summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-11-15Merge branch 'for-linus' of ↵Linus Torvalds
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID updates from Jiri Kosina: - high resolution mode for Dell canvas support, from Benjamin Tissoires - pen handling fixes for the Wacom driver, from Jason Gerecke - i2c-hid: Apollo-Lake based laptops improvements, from Hans de Goede - Input/Core: eraser tool support, from Ping Cheng - new ALPS touchpad (T4, found currently on HP EliteBook 1000, Zbook Stduio and HP Elite book x360) supportm from Masaki Ota - other smaller assorted fixes * 'for-linus' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (33 commits) HID: cp2112: fix broken gpio_direction_input callback HID: cp2112: fix interface specification URL HID: Wacom: switch Dell canvas into highres mode HID: wacom: generic: Send BTN_STYLUS3 when both barrel switches are set HID: sony: Fix SHANWAN pad rumbling on USB HID: i2c-hid: Add no-irq-after-reset quirk for 0911:5288 device HID: add backlight level quirk for Asus ROG laptops HID: cp2112: add HIDRAW dependency HID: Add ID 044f:b605 ThrustMaster, Inc. force feedback Racing Wheel HID: hid-logitech: remove redundant assignment to pointer value HID: wacom: generic: Recognize WACOM_HID_WD_PEN as a type of pen collection HID: rmi: Check that a device is a RMI device before calling RMI functions HID: add multi-input quirk for GamepadBlock HID: alps: add new U1 device ID HID: alps: add support for Alps T4 Touchpad device HID: alps: remove variables local to u1_init() from the device struct HID: alps: properly handle max_fingers and minimum on X and Y axis HID: alps: Separate U1 device code HID: alps: delete unnecessary struct u1_dev devInfo HID: usbhid: Convert timers to use timer_setup() ...
2017-11-15ARC: [plat-axs10x] DTS: Add reset controller node to manage ethernet resetEugeniy Paltsev
DW ethernet controller on axs10x hangs sometimes after SW reset. Invoke the newly aded driver (reset-axs10x.c) by adding the DT bits. With this in place, we don't need the open-coded quirk in platform code, so get rid of it as well ! Signed-off-by: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com> Signed-off-by: Vineet Gupta <vgupta@synopsys.com> Signed-off-by: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com> Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
2017-11-15ALSA: hda/realtek - Fix ALC275 no sound issueKailang Yang
Sound works after a cold boot but not after a reboot from windows. This patch will solve this issue. This is relation with Class-D power control. [ The bug was reported in Bugzilla below for Sony VAIO SVS13A1C5E -- tiwai] Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=197737 Cc: <stable@vger.kernel.org> Signed-off-by: Kailang Yang <kailang@realtek.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-11-15pkcs7: Set the module licence to prevent taintingDavid Howells
Set the module licence to prevent the kernel from being tainted if loaded as a module. Reported-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: David Howells <dhowells@redhat.com>
2017-11-15security: keys: Replace time_t with time64_t for struct key_preparsed_payloadBaolin Wang
The 'struct key_preparsed_payload' will use 'time_t' which we will try to remove in the kernel, since 'time_t' is not year 2038 safe on 32bits systems. Thus this patch replaces 'time_t' with 'time64_t' which is year 2038 safe on 32 bits system for 'struct key_preparsed_payload', moreover we should use the 'TIME64_MAX' macro to initialize the 'time64_t' type variable. Signed-off-by: Baolin Wang <baolin.wang@linaro.org> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: James Morris <james.l.morris@oracle.com>
2017-11-15security: keys: Replace time_t/timespec with time64_tBaolin Wang
The 'struct key' will use 'time_t' which we try to remove in the kernel, since 'time_t' is not year 2038 safe on 32bit systems. Also the 'struct keyring_search_context' will use 'timespec' type to record current time, which is also not year 2038 safe on 32bit systems. Thus this patch replaces 'time_t' with 'time64_t' which is year 2038 safe for 'struct key', and replace 'timespec' with 'time64_t' for the 'struct keyring_search_context', since we only look at the the seconds part of 'timespec' variable. Moreover we also change the codes where using the 'time_t' and 'timespec', and we can get current time by ktime_get_real_seconds() instead of current_kernel_time(), and use 'TIME64_MAX' macro to initialize the 'time64_t' type variable. Especially in proc.c file, we have replaced 'unsigned long' and 'timespec' type with 'u64' and 'time64_t' type to save the timeout value, which means user will get one 'u64' type timeout value by issuing proc_keys_show() function. Signed-off-by: Baolin Wang <baolin.wang@linaro.org> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: James Morris <james.l.morris@oracle.com>
2017-11-15KEYS: fix in-kernel documentation for keyctl_read()Eric Biggers
When keyctl_read() is passed a buffer that is too small, the behavior is inconsistent. Some key types will fill as much of the buffer as possible, while others won't copy anything. Moreover, the in-kernel documentation contradicted the man page on this point. Update the in-kernel documentation to say that this point is unspecified. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com>
2017-11-15iwlwifi: mvm: support version 7 of the SCAN_REQ_UMAC FW commandLuca Coelho
Newer firmware versions (such as iwlwifi-8000C-34.ucode) have introduced an API change in the SCAN_REQ_UMAC command that is not backwards compatible. The driver needs to detect and use the new API format when the firmware reports it, otherwise the scan command will not work properly, causing a command timeout. Fix this by adding a TLV that tells the driver that the new API is in use and use the correct structures for it. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=197591 Fixes: d7a5b3e9e42e ("iwlwifi: mvm: bump API to 34 for 8000 and up") Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-11-15f2fs: deny accessing encryption policy if encryption is offChao Yu
This patch adds missing feature check in encryption ioctl interface. Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2017-11-15Merge branch 'clk-cleanup' into clk-nextStephen Boyd
* clk-cleanup: clk: kona-setup: Delete error messages for failed memory allocations ARC: clk: fix spelling mistake: "configurarion" -> "configuration" clk: cdce925: remove redundant check for non-null parent_name clk: versatile: Improve sizeof() usage clk: versatile: Delete error messages for failed memory allocations clk: ux500: Improve sizeof() usage clk: ux500: Delete error messages for failed memory allocations clk: spear: Delete error messages for failed memory allocations clk: ti: Delete error messages for failed memory allocations clk: mmp: Adjust checks for NULL pointers clk: mmp: Use common error handling code in mmp_clk_register_mix() clk: mmp: Delete error messages for failed memory allocations clk: clk-xgene: Adjust six checks for null pointers clk: clk-xgene: Delete error messages for failed memory allocations clk: clk-u300: Fix a typo in two comment lines clk: clk-u300: Add some spaces for better code readability clk: clk-u300: Improve sizeof() usage clk: clk-u300: Delete error messages for failed memory allocations clk: clk-mux: Improve a size determination in clk_hw_register_mux_table() clk: clk-mux: Delete an error message for a failed memory allocation
2017-11-15Merge tag 'asoc-fix-v4.14-intel-kconfig' of ↵Takashi Iwai
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fix for Intel Kconfig Fix the Intel Kconfig issue reported by Linus.
2017-11-15dt-bindings: rtc: Add Spreadtrum SC27xx RTC documentationBaolin Wang
This patch adds the binding documentation for Spreadtrum SC27xx series RTC device. Signed-off-by: Baolin Wang <baolin.wang@spreadtrum.com> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
2017-11-15selftests: firmware: skip unsupported custom firmware fallback testsAmit Pundir
Ignore custom firmware loading and cancellation tests on older kernel releases, which do not support this feature. Fixes: 061132d2b9c9 ("test_firmware: add test custom fallback trigger") Reviewed-by: Sumit Semwal <sumit.semwal@linaro.org> Acked-by: Luis R. Rodriguez <mcgrof@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Amit Pundir <amit.pundir@linaro.org> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-11-15selftests: firmware: skip unsupported async loading testsAmit Pundir
Ignore async firmware loading tests on older kernel releases, which do not support this feature. Fixes: 1b1fe542b6f0: ("selftests: firmware: add empty string and async tests") Reviewed-by: Sumit Semwal <sumit.semwal@linaro.org> Acked-by: Luis R. Rodriguez <mcgrof@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Amit Pundir <amit.pundir@linaro.org> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-11-15Merge branch 'for-4.15/timer' into for-linusJens Axboe
Post initial pull timer related changes for block drivers. Not merged with the first pull, since they were dependent on this commit in mainline: commit 686fef928bba6be13cabe639f154af7d72b63120 Author: Kees Cook <keescook@chromium.org> Date: Thu Sep 28 06:38:17 2017 -0700 timer: Prepare to change timer callback argument type
2017-11-15selftests: memfd_test.c: fix compilation warning.Lei Yang
Replace '%d' by '%zu' to fix the following compilation warning. memfd_test.c:517:3: warning: format ‘%d’ expects argument of type ‘int’,but argument 2 has type ‘size_t’ [-Wformat=] printf("malloc(%d) failed: %m\n", mfd_def_size * 8); ^ memfd_test.c: In function ‘mfd_fail_grow_write’: memfd_test.c:537:3: warning: format ‘%d’ expects argument of type ‘int’,but argument 2 has type ‘size_t’ [-Wformat=] printf("malloc(%d) failed: %m\n", mfd_def_size * 8); Signed-off-by: Lei Yang <Lei.Yang@windriver.com> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-11-15selftests/ftrace: Introduce exit_pass and exit_failMasami Hiramatsu
As same as other results, introduce exit_pass and exit_fail functions so that we can easily understand what will happen. Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-11-15selftests: ftrace: add more config fragmentsLei Yang
We need to enable more configs to make test more without this patch,we got lots of "UNSUPPORTED" before the patch: http://pastebin.ubuntu.com/25784377/ after the patch: http://pastebin.ubuntu.com/25784387/ Signed-off-by: Lei Yang <Lei.Yang@windriver.com> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-11-15android/ion: userspace test utility for ion buffer sharingPintu Agarwal
This is a test utility to verify ION buffer sharing in user space between 2 independent processes. It uses unix domain socket (with SCM_RIGHTS) as IPC to transfer an FD to another process to share the same buffer. This utility demonstrates how ION buffer sharing can be implemented between two user space processes, using various heap types. This utility is made to be run as part of kselftest framework in kernel. The utility is verified on Ubuntu-32 bit system with Linux Kernel 4.14, using ION system heap. For more information about the utility please check the README file. Signed-off-by: Pintu Agarwal <pintu.ping@gmail.com> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-11-15selftests: remove obsolete kconfig fragment for cpu-hotpluglei.yang@windriver.com
Kconfig CONFIG_CPU_NOTIFIER_ERROR_INJECT has been removed since kernel 4.10 check commit: commit 530e9b76ae8f863dfdef4a6ad0b38613d32e8c3f Author: Thomas Gleixner <tglx@linutronix.de> Date: Wed Dec 21 20:19:53 2016 +0100 cpu/hotplug: Remove obsolete cpu hotplug register/unregister functions hotcpu_notifier(), cpu_notifier(), __hotcpu_notifier(), __cpu_notifier(), register_hotcpu_notifier(), register_cpu_notifier(), __register_hotcpu_notifier(), __register_cpu_notifier(), unregister_hotcpu_notifier(), unregister_cpu_notifier(), __unregister_hotcpu_notifier(), __unregister_cpu_notifier() <snip> Signed-off-by: Lei Yang <Lei.Yang@windriver.com> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-11-15selftests: vdso_test: support ARM64 targetsGreg Hackmann
ARM64's vDSO exports its gettimeofday() implementation with a different name (__kernel_gettimeofday) and version (LINUX_2.6.39) from other architectures. Add a corresponding special-case to vdso_test. Signed-off-by: Greg Hackmann <ghackmann@google.com> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-11-15selftests/ftrace: Do not use arch dependent do_IRQ as a target functionMasami Hiramatsu
Instead using arch-dependent do_IRQ, use do_softirq as a target function. Applying do_IRQ to set_ftrace_filter always fail on arm/arm64 and any other architectures which don't define do_IRQ. So, instead of using that, use do_softirq which is defined in kernel/softirq.c. Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-11-15selftests: breakpoints: fix compile error on breakpoint_test_arm64Sumit Semwal
The current mainline breakpoints test for arm64 fails to compile with breakpoint_test_arm64.c: In function ‘set_watchpoint’: breakpoint_test_arm64.c:97:28: error: storage size of ‘dreg_state’ isn’t known struct user_hwdebug_state dreg_state; Adding a direct include for asm/ptrace.h helps it to build, and passes the test on mainline on hikey. Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-11-15selftests: add missing test result status in memory-hotplug testlei.yang@windriver.com
it only prints FAIL status when test fails, but doesn't print PASS status when test pass,this patch is to add PASS status in the test log. Signed-off-by: Lei Yang <Lei.Yang@windriver.com> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-11-15selftests/exec: include cwd in long path calculationSteve Muckle
When creating a pathname close to PATH_MAX to test execveat, factor in the current working directory path otherwise we end up with an absolute path that is longer than PATH_MAX. While execveat() may succeed, subsequent calls to the kernel from the runtime environment which are required to successfully execute the test binary/script may fail because of this. To keep the semantics of the test the same, rework the relative pathname part of the test to be relative to the root directory so it isn't decreased by the length of the current working directory path. Signed-off-by: Steve Muckle <smuckle.linux@gmail.com> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-11-15selftests: seccomp: update .gitignore with newly added testsShuah Khan
Update .gitignore with newly added tests. Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com> Acked-by: Kees Cook <keescook@chromium.org> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-11-15selftests: vm: Update .gitignore with newly added testsShuah Khan
Update .gitignore with newly added tests. Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-11-15selftests: timers: Update .gitignore with newly added testsShuah Khan
Update .gitignore with newly added tests. Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-11-15fcntl: don't cap l_start and l_end values for F_GETLK64 in compat syscallJeff Layton
Currently, we're capping the values too low in the F_GETLK64 case. The fields in that structure are 64-bit values, so we shouldn't need to do any sort of fixup there. Make sure we check that assumption at build time in the future however by ensuring that the sizes we're copying will fit. With this, we no longer need COMPAT_LOFF_T_MAX either, so remove it. Fixes: 94073ad77fff2 (fs/locks: don't mess with the address limit in compat_fcntl64) Reported-by: Vitaly Lipatov <lav@etersoft.ru> Signed-off-by: Jeff Layton <jlayton@redhat.com> Reviewed-by: David Howells <dhowells@redhat.com>
2017-11-15fcntl: don't leak fd reference when fixup_compat_flock failsJeff Layton
Currently we just return err here, but we need to put the fd reference first. Fixes: 94073ad77fff (fs/locks: don't mess with the address limit in compat_fcntl64) Signed-off-by: Jeff Layton <jlayton@redhat.com>
2017-11-15ASoC: Intel: Add help text for SND_SOC_INTEL_SST_TOPLEVELVinod Koul
Symbol SND_SOC_INTEL_SST_TOPLEVEL is user selectable so add the help text for this symbol. Signed-off-by: Vinod Koul <vinod.koul@intel.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2017-11-15tcp: highest_sack fixEric Dumazet
syzbot easily found a regression added in our latest patches [1] No longer set tp->highest_sack to the head of the send queue since this is not logical and error prone. Only sack processing should maintain the pointer to an skb from rtx queue. We might in the future only remember the sequence instead of a pointer to skb, since rb-tree should allow a fast lookup. [1] BUG: KASAN: use-after-free in tcp_highest_sack_seq include/net/tcp.h:1706 [inline] BUG: KASAN: use-after-free in tcp_ack+0x42bb/0x4fd0 net/ipv4/tcp_input.c:3537 Read of size 4 at addr ffff8801c154faa8 by task syz-executor4/12860 CPU: 0 PID: 12860 Comm: syz-executor4 Not tainted 4.14.0-next-20171113+ #41 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 print_address_description+0x73/0x250 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report+0x25b/0x340 mm/kasan/report.c:409 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429 tcp_highest_sack_seq include/net/tcp.h:1706 [inline] tcp_ack+0x42bb/0x4fd0 net/ipv4/tcp_input.c:3537 tcp_rcv_established+0x672/0x18a0 net/ipv4/tcp_input.c:5439 tcp_v4_do_rcv+0x2ab/0x7d0 net/ipv4/tcp_ipv4.c:1468 sk_backlog_rcv include/net/sock.h:909 [inline] __release_sock+0x124/0x360 net/core/sock.c:2264 release_sock+0xa4/0x2a0 net/core/sock.c:2778 tcp_sendmsg+0x3a/0x50 net/ipv4/tcp.c:1462 inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:763 sock_sendmsg_nosec net/socket.c:632 [inline] sock_sendmsg+0xca/0x110 net/socket.c:642 ___sys_sendmsg+0x75b/0x8a0 net/socket.c:2048 __sys_sendmsg+0xe5/0x210 net/socket.c:2082 SYSC_sendmsg net/socket.c:2093 [inline] SyS_sendmsg+0x2d/0x50 net/socket.c:2089 entry_SYSCALL_64_fastpath+0x1f/0x96 RIP: 0033:0x452879 RSP: 002b:00007fc9761bfbe8 EFLAGS: 00000212 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 0000000000452879 RDX: 0000000000000000 RSI: 0000000020917fc8 RDI: 0000000000000015 RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006ee3a0 R13: 00000000ffffffff R14: 00007fc9761c06d4 R15: 0000000000000000 Allocated by task 12860: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489 kmem_cache_alloc_node+0x144/0x760 mm/slab.c:3638 __alloc_skb+0xf1/0x780 net/core/skbuff.c:193 alloc_skb_fclone include/linux/skbuff.h:1023 [inline] sk_stream_alloc_skb+0x11d/0x900 net/ipv4/tcp.c:870 tcp_sendmsg_locked+0x1341/0x3b80 net/ipv4/tcp.c:1299 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1461 inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:763 sock_sendmsg_nosec net/socket.c:632 [inline] sock_sendmsg+0xca/0x110 net/socket.c:642 SYSC_sendto+0x358/0x5a0 net/socket.c:1749 SyS_sendto+0x40/0x50 net/socket.c:1717 entry_SYSCALL_64_fastpath+0x1f/0x96 Freed by task 12860: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3492 [inline] kmem_cache_free+0x77/0x280 mm/slab.c:3750 kfree_skbmem+0xdd/0x1d0 net/core/skbuff.c:603 __kfree_skb+0x1d/0x20 net/core/skbuff.c:642 sk_wmem_free_skb include/net/sock.h:1419 [inline] tcp_rtx_queue_unlink_and_free include/net/tcp.h:1682 [inline] tcp_clean_rtx_queue net/ipv4/tcp_input.c:3111 [inline] tcp_ack+0x1b17/0x4fd0 net/ipv4/tcp_input.c:3593 tcp_rcv_established+0x672/0x18a0 net/ipv4/tcp_input.c:5439 tcp_v4_do_rcv+0x2ab/0x7d0 net/ipv4/tcp_ipv4.c:1468 sk_backlog_rcv include/net/sock.h:909 [inline] __release_sock+0x124/0x360 net/core/sock.c:2264 release_sock+0xa4/0x2a0 net/core/sock.c:2778 tcp_sendmsg+0x3a/0x50 net/ipv4/tcp.c:1462 inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:763 sock_sendmsg_nosec net/socket.c:632 [inline] sock_sendmsg+0xca/0x110 net/socket.c:642 ___sys_sendmsg+0x75b/0x8a0 net/socket.c:2048 __sys_sendmsg+0xe5/0x210 net/socket.c:2082 SYSC_sendmsg net/socket.c:2093 [inline] SyS_sendmsg+0x2d/0x50 net/socket.c:2089 entry_SYSCALL_64_fastpath+0x1f/0x96 The buggy address belongs to the object at ffff8801c154fa80 which belongs to the cache skbuff_fclone_cache of size 456 The buggy address is located 40 bytes inside of 456-byte region [ffff8801c154fa80, ffff8801c154fc48) The buggy address belongs to the page: page:ffffea00070553c0 count:1 mapcount:0 mapping:ffff8801c154f080 index:0x0 flags: 0x2fffc0000000100(slab) raw: 02fffc0000000100 ffff8801c154f080 0000000000000000 0000000100000006 raw: ffffea00070a5a20 ffffea0006a18360 ffff8801d9ca0500 0000000000000000 page dumped because: kasan: bad access detected Fixes: 737ff314563c ("tcp: use sequence distance to detect reordering") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Yuchung Cheng <ycheng@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-11-15geneve: fix fill_info when link downHangbin Liu
geneve->sock4/6 were added with geneve_open and released with geneve_stop. So when geneve link down, we will not able to show remote address and checksum info after commit 11387fe4a98 ("geneve: fix fill_info when using collect_metadata"). Fix this by avoid passing *_REMOTE{,6} for COLLECT_METADATA since they are mutually exclusive, and always show UDP_ZERO_CSUM6_RX info. Fixes: 11387fe4a98 ("geneve: fix fill_info when using collect_metadata") Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-11-15bpf: fix lockdep splatEric Dumazet
pcpu_freelist_pop() needs the same lockdep awareness than pcpu_freelist_populate() to avoid a false positive. [ INFO: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected ] switchto-defaul/12508 [HC0[0]:SC0[6]:HE0:SE0] is trying to acquire: (&htab->buckets[i].lock){......}, at: [<ffffffff9dc099cb>] __htab_percpu_map_update_elem+0x1cb/0x300 and this task is already holding: (dev_queue->dev->qdisc_class ?: &qdisc_tx_lock#2){+.-...}, at: [<ffffffff9e135848>] __dev_queue_xmit+0 x868/0x1240 which would create a new lock dependency: (dev_queue->dev->qdisc_class ?: &qdisc_tx_lock#2){+.-...} -> (&htab->buckets[i].lock){......} but this new dependency connects a SOFTIRQ-irq-safe lock: (dev_queue->dev->qdisc_class ?: &qdisc_tx_lock#2){+.-...} ... which became SOFTIRQ-irq-safe at: [<ffffffff9db5931b>] __lock_acquire+0x42b/0x1f10 [<ffffffff9db5b32c>] lock_acquire+0xbc/0x1b0 [<ffffffff9da05e38>] _raw_spin_lock+0x38/0x50 [<ffffffff9e135848>] __dev_queue_xmit+0x868/0x1240 [<ffffffff9e136240>] dev_queue_xmit+0x10/0x20 [<ffffffff9e1965d9>] ip_finish_output2+0x439/0x590 [<ffffffff9e197410>] ip_finish_output+0x150/0x2f0 [<ffffffff9e19886d>] ip_output+0x7d/0x260 [<ffffffff9e19789e>] ip_local_out+0x5e/0xe0 [<ffffffff9e197b25>] ip_queue_xmit+0x205/0x620 [<ffffffff9e1b8398>] tcp_transmit_skb+0x5a8/0xcb0 [<ffffffff9e1ba152>] tcp_write_xmit+0x242/0x1070 [<ffffffff9e1baffc>] __tcp_push_pending_frames+0x3c/0xf0 [<ffffffff9e1b3472>] tcp_rcv_established+0x312/0x700 [<ffffffff9e1c1acc>] tcp_v4_do_rcv+0x11c/0x200 [<ffffffff9e1c3dc2>] tcp_v4_rcv+0xaa2/0xc30 [<ffffffff9e191107>] ip_local_deliver_finish+0xa7/0x240 [<ffffffff9e191a36>] ip_local_deliver+0x66/0x200 [<ffffffff9e19137d>] ip_rcv_finish+0xdd/0x560 [<ffffffff9e191e65>] ip_rcv+0x295/0x510 [<ffffffff9e12ff88>] __netif_receive_skb_core+0x988/0x1020 [<ffffffff9e130641>] __netif_receive_skb+0x21/0x70 [<ffffffff9e1306ff>] process_backlog+0x6f/0x230 [<ffffffff9e132129>] net_rx_action+0x229/0x420 [<ffffffff9da07ee8>] __do_softirq+0xd8/0x43d [<ffffffff9e282bcc>] do_softirq_own_stack+0x1c/0x30 [<ffffffff9dafc2f5>] do_softirq+0x55/0x60 [<ffffffff9dafc3a8>] __local_bh_enable_ip+0xa8/0xb0 [<ffffffff9db4c727>] cpu_startup_entry+0x1c7/0x500 [<ffffffff9daab333>] start_secondary+0x113/0x140 to a SOFTIRQ-irq-unsafe lock: (&head->lock){+.+...} ... which became SOFTIRQ-irq-unsafe at: ... [<ffffffff9db5971f>] __lock_acquire+0x82f/0x1f10 [<ffffffff9db5b32c>] lock_acquire+0xbc/0x1b0 [<ffffffff9da05e38>] _raw_spin_lock+0x38/0x50 [<ffffffff9dc0b7fa>] pcpu_freelist_pop+0x7a/0xb0 [<ffffffff9dc08b2c>] htab_map_alloc+0x50c/0x5f0 [<ffffffff9dc00dc5>] SyS_bpf+0x265/0x1200 [<ffffffff9e28195f>] entry_SYSCALL_64_fastpath+0x12/0x17 other info that might help us debug this: Chain exists of: dev_queue->dev->qdisc_class ?: &qdisc_tx_lock#2 --> &htab->buckets[i].lock --> &head->lock Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&head->lock); local_irq_disable(); lock(dev_queue->dev->qdisc_class ?: &qdisc_tx_lock#2); lock(&htab->buckets[i].lock); <Interrupt> lock(dev_queue->dev->qdisc_class ?: &qdisc_tx_lock#2); *** DEADLOCK *** Fixes: e19494edab82 ("bpf: introduce percpu_freelist") Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-11-15net: cdc_ncm: GetNtbFormat endian fixBjørn Mork
The GetNtbFormat and SetNtbFormat requests operate on 16 bit little endian values. We get away with ignoring this most of the time, because we only care about USB_CDC_NCM_NTB16_FORMAT which is 0x0000. This fails for USB_CDC_NCM_NTB32_FORMAT. Fix comparison between LE value from device and constant by converting the constant to LE. Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk> Fixes: 2b02c20ce0c2 ("cdc_ncm: Set NTB format again after altsetting switch for Huawei devices") Cc: Enrico Mioso <mrkiko.rs@gmail.com> Cc: Christian Panton <christian@panton.org> Signed-off-by: Bjørn Mork <bjorn@mork.no> Acked-By: Enrico Mioso <mrkiko.rs@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-11-15Merge branch 'for-4.15/wacom' into for-linusJiri Kosina
- High resolution mode for DEll canvas support, from Benjamin Tissoires - A lot of improvements to pen handling in the Wacom driver, from Jason Gerecke Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2017-11-15Merge branch 'for-4.15/use-timer-setup' into for-linusJiri Kosina
- usbhid: conversion to timer_setup() and from_timer() from Kees Cook Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2017-11-15Merge branch 'for-4.15/upstream' into for-linusJiri Kosina
- cp2112: GPIO error handling and Kconfig fixes from Sébastien Szymanski - i2c-hid: fixup / quirk for Apollo-Lake based laptops, from Hans de Goede - Input/Core: add eraser tool support, from Ping Cheng - small assorted code fixes Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2017-11-15Merge branch 'for-4.15/sony' into for-linusJiri Kosina
- SHANWAN PS3 rumble fix from Bastien Nocera Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2017-11-15Merge branch 'for-4.15/multitouch' into for-linusJiri Kosina
- make sure that we forward MSC_TIMESTAMP in accordance to the specification, from Nicolas Boichat Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2017-11-15Merge branch 'for-4.15/logitech' into for-linusJiri Kosina
- small code fixes for Logitech driver from Colin Ian King
2017-11-15Merge branch 'for-4.15/hyperv' into for-linusJiri Kosina
- trivial printk() line termination fix for HyperV
2017-11-15Merge branch 'for-4.15/asus' into for-linusJiri Kosina
- Asus laptop fixes (fn keys, backlight), from Mustafa Kuscu and Maxime Bellengé
2017-11-15Merge branch 'for-4.15/alps' into for-linusJiri Kosina
- New ALPS touchpad (T4, found currently on HP EliteBook 1000, Zbook Stduio and HP Elite book x360) support from Masaki Ota
2017-11-15Merge branch 'for-4.14/upstream-fixes' into for-linusJiri Kosina
- Wacom: recognize PEN application collection properly, from Jason Gerecke - RMI: avoid cofusion caused by RMI functions being by mistake called on non-RMI devices, from Andrew Duggan - small device-ID-specific quirks/fixes Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2017-11-15pwm: stm32-lp: Remove pwm_is_enabled() check before calling pwm_disable()Axel Lin
The same checking is done by the implementation of pwm_disable(). Signed-off-by: Axel Lin <axel.lin@ingics.com> Acked-by: Fabrice Gasnier <fabrice.gasnier@st.com> Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
2017-11-15pwm: mediatek: Add MT2712/MT7622 supportZhi Mao
Add support for MT2712 and MT7622. Due to register offset address of pwm7 for MT2712 is not fixed 0x40, add mtk_pwm_reg_offset array for PWM register offset. Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com> Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com> Signed-off-by: Zhi Mao <zhi.mao@mediatek.com> Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
2017-11-15pwm: sunxi: Use of_device_get_match_data()Corentin Labbe
The usage of of_device_get_match_data reduce the code size a bit. Furthermore, it prevents an improbable dereference when of_match_device() returns NULL. Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com> Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
2017-11-15Merge branch 'for-4.15/callbacks' into for-linusJiri Kosina
This pulls in an infrastructure/API that allows livepatch writers to register pre-patch and post-patch callbacks that allow for running a glue code necessary for finalizing the patching if necessary. Conflicts: kernel/livepatch/core.c - trivial conflict by adding a callback call into module going notifier vs. moving that code block to klp_cleanup_module_patches_limited() Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2017-11-15pwm: atmel-tcb: Support backup modeRomain Izard
Save and restore registers for the PWM on suspend and resume, which makes hibernation and backup modes possible. Signed-off-by: Romain Izard <romain.izard.pro@gmail.com> Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com> Signed-off-by: Thierry Reding <thierry.reding@gmail.com>