October 2019 - Linux-stable-mirror

by CKI Project

Hello, We ran automated tests on a patchset that was proposed for merging into this kernel tree. The patches were applied to: Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Commit: 52020d3f6633 - Linux 5.3.5 The results of these automated tests are provided below. Overall result: FAILED (see details below) Merge: OK Compile: FAILED All kernel binaries, config files, and logs are available for download here: https://artifacts.cki-project.org/pipelines/214001 We attempted to compile the kernel for multiple architectures, but the compile failed on one or more architectures: aarch64: FAILED (see build-aarch64.log.xz attachment) ppc64le: FAILED (see build-ppc64le.log.xz attachment) x86_64: FAILED (see build-x86_64.log.xz attachment) We hope that these logs can help you find the problem quickly. For the full detail on our testing procedures, please scroll to the bottom of this message. Please reply to this email if you have any questions about the tests that we ran or if you have any suggestions on how to make future tests more effective. ,-. ,-. ( C ) ( K ) Continuous `-',-.`-' Kernel ( I ) Integration `-' ______________________________________________________________________________ Merge testing ------------- We cloned this repository and checked out the following commit: Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Commit: 52020d3f6633 - Linux 5.3.5 We grabbed the 65ceb57676c9 commit of the stable queue repository. We then merged the patchset with `git am`: s390-process-avoid-potential-reading-of-freed-stack.patch s390-sclp-fix-bit-checked-for-has_sipl.patch kvm-s390-test-for-bad-access-register-and-size-at-the-start-of-s390_mem_op.patch s390-topology-avoid-firing-events-before-kobjs-are-created.patch s390-cio-avoid-calling-strlen-on-null-pointer.patch s390-cio-exclude-subchannels-with-no-parent-from-pseudo-check.patch s390-dasd-fix-error-handling-during-online-processing.patch revert-s390-dasd-add-discard-support-for-ese-volumes.patch kvm-s390-fix-__insn32_query-inline-assembly.patch kvm-ppc-book3s-enable-xive-native-capability-only-if-opal-has-required-functions.patch kvm-ppc-book3s-hv-xive-free-escalation-interrupts-before-disabling-the-vp.patch kvm-ppc-book3s-hv-don-t-push-xive-context-when-not-using-xive-device.patch kvm-ppc-book3s-hv-fix-race-in-re-enabling-xive-escalation-interrupts.patch kvm-ppc-book3s-hv-check-for-mmu-ready-on-piggybacked-virtual-cores.patch kvm-ppc-book3s-hv-don-t-lose-pending-doorbell-request-on-migration-on-p9.patch kvm-x86-fix-userspace-set-invalid-cr4.patch nbd-fix-max-number-of-supported-devs.patch pm-devfreq-tegra-fix-khz-to-hz-conversion.patch asoc-define-a-set-of-dapm-pre-post-up-events.patch asoc-sgtl5000-improve-vag-power-and-mute-control.patch powerpc-xive-implement-get_irqchip_state-method-for-xive-to-fix-shutdown-race.patch powerpc-mce-fix-mce-handling-for-huge-pages.patch powerpc-mce-schedule-work-from-irq_work.patch powerpc-603-fix-handling-of-the-dirty-flag.patch powerpc-32s-fix-boot-failure-with-debug_pagealloc-without-kasan.patch powerpc-ptdump-fix-addresses-display-on-ppc32.patch powerpc-powernv-restrict-opal-symbol-map-to-only-be-readable-by-root.patch powerpc-pseries-fix-cpu_hotplug_lock-acquisition-in-resize_hpt.patch powerpc-powernv-ioda-fix-race-in-tce-level-allocation.patch powerpc-kasan-fix-parallel-loading-of-modules.patch powerpc-kasan-fix-shadow-area-set-up-for-modules.patch powerpc-book3s64-mm-don-t-do-tlbie-fixup-for-some-hardware-revisions.patch powerpc-book3s64-radix-rename-cpu_ftr_p9_tlbie_bug-feature-flag.patch powerpc-mm-add-a-helper-to-select-page_kernel_ro-or-page_readonly.patch powerpc-mm-fix-an-oops-in-kasan_mmu_init.patch powerpc-mm-fixup-tlbie-vs-mtpidr-mtlpidr-ordering-issue-on-power9.patch can-mcp251x-mcp251x_hw_reset-allow-more-time-after-a-reset.patch tools-lib-traceevent-fix-robust-test-of-do_generate_dynamic_list_file.patch tools-lib-traceevent-do-not-free-tep-cmdlines-in-add_new_comm-on-failure.patch crypto-qat-silence-smp_processor_id-warning.patch crypto-skcipher-unmap-pages-after-an-external-error.patch crypto-cavium-zip-add-missing-single_release.patch crypto-caam-qi-fix-error-handling-in-ern-handler.patch crypto-caam-fix-concurrency-issue-in-givencrypt-descriptor.patch crypto-ccree-account-for-tee-not-ready-to-report.patch crypto-ccree-use-the-full-crypt-length-value.patch mips-treat-loongson-extensions-as-ases.patch power-supply-sbs-battery-use-correct-flags-field.patch power-supply-sbs-battery-only-return-health-when-battery-present.patch tracing-make-sure-variable-reference-alias-has-correct-var_ref_idx.patch usercopy-avoid-highmem-pfn-warning.patch timer-read-jiffies-once-when-forwarding-base-clk.patch pci-vmd-fix-config-addressing-when-using-bus-offsets.patch pci-hv-avoid-use-of-hv_pci_dev-pci_slot-after-freeing-it.patch pci-vmd-fix-shadow-offsets-to-reflect-spec-changes.patch pci-restore-resizable-bar-size-bits-correctly-for-1mb-bars.patch selftests-tpm2-add-the-missing-test_files-assignment.patch selftests-pidfd-fix-undefined-reference-to-pthread_create.patch watchdog-imx2_wdt-fix-min-calculation-in-imx2_wdt_set_timeout.patch perf-tools-fix-segfault-in-cpu_cache_level__read.patch perf-stat-fix-a-segmentation-fault-when-using-repeat-forever.patch drm-i915-dp-fix-dsc-bpp-calculations-v5.patch drm-atomic-reject-flip_async-unconditionally.patch drm-atomic-take-the-atomic-toys-away-from-x.patch drm-mali-dp-mark-expected-switch-fall-through.patch drm-omap-fix-max-fclk-divider-for-omap36xx.patch drm-msm-dsi-fix-return-value-check-for-clk_get_parent.patch drm-nouveau-kms-nv50-don-t-create-mstms-for-edp-connectors.patch drm-amd-powerplay-change-metrics-update-period-from-1ms-to-100ms.patch drm-i915-gvt-update-vgpu-workload-head-pointer-correctly.patch drm-i915-userptr-acquire-the-page-lock-around-set_page_dirty.patch drm-i915-use-maximum-write-flush-for-pwrite_gtt.patch drm-i915-flush-extra-hard-after-writing-relocations-through-the-gtt.patch drm-i915-to-make-vgpu-ppgtt-notificaiton-as-atomic-operation.patch mac80211-keep-bhs-disabled-while-calling-drv_tx_wake_queue.patch mmc-tegra-implement-set_dma_mask.patch mmc-sdhci-improve-adma-error-reporting.patch mmc-sdhci-of-esdhc-set-dma-snooping-based-on-dma-coherence.patch mmc-sdhci-let-drivers-define-their-dma-mask.patch revert-locking-pvqspinlock-don-t-wait-if-vcpu-is-preempted.patch libnvdimm-altmap-track-namespace-boundaries-in-altmap.patch libnvdimm-prevent-nvdimm-from-requesting-key-when-security-is-disabled.patch sched-add-__assembly__-guards-around-struct-clone_args.patch dts-arm-gta04-introduce-legacy-spi-cs-high-to-make-display-work-again.patch xen-balloon-set-pages-pageoffline-in-balloon_add_region.patch xen-xenbus-fix-self-deadlock-after-killing-user-process.patch ieee802154-atusb-fix-use-after-free-at-disconnect.patch nl80211-validate-beacon-head.patch cfg80211-validate-ssid-mbssid-element-ordering-assumption.patch cfg80211-initialize-on-stack-chandefs.patch Compile testing --------------- We compiled the kernel for 4 architectures: aarch64: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg ppc64le: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg s390x: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg x86_64: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg

5 years

2
1
0 0

+ mm-compaction-fix-wrong-pfn-handling-in-__reset_isolation_pfn.patch added to -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm, compaction: fix wrong pfn handling in __reset_isolation_pfn() has been added to the -mm tree. Its filename is mm-compaction-fix-wrong-pfn-handling-in-__reset_isolation_pfn.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/mm-compaction-fix-wrong-pfn-handli… and later at http://ozlabs.org/~akpm/mmotm/broken-out/mm-compaction-fix-wrong-pfn-handli… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Vlastimil Babka <vbabka(a)suse.cz> Subject: mm, compaction: fix wrong pfn handling in __reset_isolation_pfn() Florian and Dave reported [1] a NULL pointer dereference in __reset_isolation_pfn(). While the exact cause is unclear, staring at the code revealed two bugs, which might be related. One bug is that if zone starts in the middle of pageblock, block_page might correspond to different pfn than block_pfn, and then the pfn_valid_within() checks will check different pfn's than those accessed via struct page. This might result in acessing an unitialized page in CONFIG_HOLES_IN_ZONE configs. The other bug is that end_page refers to the first page of next pageblock and not last page of current pageblock. The online and valid check is then wrong and with sections, the while (page < end_page) loop might wander off actual struct page arrays. [1] https://lore.kernel.org/linux-xfs/87o8z1fvqu.fsf@mid.deneb.enyo.de/ Link: http://lkml.kernel.org/r/20191008152915.24704-1-vbabka@suse.cz Fixes: 6b0868c820ff ("mm/compaction.c: correct zone boundary handling when resetting pageblock skip hints") Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz> Reported-by: Florian Weimer <fw(a)deneb.enyo.de> Reported-by: Dave Chinner <david(a)fromorbit.com> Acked-by: Mel Gorman <mgorman(a)techsingularity.net> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/compaction.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/mm/compaction.c~mm-compaction-fix-wrong-pfn-handling-in-__reset_isolation_pfn +++ a/mm/compaction.c @@ -270,14 +270,15 @@ __reset_isolation_pfn(struct zone *zone, /* Ensure the start of the pageblock or zone is online and valid */ block_pfn = pageblock_start_pfn(pfn); - block_page = pfn_to_online_page(max(block_pfn, zone->zone_start_pfn)); + block_pfn = max(block_pfn, zone->zone_start_pfn); + block_page = pfn_to_online_page(block_pfn); if (block_page) { page = block_page; pfn = block_pfn; } /* Ensure the end of the pageblock or zone is online and valid */ - block_pfn += pageblock_nr_pages; + block_pfn = pageblock_end_pfn(pfn) - 1; block_pfn = min(block_pfn, zone_end_pfn(zone) - 1); end_page = pfn_to_online_page(block_pfn); if (!end_page) @@ -303,7 +304,7 @@ __reset_isolation_pfn(struct zone *zone, page += (1 << PAGE_ALLOC_COSTLY_ORDER); pfn += (1 << PAGE_ALLOC_COSTLY_ORDER); - } while (page < end_page); + } while (page <= end_page); return false; } _ Patches currently in -mm which might be from vbabka(a)suse.cz are mm-page_owner-fix-off-by-one-error-in-__set_page_owner_handle.patch mm-page_owner-decouple-freeing-stack-trace-from-debug_pagealloc.patch mm-page_owner-decouple-freeing-stack-trace-from-debug_pagealloc-v3.patch mm-page_owner-rename-flag-indicating-that-page-is-allocated.patch mm-compaction-fix-wrong-pfn-handling-in-__reset_isolation_pfn.patch

5 years

1
0
0 0

FAILED: patch "[PATCH] drm/i915: Flush extra hard after writing relocations through" failed to apply to 5.3-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.3-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 576f05865581f82ac988ffec70e4e2ebd31165db Mon Sep 17 00:00:00 2001 From: Chris Wilson <chris(a)chris-wilson.co.uk> Date: Tue, 30 Jul 2019 12:21:51 +0100 Subject: [PATCH] drm/i915: Flush extra hard after writing relocations through the GTT Recently discovered in commit bdae33b8b82b ("drm/i915: Use maximum write flush for pwrite_gtt") was that we needed to our full write barrier before changing the GGTT PTE to ensure that our indirect writes through the GTT landed before the PTE changed (and the writes end up in a different page). That also applies to our GGTT relocation path. Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk> Cc: stable(a)vger.kernel.org Reviewed-by: Prathap Kumar Valsan <prathap.kumar.valsan(a)intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20190730112151.5633-4-chris@c… diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c index cbd7c6e3a1f8..4db4463089ce 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c @@ -1014,11 +1014,12 @@ static void reloc_cache_reset(struct reloc_cache *cache) kunmap_atomic(vaddr); i915_gem_object_finish_access((struct drm_i915_gem_object *)cache->node.mm); } else { - wmb(); + struct i915_ggtt *ggtt = cache_to_ggtt(cache); + + intel_gt_flush_ggtt_writes(ggtt->vm.gt); io_mapping_unmap_atomic((void __iomem *)vaddr); - if (cache->node.allocated) { - struct i915_ggtt *ggtt = cache_to_ggtt(cache); + if (cache->node.allocated) { ggtt->vm.clear_range(&ggtt->vm, cache->node.start, cache->node.size); @@ -1073,6 +1074,7 @@ static void *reloc_iomap(struct drm_i915_gem_object *obj, void *vaddr; if (cache->vaddr) { + intel_gt_flush_ggtt_writes(ggtt->vm.gt); io_mapping_unmap_atomic((void __force __iomem *) unmask_page(cache->vaddr)); } else { struct i915_vma *vma; @@ -1114,7 +1116,6 @@ static void *reloc_iomap(struct drm_i915_gem_object *obj, offset = cache->node.start; if (cache->node.allocated) { - wmb(); ggtt->vm.insert_page(&ggtt->vm, i915_gem_object_get_dma_address(obj, page), offset, I915_CACHE_NONE, 0);

5 years

1
0
0 0

FAILED: patch "[PATCH] drm/i915: Use maximum write flush for pwrite_gtt" failed to apply to 5.3-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.3-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From bdae33b8b82bb379a5b11040b0b37df25c7871c9 Mon Sep 17 00:00:00 2001 From: Chris Wilson <chris(a)chris-wilson.co.uk> Date: Thu, 18 Jul 2019 15:54:05 +0100 Subject: [PATCH] drm/i915: Use maximum write flush for pwrite_gtt MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit As recently disovered by forcing big-core (!llc) machines to use the GTT paths, we need our full GTT write flush before manipulating the GTT PTE or else the writes may be directed to the wrong page. Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk> Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> Cc: Matthew Auld <matthew.william.auld(a)gmail.com> Cc: Ville Syrjälä <ville.syrjala(a)linux.intel.com> Cc: stable(a)vger.kernel.org Reviewed-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20190718145407.21352-2-chris@… diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index fed0bc421a55..c6ba350e6e4f 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -610,7 +610,8 @@ i915_gem_gtt_pwrite_fast(struct drm_i915_gem_object *obj, unsigned int page_length = PAGE_SIZE - page_offset; page_length = remain < page_length ? remain : page_length; if (node.allocated) { - wmb(); /* flush the write before we modify the GGTT */ + /* flush the write before we modify the GGTT */ + intel_gt_flush_ggtt_writes(ggtt->vm.gt); ggtt->vm.insert_page(&ggtt->vm, i915_gem_object_get_dma_address(obj, offset >> PAGE_SHIFT), node.start, I915_CACHE_NONE, 0); @@ -639,8 +640,8 @@ i915_gem_gtt_pwrite_fast(struct drm_i915_gem_object *obj, i915_gem_object_unlock_fence(obj, fence); out_unpin: mutex_lock(&i915->drm.struct_mutex); + intel_gt_flush_ggtt_writes(ggtt->vm.gt); if (node.allocated) { - wmb(); ggtt->vm.clear_range(&ggtt->vm, node.start, node.size); remove_mappable_node(&node); } else {

5 years

1
0
0 0

[merged] mm-page_alloc-fix-a-crash-in-free_pages_prepare.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm/page_alloc.c: fix a crash in free_pages_prepare() has been removed from the -mm tree. Its filename was mm-page_alloc-fix-a-crash-in-free_pages_prepare.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Qian Cai <cai(a)lca.pw> Subject: mm/page_alloc.c: fix a crash in free_pages_prepare() On architectures like s390, arch_free_page() could mark the page unused (set_page_unused()) and any access later would trigger a kernel panic. Fix it by moving arch_free_page() after all possible accessing calls. Hardware name: IBM 2964 N96 400 (z/VM 6.4.0) Krnl PSW : 0404e00180000000 0000000026c2b96e (__free_pages_ok+0x34e/0x5d8) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3 Krnl GPRS: 0000000088d43af7 0000000000484000 000000000000007c 000000000000000f 000003d080012100 000003d080013fc0 0000000000000000 0000000000100000 00000000275cca48 0000000000000100 0000000000000008 000003d080010000 00000000000001d0 000003d000000000 0000000026c2b78a 000000002717fdb0 Krnl Code: 0000000026c2b95c: ec1100b30659 risbgn %r1,%r1,0,179,6 0000000026c2b962: e32014000036 pfd 2,1024(%r1) #0000000026c2b968: d7ff10001000 xc 0(256,%r1),0(%r1) >0000000026c2b96e: 41101100 la %r1,256(%r1) 0000000026c2b972: a737fff8 brctg %r3,26c2b962 0000000026c2b976: d7ff10001000 xc 0(256,%r1),0(%r1) 0000000026c2b97c: e31003400004 lg %r1,832 0000000026c2b982: ebff1430016a asi 5168(%r1),-1 Call Trace: __free_pages_ok+0x16a/0x5d8) memblock_free_all+0x206/0x290 mem_init+0x58/0x120 start_kernel+0x2b0/0x570 startup_continue+0x6a/0xc0 INFO: lockdep is turned off. Last Breaking-Event-Address: __free_pages_ok+0x372/0x5d8 Kernel panic - not syncing: Fatal exception: panic_on_oops 00: HCPGIR450W CP entered; disabled wait PSW 00020001 80000000 00000000 26A2379C In the past, only kernel_poison_pages() would trigger this but it needs "page_poison=on" kernel cmdline, and I suspect nobody tested that on s390. Recently, kernel_init_free_pages() (commit 6471384af2a6 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options")) was added and could trigger this as well. [akpm(a)linux-foundation.org: add comment] Link: http://lkml.kernel.org/r/1569613623-16820-1-git-send-email-cai@lca.pw Fixes: 8823b1dbc05f ("mm/page_poison.c: enable PAGE_POISONING as a separate option") Fixes: 6471384af2a6 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options") Signed-off-by: Qian Cai <cai(a)lca.pw> Reviewed-by: Heiko Carstens <heiko.carstens(a)de.ibm.com> Acked-by: Christian Borntraeger <borntraeger(a)de.ibm.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Cc: "Kirill A. Shutemov" <kirill(a)shutemov.name> Cc: Vasily Gorbik <gor(a)linux.ibm.com> Cc: Alexander Duyck <alexander.duyck(a)gmail.com> Cc: <stable(a)vger.kernel.org> [5.3+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/page_alloc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) --- a/mm/page_alloc.c~mm-page_alloc-fix-a-crash-in-free_pages_prepare +++ a/mm/page_alloc.c @@ -1175,11 +1175,17 @@ static __always_inline bool free_pages_p debug_check_no_obj_freed(page_address(page), PAGE_SIZE << order); } - arch_free_page(page, order); if (want_init_on_free()) kernel_init_free_pages(page, 1 << order); kernel_poison_pages(page, 1 << order, 0); + /* + * arch_free_page() can make the page's contents inaccessible. s390 + * does this. So nothing which can access the page's contents should + * happen after this. + */ + arch_free_page(page, order); + if (debug_pagealloc_enabled()) kernel_map_pages(page, 1 << order, 0); _ Patches currently in -mm which might be from cai(a)lca.pw are mm-slub-fix-a-deadlock-in-show_slab_objects.patch

5 years

1
0
0 0

[merged] z3fold-claim-page-in-the-beginning-of-free.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm/z3fold.c: claim page in the beginning of free has been removed from the -mm tree. Its filename was z3fold-claim-page-in-the-beginning-of-free.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Vitaly Wool <vitalywool(a)gmail.com> Subject: mm/z3fold.c: claim page in the beginning of free There's a really hard to reproduce race in z3fold between z3fold_free() and z3fold_reclaim_page(). z3fold_reclaim_page() can claim the page after z3fold_free() has checked if the page was claimed and z3fold_free() will then schedule this page for compaction which may in turn lead to random page faults (since that page would have been reclaimed by then). Fix that by claiming page in the beginning of z3fold_free() and not forgetting to clear the claim in the end. [vitalywool(a)gmail.com: v2] Link: http://lkml.kernel.org/r/20190928113456.152742cf@bigdell Link: http://lkml.kernel.org/r/20190926104844.4f0c6efa1366b8f5741eaba9@gmail.com Signed-off-by: Vitaly Wool <vitalywool(a)gmail.com> Reported-by: Markus Linnala <markus.linnala(a)gmail.com> Cc: Dan Streetman <ddstreet(a)ieee.org> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Henry Burns <henrywolfeburns(a)gmail.com> Cc: Shakeel Butt <shakeelb(a)google.com> Cc: Markus Linnala <markus.linnala(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/z3fold.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) --- a/mm/z3fold.c~z3fold-claim-page-in-the-beginning-of-free +++ a/mm/z3fold.c @@ -998,9 +998,11 @@ static void z3fold_free(struct z3fold_po struct z3fold_header *zhdr; struct page *page; enum buddy bud; + bool page_claimed; zhdr = handle_to_z3fold_header(handle); page = virt_to_page(zhdr); + page_claimed = test_and_set_bit(PAGE_CLAIMED, &page->private); if (test_bit(PAGE_HEADLESS, &page->private)) { /* if a headless page is under reclaim, just leave. @@ -1008,7 +1010,7 @@ static void z3fold_free(struct z3fold_po * has not been set before, we release this page * immediately so we don't care about its value any more. */ - if (!test_and_set_bit(PAGE_CLAIMED, &page->private)) { + if (!page_claimed) { spin_lock(&pool->lock); list_del(&page->lru); spin_unlock(&pool->lock); @@ -1044,13 +1046,15 @@ static void z3fold_free(struct z3fold_po atomic64_dec(&pool->pages_nr); return; } - if (test_bit(PAGE_CLAIMED, &page->private)) { + if (page_claimed) { + /* the page has not been claimed by us */ z3fold_page_unlock(zhdr); return; } if (unlikely(PageIsolated(page)) || test_and_set_bit(NEEDS_COMPACTING, &page->private)) { z3fold_page_unlock(zhdr); + clear_bit(PAGE_CLAIMED, &page->private); return; } if (zhdr->cpu < 0 || !cpu_online(zhdr->cpu)) { @@ -1060,10 +1064,12 @@ static void z3fold_free(struct z3fold_po zhdr->cpu = -1; kref_get(&zhdr->refcount); do_compact_page(zhdr, true); + clear_bit(PAGE_CLAIMED, &page->private); return; } kref_get(&zhdr->refcount); queue_work_on(zhdr->cpu, pool->compact_wq, &zhdr->work); + clear_bit(PAGE_CLAIMED, &page->private); z3fold_page_unlock(zhdr); } _ Patches currently in -mm which might be from vitalywool(a)gmail.com are

5 years

1
0
0 0

[merged] kernel-sysctlc-do-not-override-max_threads-provided-by-userspace.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: kernel/sysctl.c: do not override max_threads provided by userspace has been removed from the -mm tree. Its filename was kernel-sysctlc-do-not-override-max_threads-provided-by-userspace.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Michal Hocko <mhocko(a)suse.com> Subject: kernel/sysctl.c: do not override max_threads provided by userspace Partially revert 16db3d3f1170 ("kernel/sysctl.c: threads-max observe limits") because the patch is causing a regression to any workload which needs to override the auto-tuning of the limit provided by kernel. set_max_threads is implementing a boot time guesstimate to provide a sensible limit of the concurrently running threads so that runaways will not deplete all the memory. This is a good thing in general but there are workloads which might need to increase this limit for an application to run (reportedly WebSpher MQ is affected) and that is simply not possible after the mentioned change. It is also very dubious to override an admin decision by an estimation that doesn't have any direct relation to correctness of the kernel operation. Fix this by dropping set_max_threads from sysctl_max_threads so any value is accepted as long as it fits into MAX_THREADS which is important to check because allowing more threads could break internal robust futex restriction. While at it, do not use MIN_THREADS as the lower boundary because it is also only a heuristic for automatic estimation and admin might have a good reason to stop new threads to be created even when below this limit. This became more severe when we switched x86 from 4k to 8k kernel stacks. Starting since 6538b8ea886e ("x86_64: expand kernel stack to 16K") (3.16) we use THREAD_SIZE_ORDER = 2 and that halved the auto-tuned value. In the particular case 3.12 kernel.threads-max = 515561 4.4 kernel.threads-max = 200000 Neither of the two values is really insane on 32GB machine. I am not sure we want/need to tune the max_thread value further. If anything the tuning should be removed altogether if proven not useful in general. But we definitely need a way to override this auto-tuning. Link: http://lkml.kernel.org/r/20190922065801.GB18814@dhcp22.suse.cz Fixes: 16db3d3f1170 ("kernel/sysctl.c: threads-max observe limits") Signed-off-by: Michal Hocko <mhocko(a)suse.com> Reviewed-by: "Eric W. Biederman" <ebiederm(a)xmission.com> Cc: Heinrich Schuchardt <xypron.glpk(a)gmx.de> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- kernel/fork.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/kernel/fork.c~kernel-sysctlc-do-not-override-max_threads-provided-by-userspace +++ a/kernel/fork.c @@ -2925,7 +2925,7 @@ int sysctl_max_threads(struct ctl_table struct ctl_table t; int ret; int threads = max_threads; - int min = MIN_THREADS; + int min = 1; int max = MAX_THREADS; t = *table; @@ -2937,7 +2937,7 @@ int sysctl_max_threads(struct ctl_table if (ret || !write) return ret; - set_max_threads(threads); + max_threads = threads; return 0; } _ Patches currently in -mm which might be from mhocko(a)suse.com are

5 years

1
0
0 0

[merged] writeback-fix-use-after-free-in-finish_writeback_work.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: writeback: fix use-after-free in finish_writeback_work() has been removed from the -mm tree. Its filename was writeback-fix-use-after-free-in-finish_writeback_work.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Tejun Heo <tj(a)kernel.org> Subject: writeback: fix use-after-free in finish_writeback_work() finish_writeback_work() reads @done->waitq after decrementing @done->cnt. However, once @done->cnt reaches zero, @done may be freed (from stack) at any moment and @done->waitq can contain something unrelated by the time finish_writeback_work() tries to read it. This led to the following crash. "BUG: kernel NULL pointer dereference, address: 0000000000000002" #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP DEBUG_PAGEALLOC CPU: 40 PID: 555153 Comm: kworker/u98:50 Kdump: loaded Not tainted ... Workqueue: writeback wb_workfn (flush-btrfs-1) RIP: 0010:_raw_spin_lock_irqsave+0x10/0x30 Code: 48 89 d8 5b c3 e8 50 db 6b ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 53 9c 5b fa 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 05 48 89 d8 5b c3 89 c6 e8 fe ca 6b ff eb f2 66 90 RSP: 0018:ffffc90049b27d98 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000246 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: 0000000000000002 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: ffff889fff407600 R11: ffff88ba9395d740 R12: 000000000000e300 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88bfdfa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000002 CR3: 0000000002409005 CR4: 00000000001606e0 Call Trace: __wake_up_common_lock+0x63/0xc0 wb_workfn+0xd2/0x3e0 process_one_work+0x1f5/0x3f0 worker_thread+0x2d/0x3d0 kthread+0x111/0x130 ret_from_fork+0x1f/0x30 Fix it by reading and caching @done->waitq before decrementing @done->cnt. Link: http://lkml.kernel.org/r/20190924010631.GH2233839@devbig004.ftw2.facebook.c… Fixes: 5b9cce4c7eb069 ("writeback: Generalize and expose wb_completion") Signed-off-by: Tejun Heo <tj(a)kernel.org> Debugged-by: Chris Mason <clm(a)fb.com> Reviewed-by: Jens Axboe <axboe(a)kernel.dk> Cc: Jan Kara <jack(a)suse.cz> Cc: <stable(a)vger.kernel.org> [5.2+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/fs-writeback.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/fs/fs-writeback.c~writeback-fix-use-after-free-in-finish_writeback_work +++ a/fs/fs-writeback.c @@ -164,8 +164,13 @@ static void finish_writeback_work(struct if (work->auto_free) kfree(work); - if (done && atomic_dec_and_test(&done->cnt)) - wake_up_all(done->waitq); + if (done) { + wait_queue_head_t *waitq = done->waitq; + + /* @done can't be accessed after the following dec */ + if (atomic_dec_and_test(&done->cnt)) + wake_up_all(waitq); + } } static void wb_queue_work(struct bdi_writeback *wb, _ Patches currently in -mm which might be from tj(a)kernel.org are

5 years

1
0
0 0

[merged] panic-ensure-preemption-is-disabled-during-panic.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: panic: ensure preemption is disabled during panic() has been removed from the -mm tree. Its filename was panic-ensure-preemption-is-disabled-during-panic.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Will Deacon <will(a)kernel.org> Subject: panic: ensure preemption is disabled during panic() Calling 'panic()' on a kernel with CONFIG_PREEMPT=y can leave the calling CPU in an infinite loop, but with interrupts and preemption enabled. From this state, userspace can continue to be scheduled, despite the system being "dead" as far as the kernel is concerned. This is easily reproducible on arm64 when booting with "nosmp" on the command line; a couple of shell scripts print out a periodic "Ping" message whilst another triggers a crash by writing to /proc/sysrq-trigger: | sysrq: Trigger a crash | Kernel panic - not syncing: sysrq triggered crash | CPU: 0 PID: 1 Comm: init Not tainted 5.2.15 #1 | Hardware name: linux,dummy-virt (DT) | Call trace: | dump_backtrace+0x0/0x148 | show_stack+0x14/0x20 | dump_stack+0xa0/0xc4 | panic+0x140/0x32c | sysrq_handle_reboot+0x0/0x20 | __handle_sysrq+0x124/0x190 | write_sysrq_trigger+0x64/0x88 | proc_reg_write+0x60/0xa8 | __vfs_write+0x18/0x40 | vfs_write+0xa4/0x1b8 | ksys_write+0x64/0xf0 | __arm64_sys_write+0x14/0x20 | el0_svc_common.constprop.0+0xb0/0x168 | el0_svc_handler+0x28/0x78 | el0_svc+0x8/0xc | Kernel Offset: disabled | CPU features: 0x0002,24002004 | Memory Limit: none | ---[ end Kernel panic - not syncing: sysrq triggered crash ]--- | Ping 2! | Ping 1! | Ping 1! | Ping 2! The issue can also be triggered on x86 kernels if CONFIG_SMP=n, otherwise local interrupts are disabled in 'smp_send_stop()'. Disable preemption in 'panic()' before re-enabling interrupts. Link: http://lkml.kernel.org/r/20191002123538.22609-1-will@kernel.org Link: https://lore.kernel.org/r/BX1W47JXPMR8.58IYW53H6M5N@dragonstone Signed-off-by: Will Deacon <will(a)kernel.org> Reported-by: Xogium <contact(a)xogium.me> Reviewed-by: Kees Cook <keescook(a)chromium.org> Cc: Russell King <linux(a)armlinux.org.uk> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Petr Mladek <pmladek(a)suse.com> Cc: Feng Tang <feng.tang(a)intel.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- kernel/panic.c | 1 + 1 file changed, 1 insertion(+) --- a/kernel/panic.c~panic-ensure-preemption-is-disabled-during-panic +++ a/kernel/panic.c @@ -180,6 +180,7 @@ void panic(const char *fmt, ...) * after setting panic_cpu) from invoking panic() again. */ local_irq_disable(); + preempt_disable_notrace(); /* * It's possible to come here directly from a panic-assertion and _ Patches currently in -mm which might be from will(a)kernel.org are

5 years

1
0
0 0

FAILED: patch "[PATCH] nl80211: validate beacon head" failed to apply to 4.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From f88eb7c0d002a67ef31aeb7850b42ff69abc46dc Mon Sep 17 00:00:00 2001 From: Johannes Berg <johannes.berg(a)intel.com> Date: Fri, 20 Sep 2019 21:54:17 +0200 Subject: [PATCH] nl80211: validate beacon head We currently don't validate the beacon head, i.e. the header, fixed part and elements that are to go in front of the TIM element. This means that the variable elements there can be malformed, e.g. have a length exceeding the buffer size, but most downstream code from this assumes that this has already been checked. Add the necessary checks to the netlink policy. Cc: stable(a)vger.kernel.org Fixes: ed1b6cc7f80f ("cfg80211/nl80211: add beacon settings") Link: https://lore.kernel.org/r/1569009255-I7ac7fbe9436e9d8733439eab8acbbd35e55c7… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index d21b1581a665..7386421e2ad3 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -201,6 +201,38 @@ cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info) return __cfg80211_rdev_from_attrs(netns, info->attrs); } +static int validate_beacon_head(const struct nlattr *attr, + struct netlink_ext_ack *extack) +{ + const u8 *data = nla_data(attr); + unsigned int len = nla_len(attr); + const struct element *elem; + const struct ieee80211_mgmt *mgmt = (void *)data; + unsigned int fixedlen = offsetof(struct ieee80211_mgmt, + u.beacon.variable); + + if (len < fixedlen) + goto err; + + if (ieee80211_hdrlen(mgmt->frame_control) != + offsetof(struct ieee80211_mgmt, u.beacon)) + goto err; + + data += fixedlen; + len -= fixedlen; + + for_each_element(elem, data, len) { + /* nothing */ + } + + if (for_each_element_completed(elem, data, len)) + return 0; + +err: + NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head"); + return -EINVAL; +} + static int validate_ie_attr(const struct nlattr *attr, struct netlink_ext_ack *extack) { @@ -338,8 +370,9 @@ const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 }, [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 }, - [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY, - .len = IEEE80211_MAX_DATA_LEN }, + [NL80211_ATTR_BEACON_HEAD] = + NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head, + IEEE80211_MAX_DATA_LEN), [NL80211_ATTR_BEACON_TAIL] = NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, IEEE80211_MAX_DATA_LEN),

5 years

1
0
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror October 2019