1. 15 Apr, 2017 9 commits
    • Linus Torvalds's avatar
      Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · d5ff0814
      Linus Torvalds authored
      Pull nvdimm fixes from Dan Williams:
       "A small crop of lockdep, sleeping while atomic, and other fixes /
        band-aids in advance of the full-blown reworks targeting the next
        merge window. The largest change here is "libnvdimm: fix blk free
        space accounting" which deletes a pile of buggy code that better
        testing would have caught before merging. The next change that is
        borderline too big for a late rc is switching the device-dax locking
        from rcu to srcu, I couldn't think of a smaller way to make that fix.
      
        The __copy_user_nocache fix will have a full replacement in 4.12 to
        move those pmem special case considerations into the pmem driver. The
        "libnvdimm: band aid btt vs clear poison locking" commit admits that
        our error clearing support for btt went in broken, so we just disable
        it in 4.11 and -stable. A replacement / full fix is in the pipeline
        for 4.12
      
        Some of these would have been caught earlier had DEBUG_ATOMIC_SLEEP
        been enabled on my development station. I wonder if we should have:
      
            config DEBUG_ATOMIC_SLEEP
              default PROVE_LOCKING
      
        ...since I mistakenly thought I got both with PROVE_LOCKING=y.
      
        These have received a build success notification from the 0day robot,
        and some have appeared in a -next release with no reported issues"
      
      * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
        x86, pmem: fix broken __copy_user_nocache cache-bypass assumptions
        device-dax: switch to srcu, fix rcu_read_lock() vs pte allocation
        libnvdimm: band aid btt vs clear poison locking
        libnvdimm: fix reconfig_mutex, mmap_sem, and jbd2_handle lockdep splat
        libnvdimm: fix blk free space accounting
        acpi, nfit, libnvdimm: fix interleave set cookie calculation (64-bit comparison)
      d5ff0814
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 403a39f8
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "This is seven small fixes which are all for user visible issues that
        fortunately only occur in rare circumstances.
      
        The most serious is the sr one in which QEMU can cause us to read
        beyond the end of a buffer (I don't think it's exploitable, but just
        in case).
      
        The next is the sd capacity fix which means all non 512 byte sector
        drives greater than 2TB fail to be correctly sized.
      
        The rest are either in new drivers (qedf) or on error legs"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: ipr: do not set DID_PASSTHROUGH on CHECK CONDITION
        scsi: aacraid: fix PCI error recovery path
        scsi: sd: Fix capacity calculation with 32-bit sector_t
        scsi: qla2xxx: Add fix to read correct register value for ISP82xx.
        scsi: qedf: Fix crash due to unsolicited FIP VLAN response.
        scsi: sr: Sanity check returned mode data
        scsi: sd: Consider max_xfer_blocks if opt_xfer_blocks is unusable
      403a39f8
    • Linus Torvalds's avatar
      Merge branch 'parisc-4.11-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux · be84a46c
      Linus Torvalds authored
      Pull parisc fix from Helge Deller:
       "Mikulas Patocka fixed a few bugs in our new pa_memcpy() assembler
        function, e.g. one bug made the kernel unbootable if source and
        destination address are the same"
      
      * 'parisc-4.11-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
        parisc: fix bugs in pa_memcpy
      be84a46c
    • Martin Brandenburg's avatar
      orangefs: free superblock when mount fails · 1ec1688c
      Martin Brandenburg authored
      Otherwise lockdep says:
      
      [ 1337.483798] ================================================
      [ 1337.483999] [ BUG: lock held when returning to user space! ]
      [ 1337.484252] 4.11.0-rc6 #19 Not tainted
      [ 1337.484423] ------------------------------------------------
      [ 1337.484626] mount/14766 is leaving the kernel with locks still held!
      [ 1337.484841] 1 lock held by mount/14766:
      [ 1337.485017]  #0:  (&type->s_umount_key#33/1){+.+.+.}, at: [<ffffffff8124171f>] sget_userns+0x2af/0x520
      
      Caught by xfstests generic/413 which tried to mount with the unsupported
      mount option dax.  Then xfstests generic/422 ran sync which deadlocks.
      Signed-off-by: default avatarMartin Brandenburg <martin@omnibond.com>
      Acked-by: default avatarMike Marshall <hubcap@omnibond.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1ec1688c
    • Linus Torvalds's avatar
      vfs: don't do RCU lookup of empty pathnames · c0eb027e
      Linus Torvalds authored
      Normal pathname lookup doesn't allow empty pathnames, but using
      AT_EMPTY_PATH (with name_to_handle_at() or fstatat(), for example) you
      can trigger an empty pathname lookup.
      
      And not only is the RCU lookup in that case entirely unnecessary
      (because we'll obviously immediately finalize the end result), it is
      actively wrong.
      
      Why? An empth path is a special case that will return the original
      'dirfd' dentry - and that dentry may not actually be RCU-free'd,
      resulting in a potential use-after-free if we were to initialize the
      path lazily under the RCU read lock and depend on complete_walk()
      finalizing the dentry.
      
      Found by syzkaller and KASAN.
      Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Reported-by: default avatarVegard Nossum <vegard.nossum@gmail.com>
      Acked-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c0eb027e
    • Mikulas Patocka's avatar
      parisc: fix bugs in pa_memcpy · 409c1b25
      Mikulas Patocka authored
      The patch 554bfece ("parisc: Fix access
      fault handling in pa_memcpy()") reimplements the pa_memcpy function.
      Unfortunatelly, it makes the kernel unbootable. The crash happens in the
      function ide_complete_cmd where memcpy is called with the same source
      and destination address.
      
      This patch fixes a few bugs in pa_memcpy:
      
      * When jumping to .Lcopy_loop_16 for the first time, don't skip the
        instruction "ldi 31,t0" (this bug made the kernel unbootable)
      * Use the COND macro when comparing length, so that the comparison is
        64-bit (a theoretical issue, in case the length is greater than
        0xffffffff)
      * Don't use the COND macro after the "extru" instruction (the PA-RISC
        specification says that the upper 32-bits of extru result are undefined,
        although they are set to zero in practice)
      * Fix exception addresses in .Lcopy16_fault and .Lcopy8_fault
      * Rename .Lcopy_loop_4 to .Lcopy_loop_8 (so that it is consistent with
        .Lcopy8_fault)
      
      Cc: <stable@vger.kernel.org> # v4.9+
      Fixes: 554bfece ("parisc: Fix access fault handling in pa_memcpy()")
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      409c1b25
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 1bf4b126
      Linus Torvalds authored
      Pull input fixes from Dmitry Torokhov:
       "Just a small update to xpad driver to recognize yet another gamepad,
        and another change making sure userio.h is exported"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: xpad - add support for Razer Wildcat gamepad
        uapi: add missing install of userio.h
      1bf4b126
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 7e703ecc
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "Things seem to be settling down as far as networking is concerned,
        let's hope this trend continues...
      
         1) Add iov_iter_revert() and use it to fix the behavior of
            skb_copy_datagram_msg() et al., from Al Viro.
      
         2) Fix the protocol used in the synthetic SKB we cons up for the
            purposes of doing a simulated route lookup for RTM_GETROUTE
            requests. From Florian Larysch.
      
         3) Don't add noop_qdisc to the per-device qdisc hashes, from Cong
            Wang.
      
         4) Don't call netdev_change_features with the team lock held, from
            Xin Long.
      
         5) Revert TCP F-RTO extension to catch more spurious timeouts because
            it interacts very badly with some middle-boxes. From Yuchung
            Cheng.
      
         6) Fix the loss of error values in l2tp {s,g}etsockopt calls, from
            Guillaume Nault.
      
         7) ctnetlink uses bit positions where it should be using bit masks,
            fix from Liping Zhang.
      
         8) Missing RCU locking in netfilter helper code, from Gao Feng.
      
         9) Avoid double frees and use-after-frees in tcp_disconnect(), from
            Eric Dumazet.
      
        10) Don't do a changelink before we register the netdevice in
            bridging, from Ido Schimmel.
      
        11) Lock the ipv6 device address list properly, from Rabin Vincent"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (29 commits)
        netfilter: ipt_CLUSTERIP: Fix wrong conntrack netns refcnt usage
        netfilter: nft_hash: do not dump the auto generated seed
        drivers: net: usb: qmi_wwan: add QMI_QUIRK_SET_DTR for Telit PID 0x1201
        ipv6: Fix idev->addr_list corruption
        net: xdp: don't export dev_change_xdp_fd()
        bridge: netlink: register netdevice before executing changelink
        bridge: implement missing ndo_uninit()
        bpf: reference may_access_skb() from __bpf_prog_run()
        tcp: clear saved_syn in tcp_disconnect()
        netfilter: nf_ct_expect: use proper RCU list traversal/update APIs
        netfilter: ctnetlink: skip dumping expect when nfct_help(ct) is NULL
        netfilter: make it safer during the inet6_dev->addr_list traversal
        netfilter: ctnetlink: make it safer when checking the ct helper name
        netfilter: helper: Add the rcu lock when call __nf_conntrack_helper_find
        netfilter: ctnetlink: using bit to represent the ct event
        netfilter: xt_TCPMSS: add more sanity tests on tcph->doff
        net: tcp: Increase TCP_MIB_OUTRSTS even though fail to alloc skb
        l2tp: don't mask errors in pppol2tp_getsockopt()
        l2tp: don't mask errors in pppol2tp_setsockopt()
        tcp: restrict F-RTO to work-around broken middle-boxes
        ...
      7e703ecc
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 91174391
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
       "A set of small fixes for x86:
      
         - fix locking in RDT to prevent memory leaks and freeing in use
           memory
      
         - prevent setting invalid values for vdso32_enabled which cause
           inconsistencies for user space resulting in application crashes.
      
         - plug a race in the vdso32 code between fork and sysctl which causes
           inconsistencies for user space resulting in application crashes.
      
         - make MPX signal delivery work in compat mode
      
         - make the dmesg output of traps and faults readable again"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/intel_rdt: Fix locking in rdtgroup_schemata_write()
        x86/debug: Fix the printk() debug output of signal_fault(), do_trap() and do_general_protection()
        x86/vdso: Plug race between mapping and ELF header setup
        x86/vdso: Ensure vdso32_enabled gets set to valid values only
        x86/signals: Fix lower/upper bound reporting in compat siginfo
      91174391
  2. 14 Apr, 2017 29 commits
  3. 13 Apr, 2017 2 commits