July 2019 - Linux-stable-mirror

[PATCH] drm/i915/gvt: fix incorrect cache entry for guest page mapping

by Xiaolin Zhang

GPU hang observed during the guest OCL conformance test which is caused by THP GTT feature used durning the test. It was observed the same GFN with different size (4K and 2M) requested from the guest in GVT. So during the guest page dma map stage, it is required to unmap first with orginal size and then remap again with requested size. Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support") Cc: stable(a)vger.kernel.org Signed-off-by: Xiaolin Zhang <xiaolin.zhang(a)intel.com> --- drivers/gpu/drm/i915/gvt/kvmgt.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c index a68addf..4a7cf86 100644 --- a/drivers/gpu/drm/i915/gvt/kvmgt.c +++ b/drivers/gpu/drm/i915/gvt/kvmgt.c @@ -1911,6 +1911,18 @@ static int kvmgt_dma_map_guest_page(unsigned long handle, unsigned long gfn, ret = __gvt_cache_add(info->vgpu, gfn, *dma_addr, size); if (ret) goto err_unmap; + } else if (entry->size != size) { + /* the same gfn with different size: unmap and re-map */ + gvt_dma_unmap_page(vgpu, gfn, entry->dma_addr, entry->size); + __gvt_cache_remove_entry(vgpu, entry); + + ret = gvt_dma_map_page(vgpu, gfn, dma_addr, size); + if (ret) + goto err_unlock; + + ret = __gvt_cache_add(info->vgpu, gfn, *dma_addr, size); + if (ret) + goto err_unmap; } else { kref_get(&entry->ref); *dma_addr = entry->dma_addr; -- 1.8.3.1

5 years, 5 months

2
1
0 0

[PATCH 1/4] dt-bindings: allow up to four clocks for orion-mdio

by josua＠solid-run.com

From: Josua Mayer <josua(a)solid-run.com> Armada 8040 needs four clocks to be enabled for MDIO accesses to work. Update the binding to allow the extra clock to be specified. Cc: stable(a)vger.kernel.org Fixes: 6d6a331f44a1 ("dt-bindings: allow up to three clocks for orion-mdio") Signed-off-by: Josua Mayer <josua(a)solid-run.com> --- Documentation/devicetree/bindings/net/marvell-orion-mdio.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt b/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt index 42cd81090a2c..3f3cfc1d8d4d 100644 --- a/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt +++ b/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt @@ -16,7 +16,7 @@ Required properties: Optional properties: - interrupts: interrupt line number for the SMI error/done interrupt -- clocks: phandle for up to three required clocks for the MDIO instance +- clocks: phandle for up to four required clocks for the MDIO instance The child nodes of the MDIO driver are the individual PHY devices connected to this MDIO bus. They must have a "reg" property given the -- 2.16.4

5 years, 5 months

3
5
0 0

[PATCH v4 0/6] VAG power control improvement for sgtl5000 codec

by Oleksandr Suvorov

VAG power control is improved to fit the manual [1]. This patchset fixes as minimum one bug: if customer muxes Headphone to Line-In right after boot, the VAG power remains off that leads to poor sound quality from line-in. I.e. after boot: - Connect sound source to Line-In jack; - Connect headphone to HP jack; - Run following commands: $ amixer set 'Headphone' 80% $ amixer set 'Headphone Mux' LINE_IN Also this series includes fixes of non-important bugs in sgtl5000 codec driver. [1] https://www.nxp.com/docs/en/data-sheet/SGTL5000.pdf Changes in v4: - CC the patch to kernel-stable - Code optimization, simplify function signature (thanks to Cezary Rojewski <cezary.rojewski(a)intel.com> for an idea) - CC the patch to kernel-stable - Add a Fixes tag Changes in v3: - Add the reference to NXP SGTL5000 data sheet to commit message - Add the reference to NXP SGTL5000 data sheet to commit message - Fix multi-line comment format Changes in v2: - Fix patch formatting - Fix patch formatting - Fix patch formatting - Fix patch formatting - Fix patch formatting - Fix patch formatting Oleksandr Suvorov (6): ASoC: Define a set of DAPM pre/post-up events ASoC: sgtl5000: Improve VAG power and mute control ASoC: sgtl5000: Fix definition of VAG Ramp Control ASoC: sgtl5000: add ADC mute control ASoC: sgtl5000: Fix of unmute outputs on probe ASoC: sgtl5000: Fix charge pump source assignment include/sound/soc-dapm.h | 2 + sound/soc/codecs/sgtl5000.c | 240 ++++++++++++++++++++++++++++++------ sound/soc/codecs/sgtl5000.h | 2 +- 3 files changed, 203 insertions(+), 41 deletions(-) -- 2.20.1

5 years, 5 months

3
5
0 0

[v4.14.y PATCH 0/2] fix drm/udl use-after-free error

by Ross Zwisler

When testing with a device which uses the drm/udl driver, KASAN shows that on hot-remove we have a use-after-free: ================================================================== BUG: KASAN: use-after-free in do_raw_spin_lock+0x1c/0xd0 Read of size 4 at addr ffff888385e325fc by task kworker/2:2/47 CPU: 2 PID: 47 Comm: kworker/2:2 Tainted: G U 4.14.133 #19 Hardware name: GOOGLE Samus, BIOS Google_Samus.6300.276.0 08/17/2016 Workqueue: events drm_mode_rmfb_work_fn Call Trace: dump_stack+0x67/0x92 print_address_description+0x80/0x2d6 ? do_raw_spin_lock+0x1c/0xd0 kasan_report+0x255/0x295 do_raw_spin_lock+0x1c/0xd0 _raw_spin_lock_irqsave+0x42/0x4e ? down_timeout+0x19/0x58 down_timeout+0x19/0x58 udl_get_urb+0x3d/0x13b ? drm_helper_encoder_in_use+0xc2/0xe1 udl_crtc_dpms+0x45/0x274 __drm_helper_disable_unused_functions+0xed/0x150 drm_crtc_helper_set_config+0x22d/0xfc2 ? lock_acquire+0x1e4/0x21a ? modeset_lock+0x165/0x20e ? __mutex_trylock+0x9/0x11 ? debug_lockdep_rcu_enabled+0x2a/0x59 __drm_mode_set_config_internal+0xf3/0x240 drm_crtc_force_disable+0x68/0x83 drm_framebuffer_remove+0x10b/0x1af drm_mode_rmfb_work_fn+0x8d/0x9b process_one_work+0x42f/0x7a2 worker_thread+0x3a4/0x483 ? flush_delayed_work+0x64/0x64 kthread+0x1e7/0x1f7 ? __init_completion+0x2c/0x2c ret_from_fork+0x3a/0x50 Allocated by task 1959: save_stack+0x46/0xce kasan_kmalloc+0x99/0xa8 kmem_cache_alloc_trace+0x10d/0x133 udl_driver_load+0x59/0x7fe drm_dev_register+0x16b/0x2fd udl_usb_probe+0x4f/0xa6 usb_probe_interface+0x26a/0x31d driver_probe_device+0x1d5/0x411 bus_for_each_drv+0xbe/0xe5 __device_attach+0xdd/0x15b bus_probe_device+0x5a/0x10b device_add+0x468/0x7fb usb_set_configuration+0x978/0x9e5 generic_probe+0x45/0x77 driver_probe_device+0x1d5/0x411 bus_for_each_drv+0xbe/0xe5 __device_attach+0xdd/0x15b bus_probe_device+0x5a/0x10b device_add+0x468/0x7fb usb_new_device+0x51d/0x6a1 hub_event+0xee4/0x1639 process_one_work+0x42f/0x7a2 worker_thread+0x31c/0x483 kthread+0x1e7/0x1f7 ret_from_fork+0x3a/0x50 Freed by task 1959: save_stack+0x46/0xce kasan_slab_free+0x8a/0xac slab_free_hook+0x52/0x5c kfree+0x1a5/0x228 drm_dev_unregister+0xa6/0x16c drm_dev_unplug+0x12/0x5b usb_unbind_interface+0xc8/0x2c1 device_release_driver_internal+0x1e4/0x302 bus_remove_device+0x1b9/0x1e4 device_del+0x275/0x42d usb_disable_device+0x112/0x2cb usb_disconnect+0xef/0x28e usb_disconnect+0xe0/0x28e hub_event+0x7cc/0x1639 process_one_work+0x42f/0x7a2 worker_thread+0x31c/0x483 kthread+0x1e7/0x1f7 ret_from_fork+0x3a/0x50 The buggy address belongs to the object at ffff888385e32588 which belongs to the cache kmalloc-2048 of size 2048 The buggy address is located 116 bytes inside of 2048-byte region [ffff888385e32588, ffff888385e32d88) The buggy address belongs to the page: page:ffffea000e178c00 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 flags: 0x8000000000008100(slab|head) raw: 8000000000008100 0000000000000000 0000000000000000 00000001000d000d raw: ffffea000ee71e20 ffffea000ee6d620 ffff88842d00d0c0 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888385e32480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888385e32500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888385e32580: fc fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888385e32600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888385e32680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== This happens 100% of the time and is resolved by the following patch upstream: commit 6ecac85eadb9 ("drm/udl: move to embedding drm device inside udl device.") This patch is the second in this series, and requires the first patch as a dependency. This series apples cleanly to v4.14.133. Dave Airlie (2): drm/udl: introduce a macro to convert dev to udl. drm/udl: move to embedding drm device inside udl device. drivers/gpu/drm/udl/udl_drv.c | 56 +++++++++++++++++++++++++++------- drivers/gpu/drm/udl/udl_drv.h | 9 +++--- drivers/gpu/drm/udl/udl_fb.c | 12 ++++---- drivers/gpu/drm/udl/udl_main.c | 35 ++++++--------------- 4 files changed, 65 insertions(+), 47 deletions(-) -- 2.22.0.510.g264f2c817a-goog

5 years, 5 months

3
5
0 0

[PATCH v4.4.y] KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock

by Zubin Mithra

From: Paolo Bonzini <pbonzini(a)redhat.com> commit 250715a6171a076748be8ab88b274e72f0cfb435 upstream. The syzkaller folks reported a NULL pointer dereference that seems to be cause by a race between KVM_CREATE_IRQCHIP and KVM_CREATE_PIT2. The former takes kvm->lock (except when registering the devices, which needs kvm->slots_lock); the latter takes kvm->slots_lock only. Change KVM_CREATE_PIT2 to follow the same model as KVM_CREATE_IRQCHIP. Testcase: #include <pthread.h> #include <linux/kvm.h> #include <fcntl.h> #include <sys/ioctl.h> #include <stdint.h> #include <string.h> #include <stdlib.h> #include <sys/syscall.h> #include <unistd.h> long r[23]; void* thr1(void* arg) { struct kvm_pit_config pitcfg = { .flags = 4 }; switch ((long)arg) { case 0: r[2] = open("/dev/kvm", O_RDONLY|O_ASYNC); break; case 1: r[3] = ioctl(r[2], KVM_CREATE_VM, 0); break; case 2: r[4] = ioctl(r[3], KVM_CREATE_IRQCHIP, 0); break; case 3: r[22] = ioctl(r[3], KVM_CREATE_PIT2, &pitcfg); break; } return 0; } int main(int argc, char **argv) { long i; pthread_t th[4]; memset(r, -1, sizeof(r)); for (i = 0; i < 4; i++) { pthread_create(&th[i], 0, thr, (void*)i); if (argc > 1 && rand()%2) usleep(rand()%1000); } usleep(20000); return 0; } Reported-by: Dmitry Vyukov <dvyukov(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Radim Krčmář <rkrcmar(a)redhat.com> Signed-off-by: Zubin Mithra <zsm(a)google.com> --- Notes: * Syzkaller triggered a GPF in kvm_pic_clear_all with the following stacktrace when fuzzing a 4.4 kernel. Call Trace: [<ffffffff81270a07>] lock_acquire+0x294/0x2f3 kernel/locking/lockdep.c:3592 [<ffffffff832bd6f7>] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline] [<ffffffff832bd6f7>] _raw_spin_lock+0x2f/0x3e kernel/locking/spinlock.c:151 [<ffffffff81084dce>] spin_lock include/linux/spinlock.h:302 [inline] [<ffffffff81084dce>] pic_lock arch/x86/kvm/i8259.c:45 [inline] [<ffffffff81084dce>] kvm_pic_clear_all+0x33/0x5b arch/x86/kvm/i8259.c:213 [<ffffffff810968fb>] kvm_free_irq_source_id+0xc8/0xde arch/x86/kvm/irq_comm.c:197 [<ffffffff810926bb>] kvm_create_pit+0x24e/0x5c5 arch/x86/kvm/i8254.c:713 [<ffffffff8103aabf>] kvm_arch_vm_ioctl+0x592/0x17db arch/x86/kvm/x86.c:3858 [<ffffffff81013cb4>] kvm_vm_ioctl+0xb7d/0xbfa arch/x86/kvm/../../../virt/kvm/kvm_main.c:2959 [<ffffffff8149dc2e>] vfs_ioctl fs/ioctl.c:43 [inline] [<ffffffff8149dc2e>] do_vfs_ioctl+0xcb0/0xd0f fs/ioctl.c:630 [<ffffffff8149dcfe>] SYSC_ioctl fs/ioctl.c:645 [inline] [<ffffffff8149dcfe>] SyS_ioctl+0x71/0xad fs/ioctl.c:636 [<ffffffff832be2fa>] entry_SYSCALL_64_fastpath+0x31/0xb3 * This patch resolves a conflict that arises in arch/x86/kvm/i8254.c:kvm_create_pit() * This commit is present in linux-4.9.y * Tests run: Chrome OS tryjobs, Syzkaller reproducer arch/x86/kvm/i8254.c | 5 +++-- arch/x86/kvm/x86.c | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c index ab53187275794..ef56d70d10264 100644 --- a/arch/x86/kvm/i8254.c +++ b/arch/x86/kvm/i8254.c @@ -678,7 +678,6 @@ static const struct kvm_io_device_ops speaker_dev_ops = { .write = speaker_ioport_write, }; -/* Caller must hold slots_lock */ struct kvm_pit *kvm_create_pit(struct kvm *kvm, u32 flags) { struct kvm_pit *pit; @@ -733,6 +732,7 @@ struct kvm_pit *kvm_create_pit(struct kvm *kvm, u32 flags) pit->mask_notifier.func = pit_mask_notifer; kvm_register_irq_mask_notifier(kvm, 0, &pit->mask_notifier); + mutex_lock(&kvm->slots_lock); kvm_iodevice_init(&pit->dev, &pit_dev_ops); ret = kvm_io_bus_register_dev(kvm, KVM_PIO_BUS, KVM_PIT_BASE_ADDRESS, KVM_PIT_MEM_LENGTH, &pit->dev); @@ -747,13 +747,14 @@ struct kvm_pit *kvm_create_pit(struct kvm *kvm, u32 flags) if (ret < 0) goto fail_unregister; } + mutex_unlock(&kvm->slots_lock); return pit; fail_unregister: kvm_io_bus_unregister_dev(kvm, KVM_PIO_BUS, &pit->dev); - fail: + mutex_unlock(&kvm->slots_lock); kvm_unregister_irq_mask_notifier(kvm, 0, &pit->mask_notifier); kvm_unregister_irq_ack_notifier(kvm, &pit_state->irq_ack_notifier); kvm_free_irq_source_id(kvm, pit->irq_source_id); diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 66adcd00b3ddd..ef95cb80cadc2 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -3867,7 +3867,7 @@ long kvm_arch_vm_ioctl(struct file *filp, sizeof(struct kvm_pit_config))) goto out; create_pit: - mutex_lock(&kvm->slots_lock); + mutex_lock(&kvm->lock); r = -EEXIST; if (kvm->arch.vpit) goto create_pit_unlock; @@ -3876,7 +3876,7 @@ long kvm_arch_vm_ioctl(struct file *filp, if (kvm->arch.vpit) r = 0; create_pit_unlock: - mutex_unlock(&kvm->slots_lock); + mutex_unlock(&kvm->lock); break; case KVM_GET_IRQCHIP: { /* 0: PIC master, 1: PIC slave, 2: IOAPIC */ -- 2.22.0.510.g264f2c817a-goog

5 years, 5 months

2
1
0 0

[merged] bug-fix-cut-here-for-warn_on-for-__warn_taint-architectures.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: include/asm-generic/bug.h: fix "cut here" for WARN_ON for __WARN_TAINT architectures has been removed from the -mm tree. Its filename was bug-fix-cut-here-for-warn_on-for-__warn_taint-architectures.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Drew Davenport <ddavenport(a)chromium.org> Subject: include/asm-generic/bug.h: fix "cut here" for WARN_ON for __WARN_TAINT architectures For architectures using __WARN_TAINT, the WARN_ON macro did not print out the "cut here" string. The other WARN_XXX macros would print "cut here" inside __warn_printk, which is not called for WARN_ON since it doesn't have a message to print. Link: http://lkml.kernel.org/r/20190624154831.163888-1-ddavenport@chromium.org Fixes: a7bed27af194 ("bug: fix "cut here" location for __WARN_TAINT architectures") Signed-off-by: Drew Davenport <ddavenport(a)chromium.org> Acked-by: Kees Cook <keescook(a)chromium.org> Tested-by: Kees Cook <keescook(a)chromium.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/asm-generic/bug.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/include/asm-generic/bug.h~bug-fix-cut-here-for-warn_on-for-__warn_taint-architectures +++ a/include/asm-generic/bug.h @@ -104,8 +104,10 @@ extern void warn_slowpath_null(const cha warn_slowpath_fmt_taint(__FILE__, __LINE__, taint, arg) #else extern __printf(1, 2) void __warn_printk(const char *fmt, ...); -#define __WARN() __WARN_TAINT(TAINT_WARN) -#define __WARN_printf(arg...) do { __warn_printk(arg); __WARN(); } while (0) +#define __WARN() do { \ + printk(KERN_WARNING CUT_HERE); __WARN_TAINT(TAINT_WARN); \ +} while (0) +#define __WARN_printf(arg...) __WARN_printf_taint(TAINT_WARN, arg) #define __WARN_printf_taint(taint, arg...) \ do { __warn_printk(arg); __WARN_TAINT(taint); } while (0) #endif _ Patches currently in -mm which might be from ddavenport(a)chromium.org are

5 years, 5 months

1
0
0 0

[merged] coda-pass-the-host-file-in-vma-vm_file-on-mmap.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: coda: pass the host file in vma->vm_file on mmap has been removed from the -mm tree. Its filename was coda-pass-the-host-file-in-vma-vm_file-on-mmap.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Jan Harkes <jaharkes(a)cs.cmu.edu> Subject: coda: pass the host file in vma->vm_file on mmap Patch series "Coda updates". The following patch series is a collection of various fixes for Coda, most of which were collected from linux-fsdevel or linux-kernel but which have as yet not found their way upstream. This patch (of 22): Various file systems expect that vma->vm_file points at their own file handle, several use file_inode(vma->vm_file) to get at their inode or use vma->vm_file->private_data. However the way Coda wrapped mmap on a host file broke this assumption, vm_file was still pointing at the Coda file and the host file systems would scribble over Coda's inode and private file data. This patch fixes the incorrect expectation and wraps vm_ops->open and vm_ops->close to allow Coda to track when the vm_area_struct is destroyed so we still release the reference on the Coda file handle at the right time. Link: http://lkml.kernel.org/r/0e850c6e59c0b147dc2dcd51a3af004c948c3697.155811738… Signed-off-by: Jan Harkes <jaharkes(a)cs.cmu.edu> Cc: Arnd Bergmann <arnd(a)arndb.de> Cc: Colin Ian King <colin.king(a)canonical.com> Cc: Dan Carpenter <dan.carpenter(a)oracle.com> Cc: David Howells <dhowells(a)redhat.com> Cc: Fabian Frederick <fabf(a)skynet.be> Cc: Mikko Rapeli <mikko.rapeli(a)iki.fi> Cc: Sam Protsenko <semen.protsenko(a)linaro.org> Cc: Yann Droneaud <ydroneaud(a)opteya.com> Cc: Zhouyang Jia <jiazhouyang09(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/coda/file.c | 70 +++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 68 insertions(+), 2 deletions(-) --- a/fs/coda/file.c~coda-pass-the-host-file-in-vma-vm_file-on-mmap +++ a/fs/coda/file.c @@ -27,6 +27,13 @@ #include "coda_linux.h" #include "coda_int.h" +struct coda_vm_ops { + atomic_t refcnt; + struct file *coda_file; + const struct vm_operations_struct *host_vm_ops; + struct vm_operations_struct vm_ops; +}; + static ssize_t coda_file_read_iter(struct kiocb *iocb, struct iov_iter *to) { @@ -61,6 +68,34 @@ coda_file_write_iter(struct kiocb *iocb, return ret; } +static void +coda_vm_open(struct vm_area_struct *vma) +{ + struct coda_vm_ops *cvm_ops = + container_of(vma->vm_ops, struct coda_vm_ops, vm_ops); + + atomic_inc(&cvm_ops->refcnt); + + if (cvm_ops->host_vm_ops && cvm_ops->host_vm_ops->open) + cvm_ops->host_vm_ops->open(vma); +} + +static void +coda_vm_close(struct vm_area_struct *vma) +{ + struct coda_vm_ops *cvm_ops = + container_of(vma->vm_ops, struct coda_vm_ops, vm_ops); + + if (cvm_ops->host_vm_ops && cvm_ops->host_vm_ops->close) + cvm_ops->host_vm_ops->close(vma); + + if (atomic_dec_and_test(&cvm_ops->refcnt)) { + vma->vm_ops = cvm_ops->host_vm_ops; + fput(cvm_ops->coda_file); + kfree(cvm_ops); + } +} + static int coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma) { @@ -68,6 +103,8 @@ coda_file_mmap(struct file *coda_file, s struct coda_inode_info *cii; struct file *host_file; struct inode *coda_inode, *host_inode; + struct coda_vm_ops *cvm_ops; + int ret; cfi = CODA_FTOC(coda_file); BUG_ON(!cfi || cfi->cfi_magic != CODA_MAGIC); @@ -76,6 +113,13 @@ coda_file_mmap(struct file *coda_file, s if (!host_file->f_op->mmap) return -ENODEV; + if (WARN_ON(coda_file != vma->vm_file)) + return -EIO; + + cvm_ops = kmalloc(sizeof(struct coda_vm_ops), GFP_KERNEL); + if (!cvm_ops) + return -ENOMEM; + coda_inode = file_inode(coda_file); host_inode = file_inode(host_file); @@ -89,6 +133,7 @@ coda_file_mmap(struct file *coda_file, s * the container file on us! */ else if (coda_inode->i_mapping != host_inode->i_mapping) { spin_unlock(&cii->c_lock); + kfree(cvm_ops); return -EBUSY; } @@ -97,7 +142,29 @@ coda_file_mmap(struct file *coda_file, s cfi->cfi_mapcount++; spin_unlock(&cii->c_lock); - return call_mmap(host_file, vma); + vma->vm_file = get_file(host_file); + ret = call_mmap(vma->vm_file, vma); + + if (ret) { + /* if call_mmap fails, our caller will put coda_file so we + * should drop the reference to the host_file that we got. + */ + fput(host_file); + kfree(cvm_ops); + } else { + /* here we add redirects for the open/close vm_operations */ + cvm_ops->host_vm_ops = vma->vm_ops; + if (vma->vm_ops) + cvm_ops->vm_ops = *vma->vm_ops; + + cvm_ops->vm_ops.open = coda_vm_open; + cvm_ops->vm_ops.close = coda_vm_close; + cvm_ops->coda_file = coda_file; + atomic_set(&cvm_ops->refcnt, 1); + + vma->vm_ops = &cvm_ops->vm_ops; + } + return ret; } int coda_open(struct inode *coda_inode, struct file *coda_file) @@ -207,4 +274,3 @@ const struct file_operations coda_file_o .fsync = coda_fsync, .splice_read = generic_file_splice_read, }; - _ Patches currently in -mm which might be from jaharkes(a)cs.cmu.edu are

5 years, 5 months

1
0
0 0

[merged] fs-fix-the-default-values-of-i_uid-i_gid-on-proc-sys-inodes.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes. has been removed from the -mm tree. Its filename was fs-fix-the-default-values-of-i_uid-i_gid-on-proc-sys-inodes.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Radoslaw Burny <rburny(a)google.com> Subject: fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes. Normally, the inode's i_uid/i_gid are translated relative to s_user_ns, but this is not a correct behavior for proc. Since sysctl permission check in test_perm is done against GLOBAL_ROOT_[UG]ID, it makes more sense to use these values in u_[ug]id of proc inodes. In other words: although uid/gid in the inode is not read during test_perm, the inode logically belongs to the root of the namespace. I have confirmed this with Eric Biederman at LPC and in this thread: https://lore.kernel.org/lkml/87k1kzjdff.fsf@xmission.com Consequences ============ Since the i_[ug]id values of proc nodes are not used for permissions checks, this change usually makes no functional difference. However, it causes an issue in a setup where: * a namespace container is created without root user in container - hence the i_[ug]id of proc nodes are set to INVALID_[UG]ID * container creator tries to configure it by writing /proc/sys files, e.g. writing /proc/sys/kernel/shmmax to configure shared memory limit Kernel does not allow to open an inode for writing if its i_[ug]id are invalid, making it impossible to write shmmax and thus - configure the container. Using a container with no root mapping is apparently rare, but we do use this configuration at Google. Also, we use a generic tool to configure the container limits, and the inability to write any of them causes a failure. History ======= The invalid uids/gids in inodes first appeared due to 81754357770e (fs: Update i_[ug]id_(read|write) to translate relative to s_user_ns). However, AFAIK, this did not immediately cause any issues. The inability to write to these "invalid" inodes was only caused by a later commit 0bd23d09b874 (vfs: Don't modify inodes with a uid or gid unknown to the vfs). Tested: Used a repro program that creates a user namespace without any mapping and stat'ed /proc/$PID/root/proc/sys/kernel/shmmax from outside. Before the change, it shows the overflow uid, with the change it's 0. The overflow uid indicates that the uid in the inode is not correct and thus it is not possible to open the file for writing. Link: http://lkml.kernel.org/r/20190708115130.250149-1-rburny@google.com Fixes: 0bd23d09b874 ("vfs: Don't modify inodes with a uid or gid unknown to the vfs") Signed-off-by: Radoslaw Burny <rburny(a)google.com> Acked-by: Luis Chamberlain <mcgrof(a)kernel.org> Cc: Kees Cook <keescook(a)chromium.org> Cc: "Eric W . Biederman" <ebiederm(a)xmission.com> Cc: Seth Forshee <seth.forshee(a)canonical.com> Cc: John Sperbeck <jsperbeck(a)google.com> Cc: Alexey Dobriyan <adobriyan(a)gmail.com> Cc: <stable(a)vger.kernel.org> [4.8+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/proc/proc_sysctl.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/fs/proc/proc_sysctl.c~fs-fix-the-default-values-of-i_uid-i_gid-on-proc-sys-inodes +++ a/fs/proc/proc_sysctl.c @@ -499,6 +499,10 @@ static struct inode *proc_sys_make_inode if (root->set_ownership) root->set_ownership(head, table, &inode->i_uid, &inode->i_gid); + else { + inode->i_uid = GLOBAL_ROOT_UID; + inode->i_gid = GLOBAL_ROOT_GID; + } return inode; } _ Patches currently in -mm which might be from rburny(a)google.com are

5 years, 5 months

1
0
0 0

Re: [PATCH] clk: mvebu: armada-37xx-periph: Fix initialization for cpu clocks

by Ilias Apalodimas

Hello Christian, > Hi, > > I assume you use the 1000 MHz firmware. This does also not work on my Rev 7 > board. But I'm pretty sure this is not a problem of the patches, because if > I take a newer kernel (4.19.20/27) without the patches it also does not > work. A kernel 4.19.17 does work for me. My opinion on that is that this is > another problem which does just occure now because now the cpu frequency > scaling is working with the right frequencies. I am not sure which firmware i am running, i did all my tests on 5.0.0 and changing between governors worked fine without the patches Regards /Ilias > > Ilias Apalodimas <ilias.apalodimas(a)linaro.org> schrieb am Do., 14. März > 2019, 13:15: > > > Hi Gregory, > > > The clock parenting was not setup properly when DVFS was enabled. It was > > > expected that the same clock source was used with and without DVFS which > > > was not the case. > > > > > > This patch fixes this issue, allowing to make the cpufreq support work > > > when the CPU clocks source are not the default ones. > > > > > > Fixes: 92ce45fb875d ("cpufreq: Add DVFS support for Armada 37xx") > > > Cc: <stable(a)vger.kernel.org> > > > Reported-by: Christian Neubert <christian.neubert.86(a)gmail.com> > > > Reported-by: Ilias Apalodimas <ilias.apalodimas(a)linaro.org> > > > Signed-off-by: Gregory CLEMENT <gregory.clement(a)bootlin.com> > > > --- > > > drivers/clk/mvebu/armada-37xx-periph.c | 11 +++++++++++ > > > 1 file changed, 11 insertions(+) > > > > > > diff --git a/drivers/clk/mvebu/armada-37xx-periph.c > > b/drivers/clk/mvebu/armada-37xx-periph.c > > > index 1f1cff428d78..26ed3c18a239 100644 > > > --- a/drivers/clk/mvebu/armada-37xx-periph.c > > > +++ b/drivers/clk/mvebu/armada-37xx-periph.c > > > @@ -671,6 +671,17 @@ static int armada_3700_add_composite_clk(const > > struct clk_periph_data *data, > > > map = syscon_regmap_lookup_by_compatible( > > > "marvell,armada-3700-nb-pm"); > > > pmcpu_clk->nb_pm_base = map; > > > + > > > + /* > > > + * Use the same parent when DVFS is enabled that the > > > + * default parent received at boot time. When this > > > + * function is called, DVFS is not enabled yet, so we > > > + * get the default parent and we can set the parent > > > + * for DVFS. > > > + */ > > > + if (clk_pm_cpu_set_parent(muxrate_hw, > > > + > > clk_pm_cpu_get_parent(muxrate_hw))) > > > + dev_warn(dev, "Failed to setup default parent > > clock for DVFS\n"); > > > } > > > > > > *hw = clk_hw_register_composite(dev, data->name, > > data->parent_names, > > > -- > > > 2.20.1 > > > > > Applied this and selected only > > > > CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y > > CONFIG_CPU_FREQ_GOV_PERFORMANCE=y > > CONFIG_CPU_FREQ_GOV_POWERSAVE=y > > > > After changing the governor from 'powersave' to 'performance' the board > > completely froze (i even lost access to the serial port) > > > > Cheers > > /Ilias > >

5 years, 5 months

3
11
0 0

[PATCH] drm/i915/gvt: fix incorrect cache entry for guest page mapping

by Xiaolin Zhang

GPU hang observed during the guest OCL conformance test which is caused by THP GTT feature used durning the test. It was observed the same GFN with different size (4K and 2M) requested from the guest in GVT. So during the guest page dma map stage, it is required to unmap first with orginal size and then remap again with requested size. Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support") Signed-off-by: Xiaolin Zhang <xiaolin.zhang(a)intel.com> --- drivers/gpu/drm/i915/gvt/kvmgt.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c index a68addf..4a7cf86 100644 --- a/drivers/gpu/drm/i915/gvt/kvmgt.c +++ b/drivers/gpu/drm/i915/gvt/kvmgt.c @@ -1911,6 +1911,18 @@ static int kvmgt_dma_map_guest_page(unsigned long handle, unsigned long gfn, ret = __gvt_cache_add(info->vgpu, gfn, *dma_addr, size); if (ret) goto err_unmap; + } else if (entry->size != size) { + /* the same gfn with different size: unmap and re-map */ + gvt_dma_unmap_page(vgpu, gfn, entry->dma_addr, entry->size); + __gvt_cache_remove_entry(vgpu, entry); + + ret = gvt_dma_map_page(vgpu, gfn, dma_addr, size); + if (ret) + goto err_unlock; + + ret = __gvt_cache_add(info->vgpu, gfn, *dma_addr, size); + if (ret) + goto err_unmap; } else { kref_get(&entry->ref); *dma_addr = entry->dma_addr; -- 1.8.3.1

5 years, 5 months

3
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror July 2019