On Mon, 10 Jun 2019, Sasha Levin wrote:
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: 3a0f64bfa907 mac_scsi: Fix pseudo DMA implementation.
>
> The bot has tested the following trees: v5.1.7, v4.19.48, v4.14.123, v4.9.180.
>
> v5.1.7: Build OK!
> v4.19.48: Build OK!
> v4.14.123: Build OK!
> v4.9.180: Failed to apply! Possible dependencies:
> 25894d1f98ae ("scsi: ncr5380: Improve hostdata struct member alignment and cache-ability")
> 4a98f896bf2c ("scsi: ncr5380: Use correct types for DMA routines")
> 61e1ce588b10 ("scsi: ncr5380: Use correct types for device register accessors")
> 820682b1b34e ("scsi: ncr5380: Store IO ports and addresses in host private data")
> abd12b09292c ("scsi: atari_scsi: Make device register accessors re-entrant")
> b61bacbc2bf5 ("scsi: g_NCR5380: Merge g_NCR5380 and g_NCR5380_mmio drivers")
> d4408dd7ecff ("scsi: ncr5380: Simplify register polling limit")
> d5d37a0ab13b ("scsi: ncr5380: Pass hostdata pointer to register polling routines")
>
>
> How should we proceed with this patch?
>
Please don't backport to v4.9.y.
I added a Cc header in the hope of avoiding this question (Cc:
stable(a)vger.kernel.org # v4.14+) but it appears that this bot doesn't work
that way.
For this particular platform, v4.9.y would need quite a few patches to
bring it up to the same level of stability and functionality as v4.14.y or
v4.19.y. I don't really want to pursue that so I drew the line at v4.14.y.
Thanks.
--
> --
> Thanks,
> Sasha
>
We can not depend on the tcon->open_file_lock here since in multiuser mode
we may have the same file/inode open via multiple different tcons.
The current code is race prone and will crash if one user deletes a file
at the same time a different user opens/create the file.
To avoid this we need to have a spinlock attached to the inode and not the tcon.
RHBZ: 1580165
CC: Stable <stable(a)vger.kernel.org>
Signed-off-by: Ronnie Sahlberg <lsahlber(a)redhat.com>
---
fs/cifs/cifsfs.c | 1 +
fs/cifs/cifsglob.h | 1 +
fs/cifs/file.c | 8 ++++++--
3 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index f5fcd6360056..65d9771e49f9 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -303,6 +303,7 @@ cifs_alloc_inode(struct super_block *sb)
cifs_inode->uniqueid = 0;
cifs_inode->createtime = 0;
cifs_inode->epoch = 0;
+ spin_lock_init(&cifs_inode->open_file_lock);
generate_random_uuid(cifs_inode->lease_key);
/*
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 334ff5f9c3f3..733ddd5fd480 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -1377,6 +1377,7 @@ struct cifsInodeInfo {
struct rw_semaphore lock_sem; /* protect the fields above */
/* BB add in lists for dirty pages i.e. write caching info for oplock */
struct list_head openFileList;
+ spinlock_t open_file_lock; /* protects openFileList */
__u32 cifsAttrs; /* e.g. DOS archive bit, sparse, compressed, system */
unsigned int oplock; /* oplock/lease level we have */
unsigned int epoch; /* used to track lease state changes */
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 06e27ac6d82c..97090693d182 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -338,10 +338,12 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
atomic_inc(&tcon->num_local_opens);
/* if readable file instance put first in list*/
+ spin_lock(&cinode->open_file_lock);
if (file->f_mode & FMODE_READ)
list_add(&cfile->flist, &cinode->openFileList);
else
list_add_tail(&cfile->flist, &cinode->openFileList);
+ spin_unlock(&cinode->open_file_lock);
spin_unlock(&tcon->open_file_lock);
if (fid->purge_cache)
@@ -413,7 +415,9 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)
cifs_add_pending_open_locked(&fid, cifs_file->tlink, &open);
/* remove it from the lists */
+ spin_lock(&cifsi->open_file_lock);
list_del(&cifs_file->flist);
+ spin_unlock(&cifsi->open_file_lock);
list_del(&cifs_file->tlist);
atomic_dec(&tcon->num_local_opens);
@@ -1950,9 +1954,9 @@ cifs_get_writable_file(struct cifsInodeInfo *cifs_inode, bool fsuid_only,
return 0;
}
- spin_lock(&tcon->open_file_lock);
+ spin_lock(&cifs_inode->open_file_lock);
list_move_tail(&inv_file->flist, &cifs_inode->openFileList);
- spin_unlock(&tcon->open_file_lock);
+ spin_unlock(&cifs_inode->open_file_lock);
cifsFileInfo_put(inv_file);
++refind;
inv_file = NULL;
--
2.13.6
This is the start of the stable review cycle for the 4.19.50 release.
There are 51 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Tue 11 Jun 2019 04:40:08 PM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.50-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.50-rc1
Jiri Slaby <jslaby(a)suse.cz>
TTY: serial_core, add ->install
Tina Zhang <tina.zhang(a)intel.com>
drm/i915/gvt: Initialize intel_gvt_gtt_entry in stack
Helen Koike <helen.koike(a)collabora.com>
drm: don't block fb changes for async plane updates
Jonathan Corbet <corbet(a)lwn.net>
drm/i915: Maintain consistent documentation subsection ordering
Daniel Drake <drake(a)endlessm.com>
drm/i915/fbc: disable framebuffer compression on GeminiLake
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu/soc15: skip reset on init
Chris Wilson <chris(a)chris-wilson.co.uk>
drm/i915: Fix I915_EXEC_RING_MASK
Aaron Liu <aaron.liu(a)amd.com>
drm/amdgpu: remove ATPX_DGPU_REQ_POWER_FOR_DISPLAYS check when hotplug-in
Christian König <christian.koenig(a)amd.com>
drm/radeon: prefer lower reference dividers
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu/psp: move psp version specific function pointers to early_init
Ryan Pavlik <ryan.pavlik(a)collabora.com>
drm: add non-desktop quirks to Sensics and OSVR headsets.
Dave Airlie <airlied(a)redhat.com>
drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3)
Andres Rodriguez <andresx7(a)gmail.com>
drm: add non-desktop quirk for Valve HMDs
Helen Koike <helen.koike(a)collabora.com>
drm/msm: fix fb references in async update
Patrik Jakobsson <patrik.r.jakobsson(a)gmail.com>
drm/gma500/cdv: Check vbt config bits when detecting lvds panels
Dan Carpenter <dan.carpenter(a)oracle.com>
test_firmware: Use correct snprintf() limit
Dan Carpenter <dan.carpenter(a)oracle.com>
genwqe: Prevent an integer overflow in the ioctl
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "MIPS: perf: ath79: Fix perfcount IRQ assignment"
Paul Burton <paul.burton(a)mips.com>
MIPS: pistachio: Build uImage.gz by default
Paul Burton <paul.burton(a)mips.com>
MIPS: Bounds check virt_addr_valid
Roger Pau Monne <roger.pau(a)citrix.com>
xen-blkfront: switch kcalloc to kvcalloc for large array allocation
Gerald Schaefer <gerald.schaefer(a)de.ibm.com>
s390/mm: fix address space detection in exception handling
Robert Hancock <hancock(a)sedsystems.ca>
i2c: xiic: Add max_read_len quirk
Jann Horn <jannh(a)google.com>
x86/insn-eval: Fix use-after-free access to LDT entry
Jiri Kosina <jkosina(a)suse.cz>
x86/power: Fix 'nosmt' vs hibernation triple fault during resume
Kees Cook <keescook(a)chromium.org>
pstore/ram: Run without kernel crash dump region
Pi-Hsun Shih <pihsun(a)chromium.org>
pstore: Set tfm to NULL on free_buf_for_compression
Kees Cook <keescook(a)chromium.org>
pstore: Convert buf_lock to semaphore
Kees Cook <keescook(a)chromium.org>
pstore: Remove needless lock during console writes
Miklos Szeredi <mszeredi(a)redhat.com>
fuse: fallocate: fix return with locked inode
Yihao Wu <wuyihao(a)linux.alibaba.com>
NFSv4.1: Fix bug only first CB_NOTIFY_LOCK is handled
Yihao Wu <wuyihao(a)linux.alibaba.com>
NFSv4.1: Again fix a race where CB_NOTIFY_LOCK fails to wake a waiter
John David Anglin <dave.anglin(a)bell.net>
parisc: Use implicit space register selection for loading the coherence index of I/O pdirs
Linus Torvalds <torvalds(a)linux-foundation.org>
rcu: locking and unlocking need to always be at least barriers
Emil Lenngren <emil.lenngren(a)gmail.com>
mtd: spinand: macronix: Fix ECC Status Read
Olivier Matz <olivier.matz(a)6wind.com>
ipv6: fix EFAULT on sendto with icmpv6 and hdrincl
Olivier Matz <olivier.matz(a)6wind.com>
ipv6: use READ_ONCE() for inet->hdrincl as in ipv4
Hangbin Liu <liuhangbin(a)gmail.com>
Revert "fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied"
Paolo Abeni <pabeni(a)redhat.com>
pktgen: do not sleep with the thread lock held.
Willem de Bruijn <willemb(a)google.com>
packet: unconditionally free po->rollover
Jakub Kicinski <jakub.kicinski(a)netronome.com>
net/tls: replace the sleeping lock around RX resync with a bit lock
Russell King <rmk+kernel(a)armlinux.org.uk>
net: sfp: read eeprom in maximum 16 byte increments
Zhu Yanjun <yanjun.zhu(a)oracle.com>
net: rds: fix memory leak in rds_ib_flush_mr_pool
Maxime Chevallier <maxime.chevallier(a)bootlin.com>
net: mvpp2: Use strscpy to handle stat strings
Erez Alfasi <ereza(a)mellanox.com>
net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query
Ivan Khoronzhuk <ivan.khoronzhuk(a)linaro.org>
net: ethernet: ti: cpsw_ethtool: fix ethtool ring param set
David Ahern <dsahern(a)gmail.com>
neighbor: Call __ipv4_neigh_lookup_noref in neigh_xmit
Xin Long <lucien.xin(a)gmail.com>
ipv6: fix the check before getting the cookie in rt6_get_cookie
Xin Long <lucien.xin(a)gmail.com>
ipv4: not do cache for local delivery if bc_forwarding is enabled
Neil Horman <nhorman(a)tuxdriver.com>
Fix memory leak in sctp_process_init
Vivien Didelot <vivien.didelot(a)gmail.com>
ethtool: fix potential userspace buffer overflow
-------------
Diffstat:
Makefile | 4 +-
arch/mips/ath79/setup.c | 6 ++
arch/mips/mm/mmap.c | 5 ++
arch/mips/pistachio/Platform | 1 +
arch/powerpc/kernel/nvram_64.c | 2 -
arch/s390/mm/fault.c | 5 +-
arch/x86/lib/insn-eval.c | 47 ++++++++-------
arch/x86/power/cpu.c | 10 ++++
arch/x86/power/hibernate_64.c | 33 ++++++++++
drivers/acpi/apei/erst.c | 1 -
drivers/block/xen-blkfront.c | 38 ++++++------
drivers/firmware/efi/efi-pstore.c | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 3 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 19 +++---
drivers/gpu/drm/amd/amdgpu/soc15.c | 5 ++
drivers/gpu/drm/drm_atomic_helper.c | 22 +++----
drivers/gpu/drm/drm_edid.c | 25 ++++++++
drivers/gpu/drm/gma500/cdv_intel_lvds.c | 3 +
drivers/gpu/drm/gma500/intel_bios.c | 3 +
drivers/gpu/drm/gma500/psb_drv.h | 1 +
drivers/gpu/drm/i915/gvt/gtt.c | 6 +-
drivers/gpu/drm/i915/i915_reg.h | 6 +-
drivers/gpu/drm/i915/intel_fbc.c | 4 ++
drivers/gpu/drm/i915/intel_workarounds.c | 2 +-
drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 4 ++
drivers/gpu/drm/nouveau/Kconfig | 13 +++-
drivers/gpu/drm/nouveau/nouveau_drm.c | 7 ++-
drivers/gpu/drm/radeon/radeon_display.c | 4 +-
drivers/i2c/busses/i2c-xiic.c | 5 ++
drivers/irqchip/irq-ath79-misc.c | 11 ----
drivers/misc/genwqe/card_dev.c | 2 +
drivers/misc/genwqe/card_utils.c | 4 ++
drivers/mtd/nand/spi/macronix.c | 8 ++-
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 4 +-
drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 4 +-
drivers/net/ethernet/mellanox/mlx4/port.c | 5 --
drivers/net/ethernet/ti/cpsw.c | 2 +-
drivers/net/phy/sfp.c | 24 ++++++--
drivers/parisc/ccio-dma.c | 4 +-
drivers/parisc/sba_iommu.c | 3 +-
drivers/tty/serial/serial_core.c | 24 ++++----
fs/fuse/file.c | 2 +-
fs/nfs/nfs4proc.c | 32 ++++------
fs/pstore/platform.c | 80 +++++++++++--------------
fs/pstore/ram.c | 37 +++++++-----
include/drm/drm_modeset_helper_vtables.h | 8 +++
include/linux/cpu.h | 4 ++
include/linux/pstore.h | 7 +--
include/linux/rcupdate.h | 6 +-
include/net/ip6_fib.h | 3 +-
include/net/tls.h | 4 ++
include/uapi/drm/i915_drm.h | 2 +-
kernel/cpu.c | 4 +-
kernel/power/hibernate.c | 9 +++
lib/test_firmware.c | 14 ++---
net/core/ethtool.c | 5 +-
net/core/fib_rules.c | 6 +-
net/core/neighbour.c | 9 ++-
net/core/pktgen.c | 11 ++++
net/ipv4/route.c | 22 +++----
net/ipv6/raw.c | 25 +++++---
net/packet/af_packet.c | 2 +-
net/rds/ib_rdma.c | 10 ++--
net/sctp/sm_make_chunk.c | 13 +---
net/sctp/sm_sideeffect.c | 5 ++
net/tls/tls_device.c | 27 +++++++--
66 files changed, 461 insertions(+), 269 deletions(-)
This is the start of the stable review cycle for the 4.14.125 release.
There are 35 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Tue 11 Jun 2019 04:40:01 PM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.125-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.125-rc1
Kirill Smelkov <kirr(a)nexedi.com>
fuse: Add FOPEN_STREAM to use stream_open()
Kirill Smelkov <kirr(a)nexedi.com>
fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock
Kristian Evensen <kristian.evensen(a)gmail.com>
qmi_wwan: Add quirk for Quectel dynamic config
Jiri Slaby <jslaby(a)suse.cz>
TTY: serial_core, add ->install
Daniel Drake <drake(a)endlessm.com>
drm/i915/fbc: disable framebuffer compression on GeminiLake
Chris Wilson <chris(a)chris-wilson.co.uk>
drm/i915: Fix I915_EXEC_RING_MASK
Christian König <christian.koenig(a)amd.com>
drm/radeon: prefer lower reference dividers
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu/psp: move psp version specific function pointers to early_init
Dave Airlie <airlied(a)redhat.com>
drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3)
Patrik Jakobsson <patrik.r.jakobsson(a)gmail.com>
drm/gma500/cdv: Check vbt config bits when detecting lvds panels
Dan Carpenter <dan.carpenter(a)oracle.com>
test_firmware: Use correct snprintf() limit
Dan Carpenter <dan.carpenter(a)oracle.com>
genwqe: Prevent an integer overflow in the ioctl
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "MIPS: perf: ath79: Fix perfcount IRQ assignment"
Paul Burton <paul.burton(a)mips.com>
MIPS: pistachio: Build uImage.gz by default
Paul Burton <paul.burton(a)mips.com>
MIPS: Bounds check virt_addr_valid
Robert Hancock <hancock(a)sedsystems.ca>
i2c: xiic: Add max_read_len quirk
Jiri Kosina <jkosina(a)suse.cz>
x86/power: Fix 'nosmt' vs hibernation triple fault during resume
Kees Cook <keescook(a)chromium.org>
pstore/ram: Run without kernel crash dump region
Kees Cook <keescook(a)chromium.org>
pstore: Convert buf_lock to semaphore
Kees Cook <keescook(a)chromium.org>
pstore: Remove needless lock during console writes
Miklos Szeredi <mszeredi(a)redhat.com>
fuse: fallocate: fix return with locked inode
John David Anglin <dave.anglin(a)bell.net>
parisc: Use implicit space register selection for loading the coherence index of I/O pdirs
Linus Torvalds <torvalds(a)linux-foundation.org>
rcu: locking and unlocking need to always be at least barriers
Hangbin Liu <liuhangbin(a)gmail.com>
Revert "fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied"
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "fib_rules: fix error in backport of e9919a24d302 ("fib_rules: return 0...")"
Xin Long <lucien.xin(a)gmail.com>
ipv6: fix the check before getting the cookie in rt6_get_cookie
Russell King <rmk+kernel(a)armlinux.org.uk>
net: sfp: read eeprom in maximum 16 byte increments
Olivier Matz <olivier.matz(a)6wind.com>
ipv6: use READ_ONCE() for inet->hdrincl as in ipv4
Olivier Matz <olivier.matz(a)6wind.com>
ipv6: fix EFAULT on sendto with icmpv6 and hdrincl
Paolo Abeni <pabeni(a)redhat.com>
pktgen: do not sleep with the thread lock held.
Zhu Yanjun <yanjun.zhu(a)oracle.com>
net: rds: fix memory leak in rds_ib_flush_mr_pool
Erez Alfasi <ereza(a)mellanox.com>
net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query
David Ahern <dsahern(a)gmail.com>
neighbor: Call __ipv4_neigh_lookup_noref in neigh_xmit
Neil Horman <nhorman(a)tuxdriver.com>
Fix memory leak in sctp_process_init
Vivien Didelot <vivien.didelot(a)gmail.com>
ethtool: fix potential userspace buffer overflow
-------------
Diffstat:
Makefile | 4 +-
arch/mips/ath79/setup.c | 6 +
arch/mips/mm/mmap.c | 5 +
arch/mips/pistachio/Platform | 1 +
arch/powerpc/kernel/nvram_64.c | 2 -
arch/x86/power/cpu.c | 10 +
arch/x86/power/hibernate_64.c | 33 +++
drivers/acpi/apei/erst.c | 1 -
drivers/firmware/efi/efi-pstore.c | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 19 +-
drivers/gpu/drm/gma500/cdv_intel_lvds.c | 3 +
drivers/gpu/drm/gma500/intel_bios.c | 3 +
drivers/gpu/drm/gma500/psb_drv.h | 1 +
drivers/gpu/drm/i915/intel_fbc.c | 4 +
drivers/gpu/drm/nouveau/Kconfig | 13 +-
drivers/gpu/drm/nouveau/nouveau_drm.c | 7 +-
drivers/gpu/drm/radeon/radeon_display.c | 4 +-
drivers/i2c/busses/i2c-xiic.c | 5 +
drivers/irqchip/irq-ath79-misc.c | 11 -
drivers/misc/genwqe/card_dev.c | 2 +
drivers/misc/genwqe/card_utils.c | 4 +
drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 4 +-
drivers/net/ethernet/mellanox/mlx4/port.c | 5 -
drivers/net/phy/sfp.c | 24 +-
drivers/net/usb/qmi_wwan.c | 39 ++-
drivers/parisc/ccio-dma.c | 4 +-
drivers/parisc/sba_iommu.c | 3 +-
drivers/tty/serial/serial_core.c | 24 +-
drivers/xen/xenbus/xenbus_dev_frontend.c | 4 +-
fs/fuse/file.c | 6 +-
fs/open.c | 18 ++
fs/pstore/platform.c | 76 ++---
fs/pstore/ram.c | 37 ++-
fs/read_write.c | 5 +-
include/linux/cpu.h | 4 +
include/linux/fs.h | 4 +
include/linux/pstore.h | 7 +-
include/linux/rcupdate.h | 6 +-
include/net/ip6_fib.h | 3 +-
include/uapi/drm/i915_drm.h | 2 +-
include/uapi/linux/fuse.h | 2 +
kernel/cpu.c | 4 +-
kernel/power/hibernate.c | 9 +
lib/test_firmware.c | 14 +-
net/core/ethtool.c | 5 +-
net/core/fib_rules.c | 7 +-
net/core/neighbour.c | 9 +-
net/core/pktgen.c | 11 +
net/ipv6/raw.c | 25 +-
net/rds/ib_rdma.c | 10 +-
net/sctp/sm_make_chunk.c | 13 +-
net/sctp/sm_sideeffect.c | 5 +
scripts/coccinelle/api/stream_open.cocci | 363 ++++++++++++++++++++++++
53 files changed, 720 insertions(+), 174 deletions(-)
> This patch tries to avoid EAGAIN due to nrpages!=0 that was originally trying
> to drop stale pages resulting in wrong data access.
> Report: https://bugs.chromium.org/p/chromium/issues/detail?id=938958#c38
>
> Cc: <stable(a)vger.kernel.org>
> Cc: Jens Axboe <axboe(a)kernel.dk>
> Cc: linux-block(a)vger.kernel.org
> Cc: Bart Van Assche <bvanassche(a)acm.org>
> Fixes: 5db470e229e2 ("loop: drop caches if offset or block_size are changed")
> Reported-by: Gwendal Grignou <gwendal(a)chromium.org>
> Reported-by: grygorii tertychnyi <gtertych(a)cisco.com>
> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org>
> ---
> v2 from v1:
> - remove obsolete jump
FWIW, after applying this patch to 4.19.47, losetup is not failing any
more for me.
Thanks,
Francesco Ruggeri
The patch titled
Subject: mm: hugetlb: soft-offline: dissolve_free_huge_page() return zero on !PageHuge
has been added to the -mm tree. Its filename is
mm-hugetlb-soft-offline-dissolve_free_huge_page-return-zero-on-pagehuge.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-hugetlb-soft-offline-dissolve_f…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-hugetlb-soft-offline-dissolve_f…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com>
Subject: mm: hugetlb: soft-offline: dissolve_free_huge_page() return zero on !PageHuge
madvise(MADV_SOFT_OFFLINE) often returns -EBUSY when calling soft offline
for hugepages with overcommitting enabled. That was caused by the
suboptimal code in current soft-offline code. See the following part:
ret = migrate_pages(&pagelist, new_page, NULL, MPOL_MF_MOVE_ALL,
MIGRATE_SYNC, MR_MEMORY_FAILURE);
if (ret) {
...
} else {
/*
* We set PG_hwpoison only when the migration source hugepage
* was successfully dissolved, because otherwise hwpoisoned
* hugepage remains on free hugepage list, then userspace will
* find it as SIGBUS by allocation failure. That's not expected
* in soft-offlining.
*/
ret = dissolve_free_huge_page(page);
if (!ret) {
if (set_hwpoison_free_buddy_page(page))
num_poisoned_pages_inc();
}
}
return ret;
Here dissolve_free_huge_page() returns -EBUSY if the migration source page
was freed into buddy in migrate_pages(), but even in that case we actually
has a chance that set_hwpoison_free_buddy_page() succeeds. So that means
current code gives up offlining too early now.
dissolve_free_huge_page() checks that a given hugepage is suitable for
dissolving, where we should return success for !PageHuge() case because
the given hugepage is considered as already dissolved.
This change also affects other callers of dissolve_free_huge_page(), which
are cleaned up together.
Link: http://lkml.kernel.org/r/1560154686-18497-3-git-send-email-n-horiguchi@ah.j…
Fixes: 6bc9b56433b76 ("mm: fix race on soft-offlining")
Signed-off-by: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com>
Reported-by: Chen, Jerry T <jerry.t.chen(a)intel.com>
Tested-by: Chen, Jerry T <jerry.t.chen(a)intel.com>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Xishi Qiu <xishi.qiuxishi(a)alibaba-inc.com>
Cc: "Chen, Jerry T" <jerry.t.chen(a)intel.com>
Cc: "Zhuo, Qiuxu" <qiuxu.zhuo(a)intel.com>
Cc: <stable(a)vger.kernel.org> [4.19+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/hugetlb.c | 15 +++++++++------
mm/memory-failure.c | 5 +----
2 files changed, 10 insertions(+), 10 deletions(-)
--- a/mm/hugetlb.c~mm-hugetlb-soft-offline-dissolve_free_huge_page-return-zero-on-pagehuge
+++ a/mm/hugetlb.c
@@ -1519,7 +1519,12 @@ int dissolve_free_huge_page(struct page
int rc = -EBUSY;
spin_lock(&hugetlb_lock);
- if (PageHuge(page) && !page_count(page)) {
+ if (!PageHuge(page)) {
+ rc = 0;
+ goto out;
+ }
+
+ if (!page_count(page)) {
struct page *head = compound_head(page);
struct hstate *h = page_hstate(head);
int nid = page_to_nid(head);
@@ -1564,11 +1569,9 @@ int dissolve_free_huge_pages(unsigned lo
for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order) {
page = pfn_to_page(pfn);
- if (PageHuge(page) && !page_count(page)) {
- rc = dissolve_free_huge_page(page);
- if (rc)
- break;
- }
+ rc = dissolve_free_huge_page(page);
+ if (rc)
+ break;
}
return rc;
--- a/mm/memory-failure.c~mm-hugetlb-soft-offline-dissolve_free_huge_page-return-zero-on-pagehuge
+++ a/mm/memory-failure.c
@@ -1856,11 +1856,8 @@ static int soft_offline_in_use_page(stru
static int soft_offline_free_page(struct page *page)
{
- int rc = 0;
- struct page *head = compound_head(page);
+ int rc = dissolve_free_huge_page(page);
- if (PageHuge(head))
- rc = dissolve_free_huge_page(page);
if (!rc) {
if (set_hwpoison_free_buddy_page(page))
num_poisoned_pages_inc();
_
Patches currently in -mm which might be from n-horiguchi(a)ah.jp.nec.com are
mm-soft-offline-return-ebusy-if-set_hwpoison_free_buddy_page-fails.patch
mm-hugetlb-soft-offline-dissolve_free_huge_page-return-zero-on-pagehuge.patch
The patch titled
Subject: mm: soft-offline: return -EBUSY if set_hwpoison_free_buddy_page() fails
has been added to the -mm tree. Its filename is
mm-soft-offline-return-ebusy-if-set_hwpoison_free_buddy_page-fails.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-soft-offline-return-ebusy-if-se…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-soft-offline-return-ebusy-if-se…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com>
Subject: mm: soft-offline: return -EBUSY if set_hwpoison_free_buddy_page() fails
The pass/fail of soft offline should be judged by checking whether the raw
error page was finally contained or not (i.e. the result of
set_hwpoison_free_buddy_page()), but current code do not work like that.
So this patch is suggesting to fix it.
Link: http://lkml.kernel.org/r/1560154686-18497-2-git-send-email-n-horiguchi@ah.j…
Signed-off-by: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com>
Fixes: 6bc9b56433b76 ("mm: fix race on soft-offlining")
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Xishi Qiu <xishi.qiuxishi(a)alibaba-inc.com>
Cc: "Chen, Jerry T" <jerry.t.chen(a)intel.com>
Cc: "Zhuo, Qiuxu" <qiuxu.zhuo(a)intel.com>
Cc: <stable(a)vger.kernel.org> [4.19+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memory-failure.c | 2 ++
1 file changed, 2 insertions(+)
--- a/mm/memory-failure.c~mm-soft-offline-return-ebusy-if-set_hwpoison_free_buddy_page-fails
+++ a/mm/memory-failure.c
@@ -1730,6 +1730,8 @@ static int soft_offline_huge_page(struct
if (!ret) {
if (set_hwpoison_free_buddy_page(page))
num_poisoned_pages_inc();
+ else
+ ret = -EBUSY;
}
}
return ret;
_
Patches currently in -mm which might be from n-horiguchi(a)ah.jp.nec.com are
mm-soft-offline-return-ebusy-if-set_hwpoison_free_buddy_page-fails.patch
mm-hugetlb-soft-offline-dissolve_free_huge_page-return-zero-on-pagehuge.patch
The patch titled
Subject: mm/vmscan.c: fix trying to reclaim unevictable LRU page
has been added to the -mm tree. Its filename is
mm-fix-trying-to-reclaim-unevicable-lru-page.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-fix-trying-to-reclaim-unevicabl…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-fix-trying-to-reclaim-unevicabl…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Minchan Kim <minchan(a)kernel.org>
Subject: mm/vmscan.c: fix trying to reclaim unevictable LRU page
There was the below bug report from Wu Fangsuo.
On the CMA allocation path, isolate_migratepages_range() could isolate
unevictable LRU pages and reclaim_clean_page_from_list() can try to
reclaim them if they are clean file-backed pages.
7200 [ 680.491097] c4 7125 (syz-executor) page:ffffffbf02f33b40 count:86 mapcount:84 mapping:ffffffc08fa7a810 index:0x24
7201 [ 680.531186] c4 7125 (syz-executor) flags: 0x19040c(referenced|uptodate|arch_1|mappedtodisk|unevictable|mlocked)
7202 [ 680.544987] c0 7125 (syz-executor) raw: 000000000019040c ffffffc08fa7a810 0000000000000024 0000005600000053
7203 [ 680.556162] c0 7125 (syz-executor) raw: ffffffc009b05b20 ffffffc009b05b20 0000000000000000 ffffffc09bf3ee80
7204 [ 680.566860] c0 7125 (syz-executor) page dumped because: VM_BUG_ON_PAGE(PageLRU(page) || PageUnevictable(page))
7205 [ 680.578038] c0 7125 (syz-executor) page->mem_cgroup:ffffffc09bf3ee80
7206 [ 680.585467] c0 7125 (syz-executor) ------------[ cut here ]------------
7207 [ 680.592466] c0 7125 (syz-executor) kernel BUG at /home/build/farmland/adroid9.0/kernel/linux/mm/vmscan.c:1350!
7223 [ 680.603663] c0 7125 (syz-executor) Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
7224 [ 680.611436] c0 7125 (syz-executor) Modules linked in:
7225 [ 680.616769] c0 7125 (syz-executor) CPU: 0 PID: 7125 Comm: syz-executor Tainted: G S 4.14.81 #3
7226 [ 680.626826] c0 7125 (syz-executor) Hardware name: ASR AQUILAC EVB (DT)
7227 [ 680.633623] c0 7125 (syz-executor) task: ffffffc00a54cd00 task.stack: ffffffc009b00000
7228 [ 680.641917] c0 7125 (syz-executor) PC is at shrink_page_list+0x1998/0x3240
7229 [ 680.649144] c0 7125 (syz-executor) LR is at shrink_page_list+0x1998/0x3240
7230 [ 680.656303] c0 7125 (syz-executor) pc : [<ffffff90083a2158>] lr : [<ffffff90083a2158>] pstate: 60400045
7231 [ 680.666086] c0 7125 (syz-executor) sp : ffffffc009b05940
..
7342 [ 681.671308] c0 7125 (syz-executor) [<ffffff90083a2158>] shrink_page_list+0x1998/0x3240
7343 [ 681.679567] c0 7125 (syz-executor) [<ffffff90083a3dc0>] reclaim_clean_pages_from_list+0x3c0/0x4f0
7344 [ 681.688793] c0 7125 (syz-executor) [<ffffff900837ed64>] alloc_contig_range+0x3bc/0x650
7347 [ 681.717421] c0 7125 (syz-executor) [<ffffff90084925cc>] cma_alloc+0x214/0x668
7348 [ 681.724892] c0 7125 (syz-executor) [<ffffff90091e4d78>] ion_cma_allocate+0x98/0x1d8
7349 [ 681.732872] c0 7125 (syz-executor) [<ffffff90091e0b20>] ion_alloc+0x200/0x7e0
7350 [ 681.740302] c0 7125 (syz-executor) [<ffffff90091e154c>] ion_ioctl+0x18c/0x378
7351 [ 681.747738] c0 7125 (syz-executor) [<ffffff90084c6824>] do_vfs_ioctl+0x17c/0x1780
7352 [ 681.755514] c0 7125 (syz-executor) [<ffffff90084c7ed4>] SyS_ioctl+0xac/0xc0
Wu found it's due to ad6b67041a45 ("mm: remove SWAP_MLOCK in ttu").
Before that, unevictable pages go to cull_mlocked so that we can't reach
the VM_BUG_ON_PAGE line.
To fix the issue, this patch filters out unevictable LRU pages from the
reclaim_clean_pages_from_list in CMA.
Link: http://lkml.kernel.org/r/20190524071114.74202-1-minchan@kernel.org
Fixes: ad6b67041a45 ("mm: remove SWAP_MLOCK in ttu")
Signed-off-by: Minchan Kim <minchan(a)kernel.org>
Reported-by: Wu Fangsuo <fangsuowu(a)asrmicro.com>
Debugged-by: Wu Fangsuo <fangsuowu(a)asrmicro.com>
Tested-by: Wu Fangsuo <fangsuowu(a)asrmicro.com>
Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Pankaj Suryawanshi <pankaj.suryawanshi(a)einfochips.com>
Cc: <stable(a)vger.kernel.org> [4.12+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/vmscan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/vmscan.c~mm-fix-trying-to-reclaim-unevicable-lru-page
+++ a/mm/vmscan.c
@@ -1505,7 +1505,7 @@ unsigned long reclaim_clean_pages_from_l
list_for_each_entry_safe(page, next, page_list, lru) {
if (page_is_file_cache(page) && !PageDirty(page) &&
- !__PageMovable(page)) {
+ !__PageMovable(page) && !PageUnevictable(page)) {
ClearPageActive(page);
list_move(&page->lru, &clean_pages);
}
_
Patches currently in -mm which might be from minchan(a)kernel.org are
mm-fix-trying-to-reclaim-unevicable-lru-page.patch
The vsyscall=native feature is gone -- remove the docs.
Fixes: 076ca272a14c ("x86/vsyscall/64: Drop "native" vsyscalls")
Cc: stable(a)vger.kernel.org
Cc: Kees Cook <keescook(a)chromium.org>
Cc: Borislav Petkov <bp(a)alien8.de>
Cc: Kernel Hardening <kernel-hardening(a)lists.openwall.com>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Signed-off-by: Andy Lutomirski <luto(a)kernel.org>
---
Documentation/admin-guide/kernel-parameters.txt | 6 ------
1 file changed, 6 deletions(-)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 43176340c73d..e1a3525d07f2 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -5086,12 +5086,6 @@
emulate [default] Vsyscalls turn into traps and are
emulated reasonably safely.
- native Vsyscalls are native syscall instructions.
- This is a little bit faster than trapping
- and makes a few dynamic recompilers work
- better than they would in emulation mode.
- It also makes exploits much easier to write.
-
none Vsyscalls don't work at all. This makes
them quite hard to use for exploits but
might break your system.
--
2.21.0