Eric Lee / smarc-fsl-linux-kernel

13 Mar, 2019

1 commit

11 Mar, 2019

1 commit

08 Mar, 2019

1 commit

  • 8a72b81e6   isdn: isdnloop: fix pointer dereference bug ... Browse Code »

    clang has spotted an ancient code bug and warns about it with:

    drivers/isdn/isdnloop/isdnloop.c:573:12: error: address of array 'card->rcard' will always evaluate to 'true' [-Werror,-Wpointer-bool-conversion]

    This is an array of pointers, so we should check if a specific
    pointer exists in the array before using it, not whether the
    array itself exists.

    Signed-off-by: Arnd Bergmann
    Reviewed-by: Nathan Chancellor
    Signed-off-by: David S. Miller

    Arnd Bergmann
     

05 Mar, 2019

1 commit

23 Feb, 2019

1 commit

  • 6d20faecc   isdn_common: Mark expected switch fall-throughs ... Browse Code »

    In preparation to enabling -Wimplicit-fallthrough, mark switch
    cases where we are expecting to fall through.

    This patch fixes the following warnings:

    drivers/isdn/i4l/isdn_common.c: In function ‘isdn_wildmat’:
    drivers/isdn/i4l/isdn_common.c:173:5: warning: this statement may fall through [-Wimplicit-fallthrough=]
    p++;
    ~^~
    drivers/isdn/i4l/isdn_common.c:174:3: note: here
    default:
    ^~~~~~~
    CC [M] drivers/leds/leds-lp8788.o
    CC [M] drivers/gpu/drm/amd/amdgpu/../powerplay/smumgr/smu10_smumgr.o
    drivers/isdn/i4l/isdn_common.c: In function ‘isdn_status_callback’:
    drivers/isdn/i4l/isdn_common.c:729:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
    if (divert_if)
    ^
    drivers/isdn/i4l/isdn_common.c:732:2: note: here
    default:
    ^~~~~~~

    Warning level 3 was used: -Wimplicit-fallthrough=3

    Notice that, in this particular case, the code comment is modified
    in accordance with what GCC is expecting to find.

    This patch is part of the ongoing efforts to enable
    -Wimplicit-fallthrough.

    Signed-off-by: Gustavo A. R. Silva
    Signed-off-by: David S. Miller

    Gustavo A. R. Silva
     

15 Feb, 2019

1 commit

13 Feb, 2019

3 commits

  • b67de691f   isdn_v110: mark expected switch fall-through ... Browse Code »

    In preparation to enabling -Wimplicit-fallthrough, mark switch
    cases where we are expecting to fall through.

    This patch fixes the following warnings:

    drivers/isdn/i4l/isdn_v110.c: In function ‘EncodeMatrix’:
    drivers/isdn/i4l/isdn_v110.c:353:7: warning: this statement may fall through [-Wimplicit-fallthrough=]
    if (line >= mlen) {
    ^
    drivers/isdn/i4l/isdn_v110.c:358:3: note: here
    case 128:
    ^~~~

    Warning level 3 was used: -Wimplicit-fallthrough=3

    Notice that, in this particular case, the code comment is modified
    in accordance with what GCC is expecting to find.

    This patch is part of the ongoing efforts to enable
    -Wimplicit-fallthrough.

    Signed-off-by: Gustavo A. R. Silva
    Signed-off-by: David S. Miller

    Gustavo A. R. Silva
     
  • 56e9b6b96   isdn: i4l: isdn_tty: Mark expected switch fall-through ... Browse Code »

    In preparation to enabling -Wimplicit-fallthrough, mark switch
    cases where we are expecting to fall through.

    This patch fixes the following warnings:

    drivers/isdn/i4l/isdn_tty.c: In function ‘isdn_tty_edit_at’:
    drivers/isdn/i4l/isdn_tty.c:3644:18: warning: this statement may fall through [-Wimplicit-fallthrough=]
    m->mdmcmdl = 0;
    ~~~~~~~~~~~^~~
    drivers/isdn/i4l/isdn_tty.c:3646:5: note: here
    case 0:
    ^~~~

    Warning level 3 was used: -Wimplicit-fallthrough=3

    Notice that, in this particular case, the code comment is modified
    in accordance with what GCC is expecting to find.

    This patch is part of the ongoing efforts to enable
    -Wimplicit-fallthrough.

    Signed-off-by: Gustavo A. R. Silva
    Signed-off-by: David S. Miller

    Gustavo A. R. Silva
     
  • b6cd7dd99   ser_gigaset: mark expected switch fall-through ... Browse Code »

    In preparation to enabling -Wimplicit-fallthrough, mark switch
    cases where we are expecting to fall through.

    This patch fixes the following warning:

    drivers/isdn/gigaset/ser-gigaset.c: In function ‘gigaset_tty_ioctl’:
    drivers/isdn/gigaset/ser-gigaset.c:627:3: warning: this statement may fall through [-Wimplicit-fallthrough=]
    switch (arg) {
    ^~~~~~
    drivers/isdn/gigaset/ser-gigaset.c:638:2: note: here
    default:
    ^~~~~~~

    Warning level 3 was used: -Wimplicit-fallthrough=3

    Notice that, in this particular case, the code comment is modified
    in accordance with what GCC is expecting to find.

    This patch is part of the ongoing efforts to enable
    -Wimplicit-fallthrough.

    Signed-off-by: Gustavo A. R. Silva
    Acked-by: Paul Bolle
    Signed-off-by: David S. Miller

    Gustavo A. R. Silva
     

09 Feb, 2019

1 commit

06 Feb, 2019

1 commit

  • bdcc5bc25   mISDN: fix a race in dev_expire_timer() ... Browse Code »

    Since mISDN_close() uses dev->pending to iterate over active
    timers, there is a chance that one timer got removed from the
    ->pending list in dev_expire_timer() but that the thread
    has not called yet wake_up_interruptible()

    So mISDN_close() could miss this and free dev before
    completion of at least one dev_expire_timer()

    syzbot was able to catch this race :

    BUG: KASAN: use-after-free in register_lock_class+0x140c/0x1bf0 kernel/locking/lockdep.c:827
    Write of size 8 at addr ffff88809fc18948 by task syz-executor1/24769

    CPU: 1 PID: 24769 Comm: syz-executor1 Not tainted 5.0.0-rc5 #60
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:

    __dump_stack lib/dump_stack.c:77 [inline]
    dump_stack+0x172/0x1f0 lib/dump_stack.c:113
    print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
    kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
    __asan_report_store8_noabort+0x17/0x20 mm/kasan/generic_report.c:140
    register_lock_class+0x140c/0x1bf0 kernel/locking/lockdep.c:827
    __lock_acquire+0x11f/0x4700 kernel/locking/lockdep.c:3224
    lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3841
    __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
    _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:152
    __wake_up_common_lock+0xc7/0x190 kernel/sched/wait.c:120
    __wake_up+0xe/0x10 kernel/sched/wait.c:145
    dev_expire_timer+0xe4/0x3b0 drivers/isdn/mISDN/timerdev.c:174
    call_timer_fn+0x190/0x720 kernel/time/timer.c:1325
    protocol 88fb is buggy, dev hsr_slave_0
    protocol 88fb is buggy, dev hsr_slave_1
    expire_timers kernel/time/timer.c:1362 [inline]
    __run_timers kernel/time/timer.c:1681 [inline]
    __run_timers kernel/time/timer.c:1649 [inline]
    run_timer_softirq+0x652/0x1700 kernel/time/timer.c:1694
    __do_softirq+0x266/0x95a kernel/softirq.c:292
    invoke_softirq kernel/softirq.c:373 [inline]
    irq_exit+0x180/0x1d0 kernel/softirq.c:413
    exiting_irq arch/x86/include/asm/apic.h:536 [inline]
    smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1062
    apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807

    RIP: 0010:__sanitizer_cov_trace_pc+0x26/0x50 kernel/kcov.c:101
    Code: 90 90 90 90 55 48 89 e5 48 8b 75 08 65 48 8b 04 25 40 ee 01 00 65 8b 15 98 12 92 7e 81 e2 00 01 1f 00 75 2b 8b 90 d8 12 00 00 fa 02 75 20 48 8b 88 e0 12 00 00 8b 80 dc 12 00 00 48 8b 11 48
    RSP: 0018:ffff8880589b7a60 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
    RAX: ffff888087ce25c0 RBX: 0000000000000001 RCX: ffffffff818f8ca3
    RDX: 0000000000000000 RSI: ffffffff818f8b48 RDI: 0000000000000001
    RBP: ffff8880589b7a60 R08: ffff888087ce25c0 R09: ffffed1015d25bd0
    R10: ffffed1015d25bcf R11: ffff8880ae92de7b R12: ffffea0001ae4680
    R13: ffffea0001ae4688 R14: 0000000000000000 R15: ffffea0001b41648
    PageIdle include/linux/page-flags.h:398 [inline]
    page_is_idle include/linux/page_idle.h:29 [inline]
    mark_page_accessed+0x618/0x1140 mm/swap.c:398
    touch_buffer fs/buffer.c:59 [inline]
    __find_get_block+0x312/0xcc0 fs/buffer.c:1298
    sb_find_get_block include/linux/buffer_head.h:338 [inline]
    recently_deleted fs/ext4/ialloc.c:682 [inline]
    find_inode_bit.isra.0+0x202/0x510 fs/ext4/ialloc.c:722
    __ext4_new_inode+0x14ad/0x52c0 fs/ext4/ialloc.c:914
    ext4_symlink+0x3f8/0xbe0 fs/ext4/namei.c:3096
    vfs_symlink fs/namei.c:4126 [inline]
    vfs_symlink+0x378/0x5d0 fs/namei.c:4112
    do_symlinkat+0x22b/0x290 fs/namei.c:4153
    __do_sys_symlink fs/namei.c:4172 [inline]
    __se_sys_symlink fs/namei.c:4170 [inline]
    __x64_sys_symlink+0x59/0x80 fs/namei.c:4170
    do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
    entry_SYSCALL_64_after_hwframe+0x49/0xbe
    RIP: 0033:0x457b67
    Code: 0f 1f 00 b8 5c 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 6d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 58 00 00 00 0f 05 3d 01 f0 ff ff 0f 83 4d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00
    RSP: 002b:00007fff045ce0f8 EFLAGS: 00000202 ORIG_RAX: 0000000000000058
    RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000457b67
    RDX: 00007fff045ce173 RSI: 00000000004bd63f RDI: 00007fff045ce160
    RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000013
    R10: 0000000000000075 R11: 0000000000000202 R12: 0000000000000000
    R13: 0000000000000001 R14: 000000000000029b R15: 0000000000000001

    Allocated by task 24763:
    save_stack+0x45/0xd0 mm/kasan/common.c:73
    set_track mm/kasan/common.c:85 [inline]
    __kasan_kmalloc mm/kasan/common.c:496 [inline]
    __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:469
    kasan_kmalloc+0x9/0x10 mm/kasan/common.c:504
    kmem_cache_alloc_trace+0x151/0x760 mm/slab.c:3609
    kmalloc include/linux/slab.h:545 [inline]
    mISDN_open+0x9a/0x270 drivers/isdn/mISDN/timerdev.c:59
    misc_open+0x398/0x4c0 drivers/char/misc.c:141
    chrdev_open+0x247/0x6b0 fs/char_dev.c:417
    do_dentry_open+0x47d/0x1130 fs/open.c:771
    vfs_open+0xa0/0xd0 fs/open.c:880
    do_last fs/namei.c:3418 [inline]
    path_openat+0x10d7/0x4690 fs/namei.c:3534
    do_filp_open+0x1a1/0x280 fs/namei.c:3564
    do_sys_open+0x3fe/0x5d0 fs/open.c:1063
    __do_sys_openat fs/open.c:1090 [inline]
    __se_sys_openat fs/open.c:1084 [inline]
    __x64_sys_openat+0x9d/0x100 fs/open.c:1084
    do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
    entry_SYSCALL_64_after_hwframe+0x49/0xbe

    Freed by task 24762:
    save_stack+0x45/0xd0 mm/kasan/common.c:73
    set_track mm/kasan/common.c:85 [inline]
    __kasan_slab_free+0x102/0x150 mm/kasan/common.c:458
    kasan_slab_free+0xe/0x10 mm/kasan/common.c:466
    __cache_free mm/slab.c:3487 [inline]
    kfree+0xcf/0x230 mm/slab.c:3806
    mISDN_close+0x2a1/0x390 drivers/isdn/mISDN/timerdev.c:97
    __fput+0x2df/0x8d0 fs/file_table.c:278
    ____fput+0x16/0x20 fs/file_table.c:309
    task_work_run+0x14a/0x1c0 kernel/task_work.c:113
    tracehook_notify_resume include/linux/tracehook.h:188 [inline]
    exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:166
    prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
    syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
    do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293
    entry_SYSCALL_64_after_hwframe+0x49/0xbe

    The buggy address belongs to the object at ffff88809fc18900
    which belongs to the cache kmalloc-192 of size 192
    The buggy address is located 72 bytes inside of
    192-byte region [ffff88809fc18900, ffff88809fc189c0)
    The buggy address belongs to the page:
    page:ffffea00027f0600 count:1 mapcount:0 mapping:ffff88812c3f0040 index:0xffff88809fc18000
    flags: 0x1fffc0000000200(slab)
    raw: 01fffc0000000200 ffffea000269f648 ffffea00029f7408 ffff88812c3f0040
    raw: ffff88809fc18000 ffff88809fc18000 000000010000000b 0000000000000000
    page dumped because: kasan: bad access detected

    Memory state around the buggy address:
    ffff88809fc18800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    ffff88809fc18880: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    >ffff88809fc18900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    ^
    ffff88809fc18980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
    ffff88809fc18a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

    Signed-off-by: Eric Dumazet
    Cc: Karsten Keil
    Reported-by: syzbot
    Signed-off-by: David S. Miller

    Eric Dumazet
     

04 Feb, 2019

1 commit

  • 13c6ee2a9   socket: Use old_timeval types for socket timestamps ... Browse Code »

    As part of y2038 solution, all internal uses of
    struct timeval are replaced by struct __kernel_old_timeval
    and struct compat_timeval by struct old_timeval32.
    Make socket timestamps use these new types.

    This is mainly to be able to verify that the kernel build
    is y2038 safe when such non y2038 safe types are not
    supported anymore.

    Signed-off-by: Deepa Dinamani
    Acked-by: Willem de Bruijn
    Cc: isdn@linux-pingi.de
    Signed-off-by: David S. Miller

    Deepa Dinamani
     

22 Jan, 2019

1 commit

20 Jan, 2019

2 commits

  • 65ea97d17   isdn: remove unneeded semicolon ... Browse Code »

    remove unneeded semicolon

    Signed-off-by: YueHaibing
    Signed-off-by: David S. Miller

    YueHaibing
     
  • 7afa81c55   isdn: avm: Fix string plus integer warning from Clang ... Browse Code »

    A recent commit in Clang expanded the -Wstring-plus-int warning, showing
    some odd behavior in this file.

    drivers/isdn/hardware/avm/b1.c:426:30: warning: adding 'int' to a string does not append to the string [-Wstring-plus-int]
    cinfo->version[j] = "\0\0" + 1;
    ~~~~~~~^~~
    drivers/isdn/hardware/avm/b1.c:426:30: note: use array indexing to silence this warning
    cinfo->version[j] = "\0\0" + 1;
    ^
    & [ ]
    1 warning generated.

    This is equivalent to just "\0". Nick pointed out that it is smarter to
    use "" instead of "\0" because "" is used elsewhere in the kernel and
    can be deduplicated at the linking stage.

    Link: https://github.com/ClangBuiltLinux/linux/issues/309
    Suggested-by: Nick Desaulniers
    Signed-off-by: Nathan Chancellor
    Signed-off-by: David S. Miller

    Nathan Chancellor
     

12 Jan, 2019

2 commits

  • 8d008e64a   mISDN: hfcsusb: Use struct_size() in kzalloc() ... Browse Code »

    One of the more common cases of allocation size calculations is finding the
    size of a structure that has a zero-sized array at the end, along with memory
    for some number of elements for that array. For example:

    struct foo {
    int stuff;
    void *entry[];
    };

    instance = kzalloc(sizeof(struct foo) + sizeof(void *) * count, GFP_KERNEL);

    Instead of leaving these open-coded and prone to type mistakes, we can now
    use the new struct_size() helper:

    instance = kzalloc(struct_size(instance, entry, count), GFP_KERNEL);

    This code was detected with the help of Coccinelle.

    Signed-off-by: Gustavo A. R. Silva
    Signed-off-by: David S. Miller

    Gustavo A. R. Silva
     
  • 2ff33d663   isdn: i4l: isdn_tty: Fix some concurrency double-free bugs ... Browse Code »

    The functions isdn_tty_tiocmset() and isdn_tty_set_termios() may be
    concurrently executed.

    isdn_tty_tiocmset
    isdn_tty_modem_hup
    line 719: kfree(info->dtmf_state);
    line 721: kfree(info->silence_state);
    line 723: kfree(info->adpcms);
    line 725: kfree(info->adpcmr);

    isdn_tty_set_termios
    isdn_tty_modem_hup
    line 719: kfree(info->dtmf_state);
    line 721: kfree(info->silence_state);
    line 723: kfree(info->adpcms);
    line 725: kfree(info->adpcmr);

    Thus, some concurrency double-free bugs may occur.

    These possible bugs are found by a static tool written by myself and
    my manual code review.

    To fix these possible bugs, the mutex lock "modem_info_mutex" used in
    isdn_tty_tiocmset() is added in isdn_tty_set_termios().

    Signed-off-by: Jia-Ju Bai
    Signed-off-by: David S. Miller

    Jia-Ju Bai
     

03 Jan, 2019

1 commit

  • d63967e47   isdn: fix kernel-infoleak in capi_unlocked_ioctl ... Browse Code »

    Since capi_ioctl() copies 64 bytes after calling
    capi20_get_manufacturer() we need to ensure to not leak
    information to user.

    BUG: KMSAN: kernel-infoleak in _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32
    CPU: 0 PID: 11245 Comm: syz-executor633 Not tainted 4.20.0-rc7+ #2
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
    __dump_stack lib/dump_stack.c:77 [inline]
    dump_stack+0x173/0x1d0 lib/dump_stack.c:113
    kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613
    kmsan_internal_check_memory+0x9d4/0xb00 mm/kmsan/kmsan.c:704
    kmsan_copy_to_user+0xab/0xc0 mm/kmsan/kmsan_hooks.c:601
    _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32
    capi_ioctl include/linux/uaccess.h:177 [inline]
    capi_unlocked_ioctl+0x1a0b/0x1bf0 drivers/isdn/capi/capi.c:939
    do_vfs_ioctl+0xebd/0x2bf0 fs/ioctl.c:46
    ksys_ioctl fs/ioctl.c:713 [inline]
    __do_sys_ioctl fs/ioctl.c:720 [inline]
    __se_sys_ioctl+0x1da/0x270 fs/ioctl.c:718
    __x64_sys_ioctl+0x4a/0x70 fs/ioctl.c:718
    do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
    entry_SYSCALL_64_after_hwframe+0x63/0xe7
    RIP: 0033:0x440019
    Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
    RSP: 002b:00007ffdd4659fb8 EFLAGS: 00000213 ORIG_RAX: 0000000000000010
    RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440019
    RDX: 0000000020000080 RSI: 00000000c0044306 RDI: 0000000000000003
    RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8
    R10: 0000000000000000 R11: 0000000000000213 R12: 00000000004018a0
    R13: 0000000000401930 R14: 0000000000000000 R15: 0000000000000000

    Local variable description: ----data.i@capi_unlocked_ioctl
    Variable was created at:
    capi_ioctl drivers/isdn/capi/capi.c:747 [inline]
    capi_unlocked_ioctl+0x82/0x1bf0 drivers/isdn/capi/capi.c:939
    do_vfs_ioctl+0xebd/0x2bf0 fs/ioctl.c:46

    Bytes 12-63 of 64 are uninitialized
    Memory access of size 64 starts at ffff88807ac5fce8
    Data copied to user address 0000000020000080

    Signed-off-by: Eric Dumazet
    Reported-by: syzbot
    Cc: Karsten Keil
    Signed-off-by: David S. Miller

    Eric Dumazet
     

29 Dec, 2018

1 commit

  • 7418e6520   isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw() ... Browse Code »

    In drivers/isdn/hisax/hfc_pci.c, the functions hfcpci_interrupt() and
    HFCPCI_l1hw() may be concurrently executed.

    HFCPCI_l1hw()
    line 1173: if (!cs->tx_skb)

    hfcpci_interrupt()
    line 942: spin_lock_irqsave();
    line 1066: dev_kfree_skb_irq(cs->tx_skb);

    Thus, a possible concurrency use-after-free bug may occur
    in HFCPCI_l1hw().

    To fix these bugs, the calls to spin_lock_irqsave() and
    spin_unlock_irqrestore() are added in HFCPCI_l1hw(), to protect the
    access to cs->tx_skb.

    Signed-off-by: Jia-Ju Bai
    Signed-off-by: David S. Miller

    Jia-Ju Bai
     

17 Nov, 2018

1 commit

12 Nov, 2018

1 commit

07 Nov, 2018

1 commit

  • a8d621953   ISDN: eicon: Remove driver ... Browse Code »

    I started looking at the history of this driver, and last time the
    maintainer was active on the mailing list was when discussing how to
    remove it. This was in 2012:

    https://lore.kernel.org/lkml/4F4DE175.30002@melware.de/

    It looks to me like this has in practice been an orphan for quite a while.
    It's throwing warnings about stack size in a function that is in dire
    need of refactoring, and it's probably a case of "it's time to call it".

    Cc: Armin Schindler
    Cc: Karsten Keil
    Signed-off-by: Olof Johansson
    Signed-off-by: David S. Miller

    Olof Johansson
     

02 Nov, 2018

1 commit

  • 9931a07d5   Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs ... Browse Code »

    Pull AFS updates from Al Viro:
    "AFS series, with some iov_iter bits included"

    * 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (26 commits)
    missing bits of "iov_iter: Separate type from direction and use accessor functions"
    afs: Probe multiple fileservers simultaneously
    afs: Fix callback handling
    afs: Eliminate the address pointer from the address list cursor
    afs: Allow dumping of server cursor on operation failure
    afs: Implement YFS support in the fs client
    afs: Expand data structure fields to support YFS
    afs: Get the target vnode in afs_rmdir() and get a callback on it
    afs: Calc callback expiry in op reply delivery
    afs: Fix FS.FetchStatus delivery from updating wrong vnode
    afs: Implement the YFS cache manager service
    afs: Remove callback details from afs_callback_break struct
    afs: Commit the status on a new file/dir/symlink
    afs: Increase to 64-bit volume ID and 96-bit vnode ID for YFS
    afs: Don't invoke the server to read data beyond EOF
    afs: Add a couple of tracepoints to log I/O errors
    afs: Handle EIO from delivery function
    afs: Fix TTL on VL server and address lists
    afs: Implement VL server rotation
    afs: Improve FS server rotation error handling
    ...

    Linus Torvalds
     

24 Oct, 2018

2 commits

  • 44adbac8f   Merge branch 'work.tty-ioctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs ... Browse Code »

    Pull tty ioctl updates from Al Viro:
    "This is the compat_ioctl work related to tty ioctls.

    Quite a bit of dead code taken out, all tty-related stuff gone from
    fs/compat_ioctl.c. A bunch of compat bugs fixed - some still remain,
    but all more or less generic tty-related ioctls should be covered
    (remaining issues are in things like driver-private ioctls in a pcmcia
    serial card driver not getting properly handled in 32bit processes on
    64bit host, etc)"

    * 'work.tty-ioctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (53 commits)
    kill TIOCSERGSTRUCT
    change semantics of ldisc ->compat_ioctl()
    kill TIOCSER[SG]WILD
    synclink_gt(): fix compat_ioctl()
    pty: fix compat ioctls
    compat_ioctl - kill keyboard ioctl handling
    gigaset: add ->compat_ioctl()
    vt_compat_ioctl(): clean up, use compat_ptr() properly
    gigaset: don't try to printk userland buffer contents
    dgnc: don't bother with (empty) stub for TCXONC
    dgnc: leave TIOC[GS]SOFTCAR to ldisc
    remove fallback to drivers for TIOCGICOUNT
    dgnc: break-related ioctls won't reach ->ioctl()
    kill the rest of tty COMPAT_IOCTL() entries
    dgnc: TIOCM... won't reach ->ioctl()
    isdn_tty: TCSBRK{,P} won't reach ->ioctl()
    kill capinc_tty_ioctl()
    take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl()
    synclink: reduce pointless checks in ->ioctl()
    complete ->[sg]et_serial() switchover
    ...

    Linus Torvalds
     
  • aa563d7bc   iov_iter: Separate type from direction and use accessor functions ... Browse Code »

    In the iov_iter struct, separate the iterator type from the iterator
    direction and use accessor functions to access them in most places.

    Convert a bunch of places to use switch-statements to access them rather
    then chains of bitwise-AND statements. This makes it easier to add further
    iterator types. Also, this can be more efficient as to implement a switch
    of small contiguous integers, the compiler can use ~50% fewer compare
    instructions than it has to use bitwise-and instructions.

    Further, cease passing the iterator type into the iterator setup function.
    The iterator function can set that itself. Only the direction is required.

    Signed-off-by: David Howells

    David Howells
     

23 Oct, 2018

2 commits

  • aeb5e02ac   mISDN: Fix type of switch control variable in ctrl_teimanager ... Browse Code »

    Clang warns (trimmed for brevity):

    drivers/isdn/mISDN/tei.c:1193:7: warning: overflow converting case value
    to switch condition type (2147764552 to 18446744071562348872) [-Wswitch]
    case IMHOLD_L1:
    ^
    drivers/isdn/mISDN/tei.c:1187:7: warning: overflow converting case value
    to switch condition type (2147764550 to 18446744071562348870) [-Wswitch]
    case IMCLEAR_L2:
    ^
    2 warnings generated.

    The root cause is that the _IOC macro can generate really large numbers,
    which don't find into type int. My research into how GCC and Clang are
    handling this at a low level didn't prove fruitful and surveying the
    kernel tree shows that aside from here and a few places in the scsi
    subsystem, everything that uses _IOC is at least of type 'unsigned int'.
    Make that change here because as nothing in this function cares about
    the signedness of the variable and it removes ambiguity, which is never
    good when dealing with compilers.

    While we're here, remove the unnecessary local variable ret (just return
    -EINVAL and 0 directly).

    Link: https://github.com/ClangBuiltLinux/linux/issues/67
    Signed-off-by: Nathan Chancellor
    Signed-off-by: David S. Miller

    Nathan Chancellor
     
  • a1930a987   isdn: hfc_{pci,sx}: Avoid empty body if statements ... Browse Code »

    Clang warns:

    drivers/isdn/hisax/hfc_pci.c:131:34: error: if statement has empty body
    [-Werror,-Wempty-body]
    if (Read_hfc(cs, HFCPCI_INT_S1));
    ^
    drivers/isdn/hisax/hfc_pci.c:131:34: note: put the semicolon on a
    separate line to silence this warning

    In my attempt to hide the warnings because I thought they didn't serve
    any purpose[1], Masahiro Yamada pointed out that {Read,Write}_hfc in
    hci_pci.c should be using a standard register access method; otherwise,
    the compiler will just remove the if statements.

    For hfc_pci, use the versions of {Read,Write}_hfc found in
    drivers/isdn/hardware/mISDN/hfc_pCI.h while converting pci_io to be
    'void __iomem *' (and clean up ioremap) then remove the empty if
    statements.

    For hfc_sx, {Read,Write}_hfc are already use a proper register accessor
    (inb, outb) so just remove the unnecessary if statements.

    [1]: https://lore.kernel.org/lkml/20181016021454.11953-1-natechancellor@gmail.com/

    Link: https://github.com/ClangBuiltLinux/linux/issues/66
    Suggested-by: Masahiro Yamada
    Signed-off-by: Nathan Chancellor
    Signed-off-by: David S. Miller

    Nathan Chancellor
     

13 Oct, 2018

4 commits

11 Oct, 2018

1 commit

  • 7579d84be   isdn/hisax: amd7930_fn: Remove unnecessary parentheses ... Browse Code »

    Clang warns when multiple sets of parentheses are used for a single
    conditional statement.

    drivers/isdn/hisax/amd7930_fn.c:628:32: warning: equality comparison
    with extraneous parentheses [-Wparentheses-equality]
    if ((cs->dc.amd7930.ph_state == 8)) {
    ~~~~~~~~~~~~~~~~~~~~~~~~^~~~
    drivers/isdn/hisax/amd7930_fn.c:628:32: note: remove extraneous
    parentheses around the comparison to silence this warning
    if ((cs->dc.amd7930.ph_state == 8)) {
    ~ ^ ~
    drivers/isdn/hisax/amd7930_fn.c:628:32: note: use '=' to turn this
    equality comparison into an assignment
    if ((cs->dc.amd7930.ph_state == 8)) {
    ^~
    =
    1 warning generated.

    Signed-off-by: Nathan Chancellor
    Signed-off-by: David S. Miller

    Nathan Chancellor
     

09 Oct, 2018

2 commits

06 Oct, 2018

1 commit

  • 2b9156129   gigaset: asyncdata: mark expected switch fall-throughs ... Browse Code »

    In preparation to enabling -Wimplicit-fallthrough, mark switch cases
    where we are expecting to fall through.

    Notice that in this particular case, I replaced the
    " --v-- fall through --v-- " comment with a proper
    "fall through", which is what GCC is expecting to find.

    Addresses-Coverity-ID: 1364476 ("Missing break in switch")
    Addresses-Coverity-ID: 1364477 ("Missing break in switch")
    Signed-off-by: Gustavo A. R. Silva
    Signed-off-by: David S. Miller

    Gustavo A. R. Silva
     

03 Oct, 2018

1 commit

22 Sep, 2018

1 commit

20 Sep, 2018

1 commit

  • faa08325b   isdn/hisax: Remove unnecessary parenthesis ... Browse Code »

    Clang warns when more than one set of parentheses are used for single
    conditional statements:

    drivers/isdn/hisax/w6692.c:627:30: warning: equality comparison with
    extraneous parentheses [-Wparentheses-equality]
    if ((cs->dc.w6692.ph_state == W_L1IND_DRD)) {
    ~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~
    drivers/isdn/hisax/w6692.c:627:30: note: remove extraneous parentheses
    around the comparison to silence this warning
    if ((cs->dc.w6692.ph_state == W_L1IND_DRD)) {
    ~ ^ ~
    drivers/isdn/hisax/w6692.c:627:30: note: use '=' to turn this equality
    comparison into an assignment
    if ((cs->dc.w6692.ph_state == W_L1IND_DRD)) {
    ^~
    =
    1 warning generated.

    Remove the parentheses to silence this warning.

    Reported-by: Nick Desaulniers
    Signed-off-by: Nathan Chancellor
    Signed-off-by: David S. Miller

    Nathan Chancellor
     

17 Aug, 2018

1 commit

  • 5e22002aa   isdn: Disable IIOCDBGVAR ... Browse Code »

    It was possible to directly leak the kernel address where the isdn_dev
    structure pointer was stored. This is a kernel ASLR bypass for anyone
    with access to the ioctl. The code had been present since the beginning
    of git history, though this shouldn't ever be needed for normal operation,
    therefore remove it.

    Reported-by: Al Viro
    Cc: Karsten Keil
    Signed-off-by: Kees Cook
    Signed-off-by: David S. Miller

    Kees Cook
     

27 Jul, 2018

1 commit

  • 055d624fa   isdn: hisax: config: Replace GFP_ATOMIC with GFP_KERNEL ... Browse Code »

    hisax_cs_new() and hisax_cs_setup() are never called in atomic context.
    They call kmalloc() and kzalloc() with GFP_ATOMIC, which is not necessary.
    GFP_ATOMIC can be replaced with GFP_KERNEL.

    This is found by a static analysis tool named DCNS written by myself.

    Signed-off-by: Jia-Ju Bai
    Signed-off-by: David S. Miller

    Jia-Ju Bai