I'm announcing the release of the 4.19.14 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Aaro Koskinen (1):
MIPS: OCTEON: mark RGMII interface disabled on OCTEON III
Adrian Hunter (4):
perf machine: Record if a arch has a single user/kernel address space
perf thread: Add fallback functions for cases where cpumode is insufficient
perf tools: Use fallback for sample_addr_correlates_sym() cases
perf script: Use fallbacks for branch stacks
Alaa Hleihel (1):
net/mlx5e: Remove the false indication of software timestamping support
Alexey Brodkin (1):
clocksource/drivers/arc_timer: Utilize generic sched_clock
Allan W. Nielsen (1):
mscc: Configured MAC entries should be locked.
Anand Jain (2):
btrfs: dev-replace: go back to suspended state if target device is missing
btrfs: dev-replace: go back to suspend state if another EXCL_OP is running
Antoine Tenart (2):
net: mvpp2: 10G modes aren't supported on all ports
net: mvpp2: fix the phylink mode validation
Arnaldo Carvalho de Melo (1):
perf env: Also consider env->arch == NULL as local operation
Arnd Bergmann (1):
mtd: atmel-quadspi: disallow building on ebsa110
Atul Gupta (1):
crypto: chcr - small packet Tx stalls the queue
Ben Hutchings (1):
perf pmu: Suppress potential format-truncation warning
Boris Brezillon (1):
mtd: rawnand: omap2: Pass the parent of pdev to dma_request_chan()
Breno Leitao (1):
powerpc/tm: Unset MSR[TS] if not recheckpointing
Christoffer Dall (1):
KVM: arm/arm64: vgic-v2: Set active_source to 0 when restoring state
Christophe JAILLET (1):
net/ipv6: Fix a test against 'ipv6_find_idev()' return value
Claudiu Beznea (1):
net: macb: restart tx after tx used bit read
Colin Ian King (1):
staging: wilc1000: fix missing read_write setting when reading data
Cong Wang (11):
ax25: fix a use-after-free in ax25_fillin_cb()
ipv6: explicitly initialize udp6_addr in udp_sock_create6()
netrom: fix locking in nr_find_socket()
net/wan: fix a double free in x25_asy_open_tty()
ptr_ring: wrap back ->producer in __ptr_ring_swap_queue()
tipc: check tsk->group in tipc_wait_for_cond()
tipc: compare remote and local protocols in tipc_udp_enable()
tipc: fix a double free in tipc_enable_bearer()
tipc: fix a double kfree_skb()
tipc: use lock_sock() in tipc_sk_reinit()
tipc: check group dests after tipc_wait_for_cond()
Dan Carpenter (1):
net: stmmac: Fix an error code in probe()
Dan Williams (2):
x86/mm: Drop usage of __flush_tlb_all() in kernel_physical_mapping_init()
dax: Use non-exclusive wait in wait_entry_unlocked()
Davide Caratti (1):
net: Use __kernel_clockid_t in uapi net_stamp.h
Deepa Dinamani (1):
sock: Make sock->sk_stamp thread-safe
Diana Craciun (1):
powerpc/fsl: Fix spectre_v2 mitigations reporting
Dmitry Eremin-Solenikov (2):
crypto: testmgr - add AES-CFB tests
crypto: cfb - fix decryption
Eric Anholt (1):
drm/v3d: Skip debugfs dumping GCA on platforms without GCA.
Eric Dumazet (5):
ipv6: tunnels: fix two use-after-free
isdn: fix kernel-infoleak in capi_unlocked_ioctl
net: clear skb->tstamp in forwarding paths
net/hamradio/6pack: use mod_timer() to rearm timers
tcp: fix a race in inet_diag_dump_icsk()
Eugeniy Paltsev (1):
DRM: UDL: get rid of useless vblank initialization
Filipe Manana (2):
Btrfs: fix fsync of files with multiple hard links in new directories
Btrfs: send, fix race with transaction commits that create snapshots
Ganesh Goudar (1):
net/tls: allocate tls context using GFP_ATOMIC
Georgy A Bystrenin (1):
CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem
Greg Kroah-Hartman (1):
Linux 4.19.14
Greg Kurz (2):
ocxl: Fix endiannes bug in ocxl_link_update_pe()
ocxl: Fix endiannes bug in read_afu_name()
Gustavo A. R. Silva (7):
ip6mr: Fix potential Spectre v1 vulnerability
ipv4: Fix potential Spectre v1 vulnerability
ALSA: rme9652: Fix potential Spectre v1 vulnerability
ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities
ALSA: pcm: Fix potential Spectre v1 vulnerability
ALSA: emux: Fix potential Spectre v1 vulnerabilities
KVM: arm/arm64: vgic: Fix off-by-one bug in vgic_get_irq()
Hans Verkuil (5):
media: cec: keep track of outstanding transmits
media: cec-pin: fix broken tx_ignore_nack_until_eom error injection
media: vivid: free bitmap_cap when updating std/timings/etc.
media: vb2: check memory model for VIDIOC_CREATE_BUFS
media: v4l2-tpg: array index could become negative
Hans de Goede (2):
ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for Chromebook Clapper
ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for Chromebook Gnawty
Heikki Krogerus (1):
usb: roles: Add a description for the class to Kconfig
Heiner Kallweit (1):
r8169: fix WoL device wakeup enable
Herbert Xu (1):
ipv6: frags: Fix bogus skb->sk in reassembled packets
Huacai Chen (4):
MIPS: c-r4k: Add r4k_blast_scache_node for Loongson-3
MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()
MIPS: Align kernel load address to 64KB
MIPS: Fix a R10000_LLSC_WAR logic in atomic.h
Jaegeuk Kim (1):
f2fs: sanity check of xattr entry size
Jason Wang (1):
vhost: make sure used idx is seen before log in vhost_add_used_n()
Jernej Skrabec (1):
clk: sunxi-ng: Use u64 for calculation of NM rate
Jia-Ju Bai (1):
usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable()
Jian-Hong Pan (1):
ALSA: hda/realtek: Enable the headset mic auto detection for ASUS laptops
Johan Jonker (1):
clk: rockchip: fix typo in rk3188 spdif_frac parent
Jorgen Hansen (1):
VSOCK: Send reset control packet when socket is partially bound
Josef Bacik (1):
btrfs: run delayed items before dropping the snapshot
Juergen Gross (1):
xen/netfront: tolerate frags with no data
Julien Thierry (1):
KVM: arm/arm64: vgic: Do not cond_resched_lock() with IRQs disabled
Jörgen Storvist (4):
qmi_wwan: Added support for Fibocom NL668 series
qmi_wwan: Added support for Telit LN940 series
qmi_wwan: Add support for Fibocom NL678 series
USB: serial: option: add Fibocom NL678 series
Kunihiko Hayashi (1):
net: phy: Fix the issue that netif always links up after resuming
Lorenzo Bianconi (1):
gro_cell: add napi_disable in gro_cells_destroy
Lu Fengqi (1):
btrfs: skip file_extent generation check for free_space_inode in run_delalloc_nocow
Luca Ceresoli (1):
media: imx274: fix stack corruption in imx274_read_reg
Lukas Wunner (4):
spi: bcm2835: Fix race on DMA termination
spi: bcm2835: Fix book-keeping of DMA termination
spi: bcm2835: Avoid finishing transfer prematurely in IRQ mode
spi: bcm2835: Unbreak the build of esoteric configs
Lyude Paul (1):
brcmfmac: Fix out of bounds memory access during fw load
Maciej W. Rozycki (1):
rtc: m41t80: Correct alarm month range with RTC reads
Macpaul Lin (1):
cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.
Malcolm Priestley (1):
media: dvb-usb-v2: Fix incorrect use of transfer_flags URB_FREE_BUFFER
Mantas Mikulėnas (1):
ALSA: hda: add mute LED support for HP EliteBook 840 G4
Marc Zyngier (3):
arm64: KVM: Make VHE Stage-2 TLB invalidation operations non-interruptible
arm/arm64: KVM: vgic: Force VM halt when changing the active state of GICv3 PPIs/SGIs
KVM: arm/arm64: vgic: Cap SPIs to the VM-defined maximum
Marcin Wojtas (1):
net: mvneta: fix operation for 64K PAGE_SIZE
Martin Blumenstingl (2):
usb: dwc2: disable power_down on Amlogic devices
f2fs: fix validation of the block count in sanity_check_raw_super
Matthew Wilcox (1):
dax: Don't access a freed inode
Maurizio Lombardi (1):
ext4: missing unlock/put_page() in ext4_try_to_write_inline_data()
Michael J. Ruhl (1):
IB/hfi1: Incorrect sizing of sge for PIO will OOPs
Michal Hocko (1):
x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off
Michal Kubecek (1):
net: ipv4: do not handle duplicate fragments as overlapping
Mikhael Goikhman (1):
net/mlx5e: Remove unused UDP GSO remaining counter
Miquel Raynal (2):
mtd: rawnand: marvell: prevent timeouts on a loaded machine
platform-msi: Free descriptors in platform_msi_domain_free()
Moshe Shemesh (1):
net/mlx5e: RX, Verify MPWQE stride size is in range
Myungho Jung (1):
net/smc: fix TCP fallback socket release
Nava kishore Manne (1):
serial: uartps: Fix interrupt mask issue to handle the RX interrupts properly
Pan Bian (2):
ext4: fix possible use after free in ext4_quota_enable
f2fs: read page index before freeing
Patrick Dreyer (1):
Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G
Paul Aurich (1):
smb3: fix large reads on encrypted connections
Paul Burton (3):
MIPS: math-emu: Write-protect delay slot emulation pages
MIPS: Expand MIPS32 ASIDs to 64 bits
MIPS: Only include mmzone.h when CONFIG_NEED_MULTIPLE_NODES=y
Pieter Jansen van Vuuren (1):
nfp: flower: ensure TCP flags can be placed in IPv6 frame
Robin Murphy (1):
iommu/arm-smmu-v3: Fix big-endian CMD_SYNC writes
Sameer Pujar (1):
ALSA: hda/tegra: clear pending irq handlers
Sanjeev Chugh (1):
Input: atmel_mxt_ts - don't try to free unallocated kernel memory
Scott Chen (1):
USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
Sean Christopherson (2):
KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
KVM: nVMX: Free the VMREAD/VMWRITE bitmaps if alloc_kvm_area() fails
Sean Young (1):
media: rc: cec devices do not have a lirc chardev
Sebastian Ott (1):
s390/pci: fix sleeping in atomic during hotplug
Shalom Toledo (1):
mlxsw: core: Increase timeout during firmware flash process
Stefano Brivio (1):
ipv6: route: Fix return value of ip6_neigh_lookup() on neigh_create() error
Stephan Gerhold (1):
Revert "usb: dwc3: pci: Use devm functions to get the phy GPIOs"
Steven Rostedt (VMware) (1):
tools lib traceevent: Fix processing of dereferenced args in bprintk events
Stijn Tintel (1):
brcmfmac: fix roamoff=1 modparam
Sudarsana Reddy Kalluru (1):
qed: Fix command number mismatch between driver and the mfw
Sylwester Nawrocki (1):
ARM: dts: exynos: Specify I2S assigned clocks in proper node
Takashi Sakamoto (4):
ALSA: fireface: fix for state to fetch PCM frames
ALSA: firewire-lib: fix wrong handling payload_length as payload_quadlet
ALSA: firewire-lib: fix wrong assignment for 'out_packet_without_header' tracepoint
ALSA: firewire-lib: use the same print format for 'without_header' tracepoints
Tal Gilboa (1):
net/mlx5e: Cancel DIM work on close SQ
Tariq Toukan (1):
net/mlx5e: RX, Fix wrong early return in receive queue poll
Tejun Heo (1):
cgroup: fix CSS_TASK_ITER_PROCS
Terin Stock (1):
usb: dwc2: host: use hrtimer for NAK retries
Theodore Ts'o (5):
ext4: add ext4_sb_bread() to disambiguate ENOMEM cases
ext4: include terminating u32 in size of xattr entries when expanding inodes
ext4: avoid declaring fs inconsistent due to invalid file handles
ext4: force inode writes when nfsd calls commit_metadata()
ext4: check for shutdown and r/o file system in ext4_write_inode()
Tomas Winkler (2):
tpm: tpm_try_transmit() refactor error flow.
tpm: tpm_i2c_nuvoton: use correct command duration for TPM 2.x
Tyrel Datwyler (1):
ibmveth: fix DMA unmap error in ibmveth_xmit_start error path
Wandrille RONCE (1):
ALSA: hda/realtek: Enable audio jacks of ASUS UX391UA with ALC294
Wenwen Wang (1):
crypto: cavium/nitrox - fix a DMA pool free failure
Will Deacon (2):
arm64: KVM: Avoid setting the upper 32 bits of VTCR_EL2 to 1
arm64: compat: Avoid sending SIGILL for unallocated syscall numbers
Willem de Bruijn (4):
ieee802154: lowpan_header_create check must check daddr
ip: validate header length on virtual device xmit
packet: validate address length
packet: validate address length if non-zero
Xin Long (1):
sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
Yuval Avnery (1):
net/mlx5: Typo fix in del_sw_hw_rule
ruippan (潘睿) (1):
ext4: fix EXT4_IOC_GROUP_ADD ioctl
The patch titled
Subject: mm: page_mapped: don't assume compound page is huge or THP
has been removed from the -mm tree. Its filename was
mm-page_mapped-dont-assume-compound-page-is-huge-or-thp.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Jan Stancek <jstancek(a)redhat.com>
Subject: mm: page_mapped: don't assume compound page is huge or THP
LTP proc01 testcase has been observed to rarely trigger crashes
on arm64:
page_mapped+0x78/0xb4
stable_page_flags+0x27c/0x338
kpageflags_read+0xfc/0x164
proc_reg_read+0x7c/0xb8
__vfs_read+0x58/0x178
vfs_read+0x90/0x14c
SyS_read+0x60/0xc0
Issue is that page_mapped() assumes that if compound page is not huge,
then it must be THP. But if this is 'normal' compound page
(COMPOUND_PAGE_DTOR), then following loop can keep running (for
HPAGE_PMD_NR iterations) until it tries to read from memory that isn't
mapped and triggers a panic:
for (i = 0; i < hpage_nr_pages(page); i++) {
if (atomic_read(&page[i]._mapcount) >= 0)
return true;
}
I could replicate this on x86 (v4.20-rc4-98-g60b548237fed) only
with a custom kernel module [1] which:
- allocates compound page (PAGEC) of order 1
- allocates 2 normal pages (COPY), which are initialized to 0xff
(to satisfy _mapcount >= 0)
- 2 PAGEC page structs are copied to address of first COPY page
- second page of COPY is marked as not present
- call to page_mapped(COPY) now triggers fault on access to 2nd
COPY page at offset 0x30 (_mapcount)
[1] https://github.com/jstancek/reproducers/blob/master/kernel/page_mapped_cras…
Fix the loop to iterate for "1 << compound_order" pages.
Kirrill said "IIRC, sound subsystem can producuce custom mapped compound
pages".
Link: http://lkml.kernel.org/r/c440d69879e34209feba21e12d236d06bc0a25db.154357715…
Fixes: e1534ae95004 ("mm: differentiate page_mapped() from page_mapcount() for compound pages")
Signed-off-by: Jan Stancek <jstancek(a)redhat.com>
Debugged-by: Laszlo Ersek <lersek(a)redhat.com>
Suggested-by: "Kirill A. Shutemov" <kirill(a)shutemov.name>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Reviewed-by: David Hildenbrand <david(a)redhat.com>
Reviewed-by: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/util.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/util.c~mm-page_mapped-dont-assume-compound-page-is-huge-or-thp
+++ a/mm/util.c
@@ -478,7 +478,7 @@ bool page_mapped(struct page *page)
return true;
if (PageHuge(page))
return false;
- for (i = 0; i < hpage_nr_pages(page); i++) {
+ for (i = 0; i < (1 << compound_order(page)); i++) {
if (atomic_read(&page[i]._mapcount) >= 0)
return true;
}
_
Patches currently in -mm which might be from jstancek(a)redhat.com are
The patch titled
Subject: mm, memcg: fix reclaim deadlock with writeback
has been removed from the -mm tree. Its filename was
mm-memcg-fix-reclaim-deadlock-with-writeback.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Michal Hocko <mhocko(a)suse.com>
Subject: mm, memcg: fix reclaim deadlock with writeback
Liu Bo has experienced a deadlock between memcg (legacy) reclaim and the
ext4 writeback
task1:
[<ffffffff811aaa52>] wait_on_page_bit+0x82/0xa0
[<ffffffff811c5777>] shrink_page_list+0x907/0x960
[<ffffffff811c6027>] shrink_inactive_list+0x2c7/0x680
[<ffffffff811c6ba4>] shrink_node_memcg+0x404/0x830
[<ffffffff811c70a8>] shrink_node+0xd8/0x300
[<ffffffff811c73dd>] do_try_to_free_pages+0x10d/0x330
[<ffffffff811c7865>] try_to_free_mem_cgroup_pages+0xd5/0x1b0
[<ffffffff8122df2d>] try_charge+0x14d/0x720
[<ffffffff812320cc>] memcg_kmem_charge_memcg+0x3c/0xa0
[<ffffffff812321ae>] memcg_kmem_charge+0x7e/0xd0
[<ffffffff811b68a8>] __alloc_pages_nodemask+0x178/0x260
[<ffffffff8120bff5>] alloc_pages_current+0x95/0x140
[<ffffffff81074247>] pte_alloc_one+0x17/0x40
[<ffffffff811e34de>] __pte_alloc+0x1e/0x110
[<ffffffffa06739de>] alloc_set_pte+0x5fe/0xc20
[<ffffffff811e5d93>] do_fault+0x103/0x970
[<ffffffff811e6e5e>] handle_mm_fault+0x61e/0xd10
[<ffffffff8106ea02>] __do_page_fault+0x252/0x4d0
[<ffffffff8106ecb0>] do_page_fault+0x30/0x80
[<ffffffff8171bce8>] page_fault+0x28/0x30
[<ffffffffffffffff>] 0xffffffffffffffff
task2:
[<ffffffff811aadc6>] __lock_page+0x86/0xa0
[<ffffffffa02f1e47>] mpage_prepare_extent_to_map+0x2e7/0x310 [ext4]
[<ffffffffa08a2689>] ext4_writepages+0x479/0xd60
[<ffffffff811bbede>] do_writepages+0x1e/0x30
[<ffffffff812725e5>] __writeback_single_inode+0x45/0x320
[<ffffffff81272de2>] writeback_sb_inodes+0x272/0x600
[<ffffffff81273202>] __writeback_inodes_wb+0x92/0xc0
[<ffffffff81273568>] wb_writeback+0x268/0x300
[<ffffffff81273d24>] wb_workfn+0xb4/0x390
[<ffffffff810a2f19>] process_one_work+0x189/0x420
[<ffffffff810a31fe>] worker_thread+0x4e/0x4b0
[<ffffffff810a9786>] kthread+0xe6/0x100
[<ffffffff8171a9a1>] ret_from_fork+0x41/0x50
[<ffffffffffffffff>] 0xffffffffffffffff
He adds
: task1 is waiting for the PageWriteback bit of the page that task2 has
: collected in mpd->io_submit->io_bio, and tasks2 is waiting for the LOCKED
: bit the page which tasks1 has locked.
More precisely task1 is handling a page fault and it has a page locked
while it charges a new page table to a memcg. That in turn hits a memory
limit reclaim and the memcg reclaim for legacy controller is waiting on
the writeback but that is never going to finish because the writeback
itself is waiting for the page locked in the #PF path. So this is
essentially ABBA deadlock:
lock_page(A)
SetPageWriteback(A)
unlock_page(A)
lock_page(B)
lock_page(B)
pte_alloc_pne
shrink_page_list
wait_on_page_writeback(A)
SetPageWriteback(B)
unlock_page(B)
# flush A, B to clear the writeback
This accumulating of more pages to flush is used by several filesystems to
generate a more optimal IO patterns.
Waiting for the writeback in legacy memcg controller is a workaround for
pre-mature OOM killer invocations because there is no dirty IO throttling
available for the controller. There is no easy way around that
unfortunately. Therefore fix this specific issue by pre-allocating the
page table outside of the page lock. We have that handy infrastructure
for that already so simply reuse the fault-around pattern which already
does this.
There are probably other hidden __GFP_ACCOUNT | GFP_KERNEL allocations
from under a fs page locked but they should be really rare. I am not
aware of a better solution unfortunately.
[akpm(a)linux-foundation.org: fix mm/memory.c:__do_fault()]
[akpm(a)linux-foundation.org: coding-style fixes]
[mhocko(a)kernel.org: enhance comment, per Johannes]
Link: http://lkml.kernel.org/r/20181214084948.GA5624@dhcp22.suse.cz
Link: http://lkml.kernel.org/r/20181213092221.27270-1-mhocko@kernel.org
Fixes: c3b94f44fcb0 ("memcg: further prevent OOM with too many dirty pages")
Signed-off-by: Michal Hocko <mhocko(a)suse.com>
Reported-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Debugged-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Acked-by: Johannes Weiner <hannes(a)cmpxchg.org>
Reviewed-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Cc: Jan Kara <jack(a)suse.cz>
Cc: Dave Chinner <david(a)fromorbit.com>
Cc: Theodore Ts'o <tytso(a)mit.edu>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memory.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--- a/mm/memory.c~mm-memcg-fix-reclaim-deadlock-with-writeback
+++ a/mm/memory.c
@@ -2994,6 +2994,28 @@ static vm_fault_t __do_fault(struct vm_f
struct vm_area_struct *vma = vmf->vma;
vm_fault_t ret;
+ /*
+ * Preallocate pte before we take page_lock because this might lead to
+ * deadlocks for memcg reclaim which waits for pages under writeback:
+ * lock_page(A)
+ * SetPageWriteback(A)
+ * unlock_page(A)
+ * lock_page(B)
+ * lock_page(B)
+ * pte_alloc_pne
+ * shrink_page_list
+ * wait_on_page_writeback(A)
+ * SetPageWriteback(B)
+ * unlock_page(B)
+ * # flush A, B to clear the writeback
+ */
+ if (pmd_none(*vmf->pmd) && !vmf->prealloc_pte) {
+ vmf->prealloc_pte = pte_alloc_one(vmf->vma->vm_mm);
+ if (!vmf->prealloc_pte)
+ return VM_FAULT_OOM;
+ smp_wmb(); /* See comment in __pte_alloc() */
+ }
+
ret = vma->vm_ops->fault(vmf);
if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY |
VM_FAULT_DONE_COW)))
_
Patches currently in -mm which might be from mhocko(a)suse.com are
The patch titled
Subject: mm/usercopy.c: no check page span for stack objects
has been removed from the -mm tree. Its filename was
usercopy-no-check-page-span-for-stack-objects.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Qian Cai <cai(a)lca.pw>
Subject: mm/usercopy.c: no check page span for stack objects
It is easy to trigger this with CONFIG_HARDENED_USERCOPY_PAGESPAN=y,
usercopy: Kernel memory overwrite attempt detected to spans multiple
pages (offset 0, size 23)!
kernel BUG at mm/usercopy.c:102!
For example,
print_worker_info
char name[WQ_NAME_LEN] = { };
char desc[WORKER_DESC_LEN] = { };
probe_kernel_read(name, wq->name, sizeof(name) - 1);
probe_kernel_read(desc, worker->desc, sizeof(desc) - 1);
__copy_from_user_inatomic
check_object_size
check_heap_object
check_page_span
This is because on-stack variables could cross PAGE_SIZE boundary, and
failed this check,
if (likely(((unsigned long)ptr & (unsigned long)PAGE_MASK) ==
((unsigned long)end & (unsigned long)PAGE_MASK)))
ptr = FFFF889007D7EFF8
end = FFFF889007D7F00E
Hence, fix it by checking if it is a stack object first.
[keescook(a)chromium.org: improve comments after reorder]
Link: http://lkml.kernel.org/r/20190103165151.GA32845@beast
Link: http://lkml.kernel.org/r/20181231030254.99441-1-cai@lca.pw
Signed-off-by: Qian Cai <cai(a)lca.pw>
Signed-off-by: Kees Cook <keescook(a)chromium.org>
Acked-by: Kees Cook <keescook(a)chromium.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/usercopy.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/mm/usercopy.c~usercopy-no-check-page-span-for-stack-objects
+++ a/mm/usercopy.c
@@ -247,7 +247,8 @@ static DEFINE_STATIC_KEY_FALSE_RO(bypass
/*
* Validates that the given object is:
* - not bogus address
- * - known-safe heap or stack object
+ * - fully contained by stack (or stack frame, when available)
+ * - fully within SLAB object (or object whitelist area, when available)
* - not in kernel text
*/
void __check_object_size(const void *ptr, unsigned long n, bool to_user)
@@ -262,9 +263,6 @@ void __check_object_size(const void *ptr
/* Check for invalid addresses. */
check_bogus_address((const unsigned long)ptr, n, to_user);
- /* Check for bad heap object. */
- check_heap_object(ptr, n, to_user);
-
/* Check for bad stack object. */
switch (check_stack_object(ptr, n)) {
case NOT_STACK:
@@ -282,6 +280,9 @@ void __check_object_size(const void *ptr
usercopy_abort("process stack", NULL, to_user, 0, n);
}
+ /* Check for bad heap object. */
+ check_heap_object(ptr, n, to_user);
+
/* Check for object in kernel to avoid text exposure. */
check_kernel_text_object((const unsigned long)ptr, n, to_user);
}
_
Patches currently in -mm which might be from cai(a)lca.pw are
mm-page_owner-fix-for-deferred-struct-page-init.patch
page_poison-plays-nicely-with-kasan.patch
signal-allow-the-null-signal-in-rt_sigqueueinfo.patch
The patch titled
Subject: slab: alien caches must not be initialized if the allocation of the alien cache failed
has been removed from the -mm tree. Its filename was
slab-alien-caches-must-not-be-initialized-if-the-allocation-of-the-alien-cache-failed.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Christoph Lameter <cl(a)linux.com>
Subject: slab: alien caches must not be initialized if the allocation of the alien cache failed
Callers of __alloc_alien() check for NULL. We must do the same check in
__alloc_alien_cache to avoid NULL pointer dereferences on allocation
failures.
Link: http://lkml.kernel.org/r/010001680f42f192-82b4e12e-1565-4ee0-ae1f-1e9897490…
Fixes: 49dfc304ba241 ("slab: use the lock on alien_cache, instead of the lock on array_cache")
Fixes: c8522a3a5832b ("Slab: introduce alloc_alien")
Signed-off-by: Christoph Lameter <cl(a)linux.com>
Reported-by: syzbot+d6ed4ec679652b4fd4e4(a)syzkaller.appspotmail.com
Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Pekka Enberg <penberg(a)kernel.org>
Cc: David Rientjes <rientjes(a)google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/slab.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/mm/slab.c~slab-alien-caches-must-not-be-initialized-if-the-allocation-of-the-alien-cache-failed
+++ a/mm/slab.c
@@ -666,8 +666,10 @@ static struct alien_cache *__alloc_alien
struct alien_cache *alc = NULL;
alc = kmalloc_node(memsize, gfp, node);
- init_arraycache(&alc->ac, entries, batch);
- spin_lock_init(&alc->lock);
+ if (alc) {
+ init_arraycache(&alc->ac, entries, batch);
+ spin_lock_init(&alc->lock);
+ }
return alc;
}
_
Patches currently in -mm which might be from cl(a)linux.com are
The patch titled
Subject: fork, memcg: fix cached_stacks case
has been removed from the -mm tree. Its filename was
fork-memcg-fix-cached_stacks-case.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Shakeel Butt <shakeelb(a)google.com>
Subject: fork, memcg: fix cached_stacks case
5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on memcg charge
fail") fixes a crash caused due to failed memcg charge of the kernel
stack. However the fix misses the cached_stacks case which this patch
fixes. So, the same crash can happen if the memcg charge of a cached
stack is failed.
Link: http://lkml.kernel.org/r/20190102180145.57406-1-shakeelb@google.com
Fixes: 5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on memcg charge fail")
Signed-off-by: Shakeel Butt <shakeelb(a)google.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Acked-by: Rik van Riel <riel(a)surriel.com>
Cc: Rik van Riel <riel(a)surriel.com>
Cc: Roman Gushchin <guro(a)fb.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Tejun Heo <tj(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
kernel/fork.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/fork.c~fork-memcg-fix-cached_stacks-case
+++ a/kernel/fork.c
@@ -217,6 +217,7 @@ static unsigned long *alloc_thread_stack
memset(s->addr, 0, THREAD_SIZE);
tsk->stack_vm_area = s;
+ tsk->stack = s->addr;
return s->addr;
}
_
Patches currently in -mm which might be from shakeelb(a)google.com are
memcg-localize-memcg_kmem_enabled-check.patch
memcg-schedule-high-reclaim-for-remote-memcgs-on-high_work.patch