Commit Graph

447129 Commits

Author SHA1 Message Date
Viresh Kumar 407b158b99 workqueue: Add system wide power_efficient workqueues
This patch adds system wide workqueues aligned towards power saving. This is
done by allocating them with WQ_UNBOUND flag if 'wq_power_efficient' is set to
'true'.

tj: updated comments a bit.

Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
2019-07-27 22:11:01 +02:00
Viresh Kumar df8a9d39e7 workqueues: Introduce new flag WQ_POWER_EFFICIENT for power oriented workqueues
Workqueues can be performance or power-oriented. Currently, most workqueues are
bound to the CPU they were created on. This gives good performance (due to cache
effects) at the cost of potentially waking up otherwise idle cores (Idle from
scheduler's perspective. Which may or may not be physically idle) just to
process some work. To save power, we can allow the work to be rescheduled on a
core that is already awake.

Workqueues created with the WQ_UNBOUND flag will allow some power savings.
However, we don't change the default behaviour of the system.  To enable
power-saving behaviour, a new config option CONFIG_WQ_POWER_EFFICIENT needs to
be turned on. This option can also be overridden by the
workqueue.power_efficient boot parameter.

tj: Updated config description and comments.  Renamed
    CONFIG_WQ_POWER_EFFICIENT to CONFIG_WQ_POWER_EFFICIENT_DEFAULT.

Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Amit Kucheria <amit.kucheria@linaro.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
2019-07-27 22:11:01 +02:00
MSe 1251eb1446 drivers/muic: Fix '"WRITE" redefined' error after CVE-2019-2001 fix
Compile error:
In file included from kernel/samsung/gts2/drivers/muic/universal/muic_task.c:49:0:
 kernel/samsung/gts2/drivers/muic/universal/muic_debug.h:6:0: error: "WRITE" redefined [-Werror]
 #define WRITE 1
 ^
In file included from kernel/samsung/gts2/include/linux/seq_file.h:10:0,
                 from kernel/samsung/gts2/include/linux/pinctrl/pinctrl.h:19,
                 from kernel/samsung/gts2/include/asm-generic/gpio.h:8,
                 from kernel/samsung/gts2/arch/arm/include/asm/gpio.h:15,
                 from kernel/samsung/gts2/include/linux/gpio.h:45,
                 from kernel/samsung/gts2/drivers/muic/universal/muic_task.c:23:
 kernel/samsung/gts2/include/linux/fs.h:192:0: note: this is the location of the previous definition
 #define WRITE   RW_MASK

Fix is to change the define statements in drivers/muic/universal/muic_debug.h, used in
drivers/muic/universal/muic_i2c.c as follows WRITE >> DBG_WRITE, READ >> DBG_READ
to avoid the duplicate definition contradiction.

Change-Id: Ie2416adb3987fe16011fe1d14e24934218273a8a
2019-07-27 22:11:01 +02:00
syphyr 278c64a80a Revert "muic: Fix WRITE redefined compile error"
This reverts commit 3f40eaf1b9a3281929c141acc3fe495bb42863fc.
2019-07-27 22:11:00 +02:00
Wu Gao 436baac58f qcacld-2.0: Fix potential OOB read when indicate mgmt frame
In function __hdd_indicate_mgmt_frame, it doesn't check mgmt frame
length and access pointer to frame, which cause OOB read potentially.
So, check frame length before access pointer to frame.

Change-Id: Id2bd4276838f1eae49e8a24e8ab3361a69321a69
CRs-Fixed: 2429210
2019-07-27 22:11:00 +02:00
Brahmaji K 2d37893dce qseecom: Fix accessing userspace memory in kernel space
Use put_user API to write the data from kernel space to
userspace to avoid accessing userspace memory directly
in kernel space.

Bug: 65468973
Change-Id: I649fe2597e80ccad50cf16b355e220734810e94c
Signed-off-by: Brahmaji K <bkomma@codeaurora.org>
2019-07-27 22:11:00 +02:00
Vijay kumar Tumati 1287f1a46f msm: camera : Lock Implementation for avoid race condition
Lock Implementation for avoid race condition leading
to out-of-bound write in "msm_vb2_queue_setup

CRs-Fixed: 2362627
Change-Id: I7f7420c7437b9ac2f215929a8614b0846e890c98
Signed-off-by: Vijay kumar Tumati <vtumati@codeaurora.org>
2019-07-27 22:10:59 +02:00
Soumya Managoli 7f45834835 ASoC: msm: Modify buf size check to prevent OOB error
Expected buffer size to read is 2 bytes.
Corrected the size check to return error
when count is not 2.

Change-Id: I43b572d191f6f98a8a790b5ae77b43fabcd7329a
Signed-off-by: Soumya Managoli <smanag@codeaurora.org>
2019-07-27 22:10:59 +02:00
Xiaojun Sang e02c7a7eed dsp: asm: validate payload size before access
Payload size is not checked before payload access. Check size
to avoid out-of-boundary memory access.

Change-Id: Iaa39ee4ea5489bb5579e7b7d5dfada12d88c5809
Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
2019-07-27 22:10:59 +02:00
Karthikeyan Mani 8dc3bb6ce4 dsp: afe: check for payload size before payload access
Check if payload data is big enough before accessing
the data in it.

Change-Id: I939f205a8cebf6ef4859f81fae5429bca013d540
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
2019-07-27 22:10:58 +02:00
Vatsal Bucha a72aa003e4 dsp: asm: Add check for num_channels before calling q6asm_map_channels
Channel_mapping array size varies for different commands.
Add check for num_channels before calling q6asm_map_channels.

Change-Id: Iccbcfe82f716fc0ffe0a26b1779dcaa1c3cb805b
Signed-off-by: Rohit kumar <rohitkr@codeaurora.org>
Signed-off-by: Vatsal Bucha <vbucha@codeaurora.org>
2019-07-27 22:10:58 +02:00
Xiaojun Sang 9be69e398a dsp: validate token before usage as array index
Token from DSP might be invalid for array index. Validate
the token before being used as array index.

Change-Id: I9f47e1328d75d9f9acf7e85ddb452019b6eced0a
Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
2019-07-27 22:10:57 +02:00
Ajit Pandey 74e190f54e drivers: soc: qcom: Added check to avoid opening multiple instance
Opening of multiple instance of voice_svc user space from app will
lead to pointer deference of private data within apr callback. As
multi-instance not supported added check to deny open() from user
space if previous instance hasn't been closed.

Change-Id: Ia5ef16c69a517760fc9d45530a8a41a333fa2a21
Signed-off-by: Ajit Pandey <ajitp@codeaurora.org>
2019-07-27 22:10:57 +02:00
Rajesh Kemisetti b156e3861d msm: kgsl: Fix race condition while making page as dirty
set_page_dirty() is racy if the caller has no
reference against page->mapping->host, and if
the page is unlocked. This is because another
CPU could truncate the page off the mapping and
then free the mapping.

Use set_page_dirty_lock() to avoid this race condition.

Change-Id: I517fb9aee66560618c7676b311368f7a7498011f
Signed-off-by: Rajesh Kemisetti <rajeshk@codeaurora.org>
Signed-off-by: Archana Sriram <apsrir@codeaurora.org>
2019-07-27 22:10:57 +02:00
Manoj Prabhu B 07c5388313 diag: dci: Validate dci response length before parsing
Prevent possible out of bound access due to missing length check
while extracting dci packet response by adding proper checks.

CRs-Fixed: 2434571
Change-Id: I7b6972bf6559bdca99333a75d989cd6d3431b801
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
2019-07-27 22:10:56 +02:00
Jianmin Zhu d4886fefc4 cfg80211: Fix use after free when process wdev events
"bssid" is only initialized out of the while loop, in case of two
events with same type: EVENT_CONNECT_RESULT, but one has zero
ether addr, the other is non-zero, the bssid pointer will be
referenced twice, which lead to use-after-free issue

Change-Id: Ie8a24275f7ec5c2f936ef0a802a42e5f63be9c71
CRs-Fixed: 2254305
Signed-off-by: Zhu Jianmin <jianminz@codeaurora.org>
2019-07-27 22:10:56 +02:00
Vignesh Kulothungan dbb4420cbd msm: asm: validate ADSP data before access
Validate buffer index obtained from ADSP token before using it.

CRs-Fixed: 2372302
Change-Id: I5c3b1634bd08b516844638dd67f726a882edfc17
Signed-off-by: Vignesh Kulothungan <vigneshk@codeaurora.org>
2019-07-27 22:10:56 +02:00
Manoj Prabhu B aea54399b0 diag: dci: Validate dci client entries prior read
Validate the dci entries and its task structure before
accessing structure members to prevent copying dci data to
invalid entries.

Change-Id: I07c59ef0705bc52a8268b0dc984ebfa9d26d178e
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
2019-07-27 22:10:55 +02:00
kunleiz 358da63eb1 lsm: check payload size validity before using it as array index
Payload size validity is not checked before using it in array index.
Check payload size to avoid out-of-boundary memory.

Change-Id: Ic0b06bb331fc1753ff7543bb218ab12d6a4a3ca8
Signed-off-by: Kunlei Zhang <kunleiz@codeaurora.org>
2019-07-27 22:10:55 +02:00
Zhen Kong 1aaa82aefa qseecom: Add a new smc cmd to check RPMB key provision status
A new smc cmd is added to check RPMB key provision status

Change-Id: I50411bf9ae7f31589be34d7b5aaf48f2c12f0018
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
2019-07-27 22:10:55 +02:00
Vignesh Kulothungan 41ec0b6adb msm: adm: validate ADSP payload size before access
Check the size of ADSP payload before accessing it.

CRs-Fixed: 2380694
Change-Id: I52e74e5a86499ea61f8426f767948ce940d4d59c
Signed-off-by: Vignesh Kulothungan <vigneshk@codeaurora.org>
2019-07-27 22:10:54 +02:00
Vatsal Bucha acb7b45709 qdsp6v2: q6usm: Check size of payload before access
Check size of payload array before access in q6usm_callback.

Change-Id: Id0c85209a053f9dfdb53133aeb6b2510ecf18eb8
Signed-off-by: Vatsal Bucha <vbucha@codeaurora.org>
2019-07-27 22:10:54 +02:00
Vatsal Bucha 3befe291bf qdsp6v2: q6usm: Check size of payload before access
Check size of payload before access in q6usm_mmapcallback.

Change-Id: Iff0672532c2ea40e7129237a92d8365d6b554cf2
Signed-off-by: Vatsal Bucha <vbucha@codeaurora.org>
2019-07-27 22:10:54 +02:00
Vatsal Bucha c2a162f30b dsp: q6voice: Check size of shared memory buffer before access
Check buffer size in qdsp_cvs_callback before access in
ul_pkt.

Change-Id: Ic19994b46086709231656ec747d2df988b7a512f
Signed-off-by: Vatsal Bucha <vbucha@codeaurora.org>
2019-07-27 22:10:53 +02:00
Alexandre Belloni e411eea119 rtc: ensure rtc_set_alarm fails when alarms are not supported
[ Upstream commit abfdff44bc38e9e2ef7929f633fb8462632299d4 ]

When using RTC_ALM_SET or RTC_WKALM_SET with rtc_wkalrm.enabled not set,
rtc_timer_enqueue() is not called and rtc_set_alarm() may succeed but the
subsequent RTC_AIE_ON ioctl will fail. RTC_ALM_READ would also fail in that
case.

Ensure rtc_set_alarm() fails when alarms are not supported to avoid letting
programs think the alarms are working for a particular RTC when they are
not.

Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-07-27 22:10:53 +02:00
Vaibhav Jain 3068d94fba rtc: interface: Validate alarm-time before handling rollover
[ Upstream commit da96aea0ed177105cb13ee83b328f6c61e061d3f ]

In function __rtc_read_alarm() its possible for an alarm time-stamp to
be invalid even after replacing missing components with current
time-stamp. The condition 'alarm->time.tm_year < 70' will trigger this
case and will cause the call to 'rtc_tm_to_time64(&alarm->time)'
return a negative value for variable t_alm.

While handling alarm rollover this negative t_alm (assumed to seconds
offset from '1970-01-01 00:00:00') is converted back to rtc_time via
rtc_time64_to_tm() which results in this error log with seemingly
garbage values:

"rtc rtc0: invalid alarm value: -2-1--1041528741
2005511117:71582844:32"

This error was generated when the rtc driver (rtc-opal in this case)
returned an alarm time-stamp of '00-00-00 00:00:00' to indicate that
the alarm is disabled. Though I have submitted a separate fix for the
rtc-opal driver, this issue may potentially impact other
existing/future rtc drivers.

To fix this issue the patch validates the alarm time-stamp just after
filling up the missing datetime components and if rtc_valid_tm() still
reports it to be invalid then bails out of the function without
handling the rollover.

Reported-by: Steve Best <sbest@redhat.com>
Signed-off-by: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-07-27 22:10:52 +02:00
Hyogi Gim 91dae411e5 drivers/rtc/interface.c: check the error after __rtc_read_time()
In __rtc_set_alarm(), the error after __rtc_read_time() is not checked.
If rtc device fail to read time, we cannot guarantee the following
process.

Add the verification code for returned __rtc_read_time() error.

Signed-off-by: Hyogi Gim <hyogi.gim@lge.com>
Acked-by: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-07-27 22:10:52 +02:00
Alessandro Zummo a8d8007d37 rtc: verify a critical argument to rtc_update_irq() before using it
This small addition to the core simplifies code in the drivers and makes
them more robust when handling shared IRQs.

Signed-off-by: Alessandro Zummo <a.zummo@towertech.it>
Cc: Alexander Shiyan <shc_work@mail.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-07-27 22:10:52 +02:00
Ales Novak 076926d16a drivers/rtc/interface.c: fix infinite loop in initializing the alarm
In __rtc_read_alarm(), if the alarm time retrieved by
rtc_read_alarm_internal() from the device contains invalid values (e.g.
month=2,mday=31) and the year not set (=-1), the initialization will
loop infinitely because the year-fixing loop expects the time being
invalid due to leap year.

Fix reduces the loop to the leap years and adds final validity check.

Signed-off-by: Ales Novak <alnovak@suse.cz>
Acked-by: Alessandro Zummo <a.zummo@towertech.it>
Reported-by: Jiri Bohac <jbohac@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-07-27 22:10:51 +02:00
Chris Brand d40712d6de drivers/rtc/interface.c: return -EBUSY, not -EACCES when device is busy
If rtc->irq_task is non-NULL and task is NULL, they always
rtc_irq_set_freq(), whenever err is set to -EBUSY it will then immediately
be set to -EACCES, misleading the caller as to the underlying problem.

Signed-off-by: Chris Brand <chris.brand@broadcom.com>
Acked-by: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-07-27 22:10:51 +02:00
Sachin Kamat 4a28334129 drivers/rtc/interface.c: fix checkpatch errors
Fixes the following types of errors:
  ERROR: "foo* bar" should be "foo *bar"
  ERROR: else should follow close brace '}'
  WARNING: braces {} are not necessary for single statement blocks

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Cc: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-07-27 22:10:50 +02:00
Zoran Markovic e06855f862 rtc: Keep system awake until all expired RTC timers are handled
Current implementation of RTC interface allows for system suspend to
occur in the following cases:
(a) if a timer is set in the past and rtc_timer_do_work() is scheduled
to handle it, and
(b) if rtc_timer_do_work() is called to handle expired timers whose
handlers implement a preemption point.

A pending suspend request may be honoured in the above cases causing
timer handling to be delayed until after the next resume. This is
undesirable since timer handlers may have time-critical code to execute.

This patch makes sure that the system stays awake until all expired
timers are handled.

Note that all calls to pm_stay_awake() are eventually paired with
the single pm_relax() call in rtc_timer_do_work(), which is launched
using schedule_work().

Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: John Stultz <john.stultz@linaro.org>
Cc: Arve Hjonnevag <arve@android.com>
Cc: Todd Poynor <toddpoynor@google.com>
Signed-off-by: Zoran Markovic <zoran.markovic@linaro.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
2019-07-27 22:10:50 +02:00
Liangwei Dong 75aacddda2 Revert "qcacld-2.0: Fix sme active list timeout casued by delete sta request"
This reverts commit I3228badf66eeef627d7d3ff632bac1e0c90df1e5.

The orignal commit wants to fix below issue.
In some corner cases, delete sta request processing wma handler didn't sent
The response, the commands in active list will not be removed and timeout.

In current code when plugging out TF USB card in wow mode, driver
will crash due to double free the memory tpDelStaSelfParams.

The first time memory free happens as below.
When handling WDA_DEL_STA_SELF_REQ in wma_vdev_detach,
tpDelStaSelfParams is saved to iface->del_staself_req
since the vdev is still in started state. At the same
time an event <WDA_DEL_STA_SELF_RSP> with parameter
tpDelStaSelfParams is delivered, in which the
tpDelStaSelfParams is freed.
The second time memory free is in the wma_wmi_service_close
since the iface->del_staself_req is not NULL.

In normal case the iface->del_staself_req will be processed
later in wma_vdev_stop_ind, then the <WDA_DEL_STA_SELF_RSP>
event will be delivered in wma_vdev_detach_callback.
The WDA_DEL_STA_SELF_RSP event delivery in wma_vdev_detach
is unnecessary and duplicated.
If revert this change, no crash happens when plugging out TF USB card
in wow mode.

Change-Id: Ib844dd88f3a8b4496f9878b8a1fcddd72acc6a57
CRs-Fixed: 1023548
2019-07-27 22:10:49 +02:00
Selvaraj, Sridhar dcb2493c0b qcacld-2.0: Fix layer violations in SME layer
Some of the SME APIs are using LIM APIs, remove those
violations

Change-Id: I069bb328ee38078bdc0497cd4663e1ee287aa3ee
CRs-Fixed: 997473
2019-07-27 22:10:49 +02:00
Komal Seelam 3455cd9129 qcacld-2.0: Configure SSDP address to FW as WoW pattern or MC list
Incoming Data packets are filtered by FW during WoW based on the pattern
configuration done by host.

The incoming packet is filtered out to Multicast list if configured,
else it looks for other patterns that are configured.

SSDP pattern is not configured along with Multicast List, instead it
is configured as a normal WoW pattern during system/runtime suspend.
So, all the ssdp packets are dropped by FW during WoW.

To address this, host should configure the SSDP pattern as a Multicast
filter if Multicast filter is enabled in ini, else configure it as a
normal WoW Pattern. Hence the fix.

Change-Id: I64aa30832999a779591bdfce02e13545a6cbf4f2
CRs-Fixed: 1010542
2019-07-27 22:10:48 +02:00
Selvaraj, Sridhar 2017373446 qcacld-2.0: Check if vdev is created before LL stats query
Link Layer(LL) stats query is received in host in a corner/race condition
between the events "change iface" and "start ap" in HDD where vdev is not
created yet ie.as part of "change iface" in HDD, host does close session
(VDEV DELETE) and as part of start ap, host invokes open session(VDEV
CREATE). It leads to an exception issue in firmware since FW receives
REQUEST_LINK_STATS WMI for a deleted VDEV.

This fix adds a boolean variable vdev_active to vdev structure(wma_txrx_node),
which is set to true once vdev is created. vdev_active is checked for TRUE
before sending LL stats query to FW with WMI command.

Change-Id: Ifcc986c3352e4e66da35b8d6c489d98dbe61401d
CRs-Fixed: 987734
2019-07-27 22:10:48 +02:00
Krishna Kumaar Natarajan 528d045c0a qcacld-2.0: Fix layering violation in sirApi.h
Fix layering violation in sirApi.h by renaming
enumeration prefixed with LIM.

Change-Id: I8b33fbb6d315c54c8cd483bd89685719e460051a
CRs-Fixed: 995039
2019-07-27 22:10:47 +02:00
Hanumantha Reddy Pothula f39a217534 qcacld-2.0: Resolve static analysis issues
prima to qcacld-2.0 propagation

Resolved  static analysis issues,  variable initialization,
return on failure, validate data before using.

Change-Id: Ia6ffd422ae3f9bc8419f32aa914839a091841335
CRs-Fixed: 975049
2019-07-27 22:10:47 +02:00
Masti, Narayanraddi 3ab57a6c87 qcacld-2.0: Update QOS capability of TDLS station/link with TL
Currently, the QOS capability of the TDLS link is updated
based on the BSS capability. Thus, if the BSS is not QOS
capable, the TDLS link eventually is not considered as QOS capable.
To address this, update the TDLS link with the TL with the
QOS capability based on the TDLS handshake between the peers.
The information of QOS is obtained to the driver through
the change_station callback from the supplicant and thus
the information is updated to the TL accordingly.
Also, this commit advertises that the station is QOS capable
by default in the TDLS setup request /response handshakes.

Change-Id: I6a36fd77b333e66e8c030f5230b4aaaee6d7a00c
CRs-Fixed: 776081
2019-07-27 22:10:46 +02:00
c_zding e26755ec3e qcacld-2.0: Add presence check for structure tDot11fQosMapConfigure
Current logic use the "not present" structure tDot11fQosMapConfigure
to calculate the array index which lead to the array overflow and
crash of VosMCThread. Add check code to avoid this problem.

Change-Id: Ifa08b24a06e409fed1bd445574127fef02f21d19
CRs-Fixed: 978582
2019-07-27 22:10:46 +02:00
Gupta, Kapil d23fea4e24 qcacld-2.0: Remove extra spaces between two lines
prima to qcacld-2.0 propagation

Currently there are many logs which adds new line
explicitly. As part of logging enhancement, remove
such extra space lines.

Change-Id: Idee9ff6a2e0452991f7d50a986c26f36303defd1
CRs-Fixed: 974415
2019-07-27 22:10:45 +02:00
lifeng 7edcc2e072 qcacld-2.0: Fix possible buffer overflow in sirConvertAddtsRsp2Struct
propagation from qcacld-3.0 to qcacld-2.0

In the function sirConvertAddtsRsp2Struct, iterator j is
assigned with the value pAddTs->numTclas + addts.num_WMMTCLAS.
The j value is used as the index to the array pAddTs->tclasInfo.
Maximum limit on  pAddTs->tclasInfo entries is 2. So when the
value of j exceeds 2, then a possible buffer overflow could
occur.

Validate the value of j against SIR_MAC_TCLASIE_MAXNUM(2).

Change-Id: Icc723380ed4ccd51c729194d509e288be0e0712c
CRs-Fixed: 2419829
2019-07-27 22:10:45 +02:00
Dan Williams d165612289 init: initialize jump labels before command line option parsing
[ Upstream commit 6041186a32585fc7a1d0f6cfe2f138b05fdc3c82 ]

When a module option, or core kernel argument, toggles a static-key it
requires jump labels to be initialized early.  While x86, PowerPC, and
ARM64 arrange for jump_label_init() to be called before parse_args(),
ARM does not.

  Kernel command line: rdinit=/sbin/init page_alloc.shuffle=1 panic=-1 console=ttyAMA0,115200 page_alloc.shuffle=1
  ------------[ cut here ]------------
  WARNING: CPU: 0 PID: 0 at ./include/linux/jump_label.h:303
  page_alloc_shuffle+0x12c/0x1ac
  static_key_enable(): static key 'page_alloc_shuffle_key+0x0/0x4' used
  before call to jump_label_init()
  Modules linked in:
  CPU: 0 PID: 0 Comm: swapper Not tainted
  5.1.0-rc4-next-20190410-00003-g3367c36ce744 #1
  Hardware name: ARM Integrator/CP (Device Tree)
  [<c0011c68>] (unwind_backtrace) from [<c000ec48>] (show_stack+0x10/0x18)
  [<c000ec48>] (show_stack) from [<c07e9710>] (dump_stack+0x18/0x24)
  [<c07e9710>] (dump_stack) from [<c001bb1c>] (__warn+0xe0/0x108)
  [<c001bb1c>] (__warn) from [<c001bb88>] (warn_slowpath_fmt+0x44/0x6c)
  [<c001bb88>] (warn_slowpath_fmt) from [<c0b0c4a8>]
  (page_alloc_shuffle+0x12c/0x1ac)
  [<c0b0c4a8>] (page_alloc_shuffle) from [<c0b0c550>] (shuffle_store+0x28/0x48)
  [<c0b0c550>] (shuffle_store) from [<c003e6a0>] (parse_args+0x1f4/0x350)
  [<c003e6a0>] (parse_args) from [<c0ac3c00>] (start_kernel+0x1c0/0x488)

Move the fallback call to jump_label_init() to occur before
parse_args().

The redundant calls to jump_label_init() in other archs are left intact
in case they have static key toggling use cases that are even earlier
than option parsing.

Link: http://lkml.kernel.org/r/155544804466.1032396.13418949511615676665.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Reported-by: Guenter Roeck <groeck@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: Russell King <rmk@armlinux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-07-27 22:10:45 +02:00
Daniel Thompson 0d5cf975f5 param: fix crash on bad kernel arguments
commit 3438cf549d2f3ee8e52c82acc8e2a9710ac21a5b upstream.

Currently if the user passes an invalid value on the kernel command line
then the kernel will crash during argument parsing. On most systems this
is very hard to debug because the console hasn't been initialized yet.

This is a regression due to commit 51e158c12aca ("param: hand arguments
after -- straight to init") which, in response to the systemd debug
controversy, made it possible to explicitly pass arguments to init. To
achieve this parse_args() was extended from simply returning an error
code to returning a pointer. Regretably the new init args logic does not
perform a proper validity check on the pointer resulting in a crash.

This patch fixes the validity check. Should the check fail then no arguments
will be passed to init. This is reasonable and matches how the kernel treats
its own arguments (i.e. no error recovery).

Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
2019-07-27 22:10:44 +02:00
Rusty Russell 71b23d898f param: hand arguments after -- straight to init
The kernel passes any args it doesn't need through to init, except it
assumes anything containing '.' belongs to the kernel (for a module).
This change means all users can clearly distinguish which arguments
are for init.

For example, the kernel uses debug ("dee-bug") to mean log everything to
the console, where systemd uses the debug from the Scandinavian "day-boog"
meaning "fail to boot".  If a future versions uses argv[] instead of
reading /proc/cmdline, this confusion will be avoided.

eg: test 'FOO="this is --foo"' -- 'systemd.debug="true true true"'

Gives:
argv[0] = '/debug-init'
argv[1] = 'test'
argv[2] = 'systemd.debug=true true true'
envp[0] = 'HOME=/'
envp[1] = 'TERM=linux'
envp[2] = 'FOO=this is --foo'

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2019-07-27 22:10:44 +02:00
Michael Opdenacker 8717f50c9f init: make init failures more explicit
This patch proposes to make init failures more explicit.

Before this, the "No init found" message didn't help much.  It could
sometimes be misleading and actually mean "No *working* init found".

This message could hide many different issues:
 - no init program candidates found at all
 - some init program candidates exist but can't be executed (missing
   execute permissions, failed to load shared libraries, executable
   compiled for an unknown architecture...)

This patch notifies the kernel user when a candidate init program is found
but can't be executed.  In each failure situation, the error code is
displayed, to quickly find the root cause.  "No init found" is also
replaced by "No working init found", which is more correct.

This will help embedded Linux developers (especially the newcomers),
regularly making and debugging new root filesystems.

Credits to Geert Uytterhoeven and Janne Karhunen for their improvement
suggestions.

Signed-off-by: Michael Opdenacker <michael.opdenacker@free-electrons.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Tested-by: Janne Karhunen <Janne.Karhunen@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-07-27 22:10:43 +02:00
Rusty Russell 61a36c372b modules: don't fail to load on unknown parameters.
Although parameters are supposed to be part of the kernel API, experimental
parameters are often removed.  In addition, downgrading a kernel might cause
previously-working modules to fail to load.

On balance, it's probably better to warn, and load the module anyway.
This may let through a typo, but at least the logs will show it.

Reported-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2019-07-27 22:10:43 +02:00
Po-Hsu Lin 49201f3fce selftests/net: correct the return value for run_netsocktests
[ Upstream commit 30c04d796b693e22405c38e9b78e9a364e4c77e6 ]

The run_netsocktests will be marked as passed regardless the actual test
result from the ./socket:

    selftests: net: run_netsocktests
    ========================================
    --------------------
    running socket test
    --------------------
    [FAIL]
    ok 1..6 selftests: net: run_netsocktests [PASS]

This is because the test script itself has been successfully executed.
Fix this by exit 1 when the test failed.

Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-07-27 22:10:42 +02:00
Rikard Falkeborn f005b05b03 tools lib traceevent: Fix missing equality check for strcmp
[ Upstream commit f32c2877bcb068a718bb70094cd59ccc29d4d082 ]

There was a missing comparison with 0 when checking if type is "s64" or
"u64". Therefore, the body of the if-statement was entered if "type" was
"u64" or not "s64", which made the first strcmp() redundant since if
type is "u64", it's not "s64".

If type is "s64", the body of the if-statement is not entered but since
the remainder of the function consists of if-statements which will not
be entered if type is "s64", we will just return "val", which is
correct, albeit at the cost of a few more calls to strcmp(), i.e., it
will behave just as if the if-statement was entered.

If type is neither "s64" or "u64", the body of the if-statement will be
entered incorrectly and "val" returned. This means that any type that is
checked after "s64" and "u64" is handled the same way as "s64" and
"u64", i.e., the limiting of "val" to fit in for example "s8" is never
reached.

This was introduced in the kernel tree when the sources were copied from
trace-cmd in commit f7d82350e5 ("tools/events: Add files to create
libtraceevent.a"), and in the trace-cmd repo in 1cdbae6035cei
("Implement typecasting in parser") when the function was introduced,
i.e., it has always behaved the wrong way.

Detected by cppcheck.

Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com>
Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Cc: Tzvetomir Stoyanov <tstoyanov@vmware.com>
Fixes: f7d82350e5 ("tools/events: Add files to create libtraceevent.a")
Link: http://lkml.kernel.org/r/20190409091529.2686-1-rikard.falkeborn@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-07-27 22:10:42 +02:00
Francesco Ruggeri 05aa559283 netfilter: compat: initialize all fields in xt_init
commit 8d29d16d21342a0c86405d46de0c4ac5daf1760f upstream

If a non zero value happens to be in xt[NFPROTO_BRIDGE].cur at init
time, the following panic can be caused by running

% ebtables -t broute -F BROUTING

from a 32-bit user level on a 64-bit kernel. This patch replaces
kmalloc_array with kcalloc when allocating xt.

[  474.680846] BUG: unable to handle kernel paging request at 0000000009600920
[  474.687869] PGD 2037006067 P4D 2037006067 PUD 2038938067 PMD 0
[  474.693838] Oops: 0000 [#1] SMP
[  474.697055] CPU: 9 PID: 4662 Comm: ebtables Kdump: loaded Not tainted 4.19.17-11302235.AroraKernelnext.fc18.x86_64 #1
[  474.707721] Hardware name: Supermicro X9DRT/X9DRT, BIOS 3.0 06/28/2013
[  474.714313] RIP: 0010:xt_compat_calc_jump+0x2f/0x63 [x_tables]
[  474.720201] Code: 40 0f b6 ff 55 31 c0 48 6b ff 70 48 03 3d dc 45 00 00 48 89 e5 8b 4f 6c 4c 8b 47 60 ff c9 39 c8 7f 2f 8d 14 08 d1 fa 48 63 fa <41> 39 34 f8 4c 8d 0c fd 00 00 00 00 73 05 8d 42 01 eb e1 76 05 8d
[  474.739023] RSP: 0018:ffffc9000943fc58 EFLAGS: 00010207
[  474.744296] RAX: 0000000000000000 RBX: ffffc90006465000 RCX: 0000000002580249
[  474.751485] RDX: 00000000012c0124 RSI: fffffffff7be17e9 RDI: 00000000012c0124
[  474.758670] RBP: ffffc9000943fc58 R08: 0000000000000000 R09: ffffffff8117cf8f
[  474.765855] R10: ffffc90006477000 R11: 0000000000000000 R12: 0000000000000001
[  474.773048] R13: 0000000000000000 R14: ffffc9000943fcb8 R15: ffffc9000943fcb8
[  474.780234] FS:  0000000000000000(0000) GS:ffff88a03f840000(0063) knlGS:00000000f7ac7700
[  474.788612] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
[  474.794632] CR2: 0000000009600920 CR3: 0000002037422006 CR4: 00000000000606e0
[  474.802052] Call Trace:
[  474.804789]  compat_do_replace+0x1fb/0x2a3 [ebtables]
[  474.810105]  compat_do_ebt_set_ctl+0x69/0xe6 [ebtables]
[  474.815605]  ? try_module_get+0x37/0x42
[  474.819716]  compat_nf_setsockopt+0x4f/0x6d
[  474.824172]  compat_ip_setsockopt+0x7e/0x8c
[  474.828641]  compat_raw_setsockopt+0x16/0x3a
[  474.833220]  compat_sock_common_setsockopt+0x1d/0x24
[  474.838458]  __compat_sys_setsockopt+0x17e/0x1b1
[  474.843343]  ? __check_object_size+0x76/0x19a
[  474.847960]  __ia32_compat_sys_socketcall+0x1cb/0x25b
[  474.853276]  do_fast_syscall_32+0xaf/0xf6
[  474.857548]  entry_SYSENTER_compat+0x6b/0x7a

Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Zubin Mithra <zsm@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-07-27 22:10:42 +02:00