Commit graph

600697 commits

Author SHA1 Message Date
Nirmal Abraham
a1655ade5d msm: mdss: use uaccess routines to access user space buffers
Use routines defined in uaccess.h (like put_user, get_user)
while accessing user space buffers. Otherwise this leads to
userspace access violation when PAN is enabled.

Change-Id: Iea16e347ee71f0845711a21b6b9b01e16a6ab619
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
2018-07-23 17:54:22 +05:30
Linux Build Service Account
a71e8433d7 Merge "msm: camera: isp : Fix race condition in close sequence" 2018-07-23 03:03:48 -07:00
Srikanth Uyyala
c9eb396da5 msm: camera: isp : Fix race condition in close sequence
Serializing reset_hw and reset_irq, to avoid race condition

Change-Id: I8f21cb816748129bde7f0f1455b203b42603d244
Signed-off-by: Srikanth Uyyala <suyyala@codeaurora.org>
2018-07-23 10:44:50 +05:30
Gerrit - the friendly Code Review server
595eeed398 Merge changes into msm-4.4 2018-07-20 21:57:10 -07:00
Linux Build Service Account
05faf99fea Merge "msm: camera: skip recovery during stream off in dual vfe" 2018-07-20 12:17:58 -07:00
Rahul Sharma
bf9dde89b8 drm/sde: report MDP underrun error only if not stabilized
MDP underrun error is being reported to recovery manager as and when they
are detected by the interrupt handler. Since most of the times errors are
recovered successfully and stabilizes and hence we do not need to report in
those scenarios.

This implementation uses a delayed work to figure out if the error is
stabilized. In case if error is still persists then it would be reported
to the recovery manager.

Change-Id: I3509484867d86dc946dd4be856d85de444c0aa60
Signed-off-by: Rahul Sharma <rahsha@codeaurora.org>
2018-07-20 16:53:04 +05:30
Linux Build Service Account
4b519e0d9f Merge "defconfig: sdm660: align with android config requirement" 2018-07-20 02:38:08 -07:00
Linux Build Service Account
c48c535a72 Merge "msm: vidc: Addition of enums for HLG and HDR10" 2018-07-20 02:38:07 -07:00
Linux Build Service Account
1f9a2cdec9 Merge "Merge android-4.4.140 (789274d) into msm-4.4" 2018-07-20 02:38:05 -07:00
Linux Build Service Account
074aef20c5 Merge "diag: Featurize IPC logging" 2018-07-20 02:38:03 -07:00
Yong Ding
769a58cd28 soc: qcom: hab: change the unregistration to be dummy
HAB service should be kept available as long as possible
since it is very fundamental. It can possibly be used in
the GVM(Guest Virtual Machine) shutdown procedure to
talk with the hypervisor. And the unregistration function
will only be left to give a log message.

Change-Id: I0cbc153a68a0fb496d14fc49db6cfee211a01722
Signed-off-by: Yong Ding <yongding@codeaurora.org>
2018-07-20 17:00:29 +08:00
Srikanth Uyyala
d0097debb3 msm: camera: skip recovery during stream off in dual vfe
in dual vfe usecase, skip pingpong mismatch recovery
if one of the vfe's active stream count is zero.

Change-Id: I1b4dce66ad6665e41c4185d3ac510204d40131da
Signed-off-by: Srikanth Uyyala <suyyala@codeaurora.org>
2018-07-20 12:14:47 +05:30
Srikanth Uyyala
3a3c7c7bb1 msm: camera: Dont call recovery for inactive streams
During Stream-off is in progress and all active
streams are zero and that instant if we cause
pingpong mismatch, recovery is not expected.

Change-Id: Ibdaeb4308f33772fcd330712b0a866aedb7a9486
Signed-off-by: Srikanth Uyyala <suyyala@codeaurora.org>
2018-07-20 11:58:56 +05:30
Rahul Shahare
98732ea029 defconfig: sdm660: align with android config requirement
Align with android-base.cfg which is android kernel config
requirement for sdm660_defconfig.

Change-Id: I41566f96efe441f06986a1b4bfc6d034b2255062
Signed-off-by: Rahul Shahare <rshaha@codeaurora.org>
2018-07-19 23:19:27 -07:00
Paras Nagda
98f28d031d msm: vidc: Addition of enums for HLG and HDR10
Add HLG and ST2084 Transfer characteristics enum values as
specified in the latest HEVC spec.

Change-Id: Iff19ff5c13c4861f4d97ab0433214fe95fa84459
Signed-off-by: Paras Nagda <pnagda@codeaurora.org>
2018-07-20 10:12:07 +05:30
Balachandra C S
967528c6c6 ARM: dts: msm: Add proper irq type in device tree for msm device
Use proper irq type for gpio interrupt in qti-can controller. This
interrupt type may vary among different targets.

Change-Id: I32679cbdc29dbda49769dcb455589da64527f3cc
Signed-off-by: Balachandra C S <balacs@codeaurora.org>
2018-07-19 06:37:03 -07:00
Balachandra C S
fc93ec766e drivers: net: can: Inform power states to CAN controller
CAN controller needs to be aware of host power state to decide
if a timestamp message can be sent to host or not.

Change-Id: I89a570a2fb38336c38d0105bbb3df8b89d7e3035
Signed-off-by: Balachandra C S <balacs@codeaurora.org>
2018-07-19 06:36:40 -07:00
Balachandra C S
eb119bcb2a drivers: net: can: Add timestamp adjustment for frames in qti-can
Correct the frame timestamp based on the controller and host
time difference.

Change-Id: I6c60b943d18779a9bd9f221a2344dcea90b9fb5a
Signed-off-by: Balachandra C S <balacs@codeaurora.org>
2018-07-19 19:02:29 +05:30
Nirmal Abraham
5dda52d4de msm: mdss: cleanup used pipes during overlay off
During overlay off, cleanup pipes which are currently active
in used pipes list. This is to avoid to a race condition
wherein the pipe params gets changed in prepare cycle,
but the commit cylce has not executed to queue the buffers
associated with the pipe and the same pipe which has old
buffer(stale content) gets used from overlay_off flow.

Change-Id: I117e6ee9854ff287f7bb1055ca745760db980bed
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
2018-07-19 18:19:32 +05:30
Mohit Aggarwal
4b97647dc2 diag: Featurize IPC logging
Currently, in case IPC logging related config
is disabled then there are some unwanted error
logs in kernel logs. Featurize IPC logging to
get rid of error logs.

Change-Id: I8455f5e3a13cf58b4d65d1e1a5c4f1ec0adedabf
Signed-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>
2018-07-19 13:38:15 +05:30
Rahul Sharma
faa4206fb7 drm/sde: bridge chip error and smmu fault handling for recovery
This implementation adds the following support:

1. handle bridge chip error reported by driver to DBA. error reported
   to DBA will be send to recovery manager to recover the faulty
   bridge chip by performing a power cycle.

2. smmu fault error notification.

3. detection on errors in bridge chip driver.

Change-Id: I86cc491e3cd25fdcf9b998a0d687baba0a06d836
Signed-off-by: Rahul Sharma <rahsha@codeaurora.org>
2018-07-19 10:08:28 +05:30
Linux Build Service Account
8acbfc522f Merge "usb: dwc3-msm: Add boot marker" 2018-07-18 20:29:02 -07:00
Blagovest Kolenichev
df1c139ee7 Merge android-4.4.140 (789274d) into msm-4.4
* refs/heads/tmp-789274d
  Linux 4.4.140
  staging: comedi: quatech_daqp_cs: fix no-op loop daqp_ao_insn_write()
  netfilter: nf_log: don't hold nf_log_mutex during user access
  mtd: cfi_cmdset_0002: Change erase functions to check chip good only
  mtd: cfi_cmdset_0002: Change erase functions to retry for error
  mtd: cfi_cmdset_0002: Change definition naming to retry write operation
  dm bufio: don't take the lock in dm_bufio_shrink_count
  mtd: rawnand: mxc: set spare area size register explicitly
  dm bufio: drop the lock when doing GFP_NOIO allocation
  dm bufio: avoid sleeping while holding the dm_bufio lock
  mm, page_alloc: do not break __GFP_THISNODE by zonelist reset
  media: cx25840: Use subdev host data for PLL override
  x86/mce: Fix incorrect "Machine check from unknown source" message
  x86/mce: Detect local MCEs properly
  HID: debug: check length before copy_to_user()
  HID: hiddev: fix potential Spectre v1
  HID: i2c-hid: Fix "incomplete report" noise
  ext4: check superblock mapped prior to committing
  ext4: add more mount time checks of the superblock
  ext4: add more inode number paranoia checks
  ext4: clear i_data in ext4_inode_info when removing inline data
  ext4: include the illegal physical block in the bad map ext4_error msg
  ext4: verify the depth of extent tree in ext4_find_extent()
  ext4: only look at the bg_flags field if it is valid
  ext4: always check block group bounds in ext4_init_block_bitmap()
  ext4: make sure bitmaps and the inode table don't overlap with bg descriptors
  jbd2: don't mark block as modified if the handle is out of credits
  cifs: Fix infinite loop when using hard mount option
  drbd: fix access after free
  s390: Correct register corruption in critical section cleanup
  scsi: sg: mitigate read/write abuse
  tracing: Fix missing return symbol in function_graph output
  mm: hugetlb: yield when prepping struct pages
  ubi: fastmap: Correctly handle interrupted erasures in EBA
  ARM: dts: imx6q: Use correct SDMA script for SPI5 core
  netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain()
  nvme-pci: initialize queue memory before interrupts
  kprobes/x86: Do not modify singlestep buffer while resuming
  ipv4: Fix error return value in fib_convert_metrics()
  i2c: rcar: fix resume by always initializing registers before transfer
  ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode
  x86/boot: Fix early command-line parsing when matching at end
  n_tty: Access echo_* variables carefully.
  staging: android: ion: Return an ERR_PTR in ion_map_kernel
  n_tty: Fix stall at n_tty_receive_char_special().
  USB: serial: cp210x: add Silicon Labs IDs for Windows Update
  USB: serial: cp210x: add CESINEL device ids
  usb: cdc_acm: Add quirk for Uniden UBC125 scanner

Change-Id: I01c4fc4b6354c28a7d8ff391ff515096ed4d3da4
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2018-07-18 15:09:28 +05:30
Linux Build Service Account
2124c4de44 Merge "USB: core: harden cdc_parse_cdc_header" 2018-07-18 01:05:43 -07:00
Linux Build Service Account
5b0186d001 Merge "ARM: dts: msm: Change thermal configuration settings for msm8996." 2018-07-18 01:05:42 -07:00
Linux Build Service Account
e222538907 Merge "firmware_class: make firmware caching configurable" 2018-07-18 01:05:41 -07:00
Linux Build Service Account
a731719d4e Merge "drm: msm: add skip_ddc support for hdmi display" 2018-07-18 01:05:39 -07:00
Linux Build Service Account
eaa068f805 Merge "ARM: dts: msm: add ddc_skip on auto 8996 boards" 2018-07-18 01:05:37 -07:00
Linux Build Service Account
edbebfaaf2 Merge "drm/msm: Fix the format prints in display driver" 2018-07-17 15:06:26 -07:00
Linux Build Service Account
80db82bdaf Merge "msm: ipa: Error prints are misleading fix it" 2018-07-17 15:06:09 -07:00
Atul Raut
72c7b7b08e ARM: dts: msm: Change thermal configuration settings for msm8996.
msm-core(EA in kernel part) is enabled for thermal monitoring feature.
It sets cpu tsens threshold independent of thermal SW but not really
using any thermal info in driver. So redundant threshold get sets which
causes wakable irq to fire in hibernation restore phase.
That abort's system wide suspend transition which eventually fail to
restore hibernation image.

To fix, set thermal configuration to new threshold.

Change-Id: I38cad5217c1196d3a804fa78570984e60427a94e
Signed-off-by: Atul Raut <araut@codeaurora.org>
2018-07-17 10:43:45 -07:00
Tim Murray
8be65bee66 firmware_class: make firmware caching configurable
Because firmware caching generates uevent messages that are sent over a
netlink socket, it can prevent suspend on many platforms. It's also not
always useful, so make it a configurable option.

bug 32180327

Change-Id: I1250512b27edb56caa78d536e5ccf1fb669476ad
Signed-off-by: Tim Murray <timmurray@google.com>
Git-repo: https://source.codeaurora.org/quic/la/kernel/msm-4.4
Git-commit: e3198d51be98ec5606e2a2c5112a8a974d354fbc
Signed-off-by: Chintan Pandya <cpandya@codeaurora.org>
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2018-07-17 03:21:57 -07:00
Greg Kroah-Hartman
b1bad9e232 This is the 4.4.141 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAltNt4MACgkQONu9yGCS
 aT4Otg//e7FAfNGllvjx+53RBbpRUoa4ltdKNrdKa94ZGgVbGCdctKa9BntDkHSb
 Vw6tfvdonuJSs3e9KBSt4vOiTWkJ0eOnajdRYEQUg/jtufIULWgHNEl1dk0JB2Oj
 +8GAfXzlZ7NRfjEV0l0m44aU/qHaWVBBPQcmqLlxnLEr+0idWfSAGALEBnK6W+nH
 5yNU8X1pxVb1qSnL2YVM03+B9cfrFlpiPv46+hrHaQ6r87e+veD6f1tE1o8BvVy6
 f8CxWGvYisKJZ+OOQLH95xVahzcsGG5RKcarXzjsq30XJM1QZj8hBSWlzj0aBZmW
 OAiJ2dJccZaThxBSPJWLm6jzrUpjmQOtQMRK6TnlGxhG03eA8noxffTE03RUzL7Q
 jog6oxGgnrM+h08kmNHQEWP8EMgc6GTextKY2v9LQL51L+IBkvX8YOJwZS8YltOI
 XcoriH/lrNq5O7gSEQ4WoZWYlDlVYNc8r5EqI8lYeeShdGJqps6/wOZa1zqBFtbE
 BD0UxIDOs4zmcqPBebVUqGoPklLsGW5QfZi1dgBTiGNnopokMxia3DlPnQeq/euM
 b7+DBzL0ce2EamIh///HS+HF2uAM5N7w+BdEbYpIUCoSTKB0hUuKIM+T6rgXEvzD
 y0wJhH4SmjBH8w/Hc57VYVqOMAG+cUPDlhrw5XBkZ9HXy1ns1HM=
 =780A
 -----END PGP SIGNATURE-----

Merge 4.4.141 into android-4.4

Changes in 4.4.141
	MIPS: Fix ioremap() RAM check
	ibmasm: don't write out of bounds in read handler
	vmw_balloon: fix inflation with batching
	ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS
	USB: serial: ch341: fix type promotion bug in ch341_control_in()
	USB: serial: cp210x: add another USB ID for Qivicon ZigBee stick
	USB: serial: keyspan_pda: fix modem-status error handling
	USB: yurex: fix out-of-bounds uaccess in read handler
	USB: serial: mos7840: fix status-register error handling
	usb: quirks: add delay quirks for Corsair Strafe
	xhci: xhci-mem: off by one in xhci_stream_id_to_ring()
	HID: usbhid: add quirk for innomedia INNEX GENESIS/ATARI adapter
	Fix up non-directory creation in SGID directories
	tools build: fix # escaping in .cmd files for future Make
	iw_cxgb4: correctly enforce the max reg_mr depth
	x86/cpufeature: Move some of the scattered feature bits to x86_capability
	x86/cpufeature: Cleanup get_cpu_cap()
	x86/cpu: Provide a config option to disable static_cpu_has
	x86/fpu: Add an XSTATE_OP() macro
	x86/fpu: Get rid of xstate_fault()
	x86/headers: Don't include asm/processor.h in asm/atomic.h
	x86/cpufeature: Carve out X86_FEATURE_*
	x86/cpufeature: Replace the old static_cpu_has() with safe variant
	x86/cpufeature: Get rid of the non-asm goto variant
	x86/alternatives: Add an auxilary section
	x86/alternatives: Discard dynamic check after init
	x86/vdso: Use static_cpu_has()
	x86/boot: Simplify kernel load address alignment check
	x86/cpufeature: Speed up cpu_feature_enabled()
	x86/cpufeature, x86/mm/pkeys: Add protection keys related CPUID definitions
	x86/mm/pkeys: Fix mismerge of protection keys CPUID bits
	x86/cpu: Add detection of AMD RAS Capabilities
	x86/cpufeature, x86/mm/pkeys: Fix broken compile-time disabling of pkeys
	x86/cpufeature: Update cpufeaure macros
	x86/cpufeature: Make sure DISABLED/REQUIRED macros are updated
	x86/cpufeature: Add helper macro for mask check macros
	uprobes/x86: Remove incorrect WARN_ON() in uprobe_init_insn()
	netfilter: nf_queue: augment nfqa_cfg_policy
	netfilter: x_tables: initialise match/target check parameter struct
	loop: add recursion validation to LOOP_CHANGE_FD
	PM / hibernate: Fix oops at snapshot_write()
	RDMA/ucm: Mark UCM interface as BROKEN
	loop: remember whether sysfs_create_group() was done
	Linux 4.4.141

Change-Id: I777b39a0ede95b58638add97756d6beaf4a9d154
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-07-17 12:15:52 +02:00
Greg Kroah-Hartman
b3c6be58aa Linux 4.4.141 2018-07-17 11:31:46 +02:00
Tetsuo Handa
43991e916e loop: remember whether sysfs_create_group() was done
commit d3349b6b3c373ac1fbfb040b810fcee5e2adc7e0 upstream.

syzbot is hitting WARN() triggered by memory allocation fault
injection [1] because loop module is calling sysfs_remove_group()
when sysfs_create_group() failed.
Fix this by remembering whether sysfs_create_group() succeeded.

[1] https://syzkaller.appspot.com/bug?id=3f86c0edf75c86d2633aeb9dd69eccc70bc7e90b

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: syzbot <syzbot+9f03168400f56df89dbc6f1751f4458fe739ff29@syzkaller.appspotmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Renamed sysfs_ready -> sysfs_inited.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:46 +02:00
Leon Romanovsky
28db2b23f4 RDMA/ucm: Mark UCM interface as BROKEN
commit 7a8690ed6f5346f6738971892205e91d39b6b901 upstream.

In commit 357d23c811a7 ("Remove the obsolete libibcm library")
in rdma-core [1], we removed obsolete library which used the
/dev/infiniband/ucmX interface.

Following multiple syzkaller reports about non-sanitized
user input in the UCMA module, the short audit reveals the same
issues in UCM module too.

It is better to disable this interface in the kernel,
before syzkaller team invests time and energy to harden
this unused interface.

[1] https://github.com/linux-rdma/rdma-core/pull/279

Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:46 +02:00
Tetsuo Handa
a4ae35d678 PM / hibernate: Fix oops at snapshot_write()
commit fc14eebfc20854a38fd9f1d93a42b1783dad4d17 upstream.

syzbot is reporting NULL pointer dereference at snapshot_write() [1].
This is because data->handle is zero-cleared by ioctl(SNAPSHOT_FREE).
Fix this by checking data_of(data->handle) != NULL before using it.

[1] https://syzkaller.appspot.com/bug?id=828a3c71bd344a6de8b6a31233d51a72099f27fd

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: syzbot <syzbot+ae590932da6e45d6564d@syzkaller.appspotmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:46 +02:00
Theodore Ts'o
2250809623 loop: add recursion validation to LOOP_CHANGE_FD
commit d2ac838e4cd7e5e9891ecc094d626734b0245c99 upstream.

Refactor the validation code used in LOOP_SET_FD so it is also used in
LOOP_CHANGE_FD.  Otherwise it is possible to construct a set of loop
devices that all refer to each other.  This can lead to a infinite
loop in starting with "while (is_loop_device(f)) .." in loop_set_fd().

Fix this by refactoring out the validation code and using it for
LOOP_CHANGE_FD as well as LOOP_SET_FD.

Reported-by: syzbot+4349872271ece473a7c91190b68b4bac7c5dbc87@syzkaller.appspotmail.com
Reported-by: syzbot+40bd32c4d9a3cc12a339@syzkaller.appspotmail.com
Reported-by: syzbot+769c54e66f994b041be7@syzkaller.appspotmail.com
Reported-by: syzbot+0a89a9ce473936c57065@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:46 +02:00
Florian Westphal
0319892f56 netfilter: x_tables: initialise match/target check parameter struct
commit c568503ef02030f169c9e19204def610a3510918 upstream.

syzbot reports following splat:

BUG: KMSAN: uninit-value in ebt_stp_mt_check+0x24b/0x450
 net/bridge/netfilter/ebt_stp.c:162
 ebt_stp_mt_check+0x24b/0x450 net/bridge/netfilter/ebt_stp.c:162
 xt_check_match+0x1438/0x1650 net/netfilter/x_tables.c:506
 ebt_check_match net/bridge/netfilter/ebtables.c:372 [inline]
 ebt_check_entry net/bridge/netfilter/ebtables.c:702 [inline]

The uninitialised access is
   xt_mtchk_param->nft_compat

... which should be set to 0.
Fix it by zeroing the struct beforehand, same for tgchk.

ip(6)tables targetinfo uses c99-style initialiser, so no change
needed there.

Reported-by: syzbot+da4494182233c23a5fcf@syzkaller.appspotmail.com
Fixes: 55917a21d0 ("netfilter: x_tables: add context to know if extension runs from nft_compat")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:46 +02:00
Eric Dumazet
2e80015330 netfilter: nf_queue: augment nfqa_cfg_policy
commit ba062ebb2cd561d404e0fba8ee4b3f5ebce7cbfc upstream.

Three attributes are currently not verified, thus can trigger KMSAN
warnings such as :

BUG: KMSAN: uninit-value in __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline]
BUG: KMSAN: uninit-value in __fswab32 include/uapi/linux/swab.h:59 [inline]
BUG: KMSAN: uninit-value in nfqnl_recv_config+0x939/0x17d0 net/netfilter/nfnetlink_queue.c:1268
CPU: 1 PID: 4521 Comm: syz-executor120 Not tainted 4.17.0+ #5
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:113
 kmsan_report+0x188/0x2a0 mm/kmsan/kmsan.c:1117
 __msan_warning_32+0x70/0xc0 mm/kmsan/kmsan_instr.c:620
 __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline]
 __fswab32 include/uapi/linux/swab.h:59 [inline]
 nfqnl_recv_config+0x939/0x17d0 net/netfilter/nfnetlink_queue.c:1268
 nfnetlink_rcv_msg+0xb2e/0xc80 net/netfilter/nfnetlink.c:212
 netlink_rcv_skb+0x37e/0x600 net/netlink/af_netlink.c:2448
 nfnetlink_rcv+0x2fe/0x680 net/netfilter/nfnetlink.c:513
 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
 netlink_unicast+0x1680/0x1750 net/netlink/af_netlink.c:1336
 netlink_sendmsg+0x104f/0x1350 net/netlink/af_netlink.c:1901
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg net/socket.c:639 [inline]
 ___sys_sendmsg+0xec8/0x1320 net/socket.c:2117
 __sys_sendmsg net/socket.c:2155 [inline]
 __do_sys_sendmsg net/socket.c:2164 [inline]
 __se_sys_sendmsg net/socket.c:2162 [inline]
 __x64_sys_sendmsg+0x331/0x460 net/socket.c:2162
 do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x43fd59
RSP: 002b:00007ffde0e30d28 EFLAGS: 00000213 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fd59
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8
R10: 00000000004002c8 R11: 0000000000000213 R12: 0000000000401680
R13: 0000000000401710 R14: 0000000000000000 R15: 0000000000000000

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279 [inline]
 kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:189
 kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:315
 kmsan_slab_alloc+0x10/0x20 mm/kmsan/kmsan.c:322
 slab_post_alloc_hook mm/slab.h:446 [inline]
 slab_alloc_node mm/slub.c:2753 [inline]
 __kmalloc_node_track_caller+0xb35/0x11b0 mm/slub.c:4395
 __kmalloc_reserve net/core/skbuff.c:138 [inline]
 __alloc_skb+0x2cb/0x9e0 net/core/skbuff.c:206
 alloc_skb include/linux/skbuff.h:988 [inline]
 netlink_alloc_large_skb net/netlink/af_netlink.c:1182 [inline]
 netlink_sendmsg+0x76e/0x1350 net/netlink/af_netlink.c:1876
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg net/socket.c:639 [inline]
 ___sys_sendmsg+0xec8/0x1320 net/socket.c:2117
 __sys_sendmsg net/socket.c:2155 [inline]
 __do_sys_sendmsg net/socket.c:2164 [inline]
 __se_sys_sendmsg net/socket.c:2162 [inline]
 __x64_sys_sendmsg+0x331/0x460 net/socket.c:2162
 do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: fdb694a01f ("netfilter: Add fail-open support")
Fixes: 829e17a1a6 ("[NETFILTER]: nfnetlink_queue: allow changing queue length through netlink")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:46 +02:00
Oleg Nesterov
e353bf5f4c uprobes/x86: Remove incorrect WARN_ON() in uprobe_init_insn()
commit 90718e32e1dcc2479acfa208ccfc6442850b594c upstream.

insn_get_length() has the side-effect of processing the entire instruction
but only if it was decoded successfully, otherwise insn_complete() can fail
and in this case we need to just return an error without warning.

Reported-by: syzbot+30d675e3ca03c1c351e7@syzkaller.appspotmail.com
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: syzkaller-bugs@googlegroups.com
Link: https://lkml.kernel.org/lkml/20180518162739.GA5559@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:45 +02:00
Dave Hansen
b7e37d9a90 x86/cpufeature: Add helper macro for mask check macros
commit 8eda072e9d7c3429a372e3635dc5851f4a42dee1 upstream

Every time we add a word to our cpu features, we need to add
something like this in two places:

	(((bit)>>5)==16 && (1UL<<((bit)&31) & REQUIRED_MASK16))

The trick is getting the "16" in this case in both places.  I've
now screwed this up twice, so as pennance, I've come up with
this patch to keep me and other poor souls from doing the same.

I also commented the logic behind the bit manipulation showcased
above.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave@sr71.net>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20160629200110.1BA8949E@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
Reviewed-by: Matt Helsley (VMware) <matt.helsley@gmail.com>
Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>
Reviewed-by: Bo Gan <ganb@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:45 +02:00
Dave Hansen
8ebab07946 x86/cpufeature: Make sure DISABLED/REQUIRED macros are updated
commit 1e61f78baf893c7eb49f633d23ccbb420c8f808e upstream

x86 has two macros which allow us to evaluate some CPUID-based
features at compile time:

	REQUIRED_MASK_BIT_SET()
	DISABLED_MASK_BIT_SET()

They're both defined by having the compiler check the bit
argument against some constant masks of features.

But, when adding new CPUID leaves, we need to check new words
for these macros.  So make sure that those macros and the
REQUIRED_MASK* and DISABLED_MASK* get updated when necessary.

This looks kinda silly to have an open-coded value ("18" in
this case) open-coded in 5 places in the code.  But, we really do
need 5 places updated when NCAPINTS gets bumped, so now we just
force the issue.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave@sr71.net>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20160629200108.92466F6F@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
Reviewed-by: Matt Helsley (VMware) <matt.helsley@gmail.com>
Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>
Reviewed-by: Bo Gan <ganb@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:45 +02:00
Dave Hansen
febdf817e7 x86/cpufeature: Update cpufeaure macros
commit 6e17cb9c2d5efd8fcc3934e983733302b9912ff8 upstream

We had a new CPUID "NCAPINT" word added, but the REQUIRED_MASK and
DISABLED_MASK macros did not get updated.  Update them.

None of the features was needed in these masks, so there was no
harm, but we should keep them updated anyway.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave@sr71.net>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20160629200107.8D3C9A31@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
Reviewed-by: Matt Helsley (VMware) <matt.helsley@gmail.com>
Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>
Reviewed-by: Bo Gan <ganb@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:45 +02:00
Dave Hansen
793ea13ecc x86/cpufeature, x86/mm/pkeys: Fix broken compile-time disabling of pkeys
commit e8df1a95b685af84a81698199ee206e0e66a8b44 upstream

When I added support for the Memory Protection Keys processor
feature, I had to reindent the REQUIRED/DISABLED_MASK macros, and
also consult the later cpufeature words.

I'm not quite sure how I bungled it, but I consulted the wrong
word at the end.  This only affected required or disabled cpu
features in cpufeature words 14, 15 and 16.  So, only Protection
Keys itself was screwed over here.

The result was that if you disabled pkeys in your .config, you
might still see some code show up that should have been compiled
out.  There should be no functional problems, though.

In verifying this patch I also realized that the DISABLE_PKU/OSPKE
macros were defined backwards and that the cpu_has() check in
setup_pku() was not doing the compile-time disabled checks.

So also fix the macro for DISABLE_PKU/OSPKE and add a compile-time
check for pkeys being enabled in setup_pku().

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: <stable@vger.kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Dave Hansen <dave@sr71.net>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Fixes: dfb4a70f20c5 ("x86/cpufeature, x86/mm/pkeys: Add protection keys related CPUID definitions")
Link: http://lkml.kernel.org/r/20160513221328.C200930B@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
Reviewed-by: Matt Helsley (VMware) <matt.helsley@gmail.com>
Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>
Reviewed-by: Bo Gan <ganb@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:45 +02:00
Yazen Ghannam
9cc52d168f x86/cpu: Add detection of AMD RAS Capabilities
commit 71faad43060d3d2040583635fbf7d1bdb3d04118 upstream

Add a new CPUID leaf to hold the contents of CPUID 0x80000007_EBX (RasCap).

Define bits that are currently in use:

 Bit 0: McaOverflowRecov
 Bit 1: SUCCOR
 Bit 3: ScalableMca

Signed-off-by: Yazen Ghannam <Yazen.Ghannam@amd.com>
[ Shorten comment. ]
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Tony Luck <tony.luck@intel.com>
Cc: linux-edac <linux-edac@vger.kernel.org>
Link: http://lkml.kernel.org/r/1462971509-3856-5-git-send-email-bp@alien8.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
Reviewed-by: Matt Helsley (VMware) <matt.helsley@gmail.com>
Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>
Reviewed-by: Bo Gan <ganb@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:45 +02:00
Dave Hansen
e5918939e5 x86/mm/pkeys: Fix mismerge of protection keys CPUID bits
commit 0d47638f80a02b15869f1fe1fc09e5bf996750fd upstream

Kirill Shutemov pointed this out to me.

The tip tree currently has commit:

	dfb4a70f2 [x86/cpufeature, x86/mm/pkeys: Add protection keys related CPUID definitions]

whioch added support for two new CPUID bits: X86_FEATURE_PKU and
X86_FEATURE_OSPKE.  But, those bits were mis-merged and put in
cpufeature.h instead of cpufeatures.h.

This didn't cause any breakage *except* it keeps the "ospke" and
"pku" bits from showing up in cpuinfo.

Now cpuinfo has the two new flags:

	flags	: ...  pku ospke

BTW, is it really wise to have cpufeature.h and cpufeatures.h?
It seems like they can only cause confusion and mahem with tab
completion.

Reported-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Borislav Petkov <bp@suse.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Dave Hansen <dave@sr71.net>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20160310221213.06F9DB53@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
Reviewed-by: Matt Helsley (VMware) <matt.helsley@gmail.com>
Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>
Reviewed-by: Bo Gan <ganb@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:45 +02:00
Dave Hansen
747b9cefca x86/cpufeature, x86/mm/pkeys: Add protection keys related CPUID definitions
commit dfb4a70f20c5b3880da56ee4c9484bdb4e8f1e65 upstream

There are two CPUID bits for protection keys.  One is for whether
the CPU contains the feature, and the other will appear set once
the OS enables protection keys.  Specifically:

	Bit 04: OSPKE. If 1, OS has set CR4.PKE to enable
	Protection keys (and the RDPKRU/WRPKRU instructions)

This is because userspace can not see CR4 contents, but it can
see CPUID contents.

X86_FEATURE_PKU is referred to as "PKU" in the hardware documentation:

	CPUID.(EAX=07H,ECX=0H):ECX.PKU [bit 3]

X86_FEATURE_OSPKE is "OSPKU":

	CPUID.(EAX=07H,ECX=0H):ECX.OSPKE [bit 4]

These are the first CPU features which need to look at the
ECX word in CPUID leaf 0x7, so this patch also includes
fetching that word in to the cpuinfo->x86_capability[] array.

Add it to the disabled-features mask when its config option is
off.  Even though we are not using it here, we also extend the
REQUIRED_MASK_BIT_SET() macro to keep it mirroring the
DISABLED_MASK_BIT_SET() version.

This means that in almost all code, you should use:

	cpu_has(c, X86_FEATURE_PKU)

and *not* the CONFIG option.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave@sr71.net>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: linux-mm@kvack.org
Link: http://lkml.kernel.org/r/20160212210201.7714C250@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
Reviewed-by: Matt Helsley (VMware) <matt.helsley@gmail.com>
Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>
Reviewed-by: Bo Gan <ganb@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:45 +02:00
Borislav Petkov
21a4ec5918 x86/cpufeature: Speed up cpu_feature_enabled()
commit f2cc8e0791c70833758101d9756609a08dd601ec upstream

When GCC cannot do constant folding for this macro, it falls back to
cpu_has(). But static_cpu_has() is optimal and it works at all times
now. So use it and speedup the fallback case.

Before we had this:

  mov    0x99d674(%rip),%rdx        # ffffffff81b0d9f4 <boot_cpu_data+0x34>
  shr    $0x2e,%rdx
  and    $0x1,%edx
  jne    ffffffff811704e9 <do_munmap+0x3f9>

After alternatives patching, it turns into:

		  jmp    0xffffffff81170390
		  nopl   (%rax)
		  ...
		  callq  ffffffff81056e00 <mpx_notify_unmap>
ffffffff81170390: mov    0x170(%r12),%rdi

Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: Joerg Roedel <joro@8bytes.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1455578358-28347-1-git-send-email-bp@alien8.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
Reviewed-by: Matt Helsley (VMware) <matt.helsley@gmail.com>
Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>
Reviewed-by: Bo Gan <ganb@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:45 +02:00
Alexander Kuleshov
a1b00d5729 x86/boot: Simplify kernel load address alignment check
commit a4733143085d6c782ac1e6c85778655b6bac1d4e upstream

We are using %rax as temporary register to check the kernel
address alignment. We don't really have to since the TEST
instruction does not clobber the destination operand.

Suggested-by: Brian Gerst <brgerst@gmail.com>
Signed-off-by: Alexander Kuleshov <kuleshovmail@gmail.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: Alexander Popov <alpopov@ptsecurity.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1453531828-19291-1-git-send-email-kuleshovmail@gmail.com
Link: http://lkml.kernel.org/r/1453842730-28463-11-git-send-email-bp@alien8.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
Reviewed-by: Matt Helsley (VMware) <matt.helsley@gmail.com>
Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>
Reviewed-by: Bo Gan <ganb@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:31:45 +02:00