summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-10-13libertas: return errno from lbs_add_card()Lubomir Rintel
This makes the error handling somewhat cleaner -- lbs_add_card() does no logner throw away the errno and lets its callers propagate it. Signed-off-by: Lubomir Rintel <lkundrak@v3.sk> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-10-13libertas: don't set URB_ZERO_PACKET on IN USB transferLubomir Rintel
The USB core gets rightfully upset: usb 1-1: BOGUS urb flags, 240 --> 200 WARNING: CPU: 0 PID: 60 at drivers/usb/core/urb.c:503 usb_submit_urb+0x2f8/0x3ed Modules linked in: CPU: 0 PID: 60 Comm: kworker/0:3 Not tainted 4.19.0-rc6-00319-g5206d00a45c7 #39 Hardware name: OLPC XO/XO, BIOS OLPC Ver 1.00.01 06/11/2014 Workqueue: events request_firmware_work_func EIP: usb_submit_urb+0x2f8/0x3ed Code: 75 06 8b 8f 80 00 00 00 8d 47 78 89 4d e4 89 55 e8 e8 35 1c f6 ff 8b 55 e8 56 52 8b 4d e4 51 50 68 e3 ce c7 c0 e8 ed 18 c6 ff <0f> 0b 83 c4 14 80 7d ef 01 74 0a 80 7d ef 03 0f 85 b8 00 00 00 8b EAX: 00000025 EBX: ce7d4980 ECX: 00000000 EDX: 00000001 ESI: 00000200 EDI: ce7d8800 EBP: ce7f5ea8 ESP: ce7f5e70 DS: 007b ES: 007b FS: 0000 GS: 00e0 SS: 0068 EFLAGS: 00210292 CR0: 80050033 CR2: 00000000 CR3: 00e80000 CR4: 00000090 Call Trace: ? if_usb_fw_timeo+0x64/0x64 __if_usb_submit_rx_urb+0x85/0xe6 ? if_usb_fw_timeo+0x64/0x64 if_usb_submit_rx_urb_fwload+0xd/0xf if_usb_prog_firmware+0xc0/0x3db ? _request_firmware+0x54/0x47b ? _request_firmware+0x89/0x47b ? if_usb_probe+0x412/0x412 lbs_fw_loaded+0x55/0xa6 ? debug_smp_processor_id+0x12/0x14 helper_firmware_cb+0x3c/0x3f request_firmware_work_func+0x37/0x6f process_one_work+0x164/0x25a worker_thread+0x1c4/0x284 kthread+0xec/0xf1 ? cancel_delayed_work_sync+0xf/0xf ? kthread_create_on_node+0x1a/0x1a ret_from_fork+0x2e/0x38 ---[ end trace 3ef1e3b2dd53852f ]--- Cc: stable@vger.kernel.org Signed-off-by: Lubomir Rintel <lkundrak@v3.sk> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-10-13iwlegacy: Add a lock assertion in il4965_send_rxon_assoc()Jia-Ju Bai
The variables il->staging.filter_flags, rxon1->filter_flags and rxon2->filter_flags need to be protected by the mutex lock il->mutex. This patch adds a lock assertion of il->mutex to check whether this lock is held. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Acked-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-10-13brcmsmac: AP mode: update beacon when TIM changesAli MJ Al-Nasrawy
Beacons are not updated to reflect TIM changes. This is not compliant with power-saving client stations as the beacons do not have valid TIM and can cause the network to stall at random occasions and to have highly variable latencies. Fix it by updating beacon templates on mac80211 set_tim callback. Addresses an issue described in: https://marc.info/?i=20180911163534.21312d08%20()%20manjaro Signed-off-by: Ali MJ Al-Nasrawy <alimjalnasrawy@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-10-13mt76x0: phy: do not run calibration during channel switchLorenzo Bianconi
Do not perform phy/vga calibration during channel switch. Moreover remove mt76x0_agc_save and mt76x0_agc_restore routines since they are no longer necessary. Furthermore run mt76_set_channel in order to check if there are pending frames during channel switch Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: phy: align channel gain logic to mt76x2 oneLorenzo Bianconi
Update vga tuning algorithm to the one used in mt76x2 driver Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76: introduce mt76x02_init_agc_gain routineLorenzo Bianconi
Add mt76x02_init_agc_gain routine in mt76x02-lib moudule in order to be reused by mt76x0 for vga initalization Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76: move mt76x02_phy_adjust_vga_gain in mt76/mt76x02_phy.cLorenzo Bianconi
Move mt76x02_phy_adjust_vga_gain routine in mt76x02-lib module in order to be reused by mt76x0 driver for vga calibration Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76: move rssi_gain_thresh routines in mt76x02-lib moduleLorenzo Bianconi
Move mt76x2_get_rssi_gain_thresh and mt76x2_get_low_rssi_gain_thresh routines in mt76x02-lib module in order to be reused by mt76x0 driver for dynamic vga calibration Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: phy: add phy/vco temperature compensationLorenzo Bianconi
Introduce phy/vco temperature calibration. Moreover fix configuration of register 67 on bank0 during temperature reading and use mt76_poll utility routine to poll core34 register. Furthermore temperature compensation needs to be disabled if the device supports tssi compensation. This issue has never been hit since temperature reading is not actually used by usb code. Fixes: 10de7a8b4ab9 ("mt76x0: phy files") Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: eeprom: introduce mt76x0_tssi_enabled routineLorenzo Bianconi
Add mt76x0_tssi_enabled in order to check if tssi compensation is enabled since mt76x0 condition differs from mt76x2 one. Moreover move back mt76x02_temp_tx_alc_enabled and mt76x02_tssi_enabled routines in mt76x2/eeprom.h since they are mt76x2 specific Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: phy: update set_channel for mt76x0e devicesLorenzo Bianconi
Do not run mt76x0_vco_cal and mt76x0_bbp_set_bw routines and configure MT_TX_SW_CFG0 register for pcie devices in mt76x0_phy_set_channel function. Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: pci: introduce mt76x0_phy_calirate routineLorenzo Bianconi
Add mt76x0_phy_calirate routine in order to perform phy calibration for mt76x0e devices. Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: pci: rename mt76x0_phy_calibrateLorenzo Bianconi
Rename mt76x0_phy_calibrate routine in mt76x0_phy_calibration_work in order to not collide with calibration routine for mt76x0e Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76: move mt76x02_phy_set_band in mt76x02-lib moduleLorenzo Bianconi
Move mt76x02_phy_set_band routine in mt76x02_phy.c since it is shared between mt76x0 and mt76x2 drivers and remove duplicated code Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76: move mt76x02_phy_set_bw in mt76x02-lib moduleLorenzo Bianconi
Move mt76x02_phy_set_bw routine in mt76x02_phy.c since it is shared between mt76x0 and mt76x2 drivers and remove duplicated code Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: phy: remove channel parameter from mt76x0_phy_set_chan_bbp_paramsLorenzo Bianconi
Remove unused channel parameter from mt76x0_phy_set_chan_bbp_params routine signature Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: phy: fix restore phase in mt76x0_phy_recalibrate_after_assocLorenzo Bianconi
Fix restore value configured in MT_BBP(IBI, 9) register in mt76x0_phy_recalibrate_after_assoc routine. Fixes: 10de7a8b4ab9 ("mt76x0: phy files") Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76: mt76x0e: another fix for the external PA current settingFelix Fietkau
- Use the register number define instead of a magic value - Fix inverted bit test (override needs to be applied if the bit is not set) Fixes: 2b2cb40bcd7d ("mt76x0: pci: add hw initialization at bootstrap") Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: pci: fix set external PA I/O currentYueHaibing
Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/mediatek/mt76/mt76x0/pci.c: In function 'mt76x0e_register_device': drivers/net/wireless/mediatek/mt76/mt76x0/pci.c:107:8: warning: variable 'data' set but not used [-Wunused-but-set-variable] It seems correct value to write is 'data' Fixes: 2b2cb40bcd7d ("mt76x0: pci: add hw initialization at bootstrap") Acked-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76: do not store aggregation sequence number for null-data framesFelix Fietkau
Fixes a rare corner case where a BlockAckReq might get the wrong sequence number. Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: remove dma.hStanislaw Gruszka
dma.h is not used any longer. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76: reserve enough room for USB tx skbsStanislaw Gruszka
Reserve enough room for USB skb, so we don not need to check the room every time we send frame. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: pci: add mt76x0_register_device in mt76x0e_register_deviceLorenzo Bianconi
Run mt76x0_register_device routine in mt76x0e_register_device in order to register the device to the mac80211 layer. Moreover init mt76_driver_ops data structure and register interrupt line Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76: disable ldpc coding for mt76x0 devicesLorenzo Bianconi
Disable ldpc coding for mt76x0 devices. Morover remove mt76x02_mac_fill_txwi routine since it is used just in mt76x02_mac_write_txwi Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: pci: add missing mac80211 callbacksLorenzo Bianconi
Add missing mac80211 callbacks in mt76x0e_ops data structure Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: pci: report firmware version using ethtoolLorenzo Bianconi
Report via ethtool fw_ver and build_ver members of mt76x02_fw_header data structure similarly to what is reported in the syslog Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76: use mt76x02_dev instead of mt76_dev in mt76x02_eeprom.cLorenzo Bianconi
Use mt76x02_dev data structure as reference in mt76x02_eeprom.c instead of mt76_dev Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76: use mt76x02_dev instead of mt76_dev in mt76x02_txrx.cLorenzo Bianconi
Use mt76x02_dev data structure as reference in mt76x02_txrx.c instead of mt76_dev Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76: use mt76x02_dev instead of mt76_dev in mt76x02_mac.cLorenzo Bianconi
Use mt76x02_dev data structure as reference in mt76x02_mac.c instead of mt76_dev Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76: use mt76x02_dev instead of mt76_dev in mt76x02_usb_mcu.cLorenzo Bianconi
Use mt76x02_dev data structure as reference in mt76x02_usb_mcu.c instead of mt76_dev Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76: use mt76x02_dev instead of mt76_dev in mt76x02_util.cLorenzo Bianconi
Use mt76x02_dev data structure as reference in mt76x02_util.c instead of mt76_dev Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76: use mt76x02_dev instead of mt76_dev in mt76x02_phy.cLorenzo Bianconi
Use mt76x02_dev data structure as reference in mt76x02_phy.c instead of mt76_dev Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76: use mt76x02_dev instead of mt76_dev in mt76x02_mcu.cLorenzo Bianconi
Use mt76x02_dev data structure as reference in mt76x02_mcu.c instead of mt76_dev Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: phy: fix bank check in mt76x0_rf_csr_{wr,rr}Lorenzo Bianconi
Fix typo in bank check in mt76x0_rf_csr_{wr,rr} routines. This issue has never been hit since mt76x0_rf_csr_{wr,rr} are actually used just by pci code Fixes: 10de7a8b4ab9 ("mt76x0: phy files") Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: use bus helper to identify rf access methodStanislaw Gruszka
Use mt76_is_usb() to identify RF access method instead of MT76_STATE_MCU_RUNNING flag and add warning since MCU has to be initialized before we can access RF registers via MCU. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: correct RF reg pairs write for PCIeStanislaw Gruszka
We have to use RF CSR method for PCIe. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76: allow to identify busStanislaw Gruszka
Add helpers to identify bus type. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: correct RF access via RF_CSR register.Stanislaw Gruszka
PCIe version don't use MCU for RF registers access. We need to correct RF CSR method to support up to 127 RF registers. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13mt76x0: print BBP version only for debugStanislaw Gruszka
Use dev_dbg to print BBP version. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-10-13Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmGreg Kroah-Hartman
Paolo writes: "KVM fixes for 4.19-rc8 Leftover bugfixes." * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: vmx: hyper-v: don't pass EPT configuration info to vmx_hv_remote_flush_tlb() KVM: x86: support CONFIG_KVM_AMD=y with CONFIG_CRYPTO_DEV_CCP_DD=m ARM: KVM: Correctly order SGI register entries in the cp15 array
2018-10-13rtlwifi: rtl8821ae: replace _rtl8821ae_mrate_idx_to_arfr_id with generic versionColin Ian King
Function _rtl8821ae_mrate_idx_to_arfr_id is functionally identical to the generic version rtl_mrate_idx_to_arfr_id, so remove _rtl8821ae_mrate_idx_to_arfr_id and use the generic one instead. This also fixes a missing break statement found by CoverityScan in _rtl8821ae_mrate_idx_to_arfr_id, namely: CID#1167237 ("Missing break in switch") Thanks to Joe Perches for spotting this when I submitted an earlier patch. Fixes: 3c05bedb5fef ("Staging: rtl8812ae: Add Realtek 8821 PCI WIFI driver") Signed-off-by: Colin Ian King <colin.king@canonical.com> ACKed-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-10-13iwlwifi: mvm: check return value of rs_rate_from_ucode_rate()Luca Coelho
The rs_rate_from_ucode_rate() function may return -EINVAL if the rate is invalid, but none of the callsites check for the error, potentially making us access arrays with index IWL_RATE_INVALID, which is larger than the arrays, causing an out-of-bounds access. This will trigger KASAN warnings, such as the one reported in the bugzilla issue mentioned below. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=200659 Cc: stable@vger.kernel.org Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-10-13Merge tag 'iwlwifi-next-for-kalle-2018-10-12' of ↵Kalle Valo
git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Fourth set of iwlwifi patches intended for 4.20 * Support for a new scan type; * Clean-up in the queue handling code; * A few bug fixes;
2018-10-13KVM: vmx: hyper-v: don't pass EPT configuration info to ↵Vitaly Kuznetsov
vmx_hv_remote_flush_tlb() I'm observing random crashes in multi-vCPU L2 guests running on KVM on Hyper-V. I bisected the issue to the commit 877ad952be3d ("KVM: vmx: Add tlb_remote_flush callback support"). Hyper-V TLFS states: "AddressSpace specifies an address space ID (an EPT PML4 table pointer)" So apparently, Hyper-V doesn't expect us to pass naked EPTP, only PML4 pointer should be used. Strip off EPT configuration information before calling into vmx_hv_remote_flush_tlb(). Fixes: 877ad952be3d ("KVM: vmx: Add tlb_remote_flush callback support") Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-10-13ubifs: Fix WARN_ON logic in exit pathRichard Weinberger
ubifs_assert() is not WARN_ON(), so we have to invert the checks. Randy faced this warning with UBIFS being a module, since most users use UBIFS as builtin because UBIFS is the rootfs nobody noticed so far. :-( Including me. Reported-by: Randy Dunlap <rdunlap@infradead.org> Fixes: 54169ddd382d ("ubifs: Turn two ubifs_assert() into a WARN_ON()") Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-13Merge branch 'akpm'Greg Kroah-Hartman
Fixes from Andrew: * akpm: fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters() mm/thp: fix call to mmu_notifier in set_pmd_migration_entry() v2 mm/mmap.c: don't clobber partially overlapping VMA with MAP_FIXED_NOREPLACE ocfs2: fix a GCC warning
2018-10-13fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters()Khazhismel Kumykov
On non-preempt kernels this loop can take a long time (more than 50 ticks) processing through entries. Link: http://lkml.kernel.org/r/20181010172623.57033-1-khazhy@google.com Signed-off-by: Khazhismel Kumykov <khazhy@google.com> Acked-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> Reviewed-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-13mm/thp: fix call to mmu_notifier in set_pmd_migration_entry() v2Jérôme Glisse
Inside set_pmd_migration_entry() we are holding page table locks and thus we can not sleep so we can not call invalidate_range_start/end() So remove call to mmu_notifier_invalidate_range_start/end() because they are call inside the function calling set_pmd_migration_entry() (see try_to_unmap_one()). Link: http://lkml.kernel.org/r/20181012181056.7864-1-jglisse@redhat.com Signed-off-by: Jérôme Glisse <jglisse@redhat.com> Reported-by: Andrea Arcangeli <aarcange@redhat.com> Reviewed-by: Zi Yan <zi.yan@cs.rutgers.edu> Acked-by: Michal Hocko <mhocko@kernel.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Anshuman Khandual <khandual@linux.vnet.ibm.com> Cc: Dave Hansen <dave.hansen@intel.com> Cc: David Nellans <dnellans@nvidia.com> Cc: Ingo Molnar <mingo@elte.hu> Cc: Mel Gorman <mgorman@techsingularity.net> Cc: Minchan Kim <minchan@kernel.org> Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Vlastimil Babka <vbabka@suse.cz> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-13mm/mmap.c: don't clobber partially overlapping VMA with MAP_FIXED_NOREPLACEJann Horn
Daniel Micay reports that attempting to use MAP_FIXED_NOREPLACE in an application causes that application to randomly crash. The existing check for handling MAP_FIXED_NOREPLACE looks up the first VMA that either overlaps or follows the requested region, and then bails out if that VMA overlaps *the start* of the requested region. It does not bail out if the VMA only overlaps another part of the requested region. Fix it by checking that the found VMA only starts at or after the end of the requested region, in which case there is no overlap. Test case: user@debian:~$ cat mmap_fixed_simple.c #include <sys/mman.h> #include <errno.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> #ifndef MAP_FIXED_NOREPLACE #define MAP_FIXED_NOREPLACE 0x100000 #endif int main(void) { char *p; errno = 0; p = mmap((void*)0x10001000, 0x4000, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0); printf("p1=%p err=%m\n", p); errno = 0; p = mmap((void*)0x10000000, 0x2000, PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0); printf("p2=%p err=%m\n", p); char cmd[100]; sprintf(cmd, "cat /proc/%d/maps", getpid()); system(cmd); return 0; } user@debian:~$ gcc -o mmap_fixed_simple mmap_fixed_simple.c user@debian:~$ ./mmap_fixed_simple p1=0x10001000 err=Success p2=0x10000000 err=Success 10000000-10002000 r--p 00000000 00:00 0 10002000-10005000 ---p 00000000 00:00 0 564a9a06f000-564a9a070000 r-xp 00000000 fe:01 264004 /home/user/mmap_fixed_simple 564a9a26f000-564a9a270000 r--p 00000000 fe:01 264004 /home/user/mmap_fixed_simple 564a9a270000-564a9a271000 rw-p 00001000 fe:01 264004 /home/user/mmap_fixed_simple 564a9a54a000-564a9a56b000 rw-p 00000000 00:00 0 [heap] 7f8eba447000-7f8eba5dc000 r-xp 00000000 fe:01 405885 /lib/x86_64-linux-gnu/libc-2.24.so 7f8eba5dc000-7f8eba7dc000 ---p 00195000 fe:01 405885 /lib/x86_64-linux-gnu/libc-2.24.so 7f8eba7dc000-7f8eba7e0000 r--p 00195000 fe:01 405885 /lib/x86_64-linux-gnu/libc-2.24.so 7f8eba7e0000-7f8eba7e2000 rw-p 00199000 fe:01 405885 /lib/x86_64-linux-gnu/libc-2.24.so 7f8eba7e2000-7f8eba7e6000 rw-p 00000000 00:00 0 7f8eba7e6000-7f8eba809000 r-xp 00000000 fe:01 405876 /lib/x86_64-linux-gnu/ld-2.24.so 7f8eba9e9000-7f8eba9eb000 rw-p 00000000 00:00 0 7f8ebaa06000-7f8ebaa09000 rw-p 00000000 00:00 0 7f8ebaa09000-7f8ebaa0a000 r--p 00023000 fe:01 405876 /lib/x86_64-linux-gnu/ld-2.24.so 7f8ebaa0a000-7f8ebaa0b000 rw-p 00024000 fe:01 405876 /lib/x86_64-linux-gnu/ld-2.24.so 7f8ebaa0b000-7f8ebaa0c000 rw-p 00000000 00:00 0 7ffcc99fa000-7ffcc9a1b000 rw-p 00000000 00:00 0 [stack] 7ffcc9b44000-7ffcc9b47000 r--p 00000000 00:00 0 [vvar] 7ffcc9b47000-7ffcc9b49000 r-xp 00000000 00:00 0 [vdso] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall] user@debian:~$ uname -a Linux debian 4.19.0-rc6+ #181 SMP Wed Oct 3 23:43:42 CEST 2018 x86_64 GNU/Linux user@debian:~$ As you can see, the first page of the mapping at 0x10001000 was clobbered. Link: http://lkml.kernel.org/r/20181010152736.99475-1-jannh@google.com Fixes: a4ff8e8620d3 ("mm: introduce MAP_FIXED_NOREPLACE") Signed-off-by: Jann Horn <jannh@google.com> Reported-by: Daniel Micay <danielmicay@gmail.com> Acked-by: Michal Hocko <mhocko@suse.com> Acked-by: John Hubbard <jhubbard@nvidia.com> Acked-by: Kees Cook <keescook@chromium.org> Acked-by: Vlastimil Babka <vbabka@suse.cz> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
generated by cgit (git 2.34.1) at 2025-09-13 23:43:27 +0000