Seung-Woo Kim [Tue, 24 Apr 2018 07:02:17 +0000 (16:02 +0900)]
drm/tgm: tdm_pp: fix possible deadlock with ppdrv->cmd_lock
When releasing tgm drm driver, there can be deadlock for
ppdrv->cmd_lock during call path of pp_put_mem_node()
because pp_find_drv_by_handle() has also ppdrv->cmd_lock.
Fix the possible deadlock with ppdrv->cmd_lock by storing ppdrv
in m_node.
Change-Id: Ibb94b4cca818d94ee02e672e8547c1a831388322
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Seung-Woo Kim [Tue, 24 Apr 2018 05:17:34 +0000 (14:17 +0900)]
video: fbdev: exynos: decon: lower repeated spamming log
There are too many log about te on and off. Lower repeated spamming
log.
Change-Id: I80a1e6981d543d6355eecf574e227bb6d3aedbc4
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Seung-Woo Kim [Tue, 24 Apr 2018 05:16:26 +0000 (14:16 +0900)]
drm/tgm: tdm: lower repeated vblank log
There are too many log about vblank irq enable and disable. Lower
repeated spamming log.
Change-Id: I8db0c7a4efbec6a9dd8db81cf847018ee47edb61
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Seung-Woo Kim [Tue, 24 Apr 2018 04:49:23 +0000 (13:49 +0900)]
drm/tgm: tbm: lower repeated spamming log
There are too many log about gem alloc and free. Lower repeated
spamming log.
Change-Id: Ia7520df48ad67e6b9e41594e4b4eea48977365bd
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Seung-Woo Kim [Tue, 24 Apr 2018 04:48:29 +0000 (13:48 +0900)]
ion: lower repeated spamming log
There are too many log about ion alloc and free. Lower repeated
spamming log.
Change-Id: I65cb53537ea5c778f514894e96486cb6965ecf54
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Seung-Woo Kim [Tue, 17 Apr 2018 07:32:06 +0000 (16:32 +0900)]
arm64: tizen_tw2_defconfig: enable CONFIG_CONNECTOR and CONFIG_PROC_EVENTS
These options enable Netlink Connector feature of kernel to monitor
process lifecycle like Fork and Exit status of all processes
asynchronously.
In Tzen, it will be used by stc-manager(smart traffic control) to
monitor process lifecycle.
Change-Id: I265504609e6b2ce963875e66884d064affc48d9d
Signed-off-by: hyunuktak <hyunuk.tak@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Seung-Woo Kim [Tue, 17 Apr 2018 07:14:46 +0000 (16:14 +0900)]
arm64: tizen_tw2_defconfig: enable NETFILTER_XT_TARGET_LOG
Enable NETFILTER_XT_TARGET_LOG for analysis of iptables log.
It is a iptables feature for security report on Tizen 5.0,
required from stc-manager.
Signed-off-by: hyunuktak <hyunuk.tak@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Ia31c1e9463f28b74a67bad7272e0fea08c88c28c
Hoegeun Kwon [Wed, 11 Apr 2018 01:15:12 +0000 (10:15 +0900)]
arm64: tizen_tw2_defconfig: enable SW_SYNC
Enable the SW_SYNC framework configuration for use sw_sync from
userspace.
Change-Id: I7af5a77ac0f0b5694bb660e7f6155dbffafd8487
Signed-off-by: Hoegeun Kwon <hoegeun.kwon@samsung.com>
Hoegeun Kwon [Wed, 11 Apr 2018 01:14:25 +0000 (10:14 +0900)]
video: fbdev: exynos: decon: Remove unnecessary code about sw_sync
There is problem that dma_sync and sw_sync can not be used together at
the same time. Since dma_sync is a mixed implementation of sw_sync and
dma, only dma_sync of decon should be used. So remove unnecessary
sw_sync code from decon driver.
Change-Id: I0f0567306d61db6c480daf1ac8f86d2a174c912a
Signed-off-by: Hoegeun Kwon <hoegeun.kwon@samsung.com>
Liping Zhang [Tue, 28 Mar 2017 14:59:25 +0000 (22:59 +0800)]
netfilter: nfnetlink_queue: fix secctx memory leak
We must call security_release_secctx to free the memory returned by
security_secid_to_secctx, otherwise memory may be leaked forever.
Fixes:
ef493bd930ae ("netfilter: nfnetlink_queue: add security context information")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
[sw0312.kim: backport the commit
77c1c03c5b8 from mainline to fix already backported commit
- the commit
ef493bd930ae ("netfilter: nfnetlink_queue: add security context information") was backported for nether.service in tizen
- change in net/netfilter/nfnetlink_queue.c is applied to net/netfilter/nfnetlink_queue_core.c]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Ifbc5f96bb6039503b7390864936fe6eda2e53acb
Roman Gushchin [Fri, 17 Nov 2017 23:26:45 +0000 (15:26 -0800)]
proc, coredump: add CoreDumping flag to /proc/pid/status
Right now there is no convenient way to check if a process is being
coredumped at the moment.
It might be necessary to recognize such state to prevent killing the
process and getting a broken coredump. Writing a large core might take
significant time, and the process is unresponsive during it, so it might
be killed by timeout, if another process is monitoring and
killing/restarting hanging tasks.
We're getting a significant number of corrupted coredump files on
machines in our fleet, just because processes are being killed by
timeout in the middle of the core writing process.
We do have a process health check, and some agent is responsible for
restarting processes which are not responding for health check requests.
Writing a large coredump to the disk can easily exceed the reasonable
timeout (especially on an overloaded machine).
This flag will allow the agent to distinguish processes which are being
coredumped, extend the timeout for them, and let them produce a full
coredump file.
To provide an ability to detect if a process is in the state of being
coredumped, we can expose a boolean CoreDumping flag in
/proc/pid/status.
Example:
$ cat core.sh
#!/bin/sh
echo "|/usr/bin/sleep 10" > /proc/sys/kernel/core_pattern
sleep 1000 &
PID=$!
cat /proc/$PID/status | grep CoreDumping
kill -ABRT $PID
sleep 1
cat /proc/$PID/status | grep CoreDumping
$ ./core.sh
CoreDumping: 0
CoreDumping: 1
[guro@fb.com: document CoreDumping flag in /proc/<pid>/status]
Link: http://lkml.kernel.org/r/20170928135357.GA8470@castle.DHCP.thefacebook.com
Link: http://lkml.kernel.org/r/20170920230634.31572-1-guro@fb.com
Signed-off-by: Roman Gushchin <guro@fb.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Konstantin Khlebnikov <koct9i@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[inki.dae: backported from mainline - commit :
c643401218be
On Tizen, there is one issue that a process doing coredump can be killed.
This patch allows a process to detect if given process is being dumped.
With this, Tizen can exclude such process from 'kill list' so that
coredump process can finish coredump work.]
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Change-Id: I7ddd9fc618942244bd7e8523be3f080504cc9a06
Jaehoon Chung [Mon, 16 Oct 2017 10:18:19 +0000 (19:18 +0900)]
packaging: add the dzImage-recovery image
Add the dzImage-recovery image as using recovery.
Change-Id: Iafac3bdbd8165a12701fa12c6ddd2ca23ab91d2d
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
Denis Khalikov [Fri, 25 Aug 2017 11:02:13 +0000 (14:02 +0300)]
packaging: Disable UBSan build
UBSan build on kernel will cause build error because kernel has its own
sanitizer build options. So, dislable UBSan build from packaging spec.
Change-Id: Ia7cccf6daf0718e6d34b0382a62edc18f02ba999
Signed-off-by: Denis Khalikov <d.khalikov@partner.samsung.com>
Jin-young Jeon [Mon, 14 Aug 2017 08:26:31 +0000 (17:26 +0900)]
video/fbdev: decon: fix wrong pixel format setting.
fix wrong pixel format setting.
This patch comes from product kernel.
Change-Id: If5008ffacb65afef7e819ceea4f4b11bb666464e
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Jin-young Jeon [Tue, 15 Aug 2017 08:07:33 +0000 (17:07 +0900)]
drm/tgm: tdm/pp: add shift setting operation during set size.
add shift setting operation during set size
This patch comes from product kernel.
Change-Id: I98692214aaec340db6efecbcb240288d86e14241
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Jin-young Jeon [Mon, 7 Aug 2017 06:39:51 +0000 (15:39 +0900)]
drm/tgm: tdm/pp: add alignmentation to fix cropping problem.
add alignmentation to fix cropping problem
This patch comes from product kernel.
Change-Id: I2901cbe286471ae47932ea7970e5d1025eef0aa9
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Jaechul Lee [Wed, 23 Aug 2017 00:32:45 +0000 (09:32 +0900)]
packaging: Remove permission settings for devel package
Setting 644 permissions for devel package is removed. The all files in
the devel package are created with 644 permission. As a result, executable
files don't work when building out-of-tree module because they don't have a
execution permission.
Change-Id: I79854937593af982ed829a39446273e89e91a5f5
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Seung-Woo Kim [Mon, 21 Aug 2017 23:27:32 +0000 (08:27 +0900)]
packaging: fix to create uapi header before kernel build
To create proper kernel devel package, kernel should not be cleaned
after build. So, fix to create uapi header which execute clean
before kernel build.
Change-Id: Ie83a2ea56815561074b3e1ee0e77719cbd8a4711
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Seung-Woo Kim [Tue, 22 Aug 2017 00:21:55 +0000 (09:21 +0900)]
packaging: remove unnecessary files from devel package
The files created by build, including Image and merged-dtb, are not
necessary in devel package. Also, for arm64, compressed image is
not zImage or bzImage but Image.gz. Remove the unnecessary files
from devel package instead of not existing zImage or bzImage.
Change-Id: I5c930133a0d062f68545054c84f7229b62a4b1a3
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Jaechul Lee [Thu, 10 Aug 2017 02:18:56 +0000 (11:18 +0900)]
packaging: Remove symbolic link in a devel package
The symbolic link to kernel-devel-tizen-dev doesn't need anymore because
those who want to build SWAP-DA will use the absolute package name for
building respectively on the several kernels.
The out-of-tree kernel module build uses absolute devel package name to
bulid SWAP-DA. It should be left out to prevent a conflict between
each kernel devel packages.
Change-Id: I6b55002174a424267db4d5cb4a5c09d9a0ad8358
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Alexander Aksenov [Fri, 4 Aug 2017 05:10:11 +0000 (14:10 +0900)]
ARM64: tizen_tw2_defconfig: enable MODULES
To support kernel modules build, loading, and unloading enable config
option MODULES and force loading and unloading options.
Change-Id: If67e5a8c5ae91c632a3225244a385ac9ff26728b
Signed-off-by: Alexander Aksenov <a.aksenov@samsung.com>
[sw0312.kim: spilt config patch and adjust commit-msg]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Seung-Woo Kim [Fri, 4 Aug 2017 05:03:50 +0000 (14:03 +0900)]
kconfig: fix not to select TIMA_LKMAUTH from MODULES
TIMA_LKMAUTH prevents loading modules built for development. Fix
not to select TIMA_LKMAUTH by selecting MODULES for possibility
to set the config option.
Change-Id: I65b084ff31e7428296d8995ecb1a9c7a005118c8
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Alexander Aksenov [Fri, 4 Aug 2017 02:55:04 +0000 (11:55 +0900)]
misc: mcu_ipc: fix duplicated export symbol
There is duplicated export symbol with EXPORT_SYMBOL(). Fix one from
the symbols with proper function name.
With this modification, build error with CONFIG_MODULES is removed.
Change-Id: I696e324cc55ac381063ba8e442dc45e55ba78a01
Signed-off-by: Alexander Aksenov <a.aksenov@samsung.com>
[sw0312.kim: spilt mcu_ipc patch and adjust commit-msg]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Jin-young Jeon [Thu, 6 Jul 2017 05:32:18 +0000 (14:32 +0900)]
drm/tgm: tdm_pp: add pp_set_planar_addr().
It should be supported to divide each planar address.
This patch is from product kernel.
Change-Id: I3bd2cfa5fabd67ee57ffb7a575e6bf35e2ba161e
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Jin-young Jeon [Thu, 6 Jul 2017 04:35:27 +0000 (13:35 +0900)]
drm/tgm: tdm_pp: add size field on tdm_pp_buf_info.
This patch is from product kernel.
Change-Id: I4d2901793835fe708781ad72c0a3fd28d4608d41
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Jin-young Jeon [Thu, 6 Jul 2017 04:33:17 +0000 (13:33 +0900)]
drm/tgm: tbm: add tbm_gem_get_size().
This patch is from product kernel.
Change-Id: Ia5089be4a803861b66eb17d4463efe860e17914d
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Inki Dae [Thu, 6 Jul 2017 01:24:35 +0000 (10:24 +0900)]
ARM64: tizen_tw2_defconfig: disble VIDEO_EXYNOS_SCALER
This patch disbles V4L2 based scaler driver.
We use DRM based IPP driver so this configuraion should be disabled.
Change-Id: If1544d8b4db9225f26db51c2c9a1c3940b36be5e
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Inki Dae [Tue, 4 Jul 2017 01:41:39 +0000 (10:41 +0900)]
ARM64: tizen_tw2_defconfig: enable post processing driver
This patch enables post processing driver for TGM module.
Change-Id: Iff25cbe6383231d81b2b44b3773769300103e087
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Inki Dae [Tue, 4 Jul 2017 01:38:18 +0000 (10:38 +0900)]
drm/tgm: code sync with product kernel
This patch synchronizes tgm driver with latest product kernel.
Almost patches have been merged based on original patch of product kernel
but there are missing code from beginning so regarding this code,
I have merged it manually.
Change-Id: If699b55a5ad67e7a82e8195376d81ffbebf78535
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Jin-young Jeon [Thu, 29 Jun 2017 10:11:18 +0000 (19:11 +0900)]
drm/tgm: tdm: change completion interface.
Add cmd completion instead of start / stop completion.
This patch is from product kernel.
Change-Id: I09d0e61d307d619db1ebb61b8e4242edff4a4259
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Jin-young Jeon [Tue, 20 Jun 2017 06:12:46 +0000 (15:12 +0900)]
drm/tgm: tdm: add ttrace log to check vsync
This patch is from product kernel.
Change-Id: I46d68956d4cbf196379a3f6037189712248694dd
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Jin-young Jeon [Thu, 8 Jun 2017 04:16:07 +0000 (13:16 +0900)]
drm/tgm: tdm/pp: add fence mechanism on TDM PP.
This patch is from product kernel.
Change-Id: Iae386e3a0a1984d9dec157153a280ac5886ba5e0
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Jin-young Jeon [Thu, 8 Jun 2017 02:05:25 +0000 (11:05 +0900)]
drm/tgm: tbm: add get dma_buf interface.
This patch is from product kernel.
Change-Id: Id6c8221c75b2bd715968df8fdd49d4b86f26a599
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
jonggab.park [Fri, 28 Apr 2017 08:13:56 +0000 (17:13 +0900)]
drm/tdm: implement msc driver to support PP.
MSC driver is included. This patch is from product kernel.
Change-Id: Ibe08ff732fb4e5cc9718b59254cd52f8716bad5b
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
jonggab.park [Fri, 28 Apr 2017 08:02:34 +0000 (17:02 +0900)]
drm/tdm: implement PP interface.
PP interface is included. This patch is from product kernel.
Change-Id: I44d06ab017e2023440010ad64a4265e24954f0c2
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
jonggab.park [Fri, 28 Apr 2017 05:24:45 +0000 (14:24 +0900)]
drm/tbm: add get/put dma address interface.
DMA address interface set for pp driver.
This patch is from product kernel.
Change-Id: I41ad97483fdd7f0e3c17fc216d04d47edca2f8b1
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
jonggab.park [Fri, 28 Apr 2017 05:09:54 +0000 (14:09 +0900)]
drm/tgm: add sub driver handling interface.
It doesn't have the pp interface for the pp driver.
And this patch is from product kernel.
Change-Id: Iceb891e602fe6e6e246445b7d845927cc39a73c0
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Jin-young Jeon [Mon, 22 May 2017 08:34:05 +0000 (17:34 +0900)]
drm/tgm: add pid information on gem_info
This patch is from product kernel.
Change-Id: Id408cab17ca339bb2d8c8af1193a7905f2a34869
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Jin-young Jeon [Mon, 26 Dec 2016 05:51:05 +0000 (14:51 +0900)]
drm/tgm: tdm: change sequence to turn off vblank.
Prevent duplicated low power mode request.
This patch is from product kernel.
Change-Id: I729af7274ca491a84ec72790c8ca6bf67530ce5b
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Gonzha Dmitriy Evgenevich [Wed, 24 May 2017 10:51:05 +0000 (13:51 +0300)]
packaging: Turn off building with ASan
Turn off ASan for ASan sanitized firmware build
Change-Id: If786306821ff22e994efaba2b00dcabcc5eb8426
Signed-off-by: Gonzha Dmitriy Evgenevich <d.gonzha@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Seung-Woo Kim [Mon, 27 Mar 2017 06:32:47 +0000 (15:32 +0900)]
packaging: install license for rpm package instead of license package
This patch replaces license rpm package to license file in rpm
package.
Change-Id: I8d06a0b42bce3e5d774151f2d708b081c1b46956
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Marek Szyprowski [Tue, 21 Feb 2017 13:21:01 +0000 (14:21 +0100)]
dma-buf: add support for compat ioctl
Add compat ioctl support to dma-buf. This lets one to use DMA_BUF_IOCTL_SYNC
ioctl from 32bit application on 64bit kernel. Data structures for both 32
and 64bit modes are same, so there is no need for additional translation
layer.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: http://patchwork.freedesktop.org/patch/msgid/1487683261-2655-1-git-send-email-m.szyprowski@samsung.com
[Adjust commit-msg with commit in next tree]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I902d06598ffa5a8985274185f6dc5b15ae119fcb
Daniel Vetter [Tue, 21 Feb 2017 07:37:38 +0000 (16:37 +0900)]
dma-buf: Add ioctls to allow userspace to flush
The userspace might need some sort of cache coherency management e.g. when CPU
and GPU domains are being accessed through dma-buf at the same time. To
circumvent this problem there are begin/end coherency markers, that forward
directly to existing dma-buf device drivers vfunc hooks. Userspace can make use
of those markers through the DMA_BUF_IOCTL_SYNC ioctl. The sequence would be
used like following:
- mmap dma-buf fd
- for each drawing/upload cycle in CPU 1. SYNC_START ioctl, 2. read/write
to mmap area 3. SYNC_END ioctl. This can be repeated as often as you
want (with the new data being consumed by the GPU or say scanout device)
- munmap once you don't need the buffer any more
v2 (Tiago): Fix header file type names (u64 -> __u64)
v3 (Tiago): Add documentation. Use enum dma_buf_sync_flags to the begin/end
dma-buf functions. Check for overflows in start/length.
v4 (Tiago): use 2d regions for sync.
v5 (Tiago): forget about 2d regions (v4); use _IOW in DMA_BUF_IOCTL_SYNC and
remove range information from struct dma_buf_sync.
v6 (Tiago): use __u64 structured padded flags instead enum. Adjust
documentation about the recommendation on using sync ioctls.
v7 (Tiago): Alex' nit on flags definition and being even more wording in the
doc about sync usage.
v9 (Tiago): remove useless is_dma_buf_file check. Fix sync.flags conditionals
and its mask order check. Add <linux/types.h> include in dma-buf.h.
Change-Id: Id20b5354ba481e2d896b08500e1323eedcb16e5b
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: David Herrmann <dh.herrmann@gmail.com>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Reviewed-by: Stéphane Marchesin <marcheu@chromium.org>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Signed-off-by: Tiago Vignatti <tiago.vignatti@intel.com>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1455228291-29640-1-git-send-email-tiago.vignatti@intel.com
And below things are included,
- backport of mainline commit
831e9da7dc5c22fd2a5fb64e999f6e077a4338c3
- fix build errors incurred by argument mismatches of dma_buf_begin/end_cpu_access function calls in v4l2/mali/ion drivers.
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Jaechul Lee [Mon, 6 Mar 2017 09:33:36 +0000 (18:33 +0900)]
packaging: exported kernel-header based on armv7l
There were difference in kernel-headers between arch64 and armv7l
architecture. It need to be built and exported respectively. So, I
enabled building and made kernel-headers for armv7l.
Change-Id: Ia890e98a591f3474711313ab41800712717190f8
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Dongwoo Lee [Thu, 23 Feb 2017 07:01:05 +0000 (16:01 +0900)]
power: battery: sec-battery: Add support for disabling battery charge
The new attribute "disable_charge" will be added. If this attribute is
set to 1, battery charging completely stops within "discharging"
state, and it cannot resume until restoring the attribute as 0 or
rebooting the target.
Change-Id: I0638bf73ba89d72c34d1c338a411e6d4978060db
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
Jaechul Lee [Fri, 17 Feb 2017 05:11:59 +0000 (14:11 +0900)]
packaging: exported kernel-header properly
Orginally, kernel-header which is based on 3.18.14 was exported.
We applied some patches on the kernel therefore it need to export
patched kernel-header again. Moreover, organized spec script properly
and removed unnecessary code.
Change-Id: I8935d9cc374a2551e57a4ba4f551c047abad2814
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Jaechul Lee [Thu, 16 Feb 2017 05:47:49 +0000 (14:47 +0900)]
packaging: added execution authority to script files
GBS build would be failed sometimes because script file don't have
execution authority even though I already added execution permission
like this '755'. So, I added execute permisson forcibly while RPM is
executed.
Change-Id: Ie014c03575659c5f1bca18af8572c712251c38fd
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Jaechul Lee [Thu, 16 Feb 2017 02:13:37 +0000 (11:13 +0900)]
packaging: removed '%post' script and unnecessary code
There are two rpms as a result such as aarch64 and armv7l. In case of
aarh64, It works well but %post script in armv7l arch won't run because
of baselibs. Therefore, I located dzImage in /boot/kernel/dzImage
directly.
Change-Id: Ibeb43d6db22f597b9ffad07d16b925516ea1950d
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Jaechul Lee [Thu, 16 Feb 2017 05:42:28 +0000 (14:42 +0900)]
packaging: removed code associated with module build
It is not need to build kernel modules, we don't use it.
Change-Id: I534648cf110ae606187a75bca6e49bd9d954eb33
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Jaechul Lee [Wed, 15 Feb 2017 10:03:56 +0000 (19:03 +0900)]
packaging: baselibs didn't work.
if i use the name of rpm packages included '.' or '_' like
'linux-3.18-tizen_tw2', it will be failed to make armv7l rpm packages.
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Jaechul Lee [Wed, 15 Feb 2017 08:24:48 +0000 (17:24 +0900)]
packaging: fixed baselibs contents.
added "+/" for making arm7l binary and changed rpm name.
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Jaechul Lee [Wed, 15 Feb 2017 07:53:02 +0000 (16:53 +0900)]
packaging: added 'ExclusiveArch:aarch64'
TW2 should be built to use aarch64.
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Jaechul Lee [Fri, 10 Feb 2017 05:25:48 +0000 (14:25 +0900)]
packaging: added baselibs.conf for building arm7l arch.
It also need to build kernel based on arm7l.
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Jaechul Lee [Thu, 9 Feb 2017 00:18:19 +0000 (09:18 +0900)]
packaging: fixed the permission error when execute "scripts/exynos_*.sh"
script files for dtb were created with 644 permission in the scratchbox even
though i already changed perm to 755. Therefore, build will be failed when
execute "exynos_dtbtool.sh" because it doesn't have 'x' permission.
I tried to touch these files again and it worked well. I suspect that first
patch couldn't apply the file attribute. That's why i made this meaningless
commit.
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Jaechul Lee [Wed, 8 Feb 2017 01:06:03 +0000 (10:06 +0900)]
packaging: removed useless BuildRequires.
Removed useless "BuildRequires" in the spec file such as gcc, lzop, python and
etc. It is possible to build kernel without these packages.
The reason why, kernel doesn't need to have dependencies these packages
associated with Tizen platform.
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Jaechul Lee [Tue, 7 Feb 2017 09:53:06 +0000 (18:53 +0900)]
arm64: defconfig: disable SWAP_DA config.
removed useless config.
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Jaechul Lee [Tue, 7 Feb 2017 03:53:43 +0000 (12:53 +0900)]
input: removed annoying input event logs.
Removed unnecessary logs when occuring hardkeys, touchscreen, rotary event.
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Jaechul Lee [Tue, 7 Feb 2017 04:40:28 +0000 (13:40 +0900)]
arm64: defconfig: changed defconfig name to tw2 from solis
Removed unnecessary defconfigs and changed defconfig name to tw2.
Change-Id: Ifa1e0f93a9104fcad264d2015343c9b1bdf637f6
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
[sw0312.kim: sync with .config]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Jin-young Jeon [Mon, 19 Dec 2016 05:53:50 +0000 (14:53 +0900)]
drm/tgm: tbm: implement prime import ops on gem_ion.
This patch implementes prime import for gem_ion.
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Jin-young Jeon [Mon, 19 Dec 2016 04:57:47 +0000 (13:57 +0900)]
ion: add apis to get client property.
This patch adds APIs to get ion client property.
Change-Id: I642063422247fe6dc012a75fc4937637115b6358
Signed-off-by: Jin-young Jeon <jy0.jeon@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Seung-Woo Kim [Mon, 6 Feb 2017 11:31:46 +0000 (20:31 +0900)]
power-supply: sync supply properties and type
This patch fixes to sync supply properties and their type to avoid
int type in string type position.
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Seung-Woo Kim [Mon, 6 Feb 2017 11:29:56 +0000 (20:29 +0900)]
battery: p9220: adjust log and log level for get_property
The get_property function prints not matched value with info level,
so this patch adjusts value name and change to debug level.
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Jaechul Lee [Thu, 2 Feb 2017 10:38:08 +0000 (19:38 +0900)]
video: exynos: Add DECON_STATE_INIT in the suspend function
DECON_STATE_INIT is not defined in the suspend function. So, it return while
booting tizen. Besides, added logs to check the device state.
Errors
dpm_run_callback(): pm_genpd_suspend+0x0/0x78 returns -16
PM: Device
14830000.decon_fb failed to suspend: error -16
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Jaechul Lee [Wed, 1 Feb 2017 02:22:48 +0000 (11:22 +0900)]
power: Removed unnecessary logs during booting and idle state.
Changed levels of unnecessary log to debug from error and info.
Moreover, changed error code to ENODATA from EINVAL to avoid printing out
too much logs during idle state.
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Jaechul Lee [Mon, 30 Jan 2017 23:58:22 +0000 (08:58 +0900)]
packaging: Added '.gbs.conf' for partial build
Added gbs configuration file for enhanced building.
it makes gbs build faster than before.
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
[sw0312.kim: sync package version with rebase kernel version]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I19888ea5b2e753c387cac39c334fb6d7bc1bc98f
Jaechul Lee [Thu, 26 Jan 2017 01:13:24 +0000 (10:13 +0900)]
packaging: Made build scripts for GBS.
Build scripts were fixed to be worked on GBS environment based on gcc6.
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Seung-Woo Kim [Wed, 25 Jan 2017 10:31:12 +0000 (19:31 +0900)]
arm64: tizen_solis_defconfig: adjust smack options
This patch adjusts smack options to enable smack netfilter and
smack append signals.
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Roman Kubiak [Fri, 12 Jun 2015 10:32:57 +0000 (12:32 +0200)]
netfilter: nfnetlink_queue: add security context information
This patch adds an additional attribute when sending
packet information via netlink in netfilter_queue module.
It will send additional security context data, so that
userspace applications can verify this context against
their own security databases.
Signed-off-by: Roman Kubiak <r.kubiak@samsung.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Casey Schaufler [Wed, 11 Feb 2015 20:52:32 +0000 (12:52 -0800)]
Smack: secmark connections
If the secmark is available us it on connection as
well as packet delivery.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Casey Schaufler [Fri, 23 Jan 2015 17:31:01 +0000 (09:31 -0800)]
Smack: Repair netfilter dependency
On 1/23/2015 8:20 AM, Jim Davis wrote:
> Building with the attached random configuration file,
>
> security/smack/smack_netfilter.c: In function ‘smack_ipv4_output’:
> security/smack/smack_netfilter.c:55:6: error: ‘struct sk_buff’ has no
> member named ‘secmark’
> skb->secmark = skp->smk_secid;
> ^
> make[2]: *** [security/smack/smack_netfilter.o] Error 1
The existing Makefile used the wrong configuration option to
determine if smack_netfilter should be built. This sets it right.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Casey Schaufler [Sat, 13 Dec 2014 01:08:40 +0000 (17:08 -0800)]
Smack: secmark support for netfilter
Smack uses CIPSO to label internet packets and thus provide
for access control on delivery of packets. The netfilter facility
was not used to allow for Smack to work properly without netfilter
configuration. Smack does not need netfilter, however there are
cases where it would be handy.
As a side effect, the labeling of local IPv4 packets can be optimized
and the handling of local IPv6 packets is just all out better.
The best part is that the netfilter tools use "contexts" that
are just strings, and they work just as well for Smack as they
do for SELinux.
All of the conditional compilation for IPv6 was implemented
by Rafal Krypa <r.krypa@samsung.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Seung-Woo Kim [Mon, 12 Dec 2016 08:35:26 +0000 (17:35 +0900)]
Smack: ignore private inode for file functions
The access to fd from anon_inode is always failed because there is
no set xattr operations. So this patch fixes to ignore private
inode including anon_inode for file functions.
It was only ignored for smack_file_receive() to share dma-buf fd,
but dma-buf has other functions like ioctl and mmap.
Reference: https://lkml.org/lkml/2015/4/17/16
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Rafal Krypa [Fri, 9 Dec 2016 13:03:04 +0000 (14:03 +0100)]
Smack: fix d_instantiate logic for sockfs and pipefs
Since
4b936885a (v2.6.32) all inodes on sockfs and pipefs are disconnected.
It caused filesystem specific code in smack_d_instantiate to be skipped,
because all inodes on those pseudo filesystems were treated as root inodes.
As a result all sockfs inodes had the Smack label set to floor.
In most cases access checks for sockets use socket_smack data so the inode
label is not important. But there are special cases that were broken.
One example would be calling fcntl with F_SETOWN command on a socket fd.
Now smack_d_instantiate expects all pipefs and sockfs inodes to be
disconnected and has the logic in appropriate place.
Signed-off-by: Rafal Krypa <r.krypa@samsung.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
jooseong lee [Thu, 3 Nov 2016 10:54:39 +0000 (11:54 +0100)]
Smack: Assign smack_known_web label for kernel thread's
Assign smack_known_web label for kernel thread's socket
Creating struct sock by sk_alloc function in various kernel subsystems
like bluetooth doesn't call smack_socket_post_create(). In such case,
received sock label is the floor('_') label and makes access deny.
Signed-off-by: jooseong lee <jooseong.lee@samsung.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Casey Schaufler [Tue, 30 Aug 2016 17:31:39 +0000 (10:31 -0700)]
Smack: Signal delivery as an append operation
Under a strict subject/object security policy delivering a
signal or delivering network IPC could be considered either
a write or an append operation. The original choice to make
both write operations leads to an issue where IPC delivery
is desired under policy, but delivery of signals is not.
This patch provides the option of making signal delivery
an append operation, allowing Smack rules that deny signal
delivery while allowing IPC. This was requested for Tizen.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Seung-Woo Kim [Sat, 21 Jan 2017 03:32:05 +0000 (12:32 +0900)]
modem_if: remove not necessary comparison
The numerical comparison on boolean value causes build warning
with gcc 6, so this patch removes not necessary comparison.
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Seung-Woo Kim [Sat, 21 Jan 2017 03:28:57 +0000 (12:28 +0900)]
fix non proper indents for if clause
non proper indent for if clause causes build error with gcc 6. So
this patch fixes them.
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Seung-Woo Kim [Sat, 21 Jan 2017 03:26:22 +0000 (12:26 +0900)]
SWAP-DA: remove invalid semicolons on energy module
There are invalid semicolons after if clause on energy module and
it causes following build error with gcc 6, so this patch removes
the invalid semicolons.
kernel/swap/energy/energy.c: In function 'calc_wifi_recv_energy':
kernel/swap/energy/energy.c:640:2: error: this 'if' clause does not guard... [-Werror=misleading-indentation]
if (len <= 0 || check_wlan0(sock));
^~
kernel/swap/energy/energy.c:641:3: note: ...this statement, but the latter is misleadingly indented as if it is guarded by the 'if'
return;
^~~~~~
kernel/swap/energy/energy.c: In function 'calc_wifi_send_energy':
kernel/swap/energy/energy.c:653:2: error: this 'if' clause does not guard... [-Werror=misleading-indentation]
if (len <= 0 || check_wlan0(sock));
^~
kernel/swap/energy/energy.c:654:3: note: ...this statement, but the latter is misleadingly indented as if it is guarded by the 'if'
return;
^~~~~~
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Seung-Woo Kim [Tue, 17 Jan 2017 04:22:22 +0000 (13:22 +0900)]
net: bcm4358: fix not to check same value in macro
When BCMBUSTYPE is not defined, then BUSTYPE(bustype) is just
bustype. So comparing bustype and BUSTYPE(bustype) is not necessary.
This patch removes following build warning with gcc 6.
drivers/net/wireless/bcmdhd4358/siutils.c: In function 'si_doattach':
drivers/net/wireless/bcmdhd4358/siutils.c:512:14: warning: self-comparison always evaluates to false [-Wtautological-compare]
if (bustype != BUSTYPE(bustype)) {
^~
Change-Id: I1cac3dd31bcb86983469830013a1093ed9ceaa89
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Seung-Woo Kim [Sat, 21 Jan 2017 03:09:30 +0000 (12:09 +0900)]
trace: remove invalid semicolon after if clause
The commit
6f6f99a38132 ("trace: add non-hierarchical function_graph option"),
in https://android.googlesource.com/kernel/common.git/+/android-3.18,
added invalid semicolon after if clause, so it causes following
build error on gcc 6, so this patch removes the invalid seimicolon.
kernel/trace/trace_output.c: In function 'trace_graph_ret_raw':
kernel/trace/trace_output.c:976:2: error: this 'if' clause does not guard... [-Werror=misleading-indentation]
if (!trace_seq_printf(&iter->seq, "%lx %lld %lld %ld %d\n",
^~
kernel/trace/trace_output.c:982:3: note: ...this statement, but the latter is misleadingly indented as if it is guarded by the 'if'
return TRACE_TYPE_PARTIAL_LINE;
^~~~~~
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Seung-Woo Kim [Mon, 23 Jan 2017 07:53:32 +0000 (16:53 +0900)]
build: add exynos system-tools script files
This patch adds exynos system-tools script files to make
merged dtb file and merged kernel file with dtbs.
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Jaechul Lee [Thu, 26 Jan 2017 05:58:55 +0000 (14:58 +0900)]
Imported code from product.
Change-Id: Ib32fd2379edc36fd7dd8adb5459009707dc0204a
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Al Viro [Fri, 27 May 2016 15:06:05 +0000 (11:06 -0400)]
switch ->setxattr() to passing dentry and inode separately
smack ->d_instantiate() uses ->setxattr(), so to be able to call it before
we'd hashed the new dentry and attached it to inode, we need ->setxattr()
instances getting the inode as an explicit argument rather than obtaining
it from dentry.
Similar change for ->getxattr() had been done in commit ce23e64. Unlike
->getxattr() (which is used by both selinux and smack instances of
->d_instantiate()) ->setxattr() is used only by smack one and unfortunately
it got missed back then.
Reported-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Tested-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[sw0312.kim: backport to 3.18]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Ic064260484c41010024cd04f154b392a182e3da0
Al Viro [Fri, 27 May 2016 14:19:30 +0000 (10:19 -0400)]
switch xattr_handler->set() to passing dentry and inode separately
preparation for similar switch in ->setxattr() (see the next commit for
rationale).
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[sw0312.kim: backport to 3.18 including ext3]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I98d786b0c21fb761f180b564d7d4455c77cab3b9
Al Viro [Mon, 11 Apr 2016 04:53:26 +0000 (00:53 -0400)]
security_d_instantiate(): move to the point prior to attaching dentry to inode
commit
b96809173e94ea2fa8c19c2e40e8545a1821bf57 upstream.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[sw0312.kim: backport to 3.18]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Ie05efa64cefc014c21ae1acfc44acf2c81b9950b
Al Viro [Mon, 11 Apr 2016 04:48:00 +0000 (00:48 -0400)]
->getxattr(): pass dentry and inode as separate arguments
commit
ce23e640133484eebc20ca7b7668388213e11327 upstream.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[sw0312.kim: backport to 3.18]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Iddfbd0bebefe264e6f10c08ea0445b09daf99f3a
Al Viro [Mon, 11 Apr 2016 00:48:24 +0000 (20:48 -0400)]
xattr_handler: pass dentry and inode as separate arguments of ->get()
commit
b296821a7c42fa58baa17513b2b7b30ae66f3336 upstream.
... and do not assume they are already attached to each other
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[sw0312.kim: backport to 3.18 including ext3]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Ida4ef28f8c9abd23c28de20f15ad6d6b141d64e3
Greg Kroah-Hartman [Sat, 23 Feb 2019 08:04:26 +0000 (09:04 +0100)]
Linux 3.18.136
Eric Dumazet [Tue, 22 Jan 2019 18:40:59 +0000 (10:40 -0800)]
ax25: fix possible use-after-free
commit
63530aba7826a0f8e129874df9c4d264f9db3f9e upstream.
syzbot found that ax25 routes where not properly protected
against concurrent use [1].
In this particular report the bug happened while
copying ax25->digipeat.
Fix this problem by making sure we call ax25_get_route()
while ax25_route_lock is held, so that no modification
could happen while using the route.
The current two ax25_get_route() callers do not sleep,
so this change should be fine.
Once we do that, ax25_get_route() no longer needs to
grab a reference on the found route.
[1]
ax25_connect(): syz-executor0 uses autobind, please contact jreuter@yaina.de
BUG: KASAN: use-after-free in memcpy include/linux/string.h:352 [inline]
BUG: KASAN: use-after-free in kmemdup+0x42/0x60 mm/util.c:113
Read of size 66 at addr
ffff888066641a80 by task syz-executor2/531
ax25_connect(): syz-executor0 uses autobind, please contact jreuter@yaina.de
CPU: 1 PID: 531 Comm: syz-executor2 Not tainted 5.0.0-rc2+ #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1db/0x2d0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
check_memory_region_inline mm/kasan/generic.c:185 [inline]
check_memory_region+0x123/0x190 mm/kasan/generic.c:191
memcpy+0x24/0x50 mm/kasan/common.c:130
memcpy include/linux/string.h:352 [inline]
kmemdup+0x42/0x60 mm/util.c:113
kmemdup include/linux/string.h:425 [inline]
ax25_rt_autobind+0x25d/0x750 net/ax25/ax25_route.c:424
ax25_connect.cold+0x30/0xa4 net/ax25/af_ax25.c:1224
__sys_connect+0x357/0x490 net/socket.c:1664
__do_sys_connect net/socket.c:1675 [inline]
__se_sys_connect net/socket.c:1672 [inline]
__x64_sys_connect+0x73/0xb0 net/socket.c:1672
do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458099
Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:
00007f870ee22c78 EFLAGS:
00000246 ORIG_RAX:
000000000000002a
RAX:
ffffffffffffffda RBX:
0000000000000003 RCX:
0000000000458099
RDX:
0000000000000048 RSI:
0000000020000080 RDI:
0000000000000005
RBP:
000000000073bf00 R08:
0000000000000000 R09:
0000000000000000
ax25_connect(): syz-executor4 uses autobind, please contact jreuter@yaina.de
R10:
0000000000000000 R11:
0000000000000246 R12:
00007f870ee236d4
R13:
00000000004be48e R14:
00000000004ce9a8 R15:
00000000ffffffff
Allocated by task 526:
save_stack+0x45/0xd0 mm/kasan/common.c:73
set_track mm/kasan/common.c:85 [inline]
__kasan_kmalloc mm/kasan/common.c:496 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:469
kasan_kmalloc+0x9/0x10 mm/kasan/common.c:504
ax25_connect(): syz-executor5 uses autobind, please contact jreuter@yaina.de
kmem_cache_alloc_trace+0x151/0x760 mm/slab.c:3609
kmalloc include/linux/slab.h:545 [inline]
ax25_rt_add net/ax25/ax25_route.c:95 [inline]
ax25_rt_ioctl+0x3b9/0x1270 net/ax25/ax25_route.c:233
ax25_ioctl+0x322/0x10b0 net/ax25/af_ax25.c:1763
sock_do_ioctl+0xe2/0x400 net/socket.c:950
sock_ioctl+0x32f/0x6c0 net/socket.c:1074
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:509 [inline]
do_vfs_ioctl+0x107b/0x17d0 fs/ioctl.c:696
ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
__do_sys_ioctl fs/ioctl.c:720 [inline]
__se_sys_ioctl fs/ioctl.c:718 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
ax25_connect(): syz-executor5 uses autobind, please contact jreuter@yaina.de
Freed by task 550:
save_stack+0x45/0xd0 mm/kasan/common.c:73
set_track mm/kasan/common.c:85 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:458
kasan_slab_free+0xe/0x10 mm/kasan/common.c:466
__cache_free mm/slab.c:3487 [inline]
kfree+0xcf/0x230 mm/slab.c:3806
ax25_rt_add net/ax25/ax25_route.c:92 [inline]
ax25_rt_ioctl+0x304/0x1270 net/ax25/ax25_route.c:233
ax25_ioctl+0x322/0x10b0 net/ax25/af_ax25.c:1763
sock_do_ioctl+0xe2/0x400 net/socket.c:950
sock_ioctl+0x32f/0x6c0 net/socket.c:1074
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:509 [inline]
do_vfs_ioctl+0x107b/0x17d0 fs/ioctl.c:696
ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
__do_sys_ioctl fs/ioctl.c:720 [inline]
__se_sys_ioctl fs/ioctl.c:718 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at
ffff888066641a80
which belongs to the cache kmalloc-96 of size 96
The buggy address is located 0 bytes inside of
96-byte region [
ffff888066641a80,
ffff888066641ae0)
The buggy address belongs to the page:
page:
ffffea0001999040 count:1 mapcount:0 mapping:
ffff88812c3f04c0 index:0x0
flags: 0x1fffc0000000200(slab)
ax25_connect(): syz-executor4 uses autobind, please contact jreuter@yaina.de
raw:
01fffc0000000200 ffffea0001817948 ffffea0002341dc8 ffff88812c3f04c0
raw:
0000000000000000 ffff888066641000 0000000100000020 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888066641980: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888066641a00: 00 00 00 00 00 00 00 00 02 fc fc fc fc fc fc fc
>
ffff888066641a80: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff888066641b00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888066641b80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Eric Dumazet [Tue, 5 Feb 2019 23:38:44 +0000 (15:38 -0800)]
mISDN: fix a race in dev_expire_timer()
commit
bdcc5bc25548ef6b08e2e43937148f907c212292 upstream.
Since mISDN_close() uses dev->pending to iterate over active
timers, there is a chance that one timer got removed from the
->pending list in dev_expire_timer() but that the thread
has not called yet wake_up_interruptible()
So mISDN_close() could miss this and free dev before
completion of at least one dev_expire_timer()
syzbot was able to catch this race :
BUG: KASAN: use-after-free in register_lock_class+0x140c/0x1bf0 kernel/locking/lockdep.c:827
Write of size 8 at addr
ffff88809fc18948 by task syz-executor1/24769
CPU: 1 PID: 24769 Comm: syz-executor1 Not tainted 5.0.0-rc5 #60
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
__asan_report_store8_noabort+0x17/0x20 mm/kasan/generic_report.c:140
register_lock_class+0x140c/0x1bf0 kernel/locking/lockdep.c:827
__lock_acquire+0x11f/0x4700 kernel/locking/lockdep.c:3224
lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3841
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:152
__wake_up_common_lock+0xc7/0x190 kernel/sched/wait.c:120
__wake_up+0xe/0x10 kernel/sched/wait.c:145
dev_expire_timer+0xe4/0x3b0 drivers/isdn/mISDN/timerdev.c:174
call_timer_fn+0x190/0x720 kernel/time/timer.c:1325
protocol 88fb is buggy, dev hsr_slave_0
protocol 88fb is buggy, dev hsr_slave_1
expire_timers kernel/time/timer.c:1362 [inline]
__run_timers kernel/time/timer.c:1681 [inline]
__run_timers kernel/time/timer.c:1649 [inline]
run_timer_softirq+0x652/0x1700 kernel/time/timer.c:1694
__do_softirq+0x266/0x95a kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x180/0x1d0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1062
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
</IRQ>
RIP: 0010:__sanitizer_cov_trace_pc+0x26/0x50 kernel/kcov.c:101
Code: 90 90 90 90 55 48 89 e5 48 8b 75 08 65 48 8b 04 25 40 ee 01 00 65 8b 15 98 12 92 7e 81 e2 00 01 1f 00 75 2b 8b 90 d8 12 00 00 <83> fa 02 75 20 48 8b 88 e0 12 00 00 8b 80 dc 12 00 00 48 8b 11 48
RSP: 0018:
ffff8880589b7a60 EFLAGS:
00000246 ORIG_RAX:
ffffffffffffff13
RAX:
ffff888087ce25c0 RBX:
0000000000000001 RCX:
ffffffff818f8ca3
RDX:
0000000000000000 RSI:
ffffffff818f8b48 RDI:
0000000000000001
RBP:
ffff8880589b7a60 R08:
ffff888087ce25c0 R09:
ffffed1015d25bd0
R10:
ffffed1015d25bcf R11:
ffff8880ae92de7b R12:
ffffea0001ae4680
R13:
ffffea0001ae4688 R14:
0000000000000000 R15:
ffffea0001b41648
PageIdle include/linux/page-flags.h:398 [inline]
page_is_idle include/linux/page_idle.h:29 [inline]
mark_page_accessed+0x618/0x1140 mm/swap.c:398
touch_buffer fs/buffer.c:59 [inline]
__find_get_block+0x312/0xcc0 fs/buffer.c:1298
sb_find_get_block include/linux/buffer_head.h:338 [inline]
recently_deleted fs/ext4/ialloc.c:682 [inline]
find_inode_bit.isra.0+0x202/0x510 fs/ext4/ialloc.c:722
__ext4_new_inode+0x14ad/0x52c0 fs/ext4/ialloc.c:914
ext4_symlink+0x3f8/0xbe0 fs/ext4/namei.c:3096
vfs_symlink fs/namei.c:4126 [inline]
vfs_symlink+0x378/0x5d0 fs/namei.c:4112
do_symlinkat+0x22b/0x290 fs/namei.c:4153
__do_sys_symlink fs/namei.c:4172 [inline]
__se_sys_symlink fs/namei.c:4170 [inline]
__x64_sys_symlink+0x59/0x80 fs/namei.c:4170
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457b67
Code: 0f 1f 00 b8 5c 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 6d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 4d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:
00007fff045ce0f8 EFLAGS:
00000202 ORIG_RAX:
0000000000000058
RAX:
ffffffffffffffda RBX:
0000000000000001 RCX:
0000000000457b67
RDX:
00007fff045ce173 RSI:
00000000004bd63f RDI:
00007fff045ce160
RBP:
0000000000000000 R08:
0000000000000000 R09:
0000000000000013
R10:
0000000000000075 R11:
0000000000000202 R12:
0000000000000000
R13:
0000000000000001 R14:
000000000000029b R15:
0000000000000001
Allocated by task 24763:
save_stack+0x45/0xd0 mm/kasan/common.c:73
set_track mm/kasan/common.c:85 [inline]
__kasan_kmalloc mm/kasan/common.c:496 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:469
kasan_kmalloc+0x9/0x10 mm/kasan/common.c:504
kmem_cache_alloc_trace+0x151/0x760 mm/slab.c:3609
kmalloc include/linux/slab.h:545 [inline]
mISDN_open+0x9a/0x270 drivers/isdn/mISDN/timerdev.c:59
misc_open+0x398/0x4c0 drivers/char/misc.c:141
chrdev_open+0x247/0x6b0 fs/char_dev.c:417
do_dentry_open+0x47d/0x1130 fs/open.c:771
vfs_open+0xa0/0xd0 fs/open.c:880
do_last fs/namei.c:3418 [inline]
path_openat+0x10d7/0x4690 fs/namei.c:3534
do_filp_open+0x1a1/0x280 fs/namei.c:3564
do_sys_open+0x3fe/0x5d0 fs/open.c:1063
__do_sys_openat fs/open.c:1090 [inline]
__se_sys_openat fs/open.c:1084 [inline]
__x64_sys_openat+0x9d/0x100 fs/open.c:1084
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 24762:
save_stack+0x45/0xd0 mm/kasan/common.c:73
set_track mm/kasan/common.c:85 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:458
kasan_slab_free+0xe/0x10 mm/kasan/common.c:466
__cache_free mm/slab.c:3487 [inline]
kfree+0xcf/0x230 mm/slab.c:3806
mISDN_close+0x2a1/0x390 drivers/isdn/mISDN/timerdev.c:97
__fput+0x2df/0x8d0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x14a/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:166
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at
ffff88809fc18900
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 72 bytes inside of
192-byte region [
ffff88809fc18900,
ffff88809fc189c0)
The buggy address belongs to the page:
page:
ffffea00027f0600 count:1 mapcount:0 mapping:
ffff88812c3f0040 index:0xffff88809fc18000
flags: 0x1fffc0000000200(slab)
raw:
01fffc0000000200 ffffea000269f648 ffffea00029f7408 ffff88812c3f0040
raw:
ffff88809fc18000 ffff88809fc18000 000000010000000b 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88809fc18800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88809fc18880: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>
ffff88809fc18900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88809fc18980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88809fc18a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Karsten Keil <isdn@linux-pingi.de>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Eric Dumazet [Fri, 8 Feb 2019 20:41:05 +0000 (12:41 -0800)]
net/x25: do not hold the cpu too long in x25_new_lci()
commit
cf657d22ee1f0e887326a92169f2e28dc932fd10 upstream.
Due to quadratic behavior of x25_new_lci(), syzbot was able
to trigger an rcu stall.
Fix this by not blocking BH for the whole duration of
the function, and inserting a reschedule point when possible.
If we care enough, using a bitmap could get rid of the quadratic
behavior.
syzbot report :
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 0-...!: (10500 ticks this GP) idle=4fa/1/0x4000000000000002 softirq=283376/283376 fqs=0
rcu: (t=10501 jiffies g=383105 q=136)
rcu: rcu_preempt kthread starved for 10502 jiffies! g383105 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: RCU grace-period kthread stack dump:
rcu_preempt I28928 10 2 0x80000000
Call Trace:
context_switch kernel/sched/core.c:2844 [inline]
__schedule+0x817/0x1cc0 kernel/sched/core.c:3485
schedule+0x92/0x180 kernel/sched/core.c:3529
schedule_timeout+0x4db/0xfd0 kernel/time/timer.c:1803
rcu_gp_fqs_loop kernel/rcu/tree.c:1948 [inline]
rcu_gp_kthread+0x956/0x17a0 kernel/rcu/tree.c:2105
kthread+0x357/0x430 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
NMI backtrace for cpu 0
CPU: 0 PID: 8759 Comm: syz-executor2 Not tainted 5.0.0-rc4+ #51
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x1be/0x236 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
rcu_dump_cpu_stacks+0x183/0x1cf kernel/rcu/tree.c:1211
print_cpu_stall kernel/rcu/tree.c:1348 [inline]
check_cpu_stall kernel/rcu/tree.c:1422 [inline]
rcu_pending kernel/rcu/tree.c:3018 [inline]
rcu_check_callbacks.cold+0x500/0xa4a kernel/rcu/tree.c:2521
update_process_times+0x32/0x80 kernel/time/timer.c:1635
tick_sched_handle+0xa2/0x190 kernel/time/tick-sched.c:161
tick_sched_timer+0x47/0x130 kernel/time/tick-sched.c:1271
__run_hrtimer kernel/time/hrtimer.c:1389 [inline]
__hrtimer_run_queues+0x33e/0xde0 kernel/time/hrtimer.c:1451
hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1509
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
smp_apic_timer_interrupt+0x120/0x570 arch/x86/kernel/apic/apic.c:1060
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
</IRQ>
RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline]
RIP: 0010:queued_write_lock_slowpath+0x13e/0x290 kernel/locking/qrwlock.c:86
Code: 00 00 fc ff df 4c 8d 2c 01 41 83 c7 03 41 0f b6 45 00 41 38 c7 7c 08 84 c0 0f 85 0c 01 00 00 8b 03 3d 00 01 00 00 74 1a f3 90 <41> 0f b6 55 00 41 38 d7 7c eb 84 d2 74 e7 48 89 df e8 6c 0f 4f 00
RSP: 0018:
ffff88805f117bd8 EFLAGS:
00000206 ORIG_RAX:
ffffffffffffff13
RAX:
0000000000000300 RBX:
ffffffff89413ba0 RCX:
1ffffffff1282774
RDX:
0000000000000000 RSI:
0000000000000004 RDI:
ffffffff89413ba0
RBP:
ffff88805f117c70 R08:
1ffffffff1282774 R09:
fffffbfff1282775
R10:
fffffbfff1282774 R11:
ffffffff89413ba3 R12:
00000000000000ff
R13:
fffffbfff1282774 R14:
1ffff1100be22f7d R15:
0000000000000003
queued_write_lock include/asm-generic/qrwlock.h:104 [inline]
do_raw_write_lock+0x1d6/0x290 kernel/locking/spinlock_debug.c:203
__raw_write_lock_bh include/linux/rwlock_api_smp.h:204 [inline]
_raw_write_lock_bh+0x3b/0x50 kernel/locking/spinlock.c:312
x25_insert_socket+0x21/0xe0 net/x25/af_x25.c:267
x25_bind+0x273/0x340 net/x25/af_x25.c:705
__sys_bind+0x23f/0x290 net/socket.c:1505
__do_sys_bind net/socket.c:1516 [inline]
__se_sys_bind net/socket.c:1514 [inline]
__x64_sys_bind+0x73/0xb0 net/socket.c:1514
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457e39
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:
00007fafccd0dc78 EFLAGS:
00000246 ORIG_RAX:
0000000000000031
RAX:
ffffffffffffffda RBX:
0000000000000003 RCX:
0000000000457e39
RDX:
0000000000000012 RSI:
0000000020000240 RDI:
0000000000000004
RBP:
000000000073bf00 R08:
0000000000000000 R09:
0000000000000000
R10:
0000000000000000 R11:
0000000000000246 R12:
00007fafccd0e6d4
R13:
00000000004bdf8b R14:
00000000004ce4b8 R15:
00000000ffffffff
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 8752 Comm: syz-executor4 Not tainted 5.0.0-rc4+ #51
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__x25_find_socket+0x78/0x120 net/x25/af_x25.c:328
Code: 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 a6 00 00 00 4d 8b 64 24 68 4d 85 e4 74 7f e8 03 97 3d fb 49 83 ec 68 74 74 e8 f8 96 3d fb <49> 8d bc 24 88 04 00 00 48 89 f8 48 c1 e8 03 0f b6 04 18 84 c0 74
RSP: 0018:
ffff8880639efc58 EFLAGS:
00000246
RAX:
0000000000040000 RBX:
dffffc0000000000 RCX:
ffffc9000e677000
RDX:
0000000000040000 RSI:
ffffffff863244b8 RDI:
ffff88806a764628
RBP:
ffff8880639efc80 R08:
ffff8880a80d05c0 R09:
fffffbfff1282775
R10:
fffffbfff1282774 R11:
ffffffff89413ba3 R12:
ffff88806a7645c0
R13:
0000000000000001 R14:
ffff88809f29ac00 R15:
0000000000000000
FS:
00007fe8d0c58700(0000) GS:
ffff8880ae900000(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
CR2:
0000001b32823000 CR3:
00000000672eb000 CR4:
00000000001406e0
DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
DR3:
0000000000000000 DR6:
00000000fffe0ff0 DR7:
0000000000000400
Call Trace:
x25_new_lci net/x25/af_x25.c:357 [inline]
x25_connect+0x374/0xdf0 net/x25/af_x25.c:786
__sys_connect+0x266/0x330 net/socket.c:1686
__do_sys_connect net/socket.c:1697 [inline]
__se_sys_connect net/socket.c:1694 [inline]
__x64_sys_connect+0x73/0xb0 net/socket.c:1694
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457e39
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:
00007fe8d0c57c78 EFLAGS:
00000246 ORIG_RAX:
000000000000002a
RAX:
ffffffffffffffda RBX:
0000000000000003 RCX:
0000000000457e39
RDX:
0000000000000012 RSI:
0000000020000200 RDI:
0000000000000004
RBP:
000000000073bf00 R08:
0000000000000000 R09:
0000000000000000
R10:
0000000000000000 R11:
0000000000000246 R12:
00007fe8d0c586d4
R13:
00000000004be378 R14:
00000000004ceb00 R15:
00000000ffffffff
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Andrew Hendry <andrew.hendry@gmail.com>
Cc: linux-x25@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jann Horn [Sat, 26 Jan 2019 00:54:33 +0000 (01:54 +0100)]
kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
commit
cfa39381173d5f969daf43582c95ad679189cbc9 upstream.
kvm_ioctl_create_device() does the following:
1. creates a device that holds a reference to the VM object (with a borrowed
reference, the VM's refcount has not been bumped yet)
2. initializes the device
3. transfers the reference to the device to the caller's file descriptor table
4. calls kvm_get_kvm() to turn the borrowed reference to the VM into a real
reference
The ownership transfer in step 3 must not happen before the reference to the VM
becomes a proper, non-borrowed reference, which only happens in step 4.
After step 3, an attacker can close the file descriptor and drop the borrowed
reference, which can cause the refcount of the kvm object to drop to zero.
This means that we need to grab a reference for the device before
anon_inode_getfd(), otherwise the VM can disappear from under us.
Fixes:
852b6d57dc7f ("kvm: add device control API")
Cc: stable@kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Wei Yongjun [Wed, 26 Dec 2018 11:28:24 +0000 (11:28 +0000)]
hwmon: (lm80) Fix missing unlock on error in set_fan_div()
commit
07bd14ccc3049f9c0147a91a4227a571f981601a upstream.
Add the missing unlock before return from function set_fan_div()
in the error handling case.
Fixes:
c9c63915519b ("hwmon: (lm80) fix a missing check of the status of SMBus read")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Lorenzo Bianconi [Wed, 6 Feb 2019 18:18:04 +0000 (19:18 +0100)]
net: ipv4: use a dedicated counter for icmp_v4 redirect packets
[ Upstream commit
c09551c6ff7fe16a79a42133bcecba5fc2fc3291 ]
According to the algorithm described in the comment block at the
beginning of ip_rt_send_redirect, the host should try to send
'ip_rt_redirect_number' ICMP redirect packets with an exponential
backoff and then stop sending them at all assuming that the destination
ignores redirects.
If the device has previously sent some ICMP error packets that are
rate-limited (e.g TTL expired) and continues to receive traffic,
the redirect packets will never be transmitted. This happens since
peer->rate_tokens will be typically greater than 'ip_rt_redirect_number'
and so it will never be reset even if the redirect silence timeout
(ip_rt_redirect_silence) has elapsed without receiving any packet
requiring redirects.
Fix it by using a dedicated counter for the number of ICMP redirect
packets that has been sent by the host
I have not been able to identify a given commit that introduced the
issue since ip_rt_send_redirect implements the same rate-limiting
algorithm from commit
1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jose Abreu [Mon, 18 Feb 2019 13:35:03 +0000 (14:35 +0100)]
net: stmmac: Fix a race in EEE enable callback
[ Upstream commit
8a7493e58ad688eb23b81e45461c5d314f4402f1 ]
We are saving the status of EEE even before we try to enable it. This
leads to a race with XMIT function that tries to arm EEE timer before we
set it up.
Fix this by only saving the EEE parameters after all operations are
performed with success.
Signed-off-by: Jose Abreu <joabreu@synopsys.com>
Fixes:
d765955d2ae0 ("stmmac: add the Energy Efficient Ethernet support")
Cc: Joao Pinto <jpinto@synopsys.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
Cc: Alexandre Torgue <alexandre.torgue@st.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Paolo Abeni [Thu, 7 Feb 2019 13:13:18 +0000 (14:13 +0100)]
vsock: cope with memory allocation failure at socket creation time
[ Upstream commit
225d9464268599a5b4d094d02ec17808e44c7553 ]
In the unlikely event that the kmalloc call in vmci_transport_socket_init()
fails, we end-up calling vmci_transport_destruct() with a NULL vmci_trans()
and oopsing.
This change addresses the above explicitly checking for zero vmci_trans()
at destruction time.
Reported-by: Xiumei Mu <xmu@redhat.com>
Fixes:
d021c344051a ("VSOCK: Introduce VM Sockets")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Eric Dumazet [Thu, 7 Feb 2019 20:27:38 +0000 (12:27 -0800)]
vxlan: test dev->flags & IFF_UP before calling netif_rx()
[ Upstream commit
4179cb5a4c924cd233eaadd081882425bc98f44e ]
netif_rx() must be called under a strict contract.
At device dismantle phase, core networking clears IFF_UP
and flush_all_backlogs() is called after rcu grace period
to make sure no incoming packet might be in a cpu backlog
and still referencing the device.
Most drivers call netif_rx() from their interrupt handler,
and since the interrupts are disabled at device dismantle,
netif_rx() does not have to check dev->flags & IFF_UP
Virtual drivers do not have this guarantee, and must
therefore make the check themselves.
Otherwise we risk use-after-free and/or crashes.
Note this patch also fixes a small issue that came
with commit
ce6502a8f957 ("vxlan: fix a use after free
in vxlan_encap_bypass"), since the dev->stats.rx_dropped
change was done on the wrong device.
Fixes:
d342894c5d2f ("vxlan: virtual extensible lan")
Fixes:
ce6502a8f957 ("vxlan: fix a use after free in vxlan_encap_bypass")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Petr Machata <petrm@mellanox.com>
Cc: Ido Schimmel <idosch@mellanox.com>
Cc: Roopa Prabhu <roopa@cumulusnetworks.com>
Cc: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Eric Dumazet [Fri, 15 Feb 2019 21:36:20 +0000 (13:36 -0800)]
tcp: clear icsk_backoff in tcp_write_queue_purge()
[ Upstream commit
04c03114be82194d4a4858d41dba8e286ad1787c ]
soukjin bae reported a crash in tcp_v4_err() handling
ICMP_DEST_UNREACH after tcp_write_queue_head(sk)
returned a NULL pointer.
Current logic should have prevented this :
if (seq != tp->snd_una || !icsk->icsk_retransmits ||
!icsk->icsk_backoff || fastopen)
break;
Problem is the write queue might have been purged
and icsk_backoff has not been cleared.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: soukjin bae <soukjin.bae@samsung.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Eric Dumazet [Fri, 15 Feb 2019 21:36:21 +0000 (13:36 -0800)]
tcp: tcp_v4_err() should be more careful
[ Upstream commit
2c4cc9712364c051b1de2d175d5fbea6be948ebf ]
ICMP handlers are not very often stressed, we should
make them more resilient to bugs that might surface in
the future.
If there is no packet in retransmit queue, we should
avoid a NULL deref.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: soukjin bae <soukjin.bae@samsung.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Kai-Heng Feng [Tue, 19 Feb 2019 15:45:29 +0000 (23:45 +0800)]
sky2: Increase D3 delay again
[ Upstream commit
1765f5dcd00963e33f1b8a4e0f34061fbc0e2f7f ]
Another platform requires even longer delay to make the device work
correctly after S3.
So increase the delay to 300ms.
BugLink: https://bugs.launchpad.net/bugs/1798921
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>