Commit graph

603772 commits

Author SHA1 Message Date
Florian Fainelli
66e43f427d smsc75xx: Check for Wake-on-LAN modes
[ Upstream commit 9c734b2769a73eea2e9e9767c0e0bf839ff23679 ]

The driver does not check for Wake-on-LAN modes specified by an user,
but will conditionally set the device as wake-up enabled or not based on
that, which could be a very confusing user experience.

Fixes: 6c63650326 ("smsc75xx: add wol magic packet support")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-10 07:41:34 -08:00
Florian Fainelli
2bb181d8a8 r8152: Check for supported Wake-on-LAN Modes
[ Upstream commit f2750df1548bd8a2b060eb609fc43ca82811af4c ]

The driver does not check for Wake-on-LAN modes specified by an user,
but will conditionally set the device as wake-up enabled or not based on
that, which could be a very confusing user experience.

Fixes: 21ff2e8976 ("r8152: support WOL")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-10 07:41:34 -08:00
Florian Fainelli
24665cbd76 sr9800: Check for supported Wake-on-LAN modes
[ Upstream commit c5cb93e994ffb43b7b3b1ff10b9f928f54574a36 ]

The driver currently silently accepts unsupported Wake-on-LAN modes
(other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user,
which is confusing.

Fixes: 19a38d8e0a ("USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-10 07:41:34 -08:00
Florian Fainelli
04d846cddb lan78xx: Check for supported Wake-on-LAN modes
[ Upstream commit eb9ad088f96653a26b340f7c447c44cf023d5cdc ]

The driver supports a fair amount of Wake-on-LAN modes, but is not
checking that the user specified one that is supported.

Fixes: 55d7de9de6 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Woojung Huh <Woojung.Huh@Microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-10 07:41:33 -08:00
Florian Fainelli
f3d71a323f ax88179_178a: Check for supported Wake-on-LAN modes
[ Upstream commit 5ba6b4aa9a410c5e2c6417df52b5e2118ea9b467 ]

The driver currently silently accepts unsupported Wake-on-LAN modes
(other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user,
which is confusing.

Fixes: e2ca90c276 ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-10 07:41:33 -08:00
Florian Fainelli
644d191853 asix: Check for supported Wake-on-LAN modes
[ Upstream commit c4ce446e33d7a0e978256ac6fea4c80e59d9de5f ]

The driver currently silently accepts unsupported Wake-on-LAN modes
(other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user,
which is confusing.

Fixes: 2e55cc7210 ("[PATCH] USB: usbnet (3/9) module for ASIX Ethernet adapters")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-10 07:41:33 -08:00
Lubomir Rintel
df2d090bc5 pxa168fb: prepare the clock
[ Upstream commit d85536cde91fcfed6fb8d983783bd2b92c843939 ]

Add missing prepare/unprepare operations for fbi->clk,
this fixes following kernel warning:

  ------------[ cut here ]------------
  WARNING: CPU: 0 PID: 1 at drivers/clk/clk.c:874 clk_core_enable+0x2c/0x1b0
  Enabling unprepared disp0_clk
  Modules linked in:
  CPU: 0 PID: 1 Comm: swapper Not tainted 4.18.0-rc8-00032-g02b43ddd4f21-dirty #25
  Hardware name: Marvell MMP2 (Device Tree Support)
  [<c010f7cc>] (unwind_backtrace) from [<c010cc6c>] (show_stack+0x10/0x14)
  [<c010cc6c>] (show_stack) from [<c011dab4>] (__warn+0xd8/0xf0)
  [<c011dab4>] (__warn) from [<c011db10>] (warn_slowpath_fmt+0x44/0x6c)
  [<c011db10>] (warn_slowpath_fmt) from [<c043898c>] (clk_core_enable+0x2c/0x1b0)
  [<c043898c>] (clk_core_enable) from [<c0439ec8>] (clk_core_enable_lock+0x18/0x2c)
  [<c0439ec8>] (clk_core_enable_lock) from [<c0436698>] (pxa168fb_probe+0x464/0x6ac)
  [<c0436698>] (pxa168fb_probe) from [<c04779a0>] (platform_drv_probe+0x48/0x94)
  [<c04779a0>] (platform_drv_probe) from [<c0475bec>] (driver_probe_device+0x328/0x470)
  [<c0475bec>] (driver_probe_device) from [<c0475de4>] (__driver_attach+0xb0/0x124)
  [<c0475de4>] (__driver_attach) from [<c0473c38>] (bus_for_each_dev+0x64/0xa0)
  [<c0473c38>] (bus_for_each_dev) from [<c0474ee0>] (bus_add_driver+0x1b8/0x230)
  [<c0474ee0>] (bus_add_driver) from [<c0476a20>] (driver_register+0xac/0xf0)
  [<c0476a20>] (driver_register) from [<c0102dd4>] (do_one_initcall+0xb8/0x1f0)
  [<c0102dd4>] (do_one_initcall) from [<c0b010a0>] (kernel_init_freeable+0x294/0x2e0)
  [<c0b010a0>] (kernel_init_freeable) from [<c07e9eb8>] (kernel_init+0x8/0x10c)
  [<c07e9eb8>] (kernel_init) from [<c01010e8>] (ret_from_fork+0x14/0x2c)
  Exception stack(0xd008bfb0 to 0xd008bff8)
  bfa0:                                     00000000 00000000 00000000 00000000
  bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
  bfe0: 00000000 00000000 00000000 00000000 00000013 00000000
  ---[ end trace c0af40f9e2ed7cb4 ]---

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
[b.zolnierkie: enhance patch description a bit]
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-10 07:41:33 -08:00
Matias Karhumaa
b0c52fbff8 Bluetooth: SMP: fix crash in unpairing
[ Upstream commit cb28c306b93b71f2741ce1a5a66289db26715f4d ]

In case unpair_device() was called through mgmt interface at the same time
when pairing was in progress, Bluetooth kernel module crash was seen.

[  600.351225] general protection fault: 0000 [#1] SMP PTI
[  600.351235] CPU: 1 PID: 11096 Comm: btmgmt Tainted: G           OE     4.19.0-rc1+ #1
[  600.351238] Hardware name: Dell Inc. Latitude E5440/08RCYC, BIOS A18 05/14/2017
[  600.351272] RIP: 0010:smp_chan_destroy.isra.10+0xce/0x2c0 [bluetooth]
[  600.351276] Code: c0 0f 84 b4 01 00 00 80 78 28 04 0f 84 53 01 00 00 4d 85 ed 0f 85 ab 00 00 00 48 8b 08 48 8b 50 08 be 10 00 00 00 48 89 51 08 <48> 89 0a 48 b9 00 02 00 00 00 00 ad de 48 89 48 08 48 8b 83 00 01
[  600.351279] RSP: 0018:ffffa9be839b3b50 EFLAGS: 00010246
[  600.351282] RAX: ffff9c999ac565a0 RBX: ffff9c9996e98c00 RCX: ffff9c999aa28b60
[  600.351285] RDX: dead000000000200 RSI: 0000000000000010 RDI: ffff9c999e403500
[  600.351287] RBP: ffffa9be839b3b70 R08: 0000000000000000 R09: ffffffff92a25c00
[  600.351290] R10: ffffa9be839b3ae8 R11: 0000000000000001 R12: ffff9c995375b800
[  600.351292] R13: 0000000000000000 R14: ffff9c99619a5000 R15: ffff9c9962a01c00
[  600.351295] FS:  00007fb2be27c700(0000) GS:ffff9c999e880000(0000) knlGS:0000000000000000
[  600.351298] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  600.351300] CR2: 00007fb2bdadbad0 CR3: 000000041c328001 CR4: 00000000001606e0
[  600.351302] Call Trace:
[  600.351325]  smp_failure+0x4f/0x70 [bluetooth]
[  600.351345]  smp_cancel_pairing+0x74/0x80 [bluetooth]
[  600.351370]  unpair_device+0x1c1/0x330 [bluetooth]
[  600.351399]  hci_sock_sendmsg+0x960/0x9f0 [bluetooth]
[  600.351409]  ? apparmor_socket_sendmsg+0x1e/0x20
[  600.351417]  sock_sendmsg+0x3e/0x50
[  600.351422]  sock_write_iter+0x85/0xf0
[  600.351429]  do_iter_readv_writev+0x12b/0x1b0
[  600.351434]  do_iter_write+0x87/0x1a0
[  600.351439]  vfs_writev+0x98/0x110
[  600.351443]  ? ep_poll+0x16d/0x3d0
[  600.351447]  ? ep_modify+0x73/0x170
[  600.351451]  do_writev+0x61/0xf0
[  600.351455]  ? do_writev+0x61/0xf0
[  600.351460]  __x64_sys_writev+0x1c/0x20
[  600.351465]  do_syscall_64+0x5a/0x110
[  600.351471]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  600.351474] RIP: 0033:0x7fb2bdb62fe0
[  600.351477] Code: 73 01 c3 48 8b 0d b8 6e 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 69 c7 2c 00 00 75 10 b8 14 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 de 80 01 00 48 89 04 24
[  600.351479] RSP: 002b:00007ffe062cb8f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
[  600.351484] RAX: ffffffffffffffda RBX: 000000000255b3d0 RCX: 00007fb2bdb62fe0
[  600.351487] RDX: 0000000000000001 RSI: 00007ffe062cb920 RDI: 0000000000000004
[  600.351490] RBP: 00007ffe062cb920 R08: 000000000255bd80 R09: 0000000000000000
[  600.351494] R10: 0000000000000353 R11: 0000000000000246 R12: 0000000000000001
[  600.351497] R13: 00007ffe062cbbe0 R14: 0000000000000000 R15: 0000000000000000
[  600.351501] Modules linked in: algif_hash algif_skcipher af_alg cmac ipt_MASQUERADE nf_conntrack_netlink nfnetlink xfrm_user xfrm_algo iptable_nat nf_nat_ipv4 xt_addrtype iptable_filter ip_tables xt_conntrack x_tables nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c br_netfilter bridge stp llc overlay arc4 nls_iso8859_1 dm_crypt intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp dell_laptop kvm_intel crct10dif_pclmul dell_smm_hwmon crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd cryptd glue_helper intel_cstate intel_rapl_perf uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev media hid_multitouch input_leds joydev serio_raw dell_wmi snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic dell_smbios dcdbas sparse_keymap
[  600.351569]  snd_hda_intel btusb snd_hda_codec btrtl btbcm btintel snd_hda_core bluetooth(OE) snd_hwdep snd_pcm iwlmvm ecdh_generic wmi_bmof dell_wmi_descriptor snd_seq_midi mac80211 snd_seq_midi_event lpc_ich iwlwifi snd_rawmidi snd_seq snd_seq_device snd_timer cfg80211 snd soundcore mei_me mei dell_rbtn dell_smo8800 mac_hid parport_pc ppdev lp parport autofs4 hid_generic usbhid hid i915 nouveau kvmgt vfio_mdev mdev vfio_iommu_type1 vfio kvm irqbypass i2c_algo_bit ttm drm_kms_helper syscopyarea sysfillrect sysimgblt mxm_wmi psmouse ahci sdhci_pci cqhci libahci fb_sys_fops sdhci drm e1000e video wmi
[  600.351637] ---[ end trace e49e9f1df09c94fb ]---
[  600.351664] RIP: 0010:smp_chan_destroy.isra.10+0xce/0x2c0 [bluetooth]
[  600.351666] Code: c0 0f 84 b4 01 00 00 80 78 28 04 0f 84 53 01 00 00 4d 85 ed 0f 85 ab 00 00 00 48 8b 08 48 8b 50 08 be 10 00 00 00 48 89 51 08 <48> 89 0a 48 b9 00 02 00 00 00 00 ad de 48 89 48 08 48 8b 83 00 01
[  600.351669] RSP: 0018:ffffa9be839b3b50 EFLAGS: 00010246
[  600.351672] RAX: ffff9c999ac565a0 RBX: ffff9c9996e98c00 RCX: ffff9c999aa28b60
[  600.351674] RDX: dead000000000200 RSI: 0000000000000010 RDI: ffff9c999e403500
[  600.351676] RBP: ffffa9be839b3b70 R08: 0000000000000000 R09: ffffffff92a25c00
[  600.351679] R10: ffffa9be839b3ae8 R11: 0000000000000001 R12: ffff9c995375b800
[  600.351681] R13: 0000000000000000 R14: ffff9c99619a5000 R15: ffff9c9962a01c00
[  600.351684] FS:  00007fb2be27c700(0000) GS:ffff9c999e880000(0000) knlGS:0000000000000000
[  600.351686] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  600.351689] CR2: 00007fb2bdadbad0 CR3: 000000041c328001 CR4: 00000000001606e0

Crash happened because list_del_rcu() was called twice for smp->ltk. This
was possible if unpair_device was called right after ltk was generated
but before keys were distributed.

In this commit smp_cancel_pairing was refactored to cancel pairing if it
is in progress and otherwise just removes keys. Once keys are removed from
rcu list, pointers to smp context's keys are set to NULL to make sure
removed list items are not accessed later.

This commit also adjusts the functionality of mgmt unpair_device() little
bit. Previously pairing was canceled only if pairing was in state that
keys were already generated. With this commit unpair_device() cancels
pairing already in earlier states.

Bug was found by fuzzing kernel SMP implementation using Synopsys
Defensics.

Reported-by: Pekka Oikarainen <pekka.oikarainen@synopsys.com>
Signed-off-by: Matias Karhumaa <matias.karhumaa@gmail.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-10 07:41:33 -08:00
Martin Willi
6879c047ae mac80211_hwsim: do not omit multicast announce of first added radio
[ Upstream commit 28ef8b49a338dc1844e86b7954cfffc7dfa2660a ]

The allocation of hwsim radio identifiers uses a post-increment from 0,
so the first radio has idx 0. This idx is explicitly excluded from
multicast announcements ever since, but it is unclear why.

Drop that idx check and announce the first radio as well. This makes
userspace happy if it relies on these events.

Signed-off-by: Martin Willi <martin@strongswan.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-10 07:41:33 -08:00
Sean Tranchetti
5217bec5a6 xfrm: validate template mode
[ Upstream commit 32bf94fb5c2ec4ec842152d0e5937cd4bb6738fa ]

XFRM mode parameters passed as part of the user templates
in the IP_XFRM_POLICY are never properly validated. Passing
values other than valid XFRM modes can cause stack-out-of-bounds
reads to occur later in the XFRM processing:

[  140.535608] ================================================================
[  140.543058] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x17e4/0x1cc4
[  140.550306] Read of size 4 at addr ffffffc0238a7a58 by task repro/5148
[  140.557369]
[  140.558927] Call trace:
[  140.558936] dump_backtrace+0x0/0x388
[  140.558940] show_stack+0x24/0x30
[  140.558946] __dump_stack+0x24/0x2c
[  140.558949] dump_stack+0x8c/0xd0
[  140.558956] print_address_description+0x74/0x234
[  140.558960] kasan_report+0x240/0x264
[  140.558963] __asan_report_load4_noabort+0x2c/0x38
[  140.558967] xfrm_state_find+0x17e4/0x1cc4
[  140.558971] xfrm_resolve_and_create_bundle+0x40c/0x1fb8
[  140.558975] xfrm_lookup+0x238/0x1444
[  140.558977] xfrm_lookup_route+0x48/0x11c
[  140.558984] ip_route_output_flow+0x88/0xc4
[  140.558991] raw_sendmsg+0xa74/0x266c
[  140.558996] inet_sendmsg+0x258/0x3b0
[  140.559002] sock_sendmsg+0xbc/0xec
[  140.559005] SyS_sendto+0x3a8/0x5a8
[  140.559008] el0_svc_naked+0x34/0x38
[  140.559009]
[  140.592245] page dumped because: kasan: bad access detected
[  140.597981] page_owner info is not active (free page?)
[  140.603267]
[  140.653503] ================================================================

Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-10 07:41:33 -08:00
Thomas Petazzoni
f4c24fd3b6 ARM: 8799/1: mm: fix pci_ioremap_io() offset check
[ Upstream commit 3a58ac65e2d7969bcdf1b6acb70fa4d12a88e53e ]

IO_SPACE_LIMIT is the ending address of the PCI IO space, i.e
something like 0xfffff (and not 0x100000).

Therefore, when offset = 0xf0000 is passed as argument, this function
fails even though the offset + SZ_64K fits below the
IO_SPACE_LIMIT. This makes the last chunk of 64 KB of the I/O space
not usable as it cannot be mapped.

This patch fixes that by substracing 1 to offset + SZ_64K, so that we
compare the addrss of the last byte of the I/O space against
IO_SPACE_LIMIT instead of the address of the first byte of what is
after the I/O space.

Fixes: c279443709 ("ARM: Add fixed PCI i/o mapping")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Acked-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-10 07:41:33 -08:00
Andrei Otcheretianski
db420bc4b7 cfg80211: reg: Init wiphy_idx in regulatory_hint_core()
[ Upstream commit 24f33e64fcd0d50a4b1a8e5b41bd0257aa66b0e8 ]

Core regulatory hints didn't set wiphy_idx to WIPHY_IDX_INVALID. Since
the regulatory request is zeroed, wiphy_idx was always implicitly set to
0. This resulted in updating only phy #0.
Fix that.

Fixes: 806a9e3967 ("cfg80211: make regulatory_request use wiphy_idx instead of wiphy")
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
[add fixes tag]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-10 07:41:33 -08:00
Andrei Otcheretianski
7402bc9ca9 mac80211: Always report TX status
[ Upstream commit 8682250b3c1b75a45feb7452bc413d004cfe3778 ]

If a frame is dropped for any reason, mac80211 wouldn't report the TX
status back to user space.

As the user space may rely on the TX_STATUS to kick its state
machines, resends etc, it's better to just report this frame as not
acked instead.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-10 07:41:33 -08:00
Thadeu Lima de Souza Cascardo
4e16c61e87 xfrm6: call kfree_skb when skb is toobig
[ Upstream commit 215ab0f021c9fea3c18b75e7d522400ee6a49990 ]

After commit d6990976af7c5d8f55903bfb4289b6fb030bf754 ("vti6: fix PMTU caching
and reporting on xmit"), some too big skbs might be potentially passed down to
__xfrm6_output, causing it to fail to transmit but not free the skb, causing a
leak of skb, and consequentially a leak of dst references.

After running pmtu.sh, that shows as failure to unregister devices in a namespace:

[  311.397671] unregister_netdevice: waiting for veth_b to become free. Usage count = 1

The fix is to call kfree_skb in case of transmit failures.

Fixes: dd767856a3 ("xfrm6: Don't call icmpv6_send on local error")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-10 07:41:32 -08:00
Steffen Klassert
5ce93bd4cc xfrm: Validate address prefix lengths in the xfrm selector.
[ Upstream commit 07bf7908950a8b14e81aa1807e3c667eab39287a ]

We don't validate the address prefix lengths in the xfrm
selector we got from userspace. This can lead to undefined
behaviour in the address matching functions if the prefix
is too big for the given address family. Fix this by checking
the prefixes and refuse SA/policy insertation when a prefix
is invalid.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Air Icy <icytxw@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-10 07:41:32 -08:00
Linux Build Service Account
f1587d8660 Merge "dwc3: gadget: Remove soft reset as part of gadget run_stop" 2018-11-09 16:15:27 -08:00
Sean Tranchetti
c4c5a31862 af_key: unconditionally clone on broadcast
Attempting to avoid cloning the skb when broadcasting by inflating
the refcount with sock_hold/sock_put while under RCU lock is dangerous
and violates RCU principles. It leads to subtle race conditions when
attempting to free the SKB, as we may reference sockets that have
already been freed by the stack.

Unable to handle kernel paging request at virtual address 6b6b6b6b6b6c4b
[006b6b6b6b6b6c4b] address between user and kernel address ranges
Internal error: Oops: 96000004 [#1] PREEMPT SMP
task: fffffff78f65b380 task.stack: ffffff8049a88000
pc : sock_rfree+0x38/0x6c
lr : skb_release_head_state+0x6c/0xcc
Process repro (pid: 7117, stack limit = 0xffffff8049a88000)
Call trace:
	sock_rfree+0x38/0x6c
	skb_release_head_state+0x6c/0xcc
	skb_release_all+0x1c/0x38
	__kfree_skb+0x1c/0x30
	kfree_skb+0xd0/0xf4
	pfkey_broadcast+0x14c/0x18c
	pfkey_sendmsg+0x1d8/0x408
	sock_sendmsg+0x44/0x60
	___sys_sendmsg+0x1d0/0x2a8
	__sys_sendmsg+0x64/0xb4
	SyS_sendmsg+0x34/0x4c
	el0_svc_naked+0x34/0x38
Kernel panic - not syncing: Fatal exception

CRs-Fixed: 2251019
Change-Id: Ib3b01f941a34a7df61fe9445f746b7df33f4656a
Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>
2018-11-09 12:01:45 -08:00
Linux Build Service Account
ac7b931cf8 Merge "msm: kgsl: Correct the state transitions in suspend function" 2018-11-09 06:19:12 -08:00
Linux Build Service Account
06ff6ccf78 Merge "msm: kgsl: Don't halt dispatcher if device is not in SUSPEND state" 2018-11-09 06:19:10 -08:00
Sriharsha Allenki
8aa1802d6a dwc3: gadget: Remove soft reset as part of gadget run_stop
Soft reset of the core before setting the run stop
bit of the core is not suggested.
So, remove the soft reset of the core as part of
the run_stop operation.

Change-Id: Ib87176d8036a27cc7e0a5790b293ee79811e4734
Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
2018-11-09 02:17:13 -08:00
Manu Gautam
de2b9b1330 usb: gadget: Don't override config->MaxPower if specified
For various reasons, user may want to specify lower bMaxPower
using following sysfs attribute for a configuration:
"configs/c.1/MaxPower"

Driver currently ignores that and selects 500mA or 900mA based
on the connection speed. Fix this by no overriding bMaxPower
if config->MaxPower is non-zero.

Change-Id: I10b499b327d5c4e332df2ce435211144637c48d0
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
2018-11-09 15:02:43 +05:30
Linux Build Service Account
91c4a617f5 Merge "ARM: dts: msm: Enabled dt entry for bmi160 and iam20680" 2018-11-08 20:29:06 -08:00
Linux Build Service Account
70be7025dc Merge "timekeeping: Cap adjustments so they don't exceed the maxadj value" 2018-11-08 20:29:04 -08:00
Linux Build Service Account
b49958c0c6 Merge "defconfig: msm: Enable MSM_TIMER_LEAP for msm8996-auto" 2018-11-08 20:29:04 -08:00
Linux Build Service Account
a7ad7d6251 Merge "soc: qcom: hab: benchmark cross VM schdule latency" 2018-11-08 20:29:02 -08:00
puneet
a2ac9c46d5 ARM: dts: msm: Enabled dt entry for bmi160 and iam20680
GPS QDR feature has dependency on BMI160 and IAM20680
sensor driver which is enabled through GPIO 10 and 11 pins.

Change-Id: Ib9c257fc385233c733c24fa0f7175f739ce75a19
Signed-off-by: puneet <puneet@codeaurora.org>
2018-11-07 22:05:16 -08:00
Rajesh Kemisetti
de5400e150 msm: kgsl: Log context type in case of GPU faults
Log context type in case of GPU page faults or GPU faults.
Also add Vulkan context type to distinguish it from GL.

Change-Id: I7b93bf645b80abe82f2d6aa379296b2fffceb684
Signed-off-by: Rajesh Kemisetti <rajeshk@codeaurora.org>
2018-11-07 13:10:47 +05:30
John Stultz
1b6457b89d timekeeping: Cap adjustments so they don't exceed the maxadj value
Thus its been occasionally noted that users have seen
confusing warnings like:

    Adjusting tsc more than 11% (5941981 vs 7759439)

We try to limit the maximum total adjustment to 11% (10% tick
adjustment + 0.5% frequency adjustment). But this is done by
bounding the requested adjustment values, and the internal
steering that is done by tracking the error from what was
requested and what was applied, does not have any such limits.

This is usually not problematic, but in some cases has a risk
that an adjustment could cause the clocksource mult value to
overflow, so its an indication things are outside of what is
expected.

It ends up most of the reports of this 11% warning are on systems
using chrony, which utilizes the adjtimex() ADJ_TICK interface
(which allows a +-10% adjustment). The original rational for
ADJ_TICK unclear to me but my assumption it was originally added
to allow broken systems to get a big constant correction at boot
(see adjtimex userspace package for an example) which would allow
the system to work w/ ntpd's 0.5% adjustment limit.

Chrony uses ADJ_TICK to make very aggressive short term corrections
(usually right at startup). Which push us close enough to the max
bound that a few late ticks can cause the internal steering to push
past the max adjust value (tripping the warning).

Thus this patch adds some extra logic to enforce the max adjustment
cap in the internal steering.

Note: This has the potential to slow corrections when the ADJ_TICK
value is furthest away from the default value. So it would be good to
get some testing from folks using chrony, to make sure we don't
cause any troubles there.

Change-Id: I31f2966d5134af18e3902cb0f1d9805f204a3e14
Cc: Miroslav Lichvar <mlichvar@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>
Tested-by: Miroslav Lichvar <mlichvar@redhat.com>
Reported-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Git-commit: ec02b076ceab63f99e5b3d80fd223d777266c236
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
Signed-off-by: Gustavo Solaira <gustavos@codeaurora.org>
2018-11-06 22:39:34 -08:00
Linux Build Service Account
e2a4721cfa Merge "ARM: dts: msm: Add pcie-ep device for msm8996" 2018-11-06 22:09:07 -08:00
Linux Build Service Account
cbb5bff2a0 Merge "cnss2: call remove driver_ops in cnss_wlan_unregister" 2018-11-06 22:09:05 -08:00
Benedict Wong
64102d341c BACKPORT: xfrm: Allow Output Mark to be Updated Using UPDSA
Allow UPDSA to change "output mark" to permit
policy separation of packet routing decisions from
SA keying in systems that use mark-based routing.

The set mark, used as a routing and firewall mark
for outbound packets, is made update-able which
allows routing decisions to be handled independently
of keying/SA creation. To maintain consistency with
other optional attributes, the output mark is only
updated if sent with a non-zero value.

The per-SA lock and the xfrm_state_lock are taken in
that order to avoid a deadlock with
xfrm_timer_handler(), which also takes the locks in
that order.

Signed-off-by: Nathan Harold <nharold@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

(cherry picked from commit 6d8e85ffe17895d7bc632dfbaa9e2e33b22fe873)
Backport resolution required using props.output_mark instead of
props.smark

Change-Id: I08c7bfc114ac9826a8a18f5ac1c3ff17a4e0940b
Signed-off-by: Benedict Wong <benedictwong@google.com>
Bug: 114060045
2018-11-06 18:20:01 +00:00
Linux Build Service Account
3e15f887cf Merge "ARM: dts: msm: Add support for APQ8096A" 2018-11-06 09:07:19 -08:00
Linux Build Service Account
38b693f401 Merge "soc: qcom: glink_smem_native_xprt: init in_ssr before IRQ eanbled." 2018-11-06 02:05:32 -08:00
Linux Build Service Account
8952000791 Merge "soc: qcom: hab: refine hab virtual channel's resource free" 2018-11-06 02:05:30 -08:00
Linux Build Service Account
e8e7047a8a Merge "soc: qcom: socinfo: Add support for APQ8096A" 2018-11-06 02:05:29 -08:00
Linux Build Service Account
0ac5501f23 Merge "ASoC: change mask in snd_soc_get/put_volsw_sx to unsigned int" 2018-11-06 02:05:28 -08:00
Linux Build Service Account
462513774f Merge "pps: DR_SYNC pulse needs to be connected to Linux PPS driver" 2018-11-06 02:05:21 -08:00
Linux Build Service Account
cbdfa9f566 Merge "ARCH: arm: defconfig: BMI160 and IAM20680 sensor enablement" 2018-11-06 02:05:19 -08:00
Arun KS
d26af6deeb ARM: dts: msm: Add support for APQ8096A
Add msm-id to support APQ8096A

Change-Id: I3b71d5cca6f4d1447b150dbe783073862755f80a
Signed-off-by: Arun KS <arunks@codeaurora.org>
2018-11-06 11:41:54 +05:30
Linux Build Service Account
300a22811b Merge "msm: ais: Fix arbitrary kernel write" 2018-11-05 19:37:45 -08:00
Daniel Rosenberg
1bdb20fcd4 ANDROID: sdcardfs: Add option to drop unused dentries
This adds the nocache mount option, which will cause sdcardfs to always
drop dentries that are not in use, preventing cached entries from
holding on to lower dentries, which could  cause strange behavior when
bypassing the sdcardfs layer and directly changing the lower fs.

Change-Id: I70268584a20b989ae8cfdd278a2e4fa1605217fb
Signed-off-by: Daniel Rosenberg <drosen@google.com>
2018-11-06 03:22:22 +00:00
Gustavo Solaira
e4dea7a029 defconfig: msm: Enable MSM_TIMER_LEAP for msm8996-auto
Enable MSM_TIMER_LEAP config flag in both msm-auto_defconfig
and msm-auto-perf_defconfig files. This option enables check
for architecture timer leaps, when all least significant 32bits
of CNTVCT or CNTPCT counter is set and rereads counters.

Change-Id: I1b37f9931793e21f5144e0afb9c689a228c03493
Signed-off-by: Gustavo Solaira <gustavos@codeaurora.org>
2018-11-05 16:20:32 -08:00
Linux Build Service Account
071995902d Merge "soc: hab: fix uninitialized variable and relocate vchan refcnt" 2018-11-04 18:35:39 -08:00
Jaegeuk Kim
3411c22ecc Merge 4.20-rc1-4.4 into android-4.4
* origin/upstream-f2fs-stable-linux-4.4.y:
  f2fs: guarantee journalled quota data by checkpoint
  f2fs: cleanup dirty pages if recover failed
  f2fs: fix data corruption issue with hardware encryption
  f2fs: fix to recover inode->i_flags of inode block during POR
  f2fs: spread f2fs_set_inode_flags()
  f2fs: fix to spread clear_cold_data()
  Revert "f2fs: fix to clear PG_checked flag in set_page_dirty()"
  f2fs: account read IOs and use IO counts for is_idle
  f2fs: fix to account IO correctly for cgroup writeback
  f2fs: fix to account IO correctly
  f2fs: remove request_list check in is_idle()
  f2fs: allow to mount, if quota is failed
  f2fs: update REQ_TIME in f2fs_cross_rename()
  f2fs: do not update REQ_TIME in case of error conditions
  f2fs: remove unneeded disable_nat_bits()
  f2fs: remove unused sbi->trigger_ssr_threshold
  f2fs: shrink sbi->sb_lock coverage in set_file_temperature()
  f2fs: fix to recover cold bit of inode block during POR
  f2fs: submit cached bio to avoid endless PageWriteback
  f2fs: checkpoint disabling
  f2fs: clear PageError on the read path
  f2fs: allow out-place-update for direct IO in LFS mode
  f2fs: refactor ->page_mkwrite() flow
  Revert: "f2fs: check last page index in cached bio to decide submission"
  f2fs: support superblock checksum
  f2fs: add to account skip count of background GC
  f2fs: add to account meta IO
  f2fs: keep lazytime on remount
  f2fs: fix missing up_read
  f2fs: return correct errno in f2fs_gc
  f2fs: avoid f2fs_bug_on if f2fs_get_meta_page_nofail got EIO
  f2fs: mark inode dirty explicitly in recover_inode()
  f2fs: fix to recover inode's crtime during POR
  f2fs: fix to recover inode's i_gc_failures during POR
  f2fs: fix to recover inode's i_flags during POR
  f2fs: fix to recover inode's project id during POR
  f2fs: update i_size after DIO completion
  f2fs: report ENOENT correctly in f2fs_rename
  f2fs: fix remount problem of option io_bits
  f2fs: fix to recover inode's uid/gid during POR
  f2fs: avoid infinite loop in f2fs_alloc_nid
  f2fs: add new idle interval timing for discard and gc paths
  f2fs: split IO error injection according to RW
  f2fs: add SPDX license identifiers
  f2fs: surround fault_injection related option parsing using CONFIG_F2FS_FAULT_INJECTION
  f2fs: avoid sleeping under spin_lock
  f2fs: plug readahead IO in readdir()
  f2fs: fix to do sanity check with current segment number
  f2fs: fix memory leak of percpu counter in fill_super()
  f2fs: fix memory leak of write_io in fill_super()
  f2fs: cache NULL when both default_acl and acl are NULL
  f2fs: fix to flush all dirty inodes recovered in readonly fs
  f2fs: report error if quota off error during umount
  f2fs: submit bio after shutdown
  f2fs: avoid wrong decrypted data from disk
  Revert "f2fs: use printk_ratelimited for f2fs_msg"
  f2fs: fix unnecessary periodic wakeup of discard thread when dev is busy
  f2fs: fix to avoid NULL pointer dereference on se->discard_map
  f2fs: add additional sanity check in f2fs_acl_from_disk()

 Conflicts:
	fs/f2fs/data.c

Change-Id: I95097a969bbd23c2009106b07be8a1eeec675b1c
Signed-off-by: Jaegeuk Kim <jaegeuk@google.com>
2018-11-03 15:06:22 -07:00
Archana Sriram
3e3bb6e7bb msm: kgsl: Correct the state transitions in suspend function
GPU should not be forced to SUSPEND state when it is in INIT
or NONE state as this transition is invalid.

Change-Id: Ia3d0fd131348508fe34c57f271c1f991a98afa19
Signed-off-by: Archana Sriram <apsrir@codeaurora.org>
2018-11-01 23:49:07 -07:00
Yong Ding
cf41f3e0d3 soc: qcom: hab: refine hab virtual channel's resource free
Whenever a vchan is locally closed in hab_vchan_close or hab_free,
4 actions should be taken immediately, including,
 - remove it from the local hab context
 - mark its local closed flag
 - notify remote side and unblock local blocking calls over it
 - decrease the refcnt on the vchan

Change-Id: I3fbde9464f6405b6dadac248768a5fd857a29128
Signed-off-by: Yong Ding <yongding@codeaurora.org>
2018-11-01 17:37:29 +08:00
Banajit Goswami
7a4ab19b31 ASoC: change mask in snd_soc_get/put_volsw_sx to unsigned int
If the result of (min + max) is negative in functions
snd_soc_get_volsw_sx() or snd_soc_put_volsw_sx(), there
will be an overflow for the variable 'mask'.
   UBSAN: Undefined behaviour in sound/soc/soc-ops.c:382:6
   signed integer overflow:
   -2147483648 - 1 cannot be represented in type 'int'

Fix this by updating the variable type of 'mask' to unsigned int.

Change-Id: Ia34f397fad5b93c0e2ffacae60e051ad20c20bdf
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
2018-10-30 22:04:08 -07:00
Arun KS
d2be5dd424 soc: qcom: socinfo: Add support for APQ8096A
Add CPU ID to the socinfo table needed to support
APQ8096A Automotive SoC.

Change-Id: I621faa171c867b36fa541961772a841333917861
Signed-off-by: Arun KS <arunks@codeaurora.org>
2018-10-31 09:57:48 +05:30
Rajasekaran Kalidoss
7a18627fbf cnss2: call remove driver_ops in cnss_wlan_unregister
rmmod of wlan triggers cnss_wlan_unregister. wlan driver_ops
remove should be called for QCN7605 standalone and
composite devices to finish the rmmod path.

Change-Id: I0047eb65b68b7e81b9b9c9fd79825a0d3f27c640
Signed-off-by: Rajasekaran Kalidoss <rkalidos@codeaurora.org>
2018-10-30 01:46:39 -07:00
Yajun Li
67b38b0496 soc: hab: Fix a memory leakage when unexport
When the remote vchan is closed and unexport happens
in local at the same time, function hab_get_vchan_fromvcid
will return null in hab unexport, which will cause memory leak.

Change-Id: I8dac4f4154f24734dc2a11aa73f726cd705cc291
Signed-off-by: Yajun Li <yajunl@codeaurora.org>
2018-10-30 16:27:47 +08:00