1. 09 Nov, 2018 10 commits
  2. 08 Nov, 2018 12 commits
  3. 07 Nov, 2018 11 commits
  4. 06 Nov, 2018 7 commits
    • Boris Brezillon's avatar
      mtd: nand: Fix nanddev_pos_next_page() kernel-doc header · 98ee3fc7
      Boris Brezillon authored
      Function name is wrong in the kernel-doc header.
      
      Fixes: 9c3736a3
      
       ("mtd: nand: Add core infrastructure to deal with NAND devices")
      Signed-off-by: default avatarBoris Brezillon <boris.brezillon@bootlin.com>
      Reviewed-by: default avatarMiquel Raynal <miquel.raynal@bootlin.com>
      98ee3fc7
    • Linus Torvalds's avatar
      Merge tag 'trace-v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 8053e5b9
      Linus Torvalds authored
      Pull tracing fix from Steven Rostedt:
       "Masami found a slight bug in his code where he transposed the
        arguments of a call to strpbrk.
      
        The reason this wasn't detected in our tests is that the only way this
        would transpire is when a kprobe event with a symbol offset is
        attached to a function that belongs to a module that isn't loaded yet.
        When the kprobe trace event is added, the offset would be truncated
        after it was parsed, and when the module is loaded, it would use the
        symbol without the offset (as the nul character added by the parsing
        would not be replaced with the original character)"
      
      * tag 'trace-v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing/kprobes: Fix strpbrk() argument order
      8053e5b9
    • Linus Torvalds's avatar
      Merge branch 'spectre' of git://git.armlinux.org.uk/~rmk/linux-arm · 4581aa96
      Linus Torvalds authored
      Pull ARM fix from Russell King:
       "Ard spotted a typo in one of the assembly files which leads to a
        kernel oops when that code path is executed. Fix this"
      
      * 'spectre' of git://git.armlinux.org.uk/~rmk/linux-arm:
        ARM: 8809/1: proc-v7: fix Thumb annotation of cpu_v7_hvc_switch_mm
      4581aa96
    • Dave Chinner's avatar
      xfs: fix overflow in xfs_attr3_leaf_verify · 837514f7
      Dave Chinner authored
      generic/070 on 64k block size filesystems is failing with a verifier
      corruption on writeback or an attribute leaf block:
      
      [   94.973083] XFS (pmem0): Metadata corruption detected at xfs_attr3_leaf_verify+0x246/0x260, xfs_attr3_leaf block 0x811480
      [   94.975623] XFS (pmem0): Unmount and run xfs_repair
      [   94.976720] XFS (pmem0): First 128 bytes of corrupted metadata buffer:
      [   94.978270] 000000004b2e7b45: 00 00 00 00 00 00 00 00 3b ee 00 00 00 00 00 00  ........;.......
      [   94.980268] 000000006b1db90b: 00 00 00 00 00 81 14 80 00 00 00 00 00 00 00 00  ................
      [   94.982251] 00000000433f2407: 22 7b 5c 82 2d 5c 47 4c bb 31 1c 37 fa a9 ce d6  "{\.-\GL.1.7....
      [   94.984157] 0000000010dc7dfb: 00 00 00 00 00 81 04 8a 00 0a 18 e8 dd 94 01 00  ................
      [   94.986215] 00000000d5a19229: 00 a0 dc f4 fe 98 01 68 f0 d8 07 e0 00 00 00 00  .......h........
      [   94.988171] 00000000521df36c: 0c 2d 32 e2 fe 20 01 00 0c 2d 58 65 fe 0c 01 00  .-2.. ...-Xe....
      [   94.990162] 000000008477ae06: 0c 2d 5b 66 fe 8c 01 00 0c 2d 71 35 fe 7c 01 00  .-[f.....-q5.|..
      [   94.992139] 00000000a4a6bca6: 0c 2d 72 37 fc d4 01 00 0c 2d d8 b8 f0 90 01 00  .-r7.....-......
      [   94.994789] XFS (pmem0): xfs_do_force_shutdown(0x8) called from line 1453 of file fs/xfs/xfs_buf.c. Return address = ffffffff815365f3
      
      This is failing this check:
      
                      end = ichdr.freemap[i].base + ichdr.freemap[i].size;
                      if (end < ichdr.freemap[i].base)
      >>>>>                   return __this_address;
                      if (end > mp->m_attr_geo->blksize)
                              return __this_address;
      
      And from the buffer output above, the freemap array is:
      
      	freemap[0].base = 0x00a0
      	freemap[0].size = 0xdcf4	end = 0xdd94
      	freemap[1].base = 0xfe98
      	freemap[1].size = 0x0168	end = 0x10000
      	freemap[2].base = 0xf0d8
      	freemap[2].size = 0x07e0	end = 0xf8b8
      
      These all look valid - the block size is 0x10000 and so from the
      last check in the above verifier fragment we know that the end
      of freemap[1] is valid. The problem is that end is declared as:
      
      	uint16_t	end;
      
      And (uint16_t)0x10000 = 0. So we have a verifier bug here, not a
      corruption. Fix the verifier to use uint32_t types for the check and
      hence avoid the overflow.
      
      Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=201577
      
      Signed-off-by: default avatarDave Chinner <dchinner@redhat.com>
      Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      837514f7
    • Darrick J. Wong's avatar
      xfs: print buffer offsets when dumping corrupt buffers · bdec055b
      Darrick J. Wong authored
      
      
      Use DUMP_PREFIX_OFFSET when printing hex dumps of corrupt buffers
      because modern Linux now prints a 32-bit hash of our 64-bit pointer when
      using DUMP_PREFIX_ADDRESS:
      
      00000000b4bb4297: 00 00 00 00 00 00 00 00 3b ee 00 00 00 00 00 00  ........;.......
      00000005ec77e26: 00 00 00 00 02 d0 5a 00 00 00 00 00 00 00 00 00  ......Z.........
      000000015938018: 21 98 e8 b4 fd de 4c 07 bc ea 3c e5 ae b4 7c 48  !.....L...<...|H
      
      This is totally worthless for a sequential dump since we probably only
      care about tracking the buffer offsets and afaik there's no way to
      recover the actual pointer from the hashed value.
      Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      Reviewed-by: default avatarDave Chinner <dchinner@redhat.com>
      bdec055b
    • Christophe JAILLET's avatar
      xfs: Fix error code in 'xfs_ioc_getbmap()' · 132bf672
      Christophe JAILLET authored
      In this function, once 'buf' has been allocated, we unconditionally
      return 0.
      However, 'error' is set to some error codes in several error handling
      paths.
      Before commit 232b5194 ("xfs: simplify the xfs_getbmap interface")
      this was not an issue because all error paths were returning directly,
      but now that some cleanup at the end may be needed, we must propagate the
      error code.
      
      Fixes: 232b5194
      
       ("xfs: simplify the xfs_getbmap interface")
      Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      132bf672
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · a13511df
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Handle errors mid-stream of an all dump, from Alexey Kodanev.
      
       2) Fix build of openvswitch with certain combinations of netfilter
          options, from Arnd Bergmann.
      
       3) Fix interactions between GSO and BQL, from Eric Dumazet.
      
       4) Don't put a '/' in RTL8201F's sysfs file name, from Holger
          Hoffstätte.
      
       5) S390 qeth driver fixes from Julian Wiedmann.
      
       6) Allow ipv6 link local addresses for netconsole when both source and
          destination are link local, from Matwey V. Kornilov.
      
       7) Fix the BPF program address seen in /proc/kallsyms, from Song Liu.
      
       8) Initialize mutex before use in dsa microchip driver, from Tristram
          Ha.
      
       9) Out-of-bounds access in hns3, from Yunsheng Lin.
      
      10) Various netfilter fixes from Stefano Brivio, Jozsef Kadlecsik, Jiri
          Slaby, Florian Westphal, Eric Westbrook, Andrey Ryabinin, and Pablo
          Neira Ayuso.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (50 commits)
        net: alx: make alx_drv_name static
        net: bpfilter: fix iptables failure if bpfilter_umh is disabled
        sock_diag: fix autoloading of the raw_diag module
        net: core: netpoll: Enable netconsole IPv6 link local address
        ipv6: properly check return value in inet6_dump_all()
        rtnetlink: restore handling of dumpit return value in rtnl_dump_all()
        net/ipv6: Move anycast init/cleanup functions out of CONFIG_PROC_FS
        bonding/802.3ad: fix link_failure_count tracking
        net: phy: realtek: fix RTL8201F sysfs name
        sctp: define SCTP_SS_DEFAULT for Stream schedulers
        sctp: fix strchange_flags name for Stream Change Event
        mlxsw: spectrum: Fix IP2ME CPU policer configuration
        openvswitch: fix linking without CONFIG_NF_CONNTRACK_LABELS
        qed: fix link config error handling
        net: hns3: Fix for out-of-bounds access when setting pfc back pressure
        net/mlx4_en: use __netdev_tx_sent_queue()
        net: do not abort bulk send on BQL status
        net: bql: add __netdev_tx_sent_queue()
        s390/qeth: report 25Gbit link speed
        s390/qeth: sanitize ARP requests
        ...
      a13511df