Hi reviewers,
I suggest to backport commit "739f79fc9db1 mm: memcontrol: fix NULL
pointer crash in test_clear_page_writeback()" to linux-4.9 stable tree.
This email reports a NULL pointer crash in test_clear_page_writeback()
in android common kernel-4.9. There is a fix ("739f79fc9db1 mm:
memcontrol: fix NULL pointer crash in test_clear_page_writeback()") in
kernel-4.13.
commit: 739f79fc9db1b38f96b5a5109b247a650fbebf6d
subject: mm: memcontrol: fix NULL pointer crash in
test_clear_page_writeback()
kernel version to apply to: Linux-4.9
cheers,
Miles
This is the start of the stable review cycle for the 5.1.9 release.
There are 70 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Tue 11 Jun 2019 04:40:04 PM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.1.9-rc1.…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.1.9-rc1
Jiri Slaby <jslaby(a)suse.cz>
TTY: serial_core, add ->install
Helen Koike <helen.koike(a)collabora.com>
drm/amd: fix fb references in async update
Tina Zhang <tina.zhang(a)intel.com>
drm/i915/gvt: Initialize intel_gvt_gtt_entry in stack
Helen Koike <helen.koike(a)collabora.com>
drm: don't block fb changes for async plane updates
Jonathan Corbet <corbet(a)lwn.net>
drm/i915: Maintain consistent documentation subsection ordering
Weinan <weinan.z.li(a)intel.com>
drm/i915/gvt: emit init breadcrumb for gvt request
Daniel Drake <drake(a)endlessm.com>
drm/i915/fbc: disable framebuffer compression on GeminiLake
Louis Li <Ching-shih.Li(a)amd.com>
drm/amdgpu: fix ring test failure issue during s3 in vce 3.0 (V2)
Harry Wentland <harry.wentland(a)amd.com>
drm/amd/display: Add ASICREV_IS_PICASSO
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu/soc15: skip reset on init
Chris Wilson <chris(a)chris-wilson.co.uk>
drm/i915: Fix I915_EXEC_RING_MASK
Aaron Liu <aaron.liu(a)amd.com>
drm/amdgpu: remove ATPX_DGPU_REQ_POWER_FOR_DISPLAYS check when hotplug-in
Christian König <christian.koenig(a)amd.com>
drm/radeon: prefer lower reference dividers
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu/psp: move psp version specific function pointers to early_init
Mario Kleiner <mario.kleiner.de(a)gmail.com>
drm: Fix timestamp docs for variable refresh properties.
Ryan Pavlik <ryan.pavlik(a)collabora.com>
drm: add non-desktop quirks to Sensics and OSVR headsets.
Dave Airlie <airlied(a)redhat.com>
drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3)
Andres Rodriguez <andresx7(a)gmail.com>
drm: add non-desktop quirk for Valve HMDs
Helen Koike <helen.koike(a)collabora.com>
drm/msm: fix fb references in async update
Patrik Jakobsson <patrik.r.jakobsson(a)gmail.com>
drm/gma500/cdv: Check vbt config bits when detecting lvds panels
Helen Koike <helen.koike(a)collabora.com>
drm/vc4: fix fb references in async update
Helen Koike <helen.koike(a)collabora.com>
drm/rockchip: fix fb references in async update
Dan Carpenter <dan.carpenter(a)oracle.com>
test_firmware: Use correct snprintf() limit
Dan Carpenter <dan.carpenter(a)oracle.com>
genwqe: Prevent an integer overflow in the ioctl
Paul Burton <paul.burton(a)mips.com>
MIPS: pistachio: Build uImage.gz by default
Paul Burton <paul.burton(a)mips.com>
MIPS: Bounds check virt_addr_valid
Roger Pau Monne <roger.pau(a)citrix.com>
xen-blkfront: switch kcalloc to kvcalloc for large array allocation
Sagi Grimberg <sagi(a)grimberg.me>
nvme-rdma: fix queue mapping when queue count is limited
Gerald Schaefer <gerald.schaefer(a)de.ibm.com>
s390/mm: fix address space detection in exception handling
Robert Hancock <hancock(a)sedsystems.ca>
i2c: xiic: Add max_read_len quirk
Jann Horn <jannh(a)google.com>
x86/insn-eval: Fix use-after-free access to LDT entry
Jiri Kosina <jkosina(a)suse.cz>
x86/power: Fix 'nosmt' vs hibernation triple fault during resume
Faiz Abbas <faiz_abbas(a)ti.com>
mmc: sdhci_am654: Fix SLOTTYPE write
Takeshi Saito <takeshi.saito.xv(a)renesas.com>
mmc: tmio: fix SCC error handling to avoid false positive CRC error
Dan Carpenter <dan.carpenter(a)oracle.com>
memstick: mspro_block: Fix an error code in mspro_block_issue_req()
Masahiro Yamada <yamada.masahiro(a)socionext.com>
kbuild: use more portable 'command -v' for cc-cross-prefix
Kees Cook <keescook(a)chromium.org>
pstore/ram: Run without kernel crash dump region
Pi-Hsun Shih <pihsun(a)chromium.org>
pstore: Set tfm to NULL on free_buf_for_compression
Miklos Szeredi <mszeredi(a)redhat.com>
fuse: fix copy_file_range() in the writeback case
Miklos Szeredi <mszeredi(a)redhat.com>
fuse: fallocate: fix return with locked inode
Yihao Wu <wuyihao(a)linux.alibaba.com>
NFSv4.1: Fix bug only first CB_NOTIFY_LOCK is handled
Yihao Wu <wuyihao(a)linux.alibaba.com>
NFSv4.1: Again fix a race where CB_NOTIFY_LOCK fails to wake a waiter
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Fix a use after free when a server rejects the RPCSEC_GSS credential
Olga Kornievskaia <kolga(a)netapp.com>
SUNRPC fix regression in umount of a secure mount
Helge Deller <deller(a)gmx.de>
parisc: Fix crash due alternative coding for NP iopdir_fdc bit
John David Anglin <dave.anglin(a)bell.net>
parisc: Use implicit space register selection for loading the coherence index of I/O pdirs
Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
ARC: mm: SIGSEGV userspace trying to access kernel virtual memory
Jann Horn <jannh(a)google.com>
habanalabs: fix debugfs code
Linus Torvalds <torvalds(a)linux-foundation.org>
rcu: locking and unlocking need to always be at least barriers
Jakub Kicinski <jakub.kicinski(a)netronome.com>
net/tls: replace the sleeping lock around RX resync with a bit lock
Erez Alfasi <ereza(a)mellanox.com>
net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query
David Ahern <dsahern(a)gmail.com>
ipmr_base: Do not reset index in mr_table_dump
Matteo Croce <mcroce(a)redhat.com>
cls_matchall: avoid panic when receiving a packet before filter set
David Ahern <dsahern(a)gmail.com>
neighbor: Call __ipv4_neigh_lookup_noref in neigh_xmit
David Ahern <dsahern(a)gmail.com>
neighbor: Reset gc_entries counter if new entry is released before insert
Nikita Danilov <nikita.danilov(a)aquantia.com>
net: aquantia: fix wol configuration not applied sometimes
Olivier Matz <olivier.matz(a)6wind.com>
ipv6: fix EFAULT on sendto with icmpv6 and hdrincl
Olivier Matz <olivier.matz(a)6wind.com>
ipv6: use READ_ONCE() for inet->hdrincl as in ipv4
Tim Beale <timbeale(a)catalyst.net.nz>
udp: only choose unbound UDP socket for multicast when not in a VRF
Hangbin Liu <liuhangbin(a)gmail.com>
Revert "fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied"
Paolo Abeni <pabeni(a)redhat.com>
pktgen: do not sleep with the thread lock held.
Willem de Bruijn <willemb(a)google.com>
packet: unconditionally free po->rollover
Russell King <rmk+kernel(a)armlinux.org.uk>
net: sfp: read eeprom in maximum 16 byte increments
Zhu Yanjun <yanjun.zhu(a)oracle.com>
net: rds: fix memory leak in rds_ib_flush_mr_pool
Maxime Chevallier <maxime.chevallier(a)bootlin.com>
net: mvpp2: Use strscpy to handle stat strings
Ivan Khoronzhuk <ivan.khoronzhuk(a)linaro.org>
net: ethernet: ti: cpsw_ethtool: fix ethtool ring param set
Xin Long <lucien.xin(a)gmail.com>
ipv6: fix the check before getting the cookie in rt6_get_cookie
Xin Long <lucien.xin(a)gmail.com>
ipv4: not do cache for local delivery if bc_forwarding is enabled
Neil Horman <nhorman(a)tuxdriver.com>
Fix memory leak in sctp_process_init
Vivien Didelot <vivien.didelot(a)gmail.com>
ethtool: fix potential userspace buffer overflow
-------------
Diffstat:
Makefile | 4 +-
arch/arc/mm/fault.c | 9 +-
arch/mips/mm/mmap.c | 5 ++
arch/mips/pistachio/Platform | 1 +
arch/parisc/kernel/alternative.c | 3 +-
arch/s390/mm/fault.c | 5 +-
arch/x86/lib/insn-eval.c | 47 +++++-----
arch/x86/power/cpu.c | 10 +++
arch/x86/power/hibernate.c | 33 ++++++++
drivers/block/xen-blkfront.c | 38 ++++-----
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 3 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 19 +++--
drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 4 +-
drivers/gpu/drm/amd/amdgpu/soc15.c | 5 ++
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +-
drivers/gpu/drm/amd/display/include/dal_asic_id.h | 7 +-
drivers/gpu/drm/drm_atomic_helper.c | 22 ++---
drivers/gpu/drm/drm_connector.c | 6 --
drivers/gpu/drm/drm_edid.c | 25 ++++++
drivers/gpu/drm/gma500/cdv_intel_lvds.c | 3 +
drivers/gpu/drm/gma500/intel_bios.c | 3 +
drivers/gpu/drm/gma500/psb_drv.h | 1 +
drivers/gpu/drm/i915/gvt/gtt.c | 6 +-
drivers/gpu/drm/i915/gvt/scheduler.c | 19 +++++
drivers/gpu/drm/i915/i915_reg.h | 6 +-
drivers/gpu/drm/i915/intel_fbc.c | 4 +
drivers/gpu/drm/i915/intel_workarounds.c | 2 +-
drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 4 +
drivers/gpu/drm/nouveau/Kconfig | 13 ++-
drivers/gpu/drm/nouveau/nouveau_drm.c | 7 +-
drivers/gpu/drm/radeon/radeon_display.c | 4 +-
drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 51 +++++------
drivers/gpu/drm/vc4/vc4_plane.c | 2 +-
drivers/i2c/busses/i2c-xiic.c | 5 ++
drivers/memstick/core/mspro_block.c | 13 ++-
drivers/misc/genwqe/card_dev.c | 2 +
drivers/misc/genwqe/card_utils.c | 4 +
drivers/misc/habanalabs/debugfs.c | 60 ++++---------
drivers/mmc/host/sdhci_am654.c | 2 +-
drivers/mmc/host/tmio_mmc_core.c | 3 +-
.../aquantia/atlantic/hw_atl/hw_atl_utils.c | 14 +--
.../aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c | 4 +-
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 4 +-
drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 4 +-
drivers/net/ethernet/mellanox/mlx4/port.c | 5 --
drivers/net/ethernet/ti/cpsw.c | 1 +
drivers/net/phy/sfp.c | 24 +++++-
drivers/nvme/host/rdma.c | 99 +++++++++++++---------
drivers/parisc/ccio-dma.c | 4 +-
drivers/parisc/sba_iommu.c | 3 +-
drivers/tty/serial/serial_core.c | 24 +++---
fs/fuse/file.c | 14 ++-
fs/nfs/nfs4proc.c | 32 +++----
fs/pstore/platform.c | 7 +-
fs/pstore/ram.c | 36 +++++---
include/drm/drm_modeset_helper_vtables.h | 8 ++
include/linux/cpu.h | 4 +
include/linux/rcupdate.h | 6 +-
include/net/ip6_fib.h | 3 +-
include/net/tls.h | 4 +
include/uapi/drm/i915_drm.h | 2 +-
kernel/cpu.c | 4 +-
kernel/power/hibernate.c | 9 ++
lib/test_firmware.c | 14 +--
net/core/ethtool.c | 5 +-
net/core/fib_rules.c | 6 +-
net/core/neighbour.c | 11 ++-
net/core/pktgen.c | 11 +++
net/ipv4/ipmr_base.c | 3 +-
net/ipv4/route.c | 22 ++---
net/ipv4/udp.c | 3 +-
net/ipv6/raw.c | 25 ++++--
net/packet/af_packet.c | 2 +-
net/rds/ib_rdma.c | 10 ++-
net/sched/cls_matchall.c | 3 +
net/sctp/sm_make_chunk.c | 13 +--
net/sctp/sm_sideeffect.c | 5 ++
net/sunrpc/clnt.c | 30 +++----
net/tls/tls_device.c | 27 ++++--
scripts/Kbuild.include | 7 +-
80 files changed, 612 insertions(+), 363 deletions(-)
pnv_tce() returns a pointer to a TCE entry and originally a TCE table
would be pre-allocated. For the default case of 2GB window the table
needs only a single level and that is fine. However if more levels are
requested, it is possible to get a race when 2 threads want a pointer
to a TCE entry from the same page of TCEs.
This adds cmpxchg to handle the race. Note that once a TCE is non-zero,
it cannot become zero again.
CC: stable(a)vger.kernel.org # v4.19+
Fixes: a68bd1267b72 ("powerpc/powernv/ioda: Allocate indirect TCE levels on demand")
Signed-off-by: Alexey Kardashevskiy <aik(a)ozlabs.ru>
---
The race occurs about 30 times in the first 3 minutes of copying files
via rsync and that's about it.
This fixes EEH's from
https://patchwork.ozlabs.org/project/linuxppc-dev/list/?series=110810
---
Changes:
v2:
* replaced spin_lock with cmpxchg+readonce
---
arch/powerpc/platforms/powernv/pci-ioda-tce.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/arch/powerpc/platforms/powernv/pci-ioda-tce.c b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
index e28f03e1eb5e..8d6569590161 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda-tce.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
@@ -48,6 +48,9 @@ static __be64 *pnv_alloc_tce_level(int nid, unsigned int shift)
return addr;
}
+static void pnv_pci_ioda2_table_do_free_pages(__be64 *addr,
+ unsigned long size, unsigned int levels);
+
static __be64 *pnv_tce(struct iommu_table *tbl, bool user, long idx, bool alloc)
{
__be64 *tmp = user ? tbl->it_userspace : (__be64 *) tbl->it_base;
@@ -57,9 +60,9 @@ static __be64 *pnv_tce(struct iommu_table *tbl, bool user, long idx, bool alloc)
while (level) {
int n = (idx & mask) >> (level * shift);
- unsigned long tce;
+ unsigned long oldtce, tce = be64_to_cpu(READ_ONCE(tmp[n]));
- if (tmp[n] == 0) {
+ if (!tce) {
__be64 *tmp2;
if (!alloc)
@@ -70,10 +73,15 @@ static __be64 *pnv_tce(struct iommu_table *tbl, bool user, long idx, bool alloc)
if (!tmp2)
return NULL;
- tmp[n] = cpu_to_be64(__pa(tmp2) |
- TCE_PCI_READ | TCE_PCI_WRITE);
+ tce = __pa(tmp2) | TCE_PCI_READ | TCE_PCI_WRITE;
+ oldtce = be64_to_cpu(cmpxchg(&tmp[n], 0,
+ cpu_to_be64(tce)));
+ if (oldtce) {
+ pnv_pci_ioda2_table_do_free_pages(tmp2,
+ ilog2(tbl->it_level_size) + 3, 1);
+ tce = oldtce;
+ }
}
- tce = be64_to_cpu(tmp[n]);
tmp = __va(tce & ~(TCE_PCI_READ | TCE_PCI_WRITE));
idx &= ~mask;
--
2.17.1
pnv_tce() returns a pointer to a TCE entry and originally a TCE table
would be pre-allocated. For the default case of 2GB window the table
needs only a single level and that is fine. However if more levels are
requested, it is possible to get a race when 2 threads want a pointer
to a TCE entry from the same page of TCEs.
This adds a spinlock to handle the race. The alloc==true case is not
possible in the real mode so spinlock is safe for KVM as well.
CC: stable(a)vger.kernel.org # v4.19+
Fixes: a68bd1267b72 ("powerpc/powernv/ioda: Allocate indirect TCE levels on demand")
Signed-off-by: Alexey Kardashevskiy <aik(a)ozlabs.ru>
---
This fixes EEH's from
https://patchwork.ozlabs.org/project/linuxppc-dev/list/?series=110810
---
arch/powerpc/include/asm/iommu.h | 1 +
arch/powerpc/platforms/powernv/pci-ioda-tce.c | 21 ++++++++++++-------
2 files changed, 14 insertions(+), 8 deletions(-)
diff --git a/arch/powerpc/include/asm/iommu.h b/arch/powerpc/include/asm/iommu.h
index 2c1845e5e851..1825b4cc0097 100644
--- a/arch/powerpc/include/asm/iommu.h
+++ b/arch/powerpc/include/asm/iommu.h
@@ -111,6 +111,7 @@ struct iommu_table {
struct iommu_table_ops *it_ops;
struct kref it_kref;
int it_nid;
+ spinlock_t it_lock;
};
#define IOMMU_TABLE_USERSPACE_ENTRY_RO(tbl, entry) \
diff --git a/arch/powerpc/platforms/powernv/pci-ioda-tce.c b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
index e28f03e1eb5e..9a19d61e2b12 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda-tce.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
@@ -29,6 +29,7 @@ void pnv_pci_setup_iommu_table(struct iommu_table *tbl,
tbl->it_size = tce_size >> 3;
tbl->it_busno = 0;
tbl->it_type = TCE_PCI;
+ spin_lock_init(&tbl->it_lock);
}
static __be64 *pnv_alloc_tce_level(int nid, unsigned int shift)
@@ -60,18 +61,22 @@ static __be64 *pnv_tce(struct iommu_table *tbl, bool user, long idx, bool alloc)
unsigned long tce;
if (tmp[n] == 0) {
- __be64 *tmp2;
-
if (!alloc)
return NULL;
- tmp2 = pnv_alloc_tce_level(tbl->it_nid,
- ilog2(tbl->it_level_size) + 3);
- if (!tmp2)
- return NULL;
+ spin_lock(&tbl->it_lock);
+ if (tmp[n] == 0) {
+ __be64 *tmp2;
- tmp[n] = cpu_to_be64(__pa(tmp2) |
- TCE_PCI_READ | TCE_PCI_WRITE);
+ tmp2 = pnv_alloc_tce_level(tbl->it_nid,
+ ilog2(tbl->it_level_size) + 3);
+ if (tmp2)
+ tmp[n] = cpu_to_be64(__pa(tmp2) |
+ TCE_PCI_READ | TCE_PCI_WRITE);
+ }
+ spin_unlock(&tbl->it_lock);
+ if (tmp[n] == 0)
+ return NULL;
}
tce = be64_to_cpu(tmp[n]);
--
2.17.1
On Mon, 10 Jun 2019, Sasha Levin wrote:
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: 8b00c3d5d40d ncr5380: Implement new eh_abort_handler.
>
> The bot has tested the following trees: v5.1.7, v4.19.48, v4.14.123, v4.9.180.
>
> v5.1.7: Build OK!
> v4.19.48: Failed to apply! Possible dependencies:
> 6a162836997c ("scsi: NCR5380: Reduce goto statements in NCR5380_select()")
>
> v4.14.123: Failed to apply! Possible dependencies:
> 6a162836997c ("scsi: NCR5380: Reduce goto statements in NCR5380_select()")
>
> v4.9.180: Failed to apply! Possible dependencies:
> 6a162836997c ("scsi: NCR5380: Reduce goto statements in NCR5380_select()")
>
>
> How should we proceed with this patch?
>
> --
> Thanks,
> Sasha
>
Please cherry-pick the dependency, 6a162836997c. It does not alter any
functionality.
--