The significant part here is a few security fixes for ALSA core
control API by Lars. Besides that, there are a few fixes for ASoC
sigmadsp (again by Lars) for building properly, and small fixes for
ASoC rsnd, MMP, PXA and FSL, in addition to a fix for bogus WARNING in
i915/HD-audio binding.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAABAgAGBQJToaZXAAoJEGwxgFQ9KSmkOs4QAKhoVqWoyz5ZPKXAKqFvD5Ix
JqWiuYgsoJYd3RENULQ5BdOY2pOXpi8j5a5YMfKFtePuZ4qJ6NNHLMSPiv9aYrcH
cmp/ZPPqP8NgeHyQxlVe8VmW6A12myz43wR2XegzLQVyFPMXkU2IoDKcjBzYK1b0
L6sNzBEo7BE+DDCAhipbNjdjLLAadKVyCr9N4gFWCX7/AqKhYZR1HcHtz31JjS0d
Krmz0eXVlSWM9wMCC/vl8cxSVzXmmu9Pir+tu7abfCLLRKCAeqZSdqcJcjsnm4wZ
zAd6h/S7tqXKpIc9VIMmZFoKKgVOh2e1kFvWOJnrD0h/yv5p4JgWwu2QvqcFbzJT
zMmn8Mm00bh9c+oo3Hr1k2Sn6muUBtW4IDGApWcttQb7asOROkDHwSG6hdhhrE8y
0TtV4mRHpxW/81+67MixVYSb6+LLZNEiSgm09wAVxzqtwpt4J+f2DWFAU+QeJVji
SZj6pdsvn6ApC7o3tJ477+bfsplJX/ajZBbIykO3bDsfVXwwbJ90YchtFHIbzRf0
cZcqMLiJBLYrZ7S2rDfJLq9YePeoosOaV1dYiNk/jOV55WoLVdPJg12IQdWR04En
Cfw2INma241thwXREwyXn4PZPL8D35x0tsJnm059fTfyXsQ3GgSmGn1LdmIrMXs7
3122r9ncyWXSK8w58Q04
=dWKL
-----END PGP SIGNATURE-----
Merge tag 'sound-3.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"The significant part here is a few security fixes for ALSA core
control API by Lars. Besides that, there are a few fixes for ASoC
sigmadsp (again by Lars) for building properly, and small fixes for
ASoC rsnd, MMP, PXA and FSL, in addition to a fix for bogus WARNING in
i915/HD-audio binding"
* tag 'sound-3.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: control: Make sure that id->index does not overflow
ALSA: control: Handle numid overflow
ALSA: control: Don't access controls outside of protected regions
ALSA: control: Fix replacing user controls
ALSA: control: Protect user controls against concurrent access
drm/i915, HD-audio: Don't continue probing when nomodeset is given
ASoC: fsl: Fix build problem
ASoC: rsnd: fixup index of src/dst mod when capture
ASoC: fsl_spdif: Fix integer overflow when calculating divisors
ASoC: fsl_spdif: Fix incorrect usage of regmap_read()
ASoC: dapm: Make sure register value is in sync with DAPM kcontrol state
ASoC: sigmadsp: Split regmap and I2C support into separate modules
ASoC: MMP audio needs sram support
ASoC: pxa: add I2C dependencies as needed
Pull drm fixes from Dave Airlie:
"This looks bigger than it is, as one of the nouveau firmware fixes
("drm/gf100-/gr: report class data to host on fwmthd failure")
regenerates a bunch of the firmware files after changing the assembly
by a few lines, without that, its more of a
36 files changed, 370 insertions(+), 129 deletions(-)
It contains some vt.c fixes acked by Greg, for rare hard hangs on i915
loading, that also fixes hangs on reload and spurious register write
errors.
drm core: one fix for uninit memory
nouveau: displayport rework caused a few regressions, Ben has been
fixing them as the appear, along with some other fixes
radeon: pageflipping regression fix, deep color fix, mode validation
fixes
i915: fbc disable, vga console kick off, backlight fix, divide-by-zero
fix"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (33 commits)
drm: fix uninitialized acquire_ctx fields (v2)
drm/radeon: Fix radeon_irq_kms_pflip_irq_get/put() imbalance
Revert "drm/radeon: remove drm_vblank_get|put from pflip handling"
drm/radeon: improve dvi_mode_valid
drm/radeon: update mode_valid testing for DP
drm/radeon: Use dce5/6 hdmi deep color clock setup also on dce8+
drm/nouveau/disp: fix oops in destructor with headless cards
drm/gf117/i2c: no aux channels on this chipset
drm/nouveau/doc: update the thermal documentation
drm/nouveau/pwr: fix typo in fifo wrap handling
drm/nv50/disp: fix a potential oops in supervisor handling
drm/nouveau/disp/dp: don't touch link config after success
drm/nouveau/kms: reference vblank for crtc during pageflip.
drm/gk104/fb/ram: fixups from an earlier search+replace
drm/nv50/gr: remove an unneeded write while initialising PGRAPH
drm/nv50/gr: fix overlap while zeroing zcull regions
drm/gf100-/gr: report class data to host on fwmthd failure
drm/gk104/ibus: increase various random timeouts
drm/gk104/clk: only touch divider for mode we'll be using
drm/radeon: Bypass hw lut's for > 8 bpc framebuffer scanout.
...
Pull block fixes from Jens Axboe:
"A smaller collection of fixes for the block core that would be nice to
have in -rc2. This pull request contains:
- Fixes for races in the wait/wakeup logic used in blk-mq from
Alexander. No issues have been observed, but it is definitely a
bit flakey currently. Alternatively, we may drop the cyclic
wakeups going forward, but that needs more testing.
- Some cleanups from Christoph.
- Fix for an oops in null_blk if queue_mode=1 and softirq completions
are used. From me.
- A fix for a regression caused by the chunk size setting. It
inadvertently used max_hw_sectors instead of max_sectors, which is
incorrect, and causes hangs on btrfs multi-disk setups (where hw
sectors apparently isn't set). From me.
- Removal of WQ_POWER_EFFICIENT in the kblockd creation. This was a
recent addition as well, but it actually breaks blk-mq which relies
on strict scheduling. If the workqueue power_efficient mode is
turned on, this breaks blk-mq. From Matias.
- null_blk module parameter description fix from Mike"
* 'for-linus' of git://git.kernel.dk/linux-block:
blk-mq: bitmap tag: fix races in bt_get() function
blk-mq: bitmap tag: fix race on blk_mq_bitmap_tags::wake_cnt
blk-mq: bitmap tag: fix races on shared ::wake_index fields
block: blk_max_size_offset() should check ->max_sectors
null_blk: fix softirq completions for queue_mode == 1
blk-mq: merge blk_mq_drain_queue and __blk_mq_drain_queue
blk-mq: properly drain stopped queues
block: remove WQ_POWER_EFFICIENT from kblockd
null_blk: fix name and description of 'queue_mode' module parameter
block: remove elv_abort_queue and blk_abort_flushes
A first set of bug fixes that didn't make it for the merge window, and
two Kconfig cleanups that still make sense at this point. Unfortunately,
one of the two cleanups caused an unintended change in the original
version, so we had to revert one part of it and do some more testing
to ensure the rest is really fine. There was also a last-minute
rebase of the patches to remove another bad commit.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIVAwUAU6BdV2CrR//JCVInAQJHhRAAuBdFsBo1TuP/s45PHzcldEcmrlMa2aNx
5t+qGxaYJW3DppW5Ql4L3O/74au77AcPpto8CwTRzshb2peXYwJ40RQXAyxPyE4z
a2yjtz7VwX5P/BNjQZJ1OZLuMiMbVVz3ObIpNiPzooXm/y52ZZQ20AALmJcX7mor
tAmdw3qmvy0L9SYikKd8qKuDTMLV6MWexa/fZn5AA5w11V3DWr/++/6+3g4+tQs8
N8l5vk9Ok/5l+f67Ta0+R4Vh9OIcLnwYSzOKKhKebwMvxXcwPEz5HfmOSH/m3Zu1
/dC4jWwB6Z95bevhJCoNaIf9b6s29EYy2lHw3nVRiQEFTmFACNgWjqFjiKa0aune
2cKAPZAf3w8R15LveT9SuSwtuH8yVFVHqOyzUlxmbFszIqgzKxF933R7SSxQpLTn
od5QVOqxMAMd4s6Jij7xgoF5GkvlKpfqEERKSz/Gt7I+ZINcxRhXXL55emy6IGmx
jjhQa83mMgFS70Ys4ARB0Fcd1Em4v/fCPJE8UpSQHQOG3fq3QcdyxsKG0cHUJNK6
ubS8W/XpQWvowJZ1YcnpYs3zAYchwueNPyCXVX9Hs3BTx7/3wnFfUNbdduD2GRVu
iruBt+B/4KLHmiLQyt1TqZO1elel/CT/ARGvRjo8zMFoo2WXbopv1pjm7AQQ0SSb
CtK7u+xxUa8=
=/Ylr
-----END PGP SIGNATURE-----
Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc
Pull ARM SoC fixes from Arnd Bergmann:
"A first set of bug fixes that didn't make it for the merge window, and
two Kconfig cleanups that still make sense at this point.
Unfortunately, one of the two cleanups caused an unintended change in
the original version, so we had to revert one part of it and do some
more testing to ensure the rest is really fine. There was also a
last-minute rebase of the patches to remove another bad commit"
* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
ARM: use menuconfig for sub-arch menus
ARM: multi_v7_defconfig: re-enable SDHCI drivers
ARM: EXYNOS: Fix compilation warning
ARM: exynos: move sysram info to exynos.c
ARM: dts: Specify the NAND ECC scheme explicitly on Armada 385 DB board
ARM: dts: Specify the NAND ECC scheme explicitly on Armada 375 DB board
ARM: exynos: cleanup kconfig option display
misc: vexpress: fix error handling vexpress_syscfg_regmap_init()
ARM: Remove ARCH_HAS_CPUFREQ config option
ARM: integrator: fix section mismatch problem
ARM: mvebu: DT: fix OpenBlocks AX3-4 RAM size
ARM: samsung: make SAMSUNG_DMADEV optional
remoteproc: da8xx: don't select CMA on no-MMU
bus/arm-cci: add dependency on OF && CPU_V7
ARM: keystone requires ARM_PATCH_PHYS_VIRT
ARM: omap2: fix am43xx dependency on l2x0 cache
Pull security maintainership update from James Morris:
"Add Serge Hallyn as security subsystem co-maintainer"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
security: add Serge Hallyn as a maintainer
arm64 tree)
- stack alignment exception entry code fix
- GHASH crypto algorithm fix and performance improvement
- CMA buffer limited to 32-bit (until a better way to describe the
system topology in DT)
- UAPI sigcontext.h build fix
- __kernel_old_{gid,uid}_t definitions fix (affecting 32-bit LTP)
- ptrace fixes (kernel fault and 32-bit arm core dump)
- pte_mknotpresent() fix
- dts updates (APM SoC)
- defconfig and Kconfig update
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iQIcBAABAgAGBQJTodfUAAoJEGvWsS0AyF7x3f8P/iDSM8Wf7AeoMOLrOiKdqgM8
gqhs9Np6sXpIXHfZbXdHuByRL+wIZlbhUlJ8BGAAcHuz2QqsnPUkQHa5O1TEPHZG
fSOuqM/FAF0C/EKvKzRNej6OqCoevMUCvHONphKemNiZZP8H7vktoI1PuGyl7Wsr
MBrd+lqIzbx17ppXNx9sPwcWumnxwSJAkjF0fJU7IR1yZv6Vg1USrc9cJJ5dLVUd
sBn9M0SBvCbZ63ovBoBeCiCtqTDk47m9v4Ae3Tw7A590yY7jE/vWb7MJxr0U+E0K
PDhCyoOTnWHpWqPH0GgpKAmu6QeZ15IOW2DM21zj3cP9YdFRSu8VPbSMCd5XSQE/
Jd4y2FWQJBlYsBLpD7OSXy4QdEZqY7bXYD7Ine1Rt5iM6Masnu3dFdQIOBE9Z5yu
p0x1JQVf8PHVbCvCqtLQu4V03oiElyplV6uJVh4qBlepa8Cjuk99l6W9jCV6v3EP
dSdHSOUkJI/hvhlNgCKVhacFVtseAA5Uo8ov/hZq2SFRSIQRjFVvVGGDfS0XR22d
4IlagY8fGvjShFdEk/gfIUyH7Jeo1y7k69QpOkYde1yvfUEgWkThqlCrLDOVPkcG
6UFaJ7qKs9GpipJmnq6Y2RZlEPsUgLLVoz5a2xMEpGCXUhpk8LlnhQA0TvxgoVLK
Q5/+tl3Fx/SVXHUZRswj
=yCGm
-----END PGP SIGNATURE-----
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Catalin Marinas:
"These are primarily bug fixes with a performance improvement patch for
the GHASH crypto algorithm (which went in during this merging window)
and dts/defconfig/Kconfig updates.
- ftrace_return_addr() macro fix for arm (introduced earlier via the
arm64 tree)
- stack alignment exception entry code fix
- GHASH crypto algorithm fix and performance improvement
- CMA buffer limited to 32-bit (until a better way to describe the
system topology in DT)
- UAPI sigcontext.h build fix
- __kernel_old_{gid,uid}_t definitions fix (affecting 32-bit LTP)
- ptrace fixes (kernel fault and 32-bit arm core dump)
- pte_mknotpresent() fix
- dts updates (APM SoC)
- defconfig and Kconfig update"
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64: mm: remove broken &= operator from pmd_mknotpresent
arm64: fix build error in sigcontext.h
arm64: dts: Add more serial port nodes in APM X-Gene device tree
arm64/dma: Removing ARCH_HAS_DMA_GET_REQUIRED_MASK macro
arm64: ptrace: fix empty registers set in prstatus of aarch32 process core
arm64: uid16: fix __kernel_old_{gid,uid}_t definitions
arm64: ptrace: change fs when passing kernel pointer to regset code
arm64: Limit the CMA buffer to 32-bit if ZONE_DMA
arm/ftrace: fix ftrace_return_addr() to ftrace_return_address()
arm64/crypto: improve performance of GHASH algorithm
arm64/crypto: fix data corruption bug in GHASH algorithm
arm64: defconfig update for LTP
arm64: ftrace: Fix comment typo 'CONFIG_FUNCTION_GRAPH_FP_TEST'
arm64: add ARCH_HAS_OPP to allow enabling OPP library
arm64: restore alphabetic order in Kconfig
arm64: Bug fix in stack alignment exception
First round of fixes for 3.16-rc, mostly cc: stable, and the vt/vgacon
fixes from Daniel [1] to avoid hangs and unclaimed register errors on
module load/reload.
* tag 'drm-intel-fixes-2014-06-17' of git://anongit.freedesktop.org/drm-intel:
drm/i915/bdw: remove erroneous chv specific workarounds from bdw code
drm/i915: fix possible refcount leak when resetting forcewake
drm/i915: Reorder semaphore deadlock check
drm/i95: Initialize active ring->pid to -1
drm/i915: set backlight duty cycle after backlight enable for gen4
drm/i915: Avoid div-by-zero when pixel_multiplier is zero
drm/i915: Disable FBC by default also on Haswell and later
drm/i915: Kick out vga console
drm/i915: Fixup global gtt cleanup
vt: Don't ignore unbind errors in vt_unbind
vt: Fix up unregistration of vt drivers
vt: Fix replacement console check when unbinding
The acquire ctx will typically be declared on the stack, which means we
could have garbage values for any uninitialized field. In this case, it
was triggering WARN_ON()s because 'contended' had garbage value.
Go ahead and use memset() to be more future-proof.
v2: now with extra brown paper bag
Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
mode validation, deep color and pageflipping fixes.
* 'drm-fixes-3.16' of git://people.freedesktop.org/~agd5f/linux:
drm/radeon: Fix radeon_irq_kms_pflip_irq_get/put() imbalance
Revert "drm/radeon: remove drm_vblank_get|put from pflip handling"
drm/radeon: improve dvi_mode_valid
drm/radeon: update mode_valid testing for DP
drm/radeon: Use dce5/6 hdmi deep color clock setup also on dce8+
Fixes a regression in 3.16-rc1 compared to 3.15.
The unbalanced calls would presumably result in the page flip interrupts
never getting disabled once they are enabled.
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This reverts commit 75f36d8619.
drm_vblank_get() is necessary to ensure the DRM vblank counter value is
up to date in drm_send_vblank_event().
Seems to fix weston hangs waiting for page flips to complete.
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Make sure we have an HDMI monitor before validating modes with
clocks >165 Mhz on single link connections.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Need to use the adjusted clock on dce8 as well.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=80029
Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This should be a plain old '&' and could easily lead to undefined
behaviour if the target of a pmd_mknotpresent invocation was the same
as the parameter.
Fixes: 9c7e535fcc (arm64: mm: Route pmd thp functions through pte equivalents)
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: <stable@vger.kernel.org> # v3.15
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Quite a few build coverage fixes in here among the usual small driver
fixes includling the sigmadsp change from Lars - moving the driver to
separate modules per bus (which is basically just code motion) avoids
issues with some combinations of buses being enabled.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJToCEOAAoJELSic+t+oim9hS8P/jtMAdaR3JO5R1qtg8qj1tO8
ati7DEhkKHn+9rSv4rBtfjqFk0Tdy4r9ulQAS88D9k3WGWpZgUf8wdfMWdL94s5I
WRJbvtcss7VGarfOAEreaqd3/PJ0buVLeUm+JNap794WW74BqPlfw6+JveWCAL1V
UfRlkQ+PwbU4f7ieXKrtpinOpffFY6hB6N19l+nPqyy0aCn5S/rv4SXUkcJ77slG
jOjM1yxg2/RR25LDRqm6uyi2032KwhQZEyP3OccxcRWIROzltqNa+biPJwjdpUlo
aVHQ2vICFovOC1WsWSEwjntkLvgYOJGP/50ecC2SqgL6QmvR03isUqSKzkIxigog
2+fMEeXEn7gtjQNpZFDk2Ku9DDbDR22SaRlrjaMOa/YMCc8ylSY1IXuL51IkEfip
tSWGOGvg7veYhVQtnxu7wSxtnK/Gb53ugRxFYba1f44bxOKl5KByPfSY22e65e2X
hVFqVDbikEszcU7AJxMVKvGb1bPF+RGTmlfL20IXnxs/OtGVx0FURZGKLAMagVXr
3Um0W4HzAipmCBW5NmbQu+gAWoOa17c9rILOc4IaIW5zCvv+V8AURaiwT5sHtUhU
JAeNIPIVadO7Lps+bgGT/Auisa8loFiYXFGOJecgcXPiMnZ+2jp7Gb3EgG5Gl8YQ
boxQMUoCp3d+I2+uAqpm
=oF1h
-----END PGP SIGNATURE-----
Merge tag 'asoc-v3.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Fixes for v3.16
Quite a few build coverage fixes in here among the usual small driver
fixes includling the sigmadsp change from Lars - moving the driver to
separate modules per bus (which is basically just code motion) avoids
issues with some combinations of buses being enabled.
The ALSA control code expects that the range of assigned indices to a control is
continuous and does not overflow. Currently there are no checks to enforce this.
If a control with a overflowing index range is created that control becomes
effectively inaccessible and unremovable since snd_ctl_find_id() will not be
able to find it. This patch adds a check that makes sure that controls with a
overflowing index range can not be created.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Each control gets automatically assigned its numids when the control is created.
The allocation is done by incrementing the numid by the amount of allocated
numids per allocation. This means that excessive creation and destruction of
controls (e.g. via SNDRV_CTL_IOCTL_ELEM_ADD/REMOVE) can cause the id to
eventually overflow. Currently when this happens for the control that caused the
overflow kctl->id.numid + kctl->count will also over flow causing it to be
smaller than kctl->id.numid. Most of the code assumes that this is something
that can not happen, so we need to make sure that it won't happen
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
A control that is visible on the card->controls list can be freed at any time.
This means we must not access any of its memory while not holding the
controls_rw_lock. Otherwise we risk a use after free access.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
There are two issues with the current implementation for replacing user
controls. The first is that the code does not check if the control is actually a
user control and neither does it check if the control is owned by the process
that tries to remove it. That allows userspace applications to remove arbitrary
controls, which can cause a user after free if a for example a driver does not
expect a control to be removed from under its feed.
The second issue is that on one hand when a control is replaced the
user_ctl_count limit is not checked and on the other hand the user_ctl_count is
increased (even though the number of user controls does not change). This allows
userspace, once the user_ctl_count limit as been reached, to repeatedly replace
a control until user_ctl_count overflows. Once that happens new controls can be
added effectively bypassing the user_ctl_count limit.
Both issues can be fixed by instead of open-coding the removal of the control
that is to be replaced to use snd_ctl_remove_user_ctl(). This function does
proper permission checks as well as decrements user_ctl_count after the control
has been removed.
Note that by using snd_ctl_remove_user_ctl() the check which returns -EBUSY at
beginning of the function if the control already exists is removed. This is not
a problem though since the check is quite useless, because the lock that is
protecting the control list is released between the check and before adding the
new control to the list, which means that it is possible that a different
control with the same settings is added to the list after the check. Luckily
there is another check that is done while holding the lock in snd_ctl_add(), so
we'll rely on that to make sure that the same control is not added twice.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The user-control put and get handlers as well as the tlv do not protect against
concurrent access from multiple threads. Since the state of the control is not
updated atomically it is possible that either two write operations or a write
and a read operation race against each other. Both can lead to arbitrary memory
disclosure. This patch introduces a new lock that protects user-controls from
concurrent access. Since applications typically access controls sequentially
than in parallel a single lock per card should be fine.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
I'm seeing this build failure for arm64:
CC [M] Documentation/filesystems/configfs/configfs_example_macros.o
In file included from /usr/include/bits/sigcontext.h:27:0,
from /usr/include/signal.h:340,
from /usr/include/sys/wait.h:30,
from Documentation/accounting/getdelays.c:24:
.../linux/usr/include/asm/sigcontext.h:61:2: error: unknown type name ‘u64’
u64 esr;
^
make[2]: *** [Documentation/accounting/getdelays] Error 1
This was introduced by commit 15af1942dd:
arm64: Expose ESR_EL1 information to user when SIGSEGV/SIGBUS
Using __u64 instead of u64 fixes the problem.
Signed-off-by: Mark Salter <msalter@redhat.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
APM X-Gene Storm SoC supports 4 serial ports. This patch adds device nodes
for serial ports 1 to 3 (a device node for serial port 0 is already present
in the dts file).
This patch also sets the compatible property of serial nodes to "ns16550a".
Signed-off-by: Vinayak Kale <vkale@apm.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Arm64 does not define dma_get_required_mask() function.
Therefore, it should not define the ARCH_HAS_DMA_GET_REQUIRED_MASK.
This causes build errors in some device drivers (e.g. mpt2sas)
Signed-off-by: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: <stable@vger.kernel.org>
Currently core file of aarch32 process prstatus note has empty
registers set. As result aarch32 core files create by V8 kernel are
not very useful.
It happens because compat_gpr_get and compat_gpr_set functions can
copy registers values to/from either kbuf or ubuf. ELF core file
collection function fill_thread_core_info calls compat_gpr_get
with kbuf set and ubuf set to 0. But current compat_gpr_get and
compat_gpr_set function handle copy to/from only ubuf case.
Fix is to handle kbuf and ubuf as two separate cases in similar
way as other functions like user_regset_copyout, user_regset_copyin do.
Signed-off-by: Victor Kamensky <victor.kamensky@linaro.org>
Acked-by: Will Deacon <will.deacon@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Whilst native arm64 applications don't have the 16-bit UID/GID syscalls
wired up, compat tasks can still access them. The 16-bit wrappers for
these syscalls use __kernel_old_uid_t and __kernel_old_gid_t, which must
be 16-bit data types to maintain compatibility with the 16-bit UIDs used
by compat applications.
This patch defines 16-bit __kernel_old_{gid,uid}_t types for arm64
instead of using the 32-bit types provided by asm-generic.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Our compat PTRACE_POKEUSR implementation simply passes the user data to
regset_copy_from_user after some simple range checking. Unfortunately,
the data in question has already been copied to the kernel stack by this
point, so the subsequent access_ok check fails and the ptrace request
returns -EFAULT. This causes problems tracing fork() with older versions
of strace.
This patch briefly changes the fs to KERNEL_DS, so that the access_ok
check passes even with a kernel address.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
When the CMA buffer is allocated, it is too early to know whether
devices will require ZONE_DMA memory. This patch limits the CMA buffer
to (DMA_BIT_MASK(32) + 1) if CONFIG_ZONE_DMA is enabled.
In addition, it computes the dma_to_phys(DMA_BIT_MASK(32)) before the
increment (no current functional change).
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
The clean up of CALLER_ADDR*() functions required the archs to either
use the default __builtin_return_address(X) (where X > 0) or override
it with something the arch can use. To override it, the arch would
define ftrace_return_address(x).
The arm architecture requires this to be redefined but instead of
defining ftrace_return_address(x) it defined ftrace_return_addr(x).
Fixes: eed542d696 (ftrace: Make CALLER_ADDRx macros more generic)
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Tested-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
This patches modifies the GHASH secure hash implementation to switch to a
faster, polynomial multiplication based reduction instead of one that uses
shifts and rotates.
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
This fixes a bug in the GHASH algorithm resulting in the calculated hash to be
incorrect if the input is presented in chunks whose size is not a multiple of
16 bytes.
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Fixes: fdd2389457 ("arm64/crypto: GHASH secure hash using ARMv8 Crypto Extensions")
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
The Operating Performance Point (OPP) Layer library is a generic
library used by CPUFREQ and DEVFREQ. It can be enabled only on the
platforms that specify ARCH_HAS_OPP option.
This patch selects that option in order to allow ARM64 based platforms
to use OPP library.
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
The value of ESR has been stored into x1, and should be directly pass to
do_sp_pc_abort function, "MOV x1, x25" is an extra operation and do_sp_pc_abort
will get the wrong value of ESR.
Signed-off-by: ChiaHao <andy.jhshiu@gmail.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: <stable@vger.kernel.org>
Commit aa8532c322 (xen: refactor suspend
pre/post hooks) broke resuming PVHVM (auto-translated physmap) guests.
The gnttab_suspend() would clear the mapping for the grant table
frames, but the ->unmap_frames() call is only applicable to PV guests.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Reported-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Tested-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Remove xen_enable_nmi() to fix a 64-bit guest crash when registering
the NMI callback on Xen 3.1 and earlier.
It's not needed since the NMI callback is set by a set_trap_table
hypercall (in xen_load_idt() or xen_write_idt_entry()).
It's also broken since it only set the current VCPU's callback.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Reported-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Tested-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Add Serge E. Hallyn <serge@hallyn.com> as a co-maintainer of the
security subsystem, to avoid having a single point of failure
in the development process.
Signed-off-by: James Morris <james.l.morris@oracle.com>
couple more DP regression fixes.
* 'drm-nouveau-next' of git://anongit.freedesktop.org/git/nouveau/linux-2.6:
drm/nouveau/disp: fix oops in destructor with headless cards
drm/gf117/i2c: no aux channels on this chipset
If init doesn't run then disp->outp might not be initialized, resulting
in an oops.
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This update fixes few issues in bt_get() function:
- list_empty(&wait.task_list) check is not protected;
- was_empty check is always true which results in *every* thread
entering the loop resets bt_wait_state::wait_cnt counter rather
than every bt->wake_cnt'th thread;
- 'bt_wait_state::wait_cnt' counter update is redundant, since
it also gets reset in bt_clear_tag() function;
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Ming Lei <tom.leiming@gmail.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Alexander Gordeev <agordeev@redhat.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
This piece of code in bt_clear_tag() function is racy:
bs = bt_wake_ptr(bt);
if (bs && atomic_dec_and_test(&bs->wait_cnt)) {
atomic_set(&bs->wait_cnt, bt->wake_cnt);
wake_up(&bs->wait);
}
Since nothing prevents bt_wake_ptr() from returning the very
same 'bs' address on multiple CPUs, the following scenario is
possible:
CPU1 CPU2
---- ----
0. bs = bt_wake_ptr(bt); bs = bt_wake_ptr(bt);
1. atomic_dec_and_test(&bs->wait_cnt)
2. atomic_dec_and_test(&bs->wait_cnt)
3. atomic_set(&bs->wait_cnt, bt->wake_cnt);
If the decrement in [1] yields zero then for some amount of time
the decrement in [2] results in a negative/overflow value, which
is not expected. The follow-up assignment in [3] overwrites the
invalid value with the batch value (and likely prevents the issue
from being severe) which is still incorrect and should be a lesser.
Cc: Ming Lei <tom.leiming@gmail.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Alexander Gordeev <agordeev@redhat.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Fix racy updates of shared blk_mq_bitmap_tags::wake_index
and blk_mq_hw_ctx::wake_index fields.
Cc: Ming Lei <tom.leiming@gmail.com>
Signed-off-by: Alexander Gordeev <agordeev@redhat.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Commit 762380ad93 inadvertently changed a check for max_sectors
to max_hw_sectors. Revert that part, so we still compare against
max_sectors.
Signed-off-by: Jens Axboe <axboe@fb.com>
- A fix in of_attach_node due to of_find_node_by_path changes
- Prevent format strings in DT kobject names
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAABAgAGBQJToLl9AAoJEMhvYp4jgsXiD2AH/1CEzQ0i7SKZsQOYKXpVwgDC
dsOfJo6C7vk3QIi8VvX0i7e97LxcrrQaozQKdO+topS+0yB9wxbW/3BB2r8dkuBX
EED64hAZ3qIMH6Iz3H9UbTQ7v7zW3dGyygayMgBlZH+pKC4mMrJKcrQxxdGacKXS
a2vaGPnmLuECPxVWMjRCLM3f08rqBUmmW+Ci0QMNl7j3LLfbbL/oX70u0BDaAAWe
DkixrPxpDxR6uuDt9dpVDRC5R7SyNJiUYEIFtOiaKmLWqJpvqviSxBk2F4ZIE4sQ
yvUfceGjD7CpHdiDFSruCmwQsZgCepZTF2D/LeYZhW0IWCKBW6AXZNlS/YdGXqo=
=PuNT
-----END PGP SIGNATURE-----
Merge tag 'dt-fixes-for-3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux
Pull device tree fixes from Rob Herring:
- fix microblaze compiling due to conflicting merge window changes
- a fix in of_attach_node due to of_find_node_by_path changes
- prevent format strings in DT kobject names
* tag 'dt-fixes-for-3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
OF: fix of_find_node_by_path() assumption that of_allnodes is root
of: avoid format string parsing in kobject names
of/platform: Fix microblaze build failure
