1. 06 Apr, 2016 2 commits
    • Colin Ian King's avatar
      ASN.1: fix open failure check on headername · 952cca6a
      Colin Ian King authored
      The check for a failed open on headername is incorrectly checking
      on the out FILE pointer rather than the hdr. Fix this.
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      952cca6a
    • Jerome Marchand's avatar
      assoc_array: don't call compare_object() on a node · 8d4a2ec1
      Jerome Marchand authored
      Changes since V1: fixed the description and added KASan warning.
      
      In assoc_array_insert_into_terminal_node(), we call the
      compare_object() method on all non-empty slots, even when they're
      not leaves, passing a pointer to an unexpected structure to
      compare_object(). Currently it causes an out-of-bound read access
      in keyring_compare_object detected by KASan (see below). The issue
      is easily reproduced with keyutils testsuite.
      Only call compare_object() when the slot is a leave.
      
      KASan warning:
      ==================================================================
      BUG: KASAN: slab-out-of-bounds in keyring_compare_object+0x213/0x240 at addr ffff880060a6f838
      Read of size 8 by task keyctl/1655
      =============================================================================
      BUG kmalloc-192 (Not tainted): kasan: bad access detected
      -----------------------------------------------------------------------------
      
      Disabling lock debugging due to kernel taint
      INFO: Allocated in assoc_array_insert+0xfd0/0x3a60 age=69 cpu=1 pid=1647
      	___slab_alloc+0x563/0x5c0
      	__slab_alloc+0x51/0x90
      	kmem_cache_alloc_trace+0x263/0x300
      	assoc_array_insert+0xfd0/0x3a60
      	__key_link_begin+0xfc/0x270
      	key_create_or_update+0x459/0xaf0
      	SyS_add_key+0x1ba/0x350
      	entry_SYSCALL_64_fastpath+0x12/0x76
      INFO: Slab 0xffffea0001829b80 objects=16 used=8 fp=0xffff880060a6f550 flags=0x3fff8000004080
      INFO: Object 0xffff880060a6f740 @offset=5952 fp=0xffff880060a6e5d1
      
      Bytes b4 ffff880060a6f730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      Object ffff880060a6f740: d1 e5 a6 60 00 88 ff ff 0e 00 00 00 00 00 00 00  ...`............
      Object ffff880060a6f750: 02 cf 8e 60 00 88 ff ff 02 c0 8e 60 00 88 ff ff  ...`.......`....
      Object ffff880060a6f760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      Object ffff880060a6f770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      Object ffff880060a6f780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      Object ffff880060a6f790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      Object ffff880060a6f7a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      Object ffff880060a6f7b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      Object ffff880060a6f7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      Object ffff880060a6f7d0: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      Object ffff880060a6f7e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      Object ffff880060a6f7f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      CPU: 0 PID: 1655 Comm: keyctl Tainted: G    B           4.5.0-rc4-kasan+ #291
      Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
       0000000000000000 000000001b2800b4 ffff880060a179e0 ffffffff81b60491
       ffff88006c802900 ffff880060a6f740 ffff880060a17a10 ffffffff815e2969
       ffff88006c802900 ffffea0001829b80 ffff880060a6f740 ffff880060a6e650
      Call Trace:
       [<ffffffff81b60491>] dump_stack+0x85/0xc4
       [<ffffffff815e2969>] print_trailer+0xf9/0x150
       [<ffffffff815e9454>] object_err+0x34/0x40
       [<ffffffff815ebe50>] kasan_report_error+0x230/0x550
       [<ffffffff819949be>] ? keyring_get_key_chunk+0x13e/0x210
       [<ffffffff815ec62d>] __asan_report_load_n_noabort+0x5d/0x70
       [<ffffffff81994cc3>] ? keyring_compare_object+0x213/0x240
       [<ffffffff81994cc3>] keyring_compare_object+0x213/0x240
       [<ffffffff81bc238c>] assoc_array_insert+0x86c/0x3a60
       [<ffffffff81bc1b20>] ? assoc_array_cancel_edit+0x70/0x70
       [<ffffffff8199797d>] ? __key_link_begin+0x20d/0x270
       [<ffffffff8199786c>] __key_link_begin+0xfc/0x270
       [<ffffffff81993389>] key_create_or_update+0x459/0xaf0
       [<ffffffff8128ce0d>] ? trace_hardirqs_on+0xd/0x10
       [<ffffffff81992f30>] ? key_type_lookup+0xc0/0xc0
       [<ffffffff8199e19d>] ? lookup_user_key+0x13d/0xcd0
       [<ffffffff81534763>] ? memdup_user+0x53/0x80
       [<ffffffff819983ea>] SyS_add_key+0x1ba/0x350
       [<ffffffff81998230>] ? key_get_type_from_user.constprop.6+0xa0/0xa0
       [<ffffffff828bcf4e>] ? retint_user+0x18/0x23
       [<ffffffff8128cc7e>] ? trace_hardirqs_on_caller+0x3fe/0x580
       [<ffffffff81004017>] ? trace_hardirqs_on_thunk+0x17/0x19
       [<ffffffff828bc432>] entry_SYSCALL_64_fastpath+0x12/0x76
      Memory state around the buggy address:
       ffff880060a6f700: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
       ffff880060a6f780: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
      >ffff880060a6f800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                              ^
       ffff880060a6f880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
       ffff880060a6f900: fc fc fc fc fc fc 00 00 00 00 00 00 00 00 00 00
      ==================================================================
      Signed-off-by: default avatarJerome Marchand <jmarchan@redhat.com>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      cc: stable@vger.kernel.org
      8d4a2ec1
  2. 05 Apr, 2016 7 commits
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 541d8f4d
      Linus Torvalds authored
      Pull KVM fixes from Paolo Bonzini:
       "Miscellaneous bugfixes.
      
        The ARM and s390 fixes are for new regressions from the merge window,
        others are usual stable material"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        compiler-gcc: disable -ftracer for __noclone functions
        kvm: x86: make lapic hrtimer pinned
        s390/mm/kvm: fix mis-merge in gmap handling
        kvm: set page dirty only if page has been writable
        KVM: x86: reduce default value of halt_poll_ns parameter
        KVM: Hyper-V: do not do hypercall userspace exits if SynIC is disabled
        KVM: x86: Inject pending interrupt even if pending nmi exist
        arm64: KVM: Register CPU notifiers when the kernel runs at HYP
        arm64: kvm: 4.6-rc1: Fix VTCR_EL2 VS setting
      541d8f4d
    • Linus Torvalds's avatar
      Merge tag 'spi-fix-v4.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · 5003bc6c
      Linus Torvalds authored
      Pull spi fixes from Mark Brown:
       "A couple of driver specific fixes here that came in since the merge
        window plus one core fix for locking in cases where a client driver
        grabs a lock on the whole bus for an extended series of operations
        that was introduced by the changes to support accelerated flash
        operations"
      
      * tag 'spi-fix-v4.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
        spi: rockchip: fix probe deferral handling
        spi: omap2-mcspi: fix dma transfer for vmalloced buffer
        spi: fix possible deadlock between internal bus locks and bus_lock_flag
        spi: imx: Fix possible NULL pointer deref
        spi: imx: only do necessary changes to ECSPIx_CONFIGREG
        spi: rockchip: Spelling s/divsor/divisor/
      5003bc6c
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-v4.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl · 1b5caa3e
      Linus Torvalds authored
      Pull pin control fixes from Linus Walleij:
       "Here is a set of pin control fixes for the v4.6 series.
      
        A bit bigger than what I hoped for, but all fixes are confined to
        drivers, a few of them also targeted to stable.
      
        Summary:
      
         - On Super-H PFC (Renesas) controllers: only use dummies on legacy
           systems.  This fixes a serious ethernet regression on a Renesas
           board.
         - Pistachio: Fix errors in the pin table.
         - Allwinner SunXi: fix the external interrupts to work.
         - Intel: fix so the high level interrupts start working, and fix a
           spurious interrupt issue.
         - Qualcomm ipq4019: fix the number of GPIOs provided (bump to 100),
           correct register offsets and handle GPIO mode properly.
         - Revert the revert on the revert so that Xway has a .to_irq()
           callback again.
         - Minor fixes to errorpaths and debug info.
         - A MAINTAINERS update"
      
      * tag 'pinctrl-v4.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        Revert "Revert "pinctrl: lantiq: Implement gpio_chip.to_irq""
        pinctrl: qcom: ipq4019: fix register offsets
        pinctrl: qcom: ipq4019: fix the function enum for gpio mode
        pinctrl: qcom: ipq4019: set ngpios to correct value
        pinctrl: nomadik: fix pull debug print inversion
        MAINTAINERS: pinctrl: samsung: Add two new maintainers
        pinctrl: intel: implement gpio_irq_enable
        pinctrl: intel: make the high level interrupt working
        pinctrl: freescale: imx: fix bogus check of of_iomap() return value
        pinctrl: sunxi: Fix A33 external interrupts not working
        pinctrl: pistachio: fix mfio84-89 function description and pinmux.
        pinctrl: sh-pfc: only use dummy states for non-DT platforms
      1b5caa3e
    • Linus Torvalds's avatar
      Merge tag 'media/v4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · 62d2def9
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
       "Some bug fixes on au0828 and snd-usb-audio:
      
         - the au0828+snd-usb-audio MC patch broke several things and produced
           some race conditions.  Better to revert the patches, and re-work on
           them for a next version
      
         - fix a regression at tuner disable links logic
      
         - properly handle dev_state as a bitmask"
      
      * tag 'media/v4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
        [media] Revert "[media] media: au0828 change to use Managed Media Controller API"
        [media] Revert "[media] sound/usb: Use Media Controller API to share media resources"
        [media] au0828: Fix dev_state handling
        [media] au0828: fix au0828_v4l2_close() dev_state race condition
        [media] media: au0828 fix to clear enable/disable/change source handlers
        [media] v4l2-mc: cleanup a warning
        [media] au0828: disable tuner links and cache tuner/decoder
      62d2def9
    • Paolo Bonzini's avatar
      compiler-gcc: disable -ftracer for __noclone functions · 95272c29
      Paolo Bonzini authored
      -ftracer can duplicate asm blocks causing compilation to fail in
      noclone functions.  For example, KVM declares a global variable
      in an asm like
      
          asm("2: ... \n
               .pushsection data \n
               .global vmx_return \n
               vmx_return: .long 2b");
      
      and -ftracer causes a double declaration.
      
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Michal Marek <mmarek@suse.cz>
      Cc: stable@vger.kernel.org
      Cc: kvm@vger.kernel.org
      Reported-by: default avatarLinda Walsh <lkml@tlinx.org>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      95272c29
    • Luiz Capitulino's avatar
      kvm: x86: make lapic hrtimer pinned · 61abdbe0
      Luiz Capitulino authored
      When a vCPU runs on a nohz_full core, the hrtimer used by
      the lapic emulation code can be migrated to another core.
      When this happens, it's possible to observe milisecond
      latency when delivering timer IRQs to KVM guests.
      
      The huge latency is mainly due to the fact that
      apic_timer_fn() expects to run during a kvm exit. It
      sets KVM_REQ_PENDING_TIMER and let it be handled on kvm
      entry. However, if the timer fires on a different core,
      we have to wait until the next kvm exit for the guest
      to see KVM_REQ_PENDING_TIMER set.
      
      This problem became visible after commit 9642d18e. This
      commit changed the timer migration code to always attempt
      to migrate timers away from nohz_full cores. While it's
      discussable if this is correct/desirable (I don't think
      it is), it's clear that the lapic emulation code has
      a requirement on firing the hrtimer in the same core
      where it was started. This is achieved by making the
      hrtimer pinned.
      
      Lastly, note that KVM has code to migrate timers when a
      vCPU is scheduled to run in different core. However, this
      forced migration may fail. When this happens, we can have
      the same problem. If we want 100% correctness, we'll have
      to modify apic_timer_fn() to cause a kvm exit when it runs
      on a different core than the vCPU. Not sure if this is
      possible.
      
      Here's a reproducer for the issue being fixed:
      
       1. Set all cores but core0 to be nohz_full cores
       2. Start a guest with a single vCPU
       3. Trace apic_timer_fn() and kvm_inject_apic_timer_irqs()
      
      You'll see that apic_timer_fn() will run in core0 while
      kvm_inject_apic_timer_irqs() runs in a different core. If
      you get both on core0, try running a program that takes 100%
      of the CPU and pin it to core0 to force the vCPU out.
      Signed-off-by: default avatarLuiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      61abdbe0
    • Christian Borntraeger's avatar
      s390/mm/kvm: fix mis-merge in gmap handling · 9c650d09
      Christian Borntraeger authored
      commit 1e133ab2 ("s390/mm: split arch/s390/mm/pgtable.c") dropped
      some changes from commit a3a92c31 ("KVM: s390: fix mismatch
      between user and in-kernel guest limit") - this breaks KVM for some
      memory sizes (kvm-s390: failed to commit memory region) like
      exactly 2GB.
      
      Cc: Dominik Dingel <dingel@linux.vnet.ibm.com>
      Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
      Acked-by: default avatarHeiko Carstens <heiko.carstens@de.ibm.com>
      Signed-off-by: default avatarChristian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      9c650d09
  3. 04 Apr, 2016 17 commits
  4. 03 Apr, 2016 14 commits