Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Commits on Mar 16, 2015
  1. @gregkh

    LZ4 : fix the data abort issue

    JeHyeon Yeon authored gregkh committed
    If the part of the compression data are corrupted, or the compression
    data is totally fake, the memory access over the limit is possible.
    
    This is the log from my system usning lz4 decompression.
       [6502]data abort, halting
       [6503]r0  0x00000000 r1  0x00000000 r2  0xdcea0ffc r3  0xdcea0ffc
       [6509]r4  0xb9ab0bfd r5  0xdcea0ffc r6  0xdcea0ff8 r7  0xdce80000
       [6515]r8  0x00000000 r9  0x00000000 r10 0x00000000 r11 0xb9a98000
       [6522]r12 0xdcea1000 usp 0x00000000 ulr 0x00000000 pc  0x820149bc
       [6528]spsr 0x400001f3
    and the memory addresses of some variables at the moment are
        ref:0xdcea0ffc, op:0xdcea0ffc, oend:0xdcea1000
    
    As you can see, COPYLENGH is 8bytes, so @ref and @op can access the momory
    over @oend.
    
    Signed-off-by: JeHyeon Yeon <tom.yeon@windriver.com>
    Reviewed-by: David Sterba <dsterba@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commits on Mar 13, 2015
  1. Merge branch 'gadget' of git://git.kernel.org/pub/scm/linux/kernel/gi…

    authored
    …t/viro/vfs
    
    Pull gadgetfs fixes from Al Viro:
     "Assorted fixes around AIO on gadgetfs: leaks, use-after-free, troubles
      caused by ->f_op flipping"
    
    * 'gadget' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
      gadgetfs: really get rid of switching ->f_op
      gadgetfs: get rid of flipping ->f_op in ep_config()
      gadget: switch ep_io_operations to ->read_iter/->write_iter
      gadgetfs: use-after-free in ->aio_read()
      gadget/function/f_fs.c: switch to ->{read,write}_iter()
      gadget/function/f_fs.c: use put iov_iter into io_data
      gadget/function/f_fs.c: close leaks
      move iov_iter.c from mm/ to lib/
      new helper: dup_iter()
Commits on Mar 10, 2015
  1. Merge tag 'trace-fixes-v4.0-rc2-2' of git://git.kernel.org/pub/scm/li…

    authored
    …nux/kernel/git/rostedt/linux-trace
    
    Pull seq-buf/ftrace fixes from Steven Rostedt:
     "This includes fixes for seq_buf_bprintf() truncation issue.  It also
      contains fixes to ftrace when /proc/sys/kernel/ftrace_enabled and
      function tracing are started.  Doing the following causes some issues:
    
        # echo 0 > /proc/sys/kernel/ftrace_enabled
        # echo function_graph > /sys/kernel/debug/tracing/current_tracer
        # echo 1 > /proc/sys/kernel/ftrace_enabled
        # echo nop > /sys/kernel/debug/tracing/current_tracer
        # echo function_graph > /sys/kernel/debug/tracing/current_tracer
    
      As well as with function tracing too.  Pratyush Anand first reported
      this issue to me and supplied a patch.  When I tested this on my x86
      test box, it caused thousands of backtraces and warnings to appear in
      dmesg, which also caused a denial of service (a warning for every
      function that was listed).  I applied Pratyush's patch but it did not
      fix the issue for me.  I looked into it and found a slight problem
      with trampoline accounting.  I fixed it and sent Pratyush a patch, but
      he said that it did not fix the issue for him.
    
      I later learned tha Pratyush was using an ARM64 server, and when I
      tested on my ARM board, I was able to reproduce the same issue as
      Pratyush.  After applying his patch, it fixed the problem.  The above
      test uncovered two different bugs, one in x86 and one in ARM and
      ARM64.  As this looked like it would affect PowerPC, I tested it on my
      PPC64 box.  It too broke, but neither the patch that fixed ARM or x86
      fixed this box (the changes were all in generic code!).  The above
      test, uncovered two more bugs that affected PowerPC.  Again, the
      changes were only done to generic code.  It's the way the arch code
      expected things to be done that was different between the archs.  Some
      where more sensitive than others.
    
      The rest of this series fixes the PPC bugs as well"
    
    * tag 'trace-fixes-v4.0-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
      ftrace: Fix ftrace enable ordering of sysctl ftrace_enabled
      ftrace: Fix en(dis)able graph caller when en(dis)abling record via sysctl
      ftrace: Clear REGS_EN and TRAMP_EN flags on disabling record via sysctl
      seq_buf: Fix seq_buf_bprintf() truncation
      seq_buf: Fix seq_buf_vprintf() truncation
Commits on Mar 5, 2015
  1. @rostedt

    seq_buf: Fix seq_buf_bprintf() truncation

    rostedt authored
    In seq_buf_bprintf(), bstr_printf() is used to copy the format into the
    buffer remaining in the seq_buf structure. The return of bstr_printf()
    is the amount of characters written to the buffer excluding the '\0',
    unless the line was truncated!
    
    If the line copied does not fit, it is truncated, and a '\0' is added
    to the end of the buffer. But in this case, '\0' is included in the length
    of the line written. To know if the buffer had overflowed, the return
    length will be the same or greater than the length of the buffer passed in.
    
    The check in seq_buf_bprintf() only checked if the length returned from
    bstr_printf() would fit in the buffer, as the seq_buf_bprintf() is only
    to be an all or nothing command. It either writes all the string into
    the seq_buf, or none of it. If the string is truncated, the pointers
    inside the seq_buf must be reset to what they were when the function was
    called. This is not the case. On overflow, it copies only part of the string.
    
    The fix is to change the overflow check to see if the length returned from
    bstr_printf() is less than the length remaining in the seq_buf buffer, and not
    if it is less than or equal to as it currently does. Then seq_buf_bprintf()
    will know if the write from bstr_printf() was truncated or not.
    
    Link: http://lkml.kernel.org/r/1425500481.2712.27.camel@perches.com
    
    Cc: stable@vger.kernel.org
    Reported-by: Joe Perches <joe@perches.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Commits on Mar 4, 2015
  1. @rostedt

    seq_buf: Fix seq_buf_vprintf() truncation

    rostedt authored
    In seq_buf_vprintf(), vsnprintf() is used to copy the format into the
    buffer remaining in the seq_buf structure. The return of vsnprintf()
    is the amount of characters written to the buffer excluding the '\0',
    unless the line was truncated!
    
    If the line copied does not fit, it is truncated, and a '\0' is added
    to the end of the buffer. But in this case, '\0' is included in the length
    of the line written. To know if the buffer had overflowed, the return
    length will be the same as the length of the buffer passed in.
    
    The check in seq_buf_vprintf() only checked if the length returned from
    vsnprintf() would fit in the buffer, as the seq_buf_vprintf() is only
    to be an all or nothing command. It either writes all the string into
    the seq_buf, or none of it. If the string is truncated, the pointers
    inside the seq_buf must be reset to what they were when the function was
    called. This is not the case. On overflow, it copies only part of the string.
    
    The fix is to change the overflow check to see if the length returned from
    vsnprintf() is less than the length remaining in the seq_buf buffer, and not
    if it is less than or equal to as it currently does. Then seq_buf_vprintf()
    will know if the write from vsnpritnf() was truncated or not.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Commits on Mar 3, 2015
  1. Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

    authored
    Pull networking fixes from David Miller:
    
     1) If an IPVS tunnel is created with a mixed-family destination
        address, it cannot be removed.  Fix from Alexey Andriyanov.
    
     2) Fix module refcount underflow in netfilter's nft_compat, from Pablo
        Neira Ayuso.
    
     3) Generic statistics infrastructure can reference variables sitting on
        a released function stack, therefore use dynamic allocation always.
        Fix from Ignacy Gawędzki.
    
     4) skb_copy_bits() return value test is inverted in ip_check_defrag().
    
     5) Fix network namespace exit in openvswitch, we have to release all of
        the per-net vports.  From Pravin B Shelar.
    
     6) Fix signedness bug in CAIF's cfpkt_iterate(), from Dan Carpenter.
    
     7) Fix rhashtable grow/shrink behavior, only expand during inserts and
        shrink during deletes.  From Daniel Borkmann.
    
     8) Netdevice names with semicolons should never be allowed, because
        they serve as a separator.  From Matthew Thode.
    
     9) Use {,__}set_current_state() where appropriate, from Fabian
        Frederick.
    
    10) Revert byte queue limits support in r8169 driver, it's causing
        regressions we can't figure out.
    
    11) tcp_should_expand_sndbuf() erroneously uses tp->packets_out to
        measure packets in flight, properly use tcp_packets_in_flight()
        instead.  From Neal Cardwell.
    
    12) Fix accidental removal of support for bluetooth in CSR based Intel
        wireless cards.  From Marcel Holtmann.
    
    13) We accidently added a behavioral change between native and compat
        tasks, wrt testing the MSG_CMSG_COMPAT bit.  Just ignore it if the
        user happened to set it in a native binary as that was always the
        behavior we had.  From Catalin Marinas.
    
    14) Check genlmsg_unicast() return valud in hwsim netlink tx frame
        handling, from Bob Copeland.
    
    15) Fix stale ->radar_required setting in mac80211 that can prevent
        starting new scans, from Eliad Peller.
    
    16) Fix memory leak in nl80211 monitor, from Johannes Berg.
    
    17) Fix race in TX index handling in xen-netback, from David Vrabel.
    
    18) Don't enable interrupts in amx-xgbe driver until all software et al.
        state is ready for the interrupt handler to run.  From Thomas
        Lendacky.
    
    19) Add missing netlink_ns_capable() checks to rtnl_newlink(), from Eric
        W Biederman.
    
    20) The amount of header space needed in macvtap was not calculated
        properly, fix it otherwise we splat past the beginning of the
        packet.  From Eric Dumazet.
    
    21) Fix bcmgenet TCP TX perf regression, from Jaedon Shin.
    
    22) Don't raw initialize or mod timers, use setup_timer() and
        mod_timer() instead.  From Vaishali Thakkar.
    
    23) Fix software maintained statistics in bcmgenet and systemport
        drivers, from Florian Fainelli.
    
    24) DMA descriptor updates in sh_eth need proper memory barriers, from
        Ben Hutchings.
    
    25) Don't do UDP Fragmentation Offload on RAW sockets, from Michal
        Kubecek.
    
    26) Openvswitch's non-masked set actions aren't constructed properly
        into netlink messages, fix from Joe Stringer.
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (116 commits)
      openvswitch: Fix serialization of non-masked set actions.
      gianfar: Reduce logging noise seen due to phy polling if link is down
      ibmveth: Add function to enable live MAC address changes
      net: bridge: add compile-time assert for cb struct size
      udp: only allow UFO for packets from SOCK_DGRAM sockets
      sh_eth: Really fix padding of short frames on TX
      Revert "sh_eth: Enable Rx descriptor word 0 shift for r8a7790"
      sh_eth: Fix RX recovery on R-Car in case of RX ring underrun
      sh_eth: Ensure proper ordering of descriptor active bit write/read
      net/mlx4_en: Disbale GRO for incoming loopback/selftest packets
      net/mlx4_core: Fix wrong mask and error flow for the update-qp command
      net: systemport: fix software maintained statistics
      net: bcmgenet: fix software maintained statistics
      rxrpc: don't multiply with HZ twice
      rxrpc: terminate retrans loop when sending of skb fails
      net/hsr: Fix NULL pointer dereference and refcnt bugs when deleting a HSR interface.
      net: pasemi: Use setup_timer and mod_timer
      net: stmmac: Use setup_timer and mod_timer
      net: 8390: axnet_cs: Use setup_timer and mod_timer
      net: 8390: pcnet_cs: Use setup_timer and mod_timer
      ...
Commits on Feb 27, 2015
  1. @davem330

    rhashtable: use cond_resched()

    Eric Dumazet authored davem330 committed
    If a hash table has 128 slots and 16384 elems, expand to 256 slots
    takes more than one second. For larger sets, a soft lockup is detected.
    
    Holding cpu for that long, even in a work queue is a show stopper
    for non preemptable kernels.
    
    cond_resched() at strategic points to allow process scheduler
    to reschedule us.
    
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Acked-by: Daniel Borkmann <daniel@iogearbox.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  2. @borkmann @davem330

    rhashtable: remove indirection for grow/shrink decision functions

    borkmann authored davem330 committed
    Currently, all real users of rhashtable default their grow and shrink
    decision functions to rht_grow_above_75() and rht_shrink_below_30(),
    so that there's currently no need to have this explicitly selectable.
    
    It can/should be generic and private inside rhashtable until a real
    use case pops up. Since we can make this private, we'll save us this
    additional indirection layer and can improve insertion/deletion time
    as well.
    
    Reference: http://patchwork.ozlabs.org/patch/443040/
    Suggested-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Acked-by: Thomas Graf <tgraf@suug.ch>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  3. @borkmann @davem330

    rhashtable: unconditionally grow when max_shift is not specified

    borkmann authored davem330 committed
    While commit c0c09bf ("rhashtable: avoid unnecessary wakeup for
    worker queue") rightfully moved part of the decision making of
    whether we should expand or shrink from the expand/shrink functions
    themselves into insert/delete functions in order to avoid unnecessary
    worker wake-ups, it however introduced a regression by doing so.
    
    Before that change, if no max_shift was specified (= 0) on rhashtable
    initialization, rhashtable_expand() would just grow unconditionally
    and lets the available memory be the limiting factor. After that
    change, if no max_shift was specified, there would be _no_ expansion
    step at all.
    
    Given that netlink and tipc have a max_shift specified, it was not
    visible there, but Josh Hunt reported that if nft that starts out
    with a default element hint of 3 if not otherwise provided, would
    slow i.e. inserts down trememdously as it cannot grow larger to
    relax table occupancy.
    
    Given that the test case verifies shrinks/expands manually, we also
    must remove pointer to the helper functions to explicitly avoid
    parallel resizing on insertions/deletions. test_bucket_stats() and
    test_rht_lookup() could also be wrapped around rhashtable mutex to
    explicitly synchronize a walk from resizing, but I think that defeats
    the actual test case which intended to have explicit test steps,
    i.e. 1) inserts, 2) expands, 3) shrinks, 4) deletions, with object
    verification after each stage.
    
    Reported-by: Josh Hunt <johunt@akamai.com>
    Fixes: c0c09bf ("rhashtable: avoid unnecessary wakeup for worker queue")
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Cc: Ying Xue <ying.xue@windriver.com>
    Cc: Josh Hunt <johunt@akamai.com>
    Acked-by: Thomas Graf <tgraf@suug.ch>
    Signed-off-by: David S. Miller <davem@davemloft.net>
Commits on Feb 23, 2015
  1. @sashalevin @davem330

    rhashtable: initialize all rhashtable walker members

    sashalevin authored davem330 committed
    Commit f2dba9c ("rhashtable: Introduce rhashtable_walk_*") forgot to
    initialize the members of struct rhashtable_walker after allocating it, which
    caused an undefined value for 'resize' which is used later on.
    
    Fixes: f2dba9c ("rhashtable: Introduce rhashtable_walk_*")
    Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
Commits on Feb 20, 2015
  1. @borkmann @davem330

    rhashtable: allow to unload test module

    borkmann authored davem330 committed
    There's no good reason why to disallow unloading of the rhashtable
    test case module.
    
    Commit 9d6dbe1 moved the code from a boot test into a stand-alone
    module, but only converted the subsys_initcall() handler into a
    module_init() function without a related exit handler, and thus
    preventing the test module from unloading.
    
    Fixes: 9d6dbe1 ("rhashtable: Make selftest modular")
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Acked-by: Thomas Graf <tgraf@suug.ch>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  2. @borkmann @davem330

    rhashtable: better high order allocation attempts

    borkmann authored davem330 committed
    When trying to allocate future tables via bucket_table_alloc(), it seems
    overkill on large table shifts that we probe for kzalloc() unconditionally
    first, as it's likely to fail.
    
    Only probe with kzalloc() for more reasonable table sizes and use vzalloc()
    either as a fallback on failure or directly in case of large table sizes.
    
    Fixes: 7e1e776 ("lib: Resizable, Scalable, Concurrent Hash Table")
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Acked-by: Thomas Graf <tgraf@suug.ch>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  3. @borkmann @davem330

    rhashtable: don't test for shrink on insert, expansion on delete

    borkmann authored davem330 committed
    Restore pre 54c5b7d behaviour and only probe for expansions on inserts
    and shrinks on deletes. Currently, it will happen that on initial inserts
    into a sparse hash table, we may i.e. shrink it first simply because it's
    not fully populated yet, only to later realize that we need to grow again.
    
    This however is counter intuitive, e.g. an initial default size of 64
    elements is already small enough, and in case an elements size hint is given
    to the hash table by a user, we should avoid unnecessary expansion steps,
    so a shrink is clearly unintended here.
    
    Fixes: 54c5b7d ("rhashtable: introduce rhashtable_wakeup_worker helper function")
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Cc: Ying Xue <ying.xue@windriver.com>
    Acked-by: Thomas Graf <tgraf@suug.ch>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  4. @borkmann @davem330

    rhashtable: don't allocate ht structure on stack in test_rht_init

    borkmann authored davem330 committed
    With object runtime debugging enabled, the rhashtable test suite
    will rightfully throw a warning "ODEBUG: object is on stack, but
    not annotated" from rhashtable_init().
    
    This is because run_work is (correctly) being initialized via
    INIT_WORK(), and not annotated by INIT_WORK_ONSTACK(). Meaning,
    rhashtable_init() is okay as is, we just need to move ht e.g.,
    into global scope.
    
    It never triggered anything, since test_rhashtable is rather a
    controlled environment and effectively runs to completion, so
    that stack memory is not vanishing underneath us, we shouldn't
    confuse any testers with it though.
    
    Fixes: 7e1e776 ("lib: Resizable, Scalable, Concurrent Hash Table")
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Acked-by: Thomas Graf <tgraf@suug.ch>
    Signed-off-by: David S. Miller <davem@davemloft.net>
Commits on Feb 19, 2015
  1. Merge branch 'kconfig' of git://git.kernel.org/pub/scm/linux/kernel/g…

    authored
    …it/mmarek/kbuild
    
    Pull kconfig updates from Michal Marek:
     "Yann E Morin was supposed to take over kconfig maintainership, but
      this hasn't happened.  So I'm sending a few kconfig patches that I
      collected:
    
       - Fix for missing va_end in kconfig
       - merge_config.sh displays used if given too few arguments
       - s/boolean/bool/ in Kconfig files for consistency, with the plan to
         only support bool in the future"
    
    * 'kconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
      kconfig: use va_end to match corresponding va_start
      merge_config.sh: Display usage if given too few arguments
      kconfig: use bool instead of boolean for type definition attributes
Commits on Feb 18, 2015
  1. Merge tag 'virtio-next-for-linus' of git://git.kernel.org/pub/scm/lin…

    authored
    …ux/kernel/git/rusty/linux
    
    Pull virtio updates from Rusty Russell:
     "OK, this has the big virtio 1.0 implementation, as specified by OASIS.
    
      On top of tht is the major rework of lguest, to use PCI and virtio
      1.0, to double-check the implementation.
    
      Then comes the inevitable fixes and cleanups from that work"
    
    * tag 'virtio-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux: (80 commits)
      virtio: don't set VIRTIO_CONFIG_S_DRIVER_OK twice.
      virtio_net: unconditionally define struct virtio_net_hdr_v1.
      tools/lguest: don't use legacy definitions for net device in example launcher.
      virtio: Don't expose legacy net features when VIRTIO_NET_NO_LEGACY defined.
      tools/lguest: use common error macros in the example launcher.
      tools/lguest: give virtqueues names for better error messages
      tools/lguest: more documentation and checking of virtio 1.0 compliance.
      lguest: don't look in console features to find emerg_wr.
      tools/lguest: don't start devices until DRIVER_OK status set.
      tools/lguest: handle indirect partway through chain.
      tools/lguest: insert driver references from the 1.0 spec (4.1 Virtio Over PCI)
      tools/lguest: insert device references from the 1.0 spec (4.1 Virtio Over PCI)
      tools/lguest: rename virtio_pci_cfg_cap field to match spec.
      tools/lguest: fix features_accepted logic in example launcher.
      tools/lguest: handle device reset correctly in example launcher.
      virtual: Documentation: simplify and generalize paravirt_ops.txt
      lguest: remove NOTIFY call and eventfd facility.
      lguest: remove NOTIFY facility from demonstration launcher.
      lguest: use the PCI console device's emerg_wr for early boot messages.
      lguest: always put console in PCI slot #1.
      ...
  2. move iov_iter.c from mm/ to lib/

    Al Viro authored
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Commits on Feb 17, 2015
  1. Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel…

    authored
    …/git/viro/vfs
    
    Pull misc VFS updates from Al Viro:
     "This cycle a lot of stuff sits on topical branches, so I'll be sending
      more or less one pull request per branch.
    
      This is the first pile; more to follow in a few.  In this one are
      several misc commits from early in the cycle (before I went for
      separate branches), plus the rework of mntput/dput ordering on umount,
      switching to use of fs_pin instead of convoluted games in
      namespace_unlock()"
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
      switch the IO-triggering parts of umount to fs_pin
      new fs_pin killing logics
      allow attaching fs_pin to a group not associated with some superblock
      get rid of the second argument of acct_kill()
      take count and rcu_head out of fs_pin
      dcache: let the dentry count go down to zero without taking d_lock
      pull bumping refcount into ->kill()
      kill pin_put()
      mode_t whack-a-mole: chelsio
      file->f_path.dentry is pinned down for as long as the file is open...
      get rid of lustre_dump_dentry()
      gut proc_register() a bit
      kill d_validate()
      ncpfs: get rid of d_validate() nonsense
      selinuxfs: don't open-code d_genocide()
  2. @jan-kiszka

    scripts/gdb: add infrastructure

    jan-kiszka authored committed
    This provides the basic infrastructure to load kernel-specific python
    helper scripts when debugging the kernel in gdb.
    
    The loading mechanism is based on gdb loading for <objfile>-gdb.py when
    opening <objfile>.  Therefore, this places a corresponding link to the
    main helper script into the output directory that contains vmlinux.
    
    The main scripts will pull in submodules containing Linux specific gdb
    commands and functions.  To avoid polluting the source directory with
    compiled python modules, we link to them from the object directory.
    
    Due to gdb.parse_and_eval and string redirection for gdb.execute, we
    depend on gdb >= 7.2.
    
    This feature is enabled via CONFIG_GDB_SCRIPTS.
    
    Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
    Acked-by: Michal Marek <mmarek@suse.cz>		[kbuild stuff]
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Jason Wessel <jason.wessel@windriver.com>
    Cc: Andi Kleen <andi@firstfloor.org>
    Cc: Ben Widawsky <ben@bwidawsk.net>
    Cc: Borislav Petkov <bp@suse.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  3. @christophjaeger

    lib/Kconfig: use bool instead of boolean

    christophjaeger authored committed
    Keyword 'boolean' for type definition attributes is considered
    deprecated and, therefore, should not be used anymore.
    
    See http://lkml.kernel.org/r/cover.1418003065.git.cj@linux.com
    See http://lkml.kernel.org/r/1419108071-11607-1-git-send-email-cj@linux.com
    
    Signed-off-by: Christoph Jaeger <cj@linux.com>
    Cc: Russell King <linux@arm.linux.org.uk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commits on Feb 14, 2015
  1. Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

    authored
    Pull crypto update from Herbert Xu:
     "Here is the crypto update for 3.20:
    
       - Added 192/256-bit key support to aesni GCM.
       - Added MIPS OCTEON MD5 support.
       - Fixed hwrng starvation and race conditions.
       - Added note that memzero_explicit is not a subsitute for memset.
       - Added user-space interface for crypto_rng.
       - Misc fixes"
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (71 commits)
      crypto: tcrypt - do not allocate iv on stack for aead speed tests
      crypto: testmgr - limit IV copy length in aead tests
      crypto: tcrypt - fix buflen reminder calculation
      crypto: testmgr - mark rfc4106(gcm(aes)) as fips_allowed
      crypto: caam - fix resource clean-up on error path for caam_jr_init
      crypto: caam - pair irq map and dispose in the same function
      crypto: ccp - terminate ccp_support array with empty element
      crypto: caam - remove unused local variable
      crypto: caam - remove dead code
      crypto: caam - don't emit ICV check failures to dmesg
      hwrng: virtio - drop extra empty line
      crypto: replace scatterwalk_sg_next with sg_next
      crypto: atmel - Free memory in error path
      crypto: doc - remove colons in comments
      crypto: seqiv - Ensure that IV size is at least 8 bytes
      crypto: cts - Weed out non-CBC algorithms
      MAINTAINERS: add linux-crypto to hw random
      crypto: cts - Remove bogus use of seqiv
      crypto: qat - don't need qat_auth_state struct
      crypto: algif_rng - fix sparse non static symbol warning
      ...
  2. @aryabinin

    kasan: enable instrumentation of global variables

    aryabinin authored committed
    This feature let us to detect accesses out of bounds of global variables.
    This will work as for globals in kernel image, so for globals in modules.
    Currently this won't work for symbols in user-specified sections (e.g.
    __init, __read_mostly, ...)
    
    The idea of this is simple.  Compiler increases each global variable by
    redzone size and add constructors invoking __asan_register_globals()
    function.  Information about global variable (address, size, size with
    redzone ...) passed to __asan_register_globals() so we could poison
    variable's redzone.
    
    This patch also forces module_alloc() to return 8*PAGE_SIZE aligned
    address making shadow memory handling (
    kasan_module_alloc()/kasan_module_free() ) more simple.  Such alignment
    guarantees that each shadow page backing modules address space correspond
    to only one module_alloc() allocation.
    
    Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Cc: Konstantin Serebryany <kcc@google.com>
    Cc: Dmitry Chernenkov <dmitryc@google.com>
    Signed-off-by: Andrey Konovalov <adech.fo@gmail.com>
    Cc: Yuri Gribov <tetra2005@gmail.com>
    Cc: Konstantin Khlebnikov <koct9i@gmail.com>
    Cc: Sasha Levin <sasha.levin@oracle.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
    Cc: Dave Hansen <dave.hansen@intel.com>
    Cc: Andi Kleen <andi@firstfloor.org>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Pekka Enberg <penberg@kernel.org>
    Cc: David Rientjes <rientjes@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  3. @aryabinin

    lib: add kasan test module

    aryabinin authored committed
    This is a test module doing various nasty things like out of bounds
    accesses, use after free.  It is useful for testing kernel debugging
    features like kernel address sanitizer.
    
    It mostly concentrates on testing of slab allocator, but we might want to
    add more different stuff here in future (like stack/global variables out
    of bounds accesses and so on).
    
    Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Cc: Konstantin Serebryany <kcc@google.com>
    Cc: Dmitry Chernenkov <dmitryc@google.com>
    Signed-off-by: Andrey Konovalov <adech.fo@gmail.com>
    Cc: Yuri Gribov <tetra2005@gmail.com>
    Cc: Konstantin Khlebnikov <koct9i@gmail.com>
    Cc: Sasha Levin <sasha.levin@oracle.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
    Cc: Dave Hansen <dave.hansen@intel.com>
    Cc: Andi Kleen <andi@firstfloor.org>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Pekka Enberg <penberg@kernel.org>
    Cc: David Rientjes <rientjes@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  4. @aryabinin

    mm: slub: add kernel address sanitizer support for slub allocator

    aryabinin authored committed
    With this patch kasan will be able to catch bugs in memory allocated by
    slub.  Initially all objects in newly allocated slab page, marked as
    redzone.  Later, when allocation of slub object happens, requested by
    caller number of bytes marked as accessible, and the rest of the object
    (including slub's metadata) marked as redzone (inaccessible).
    
    We also mark object as accessible if ksize was called for this object.
    There is some places in kernel where ksize function is called to inquire
    size of really allocated area.  Such callers could validly access whole
    allocated memory, so it should be marked as accessible.
    
    Code in slub.c and slab_common.c files could validly access to object's
    metadata, so instrumentation for this files are disabled.
    
    Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
    Signed-off-by: Dmitry Chernenkov <dmitryc@google.com>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Cc: Konstantin Serebryany <kcc@google.com>
    Signed-off-by: Andrey Konovalov <adech.fo@gmail.com>
    Cc: Yuri Gribov <tetra2005@gmail.com>
    Cc: Konstantin Khlebnikov <koct9i@gmail.com>
    Cc: Sasha Levin <sasha.levin@oracle.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
    Cc: Dave Hansen <dave.hansen@intel.com>
    Cc: Andi Kleen <andi@firstfloor.org>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Pekka Enberg <penberg@kernel.org>
    Cc: David Rientjes <rientjes@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  5. @aryabinin

    x86_64: add KASan support

    aryabinin authored committed
    This patch adds arch specific code for kernel address sanitizer.
    
    16TB of virtual addressed used for shadow memory.  It's located in range
    [ffffec0000000000 - fffffc0000000000] between vmemmap and %esp fixup
    stacks.
    
    At early stage we map whole shadow region with zero page.  Latter, after
    pages mapped to direct mapping address range we unmap zero pages from
    corresponding shadow (see kasan_map_shadow()) and allocate and map a real
    shadow memory reusing vmemmap_populate() function.
    
    Also replace __pa with __pa_nodebug before shadow initialized.  __pa with
    CONFIG_DEBUG_VIRTUAL=y make external function call (__phys_addr)
    __phys_addr is instrumented, so __asan_load could be called before shadow
    area initialized.
    
    Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Cc: Konstantin Serebryany <kcc@google.com>
    Cc: Dmitry Chernenkov <dmitryc@google.com>
    Signed-off-by: Andrey Konovalov <adech.fo@gmail.com>
    Cc: Yuri Gribov <tetra2005@gmail.com>
    Cc: Konstantin Khlebnikov <koct9i@gmail.com>
    Cc: Sasha Levin <sasha.levin@oracle.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
    Cc: Dave Hansen <dave.hansen@intel.com>
    Cc: Andi Kleen <andi@firstfloor.org>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Pekka Enberg <penberg@kernel.org>
    Cc: David Rientjes <rientjes@google.com>
    Cc: Jim Davis <jim.epost@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  6. @aryabinin

    kasan: add kernel address sanitizer infrastructure

    aryabinin authored committed
    Kernel Address sanitizer (KASan) is a dynamic memory error detector.  It
    provides fast and comprehensive solution for finding use-after-free and
    out-of-bounds bugs.
    
    KASAN uses compile-time instrumentation for checking every memory access,
    therefore GCC > v4.9.2 required.  v4.9.2 almost works, but has issues with
    putting symbol aliases into the wrong section, which breaks kasan
    instrumentation of globals.
    
    This patch only adds infrastructure for kernel address sanitizer.  It's
    not available for use yet.  The idea and some code was borrowed from [1].
    
    Basic idea:
    
    The main idea of KASAN is to use shadow memory to record whether each byte
    of memory is safe to access or not, and use compiler's instrumentation to
    check the shadow memory on each memory access.
    
    Address sanitizer uses 1/8 of the memory addressable in kernel for shadow
    memory and uses direct mapping with a scale and offset to translate a
    memory address to its corresponding shadow address.
    
    Here is function to translate address to corresponding shadow address:
    
         unsigned long kasan_mem_to_shadow(unsigned long addr)
         {
                    return (addr >> KASAN_SHADOW_SCALE_SHIFT) + KASAN_SHADOW_OFFSET;
         }
    
    where KASAN_SHADOW_SCALE_SHIFT = 3.
    
    So for every 8 bytes there is one corresponding byte of shadow memory.
    The following encoding used for each shadow byte: 0 means that all 8 bytes
    of the corresponding memory region are valid for access; k (1 <= k <= 7)
    means that the first k bytes are valid for access, and other (8 - k) bytes
    are not; Any negative value indicates that the entire 8-bytes are
    inaccessible.  Different negative values used to distinguish between
    different kinds of inaccessible memory (redzones, freed memory) (see
    mm/kasan/kasan.h).
    
    To be able to detect accesses to bad memory we need a special compiler.
    Such compiler inserts a specific function calls (__asan_load*(addr),
    __asan_store*(addr)) before each memory access of size 1, 2, 4, 8 or 16.
    
    These functions check whether memory region is valid to access or not by
    checking corresponding shadow memory.  If access is not valid an error
    printed.
    
    Historical background of the address sanitizer from Dmitry Vyukov:
    
    	"We've developed the set of tools, AddressSanitizer (Asan),
    	ThreadSanitizer and MemorySanitizer, for user space. We actively use
    	them for testing inside of Google (continuous testing, fuzzing,
    	running prod services). To date the tools have found more than 10'000
    	scary bugs in Chromium, Google internal codebase and various
    	open-source projects (Firefox, OpenSSL, gcc, clang, ffmpeg, MySQL and
    	lots of others): [2] [3] [4].
    	The tools are part of both gcc and clang compilers.
    
    	We have not yet done massive testing under the Kernel AddressSanitizer
    	(it's kind of chicken and egg problem, you need it to be upstream to
    	start applying it extensively). To date it has found about 50 bugs.
    	Bugs that we've found in upstream kernel are listed in [5].
    	We've also found ~20 bugs in out internal version of the kernel. Also
    	people from Samsung and Oracle have found some.
    
    	[...]
    
    	As others noted, the main feature of AddressSanitizer is its
    	performance due to inline compiler instrumentation and simple linear
    	shadow memory. User-space Asan has ~2x slowdown on computational
    	programs and ~2x memory consumption increase. Taking into account that
    	kernel usually consumes only small fraction of CPU and memory when
    	running real user-space programs, I would expect that kernel Asan will
    	have ~10-30% slowdown and similar memory consumption increase (when we
    	finish all tuning).
    
    	I agree that Asan can well replace kmemcheck. We have plans to start
    	working on Kernel MemorySanitizer that finds uses of unitialized
    	memory. Asan+Msan will provide feature-parity with kmemcheck. As
    	others noted, Asan will unlikely replace debug slab and pagealloc that
    	can be enabled at runtime. Asan uses compiler instrumentation, so even
    	if it is disabled, it still incurs visible overheads.
    
    	Asan technology is easily portable to other architectures. Compiler
    	instrumentation is fully portable. Runtime has some arch-dependent
    	parts like shadow mapping and atomic operation interception. They are
    	relatively easy to port."
    
    Comparison with other debugging features:
    ========================================
    
    KMEMCHECK:
    
      - KASan can do almost everything that kmemcheck can.  KASan uses
        compile-time instrumentation, which makes it significantly faster than
        kmemcheck.  The only advantage of kmemcheck over KASan is detection of
        uninitialized memory reads.
    
        Some brief performance testing showed that kasan could be
        x500-x600 times faster than kmemcheck:
    
    $ netperf -l 30
    		MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to localhost (127.0.0.1) port 0 AF_INET
    		Recv   Send    Send
    		Socket Socket  Message  Elapsed
    		Size   Size    Size     Time     Throughput
    		bytes  bytes   bytes    secs.    10^6bits/sec
    
    no debug:	87380  16384  16384    30.00    41624.72
    
    kasan inline:	87380  16384  16384    30.00    12870.54
    
    kasan outline:	87380  16384  16384    30.00    10586.39
    
    kmemcheck: 	87380  16384  16384    30.03      20.23
    
      - Also kmemcheck couldn't work on several CPUs.  It always sets
        number of CPUs to 1.  KASan doesn't have such limitation.
    
    DEBUG_PAGEALLOC:
    	- KASan is slower than DEBUG_PAGEALLOC, but KASan works on sub-page
    	  granularity level, so it able to find more bugs.
    
    SLUB_DEBUG (poisoning, redzones):
    	- SLUB_DEBUG has lower overhead than KASan.
    
    	- SLUB_DEBUG in most cases are not able to detect bad reads,
    	  KASan able to detect both reads and writes.
    
    	- In some cases (e.g. redzone overwritten) SLUB_DEBUG detect
    	  bugs only on allocation/freeing of object. KASan catch
    	  bugs right before it will happen, so we always know exact
    	  place of first bad read/write.
    
    [1] https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel
    [2] https://code.google.com/p/address-sanitizer/wiki/FoundBugs
    [3] https://code.google.com/p/thread-sanitizer/wiki/FoundBugs
    [4] https://code.google.com/p/memory-sanitizer/wiki/FoundBugs
    [5] https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel#Trophies
    
    Based on work by Andrey Konovalov.
    
    Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
    Acked-by: Michal Marek <mmarek@suse.cz>
    Signed-off-by: Andrey Konovalov <adech.fo@gmail.com>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Cc: Konstantin Serebryany <kcc@google.com>
    Cc: Dmitry Chernenkov <dmitryc@google.com>
    Cc: Yuri Gribov <tetra2005@gmail.com>
    Cc: Konstantin Khlebnikov <koct9i@gmail.com>
    Cc: Sasha Levin <sasha.levin@oracle.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
    Cc: Dave Hansen <dave.hansen@intel.com>
    Cc: Andi Kleen <andi@firstfloor.org>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Pekka Enberg <penberg@kernel.org>
    Cc: David Rientjes <rientjes@google.com>
    Cc: Stephen Rothwell <sfr@canb.auug.org.au>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  7. bitmap, cpumask, nodemask: remove dedicated formatting functions

    Tejun Heo authored committed
    Now that all bitmap formatting usages have been converted to
    '%*pb[l]', the separate formatting functions are unnecessary.  The
    following functions are removed.
    
    * bitmap_scn[list]printf()
    * cpumask_scnprintf(), cpulist_scnprintf()
    * [__]nodemask_scnprintf(), [__]nodelist_scnprintf()
    * seq_bitmap[_list](), seq_cpumask[_list](), seq_nodemask[_list]()
    * seq_buf_bitmask()
    
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Cc: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  8. bitmap: use %*pb[l] to print bitmaps including cpumasks and nodemasks

    Tejun Heo authored committed
    printk and friends can now format bitmaps using '%*pb[l]'.  cpumask
    and nodemask also provide cpumask_pr_args() and nodemask_pr_args()
    respectively which can be used to generate the two printf arguments
    necessary to format the specified cpu/nodemask.
    
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  9. lib/vsprintf: implement bitmap printing through '%*pb[l]'

    Tejun Heo authored committed
    bitmap and its derivatives such as cpumask and nodemask currently only
    provide formatting functions which put the output string into the
    provided buffer; however, how long this buffer should be isn't defined
    anywhere and given that some of these bitmaps can be too large to be
    formatted into an on-stack buffer it users sometimes are unnecessarily
    forced to come up with creative solutions and compromises for the
    buffer just to printk these bitmaps.
    
    There have been a couple different attempts at making this easier.
    
    1. Way back, PeterZ tried printk '%pb' extension with the precision
       for bit width - '%.*pb'.  This was intuitive and made sense but
       unfortunately triggered a compile warning about using precision
       for a pointer.
    
       http://lkml.kernel.org/g/1336577562.2527.58.camel@twins
    
    2. I implemented bitmap_pr_cont[_list]() and its wrappers for cpumask
       and nodemask.  This works but PeterZ pointed out that pr_cont's
       tendency to produce broken lines when multiple CPUs are printing is
       bothering considering the usages.
    
       http://lkml.kernel.org/g/1418226774-30215-3-git-send-email-tj@kernel.org
    
    So, this patch is another attempt at teaching printk and friends how
    to print bitmaps.  It's almost identical to what PeterZ tried with
    precision but it uses the field width for the number of bits instead
    of precision.  The format used is '%*pb[l]', with the optional
    trailing 'l' specifying list format instead of hex masks.
    
    This is a valid format string and doesn't trigger compiler warnings;
    however, it does make it impossible to specify output field width when
    printing bitmaps.  I think this is an acceptable trade-off given how
    much easier it makes printing bitmaps and that we don't have any
    in-kernel user which is using the field width specification.  If any
    future user wants to use field width with a bitmap, it'd have to
    format the bitmap into a string buffer and then print that buffer with
    width spec, which isn't different from how it should be done now.
    
    This patch implements bitmap[_list]_string() which are called from the
    vsprintf pointer() formatting function.  The implementation is mostly
    identical to bitmap_scn[list]printf() except that the output is
    performed in the vsprintf way.  These functions handle formatting into
    too small buffers and sprintf() family of functions report the correct
    overrun output length.
    
    bitmap_scn[list]printf() are now thin wrappers around scnprintf().
    
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: "James E.J. Bottomley" <James.Bottomley@HansenPartnership.com>
    Cc: "John W. Linville" <linville@tuxdriver.com>
    Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
    Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Cc: Chris Metcalf <cmetcalf@tilera.com>
    Cc: Chris Zankel <chris@zankel.net>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Cc: Fenghua Yu <fenghua.yu@intel.com>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: Li Zefan <lizefan@huawei.com>
    Cc: Max Filippov <jcmvbkbc@gmail.com>
    Cc: Mike Travis <travis@sgi.com>
    Cc: Pekka Enberg <penberg@kernel.org>
    Cc: Russell King <linux@arm.linux.org.uk>
    Cc: Rusty Russell <rusty@rustcorp.com.au>
    Cc: Steffen Klassert <steffen.klassert@secunet.com>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Tony Luck <tony.luck@intel.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  10. @jankara

    lib/genalloc.c: check result of devres_alloc()

    jankara authored committed
    devm_gen_pool_create() calls devres_alloc() and dereferences its result
    without checking whether devres_alloc() succeeded.  Check for error and
    bail out if it happened.
    
    Coverity-id 1016493.
    
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  11. @Villemoes

    lib/string.c: improve strrchr()

    Villemoes authored committed
    Instead of potentially passing over the string twice in case c is not
    found, just keep track of the last occurrence.  According to
    bloat-o-meter, this also cuts the generated code by a third (54 vs 36
    bytes).  Oh, and we get rid of those 7-space indented lines.
    
    Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  12. @borkmann

    lib: crc32: constify crc32 lookup table

    borkmann authored committed
    Commit 8f243af ("sections: fix const sections for crc32 table")
    removed the compile-time generated crc32 tables from the RO sections,
    because it conflicts with the definition of __cacheline_aligned which
    puts all such aligned data into .data..cacheline_aligned section
    optimized for wasting less space, and can cause alignment issues when
    used in combination with const with some gcc versions like 4.7.0 due to
    a gcc bug [1].
    
    Given that most gcc versions should have the fix by now, we can just use
    ____cacheline_aligned, which only aligns the data but doesn't move it
    into specific sections as opposed to __cacheline_aligned.  In case of
    gcc versions having the mentioned bug, the alignment attribute will have
    no effect, but the data will still be made RO.
    
    After patch tables are in RO:
    
      $ nm -v lib/crc32.o | grep -1 -E "crc32c?table"
      0000000000000000 t arch_local_irq_enable
      0000000000000000 r crc32ctable_le
      0000000000000000 t crc32_exit
      --
      0000000000000960 t test_buf
      0000000000002000 r crc32table_be
      0000000000004000 r crc32table_le
      000000001d1056e5 A __crc_crc32_be
    
      [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=52181
    
    Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
    Cc: Joe Mario <jmario@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  13. @Villemoes

    lib: bitmap: remove redundant code from __bitmap_shift_left

    Villemoes authored committed
    The first of these conditionals is completely redundant: If k == lim-1, we
    must have off==0, so the second conditional will also trigger and then it
    wouldn't matter if upper had some high bits set.  But the second
    conditional is in fact also redundant, since it only serves to clear out
    some high-order "don't care" bits of dst, about which no guarantee is
    made.
    
    Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  14. @Villemoes

    lib: bitmap: eliminate branch in __bitmap_shift_left

    Villemoes authored committed
    We can shift the bits from lower and upper into place before assembling
    dst[k + off]; moving the shift of lower into the branch where we already
    know that rem is non-zero allows us to remove a conditional.
    
    Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  15. @Villemoes

    lib: bitmap: change bitmap_shift_left to take unsigned parameters

    Villemoes authored committed
    gcc can generate slightly better code for stuff like "nbits %
    BITS_PER_LONG" when it knows nbits is not negative.  Since negative size
    bitmaps or shift amounts don't make sense, change these parameters of
    bitmap_shift_right to unsigned.
    
    If off >= lim (which requires shift >= nbits), k is initialized with a
    large positive value, but since I've let k continue to be signed, the loop
    will never run and dst will be zeroed as expected.  Inside the loop, k is
    guaranteed to be non-negative, so the fact that it is promoted to unsigned
    in the various expressions it appears in is harmless.
    
    Also use "shift" and "nbits" consistently for the parameter names.
    
    Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Something went wrong with that request. Please try again.