* fs: NULL deref in atime_needs_update
@ 2016-02-05 21:11 Dmitry Vyukov
2016-02-16 23:40 ` Mickaël Salaün
0 siblings, 1 reply; 49+ messages in thread
From: Dmitry Vyukov @ 2016-02-05 21:11 UTC (permalink / raw)
To: Alexander Viro, linux-fsdevel, LKML
Cc: syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin
Hello,
I've hit the following GPF while running syzkaller fuzzer:
general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN
Modules linked in:
CPU: 1 PID: 5178 Comm: syz-executor Not tainted 4.5.0-rc2+ #65
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff880064768000 ti: ffff8800622c0000 task.ti: ffff8800622c0000
RIP: 0010:[<ffffffff8181aa5d>] [<ffffffff8181aa5d>]
atime_needs_update+0x2d/0x460
RSP: 0018:ffff8800622c7a30 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: dffffc0000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000c
RBP: ffff8800622c7a58 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff8800622c7c08
R13: ffff8800622c7c08 R14: ffff8800301ca322 R15: ffff8800622c7bb0
FS: 00007fd1c9f8b700(0000) GS:ffff88003ed00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000020f31000 CR3: 0000000062274000 CR4: 00000000000006e0
Stack:
ffff8800622c7bf4 0000000000000000 ffff8800622c7c08 ffff8800301ca322
ffff8800622c7bb0 ffff8800622c7b38 ffffffff817ecd91 ffff880030bf5200
ffff8800622c7bb8 1ffff1000c458f56 ffff8800622c7c00 ffff8800622c7be0
Call Trace:
[< inline >] get_link fs/namei.c:1006
[<ffffffff817ecd91>] link_path_walk+0xaf1/0x1030 fs/namei.c:1968
[<ffffffff817ed311>] path_parentat+0x41/0x150 fs/namei.c:2176
[<ffffffff817f4c5c>] filename_parentat+0x17c/0x3c0 fs/namei.c:2198
[< inline >] user_path_parent fs/namei.c:2412
[< inline >] SYSC_renameat2 fs/namei.c:4411
[< inline >] SyS_renameat2 fs/namei.c:4375
[< inline >] SYSC_renameat fs/namei.c:4521
[<ffffffff817f9a72>] SyS_renameat+0x192/0x820 fs/namei.c:4518
[<ffffffff8669e0b6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
Code: 89 e5 41 57 41 56 41 55 41 54 49 89 fc 53 48 89 f3 e8 08 25 d5
ff 48 8d 7b 0c 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f>
b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85
RIP [<ffffffff8181aa5d>] atime_needs_update+0x2d/0x460 fs/inode.c:1611
RSP <ffff8800622c7a30>
---[ end trace 1a4c9bda4680ce46 ]---
On commit df48ab3c2f5ffca88b7803ffbadd074bd5a0a2ef.
Objdump shows that inode is NULL in atime_needs_update.
Unfortunately reproduction of this crash is very hard. The program
executes something along the lines of:
mmap(0x20000000, 15945728, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mkdir("./bus", 0662515705056234013740) = 0
openat(AT_FDCWD, "./bus", O_RDONLY|O_EXCL) = 3
symlinkat("../bus", 3, "./bus") = 0
renameat(3, "./bus", 3, "./bus/file0") = 0
mmap(0x20f35000, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20f35000
mount("./bus", "./bus", 0x20f2aee4,
MS_RDONLY|MS_NODEV|MS_RELATIME|MS_NODIRATIME|MS_BIND|MS_MOVE|MS_REC|MS_UNBINDABLE|MS_SLAVE|MS_SHARED|0xc000380,
0x20093f5f) = 0
open("./bus/file0", O_RDWR|O_EXCL) = -1 EISDIR (Is a directory)
exit_group(0) = ?
But in multiple threads so that some calls can be doubled and/or
overlapped. And all this happens on a tmpfs mount.
But I was able to reproduce it 8 or so times, so I am sure that it is real.
For future reference, I was running these programs:
https://gist.githubusercontent.com/dvyukov/124c457d308fa724d88a/raw/fec2d86e125a7fd2fa2916791d65d7daead7cbbb/gistfile1.txt
Following these instructions:
https://github.com/google/syzkaller/wiki/How-to-execute-syzkaller-programs
^ permalink raw reply [flat|nested] 49+ messages in thread* Re: fs: NULL deref in atime_needs_update 2016-02-05 21:11 fs: NULL deref in atime_needs_update Dmitry Vyukov @ 2016-02-16 23:40 ` Mickaël Salaün 2016-02-19 19:32 ` Dmitry Vyukov 2016-02-24 3:12 ` Ian Kent 0 siblings, 2 replies; 49+ messages in thread From: Mickaël Salaün @ 2016-02-16 23:40 UTC (permalink / raw) To: Dmitry Vyukov, Alexander Viro, linux-fsdevel, LKML Cc: syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin [-- Attachment #1: Type: text/plain, Size: 6112 bytes --] Hi, Actually I found the same bug (without fuzzing) and I can reproduce it in a deterministic way (e.g. by creating a LSM that return 1 for the security_file_open hook). At least, from v4.2.8 I can easily trigger traces like this : BUG: unable to handle kernel NULL pointer dereference at 0000000000000050 IP: [<ffffffff81170871>] atime_needs_update+0x11/0xc0 PGD 127b17067 PUD 12ab2e067 PMD 0 Oops: 0000 [#45] SMP [...] RIP: 0010:[<ffffffff81170871>] [<ffffffff81170871>] atime_needs_update+0x11/0xc0 RSP: 0018:ffff880127853c18 EFLAGS: 00010246 RAX: ffff88012ad0c080 RBX: ffff88012ad0c1d8 RCX: ffff88012ad0c080 RDX: 0000000000000000 RSI: ffff88012ad0c1d8 RDI: ffff880127853d98 RBP: ffff880127853c28 R08: ffff8800cc0a2540 R09: ffff8800cfbfc320 R10: ffff8800cc0a2540 R11: 0000000000000001 R12: ffff8800cb5d6300 R13: 0000000000000000 R14: ffff88012ad0c080 R15: ffff880127853e7c FS: 00007f1054aae700(0000) GS:ffff88012fc40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000050 CR3: 0000000127977000 CR4: 00000000000406e0 Stack: ffff88012ad0c1d8 ffff8800cb5d6300 ffff880127853c60 ffffffff8117094e ffff8800c9ade3c0 0000000000000000 00000000a670294f ffff880127853d70 ffff880127853d98 ffff880127853c98 ffffffff8116071c ffff8800cb4ada80 Call Trace: [<ffffffff8117094e>] ? touch_atime+0x2e/0xd0 [<ffffffff8116071c>] ? trailing_symlink+0xec/0x280 [<ffffffff81163a78>] ? path_openat+0x468/0x1240 [<ffffffff8111856d>] ? pagevec_lru_move_fn+0xed/0x110 [<ffffffff81117ff0>] ? __activate_page+0x130/0x130 [<ffffffff8116593c>] ? do_filp_open+0x8c/0x100 [<ffffffff81164dec>] ? filename_lookup+0xec/0x180 [<ffffffff8115bc24>] ? do_open_execat+0x74/0x170 [<ffffffff8115d437>] ? do_execveat_common.isra.42+0x1a7/0x6a0 [<ffffffff8115db90>] ? SyS_execve+0x30/0x40 [<ffffffff8156ad65>] ? stub_execve+0x5/0x5 [<ffffffff8156aadb>] ? entry_SYSCALL_64_fastpath+0x16/0x6a Code: 89 c7 e8 63 eb ff ff 48 89 d8 5b c3 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 54 53 f6 46 0c 02 75 72 48 8b 56 28 <48> 8b 42 50 a9 01 04 00 00 75 63 f6 c4 08 75 65 4c 8b 27 41 8b RIP [<ffffffff81170871>] atime_needs_update+0x11/0xc0 RSP <ffff880127853c18> CR2: 0000000000000050 ---[ end trace 97dc4f4bb0214bd8 ]--- Regards, Mickaël On 05/02/2016 22:11, Dmitry Vyukov wrote: > Hello, > > I've hit the following GPF while running syzkaller fuzzer: > > general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN > Modules linked in: > CPU: 1 PID: 5178 Comm: syz-executor Not tainted 4.5.0-rc2+ #65 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > task: ffff880064768000 ti: ffff8800622c0000 task.ti: ffff8800622c0000 > RIP: 0010:[<ffffffff8181aa5d>] [<ffffffff8181aa5d>] > atime_needs_update+0x2d/0x460 > RSP: 0018:ffff8800622c7a30 EFLAGS: 00010203 > RAX: dffffc0000000000 RBX: 0000000000000000 RCX: dffffc0000000000 > RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000c > RBP: ffff8800622c7a58 R08: 0000000000000001 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000001 R12: ffff8800622c7c08 > R13: ffff8800622c7c08 R14: ffff8800301ca322 R15: ffff8800622c7bb0 > FS: 00007fd1c9f8b700(0000) GS:ffff88003ed00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b > CR2: 0000000020f31000 CR3: 0000000062274000 CR4: 00000000000006e0 > Stack: > ffff8800622c7bf4 0000000000000000 ffff8800622c7c08 ffff8800301ca322 > ffff8800622c7bb0 ffff8800622c7b38 ffffffff817ecd91 ffff880030bf5200 > ffff8800622c7bb8 1ffff1000c458f56 ffff8800622c7c00 ffff8800622c7be0 > Call Trace: > [< inline >] get_link fs/namei.c:1006 > [<ffffffff817ecd91>] link_path_walk+0xaf1/0x1030 fs/namei.c:1968 > [<ffffffff817ed311>] path_parentat+0x41/0x150 fs/namei.c:2176 > [<ffffffff817f4c5c>] filename_parentat+0x17c/0x3c0 fs/namei.c:2198 > [< inline >] user_path_parent fs/namei.c:2412 > [< inline >] SYSC_renameat2 fs/namei.c:4411 > [< inline >] SyS_renameat2 fs/namei.c:4375 > [< inline >] SYSC_renameat fs/namei.c:4521 > [<ffffffff817f9a72>] SyS_renameat+0x192/0x820 fs/namei.c:4518 > [<ffffffff8669e0b6>] entry_SYSCALL_64_fastpath+0x16/0x7a > arch/x86/entry/entry_64.S:185 > Code: 89 e5 41 57 41 56 41 55 41 54 49 89 fc 53 48 89 f3 e8 08 25 d5 > ff 48 8d 7b 0c 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> > b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 > RIP [<ffffffff8181aa5d>] atime_needs_update+0x2d/0x460 fs/inode.c:1611 > RSP <ffff8800622c7a30> > ---[ end trace 1a4c9bda4680ce46 ]--- > > On commit df48ab3c2f5ffca88b7803ffbadd074bd5a0a2ef. > > Objdump shows that inode is NULL in atime_needs_update. > > Unfortunately reproduction of this crash is very hard. The program > executes something along the lines of: > > mmap(0x20000000, 15945728, PROT_READ|PROT_WRITE, > MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 > mkdir("./bus", 0662515705056234013740) = 0 > openat(AT_FDCWD, "./bus", O_RDONLY|O_EXCL) = 3 > symlinkat("../bus", 3, "./bus") = 0 > renameat(3, "./bus", 3, "./bus/file0") = 0 > mmap(0x20f35000, 4096, PROT_READ|PROT_WRITE, > MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20f35000 > mount("./bus", "./bus", 0x20f2aee4, > MS_RDONLY|MS_NODEV|MS_RELATIME|MS_NODIRATIME|MS_BIND|MS_MOVE|MS_REC|MS_UNBINDABLE|MS_SLAVE|MS_SHARED|0xc000380, > 0x20093f5f) = 0 > open("./bus/file0", O_RDWR|O_EXCL) = -1 EISDIR (Is a directory) > exit_group(0) = ? > > But in multiple threads so that some calls can be doubled and/or > overlapped. And all this happens on a tmpfs mount. > > But I was able to reproduce it 8 or so times, so I am sure that it is real. > > For future reference, I was running these programs: > https://gist.githubusercontent.com/dvyukov/124c457d308fa724d88a/raw/fec2d86e125a7fd2fa2916791d65d7daead7cbbb/gistfile1.txt > Following these instructions: > https://github.com/google/syzkaller/wiki/How-to-execute-syzkaller-programs > [-- Attachment #2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 455 bytes --] ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-16 23:40 ` Mickaël Salaün @ 2016-02-19 19:32 ` Dmitry Vyukov 2016-02-20 3:21 ` Al Viro 2016-02-24 3:12 ` Ian Kent 1 sibling, 1 reply; 49+ messages in thread From: Dmitry Vyukov @ 2016-02-19 19:32 UTC (permalink / raw) To: Mickaël Salaün Cc: Alexander Viro, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Wed, Feb 17, 2016 at 12:40 AM, Mickaël Salaün <mic@digikod.net> wrote: > Hi, > > Actually I found the same bug (without fuzzing) and I can reproduce it in a deterministic way (e.g. by creating a LSM that return 1 for the security_file_open hook). At least, from v4.2.8 I can easily trigger traces like this : > > BUG: unable to handle kernel NULL pointer dereference at 0000000000000050 > IP: [<ffffffff81170871>] atime_needs_update+0x11/0xc0 > PGD 127b17067 PUD 12ab2e067 PMD 0 > Oops: 0000 [#45] SMP > [...] > RIP: 0010:[<ffffffff81170871>] [<ffffffff81170871>] atime_needs_update+0x11/0xc0 > RSP: 0018:ffff880127853c18 EFLAGS: 00010246 > RAX: ffff88012ad0c080 RBX: ffff88012ad0c1d8 RCX: ffff88012ad0c080 > RDX: 0000000000000000 RSI: ffff88012ad0c1d8 RDI: ffff880127853d98 > RBP: ffff880127853c28 R08: ffff8800cc0a2540 R09: ffff8800cfbfc320 > R10: ffff8800cc0a2540 R11: 0000000000000001 R12: ffff8800cb5d6300 > R13: 0000000000000000 R14: ffff88012ad0c080 R15: ffff880127853e7c > FS: 00007f1054aae700(0000) GS:ffff88012fc40000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000000050 CR3: 0000000127977000 CR4: 00000000000406e0 > Stack: > ffff88012ad0c1d8 ffff8800cb5d6300 ffff880127853c60 ffffffff8117094e > ffff8800c9ade3c0 0000000000000000 00000000a670294f ffff880127853d70 > ffff880127853d98 ffff880127853c98 ffffffff8116071c ffff8800cb4ada80 > Call Trace: > [<ffffffff8117094e>] ? touch_atime+0x2e/0xd0 > [<ffffffff8116071c>] ? trailing_symlink+0xec/0x280 > [<ffffffff81163a78>] ? path_openat+0x468/0x1240 > [<ffffffff8111856d>] ? pagevec_lru_move_fn+0xed/0x110 > [<ffffffff81117ff0>] ? __activate_page+0x130/0x130 > [<ffffffff8116593c>] ? do_filp_open+0x8c/0x100 > [<ffffffff81164dec>] ? filename_lookup+0xec/0x180 > [<ffffffff8115bc24>] ? do_open_execat+0x74/0x170 > [<ffffffff8115d437>] ? do_execveat_common.isra.42+0x1a7/0x6a0 > [<ffffffff8115db90>] ? SyS_execve+0x30/0x40 > [<ffffffff8156ad65>] ? stub_execve+0x5/0x5 > [<ffffffff8156aadb>] ? entry_SYSCALL_64_fastpath+0x16/0x6a > Code: 89 c7 e8 63 eb ff ff 48 89 d8 5b c3 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 54 53 f6 46 0c 02 75 72 48 8b 56 28 <48> 8b 42 50 a9 01 04 00 00 75 63 f6 c4 08 75 65 4c 8b 27 41 8b > RIP [<ffffffff81170871>] atime_needs_update+0x11/0xc0 > RSP <ffff880127853c18> > CR2: 0000000000000050 > ---[ end trace 97dc4f4bb0214bd8 ]--- > > > Regards, > Mickaël > > > On 05/02/2016 22:11, Dmitry Vyukov wrote: >> Hello, >> >> I've hit the following GPF while running syzkaller fuzzer: >> >> general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN >> Modules linked in: >> CPU: 1 PID: 5178 Comm: syz-executor Not tainted 4.5.0-rc2+ #65 >> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 >> task: ffff880064768000 ti: ffff8800622c0000 task.ti: ffff8800622c0000 >> RIP: 0010:[<ffffffff8181aa5d>] [<ffffffff8181aa5d>] >> atime_needs_update+0x2d/0x460 >> RSP: 0018:ffff8800622c7a30 EFLAGS: 00010203 >> RAX: dffffc0000000000 RBX: 0000000000000000 RCX: dffffc0000000000 >> RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000c >> RBP: ffff8800622c7a58 R08: 0000000000000001 R09: 0000000000000000 >> R10: 0000000000000000 R11: 0000000000000001 R12: ffff8800622c7c08 >> R13: ffff8800622c7c08 R14: ffff8800301ca322 R15: ffff8800622c7bb0 >> FS: 00007fd1c9f8b700(0000) GS:ffff88003ed00000(0000) knlGS:0000000000000000 >> CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b >> CR2: 0000000020f31000 CR3: 0000000062274000 CR4: 00000000000006e0 >> Stack: >> ffff8800622c7bf4 0000000000000000 ffff8800622c7c08 ffff8800301ca322 >> ffff8800622c7bb0 ffff8800622c7b38 ffffffff817ecd91 ffff880030bf5200 >> ffff8800622c7bb8 1ffff1000c458f56 ffff8800622c7c00 ffff8800622c7be0 >> Call Trace: >> [< inline >] get_link fs/namei.c:1006 >> [<ffffffff817ecd91>] link_path_walk+0xaf1/0x1030 fs/namei.c:1968 >> [<ffffffff817ed311>] path_parentat+0x41/0x150 fs/namei.c:2176 >> [<ffffffff817f4c5c>] filename_parentat+0x17c/0x3c0 fs/namei.c:2198 >> [< inline >] user_path_parent fs/namei.c:2412 >> [< inline >] SYSC_renameat2 fs/namei.c:4411 >> [< inline >] SyS_renameat2 fs/namei.c:4375 >> [< inline >] SYSC_renameat fs/namei.c:4521 >> [<ffffffff817f9a72>] SyS_renameat+0x192/0x820 fs/namei.c:4518 >> [<ffffffff8669e0b6>] entry_SYSCALL_64_fastpath+0x16/0x7a >> arch/x86/entry/entry_64.S:185 >> Code: 89 e5 41 57 41 56 41 55 41 54 49 89 fc 53 48 89 f3 e8 08 25 d5 >> ff 48 8d 7b 0c 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> >> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 >> RIP [<ffffffff8181aa5d>] atime_needs_update+0x2d/0x460 fs/inode.c:1611 >> RSP <ffff8800622c7a30> >> ---[ end trace 1a4c9bda4680ce46 ]--- >> >> On commit df48ab3c2f5ffca88b7803ffbadd074bd5a0a2ef. >> >> Objdump shows that inode is NULL in atime_needs_update. >> >> Unfortunately reproduction of this crash is very hard. The program >> executes something along the lines of: >> >> mmap(0x20000000, 15945728, PROT_READ|PROT_WRITE, >> MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 >> mkdir("./bus", 0662515705056234013740) = 0 >> openat(AT_FDCWD, "./bus", O_RDONLY|O_EXCL) = 3 >> symlinkat("../bus", 3, "./bus") = 0 >> renameat(3, "./bus", 3, "./bus/file0") = 0 >> mmap(0x20f35000, 4096, PROT_READ|PROT_WRITE, >> MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20f35000 >> mount("./bus", "./bus", 0x20f2aee4, >> MS_RDONLY|MS_NODEV|MS_RELATIME|MS_NODIRATIME|MS_BIND|MS_MOVE|MS_REC|MS_UNBINDABLE|MS_SLAVE|MS_SHARED|0xc000380, >> 0x20093f5f) = 0 >> open("./bus/file0", O_RDWR|O_EXCL) = -1 EISDIR (Is a directory) >> exit_group(0) = ? >> >> But in multiple threads so that some calls can be doubled and/or >> overlapped. And all this happens on a tmpfs mount. >> >> But I was able to reproduce it 8 or so times, so I am sure that it is real. >> >> For future reference, I was running these programs: >> https://gist.githubusercontent.com/dvyukov/124c457d308fa724d88a/raw/fec2d86e125a7fd2fa2916791d65d7daead7cbbb/gistfile1.txt >> Following these instructions: >> https://github.com/google/syzkaller/wiki/How-to-execute-syzkaller-programs I've hit another GPF in atime_needs_update, but this time from SyS_openat: kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN Modules linked in: CPU: 0 PID: 20147 Comm: syz-executor Not tainted 4.5.0-rc4+ #329 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff88005f154740 ti: ffff88005f048000 task.ti: ffff88005f048000 RIP: 0010:[<ffffffff81818b5d>] [<ffffffff81818b5d>] atime_needs_update+0x2d/0x460 RSP: 0018:ffff88005f04fa48 EFLAGS: 00010203 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88005f04fd88 RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000c RBP: ffff88005f04fa70 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88005f04fd98 R13: 0000000000000000 R14: ffff88005f04fd98 R15: ffff88005f04fd78 FS: 00007f612639b700(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 000000002003ef84 CR3: 000000006073e000 CR4: 00000000000006f0 Stack: ffff88005f04fd40 ffff88005f04fe08 0000000000000000 ffff88005f04fd98 ffff88005f04fd78 ffff88005f04fab8 ffffffff817e5572 ffff88005f04fd78 ffff88002bcf02f8 0000000000000001 0000000000000000 ffff88002bcf02f8 Call Trace: [< inline >] get_link fs/namei.c:1006 [<ffffffff817e5572>] trailing_symlink+0x142/0x760 fs/namei.c:2094 [<ffffffff817ec531>] path_openat+0xbc1/0x5e30 fs/namei.c:3389 [<ffffffff817f4fde>] do_filp_open+0x18e/0x250 fs/namei.c:3421 [<ffffffff817b970c>] do_sys_open+0x1fc/0x420 fs/open.c:1022 [< inline >] SYSC_openat fs/open.c:1049 [<ffffffff817b99a0>] SyS_openat+0x30/0x40 fs/open.c:1043 [<ffffffff86662636>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 Code: 89 e5 41 57 41 56 41 55 41 54 49 89 fc 53 48 89 f3 e8 c8 32 d5 ff 48 8d 7b 0c 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 RIP [<ffffffff81818b5d>] atime_needs_update+0x2d/0x460 fs/inode.c:1611 RSP <ffff88005f04fa48> ---[ end trace 0790795e3dea8fc8 ]--- The program that triggered it was: mmap(&(0x7f0000000000)=nil, (0x51000), 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000002000)="2e2f66696c653000", 0x40) mount(&(0x7f000001a000)="2e2f66696c653000", &(0x7f000001a000+0x4cf)="2e2f66696c653000", &(0x7f000001a000+0xc79)="72616d667300", 0x800, &(0x7f000003f000-0x7c)="3dd496054f9a5d4176272c354e968b1cf2c6c18792461e7325b5774e9197aad240b4b45ac67faa72d988a86dd8ba348739259df192d01f08ca39a8524fee967d7f39f0ec53ce000ff78ed4b2510c5ae8812ed421db038390d8f3fea242e682c907334bc6fc74f2490e4aac983bdf85c9f5b6f6b288b0074ab201ab") r1 = open$dir(&(0x7f000004c000+0x7df)="2e2f66696c653000", 0x200000, 0x82) symlinkat(&(0x7f000002e000)="2e2f66696c65302f66696c653000", r1, &(0x7f0000033000)="2e2f66696c653000") openat(r1, &(0x7f000004b000-0x8)="2e2f66696c653000", 0x40000, 0x2) On commit 1926e54f115725a9248d0c4c65c22acaf94de4c4. ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-19 19:32 ` Dmitry Vyukov @ 2016-02-20 3:21 ` Al Viro 2016-02-20 3:54 ` Al Viro 2016-02-20 10:36 ` Dmitry Vyukov 0 siblings, 2 replies; 49+ messages in thread From: Al Viro @ 2016-02-20 3:21 UTC (permalink / raw) To: Dmitry Vyukov Cc: Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Fri, Feb 19, 2016 at 08:32:10PM +0100, Dmitry Vyukov wrote: > > BUG: unable to handle kernel NULL pointer dereference at 0000000000000050 NULL inode->i_sb, by the look of the offset, but I really don't understand where the hell is that code doing (or how is that instruction going to generate dereferencing of 0x50, for that matter). > I've hit another GPF in atime_needs_update, but this time from SyS_openat: > > kasan: GPF could be caused by NULL-ptr deref or user memory > accessgeneral protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN > Modules linked in: > CPU: 0 PID: 20147 Comm: syz-executor Not tainted 4.5.0-rc4+ #329 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > task: ffff88005f154740 ti: ffff88005f048000 task.ti: ffff88005f048000 > RIP: 0010:[<ffffffff81818b5d>] [<ffffffff81818b5d>] > atime_needs_update+0x2d/0x460 > RSP: 0018:ffff88005f04fa48 EFLAGS: 00010203 > RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88005f04fd88 > RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000c > RBP: ffff88005f04fa70 R08: 0000000000000001 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000001 R12: ffff88005f04fd98 > R13: 0000000000000000 R14: ffff88005f04fd98 R15: ffff88005f04fd78 > FS: 00007f612639b700(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b > CR2: 000000002003ef84 CR3: 000000006073e000 CR4: 00000000000006f0 > Stack: > ffff88005f04fd40 ffff88005f04fe08 0000000000000000 ffff88005f04fd98 > ffff88005f04fd78 ffff88005f04fab8 ffffffff817e5572 ffff88005f04fd78 > ffff88002bcf02f8 0000000000000001 0000000000000000 ffff88002bcf02f8 > Call Trace: > [< inline >] get_link fs/namei.c:1006 > [<ffffffff817e5572>] trailing_symlink+0x142/0x760 fs/namei.c:2094 > [<ffffffff817ec531>] path_openat+0xbc1/0x5e30 fs/namei.c:3389 > [<ffffffff817f4fde>] do_filp_open+0x18e/0x250 fs/namei.c:3421 > [<ffffffff817b970c>] do_sys_open+0x1fc/0x420 fs/open.c:1022 > [< inline >] SYSC_openat fs/open.c:1049 > [<ffffffff817b99a0>] SyS_openat+0x30/0x40 fs/open.c:1043 > [<ffffffff86662636>] entry_SYSCALL_64_fastpath+0x16/0x7a > arch/x86/entry/entry_64.S:185 > Code: 89 e5 41 57 41 56 41 55 41 54 49 89 fc 53 48 89 f3 e8 c8 32 d5 > ff 48 8d 7b 0c 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> > b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 > RIP [<ffffffff81818b5d>] atime_needs_update+0x2d/0x460 fs/inode.c:1611 > RSP <ffff88005f04fa48> What was the fault address here and what config are you using for those builds? ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-20 3:21 ` Al Viro @ 2016-02-20 3:54 ` Al Viro 2016-02-20 10:36 ` Dmitry Vyukov 1 sibling, 0 replies; 49+ messages in thread From: Al Viro @ 2016-02-20 3:54 UTC (permalink / raw) To: Dmitry Vyukov Cc: Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Sat, Feb 20, 2016 at 03:21:27AM +0000, Al Viro wrote: > On Fri, Feb 19, 2016 at 08:32:10PM +0100, Dmitry Vyukov wrote: > > > BUG: unable to handle kernel NULL pointer dereference at 0000000000000050 > > NULL inode->i_sb, by the look of the offset, but I really don't understand > where the hell is that code doing (or how is that instruction going to > generate dereferencing of 0x50, for that matter). BTW, Mickaël's trace *does* make sense and it's definitely NULL inode->i_sb (inode itself - in %rsi, inode->i_sb - in %rdx, offset of s_flags is 0x50, the line in question is if ((inode->i_sb->s_flags & MS_NODIRATIME) && S_ISDIR(inode->i_mode)) What I don't understand is what could possibly have NULL ->i_sb in *any* instance of struct inode. ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update @ 2016-02-20 3:54 ` Al Viro 0 siblings, 0 replies; 49+ messages in thread From: Al Viro @ 2016-02-20 3:54 UTC (permalink / raw) To: Dmitry Vyukov Cc: Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Sat, Feb 20, 2016 at 03:21:27AM +0000, Al Viro wrote: > On Fri, Feb 19, 2016 at 08:32:10PM +0100, Dmitry Vyukov wrote: > > > BUG: unable to handle kernel NULL pointer dereference at 0000000000000050 > > NULL inode->i_sb, by the look of the offset, but I really don't understand > where the hell is that code doing (or how is that instruction going to > generate dereferencing of 0x50, for that matter). BTW, Micka�l's trace *does* make sense and it's definitely NULL inode->i_sb (inode itself - in %rsi, inode->i_sb - in %rdx, offset of s_flags is 0x50, the line in question is if ((inode->i_sb->s_flags & MS_NODIRATIME) && S_ISDIR(inode->i_mode)) What I don't understand is what could possibly have NULL ->i_sb in *any* instance of struct inode. ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-20 3:54 ` Al Viro (?) @ 2016-02-20 13:25 ` Mickaël Salaün 2016-02-20 17:10 ` Al Viro -1 siblings, 1 reply; 49+ messages in thread From: Mickaël Salaün @ 2016-02-20 13:25 UTC (permalink / raw) To: Al Viro, Dmitry Vyukov Cc: linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin [-- Attachment #1: Type: text/plain, Size: 1286 bytes --] On 20/02/2016 04:54, Al Viro wrote: > On Sat, Feb 20, 2016 at 03:21:27AM +0000, Al Viro wrote: >> On Fri, Feb 19, 2016 at 08:32:10PM +0100, Dmitry Vyukov wrote: >>>> BUG: unable to handle kernel NULL pointer dereference at 0000000000000050 >> >> NULL inode->i_sb, by the look of the offset, but I really don't understand >> where the hell is that code doing (or how is that instruction going to >> generate dereferencing of 0x50, for that matter). > > BTW, Mickaël's trace *does* make sense and it's definitely NULL inode->i_sb > (inode itself - in %rsi, inode->i_sb - in %rdx, offset of s_flags is 0x50, > the line in question is > if ((inode->i_sb->s_flags & MS_NODIRATIME) && S_ISDIR(inode->i_mode)) > > What I don't understand is what could possibly have NULL ->i_sb in *any* > instance of struct inode. > I can also trigger bugs with a bad inode pointer dereference in atime_needs_update: if (inode->i_flags & S_NOATIME) I think the bug may be somewhere in the nd->depth handling (when its value is 0) in fs/namei.c:get_link(): struct saved *last = nd->stack + nd->depth - 1 Moreover, is it intentional that touch_atime() is called by get_link() even if the access (previously checked with security_file_open(), e.g. by do_last) is denied? [-- Attachment #2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 455 bytes --] ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-20 13:25 ` Mickaël Salaün @ 2016-02-20 17:10 ` Al Viro 0 siblings, 0 replies; 49+ messages in thread From: Al Viro @ 2016-02-20 17:10 UTC (permalink / raw) To: Mickaël Salaün Cc: Dmitry Vyukov, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Sat, Feb 20, 2016 at 02:25:40PM +0100, Mickaël Salaün wrote: > I think the bug may be somewhere in the nd->depth handling (when its value is 0) in fs/namei.c:get_link(): struct saved *last = nd->stack + nd->depth - 1 Getting there with nd->depth == 0 would certainly be a bug - it would mean that we got there without should_follow_link() having returned 1. In case of open() it would be "do_last() has returned positive without should_follow_link() having returned 1". <looks> OK, there are several places where we rely on not getting bogus return values - inode_permission() should not return positives, neither should vfs_open(), security_path_truncate() and notify_change(). Other similar "handle the last component" functions are guaranteed to never return positives other than directly from should_follow_link(), so they are OK. IIRC, you used LSM to inject a positive value to inode_permission(), right? Another way to trigger that would've been ->open() returning positive - a bug on *anything* since ->open() had been introduced in 0.95. Amount of harm would vary - e.g. 0.95 would simply have that positive number returned to userland, looking like successful open(2). With no new descriptor, of course... Short-term we probably want just if (unlikely(error > 0)) { WARN_ON(1); error = -EINVAL; } added right after out: in do_last(), try to trigger Dmitry's reproducers on it and then work back to the source of that thing *if* that's what's happening in his case. Yours almost certainly is just that. Longer-term... I'm not sure. Having a method that is supposed to return 0 or -E<something> actually return positive is going to be a bad thing, no matter what, but "that bogus value gets passed to userland" is a lot more tolerable than "kernel memory corruption". do_last() calling conventions make it vulnerable to the latter, and as far as nd->stack underruns that's it, but I'm not sure we don't have other places where such bug in driver, etc. would translate into mess ;-/ OK, in any case, let's start with checking if Dmitry is seeing that and not something else. I still don't understand his stack traces - the fault address quoted in his first posting doesn't match the register values in the same trace, and there's also a possibility that it's an RCU-related crap. This should give a warning and prevent an oops if we are hitting a stack underrun on bogus positive from do_last(). Dmitry, could you try to build with delta below and run your reproducer(s)? diff --git a/fs/namei.c b/fs/namei.c index f624d13..e30deef 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -3273,6 +3273,10 @@ opened: goto exit_fput; } out: + if (unlikely(error > 0)) { + WARN_ON(1); + error = -EINVAL; + } if (got_write) mnt_drop_write(nd->path.mnt); path_put(&save_parent); ^ permalink raw reply related [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update @ 2016-02-20 17:10 ` Al Viro 0 siblings, 0 replies; 49+ messages in thread From: Al Viro @ 2016-02-20 17:10 UTC (permalink / raw) To: Mickaël Salaün Cc: Dmitry Vyukov, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Sat, Feb 20, 2016 at 02:25:40PM +0100, Micka�l Sala�n wrote: > I think the bug may be somewhere in the nd->depth handling (when its value is 0) in fs/namei.c:get_link(): struct saved *last = nd->stack + nd->depth - 1 Getting there with nd->depth == 0 would certainly be a bug - it would mean that we got there without should_follow_link() having returned 1. In case of open() it would be "do_last() has returned positive without should_follow_link() having returned 1". <looks> OK, there are several places where we rely on not getting bogus return values - inode_permission() should not return positives, neither should vfs_open(), security_path_truncate() and notify_change(). Other similar "handle the last component" functions are guaranteed to never return positives other than directly from should_follow_link(), so they are OK. IIRC, you used LSM to inject a positive value to inode_permission(), right? Another way to trigger that would've been ->open() returning positive - a bug on *anything* since ->open() had been introduced in 0.95. Amount of harm would vary - e.g. 0.95 would simply have that positive number returned to userland, looking like successful open(2). With no new descriptor, of course... Short-term we probably want just if (unlikely(error > 0)) { WARN_ON(1); error = -EINVAL; } added right after out: in do_last(), try to trigger Dmitry's reproducers on it and then work back to the source of that thing *if* that's what's happening in his case. Yours almost certainly is just that. Longer-term... I'm not sure. Having a method that is supposed to return 0 or -E<something> actually return positive is going to be a bad thing, no matter what, but "that bogus value gets passed to userland" is a lot more tolerable than "kernel memory corruption". do_last() calling conventions make it vulnerable to the latter, and as far as nd->stack underruns that's it, but I'm not sure we don't have other places where such bug in driver, etc. would translate into mess ;-/ OK, in any case, let's start with checking if Dmitry is seeing that and not something else. I still don't understand his stack traces - the fault address quoted in his first posting doesn't match the register values in the same trace, and there's also a possibility that it's an RCU-related crap. This should give a warning and prevent an oops if we are hitting a stack underrun on bogus positive from do_last(). Dmitry, could you try to build with delta below and run your reproducer(s)? diff --git a/fs/namei.c b/fs/namei.c index f624d13..e30deef 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -3273,6 +3273,10 @@ opened: goto exit_fput; } out: + if (unlikely(error > 0)) { + WARN_ON(1); + error = -EINVAL; + } if (got_write) mnt_drop_write(nd->path.mnt); path_put(&save_parent); ^ permalink raw reply related [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-20 17:10 ` Al Viro (?) @ 2016-02-20 20:26 ` Mickaël Salaün 2016-02-20 20:50 ` Al Viro -1 siblings, 1 reply; 49+ messages in thread From: Mickaël Salaün @ 2016-02-20 20:26 UTC (permalink / raw) To: Al Viro Cc: Dmitry Vyukov, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin [-- Attachment #1: Type: text/plain, Size: 1774 bytes --] On 20/02/2016 18:10, Al Viro wrote: > On Sat, Feb 20, 2016 at 02:25:40PM +0100, Mickaël Salaün wrote: > >> I think the bug may be somewhere in the nd->depth handling (when its value is 0) in fs/namei.c:get_link(): struct saved *last = nd->stack + nd->depth - 1 > > Getting there with nd->depth == 0 would certainly be a bug - it would mean > that we got there without should_follow_link() having returned 1. > > In case of open() it would be "do_last() has returned positive without > should_follow_link() having returned 1". OK, the do_last() return value was the origin of my bug in fs/namei.c:path_openat(): while (!(error = link_path_walk(s, nd)) && (error = do_last(nd, file, op, &opened)) > 0) > > <looks> > > OK, there are several places where we rely on not getting bogus return values > - inode_permission() should not return positives, neither should vfs_open(), > security_path_truncate() and notify_change(). > > Other similar "handle the last component" functions are guaranteed to > never return positives other than directly from should_follow_link(), so > they are OK. > > IIRC, you used LSM to inject a positive value to inode_permission(), right? Yes, my test hook was wrong because it returned 1 (instead of -EPERM or -EACCES) which is an invalid return value. > diff --git a/fs/namei.c b/fs/namei.c > index f624d13..e30deef 100644 > --- a/fs/namei.c > +++ b/fs/namei.c > @@ -3273,6 +3273,10 @@ opened: > goto exit_fput; > } > out: > + if (unlikely(error > 0)) { > + WARN_ON(1); > + error = -EINVAL; > + } > if (got_write) > mnt_drop_write(nd->path.mnt); > path_put(&save_parent); > I think your warning patch should be upstreamed to detect such cases :) Thanks, Mickaël [-- Attachment #2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 455 bytes --] ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-20 20:26 ` Mickaël Salaün @ 2016-02-20 20:50 ` Al Viro 0 siblings, 0 replies; 49+ messages in thread From: Al Viro @ 2016-02-20 20:50 UTC (permalink / raw) To: Mickaël Salaün Cc: Dmitry Vyukov, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Sat, Feb 20, 2016 at 09:26:28PM +0100, Mickaël Salaün wrote: > > + if (unlikely(error > 0)) { > > + WARN_ON(1); > > + error = -EINVAL; > > + } > > if (got_write) > > mnt_drop_write(nd->path.mnt); > > path_put(&save_parent); > > > > I think your warning patch should be upstreamed to detect such cases :) I'm not sure whether it's better done there or one step closer to the source - e.g. telling whether it was bogus ->open() or a bogus LSM hook (and _which_ bogus LSM hook had it been) would be hard with that location of test. It still leaves the question of what's going on in Dmitry's tests - it might be one of those source or it might be something else entirely; this location of test would at least tell whether a stack underrun is involved or not... ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update @ 2016-02-20 20:50 ` Al Viro 0 siblings, 0 replies; 49+ messages in thread From: Al Viro @ 2016-02-20 20:50 UTC (permalink / raw) To: Mickaël Salaün Cc: Dmitry Vyukov, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Sat, Feb 20, 2016 at 09:26:28PM +0100, Micka�l Sala�n wrote: > > + if (unlikely(error > 0)) { > > + WARN_ON(1); > > + error = -EINVAL; > > + } > > if (got_write) > > mnt_drop_write(nd->path.mnt); > > path_put(&save_parent); > > > > I think your warning patch should be upstreamed to detect such cases :) I'm not sure whether it's better done there or one step closer to the source - e.g. telling whether it was bogus ->open() or a bogus LSM hook (and _which_ bogus LSM hook had it been) would be hard with that location of test. It still leaves the question of what's going on in Dmitry's tests - it might be one of those source or it might be something else entirely; this location of test would at least tell whether a stack underrun is involved or not... ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-20 17:10 ` Al Viro (?) (?) @ 2016-02-22 11:20 ` Dmitry Vyukov 2016-02-22 17:23 ` Al Viro -1 siblings, 1 reply; 49+ messages in thread From: Dmitry Vyukov @ 2016-02-22 11:20 UTC (permalink / raw) To: Al Viro Cc: Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Sat, Feb 20, 2016 at 6:10 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: > On Sat, Feb 20, 2016 at 02:25:40PM +0100, Mickaël Salaün wrote: > >> I think the bug may be somewhere in the nd->depth handling (when its value is 0) in fs/namei.c:get_link(): struct saved *last = nd->stack + nd->depth - 1 > > Getting there with nd->depth == 0 would certainly be a bug - it would mean > that we got there without should_follow_link() having returned 1. > > In case of open() it would be "do_last() has returned positive without > should_follow_link() having returned 1". > > <looks> > > OK, there are several places where we rely on not getting bogus return values > - inode_permission() should not return positives, neither should vfs_open(), > security_path_truncate() and notify_change(). > > Other similar "handle the last component" functions are guaranteed to > never return positives other than directly from should_follow_link(), so > they are OK. > > IIRC, you used LSM to inject a positive value to inode_permission(), right? > > Another way to trigger that would've been ->open() returning positive - > a bug on *anything* since ->open() had been introduced in 0.95. Amount of > harm would vary - e.g. 0.95 would simply have that positive number returned > to userland, looking like successful open(2). With no new descriptor, of > course... > > Short-term we probably want just > if (unlikely(error > 0)) { > WARN_ON(1); > error = -EINVAL; > } > added right after out: in do_last(), try to trigger Dmitry's reproducers > on it and then work back to the source of that thing *if* that's what's > happening in his case. Yours almost certainly is just that. > > Longer-term... I'm not sure. Having a method that is supposed to return 0 > or -E<something> actually return positive is going to be a bad thing, no > matter what, but "that bogus value gets passed to userland" is a lot > more tolerable than "kernel memory corruption". do_last() calling conventions > make it vulnerable to the latter, and as far as nd->stack underruns that's > it, but I'm not sure we don't have other places where such bug in driver, > etc. would translate into mess ;-/ > > OK, in any case, let's start with checking if Dmitry is seeing that and not > something else. I still don't understand his stack traces - the fault > address quoted in his first posting doesn't match the register values in > the same trace, and there's also a possibility that it's an RCU-related > crap. This should give a warning and prevent an oops if we are hitting > a stack underrun on bogus positive from do_last(). Dmitry, could you try > to build with delta below and run your reproducer(s)? > > diff --git a/fs/namei.c b/fs/namei.c > index f624d13..e30deef 100644 > --- a/fs/namei.c > +++ b/fs/namei.c > @@ -3273,6 +3273,10 @@ opened: > goto exit_fput; > } > out: > + if (unlikely(error > 0)) { > + WARN_ON(1); > + error = -EINVAL; > + } > if (got_write) > mnt_drop_write(nd->path.mnt); > path_put(&save_parent); I've reproduced the second report (the one originating in openat) with this patch and the WARNING did _not_ fire: kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN Modules linked in: CPU: 2 PID: 17525 Comm: syz-executor Not tainted 4.5.0-rc5+ #331 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff88002c6ddf00 ti: ffff88002c740000 task.ti: ffff88002c740000 RIP: 0010:[<ffffffff81821ded>] [<ffffffff81821ded>] atime_needs_update+0x2d/0x460 RSP: 0018:ffff88002c747a48 EFLAGS: 00010203 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88002c747d88 RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000c RBP: ffff88002c747a70 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88002c747d98 R13: 0000000000000000 R14: ffff88002c747d98 R15: ffff88002c747d78 FS: 00007f24da3d9700(0000) GS:ffff88006d600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 000000002003f000 CR3: 000000002e2d0000 CR4: 00000000000006e0 Stack: ffff88002c747d40 ffff88002c747e08 0000000000000000 ffff88002c747d98 ffff88002c747d78 ffff88002c747ab8 ffffffff817eeda2 ffff88002c747d78 ffff880030fa88e8 ffff88002c747c98 0000000000000000 ffff88002c747d40 Call Trace: [< inline >] get_link fs/namei.c:1006 [<ffffffff817eeda2>] trailing_symlink+0x142/0x760 fs/namei.c:2094 [<ffffffff817f5cec>] path_openat+0xb4c/0x5760 fs/namei.c:3393 [<ffffffff817fe13e>] do_filp_open+0x18e/0x250 fs/namei.c:3425 [<ffffffff817c2dbc>] do_sys_open+0x1fc/0x420 fs/open.c:1022 [< inline >] SYSC_openat fs/open.c:1049 [<ffffffff817c3050>] SyS_openat+0x30/0x40 fs/open.c:1043 [<ffffffff8669f6b6>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 Code: 89 e5 41 57 41 56 41 55 41 54 49 89 fc 53 48 89 f3 e8 98 17 d5 ff 48 8d 7b 0c 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 RIP [<ffffffff81821ded>] atime_needs_update+0x2d/0x460 fs/inode.c:1617 RSP <ffff88002c747a48> ---[ end trace 872348222bfe81b0 ]--- This is _not_ on a tmpfs mount. Regarding the registers, here is disassembly. The crash happens on a KASAN check of the ffffffff81821dc0 <atime_needs_update>: ffffffff81821dc0: 55 push %rbp ffffffff81821dc1: 48 89 e5 mov %rsp,%rbp ffffffff81821dc4: 41 57 push %r15 ffffffff81821dc6: 41 56 push %r14 ffffffff81821dc8: 41 55 push %r13 ffffffff81821dca: 41 54 push %r12 ffffffff81821dcc: 49 89 fc mov %rdi,%r12 ffffffff81821dcf: 53 push %rbx ffffffff81821dd0: 48 89 f3 mov %rsi,%rbx ffffffff81821dd3: e8 98 17 d5 ff callq ffffffff81573570 <__sanitizer_cov_trace_pc> ffffffff81821dd8: 48 8d 7b 0c lea 0xc(%rbx),%rdi ffffffff81821ddc: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax ffffffff81821de3: fc ff df ffffffff81821de6: 48 89 fa mov %rdi,%rdx ffffffff81821de9: 48 c1 ea 03 shr $0x3,%rdx ffffffff81821ded: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx ffffffff81821df1: 48 89 f8 mov %rdi,%rax ffffffff81821df4: 83 e0 07 and $0x7,%eax ffffffff81821df7: 83 c0 03 add $0x3,%eax ffffffff81821dfa: 38 d0 cmp %dl,%al ffffffff81821dfc: 7c 08 jl ffffffff81821e06 <atime_needs_update+0x46> ffffffff81821dfe: 84 d2 test %dl,%dl ffffffff81821e00: 0f 85 03 03 00 00 jne ffffffff81822109 <atime_needs_update+0x349> ffffffff81821e06: f6 43 0c 02 testb $0x2,0xc(%rbx) ffffffff81821e0a: 0f 85 1a 02 00 00 jne ffffffff8182202a <atime_needs_update+0x26a> ffffffff81821e10: e8 5b 17 d5 ff callq ffffffff81573570 <__sanitizer_cov_trace_pc> ffffffff81821e15: 48 8d 7b 28 lea 0x28(%rbx),%rdi ffffffff81821e19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax ffffffff81821e20: fc ff df ffffffff81821e23: 48 89 fa mov %rdi,%rdx ffffffff81821e26: 48 c1 ea 03 shr $0x3,%rdx ffffffff81821e2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) ffffffff81821e2e: 0f 85 c4 03 00 00 jne ffffffff818221f8 <atime_needs_update+0x438> It means that inode is NULL here: bool atime_needs_update(const struct path *path, struct inode *inode) { struct vfsmount *mnt = path->mnt; struct timespec now; if (inode->i_flags & S_NOATIME) return false; ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-22 11:20 ` Dmitry Vyukov @ 2016-02-22 17:23 ` Al Viro 2016-02-23 15:34 ` Dmitry Vyukov 0 siblings, 1 reply; 49+ messages in thread From: Al Viro @ 2016-02-22 17:23 UTC (permalink / raw) To: Dmitry Vyukov Cc: Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Mon, Feb 22, 2016 at 12:20:30PM +0100, Dmitry Vyukov wrote: > I've reproduced the second report (the one originating in openat) with > this patch and the WARNING did _not_ fire: Lovely... Could you dump your inode.o on anonftp somewhere? Or post the disassembled atime_needs_update, for that matter - shouldn't be all that long... .config (and gcc version) you are using would also be nice. On the face of it, NULL inode is a plausible source of that one, but it's _very_ odd. It would have to be NULL ->link_inode, and since the warning hadn't triggered, there was a successful should_follow_link(), with NULL inode argument. Could you slap WARN_ON(!inode) in pick_link()? Or even WARN_ON(IS_ERR_OR_NULL(inode)), for that matter... ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-22 17:23 ` Al Viro @ 2016-02-23 15:34 ` Dmitry Vyukov 2016-02-23 18:17 ` Al Viro 0 siblings, 1 reply; 49+ messages in thread From: Dmitry Vyukov @ 2016-02-23 15:34 UTC (permalink / raw) To: Al Viro Cc: Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Mon, Feb 22, 2016 at 6:23 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: > On Mon, Feb 22, 2016 at 12:20:30PM +0100, Dmitry Vyukov wrote: > >> I've reproduced the second report (the one originating in openat) with >> this patch and the WARNING did _not_ fire: > > Lovely... Could you dump your inode.o on anonftp somewhere? Or post > the disassembled atime_needs_update, for that matter - shouldn't be > all that long... .config (and gcc version) you are using would also be nice. > > On the face of it, NULL inode is a plausible source of that one, but > it's _very_ odd. It would have to be NULL ->link_inode, and since the > warning hadn't triggered, there was a successful should_follow_link(), > with NULL inode argument. > > Could you slap WARN_ON(!inode) in pick_link()? Or even > WARN_ON(IS_ERR_OR_NULL(inode)), for that matter... I was able to reproduce the crash on vanilla kernel (no KASAN, no KCOV) with the new WARNING, this one does fire. So I am on commit 4de8ebeff8ddefaceeb7fc6a9b1a514fc9624509 (Feb 22), with: $ git diff diff --git a/fs/namei.c b/fs/namei.c index f624d13..9675e9e 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1669,6 +1669,7 @@ static int pick_link(struct nameidata *nd, struct path *link, { int error; struct saved *last; + WARN_ON(IS_ERR_OR_NULL(inode)); if (unlikely(nd->total_link_count++ >= MAXSYMLINKS)) { path_to_nameidata(link, nd); return -ELOOP; @@ -3273,6 +3274,10 @@ opened: goto exit_fput; } out: + if (unlikely(error > 0)) { + WARN_ON(1); + error = -EINVAL; + } if (got_write) mnt_drop_write(nd->path.mnt); path_put(&save_parent); The crash: [ 8095.048336] ------------[ cut here ]------------ [ 8095.048864] WARNING: CPU: 3 PID: 5532 at fs/namei.c:1672 should_follow_link.part.25+0x55/0x21a() [ 8095.049830] Modules linked in: [ 8095.050155] CPU: 3 PID: 5532 Comm: syz-executor Not tainted 4.5.0-rc5+ #69 [ 8095.050760] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 [ 8095.051104] 0000000000000000 ffff8800005ffc78 ffffffff8194e5f9 0000000000000000 [ 8095.051649] ffffffff8334c24c ffff8800005ffcb0 ffffffff81172291 ffff8800005ffde0 [ 8095.051649] ffff8800005ffd98 0000000000048000 ffff8800005ffde0 ffff8800005ffefc [ 8095.051649] Call Trace: [ 8095.051649] [<ffffffff8194e5f9>] dump_stack+0x99/0xd0 [ 8095.054784] [<ffffffff81172291>] warn_slowpath_common+0x81/0xc0 [ 8095.054784] [<ffffffff81172385>] warn_slowpath_null+0x15/0x20 [ 8095.054784] [<ffffffff8185a55c>] should_follow_link.part.25+0x55/0x21a [ 8095.054784] [<ffffffff813180c9>] path_openat+0x1229/0x1500 [ 8095.057172] [<ffffffff813193d9>] do_filp_open+0x79/0xd0 [ 8095.057172] [<ffffffff82b170c2>] ? _raw_spin_unlock+0x22/0x30 [ 8095.057172] [<ffffffff81328d98>] ? __alloc_fd+0xf8/0x200 [ 8095.058364] [<ffffffff81306eb0>] do_sys_open+0x110/0x1f0 [ 8095.058364] [<ffffffff81306fbf>] SyS_openat+0xf/0x20 [ 8095.058364] [<ffffffff82b17b76>] entry_SYSCALL_64_fastpath+0x16/0x7a [ 8095.060124] ---[ end trace 50e32daa426e4c92 ]--- [ 8095.060526] BUG: unable to handle kernel NULL pointer dereference at 000000000000000c [ 8095.061111] IP: [<ffffffff813272b9>] atime_needs_update+0x9/0xc0 [ 8095.061549] PGD 6ae6e067 PUD 6ae6a067 PMD 0 [ 8095.061549] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC [ 8095.061549] Modules linked in: [ 8095.061549] CPU: 3 PID: 5532 Comm: syz-executor Tainted: G W 4.5.0-rc5+ #69 [ 8095.061549] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 [ 8095.061549] task: ffff88002bc00000 ti: ffff8800005fc000 task.ti: ffff8800005fc000 [ 8095.061549] RIP: 0010:[<ffffffff813272b9>] [<ffffffff813272b9>] atime_needs_update+0x9/0xc0 [ 8095.061549] RSP: 0018:ffff8800005ffcb0 EFLAGS: 00010282 [ 8095.061549] RAX: 0000000000000030 RBX: ffff8800005ffde0 RCX: 0000000000000000 [ 8095.061549] RDX: ffff8800005ffe38 RSI: 0000000000000000 RDI: ffff8800005ffe38 [ 8095.061549] RBP: ffff8800005ffcc0 R08: 0000000000000002 R09: 0000000000000001 [ 8095.061549] R10: 0000000000000001 R11: 0000000000001828 R12: 0000000000000000 [ 8095.061549] R13: ffff8800005ffe38 R14: ffff880031950be0 R15: ffff8800005ffefc [ 8095.061549] FS: 00007fc3bf2ee700(0000) GS:ffff88007f900000(0000) knlGS:0000000000000000 [ 8095.069746] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 8095.069746] CR2: 000000000000000c CR3: 000000006b982000 CR4: 00000000000006e0 [ 8095.071108] Stack: [ 8095.071538] ffff8800005ffcc0 ffff8800005ffde0 ffff8800005ffd00 ffffffff81314ca2 [ 8095.072227] 0000000200000002 0000000000000005 ffff8800005ffd98 0000000000048000 [ 8095.072227] ffff8800005ffde0 ffff8800005ffefc ffff8800005ffdd0 ffffffff81317173 [ 8095.072227] Call Trace: [ 8095.072227] [<ffffffff81314ca2>] trailing_symlink+0x62/0x260 [ 8095.072227] [<ffffffff81317173>] path_openat+0x2d3/0x1500 [ 8095.072227] [<ffffffff813193d9>] do_filp_open+0x79/0xd0 [ 8095.072227] [<ffffffff82b170c2>] ? _raw_spin_unlock+0x22/0x30 [ 8095.072227] [<ffffffff81328d98>] ? __alloc_fd+0xf8/0x200 [ 8095.072227] [<ffffffff81306eb0>] do_sys_open+0x110/0x1f0 [ 8095.072227] [<ffffffff81306fbf>] SyS_openat+0xf/0x20 [ 8095.072227] [<ffffffff82b17b76>] entry_SYSCALL_64_fastpath+0x16/0x7a [ 8095.072227] Code: ff ff ff 48 85 c0 48 89 c3 74 08 48 89 c7 e8 ef dc ff ff 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 53 48 83 ec 08 <f6> 46 0c 02 48 8b 1f 75 6b 48 8b 7e 28 48 8b 47 50 a9 01 04 00 [ 8095.072227] RIP [<ffffffff813272b9>] atime_needs_update+0x9/0xc0 [ 8095.072227] RSP <ffff8800005ffcb0> [ 8095.072227] CR2: 000000000000000c [ 8095.116838] ---[ end trace 50e32daa426e4c93 ]--- [ 8095.116838] BUG: sleeping function called from invalid context at include/linux/sched.h:2795 [ 8095.116838] in_atomic(): 1, irqs_disabled(): 1, pid: 5532, name: syz-executor [ 8095.116838] INFO: lockdep is turned off. [ 8095.116838] irq event stamp: 636 [ 8095.116838] hardirqs last enabled at (635): [<ffffffff811d9926>] vprintk_emit+0x2d6/0x5f0 [ 8095.116838] hardirqs last disabled at (636): [<ffffffff82b1a089>] error_entry+0x69/0xc0 [ 8095.116838] softirqs last enabled at (632): [<ffffffff81178172>] __do_softirq+0x222/0x4a0 [ 8095.116838] softirqs last disabled at (623): [<ffffffff81178767>] irq_exit+0xa7/0xc0 [ 8095.116838] CPU: 3 PID: 5532 Comm: syz-executor Tainted: G D W 4.5.0-rc5+ #69 [ 8095.116838] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 [ 8095.116838] 0000000000000000 ffff8800005ff9a8 ffffffff8194e5f9 ffff88002bc00000 [ 8095.116838] 000000000000159c ffff8800005ff9d0 ffffffff811a0659 ffffffff832a29c3 [ 8095.116838] 0000000000000aeb 0000000000000000 ffff8800005ff9f8 ffffffff811a0764 [ 8095.116838] Call Trace: [ 8095.116838] [<ffffffff8194e5f9>] dump_stack+0x99/0xd0 [ 8095.116838] [<ffffffff811a0659>] ___might_sleep+0x179/0x240 [ 8095.116838] [<ffffffff811a0764>] __might_sleep+0x44/0x80 [ 8095.116838] [<ffffffff811842cf>] exit_signals+0x1f/0x130 [ 8095.116838] [<ffffffff811756ef>] do_exit+0xbf/0xd10 [ 8095.116838] [<ffffffff811da524>] ? kmsg_dump+0x104/0x180 [ 8095.116838] [<ffffffff8108549f>] oops_end+0x9f/0xe0 [ 8095.116838] [<ffffffff810ce6e8>] no_context+0x108/0x390 [ 8095.116838] [<ffffffff811d7837>] ? print_time.part.13+0x67/0x90 [ 8095.116838] [<ffffffff810cea8d>] __bad_area_nosemaphore+0x11d/0x220 [ 8095.116838] [<ffffffff810ceb9e>] bad_area_nosemaphore+0xe/0x10 [ 8095.116838] [<ffffffff810cf2c4>] __do_page_fault+0x84/0x470 [ 8095.116838] [<ffffffff810cf764>] trace_do_page_fault+0x74/0x2c0 [ 8095.116838] [<ffffffff810c9ba4>] do_async_page_fault+0x14/0x90 [ 8095.116838] [<ffffffff82b19eb8>] async_page_fault+0x28/0x30 [ 8095.116838] [<ffffffff813272b9>] ? atime_needs_update+0x9/0xc0 [ 8095.116838] [<ffffffff81314ca2>] trailing_symlink+0x62/0x260 [ 8095.116838] [<ffffffff81317173>] path_openat+0x2d3/0x1500 [ 8095.116838] [<ffffffff813193d9>] do_filp_open+0x79/0xd0 [ 8095.116838] [<ffffffff82b170c2>] ? _raw_spin_unlock+0x22/0x30 [ 8095.116838] [<ffffffff81328d98>] ? __alloc_fd+0xf8/0x200 [ 8095.116838] [<ffffffff81306eb0>] do_sys_open+0x110/0x1f0 [ 8095.116838] [<ffffffff81306fbf>] SyS_openat+0xf/0x20 [ 8095.116838] [<ffffffff82b17b76>] entry_SYSCALL_64_fastpath+0x16/0x7a [ 8095.195133] note: syz-executor[5532] exited with preempt_count 1 And here is my inode.o: https://gist.githubusercontent.com/dvyukov/27ec88c2c1a83c2e0f38/raw/2514d0ddd7720a978e6a2f67c2dcb391046ce0e7/gistfile1.txt This can be reproduced following the instructions here: https://github.com/google/syzkaller/wiki/How-to-execute-syzkaller-programs Using this command line: # ./syz-execprog -cover=0 -procs=60 -repeat=0 prog with the following program: https://gist.githubusercontent.com/dvyukov/fc026f36f9f76d1a440b/raw/0e133afa99eb7de45880523fbd48256cd2ae4a6c/gistfile1.txt (requires CONFIG_USER_NS=y). The crash triggers after hours of execution. ^ permalink raw reply related [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-23 15:34 ` Dmitry Vyukov @ 2016-02-23 18:17 ` Al Viro 0 siblings, 0 replies; 49+ messages in thread From: Al Viro @ 2016-02-23 18:17 UTC (permalink / raw) To: Dmitry Vyukov Cc: Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Tue, Feb 23, 2016 at 04:34:59PM +0100, Dmitry Vyukov wrote: > The crash: > > [ 8095.048336] ------------[ cut here ]------------ > [ 8095.048864] WARNING: CPU: 3 PID: 5532 at fs/namei.c:1672 > should_follow_link.part.25+0x55/0x21a() NULL or ERR_PTR() passed as inode to should_follow_link(). > [ 8095.060526] BUG: unable to handle kernel NULL pointer dereference > at 000000000000000c OK, NULL inode it is. And that was in do_last(). > And here is my inode.o: > https://gist.githubusercontent.com/dvyukov/27ec88c2c1a83c2e0f38/raw/2514d0ddd7720a978e6a2f67c2dcb391046ce0e7/gistfile1.txt > > This can be reproduced following the instructions here: > https://github.com/google/syzkaller/wiki/How-to-execute-syzkaller-programs > Using this command line: > # ./syz-execprog -cover=0 -procs=60 -repeat=0 prog > with the following program: > https://gist.githubusercontent.com/dvyukov/fc026f36f9f76d1a440b/raw/0e133afa99eb7de45880523fbd48256cd2ae4a6c/gistfile1.txt > (requires CONFIG_USER_NS=y). The crash triggers after hours of execution. Joy... Another interesting question is whether we'd been in RCU mode at the time of that should_follow_link(). The thing is, we could've come there either from if (!(open_flag & O_CREAT)) { if (nd->last.name[nd->last.len]) nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; /* we _can_ be in RCU mode here */ error = lookup_fast(nd, &path, &inode, &seq); if (likely(!error)) goto finish_lookup; or from BUG_ON(nd->flags & LOOKUP_RCU); inode = d_backing_inode(path.dentry); seq = 0; /* out of RCU mode, so the value doesn't matter */ if (unlikely(d_is_negative(path.dentry))) { path_to_nameidata(&path, nd); return -ENOENT; } finish_lookup: In the latter case we are holding a reference to path.dentry, so d_is_negative ought to be reliable and refering to the same backing inode. In the former, if we leave still in RCU mode, we went through *inode = d_backing_inode(dentry); negative = d_is_negative(dentry); [check that dentry->d_seq is still unchanged] ... [check that negative is false] and that guarantees that both inode and negative had been taken while dentry remained stable, so we couldn't pass through the second check with NULL inode. And returning 0 in non-RCU mode means that we go through if (unlikely(d_is_negative(dentry))) { dput(dentry); return -ENOENT; } path->mnt = mnt; path->dentry = dentry; err = follow_managed(path, nd); if (likely(!err)) *inode = d_backing_inode(path->dentry); return err; with dentry pinned, so NULL inode here is also bloody odd - we have positive dentry that will remain positive through all that and somehow follow_managed() (in non-RCU mode) gets us a negative one. Now, follow_managed() either leaves path->dentry unchanged (and keeps it pinned through all of that), or does struct vfsmount *mounted = lookup_mnt(path); if (mounted) { dput(path->dentry); if (need_mntput) mntput(path->mnt); path->mnt = mounted; path->dentry = dget(mounted->mnt_root); (and ->mnt_root should never be negative), or goes into follow_autmount(), where we either leave the damn thing unchanged or hit path->dentry = dget(mnt->mnt_root); ... or we have ->d_automount() instance doing something nasty to it. Damn. OK, a look through the instances shows that only autofs4 one might modify path->dentry: struct dentry *new = d_lookup(parent, &dentry->d_name); if (!new) return NULL; ino = autofs4_dentry_ino(new); ino->last_used = jiffies; dput(path->dentry); path->dentry = new; in autofs4_mountpoint_changed()... I doubt that this is the cause here, but let's slap WARN_ON(d_is_negative(new)) there. The thing is, I *do* see one bug around should_follow_link(), but it would manifest differently. So you must be hitting something else there, to get that NULL inode... Could you try to reproduce it with the patch below and see what warnings trigger? I'll try to reproduce it as well, but since you already have a working setup... diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c index c6d7d3d..86f81e3 100644 --- a/fs/autofs4/root.c +++ b/fs/autofs4/root.c @@ -323,6 +323,7 @@ static struct dentry *autofs4_mountpoint_changed(struct path *path) struct dentry *new = d_lookup(parent, &dentry->d_name); if (!new) return NULL; + WARN_ON(d_is_negative(new)); ino = autofs4_dentry_ino(new); ino->last_used = jiffies; dput(path->dentry); diff --git a/fs/namei.c b/fs/namei.c index f624d13..ac00bcb 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1209,6 +1209,7 @@ static int follow_managed(struct path *path, struct nameidata *nd) /* Handle an automount point */ if (managed & DCACHE_NEED_AUTOMOUNT) { ret = follow_automount(path, nd, &need_mntput); + WARN_ON(d_is_negative(path->dentry)); if (ret < 0) break; continue; @@ -1613,8 +1614,10 @@ unlazy: path->mnt = mnt; path->dentry = dentry; err = follow_managed(path, nd); - if (likely(!err)) + if (likely(!err)) { *inode = d_backing_inode(path->dentry); + WARN_ON(!inode); + } return err; need_lookup: @@ -1712,6 +1715,17 @@ static inline int should_follow_link(struct nameidata *nd, struct path *link, return 0; if (!follow) return 0; + /* make sure that d_is_symlink above matches inode */ + if (nd->flags & LOOKUP_RCU) { + if (read_seqcount_retry(&link->dentry->d_seq, seq)) { + WARN_ON(1); // just as way to report hitting + // that path; it's OK to get + // here, in the final variant + // WARN_ON will disappear. + return -ECHILD; + } + } + WARN_ON(!inode); // now, _that_ should not happen. return pick_link(nd, link, inode, seq); } @@ -3273,6 +3287,10 @@ opened: goto exit_fput; } out: + if (unlikely(error > 0)) { + WARN_ON(1); + error = -EINVAL; + } if (got_write) mnt_drop_write(nd->path.mnt); path_put(&save_parent); ^ permalink raw reply related [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-20 3:21 ` Al Viro 2016-02-20 3:54 ` Al Viro @ 2016-02-20 10:36 ` Dmitry Vyukov 1 sibling, 0 replies; 49+ messages in thread From: Dmitry Vyukov @ 2016-02-20 10:36 UTC (permalink / raw) To: Al Viro Cc: Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Sat, Feb 20, 2016 at 4:21 AM, Al Viro <viro@zeniv.linux.org.uk> wrote: > On Fri, Feb 19, 2016 at 08:32:10PM +0100, Dmitry Vyukov wrote: >> > BUG: unable to handle kernel NULL pointer dereference at 0000000000000050 > > NULL inode->i_sb, by the look of the offset, but I really don't understand > where the hell is that code doing (or how is that instruction going to > generate dereferencing of 0x50, for that matter). > >> I've hit another GPF in atime_needs_update, but this time from SyS_openat: >> >> kasan: GPF could be caused by NULL-ptr deref or user memory >> accessgeneral protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN >> Modules linked in: >> CPU: 0 PID: 20147 Comm: syz-executor Not tainted 4.5.0-rc4+ #329 >> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 >> task: ffff88005f154740 ti: ffff88005f048000 task.ti: ffff88005f048000 >> RIP: 0010:[<ffffffff81818b5d>] [<ffffffff81818b5d>] >> atime_needs_update+0x2d/0x460 >> RSP: 0018:ffff88005f04fa48 EFLAGS: 00010203 >> RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88005f04fd88 >> RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000c >> RBP: ffff88005f04fa70 R08: 0000000000000001 R09: 0000000000000000 >> R10: 0000000000000000 R11: 0000000000000001 R12: ffff88005f04fd98 >> R13: 0000000000000000 R14: ffff88005f04fd98 R15: ffff88005f04fd78 >> FS: 00007f612639b700(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000 >> CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b >> CR2: 000000002003ef84 CR3: 000000006073e000 CR4: 00000000000006f0 >> Stack: >> ffff88005f04fd40 ffff88005f04fe08 0000000000000000 ffff88005f04fd98 >> ffff88005f04fd78 ffff88005f04fab8 ffffffff817e5572 ffff88005f04fd78 >> ffff88002bcf02f8 0000000000000001 0000000000000000 ffff88002bcf02f8 >> Call Trace: >> [< inline >] get_link fs/namei.c:1006 >> [<ffffffff817e5572>] trailing_symlink+0x142/0x760 fs/namei.c:2094 >> [<ffffffff817ec531>] path_openat+0xbc1/0x5e30 fs/namei.c:3389 >> [<ffffffff817f4fde>] do_filp_open+0x18e/0x250 fs/namei.c:3421 >> [<ffffffff817b970c>] do_sys_open+0x1fc/0x420 fs/open.c:1022 >> [< inline >] SYSC_openat fs/open.c:1049 >> [<ffffffff817b99a0>] SyS_openat+0x30/0x40 fs/open.c:1043 >> [<ffffffff86662636>] entry_SYSCALL_64_fastpath+0x16/0x7a >> arch/x86/entry/entry_64.S:185 >> Code: 89 e5 41 57 41 56 41 55 41 54 49 89 fc 53 48 89 f3 e8 c8 32 d5 >> ff 48 8d 7b 0c 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> >> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 >> RIP [<ffffffff81818b5d>] atime_needs_update+0x2d/0x460 fs/inode.c:1611 >> RSP <ffff88005f04fa48> > > What was the fault address here and what config are you using for those > builds? This is with CONFIG_KASAN. GPF happens on shadow check for NULL address. In both cases: RAX: dffffc0000000000 RDX: 0000000000000001 where dffffc0000000000 is shadow base and 0000000000000001 is offset. So the original memory access was to range [8-16) (i.e. NULL with small offset). ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-16 23:40 ` Mickaël Salaün 2016-02-19 19:32 ` Dmitry Vyukov @ 2016-02-24 3:12 ` Ian Kent 2016-02-24 4:46 ` Al Viro 1 sibling, 1 reply; 49+ messages in thread From: Ian Kent @ 2016-02-24 3:12 UTC (permalink / raw) To: Mickaël Salaün, Dmitry Vyukov, Alexander Viro, linux-fsdevel, LKML Cc: syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Wed, 2016-02-17 at 00:40 +0100, Mickaël Salaün wrote: > Hi, > > Actually I found the same bug (without fuzzing) and I can reproduce it > in a deterministic way (e.g. by creating a LSM that return 1 for the > security_file_open hook). At least, from v4.2.8 I can easily trigger > traces like this : Reading through this thread I wonder if this is a new problem. Is there a previous kernel it can't be reproduced on? Perhaps a bisect will shed some light on what's happening. > > BUG: unable to handle kernel NULL pointer dereference at > 0000000000000050 > IP: [<ffffffff81170871>] atime_needs_update+0x11/0xc0 > PGD 127b17067 PUD 12ab2e067 PMD 0 > Oops: 0000 [#45] SMP > [...] > RIP: 0010:[<ffffffff81170871>] [<ffffffff81170871>] > atime_needs_update+0x11/0xc0 > RSP: 0018:ffff880127853c18 EFLAGS: 00010246 > RAX: ffff88012ad0c080 RBX: ffff88012ad0c1d8 RCX: ffff88012ad0c080 > RDX: 0000000000000000 RSI: ffff88012ad0c1d8 RDI: ffff880127853d98 > RBP: ffff880127853c28 R08: ffff8800cc0a2540 R09: ffff8800cfbfc320 > R10: ffff8800cc0a2540 R11: 0000000000000001 R12: ffff8800cb5d6300 > R13: 0000000000000000 R14: ffff88012ad0c080 R15: ffff880127853e7c > FS: 00007f1054aae700(0000) GS:ffff88012fc40000(0000) > knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000000050 CR3: 0000000127977000 CR4: 00000000000406e0 > Stack: > ffff88012ad0c1d8 ffff8800cb5d6300 ffff880127853c60 ffffffff8117094e > ffff8800c9ade3c0 0000000000000000 00000000a670294f ffff880127853d70 > ffff880127853d98 ffff880127853c98 ffffffff8116071c ffff8800cb4ada80 > Call Trace: > [<ffffffff8117094e>] ? touch_atime+0x2e/0xd0 > [<ffffffff8116071c>] ? trailing_symlink+0xec/0x280 > [<ffffffff81163a78>] ? path_openat+0x468/0x1240 > [<ffffffff8111856d>] ? pagevec_lru_move_fn+0xed/0x110 > [<ffffffff81117ff0>] ? __activate_page+0x130/0x130 > [<ffffffff8116593c>] ? do_filp_open+0x8c/0x100 > [<ffffffff81164dec>] ? filename_lookup+0xec/0x180 > [<ffffffff8115bc24>] ? do_open_execat+0x74/0x170 > [<ffffffff8115d437>] ? do_execveat_common.isra.42+0x1a7/0x6a0 > [<ffffffff8115db90>] ? SyS_execve+0x30/0x40 > [<ffffffff8156ad65>] ? stub_execve+0x5/0x5 > [<ffffffff8156aadb>] ? entry_SYSCALL_64_fastpath+0x16/0x6a > Code: 89 c7 e8 63 eb ff ff 48 89 d8 5b c3 0f 1f 40 00 66 2e 0f 1f 84 > 00 00 00 00 00 55 48 89 e5 41 54 53 f6 46 0c 02 75 72 48 8b 56 28 <48> > 8b 42 50 a9 01 04 00 00 75 63 f6 c4 08 75 65 4c 8b 27 41 8b > RIP [<ffffffff81170871>] atime_needs_update+0x11/0xc0 > RSP <ffff880127853c18> > CR2: 0000000000000050 > ---[ end trace 97dc4f4bb0214bd8 ]--- > > > Regards, > Mickaël > > > On 05/02/2016 22:11, Dmitry Vyukov wrote: > > Hello, > > > > I've hit the following GPF while running syzkaller fuzzer: > > > > general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN > > Modules linked in: > > CPU: 1 PID: 5178 Comm: syz-executor Not tainted 4.5.0-rc2+ #65 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs > > 01/01/2011 > > task: ffff880064768000 ti: ffff8800622c0000 task.ti: > > ffff8800622c0000 > > RIP: 0010:[<ffffffff8181aa5d>] [<ffffffff8181aa5d>] > > atime_needs_update+0x2d/0x460 > > RSP: 0018:ffff8800622c7a30 EFLAGS: 00010203 > > RAX: dffffc0000000000 RBX: 0000000000000000 RCX: dffffc0000000000 > > RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000c > > RBP: ffff8800622c7a58 R08: 0000000000000001 R09: 0000000000000000 > > R10: 0000000000000000 R11: 0000000000000001 R12: ffff8800622c7c08 > > R13: ffff8800622c7c08 R14: ffff8800301ca322 R15: ffff8800622c7bb0 > > FS: 00007fd1c9f8b700(0000) GS:ffff88003ed00000(0000) > > knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b > > CR2: 0000000020f31000 CR3: 0000000062274000 CR4: 00000000000006e0 > > Stack: > > ffff8800622c7bf4 0000000000000000 ffff8800622c7c08 ffff8800301ca322 > > ffff8800622c7bb0 ffff8800622c7b38 ffffffff817ecd91 ffff880030bf5200 > > ffff8800622c7bb8 1ffff1000c458f56 ffff8800622c7c00 ffff8800622c7be0 > > Call Trace: > > [< inline >] get_link fs/namei.c:1006 > > [<ffffffff817ecd91>] link_path_walk+0xaf1/0x1030 fs/namei.c:1968 > > [<ffffffff817ed311>] path_parentat+0x41/0x150 fs/namei.c:2176 > > [<ffffffff817f4c5c>] filename_parentat+0x17c/0x3c0 fs/namei.c:2198 > > [< inline >] user_path_parent fs/namei.c:2412 > > [< inline >] SYSC_renameat2 fs/namei.c:4411 > > [< inline >] SyS_renameat2 fs/namei.c:4375 > > [< inline >] SYSC_renameat fs/namei.c:4521 > > [<ffffffff817f9a72>] SyS_renameat+0x192/0x820 fs/namei.c:4518 > > [<ffffffff8669e0b6>] entry_SYSCALL_64_fastpath+0x16/0x7a > > arch/x86/entry/entry_64.S:185 > > Code: 89 e5 41 57 41 56 41 55 41 54 49 89 fc 53 48 89 f3 e8 08 25 d5 > > ff 48 8d 7b 0c 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 > > <0f> > > b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 > > RIP [<ffffffff8181aa5d>] atime_needs_update+0x2d/0x460 > > fs/inode.c:1611 > > RSP <ffff8800622c7a30> > > ---[ end trace 1a4c9bda4680ce46 ]--- > > > > On commit df48ab3c2f5ffca88b7803ffbadd074bd5a0a2ef. > > > > Objdump shows that inode is NULL in atime_needs_update. > > > > Unfortunately reproduction of this crash is very hard. The program > > executes something along the lines of: > > > > mmap(0x20000000, 15945728, PROT_READ|PROT_WRITE, > > MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 > > mkdir("./bus", 0662515705056234013740) = 0 > > openat(AT_FDCWD, "./bus", O_RDONLY|O_EXCL) = 3 > > symlinkat("../bus", 3, "./bus") = 0 > > renameat(3, "./bus", 3, "./bus/file0") = 0 > > mmap(0x20f35000, 4096, PROT_READ|PROT_WRITE, > > MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20f35000 > > mount("./bus", "./bus", 0x20f2aee4, > > MS_RDONLY|MS_NODEV|MS_RELATIME|MS_NODIRATIME|MS_BIND|MS_MOVE|MS_REC| > > MS_UNBINDABLE|MS_SLAVE|MS_SHARED|0xc000380, > > 0x20093f5f) = 0 > > open("./bus/file0", O_RDWR|O_EXCL) = -1 EISDIR (Is a directory) > > exit_group(0) = ? > > > > But in multiple threads so that some calls can be doubled and/or > > overlapped. And all this happens on a tmpfs mount. > > > > But I was able to reproduce it 8 or so times, so I am sure that it > > is real. > > > > For future reference, I was running these programs: > > https://gist.githubusercontent.com/dvyukov/124c457d308fa724d88a/raw/ > > fec2d86e125a7fd2fa2916791d65d7daead7cbbb/gistfile1.txt > > Following these instructions: > > https://github.com/google/syzkaller/wiki/How-to-execute-syzkaller-pr > > ograms > > > > ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-24 3:12 ` Ian Kent @ 2016-02-24 4:46 ` Al Viro 0 siblings, 0 replies; 49+ messages in thread From: Al Viro @ 2016-02-24 4:46 UTC (permalink / raw) To: Ian Kent Cc: Mickaël Salaün, Dmitry Vyukov, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Wed, Feb 24, 2016 at 11:12:13AM +0800, Ian Kent wrote: > On Wed, 2016-02-17 at 00:40 +0100, Mickaël Salaün wrote: > > Hi, > > > > Actually I found the same bug (without fuzzing) and I can reproduce it > > in a deterministic way (e.g. by creating a LSM that return 1 for the > > security_file_open hook). At least, from v4.2.8 I can easily trigger > > traces like this : > > Reading through this thread I wonder if this is a new problem. > > Is there a previous kernel it can't be reproduced on? > Perhaps a bisect will shed some light on what's happening. There are several things in the mix. What Mickaël has found is that a bunch of places where _positive_ number returned instead of expected 0 or -E... can get propagated all way back to caller of do_last(), confusing the hell out of it. That's not what Dmitry has triggered, though. WARN_ON() in the end of do_last() would've triggered, and IMO this one, along with mitigation (map that "error value" to -EINVAL) should go into mainline and all -stable. Bogus ->open() returning a positive number had always been bad news; in the best case it would be returned to userland, leading to "open(2) has failed and returned a positive number". Hell knows if we ever had such instances (or have them right now), but I wouldn't bet on their absense. Rare failure exits returning bogus values in an ->open() instance in some driver can easily stay unnoticed for a long time. Starting from at least 3.6 (circa the atomic_open support) it got more unpleasant than simple "confuse the hell out of userland". ->open() isn't the only vector for injection of such crap - ->permission() would also serve, same for several LSM turds, etc. Again, that's a separate problem. What Dmitry seems to be catching is getting crap values fed to should_follow_link() as inode. I see one bug in that area that does need fixing (fix present in the last patch I've posted, with WARN_ON() to indicate that this thing has triggered; _that_ WARN_ON() should be gone from the final variant, since this can trigger without driver bugs, etc.) In RCU mode after we'd checked that dentry is a symlink one, we need to verify that it hadn't been changed since before we'd fetched the inode. It might have been e.g. a regular file, which got unlinked with symlink created in its place. Then we'd go into get_link() with non-symlink inode and oops on attempt to call its ->i_op->get_link(). That race is real, very hard to hit (you need both the unlink(2) and symlink(2) to happen between lookup_fast() and should_follow_link() and unless you have PREEMPT_RCU you can't lose the timeslice there) and would've manifested differently. But that leaves other two kinds of bugs getting triggered: inode of some non-symlink is possible, but what we saw included NULL inode when we'd reached finish_open: in do_last(). Should be flat-out impossible - we either get lookup_fast(..., &inode, ...) return 0 and store NULL in inode, or get NULL inode from pinned d_is_symlink() dentry after having grabbed a reference and left RCU mode. Neither should be possible without either something weird happening to lookup_fast() (and we would've seen oopsen in link_path_walk() if that could happen, BTW) or screwed dentry refcounting somewhere, combined with a race that managed to turn... Oh, shit. No screwed refcounting is needed. Look: BUG_ON(nd->flags & LOOKUP_RCU); inode = d_backing_inode(path.dentry); seq = 0; /* out of RCU mode, so the value doesn't matter */ if (unlikely(d_is_negative(path.dentry))) { path_to_nameidata(&path, nd); return -ENOENT; } Suppose we come here with negative path.dentry. We are holding a reference, all right, and for a _postive_ dentry that would've been enough to keep it positive. Not so for a negative one, though - symlink(2) on another CPU doint d_instantiate() just before the d_is_negative() check and we are fucked - inode is stale and we sail through all the checks, all the way into should_follow_link(). We also have the same kind of crap in walk_component() - err = lookup_slow(nd, &path); if (err < 0) return err; inode = d_backing_inode(path.dentry); seq = 0; /* we are already out of RCU mode */ err = -ENOENT; if (d_is_negative(path.dentry)) goto out_path_put; There it's much harder to hit, though - we need it not just d_instantiate() overlapping those lines; we need the racing syscall to get from locking the parent to d_instantiate() between the point where lookup_slow() has unlocked the parent and d_is_negative(). And lookup_slow() couldn't have gone into mountpoint crossing, so it's really hard to hit - you pretty much have to get preempted just after fetching inode. OK, the next delta to try, and there definitely are several commits in that pile. It still does not explain the traces with GPF at 0x50, though - for that we need not just a NULL getting to should_follow_link() but something non-NULL with NULL at offset 40 from it (offset of ->i_sb in struct inode). That something *can't* be a valid struct inode or had been one in recent past - ->i_sb is assigned in new_inode(), value is always non-NULL and never modified all the way until RCU-delayed freeing of struct inode. So that has to be something entirely different... Anyway, the patch so far follows: diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c index c6d7d3d..86f81e3 100644 --- a/fs/autofs4/root.c +++ b/fs/autofs4/root.c @@ -323,6 +323,7 @@ static struct dentry *autofs4_mountpoint_changed(struct path *path) struct dentry *new = d_lookup(parent, &dentry->d_name); if (!new) return NULL; + WARN_ON(d_is_negative(new)); ino = autofs4_dentry_ino(new); ino->last_used = jiffies; dput(path->dentry); diff --git a/fs/namei.c b/fs/namei.c index f624d13..a5bcf63 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1209,6 +1209,7 @@ static int follow_managed(struct path *path, struct nameidata *nd) /* Handle an automount point */ if (managed & DCACHE_NEED_AUTOMOUNT) { ret = follow_automount(path, nd, &need_mntput); + WARN_ON(d_is_negative(path->dentry)); if (ret < 0) break; continue; @@ -1613,8 +1614,10 @@ unlazy: path->mnt = mnt; path->dentry = dentry; err = follow_managed(path, nd); - if (likely(!err)) + if (likely(!err)) { *inode = d_backing_inode(path->dentry); + WARN_ON(!inode); + } return err; need_lookup: @@ -1712,6 +1715,17 @@ static inline int should_follow_link(struct nameidata *nd, struct path *link, return 0; if (!follow) return 0; + /* make sure that d_is_symlink above matches inode */ + if (nd->flags & LOOKUP_RCU) { + if (read_seqcount_retry(&link->dentry->d_seq, seq)) { + WARN_ON(1); // just as way to report hitting + // that path; it's OK to get + // here, in the final variant + // WARN_ON will disappear. + return -ECHILD; + } + } + WARN_ON(!inode); // now, _that_ should not happen. return pick_link(nd, link, inode, seq); } @@ -1743,11 +1757,11 @@ static int walk_component(struct nameidata *nd, int flags) if (err < 0) return err; - inode = d_backing_inode(path.dentry); seq = 0; /* we are already out of RCU mode */ err = -ENOENT; if (d_is_negative(path.dentry)) goto out_path_put; + inode = d_backing_inode(path.dentry); } if (flags & WALK_PUT) @@ -3192,12 +3206,12 @@ retry_lookup: return error; BUG_ON(nd->flags & LOOKUP_RCU); - inode = d_backing_inode(path.dentry); seq = 0; /* out of RCU mode, so the value doesn't matter */ if (unlikely(d_is_negative(path.dentry))) { path_to_nameidata(&path, nd); return -ENOENT; } + inode = d_backing_inode(path.dentry); finish_lookup: if (nd->depth) put_link(nd); @@ -3206,11 +3220,6 @@ finish_lookup: if (unlikely(error)) return error; - if (unlikely(d_is_symlink(path.dentry)) && !(open_flag & O_PATH)) { - path_to_nameidata(&path, nd); - return -ELOOP; - } - if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path.mnt) { path_to_nameidata(&path, nd); } else { @@ -3229,6 +3238,10 @@ finish_open: return error; } audit_inode(nd->name, nd->path.dentry, 0); + if (unlikely(d_is_symlink(nd->path.dentry)) && !(open_flag & O_PATH)) { + error = -ELOOP; + goto out; + } error = -EISDIR; if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry)) goto out; @@ -3273,6 +3286,10 @@ opened: goto exit_fput; } out: + if (unlikely(error > 0)) { + WARN_ON(1); + error = -EINVAL; + } if (got_write) mnt_drop_write(nd->path.mnt); path_put(&save_parent); ^ permalink raw reply related [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update @ 2016-02-24 4:46 ` Al Viro 0 siblings, 0 replies; 49+ messages in thread From: Al Viro @ 2016-02-24 4:46 UTC (permalink / raw) To: Ian Kent Cc: Mickaël Salaün, Dmitry Vyukov, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Wed, Feb 24, 2016 at 11:12:13AM +0800, Ian Kent wrote: > On Wed, 2016-02-17 at 00:40 +0100, Micka�l Sala�n wrote: > > Hi, > > > > Actually I found the same bug (without fuzzing) and I can reproduce it > > in a deterministic way (e.g. by creating a LSM that return 1 for the > > security_file_open hook). At least, from v4.2.8 I can easily trigger > > traces like this : > > Reading through this thread I wonder if this is a new problem. > > Is there a previous kernel it can't be reproduced on? > Perhaps a bisect will shed some light on what's happening. There are several things in the mix. What Micka�l has found is that a bunch of places where _positive_ number returned instead of expected 0 or -E... can get propagated all way back to caller of do_last(), confusing the hell out of it. That's not what Dmitry has triggered, though. WARN_ON() in the end of do_last() would've triggered, and IMO this one, along with mitigation (map that "error value" to -EINVAL) should go into mainline and all -stable. Bogus ->open() returning a positive number had always been bad news; in the best case it would be returned to userland, leading to "open(2) has failed and returned a positive number". Hell knows if we ever had such instances (or have them right now), but I wouldn't bet on their absense. Rare failure exits returning bogus values in an ->open() instance in some driver can easily stay unnoticed for a long time. Starting from at least 3.6 (circa the atomic_open support) it got more unpleasant than simple "confuse the hell out of userland". ->open() isn't the only vector for injection of such crap - ->permission() would also serve, same for several LSM turds, etc. Again, that's a separate problem. What Dmitry seems to be catching is getting crap values fed to should_follow_link() as inode. I see one bug in that area that does need fixing (fix present in the last patch I've posted, with WARN_ON() to indicate that this thing has triggered; _that_ WARN_ON() should be gone from the final variant, since this can trigger without driver bugs, etc.) In RCU mode after we'd checked that dentry is a symlink one, we need to verify that it hadn't been changed since before we'd fetched the inode. It might have been e.g. a regular file, which got unlinked with symlink created in its place. Then we'd go into get_link() with non-symlink inode and oops on attempt to call its ->i_op->get_link(). That race is real, very hard to hit (you need both the unlink(2) and symlink(2) to happen between lookup_fast() and should_follow_link() and unless you have PREEMPT_RCU you can't lose the timeslice there) and would've manifested differently. But that leaves other two kinds of bugs getting triggered: inode of some non-symlink is possible, but what we saw included NULL inode when we'd reached finish_open: in do_last(). Should be flat-out impossible - we either get lookup_fast(..., &inode, ...) return 0 and store NULL in inode, or get NULL inode from pinned d_is_symlink() dentry after having grabbed a reference and left RCU mode. Neither should be possible without either something weird happening to lookup_fast() (and we would've seen oopsen in link_path_walk() if that could happen, BTW) or screwed dentry refcounting somewhere, combined with a race that managed to turn... Oh, shit. No screwed refcounting is needed. Look: BUG_ON(nd->flags & LOOKUP_RCU); inode = d_backing_inode(path.dentry); seq = 0; /* out of RCU mode, so the value doesn't matter */ if (unlikely(d_is_negative(path.dentry))) { path_to_nameidata(&path, nd); return -ENOENT; } Suppose we come here with negative path.dentry. We are holding a reference, all right, and for a _postive_ dentry that would've been enough to keep it positive. Not so for a negative one, though - symlink(2) on another CPU doint d_instantiate() just before the d_is_negative() check and we are fucked - inode is stale and we sail through all the checks, all the way into should_follow_link(). We also have the same kind of crap in walk_component() - err = lookup_slow(nd, &path); if (err < 0) return err; inode = d_backing_inode(path.dentry); seq = 0; /* we are already out of RCU mode */ err = -ENOENT; if (d_is_negative(path.dentry)) goto out_path_put; There it's much harder to hit, though - we need it not just d_instantiate() overlapping those lines; we need the racing syscall to get from locking the parent to d_instantiate() between the point where lookup_slow() has unlocked the parent and d_is_negative(). And lookup_slow() couldn't have gone into mountpoint crossing, so it's really hard to hit - you pretty much have to get preempted just after fetching inode. OK, the next delta to try, and there definitely are several commits in that pile. It still does not explain the traces with GPF at 0x50, though - for that we need not just a NULL getting to should_follow_link() but something non-NULL with NULL at offset 40 from it (offset of ->i_sb in struct inode). That something *can't* be a valid struct inode or had been one in recent past - ->i_sb is assigned in new_inode(), value is always non-NULL and never modified all the way until RCU-delayed freeing of struct inode. So that has to be something entirely different... Anyway, the patch so far follows: diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c index c6d7d3d..86f81e3 100644 --- a/fs/autofs4/root.c +++ b/fs/autofs4/root.c @@ -323,6 +323,7 @@ static struct dentry *autofs4_mountpoint_changed(struct path *path) struct dentry *new = d_lookup(parent, &dentry->d_name); if (!new) return NULL; + WARN_ON(d_is_negative(new)); ino = autofs4_dentry_ino(new); ino->last_used = jiffies; dput(path->dentry); diff --git a/fs/namei.c b/fs/namei.c index f624d13..a5bcf63 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1209,6 +1209,7 @@ static int follow_managed(struct path *path, struct nameidata *nd) /* Handle an automount point */ if (managed & DCACHE_NEED_AUTOMOUNT) { ret = follow_automount(path, nd, &need_mntput); + WARN_ON(d_is_negative(path->dentry)); if (ret < 0) break; continue; @@ -1613,8 +1614,10 @@ unlazy: path->mnt = mnt; path->dentry = dentry; err = follow_managed(path, nd); - if (likely(!err)) + if (likely(!err)) { *inode = d_backing_inode(path->dentry); + WARN_ON(!inode); + } return err; need_lookup: @@ -1712,6 +1715,17 @@ static inline int should_follow_link(struct nameidata *nd, struct path *link, return 0; if (!follow) return 0; + /* make sure that d_is_symlink above matches inode */ + if (nd->flags & LOOKUP_RCU) { + if (read_seqcount_retry(&link->dentry->d_seq, seq)) { + WARN_ON(1); // just as way to report hitting + // that path; it's OK to get + // here, in the final variant + // WARN_ON will disappear. + return -ECHILD; + } + } + WARN_ON(!inode); // now, _that_ should not happen. return pick_link(nd, link, inode, seq); } @@ -1743,11 +1757,11 @@ static int walk_component(struct nameidata *nd, int flags) if (err < 0) return err; - inode = d_backing_inode(path.dentry); seq = 0; /* we are already out of RCU mode */ err = -ENOENT; if (d_is_negative(path.dentry)) goto out_path_put; + inode = d_backing_inode(path.dentry); } if (flags & WALK_PUT) @@ -3192,12 +3206,12 @@ retry_lookup: return error; BUG_ON(nd->flags & LOOKUP_RCU); - inode = d_backing_inode(path.dentry); seq = 0; /* out of RCU mode, so the value doesn't matter */ if (unlikely(d_is_negative(path.dentry))) { path_to_nameidata(&path, nd); return -ENOENT; } + inode = d_backing_inode(path.dentry); finish_lookup: if (nd->depth) put_link(nd); @@ -3206,11 +3220,6 @@ finish_lookup: if (unlikely(error)) return error; - if (unlikely(d_is_symlink(path.dentry)) && !(open_flag & O_PATH)) { - path_to_nameidata(&path, nd); - return -ELOOP; - } - if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path.mnt) { path_to_nameidata(&path, nd); } else { @@ -3229,6 +3238,10 @@ finish_open: return error; } audit_inode(nd->name, nd->path.dentry, 0); + if (unlikely(d_is_symlink(nd->path.dentry)) && !(open_flag & O_PATH)) { + error = -ELOOP; + goto out; + } error = -EISDIR; if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry)) goto out; @@ -3273,6 +3286,10 @@ opened: goto exit_fput; } out: + if (unlikely(error > 0)) { + WARN_ON(1); + error = -EINVAL; + } if (got_write) mnt_drop_write(nd->path.mnt); path_put(&save_parent); ^ permalink raw reply related [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-24 4:46 ` Al Viro (?) @ 2016-02-24 10:03 ` Dmitry Vyukov 2016-02-24 10:15 ` Dmitry Vyukov -1 siblings, 1 reply; 49+ messages in thread From: Dmitry Vyukov @ 2016-02-24 10:03 UTC (permalink / raw) To: Al Viro Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Wed, Feb 24, 2016 at 5:46 AM, Al Viro <viro@zeniv.linux.org.uk> wrote: > On Wed, Feb 24, 2016 at 11:12:13AM +0800, Ian Kent wrote: >> On Wed, 2016-02-17 at 00:40 +0100, Mickaël Salaün wrote: >> > Hi, >> > >> > Actually I found the same bug (without fuzzing) and I can reproduce it >> > in a deterministic way (e.g. by creating a LSM that return 1 for the >> > security_file_open hook). At least, from v4.2.8 I can easily trigger >> > traces like this : >> >> Reading through this thread I wonder if this is a new problem. >> >> Is there a previous kernel it can't be reproduced on? >> Perhaps a bisect will shed some light on what's happening. > > There are several things in the mix. What Mickaël has found is that a bunch > of places where _positive_ number returned instead of expected 0 or -E... can > get propagated all way back to caller of do_last(), confusing the hell out > of it. That's not what Dmitry has triggered, though. WARN_ON() in the > end of do_last() would've triggered, and IMO this one, along with mitigation > (map that "error value" to -EINVAL) should go into mainline and all -stable. > Bogus ->open() returning a positive number had always been bad news; in the > best case it would be returned to userland, leading to "open(2) has failed > and returned a positive number". Hell knows if we ever had such instances > (or have them right now), but I wouldn't bet on their absense. Rare > failure exits returning bogus values in an ->open() instance in some driver > can easily stay unnoticed for a long time. Starting from at least 3.6 > (circa the atomic_open support) it got more unpleasant than simple "confuse > the hell out of userland". ->open() isn't the only vector for injection of > such crap - ->permission() would also serve, same for several LSM turds, etc. > > Again, that's a separate problem. What Dmitry seems to be catching is getting > crap values fed to should_follow_link() as inode. I see one bug in that > area that does need fixing (fix present in the last patch I've posted, with > WARN_ON() to indicate that this thing has triggered; _that_ WARN_ON() should > be gone from the final variant, since this can trigger without driver bugs, > etc.) In RCU mode after we'd checked that dentry is a symlink one, we need > to verify that it hadn't been changed since before we'd fetched the inode. > It might have been e.g. a regular file, which got unlinked with symlink > created in its place. Then we'd go into get_link() with non-symlink inode > and oops on attempt to call its ->i_op->get_link(). That race is real, very > hard to hit (you need both the unlink(2) and symlink(2) to happen between > lookup_fast() and should_follow_link() and unless you have PREEMPT_RCU you > can't lose the timeslice there) and would've manifested differently. > > But that leaves other two kinds of bugs getting triggered: inode of some > non-symlink is possible, but what we saw included NULL inode when we'd > reached finish_open: in do_last(). Should be flat-out impossible - we either > get lookup_fast(..., &inode, ...) return 0 and store NULL in inode, or > get NULL inode from pinned d_is_symlink() dentry after having grabbed > a reference and left RCU mode. Neither should be possible without either > something weird happening to lookup_fast() (and we would've seen oopsen in > link_path_walk() if that could happen, BTW) or screwed dentry refcounting > somewhere, combined with a race that managed to turn... > > Oh, shit. No screwed refcounting is needed. Look: > BUG_ON(nd->flags & LOOKUP_RCU); > inode = d_backing_inode(path.dentry); > seq = 0; /* out of RCU mode, so the value doesn't matter */ > if (unlikely(d_is_negative(path.dentry))) { > path_to_nameidata(&path, nd); > return -ENOENT; > } > Suppose we come here with negative path.dentry. We are holding a reference, > all right, and for a _postive_ dentry that would've been enough to keep > it positive. Not so for a negative one, though - symlink(2) on another > CPU doint d_instantiate() just before the d_is_negative() check and we > are fucked - inode is stale and we sail through all the checks, all the > way into should_follow_link(). > > We also have the same kind of crap in walk_component() - > err = lookup_slow(nd, &path); > if (err < 0) > return err; > inode = d_backing_inode(path.dentry); > seq = 0; /* we are already out of RCU mode */ > err = -ENOENT; > if (d_is_negative(path.dentry)) > goto out_path_put; > There it's much harder to hit, though - we need it not just d_instantiate() > overlapping those lines; we need the racing syscall to get from locking > the parent to d_instantiate() between the point where lookup_slow() has > unlocked the parent and d_is_negative(). And lookup_slow() couldn't have > gone into mountpoint crossing, so it's really hard to hit - you pretty > much have to get preempted just after fetching inode. > > OK, the next delta to try, and there definitely are several commits in > that pile. It still does not explain the traces with GPF at 0x50, though - > for that we need not just a NULL getting to should_follow_link() but > something non-NULL with NULL at offset 40 from it (offset of ->i_sb in > struct inode). That something *can't* be a valid struct inode or had been > one in recent past - ->i_sb is assigned in new_inode(), value is always > non-NULL and never modified all the way until RCU-delayed freeing of struct > inode. So that has to be something entirely different... Anyway, the > patch so far follows: Restarted testing with this patch (dropped previous patches because they conflict). These "unlikely" scenarios can be more likely inside of VMs where effective preemption can happen at random points. Also NMIs probably can increase probability of such races. ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-24 10:03 ` Dmitry Vyukov @ 2016-02-24 10:15 ` Dmitry Vyukov 2016-02-24 13:35 ` Dmitry Vyukov 0 siblings, 1 reply; 49+ messages in thread From: Dmitry Vyukov @ 2016-02-24 10:15 UTC (permalink / raw) To: Al Viro Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Wed, Feb 24, 2016 at 11:03 AM, Dmitry Vyukov <dvyukov@google.com> wrote: > On Wed, Feb 24, 2016 at 5:46 AM, Al Viro <viro@zeniv.linux.org.uk> wrote: >> On Wed, Feb 24, 2016 at 11:12:13AM +0800, Ian Kent wrote: >>> On Wed, 2016-02-17 at 00:40 +0100, Mickaël Salaün wrote: >>> > Hi, >>> > >>> > Actually I found the same bug (without fuzzing) and I can reproduce it >>> > in a deterministic way (e.g. by creating a LSM that return 1 for the >>> > security_file_open hook). At least, from v4.2.8 I can easily trigger >>> > traces like this : >>> >>> Reading through this thread I wonder if this is a new problem. >>> >>> Is there a previous kernel it can't be reproduced on? >>> Perhaps a bisect will shed some light on what's happening. >> >> There are several things in the mix. What Mickaël has found is that a bunch >> of places where _positive_ number returned instead of expected 0 or -E... can >> get propagated all way back to caller of do_last(), confusing the hell out >> of it. That's not what Dmitry has triggered, though. WARN_ON() in the >> end of do_last() would've triggered, and IMO this one, along with mitigation >> (map that "error value" to -EINVAL) should go into mainline and all -stable. >> Bogus ->open() returning a positive number had always been bad news; in the >> best case it would be returned to userland, leading to "open(2) has failed >> and returned a positive number". Hell knows if we ever had such instances >> (or have them right now), but I wouldn't bet on their absense. Rare >> failure exits returning bogus values in an ->open() instance in some driver >> can easily stay unnoticed for a long time. Starting from at least 3.6 >> (circa the atomic_open support) it got more unpleasant than simple "confuse >> the hell out of userland". ->open() isn't the only vector for injection of >> such crap - ->permission() would also serve, same for several LSM turds, etc. >> >> Again, that's a separate problem. What Dmitry seems to be catching is getting >> crap values fed to should_follow_link() as inode. I see one bug in that >> area that does need fixing (fix present in the last patch I've posted, with >> WARN_ON() to indicate that this thing has triggered; _that_ WARN_ON() should >> be gone from the final variant, since this can trigger without driver bugs, >> etc.) In RCU mode after we'd checked that dentry is a symlink one, we need >> to verify that it hadn't been changed since before we'd fetched the inode. >> It might have been e.g. a regular file, which got unlinked with symlink >> created in its place. Then we'd go into get_link() with non-symlink inode >> and oops on attempt to call its ->i_op->get_link(). That race is real, very >> hard to hit (you need both the unlink(2) and symlink(2) to happen between >> lookup_fast() and should_follow_link() and unless you have PREEMPT_RCU you >> can't lose the timeslice there) and would've manifested differently. >> >> But that leaves other two kinds of bugs getting triggered: inode of some >> non-symlink is possible, but what we saw included NULL inode when we'd >> reached finish_open: in do_last(). Should be flat-out impossible - we either >> get lookup_fast(..., &inode, ...) return 0 and store NULL in inode, or >> get NULL inode from pinned d_is_symlink() dentry after having grabbed >> a reference and left RCU mode. Neither should be possible without either >> something weird happening to lookup_fast() (and we would've seen oopsen in >> link_path_walk() if that could happen, BTW) or screwed dentry refcounting >> somewhere, combined with a race that managed to turn... >> >> Oh, shit. No screwed refcounting is needed. Look: >> BUG_ON(nd->flags & LOOKUP_RCU); >> inode = d_backing_inode(path.dentry); >> seq = 0; /* out of RCU mode, so the value doesn't matter */ >> if (unlikely(d_is_negative(path.dentry))) { >> path_to_nameidata(&path, nd); >> return -ENOENT; >> } >> Suppose we come here with negative path.dentry. We are holding a reference, >> all right, and for a _postive_ dentry that would've been enough to keep >> it positive. Not so for a negative one, though - symlink(2) on another >> CPU doint d_instantiate() just before the d_is_negative() check and we >> are fucked - inode is stale and we sail through all the checks, all the >> way into should_follow_link(). >> >> We also have the same kind of crap in walk_component() - >> err = lookup_slow(nd, &path); >> if (err < 0) >> return err; >> inode = d_backing_inode(path.dentry); >> seq = 0; /* we are already out of RCU mode */ >> err = -ENOENT; >> if (d_is_negative(path.dentry)) >> goto out_path_put; >> There it's much harder to hit, though - we need it not just d_instantiate() >> overlapping those lines; we need the racing syscall to get from locking >> the parent to d_instantiate() between the point where lookup_slow() has >> unlocked the parent and d_is_negative(). And lookup_slow() couldn't have >> gone into mountpoint crossing, so it's really hard to hit - you pretty >> much have to get preempted just after fetching inode. >> >> OK, the next delta to try, and there definitely are several commits in >> that pile. It still does not explain the traces with GPF at 0x50, though - >> for that we need not just a NULL getting to should_follow_link() but >> something non-NULL with NULL at offset 40 from it (offset of ->i_sb in >> struct inode). That something *can't* be a valid struct inode or had been >> one in recent past - ->i_sb is assigned in new_inode(), value is always >> non-NULL and never modified all the way until RCU-delayed freeing of struct >> inode. So that has to be something entirely different... Anyway, the >> patch so far follows: > > > Restarted testing with this patch (dropped previous patches because > they conflict). > > These "unlikely" scenarios can be more likely inside of VMs where > effective preemption can happen at random points. Also NMIs probably > can increase probability of such races. For now I can only say that I am hitting this one (3 times in 20 mins): if (read_seqcount_retry(&link->dentry->d_seq, seq)) { WARN_ON(1); // just as way to report hitting // that path; it's OK to get // here, in the final variant // WARN_ON will disappear. ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-24 10:15 ` Dmitry Vyukov @ 2016-02-24 13:35 ` Dmitry Vyukov 2016-02-24 15:15 ` Al Viro 0 siblings, 1 reply; 49+ messages in thread From: Dmitry Vyukov @ 2016-02-24 13:35 UTC (permalink / raw) To: Al Viro Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Wed, Feb 24, 2016 at 11:15 AM, Dmitry Vyukov <dvyukov@google.com> wrote: > On Wed, Feb 24, 2016 at 11:03 AM, Dmitry Vyukov <dvyukov@google.com> wrote: >> On Wed, Feb 24, 2016 at 5:46 AM, Al Viro <viro@zeniv.linux.org.uk> wrote: >>> On Wed, Feb 24, 2016 at 11:12:13AM +0800, Ian Kent wrote: >>>> On Wed, 2016-02-17 at 00:40 +0100, Mickaël Salaün wrote: >>>> > Hi, >>>> > >>>> > Actually I found the same bug (without fuzzing) and I can reproduce it >>>> > in a deterministic way (e.g. by creating a LSM that return 1 for the >>>> > security_file_open hook). At least, from v4.2.8 I can easily trigger >>>> > traces like this : >>>> >>>> Reading through this thread I wonder if this is a new problem. >>>> >>>> Is there a previous kernel it can't be reproduced on? >>>> Perhaps a bisect will shed some light on what's happening. >>> >>> There are several things in the mix. What Mickaël has found is that a bunch >>> of places where _positive_ number returned instead of expected 0 or -E... can >>> get propagated all way back to caller of do_last(), confusing the hell out >>> of it. That's not what Dmitry has triggered, though. WARN_ON() in the >>> end of do_last() would've triggered, and IMO this one, along with mitigation >>> (map that "error value" to -EINVAL) should go into mainline and all -stable. >>> Bogus ->open() returning a positive number had always been bad news; in the >>> best case it would be returned to userland, leading to "open(2) has failed >>> and returned a positive number". Hell knows if we ever had such instances >>> (or have them right now), but I wouldn't bet on their absense. Rare >>> failure exits returning bogus values in an ->open() instance in some driver >>> can easily stay unnoticed for a long time. Starting from at least 3.6 >>> (circa the atomic_open support) it got more unpleasant than simple "confuse >>> the hell out of userland". ->open() isn't the only vector for injection of >>> such crap - ->permission() would also serve, same for several LSM turds, etc. >>> >>> Again, that's a separate problem. What Dmitry seems to be catching is getting >>> crap values fed to should_follow_link() as inode. I see one bug in that >>> area that does need fixing (fix present in the last patch I've posted, with >>> WARN_ON() to indicate that this thing has triggered; _that_ WARN_ON() should >>> be gone from the final variant, since this can trigger without driver bugs, >>> etc.) In RCU mode after we'd checked that dentry is a symlink one, we need >>> to verify that it hadn't been changed since before we'd fetched the inode. >>> It might have been e.g. a regular file, which got unlinked with symlink >>> created in its place. Then we'd go into get_link() with non-symlink inode >>> and oops on attempt to call its ->i_op->get_link(). That race is real, very >>> hard to hit (you need both the unlink(2) and symlink(2) to happen between >>> lookup_fast() and should_follow_link() and unless you have PREEMPT_RCU you >>> can't lose the timeslice there) and would've manifested differently. >>> >>> But that leaves other two kinds of bugs getting triggered: inode of some >>> non-symlink is possible, but what we saw included NULL inode when we'd >>> reached finish_open: in do_last(). Should be flat-out impossible - we either >>> get lookup_fast(..., &inode, ...) return 0 and store NULL in inode, or >>> get NULL inode from pinned d_is_symlink() dentry after having grabbed >>> a reference and left RCU mode. Neither should be possible without either >>> something weird happening to lookup_fast() (and we would've seen oopsen in >>> link_path_walk() if that could happen, BTW) or screwed dentry refcounting >>> somewhere, combined with a race that managed to turn... >>> >>> Oh, shit. No screwed refcounting is needed. Look: >>> BUG_ON(nd->flags & LOOKUP_RCU); >>> inode = d_backing_inode(path.dentry); >>> seq = 0; /* out of RCU mode, so the value doesn't matter */ >>> if (unlikely(d_is_negative(path.dentry))) { >>> path_to_nameidata(&path, nd); >>> return -ENOENT; >>> } >>> Suppose we come here with negative path.dentry. We are holding a reference, >>> all right, and for a _postive_ dentry that would've been enough to keep >>> it positive. Not so for a negative one, though - symlink(2) on another >>> CPU doint d_instantiate() just before the d_is_negative() check and we >>> are fucked - inode is stale and we sail through all the checks, all the >>> way into should_follow_link(). >>> >>> We also have the same kind of crap in walk_component() - >>> err = lookup_slow(nd, &path); >>> if (err < 0) >>> return err; >>> inode = d_backing_inode(path.dentry); >>> seq = 0; /* we are already out of RCU mode */ >>> err = -ENOENT; >>> if (d_is_negative(path.dentry)) >>> goto out_path_put; >>> There it's much harder to hit, though - we need it not just d_instantiate() >>> overlapping those lines; we need the racing syscall to get from locking >>> the parent to d_instantiate() between the point where lookup_slow() has >>> unlocked the parent and d_is_negative(). And lookup_slow() couldn't have >>> gone into mountpoint crossing, so it's really hard to hit - you pretty >>> much have to get preempted just after fetching inode. >>> >>> OK, the next delta to try, and there definitely are several commits in >>> that pile. It still does not explain the traces with GPF at 0x50, though - >>> for that we need not just a NULL getting to should_follow_link() but >>> something non-NULL with NULL at offset 40 from it (offset of ->i_sb in >>> struct inode). That something *can't* be a valid struct inode or had been >>> one in recent past - ->i_sb is assigned in new_inode(), value is always >>> non-NULL and never modified all the way until RCU-delayed freeing of struct >>> inode. So that has to be something entirely different... Anyway, the >>> patch so far follows: Fired after some time: [ 3491.147607] ------------[ cut here ]------------ [ 3491.147986] WARNING: CPU: 1 PID: 17000 at fs/namei.c:1728 path_openat+0x14e5/0x1560() [ 3491.148576] Modules linked in: [ 3491.148818] CPU: 1 PID: 17000 Comm: syz-executor Tainted: G W 4.5.0-rc5+ #72 [ 3491.149530] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 [ 3491.149530] 0000000000000000 ffff88002d6ebcb8 ffffffff8194ad79 0000000000000000 [ 3491.152103] ffffffff8334501c ffff88002d6ebcf0 ffffffff81172291 0000000000000000 [ 3491.152103] ffff88002d6ebd98 ffff88002d6ebde0 0000000000048000 ffff88002d6ebefc [ 3491.155310] Call Trace: [ 3491.155310] [<ffffffff8194ad79>] dump_stack+0x99/0xd0 [ 3491.155310] [<ffffffff81172291>] warn_slowpath_common+0x81/0xc0 [ 3491.157483] [<ffffffff81172385>] warn_slowpath_null+0x15/0x20 [ 3491.157483] [<ffffffff81318495>] path_openat+0x14e5/0x1560 [ 3491.157483] [<ffffffff81319549>] do_filp_open+0x79/0xd0 [ 3491.157483] [<ffffffff82b11d92>] ? _raw_spin_unlock+0x22/0x30 [ 3491.157483] [<ffffffff81328f08>] ? __alloc_fd+0xf8/0x200 [ 3491.157483] [<ffffffff81306eb0>] do_sys_open+0x110/0x1f0 [ 3491.157483] [<ffffffff81306fbf>] SyS_openat+0xf/0x20 [ 3491.157483] [<ffffffff82b12836>] entry_SYSCALL_64_fastpath+0x16/0x7a [ 3491.161521] ---[ end trace c65af9be7536efae ]--- [ 3491.161838] BUG: unable to handle kernel NULL pointer dereference at 000000000000000c [ 3491.162339] IP: [<ffffffff81327429>] atime_needs_update+0x9/0xc0 [ 3491.162577] PGD 2d626067 PUD 2c4cc067 PMD 0 [ 3491.163036] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC [ 3491.163039] Modules linked in: [ 3491.163039] CPU: 1 PID: 17000 Comm: syz-executor Tainted: G W 4.5.0-rc5+ #72 [ 3491.163039] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 [ 3491.164386] task: ffff88002c9196c0 ti: ffff88002d6e8000 task.ti: ffff88002d6e8000 [ 3491.164386] RIP: 0010:[<ffffffff81327429>] [<ffffffff81327429>] atime_needs_update+0x9/0xc0 [ 3491.164386] RSP: 0018:ffff88002d6ebcb0 EFLAGS: 00010282 [ 3491.165591] RAX: 0000000000000030 RBX: ffff88002d6ebde0 RCX: 0000000000000002 [ 3491.165591] RDX: ffff88002d6ebe38 RSI: 0000000000000000 RDI: ffff88002d6ebe38 [ 3491.165591] RBP: ffff88002d6ebcc0 R08: ffff88002d6ebe38 R09: 0000000000000001 [ 3491.167202] R10: 0000000000000001 R11: 0000000000001816 R12: 0000000000000000 [ 3491.167368] R13: ffff88002d6ebe38 R14: ffff880072508980 R15: ffff88002d6ebefc [ 3491.167368] FS: 00007f02454e5700(0000) GS:ffff88003ed00000(0000) knlGS:0000000000000000 [ 3491.167368] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 3491.167368] CR2: 000000000000000c CR3: 000000002cb5f000 CR4: 00000000000006e0 [ 3491.167368] Stack: [ 3491.169740] 0000000000000000 ffff88002d6ebde0 ffff88002d6ebd00 ffffffff81314922 [ 3491.169740] 0000000000000001 0000000000000000 ffff88002d6ebd98 ffff88002d6ebde0 [ 3491.169740] 0000000000048000 ffff88002d6ebefc ffff88002d6ebdd0 ffffffff8131729d [ 3491.169740] Call Trace: [ 3491.169740] [<ffffffff81314922>] trailing_symlink+0x62/0x260 [ 3491.169740] [<ffffffff8131729d>] path_openat+0x2ed/0x1560 [ 3491.169740] [<ffffffff81319549>] do_filp_open+0x79/0xd0 [ 3491.169740] [<ffffffff82b11d92>] ? _raw_spin_unlock+0x22/0x30 [ 3491.169740] [<ffffffff81328f08>] ? __alloc_fd+0xf8/0x200 [ 3491.169740] [<ffffffff81306eb0>] do_sys_open+0x110/0x1f0 [ 3491.169740] [<ffffffff81306fbf>] SyS_openat+0xf/0x20 [ 3491.169740] [<ffffffff82b12836>] entry_SYSCALL_64_fastpath+0x16/0x7a [ 3491.169740] Code: ff ff ff 48 85 c0 48 89 c3 74 08 48 89 c7 e8 ef dc ff ff 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 53 48 83 ec 08 <f6> 46 0c 02 48 8b 1f 75 6b 48 8b 7e 28 48 8b 47 50 a9 01 04 00 [ 3491.169740] RIP [<ffffffff81327429>] atime_needs_update+0x9/0xc0 [ 3491.169740] RSP <ffff88002d6ebcb0> [ 3491.169740] CR2: 000000000000000c [ 3491.195051] ---[ end trace c65af9be7536efaf ]--- [ 3491.195051] BUG: sleeping function called from invalid context at include/linux/sched.h:2795 [ 3491.195051] in_atomic(): 1, irqs_disabled(): 1, pid: 17000, name: syz-executor [ 3491.195051] INFO: lockdep is turned off. [ 3491.195051] irq event stamp: 622 [ 3491.195051] hardirqs last enabled at (621): [<ffffffff811d9926>] vprintk_emit+0x2d6/0x5f0 [ 3491.195051] hardirqs last disabled at (622): [<ffffffff82b14d49>] error_entry+0x69/0xc0 [ 3491.195051] softirqs last enabled at (618): [<ffffffff81178172>] __do_softirq+0x222/0x4a0 [ 3491.195051] softirqs last disabled at (595): [<ffffffff81178767>] irq_exit+0xa7/0xc0 [ 3491.195051] CPU: 1 PID: 17000 Comm: syz-executor Tainted: G D W 4.5.0-rc5+ #72 [ 3491.195051] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 [ 3491.195051] 0000000000000000 ffff88002d6eb9a8 ffffffff8194ad79 ffff88002c9196c0 [ 3491.195051] 0000000000004268 ffff88002d6eb9d0 ffffffff811a0659 ffffffff8329b7fb [ 3491.195051] 0000000000000aeb 0000000000000000 ffff88002d6eb9f8 ffffffff811a0764 [ 3491.195051] Call Trace: [ 3491.195051] [<ffffffff8194ad79>] dump_stack+0x99/0xd0 [ 3491.195051] [<ffffffff811a0659>] ___might_sleep+0x179/0x240 [ 3491.195051] [<ffffffff811a0764>] __might_sleep+0x44/0x80 [ 3491.195051] [<ffffffff811842cf>] exit_signals+0x1f/0x130 [ 3491.195051] [<ffffffff811756ef>] do_exit+0xbf/0xd10 [ 3491.195051] [<ffffffff811da524>] ? kmsg_dump+0x104/0x180 [ 3491.195051] [<ffffffff8108549f>] oops_end+0x9f/0xe0 [ 3491.195051] [<ffffffff810ce6e8>] no_context+0x108/0x390 [ 3491.195051] [<ffffffff810cea8d>] __bad_area_nosemaphore+0x11d/0x220 [ 3491.195051] [<ffffffff810ceb9e>] bad_area_nosemaphore+0xe/0x10 [ 3491.195051] [<ffffffff810cf2c4>] __do_page_fault+0x84/0x470 [ 3491.195051] [<ffffffff810cf764>] trace_do_page_fault+0x74/0x2c0 [ 3491.195051] [<ffffffff810c9ba4>] do_async_page_fault+0x14/0x90 [ 3491.195051] [<ffffffff82b14b78>] async_page_fault+0x28/0x30 [ 3491.195051] [<ffffffff81327429>] ? atime_needs_update+0x9/0xc0 [ 3491.195051] [<ffffffff81314922>] trailing_symlink+0x62/0x260 [ 3491.195051] [<ffffffff8131729d>] path_openat+0x2ed/0x1560 [ 3491.195051] [<ffffffff81319549>] do_filp_open+0x79/0xd0 [ 3491.195051] [<ffffffff82b11d92>] ? _raw_spin_unlock+0x22/0x30 [ 3491.195051] [<ffffffff81328f08>] ? __alloc_fd+0xf8/0x200 [ 3491.195051] [<ffffffff81306eb0>] do_sys_open+0x110/0x1f0 [ 3491.195051] [<ffffffff81306fbf>] SyS_openat+0xf/0x20 [ 3491.195051] [<ffffffff82b12836>] entry_SYSCALL_64_fastpath+0x16/0x7a [ 3491.284831] note: syz-executor[17000] exited with preempt_count 1 The warning is this one: static inline int should_follow_link(struct nameidata *nd, struct path *link, int follow, struct inode *inode, unsigned seq) { .... WARN_ON(!inode); // now, _that_ should not happen. return pick_link(nd, link, inode, seq); } ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-24 13:35 ` Dmitry Vyukov @ 2016-02-24 15:15 ` Al Viro 2016-02-25 8:29 ` Dmitry Vyukov 0 siblings, 1 reply; 49+ messages in thread From: Al Viro @ 2016-02-24 15:15 UTC (permalink / raw) To: Dmitry Vyukov Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Wed, Feb 24, 2016 at 02:35:18PM +0100, Dmitry Vyukov wrote: > The warning is this one: > > static inline int should_follow_link(struct nameidata *nd, struct path *link, > int follow, > struct inode *inode, unsigned seq) > { > .... > WARN_ON(!inode); // now, _that_ should not happen. > return pick_link(nd, link, inode, seq); > } Let's try it with less chatty should_follow_link() and better set of tripwires on the way to it: diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c index c6d7d3d..86f81e3 100644 --- a/fs/autofs4/root.c +++ b/fs/autofs4/root.c @@ -323,6 +323,7 @@ static struct dentry *autofs4_mountpoint_changed(struct path *path) struct dentry *new = d_lookup(parent, &dentry->d_name); if (!new) return NULL; + WARN_ON(d_is_negative(new)); ino = autofs4_dentry_ino(new); ino->last_used = jiffies; dput(path->dentry); diff --git a/fs/namei.c b/fs/namei.c index f624d13..071a4ba 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1209,6 +1209,7 @@ static int follow_managed(struct path *path, struct nameidata *nd) /* Handle an automount point */ if (managed & DCACHE_NEED_AUTOMOUNT) { ret = follow_automount(path, nd, &need_mntput); + WARN_ON(d_is_negative(path->dentry)); if (ret < 0) break; continue; @@ -1582,8 +1583,10 @@ static int lookup_fast(struct nameidata *nd, return -ENOENT; path->mnt = mnt; path->dentry = dentry; - if (likely(__follow_mount_rcu(nd, path, inode, seqp))) + if (likely(__follow_mount_rcu(nd, path, inode, seqp))) { + WARN_ON(!*inode); return 0; + } unlazy: if (unlazy_walk(nd, dentry, seq)) return -ECHILD; @@ -1613,8 +1616,10 @@ unlazy: path->mnt = mnt; path->dentry = dentry; err = follow_managed(path, nd); - if (likely(!err)) + if (likely(!err)) { *inode = d_backing_inode(path->dentry); + WARN_ON(!*inode); + } return err; need_lookup: @@ -1712,6 +1717,12 @@ static inline int should_follow_link(struct nameidata *nd, struct path *link, return 0; if (!follow) return 0; + /* make sure that d_is_symlink above matches inode */ + if (nd->flags & LOOKUP_RCU) { + if (read_seqcount_retry(&link->dentry->d_seq, seq)) + return -ECHILD; + } + WARN_ON(!inode); // now, _that_ should not happen. return pick_link(nd, link, inode, seq); } @@ -1743,11 +1754,11 @@ static int walk_component(struct nameidata *nd, int flags) if (err < 0) return err; - inode = d_backing_inode(path.dentry); seq = 0; /* we are already out of RCU mode */ err = -ENOENT; if (d_is_negative(path.dentry)) goto out_path_put; + inode = d_backing_inode(path.dentry); } if (flags & WALK_PUT) @@ -3106,8 +3117,10 @@ static int do_last(struct nameidata *nd, nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; /* we _can_ be in RCU mode here */ error = lookup_fast(nd, &path, &inode, &seq); - if (likely(!error)) + if (likely(!error)) { + WARN_ON(!inode); goto finish_lookup; + } if (error < 0) return error; @@ -3192,12 +3205,13 @@ retry_lookup: return error; BUG_ON(nd->flags & LOOKUP_RCU); - inode = d_backing_inode(path.dentry); seq = 0; /* out of RCU mode, so the value doesn't matter */ if (unlikely(d_is_negative(path.dentry))) { path_to_nameidata(&path, nd); return -ENOENT; } + inode = d_backing_inode(path.dentry); + WARN_ON(!inode); finish_lookup: if (nd->depth) put_link(nd); @@ -3206,11 +3220,6 @@ finish_lookup: if (unlikely(error)) return error; - if (unlikely(d_is_symlink(path.dentry)) && !(open_flag & O_PATH)) { - path_to_nameidata(&path, nd); - return -ELOOP; - } - if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path.mnt) { path_to_nameidata(&path, nd); } else { @@ -3229,6 +3238,10 @@ finish_open: return error; } audit_inode(nd->name, nd->path.dentry, 0); + if (unlikely(d_is_symlink(nd->path.dentry)) && !(open_flag & O_PATH)) { + error = -ELOOP; + goto out; + } error = -EISDIR; if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry)) goto out; @@ -3273,6 +3286,10 @@ opened: goto exit_fput; } out: + if (unlikely(error > 0)) { + WARN_ON(1); + error = -EINVAL; + } if (got_write) mnt_drop_write(nd->path.mnt); path_put(&save_parent); ^ permalink raw reply related [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-24 15:15 ` Al Viro @ 2016-02-25 8:29 ` Dmitry Vyukov 2016-02-25 16:39 ` Al Viro 0 siblings, 1 reply; 49+ messages in thread From: Dmitry Vyukov @ 2016-02-25 8:29 UTC (permalink / raw) To: Al Viro Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin On Wed, Feb 24, 2016 at 4:15 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: > On Wed, Feb 24, 2016 at 02:35:18PM +0100, Dmitry Vyukov wrote: > >> The warning is this one: >> >> static inline int should_follow_link(struct nameidata *nd, struct path *link, >> int follow, >> struct inode *inode, unsigned seq) >> { >> .... >> WARN_ON(!inode); // now, _that_ should not happen. >> return pick_link(nd, link, inode, seq); >> } > > Let's try it with less chatty should_follow_link() and better set of > tripwires on the way to it: Humm... I've left it running over night but no GPFs happened... Usually they happened within two hours or so. I would think that your patch fixes it and I did not actually apply it last time (or did not rebuild kernel). But I saw the new warnings that the patch adds, so I should have been rebuilt it... What I saw is a dozen of pairs of warnings like the one below. Is it possible the warning printing introduces enough delay to close the inconsistency window?.... [46839.557154] ------------[ cut here ]------------ [46839.557663] WARNING: CPU: 0 PID: 10503 at fs/namei.c:1587 lookup_fast+0x2bf/0x420() [46839.558239] Modules linked in: [46839.558466] CPU: 0 PID: 10503 Comm: syz-executor Tainted: G W 4.5.0-rc5+ #73 [46839.558980] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 [46839.559174] 0000000000000000 ffff88002b6ebc48 ffffffff8194acd9 0000000000000000 [46839.559564] ffffffff83344ffc ffff88002b6ebc80 ffffffff81172291 ffff88002b6ebde0 [46839.559564] ffff8800314cc720 ffff88002b6ebd90 ffff88002b6ebd98 ffff88002b6ebd8c [46839.560614] Call Trace: [46839.560614] [<ffffffff8194acd9>] dump_stack+0x99/0xd0 [46839.561294] [<ffffffff81172291>] warn_slowpath_common+0x81/0xc0 [46839.561712] [<ffffffff81172385>] warn_slowpath_null+0x15/0x20 [46839.561712] [<ffffffff81314ddf>] lookup_fast+0x2bf/0x420 [46839.561712] [<ffffffff81315568>] ? link_path_walk+0x68/0x4e0 [46839.561712] [<ffffffff813172b5>] path_openat+0x375/0x1520 [46839.563137] [<ffffffff81319499>] do_filp_open+0x79/0xd0 [46839.563137] [<ffffffff82b11cf2>] ? _raw_spin_unlock+0x22/0x30 [46839.563137] [<ffffffff81328e58>] ? __alloc_fd+0xf8/0x200 [46839.564353] [<ffffffff81306eb0>] do_sys_open+0x110/0x1f0 [46839.564353] [<ffffffff81306fbf>] SyS_openat+0xf/0x20 [46839.564353] [<ffffffff82b12776>] entry_SYSCALL_64_fastpath+0x16/0x7a [46839.565558] ---[ end trace 3c3bc0f927bf4e90 ]--- [46839.565858] ------------[ cut here ]------------ [46839.566203] WARNING: CPU: 0 PID: 10503 at fs/namei.c:3121 path_openat+0x12bc/0x1520() [46839.566700] Modules linked in: [46839.566914] CPU: 0 PID: 10503 Comm: syz-executor Tainted: G W 4.5.0-rc5+ #73 [46839.567154] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 [46839.567154] 0000000000000000 ffff88002b6ebcb8 ffffffff8194acd9 0000000000000000 [46839.567154] ffffffff83344ffc ffff88002b6ebcf0 ffffffff81172291 0000000000000005 [46839.567154] ffff88002b6ebd98 0000000000048000 ffff88002b6ebde0 ffff88002b6ebefc [46839.567154] Call Trace: [46839.567154] [<ffffffff8194acd9>] dump_stack+0x99/0xd0 [46839.567154] [<ffffffff81172291>] warn_slowpath_common+0x81/0xc0 [46839.567154] [<ffffffff81172385>] warn_slowpath_null+0x15/0x20 [46839.567154] [<ffffffff813181fc>] path_openat+0x12bc/0x1520 [46839.567154] [<ffffffff81319499>] do_filp_open+0x79/0xd0 [46839.567154] [<ffffffff82b11cf2>] ? _raw_spin_unlock+0x22/0x30 [46839.567154] [<ffffffff81328e58>] ? __alloc_fd+0xf8/0x200 [46839.567154] [<ffffffff81306eb0>] do_sys_open+0x110/0x1f0 [46839.567154] [<ffffffff81306fbf>] SyS_openat+0xf/0x20 [46839.567154] [<ffffffff82b12776>] entry_SYSCALL_64_fastpath+0x16/0x7a [46839.573763] ---[ end trace 3c3bc0f927bf4e91 ]--- ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-25 8:29 ` Dmitry Vyukov @ 2016-02-25 16:39 ` Al Viro 2016-02-26 21:21 ` Al Viro 0 siblings, 1 reply; 49+ messages in thread From: Al Viro @ 2016-02-25 16:39 UTC (permalink / raw) To: Dmitry Vyukov Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds On Thu, Feb 25, 2016 at 09:29:21AM +0100, Dmitry Vyukov wrote: > Humm... I've left it running over night but no GPFs happened... > Usually they happened within two hours or so. I would think that your > patch fixes it and I did not actually apply it last time (or did not > rebuild kernel). But I saw the new warnings that the patch adds, so I > should have been rebuilt it... > > What I saw is a dozen of pairs of warnings like the one below. > Is it possible the warning printing introduces enough delay to close > the inconsistency window?.... All that stops these warnings from triggering atime_... oopsen is that dentry involved isn't a symlink one. lookup_fast() should *not* return 0 and set *inode to NULL. Ever. Trigger the same in walk_component() and you'll get NULL nd->inode, which will oops as soon as you get to may_lookup() for the next component (or atime one if dentry turns out to be a symlink and not a directory). IOW, what happened is that you've got dozens of instances of the underlying bug triggered, all on non-symlink dentries in the last components of pathname. The codepath in question is this: *inode = d_backing_inode(dentry); negative = d_is_negative(dentry); if (read_seqcount_retry(&dentry->d_seq, seq)) return -ECHILD; at that point we'd better have negative and *inode refering to the state of dentry at the same moment - seq had been fetched before both the inode and dentry flags and has remained unchanged until the later point, i.e. through all the interval containing both fetches. .... if (negative) return -ENOENT; no *inode changes in between, so it ought to be non-NULL path->mnt = mnt; path->dentry = dentry; if (likely(__follow_mount_rcu(nd, path, inode, seqp))) { WARN_ON(!*inode); return 0; and you are triggering that WARN_ON. So either __follow_mount_rcu() has returned true and zeroed *inode, or we have something very wrong with ->d_seq. __follow_mount_rcu() reassigns *inode only in one place: mounted = __lookup_mnt(path->mnt, path->dentry); if (!mounted) break; path->mnt = &mounted->mnt; path->dentry = mounted->mnt.mnt_root; nd->flags |= LOOKUP_JUMPED; *seqp = read_seqcount_begin(&path->dentry->d_seq); /* * Update the inode too. We don't need to re-check the * dentry sequence number here after this d_inode read, * because a mount-point is always pinned. */ *inode = path->dentry->d_inode; Note that it had returned true, so we have read_seqretry(&mount_lock, nd->m_seq) yielding false, i.e. mount_lock hadn't been touched through all of that. Having ->mnt_root->d_inode go NULL on a live vfsmount is a Bad Thing(tm), for obvious reasons. ->mnt_root should've remained pinned until cleanup_mnt(), which means that it must've already gotten through mntput_no_expire() lock_mount_hash/unlock_mount_hash *before* we'd picked nd->m_seq; otherwise we'd see mount_lock mismatch. Now, all removals from vfsmount hash should happen under mount_lock and prior to cleanup_mnt() on victim. So we should've had this: Somebody: hlist_del_init(&mounted->mnt_hash); ... write_sequnlock(&mount_lock); Us: rcu_read_lock(); nd->m_seq = read_seqbegin(&mount_lock); ... hlist_for_each_entry_rcu(p, head, mnt_hash) ... run into 'mounted' find mount_lock untouched. AFAICS, write_sequnlock/read_seqbegin barriers should've sufficed to prevent that... Hrm... OK, seeing that you still seem to trigger those within an hour or two (and *any* of remaining WARN_ON() are serious bugs - none of the "mitigation had been triggered" remained, sorry for not making it clear), let's try this. Again, any WARN_ON triggered means that we'd caught something, whether it progresses into oops or not. diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c index c6d7d3d..86f81e3 100644 --- a/fs/autofs4/root.c +++ b/fs/autofs4/root.c @@ -323,6 +323,7 @@ static struct dentry *autofs4_mountpoint_changed(struct path *path) struct dentry *new = d_lookup(parent, &dentry->d_name); if (!new) return NULL; + WARN_ON(d_is_negative(new)); ino = autofs4_dentry_ino(new); ino->last_used = jiffies; dput(path->dentry); diff --git a/fs/namei.c b/fs/namei.c index f624d13..daa6b25 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1209,6 +1209,7 @@ static int follow_managed(struct path *path, struct nameidata *nd) /* Handle an automount point */ if (managed & DCACHE_NEED_AUTOMOUNT) { ret = follow_automount(path, nd, &need_mntput); + WARN_ON(d_is_negative(path->dentry)); if (ret < 0) break; continue; @@ -1260,6 +1261,7 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, { for (;;) { struct mount *mounted; + void *p; /* * Don't forget we might have a non-mountpoint managed dentry * that wants to block transit. @@ -1289,7 +1291,9 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, * dentry sequence number here after this d_inode read, * because a mount-point is always pinned. */ - *inode = path->dentry->d_inode; + p = *inode = path->dentry->d_inode; + if (unlikely(!p)) + WARN_ON(!read_seqretry(&mount_lock, nd->m_seq)); } return !read_seqretry(&mount_lock, nd->m_seq) && !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT); @@ -1580,10 +1584,12 @@ static int lookup_fast(struct nameidata *nd, */ if (negative) return -ENOENT; + WARN_ON(!*inode); // ->d_seq was fucked somehow path->mnt = mnt; path->dentry = dentry; - if (likely(__follow_mount_rcu(nd, path, inode, seqp))) + if (likely(__follow_mount_rcu(nd, path, inode, seqp))) { return 0; + } unlazy: if (unlazy_walk(nd, dentry, seq)) return -ECHILD; @@ -1613,8 +1619,10 @@ unlazy: path->mnt = mnt; path->dentry = dentry; err = follow_managed(path, nd); - if (likely(!err)) + if (likely(!err)) { *inode = d_backing_inode(path->dentry); + WARN_ON(!*inode); + } return err; need_lookup: @@ -1712,6 +1720,12 @@ static inline int should_follow_link(struct nameidata *nd, struct path *link, return 0; if (!follow) return 0; + /* make sure that d_is_symlink above matches inode */ + if (nd->flags & LOOKUP_RCU) { + if (read_seqcount_retry(&link->dentry->d_seq, seq)) + return -ECHILD; + } + WARN_ON(!inode); // now, _that_ should not happen. return pick_link(nd, link, inode, seq); } @@ -1743,11 +1757,11 @@ static int walk_component(struct nameidata *nd, int flags) if (err < 0) return err; - inode = d_backing_inode(path.dentry); seq = 0; /* we are already out of RCU mode */ err = -ENOENT; if (d_is_negative(path.dentry)) goto out_path_put; + inode = d_backing_inode(path.dentry); } if (flags & WALK_PUT) @@ -3106,8 +3120,10 @@ static int do_last(struct nameidata *nd, nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; /* we _can_ be in RCU mode here */ error = lookup_fast(nd, &path, &inode, &seq); - if (likely(!error)) + if (likely(!error)) { + WARN_ON(!inode); goto finish_lookup; + } if (error < 0) return error; @@ -3192,12 +3208,13 @@ retry_lookup: return error; BUG_ON(nd->flags & LOOKUP_RCU); - inode = d_backing_inode(path.dentry); seq = 0; /* out of RCU mode, so the value doesn't matter */ if (unlikely(d_is_negative(path.dentry))) { path_to_nameidata(&path, nd); return -ENOENT; } + inode = d_backing_inode(path.dentry); + WARN_ON(!inode); finish_lookup: if (nd->depth) put_link(nd); @@ -3206,11 +3223,6 @@ finish_lookup: if (unlikely(error)) return error; - if (unlikely(d_is_symlink(path.dentry)) && !(open_flag & O_PATH)) { - path_to_nameidata(&path, nd); - return -ELOOP; - } - if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path.mnt) { path_to_nameidata(&path, nd); } else { @@ -3229,6 +3241,10 @@ finish_open: return error; } audit_inode(nd->name, nd->path.dentry, 0); + if (unlikely(d_is_symlink(nd->path.dentry)) && !(open_flag & O_PATH)) { + error = -ELOOP; + goto out; + } error = -EISDIR; if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry)) goto out; @@ -3273,6 +3289,10 @@ opened: goto exit_fput; } out: + if (unlikely(error > 0)) { + WARN_ON(1); + error = -EINVAL; + } if (got_write) mnt_drop_write(nd->path.mnt); path_put(&save_parent); diff --git a/fs/namespace.c b/fs/namespace.c index 4fb1691..4128a5c 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -1060,6 +1060,8 @@ static void cleanup_mnt(struct mount *mnt) * so mnt_get_writers() below is safe. */ WARN_ON(mnt_get_writers(mnt)); + WARN_ON(!mnt->mnt.mnt_root->d_inode); // some joker has managed to + // make mnt_root negative on us if (unlikely(mnt->mnt_pins.first)) mnt_pin_kill(mnt); fsnotify_vfsmount_delete(&mnt->mnt); ^ permalink raw reply related [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-25 16:39 ` Al Viro @ 2016-02-26 21:21 ` Al Viro 2016-02-26 21:25 ` Dmitry Vyukov 0 siblings, 1 reply; 49+ messages in thread From: Al Viro @ 2016-02-26 21:21 UTC (permalink / raw) To: Dmitry Vyukov Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds On Thu, Feb 25, 2016 at 04:39:27PM +0000, Al Viro wrote: > Hrm... OK, seeing that you still seem to trigger those within an hour or > two (and *any* of remaining WARN_ON() are serious bugs - none of the > "mitigation had been triggered" remained, sorry for not making it clear), > let's try this. Again, any WARN_ON triggered means that we'd caught something, > whether it progresses into oops or not. Any news on that one? I'm going to carve fixes for understood bugs out of that one and put those into tonight push, but it would be nice to sort out all remaining crap lurking in that area... Another question: what about the very first trace you'd posted, with apparent GPF at 00000050? Have you seen anything like that afterwards? > diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c > index c6d7d3d..86f81e3 100644 > --- a/fs/autofs4/root.c > +++ b/fs/autofs4/root.c > @@ -323,6 +323,7 @@ static struct dentry *autofs4_mountpoint_changed(struct path *path) > struct dentry *new = d_lookup(parent, &dentry->d_name); > if (!new) > return NULL; > + WARN_ON(d_is_negative(new)); > ino = autofs4_dentry_ino(new); > ino->last_used = jiffies; > dput(path->dentry); > diff --git a/fs/namei.c b/fs/namei.c > index f624d13..daa6b25 100644 > --- a/fs/namei.c > +++ b/fs/namei.c > @@ -1209,6 +1209,7 @@ static int follow_managed(struct path *path, struct nameidata *nd) > /* Handle an automount point */ > if (managed & DCACHE_NEED_AUTOMOUNT) { > ret = follow_automount(path, nd, &need_mntput); > + WARN_ON(d_is_negative(path->dentry)); > if (ret < 0) > break; > continue; > @@ -1260,6 +1261,7 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, > { > for (;;) { > struct mount *mounted; > + void *p; > /* > * Don't forget we might have a non-mountpoint managed dentry > * that wants to block transit. > @@ -1289,7 +1291,9 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, > * dentry sequence number here after this d_inode read, > * because a mount-point is always pinned. > */ > - *inode = path->dentry->d_inode; > + p = *inode = path->dentry->d_inode; > + if (unlikely(!p)) > + WARN_ON(!read_seqretry(&mount_lock, nd->m_seq)); > } > return !read_seqretry(&mount_lock, nd->m_seq) && > !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT); > @@ -1580,10 +1584,12 @@ static int lookup_fast(struct nameidata *nd, > */ > if (negative) > return -ENOENT; > + WARN_ON(!*inode); // ->d_seq was fucked somehow > path->mnt = mnt; > path->dentry = dentry; > - if (likely(__follow_mount_rcu(nd, path, inode, seqp))) > + if (likely(__follow_mount_rcu(nd, path, inode, seqp))) { > return 0; > + } > unlazy: > if (unlazy_walk(nd, dentry, seq)) > return -ECHILD; > @@ -1613,8 +1619,10 @@ unlazy: > path->mnt = mnt; > path->dentry = dentry; > err = follow_managed(path, nd); > - if (likely(!err)) > + if (likely(!err)) { > *inode = d_backing_inode(path->dentry); > + WARN_ON(!*inode); > + } > return err; > > need_lookup: > @@ -1712,6 +1720,12 @@ static inline int should_follow_link(struct nameidata *nd, struct path *link, > return 0; > if (!follow) > return 0; > + /* make sure that d_is_symlink above matches inode */ > + if (nd->flags & LOOKUP_RCU) { > + if (read_seqcount_retry(&link->dentry->d_seq, seq)) > + return -ECHILD; > + } > + WARN_ON(!inode); // now, _that_ should not happen. > return pick_link(nd, link, inode, seq); > } > > @@ -1743,11 +1757,11 @@ static int walk_component(struct nameidata *nd, int flags) > if (err < 0) > return err; > > - inode = d_backing_inode(path.dentry); > seq = 0; /* we are already out of RCU mode */ > err = -ENOENT; > if (d_is_negative(path.dentry)) > goto out_path_put; > + inode = d_backing_inode(path.dentry); > } > > if (flags & WALK_PUT) > @@ -3106,8 +3120,10 @@ static int do_last(struct nameidata *nd, > nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; > /* we _can_ be in RCU mode here */ > error = lookup_fast(nd, &path, &inode, &seq); > - if (likely(!error)) > + if (likely(!error)) { > + WARN_ON(!inode); > goto finish_lookup; > + } > > if (error < 0) > return error; > @@ -3192,12 +3208,13 @@ retry_lookup: > return error; > > BUG_ON(nd->flags & LOOKUP_RCU); > - inode = d_backing_inode(path.dentry); > seq = 0; /* out of RCU mode, so the value doesn't matter */ > if (unlikely(d_is_negative(path.dentry))) { > path_to_nameidata(&path, nd); > return -ENOENT; > } > + inode = d_backing_inode(path.dentry); > + WARN_ON(!inode); > finish_lookup: > if (nd->depth) > put_link(nd); > @@ -3206,11 +3223,6 @@ finish_lookup: > if (unlikely(error)) > return error; > > - if (unlikely(d_is_symlink(path.dentry)) && !(open_flag & O_PATH)) { > - path_to_nameidata(&path, nd); > - return -ELOOP; > - } > - > if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path.mnt) { > path_to_nameidata(&path, nd); > } else { > @@ -3229,6 +3241,10 @@ finish_open: > return error; > } > audit_inode(nd->name, nd->path.dentry, 0); > + if (unlikely(d_is_symlink(nd->path.dentry)) && !(open_flag & O_PATH)) { > + error = -ELOOP; > + goto out; > + } > error = -EISDIR; > if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry)) > goto out; > @@ -3273,6 +3289,10 @@ opened: > goto exit_fput; > } > out: > + if (unlikely(error > 0)) { > + WARN_ON(1); > + error = -EINVAL; > + } > if (got_write) > mnt_drop_write(nd->path.mnt); > path_put(&save_parent); > diff --git a/fs/namespace.c b/fs/namespace.c > index 4fb1691..4128a5c 100644 > --- a/fs/namespace.c > +++ b/fs/namespace.c > @@ -1060,6 +1060,8 @@ static void cleanup_mnt(struct mount *mnt) > * so mnt_get_writers() below is safe. > */ > WARN_ON(mnt_get_writers(mnt)); > + WARN_ON(!mnt->mnt.mnt_root->d_inode); // some joker has managed to > + // make mnt_root negative on us > if (unlikely(mnt->mnt_pins.first)) > mnt_pin_kill(mnt); > fsnotify_vfsmount_delete(&mnt->mnt); > -- > To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-26 21:21 ` Al Viro @ 2016-02-26 21:25 ` Dmitry Vyukov 2016-02-26 22:07 ` Al Viro 0 siblings, 1 reply; 49+ messages in thread From: Dmitry Vyukov @ 2016-02-26 21:25 UTC (permalink / raw) To: Al Viro Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds On Fri, Feb 26, 2016 at 10:21 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: > On Thu, Feb 25, 2016 at 04:39:27PM +0000, Al Viro wrote: >> Hrm... OK, seeing that you still seem to trigger those within an hour or >> two (and *any* of remaining WARN_ON() are serious bugs - none of the >> "mitigation had been triggered" remained, sorry for not making it clear), >> let's try this. Again, any WARN_ON triggered means that we'd caught something, >> whether it progresses into oops or not. > > Any news on that one? I'm going to carve fixes for understood bugs out of > that one and put those into tonight push, but it would be nice to sort out > all remaining crap lurking in that area... > > Another question: what about the very first trace you'd posted, with apparent > GPF at 00000050? Have you seen anything like that afterwards? No, I did not have time to retest. GPF at 00000050 was not mine, it was Mickaël's. I did not try to reproduce mine first. But most likely it is the same as the one I reproduced lately (GPF at NULL in atime_needs_update). ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-26 21:25 ` Dmitry Vyukov @ 2016-02-26 22:07 ` Al Viro 0 siblings, 0 replies; 49+ messages in thread From: Al Viro @ 2016-02-26 22:07 UTC (permalink / raw) To: Dmitry Vyukov Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds On Fri, Feb 26, 2016 at 10:25:21PM +0100, Dmitry Vyukov wrote: > On Fri, Feb 26, 2016 at 10:21 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: > > On Thu, Feb 25, 2016 at 04:39:27PM +0000, Al Viro wrote: > >> Hrm... OK, seeing that you still seem to trigger those within an hour or > >> two (and *any* of remaining WARN_ON() are serious bugs - none of the > >> "mitigation had been triggered" remained, sorry for not making it clear), > >> let's try this. Again, any WARN_ON triggered means that we'd caught something, > >> whether it progresses into oops or not. > > > > Any news on that one? I'm going to carve fixes for understood bugs out of > > that one and put those into tonight push, but it would be nice to sort out > > all remaining crap lurking in that area... > > > > Another question: what about the very first trace you'd posted, with apparent > > GPF at 00000050? Have you seen anything like that afterwards? > > No, I did not have time to retest. > > GPF at 00000050 was not mine, it was Mickaël's. Ah, OK - his is basically a forced nd->stack[] underrun, with passing a never-assigned nd->link_inode to atime_needs_update(), so we are just passing a contents of uninitialized stack word there and while it ends up possible to dereference, it's not an address of struct inode and the first attempt to follow a pointer in what would've been a struct inode at that address (accessing inode->i_sb->s_flags) did blow up with GPF at offsetof(struct super_block, s_flags). All right, so we basically have several understood ones with fixes plus something unknown that leads to lookup_fast() returning 0 with NULL in *inode in about an hour or two on your setup... ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update @ 2016-02-26 22:07 ` Al Viro 0 siblings, 0 replies; 49+ messages in thread From: Al Viro @ 2016-02-26 22:07 UTC (permalink / raw) To: Dmitry Vyukov Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds On Fri, Feb 26, 2016 at 10:25:21PM +0100, Dmitry Vyukov wrote: > On Fri, Feb 26, 2016 at 10:21 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: > > On Thu, Feb 25, 2016 at 04:39:27PM +0000, Al Viro wrote: > >> Hrm... OK, seeing that you still seem to trigger those within an hour or > >> two (and *any* of remaining WARN_ON() are serious bugs - none of the > >> "mitigation had been triggered" remained, sorry for not making it clear), > >> let's try this. Again, any WARN_ON triggered means that we'd caught something, > >> whether it progresses into oops or not. > > > > Any news on that one? I'm going to carve fixes for understood bugs out of > > that one and put those into tonight push, but it would be nice to sort out > > all remaining crap lurking in that area... > > > > Another question: what about the very first trace you'd posted, with apparent > > GPF at 00000050? Have you seen anything like that afterwards? > > No, I did not have time to retest. > > GPF at 00000050 was not mine, it was Micka�l's. Ah, OK - his is basically a forced nd->stack[] underrun, with passing a never-assigned nd->link_inode to atime_needs_update(), so we are just passing a contents of uninitialized stack word there and while it ends up possible to dereference, it's not an address of struct inode and the first attempt to follow a pointer in what would've been a struct inode at that address (accessing inode->i_sb->s_flags) did blow up with GPF at offsetof(struct super_block, s_flags). All right, so we basically have several understood ones with fixes plus something unknown that leads to lookup_fast() returning 0 with NULL in *inode in about an hour or two on your setup... ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-26 22:07 ` Al Viro @ 2016-02-27 22:27 ` Al Viro -1 siblings, 0 replies; 49+ messages in thread From: Al Viro @ 2016-02-27 22:27 UTC (permalink / raw) To: Dmitry Vyukov Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds On Fri, Feb 26, 2016 at 10:07:59PM +0000, Al Viro wrote: > On Fri, Feb 26, 2016 at 10:25:21PM +0100, Dmitry Vyukov wrote: > > On Fri, Feb 26, 2016 at 10:21 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: > > > On Thu, Feb 25, 2016 at 04:39:27PM +0000, Al Viro wrote: > > >> Hrm... OK, seeing that you still seem to trigger those within an hour or > > >> two (and *any* of remaining WARN_ON() are serious bugs - none of the > > >> "mitigation had been triggered" remained, sorry for not making it clear), > > >> let's try this. Again, any WARN_ON triggered means that we'd caught something, > > >> whether it progresses into oops or not. > > > > > > Any news on that one? I'm going to carve fixes for understood bugs out of > > > that one and put those into tonight push, but it would be nice to sort out > > > all remaining crap lurking in that area... > > > > > > Another question: what about the very first trace you'd posted, with apparent > > > GPF at 00000050? Have you seen anything like that afterwards? > > > > No, I did not have time to retest. > > > > GPF at 00000050 was not mine, it was Mickaël's. > > Ah, OK - his is basically a forced nd->stack[] underrun, with passing a > never-assigned nd->link_inode to atime_needs_update(), so we are just > passing a contents of uninitialized stack word there and while it ends > up possible to dereference, it's not an address of struct inode and the > first attempt to follow a pointer in what would've been a struct inode > at that address (accessing inode->i_sb->s_flags) did blow up with GPF at > offsetof(struct super_block, s_flags). > > All right, so we basically have several understood ones with fixes plus > something unknown that leads to lookup_fast() returning 0 with NULL in > *inode in about an hour or two on your setup... BTW, what kind of userland are you using? The thing is, shared-subtree setups differ, and if the crap is anywhere near vfsmount handling, that could have some impact... So far I hadn't been able to trigger any of these WARN_ON(); setup here is debian/testing on 4-way KVM guest with 4Gb memory given to it running on a 6-way host (Phenom II X6 1100T, 3.3GHz, 16Gb RAM total); 4.2 with debian/stable userland on host. What's the setup on your reproducer? ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update @ 2016-02-27 22:27 ` Al Viro 0 siblings, 0 replies; 49+ messages in thread From: Al Viro @ 2016-02-27 22:27 UTC (permalink / raw) To: Dmitry Vyukov Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds On Fri, Feb 26, 2016 at 10:07:59PM +0000, Al Viro wrote: > On Fri, Feb 26, 2016 at 10:25:21PM +0100, Dmitry Vyukov wrote: > > On Fri, Feb 26, 2016 at 10:21 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: > > > On Thu, Feb 25, 2016 at 04:39:27PM +0000, Al Viro wrote: > > >> Hrm... OK, seeing that you still seem to trigger those within an hour or > > >> two (and *any* of remaining WARN_ON() are serious bugs - none of the > > >> "mitigation had been triggered" remained, sorry for not making it clear), > > >> let's try this. Again, any WARN_ON triggered means that we'd caught something, > > >> whether it progresses into oops or not. > > > > > > Any news on that one? I'm going to carve fixes for understood bugs out of > > > that one and put those into tonight push, but it would be nice to sort out > > > all remaining crap lurking in that area... > > > > > > Another question: what about the very first trace you'd posted, with apparent > > > GPF at 00000050? Have you seen anything like that afterwards? > > > > No, I did not have time to retest. > > > > GPF at 00000050 was not mine, it was Micka�l's. > > Ah, OK - his is basically a forced nd->stack[] underrun, with passing a > never-assigned nd->link_inode to atime_needs_update(), so we are just > passing a contents of uninitialized stack word there and while it ends > up possible to dereference, it's not an address of struct inode and the > first attempt to follow a pointer in what would've been a struct inode > at that address (accessing inode->i_sb->s_flags) did blow up with GPF at > offsetof(struct super_block, s_flags). > > All right, so we basically have several understood ones with fixes plus > something unknown that leads to lookup_fast() returning 0 with NULL in > *inode in about an hour or two on your setup... BTW, what kind of userland are you using? The thing is, shared-subtree setups differ, and if the crap is anywhere near vfsmount handling, that could have some impact... So far I hadn't been able to trigger any of these WARN_ON(); setup here is debian/testing on 4-way KVM guest with 4Gb memory given to it running on a 6-way host (Phenom II X6 1100T, 3.3GHz, 16Gb RAM total); 4.2 with debian/stable userland on host. What's the setup on your reproducer? ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-27 22:27 ` Al Viro (?) @ 2016-02-28 15:43 ` Dmitry Vyukov 2016-02-28 16:04 ` Dmitry Vyukov -1 siblings, 1 reply; 49+ messages in thread From: Dmitry Vyukov @ 2016-02-28 15:43 UTC (permalink / raw) To: Al Viro Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds [-- Attachment #1: Type: text/plain, Size: 3586 bytes --] On Sat, Feb 27, 2016 at 11:27 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: > On Fri, Feb 26, 2016 at 10:07:59PM +0000, Al Viro wrote: >> On Fri, Feb 26, 2016 at 10:25:21PM +0100, Dmitry Vyukov wrote: >> > On Fri, Feb 26, 2016 at 10:21 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: >> > > On Thu, Feb 25, 2016 at 04:39:27PM +0000, Al Viro wrote: >> > >> Hrm... OK, seeing that you still seem to trigger those within an hour or >> > >> two (and *any* of remaining WARN_ON() are serious bugs - none of the >> > >> "mitigation had been triggered" remained, sorry for not making it clear), >> > >> let's try this. Again, any WARN_ON triggered means that we'd caught something, >> > >> whether it progresses into oops or not. >> > > >> > > Any news on that one? I'm going to carve fixes for understood bugs out of >> > > that one and put those into tonight push, but it would be nice to sort out >> > > all remaining crap lurking in that area... >> > > >> > > Another question: what about the very first trace you'd posted, with apparent >> > > GPF at 00000050? Have you seen anything like that afterwards? >> > >> > No, I did not have time to retest. >> > >> > GPF at 00000050 was not mine, it was Mickaël's. >> >> Ah, OK - his is basically a forced nd->stack[] underrun, with passing a >> never-assigned nd->link_inode to atime_needs_update(), so we are just >> passing a contents of uninitialized stack word there and while it ends >> up possible to dereference, it's not an address of struct inode and the >> first attempt to follow a pointer in what would've been a struct inode >> at that address (accessing inode->i_sb->s_flags) did blow up with GPF at >> offsetof(struct super_block, s_flags). >> >> All right, so we basically have several understood ones with fixes plus >> something unknown that leads to lookup_fast() returning 0 with NULL in >> *inode in about an hour or two on your setup... > > BTW, what kind of userland are you using? The thing is, shared-subtree > setups differ, and if the crap is anywhere near vfsmount handling, that > could have some impact... So far I hadn't been able to trigger any of > these WARN_ON(); setup here is debian/testing on 4-way KVM guest with 4Gb > memory given to it running on a 6-way host (Phenom II X6 1100T, 3.3GHz, 16Gb > RAM total); 4.2 with debian/stable userland on host. What's the setup on > your reproducer? Restarted fuzzer with the latest patch on top of 0fcbf996d848d03573113d83f4e3fb3bcfa5ab5e. > All that stops these warnings from triggering atime_... oopsen is that dentry > involved isn't a symlink one. What worries me is that I am running the same program in the same setup. The program does operate on symlinks and previous it triggered oopses. But now it does not. I've also rebased onto latest Linus tree, maybe that made difference... My userspace is a Debian Wheezy built using this script: https://github.com/google/syzkaller/blob/master/tools/create-image.sh I run it in qemu as: $ qemu-system-x86_64 -hda wheezy.img -net user,host=10.0.2.10,hostfwd=tcp::10022-:22 -net nic -nographic -kernel arch/x86/boot/bzImage -append "console=ttyS0 root=/dev/sda debug earlyprintk=serial slub_debug=UZ" -enable-kvm -pidfile vm_pid -m 2G -numa node,nodeid=0,cpus=0-1 -numa node,nodeid=1,cpus=2-3 -smp sockets=2,cores=2,threads=1 -usb -usbdevice mouse -usbdevice tablet -soundhw all I also use a pretty beefy config (attached) which includes KASAN and KCOV both of which introduce significant slowdown and can affect thread interleavings. [-- Attachment #2: .config --] [-- Type: application/octet-stream, Size: 138963 bytes --] # # Automatically generated file; DO NOT EDIT. # Linux/x86 4.5.0-rc4 Kernel Configuration # CONFIG_64BIT=y CONFIG_X86_64=y CONFIG_X86=y CONFIG_INSTRUCTION_DECODER=y CONFIG_PERF_EVENTS_INTEL_UNCORE=y CONFIG_OUTPUT_FORMAT="elf64-x86-64" CONFIG_ARCH_DEFCONFIG="arch/x86/configs/x86_64_defconfig" CONFIG_LOCKDEP_SUPPORT=y CONFIG_STACKTRACE_SUPPORT=y CONFIG_MMU=y CONFIG_ARCH_MMAP_RND_BITS_MIN=28 CONFIG_ARCH_MMAP_RND_BITS_MAX=32 CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8 CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16 CONFIG_NEED_DMA_MAP_STATE=y CONFIG_NEED_SG_DMA_LENGTH=y CONFIG_GENERIC_ISA_DMA=y CONFIG_GENERIC_BUG=y CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y CONFIG_GENERIC_HWEIGHT=y CONFIG_ARCH_MAY_HAVE_PC_FDC=y CONFIG_RWSEM_XCHGADD_ALGORITHM=y CONFIG_GENERIC_CALIBRATE_DELAY=y CONFIG_ARCH_HAS_CPU_RELAX=y CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y CONFIG_HAVE_SETUP_PER_CPU_AREA=y CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y CONFIG_ARCH_HIBERNATION_POSSIBLE=y CONFIG_ARCH_SUSPEND_POSSIBLE=y CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y CONFIG_ARCH_WANT_GENERAL_HUGETLB=y CONFIG_ZONE_DMA32=y CONFIG_AUDIT_ARCH=y CONFIG_ARCH_SUPPORTS_OPTIMIZED_INLINING=y CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y CONFIG_KASAN_SHADOW_OFFSET=0xdffffc0000000000 CONFIG_HAVE_INTEL_TXT=y CONFIG_X86_64_SMP=y CONFIG_ARCH_HWEIGHT_CFLAGS="-fcall-saved-rdi -fcall-saved-rsi -fcall-saved-rdx -fcall-saved-rcx -fcall-saved-r8 -fcall-saved-r9 -fcall-saved-r10 -fcall-saved-r11" CONFIG_ARCH_SUPPORTS_UPROBES=y CONFIG_FIX_EARLYCON_MEM=y CONFIG_PGTABLE_LEVELS=4 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config" CONFIG_CONSTRUCTORS=y CONFIG_IRQ_WORK=y CONFIG_BUILDTIME_EXTABLE_SORT=y # # General setup # CONFIG_INIT_ENV_ARG_LIMIT=32 CONFIG_CROSS_COMPILE="" # CONFIG_COMPILE_TEST is not set CONFIG_LOCALVERSION="" # CONFIG_LOCALVERSION_AUTO is not set CONFIG_HAVE_KERNEL_GZIP=y CONFIG_HAVE_KERNEL_BZIP2=y CONFIG_HAVE_KERNEL_LZMA=y CONFIG_HAVE_KERNEL_XZ=y CONFIG_HAVE_KERNEL_LZO=y CONFIG_HAVE_KERNEL_LZ4=y CONFIG_KERNEL_GZIP=y # CONFIG_KERNEL_BZIP2 is not set # CONFIG_KERNEL_LZMA is not set # CONFIG_KERNEL_XZ is not set # CONFIG_KERNEL_LZO is not set # CONFIG_KERNEL_LZ4 is not set CONFIG_DEFAULT_HOSTNAME="(none)" CONFIG_SWAP=y CONFIG_SYSVIPC=y CONFIG_SYSVIPC_SYSCTL=y CONFIG_POSIX_MQUEUE=y CONFIG_POSIX_MQUEUE_SYSCTL=y CONFIG_CROSS_MEMORY_ATTACH=y CONFIG_FHANDLE=y CONFIG_USELIB=y CONFIG_AUDIT=y CONFIG_HAVE_ARCH_AUDITSYSCALL=y CONFIG_AUDITSYSCALL=y CONFIG_AUDIT_WATCH=y CONFIG_AUDIT_TREE=y # # IRQ subsystem # CONFIG_GENERIC_IRQ_PROBE=y CONFIG_GENERIC_IRQ_SHOW=y CONFIG_GENERIC_PENDING_IRQ=y CONFIG_IRQ_DOMAIN=y CONFIG_IRQ_DOMAIN_HIERARCHY=y CONFIG_GENERIC_MSI_IRQ=y CONFIG_GENERIC_MSI_IRQ_DOMAIN=y CONFIG_IRQ_DOMAIN_DEBUG=y CONFIG_IRQ_FORCED_THREADING=y CONFIG_SPARSE_IRQ=y CONFIG_CLOCKSOURCE_WATCHDOG=y CONFIG_ARCH_CLOCKSOURCE_DATA=y CONFIG_CLOCKSOURCE_VALIDATE_LAST_CYCLE=y CONFIG_GENERIC_TIME_VSYSCALL=y CONFIG_GENERIC_CLOCKEVENTS=y CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y CONFIG_GENERIC_CMOS_UPDATE=y # # Timers subsystem # CONFIG_TICK_ONESHOT=y CONFIG_NO_HZ_COMMON=y # CONFIG_HZ_PERIODIC is not set CONFIG_NO_HZ_IDLE=y # CONFIG_NO_HZ_FULL is not set CONFIG_NO_HZ=y CONFIG_HIGH_RES_TIMERS=y # # CPU/Task time and stats accounting # CONFIG_TICK_CPU_ACCOUNTING=y # CONFIG_VIRT_CPU_ACCOUNTING_GEN is not set # CONFIG_IRQ_TIME_ACCOUNTING is not set CONFIG_BSD_PROCESS_ACCT=y # CONFIG_BSD_PROCESS_ACCT_V3 is not set CONFIG_TASKSTATS=y CONFIG_TASK_DELAY_ACCT=y CONFIG_TASK_XACCT=y CONFIG_TASK_IO_ACCOUNTING=y # # RCU Subsystem # CONFIG_TREE_RCU=y # CONFIG_RCU_EXPERT is not set CONFIG_SRCU=y # CONFIG_TASKS_RCU is not set CONFIG_RCU_STALL_COMMON=y # CONFIG_TREE_RCU_TRACE is not set # CONFIG_RCU_EXPEDITE_BOOT is not set CONFIG_BUILD_BIN2C=y # CONFIG_IKCONFIG is not set CONFIG_LOG_BUF_SHIFT=18 CONFIG_LOG_CPU_MAX_BUF_SHIFT=12 CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y CONFIG_ARCH_SUPPORTS_INT128=y CONFIG_NUMA_BALANCING=y CONFIG_NUMA_BALANCING_DEFAULT_ENABLED=y CONFIG_CGROUPS=y CONFIG_PAGE_COUNTER=y CONFIG_MEMCG=y CONFIG_MEMCG_SWAP=y CONFIG_MEMCG_SWAP_ENABLED=y CONFIG_BLK_CGROUP=y CONFIG_DEBUG_BLK_CGROUP=y CONFIG_CGROUP_WRITEBACK=y CONFIG_CGROUP_SCHED=y CONFIG_FAIR_GROUP_SCHED=y CONFIG_CFS_BANDWIDTH=y CONFIG_RT_GROUP_SCHED=y CONFIG_CGROUP_PIDS=y CONFIG_CGROUP_FREEZER=y CONFIG_CGROUP_HUGETLB=y CONFIG_CPUSETS=y CONFIG_PROC_PID_CPUSET=y CONFIG_CGROUP_DEVICE=y CONFIG_CGROUP_CPUACCT=y CONFIG_CGROUP_PERF=y CONFIG_CGROUP_DEBUG=y CONFIG_CHECKPOINT_RESTORE=y CONFIG_NAMESPACES=y CONFIG_UTS_NS=y CONFIG_IPC_NS=y CONFIG_USER_NS=y CONFIG_PID_NS=y CONFIG_NET_NS=y CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set CONFIG_RELAY=y CONFIG_BLK_DEV_INITRD=y CONFIG_INITRAMFS_SOURCE="" CONFIG_RD_GZIP=y CONFIG_RD_BZIP2=y CONFIG_RD_LZMA=y CONFIG_RD_XZ=y CONFIG_RD_LZO=y CONFIG_RD_LZ4=y # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set CONFIG_SYSCTL=y CONFIG_ANON_INODES=y CONFIG_HAVE_UID16=y CONFIG_SYSCTL_EXCEPTION_TRACE=y CONFIG_HAVE_PCSPKR_PLATFORM=y CONFIG_BPF=y CONFIG_EXPERT=y CONFIG_UID16=y CONFIG_MULTIUSER=y CONFIG_SGETMASK_SYSCALL=y CONFIG_SYSFS_SYSCALL=y # CONFIG_SYSCTL_SYSCALL is not set CONFIG_KALLSYMS=y CONFIG_KALLSYMS_ALL=y CONFIG_PRINTK=y CONFIG_BUG=y CONFIG_ELF_CORE=y CONFIG_PCSPKR_PLATFORM=y CONFIG_BASE_FULL=y CONFIG_FUTEX=y CONFIG_EPOLL=y CONFIG_SIGNALFD=y CONFIG_TIMERFD=y CONFIG_EVENTFD=y CONFIG_BPF_SYSCALL=y CONFIG_SHMEM=y CONFIG_AIO=y CONFIG_ADVISE_SYSCALLS=y CONFIG_USERFAULTFD=y CONFIG_PCI_QUIRKS=y CONFIG_MEMBARRIER=y # CONFIG_EMBEDDED is not set CONFIG_HAVE_PERF_EVENTS=y # # Kernel Performance Events And Counters # CONFIG_PERF_EVENTS=y # CONFIG_DEBUG_PERF_USE_VMALLOC is not set CONFIG_VM_EVENT_COUNTERS=y CONFIG_SLUB_DEBUG=y # CONFIG_COMPAT_BRK is not set # CONFIG_SLAB is not set CONFIG_SLUB=y # CONFIG_SLOB is not set CONFIG_SLUB_CPU_PARTIAL=y # CONFIG_SYSTEM_DATA_VERIFICATION is not set CONFIG_PROFILING=y CONFIG_TRACEPOINTS=y CONFIG_KEXEC_CORE=y # CONFIG_OPROFILE is not set CONFIG_HAVE_OPROFILE=y CONFIG_OPROFILE_NMI_TIMER=y CONFIG_KPROBES=y CONFIG_JUMP_LABEL=y # CONFIG_STATIC_KEYS_SELFTEST is not set CONFIG_OPTPROBES=y # CONFIG_UPROBES is not set # CONFIG_HAVE_64BIT_ALIGNED_ACCESS is not set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y CONFIG_ARCH_USE_BUILTIN_BSWAP=y CONFIG_KRETPROBES=y CONFIG_USER_RETURN_NOTIFIER=y CONFIG_HAVE_IOREMAP_PROT=y CONFIG_HAVE_KPROBES=y CONFIG_HAVE_KRETPROBES=y CONFIG_HAVE_OPTPROBES=y CONFIG_HAVE_KPROBES_ON_FTRACE=y CONFIG_HAVE_ARCH_TRACEHOOK=y CONFIG_HAVE_DMA_CONTIGUOUS=y CONFIG_GENERIC_SMP_IDLE_THREAD=y CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT=y CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y CONFIG_HAVE_DMA_API_DEBUG=y CONFIG_HAVE_HW_BREAKPOINT=y CONFIG_HAVE_MIXED_BREAKPOINTS_REGS=y CONFIG_HAVE_USER_RETURN_NOTIFIER=y CONFIG_HAVE_PERF_EVENTS_NMI=y CONFIG_HAVE_PERF_REGS=y CONFIG_HAVE_PERF_USER_STACK_DUMP=y CONFIG_HAVE_ARCH_JUMP_LABEL=y CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y CONFIG_HAVE_CMPXCHG_LOCAL=y CONFIG_HAVE_CMPXCHG_DOUBLE=y CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION=y CONFIG_ARCH_WANT_OLD_COMPAT_IPC=y CONFIG_HAVE_ARCH_SECCOMP_FILTER=y CONFIG_SECCOMP_FILTER=y CONFIG_HAVE_CC_STACKPROTECTOR=y # CONFIG_CC_STACKPROTECTOR is not set CONFIG_CC_STACKPROTECTOR_NONE=y # CONFIG_CC_STACKPROTECTOR_REGULAR is not set # CONFIG_CC_STACKPROTECTOR_STRONG is not set CONFIG_HAVE_CONTEXT_TRACKING=y CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y CONFIG_HAVE_ARCH_HUGE_VMAP=y CONFIG_HAVE_ARCH_SOFT_DIRTY=y CONFIG_MODULES_USE_ELF_RELA=y CONFIG_HAVE_IRQ_EXIT_ON_IRQ_STACK=y CONFIG_ARCH_HAS_ELF_RANDOMIZE=y CONFIG_HAVE_ARCH_MMAP_RND_BITS=y CONFIG_ARCH_MMAP_RND_BITS=28 CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS=y CONFIG_ARCH_MMAP_RND_COMPAT_BITS=8 CONFIG_HAVE_COPY_THREAD_TLS=y CONFIG_OLD_SIGSUSPEND3=y CONFIG_COMPAT_OLD_SIGACTION=y # # GCOV-based kernel profiling # # CONFIG_GCOV_KERNEL is not set CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set CONFIG_SLABINFO=y CONFIG_RT_MUTEXES=y CONFIG_BASE_SMALL=0 CONFIG_MODULES=y # CONFIG_MODULE_FORCE_LOAD is not set CONFIG_MODULE_UNLOAD=y CONFIG_MODULE_FORCE_UNLOAD=y # CONFIG_MODVERSIONS is not set # CONFIG_MODULE_SRCVERSION_ALL is not set # CONFIG_MODULE_SIG is not set # CONFIG_MODULE_COMPRESS is not set CONFIG_MODULES_TREE_LOOKUP=y CONFIG_BLOCK=y CONFIG_BLK_DEV_BSG=y CONFIG_BLK_DEV_BSGLIB=y CONFIG_BLK_DEV_INTEGRITY=y CONFIG_BLK_DEV_THROTTLING=y CONFIG_BLK_CMDLINE_PARSER=y # # Partition Types # CONFIG_PARTITION_ADVANCED=y CONFIG_ACORN_PARTITION=y CONFIG_ACORN_PARTITION_CUMANA=y CONFIG_ACORN_PARTITION_EESOX=y CONFIG_ACORN_PARTITION_ICS=y CONFIG_ACORN_PARTITION_ADFS=y CONFIG_ACORN_PARTITION_POWERTEC=y CONFIG_ACORN_PARTITION_RISCIX=y CONFIG_AIX_PARTITION=y CONFIG_OSF_PARTITION=y CONFIG_AMIGA_PARTITION=y CONFIG_ATARI_PARTITION=y CONFIG_MAC_PARTITION=y CONFIG_MSDOS_PARTITION=y CONFIG_BSD_DISKLABEL=y CONFIG_MINIX_SUBPARTITION=y CONFIG_SOLARIS_X86_PARTITION=y CONFIG_UNIXWARE_DISKLABEL=y CONFIG_LDM_PARTITION=y CONFIG_LDM_DEBUG=y CONFIG_SGI_PARTITION=y CONFIG_ULTRIX_PARTITION=y CONFIG_SUN_PARTITION=y CONFIG_KARMA_PARTITION=y CONFIG_EFI_PARTITION=y CONFIG_SYSV68_PARTITION=y CONFIG_CMDLINE_PARTITION=y CONFIG_BLOCK_COMPAT=y # # IO Schedulers # CONFIG_IOSCHED_NOOP=y CONFIG_IOSCHED_DEADLINE=y CONFIG_IOSCHED_CFQ=m CONFIG_CFQ_GROUP_IOSCHED=y CONFIG_DEFAULT_DEADLINE=y # CONFIG_DEFAULT_NOOP is not set CONFIG_DEFAULT_IOSCHED="deadline" CONFIG_PREEMPT_NOTIFIERS=y CONFIG_PADATA=y CONFIG_ASN1=y CONFIG_UNINLINE_SPIN_UNLOCK=y CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y CONFIG_RWSEM_SPIN_ON_OWNER=y CONFIG_LOCK_SPIN_ON_OWNER=y CONFIG_ARCH_USE_QUEUED_SPINLOCKS=y CONFIG_QUEUED_SPINLOCKS=y CONFIG_ARCH_USE_QUEUED_RWLOCKS=y CONFIG_QUEUED_RWLOCKS=y CONFIG_FREEZER=y # # Processor type and features # CONFIG_ZONE_DMA=y CONFIG_SMP=y CONFIG_X86_FEATURE_NAMES=y CONFIG_X86_FAST_FEATURE_TESTS=y # CONFIG_X86_X2APIC is not set CONFIG_X86_MPPARSE=y CONFIG_X86_EXTENDED_PLATFORM=y # CONFIG_X86_VSMP is not set # CONFIG_X86_GOLDFISH is not set CONFIG_X86_INTEL_MID=y # CONFIG_X86_INTEL_LPSS is not set # CONFIG_X86_AMD_PLATFORM_DEVICE is not set CONFIG_IOSF_MBI=y CONFIG_IOSF_MBI_DEBUG=y CONFIG_X86_SUPPORTS_MEMORY_FAILURE=y CONFIG_SCHED_OMIT_FRAME_POINTER=y CONFIG_HYPERVISOR_GUEST=y CONFIG_PARAVIRT=y CONFIG_PARAVIRT_DEBUG=y # CONFIG_PARAVIRT_SPINLOCKS is not set CONFIG_XEN=y CONFIG_XEN_DOM0=y CONFIG_XEN_PVHVM=y CONFIG_XEN_512GB=y CONFIG_XEN_SAVE_RESTORE=y CONFIG_XEN_DEBUG_FS=y CONFIG_XEN_PVH=y CONFIG_KVM_GUEST=y CONFIG_KVM_DEBUG_FS=y # CONFIG_PARAVIRT_TIME_ACCOUNTING is not set CONFIG_PARAVIRT_CLOCK=y CONFIG_NO_BOOTMEM=y # CONFIG_MK8 is not set # CONFIG_MPSC is not set # CONFIG_MCORE2 is not set # CONFIG_MATOM is not set CONFIG_GENERIC_CPU=y CONFIG_X86_INTERNODE_CACHE_SHIFT=6 CONFIG_X86_L1_CACHE_SHIFT=6 CONFIG_X86_TSC=y CONFIG_X86_CMPXCHG64=y CONFIG_X86_CMOV=y CONFIG_X86_MINIMUM_CPU_FAMILY=64 CONFIG_X86_DEBUGCTLMSR=y # CONFIG_PROCESSOR_SELECT is not set CONFIG_CPU_SUP_INTEL=y CONFIG_CPU_SUP_AMD=y CONFIG_CPU_SUP_CENTAUR=y CONFIG_HPET_TIMER=y CONFIG_HPET_EMULATE_RTC=y CONFIG_APB_TIMER=y CONFIG_DMI=y # CONFIG_GART_IOMMU is not set CONFIG_CALGARY_IOMMU=y CONFIG_CALGARY_IOMMU_ENABLED_BY_DEFAULT=y CONFIG_SWIOTLB=y CONFIG_IOMMU_HELPER=y # CONFIG_MAXSMP is not set CONFIG_NR_CPUS=64 CONFIG_SCHED_SMT=y CONFIG_SCHED_MC=y # CONFIG_PREEMPT_NONE is not set CONFIG_PREEMPT_VOLUNTARY=y # CONFIG_PREEMPT is not set CONFIG_PREEMPT_COUNT=y CONFIG_X86_LOCAL_APIC=y CONFIG_X86_IO_APIC=y CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y CONFIG_X86_MCE=y CONFIG_X86_MCE_INTEL=y CONFIG_X86_MCE_AMD=y CONFIG_X86_MCE_THRESHOLD=y # CONFIG_X86_MCE_INJECT is not set CONFIG_X86_THERMAL_VECTOR=y # CONFIG_VM86 is not set CONFIG_X86_16BIT=y CONFIG_X86_ESPFIX64=y CONFIG_X86_VSYSCALL_EMULATION=y # CONFIG_I8K is not set CONFIG_MICROCODE=y CONFIG_MICROCODE_INTEL=y CONFIG_MICROCODE_AMD=y CONFIG_MICROCODE_OLD_INTERFACE=y CONFIG_X86_MSR=y CONFIG_X86_CPUID=y CONFIG_ARCH_PHYS_ADDR_T_64BIT=y CONFIG_ARCH_DMA_ADDR_T_64BIT=y CONFIG_NUMA=y CONFIG_AMD_NUMA=y CONFIG_X86_64_ACPI_NUMA=y CONFIG_NODES_SPAN_OTHER_NODES=y # CONFIG_NUMA_EMU is not set CONFIG_NODES_SHIFT=6 CONFIG_ARCH_SPARSEMEM_ENABLE=y CONFIG_ARCH_SPARSEMEM_DEFAULT=y CONFIG_ARCH_SELECT_MEMORY_MODEL=y # CONFIG_ARCH_MEMORY_PROBE is not set CONFIG_ARCH_PROC_KCORE_TEXT=y CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000 CONFIG_SELECT_MEMORY_MODEL=y CONFIG_SPARSEMEM_MANUAL=y CONFIG_SPARSEMEM=y CONFIG_NEED_MULTIPLE_NODES=y CONFIG_HAVE_MEMORY_PRESENT=y CONFIG_SPARSEMEM_EXTREME=y CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y CONFIG_SPARSEMEM_ALLOC_MEM_MAP_TOGETHER=y CONFIG_SPARSEMEM_VMEMMAP=y CONFIG_HAVE_MEMBLOCK=y CONFIG_HAVE_MEMBLOCK_NODE_MAP=y CONFIG_ARCH_DISCARD_MEMBLOCK=y CONFIG_MEMORY_ISOLATION=y # CONFIG_MOVABLE_NODE is not set CONFIG_HAVE_BOOTMEM_INFO_NODE=y CONFIG_MEMORY_HOTPLUG=y CONFIG_MEMORY_HOTPLUG_SPARSE=y CONFIG_MEMORY_HOTREMOVE=y CONFIG_SPLIT_PTLOCK_CPUS=4 CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y CONFIG_MEMORY_BALLOON=y CONFIG_BALLOON_COMPACTION=y CONFIG_COMPACTION=y CONFIG_MIGRATION=y CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION=y CONFIG_PHYS_ADDR_T_64BIT=y CONFIG_ZONE_DMA_FLAG=1 CONFIG_BOUNCE=y CONFIG_VIRT_TO_BUS=y CONFIG_MMU_NOTIFIER=y # CONFIG_KSM is not set CONFIG_DEFAULT_MMAP_MIN_ADDR=4096 CONFIG_ARCH_SUPPORTS_MEMORY_FAILURE=y # CONFIG_MEMORY_FAILURE is not set CONFIG_TRANSPARENT_HUGEPAGE=y CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y # CONFIG_TRANSPARENT_HUGEPAGE_MADVISE is not set # CONFIG_CLEANCACHE is not set # CONFIG_FRONTSWAP is not set # CONFIG_CMA is not set # CONFIG_MEM_SOFT_DIRTY is not set # CONFIG_ZPOOL is not set # CONFIG_ZBUD is not set # CONFIG_ZSMALLOC is not set CONFIG_GENERIC_EARLY_IOREMAP=y CONFIG_ARCH_SUPPORTS_DEFERRED_STRUCT_PAGE_INIT=y # CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set # CONFIG_IDLE_PAGE_TRACKING is not set # CONFIG_X86_PMEM_LEGACY is not set CONFIG_X86_CHECK_BIOS_CORRUPTION=y CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK=y CONFIG_X86_RESERVE_LOW=64 CONFIG_MTRR=y # CONFIG_MTRR_SANITIZER is not set CONFIG_X86_PAT=y CONFIG_ARCH_USES_PG_UNCACHED=y CONFIG_ARCH_RANDOM=y CONFIG_X86_SMAP=y # CONFIG_X86_INTEL_MPX is not set CONFIG_EFI=y # CONFIG_EFI_STUB is not set CONFIG_SECCOMP=y # CONFIG_HZ_100 is not set # CONFIG_HZ_250 is not set # CONFIG_HZ_300 is not set CONFIG_HZ_1000=y CONFIG_HZ=1000 CONFIG_SCHED_HRTICK=y CONFIG_KEXEC=y # CONFIG_KEXEC_FILE is not set CONFIG_CRASH_DUMP=y CONFIG_PHYSICAL_START=0x1000000 CONFIG_RELOCATABLE=y # CONFIG_RANDOMIZE_BASE is not set CONFIG_PHYSICAL_ALIGN=0x200000 CONFIG_HOTPLUG_CPU=y # CONFIG_BOOTPARAM_HOTPLUG_CPU0 is not set # CONFIG_DEBUG_HOTPLUG_CPU0 is not set # CONFIG_COMPAT_VDSO is not set # CONFIG_LEGACY_VSYSCALL_NATIVE is not set CONFIG_LEGACY_VSYSCALL_EMULATE=y # CONFIG_LEGACY_VSYSCALL_NONE is not set # CONFIG_CMDLINE_BOOL is not set CONFIG_MODIFY_LDT_SYSCALL=y CONFIG_HAVE_LIVEPATCH=y CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y CONFIG_USE_PERCPU_NUMA_NODE_ID=y # # Power management and ACPI options # CONFIG_SUSPEND=y CONFIG_SUSPEND_FREEZER=y # CONFIG_SUSPEND_SKIP_SYNC is not set CONFIG_HIBERNATE_CALLBACKS=y # CONFIG_HIBERNATION is not set CONFIG_PM_SLEEP=y CONFIG_PM_SLEEP_SMP=y # CONFIG_PM_AUTOSLEEP is not set # CONFIG_PM_WAKELOCKS is not set CONFIG_PM=y # CONFIG_PM_DEBUG is not set # CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set CONFIG_ACPI=y CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC=y CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT=y CONFIG_ACPI_DEBUGGER=y CONFIG_ACPI_DEBUGGER_USER=y CONFIG_ACPI_SLEEP=y # CONFIG_ACPI_PROCFS_POWER is not set CONFIG_ACPI_REV_OVERRIDE_POSSIBLE=y # CONFIG_ACPI_EC_DEBUGFS is not set CONFIG_ACPI_AC=y CONFIG_ACPI_BATTERY=y CONFIG_ACPI_BUTTON=y CONFIG_ACPI_VIDEO=y CONFIG_ACPI_FAN=y CONFIG_ACPI_DOCK=y CONFIG_ACPI_CPU_FREQ_PSS=y CONFIG_ACPI_PROCESSOR_IDLE=y CONFIG_ACPI_PROCESSOR=y CONFIG_ACPI_HOTPLUG_CPU=y # CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set CONFIG_ACPI_THERMAL=y CONFIG_ACPI_NUMA=y # CONFIG_ACPI_CUSTOM_DSDT is not set # CONFIG_ACPI_INITRD_TABLE_OVERRIDE is not set CONFIG_ACPI_DEBUG=y # CONFIG_ACPI_PCI_SLOT is not set CONFIG_X86_PM_TIMER=y CONFIG_ACPI_CONTAINER=y CONFIG_ACPI_HOTPLUG_MEMORY=y CONFIG_ACPI_HOTPLUG_IOAPIC=y # CONFIG_ACPI_SBS is not set # CONFIG_ACPI_HED is not set # CONFIG_ACPI_CUSTOM_METHOD is not set # CONFIG_ACPI_BGRT is not set # CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set # CONFIG_ACPI_NFIT is not set CONFIG_HAVE_ACPI_APEI=y CONFIG_HAVE_ACPI_APEI_NMI=y # CONFIG_ACPI_APEI is not set # CONFIG_ACPI_EXTLOG is not set # CONFIG_PMIC_OPREGION is not set CONFIG_SFI=y # # CPU Frequency scaling # CONFIG_CPU_FREQ=y CONFIG_CPU_FREQ_GOV_COMMON=y # CONFIG_CPU_FREQ_STAT is not set # CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set # CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE=y # CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set # CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set CONFIG_CPU_FREQ_GOV_PERFORMANCE=y # CONFIG_CPU_FREQ_GOV_POWERSAVE is not set CONFIG_CPU_FREQ_GOV_USERSPACE=y CONFIG_CPU_FREQ_GOV_ONDEMAND=y # CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set # # CPU frequency scaling drivers # CONFIG_X86_INTEL_PSTATE=y # CONFIG_X86_PCC_CPUFREQ is not set CONFIG_X86_ACPI_CPUFREQ=y CONFIG_X86_ACPI_CPUFREQ_CPB=y CONFIG_X86_SFI_CPUFREQ=y # CONFIG_X86_POWERNOW_K8 is not set # CONFIG_X86_AMD_FREQ_SENSITIVITY is not set # CONFIG_X86_SPEEDSTEP_CENTRINO is not set # CONFIG_X86_P4_CLOCKMOD is not set # # shared options # # CONFIG_X86_SPEEDSTEP_LIB is not set # # CPU Idle # CONFIG_CPU_IDLE=y CONFIG_CPU_IDLE_GOV_LADDER=y CONFIG_CPU_IDLE_GOV_MENU=y # CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED is not set # CONFIG_INTEL_IDLE is not set # # Memory power savings # # CONFIG_I7300_IDLE is not set # # Bus options (PCI etc.) # CONFIG_PCI=y CONFIG_PCI_DIRECT=y CONFIG_PCI_MMCONFIG=y CONFIG_PCI_XEN=y CONFIG_PCI_DOMAINS=y # CONFIG_PCI_CNB20LE_QUIRK is not set CONFIG_PCIEPORTBUS=y CONFIG_HOTPLUG_PCI_PCIE=y CONFIG_PCIEAER=y # CONFIG_PCIE_ECRC is not set # CONFIG_PCIEAER_INJECT is not set CONFIG_PCIEASPM=y CONFIG_PCIEASPM_DEBUG=y CONFIG_PCIEASPM_DEFAULT=y # CONFIG_PCIEASPM_POWERSAVE is not set # CONFIG_PCIEASPM_PERFORMANCE is not set CONFIG_PCIE_PME=y CONFIG_PCI_BUS_ADDR_T_64BIT=y CONFIG_PCI_MSI=y CONFIG_PCI_MSI_IRQ_DOMAIN=y CONFIG_PCI_DEBUG=y # CONFIG_PCI_REALLOC_ENABLE_AUTO is not set # CONFIG_PCI_STUB is not set CONFIG_XEN_PCIDEV_FRONTEND=y CONFIG_HT_IRQ=y CONFIG_PCI_ATS=y CONFIG_PCI_IOV=y CONFIG_PCI_PRI=y CONFIG_PCI_PASID=y CONFIG_PCI_LABEL=y # # PCI host controller drivers # CONFIG_ISA_DMA_API=y CONFIG_AMD_NB=y CONFIG_PCCARD=y CONFIG_PCMCIA=y CONFIG_PCMCIA_LOAD_CIS=y CONFIG_CARDBUS=y # # PC-card bridges # CONFIG_YENTA=y CONFIG_YENTA_O2=y CONFIG_YENTA_RICOH=y CONFIG_YENTA_TI=y CONFIG_YENTA_ENE_TUNE=y CONFIG_YENTA_TOSHIBA=y CONFIG_PD6729=y CONFIG_I82092=y CONFIG_PCCARD_NONSTATIC=y CONFIG_HOTPLUG_PCI=y CONFIG_HOTPLUG_PCI_ACPI=y CONFIG_HOTPLUG_PCI_ACPI_IBM=y CONFIG_HOTPLUG_PCI_CPCI=y CONFIG_HOTPLUG_PCI_CPCI_ZT5550=y CONFIG_HOTPLUG_PCI_CPCI_GENERIC=y CONFIG_HOTPLUG_PCI_SHPC=y CONFIG_RAPIDIO=y CONFIG_RAPIDIO_TSI721=y CONFIG_RAPIDIO_DISC_TIMEOUT=30 CONFIG_RAPIDIO_ENABLE_RX_TX_PORTS=y CONFIG_RAPIDIO_DMA_ENGINE=y CONFIG_RAPIDIO_DEBUG=y # CONFIG_RAPIDIO_ENUM_BASIC is not set # # RapidIO Switch drivers # CONFIG_RAPIDIO_TSI57X=y CONFIG_RAPIDIO_CPS_XX=y CONFIG_RAPIDIO_TSI568=y CONFIG_RAPIDIO_CPS_GEN2=y CONFIG_X86_SYSFB=y # # Executable file formats / Emulations # CONFIG_BINFMT_ELF=y CONFIG_COMPAT_BINFMT_ELF=y CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y CONFIG_BINFMT_SCRIPT=y # CONFIG_HAVE_AOUT is not set CONFIG_BINFMT_MISC=y CONFIG_COREDUMP=y CONFIG_IA32_EMULATION=y CONFIG_IA32_AOUT=y CONFIG_X86_X32=y CONFIG_COMPAT=y CONFIG_COMPAT_FOR_U64_ALIGNMENT=y CONFIG_SYSVIPC_COMPAT=y CONFIG_KEYS_COMPAT=y CONFIG_X86_DEV_DMA_OPS=y CONFIG_PMC_ATOM=y CONFIG_VMD=y CONFIG_NET=y CONFIG_COMPAT_NETLINK_MESSAGES=y CONFIG_NET_INGRESS=y # # Networking options # CONFIG_PACKET=y CONFIG_PACKET_DIAG=y CONFIG_UNIX=y CONFIG_UNIX_DIAG=y CONFIG_XFRM=y CONFIG_XFRM_ALGO=y CONFIG_XFRM_USER=y # CONFIG_XFRM_SUB_POLICY is not set CONFIG_XFRM_MIGRATE=y # CONFIG_XFRM_STATISTICS is not set CONFIG_XFRM_IPCOMP=y CONFIG_NET_KEY=y CONFIG_NET_KEY_MIGRATE=y CONFIG_INET=y CONFIG_IP_MULTICAST=y CONFIG_IP_ADVANCED_ROUTER=y # CONFIG_IP_FIB_TRIE_STATS is not set CONFIG_IP_MULTIPLE_TABLES=y CONFIG_IP_ROUTE_MULTIPATH=y CONFIG_IP_ROUTE_VERBOSE=y CONFIG_IP_ROUTE_CLASSID=y CONFIG_IP_PNP=y CONFIG_IP_PNP_DHCP=y CONFIG_IP_PNP_BOOTP=y CONFIG_IP_PNP_RARP=y CONFIG_NET_IPIP=y CONFIG_NET_IPGRE_DEMUX=y CONFIG_NET_IP_TUNNEL=y CONFIG_NET_IPGRE=y CONFIG_NET_IPGRE_BROADCAST=y CONFIG_IP_MROUTE=y CONFIG_IP_MROUTE_MULTIPLE_TABLES=y CONFIG_IP_PIMSM_V1=y CONFIG_IP_PIMSM_V2=y CONFIG_SYN_COOKIES=y CONFIG_NET_IPVTI=y CONFIG_NET_UDP_TUNNEL=y CONFIG_NET_FOU=y CONFIG_NET_FOU_IP_TUNNELS=y CONFIG_INET_AH=y CONFIG_INET_ESP=y CONFIG_INET_IPCOMP=y CONFIG_INET_XFRM_TUNNEL=y CONFIG_INET_TUNNEL=y CONFIG_INET_XFRM_MODE_TRANSPORT=y CONFIG_INET_XFRM_MODE_TUNNEL=y CONFIG_INET_XFRM_MODE_BEET=y CONFIG_INET_LRO=y CONFIG_INET_DIAG=y CONFIG_INET_TCP_DIAG=y CONFIG_INET_UDP_DIAG=y CONFIG_INET_DIAG_DESTROY=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BIC=y CONFIG_TCP_CONG_CUBIC=y # CONFIG_TCP_CONG_WESTWOOD is not set # CONFIG_TCP_CONG_HTCP is not set # CONFIG_TCP_CONG_HSTCP is not set # CONFIG_TCP_CONG_HYBLA is not set # CONFIG_TCP_CONG_VEGAS is not set # CONFIG_TCP_CONG_SCALABLE is not set # CONFIG_TCP_CONG_LP is not set # CONFIG_TCP_CONG_VENO is not set # CONFIG_TCP_CONG_YEAH is not set # CONFIG_TCP_CONG_ILLINOIS is not set # CONFIG_TCP_CONG_DCTCP is not set # CONFIG_TCP_CONG_CDG is not set # CONFIG_DEFAULT_BIC is not set CONFIG_DEFAULT_CUBIC=y # CONFIG_DEFAULT_RENO is not set CONFIG_DEFAULT_TCP_CONG="cubic" CONFIG_TCP_MD5SIG=y CONFIG_IPV6=y CONFIG_IPV6_ROUTER_PREF=y CONFIG_IPV6_ROUTE_INFO=y # CONFIG_IPV6_OPTIMISTIC_DAD is not set CONFIG_INET6_AH=y CONFIG_INET6_ESP=y CONFIG_INET6_IPCOMP=y CONFIG_IPV6_MIP6=y CONFIG_IPV6_ILA=y CONFIG_INET6_XFRM_TUNNEL=y CONFIG_INET6_TUNNEL=y CONFIG_INET6_XFRM_MODE_TRANSPORT=y CONFIG_INET6_XFRM_MODE_TUNNEL=y CONFIG_INET6_XFRM_MODE_BEET=y CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION=y CONFIG_IPV6_VTI=y CONFIG_IPV6_SIT=y CONFIG_IPV6_SIT_6RD=y CONFIG_IPV6_NDISC_NODETYPE=y CONFIG_IPV6_TUNNEL=y CONFIG_IPV6_GRE=y CONFIG_IPV6_MULTIPLE_TABLES=y CONFIG_IPV6_SUBTREES=y CONFIG_IPV6_MROUTE=y CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y CONFIG_IPV6_PIMSM_V2=y CONFIG_NETLABEL=y CONFIG_NETWORK_SECMARK=y CONFIG_NET_PTP_CLASSIFY=y CONFIG_NETWORK_PHY_TIMESTAMPING=y CONFIG_NETFILTER=y CONFIG_NETFILTER_DEBUG=y # CONFIG_NETFILTER_ADVANCED is not set # # Core Netfilter Configuration # CONFIG_NETFILTER_INGRESS=y CONFIG_NETFILTER_NETLINK=y CONFIG_NETFILTER_NETLINK_LOG=y CONFIG_NF_CONNTRACK=y CONFIG_NF_LOG_COMMON=m CONFIG_NF_CONNTRACK_SECMARK=y CONFIG_NF_CONNTRACK_PROCFS=y CONFIG_NF_CONNTRACK_FTP=y CONFIG_NF_CONNTRACK_IRC=y # CONFIG_NF_CONNTRACK_NETBIOS_NS is not set CONFIG_NF_CONNTRACK_SIP=y CONFIG_NF_CT_NETLINK=y # CONFIG_NETFILTER_NETLINK_GLUE_CT is not set CONFIG_NF_NAT=y CONFIG_NF_NAT_NEEDED=y # CONFIG_NF_NAT_AMANDA is not set CONFIG_NF_NAT_FTP=y CONFIG_NF_NAT_IRC=y CONFIG_NF_NAT_SIP=y # CONFIG_NF_NAT_TFTP is not set # CONFIG_NF_NAT_REDIRECT is not set CONFIG_NF_TABLES=y CONFIG_NF_TABLES_INET=y CONFIG_NF_TABLES_NETDEV=y CONFIG_NFT_EXTHDR=y CONFIG_NFT_META=y CONFIG_NFT_CT=y CONFIG_NFT_RBTREE=y CONFIG_NFT_HASH=y CONFIG_NFT_COUNTER=y CONFIG_NFT_LOG=y CONFIG_NFT_LIMIT=y # CONFIG_NFT_MASQ is not set # CONFIG_NFT_REDIR is not set CONFIG_NFT_NAT=y CONFIG_NFT_REJECT=y CONFIG_NFT_REJECT_INET=y CONFIG_NFT_COMPAT=y CONFIG_NF_DUP_NETDEV=y CONFIG_NFT_DUP_NETDEV=y CONFIG_NFT_FWD_NETDEV=y CONFIG_NETFILTER_XTABLES=y # # Xtables combined modules # CONFIG_NETFILTER_XT_MARK=m # # Xtables targets # CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=y CONFIG_NETFILTER_XT_TARGET_LOG=m CONFIG_NETFILTER_XT_NAT=m # CONFIG_NETFILTER_XT_TARGET_NETMAP is not set CONFIG_NETFILTER_XT_TARGET_NFLOG=y # CONFIG_NETFILTER_XT_TARGET_REDIRECT is not set CONFIG_NETFILTER_XT_TARGET_SECMARK=y CONFIG_NETFILTER_XT_TARGET_TCPMSS=y # # Xtables matches # CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y CONFIG_NETFILTER_XT_MATCH_POLICY=y CONFIG_NETFILTER_XT_MATCH_STATE=y CONFIG_IP_SET=y CONFIG_IP_SET_MAX=256 CONFIG_IP_SET_BITMAP_IP=y CONFIG_IP_SET_BITMAP_IPMAC=y CONFIG_IP_SET_BITMAP_PORT=y CONFIG_IP_SET_HASH_IP=y CONFIG_IP_SET_HASH_IPMARK=y CONFIG_IP_SET_HASH_IPPORT=y CONFIG_IP_SET_HASH_IPPORTIP=y CONFIG_IP_SET_HASH_IPPORTNET=y CONFIG_IP_SET_HASH_MAC=y CONFIG_IP_SET_HASH_NETPORTNET=y CONFIG_IP_SET_HASH_NET=y CONFIG_IP_SET_HASH_NETNET=y CONFIG_IP_SET_HASH_NETPORT=y CONFIG_IP_SET_HASH_NETIFACE=y CONFIG_IP_SET_LIST_SET=y # CONFIG_IP_VS is not set # # IP: Netfilter Configuration # CONFIG_NF_DEFRAG_IPV4=y CONFIG_NF_CONNTRACK_IPV4=y CONFIG_NF_CONNTRACK_PROC_COMPAT=y CONFIG_NF_TABLES_IPV4=y CONFIG_NFT_CHAIN_ROUTE_IPV4=y CONFIG_NFT_REJECT_IPV4=y CONFIG_NFT_DUP_IPV4=y CONFIG_NF_TABLES_ARP=y CONFIG_NF_DUP_IPV4=y CONFIG_NF_LOG_ARP=m CONFIG_NF_LOG_IPV4=m CONFIG_NF_REJECT_IPV4=y CONFIG_NF_NAT_IPV4=m # CONFIG_NFT_CHAIN_NAT_IPV4 is not set CONFIG_NF_NAT_MASQUERADE_IPV4=m # CONFIG_NF_NAT_PPTP is not set # CONFIG_NF_NAT_H323 is not set CONFIG_IP_NF_IPTABLES=y CONFIG_IP_NF_FILTER=y CONFIG_IP_NF_TARGET_REJECT=y CONFIG_IP_NF_NAT=m CONFIG_IP_NF_TARGET_MASQUERADE=m CONFIG_IP_NF_MANGLE=y CONFIG_IP_NF_RAW=y # # IPv6: Netfilter Configuration # CONFIG_NF_DEFRAG_IPV6=y CONFIG_NF_CONNTRACK_IPV6=y CONFIG_NF_TABLES_IPV6=y CONFIG_NFT_CHAIN_ROUTE_IPV6=y CONFIG_NFT_REJECT_IPV6=y CONFIG_NFT_DUP_IPV6=y CONFIG_NF_DUP_IPV6=y CONFIG_NF_REJECT_IPV6=y CONFIG_NF_LOG_IPV6=m CONFIG_IP6_NF_IPTABLES=y CONFIG_IP6_NF_MATCH_IPV6HEADER=y CONFIG_IP6_NF_FILTER=y CONFIG_IP6_NF_TARGET_REJECT=y CONFIG_IP6_NF_MANGLE=y CONFIG_IP6_NF_RAW=y CONFIG_NF_TABLES_BRIDGE=y CONFIG_NFT_BRIDGE_META=y CONFIG_NFT_BRIDGE_REJECT=y CONFIG_NF_LOG_BRIDGE=y CONFIG_BRIDGE_NF_EBTABLES=y CONFIG_BRIDGE_EBT_BROUTE=y CONFIG_BRIDGE_EBT_T_FILTER=y CONFIG_BRIDGE_EBT_T_NAT=y CONFIG_BRIDGE_EBT_802_3=y CONFIG_BRIDGE_EBT_AMONG=y CONFIG_BRIDGE_EBT_ARP=y CONFIG_BRIDGE_EBT_IP=y CONFIG_BRIDGE_EBT_IP6=y CONFIG_BRIDGE_EBT_LIMIT=y CONFIG_BRIDGE_EBT_MARK=y CONFIG_BRIDGE_EBT_PKTTYPE=y CONFIG_BRIDGE_EBT_STP=y CONFIG_BRIDGE_EBT_VLAN=y CONFIG_BRIDGE_EBT_ARPREPLY=y CONFIG_BRIDGE_EBT_DNAT=y CONFIG_BRIDGE_EBT_MARK_T=y CONFIG_BRIDGE_EBT_REDIRECT=y CONFIG_BRIDGE_EBT_SNAT=y CONFIG_BRIDGE_EBT_LOG=y CONFIG_BRIDGE_EBT_NFLOG=y CONFIG_IP_DCCP=y CONFIG_INET_DCCP_DIAG=y # # DCCP CCIDs Configuration # CONFIG_IP_DCCP_CCID2_DEBUG=y CONFIG_IP_DCCP_CCID3=y CONFIG_IP_DCCP_CCID3_DEBUG=y CONFIG_IP_DCCP_TFRC_LIB=y CONFIG_IP_DCCP_TFRC_DEBUG=y # # DCCP Kernel Hacking # CONFIG_IP_DCCP_DEBUG=y CONFIG_NET_DCCPPROBE=y CONFIG_IP_SCTP=y CONFIG_NET_SCTPPROBE=y CONFIG_SCTP_DBG_OBJCNT=y # CONFIG_SCTP_DEFAULT_COOKIE_HMAC_MD5 is not set # CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA1 is not set CONFIG_SCTP_DEFAULT_COOKIE_HMAC_NONE=y # CONFIG_SCTP_COOKIE_HMAC_MD5 is not set # CONFIG_SCTP_COOKIE_HMAC_SHA1 is not set CONFIG_RDS=y CONFIG_RDS_RDMA=m CONFIG_RDS_TCP=y CONFIG_RDS_DEBUG=y CONFIG_TIPC=y # CONFIG_TIPC_MEDIA_IB is not set CONFIG_TIPC_MEDIA_UDP=y CONFIG_ATM=y CONFIG_ATM_CLIP=y # CONFIG_ATM_CLIP_NO_ICMP is not set CONFIG_ATM_LANE=y CONFIG_ATM_MPOA=y CONFIG_ATM_BR2684=y CONFIG_ATM_BR2684_IPFILTER=y CONFIG_L2TP=y CONFIG_L2TP_DEBUGFS=y CONFIG_L2TP_V3=y CONFIG_L2TP_IP=y CONFIG_L2TP_ETH=y CONFIG_STP=y CONFIG_GARP=y CONFIG_MRP=y CONFIG_BRIDGE=y CONFIG_BRIDGE_IGMP_SNOOPING=y CONFIG_BRIDGE_VLAN_FILTERING=y CONFIG_HAVE_NET_DSA=y CONFIG_VLAN_8021Q=y CONFIG_VLAN_8021Q_GVRP=y CONFIG_VLAN_8021Q_MVRP=y CONFIG_DECNET=y CONFIG_DECNET_ROUTER=y CONFIG_LLC=y CONFIG_LLC2=y CONFIG_IPX=y CONFIG_IPX_INTERN=y CONFIG_ATALK=y CONFIG_DEV_APPLETALK=y CONFIG_IPDDP=y CONFIG_IPDDP_ENCAP=y CONFIG_X25=y CONFIG_LAPB=y CONFIG_PHONET=y CONFIG_6LOWPAN=y # CONFIG_6LOWPAN_DEBUGFS is not set CONFIG_6LOWPAN_NHC=y CONFIG_6LOWPAN_NHC_DEST=y CONFIG_6LOWPAN_NHC_FRAGMENT=y CONFIG_6LOWPAN_NHC_HOP=y CONFIG_6LOWPAN_NHC_IPV6=y CONFIG_6LOWPAN_NHC_MOBILITY=y CONFIG_6LOWPAN_NHC_ROUTING=y CONFIG_6LOWPAN_NHC_UDP=y CONFIG_6LOWPAN_GHC_EXT_HDR_HOP=y CONFIG_6LOWPAN_GHC_UDP=y CONFIG_6LOWPAN_GHC_ICMPV6=y CONFIG_6LOWPAN_GHC_EXT_HDR_DEST=y CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=y CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=y CONFIG_IEEE802154=y CONFIG_IEEE802154_NL802154_EXPERIMENTAL=y CONFIG_IEEE802154_SOCKET=y CONFIG_IEEE802154_6LOWPAN=y CONFIG_MAC802154=y CONFIG_NET_SCHED=y # # Queueing/Scheduling # CONFIG_NET_SCH_CBQ=y CONFIG_NET_SCH_HTB=y CONFIG_NET_SCH_HFSC=y CONFIG_NET_SCH_ATM=y CONFIG_NET_SCH_PRIO=y CONFIG_NET_SCH_MULTIQ=y CONFIG_NET_SCH_RED=y CONFIG_NET_SCH_SFB=y # CONFIG_NET_SCH_SFQ is not set # CONFIG_NET_SCH_TEQL is not set # CONFIG_NET_SCH_TBF is not set # CONFIG_NET_SCH_GRED is not set # CONFIG_NET_SCH_DSMARK is not set # CONFIG_NET_SCH_NETEM is not set # CONFIG_NET_SCH_DRR is not set # CONFIG_NET_SCH_MQPRIO is not set # CONFIG_NET_SCH_CHOKE is not set # CONFIG_NET_SCH_QFQ is not set # CONFIG_NET_SCH_CODEL is not set # CONFIG_NET_SCH_FQ_CODEL is not set # CONFIG_NET_SCH_FQ is not set # CONFIG_NET_SCH_HHF is not set # CONFIG_NET_SCH_PIE is not set # CONFIG_NET_SCH_INGRESS is not set # CONFIG_NET_SCH_PLUG is not set # # Classification # CONFIG_NET_CLS=y CONFIG_NET_CLS_BASIC=y CONFIG_NET_CLS_TCINDEX=y CONFIG_NET_CLS_ROUTE4=y CONFIG_NET_CLS_FW=y CONFIG_NET_CLS_U32=y CONFIG_CLS_U32_PERF=y CONFIG_CLS_U32_MARK=y CONFIG_NET_CLS_RSVP=y CONFIG_NET_CLS_RSVP6=y CONFIG_NET_CLS_FLOW=y # CONFIG_NET_CLS_CGROUP is not set CONFIG_NET_CLS_BPF=y # CONFIG_NET_CLS_FLOWER is not set CONFIG_NET_EMATCH=y CONFIG_NET_EMATCH_STACK=32 # CONFIG_NET_EMATCH_CMP is not set # CONFIG_NET_EMATCH_NBYTE is not set # CONFIG_NET_EMATCH_U32 is not set # CONFIG_NET_EMATCH_META is not set # CONFIG_NET_EMATCH_TEXT is not set CONFIG_NET_EMATCH_CANID=y CONFIG_NET_EMATCH_IPSET=y CONFIG_NET_CLS_ACT=y # CONFIG_NET_ACT_POLICE is not set # CONFIG_NET_ACT_GACT is not set # CONFIG_NET_ACT_MIRRED is not set # CONFIG_NET_ACT_IPT is not set CONFIG_NET_ACT_NAT=y # CONFIG_NET_ACT_PEDIT is not set # CONFIG_NET_ACT_SIMP is not set # CONFIG_NET_ACT_SKBEDIT is not set CONFIG_NET_ACT_CSUM=y # CONFIG_NET_ACT_VLAN is not set # CONFIG_NET_ACT_BPF is not set CONFIG_NET_CLS_IND=y CONFIG_NET_SCH_FIFO=y CONFIG_DCB=y CONFIG_DNS_RESOLVER=y CONFIG_BATMAN_ADV=y CONFIG_BATMAN_ADV_BLA=y CONFIG_BATMAN_ADV_DAT=y CONFIG_BATMAN_ADV_NC=y CONFIG_BATMAN_ADV_MCAST=y # CONFIG_BATMAN_ADV_DEBUG is not set CONFIG_OPENVSWITCH=y CONFIG_OPENVSWITCH_GRE=y CONFIG_OPENVSWITCH_VXLAN=y CONFIG_VSOCKETS=y CONFIG_NETLINK_MMAP=y # CONFIG_NETLINK_DIAG is not set CONFIG_MPLS=y CONFIG_NET_MPLS_GSO=y # CONFIG_MPLS_ROUTING is not set CONFIG_HSR=m # CONFIG_NET_SWITCHDEV is not set CONFIG_NET_L3_MASTER_DEV=y CONFIG_RPS=y CONFIG_RFS_ACCEL=y CONFIG_XPS=y CONFIG_SOCK_CGROUP_DATA=y CONFIG_CGROUP_NET_PRIO=y CONFIG_CGROUP_NET_CLASSID=y CONFIG_NET_RX_BUSY_POLL=y CONFIG_BQL=y CONFIG_BPF_JIT=y CONFIG_NET_FLOW_LIMIT=y # # Network testing # # CONFIG_NET_PKTGEN is not set # CONFIG_NET_TCPPROBE is not set # CONFIG_NET_DROP_MONITOR is not set CONFIG_HAMRADIO=y # # Packet Radio protocols # CONFIG_AX25=y CONFIG_AX25_DAMA_SLAVE=y CONFIG_NETROM=y CONFIG_ROSE=y # # AX.25 network device drivers # CONFIG_MKISS=y CONFIG_6PACK=y CONFIG_BPQETHER=y CONFIG_BAYCOM_SER_FDX=y CONFIG_BAYCOM_SER_HDX=y # CONFIG_BAYCOM_PAR is not set CONFIG_YAM=y CONFIG_CAN=y CONFIG_CAN_RAW=y CONFIG_CAN_BCM=y CONFIG_CAN_GW=y # # CAN Device Drivers # CONFIG_CAN_VCAN=y CONFIG_CAN_SLCAN=y CONFIG_CAN_DEV=y CONFIG_CAN_CALC_BITTIMING=y CONFIG_CAN_LEDS=y CONFIG_CAN_SJA1000=y CONFIG_CAN_SJA1000_ISA=y CONFIG_CAN_SJA1000_PLATFORM=y CONFIG_CAN_EMS_PCMCIA=y CONFIG_CAN_EMS_PCI=y CONFIG_CAN_PEAK_PCMCIA=y CONFIG_CAN_PEAK_PCI=y CONFIG_CAN_PEAK_PCIEC=y CONFIG_CAN_KVASER_PCI=y CONFIG_CAN_PLX_PCI=y CONFIG_CAN_C_CAN=y CONFIG_CAN_C_CAN_PLATFORM=y CONFIG_CAN_C_CAN_PCI=y CONFIG_CAN_M_CAN=y CONFIG_CAN_CC770=y CONFIG_CAN_CC770_ISA=y CONFIG_CAN_CC770_PLATFORM=y # # CAN USB interfaces # CONFIG_CAN_EMS_USB=y CONFIG_CAN_ESD_USB2=y CONFIG_CAN_GS_USB=y CONFIG_CAN_KVASER_USB=y CONFIG_CAN_PEAK_USB=y CONFIG_CAN_8DEV_USB=y CONFIG_CAN_SOFTING=y CONFIG_CAN_SOFTING_CS=y CONFIG_CAN_DEBUG_DEVICES=y CONFIG_IRDA=y # # IrDA protocols # CONFIG_IRLAN=y CONFIG_IRNET=y CONFIG_IRCOMM=y CONFIG_IRDA_ULTRA=y # # IrDA options # CONFIG_IRDA_CACHE_LAST_LSAP=y CONFIG_IRDA_FAST_RR=y CONFIG_IRDA_DEBUG=y # # Infrared-port device drivers # # # SIR device drivers # CONFIG_IRTTY_SIR=y # # Dongle support # CONFIG_DONGLE=y CONFIG_ESI_DONGLE=y CONFIG_ACTISYS_DONGLE=y CONFIG_TEKRAM_DONGLE=y CONFIG_TOIM3232_DONGLE=y CONFIG_LITELINK_DONGLE=y CONFIG_MA600_DONGLE=y CONFIG_GIRBIL_DONGLE=y CONFIG_MCP2120_DONGLE=y CONFIG_OLD_BELKIN_DONGLE=y CONFIG_ACT200L_DONGLE=y CONFIG_KINGSUN_DONGLE=y CONFIG_KSDAZZLE_DONGLE=y CONFIG_KS959_DONGLE=y # # FIR device drivers # CONFIG_USB_IRDA=y CONFIG_SIGMATEL_FIR=y CONFIG_NSC_FIR=y CONFIG_WINBOND_FIR=y CONFIG_SMC_IRCC_FIR=y CONFIG_ALI_FIR=y CONFIG_VLSI_FIR=y CONFIG_VIA_FIR=y CONFIG_MCS_FIR=y CONFIG_BT=y CONFIG_BT_BREDR=y CONFIG_BT_RFCOMM=y CONFIG_BT_RFCOMM_TTY=y CONFIG_BT_BNEP=y CONFIG_BT_BNEP_MC_FILTER=y CONFIG_BT_BNEP_PROTO_FILTER=y CONFIG_BT_CMTP=y CONFIG_BT_HIDP=y CONFIG_BT_HS=y CONFIG_BT_LE=y CONFIG_BT_6LOWPAN=y CONFIG_BT_SELFTEST=y CONFIG_BT_SELFTEST_ECDH=y CONFIG_BT_SELFTEST_SMP=y CONFIG_BT_DEBUGFS=y # # Bluetooth device drivers # CONFIG_BT_INTEL=y CONFIG_BT_BCM=y CONFIG_BT_RTL=y CONFIG_BT_QCA=y CONFIG_BT_HCIBTUSB=y CONFIG_BT_HCIBTUSB_BCM=y CONFIG_BT_HCIBTUSB_RTL=y # CONFIG_BT_HCIBTSDIO is not set CONFIG_BT_HCIUART=y CONFIG_BT_HCIUART_H4=y CONFIG_BT_HCIUART_BCSP=y CONFIG_BT_HCIUART_ATH3K=y CONFIG_BT_HCIUART_LL=y CONFIG_BT_HCIUART_3WIRE=y CONFIG_BT_HCIUART_INTEL=y CONFIG_BT_HCIUART_BCM=y CONFIG_BT_HCIUART_QCA=y CONFIG_BT_HCIBCM203X=y CONFIG_BT_HCIBPA10X=y CONFIG_BT_HCIBFUSB=y CONFIG_BT_HCIDTL1=y CONFIG_BT_HCIBT3C=y CONFIG_BT_HCIBLUECARD=y CONFIG_BT_HCIBTUART=y CONFIG_BT_HCIVHCI=y CONFIG_BT_MRVL=y # CONFIG_BT_MRVL_SDIO is not set CONFIG_BT_ATH3K=y CONFIG_AF_RXRPC=y CONFIG_AF_RXRPC_DEBUG=y CONFIG_RXKAD=y CONFIG_FIB_RULES=y CONFIG_WIRELESS=y CONFIG_WIRELESS_EXT=y CONFIG_WEXT_CORE=y CONFIG_WEXT_PROC=y CONFIG_WEXT_PRIV=y CONFIG_CFG80211=y # CONFIG_NL80211_TESTMODE is not set # CONFIG_CFG80211_DEVELOPER_WARNINGS is not set CONFIG_CFG80211_REG_DEBUG=y # CONFIG_CFG80211_CERTIFICATION_ONUS is not set CONFIG_CFG80211_DEFAULT_PS=y # CONFIG_CFG80211_DEBUGFS is not set # CONFIG_CFG80211_INTERNAL_REGDB is not set CONFIG_CFG80211_CRDA_SUPPORT=y CONFIG_CFG80211_WEXT=y CONFIG_LIB80211=m CONFIG_LIB80211_DEBUG=y CONFIG_MAC80211=y CONFIG_MAC80211_HAS_RC=y CONFIG_MAC80211_RC_MINSTREL=y CONFIG_MAC80211_RC_MINSTREL_HT=y # CONFIG_MAC80211_RC_MINSTREL_VHT is not set CONFIG_MAC80211_RC_DEFAULT_MINSTREL=y CONFIG_MAC80211_RC_DEFAULT="minstrel_ht" # CONFIG_MAC80211_MESH is not set CONFIG_MAC80211_LEDS=y CONFIG_MAC80211_DEBUGFS=y # CONFIG_MAC80211_MESSAGE_TRACING is not set # CONFIG_MAC80211_DEBUG_MENU is not set CONFIG_MAC80211_STA_HASH_MAX_SIZE=0 CONFIG_WIMAX=y CONFIG_WIMAX_DEBUG_LEVEL=1 CONFIG_RFKILL=y CONFIG_RFKILL_LEDS=y # CONFIG_RFKILL_INPUT is not set CONFIG_NET_9P=y CONFIG_NET_9P_VIRTIO=y # CONFIG_NET_9P_RDMA is not set CONFIG_NET_9P_DEBUG=y CONFIG_CAIF=y CONFIG_CAIF_DEBUG=y CONFIG_CAIF_NETDEV=y # CONFIG_CAIF_USB is not set CONFIG_CEPH_LIB=y CONFIG_CEPH_LIB_PRETTYDEBUG=y CONFIG_CEPH_LIB_USE_DNS_RESOLVER=y CONFIG_NFC=y CONFIG_NFC_DIGITAL=y CONFIG_NFC_NCI=y CONFIG_NFC_NCI_UART=y CONFIG_NFC_HCI=y CONFIG_NFC_SHDLC=y # # Near Field Communication (NFC) devices # CONFIG_NFC_PN533=y CONFIG_NFC_MEI_PHY=y CONFIG_NFC_SIM=y CONFIG_NFC_PORT100=y CONFIG_NFC_FDP=y CONFIG_NFC_FDP_I2C=y CONFIG_NFC_PN544=y CONFIG_NFC_PN544_I2C=y CONFIG_NFC_PN544_MEI=y CONFIG_NFC_MICROREAD=y CONFIG_NFC_MICROREAD_I2C=y CONFIG_NFC_MICROREAD_MEI=y CONFIG_NFC_MRVL=y CONFIG_NFC_MRVL_USB=y CONFIG_NFC_MRVL_UART=y CONFIG_NFC_MRVL_I2C=y CONFIG_NFC_ST21NFCA=y CONFIG_NFC_ST21NFCA_I2C=y CONFIG_NFC_ST_NCI=y CONFIG_NFC_ST_NCI_I2C=y CONFIG_NFC_NXP_NCI=y CONFIG_NFC_NXP_NCI_I2C=y CONFIG_NFC_S3FWRN5=y CONFIG_NFC_S3FWRN5_I2C=y CONFIG_LWTUNNEL=y CONFIG_HAVE_BPF_JIT=y # # Device Drivers # # # Generic Driver Options # CONFIG_UEVENT_HELPER=y CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" CONFIG_DEVTMPFS=y CONFIG_DEVTMPFS_MOUNT=y CONFIG_STANDALONE=y CONFIG_PREVENT_FIRMWARE_BUILD=y CONFIG_FW_LOADER=y CONFIG_FIRMWARE_IN_KERNEL=y CONFIG_EXTRA_FIRMWARE="" # CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set CONFIG_WANT_DEV_COREDUMP=y CONFIG_ALLOW_DEV_COREDUMP=y CONFIG_DEV_COREDUMP=y CONFIG_DEBUG_DRIVER=y CONFIG_DEBUG_DEVRES=y CONFIG_SYS_HYPERVISOR=y # CONFIG_GENERIC_CPU_DEVICES is not set CONFIG_GENERIC_CPU_AUTOPROBE=y CONFIG_REGMAP=y CONFIG_REGMAP_I2C=y CONFIG_REGMAP_MMIO=y CONFIG_REGMAP_IRQ=y CONFIG_DMA_SHARED_BUFFER=y # CONFIG_FENCE_TRACE is not set # # Bus devices # CONFIG_CONNECTOR=y CONFIG_PROC_EVENTS=y CONFIG_MTD=y # CONFIG_MTD_TESTS is not set CONFIG_MTD_REDBOOT_PARTS=y CONFIG_MTD_REDBOOT_DIRECTORY_BLOCK=-1 CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED=y CONFIG_MTD_REDBOOT_PARTS_READONLY=y CONFIG_MTD_CMDLINE_PARTS=y CONFIG_MTD_AR7_PARTS=y # # User Modules And Translation Layers # CONFIG_MTD_BLKDEVS=y CONFIG_MTD_BLOCK=y CONFIG_FTL=y CONFIG_NFTL=y CONFIG_NFTL_RW=y CONFIG_INFTL=y CONFIG_RFD_FTL=y CONFIG_SSFDC=y CONFIG_SM_FTL=y CONFIG_MTD_OOPS=y CONFIG_MTD_SWAP=y CONFIG_MTD_PARTITIONED_MASTER=y # # RAM/ROM/Flash chip drivers # CONFIG_MTD_CFI=y CONFIG_MTD_JEDECPROBE=y CONFIG_MTD_GEN_PROBE=y CONFIG_MTD_CFI_ADV_OPTIONS=y CONFIG_MTD_CFI_NOSWAP=y # CONFIG_MTD_CFI_BE_BYTE_SWAP is not set # CONFIG_MTD_CFI_LE_BYTE_SWAP is not set CONFIG_MTD_CFI_GEOMETRY=y CONFIG_MTD_MAP_BANK_WIDTH_1=y CONFIG_MTD_MAP_BANK_WIDTH_2=y CONFIG_MTD_MAP_BANK_WIDTH_4=y CONFIG_MTD_MAP_BANK_WIDTH_8=y CONFIG_MTD_MAP_BANK_WIDTH_16=y CONFIG_MTD_MAP_BANK_WIDTH_32=y CONFIG_MTD_CFI_I1=y CONFIG_MTD_CFI_I2=y CONFIG_MTD_CFI_I4=y CONFIG_MTD_CFI_I8=y CONFIG_MTD_OTP=y CONFIG_MTD_CFI_INTELEXT=y CONFIG_MTD_CFI_AMDSTD=y CONFIG_MTD_CFI_STAA=y CONFIG_MTD_CFI_UTIL=y CONFIG_MTD_RAM=y CONFIG_MTD_ROM=y CONFIG_MTD_ABSENT=y # # Mapping drivers for chip access # CONFIG_MTD_COMPLEX_MAPPINGS=y CONFIG_MTD_PHYSMAP=y CONFIG_MTD_PHYSMAP_COMPAT=y CONFIG_MTD_PHYSMAP_START=0x8000000 CONFIG_MTD_PHYSMAP_LEN=0x0 CONFIG_MTD_PHYSMAP_BANKWIDTH=2 # CONFIG_MTD_SBC_GXX is not set CONFIG_MTD_AMD76XROM=y # CONFIG_MTD_ICHXROM is not set # CONFIG_MTD_ESB2ROM is not set # CONFIG_MTD_CK804XROM is not set # CONFIG_MTD_SCB2_FLASH is not set # CONFIG_MTD_NETtel is not set # CONFIG_MTD_L440GX is not set # CONFIG_MTD_PCI is not set # CONFIG_MTD_PCMCIA is not set # CONFIG_MTD_INTEL_VR_NOR is not set # CONFIG_MTD_PLATRAM is not set # CONFIG_MTD_LATCH_ADDR is not set # # Self-contained MTD device drivers # # CONFIG_MTD_PMC551 is not set # CONFIG_MTD_SLRAM is not set # CONFIG_MTD_PHRAM is not set # CONFIG_MTD_MTDRAM is not set # CONFIG_MTD_BLOCK2MTD is not set # # Disk-On-Chip Device Drivers # # CONFIG_MTD_DOCG3 is not set CONFIG_MTD_NAND_ECC=y # CONFIG_MTD_NAND_ECC_SMC is not set # CONFIG_MTD_NAND is not set # CONFIG_MTD_ONENAND is not set # # LPDDR & LPDDR2 PCM memory drivers # # CONFIG_MTD_LPDDR is not set # CONFIG_MTD_SPI_NOR is not set # CONFIG_MTD_UBI is not set # CONFIG_OF is not set CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y CONFIG_PARPORT=y # CONFIG_PARPORT_PC is not set # CONFIG_PARPORT_GSC is not set # CONFIG_PARPORT_AX88796 is not set # CONFIG_PARPORT_1284 is not set CONFIG_PNP=y CONFIG_PNP_DEBUG_MESSAGES=y # # Protocols # CONFIG_PNPACPI=y CONFIG_BLK_DEV=y CONFIG_BLK_DEV_NULL_BLK=y CONFIG_BLK_DEV_FD=y CONFIG_BLK_DEV_PCIESSD_MTIP32XX=y CONFIG_BLK_CPQ_CISS_DA=y CONFIG_CISS_SCSI_TAPE=y CONFIG_BLK_DEV_DAC960=y CONFIG_BLK_DEV_UMEM=y # CONFIG_BLK_DEV_COW_COMMON is not set CONFIG_BLK_DEV_LOOP=y CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 CONFIG_BLK_DEV_CRYPTOLOOP=y CONFIG_BLK_DEV_DRBD=y CONFIG_DRBD_FAULT_INJECTION=y CONFIG_BLK_DEV_NBD=y CONFIG_BLK_DEV_SKD=y CONFIG_BLK_DEV_SX8=y CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_COUNT=16 CONFIG_BLK_DEV_RAM_SIZE=4096 CONFIG_BLK_DEV_RAM_DAX=y CONFIG_CDROM_PKTCDVD=y CONFIG_CDROM_PKTCDVD_BUFFERS=8 CONFIG_CDROM_PKTCDVD_WCACHE=y CONFIG_ATA_OVER_ETH=y CONFIG_XEN_BLKDEV_FRONTEND=y CONFIG_XEN_BLKDEV_BACKEND=y CONFIG_VIRTIO_BLK=y CONFIG_BLK_DEV_HD=y CONFIG_BLK_DEV_RBD=y CONFIG_BLK_DEV_RSXX=y CONFIG_BLK_DEV_NVME=y CONFIG_BLK_DEV_NVME_SCSI=y # # Misc devices # CONFIG_SENSORS_LIS3LV02D=y # CONFIG_AD525X_DPOT is not set # CONFIG_DUMMY_IRQ is not set # CONFIG_IBM_ASM is not set # CONFIG_PHANTOM is not set # CONFIG_INTEL_MID_PTI is not set # CONFIG_SGI_IOC4 is not set CONFIG_TIFM_CORE=y CONFIG_TIFM_7XX1=y CONFIG_ICS932S401=y CONFIG_ENCLOSURE_SERVICES=y CONFIG_HP_ILO=y CONFIG_APDS9802ALS=y CONFIG_ISL29003=y CONFIG_ISL29020=y CONFIG_SENSORS_TSL2550=y CONFIG_SENSORS_BH1780=y CONFIG_SENSORS_BH1770=y CONFIG_SENSORS_APDS990X=y CONFIG_HMC6352=y CONFIG_DS1682=y CONFIG_BMP085=y CONFIG_BMP085_I2C=y CONFIG_USB_SWITCH_FSA9480=y CONFIG_SRAM=y CONFIG_C2PORT=y CONFIG_C2PORT_DURAMAR_2150=y # # EEPROM support # # CONFIG_EEPROM_AT24 is not set # CONFIG_EEPROM_LEGACY is not set # CONFIG_EEPROM_MAX6875 is not set # CONFIG_EEPROM_93CX6 is not set # CONFIG_CB710_CORE is not set # # Texas Instruments shared transport line discipline # # CONFIG_SENSORS_LIS3_I2C is not set # # Altera FPGA firmware download module # # CONFIG_ALTERA_STAPL is not set CONFIG_INTEL_MEI=y CONFIG_INTEL_MEI_ME=y CONFIG_INTEL_MEI_TXE=y # CONFIG_VMWARE_VMCI is not set # # Intel MIC Bus Driver # # CONFIG_INTEL_MIC_BUS is not set # # SCIF Bus Driver # # CONFIG_SCIF_BUS is not set # # Intel MIC Host Driver # # # Intel MIC Card Driver # # # SCIF Driver # # # Intel MIC Coprocessor State Management (COSM) Drivers # # CONFIG_GENWQE is not set # CONFIG_ECHO is not set # CONFIG_CXL_BASE is not set # CONFIG_CXL_KERNEL_API is not set # CONFIG_CXL_EEH is not set CONFIG_HAVE_IDE=y # CONFIG_IDE is not set # # SCSI device support # CONFIG_SCSI_MOD=y CONFIG_RAID_ATTRS=y CONFIG_SCSI=y CONFIG_SCSI_DMA=y CONFIG_SCSI_NETLINK=y CONFIG_SCSI_MQ_DEFAULT=y CONFIG_SCSI_PROC_FS=y # # SCSI support type (disk, tape, CD-ROM) # CONFIG_BLK_DEV_SD=y CONFIG_CHR_DEV_ST=y CONFIG_CHR_DEV_OSST=y CONFIG_BLK_DEV_SR=y CONFIG_BLK_DEV_SR_VENDOR=y CONFIG_CHR_DEV_SG=y CONFIG_CHR_DEV_SCH=y CONFIG_SCSI_ENCLOSURE=y CONFIG_SCSI_CONSTANTS=y # CONFIG_SCSI_LOGGING is not set CONFIG_SCSI_SCAN_ASYNC=y # # SCSI Transports # CONFIG_SCSI_SPI_ATTRS=y CONFIG_SCSI_FC_ATTRS=y CONFIG_SCSI_ISCSI_ATTRS=y CONFIG_SCSI_SAS_ATTRS=y CONFIG_SCSI_SAS_LIBSAS=y CONFIG_SCSI_SAS_ATA=y CONFIG_SCSI_SAS_HOST_SMP=y CONFIG_SCSI_SRP_ATTRS=y # CONFIG_SCSI_LOWLEVEL is not set CONFIG_SCSI_LOWLEVEL_PCMCIA=y # CONFIG_PCMCIA_AHA152X is not set # CONFIG_PCMCIA_FDOMAIN is not set # CONFIG_PCMCIA_QLOGIC is not set # CONFIG_PCMCIA_SYM53C500 is not set CONFIG_SCSI_DH=y # CONFIG_SCSI_DH_RDAC is not set # CONFIG_SCSI_DH_HP_SW is not set # CONFIG_SCSI_DH_EMC is not set # CONFIG_SCSI_DH_ALUA is not set CONFIG_SCSI_OSD_INITIATOR=y # CONFIG_SCSI_OSD_ULD is not set CONFIG_SCSI_OSD_DPRINT_SENSE=1 CONFIG_SCSI_OSD_DEBUG=y CONFIG_ATA=y # CONFIG_ATA_NONSTANDARD is not set CONFIG_ATA_VERBOSE_ERROR=y CONFIG_ATA_ACPI=y # CONFIG_SATA_ZPODD is not set CONFIG_SATA_PMP=y # # Controllers with non-SFF native interface # CONFIG_SATA_AHCI=y # CONFIG_SATA_AHCI_PLATFORM is not set # CONFIG_SATA_INIC162X is not set # CONFIG_SATA_ACARD_AHCI is not set # CONFIG_SATA_SIL24 is not set CONFIG_ATA_SFF=y # # SFF controllers with custom DMA interface # # CONFIG_PDC_ADMA is not set # CONFIG_SATA_QSTOR is not set # CONFIG_SATA_SX4 is not set CONFIG_ATA_BMDMA=y # # SATA SFF controllers with BMDMA # CONFIG_ATA_PIIX=y # CONFIG_SATA_MV is not set # CONFIG_SATA_NV is not set # CONFIG_SATA_PROMISE is not set # CONFIG_SATA_SIL is not set # CONFIG_SATA_SIS is not set # CONFIG_SATA_SVW is not set # CONFIG_SATA_ULI is not set # CONFIG_SATA_VIA is not set # CONFIG_SATA_VITESSE is not set # # PATA SFF controllers with BMDMA # # CONFIG_PATA_ALI is not set CONFIG_PATA_AMD=y CONFIG_PATA_ARTOP=y CONFIG_PATA_ATIIXP=y CONFIG_PATA_ATP867X=y CONFIG_PATA_CMD64X=y CONFIG_PATA_CYPRESS=y # CONFIG_PATA_EFAR is not set # CONFIG_PATA_HPT366 is not set # CONFIG_PATA_HPT37X is not set # CONFIG_PATA_HPT3X2N is not set # CONFIG_PATA_HPT3X3 is not set # CONFIG_PATA_IT8213 is not set # CONFIG_PATA_IT821X is not set # CONFIG_PATA_JMICRON is not set # CONFIG_PATA_MARVELL is not set # CONFIG_PATA_NETCELL is not set # CONFIG_PATA_NINJA32 is not set # CONFIG_PATA_NS87415 is not set CONFIG_PATA_OLDPIIX=y # CONFIG_PATA_OPTIDMA is not set # CONFIG_PATA_PDC2027X is not set # CONFIG_PATA_PDC_OLD is not set # CONFIG_PATA_RADISYS is not set # CONFIG_PATA_RDC is not set CONFIG_PATA_SCH=y # CONFIG_PATA_SERVERWORKS is not set # CONFIG_PATA_SIL680 is not set # CONFIG_PATA_SIS is not set # CONFIG_PATA_TOSHIBA is not set # CONFIG_PATA_TRIFLEX is not set # CONFIG_PATA_VIA is not set # CONFIG_PATA_WINBOND is not set # # PIO-only SFF controllers # CONFIG_PATA_CMD640_PCI=y CONFIG_PATA_MPIIX=y # CONFIG_PATA_NS87410 is not set # CONFIG_PATA_OPTI is not set # CONFIG_PATA_PCMCIA is not set # CONFIG_PATA_PLATFORM is not set # CONFIG_PATA_RZ1000 is not set # # Generic fallback / legacy drivers # # CONFIG_PATA_ACPI is not set CONFIG_ATA_GENERIC=y # CONFIG_PATA_LEGACY is not set CONFIG_MD=y CONFIG_BLK_DEV_MD=y CONFIG_MD_AUTODETECT=y # CONFIG_MD_LINEAR is not set # CONFIG_MD_RAID0 is not set # CONFIG_MD_RAID1 is not set # CONFIG_MD_RAID10 is not set # CONFIG_MD_RAID456 is not set # CONFIG_MD_MULTIPATH is not set # CONFIG_MD_FAULTY is not set CONFIG_MD_CLUSTER=m # CONFIG_BCACHE is not set CONFIG_BLK_DEV_DM_BUILTIN=y CONFIG_BLK_DEV_DM=y # CONFIG_DM_MQ_DEFAULT is not set CONFIG_DM_DEBUG=y CONFIG_DM_CRYPT=y # CONFIG_DM_SNAPSHOT is not set # CONFIG_DM_THIN_PROVISIONING is not set # CONFIG_DM_CACHE is not set # CONFIG_DM_ERA is not set CONFIG_DM_MIRROR=y # CONFIG_DM_LOG_USERSPACE is not set # CONFIG_DM_RAID is not set CONFIG_DM_ZERO=y # CONFIG_DM_MULTIPATH is not set # CONFIG_DM_DELAY is not set # CONFIG_DM_UEVENT is not set # CONFIG_DM_FLAKEY is not set # CONFIG_DM_VERITY is not set # CONFIG_DM_SWITCH is not set # CONFIG_DM_LOG_WRITES is not set # CONFIG_TARGET_CORE is not set CONFIG_FUSION=y # CONFIG_FUSION_SPI is not set # CONFIG_FUSION_FC is not set # CONFIG_FUSION_SAS is not set CONFIG_FUSION_MAX_SGE=128 # CONFIG_FUSION_LOGGING is not set # # IEEE 1394 (FireWire) support # CONFIG_FIREWIRE=y CONFIG_FIREWIRE_OHCI=y CONFIG_FIREWIRE_SBP2=y CONFIG_FIREWIRE_NET=y CONFIG_FIREWIRE_NOSY=y CONFIG_MACINTOSH_DRIVERS=y CONFIG_MAC_EMUMOUSEBTN=y CONFIG_NETDEVICES=y CONFIG_MII=y CONFIG_NET_CORE=y # CONFIG_BONDING is not set # CONFIG_DUMMY is not set # CONFIG_EQUALIZER is not set # CONFIG_NET_FC is not set # CONFIG_IFB is not set # CONFIG_NET_TEAM is not set # CONFIG_MACVLAN is not set CONFIG_IPVLAN=y CONFIG_VXLAN=y # CONFIG_GENEVE is not set CONFIG_NETCONSOLE=y CONFIG_NETCONSOLE_DYNAMIC=y CONFIG_NETPOLL=y CONFIG_NET_POLL_CONTROLLER=y # CONFIG_NTB_NETDEV is not set CONFIG_RIONET=y CONFIG_RIONET_TX_SIZE=128 CONFIG_RIONET_RX_SIZE=128 # CONFIG_TUN is not set # CONFIG_TUN_VNET_CROSS_LE is not set # CONFIG_VETH is not set CONFIG_VIRTIO_NET=y # CONFIG_NLMON is not set CONFIG_NET_VRF=y # CONFIG_ARCNET is not set CONFIG_ATM_DRIVERS=y # CONFIG_ATM_DUMMY is not set CONFIG_ATM_TCP=y # CONFIG_ATM_LANAI is not set # CONFIG_ATM_ENI is not set # CONFIG_ATM_FIRESTREAM is not set # CONFIG_ATM_ZATM is not set # CONFIG_ATM_NICSTAR is not set # CONFIG_ATM_IDT77252 is not set # CONFIG_ATM_AMBASSADOR is not set # CONFIG_ATM_HORIZON is not set CONFIG_ATM_IA=y CONFIG_ATM_IA_DEBUG=y # CONFIG_ATM_FORE200E is not set # CONFIG_ATM_HE is not set # CONFIG_ATM_SOLOS is not set # # CAIF transport drivers # # CONFIG_CAIF_TTY is not set # CONFIG_CAIF_SPI_SLAVE is not set # CONFIG_CAIF_HSI is not set # CONFIG_CAIF_VIRTIO is not set # CONFIG_VHOST_NET is not set # CONFIG_VHOST_CROSS_ENDIAN_LEGACY is not set # # Distributed Switch Architecture drivers # # CONFIG_NET_DSA_MV88E6XXX is not set # CONFIG_NET_DSA_MV88E6XXX_NEED_PPU is not set CONFIG_ETHERNET=y CONFIG_NET_VENDOR_3COM=y CONFIG_PCMCIA_3C574=y # CONFIG_PCMCIA_3C589 is not set # CONFIG_VORTEX is not set # CONFIG_TYPHOON is not set CONFIG_NET_VENDOR_ADAPTEC=y # CONFIG_ADAPTEC_STARFIRE is not set CONFIG_NET_VENDOR_AGERE=y CONFIG_ET131X=y CONFIG_NET_VENDOR_ALTEON=y CONFIG_ACENIC=y CONFIG_ACENIC_OMIT_TIGON_I=y # CONFIG_ALTERA_TSE is not set CONFIG_NET_VENDOR_AMD=y # CONFIG_AMD8111_ETH is not set # CONFIG_PCNET32 is not set # CONFIG_PCMCIA_NMCLAN is not set CONFIG_NET_VENDOR_ARC=y CONFIG_NET_VENDOR_ATHEROS=y # CONFIG_ATL2 is not set # CONFIG_ATL1 is not set # CONFIG_ATL1E is not set # CONFIG_ATL1C is not set # CONFIG_ALX is not set # CONFIG_NET_VENDOR_AURORA is not set CONFIG_NET_CADENCE=y # CONFIG_MACB is not set CONFIG_NET_VENDOR_BROADCOM=y # CONFIG_B44 is not set # CONFIG_BCMGENET is not set # CONFIG_BNX2 is not set # CONFIG_CNIC is not set CONFIG_TIGON3=y # CONFIG_BNX2X is not set # CONFIG_BNXT is not set CONFIG_NET_VENDOR_BROCADE=y # CONFIG_BNA is not set CONFIG_NET_VENDOR_CAVIUM=y # CONFIG_THUNDER_NIC_PF is not set # CONFIG_THUNDER_NIC_VF is not set # CONFIG_THUNDER_NIC_BGX is not set # CONFIG_LIQUIDIO is not set CONFIG_NET_VENDOR_CHELSIO=y # CONFIG_CHELSIO_T1 is not set # CONFIG_CHELSIO_T3 is not set # CONFIG_CHELSIO_T4 is not set # CONFIG_CHELSIO_T4VF is not set CONFIG_NET_VENDOR_CISCO=y # CONFIG_ENIC is not set # CONFIG_CX_ECAT is not set # CONFIG_DNET is not set CONFIG_NET_VENDOR_DEC=y CONFIG_NET_TULIP=y # CONFIG_DE2104X is not set # CONFIG_TULIP is not set # CONFIG_DE4X5 is not set # CONFIG_WINBOND_840 is not set # CONFIG_DM9102 is not set # CONFIG_ULI526X is not set # CONFIG_PCMCIA_XIRCOM is not set CONFIG_NET_VENDOR_DLINK=y # CONFIG_DL2K is not set # CONFIG_SUNDANCE is not set CONFIG_NET_VENDOR_EMULEX=y CONFIG_BE2NET=y CONFIG_BE2NET_HWMON=y CONFIG_BE2NET_VXLAN=y CONFIG_NET_VENDOR_EZCHIP=y CONFIG_NET_VENDOR_EXAR=y # CONFIG_S2IO is not set # CONFIG_VXGE is not set CONFIG_NET_VENDOR_FUJITSU=y # CONFIG_PCMCIA_FMVJ18X is not set CONFIG_NET_VENDOR_HP=y # CONFIG_HP100 is not set CONFIG_NET_VENDOR_INTEL=y CONFIG_E100=y CONFIG_E1000=y CONFIG_E1000E=y # CONFIG_IGB is not set # CONFIG_IGBVF is not set # CONFIG_IXGB is not set # CONFIG_IXGBE is not set # CONFIG_IXGBEVF is not set # CONFIG_I40E is not set # CONFIG_I40EVF is not set # CONFIG_FM10K is not set CONFIG_NET_VENDOR_I825XX=y # CONFIG_JME is not set CONFIG_NET_VENDOR_MARVELL=y # CONFIG_MVMDIO is not set # CONFIG_SKGE is not set CONFIG_SKY2=y CONFIG_SKY2_DEBUG=y CONFIG_NET_VENDOR_MELLANOX=y # CONFIG_MLX4_EN is not set CONFIG_MLX4_CORE=y CONFIG_MLX4_DEBUG=y # CONFIG_MLX5_CORE is not set # CONFIG_MLXSW_CORE is not set CONFIG_NET_VENDOR_MICREL=y # CONFIG_KS8842 is not set # CONFIG_KS8851_MLL is not set # CONFIG_KSZ884X_PCI is not set CONFIG_NET_VENDOR_MYRI=y # CONFIG_MYRI10GE is not set # CONFIG_FEALNX is not set CONFIG_NET_VENDOR_NATSEMI=y # CONFIG_NATSEMI is not set # CONFIG_NS83820 is not set CONFIG_NET_VENDOR_NETRONOME=y CONFIG_NFP_NETVF=y CONFIG_NFP_NET_DEBUG=y CONFIG_NET_VENDOR_8390=y # CONFIG_PCMCIA_AXNET is not set # CONFIG_NE2K_PCI is not set # CONFIG_PCMCIA_PCNET is not set CONFIG_NET_VENDOR_NVIDIA=y CONFIG_FORCEDETH=y CONFIG_NET_VENDOR_OKI=y # CONFIG_ETHOC is not set CONFIG_NET_PACKET_ENGINE=y # CONFIG_HAMACHI is not set # CONFIG_YELLOWFIN is not set CONFIG_NET_VENDOR_QLOGIC=y # CONFIG_QLA3XXX is not set # CONFIG_QLCNIC is not set # CONFIG_QLGE is not set CONFIG_NETXEN_NIC=y # CONFIG_QED is not set CONFIG_NET_VENDOR_QUALCOMM=y CONFIG_NET_VENDOR_REALTEK=y # CONFIG_ATP is not set # CONFIG_8139CP is not set CONFIG_8139TOO=y CONFIG_8139TOO_PIO=y # CONFIG_8139TOO_TUNE_TWISTER is not set # CONFIG_8139TOO_8129 is not set # CONFIG_8139_OLD_RX_RESET is not set # CONFIG_R8169 is not set CONFIG_NET_VENDOR_RENESAS=y CONFIG_NET_VENDOR_RDC=y # CONFIG_R6040 is not set CONFIG_NET_VENDOR_ROCKER=y CONFIG_NET_VENDOR_SAMSUNG=y # CONFIG_SXGBE_ETH is not set CONFIG_NET_VENDOR_SEEQ=y CONFIG_NET_VENDOR_SILAN=y # CONFIG_SC92031 is not set CONFIG_NET_VENDOR_SIS=y # CONFIG_SIS900 is not set # CONFIG_SIS190 is not set # CONFIG_SFC is not set CONFIG_NET_VENDOR_SMSC=y # CONFIG_PCMCIA_SMC91C92 is not set # CONFIG_EPIC100 is not set # CONFIG_SMSC911X is not set # CONFIG_SMSC9420 is not set CONFIG_NET_VENDOR_STMICRO=y # CONFIG_STMMAC_ETH is not set CONFIG_NET_VENDOR_SUN=y # CONFIG_HAPPYMEAL is not set # CONFIG_SUNGEM is not set # CONFIG_CASSINI is not set # CONFIG_NIU is not set CONFIG_NET_VENDOR_SYNOPSYS=y CONFIG_NET_VENDOR_TEHUTI=y # CONFIG_TEHUTI is not set CONFIG_NET_VENDOR_TI=y # CONFIG_TI_CPSW_ALE is not set # CONFIG_TLAN is not set CONFIG_NET_VENDOR_VIA=y # CONFIG_VIA_RHINE is not set # CONFIG_VIA_VELOCITY is not set CONFIG_NET_VENDOR_WIZNET=y # CONFIG_WIZNET_W5100 is not set # CONFIG_WIZNET_W5300 is not set CONFIG_NET_VENDOR_XIRCOM=y # CONFIG_PCMCIA_XIRC2PS is not set CONFIG_FDDI=y # CONFIG_DEFXX is not set # CONFIG_SKFP is not set # CONFIG_HIPPI is not set # CONFIG_NET_SB1000 is not set CONFIG_PHYLIB=y # # MII PHY device drivers # CONFIG_AQUANTIA_PHY=y CONFIG_AT803X_PHY=y CONFIG_AMD_PHY=y CONFIG_MARVELL_PHY=y # CONFIG_DAVICOM_PHY is not set # CONFIG_QSEMI_PHY is not set # CONFIG_LXT_PHY is not set # CONFIG_CICADA_PHY is not set # CONFIG_VITESSE_PHY is not set # CONFIG_TERANETICS_PHY is not set # CONFIG_SMSC_PHY is not set # CONFIG_BROADCOM_PHY is not set # CONFIG_BCM7XXX_PHY is not set # CONFIG_BCM87XX_PHY is not set # CONFIG_ICPLUS_PHY is not set # CONFIG_REALTEK_PHY is not set # CONFIG_NATIONAL_PHY is not set # CONFIG_STE10XP is not set # CONFIG_LSI_ET1011C_PHY is not set # CONFIG_MICREL_PHY is not set # CONFIG_DP83848_PHY is not set # CONFIG_DP83867_PHY is not set # CONFIG_MICROCHIP_PHY is not set # CONFIG_FIXED_PHY is not set # CONFIG_MDIO_BITBANG is not set # CONFIG_MDIO_OCTEON is not set # CONFIG_MDIO_BCM_UNIMAC is not set # CONFIG_PLIP is not set CONFIG_PPP=y CONFIG_PPP_BSDCOMP=y CONFIG_PPP_DEFLATE=y CONFIG_PPP_FILTER=y CONFIG_PPP_MPPE=y CONFIG_PPP_MULTILINK=y CONFIG_PPPOATM=y CONFIG_PPPOE=y CONFIG_PPTP=y CONFIG_PPPOL2TP=y CONFIG_PPP_ASYNC=y CONFIG_PPP_SYNC_TTY=y # CONFIG_SLIP is not set CONFIG_SLHC=y CONFIG_USB_NET_DRIVERS=y CONFIG_USB_CATC=y CONFIG_USB_KAWETH=y # CONFIG_USB_PEGASUS is not set # CONFIG_USB_RTL8150 is not set # CONFIG_USB_RTL8152 is not set # CONFIG_USB_LAN78XX is not set # CONFIG_USB_USBNET is not set # CONFIG_USB_HSO is not set # CONFIG_USB_IPHETH is not set CONFIG_WLAN=y CONFIG_WLAN_VENDOR_ADMTEK=y # CONFIG_ADM8211 is not set CONFIG_ATH_COMMON=y CONFIG_WLAN_VENDOR_ATH=y CONFIG_ATH_DEBUG=y # CONFIG_ATH_TRACEPOINTS is not set CONFIG_ATH5K=y CONFIG_ATH5K_DEBUG=y # CONFIG_ATH5K_TRACER is not set CONFIG_ATH5K_PCI=y CONFIG_ATH9K_HW=y CONFIG_ATH9K_COMMON=y CONFIG_ATH9K_BTCOEX_SUPPORT=y CONFIG_ATH9K=y CONFIG_ATH9K_PCI=y CONFIG_ATH9K_AHB=y CONFIG_ATH9K_DEBUGFS=y # CONFIG_ATH9K_STATION_STATISTICS is not set CONFIG_ATH9K_DYNACK=y CONFIG_ATH9K_WOW=y CONFIG_ATH9K_RFKILL=y CONFIG_ATH9K_CHANNEL_CONTEXT=y CONFIG_ATH9K_PCOEM=y CONFIG_ATH9K_HTC=y CONFIG_ATH9K_HTC_DEBUGFS=y CONFIG_ATH9K_HWRNG=y CONFIG_CARL9170=y CONFIG_CARL9170_LEDS=y # CONFIG_CARL9170_DEBUGFS is not set CONFIG_CARL9170_WPC=y CONFIG_CARL9170_HWRNG=y CONFIG_ATH6KL=y CONFIG_ATH6KL_SDIO=y CONFIG_ATH6KL_USB=y CONFIG_ATH6KL_DEBUG=y # CONFIG_ATH6KL_TRACING is not set CONFIG_AR5523=y CONFIG_WIL6210=y CONFIG_WIL6210_ISR_COR=y # CONFIG_WIL6210_TRACING is not set CONFIG_ATH10K=y CONFIG_ATH10K_PCI=y CONFIG_ATH10K_DEBUG=y # CONFIG_ATH10K_DEBUGFS is not set # CONFIG_ATH10K_TRACING is not set # CONFIG_WCN36XX is not set CONFIG_WLAN_VENDOR_ATMEL=y # CONFIG_ATMEL is not set # CONFIG_AT76C50X_USB is not set CONFIG_WLAN_VENDOR_BROADCOM=y # CONFIG_B43 is not set # CONFIG_B43LEGACY is not set # CONFIG_BRCMSMAC is not set # CONFIG_BRCMFMAC is not set CONFIG_WLAN_VENDOR_CISCO=y # CONFIG_AIRO is not set # CONFIG_AIRO_CS is not set CONFIG_WLAN_VENDOR_INTEL=y # CONFIG_IPW2100 is not set # CONFIG_IPW2200 is not set # CONFIG_IWL4965 is not set # CONFIG_IWL3945 is not set # CONFIG_IWLWIFI is not set CONFIG_WLAN_VENDOR_INTERSIL=y # CONFIG_HOSTAP is not set # CONFIG_HERMES is not set # CONFIG_P54_COMMON is not set # CONFIG_PRISM54 is not set CONFIG_WLAN_VENDOR_MARVELL=y # CONFIG_LIBERTAS is not set # CONFIG_LIBERTAS_THINFIRM is not set # CONFIG_MWIFIEX is not set # CONFIG_MWL8K is not set CONFIG_WLAN_VENDOR_MEDIATEK=y CONFIG_MT7601U=y CONFIG_WLAN_VENDOR_RALINK=y # CONFIG_RT2X00 is not set CONFIG_WLAN_VENDOR_REALTEK=y # CONFIG_RTL8180 is not set # CONFIG_RTL8187 is not set CONFIG_RTL_CARDS=y # CONFIG_RTL8192CE is not set # CONFIG_RTL8192SE is not set # CONFIG_RTL8192DE is not set # CONFIG_RTL8723AE is not set # CONFIG_RTL8723BE is not set # CONFIG_RTL8188EE is not set # CONFIG_RTL8192EE is not set # CONFIG_RTL8821AE is not set # CONFIG_RTL8192CU is not set # CONFIG_RTL8XXXU is not set CONFIG_WLAN_VENDOR_RSI=y # CONFIG_RSI_91X is not set CONFIG_WLAN_VENDOR_ST=y # CONFIG_CW1200 is not set # CONFIG_WLAN_VENDOR_TI is not set # CONFIG_WLAN_VENDOR_ZYDAS is not set # CONFIG_PCMCIA_RAYCS is not set # CONFIG_PCMCIA_WL3501 is not set # CONFIG_MAC80211_HWSIM is not set # CONFIG_USB_NET_RNDIS_WLAN is not set # # WiMAX Wireless Broadband devices # CONFIG_WIMAX_I2400M=y CONFIG_WIMAX_I2400M_USB=y CONFIG_WIMAX_I2400M_DEBUG_LEVEL=1 CONFIG_WAN=y CONFIG_LANMEDIA=y CONFIG_HDLC=y CONFIG_HDLC_RAW=y CONFIG_HDLC_RAW_ETH=y CONFIG_HDLC_CISCO=y CONFIG_HDLC_FR=y CONFIG_HDLC_PPP=y CONFIG_HDLC_X25=y CONFIG_PCI200SYN=y CONFIG_WANXL=y CONFIG_PC300TOO=y CONFIG_FARSYNC=y # CONFIG_DSCC4 is not set CONFIG_DLCI=y CONFIG_DLCI_MAX=8 CONFIG_LAPBETHER=m CONFIG_X25_ASY=y CONFIG_SBNI=y CONFIG_SBNI_MULTILINE=y CONFIG_IEEE802154_DRIVERS=y CONFIG_IEEE802154_FAKELB=y CONFIG_IEEE802154_ATUSB=y CONFIG_XEN_NETDEV_FRONTEND=y CONFIG_XEN_NETDEV_BACKEND=y CONFIG_VMXNET3=y CONFIG_FUJITSU_ES=y CONFIG_ISDN=y CONFIG_ISDN_I4L=y CONFIG_ISDN_PPP=y CONFIG_ISDN_PPP_VJ=y CONFIG_ISDN_MPP=y CONFIG_IPPP_FILTER=y CONFIG_ISDN_PPP_BSDCOMP=y CONFIG_ISDN_AUDIO=y CONFIG_ISDN_TTY_FAX=y CONFIG_ISDN_X25=y # # ISDN feature submodules # CONFIG_ISDN_DIVERSION=y # # ISDN4Linux hardware drivers # # # Passive cards # CONFIG_ISDN_DRV_HISAX=y # # D-channel protocol features # CONFIG_HISAX_EURO=y CONFIG_DE_AOC=y CONFIG_HISAX_NO_SENDCOMPLETE=y CONFIG_HISAX_NO_LLC=y CONFIG_HISAX_NO_KEYPAD=y CONFIG_HISAX_1TR6=y CONFIG_HISAX_NI1=y CONFIG_HISAX_MAX_CARDS=8 # # HiSax supported cards # CONFIG_HISAX_16_3=y CONFIG_HISAX_TELESPCI=y CONFIG_HISAX_S0BOX=y CONFIG_HISAX_FRITZPCI=y CONFIG_HISAX_AVM_A1_PCMCIA=y CONFIG_HISAX_ELSA=y CONFIG_HISAX_DIEHLDIVA=y CONFIG_HISAX_SEDLBAUER=y CONFIG_HISAX_NETJET=y CONFIG_HISAX_NETJET_U=y CONFIG_HISAX_NICCY=y CONFIG_HISAX_BKM_A4T=y CONFIG_HISAX_SCT_QUADRO=y CONFIG_HISAX_GAZEL=y CONFIG_HISAX_HFC_PCI=y CONFIG_HISAX_W6692=y CONFIG_HISAX_HFC_SX=y CONFIG_HISAX_ENTERNOW_PCI=y CONFIG_HISAX_DEBUG=y # # HiSax PCMCIA card service modules # CONFIG_HISAX_SEDLBAUER_CS=y CONFIG_HISAX_ELSA_CS=y CONFIG_HISAX_AVM_A1_CS=y CONFIG_HISAX_TELES_CS=y # # HiSax sub driver modules # CONFIG_HISAX_ST5481=y CONFIG_HISAX_HFCUSB=y CONFIG_HISAX_HFC4S8S=y CONFIG_HISAX_FRITZ_PCIPNP=y # # Active cards # CONFIG_ISDN_CAPI=y CONFIG_CAPI_TRACE=y CONFIG_ISDN_CAPI_CAPI20=y CONFIG_ISDN_CAPI_MIDDLEWARE=y # CONFIG_ISDN_CAPI_CAPIDRV is not set # # CAPI hardware drivers # CONFIG_CAPI_AVM=y CONFIG_ISDN_DRV_AVMB1_B1PCI=y CONFIG_ISDN_DRV_AVMB1_B1PCIV4=y CONFIG_ISDN_DRV_AVMB1_B1PCMCIA=y CONFIG_ISDN_DRV_AVMB1_AVM_CS=y CONFIG_ISDN_DRV_AVMB1_T1PCI=y CONFIG_ISDN_DRV_AVMB1_C4=y CONFIG_CAPI_EICON=y CONFIG_ISDN_DIVAS=y CONFIG_ISDN_DIVAS_BRIPCI=y CONFIG_ISDN_DIVAS_PRIPCI=y CONFIG_ISDN_DIVAS_DIVACAPI=y CONFIG_ISDN_DIVAS_USERIDI=y # CONFIG_ISDN_DIVAS_MAINT is not set CONFIG_ISDN_DRV_GIGASET=y CONFIG_GIGASET_CAPI=y # CONFIG_GIGASET_I4L is not set # CONFIG_GIGASET_DUMMYLL is not set CONFIG_GIGASET_BASE=y CONFIG_GIGASET_M105=y CONFIG_GIGASET_M101=y CONFIG_GIGASET_DEBUG=y # CONFIG_HYSDN is not set CONFIG_MISDN=y CONFIG_MISDN_DSP=y CONFIG_MISDN_L1OIP=y # # mISDN hardware drivers # CONFIG_MISDN_HFCPCI=y CONFIG_MISDN_HFCMULTI=y CONFIG_MISDN_HFCUSB=y CONFIG_MISDN_AVMFRITZ=y CONFIG_MISDN_SPEEDFAX=y CONFIG_MISDN_INFINEON=y CONFIG_MISDN_W6692=y CONFIG_MISDN_NETJET=y CONFIG_MISDN_IPAC=y CONFIG_MISDN_ISAR=y CONFIG_ISDN_HDLC=y CONFIG_NVM=y CONFIG_NVM_DEBUG=y CONFIG_NVM_GENNVM=y CONFIG_NVM_RRPC=y # # Input device support # CONFIG_INPUT=y CONFIG_INPUT_LEDS=y CONFIG_INPUT_FF_MEMLESS=y CONFIG_INPUT_POLLDEV=y CONFIG_INPUT_SPARSEKMAP=y CONFIG_INPUT_MATRIXKMAP=y # # Userland interfaces # CONFIG_INPUT_MOUSEDEV=y # CONFIG_INPUT_MOUSEDEV_PSAUX is not set CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024 CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768 # CONFIG_INPUT_JOYDEV is not set CONFIG_INPUT_EVDEV=y # CONFIG_INPUT_EVBUG is not set # # Input Device Drivers # CONFIG_INPUT_KEYBOARD=y CONFIG_KEYBOARD_ADP5520=y CONFIG_KEYBOARD_ADP5588=y CONFIG_KEYBOARD_ADP5589=y CONFIG_KEYBOARD_ATKBD=y CONFIG_KEYBOARD_QT1070=y CONFIG_KEYBOARD_QT2160=y CONFIG_KEYBOARD_LKKBD=y CONFIG_KEYBOARD_TCA6416=y CONFIG_KEYBOARD_TCA8418=y CONFIG_KEYBOARD_LM8323=y CONFIG_KEYBOARD_LM8333=y CONFIG_KEYBOARD_MAX7359=y CONFIG_KEYBOARD_MCS=y CONFIG_KEYBOARD_MPR121=y CONFIG_KEYBOARD_NEWTON=y CONFIG_KEYBOARD_OPENCORES=y CONFIG_KEYBOARD_STOWAWAY=y CONFIG_KEYBOARD_SUNKBD=y CONFIG_KEYBOARD_XTKBD=y CONFIG_KEYBOARD_CROS_EC=y CONFIG_INPUT_MOUSE=y CONFIG_MOUSE_PS2=y CONFIG_MOUSE_PS2_ALPS=y CONFIG_MOUSE_PS2_LOGIPS2PP=y CONFIG_MOUSE_PS2_SYNAPTICS=y CONFIG_MOUSE_PS2_CYPRESS=y CONFIG_MOUSE_PS2_LIFEBOOK=y CONFIG_MOUSE_PS2_TRACKPOINT=y CONFIG_MOUSE_PS2_ELANTECH=y CONFIG_MOUSE_PS2_SENTELIC=y CONFIG_MOUSE_PS2_TOUCHKIT=y CONFIG_MOUSE_PS2_FOCALTECH=y CONFIG_MOUSE_PS2_VMMOUSE=y CONFIG_MOUSE_SERIAL=y # CONFIG_MOUSE_APPLETOUCH is not set # CONFIG_MOUSE_BCM5974 is not set # CONFIG_MOUSE_CYAPA is not set # CONFIG_MOUSE_ELAN_I2C is not set # CONFIG_MOUSE_VSXXXAA is not set # CONFIG_MOUSE_SYNAPTICS_I2C is not set # CONFIG_MOUSE_SYNAPTICS_USB is not set CONFIG_INPUT_JOYSTICK=y CONFIG_JOYSTICK_ANALOG=y CONFIG_JOYSTICK_A3D=y CONFIG_JOYSTICK_ADI=y # CONFIG_JOYSTICK_COBRA is not set # CONFIG_JOYSTICK_GF2K is not set # CONFIG_JOYSTICK_GRIP is not set # CONFIG_JOYSTICK_GRIP_MP is not set # CONFIG_JOYSTICK_GUILLEMOT is not set # CONFIG_JOYSTICK_INTERACT is not set # CONFIG_JOYSTICK_SIDEWINDER is not set # CONFIG_JOYSTICK_TMDC is not set # CONFIG_JOYSTICK_IFORCE is not set # CONFIG_JOYSTICK_WARRIOR is not set # CONFIG_JOYSTICK_MAGELLAN is not set # CONFIG_JOYSTICK_SPACEORB is not set # CONFIG_JOYSTICK_SPACEBALL is not set # CONFIG_JOYSTICK_STINGER is not set # CONFIG_JOYSTICK_TWIDJOY is not set # CONFIG_JOYSTICK_ZHENHUA is not set # CONFIG_JOYSTICK_DB9 is not set # CONFIG_JOYSTICK_GAMECON is not set # CONFIG_JOYSTICK_TURBOGRAFX is not set # CONFIG_JOYSTICK_AS5011 is not set # CONFIG_JOYSTICK_JOYDUMP is not set # CONFIG_JOYSTICK_XPAD is not set # CONFIG_JOYSTICK_WALKERA0701 is not set CONFIG_INPUT_TABLET=y CONFIG_TABLET_USB_ACECAD=y CONFIG_TABLET_USB_AIPTEK=y CONFIG_TABLET_USB_GTCO=y CONFIG_TABLET_USB_HANWANG=y # CONFIG_TABLET_USB_KBTAB is not set # CONFIG_TABLET_SERIAL_WACOM4 is not set CONFIG_INPUT_TOUCHSCREEN=y CONFIG_TOUCHSCREEN_PROPERTIES=y CONFIG_TOUCHSCREEN_AD7879=y CONFIG_TOUCHSCREEN_AD7879_I2C=y CONFIG_TOUCHSCREEN_ATMEL_MXT=y CONFIG_TOUCHSCREEN_BU21013=y # CONFIG_TOUCHSCREEN_CYTTSP_CORE is not set # CONFIG_TOUCHSCREEN_CYTTSP4_CORE is not set CONFIG_TOUCHSCREEN_DA9034=y # CONFIG_TOUCHSCREEN_DYNAPRO is not set # CONFIG_TOUCHSCREEN_HAMPSHIRE is not set # CONFIG_TOUCHSCREEN_EETI is not set # CONFIG_TOUCHSCREEN_EGALAX_SERIAL is not set # CONFIG_TOUCHSCREEN_FUJITSU is not set # CONFIG_TOUCHSCREEN_ILI210X is not set # CONFIG_TOUCHSCREEN_GUNZE is not set # CONFIG_TOUCHSCREEN_ELAN is not set # CONFIG_TOUCHSCREEN_ELO is not set # CONFIG_TOUCHSCREEN_WACOM_W8001 is not set # CONFIG_TOUCHSCREEN_WACOM_I2C is not set # CONFIG_TOUCHSCREEN_MAX11801 is not set # CONFIG_TOUCHSCREEN_MCS5000 is not set # CONFIG_TOUCHSCREEN_MMS114 is not set # CONFIG_TOUCHSCREEN_MTOUCH is not set # CONFIG_TOUCHSCREEN_INEXIO is not set CONFIG_TOUCHSCREEN_INTEL_MID=y # CONFIG_TOUCHSCREEN_MK712 is not set # CONFIG_TOUCHSCREEN_PENMOUNT is not set # CONFIG_TOUCHSCREEN_EDT_FT5X06 is not set # CONFIG_TOUCHSCREEN_TOUCHRIGHT is not set # CONFIG_TOUCHSCREEN_TOUCHWIN is not set # CONFIG_TOUCHSCREEN_PIXCIR is not set # CONFIG_TOUCHSCREEN_WDT87XX_I2C is not set CONFIG_TOUCHSCREEN_WM97XX=y CONFIG_TOUCHSCREEN_WM9705=y CONFIG_TOUCHSCREEN_WM9712=y CONFIG_TOUCHSCREEN_WM9713=y # CONFIG_TOUCHSCREEN_USB_COMPOSITE is not set # CONFIG_TOUCHSCREEN_TOUCHIT213 is not set # CONFIG_TOUCHSCREEN_TSC_SERIO is not set # CONFIG_TOUCHSCREEN_TSC2004 is not set # CONFIG_TOUCHSCREEN_TSC2007 is not set # CONFIG_TOUCHSCREEN_ST1232 is not set # CONFIG_TOUCHSCREEN_SX8654 is not set # CONFIG_TOUCHSCREEN_TPS6507X is not set # CONFIG_TOUCHSCREEN_ROHM_BU21023 is not set CONFIG_INPUT_MISC=y CONFIG_INPUT_AD714X=y CONFIG_INPUT_AD714X_I2C=y CONFIG_INPUT_BMA150=y CONFIG_INPUT_E3X0_BUTTON=y # CONFIG_INPUT_PCSPKR is not set # CONFIG_INPUT_MMA8450 is not set # CONFIG_INPUT_MPU3050 is not set # CONFIG_INPUT_APANEL is not set # CONFIG_INPUT_ATLAS_BTNS is not set # CONFIG_INPUT_ATI_REMOTE2 is not set # CONFIG_INPUT_KEYSPAN_REMOTE is not set # CONFIG_INPUT_KXTJ9 is not set # CONFIG_INPUT_POWERMATE is not set # CONFIG_INPUT_YEALINK is not set # CONFIG_INPUT_CM109 is not set CONFIG_INPUT_AXP20X_PEK=y # CONFIG_INPUT_UINPUT is not set # CONFIG_INPUT_PCF8574 is not set # CONFIG_INPUT_PWM_BEEPER is not set # CONFIG_INPUT_ADXL34X is not set # CONFIG_INPUT_IMS_PCU is not set # CONFIG_INPUT_CMA3000 is not set CONFIG_INPUT_XEN_KBDDEV_FRONTEND=y # CONFIG_INPUT_IDEAPAD_SLIDEBAR is not set # CONFIG_INPUT_DRV2665_HAPTICS is not set # CONFIG_INPUT_DRV2667_HAPTICS is not set # # Hardware I/O ports # CONFIG_SERIO=y CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y CONFIG_SERIO_I8042=y CONFIG_SERIO_SERPORT=y CONFIG_SERIO_CT82C710=y # CONFIG_SERIO_PARKBD is not set CONFIG_SERIO_PCIPS2=y CONFIG_SERIO_LIBPS2=y CONFIG_SERIO_RAW=y CONFIG_SERIO_ALTERA_PS2=y CONFIG_SERIO_PS2MULT=y CONFIG_SERIO_ARC_PS2=y CONFIG_USERIO=y CONFIG_GAMEPORT=y CONFIG_GAMEPORT_NS558=y CONFIG_GAMEPORT_L4=y CONFIG_GAMEPORT_EMU10K1=y CONFIG_GAMEPORT_FM801=y # # Character devices # CONFIG_TTY=y CONFIG_VT=y CONFIG_CONSOLE_TRANSLATIONS=y CONFIG_VT_CONSOLE=y CONFIG_VT_CONSOLE_SLEEP=y CONFIG_HW_CONSOLE=y CONFIG_VT_HW_CONSOLE_BINDING=y CONFIG_UNIX98_PTYS=y CONFIG_DEVPTS_MULTIPLE_INSTANCES=y CONFIG_LEGACY_PTYS=y CONFIG_LEGACY_PTY_COUNT=256 CONFIG_SERIAL_NONSTANDARD=y CONFIG_ROCKETPORT=y CONFIG_CYCLADES=y CONFIG_CYZ_INTR=y CONFIG_MOXA_INTELLIO=y CONFIG_MOXA_SMARTIO=y CONFIG_SYNCLINK=y CONFIG_SYNCLINKMP=y CONFIG_SYNCLINK_GT=y CONFIG_NOZOMI=y CONFIG_ISI=y # CONFIG_N_HDLC is not set CONFIG_N_GSM=y CONFIG_TRACE_ROUTER=y CONFIG_TRACE_SINK=y CONFIG_DEVMEM=y CONFIG_DEVKMEM=y # # Serial drivers # CONFIG_SERIAL_EARLYCON=y CONFIG_SERIAL_8250=y CONFIG_SERIAL_8250_DEPRECATED_OPTIONS=y CONFIG_SERIAL_8250_PNP=y CONFIG_SERIAL_8250_CONSOLE=y CONFIG_SERIAL_8250_DMA=y CONFIG_SERIAL_8250_PCI=y CONFIG_SERIAL_8250_CS=y CONFIG_SERIAL_8250_NR_UARTS=32 CONFIG_SERIAL_8250_RUNTIME_UARTS=4 CONFIG_SERIAL_8250_EXTENDED=y CONFIG_SERIAL_8250_MANY_PORTS=y CONFIG_SERIAL_8250_SHARE_IRQ=y CONFIG_SERIAL_8250_DETECT_IRQ=y CONFIG_SERIAL_8250_RSA=y # CONFIG_SERIAL_8250_FSL is not set CONFIG_SERIAL_8250_DW=y CONFIG_SERIAL_8250_RT288X=y CONFIG_SERIAL_8250_FINTEK=y CONFIG_SERIAL_8250_MID=y # # Non-8250 serial port support # CONFIG_SERIAL_UARTLITE=y CONFIG_SERIAL_UARTLITE_CONSOLE=y CONFIG_SERIAL_CORE=y CONFIG_SERIAL_CORE_CONSOLE=y CONFIG_SERIAL_JSM=y CONFIG_SERIAL_SCCNXP=y CONFIG_SERIAL_SCCNXP_CONSOLE=y CONFIG_SERIAL_SC16IS7XX_CORE=y CONFIG_SERIAL_SC16IS7XX=y CONFIG_SERIAL_SC16IS7XX_I2C=y CONFIG_SERIAL_ALTERA_JTAGUART=y CONFIG_SERIAL_ALTERA_JTAGUART_CONSOLE=y CONFIG_SERIAL_ALTERA_JTAGUART_CONSOLE_BYPASS=y CONFIG_SERIAL_ALTERA_UART=y CONFIG_SERIAL_ALTERA_UART_MAXPORTS=4 CONFIG_SERIAL_ALTERA_UART_BAUDRATE=115200 CONFIG_SERIAL_ALTERA_UART_CONSOLE=y CONFIG_SERIAL_ARC=y CONFIG_SERIAL_ARC_CONSOLE=y CONFIG_SERIAL_ARC_NR_PORTS=1 CONFIG_SERIAL_RP2=y CONFIG_SERIAL_RP2_NR_UARTS=32 CONFIG_SERIAL_FSL_LPUART=y CONFIG_SERIAL_FSL_LPUART_CONSOLE=y # CONFIG_SERIAL_MEN_Z135 is not set # CONFIG_TTY_PRINTK is not set # CONFIG_PRINTER is not set # CONFIG_PPDEV is not set CONFIG_HVC_DRIVER=y CONFIG_HVC_IRQ=y CONFIG_HVC_XEN=y CONFIG_HVC_XEN_FRONTEND=y CONFIG_VIRTIO_CONSOLE=y # CONFIG_IPMI_HANDLER is not set CONFIG_HW_RANDOM=y CONFIG_HW_RANDOM_TIMERIOMEM=y CONFIG_HW_RANDOM_INTEL=y CONFIG_HW_RANDOM_AMD=y CONFIG_HW_RANDOM_VIA=y CONFIG_HW_RANDOM_VIRTIO=y CONFIG_HW_RANDOM_TPM=y CONFIG_NVRAM=y CONFIG_R3964=y CONFIG_APPLICOM=y # # PCMCIA character devices # CONFIG_SYNCLINK_CS=y CONFIG_CARDMAN_4000=y CONFIG_CARDMAN_4040=y CONFIG_IPWIRELESS=y CONFIG_MWAVE=y CONFIG_RAW_DRIVER=y CONFIG_MAX_RAW_DEVS=256 CONFIG_HPET=y CONFIG_HPET_MMAP=y CONFIG_HPET_MMAP_DEFAULT=y CONFIG_HANGCHECK_TIMER=y CONFIG_TCG_TPM=y CONFIG_TCG_TIS=y CONFIG_TCG_TIS_I2C_ATMEL=y CONFIG_TCG_TIS_I2C_INFINEON=y CONFIG_TCG_TIS_I2C_NUVOTON=y CONFIG_TCG_NSC=y CONFIG_TCG_ATMEL=y CONFIG_TCG_INFINEON=y CONFIG_TCG_XEN=y CONFIG_TCG_CRB=y CONFIG_TELCLOCK=y CONFIG_DEVPORT=y CONFIG_XILLYBUS=y CONFIG_XILLYBUS_PCIE=y # # I2C support # CONFIG_I2C=y CONFIG_ACPI_I2C_OPREGION=y CONFIG_I2C_BOARDINFO=y CONFIG_I2C_COMPAT=y # CONFIG_I2C_CHARDEV is not set # CONFIG_I2C_MUX is not set CONFIG_I2C_HELPER_AUTO=y CONFIG_I2C_SMBUS=y CONFIG_I2C_ALGOBIT=y # # I2C Hardware Bus support # # # PC SMBus host controller drivers # CONFIG_I2C_ALI1535=y CONFIG_I2C_ALI1563=y # CONFIG_I2C_ALI15X3 is not set # CONFIG_I2C_AMD756 is not set # CONFIG_I2C_AMD8111 is not set CONFIG_I2C_I801=y # CONFIG_I2C_ISCH is not set # CONFIG_I2C_ISMT is not set # CONFIG_I2C_PIIX4 is not set # CONFIG_I2C_NFORCE2 is not set # CONFIG_I2C_SIS5595 is not set # CONFIG_I2C_SIS630 is not set # CONFIG_I2C_SIS96X is not set # CONFIG_I2C_VIA is not set # CONFIG_I2C_VIAPRO is not set # # ACPI drivers # # CONFIG_I2C_SCMI is not set # # I2C system bus drivers (mostly embedded / system-on-chip) # CONFIG_I2C_DESIGNWARE_CORE=y CONFIG_I2C_DESIGNWARE_PCI=y CONFIG_I2C_OCORES=y # CONFIG_I2C_PCA_PLATFORM is not set # CONFIG_I2C_PXA_PCI is not set # CONFIG_I2C_SIMTEC is not set # CONFIG_I2C_XILINX is not set # # External I2C/SMBus adapter drivers # CONFIG_I2C_DIOLAN_U2C=y # CONFIG_I2C_PARPORT is not set CONFIG_I2C_PARPORT_LIGHT=y # CONFIG_I2C_ROBOTFUZZ_OSIF is not set # CONFIG_I2C_TAOS_EVM is not set # CONFIG_I2C_TINY_USB is not set # # Other I2C/SMBus bus drivers # CONFIG_I2C_CROS_EC_TUNNEL=y CONFIG_I2C_STUB=m CONFIG_I2C_SLAVE=y CONFIG_I2C_SLAVE_EEPROM=y # CONFIG_I2C_DEBUG_CORE is not set # CONFIG_I2C_DEBUG_ALGO is not set # CONFIG_I2C_DEBUG_BUS is not set # CONFIG_SPI is not set # CONFIG_SPMI is not set # CONFIG_HSI is not set # # PPS support # CONFIG_PPS=y # CONFIG_PPS_DEBUG is not set # # PPS clients support # CONFIG_PPS_CLIENT_KTIMER=y CONFIG_PPS_CLIENT_LDISC=y # CONFIG_PPS_CLIENT_PARPORT is not set CONFIG_PPS_CLIENT_GPIO=y # # PPS generators support # # # PTP clock support # CONFIG_PTP_1588_CLOCK=y # CONFIG_DP83640_PHY is not set CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y # CONFIG_GPIOLIB is not set # CONFIG_W1 is not set CONFIG_POWER_SUPPLY=y # CONFIG_POWER_SUPPLY_DEBUG is not set # CONFIG_PDA_POWER is not set # CONFIG_GENERIC_ADC_BATTERY is not set # CONFIG_TEST_POWER is not set # CONFIG_BATTERY_DS2780 is not set # CONFIG_BATTERY_DS2781 is not set # CONFIG_BATTERY_DS2782 is not set CONFIG_BATTERY_WM97XX=y # CONFIG_BATTERY_SBS is not set # CONFIG_BATTERY_BQ27XXX is not set CONFIG_BATTERY_DA9030=y # CONFIG_AXP288_FUEL_GAUGE is not set # CONFIG_BATTERY_MAX17040 is not set # CONFIG_BATTERY_MAX17042 is not set CONFIG_CHARGER_ISP1704=y # CONFIG_CHARGER_MAX8903 is not set # CONFIG_CHARGER_LP8727 is not set # CONFIG_CHARGER_BQ2415X is not set # CONFIG_CHARGER_SMB347 is not set # CONFIG_BATTERY_GAUGE_LTC2941 is not set CONFIG_AXP20X_POWER=y # CONFIG_POWER_RESET is not set # CONFIG_POWER_AVS is not set CONFIG_HWMON=y # CONFIG_HWMON_VID is not set # CONFIG_HWMON_DEBUG_CHIP is not set # # Native drivers # CONFIG_SENSORS_ABITUGURU=y CONFIG_SENSORS_ABITUGURU3=y # CONFIG_SENSORS_AD7414 is not set # CONFIG_SENSORS_AD7418 is not set # CONFIG_SENSORS_ADM1021 is not set # CONFIG_SENSORS_ADM1025 is not set # CONFIG_SENSORS_ADM1026 is not set # CONFIG_SENSORS_ADM1029 is not set # CONFIG_SENSORS_ADM1031 is not set # CONFIG_SENSORS_ADM9240 is not set # CONFIG_SENSORS_ADT7410 is not set # CONFIG_SENSORS_ADT7411 is not set # CONFIG_SENSORS_ADT7462 is not set # CONFIG_SENSORS_ADT7470 is not set # CONFIG_SENSORS_ADT7475 is not set # CONFIG_SENSORS_ASC7621 is not set # CONFIG_SENSORS_K8TEMP is not set # CONFIG_SENSORS_K10TEMP is not set # CONFIG_SENSORS_FAM15H_POWER is not set # CONFIG_SENSORS_APPLESMC is not set # CONFIG_SENSORS_ASB100 is not set # CONFIG_SENSORS_ATXP1 is not set # CONFIG_SENSORS_DS620 is not set # CONFIG_SENSORS_DS1621 is not set # CONFIG_SENSORS_DELL_SMM is not set # CONFIG_SENSORS_I5K_AMB is not set # CONFIG_SENSORS_F71805F is not set # CONFIG_SENSORS_F71882FG is not set # CONFIG_SENSORS_F75375S is not set # CONFIG_SENSORS_FSCHMD is not set # CONFIG_SENSORS_GL518SM is not set # CONFIG_SENSORS_GL520SM is not set # CONFIG_SENSORS_G760A is not set # CONFIG_SENSORS_G762 is not set # CONFIG_SENSORS_HIH6130 is not set # CONFIG_SENSORS_IIO_HWMON is not set # CONFIG_SENSORS_I5500 is not set # CONFIG_SENSORS_CORETEMP is not set # CONFIG_SENSORS_IT87 is not set # CONFIG_SENSORS_JC42 is not set # CONFIG_SENSORS_POWR1220 is not set # CONFIG_SENSORS_LINEAGE is not set CONFIG_SENSORS_LTC2945=y CONFIG_SENSORS_LTC4151=y # CONFIG_SENSORS_LTC4215 is not set # CONFIG_SENSORS_LTC4222 is not set # CONFIG_SENSORS_LTC4245 is not set # CONFIG_SENSORS_LTC4260 is not set # CONFIG_SENSORS_LTC4261 is not set # CONFIG_SENSORS_MAX16065 is not set # CONFIG_SENSORS_MAX1619 is not set # CONFIG_SENSORS_MAX1668 is not set # CONFIG_SENSORS_MAX197 is not set # CONFIG_SENSORS_MAX6639 is not set # CONFIG_SENSORS_MAX6642 is not set # CONFIG_SENSORS_MAX6650 is not set # CONFIG_SENSORS_MAX6697 is not set # CONFIG_SENSORS_MAX31790 is not set # CONFIG_SENSORS_MCP3021 is not set # CONFIG_SENSORS_LM63 is not set # CONFIG_SENSORS_LM73 is not set # CONFIG_SENSORS_LM75 is not set # CONFIG_SENSORS_LM77 is not set # CONFIG_SENSORS_LM78 is not set # CONFIG_SENSORS_LM80 is not set # CONFIG_SENSORS_LM83 is not set # CONFIG_SENSORS_LM85 is not set # CONFIG_SENSORS_LM87 is not set # CONFIG_SENSORS_LM90 is not set # CONFIG_SENSORS_LM92 is not set # CONFIG_SENSORS_LM93 is not set # CONFIG_SENSORS_LM95234 is not set # CONFIG_SENSORS_LM95241 is not set # CONFIG_SENSORS_LM95245 is not set # CONFIG_SENSORS_PC87360 is not set # CONFIG_SENSORS_PC87427 is not set # CONFIG_SENSORS_NTC_THERMISTOR is not set # CONFIG_SENSORS_NCT6683 is not set # CONFIG_SENSORS_NCT6775 is not set # CONFIG_SENSORS_NCT7802 is not set # CONFIG_SENSORS_NCT7904 is not set # CONFIG_SENSORS_PCF8591 is not set # CONFIG_PMBUS is not set # CONFIG_SENSORS_SHT21 is not set # CONFIG_SENSORS_SHTC1 is not set # CONFIG_SENSORS_SIS5595 is not set # CONFIG_SENSORS_DME1737 is not set # CONFIG_SENSORS_EMC1403 is not set # CONFIG_SENSORS_EMC2103 is not set # CONFIG_SENSORS_EMC6W201 is not set # CONFIG_SENSORS_SMSC47M1 is not set # CONFIG_SENSORS_SMSC47M192 is not set # CONFIG_SENSORS_SMSC47B397 is not set # CONFIG_SENSORS_SCH56XX_COMMON is not set # CONFIG_SENSORS_SCH5627 is not set # CONFIG_SENSORS_SCH5636 is not set # CONFIG_SENSORS_SMM665 is not set # CONFIG_SENSORS_ADC128D818 is not set # CONFIG_SENSORS_ADS1015 is not set # CONFIG_SENSORS_ADS7828 is not set # CONFIG_SENSORS_AMC6821 is not set # CONFIG_SENSORS_INA209 is not set # CONFIG_SENSORS_INA2XX is not set # CONFIG_SENSORS_TC74 is not set # CONFIG_SENSORS_THMC50 is not set # CONFIG_SENSORS_TMP102 is not set # CONFIG_SENSORS_TMP103 is not set # CONFIG_SENSORS_TMP401 is not set # CONFIG_SENSORS_TMP421 is not set # CONFIG_SENSORS_VIA_CPUTEMP is not set # CONFIG_SENSORS_VIA686A is not set # CONFIG_SENSORS_VT1211 is not set # CONFIG_SENSORS_VT8231 is not set # CONFIG_SENSORS_W83781D is not set # CONFIG_SENSORS_W83791D is not set # CONFIG_SENSORS_W83792D is not set # CONFIG_SENSORS_W83793 is not set # CONFIG_SENSORS_W83795 is not set # CONFIG_SENSORS_W83L785TS is not set # CONFIG_SENSORS_W83L786NG is not set # CONFIG_SENSORS_W83627HF is not set # CONFIG_SENSORS_W83627EHF is not set # # ACPI drivers # # CONFIG_SENSORS_ACPI_POWER is not set # CONFIG_SENSORS_ATK0110 is not set CONFIG_THERMAL=y CONFIG_THERMAL_HWMON=y CONFIG_THERMAL_WRITABLE_TRIPS=y CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y # CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE is not set # CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE is not set # CONFIG_THERMAL_DEFAULT_GOV_POWER_ALLOCATOR is not set # CONFIG_THERMAL_GOV_FAIR_SHARE is not set CONFIG_THERMAL_GOV_STEP_WISE=y CONFIG_THERMAL_GOV_BANG_BANG=y CONFIG_THERMAL_GOV_USER_SPACE=y # CONFIG_THERMAL_GOV_POWER_ALLOCATOR is not set # CONFIG_THERMAL_EMULATION is not set # CONFIG_INTEL_POWERCLAMP is not set CONFIG_X86_PKG_TEMP_THERMAL=m # CONFIG_INTEL_SOC_DTS_THERMAL is not set # CONFIG_INT340X_THERMAL is not set # CONFIG_INTEL_PCH_THERMAL is not set CONFIG_WATCHDOG=y CONFIG_WATCHDOG_CORE=y # CONFIG_WATCHDOG_NOWAYOUT is not set # CONFIG_WATCHDOG_SYSFS is not set # # Watchdog Device Drivers # CONFIG_SOFT_WATCHDOG=y CONFIG_XILINX_WATCHDOG=y # CONFIG_ZIIRAVE_WATCHDOG is not set CONFIG_CADENCE_WATCHDOG=y # CONFIG_DW_WATCHDOG is not set # CONFIG_MAX63XX_WATCHDOG is not set # CONFIG_ACQUIRE_WDT is not set # CONFIG_ADVANTECH_WDT is not set # CONFIG_ALIM1535_WDT is not set # CONFIG_ALIM7101_WDT is not set # CONFIG_F71808E_WDT is not set # CONFIG_SP5100_TCO is not set # CONFIG_SBC_FITPC2_WATCHDOG is not set # CONFIG_EUROTECH_WDT is not set # CONFIG_IB700_WDT is not set # CONFIG_IBMASR is not set # CONFIG_WAFER_WDT is not set # CONFIG_I6300ESB_WDT is not set # CONFIG_IE6XX_WDT is not set # CONFIG_INTEL_SCU_WATCHDOG is not set CONFIG_INTEL_MID_WATCHDOG=y # CONFIG_ITCO_WDT is not set # CONFIG_IT8712F_WDT is not set # CONFIG_IT87_WDT is not set # CONFIG_HP_WATCHDOG is not set # CONFIG_SC1200_WDT is not set # CONFIG_PC87413_WDT is not set # CONFIG_NV_TCO is not set # CONFIG_60XX_WDT is not set # CONFIG_CPU5_WDT is not set # CONFIG_SMSC_SCH311X_WDT is not set # CONFIG_SMSC37B787_WDT is not set # CONFIG_VIA_WDT is not set # CONFIG_W83627HF_WDT is not set # CONFIG_W83877F_WDT is not set # CONFIG_W83977F_WDT is not set # CONFIG_MACHZ_WDT is not set # CONFIG_SBC_EPX_C3_WATCHDOG is not set # CONFIG_BCM7038_WDT is not set CONFIG_XEN_WDT=y # # PCI-based Watchdog Cards # # CONFIG_PCIPCWATCHDOG is not set # CONFIG_WDTPCI is not set # # USB-based Watchdog Cards # # CONFIG_USBPCWATCHDOG is not set CONFIG_SSB_POSSIBLE=y # # Sonics Silicon Backplane # # CONFIG_SSB is not set CONFIG_BCMA_POSSIBLE=y # # Broadcom specific AMBA # # CONFIG_BCMA is not set # # Multifunction device drivers # CONFIG_MFD_CORE=y CONFIG_MFD_AS3711=y CONFIG_PMIC_ADP5520=y CONFIG_MFD_BCM590XX=y CONFIG_MFD_AXP20X=y CONFIG_MFD_CROS_EC=y CONFIG_MFD_CROS_EC_I2C=y CONFIG_PMIC_DA903X=y # CONFIG_MFD_DA9052_I2C is not set # CONFIG_MFD_DA9055 is not set # CONFIG_MFD_DA9062 is not set # CONFIG_MFD_DA9063 is not set # CONFIG_MFD_DA9150 is not set # CONFIG_MFD_DLN2 is not set # CONFIG_MFD_MC13XXX_I2C is not set # CONFIG_HTC_PASIC3 is not set # CONFIG_LPC_ICH is not set # CONFIG_LPC_SCH is not set # CONFIG_MFD_INTEL_LPSS_ACPI is not set # CONFIG_MFD_INTEL_LPSS_PCI is not set CONFIG_MFD_INTEL_MSIC=y # CONFIG_MFD_JANZ_CMODIO is not set # CONFIG_MFD_KEMPLD is not set # CONFIG_MFD_88PM800 is not set # CONFIG_MFD_88PM805 is not set # CONFIG_MFD_88PM860X is not set # CONFIG_MFD_MAX14577 is not set # CONFIG_MFD_MAX77693 is not set # CONFIG_MFD_MAX77843 is not set # CONFIG_MFD_MAX8907 is not set # CONFIG_MFD_MAX8925 is not set # CONFIG_MFD_MAX8997 is not set # CONFIG_MFD_MAX8998 is not set # CONFIG_MFD_MT6397 is not set # CONFIG_MFD_MENF21BMC is not set # CONFIG_MFD_VIPERBOARD is not set # CONFIG_MFD_RETU is not set # CONFIG_MFD_PCF50633 is not set # CONFIG_MFD_RDC321X is not set # CONFIG_MFD_RTSX_PCI is not set # CONFIG_MFD_RT5033 is not set # CONFIG_MFD_RTSX_USB is not set # CONFIG_MFD_RC5T583 is not set # CONFIG_MFD_RN5T618 is not set # CONFIG_MFD_SEC_CORE is not set # CONFIG_MFD_SI476X_CORE is not set # CONFIG_MFD_SM501 is not set # CONFIG_MFD_SKY81452 is not set # CONFIG_MFD_SMSC is not set # CONFIG_ABX500_CORE is not set CONFIG_MFD_SYSCON=y # CONFIG_MFD_TI_AM335X_TSCADC is not set # CONFIG_MFD_LP3943 is not set # CONFIG_MFD_LP8788 is not set # CONFIG_MFD_PALMAS is not set # CONFIG_TPS6105X is not set # CONFIG_TPS6507X is not set # CONFIG_MFD_TPS65090 is not set # CONFIG_MFD_TPS65217 is not set # CONFIG_MFD_TPS65218 is not set # CONFIG_MFD_TPS6586X is not set # CONFIG_MFD_TPS80031 is not set # CONFIG_TWL4030_CORE is not set # CONFIG_TWL6040_CORE is not set # CONFIG_MFD_WL1273_CORE is not set # CONFIG_MFD_LM3533 is not set # CONFIG_MFD_TMIO is not set # CONFIG_MFD_VX855 is not set # CONFIG_MFD_ARIZONA_I2C is not set # CONFIG_MFD_WM8400 is not set # CONFIG_MFD_WM831X_I2C is not set # CONFIG_MFD_WM8350_I2C is not set # CONFIG_MFD_WM8994 is not set # CONFIG_REGULATOR is not set # CONFIG_MEDIA_SUPPORT is not set # # Graphics support # CONFIG_AGP=y CONFIG_AGP_AMD64=y CONFIG_AGP_INTEL=y CONFIG_AGP_SIS=y CONFIG_AGP_VIA=y CONFIG_INTEL_GTT=y CONFIG_VGA_ARB=y CONFIG_VGA_ARB_MAX_GPUS=16 CONFIG_VGA_SWITCHEROO=y CONFIG_DRM=y CONFIG_DRM_MIPI_DSI=y CONFIG_DRM_KMS_HELPER=y CONFIG_DRM_KMS_FB_HELPER=y CONFIG_DRM_FBDEV_EMULATION=y CONFIG_DRM_LOAD_EDID_FIRMWARE=y CONFIG_DRM_TTM=y # # I2C encoder or helper chips # CONFIG_DRM_I2C_ADV7511=y CONFIG_DRM_I2C_CH7006=y # CONFIG_DRM_I2C_SIL164 is not set # CONFIG_DRM_I2C_NXP_TDA998X is not set # CONFIG_DRM_TDFX is not set # CONFIG_DRM_R128 is not set # CONFIG_DRM_RADEON is not set # CONFIG_DRM_AMDGPU is not set # CONFIG_DRM_NOUVEAU is not set # CONFIG_DRM_I810 is not set CONFIG_DRM_I915=y # CONFIG_DRM_I915_PRELIMINARY_HW_SUPPORT is not set # CONFIG_DRM_MGA is not set # CONFIG_DRM_SIS is not set # CONFIG_DRM_VIA is not set # CONFIG_DRM_SAVAGE is not set # CONFIG_DRM_VGEM is not set # CONFIG_DRM_VMWGFX is not set # CONFIG_DRM_GMA500 is not set # CONFIG_DRM_UDL is not set # CONFIG_DRM_AST is not set # CONFIG_DRM_MGAG200 is not set # CONFIG_DRM_CIRRUS_QEMU is not set # CONFIG_DRM_QXL is not set # CONFIG_DRM_BOCHS is not set CONFIG_DRM_VIRTIO_GPU=y CONFIG_DRM_PANEL=y # # Display Panels # CONFIG_DRM_BRIDGE=y # # Display Interface Bridges # # # Frame buffer Devices # CONFIG_FB=y # CONFIG_FIRMWARE_EDID is not set CONFIG_FB_CMDLINE=y CONFIG_FB_NOTIFY=y CONFIG_FB_DDC=y CONFIG_FB_BOOT_VESA_SUPPORT=y CONFIG_FB_CFB_FILLRECT=y CONFIG_FB_CFB_COPYAREA=y CONFIG_FB_CFB_IMAGEBLIT=y # CONFIG_FB_CFB_REV_PIXELS_IN_BYTE is not set CONFIG_FB_SYS_FILLRECT=y CONFIG_FB_SYS_COPYAREA=y CONFIG_FB_SYS_IMAGEBLIT=y # CONFIG_FB_FOREIGN_ENDIAN is not set CONFIG_FB_SYS_FOPS=y CONFIG_FB_DEFERRED_IO=y # CONFIG_FB_SVGALIB is not set # CONFIG_FB_MACMODES is not set # CONFIG_FB_BACKLIGHT is not set CONFIG_FB_MODE_HELPERS=y CONFIG_FB_TILEBLITTING=y # # Frame buffer hardware drivers # CONFIG_FB_CIRRUS=y CONFIG_FB_PM2=y CONFIG_FB_PM2_FIFO_DISCONNECT=y CONFIG_FB_CYBER2000=y CONFIG_FB_CYBER2000_DDC=y CONFIG_FB_ARC=y CONFIG_FB_ASILIANT=y CONFIG_FB_IMSTT=y # CONFIG_FB_VGA16 is not set # CONFIG_FB_UVESA is not set CONFIG_FB_VESA=y CONFIG_FB_EFI=y # CONFIG_FB_N411 is not set # CONFIG_FB_HGA is not set # CONFIG_FB_OPENCORES is not set # CONFIG_FB_S1D13XXX is not set # CONFIG_FB_NVIDIA is not set # CONFIG_FB_RIVA is not set # CONFIG_FB_I740 is not set # CONFIG_FB_LE80578 is not set # CONFIG_FB_MATROX is not set # CONFIG_FB_RADEON is not set # CONFIG_FB_ATY128 is not set # CONFIG_FB_ATY is not set # CONFIG_FB_S3 is not set # CONFIG_FB_SAVAGE is not set # CONFIG_FB_SIS is not set # CONFIG_FB_NEOMAGIC is not set # CONFIG_FB_KYRO is not set # CONFIG_FB_3DFX is not set # CONFIG_FB_VOODOO1 is not set # CONFIG_FB_VT8623 is not set # CONFIG_FB_TRIDENT is not set # CONFIG_FB_ARK is not set # CONFIG_FB_PM3 is not set # CONFIG_FB_CARMINE is not set # CONFIG_FB_SMSCUFX is not set # CONFIG_FB_UDL is not set # CONFIG_FB_IBM_GXT4500 is not set CONFIG_FB_VIRTUAL=y CONFIG_XEN_FBDEV_FRONTEND=y # CONFIG_FB_METRONOME is not set # CONFIG_FB_MB862XX is not set # CONFIG_FB_BROADSHEET is not set # CONFIG_FB_AUO_K190X is not set # CONFIG_FB_SIMPLE is not set # CONFIG_FB_SM712 is not set CONFIG_BACKLIGHT_LCD_SUPPORT=y # CONFIG_LCD_CLASS_DEVICE is not set CONFIG_BACKLIGHT_CLASS_DEVICE=y CONFIG_BACKLIGHT_GENERIC=y # CONFIG_BACKLIGHT_PWM is not set CONFIG_BACKLIGHT_DA903X=y # CONFIG_BACKLIGHT_APPLE is not set # CONFIG_BACKLIGHT_PM8941_WLED is not set # CONFIG_BACKLIGHT_SAHARA is not set CONFIG_BACKLIGHT_ADP5520=y # CONFIG_BACKLIGHT_ADP8860 is not set # CONFIG_BACKLIGHT_ADP8870 is not set # CONFIG_BACKLIGHT_LM3630A is not set # CONFIG_BACKLIGHT_LM3639 is not set # CONFIG_BACKLIGHT_LP855X is not set CONFIG_BACKLIGHT_AS3711=y # CONFIG_BACKLIGHT_LV5207LP is not set # CONFIG_BACKLIGHT_BD6107 is not set # CONFIG_VGASTATE is not set CONFIG_HDMI=y # # Console display driver support # CONFIG_VGA_CONSOLE=y CONFIG_VGACON_SOFT_SCROLLBACK=y CONFIG_VGACON_SOFT_SCROLLBACK_SIZE=64 CONFIG_DUMMY_CONSOLE=y CONFIG_DUMMY_CONSOLE_COLUMNS=80 CONFIG_DUMMY_CONSOLE_ROWS=25 CONFIG_FRAMEBUFFER_CONSOLE=y CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y # CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set CONFIG_LOGO=y # CONFIG_LOGO_LINUX_MONO is not set # CONFIG_LOGO_LINUX_VGA16 is not set CONFIG_LOGO_LINUX_CLUT224=y CONFIG_SOUND=y CONFIG_SOUND_OSS_CORE=y CONFIG_SOUND_OSS_CORE_PRECLAIM=y CONFIG_SND=y CONFIG_SND_TIMER=y CONFIG_SND_PCM=y CONFIG_SND_HWDEP=y CONFIG_SND_RAWMIDI=y CONFIG_SND_JACK=y CONFIG_SND_SEQUENCER=y CONFIG_SND_SEQ_DUMMY=y CONFIG_SND_OSSEMUL=y CONFIG_SND_MIXER_OSS=y CONFIG_SND_PCM_OSS=y CONFIG_SND_PCM_OSS_PLUGINS=y CONFIG_SND_PCM_TIMER=y CONFIG_SND_SEQUENCER_OSS=y CONFIG_SND_HRTIMER=y CONFIG_SND_SEQ_HRTIMER_DEFAULT=y CONFIG_SND_DYNAMIC_MINORS=y CONFIG_SND_MAX_CARDS=32 CONFIG_SND_SUPPORT_OLD_API=y CONFIG_SND_PROC_FS=y CONFIG_SND_VERBOSE_PROCFS=y # CONFIG_SND_VERBOSE_PRINTK is not set CONFIG_SND_DEBUG=y # CONFIG_SND_DEBUG_VERBOSE is not set CONFIG_SND_PCM_XRUN_DEBUG=y CONFIG_SND_VMASTER=y CONFIG_SND_DMA_SGBUF=y CONFIG_SND_RAWMIDI_SEQ=y CONFIG_SND_OPL3_LIB_SEQ=y # CONFIG_SND_OPL4_LIB_SEQ is not set # CONFIG_SND_SBAWE_SEQ is not set # CONFIG_SND_EMU10K1_SEQ is not set CONFIG_SND_MPU401_UART=y CONFIG_SND_OPL3_LIB=y CONFIG_SND_AC97_CODEC=y CONFIG_SND_DRIVERS=y CONFIG_SND_PCSP=y CONFIG_SND_DUMMY=y CONFIG_SND_ALOOP=y CONFIG_SND_VIRMIDI=y # CONFIG_SND_MTPAV is not set CONFIG_SND_MTS64=y CONFIG_SND_SERIAL_U16550=y CONFIG_SND_MPU401=y CONFIG_SND_PORTMAN2X4=y CONFIG_SND_AC97_POWER_SAVE=y CONFIG_SND_AC97_POWER_SAVE_DEFAULT=0 CONFIG_SND_SB_COMMON=y CONFIG_SND_PCI=y CONFIG_SND_AD1889=y CONFIG_SND_ALS300=y CONFIG_SND_ALS4000=y CONFIG_SND_ALI5451=y # CONFIG_SND_ASIHPI is not set # CONFIG_SND_ATIIXP is not set # CONFIG_SND_ATIIXP_MODEM is not set CONFIG_SND_AU8810=y # CONFIG_SND_AU8820 is not set # CONFIG_SND_AU8830 is not set # CONFIG_SND_AW2 is not set # CONFIG_SND_AZT3328 is not set # CONFIG_SND_BT87X is not set # CONFIG_SND_CA0106 is not set # CONFIG_SND_CMIPCI is not set CONFIG_SND_OXYGEN_LIB=y # CONFIG_SND_OXYGEN is not set # CONFIG_SND_CS4281 is not set # CONFIG_SND_CS46XX is not set # CONFIG_SND_CTXFI is not set # CONFIG_SND_DARLA20 is not set # CONFIG_SND_GINA20 is not set # CONFIG_SND_LAYLA20 is not set # CONFIG_SND_DARLA24 is not set # CONFIG_SND_GINA24 is not set # CONFIG_SND_LAYLA24 is not set # CONFIG_SND_MONA is not set # CONFIG_SND_MIA is not set # CONFIG_SND_ECHO3G is not set # CONFIG_SND_INDIGO is not set # CONFIG_SND_INDIGOIO is not set # CONFIG_SND_INDIGODJ is not set # CONFIG_SND_INDIGOIOX is not set # CONFIG_SND_INDIGODJX is not set # CONFIG_SND_EMU10K1 is not set # CONFIG_SND_EMU10K1X is not set # CONFIG_SND_ENS1370 is not set # CONFIG_SND_ENS1371 is not set # CONFIG_SND_ES1938 is not set # CONFIG_SND_ES1968 is not set # CONFIG_SND_FM801 is not set # CONFIG_SND_HDSP is not set # CONFIG_SND_HDSPM is not set # CONFIG_SND_ICE1712 is not set # CONFIG_SND_ICE1724 is not set # CONFIG_SND_INTEL8X0 is not set # CONFIG_SND_INTEL8X0M is not set # CONFIG_SND_KORG1212 is not set # CONFIG_SND_LOLA is not set # CONFIG_SND_LX6464ES is not set # CONFIG_SND_MAESTRO3 is not set # CONFIG_SND_MIXART is not set # CONFIG_SND_NM256 is not set # CONFIG_SND_PCXHR is not set # CONFIG_SND_RIPTIDE is not set # CONFIG_SND_RME32 is not set # CONFIG_SND_RME96 is not set # CONFIG_SND_RME9652 is not set # CONFIG_SND_SONICVIBES is not set # CONFIG_SND_TRIDENT is not set # CONFIG_SND_VIA82XX is not set # CONFIG_SND_VIA82XX_MODEM is not set CONFIG_SND_VIRTUOSO=y # CONFIG_SND_VX222 is not set # CONFIG_SND_YMFPCI is not set # # HD-Audio # CONFIG_SND_HDA=y CONFIG_SND_HDA_INTEL=y CONFIG_SND_HDA_HWDEP=y CONFIG_SND_HDA_RECONFIG=y CONFIG_SND_HDA_INPUT_BEEP=y CONFIG_SND_HDA_INPUT_BEEP_MODE=1 CONFIG_SND_HDA_PATCH_LOADER=y CONFIG_SND_HDA_CODEC_REALTEK=y CONFIG_SND_HDA_CODEC_ANALOG=y CONFIG_SND_HDA_CODEC_SIGMATEL=y CONFIG_SND_HDA_CODEC_VIA=y CONFIG_SND_HDA_CODEC_HDMI=y # CONFIG_SND_HDA_CODEC_CIRRUS is not set # CONFIG_SND_HDA_CODEC_CONEXANT is not set # CONFIG_SND_HDA_CODEC_CA0110 is not set # CONFIG_SND_HDA_CODEC_CA0132 is not set # CONFIG_SND_HDA_CODEC_CMEDIA is not set # CONFIG_SND_HDA_CODEC_SI3054 is not set CONFIG_SND_HDA_GENERIC=y CONFIG_SND_HDA_POWER_SAVE_DEFAULT=0 CONFIG_SND_HDA_CORE=y CONFIG_SND_HDA_I915=y CONFIG_SND_HDA_PREALLOC_SIZE=64 CONFIG_SND_USB=y CONFIG_SND_USB_AUDIO=y # CONFIG_SND_USB_UA101 is not set # CONFIG_SND_USB_USX2Y is not set # CONFIG_SND_USB_CAIAQ is not set # CONFIG_SND_USB_US122L is not set # CONFIG_SND_USB_6FIRE is not set # CONFIG_SND_USB_HIFACE is not set # CONFIG_SND_BCD2000 is not set # CONFIG_SND_USB_POD is not set # CONFIG_SND_USB_PODHD is not set # CONFIG_SND_USB_TONEPORT is not set # CONFIG_SND_USB_VARIAX is not set CONFIG_SND_FIREWIRE=y CONFIG_SND_FIREWIRE_LIB=y CONFIG_SND_DICE=y CONFIG_SND_OXFW=y CONFIG_SND_ISIGHT=y CONFIG_SND_FIREWORKS=y CONFIG_SND_BEBOB=y CONFIG_SND_FIREWIRE_DIGI00X=y CONFIG_SND_FIREWIRE_TASCAM=y CONFIG_SND_PCMCIA=y # CONFIG_SND_VXPOCKET is not set # CONFIG_SND_PDAUDIOCF is not set # CONFIG_SND_SOC is not set # CONFIG_SOUND_PRIME is not set CONFIG_AC97_BUS=y # # HID support # CONFIG_HID=y # CONFIG_HID_BATTERY_STRENGTH is not set CONFIG_HIDRAW=y # CONFIG_UHID is not set CONFIG_HID_GENERIC=y # # Special HID drivers # CONFIG_HID_A4TECH=y # CONFIG_HID_ACRUX is not set CONFIG_HID_APPLE=y # CONFIG_HID_APPLEIR is not set # CONFIG_HID_AUREAL is not set CONFIG_HID_BELKIN=y # CONFIG_HID_BETOP_FF is not set CONFIG_HID_CHERRY=y CONFIG_HID_CHICONY=y # CONFIG_HID_CORSAIR is not set # CONFIG_HID_PRODIKEYS is not set CONFIG_HID_CYPRESS=y # CONFIG_HID_DRAGONRISE is not set # CONFIG_HID_EMS_FF is not set # CONFIG_HID_ELECOM is not set # CONFIG_HID_ELO is not set CONFIG_HID_EZKEY=y # CONFIG_HID_GEMBIRD is not set # CONFIG_HID_GFRM is not set # CONFIG_HID_HOLTEK is not set # CONFIG_HID_GT683R is not set # CONFIG_HID_KEYTOUCH is not set # CONFIG_HID_KYE is not set # CONFIG_HID_UCLOGIC is not set # CONFIG_HID_WALTOP is not set CONFIG_HID_GYRATION=y # CONFIG_HID_ICADE is not set # CONFIG_HID_TWINHAN is not set CONFIG_HID_KENSINGTON=y # CONFIG_HID_LCPOWER is not set # CONFIG_HID_LENOVO is not set CONFIG_HID_LOGITECH=y # CONFIG_HID_LOGITECH_DJ is not set # CONFIG_HID_LOGITECH_HIDPP is not set CONFIG_LOGITECH_FF=y # CONFIG_LOGIRUMBLEPAD2_FF is not set # CONFIG_LOGIG940_FF is not set CONFIG_LOGIWHEELS_FF=y # CONFIG_HID_MAGICMOUSE is not set CONFIG_HID_MICROSOFT=y CONFIG_HID_MONTEREY=y # CONFIG_HID_MULTITOUCH is not set CONFIG_HID_NTRIG=y # CONFIG_HID_ORTEK is not set CONFIG_HID_PANTHERLORD=y CONFIG_PANTHERLORD_FF=y # CONFIG_HID_PENMOUNT is not set CONFIG_HID_PETALYNX=y # CONFIG_HID_PICOLCD is not set # CONFIG_HID_PLANTRONICS is not set # CONFIG_HID_PRIMAX is not set # CONFIG_HID_ROCCAT is not set # CONFIG_HID_SAITEK is not set CONFIG_HID_SAMSUNG=y CONFIG_HID_SONY=y # CONFIG_SONY_FF is not set # CONFIG_HID_SPEEDLINK is not set # CONFIG_HID_STEELSERIES is not set CONFIG_HID_SUNPLUS=y # CONFIG_HID_RMI is not set # CONFIG_HID_GREENASIA is not set # CONFIG_HID_SMARTJOYPLUS is not set # CONFIG_HID_TIVO is not set CONFIG_HID_TOPSEED=y # CONFIG_HID_THINGM is not set # CONFIG_HID_THRUSTMASTER is not set # CONFIG_HID_WACOM is not set # CONFIG_HID_WIIMOTE is not set # CONFIG_HID_XINMO is not set # CONFIG_HID_ZEROPLUS is not set # CONFIG_HID_ZYDACRON is not set # CONFIG_HID_SENSOR_HUB is not set # # USB HID support # CONFIG_USB_HID=y CONFIG_HID_PID=y CONFIG_USB_HIDDEV=y # # I2C HID support # CONFIG_I2C_HID=y CONFIG_USB_OHCI_LITTLE_ENDIAN=y CONFIG_USB_SUPPORT=y CONFIG_USB_COMMON=y CONFIG_USB_ARCH_HAS_HCD=y CONFIG_USB=y CONFIG_USB_ANNOUNCE_NEW_DEVICES=y # # Miscellaneous USB options # CONFIG_USB_DEFAULT_PERSIST=y CONFIG_USB_DYNAMIC_MINORS=y CONFIG_USB_OTG=y # CONFIG_USB_OTG_WHITELIST is not set CONFIG_USB_OTG_BLACKLIST_HUB=y # CONFIG_USB_OTG_FSM is not set # CONFIG_USB_ULPI_BUS is not set CONFIG_USB_MON=y # CONFIG_USB_WUSB is not set # CONFIG_USB_WUSB_CBAF is not set # # USB Host Controller Drivers # CONFIG_USB_C67X00_HCD=y CONFIG_USB_XHCI_HCD=y CONFIG_USB_XHCI_PCI=y CONFIG_USB_XHCI_PLATFORM=y CONFIG_USB_EHCI_HCD=y # CONFIG_USB_EHCI_ROOT_HUB_TT is not set CONFIG_USB_EHCI_TT_NEWSCHED=y CONFIG_USB_EHCI_PCI=y CONFIG_USB_EHCI_HCD_PLATFORM=y CONFIG_USB_OXU210HP_HCD=y # CONFIG_USB_ISP116X_HCD is not set # CONFIG_USB_ISP1362_HCD is not set # CONFIG_USB_FOTG210_HCD is not set CONFIG_USB_OHCI_HCD=y CONFIG_USB_OHCI_HCD_PCI=y # CONFIG_USB_OHCI_HCD_PLATFORM is not set CONFIG_USB_UHCI_HCD=y # CONFIG_USB_SL811_HCD is not set # CONFIG_USB_R8A66597_HCD is not set # CONFIG_USB_WHCI_HCD is not set # CONFIG_USB_HWA_HCD is not set # CONFIG_USB_HCD_TEST_MODE is not set # # USB Device Class drivers # CONFIG_USB_ACM=y CONFIG_USB_PRINTER=y CONFIG_USB_WDM=y CONFIG_USB_TMC=y # # NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may # # # also be needed; see USB_STORAGE Help for more info # CONFIG_USB_STORAGE=y CONFIG_USB_STORAGE_DEBUG=y CONFIG_USB_STORAGE_REALTEK=y CONFIG_REALTEK_AUTOPM=y CONFIG_USB_STORAGE_DATAFAB=y CONFIG_USB_STORAGE_FREECOM=y CONFIG_USB_STORAGE_ISD200=y # CONFIG_USB_STORAGE_USBAT is not set # CONFIG_USB_STORAGE_SDDR09 is not set # CONFIG_USB_STORAGE_SDDR55 is not set # CONFIG_USB_STORAGE_JUMPSHOT is not set # CONFIG_USB_STORAGE_ALAUDA is not set # CONFIG_USB_STORAGE_ONETOUCH is not set # CONFIG_USB_STORAGE_KARMA is not set # CONFIG_USB_STORAGE_CYPRESS_ATACB is not set # CONFIG_USB_STORAGE_ENE_UB6250 is not set # CONFIG_USB_UAS is not set # # USB Imaging devices # CONFIG_USB_MDC800=y CONFIG_USB_MICROTEK=y # CONFIG_USBIP_CORE is not set # CONFIG_USB_MUSB_HDRC is not set # CONFIG_USB_DWC3 is not set # CONFIG_USB_DWC2 is not set # CONFIG_USB_CHIPIDEA is not set # CONFIG_USB_ISP1760 is not set # # USB port drivers # # CONFIG_USB_USS720 is not set # CONFIG_USB_SERIAL is not set # # USB Miscellaneous drivers # CONFIG_USB_EMI62=y CONFIG_USB_EMI26=y CONFIG_USB_ADUTUX=y CONFIG_USB_SEVSEG=y # CONFIG_USB_RIO500 is not set # CONFIG_USB_LEGOTOWER is not set # CONFIG_USB_LCD is not set # CONFIG_USB_LED is not set # CONFIG_USB_CYPRESS_CY7C63 is not set # CONFIG_USB_CYTHERM is not set # CONFIG_USB_IDMOUSE is not set # CONFIG_USB_FTDI_ELAN is not set # CONFIG_USB_APPLEDISPLAY is not set # CONFIG_USB_SISUSBVGA is not set # CONFIG_USB_LD is not set # CONFIG_USB_TRANCEVIBRATOR is not set # CONFIG_USB_IOWARRIOR is not set # CONFIG_USB_TEST is not set # CONFIG_USB_EHSET_TEST_FIXTURE is not set # CONFIG_USB_ISIGHTFW is not set # CONFIG_USB_YUREX is not set # CONFIG_USB_EZUSB_FX2 is not set # CONFIG_USB_HSIC_USB3503 is not set # CONFIG_USB_LINK_LAYER_TEST is not set # CONFIG_USB_CHAOSKEY is not set # CONFIG_USB_ATM is not set # # USB Physical Layer drivers # CONFIG_USB_PHY=y CONFIG_NOP_USB_XCEIV=y CONFIG_USB_ISP1301=y CONFIG_USB_GADGET=y CONFIG_USB_GADGET_DEBUG=y CONFIG_USB_GADGET_VERBOSE=y CONFIG_USB_GADGET_DEBUG_FILES=y CONFIG_USB_GADGET_DEBUG_FS=y CONFIG_USB_GADGET_VBUS_DRAW=2 CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS=2 CONFIG_U_SERIAL_CONSOLE=y # # USB Peripheral Controller # CONFIG_USB_FOTG210_UDC=y CONFIG_USB_GR_UDC=y CONFIG_USB_R8A66597=y CONFIG_USB_PXA27X=y CONFIG_USB_MV_UDC=y CONFIG_USB_MV_U3D=y CONFIG_USB_M66592=y CONFIG_USB_BDC_UDC=y # # Platform Support # CONFIG_USB_BDC_PCI=y CONFIG_USB_AMD5536UDC=y CONFIG_USB_NET2272=y CONFIG_USB_NET2272_DMA=y CONFIG_USB_NET2280=y CONFIG_USB_GOKU=y CONFIG_USB_EG20T=y CONFIG_USB_DUMMY_HCD=y CONFIG_USB_LIBCOMPOSITE=m CONFIG_USB_F_ACM=m CONFIG_USB_F_SS_LB=m CONFIG_USB_U_SERIAL=m CONFIG_USB_U_ETHER=m CONFIG_USB_F_SERIAL=m CONFIG_USB_F_OBEX=m CONFIG_USB_F_NCM=m CONFIG_USB_F_ECM=m CONFIG_USB_F_PHONET=m CONFIG_USB_F_EEM=m CONFIG_USB_F_SUBSET=m CONFIG_USB_F_RNDIS=m CONFIG_USB_F_MASS_STORAGE=m CONFIG_USB_F_FS=m CONFIG_USB_F_UAC1=m CONFIG_USB_F_UAC2=m CONFIG_USB_F_MIDI=m CONFIG_USB_F_HID=m CONFIG_USB_F_PRINTER=m CONFIG_USB_CONFIGFS=m CONFIG_USB_CONFIGFS_SERIAL=y CONFIG_USB_CONFIGFS_ACM=y CONFIG_USB_CONFIGFS_OBEX=y CONFIG_USB_CONFIGFS_NCM=y CONFIG_USB_CONFIGFS_ECM=y CONFIG_USB_CONFIGFS_ECM_SUBSET=y CONFIG_USB_CONFIGFS_RNDIS=y CONFIG_USB_CONFIGFS_EEM=y CONFIG_USB_CONFIGFS_PHONET=y CONFIG_USB_CONFIGFS_MASS_STORAGE=y CONFIG_USB_CONFIGFS_F_LB_SS=y CONFIG_USB_CONFIGFS_F_FS=y CONFIG_USB_CONFIGFS_F_UAC1=y CONFIG_USB_CONFIGFS_F_UAC2=y CONFIG_USB_CONFIGFS_F_MIDI=y CONFIG_USB_CONFIGFS_F_HID=y CONFIG_USB_CONFIGFS_F_PRINTER=y CONFIG_USB_ZERO=m # CONFIG_USB_ZERO_HNPTEST is not set CONFIG_USB_AUDIO=m CONFIG_GADGET_UAC1=y CONFIG_USB_ETH=m CONFIG_USB_ETH_RNDIS=y CONFIG_USB_ETH_EEM=y CONFIG_USB_G_NCM=m CONFIG_USB_GADGETFS=m CONFIG_USB_FUNCTIONFS=m CONFIG_USB_FUNCTIONFS_ETH=y CONFIG_USB_FUNCTIONFS_RNDIS=y CONFIG_USB_FUNCTIONFS_GENERIC=y CONFIG_USB_MASS_STORAGE=m CONFIG_USB_G_SERIAL=m CONFIG_USB_MIDI_GADGET=m CONFIG_USB_G_PRINTER=m CONFIG_USB_CDC_COMPOSITE=m # CONFIG_USB_G_NOKIA is not set CONFIG_USB_G_ACM_MS=m CONFIG_USB_G_MULTI=m CONFIG_USB_G_MULTI_RNDIS=y CONFIG_USB_G_MULTI_CDC=y CONFIG_USB_G_HID=m CONFIG_USB_G_DBGP=m # CONFIG_USB_G_DBGP_PRINTK is not set CONFIG_USB_G_DBGP_SERIAL=y # CONFIG_USB_LED_TRIG is not set CONFIG_UWB=y CONFIG_UWB_HWA=y CONFIG_UWB_WHCI=y CONFIG_UWB_I1480U=y CONFIG_MMC=y CONFIG_MMC_DEBUG=y # # MMC/SD/SDIO Card Drivers # CONFIG_MMC_BLOCK=y CONFIG_MMC_BLOCK_MINORS=8 CONFIG_MMC_BLOCK_BOUNCE=y CONFIG_SDIO_UART=y # CONFIG_MMC_TEST is not set # # MMC/SD/SDIO Host Controller Drivers # CONFIG_MMC_SDHCI=y CONFIG_MMC_SDHCI_PCI=y CONFIG_MMC_RICOH_MMC=y CONFIG_MMC_SDHCI_ACPI=y CONFIG_MMC_SDHCI_PLTFM=y CONFIG_MMC_WBSD=y CONFIG_MMC_TIFM_SD=y # CONFIG_MMC_SDRICOH_CS is not set # CONFIG_MMC_CB710 is not set # CONFIG_MMC_VIA_SDMMC is not set # CONFIG_MMC_VUB300 is not set # CONFIG_MMC_USHC is not set # CONFIG_MMC_USDHI6ROL0 is not set # CONFIG_MMC_TOSHIBA_PCI is not set # CONFIG_MMC_MTK is not set # CONFIG_MEMSTICK is not set CONFIG_NEW_LEDS=y CONFIG_LEDS_CLASS=y # CONFIG_LEDS_CLASS_FLASH is not set # # LED drivers # CONFIG_LEDS_LM3530=y CONFIG_LEDS_LM3642=y # CONFIG_LEDS_PCA9532 is not set # CONFIG_LEDS_LP3944 is not set # CONFIG_LEDS_LP5521 is not set # CONFIG_LEDS_LP5523 is not set # CONFIG_LEDS_LP5562 is not set # CONFIG_LEDS_LP8501 is not set # CONFIG_LEDS_LP8860 is not set # CONFIG_LEDS_CLEVO_MAIL is not set # CONFIG_LEDS_PCA955X is not set # CONFIG_LEDS_PCA963X is not set CONFIG_LEDS_DA903X=y # CONFIG_LEDS_PWM is not set # CONFIG_LEDS_BD2802 is not set # CONFIG_LEDS_INTEL_SS4200 is not set CONFIG_LEDS_ADP5520=y # CONFIG_LEDS_TCA6507 is not set # CONFIG_LEDS_TLC591XX is not set # CONFIG_LEDS_LM355x is not set # # LED driver for blink(1) USB RGB LED is under Special HID drivers (HID_THINGM) # # CONFIG_LEDS_BLINKM is not set # # LED Triggers # CONFIG_LEDS_TRIGGERS=y # CONFIG_LEDS_TRIGGER_TIMER is not set # CONFIG_LEDS_TRIGGER_ONESHOT is not set # CONFIG_LEDS_TRIGGER_HEARTBEAT is not set # CONFIG_LEDS_TRIGGER_BACKLIGHT is not set # CONFIG_LEDS_TRIGGER_CPU is not set # CONFIG_LEDS_TRIGGER_DEFAULT_ON is not set # # iptables trigger is under Netfilter config (LED target) # # CONFIG_LEDS_TRIGGER_TRANSIENT is not set # CONFIG_LEDS_TRIGGER_CAMERA is not set # CONFIG_ACCESSIBILITY is not set CONFIG_INFINIBAND=y CONFIG_INFINIBAND_USER_MAD=y CONFIG_INFINIBAND_USER_ACCESS=y CONFIG_INFINIBAND_USER_MEM=y CONFIG_INFINIBAND_ON_DEMAND_PAGING=y CONFIG_INFINIBAND_ADDR_TRANS=y CONFIG_INFINIBAND_ADDR_TRANS_CONFIGFS=y CONFIG_INFINIBAND_MTHCA=y CONFIG_INFINIBAND_MTHCA_DEBUG=y CONFIG_INFINIBAND_QIB=y CONFIG_MLX4_INFINIBAND=y CONFIG_INFINIBAND_NES=y CONFIG_INFINIBAND_NES_DEBUG=y CONFIG_INFINIBAND_OCRDMA=y # CONFIG_INFINIBAND_USNIC is not set CONFIG_INFINIBAND_IPOIB=y CONFIG_INFINIBAND_IPOIB_CM=y CONFIG_INFINIBAND_IPOIB_DEBUG=y # CONFIG_INFINIBAND_IPOIB_DEBUG_DATA is not set CONFIG_INFINIBAND_SRP=y CONFIG_INFINIBAND_ISER=y CONFIG_EDAC_ATOMIC_SCRUB=y CONFIG_EDAC_SUPPORT=y CONFIG_EDAC=y CONFIG_EDAC_LEGACY_SYSFS=y CONFIG_EDAC_DEBUG=y CONFIG_EDAC_DECODE_MCE=y # CONFIG_EDAC_MM_EDAC is not set CONFIG_RTC_LIB=y CONFIG_RTC_CLASS=y # CONFIG_RTC_HCTOSYS is not set CONFIG_RTC_SYSTOHC=y CONFIG_RTC_SYSTOHC_DEVICE="rtc0" CONFIG_RTC_DEBUG=y # # RTC interfaces # CONFIG_RTC_INTF_SYSFS=y CONFIG_RTC_INTF_PROC=y CONFIG_RTC_INTF_DEV=y # CONFIG_RTC_INTF_DEV_UIE_EMUL is not set # CONFIG_RTC_DRV_TEST is not set # # I2C RTC drivers # CONFIG_RTC_DRV_ABB5ZES3=y CONFIG_RTC_DRV_ABX80X=y # CONFIG_RTC_DRV_DS1307 is not set # CONFIG_RTC_DRV_DS1374 is not set # CONFIG_RTC_DRV_DS1672 is not set # CONFIG_RTC_DRV_DS3232 is not set # CONFIG_RTC_DRV_MAX6900 is not set # CONFIG_RTC_DRV_RS5C372 is not set # CONFIG_RTC_DRV_ISL1208 is not set # CONFIG_RTC_DRV_ISL12022 is not set # CONFIG_RTC_DRV_ISL12057 is not set # CONFIG_RTC_DRV_X1205 is not set # CONFIG_RTC_DRV_PCF2127 is not set # CONFIG_RTC_DRV_PCF8523 is not set # CONFIG_RTC_DRV_PCF8563 is not set # CONFIG_RTC_DRV_PCF85063 is not set # CONFIG_RTC_DRV_PCF8583 is not set # CONFIG_RTC_DRV_M41T80 is not set # CONFIG_RTC_DRV_BQ32K is not set # CONFIG_RTC_DRV_S35390A is not set # CONFIG_RTC_DRV_FM3130 is not set # CONFIG_RTC_DRV_RX8010 is not set # CONFIG_RTC_DRV_RX8581 is not set # CONFIG_RTC_DRV_RX8025 is not set # CONFIG_RTC_DRV_EM3027 is not set # CONFIG_RTC_DRV_RV3029C2 is not set # CONFIG_RTC_DRV_RV8803 is not set # # SPI RTC drivers # # # Platform RTC drivers # CONFIG_RTC_DRV_CMOS=y CONFIG_RTC_DRV_VRTC=y # CONFIG_RTC_DRV_DS1286 is not set # CONFIG_RTC_DRV_DS1511 is not set # CONFIG_RTC_DRV_DS1553 is not set # CONFIG_RTC_DRV_DS1685_FAMILY is not set # CONFIG_RTC_DRV_DS1742 is not set # CONFIG_RTC_DRV_DS2404 is not set # CONFIG_RTC_DRV_STK17TA8 is not set # CONFIG_RTC_DRV_M48T86 is not set # CONFIG_RTC_DRV_M48T35 is not set # CONFIG_RTC_DRV_M48T59 is not set # CONFIG_RTC_DRV_MSM6242 is not set # CONFIG_RTC_DRV_BQ4802 is not set # CONFIG_RTC_DRV_RP5C01 is not set # CONFIG_RTC_DRV_V3020 is not set # # on-CPU RTC drivers # # # HID Sensor RTC drivers # # CONFIG_RTC_DRV_HID_SENSOR_TIME is not set CONFIG_DMADEVICES=y CONFIG_DMADEVICES_DEBUG=y CONFIG_DMADEVICES_VDEBUG=y # # DMA Devices # CONFIG_DMA_ENGINE=y CONFIG_DMA_VIRTUAL_CHANNELS=y CONFIG_DMA_ACPI=y CONFIG_INTEL_IDMA64=y # CONFIG_INTEL_IOATDMA is not set # CONFIG_DW_DMAC is not set # CONFIG_DW_DMAC_PCI is not set CONFIG_HSU_DMA=y CONFIG_HSU_DMA_PCI=y # # DMA Clients # CONFIG_ASYNC_TX_DMA=y # CONFIG_DMATEST is not set # CONFIG_AUXDISPLAY is not set # CONFIG_UIO is not set # CONFIG_VFIO is not set CONFIG_IRQ_BYPASS_MANAGER=y CONFIG_VIRT_DRIVERS=y CONFIG_VIRTIO=y # # Virtio drivers # CONFIG_VIRTIO_PCI=y CONFIG_VIRTIO_PCI_LEGACY=y CONFIG_VIRTIO_BALLOON=y CONFIG_VIRTIO_INPUT=y # CONFIG_VIRTIO_MMIO is not set # # Microsoft Hyper-V guest support # # CONFIG_HYPERV is not set # # Xen driver support # CONFIG_XEN_BALLOON=y CONFIG_XEN_BALLOON_MEMORY_HOTPLUG=y CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT=512 CONFIG_XEN_SCRUB_PAGES=y CONFIG_XEN_DEV_EVTCHN=y CONFIG_XEN_BACKEND=y CONFIG_XENFS=y CONFIG_XEN_COMPAT_XENFS=y CONFIG_XEN_SYS_HYPERVISOR=y CONFIG_XEN_XENBUS_FRONTEND=y CONFIG_XEN_GNTDEV=y CONFIG_XEN_GRANT_DEV_ALLOC=y CONFIG_SWIOTLB_XEN=y CONFIG_XEN_PCIDEV_BACKEND=y CONFIG_XEN_PRIVCMD=y CONFIG_XEN_ACPI_PROCESSOR=y CONFIG_XEN_MCE_LOG=y CONFIG_XEN_HAVE_PVMMU=y CONFIG_XEN_EFI=y CONFIG_XEN_AUTO_XLATE=y CONFIG_XEN_ACPI=y CONFIG_XEN_SYMS=y CONFIG_XEN_HAVE_VPMU=y CONFIG_STAGING=y CONFIG_SLICOSS=y CONFIG_PRISM2_USB=y CONFIG_COMEDI=m CONFIG_COMEDI_DEBUG=y CONFIG_COMEDI_DEFAULT_BUF_SIZE_KB=2048 CONFIG_COMEDI_DEFAULT_BUF_MAXSIZE_KB=20480 CONFIG_COMEDI_MISC_DRIVERS=y # CONFIG_COMEDI_BOND is not set # CONFIG_COMEDI_TEST is not set # CONFIG_COMEDI_PARPORT is not set # CONFIG_COMEDI_SERIAL2002 is not set # CONFIG_COMEDI_ISA_DRIVERS is not set CONFIG_COMEDI_PCI_DRIVERS=m # CONFIG_COMEDI_8255_PCI is not set # CONFIG_COMEDI_ADDI_APCI_1032 is not set # CONFIG_COMEDI_ADDI_APCI_1500 is not set # CONFIG_COMEDI_ADDI_APCI_1516 is not set # CONFIG_COMEDI_ADDI_APCI_1564 is not set # CONFIG_COMEDI_ADDI_APCI_16XX is not set # CONFIG_COMEDI_ADDI_APCI_2032 is not set # CONFIG_COMEDI_ADDI_APCI_2200 is not set # CONFIG_COMEDI_ADDI_APCI_3120 is not set # CONFIG_COMEDI_ADDI_APCI_3501 is not set # CONFIG_COMEDI_ADDI_APCI_3XXX is not set # CONFIG_COMEDI_ADL_PCI6208 is not set # CONFIG_COMEDI_ADL_PCI7X3X is not set # CONFIG_COMEDI_ADL_PCI8164 is not set # CONFIG_COMEDI_ADL_PCI9111 is not set # CONFIG_COMEDI_ADL_PCI9118 is not set # CONFIG_COMEDI_ADV_PCI1710 is not set # CONFIG_COMEDI_ADV_PCI1720 is not set # CONFIG_COMEDI_ADV_PCI1723 is not set # CONFIG_COMEDI_ADV_PCI1724 is not set # CONFIG_COMEDI_ADV_PCI1760 is not set # CONFIG_COMEDI_ADV_PCI_DIO is not set # CONFIG_COMEDI_AMPLC_DIO200_PCI is not set # CONFIG_COMEDI_AMPLC_PC236_PCI is not set # CONFIG_COMEDI_AMPLC_PC263_PCI is not set # CONFIG_COMEDI_AMPLC_PCI224 is not set # CONFIG_COMEDI_AMPLC_PCI230 is not set # CONFIG_COMEDI_CONTEC_PCI_DIO is not set # CONFIG_COMEDI_DAS08_PCI is not set # CONFIG_COMEDI_DT3000 is not set # CONFIG_COMEDI_DYNA_PCI10XX is not set # CONFIG_COMEDI_GSC_HPDI is not set # CONFIG_COMEDI_MF6X4 is not set # CONFIG_COMEDI_ICP_MULTI is not set # CONFIG_COMEDI_DAQBOARD2000 is not set # CONFIG_COMEDI_JR3_PCI is not set # CONFIG_COMEDI_KE_COUNTER is not set # CONFIG_COMEDI_CB_PCIDAS64 is not set # CONFIG_COMEDI_CB_PCIDAS is not set # CONFIG_COMEDI_CB_PCIDDA is not set # CONFIG_COMEDI_CB_PCIMDAS is not set # CONFIG_COMEDI_CB_PCIMDDA is not set # CONFIG_COMEDI_ME4000 is not set # CONFIG_COMEDI_ME_DAQ is not set # CONFIG_COMEDI_NI_6527 is not set # CONFIG_COMEDI_NI_65XX is not set # CONFIG_COMEDI_NI_660X is not set # CONFIG_COMEDI_NI_670X is not set # CONFIG_COMEDI_NI_LABPC_PCI is not set # CONFIG_COMEDI_NI_PCIDIO is not set # CONFIG_COMEDI_NI_PCIMIO is not set # CONFIG_COMEDI_RTD520 is not set # CONFIG_COMEDI_S626 is not set CONFIG_COMEDI_PCMCIA_DRIVERS=m # CONFIG_COMEDI_CB_DAS16_CS is not set # CONFIG_COMEDI_DAS08_CS is not set # CONFIG_COMEDI_NI_DAQ_700_CS is not set # CONFIG_COMEDI_NI_DAQ_DIO24_CS is not set # CONFIG_COMEDI_NI_LABPC_CS is not set # CONFIG_COMEDI_NI_MIO_CS is not set # CONFIG_COMEDI_QUATECH_DAQP_CS is not set CONFIG_COMEDI_USB_DRIVERS=m # CONFIG_COMEDI_DT9812 is not set # CONFIG_COMEDI_NI_USB6501 is not set # CONFIG_COMEDI_USBDUX is not set # CONFIG_COMEDI_USBDUXFAST is not set # CONFIG_COMEDI_USBDUXSIGMA is not set # CONFIG_COMEDI_VMK80XX is not set CONFIG_COMEDI_8255=m CONFIG_COMEDI_8255_SA=m CONFIG_COMEDI_KCOMEDILIB=m # CONFIG_PANEL is not set CONFIG_RTL8192U=m CONFIG_RTLLIB=m CONFIG_RTLLIB_CRYPTO_CCMP=m CONFIG_RTLLIB_CRYPTO_TKIP=m CONFIG_RTLLIB_CRYPTO_WEP=m CONFIG_RTL8192E=m CONFIG_R8712U=m CONFIG_R8188EU=m CONFIG_88EU_AP_MODE=y CONFIG_R8723AU=m CONFIG_8723AU_AP_MODE=y CONFIG_8723AU_BT_COEXIST=y # CONFIG_RTS5208 is not set CONFIG_VT6655=m CONFIG_VT6656=m # # IIO staging drivers # # # Accelerometers # # # Analog to digital converters # # # Analog digital bi-direction converters # # # Capacitance to digital converters # # CONFIG_AD7150 is not set # CONFIG_AD7152 is not set # CONFIG_AD7746 is not set # # Direct Digital Synthesis # # # Digital gyroscope sensors # # # Network Analyzer, Impedance Converters # # CONFIG_AD5933 is not set # # Light sensors # # CONFIG_SENSORS_ISL29018 is not set # CONFIG_SENSORS_ISL29028 is not set # CONFIG_TSL2583 is not set # CONFIG_TSL2x7x is not set # # Magnetometer sensors # # CONFIG_SENSORS_HMC5843_I2C is not set # # Active energy metering IC # # CONFIG_ADE7854 is not set # # Resolver to digital converters # # # Triggers - standalone # CONFIG_FB_SM750=m CONFIG_FB_XGI=m # # Speakup console speech # # CONFIG_SPEAKUP is not set CONFIG_TOUCHSCREEN_SYNAPTICS_I2C_RMI4=m CONFIG_STAGING_MEDIA=y # CONFIG_STAGING_RDMA is not set # # Android # CONFIG_WIMAX_GDM72XX=y # CONFIG_WIMAX_GDM72XX_QOS is not set # CONFIG_WIMAX_GDM72XX_K_MODE is not set # CONFIG_WIMAX_GDM72XX_WIMAX2 is not set CONFIG_WIMAX_GDM72XX_USB=y # CONFIG_WIMAX_GDM72XX_SDIO is not set # CONFIG_WIMAX_GDM72XX_USB_PM is not set CONFIG_LTE_GDM724X=m CONFIG_FIREWIRE_SERIAL=m CONFIG_FWTTY_MAX_TOTAL_PORTS=64 CONFIG_FWTTY_MAX_CARD_PORTS=32 CONFIG_LUSTRE_FS=m CONFIG_LUSTRE_OBD_MAX_IOCTL_BUFFER=8192 # CONFIG_LUSTRE_DEBUG_EXPENSIVE_CHECK is not set CONFIG_LUSTRE_LLITE_LLOOP=m CONFIG_LNET=m CONFIG_LNET_MAX_PAYLOAD=1048576 # CONFIG_LNET_SELFTEST is not set CONFIG_LNET_XPRT_IB=m # CONFIG_DGNC is not set # CONFIG_DGAP is not set # CONFIG_GS_FPGABOOT is not set # CONFIG_CRYPTO_SKEIN is not set CONFIG_UNISYSSPAR=y # CONFIG_UNISYS_VISORBUS is not set CONFIG_WILC1000=y CONFIG_WILC1000_SDIO=y # CONFIG_WILC1000_HW_OOB_INTR is not set # CONFIG_MOST is not set CONFIG_X86_PLATFORM_DEVICES=y CONFIG_ACERHDF=y # CONFIG_ASUS_LAPTOP is not set # CONFIG_DELL_SMO8800 is not set CONFIG_DELL_RBTN=y # CONFIG_FUJITSU_LAPTOP is not set # CONFIG_FUJITSU_TABLET is not set # CONFIG_AMILO_RFKILL is not set CONFIG_HP_ACCEL=y CONFIG_HP_WIRELESS=y # CONFIG_MSI_LAPTOP is not set # CONFIG_PANASONIC_LAPTOP is not set # CONFIG_COMPAL_LAPTOP is not set # CONFIG_SONY_LAPTOP is not set # CONFIG_IDEAPAD_LAPTOP is not set # CONFIG_THINKPAD_ACPI is not set # CONFIG_SENSORS_HDAPS is not set # CONFIG_INTEL_MENLOW is not set CONFIG_EEEPC_LAPTOP=y CONFIG_ASUS_WIRELESS=y # CONFIG_ACPI_WMI is not set # CONFIG_TOPSTAR_LAPTOP is not set CONFIG_TOSHIBA_BT_RFKILL=y # CONFIG_TOSHIBA_HAPS is not set # CONFIG_ACPI_CMPC is not set CONFIG_INTEL_HID_EVENT=y CONFIG_INTEL_SCU_IPC=y CONFIG_INTEL_SCU_IPC_UTIL=y CONFIG_INTEL_MID_POWER_BUTTON=y # CONFIG_INTEL_MFLD_THERMAL is not set # CONFIG_INTEL_IPS is not set # CONFIG_IBM_RTL is not set # CONFIG_SAMSUNG_LAPTOP is not set # CONFIG_INTEL_OAKTRAIL is not set # CONFIG_SAMSUNG_Q10 is not set # CONFIG_APPLE_GMUX is not set CONFIG_INTEL_RST=y # CONFIG_INTEL_SMARTCONNECT is not set # CONFIG_PVPANIC is not set # CONFIG_INTEL_PMC_IPC is not set # CONFIG_SURFACE_PRO3_BUTTON is not set CONFIG_INTEL_PUNIT_IPC=y CONFIG_CHROME_PLATFORMS=y CONFIG_CHROMEOS_LAPTOP=y CONFIG_CHROMEOS_PSTORE=y CONFIG_CROS_EC_CHARDEV=y CONFIG_CROS_EC_LPC=y CONFIG_CROS_EC_PROTO=y # # Hardware Spinlock drivers # # # Clock Source drivers # CONFIG_CLKEVT_I8253=y CONFIG_I8253_LOCK=y CONFIG_CLKBLD_I8253=y CONFIG_DW_APB_TIMER=y # CONFIG_ATMEL_PIT is not set # CONFIG_SH_TIMER_CMT is not set # CONFIG_SH_TIMER_MTU2 is not set # CONFIG_SH_TIMER_TMU is not set # CONFIG_EM_TIMER_STI is not set CONFIG_MAILBOX=y CONFIG_PCC=y CONFIG_ALTERA_MBOX=y CONFIG_IOMMU_API=y CONFIG_IOMMU_SUPPORT=y # # Generic IOMMU Pagetable Support # CONFIG_IOMMU_IOVA=y CONFIG_AMD_IOMMU=y CONFIG_AMD_IOMMU_STATS=y # CONFIG_AMD_IOMMU_V2 is not set CONFIG_DMAR_TABLE=y CONFIG_INTEL_IOMMU=y # CONFIG_INTEL_IOMMU_SVM is not set # CONFIG_INTEL_IOMMU_DEFAULT_ON is not set CONFIG_INTEL_IOMMU_FLOPPY_WA=y # CONFIG_IRQ_REMAP is not set # # Remoteproc drivers # # CONFIG_STE_MODEM_RPROC is not set # # Rpmsg drivers # # # SOC (System On Chip) specific Drivers # # CONFIG_SUNXI_SRAM is not set # CONFIG_SOC_TI is not set # CONFIG_PM_DEVFREQ is not set # CONFIG_EXTCON is not set # CONFIG_MEMORY is not set CONFIG_IIO=y CONFIG_IIO_BUFFER=y CONFIG_IIO_BUFFER_CB=y CONFIG_IIO_KFIFO_BUF=y CONFIG_IIO_CONFIGFS=y # CONFIG_IIO_TRIGGER is not set CONFIG_IIO_SW_TRIGGER=y # # Accelerometers # # CONFIG_BMA180 is not set # CONFIG_BMC150_ACCEL is not set # CONFIG_IIO_ST_ACCEL_3AXIS is not set # CONFIG_KXCJK1013 is not set # CONFIG_MMA7455_I2C is not set # CONFIG_MMA8452 is not set # CONFIG_MMA9551 is not set # CONFIG_MMA9553 is not set # CONFIG_MXC4005 is not set # CONFIG_MXC6255 is not set # CONFIG_STK8312 is not set # # Analog to digital converters # # CONFIG_AD7291 is not set # CONFIG_AD799X is not set # CONFIG_AXP288_ADC is not set # CONFIG_INA2XX_ADC is not set # CONFIG_MAX1363 is not set # CONFIG_MCP3422 is not set # CONFIG_MEN_Z188_ADC is not set # CONFIG_NAU7802 is not set # CONFIG_TI_ADC081C is not set # # Amplifiers # # # Chemical Sensors # # CONFIG_IAQCORE is not set # CONFIG_VZ89X is not set # # Hid Sensor IIO Common # # # SSP Sensor Common # # # Digital to analog converters # # CONFIG_AD5064 is not set # CONFIG_AD5380 is not set # CONFIG_AD5446 is not set # CONFIG_M62332 is not set # CONFIG_MAX517 is not set # CONFIG_MCP4725 is not set # # IIO dummy driver # # CONFIG_IIO_SIMPLE_DUMMY is not set # # Frequency Synthesizers DDS/PLL # # # Clock Generator/Distribution # # # Phase-Locked Loop (PLL) frequency synthesizers # # # Digital gyroscope sensors # # CONFIG_BMG160 is not set # CONFIG_IIO_ST_GYRO_3AXIS is not set # CONFIG_ITG3200 is not set # # Health sensors # # CONFIG_MAX30100 is not set # # Humidity sensors # # CONFIG_HDC100X is not set # CONFIG_HTU21 is not set # CONFIG_SI7005 is not set # CONFIG_SI7020 is not set # # Inertial measurement units # # CONFIG_KMX61 is not set # # Light sensors # # CONFIG_ACPI_ALS is not set # CONFIG_ADJD_S311 is not set # CONFIG_AL3320A is not set # CONFIG_APDS9300 is not set # CONFIG_APDS9960 is not set # CONFIG_BH1750 is not set # CONFIG_CM32181 is not set # CONFIG_CM3232 is not set # CONFIG_CM3323 is not set # CONFIG_CM36651 is not set # CONFIG_GP2AP020A00F is not set # CONFIG_ISL29125 is not set # CONFIG_JSA1212 is not set # CONFIG_RPR0521 is not set # CONFIG_LTR501 is not set # CONFIG_OPT3001 is not set # CONFIG_PA12203001 is not set # CONFIG_STK3310 is not set # CONFIG_TCS3414 is not set # CONFIG_TCS3472 is not set # CONFIG_SENSORS_TSL2563 is not set # CONFIG_TSL4531 is not set # CONFIG_US5182D is not set # CONFIG_VCNL4000 is not set # # Magnetometer sensors # # CONFIG_BMC150_MAGN is not set # CONFIG_MAG3110 is not set # CONFIG_MMC35240 is not set # CONFIG_IIO_ST_MAGN_3AXIS is not set # # Inclinometer sensors # # # Digital potentiometers # # CONFIG_MCP4531 is not set # # Pressure sensors # # CONFIG_BMP280 is not set # CONFIG_MPL115 is not set # CONFIG_MPL3115 is not set # CONFIG_MS5611 is not set # CONFIG_MS5637 is not set # CONFIG_IIO_ST_PRESS is not set # CONFIG_T5403 is not set # # Lightning sensors # # # Proximity sensors # # CONFIG_LIDAR_LITE_V2 is not set # CONFIG_SX9500 is not set # # Temperature sensors # # CONFIG_MLX90614 is not set # CONFIG_TMP006 is not set # CONFIG_TSYS01 is not set # CONFIG_TSYS02D is not set CONFIG_NTB=y # CONFIG_NTB_AMD is not set CONFIG_NTB_INTEL=y # CONFIG_NTB_PINGPONG is not set # CONFIG_NTB_TOOL is not set # CONFIG_NTB_PERF is not set CONFIG_NTB_TRANSPORT=y CONFIG_VME_BUS=y # # VME Bridge Drivers # CONFIG_VME_CA91CX42=y CONFIG_VME_TSI148=y # # VME Board Drivers # # CONFIG_VMIVME_7805 is not set # # VME Device Drivers # # CONFIG_VME_USER is not set CONFIG_PWM=y CONFIG_PWM_SYSFS=y CONFIG_PWM_LPSS=y CONFIG_PWM_LPSS_PCI=y CONFIG_PWM_LPSS_PLATFORM=y CONFIG_PWM_PCA9685=y CONFIG_ARM_GIC_MAX_NR=1 # CONFIG_TS4800_IRQ is not set # CONFIG_IPACK_BUS is not set # CONFIG_RESET_CONTROLLER is not set # CONFIG_FMC is not set # # PHY Subsystem # CONFIG_GENERIC_PHY=y # CONFIG_PHY_PXA_28NM_HSIC is not set # CONFIG_PHY_PXA_28NM_USB2 is not set # CONFIG_BCM_KONA_USB2_PHY is not set CONFIG_POWERCAP=y CONFIG_INTEL_RAPL=y CONFIG_MCB=y CONFIG_MCB_PCI=y # # Performance monitor support # CONFIG_RAS=y # CONFIG_AMD_MCE_INJ is not set # CONFIG_THUNDERBOLT is not set # # Android # # CONFIG_ANDROID is not set CONFIG_LIBNVDIMM=y CONFIG_BLK_DEV_PMEM=y CONFIG_ND_BLK=y CONFIG_ND_CLAIM=y CONFIG_ND_BTT=y CONFIG_BTT=y CONFIG_NVMEM=y # CONFIG_STM is not set # CONFIG_STM_DUMMY is not set # CONFIG_STM_SOURCE_CONSOLE is not set # CONFIG_INTEL_TH is not set # # FPGA Configuration Support # # CONFIG_FPGA is not set # # Firmware Drivers # # CONFIG_EDD is not set CONFIG_FIRMWARE_MEMMAP=y # CONFIG_DELL_RBU is not set # CONFIG_DCDBAS is not set CONFIG_DMIID=y # CONFIG_DMI_SYSFS is not set CONFIG_DMI_SCAN_MACHINE_NON_EFI_FALLBACK=y # CONFIG_ISCSI_IBFT_FIND is not set # CONFIG_GOOGLE_FIRMWARE is not set # # EFI (Extensible Firmware Interface) Support # CONFIG_EFI_VARS=y CONFIG_EFI_ESRT=y CONFIG_EFI_VARS_PSTORE=y CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE=y CONFIG_EFI_RUNTIME_MAP=y # CONFIG_EFI_FAKE_MEMMAP is not set CONFIG_EFI_RUNTIME_WRAPPERS=y # # File systems # CONFIG_DCACHE_WORD_ACCESS=y CONFIG_EXT2_FS=y CONFIG_EXT2_FS_XATTR=y CONFIG_EXT2_FS_POSIX_ACL=y CONFIG_EXT2_FS_SECURITY=y CONFIG_EXT3_FS=y CONFIG_EXT3_FS_POSIX_ACL=y CONFIG_EXT3_FS_SECURITY=y CONFIG_EXT4_FS=y CONFIG_EXT4_FS_POSIX_ACL=y CONFIG_EXT4_FS_SECURITY=y CONFIG_EXT4_ENCRYPTION=y CONFIG_EXT4_FS_ENCRYPTION=y CONFIG_EXT4_DEBUG=y CONFIG_JBD2=y CONFIG_JBD2_DEBUG=y CONFIG_FS_MBCACHE=y CONFIG_REISERFS_FS=y CONFIG_REISERFS_CHECK=y CONFIG_REISERFS_PROC_INFO=y CONFIG_REISERFS_FS_XATTR=y CONFIG_REISERFS_FS_POSIX_ACL=y CONFIG_REISERFS_FS_SECURITY=y CONFIG_JFS_FS=y CONFIG_JFS_POSIX_ACL=y CONFIG_JFS_SECURITY=y CONFIG_JFS_DEBUG=y CONFIG_JFS_STATISTICS=y CONFIG_XFS_FS=y CONFIG_XFS_QUOTA=y CONFIG_XFS_POSIX_ACL=y CONFIG_XFS_RT=y CONFIG_XFS_DEBUG=y CONFIG_GFS2_FS=y CONFIG_OCFS2_FS=m CONFIG_OCFS2_FS_O2CB=m CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m CONFIG_OCFS2_FS_STATS=y CONFIG_OCFS2_DEBUG_MASKLOG=y CONFIG_OCFS2_DEBUG_FS=y CONFIG_BTRFS_FS=y CONFIG_BTRFS_FS_POSIX_ACL=y CONFIG_BTRFS_FS_CHECK_INTEGRITY=y # CONFIG_BTRFS_FS_RUN_SANITY_TESTS is not set CONFIG_BTRFS_DEBUG=y CONFIG_BTRFS_ASSERT=y CONFIG_NILFS2_FS=y CONFIG_F2FS_FS=y CONFIG_F2FS_STAT_FS=y CONFIG_F2FS_FS_XATTR=y CONFIG_F2FS_FS_POSIX_ACL=y CONFIG_F2FS_FS_SECURITY=y CONFIG_F2FS_CHECK_FS=y CONFIG_F2FS_FS_ENCRYPTION=y CONFIG_FS_DAX=y CONFIG_FS_POSIX_ACL=y CONFIG_EXPORTFS=y CONFIG_FILE_LOCKING=y CONFIG_MANDATORY_FILE_LOCKING=y CONFIG_FSNOTIFY=y CONFIG_DNOTIFY=y CONFIG_INOTIFY_USER=y CONFIG_FANOTIFY=y CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y CONFIG_QUOTA=y CONFIG_QUOTA_NETLINK_INTERFACE=y # CONFIG_PRINT_QUOTA_WARNING is not set CONFIG_QUOTA_DEBUG=y CONFIG_QUOTA_TREE=y # CONFIG_QFMT_V1 is not set CONFIG_QFMT_V2=y CONFIG_QUOTACTL=y CONFIG_QUOTACTL_COMPAT=y CONFIG_AUTOFS4_FS=y CONFIG_FUSE_FS=y CONFIG_CUSE=y CONFIG_OVERLAY_FS=y # # Caches # CONFIG_FSCACHE=y CONFIG_FSCACHE_STATS=y CONFIG_FSCACHE_HISTOGRAM=y CONFIG_FSCACHE_DEBUG=y CONFIG_FSCACHE_OBJECT_LIST=y CONFIG_CACHEFILES=y CONFIG_CACHEFILES_DEBUG=y CONFIG_CACHEFILES_HISTOGRAM=y # # CD-ROM/DVD Filesystems # CONFIG_ISO9660_FS=y CONFIG_JOLIET=y CONFIG_ZISOFS=y # CONFIG_UDF_FS is not set # # DOS/FAT/NT Filesystems # CONFIG_FAT_FS=y CONFIG_MSDOS_FS=y CONFIG_VFAT_FS=y CONFIG_FAT_DEFAULT_CODEPAGE=437 CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1" CONFIG_NTFS_FS=y CONFIG_NTFS_DEBUG=y CONFIG_NTFS_RW=y # # Pseudo filesystems # CONFIG_PROC_FS=y CONFIG_PROC_KCORE=y CONFIG_PROC_VMCORE=y CONFIG_PROC_SYSCTL=y CONFIG_PROC_PAGE_MONITOR=y CONFIG_PROC_CHILDREN=y CONFIG_KERNFS=y CONFIG_SYSFS=y CONFIG_TMPFS=y CONFIG_TMPFS_POSIX_ACL=y CONFIG_TMPFS_XATTR=y CONFIG_HUGETLBFS=y CONFIG_HUGETLB_PAGE=y CONFIG_CONFIGFS_FS=y CONFIG_EFIVAR_FS=m CONFIG_MISC_FILESYSTEMS=y CONFIG_ADFS_FS=y CONFIG_ADFS_FS_RW=y CONFIG_AFFS_FS=y CONFIG_ECRYPT_FS=y CONFIG_ECRYPT_FS_MESSAGING=y CONFIG_HFS_FS=y CONFIG_HFSPLUS_FS=y CONFIG_HFSPLUS_FS_POSIX_ACL=y CONFIG_BEFS_FS=y CONFIG_BEFS_DEBUG=y CONFIG_BFS_FS=y CONFIG_EFS_FS=y # CONFIG_JFFS2_FS is not set CONFIG_LOGFS=y # CONFIG_CRAMFS is not set CONFIG_SQUASHFS=y CONFIG_SQUASHFS_FILE_CACHE=y # CONFIG_SQUASHFS_FILE_DIRECT is not set CONFIG_SQUASHFS_DECOMP_SINGLE=y # CONFIG_SQUASHFS_DECOMP_MULTI is not set # CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU is not set CONFIG_SQUASHFS_XATTR=y CONFIG_SQUASHFS_ZLIB=y CONFIG_SQUASHFS_LZ4=y CONFIG_SQUASHFS_LZO=y CONFIG_SQUASHFS_XZ=y CONFIG_SQUASHFS_4K_DEVBLK_SIZE=y CONFIG_SQUASHFS_EMBEDDED=y CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3 CONFIG_VXFS_FS=y CONFIG_MINIX_FS=y CONFIG_OMFS_FS=y CONFIG_HPFS_FS=y CONFIG_QNX4FS_FS=y CONFIG_QNX6FS_FS=y CONFIG_QNX6FS_DEBUG=y CONFIG_ROMFS_FS=y CONFIG_ROMFS_BACKED_BY_BLOCK=y # CONFIG_ROMFS_BACKED_BY_MTD is not set # CONFIG_ROMFS_BACKED_BY_BOTH is not set CONFIG_ROMFS_ON_BLOCK=y CONFIG_PSTORE=y CONFIG_PSTORE_CONSOLE=y CONFIG_PSTORE_PMSG=y CONFIG_PSTORE_RAM=y CONFIG_SYSV_FS=y CONFIG_UFS_FS=y CONFIG_UFS_FS_WRITE=y CONFIG_UFS_DEBUG=y CONFIG_NETWORK_FILESYSTEMS=y CONFIG_NFS_FS=y CONFIG_NFS_V2=y CONFIG_NFS_V3=y CONFIG_NFS_V3_ACL=y CONFIG_NFS_V4=y CONFIG_NFS_SWAP=y CONFIG_NFS_V4_1=y CONFIG_NFS_V4_2=y CONFIG_PNFS_FILE_LAYOUT=y CONFIG_PNFS_BLOCK=y CONFIG_PNFS_FLEXFILE_LAYOUT=m CONFIG_NFS_V4_1_IMPLEMENTATION_ID_DOMAIN="y" CONFIG_NFS_V4_1_MIGRATION=y CONFIG_NFS_V4_SECURITY_LABEL=y CONFIG_ROOT_NFS=y CONFIG_NFS_FSCACHE=y # CONFIG_NFS_USE_LEGACY_DNS is not set CONFIG_NFS_USE_KERNEL_DNS=y CONFIG_NFS_DEBUG=y # CONFIG_NFSD is not set CONFIG_GRACE_PERIOD=y CONFIG_LOCKD=y CONFIG_LOCKD_V4=y CONFIG_NFS_ACL_SUPPORT=y CONFIG_NFS_COMMON=y CONFIG_SUNRPC=y CONFIG_SUNRPC_GSS=y CONFIG_SUNRPC_BACKCHANNEL=y CONFIG_SUNRPC_SWAP=y CONFIG_RPCSEC_GSS_KRB5=y CONFIG_SUNRPC_DEBUG=y CONFIG_SUNRPC_XPRT_RDMA=y CONFIG_CEPH_FS=y CONFIG_CEPH_FSCACHE=y CONFIG_CEPH_FS_POSIX_ACL=y CONFIG_CIFS=y CONFIG_CIFS_STATS=y CONFIG_CIFS_STATS2=y CONFIG_CIFS_WEAK_PW_HASH=y CONFIG_CIFS_UPCALL=y CONFIG_CIFS_XATTR=y CONFIG_CIFS_POSIX=y CONFIG_CIFS_ACL=y CONFIG_CIFS_DEBUG=y CONFIG_CIFS_DEBUG2=y CONFIG_CIFS_DFS_UPCALL=y CONFIG_CIFS_SMB2=y CONFIG_CIFS_SMB311=y CONFIG_CIFS_FSCACHE=y CONFIG_NCP_FS=y CONFIG_NCPFS_PACKET_SIGNING=y CONFIG_NCPFS_IOCTL_LOCKING=y CONFIG_NCPFS_STRONG=y CONFIG_NCPFS_NFS_NS=y CONFIG_NCPFS_OS2_NS=y CONFIG_NCPFS_SMALLDOS=y CONFIG_NCPFS_NLS=y CONFIG_NCPFS_EXTRAS=y CONFIG_CODA_FS=y CONFIG_AFS_FS=y CONFIG_AFS_DEBUG=y CONFIG_AFS_FSCACHE=y CONFIG_9P_FS=y CONFIG_9P_FSCACHE=y # CONFIG_9P_FS_POSIX_ACL is not set # CONFIG_9P_FS_SECURITY is not set CONFIG_NLS=y CONFIG_NLS_DEFAULT="utf8" CONFIG_NLS_CODEPAGE_437=y # CONFIG_NLS_CODEPAGE_737 is not set # CONFIG_NLS_CODEPAGE_775 is not set # CONFIG_NLS_CODEPAGE_850 is not set # CONFIG_NLS_CODEPAGE_852 is not set # CONFIG_NLS_CODEPAGE_855 is not set # CONFIG_NLS_CODEPAGE_857 is not set # CONFIG_NLS_CODEPAGE_860 is not set # CONFIG_NLS_CODEPAGE_861 is not set # CONFIG_NLS_CODEPAGE_862 is not set # CONFIG_NLS_CODEPAGE_863 is not set # CONFIG_NLS_CODEPAGE_864 is not set # CONFIG_NLS_CODEPAGE_865 is not set # CONFIG_NLS_CODEPAGE_866 is not set # CONFIG_NLS_CODEPAGE_869 is not set # CONFIG_NLS_CODEPAGE_936 is not set # CONFIG_NLS_CODEPAGE_950 is not set # CONFIG_NLS_CODEPAGE_932 is not set # CONFIG_NLS_CODEPAGE_949 is not set # CONFIG_NLS_CODEPAGE_874 is not set # CONFIG_NLS_ISO8859_8 is not set # CONFIG_NLS_CODEPAGE_1250 is not set # CONFIG_NLS_CODEPAGE_1251 is not set CONFIG_NLS_ASCII=y CONFIG_NLS_ISO8859_1=y # CONFIG_NLS_ISO8859_2 is not set # CONFIG_NLS_ISO8859_3 is not set # CONFIG_NLS_ISO8859_4 is not set # CONFIG_NLS_ISO8859_5 is not set # CONFIG_NLS_ISO8859_6 is not set # CONFIG_NLS_ISO8859_7 is not set # CONFIG_NLS_ISO8859_9 is not set # CONFIG_NLS_ISO8859_13 is not set # CONFIG_NLS_ISO8859_14 is not set # CONFIG_NLS_ISO8859_15 is not set # CONFIG_NLS_KOI8_R is not set # CONFIG_NLS_KOI8_U is not set # CONFIG_NLS_MAC_ROMAN is not set # CONFIG_NLS_MAC_CELTIC is not set # CONFIG_NLS_MAC_CENTEURO is not set # CONFIG_NLS_MAC_CROATIAN is not set # CONFIG_NLS_MAC_CYRILLIC is not set # CONFIG_NLS_MAC_GAELIC is not set # CONFIG_NLS_MAC_GREEK is not set # CONFIG_NLS_MAC_ICELAND is not set # CONFIG_NLS_MAC_INUIT is not set # CONFIG_NLS_MAC_ROMANIAN is not set # CONFIG_NLS_MAC_TURKISH is not set CONFIG_NLS_UTF8=y CONFIG_DLM=m CONFIG_DLM_DEBUG=y # # Kernel hacking # CONFIG_TRACE_IRQFLAGS_SUPPORT=y # # printk and dmesg options # CONFIG_PRINTK_TIME=y CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4 # CONFIG_BOOT_PRINTK_DELAY is not set CONFIG_DYNAMIC_DEBUG=y # # Compile-time checks and compiler options # CONFIG_DEBUG_INFO=y # CONFIG_DEBUG_INFO_REDUCED is not set # CONFIG_DEBUG_INFO_SPLIT is not set # CONFIG_DEBUG_INFO_DWARF4 is not set # CONFIG_GDB_SCRIPTS is not set # CONFIG_ENABLE_WARN_DEPRECATED is not set CONFIG_ENABLE_MUST_CHECK=y CONFIG_FRAME_WARN=2048 # CONFIG_STRIP_ASM_SYMS is not set # CONFIG_READABLE_ASM is not set # CONFIG_UNUSED_SYMBOLS is not set # CONFIG_PAGE_OWNER is not set CONFIG_DEBUG_FS=y # CONFIG_HEADERS_CHECK is not set # CONFIG_DEBUG_SECTION_MISMATCH is not set CONFIG_SECTION_MISMATCH_WARN_ONLY=y CONFIG_ARCH_WANT_FRAME_POINTERS=y CONFIG_FRAME_POINTER=y # CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set CONFIG_MAGIC_SYSRQ=y CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1 CONFIG_DEBUG_KERNEL=y # # Memory Debugging # CONFIG_PAGE_EXTENSION=y CONFIG_DEBUG_PAGEALLOC=y # CONFIG_DEBUG_OBJECTS is not set CONFIG_SLUB_DEBUG_ON=y # CONFIG_SLUB_STATS is not set CONFIG_HAVE_DEBUG_KMEMLEAK=y CONFIG_DEBUG_KMEMLEAK=y CONFIG_DEBUG_KMEMLEAK_EARLY_LOG_SIZE=16384 # CONFIG_DEBUG_KMEMLEAK_TEST is not set # CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF is not set CONFIG_DEBUG_STACK_USAGE=y CONFIG_DEBUG_VM=y CONFIG_DEBUG_VM_VMACACHE=y CONFIG_DEBUG_VM_RB=y CONFIG_DEBUG_VM_PGFLAGS=y CONFIG_DEBUG_VIRTUAL=y # CONFIG_DEBUG_MEMORY_INIT is not set CONFIG_DEBUG_PER_CPU_MAPS=y CONFIG_HAVE_DEBUG_STACKOVERFLOW=y CONFIG_DEBUG_STACKOVERFLOW=y CONFIG_HAVE_ARCH_KMEMCHECK=y # CONFIG_KMEMCHECK is not set CONFIG_HAVE_ARCH_KASAN=y CONFIG_KASAN=y # CONFIG_KASAN_OUTLINE is not set CONFIG_KASAN_INLINE=y # CONFIG_TEST_KASAN is not set CONFIG_ARCH_HAS_KCOV=y CONFIG_KCOV=y CONFIG_DEBUG_SHIRQ=y # # Debug Lockups and Hangs # # CONFIG_LOCKUP_DETECTOR is not set # CONFIG_DETECT_HUNG_TASK is not set CONFIG_WQ_WATCHDOG=y # CONFIG_PANIC_ON_OOPS is not set CONFIG_PANIC_ON_OOPS_VALUE=0 CONFIG_PANIC_TIMEOUT=0 CONFIG_SCHED_DEBUG=y CONFIG_SCHED_INFO=y CONFIG_SCHEDSTATS=y CONFIG_SCHED_STACK_END_CHECK=y CONFIG_DEBUG_TIMEKEEPING=y CONFIG_TIMER_STATS=y # # Lock Debugging (spinlocks, mutexes, etc...) # # CONFIG_DEBUG_RT_MUTEXES is not set CONFIG_DEBUG_SPINLOCK=y CONFIG_DEBUG_MUTEXES=y # CONFIG_DEBUG_WW_MUTEX_SLOWPATH is not set CONFIG_DEBUG_LOCK_ALLOC=y CONFIG_PROVE_LOCKING=y CONFIG_LOCKDEP=y # CONFIG_LOCK_STAT is not set CONFIG_DEBUG_LOCKDEP=y CONFIG_DEBUG_ATOMIC_SLEEP=y # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set # CONFIG_LOCK_TORTURE_TEST is not set CONFIG_TRACE_IRQFLAGS=y CONFIG_STACKTRACE=y # CONFIG_DEBUG_KOBJECT is not set CONFIG_DEBUG_BUGVERBOSE=y CONFIG_DEBUG_LIST=y CONFIG_DEBUG_PI_LIST=y CONFIG_DEBUG_SG=y CONFIG_DEBUG_NOTIFIERS=y CONFIG_DEBUG_CREDENTIALS=y # # RCU Debugging # CONFIG_PROVE_RCU=y # CONFIG_PROVE_RCU_REPEATEDLY is not set # CONFIG_SPARSE_RCU_POINTER is not set # CONFIG_TORTURE_TEST is not set # CONFIG_RCU_TORTURE_TEST is not set CONFIG_RCU_CPU_STALL_TIMEOUT=21 # CONFIG_RCU_TRACE is not set # CONFIG_RCU_EQS_DEBUG is not set CONFIG_DEBUG_WQ_FORCE_RR_CPU=y # CONFIG_DEBUG_BLOCK_EXT_DEVT is not set # CONFIG_NOTIFIER_ERROR_INJECTION is not set # CONFIG_FAULT_INJECTION is not set # CONFIG_LATENCYTOP is not set CONFIG_ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS=y CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y CONFIG_USER_STACKTRACE_SUPPORT=y CONFIG_NOP_TRACER=y CONFIG_HAVE_FUNCTION_TRACER=y CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y CONFIG_HAVE_FUNCTION_GRAPH_FP_TEST=y CONFIG_HAVE_DYNAMIC_FTRACE=y CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y CONFIG_HAVE_SYSCALL_TRACEPOINTS=y CONFIG_HAVE_FENTRY=y CONFIG_HAVE_C_RECORDMCOUNT=y CONFIG_TRACE_CLOCK=y CONFIG_RING_BUFFER=y CONFIG_EVENT_TRACING=y CONFIG_CONTEXT_SWITCH_TRACER=y CONFIG_TRACING=y CONFIG_GENERIC_TRACER=y CONFIG_TRACING_SUPPORT=y CONFIG_FTRACE=y # CONFIG_FUNCTION_TRACER is not set # CONFIG_IRQSOFF_TRACER is not set # CONFIG_SCHED_TRACER is not set CONFIG_FTRACE_SYSCALLS=y # CONFIG_TRACER_SNAPSHOT is not set CONFIG_BRANCH_PROFILE_NONE=y # CONFIG_PROFILE_ANNOTATED_BRANCHES is not set # CONFIG_PROFILE_ALL_BRANCHES is not set # CONFIG_STACK_TRACER is not set CONFIG_BLK_DEV_IO_TRACE=y CONFIG_KPROBE_EVENT=y # CONFIG_UPROBE_EVENT is not set CONFIG_BPF_EVENTS=y CONFIG_PROBE_EVENTS=y # CONFIG_FTRACE_STARTUP_TEST is not set # CONFIG_MMIOTRACE is not set # CONFIG_TRACEPOINT_BENCHMARK is not set # CONFIG_RING_BUFFER_BENCHMARK is not set # CONFIG_RING_BUFFER_STARTUP_TEST is not set # CONFIG_TRACE_ENUM_MAP_FILE is not set # # Runtime Testing # # CONFIG_LKDTM is not set # CONFIG_TEST_LIST_SORT is not set # CONFIG_KPROBES_SANITY_TEST is not set # CONFIG_BACKTRACE_SELF_TEST is not set # CONFIG_RBTREE_TEST is not set # CONFIG_INTERVAL_TREE_TEST is not set # CONFIG_PERCPU_TEST is not set # CONFIG_ATOMIC64_SELFTEST is not set # CONFIG_TEST_HEXDUMP is not set # CONFIG_TEST_STRING_HELPERS is not set # CONFIG_TEST_KSTRTOX is not set # CONFIG_TEST_PRINTF is not set # CONFIG_TEST_RHASHTABLE is not set CONFIG_PROVIDE_OHCI1394_DMA_INIT=y CONFIG_DMA_API_DEBUG=y # CONFIG_TEST_LKM is not set # CONFIG_TEST_USER_COPY is not set # CONFIG_TEST_BPF is not set # CONFIG_TEST_FIRMWARE is not set # CONFIG_TEST_UDELAY is not set # CONFIG_MEMTEST is not set # CONFIG_TEST_STATIC_KEYS is not set # CONFIG_SAMPLES is not set CONFIG_HAVE_ARCH_KGDB=y # CONFIG_KGDB is not set CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y # CONFIG_UBSAN is not set CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED=y # CONFIG_STRICT_DEVMEM is not set CONFIG_X86_VERBOSE_BOOTUP=y CONFIG_EARLY_PRINTK=y CONFIG_EARLY_PRINTK_DBGP=y # CONFIG_EARLY_PRINTK_EFI is not set # CONFIG_X86_PTDUMP_CORE is not set # CONFIG_X86_PTDUMP is not set # CONFIG_EFI_PGT_DUMP is not set # CONFIG_DEBUG_RODATA is not set # CONFIG_DEBUG_SET_MODULE_RONX is not set # CONFIG_DEBUG_NX_TEST is not set CONFIG_DOUBLEFAULT=y CONFIG_DEBUG_TLBFLUSH=y # CONFIG_IOMMU_STRESS is not set CONFIG_HAVE_MMIOTRACE_SUPPORT=y # CONFIG_X86_DECODER_SELFTEST is not set CONFIG_IO_DELAY_TYPE_0X80=0 CONFIG_IO_DELAY_TYPE_0XED=1 CONFIG_IO_DELAY_TYPE_UDELAY=2 CONFIG_IO_DELAY_TYPE_NONE=3 CONFIG_IO_DELAY_0X80=y # CONFIG_IO_DELAY_0XED is not set # CONFIG_IO_DELAY_UDELAY is not set # CONFIG_IO_DELAY_NONE is not set CONFIG_DEFAULT_IO_DELAY_TYPE=0 CONFIG_DEBUG_BOOT_PARAMS=y CONFIG_CPA_DEBUG=y CONFIG_OPTIMIZE_INLINING=y # CONFIG_DEBUG_ENTRY is not set # CONFIG_DEBUG_NMI_SELFTEST is not set # CONFIG_X86_DEBUG_STATIC_CPU_HAS is not set CONFIG_X86_DEBUG_FPU=y CONFIG_PUNIT_ATOM_DEBUG=y # # Security options # CONFIG_KEYS=y CONFIG_PERSISTENT_KEYRINGS=y CONFIG_BIG_KEYS=y CONFIG_TRUSTED_KEYS=y CONFIG_ENCRYPTED_KEYS=y # CONFIG_SECURITY_DMESG_RESTRICT is not set CONFIG_SECURITY=y CONFIG_SECURITYFS=y CONFIG_SECURITY_NETWORK=y CONFIG_SECURITY_NETWORK_XFRM=y CONFIG_SECURITY_PATH=y # CONFIG_INTEL_TXT is not set CONFIG_LSM_MMAP_MIN_ADDR=65536 CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_SELINUX_BOOTPARAM=y CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=1 CONFIG_SECURITY_SELINUX_DISABLE=y CONFIG_SECURITY_SELINUX_DEVELOP=y CONFIG_SECURITY_SELINUX_AVC_STATS=y CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1 # CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX is not set CONFIG_SECURITY_SMACK=y CONFIG_SECURITY_SMACK_BRINGUP=y CONFIG_SECURITY_SMACK_NETFILTER=y CONFIG_SECURITY_TOMOYO=y CONFIG_SECURITY_TOMOYO_MAX_ACCEPT_ENTRY=2048 CONFIG_SECURITY_TOMOYO_MAX_AUDIT_LOG=1024 CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER=y CONFIG_SECURITY_APPARMOR=y CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1 CONFIG_SECURITY_APPARMOR_HASH=y CONFIG_SECURITY_YAMA=y CONFIG_INTEGRITY=y CONFIG_INTEGRITY_SIGNATURE=y CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y # CONFIG_INTEGRITY_TRUSTED_KEYRING is not set CONFIG_INTEGRITY_AUDIT=y CONFIG_IMA=y CONFIG_IMA_MEASURE_PCR_IDX=10 CONFIG_IMA_LSM_RULES=y # CONFIG_IMA_TEMPLATE is not set CONFIG_IMA_NG_TEMPLATE=y # CONFIG_IMA_SIG_TEMPLATE is not set CONFIG_IMA_DEFAULT_TEMPLATE="ima-ng" CONFIG_IMA_DEFAULT_HASH_SHA1=y # CONFIG_IMA_DEFAULT_HASH_SHA256 is not set # CONFIG_IMA_DEFAULT_HASH_SHA512 is not set # CONFIG_IMA_DEFAULT_HASH_WP512 is not set CONFIG_IMA_DEFAULT_HASH="sha1" # CONFIG_IMA_WRITE_POLICY is not set CONFIG_IMA_READ_POLICY=y # CONFIG_IMA_APPRAISE is not set CONFIG_EVM=y CONFIG_EVM_ATTR_FSUUID=y # CONFIG_EVM_EXTRA_SMACK_XATTRS is not set # CONFIG_DEFAULT_SECURITY_SELINUX is not set # CONFIG_DEFAULT_SECURITY_SMACK is not set # CONFIG_DEFAULT_SECURITY_TOMOYO is not set CONFIG_DEFAULT_SECURITY_APPARMOR=y # CONFIG_DEFAULT_SECURITY_DAC is not set CONFIG_DEFAULT_SECURITY="apparmor" CONFIG_XOR_BLOCKS=y CONFIG_CRYPTO=y # # Crypto core or helper # CONFIG_CRYPTO_ALGAPI=y CONFIG_CRYPTO_ALGAPI2=y CONFIG_CRYPTO_AEAD=y CONFIG_CRYPTO_AEAD2=y CONFIG_CRYPTO_BLKCIPHER=y CONFIG_CRYPTO_BLKCIPHER2=y CONFIG_CRYPTO_HASH=y CONFIG_CRYPTO_HASH2=y CONFIG_CRYPTO_RNG=y CONFIG_CRYPTO_RNG2=y CONFIG_CRYPTO_RNG_DEFAULT=y CONFIG_CRYPTO_PCOMP=y CONFIG_CRYPTO_PCOMP2=y CONFIG_CRYPTO_AKCIPHER2=y CONFIG_CRYPTO_AKCIPHER=y CONFIG_CRYPTO_RSA=y CONFIG_CRYPTO_MANAGER=y CONFIG_CRYPTO_MANAGER2=y CONFIG_CRYPTO_USER=y # CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set CONFIG_CRYPTO_GF128MUL=y CONFIG_CRYPTO_NULL=y CONFIG_CRYPTO_NULL2=y CONFIG_CRYPTO_PCRYPT=y CONFIG_CRYPTO_WORKQUEUE=y CONFIG_CRYPTO_CRYPTD=y CONFIG_CRYPTO_MCRYPTD=y CONFIG_CRYPTO_AUTHENC=y # CONFIG_CRYPTO_TEST is not set CONFIG_CRYPTO_ABLK_HELPER=y CONFIG_CRYPTO_GLUE_HELPER_X86=y # # Authenticated Encryption with Associated Data # CONFIG_CRYPTO_CCM=y CONFIG_CRYPTO_GCM=y CONFIG_CRYPTO_CHACHA20POLY1305=y CONFIG_CRYPTO_SEQIV=y CONFIG_CRYPTO_ECHAINIV=y # # Block modes # CONFIG_CRYPTO_CBC=y CONFIG_CRYPTO_CTR=y CONFIG_CRYPTO_CTS=y CONFIG_CRYPTO_ECB=y CONFIG_CRYPTO_LRW=y CONFIG_CRYPTO_PCBC=y CONFIG_CRYPTO_XTS=y CONFIG_CRYPTO_KEYWRAP=y # # Hash modes # CONFIG_CRYPTO_CMAC=y CONFIG_CRYPTO_HMAC=y CONFIG_CRYPTO_XCBC=y CONFIG_CRYPTO_VMAC=y # # Digest # CONFIG_CRYPTO_CRC32C=y CONFIG_CRYPTO_CRC32C_INTEL=y CONFIG_CRYPTO_CRC32=y CONFIG_CRYPTO_CRC32_PCLMUL=y CONFIG_CRYPTO_CRCT10DIF=y CONFIG_CRYPTO_CRCT10DIF_PCLMUL=y CONFIG_CRYPTO_GHASH=y CONFIG_CRYPTO_POLY1305=y CONFIG_CRYPTO_POLY1305_X86_64=y CONFIG_CRYPTO_MD4=y CONFIG_CRYPTO_MD5=y CONFIG_CRYPTO_MICHAEL_MIC=y CONFIG_CRYPTO_RMD128=y CONFIG_CRYPTO_RMD160=y CONFIG_CRYPTO_RMD256=y CONFIG_CRYPTO_RMD320=y CONFIG_CRYPTO_SHA1=y CONFIG_CRYPTO_SHA1_SSSE3=y CONFIG_CRYPTO_SHA256_SSSE3=y CONFIG_CRYPTO_SHA512_SSSE3=y CONFIG_CRYPTO_SHA1_MB=y CONFIG_CRYPTO_SHA256=y CONFIG_CRYPTO_SHA512=y CONFIG_CRYPTO_TGR192=y CONFIG_CRYPTO_WP512=y CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL=y # # Ciphers # CONFIG_CRYPTO_AES=y CONFIG_CRYPTO_AES_X86_64=y CONFIG_CRYPTO_AES_NI_INTEL=y CONFIG_CRYPTO_ANUBIS=y CONFIG_CRYPTO_ARC4=y CONFIG_CRYPTO_BLOWFISH=y CONFIG_CRYPTO_BLOWFISH_COMMON=y CONFIG_CRYPTO_BLOWFISH_X86_64=y CONFIG_CRYPTO_CAMELLIA=y CONFIG_CRYPTO_CAMELLIA_X86_64=y CONFIG_CRYPTO_CAMELLIA_AESNI_AVX_X86_64=y CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64=y CONFIG_CRYPTO_CAST_COMMON=y CONFIG_CRYPTO_CAST5=y CONFIG_CRYPTO_CAST5_AVX_X86_64=y CONFIG_CRYPTO_CAST6=y CONFIG_CRYPTO_CAST6_AVX_X86_64=y CONFIG_CRYPTO_DES=y CONFIG_CRYPTO_DES3_EDE_X86_64=y CONFIG_CRYPTO_FCRYPT=y CONFIG_CRYPTO_KHAZAD=y CONFIG_CRYPTO_SALSA20=y CONFIG_CRYPTO_SALSA20_X86_64=y CONFIG_CRYPTO_CHACHA20=y CONFIG_CRYPTO_CHACHA20_X86_64=y CONFIG_CRYPTO_SEED=y CONFIG_CRYPTO_SERPENT=y CONFIG_CRYPTO_SERPENT_SSE2_X86_64=y CONFIG_CRYPTO_SERPENT_AVX_X86_64=y CONFIG_CRYPTO_SERPENT_AVX2_X86_64=y CONFIG_CRYPTO_TEA=y CONFIG_CRYPTO_TWOFISH=y CONFIG_CRYPTO_TWOFISH_COMMON=y CONFIG_CRYPTO_TWOFISH_X86_64=y CONFIG_CRYPTO_TWOFISH_X86_64_3WAY=y CONFIG_CRYPTO_TWOFISH_AVX_X86_64=y # # Compression # CONFIG_CRYPTO_DEFLATE=y CONFIG_CRYPTO_ZLIB=y CONFIG_CRYPTO_LZO=y CONFIG_CRYPTO_842=y CONFIG_CRYPTO_LZ4=y CONFIG_CRYPTO_LZ4HC=y # # Random Number Generation # CONFIG_CRYPTO_ANSI_CPRNG=y CONFIG_CRYPTO_DRBG_MENU=y CONFIG_CRYPTO_DRBG_HMAC=y # CONFIG_CRYPTO_DRBG_HASH is not set # CONFIG_CRYPTO_DRBG_CTR is not set CONFIG_CRYPTO_DRBG=y CONFIG_CRYPTO_JITTERENTROPY=y CONFIG_CRYPTO_USER_API=y CONFIG_CRYPTO_USER_API_HASH=y CONFIG_CRYPTO_USER_API_SKCIPHER=y CONFIG_CRYPTO_USER_API_RNG=y CONFIG_CRYPTO_USER_API_AEAD=y CONFIG_CRYPTO_HASH_INFO=y CONFIG_CRYPTO_HW=y # CONFIG_CRYPTO_DEV_PADLOCK is not set # CONFIG_CRYPTO_DEV_CCP is not set CONFIG_CRYPTO_DEV_QAT=y # CONFIG_CRYPTO_DEV_QAT_DH895xCC is not set CONFIG_CRYPTO_DEV_QAT_C3XXX=y CONFIG_CRYPTO_DEV_QAT_C62X=y # CONFIG_CRYPTO_DEV_QAT_DH895xCCVF is not set CONFIG_CRYPTO_DEV_QAT_C3XXXVF=y CONFIG_CRYPTO_DEV_QAT_C62XVF=y CONFIG_ASYMMETRIC_KEY_TYPE=y CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y CONFIG_PUBLIC_KEY_ALGO_RSA=y CONFIG_X509_CERTIFICATE_PARSER=y # CONFIG_PKCS7_MESSAGE_PARSER is not set # # Certificates for signature checking # CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYS="" CONFIG_HAVE_KVM=y CONFIG_HAVE_KVM_IRQCHIP=y CONFIG_HAVE_KVM_IRQFD=y CONFIG_HAVE_KVM_IRQ_ROUTING=y CONFIG_HAVE_KVM_EVENTFD=y CONFIG_KVM_APIC_ARCHITECTURE=y CONFIG_KVM_MMIO=y CONFIG_KVM_ASYNC_PF=y CONFIG_HAVE_KVM_MSI=y CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT=y CONFIG_KVM_VFIO=y CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT=y CONFIG_KVM_COMPAT=y CONFIG_HAVE_KVM_IRQ_BYPASS=y CONFIG_VIRTUALIZATION=y CONFIG_KVM=y CONFIG_KVM_INTEL=y CONFIG_KVM_AMD=y CONFIG_KVM_MMU_AUDIT=y CONFIG_KVM_DEVICE_ASSIGNMENT=y CONFIG_BINARY_PRINTF=y # # Library routines # CONFIG_RAID6_PQ=y CONFIG_BITREVERSE=y # CONFIG_HAVE_ARCH_BITREVERSE is not set CONFIG_RATIONAL=y CONFIG_GENERIC_STRNCPY_FROM_USER=y CONFIG_GENERIC_STRNLEN_USER=y CONFIG_GENERIC_NET_UTILS=y CONFIG_GENERIC_FIND_FIRST_BIT=y CONFIG_GENERIC_PCI_IOMAP=y CONFIG_GENERIC_IOMAP=y CONFIG_GENERIC_IO=y CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y CONFIG_ARCH_HAS_FAST_MULTIPLIER=y CONFIG_CRC_CCITT=y CONFIG_CRC16=y CONFIG_CRC_T10DIF=y CONFIG_CRC_ITU_T=y CONFIG_CRC32=y # CONFIG_CRC32_SELFTEST is not set CONFIG_CRC32_SLICEBY8=y # CONFIG_CRC32_SLICEBY4 is not set # CONFIG_CRC32_SARWATE is not set # CONFIG_CRC32_BIT is not set # CONFIG_CRC7 is not set CONFIG_LIBCRC32C=y # CONFIG_CRC8 is not set # CONFIG_AUDIT_ARCH_COMPAT_GENERIC is not set # CONFIG_RANDOM32_SELFTEST is not set CONFIG_842_COMPRESS=y CONFIG_842_DECOMPRESS=y CONFIG_ZLIB_INFLATE=y CONFIG_ZLIB_DEFLATE=y CONFIG_LZO_COMPRESS=y CONFIG_LZO_DECOMPRESS=y CONFIG_LZ4_COMPRESS=y CONFIG_LZ4HC_COMPRESS=y CONFIG_LZ4_DECOMPRESS=y CONFIG_XZ_DEC=y CONFIG_XZ_DEC_X86=y CONFIG_XZ_DEC_POWERPC=y CONFIG_XZ_DEC_IA64=y CONFIG_XZ_DEC_ARM=y CONFIG_XZ_DEC_ARMTHUMB=y CONFIG_XZ_DEC_SPARC=y CONFIG_XZ_DEC_BCJ=y # CONFIG_XZ_DEC_TEST is not set CONFIG_DECOMPRESS_GZIP=y CONFIG_DECOMPRESS_BZIP2=y CONFIG_DECOMPRESS_LZMA=y CONFIG_DECOMPRESS_XZ=y CONFIG_DECOMPRESS_LZO=y CONFIG_DECOMPRESS_LZ4=y CONFIG_GENERIC_ALLOCATOR=y CONFIG_REED_SOLOMON=y CONFIG_REED_SOLOMON_ENC8=y CONFIG_REED_SOLOMON_DEC8=y CONFIG_BTREE=y CONFIG_INTERVAL_TREE=y CONFIG_ASSOCIATIVE_ARRAY=y CONFIG_HAS_IOMEM=y CONFIG_HAS_IOPORT_MAP=y CONFIG_HAS_DMA=y CONFIG_CHECK_SIGNATURE=y # CONFIG_CPUMASK_OFFSTACK is not set CONFIG_CPU_RMAP=y CONFIG_DQL=y CONFIG_GLOB=y # CONFIG_GLOB_SELFTEST is not set CONFIG_NLATTR=y CONFIG_ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE=y CONFIG_LRU_CACHE=y CONFIG_CLZ_TAB=y # CONFIG_CORDIC is not set # CONFIG_DDR is not set CONFIG_IRQ_POLL=y CONFIG_MPILIB=y CONFIG_SIGNATURE=y CONFIG_OID_REGISTRY=y CONFIG_UCS2_STRING=y CONFIG_FONT_SUPPORT=y # CONFIG_FONTS is not set CONFIG_FONT_8x8=y CONFIG_FONT_8x16=y # CONFIG_SG_SPLIT is not set CONFIG_ARCH_HAS_SG_CHAIN=y CONFIG_ARCH_HAS_PMEM_API=y CONFIG_ARCH_HAS_MMIO_FLUSH=y ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-28 15:43 ` Dmitry Vyukov @ 2016-02-28 16:04 ` Dmitry Vyukov 2016-02-28 17:01 ` Al Viro 0 siblings, 1 reply; 49+ messages in thread From: Dmitry Vyukov @ 2016-02-28 16:04 UTC (permalink / raw) To: Al Viro Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds On Sun, Feb 28, 2016 at 4:43 PM, Dmitry Vyukov <dvyukov@google.com> wrote: > On Sat, Feb 27, 2016 at 11:27 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: >> On Fri, Feb 26, 2016 at 10:07:59PM +0000, Al Viro wrote: >>> On Fri, Feb 26, 2016 at 10:25:21PM +0100, Dmitry Vyukov wrote: >>> > On Fri, Feb 26, 2016 at 10:21 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: >>> > > On Thu, Feb 25, 2016 at 04:39:27PM +0000, Al Viro wrote: >>> > >> Hrm... OK, seeing that you still seem to trigger those within an hour or >>> > >> two (and *any* of remaining WARN_ON() are serious bugs - none of the >>> > >> "mitigation had been triggered" remained, sorry for not making it clear), >>> > >> let's try this. Again, any WARN_ON triggered means that we'd caught something, >>> > >> whether it progresses into oops or not. >>> > > >>> > > Any news on that one? I'm going to carve fixes for understood bugs out of >>> > > that one and put those into tonight push, but it would be nice to sort out >>> > > all remaining crap lurking in that area... >>> > > >>> > > Another question: what about the very first trace you'd posted, with apparent >>> > > GPF at 00000050? Have you seen anything like that afterwards? >>> > >>> > No, I did not have time to retest. >>> > >>> > GPF at 00000050 was not mine, it was Mickaël's. >>> >>> Ah, OK - his is basically a forced nd->stack[] underrun, with passing a >>> never-assigned nd->link_inode to atime_needs_update(), so we are just >>> passing a contents of uninitialized stack word there and while it ends >>> up possible to dereference, it's not an address of struct inode and the >>> first attempt to follow a pointer in what would've been a struct inode >>> at that address (accessing inode->i_sb->s_flags) did blow up with GPF at >>> offsetof(struct super_block, s_flags). >>> >>> All right, so we basically have several understood ones with fixes plus >>> something unknown that leads to lookup_fast() returning 0 with NULL in >>> *inode in about an hour or two on your setup... >> >> BTW, what kind of userland are you using? The thing is, shared-subtree >> setups differ, and if the crap is anywhere near vfsmount handling, that >> could have some impact... So far I hadn't been able to trigger any of >> these WARN_ON(); setup here is debian/testing on 4-way KVM guest with 4Gb >> memory given to it running on a 6-way host (Phenom II X6 1100T, 3.3GHz, 16Gb >> RAM total); 4.2 with debian/stable userland on host. What's the setup on >> your reproducer? > > > Restarted fuzzer with the latest patch on top of > 0fcbf996d848d03573113d83f4e3fb3bcfa5ab5e. > >> All that stops these warnings from triggering atime_... oopsen is that dentry >> involved isn't a symlink one. > > What worries me is that I am running the same program in the same > setup. The program does operate on symlinks and previous it triggered > oopses. But now it does not. I've also rebased onto latest Linus tree, > maybe that made difference... > > My userspace is a Debian Wheezy built using this script: > https://github.com/google/syzkaller/blob/master/tools/create-image.sh > > I run it in qemu as: > $ qemu-system-x86_64 -hda wheezy.img -net > user,host=10.0.2.10,hostfwd=tcp::10022-:22 -net nic -nographic -kernel > arch/x86/boot/bzImage -append "console=ttyS0 root=/dev/sda debug > earlyprintk=serial slub_debug=UZ" -enable-kvm -pidfile vm_pid -m 2G > -numa node,nodeid=0,cpus=0-1 -numa node,nodeid=1,cpus=2-3 -smp > sockets=2,cores=2,threads=1 -usb -usbdevice mouse -usbdevice tablet > -soundhw all > > I also use a pretty beefy config (attached) which includes KASAN and > KCOV both of which introduce significant slowdown and can affect > thread interleavings. What was triggered so far is this. As far as I see it it roughly the same as before. [ 1422.292356] ------------[ cut here ]------------ [ 1422.292841] WARNING: CPU: 0 PID: 32603 at fs/namei.c:1587 lookup_fast+0x3fa/0x450() [ 1422.293543] Modules linked in: [ 1422.293868] CPU: 0 PID: 32603 Comm: syz-executor Not tainted 4.5.0-rc4+ #75 [ 1422.294426] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 [ 1422.294482] 0000000000000000 ffff8800148d3c48 ffffffff81931fc9 0000000000000000 [ 1422.294482] ffffffff83314939 ffff8800148d3c80 ffffffff8116eee1 ffff8800148d3de0 [ 1422.294482] ffff8800148d3d90 ffff8800148d3d98 ffff8800148d3d8c 0000000000000001 [ 1422.294482] Call Trace: [ 1422.294482] [<ffffffff81931fc9>] dump_stack+0x99/0xd0 [ 1422.294482] [<ffffffff8116eee1>] warn_slowpath_common+0x81/0xc0 [ 1422.294482] [<ffffffff8116efd5>] warn_slowpath_null+0x15/0x20 [ 1422.294482] [<ffffffff8130e89a>] lookup_fast+0x3fa/0x450 [ 1422.294482] [<ffffffff8130f388>] ? link_path_walk+0x68/0x4e0 [ 1422.294482] [<ffffffff8130fe66>] ? path_init+0x666/0x810 [ 1422.294482] [<ffffffff81310775>] path_openat+0x375/0x1520 [ 1422.294482] [<ffffffff811c780d>] ? trace_hardirqs_on+0xd/0x10 [ 1422.294482] [<ffffffff81313129>] do_filp_open+0x79/0xd0 [ 1422.294482] [<ffffffff82ae3022>] ? _raw_spin_unlock+0x22/0x30 [ 1422.294482] [<ffffffff81322af8>] ? __alloc_fd+0xf8/0x200 [ 1422.294482] [<ffffffff81300c10>] do_sys_open+0x110/0x1f0 [ 1422.294482] [<ffffffff81300d1f>] SyS_openat+0xf/0x20 [ 1422.294482] [<ffffffff82ae3ab6>] entry_SYSCALL_64_fastpath+0x16/0x7a [ 1422.304062] ---[ end trace 658f7fb8fc01ebf0 ]--- [ 1422.304425] ------------[ cut here ]------------ [ 1422.304842] WARNING: CPU: 0 PID: 32603 at fs/namei.c:3124 path_openat+0x12bc/0x1520() [ 1422.305551] Modules linked in: [ 1422.305803] CPU: 0 PID: 32603 Comm: syz-executor Tainted: G W 4.5.0-rc4+ #75 [ 1422.306476] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 [ 1422.306476] 0000000000000000 ffff8800148d3cb8 ffffffff81931fc9 0000000000000000 [ 1422.306476] ffffffff83314939 ffff8800148d3cf0 ffffffff8116eee1 0000000000000005 [ 1422.306476] ffff8800148d3d98 0000000000048000 ffff8800148d3de0 ffff8800148d3efc [ 1422.306476] Call Trace: [ 1422.306476] [<ffffffff81931fc9>] dump_stack+0x99/0xd0 [ 1422.306476] [<ffffffff8116eee1>] warn_slowpath_common+0x81/0xc0 [ 1422.306476] [<ffffffff8116efd5>] warn_slowpath_null+0x15/0x20 [ 1422.306476] [<ffffffff813116bc>] path_openat+0x12bc/0x1520 [ 1422.306476] [<ffffffff81313129>] do_filp_open+0x79/0xd0 [ 1422.306476] [<ffffffff82ae3022>] ? _raw_spin_unlock+0x22/0x30 [ 1422.306476] [<ffffffff81322af8>] ? __alloc_fd+0xf8/0x200 [ 1422.306476] [<ffffffff81300c10>] do_sys_open+0x110/0x1f0 [ 1422.306476] [<ffffffff81300d1f>] SyS_openat+0xf/0x20 [ 1422.306476] [<ffffffff82ae3ab6>] entry_SYSCALL_64_fastpath+0x16/0x7a [ 1422.314201] ---[ end trace 658f7fb8fc01ebf1 ]--- INIT: Id "V0" respawning too fast: disabled for 5 minutes ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-28 16:04 ` Dmitry Vyukov @ 2016-02-28 17:01 ` Al Viro 2016-02-28 20:01 ` Al Viro 0 siblings, 1 reply; 49+ messages in thread From: Al Viro @ 2016-02-28 17:01 UTC (permalink / raw) To: Dmitry Vyukov Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds, David Howells [dhowells Cc'd] On Sun, Feb 28, 2016 at 05:04:19PM +0100, Dmitry Vyukov wrote: > > [ 1422.292356] ------------[ cut here ]------------ > [ 1422.292841] WARNING: CPU: 0 PID: 32603 at fs/namei.c:1587 > lookup_fast+0x3fa/0x450() Huh? So you have dentry = __d_lookup_rcu(parent, &nd->last, &seq); returning non-NULL dentry, then *inode = d_backing_inode(dentry); negative = d_is_negative(dentry); if (read_seqcount_retry(&dentry->d_seq, seq)) return -ECHILD; followed by by *inode == NULL and negative == true? Nuts... OK, that removes vfsmounts from consideration, but... How the fuck is that possible? We have smp_rmb(); seq = &dentry->d_seq->sequence & ~1; see that ->d_name and ->d_parent match what we are looking for, then *inode = dentry->d_inode; type = READ_ONCE(dentry->d_flags); smp_rmb(); negative = (type & DCACHE_ENTRY_TYPE) == DCACHE_MISS_TYPE; smp_rmb(); if (dentry->d_seq->sequence != seq) sod off and observe *inode == NULL && !negative Erm... What's to order ->d_inode and ->d_flags fetches there? David? Looks like the barrier in d_is_negative() is on the wrong side of fetch. Confused... ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-28 17:01 ` Al Viro @ 2016-02-28 20:01 ` Al Viro 2016-02-29 9:38 ` Dmitry Vyukov ` (2 more replies) 0 siblings, 3 replies; 49+ messages in thread From: Al Viro @ 2016-02-28 20:01 UTC (permalink / raw) To: Dmitry Vyukov Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds, David Howells On Sun, Feb 28, 2016 at 05:01:34PM +0000, Al Viro wrote: > Erm... What's to order ->d_inode and ->d_flags fetches there? David? > Looks like the barrier in d_is_negative() is on the wrong side of fetch. > Confused... OK, as per David's suggestion, let's flip them around, bringing the barrier in d_is_negative() between them. Dmitry, could you try this on top of mainline? Again, it's until the first warning. diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c index c6d7d3d..86f81e3 100644 --- a/fs/autofs4/root.c +++ b/fs/autofs4/root.c @@ -323,6 +323,7 @@ static struct dentry *autofs4_mountpoint_changed(struct path *path) struct dentry *new = d_lookup(parent, &dentry->d_name); if (!new) return NULL; + WARN_ON(d_is_negative(new)); ino = autofs4_dentry_ino(new); ino->last_used = jiffies; dput(path->dentry); diff --git a/fs/namei.c b/fs/namei.c index 9c590e0..630d222 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1209,6 +1209,7 @@ static int follow_managed(struct path *path, struct nameidata *nd) /* Handle an automount point */ if (managed & DCACHE_NEED_AUTOMOUNT) { ret = follow_automount(path, nd, &need_mntput); + WARN_ON(d_is_negative(path->dentry)); if (ret < 0) break; continue; @@ -1260,6 +1261,7 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, { for (;;) { struct mount *mounted; + void *p; /* * Don't forget we might have a non-mountpoint managed dentry * that wants to block transit. @@ -1289,7 +1291,9 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, * dentry sequence number here after this d_inode read, * because a mount-point is always pinned. */ - *inode = path->dentry->d_inode; + p = *inode = path->dentry->d_inode; + if (unlikely(!p)) + WARN_ON(!read_seqretry(&mount_lock, nd->m_seq)); } return !read_seqretry(&mount_lock, nd->m_seq) && !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT); @@ -1550,8 +1554,8 @@ static int lookup_fast(struct nameidata *nd, * This sequence count validates that the inode matches * the dentry name information from lookup. */ - *inode = d_backing_inode(dentry); negative = d_is_negative(dentry); + *inode = d_backing_inode(dentry); if (read_seqcount_retry(&dentry->d_seq, seq)) return -ECHILD; @@ -1580,6 +1584,7 @@ static int lookup_fast(struct nameidata *nd, */ if (negative) return -ENOENT; + WARN_ON(!*inode); // ->d_seq was fucked somehow path->mnt = mnt; path->dentry = dentry; if (likely(__follow_mount_rcu(nd, path, inode, seqp))) @@ -1613,8 +1618,10 @@ unlazy: path->mnt = mnt; path->dentry = dentry; err = follow_managed(path, nd); - if (likely(!err)) + if (likely(!err)) { *inode = d_backing_inode(path->dentry); + WARN_ON(!*inode); + } return err; need_lookup: @@ -1717,6 +1724,7 @@ static inline int should_follow_link(struct nameidata *nd, struct path *link, if (read_seqcount_retry(&link->dentry->d_seq, seq)) return -ECHILD; } + WARN_ON(!inode); // now, _that_ should not happen. return pick_link(nd, link, inode, seq); } @@ -3111,8 +3119,10 @@ static int do_last(struct nameidata *nd, nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; /* we _can_ be in RCU mode here */ error = lookup_fast(nd, &path, &inode, &seq); - if (likely(!error)) + if (likely(!error)) { + WARN_ON(!inode); goto finish_lookup; + } if (error < 0) return error; @@ -3203,6 +3213,7 @@ retry_lookup: return -ENOENT; } inode = d_backing_inode(path.dentry); + WARN_ON(!inode); finish_lookup: if (nd->depth) put_link(nd); diff --git a/fs/namespace.c b/fs/namespace.c index 4fb1691..4128a5c 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -1060,6 +1060,8 @@ static void cleanup_mnt(struct mount *mnt) * so mnt_get_writers() below is safe. */ WARN_ON(mnt_get_writers(mnt)); + WARN_ON(!mnt->mnt.mnt_root->d_inode); // some joker has managed to + // make mnt_root negative on us if (unlikely(mnt->mnt_pins.first)) mnt_pin_kill(mnt); fsnotify_vfsmount_delete(&mnt->mnt); ^ permalink raw reply related [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-28 20:01 ` Al Viro @ 2016-02-29 9:38 ` Dmitry Vyukov 2016-02-29 12:34 ` Dmitry Vyukov 2016-02-29 13:09 ` Al Viro 2016-02-29 13:43 ` David Howells 2 siblings, 1 reply; 49+ messages in thread From: Dmitry Vyukov @ 2016-02-29 9:38 UTC (permalink / raw) To: Al Viro Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds, David Howells On Sun, Feb 28, 2016 at 9:01 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: > On Sun, Feb 28, 2016 at 05:01:34PM +0000, Al Viro wrote: > >> Erm... What's to order ->d_inode and ->d_flags fetches there? David? >> Looks like the barrier in d_is_negative() is on the wrong side of fetch. >> Confused... > > OK, as per David's suggestion, let's flip them around, bringing the > barrier in d_is_negative() between them. Dmitry, could you try this on > top of mainline? Again, it's until the first warning. Good news, I was able to trigger these warnings on a plain C program: https://gist.githubusercontent.com/dvyukov/1a81426b8a5dd3620d6f/raw/fe6d03cfb0d219ad3d979f8bd6c016a5a1b93212/gistfile1.txt Unfortunately, the failure rate is significantly lower than with syzkaller. Syzkaller triggered it 8 times in 18 hours on a single VM; while the C program triggered it once on 2 VMs. Al, maybe you can modify the program to increase failure rate? I would expect that we need to clash 2 (or maybe 3) syscalls with right timing to trigger it. You must have a better idea as to what are these syscalls. P.S. this is still with the previous patch, not the latest one. ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-29 9:38 ` Dmitry Vyukov @ 2016-02-29 12:34 ` Dmitry Vyukov 2016-02-29 16:11 ` Al Viro 0 siblings, 1 reply; 49+ messages in thread From: Dmitry Vyukov @ 2016-02-29 12:34 UTC (permalink / raw) To: Al Viro Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds, David Howells On Mon, Feb 29, 2016 at 10:38 AM, Dmitry Vyukov <dvyukov@google.com> wrote: > On Sun, Feb 28, 2016 at 9:01 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: >> On Sun, Feb 28, 2016 at 05:01:34PM +0000, Al Viro wrote: >> >>> Erm... What's to order ->d_inode and ->d_flags fetches there? David? >>> Looks like the barrier in d_is_negative() is on the wrong side of fetch. >>> Confused... >> >> OK, as per David's suggestion, let's flip them around, bringing the >> barrier in d_is_negative() between them. Dmitry, could you try this on >> top of mainline? Again, it's until the first warning. I am testing the new patch for several hours in several VMs now, I would expect a WARNING to already fire. But no warnings fired so far. I will keep it running. But meanwhile, do you an explanation of how: - *inode = d_backing_inode(dentry); negative = d_is_negative(dentry); + *inode = d_backing_inode(dentry); can fix the bug? Explanation other than a missing rmw, because I am running on x86 so I would not expect rmb to be the root cause (though, it still may be necessary for other arches and to prevent possible miscompilations). If you do have it and assuming that I will not see warnings till tomorrow, then hopefully we can consider it as fixed! It's not that I really understand what happens here, but looking at the diff: is it the case that negative and inode can change under our feet? If so, we still probably can get an inconsistent picture (i.e. negative dentry but not NULL inode), can it be an issue? Is non-negative->negative->non-negative->negative transition possible? If so, we still probably can get the same crash regardless of order of negative/inode loads. ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-29 12:34 ` Dmitry Vyukov @ 2016-02-29 16:11 ` Al Viro 0 siblings, 0 replies; 49+ messages in thread From: Al Viro @ 2016-02-29 16:11 UTC (permalink / raw) To: Dmitry Vyukov Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds, David Howells On Mon, Feb 29, 2016 at 01:34:13PM +0100, Dmitry Vyukov wrote: > It's not that I really understand what happens here, but looking at > the diff: is it the case that negative and inode can change under our > feet? If so, we still probably can get an inconsistent picture (i.e. > negative dentry but not NULL inode), can it be an issue? Is > non-negative->negative->non-negative->negative transition possible? If > so, we still probably can get the same crash regardless of order of > negative/inode loads. Yes, we can - relying on the ordering is brittle and wrong. See other posting for possible solution; at least that one has much more understandable rules: * ->d_seq is bumped before and after modifications of ->d_inode and ->d_flags, which both provides the barriers and (which is what matters for x86) guarantees that ->d_seq match on recheck (which we do anyway) means that ->d_inode and ->d_flags match each other. * RCU users of that part of ->d_flags should be verified by ->d_seq check (we already are doing that - should_follow_link() didn't and that was one of the bugs that got fixed). * non-RCU users either have the parent locked (which stabilizes everything) or have dentry pinned and positive (ditto). Checking that dentry is negative (either by looking at inode or flags) does not guarantee that it will stay such unless the parent is locked anyway. IOW, the games with barriers and order of assignments between ->d_inode and ->d_flags do not actually buy us anything useful. * in case of __dentry_kill() we do *NOT* surround the stores to ->d_inode/->d_flags with ->d_seq bumps, but that's safe since by that point we had already done __d_drop(), so RCU reader either doesn't find the dentry in the first place, or gets ->d_seq bumped (by 2) between the moment it's been fetched by __d_lookup_rcu() finding the sucker and the moment when ->d_inode/->d_flags get changed. If RCU reader gets in before that, it sees consistent ->d_inode/->d_flags, as they used to be. It will eventually fail to grab a reference to that dentry, but that's not our problem. If it gets in late enough to see ->d_inode and/or ->d_flags changed, it will fail ->d_seq check and ignore the values it has fetched. Again, no need for a barrier between ->d_inode and ->d_flags stores in that case. As the matter of fact, I'm somewhat tempted to make static void dentry_unlink_inode(struct dentry * dentry) __releases(dentry->d_lock) __releases(dentry->d_inode->i_lock) { struct inode *inode = dentry->d_inode; bool hashed = !d_unhashed(dentry); if (hashed) raw_write_seqcount_begin(&dentry->d_seq); __d_clear_type_and_inode(dentry); hlist_del_init(&dentry->d_u.d_alias); if (hashed) raw_write_seqcount_end(&dentry->d_seq); spin_unlock(&dentry->d_lock); spin_unlock(&inode->i_lock); if (!inode->i_nlink) fsnotify_inoderemove(inode); if (dentry->d_op && dentry->d_op->d_iput) dentry->d_op->d_iput(dentry, inode); else iput(inode); } and replace dentry_iput() in its only caller with if (dentry->d_inode) dentry_unlink_inode(dentry); /* will drop ->d_lock */ else spin_unlock(&dentry->d_lock); That would get rid of annoying code duplication, but I would like to see profiles - the cost of branches might very well get unpleasant. Not sure, and that part definitely isn't a -stable fodder. ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-28 20:01 ` Al Viro 2016-02-29 9:38 ` Dmitry Vyukov @ 2016-02-29 13:09 ` Al Viro 2016-02-29 15:54 ` Dmitry Vyukov 2016-02-29 16:45 ` Linus Torvalds 2016-02-29 13:43 ` David Howells 2 siblings, 2 replies; 49+ messages in thread From: Al Viro @ 2016-02-29 13:09 UTC (permalink / raw) To: Dmitry Vyukov Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds, David Howells On Sun, Feb 28, 2016 at 08:01:01PM +0000, Al Viro wrote: > On Sun, Feb 28, 2016 at 05:01:34PM +0000, Al Viro wrote: > > > Erm... What's to order ->d_inode and ->d_flags fetches there? David? > > Looks like the barrier in d_is_negative() is on the wrong side of fetch. > > Confused... > > OK, as per David's suggestion, let's flip them around, bringing the > barrier in d_is_negative() between them. Dmitry, could you try this on > top of mainline? Again, it's until the first warning. Hmm... Reordering is definitely wrong, but what I really wonder is if dentry_rcuwalk_invalidate() is right outside of __d_drop(). IOW, is it right in __d_instantiate() and dentry_unlink_inode()? The code dealing with ->d_flags in RCU mode is more interested in coherency between ->d_flags and ->d_inode and it looks like we'd need *two* increments - even-to-odd before updating both and odd-to-even after both are in sync. The more I look at the situation with d_is_...() wrt barriers and ->d_seq, the less I understand it; outside of RCU mode we don't really need the barriers for that stuff and in RCU mode ->d_flags handling had been a serious headache all along... I'm tempted to do as below; the amount of smp_wmb() remains the same and so's the amount of stores (splitting that += 2 in two doesn't affect that - we dirty the same cacheline before and after anyway). OTOH, that would mean that ->d_seq match guarantees ->d_flags and ->d_inode being in sync. And I suspect that we could drop _read_ barriers in d_is_...() after that; in non-RCU mode we don't give a damn anyway and in RCU one ->d_seq check would provide one; it doesn't really matter on x86, but smp_rmb() may be costly. Splitting ->d_seq increments *does* matter on x86 wrt correctness; in-between state becomes guaranteed ->d_seq mismatch and that just might be it. Dmitry, could you add this on top of the previous patch? David, Linus, do you see any problems with that? To me it looks saner that way and as cheap as the current code, but I might be missing something here... diff --git a/fs/dcache.c b/fs/dcache.c index 92d5140..2c08cce 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -279,7 +279,6 @@ static inline void __d_set_inode_and_type(struct dentry *dentry, unsigned flags; dentry->d_inode = inode; - smp_wmb(); flags = READ_ONCE(dentry->d_flags); flags &= ~(DCACHE_ENTRY_TYPE | DCACHE_FALLTHRU); flags |= type_flags; @@ -300,7 +299,6 @@ static inline void __d_clear_type_and_inode(struct dentry *dentry) flags &= ~(DCACHE_ENTRY_TYPE | DCACHE_FALLTHRU); WRITE_ONCE(dentry->d_flags, flags); - smp_wmb(); dentry->d_inode = NULL; } @@ -370,9 +368,11 @@ static void dentry_unlink_inode(struct dentry * dentry) __releases(dentry->d_inode->i_lock) { struct inode *inode = dentry->d_inode; + + raw_write_seqcount_begin(&dentry->d_seq); __d_clear_type_and_inode(dentry); hlist_del_init(&dentry->d_u.d_alias); - dentry_rcuwalk_invalidate(dentry); + raw_write_seqcount_end(&dentry->d_seq); spin_unlock(&dentry->d_lock); spin_unlock(&inode->i_lock); if (!inode->i_nlink) @@ -1758,8 +1758,9 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode) spin_lock(&dentry->d_lock); if (inode) hlist_add_head(&dentry->d_u.d_alias, &inode->i_dentry); + raw_write_seqcount_begin(&dentry->d_seq); __d_set_inode_and_type(dentry, inode, add_flags); - dentry_rcuwalk_invalidate(dentry); + raw_write_seqcount_end(&dentry->d_seq); spin_unlock(&dentry->d_lock); fsnotify_d_instantiate(dentry, inode); } ^ permalink raw reply related [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-29 13:09 ` Al Viro @ 2016-02-29 15:54 ` Dmitry Vyukov 2016-02-29 16:19 ` Al Viro 2016-02-29 16:45 ` Linus Torvalds 1 sibling, 1 reply; 49+ messages in thread From: Dmitry Vyukov @ 2016-02-29 15:54 UTC (permalink / raw) To: Al Viro Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds, David Howells On Mon, Feb 29, 2016 at 2:09 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: > On Sun, Feb 28, 2016 at 08:01:01PM +0000, Al Viro wrote: >> On Sun, Feb 28, 2016 at 05:01:34PM +0000, Al Viro wrote: >> >> > Erm... What's to order ->d_inode and ->d_flags fetches there? David? >> > Looks like the barrier in d_is_negative() is on the wrong side of fetch. >> > Confused... >> >> OK, as per David's suggestion, let's flip them around, bringing the >> barrier in d_is_negative() between them. Dmitry, could you try this on >> top of mainline? Again, it's until the first warning. > > Hmm... Reordering is definitely wrong, but what I really wonder is if > dentry_rcuwalk_invalidate() is right outside of __d_drop(). IOW, is > it right in __d_instantiate() and dentry_unlink_inode()? The code > dealing with ->d_flags in RCU mode is more interested in coherency between > ->d_flags and ->d_inode and it looks like we'd need *two* increments - > even-to-odd before updating both and odd-to-even after both are in sync. > The more I look at the situation with d_is_...() wrt barriers and ->d_seq, > the less I understand it; outside of RCU mode we don't really need the > barriers for that stuff and in RCU mode ->d_flags handling had been > a serious headache all along... > > I'm tempted to do as below; the amount of smp_wmb() remains the same and > so's the amount of stores (splitting that += 2 in two doesn't affect that - > we dirty the same cacheline before and after anyway). OTOH, that would > mean that ->d_seq match guarantees ->d_flags and ->d_inode being in sync. > And I suspect that we could drop _read_ barriers in d_is_...() after that; > in non-RCU mode we don't give a damn anyway and in RCU one ->d_seq check > would provide one; it doesn't really matter on x86, but smp_rmb() may be > costly. Splitting ->d_seq increments *does* matter on x86 wrt correctness; > in-between state becomes guaranteed ->d_seq mismatch and that just might > be it. Dmitry, could you add this on top of the previous patch? Regardless of whether reordering is wrong or not, do we see how it can fix the WARNINGs/oopses? Because it does seem to. I've tried to revert just this part: - *inode = d_backing_inode(dentry); negative = d_is_negative(dentry); + *inode = d_backing_inode(dentry); And got: [ 976.609688] WARNING: CPU: 0 PID: 12126 at fs/namei.c:1587 lookup_fast+0x3fa/0x450() [ 976.626768] WARNING: CPU: 0 PID: 12126 at fs/namei.c:3123 path_openat+0x12bc/0x1520() in 15 minutes. In particular, applying this on top the previous patch will be inconclusive, because I already don't see the warnings. > David, Linus, do you see any problems with that? To me it looks saner > that way and as cheap as the current code, but I might be missing something > here... > > diff --git a/fs/dcache.c b/fs/dcache.c > index 92d5140..2c08cce 100644 > --- a/fs/dcache.c > +++ b/fs/dcache.c > @@ -279,7 +279,6 @@ static inline void __d_set_inode_and_type(struct dentry *dentry, > unsigned flags; > > dentry->d_inode = inode; > - smp_wmb(); > flags = READ_ONCE(dentry->d_flags); > flags &= ~(DCACHE_ENTRY_TYPE | DCACHE_FALLTHRU); > flags |= type_flags; > @@ -300,7 +299,6 @@ static inline void __d_clear_type_and_inode(struct dentry *dentry) > > flags &= ~(DCACHE_ENTRY_TYPE | DCACHE_FALLTHRU); > WRITE_ONCE(dentry->d_flags, flags); > - smp_wmb(); > dentry->d_inode = NULL; > } > > @@ -370,9 +368,11 @@ static void dentry_unlink_inode(struct dentry * dentry) > __releases(dentry->d_inode->i_lock) > { > struct inode *inode = dentry->d_inode; > + > + raw_write_seqcount_begin(&dentry->d_seq); > __d_clear_type_and_inode(dentry); > hlist_del_init(&dentry->d_u.d_alias); > - dentry_rcuwalk_invalidate(dentry); > + raw_write_seqcount_end(&dentry->d_seq); > spin_unlock(&dentry->d_lock); > spin_unlock(&inode->i_lock); > if (!inode->i_nlink) > @@ -1758,8 +1758,9 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode) > spin_lock(&dentry->d_lock); > if (inode) > hlist_add_head(&dentry->d_u.d_alias, &inode->i_dentry); > + raw_write_seqcount_begin(&dentry->d_seq); > __d_set_inode_and_type(dentry, inode, add_flags); > - dentry_rcuwalk_invalidate(dentry); > + raw_write_seqcount_end(&dentry->d_seq); > spin_unlock(&dentry->d_lock); > fsnotify_d_instantiate(dentry, inode); > } ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-29 15:54 ` Dmitry Vyukov @ 2016-02-29 16:19 ` Al Viro 2016-02-29 18:19 ` Dmitry Vyukov 0 siblings, 1 reply; 49+ messages in thread From: Al Viro @ 2016-02-29 16:19 UTC (permalink / raw) To: Dmitry Vyukov Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds, David Howells On Mon, Feb 29, 2016 at 04:54:54PM +0100, Dmitry Vyukov wrote: > Regardless of whether reordering is wrong or not, do we see how it can > fix the WARNINGs/oopses? Because it does seem to. I've tried to revert > just this part: > > - *inode = d_backing_inode(dentry); > negative = d_is_negative(dentry); > + *inode = d_backing_inode(dentry); > > And got: > > [ 976.609688] WARNING: CPU: 0 PID: 12126 at fs/namei.c:1587 > lookup_fast+0x3fa/0x450() > [ 976.626768] WARNING: CPU: 0 PID: 12126 at fs/namei.c:3123 > path_openat+0x12bc/0x1520() > > in 15 minutes. dentry going from negative to positive lookup_fast() fetch NULL ->d_inode store non-NULL ->d_inode store new ->d_flags fetch new ->d_flags check ->d_seq bump ->d_seq by 2 Change the order of fetches and you'll get rid of that scenario. > In particular, applying this on top the previous patch will be > inconclusive, because I already don't see the warnings. Apply it with that reordering reversed, please. ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-29 16:19 ` Al Viro @ 2016-02-29 18:19 ` Dmitry Vyukov 2016-03-01 8:59 ` Dmitry Vyukov 0 siblings, 1 reply; 49+ messages in thread From: Dmitry Vyukov @ 2016-02-29 18:19 UTC (permalink / raw) To: Al Viro Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds, David Howells On Mon, Feb 29, 2016 at 5:19 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: > On Mon, Feb 29, 2016 at 04:54:54PM +0100, Dmitry Vyukov wrote: > >> Regardless of whether reordering is wrong or not, do we see how it can >> fix the WARNINGs/oopses? Because it does seem to. I've tried to revert >> just this part: >> >> - *inode = d_backing_inode(dentry); >> negative = d_is_negative(dentry); >> + *inode = d_backing_inode(dentry); >> >> And got: >> >> [ 976.609688] WARNING: CPU: 0 PID: 12126 at fs/namei.c:1587 >> lookup_fast+0x3fa/0x450() >> [ 976.626768] WARNING: CPU: 0 PID: 12126 at fs/namei.c:3123 >> path_openat+0x12bc/0x1520() >> >> in 15 minutes. > > dentry going from negative to positive lookup_fast() > fetch NULL ->d_inode > store non-NULL ->d_inode > store new ->d_flags > fetch new ->d_flags > check ->d_seq > bump ->d_seq by 2 > > Change the order of fetches and you'll get rid of that scenario. > >> In particular, applying this on top the previous patch will be >> inconclusive, because I already don't see the warnings. > > Apply it with that reordering reversed, please. OK, just wanted to make sure that we keep track of the situation. Restarted testing with combined patch. Here is it just in case: https://gist.githubusercontent.com/dvyukov/67fe363d5ce2e2b06c71/raw/4d1b6c23f8dff7e0f8e2e3cab7e50208fddb0570/gistfile1.txt ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-29 18:19 ` Dmitry Vyukov @ 2016-03-01 8:59 ` Dmitry Vyukov 0 siblings, 0 replies; 49+ messages in thread From: Dmitry Vyukov @ 2016-03-01 8:59 UTC (permalink / raw) To: Al Viro Cc: Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds, David Howells On Mon, Feb 29, 2016 at 7:19 PM, Dmitry Vyukov <dvyukov@google.com> wrote: > On Mon, Feb 29, 2016 at 5:19 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: >> On Mon, Feb 29, 2016 at 04:54:54PM +0100, Dmitry Vyukov wrote: >> >>> Regardless of whether reordering is wrong or not, do we see how it can >>> fix the WARNINGs/oopses? Because it does seem to. I've tried to revert >>> just this part: >>> >>> - *inode = d_backing_inode(dentry); >>> negative = d_is_negative(dentry); >>> + *inode = d_backing_inode(dentry); >>> >>> And got: >>> >>> [ 976.609688] WARNING: CPU: 0 PID: 12126 at fs/namei.c:1587 >>> lookup_fast+0x3fa/0x450() >>> [ 976.626768] WARNING: CPU: 0 PID: 12126 at fs/namei.c:3123 >>> path_openat+0x12bc/0x1520() >>> >>> in 15 minutes. >> >> dentry going from negative to positive lookup_fast() >> fetch NULL ->d_inode >> store non-NULL ->d_inode >> store new ->d_flags >> fetch new ->d_flags >> check ->d_seq >> bump ->d_seq by 2 >> >> Change the order of fetches and you'll get rid of that scenario. >> >>> In particular, applying this on top the previous patch will be >>> inconclusive, because I already don't see the warnings. >> >> Apply it with that reordering reversed, please. > > > OK, just wanted to make sure that we keep track of the situation. > Restarted testing with combined patch. Here is it just in case: > https://gist.githubusercontent.com/dvyukov/67fe363d5ce2e2b06c71/raw/4d1b6c23f8dff7e0f8e2e3cab7e50208fddb0570/gistfile1.txt No warnings/crashes in 15 hours on 3 VMs! ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-29 13:09 ` Al Viro 2016-02-29 15:54 ` Dmitry Vyukov @ 2016-02-29 16:45 ` Linus Torvalds 2016-02-29 16:50 ` Al Viro 1 sibling, 1 reply; 49+ messages in thread From: Linus Torvalds @ 2016-02-29 16:45 UTC (permalink / raw) To: Al Viro Cc: Dmitry Vyukov, Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, David Howells On Mon, Feb 29, 2016 at 5:09 AM, Al Viro <viro@zeniv.linux.org.uk> wrote: > > The more I look at the situation with d_is_...() wrt barriers and ->d_seq, > the less I understand it; outside of RCU mode we don't really need the > barriers for that stuff and in RCU mode ->d_flags handling had been > a serious headache all along... Yeah, one of my least favorite "recent" vfs improvements. > I'm tempted to do as below .. [ changing it to be unde the seqlock ] > > David, Linus, do you see any problems with that? To me it looks saner > that way and as cheap as the current code, but I might be missing something > here... I'd absolutely love to see this. The memory ordering for the flags updates and reading was always really confusing, and I hated how it was hidden inside the random access functions. And apparently it wasn't just confusing, it was buggy too. But I'd love it _more_ if this also means that we can get rid of the rmb's, which your patch didn't. Can we? Or does the ordering still remain for some other issue? Linus ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-29 16:45 ` Linus Torvalds @ 2016-02-29 16:50 ` Al Viro 2016-02-29 17:20 ` Al Viro 2016-02-29 17:24 ` Linus Torvalds 0 siblings, 2 replies; 49+ messages in thread From: Al Viro @ 2016-02-29 16:50 UTC (permalink / raw) To: Linus Torvalds Cc: Dmitry Vyukov, Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, David Howells On Mon, Feb 29, 2016 at 08:45:37AM -0800, Linus Torvalds wrote: > > David, Linus, do you see any problems with that? To me it looks saner > > that way and as cheap as the current code, but I might be missing something > > here... > > I'd absolutely love to see this. The memory ordering for the flags > updates and reading was always really confusing, and I hated how it > was hidden inside the random access functions. And apparently it > wasn't just confusing, it was buggy too. > > But I'd love it _more_ if this also means that we can get rid of the > rmb's, which your patch didn't. Can we? Or does the ordering still > remain for some other issue? In __d_entry_type(), you mean? Should be, along with READ_ONCE() there. AFAICS, ordering shouldn't be an issue anymore... ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-29 16:50 ` Al Viro @ 2016-02-29 17:20 ` Al Viro 2016-02-29 17:24 ` Linus Torvalds 1 sibling, 0 replies; 49+ messages in thread From: Al Viro @ 2016-02-29 17:20 UTC (permalink / raw) To: Linus Torvalds Cc: Dmitry Vyukov, Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, David Howells On Mon, Feb 29, 2016 at 04:50:31PM +0000, Al Viro wrote: > In __d_entry_type(), you mean? Should be, along with READ_ONCE() there. > AFAICS, ordering shouldn't be an issue anymore... FWIW, I've pushed the candidate fix (including the above) into vfs.git#for-linus; I'd prefer to wait for confirmation that dcache.c part is sufficient to fix the problem (_without_ reordering in lookup_fast()) before sending a pull request, though. ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-29 16:50 ` Al Viro 2016-02-29 17:20 ` Al Viro @ 2016-02-29 17:24 ` Linus Torvalds 1 sibling, 0 replies; 49+ messages in thread From: Linus Torvalds @ 2016-02-29 17:24 UTC (permalink / raw) To: Al Viro Cc: Dmitry Vyukov, Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, David Howells On Mon, Feb 29, 2016 at 8:50 AM, Al Viro <viro@zeniv.linux.org.uk> wrote: > > In __d_entry_type(), you mean? Should be, along with READ_ONCE() there. > AFAICS, ordering shouldn't be an issue anymore... That's the one. It results in those barriers in very subtle places, and it was always unclear whether any of the users of those "d_is_*()" helper functions really understood the subtle memory ordering involved. The smp_rmb() is also potentially quite expensive on some architectures. So getting rid of those hidden memory orderings would be a goodness quite apart from fixing the bug Dmitry found. Linus ^ permalink raw reply [flat|nested] 49+ messages in thread
* Re: fs: NULL deref in atime_needs_update 2016-02-28 20:01 ` Al Viro 2016-02-29 9:38 ` Dmitry Vyukov 2016-02-29 13:09 ` Al Viro @ 2016-02-29 13:43 ` David Howells 2 siblings, 0 replies; 49+ messages in thread From: David Howells @ 2016-02-29 13:43 UTC (permalink / raw) To: Al Viro Cc: dhowells, Dmitry Vyukov, Ian Kent, Mickaël Salaün, linux-fsdevel, LKML, syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin, Linus Torvalds Al Viro <viro@ZenIV.linux.org.uk> wrote: > David, Linus, do you see any problems with that? To me it looks saner > that way and as cheap as the current code, but I might be missing something > here... You're effectively converting to this: read d_seq.sequence smp_rmb() read d_inode, d_flags smp_rmb() check d_seq.sequence in the read path and this: write d_seq.sequence smp_wmb() write d_inode, d_flags smp_wmb() write d_seq.sequence This should work - especially if we're wangling these sequence points anyway, and so have to pay the barrier penalties whatever. In fact, you actually take a barrier out, I think. I have had a problem with getting the ordering of d_inode and d_flags right because of __d_clear_type_and_inode() where we're required to unset a dentry so that it can be repurposed[*] as a negative dentry rather than replacing it. This is something we for performance sake - and it's something we can only do if the dentry isn't referenced, whereas if we properly followed the RCU model, we would have to wait a grace period after delisting an unlinked dentry before we could repurpose it - but that significantly slows down rename, unlink and rmdir. [*] Al and I disagree on whether this is a reuse or merely a change of state. David ^ permalink raw reply [flat|nested] 49+ messages in thread
end of thread, other threads:[~2016-03-01 8:59 UTC | newest] Thread overview: 49+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2016-02-05 21:11 fs: NULL deref in atime_needs_update Dmitry Vyukov 2016-02-16 23:40 ` Mickaël Salaün 2016-02-19 19:32 ` Dmitry Vyukov 2016-02-20 3:21 ` Al Viro 2016-02-20 3:54 ` Al Viro 2016-02-20 3:54 ` Al Viro 2016-02-20 13:25 ` Mickaël Salaün 2016-02-20 17:10 ` Al Viro 2016-02-20 17:10 ` Al Viro 2016-02-20 20:26 ` Mickaël Salaün 2016-02-20 20:50 ` Al Viro 2016-02-20 20:50 ` Al Viro 2016-02-22 11:20 ` Dmitry Vyukov 2016-02-22 17:23 ` Al Viro 2016-02-23 15:34 ` Dmitry Vyukov 2016-02-23 18:17 ` Al Viro 2016-02-20 10:36 ` Dmitry Vyukov 2016-02-24 3:12 ` Ian Kent 2016-02-24 4:46 ` Al Viro 2016-02-24 4:46 ` Al Viro 2016-02-24 10:03 ` Dmitry Vyukov 2016-02-24 10:15 ` Dmitry Vyukov 2016-02-24 13:35 ` Dmitry Vyukov 2016-02-24 15:15 ` Al Viro 2016-02-25 8:29 ` Dmitry Vyukov 2016-02-25 16:39 ` Al Viro 2016-02-26 21:21 ` Al Viro 2016-02-26 21:25 ` Dmitry Vyukov 2016-02-26 22:07 ` Al Viro 2016-02-26 22:07 ` Al Viro 2016-02-27 22:27 ` Al Viro 2016-02-27 22:27 ` Al Viro 2016-02-28 15:43 ` Dmitry Vyukov 2016-02-28 16:04 ` Dmitry Vyukov 2016-02-28 17:01 ` Al Viro 2016-02-28 20:01 ` Al Viro 2016-02-29 9:38 ` Dmitry Vyukov 2016-02-29 12:34 ` Dmitry Vyukov 2016-02-29 16:11 ` Al Viro 2016-02-29 13:09 ` Al Viro 2016-02-29 15:54 ` Dmitry Vyukov 2016-02-29 16:19 ` Al Viro 2016-02-29 18:19 ` Dmitry Vyukov 2016-03-01 8:59 ` Dmitry Vyukov 2016-02-29 16:45 ` Linus Torvalds 2016-02-29 16:50 ` Al Viro 2016-02-29 17:20 ` Al Viro 2016-02-29 17:24 ` Linus Torvalds 2016-02-29 13:43 ` David Howells
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.