1787 Commits

Author SHA1 Message Date
Matsvei Niaverau
c8c286e8e9 Merge branch 'android-4.14-stable' into lineage-20 2023-11-16 12:48:55 +01:00
Greg Kroah-Hartman
d764c607e6 Merge 4.14.314 into android-4.14-stable
Changes in 4.14.314
	ARM: dts: rockchip: fix a typo error for rk3288 spdif node
	net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg
	virtio_net: bugfix overflow inside xdp_linearize_page()
	i40e: fix accessing vsi->active_filters without holding lock
	i40e: fix i40e_setup_misc_vector() error handling
	mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next()
	e1000e: Disable TSO on i219-LM card to increase speed
	f2fs: Fix f2fs_truncate_partial_nodes ftrace event
	selftests: sigaltstack: fix -Wuninitialized
	scsi: megaraid_sas: Fix fw_crash_buffer_show()
	scsi: core: Improve scsi_vpd_inquiry() checks
	net: dsa: b53: mmap: add phy ops
	s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling
	xen/netback: use same error messages for same errors
	nilfs2: initialize unused bytes in segment summary blocks
	memstick: fix memory leak if card device is never registered
	x86/purgatory: Don't generate debug info for purgatory.ro
	Revert "ext4: fix use-after-free in ext4_xattr_set_entry"
	ext4: remove duplicate definition of ext4_xattr_ibody_inline_set()
	ext4: fix use-after-free in ext4_xattr_set_entry
	udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM).
	tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
	inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().
	dccp: Call inet6_destroy_sock() via sk->sk_destruct().
	sctp: Call inet6_destroy_sock() via sk->sk_destruct().
	counter: 104-quad-8: Fix race condition between FLAG and CNTR reads
	iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger()
	ASN.1: Fix check for strdup() success
	Linux 4.14.314

Change-Id: I8793bc8329f8c8b927a91686eaa4fa6bb556c3f1
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-04-26 13:06:46 +00:00
Douglas Raillard
fc4c7404ae f2fs: Fix f2fs_truncate_partial_nodes ftrace event
[ Upstream commit 0b04d4c0542e8573a837b1d81b94209e48723b25 ]

Fix the nid_t field so that its size is correctly reported in the text
format embedded in trace.dat files. As it stands, it is reported as
being of size 4:

        field:nid_t nid[3];     offset:24;      size:4; signed:0;

Instead of 12:

        field:nid_t nid[3];     offset:24;      size:12;        signed:0;

This also fixes the reported offset of subsequent fields so that they
match with the actual struct layout.

Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
Reviewed-by: Mukesh Ojha <quic_mojha@quicinc.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-26 11:18:56 +02:00
Greg Kroah-Hartman
334b33732c Merge 4.14.291 into android-4.14-stable
Changes in 4.14.291
        Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
        ntfs: fix use-after-free in ntfs_ucsncmp()
        s390/archrandom: prevent CPACF trng invocations in interrupt context
        scsi: ufs: host: Hold reference returned by of_parse_phandle()
        net: ping6: Fix memleak in ipv6_renew_options().
        net: sungem_phy: Add of_node_put() for reference returned by of_get_parent()
        netfilter: nf_queue: do not allow packet truncation below transport header offset
        ARM: crypto: comment out gcc warning that breaks clang builds
        mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle.
        ACPI: video: Force backlight native for some TongFang devices
        ACPI: video: Shortening quirk list by identifying Clevo by board_name only
        macintosh/adb: fix oob read in do_adb_query() function
        Makefile: link with -z noexecstack --no-warn-rwx-segments
        x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments
        ALSA: bcd2000: Fix a UAF bug on the error path of probing
        add barriers to buffer_uptodate and set_buffer_uptodate
        HID: wacom: Don't register pad_input for touch switch
        KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
        KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks
        KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP
        ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model
        ALSA: hda/cirrus - support for iMac 12,1 model
        vfs: Check the truncate maximum size in inode_newsize_ok()
        fs: Add missing umask strip in vfs_tmpfile
        usbnet: Fix linkwatch use-after-free on disconnect
        parisc: Fix device names in /proc/iomem
        drm/nouveau: fix another off-by-one in nvbios_addr
        drm/amdgpu: Check BO's requested pinning domains against its preferred_domains
        iio: light: isl29028: Fix the warning in isl29028_remove()
        fuse: limit nsec
        md-raid10: fix KASAN warning
        ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr()
        PCI: Add defines for normal and subtractive PCI bridges
        powerpc/fsl-pci: Fix Class Code of PCIe Root Port
        powerpc/powernv: Avoid crashing if rng is NULL
        MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
        USB: HCD: Fix URB giveback issue in tasklet function
        netfilter: nf_tables: fix null deref due to zeroed list head
        arm64: Do not forget syscall when starting a new thread.
        arm64: fix oops in concurrently setting insn_emulation sysctls
        ext2: Add more validity checks for inode counts
        ARM: dts: imx6ul: add missing properties for sram
        ARM: dts: imx6ul: fix qspi node compatible
        ARM: OMAP2+: display: Fix refcount leak bug
        ACPI: PM: save NVS memory for Lenovo G40-45
        ACPI: LPSS: Fix missing check in register_device_clock()
        PM: hibernate: defer device probing when resuming from hibernation
        selinux: Add boundary check in put_entry()
        ARM: findbit: fix overflowing offset
        ARM: bcm: Fix refcount leak in bcm_kona_smc_init
        x86/pmem: Fix platform-device leak in error path
        ARM: dts: ast2500-evb: fix board compatible
        soc: fsl: guts: machine variable might be unset
        cpufreq: zynq: Fix refcount leak in zynq_get_revision
        ARM: dts: qcom: pm8841: add required thermal-sensor-cells
        arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node
        regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
        thermal/tools/tmon: Include pthread and time headers in tmon.h
        dm: return early from dm_pr_call() if DM device is suspended
        drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
        drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function
        i2c: Fix a potential use after free
        ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
        wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd()
        drm: bridge: adv7511: Add check for mipi_dsi_driver_register
        media: hdpvr: fix error value returns in hdpvr_read
        drm/vc4: dsi: Correct DSI divider calculations
        drm/rockchip: vop: Don't crash for invalid duplicate_state()
        drm/mediatek: dpi: Remove output format of YUV
        drm: bridge: sii8620: fix possible off-by-one
        media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment
        tcp: make retransmitted SKB fit into the send window
        selftests: timers: valid-adjtimex: build fix for newer toolchains
        selftests: timers: clocksource-switch: fix passing errors from child
        fs: check FMODE_LSEEK to control internal pipe splicing
        wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()
        wifi: p54: Fix an error handling path in p54spi_probe()
        wifi: p54: add missing parentheses in p54_flush()
        can: pch_can: do not report txerr and rxerr during bus-off
        can: rcar_can: do not report txerr and rxerr during bus-off
        can: sja1000: do not report txerr and rxerr during bus-off
        can: hi311x: do not report txerr and rxerr during bus-off
        can: sun4i_can: do not report txerr and rxerr during bus-off
        can: usb_8dev: do not report txerr and rxerr during bus-off
        can: error: specify the values of data[5..7] of CAN error frames
        can: pch_can: pch_can_error(): initialize errc before using it
        Bluetooth: hci_intel: Add check for platform_driver_register
        i2c: cadence: Support PEC for SMBus block read
        i2c: mux-gpmux: Add of_node_put() when breaking out of loop
        wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()`
        wifi: libertas: Fix possible refcount leak in if_usb_probe()
        net: rose: fix netdev reference changes
        dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock
        mtd: maps: Fix refcount leak in of_flash_probe_versatile
        mtd: maps: Fix refcount leak in ap_flash_init
        mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release
        mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path
        fpga: altera-pr-ip: fix unsigned comparison with less than zero
        usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe
        usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe
        misc: rtsx: Fix an error handling path in rtsx_pci_probe()
        mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch
        memstick/ms_block: Fix some incorrect memory allocation
        memstick/ms_block: Fix a memory leak
        mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R
        scsi: smartpqi: Fix DMA direction for RAID requests
        usb: gadget: udc: amd5536 depends on HAS_DMA
        RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
        gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()
        mmc: cavium-octeon: Add of_node_put() when breaking out of loop
        mmc: cavium-thunderx: Add of_node_put() when breaking out of loop
        USB: serial: fix tty-port initialized comments
        platform/olpc: Fix uninitialized data in debugfs write
        mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region
        RDMA/rxe: Fix error unwind in rxe_create_qp()
        ext4: recover csum seed of tmp_inode after migrating to extents
        jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
        ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe
        ASoC: codecs: da7210: add check for i2c_add_driver
        ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe
        profiling: fix shift too large makes kernel panic
        tty: n_gsm: fix non flow control frames during mux flow off
        tty: n_gsm: fix packet re-transmission without open control channel
        tty: n_gsm: fix race condition in gsmld_write()
        remoteproc: qcom: wcnss: Fix handling of IRQs
        vfio/ccw: Do not change FSM state in subchannel event
        tty: n_gsm: fix wrong T1 retry count handling
        tty: n_gsm: fix DM command
        iommu/exynos: Handle failed IOMMU device registration properly
        kfifo: fix kfifo_to_user() return type
        mfd: t7l66xb: Drop platform disable callback
        iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop
        s390/zcore: fix race when reading from hardware system area
        video: fbdev: amba-clcd: Fix refcount leak bugs
        video: fbdev: sis: fix typos in SiS_GetModeID()
        powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias
        powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader
        powerpc/xive: Fix refcount leak in xive_get_max_prio
        powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address
        kprobes: Forbid probing on trampoline and BPF code areas
        powerpc/pci: Fix PHB numbering when using opal-phbid
        genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO
        x86/numa: Use cpumask_available instead of hardcoded NULL check
        video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock()
        tools/thermal: Fix possible path truncations
        video: fbdev: vt8623fb: Check the size of screen before memset_io()
        video: fbdev: arkfb: Check the size of screen before memset_io()
        video: fbdev: s3fb: Check the size of screen before memset_io()
        scsi: zfcp: Fix missing auto port scan and thus missing target ports
        x86/olpc: fix 'logical not is only applied to the left hand side'
        spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
        ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
        ext4: make sure ext4_append() always allocates new block
        ext4: fix use-after-free in ext4_xattr_set_entry
        ext4: update s_overhead_clusters in the superblock during an on-line resize
        ext4: fix extent status tree race in writeback error recovery path
        ext4: correct max_inline_xattr_value_size computing
        ext4: correct the misjudgment in ext4_iget_extra_inode
        intel_th: pci: Add Raptor Lake-S CPU support
        intel_th: pci: Add Raptor Lake-S PCH support
        intel_th: pci: Add Meteor Lake-P support
        dm raid: fix address sanitizer warning in raid_resume
        dm raid: fix address sanitizer warning in raid_status
        net_sched: cls_route: remove from list when handle is 0
        btrfs: reject log replay if there is unsupported RO compat flag
        KVM: Add infrastructure and macro to mark VM as bugged
        KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq
        KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast()
        tcp: fix over estimation in sk_forced_mem_schedule()
        scsi: sg: Allow waiting for commands to complete on removed device
        Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP"
        Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
        net/9p: Initialize the iounit field during fid creation
        net_sched: cls_route: disallow handle of 0
        powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E
        ALSA: info: Fix llseek return value when using callback
        rds: add missing barrier to release_refill
        ata: libata-eh: Add missing command name
        btrfs: fix lost error handling when looking up extended ref on log replay
        can: ems_usb: fix clang's -Wunaligned-access warning
        apparmor: fix quiet_denied for file rules
        apparmor: Fix failed mount permission check error message
        apparmor: fix aa_label_asxprint return check
        apparmor: fix reference count leak in aa_pivotroot()
        NFSv4: Fix races in the legacy idmapper upcall
        NFSv4.1: RECLAIM_COMPLETE must handle EACCES
        SUNRPC: Reinitialise the backchannel request buffers before reuse
        pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map
        pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed
        ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool
        geneve: do not use RT_TOS for IPv6 flowlabel
        vsock: Fix memory leak in vsock_connect()
        vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout()
        tools build: Switch to new openssl API for test-libcrypto
        xen/xenbus: fix return type in xenbus_file_read()
        atm: idt77252: fix use-after-free bugs caused by tst_timer
        nios2: page fault et.al. are *not* restartable syscalls...
        nios2: don't leave NULLs in sys_call_table[]
        nios2: traced syscall does need to check the syscall number
        nios2: fix syscall restart checks
        nios2: restarts apply only to the first sigframe we build...
        nios2: add force_successful_syscall_return()
        netfilter: nf_tables: really skip inactive sets when allocating name
        powerpc/pci: Fix get_phb_number() locking
        i40e: Fix to stop tx_timeout recovery if GLOBR fails
        fec: Fix timer capture timing in `fec_ptp_enable_pps()`
        igb: Add lock to avoid data race
        kbuild: clear LDFLAGS in the top Makefile
        btrfs: only write the sectors in the vertical stripe which has data stripes
        btrfs: raid56: don't trust any cached sector in __raid56_parity_recover()
        drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors()
        PCI: Add ACS quirk for Broadcom BCM5750x NICs
        irqchip/tegra: Fix overflow implicit truncation warnings
        usb: host: ohci-ppc-of: Fix refcount leak bug
        clk: qcom: ipq8074: dont disable gcc_sleep_clk_src
        gadgetfs: ep_io - wait until IRQ finishes
        cxl: Fix a memory leak in an error handling path
        drivers:md:fix a potential use-after-free bug
        ext4: avoid remove directory when directory is corrupted
        ext4: avoid resizing to a partial cluster size
        tty: serial: Fix refcount leak bug in ucc_uart.c
        vfio: Clear the caps->buf to NULL after free
        mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start
        ALSA: core: Add async signal helpers
        ALSA: timer: Use deferred fasync helper
        smb3: check xattr value length earlier
        powerpc/64: Init jump labels before parse_early_param()
        video: fbdev: i740fb: Check the argument of i740_calc_vclk()
        MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0
        Linux 4.14.291

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I05ae298bdce8b81c6613d845a84158d74bb3cd8f
2022-09-06 16:59:10 +02:00
David Collins
dc6033a776 spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
commit 2af28b241eea816e6f7668d1954f15894b45d7e3 upstream.

trace_spmi_write_begin() and trace_spmi_read_end() both call
memcpy() with a length of "len + 1".  This leads to one extra
byte being read beyond the end of the specified buffer.  Fix
this out-of-bound memory access by using a length of "len"
instead.

Here is a KASAN log showing the issue:

BUG: KASAN: stack-out-of-bounds in trace_event_raw_event_spmi_read_end+0x1d0/0x234
Read of size 2 at addr ffffffc0265b7540 by task thermal@2.0-ser/1314
...
Call trace:
 dump_backtrace+0x0/0x3e8
 show_stack+0x2c/0x3c
 dump_stack_lvl+0xdc/0x11c
 print_address_description+0x74/0x384
 kasan_report+0x188/0x268
 kasan_check_range+0x270/0x2b0
 memcpy+0x90/0xe8
 trace_event_raw_event_spmi_read_end+0x1d0/0x234
 spmi_read_cmd+0x294/0x3ac
 spmi_ext_register_readl+0x84/0x9c
 regmap_spmi_ext_read+0x144/0x1b0 [regmap_spmi]
 _regmap_raw_read+0x40c/0x754
 regmap_raw_read+0x3a0/0x514
 regmap_bulk_read+0x418/0x494
 adc5_gen3_poll_wait_hs+0xe8/0x1e0 [qcom_spmi_adc5_gen3]
 ...
 __arm64_sys_read+0x4c/0x60
 invoke_syscall+0x80/0x218
 el0_svc_common+0xec/0x1c8
 ...

addr ffffffc0265b7540 is located in stack of task thermal@2.0-ser/1314 at offset 32 in frame:
 adc5_gen3_poll_wait_hs+0x0/0x1e0 [qcom_spmi_adc5_gen3]

this frame has 1 object:
 [32, 33) 'status'

Memory state around the buggy address:
 ffffffc0265b7400: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
 ffffffc0265b7480: 04 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffc0265b7500: 00 00 00 00 f1 f1 f1 f1 01 f3 f3 f3 00 00 00 00
                                           ^
 ffffffc0265b7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffc0265b7600: f1 f1 f1 f1 01 f2 07 f2 f2 f2 01 f3 00 00 00 00
==================================================================

Fixes: a9fce37481 ("spmi: add command tracepoints for SPMI")
Cc: stable@vger.kernel.org
Reviewed-by: Stephen Boyd <sboyd@kernel.org>
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: David Collins <quic_collinsd@quicinc.com>
Link: https://lore.kernel.org/r/20220627235512.2272783-1-quic_collinsd@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-25 11:11:27 +02:00
Greg Kroah-Hartman
73f6c0fdd9 Merge 4.14.289 into android-4.14-stable
Changes in 4.14.289
	ALSA: hda - Add fixup for Dell Latitidue E5430
	ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model
	xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue
	net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale pointer
	ARM: 9213/1: Print message about disabled Spectre workarounds only once
	ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction
	cgroup: Use separate src/dst nodes when preloading css_sets for migration
	nilfs2: fix incorrect masking of permission flags for symlinks
	net: dsa: bcm_sf2: force pause link settings
	xhci: bail out early if driver can't accress host in resume
	xhci: make xhci_handshake timeout for xhci_reset() adjustable
	ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle
	inetpeer: Fix data-races around sysctl.
	net: Fix data-races around sysctl_mem.
	cipso: Fix data-races around sysctl.
	icmp: Fix data-races around sysctl.
	ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero
	icmp: Fix a data-race around sysctl_icmp_ratelimit.
	icmp: Fix a data-race around sysctl_icmp_ratemask.
	ipv4: Fix data-races around sysctl_ip_dynaddr.
	sfc: fix use after free when disabling sriov
	seg6: fix skb checksum evaluation in SRH encapsulation/insertion
	seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors
	sfc: fix kernel panic when creating VF
	virtio_mmio: Add missing PM calls to freeze/restore
	virtio_mmio: Restore guest page size on resume
	netfilter: br_netfilter: do not skip all hooks with 0 priority
	cpufreq: pmac32-cpufreq: Fix refcount leak bug
	platform/x86: hp-wmi: Ignore Sanitization Mode event
	net: tipc: fix possible refcount leak in tipc_sk_create()
	NFC: nxp-nci: don't print header length mismatch on i2c error
	net: sfp: fix memory leak in sfp_probe()
	ASoC: ops: Fix off by one in range control validation
	ASoC: wm5110: Fix DRE control
	irqchip: or1k-pic: Undefine mask_ack for level triggered hardware
	x86: Clear .brk area at early boot
	signal handling: don't use BUG_ON() for debugging
	USB: serial: ftdi_sio: add Belimo device ids
	usb: dwc3: gadget: Fix event pending check
	tty: serial: samsung_tty: set dma burst_size to 1
	serial: 8250: fix return error code in serial8250_request_std_resource()
	mm: invalidate hwpoison page cache page in fault path
	can: m_can: m_can_tx_handler(): fix use after free of skb
	Linux 4.14.289

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I1e9b12a81151982c15f4a71b01aff2f1ad2eb7e5
2022-07-21 21:55:35 +02:00
Steven Rostedt (Google)
98d0dcf81a net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale pointer
commit 820b8963adaea34a87abbecb906d1f54c0aabfb7 upstream.

The trace event sock_exceed_buf_limit saves the prot->sysctl_mem pointer
and then dereferences it in the TP_printk() portion. This is unsafe as the
TP_printk() portion is executed at the time the buffer is read. That is,
it can be seconds, minutes, days, months, even years later. If the proto
is freed, then this dereference will can also lead to a kernel crash.

Instead, save the sysctl_mem array into the ring buffer and have the
TP_printk() reference that instead. This is the proper and safe way to
read pointers in trace events.

Link: https://lore.kernel.org/all/20220706052130.16368-12-kuniyu@amazon.com/

Cc: stable@vger.kernel.org
Fixes: 3847ce32ae ("core: add tracepoints for queueing skb to rcvbuf")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Acked-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-21 20:42:43 +02:00
Greg Kroah-Hartman
e1c62d43d5 Merge 4.14.286 into android-4.14-stable
Changes in 4.14.286
	vt: drop old FONT ioctls
	random: schedule mix_interrupt_randomness() less often
	ata: libata: add qc->flags in ata_qc_complete_template tracepoint
	dm era: commit metadata in postsuspend after worker stops
	random: quiet urandom warning ratelimit suppression message
	USB: serial: option: add Telit LE910Cx 0x1250 composition
	USB: serial: option: add Quectel EM05-G modem
	USB: serial: option: add Quectel RM500K module support
	bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers
	x86/xen: Remove undefined behavior in setup_features()
	MIPS: Remove repetitive increase irq_err_count
	igb: Make DMA faster when CPU is active on the PCIe link
	iio: adc: vf610: fix conversion mode sysfs node name
	usb: chipidea: udc: check request status before setting device address
	iio:accel:bma180: rearrange iio trigger get and register
	iio: accel: mma8452: ignore the return value of reset operation
	iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up()
	iio: trigger: sysfs: fix use-after-free on remove
	iio: adc: axp288: Override TS pin bias current for some models
	xtensa: xtfpga: Fix refcount leak bug in setup
	xtensa: Fix refcount leak bug in time.c
	powerpc: Enable execve syscall exit tracepoint
	powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address
	powerpc/powernv: wire up rng during setup_arch
	ARM: dts: imx6qdl: correct PU regulator ramp delay
	ARM: exynos: Fix refcount leak in exynos_map_pmu
	ARM: Fix refcount leak in axxia_boot_secondary
	ARM: cns3xxx: Fix refcount leak in cns3xxx_init
	modpost: fix section mismatch check for exported init/exit sections
	powerpc/pseries: wire up rng during setup_arch()
	drm: remove drm_fb_helper_modinit
	xen: unexport __init-annotated xen_xlate_map_ballooned_pages()
	fdt: Update CRC check for rng-seed
	kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]
	swiotlb: skip swiotlb_bounce when orig_addr is zero
	Linux 4.14.286

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ice28ce89388a656c20f3cc1f917c66d45466421a
2022-07-03 10:10:36 +02:00
Edward Wu
42c75fc81f ata: libata: add qc->flags in ata_qc_complete_template tracepoint
commit 540a92bfe6dab7310b9df2e488ba247d784d0163 upstream.

Add flags value to check the result of ata completion

Fixes: 255c03d15a ("libata: Add tracepoints")
Cc: stable@vger.kernel.org
Signed-off-by: Edward Wu <edwardwu@realtek.com>
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-02 16:18:08 +02:00
Eric Biggers
d73f58abbf Merge 4.14.285 into android-4.14-stable
Changes in 4.14.285
	9p: missing chunk of "fs/9p: Don't update file type when updating file attributes"
	crypto: chacha20 - Fix keystream alignment for chacha20_block()
	random: always fill buffer in get_random_bytes_wait
	random: optimize add_interrupt_randomness
	drivers/char/random.c: remove unused dont_count_entropy
	random: Fix whitespace pre random-bytes work
	random: Return nbytes filled from hw RNG
	random: add a config option to trust the CPU's hwrng
	random: remove preempt disabled region
	random: Make crng state queryable
	random: make CPU trust a boot parameter
	drivers/char/random.c: constify poolinfo_table
	drivers/char/random.c: remove unused stuct poolinfo::poolbits
	drivers/char/random.c: make primary_crng static
	random: only read from /dev/random after its pool has received 128 bits
	random: move rand_initialize() earlier
	random: document get_random_int() family
	latent_entropy: avoid build error when plugin cflags are not set
	random: fix soft lockup when trying to read from an uninitialized blocking pool
	random: Support freezable kthreads in add_hwgenerator_randomness()
	fdt: add support for rng-seed
	random: Use wait_event_freezable() in add_hwgenerator_randomness()
	char/random: Add a newline at the end of the file
	Revert "hwrng: core - Freeze khwrng thread during suspend"
	crypto: Deduplicate le32_to_cpu_array() and cpu_to_le32_array()
	crypto: blake2s - generic C library implementation and selftest
	lib/crypto: blake2s: move hmac construction into wireguard
	lib/crypto: sha1: re-roll loops to reduce code size
	random: Don't wake crng_init_wait when crng_init == 1
	random: Add a urandom_read_nowait() for random APIs that don't warn
	random: add GRND_INSECURE to return best-effort non-cryptographic bytes
	random: ignore GRND_RANDOM in getentropy(2)
	random: make /dev/random be almost like /dev/urandom
	char/random: silence a lockdep splat with printk()
	random: fix crash on multiple early calls to add_bootloader_randomness()
	random: remove the blocking pool
	random: delete code to pull data into pools
	random: remove kernel.random.read_wakeup_threshold
	random: remove unnecessary unlikely()
	random: convert to ENTROPY_BITS for better code readability
	random: Add and use pr_fmt()
	random: fix typo in add_timer_randomness()
	random: remove some dead code of poolinfo
	random: split primary/secondary crng init paths
	random: avoid warnings for !CONFIG_NUMA builds
	x86: Remove arch_has_random, arch_has_random_seed
	powerpc: Remove arch_has_random, arch_has_random_seed
	s390: Remove arch_has_random, arch_has_random_seed
	linux/random.h: Remove arch_has_random, arch_has_random_seed
	linux/random.h: Use false with bool
	linux/random.h: Mark CONFIG_ARCH_RANDOM functions __must_check
	powerpc: Use bool in archrandom.h
	random: add arch_get_random_*long_early()
	random: avoid arch_get_random_seed_long() when collecting IRQ randomness
	random: remove dead code left over from blocking pool
	MAINTAINERS: co-maintain random.c
	crypto: blake2s - include <linux/bug.h> instead of <asm/bug.h>
	crypto: blake2s - adjust include guard naming
	random: document add_hwgenerator_randomness() with other input functions
	random: remove unused irq_flags argument from add_interrupt_randomness()
	random: use BLAKE2s instead of SHA1 in extraction
	random: do not sign extend bytes for rotation when mixing
	random: do not re-init if crng_reseed completes before primary init
	random: mix bootloader randomness into pool
	random: harmonize "crng init done" messages
	random: use IS_ENABLED(CONFIG_NUMA) instead of ifdefs
	random: initialize ChaCha20 constants with correct endianness
	random: early initialization of ChaCha constants
	random: avoid superfluous call to RDRAND in CRNG extraction
	random: don't reset crng_init_cnt on urandom_read()
	random: fix typo in comments
	random: cleanup poolinfo abstraction
	crypto: chacha20 - Fix chacha20_block() keystream alignment (again)
	random: cleanup integer types
	random: remove incomplete last_data logic
	random: remove unused extract_entropy() reserved argument
	random: try to actively add entropy rather than passively wait for it
	random: rather than entropy_store abstraction, use global
	random: remove unused OUTPUT_POOL constants
	random: de-duplicate INPUT_POOL constants
	random: prepend remaining pool constants with POOL_
	random: cleanup fractional entropy shift constants
	random: access input_pool_data directly rather than through pointer
	random: simplify arithmetic function flow in account()
	random: continually use hwgenerator randomness
	random: access primary_pool directly rather than through pointer
	random: only call crng_finalize_init() for primary_crng
	random: use computational hash for entropy extraction
	random: simplify entropy debiting
	random: use linear min-entropy accumulation crediting
	random: always wake up entropy writers after extraction
	random: make credit_entropy_bits() always safe
	random: remove use_input_pool parameter from crng_reseed()
	random: remove batched entropy locking
	random: fix locking in crng_fast_load()
	random: use RDSEED instead of RDRAND in entropy extraction
	random: inline leaves of rand_initialize()
	random: ensure early RDSEED goes through mixer on init
	random: do not xor RDRAND when writing into /dev/random
	random: absorb fast pool into input pool after fast load
	random: use hash function for crng_slow_load()
	random: remove outdated INT_MAX >> 6 check in urandom_read()
	random: zero buffer after reading entropy from userspace
	random: tie batched entropy generation to base_crng generation
	random: remove ifdef'd out interrupt bench
	random: remove unused tracepoints
	random: add proper SPDX header
	random: deobfuscate irq u32/u64 contributions
	random: introduce drain_entropy() helper to declutter crng_reseed()
	random: remove useless header comment
	random: remove whitespace and reorder includes
	random: group initialization wait functions
	random: group entropy extraction functions
	random: group entropy collection functions
	random: group userspace read/write functions
	random: group sysctl functions
	random: rewrite header introductory comment
	random: defer fast pool mixing to worker
	random: do not take pool spinlock at boot
	random: unify early init crng load accounting
	random: check for crng_init == 0 in add_device_randomness()
	random: pull add_hwgenerator_randomness() declaration into random.h
	random: clear fast pool, crng, and batches in cpuhp bring up
	random: round-robin registers as ulong, not u32
	random: only wake up writers after zap if threshold was passed
	random: cleanup UUID handling
	random: unify cycles_t and jiffies usage and types
	random: do crng pre-init loading in worker rather than irq
	random: give sysctl_random_min_urandom_seed a more sensible value
	random: don't let 644 read-only sysctls be written to
	random: replace custom notifier chain with standard one
	random: use SipHash as interrupt entropy accumulator
	random: make consistent usage of crng_ready()
	random: reseed more often immediately after booting
	random: check for signal and try earlier when generating entropy
	random: skip fast_init if hwrng provides large chunk of entropy
	random: treat bootloader trust toggle the same way as cpu trust toggle
	random: re-add removed comment about get_random_{u32,u64} reseeding
	random: mix build-time latent entropy into pool at init
	random: do not split fast init input in add_hwgenerator_randomness()
	random: do not allow user to keep crng key around on stack
	random: check for signal_pending() outside of need_resched() check
	random: check for signals every PAGE_SIZE chunk of /dev/[u]random
	random: make random_get_entropy() return an unsigned long
	random: document crng_fast_key_erasure() destination possibility
	random: fix sysctl documentation nits
	init: call time_init() before rand_initialize()
	ia64: define get_cycles macro for arch-override
	s390: define get_cycles macro for arch-override
	parisc: define get_cycles macro for arch-override
	alpha: define get_cycles macro for arch-override
	powerpc: define get_cycles macro for arch-override
	timekeeping: Add raw clock fallback for random_get_entropy()
	m68k: use fallback for random_get_entropy() instead of zero
	mips: use fallback for random_get_entropy() instead of just c0 random
	arm: use fallback for random_get_entropy() instead of zero
	nios2: use fallback for random_get_entropy() instead of zero
	x86/tsc: Use fallback for random_get_entropy() instead of zero
	um: use fallback for random_get_entropy() instead of zero
	sparc: use fallback for random_get_entropy() instead of zero
	xtensa: use fallback for random_get_entropy() instead of zero
	random: insist on random_get_entropy() existing in order to simplify
	random: do not use batches when !crng_ready()
	random: do not pretend to handle premature next security model
	random: order timer entropy functions below interrupt functions
	random: do not use input pool from hard IRQs
	random: help compiler out with fast_mix() by using simpler arguments
	siphash: use one source of truth for siphash permutations
	random: use symbolic constants for crng_init states
	random: avoid initializing twice in credit race
	random: remove ratelimiting for in-kernel unseeded randomness
	random: use proper jiffies comparison macro
	random: handle latent entropy and command line from random_init()
	random: credit architectural init the exact amount
	random: use static branch for crng_ready()
	random: remove extern from functions in header
	random: use proper return types on get_random_{int,long}_wait()
	random: move initialization functions out of hot pages
	random: move randomize_page() into mm where it belongs
	random: convert to using fops->write_iter()
	random: wire up fops->splice_{read,write}_iter()
	random: check for signals after page of pool writes
	Revert "random: use static branch for crng_ready()"
	crypto: drbg - add FIPS 140-2 CTRNG for noise source
	crypto: drbg - always seeded with SP800-90B compliant noise source
	crypto: drbg - prepare for more fine-grained tracking of seeding state
	crypto: drbg - track whether DRBG was seeded with !rng_is_initialized()
	crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed()
	crypto: drbg - always try to free Jitter RNG instance
	crypto: drbg - make reseeding from get_random_bytes() synchronous
	random: avoid checking crng_ready() twice in random_init()
	random: mark bootloader randomness code as __init
	random: account for arch randomness in bits
	ASoC: cs42l52: Fix TLV scales for mixer controls
	ASoC: cs53l30: Correct number of volume levels on SX controls
	ASoC: cs42l52: Correct TLV for Bypass Volume
	ASoC: cs42l56: Correct typo in minimum level for SX volume controls
	ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
	ASoC: wm8962: Fix suspend while playing music
	scsi: vmw_pvscsi: Expand vcpuHint to 16 bits
	scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology
	scsi: ipr: Fix missing/incorrect resource cleanup in error case
	scsi: pmcraid: Fix missing resource cleanup in error case
	virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed
	nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred
	ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg
	net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag
	random: credit cpu and bootloader seeds by default
	pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE
	i40e: Fix call trace in setup_tx_descriptors
	tty: goldfish: Fix free_irq() on remove
	misc: atmel-ssc: Fix IRQ check in ssc_probe
	net: bgmac: Fix an erroneous kfree() in bgmac_remove()
	arm64: ftrace: fix branch range checks
	certs/blacklist_hashes.c: fix const confusion in certs blacklist
	irqchip/gic/realview: Fix refcount leak in realview_gic_of_init
	comedi: vmk80xx: fix expression for tx buffer size
	USB: serial: option: add support for Cinterion MV31 with new baseline
	USB: serial: io_ti: add Agilent E5805A support
	usb: dwc2: Fix memory leak in dwc2_hcd_init
	usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe
	serial: 8250: Store to lsr_save_flags after lsr read
	ext4: fix bug_on ext4_mb_use_inode_pa
	ext4: make variable "count" signed
	ext4: add reserved GDT blocks check
	virtio-pci: Remove wrong address verification in vp_del_vqs()
	l2tp: don't use inet_shutdown on ppp session destroy
	l2tp: fix race in pppol2tp_release with session object destroy
	s390/mm: use non-quiescing sske for KVM switch to keyed guest
	usb: gadget: u_ether: fix regression in setting fixed MAC address
	xprtrdma: fix incorrect header size calculations
	tcp: add some entropy in __inet_hash_connect()
	tcp: use different parts of the port_offset for index and offset
	tcp: add small random increments to the source port
	tcp: dynamically allocate the perturb table used by source ports
	tcp: increase source port perturb table to 2^16
	tcp: drop the hash_32() part from the index calculation
	Linux 4.14.285

Conflicts:
	crypto/chacha20_generic.c
	drivers/char/random.c
	drivers/of/fdt.c
	include/crypto/chacha20.h
	lib/chacha20.c

Merge resolution notes:
  - Added CHACHA20_KEY_SIZE and CHACHA20_BLOCK_SIZE constants to
    chacha.h, to minimize changes from the 4.14.285 version of random.c

  - Updated lib/vsprintf.c for
    "random: replace custom notifier chain with standard one".

Change-Id: I6a4ca9b12ed23f76bac6c4c9e6306e2b354e2752
Signed-off-by: Eric Biggers <ebiggers@google.com>
2022-06-28 18:00:02 +00:00
Jason A. Donenfeld
707c01fe19 random: remove unused tracepoints
commit 14c174633f349cb41ea90c2c0aaddac157012f74 upstream.

These explicit tracepoints aren't really used and show sign of aging.
It's work to keep these up to date, and before I attempted to keep them
up to date, they weren't up to date, which indicates that they're not
really used. These days there are better ways of introspecting anyway.

Cc: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Dominik Brodowski <linux@dominikbrodowski.net>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-25 11:46:34 +02:00
Jason A. Donenfeld
acbf6f4851 random: use hash function for crng_slow_load()
commit 66e4c2b9541503d721e936cc3898c9f25f4591ff upstream.

Since we have a hash function that's really fast, and the goal of
crng_slow_load() is reportedly to "touch all of the crng's state", we
can just hash the old state together with the new state and call it a
day. This way we dont need to reason about another LFSR or worry about
various attacks there. This code is only ever used at early boot and
then never again.

Cc: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Dominik Brodowski <linux@dominikbrodowski.net>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-25 11:46:33 +02:00
Jason A. Donenfeld
62a2b4bd3e random: simplify entropy debiting
commit 9c07f57869e90140080cfc282cc628d123e27704 upstream.

Our pool is 256 bits, and we only ever use all of it or don't use it at
all, which is decided by whether or not it has at least 128 bits in it.
So we can drastically simplify the accounting and cmpxchg loop to do
exactly this.  While we're at it, we move the minimum bit size into a
constant so it can be shared between the two places where it matters.

The reason we want any of this is for the case in which an attacker has
compromised the current state, and then bruteforces small amounts of
entropy added to it. By demanding a particular minimum amount of entropy
be present before reseeding, we make that bruteforcing difficult.

Note that this rationale no longer includes anything about /dev/random
blocking at the right moment, since /dev/random no longer blocks (except
for at ~boot), but rather uses the crng. In a former life, /dev/random
was different and therefore required a more nuanced account(), but this
is no longer.

Behaviorally, nothing changes here. This is just a simplification of
the code.

Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-25 11:46:32 +02:00
Jason A. Donenfeld
55349296ba random: rather than entropy_store abstraction, use global
commit 90ed1e67e896cc8040a523f8428fc02f9b164394 upstream.

Originally, the RNG used several pools, so having things abstracted out
over a generic entropy_store object made sense. These days, there's only
one input pool, and then an uneven mix of usage via the abstraction and
usage via &input_pool. Rather than this uneasy mixture, just get rid of
the abstraction entirely and have things always use the global. This
simplifies the code and makes reading it a bit easier.

Reviewed-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-25 11:46:31 +02:00
Eric Biggers
5ab8e04f6d random: remove dead code left over from blocking pool
commit 118a4417e14348b2e46f5e467da8444ec4757a45 upstream.

Remove some dead code that was left over following commit 90ea1c6436d2
("random: remove the blocking pool").

Cc: linux-crypto@vger.kernel.org
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Andy Lutomirski <luto@kernel.org>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-25 11:46:29 +02:00
Theodore Ts'o
fd5e41d61e random: only read from /dev/random after its pool has received 128 bits
commit eb9d1bf079bb438d1a066d72337092935fc770f6 upstream.

Immediately after boot, we allow reads from /dev/random before its
entropy pool has been fully initialized.  Fix this so that we don't
allow this until the blocking pool has received 128 bits.

We do this by repurposing the initialized flag in the entropy pool
struct, and use the initialized flag in the blocking pool to indicate
whether it is safe to pull from the blocking pool.

To do this, we needed to rework when we decide to push entropy from the
input pool to the blocking pool, since the initialized flag for the
input pool was used for this purpose.  To simplify things, we no
longer use the initialized flag for that purpose, nor do we use the
entropy_total field any more.

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-25 11:46:26 +02:00
Greg Kroah-Hartman
bc1a5b8c02 Merge 4.14.283 into android-4.14-stable
Changes in 4.14.283
	binfmt_flat: do not stop relocating GOT entries prematurely on riscv
	USB: serial: option: add Quectel BG95 modem
	USB: new quirk for Dell Gen 2 devices
	ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP
	ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
	btrfs: add "0x" prefix for unsupported optional features
	btrfs: repair super block num_devices automatically
	drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
	mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue
	b43legacy: Fix assigning negative value to unsigned variable
	b43: Fix assigning negative value to unsigned variable
	ipw2x00: Fix potential NULL dereference in libipw_xmit()
	ACPICA: Avoid cache flush inside virtual machines
	ALSA: jack: Access input_dev under mutex
	drm/amd/pm: fix double free in si_parse_power_table()
	ath9k: fix QCA9561 PA bias level
	media: venus: hfi: avoid null dereference in deinit
	media: pci: cx23885: Fix the error handling in cx23885_initdev()
	media: cx25821: Fix the warning when removing the module
	scsi: megaraid: Fix error check return value of register_chrdev()
	drm/amd/pm: fix the compile warning
	ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL
	ASoC: dapm: Don't fold register value changes into notifications
	s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES
	dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC
	ipmi:ssif: Check for NULL msg when handling events and messages
	rtlwifi: Use pr_warn instead of WARN_ONCE
	openrisc: start CPU timer early in boot
	nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags
	ASoC: rt5645: Fix errorenous cleanup order
	net: phy: micrel: Allow probing without .driver_data
	media: exynos4-is: Fix compile warning
	rxrpc: Return an error to sendmsg if call failed
	eth: tg3: silence the GCC 12 array-bounds warning
	ARM: dts: ox820: align interrupt controller node name with dtschema
	fs: jfs: fix possible NULL pointer dereference in dbFree()
	ARM: OMAP1: clock: Fix UART rate reporting algorithm
	fat: add ratelimit to fat*_ent_bread()
	ARM: versatile: Add missing of_node_put in dcscb_init
	ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM
	ARM: hisi: Add missing of_node_put after of_find_compatible_node
	PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()
	tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate
	powerpc/xics: fix refcount leak in icp_opal_init()
	macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled
	RDMA/hfi1: Prevent panic when SDMA is disabled
	drm: fix EDID struct for old ARM OABI format
	ath9k: fix ar9003_get_eepmisc
	ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe
	ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
	x86/delay: Fix the wrong asm constraint in delay_loop()
	drm/mediatek: Fix mtk_cec_mask()
	spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout
	NFC: NULL out the dev->rfkill to prevent UAF
	efi: Add missing prototype for efi_capsule_setup_info
	HID: hid-led: fix maximum brightness for Dream Cheeky
	spi: img-spfi: Fix pm_runtime_get_sync() error checking
	ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
	inotify: show inotify mask flags in proc fdinfo
	fsnotify: fix wrong lockdep annotations
	x86/pm: Fix false positive kmemleak report in msr_build_context()
	drm/msm/dsi: fix error checks and return values for DSI xmit functions
	drm/msm/hdmi: check return value after calling platform_get_resource_byname()
	drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
	x86: Fix return value of __setup handlers
	irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
	x86/mm: Cleanup the control_va_addr_alignment() __setup handler
	drm/msm: return an error pointer in msm_gem_prime_get_sg_table()
	media: uvcvideo: Fix missing check to determine if element is found in list
	ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
	regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
	media: st-delta: Fix PM disable depth imbalance in delta_probe
	media: exynos4-is: Change clk_disable to clk_disable_unprepare
	media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
	Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
	m68k: math-emu: Fix dependencies of math emulation support
	sctp: read sk->sk_bound_dev_if once in sctp_rcv()
	ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition()
	rxrpc: Fix listen() setting the bar too high for the prealloc rings
	rxrpc: Don't try to resend the request if we're receiving the reply
	soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc
	soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc
	ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT
	ARM: dts: bcm2835-rpi-b: Fix GPIO line names
	mfd: ipaq-micro: Fix error check return value of platform_get_irq()
	scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac()
	pinctrl: mvebu: Fix irq_of_parse_and_map() return value
	drivers/base/node.c: fix compaction sysfs file leak
	powerpc/8xx: export 'cpm_setbrg' for modules
	powerpc/idle: Fix return value of __setup() handler
	powerpc/4xx/cpm: Fix return value of __setup() handler
	tty: fix deadlock caused by calling printk() under tty_port->lock
	Input: sparcspkr - fix refcount leak in bbc_beep_probe
	powerpc/perf: Fix the threshold compare group constraint for power9
	powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup
	mailbox: forward the hrtimer if not queued and under a lock
	iommu/mediatek: Add list_del in mtk_iommu_remove
	video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup
	iommu/amd: Increase timeout waiting for GA log enablement
	perf c2c: Use stdio interface if slang is not supported
	perf jevents: Fix event syntax error caused by ExtSel
	wifi: mac80211: fix use-after-free in chanctx code
	iwlwifi: mvm: fix assert 1F04 upon reconfig
	fs-writeback: writeback_sb_inodes:Recalculate 'wrote' according skipped pages
	ext4: fix use-after-free in ext4_rename_dir_prepare
	ext4: fix bug_on in ext4_writepages
	ext4: verify dir block before splitting it
	ext4: avoid cycles in directory h-tree
	dlm: fix plock invalid read
	dlm: fix missing lkb refcount handling
	ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
	scsi: dc395x: Fix a missing check on list iterator
	scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled
	drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.
	drm/nouveau/clk: Fix an incorrect NULL check on list iterator
	drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX
	md: fix an incorrect NULL check in does_sb_need_changing
	md: fix an incorrect NULL check in md_reload_sb
	RDMA/hfi1: Fix potential integer multiplication overflow errors
	irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x
	irqchip: irq-xtensa-mx: fix initial IRQ affinity
	mac80211: upgrade passive scan to active scan on DFS channels after beacon rx
	um: chan_user: Fix winch_tramp() return value
	um: Fix out-of-bounds read in LDT setup
	iommu/msm: Fix an incorrect NULL check on list iterator
	nodemask.h: fix compilation error with GCC12
	hugetlb: fix huge_pmd_unshare address update
	rtl818x: Prevent using not initialized queues
	ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control
	carl9170: tx: fix an incorrect use of list iterator
	gma500: fix an incorrect NULL check on list iterator
	arm64: dts: qcom: ipq8074: fix the sleep clock frequency
	phy: qcom-qmp: fix struct clk leak on probe errors
	docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0
	dt-bindings: gpio: altera: correct interrupt-cells
	phy: qcom-qmp: fix reset-controller leak on probe errors
	RDMA/rxe: Generate a completion for unsupported/invalid opcode
	MIPS: IP27: Remove incorrect `cpu_has_fpu' override
	netfilter: nf_tables: disallow non-stateful expression in sets earlier
	pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
	staging: greybus: codecs: fix type confusion of list iterator variable
	tty: goldfish: Use tty_port_destroy() to destroy port
	usb: usbip: fix a refcount leak in stub_probe()
	usb: usbip: add missing device lock on tweak configuration cmd
	USB: storage: karma: fix rio_karma_init return
	pwm: lp3943: Fix duty calculation in case period was clamped
	rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value
	coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier
	soc: rockchip: Fix refcount leak in rockchip_grf_init
	rtc: mt6397: check return value after calling platform_get_resource()
	serial: meson: acquire port->lock in startup()
	serial: digicolor-usart: Don't allow CS5-6
	serial: txx9: Don't allow CS5-6
	serial: sh-sci: Don't allow CS5-6
	serial: st-asc: Sanitize CSIZE and correct PARENB for CS7
	firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
	clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value
	net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry()
	net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
	modpost: fix removing numeric suffixes
	jffs2: fix memory leak in jffs2_do_fill_super
	ubi: ubi_create_volume: Fix use-after-free when volume creation failed
	tcp: tcp_rtx_synack() can be called from process context
	perf c2c: Fix sorting in percent_rmt_hitm_cmp()
	mips: cpc: Fix refcount leak in mips_cpc_default_phys_base
	tracing: Fix sleeping function called from invalid context on RT kernel
	tracing: Avoid adding tracer option before update_tracer_options
	i2c: cadence: Increase timeout per message if necessary
	m68knommu: set ZERO_PAGE() to the allocated zeroed page
	m68knommu: fix undefined reference to `_init_sp'
	video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove()
	xprtrdma: treat all calls not a bcall when bc_serv is NULL
	ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
	net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure
	SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()
	net: mdio: unexport __init-annotated mdio_bus_init()
	net: xfrm: unexport __init-annotated xfrm4_protocol_init()
	net: ipv6: unexport __init-annotated seg6_hmac_init()
	net: altera: Fix refcount leak in altera_tse_mdio_create
	drm: imx: fix compiler warning with gcc-12
	iio: dummy: iio_simple_dummy: check the return value of kstrdup()
	lkdtm/usercopy: Expand size of "out of frame" object
	tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
	tty: Fix a possible resource leak in icom_probe
	drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
	USB: host: isp116x: check return value after calling platform_get_resource()
	drivers: tty: serial: Fix deadlock in sa1100_set_termios()
	drivers: usb: host: Fix deadlock in oxu_bus_suspend()
	USB: hcd-pci: Fully suspend across freeze/thaw cycle
	usb: dwc2: gadget: don't reset gadget's driver->bus
	misc: rtsx: set NULL intfdata when probe fails
	extcon: Modify extcon device to be created after driver data is set
	clocksource/drivers/sp804: Avoid error on multiple instances
	staging: rtl8712: fix uninit-value in r871xu_drv_init()
	serial: msm_serial: disable interrupts in __msm_console_write()
	kernfs: Separate kernfs_pr_cont_buf and rename_lock.
	md: protect md_unregister_thread from reentrancy
	Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process"
	drm/radeon: fix a possible null pointer dereference
	modpost: fix undefined behavior of is_arm_mapping_symbol()
	nbd: call genl_unregister_family() first in nbd_cleanup()
	nbd: fix race between nbd_alloc_config() and module removal
	nbd: fix io hung while disconnecting device
	nodemask: Fix return values to be unsigned
	vringh: Fix loop descriptors check in the indirect cases
	ALSA: hda/conexant - Fix loopback issue with CX20632
	cifs: return errors during session setup during reconnects
	ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
	nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION
	nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling
	ixgbe: fix bcast packets Rx on VF after promisc removal
	ixgbe: fix unexpected VLAN Rx in promisc mode on VF
	Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
	powerpc/32: Fix overread/overwrite of thread_struct via ptrace
	md/raid0: Ignore RAID0 layout if the second zone has only one device
	mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write
	mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N
	PCI: qcom: Fix unbalanced PHY init on probe errors
	tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd
	Linux 4.14.283

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ied22d0825be1474eb1388684d690c7c40d8fe891
2022-06-14 17:05:02 +02:00
Vasily Averin
232db3526c tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate
[ Upstream commit 2b132903de7124dd9a758be0c27562e91a510848 ]

Fixes following sparse warnings:

  CHECK   mm/vmscan.c
mm/vmscan.c: note: in included file (through
include/trace/trace_events.h, include/trace/define_trace.h,
include/trace/events/vmscan.h):
./include/trace/events/vmscan.h:281:1: sparse: warning:
 cast to restricted isolate_mode_t
./include/trace/events/vmscan.h:281:1: sparse: warning:
 restricted isolate_mode_t degrades to integer

Link: https://lkml.kernel.org/r/e85d7ff2-fd10-53f8-c24e-ba0458439c1b@openvz.org
Signed-off-by: Vasily Averin <vvs@openvz.org>
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-06-14 16:53:47 +02:00
Stanley Chu
e25b53e5d9 [ALPS05588970] eara-io-qos: Provide top ratio in perf-tracker trace
Provide top ratio in perf-tracker trace.

MTK-Commit-Id: 41076716f9254e9eafc9a5de08e61569f4e511fd

Change-Id: I5370339ed58ed5e2b1bedb6e46e7cc422790a7b4
Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
CR-Id: ALPS05588970
Feature: UFS(Universal Flash Storage)
(cherry picked from commit 6227e865b049672a0a43fd65bcf16c5528ea0ea1)
2021-03-18 23:42:31 +08:00
Greg Kroah-Hartman
c0303b0388 Merge 4.14.222 into android-4.14-stable
Changes in 4.14.222
	fgraph: Initialize tracing_graph_pause at task creation
	remoteproc: qcom_q6v5_mss: Validate modem blob firmware size before load
	remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load
	af_key: relax availability checks for skb size calculation
	pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()
	iwlwifi: mvm: take mutex for calling iwl_mvm_get_sync_time()
	iwlwifi: pcie: add a NULL check in iwl_pcie_txq_unmap
	iwlwifi: mvm: guard against device removal in reprobe
	SUNRPC: Move simple_get_bytes and simple_get_netobj into private header
	SUNRPC: Handle 0 length opaque XDR object data properly
	lib/string: Add strscpy_pad() function
	include/trace/events/writeback.h: fix -Wstringop-truncation warnings
	memcg: fix a crash in wb_workfn when a device disappears
	squashfs: add more sanity checks in id lookup
	squashfs: add more sanity checks in inode lookup
	squashfs: add more sanity checks in xattr id lookup
	tracing: Do not count ftrace events in top level enable output
	tracing: Check length before giving out the filter buffer
	arm/xen: Don't probe xenbus as part of an early initcall
	MIPS: BMIPS: Fix section mismatch warning
	arm64: dts: rockchip: Fix PCIe DT properties on rk3399
	platform/x86: hp-wmi: Disable tablet-mode reporting by default
	ovl: perform vfs_getxattr() with mounter creds
	cap: fix conversions on getxattr
	ovl: skip getxattr of security labels
	ARM: dts: lpc32xx: Revert set default clock rate of HCLK PLL
	ARM: ensure the signal page contains defined contents
	memblock: do not start bottom-up allocations with kernel_end
	bpf: Check for integer overflow when using roundup_pow_of_two()
	netfilter: xt_recent: Fix attempt to update deleted entry
	xen/netback: avoid race in xenvif_rx_ring_slots_available()
	netfilter: conntrack: skip identical origin tuple in same zone only
	usb: dwc3: ulpi: fix checkpatch warning
	usb: dwc3: ulpi: Replace CPU-based busyloop with Protocol-based one
	net/vmw_vsock: improve locking in vsock_connect_timeout()
	net: watchdog: hold device global xmit lock during tx disable
	vsock/virtio: update credit only if socket is not closed
	vsock: fix locking in vsock_shutdown()
	i2c: stm32f7: fix configuration of the digital filter
	h8300: fix PREEMPTION build, TI_PRE_COUNT undefined
	x86/build: Disable CET instrumentation in the kernel for 32-bit too
	trace: Use -mcount-record for dynamic ftrace
	tracing: Fix SKIP_STACK_VALIDATION=1 build due to bad merge with -mrecord-mcount
	tracing: Avoid calling cc-option -mrecord-mcount for every Makefile
	Xen/x86: don't bail early from clear_foreign_p2m_mapping()
	Xen/x86: also check kernel mapping in set_foreign_p2m_mapping()
	Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages()
	Xen/gntdev: correct error checking in gntdev_map_grant_pages()
	xen/arm: don't ignore return errors from set_phys_to_machine
	xen-blkback: don't "handle" error by BUG()
	xen-netback: don't "handle" error by BUG()
	xen-scsiback: don't "handle" error by BUG()
	xen-blkback: fix error handling in xen_blkbk_map()
	scsi: qla2xxx: Fix crash during driver load on big endian machines
	USB: Gadget Ethernet: Re-enable Jumbo frames.
	usb: gadget: u_ether: Fix MTU size mismatch with RX packet size
	kvm: check tlbs_dirty directly
	Linux 4.14.222

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I22657377bcf9340798a60064ba3d5ebdf1165097
2021-02-23 14:55:38 +01:00
Theodore Ts'o
d24cf6d0d7 memcg: fix a crash in wb_workfn when a device disappears
[ Upstream commit 68f23b89067fdf187763e75a56087550624fdbee ]

Without memcg, there is a one-to-one mapping between the bdi and
bdi_writeback structures.  In this world, things are fairly
straightforward; the first thing bdi_unregister() does is to shutdown
the bdi_writeback structure (or wb), and part of that writeback ensures
that no other work queued against the wb, and that the wb is fully
drained.

With memcg, however, there is a one-to-many relationship between the bdi
and bdi_writeback structures; that is, there are multiple wb objects
which can all point to a single bdi.  There is a refcount which prevents
the bdi object from being released (and hence, unregistered).  So in
theory, the bdi_unregister() *should* only get called once its refcount
goes to zero (bdi_put will drop the refcount, and when it is zero,
release_bdi gets called, which calls bdi_unregister).

Unfortunately, del_gendisk() in block/gen_hd.c never got the memo about
the Brave New memcg World, and calls bdi_unregister directly.  It does
this without informing the file system, or the memcg code, or anything
else.  This causes the root wb associated with the bdi to be
unregistered, but none of the memcg-specific wb's are shutdown.  So when
one of these wb's are woken up to do delayed work, they try to
dereference their wb->bdi->dev to fetch the device name, but
unfortunately bdi->dev is now NULL, thanks to the bdi_unregister()
called by del_gendisk().  As a result, *boom*.

Fortunately, it looks like the rest of the writeback path is perfectly
happy with bdi->dev and bdi->owner being NULL, so the simplest fix is to
create a bdi_dev_name() function which can handle bdi->dev being NULL.
This also allows us to bulletproof the writeback tracepoints to prevent
them from dereferencing a NULL pointer and crashing the kernel if one is
tracing with memcg's enabled, and an iSCSI device dies or a USB storage
stick is pulled.

The most common way of triggering this will be hotremoval of a device
while writeback with memcg enabled is going on.  It was triggering
several times a day in a heavily loaded production environment.

Google Bug Id: 145475544

Link: https://lore.kernel.org/r/20191227194829.150110-1-tytso@mit.edu
Link: http://lkml.kernel.org/r/20191228005211.163952-1-tytso@mit.edu
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: Chris Mason <clm@fb.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-02-23 14:00:30 +01:00
Qian Cai
fe4c89150d include/trace/events/writeback.h: fix -Wstringop-truncation warnings
[ Upstream commit d1a445d3b86c9341ce7a0954c23be0edb5c9bec5 ]

There are many of those warnings.

In file included from ./arch/powerpc/include/asm/paca.h:15,
                 from ./arch/powerpc/include/asm/current.h:13,
                 from ./include/linux/thread_info.h:21,
                 from ./include/asm-generic/preempt.h:5,
                 from ./arch/powerpc/include/generated/asm/preempt.h:1,
                 from ./include/linux/preempt.h:78,
                 from ./include/linux/spinlock.h:51,
                 from fs/fs-writeback.c:19:
In function 'strncpy',
    inlined from 'perf_trace_writeback_page_template' at
./include/trace/events/writeback.h:56:1:
./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified
bound 32 equals destination size [-Wstringop-truncation]
  return __builtin_strncpy(p, q, size);
         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fix it by using the new strscpy_pad() which was introduced in "lib/string:
Add strscpy_pad() function" and will always be NUL-terminated instead of
strncpy().  Also, change strlcpy() to use strscpy_pad() in this file for
consistency.

Link: http://lkml.kernel.org/r/1564075099-27750-1-git-send-email-cai@lca.pw
Fixes: 455b286468 ("writeback: Initial tracing support")
Fixes: 028c2dd184 ("writeback: Add tracing to balance_dirty_pages")
Fixes: e84d0a4f8e ("writeback: trace event writeback_queue_io")
Fixes: b48c104d22 ("writeback: trace event bdi_dirty_ratelimit")
Fixes: cc1676d917 ("writeback: Move requeueing when I_SYNC set to writeback_sb_inodes()")
Fixes: 9fb0a7da0c ("writeback: add more tracepoints")
Signed-off-by: Qian Cai <cai@lca.pw>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: Tobin C. Harding <tobin@kernel.org>
Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Dave Chinner <dchinner@redhat.com>
Cc: Fengguang Wu <fengguang.wu@intel.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Joe Perches <joe@perches.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Jann Horn <jannh@google.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Nitin Gote <nitin.r.gote@intel.com>
Cc: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Cc: Stephen Kitt <steve@sk2.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-02-23 14:00:30 +01:00
Jan Kara
5c846eee8b writeback: Drop I_DIRTY_TIME_EXPIRE
commit 5fcd57505c002efc5823a7355e21f48dd02d5a51 upstream.

The only use of I_DIRTY_TIME_EXPIRE is to detect in
__writeback_single_inode() that inode got there because flush worker
decided it's time to writeback the dirty inode time stamps (either
because we are syncing or because of age). However we can detect this
directly in __writeback_single_inode() and there's no need for the
strange propagation with I_DIRTY_TIME_EXPIRE flag.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-30 13:31:17 +01:00
James Hsu
968a40b8b1 [ALPS05287226] mrdump: add PG_iommu page flag
add PG_iommu page flag for mrdump to bypass some user page
to decrease full ramdump

bypass user page type
1. ion memory

MTK-Commit-Id: 03784956c46a349f8a18053173cff37f244eee88

Change-Id: I1bdfeab39e73fa778974c84e0a0c91958b35b5ab
Signed-off-by: James Hsu <james.hsu@mediatek.com>
CR-Id: ALPS05287226
Feature: Memory RAM Dump (MRDUMP)
2021-01-29 02:20:27 +08:00
Argus Lin
23a2446f01 [ALPS05234190] SPMI: fix kasan issue
Native code bug. Spmi event trace - spmi_write_begin and
spmi_read_begin use memcpy to copy (length + 1) bytes from buf.
But val length at buf only length byte. When we copy
length + 1 bytes, it will cause BUG: KASAN: slab-out-of-bounds
issue.

The entrypoint is "echo *:* > /sys/kernel/debug/tracing/set_event".
*:* string will be sent by fuzzer, enable spmi event trace, and
trigger KE.

MTK-Commit-Id: 8d1f8b74b1f9696f684f3272ffe50742f0bbb1f8

Change-Id: Iaf9a6a3ecba59711afa2f606f8a96f3f193ee558
Signed-off-by: Jeter Chen <jeter.chen@mediatek.com>
CR-Id: ALPS05234190
Feature: Vulnerability Scan
(cherry picked from commit 8da957709a199d35db1233b3eba44816db7fa13d)
2021-01-29 02:18:10 +08:00
mingyuan ma
ca5065beb1 [ALPS05139084] ion: rollback patch add heap size change tracepoints
Rollback google patch add heap size change tracepoints, since it has not
been applied on google official codebase.

MTK-Commit-Id: ad20edf08d5c32e584ffc927e4e19b9df1ad7a73

Change-Id: Ibb2681307c41e91f61c85936fdfcd4e22ddc5c52
Signed-off-by: Mingyuan Ma <mingyuan.ma@mediatek.com>
CR-Id: ALPS05139084
Feature: [Module]ION/M4U
2021-01-29 02:17:52 +08:00
skylake.huang
f0b9b6816e [ALPS05218188] [Do NOT Sync]Merge branch android-4.14-stable into alps-trunk-r0.basic
[Detail]
	Parent: 8d6de4a1be
		Merge 4.14.184 into android-4.14-stable
	Start: 052327acd0
		ANDROID: kbuild: merge more sections with LTO
	Target: e570b0fb2f
		Merge 4.14.186 into android-4.14-stable

MTK-Commit-Id: d11d3ad00fa75b50bdcede0da19a1e3c23d483aa

Feature: Others
Change-Id: I060a264d9b0ab48b1943a4525d035f773c65c7c4
CR-Id: ALPS05218188
Signed-off-by: Breeze.Li <breeze.li@mediatek.com>
2021-01-29 02:17:20 +08:00
San Wu
bd90b79512 [ALPS05129597] perf: perf_tracker with vcore uv info support
[Detail]
   Add New info for power analysis

MTK-Commit-Id: 634740619a2f480c35f6aa5434aafc68f6452956

Change-Id: I2060dbc8372f74b4f5c37c63f984f9eca3d3d116
CR-Id: ALPS05129597
Feature: System Performance
Signed-off-by: San Wu <san.wu@mediatek.com>
(cherry picked from commit 6bb94974d4ab8fb445093768d554d86c918f29c6)
2021-01-29 02:16:40 +08:00
YT Chang
d8858ad729 [ALPS04702478] sched: share-buck aware
energy aware aware share buck
use max frequency in the shared buck to calculate the
dynamic power and leakage power

MTK-Commit-Id: dcebf6a8e0d979c3ce7eaab8d4338a0dd0b6fa5c

Change-Id: I1f08775ef9241527b46c71b39895d92484b2580f
Signed-off-by: YT Chang <yt.chang@mediatek.com>
CR-Id: ALPS04702478
Feature: Energy Aware Scheduling Plus (EAS+)
2021-01-29 02:16:32 +08:00
Jing-Ting Wu
745ae1bd66 [ALPS05114665] sched: add ta uclamp for big task rotation
[Detail]
Add dynamic top-app uclamp for big task rotation

MTK-Commit-Id: 13cceef8c98b173d3db492f32e24513127a2ec75

Change-Id: I3f78b9c802cc151b501897545d215009b2ae93d9
CR-Id: ALPS05114665
Feature: Energy Aware Scheduling Plus (EAS+)
Signed-off-by: Jing-Ting Wu <jing-ting.wu@mediatek.com>
2021-01-29 02:15:31 +08:00
ChiaYu Ku
c9bdedb9aa [ALPS05141571] eara: R migration
1. eara thermal
2. performance observer
3. resoure symohony

MTK-Commit-Id: e26bd92c222b3b3eaa7a60f532ab146da0cd6e13

Change-Id: Ie1b19c24ab09fe739fc37c52e8e5d0cd34cf541b
Signed-off-by: ChiaYu Ku <ChiaYu.Ku@mediatek.com>
CR-Id: ALPS05141571
Feature: FPSGO
2021-01-29 02:15:28 +08:00
zhuoliang zhang
e6be552790 [ALPS05115305] UPSTREAM:netd:batch processing of network packets
[Detail]This patch adds the capability for the network stack to receive
a list of packets and process them as a unit, rather than handling each
packet singly in sequence. This is done factoring out the existing data
path code at each layer and warpping it in list handling code.
The motivation is to improve instruction cache hit rate and reduction of
indirect calls, resulting in some impressive performance improvements.

patch sets:
net: core: trivial netif_receive_skb_list() entry point
(commit	f6ad8c1bcdf014272d08c55b9469536952a0a771)

net: core: unwrap skb list receive slightly further
(commit	920572b73280a29e3a9f58807a8b90051b19ee60)

net: core: Another step of skb receive list processing
(commit	7da517a3bc529dc5399e742688b32cafa2ca5ca0)

net: core: another layer of lists, around PF_MEMALLOC skb handling
(commit	4ce0017a373afaaa9ef17614d8fa4f6fde261d18)

net: core: propagate SKB lists through packet_type lookup
(commit	88eb1944e18c1ba61da538ae9d1732832eb79b9d)

net: dont bother calling list RX functions on empty lists
(commit	b9f463d6c9849230043123a6335d59ac7fea4d5a)

net: ipv4: listified version of ip_rcv
(commit	17266ee939849cb095ed7dd9edbec4162172226b)

net: ipv4: listify ip_rcv_finish
(commit	5fa12739a53d0780265ed9d44d9ec9ba5f9ad00a)

net: core: fix uses-after-free in list processing
(commit	8c057efaebb557b60ba514b5e39e8000a1eab0f1)

net: core: fix use-after-free in __netif_receive_skb_list_core
(commit	9af86f9338949a9369bda5e6fed69347d1813054)

net: ipv4: fix drop handling in ip_list_rcv() and ip_list_rcv_finish()
(commit	a4ca8b7df73c6d78b8b5aa8246a7d794b25c25ce)

net: Add and use skb_mark_not_on_list().
(commit	a8305bff685252e80b7c60f4f5e7dd2e63e38218)

net: Add and use skb_list_del_init().
(commit	992cba7e276d438ac8b0a8c17b147b37c8c286f7)

net: use skb_list_del_init() to remove from RX sublists
(commit	22f6bbb7bcfcef0b373b0502a7ff390275c575dd)

net: core: netif_receive_skb_list: unlist skb before passing to pt->func
(commit	9a5a90d167b0e5fe3d47af16b68fd09ce64085cd)

[Solution]merge batching feature from kernel-4.19.

MTK-Commit-Id: 9c27b30fd42f0bcc5c73d81a20d6c7d8c2fdcf3e

Change-Id: Ie3a255c68d56c1cecfe11fd8f556b949365bca33
Signed-off-by: zhuoliang zhang <zhuoliang.zhang@mediatek.com>
CR-Id: ALPS05115305
Feature: Modem Interface Driver
(cherry picked from commit 9d907763d066605b7cda2b7883b1ca7cb71c9cbc)
2021-01-29 02:14:35 +08:00
skylake.huang
f22b5719f5 [ALPS05116835] [Do NOT Sync]Merge branch android-4.14-stable into alps-trunk-r0.basic
[Detail]
	Parent: 32bc956bc2
		Merge 4.14.174 into android-4.14
	Start: 9affadc76e
		ANDROID: UPSTREAM: bpf: Explicitly memset the bpf_attr structure
	Target: 10557abb61
		Merge 4.14.179 into android-4.14-stable

MTK-Commit-Id: 571bd9ed6e169c9210bedd85d5835daf73f9950a

Feature: Others
Change-Id: I0f577ffe6e316fc803adc0a83636b335af891ff5
CR-Id: ALPS05116835
Signed-off-by: Breeze.Li <breeze.li@mediatek.com>
2021-01-29 02:13:36 +08:00
skylake.huang
b189fe3e50 [ALPS05077885] [Do NOT Sync]Merge branch android-4.14 into alps-trunk-r0.basic
[Detail]
	Parent: 234de92896
		Merge 4.14.150 into android-4.14
	Start: 7d642373db
		ANDROID: refactor build.config files to remove duplication
	Target: 32bc956bc2
		Merge 4.14.174 into android-4.14

MTK-Commit-Id: 73aee9b6172d4865b3b10bd396f7cfa40e7207b1

Feature: Others
Change-Id: Id09b858cd9f7f12db63cdb0bea42254d233a9fbd
CR-Id: ALPS05077885
Signed-off-by: Breeze.Li <breeze.li@mediatek.com>
2021-01-29 02:12:11 +08:00
Kobe Wu
95aa0968e9 [ALPS04994668] lockdep: improve lockdep debugging
1. set a limitation to prevent from log too much
2. add aee dump on held lock too much
3. ignore performance warning on KASAN/UBSAN load
4. increase size of lockdep chain buffer
5. refine function to dump task stack
6. refine mt_aee_dump_held_locks

MTK-Commit-Id: 5d2ddb79008c3919483973c2e5459e1405f70a30

Change-Id: I8c5d6c467873cdb9be896089cd2d8100b16f11c1
CR-Id: ALPS04994668
Feature: [Module]Lockdep
Signed-off-by: Kobe Wu <kobe-cp.wu@mediatek.com>
2021-01-29 01:03:38 +08:00
JianMin Liu
e7faf7a491 [ALPS04791510] task-turbo: scheduler tuning for task turbo
Give min_nice to turbo task for it has more oppotunity to
  occupy CPU resource and Turbo task wake-up at BCPU if
  SUB_FEAT_PREFER_BIGCORE is enable.

  Related trace event:
  a. echo 1 > /d/tracing/events/task_turbo/sched_turbo_nice_set/enable
   - Tracking turbo task set nice value

  b. echo 1 > /d/tracing/events/sched/sched_set_user_nice/enable
   - Tracking all task set nice value

MTK-Commit-Id: d16f4b17e77536b6469b9af9c2120f69c8861ddd

Change-Id: Ib8cd77e5a907513143a3fe22c274afaf1ff54f4b
Signed-off-by: JianMin Liu <jian-min.liu@mediatek.com>
CR-Id: ALPS04791510
Feature: System Performance
2021-01-29 01:03:16 +08:00
skylake.huang
dd8609f236 [ALPS05012802] [Do NOT Sync]Merge branch android-4.14 into alps-trunk-r0.basic
[Detail]
	Parent: 54236917c6
		Merge 4.14.141 into android-4.14
	Start: a9d0871a56
		ANDROID: fiq_debugger: remove
	Target: 234de92896
		Merge 4.14.150 into android-4.14

MTK-Commit-Id: 2787c355dfe4c7cb54fdbdb5b5099245ff4502b3

Feature: Others
Change-Id: I77184a925c03fcfd29597e0fbf526580e346f90e
CR-Id: ALPS05012802
Signed-off-by: Breeze.Li <breeze.li@mediatek.com>
2021-01-29 01:02:10 +08:00
Guangming Cao
16914a97e1 [ALPS04737989] [PATCH] ion: Make heap_name in ion trace points a copy
Currently, trace point for ion heap events take
the raw const char* pointer from the heap struct.
This has two issues:
1) The binary ftrace buffer wont contain the actual string
   but only the pointers. This makes hard to use tools like
   trace-cmd that consume the binary buffer on kernels built
   with clang, due to a bug in the generation of printk_format.
2) There is no guarantee that the const char* pointers store
   have unlimited lifetime. If they are tied to the lifetime
   of the ion heaps "private" object, the kernel might end up
   dereferencing a null pointer if the text-endpoint of the
   ftrace buffer is read after the heap has been destroyed.

Change-Id: I49a5a9d43efdb2a48590b056355b1fa0f69dd0b4
Signed-off-by: Primiano Tucci <primiano@google.com>
---

MTK-Commit-Id: d4b4fbd35f43b5358bf46b42462752ddc87e6a39

Change-Id: I20cae45e3189053295cb996030ea7a413d29398e
Signed-off-by: Guangming Cao <guangming.cao@mediatek.com>
CR-Id: ALPS04737989
Feature: Google Patch
2021-01-29 00:56:46 +08:00
Guangming Cao
2521f61a57 [ALPS04737989] [PATCH] ion: add heap size change tracepoints
This change adds tracepoints to log when the size of the ion heap
changes. This helps identify processes that are using a significant
amount of ion memory.

Change-Id: Ia43a8699eb5db95741e50d8746fb6825efc9ed14
Signed-off-by: Tim Murray <timmurray@google.com>
---

MTK-Commit-Id: 48e1ab027a596ba765a13b400d9ab03594351708

Change-Id: I45848060b0bcd1833397ae5e6585a9a45cca09bc
Signed-off-by: Guangming Cao <guangming.cao@mediatek.com>
CR-Id: ALPS04737989
Feature: Google Patch
2021-01-29 00:56:45 +08:00
Joel Fernandes
253521f910 [ALPS04737989] [PATCH] mm: emit tracepoint when rss watermark is hit
Useful to track how rss is changing per tgid. Required for the
memory visibility work being done for Android.

Original patch by Tim Murray:
https://partner-android-review.googlesource.com/c/kernel/private/
msm-google/+/1081280

Changes from original patch:
- dont bloat mm_struct
- add some noise reduction to rss tracking

Change-Id: Ief904334235ff4380244e5803d7853579e70d202
Signed-off-by: Joel Fernandes <joelaf@google.com>
---

MTK-Commit-Id: 04500bde64fa9a1ede4b5bf955040cde3a37baf8

Change-Id: I8e5deff583ddde34134bb13ca91d6071e7c73c1c
Signed-off-by: Chinwen Chang <chinwen.chang@mediatek.com>
CR-Id: ALPS04737989
Feature: Google Patch
2021-01-29 00:56:34 +08:00
Juju Sung
6ff7387770 [ALPS04284125] memory-amms: add support for mt6768
[Detail]
AMMS refctory

MTK-Commit-Id: 0637c6f40d2b49a694839407ebe049b32d008608

Change-Id: I36f24b7119ea3044f121fe6b707ab8299735e468
Signed-off-by: Juju Sung <juju.sung@mediatek.com>
CR-Id: ALPS04284125
Feature: [Module]Kernel Maintenance
2021-01-29 00:51:50 +08:00
Brian-SY Yang
7e0b4e3b54 [ALPS04715044] SWPM: mt6768/mt6785 migration
sync latest code of mt6768/mt6785

MTK-Commit-Id: fa2761b15f11bec98289f2b41a2f3608fa96c1b9

Change-Id: Iaa94db898eb4f769f30cfa6161ef68b95d624664
Signed-off-by: Brian-SY Yang <brian-sy.yang@mediatek.com>
CR-Id: ALPS04715044
Feature: Power Management
2021-01-29 00:49:43 +08:00
Juju Sung
55757151ba [ALPS04284125] LowPower: add support for mt6785
[Detail]
1.add cpu/gpu dvfs driver for mt6785 support
2.add mfd driver for mt6785 support
3.add diplay driver
4.add lowpower multidriver

MTK-Commit-Id: b219b263136ced20eaad5c04c23564a191dd5da7

Change-Id: I37505c8b980d0d5872872df71a8b98af5a4433af
CR-Id: ALPS04284125
Feature:[Module]Kernel Maintenance
Signed-off-by: Juju Sung <juju.sung@mediatek.com>
2021-01-29 00:47:29 +08:00
Xiaoqing Liu
261b391038 [ALPS04429396] cpufreq: add interactive policy
Merge interactive policy
 1.copy from kernel-4.9 ,not supported by google in kernel-4.14
 2.idle notify not supported in kernel-4.14 by google,so the frequency
   will not be updated in time when idle comes back.

Build pass.

MTK-Commit-Id: 4e70fcc00d317f88a319cefe8ab2d2994266863a

Change-Id: Ia1d4553c79e7781b7525e9fd3c66345b8051d2eb
Signed-off-by: Xiaoqing Liu <Xiaoqing.Liu@mediatek.com>
CR-Id: ALPS04429396
Feature: DVFS (Dynamic Voltage and Frequency Scaling)
2021-01-29 00:45:39 +08:00
JianMin Liu
798eaa377b [ALPS04272373] perf: introduce low memory thrashing hint feature
[Detail]
       A hint to notify userspace if low-momory
       is occurs via uevent per second. The system in
       userspace can use the hint to make memory more
       healthy properly.

       How to enable(default off):
       - kcofig: CONFIG_MTK_LOWMEM_HINT=y
       - echo 1 > /proc/mtk-perf/lowmem_hint_enable

       Related proc node and setting:
         a. /proc/mtk-perf/mt_customized_target
         - target free memory which is healthy for system

         b. /proc/mtk-perf/mt_info
         - shows the following information. "target" is aligned
           with mt_customized_target
           free=871024 KB
           cache=1244020 KB
           target=118052 KB

         c. mt_throttle_ms (default: 1 secoond)
         - event throttle time to prevent events too much.

        Feature Overhead
        - average ~12 us each time (evb6768/32bit)

        debug trace events:
         a. trigger_lowmem_hint
            - shows if low memory hint have triggered
         b. lowmem_hint_uevent
            - shows if uvent hint have been sent to userspace
              correctly

MTK-Commit-Id: c50b4e8265b8975a2887839e4ca827c584e008da

Change-Id: I8bc9e9ada6a889bae95e4fc7206155b770a4e1a5
CR-Id: ALPS04272373
Feature: System Performance
Signed-off-by: Jian-Min Liu <jian-min.liu@mediatek.com>
2021-01-29 00:39:34 +08:00
JianMin Liu
083ca602cf [ALPS04388817] perf: a tracker for performance index
[Detail]
    A kernel module for performance index which tracks
    memory/io/cpu stall ratio/cpu freq/dram freq/emi to
    help identify performance drop cause. It is a polling
    base design(interval 4 or 8ms) and default is off.
    Cost is estimated 6 ~ 15us per 4ms in average.

    How to enable this feature(default off)
       - kernel config: CONFIG_MTK_PERF_TRACKER=y
       - echo 1 > /sys/devices/system/cpu/perf/enable
    related trace events
       - perf_index_s, perf_index_l

    [ALPS04266006] perf: a tracker for performance index
    [ALPS04272373] perf: refactor perf tracker for flexibilty
    [ALPS04272373] perf: fix undeclared vaiable build error

MTK-Commit-Id: 99e380d56499e098da9c4c8639bc4374d8971fc1

Change-Id: Id4c1977448ecd28ba41802ce60b699a90bff0f0b
Feature: System Performance
CR-Id: ALPS04388817
Signed-off-by: Jian-Min Liu <jian-min.liu@mediatek.com>
2021-01-29 00:39:05 +08:00
chienwei.chang
eb4002a265 [ALPS04413516] [Do NOT Sync]Merge branch android-4.14-q into alps-trunk-q0.basic
[Detail]
	Parent: 4344de2f79
		Merge 4.14.108 into android-4.14
	Start: 02b2463554
		ANDROID: dm-bow: Add dm-bow feature
	Target: d5d9c959f5
		Merge 4.14.111 into android-4.14-q

MTK-Commit-Id: ed06e09c1713bb3e2b97245198dbfdae8669f4d8

Feature: Others
Change-Id: Ib81f191c6e12e7812313bddfcc7de94b3770156c
CR-Id: ALPS04413516
2021-01-29 00:38:50 +08:00
Kobe Wu
822cf70c5d [ALPS04355347] lockdep: enhance lock debugging function
1. verify lockdep lifetime
2. dump held locks when rcu stalls on CPU/task
3. adjust aee_dump position
4. improve lockdep selftest cases
5. print warning message to trace when printk is unusable
6. skip UBSAN checking in lockdep.c
7. add false alarm cases to filter

MTK-Commit-Id: a610ff8aa5a0d25a119898ceb69aae4cbb1213f6

Change-Id: Ieb7054ef94676f3b4d77c3c00706671d4e238826
CR-Id: ALPS04355347
Feature: [Module]Lockdep
Signed-off-by: Kobe Wu <kobe-cp.wu@mediatek.com>
2021-01-29 00:37:45 +08:00
Poting Chen
869d044805 [ALPS04331194] FPSGO: add FPSGO_V3
[Detail]
Support FPSGO_V3 framework for most FPS performance and
low power balance. As a perquisite to ensure FPS performance,
FPSGO_V3 persuades lowest power consumption for better DoU
endurance and gaming experience.
FPSGO_V3 include AI performance and low power.

MTK-Commit-Id: d93d71e1eed3220f213b85fef2947feb277a02cc

Change-Id: Icfe2a03c886d34abfefea7e443b19a6b50a50cf3
Signed-off-by: Poting Chen <poting.chen@mediatek.com>
CR-Id: ALPS04331194
Feature: FPSGO
2021-01-29 00:37:40 +08:00
chienwei.chang
8b95036430 [ALPS04364611] [Do NOT Sync]Merge branch android-4.14 into alps-trunk-q0.basic
[Detail]
	Parent: da2880fa47
		Merge 4.14.93 into android-4.14
	Start: 8a007427f6
		ANDROID: f2fs Complement android_fs tracepoint of read path
	Target: 4344de2f79
		Merge 4.14.108 into android-4.14

MTK-Commit-Id: bac56dd9552f982f7d0aad785bfb97de6f3e06e6

Feature: Others
Change-Id: Iff41f5ea1eb07b7571d29341653fec634b94a5ac
CR-Id: ALPS04364611
2021-01-29 00:37:28 +08:00