Eric Lee / smarc-fsl-linux-kernel

06 Jan, 2021

1 commit

  • f290cffdf   misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells() ... Browse Code »

    commit 31dcb6c30a26d32650ce134820f27de3c675a45a upstream.

    A kernel-infoleak was reported by syzbot, which was caused because
    dbells was left uninitialized.
    Using kzalloc() instead of kmalloc() fixes this issue.

    Reported-by: syzbot+a79e17c39564bedf0930@syzkaller.appspotmail.com
    Tested-by: syzbot+a79e17c39564bedf0930@syzkaller.appspotmail.com
    Signed-off-by: Anant Thazhemadam
    Link: https://lore.kernel.org/r/20201122224534.333471-1-anant.thazhemadam@gmail.com
    Signed-off-by: Greg Kroah-Hartman

    Anant Thazhemadam
     

28 Aug, 2020

1 commit

  • 90ca6333f   VMCI: check return value of get_user_pages_fast() for errors ... Browse Code »

    In a couple of places in qp_host_get_user_memory(),
    get_user_pages_fast() is called without properly checking for errors. If
    e.g. -EFAULT is returned, this negative value will then be passed on to
    qp_release_pages(), which expects a u64 as input.

    Fix this by only calling qp_release_pages() when we have a positive
    number returned.

    Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.")
    Signed-off-by: Alex Dewar
    Link: https://lore.kernel.org/r/20200825164522.412392-1-alex.dewar90@gmail.com
    Signed-off-by: Greg Kroah-Hartman

    Alex Dewar
     

29 May, 2020

1 commit

02 Dec, 2019

1 commit

  • 0da522107   Merge tag 'compat-ioctl-5.5' of git://git.kernel.org:/pub/scm/linux/kernel/git/arnd/playground ... Browse Code »

    Pull removal of most of fs/compat_ioctl.c from Arnd Bergmann:
    "As part of the cleanup of some remaining y2038 issues, I came to
    fs/compat_ioctl.c, which still has a couple of commands that need
    support for time64_t.

    In completely unrelated work, I spent time on cleaning up parts of
    this file in the past, moving things out into drivers instead.

    After Al Viro reviewed an earlier version of this series and did a lot
    more of that cleanup, I decided to try to completely eliminate the
    rest of it and move it all into drivers.

    This series incorporates some of Al's work and many patches of my own,
    but in the end stops short of actually removing the last part, which
    is the scsi ioctl handlers. I have patches for those as well, but they
    need more testing or possibly a rewrite"

    * tag 'compat-ioctl-5.5' of git://git.kernel.org:/pub/scm/linux/kernel/git/arnd/playground: (42 commits)
    scsi: sd: enable compat ioctls for sed-opal
    pktcdvd: add compat_ioctl handler
    compat_ioctl: move SG_GET_REQUEST_TABLE handling
    compat_ioctl: ppp: move simple commands into ppp_generic.c
    compat_ioctl: handle PPPIOCGIDLE for 64-bit time_t
    compat_ioctl: move PPPIOCSCOMPRESS to ppp_generic
    compat_ioctl: unify copy-in of ppp filters
    tty: handle compat PPP ioctls
    compat_ioctl: move SIOCOUTQ out of compat_ioctl.c
    compat_ioctl: handle SIOCOUTQNSD
    af_unix: add compat_ioctl support
    compat_ioctl: reimplement SG_IO handling
    compat_ioctl: move WDIOC handling into wdt drivers
    fs: compat_ioctl: move FITRIM emulation into file systems
    gfs2: add compat_ioctl support
    compat_ioctl: remove unused convert_in_user macro
    compat_ioctl: remove last RAID handling code
    compat_ioctl: remove /dev/raw ioctl translation
    compat_ioctl: remove PCI ioctl translation
    compat_ioctl: remove joystick ioctl translation
    ...

    Linus Torvalds
     

21 Nov, 2019

1 commit

  • 2be8ca97d   vsock/vmci: make vmci_vsock_cb_host_called static ... Browse Code »

    When using make C=2 drivers/misc/vmw_vmci/vmci_driver.o
    to compile, below warning can be seen:
    drivers/misc/vmw_vmci/vmci_driver.c:33:6: warning:
    symbol 'vmci_vsock_cb_host_called' was not declared. Should it be static?

    This patch make symbol vmci_vsock_cb_host_called static.

    Fixes: b1bba80a4376 ("vsock/vmci: register vmci_transport only when VMCI guest/host are active")
    Reported-by: Hulk Robot
    Signed-off-by: Mao Wenan
    Reported-by: kbuild test robot
    Signed-off-by: Stefano Garzarella
    Signed-off-by: David S. Miller

    Mao Wenan
     

15 Nov, 2019

1 commit

  • b1bba80a4   vsock/vmci: register vmci_transport only when VMCI guest/host are active ... Browse Code »

    To allow other transports to be loaded with vmci_transport,
    we register the vmci_transport as G2H or H2G only when a VMCI guest
    or host is active.

    To do that, this patch adds a callback registered in the vmci driver
    that will be called when the host or guest becomes active.
    This callback will register the vmci_transport in the VSOCK core.

    Cc: Jorgen Hansen
    Signed-off-by: Stefano Garzarella
    Signed-off-by: David S. Miller

    Stefano Garzarella
     

23 Oct, 2019

1 commit

  • 1832f2d8f   compat_ioctl: move more drivers to compat_ptr_ioctl ... Browse Code »

    The .ioctl and .compat_ioctl file operations have the same prototype so
    they can both point to the same function, which works great almost all
    the time when all the commands are compatible.

    One exception is the s390 architecture, where a compat pointer is only
    31 bit wide, and converting it into a 64-bit pointer requires calling
    compat_ptr(). Most drivers here will never run in s390, but since we now
    have a generic helper for it, it's easy enough to use it consistently.

    I double-checked all these drivers to ensure that all ioctl arguments
    are used as pointers or are ignored, but are not interpreted as integer
    values.

    Acked-by: Jason Gunthorpe
    Acked-by: Daniel Vetter
    Acked-by: Mauro Carvalho Chehab
    Acked-by: Greg Kroah-Hartman
    Acked-by: David Sterba
    Acked-by: Darren Hart (VMware)
    Acked-by: Jonathan Cameron
    Acked-by: Bjorn Andersson
    Acked-by: Dan Williams
    Signed-off-by: Arnd Bergmann

    Arnd Bergmann
     

29 Aug, 2019

1 commit

  • ba03a9bbd   VMCI: Release resource if the work is already queued ... Browse Code »

    Francois reported that VMware balloon gets stuck after a balloon reset,
    when the VMCI doorbell is removed. A similar error can occur when the
    balloon driver is removed with the following splat:

    [ 1088.622000] INFO: task modprobe:3565 blocked for more than 120 seconds.
    [ 1088.622035] Tainted: G W 5.2.0 #4
    [ 1088.622087] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    [ 1088.622205] modprobe D 0 3565 1450 0x00000000
    [ 1088.622210] Call Trace:
    [ 1088.622246] __schedule+0x2a8/0x690
    [ 1088.622248] schedule+0x2d/0x90
    [ 1088.622250] schedule_timeout+0x1d3/0x2f0
    [ 1088.622252] wait_for_completion+0xba/0x140
    [ 1088.622320] ? wake_up_q+0x80/0x80
    [ 1088.622370] vmci_resource_remove+0xb9/0xc0 [vmw_vmci]
    [ 1088.622373] vmci_doorbell_destroy+0x9e/0xd0 [vmw_vmci]
    [ 1088.622379] vmballoon_vmci_cleanup+0x6e/0xf0 [vmw_balloon]
    [ 1088.622381] vmballoon_exit+0x18/0xcc8 [vmw_balloon]
    [ 1088.622394] __x64_sys_delete_module+0x146/0x280
    [ 1088.622408] do_syscall_64+0x5a/0x130
    [ 1088.622410] entry_SYSCALL_64_after_hwframe+0x44/0xa9
    [ 1088.622415] RIP: 0033:0x7f54f62791b7
    [ 1088.622421] Code: Bad RIP value.
    [ 1088.622421] RSP: 002b:00007fff2a949008 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
    [ 1088.622426] RAX: ffffffffffffffda RBX: 000055dff8b55d00 RCX: 00007f54f62791b7
    [ 1088.622426] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055dff8b55d68
    [ 1088.622427] RBP: 000055dff8b55d00 R08: 00007fff2a947fb1 R09: 0000000000000000
    [ 1088.622427] R10: 00007f54f62f5cc0 R11: 0000000000000206 R12: 000055dff8b55d68
    [ 1088.622428] R13: 0000000000000001 R14: 000055dff8b55d68 R15: 00007fff2a94a3f0

    The cause for the bug is that when the "delayed" doorbell is invoked, it
    takes a reference on the doorbell entry and schedules work that is
    supposed to run the appropriate code and drop the doorbell entry
    reference. The code ignores the fact that if the work is already queued,
    it will not be scheduled to run one more time. As a result one of the
    references would not be dropped. When the code waits for the reference
    to get to zero, during balloon reset or module removal, it gets stuck.

    Fix it. Drop the reference if schedule_work() indicates that the work is
    already queued.

    Note that this bug got more apparent (or apparent at all) due to
    commit ce664331b248 ("vmw_balloon: VMCI_DOORBELL_SET does not check status").

    Fixes: 83e2ec765be03 ("VMCI: doorbell implementation.")
    Reported-by: Francois Rigault
    Cc: Jorgen Hansen
    Cc: Adit Ranadive
    Cc: Alexios Zavras
    Cc: Vishnu DASA
    Cc: stable@vger.kernel.org
    Signed-off-by: Nadav Amit
    Reviewed-by: Vishnu Dasa
    Link: https://lore.kernel.org/r/20190820202638.49003-1-namit@vmware.com
    Signed-off-by: Greg Kroah-Hartman

    Nadav Amit
     

21 Jun, 2019

1 commit

  • 1c2eb5b28   VMCI: Fix integer overflow in VMCI handle arrays ... Browse Code »

    The VMCI handle array has an integer overflow in
    vmci_handle_arr_append_entry when it tries to expand the array. This can be
    triggered from a guest, since the doorbell link hypercall doesn't impose a
    limit on the number of doorbell handles that a VM can create in the
    hypervisor, and these handles are stored in a handle array.

    In this change, we introduce a mandatory max capacity for handle
    arrays/lists to avoid excessive memory usage.

    Signed-off-by: Vishnu Dasa
    Reviewed-by: Adit Ranadive
    Reviewed-by: Jorgen Hansen
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Vishnu DASA
     

05 Jun, 2019

1 commit

  • 685a6bf84   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321 ... Browse Code »

    Based on 1 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license as published by
    the free software foundation version 2 and no later version this
    program is distributed in the hope that it will be useful but
    without any warranty without even the implied warranty of
    merchantability or fitness for a particular purpose see the gnu
    general public license for more details

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-only

    has been chosen to replace the boilerplate/reference in 33 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Kate Stewart
    Reviewed-by: Alexios Zavras
    Reviewed-by: Allison Randal
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190530000435.345978407@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

21 May, 2019

1 commit

15 May, 2019

1 commit

  • 73b0140bf   mm/gup: change GUP fast to use flags rather than a write 'bool' ... Browse Code »

    To facilitate additional options to get_user_pages_fast() change the
    singular write parameter to be gup_flags.

    This patch does not change any functionality. New functionality will
    follow in subsequent patches.

    Some of the get_user_pages_fast() call sites were unchanged because they
    already passed FOLL_WRITE or 0 for the write parameter.

    NOTE: It was suggested to change the ordering of the get_user_pages_fast()
    arguments to ensure that callers were converted. This breaks the current
    GUP call site convention of having the returned pages be the final
    parameter. So the suggestion was rejected.

    Link: http://lkml.kernel.org/r/20190328084422.29911-4-ira.weiny@intel.com
    Link: http://lkml.kernel.org/r/20190317183438.2057-4-ira.weiny@intel.com
    Signed-off-by: Ira Weiny
    Reviewed-by: Mike Marshall
    Cc: Aneesh Kumar K.V
    Cc: Benjamin Herrenschmidt
    Cc: Borislav Petkov
    Cc: Dan Williams
    Cc: "David S. Miller"
    Cc: Heiko Carstens
    Cc: Ingo Molnar
    Cc: James Hogan
    Cc: Jason Gunthorpe
    Cc: John Hubbard
    Cc: "Kirill A. Shutemov"
    Cc: Martin Schwidefsky
    Cc: Michal Hocko
    Cc: Paul Mackerras
    Cc: Peter Zijlstra
    Cc: Ralf Baechle
    Cc: Rich Felker
    Cc: Thomas Gleixner
    Cc: Yoshinori Sato
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Ira Weiny
     

26 Feb, 2019

1 commit

  • f2db7361c   VMCI: Support upto 64-bit PPNs ... Browse Code »

    Add support in the VMCI driver to handle upto 64-bit PPNs when the VMCI
    device exposes the capability for 64-bit PPNs.

    Reviewed-by: Adit Ranadive
    Reviewed-by: Jorgen Hansen
    Signed-off-by: Vishnu Dasa
    Signed-off-by: Greg Kroah-Hartman

    Vishnu DASA
     

04 Jan, 2019

1 commit

  • 96d4f267e   Remove 'type' argument from access_ok() function ... Browse Code »

    Nobody has actually used the type (VERIFY_READ vs VERIFY_WRITE) argument
    of the user address range verification function since we got rid of the
    old racy i386-only code to walk page tables by hand.

    It existed because the original 80386 would not honor the write protect
    bit when in kernel mode, so you had to do COW by hand before doing any
    user access. But we haven't supported that in a long time, and these
    days the 'type' argument is a purely historical artifact.

    A discussion about extending 'user_access_begin()' to do the range
    checking resulted this patch, because there is no way we're going to
    move the old VERIFY_xyz interface to that model. And it's best done at
    the end of the merge window when I've done most of my merges, so let's
    just get this done once and for all.

    This patch was mostly done with a sed-script, with manual fix-ups for
    the cases that weren't of the trivial 'access_ok(VERIFY_xyz' form.

    There were a couple of notable cases:

    - csky still had the old "verify_area()" name as an alias.

    - the iter_iov code had magical hardcoded knowledge of the actual
    values of VERIFY_{READ,WRITE} (not that they mattered, since nothing
    really used it)

    - microblaze used the type argument for a debug printout

    but other than those oddities this should be a total no-op patch.

    I tried to fix up all architectures, did fairly extensive grepping for
    access_ok() uses, and the changes are trivial, but I may have missed
    something. Any missed conversion should be trivially fixable, though.

    Signed-off-by: Linus Torvalds

    Linus Torvalds
     

19 Dec, 2018

1 commit

02 Nov, 2018

1 commit

  • 9931a07d5   Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs ... Browse Code »

    Pull AFS updates from Al Viro:
    "AFS series, with some iov_iter bits included"

    * 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (26 commits)
    missing bits of "iov_iter: Separate type from direction and use accessor functions"
    afs: Probe multiple fileservers simultaneously
    afs: Fix callback handling
    afs: Eliminate the address pointer from the address list cursor
    afs: Allow dumping of server cursor on operation failure
    afs: Implement YFS support in the fs client
    afs: Expand data structure fields to support YFS
    afs: Get the target vnode in afs_rmdir() and get a callback on it
    afs: Calc callback expiry in op reply delivery
    afs: Fix FS.FetchStatus delivery from updating wrong vnode
    afs: Implement the YFS cache manager service
    afs: Remove callback details from afs_callback_break struct
    afs: Commit the status on a new file/dir/symlink
    afs: Increase to 64-bit volume ID and 96-bit vnode ID for YFS
    afs: Don't invoke the server to read data beyond EOF
    afs: Add a couple of tracepoints to log I/O errors
    afs: Handle EIO from delivery function
    afs: Fix TTL on VL server and address lists
    afs: Implement VL server rotation
    afs: Improve FS server rotation error handling
    ...

    Linus Torvalds
     

24 Oct, 2018

1 commit

  • aa563d7bc   iov_iter: Separate type from direction and use accessor functions ... Browse Code »

    In the iov_iter struct, separate the iterator type from the iterator
    direction and use accessor functions to access them in most places.

    Convert a bunch of places to use switch-statements to access them rather
    then chains of bitwise-AND statements. This makes it easier to add further
    iterator types. Also, this can be more efficient as to implement a switch
    of small contiguous integers, the compiler can use ~50% fewer compare
    instructions than it has to use bitwise-and instructions.

    Further, cease passing the iterator type into the iterator setup function.
    The iterator function can set that itself. Only the direction is required.

    Signed-off-by: David Howells

    David Howells
     

03 Oct, 2018

2 commits

  • 8f523d6db   VMCI: remove set but not used variable 'cid' ... Browse Code »

    Fixes gcc '-Wunused-but-set-variable' warning:

    drivers/misc/vmw_vmci/vmci_host.c: In function 'vmci_host_do_alloc_queuepair':
    drivers/misc/vmw_vmci/vmci_host.c:450:6: warning:
    variable 'cid' set but not used [-Wunused-but-set-variable]
    u32 cid;
    ^

    Signed-off-by: YueHaibing
    Signed-off-by: Greg Kroah-Hartman

    YueHaibing
     
  • 11924ba5e   VMCI: Resource wildcard match fixed ... Browse Code »

    When adding a VMCI resource, the check for an existing entry
    would ignore that the new entry could be a wildcard. This could
    result in multiple resource entries that would match a given
    handle. One disastrous outcome of this is that the
    refcounting used to ensure that delayed callbacks for VMCI
    datagrams have run before the datagram is destroyed can be
    wrong, since the refcount could be increased on the duplicate
    entry. This in turn leads to a use after free bug. This issue
    was discovered by Hangbin Liu using KASAN and syzkaller.

    Fixes: bc63dedb7d46 ("VMCI: resource object implementation")
    Reported-by: Hangbin Liu
    Reviewed-by: Adit Ranadive
    Reviewed-by: Vishnu Dasa
    Signed-off-by: Jorgen Hansen
    Signed-off-by: Greg Kroah-Hartman

    Jorgen Hansen
     

26 Sep, 2018

1 commit

07 Jul, 2018

1 commit

03 Jul, 2018

1 commit

13 Jun, 2018

1 commit

  • 6da2ec560   treewide: kmalloc() -> kmalloc_array() ... Browse Code »

    The kmalloc() function has a 2-factor argument form, kmalloc_array(). This
    patch replaces cases of:

    kmalloc(a * b, gfp)

    with:
    kmalloc_array(a * b, gfp)

    as well as handling cases of:

    kmalloc(a * b * c, gfp)

    with:

    kmalloc(array3_size(a, b, c), gfp)

    as it's slightly less ugly than:

    kmalloc_array(array_size(a, b), c, gfp)

    This does, however, attempt to ignore constant size factors like:

    kmalloc(4 * 1024, gfp)

    though any constants defined via macros get caught up in the conversion.

    Any factors with a sizeof() of "unsigned char", "char", and "u8" were
    dropped, since they're redundant.

    The tools/ directory was manually excluded, since it has its own
    implementation of kmalloc().

    The Coccinelle script used for this was:

    // Fix redundant parens around sizeof().
    @@
    type TYPE;
    expression THING, E;
    @@

    (
    kmalloc(
    - (sizeof(TYPE)) * E
    + sizeof(TYPE) * E
    , ...)
    |
    kmalloc(
    - (sizeof(THING)) * E
    + sizeof(THING) * E
    , ...)
    )

    // Drop single-byte sizes and redundant parens.
    @@
    expression COUNT;
    typedef u8;
    typedef __u8;
    @@

    (
    kmalloc(
    - sizeof(u8) * (COUNT)
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(__u8) * (COUNT)
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(char) * (COUNT)
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(unsigned char) * (COUNT)
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(u8) * COUNT
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(__u8) * COUNT
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(char) * COUNT
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(unsigned char) * COUNT
    + COUNT
    , ...)
    )

    // 2-factor product with sizeof(type/expression) and identifier or constant.
    @@
    type TYPE;
    expression THING;
    identifier COUNT_ID;
    constant COUNT_CONST;
    @@

    (
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * (COUNT_ID)
    + COUNT_ID, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * COUNT_ID
    + COUNT_ID, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * (COUNT_CONST)
    + COUNT_CONST, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * COUNT_CONST
    + COUNT_CONST, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * (COUNT_ID)
    + COUNT_ID, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * COUNT_ID
    + COUNT_ID, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * (COUNT_CONST)
    + COUNT_CONST, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * COUNT_CONST
    + COUNT_CONST, sizeof(THING)
    , ...)
    )

    // 2-factor product, only identifiers.
    @@
    identifier SIZE, COUNT;
    @@

    - kmalloc
    + kmalloc_array
    (
    - SIZE * COUNT
    + COUNT, SIZE
    , ...)

    // 3-factor product with 1 sizeof(type) or sizeof(expression), with
    // redundant parens removed.
    @@
    expression THING;
    identifier STRIDE, COUNT;
    type TYPE;
    @@

    (
    kmalloc(
    - sizeof(TYPE) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kmalloc(
    - sizeof(THING) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kmalloc(
    - sizeof(THING) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kmalloc(
    - sizeof(THING) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kmalloc(
    - sizeof(THING) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    )

    // 3-factor product with 2 sizeof(variable), with redundant parens removed.
    @@
    expression THING1, THING2;
    identifier COUNT;
    type TYPE1, TYPE2;
    @@

    (
    kmalloc(
    - sizeof(TYPE1) * sizeof(TYPE2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    kmalloc(
    - sizeof(THING1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    kmalloc(
    - sizeof(THING1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    )

    // 3-factor product, only identifiers, with redundant parens removed.
    @@
    identifier STRIDE, SIZE, COUNT;
    @@

    (
    kmalloc(
    - (COUNT) * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - COUNT * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - COUNT * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - (COUNT) * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - COUNT * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - (COUNT) * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - (COUNT) * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - COUNT * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    )

    // Any remaining multi-factor products, first at least 3-factor products,
    // when they're not all constants...
    @@
    expression E1, E2, E3;
    constant C1, C2, C3;
    @@

    (
    kmalloc(C1 * C2 * C3, ...)
    |
    kmalloc(
    - (E1) * E2 * E3
    + array3_size(E1, E2, E3)
    , ...)
    |
    kmalloc(
    - (E1) * (E2) * E3
    + array3_size(E1, E2, E3)
    , ...)
    |
    kmalloc(
    - (E1) * (E2) * (E3)
    + array3_size(E1, E2, E3)
    , ...)
    |
    kmalloc(
    - E1 * E2 * E3
    + array3_size(E1, E2, E3)
    , ...)
    )

    // And then all remaining 2 factors products when they're not all constants,
    // keeping sizeof() as the second factor argument.
    @@
    expression THING, E1, E2;
    type TYPE;
    constant C1, C2, C3;
    @@

    (
    kmalloc(sizeof(THING) * C2, ...)
    |
    kmalloc(sizeof(TYPE) * C2, ...)
    |
    kmalloc(C1 * C2 * C3, ...)
    |
    kmalloc(C1 * C2, ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * (E2)
    + E2, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * E2
    + E2, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * (E2)
    + E2, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * E2
    + E2, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - (E1) * E2
    + E1, E2
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - (E1) * (E2)
    + E1, E2
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - E1 * E2
    + E1, E2
    , ...)
    )

    Signed-off-by: Kees Cook

    Kees Cook
     

12 Feb, 2018

1 commit

  • a9a08845e   vfs: do bulk POLL* -> EPOLL* replacement ... Browse Code »

    This is the mindless scripted replacement of kernel use of POLL*
    variables as described by Al, done by this script:

    for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do
    L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'`
    for f in $L; do sed -i "-es/^\([^\"]*\)\(\\)/\\1E\\2/" $f; done
    done

    with de-mangling cleanups yet to come.

    NOTE! On almost all architectures, the EPOLL* constants have the same
    values as the POLL* constants do. But they keyword here is "almost".
    For various bad reasons they aren't the same, and epoll() doesn't
    actually work quite correctly in some cases due to this on Sparc et al.

    The next patch from Al will sort out the final differences, and we
    should be all done.

    Scripted-by: Al Viro
    Signed-off-by: Linus Torvalds

    Linus Torvalds
     

01 Feb, 2018

1 commit

03 Dec, 2017

4 commits

29 Nov, 2017

1 commit

28 Aug, 2017

1 commit

09 May, 2017

1 commit

16 Mar, 2017

1 commit

02 Mar, 2017

3 commits

28 Feb, 2017

2 commits

  • 5b5e0928f   lib/vsprintf.c: remove %Z support ... Browse Code »

    Now that %z is standartised in C99 there is no reason to support %Z.
    Unlike %L it doesn't even make format strings smaller.

    Use BUILD_BUG_ON in a couple ATM drivers.

    In case anyone didn't notice lib/vsprintf.o is about half of SLUB which
    is in my opinion is quite an achievement. Hopefully this patch inspires
    someone else to trim vsprintf.c more.

    Link: http://lkml.kernel.org/r/20170103230126.GA30170@avx2
    Signed-off-by: Alexey Dobriyan
    Cc: Andy Shevchenko
    Cc: Rasmus Villemoes
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alexey Dobriyan
     
  • 3f8b6fb7f   scripts/spelling.txt: add "comsume(r)" pattern and fix typo instances ... Browse Code »

    Fix typos and add the following to the scripts/spelling.txt:

    comsume||consume
    comsumer||consumer
    comsuming||consuming

    I see some variable names with this pattern, but this commit is only
    touching comment blocks to avoid unexpected impact.

    Link: http://lkml.kernel.org/r/1481573103-11329-19-git-send-email-yamada.masahiro@socionext.com
    Signed-off-by: Masahiro Yamada
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Masahiro Yamada
     

03 Feb, 2017

1 commit

28 Oct, 2016

1 commit

  • eb94cd68a   VMCI: Doorbell create and destroy fixes ... Browse Code »

    This change consists of two changes:

    1) If vmci_doorbell_create is called when neither guest nor
    host personality as been initialized, vmci_get_context_id
    will return VMCI_INVALID_ID. In that case, we should fail
    the create call.
    2) In doorbell destroy, we assume that vmci_guest_code_active()
    has the same return value on create and destroy. That may not
    be the case, so we may end up with the wrong refcount.
    Instead, destroy should check explicitly whether the doorbell
    is in the index table as an indicator of whether the guest
    code was active at create time.

    Reviewed-by: Adit Ranadive
    Signed-off-by: Jorgen Hansen
    Signed-off-by: Greg Kroah-Hartman

    Jorgen Hansen