lael-labs/linux

kernel/configs/android-base.config+152−0

@@ -0,0 +1,152 @@
	1	# KEEP ALPHABETICALLY SORTED
	2	# CONFIG_DEVKMEM is not set
	3	# CONFIG_DEVMEM is not set
	4	# CONFIG_INET_LRO is not set
	5	# CONFIG_MODULES is not set
	6	# CONFIG_OABI_COMPAT is not set
	7	# CONFIG_SYSVIPC is not set
	8	CONFIG_ANDROID=y
	9	CONFIG_ANDROID_BINDER_IPC=y
	10	CONFIG_ANDROID_LOW_MEMORY_KILLER=y
	11	CONFIG_ARMV8_DEPRECATED=y
	12	CONFIG_ASHMEM=y
	13	CONFIG_AUDIT=y
	14	CONFIG_BLK_DEV_DM=y
	15	CONFIG_BLK_DEV_INITRD=y
	16	CONFIG_CGROUPS=y
	17	CONFIG_CGROUP_CPUACCT=y
	18	CONFIG_CGROUP_DEBUG=y
	19	CONFIG_CGROUP_FREEZER=y
	20	CONFIG_CGROUP_SCHED=y
	21	CONFIG_CP15_BARRIER_EMULATION=y
	22	CONFIG_DM_CRYPT=y
	23	CONFIG_DM_VERITY=y
	24	CONFIG_DM_VERITY_FEC=y
	25	CONFIG_EMBEDDED=y
	26	CONFIG_FB=y
	27	CONFIG_HIGH_RES_TIMERS=y
	28	CONFIG_INET6_AH=y
	29	CONFIG_INET6_ESP=y
	30	CONFIG_INET6_IPCOMP=y
	31	CONFIG_INET=y
	32	CONFIG_INET_DIAG_DESTROY=y
	33	CONFIG_INET_ESP=y
	34	CONFIG_INET_XFRM_MODE_TUNNEL=y
	35	CONFIG_IP6_NF_FILTER=y
	36	CONFIG_IP6_NF_IPTABLES=y
	37	CONFIG_IP6_NF_MANGLE=y
	38	CONFIG_IP6_NF_RAW=y
	39	CONFIG_IP6_NF_TARGET_REJECT=y
	40	CONFIG_IPV6=y
	41	CONFIG_IPV6_MIP6=y
	42	CONFIG_IPV6_MULTIPLE_TABLES=y
	43	CONFIG_IPV6_OPTIMISTIC_DAD=y
	44	CONFIG_IPV6_PRIVACY=y
	45	CONFIG_IPV6_ROUTER_PREF=y
	46	CONFIG_IPV6_ROUTE_INFO=y
	47	CONFIG_IP_ADVANCED_ROUTER=y
	48	CONFIG_IP_MULTICAST=y
	49	CONFIG_IP_MULTIPLE_TABLES=y
	50	CONFIG_IP_NF_ARPFILTER=y
	51	CONFIG_IP_NF_ARPTABLES=y
	52	CONFIG_IP_NF_ARP_MANGLE=y
	53	CONFIG_IP_NF_FILTER=y
	54	CONFIG_IP_NF_IPTABLES=y
	55	CONFIG_IP_NF_MANGLE=y
	56	CONFIG_IP_NF_MATCH_AH=y
	57	CONFIG_IP_NF_MATCH_ECN=y
	58	CONFIG_IP_NF_MATCH_TTL=y
	59	CONFIG_IP_NF_NAT=y
	60	CONFIG_IP_NF_RAW=y
	61	CONFIG_IP_NF_SECURITY=y
	62	CONFIG_IP_NF_TARGET_MASQUERADE=y
	63	CONFIG_IP_NF_TARGET_NETMAP=y
	64	CONFIG_IP_NF_TARGET_REDIRECT=y
	65	CONFIG_IP_NF_TARGET_REJECT=y
	66	CONFIG_NET=y
	67	CONFIG_NETDEVICES=y
	68	CONFIG_NETFILTER=y
	69	CONFIG_NETFILTER_TPROXY=y
	70	CONFIG_NETFILTER_XT_MATCH_COMMENT=y
	71	CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y
	72	CONFIG_NETFILTER_XT_MATCH_CONNMARK=y
	73	CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
	74	CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y
	75	CONFIG_NETFILTER_XT_MATCH_HELPER=y
	76	CONFIG_NETFILTER_XT_MATCH_IPRANGE=y
	77	CONFIG_NETFILTER_XT_MATCH_LENGTH=y
	78	CONFIG_NETFILTER_XT_MATCH_LIMIT=y
	79	CONFIG_NETFILTER_XT_MATCH_MAC=y
	80	CONFIG_NETFILTER_XT_MATCH_MARK=y
	81	CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y
	82	CONFIG_NETFILTER_XT_MATCH_POLICY=y
	83	CONFIG_NETFILTER_XT_MATCH_QUOTA=y
	84	CONFIG_NETFILTER_XT_MATCH_SOCKET=y
	85	CONFIG_NETFILTER_XT_MATCH_STATE=y
	86	CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
	87	CONFIG_NETFILTER_XT_MATCH_STRING=y
	88	CONFIG_NETFILTER_XT_MATCH_TIME=y
	89	CONFIG_NETFILTER_XT_MATCH_U32=y
	90	CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y
	91	CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
	92	CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=y
	93	CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y
	94	CONFIG_NETFILTER_XT_TARGET_MARK=y
	95	CONFIG_NETFILTER_XT_TARGET_NFLOG=y
	96	CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y
	97	CONFIG_NETFILTER_XT_TARGET_SECMARK=y
	98	CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
	99	CONFIG_NETFILTER_XT_TARGET_TPROXY=y
	100	CONFIG_NETFILTER_XT_TARGET_TRACE=y
	101	CONFIG_NET_CLS_ACT=y
	102	CONFIG_NET_CLS_U32=y
	103	CONFIG_NET_EMATCH=y
	104	CONFIG_NET_EMATCH_U32=y
	105	CONFIG_NET_KEY=y
	106	CONFIG_NET_SCHED=y
	107	CONFIG_NET_SCH_HTB=y
	108	CONFIG_NF_CONNTRACK=y
	109	CONFIG_NF_CONNTRACK_AMANDA=y
	110	CONFIG_NF_CONNTRACK_EVENTS=y
	111	CONFIG_NF_CONNTRACK_FTP=y
	112	CONFIG_NF_CONNTRACK_H323=y
	113	CONFIG_NF_CONNTRACK_IPV4=y
	114	CONFIG_NF_CONNTRACK_IPV6=y
	115	CONFIG_NF_CONNTRACK_IRC=y
	116	CONFIG_NF_CONNTRACK_NETBIOS_NS=y
	117	CONFIG_NF_CONNTRACK_PPTP=y
	118	CONFIG_NF_CONNTRACK_SANE=y
	119	CONFIG_NF_CONNTRACK_SECMARK=y
	120	CONFIG_NF_CONNTRACK_TFTP=y
	121	CONFIG_NF_CT_NETLINK=y
	122	CONFIG_NF_CT_PROTO_DCCP=y
	123	CONFIG_NF_CT_PROTO_SCTP=y
	124	CONFIG_NF_CT_PROTO_UDPLITE=y
	125	CONFIG_NF_NAT=y
	126	CONFIG_NO_HZ=y
	127	CONFIG_PACKET=y
	128	CONFIG_PM_AUTOSLEEP=y
	129	CONFIG_PM_WAKELOCKS=y
	130	CONFIG_PPP=y
	131	CONFIG_PPP_BSDCOMP=y
	132	CONFIG_PPP_DEFLATE=y
	133	CONFIG_PPP_MPPE=y
	134	CONFIG_PREEMPT=y
	135	CONFIG_QUOTA=y
	136	CONFIG_RTC_CLASS=y
	137	CONFIG_RT_GROUP_SCHED=y
	138	CONFIG_SECURITY=y
	139	CONFIG_SECURITY_NETWORK=y
	140	CONFIG_SECURITY_SELINUX=y
	141	CONFIG_SETEND_EMULATION=y
	142	CONFIG_STAGING=y
	143	CONFIG_SWP_EMULATION=y
	144	CONFIG_SYNC=y
	145	CONFIG_TUN=y
	146	CONFIG_UNIX=y
	147	CONFIG_USB_GADGET=y
	148	CONFIG_USB_CONFIGFS=y
	149	CONFIG_USB_CONFIGFS_F_FS=y
	150	CONFIG_USB_CONFIGFS_F_MIDI=y
	151	CONFIG_USB_OTG_WAKELOCK=y
	152	CONFIG_XFRM_USER=y

kernel/configs/android-recommended.config+121−0

@@ -0,0 +1,121 @@
	1	# KEEP ALPHABETICALLY SORTED
	2	# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
	3	# CONFIG_INPUT_MOUSE is not set
	4	# CONFIG_LEGACY_PTYS is not set
	5	# CONFIG_NF_CONNTRACK_SIP is not set
	6	# CONFIG_PM_WAKELOCKS_GC is not set
	7	# CONFIG_VT is not set
	8	CONFIG_BACKLIGHT_LCD_SUPPORT=y
	9	CONFIG_BLK_DEV_LOOP=y
	10	CONFIG_BLK_DEV_RAM=y
	11	CONFIG_BLK_DEV_RAM_SIZE=8192
	12	CONFIG_COMPACTION=y
	13	CONFIG_DEBUG_RODATA=y
	14	CONFIG_DM_UEVENT=y
	15	CONFIG_DRAGONRISE_FF=y
	16	CONFIG_ENABLE_DEFAULT_TRACERS=y
	17	CONFIG_EXT4_FS=y
	18	CONFIG_EXT4_FS_SECURITY=y
	19	CONFIG_FUSE_FS=y
	20	CONFIG_GREENASIA_FF=y
	21	CONFIG_HIDRAW=y
	22	CONFIG_HID_A4TECH=y
	23	CONFIG_HID_ACRUX=y
	24	CONFIG_HID_ACRUX_FF=y
	25	CONFIG_HID_APPLE=y
	26	CONFIG_HID_BELKIN=y
	27	CONFIG_HID_CHERRY=y
	28	CONFIG_HID_CHICONY=y
	29	CONFIG_HID_CYPRESS=y
	30	CONFIG_HID_DRAGONRISE=y
	31	CONFIG_HID_ELECOM=y
	32	CONFIG_HID_EMS_FF=y
	33	CONFIG_HID_EZKEY=y
	34	CONFIG_HID_GREENASIA=y
	35	CONFIG_HID_GYRATION=y
	36	CONFIG_HID_HOLTEK=y
	37	CONFIG_HID_KENSINGTON=y
	38	CONFIG_HID_KEYTOUCH=y
	39	CONFIG_HID_KYE=y
	40	CONFIG_HID_LCPOWER=y
	41	CONFIG_HID_LOGITECH=y
	42	CONFIG_HID_LOGITECH_DJ=y
	43	CONFIG_HID_MAGICMOUSE=y
	44	CONFIG_HID_MICROSOFT=y
	45	CONFIG_HID_MONTEREY=y
	46	CONFIG_HID_MULTITOUCH=y
	47	CONFIG_HID_NTRIG=y
	48	CONFIG_HID_ORTEK=y
	49	CONFIG_HID_PANTHERLORD=y
	50	CONFIG_HID_PETALYNX=y
	51	CONFIG_HID_PICOLCD=y
	52	CONFIG_HID_PRIMAX=y
	53	CONFIG_HID_PRODIKEYS=y
	54	CONFIG_HID_ROCCAT=y
	55	CONFIG_HID_SAITEK=y
	56	CONFIG_HID_SAMSUNG=y
	57	CONFIG_HID_SMARTJOYPLUS=y
	58	CONFIG_HID_SONY=y
	59	CONFIG_HID_SPEEDLINK=y
	60	CONFIG_HID_SUNPLUS=y
	61	CONFIG_HID_THRUSTMASTER=y
	62	CONFIG_HID_TIVO=y
	63	CONFIG_HID_TOPSEED=y
	64	CONFIG_HID_TWINHAN=y
	65	CONFIG_HID_UCLOGIC=y
	66	CONFIG_HID_WACOM=y
	67	CONFIG_HID_WALTOP=y
	68	CONFIG_HID_WIIMOTE=y
	69	CONFIG_HID_ZEROPLUS=y
	70	CONFIG_HID_ZYDACRON=y
	71	CONFIG_INPUT_EVDEV=y
	72	CONFIG_INPUT_GPIO=y
	73	CONFIG_INPUT_JOYSTICK=y
	74	CONFIG_INPUT_MISC=y
	75	CONFIG_INPUT_TABLET=y
	76	CONFIG_INPUT_UINPUT=y
	77	CONFIG_ION=y
	78	CONFIG_JOYSTICK_XPAD=y
	79	CONFIG_JOYSTICK_XPAD_FF=y
	80	CONFIG_JOYSTICK_XPAD_LEDS=y
	81	CONFIG_KALLSYMS_ALL=y
	82	CONFIG_KSM=y
	83	CONFIG_LOGIG940_FF=y
	84	CONFIG_LOGIRUMBLEPAD2_FF=y
	85	CONFIG_LOGITECH_FF=y
	86	CONFIG_MD=y
	87	CONFIG_MEDIA_SUPPORT=y
	88	CONFIG_MSDOS_FS=y
	89	CONFIG_PANIC_TIMEOUT=5
	90	CONFIG_PANTHERLORD_FF=y
	91	CONFIG_PERF_EVENTS=y
	92	CONFIG_PM_DEBUG=y
	93	CONFIG_PM_RUNTIME=y
	94	CONFIG_PM_WAKELOCKS_LIMIT=0
	95	CONFIG_POWER_SUPPLY=y
	96	CONFIG_PSTORE=y
	97	CONFIG_PSTORE_CONSOLE=y
	98	CONFIG_PSTORE_RAM=y
	99	CONFIG_SCHEDSTATS=y
	100	CONFIG_SMARTJOYPLUS_FF=y
	101	CONFIG_SND=y
	102	CONFIG_SOUND=y
	103	CONFIG_SUSPEND_TIME=y
	104	CONFIG_TABLET_USB_ACECAD=y
	105	CONFIG_TABLET_USB_AIPTEK=y
	106	CONFIG_TABLET_USB_GTCO=y
	107	CONFIG_TABLET_USB_HANWANG=y
	108	CONFIG_TABLET_USB_KBTAB=y
	109	CONFIG_TASKSTATS=y
	110	CONFIG_TASK_DELAY_ACCT=y
	111	CONFIG_TASK_IO_ACCOUNTING=y
	112	CONFIG_TASK_XACCT=y
	113	CONFIG_TIMER_STATS=y
	114	CONFIG_TMPFS=y
	115	CONFIG_TMPFS_POSIX_ACL=y
	116	CONFIG_UHID=y
	117	CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
	118	CONFIG_USB_EHCI_HCD=y
	119	CONFIG_USB_HIDDEV=y
	120	CONFIG_USB_USBNET=y
	121	CONFIG_VFAT_FS=y

kernel/events/core.c+1−1

@@ -448,7 +448,7 @@ static u64 __report_allowed; · 447 unmodified lines
448		448
449	static void perf_duration_warn(struct irq_work *w)	449	static void perf_duration_warn(struct irq_work *w)
450	{	450	{
451	printk_ratelimited(KERN_WARNING	451	printk_ratelimited(KERN_INFO
452	"perf: interrupt took too long (%lld > %lld), lowering "	452	"perf: interrupt took too long (%lld > %lld), lowering "
453	"kernel.perf_event_max_sample_rate to %d\n",	453	"kernel.perf_event_max_sample_rate to %d\n",
454	__report_avg, __report_allowed,	454	__report_avg, __report_allowed,

kernel/exit.c+1−1

@@ -715,7 +715,7 @@ static void check_stack_usage(void) · 714 unmodified lines
715		715
716	spin_lock(&low_water_lock);	716	spin_lock(&low_water_lock);
717	if (free < lowest_to_date) {	717	if (free < lowest_to_date) {
718	pr_warn("%s (%d) used greatest stack depth: %lu bytes left\n",	718	pr_info("%s (%d) used greatest stack depth: %lu bytes left\n",
719	current->comm, task_pid_nr(current), free);	719	current->comm, task_pid_nr(current), free);
720	lowest_to_date = free;	720	lowest_to_date = free;
721	}	721	}

kernel/jump_label.c+60−1

@@ -14,6 +14,7 @@ · 13 unmodified lines
14	#include <linux/err.h>	14	#include <linux/err.h>
15	#include <linux/static_key.h>	15	#include <linux/static_key.h>
16	#include <linux/jump_label_ratelimit.h>	16	#include <linux/jump_label_ratelimit.h>
		17	#include <linux/bug.h>
17		18
18	#ifdef HAVE_JUMP_LABEL	19	#ifdef HAVE_JUMP_LABEL
19		20
@@ -56,6 +57,49 @@ jump_label_sort_entries(struct jump_entry start, struct jump_entry stop) · 36 unmodified lines
56		57
57	static void jump_label_update(struct static_key *key);	58	static void jump_label_update(struct static_key *key);
58		59
		60	/*
		61	* There are similar definitions for the !HAVE_JUMP_LABEL case in jump_label.h.
		62	* The use of 'atomic_read()' requires atomic.h and its problematic for some
		63	* kernel headers such as kernel.h and others. Since static_key_count() is not
		64	* used in the branch statements as it is for the !HAVE_JUMP_LABEL case its ok
		65	* to have it be a function here. Similarly, for 'static_key_enable()' and
		66	* 'static_key_disable()', which require bug.h. This should allow jump_label.h
		67	* to be included from most/all places for HAVE_JUMP_LABEL.
		68	*/
		69	int static_key_count(struct static_key *key)
		70	{
		71	/*
		72	* -1 means the first static_key_slow_inc() is in progress.
		73	* static_key_enabled() must return true, so return 1 here.
		74	*/
		75	int n = atomic_read(&key->enabled);
		76
		77	return n >= 0 ? n : 1;
		78	}
		79	EXPORT_SYMBOL_GPL(static_key_count);
		80
		81	void static_key_enable(struct static_key *key)
		82	{
		83	int count = static_key_count(key);
		84
		85	WARN_ON_ONCE(count < 0 \|\| count > 1);
		86
		87	if (!count)
		88	static_key_slow_inc(key);
		89	}
		90	EXPORT_SYMBOL_GPL(static_key_enable);
		91
		92	void static_key_disable(struct static_key *key)
		93	{
		94	int count = static_key_count(key);
		95
		96	WARN_ON_ONCE(count < 0 \|\| count > 1);
		97
		98	if (count)
		99	static_key_slow_dec(key);
		100	}
		101	EXPORT_SYMBOL_GPL(static_key_disable);
		102
59	void static_key_slow_inc(struct static_key *key)	103	void static_key_slow_inc(struct static_key *key)
60	{	104	{
61	int v, v1;	105	int v, v1;
@@ -235,6 +279,18 @@ void __init jump_label_init(void) · 173 unmodified lines
235	struct static_key *key = NULL;	279	struct static_key *key = NULL;
236	struct jump_entry *iter;	280	struct jump_entry *iter;
237		281
		282	/*
		283	* Since we are initializing the static_key.enabled field with
		284	* with the 'raw' int values (to avoid pulling in atomic.h) in
		285	* jump_label.h, let's make sure that is safe. There are only two
		286	* cases to check since we initialize to 0 or 1.
		287	*/
		288	BUILD_BUG_ON((int)ATOMIC_INIT(0) != 0);
		289	BUILD_BUG_ON((int)ATOMIC_INIT(1) != 1);
		290
		291	if (static_key_initialized)
		292	return;
		293
238	jump_label_lock();	294	jump_label_lock();
239	jump_label_sort_entries(iter_start, iter_stop);	295	jump_label_sort_entries(iter_start, iter_stop);
240		296
@@ -284,11 +340,14 @@ static int __jump_label_mod_text_reserved(void start, void end) · 43 unmodified lines
284	{	340	{
285	struct module *mod;	341	struct module *mod;
286		342
		343	preempt_disable();
287	mod = __module_text_address((unsigned long)start);	344	mod = __module_text_address((unsigned long)start);
		345	WARN_ON_ONCE(__module_text_address((unsigned long)end) != mod);
		346	preempt_enable();
		347
288	if (!mod)	348	if (!mod)
289	return 0;	349	return 0;
290		350
291	WARN_ON_ONCE(__module_text_address((unsigned long)end) != mod);
292		351
293	return __jump_label_text_reserved(mod->jump_entries,	352	return __jump_label_text_reserved(mod->jump_entries,
294	mod->jump_entries + mod->num_jump_entries,	353	mod->jump_entries + mod->num_jump_entries,

kernel/kexec.c+2−1

@@ -48,7 +48,8 @@ static int kimage_alloc_init(struct kimage **rimage, unsigned long entry, · 47 unmodified lines
48		48
49	if (kexec_on_panic) {	49	if (kexec_on_panic) {
50	/* Verify we have a valid entry point */	50	/* Verify we have a valid entry point */
51	if ((entry < crashk_res.start) \|\| (entry > crashk_res.end))	51	if ((entry < phys_to_boot_phys(crashk_res.start)) \|\|
		52	(entry > phys_to_boot_phys(crashk_res.end)))
52	return -EADDRNOTAVAIL;	53	return -EADDRNOTAVAIL;
53	}	54	}
54		55

kernel/kexec_core.c+45−24

 	return 0;
 }
+int kexec_crash_loaded(void)
+{
+	return !!kexec_crash_image;
+}
+EXPORT_SYMBOL_GPL(kexec_crash_loaded);
 /*
  * When kexec transitions to the new kernel there is a one-to-one
  * mapping between physical and virtual addresses.  On processors
  * allocating pages whose destination address we do not care about.
  */
 #define KIMAGE_NO_DEST (-1UL)
+#define PAGE_COUNT(x) (((x) + PAGE_SIZE - 1) >> PAGE_SHIFT)
 static struct page *kimage_alloc_page(struct kimage *image,
 				       gfp_t gfp_mask,
 int sanity_check_segment_list(struct kimage *image)
 {
-	int result, i;
+	int i;
 	unsigned long nr_segments = image->nr_segments;
+	unsigned long total_pages = 0;
 	/*
 	 * Verify we have good destination addresses.  The caller is
 	 * simply because addresses are changed to page size
 	 * granularity.
 	 */
-	result = -EADDRNOTAVAIL;
 	for (i = 0; i < nr_segments; i++) {
 		unsigned long mstart, mend;
 		mstart = image->segment[i].mem;
 		mend   = mstart + image->segment[i].memsz;
+		if (mstart > mend)
+			return -EADDRNOTAVAIL;
 		if ((mstart & ~PAGE_MASK) || (mend & ~PAGE_MASK))
-			return result;
+			return -EADDRNOTAVAIL;
 		if (mend >= KEXEC_DESTINATION_MEMORY_LIMIT)
-			return result;
+			return -EADDRNOTAVAIL;
 	}
 	/* Verify our destination addresses do not overlap.
 	 * through very weird things can happen with no
 	 * easy explanation as one segment stops on another.
 	 */
-	result = -EINVAL;
 	for (i = 0; i < nr_segments; i++) {
 		unsigned long mstart, mend;
 		unsigned long j;
 			pend   = pstart + image->segment[j].memsz;
 			/* Do the segments overlap ? */
 			if ((mend > pstart) && (mstart < pend))
-				return result;
+				return -EINVAL;
 		}
 	}
 	 * and it is easier to check up front than to be surprised
 	 * later on.
 	 */
-	result = -EINVAL;
 	for (i = 0; i < nr_segments; i++) {
 		if (image->segment[i].bufsz > image->segment[i].memsz)
-			return result;
+			return -EINVAL;
+	}
+	/*
+	 * Verify that no more than half of memory will be consumed. If the
+	 * request from userspace is too large, a large amount of time will be
+	 * wasted allocating pages, which can cause a soft lockup.
+	 */
+	for (i = 0; i < nr_segments; i++) {
+		if (PAGE_COUNT(image->segment[i].memsz) > totalram_pages / 2)
+			return -EINVAL;
+		total_pages += PAGE_COUNT(image->segment[i].memsz);
 	}
+	if (total_pages > totalram_pages / 2)
+		return -EINVAL;
 	/*
 	 * Verify we have good destination addresses.  Normally
 	 * the caller is responsible for making certain we don't
 	 */
 	if (image->type == KEXEC_TYPE_CRASH) {
-		result = -EADDRNOTAVAIL;
 		for (i = 0; i < nr_segments; i++) {
 			unsigned long mstart, mend;
 			mstart = image->segment[i].mem;
 			mend = mstart + image->segment[i].memsz - 1;
 			/* Ensure we are within the crash kernel limits */
-			if ((mstart < crashk_res.start) ||
+			if ((mstart < phys_to_boot_phys(crashk_res.start)) ||
-			    (mend > crashk_res.end))
+			    (mend > phys_to_boot_phys(crashk_res.end)))
-				return result;
+				return -EADDRNOTAVAIL;
 		}
 	}
 		pages = kimage_alloc_pages(KEXEC_CONTROL_MEMORY_GFP, order);
 		if (!pages)
 			break;
-		pfn   = page_to_pfn(pages);
+		pfn   = page_to_boot_pfn(pages);
 		epfn  = pfn + count;
 		addr  = pfn << PAGE_SHIFT;
 		eaddr = epfn << PAGE_SHIFT;
 			return -ENOMEM;
 		ind_page = page_address(page);
-		*image->entry = virt_to_phys(ind_page) | IND_INDIRECTION;
+		*image->entry = virt_to_boot_phys(ind_page) | IND_INDIRECTION;
 		image->entry = ind_page;
 		image->last_entry = ind_page +
 				      ((PAGE_SIZE/sizeof(kimage_entry_t)) - 1);
 #define for_each_kimage_entry(image, ptr, entry) \
 	for (ptr = &image->head; (entry = *ptr) && !(entry & IND_DONE); \
 		ptr = (entry & IND_INDIRECTION) ? \
-			phys_to_virt((entry & PAGE_MASK)) : ptr + 1)
+			boot_phys_to_virt((entry & PAGE_MASK)) : ptr + 1)
 static void kimage_free_entry(kimage_entry_t entry)
 {
 	struct page *page;
-	page = pfn_to_page(entry >> PAGE_SHIFT);
+	page = boot_pfn_to_page(entry >> PAGE_SHIFT);
 	kimage_free_pages(page);
 }
 	 * have a match.
 	 */
 	list_for_each_entry(page, &image->dest_pages, lru) {
-		addr = page_to_pfn(page) << PAGE_SHIFT;
+		addr = page_to_boot_pfn(page) << PAGE_SHIFT;
 		if (addr == destination) {
 			list_del(&page->lru);
 			return page;
 		if (!page)
 			return NULL;
 		/* If the page cannot be used file it away */
-		if (page_to_pfn(page) >
+		if (page_to_boot_pfn(page) >
 				(KEXEC_SOURCE_MEMORY_LIMIT >> PAGE_SHIFT)) {
 			list_add(&page->lru, &image->unusable_pages);
 			continue;
 		}
-		addr = page_to_pfn(page) << PAGE_SHIFT;
+		addr = page_to_boot_pfn(page) << PAGE_SHIFT;
 		/* If it is the destination page we want use it */
 		if (addr == destination)
 			struct page *old_page;
 			old_addr = *old & PAGE_MASK;
-			old_page = pfn_to_page(old_addr >> PAGE_SHIFT);
+			old_page = boot_pfn_to_page(old_addr >> PAGE_SHIFT);
 			copy_highpage(page, old_page);
 			*old = addr | (*old & ~PAGE_MASK);
 			result  = -ENOMEM;
 			goto out;
 		}
-		result = kimage_add_page(image, page_to_pfn(page)
+		result = kimage_add_page(image, page_to_boot_pfn(page)
 								<< PAGE_SHIFT);
 		if (result < 0)
 			goto out;
 		char *ptr;
 		size_t uchunk, mchunk;
-		page = pfn_to_page(maddr >> PAGE_SHIFT);
+		page = boot_pfn_to_page(maddr >> PAGE_SHIFT);
 		if (!page) {
 			result  = -ENOMEM;
 			goto out;
 	unsigned long addr;
 	for (addr = begin; addr < end; addr += PAGE_SIZE)
-		free_reserved_page(pfn_to_page(addr >> PAGE_SHIFT));
+		free_reserved_page(boot_pfn_to_page(addr >> PAGE_SHIFT));
 }
 int crash_shrink_memory(unsigned long new_size)
 void __weak arch_crash_save_vmcoreinfo(void)
 {}
-unsigned long __weak paddr_vmcoreinfo_note(void)
+phys_addr_t __weak paddr_vmcoreinfo_note(void)
 {
 	return __pa((unsigned long)(char *)&vmcoreinfo_note);
 }

kernel/ksysfs.c+3−3

@@ -101,7 +101,7 @@ KERNEL_ATTR_RO(kexec_loaded); · 100 unmodified lines
101	static ssize_t kexec_crash_loaded_show(struct kobject *kobj,	101	static ssize_t kexec_crash_loaded_show(struct kobject *kobj,
102	struct kobj_attribute attr, char buf)	102	struct kobj_attribute attr, char buf)
103	{	103	{
104	return sprintf(buf, "%d\n", !!kexec_crash_image);	104	return sprintf(buf, "%d\n", kexec_crash_loaded());
105	}	105	}
106	KERNEL_ATTR_RO(kexec_crash_loaded);	106	KERNEL_ATTR_RO(kexec_crash_loaded);
107		107
@@ -128,8 +128,8 @@ KERNEL_ATTR_RW(kexec_crash_size); · 20 unmodified lines
128	static ssize_t vmcoreinfo_show(struct kobject *kobj,	128	static ssize_t vmcoreinfo_show(struct kobject *kobj,
129	struct kobj_attribute attr, char buf)	129	struct kobj_attribute attr, char buf)
130	{	130	{
131	return sprintf(buf, "%lx %x\n",	131	phys_addr_t vmcore_base = paddr_vmcoreinfo_note();
132	paddr_vmcoreinfo_note(),	132	return sprintf(buf, "%pa %x\n", &vmcore_base,
133	(unsigned int)sizeof(vmcoreinfo_note));	133	(unsigned int)sizeof(vmcoreinfo_note));
134	}	134	}
135	KERNEL_ATTR_RO(vmcoreinfo);	135	KERNEL_ATTR_RO(vmcoreinfo);

kernel/livepatch/core.c+1−1

@@ -309,7 +309,7 @@ static int klp_write_object_relocations(struct module *pmod, · 308 unmodified lines
309	break;	309	break;
310	}	310	}
311		311
312	module_enable_ro(pmod);	312	module_enable_ro(pmod, true);
313	return ret;	313	return ret;
314	}	314	}
315		315

kernel/module.c+101−21

 #include <linux/jump_label.h>
 #include <linux/pfn.h>
 #include <linux/bsearch.h>
+#include <linux/dynamic_debug.h>
 #include <uapi/linux/module.h>
 #include "module-internal.h"
 	if (unlikely(!debug_locks))
 		return;
-	WARN_ON(!rcu_read_lock_sched_held() &&
+	WARN_ON_ONCE(!rcu_read_lock_sched_held() &&
 		!lockdep_is_held(&module_mutex));
 #endif
 }
  * A thread that wants to hold a reference to a module only while it
  * is running can call this to safely exit.  nfsd and lockd use this.
  */
-void __module_put_and_exit(struct module *mod, long code)
+void __noreturn __module_put_and_exit(struct module *mod, long code)
 {
 	module_put(mod);
 	do_exit(code);
 	temp_attr = mod->modinfo_attrs;
 	for (i = 0; (attr = modinfo_attrs[i]) && !error; i++) {
-		if (!attr->test ||
+		if (!attr->test || attr->test(mod)) {
-		    (attr->test && attr->test(mod))) {
 			memcpy(temp_attr, attr, sizeof(*temp_attr));
 			sysfs_attr_init(&temp_attr->attr);
 			error = sysfs_create_file(&mod->mkobj.kobj,
  * from modification and any data from execution.
  *
  * General layout of module is:
- *          [text] [read-only-data] [writable data]
+ *          [text] [read-only-data] [ro-after-init] [writable data]
- * text_size -----^                ^               ^
+ * text_size -----^                ^               ^               ^
- * ro_size ------------------------|               |
+ * ro_size ------------------------|               |               |
- * size -------------------------------------------|
+ * ro_after_init_size -----------------------------|               |
+ * size -----------------------------------------------------------|
  *
  * These values are always page-aligned (as is base)
  */
 		   (layout->ro_size - layout->text_size) >> PAGE_SHIFT);
 }
+static void frob_ro_after_init(const struct module_layout *layout,
+				int (*set_memory)(unsigned long start, int num_pages))
+{
+	BUG_ON((unsigned long)layout->base & (PAGE_SIZE-1));
+	BUG_ON((unsigned long)layout->ro_size & (PAGE_SIZE-1));
+	BUG_ON((unsigned long)layout->ro_after_init_size & (PAGE_SIZE-1));
+	set_memory((unsigned long)layout->base + layout->ro_size,
+		   (layout->ro_after_init_size - layout->ro_size) >> PAGE_SHIFT);
+}
 static void frob_writable_data(const struct module_layout *layout,
 			       int (*set_memory)(unsigned long start, int num_pages))
 {
 	BUG_ON((unsigned long)layout->base & (PAGE_SIZE-1));
-	BUG_ON((unsigned long)layout->ro_size & (PAGE_SIZE-1));
+	BUG_ON((unsigned long)layout->ro_after_init_size & (PAGE_SIZE-1));
 	BUG_ON((unsigned long)layout->size & (PAGE_SIZE-1));
-	set_memory((unsigned long)layout->base + layout->ro_size,
+	set_memory((unsigned long)layout->base + layout->ro_after_init_size,
-		   (layout->size - layout->ro_size) >> PAGE_SHIFT);
+		   (layout->size - layout->ro_after_init_size) >> PAGE_SHIFT);
 }
 /* livepatching wants to disable read-only so it can frob module. */
 {
 	frob_text(&mod->core_layout, set_memory_rw);
 	frob_rodata(&mod->core_layout, set_memory_rw);
+	frob_ro_after_init(&mod->core_layout, set_memory_rw);
 	frob_text(&mod->init_layout, set_memory_rw);
 	frob_rodata(&mod->init_layout, set_memory_rw);
 }
-void module_enable_ro(const struct module *mod)
+void module_enable_ro(const struct module *mod, bool after_init)
 {
 	frob_text(&mod->core_layout, set_memory_ro);
 	frob_rodata(&mod->core_layout, set_memory_ro);
 	frob_text(&mod->init_layout, set_memory_ro);
 	frob_rodata(&mod->init_layout, set_memory_ro);
+	if (after_init)
+		frob_ro_after_init(&mod->core_layout, set_memory_ro);
 }
 static void module_enable_nx(const struct module *mod)
 {
 	frob_rodata(&mod->core_layout, set_memory_nx);
+	frob_ro_after_init(&mod->core_layout, set_memory_nx);
 	frob_writable_data(&mod->core_layout, set_memory_nx);
 	frob_rodata(&mod->init_layout, set_memory_nx);
 	frob_writable_data(&mod->init_layout, set_memory_nx);
 static void module_disable_nx(const struct module *mod)
 {
 	frob_rodata(&mod->core_layout, set_memory_x);
+	frob_ro_after_init(&mod->core_layout, set_memory_x);
 	frob_writable_data(&mod->core_layout, set_memory_x);
 	frob_rodata(&mod->init_layout, set_memory_x);
 	frob_writable_data(&mod->init_layout, set_memory_x);
 	frob_text(layout, set_memory_rw);
 	frob_rodata(layout, set_memory_rw);
 	frob_rodata(layout, set_memory_x);
+	frob_ro_after_init(layout, set_memory_rw);
+	frob_ro_after_init(layout, set_memory_x);
 	frob_writable_data(layout, set_memory_x);
 }
 		 * finder in the two loops below */
 		{ SHF_EXECINSTR | SHF_ALLOC, ARCH_SHF_SMALL },
 		{ SHF_ALLOC, SHF_WRITE | ARCH_SHF_SMALL },
+		{ SHF_RO_AFTER_INIT | SHF_ALLOC, ARCH_SHF_SMALL },
 		{ SHF_WRITE | SHF_ALLOC, ARCH_SHF_SMALL },
 		{ ARCH_SHF_SMALL | SHF_ALLOC, 0 }
 	};
 			mod->core_layout.size = debug_align(mod->core_layout.size);
 			mod->core_layout.ro_size = mod->core_layout.size;
 			break;
-		case 3: /* whole core */
+		case 2: /* RO after init */
+			mod->core_layout.size = debug_align(mod->core_layout.size);
+			mod->core_layout.ro_after_init_size = mod->core_layout.size;
+			break;
+		case 4: /* whole core */
 			mod->core_layout.size = debug_align(mod->core_layout.size);
 			break;
 		}
 			mod->init_layout.size = debug_align(mod->init_layout.size);
 			mod->init_layout.ro_size = mod->init_layout.size;
 			break;
-		case 3: /* whole init */
+		case 2:
+			/*
+			 * RO after init doesn't apply to init_layout (only
+			 * core_layout), so it just takes the value of ro_size.
+			 */
+			mod->init_layout.ro_after_init_size = mod->init_layout.ro_size;
+			break;
+		case 4: /* whole init */
 			mod->init_layout.size = debug_align(mod->init_layout.size);
 			break;
 		}
 #endif
 #ifdef CONFIG_MODULE_SIG
-static int module_sig_check(struct load_info *info)
+static int module_sig_check(struct load_info *info, int flags)
 {
 	int err = -ENOKEY;
 	const unsigned long markerlen = sizeof(MODULE_SIG_STRING) - 1;
 	const void *mod = info->hdr;
-	if (info->len > markerlen &&
+	/*
+	 * Require flags == 0, as a module with version information
+	 * removed is no longer the module that was signed
+	 */
+	if (flags == 0 &&
+	    info->len > markerlen &&
 	    memcmp(mod + info->len - markerlen, MODULE_SIG_STRING, markerlen) == 0) {
 		/* We truncate the module to discard the signature */
 		info->len -= markerlen;
 	return err;
 }
 #else /* !CONFIG_MODULE_SIG */
-static int module_sig_check(struct load_info *info)
+static int module_sig_check(struct load_info *info, int flags)
 {
 	return 0;
 }
 		return -ENOEXEC;
 	}
-	if (!get_modinfo(info, "intree"))
+	if (!get_modinfo(info, "intree")) {
+		if (!test_taint(TAINT_OOT_MODULE))
+			pr_warn("%s: loading out-of-tree module taints kernel.\n",
+				mod->name);
 		add_taint_module(mod, TAINT_OOT_MODULE, LOCKDEP_STILL_OK);
+	}
 	if (get_modinfo(info, "staging")) {
 		add_taint_module(mod, TAINT_CRAP, LOCKDEP_STILL_OK);
 static int check_module_license_and_versions(struct module *mod)
 {
+	int prev_taint = test_taint(TAINT_PROPRIETARY_MODULE);
 	/*
 	 * ndiswrapper is under GPL by itself, but loads proprietary modules.
 	 * Don't use add_taint_module(), as it would prevent ndiswrapper from
 		add_taint_module(mod, TAINT_PROPRIETARY_MODULE,
 				 LOCKDEP_NOW_UNRELIABLE);
+	if (!prev_taint && test_taint(TAINT_PROPRIETARY_MODULE))
+		pr_warn("%s: module license taints kernel.\n", mod->name);
 #ifdef CONFIG_MODVERSIONS
 	if ((mod->num_syms && !mod->crcs)
 	    || (mod->num_gpl_syms && !mod->gpl_crcs)
 	return 0;
 }
+/* module_blacklist is a comma-separated list of module names */
+static char *module_blacklist;
+static bool blacklisted(char *module_name)
+{
+	const char *p;
+	size_t len;
+	if (!module_blacklist)
+		return false;
+	for (p = module_blacklist; *p; p += len) {
+		len = strcspn(p, ",");
+		if (strlen(module_name) == len && !memcmp(module_name, p, len))
+			return true;
+		if (p[len] == ',')
+			len++;
+	}
+	return false;
+}
+core_param(module_blacklist, module_blacklist, charp, 0400);
 static struct module *layout_and_allocate(struct load_info *info, int flags)
 {
 	/* Module within temporary copy. */
 	struct module *mod;
+	unsigned int ndx;
 	int err;
 	mod = setup_load_info(info, flags);
 	if (IS_ERR(mod))
 		return mod;
+	if (blacklisted(mod->name))
+		return ERR_PTR(-EPERM);
 	err = check_modinfo(mod, info, flags);
 	if (err)
 		return ERR_PTR(err);
 	/* We will do a special allocation for per-cpu sections later. */
 	info->sechdrs[info->index.pcpu].sh_flags &= ~(unsigned long)SHF_ALLOC;
+	/*
+	 * Mark ro_after_init section with SHF_RO_AFTER_INIT so that
+	 * layout_sections() can put it in the right place.
+	 * Note: ro_after_init sections also have SHF_{WRITE,ALLOC} set.
+	 */
+	ndx = find_sec(info, ".data..ro_after_init");
+	if (ndx)
+		info->sechdrs[ndx].sh_flags |= SHF_RO_AFTER_INIT;
 	/* Determine total sizes, and put offsets in sh_entsize.  For now
 	   this is done generically; there doesn't appear to be any
 	   special cases for the architectures. */
 	/* Switch to core kallsyms now init is done: kallsyms may be walking! */
 	rcu_assign_pointer(mod->kallsyms, &mod->core_kallsyms);
 #endif
+	module_enable_ro(mod, true);
 	mod_tree_remove_init(mod);
 	disable_ro_nx(&mod->init_layout);
 	module_arch_freeing_init(mod);
 	mod->init_layout.base = NULL;
 	mod->init_layout.size = 0;
 	mod->init_layout.ro_size = 0;
+	mod->init_layout.ro_after_init_size = 0;
 	mod->init_layout.text_size = 0;
 	/*
 	 * We want to free module_init, but be aware that kallsyms may be
 	/* This relies on module_mutex for list integrity. */
 	module_bug_finalize(info->hdr, info->sechdrs, mod);
-	/* Set RO and NX regions */
+	module_enable_ro(mod, false);
-	module_enable_ro(mod);
 	module_enable_nx(mod);
 	/* Mark state as coming so strong_try_module_get() ignores us,
 	long err;
 	char *after_dashes;
-	err = module_sig_check(info);
+	err = module_sig_check(info, flags);
 	if (err)
 		goto free_copy;

kernel/panic.c+4−9

@@ -108,6 +108,7 @@ void panic(const char *fmt, ...) · 107 unmodified lines
108	long i, i_next = 0;	108	long i, i_next = 0;
109	int state = 0;	109	int state = 0;
110	int old_cpu, this_cpu;	110	int old_cpu, this_cpu;
		111	bool _crash_kexec_post_notifiers = crash_kexec_post_notifiers;
111		112
112	/*	113	/*
113	* Disable local interrupts. This will prevent panic_smp_self_stop	114	* Disable local interrupts. This will prevent panic_smp_self_stop
@@ -160,7 +161,7 @@ void panic(const char *fmt, ...) · 46 unmodified lines
160	*	161	*
161	* Bypass the panic_cpu check and call __crash_kexec directly.	162	* Bypass the panic_cpu check and call __crash_kexec directly.
162	*/	163	*/
163	if (!crash_kexec_post_notifiers) {	164	if (!_crash_kexec_post_notifiers) {
164	printk_nmi_flush_on_panic();	165	printk_nmi_flush_on_panic();
165	__crash_kexec(NULL);	166	__crash_kexec(NULL);
166	}	167	}
@@ -191,7 +192,7 @@ void panic(const char *fmt, ...) · 24 unmodified lines
191	*	192	*
192	* Bypass the panic_cpu check and call __crash_kexec directly.	193	* Bypass the panic_cpu check and call __crash_kexec directly.
193	*/	194	*/
194	if (crash_kexec_post_notifiers)	195	if (_crash_kexec_post_notifiers)
195	__crash_kexec(NULL);	196	__crash_kexec(NULL);
196		197
197	bust_spinlocks(0);	198	bust_spinlocks(0);
@@ -571,13 +572,7 @@ EXPORT_SYMBOL(__stack_chk_fail); · 373 unmodified lines
571	core_param(panic, panic_timeout, int, 0644);	572	core_param(panic, panic_timeout, int, 0644);
572	core_param(pause_on_oops, pause_on_oops, int, 0644);	573	core_param(pause_on_oops, pause_on_oops, int, 0644);
573	core_param(panic_on_warn, panic_on_warn, int, 0644);	574	core_param(panic_on_warn, panic_on_warn, int, 0644);
574		575	core_param(crash_kexec_post_notifiers, crash_kexec_post_notifiers, bool, 0644);
575	static int __init setup_crash_kexec_post_notifiers(char *s)
576	{
577	crash_kexec_post_notifiers = true;
578	return 0;
579	}
580	early_param("crash_kexec_post_notifiers", setup_crash_kexec_post_notifiers);
581		576
582	static int __init oops_setup(char *s)	577	static int __init oops_setup(char *s)
583	{	578	{

kernel/printk/printk.c+154−16

@@ -26,7 +26,6 @@ · 25 unmodified lines
26	#include <linux/nmi.h>	26	#include <linux/nmi.h>
27	#include <linux/module.h>	27	#include <linux/module.h>
28	#include <linux/moduleparam.h>	28	#include <linux/moduleparam.h>
29	#include <linux/interrupt.h> /* For in_interrupt() */
30	#include <linux/delay.h>	29	#include <linux/delay.h>
31	#include <linux/smp.h>	30	#include <linux/smp.h>
32	#include <linux/security.h>	31	#include <linux/security.h>
@@ -48,7 +47,7 @@ · 15 unmodified lines
48	#include <linux/uio.h>	47	#include <linux/uio.h>
49		48
50	#include <asm/uaccess.h>	49	#include <asm/uaccess.h>
51	#include <asm-generic/sections.h>	50	#include <asm/sections.h>
52		51
53	#define CREATE_TRACE_POINTS	52	#define CREATE_TRACE_POINTS
54	#include <trace/events/printk.h>	53	#include <trace/events/printk.h>
@@ -86,6 +85,111 @@ static struct lockdep_map console_lock_dep_map = { · 31 unmodified lines
86	};	85	};
87	#endif	86	#endif
88		87
		88	enum devkmsg_log_bits {
		89	__DEVKMSG_LOG_BIT_ON = 0,
		90	__DEVKMSG_LOG_BIT_OFF,
		91	__DEVKMSG_LOG_BIT_LOCK,
		92	};
		93
		94	enum devkmsg_log_masks {
		95	DEVKMSG_LOG_MASK_ON = BIT(__DEVKMSG_LOG_BIT_ON),
		96	DEVKMSG_LOG_MASK_OFF = BIT(__DEVKMSG_LOG_BIT_OFF),
		97	DEVKMSG_LOG_MASK_LOCK = BIT(__DEVKMSG_LOG_BIT_LOCK),
		98	};
		99
		100	/* Keep both the 'on' and 'off' bits clear, i.e. ratelimit by default: */
		101	#define DEVKMSG_LOG_MASK_DEFAULT 0
		102
		103	static unsigned int __read_mostly devkmsg_log = DEVKMSG_LOG_MASK_DEFAULT;
		104
		105	static int __control_devkmsg(char *str)
		106	{
		107	if (!str)
		108	return -EINVAL;
		109
		110	if (!strncmp(str, "on", 2)) {
		111	devkmsg_log = DEVKMSG_LOG_MASK_ON;
		112	return 2;
		113	} else if (!strncmp(str, "off", 3)) {
		114	devkmsg_log = DEVKMSG_LOG_MASK_OFF;
		115	return 3;
		116	} else if (!strncmp(str, "ratelimit", 9)) {
		117	devkmsg_log = DEVKMSG_LOG_MASK_DEFAULT;
		118	return 9;
		119	}
		120	return -EINVAL;
		121	}
		122
		123	static int __init control_devkmsg(char *str)
		124	{
		125	if (__control_devkmsg(str) < 0)
		126	return 1;
		127
		128	/*
		129	* Set sysctl string accordingly:
		130	*/
		131	if (devkmsg_log == DEVKMSG_LOG_MASK_ON) {
		132	memset(devkmsg_log_str, 0, DEVKMSG_STR_MAX_SIZE);
		133	strncpy(devkmsg_log_str, "on", 2);
		134	} else if (devkmsg_log == DEVKMSG_LOG_MASK_OFF) {
		135	memset(devkmsg_log_str, 0, DEVKMSG_STR_MAX_SIZE);
		136	strncpy(devkmsg_log_str, "off", 3);
		137	}
		138	/* else "ratelimit" which is set by default. */
		139
		140	/*
		141	* Sysctl cannot change it anymore. The kernel command line setting of
		142	* this parameter is to force the setting to be permanent throughout the
		143	* runtime of the system. This is a precation measure against userspace
		144	* trying to be a smarta** and attempting to change it up on us.
		145	*/
		146	devkmsg_log \|= DEVKMSG_LOG_MASK_LOCK;
		147
		148	return 0;
		149	}
		150	__setup("printk.devkmsg=", control_devkmsg);
		151
		152	char devkmsg_log_str[DEVKMSG_STR_MAX_SIZE] = "ratelimit";
		153
		154	int devkmsg_sysctl_set_loglvl(struct ctl_table *table, int write,
		155	void __user buffer, size_t lenp, loff_t *ppos)
		156	{
		157	char old_str[DEVKMSG_STR_MAX_SIZE];
		158	unsigned int old;
		159	int err;
		160
		161	if (write) {
		162	if (devkmsg_log & DEVKMSG_LOG_MASK_LOCK)
		163	return -EINVAL;
		164
		165	old = devkmsg_log;
		166	strncpy(old_str, devkmsg_log_str, DEVKMSG_STR_MAX_SIZE);
		167	}
		168
		169	err = proc_dostring(table, write, buffer, lenp, ppos);
		170	if (err)
		171	return err;
		172
		173	if (write) {
		174	err = __control_devkmsg(devkmsg_log_str);
		175
		176	/*
		177	* Do not accept an unknown string OR a known string with
		178	* trailing crap...
		179	*/
		180	if (err < 0 \|\| (err + 1 != *lenp)) {
		181
		182	/* ... and restore old setting. */
		183	devkmsg_log = old;
		184	strncpy(devkmsg_log_str, old_str, DEVKMSG_STR_MAX_SIZE);
		185
		186	return -EINVAL;
		187	}
		188	}
		189
		190	return 0;
		191	}
		192
89	/*	193	/*
90	* Number of registered extended console drivers.	194	* Number of registered extended console drivers.
91	*	195	*
@@ -614,6 +718,7 @@ struct devkmsg_user { · 522 unmodified lines
614	u64 seq;	718	u64 seq;
615	u32 idx;	719	u32 idx;
616	enum log_flags prev;	720	enum log_flags prev;
		721	struct ratelimit_state rs;
617	struct mutex lock;	722	struct mutex lock;
618	char buf[CONSOLE_EXT_LOG_MAX];	723	char buf[CONSOLE_EXT_LOG_MAX];
619	};	724	};
@@ -623,11 +728,24 @@ static ssize_t devkmsg_write(struct kiocb iocb, struct iov_iter from) · 3 unmodified lines
623	char buf, line;	728	char buf, line;
624	int level = default_message_loglevel;	729	int level = default_message_loglevel;
625	int facility = 1; /* LOG_USER */	730	int facility = 1; /* LOG_USER */
		731	struct file *file = iocb->ki_filp;
		732	struct devkmsg_user *user = file->private_data;
626	size_t len = iov_iter_count(from);	733	size_t len = iov_iter_count(from);
627	ssize_t ret = len;	734	ssize_t ret = len;
628		735
629	if (len > LOG_LINE_MAX)	736	if (!user \|\| len > LOG_LINE_MAX)
630	return -EINVAL;	737	return -EINVAL;
		738
		739	/* Ignore when user logging is disabled. */
		740	if (devkmsg_log & DEVKMSG_LOG_MASK_OFF)
		741	return len;
		742
		743	/* Ratelimit when not explicitly enabled. */
		744	if (!(devkmsg_log & DEVKMSG_LOG_MASK_ON)) {
		745	if (!___ratelimit(&user->rs, current->comm))
		746	return ret;
		747	}
		748
631	buf = kmalloc(len+1, GFP_KERNEL);	749	buf = kmalloc(len+1, GFP_KERNEL);
632	if (buf == NULL)	750	if (buf == NULL)
633	return -ENOMEM;	751	return -ENOMEM;
@@ -800,19 +918,24 @@ static int devkmsg_open(struct inode inode, struct file file) · 166 unmodified lines
800	struct devkmsg_user *user;	918	struct devkmsg_user *user;
801	int err;	919	int err;
802		920
803	/* write-only does not need any file context */	921	if (devkmsg_log & DEVKMSG_LOG_MASK_OFF)
804	if ((file->f_flags & O_ACCMODE) == O_WRONLY)	922	return -EPERM;
805	return 0;
806		923
807	err = check_syslog_permissions(SYSLOG_ACTION_READ_ALL,	924	/* write-only does not need any file context */
808	SYSLOG_FROM_READER);	925	if ((file->f_flags & O_ACCMODE) != O_WRONLY) {
809	if (err)	926	err = check_syslog_permissions(SYSLOG_ACTION_READ_ALL,
810	return err;	927	SYSLOG_FROM_READER);
		928	if (err)
		929	return err;
		930	}
811		931
812	user = kmalloc(sizeof(struct devkmsg_user), GFP_KERNEL);	932	user = kmalloc(sizeof(struct devkmsg_user), GFP_KERNEL);
813	if (!user)	933	if (!user)
814	return -ENOMEM;	934	return -ENOMEM;
815		935
		936	ratelimit_default_init(&user->rs);
		937	ratelimit_set_flags(&user->rs, RATELIMIT_MSG_ON_RELEASE);
		938
816	mutex_init(&user->lock);	939	mutex_init(&user->lock);
817		940
818	raw_spin_lock_irq(&logbuf_lock);	941	raw_spin_lock_irq(&logbuf_lock);
@@ -831,6 +954,8 @@ static int devkmsg_release(struct inode inode, struct file file) · 12 unmodified lines
831	if (!user)	954	if (!user)
832	return 0;	955	return 0;
833		956
		957	ratelimit_state_exit(&user->rs);
		958
834	mutex_destroy(&user->lock);	959	mutex_destroy(&user->lock);
835	kfree(user);	960	kfree(user);
836	return 0;	961	return 0;
@@ -986,6 +1111,11 @@ module_param(ignore_loglevel, bool, S_IRUGO \| S_IWUSR); · 149 unmodified lines
986	MODULE_PARM_DESC(ignore_loglevel,	1111	MODULE_PARM_DESC(ignore_loglevel,
987	"ignore loglevel setting (prints all kernel messages to the console)");	1112	"ignore loglevel setting (prints all kernel messages to the console)");
988		1113
		1114	static bool suppress_message_printing(int level)
		1115	{
		1116	return (level >= console_loglevel && !ignore_loglevel);
		1117	}
		1118
989	#ifdef CONFIG_BOOT_PRINTK_DELAY	1119	#ifdef CONFIG_BOOT_PRINTK_DELAY
990		1120
991	static int boot_delay; /* msecs delay after each printk during bootup */	1121	static int boot_delay; /* msecs delay after each printk during bootup */
@@ -1015,7 +1145,7 @@ static void boot_delay_msec(int level) · 23 unmodified lines
1015	unsigned long timeout;	1145	unsigned long timeout;
1016		1146
1017	if ((boot_delay == 0 \|\| system_state != SYSTEM_BOOTING)	1147	if ((boot_delay == 0 \|\| system_state != SYSTEM_BOOTING)
1018	\|\| (level >= console_loglevel && !ignore_loglevel)) {	1148	\|\| suppress_message_printing(level)) {
1019	return;	1149	return;
1020	}	1150	}
1021		1151
@@ -1439,8 +1569,6 @@ static void call_console_drivers(int level, · 417 unmodified lines
1439		1569
1440	trace_console(text, len);	1570	trace_console(text, len);
1441		1571
1442	if (level >= console_loglevel && !ignore_loglevel)
1443	return;
1444	if (!console_drivers)	1572	if (!console_drivers)
1445	return;	1573	return;
1446		1574
@@ -1888,6 +2016,7 @@ static void call_console_drivers(int level, · 441 unmodified lines
1888	static size_t msg_print_text(const struct printk_log *msg, enum log_flags prev,	2016	static size_t msg_print_text(const struct printk_log *msg, enum log_flags prev,
1889	bool syslog, char *buf, size_t size) { return 0; }	2017	bool syslog, char *buf, size_t size) { return 0; }
1890	static size_t cont_print_text(char *text, size_t size) { return 0; }	2018	static size_t cont_print_text(char *text, size_t size) { return 0; }
		2019	static bool suppress_message_printing(int level) { return false; }
1891		2020
1892	/* Still needs to be defined for users */	2021	/* Still needs to be defined for users */
1893	DEFINE_PER_CPU(printk_func_t, printk_func);	2022	DEFINE_PER_CPU(printk_func_t, printk_func);
@@ -2167,6 +2296,13 @@ static void console_cont_flush(char *text, size_t size) · 273 unmodified lines
2167	if (!cont.len)	2296	if (!cont.len)
2168	goto out;	2297	goto out;
2169		2298
		2299	if (suppress_message_printing(cont.level)) {
		2300	cont.cons = cont.len;
		2301	if (cont.flushed)
		2302	cont.len = 0;
		2303	goto out;
		2304	}
		2305
2170	/*	2306	/*
2171	* We still queue earlier records, likely because the console was	2307	* We still queue earlier records, likely because the console was
2172	* busy. The earlier ones need to be printed before this one, we	2308	* busy. The earlier ones need to be printed before this one, we
@@ -2270,10 +2406,13 @@ skip: · 97 unmodified lines
2270	break;	2406	break;
2271		2407
2272	msg = log_from_idx(console_idx);	2408	msg = log_from_idx(console_idx);
2273	if (msg->flags & LOG_NOCONS) {	2409	level = msg->level;
		2410	if ((msg->flags & LOG_NOCONS) \|\|
		2411	suppress_message_printing(level)) {
2274	/*	2412	/*
2275	* Skip record we have buffered and already printed	2413	* Skip record we have buffered and already printed
2276	* directly to the console when we received it.	2414	* directly to the console when we received it, and
		2415	* record that has level above the console loglevel.
2277	*/	2416	*/
2278	console_idx = log_next(console_idx);	2417	console_idx = log_next(console_idx);
2279	console_seq++;	2418	console_seq++;
@@ -2287,7 +2426,6 @@ skip: · 7 unmodified lines
2287	goto skip;	2426	goto skip;
2288	}	2427	}
2289		2428
2290	level = msg->level;
2291	len += msg_print_text(msg, console_prev, false,	2429	len += msg_print_text(msg, console_prev, false,
2292	text + len, sizeof(text) - len);	2430	text + len, sizeof(text) - len);
2293	if (nr_ext_console_drivers) {	2431	if (nr_ext_console_drivers) {

kernel/ptrace.c+2−2

@@ -585,8 +585,8 @@ static int ptrace_setoptions(struct task_struct *child, unsigned long data) · 584 unmodified lines
585	return -EINVAL;	585	return -EINVAL;
586		586
587	if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) {	587	if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) {
588	if (!config_enabled(CONFIG_CHECKPOINT_RESTORE) \|\|	588	if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) \|\|
589	!config_enabled(CONFIG_SECCOMP))	589	!IS_ENABLED(CONFIG_SECCOMP))
590	return -EINVAL;	590	return -EINVAL;
591		591
592	if (!capable(CAP_SYS_ADMIN))	592	if (!capable(CAP_SYS_ADMIN))

kernel/relay.c+32−2

 		if (!dentry)
 			goto free_buf;
 		relay_set_buf_dentry(buf, dentry);
+	} else {
+		/* Only retrieve global info, nothing more, nothing less */
+		dentry = chan->cb->create_buf_file(NULL, NULL,
+						   S_IRUSR, buf,
+						   &chan->is_global);
+		if (WARN_ON(dentry))
+			goto free_buf;
 	}
  	buf->cpu = cpu;
  *	attributes specified.  The created channel buffer files
  *	will be named base_filename0...base_filenameN-1.  File
  *	permissions will be %S_IRUSR.
+ *
+ *	If opening a buffer (@parent = NULL) that you later wish to register
+ *	in a filesystem, call relay_late_setup_files() once the @parent dentry
+ *	is available.
  */
 struct rchan *relay_open(const char *base_filename,
 			 struct dentry *parent,
  *
  *	Returns 0 if successful, non-zero otherwise.
  *
- *	Use to setup files for a previously buffer-only channel.
+ *	Use to setup files for a previously buffer-only channel created
- *	Useful to do early tracing in kernel, before VFS is up, for example.
+ *	by relay_open() with a NULL parent dentry.
+ *
+ *	For example, this is useful for perfomring early tracing in kernel,
+ *	before VFS is up and then exposing the early results once the dentry
+ *	is available.
  */
 int relay_late_setup_files(struct rchan *chan,
 			   const char *base_filename,
 	}
 	chan->has_base_filename = 1;
 	chan->parent = parent;
+	if (chan->is_global) {
+		err = -EINVAL;
+		if (!WARN_ON_ONCE(!chan->buf[0])) {
+			dentry = relay_create_buf_file(chan, chan->buf[0], 0);
+			if (dentry && !WARN_ON_ONCE(!chan->is_global)) {
+				relay_set_buf_dentry(chan->buf[0], dentry);
+				err = 0;
+			}
+		}
+		mutex_unlock(&relay_channels_mutex);
+		return err;
+	}
 	curr_cpu = get_cpu();
 	/*
 	 * The CPU hotplug notifier ran before us and created buffers with
 	return err;
 }
+EXPORT_SYMBOL_GPL(relay_late_setup_files);
 /**
  *	relay_switch_subbuf - switch to a new sub-buffer

kernel/seccomp.c+3−3

@@ -347,7 +347,7 @@ static struct seccomp_filter seccomp_prepare_filter(struct sock_fprog fprog) · 346 unmodified lines
347	{	347	{
348	struct seccomp_filter *sfilter;	348	struct seccomp_filter *sfilter;
349	int ret;	349	int ret;
350	const bool save_orig = config_enabled(CONFIG_CHECKPOINT_RESTORE);	350	const bool save_orig = IS_ENABLED(CONFIG_CHECKPOINT_RESTORE);
351		351
352	if (fprog->len == 0 \|\| fprog->len > BPF_MAXINSNS)	352	if (fprog->len == 0 \|\| fprog->len > BPF_MAXINSNS)
353	return ERR_PTR(-EINVAL);	353	return ERR_PTR(-EINVAL);
@@ -542,7 +542,7 @@ void secure_computing_strict(int this_syscall) · 188 unmodified lines
542	{	542	{
543	int mode = current->seccomp.mode;	543	int mode = current->seccomp.mode;
544		544
545	if (config_enabled(CONFIG_CHECKPOINT_RESTORE) &&	545	if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
546	unlikely(current->ptrace & PT_SUSPEND_SECCOMP))	546	unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
547	return;	547	return;
548		548
@@ -655,7 +655,7 @@ int __secure_computing(const struct seccomp_data *sd) · 106 unmodified lines
655	int mode = current->seccomp.mode;	655	int mode = current->seccomp.mode;
656	int this_syscall;	656	int this_syscall;
657		657
658	if (config_enabled(CONFIG_CHECKPOINT_RESTORE) &&	658	if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
659	unlikely(current->ptrace & PT_SUSPEND_SECCOMP))	659	unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
660	return 0;	660	return 0;
661		661

kernel/sysctl.c+7−0

@@ -813,6 +813,13 @@ static struct ctl_table kern_table[] = { · 812 unmodified lines
813	.extra1 = &zero,	813	.extra1 = &zero,
814	.extra2 = &ten_thousand,	814	.extra2 = &ten_thousand,
815	},	815	},
		816	{
		817	.procname = "printk_devkmsg",
		818	.data = devkmsg_log_str,
		819	.maxlen = DEVKMSG_STR_MAX_SIZE,
		820	.mode = 0644,
		821	.proc_handler = devkmsg_sysctl_set_loglvl,
		822	},
816	{	823	{
817	.procname = "dmesg_restrict",	824	.procname = "dmesg_restrict",
818	.data = &dmesg_restrict,	825	.data = &dmesg_restrict,

kernel/task_work.c+6−4

 	struct callback_head *head;
 	do {
-		head = ACCESS_ONCE(task->task_works);
+		head = READ_ONCE(task->task_works);
 		if (unlikely(head == &work_exited))
 			return -ESRCH;
 		work->next = head;
 	struct callback_head **pprev = &task->task_works;
 	struct callback_head *work;
 	unsigned long flags;
+	if (likely(!task->task_works))
+		return NULL;
 	/*
 	 * If cmpxchg() fails we continue without updating pprev.
 	 * Either we raced with task_work_add() which added the
 	 * we raced with task_work_run(), *pprev == NULL/exited.
 	 */
 	raw_spin_lock_irqsave(&task->pi_lock, flags);
-	while ((work = ACCESS_ONCE(*pprev))) {
+	while ((work = lockless_dereference(*pprev))) {
-		smp_read_barrier_depends();
 		if (work->func != func)
 			pprev = &work->next;
 		else if (cmpxchg(pprev, work, work->next) == work)
 		 * work_exited unless the list is empty.
 		 */
 		do {
-			work = ACCESS_ONCE(task->task_works);
+			work = READ_ONCE(task->task_works);
 			head = !work && (task->flags & PF_EXITING) ?
 				&work_exited : NULL;
 		} while (cmpxchg(&task->task_works, work, head) != work);

kernel/trace/Makefile+4−0

@@ -1,4 +1,8 @@
1		1
		2	# We are fully aware of the dangers of __builtin_return_address()
		3	FRAME_CFLAGS := $(call cc-disable-warning,frame-address)
		4	KBUILD_CFLAGS += $(FRAME_CFLAGS)
		5
2	# Do not instrument the tracer itself:	6	# Do not instrument the tracer itself:
3		7
4	ifdef CONFIG_FUNCTION_TRACER	8	ifdef CONFIG_FUNCTION_TRACER

kernel/trace/blktrace.c+3−3

@@ -776,7 +776,7 @@ static void blk_add_trace_bio(struct request_queue q, struct bio bio, · 775 unmodified lines
776	return;	776	return;
777		777
778	__blk_add_trace(bt, bio->bi_iter.bi_sector, bio->bi_iter.bi_size,	778	__blk_add_trace(bt, bio->bi_iter.bi_sector, bio->bi_iter.bi_size,
779	bio_op(bio), bio->bi_rw, what, error, 0, NULL);	779	bio_op(bio), bio->bi_opf, what, error, 0, NULL);
780	}	780	}
781		781
782	static void blk_add_trace_bio_bounce(void *ignore,	782	static void blk_add_trace_bio_bounce(void *ignore,
@@ -881,7 +881,7 @@ static void blk_add_trace_split(void *ignore, · 98 unmodified lines
881	__be64 rpdu = cpu_to_be64(pdu);	881	__be64 rpdu = cpu_to_be64(pdu);
882		882
883	__blk_add_trace(bt, bio->bi_iter.bi_sector,	883	__blk_add_trace(bt, bio->bi_iter.bi_sector,
884	bio->bi_iter.bi_size, bio_op(bio), bio->bi_rw,	884	bio->bi_iter.bi_size, bio_op(bio), bio->bi_opf,
885	BLK_TA_SPLIT, bio->bi_error, sizeof(rpdu),	885	BLK_TA_SPLIT, bio->bi_error, sizeof(rpdu),
886	&rpdu);	886	&rpdu);
887	}	887	}
@@ -915,7 +915,7 @@ static void blk_add_trace_bio_remap(void *ignore, · 27 unmodified lines
915	r.sector_from = cpu_to_be64(from);	915	r.sector_from = cpu_to_be64(from);
916		916
917	__blk_add_trace(bt, bio->bi_iter.bi_sector, bio->bi_iter.bi_size,	917	__blk_add_trace(bt, bio->bi_iter.bi_sector, bio->bi_iter.bi_size,
918	bio_op(bio), bio->bi_rw, BLK_TA_REMAP, bio->bi_error,	918	bio_op(bio), bio->bi_opf, BLK_TA_REMAP, bio->bi_error,
919	sizeof(r), &r);	919	sizeof(r), &r);
920	}	920	}
921		921

kernel/trace/trace_events_hist.c+7−7

 		goto out;
 	}
+	if (hist_data->attrs->pause)
+		data->paused = true;
 	if (named_data) {
 		destroy_hist_data(data->private_data);
 		data->private_data = named_data->private_data;
 		data->ops = &event_hist_trigger_named_ops;
 	}
-	if (hist_data->attrs->pause)
-		data->paused = true;
 	if (data->ops->init) {
 		ret = data->ops->init(data->ops, data);
 		if (ret < 0)
 static void hist_unreg_all(struct trace_event_file *file)
 {
-	struct event_trigger_data *test;
+	struct event_trigger_data *test, *n;
-	list_for_each_entry_rcu(test, &file->triggers, list) {
+	list_for_each_entry_safe(test, n, &file->triggers, list) {
 		if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
 			list_del_rcu(&test->list);
 			trace_event_trigger_enable_disable(file, 0);
 static void hist_enable_unreg_all(struct trace_event_file *file)
 {
-	struct event_trigger_data *test;
+	struct event_trigger_data *test, *n;
-	list_for_each_entry_rcu(test, &file->triggers, list) {
+	list_for_each_entry_safe(test, n, &file->triggers, list) {
 		if (test->cmd_ops->trigger_type == ETT_HIST_ENABLE) {
 			list_del_rcu(&test->list);
 			update_cond_flag(file);