Commit graph android_kernel_sony_sdm845/kernel
Message SHA1
Merge "trace: ipc_logging: Avoid buffer overflow in ipc_log_string()" into msm-4.9
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-04-06 11:55:03 -07:00
9453ed4d18
perf: Add support for exclude_idle attribute
Enable the perf exclude_idle event attribute to avoid waking
possilby sleeping CPUS. The counter values are updated when CPU
enters idle. If the CPU is idle when perf reads the current
event value (of an exclude idle event) then the value from
when the CPU went idle is returned.
This commit supercedes the commits below. The context for the
commits below changed too much to enable cherry-picking.
commit 573979dee2a7 ("perf: Add support for exclude_idle attribute")
commit 54f6e4ae87be ("perf: Enable updating exclude_idle events
at idle")
commit 960dbb1751f3 ("perf: Skip permission checks on kernel owned
perf events")

Change-Id: Ib554c9fe106963ec1b42e72aeaf84fc73201bbb7
Signed-off-by: Patrick Fay <pfay@codeaurora.org>

Patrick Fay   commited 2017-04-05 10:47:28 -07:00
5b65b16f3b
Merge "qos: Disable irq notifier when qos request is removed" into msm-4.9
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-04-04 12:13:21 -07:00
9519093176
Merge "kernel/lib: add additional debug capabilities for data corruption" into msm-4.9
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-04-04 12:12:46 -07:00
5dae46224b
trace: ipc_logging: Avoid buffer overflow in ipc_log_string()
In ipc_log_string() the return value from vsnprintf(), data_size,
is used to increment ectxt.offset. However, this length could
actually be much larger than that of ectxt.buff itself. This is a
typical mistake of [v]snprintf() usage [1], in that it returns
not the number of characters written but how many characters
*would* have been written regardless of whether it was truncated.
The result is that even though ectxt.buff itself is not overrun,
the incorrect size in ectxt.offset will be later used as the length
parameter when memcpy()'ing to the ipc_log_page's data, overflowing
that memory and beyond. The write_page's write_offset would also
indicate an out-of-bounds (greater than PAGE_SIZE) length.

The fix is simple: use vscnprintf() instead of vsnprintf().

[1] https://lwn.net/Articles/69419/

Change-Id: I2e9d44e74f5f30a009732e31a554d82e31946999
Signed-off-by: Jack Pham <jackp@codeaurora.org>

Jack Pham   commited 2017-04-04 10:19:24 -07:00
f123c9aada
perf: enable perf to continue across hotplug
Currently perf hardware, software and tracepoint events are
deleted when a cpu is hotplugged out. This change restarts
the events after hotplug. In arm_pmu.c most of the code
for handline power collapse is reused for hotplug.
This change supercedes commit 1f0f95c5fe9e ("perf: add hotplug
support so that perf continues after hotplug") and uses the
new hotplug notification method.

Change-Id: Ia9de1c150558125e2da5f2c4354c268ce4b1154a
Signed-off-by: Patrick Fay <pfay@codeaurora.org>

Patrick Fay   commited 2017-04-03 19:20:57 -07:00
b02d7648fb
Merge "sched: hmp: Reduce number of load reports in a window" into msm-4.9
Linux Build Service Account   authored and   Gerrit - the friendly Code Review server   commited 2017-04-03 18:13:33 -07:00
e15713be0b
Merge remote-tracking branch '4.9/tmp-c96f651' into msm-4.9
* 4.9/tmp-c96f651:
  Linux 4.9.20
  usb: musb: fix possible spinlock deadlock
  sched/rt: Add a missing rescheduling point
  fscrypt: remove broken support for detecting keyring key revocation
  metag/ptrace: Reject partial NT_METAG_RPIPE writes
  metag/ptrace: Provide default TXSTATUS for short NT_PRSTATUS
  metag/ptrace: Preserve previous registers for short regset write
  sparc/ptrace: Preserve previous registers for short regset write
  mips/ptrace: Preserve previous registers for short regset write
  h8300/ptrace: Fix incorrect register transfer count
  c6x/ptrace: Remove useless PTRACE_SETREGSET implementation
  pinctrl: qcom: Don't clear status bit on irq_unmask
  virtio_balloon: init 1st buffer in stats vq
  KVM: x86: cleanup the page tracking SRCU instance
  xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder
  xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window
  xfrm: policy: init locks early
  ANDROID: ARM64: Allow to choose appended kernel image
  Linux 4.9.19
  crypto: algif_hash - avoid zero-sized array
  fbcon: Fix vc attr at deinit
  drm: reference count event->completion
  nl80211: fix dumpit error path RTNL deadlocks
  drm/bridge: analogix dp: Fix runtime PM state on driver bind
  device-dax: fix pmd/pte fault fallback handling
  libceph: don't set weight to IN when OSD is destroyed
  Drivers: hv: vmbus: Don't leak memory when a channel is rescinded
  Drivers: hv: vmbus: Don't leak channel ids
  intel_th: Don't leak module refcount on failure to activate
  jbd2: don't leak memory if setting up journal fails
  auxdisplay: img-ascii-lcd: add missing sentinel entry in img_ascii_lcd_matches
  drm/amdgpu: reinstate oland workaround for sclk
  blk-mq: don't complete un-started request in timeout handler
  cgroup, net_cls: iterate the fds of only the tasks which are being migrated
  cpufreq: Restore policy min/max limits on CPU online
  arm64: kaslr: Fix up the kernel image alignment
  ARM: at91: pm: cpu_idle: switch DDR to power-down mode
  Revert "ARM: at91/dt: sama5d2: Use new compatible for ohci node"
  iommu/vt-d: Fix NULL pointer dereference in device_to_iommu
  xen/acpi: upload PM state from init-domain to Xen
  crypto: ccp - Assign DMA commands to the channel's CCP
  mwifiex: pcie: don't leak DMA buffers when removing
  clk: sunxi-ng: mp: Adjust parent rate for pre-dividers
  clk: sunxi-ng: sun6i: Fix enable bit offset for hdmi-ddc module clock
  hwrng: geode - Revert managed API changes
  hwrng: amd - Revert managed API changes
  mmc: sdhci-pci: Do not disable interrupts in sdhci_intel_set_power
  mmc: sdhci: Do not disable interrupts while waiting for clock
  mmc: sdhci-of-arasan: fix incorrect timeout clock
  mmc: sdhci-of-at91: Support external regulators
  powerpc/64s: Fix idle wakeup potential to clobber registers
  ext4: lock the xattr block before checksuming it
  ext4: mark inode dirty after converting inline directory
  parport: fix attempt to write duplicate procfiles
  iio: magnetometer: ak8974: remove incorrect __exit markups
  iio: hid-sensor-trigger: Change get poll value function order to avoid sensor properties losing after resume from S3
  iio: sw-device: Fix config group initialization
  iio: adc: ti_am335x_adc: fix fifo overrun recovery
  mmc: ushc: fix NULL-deref at probe
  uwb: hwa-rc: fix NULL-deref at probe
  uwb: i1480-dfu: fix NULL-deref at probe
  USB: usbtmc: fix probe error path
  USB: usbtmc: add missing endpoint sanity check
  usb: hub: Fix crash after failure to read BOS descriptor
  usb: musb: cppi41: don't check early-TX-interrupt for Isoch transfer
  USB: wusbcore: fix NULL-deref at probe
  USB: idmouse: fix NULL-deref at probe
  USB: lvtest: fix NULL-deref at probe
  USB: uss720: fix NULL-deref at probe
  usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk
  usb: gadget: f_uvc: Fix SuperSpeed companion descriptor's wBytesPerInterval
  ACM gadget: fix endianness in notifications
  USB: serial: qcserial: add Dell DW5811e
  USB: serial: option: add Quectel UC15, UC20, EC21, and EC25 modems
  ALSA: hda - Adding a group of pin definition to fix headset problem
  ALSA: ctxfi: Fix the incorrect check of dma_set_mask() call
  ALSA: seq: Fix racy cell insertions during snd_seq_pool_done()
  Input: sur40 - validate number of endpoints before using them
  Input: kbtab - validate number of endpoints before using them
  Input: cm109 - validate number of endpoints before using them
  Input: yealink - validate number of endpoints before using them
  Input: hanwang - validate number of endpoints before using them
  Input: ims-pcu - validate number of endpoints before using them
  Input: iforce - validate number of endpoints before using them
  Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000
  Input: elan_i2c - add ASUS EeeBook X205TA special touchpad fw
  Input: ALPS - fix trackstick button handling on V8 devices
  Input: ALPS - fix V8+ protocol handling (73 03 28)
  tcp: initialize icsk_ack.lrcvtime at session start time
  socket, bpf: fix sk_filter use after free in sk_clone_lock
  ipv4: provide stronger user input validation in nl_fib_input()
  net: bcmgenet: remove bcmgenet_internal_phy_setup()
  ipv6: make sure to initialize sockc.tsflags before first use
  net/mlx5e: Count LRO packets correctly
  net/mlx5e: Count GSO packets correctly
  net/mlx5: Increase number of max QPs in default profile
  net/mlx5e: Use the proper UAPI values when offloading TC vlan actions
  net/mlx5: Add missing entries for set/query rate limit commands
  net: vrf: Reset rt6i_idev in local dst after put
  qmi_wwan: add Dell DW5811e
  net: unix: properly re-increment inflight counter of GC discarded candidates
  openvswitch: Add missing case OVS_TUNNEL_KEY_ATTR_PAD
  amd-xgbe: Fix jumbo MTU processing on newer hardware
  net: properly release sk_frag.page
  net: bcmgenet: Do not suspend PHY if Wake-on-LAN is enabled
  net/openvswitch: Set the ipv6 source tunnel key address attribute correctly

Change-Id: I83a11caf9ef417ddfc78b8ed688d10d8e3c9cb1a
Signed-off-by: Kyle Yan <kyan@codeaurora.org>

Kyle Yan   commited 2017-04-03 10:20:10 -07:00
0078bd9a60
sched: hmp: Reduce number of load reports in a window
There's no use reporting load more than once in a window
via the cpufreq_update_util path (unless there's a migration).
Set the load_reported_window flag in sched_get_cpus_busy
to remove these redundant updates.

Change-Id: If43dd5abc7e0e52a8e0f0df3a20ca99ed92f5361
Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>

Vikram Mulukutla   commited 2017-03-31 17:10:18 -07:00
2a6993612b
This is the 4.9.20 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAljeFAkACgkQONu9yGCS
 aT5MGRAAhBw+wSgkRvHRc0+kecrqGgBsNli47FNH4yRsMCNNgxbDEg8+xDDj8MBH
 lHOAFq2eXxyej5S0yZso8c1uB5Q6imILElBFZEuoxuyFQg+rQ9q8sBp726/PH0MO
 TUlg8OAOcdzLNibCbTKT/sPfBFU+d5Jb2qErEFfssUO5h/GpJhjHYJBXC5q+TBLZ
 Fx1Laajx9GyOCwriYizju/NizVlEX51jiqMpetX/nkHTJWyq8VfKnCg69kNnBzbe
 XFJ1nSsfHbckiP15jrHtsNCIq4vX+2W6WRu05+YK2irwunEADb6Ak5pF1N75LfGV
 ssP+EZU9P/i9gl8DL/8Um7OY2x7N7/Hew/qyHOCly0mo67PL4Nj+byoq/k0Oe7+m
 KaAjnHhMjJGBJLiU+Xy5cPzkJb9dxFPPTu3PqwKiUrfqIaTPUQjHv7d2z3HzSl1t
 6s6S1y65MTOiTLbcRMAdJvF//PhyQar/91KE2sszVyoPqgT1hP+aUhjD+bf52ex9
 LnwMMBcMHObm8B8z/WzStho/1bxWD9wTC7MA8JtuCg8tWrEx9cnRtHsFh9IKwbQp
 00mk9kHBaDgxDaeCe1zz9GHcicP8rsLD/0HOjJCLmiWIIel50XRQZG2DjvYSCjss
 FyFbQ3SoACzyFPUPOQSLbw5ejrSRNL3emQcGxvyXz9U4P8rGJ3I=
 =8qjI
 -----END PGP SIGNATURE-----

Merge 4.9.20 into android-4.9

Changes in 4.9.20:
	xfrm: policy: init locks early
	xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window
	xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder
	KVM: x86: cleanup the page tracking SRCU instance
	virtio_balloon: init 1st buffer in stats vq
	pinctrl: qcom: Don't clear status bit on irq_unmask
	c6x/ptrace: Remove useless PTRACE_SETREGSET implementation
	h8300/ptrace: Fix incorrect register transfer count
	mips/ptrace: Preserve previous registers for short regset write
	sparc/ptrace: Preserve previous registers for short regset write
	metag/ptrace: Preserve previous registers for short regset write
	metag/ptrace: Provide default TXSTATUS for short NT_PRSTATUS
	metag/ptrace: Reject partial NT_METAG_RPIPE writes
	fscrypt: remove broken support for detecting keyring key revocation
	sched/rt: Add a missing rescheduling point
	usb: musb: fix possible spinlock deadlock
	Linux 4.9.20

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Greg Kroah-Hartman   commited 2017-03-31 11:07:16 +02:00
c96f651270
sched/rt: Add a missing rescheduling point
commit 619bd4a71874a8fd78eb6ccf9f272c5e98bcc7b7 upstream.

Since the change in commit:

  fd7a4bed18 ("sched, rt: Convert switched_{from, to}_rt() / prio_changed_rt() to balance callbacks")

... we don't reschedule a task under certain circumstances:

Lets say task-A, SCHED_OTHER, is running on CPU0 (and it may run only on
CPU0) and holds a PI lock. This task is removed from the CPU because it
used up its time slice and another SCHED_OTHER task is running. Task-B on
CPU1 runs at RT priority and asks for the lock owned by task-A. This
results in a priority boost for task-A. Task-B goes to sleep until the
lock has been made available. Task-A is already runnable (but not active),
so it receives no wake up.

The reality now is that task-A gets on the CPU once the scheduler decides
to remove the current task despite the fact that a high priority task is
enqueued and waiting. This may take a long time.

The desired behaviour is that CPU0 immediately reschedules after the
priority boost which made task-A the task with the lowest priority.

Suggested-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: fd7a4bed18 ("sched, rt: Convert switched_{from, to}_rt() prio_changed_rt() to balance callbacks")
Link: http://lkml.kernel.org/r/20170124144006.29821-1-bigeasy@linutronix.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Sebastian Andrzej Siewior   authored and   Greg Kroah-Hartman   commited 2017-03-31 10:31:46 +02:00
916c5cfeab
sched: cpufreq: HMP load reporting changes
Since HMP uses WALT, ensure that load is reported just once per window,
with the exception of intercluster migrations. Further, try to report load
whenever WALT stats are updated.

Change-Id: I6539f8c916f6f271cf26f03249de7f953d5b12c2
Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>

Vikram Mulukutla   authored and   Rohit Gupta   commited 2017-03-29 17:20:06 -07:00
4b54aae63a
kernel/lib: add additional debug capabilities for data corruption
Data corruptions in the kernel often end up in system crashes that
are easier to debug closer to the time of detection. Specifically,
if we do not panic immediately after lock or list corruptions have been
detected, the problem context is lost in the ensuing system mayhem.
Add support for allowing system crash immediately after such corruptions
are detected. The CONFIG option controls the enabling/disabling of the
feature.

Change-Id: I9b2eb62da506a13007acff63e85e9515145909ff
Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>

Syed Rameez Mustafa   authored and   Patrick Daly   commited 2017-03-29 13:02:14 -07:00
cf9c1e45e7
Merge remote-tracking branch '4.9/tmp-6bf53d4' into msm-4.9
* 4.9/tmp-6bf53d4:
  FROMLIST: net: ipv6: Add sysctl for minimum prefix len acceptable in RIOs
  Linux 4.9.18
  ext4: fix fencepost in s_first_meta_bg validation
  drm/amdgpu/si: add dpm quirk for Oland
  cgroup/pids: remove spurious suspicious RCU usage warning
  percpu: acquire pcpu_lock when updating pcpu_nr_empty_pop_pages
  gfs2: Avoid alignment hole in struct lm_lockname
  isdn/gigaset: fix NULL-deref at probe
  target: Fix VERIFY_16 handling in sbc_parse_cdb
  scsi: libiscsi: add lock around task lists to fix list corruption regression
  scsi: lpfc: Add shutdown method for kexec
  target/pscsi: Fix TYPE_TAPE + TYPE_MEDIMUM_CHANGER export
  md/raid1/10: fix potential deadlock
  powerpc/boot: Fix zImage TOC alignment
  cpufreq: Fix and clean up show_cpuinfo_cur_freq()
  NFS prevent double free in async nfs4_exchange_id
  xprtrdma: Squelch kbuild sparse complaint
  perf/core: Fix event inheritance on fork()
  perf/core: Fix use-after-free in perf_release()
  parisc: Fix system shutdown halt
  parisc: Optimize flush_kernel_vmap_range and invalidate_kernel_vmap_range
  qla2xxx: Fix request queue corruption.
  qla2xxx: Fix memory leak for abts processing
  give up on gcc ilog2() constant optimizations
  drm/vc4: Use runtime autosuspend to avoid thrashing V3D power state.
  drm/vc4: Fix termination of the initial scan for branch targets.
  ANDROID: sdcardfs: Fix style issues in macros
  ANDROID: sdcardfs: Use seq_puts over seq_printf
  ANDROID: sdcardfs: Use to kstrout
  ANDROID: sdcardfs: Use pr_[...] instead of printk
  ANDROID: sdcardfs: remove unneeded null check
  ANDROID: sdcardfs: Fix style issues with comments
  ANDROID: sdcardfs: Fix formatting
  ANDROID: sdcardfs: correct order of descriptors
  ANDROID: fix the deadlock in xt_qtaguid when enable DDEBUG

Change-Id: Iab1dd539faba7429e4cb76cc6bf9c325479b5f47
Signed-off-by: Kyle Yan <kyan@codeaurora.org>

Kyle Yan   commited 2017-03-29 05:03:45 -07:00
4891f6a567
This is the 4.9.18 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAljXoLQACgkQONu9yGCS
 aT7F0xAA18J3AhCcqlYhj7OXAgLCtgop4ftDb+tYbUEirbiU3q+M5GtkDTFiI2m/
 z/KUyCbteeYBSzUg3TlFjupbCFlBOs9uVKStDoQoqmMD2gwUmljEpzRqcXHe0vWx
 4YCqwDzizHFzS2LSwWtXDPauP3YqVvuif05x2pz9kPzmYoXSytR+YTtMDHI2sNH4
 1IlXWvJJfYiWhHxhsvQOAuNwZyDfYDNxF1gdLdcNQ8A880VA8DtdZRFypwq6loBW
 r1E3KHPHhpLLJ447rpxJ+ns7gRoCDoj5eDGtvkLTHKIY3Nkf+hfxeTEW7ZmcyJ+f
 4KvxakQnITjY3RkuKA1kU34gl+IWNMHn0a+ETOLGksUqlQUtpkaNe3Br6o2IY8JK
 UaCFCIaOCv0N3t1sCxkisWiLq1y/nSff+dJ2biD4cue9rZZZEi5B0BgrikVx5Ft9
 jvZEO6S8fQUOHLRgb3+ubWQpF8h5ETEXyIsAzg2lcmx5+/c+ql63026fibOamjAQ
 r3ZYI60Uin/SDfDyZ7rxuthgZQnLLJ3xBunja3ccBKscoiffDlF/fFFgNDpKoFu0
 CcqGbiuGi0veocXnTSFj9sehocli8Aor7cbNmTWvkXpZzcd9kyzEl2gW05CGaK2I
 CEcQWde4cRmKrONNSIfyQngeaC84OoyRGECoIcRCvzbkfxRrVSI=
 =s1Fv
 -----END PGP SIGNATURE-----

Merge 4.9.18 into android-4.9

Changes in 4.9.18:
	drm/vc4: Fix termination of the initial scan for branch targets.
	drm/vc4: Use runtime autosuspend to avoid thrashing V3D power state.
	give up on gcc ilog2() constant optimizations
	qla2xxx: Fix memory leak for abts processing
	qla2xxx: Fix request queue corruption.
	parisc: Optimize flush_kernel_vmap_range and invalidate_kernel_vmap_range
	parisc: Fix system shutdown halt
	perf/core: Fix use-after-free in perf_release()
	perf/core: Fix event inheritance on fork()
	xprtrdma: Squelch kbuild sparse complaint
	NFS prevent double free in async nfs4_exchange_id
	cpufreq: Fix and clean up show_cpuinfo_cur_freq()
	powerpc/boot: Fix zImage TOC alignment
	md/raid1/10: fix potential deadlock
	target/pscsi: Fix TYPE_TAPE + TYPE_MEDIMUM_CHANGER export
	scsi: lpfc: Add shutdown method for kexec
	scsi: libiscsi: add lock around task lists to fix list corruption regression
	target: Fix VERIFY_16 handling in sbc_parse_cdb
	isdn/gigaset: fix NULL-deref at probe
	gfs2: Avoid alignment hole in struct lm_lockname
	percpu: acquire pcpu_lock when updating pcpu_nr_empty_pop_pages
	cgroup/pids: remove spurious suspicious RCU usage warning
	drm/amdgpu/si: add dpm quirk for Oland
	ext4: fix fencepost in s_first_meta_bg validation
	Linux 4.9.18

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Greg Kroah-Hartman   commited 2017-03-29 13:56:47 +02:00
6bf53d4143
Merge "Merge remote-tracking branch '4.9/tmp-82ab074' into 4.9" into msm-4.9
Channagoud Kadabi   authored and   Gerrit - the friendly Code Review server   commited 2017-03-28 10:59:22 -07:00
577379aa74
Merge "sched/core_ctl: Fix state_lock spinlock contention" into msm-4.9
Kyle Yan   authored and   Gerrit - the friendly Code Review server   commited 2017-03-28 04:00:23 -07:00
20e0464bf0
Merge remote-tracking branch '4.9/tmp-82ab074' into 4.9
* 4.9/tmp-82ab074:
  Linux 4.9.17
  crypto: powerpc - Fix initialisation of crc32c context
  locking/rwsem: Fix down_write_killable() for CONFIG_RWSEM_GENERIC_SPINLOCK=y
  futex: Add missing error handling to FUTEX_REQUEUE_PI
  futex: Fix potential use-after-free in FUTEX_REQUEUE_PI
  x86/perf: Fix CR4.PCE propagation to use active_mm instead of mm
  x86/kasan: Fix boot with KASAN=y and PROFILE_ANNOTATED_BRANCHES=y
  x86/tsc: Fix ART for TSC_KNOWN_FREQ
  irqchip/gicv3-its: Add workaround for QDF2400 ITS erratum 0065
  arm64: KVM: VHE: Clear HCR_TGE when invalidating guest TLBs
  drm/vc4: Fix ->clock_select setting for the VEC encoder
  drm/vc4: Fix race between page flip completion event and clean-up
  clk: bcm2835: Fix ->fixed_divider of pllh_aux
  powerpc/mm: Fix build break when CMA=n && SPAPR_TCE_IOMMU=y
  usb: gadget: udc: atmel: remove memory leak
  serial: 8250_pci: Detach low-level driver during PCI error recovery
  ACPI / blacklist: Make Dell Latitude 3350 ethernet work
  ACPI / blacklist: add _REV quirks for Dell Precision 5520 and 3520
  slub: move synchronize_sched out of slab_mutex on shrink
  uvcvideo: uvc_scan_fallback() for webcams with broken chain
  s390/zcrypt: Introduce CEX6 toleration
  block: allow WRITE_SAME commands with the SG_IO ioctl
  drm/nouveau/disp/nv50-: specify ctrl/user separately when constructing classes
  drm/nouveau/disp/nv50-: split chid into chid.ctrl and chid.user
  drm/nouveau/disp/gp102: fix cursor/overlay immediate channel indices
  vfio/spapr: Postpone default window creation
  vfio/spapr: Add a helper to create default DMA window
  powerpc/mm/iommu, vfio/spapr: Put pages on VFIO container shutdown
  vfio/spapr: Reference mm in tce_container
  powerpc/iommu: Stop using @current in mm_iommu_xxx
  powerpc/iommu: Pass mm_struct to init/cleanup helpers
  vfio/spapr: Postpone allocation of userspace version of TCE table
  Drivers: hv: ring_buffer: count on wrap around mappings in get_next_pkt_raw() (v2)
  ibmveth: calculate gso_segs for large packets
  PCI: Do any VF BAR updates before enabling the BARs
  PCI: Ignore BAR updates on virtual functions
  PCI: Update BARs using property bits appropriate for type
  PCI: Don't update VF BARs while VF memory space is enabled
  PCI: Decouple IORESOURCE_ROM_ENABLE and PCI_ROM_ADDRESS_ENABLE
  PCI: Add comments about ROM BAR updating
  PCI: Remove pci_resource_bar() and pci_iov_resource_bar()
  PCI: Separate VF BAR updates from standard BAR updates
  x86/hyperv: Handle unknown NMIs on one CPU when unknown_nmi_panic
  scsi: ibmvscsis: Synchronize cmds at remove time
  scsi: ibmvscsis: Synchronize cmds at tpg_enable_store time
  scsi: ibmvscsis: Rearrange functions for future patches
  scsi: ibmvscsis: Clean up properly if target_submit_cmd/tmr fails
  scsi: ibmvscsis: Return correct partition name/# to client
  scsi: ibmvscsis: Issues from Dan Carpenter/Smatch
  igb: add i211 to i210 PHY workaround
  igb: Workaround for igb i210 firmware issue
  xen: do not re-use pirq number cached in pci device msi msg data
  dmaengine: iota: ioat_alloc_chan_resources should not perform sleeping allocations.
  bpf: fix mark_reg_unknown_value for spilled regs on map value marking
  bpf: fix regression on verifier pruning wrt map lookups
  bpf: fix state equivalence
  bpf: Detect identical PTR_TO_MAP_VALUE_OR_NULL registers
  dccp: fix memory leak during tear-down of unsuccessful connection request
  tun: fix premature POLLOUT notification on tun devices
  dccp/tcp: fix routing redirect race
  bridge: drop netfilter fake rtable unconditionally
  ipv6: avoid write to a possibly cloned skb
  ipv6: make ECMP route replacement less greedy
  mpls: Do not decrement alive counter for unregister events
  mpls: Send route delete notifications when router module is unloaded
  act_connmark: avoid crashing on malformed nlattrs with null parms
  uapi: fix linux/packet_diag.h userspace compilation error
  net/tunnel: set inner protocol in network gro hooks
  vrf: Fix use-after-free in vrf_xmit
  dccp: fix use-after-free in dccp_feat_activate_values
  net/sched: act_skbmod: remove unneeded rcu_read_unlock in tcf_skbmod_dump
  net: fix socket refcounting in skb_complete_tx_timestamp()
  net: fix socket refcounting in skb_complete_wifi_ack()
  tcp: fix various issues for sockets morphing to listen state
  strparser: destroy workqueue on module exit
  dccp: Unlock sock before calling sk_free()
  ipv6: orphan skbs in reassembly unit
  net: net_enable_timestamp() can be called from irq contexts
  net: don't call strlen() on the user buffer in packet_bind_spkt()
  net: bridge: allow IPv6 when multicast flood is disabled
  tcp/dccp: block BH for SYN processing
  mlxsw: spectrum_router: Avoid potential packets loss
  geneve: lock RCU on TX path
  vxlan: lock RCU on TX path
  net: phy: Avoid deadlock during phy_error()
  l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv
  net sched actions: decrement module reference count after table flush.
  ipv4: mask tos for input route
  vxlan: don't allow overwrite of config src addr
  vti6: return GRE_KEY for vti6
  vxlan: correctly validate VXLAN ID against VXLAN_N_VID
  net/mlx5e: Fix wrong CQE decompression
  net/mlx5e: Do not reduce LRO WQE size when not using build_skb
  net/mlx5e: Register/unregister vport representors on interface attach/detach
  ANDROID: mmc: core: export emmc revision
  ANDROID: sdcardfs: Fix gid issue
  ANDROID: sdcardfs: Remove uninformative prints
  ANDROID: sdcardfs: move path_put outside of spinlock
  ANDROID: sdcardfs: Use case insensitive hash function
  ANDROID: sdcardfs: declare MODULE_ALIAS_FS
  ANDROID: sdcardfs: Get the blocksize from the lower fs
  ANDROID: sdcardfs: Use d_invalidate instead of drop_recurisve
  ANDROID: sdcardfs: Switch to internal case insensitive compare
  ANDROID: sdcardfs: Use spin_lock_nested
  ANDROID: sdcardfs: Replace get/put with d_lock
  ANDROID: sdcardfs: rate limit warning print
  ANDROID: sdcardfs: Fix case insensitive lookup
  ANDROID: sdcardfs: support direct-IO (DIO) operations
  ANDROID: sdcardfs: implement vm_ops->page_mkwrite
  ANDROID: sdcardfs: Don't bother deleting freelist
  ANDROID: sdcardfs: Add missing path_put
  ANDROID: sdcardfs: Fix incorrect hash
  ANDROID: export security_path_chown
  ANDROID: sdcardfs: Switch strcasecmp for internal call
  ANDROID: sdcardfs: switch to full_name_hash and qstr
  ANDROID: sdcardfs: Add GID Derivation to sdcardfs
  ANDROID: sdcardfs: Remove redundant operation
  ANDROID: sdcardfs: add support for user permission isolation
  ANDROID: sdcardfs: Refactor configfs interface
  ANDROID: sdcardfs: Allow non-owners to touch
  ANDROID: binder: add padding to binder_fd_array_object.
  ANDROID: binder: use group leader instead of open thread
  BACKPORT: mmc: core: Export device lifetime information through sysfs
  ANDROID: android-verity: do not compile as independent module

Change-Id: I7d409ec3e84eaa7f499c951d38f4cba2614415f7
Signed-off-by: Kyle Yan <kyan@codeaurora.org>

Kyle Yan   commited 2017-03-27 13:25:25 -07:00
110cce4ad4
core_ctl: Bail out early from the boost API when core_ctl is disabled
core_ctl can be completely disabled from a kernel parameter now.
Add a check to bail out early from the boost API.

Change-Id: Ib825500b0cb2c06af2cfcb82e5d79f91e9dd7b3b
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

Pavankumar Kondeti   commited 2017-03-27 09:59:11 +05:30
d198dde643
core_ctl: Add a kernel parameter to disable core_ctl
Add a kernel parameter called "core_ctl_disable_cpumask" to
specify the CPUs for which core_ctl is not needed. As
core_ctl operates on a cluster basis, all of the CPUs in a
given cluster must be specified to disable core_ctl on that
cluster.

Change-Id: Idfdc5b3aa9f54bafe20489e5ded9d96da6eff21c
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

Pavankumar Kondeti   commited 2017-03-27 09:59:04 +05:30
1e951a7ff0
sched/core_ctl: Fix state_lock spinlock contention
There is no need to call core_ctl_check() from scheduler tick path
on all CPUs. This results in core_ctl's state_lock spin lock
contention. Assign this job to the CPU which is responsible
for updating the ticks.

Change-Id: I9664037cc25c204d532bdd0f006c7e27ef143497
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

Pavankumar Kondeti   commited 2017-03-27 09:54:18 +05:30
e9afb1aa77
cgroup/pids: remove spurious suspicious RCU usage warning
commit 1d18c2747f937f1b5ec65ce6bf4ccb9ca1aea9e8 upstream.

pids_can_fork() is special in that the css association is guaranteed
to be stable throughout the function and thus doesn't need RCU
protection around task_css access.  When determining the css to charge
the pid, task_css_check() is used to override the RCU sanity check.

While adding a warning message on fork rejection from pids limit,
135b8b37bd ("cgroup: Add pids controller event when fork fails
because of pid limit") incorrectly added a task_css access which is
neither RCU protected or explicitly annotated.  This triggers the
following suspicious RCU usage warning when RCU debugging is enabled.

  cgroup: fork rejected by pids controller in

  ===============================
  [ ERR: suspicious RCU usage.  ]
  4.10.0-work+ #1 Not tainted
  -------------------------------
  ./include/linux/cgroup.h:435 suspicious rcu_dereference_check() usage!

  other info that might help us debug this:

  rcu_scheduler_active = 2, debug_locks = 0
  1 lock held by bash/1748:
   #0:  (&cgroup_threadgroup_rwsem){+++++.}, at: [<ffffffff81052c96>] _do_fork+0xe6/0x6e0

  stack backtrace:
  CPU: 3 PID: 1748 Comm: bash Not tainted 4.10.0-work+ #1
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-1.fc25 04/01/2014
  Call Trace:
   dump_stack+0x68/0x93
   lockdep_rcu_suspicious+0xd7/0x110
   pids_can_fork+0x1c7/0x1d0
   cgroup_can_fork+0x67/0xc0
   copy_process.part.58+0x1709/0x1e90
   _do_fork+0xe6/0x6e0
   SyS_clone+0x19/0x20
   do_syscall_64+0x5c/0x140
   entry_SYSCALL64_slow_path+0x25/0x25
  RIP: 0033:0x7f7853fab93a
  RSP: 002b:00007ffc12d05c90 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
  RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7853fab93a
  RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
  RBP: 00007ffc12d05cc0 R08: 0000000000000000 R09: 00007f78548db700
  R10: 00007f78548db9d0 R11: 0000000000000246 R12: 00000000000006d4
  R13: 0000000000000001 R14: 0000000000000000 R15: 000055e3ebe2c04d
  /asdf

There's no reason to dereference task_css again here when the
associated css is already available.  Fix it by replacing the
task_cgroup() call with css->cgroup.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Mike Galbraith <efault@gmx.de>
Fixes: 135b8b37bd ("cgroup: Add pids controller event when fork fails because of pid limit")
Cc: Kenny Yu <kennyyu@fb.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Tejun Heo   authored and   Greg Kroah-Hartman   commited 2017-03-26 13:05:58 +02:00
228514bf24
perf/core: Fix event inheritance on fork()
commit e7cc4865f0f31698ef2f7aac01a50e78968985b7 upstream.

While hunting for clues to a use-after-free, Oleg spotted that
perf_event_init_context() can loose an error value with the result
that fork() can succeed even though we did not fully inherit the perf
event context.

Spotted-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: oleg@redhat.com
Fixes: 889ff01506 ("perf/core: Split context's event group list into pinned and non-pinned lists")
Link: http://lkml.kernel.org/r/20170316125823.190342547@infradead.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Peter Zijlstra   authored and   Greg Kroah-Hartman   commited 2017-03-26 13:05:57 +02:00
69efd8e212
perf/core: Fix use-after-free in perf_release()
commit e552a8389aa409e257b7dcba74f67f128f979ccc upstream.

Dmitry reported syzcaller tripped a use-after-free in perf_release().

After much puzzlement Oleg spotted the below scenario:

  Task1                           Task2

  fork()
    perf_event_init_task()
    /* ... */
    goto bad_fork_$foo;
    /* ... */
    perf_event_free_task()
      mutex_lock(ctx->lock)
      perf_free_event(B)

                                  perf_event_release_kernel(A)
                                    mutex_lock(A->child_mutex)
                                    list_for_each_entry(child, ...) {
                                      /* child == B */
                                      ctx = B->ctx;
                                      get_ctx(ctx);
                                      mutex_unlock(A->child_mutex);

        mutex_lock(A->child_mutex)
        list_del_init(B->child_list)
        mutex_unlock(A->child_mutex)

        /* ... */

      mutex_unlock(ctx->lock);
      put_ctx() /* >0 */
    free_task();
                                      mutex_lock(ctx->lock);
                                      mutex_lock(A->child_mutex);
                                      /* ... */
                                      mutex_unlock(A->child_mutex);
                                      mutex_unlock(ctx->lock)
                                      put_ctx() /* 0 */
                                        ctx->task && !TOMBSTONE
                                          put_task_struct() /* UAF */

This patch closes the hole by making perf_event_free_task() destroy the
task <-> ctx relation such that perf_event_release_kernel() will no longer
observe the now dead task.

Spotted-by: Oleg Nesterov <oleg@redhat.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: fweisbec@gmail.com
Cc: oleg@redhat.com
Fixes: c6e5b73242 ("perf: Synchronously clean up child events")
Link: http://lkml.kernel.org/r/20170314155949.GE32474@worktop
Link: http://lkml.kernel.org/r/20170316125823.140295131@infradead.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Peter Zijlstra   authored and   Greg Kroah-Hartman   commited 2017-03-26 13:05:57 +02:00
c04a938229
Merge "sched: Call sched_exit() when a task is exiting" into msm-4.9
Kyle Yan   authored and   Gerrit - the friendly Code Review server   commited 2017-03-25 04:00:34 -07:00
9767aee57b
Merge "trace: cpu_freq_switch: Add profiler for CPU frequency switch times" into msm-4.9
Kyle Yan   authored and   Gerrit - the friendly Code Review server   commited 2017-03-25 04:00:22 -07:00
239ad2dcc2
sched: Call sched_exit() when a task is exiting
The scheduler needs to do some book-keeping when a task exits.
Call the scheduler hook sched_exit() that takes care of all of
that necessary book-keeping.

Change-Id: I551aead70248b06f9d918e6d032075d6ecaa7fed
Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>

Syed Rameez Mustafa   commited 2017-03-24 15:57:31 -07:00
d5b9f97f3c
sched: don't assume higher capacity means higher power in tick migration
When an upmigrate ineligible task running on the maximum capacity CPU,
we check if it can be migrated to a lower capacity CPU in tick path.
Add a power cost based check there to prevent the task migration
from a power efficient CPU.

Change-Id: I291c62d7dbf169d5123faba5f5246ad44a7a40dd
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

Pavankumar Kondeti   authored and   Gerrit - the friendly Code Review server   commited 2017-03-24 10:55:25 -07:00
4fed24d120
sched: optimize cpumask operations during task placement
Compute the CPU search mask once by taking task affinity,
cpu_active_mask and cpu_isolated_mask into account and cache
it in cpu_selection_env. This prevents doing the same cpumask
operations multiple times.

Change-Id: I78f35c59e6ee9437b3a522ac7ad856c0251f81ec
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

Pavankumar Kondeti   authored and   Gerrit - the friendly Code Review server   commited 2017-03-24 10:55:16 -07:00
52296641a3
sched: don't select an inactive/isolated CPU in sbc()
In select_best_cpu(), if no CPU is selected from the candidate
cluster, the search is expanded to the backup cluster. The
current code may select an inactive/isolated CPU in the
backup cluster. Fix this.

Change-Id: Id1e8a2b2f84ea274cdeda408957490ca05ef5fdb
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

Pavankumar Kondeti   authored and   Gerrit - the friendly Code Review server   commited 2017-03-24 10:55:10 -07:00
068743c10e
sched: Fix load tracking bug to avoid adding phantom task demand
When update_task_ravg() is called with the TASK_UPDATE event on a task
that is not on the runqueue, task demand accounting incorrectly treats
the time delta as execution time. This can happen when a sleeping
task is moved to/from colocation groups. This phantom execution time can
cause unpredictable changes to demand that in turn can result in
incorrect task placement. Fix the issue by adding special handling of
TASK_UPDATE in task demand accounting. CPU busy time accounting already
has all the necessary checks.

Change-Id: Ibb42d83ac353bf2e849055fa3cb5c22e7acd56de
Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>

Syed Rameez Mustafa   authored and   Gerrit - the friendly Code Review server   commited 2017-03-24 10:54:02 -07:00
b1bfa78b62
Merge "sched: fix bug in auto adjustment of group upmigrate/downmigrate" into msm-4.9
Kyle Yan   authored and   Gerrit - the friendly Code Review server   commited 2017-03-24 10:42:45 -07:00
82175be6ea
qos: Disable irq notifier when qos request is removed
When a qos request is added with IRQ affinity, irq notifier
for that irq is added and with out disabling the irq
notifier if the irq is free it is through a warning.
So disable irq notifier when the qos request is removed.

Change-Id: I50faa4ecbe1b632c0f0f203ca52faf18753c33d4
Signed-off-by: Srinivas Rao L <lsrao@codeaurora.org>

Srinivas Rao L   authored and   Gerrit - the friendly Code Review server   commited 2017-03-23 13:48:24 -07:00
8bcb8eac5d
Merge "sched: remove sched_new_task_windows tunable" into msm-4.9
Kyle Yan   authored and   Gerrit - the friendly Code Review server   commited 2017-03-23 10:20:05 -07:00
aff73b63fc
Merge "core_ctl: remove "cpus" sysfs file that prints CPU online status" into msm-4.9
Kyle Yan   authored and   Gerrit - the friendly Code Review server   commited 2017-03-23 10:20:04 -07:00
2444a62475
Merge "core_ctl: use pr_fmt" into msm-4.9
Kyle Yan   authored and   Gerrit - the friendly Code Review server   commited 2017-03-23 10:20:03 -07:00
3b0d26c513
Merge "core_ctl: kill maintenance of online state" into msm-4.9
Kyle Yan   authored and   Gerrit - the friendly Code Review server   commited 2017-03-23 10:20:03 -07:00
66e7c96a10
Merge "core_ctl: fix bug in assignment of not_preferred tunable values" into msm-4.9
Kyle Yan   authored and   Gerrit - the friendly Code Review server   commited 2017-03-23 10:20:02 -07:00
5d467eb3cd
Merge "core_ctl: redo offline_delay_ms tunable implementation" into msm-4.9
Kyle Yan   authored and   Gerrit - the friendly Code Review server   commited 2017-03-23 10:20:01 -07:00
4076c838fd
drivers: Fix more compiler warnings
Fix uninitialized variable warnings that were not previously caught by
old compiler.

Change-Id: I5014a235da41d32a3a1ae234286270ec9af875fc
Signed-off-by: Kyle Yan <kyan@codeaurora.org>

Kyle Yan   commited 2017-03-22 19:20:23 -07:00
74fdd73187
locking/rwsem: Fix down_write_killable() for CONFIG_RWSEM_GENERIC_SPINLOCK=y
am: c406096522

Change-Id: I2ac74fa5f03a3dff0b45e91d8be4e80c9c70da98

Niklas Cassel   authored and   android-build-merger   commited 2017-03-22 12:09:25 +00:00
7298964b46
futex: Add missing error handling to FUTEX_REQUEUE_PI
am: 1522181f4b

Change-Id: I74d73e5550ccb3a8d846f636b4f7940b124d261c

Peter Zijlstra   authored and   android-build-merger   commited 2017-03-22 12:09:16 +00:00
7135bd3da3
futex: Fix potential use-after-free in FUTEX_REQUEUE_PI
am: 6244ffc5a1

Change-Id: I973ed47c736e8deeebcea67e885abfb557fc1469

Peter Zijlstra   authored and   android-build-merger   commited 2017-03-22 12:09:06 +00:00
11a359f58e
bpf: fix mark_reg_unknown_value for spilled regs on map value marking
am: 0e0f1d6fdb

Change-Id: I3990cdd8bc095423723df1771ec87158dc8cb63a

Daniel Borkmann   authored and   android-build-merger   commited 2017-03-22 12:01:48 +00:00
82af7abe04
bpf: fix regression on verifier pruning wrt map lookups
am: 1889d6d9b5

Change-Id: I528df00bc5cd00aec10f56ad53907f6ca8044973

Daniel Borkmann   authored and   android-build-merger   commited 2017-03-22 12:01:38 +00:00
01db8bf2c4
bpf: fix state equivalence
am: b7f5aa1ca0

Change-Id: I1d61f752ac33e41ebb748eba7d3f48003ee29c19

Alexei Starovoitov   authored and   android-build-merger   commited 2017-03-22 12:01:29 +00:00
67684a346c
bpf: Detect identical PTR_TO_MAP_VALUE_OR_NULL registers
am: 1411707acb

Change-Id: I02e316379d5a19258ea601e75b9f4cece6450acd

Thomas Graf   authored and   android-build-merger   commited 2017-03-22 12:01:20 +00:00
199e71c26a
locking/rwsem: Fix down_write_killable() for CONFIG_RWSEM_GENERIC_SPINLOCK=y
commit 17fcbd590d0c3e35bd9646e2215f86586378bc42 upstream.

We hang if SIGKILL has been sent, but the task is stuck in down_read()
(after do_exit()), even though no task is doing down_write() on the
rwsem in question:

  INFO: task libupnp:21868 blocked for more than 120 seconds.
  libupnp         D    0 21868      1 0x08100008
  ...
  Call Trace:
  __schedule()
  schedule()
  __down_read()
  do_exit()
  do_group_exit()
  __wake_up_parent()

This bug has already been fixed for CONFIG_RWSEM_XCHGADD_ALGORITHM=y in
the following commit:

 04cafed7fc ("locking/rwsem: Fix down_write_killable()")

... however, this bug also exists for CONFIG_RWSEM_GENERIC_SPINLOCK=y.

Signed-off-by: Niklas Cassel <niklas.cassel@axis.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: <mhocko@suse.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Niklas Cassel <niklass@axis.com>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: d47996082f ("locking/rwsem: Introduce basis for down_write_killable()")
Link: http://lkml.kernel.org/r/1487981873-12649-1-git-send-email-niklass@axis.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Niklas Cassel   authored and   Greg Kroah-Hartman   commited 2017-03-22 12:43:40 +01:00
c406096522
futex: Add missing error handling to FUTEX_REQUEUE_PI
commit 9bbb25afeb182502ca4f2c4f3f88af0681b34cae upstream.

Thomas spotted that fixup_pi_state_owner() can return errors and we
fail to unlock the rt_mutex in that case.

Reported-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Cc: juri.lelli@arm.com
Cc: bigeasy@linutronix.de
Cc: xlpang@redhat.com
Cc: rostedt@goodmis.org
Cc: mathieu.desnoyers@efficios.com
Cc: jdesfossez@efficios.com
Cc: dvhart@infradead.org
Cc: bristot@redhat.com
Link: http://lkml.kernel.org/r/20170304093558.867401760@infradead.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Peter Zijlstra   authored and   Greg Kroah-Hartman   commited 2017-03-22 12:43:40 +01:00
1522181f4b
futex: Fix potential use-after-free in FUTEX_REQUEUE_PI
commit c236c8e95a3d395b0494e7108f0d41cf36ec107c upstream.

While working on the futex code, I stumbled over this potential
use-after-free scenario. Dmitry triggered it later with syzkaller.

pi_mutex is a pointer into pi_state, which we drop the reference on in
unqueue_me_pi(). So any access to that pointer after that is bad.

Since other sites already do rt_mutex_unlock() with hb->lock held, see
for example futex_lock_pi(), simply move the unlock before
unqueue_me_pi().

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Cc: juri.lelli@arm.com
Cc: bigeasy@linutronix.de
Cc: xlpang@redhat.com
Cc: rostedt@goodmis.org
Cc: mathieu.desnoyers@efficios.com
Cc: jdesfossez@efficios.com
Cc: dvhart@infradead.org
Cc: bristot@redhat.com
Link: http://lkml.kernel.org/r/20170304093558.801744246@infradead.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Peter Zijlstra   authored and   Greg Kroah-Hartman   commited 2017-03-22 12:43:40 +01:00
6244ffc5a1