{"push_id":791925584,"size":13,"distinct_size":13,"ref":"refs/heads/master","head":"9c488de24f7264f08d341024bffdd637b4d04c96","before":"6ff33f3902c3b1c5d0db6b1e2c70b6d76fba357f","commits":[{"sha":"a077224fd35b2f7fbc93f14cf67074fc792fbac2","author":{"email":"66d3c5fdaeea7ff1f996ad04f2c45e08ab38e2f5@linaro.org","name":"Ard Biesheuvel"},"message":"ARM: 8429/1: disable GCC SRA optimization\n\nWhile working on the 32-bit ARM port of UEFI, I noticed a strange\ncorruption in the kernel log. The following snprintf() statement\n(in drivers/firmware/efi/efi.c:efi_md_typeattr_format())\n\n\tsnprintf(pos, size, \"|%3s|%2s|%2s|%2s|%3s|%2s|%2s|%2s|%2s]\",\n\nwas producing the following output in the log:\n\n\t|    |   |   |   |    |WB|WT|WC|UC]\n\t|    |   |   |   |    |WB|WT|WC|UC]\n\t|    |   |   |   |    |WB|WT|WC|UC]\n\t|RUN|   |   |   |    |WB|WT|WC|UC]*\n\t|RUN|   |   |   |    |WB|WT|WC|UC]*\n\t|    |   |   |   |    |WB|WT|WC|UC]\n\t|RUN|   |   |   |    |WB|WT|WC|UC]*\n\t|    |   |   |   |    |WB|WT|WC|UC]\n\t|RUN|   |   |   |    |   |   |   |UC]\n\t|RUN|   |   |   |    |   |   |   |UC]\n\nAs it turns out, this is caused by incorrect code being emitted for\nthe string() function in lib/vsprintf.c. The following code\n\n\tif (!(spec.flags & LEFT)) {\n\t\twhile (len < spec.field_width--) {\n\t\t\tif (buf < end)\n\t\t\t\t*buf = ' ';\n\t\t\t++buf;\n\t\t}\n\t}\n\tfor (i = 0; i < len; ++i) {\n\t\tif (buf < end)\n\t\t\t*buf = *s;\n\t\t++buf; ++s;\n\t}\n\twhile (len < spec.field_width--) {\n\t\tif (buf < end)\n\t\t\t*buf = ' ';\n\t\t++buf;\n\t}\n\nwhen called with len == 0, triggers an issue in the GCC SRA optimization\npass (Scalar Replacement of Aggregates), which handles promotion of signed\nstruct members incorrectly. This is a known but as yet unresolved issue.\n(https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65932). In this particular\ncase, it is causing the second while loop to be executed erroneously a\nsingle time, causing the additional space characters to be printed.\n\nSo disable the optimization by passing -fno-ipa-sra.\n\nCc: <stable@vger.kernel.org>\nAcked-by: Nicolas Pitre <nico@linaro.org>\nSigned-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/a077224fd35b2f7fbc93f14cf67074fc792fbac2"},{"sha":"39dc53deff30d9b239ac36cfeb0ef2022d03a449","author":{"email":"f6aa0246ff943bfa8602cdf60d40c481b38ed232@arm.linux.org.uk","name":"Russell King"},"message":"ARM: swpan: fix nwfpe for uaccess changes\n\nNWFPE needs to access userspace to check whether the next instruction\nis another FP instruction.  Allow userspace access for this read.\n\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/39dc53deff30d9b239ac36cfeb0ef2022d03a449"},{"sha":"296254f3223d201f2aa53f5f717eedfdc63f3db8","author":{"email":"f6aa0246ff943bfa8602cdf60d40c481b38ed232@arm.linux.org.uk","name":"Russell King"},"message":"ARM: uaccess: remove unneeded uaccess_save_and_disable macro\n\nThis macro is never referenced, remove it.\n\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/296254f3223d201f2aa53f5f717eedfdc63f3db8"},{"sha":"af4cb25df93d2e7a97d65db2bfacaa4400988dea","author":{"email":"f6aa0246ff943bfa8602cdf60d40c481b38ed232@arm.linux.org.uk","name":"Russell King"},"message":"ARM: uaccess: fix undefined instruction on ARMv7M/noMMU\n\nThe use of get_domain() in copy_thread() results in an oops on\nARMv7M/noMMU systems.  The thread cpu_domain value is only used when\nCONFIG_CPU_USE_DOMAINS is enabled, so there's no need to save the\nvalue in copy_thread() except when this is enabled, and this option\nwill never be enabled on these platforms.\n\nUnhandled exception: IPSR = 00000006 LR = fffffff1\nCPU: 0 PID: 0 Comm: swapper Not tainted 4.2.0-next-20150909-00001-gb8ec5ad #41\nHardware name: NXP LPC18xx/43xx (Device Tree)\ntask: 2823fbe0 ti: 2823c000 task.ti: 2823c000\nPC is at copy_thread+0x18/0x92\nLR is at copy_thread+0x19/0x92\npc : [<2800a46e>]    lr : [<2800a46f>]    psr: 4100000b\nsp : 2823df00  ip : 00000000  fp : 287c81c0\nr10: 00000000  r9 : 00800300  r8 : 287c8000\nr7 : 287c8000  r6 : 2818908d  r5 : 00000000  r4 : 287ca000\nr3 : 00000000  r2 : 00000000  r1 : fffffff0  r0 : 287ca048\nxPSR: 4100000b\n\nReported-by: Ariel D'Alessandro <ariel@vanguardiasur.com.ar>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/af4cb25df93d2e7a97d65db2bfacaa4400988dea"},{"sha":"4c17a6d56bb0cad3066a714e94f7185a24b40f49","author":{"email":"1ff1d5ceb421971f93e6626b02a9591b29d7600e@thejh.net","name":"Jann Horn"},"message":"CIFS: fix type confusion in copy offload ioctl\n\nThis might lead to local privilege escalation (code execution as\nkernel) for systems where the following conditions are met:\n\n - CONFIG_CIFS_SMB2 and CONFIG_CIFS_POSIX are enabled\n - a cifs filesystem is mounted where:\n  - the mount option \"vers\" was used and set to a value >=2.0\n  - the attacker has write access to at least one file on the filesystem\n\nTo attack this, an attacker would have to guess the target_tcon\npointer (but guessing wrong doesn't cause a crash, it just returns an\nerror code) and win a narrow race.\n\nCC: Stable <stable@vger.kernel.org>\nSigned-off-by: Jann Horn <jann@thejh.net>\nSigned-off-by: Steve French <smfrench@gmail.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/4c17a6d56bb0cad3066a714e94f7185a24b40f49"},{"sha":"716ff1921a86c637b8875c7bb312fc6755fa9300","author":{"email":"f6aa0246ff943bfa8602cdf60d40c481b38ed232@arm.linux.org.uk","name":"Russell King"},"message":"ARM: domains: thread_info.h no longer needs asm/domains.h\n\nAs of 1eef5d2f1b46 (\"ARM: domains: switch to keeping domain value in\nregister\") we no longer need to include asm/domains.h into\nasm/thread_info.h.  Remove it.\n\nTested-by: Robert Jarzmik <robert.jarzmik@free.fr>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/716ff1921a86c637b8875c7bb312fc6755fa9300"},{"sha":"6e8f580d1fcc18e290713984c379cb97131c015a","author":{"email":"f6aa0246ff943bfa8602cdf60d40c481b38ed232@arm.linux.org.uk","name":"Russell King"},"message":"ARM: domains: add memory dependencies to get_domain/set_domain\n\nWe need to have memory dependencies on get_domain/set_domain to avoid\nthe compiler over-optimising these inline assembly instructions.\n\nLoads/stores must not be reordered across a set_domain(), so introduce\na compiler barrier for that assembly.\n\nThe value of get_domain() must not be cached across a set_domain(), but\nwe still want to allow the compiler to optimise it away.  Introduce a\ndependency on current_thread_info()->cpu_domain to avoid this; the new\nmemory clobber in set_domain() should therefore cause the compiler to\nre-load this.  The other advantage of using this is we should have its\naddress in the register set already, or very soon after at most call\nsites.\n\nTested-by: Robert Jarzmik <robert.jarzmik@free.fr>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/6e8f580d1fcc18e290713984c379cb97131c015a"},{"sha":"0b61f2c0f37983c98ed4207f3f5e265938371b68","author":{"email":"2fe41d4e32b0bb991f63b975f2bed08c1e666665@citrix.com","name":"Julien Grall"},"message":"arm/xen: Enable user access to the kernel before issuing a privcmd call\n\nWhen Xen is copying data to/from the guest it will check if the kernel\nhas the right to do the access. If not, the hypercall will return an\nerror.\n\nAfter the commit a5e090acbf545c0a3b04080f8a488b17ec41fe02 \"ARM:\nsoftware-based privileged-no-access support\", the kernel can't access\nany longer the user space by default. This will result to fail on every\nhypercall made by the userspace (i.e via privcmd).\n\nWe have to enable the userspace access and then restore the correct\npermission every time the privcmd is used to made an hypercall.\n\nI didn't find generic helpers to do a these operations, so the change\nis only arm32 specific.\n\nReported-by: Riku Voipio <riku.voipio@linaro.org>\nSigned-off-by: Julien Grall <julien.grall@citrix.com>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/0b61f2c0f37983c98ed4207f3f5e265938371b68"},{"sha":"a4a5a7379e4ca03c192b732d61e446994eb67bbc","author":{"email":"94b2a0a74cb42a2dd0cf1b763601af7f13907aa9@free.fr","name":"Robert Jarzmik"},"message":"ARM: 8431/1: fix alignement of __bug_table section entries\n\nOn old ARM chips, unaligned accesses to memory are not trapped and\nfixed.  On module load, symbols are relocated, and the relocation of\n__bug_table symbols is done on a u32 basis. Yet the section is not\naligned to a multiple of 4 address, but to a multiple of 2.\n\nThis triggers an Oops on pxa architecture, where address 0xbf0021ea\nis the first relocation in the __bug_table section :\n  apply_relocate(): pxa3xx_nand: section 13 reloc 0 sym ''\n  Unable to handle kernel paging request at virtual address bf0021ea\n  pgd = e1cd0000\n  [bf0021ea] *pgd=c1cce851, *pte=c1cde04f, *ppte=c1cde01f\n  Internal error: Oops: 23 [#1] ARM\n  Modules linked in:\n  CPU: 0 PID: 606 Comm: insmod Not tainted 4.2.0-rc8-next-20150828-cm-x300+ #887\n  Hardware name: CM-X300 module\n  task: e1c68700 ti: e1c3e000 task.ti: e1c3e000\n  PC is at apply_relocate+0x2f4/0x3d4\n  LR is at 0xbf0021ea\n  pc : [<c000e7c8>]    lr : [<bf0021ea>]    psr: 80000013\n  sp : e1c3fe30  ip : 60000013  fp : e49e8c60\n  r10: e49e8fa8  r9 : 00000000  r8 : e49e7c58\n  r7 : e49e8c38  r6 : e49e8a58  r5 : e49e8920  r4 : e49e8918\n  r3 : bf0021ea  r2 : bf007034  r1 : 00000000  r0 : bf000000\n  Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none\n  Control: 0000397f  Table: c1cd0018  DAC: 00000051\n  Process insmod (pid: 606, stack limit = 0xe1c3e198)\n  [<c000e7c8>] (apply_relocate) from [<c005ce5c>] (load_module+0x1248/0x1f5c)\n  [<c005ce5c>] (load_module) from [<c005dc54>] (SyS_init_module+0xe4/0x170)\n  [<c005dc54>] (SyS_init_module) from [<c000a420>] (ret_fast_syscall+0x0/0x38)\n\nFix this by ensuring entries in __bug_table are all aligned to at least\nof multiple of 4. This transforms a module section  __bug_table as :\n-   [12] __bug_table       PROGBITS        00000000 002232 000018 00   A  0   0  1\n+   [12] __bug_table       PROGBITS        00000000 002232 000018 00   A  0   0  4\n\nSigned-off-by: Robert Jarzmik <robert.jarzmik@free.fr>\nReviewed-by: Dave Martin <Dave.Martin@arm.com>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/a4a5a7379e4ca03c192b732d61e446994eb67bbc"},{"sha":"c2172ce2303051764829d4958bd50a11ada0590f","author":{"email":"f6aa0246ff943bfa8602cdf60d40c481b38ed232@arm.linux.org.uk","name":"Russell King"},"message":"Merge branch 'uaccess' into fixes","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/c2172ce2303051764829d4958bd50a11ada0590f"},{"sha":"eda2116f4ab6d79cfcffc202b5d2bbb0797ba013","author":{"email":"51565b4e5841e493fd669866e11ea3c7c0d781cc@gmail.com","name":"Steve French"},"message":"[CIFS] mount option sec=none not displayed properly in /proc/mounts\n\nWhen the user specifies \"sec=none\" in a cifs mount, we set\nsec_type as unspecified (and set a flag and the username will be\nnull) rather than setting sectype as \"none\" so\ncifs_show_security was not properly displaying it in\ncifs /proc/mounts entries.\n\nSigned-off-by: Steve French <steve.french@primarydata.com>\nReviewed-by: Jeff Layton <jlayton@poochiereds.net>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/eda2116f4ab6d79cfcffc202b5d2bbb0797ba013"},{"sha":"57e6bbcb4beb4c87aa93e78a1db08fdaab9ee65f","author":{"email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org","name":"Linus Torvalds"},"message":"Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm\n\nPull ARM fixes from Russell King:\n \"A number of fixes for the merge window, fixing a number of cases\n  missed when testing the uaccess code, particularly cases which only\n  show up with certain compiler versions\"\n\n* 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:\n  ARM: 8431/1: fix alignement of __bug_table section entries\n  arm/xen: Enable user access to the kernel before issuing a privcmd call\n  ARM: domains: add memory dependencies to get_domain/set_domain\n  ARM: domains: thread_info.h no longer needs asm/domains.h\n  ARM: uaccess: fix undefined instruction on ARMv7M/noMMU\n  ARM: uaccess: remove unneeded uaccess_save_and_disable macro\n  ARM: swpan: fix nwfpe for uaccess changes\n  ARM: 8429/1: disable GCC SRA optimization","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/57e6bbcb4beb4c87aa93e78a1db08fdaab9ee65f"},{"sha":"9c488de24f7264f08d341024bffdd637b4d04c96","author":{"email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org","name":"Linus Torvalds"},"message":"Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6\n\nPull CIFS fixes from Steve French:\n \"Two small cifs fixes\"\n\n* 'for-next' of git://git.samba.org/sfrench/cifs-2.6:\n  [CIFS] mount option sec=none not displayed properly in /proc/mounts\n  CIFS: fix type confusion in copy offload ioctl","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/9c488de24f7264f08d341024bffdd637b4d04c96"}]}