1. 05 Mar, 2019 10 commits
    • Linus Torvalds's avatar
      Merge tag 'leds-for-5.1-rc1' of... · cd2a3bf0
      Linus Torvalds authored
      Merge tag 'leds-for-5.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds
      
      Pull LED updates from Jacek Anaszewski:
      
       - finalize previously announced support for initialization of pattern
         triggers from Device Tree
      
       - fix for null deref on firmware load failure in leds-lp55xx-common.c
      
      * tag 'leds-for-5.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds:
        leds: lp55xx: fix null deref on firmware load failure
        leds: trigger: timer: Add initialization from Device Tree
        leds: trigger: oneshot: Add initialization from Device Tree
        leds: trigger: pattern: Add pattern initialization from Device Tree
        leds: Add helper for getting default pattern from Device Tree
        dt-bindings: leds: Add pattern initialization from Device Tree
      cd2a3bf0
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging · 7629bac6
      Linus Torvalds authored
      Pull hwmon updates from Guenter Roeck:
      
       - Add support for LM96000, DPS-650AB to existing drivers
      
       - Use permission specific SENSOR[_DEVICE]_ATTR variants in several
         drivers
      
       - Replace S_<PERMS> with octal values in several drivers
      
       - Update some license headers
      
       - Various minor fixes and improvements in several drivers
      
      * tag 'hwmon-for-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (89 commits)
        dt-bindings: hwmon: Add missing documentation for lm75
        hwmon: (ad7418) Add device tree probing
        hwmon: (ad741x) Add DT bindings for Analog Devices AD741x
        hwmon: (ntc_thermistor) Convert to new hwmon API
        hwmon: (pwm-fan) Add optional regulator support
        dt-bindings: hwmon: Add optional regulator support to pwm-fan
        hwmon: (f71882fg) Mark expected switch fall-through
        hwmon: (ad7418) Catch I2C errors
        hwmon: (lm85) add support for LM96000 high frequencies
        hwmon: (lm85) support the LM96000
        dt-bindings: Add LM96000 as a trivial device
        hwmon: (lm85) remove freq_map size hardcodes
        hwmon: (occ) Fix license headers
        hwmon: (via-cputemp) Use permission specific SENSOR[_DEVICE]_ATTR variants
        hwmon: (vexpress-hwmon) Use permission specific SENSOR[_DEVICE]_ATTR variants
        hwmon: (tmp421) Replace S_<PERMS> with octal values
        hwmon: (tmp103) Use permission specific SENSOR[_DEVICE]_ATTR variants
        hwmon: (tmp102) Replace S_<PERMS> with octal values
        hwmon: (tc74) Use permission specific SENSOR[_DEVICE]_ATTR variants
        hwmon: (tc654) Use permission specific SENSOR[_DEVICE]_ATTR variants
        ...
      7629bac6
    • Linus Torvalds's avatar
      Merge tag 'spi-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · dcc75dde
      Linus Torvalds authored
      Pull spi updates from Mark Brown:
       "A fairly quiet release for SPI, the biggest thing is the conversion to
        use GPIO descriptors which is now 90% done but still needs some
        stragglers converting.
      
        Summary:
      
         - Support for inter-word delays
      
         - Conversion of the core and most drivers to use GPIO descriptors for
           GPIO controlled chip selects
      
         - New drivers for NXP FlexSPI and QuadSPI, SiFive and Spreadtrum"
      
      * tag 'spi-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (104 commits)
        spi: sh-msiof: Restrict bits per word to 8/16/24/32 on R-Car Gen2/3
        spi: sifive: Remove redundant dev_err call in sifive_spi_probe()
        spi: sifive: Remove spi_master_put in sifive_spi_remove()
        spi: spi-gpio: fix SPI_CS_HIGH capability
        spi: pxa2xx: Setup maximum supported DMA transfer length
        spi: sifive: Add driver for the SiFive SPI controller
        spi: sifive: Add DT documentation for SiFive SPI controller
        spi: sprd: Add a prefix for SPI DMA channel macros
        spi: sprd: spi: sprd: Add DMA mode support
        dt-bindings: spi: Add the DMA properties for the SPI dma mode
        spi: sprd: Add the SPI irq function for the SPI DMA mode
        dt-bindings: spi: imx: Add an entry for the i.MX8QM compatible
        spi: use gpio[d]_set_value_cansleep for setting chipselect GPIO
        spi: gpio: Advertise support for SPI_CS_HIGH
        spi: sh-msiof: Replace spi_master by spi_controller
        spi: sh-hspi: Replace spi_master by spi_controller
        spi: rspi: Replace spi_master by spi_controller
        spi: atmel-quadspi: add support for sam9x60 qspi controller
        dt-bindings: spi: atmel-quadspi: QuadSPI driver for Microchip SAM9X60
        spi: atmel-quadspi: add support for named peripheral clock
        ...
      dcc75dde
    • Linus Torvalds's avatar
      Merge tag 'regulator-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator · 32c0ac3a
      Linus Torvalds authored
      Pull regulator updates from Mark Brown:
       "The bulk of the standout changes in this release are cleanups, with
        the core work being a combination of factoring out common code into
        helpers and the completion of the conversion of the core to use GPIO
        descriptors.
      
        Summary:
      
         - Addition of helper functions for current limits and conversion of
           drivers to use them by Axel Lin.
      
         - Lots and lots of cleanups from Axel Lin.
      
         - Conversion of the core to use GPIO descriptors rather than numbers
           by Linus Walleij.
      
         - New drivers for Maxim MAX77650 and ROHM BD70528"
      
      * tag 'regulator-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (131 commits)
        regulator: mc13xxx: Constify regulator_ops variables
        regulator: palmas: Constify palmas_smps_ramp_delay array
        regulator: wm831x-dcdc: Convert to use regulator_set/get_current_limit_regmap
        regulator: pv88090: Convert to use regulator_set/get_current_limit_regmap
        regulator: pv88080: Convert to use regulator_set/get_current_limit_regmap
        regulator: pv88060: Convert to use regulator_set/get_current_limit_regmap
        regulator: max77650: Convert to use regulator_set/get_current_limit_regmap
        regulator: lp873x: Convert to use regulator_set/get_current_limit_regmap
        regulator: lp872x: Convert to use regulator_set/get_current_limit_regmap
        regulator: da9210: Convert to use regulator_set/get_current_limit_regmap
        regulator: da9055: Convert to use regulator_set/get_current_limit_regmap
        regulator: core: Add set/get_current_limit helpers for regmap users
        regulator: Fix comment for csel_reg and csel_mask
        regulator: stm32-vrefbuf: add power management support
        regulator: 88pm8607: Remove unused fields from struct pm8607_regulator_info
        regulator: 88pm8607: Simplify pm8607_list_voltage implementation
        regulator: cpcap: Constify omap4_regulators and xoom_regulators
        regulator: cpcap: Remove unused vsel_shift from struct cpcap_regulator
        dt-bindings: regulator: tps65218: rectify units of LS3
        dt-bindings: regulator: add LS2 load switch documentation
        ...
      32c0ac3a
    • Linus Torvalds's avatar
      Merge tag 'regmap-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap · e48b044e
      Linus Torvalds authored
      Pull regmap updates from Mark Brown:
       "There are only two changes here:
      
         - fix for conflicting attributes on the rbtree node structure
      
         - implementation of main status register support in the interrupt
           code which supports chips that have a register to cut down on the
           number of per-interrupt status registers that need to be checked
           when handling interrupts"
      
      * tag 'regmap-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
        regmap: Remove attribute packed from struct 'regcache_rbtree_node'
        regmap: regmap-irq: Add main status register support
      e48b044e
    • Linus Torvalds's avatar
      Merge tag 'mmc-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · 42eaf185
      Linus Torvalds authored
      Pull MMC updates from Ulf Hansson:
       "MMC core:
         - Fixup max_discard/trim calculations
         - Announce SD specs greater than 4.0
         - Add discard support for SD cards
         - Don't do retries for CMD6 (SWITCH command)
         - Various cleanups and re-structuring
      
        MMC host:
         - cqhci:
            * Add maintainers for eMMC CQHCI driver
         - sdhci:
            * Consolidate WP GPIO code
            * Add ADMA3 DMA support for V4 enabled host
            * Fixup card detect support in pci-o2micro driver
            * Add support for CMDQ and SDMMC pads auto-calibration in tegra
              driver
            * Add DCMD support and CMDQ support, support for i.MX6ULL variant,
              fixup HS400 timing issue and add HS400_ES support for i.MX8QXP
              to esdhc-imx driver
            * Avoid CRC errors by adjusting settings to speed mode and fixup
              card initialization for high speed mode in renesas_sdhi
            * Fixup timeout settings for omap
            * Enable 8 bits bus-width support in atmel-mci
            * Convert some legacy code in jz4740 driver to use modern APIs
            * Send a CMD12 to clear DPSM at errors for STM32 sdmmc mmci
              driver"
      
      * tag 'mmc-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (69 commits)
        mmc:fix a bug when max_discard is 0
        mmc: core: Add a debug print when the card may have been replaced
        mmc: core: Add sd discard timeout
        mmc: core: Add discard support to sd
        mmc: sdhci-esdhc-imx: clear the HALT bit when enable CQE
        mmc: core: do not retry CMD6 in __mmc_switch()
        mmc: core: Convert mmc_align_data_size() into an SDIO specific function
        mmc: core: Move mmc_of_parse_voltage() to host.c
        mmc: core: Convert mmc_regulator_get_ocrmask() to static
        mmc: core: Move regulator helpers to separate file
        mmc: of_mmc_spi: Convert to mmc_of_parse_voltage()
        mmc: core: Drop retries as in-parameter to mmc_wait_for_app_cmd()
        mmc: core: Convert mmc_wait_for_app_cmd() to static
        mmc: renesas_sdhi: Change HW adjustment register according to speed mode
        mmc: mmci: Send a CMD12 to clear the DPSM at errors
        mmc: sdhci-xenon: Fixup already marked switch fall-through
        mmc: sdhci-tegra: drop ->get_ro() implementation
        mmc: sdhci-omap: drop ->get_ro() implementation
        mmc: sdhci: use WP GPIO in sdhci_check_ro()
        mmc: wmt-sdmmc: Drop unused include
        ...
      42eaf185
    • Linus Torvalds's avatar
      Merge tag 'i3c/for-5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux · c8d950ab
      Linus Torvalds authored
      Pull i3c updates from Boris Brezillon:
      
       - Add a /* fall-through */ comment in the dw-i3c-master driver
      
       - Update the I3C entries in MAINTAINERS to add an IRC chan
      
      * tag 'i3c/for-5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux:
        i3c: master: dw-i3c-master: mark expected switch fall-through
        MAINTAINERS: Add an IRC channel for the I3C subsystem
      c8d950ab
    • Linus Torvalds's avatar
      Merge tag 'mtd/for-5.1' of git://git.infradead.org/linux-mtd · 811c16a2
      Linus Torvalds authored
      Pull MTD updates from Boris Brezillon:
       "Core MTD changes:
         - Use struct_size() where appropriate
         - mtd_{read,write}() as wrappers around mtd_{read,write}_oob()
         - Fix misuse of PTR_ERR() in docg3
         - Coding style improvements in mtdcore.c
      
        SPI NOR changes:
          Core changes:
           - Add support of octal mode I/O transfer
           - Add a bunch of SPI NOR entries to the flash_info table
      
          SPI NOR controller driver changes:
           - cadence-quadspi:
              * Add support for Octal SPI controller
              * write upto 8-bytes data in STIG mode
           - mtk-quadspi:
              * rename config to a common one
              * add SNOR_HWCAPS_READ to spi_nor_hwcaps mask
           - Add Tudor as SPI-NOR co-maintainer
      
        NAND changes:
          NAND core changes:
           - Fourth batch of fixes/cleanup to the raw NAND core impacting
             various controller drivers (Sunxi, Marvell, MTK, TMIO, OMAP2).
           - Check the return code of nand_reset() and nand_readid_op().
           - Remove ->legacy.erase and single_erase().
           - Simplify the locking.
           - Several implicit fall through annotations.
      
          Raw NAND controllers drivers changes:
           - Fix various possible object reference leaks (MTK, JZ4780, Atmel)
           - ST:
              * Add support for STM32 FMC2 NAND flash controller
           - Meson:
              * Add support for Amlogic NAND flash controller
           - Denali:
              * Several cleanup patches
           - Sunxi:
              * Several cleanup patches
           - FSMC:
              * Disable NAND on remove()
              * Reset NAND timings on resume()
      
          SPI-NAND drivers changes:
           - Toshiba:
              * Add support for all Toshiba products.
           - Macronix:
              * Fix ECC status read.
           - Gigadevice:
              * Add support for GD5F1GQ4UExxG"
      
      * tag 'mtd/for-5.1' of git://git.infradead.org/linux-mtd: (64 commits)
        mtd: spi-nor: Fix wrong abbreviation HWCPAS
        mtd: spi-nor: cadence-quadspi: fix spelling mistake: "Couldnt't" -> "Couldn't"
        mtd: spi-nor: Add support for en25qh64
        mtd: spi-nor: Add support for MX25V8035F
        mtd: spi-nor: Add support for EN25Q80A
        mtd: spi-nor: cadence-quadspi: Add support for Octal SPI controller
        dt-bindings: cadence-quadspi: Add new compatible for AM654 SoC
        mtd: spi-nor: split s25fl128s into s25fl128s0 and s25fl128s1
        mtd: spi-nor: cadence-quadspi: write upto 8-bytes data in STIG mode
        mtd: spi-nor: Add support for mx25u3235f
        mtd: rawnand: denali_dt: remove single anonymous clock support
        mtd: rawnand: mtk: fix possible object reference leak
        mtd: rawnand: jz4780: fix possible object reference leak
        mtd: rawnand: atmel: fix possible object reference leak
        mtd: rawnand: fsmc: Disable NAND on remove()
        mtd: rawnand: fsmc: Reset NAND timings on resume()
        mtd: spinand: Add support for GigaDevice GD5F1GQ4UExxG
        mtd: rawnand: denali: remove unused dma_addr field from denali_nand_info
        mtd: rawnand: denali: remove unused function argument 'raw'
        mtd: rawnand: denali: remove unneeded denali_reset_irq() call
        ...
      811c16a2
    • Linus Torvalds's avatar
      Merge tag 'vfio-v5.1-rc1' of git://github.com/awilliam/linux-vfio · a83b0423
      Linus Torvalds authored
      Pull VFIO updates from Alex Williamson:
      
       - Switch mdev to generic UUID API (Andy Shevchenko)
      
       - Fixup platform reset include paths (Masahiro Yamada)
      
       - Fix usage of MINORMASK (Chengguang Xu)
      
       - Remove noise from duplicate spapr table unsets (Alexey Kardashevskiy)
      
       - Restore device state after PM reset (Alex Williamson)
      
       - Ensure memory translation enabled for PCI ROM access (Eric Auger)
      
      * tag 'vfio-v5.1-rc1' of git://github.com/awilliam/linux-vfio:
        vfio_pci: Enable memory accesses before calling pci_map_rom
        vfio/pci: Restore device state on PM transition
        vfio/spapr_tce: Skip unsetting already unset table
        samples/vfio-mdev/mtty: expand minor range when registering chrdev region
        samples/vfio-mdev/mdpy: expand minor range when registering chrdev region
        samples/vfio-mdev/mbochs: expand minor range when registering chrdev region
        vfio: expand minor range when registering chrdev region
        vfio: platform: reset: fix up include directives to remove ccflags-y
        vfio-mdev: Switch to use new generic UUID API
      a83b0423
    • Slavomir Kaslev's avatar
      fs: Make splice() and tee() take into account O_NONBLOCK flag on pipes · ee5e0011
      Slavomir Kaslev authored
      The current implementation of splice() and tee() ignores O_NONBLOCK set
      on pipe file descriptors and checks only the SPLICE_F_NONBLOCK flag for
      blocking on pipe arguments.  This is inconsistent since splice()-ing
      from/to non-pipe file descriptors does take O_NONBLOCK into
      consideration.
      
      Fix this by promoting O_NONBLOCK, when set on a pipe, to
      SPLICE_F_NONBLOCK.
      
      Some context for how the current implementation of splice() leads to
      inconsistent behavior.  In the ongoing work[1] to add VM tracing
      capability to trace-cmd we stream tracing data over named FIFOs or
      vsockets from guests back to the host.
      
      When we receive SIGINT from user to stop tracing, we set O_NONBLOCK on
      the input file descriptor and set SPLICE_F_NONBLOCK for the next call to
      splice().  If splice() was blocked waiting on data from the input FIFO,
      after SIGINT splice() restarts with the same arguments (no
      SPLICE_F_NONBLOCK) and blocks again instead of returning -EAGAIN when no
      data is available.
      
      This differs from the splice() behavior when reading from a vsocket or
      when we're doing a traditional read()/write() loop (trace-cmd's
      --nosplice argument).
      
      With this patch applied we get the same behavior in all situations after
      setting O_NONBLOCK which also matches the behavior of doing a
      read()/write() loop instead of splice().
      
      This change does have potential of breaking users who don't expect
      EAGAIN from splice() when SPLICE_F_NONBLOCK is not set.  OTOH programs
      that set O_NONBLOCK and don't anticipate EAGAIN are arguably buggy[2].
      
       [1] https://github.com/skaslev/trace-cmd/tree/vsock
       [2] https://github.com/torvalds/linux/blob/d47e3da1759230e394096fd742aad423c291ba48/fs/read_write.c#L1425Signed-off-by: 's avatarSlavomir Kaslev <kaslevs@vmware.com>
      Reviewed-by: 's avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      Signed-off-by: 's avatarLinus Torvalds <torvalds@linux-foundation.org>
      ee5e0011
  2. 04 Mar, 2019 13 commits
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 4f9020ff
      Linus Torvalds authored
      Pull vfs fixes from Al Viro:
       "Assorted fixes that sat in -next for a while, all over the place"
      
      * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        aio: Fix locking in aio_poll()
        exec: Fix mem leak in kernel_read_file
        copy_mount_string: Limit string length to PATH_MAX
        cgroup: saner refcounting for cgroup_root
        fix cgroup_do_mount() handling of failure exits
      4f9020ff
    • Linus Torvalds's avatar
      get rid of legacy 'get_ds()' function · 736706be
      Linus Torvalds authored
      Every in-kernel use of this function defined it to KERNEL_DS (either as
      an actual define, or as an inline function).  It's an entirely
      historical artifact, and long long long ago used to actually read the
      segment selector valueof '%ds' on x86.
      
      Which in the kernel is always KERNEL_DS.
      
      Inspired by a patch from Jann Horn that just did this for a very small
      subset of users (the ones in fs/), along with Al who suggested a script.
      I then just took it to the logical extreme and removed all the remaining
      gunk.
      
      Roughly scripted with
      
         git grep -l '(get_ds())' -- :^tools/ | xargs sed -i 's/(get_ds())/(KERNEL_DS)/'
         git grep -lw 'get_ds' -- :^tools/ | xargs sed -i '/^#define get_ds()/d'
      
      plus manual fixups to remove a few unusual usage patterns, the couple of
      inline function cases and to fix up a comment that had become stale.
      
      The 'get_ds()' function remains in an x86 kvm selftest, since in user
      space it actually does something relevant.
      Inspired-by: 's avatarJann Horn <jannh@google.com>
      Inspired-by: 's avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: 's avatarLinus Torvalds <torvalds@linux-foundation.org>
      736706be
    • Linus Torvalds's avatar
      aio: simplify - and fix - fget/fput for io_submit() · 84c4e1f8
      Linus Torvalds authored
      Al Viro root-caused a race where the IOCB_CMD_POLL handling of
      fget/fput() could cause us to access the file pointer after it had
      already been freed:
      
       "In more details - normally IOCB_CMD_POLL handling looks so:
      
         1) io_submit(2) allocates aio_kiocb instance and passes it to
            aio_poll()
      
         2) aio_poll() resolves the descriptor to struct file by req->file =
            fget(iocb->aio_fildes)
      
         3) aio_poll() sets ->woken to false and raises ->ki_refcnt of that
            aio_kiocb to 2 (bumps by 1, that is).
      
         4) aio_poll() calls vfs_poll(). After sanity checks (basically,
            "poll_wait() had been called and only once") it locks the queue.
            That's what the extra reference to iocb had been for - we know we
            can safely access it.
      
         5) With queue locked, we check if ->woken has already been set to
            true (by aio_poll_wake()) and, if it had been, we unlock the
            queue, drop a reference to aio_kiocb and bugger off - at that
            point it's a responsibility to aio_poll_wake() and the stuff
            called/scheduled by it. That code will drop the reference to file
            in req->file, along with the other reference to our aio_kiocb.
      
         6) otherwise, we see whether we need to wait. If we do, we unlock the
            queue, drop one reference to aio_kiocb and go away - eventual
            wakeup (or cancel) will deal with the reference to file and with
            the other reference to aio_kiocb
      
         7) otherwise we remove ourselves from waitqueue (still under the
            queue lock), so that wakeup won't get us. No async activity will
            be happening, so we can safely drop req->file and iocb ourselves.
      
        If wakeup happens while we are in vfs_poll(), we are fine - aio_kiocb
        won't get freed under us, so we can do all the checks and locking
        safely. And we don't touch ->file if we detect that case.
      
        However, vfs_poll() most certainly *does* touch the file it had been
        given. So wakeup coming while we are still in ->poll() might end up
        doing fput() on that file. That case is not too rare, and usually we
        are saved by the still present reference from descriptor table - that
        fput() is not the final one.
      
        But if another thread closes that descriptor right after our fget()
        and wakeup does happen before ->poll() returns, we are in trouble -
        final fput() done while we are in the middle of a method:
      
      Al also wrote a patch to take an extra reference to the file descriptor
      to fix this, but I instead suggested we just streamline the whole file
      pointer handling by submit_io() so that the generic aio submission code
      simply keeps the file pointer around until the aio has completed.
      
      Fixes: bfe4037e ("aio: implement IOCB_CMD_POLL")
      Acked-by: 's avatarAl Viro <viro@zeniv.linux.org.uk>
      Reported-by: syzbot+503d4cc169fcec1cb18c@syzkaller.appspotmail.com
      Signed-off-by: 's avatarLinus Torvalds <torvalds@linux-foundation.org>
      84c4e1f8
    • Linus Torvalds's avatar
      x86-64: add warning for non-canonical user access address dereferences · 00c42373
      Linus Torvalds authored
      This adds a warning (once) for any kernel dereference that has a user
      exception handler, but accesses a non-canonical address.  It basically
      is a simpler - and more limited - version of commit 9da3f2b7
      ("x86/fault: BUG() when uaccess helpers fault on kernel addresses") that
      got reverted.
      
      Note that unlike that original commit, this only causes a warning,
      because there are real situations where we currently can do this
      (notably speculative argument fetching for uprobes etc).  Also, unlike
      that original commit, this _only_ triggers for #GP accesses, so the
      cases of valid kernel pointers that cross into a non-mapped page aren't
      affected.
      
      The intent of this is two-fold:
      
       - the uprobe/tracing accesses really do need to be more careful. In
         particular, from a portability standpoint it's just wrong to think
         that "a pointer is a pointer", and use the same logic for any random
         pointer value you find on the stack. It may _work_ on x86-64, but it
         doesn't necessarily work on other architectures (where the same
         pointer value can be either a kernel pointer _or_ a user pointer, and
         you really need to be much more careful in how you try to access it)
      
         The warning can hopefully end up being a reminder that just any
         random pointer access won't do.
      
       - Kees in particular wanted a way to actually report invalid uses of
         wild pointers to user space accessors, instead of just silently
         failing them. Automated fuzzers want a way to get reports if the
         kernel ever uses invalid values that the fuzzer fed it.
      
         The non-canonical address range is a fair chunk of the address space,
         and with this you can teach syzkaller to feed in invalid pointer
         values and find cases where we do not properly validate user
         addresses (possibly due to bad uses of "set_fs()").
      Acked-by: 's avatarKees Cook <keescook@chromium.org>
      Cc: Jann Horn <jannh@google.com>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Signed-off-by: 's avatarLinus Torvalds <torvalds@linux-foundation.org>
      00c42373
    • Mark Brown's avatar
      Merge branch 'spi-5.1' into spi-next · 14dbfb41
      Mark Brown authored
      14dbfb41
    • Mark Brown's avatar
      Merge branch 'spi-5.0' into spi-linus · b50c6ac8
      Mark Brown authored
      b50c6ac8
    • Mark Brown's avatar
      88f268a5
    • Mark Brown's avatar
      c364098f
    • Geert Uytterhoeven's avatar
      spi: sh-msiof: Restrict bits per word to 8/16/24/32 on R-Car Gen2/3 · 0e836c3b
      Geert Uytterhoeven authored
      While the MSIOF variants in older SuperH and SH/R-Mobile SoCs support
      bits-per-word values in the full range 8..32, the variants present in
      R-Car Gen2 and Gen3 SoCs are restricted to 8, 16, 24, or 32.
      
      Obtain the value from family-specific sh_msiof_chipdata to fix this.
      Reported-by: 's avatarYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
      Signed-off-by: 's avatarGeert Uytterhoeven <geert+renesas@glider.be>
      Reviewed-by: 's avatarSimon Horman <horms+renesas@verge.net.au>
      Signed-off-by: 's avatarMark Brown <broonie@kernel.org>
      0e836c3b
    • Axel Lin's avatar
      regulator: mc13xxx: Constify regulator_ops variables · e5680c4d
      Axel Lin authored
      These regulator_ops variables should never change, make them const.
      Signed-off-by: 's avatarAxel Lin <axel.lin@ingics.com>
      Signed-off-by: 's avatarMark Brown <broonie@kernel.org>
      e5680c4d
    • Axel Lin's avatar
      regulator: palmas: Constify palmas_smps_ramp_delay array · ad542a52
      Axel Lin authored
      The palmas_smps_ramp_delay array should never modify, make it const.
      Signed-off-by: 's avatarAxel Lin <axel.lin@ingics.com>
      Signed-off-by: 's avatarMark Brown <broonie@kernel.org>
      ad542a52
    • Axel Lin's avatar
      regulator: wm831x-dcdc: Convert to use regulator_set/get_current_limit_regmap · 20eb641e
      Axel Lin authored
      Use regulator_set/get_current_limit_regmap helpers to save some code.
      Signed-off-by: 's avatarAxel Lin <axel.lin@ingics.com>
      Acked-by: 's avatarCharles Keepax <ckeepax@opensource.cirrus.com>
      Signed-off-by: 's avatarMark Brown <broonie@kernel.org>
      20eb641e
    • Axel Lin's avatar
      regulator: pv88090: Convert to use regulator_set/get_current_limit_regmap · f4afd05e
      Axel Lin authored
      Use regulator_set/get_current_limit_regmap helpers to save some code.
      Signed-off-by: 's avatarAxel Lin <axel.lin@ingics.com>
      Acked-by: Steve Twiss <stwiss.opensource@diasemi.com>;
      Signed-off-by: 's avatarMark Brown <broonie@kernel.org>
      f4afd05e
  3. 03 Mar, 2019 12 commits
  4. 02 Mar, 2019 5 commits
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · e7c42a89
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
       "Two last minute fixes:
      
         - Prevent value evaluation via functions happening in the user access
           enabled region of __put_user() (put another way: make sure to
           evaluate the value to be stored in user space _before_ enabling
           user space accesses)
      
         - Correct the definition of a Hyper-V hypercall constant"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/hyper-v: Fix definition of HV_MAX_FLUSH_REP_COUNT
        x86/uaccess: Don't leak the AC flag into __put_user() value evaluation
      e7c42a89
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · df49fd0f
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Nine small fixes.
      
        The resume fix is a cosmetic removal of a warning with an incorrect
        condition causing it to alarm people wrongly.
      
        The other eight patches correct a thinko in Christoph Hellwig's DMA
        conversion series. Without it all these drivers end up with 32 bit DMA
        masks meaning they bounce any page over 4GB before sending it to the
        controller.
      
        Nowadays, even laptops mostly have memory above 4GB, so this can lead
        to significant performance degradation with all the bouncing"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: core: Avoid that system resume triggers a kernel warning
        scsi: hptiop: fix calls to dma_set_mask()
        scsi: hisi_sas: fix calls to dma_set_mask_and_coherent()
        scsi: csiostor: fix calls to dma_set_mask_and_coherent()
        scsi: bfa: fix calls to dma_set_mask_and_coherent()
        scsi: aic94xx: fix calls to dma_set_mask_and_coherent()
        scsi: 3w-sas: fix calls to dma_set_mask_and_coherent()
        scsi: 3w-9xxx: fix calls to dma_set_mask_and_coherent()
        scsi: lpfc: fix calls to dma_set_mask_and_coherent()
      df49fd0f
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · c93d9218
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix refcount leak in act_ipt during replace, from Davide Caratti.
      
       2) Set task state properly in tun during blocking reads, from Timur
          Celik.
      
       3) Leaked reference in DSA, from Wen Yang.
      
       4) NULL deref in act_tunnel_key, from Vlad Buslov.
      
       5) cipso_v4_erro can reference the skb IPCB in inappropriate contexts
          thus referencing garbage, from Nazarov Sergey.
      
       6) Don't accept RTA_VIA and RTA_GATEWAY in contexts where those
          attributes make no sense.
      
       7) Fix hung sendto in tipc, from Tung Nguyen.
      
       8) Out-of-bounds access in netlabel, from Paul Moore.
      
       9) Grant reference leak in xen-netback, from Igor Druzhinin.
      
      10) Fix tx stalls with lan743x, from Bryan Whitehead.
      
      11) Fix interrupt storm with mv88e6xxx, from Hein Kallweit.
      
      12) Memory leak in sit on device registry failure, from Mao Wenan.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (44 commits)
        net: sit: fix memory leak in sit_init_net()
        net: dsa: mv88e6xxx: Fix statistics on mv88e6161
        geneve: correctly handle ipv6.disable module parameter
        net: dsa: mv88e6xxx: prevent interrupt storm caused by mv88e6390x_port_set_cmode
        bpf: fix sanitation rewrite in case of non-pointers
        ipv4: Add ICMPv6 support when parse route ipproto
        MIPS: eBPF: Fix icache flush end address
        lan743x: Fix TX Stall Issue
        net: phy: phylink: fix uninitialized variable in phylink_get_mac_state
        net: aquantia: regression on cpus with high cores: set mode with 8 queues
        selftests: fixes for UDP GRO
        bpf: drop refcount if bpf_map_new_fd() fails in map_create()
        net: dsa: mv88e6xxx: power serdes on/off for 10G interfaces on 6390X
        net: dsa: mv88e6xxx: Fix u64 statistics
        xen-netback: don't populate the hash cache on XenBus disconnect
        xen-netback: fix occasional leak of grant ref mappings under memory pressure
        sctp: chunk.c: correct format string for size_t in printk
        net: netem: fix skb length BUG_ON in __skb_to_sgvec
        netlabel: fix out-of-bounds memory accesses
        ipv4: Pass original device to ip_rcv_finish_core
        ...
      c93d9218
    • Linus Torvalds's avatar
      Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · fa3294c5
      Linus Torvalds authored
      Pull more crypto fixes from Herbert Xu:
       "This fixes a couple of issues in arm64/chacha that was introduced in
        5.0"
      
      * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        crypto: arm64/chacha - fix hchacha_block_neon() for big endian
        crypto: arm64/chacha - fix chacha_4block_xor_neon() for big endian
      fa3294c5
    • Mao Wenan's avatar
      net: sit: fix memory leak in sit_init_net() · 07f12b26
      Mao Wenan authored
      If register_netdev() is failed to register sitn->fb_tunnel_dev,
      it will go to err_reg_dev and forget to free netdev(sitn->fb_tunnel_dev).
      
      BUG: memory leak
      unreferenced object 0xffff888378daad00 (size 512):
        comm "syz-executor.1", pid 4006, jiffies 4295121142 (age 16.115s)
        hex dump (first 32 bytes):
          00 e6 ed c0 83 88 ff ff 00 00 00 00 00 00 00 00  ................
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      backtrace:
          [<00000000d6dcb63e>] kvmalloc include/linux/mm.h:577 [inline]
          [<00000000d6dcb63e>] kvzalloc include/linux/mm.h:585 [inline]
          [<00000000d6dcb63e>] netif_alloc_netdev_queues net/core/dev.c:8380 [inline]
          [<00000000d6dcb63e>] alloc_netdev_mqs+0x600/0xcc0 net/core/dev.c:8970
          [<00000000867e172f>] sit_init_net+0x295/0xa40 net/ipv6/sit.c:1848
          [<00000000871019fa>] ops_init+0xad/0x3e0 net/core/net_namespace.c:129
          [<00000000319507f6>] setup_net+0x2ba/0x690 net/core/net_namespace.c:314
          [<0000000087db4f96>] copy_net_ns+0x1dc/0x330 net/core/net_namespace.c:437
          [<0000000057efc651>] create_new_namespaces+0x382/0x730 kernel/nsproxy.c:107
          [<00000000676f83de>] copy_namespaces+0x2ed/0x3d0 kernel/nsproxy.c:165
          [<0000000030b74bac>] copy_process.part.27+0x231e/0x6db0 kernel/fork.c:1919
          [<00000000fff78746>] copy_process kernel/fork.c:1713 [inline]
          [<00000000fff78746>] _do_fork+0x1bc/0xe90 kernel/fork.c:2224
          [<000000001c2e0d1c>] do_syscall_64+0xc8/0x580 arch/x86/entry/common.c:290
          [<00000000ec48bd44>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
          [<0000000039acff8a>] 0xffffffffffffffff
      Signed-off-by: 's avatarMao Wenan <maowenan@huawei.com>
      Signed-off-by: 's avatarDavid S. Miller <davem@davemloft.net>
      07f12b26