--- /dev/null
+From d88c93f090f708c18195553b352b9f205e65418f Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Wed, 23 Jan 2019 11:27:02 +0100
+Subject: debugfs: fix debugfs_rename parameter checking
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit d88c93f090f708c18195553b352b9f205e65418f upstream.
+
+debugfs_rename() needs to check that the dentries passed into it really
+are valid, as sometimes they are not (i.e. if the return value of
+another debugfs call is passed into this one.) So fix this up by
+properly checking if the two parent directories are errors (they are
+allowed to be NULL), and if the dentry to rename is not NULL or an
+error.
+
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/debugfs/inode.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -766,6 +766,13 @@ struct dentry *debugfs_rename(struct den
+ struct dentry *dentry = NULL, *trap;
+ struct name_snapshot old_name;
+
++ if (IS_ERR(old_dir))
++ return old_dir;
++ if (IS_ERR(new_dir))
++ return new_dir;
++ if (IS_ERR_OR_NULL(old_dentry))
++ return old_dentry;
++
+ trap = lock_rename(new_dir, old_dir);
+ /* Source or destination directories don't exist? */
+ if (d_really_is_negative(old_dir) || d_really_is_negative(new_dir))
--- /dev/null
+From 9bcf15f75cac3c6a00d8f8083a635de9c8537799 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sat, 5 Jan 2019 19:36:18 +0100
+Subject: iio: adc: axp288: Fix TS-pin handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 9bcf15f75cac3c6a00d8f8083a635de9c8537799 upstream.
+
+Prior to this commit there were 3 issues with our handling of the TS-pin:
+
+1) There are 2 ways how the firmware can disable monitoring of the TS-pin
+for designs which do not have a temperature-sensor for the battery:
+a) Clearing bit 0 of the AXP20X_ADC_EN1 register
+b) Setting bit 2 of the AXP288_ADC_TS_PIN_CTRL monitoring
+
+Prior to this commit we were unconditionally setting both bits to the
+value used on devices with a TS. This causes the temperature protection to
+kick in on devices without a TS, such as the Jumper ezbook v2, causing
+them to not charge under Linux.
+
+This commit fixes this by using regmap_update_bits when updating these 2
+registers, leaving the 2 mentioned bits alone.
+
+The next 2 problems are related to our handling of the current-source
+for the TS-pin. The current-source used for the battery temp-sensor (TS)
+is shared with the GPADC. For proper fuel-gauge and charger operation the
+TS current-source needs to be permanently on. But to read the GPADC we
+need to temporary switch the TS current-source to ondemand, so that the
+GPADC can use it, otherwise we will always read an all 0 value.
+
+2) Problem 2 is we were writing hardcoded values to the ADC TS pin-ctrl
+register, overwriting various other unrelated bits. Specifically we were
+overwriting the current-source setting for the TS and GPIO0 pins, forcing
+it to 80ųA independent of its original setting. On a Chuwi Vi10 tablet
+this was causing us to get a too high adc value (due to a too high
+current-source) resulting in the following errors being logged:
+
+ACPI Error: AE_ERROR, Returned by Handler for [UserDefinedRegion]
+ACPI Error: Method parse/execution failed \_SB.SXP1._TMP, AE_ERROR
+
+This commit fixes this by using regmap_update_bits to change only the
+relevant bits.
+
+3) After reading the GPADC channel we were unconditionally enabling the
+TS current-source even on devices where the TS-pin is not used and the
+current-source thus was off before axp288_adc_read_raw call.
+
+This commit fixes this by making axp288_adc_set_ts a nop on devices where
+the ADC is not enabled for the TS-pin.
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1610545
+Fixes: 3091141d7803 ("iio: adc: axp288: Fix the GPADC pin ...")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/axp288_adc.c | 76 +++++++++++++++++++++++++++++++++----------
+ 1 file changed, 60 insertions(+), 16 deletions(-)
+
+--- a/drivers/iio/adc/axp288_adc.c
++++ b/drivers/iio/adc/axp288_adc.c
+@@ -27,9 +27,18 @@
+ #include <linux/iio/machine.h>
+ #include <linux/iio/driver.h>
+
+-#define AXP288_ADC_EN_MASK 0xF1
+-#define AXP288_ADC_TS_PIN_GPADC 0xF2
+-#define AXP288_ADC_TS_PIN_ON 0xF3
++/*
++ * This mask enables all ADCs except for the battery temp-sensor (TS), that is
++ * left as-is to avoid breaking charging on devices without a temp-sensor.
++ */
++#define AXP288_ADC_EN_MASK 0xF0
++#define AXP288_ADC_TS_ENABLE 0x01
++
++#define AXP288_ADC_TS_CURRENT_ON_OFF_MASK GENMASK(1, 0)
++#define AXP288_ADC_TS_CURRENT_OFF (0 << 0)
++#define AXP288_ADC_TS_CURRENT_ON_WHEN_CHARGING (1 << 0)
++#define AXP288_ADC_TS_CURRENT_ON_ONDEMAND (2 << 0)
++#define AXP288_ADC_TS_CURRENT_ON (3 << 0)
+
+ enum axp288_adc_id {
+ AXP288_ADC_TS,
+@@ -44,6 +53,7 @@ enum axp288_adc_id {
+ struct axp288_adc_info {
+ int irq;
+ struct regmap *regmap;
++ bool ts_enabled;
+ };
+
+ static const struct iio_chan_spec axp288_adc_channels[] = {
+@@ -123,21 +133,33 @@ static int axp288_adc_read_channel(int *
+ return IIO_VAL_INT;
+ }
+
+-static int axp288_adc_set_ts(struct regmap *regmap, unsigned int mode,
+- unsigned long address)
++/*
++ * The current-source used for the battery temp-sensor (TS) is shared
++ * with the GPADC. For proper fuel-gauge and charger operation the TS
++ * current-source needs to be permanently on. But to read the GPADC we
++ * need to temporary switch the TS current-source to ondemand, so that
++ * the GPADC can use it, otherwise we will always read an all 0 value.
++ */
++static int axp288_adc_set_ts(struct axp288_adc_info *info,
++ unsigned int mode, unsigned long address)
+ {
+ int ret;
+
+- /* channels other than GPADC do not need to switch TS pin */
++ /* No need to switch the current-source if the TS pin is disabled */
++ if (!info->ts_enabled)
++ return 0;
++
++ /* Channels other than GPADC do not need the current source */
+ if (address != AXP288_GP_ADC_H)
+ return 0;
+
+- ret = regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, mode);
++ ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
++ AXP288_ADC_TS_CURRENT_ON_OFF_MASK, mode);
+ if (ret)
+ return ret;
+
+ /* When switching to the GPADC pin give things some time to settle */
+- if (mode == AXP288_ADC_TS_PIN_GPADC)
++ if (mode == AXP288_ADC_TS_CURRENT_ON_ONDEMAND)
+ usleep_range(6000, 10000);
+
+ return 0;
+@@ -153,14 +175,14 @@ static int axp288_adc_read_raw(struct ii
+ mutex_lock(&indio_dev->mlock);
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
+- if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_GPADC,
++ if (axp288_adc_set_ts(info, AXP288_ADC_TS_CURRENT_ON_ONDEMAND,
+ chan->address)) {
+ dev_err(&indio_dev->dev, "GPADC mode\n");
+ ret = -EINVAL;
+ break;
+ }
+ ret = axp288_adc_read_channel(val, chan->address, info->regmap);
+- if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_ON,
++ if (axp288_adc_set_ts(info, AXP288_ADC_TS_CURRENT_ON,
+ chan->address))
+ dev_err(&indio_dev->dev, "TS pin restore\n");
+ break;
+@@ -172,13 +194,35 @@ static int axp288_adc_read_raw(struct ii
+ return ret;
+ }
+
+-static int axp288_adc_set_state(struct regmap *regmap)
++static int axp288_adc_initialize(struct axp288_adc_info *info)
+ {
+- /* ADC should be always enabled for internal FG to function */
+- if (regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON))
+- return -EIO;
++ int ret, adc_enable_val;
++
++ /*
++ * Determine if the TS pin is enabled and set the TS current-source
++ * accordingly.
++ */
++ ret = regmap_read(info->regmap, AXP20X_ADC_EN1, &adc_enable_val);
++ if (ret)
++ return ret;
++
++ if (adc_enable_val & AXP288_ADC_TS_ENABLE) {
++ info->ts_enabled = true;
++ ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
++ AXP288_ADC_TS_CURRENT_ON_OFF_MASK,
++ AXP288_ADC_TS_CURRENT_ON);
++ } else {
++ info->ts_enabled = false;
++ ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
++ AXP288_ADC_TS_CURRENT_ON_OFF_MASK,
++ AXP288_ADC_TS_CURRENT_OFF);
++ }
++ if (ret)
++ return ret;
+
+- return regmap_write(regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
++ /* Turn on the ADC for all channels except TS, leave TS as is */
++ return regmap_update_bits(info->regmap, AXP20X_ADC_EN1,
++ AXP288_ADC_EN_MASK, AXP288_ADC_EN_MASK);
+ }
+
+ static const struct iio_info axp288_adc_iio_info = {
+@@ -209,7 +253,7 @@ static int axp288_adc_probe(struct platf
+ * Set ADC to enabled state at all time, including system suspend.
+ * otherwise internal fuel gauge functionality may be affected.
+ */
+- ret = axp288_adc_set_state(axp20x->regmap);
++ ret = axp288_adc_initialize(info);
+ if (ret) {
+ dev_err(&pdev->dev, "unable to enable ADC device\n");
+ return ret;
--- /dev/null
+From 0808831dc62e90023ad14ff8da4804c7846e904b Mon Sep 17 00:00:00 2001
+From: Matt Ranostay <matt.ranostay@konsulko.com>
+Date: Sun, 30 Dec 2018 19:07:01 -0800
+Subject: iio: chemical: atlas-ph-sensor: correct IIO_TEMP values to millicelsius
+
+From: Matt Ranostay <matt.ranostay@konsulko.com>
+
+commit 0808831dc62e90023ad14ff8da4804c7846e904b upstream.
+
+IIO_TEMP scale value for temperature was incorrect and not in millicelsius
+as required by the ABI documentation.
+
+Signed-off-by: Matt Ranostay <matt.ranostay@konsulko.com>
+Fixes: 27dec00ecf2d (iio: chemical: add Atlas pH-SM sensor support)
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/chemical/atlas-ph-sensor.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/iio/chemical/atlas-ph-sensor.c
++++ b/drivers/iio/chemical/atlas-ph-sensor.c
+@@ -453,9 +453,8 @@ static int atlas_read_raw(struct iio_dev
+ case IIO_CHAN_INFO_SCALE:
+ switch (chan->type) {
+ case IIO_TEMP:
+- *val = 1; /* 0.01 */
+- *val2 = 100;
+- break;
++ *val = 10;
++ return IIO_VAL_INT;
+ case IIO_PH:
+ *val = 1; /* 0.001 */
+ *val2 = 1000;
+@@ -486,7 +485,7 @@ static int atlas_write_raw(struct iio_de
+ int val, int val2, long mask)
+ {
+ struct atlas_data *data = iio_priv(indio_dev);
+- __be32 reg = cpu_to_be32(val);
++ __be32 reg = cpu_to_be32(val / 10);
+
+ if (val2 != 0 || val < 0 || val > 20000)
+ return -EINVAL;
--- /dev/null
+From f8a70d8b889f180e6860cb1f85fed43d37844c5a Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 3 Dec 2018 17:52:19 +0300
+Subject: misc: vexpress: Off by one in vexpress_syscfg_exec()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit f8a70d8b889f180e6860cb1f85fed43d37844c5a upstream.
+
+The > comparison should be >= to prevent reading beyond the end of the
+func->template[] array.
+
+(The func->template array is allocated in vexpress_syscfg_regmap_init()
+and it has func->num_templates elements.)
+
+Fixes: 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/vexpress-syscfg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/misc/vexpress-syscfg.c
++++ b/drivers/misc/vexpress-syscfg.c
+@@ -61,7 +61,7 @@ static int vexpress_syscfg_exec(struct v
+ int tries;
+ long timeout;
+
+- if (WARN_ON(index > func->num_templates))
++ if (WARN_ON(index >= func->num_templates))
+ return -EINVAL;
+
+ command = readl(syscfg->base + SYS_CFGCTRL);
--- /dev/null
+From d5d27fd9826b59979b184ec288e4812abac0e988 Mon Sep 17 00:00:00 2001
+From: Martin Kepplinger <martin.kepplinger@ginzinger.com>
+Date: Tue, 5 Feb 2019 16:52:51 +0100
+Subject: mtd: rawnand: gpmi: fix MX28 bus master lockup problem
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Martin Kepplinger <martin.kepplinger@ginzinger.com>
+
+commit d5d27fd9826b59979b184ec288e4812abac0e988 upstream.
+
+Disable BCH soft reset according to MX23 erratum #2847 ("BCH soft
+reset may cause bus master lock up") for MX28 too. It has the same
+problem.
+
+Observed problem: once per 100,000+ MX28 reboots NAND read failed on
+DMA timeout errors:
+[ 1.770823] UBI: attaching mtd3 to ubi0
+[ 2.768088] gpmi_nand: DMA timeout, last DMA :1
+[ 3.958087] gpmi_nand: BCH timeout, last DMA :1
+[ 4.156033] gpmi_nand: Error in ECC-based read: -110
+[ 4.161136] UBI warning: ubi_io_read: error -110 while reading 64
+bytes from PEB 0:0, read only 0 bytes, retry
+[ 4.171283] step 1 error
+[ 4.173846] gpmi_nand: Chip: 0, Error -1
+
+Without BCH soft reset we successfully executed 1,000,000 MX28 reboots.
+
+I have a quote from NXP regarding this problem, from July 18th 2016:
+
+"As the i.MX23 and i.MX28 are of the same generation, they share many
+characteristics. Unfortunately, also the erratas may be shared.
+In case of the documented erratas and the workarounds, you can also
+apply the workaround solution of one device on the other one. This have
+been reported, but I’m afraid that there are not an estimated date for
+updating the Errata documents.
+Please accept our apologies for any inconveniences this may cause."
+
+Fixes: 6f2a6a52560a ("mtd: nand: gpmi: reset BCH earlier, too, to avoid NAND startup problems")
+Cc: stable@vger.kernel.org
+Signed-off-by: Manfred Schlaegl <manfred.schlaegl@ginzinger.com>
+Signed-off-by: Martin Kepplinger <martin.kepplinger@ginzinger.com>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Acked-by: Han Xu <han.xu@nxp.com>
+Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/gpmi-nand/gpmi-lib.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
++++ b/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
+@@ -168,9 +168,10 @@ int gpmi_init(struct gpmi_nand_data *thi
+
+ /*
+ * Reset BCH here, too. We got failures otherwise :(
+- * See later BCH reset for explanation of MX23 handling
++ * See later BCH reset for explanation of MX23 and MX28 handling
+ */
+- ret = gpmi_reset_block(r->bch_regs, GPMI_IS_MX23(this));
++ ret = gpmi_reset_block(r->bch_regs,
++ GPMI_IS_MX23(this) || GPMI_IS_MX28(this));
+ if (ret)
+ goto err_out;
+
+@@ -275,13 +276,11 @@ int bch_set_geometry(struct gpmi_nand_da
+
+ /*
+ * Due to erratum #2847 of the MX23, the BCH cannot be soft reset on this
+- * chip, otherwise it will lock up. So we skip resetting BCH on the MX23.
+- * On the other hand, the MX28 needs the reset, because one case has been
+- * seen where the BCH produced ECC errors constantly after 10000
+- * consecutive reboots. The latter case has not been seen on the MX23
+- * yet, still we don't know if it could happen there as well.
++ * chip, otherwise it will lock up. So we skip resetting BCH on the MX23
++ * and MX28.
+ */
+- ret = gpmi_reset_block(r->bch_regs, GPMI_IS_MX23(this));
++ ret = gpmi_reset_block(r->bch_regs,
++ GPMI_IS_MX23(this) || GPMI_IS_MX28(this));
+ if (ret)
+ goto err_out;
+
--- /dev/null
+From c4a46acf1db3ce547d290c29e55b3476c78dd76c Mon Sep 17 00:00:00 2001
+From: Tomas Winkler <tomas.winkler@intel.com>
+Date: Thu, 24 Jan 2019 14:45:03 +0200
+Subject: samples: mei: use /dev/mei0 instead of /dev/mei
+
+From: Tomas Winkler <tomas.winkler@intel.com>
+
+commit c4a46acf1db3ce547d290c29e55b3476c78dd76c upstream.
+
+The device was moved from misc device to character devices
+to support multiple mei devices.
+
+Cc: <stable@vger.kernel.org> #v4.9+
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ samples/mei/mei-amt-version.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/samples/mei/mei-amt-version.c
++++ b/samples/mei/mei-amt-version.c
+@@ -117,7 +117,7 @@ static bool mei_init(struct mei *me, con
+
+ me->verbose = verbose;
+
+- me->fd = open("/dev/mei", O_RDWR);
++ me->fd = open("/dev/mei0", O_RDWR);
+ if (me->fd == -1) {
+ mei_err(me, "Cannot establish a handle to the Intel MEI driver\n");
+ goto err;
--- /dev/null
+mtd-rawnand-gpmi-fix-mx28-bus-master-lockup-problem.patch
+iio-adc-axp288-fix-ts-pin-handling.patch
+iio-chemical-atlas-ph-sensor-correct-iio_temp-values-to-millicelsius.patch
+signal-always-notice-exiting-tasks.patch
+signal-better-detection-of-synchronous-signals.patch
+misc-vexpress-off-by-one-in-vexpress_syscfg_exec.patch
+samples-mei-use-dev-mei0-instead-of-dev-mei.patch
+debugfs-fix-debugfs_rename-parameter-checking.patch
--- /dev/null
+From 35634ffa1751b6efd8cf75010b509dcb0263e29b Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Wed, 6 Feb 2019 18:39:40 -0600
+Subject: signal: Always notice exiting tasks
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+commit 35634ffa1751b6efd8cf75010b509dcb0263e29b upstream.
+
+Recently syzkaller was able to create unkillablle processes by
+creating a timer that is delivered as a thread local signal on SIGHUP,
+and receiving SIGHUP SA_NODEFERER. Ultimately causing a loop
+failing to deliver SIGHUP but always trying.
+
+Upon examination it turns out part of the problem is actually most of
+the solution. Since 2.5 signal delivery has found all fatal signals,
+marked the signal group for death, and queued SIGKILL in every threads
+thread queue relying on signal->group_exit_code to preserve the
+information of which was the actual fatal signal.
+
+The conversion of all fatal signals to SIGKILL results in the
+synchronous signal heuristic in next_signal kicking in and preferring
+SIGHUP to SIGKILL. Which is especially problematic as all
+fatal signals have already been transformed into SIGKILL.
+
+Instead of dequeueing signals and depending upon SIGKILL to
+be the first signal dequeued, first test if the signal group
+has already been marked for death. This guarantees that
+nothing in the signal queue can prevent a process that needs
+to exit from exiting.
+
+Cc: stable@vger.kernel.org
+Tested-by: Dmitry Vyukov <dvyukov@google.com>
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Ref: ebf5ebe31d2c ("[PATCH] signal-fixes-2.5.59-A4")
+History Tree: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/signal.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -2225,6 +2225,11 @@ relock:
+ goto relock;
+ }
+
++ /* Has this task already been marked for death? */
++ ksig->info.si_signo = signr = SIGKILL;
++ if (signal_group_exit(signal))
++ goto fatal;
++
+ for (;;) {
+ struct k_sigaction *ka;
+
+@@ -2320,6 +2325,7 @@ relock:
+ continue;
+ }
+
++ fatal:
+ spin_unlock_irq(&sighand->siglock);
+
+ /*
--- /dev/null
+From 7146db3317c67b517258cb5e1b08af387da0618b Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Wed, 6 Feb 2019 17:51:47 -0600
+Subject: signal: Better detection of synchronous signals
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+commit 7146db3317c67b517258cb5e1b08af387da0618b upstream.
+
+Recently syzkaller was able to create unkillablle processes by
+creating a timer that is delivered as a thread local signal on SIGHUP,
+and receiving SIGHUP SA_NODEFERER. Ultimately causing a loop failing
+to deliver SIGHUP but always trying.
+
+When the stack overflows delivery of SIGHUP fails and force_sigsegv is
+called. Unfortunately because SIGSEGV is numerically higher than
+SIGHUP next_signal tries again to deliver a SIGHUP.
+
+From a quality of implementation standpoint attempting to deliver the
+timer SIGHUP signal is wrong. We should attempt to deliver the
+synchronous SIGSEGV signal we just forced.
+
+We can make that happening in a fairly straight forward manner by
+instead of just looking at the signal number we also look at the
+si_code. In particular for exceptions (aka synchronous signals) the
+si_code is always greater than 0.
+
+That still has the potential to pick up a number of asynchronous
+signals as in a few cases the same si_codes that are used
+for synchronous signals are also used for asynchronous signals,
+and SI_KERNEL is also included in the list of possible si_codes.
+
+Still the heuristic is much better and timer signals are definitely
+excluded. Which is enough to prevent all known ways for someone
+sending a process signals fast enough to cause unexpected and
+arguably incorrect behavior.
+
+Cc: stable@vger.kernel.org
+Fixes: a27341cd5fcb ("Prioritize synchronous signals over 'normal' signals")
+Tested-by: Dmitry Vyukov <dvyukov@google.com>
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/signal.c | 52 +++++++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 51 insertions(+), 1 deletion(-)
+
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -672,6 +672,48 @@ void signal_wake_up_state(struct task_st
+ kick_process(t);
+ }
+
++static int dequeue_synchronous_signal(siginfo_t *info)
++{
++ struct task_struct *tsk = current;
++ struct sigpending *pending = &tsk->pending;
++ struct sigqueue *q, *sync = NULL;
++
++ /*
++ * Might a synchronous signal be in the queue?
++ */
++ if (!((pending->signal.sig[0] & ~tsk->blocked.sig[0]) & SYNCHRONOUS_MASK))
++ return 0;
++
++ /*
++ * Return the first synchronous signal in the queue.
++ */
++ list_for_each_entry(q, &pending->list, list) {
++ /* Synchronous signals have a postive si_code */
++ if ((q->info.si_code > SI_USER) &&
++ (sigmask(q->info.si_signo) & SYNCHRONOUS_MASK)) {
++ sync = q;
++ goto next;
++ }
++ }
++ return 0;
++next:
++ /*
++ * Check if there is another siginfo for the same signal.
++ */
++ list_for_each_entry_continue(q, &pending->list, list) {
++ if (q->info.si_signo == sync->info.si_signo)
++ goto still_pending;
++ }
++
++ sigdelset(&pending->signal, sync->info.si_signo);
++ recalc_sigpending();
++still_pending:
++ list_del_init(&sync->list);
++ copy_siginfo(info, &sync->info);
++ __sigqueue_free(sync);
++ return info->si_signo;
++}
++
+ /*
+ * Remove signals in mask from the pending set and queue.
+ * Returns 1 if any signals were found.
+@@ -2243,7 +2285,15 @@ relock:
+ goto relock;
+ }
+
+- signr = dequeue_signal(current, ¤t->blocked, &ksig->info);
++ /*
++ * Signals generated by the execution of an instruction
++ * need to be delivered before any other pending signals
++ * so that the instruction pointer in the signal stack
++ * frame points to the faulting instruction.
++ */
++ signr = dequeue_synchronous_signal(&ksig->info);
++ if (!signr)
++ signr = dequeue_signal(current, ¤t->blocked, &ksig->info);
+
+ if (!signr)
+ break; /* will return 0 */
projects / thirdparty / kernel / stable-queue.git / commitdiff
