid stateids in nfs_layout_find_inode_by_stateid()
    rtc: 88pm860x: fix possible race condition
    soc: imx: gpc: fix power up sequencing
    clk: tegra: Fix Tegra PMC clock out parents
    power: supply: bq27xxx_battery: Silence deferred-probe error
    clk: at91: usb: continue if clk_hw_round_rate() return zero
    of: unittest: kmemleak in of_unittest_platform_populate()
    rbd: call rbd_dev_unprobe() after unwatching and flushing notifies
    rbd: avoid a deadlock on header_rwsem when flushing notifies
  * of: fix missing kobject init for !SYSFS && OF_DYNAMIC config
      drivers/of/base.c
  * soc: qcom: smem: Use le32_to_cpu for comparison
      drivers/soc/qcom/smem.c
    wil6210: abort properly in cfg suspend
    wil6210: fix length check in __wmi_send
    wil6210: add block size checks during FW load
    wil6210: fix PCIe bus mastering in case of interface down
  * rpmsg: glink: smem: Ensure ordering during tx
      drivers/rpmsg/qcom_glink_smem.c
  * rpmsg: glink: Fix missing mutex_init() in qcom_glink_alloc_channel()
      drivers/rpmsg/qcom_glink_native.c
    rtc: pm8xxx: Fix issue in RTC write path
  * rpmsg: glink: use put_device() if device_register fail
      drivers/rpmsg/qcom_glink_smem.c
    wil6210: rate limit wil_rx_refill error
  * scsi: ufs: ufs-qcom: remove broken hci version quirk
      drivers/scsi/ufs/ufs-qcom.c
  * scsi: ufs: make sure all interrupts are processed
      drivers/scsi/ufs/ufshcd.c
    wil6210: fix temperature debugfs
    wil6210: increase firmware ready timeout
  * arch_topology: Fix section miss match warning due to free_raw_capacity()
      drivers/base/arch_topology.c
  * arm64: traps: Don't print stack or raw PC/LR values in backtraces
      arch/arm64/kernel/process.c
      arch/arm64/kernel/traps.c
  * arm64: perf: remove unsupported events for Cortex-A73
      arch/arm64/kernel/perf_event.c
  * Revert "gpio: set up initial state from .get_direction()"
      drivers/gpio/gpiolib.c
  * clk: Fix debugfs_create_*() usage
      drivers/clk/clk.c
  * drm: NULL pointer dereference [null-pointer-deref] (CWE 476) problem
      drivers/gpu/drm/drm_dp_mst_topology.c
    video: fbdev: sis: Remove unnecessary parentheses and commented code
    lib/raid6: use vdupq_n_u8 to avoid endianness warnings
    ALSA: hda: Don't release card at firmware loading error
    irqchip/mbigen: Free msi_desc on device teardown
    netfilter: nf_tables: report EOPNOTSUPP on unsupported flags/object type
    arm, bpf: Fix bugs with ALU64 {RSH, ARSH} BPF_K shift by 0
  * ext4: use non-movable memory for superblock readahead
      fs/buffer.c
      fs/ext4/inode.c
      fs/ext4/super.c
      include/linux/buffer_head.h
  * scsi: sg: add sg_remove_request in sg_common_write
      drivers/scsi/sg.c
    objtool: Fix switch table detection in .text.unlikely
  * mm/vmalloc.c: move 'area->pages' after if statement
      mm/vmalloc.c
    x86/resctrl: Fix invalid attempt at removing the default resource group
    x86/resctrl: Preserve CDP enable over CPU hotplug
    x86/intel_rdt: Enable L2 CDP in MSR IA32_L2_QOS_CFG
    x86/intel_rdt: Add two new resources for L2 Code and Data Prioritization (CDP)
    x86/intel_rdt: Enumerate L2 Code and Data Prioritization (CDP) feature
    x86/microcode/AMD: Increase microcode PATCH_MAX_SIZE
    scsi: target: fix hang when multiple threads try to destroy the same iscsi session
    scsi: target: remove boilerplate code
    kvm: x86: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD
    dm flakey: check for null arg_name in parse_features()
  * ext4: do not zeroout extents beyond i_disksize
      fs/ext4/extents.c
    mac80211_hwsim: Use kstrndup() in place of kasprintf()
    btrfs: check commit root generation in should_ignore_root
  * tracing: Fix the race between registering 'snapshot' event trigger and triggering 'snapshot' operation
      kernel/trace/trace_events_trigger.c
  * ALSA: usb-audio: Don't override ignore_ctl_error value from the map
      sound/usb/mixer.c
    ASoC: Intel: mrfld: return error codes when an error occurs
    ASoC: Intel: mrfld: fix incorrect check on p->sink
  * ext4: fix incorrect inodes per group in error message
      fs/ext4/super.c
  * ext4: fix incorrect group count in ext4_fill_super error message
      fs/ext4/super.c
    pwm: pca9685: Fix PWM/GPIO inter-operation
  * jbd2: improve comments about freeing data buffers whose page mapping is NULL
      fs/jbd2/commit.c
  * scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic
      drivers/scsi/ufs/ufshcd.c
    net: stmmac: dwmac-sunxi: Provide TX and RX fifo sizes
  * net: revert default NAPI poll timeout to 2 jiffies
      net/core/dev.c
  * net: qrtr: send msgs from local of same id as broadcast
      net/qrtr/qrtr.c
  * net: ipv6: do not consider routes via gateways for anycast address check
      include/net/ip6_route.h
  * net: ipv4: devinet: Fix crash when add/del multicast IP with autojoin
      net/ipv4/devinet.c
    hsr: check protocol version in hsr_newlink()
    amd-xgbe: Use __napi_schedule() in BH context
    mfd: dln2: Fix sanity checking for endpoints
    misc: echo: Remove unnecessary parentheses and simplify check for zero
    powerpc/fsl_booke: Avoid creating duplicate tlb1 entry
    ipmi: fix hung processes in __get_guid()
    ftrace/kprobe: Show the maxactive number on kprobe_events
  * drm: Remove PageReserved manipulation from drm_pci_alloc
      drivers/gpu/drm/drm_pci.c
  * drm/dp_mst: Fix clearing payload state on topology disable
      drivers/gpu/drm/drm_dp_mst_topology.c
    crypto: caam - update xts sector size for large input length
    dm zoned: remove duplicate nr_rnd_zones increase in dmz_init_zone()
    btrfs: use nofs allocations for running delayed items
    Btrfs: fix crash during unmount due to race with delayed inode workers
    powerpc: Make setjmp/longjmp signature standard
    powerpc: Add attributes for setjmp/longjmp
    scsi: mpt3sas: Fix kernel panic observed on soft HBA unplug
    powerpc/kprobes: Ignore traps that happened in real mode
    powerpc/xive: Use XIVE_BAD_IRQ instead of zero to catch non configured IPIs
    powerpc/hash64/devmap: Use H_PAGE_THP_HUGE when setting up huge devmap PTE entries
    powerpc/64/tm: Don't let userspace set regs->trap via sigreturn
    powerpc/powernv/idle: Restore AMR/UAMOR/AMOR after idle
    libata: Return correct status in sata_pmp_eh_recover_pm() when ATA_DFLAG_DETACH is set
    hfsplus: fix crash and filesystem corruption when deleting files
    cpufreq: powernv: Fix use-after-free
  * kmod: make request_module() return an error when autoloading is disabled
      kernel/kmod.c
    Input: i8042 - add Acer Aspire 5738z to nomux list
    s390/diag: fix display of diagnose call statistics
    perf tools: Support Python 3.8+ in Makefile
    ocfs2: no need try to truncate file beyond i_size
  * fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()
      fs/filesystems.c
  * ext4: fix a data race at inode->i_blocks
      fs/ext4/inode.c
    NFS: Fix a page leak in nfs_destroy_unlinked_subrequests()
    rtc: omap: Use define directive for PIN_CONFIG_ACTIVE_HIGH
  * arm64: armv8_deprecated: Fix undef_hook mask for thumb setend
      arch/arm64/kernel/armv8_deprecated.c
    scsi: zfcp: fix missing erp_lock in port recovery trigger for point-to-point
  * dm verity fec: fix memory leak in verity_fec_dtr
      drivers/md/dm-verity-fec.c
  * mm: Use fixed constant in page_frag_alloc instead of size + 1
      mm/page_alloc.c
    tools: gpio: Fix out-of-tree build regression
  * x86/speculation: Remove redundant arch_smt_update() invocation
      kernel/cpu.c
    powerpc/pseries: Drop pointless static qualifier in vpa_debugfs_init()
  * net: rtnl_configure_link: fix dev flags changes arg to __dev_notify_flags
      net/core/rtnetlink.c
    ALSA: hda: Initialize power_state field properly
    crypto: mxs-dcp - fix scatterlist linearization for hash
    btrfs: drop block from cache on error in relocation
    CIFS: Fix bug which the return value by asynchronous read is error
    KVM: VMX: fix crash cleanup when KVM wasn't used
    KVM: VMX: Always VMCLEAR in-use VMCSes during crash with kexec support
    KVM: x86: Allocate new rmap and large page tracking when moving memslot
    KVM: s390: vsie: Fix delivery of addressing exceptions
    KVM: s390: vsie: Fix region 1 ASCE sanity shadow address checks
    KVM: nVMX: Properly handle userspace interrupt window request
    x86/entry/32: Add missing ASM_CLAC to general_protection entry
  * signal: Extend exec_id to 64bits
      fs/exec.c
      include/linux/sched.h
      kernel/signal.c
    ath9k: Handle txpower changes even when TPC is disabled
    MIPS: OCTEON: irq: Fix potential NULL pointer dereference
    irqchip/versatile-fpga: Apply clear-mask earlier
  * KEYS: reaching the keys quotas correctly
      security/keys/key.c
      security/keys/keyctl.c
    PCI: endpoint: Fix for concurrent memory allocation in OB address region
    PCI/ASPM: Clear the correct bits when enabling L1 substates
    nvme-fc: Revert "add module to ops template to allow module references"
  * thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n
      include/linux/devfreq_cooling.h
    acpi/x86: ignore unspecified bit positions in the ACPI global lock field
    media: ti-vpe: cal: fix disable_irqs to only the intended target
    ALSA: hda/realtek - Set principled PC Beep configuration for ALC256
    ALSA: doc: Document PC Beep Hidden Register on Realtek ALC256
    ALSA: pcm: oss: Fix regression by buffer overflow fix
    ALSA: ice1724: Fix invalid access for enumerated ctl items
    ALSA: hda: Fix potential access overflow in beep helper
    ALSA: hda: Add driver blacklist
  * ALSA: usb-audio: Add mixer workaround for TRX40 and co
      sound/usb/mixer_maps.c
  * usb: gadget: composite: Inform controller driver of self-powered
      drivers/usb/gadget/composite.c
  * usb: gadget: f_fs: Fix use after free issue as part of queue failure
      drivers/usb/gadget/function/f_fs.c
    ASoC: topology: use name_prefix for new kcontrol
  * ASoC: dpcm: allow start or stop during pause for backend
      sound/soc/soc-pcm.c
  * ASoC: dapm: connect virtual mux with default value
      sound/soc/soc-dapm.c
  * ASoC: fix regwmask
      sound/soc/soc-ops.c
  * slub: improve bit diffusion for freelist ptr obfuscation
      mm/slub.c
    misc: rtsx: set correct pcr_ops for rts522A
  * uapi: rename ext2_swab() to swab() and share globally in swab.h
      include/linux/swab.h
      include/uapi/linux/swab.h
      lib/find_bit.c
    btrfs: track reloc roots based on their commit root bytenr
    btrfs: remove a BUG_ON() from merge_reloc_roots()
    block, bfq: fix use-after-free in bfq_idle_slice_timer_body
    locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps()
  * irqchip/gic-v4: Provide irq_retrigger to avoid circular locking dependency
      drivers/irqchip/irq-gic-v3-its.c
  * usb: dwc3: core: add support for disabling SS instances in park mode
      drivers/usb/dwc3/core.c
      drivers/usb/dwc3/core.h
  * block: Fix use-after-free issue accessing struct io_cq
      block/blk-ioc.c
      include/linux/iocontext.h
  * genirq/irqdomain: Check pointer in irq_domain_alloc_irqs_hierarchy()
      kernel/irq/irqdomain.c
    efi/x86: Ignore the memory attributes table on i386
    x86/boot: Use unsigned comparison for addresses
    gfs2: Don't demote a glock until its revokes are written
    libata: Remove extra scsi_host_put() in ata_scsi_add_hosts()
    PCI/switchtec: Fix init_completion race condition with poll_wait()
    selftests/x86/ptrace_syscall_32: Fix no-vDSO segfault
  * sched: Avoid scale real weight down to zero
      kernel/sched/sched.h
    irqchip/versatile-fpga: Handle chained IRQs properly
  * block: keep bdi->io_pages in sync with max_sectors_kb for stacked devices
      block/blk-settings.c
    x86: Don't let pgprot_modify() change the page encryption bit
    null_blk: fix spurious IO errors after failed past-wp access
    null_blk: Handle null_add_dev() failures properly
    null_blk: Fix the null_add_dev() error path
    i2c: st: fix missing struct parameter description
    qlcnic: Fix bad kzalloc null test
    cxgb4/ptp: pass the sign of offset delta in FW CMD
    hinic: fix wrong para of wait_for_completion_timeout
    hinic: fix a bug of waitting for IO stopped
    net: vxge: fix wrong __VA_ARGS__ usage
    bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads

Change-Id: I8588871f277a784d0223cccdccb66d481bbb209d
Signed-off-by: lucaswei <lucaswei@google.com>
 2020-06-01 11:03:40 +08:00
Jann Horn
e5de393402 vmalloc: fix remap_vmalloc_range() bounds checks 
commit bdebd6a2831b6fab69eb85cee74a8ba77f1a1cc2 upstream.

remap_vmalloc_range() has had various issues with the bounds checks it
promises to perform ("This function checks that addr is a valid
vmalloc'ed area, and that it is big enough to cover the vma") over time,
e.g.:

 - not detecting pgoff<<PAGE_SHIFT overflow

 - not detecting (pgoff<<PAGE_SHIFT)+usize overflow

 - not checking whether addr and addr+(pgoff<<PAGE_SHIFT) are the same
   vmalloc allocation

 - comparing a potentially wildly out-of-bounds pointer with the end of
   the vmalloc region

In particular, since commit fc9702273e2e ("bpf: Add mmap() support for
BPF_MAP_TYPE_ARRAY"), unprivileged users can cause kernel null pointer
dereferences by calling mmap() on a BPF map with a size that is bigger
than the distance from the start of the BPF map to the end of the
address space.

This could theoretically be used as a kernel ASLR bypass, by using
whether mmap() with a given offset oopses or returns an error code to
perform a binary search over the possible address range.

To allow remap_vmalloc_range_partial() to verify that addr and
addr+(pgoff<<PAGE_SHIFT) are in the same vmalloc region, pass the offset
to remap_vmalloc_range_partial() instead of adding it to the pointer in
remap_vmalloc_range().

In remap_vmalloc_range_partial(), fix the check against
get_vm_area_size() by using size comparisons instead of pointer
comparisons, and add checks for pgoff.

Fixes: 833423143c ("[PATCH] mm: introduce remap_vmalloc_range()")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: stable@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Martin KaFai Lau <kafai@fb.com>
Cc: Song Liu <songliubraving@fb.com>
Cc: Yonghong Song <yhs@fb.com>
Cc: Andrii Nakryiko <andriin@fb.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: KP Singh <kpsingh@chromium.org>
Link: http://lkml.kernel.org/r/20200415222312.236431-1-jannh@google.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2020-05-02 17:24:21 +02:00
lucaswei
290cbddfab Merge android-4.14-q (4.14.176) into android-msm-floral-4.14-lts 
Merge 4.14.176 into android-4.14-q
Linux 4.14.176
  * drm/msm: Use the correct dma_sync calls in msm_gem
      drivers/gpu/drm/msm/msm_gem.c
  * rpmsg: glink: smem: Support rx peak for size less than 4 bytes
      drivers/rpmsg/qcom_glink_smem.c
  * drm_dp_mst_topology: fix broken drm_dp_sideband_parse_remote_dpcd_read()
      drivers/gpu/drm/drm_dp_mst_topology.c
  * usb: dwc3: don't set gadget->is_otg flag
      drivers/usb/dwc3/gadget.c
  * rpmsg: glink: Remove chunk size word align warning
      drivers/rpmsg/qcom_glink_native.c
  * arm64: Fix size of __early_cpu_boot_status
      arch/arm64/kernel/head.S
  * drm/msm: stop abusing dma_map/unmap for cache
      drivers/gpu/drm/msm/msm_gem.c
  * clk: qcom: rcg: Return failure for RCG update
      drivers/clk/qcom/clk-rcg2.c
    acpi/nfit: Fix bus command validation
    fbcon: fix null-ptr-deref in fbcon_switch
    RDMA/cm: Update num_paths in cma_resolve_iboe_route error flow
    Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl
    ceph: canonicalize server path in place
    ceph: remove the extra slashes in the server path
    IB/hfi1: Fix memory leaks in sysfs registration and unregistration
    IB/hfi1: Call kobject_put() when kobject_init_and_add() fails
    ASoC: jz4740-i2s: Fix divider written at incorrect offset in register
    hwrng: imx-rngc - fix an error path
    tools/accounting/getdelays.c: fix netlink attribute length
  * random: always use batched entropy for get_random_u{32,64}
      drivers/char/random.c
    mlxsw: spectrum_flower: Do not stop at FLOW_ACTION_VLAN_MANGLE
    slcan: Don't transmit uninitialized stack data in padding
    net: stmmac: dwmac1000: fix out-of-bounds mac address reg setting
    net: phy: micrel: kszphy_resume(): add delay after genphy_resume() before accessing PHY registers
    net: dsa: bcm_sf2: Ensure correct sub-node is parsed
  * ipv6: don't auto-add link-local address to lag ports
      net/ipv6/addrconf.c
    mm: mempolicy: require at least one nodeid for MPOL_PREFERRED
    padata: always acquire cpu_hotplug_lock before pinst->lock
  * coresight: do not use the BIT() macro in the UAPI header
      include/uapi/linux/coresight-stm.h
    misc: pci_endpoint_test: Fix to support > 10 pci-endpoint-test devices
  * blk-mq: Allow blocking queue tag iter callbacks
      block/blk-mq-tag.c
  * blk-mq: sync the update nr_hw_queues with blk_mq_queue_tag_busy_iter
      block/blk-mq-tag.c
      block/blk-mq.c
    drm/etnaviv: replace MMU flush marker with flush sequence
    tools/power turbostat: Fix gcc build warnings
  * initramfs: restore default compression behavior
      usr/Kconfig
    drm/bochs: downgrade pci_request_region failure from error to warning
    sctp: fix possibly using a bad saddr with a given dst
    sctp: fix refcount bug in sctp_wfree
  * net, ip_tunnel: fix interface lookup with no key
      net/ipv4/ip_tunnel.c
  * ipv4: fix a RCU-list lock in fib_triestat_seq_show
      net/ipv4/fib_trie.c
    ANDROID: cuttlefish_defconfig: Minimally enable EFI
  * UPSTREAM: loop: Only freeze block queue when needed.
      drivers/block/loop.c
  * UPSTREAM: loop: Only change blocksize when needed.
      drivers/block/loop.c
    Merge 4.14.175 into android-4.14-q
Linux 4.14.175
    arm64: dts: ls1046ardb: set RGMII interfaces to RGMII_ID mode
    arm64: dts: ls1043a-rdb: correct RGMII delay mode to rgmii-id
    ARM: bcm2835-rpi-zero-w: Add missing pinctrl name
    ARM: dts: oxnas: Fix clear-mask property
    perf map: Fix off by one in strncpy() size argument
  * arm64: alternative: fix build with clang integrated assembler
      arch/arm64/include/asm/alternative.h
    net: ks8851-ml: Fix IO operations, again
    gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 CHT + AXP288 model
  * bpf: Explicitly memset some bpf info structures declared on the stack
      kernel/bpf/syscall.c
  * bpf: Explicitly memset the bpf_attr structure
      kernel/bpf/syscall.c
    platform/x86: pmc_atom: Add Lex 2I385SW to critclk_systems DMI table
  * vt: vt_ioctl: fix use-after-free in vt_in_use()
      drivers/tty/vt/vt_ioctl.c
  * vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console
      drivers/tty/vt/vt.c
      drivers/tty/vt/vt_ioctl.c
  * vt: vt_ioctl: remove unnecessary console allocation checks
      drivers/tty/vt/vt_ioctl.c
  * vt: switch vt_dont_switch to bool
      drivers/tty/vt/vt_ioctl.c
      include/linux/vt_kern.h
  * vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines
      drivers/tty/vt/vt_ioctl.c
  * vt: selection, introduce vc_is_sel
      drivers/tty/vt/selection.c
      drivers/tty/vt/vt.c
      drivers/tty/vt/vt_ioctl.c
      include/linux/selection.h
    mac80211: fix authentication with iwlwifi/mvm
    mac80211: Check port authorization in the ieee80211_tx_dequeue() case
    media: xirlink_cit: add missing descriptor sanity checks
    media: stv06xx: add missing descriptor sanity checks
    media: dib0700: fix rc endpoint lookup
    media: ov519: add missing endpoint sanity checks
  * libfs: fix infoleak in simple_attr_read()
      fs/libfs.c
    staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
    staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb
    staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table
    media: usbtv: fix control-message timeouts
    media: flexcop-usb: fix endpoint sanity check
    usb: musb: fix crash with highmen PIO and usbmon
    USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback
    USB: cdc-acm: restore capability check order
    USB: serial: option: add Wistron Neweb D19Q1
    USB: serial: option: add BroadMobi BM806U
    USB: serial: option: add support for ASKEY WWHC050
    afs: Fix some tracing details
    Input: raydium_i2c_ts - fix error codes in raydium_i2c_boot_trigger()
    Input: raydium_i2c_ts - use true and false for boolean values
  * vti6: Fix memory leak of skb if input policy check fails
      net/ipv6/ip6_vti.c
    netfilter: nft_fwd_netdev: validate family and chain type
  * xfrm: policy: Fix doulbe free in xfrm_policy_timer
      net/xfrm/xfrm_policy.c
  * xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire
      net/xfrm/xfrm_user.c
  * xfrm: fix uctx len check in verify_sec_ctx_len
      net/xfrm/xfrm_user.c
    RDMA/mlx5: Block delay drop to unprivileged users
  * vti[6]: fix packet tx through bpf_redirect() in XinY cases
      net/ipv4/Kconfig
      net/ipv4/ip_vti.c
      net/ipv6/ip6_vti.c
  * xfrm: handle NETDEV_UNREGISTER for xfrm device
      net/xfrm/xfrm_device.c
  * genirq: Fix reference leaks on irq affinity notifiers
      kernel/irq/manage.c
    RDMA/core: Ensure security pkey modify is not lost
    gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 BYT + AXP288 model
    gpiolib: acpi: Rework honor_wakeup option into an ignore_wake option
    gpiolib: acpi: Correct comment for HP x2 10 honor_wakeup quirk
    mac80211: mark station unauthorized before key removal
  * scsi: sd: Fix optimal I/O size for devices that change reported values
      drivers/scsi/sd.c
    scripts/dtc: Remove redundant YYLOC global declaration
    tools: Let O= makes handle a relative path with -C option
    perf probe: Do not depend on dwfl_module_addrsym()
    ARM: dts: omap5: Add bus_dma_limit for L3 bus
    ARM: dts: dra7: Add bus_dma_limit for L3 bus
  * Input: avoid BIT() macro usage in the serio.h UAPI header
      include/uapi/linux/serio.h
    Input: synaptics - enable RMI on HP Envy 13-ad105ng
    i2c: hix5hd2: add missed clk_disable_unprepare in remove
    ftrace/x86: Anotate text_mutex split between ftrace_arch_code_modify_post_process() and ftrace_arch_code_modify_prepare()
  * arm64: compat: map SPSR_ELx<->PSR for signals
      arch/arm64/kernel/signal32.c
  * arm64: ptrace: map SPSR_ELx<->PSR for compat tasks
      arch/arm64/kernel/ptrace.c
    sxgbe: Fix off by one in samsung driver strncpy size arg
    dpaa_eth: Remove unnecessary boolean expression in dpaa_get_headroom
    mac80211: Do not send mesh HWMP PREQ if HWMP is disabled
    scsi: ipr: Fix softlockup when rescanning devices in petitboot
  * fsl/fman: detect FMan erratum A050385
      drivers/net/ethernet/freescale/fman/Kconfig
    arm64: dts: ls1043a: FMan erratum A050385
    dt-bindings: net: FMan erratum A050385
  * cgroup1: don't call release_agent when it is ""
      kernel/cgroup/cgroup-v1.c
  * drivers/of/of_mdio.c:fix of_mdiobus_register()
      drivers/of/of_mdio.c
    cpupower: avoid multiple definition with gcc -fno-common
  * cgroup-v1: cgroup_pidlist_next should update position index
      kernel/cgroup/cgroup-v1.c
  * net: ipv4: don't let PMTU updates increase route MTU
      net/ipv4/route.c
    hsr: set .netnsok flag
    hsr: add restart routine into hsr_get_node_list()
    hsr: use rcu_read_lock() in hsr_get_node_{list/status}()
    vxlan: check return value of gro_cells_init()
    net: dsa: mt7530: Change the LINK bit to reflect the link status
    bnxt_en: fix memory leaks in bnxt_dcbnl_ieee_getets()
    slcan: not call free_netdev before rtnl_unlock in slcan_open
    NFC: fdp: Fix a signedness bug in fdp_nci_send_patch()
    net: stmmac: dwmac-rk: fix error path in rk_gmac_probe
    net_sched: keep alloc_hash updated after hash allocation
    net_sched: cls_route: remove the right filter from hashtable
    net: qmi_wwan: add support for ASKEY WWHC050
  * net/packet: tpacket_rcv: avoid a producer race condition
      net/packet/af_packet.c
      net/packet/internal.h
    net: mvneta: Fix the case where the last poll did not process all rx
    net: dsa: Fix duplicate frames flooded by learning
    macsec: restrict to ethernet devices
    hsr: fix general protection fault in hsr_addr_is_self()
  * Revert "drm/dp_mst: Skip validating ports during destruction, just ref"
      drivers/gpu/drm/drm_dp_mst_topology.c
    staging: greybus: loopback_test: fix potential path truncations
    staging: greybus: loopback_test: fix potential path truncation
    drm/bridge: dw-hdmi: fix AVI frame colorimetry
  * arm64: smp: fix crash_smp_send_stop() behaviour
      arch/arm64/kernel/smp.c
  * arm64: smp: fix smp_send_stop() behaviour
      arch/arm64/kernel/smp.c
    ALSA: hda/realtek: Fix pop noise on ALC225
  * Revert "ipv6: Fix handling of LLA with VRF and sockets bound to VRF"
      net/ipv6/tcp_ipv6.c
    Revert "vrf: mark skb for multicast or link-local as enslaved to VRF"
  * futex: Unbreak futex hashing
      kernel/futex.c
  * futex: Fix inode life-time issue
      fs/inode.c
      include/linux/fs.h
      include/linux/futex.h
      kernel/futex.c
  * kbuild: Disable -Wpointer-to-enum-cast
      scripts/Makefile.extrawarn
    iio: adc: at91-sama5d2_adc: fix differential channels in triggered mode
    iio: adc: at91-sama5d2_adc: fix channel configuration for differential channels
    USB: cdc-acm: fix rounding error in TIOCSSERIAL
    USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL
  * x86/mm: split vmalloc_sync_all()
      include/linux/vmalloc.h
      kernel/notifier.c
      mm/vmalloc.c
  * page-flags: fix a crash at SetPageError(THP_SWAP)
      include/linux/page-flags.h
  * mm, slub: prevent kmalloc_node crashes and memory leaks
      mm/slub.c
  * mm: slub: be more careful about the double cmpxchg of freelist
      mm/slub.c
  * memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event
      mm/memcontrol.c
  * xhci: Do not open code __print_symbolic() in xhci trace events
      drivers/usb/host/xhci-trace.h
  * rtc: max8907: add missing select REGMAP_IRQ
      drivers/rtc/Kconfig
    intel_th: pci: Add Elkhart Lake CPU support
    intel_th: Fix user-visible error codes
    staging/speakup: fix get_word non-space look-ahead
    staging: rtl8188eu: Add device id for MERCUSYS MW150US v2
    mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2
    iio: magnetometer: ak8974: Fix negative raw values in sysfs
    iio: trigger: stm32-timer: disable master mode when stopping
    ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks
    ALSA: pcm: oss: Avoid plugin buffer overflow
    ALSA: seq: oss: Fix running status after receiving sysex
    ALSA: seq: virmidi: Fix running status after receiving sysex
    ALSA: line6: Fix endless MIDI read loop
  * usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c
      drivers/usb/host/xhci-pci.c
    USB: serial: pl2303: add device-id for HP LD381
  * usb: host: xhci-plat: add a shutdown
      drivers/usb/host/xhci-plat.c
    USB: serial: option: add ME910G1 ECM composition 0x110b
  * usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters
      drivers/usb/core/quirks.c
  * USB: Disable LPM on WD19's Realtek Hub
      drivers/usb/core/quirks.c
    parse-maintainers: Mark as executable
    block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group()
    xenbus: req->err should be updated before req->state
    xenbus: req->body should be updated before req->state
    dm bio record: save/restore bi_end_io and bi_integrity
    altera-stapl: altera_get_note: prevent write beyond end of 'key'
    drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer
    drm/exynos: dsi: fix workaround for the legacy clock name
    drm/exynos: dsi: propagate error value and silence meaningless warning
    spi/zynqmp: remove entry that causes a cs glitch
    spi: pxa2xx: Add CS control clock quirk
    ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes
    powerpc: Include .BTF section
    spi: qup: call spi_qup_pm_resume_runtime before suspending
  * UPSTREAM: ipv6: ndisc: add support for 'PREF64' dns64 prefix identifier
      include/net/ndisc.h
      net/ipv6/ndisc.c
    ANDROID: dm-bow: Fix free_show value is incorrect
  * UPSTREAM: bpf: Explicitly memset some bpf info structures declared on the stack
      kernel/bpf/syscall.c
  * UPSTREAM: bpf: Explicitly memset the bpf_attr structure
      kernel/bpf/syscall.c
    Merge 4.14.174 into android-4.14-q
Linux 4.14.174
  * ipv4: ensure rcu_read_lock() in cipso_v4_error()
      net/ipv4/cipso_ipv4.c
  * mm: slub: add missing TID bump in kmem_cache_alloc_bulk()
      mm/slub.c
    ARM: 8958/1: rename missed uaccess .fixup section
    ARM: 8957/1: VDSO: Match ARMv8 timer in cntvct_functional()
  * jbd2: fix data races at struct journal_head
      fs/jbd2/transaction.c
  * net: rmnet: fix NULL pointer dereference in rmnet_newlink()
      drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
    hinic: fix a bug of setting hw_ioctxt
    slip: not call free_netdev before rtnl_unlock in slip_open
  * signal: avoid double atomic counter increments for user accounting
      kernel/signal.c
    mac80211: rx: avoid RCU list traversal under mutex
    net: ks8851-ml: Fix IRQ handling and locking
    net: usb: qmi_wwan: restore mtu min/max values after raw_ip switch
    scsi: libfc: free response frame from GPN_ID
  * cfg80211: check reg_rule for NULL in handle_channel_custom()
      net/wireless/reg.c
    HID: i2c-hid: add Trekstor Surfbook E11B to descriptor override
  * HID: apple: Add support for recent firmware on Magic Keyboards
      drivers/hid/hid-apple.c
    ACPI: watchdog: Allow disabling WDAT at boot
    perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag
    batman-adv: Don't schedule OGM for disabled interface
    batman-adv: Avoid free/alloc race when handling OGM buffer
    batman-adv: Avoid free/alloc race when handling OGM2 buffer
    batman-adv: Fix duplicated OGMs on NETDEV_UP
    batman-adv: Fix debugfs path for renamed softif
    batman-adv: Fix debugfs path for renamed hardif
    batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs
    batman-adv: Fix TT sync flags for intermediate TT responses
    batman-adv: Avoid race in TT TVLV allocator helper
    batman-adv: update data pointers after skb_cow()
    batman-adv: Fix internal interface indices types
    batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq
    batman-adv: Fix check of retrieved orig_gw in batadv_v_gw_is_eligible
    batman-adv: Always initialize fragment header priority
    batman-adv: Avoid spurious warnings from bat_v neigh_cmp implementation
    efi: Add a sanity check to efivar_store_raw()
    net/smc: check for valid ib_client_data
  * ipv6: restrict IPV6_ADDRFORM operation
      net/ipv6/ipv6_sockglue.c
    i2c: acpi: put device when verifying client fails
    iommu/vt-d: Ignore devices with out-of-spec domain number
    iommu/vt-d: Fix the wrong printing in RHSA parsing
    netfilter: nft_payload: add missing attribute validation for payload csum flags
    netfilter: cthelper: add missing attribute validation for cthelper
  * nl80211: add missing attribute validation for channel switch
      net/wireless/nl80211.c
  * nl80211: add missing attribute validation for beacon report scanning
      net/wireless/nl80211.c
  * nl80211: add missing attribute validation for critical protocol indication
      net/wireless/nl80211.c
  * pinctrl: core: Remove extra kref_get which blocks hogs being freed
      drivers/pinctrl/core.c
    pinctrl: meson-gxl: fix GPIOX sdio pins
    iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page
    iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint
  * iommu/dma: Fix MSI reservation allocation
      drivers/iommu/dma-iommu.c
    x86/mce: Fix logic and comments around MSR_PPIN_CTL
    efi: Fix a race and a buffer overflow while reading efivars via sysfs
    ARC: define __ALIGN_STR and __ALIGN symbols for ARC
    KVM: x86: clear stale x86_emulate_ctxt->intercept value
    gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache
  * cifs_atomic_open(): fix double-put on late allocation failure
      fs/open.c
    ktest: Add timeout for ssh sync testing
    drm/amd/display: remove duplicated assignment to grph_obj_type
  * workqueue: don't use wq_select_unbound_cpu() for bound works
      kernel/workqueue.c
    iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint
    virtio-blk: fix hw_queue stopped on arbitrary error
    iwlwifi: mvm: Do not require PHY_SKU NVM section for 3168 devices
  * cgroup: Iterate tasks that did not finish do_exit()
      include/linux/cgroup.h
      kernel/cgroup/cgroup.c
  * cgroup: cgroup_procs_next should increase position index
      kernel/cgroup/cgroup.c
    ipvlan: don't deref eth hdr before checking it's set
    ipvlan: egress mcast packets are not exceptional
    ipvlan: do not add hardware address of master to its unicast filter list
  * inet_diag: return classid for all socket types
      include/linux/inet_diag.h
      net/ipv4/inet_diag.c
      net/ipv4/udp_diag.c
    macvlan: add cond_resched() during multicast processing
    net: fec: validate the new settings in fec_enet_set_coalesce()
  * slip: make slhc_compress() more robust against malicious packets
      drivers/net/slip/slhc.c
  * bonding/alb: make sure arp header is pulled before accessing it
      drivers/net/bonding/bond_alb.c
  * net: phy: fix MDIO bus PM PHY resuming
      drivers/net/phy/phy_device.c
      include/linux/phy.h
    nfc: add missing attribute validation for vendor subcommand
    nfc: add missing attribute validation for SE API
    team: add missing attribute validation for array index
    team: add missing attribute validation for port ifindex
    net: fq: add missing attribute validation for orphan mask
    macsec: add missing attribute validation for port
    can: add missing attribute validation for termination
    nl802154: add missing attribute validation for dev_type
    nl802154: add missing attribute validation
  * fib: add missing attribute validation for tun_id
      include/net/fib_rules.h
  * net: memcg: fix lockdep splat in inet_csk_accept()
      net/ipv4/inet_connection_sock.c
  * net: memcg: late association of sock to memcg
      mm/memcontrol.c
      net/core/sock.c
      net/ipv4/inet_connection_sock.c
  * cgroup: memcg: net: do not associate sock with unrelated cgroup
      kernel/cgroup/cgroup.c
      mm/memcontrol.c
    bnxt_en: reinitialize IRQs when MTU is modified
    sfc: detach from cb_page in efx_copy_channel()
  * r8152: check disconnect status after long sleep
      drivers/net/usb/r8152.c
  * net/packet: tpacket_rcv: do not increment ring index on drop
      net/packet/af_packet.c
    net: nfc: fix bounds checking bugs on "pipe"
    net: macsec: update SCI upon MAC address change.
  * netlink: Use netlink header as base to calculate bad attribute offset
      net/netlink/af_netlink.c
    ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast()
    ipvlan: add cond_resched_rcu() while processing muticast backlog
  * ipv6/addrconf: call ipv6_mc_up() for non-Ethernet interface
      net/ipv6/addrconf.c
  * gre: fix uninit-value in __iptunnel_pull_header
      net/ipv4/gre_demux.c
    cgroup, netclassid: periodically release file_lock on classid updating
  * net: phy: Avoid multiple suspends
      drivers/net/phy/phy_device.c
  * phy: Revert toggling reset changes.
      drivers/net/phy/phy_device.c
    Merge 4.14.173 into android-4.14-q
Linux 4.14.173
    ASoC: topology: Fix memleak in soc_tplg_manifest_load()
  * xhci: handle port status events for removed USB3 hcd
      drivers/usb/host/xhci-ring.c
    dm integrity: fix a deadlock due to offloading to an incorrect workqueue
    powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems
    dmaengine: coh901318: Fix a double lock bug in dma_tc_handle()
    hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT()
    ARM: imx: build v7_cpu_resume() unconditionally
    IB/hfi1, qib: Ensure RCU is locked when accessing list
    RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()
    RDMA/iwcm: Fix iwcm work deallocation
  * ASoC: dapm: Correct DAPM handling of active widgets during shutdown
      sound/soc/soc-dapm.c
    ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path
  * ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output
      sound/soc/soc-pcm.c
    ASoC: intel: skl: Fix possible buffer overflow in debug outputs
    ASoC: intel: skl: Fix pin debug prints
    ASoC: topology: Fix memleak in soc_tplg_link_elems_load()
    ARM: dts: ls1021a: Restore MDIO compatible to gianfar
    dm cache: fix a crash due to incorrect work item cancelling
    dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list
    dmaengine: tegra-apb: Fix use-after-free
    x86/pkeys: Manually set X86_FEATURE_OSPKE to preserve existing changes
  * vt: selection, push sel_lock up
      drivers/tty/vt/selection.c
  * vt: selection, push console lock down
      drivers/tty/vt/selection.c
      drivers/tty/vt/vt.c
  * vt: selection, close sel_buffer race
      drivers/tty/vt/selection.c
    serial: 8250_exar: add support for ACCES cards
    tty:serial:mvebu-uart:fix a wrong return
    arm: dts: dra76x: Fix mmc3 max-frequency
  * fat: fix uninit-memory access for partial initialized inode
      fs/fat/inode.c
  * mm, numa: fix bad pmd by atomically check for pmd_trans_huge when marking page tables prot_numa
      mm/mprotect.c
    vgacon: Fix a UAF in vgacon_invert_region
  * usb: core: port: do error out if usb_autopm_get_interface() fails
      drivers/usb/core/port.c
  * usb: core: hub: do error out if usb_autopm_get_interface() fails
      drivers/usb/core/hub.c
  * usb: core: hub: fix unhandled return by employing a void function
      drivers/usb/core/hub.c
  * usb: quirks: add NO_LPM quirk for Logitech Screen Share
      drivers/usb/core/quirks.c
  * usb: storage: Add quirk for Samsung Fit flash
      drivers/usb/storage/unusual_devs.h
    cifs: don't leak -EAGAIN for stat() during reconnect
    net: thunderx: workaround BGX TX Underflow issue
    x86/xen: Distribute switch variables for initialization
    nvme: Fix uninitialized-variable warning
    x86/boot/compressed: Don't declare __force_order in kaslr_64.c
    s390/cio: cio_ignore_proc_seq_next should increase position index
    watchdog: da9062: do not ping the hw during stop()
    net: ks8851-ml: Fix 16-bit IO operation
    net: ks8851-ml: Fix 16-bit data access
    net: ks8851-ml: Remove 8-bit bus accessors
    drm/msm/dsi: save pll state before dsi host is powered off
    drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI
    drm/msm/mdp5: rate limit pp done timeout warnings
    usb: gadget: serial: fix Tx stall after buffer overflow
  * usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags
      drivers/usb/gadget/function/f_fs.c
  * usb: gadget: composite: Support more than 500mA MaxPower
      drivers/usb/gadget/composite.c
    selftests: fix too long argument
    serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE
    kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic
    RDMA/core: Fix use of logical OR in get_new_pps
    RDMA/core: Fix pkey and port assignment in get_new_pps
    net: dsa: bcm_sf2: Forcibly configure IMP port for 1Gb/sec
    EDAC/amd64: Set grain per DIMM
    x86/mce: Handle varying MCA bank counts
    vhost: Check docket sk_family instead of call getname
  * audit: always check the netlink payload length in audit_receive_msg()
      kernel/audit.c
  * Revert "char/random: silence a lockdep splat with printk()"
      drivers/char/random.c
    mm, thp: fix defrag setting if newline is not used
    mm/huge_memory.c: use head to check huge zero page
    perf hists browser: Restore ESC as "Zoom out" of DSO/thread/etc
    kprobes: Set unoptimized flag after unoptimizing code
    drivers: net: xgene: Fix the order of the arguments of 'alloc_etherdev_mqs()'
  * tuntap: correctly set SOCKWQ_ASYNC_NOSPACE
      drivers/net/tun.c
    KVM: Check for a bad hva before dropping into the ghc slow path
    KVM: SVM: Override default MMIO mask if memory encryption is enabled
    mwifiex: drop most magic numbers from mwifiex_process_tdls_action_frame()
  * namei: only return -ECHILD from follow_dotdot_rcu()
      fs/namei.c
    net: ena: make ena rxfh support ETH_RSS_HASH_NO_CHANGE
    net: atlantic: fix potential error handling
  * net: netlink: cap max groups which will be considered in netlink_bind()
      net/netlink/af_netlink.c
  * include/linux/bitops.h: introduce BITS_PER_TYPE
      include/linux/bitops.h
  * ecryptfs: Fix up bad backport of fe2e082f5da5b4a0a92ae32978f81507ef37ec66
      fs/ecryptfs/keystore.c
  * usb: charger: assign specific number for enum value
      include/uapi/linux/usb/charger.h
    drm/i915/gvt: Separate display reset from ALL_ENGINES reset
    i2c: jz4780: silence log flood on txabrt
    i2c: altera: Fix potential integer overflow
    MIPS: VPE: Fix a double free and a memory leak in 'release_vpe()'
  * HID: hiddev: Fix race in in hiddev_disconnect()
      drivers/hid/usbhid/hiddev.c
  * Revert "PM / devfreq: Modify the device name as devfreq(X) for sysfs"
      drivers/devfreq/devfreq.c
  * tracing: Disable trace_printk() on post poned tests
      kernel/trace/trace.c
  * HID: core: increase HID report buffer size to 8KiB
      include/linux/hid.h
  * HID: core: fix off-by-one memset in hid_report_raw_event()
      drivers/hid/hid-core.c
    HID: ite: Only bind to keyboard USB interface on Acer SW5-012 keyboard dock
    KVM: VMX: check descriptor table exits on instruction emulation
    ACPI: watchdog: Fix gas->access_width usage
  * ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro
      include/acpi/actypes.h
  * audit: fix error handling in audit_data_to_entry()
      kernel/auditfilter.c
  * ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()
      fs/ext4/super.c
  * net: sched: correct flower port blocking
      include/net/flow_dissector.h
    qede: Fix race between rdma destroy workqueue and link change event
  * ipv6: Fix route replacement with dev-only route
      net/ipv6/ip6_fib.c
  * ipv6: Fix nlmsg_flags when splitting a multipath route
      net/ipv6/route.c
    sctp: move the format error check out of __sctp_sf_do_9_1_abort
    nfc: pn544: Fix occasional HW initialization failure
    net: phy: restore mdio regs in the iproc mdio driver
  * net: fib_rules: Correctly set table field when table number exceeds 8 bits
      net/core/fib_rules.c
  * sysrq: Remove duplicated sysrq message
      drivers/tty/sysrq.c
  * sysrq: Restore original console_loglevel when sysrq disabled
      drivers/tty/sysrq.c
  * cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE
      net/wireless/nl80211.c
    cifs: Fix mode output in debugging statements
    net: ena: ena-com.c: prevent NULL pointer dereference
    net: ena: ethtool: use correct value for crc32 hash
    net: ena: fix incorrectly saving queue numbers when setting RSS indirection table
    net: ena: rss: store hash function as values and not bits
    net: ena: rss: fix failure to get indirection table
    net: ena: fix incorrect default RSS key
    net: ena: add missing ethtool TX timestamping indication
    net: ena: fix uses of round_jiffies()
    net: ena: fix potential crash when rxfh key is NULL
    qmi_wwan: unconditionally reject 2 ep interfaces
    qmi_wwan: re-add DW5821e pre-production variant
  * cfg80211: check wiphy driver existence for drvinfo report
      net/wireless/ethtool.c
    mac80211: consider more elements in parsing CRC
    dax: pass NOWAIT flag to iomap_apply
  * drm/msm: Set dma maximum segment size for mdss
      drivers/gpu/drm/msm/msm_drv.c
    ipmi:ssif: Handle a possible NULL pointer reference
  * ext4: fix potential race between s_group_info online resizing and access
      fs/ext4/ext4.h
      fs/ext4/mballoc.c
  * ext4: fix potential race between s_flex_groups online resizing and access
      fs/ext4/ext4.h
      fs/ext4/ialloc.c
      fs/ext4/mballoc.c
      fs/ext4/resize.c
      fs/ext4/super.c
  * ext4: fix potential race between online resizing and write operations
      fs/ext4/balloc.c
      fs/ext4/ext4.h
      fs/ext4/resize.c
      fs/ext4/super.c
  * netfilter: nf_conntrack: resolve clash for matching conntracks
      net/netfilter/nf_conntrack_core.c
    iwlwifi: pcie: fix rb_allocator workqueue allocation
  * UPSTREAM: binder: fix incorrect calculation for num_valid
      drivers/android/binder.c
    Merge 4.14.172 into android-4.14-q
  * UPSTREAM: sched/psi: Fix OOB write when writing 0 bytes to PSI files
      kernel/sched/psi.c
  * UPSTREAM: psi: Fix a division error in psi poll()
      kernel/sched/psi.c
  * UPSTREAM: sched/psi: Fix sampling error and rare div0 crashes with cgroups and high uptime
      kernel/sched/psi.c
  * UPSTREAM: sched/psi: Correct overly pessimistic size calculation
      kernel/sched/psi.c
Linux 4.14.172
    s390/mm: Explicitly compare PAGE_DEFAULT_KEY against zero in storage_key_init_range
    xen: Enable interrupts when calling _cond_resched()
    ata: ahci: Add shutdown to freeze hardware resources of ahci
  * netfilter: xt_hashlimit: limit the max size of hashtable
      net/netfilter/xt_hashlimit.c
    ALSA: seq: Fix concurrent access to queue current tick/time
    ALSA: seq: Avoid concurrent access to queue flags
  * ALSA: rawmidi: Avoid bit fields for state flags
      include/sound/rawmidi.h
  * genirq/proc: Reject invalid affinity masks (again)
      kernel/irq/internals.h
      kernel/irq/manage.c
      kernel/irq/proc.c
    iommu/vt-d: Fix compile warning from intel-svm.h
  * ecryptfs: replace BUG_ON with error handling code
      fs/ecryptfs/crypto.c
    staging: greybus: use after free in gb_audio_manager_remove_all()
    staging: rtl8723bs: fix copy of overlapping memory
  * usb: gadget: composite: Fix bMaxPower for SuperSpeedPlus
      drivers/usb/gadget/composite.c
    scsi: Revert "target: iscsi: Wait for all commands to finish before freeing a session"
    scsi: Revert "RDMA/isert: Fix a recently introduced regression related to logout"
    Btrfs: fix btrfs_wait_ordered_range() so that it waits for all ordered extents
    btrfs: do not check delayed items are empty for single transaction cleanup
    btrfs: fix bytes_may_use underflow in prealloc error condtition
    KVM: apic: avoid calculating pending eoi from an uninitialized val
    KVM: nVMX: handle nested posted interrupts when apicv is disabled for L1
    KVM: nVMX: Check IO instruction VM-exit conditions
    KVM: nVMX: Refactor IO bitmap checks into helper function
  * ext4: fix race between writepages and enabling EXT4_EXTENTS_FL
      fs/ext4/ext4.h
      fs/ext4/migrate.c
  * ext4: rename s_journal_flag_rwsem to s_writepages_rwsem
      fs/ext4/ext4.h
      fs/ext4/inode.c
      fs/ext4/super.c
  * ext4: fix mount failure with quota configured as module
      fs/ext4/super.c
  * ext4: add cond_resched() to __ext4_find_entry()
      fs/ext4/namei.c
  * ext4: fix a data race in EXT4_I(inode)->i_disksize
      fs/ext4/ext4.h
      fs/ext4/inode.c
    KVM: nVMX: Don't emulate instructions in guest mode
    lib/stackdepot.c: fix global out-of-bounds in stack_slabs
    serial: 8250: Check UPF_IRQ_SHARED in advance
  * vt: vt_ioctl: fix race in VT_RESIZEX
      drivers/tty/vt/vt_ioctl.c
  * VT_RESIZEX: get rid of field-by-field copyin
      drivers/tty/vt/vt_ioctl.c
  * xhci: apply XHCI_PME_STUCK_QUIRK to Intel Comet Lake platforms
      drivers/usb/host/xhci-pci.c
    KVM: x86: don't notify userspace IOAPIC on edge-triggered interrupt EOI
    drm/amdgpu/soc15: fix xclk for raven
  * mm/vmscan.c: don't round up scan size for online memory cgroup
      mm/vmscan.c
    Revert "ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()"
    MAINTAINERS: Update drm/i915 bug filing URL
  * serdev: ttyport: restore client ops on deregistration
      drivers/tty/tty_port.c
      include/linux/tty.h
    tty: serial: imx: setup the correct sg entry for tx dma
    tty/serial: atmel: manage shutdown in case of RS485 or ISO7816 mode
    x86/mce/amd: Fix kobject lifetime
    x86/mce/amd: Publish the bank pointer only after setup has succeeded
    staging: rtl8723bs: Fix potential overuse of kernel memory
    staging: rtl8723bs: Fix potential security hole
    staging: rtl8188eu: Fix potential overuse of kernel memory
    staging: rtl8188eu: Fix potential security hole
  * USB: hub: Fix the broken detection of USB3 device in SMSC hub
      drivers/usb/core/hub.c
      drivers/usb/core/hub.h
  * USB: hub: Don't record a connect-change event during reset-resume
      drivers/usb/core/hub.c
  * USB: Fix novation SourceControl XL after suspend
      drivers/usb/core/quirks.c
    usb: uas: fix a plug & unplug racing
  * usb: host: xhci: update event ring dequeue pointer on purpose
      drivers/usb/host/xhci-ring.c
  * xhci: fix runtime pm enabling for quirky Intel hosts
      drivers/usb/host/xhci-pci.c
  * xhci: Force Maximum Packet size for Full-speed bulk devices to valid range.
      drivers/usb/host/xhci-mem.c
    staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi.
  * staging: android: ashmem: Disallow ashmem memory from being remapped
      drivers/staging/android/ashmem.c
  * vt: selection, handle pending signals in paste_selection
      drivers/tty/vt/selection.c
    floppy: check FDC index for errors before assigning it
    USB: misc: iowarrior: add support for the 100 device
    USB: misc: iowarrior: add support for the 28 and 28L devices
    USB: misc: iowarrior: add support for 2 OEMed devices
    thunderbolt: Prevent crash if non-active NVMem file is read
    net/smc: fix leak of kernel memory to user space
    net/sched: flower: add missing validation of TCA_FLOWER_FLAGS
    net/sched: matchall: add missing validation of TCA_MATCHALL_FLAGS
    net: dsa: tag_qca: Make sure there is headroom for tag
    enic: prevent waking up stopped tx queues over watchdog reset
  * selinux: ensure we cleanup the internal AVC counters on error in avc_update()
      security/selinux/avc.c
    mlxsw: spectrum_dpipe: Add missing error path
    virtio_balloon: prevent pfn array overflow
    help_next should increase position index
  * brd: check and limit max_part par
      drivers/block/brd.c
    microblaze: Prevent the overflow of the start
    iwlwifi: mvm: Fix thermal zone registration
  * irqchip/gic-v3-its: Reference to its_invall_cmd descriptor when building INVALL
      drivers/irqchip/irq-gic-v3-its.c
    bcache: explicity type cast in bset_bkey_last()
    reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()
  * lib/scatterlist.c: adjust indentation in __sg_alloc_table
      lib/scatterlist.c
    ocfs2: fix a NULL pointer dereference when call ocfs2_update_inode_fsync_trans()
    radeon: insert 10ms sleep in dce5_crtc_load_lut
  * trigger_next should increase position index
      kernel/trace/trace_events_trigger.c
    ftrace: fpid_next() should increase position index
    drm/nouveau/disp/nv50-: prevent oops when no channel method map provided
  * irqchip/gic-v3: Only provision redistributors that are enabled in ACPI
      drivers/irqchip/irq-gic-v3.c
    ceph: check availability of mds cluster on mount after wait timeout
    cifs: fix NULL dereference in match_prepath
    iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop
    hostap: Adjust indentation in prism2_hostapd_add_sta
    ARM: 8951/1: Fix Kexec compilation issue.
  * jbd2: make sure ESHUTDOWN to be recorded in the journal superblock
      fs/jbd2/journal.c
  * jbd2: switch to use jbd2_journal_abort() when failed to submit the commit record
      fs/jbd2/commit.c
    powerpc/sriov: Remove VF eeh_dev state when disabling SR-IOV
    ALSA: hda - Add docking station support for Lenovo Thinkpad T420s
  * driver core: platform: fix u32 greater or equal to zero comparison
      drivers/base/platform.c
    s390/ftrace: generate traced function stack frame
    x86/decoder: Add TEST opcode to Group3-2
    ALSA: hda/hdmi - add retry logic to parse_intel_hdmi()
    irqchip/mbigen: Set driver .suppress_bind_attrs to avoid remove problems
    remoteproc: Initialize rproc_class before use
    btrfs: device stats, log when stats are zeroed
    btrfs: safely advance counter when looking up bio csums
    btrfs: fix possible NULL-pointer dereference in integrity checks
    pwm: Remove set but not set variable 'pwm'
    ide: serverworks: potential overflow in svwks_set_pio_mode()
    cmd64x: potential buffer overflow in cmd64x_program_timings()
    pwm: omap-dmtimer: Remove PWM chip in .remove before making it unfunctional
    x86/mm: Fix NX bit clearing issue in kernel_map_pages_in_pgd
  * f2fs: fix memleak of kobject
      fs/f2fs/sysfs.c
    watchdog/softlockup: Enforce that timestamp is valid on boot
  * arm64: fix alternatives with LLVM's integrated assembler
      arch/arm64/include/asm/alternative.h
    scsi: iscsi: Don't destroy session if there are outstanding connections
  * f2fs: free sysfs kobject
      fs/f2fs/sysfs.c
    iommu/arm-smmu-v3: Use WRITE_ONCE() when changing validity of an STE
    usb: musb: omap2430: Get rid of musb .set_vbus for omap2430 glue
    drm/vmwgfx: prevent memory leak in vmw_cmdbuf_res_add
    drm/nouveau: Fix copy-paste error in nouveau_fence_wait_uevent_handler
    drm/nouveau/gr/gk20a,gm200-: add terminators to method lists read from fw
    drm/nouveau/secboot/gm20b: initialize pointer in gm20b_secboot_new()
    vme: bridges: reduce stack usage
  * driver core: Print device when resources present in really_probe()
      drivers/base/dd.c
  * driver core: platform: Prevent resouce overflow from causing infinite loops
      drivers/base/platform.c
    tty: synclink_gt: Adjust indentation in several functions
    tty: synclinkmp: Adjust indentation in several functions
  * ASoC: atmel: fix build error with CONFIG_SND_ATMEL_SOC_DMA=m
      sound/soc/atmel/Kconfig
    wan: ixp4xx_hss: fix compile-testing on 64-bit
    Input: edt-ft5x06 - work around first register access error
  * rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
      include/linux/list_nulls.h
      include/linux/rculist_nulls.h
    efi/x86: Don't panic or BUG() on non-critical error conditions
    soc/tegra: fuse: Correct straps' address for older Tegra124 device trees
    IB/hfi1: Add software counter for ctxt0 seq drop
    udf: Fix free space reporting for metadata and virtual partitions
    usbip: Fix unsafe unaligned pointer usage
  * drm: remove the newline for CRC source name.
      drivers/gpu/drm/drm_debugfs_crc.c
    tools lib api fs: Fix gcc9 stringop-truncation compilation error
    ALSA: sh: Fix compile warning wrt const
    ALSA: sh: Fix unused variable warnings
    clk: sunxi-ng: add mux and pll notifiers for A64 CPU clock
    RDMA/rxe: Fix error type of mmap_offset
    pinctrl: sh-pfc: sh7269: Fix CAN function GPIOs
  * PM / devfreq: rk3399_dmc: Add COMPILE_TEST and HAVE_ARM_SMCCC dependency
      drivers/devfreq/Kconfig
      drivers/devfreq/event/Kconfig
    x86/vdso: Provide missing include file
  * dmaengine: Store module owner in dma_device struct
      drivers/dma/dmaengine.c
      include/linux/dmaengine.h
    ARM: dts: r8a7779: Add device node for ARM global timer
    drm/mediatek: handle events when enabling/disabling crtc
    scsi: aic7xxx: Adjust indentation in ahc_find_syncrate
  * scsi: ufs: Complete pending requests in host reset and restore path
      drivers/scsi/ufs/ufshcd.c
      drivers/scsi/ufs/ufshcd.h
    ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1
    orinoco: avoid assertion in case of NULL pointer
    rtlwifi: rtl_pci: Fix -Wcast-function-type
    iwlegacy: Fix -Wcast-function-type
    ipw2x00: Fix -Wcast-function-type
    b43legacy: Fix -Wcast-function-type
    ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status
    fore200e: Fix incorrect checks of NULL pointer dereference
    reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling
  * media: v4l2-device.h: Explicitly compare grp{id,mask} to zero in v4l2_device macros
      include/media/v4l2-device.h
    ARM: dts: imx6: rdu2: Disable WP for USDHC2 and USDHC3
    arm64: dts: qcom: msm8996: Disable USB2 PHY suspend by core
    NFC: port100: Convert cpu_to_le16(le16_to_cpu(E1) + E2) to use le16_add_cpu().
    PCI/IOV: Fix memory leak in pci_iov_add_virtfn()
    net/wan/fsl_ucc_hdlc: reject muram offsets above 64K
    regulator: rk808: Lower log level on optional GPIOs being not available
    drm/amdgpu: remove 4 set but not used variable in amdgpu_atombios_get_connector_info_from_object_table
  * clk: qcom: rcg2: Don't crash if our parent can't be found; return an error
      drivers/clk/qcom/clk-rcg2.c
  * kconfig: fix broken dependency in randconfig-generated .config
      scripts/kconfig/confdata.c
    KVM: s390: ENOTSUPP -> EOPNOTSUPP fixups
    nbd: add a flush_workqueue in nbd_start_device
  * ext4, jbd2: ensure panic when aborting with zero errno
      fs/jbd2/checkpoint.c
      fs/jbd2/journal.c
  * tracing: Fix very unlikely race of registering two stat tracers
      kernel/trace/trace_stat.c
  * tracing: Fix tracing_stat return values in error handling paths
      kernel/trace/trace_stat.c
    x86/sysfb: Fix check for bad VRAM size
  * jbd2: clear JBD2_ABORT flag before journal_reset to update log tail info when load journal
      fs/jbd2/journal.c
    kselftest: Minimise dependency of get_size on C library interfaces
    clocksource/drivers/bcm2835_timer: Fix memory leak of timer
    usb: dwc2: Fix IN FIFO allocation
    usb: gadget: udc: fix possible sleep-in-atomic-context bugs in gr_probe()
    uio: fix a sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()
    sparc: Add .exit.data section.
    MIPS: Loongson: Fix potential NULL dereference in loongson3_platform_init()
    efi/x86: Map the entire EFI vendor string before copying it
    pinctrl: baytrail: Do not clear IRQ flags on direct-irq enabled pins
    media: sti: bdisp: fix a possible sleep-in-atomic-context bug in bdisp_device_run()
  * char/random: silence a lockdep splat with printk()
      drivers/char/random.c
    gpio: gpio-grgpio: fix possible sleep-in-atomic-context bugs in grgpio_irq_map/unmap()
    powerpc/powernv/iov: Ensure the pdn for VFs always contains a valid PE number
    media: i2c: mt9v032: fix enum mbus codes and frame sizes
    pxa168fb: Fix the function used to release some memory in an error handling path
    pinctrl: sh-pfc: sh7264: Fix CAN function GPIOs
    gianfar: Fix TX timestamping with a stacked DSA driver
  * ALSA: ctl: allow TLV read operation for callback type of element in locked case
      sound/core/control.c
  * ext4: fix ext4_dax_read/write inode locking sequence for IOCB_NOWAIT
      fs/ext4/file.c
    leds: pca963x: Fix open-drain initialization
    brcmfmac: Fix use after free in brcmf_sdio_readframes()
  * cpu/hotplug, stop_machine: Fix stop_machine vs hotplug order
      kernel/cpu.c
    drm/gma500: Fixup fbdev stolen size usage evaluation
    KVM: nVMX: Use correct root level for nested EPT shadow page tables
    Revert "KVM: VMX: Add non-canonical check on writes to RTIT address MSRs"
    Revert "KVM: nVMX: Use correct root level for nested EPT shadow page tables"
    scsi: qla2xxx: fix a potential NULL pointer dereference
  * jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer
      fs/jbd2/commit.c
  * jbd2: move the clearing of b_modified flag to the journal_unmap_buffer()
      fs/jbd2/commit.c
      fs/jbd2/transaction.c
    hwmon: (pmbus/ltc2978) Fix PMBus polling of MFR_COMMON definitions.
    perf/x86/intel: Fix inaccurate period in context switch for auto-reload
    s390/time: Fix clk type in get_tod_clock
    RDMA/core: Fix protection fault in get_pkey_idx_qp_list
    IB/hfi1: Close window for pq and request coliding
    serial: imx: Only handle irqs that are actually enabled
    serial: imx: ensure that RX irqs are off if RX is off
    padata: Remove broken queue flushing
    perf/x86/amd: Add missing L2 misses event spec to AMD Family 17h's event map
    KVM: nVMX: Use correct root level for nested EPT shadow page tables
  * arm64: ssbs: Fix context-switch when SSBS is present on all CPUs
      arch/arm64/kernel/process.c
    btrfs: log message when rw remount is attempted with unclean tree-log
    btrfs: print message when tree-log replay starts
    Btrfs: fix race between using extent maps and merging them
  * ext4: improve explanation of a mount failure caused by a misconfigured kernel
      fs/ext4/super.c
  * ext4: fix checksum errors with indexed dirs
      fs/ext4/dir.c
      fs/ext4/ext4.h
      fs/ext4/inode.c
      fs/ext4/namei.c
  * ext4: fix support for inode sizes > 1024 bytes
      fs/ext4/super.c
  * ext4: don't assume that mmp_nodename/bdevname have NUL
      fs/ext4/mmp.c
    ARM: 8723/2: always assume the "unified" syntax for assembly code
  * arm64: nofpsimd: Handle TIF_FOREIGN_FPSTATE flag cleanly
      arch/arm64/kernel/fpsimd.c
  * arm64: ptrace: nofpsimd: Fail FP/SIMD regset operations
      arch/arm64/kernel/ptrace.c
  * arm64: cpufeature: Set the FP/SIMD compat HWCAP bits properly
      arch/arm64/kernel/cpufeature.c
  * ALSA: usb-audio: Apply sample rate quirk for Audioengine D1
      sound/usb/quirks.c
    Input: synaptics - remove the LEN0049 dmi id from topbuttonpad list
    Input: synaptics - enable SMBus on ThinkPad L470
    Input: synaptics - switch T470s to RMI4 by default
  * ecryptfs: fix a memory leak bug in ecryptfs_init_messaging()
      fs/ecryptfs/messaging.c
  * ecryptfs: fix a memory leak bug in parse_tag_1_packet()
      fs/ecryptfs/keystore.c
    ASoC: sun8i-codec: Fix setting DAI data format
    ALSA: hda: Use scnprintf() for printing texts for sysfs/procfs
    iommu/qcom: Fix bogus detach logic
    KVM: x86: emulate RDPID
  * ANDROID: net: bpf: Allow TC programs to call BPF_FUNC_skb_change_head
      net/core/filter.c
    Merge 4.14.171 into android-4.14-q
Linux 4.14.171
    libertas: make lbs_ibss_join_existing() return error code on rates overflow
    libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held
    mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()
    mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()
    serial: uartps: Move the spinlock after the read of the tx empty
  * dm: fix potential for q->make_request_fn NULL pointer
      drivers/md/dm.c
    scsi: megaraid_sas: Do not initiate OCR if controller is not in ready state
    pinctrl: sh-pfc: r8a7778: Fix duplicate SDSELF_B and SD1_CLK_B
    media: i2c: adv748x: Fix unsafe macros
    crypto: atmel-sha - fix error handling when setting hmac key
    crypto: artpec6 - return correct error code for failed setkey()
    KVM: arm/arm64: Fix young bit from mmu notifier
  * arm64: cpufeature: Fix the type of no FP/SIMD capability
      arch/arm64/kernel/cpufeature.c
    ARM: 8949/1: mm: mark free_memmap as __init
    KVM: arm/arm64: vgic-its: Fix restoration of unmapped collections
    powerpc/pseries: Allow not having ibm, hypertas-functions::hcall-multi-tce for DDW
    powerpc/pseries/vio: Fix iommu_table use-after-free refcount warning
    tools/power/acpi: fix compilation error
    ARM: dts: at91: sama5d3: define clock rate range for tcb1
    ARM: dts: at91: sama5d3: fix maximum peripheral clock rates
    platform/x86: intel_mid_powerbtn: Take a copy of ddata
    ARC: [plat-axs10x]: Add missing multicast filter number to GMAC node
    rtc: cmos: Stop using shared IRQ
    rtc: hym8563: Return -EINVAL if the time is known to be invalid
    serial: uartps: Add a timeout to the tx empty wait
    NFSv4: try lease recovery on NFS4ERR_EXPIRED
    NFS/pnfs: Fix pnfs_generic_prepare_to_resend_writes()
  * nfs: NFS_SWAP should depend on SWAP
      fs/nfs/Kconfig
  * PCI: Don't disable bridge BARs when assigning bus resources
      drivers/pci/setup-bus.c
    PCI/switchtec: Fix vep_vector_number ioread width
  * scsi: ufs: Fix ufshcd_probe_hba() reture value in case ufshcd_scsi_add_wlus() fails
      drivers/scsi/ufs/ufshcd.c
    RDMA/netlink: Do not always generate an ACK for some netlink operations
    hv_sock: Remove the accept port restriction
  * ASoC: pcm: update FE/BE trigger order based on the command
      sound/soc/soc-pcm.c
    rxrpc: Fix service call disconnection
  * perf/core: Fix mlock accounting in perf_mmap()
      kernel/events/core.c
  * clocksource: Prevent double add_timer_on() for watchdog_timer
      kernel/time/clocksource.c
    cifs: fail i/o on soft mounts if sessionsetup errors out
    KVM: s390: do not clobber registers during guest reset/store status
    KVM: Play nice with read-only memslots when querying host page size
  * KVM: Use vcpu-specific gva->hva translation when querying host page size
      include/linux/kvm_host.h
    KVM: nVMX: vmread should not set rflags to specify success in case of #PF
    KVM: VMX: Add non-canonical check on writes to RTIT address MSRs
    KVM: x86/mmu: Apply max PA check for MMIO sptes to 32-bit KVM
    KVM: x86: Fix potential put_fpu() w/o load_fpu() on MPX platform
    btrfs: flush write bio if we loop in extent_write_cache_pages
    KVM: x86: Protect pmu_intel.c from Spectre-v1/L1TF attacks
    drm: atmel-hlcdc: enable clock before configuring timing engine
    Btrfs: fix race between adding and putting tree mod seq elements and nodes
    btrfs: remove trivial locking wrappers of tree mod log
    btrfs: free block groups after free'ing fs trees
    btrfs: use bool argument in free_root_pointers()
    Btrfs: fix missing hole after hole punching and fsync when using NO_HOLES
    Btrfs: fix assertion failure on fsync with NO_HOLES enabled
    btrfs: Get rid of the confusing btrfs_file_extent_inline_len
  * ext4: fix deadlock allocating crypto bounce page from mempool
      fs/ext4/page-io.c
  * bonding/alb: properly access headers in bond_alb_xmit()
      drivers/net/bonding/bond_alb.c
    net: macb: Limit maximum GEM TX length in TSO
    net: macb: Remove unnecessary alignment check for TSO
    net: systemport: Avoid RBUF stuck in Wake-on-LAN mode
    net_sched: fix a resource leak in tcindex_set_parms()
    net: dsa: bcm_sf2: Only 7278 supports 2Gb/sec IMP port
    mfd: rn5t618: Mark ADC control register volatile
    mfd: da9062: Fix watchdog compatible string
    ubi: Fix an error pointer dereference in error handling code
    ubi: fastmap: Fix inverted logic in seen selfcheck
    nfsd: fix jiffies/time_t mixup in LRU list
    nfsd: fix delay timer on 32-bit architectures
    IB/core: Fix ODP get user pages flow
    IB/mlx5: Fix outstanding_pi index for GSI qps
    net: tulip: Adjust indentation in {dmfe, uli526x}_init_module
    net: smc911x: Adjust indentation in smc911x_phy_configure
  * ppp: Adjust indentation into ppp_async_input
      drivers/net/ppp/ppp_async.c
    NFC: pn544: Adjust indentation in pn544_hci_check_presence
    powerpc/44x: Adjust indentation in ibm4xx_denali_fixup_memsize
    ext2: Adjust indentation in ext2_fill_super
    phy: qualcomm: Adjust indentation in read_poll_timeout
  * scsi: ufs: Recheck bkops level if bkops is disabled
      drivers/scsi/ufs/ufshcd.c
    scsi: qla4xxx: Adjust indentation in qla4xxx_mem_free
    scsi: csiostor: Adjust indentation in csio_device_reset
    scsi: qla2xxx: Fix the endianness of the qla82xx_get_fw_size() return type
    clk: tegra: Mark fuse clock as critical
    KVM: x86: Free wbinvd_dirty_mask if vCPU creation fails
    KVM: PPC: Book3S PR: Free shared page if mmu initialization fails
    KVM: PPC: Book3S HV: Uninit vCPU if vcore creation fails
    KVM: x86: Protect MSR-based index computations in fixed_msr_to_seg_unit() from Spectre-v1/L1TF attacks
    KVM: x86: Protect x86_decode_insn from Spectre-v1/L1TF attacks
    KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks in x86.c
    KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks
    KVM: x86: Protect MSR-based index computations in pmu.h from Spectre-v1/L1TF attacks
    KVM: x86: Protect ioapic_write_indirect() from Spectre-v1/L1TF attacks
    KVM: x86: Protect kvm_hv_msr_[get|set]_crash_data() from Spectre-v1/L1TF attacks
    KVM: x86: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks
    KVM: x86: Protect DR-based index computations from Spectre-v1/L1TF attacks
    KVM: x86: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks
    KVM: x86: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks
    xen/balloon: Support xend-based toolstack take two
    tools/kvm_stat: Fix kvm_exit filter name
    sunrpc: expiry_time should be seconds not timeval
    mwifiex: fix unbalanced locking in mwifiex_process_country_ie()
    iwlwifi: don't throw error when trying to remove IGTK
    ARM: tegra: Enable PLLP bypass during Tegra124 LP1
    btrfs: set trans->drity in btrfs_commit_transaction
    NFS: Directory page cache pages need to be locked when read
    NFS: Fix memory leaks and corruption in readdir
    scsi: qla2xxx: Fix unbound NVME response length
    crypto: picoxcell - adjust the position of tasklet_init and fix missed tasklet_kill
  * crypto: api - Fix race condition in crypto_spawn_alg
      crypto/algapi.c
      crypto/api.c
      crypto/internal.h
    crypto: atmel-aes - Fix counter overflow in CTR mode
    crypto: pcrypt - Do not clear MAY_SLEEP flag in original request
    crypto: ccp - set max RSA modulus size for v3 platform devices as well
    samples/bpf: Don't try to remove user's homedir on clean
  * ftrace: Protect ftrace_graph_hash with ftrace_sync
      kernel/trace/trace.h
  * ftrace: Add comment to why rcu_dereference_sched() is open coded
      kernel/trace/trace.h
  * tracing: Annotate ftrace_graph_notrace_hash pointer with __rcu
      kernel/trace/trace.h
  * tracing: Annotate ftrace_graph_hash pointer with __rcu
      kernel/trace/trace.h
    dm crypt: fix benbi IV constructor crash if used in authenticated mode
    dm space map common: fix to ensure new block isn't already in use
    dm zoned: support zone sizes smaller than 128MiB
  * of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc
      drivers/of/Kconfig
      drivers/of/address.c
  * PM: core: Fix handling of devices deleted during system-wide resume
      drivers/base/power/main.c
  * f2fs: code cleanup for f2fs_statfs_project()
      fs/f2fs/super.c
  * f2fs: fix miscounted block limit in f2fs_statfs_project()
      fs/f2fs/super.c
  * f2fs: choose hardlimit when softlimit is larger than hardlimit in f2fs_statfs_project()
      fs/f2fs/super.c
    power: supply: ltc2941-battery-gauge: fix use-after-free
    scsi: qla2xxx: Fix mtcp dump collection failure
  * crypto: api - Check spawn->alg under lock in crypto_drop_spawn
      crypto/algapi.c
    hv_balloon: Balloon up according to request page number
    ubifs: don't trigger assertion on invalid no-key filename
    mmc: sdhci-of-at91: fix memleak on clk_get failure
    PCI: keystone: Fix link training retries initiation
    ubifs: Fix deadlock in concurrent bulk-read and writepage
    ubifs: Fix FS_IOC_SETFLAGS unexpectedly clearing encrypt flag
    ubifs: Reject unsupported ioctl flags explicitly
  * alarmtimer: Unregister wakeup source when module get fails
      kernel/time/alarmtimer.c
    ACPI: video: Do not export a non working backlight interface on MSI MS-7721 boards
    mmc: spi: Toggle SPI polarity, do not hardcode it
    powerpc/pseries: Advance pfn if section is not present in lmb_is_removable()
    powerpc/xmon: don't access ASDR in VMs
    s390/mm: fix dynamic pagetable upgrade for hugetlbfs
    MIPS: fix indentation of the 'RELOCS' message
  * KVM: arm64: Only sign-extend MMIO up to register width
      arch/arm64/include/asm/kvm_mmio.h
    platform/x86: intel_scu_ipc: Fix interrupt support
  * irqdomain: Fix a memory leak in irq_domain_push_irq()
      kernel/irq/irqdomain.c
    lib/test_kasan.c: fix memory leak in kmalloc_oob_krealloc_more()
    media: v4l2-rect.h: fix v4l2_rect_map_inside() top/left adjustments
    media/v4l2-core: set pages dirty upon releasing DMA buffers
    ALSA: dummy: Fix PCM format loop in proc output
    usb: gadget: f_ecm: Use atomic_t to track in-flight request
  * usb: gadget: f_ncm: Use atomic_t to track in-flight request
      drivers/usb/gadget/function/f_ncm.c
    usb: gadget: legacy: set max_speed to super-speed
    brcmfmac: Fix memory leak in brcmf_usbdev_qinit
  * tracing: Fix sched switch start/stop refcount racy updates
      kernel/trace/trace_sched_switch.c
    mfd: dln2: More sanity checking for endpoints
    media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors
    rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect
    rxrpc: Fix insufficient receive notification generation
  * tcp: clear tp->segs_{in|out} in tcp_disconnect()
      net/ipv4/tcp.c
  * tcp: clear tp->data_segs{in|out} in tcp_disconnect()
      net/ipv4/tcp.c
  * tcp: clear tp->delivered in tcp_disconnect()
      net/ipv4/tcp.c
  * tcp: clear tp->total_retrans in tcp_disconnect()
      net/ipv4/tcp.c
    bnxt_en: Fix TC queue mapping.
    net_sched: fix an OOB access in cls_tcindex
    net: hsr: fix possible NULL deref in hsr_handle_frame()
  * l2tp: Allow duplicate session creation with UDP
      net/l2tp/l2tp_core.c
    gtp: use __GFP_NOWARN to avoid memalloc warning
    cls_rsvp: fix rsvp_policy
    sparc32: fix struct ipc64_perm type definition
    iwlwifi: mvm: fix NVM check for 3168 devices
    x86/cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR
    media: iguanair: fix endpoint sanity check
  * kernel/module: Fix memleak in module_add_modinfo_attrs()
      kernel/module.c

Change-Id: I481eceb2214ffd107b59f8745d72e418d8b5fefb
Signed-off-by: lucaswei <lucaswei@google.com>
 2020-04-24 21:08:58 +08:00
Joerg Roedel
c3cf92fd9b x86/mm: split vmalloc_sync_all() 
commit 763802b53a427ed3cbd419dbba255c414fdd9e7c upstream.

Commit 3f8fd02b1bf1 ("mm/vmalloc: Sync unmappings in
__purge_vmap_area_lazy()") introduced a call to vmalloc_sync_all() in
the vunmap() code-path.  While this change was necessary to maintain
correctness on x86-32-pae kernels, it also adds additional cycles for
architectures that don't need it.

Specifically on x86-64 with CONFIG_VMAP_STACK=y some people reported
severe performance regressions in micro-benchmarks because it now also
calls the x86-64 implementation of vmalloc_sync_all() on vunmap().  But
the vmalloc_sync_all() implementation on x86-64 is only needed for newly
created mappings.

To avoid the unnecessary work on x86-64 and to gain the performance
back, split up vmalloc_sync_all() into two functions:

	* vmalloc_sync_mappings(), and
	* vmalloc_sync_unmappings()

Most call-sites to vmalloc_sync_all() only care about new mappings being
synchronized.  The only exception is the new call-site added in the
above mentioned commit.

Shile Zhang directed us to a report of an 80% regression in reaim
throughput.

Fixes: 3f8fd02b1bf1 ("mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()")
Reported-by: kernel test robot <oliver.sang@intel.com>
Reported-by: Shile Zhang <shile.zhang@linux.alibaba.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Borislav Petkov <bp@suse.de>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>	[GHES]
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20191009124418.8286-1-joro@8bytes.org
Link: https://lists.01.org/hyperkitty/list/lkp@lists.01.org/thread/4D3JPPHBNOSPFK2KEPC6KGKS6J25AIDB/
Link: http://lkml.kernel.org/r/20191113095530.228959-1-shile.zhang@linux.alibaba.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2020-04-02 16:34:20 +02:00
Wilson Sung
c5ca3f6408 Revert none upstream mm patches 
Revert below patches:
6c6855ca65 ("mm: page_alloc: Add debug log in free_reserved_area for static memory")
b5ae9223ce ("msm: Increase the kernel virtual area to include lowmem")
a5ebe3b356 ("mm: Update is_vmalloc_addr to account for vmalloc savings")
9e24634404 ("mm: memblock: dynamically calculate memory hotplug range")
03307a0339 ("msm: Allow lowmem to be non contiguous and mixed")
68c4f530d2 ("mm: memblock:  Add more debug logs")
dc3a61b4c6 ("mm: cma: make writeable CMA debugfs optional")
9d5115ba4e ("mm: fix the race between swapin_readahead and SWP_SYNCHRONOUS_IO path")
0f6b15696b ("mm, page_owner: record time and pid")
d21115953f ("ARM64: mm: Add log in fixmap_remap_fdt for static memory")
b1410a2fab ("arm64: Honor limits set by boot parameter")
075169d79b ("arm64: mm: Support setting removed_dma_ops in arch_setup_dma_ops")

Bug: 149660093
Bug: 149721069
Change-Id: Id22f0c1f0aaf1789e20004f84741fb75c3982abb
Signed-off-by: Wilson Sung <wilsonsung@google.com>
 2020-03-20 11:47:07 +08:00
Susheel Khiani
a5ebe3b356 mm: Update is_vmalloc_addr to account for vmalloc savings 
is_vmalloc_addr currently assumes that all vmalloc addresses
exist between VMALLOC_START and VMALLOC_END. This may not be
the case when interleaving vmalloc and lowmem. Update the
is_vmalloc_addr to properly check for this.

Correspondingly we need to ensure that VMALLOC_TOTAL accounts
for all the vmalloc regions when CONFIG_ENABLE_VMALLOC_SAVING
is enabled.

Change-Id: I5def3d6ae1a4de59ea36f095b8c73649a37b1f36
Signed-off-by: Susheel Khiani <skhiani@codeaurora.org>
Signed-off-by: Zhenhua Huang <zhenhuah@codeaurora.org>
 2019-12-26 22:32:23 -08:00
Susheel Khiani
03307a0339 msm: Allow lowmem to be non contiguous and mixed 
Currently on 32 bit systems, virtual space above
PAGE_OFFSET is reserved for direct mapped lowmem
and part of virtual address space is reserved for
vmalloc. We want to optimize such as to have as
much direct mapped memory as possible since there is
penalty for mapping/unmapping highmem. Now, we may
have an image that is expected to have a lifetime of
the entire system and is reserved in physical region
that would be part of direct mapped lowmem. The
physical memory which is thus reserved is never used
by Linux. This means that even though the system is
not actually accessing the  virtual memory
corresponding to the reserved physical memory, we
are still losing that portion of direct mapped lowmem
space.

So by allowing lowmem to be non contiguous we can
give this unused virtual address space of reserved
region back for use in vmalloc.

Change-Id: I980b3dfafac71884dcdcb8cd2e4a6363cde5746a
Signed-off-by: Susheel Khiani <skhiani@codeaurora.org>
 2019-12-10 14:33:29 +08:00
Roman Gushchin
fd7f993edf mm: show number of vmalloc pages in /proc/meminfo 
Vmalloc() is getting more and more used these days (kernel stacks,
bpf and percpu allocator are new top users), and the total %
of memory consumed by vmalloc() can be pretty significant
and changes dynamically.

/proc/meminfo is the best place to display this information:
its top goal is to show top consumers of the memory.

Since the VmallocUsed field in /proc/meminfo is not in use
for quite a long time (it has been defined to 0 by the
commit a5ad88ce8c ("mm: get rid of 'vmalloc_info' from
/proc/meminfo")), let's reuse it for showing the actual
physical memory consumption of vmalloc().

Change-Id: Ice4fd4b94c9c156b463487aaef033a8f8c3aa821
Signed-off-by: Roman Gushchin <guro@fb.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Patch-mainline: linux-mm @ Mon, 25 Feb 2019 12:30:37 -0800
Signed-off-by: Vijayanand Jitta <vjitta@codeaurora.org>
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
 2019-03-19 22:53:38 -07:00
Greg Kroah-Hartman
b24413180f License cleanup: add SPDX GPL-2.0 license identifier to files with no license 
Many source files in the tree are missing licensing information, which
makes it harder for compliance tools to determine the correct license.

By default all files without license information are under the default
license of the kernel, which is GPL version 2.

Update the files which contain no license information with the 'GPL-2.0'
SPDX license identifier.  The SPDX identifier is a legally binding
shorthand, which can be used instead of the full boiler plate text.

This patch is based on work done by Thomas Gleixner and Kate Stewart and
Philippe Ombredanne.

How this work was done:

Patches were generated and checked against linux-4.14-rc6 for a subset of
the use cases:
 - file had no licensing information it it.
 - file was a */uapi/* one with no licensing information in it,
 - file was a */uapi/* one with existing licensing information,

Further patches will be generated in subsequent months to fix up cases
where non-standard license headers were used, and references to license
had to be inferred by heuristics based on keywords.

The analysis to determine which SPDX License Identifier to be applied to
a file was done in a spreadsheet of side by side results from of the
output of two independent scanners (ScanCode & Windriver) producing SPDX
tag:value files created by Philippe Ombredanne.  Philippe prepared the
base worksheet, and did an initial spot review of a few 1000 files.

The 4.13 kernel was the starting point of the analysis with 60,537 files
assessed.  Kate Stewart did a file by file comparison of the scanner
results in the spreadsheet to determine which SPDX license identifier(s)
to be applied to the file. She confirmed any determination that was not
immediately clear with lawyers working with the Linux Foundation.

Criteria used to select files for SPDX license identifier tagging was:
 - Files considered eligible had to be source code files.
 - Make and config files were included as candidates if they contained >5
   lines of source
 - File already had some variant of a license header in it (even if <5
   lines).

All documentation files were explicitly excluded.

The following heuristics were used to determine which SPDX license
identifiers to apply.

 - when both scanners couldn't find any license traces, file was
   considered to have no license information in it, and the top level
   COPYING file license applied.

   For non */uapi/* files that summary was:

   SPDX license identifier                            # files
   ---------------------------------------------------|-------
   GPL-2.0                                              11139

   and resulted in the first patch in this series.

   If that file was a */uapi/* path one, it was "GPL-2.0 WITH
   Linux-syscall-note" otherwise it was "GPL-2.0".  Results of that was:

   SPDX license identifier                            # files
   ---------------------------------------------------|-------
   GPL-2.0 WITH Linux-syscall-note                        930

   and resulted in the second patch in this series.

 - if a file had some form of licensing information in it, and was one
   of the */uapi/* ones, it was denoted with the Linux-syscall-note if
   any GPL family license was found in the file or had no licensing in
   it (per prior point).  Results summary:

   SPDX license identifier                            # files
   ---------------------------------------------------|------
   GPL-2.0 WITH Linux-syscall-note                       270
   GPL-2.0+ WITH Linux-syscall-note                      169
   ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause)    21
   ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause)    17
   LGPL-2.1+ WITH Linux-syscall-note                      15
   GPL-1.0+ WITH Linux-syscall-note                       14
   ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause)    5
   LGPL-2.0+ WITH Linux-syscall-note                       4
   LGPL-2.1 WITH Linux-syscall-note                        3
   ((GPL-2.0 WITH Linux-syscall-note) OR MIT)              3
   ((GPL-2.0 WITH Linux-syscall-note) AND MIT)             1

   and that resulted in the third patch in this series.

 - when the two scanners agreed on the detected license(s), that became
   the concluded license(s).

 - when there was disagreement between the two scanners (one detected a
   license but the other didn't, or they both detected different
   licenses) a manual inspection of the file occurred.

 - In most cases a manual inspection of the information in the file
   resulted in a clear resolution of the license that should apply (and
   which scanner probably needed to revisit its heuristics).

 - When it was not immediately clear, the license identifier was
   confirmed with lawyers working with the Linux Foundation.

 - If there was any question as to the appropriate license identifier,
   the file was flagged for further research and to be revisited later
   in time.

In total, over 70 hours of logged manual review was done on the
spreadsheet to determine the SPDX license identifiers to apply to the
source files by Kate, Philippe, Thomas and, in some cases, confirmation
by lawyers working with the Linux Foundation.

Kate also obtained a third independent scan of the 4.13 code base from
FOSSology, and compared selected files where the other two scanners
disagreed against that SPDX file, to see if there was new insights.  The
Windriver scanner is based on an older version of FOSSology in part, so
they are related.

Thomas did random spot checks in about 500 files from the spreadsheets
for the uapi headers and agreed with SPDX license identifier in the
files he inspected. For the non-uapi files Thomas did random spot checks
in about 15000 files.

In initial set of patches against 4.14-rc6, 3 files were found to have
copy/paste license identifier errors, and have been fixed to reflect the
correct identifier.

Additionally Philippe spent 10 hours this week doing a detailed manual
inspection and review of the 12,461 patched files from the initial patch
version early this week with:
 - a full scancode scan run, collecting the matched texts, detected
   license ids and scores
 - reviewing anything where there was a license detected (about 500+
   files) to ensure that the applied SPDX license was correct
 - reviewing anything where there was no detection but the patch license
   was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied
   SPDX license was correct

This produced a worksheet with 20 files needing minor correction.  This
worksheet was then exported into 3 different .csv files for the
different types of files to be modified.

These .csv files were then reviewed by Greg.  Thomas wrote a script to
parse the csv files and add the proper SPDX tag to the file, in the
format that the file expected.  This script was further refined by Greg
based on the output to detect more types of files automatically and to
distinguish between header and source .c files (which need different
comment types.)  Finally Greg ran the script using the .csv files to
generate the patches.

Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org>
Reviewed-by: Philippe Ombredanne <pombredanne@nexb.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-11-02 11:10:55 +01:00
Michal Hocko
8594a21cf7 mm, vmalloc: fix vmalloc users tracking properly 
Commit 1f5307b1e0 ("mm, vmalloc: properly track vmalloc users") has
pulled asm/pgtable.h include dependency to linux/vmalloc.h and that
turned out to be a bad idea for some architectures.  E.g.  m68k fails
with

   In file included from arch/m68k/include/asm/pgtable_mm.h:145:0,
                    from arch/m68k/include/asm/pgtable.h:4,
                    from include/linux/vmalloc.h:9,
                    from arch/m68k/kernel/module.c:9:
   arch/m68k/include/asm/mcf_pgtable.h: In function 'nocache_page':
>> arch/m68k/include/asm/mcf_pgtable.h:339:43: error: 'init_mm' undeclared (first use in this function)
    #define pgd_offset_k(address) pgd_offset(&init_mm, address)

as spotted by kernel build bot. nios2 fails for other reason

  In file included from include/asm-generic/io.h:767:0,
                   from arch/nios2/include/asm/io.h:61,
                   from include/linux/io.h:25,
                   from arch/nios2/include/asm/pgtable.h:18,
                   from include/linux/mm.h:70,
                   from include/linux/pid_namespace.h:6,
                   from include/linux/ptrace.h:9,
                   from arch/nios2/include/uapi/asm/elf.h:23,
                   from arch/nios2/include/asm/elf.h:22,
                   from include/linux/elf.h:4,
                   from include/linux/module.h:15,
                   from init/main.c:16:
  include/linux/vmalloc.h: In function '__vmalloc_node_flags':
  include/linux/vmalloc.h:99:40: error: 'PAGE_KERNEL' undeclared (first use in this function); did you mean 'GFP_KERNEL'?

which is due to the newly added #include <asm/pgtable.h>, which on nios2
includes <linux/io.h> and thus <asm/io.h> and <asm-generic/io.h> which
again includes <linux/vmalloc.h>.

Tweaking that around just turns out a bigger headache than necessary.
This patch reverts 1f5307b1e0 and reimplements the original fix in a
different way.  __vmalloc_node_flags can stay static inline which will
cover vmalloc* functions.  We only have one external user
(kvmalloc_node) and we can export __vmalloc_node_flags_caller and
provide the caller directly.  This is much simpler and it doesn't really
need any games with header files.

[akpm@linux-foundation.org: coding-style fixes]
[mhocko@kernel.org: revert old comment]
  Link: http://lkml.kernel.org/r/20170509211054.GB16325@dhcp22.suse.cz
Fixes: 1f5307b1e0 ("mm, vmalloc: properly track vmalloc users")
Link: http://lkml.kernel.org/r/20170509153702.GR6481@dhcp22.suse.cz
Signed-off-by: Michal Hocko <mhocko@suse.com>
Cc: Tobias Klauser <tklauser@distanz.ch>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2017-05-12 15:57:15 -07:00
Michal Hocko
1f5307b1e0 mm, vmalloc: properly track vmalloc users 
__vmalloc_node_flags used to be static inline but this has changed by
"mm: introduce kv[mz]alloc helpers" because kvmalloc_node needs to use
it as well and the code is outside of the vmalloc proper.  I haven't
realized that changing this will lead to a subtle bug though.  The
function is responsible to track the caller as well.  This caller is
then printed by /proc/vmallocinfo.  If __vmalloc_node_flags is not
inline then we would get only direct users of __vmalloc_node_flags as
callers (e.g.  v[mz]alloc) which reduces usefulness of this debugging
feature considerably.  It simply doesn't help to see that the given
range belongs to vmalloc as a caller:

  0xffffc90002c79000-0xffffc90002c7d000   16384 vmalloc+0x16/0x18 pages=3 vmalloc N0=3
  0xffffc90002c81000-0xffffc90002c85000   16384 vmalloc+0x16/0x18 pages=3 vmalloc N1=3
  0xffffc90002c8d000-0xffffc90002c91000   16384 vmalloc+0x16/0x18 pages=3 vmalloc N1=3
  0xffffc90002c95000-0xffffc90002c99000   16384 vmalloc+0x16/0x18 pages=3 vmalloc N1=3

We really want to catch the _caller_ of the vmalloc function.  Fix this
issue by making __vmalloc_node_flags static inline again.

Link: http://lkml.kernel.org/r/20170502134657.12381-1-mhocko@kernel.org
Signed-off-by: Michal Hocko <mhocko@suse.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2017-05-08 17:15:12 -07:00
Michal Hocko
a7c3e901a4 mm: introduce kv[mz]alloc helpers 
Patch series "kvmalloc", v5.

There are many open coded kmalloc with vmalloc fallback instances in the
tree.  Most of them are not careful enough or simply do not care about
the underlying semantic of the kmalloc/page allocator which means that
a) some vmalloc fallbacks are basically unreachable because the kmalloc
part will keep retrying until it succeeds b) the page allocator can
invoke a really disruptive steps like the OOM killer to move forward
which doesn't sound appropriate when we consider that the vmalloc
fallback is available.

As it can be seen implementing kvmalloc requires quite an intimate
knowledge if the page allocator and the memory reclaim internals which
strongly suggests that a helper should be implemented in the memory
subsystem proper.

Most callers, I could find, have been converted to use the helper
instead.  This is patch 6.  There are some more relying on __GFP_REPEAT
in the networking stack which I have converted as well and Eric Dumazet
was not opposed [2] to convert them as well.

[1] http://lkml.kernel.org/r/20170130094940.13546-1-mhocko@kernel.org
[2] http://lkml.kernel.org/r/1485273626.16328.301.camel@edumazet-glaptop3.roam.corp.google.com

This patch (of 9):

Using kmalloc with the vmalloc fallback for larger allocations is a
common pattern in the kernel code.  Yet we do not have any common helper
for that and so users have invented their own helpers.  Some of them are
really creative when doing so.  Let's just add kv[mz]alloc and make sure
it is implemented properly.  This implementation makes sure to not make
a large memory pressure for > PAGE_SZE requests (__GFP_NORETRY) and also
to not warn about allocation failures.  This also rules out the OOM
killer as the vmalloc is a more approapriate fallback than a disruptive
user visible action.

This patch also changes some existing users and removes helpers which
are specific for them.  In some cases this is not possible (e.g.
ext4_kvmalloc, libcfs_kvzalloc) because those seems to be broken and
require GFP_NO{FS,IO} context which is not vmalloc compatible in general
(note that the page table allocation is GFP_KERNEL).  Those need to be
fixed separately.

While we are at it, document that __vmalloc{_node} about unsupported gfp
mask because there seems to be a lot of confusion out there.
kvmalloc_node will warn about GFP_KERNEL incompatible (which are not
superset) flags to catch new abusers.  Existing ones would have to die
slowly.

[sfr@canb.auug.org.au: f2fs fixup]
  Link: http://lkml.kernel.org/r/20170320163735.332e64b7@canb.auug.org.au
Link: http://lkml.kernel.org/r/20170306103032.2540-2-mhocko@kernel.org
Signed-off-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>	[ext4 part]
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2017-05-08 17:15:12 -07:00
Andrey Ryabinin
bf22e37a64 mm: add vfree_atomic() 
We are going to use sleeping lock for freeing vmap.  However some
vfree() users want to free memory from atomic (but not from interrupt)
context.  For this we add vfree_atomic() - deferred variation of vfree()
which can be used in any atomic context (except NMIs).

[akpm@linux-foundation.org: tweak comment grammar]
[aryabinin@virtuozzo.com: use raw_cpu_ptr() instead of this_cpu_ptr()]
  Link: http://lkml.kernel.org/r/1481553981-3856-1-git-send-email-aryabinin@virtuozzo.com
Link: http://lkml.kernel.org/r/1479474236-4139-5-git-send-email-hch@lst.de
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Cc: Joel Fernandes <joelaf@google.com>
Cc: Jisheng Zhang <jszhang@marvell.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: John Dias <joaodias@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2016-12-12 18:55:08 -08:00
Linus Torvalds
1d6da87a32 Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux 
Pull drm updates from Dave Airlie:
 "Here's the main drm pull request for 4.7, it's been a busy one, and
  I've been a bit more distracted in real life this merge window.  Lots
  more ARM drivers, not sure if it'll ever end.  I think I've at least
  one more coming the next merge window.

  But changes are all over the place, support for AMD Polaris GPUs is in
  here, some missing GM108 support for nouveau (found in some Lenovos),
  a bunch of MST and skylake fixes.

  I've also noticed a few fixes from Arnd in my inbox, that I'll try and
  get in asap, but I didn't think they should hold this up.

  New drivers:
   - Hisilicon kirin display driver
   - Mediatek MT8173 display driver
   - ARC PGU - bitstreamer on Synopsys ARC SDP boards
   - Allwinner A13 initial RGB output driver
   - Analogix driver for DisplayPort IP found in exynos and rockchip

  DRM Core:
   - UAPI headers fixes and C++ safety
   - DRM connector reference counting
   - DisplayID mode parsing for Dell 5K monitors
   - Removal of struct_mutex from drivers
   - Connector registration cleanups
   - MST robustness fixes
   - MAINTAINERS updates
   - Lockless GEM object freeing
   - Generic fbdev deferred IO support

  panel:
   - Support for a bunch of new panels

  i915:
   - VBT refactoring
   - PLL computation cleanups
   - DSI support for BXT
   - Color manager support
   - More atomic patches
   - GEM improvements
   - GuC fw loading fixes
   - DP detection fixes
   - SKL GPU hang fixes
   - Lots of BXT fixes

  radeon/amdgpu:
   - Initial Polaris support
   - GPUVM/Scheduler/Clock/Power improvements
   - ASYNC pageflip support
   - New mesa feature support

  nouveau:
   - GM108 support
   - Power sensor support improvements
   - GR init + ucode fixes.
   - Use GPU provided topology information

  vmwgfx:
   - Add host messaging support

  gma500:
   - Some cleanups and fixes

  atmel:
   - Bridge support
   - Async atomic commit support

  fsl-dcu:
   - Timing controller for LCD support
   - Pixel clock polarity support

  rcar-du:
   - Misc fixes

  exynos:
   - Pipeline clock support
   - Exynoss4533 SoC support
   - HW trigger mode support
   - export HDMI_PHY clock
   - DECON5433 fixes
   - Use generic prime functions
   - use DMA mapping APIs

  rockchip:
   - Lots of little fixes

  vc4:
   - Render node support
   - Gamma ramp support
   - DPI output support

  msm:
   - Mostly cleanups and fixes
   - Conversion to generic struct fence

  etnaviv:
   - Fix for prime buffer handling
   - Allow hangcheck to be coalesced with other wakeups

  tegra:
   - Gamme table size fix"

* 'drm-next' of git://people.freedesktop.org/~airlied/linux: (1050 commits)
  drm/edid: add displayid detailed 1 timings to the modelist. (v1.1)
  drm/edid: move displayid validation to it's own function.
  drm/displayid: Iterate over all DisplayID blocks
  drm/edid: move displayid tiled block parsing into separate function.
  drm: Nuke ->vblank_disable_allowed
  drm/vmwgfx: Report vmwgfx version to vmware.log
  drm/vmwgfx: Add VMWare host messaging capability
  drm/vmwgfx: Kill some lockdep warnings
  drm/nouveau/gr/gf100-: fix race condition in fecs/gpccs ucode
  drm/nouveau/core: recognise GM108 chipsets
  drm/nouveau/gr/gm107-: fix touching non-existent ppcs in attrib cb setup
  drm/nouveau/gr/gk104-: share implementation of ppc exception init
  drm/nouveau/gr/gk104-: move rop_active_fbps init to nonctx
  drm/nouveau/bios/pll: check BIT table version before trying to parse it
  drm/nouveau/bios/pll: prevent oops when limits table can't be parsed
  drm/nouveau/volt/gk104: round up in gk104_volt_set
  drm/nouveau/fb/gm200: setup mmu debug buffer registers at init()
  drm/nouveau/fb/gk20a,gm20b: setup mmu debug buffer registers at init()
  drm/nouveau/fb/gf100-: allocate mmu debug buffers
  drm/nouveau/fb: allow chipset-specific actions for oneinit()
  ...
 2016-05-23 11:48:48 -07:00
Chris Wilson
80c4bd7a5e mm/vmalloc: keep a separate lazy-free list 
When mixing lots of vmallocs and set_memory_*() (which calls
vm_unmap_aliases()) I encountered situations where the performance
degraded severely due to the walking of the entire vmap_area list each
invocation.

One simple improvement is to add the lazily freed vmap_area to a
separate lockless free list, such that we then avoid having to walk the
full list on each purge.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Roman Pen <r.peniaev@gmail.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Roman Pen <r.peniaev@gmail.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Toshi Kani <toshi.kani@hp.com>
Cc: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2016-05-20 17:58:30 -07:00
Chris Wilson
4da56b99d9 mm/vmap: Add a notifier for when we run out of vmap address space 
vmaps are temporary kernel mappings that may be of long duration.
Reusing a vmap on an object is preferrable for a driver as the cost of
setting up the vmap can otherwise dominate the operation on the object.
However, the vmap address space is rather limited on 32bit systems and
so we add a notification for vmap pressure in order for the driver to
release any cached vmappings.

The interface is styled after the oom-notifier where the callees are
passed a pointer to an unsigned long counter for them to indicate if they
have freed any space.

v2: Guard the blocking notifier call with gfpflags_allow_blocking()
v3: Correct typo in forward declaration and move to head of file

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Roman Peniaev <r.peniaev@gmail.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: linux-mm@kvack.org
Cc: linux-kernel@vger.kernel.org
Acked-by: Andrew Morton <akpm@linux-foundation.org> # for inclusion via DRM
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1459777603-23618-3-git-send-email-chris@chris-wilson.co.uk
Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
 2016-04-05 11:12:04 +01:00
David Rientjes
244d63ee34 mm, vmalloc: remove VM_VPAGES 
VM_VPAGES is unnecessary, it's easier to check is_vmalloc_addr() when
reading /proc/vmallocinfo.

[akpm@linux-foundation.org: remove VM_VPAGES reference via kvfree()]
Signed-off-by: David Rientjes <rientjes@google.com>
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2016-01-14 16:00:49 -08:00
Linus Torvalds
a5ad88ce8c mm: get rid of 'vmalloc_info' from /proc/meminfo 
It turns out that at least some versions of glibc end up reading
/proc/meminfo at every single startup, because glibc wants to know the
amount of memory the machine has.  And while that's arguably insane,
it's just how things are.

And it turns out that it's not all that expensive most of the time, but
the vmalloc information statistics (amount of virtual memory used in the
vmalloc space, and the biggest remaining chunk) can be rather expensive
to compute.

The 'get_vmalloc_info()' function actually showed up on my profiles as
4% of the CPU usage of "make test" in the git source repository, because
the git tests are lots of very short-lived shell-scripts etc.

It turns out that apparently this same silly vmalloc info gathering
shows up on the facebook servers too, according to Dave Jones.  So it's
not just "make test" for git.

We had two patches to just cache the information (one by me, one by
Ingo) to mitigate this issue, but the whole vmalloc information of of
rather dubious value to begin with, and people who *actually* want to
know what the situation is wrt the vmalloc area should just look at the
much more complete /proc/vmallocinfo instead.

In fact, according to my testing - and perhaps more importantly,
according to that big search engine in the sky: Google - there is
nothing out there that actually cares about those two expensive fields:
VmallocUsed and VmallocChunk.

So let's try to just remove them entirely.  Actually, this just removes
the computation and reports the numbers as zero for now, just to try to
be minimally intrusive.

If this breaks anything, we'll obviously have to re-introduce the code
to compute this all and add the caching patches on top.  But if given
the option, I'd really prefer to just remove this bad idea entirely
rather than add even more code to work around our historical mistake
that likely nobody really cares about.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2015-11-01 17:09:15 -08:00
Andrey Ryabinin
a5af5aa8b6 kasan, module, vmalloc: rework shadow allocation for modules 
Current approach in handling shadow memory for modules is broken.

Shadow memory could be freed only after memory shadow corresponds it is no
longer used.  vfree() called from interrupt context could use memory its
freeing to store 'struct llist_node' in it:

    void vfree(const void *addr)
    {
    ...
        if (unlikely(in_interrupt())) {
            struct vfree_deferred *p = this_cpu_ptr(&vfree_deferred);
            if (llist_add((struct llist_node *)addr, &p->list))
                    schedule_work(&p->wq);

Later this list node used in free_work() which actually frees memory.
Currently module_memfree() called in interrupt context will free shadow
before freeing module's memory which could provoke kernel crash.

So shadow memory should be freed after module's memory.  However, such
deallocation order could race with kasan_module_alloc() in module_alloc().

Free shadow right before releasing vm area.  At this point vfree()'d
memory is not used anymore and yet not available for other allocations.
New VM_KASAN flag used to indicate that vm area has dynamically allocated
shadow memory so kasan frees shadow only if it was previously allocated.

Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
Acked-by: Rusty Russell <rusty@rustcorp.com.au>
Cc: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2015-03-12 18:46:08 -07:00
Andrey Ryabinin
cb9e3c292d mm: vmalloc: pass additional vm_flags to __vmalloc_node_range() 
For instrumenting global variables KASan will shadow memory backing memory
for modules.  So on module loading we will need to allocate memory for
shadow and map it at address in shadow that corresponds to the address
allocated in module_alloc().

__vmalloc_node_range() could be used for this purpose, except it puts a
guard hole after allocated area.  Guard hole in shadow memory should be a
problem because at some future point we might need to have a shadow memory
at address occupied by guard hole.  So we could fail to allocate shadow
for module_alloc().

Now we have VM_NO_GUARD flag disabling guard page, so we need to pass into
__vmalloc_node_range().  Add new parameter 'vm_flags' to
__vmalloc_node_range() function.

Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Konstantin Serebryany <kcc@google.com>
Cc: Dmitry Chernenkov <dmitryc@google.com>
Signed-off-by: Andrey Konovalov <adech.fo@gmail.com>
Cc: Yuri Gribov <tetra2005@gmail.com>
Cc: Konstantin Khlebnikov <koct9i@gmail.com>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2015-02-13 21:21:42 -08:00
Andrey Ryabinin
71394fe501 mm: vmalloc: add flag preventing guard hole allocation 
For instrumenting global variables KASan will shadow memory backing memory
for modules.  So on module loading we will need to allocate memory for
shadow and map it at address in shadow that corresponds to the address
allocated in module_alloc().

__vmalloc_node_range() could be used for this purpose, except it puts a
guard hole after allocated area.  Guard hole in shadow memory should be a
problem because at some future point we might need to have a shadow memory
at address occupied by guard hole.  So we could fail to allocate shadow
for module_alloc().

Add a new vm_struct flag 'VM_NO_GUARD' indicating that vm area doesn't
have a guard hole.

Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Konstantin Serebryany <kcc@google.com>
Cc: Dmitry Chernenkov <dmitryc@google.com>
Signed-off-by: Andrey Konovalov <adech.fo@gmail.com>
Cc: Yuri Gribov <tetra2005@gmail.com>
Cc: Konstantin Khlebnikov <koct9i@gmail.com>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2015-02-13 21:21:42 -08:00
WANG Chao
f6f8ed4735 mm/vmalloc.c: clean up map_vm_area third argument 
Currently map_vm_area() takes (struct page *** pages) as third argument,
and after mapping, it moves (*pages) to point to (*pages +
nr_mappped_pages).

It looks like this kind of increment is useless to its caller these
days.  The callers don't care about the increments and actually they're
trying to avoid this by passing another copy to map_vm_area().

The caller can always guarantee all the pages can be mapped into vm_area
as specified in first argument and the caller only cares about whether
map_vm_area() fails or not.

This patch cleans up the pointer movement in map_vm_area() and updates
its callers accordingly.

Signed-off-by: WANG Chao <chaowang@redhat.com>
Cc: Zhang Yanfei <zhangyanfei@cn.fujitsu.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Nitin Gupta <ngupta@vflare.org>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2014-08-06 18:01:19 -07:00
Zhang Yanfei
20fc02b477 mm/vmalloc.c: rename VM_UNLIST to VM_UNINITIALIZED 
VM_UNLIST was used to indicate that the vm_struct is not listed in
vmlist.

But after commit 4341fa4547 ("mm, vmalloc: remove list management of
vmlist after initializing vmalloc"), the meaning of this flag changed.
It now means the vm_struct is not fully initialized.  So renaming it to
VM_UNINITIALIZED seems more reasonable.

Also change clear_vm_unlist to clear_vm_uninitialized_flag.

Signed-off-by: Zhang Yanfei <zhangyanfei@cn.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2013-07-09 10:33:21 -07:00
HATAYAMA Daisuke
e69e9d4aee vmalloc: introduce remap_vmalloc_range_partial 
We want to allocate ELF note segment buffer on the 2nd kernel in vmalloc
space and remap it to user-space in order to reduce the risk that memory
allocation fails on system with huge number of CPUs and so with huge ELF
note segment that exceeds 11-order block size.

Although there's already remap_vmalloc_range for the purpose of
remapping vmalloc memory to user-space, we need to specify user-space
range via vma.
 Mmap on /proc/vmcore needs to remap range across multiple objects, so
the interface that requires vma to cover full range is problematic.

This patch introduces remap_vmalloc_range_partial that receives user-space
range as a pair of base address and size and can be used for mmap on
/proc/vmcore case.

remap_vmalloc_range is rewritten using remap_vmalloc_range_partial.

[akpm@linux-foundation.org: use PAGE_ALIGNED()]
Signed-off-by: HATAYAMA Daisuke <d.hatayama@jp.fujitsu.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: Atsushi Kumagai <kumagai-atsushi@mxc.nes.nec.co.jp>
Cc: Lisa Mitchell <lisa.mitchell@hp.com>
Cc: Zhang Yanfei <zhangyanfei@cn.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2013-07-03 16:07:30 -07:00
Atsushi Kumagai
13ba3fcbbe kexec, vmalloc: export additional vmalloc layer information 
Now, vmap_area_list is exported as VMCOREINFO for makedumpfile to get
the start address of vmalloc region (vmalloc_start).  The address which
contains vmalloc_start value is represented as below:

  vmap_area_list.next - OFFSET(vmap_area.list) + OFFSET(vmap_area.va_start)

However, both OFFSET(vmap_area.va_start) and OFFSET(vmap_area.list)
aren't exported as VMCOREINFO.

So this patch exports them externally with small cleanup.

[akpm@linux-foundation.org: vmalloc.h should include list.h for list_head]
Signed-off-by: Atsushi Kumagai <kumagai-atsushi@mxc.nes.nec.co.jp>
Cc: Joonsoo Kim <js1304@gmail.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Atsushi Kumagai <kumagai-atsushi@mxc.nes.nec.co.jp>
Cc: Chris Metcalf <cmetcalf@tilera.com>
Cc: Dave Anderson <anderson@redhat.com>
Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2013-04-29 15:54:34 -07:00
Joonsoo Kim
f1c4069e1d mm, vmalloc: export vmap_area_list, instead of vmlist 
Although our intention is to unexport internal structure entirely, but
there is one exception for kexec.  kexec dumps address of vmlist and
makedumpfile uses this information.

We are about to remove vmlist, then another way to retrieve information
of vmalloc layer is needed for makedumpfile.  For this purpose, we
export vmap_area_list, instead of vmlist.

Signed-off-by: Joonsoo Kim <js1304@gmail.com>
Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Dave Anderson <anderson@redhat.com>
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: Atsushi Kumagai <kumagai-atsushi@mxc.nes.nec.co.jp>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Chris Metcalf <cmetcalf@tilera.com>
Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
Cc: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2013-04-29 15:54:34 -07:00
Joonsoo Kim
db3808c1ba mm, vmalloc: move get_vmalloc_info() to vmalloc.c 
Now get_vmalloc_info() is in fs/proc/mmu.c.  There is no reason that this
code must be here and it's implementation needs vmlist_lock and it iterate
a vmlist which may be internal data structure for vmalloc.

It is preferable that vmlist_lock and vmlist is only used in vmalloc.c
for maintainability. So move the code to vmalloc.c

Signed-off-by: Joonsoo Kim <js1304@gmail.com>
Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Atsushi Kumagai <kumagai-atsushi@mxc.nes.nec.co.jp>
Cc: Chris Metcalf <cmetcalf@tilera.com>
Cc: Dave Anderson <anderson@redhat.com>
Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2013-04-29 15:54:33 -07:00
Marek Szyprowski
e9da6e9905 ARM: dma-mapping: remove custom consistent dma region 
This patch changes dma-mapping subsystem to use generic vmalloc areas
for all consistent dma allocations. This increases the total size limit
of the consistent allocations and removes platform hacks and a lot of
duplicated code.

Atomic allocations are served from special pool preallocated on boot,
because vmalloc areas cannot be reliably created in atomic context.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Kyungmin Park <kyungmin.park@samsung.com>
Reviewed-by: Minchan Kim <minchan@kernel.org>
 2012-07-30 12:25:45 +02:00
Marek Szyprowski
5e6cafc83e mm: vmalloc: use const void * for caller argument 
'const void *' is a safer type for caller function type. This patch
updates all references to caller function type.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Kyungmin Park <kyungmin.park@samsung.com>
Reviewed-by: Minchan Kim <minchan@kernel.org>
 2012-07-30 12:25:44 +02:00
Russell King
73829af71f Merge branch 'vmalloc' of git://git.linaro.org/people/nico/linux into devel-stable 2011-12-05 23:27:59 +00:00
Nicolas Pitre
be9b7335e7 mm: add vm_area_add_early() 
The existing vm_area_register_early() allows for early vmalloc space
allocation.  However upcoming cleanups in the ARM architecture require
that some fixed locations in the vmalloc area be reserved also very early.

The name "vm_area_register_early" would have been a good name for the
reservation part without the allocation.  Since it is already in use with
different semantics, let's create vm_area_add_early() instead.

Both vm_area_register_early() and vm_area_add_early() can be used together
meaning that the former is now implemented using the later where it is
ensured that no conflicting areas are added, but no attempt is made to
make the allocation scheme in vm_area_register_early() more sophisticated.
After all, you must know what you're doing when using those functions.

Signed-off-by: Nicolas Pitre <nicolas.pitre@linaro.org>
Acked-by: Andrew Morton <akpm@linux-foundation.org>
Cc: linux-mm@kvack.org
 2011-11-18 13:51:22 -05:00
David Vrabel
cd12909cb5 xen: map foreign pages for shared rings by updating the PTEs directly 
When mapping a foreign page with xenbus_map_ring_valloc() with the
GNTTABOP_map_grant_ref hypercall, set the GNTMAP_contains_pte flag and
pass a pointer to the PTE (in init_mm).

After the page is mapped, the usual fault mechanism can be used to
update additional MMs.  This allows the vmalloc_sync_all() to be
removed from alloc_vm_area().

Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Acked-by: Andrew Morton <akpm@linux-foundation.org>
[v1: Squashed fix by Michal for no-mmu case]
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Michal Simek <monstr@monstr.eu>
 2011-11-16 12:13:08 -05:00
Mitsuo Hayasaka
f5252e009d mm: avoid null pointer access in vm_struct via /proc/vmallocinfo 
The /proc/vmallocinfo shows information about vmalloc allocations in
vmlist that is a linklist of vm_struct.  It, however, may access pages
field of vm_struct where a page was not allocated.  This results in a null
pointer access and leads to a kernel panic.

Why this happens: In __vmalloc_node_range() called from vmalloc(), newly
allocated vm_struct is added to vmlist at __get_vm_area_node() and then,
some fields of vm_struct such as nr_pages and pages are set at
__vmalloc_area_node().  In other words, it is added to vmlist before it is
fully initialized.  At the same time, when the /proc/vmallocinfo is read,
it accesses the pages field of vm_struct according to the nr_pages field
at show_numa_info().  Thus, a null pointer access happens.

The patch adds the newly allocated vm_struct to the vmlist *after* it is
fully initialized.  So, it can avoid accessing the pages field with
unallocated page when show_numa_info() is called.

Signed-off-by: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Namhyung Kim <namhyung@gmail.com>
Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
Cc: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Cc: <stable@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2011-10-31 17:30:47 -07:00
Graf Yang
b554cb426a NOMMU: support SMP dynamic percpu_alloc 
The percpu code requires more functions to be implemented in the mm core
which nommu currently does not provide.  So add inline implementations
since these are largely meaningless on nommu systems.

Signed-off-by: Graf Yang <graf.yang@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Greg Ungerer <gerg@uclinux.org>
 2011-03-28 12:53:29 +01:00
David Rientjes
d0a21265df mm: unify module_alloc code for vmalloc 
Four architectures (arm, mips, sparc, x86) use __vmalloc_area() for
module_init().  Much of the code is duplicated and can be generalized in a
globally accessible function, __vmalloc_node_range().

__vmalloc_node() now calls into __vmalloc_node_range() with a range of
[VMALLOC_START, VMALLOC_END) for functionally equivalent behavior.

Each architecture may then use __vmalloc_node_range() directly to remove
the duplication of code.

Signed-off-by: David Rientjes <rientjes@google.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Russell King <linux@arm.linux.org.uk>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2011-01-13 17:32:34 -08:00
David Rientjes
ec3f64fc9c mm: remove gfp mask from pcpu_get_vm_areas 
pcpu_get_vm_areas() only uses GFP_KERNEL allocations, so remove the gfp_t
formal and use the mask internally.

Signed-off-by: David Rientjes <rientjes@google.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2011-01-13 17:32:34 -08:00
David Rientjes
e5a5623b28 mm: remove unused get_vm_area_node 
get_vm_area_node() is unused in the kernel and can thus be removed.

Signed-off-by: David Rientjes <rientjes@google.com>
Cc: Christoph Lameter <cl@linux.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2011-01-13 17:32:34 -08:00
Jeremy Fitzhardinge
64141da587 vmalloc: eagerly clear ptes on vunmap 
On stock 2.6.37-rc4, running:

  # mount lilith:/export /mnt/lilith
  # find  /mnt/lilith/ -type f -print0 | xargs -0 file

crashes the machine fairly quickly under Xen.  Often it results in oops
messages, but the couple of times I tried just now, it just hung quietly
and made Xen print some rude messages:

    (XEN) mm.c:2389:d80 Bad type (saw 7400000000000001 != exp
    3000000000000000) for mfn 1d7058 (pfn 18fa7)
    (XEN) mm.c:964:d80 Attempt to create linear p.t. with write perms
    (XEN) mm.c:2389:d80 Bad type (saw 7400000000000010 != exp
    1000000000000000) for mfn 1d2e04 (pfn 1d1fb)
    (XEN) mm.c:2965:d80 Error while pinning mfn 1d2e04

Which means the domain tried to map a pagetable page RW, which would
allow it to map arbitrary memory, so Xen stopped it.  This is because
vm_unmap_ram() left some pages mapped in the vmalloc area after NFS had
finished with them, and those pages got recycled as pagetable pages
while still having these RW aliases.

Removing those mappings immediately removes the Xen-visible aliases, and
so it has no problem with those pages being reused as pagetable pages.
Deferring the TLB flush doesn't upset Xen because it can flush the TLB
itself as needed to maintain its invariants.

When unmapping a region in the vmalloc space, clear the ptes
immediately.  There's no point in deferring this because there's no
amortization benefit.

The TLBs are left dirty, and they are flushed lazily to amortize the
cost of the IPIs.

This specific motivation for this patch is an oops-causing regression
since 2.6.36 when using NFS under Xen, triggered by the NFS client's use
of vm_map_ram() introduced in 56e4ebf877 ("NFS: readdir with vmapped
pages") .  XFS also uses vm_map_ram() and could cause similar problems.

Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Cc: Nick Piggin <npiggin@kernel.dk>
Cc: Bryan Schumaker <bjschuma@netapp.com>
Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: Alex Elder <aelder@sgi.com>
Cc: Dave Chinner <david@fromorbit.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2010-12-02 14:51:15 -08:00
Dave Young
e1ca7788de mm: add vzalloc() and vzalloc_node() helpers 
Add vzalloc() and vzalloc_node() to encapsulate the
vmalloc-then-memset-zero operation.

Use __GFP_ZERO to zero fill the allocated memory.

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Cc: Christoph Lameter <cl@linux-foundation.org>
Acked-by: Greg Ungerer <gerg@snapgear.com>
Cc: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2010-10-26 16:52:10 -07:00
Tejun Heo
4f8b02b4e5 vmalloc: pcpu_get/free_vm_areas() aren't needed on UP 
These functions are used only by percpu memory allocator on SMP.
Don't build them on UP.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Nick Piggin <npiggin@kernel.dk>
Reviewed-by: Chrsitoph Lameter <cl@linux.com>
 2010-09-08 11:10:47 +02:00
Linus Torvalds
26f0cf9181 Merge branch 'stable/xen-swiotlb-0.8.6' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen 
* 'stable/xen-swiotlb-0.8.6' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  x86: Detect whether we should use Xen SWIOTLB.
  pci-swiotlb-xen: Add glue code to setup dma_ops utilizing xen_swiotlb_* functions.
  swiotlb-xen: SWIOTLB library for Xen PV guest with PCI passthrough.
  xen/mmu: inhibit vmap aliases rather than trying to clear them out
  vmap: add flag to allow lazy unmap to be disabled at runtime
  xen: Add xen_create_contiguous_region
  xen: Rename the balloon lock
  xen: Allow unprivileged Xen domains to create iomap pages
  xen: use _PAGE_IOMAP in ioremap to do machine mappings

Fix up trivial conflicts (adding both xen swiotlb and xen pci platform
driver setup close to each other) in drivers/xen/{Kconfig,Makefile} and
include/xen/xen-ops.h
 2010-08-12 09:09:41 -07:00
Jeremy Fitzhardinge
a0d40c8025 vmap: add flag to allow lazy unmap to be disabled at runtime 
Add a flag to force lazy_max_pages() to zero to prevent any outstanding
mapped pages.  We'll need this for Xen.

Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Nick Piggin <npiggin@suse.de>
 2010-07-27 11:49:09 -04:00
Kenji Kaneshige
ffa71f33a8 x86, ioremap: Fix incorrect physical address handling in PAE mode 
Current x86 ioremap() doesn't handle physical address higher than
32-bit properly in X86_32 PAE mode. When physical address higher than
32-bit is passed to ioremap(), higher 32-bits in physical address is
cleared wrongly. Due to this bug, ioremap() can map wrong address to
linear address space.

In my case, 64-bit MMIO region was assigned to a PCI device (ioat
device) on my system. Because of the ioremap()'s bug, wrong physical
address (instead of MMIO region) was mapped to linear address space.
Because of this, loading ioatdma driver caused unexpected behavior
(kernel panic, kernel hangup, ...).

Signed-off-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
LKML-Reference: <4C1AE680.7090408@jp.fujitsu.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
 2010-07-09 11:42:03 -07:00
Tejun Heo
ca23e405e0 vmalloc: implement pcpu_get_vm_areas() 
To directly use spread NUMA memories for percpu units, percpu
allocator will be updated to allow sparsely mapping units in a chunk.
As the distances between units can be very large, this makes
allocating single vmap area for each chunk undesirable.  This patch
implements pcpu_get_vm_areas() and pcpu_free_vm_areas() which
allocates and frees sparse congruent vmap areas.

pcpu_get_vm_areas() take @offsets and @sizes array which define
distances and sizes of vmap areas.  It scans down from the top of
vmalloc area looking for the top-most address which can accomodate all
the areas.  The top-down scan is to avoid interacting with regular
vmallocs which can push up these congruent areas up little by little
ending up wasting address space and page table.

To speed up top-down scan, the highest possible address hint is
maintained.  Although the scan is linear from the hint, given the
usual large holes between memory addresses between NUMA nodes, the
scanning is highly likely to finish after finding the first hole for
the last unit which is scanned first.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Nick Piggin <npiggin@suse.de>
 2009-08-14 15:00:52 +09:00
Ingo Molnar
0edcf8d692 Merge branch 'tj-percpu' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/misc into core/percpu 
Conflicts:
	arch/x86/include/asm/pgtable.h
 2009-02-24 21:52:45 +01:00
Tejun Heo
c0c0a29379 vmalloc: add @align to vm_area_register_early() 
Impact: allow larger alignment for early vmalloc area allocation

Some early vmalloc users might want larger alignment, for example, for
custom large page mapping.  Add @align to vm_area_register_early().
While at it, drop docbook comment on non-existent @size.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Nick Piggin <nickpiggin@yahoo.com.au>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
 2009-02-24 11:57:21 +09:00
Tejun Heo
8fc4898500 vmalloc: add un/map_kernel_range_noflush() 
Impact: two more public map/unmap functions

Implement map_kernel_range_noflush() and unmap_kernel_range_noflush().
These functions respectively map and unmap address range in kernel VM
area but doesn't do any vcache or tlb flushing.  These will be used by
new percpu allocator.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Nick Piggin <nickpiggin@yahoo.com.au>
 2009-02-20 16:29:08 +09:00
Tejun Heo
f0aa661790 vmalloc: implement vm_area_register_early() 
Impact: allow multiple early vm areas

There are places where kernel VM area needs to be allocated before
vmalloc is initialized.  This is done by allocating static vm_struct,
initializing several fields and linking it to vmlist and later vmalloc
initialization picking up these from vmlist.  This is currently done
manually and if there's more than one such areas, there's no defined
way to arbitrate who gets which address.

This patch implements vm_area_register_early(), which takes vm_area
struct with flags and size initialized, assigns address to it and puts
it on the vmlist.  This way, multiple early vm areas can determine
which addresses they should use.  The only current user - alpha mm
init - is converted to use it.

Signed-off-by: Tejun Heo <tj@kernel.org>
 2009-02-20 16:29:08 +09:00