Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1691242 > unrolled thread

[PATCH 4.12 00/84] 4.12.3-stable review

Started byGreg Kroah-Hartman <gregkh@linuxfoundation.org>
First post2017-07-19 11:50 +0200
Last post2017-07-20 01:40 +0200
Articles 20 on this page of 59 — 8 participants

Back to article view | Back to linux.kernel


Contents

  [PATCH 4.12 00/84] 4.12.3-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 11:50 +0200
    [PATCH 4.12 56/84] arm64: Preventing READ_IMPLIES_EXEC propagation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 63/84] mnt: Make propagate_umount less slow for overlapping mount propagation trees Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 59/84] nvmem: core: fix leaks on registration errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 54/84] powerpc/kexec: Fix radix to hash kexec due to IAMR/AMOR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 41/84] tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/: Depth Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 38/84] parisc: use compat_sys_keyctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 76/84] PM / wakeirq: Convert to SRCU Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 46/84] fs/dcache.c: fix spin lockup issue on nlru->lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 40/84] parisc/mm: Ensure IRQs are off in switch_mm() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 53/84] exec: Limit arg stack to at most 75% of _STK_LIM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 57/84] vt: fix unchecked __put_user() in tioclinux ioctls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 64/84] selftests/capabilities: Fix the test_execve test Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 55/84] ARM64: dts: marvell: armada37xx: Fix timer interrupt specifiers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 52/84] s390: reduce ELF_ET_DYN_BASE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 44/84] kernel/extable.c: mark core_kernel_text notrace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 39/84] parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 45/84] mm/list_lru.c: fix list_lru_count_node() to be race free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 47/84] checkpatch: silence perl 5.26.0 unescaped left brace warnings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 62/84] mnt: In propgate_umount handle visiting mounts in any order Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 61/84] mnt: In umount propagation reparent in a separate pass Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 50/84] arm64: move ELF_ET_DYN_BASE to 4GB / 4MB Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 58/84] rcu: Add memory barriers for NOCB leader wakeup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 48/84] binfmt_elf: use ELF_ET_DYN_BASE only for PIE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 60/84] Drivers: hv: vmbus: Close timing hole that can corrupt per-cpu page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:00 +0200
    [PATCH 4.12 26/84] x86/xen/efi: Initialize only the EFI struct members used by Xen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
      Re: [PATCH 4.12 26/84] x86/xen/efi: Initialize only the EFI struct  members used by Xen Daniel Kiper <daniel.kiper@oracle.com> - 2017-07-19 12:40 +0200
        Re: [PATCH 4.12 26/84] x86/xen/efi: Initialize only the EFI struct  members used by Xen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:20 +0200
          Re: [PATCH 4.12 26/84] x86/xen/efi: Initialize only the EFI struct  members used by Xen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
            Re: [PATCH 4.12 26/84] x86/xen/efi: Initialize only the EFI struct  members used by Xen Daniel Kiper <daniel.kiper@oracle.com> - 2017-07-19 14:00 +0200
          Re: [PATCH 4.12 26/84] x86/xen/efi: Initialize only the EFI struct  members used by Xen Daniel Kiper <daniel.kiper@oracle.com> - 2017-07-19 13:30 +0200
        Re: [PATCH 4.12 26/84] x86/xen/efi: Initialize only the EFI struct  members used by Xen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-20 11:20 +0200
          Re: [PATCH 4.12 26/84] x86/xen/efi: Initialize only the EFI struct  members used by Xen Ingo Molnar <mingo@kernel.org> - 2017-07-20 11:50 +0200
          Re: [PATCH 4.12 26/84] x86/xen/efi: Initialize only the EFI struct  members used by Xen Daniel Kiper <daniel.kiper@oracle.com> - 2017-07-20 14:40 +0200
            Re: [PATCH 4.12 26/84] x86/xen/efi: Initialize only the EFI struct  members used by Xen Juergen Gross <jgross@suse.com> - 2017-07-21 08:40 +0200
        Re: [PATCH 4.12 26/84] x86/xen/efi: Initialize only the EFI struct  members used by Xen Ingo Molnar <mingo@kernel.org> - 2017-07-20 11:20 +0200
    [PATCH 4.12 09/84] liquidio: fix bug in soft reset failure detection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
    [PATCH 4.12 02/84] net/mlx5: Fix driver load error flow when firmware is stuck Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
    [PATCH 4.12 16/84] tap: convert a mutex to a spinlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
    [PATCH 4.12 30/84] cfg80211: Check if PMKID attribute is of expected size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
    [PATCH 4.12 20/84] Adding asm-prototypes.h for genksyms to generate crc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
    [PATCH 4.12 32/84] drm/amdgpu/gfx6: properly cache mc_arb_ramcfg Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
    [PATCH 4.12 13/84] rds: tcp: use sock_create_lite() to create the accept socket Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
    [PATCH 4.12 06/84] vxlan: fix hlist corruption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
    [PATCH 4.12 03/84] net/mlx5: Cancel delayed recovery work when unloading the driver Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
    [PATCH 4.12 04/84] net/mlx5e: Fix TX carrier errors report in get stats ndo Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
    [PATCH 4.12 36/84] irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
    [PATCH 4.12 22/84] Adding the type of exported symbols Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
    [PATCH 4.12 12/84] virtio-net: fix leaking of ctx array Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
    [PATCH 4.12 28/84] cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
    [PATCH 4.12 05/84] ipv6: dad: dont remove dynamic addresses if link is down Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
    [PATCH 4.12 24/84] brcmfmac: Fix a memory leak in error handling path in brcmf_cfg80211_attach Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
    [PATCH 4.12 17/84] bridge: mdb: fix leak on complete_info ptr on fail path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:10 +0200
    Re: [PATCH 4.12 00/84] 4.12.3-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-07-19 18:40 +0200
      Re: [PATCH 4.12 00/84] 4.12.3-stable review Kevin Hilman <khilman@baylibre.com> - 2017-07-22 17:50 +0200
        Re: [PATCH 4.12 00/84] 4.12.3-stable review Sjoerd Simons <sjoerd.simons@collabora.co.uk> - 2017-07-24 11:20 +0200
    Re: [PATCH 4.12 00/84] 4.12.3-stable review Guenter Roeck <linux@roeck-us.net> - 2017-07-19 22:40 +0200
      Re: [PATCH 4.12 00/84] 4.12.3-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-20 07:10 +0200
    Re: [PATCH 4.12 00/84] 4.12.3-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-07-20 01:40 +0200

Page 1 of 3  [1] 2 3  Next page →


#1691242 — [PATCH 4.12 00/84] 4.12.3-stable review

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 11:50 +0200
Subject[PATCH 4.12 00/84] 4.12.3-stable review
Message-ID<u4TMd-6Hh-5@gated-at.bofh.it>
This is the start of the stable review cycle for the 4.12.3 release.
There are 84 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Fri Jul 21 09:22:37 UTC 2017.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.12.3-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.12.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.12.3-rc1

Haozhong Zhang <haozhong.zhang@intel.com>
    kvm: vmx: allow host to access guest MSR_IA32_BNDCFGS

Jim Mattson <jmattson@google.com>
    kvm: vmx: Check value written to IA32_BNDCFGS

Jim Mattson <jmattson@google.com>
    kvm: x86: Guest BNDCFGS requires guest MPX support

Jim Mattson <jmattson@google.com>
    kvm: vmx: Do not disable intercepts for BNDCFGS

Dan Carpenter <dan.carpenter@oracle.com>
    PM / QoS: return -EINVAL for bogus strings

Hui Wang <hui.wang@canonical.com>
    ALSA: hda/realtek - change the location for one of two front microphones

Ville Syrjälä <ville.syrjala@linux.intel.com>
    ALSA: x86: Clear the pdata.notify_lpe_audio pointer before teardown

Douglas Anderson <dianders@chromium.org>
    pstore: Fix leaked pstore_record in pstore_get_backend_records()

Thomas Gleixner <tglx@linutronix.de>
    PM / wakeirq: Convert to SRCU

Peter Zijlstra <peterz@infradead.org>
    sched/topology: Fix overlapping sched_group_mask

Lauro Ramos Venancio <lvenanci@redhat.com>
    sched/topology: Optimize build_group_mask()

Peter Zijlstra <peterz@infradead.org>
    sched/topology: Fix building of overlapping sched-groups

Dmitry V. Levin <ldv@altlinux.org>
    sched/headers/uapi: Fix linux/sched/types.h userspace compilation errors

Eric Biggers <ebiggers@google.com>
    KEYS: DH: validate __spare field

Horia Geantă <horia.geanta@nxp.com>
    crypto: caam - fix signals handling

David Gstir <david@sigma-star.at>
    crypto: caam - properly set IV after {en,de}crypt

Herbert Xu <herbert@gondor.apana.org.au>
    crypto: sha1-ssse3 - Disable avx2

Gilad Ben-Yossef <gilad@benyossef.com>
    crypto: atmel - only treat EBUSY as transient if backlog

Martin Hicks <mort@bork.org>
    crypto: talitos - Extend max key length for SHA384/512-HMAC and AEAD

Helge Deller <deller@gmx.de>
    mm: fix overflow check in expand_upwards()

Andy Lutomirski <luto@kernel.org>
    selftests/capabilities: Fix the test_execve test

Eric W. Biederman <ebiederm@xmission.com>
    mnt: Make propagate_umount less slow for overlapping mount propagation trees

Eric W. Biederman <ebiederm@xmission.com>
    mnt: In propgate_umount handle visiting mounts in any order

Eric W. Biederman <ebiederm@xmission.com>
    mnt: In umount propagation reparent in a separate pass

Michael Kelley <mikelley@microsoft.com>
    Drivers: hv: vmbus: Close timing hole that can corrupt per-cpu page

Johan Hovold <johan@kernel.org>
    nvmem: core: fix leaks on registration errors

Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    rcu: Add memory barriers for NOCB leader wakeup

Adam Borowski <kilobyte@angband.pl>
    vt: fix unchecked __put_user() in tioclinux ioctls

Dong Bo <dongbo4@huawei.com>
    arm64: Preventing READ_IMPLIES_EXEC propagation

Marc Zyngier <marc.zyngier@arm.com>
    ARM64: dts: marvell: armada37xx: Fix timer interrupt specifiers

Balbir Singh <bsingharora@gmail.com>
    powerpc/kexec: Fix radix to hash kexec due to IAMR/AMOR

Kees Cook <keescook@chromium.org>
    exec: Limit arg stack to at most 75% of _STK_LIM

Kees Cook <keescook@chromium.org>
    s390: reduce ELF_ET_DYN_BASE

Kees Cook <keescook@chromium.org>
    powerpc: move ELF_ET_DYN_BASE to 4GB / 4MB

Kees Cook <keescook@chromium.org>
    arm64: move ELF_ET_DYN_BASE to 4GB / 4MB

Kees Cook <keescook@chromium.org>
    arm: move ELF_ET_DYN_BASE to 4MB

Kees Cook <keescook@chromium.org>
    binfmt_elf: use ELF_ET_DYN_BASE only for PIE

Cyril Bur <cyrilbur@gmail.com>
    checkpatch: silence perl 5.26.0 unescaped left brace warnings

Sahitya Tummala <stummala@codeaurora.org>
    fs/dcache.c: fix spin lockup issue on nlru->lock

Sahitya Tummala <stummala@codeaurora.org>
    mm/list_lru.c: fix list_lru_count_node() to be race free

Marcin Nowakowski <marcin.nowakowski@imgtec.com>
    kernel/extable.c: mark core_kernel_text notrace

Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
    thp, mm: fix crash due race in MADV_FREE handling

David Rientjes <rientjes@google.com>
    compiler, clang: always inline when CONFIG_OPTIMIZE_INLINING is disabled

Ben Hutchings <ben@decadent.org.uk>
    tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/: Depth

Helge Deller <deller@gmx.de>
    parisc/mm: Ensure IRQs are off in switch_mm()

Thomas Bogendoerfer <tsbogend@alpha.franken.de>
    parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs

Eric Biggers <ebiggers@google.com>
    parisc: use compat_sys_keyctl()

Helge Deller <deller@gmx.de>
    parisc: Report SIGSEGV instead of SIGBUS when running out of stack

Suzuki K Poulose <suzuki.poulose@arm.com>
    irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity

Alex Williamson <alex.williamson@redhat.com>
    kvm-vfio: Decouple only when we match a group

Paul Mackerras <paulus@ozlabs.org>
    KVM: PPC: Book3S: Fix typo in XICS-on-XIVE state saving code

Hu Huajun <huhuajun@huawei.com>
    KVM: ARM64: fix phy counter access failure in guest.

Alex Deucher <alexander.deucher@amd.com>
    drm/amdgpu/gfx6: properly cache mc_arb_ramcfg

Srinivas Dasari <dasaris@qti.qualcomm.com>
    cfg80211: Check if NAN service ID is of expected size

Srinivas Dasari <dasaris@qti.qualcomm.com>
    cfg80211: Check if PMKID attribute is of expected size

Srinivas Dasari <dasaris@qti.qualcomm.com>
    cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES

Srinivas Dasari <dasaris@qti.qualcomm.com>
    cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE

Daniel Kiper <daniel.kiper@oracle.com>
    efi: Process the MEMATTR table only if EFI_MEMMAP is enabled

Daniel Kiper <daniel.kiper@oracle.com>
    x86/xen/efi: Initialize only the EFI struct members used by Xen

Peter S. Housel <housel@acm.org>
    brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain

Christophe Jaillet <christophe.jaillet@wanadoo.fr>
    brcmfmac: Fix a memory leak in error handling path in 'brcmf_cfg80211_attach'

Nitin Gupta <nitin.m.gupta@oracle.com>
    sparc64: Fix gup_huge_pmd

Nagarathnam Muthusamy <nagarathnam.muthusamy@oracle.com>
    Adding the type of exported symbols

Nagarathnam Muthusamy <nagarathnam.muthusamy@oracle.com>
    sed regex in Makefile.build requires line break between exported symbols

Nagarathnam Muthusamy <nagarathnam.muthusamy@oracle.com>
    Adding asm-prototypes.h for genksyms to generate crc

Bert Kenward <bkenward@solarflare.com>
    sfc: don't read beyond unicast address list

Arend van Spriel <arend.vanspriel@broadcom.com>
    brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()

Eduardo Valentin <eduval@amazon.com>
    bridge: mdb: fix leak on complete_info ptr on fail path

WANG Cong <xiyou.wangcong@gmail.com>
    tap: convert a mutex to a spinlock

Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
    cxgb4: fix BUG() on interrupt deallocating path of ULD

Huy Nguyen <huyn@mellanox.com>
    net/mlx5e: Initialize CEE's getpermhwaddr address buffer to 0xff

Sowmini Varadhan <sowmini.varadhan@oracle.com>
    rds: tcp: use sock_create_lite() to create the accept socket

Jason Wang <jasowang@redhat.com>
    virtio-net: fix leaking of ctx array

Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
    vrf: fix bug_on triggered by rx when destroying a vrf

David Ahern <dsahern@gmail.com>
    net: ipv6: Compare lwstate in detecting duplicate nexthops

Derek Chickles <derek.chickles@cavium.com>
    liquidio: fix bug in soft reset failure detection

Alban Browaeys <alban.browaeys@gmail.com>
    net: core: Fix slab-out-of-bounds in netdev_stats_to_stats64

Jiri Benc <jbenc@redhat.com>
    geneve: fix hlist corruption

Jiri Benc <jbenc@redhat.com>
    vxlan: fix hlist corruption

Sabrina Dubroca <sd@queasysnail.net>
    ipv6: dad: don't remove dynamic addresses if link is down

Gal Pressman <galp@mellanox.com>
    net/mlx5e: Fix TX carrier errors report in get stats ndo

Mohamad Haj Yahia <mohamad@mellanox.com>
    net/mlx5: Cancel delayed recovery work when unloading the driver

Gal Pressman <galp@mellanox.com>
    net/mlx5: Fix driver load error flow when firmware is stuck

Gleb Fotengauer-Malinovskiy <glebfm@altlinux.org>
    staging: android: uapi: drop definitions of removed ION_IOC_{FREE,SHARE} ioctls


-------------

Diffstat:

 Makefile                                           |   4 +-
 arch/arm/include/asm/elf.h                         |   8 +-
 arch/arm64/boot/dts/marvell/armada-37xx.dtsi       |  12 +-
 arch/arm64/include/asm/elf.h                       |  18 +-
 arch/parisc/include/asm/dma-mapping.h              |  11 +-
 arch/parisc/include/asm/mmu_context.h              |  15 +-
 arch/parisc/kernel/syscall_table.S                 |   2 +-
 arch/parisc/mm/fault.c                             |   2 +-
 arch/powerpc/include/asm/elf.h                     |  13 +-
 arch/powerpc/kernel/misc_64.S                      |  12 ++
 arch/powerpc/kvm/book3s_xive.c                     |   4 +-
 arch/s390/include/asm/elf.h                        |  15 +-
 arch/sparc/include/asm/asm-prototypes.h            |  24 +++
 arch/sparc/lib/atomic_64.S                         |  44 +++--
 arch/sparc/lib/checksum_64.S                       |   1 +
 arch/sparc/lib/csum_copy.S                         |   1 +
 arch/sparc/lib/memscan_64.S                        |   2 +
 arch/sparc/lib/memset.S                            |   1 +
 arch/sparc/mm/gup.c                                |   4 +-
 arch/x86/crypto/sha1_ssse3_glue.c                  |   2 +-
 arch/x86/include/asm/elf.h                         |  13 +-
 arch/x86/include/asm/msr-index.h                   |   2 +
 arch/x86/kvm/cpuid.h                               |   8 +
 arch/x86/kvm/vmx.c                                 |  10 +-
 arch/x86/xen/efi.c                                 |  45 ++---
 drivers/base/power/sysfs.c                         |   2 +
 drivers/base/power/wakeup.c                        |  32 ++--
 drivers/crypto/atmel-sha.c                         |   4 +-
 drivers/crypto/caam/caamalg.c                      |  20 +-
 drivers/crypto/caam/caamhash.c                     |   2 +-
 drivers/crypto/caam/key_gen.c                      |   2 +-
 drivers/crypto/talitos.c                           |   7 +-
 drivers/firmware/efi/efi.c                         |   3 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c              |   3 +-
 drivers/hv/hv.c                                    |   7 +-
 drivers/irqchip/irq-gic-v3.c                       |   3 +
 .../ethernet/cavium/liquidio/cn23xx_pf_device.c    |   2 +-
 .../net/ethernet/cavium/liquidio/cn66xx_device.c   |   2 +-
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c    |  16 +-
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c     |  42 ++--
 drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c |   2 +
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |   2 -
 drivers/net/ethernet/mellanox/mlx5/core/health.c   |  15 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |   4 +-
 drivers/net/ethernet/sfc/ef10.c                    |   8 +-
 drivers/net/geneve.c                               |  48 +++--
 drivers/net/tap.c                                  |  18 +-
 drivers/net/virtio_net.c                           |   1 +
 drivers/net/vrf.c                                  |  11 +-
 drivers/net/vxlan.c                                |  30 ++-
 .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  |   7 +-
 .../broadcom/brcm80211/brcmfmac/cfg80211.c         |   8 +-
 drivers/nvmem/core.c                               |  13 +-
 drivers/parisc/ccio-dma.c                          |  12 ++
 drivers/parisc/dino.c                              |   5 +-
 drivers/parisc/lba_pci.c                           |   6 +-
 drivers/parisc/sba_iommu.c                         |  14 ++
 drivers/staging/android/uapi/ion.h                 |  18 --
 drivers/tty/vt/vt.c                                |   6 +-
 fs/binfmt_elf.c                                    |  59 +++++-
 fs/dcache.c                                        |   5 +-
 fs/exec.c                                          |  11 +-
 fs/mount.h                                         |   1 +
 fs/namespace.c                                     |   1 +
 fs/pnode.c                                         | 212 ++++++++++++++++-----
 fs/pstore/platform.c                               |   4 +-
 include/linux/compiler-clang.h                     |   8 -
 include/linux/compiler-gcc.h                       |  18 +-
 include/linux/list_lru.h                           |   1 +
 include/linux/mlx5/driver.h                        |   1 +
 include/net/ip6_route.h                            |   8 +
 include/net/vxlan.h                                |  10 +-
 include/uapi/linux/sched/types.h                   |  16 +-
 kernel/extable.c                                   |   2 +-
 kernel/rcu/tree_plugin.h                           |   2 +
 kernel/sched/topology.c                            |  24 ++-
 mm/huge_memory.c                                   |   2 +-
 mm/list_lru.c                                      |  14 +-
 mm/mmap.c                                          |   2 +-
 net/bridge/br_mdb.c                                |   3 +-
 net/core/dev.c                                     |   2 +-
 net/ipv6/addrconf.c                                |  18 +-
 net/ipv6/ip6_fib.c                                 |   5 +-
 net/ipv6/route.c                                   |   8 +-
 net/rds/tcp_listen.c                               |   2 +-
 net/wireless/nl80211.c                             |  10 +-
 scripts/checkpatch.pl                              |   6 +-
 security/keys/compat_dh.c                          |   2 +
 security/keys/dh.c                                 |   5 +
 sound/pci/hda/patch_realtek.c                      |  14 ++
 sound/x86/intel_hdmi_audio.c                       |   5 +
 tools/lib/lockdep/uinclude/linux/lockdep.h         |   2 +-
 tools/testing/selftests/capabilities/test_execve.c |   7 +-
 virt/kvm/arm/arm.c                                 |   4 +-
 virt/kvm/vfio.c                                    |  13 +-
 95 files changed, 766 insertions(+), 389 deletions(-)

[toc] | [next] | [standalone]


#1691243 — [PATCH 4.12 56/84] arm64: Preventing READ_IMPLIES_EXEC propagation

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 56/84] arm64: Preventing READ_IMPLIES_EXEC propagation
Message-ID<u4TVU-6Ls-3@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dong Bo <dongbo4@huawei.com>

commit 48f99c8ec0b25756d0283ab058826ae07d14fad7 upstream.

Like arch/arm/, we inherit the READ_IMPLIES_EXEC personality flag across
fork(). This is undesirable for a number of reasons:

  * ELF files that don't require executable stack can end up with it
    anyway

  * We end up performing un-necessary I-cache maintenance when mapping
    what should be non-executable pages

  * Restricting what is executable is generally desirable when defending
    against overflow attacks

This patch clears the personality flag when setting up the personality for
newly spwaned native tasks. Given that semi-recent AArch64 toolchains emit
a non-executable PT_GNU_STACK header, userspace applications can already
not rely on READ_IMPLIES_EXEC so shouldn't be adversely affected by this
change.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Dong Bo <dongbo4@huawei.com>
[will: added comment to compat code, rewrote commit message]
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/include/asm/elf.h |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -141,6 +141,7 @@ typedef struct user_fpsimd_state elf_fpr
 ({									\
 	clear_bit(TIF_32BIT, &current->mm->context.flags);		\
 	clear_thread_flag(TIF_32BIT);					\
+	current->personality &= ~READ_IMPLIES_EXEC;			\
 })
 
 /* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */
@@ -187,6 +188,11 @@ typedef compat_elf_greg_t		compat_elf_gr
 					 ((x)->e_flags & EF_ARM_EABI_MASK))
 
 #define compat_start_thread		compat_start_thread
+/*
+ * Unlike the native SET_PERSONALITY macro, the compat version inherits
+ * READ_IMPLIES_EXEC across a fork() since this is the behaviour on
+ * arch/arm/.
+ */
 #define COMPAT_SET_PERSONALITY(ex)					\
 ({									\
 	set_bit(TIF_32BIT, &current->mm->context.flags);		\

[toc] | [prev] | [next] | [standalone]


#1691244 — [PATCH 4.12 63/84] mnt: Make propagate_umount less slow for overlapping mount propagation trees

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 63/84] mnt: Make propagate_umount less slow for overlapping mount propagation trees
Message-ID<u4TVT-6Ls-1@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric W. Biederman <ebiederm@xmission.com>

commit 296990deb389c7da21c78030376ba244dc1badf5 upstream.

Andrei Vagin pointed out that time to executue propagate_umount can go
non-linear (and take a ludicrious amount of time) when the mount
propogation trees of the mounts to be unmunted by a lazy unmount
overlap.

Make the walk of the mount propagation trees nearly linear by
remembering which mounts have already been visited, allowing
subsequent walks to detect when walking a mount propgation tree or a
subtree of a mount propgation tree would be duplicate work and to skip
them entirely.

Walk the list of mounts whose propgatation trees need to be traversed
from the mount highest in the mount tree to mounts lower in the mount
tree so that odds are higher that the code will walk the largest trees
first, allowing later tree walks to be skipped entirely.

Add cleanup_umount_visitation to remover the code's memory of which
mounts have been visited.

Add the functions last_slave and skip_propagation_subtree to allow
skipping appropriate parts of the mount propagation tree without
needing to change the logic of the rest of the code.

A script to generate overlapping mount propagation trees:

$ cat runs.h
set -e
mount -t tmpfs zdtm /mnt
mkdir -p /mnt/1 /mnt/2
mount -t tmpfs zdtm /mnt/1
mount --make-shared /mnt/1
mkdir /mnt/1/1

iteration=10
if [ -n "$1" ] ; then
	iteration=$1
fi

for i in $(seq $iteration); do
	mount --bind /mnt/1/1 /mnt/1/1
done

mount --rbind /mnt/1 /mnt/2

TIMEFORMAT='%Rs'
nr=$(( ( 2 ** ( $iteration + 1 ) ) + 1 ))
echo -n "umount -l /mnt/1 -> $nr        "
time umount -l /mnt/1

nr=$(cat /proc/self/mountinfo | grep zdtm | wc -l )
time umount -l /mnt/2

$ for i in $(seq 9 19); do echo $i; unshare -Urm bash ./run.sh $i; done

Here are the performance numbers with and without the patch:

     mhash |  8192   |  8192  | 1048576 | 1048576
    mounts | before  | after  |  before | after
    ------------------------------------------------
      1025 |  0.040s | 0.016s |  0.038s | 0.019s
      2049 |  0.094s | 0.017s |  0.080s | 0.018s
      4097 |  0.243s | 0.019s |  0.206s | 0.023s
      8193 |  1.202s | 0.028s |  1.562s | 0.032s
     16385 |  9.635s | 0.036s |  9.952s | 0.041s
     32769 | 60.928s | 0.063s | 44.321s | 0.064s
     65537 |         | 0.097s |         | 0.097s
    131073 |         | 0.233s |         | 0.176s
    262145 |         | 0.653s |         | 0.344s
    524289 |         | 2.305s |         | 0.735s
   1048577 |         | 7.107s |         | 2.603s

Andrei Vagin reports fixing the performance problem is part of the
work to fix CVE-2016-6213.

Fixes: a05964f3917c ("[PATCH] shared mounts handling: umount")
Reported-by: Andrei Vagin <avagin@openvz.org>
Reviewed-by: Andrei Vagin <avagin@virtuozzo.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/pnode.c |   63 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 62 insertions(+), 1 deletion(-)

--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -24,6 +24,11 @@ static inline struct mount *first_slave(
 	return list_entry(p->mnt_slave_list.next, struct mount, mnt_slave);
 }
 
+static inline struct mount *last_slave(struct mount *p)
+{
+	return list_entry(p->mnt_slave_list.prev, struct mount, mnt_slave);
+}
+
 static inline struct mount *next_slave(struct mount *p)
 {
 	return list_entry(p->mnt_slave.next, struct mount, mnt_slave);
@@ -162,6 +167,19 @@ static struct mount *propagation_next(st
 	}
 }
 
+static struct mount *skip_propagation_subtree(struct mount *m,
+						struct mount *origin)
+{
+	/*
+	 * Advance m such that propagation_next will not return
+	 * the slaves of m.
+	 */
+	if (!IS_MNT_NEW(m) && !list_empty(&m->mnt_slave_list))
+		m = last_slave(m);
+
+	return m;
+}
+
 static struct mount *next_group(struct mount *m, struct mount *origin)
 {
 	while (1) {
@@ -505,6 +523,15 @@ static void restore_mounts(struct list_h
 	}
 }
 
+static void cleanup_umount_visitations(struct list_head *visited)
+{
+	while (!list_empty(visited)) {
+		struct mount *mnt =
+			list_first_entry(visited, struct mount, mnt_umounting);
+		list_del_init(&mnt->mnt_umounting);
+	}
+}
+
 /*
  * collect all mounts that receive propagation from the mount in @list,
  * and return these additional mounts in the same list.
@@ -517,11 +544,23 @@ int propagate_umount(struct list_head *l
 	struct mount *mnt;
 	LIST_HEAD(to_restore);
 	LIST_HEAD(to_umount);
+	LIST_HEAD(visited);
 
-	list_for_each_entry(mnt, list, mnt_list) {
+	/* Find candidates for unmounting */
+	list_for_each_entry_reverse(mnt, list, mnt_list) {
 		struct mount *parent = mnt->mnt_parent;
 		struct mount *m;
 
+		/*
+		 * If this mount has already been visited it is known that it's
+		 * entire peer group and all of their slaves in the propagation
+		 * tree for the mountpoint has already been visited and there is
+		 * no need to visit them again.
+		 */
+		if (!list_empty(&mnt->mnt_umounting))
+			continue;
+
+		list_add_tail(&mnt->mnt_umounting, &visited);
 		for (m = propagation_next(parent, parent); m;
 		     m = propagation_next(m, parent)) {
 			struct mount *child = __lookup_mnt(&m->mnt,
@@ -529,6 +568,27 @@ int propagate_umount(struct list_head *l
 			if (!child)
 				continue;
 
+			if (!list_empty(&child->mnt_umounting)) {
+				/*
+				 * If the child has already been visited it is
+				 * know that it's entire peer group and all of
+				 * their slaves in the propgation tree for the
+				 * mountpoint has already been visited and there
+				 * is no need to visit this subtree again.
+				 */
+				m = skip_propagation_subtree(m, parent);
+				continue;
+			} else if (child->mnt.mnt_flags & MNT_UMOUNT) {
+				/*
+				 * We have come accross an partially unmounted
+				 * mount in list that has not been visited yet.
+				 * Remember it has been visited and continue
+				 * about our merry way.
+				 */
+				list_add_tail(&child->mnt_umounting, &visited);
+				continue;
+			}
+
 			/* Check the child and parents while progress is made */
 			while (__propagate_umount(child,
 						  &to_umount, &to_restore)) {
@@ -542,6 +602,7 @@ int propagate_umount(struct list_head *l
 
 	umount_list(&to_umount, &to_restore);
 	restore_mounts(&to_restore);
+	cleanup_umount_visitations(&visited);
 	list_splice_tail(&to_umount, list);
 
 	return 0;

[toc] | [prev] | [next] | [standalone]


#1691245 — [PATCH 4.12 59/84] nvmem: core: fix leaks on registration errors

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 59/84] nvmem: core: fix leaks on registration errors
Message-ID<u4TVU-6Ls-5@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 3360acdf839170b612f5b212539694c20e3f16d0 upstream.

Make sure to deregister and release the nvmem device and underlying
memory on registration errors.

Note that the private data must be freed using put_device() once the
struct device has been initialised.

Also note that there's a related reference leak in the deregistration
function as reported by Mika Westerberg which is being fixed separately.

Fixes: b6c217ab9be6 ("nvmem: Add backwards compatibility support for older EEPROM drivers.")
Fixes: eace75cfdcf7 ("nvmem: Add a simple NVMEM framework for nvmem providers")
Cc: Andrew Lunn <andrew@lunn.ch>
Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/nvmem/core.c |   13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -489,21 +489,24 @@ struct nvmem_device *nvmem_register(cons
 
 	rval = device_add(&nvmem->dev);
 	if (rval)
-		goto out;
+		goto err_put_device;
 
 	if (config->compat) {
 		rval = nvmem_setup_compat(nvmem, config);
 		if (rval)
-			goto out;
+			goto err_device_del;
 	}
 
 	if (config->cells)
 		nvmem_add_cells(nvmem, config);
 
 	return nvmem;
-out:
-	ida_simple_remove(&nvmem_ida, nvmem->id);
-	kfree(nvmem);
+
+err_device_del:
+	device_del(&nvmem->dev);
+err_put_device:
+	put_device(&nvmem->dev);
+
 	return ERR_PTR(rval);
 }
 EXPORT_SYMBOL_GPL(nvmem_register);

[toc] | [prev] | [next] | [standalone]


#1691246 — [PATCH 4.12 54/84] powerpc/kexec: Fix radix to hash kexec due to IAMR/AMOR

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 54/84] powerpc/kexec: Fix radix to hash kexec due to IAMR/AMOR
Message-ID<u4TVU-6Ls-7@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Balbir Singh <bsingharora@gmail.com>

commit 1e2a516e89fc412a754327522ab271b42f99c6b4 upstream.

This patch fixes a crash seen while doing a kexec from radix mode to
hash mode. Key 0 is special in hash and used in the RPN by default, we
set the key values to 0 today. In radix mode key 0 is used to control
supervisor<->user access. In hash key 0 is used by default, so the
first instruction after the switch causes a crash on kexec.

Commit 3b10d0095a1e ("powerpc/mm/radix: Prevent kernel execution of
user space") introduced the setting of IAMR and AMOR values to prevent
execution of user mode instructions from supervisor mode. We need to
clean up these SPR's on kexec.

Fixes: 3b10d0095a1e ("powerpc/mm/radix: Prevent kernel execution of user space")
Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Balbir Singh <bsingharora@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/kernel/misc_64.S |   12 ++++++++++++
 1 file changed, 12 insertions(+)

--- a/arch/powerpc/kernel/misc_64.S
+++ b/arch/powerpc/kernel/misc_64.S
@@ -614,6 +614,18 @@ _GLOBAL(kexec_sequence)
 	li	r0,0
 	std	r0,16(r1)
 
+BEGIN_FTR_SECTION
+	/*
+	 * This is the best time to turn AMR/IAMR off.
+	 * key 0 is used in radix for supervisor<->user
+	 * protection, but on hash key 0 is reserved
+	 * ideally we want to enter with a clean state.
+	 * NOTE, we rely on r0 being 0 from above.
+	 */
+	mtspr	SPRN_IAMR,r0
+	mtspr	SPRN_AMOR,r0
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
+
 	/* save regs for local vars on new stack.
 	 * yes, we won't go back, but ...
 	 */

[toc] | [prev] | [next] | [standalone]


#1691247 — [PATCH 4.12 41/84] tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/: Depth

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 41/84] tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/: Depth
Message-ID<u4TVU-6Ls-17@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Hutchings <ben@decadent.org.uk>

commit 98dcea0cfd04e083ac74137ceb9a632604740e2d upstream.

liblockdep has been broken since commit 75dd602a5198 ("lockdep: Fix
lock_chain::base size"), as that adds a check that MAX_LOCK_DEPTH is
within the range of lock_chain::depth and in liblockdep it is much
too large.

That should have resulted in a compiler error, but didn't because:

- the check uses ARRAY_SIZE(), which isn't yet defined in liblockdep
  so is assumed to be an (undeclared) function
- putting a function call inside a BUILD_BUG_ON() expression quietly
  turns it into some nonsense involving a variable-length array

It did produce a compiler warning, but I didn't notice because
liblockdep already produces too many warnings if -Wall is enabled
(which I'll fix shortly).

Even before that commit, which reduced lock_chain::depth from 8 bits
to 6, MAX_LOCK_DEPTH was too large.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: a.p.zijlstra@chello.nl
Link: http://lkml.kernel.org/r/20170525130005.5947-3-alexander.levin@verizon.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 tools/lib/lockdep/uinclude/linux/lockdep.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/tools/lib/lockdep/uinclude/linux/lockdep.h
+++ b/tools/lib/lockdep/uinclude/linux/lockdep.h
@@ -8,7 +8,7 @@
 #include <linux/utsname.h>
 #include <linux/compiler.h>
 
-#define MAX_LOCK_DEPTH 2000UL
+#define MAX_LOCK_DEPTH 63UL
 
 #define asmlinkage
 #define __visible

[toc] | [prev] | [next] | [standalone]


#1691248 — [PATCH 4.12 38/84] parisc: use compat_sys_keyctl()

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 38/84] parisc: use compat_sys_keyctl()
Message-ID<u4TVU-6Ls-9@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Biggers <ebiggers@google.com>

commit b0f94efd5aa8daa8a07d7601714c2573266cd4c9 upstream.

Architectures with a compat syscall table must put compat_sys_keyctl()
in it, not sys_keyctl().  The parisc architecture was not doing this;
fix it.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Acked-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/parisc/kernel/syscall_table.S |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -361,7 +361,7 @@
 	ENTRY_SAME(ni_syscall)	/* 263: reserved for vserver */
 	ENTRY_SAME(add_key)
 	ENTRY_SAME(request_key)		/* 265 */
-	ENTRY_SAME(keyctl)
+	ENTRY_COMP(keyctl)
 	ENTRY_SAME(ioprio_set)
 	ENTRY_SAME(ioprio_get)
 	ENTRY_SAME(inotify_init)

[toc] | [prev] | [next] | [standalone]


#1691249 — [PATCH 4.12 76/84] PM / wakeirq: Convert to SRCU

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 76/84] PM / wakeirq: Convert to SRCU
Message-ID<u4TVU-6Ls-15@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <tglx@linutronix.de>

commit ea0212f40c6bc0594c8eff79266759e3ecd4bacc upstream.

The wakeirq infrastructure uses RCU to protect the list of wakeirqs. That
breaks the irq bus locking infrastructure, which is allows sleeping
functions to be called so interrupt controllers behind slow busses,
e.g. i2c, can be handled.

The wakeirq functions hold rcu_read_lock and call into irq functions, which
in case of interrupts using the irq bus locking will trigger a
might_sleep() splat.

Convert the wakeirq infrastructure to Sleepable RCU and unbreak it.

Fixes: 4990d4fe327b (PM / Wakeirq: Add automated device wake IRQ handling)
Reported-by: Brian Norris <briannorris@chromium.org>
Suggested-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Tested-by: Tony Lindgren <tony@atomide.com>
Tested-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/base/power/wakeup.c |   32 ++++++++++++++++++--------------
 1 file changed, 18 insertions(+), 14 deletions(-)

--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -60,6 +60,8 @@ static LIST_HEAD(wakeup_sources);
 
 static DECLARE_WAIT_QUEUE_HEAD(wakeup_count_wait_queue);
 
+DEFINE_STATIC_SRCU(wakeup_srcu);
+
 static struct wakeup_source deleted_ws = {
 	.name = "deleted",
 	.lock =  __SPIN_LOCK_UNLOCKED(deleted_ws.lock),
@@ -198,7 +200,7 @@ void wakeup_source_remove(struct wakeup_
 	spin_lock_irqsave(&events_lock, flags);
 	list_del_rcu(&ws->entry);
 	spin_unlock_irqrestore(&events_lock, flags);
-	synchronize_rcu();
+	synchronize_srcu(&wakeup_srcu);
 }
 EXPORT_SYMBOL_GPL(wakeup_source_remove);
 
@@ -332,12 +334,12 @@ void device_wakeup_detach_irq(struct dev
 void device_wakeup_arm_wake_irqs(void)
 {
 	struct wakeup_source *ws;
+	int srcuidx;
 
-	rcu_read_lock();
+	srcuidx = srcu_read_lock(&wakeup_srcu);
 	list_for_each_entry_rcu(ws, &wakeup_sources, entry)
 		dev_pm_arm_wake_irq(ws->wakeirq);
-
-	rcu_read_unlock();
+	srcu_read_unlock(&wakeup_srcu, srcuidx);
 }
 
 /**
@@ -348,12 +350,12 @@ void device_wakeup_arm_wake_irqs(void)
 void device_wakeup_disarm_wake_irqs(void)
 {
 	struct wakeup_source *ws;
+	int srcuidx;
 
-	rcu_read_lock();
+	srcuidx = srcu_read_lock(&wakeup_srcu);
 	list_for_each_entry_rcu(ws, &wakeup_sources, entry)
 		dev_pm_disarm_wake_irq(ws->wakeirq);
-
-	rcu_read_unlock();
+	srcu_read_unlock(&wakeup_srcu, srcuidx);
 }
 
 /**
@@ -804,10 +806,10 @@ EXPORT_SYMBOL_GPL(pm_wakeup_dev_event);
 void pm_print_active_wakeup_sources(void)
 {
 	struct wakeup_source *ws;
-	int active = 0;
+	int srcuidx, active = 0;
 	struct wakeup_source *last_activity_ws = NULL;
 
-	rcu_read_lock();
+	srcuidx = srcu_read_lock(&wakeup_srcu);
 	list_for_each_entry_rcu(ws, &wakeup_sources, entry) {
 		if (ws->active) {
 			pr_debug("active wakeup source: %s\n", ws->name);
@@ -823,7 +825,7 @@ void pm_print_active_wakeup_sources(void
 	if (!active && last_activity_ws)
 		pr_debug("last active wakeup source: %s\n",
 			last_activity_ws->name);
-	rcu_read_unlock();
+	srcu_read_unlock(&wakeup_srcu, srcuidx);
 }
 EXPORT_SYMBOL_GPL(pm_print_active_wakeup_sources);
 
@@ -950,8 +952,9 @@ void pm_wakep_autosleep_enabled(bool set
 {
 	struct wakeup_source *ws;
 	ktime_t now = ktime_get();
+	int srcuidx;
 
-	rcu_read_lock();
+	srcuidx = srcu_read_lock(&wakeup_srcu);
 	list_for_each_entry_rcu(ws, &wakeup_sources, entry) {
 		spin_lock_irq(&ws->lock);
 		if (ws->autosleep_enabled != set) {
@@ -965,7 +968,7 @@ void pm_wakep_autosleep_enabled(bool set
 		}
 		spin_unlock_irq(&ws->lock);
 	}
-	rcu_read_unlock();
+	srcu_read_unlock(&wakeup_srcu, srcuidx);
 }
 #endif /* CONFIG_PM_AUTOSLEEP */
 
@@ -1026,15 +1029,16 @@ static int print_wakeup_source_stats(str
 static int wakeup_sources_stats_show(struct seq_file *m, void *unused)
 {
 	struct wakeup_source *ws;
+	int srcuidx;
 
 	seq_puts(m, "name\t\tactive_count\tevent_count\twakeup_count\t"
 		"expire_count\tactive_since\ttotal_time\tmax_time\t"
 		"last_change\tprevent_suspend_time\n");
 
-	rcu_read_lock();
+	srcuidx = srcu_read_lock(&wakeup_srcu);
 	list_for_each_entry_rcu(ws, &wakeup_sources, entry)
 		print_wakeup_source_stats(m, ws);
-	rcu_read_unlock();
+	srcu_read_unlock(&wakeup_srcu, srcuidx);
 
 	print_wakeup_source_stats(m, &deleted_ws);
 

[toc] | [prev] | [next] | [standalone]


#1691251 — [PATCH 4.12 46/84] fs/dcache.c: fix spin lockup issue on nlru->lock

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 46/84] fs/dcache.c: fix spin lockup issue on nlru->lock
Message-ID<u4TVU-6Ls-19@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sahitya Tummala <stummala@codeaurora.org>

commit b17c070fb624cf10162cf92ea5e1ec25cd8ac176 upstream.

__list_lru_walk_one() acquires nlru spin lock (nlru->lock) for longer
duration if there are more number of items in the lru list.  As per the
current code, it can hold the spin lock for upto maximum UINT_MAX
entries at a time.  So if there are more number of items in the lru
list, then "BUG: spinlock lockup suspected" is observed in the below
path:

  spin_bug+0x90
  do_raw_spin_lock+0xfc
  _raw_spin_lock+0x28
  list_lru_add+0x28
  dput+0x1c8
  path_put+0x20
  terminate_walk+0x3c
  path_lookupat+0x100
  filename_lookup+0x6c
  user_path_at_empty+0x54
  SyS_faccessat+0xd0
  el0_svc_naked+0x24

This nlru->lock is acquired by another CPU in this path -

  d_lru_shrink_move+0x34
  dentry_lru_isolate_shrink+0x48
  __list_lru_walk_one.isra.10+0x94
  list_lru_walk_node+0x40
  shrink_dcache_sb+0x60
  do_remount_sb+0xbc
  do_emergency_remount+0xb0
  process_one_work+0x228
  worker_thread+0x2e0
  kthread+0xf4
  ret_from_fork+0x10

Fix this lockup by reducing the number of entries to be shrinked from
the lru list to 1024 at once.  Also, add cond_resched() before
processing the lru list again.

Link: http://marc.info/?t=149722864900001&r=1&w=2
Link: http://lkml.kernel.org/r/1498707575-2472-1-git-send-email-stummala@codeaurora.org
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Suggested-by: Jan Kara <jack@suse.cz>
Suggested-by: Vladimir Davydov <vdavydov.dev@gmail.com>
Acked-by: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Alexander Polakov <apolyakov@beget.ru>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/dcache.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1133,11 +1133,12 @@ void shrink_dcache_sb(struct super_block
 		LIST_HEAD(dispose);
 
 		freed = list_lru_walk(&sb->s_dentry_lru,
-			dentry_lru_isolate_shrink, &dispose, UINT_MAX);
+			dentry_lru_isolate_shrink, &dispose, 1024);
 
 		this_cpu_sub(nr_dentry_unused, freed);
 		shrink_dentry_list(&dispose);
-	} while (freed > 0);
+		cond_resched();
+	} while (list_lru_count(&sb->s_dentry_lru) > 0);
 }
 EXPORT_SYMBOL(shrink_dcache_sb);
 

[toc] | [prev] | [next] | [standalone]


#1691252 — [PATCH 4.12 40/84] parisc/mm: Ensure IRQs are off in switch_mm()

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 40/84] parisc/mm: Ensure IRQs are off in switch_mm()
Message-ID<u4TVU-6Ls-21@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Helge Deller <deller@gmx.de>

commit 649aa24254e85bf6bd7807dd372d083707852b1f upstream.

This is because of commit f98db6013c55 ("sched/core: Add switch_mm_irqs_off()
and use it in the scheduler") in which switch_mm_irqs_off() is called by the
scheduler, vs switch_mm() which is used by use_mm().

This patch lets the parisc code mirror the x86 and powerpc code, ie. it
disables interrupts in switch_mm(), and optimises the scheduler case by
defining switch_mm_irqs_off().

Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/parisc/include/asm/mmu_context.h |   15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

--- a/arch/parisc/include/asm/mmu_context.h
+++ b/arch/parisc/include/asm/mmu_context.h
@@ -49,15 +49,26 @@ static inline void load_context(mm_conte
 	mtctl(__space_to_prot(context), 8);
 }
 
-static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next, struct task_struct *tsk)
+static inline void switch_mm_irqs_off(struct mm_struct *prev,
+		struct mm_struct *next, struct task_struct *tsk)
 {
-
 	if (prev != next) {
 		mtctl(__pa(next->pgd), 25);
 		load_context(next->context);
 	}
 }
 
+static inline void switch_mm(struct mm_struct *prev,
+		struct mm_struct *next, struct task_struct *tsk)
+{
+	unsigned long flags;
+
+	local_irq_save(flags);
+	switch_mm_irqs_off(prev, next, tsk);
+	local_irq_restore(flags);
+}
+#define switch_mm_irqs_off switch_mm_irqs_off
+
 #define deactivate_mm(tsk,mm)	do { } while (0)
 
 static inline void activate_mm(struct mm_struct *prev, struct mm_struct *next)

[toc] | [prev] | [next] | [standalone]


#1691254 — [PATCH 4.12 53/84] exec: Limit arg stack to at most 75% of _STK_LIM

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 53/84] exec: Limit arg stack to at most 75% of _STK_LIM
Message-ID<u4TVU-6Ls-27@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kees Cook <keescook@chromium.org>

commit da029c11e6b12f321f36dac8771e833b65cec962 upstream.

To avoid pathological stack usage or the need to special-case setuid
execs, just limit all arg stack usage to at most 75% of _STK_LIM (6MB).

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/exec.c |   11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

--- a/fs/exec.c
+++ b/fs/exec.c
@@ -220,8 +220,7 @@ static struct page *get_arg_page(struct
 
 	if (write) {
 		unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start;
-		unsigned long ptr_size;
-		struct rlimit *rlim;
+		unsigned long ptr_size, limit;
 
 		/*
 		 * Since the stack will hold pointers to the strings, we
@@ -250,14 +249,16 @@ static struct page *get_arg_page(struct
 			return page;
 
 		/*
-		 * Limit to 1/4-th the stack size for the argv+env strings.
+		 * Limit to 1/4 of the max stack size or 3/4 of _STK_LIM
+		 * (whichever is smaller) for the argv+env strings.
 		 * This ensures that:
 		 *  - the remaining binfmt code will not run out of stack space,
 		 *  - the program will have a reasonable amount of stack left
 		 *    to work from.
 		 */
-		rlim = current->signal->rlim;
-		if (size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4)
+		limit = _STK_LIM / 4 * 3;
+		limit = min(limit, rlimit(RLIMIT_STACK) / 4);
+		if (size > limit)
 			goto fail;
 	}
 

[toc] | [prev] | [next] | [standalone]


#1691257 — [PATCH 4.12 57/84] vt: fix unchecked __put_user() in tioclinux ioctls

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 57/84] vt: fix unchecked __put_user() in tioclinux ioctls
Message-ID<u4TVV-6Ls-33@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Adam Borowski <kilobyte@angband.pl>

commit 6987dc8a70976561d22450b5858fc9767788cc1c upstream.

Only read access is checked before this call.

Actually, at the moment this is not an issue, as every in-tree arch does
the same manual checks for VERIFY_READ vs VERIFY_WRITE, relying on the MMU
to tell them apart, but this wasn't the case in the past and may happen
again on some odd arch in the future.

If anyone cares about 3.7 and earlier, this is a security hole (untested)
on real 80386 CPUs.

Signed-off-by: Adam Borowski <kilobyte@angband.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/vt/vt.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -2709,13 +2709,13 @@ int tioclinux(struct tty_struct *tty, un
 	 * related to the kernel should not use this.
 	 */
 			data = vt_get_shift_state();
-			ret = __put_user(data, p);
+			ret = put_user(data, p);
 			break;
 		case TIOCL_GETMOUSEREPORTING:
 			console_lock();	/* May be overkill */
 			data = mouse_reporting();
 			console_unlock();
-			ret = __put_user(data, p);
+			ret = put_user(data, p);
 			break;
 		case TIOCL_SETVESABLANK:
 			console_lock();
@@ -2724,7 +2724,7 @@ int tioclinux(struct tty_struct *tty, un
 			break;
 		case TIOCL_GETKMSGREDIRECT:
 			data = vt_get_kmsg_redirect();
-			ret = __put_user(data, p);
+			ret = put_user(data, p);
 			break;
 		case TIOCL_SETKMSGREDIRECT:
 			if (!capable(CAP_SYS_ADMIN)) {

[toc] | [prev] | [next] | [standalone]


#1691258 — [PATCH 4.12 64/84] selftests/capabilities: Fix the test_execve test

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 64/84] selftests/capabilities: Fix the test_execve test
Message-ID<u4TVV-6Ls-41@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andy Lutomirski <luto@kernel.org>

commit 796a3bae2fba6810427efdb314a1c126c9490fb3 upstream.

test_execve does rather odd mount manipulations to safely create
temporary setuid and setgid executables that aren't visible to the
rest of the system.  Those executables end up in the test's cwd, but
that cwd is MNT_DETACHed.

The core namespace code considers MNT_DETACHed trees to belong to no
mount namespace at all and, in general, MNT_DETACHed trees are only
barely function.  This interacted with commit 380cf5ba6b0a ("fs:
Treat foreign mounts as nosuid") to cause all MNT_DETACHed trees to
act as though they're nosuid, breaking the test.

Fix it by just not detaching the tree.  It's still in a private
mount namespace and is therefore still invisible to the rest of the
system (except via /proc, and the same nosuid logic will protect all
other programs on the system from believing in test_execve's setuid
bits).

While we're at it, fix some blatant whitespace problems.

Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Fixes: 380cf5ba6b0a ("fs: Treat foreign mounts as nosuid")
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Shuah Khan <shuahkh@osg.samsung.com>
Cc: Greg KH <greg@kroah.com>
Cc: linux-kselftest@vger.kernel.org
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 tools/testing/selftests/capabilities/test_execve.c |    7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

--- a/tools/testing/selftests/capabilities/test_execve.c
+++ b/tools/testing/selftests/capabilities/test_execve.c
@@ -138,9 +138,6 @@ static void chdir_to_tmpfs(void)
 
 	if (chdir(cwd) != 0)
 		err(1, "chdir to private tmpfs");
-
-	if (umount2(".", MNT_DETACH) != 0)
-		err(1, "detach private tmpfs");
 }
 
 static void copy_fromat_to(int fromfd, const char *fromname, const char *toname)
@@ -248,7 +245,7 @@ static int do_tests(int uid, const char
 			err(1, "chown");
 		if (chmod("validate_cap_sgidnonroot", S_ISGID | 0710) != 0)
 			err(1, "chmod");
-}
+	}
 
 	capng_get_caps_process();
 
@@ -384,7 +381,7 @@ static int do_tests(int uid, const char
 	} else {
 		printf("[RUN]\tNon-root +ia, sgidnonroot => i\n");
 		exec_other_validate_cap("./validate_cap_sgidnonroot",
-						false, false, true, false);
+					false, false, true, false);
 
 		if (fork_wait()) {
 			printf("[RUN]\tNon-root +ia, sgidroot => i\n");

[toc] | [prev] | [next] | [standalone]


#1691260 — [PATCH 4.12 55/84] ARM64: dts: marvell: armada37xx: Fix timer interrupt specifiers

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 55/84] ARM64: dts: marvell: armada37xx: Fix timer interrupt specifiers
Message-ID<u4TVV-6Ls-45@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marc Zyngier <marc.zyngier@arm.com>

commit 88cda00733f0731711c76e535d4972c296ac512e upstream.

Contrary to popular belief, PPIs connected to a GICv3 to not have
an affinity field similar to that of GICv2. That is consistent
with the fact that GICv3 is designed to accomodate thousands of
CPUs, and fitting them as a bitmap in a byte is... difficult.

Fixes: adbc3695d9e4 ("arm64: dts: add the Marvell Armada 3700 family and a development board")
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/boot/dts/marvell/armada-37xx.dtsi |   12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
@@ -75,14 +75,10 @@
 
 	timer {
 		compatible = "arm,armv8-timer";
-		interrupts = <GIC_PPI 13
-			(GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_HIGH)>,
-			     <GIC_PPI 14
-			(GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_HIGH)>,
-			     <GIC_PPI 11
-			(GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_HIGH)>,
-			     <GIC_PPI 10
-			(GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_HIGH)>;
+		interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_PPI 14 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_PPI 11 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_PPI 10 IRQ_TYPE_LEVEL_HIGH>;
 	};
 
 	soc {

[toc] | [prev] | [next] | [standalone]


#1691261 — [PATCH 4.12 52/84] s390: reduce ELF_ET_DYN_BASE

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 52/84] s390: reduce ELF_ET_DYN_BASE
Message-ID<u4TVV-6Ls-47@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kees Cook <keescook@chromium.org>

commit a73dc5370e153ac63718d850bddf0c9aa9d871e6 upstream.

Now that explicitly executed loaders are loaded in the mmap region, we
have more freedom to decide where we position PIE binaries in the
address space to avoid possible collisions with mmap or stack regions.

For 64-bit, align to 4GB to allow runtimes to use the entire 32-bit
address space for 32-bit pointers.  On 32-bit use 4MB, which is the
traditional x86 minimum load location, likely to avoid historically
requiring a 4MB page table entry when only a portion of the first 4MB
would be used (since the NULL address is avoided).  For s390 the
position could be 0x10000, but that is needlessly close to the NULL
address.

Link: http://lkml.kernel.org/r/1498154792-49952-5-git-send-email-keescook@chromium.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: James Hogan <james.hogan@imgtec.com>
Cc: Pratyush Anand <panand@redhat.com>
Cc: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/s390/include/asm/elf.h |   15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -161,14 +161,13 @@ extern unsigned int vdso_enabled;
 #define CORE_DUMP_USE_REGSET
 #define ELF_EXEC_PAGESIZE	4096
 
-/* This is the location that an ET_DYN program is loaded if exec'ed.  Typical
-   use of this is to invoke "./ld.so someprog" to test out a new version of
-   the loader.  We need to make sure that it is out of the way of the program
-   that it will "exec", and that there is sufficient room for the brk. 64-bit
-   tasks are aligned to 4GB. */
-#define ELF_ET_DYN_BASE (is_compat_task() ? \
-				(STACK_TOP / 3 * 2) : \
-				(STACK_TOP / 3 * 2) & ~((1UL << 32) - 1))
+/*
+ * This is the base location for PIE (ET_DYN with INTERP) loads. On
+ * 64-bit, this is raised to 4GB to leave the entire 32-bit address
+ * space open for things that want to use the area for 32-bit pointers.
+ */
+#define ELF_ET_DYN_BASE		(is_compat_task() ? 0x000400000UL : \
+						    0x100000000UL)
 
 /* This yields a mask that user programs can use to figure out what
    instruction set this CPU supports. */

[toc] | [prev] | [next] | [standalone]


#1691264 — [PATCH 4.12 44/84] kernel/extable.c: mark core_kernel_text notrace

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 44/84] kernel/extable.c: mark core_kernel_text notrace
Message-ID<u4TVW-6Ls-59@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marcin Nowakowski <marcin.nowakowski@imgtec.com>

commit c0d80ddab89916273cb97114889d3f337bc370ae upstream.

core_kernel_text is used by MIPS in its function graph trace processing,
so having this method traced leads to an infinite set of recursive calls
such as:

  Call Trace:
     ftrace_return_to_handler+0x50/0x128
     core_kernel_text+0x10/0x1b8
     prepare_ftrace_return+0x6c/0x114
     ftrace_graph_caller+0x20/0x44
     return_to_handler+0x10/0x30
     return_to_handler+0x0/0x30
     return_to_handler+0x0/0x30
     ftrace_ops_no_ops+0x114/0x1bc
     core_kernel_text+0x10/0x1b8
     core_kernel_text+0x10/0x1b8
     core_kernel_text+0x10/0x1b8
     ftrace_ops_no_ops+0x114/0x1bc
     core_kernel_text+0x10/0x1b8
     prepare_ftrace_return+0x6c/0x114
     ftrace_graph_caller+0x20/0x44
     (...)

Mark the function notrace to avoid it being traced.

Link: http://lkml.kernel.org/r/1498028607-6765-1-git-send-email-marcin.nowakowski@imgtec.com
Signed-off-by: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Meyer <thomas@m3y3r.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/extable.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/kernel/extable.c
+++ b/kernel/extable.c
@@ -69,7 +69,7 @@ static inline int init_kernel_text(unsig
 	return 0;
 }
 
-int core_kernel_text(unsigned long addr)
+int notrace core_kernel_text(unsigned long addr)
 {
 	if (addr >= (unsigned long)_stext &&
 	    addr < (unsigned long)_etext)

[toc] | [prev] | [next] | [standalone]


#1691265 — [PATCH 4.12 39/84] parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 39/84] parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs
Message-ID<u4TVW-6Ls-57@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>

commit 33f9e02495d15a061f0c94ef46f5103a2d0c20f3 upstream.

Enabling parport pc driver on a B2600 (and probably other 64bit PARISC
systems) produced following BUG:

CPU: 0 PID: 1 Comm: swapper Not tainted 4.12.0-rc5-30198-g1132d5e #156
task: 000000009e050000 task.stack: 000000009e04c000

     YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI
PSW: 00001000000001101111111100001111 Not tainted
r00-03  000000ff0806ff0f 000000009e04c990 0000000040871b78 000000009e04cac0
r04-07  0000000040c14de0 ffffffffffffffff 000000009e07f098 000000009d82d200
r08-11  000000009d82d210 0000000000000378 0000000000000000 0000000040c345e0
r12-15  0000000000000005 0000000040c345e0 0000000000000000 0000000040c9d5e0
r16-19  0000000040c345e0 00000000f00001c4 00000000f00001bc 0000000000000061
r20-23  000000009e04ce28 0000000000000010 0000000000000010 0000000040b89e40
r24-27  0000000000000003 0000000000ffffff 000000009d82d210 0000000040c14de0
r28-31  0000000000000000 000000009e04ca90 000000009e04cb40 0000000000000000
sr00-03  0000000000000000 0000000000000000 0000000000000000 0000000000000000
sr04-07  0000000000000000 0000000000000000 0000000000000000 0000000000000000

IASQ: 0000000000000000 0000000000000000 IAOQ: 00000000404aece0 00000000404aece4
 IIR: 03ffe01f    ISR: 0000000010340000  IOR: 000001781304cac8
 CPU:        0   CR30: 000000009e04c000 CR31: 00000000e2976de2
 ORIG_R28: 0000000000000200
 IAOQ[0]: sba_dma_supported+0x80/0xd0
 IAOQ[1]: sba_dma_supported+0x84/0xd0
 RP(r2): parport_pc_probe_port+0x178/0x1200

Cause is a call to dma_coerce_mask_and_coherenet in parport_pc_probe_port,
which PARISC DMA API doesn't handle very nicely. This commit gives back
DMA_ERROR_CODE for DMA API calls, if device isn't capable of DMA
transaction.

Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/parisc/include/asm/dma-mapping.h |   11 +++++++----
 drivers/parisc/ccio-dma.c             |   12 ++++++++++++
 drivers/parisc/dino.c                 |    5 ++++-
 drivers/parisc/lba_pci.c              |    6 ++++--
 drivers/parisc/sba_iommu.c            |   14 ++++++++++++++
 5 files changed, 41 insertions(+), 7 deletions(-)

--- a/arch/parisc/include/asm/dma-mapping.h
+++ b/arch/parisc/include/asm/dma-mapping.h
@@ -20,6 +20,8 @@
 ** flush/purge and allocate "regular" cacheable pages for everything.
 */
 
+#define DMA_ERROR_CODE	(~(dma_addr_t)0)
+
 #ifdef CONFIG_PA11
 extern const struct dma_map_ops pcxl_dma_ops;
 extern const struct dma_map_ops pcx_dma_ops;
@@ -54,12 +56,13 @@ parisc_walk_tree(struct device *dev)
 			break;
 		}
 	}
-	BUG_ON(!dev->platform_data);
 	return dev->platform_data;
 }
-		
-#define GET_IOC(dev) (HBA_DATA(parisc_walk_tree(dev))->iommu)
-	
+
+#define GET_IOC(dev) ({					\
+	void *__pdata = parisc_walk_tree(dev);		\
+	__pdata ? HBA_DATA(__pdata)->iommu : NULL;	\
+})
 
 #ifdef CONFIG_IOMMU_CCIO
 struct parisc_device;
--- a/drivers/parisc/ccio-dma.c
+++ b/drivers/parisc/ccio-dma.c
@@ -741,6 +741,8 @@ ccio_map_single(struct device *dev, void
 
 	BUG_ON(!dev);
 	ioc = GET_IOC(dev);
+	if (!ioc)
+		return DMA_ERROR_CODE;
 
 	BUG_ON(size <= 0);
 
@@ -814,6 +816,10 @@ ccio_unmap_page(struct device *dev, dma_
 	
 	BUG_ON(!dev);
 	ioc = GET_IOC(dev);
+	if (!ioc) {
+		WARN_ON(!ioc);
+		return;
+	}
 
 	DBG_RUN("%s() iovp 0x%lx/%x\n",
 		__func__, (long)iova, size);
@@ -918,6 +924,8 @@ ccio_map_sg(struct device *dev, struct s
 	
 	BUG_ON(!dev);
 	ioc = GET_IOC(dev);
+	if (!ioc)
+		return 0;
 	
 	DBG_RUN_SG("%s() START %d entries\n", __func__, nents);
 
@@ -990,6 +998,10 @@ ccio_unmap_sg(struct device *dev, struct
 
 	BUG_ON(!dev);
 	ioc = GET_IOC(dev);
+	if (!ioc) {
+		WARN_ON(!ioc);
+		return;
+	}
 
 	DBG_RUN_SG("%s() START %d entries, %p,%x\n",
 		__func__, nents, sg_virt(sglist), sglist->length);
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -154,7 +154,10 @@ struct dino_device
 };
 
 /* Looks nice and keeps the compiler happy */
-#define DINO_DEV(d) ((struct dino_device *) d)
+#define DINO_DEV(d) ({				\
+	void *__pdata = d;			\
+	BUG_ON(!__pdata);			\
+	(struct dino_device *)__pdata; })
 
 
 /*
--- a/drivers/parisc/lba_pci.c
+++ b/drivers/parisc/lba_pci.c
@@ -111,8 +111,10 @@ static u32 lba_t32;
 
 
 /* Looks nice and keeps the compiler happy */
-#define LBA_DEV(d) ((struct lba_device *) (d))
-
+#define LBA_DEV(d) ({				\
+	void *__pdata = d;			\
+	BUG_ON(!__pdata);			\
+	(struct lba_device *)__pdata; })
 
 /*
 ** Only allow 8 subsidiary busses per LBA
--- a/drivers/parisc/sba_iommu.c
+++ b/drivers/parisc/sba_iommu.c
@@ -691,6 +691,8 @@ static int sba_dma_supported( struct dev
 		return 0;
 
 	ioc = GET_IOC(dev);
+	if (!ioc)
+		return 0;
 
 	/*
 	 * check if mask is >= than the current max IO Virt Address
@@ -722,6 +724,8 @@ sba_map_single(struct device *dev, void
 	int pide;
 
 	ioc = GET_IOC(dev);
+	if (!ioc)
+		return DMA_ERROR_CODE;
 
 	/* save offset bits */
 	offset = ((dma_addr_t) (long) addr) & ~IOVP_MASK;
@@ -813,6 +817,10 @@ sba_unmap_page(struct device *dev, dma_a
 	DBG_RUN("%s() iovp 0x%lx/%x\n", __func__, (long) iova, size);
 
 	ioc = GET_IOC(dev);
+	if (!ioc) {
+		WARN_ON(!ioc);
+		return;
+	}
 	offset = iova & ~IOVP_MASK;
 	iova ^= offset;        /* clear offset bits */
 	size += offset;
@@ -952,6 +960,8 @@ sba_map_sg(struct device *dev, struct sc
 	DBG_RUN_SG("%s() START %d entries\n", __func__, nents);
 
 	ioc = GET_IOC(dev);
+	if (!ioc)
+		return 0;
 
 	/* Fast path single entry scatterlists. */
 	if (nents == 1) {
@@ -1037,6 +1047,10 @@ sba_unmap_sg(struct device *dev, struct
 		__func__, nents, sg_virt(sglist), sglist->length);
 
 	ioc = GET_IOC(dev);
+	if (!ioc) {
+		WARN_ON(!ioc);
+		return;
+	}
 
 #ifdef SBA_COLLECT_STATS
 	ioc->usg_calls++;

[toc] | [prev] | [next] | [standalone]


#1691266 — [PATCH 4.12 45/84] mm/list_lru.c: fix list_lru_count_node() to be race free

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 45/84] mm/list_lru.c: fix list_lru_count_node() to be race free
Message-ID<u4TVW-6Ls-67@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sahitya Tummala <stummala@codeaurora.org>

commit 2c80cd57c74339889a8752b20862a16c28929c3a upstream.

list_lru_count_node() iterates over all memcgs to get the total number of
entries on the node but it can race with memcg_drain_all_list_lrus(),
which migrates the entries from a dead cgroup to another.  This can return
incorrect number of entries from list_lru_count_node().

Fix this by keeping track of entries per node and simply return it in
list_lru_count_node().

Link: http://lkml.kernel.org/r/1498707555-30525-1-git-send-email-stummala@codeaurora.org
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Acked-by: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Alexander Polakov <apolyakov@beget.ru>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/list_lru.h |    1 +
 mm/list_lru.c            |   14 ++++++--------
 2 files changed, 7 insertions(+), 8 deletions(-)

--- a/include/linux/list_lru.h
+++ b/include/linux/list_lru.h
@@ -44,6 +44,7 @@ struct list_lru_node {
 	/* for cgroup aware lrus points to per cgroup lists, otherwise NULL */
 	struct list_lru_memcg	*memcg_lrus;
 #endif
+	long nr_items;
 } ____cacheline_aligned_in_smp;
 
 struct list_lru {
--- a/mm/list_lru.c
+++ b/mm/list_lru.c
@@ -117,6 +117,7 @@ bool list_lru_add(struct list_lru *lru,
 		l = list_lru_from_kmem(nlru, item);
 		list_add_tail(item, &l->list);
 		l->nr_items++;
+		nlru->nr_items++;
 		spin_unlock(&nlru->lock);
 		return true;
 	}
@@ -136,6 +137,7 @@ bool list_lru_del(struct list_lru *lru,
 		l = list_lru_from_kmem(nlru, item);
 		list_del_init(item);
 		l->nr_items--;
+		nlru->nr_items--;
 		spin_unlock(&nlru->lock);
 		return true;
 	}
@@ -183,15 +185,10 @@ EXPORT_SYMBOL_GPL(list_lru_count_one);
 
 unsigned long list_lru_count_node(struct list_lru *lru, int nid)
 {
-	long count = 0;
-	int memcg_idx;
+	struct list_lru_node *nlru;
 
-	count += __list_lru_count_one(lru, nid, -1);
-	if (list_lru_memcg_aware(lru)) {
-		for_each_memcg_cache_index(memcg_idx)
-			count += __list_lru_count_one(lru, nid, memcg_idx);
-	}
-	return count;
+	nlru = &lru->node[nid];
+	return nlru->nr_items;
 }
 EXPORT_SYMBOL_GPL(list_lru_count_node);
 
@@ -226,6 +223,7 @@ restart:
 			assert_spin_locked(&nlru->lock);
 		case LRU_REMOVED:
 			isolated++;
+			nlru->nr_items--;
 			/*
 			 * If the lru lock has been dropped, our list
 			 * traversal is now invalid and so we have to

[toc] | [prev] | [next] | [standalone]


#1691267 — [PATCH 4.12 47/84] checkpatch: silence perl 5.26.0 unescaped left brace warnings

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 47/84] checkpatch: silence perl 5.26.0 unescaped left brace warnings
Message-ID<u4TVW-6Ls-73@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Cyril Bur <cyrilbur@gmail.com>

commit 8d81ae05d0176da1c54aeaed697fa34be5c5575e upstream.

As of perl 5, version 26, subversion 0 (v5.26.0) some new warnings have
occurred when running checkpatch.

Unescaped left brace in regex is deprecated here (and will be fatal in
Perl 5.30), passed through in regex; marked by <-- HERE in m/^(.\s*){
<-- HERE \s*/ at scripts/checkpatch.pl line 3544.

Unescaped left brace in regex is deprecated here (and will be fatal in
Perl 5.30), passed through in regex; marked by <-- HERE in m/^(.\s*){
<-- HERE \s*/ at scripts/checkpatch.pl line 3885.

Unescaped left brace in regex is deprecated here (and will be fatal in
Perl 5.30), passed through in regex; marked by <-- HERE in
m/^(\+.*(?:do|\))){ <-- HERE / at scripts/checkpatch.pl line 4374.

It seems perfectly reasonable to do as the warning suggests and simply
escape the left brace in these three locations.

Link: http://lkml.kernel.org/r/20170607060135.17384-1-cyrilbur@gmail.com
Signed-off-by: Cyril Bur <cyrilbur@gmail.com>
Acked-by: Joe Perches <joe@perches.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 scripts/checkpatch.pl |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -3541,7 +3541,7 @@ sub process {
 				$fixedline =~ s/\s*=\s*$/ = {/;
 				fix_insert_line($fixlinenr, $fixedline);
 				$fixedline = $line;
-				$fixedline =~ s/^(.\s*){\s*/$1/;
+				$fixedline =~ s/^(.\s*)\{\s*/$1/;
 				fix_insert_line($fixlinenr, $fixedline);
 			}
 		}
@@ -3882,7 +3882,7 @@ sub process {
 				my $fixedline = rtrim($prevrawline) . " {";
 				fix_insert_line($fixlinenr, $fixedline);
 				$fixedline = $rawline;
-				$fixedline =~ s/^(.\s*){\s*/$1\t/;
+				$fixedline =~ s/^(.\s*)\{\s*/$1\t/;
 				if ($fixedline !~ /^\+\s*$/) {
 					fix_insert_line($fixlinenr, $fixedline);
 				}
@@ -4371,7 +4371,7 @@ sub process {
 			if (ERROR("SPACING",
 				  "space required before the open brace '{'\n" . $herecurr) &&
 			    $fix) {
-				$fixed[$fixlinenr] =~ s/^(\+.*(?:do|\))){/$1 {/;
+				$fixed[$fixlinenr] =~ s/^(\+.*(?:do|\)))\{/$1 {/;
 			}
 		}
 

[toc] | [prev] | [next] | [standalone]


#1691269 — [PATCH 4.12 62/84] mnt: In propgate_umount handle visiting mounts in any order

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-07-19 12:00 +0200
Subject[PATCH 4.12 62/84] mnt: In propgate_umount handle visiting mounts in any order
Message-ID<u4TVX-6Ls-75@gated-at.bofh.it>
In reply to#1691242
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric W. Biederman <ebiederm@xmission.com>

commit 99b19d16471e9c3faa85cad38abc9cbbe04c6d55 upstream.

While investigating some poor umount performance I realized that in
the case of overlapping mount trees where some of the mounts are locked
the code has been failing to unmount all of the mounts it should
have been unmounting.

This failure to unmount all of the necessary
mounts can be reproduced with:

$ cat locked_mounts_test.sh

mount -t tmpfs test-base /mnt
mount --make-shared /mnt
mkdir -p /mnt/b

mount -t tmpfs test1 /mnt/b
mount --make-shared /mnt/b
mkdir -p /mnt/b/10

mount -t tmpfs test2 /mnt/b/10
mount --make-shared /mnt/b/10
mkdir -p /mnt/b/10/20

mount --rbind /mnt/b /mnt/b/10/20

unshare -Urm --propagation unchaged /bin/sh -c 'sleep 5; if [ $(grep test /proc/self/mountinfo | wc -l) -eq 1 ] ; then echo SUCCESS ; else echo FAILURE ; fi'
sleep 1
umount -l /mnt/b
wait %%

$ unshare -Urm ./locked_mounts_test.sh

This failure is corrected by removing the prepass that marks mounts
that may be umounted.

A first pass is added that umounts mounts if possible and if not sets
mount mark if they could be unmounted if they weren't locked and adds
them to a list to umount possibilities.  This first pass reconsiders
the mounts parent if it is on the list of umount possibilities, ensuring
that information of umoutability will pass from child to mount parent.

A second pass then walks through all mounts that are umounted and processes
their children unmounting them or marking them for reparenting.

A last pass cleans up the state on the mounts that could not be umounted
and if applicable reparents them to their first parent that remained
mounted.

While a bit longer than the old code this code is much more robust
as it allows information to flow up from the leaves and down
from the trunk making the order in which mounts are encountered
in the umount propgation tree irrelevant.

Fixes: 0c56fe31420c ("mnt: Don't propagate unmounts to locked mounts")
Reviewed-by: Andrei Vagin <avagin@virtuozzo.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/mount.h     |    2 
 fs/namespace.c |    2 
 fs/pnode.c     |  150 +++++++++++++++++++++++++++++++++------------------------
 3 files changed, 91 insertions(+), 63 deletions(-)

--- a/fs/mount.h
+++ b/fs/mount.h
@@ -58,7 +58,7 @@ struct mount {
 	struct mnt_namespace *mnt_ns;	/* containing namespace */
 	struct mountpoint *mnt_mp;	/* where is it mounted */
 	struct hlist_node mnt_mp_list;	/* list mounts with the same mountpoint */
-	struct list_head mnt_reparent;	/* reparent list entry */
+	struct list_head mnt_umounting; /* list entry for umount propagation */
 #ifdef CONFIG_FSNOTIFY
 	struct fsnotify_mark_connector __rcu *mnt_fsnotify_marks;
 	__u32 mnt_fsnotify_mask;
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -236,7 +236,7 @@ static struct mount *alloc_vfsmnt(const
 		INIT_LIST_HEAD(&mnt->mnt_slave_list);
 		INIT_LIST_HEAD(&mnt->mnt_slave);
 		INIT_HLIST_NODE(&mnt->mnt_mp_list);
-		INIT_LIST_HEAD(&mnt->mnt_reparent);
+		INIT_LIST_HEAD(&mnt->mnt_umounting);
 		init_fs_pin(&mnt->mnt_umount, drop_mountpoint);
 	}
 	return mnt;
--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -413,86 +413,95 @@ void propagate_mount_unlock(struct mount
 	}
 }
 
-/*
- * Mark all mounts that the MNT_LOCKED logic will allow to be unmounted.
- */
-static void mark_umount_candidates(struct mount *mnt)
+static void umount_one(struct mount *mnt, struct list_head *to_umount)
 {
-	struct mount *parent = mnt->mnt_parent;
-	struct mount *m;
-
-	BUG_ON(parent == mnt);
-
-	for (m = propagation_next(parent, parent); m;
-			m = propagation_next(m, parent)) {
-		struct mount *child = __lookup_mnt(&m->mnt,
-						mnt->mnt_mountpoint);
-		if (!child || (child->mnt.mnt_flags & MNT_UMOUNT))
-			continue;
-		if (!IS_MNT_LOCKED(child) || IS_MNT_MARKED(m)) {
-			SET_MNT_MARK(child);
-		}
-	}
+	CLEAR_MNT_MARK(mnt);
+	mnt->mnt.mnt_flags |= MNT_UMOUNT;
+	list_del_init(&mnt->mnt_child);
+	list_del_init(&mnt->mnt_umounting);
+	list_move_tail(&mnt->mnt_list, to_umount);
 }
 
 /*
  * NOTE: unmounting 'mnt' naturally propagates to all other mounts its
  * parent propagates to.
  */
-static void __propagate_umount(struct mount *mnt, struct list_head *to_reparent)
+static bool __propagate_umount(struct mount *mnt,
+			       struct list_head *to_umount,
+			       struct list_head *to_restore)
 {
-	struct mount *parent = mnt->mnt_parent;
-	struct mount *m;
+	bool progress = false;
+	struct mount *child;
 
-	BUG_ON(parent == mnt);
-
-	for (m = propagation_next(parent, parent); m;
-			m = propagation_next(m, parent)) {
-		struct mount *topper;
-		struct mount *child = __lookup_mnt(&m->mnt,
-						mnt->mnt_mountpoint);
-		/*
-		 * umount the child only if the child has no children
-		 * and the child is marked safe to unmount.
-		 */
-		if (!child || !IS_MNT_MARKED(child))
+	/*
+	 * The state of the parent won't change if this mount is
+	 * already unmounted or marked as without children.
+	 */
+	if (mnt->mnt.mnt_flags & (MNT_UMOUNT | MNT_MARKED))
+		goto out;
+
+	/* Verify topper is the only grandchild that has not been
+	 * speculatively unmounted.
+	 */
+	list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
+		if (child->mnt_mountpoint == mnt->mnt.mnt_root)
+			continue;
+		if (!list_empty(&child->mnt_umounting) && IS_MNT_MARKED(child))
 			continue;
-		CLEAR_MNT_MARK(child);
+		/* Found a mounted child */
+		goto children;
+	}
 
-		/* If there is exactly one mount covering all of child
-		 * replace child with that mount.
-		 */
-		topper = find_topper(child);
-		if (topper)
-			list_add_tail(&topper->mnt_reparent, to_reparent);
-
-		if (topper || list_empty(&child->mnt_mounts)) {
-			list_del_init(&child->mnt_child);
-			list_del_init(&child->mnt_reparent);
-			child->mnt.mnt_flags |= MNT_UMOUNT;
-			list_move_tail(&child->mnt_list, &mnt->mnt_list);
+	/* Mark mounts that can be unmounted if not locked */
+	SET_MNT_MARK(mnt);
+	progress = true;
+
+	/* If a mount is without children and not locked umount it. */
+	if (!IS_MNT_LOCKED(mnt)) {
+		umount_one(mnt, to_umount);
+	} else {
+children:
+		list_move_tail(&mnt->mnt_umounting, to_restore);
+	}
+out:
+	return progress;
+}
+
+static void umount_list(struct list_head *to_umount,
+			struct list_head *to_restore)
+{
+	struct mount *mnt, *child, *tmp;
+	list_for_each_entry(mnt, to_umount, mnt_list) {
+		list_for_each_entry_safe(child, tmp, &mnt->mnt_mounts, mnt_child) {
+			/* topper? */
+			if (child->mnt_mountpoint == mnt->mnt.mnt_root)
+				list_move_tail(&child->mnt_umounting, to_restore);
+			else
+				umount_one(child, to_umount);
 		}
 	}
 }
 
-static void reparent_mounts(struct list_head *to_reparent)
+static void restore_mounts(struct list_head *to_restore)
 {
-	while (!list_empty(to_reparent)) {
+	/* Restore mounts to a clean working state */
+	while (!list_empty(to_restore)) {
 		struct mount *mnt, *parent;
 		struct mountpoint *mp;
 
-		mnt = list_first_entry(to_reparent, struct mount, mnt_reparent);
-		list_del_init(&mnt->mnt_reparent);
+		mnt = list_first_entry(to_restore, struct mount, mnt_umounting);
+		CLEAR_MNT_MARK(mnt);
+		list_del_init(&mnt->mnt_umounting);
 
-		/* Where should this mount be reparented to? */
+		/* Should this mount be reparented? */
 		mp = mnt->mnt_mp;
 		parent = mnt->mnt_parent;
 		while (parent->mnt.mnt_flags & MNT_UMOUNT) {
 			mp = parent->mnt_mp;
 			parent = parent->mnt_parent;
 		}
-
-		mnt_change_mountpoint(parent, mp, mnt);
+		if (parent != mnt->mnt_parent)
+			mnt_change_mountpoint(parent, mp, mnt);
 	}
 }
 
@@ -506,15 +515,34 @@ static void reparent_mounts(struct list_
 int propagate_umount(struct list_head *list)
 {
 	struct mount *mnt;
-	LIST_HEAD(to_reparent);
-
-	list_for_each_entry_reverse(mnt, list, mnt_list)
-		mark_umount_candidates(mnt);
+	LIST_HEAD(to_restore);
+	LIST_HEAD(to_umount);
 
-	list_for_each_entry(mnt, list, mnt_list)
-		__propagate_umount(mnt, &to_reparent);
+	list_for_each_entry(mnt, list, mnt_list) {
+		struct mount *parent = mnt->mnt_parent;
+		struct mount *m;
+
+		for (m = propagation_next(parent, parent); m;
+		     m = propagation_next(m, parent)) {
+			struct mount *child = __lookup_mnt(&m->mnt,
+							   mnt->mnt_mountpoint);
+			if (!child)
+				continue;
+
+			/* Check the child and parents while progress is made */
+			while (__propagate_umount(child,
+						  &to_umount, &to_restore)) {
+				/* Is the parent a umount candidate? */
+				child = child->mnt_parent;
+				if (list_empty(&child->mnt_umounting))
+					break;
+			}
+		}
+	}
 
-	reparent_mounts(&to_reparent);
+	umount_list(&to_umount, &to_restore);
+	restore_mounts(&to_restore);
+	list_splice_tail(&to_umount, list);
 
 	return 0;
 }

[toc] | [prev] | [next] | [standalone]


Page 1 of 3  [1] 2 3  Next page →

Back to top | Article view | linux.kernel


csiph-web