Commit Graph

931668 Commits

Author SHA1 Message Date
Giuseppe Scrivano
e1eb26fa62 ipc/namespace.c: use a work queue to free_ipc
the reason is to avoid a delay caused by the synchronize_rcu() call in
kern_umount() when the mqueue mount is freed.

the code:

    #define _GNU_SOURCE
    #include <sched.h>
    #include <error.h>
    #include <errno.h>
    #include <stdlib.h>

    int main()
    {
        int i;

        for (i = 0; i < 1000; i++)
            if (unshare(CLONE_NEWIPC) < 0)
                error(EXIT_FAILURE, errno, "unshare");
    }

goes from

	Command being timed: "./ipc-namespace"
	User time (seconds): 0.00
	System time (seconds): 0.06
	Percent of CPU this job got: 0%
	Elapsed (wall clock) time (h:mm:ss or m:ss): 0:08.05

to

	Command being timed: "./ipc-namespace"
	User time (seconds): 0.00
	System time (seconds): 0.02
	Percent of CPU this job got: 96%
	Elapsed (wall clock) time (h:mm:ss or m:ss): 0:00.03

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Reviewed-by: Waiman Long <longman@redhat.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Manfred Spraul <manfred@colorfullife.com>
Link: http://lkml.kernel.org/r/20200225145419.527994-1-gscrivan@redhat.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-06-08 11:05:56 -07:00
Jules Irenge
4b78e2013a ipc/msg: add missing annotation for freeque()
Sparse reports a warning at freeque()

warning: context imbalance in freeque() - unexpected unlock

The root cause is the missing annotation at freeque()

Add the missing __releases(RCU) annotation
Add the missing __releases(&msq->q_perm) annotation

Signed-off-by: Jules Irenge <jbi.octave@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Lu Shuaibing <shuaibinglu@126.com>
Cc: Nathan Chancellor <natechancellor@gmail.com>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Link: http://lkml.kernel.org/r/20200403160505.2832-2-jbi.octave@gmail.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-06-08 11:05:55 -07:00
SeongJae Park
92fb1db26e mm/page_idle.c: skip offline pages
'Idle page tracking' users can pass random pfn that might be mapped to an
offline page.  To avoid accessing such pages, this commit modifies the
'page_idle_get_page()' to use 'pfn_to_online_page()' instead of
'pfn_valid()' and 'pfn_to_page()' combination, so that the pfn mapped to
an offline page can be skipped.

Reported-by: David Hildenbrand <david@redhat.com>
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Pankaj Gupta <pankaj.gupta.linux@gmail.com>
Link: http://lkml.kernel.org/r/20200605092502.18018-2-sjpark@amazon.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-06-08 11:05:55 -07:00
Linus Torvalds
63d72b93f2 vfs: clean up posix_acl_permission() logic aroudn MAY_NOT_BLOCK
posix_acl_permission() does not care about MAY_NOT_BLOCK, and in fact
the permission logic internally must not check that bit (it's only for
upper layers to decide whether they can block to do IO to look up the
acl information or not).

But the way the code was written, it _looked_ like it cared, since the
function explicitly did not mask that bit off.

But it has exactly two callers: one for when that bit is set, which
first clears the bit before calling posix_acl_permission(), and the
other call site when that bit was clear.

So stop the silly games "saving" the MAY_NOT_BLOCK bit that must not be
used for the actual permission test, and that currently is pointlessly
cleared by the callers when the function itself should just not care.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-06-08 11:04:19 -07:00
Linus Torvalds
5fc475b749 vfs: do not do group lookup when not necessary
Rasmus Villemoes points out that the 'in_group_p()' tests can be a
noticeable expense, and often completely unnecessary.  A common
situation is that the 'group' bits are the same as the 'other' bits
wrt the permissions we want to test.

So rewrite 'acl_permission_check()' to not bother checking for group
ownership when the permission check doesn't care.

For example, if we're asking for read permissions, and both 'group' and
'other' allow reading, there's really no reason to check if we're part
of the group or not: either way, we'll allow it.

Rasmus says:
 "On a bog-standard Ubuntu 20.04 install, a workload consisting of
  compiling lots of userspace programs (i.e., calling lots of
  short-lived programs that all need to get their shared libs mapped in,
  and the compilers poking around looking for system headers - lots of
  /usr/lib, /usr/bin, /usr/include/ accesses) puts in_group_p around
  0.1% according to perf top.

  System-installed files are almost always 0755 (directories and
  binaries) or 0644, so in most cases, we can avoid the binary search
  and the cost of pulling the cred->groups array and in_group_p() .text
  into the cpu cache"

Reported-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-06-08 11:04:19 -07:00
SeongJae Park
146f5cdeda docs/memory-barriers.txt/kokr: smp_mb__{before,after}_atomic(): update Documentation
Translate this commit to Korean:

  39323c64b8 ("smp_mb__{before,after}_atomic(): update Documentation")

Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reviewed-by: Yunjae Lee <lyj7694@gmail.com>
Link: https://lore.kernel.org/r/20200606083746.20869-1-sjpark@amazon.de
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2020-06-08 09:42:37 -06:00
Dejin Zheng
3699158d3f Documentation: devres: add missing entry for devm_platform_get_and_ioremap_resource()
The devm_platform_get_and_ioremap_resource() should be documented in
devres.rst. Add the missing entry.

Signed-off-by: Dejin Zheng <zhengdejin5@gmail.com>
Link: https://lore.kernel.org/r/20200527144531.9376-1-zhengdejin5@gmail.com
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2020-06-08 09:36:47 -06:00
Alexander A. Klimov
93431e0607 Replace HTTP links with HTTPS ones: documentation
Rationale:
Reduces attack surface on kernel devs opening the links for MITM
as HTTPS traffic is much harder to manipulate.

Deterministic algorithm:
For each file:
  For each line:
    If doesn't contain `\bxmlns\b`:
      For each link, `\bhttp://[^# \t\r\n]*(?:\w|/)`:
        If both the HTTP and HTTPS versions
        return 200 OK and serve the same content:
          Replace HTTP with HTTPS.

Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
Link: https://lore.kernel.org/r/20200526060544.25127-1-grandmaster@al2klimov.de
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2020-06-08 09:30:19 -06:00
Lukas Bulwahn
b55e45a59c docs: it_IT: address invalid reference warnings
Documentation generation warns:

  it_IT/kernel-hacking/hacking.rst:
    WARNING: unknown document: ../core-api/symbol/namespaces

  it_IT/process/5.Posting.rst:
    WARNING: undefined label: it_email_clients

  it_IT/process/submitting-patches.rst:
    WARNING: undefined label: it_email_clients

  it_IT/process/howto.rst:
     WARNING: undefined label: it_managementstyle

Refer to English documentation, as Italian translation does not exist,
and add labels for Italian process documents to resolve label references.

Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Link: https://lore.kernel.org/r/20200531185618.7099-1-lukas.bulwahn@gmail.com
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2020-06-08 09:25:27 -06:00
Lukas Bulwahn
a5001484e2 doc: zh_CN: use doc reference to resolve undefined label warning
Documentation generation warns:

  Documentation/translations/zh_CN/filesystems/debugfs.rst:5:
  WARNING: undefined label: debugfs_index

Use doc reference for files rather than introducing a label to refer to.
This resolves the warning above.

Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Reviewed-by: Alex Shi <alex.shi@linux.alibaba.com>
Link: https://lore.kernel.org/r/20200531183556.5751-1-lukas.bulwahn@gmail.com
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2020-06-08 09:24:58 -06:00
Jonathan Corbet
9970230474 docs: Update the location of the LF NDA program
The link to the Linux Foundation NDA program got broken in one of their
web-site thrashups; now that the information is back online, point to its
current location.  This should last until the next thrashup...

Reported-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Reviewed-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2020-06-08 09:15:48 -06:00
Heinrich Schuchardt
cc8246debb docs: dev-tools: coccinelle: underlines
Underline lengths should match the lengths of headings to avoid build
warnings with Sphinx.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Acked-by: Julia Lawall <julia.lawall@inria.fr>
Link: https://lore.kernel.org/r/20200605030405.6479-1-xypron.glpk@gmx.de
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2020-06-08 09:14:51 -06:00
Christoph Hellwig
7ff0d4490e trace: fix an incorrect __user annotation on stack_trace_sysctl
No user pointers for sysctls anymore.

Fixes: 32927393dc ("sysctl: pass kernel pointers to ->proc_handler")
Reported-by: build test robot <lkp@intel.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2020-06-08 10:13:56 -04:00
Christoph Hellwig
a2541dcb51 random: fix an incorrect __user annotation on proc_do_entropy
No user pointers for sysctls anymore.

Fixes: 32927393dc ("sysctl: pass kernel pointers to ->proc_handler")
Reported-by: build test robot <lkp@intel.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2020-06-08 10:13:56 -04:00
Christoph Hellwig
c7388c1f8f net/sysctl: remove leftover __user annotations on neigh_proc_dointvec*
Remove the leftover __user annotation on the prototypes for
neigh_proc_dointvec*.  The implementations already got this right, but
the headers kept the __user tags around.

Fixes: 32927393dc ("sysctl: pass kernel pointers to ->proc_handler")
Reported-by: build test robot <lkp@intel.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2020-06-08 10:13:56 -04:00
Christoph Hellwig
56965ac725 net/sysctl: use cpumask_parse in flow_limit_cpu_sysctl
cpumask_parse_user works on __user pointers, so this is wrong now.

Fixes: 32927393dc ("sysctl: pass kernel pointers to ->proc_handler")
Reported-by: build test robot <lkp@intel.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2020-06-08 10:13:56 -04:00
Rafael J. Wysocki
956ad9d98b ACPI: PM: Avoid using power resources if there are none for D0
As recently reported, some platforms provide a list of power
resources for device power state D3hot, through the _PR3 object,
but they do not provide a list of power resources for device power
state D0.

Among other things, this causes acpi_device_get_power() to return
D3hot as the current state of the device in question if all of the
D3hot power resources are "on", because it sees the power_resources
flag set and calls acpi_power_get_inferred_state() which finds that
D3hot is the shallowest power state with all of the associated power
resources turned "on", so that's what it returns.  Moreover, that
value takes precedence over the acpi_dev_pm_explicit_get() return
value, because it means a deeper power state.  The device may very
well be in D0 physically at that point, however.

Moreover, the presence of _PR3 without _PR0 for a given device
means that only one D3-level power state can be supported by it.
Namely, because there are no power resources to turn "off" when
transitioning the device from D0 into D3cold (which should be
supported since _PR3 is present), the evaluation of _PS3 should
be sufficient to put it straight into D3cold, but this means that
the effect of turning "on" the _PR3 power resources is unclear,
so it is better to avoid doing that altogether.  Consequently,
there is no practical way do distinguish D3cold from D3hot for
the device in question and the power states of it can be labeled
so that D3hot is the deepest supported one (and Linux assumes
that putting a device into D3hot via ACPI may cause power to be
removed from it anyway, for legacy reasons).

To work around the problem described above modify the ACPI
enumeration of devices so that power resources are only used
for device power management if the list of D0 power resources
is not empty and make it mart D3cold as supported only if that
is the case and the D3hot list of power resources is not empty
too.

Fixes: ef85bdbec4 ("ACPI / scan: Consolidate extraction of power resources lists")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=205057
Link: https://lore.kernel.org/linux-acpi/20200603194659.185757-1-hdegoede@redhat.com/
Reported-by: Hans de Goede <hdegoede@redhat.com>
Tested-by: Hans de Goede <hdegoede@redhat.com>
Tested-by: youling257@gmail.com
Cc: 3.10+ <stable@vger.kernel.org> # 3.10+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
2020-06-08 13:31:24 +02:00
Michael S. Tsirkin
b3fb6de7c6 virtio-mem: drop unnecessary initialization
rc is initialized to -ENIVAL but that's never used. Drop it.

Fixes: 5f1f79bbc9 ("virtio-mem: Paravirtualized memory hotplug")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: David Hildenbrand <david@redhat.com>
2020-06-08 05:12:52 -04:00
youngjun
2068cf7dfb ovl: remove unnecessary lock check
Directory is always locked until "out_unlock" label.  So lock check is not
needed.

Signed-off-by: youngjun <her0gyugyu@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2020-06-08 09:57:19 +02:00
Dave Airlie
efe792f39d Merge https://gitlab.freedesktop.org/drm/msm into drm-next-msm-5.8
* new gpu support: a405, a640, a650
* dpu: color processing support
* mdp5: support for msm8x36 (the thing with a405)
* some prep work for per-context pagetables (ie the part that
  does not depend on in-flight iommu patches)
* last but not least, UABI update for submit ioctl to support
  syncobj (from Bas)

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Rob Clark <robdclark@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/ <CAF6AEGvLMubYPeKZ0rvOp45=+h4HZz-K9XNf0CXYcvPDVbnqLA@mail.gmail.com
2020-06-08 13:22:57 +10:00
Dave Airlie
8d286e2ff4 Merge tag 'drm-intel-next-fixes-2020-06-04' of git://anongit.freedesktop.org/drm/drm-intel into drm-next
- Includes gvt-next-fixes-2020-05-28
- Use after free fix for display global state.
- Whitelisting context-local timestamp on Gen9
  and two scheduler fixes with deps (Cc: stable)
- Removal of write flag from sysfs files where
  ineffective

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200604150454.GA59322@jlahtine-desk.ger.corp.intel.com
2020-06-08 11:59:57 +10:00
Dave Airlie
fa3fa2228c Merge tag 'amd-drm-fixes-5.8-2020-06-04' of git://people.freedesktop.org/~agd5f/linux into drm-next
amd-drm-fixes-5.8-2020-06-04

amdgpu:
- Prevent hwmon accesses while GPU is in reset
- CTF interrupt fix
- Backlight fix for renoir
- Fix for display sync groups
- Display bandwidth validation workaround

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Alex Deucher <alexdeucher@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200604181900.4609-1-alexander.deucher@amd.com
2020-06-08 11:55:33 +10:00
Linus Torvalds
af7b480103 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from David Miller:

 - Fix the build with certain Kconfig combinations for the Chelsio
   inline TLS device, from Rohit Maheshwar and Vinay Kumar Yadavi.

 - Fix leak in genetlink, from Cong Lang.

 - Fix out of bounds packet header accesses in seg6, from Ahmed
   Abdelsalam.

 - Two XDP fixes in the ENA driver, from Sameeh Jubran

 - Use rwsem in device rename instead of a seqcount because this code
   can sleep, from Ahmed S. Darwish.

 - Fix WoL regressions in r8169, from Heiner Kallweit.

 - Fix qed crashes in kdump mode, from Alok Prasad.

 - Fix the callbacks used for certain thermal zones in mlxsw, from Vadim
   Pasternak.

* git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (35 commits)
  net: dsa: lantiq_gswip: fix and improve the unsupported interface error
  mlxsw: core: Use different get_trend() callbacks for different thermal zones
  net: dp83869: Reset return variable if PHY strap is read
  rhashtable: Drop raw RCU deref in nested_table_free
  cxgb4: Use kfree() instead kvfree() where appropriate
  net: qed: fixes crash while running driver in kdump kernel
  vsock/vmci: make vmci_vsock_transport_cb() static
  net: ethtool: Fix comment mentioning typo in IS_ENABLED()
  net: phy: mscc: fix Serdes configuration in vsc8584_config_init
  net: mscc: Fix OF_MDIO config check
  net: marvell: Fix OF_MDIO config check
  net: dp83867: Fix OF_MDIO config check
  net: dp83869: Fix OF_MDIO config check
  net: ethernet: mvneta: fix MVNETA_SKB_HEADROOM alignment
  ethtool: linkinfo: remove an unnecessary NULL check
  net/xdp: use shift instead of 64 bit division
  crypto/chtls:Fix compile error when CONFIG_IPV6 is disabled
  inet_connection_sock: clear inet_num out of destroy helper
  yam: fix possible memory leak in yam_init_driver
  lan743x: Use correct MAC_CR configuration for 1 GBit speed
  ...
2020-06-07 17:27:45 -07:00
Linus Torvalds
52e0ad262c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next
Pull sparc updates from David Miller:

 - Rework the sparc32 page tables so that READ_ONCE(*pmd), as done by
   generic code, operates on a word sized element. From Will Deacon.

 - Some scnprintf() conversions, from Chen Zhou.

 - A pin_user_pages() conversion from John Hubbard.

 - Several 32-bit ptrace register handling fixes and such from Al Viro.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next:
  fix a braino in "sparc32: fix register window handling in genregs32_[gs]et()"
  sparc32: mm: Only call ctor()/dtor() functions for first and last user
  sparc32: mm: Disable SPLIT_PTLOCK_CPUS
  sparc32: mm: Don't try to free page-table pages if ctor() fails
  sparc32: register memory occupied by kernel as memblock.memory
  sparc: remove unused header file nfs_fs.h
  sparc32: fix register window handling in genregs32_[gs]et()
  sparc64: fix misuses of access_process_vm() in genregs32_[sg]et()
  oradax: convert get_user_pages() --> pin_user_pages()
  sparc: use scnprintf() in show_pciobppath_attr() in vio.c
  sparc: use scnprintf() in show_pciobppath_attr() in pci.c
  tty: vcc: Fix error return code in vcc_probe()
  sparc32: mm: Reduce allocation size for PMD and PTE tables
  sparc32: mm: Change pgtable_t type to pte_t * instead of struct page *
  sparc32: mm: Restructure sparc32 MMU page-table layout
  sparc32: mm: Fix argument checking in __srmmu_get_nocache()
  sparc64: Replace zero-length array with flexible-array
  sparc: mm: return true,false in kern_addr_valid()
2020-06-07 17:25:29 -07:00
David S. Miller
4f8ad73898 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc 2020-06-07 17:11:41 -07:00
Martin Blumenstingl
4d3da2d8d9 net: dsa: lantiq_gswip: fix and improve the unsupported interface error
While trying to use the lantiq_gswip driver on one of my boards I made
a mistake when specifying the phy-mode (because the out-of-tree driver
wants phy-mode "gmii" or "mii" for the internal PHYs). In this case the
following error is printed multiple times:
  Unsupported interface: 3

While it gives at least a hint at what may be wrong it is not very user
friendly. Print the human readable phy-mode and also which port is
configured incorrectly (this hardware supports ports 0..6) to improve
the cases where someone made a mistake.

Fixes: 14fceff477 ("net: dsa: Add Lantiq / Intel DSA driver for vrx200")
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-06-07 17:09:46 -07:00
Dave Airlie
3f29eacc3e Merge branch 'linux-5.8' of git://github.com/skeggsb/linux into drm-next
- HDMI/DP audio HDA fixes
- display hang fix for Volta/Turing
- GK20A regression fix.

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Ben Skeggs <skeggsb@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/ <CACAvsv4PW6tAZY6Uvrhi5OV+4rDXvrtNcoq2w_i35YajByj+ew@mail.gmail.com
2020-06-08 10:06:14 +10:00
Vadim Pasternak
2dc2f76005 mlxsw: core: Use different get_trend() callbacks for different thermal zones
The driver registers three different types of thermal zones: For the
ASIC itself, for port modules and for gearboxes.

Currently, all three types use the same get_trend() callback which does
not work correctly for the ASIC thermal zone. The callback assumes that
the device data is of type 'struct mlxsw_thermal_module', whereas for
the ASIC thermal zone 'struct mlxsw_thermal' is passed as device data.

Fix this by using one get_trend() callback for the ASIC thermal zone and
another for the other two types.

Fixes: 6f73862fab ("mlxsw: core: Add the hottest thermal zone detection")
Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-06-07 16:59:43 -07:00
David S. Miller
9049a40c85 Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-06-07 16:40:14 -07:00
Linus Torvalds
cf0c97f148 This is the bulk of pin control changes for the v5.8
kernel cycle.
 
 New drivers:
 
 - Intel Jasper Lake support.
 
 - NXP Freescale i.MX8DXL support.
 
 - Qualcomm SM8250 support.
 
 - Renesas R8A7742 SH-PFC support.
 
 Driver improvements:
 
 - Severe cleanup and modernization of the MCP23s08 driver.
 
 - Mediatek driver modularized.
 
 - Setting config supported in the Meson driver.
 
 - Wakeup support for the Broadcom BCM7211.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAl7dZC4ACgkQQRCzN7AZ
 XXOEZg/9F4dCwXmMxMxbS1c7DSHxsJTEHYKDDgAZ0L36N2DHihpMGbVQFzEe9khK
 xeSS8M4ecACYzw3FJGESaEC+fmTZ7zxr60SR++iyJJptooKAmcA00d2M/4VQ4ggN
 P/nXFEsGJvQ7nNJSO95wXr5K8aVkQW7rjo1cnblXH0c9dYOp+ItyodIytKcdWeZ9
 QfWSovYd+Oqra0braxx+pM/iTFVf6eOoCFZ8gkXB35pORsZ4Vl/e8pXMHXc3wUUm
 S1b6e3fifLiEGANvCEXz47/f3lUmUY26FsCSCAt92tHChq/p6coIKKvKyP4723PF
 R2L03iO8jMfsX+HwL2ivblSZ/lFExEgalWET56aogZClRQVynC0NMOnDEdluYGaT
 XJZPib9sRqQOF36+G9Bcy4zlqjj1LoHwqpiCdAhtj3AACTKdoLjDK0sJ3Wn5E8lJ
 QfIb+oqOmOGNHN/fdSsxsNM1ptOqNb/sW2Gk4O+X9tYzG17m16oZEVkrv4FNhmeC
 mePl/7aX+aMoHkEYxvt9tF3kRDFbndcuHdNFtRxq0Tx9jELiR91ySjjs9bUr2Vnl
 kkihtfIMZngQjBgHe2PNlcF2t7gSIgSBVEvwxslcUlx3XvVEDP16RKJV52aL80uu
 ev4k0h72CTxI1lZuNuW4cJYDKF/wJPqPtQ8+GQfOZxG7yuM8tOc=
 =3UGk
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl-v5.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pin control updates from Linus Walleij:
 "This is the bulk of pin control changes for the v5.8 kernel cycle.

  It's just really boring this time. Zero core changes. Just linear
  development, cleanups and misc noncritical fixes. Some new drivers for
  very new Qualcomm and Intel chips.

  New drivers:

   - Intel Jasper Lake support.

   - NXP Freescale i.MX8DXL support.

   - Qualcomm SM8250 support.

   - Renesas R8A7742 SH-PFC support.

  Driver improvements:

   - Severe cleanup and modernization of the MCP23s08 driver.

   - Mediatek driver modularized.

   - Setting config supported in the Meson driver.

   - Wakeup support for the Broadcom BCM7211"

* tag 'pinctrl-v5.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (72 commits)
  pinctrl: sprd: Fix the incorrect pull-up definition
  pinctrl: pxa: pxa2xx: Remove 'pxa2xx_pinctrl_exit()' which is unused and broken
  pinctrl: freescale: imx: Use 'devm_of_iomap()' to avoid a resource leak in case of error in 'imx_pinctrl_probe()'
  pinctrl: freescale: imx: Fix an error handling path in 'imx_pinctrl_probe()'
  pinctrl: sirf: add missing put_device() call in sirfsoc_gpio_probe()
  pinctrl: imxl: Fix an error handling path in 'imx1_pinctrl_core_probe()'
  pinctrl: bcm2835: Add support for wake-up interrupts
  pinctrl: bcm2835: Match BCM7211 compatible string
  dt-bindings: pinctrl: Document optional BCM7211 wake-up interrupts
  dt-bindings: pinctrl: Document 7211 compatible for brcm, bcm2835-gpio.txt
  dt-bindings: pinctrl: stm32: Add missing interrupts property
  pinctrl: at91-pio4: Add COMPILE_TEST support
  pinctrl: Fix return value about devm_platform_ioremap_resource()
  MAINTAINERS: Renesas Pin Controllers are supported
  dt-bindings: pinctrl: ocelot: Add Sparx5 SoC support
  pinctrl: ocelot: Fix GPIO interrupt decoding on Jaguar2
  pinctrl: ocelot: Remove instance number from pin functions
  pinctrl: ocelot: Always register GPIO driver
  dt-bindings: pinctrl: rockchip: update example
  pinctrl: amd: Add ACPI dependency
  ...
2020-06-07 16:13:43 -07:00
Linus Torvalds
e8dff03aef RTC for 5.8
Subsystem:
  - new VL flag for backup switch over
 
 Drivers:
  - ingenic: only support device tree
  - pcf2127: report battery switch over, handle nowayout
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEycoQi/giopmpPgB12wIijOdRNOUFAl7dWSkACgkQ2wIijOdR
 NOXGbQ//cSTxUJbuYBNi/VCV7J3/khGlyoQQqDsru/tzuEwXHGBoG2LRNQMOauWd
 2Osg61VQj4IY+WCqp4+ivn5H0K26y1PPKkt+UmrlRgkl0eeDFWmY4ejpziZ85D7Z
 kDlzcUi3YWkd6m4YSJJrtdCcKljBMIEXb/PEKKK9y6dkrcG5990N8JchpmkCzrjx
 fTPVIOfxu43msDc5b8egUDzPYnNbFw3ERAeasr6/EGTz+ksCspXtvWDk/mJzum0G
 FiermTkO499Dr66Nf0AS3ex9SvEoqH+kd9KA1CKii5OlYEl7K9sI+eSmTQ1EutZO
 L5WAvvQdW8UkARo6R4HAobhwK27pL+wpzUljbyXxt940/RTeqp82kl7rnH+0ihU7
 tTbR2Vu+uwWrfQbPkCCj0TJmqIHgam5/Vhn1+ZR2f4U2JIlPvvHoLRVKO0oP7XKK
 1ZDcP8zc9V2LQ2G2M1/ec6eOmoGW3EZDnKp4hcv9mnEiePSvVn04t5sa83NjNs4R
 e+awVY1x5pFwoXu99gjlfQTV2kTyaA7Jywp6gIO7BKaw/Ci3+d3tlpowfsDH+UVI
 WwKxNNqmuNXqoIep0zqUhqXHNIizKxGEk8wE4mr8HP2SlGJ+lUHAyrTTdpLeinN1
 5qTEPT3BhjExSFfDZQyWV3+CzKMvxtfFA4/Ca/0iSoaqzMZpm1E=
 =dsKr
 -----END PGP SIGNATURE-----

Merge tag 'rtc-5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux

Pull RTC updates from Alexandre Belloni:
 "Not much this cycle apart from the ingenic rtc driver rework.

  The fixes are mainly minor issues reported by coccinelle rather than
  real world issues.

  Subsystem:

   - new VL flag for backup switch over

  Drivers:

   - ingenic: only support device tree

   - pcf2127: report battery switch over, handle nowayout"

* tag 'rtc-5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (29 commits)
  rtc: pcf2127: watchdog: handle nowayout feature
  rtc: fsl-ftm-alarm: fix freeze(s2idle) failed to wake
  rtc: abx80x: Provide debug feedback for invalid dt properties
  rtc: abx80x: Add Device Tree matching table
  rtc: rv3028: Add missed check for devm_regmap_init_i2c()
  rtc: mpc5121: Use correct return value for mpc5121_rtc_probe()
  rtc: goldfish: Use correct return value for goldfish_rtc_probe()
  rtc: snvs: Add necessary clock operations for RTC APIs
  rtc: snvs: Make SNVS clock always prepared
  rtc: ingenic: Reset regulator register in probe
  rtc: ingenic: Fix masking of error code
  rtc: ingenic: Remove unused fields from private structure
  rtc: ingenic: Set wakeup params in probe
  rtc: ingenic: Enable clock in probe
  rtc: ingenic: Use local 'dev' variable in probe
  rtc: ingenic: Only support probing from devicetree
  rtc: mc13xxx: fix a double-unlock issue
  rtc: stmp3xxx: update contact email
  rtc: max77686: Use single-byte writes on MAX77620
  rtc: pcf2127: report battery switch over
  ...
2020-06-07 16:11:23 -07:00
Linus Torvalds
787f74fc50 Intel Icelake NTB support, Intel driver bug fixes, and lots of bug fixes
for ntb tests
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEoE9b9c3U2JxX98mqbmZLrHqL0iMFAl7a3aUACgkQbmZLrHqL
 0iPmmA//fZ5PuqEfAjsCQjxQjVsvh195pBPL4vcwtpu9R7xDKztoRqOMzHbmvLXK
 db+E9erWPFESjJFMqH4u3kAVIGvKSRkbjsVH7rhhdgabjB6IAs4nJr+ucvOD1fp+
 OO3AJl8cedJurj5yUhCEJ13lT3Y/90YqJLdtqkAi0m9iABH7J54SmxZosVj1XUBt
 PoIyF1PGXCeVv+v0VTjRsm67kGL4K3dggOPJFPZ56trhLshOlCrcaRt/MzVVMAud
 P9ZU9h02sp62E87anUhe6TsR6G0BgRbOvvX39VtxoaJjfoMFEBGFzEPEj+3V1tfa
 jeSM3jE9sCvbFFxuarvyHNoCRY4lntGjzP8lM1sCatSjp5mJnEFSC3tSGyY+cAFr
 LB2How8Bikrq/PQ/H768UXL9ChYv+T5hsHRcz4yllKkyl9OwJAUpqlvBMJUNIMu3
 Yvrhj9oG6EH28dK7nuzNxXIPPjBgkbetCK/jhfn6XZT9jP2p5iXv4qA3bjCsn11E
 0cPCXVwMAkwcgVaTuPWdNFILXGfijcwfpBlsgHak0MvureQz+ANVJqWpZwJyWQB5
 aiLr0xzW9qTVfX+vGAopHAoFD2If1eS/wTqqXF5TYbZT8/cuwjzGEl8aIPEP1ldz
 Jyy/tVK97Lk8S6ZXceQucugAy4CKAIcRmlulkxYjH6fbVf2jyfo=
 =cp25
 -----END PGP SIGNATURE-----

Merge tag 'ntb-5.8' of git://github.com/jonmason/ntb

Pull NTB updates from Jon Mason:
 "Intel Icelake NTB support, Intel driver bug fixes, and lots of bug
  fixes for ntb tests"

* tag 'ntb-5.8' of git://github.com/jonmason/ntb:
  NTB: ntb_test: Fix bug when counting remote files
  NTB: perf: Fix race condition when run with ntb_test
  NTB: perf: Fix support for hardware that doesn't have port numbers
  NTB: perf: Don't require one more memory window than number of peers
  NTB: ntb_pingpong: Choose doorbells based on port number
  NTB: Fix the default port and peer numbers for legacy drivers
  NTB: Revert the change to use the NTB device dev for DMA allocations
  NTB: ntb_tool: reading the link file should not end in a NULL byte
  ntb_perf: avoid false dma unmap of destination address
  ntb_perf: increase sleep time from one milli sec to one sec
  ntb_tool: pass correct struct device to dma_alloc_coherent
  ntb_perf: pass correct struct device to dma_alloc_coherent
  ntb: hw: remove the code that sets the DMA mask
  NTB: correct ntb_peer_spad_addr and ntb_peer_spad_read comment typos
  ntb: intel: fix static declaration
  ntb: intel: add hw workaround for NTB BAR alignment
  ntb: intel: Add Icelake (gen4) support for Intel NTB
  NTB: Fix static check warning in perf_clear_test
  include/ntb: Fix typo in ntb_unregister_device description
2020-06-07 16:08:41 -07:00
Linus Torvalds
a2b447066c Tag summary
+ Features
   - Replace zero-length array with flexible-array
   - add a valid state flags check
   - add consistency check between state and dfa diff encode flags
   - add apparmor subdir to proc attr interface
   - fail unpack if profile mode is unknown
   - add outofband transition and use it in xattr match
   - ensure that dfa state tables have entries
 
 + Cleanups
   - Use true and false for bool variable
   - Remove semicolon
   - Clean code by removing redundant instructions
   - Replace two seq_printf() calls by seq_puts() in aa_label_seq_xprint()
   - remove duplicate check of xattrs on profile attachment
   - remove useless aafs_create_symlink
 
 + Bug fixes
   - Fix memory leak of profile proxy
   - fix introspection of of task mode for unconfined tasks
   - fix nnp subset test for unconfined
   - check/put label on apparmor_sk_clone_security()
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE7cSDD705q2rFEEf7BS82cBjVw9gFAl7dUf4ACgkQBS82cBjV
 w9j8rA//R3qbVeiN3SJtxLhiF3AAdP2cVbZ/mAhQLwYObI6flb1bliiahJHRf8Ey
 FaVb4srOH8NlmzNINZehXOvD3UDwX/sbpw8h0Y0JolO+v1m3UXkt/eRoMt6gRz7I
 jtaImY1/V+G4O5rV5fGA1HQI8Geg+W9Abt32d16vyKIIpnBS/Pfv8ppM0NcHCZ4G
 e8935T/dMNK5K0Y7HNb1nMjyzEr0LtEXvXznBOrGVpCtDQ45m0/NBvAqpfhuKsVm
 FE5Na8rgtiB9sU72LaoNXNr8Y5LVgkXPmBr/e1FqZtF01XEarKb7yJDGOLrLpp1o
 rGYpY9DQSBT/ZZrwMaLFqCd1XtnN1BAmhlM6TXfnm25ArEnQ49ReHFc7ZHZRSTZz
 LWVBD6atZbapvqckk1SU49eCLuGs5wmRj/CmwdoQUbZ+aOfR68zF+0PANbP5xDo4
 862MmeMsm8JHndeCelpZQRbhtXt0t9MDzwMBevKhxV9hbpt4g8DcnC5tNUc9AnJi
 qJDsMkytYhazIW+/4MsnLTo9wzhqzXq5kBeE++Xl7vDE/V+d5ocvQg73xtwQo9sx
 LzMlh3cPmBvOnlpYfnONZP8pJdjDAuESsi/H5+RKQL3cLz7NX31CLWR8dXLBHy80
 Dvxqvy84Cf7buigqwSzgAGKjDI5HmeOECAMjpLbEB2NS9xxQYuk=
 =U7d2
 -----END PGP SIGNATURE-----

Merge tag 'apparmor-pr-2020-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor

Pull apparmor updates from John Johansen:
 "Features:
   - Replace zero-length array with flexible-array
   - add a valid state flags check
   - add consistency check between state and dfa diff encode flags
   - add apparmor subdir to proc attr interface
   - fail unpack if profile mode is unknown
   - add outofband transition and use it in xattr match
   - ensure that dfa state tables have entries

  Cleanups:
   - Use true and false for bool variable
   - Remove semicolon
   - Clean code by removing redundant instructions
   - Replace two seq_printf() calls by seq_puts() in aa_label_seq_xprint()
   - remove duplicate check of xattrs on profile attachment
   - remove useless aafs_create_symlink

  Bug fixes:
   - Fix memory leak of profile proxy
   - fix introspection of of task mode for unconfined tasks
   - fix nnp subset test for unconfined
   - check/put label on apparmor_sk_clone_security()"

* tag 'apparmor-pr-2020-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor:
  apparmor: Fix memory leak of profile proxy
  apparmor: fix introspection of of task mode for unconfined tasks
  apparmor: check/put label on apparmor_sk_clone_security()
  apparmor: Use true and false for bool variable
  security/apparmor/label.c: Clean code by removing redundant instructions
  apparmor: Replace zero-length array with flexible-array
  apparmor: ensure that dfa state tables have entries
  apparmor: remove duplicate check of xattrs on profile attachment.
  apparmor: add outofband transition and use it in xattr match
  apparmor: fail unpack if profile mode is unknown
  apparmor: fix nnp subset test for unconfined
  apparmor: remove useless aafs_create_symlink
  apparmor: add proc subdir to attrs
  apparmor: add consistency check between state and dfa diff encode flags
  apparmor: add a valid state flags check
  AppArmor: Remove semicolon
  apparmor: Replace two seq_printf() calls by seq_puts() in aa_label_seq_xprint()
2020-06-07 16:04:49 -07:00
Roberto Sassu
8b8c704d91 ima: Remove __init annotation from ima_pcrread()
Commit 6cc7c266e5 ("ima: Call ima_calc_boot_aggregate() in
ima_eventdigest_init()") added a call to ima_calc_boot_aggregate() so that
the digest can be recalculated for the boot_aggregate measurement entry if
the 'd' template field has been requested. For the 'd' field, only SHA1 and
MD5 digests are accepted.

Given that ima_eventdigest_init() does not have the __init annotation, all
functions called should not have it. This patch removes __init from
ima_pcrread().

Cc: stable@vger.kernel.org
Fixes:  6cc7c266e5 ("ima: Call ima_calc_boot_aggregate() in ima_eventdigest_init()")
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-06-07 16:03:09 -07:00
John Johansen
3622ad25d4 apparmor: Fix memory leak of profile proxy
When the proxy isn't replaced and the profile is removed, the proxy
is being leaked resulting in a kmemleak check message of

unreferenced object 0xffff888077a3a490 (size 16):
  comm "apparmor_parser", pid 128041, jiffies 4322684109 (age 1097.028s)
  hex dump (first 16 bytes):
    03 00 00 00 00 00 00 00 b0 92 fd 4b 81 88 ff ff  ...........K....
  backtrace:
    [<0000000084d5daf2>] aa_alloc_proxy+0x58/0xe0
    [<00000000ecc0e21a>] aa_alloc_profile+0x159/0x1a0
    [<000000004cc9ce15>] unpack_profile+0x275/0x1c40
    [<000000007332b3ca>] aa_unpack+0x1e7/0x7e0
    [<00000000e25e31bd>] aa_replace_profiles+0x18a/0x1d10
    [<00000000350d9415>] policy_update+0x237/0x650
    [<000000003fbf934e>] profile_load+0x122/0x160
    [<0000000047f7b781>] vfs_write+0x139/0x290
    [<000000008ad12358>] ksys_write+0xcd/0x170
    [<000000001a9daa7b>] do_syscall_64+0x70/0x310
    [<00000000b9efb0cf>] entry_SYSCALL_64_after_hwframe+0x49/0xb3

Make sure to cleanup the profile's embedded label which will result
on the proxy being properly freed.

Fixes: 637f688dc3 ("apparmor: switch from profiles to using labels on contexts")
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-06-07 13:38:55 -07:00
John Johansen
dd2569fbb0 apparmor: fix introspection of of task mode for unconfined tasks
Fix two issues with introspecting the task mode.

1. If a task is attached to a unconfined profile that is not the
   ns->unconfined profile then. Mode the mode is always reported
   as -

      $ ps -Z
      LABEL                               PID TTY          TIME CMD
      unconfined                         1287 pts/0    00:00:01 bash
      test (-)                           1892 pts/0    00:00:00 ps

   instead of the correct value of (unconfined) as shown below

      $ ps -Z
      LABEL                               PID TTY          TIME CMD
      unconfined                         2483 pts/0    00:00:01 bash
      test (unconfined)                  3591 pts/0    00:00:00 ps

2. if a task is confined by a stack of profiles that are unconfined
   the output of label mode is again the incorrect value of (-) like
   above, instead of (unconfined). This is because the visibile
   profile count increment is skipped by the special casing of
   unconfined.

Fixes: f1bd904175 ("apparmor: add the base fns() for domain labels")
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-06-07 13:38:55 -07:00
Mauricio Faria de Oliveira
3b646abc5b apparmor: check/put label on apparmor_sk_clone_security()
Currently apparmor_sk_clone_security() does not check for existing
label/peer in the 'new' struct sock; it just overwrites it, if any
(with another reference to the label of the source sock.)

    static void apparmor_sk_clone_security(const struct sock *sk,
                                           struct sock *newsk)
    {
            struct aa_sk_ctx *ctx = SK_CTX(sk);
            struct aa_sk_ctx *new = SK_CTX(newsk);

            new->label = aa_get_label(ctx->label);
            new->peer = aa_get_label(ctx->peer);
    }

This might leak label references, which might overflow under load.
Thus, check for and put labels, to prevent such errors.

Note this is similarly done on:

    static int apparmor_socket_post_create(struct socket *sock, ...)
    ...
            if (sock->sk) {
                    struct aa_sk_ctx *ctx = SK_CTX(sock->sk);

                    aa_put_label(ctx->label);
                    ctx->label = aa_get_label(label);
            }
    ...

Context:
-------

The label reference count leak is observed if apparmor_sock_graft()
is called previously: this sets the 'ctx->label' field by getting
a reference to the current label (later overwritten, without put.)

    static void apparmor_sock_graft(struct sock *sk, ...)
    {
            struct aa_sk_ctx *ctx = SK_CTX(sk);

            if (!ctx->label)
                    ctx->label = aa_get_current_label();
    }

And that is the case on crypto/af_alg.c:af_alg_accept():

    int af_alg_accept(struct sock *sk, struct socket *newsock, ...)
    ...
            struct sock *sk2;
            ...
            sk2 = sk_alloc(...);
            ...
            security_sock_graft(sk2, newsock);
            security_sk_clone(sk, sk2);
    ...

Apparently both calls are done on their own right, especially for
other LSMs, being introduced in 2010/2014, before apparmor socket
mediation in 2017 (see commits [1,2,3,4]).

So, it looks OK there! Let's fix the reference leak in apparmor.

Test-case:
---------

Exercise that code path enough to overflow label reference count.

    $ cat aa-refcnt-af_alg.c
    #include <stdio.h>
    #include <string.h>
    #include <unistd.h>
    #include <sys/socket.h>
    #include <linux/if_alg.h>

    int main() {
            int sockfd;
            struct sockaddr_alg sa;

            /* Setup the crypto API socket */
            sockfd = socket(AF_ALG, SOCK_SEQPACKET, 0);
            if (sockfd < 0) {
                    perror("socket");
                    return 1;
            }

            memset(&sa, 0, sizeof(sa));
            sa.salg_family = AF_ALG;
            strcpy((char *) sa.salg_type, "rng");
            strcpy((char *) sa.salg_name, "stdrng");

            if (bind(sockfd, (struct sockaddr *) &sa, sizeof(sa)) < 0) {
                    perror("bind");
                    return 1;
            }

            /* Accept a "connection" and close it; repeat. */
            while (!close(accept(sockfd, NULL, 0)));

            return 0;
    }

    $ gcc -o aa-refcnt-af_alg aa-refcnt-af_alg.c

    $ ./aa-refcnt-af_alg
    <a few hours later>

    [ 9928.475953] refcount_t overflow at apparmor_sk_clone_security+0x37/0x70 in aa-refcnt-af_alg[1322], uid/euid: 1000/1000
    ...
    [ 9928.507443] RIP: 0010:apparmor_sk_clone_security+0x37/0x70
    ...
    [ 9928.514286]  security_sk_clone+0x33/0x50
    [ 9928.514807]  af_alg_accept+0x81/0x1c0 [af_alg]
    [ 9928.516091]  alg_accept+0x15/0x20 [af_alg]
    [ 9928.516682]  SYSC_accept4+0xff/0x210
    [ 9928.519609]  SyS_accept+0x10/0x20
    [ 9928.520190]  do_syscall_64+0x73/0x130
    [ 9928.520808]  entry_SYSCALL_64_after_hwframe+0x3d/0xa2

Note that other messages may be seen, not just overflow, depending on
the value being incremented by kref_get(); on another run:

    [ 7273.182666] refcount_t: saturated; leaking memory.
    ...
    [ 7273.185789] refcount_t: underflow; use-after-free.

Kprobes:
-------

Using kprobe events to monitor sk -> sk_security -> label -> count (kref):

Original v5.7 (one reference leak every iteration)

 ... (af_alg_accept+0x0/0x1c0) label=0xffff8a0f36c25eb0 label_refcnt=0x11fd2
 ... (af_alg_release_parent+0x0/0xd0) label=0xffff8a0f36c25eb0 label_refcnt=0x11fd4
 ... (af_alg_accept+0x0/0x1c0) label=0xffff8a0f36c25eb0 label_refcnt=0x11fd3
 ... (af_alg_release_parent+0x0/0xd0) label=0xffff8a0f36c25eb0 label_refcnt=0x11fd5
 ... (af_alg_accept+0x0/0x1c0) label=0xffff8a0f36c25eb0 label_refcnt=0x11fd4
 ... (af_alg_release_parent+0x0/0xd0) label=0xffff8a0f36c25eb0 label_refcnt=0x11fd6

Patched v5.7 (zero reference leak per iteration)

 ... (af_alg_accept+0x0/0x1c0) label=0xffff9ff376c25eb0 label_refcnt=0x593
 ... (af_alg_release_parent+0x0/0xd0) label=0xffff9ff376c25eb0 label_refcnt=0x594
 ... (af_alg_accept+0x0/0x1c0) label=0xffff9ff376c25eb0 label_refcnt=0x593
 ... (af_alg_release_parent+0x0/0xd0) label=0xffff9ff376c25eb0 label_refcnt=0x594
 ... (af_alg_accept+0x0/0x1c0) label=0xffff9ff376c25eb0 label_refcnt=0x593
 ... (af_alg_release_parent+0x0/0xd0) label=0xffff9ff376c25eb0 label_refcnt=0x594

Commits:
-------

[1] commit 507cad355f ("crypto: af_alg - Make sure sk_security is initialized on accept()ed sockets")
[2] commit 4c63f83c2c ("crypto: af_alg - properly label AF_ALG socket")
[3] commit 2acce6aa9f ("Networking") a.k.a ("crypto: af_alg - Avoid sock_graft call warning)
[4] commit 56974a6fcf ("apparmor: add base infastructure for socket mediation")

Fixes: 56974a6fcf ("apparmor: add base infastructure for socket mediation")
Reported-by: Brian Moyles <bmoyles@netflix.com>
Signed-off-by: Mauricio Faria de Oliveira <mfo@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-06-07 13:38:56 -07:00
Linus Torvalds
9aa900c809 Char/Misc driver patches for 5.8-rc1
Here is the large set of char/misc driver patches for 5.8-rc1
 
 Included in here are:
 	- habanalabs driver updates, loads
 	- mhi bus driver updates
 	- extcon driver updates
 	- clk driver updates (approved by the clock maintainer)
 	- firmware driver updates
 	- fpga driver updates
 	- gnss driver updates
 	- coresight driver updates
 	- interconnect driver updates
 	- parport driver updates (it's still alive!)
 	- nvmem driver updates
 	- soundwire driver updates
 	- visorbus driver updates
 	- w1 driver updates
 	- various misc driver updates
 
 In short, loads of different driver subsystem updates along with the
 drivers as well.
 
 All have been in linux-next for a while with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCXtzkHw8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+yldOwCgus/DgpnI1UL4z+NdBxJrAXtkPmgAn2sgTUea
 i5RblCmcVMqvHaGtYkY+
 =tScN
 -----END PGP SIGNATURE-----

Merge tag 'char-misc-5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver updates from Greg KH:
 "Here is the large set of char/misc driver patches for 5.8-rc1

  Included in here are:

   - habanalabs driver updates, loads

   - mhi bus driver updates

   - extcon driver updates

   - clk driver updates (approved by the clock maintainer)

   - firmware driver updates

   - fpga driver updates

   - gnss driver updates

   - coresight driver updates

   - interconnect driver updates

   - parport driver updates (it's still alive!)

   - nvmem driver updates

   - soundwire driver updates

   - visorbus driver updates

   - w1 driver updates

   - various misc driver updates

  In short, loads of different driver subsystem updates along with the
  drivers as well.

  All have been in linux-next for a while with no reported issues"

* tag 'char-misc-5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (233 commits)
  habanalabs: correctly cast u64 to void*
  habanalabs: initialize variable to default value
  extcon: arizona: Fix runtime PM imbalance on error
  extcon: max14577: Add proper dt-compatible strings
  extcon: adc-jack: Fix an error handling path in 'adc_jack_probe()'
  extcon: remove redundant assignment to variable idx
  w1: omap-hdq: print dev_err if irq flags are not cleared
  w1: omap-hdq: fix interrupt handling which did show spurious timeouts
  w1: omap-hdq: fix return value to be -1 if there is a timeout
  w1: omap-hdq: cleanup to add missing newline for some dev_dbg
  /dev/mem: Revoke mappings when a driver claims the region
  misc: xilinx-sdfec: convert get_user_pages() --> pin_user_pages()
  misc: xilinx-sdfec: cleanup return value in xsdfec_table_write()
  misc: xilinx-sdfec: improve get_user_pages_fast() error handling
  nvmem: qfprom: remove incorrect write support
  habanalabs: handle MMU cache invalidation timeout
  habanalabs: don't allow hard reset with open processes
  habanalabs: GAUDI does not support soft-reset
  habanalabs: add print for soft reset due to event
  habanalabs: improve MMU cache invalidation code
  ...
2020-06-07 10:59:32 -07:00
Linus Torvalds
f558b8364e Driver core patches for 5.8-rc1
Here is the set of driver core patches for 5.8-rc1.
 
 Not all that huge this release, just a number of small fixes and
 updates:
 	- software node fixes
 	- kobject now sends KOBJ_REMOVE when it is removed from sysfs,
 	  not when it is removed from memory (which could come much
 	  later)
 	- device link additions and fixes based on testing on more
 	  devices
 	- firmware core cleanups
 	- other minor changes, full details in the shortlog
 
 All have been in linux-next for a while with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCXtzmXg8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymaAQCfZZ9prH3AMLF7DIkG3vMw0njLXt0An2FxrKYU
 wetHRG4KL9vTkdz7+TqU
 =t5LE
 -----END PGP SIGNATURE-----

Merge tag 'driver-core-5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

Pull driver core updates from Greg KH:
 "Here is the set of driver core patches for 5.8-rc1.

  Not all that huge this release, just a number of small fixes and
  updates:

   - software node fixes

   - kobject now sends KOBJ_REMOVE when it is removed from sysfs, not
     when it is removed from memory (which could come much later)

   - device link additions and fixes based on testing on more devices

   - firmware core cleanups

   - other minor changes, full details in the shortlog

  All have been in linux-next for a while with no reported issues"

* tag 'driver-core-5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (23 commits)
  driver core: Update device link status correctly for SYNC_STATE_ONLY links
  firmware_loader: change enum fw_opt to u32
  software node: implement software_node_unregister()
  kobject: send KOBJ_REMOVE uevent when the object is removed from sysfs
  driver core: Remove unnecessary is_fwnode_dev variable in device_add()
  drivers property: When no children in primary, try secondary
  driver core: platform: Fix spelling errors in platform.c
  driver core: Remove check in driver_deferred_probe_force_trigger()
  of: platform: Batch fwnode parsing when adding all top level devices
  driver core: fw_devlink: Add support for batching fwnode parsing
  driver core: Look for waiting consumers only for a fwnode's primary device
  driver core: Move code to the right part of the file
  Revert "Revert "driver core: Set fw_devlink to "permissive" behavior by default""
  drivers: base: Fix NULL pointer exception in __platform_driver_probe() if a driver developer is foolish
  firmware_loader: move fw_fallback_config to a private kernel symbol namespace
  driver core: Add missing '\n' in log messages
  driver/base/soc: Use kobj_to_dev() API
  Add documentation on meaning of -EPROBE_DEFER
  driver core: platform: remove redundant assignment to variable ret
  debugfs: Use the correct style for SPDX License Identifier
  ...
2020-06-07 10:53:36 -07:00
Linus Torvalds
80ef846e99 Staging/IIO driver patches for 5.8-rc1
Here is the large set of staging and IIO driver changes for 5.8-rc1
 
 Nothing major, but a lot of new IIO drivers are included in here, along
 with other core iio cleanups and changes.
 
 On the staging driver front, again, nothing noticable.  No new deletions
 or additions, just a ton of tiny cleanups all over the tree done by a
 lot of different people.  Most coding style, but many actual real fixes
 and cleanups that are nice to see.
 
 All of these have been in linux-next for a while with no reported
 issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCXtzoAQ8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ym9FwCgkW8WZJGnvHLjuuG8C01azCEh/KUAoJRji8jK
 4zCG8NxAPFsQ1QP2SZPq
 =jEyw
 -----END PGP SIGNATURE-----

Merge tag 'staging-5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging/IIO driver updates from Greg KH:
 "Here is the large set of staging and IIO driver changes for 5.8-rc1

  Nothing major, but a lot of new IIO drivers are included in here,
  along with other core iio cleanups and changes.

  On the staging driver front, again, nothing noticable. No new
  deletions or additions, just a ton of tiny cleanups all over the tree
  done by a lot of different people. Most coding style, but many actual
  real fixes and cleanups that are nice to see.

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'staging-5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (618 commits)
  staging: rtl8723bs: Use common packet header constants
  staging: sm750fb: Add names to proc_setBLANK args
  staging: most: usb: init return value in default path of switch/case expression
  staging: vchiq: Get rid of VCHIQ_SERVICE_OPENEND callback reason
  staging: vchiq: move vchiq_release_message() into vchiq
  staging: vchi: Get rid of C++ guards
  staging: vchi: Get rid of not implemented function declarations
  staging: vchi: Get rid of vchiq_status_to_vchi()
  staging: vchi: Get rid of vchi_service_set_option()
  staging: vchi: Merge vchi_msg_queue() into vchi_queue_kernel_message()
  staging: vchiq: Move copy callback handling into vchiq
  staging: vchi: Get rid of vchi_queue_user_message()
  staging: vchi: Get rid of vchi_service_destroy()
  staging: most: usb: use function sysfs_streq
  staging: most: usb: add missing put_device calls
  staging: most: usb: use correct error codes
  staging: most: usb: replace code to calculate array index
  staging: most: usb: don't use error path to exit function on success
  staging: most: usb: move allocation of URB out of critical section
  staging: most: usb: return 0 instead of variable
  ...
2020-06-07 10:45:08 -07:00
Linus Torvalds
081096d98b TTY/Serial driver updates for 5.8-rc1
Here is the tty and serial driver updates for 5.8-rc1
 
 Nothing huge at all, just a lot of little serial driver fixes, updates
 for new devices and features, and other small things.  Full details are
 in the shortlog.
 
 Note, you will get a conflict merging with your tree in the
 Documentation/devicetree/bindings/serial/rs485.yaml file, but it should
 be pretty obvious what to do.  If not, I'm sure Rob will clean it all up
 afterwards :)
 
 All of these have been in linux-next with no issues for a while.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCXtzpCg8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ylRxACgjGtOKPjahONL4lWd0F8ZYEcyw7sAn34woBCO
 BDUV3kolrRQ4OYNJWsHP
 =TvqG
 -----END PGP SIGNATURE-----

Merge tag 'tty-5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull tty/serial driver updates from Greg KH:
 "Here is the tty and serial driver updates for 5.8-rc1

  Nothing huge at all, just a lot of little serial driver fixes, updates
  for new devices and features, and other small things. Full details are
  in the shortlog.

  All of these have been in linux-next with no issues for a while"

* tag 'tty-5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (67 commits)
  tty: serial: qcom_geni_serial: Add 51.2MHz frequency support
  tty: serial: imx: clear Ageing Timer Interrupt in handler
  serial: 8250_fintek: Add F81966 Support
  sc16is7xx: Add flag to activate IrDA mode
  dt-bindings: sc16is7xx: Add flag to activate IrDA mode
  serial: 8250: Support rs485 bus termination GPIO
  serial: 8520_port: Fix function param documentation
  dt-bindings: serial: Add binding for rs485 bus termination GPIO
  vt: keyboard: avoid signed integer overflow in k_ascii
  serial: 8250: Enable 16550A variants by default on non-x86
  tty: hvc_console, fix crashes on parallel open/close
  serial: imx: Initialize lock for non-registered console
  sc16is7xx: Read the LSR register for basic device presence check
  sc16is7xx: Allow sharing the IRQ line
  sc16is7xx: Use threaded IRQ
  sc16is7xx: Always use falling edge IRQ
  tty: n_gsm: Fix bogus i++ in gsm_data_kick
  tty: n_gsm: Remove unnecessary test in gsm_print_packet()
  serial: stm32: add no_console_suspend support
  tty: serial: fsl_lpuart: Use __maybe_unused instead of #if CONFIG_PM_SLEEP
  ...
2020-06-07 09:52:36 -07:00
Linus Torvalds
e611c0fe31 USB/PHY driver updates for 5.8-rc1
Here are the large set of USB and PHY driver updates for 5.8-rc1.
 
 Nothing huge, just lots of little things:
 	- USB gadget fixes and additions all over the place
 	- new PHY drivers
 	- PHY driver fixes and updates
 	- XHCI driver updates
 	- musb driver updates
 	- more USB-serial driver ids added
 	- various USB quirks added
 	- thunderbolt minor updates and fixes
 	- typec updates and additions
 
 Full details are in the shortlog.
 
 All of these have been in linux-next for a while with no reported
 issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCXtzqVA8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ynftwCfeanyI6TR5AdfJVZN50B6/ySvVwcAn07i9VRX
 tnt2kz0UqReYpLt0wyJ7
 =YP7o
 -----END PGP SIGNATURE-----

Merge tag 'usb-5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB/PHY driver updates from Greg KH:
 "Here are the large set of USB and PHY driver updates for 5.8-rc1.

  Nothing huge, just lots of little things:

   - USB gadget fixes and additions all over the place

   - new PHY drivers

   - PHY driver fixes and updates

   - XHCI driver updates

   - musb driver updates

   - more USB-serial driver ids added

   - various USB quirks added

   - thunderbolt minor updates and fixes

   - typec updates and additions

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'usb-5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (245 commits)
  usb: dwc3: meson-g12a: fix USB2 PHY initialization on G12A and A1 SoCs
  usb: dwc3: meson-g12a: fix error path when fetching the reset line fails
  Revert "dt-bindings: usb: qcom,dwc3: Convert USB DWC3 bindings"
  Revert "dt-bindings: usb: qcom,dwc3: Add compatible for SC7180"
  Revert "dt-bindings: usb: qcom,dwc3: Introduce interconnect properties for Qualcomm DWC3 driver"
  USB: serial: ch341: fix lockup of devices with limited prescaler
  USB: serial: ch341: add basis for quirk detection
  CDC-ACM: heed quirk also in error handling
  USB: serial: option: add Telit LE910C1-EUX compositions
  usb: musb: Fix runtime PM imbalance on error
  usb: musb: jz4740: Prevent lockup when CONFIG_SMP is set
  usb: musb: mediatek: add reset FADDR to zero in reset interrupt handle
  usb: musb: use true for 'use_dma'
  usb: musb: start session in resume for host port
  usb: musb: return -ESHUTDOWN in urb when three-strikes error happened
  USB: serial: qcserial: add DW5816e QDL support
  thunderbolt: Add trivial .shutdown
  usb: dwc3: keystone: Turn on USB3 PHY before controller
  dt-bindings: usb: ti,keystone-dwc3.yaml: Add USB3.0 PHY property
  dt-bindings: usb: convert keystone-usb.txt to YAML
  ...
2020-06-07 09:42:16 -07:00
Al Viro
9d964e1b82 fix a braino in "sparc32: fix register window handling in genregs32_[gs]et()"
lost npc in PTRACE_SETREGSET, breaking PTRACE_SETREGS as well

Fixes: cf51e129b9 "sparc32: fix register window handling in genregs32_[gs]et()"
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2020-06-07 10:37:09 -04:00
Dan Murphy
4e2905adac net: dp83869: Reset return variable if PHY strap is read
When the PHY's strap register is read to determine if lane swapping is
needed the phy_read_mmd returns the value back into the ret variable.

If the call to read the strap fails the failed value is returned.  If
the call to read the strap is successful then ret is possibly set to a
non-zero positive number. Without reseting the ret value to 0 this will
cause the parse DT function to return a failure.

Fixes: c4566aec6e ("net: phy: dp83869: Update port-mirroring to read straps")
Signed-off-by: Dan Murphy <dmurphy@ti.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-06-06 15:53:44 -07:00
Herbert Xu
4a3084aaa8 rhashtable: Drop raw RCU deref in nested_table_free
This patch replaces some unnecessary uses of rcu_dereference_raw
in the rhashtable code with rcu_dereference_protected.

The top-level nested table entry is only marked as RCU because it
shares the same type as the tree entries underneath it.  So it
doesn't need any RCU protection.

We also don't need RCU protection when we're freeing a nested RCU
table because by this stage we've long passed a memory barrier
when anyone could change the nested table.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-06-06 15:51:17 -07:00
Linus Torvalds
3b69e8b457 Fix for arch/sh build regression with newer binutils, removal of SH5,
fixes for module exports, and misc cleanup.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQEcBAABAgAGBQJe28l0AAoJELcQ+SIFb8HaKFMH/0T7tHfWit4+efmeDLhfrewd
 Fq9lLnEGmLy82AZqmd730gvD2ckbjUCm0ikKC79sCd14r3bIB1RCDKfXbY6rB3uI
 EDijbkzsjfOYG9ZAiDYTIbyrM2u2/1PzFiYTxHVDtPLbCPGfacbcfrDL+u143IXP
 ez/RHGLE6uYDvKi0Y0/VDKgMCW9bNlcEkL2/tKFVg2cipDi2Lfmi3Jss/id+5uOI
 N8XeZoyHjyWr7GeRZwN/hNPLDvLY//Uf5q6RB9VrTsN4Vrja7kjWMZkgsGkmGbNo
 f6BbLenq+KMfOSJrIzS3MgTRinoqRF5S518pkbGtgRQn0rZKfd6h85DG15RlPGk=
 =Ktnp
 -----END PGP SIGNATURE-----

Merge tag 'sh-for-5.8' of git://git.libc.org/linux-sh

Pull arch/sh updates from Rich Felker:
 "Fix for arch/sh build regression with newer binutils, removal of SH5,
  fixes for module exports, and misc cleanup"

* tag 'sh-for-5.8' of git://git.libc.org/linux-sh:
  sh: remove sh5 support
  sh: add missing EXPORT_SYMBOL() for __delay
  sh: Convert ins[bwl]/outs[bwl] macros to inline functions
  sh: Convert iounmap() macros to inline functions
  sh: Add missing DECLARE_EXPORT() for __ashiftrt_r4_xx
  sh: configs: Cleanup old Kconfig IO scheduler options
  arch/sh: vmlinux.scr
  sh: Replace CONFIG_MTD_M25P80 with CONFIG_MTD_SPI_NOR in sh7757lcr_defconfig
  sh: sh4a: Bring back tmu3_device early device
2020-06-06 15:22:01 -07:00
Zhu Lingshan
e7991f376a ifcvf: implement config interrupt in IFCVF
This commit implements config interrupt support
in IFC VF

Signed-off-by: Zhu Lingshan <lingshan.zhu@intel.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/1591352835-22441-6-git-send-email-lingshan.zhu@intel.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-06-06 16:26:47 -04:00
Zhu Lingshan
e0136c16fa vhost: replace -1 with VHOST_FILE_UNBIND in ioctls
This commit replaces -1 with VHOST_FILE_UNBIND in ioctls since
we have added such a macro in the uapi header for vdpa_host.

Signed-off-by: Zhu Lingshan <lingshan.zhu@intel.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/1591352835-22441-5-git-send-email-lingshan.zhu@intel.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-06-06 16:26:27 -04:00
Zhu Lingshan
776f395004 vhost_vdpa: Support config interrupt in vdpa
This commit implements config interrupt support in
vhost_vdpa layer.

Signed-off-by: Zhu Lingshan <lingshan.zhu@intel.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/1591352835-22441-4-git-send-email-lingshan.zhu@intel.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-06-06 16:26:27 -04:00
Zhu Lingshan
bb02e6e63d ifcvf: ignore continuous setting same status value
User space may try to set status of same value multiple times,
this patch handles this case more efficiently by ignoring the
setting of the same status value.

Signed-off-by: Zhu Lingshan <lingshan.zhu@intel.com>
Link: https://lore.kernel.org/r/1591352835-22441-3-git-send-email-lingshan.zhu@intel.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-06-06 16:25:22 -04:00