February 2018 - Linux-stable-mirror

[Linux-stable-mirror] [PATCH -mm -v2] mm, swap, frontswap: Fix THP swap if frontswap enabled

by Huang, Ying

From: Huang Ying <huang.ying.caritas(a)gmail.com> It was reported by Sergey Senozhatsky that if THP (Transparent Huge Page) and frontswap (via zswap) are both enabled, when memory goes low so that swap is triggered, segfault and memory corruption will occur in random user space applications as follow, kernel: urxvt[338]: segfault at 20 ip 00007fc08889ae0d sp 00007ffc73a7fc40 error 6 in libc-2.26.so[7fc08881a000+1ae000] #0 0x00007fc08889ae0d _int_malloc (libc.so.6) #1 0x00007fc08889c2f3 malloc (libc.so.6) #2 0x0000560e6004bff7 _Z14rxvt_wcstoutf8PKwi (urxvt) #3 0x0000560e6005e75c n/a (urxvt) #4 0x0000560e6007d9f1 _ZN16rxvt_perl_interp6invokeEP9rxvt_term9hook_typez (urxvt) #5 0x0000560e6003d988 _ZN9rxvt_term9cmd_parseEv (urxvt) #6 0x0000560e60042804 _ZN9rxvt_term6pty_cbERN2ev2ioEi (urxvt) #7 0x0000560e6005c10f _Z17ev_invoke_pendingv (urxvt) #8 0x0000560e6005cb55 ev_run (urxvt) #9 0x0000560e6003b9b9 main (urxvt) #10 0x00007fc08883af4a __libc_start_main (libc.so.6) #11 0x0000560e6003f9da _start (urxvt) After bisection, it was found the first bad commit is bd4c82c22c367e068 ("mm, THP, swap: delay splitting THP after swapped out"). The root cause is as follow. When the pages are written to swap device during swapping out in swap_writepage(), zswap (fontswap) is tried to compress the pages instead to improve the performance. But zswap (frontswap) will treat THP as normal page, so only the head page is saved. After swapping in, tail pages will not be restored to its original contents, so cause the memory corruption in the applications. This is fixed via splitting THP before writing the page to swap device if frontswap is enabled. To deal with the situation where frontswap is enabled at runtime, whether the page is THP is checked before using frontswap during swapping out too. Reported-and-tested-by: Sergey Senozhatsky <sergey.senozhatsky(a)gmail.com> Signed-off-by: "Huang, Ying" <ying.huang(a)intel.com> Cc: Konrad Rzeszutek Wilk <konrad.wilk(a)oracle.com> Cc: Dan Streetman <ddstreet(a)ieee.org> Cc: Seth Jennings <sjenning(a)redhat.com> Cc: Minchan Kim <minchan(a)kernel.org> Cc: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Cc: Shaohua Li <shli(a)kernel.org> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Mel Gorman <mgorman(a)techsingularity.net> Cc: Shakeel Butt <shakeelb(a)google.com> Cc: stable(a)vger.kernel.org # 4.14 Fixes: bd4c82c22c367e068 ("mm, THP, swap: delay splitting THP after swapped out") Changelog: v2: - Move frontswap check into swapfile.c to avoid to make vmscan.c depends on frontswap. --- mm/page_io.c | 2 +- mm/swapfile.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/mm/page_io.c b/mm/page_io.c index b41cf9644585..6dca817ae7a0 100644 --- a/mm/page_io.c +++ b/mm/page_io.c @@ -250,7 +250,7 @@ int swap_writepage(struct page *page, struct writeback_control *wbc) unlock_page(page); goto out; } - if (frontswap_store(page) == 0) { + if (!PageTransHuge(page) && frontswap_store(page) == 0) { set_page_writeback(page); unlock_page(page); end_page_writeback(page); diff --git a/mm/swapfile.c b/mm/swapfile.c index 006047b16814..0b7c7883ce64 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -934,6 +934,9 @@ int get_swap_pages(int n_goal, bool cluster, swp_entry_t swp_entries[]) /* Only single cluster request supported */ WARN_ON_ONCE(n_goal > 1 && cluster); + /* Frontswap doesn't support THP */ + if (frontswap_enabled() && cluster) + goto noswap; avail_pgs = atomic_long_read(&nr_swap_pages) / nr_pages; if (avail_pgs <= 0) -- 2.15.1

6 years, 11 months

7
12
0 0

[Linux-stable-mirror] [PATCH v2] xenbus: track caller request id

by Joao Martins

Commit fd8aa9095a95 ("xen: optimize xenbus driver for multiple concurrent xenstore accesses") optimized xenbus concurrent accesses but in doing so broke UABI of /dev/xen/xenbus. Through /dev/xen/xenbus applications are in charge of xenbus message exchange with the correct header and body. Now, after the mentioned commit the replies received by application will no longer have the header req_id echoed back as it was on request (see specification below for reference), because that particular field is being overwritten by kernel. struct xsd_sockmsg { uint32_t type; /* XS_??? */ uint32_t req_id;/* Request identifier, echoed in daemon's response. */ uint32_t tx_id; /* Transaction id (0 if not related to a transaction). */ uint32_t len; /* Length of data following this. */ /* Generally followed by nul-terminated string(s). */ }; Before there was only one request at a time so req_id could simply be forwarded back and forth. To allow simultaneous requests we need a different req_id for each message thus kernel keeps a monotonic increasing counter for this field and is written on every request irrespective of userspace value. Forwarding again the req_id on userspace requests is not a solution because we would open the possibility of userspace-generated req_id colliding with kernel ones. So this patch instead takes another route which is to artificially keep user req_id while keeping the xenbus logic as is. We do that by saving the original req_id before xs_send(), use the private kernel counter as req_id and then once reply comes and was validated, we restore back the original req_id. Cc: <stable(a)vger.kernel.org> # 4.11 Fixes: fd8aa9095a ("xen: optimize xenbus driver for multiple concurrent xenstore accesses") Reported-by: Bhavesh Davda <bhavesh.davda(a)oracle.com> Signed-off-by: Joao Martins <joao.m.martins(a)oracle.com> --- Here's a link to a unit test (https://pastebin.com/2q51j2sR) where req_id of reply and response are being asserted each request. Without this patch the assert will fail (e.g. try it with `./xswire_reqid_test name`). But on <= v4.10 or >= v4.11 with the fix above, it will print domain name 10 times. Changes since v1: * Adjust commit message (Comments from Juergen on IRC) * Unilateraly save/restore req_id and remove xs_request_is_user() * Initialize req_id for kernel callers --- drivers/xen/xenbus/xenbus.h | 1 + drivers/xen/xenbus/xenbus_comms.c | 1 + drivers/xen/xenbus/xenbus_xs.c | 3 +++ 3 files changed, 5 insertions(+) diff --git a/drivers/xen/xenbus/xenbus.h b/drivers/xen/xenbus/xenbus.h index 149c5e7efc89..092981171df1 100644 --- a/drivers/xen/xenbus/xenbus.h +++ b/drivers/xen/xenbus/xenbus.h @@ -76,6 +76,7 @@ struct xb_req_data { struct list_head list; wait_queue_head_t wq; struct xsd_sockmsg msg; + uint32_t caller_req_id; enum xsd_sockmsg_type type; char *body; const struct kvec *vec; diff --git a/drivers/xen/xenbus/xenbus_comms.c b/drivers/xen/xenbus/xenbus_comms.c index 5b081a01779d..d239fc3c5e3d 100644 --- a/drivers/xen/xenbus/xenbus_comms.c +++ b/drivers/xen/xenbus/xenbus_comms.c @@ -309,6 +309,7 @@ static int process_msg(void) goto out; if (req->state == xb_req_state_wait_reply) { + req->msg.req_id = req->caller_req_id; req->msg.type = state.msg.type; req->msg.len = state.msg.len; req->body = state.body; diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c index 3e59590c7254..3f3b29398ab8 100644 --- a/drivers/xen/xenbus/xenbus_xs.c +++ b/drivers/xen/xenbus/xenbus_xs.c @@ -227,6 +227,8 @@ static void xs_send(struct xb_req_data *req, struct xsd_sockmsg *msg) req->state = xb_req_state_queued; init_waitqueue_head(&req->wq); + /* Save the caller req_id and restore it later in the reply */ + req->caller_req_id = req->msg.req_id; req->msg.req_id = xs_request_enter(req); mutex_lock(&xb_write_mutex); @@ -310,6 +312,7 @@ static void *xs_talkv(struct xenbus_transaction t, req->num_vecs = num_vecs; req->cb = xs_wake_up; + msg.req_id = 0; msg.tx_id = t.id; msg.type = type; msg.len = 0; -- 2.11.0

6 years, 11 months

2
2
0 0

[Linux-stable-mirror] [PATCH 6/6] xhci: fix xhci debugfs errors in xhci_stop

by Mathias Nyman

From: Zhengjun Xing <zhengjun.xing(a)linux.intel.com> In function xhci_stop, xhci_debugfs_exit called before xhci_mem_cleanup. xhci_debugfs_exit removed the xhci debugfs root nodes, xhci_mem_cleanup called function xhci_free_virt_devices_depth_first which in turn called function xhci_debugfs_remove_slot. Function xhci_debugfs_remove_slot removed the nodes for devices, the nodes folders are sub folder of xhci debugfs. It is unreasonable to remove xhci debugfs root folder before xhci debugfs sub folder. Function xhci_mem_cleanup should be called before function xhci_debugfs_exit. Fixes: 02b6fdc2a153 ("usb: xhci: Add debugfs interface for xHCI driver") Cc: <stable(a)vger.kernel.org> # v4.15 Signed-off-by: Zhengjun Xing <zhengjun.xing(a)linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> --- drivers/usb/host/xhci.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index 4adb6da..25d4b748 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -646,8 +646,6 @@ static void xhci_stop(struct usb_hcd *hcd) return; } - xhci_debugfs_exit(xhci); - xhci_dbc_exit(xhci); spin_lock_irq(&xhci->lock); @@ -680,6 +678,7 @@ static void xhci_stop(struct usb_hcd *hcd) xhci_dbg_trace(xhci, trace_xhci_dbg_init, "cleaning up memory"); xhci_mem_cleanup(xhci); + xhci_debugfs_exit(xhci); xhci_dbg_trace(xhci, trace_xhci_dbg_init, "xhci_stop completed - status = %x", readl(&xhci->op_regs->status)); -- 2.7.4

6 years, 11 months

1
0
0 0

[Linux-stable-mirror] [PATCH 5/6] xhci: xhci debugfs device nodes weren't removed after device plugged out

by Mathias Nyman

From: Zhengjun Xing <zhengjun.xing(a)linux.intel.com> There is a bug after plugged out USB device, the device and its ep00 nodes are still kept, we need to remove the nodes in xhci_free_dev when USB device is plugged out. Fixes: 052f71e25a7e ("xhci: Fix xhci debugfs NULL pointer dereference in resume from hibernate") Cc: <stable(a)vger.kernel.org> # v4.15 Signed-off-by: Zhengjun Xing <zhengjun.xing(a)linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> --- drivers/usb/host/xhci.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index b01bd64..4adb6da 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -3545,12 +3545,10 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) virt_dev->eps[i].ep_state &= ~EP_STOP_CMD_PENDING; del_timer_sync(&virt_dev->eps[i].stop_cmd_timer); } - + xhci_debugfs_remove_slot(xhci, udev->slot_id); ret = xhci_disable_slot(xhci, udev->slot_id); - if (ret) { - xhci_debugfs_remove_slot(xhci, udev->slot_id); + if (ret) xhci_free_virt_device(xhci, udev->slot_id); - } } int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id) -- 2.7.4

6 years, 11 months

1
0
0 0

[Linux-stable-mirror] [PATCH 4/6] xhci: Fix xhci debugfs devices node disappearance after hibernation

by Mathias Nyman

From: Zhengjun Xing <zhengjun.xing(a)linux.intel.com> During system resume from hibernation, xhci host is reset, all the nodes in devices folder are removed in xhci_mem_cleanup function. Later nodes in /sys/kernel/debug/usb/xhci/* are created again in function xhci_run, but the nodes already exist, so the nodes still keep the old ones, finally device nodes in xhci debugfs folder /sys/kernel/debug/usb/xhci/*/devices/* are disappeared. This fix removed xhci debugfs nodes before the nodes are re-created, so all the nodes in xhci debugfs can be re-created successfully. Fixes: 02b6fdc2a153 ("usb: xhci: Add debugfs interface for xHCI driver") Cc: <stable(a)vger.kernel.org> # v4.15 Signed-off-by: Zhengjun Xing <zhengjun.xing(a)linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> --- drivers/usb/host/xhci.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index 1eeb339..b01bd64 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -1014,6 +1014,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) xhci_dbg(xhci, "cleaning up memory\n"); xhci_mem_cleanup(xhci); + xhci_debugfs_exit(xhci); xhci_dbg(xhci, "xhci_stop completed - status = %x\n", readl(&xhci->op_regs->status)); -- 2.7.4

6 years, 11 months

1
0
0 0

[Linux-stable-mirror] [PATCH 3/6] xhci: Fix NULL pointer in xhci debugfs

by Mathias Nyman

From: Zhengjun Xing <zhengjun.xing(a)linux.intel.com> Commit dde634057da7 ("xhci: Fix use-after-free in xhci debugfs") causes a null pointer dereference while fixing xhci-debugfs usage of ring pointers that were freed during hibernate. The fix passed addresses to ring pointers instead, but forgot to do this change for the xhci_ring_trb_show function. The address of the ring pointer passed to xhci-debugfs was of a temporary ring pointer "new_ring" instead of the actual ring "ring" pointer. The temporary new_ring pointer will be set to NULL later causing the NULL pointer dereference. This issue was seen when reading xhci related files in debugfs: cat /sys/kernel/debug/usb/xhci/*/devices/*/ep*/trbs [ 184.604861] BUG: unable to handle kernel NULL pointer dereference at (null) [ 184.613776] IP: xhci_ring_trb_show+0x3a/0x890 [ 184.618733] PGD 264193067 P4D 264193067 PUD 263238067 PMD 0 [ 184.625184] Oops: 0000 [#1] SMP [ 184.726410] RIP: 0010:xhci_ring_trb_show+0x3a/0x890 [ 184.731944] RSP: 0018:ffffba8243c0fd90 EFLAGS: 00010246 [ 184.737880] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000000295d6 [ 184.746020] RDX: 00000000000295d5 RSI: 0000000000000001 RDI: ffff971a6418d400 [ 184.754121] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 184.762222] R10: ffff971a64c98a80 R11: ffff971a62a00e40 R12: ffff971a62a85500 [ 184.770325] R13: 0000000000020000 R14: ffff971a6418d400 R15: ffff971a6418d400 [ 184.778448] FS: 00007fe725a79700(0000) GS:ffff971a6ec00000(0000) knlGS:0000000000000000 [ 184.787644] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 184.794168] CR2: 0000000000000000 CR3: 000000025f365005 CR4: 00000000003606f0 [ 184.802318] Call Trace: [ 184.805094] ? seq_read+0x281/0x3b0 [ 184.809068] seq_read+0xeb/0x3b0 [ 184.812735] full_proxy_read+0x4d/0x70 [ 184.817007] __vfs_read+0x23/0x120 [ 184.820870] vfs_read+0x91/0x130 [ 184.824538] SyS_read+0x42/0x90 [ 184.828106] entry_SYSCALL_64_fastpath+0x1a/0x7d Fixes: dde634057da7 ("xhci: Fix use-after-free in xhci debugfs") Cc: <stable(a)vger.kernel.org> # v4.15 Signed-off-by: Zhengjun Xing <zhengjun.xing(a)linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> --- drivers/usb/host/xhci-debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c index e26e685..5851052 100644 --- a/drivers/usb/host/xhci-debugfs.c +++ b/drivers/usb/host/xhci-debugfs.c @@ -211,7 +211,7 @@ static void xhci_ring_dump_segment(struct seq_file *s, static int xhci_ring_trb_show(struct seq_file *s, void *unused) { int i; - struct xhci_ring *ring = s->private; + struct xhci_ring *ring = *(struct xhci_ring **)s->private; struct xhci_segment *seg = ring->first_seg; for (i = 0; i < ring->num_segs; i++) { @@ -387,7 +387,7 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci, snprintf(epriv->name, sizeof(epriv->name), "ep%02d", ep_index); epriv->root = xhci_debugfs_create_ring_dir(xhci, - &dev->eps[ep_index].new_ring, + &dev->eps[ep_index].ring, epriv->name, spriv->root); spriv->eps[ep_index] = epriv; -- 2.7.4

6 years, 11 months

1
0
0 0

[Linux-stable-mirror] v4.15.3 build: 0 failures 0 warnings (v4.15.3)

by Build bot for Mark Brown

Tree/Branch: v4.15.3 Git describe: v4.15.3 Commit: e6e2d12fa4 Linux 4.15.3 Build Time: 112 min 12 sec Passed: 10 / 10 (100.00 %) Failed: 0 / 10 ( 0.00 %) Errors: 0 Warnings: 0 Section Mismatches: 0 ------------------------------------------------------------------------------- defconfigs with issues (other than build errors): ------------------------------------------------------------------------------- =============================================================================== Detailed per-defconfig build reports below: ------------------------------------------------------------------------------- Passed with no errors, warnings or mismatches: arm64-allnoconfig arm64-allmodconfig arm-multi_v5_defconfig arm-multi_v7_defconfig x86_64-defconfig arm-allmodconfig arm-allnoconfig x86_64-allnoconfig arm-multi_v4t_defconfig arm64-defconfig close failed in file object destructor: sys.excepthook is missing lost sys.stderr

6 years, 11 months

1
0
0 0

[Linux-stable-mirror] [PATCH 1/2] xen: xenbus_dev_frontend: Fix XS_TRANSACTION_END handling

by Simon Gaiser

Commit fd8aa9095a95 ("xen: optimize xenbus driver for multiple concurrent xenstore accesses") made a subtle change to the semantic of xenbus_dev_request_and_reply() and xenbus_transaction_end(). Before on an error response to XS_TRANSACTION_END xenbus_dev_request_and_reply() would not decrement the active transaction counter. But xenbus_transaction_end() has always counted the transaction as finished regardless of the response. The new behavior is that xenbus_dev_request_and_reply() and xenbus_transaction_end() will always count the transaction as finished regardless the response code (handled in xs_request_exit()). But xenbus_dev_frontend tries to end a transaction on closing of the device if the XS_TRANSACTION_END failed before. Trying to close the transaction twice corrupts the reference count. So fix this by also considering a transaction closed if we have sent XS_TRANSACTION_END once regardless of the return code. Cc: <stable(a)vger.kernel.org> # 4.11 Fixes: fd8aa9095a95 ("xen: optimize xenbus driver for multiple concurrent xenstore accesses") Signed-off-by: Simon Gaiser <simon(a)invisiblethingslab.com> --- drivers/xen/xenbus/xenbus_dev_frontend.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c index f3b089b7c0b6..d2edbc79384a 100644 --- a/drivers/xen/xenbus/xenbus_dev_frontend.c +++ b/drivers/xen/xenbus/xenbus_dev_frontend.c @@ -365,7 +365,7 @@ void xenbus_dev_queue_reply(struct xb_req_data *req) if (WARN_ON(rc)) goto out; } - } else if (req->msg.type == XS_TRANSACTION_END) { + } else if (req->type == XS_TRANSACTION_END) { trans = xenbus_get_transaction(u, req->msg.tx_id); if (WARN_ON(!trans)) goto out; -- 2.15.1

6 years, 11 months

3
3
0 0

[Linux-stable-mirror] [PATCH 3.2 00/79] 3.2.99-rc1 review

by Ben Hutchings

This is the start of the stable review cycle for the 3.2.99 release. There are 79 patches in this series, which will be posted as responses to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue Feb 13 12:00:00 UTC 2018. Anything received after that time might be too late. All the patches have also been committed to the linux-3.2.y-rc branch of https://git.kernel.org/pub/scm/linux/kernel/git/bwh/linux-stable-rc.git . A shortlog and diffstat can be found below. Ben. ------------- Al Viro (2): autofs4: autofs4_wait() vs. autofs4_catatonic_mode() race [4041bcdc7bef06a2fb29c57394c713a74bd13b08] autofs4: catatonic_mode vs. notify_daemon race [8753333266be67ff3a984ac1f6566d31c260bee4] Alan (1): usbip: Fix sscanf handling [2d32927127f44d755780aa5fa88c8c34e72558f8] Alan Stern (1): USB: usbfs: compute urb->actual_length for isochronous [2ef47001b3ee3ded579b7532ebdcf8680e4d8c54] Alex Chen (1): ocfs2: should wait dio before inode lock in ocfs2_setattr() [28f5a8a7c033cbf3e32277f4cc9c6afd74f05300] Alexander Potapenko (1): sctp: fully initialize the IPv6 address in sctp_v6_to_addr() [15339e441ec46fbc3bf3486bb1ae4845b0f1bb8d] Alexander Steffen (1): tpm-dev-common: Reject too short writes [ee70bc1e7b63ac8023c9ff9475d8741e397316e7] Alexandre Belloni (1): rtc: set the alarm to the next expiring timer [74717b28cb32e1ad3c1042cafd76b264c8c0f68d] Andreas Rohner (1): nilfs2: fix race condition that causes file system corruption [31ccb1f7ba3cfe29631587d451cf5bb8ab593550] Arnd Bergmann (2): Input: adxl34x - do not treat FIFO_MODE() as boolean [1dbc080c9ef6bcfba652ef0d6ae919b8c7c85a1d] isofs: fix timestamps beyond 2027 [34be4dbf87fc3e474a842305394534216d428f5d] Bart Van Assche (1): IB/srp: Avoid that a cable pull can trigger a kernel crash [8a0d18c62121d3c554a83eb96e2752861d84d937] Bart Westgeest (1): staging: usbip: removed #if 0'd out code [34c09578179f5838e5958c45e8aed4edc9c6c3b8] Bernhard Rosenkraenzer (1): USB: Add delay-init quirk for Corsair K70 LUX keyboards [a0fea6027f19c62727315aba1a7fae75a9caa842] Brent Taylor (1): mtd: nand: Fix writing mtdoops to nand flash. [30863e38ebeb500a31cecee8096fb5002677dd9b] Chuck Lever (1): nfs: Fix ugly referral attributes [c05cefcc72416a37eba5a2b35f0704ed758a9145] Colin Ian King (1): rtc: interface: ignore expired timers when enqueuing new timers [2b2f5ff00f63847d95adad6289bd8b05f5983dd5] Dan Carpenter (2): eCryptfs: use after free in ecryptfs_release_messaging() [db86be3a12d0b6e5c5b51c2ab2a48f06329cb590] scsi: bfa: integer overflow in debugfs [3e351275655d3c84dc28abf170def9786db5176d] Eric Biggers (1): dm bufio: fix integer overflow when limiting maximum cache size [74d4108d9e681dbbe4a2940ed8fdff1f6868184c] Eric Dumazet (1): netfilter: xt_TCPMSS: add more sanity tests on tcph->doff [2638fd0f92d4397884fd991d8f4925cb3f081901] Eric W. Biederman (1): net/sctp: Always set scope_id in sctp_inet6_skb_msgname [7c8a61d9ee1df0fb4747879fa67a99614eb62fec] Felipe Balbi (1): usb: add helper to extract bits 12:11 of wMaxPacketSize [541b6fe63023f3059cf85d47ff2767a3e42a8e44] Gabriele Paoloni (1): PCI/AER: Report non-fatal errors only to the affected endpoint [86acc790717fb60fb51ea3095084e331d8711c74] Guenter Roeck (1): kaiser: Set _PAGE_NX only if supported [61e9b3671007a5da8127955a1a3bda7e0d5f42e8] Guillaume Nault (5): l2tp: don't register sessions in l2tp_session_create() [3953ae7b218df4d1e544b98a393666f9ae58a78c] l2tp: ensure sessions are freed after their PPPOL2TP socket [cdd10c9627496ad25c87ce6394e29752253c69d3] l2tp: initialise PPP sessions before registering them [f98be6c6359e7e4a61aaefb9964c1db31cb9ec0c] l2tp: initialise l2tp_eth sessions before registering them [ee28de6bbd78c2e18111a0aef43ea746f28d2073] l2tp: protect sock pointer of struct pppol2tp_session with RCU [ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741] Hou Tao (1): dm: fix race between dm_get_from_kobject() and __dm_destroy() [b9a41d21dceadf8104812626ef85dc56ee8a60ed] Jan Harkes (1): coda: fix 'kernel memory exposure attempt' in fsync [d337b66a4c52c7b04eec661d86c2ef6e168965a2] Jason Gunthorpe (1): sctp: Fixup v4mapped behaviour to comply with Sock API [299ee123e19889d511092347f5fc14db0f10e3a6] Jens Axboe (1): blktrace: fix unlocked access to init/start-stop/teardown [1f2cac107c591c24b60b115d6050adc213d10fc0] Johan Hovold (2): USB: serial: garmin_gps: fix I/O after failed probe and remove [19a565d9af6e0d828bd0d521d3bafd5017f4ce52] USB: serial: garmin_gps: fix memory leak on probe errors [74d471b598444b7f2d964930f7234779c80960a0] Ladi Prosek (1): KVM: nVMX: set IDTR and GDTR limits when loading L1 host state [21f2d551183847bc7fbe8d866151d00cdad18752] Ladislav Michl (1): video: udlfb: Fix read EDID timeout [c98769475575c8a585f5b3952f4b5f90266f699b] Lepton Wu (1): kaiser: Set _PAGE_NX only if supported [not upstream; specific to KAISER backport] Mark Bloch (1): IB/mlx4: Increase maximal message size under UD QP [5f22a1d87c5315a98981ecf93cd8de226cffe6ca] Markus Elfring (1): media: omap_vout: Fix a possible null pointer dereference in omap_vout_open() [bfba2b3e21b9426c0f9aca00f3cad8631b2da170] Masami Hiramatsu (1): x86/decoder: Add new TEST instruction pattern [12a78d43de767eaf8fb272facb7a7b6f2dc6a9df] Mauro Carvalho Chehab (1): [media] cx231xx: Fix the max number of interfaces [139d28826b8e2bc7a9232fde0d2f14812914f501] Michele Baldessari (1): media: Don't do DMA on stack for firmware upload in the AS102 driver [b3120d2cc447ee77b9d69bf4ad7b452c9adb4d39] Mike Snitzer (1): dm: discard support requires all targets in a table support discards [8a74d29d541cd86569139c6f3f44b2d210458071] Mohamed Ghannam (2): RDS: Heap OOB write in rds_message_alloc_sgs() [c095508770aebf1b9218e77026e48345d719b17c] RDS: null pointer dereference in rds_atomic_free_op [7d11f77f84b27cef452cee332f4e469503084737] Nadav Amit (1): KVM: vmx: Inject #GP on invalid PAT CR [4566654bb9be9e8864df417bb72ceee5136b6a6a] NeilBrown (2): autofs: don't fail mount for transient error [ecc0c469f27765ed1e2b967be0aa17cee1a60b76] autofs: fix careless error in recent commit [302ec300ef8a545a7fc7f667e5fd743b091c2eeb] Pablo Neira Ayuso (3): netfilter: xt_TCPMSS: fix handling of malformed TCP header and options [71ffe9c77dd7a2b62207953091efa8dafec958dd] netfilter: xt_TCPOPTSTRIP: don't use tcp_hdr() [ed82c437320c48a4032492f4a55a7e2c934158b6] netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond packet boundary [bc6bcb59dd7c184d229f9e86d08aa56059938a4c] Paolo Bonzini (1): KVM: SVM: obey guest PAT [15038e14724799b8c205beb5f20f9e54896013c3] Phil Oester (2): netfilter: xt_TCPMSS: Fix missing fragmentation handling [b396966c4688522863572927cb30aa874b3ec504] netfilter: xt_TCPMSS: correct return value in tcpmss_mangle_packet [1205e1fa615805c9efa97303b552cf445965752a] Rusty Russell (1): x86/smp: Don't ever patch back to UP if we unplug cpus [816afe4ff98ee10b1d30fd66361be132a0a5cee6] Sean Young (1): media: rc: check for integer overflow [3e45067f94bbd61dec0619b1c32744eb0de480c8] Shuah Khan (4): usbip: fix stub_rx: get_pipe() to validate endpoint number [635f545a7e8be7596b9b2b6a43cab6bbd5a88e43] usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input [c6688ef9f29762e65bce325ef4acd6c675806366] usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer [be6123df1ea8f01ee2f896a16c2b7be3e4557a5a] usbip: prevent vhci_hcd driver from leaking a socket pointer address [2f2d0088eb93db5c649d2a5e34a3800a8a935fc5] Stanislaw Gruszka (1): rt2x00usb: mark device removed when get ENOENT usb error [bfa62a52cad93686bb8d8171ea5288813248a7c6] Takashi Iwai (6): ALSA: seq: Make ioctls race-free [b3defb791b26ea0683a93a4f49c77ec45ec96f10] ALSA: timer: Remove kernel warning at compat ioctl error paths [3d4e8303f2c747c8540a0a0126d0151514f6468b] ALSA: usb-audio: Add sanity checks in v2 clock parsers [0a62d6c966956d77397c32836a5bbfe3af786fc1] ALSA: usb-audio: Add sanity checks to FE parser [d937cd6790a2bef2d07b500487646bd794c039bb] ALSA: usb-audio: Fix potential out-of-bound access at parsing SU [f658f17b5e0e339935dca23e77e0f3cad591926b] ALSA: usb-audio: Fix potential zero-division at parsing FU [8428a8ebde2db1e988e41a58497a28beb7ce1705] Tom Parkin (3): l2tp: add session reorder queue purge function to core [48f72f92b31431c40279b0fba6c5588e07e67d95] l2tp: purge session reorder queue on delete [4c6e2fd35460208596fa099ee0750a4b0438aa5c] l2tp: push all ppp pseudowire shutdown through .release handler [cf2f5c886a209377daefd5d2ba0bcd49c3887813] Tuomas Tynkkynen (2): fs/9p: Compare qid.path in v9fs_test_inode [8ee031631546cf2f7859cc69593bd60bbdd70b46] net/9p: Switch to wait_event_killable() [9523feac272ccad2ad8186ba4fcc89103754de52] Vasily Gorbik (1): s390/disassembler: increase show_code buffer size [b192571d1ae375e0bbe0aa3ccfa1a3c3704454b9] Vijendar Mukunda (1): ALSA: hda: Add Raven PCI ID [9ceace3c9c18c67676e75141032a65a8e01f9a7a] Waiman Long (1): blktrace: Fix potential deadlock between delete & sysfs ops [5acb3cc2c2e9d3020a4fee43763c6463767f1572] Younger Liu (1): ocfs2: fix issue that ocfs2_setattr() does not deal with new_i_size==i_size [d62e74be1270c89fbaf7aada8218bfdf62d00a58] Zhou Chengming (1): kprobes, x86/alternatives: Use text_mutex to protect smp_alt_modules [e846d13958066828a9483d862cc8370a72fadbb6] Documentation/kernel-parameters.txt | 3 - Makefile | 4 +- arch/s390/kernel/dis.c | 4 +- arch/x86/include/asm/alternative.h | 4 +- arch/x86/kernel/alternative.c | 129 +++------- arch/x86/kernel/smpboot.c | 20 +- arch/x86/kvm/svm.c | 7 + arch/x86/kvm/vmx.c | 4 + arch/x86/kvm/x86.c | 5 +- arch/x86/kvm/x86.h | 2 + arch/x86/lib/x86-opcode-map.txt | 2 +- arch/x86/mm/kaiser.c | 5 +- arch/x86/xen/smp.c | 6 +- block/blk-core.c | 3 + drivers/char/tpm/tpm.c | 6 + drivers/infiniband/hw/mlx4/qp.c | 2 +- drivers/infiniband/ulp/srp/ib_srp.c | 23 +- drivers/input/misc/adxl34x.c | 2 +- drivers/md/dm-bufio.c | 15 +- drivers/md/dm-table.c | 32 ++- drivers/md/dm.c | 12 +- drivers/media/rc/ir-lirc-codec.c | 9 +- drivers/media/video/cx231xx/cx231xx-cards.c | 3 +- drivers/media/video/omap/omap_vout.c | 3 +- drivers/mtd/nand/nand_base.c | 9 +- drivers/net/wireless/rt2x00/rt2x00usb.c | 6 +- drivers/pci/pcie/aer/aerdrv_core.c | 9 +- drivers/rtc/interface.c | 16 +- drivers/scsi/bfa/bfad_debugfs.c | 5 +- drivers/staging/media/as102/as102_fw.c | 28 ++- drivers/staging/usbip/stub_rx.c | 58 +++-- drivers/staging/usbip/stub_tx.c | 7 + drivers/staging/usbip/usbip_common.h | 1 + .../staging/usbip/userspace/libsrc/usbip_common.c | 2 +- .../staging/usbip/userspace/libsrc/vhci_driver.c | 8 +- drivers/staging/usbip/vhci_hcd.c | 39 --- drivers/staging/usbip/vhci_sysfs.c | 20 +- drivers/usb/core/devio.c | 14 ++ drivers/usb/core/quirks.c | 3 + drivers/usb/serial/garmin_gps.c | 22 +- drivers/video/udlfb.c | 10 +- fs/9p/vfs_inode.c | 3 + fs/9p/vfs_inode_dotl.c | 3 + fs/autofs4/waitq.c | 45 +++- fs/coda/upcall.c | 3 +- fs/ecryptfs/messaging.c | 8 +- fs/isofs/isofs.h | 2 +- fs/isofs/rock.h | 2 +- fs/isofs/util.c | 2 +- fs/nfs/nfs4proc.c | 18 +- fs/nilfs2/segment.c | 6 +- fs/ocfs2/alloc.c | 2 +- fs/ocfs2/file.c | 18 +- include/linux/blkdev.h | 1 + include/linux/usb/ch9.h | 19 ++ include/net/sctp/sctp.h | 2 + include/net/sctp/structs.h | 8 +- kernel/cpu.c | 11 - kernel/extable.c | 2 + kernel/trace/blktrace.c | 76 ++++-- net/9p/client.c | 3 +- net/9p/trans_virtio.c | 13 +- net/l2tp/l2tp_core.c | 42 ++-- net/l2tp/l2tp_core.h | 3 + net/l2tp/l2tp_eth.c | 96 +++++-- net/l2tp/l2tp_ppp.c | 276 ++++++++++++--------- net/netfilter/xt_TCPMSS.c | 43 ++-- net/netfilter/xt_TCPOPTSTRIP.c | 19 +- net/rds/rdma.c | 4 + net/sctp/ipv6.c | 160 ++++++------ net/sctp/protocol.c | 12 +- net/sctp/socket.c | 33 ++- net/sctp/transport.c | 4 +- net/sctp/ulpevent.c | 2 +- sound/core/seq/seq_clientmgr.c | 10 +- sound/core/seq/seq_clientmgr.h | 1 + sound/core/timer_compat.c | 12 +- sound/pci/hda/hda_intel.c | 3 + sound/usb/clock.c | 9 +- sound/usb/mixer.c | 19 +- 80 files changed, 916 insertions(+), 641 deletions(-) -- Ben Hutchings Sturgeon's Law: Ninety percent of everything is crap.

6 years, 11 months

4
82
0 0

[Linux-stable-mirror] [PATCH -mm -v3] mm, swap, frontswap: Fix THP swap if frontswap enabled

by Huang, Ying

From: Huang Ying <huang.ying.caritas(a)gmail.com> It was reported by Sergey Senozhatsky that if THP (Transparent Huge Page) and frontswap (via zswap) are both enabled, when memory goes low so that swap is triggered, segfault and memory corruption will occur in random user space applications as follow, kernel: urxvt[338]: segfault at 20 ip 00007fc08889ae0d sp 00007ffc73a7fc40 error 6 in libc-2.26.so[7fc08881a000+1ae000] #0 0x00007fc08889ae0d _int_malloc (libc.so.6) #1 0x00007fc08889c2f3 malloc (libc.so.6) #2 0x0000560e6004bff7 _Z14rxvt_wcstoutf8PKwi (urxvt) #3 0x0000560e6005e75c n/a (urxvt) #4 0x0000560e6007d9f1 _ZN16rxvt_perl_interp6invokeEP9rxvt_term9hook_typez (urxvt) #5 0x0000560e6003d988 _ZN9rxvt_term9cmd_parseEv (urxvt) #6 0x0000560e60042804 _ZN9rxvt_term6pty_cbERN2ev2ioEi (urxvt) #7 0x0000560e6005c10f _Z17ev_invoke_pendingv (urxvt) #8 0x0000560e6005cb55 ev_run (urxvt) #9 0x0000560e6003b9b9 main (urxvt) #10 0x00007fc08883af4a __libc_start_main (libc.so.6) #11 0x0000560e6003f9da _start (urxvt) After bisection, it was found the first bad commit is bd4c82c22c367e068 ("mm, THP, swap: delay splitting THP after swapped out"). The root cause is as follow. When the pages are written to swap device during swapping out in swap_writepage(), zswap (fontswap) is tried to compress the pages instead to improve the performance. But zswap (frontswap) will treat THP as normal page, so only the head page is saved. After swapping in, tail pages will not be restored to its original contents, so cause the memory corruption in the applications. This is fixed via rejecting to save page in frontswap store functions if the page is a THP. So that the THP will be swapped out to swap device. Another choice is to split THP if frontswap is enabled. But it is found that the frontswap enabling isn't flexible. For example, if CONFIG_ZSWAP=y (cannot be module), frontswap will be enabled even if zswap itself isn't enabled. Frontswap has multiple backends, to make it easy for one backend to enable THP support, the THP checking is put in backend frontswap store functions instead of the general interfaces. Fixes: bd4c82c22c367e068 ("mm, THP, swap: delay splitting THP after swapped out") Reported-by: Sergey Senozhatsky <sergey.senozhatsky(a)gmail.com> Tested-by: Sergey Senozhatsky <sergey.senozhatsky(a)gmail.com> Suggested-by: Minchan Kim <minchan(a)kernel.org> # put THP checking in backend Signed-off-by: "Huang, Ying" <ying.huang(a)intel.com> Cc: Konrad Rzeszutek Wilk <konrad.wilk(a)oracle.com> Cc: Dan Streetman <ddstreet(a)ieee.org> Cc: Seth Jennings <sjenning(a)redhat.com> Cc: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Cc: Shaohua Li <shli(a)kernel.org> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Mel Gorman <mgorman(a)techsingularity.net> Cc: Shakeel Butt <shakeelb(a)google.com> Cc: Boris Ostrovsky <boris.ostrovsky(a)oracle.com> Cc: Juergen Gross <jgross(a)suse.com> Cc: stable(a)vger.kernel.org # 4.14 Changelog: v3: - Fix via checking THP in frontswap backend as suggested by Minchan. v2: - Move frontswap check into swapfile.c to avoid to make vmscan.c depends on frontswap as suggested by Minchan. --- drivers/xen/tmem.c | 4 ++++ mm/zswap.c | 6 ++++++ 2 files changed, 10 insertions(+) diff --git a/drivers/xen/tmem.c b/drivers/xen/tmem.c index bf13d1ec51f3..04e7b3b29bac 100644 --- a/drivers/xen/tmem.c +++ b/drivers/xen/tmem.c @@ -284,6 +284,10 @@ static int tmem_frontswap_store(unsigned type, pgoff_t offset, int pool = tmem_frontswap_poolid; int ret; + /* THP isn't supported */ + if (PageTransHuge(page)) + return -1; + if (pool < 0) return -1; if (ind64 != ind) diff --git a/mm/zswap.c b/mm/zswap.c index c004aa4fd3f4..61a5c41972db 100644 --- a/mm/zswap.c +++ b/mm/zswap.c @@ -1007,6 +1007,12 @@ static int zswap_frontswap_store(unsigned type, pgoff_t offset, u8 *src, *dst; struct zswap_header zhdr = { .swpentry = swp_entry(type, offset) }; + /* THP isn't supported */ + if (PageTransHuge(page)) { + ret = -EINVAL; + goto reject; + } + if (!zswap_enabled || !tree) { ret = -ENODEV; goto reject; -- 2.15.1

6 years, 11 months

3
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror February 2018