aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* set bcmdhd nvram path to the firmware dirreplicant-6.0Wolfgang Wiedmeyer2017-06-127-7/+7
| | | | Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
* n7000 defconfigs: sync with i9100Wolfgang Wiedmeyer2017-06-082-62/+356
| | | | | | | | | Includes needed changes for Replicant 6.0 and enables f2fs support, ksm, some crypto-related enhancements and ath9k_htc. Heap randomization should be enabled all the time. Use stack-protector mode and seccomp. Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
* bcmdhd wireless: Fix more off by one errors.Christian Neumüller2017-05-151-13/+13
| | | | | | | These were not detected by the stack protector, either because the functions where not called or because the corruption hits a local variable. Change-Id: I385c81b133ee09c28df56597df3fb25d9c063f43
* bcmdhd wireless: Fix off by one in initialization.Christian Neumüller2017-05-151-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | An sprintf in dhd_write_macaddr wrote a rogue null byte after the buffer. Found with CONFIG_CC_STACKPROTECTOR=y (idea of Lanchon at XDA Developers [1]). [1]: http://forum.xda-developers.com/showthread.php?p=55306602 Panic, on a Samsung Galaxy S2 i9100, was: <0>[ 26.412257] c1 Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: bf013a2c <0>[ 26.412315] c1 <4>[ 26.412334] c1 Backtrace: <4>[ 26.412382] c1 [<c064e5b8>] (dump_backtrace+0x0/0x10c) from [<c0b91e6c>] (dump_stack+0x18/0x1c) <4>[ 26.412439] c1 r6:e211e820 r5:c0ed4760 r4:c0f5c940 r3:271aed5c <4>[ 26.412496] c1 [<c0b91e54>] (dump_stack+0x0/0x1c) from [<c0b92204>] (panic+0x80/0x1ac) <4>[ 26.412561] c1 [<c0b92184>] (panic+0x0/0x1ac) from [<c0684be0>] (init_oops_id+0x0/0x58) <4>[ 26.412613] c1 r3:271aed5c r2:271aed00 r1:bf013a2c r0:c0cb8880 <4>[ 26.412663] c1 r7:e273bc32 <4>[ 26.412742] c1 [<c0684bc4>] (__stack_chk_fail+0x0/0x1c) from [<bf013a2c>] (dhd_write_macaddr+0x2e4/0x310 [dhd]) <4>[ 26.412864] c1 [<bf013748>] (dhd_write_macaddr+0x0/0x310 [dhd]) from [<bf01a554>] (dhd_bus_start+0x1a4/0x2e0 [dhd]) <4>[ 26.412985] c1 [<bf01a3b0>] (dhd_bus_start+0x0/0x2e0 [dhd]) from [<bf020558>] (dhdsdio_probe+0x4a4/0x72c [dhd]) <4>[ 26.413097] c1 [<bf0200b4>] (dhdsdio_probe+0x0/0x72c [dhd]) from [<bf00c0ec>] (bcmsdh_probe+0xf8/0x150 [dhd]) <4>[ 26.413206] c1 [<bf00bff4>] (bcmsdh_probe+0x0/0x150 [dhd]) from [<bf00e038>] (bcmsdh_sdmmc_probe+0x54/0xbc [dhd]) <4>[ 26.413304] c1 [<bf00dfe4>] (bcmsdh_sdmmc_probe+0x0/0xbc [dhd]) from [<c09a7fe8>] (sdio_bus_probe+0xfc/0x108) <4>[ 26.413368] c1 r5:e2d97000 r4:e2d97008 <4>[ 26.413414] c1 [<c09a7eec>] (sdio_bus_probe+0x0/0x108) from [<c0896764>] (driver_probe_device+0x94/0x1a8) <4>[ 26.413474] c1 r8:00000000 r7:bf067414 r6:e2d9703c r5:c0f6ddb8 r4:e2d97008 <4>[ 26.413531] c1 r3:c09a7eec <4>[ 26.413563] c1 [<c08966d0>] (driver_probe_device+0x0/0x1a8) from [<c089690c>] (__driver_attach+0x94/0x98) <4>[ 26.413624] c1 r7:e2e631e0 r6:e2d9703c r5:bf067414 r4:e2d97008 <4>[ 26.413683] c1 [<c0896878>] (__driver_attach+0x0/0x98) from [<c0895678>] (bus_for_each_dev+0x4c/0x94) <4>[ 26.413742] c1 r6:c0896878 r5:bf067414 r4:00000000 r3:c0896878 <4>[ 26.413799] c1 [<c089562c>] (bus_for_each_dev+0x0/0x94) from [<c0896428>] (driver_attach+0x24/0x28) <4>[ 26.413857] c1 r6:c0f02af0 r5:bf067414 r4:bf067414 <4>[ 26.413904] c1 [<c0896404>] (driver_attach+0x0/0x28) from [<c08960c8>] (bus_add_driver+0x180/0x250) <4>[ 26.413970] c1 [<c0895f48>] (bus_add_driver+0x0/0x250) from [<c0896e14>] (driver_register+0x80/0x150) <4>[ 26.414037] c1 [<c0896d94>] (driver_register+0x0/0x150) from [<c09a8128>] (sdio_register_driver+0x2c/0x30) <4>[ 26.414131] c1 [<c09a80fc>] (sdio_register_driver+0x0/0x30) from [<bf00e250>] (sdio_function_init+0x3c/0x8c [dhd]) <4>[ 26.414244] c1 [<bf00e214>] (sdio_function_init+0x0/0x8c [dhd]) from [<bf00c19c>] (bcmsdh_register+0x1c/0x24 [dhd]) <4>[ 26.414311] c1 r5:00000004 r4:bf06a3c4 <4>[ 26.414398] c1 [<bf00c180>] (bcmsdh_register+0x0/0x24 [dhd]) from [<bf027990>] (dhd_bus_register+0x24/0x48 [dhd]) <4>[ 26.414515] c1 [<bf02796c>] (dhd_bus_register+0x0/0x48 [dhd]) from [<bf07618c>] (init_module+0x18c/0x284 [dhd]) <4>[ 26.414610] c1 [<bf076000>] (init_module+0x0/0x284 [dhd]) from [<c06448f8>] (do_one_initcall+0x128/0x1a8) <4>[ 26.414683] c1 [<c06447d0>] (do_one_initcall+0x0/0x1a8) from [<c06b9710>] (sys_init_module+0xdf8/0x1b1c) <4>[ 26.414756] c1 [<c06b8918>] (sys_init_module+0x0/0x1b1c) from [<c064a8c0>] (ret_fast_syscall+0x0/0x30) <2>[ 26.414861] c0 CPU0: stopping <4>[ 26.414886] c0 Backtrace: <4>[ 26.414920] c0 [<c064e5b8>] (dump_backtrace+0x0/0x10c) from [<c0b91e6c>] (dump_stack+0x18/0x1c) <4>[ 26.414977] c0 r6:c0d54000 r5:c0eb5d08 r4:00000006 r3:271aed5c <4>[ 26.415039] c0 [<c0b91e54>] (dump_stack+0x0/0x1c) from [<c06444bc>] (do_IPI+0x258/0x29c) <4>[ 26.415102] c0 [<c0644264>] (do_IPI+0x0/0x29c) from [<c064a340>] (__irq_svc+0x80/0x130) <4>[ 26.415156] c0 Exception stack(0xc0d55ef0 to 0xc0d55f38) <4>[ 26.415197] c0 5ee0: 3b9ac9ff 540deacd 01c99e53 00072679 <4>[ 26.415258] c0 5f00: c0f5a468 00000000 c0d54000 00000000 c1b540a8 412fc091 00000000 c0d55f64 <4>[ 26.415317] c0 5f20: 540deacd c0d55f38 c06aa768 c065bd78 20000013 ffffffff <4>[ 26.415380] c0 [<c065bd3c>] (exynos4_enter_idle+0x0/0x174) from [<c099a890>] (cpuidle_idle_call+0xa4/0x120) <4>[ 26.415442] c0 r7:00000000 r6:00000001 r5:c0f815ac r4:c1b540b8 <4>[ 26.415498] c0 [<c099a7ec>] (cpuidle_idle_call+0x0/0x120) from [<c064bd40>] (cpu_idle+0xc4/0x100) <4>[ 26.415554] c0 r8:4000406a r7:c0ba09a8 r6:c0f59ec4 r5:c0ebd8c4 r4:c0d54000 <4>[ 26.415610] c0 r3:c099a7ec <4>[ 26.415641] c0 [<c064bc7c>] (cpu_idle+0x0/0x100) from [<c0b83238>] (rest_init+0x8c/0xa4) <4>[ 26.415694] c0 r7:c1b51180 r6:c0f59e00 r5:00000002 r4:c0d54000 <4>[ 26.415752] c0 [<c0b831ac>] (rest_init+0x0/0xa4) from [<c00089c4>] (start_kernel+0x2dc/0x330) <4>[ 26.415807] c0 r5:c063d944 r4:c0eb5d34 <4>[ 26.415845] c0 [<c00086e8>] (start_kernel+0x0/0x330) from [<40008044>] (0x40008044) Change-Id: Iaa907383e196fdf787ae4660977b58de79212de1
* config hardening for i9100, i9300, i9305 and n7100Wolfgang Wiedmeyer2017-03-164-12/+39
| | | | | | | Ensure that heap randomization is enabled all the time. Enable stack-protector mode and seccomp. Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
* n7100: sync defconfig with i9300 and enable the updated sensor driversWolfgang Wiedmeyer2017-02-231-41/+26
| | | | | | enables f2fs support, ksm and some crypto-related enhancements Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
* drivers/sensorhub: update from GT-N7100_KK_Opensource_Update1 source dropWolfgang Wiedmeyer2017-02-2349-1272/+10525
| | | | | | | | | | | | | | The import already includes the build fixes from this commit: commit 7055ffb Author: Dheeraj CVR <cvr.dheeraj@gmail.com> Date: 2014-12-22 12:55:48 +0530 drivers: sensorhub: fix compile Change-Id: Ice06c873e4f2fe50ccb1a4cac5ac761e4a872bd3 Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
* n7100: regenerate defconfig with ath9k enabled and mobicore and extdsp disabledWolfgang Wiedmeyer2017-02-221-66/+155
| | | | Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
* Merge branch 'cm-13.0' of ↵replicant-6.0-beta-0002Wolfgang Wiedmeyer2017-02-1215-16/+16
|\ | | | | | | | | | | https://github.com/LineageOS/android_kernel_samsung_smdk4412 into replicant-6.0 Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
| * i9305: enable idletimerJUX842017-02-031-1/+1
| | | | | | | | Change-Id: If0fdabc3776d1aeb2bf19028ca8f16e85b6593e1
| * smdk4412 : rebrandSimon Shields2017-01-2915-15/+15
| | | | | | | | Change-Id: I5ddf596d0db704dde58c2e57c49c3e7e1eb28014
* | i9305: disable mobicore driverWolfgang Wiedmeyer2017-01-281-9/+2
| | | | | | | | | | | | Replicant does not cooperate with TrustZone. Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
* | i9305: enable ath9k_htc and disable samsung_extdisp driverreplicant-6.0-beta-0001Wolfgang Wiedmeyer2017-01-271-160/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | The samsung_extdisp driver for GT-I9500 was affected by CVE-2015-1800 and CVE-2015-1801. The Galaxy S3 uses an older version of this driver and is at least affected by CVE-2015-1801. Newer kernel versions for the GT-I9500 had the driver completely removed. I also found no indication that the driver is actually needed for the S3, so let's disable it. vulnerability disclosure and further information: http://blog.quarkslab.com/kernel-vulnerabilities-in-the-samsung-s4.html Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
* | i9300: enable ath9k_htcWolfgang Wiedmeyer2017-01-211-4/+58
| | | | | | | | Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
* | net/wireless: add cfg80211_ref_bss() from 3.4 kernelWolfgang Wiedmeyer2017-01-211-0/+12
| | | | | | | | | | | | mac80211 needs this function. Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
* | i9100: enable ath9k_htcWolfgang Wiedmeyer2017-01-211-4/+88
| | | | | | | | Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
* | Backport ath from 3.4 kernelWolfgang Wiedmeyer2017-01-2184-7441/+17780
| | | | | | | | | | | | | | net/wireless and mac80211 are already backported from a 3.4 kernel, so it makes sense to also get ath from 3.4 (3.4.113). Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
* | Backport mac80211 from 3.4 kernelWolfgang Wiedmeyer2017-01-2168-4755/+9491
| | | | | | | | | | | | | | | | | | The ath9k_htc driver depends on mac80211, but mac80211 can't be build. The reason is that net/wireless is almost completely backported from a 3.4 kernel. To follow suit, mac80211 is also backported from 3.4, more precisely from 3.4.113. This makes mac80211 build. Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
* | Merge remote-tracking branch 'lineageos/cm-13.0' into replicant-6.0Wolfgang Wiedmeyer2017-01-174-28/+22
|\ \ | |/
| * ALSA: pcm : Call kill_fasync() in stream lockTakashi Iwai2017-01-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently kill_fasync() is called outside the stream lock in snd_pcm_period_elapsed(). This is potentially racy, since the stream may get released even during the irq handler is running. Although snd_pcm_release_substream() calls snd_pcm_drop(), this doesn't guarantee that the irq handler finishes, thus the kill_fasync() call outside the stream spin lock may be invoked after the substream is detached, as recently reported by KASAN. As a quick workaround, move kill_fasync() call inside the stream lock. The fasync is rarely used interface, so this shouldn't have a big impact from the performance POV. Ideally, we should implement some sync mechanism for the proper finish of stream and irq handler. But this oneliner should suffice for most cases, so far. Change-Id: I5dbc5260abe527261b4b8c4699400b317af8451e Reported-by: Baozeng Ding <sploving1@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * net: avoid signed overflows for SO_{SND|RCV}BUFFORCEEric Dumazet2017-01-081-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CAP_NET_ADMIN users should not be allowed to set negative sk_sndbuf or sk_rcvbuf values, as it can lead to various memory corruptions, crashes, OOM... Note that before commit 82981930125a ("net: cleanups in sock_setsockopt()"), the bug was even more serious, since SO_SNDBUF and SO_RCVBUF were vulnerable. This needs to be backported to all known linux kernels. Again, many thanks to syzkaller team for discovering this gem. Change-Id: I7b3a4b234eee4e3b2b2766f4d61a44d92e76095d Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * net: cleanups in sock_setsockopt()Eric Dumazet2017-01-081-27/+15
| | | | | | | | | | | | | | | | | | Use min_t()/max_t() macros, reformat two comments, use !!test_bit() to match !!sock_flag() Change-Id: Ie9ef0586af81908916e7df27ea3c4508982dc42c Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * sg_write()/bsg_write() is not fit to be called under KERNEL_DSAl Viro2017-01-082-0/+6
| | | | | | | | | | | | | | | | | | | | | | Both damn things interpret userland pointers embedded into the payload; worse, they are actually traversing those. Leaving aside the bad API design, this is very much _not_ safe to call with KERNEL_DS. Bail out early if that happens. Change-Id: I0d2f3b1ed4e763c559ecec98af32767360985e91 Cc: stable@vger.kernel.org Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* | Merge branch 'cm-13.0' of ↵Wolfgang Wiedmeyer2017-01-171-30/+56
|\ \ | |/ | | | | https://github.com/CyanogenMod/android_kernel_samsung_smdk4412 into replicant-6.0
| * i9305 : new defconfigRGIB2016-12-151-30/+56
| | | | | | | | Change-Id: I09f0b17d6f77ebb7e8982e9a1c0357ca4e2eae7a
* | i9100: update recovery defconfigWolfgang Wiedmeyer2017-01-111-30/+81
| | | | | | | | Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
* | S5C73M3: Boot from FROM when no firmware is availablereplicant-6.0-alpha-0006Paul Kocialkowski2016-12-151-30/+16
| | | | | | | | Signed-off-by: Paul Kocialkowski <contact@paulk.fr>
* | S5C73M3: System firmware loading correction using static memory arrayPaul Kocialkowski2016-12-151-13/+7
| | | | | | | | Signed-off-by: Paul Kocialkowski <contact@paulk.fr>
* | S5C73M3: Avoid writing the firmware to the filesystemPaul Kocialkowski2016-12-151-15/+0
| | | | | | | | Signed-off-by: Paul Kocialkowski <contact@paulk.fr>
* | Merge branch 'cm-13.0' of ↵Wolfgang Wiedmeyer2016-12-13377-41171/+33584
|\ \ | |/ | | | | https://github.com/CyanogenMod/android_kernel_samsung_smdk4412 into replicant-6.0
| * netfilter: Change %p to %pK in debug messagesMin Chong2016-12-131-10/+10
| | | | | | | | | | | | | | | | | | | | | | The format specifier %p can leak kernel addresses while not valuing the kptr_restrict system settings. Use %pK instead of %p, which also evaluates whether kptr_restrict is set. Bug: 31796940 Change-Id: Ia2946d6b493126d68281f97778faf578247f088e Signed-off-by: Min Chong <mchong@google.com>
| * drivers: video: Add bounds checking in fb_cmap_to_userSteve Pfetsch2016-12-131-1/+1
| | | | | | | | | | | | | | | | Verify that unsigned int value will not become negative before cast to signed int. Bug: 31651010 Change-Id: I548a200f678762042617f11100b6966a405a3920
| * fbcmap: Remove unnecessary condition checkPing Li2016-12-131-2/+2
| | | | | | | | | | | | | | | | In fb_set_user_cmap function, cmap->start variable is an unsigned integer, it doesn't need a condition check with the sign. Change-Id: I355ddb7edcc085ee52e4054833b687640376eee3 Signed-off-by: Ping Li <pingli@codeaurora.org>
| * fbmem: Check failure of FBIOPUTCMAP ioctlPawan Kumar2016-12-132-9/+25
| | | | | | | | | | | | | | | | | | On FBIOPUTCMAP ioctl failure deallocate fb cmap. Put null check for cmap red, green, blue component. Change-Id: I10468ee30d0e76c256cf3d7a6ffe14db7fd4511b Signed-off-by: Pawan Kumar <pavaku@codeaurora.org>
| * net: ping: Fix stack buffer overflow in ping_common_sendmsg()Siqi Lin2016-12-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In ping_common_sendmsg(), when len < icmph_len, memcpy_fromiovec() will access invalid memory because msg->msg_iov only has 1 element and memcpy_fromiovec() attempts to increment it. KASAN report: BUG: KASAN: stack-out-of-bounds in memcpy_fromiovec+0x60/0x114 at addr ffffffc071077da0 Read of size 8 by task trinity-c2/9623 page:ffffffbe034b9a08 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x0() page dumped because: kasan: bad access detected CPU: 0 PID: 9623 Comm: trinity-c2 Tainted: G BU 3.18.0-dirty #15 Hardware name: Google Tegra210 Smaug Rev 1,3+ (DT) Call trace: [<ffffffc000209c98>] dump_backtrace+0x0/0x1ac arch/arm64/kernel/traps.c:90 [<ffffffc000209e54>] show_stack+0x10/0x1c arch/arm64/kernel/traps.c:171 [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffc000f18dc4>] dump_stack+0x7c/0xd0 lib/dump_stack.c:50 [< inline >] print_address_description mm/kasan/report.c:147 [< inline >] kasan_report_error mm/kasan/report.c:236 [<ffffffc000373dcc>] kasan_report+0x380/0x4b8 mm/kasan/report.c:259 [< inline >] check_memory_region mm/kasan/kasan.c:264 [<ffffffc00037352c>] __asan_load8+0x20/0x70 mm/kasan/kasan.c:507 [<ffffffc0005b9624>] memcpy_fromiovec+0x5c/0x114 lib/iovec.c:15 [< inline >] memcpy_from_msg include/linux/skbuff.h:2667 [<ffffffc000ddeba0>] ping_common_sendmsg+0x50/0x108 net/ipv4/ping.c:674 [<ffffffc000dded30>] ping_v4_sendmsg+0xd8/0x698 net/ipv4/ping.c:714 [<ffffffc000dc91dc>] inet_sendmsg+0xe0/0x12c net/ipv4/af_inet.c:749 [< inline >] __sock_sendmsg_nosec net/socket.c:624 [< inline >] __sock_sendmsg net/socket.c:632 [<ffffffc000cab61c>] sock_sendmsg+0x124/0x164 net/socket.c:643 [< inline >] SYSC_sendto net/socket.c:1797 [<ffffffc000cad270>] SyS_sendto+0x178/0x1d8 net/socket.c:1761 Memory state around the buggy address: ffffffc071077c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 f1 f1 ffffffc071077d00: f1 f1 04 f4 f4 f4 f2 f2 f2 f2 04 f4 f4 f4 f2 f2 >ffffffc071077d80: f2 f2 00 00 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 ^ ffffffc071077e00: 00 f4 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 ffffffc071077e80: 00 00 00 00 00 00 f3 f3 f3 f3 00 00 00 00 00 00 RM-290 Bug: 31349935 Change-Id: Ib7385fc26dfe7e07e9bab42a10ff65a37cbaab54 Signed-off-by: Siqi Lin <siqilin@google.com>
| * perf: protect group_leader from races that cause ctx double-freeJohn Dias2016-12-132-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When moving a group_leader perf event from a software-context to a hardware-context, there's a race in checking and updating that context. The existing locking solution doesn't work; note that it tries to grab a lock inside the group_leader's context object, which you can only get at by going through a pointer that should be protected from these races. To avoid that problem, and to produce a simple solution, we can just use a lock per group_leader to protect all checks on the group_leader's context. The new lock is grabbed and released when no context locks are held. RM-290 Bug: 30955111 Bug: 31095224 Change-Id: If37124c100ca6f4aa962559fba3bd5dbbec8e052
| * BACKPORT: perf: Fix event->ctx lockingAriel Yin2016-12-131-35/+206
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There have been a few reported issues wrt. the lack of locking around changing event->ctx. This patch tries to address those. It avoids the whole rwsem thing; and while it appears to work, please give it some thought in review. What I did fail at is sensible runtime checks on the use of event->ctx, the RCU use makes it very hard. Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Arnaldo Carvalho de Melo <acme@kernel.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Link: http://lkml.kernel.org/r/20150123125834.209535886@infradead.org Signed-off-by: Ingo Molnar <mingo@kernel.org> (cherry picked from commit f63a8daa5812afef4f06c962351687e1ff9ccb2b) Bug: 30955111 Bug: 31095224 Change-Id: I5bab713034e960fad467637e98e914440de5666d
| * BACKPORT: lockdep: Silence warning if CONFIG_LOCKDEP isn't setPaul Bolle2016-12-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since commit c9a4962881929df7f1ef6e63e1b9da304faca4dd ("nfsd: make client_lock per net") compiling nfs4state.o without CONFIG_LOCKDEP set, triggers this GCC warning: fs/nfsd/nfs4state.c: In function ‘free_client’: fs/nfsd/nfs4state.c:1051:19: warning: unused variable ‘nn’ [-Wunused-variable] The cause of that warning is that lockdep_assert_held() compiles away if CONFIG_LOCKDEP is not set. Silence this warning by using the argument to lockdep_assert_held() as a nop if CONFIG_LOCKDEP is not set. Signed-off-by: Paul Bolle <pebolle@tiscali.nl> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stanislav Kinsbursky <skinsbursky@parallels.com> Cc: J. Bruce Fields <bfields@redhat.com> Link: http://lkml.kernel.org/r/1359060797.1325.33.camel@x61.thuisdomein Signed-off-by: Ingo Molnar <mingo@kernel.org> -- include/linux/lockdep.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Change-Id: I4a4e78fd92dccffe5fc7c3a2617ef7d4cf59f738
| * BACKPORT: perf: Introduce perf_pmu_migrate_context()Yan, Zheng2016-12-132-0/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Originally from Peter Zijlstra. The helper migrates perf events from one cpu to another cpu. Conflicts (perf: Fix race in removing an event): kernel/events/core.c Change-Id: I7885fe36c9e2803b10477d556163197085be3d19 Signed-off-by: Zheng Yan <zheng.z.yan@intel.com> Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Link: http://lkml.kernel.org/r/1339741902-8449-5-git-send-email-zheng.z.yan@intel.com Signed-off-by: Ingo Molnar <mingo@kernel.org>
| * BACKPORT: perf: Allow the PMU driver to choose the CPU on which to install ↵Yan, Zheng2016-12-131-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | events Allow the pmu->event_init callback to change event->cpu, so the PMU driver can choose the CPU on which to install events. Change-Id: I0f8b4310d306f4c87bc961f0359c2bdf65c129b6 Signed-off-by: Zheng Yan <zheng.z.yan@intel.com> Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Link: http://lkml.kernel.org/r/1339741902-8449-4-git-send-email-zheng.z.yan@intel.com Signed-off-by: Ingo Molnar <mingo@kernel.org>
| * smdk4412-kernel : do not ignore COB wifi chipsRGIB2016-12-091-0/+6
| | | | | | | | Change-Id: Ic3edddb6d0909df89a0d9551394891fa1fac707a
| * smdk4412-kernel : kona wifi module is COB typeRGIB2016-12-093-0/+3
| | | | | | | | Change-Id: I803de2a929dbb9fe470414ea55f2401da5637791
| * smdk4412 : new i9305 defconfigRGIB2016-11-231-33/+221
| | | | | | | | Change-Id: I1d67d7e79502eec9dca036b4ea7c4f8a41d1c128
| * i777: Regenerate defconfigCNBLACK2016-11-161-14/+69
| | | | | | | | | | Change-Id: I28764a4d6752ccb1501b6af24c7efa443b037dac Signed-off-by: Jeonghun Yang <didwjdgns820@gmail.com>
| * HID: core: prevent out-of-bound readingsBenjamin Tissoires2016-11-111-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | Plugging a Logitech DJ receiver with KASAN activated raises a bunch of out-of-bound readings. The fields are allocated up to MAX_USAGE, meaning that potentially, we do not have enough fields to fit the incoming values. Add checks and silence KASAN. Change-Id: I11d44957b450a3eda258c05f9e833c71a079e83c Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * BACKPORT: tty: Prevent ldisc drivers from re-using stale tty fieldsPeter Hurley2016-11-111-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (cherry picked from commit dd42bf1197144ede075a9d4793123f7689e164bc) Line discipline drivers may mistakenly misuse ldisc-related fields when initializing. For example, a failure to initialize tty->receive_room in the N_GIGASET_M101 line discipline was recently found and fixed [1]. Now, the N_X25 line discipline has been discovered accessing the previous line discipline's already-freed private data [2]. Harden the ldisc interface against misuse by initializing revelant tty fields before instancing the new line discipline. [1] commit fd98e9419d8d622a4de91f76b306af6aa627aa9c Author: Tilman Schmidt <tilman@imap.cc> Date: Tue Jul 14 00:37:13 2015 +0200 isdn/gigaset: reset tty->receive_room when attaching ser_gigaset [2] Report from Sasha Levin <sasha.levin@oracle.com> [ 634.336761] ================================================================== [ 634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0 [ 634.339558] Read of size 4 by task syzkaller_execu/8981 [ 634.340359] ============================================================================= [ 634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected ... [ 634.405018] Call Trace: [ 634.405277] dump_stack (lib/dump_stack.c:52) [ 634.405775] print_trailer (mm/slub.c:655) [ 634.406361] object_err (mm/slub.c:662) [ 634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236) [ 634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279) [ 634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1)) [ 634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447) [ 634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567) [ 634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879) [ 634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607) [ 634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613) [ 634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188) Cc: Tilman Schmidt <tilman@imap.cc> Cc: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Change-Id: Ibed6feadfb9706d478f93feec3b240aecfc64af3 Bug: 30951112
| * perf: Fix race in swevent hashPeter Zijlstra2016-11-111-7/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There's a race on CPU unplug where we free the swevent hash array while it can still have events on. This will result in a use-after-free which is BAD. Simply do not free the hash array on unplug. This leaves the thing around and no use-after-free takes place. When the last swevent dies, we do a for_each_possible_cpu() iteration anyway to clean these up, at which time we'll free it, so no leakage will occur. Change-Id: I751faf3215bbdaa6b6358f3a752bdd24126cfa0b Reported-by: Sasha Levin <sasha.levin@oracle.com> Tested-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Vince Weaver <vincent.weaver@maine.edu> Signed-off-by: Ingo Molnar <mingo@kernel.org>
| * ALSA: usb-audio: Fix double-free in error paths after ↵Vladis Dronov2016-11-112-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | snd_usb_add_audio_stream() call commit 836b34a935abc91e13e63053d0a83b24dfb5ea78 upstream. create_fixed_stream_quirk(), snd_usb_parse_audio_interface() and create_uaxx_quirk() functions allocate the audioformat object by themselves and free it upon error before returning. However, once the object is linked to a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be double-freed, eventually resulting in a memory corruption. This patch fixes these failures in the error paths by unlinking the audioformat object before freeing it. Based on a patch by Takashi Iwai <tiwai@suse.de> [Note for stable backports: this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()')] Change-Id: Ia332409f06bbd20c0abf9cf915f4a041200e4736 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358 Reported-by: Ralf Spenneberg <ralf@spenneberg.net> Signed-off-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| * ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()Takashi Iwai2016-11-111-11/+11
| | | | | | | | | | | | | | | | | | | | | | commit 902eb7fd1e4af3ac69b9b30f8373f118c92b9729 upstream. Just a minor code cleanup: unify the error paths. Change-Id: Idbac50c4d1602ea3b075c747a716cc6eab905b52 Signed-off-by: Takashi Iwai <tiwai@suse.de> [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| * ALSA: usb-audio: Fix NULL dereference in create_fixed_stream_quirk()Takashi Iwai2016-11-111-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 0f886ca12765d20124bd06291c82951fd49a33be upstream. create_fixed_stream_quirk() may cause a NULL-pointer dereference by accessing the non-existing endpoint when a USB device with a malformed USB descriptor is used. This patch avoids it simply by adding a sanity check of bNumEndpoints before the accesses. Change-Id: I94025f3eec256347b50805b388940774e559dae2 Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125 Signed-off-by: Takashi Iwai <tiwai@suse.de> [bwh: Backported to 3.2: - There's no altsd variable - Adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
generated by cgit v1.1 at 2024-04-23 18:47:49 +0000