From: James Hogan <jhogan(a)kernel.org>
Building 32-bit MIPS64r2 kernels produces warnings like the following
on certain toolchains (such as GNU assembler 2.24.90, but not GNU
assembler 2.28.51) since commit 22b8ba765a72 ("MIPS: Fix MIPS64 FP
save/restore on 32-bit kernels"), due to the exposure of fpu_save_16odd
from fpu_save_double and fpu_restore_16odd from fpu_restore_double:
arch/mips/kernel/r4k_fpu.S:47: Warning: float register should be even, was 1
...
arch/mips/kernel/r4k_fpu.S:59: Warning: float register should be even, was 1
...
This appears to be because .set mips64r2 does not change the FPU ABI to
64-bit when -march=mips64r2 (or e.g. -march=xlp) is provided on the
command line on that toolchain, from the default FPU ABI of 32-bit due
to the -mabi=32. This makes access to the odd FPU registers invalid.
Fix by explicitly changing the FPU ABI with .set fp=64 directives in
fpu_save_16odd and fpu_restore_16odd, and moving the undefine of fp up
in asmmacro.h so fp doesn't turn into $30.
Fixes: 22b8ba765a72 ("MIPS: Fix MIPS64 FP save/restore on 32-bit kernels")
Signed-off-by: James Hogan <jhogan(a)kernel.org>
Cc: Ralf Baechle <ralf(a)linux-mips.org>
Cc: Paul Burton <paul.burton(a)imgtec.com>
Cc: linux-mips(a)linux-mips.org
Cc: <stable(a)vger.kernel.org> # 4.0+: 22b8ba765a72: MIPS: Fix MIPS64 FP save/restore on 32-bit kernels
Cc: <stable(a)vger.kernel.org> # 4.0+
---
arch/mips/include/asm/asmmacro.h | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/arch/mips/include/asm/asmmacro.h b/arch/mips/include/asm/asmmacro.h
index b815d7b3bd27..feb069cbf44e 100644
--- a/arch/mips/include/asm/asmmacro.h
+++ b/arch/mips/include/asm/asmmacro.h
@@ -19,6 +19,9 @@
#include <asm/asmmacro-64.h>
#endif
+/* preprocessor replaces the fp in ".set fp=64" with $30 otherwise */
+#undef fp
+
/*
* Helper macros for generating raw instruction encodings.
*/
@@ -105,6 +108,7 @@
.macro fpu_save_16odd thread
.set push
.set mips64r2
+ .set fp=64
SET_HARDFLOAT
sdc1 $f1, THREAD_FPR1(\thread)
sdc1 $f3, THREAD_FPR3(\thread)
@@ -163,6 +167,7 @@
.macro fpu_restore_16odd thread
.set push
.set mips64r2
+ .set fp=64
SET_HARDFLOAT
ldc1 $f1, THREAD_FPR1(\thread)
ldc1 $f3, THREAD_FPR3(\thread)
@@ -234,9 +239,6 @@
.endm
#ifdef TOOLCHAIN_SUPPORTS_MSA
-/* preprocessor replaces the fp in ".set fp=64" with $30 otherwise */
-#undef fp
-
.macro _cfcmsa rd, cs
.set push
.set mips32r2
--
2.14.1
On Thu, 2017-11-23 at 13:08 +0000, Ben Hutchings wrote:
> On Tue, 2017-11-21 at 19:41 -0800, Joe Perches wrote:
> > On Wed, 2017-11-22 at 01:58 +0000, Ben Hutchings wrote:
> > > 3.16.51-rc1 review patch. If anyone has any objections, please let me know.
> > []
> > > --- a/drivers/md/bcache/writeback.h
> > > +++ b/drivers/md/bcache/writeback.h
> > > @@ -14,6 +14,25 @@ static inline uint64_t bcache_dev_sector
> > > return ret;
> > > }
> > >
> > > +static inline uint64_t bcache_flash_devs_sectors_dirty(struct cache_set *c)
> > > +{
> > > + uint64_t i, ret = 0;
> >
> > There's no reason i should be uint64_t
> > as nr_uuids is unsigned int.
>
> But this still works, right? That's a minor issue to deal with
> upstream, not in the backport.
correct
This is the start of the stable review cycle for the 4.9.65 release.
There are 25 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri Nov 24 10:11:07 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.65-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.65-rc1
Jan Harkes <jaharkes(a)cs.cmu.edu>
coda: fix 'kernel memory exposure attempt' in fsync
Pavel Tatashin <pasha.tatashin(a)oracle.com>
mm/page_alloc.c: broken deferred calculation
Corey Minyard <cminyard(a)mvista.com>
ipmi: fix unsigned long underflow
alex chen <alex.chen(a)huawei.com>
ocfs2: should wait dio before inode lock in ocfs2_setattr()
Changwei Ge <ge.changwei(a)h3c.com>
ocfs2: fix cluster hang after a node dies
Adam Wallis <awallis(a)codeaurora.org>
dmaengine: dmatest: warn user when dma test times out
Ji-Ze Hong (Peter Hong) <hpeter(a)gmail.com>
serial: 8250_fintek: Fix finding base_port with activated SuperIO
Lukas Wunner <lukas(a)wunner.de>
serial: omap: Fix EFR write on RTS deassertion
Roberto Sassu <roberto.sassu(a)huawei.com>
ima: do not update security.ima if appraisal status is not INTEGRITY_PASS
Eric Biggers <ebiggers(a)google.com>
crypto: dh - Fix double free of ctx->p
Tudor-Dan Ambarus <tudor.ambarus(a)microchip.com>
crypto: dh - fix memleak in setkey
Eric W. Biederman <ebiederm(a)xmission.com>
net/sctp: Always set scope_id in sctp_inet6_skb_msgname
Huacai Chen <chenhc(a)lemote.com>
fealnx: Fix building error on MIPS
Xin Long <lucien.xin(a)gmail.com>
sctp: do not peel off an assoc from one netns to another one
Jason A. Donenfeld <Jason(a)zx2c4.com>
af_netlink: ensure that NLMSG_DONE never fails in dumps
Cong Wang <xiyou.wangcong(a)gmail.com>
vlan: fix a use-after-free in vlan_device_event()
Andrey Konovalov <andreyknvl(a)google.com>
net: usb: asix: fill null-ptr-deref in asix_suspend
Kristian Evensen <kristian.evensen(a)gmail.com>
qmi_wwan: Add missing skb_reset_mac_header-call
Bjørn Mork <bjorn(a)mork.no>
net: qmi_wwan: fix divide by 0 on bad descriptors
Bjørn Mork <bjorn(a)mork.no>
net: cdc_ether: fix divide by 0 on bad descriptors
Hangbin Liu <liuhangbin(a)gmail.com>
bonding: discard lowest hash bit for 802.3ad layer3+4
Ye Yin <hustcat(a)gmail.com>
netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed
Eric Dumazet <edumazet(a)google.com>
tcp: do not mangle skb->cb[] in tcp_make_synack()
Jeff Barnhill <0xeffeff(a)gmail.com>
net: vrf: correct FRA_L3MDEV encode type
Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru>
tcp_nv: fix division by zero in tcpnv_acked()
-------------
Diffstat:
Makefile | 4 ++--
crypto/dh.c | 34 +++++++++++++++-------------------
drivers/char/ipmi/ipmi_msghandler.c | 10 ++++++----
drivers/dma/dmatest.c | 1 +
drivers/net/bonding/bond_main.c | 2 +-
drivers/net/ethernet/fealnx.c | 6 +++---
drivers/net/usb/asix_devices.c | 4 ++--
drivers/net/usb/cdc_ether.c | 2 +-
drivers/net/usb/qmi_wwan.c | 3 ++-
drivers/net/vrf.c | 2 +-
drivers/tty/serial/8250/8250_fintek.c | 3 +++
drivers/tty/serial/omap-serial.c | 2 +-
fs/coda/upcall.c | 3 +--
fs/ocfs2/dlm/dlmrecovery.c | 1 +
fs/ocfs2/file.c | 9 +++++++--
include/linux/mmzone.h | 3 ++-
include/linux/skbuff.h | 7 +++++++
mm/page_alloc.c | 27 ++++++++++++++++++---------
net/8021q/vlan.c | 6 +++---
net/core/skbuff.c | 1 +
net/ipv4/tcp_nv.c | 2 +-
net/ipv4/tcp_output.c | 9 ++-------
net/netlink/af_netlink.c | 17 +++++++++++------
net/netlink/af_netlink.h | 1 +
net/sctp/ipv6.c | 5 +++--
net/sctp/socket.c | 4 ++++
security/integrity/ima/ima_appraise.c | 3 +++
27 files changed, 103 insertions(+), 68 deletions(-)
On Thu 23-11-17 13:05:10, Ben Hutchings wrote:
> On Wed, 2017-11-22 at 08:41 +0100, Vlastimil Babka wrote:
> > On 11/22/2017 02:58 AM, Ben Hutchings wrote:
> > > 3.16.51-rc1 review patch. If anyone has any objections, please let me know.
> >
> > I don't really care much in the end, but is "fix wrong comment" really a
> > stable patch material these days? :)
>
> It had a Fixes: field and it clearly won't do any harm.
Fixes tag is sometimes abused this way. It will not do any harm but the
fewer patch to backport the better IMHO
> Still, none of the other stable branches has it so I'll drop it.
Makes sense.
--
Michal Hocko
SUSE Labs
When no IOMMU is available, all GEM buffers allocated by Exynos DRM driver
are contiguous, because of the underlying dma_alloc_attrs() function
provides only such buffers. In such case it makes no sense to keep
BO_NONCONTIG flag for the allocated GEM buffers. This allows to avoid
failures for buffer contiguity checks in the subsequent operations on GEM
objects.
Signed-off-by: Marek Szyprowski <m.szyprowski(a)samsung.com>
CC: stable(a)vger.kernel.org # v4.4+
---
This issue is there since commit 0519f9a12d011 ("drm/exynos: add iommu
support for exynos drm framework"), but this patch applies cleanly
only to v4.4+ kernel releases due changes in the surrounding code.
Changelog:
v2:
- added warning message when buffer flags are updadated (requested by Inki)
v1: https://patchwork.kernel.org/patch/10034919/
- initial version
---
drivers/gpu/drm/exynos/exynos_drm_gem.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index 077de014d610..4400efe3974a 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -247,6 +247,15 @@ struct exynos_drm_gem *exynos_drm_gem_create(struct drm_device *dev,
if (IS_ERR(exynos_gem))
return exynos_gem;
+ if (!is_drm_iommu_supported(dev) && (flags & EXYNOS_BO_NONCONTIG)) {
+ /*
+ * when no IOMMU is available, all allocated buffers are
+ * contiguous anyway, so drop EXYNOS_BO_NONCONTIG flag
+ */
+ flags &= ~EXYNOS_BO_NONCONTIG;
+ DRM_WARN("Non-contiguous allocation is not supported without IOMMU, falling back to contiguous buffer\n");
+ }
+
/* set memory type and cache attribute from user side. */
exynos_gem->flags = flags;
--
2.14.2
We added crtc_id to the atomic ioctl, but forgot to add it for vblank
and page flip events. Commit bd386e518056 ("drm: Reorganize
drm_pending_event to support future event types [v2]") added it to
the vblank event, but page flip event was still missing.
Correct this and add a test for making sure we always set crtc_id correctly.
Fixes: bd386e518056 ("drm: Reorganize drm_pending_event to support future event types [v2]")
Fixes: 5db06a8a98f5 ("drm: Pass CRTC ID in userspace vblank events")
Cc: Daniel Stone <daniels(a)collabora.com>
Cc: Daniel Vetter <daniel.vetter(a)intel.com>
Cc: Gustavo Padovan <gustavo(a)padovan.org>
Cc: Sean Paul <seanpaul(a)chromium.org>
Cc: dri-devel(a)lists.freedesktop.org
Cc: <stable(a)vger.kernel.org> # v4.12+
Signed-off-by: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com>
---
drivers/gpu/drm/drm_plane.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
index 19404e34cd59..37a93cdffb4a 100644
--- a/drivers/gpu/drm/drm_plane.c
+++ b/drivers/gpu/drm/drm_plane.c
@@ -1030,6 +1030,7 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
e->event.base.length = sizeof(e->event);
e->event.vbl.user_data = page_flip->user_data;
+ e->event.vbl.crtc_id = crtc->base.id;
ret = drm_event_reserve_init(dev, file_priv, &e->base, &e->event.base);
if (ret) {
kfree(e);
--
2.15.0
From: Jan Kara <jack(a)suse.cz>
[ Upstream commit e3fce68cdbed297d927e993b3ea7b8b1cee545da ]
Currently dax_iomap_rw() takes care of invalidating page tables and
evicting hole pages from the radix tree when write(2) to the file
happens. This invalidation is only necessary when there is some block
allocation resulting from write(2). Furthermore in current place the
invalidation is racy wrt page fault instantiating a hole page just after
we have invalidated it.
So perform the page invalidation inside dax_iomap_actor() where we can
do it only when really necessary and after blocks have been allocated so
nobody will be instantiating new hole pages anymore.
Reviewed-by: Christoph Hellwig <hch(a)lst.de>
Reviewed-by: Ross Zwisler <ross.zwisler(a)linux.intel.com>
Signed-off-by: Jan Kara <jack(a)suse.cz>
Signed-off-by: Dan Williams <dan.j.williams(a)intel.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
---
fs/dax.c | 28 +++++++++++-----------------
1 file changed, 11 insertions(+), 17 deletions(-)
diff --git a/fs/dax.c b/fs/dax.c
index bf6218da7928..800748f10b3d 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -1265,6 +1265,17 @@ iomap_dax_actor(struct inode *inode, loff_t pos, loff_t length, void *data,
if (WARN_ON_ONCE(iomap->type != IOMAP_MAPPED))
return -EIO;
+ /*
+ * Write can allocate block for an area which has a hole page mapped
+ * into page tables. We have to tear down these mappings so that data
+ * written by write(2) is visible in mmap.
+ */
+ if ((iomap->flags & IOMAP_F_NEW) && inode->i_mapping->nrpages) {
+ invalidate_inode_pages2_range(inode->i_mapping,
+ pos >> PAGE_SHIFT,
+ (end - 1) >> PAGE_SHIFT);
+ }
+
while (pos < end) {
unsigned offset = pos & (PAGE_SIZE - 1);
struct blk_dax_ctl dax = { 0 };
@@ -1329,23 +1340,6 @@ iomap_dax_rw(struct kiocb *iocb, struct iov_iter *iter,
if (iov_iter_rw(iter) == WRITE)
flags |= IOMAP_WRITE;
- /*
- * Yes, even DAX files can have page cache attached to them: A zeroed
- * page is inserted into the pagecache when we have to serve a write
- * fault on a hole. It should never be dirtied and can simply be
- * dropped from the pagecache once we get real data for the page.
- *
- * XXX: This is racy against mmap, and there's nothing we can do about
- * it. We'll eventually need to shift this down even further so that
- * we can check if we allocated blocks over a hole first.
- */
- if (mapping->nrpages) {
- ret = invalidate_inode_pages2_range(mapping,
- pos >> PAGE_SHIFT,
- (pos + iov_iter_count(iter) - 1) >> PAGE_SHIFT);
- WARN_ON_ONCE(ret);
- }
-
while (iov_iter_count(iter)) {
ret = iomap_apply(inode, pos, iov_iter_count(iter), flags, ops,
iter, iomap_dax_actor);
--
2.11.0
Running this code with IRQs enabled (where dummy_lock is a spinlock):
static void check_load_gs_index(void)
{
/* This will fail. */
load_gs_index(0xffff);
spin_lock(&dummy_lock);
spin_unlock(&dummy_lock);
}
Will generate a lockdep warning. The issue is that the actual write
to %gs would cause an exception with IRQs disabled, and the exception
handler would, as an inadvertent side effect, update irqflag tracing
to reflect the IRQs-off status. native_load_gs_index() would then
turn IRQs back on and return with irqflag tracing still thinking that
IRQs were off. The dummy lock-and-unlock causes lockdep to notice the
error and warn.
Fix it by adding the missing tracing.
Apparently nothing did this in a context where it mattered. I haven't
tried to find a code path that would actually exhibit the warning if
appropriately nasty user code were running.
I suspect that the security impact of this bug is very, very low --
production systems don't run with lockdep enabled, and the warning is
mostly harmless anyway.
Found during a quick audit of the entry code to try to track down an
unrelated bug that Ingo found in some still-in-development code.
Cc: stable(a)vger.kernel.org
Signed-off-by: Andy Lutomirski <luto(a)kernel.org>
---
Hi Ingo-
You asked me to look for an irqflag tracing bug, so I found one :)
arch/x86/entry/entry_64.S | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index a2b30ec69497..3c288f260fdf 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -51,15 +51,19 @@ ENTRY(native_usergs_sysret64)
END(native_usergs_sysret64)
#endif /* CONFIG_PARAVIRT */
-.macro TRACE_IRQS_IRETQ
+.macro TRACE_IRQS_FLAGS flags:req
#ifdef CONFIG_TRACE_IRQFLAGS
- bt $9, EFLAGS(%rsp) /* interrupts off? */
+ bt $9, \flags /* interrupts off? */
jnc 1f
TRACE_IRQS_ON
1:
#endif
.endm
+.macro TRACE_IRQS_IRETQ
+ TRACE_IRQS_FLAGS EFLAGS(%rsp)
+.endm
+
/*
* When dynamic function tracer is enabled it will add a breakpoint
* to all locations that it is about to modify, sync CPUs, update
@@ -943,11 +947,13 @@ ENTRY(native_load_gs_index)
FRAME_BEGIN
pushfq
DISABLE_INTERRUPTS(CLBR_ANY & ~CLBR_RDI)
+ TRACE_IRQS_OFF
SWAPGS
.Lgs_change:
movl %edi, %gs
2: ALTERNATIVE "", "mfence", X86_BUG_SWAPGS_FENCE
SWAPGS
+ TRACE_IRQS_FLAGS (%rsp)
popfq
FRAME_END
ret
--
2.13.6