The following commit has been merged into the perf/urgent branch of tip:
Commit-ID: 722ddfde366fd46205456a9c5ff9b3359dc9a75e
Gitweb: https://git.kernel.org/tip/722ddfde366fd46205456a9c5ff9b3359dc9a75e
Author: Jiri Olsa <jolsa(a)kernel.org>
AuthorDate: Tue, 05 Nov 2019 00:27:11 +01:00
Committer: Arnaldo Carvalho de Melo <acme(a)redhat.com>
CommitterDate: Tue, 05 Nov 2019 08:49:14 -03:00
perf tools: Fix time sorting
The final sort might get confused when the comparison is done over
bigger numbers than int like for -s time.
Check the following report for longer workloads:
$ perf report -s time -F time,overhead --stdio
Fix hist_entry__sort() to properly return int64_t and not possible cut
int.
Fixes: 043ca389a318 ("perf tools: Use hpp formats to sort final output")
Signed-off-by: Jiri Olsa <jolsa(a)kernel.org>
Reviewed-by: Andi Kleen <ak(a)linux.intel.com>
Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Cc: Michael Petlan <mpetlan(a)redhat.com>
Cc: Namhyung Kim <namhyung(a)kernel.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: stable(a)vger.kernel.org # v3.16+
Link: http://lore.kernel.org/lkml/20191104232711.16055-1-jolsa@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com>
---
tools/perf/util/hist.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index 679a1d7..7b6eaf5 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -1625,7 +1625,7 @@ int hists__collapse_resort(struct hists *hists, struct ui_progress *prog)
return 0;
}
-static int hist_entry__sort(struct hist_entry *a, struct hist_entry *b)
+static int64_t hist_entry__sort(struct hist_entry *a, struct hist_entry *b)
{
struct hists *hists = a->hists;
struct perf_hpp_fmt *fmt;
From: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
Make sure we have a crtc before probing its primary plane's
max stride. Initially I thought we can't get this far without
crtcs, but looks like we can via the dumb_create ioctl.
Not sure if we shouldn't disable dumb buffer support entirely
when we have no crtcs, but that would require some amount of work
as the only thing currently being checked is dev->driver->dumb_create
which we'd have to convert to some device specific dynamic thing.
Cc: stable(a)vger.kernel.org
Reported-by: Mika Kuoppala <mika.kuoppala(a)linux.intel.com>
Fixes: aa5ca8b7421c ("drm/i915: Align dumb buffer stride to 4k to allow for gtt remapping")
Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
---
drivers/gpu/drm/i915/display/intel_display.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
index 1f93860fb897..331030765ca9 100644
--- a/drivers/gpu/drm/i915/display/intel_display.c
+++ b/drivers/gpu/drm/i915/display/intel_display.c
@@ -2543,6 +2543,9 @@ u32 intel_plane_fb_max_stride(struct drm_i915_private *dev_priv,
* the highest stride limits of them all.
*/
crtc = intel_get_crtc_for_pipe(dev_priv, PIPE_A);
+ if (!crtc)
+ return 0;
+
plane = to_intel_plane(crtc->base.primary);
return plane->max_stride(plane, pixel_format, modifier,
--
2.23.0
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 95180e47e77a - Linux 5.3.8
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/267171
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 95180e47e77a - Linux 5.3.8
We grabbed the 5d3fac209a5d commit of the stable queue repository.
We then merged the patchset with `git am`:
io_uring-fix-up-o_nonblock-handling-for-sockets.patch
dm-snapshot-introduce-account_start_copy-and-account.patch
dm-snapshot-rework-cow-throttling-to-fix-deadlock.patch
btrfs-fix-inode-cache-block-reserve-leak-on-failure-.patch
btrfs-qgroup-always-free-prealloc-meta-reserve-in-bt.patch
iio-adc-meson_saradc-fix-memory-allocation-order.patch
iio-fix-center-temperature-of-bmc150-accel-core.patch
libsubcmd-make-_fortify_source-defines-dependent-on-.patch
perf-tests-avoid-raising-segv-using-an-obvious-null-.patch
perf-map-fix-overlapped-map-handling.patch
perf-script-brstackinsn-fix-recovery-from-lbr-binary.patch
perf-jevents-fix-period-for-intel-fixed-counters.patch
perf-tools-propagate-get_cpuid-error.patch
perf-annotate-propagate-perf_env__arch-error.patch
perf-annotate-fix-the-signedness-of-failure-returns.patch
perf-annotate-propagate-the-symbol__annotate-error-r.patch
perf-annotate-fix-arch-specific-init-failure-errors.patch
perf-annotate-return-appropriate-error-code-for-allo.patch
perf-annotate-don-t-return-1-for-error-when-doing-bp.patch
staging-rtl8188eu-fix-null-dereference-when-kzalloc-.patch
rdma-siw-fix-serialization-issue-in-write_space.patch
rdma-hfi1-prevent-memory-leak-in-sdma_init.patch
rdma-iw_cxgb4-fix-srq-access-from-dump_qp.patch
rdma-iwcm-fix-a-lock-inversion-issue.patch
hid-hyperv-use-in-place-iterator-api-in-the-channel-.patch
kselftest-exclude-failed-targets-from-runlist.patch
selftests-kselftest-runner.sh-add-45-second-timeout-.patch
nfs-fix-nfsi-nrequests-count-error-on-nfs_inode_remo.patch
arm64-cpufeature-effectively-expose-frint-capability.patch
arm64-fix-incorrect-irqflag-restore-for-priority-mas.patch
arm64-ftrace-ensure-synchronisation-in-plt-setup-for.patch
tty-serial-owl-fix-the-link-time-qualifier-of-owl_ua.patch
tty-serial-rda-fix-the-link-time-qualifier-of-rda_ua.patch
serial-sifive-select-serial_earlycon.patch
tty-n_hdlc-fix-build-on-sparc.patch
misc-fastrpc-prevent-memory-leak-in-fastrpc_dma_buf_.patch
rdma-core-fix-an-error-handling-path-in-res_get_comm.patch
rdma-cm-fix-memory-leak-in-cm_add-remove_one.patch
rdma-nldev-reshuffle-the-code-to-avoid-need-to-rebin.patch
rdma-mlx5-do-not-allow-rereg-of-a-odp-mr.patch
rdma-mlx5-order-num_pending_prefetch-properly-with-s.patch
rdma-mlx5-add-missing-synchronize_srcu-for-mw-cases.patch
gpio-max77620-use-correct-unit-for-debounce-times.patch
fs-cifs-mute-wunused-const-variable-message.patch
arm64-vdso32-fix-broken-compat-vdso-build-warnings.patch
arm64-vdso32-detect-binutils-support-for-dmb-ishld.patch
serial-mctrl_gpio-check-for-null-pointer.patch
serial-8250_omap-fix-gpio-check-for-auto-rts-cts.patch
arm64-default-to-building-compat-vdso-with-clang-whe.patch
arm64-vdso32-don-t-use-kbuild_cppflags-unconditional.patch
efi-cper-fix-endianness-of-pcie-class-code.patch
efi-x86-do-not-clean-dummy-variable-in-kexec-path.patch
mips-include-mark-__cmpxchg-as-__always_inline.patch
riscv-avoid-kernel-hangs-when-trapped-in-bug.patch
riscv-avoid-sending-a-sigtrap-to-a-user-thread-trapp.patch
riscv-correct-the-handling-of-unexpected-ebreak-in-d.patch
x86-xen-return-from-panic-notifier.patch
ocfs2-clear-zero-in-unaligned-direct-io.patch
fs-ocfs2-fix-possible-null-pointer-dereferences-in-o.patch
fs-ocfs2-fix-a-possible-null-pointer-dereference-in-.patch
fs-ocfs2-fix-a-possible-null-pointer-dereference-in-.patch
btrfs-silence-maybe-uninitialized-warning-in-clone_r.patch
arm64-armv8_deprecated-checking-return-value-for-mem.patch
x86-cpu-add-comet-lake-to-the-intel-cpu-models-heade.patch
sched-fair-scale-bandwidth-quota-and-period-without-.patch
sched-vtime-fix-guest-system-mis-accounting-on-task-.patch
perf-core-rework-memory-accounting-in-perf_mmap.patch
perf-core-fix-corner-case-in-perf_rotate_context.patch
perf-x86-amd-change-fix-nmi-latency-mitigation-to-us.patch
drm-amdgpu-fix-memory-leak.patch
iio-imu-adis16400-release-allocated-memory-on-failur.patch
iio-imu-adis16400-fix-memory-leak.patch
iio-imu-st_lsm6dsx-fix-waitime-for-st_lsm6dsx-i2c-co.patch
mips-include-mark-__xchg-as-__always_inline.patch
mips-fw-sni-fix-out-of-bounds-init-of-o32-stack.patch
s390-cio-fix-virtio-ccw-dma-without-pv.patch
virt-vbox-fix-memory-leak-in-hgcm_call_preprocess_li.patch
nbd-fix-possible-sysfs-duplicate-warning.patch
nfsv4-fix-leak-of-clp-cl_acceptor-string.patch
sunrpc-fix-race-to-sk_err-after-xs_error_report.patch
s390-uaccess-avoid-false-positive-compiler-warnings.patch
tracing-initialize-iter-seq-after-zeroing-in-tracing.patch
perf-annotate-fix-multiple-memory-and-file-descripto.patch
perf-aux-fix-tracking-of-auxiliary-trace-buffer-allo.patch
usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch
nbd-verify-socket-is-supported-during-setup.patch
arm64-dts-qcom-add-lenovo-miix-630.patch
arm64-dts-qcom-add-hp-envy-x2.patch
arm64-dts-qcom-add-asus-novago-tp370ql.patch
rtw88-fix-misuse-of-genmask-macro.patch
s390-pci-fix-msi-message-data.patch
thunderbolt-correct-path-indices-for-pcie-tunnel.patch
thunderbolt-use-32-bit-writes-when-writing-ring-prod.patch
ath6kl-fix-a-null-ptr-deref-bug-in-ath6kl_usb_alloc_.patch
fuse-flush-dirty-data-metadata-before-non-truncate-setattr.patch
fuse-truncate-pending-writes-on-o_trunc.patch
alsa-bebob-fix-prototype-of-helper-function-to-return-negative-value.patch
alsa-timer-fix-mutex-deadlock-at-releasing-card.patch
alsa-hda-realtek-fix-2-front-mics-of-codec-0x623.patch
alsa-hda-realtek-add-support-for-alc623.patch
ath10k-fix-latency-issue-for-qca988x.patch
uas-revert-commit-3ae62a42090f-uas-fix-alignment-of-scatter-gather-segments.patch
nl80211-fix-validation-of-mesh-path-nexthop.patch
usb-gadget-reject-endpoints-with-0-maxpacket-value.patch
usb-storage-revert-commit-747668dbc061-usb-storage-set-virt_boundary_mask-to-avoid-sg-overflows.patch
usb-ldusb-fix-ring-buffer-locking.patch
usb-ldusb-fix-control-message-timeout.patch
usb-xhci-fix-immediate-data-transfer-endianness.patch
usb-xhci-fix-__le32-__le64-accessors-in-debugfs-code.patch
usb-serial-whiteheat-fix-potential-slab-corruption.patch
usb-serial-whiteheat-fix-line-speed-endianness.patch
xhci-fix-use-after-free-regression-in-xhci-clear-hub-tt-implementation.patch
scsi-qla2xxx-fix-partial-flash-write-of-mbi.patch
scsi-target-cxgbit-fix-cxgbit_fw4_ack.patch
hid-i2c-hid-add-trekstor-primebook-c11b-to-descriptor-override.patch
hid-fix-assumption-that-devices-have-inputs.patch
hid-fix-error-message-in-hid_open_report.patch
hid-logitech-hidpp-split-g920_get_config.patch
hid-logitech-hidpp-rework-device-validation.patch
hid-logitech-hidpp-do-all-ff-cleanup-in-hidpp_ff_destroy.patch
um-ubd-entrust-re-queue-to-the-upper-layers.patch
s390-unwind-fix-mixing-regs-and-sp.patch
s390-cmm-fix-information-leak-in-cmm_timeout_handler.patch
s390-idle-fix-cpu-idle-time-calculation.patch
arc-perf-accommodate-big-endian-cpu.patch
ib-hfi1-avoid-excessive-retry-for-tid-rdma-read-request.patch
arm64-ensure-vm_write-vm_shared-ptes-are-clean-by-default.patch
arm64-cpufeature-enable-qualcomm-falkor-kryo-errata-1003.patch
virtio_ring-fix-stalls-for-packed-rings.patch
rtlwifi-rtl_pci-fix-problem-of-too-small-skb-len.patch
rtlwifi-fix-potential-overflow-on-p2p-code.patch
kvm-vmx-svm-always-run-with-efer.nxe-1-when-shadow-paging-is-active.patch
dmaengine-qcom-bam_dma-fix-resource-leak.patch
dmaengine-tegra210-adma-fix-transfer-failure.patch
dmaengine-imx-sdma-fix-size-check-for-sdma-script_number.patch
dmaengine-cppi41-fix-cppi41_dma_prep_slave_sg-when-idle.patch
drm-amdgpu-gmc10-properly-set-bank_select-and-fragment_size.patch
drm-i915-fix-pch-reference-clock-for-fdi-on-hsw-bdw.patch
drm-amdgpu-gfx10-update-gfx-golden-settings.patch
drm-amdgpu-powerplay-vega10-allow-undervolting-in-p7.patch
drm-amdgpu-fix-sdma-hang-when-performing-vkexample-test.patch
nfs-fix-an-rcu-lock-leak-in-nfs4_refresh_delegation_stateid.patch
io_uring-ensure-we-clear-io_kiocb-result-before-each-issue.patch
iommu-vt-d-fix-panic-after-kexec-p-for-kdump.patch
batman-adv-avoid-free-alloc-race-when-handling-ogm-buffer.patch
llc-fix-sk_buff-leak-in-llc_sap_state_process.patch
llc-fix-sk_buff-leak-in-llc_conn_service.patch
rxrpc-fix-call-ref-leak.patch
rxrpc-rxrpc_peer-needs-to-hold-a-ref-on-the-rxrpc_local-record.patch
rxrpc-fix-trace-after-put-looking-at-the-put-peer-record.patch
nfc-pn533-fix-use-after-free-and-memleaks.patch
bonding-fix-potential-null-deref-in-bond_update_slave_arr.patch
netfilter-conntrack-avoid-possible-false-sharing.patch
net-usb-sr9800-fix-uninitialized-local-variable.patch
sch_netem-fix-rcu-splat-in-netem_enqueue.patch
net-sched-sch_sfb-don-t-call-qdisc_put-while-holding-tree-lock.patch
iwlwifi-exclude-geo-sar-support-for-3168.patch
sched-fair-fix-low-cpu-usage-with-high-throttling-by-removing-expiration-of-cpu-local-slices.patch
alsa-usb-audio-dsd-auto-detection-for-playback-desig.patch
alsa-usb-audio-update-dsd-support-quirks-for-oppo-an.patch
alsa-usb-audio-add-dsd-support-for-gustard-u16-x26-u.patch
rdma-mlx5-use-irq-xarray-locking-for-mkey_table.patch
sched-fair-fix-wunused-but-set-variable-warnings.patch
powerpc-powernv-fix-cpu-idle-to-be-called-with-irqs-.patch
revert-nvme-allow-64-bit-results-in-passthru-command.patch
revert-alsa-hda-flush-interrupts-on-disabling.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test
✅ Podman system integration test (as root)
✅ Podman system integration test (as user)
✅ LTP lite
✅ Loopdev Sanity
✅ jvm test suite
✅ AMTU (Abstract Machine Test Utility)
✅ LTP: openposix test suite
✅ Ethernet drivers sanity
✅ Networking socket: fuzz
✅ audit: audit testsuite test
✅ httpd: mod_ssl smoke sanity
✅ iotop: sanity
✅ tuned: tune-processes-through-perf
✅ ALSA PCM loopback test
✅ ALSA Control (mixer) Userspace Element test
✅ Usex - version 1.9-29
✅ storage: SCSI VPD
✅ stress: stress-ng
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ storage: dm/common
Host 2:
✅ Boot test
✅ xfstests: xfs
✅ selinux-policy: serge-testsuite
✅ storage: software RAID testing
🚧 ✅ Storage blktests
ppc64le:
Host 1:
✅ Boot test
✅ Podman system integration test (as root)
✅ Podman system integration test (as user)
✅ LTP lite
✅ Loopdev Sanity
✅ jvm test suite
✅ AMTU (Abstract Machine Test Utility)
✅ LTP: openposix test suite
✅ Ethernet drivers sanity
✅ Networking socket: fuzz
✅ audit: audit testsuite test
✅ httpd: mod_ssl smoke sanity
✅ iotop: sanity
✅ tuned: tune-processes-through-perf
✅ ALSA PCM loopback test
✅ ALSA Control (mixer) Userspace Element test
✅ Usex - version 1.9-29
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ storage: dm/common
Host 2:
✅ Boot test
✅ xfstests: xfs
✅ selinux-policy: serge-testsuite
✅ storage: software RAID testing
🚧 ✅ Storage blktests
x86_64:
Host 1:
✅ Boot test
✅ xfstests: xfs
✅ selinux-policy: serge-testsuite
✅ storage: software RAID testing
🚧 ✅ IOMMU boot test
🚧 ✅ Storage blktests
Host 2:
✅ Boot test
✅ Podman system integration test (as root)
✅ Podman system integration test (as user)
✅ LTP lite
✅ Loopdev Sanity
✅ jvm test suite
✅ AMTU (Abstract Machine Test Utility)
✅ LTP: openposix test suite
✅ Ethernet drivers sanity
✅ Networking socket: fuzz
✅ audit: audit testsuite test
✅ httpd: mod_ssl smoke sanity
✅ iotop: sanity
✅ tuned: tune-processes-through-perf
✅ pciutils: sanity smoke test
✅ ALSA PCM loopback test
✅ ALSA Control (mixer) Userspace Element test
✅ Usex - version 1.9-29
✅ storage: SCSI VPD
✅ stress: stress-ng
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ storage: dm/common
Host 3:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
🚧 ⚡⚡⚡ /kernel/infiniband/env_setup
🚧 ⚡⚡⚡ /kernel/infiniband/sanity
Host 4:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
🚧 ⚡⚡⚡ /kernel/infiniband/env_setup
🚧 ⚡⚡⚡ /kernel/infiniband/sanity
Host 5:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
🚧 ⚡⚡⚡ /kernel/infiniband/env_setup
🚧 ⚡⚡⚡ /kernel/infiniband/sanity
Host 6:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
🚧 ⚡⚡⚡ /kernel/infiniband/env_setup
🚧 ⚡⚡⚡ /kernel/infiniband/sanity
Test sources: https://github.com/CKI-project/tests-beaker
💚 Pull requests are welcome for new tests or improvements to existing tests!
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
Testing timeout
---------------
We aim to provide a report within reasonable timeframe. Tests that haven't
finished running are marked with ⏱. Reports for non-upstream kernels have
a Beaker recipe linked to next to each host.
The x86 version of get_user_pages_fast() relies on disabled interrupts to
synchronize gup_pte_range() between gup_get_pte(ptep); and get_page() against
a parallel munmap. The munmap side nulls the pte, then flushes TLBs, then
releases the page. As TLB flush is done synchronously via IPI disabling
interrupts blocks the page release, and get_page(), which assumes existing
reference on page, is thus safe.
However when TLB flush is done by a hypercall, e.g. in a Xen PV guest, there is
no blocking thanks to disabled interrupts, and get_page() can succeed on a page
that was already freed or even reused.
We have recently seen this happen with our 4.4 and 4.12 based kernels, with
userspace (java) that exits a thread, where mm_release() performs a futex_wake()
on tsk->clear_child_tid, and another thread in parallel unmaps the page where
tsk->clear_child_tid points to. The spurious get_page() succeeds, but futex code
immediately releases the page again, while it's already on a freelist. Symptoms
include a bad page state warning, general protection faults acessing a poisoned
list prev/next pointer in the freelist, or free page pcplists of two cpus joined
together in a single list. Oscar has also reproduced this scenario, with a
patch inserting delays before the get_page() to make the race window larger.
Fix this by removing the dependency on TLB flush interrupts the same way as the
generic get_user_pages_fast() code by using page_cache_add_speculative() and
revalidating the PTE contents after pinning the page. Mainline is safe since
4.13 where the x86 gup code was removed in favor of the common code. Accessing
the page table itself safely also relies on disabled interrupts and TLB flush
IPIs that don't happen with hypercalls, which was acknowledged in commit
9e52fc2b50de ("x86/mm: Enable RCU based page table freeing
(CONFIG_HAVE_RCU_TABLE_FREE=y)"). That commit with follups should also be
backported for full safety, although our reproducer didn't hit a problem
without that backport.
Reproduced-by: Oscar Salvador <osalvador(a)suse.de>
Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Ingo Molnar <mingo(a)redhat.com>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Juergen Gross <jgross(a)suse.com>
Cc: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Cc: Vitaly Kuznetsov <vkuznets(a)redhat.com>
Cc: Linus Torvalds <torvalds(a)linux-foundation.org>
Cc: Borislav Petkov <bp(a)alien8.de>
Cc: Dave Hansen <dave.hansen(a)linux.intel.com>
Cc: Andy Lutomirski <luto(a)kernel.org>
---
Hi, I'm sending this stable-only patch for consideration because it's probably
unrealistic to backport the 4.13 switch to generic GUP. I can look at 4.4 and
3.16 if accepted. The RCU page table freeing could be also considered.
Note the patch also includes page refcount protection. I found out that
8fde12ca79af ("mm: prevent get_user_pages() from overflowing page refcount")
backport to 4.9 missed the arch-specific gup implementations:
https://lore.kernel.org/lkml/6650323f-dbc9-f069-000b-f6b0f941a065@suse.cz/
arch/x86/mm/gup.c | 32 ++++++++++++++++++++++++++++++--
1 file changed, 30 insertions(+), 2 deletions(-)
diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
index 1680768d392c..d7db45bdfb3b 100644
--- a/arch/x86/mm/gup.c
+++ b/arch/x86/mm/gup.c
@@ -97,6 +97,20 @@ static inline int pte_allows_gup(unsigned long pteval, int write)
return 1;
}
+/*
+ * Return the compund head page with ref appropriately incremented,
+ * or NULL if that failed.
+ */
+static inline struct page *try_get_compound_head(struct page *page, int refs)
+{
+ struct page *head = compound_head(page);
+ if (WARN_ON_ONCE(page_ref_count(head) < 0))
+ return NULL;
+ if (unlikely(!page_cache_add_speculative(head, refs)))
+ return NULL;
+ return head;
+}
+
/*
* The performance critical leaf functions are made noinline otherwise gcc
* inlines everything into a single function which results in too much
@@ -112,7 +126,7 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
ptep = pte_offset_map(&pmd, addr);
do {
pte_t pte = gup_get_pte(ptep);
- struct page *page;
+ struct page *head, *page;
/* Similar to the PMD case, NUMA hinting must take slow path */
if (pte_protnone(pte)) {
@@ -138,7 +152,21 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
}
VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
page = pte_page(pte);
- get_page(page);
+
+ head = try_get_compound_head(page, 1);
+ if (!head) {
+ put_dev_pagemap(pgmap);
+ pte_unmap(ptep);
+ return 0;
+ }
+
+ if (unlikely(pte_val(pte) != pte_val(*ptep))) {
+ put_page(head);
+ put_dev_pagemap(pgmap);
+ pte_unmap(ptep);
+ return 0;
+ }
+
put_dev_pagemap(pgmap);
SetPageReferenced(page);
pages[*nr] = page;
--
2.22.0