September 2019 - Linux-stable-mirror

by Ben Hutchings

I'm announcing the release of the 3.16.74 kernel. All users of the 3.16 kernel series should upgrade. The updated 3.16.y git tree can be found at: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-3.16.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git The diff from 3.16.73 is attached to this message. Ben. ------------ Documentation/x86/mds.rst | 44 ++------- Makefile | 2 +- arch/arm/boot/dts/exynos5260.dtsi | 2 +- arch/arm/crypto/aesbs-glue.c | 4 + arch/arm/mach-omap2/omap_hwmod.c | 2 +- arch/arm/plat-pxa/ssp.c | 6 -- arch/arm64/include/asm/memory.h | 8 ++ arch/powerpc/include/asm/reg_booke.h | 2 +- arch/powerpc/platforms/83xx/usb.c | 4 +- arch/x86/crypto/crct10dif-pclmul_glue.c | 13 +-- arch/x86/include/asm/uaccess.h | 7 +- arch/x86/kernel/traps.c | 8 -- crypto/crct10dif_generic.c | 11 +-- crypto/salsa20_generic.c | 2 +- drivers/bluetooth/hci_ldisc.c | 10 +- drivers/bluetooth/hci_uart.h | 1 + drivers/clk/tegra/clk-pll.c | 4 +- drivers/gpu/drm/drm_fb_helper.c | 11 +-- drivers/gpu/drm/radeon/radeon_display.c | 4 +- drivers/hwmon/f71805f.c | 15 ++- drivers/hwmon/pc87427.c | 14 ++- drivers/hwmon/smsc47b397.c | 13 ++- drivers/hwmon/smsc47m1.c | 28 ++++-- drivers/hwmon/vt1211.c | 15 ++- drivers/hwmon/w83627hf.c | 42 +++++++- drivers/infiniband/hw/cxgb4/cm.c | 2 + drivers/iommu/intel-iommu.c | 7 +- drivers/md/bcache/journal.c | 11 ++- drivers/md/bcache/super.c | 13 ++- drivers/media/i2c/soc_camera/ov6650.c | 2 + drivers/media/pci/cx18/cx18-fileops.c | 2 +- drivers/media/pci/ivtv/ivtv-fileops.c | 2 +- drivers/media/platform/davinci/isif.c | 9 -- drivers/media/platform/davinci/vpbe.c | 2 +- drivers/media/platform/omap/omap_vout.c | 15 ++- drivers/media/radio/radio-raremono.c | 30 ++++-- drivers/media/radio/wl128x/fmdrv_common.c | 13 ++- drivers/media/usb/cpia2/cpia2_usb.c | 3 +- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 2 + drivers/media/usb/pvrusb2/pvrusb2-hdw.h | 1 + drivers/media/usb/siano/smsusb.c | 33 ++++--- drivers/media/usb/tlg2300/Kconfig | 1 + drivers/net/bonding/bond_options.c | 7 -- drivers/net/ethernet/arc/emac_main.c | 9 +- drivers/net/ethernet/chelsio/cxgb3/l2t.h | 2 +- drivers/net/ethernet/freescale/ucc_geth_ethtool.c | 8 +- drivers/net/ethernet/ibm/ehea/ehea_main.c | 2 +- drivers/net/wireless/at76c50x-usb.c | 4 +- drivers/net/wireless/ath/ath6kl/wmi.c | 10 +- drivers/net/wireless/mwifiex/ie.c | 3 + drivers/net/wireless/mwifiex/uap_cmd.c | 17 +++- drivers/net/wireless/mwl8k.c | 13 ++- drivers/net/wireless/p54/p54pci.c | 3 +- drivers/net/wireless/p54/p54usb.c | 43 ++++---- drivers/net/wireless/rsi/rsi_91x_mac80211.c | 1 + drivers/pci/pcie/aspm.c | 49 +++++++--- drivers/pci/quirks.c | 76 +++++++++++++++ drivers/platform/x86/alienware-wmi.c | 19 ++-- drivers/platform/x86/sony-laptop.c | 8 +- drivers/pwm/core.c | 10 +- drivers/pwm/pwm-tiehrpwm.c | 2 + drivers/pwm/sysfs.c | 14 +-- drivers/rtc/interface.c | 7 +- drivers/scsi/libsas/sas_expander.c | 2 + drivers/scsi/qla2xxx/qla_attr.c | 4 +- drivers/scsi/qla2xxx/qla_os.c | 34 ++++--- drivers/scsi/qla4xxx/ql4_os.c | 2 +- drivers/spi/spi-rspi.c | 48 +++++---- drivers/staging/comedi/drivers/dt282x.c | 3 +- drivers/staging/line6/pcm.c | 5 + drivers/tty/serial/serial_core.c | 15 ++- drivers/tty/vt/keyboard.c | 33 +++++-- drivers/usb/class/cdc-acm.c | 113 +++++++++++++++++----- drivers/usb/class/cdc-acm.h | 4 + drivers/usb/misc/rio500.c | 24 +++-- drivers/usb/misc/sisusbvga/sisusb.c | 15 +-- drivers/usb/serial/generic.c | 57 ++++++++--- drivers/usb/serial/usb-serial.c | 11 ++- drivers/vhost/vhost.c | 4 +- drivers/video/backlight/lm3630a_bl.c | 4 +- drivers/virt/fsl_hypervisor.c | 26 ++--- fs/ceph/super.c | 7 ++ fs/cifs/smb2ops.c | 14 +-- fs/ext4/file.c | 7 ++ fs/ext4/ioctl.c | 2 +- fs/fuse/file.c | 9 +- fs/gfs2/rgrp.c | 12 ++- fs/jbd2/journal.c | 4 + fs/nfs/nfs4state.c | 4 + fs/ocfs2/export.c | 30 +++++- fs/xfs/xfs_super.c | 10 ++ include/linux/atalk.h | 20 +++- include/linux/ieee80211.h | 3 + include/linux/mfd/da9063/registers.h | 6 +- include/linux/of.h | 4 +- include/linux/pci.h | 2 + include/linux/pwm.h | 5 - include/linux/smpboot.h | 2 +- include/media/davinci/vpbe.h | 2 +- include/net/bluetooth/hci_core.h | 3 + include/net/mac80211.h | 13 +++ kernel/debug/kdb/kdb_main.c | 2 +- kernel/time/ntp.c | 2 +- kernel/trace/trace_events.c | 3 - lib/kobject_uevent.c | 9 +- net/appletalk/atalk_proc.c | 2 +- net/appletalk/ddp.c | 37 +++++-- net/appletalk/sysctl_net_atalk.c | 5 +- net/bluetooth/hci_conn.c | 10 +- net/bluetooth/l2cap_core.c | 34 +++++-- net/bridge/netfilter/ebtables.c | 4 +- net/ipv4/raw.c | 6 +- net/mac80211/ieee80211_i.h | 3 + net/mac80211/mlme.c | 16 ++- net/mac80211/rx.c | 2 + net/mac80211/tdls.c | 40 ++++++++ sound/pci/hda/hda_generic.c | 3 +- sound/pci/hda/hda_generic.h | 1 + sound/pci/hda/patch_hdmi.c | 6 ++ sound/pci/hda/patch_realtek.c | 5 +- sound/soc/codecs/max98090.c | 12 +-- sound/soc/fsl/fsl_esai.c | 1 + sound/usb/mixer.c | 36 +++++-- tools/testing/selftests/ipc/msgque.c | 11 ++- virt/kvm/coalesced_mmio.c | 17 ++-- 125 files changed, 1069 insertions(+), 488 deletions(-) Alan Stern (3): media: usb: siano: Fix general protection fault in smsusb media: usb: siano: Fix false-positive "uninitialized variable" warning p54usb: Fix race between disconnect and firmware loading Alexander Kochetkov (1): net: arc_emac: fix koops caused by sk_buff free Andrew Vasquez (1): scsi: qla2xxx: Fix incorrect region-size setting in optrom SYSFS routines Andy Lutomirski (2): x86/speculation/mds: Revert CPU buffer clear on double fault exit x86/speculation/mds: Improve CPU buffer clear documentation Arik Nemtsov (1): mac80211: add API to request TDLS operation from userspace Arnd Bergmann (3): scsi: qla4xxx: avoid freeing unallocated dma memory media: davinci-isif: avoid uninitialized variable use appletalk: Fix compile regression Bart Van Assche (1): scsi: qla2xxx: Unregister chrdev if module initialization fails Ben Hutchings (2): media: poseidon: Depend on PM_RUNTIME Linux 3.16.74 Bob Peterson (2): GFS2: Fix rgrp end rounding problem for bsize < page size GFS2: don't set rgrp gl_object until it's inserted into rgrp tree Brian Masney (1): backlight: lm3630a: Return 0 on success in update_status functions Christian König (1): drm/radeon: prefer lower reference dividers Christoph Probst (1): cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level() Christoph Vogtländer (1): pwm: tiehrpwm: Update shadow register for disabling PWMs Christophe Leroy (1): net: ucc_geth - fix Oops when changing number of buffers in the ring Colin Ian King (2): RDMA/cxgb4: Fix null pointer dereference on alloc_skb failure platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer Coly Li (1): bcache: never set KEY_PTRS of journal key to 0 in journal_reclaim() Dan Carpenter (11): media: ivtv: update *pos correctly in ivtv_read_pos() media: cx18: update *pos correctly in cx18_read_pos() media: wl128x: Fix an error code in fm_download_firmware() media: wl128x: prevent two potential buffer overflows media: pvrusb2: Prevent a buffer overflow media: omap_vout: potential buffer overflow in vidioc_dqbuf() media: davinci/vpbe: array underflow in vpbe_enum_outputs() platform/x86: alienware-wmi: printing the wrong error code kdb: do a sanity check on the cpu in kdb_per_cpu() drivers/virt/fsl_hypervisor.c: dereferencing error pointers in ioctl ath6kl: add some bounds checking Dave Chinner (1): xfs: clear sb->s_fs_info on mount failure David Ahern (1): ipv4: Fix raw socket lookup for local traffic Dmitry Osipenko (1): clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider Elazar Leibovich (1): tracing: Fix partial reading of trace event's id file Eric Biggers (4): crypto: crct10dif-generic - fix use via crypto_shash_digest() crypto: x86/crct10dif-pcl - fix use via crypto_shash_digest() crypto: salsa20 - don't access already-freed walk.iv crypto: arm/aes-neonbs - don't access already-freed walk.iv Florian Westphal (1): netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule Geert Uytterhoeven (2): spi: rspi: Fix register initialization while runtime-suspended spi: rspi: Fix sequencer reset during initialization Guenter Roeck (6): hwmon: (f71805f) Use request_muxed_region for Super-IO accesses hwmon: (pc87427) Use request_muxed_region for Super-IO accesses hwmon: (smsc47b397) Use request_muxed_region for Super-IO accesses hwmon: (smsc47m1) Use request_muxed_region for Super-IO accesses hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses hwmon: (vt1211) Use request_muxed_region for Super-IO accesses Gustavo A. R. Silva (2): cxgb3/l2t: Fix undefined behaviour platform/x86: sony-laptop: Fix unintentional fall-through Hui Peng (2): ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term Hui Wang (1): ALSA: hda/hdmi - Read the pin sense from register when repolling Ian Abbott (1): staging: comedi: dt282x: fix a null pointer deref on interrupt James Prestwood (1): PCI: Mark Atheros AR9462 to avoid bus reset Janusz Krzysztofik (1): media: ov6650: Fix sensor possibly not detected on probe Jarod Wilson (1): bonding: fix arp_validate toggling in active-backup mode Jason Yan (1): scsi: libsas: delete sas port if expander discover failed Jeff Layton (1): ceph: flush dirty inodes before proceeding with remount Jiri Slaby (1): TTY: serial_core, add ->install Jiufei Xue (1): jbd2: check superblock mapped prior to committing Johan Hovold (3): USB: serial: fix initial-termios handling USB: cdc-acm: fix unthrottle races USB: serial: fix unthrottle races Johannes Berg (1): mac80211: drop robust management frames from unknown TA Jon Hunter (1): ASoC: max98090: Fix restore of DAPM Muxes Julia Lawall (1): powerpc/83xx: Add missing of_node_put() after of_device_is_available() Kailang Yang (1): ALSA: hda/realtek - EAPD turn on later Karthik D A (1): mwifiex: vendor_ie length check for parse WMM IEs Kees Cook (1): selftests/ipc: Fix msgque compiler warnings Kefeng Wang (1): Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto() Kirill Tkhai (1): ext4: actually request zeroing of inode table after grow Ladislav Michl (2): cdc-acm: store in and out pipes in acm structure cdc-acm: handle read pipe errors Laurentiu Tudor (1): powerpc/booke64: set RI in default MSR Liang Chen (1): bcache: fix a race between cache register and cacheset unregister Liu Bo (1): fuse: honor RLIMIT_FSIZE in fuse_file_fallocate Loic Poulain (1): Bluetooth: hci_ldisc: Fix null pointer derefence in case of early data Lu Baolu (1): iommu/vt-d: Set intel_iommu_gfx_mapped correctly Lukas Czerner (1): ext4: fix data corruption caused by overlapping unaligned and aligned IO Luke Nowakowski-Krijger (1): media: radio-raremono: change devm_k*alloc to k*alloc Lyude Paul (1): PCI: Reset Lenovo ThinkPad P50 nvgpu at boot if necessary Marcel Holtmann (2): Bluetooth: Align minimum encryption key size for LE and BR/EDR connections Bluetooth: Fix regression with minimum encryption key size alignment Matias Karhumaa (1): Bluetooth: Fix faulty expression for minimum encryption key size check Matt Delco (1): KVM: coalesced_mmio: add bounds checking Mauro Carvalho Chehab (1): media: smsusb: better handle optional alignment Miklos Szeredi (2): fuse: fix writepages on 32bit fuse: fallocate: fix return with locked inode Miroslav Lichvar (1): ntp: Allow TAI-UTC offset to be set to zero Noralf Trønnes (1): drm/fb-helper: dpms_legacy(): Only set on connectors in use Oliver Neukum (5): cdc-acm: fix race between callback and unthrottle USB: serial: use variable for status USB: rio500: refuse more than one device at a time media: cpia2_usb: first wake up, then free in disconnect USB: sisusbvga: fix oops in error path of sisusb_probe Pan Bian (1): p54: drop device reference count if fails to enable device Peter Zijlstra (1): x86/uaccess: Dont leak the AC flag into __put_user() argument evaluation Petr Štetiar (1): mwl8k: Fix rate_idx underflow Phong Hoang (1): pwm: Fix deadlock warning when removing PWM device Phong Tran (1): of: fix clang -Wunsequenced for be32_to_cpu() Romain Izard (1): usb: cdc-acm: fix race during wakeup blocking TX traffic S.j. Wang (1): ASoC: fsl_esai: Fix missing break in switch statement Sanjay Konduri (1): rsi: add fix for crash during assertions Sebastian Andrzej Siewior (1): smpboot: Place the __percpu annotation correctly Sergei Trofimovich (1): tty/vt: fix write/write race in ioctl(KDSKBSENT) handler Shuning Zhang (1): ocfs2: fix ocfs2 read inode data panic in ocfs2_iget Slava Pestov (1): bcache: fix memory corruption in init error path Stefan Mätje (2): PCI: Factor out pcie_retrain_link() function PCI: Work around Pericom PCIe-to-PCI bridge Retrain Link erratum Stephen Suryaputra (1): ipv4: Use return value of inet_iif() for __raw_v4_lookup in the while loop Steve Twiss (1): mfd: da9063: Fix OTP control register names to match datasheets for DA9063/63L Stuart Menefy (1): ARM: dts: exynos: Fix interrupt for shared EINTs on Exynos5260 Takashi Iwai (3): ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk() ALSA: hda/realtek - Fix overridden device-specific initialization ALSA: line6: Fix write on zero-sized buffer Tetsuo Handa (1): kobject: Don't trigger kobject_uevent(KOBJ_REMOVE) twice. Tony Lindgren (1): ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset() Vincenzo Frascino (1): arm64: compat: Reduce address limit Wen Huang (1): mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings Wenwen Wang (1): ALSA: usb-audio: Fix a memory leak bug Wolfram Sang (1): rtc: don't reference bogus function pointer in kdoc Yu Wang (1): mac80211: handle deauthentication/disassociation from TDLS peer YueHaibing (4): ehea: Fix a copy-paste err in ehea_init_port_res ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data" at76c50x-usb: Don't register led_trigger if usb_register_driver failed appletalk: Fix use-after-free in atalk_proc_exit ZhangXiaoxu (1): NFS4: Fix v4.0 client state corruption when mount yongduan (1): vhost: make sure log_num < in_num -- Ben Hutchings We get into the habit of living before acquiring the habit of thinking. - Albert Camus

5 years

1
0
0 0

[PATCH stable 4.4 net] net: rds: Fix NULL ptr use in rds_tcp_kill_sock

by Mao Wenan

After the commit c4e97b06cfdc ("net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock()."), it introduced null-ptr-deref in rds_tcp_kill_sock as below: BUG: KASAN: null-ptr-deref on address 0000000000000020 Read of size 8 by task kworker/u16:10/910 CPU: 3 PID: 910 Comm: kworker/u16:10 Not tainted 4.4.178+ #3 Hardware name: linux,dummy-virt (DT) Workqueue: netns cleanup_net Call trace: [<ffffff90080abb50>] dump_backtrace+0x0/0x618 [<ffffff90080ac1a0>] show_stack+0x38/0x60 [<ffffff9008c42b78>] dump_stack+0x1a8/0x230 [<ffffff90085d469c>] kasan_report_error+0xc8c/0xfc0 [<ffffff90085d54a4>] kasan_report+0x94/0xd8 [<ffffff90085d1b28>] __asan_load8+0x88/0x150 [<ffffff9009c9cc2c>] rds_tcp_dev_event+0x734/0xb48 [<ffffff90081eacb0>] raw_notifier_call_chain+0x150/0x1e8 [<ffffff900973fec0>] call_netdevice_notifiers_info+0x90/0x110 [<ffffff9009764874>] netdev_run_todo+0x2f4/0xb08 [<ffffff9009796d34>] rtnl_unlock+0x2c/0x48 [<ffffff9009756484>] default_device_exit_batch+0x444/0x528 [<ffffff9009720498>] ops_exit_list+0x1c0/0x240 [<ffffff9009724a80>] cleanup_net+0x738/0xbf8 [<ffffff90081ca6cc>] process_one_work+0x96c/0x13e0 [<ffffff90081cf370>] worker_thread+0x7e0/0x1910 [<ffffff90081e7174>] kthread+0x304/0x390 [<ffffff9008094280>] ret_from_fork+0x10/0x50 If the first loop add the tc->t_sock = NULL to the tmp_list, 1). list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) then the second loop is to find connections to destroy, tc->t_sock might equal NULL, and tc->t_sock->sk happens null-ptr-deref. 2). list_for_each_entry_safe(tc, _tc, &tmp_list, t_tcp_node) Fixes: c4e97b06cfdc ("net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock().") Signed-off-by: Mao Wenan <maowenan(a)huawei.com> --- net/rds/tcp.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/net/rds/tcp.c b/net/rds/tcp.c index 554d4b461983..c10622a9321c 100644 --- a/net/rds/tcp.c +++ b/net/rds/tcp.c @@ -352,9 +352,11 @@ static void rds_tcp_kill_sock(struct net *net) } spin_unlock_irq(&rds_tcp_conn_lock); list_for_each_entry_safe(tc, _tc, &tmp_list, t_tcp_node) { - sk = tc->t_sock->sk; - sk->sk_prot->disconnect(sk, 0); - tcp_done(sk); + if (tc->t_sock) { + sk = tc->t_sock->sk; + sk->sk_prot->disconnect(sk, 0); + tcp_done(sk); + } if (tc->conn->c_passive) rds_conn_destroy(tc->conn->c_passive); rds_conn_destroy(tc->conn); -- 2.20.1

5 years

3
3
0 0

[PATCH] drm/i915: Mark contents as dirty on a write fault

by Chris Wilson

Since dropping the set-to-gtt-domain in commit a679f58d0510 ("drm/i915: Flush pages on acquisition"), we no longer mark the contents as dirty on a write fault. This has the issue of us then not marking the pages as dirty on releasing the buffer, which means the contents are not written out to the swap device (should we ever pick that buffer as a victim). Notably, this is visible in the dumb buffer interface used for cursors. Having updated the cursor contents via mmap, and swapped away, if the shrinker should evict the old cursor, upon next reuse, the cursor would be invisible. E.g. echo 80 > /proc/sys/kernel/sysrq ; echo f > /proc/sysrq-trigger Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111541 Fixes: a679f58d0510 ("drm/i915: Flush pages on acquisition") Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk> Cc: Matthew Auld <matthew.william.auld(a)gmail.com> Cc: Ville Syrjälä <ville.syrjala(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> # v5.2+ --- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/i915_gem_mman.c index 1748e63156a2..860b751c51f1 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c @@ -319,7 +319,11 @@ vm_fault_t i915_gem_fault(struct vm_fault *vmf) intel_wakeref_auto(&i915->ggtt.userfault_wakeref, msecs_to_jiffies_timeout(CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND)); - i915_vma_set_ggtt_write(vma); + if (write) { + GEM_BUG_ON(!i915_gem_object_has_pinned_pages(obj)); + i915_vma_set_ggtt_write(vma); + obj->mm.dirty = true; + } err_fence: i915_vma_unpin_fence(vma); -- 2.23.0

5 years

2
3
0 0

Re: [PATCH 26/31] perf stat: Reset previous counts on repeat with interval

by Srikar Dronamraju

Hi Sasha, > > This commit has been processed because it contains a "Fixes:" tag, > fixing commit: 13370a9b5bb8 perf stat: Add interval printing. > > The bot has tested the following trees: v5.2.16, v4.19.74, v4.14.145, v4.9.193, v4.4.193. > > v5.2.16: Failed to apply! Possible dependencies: > 1c839a5a4061 ("perf cs-etm: Configure timestamp generation in CPU-wide mode") > 32dcd021d004 ("perf evsel: Rename struct perf_evsel to struct evsel") > 3399ad9ac234 ("perf cs-etm: Configure contextID tracing in CPU-wide mode") > acae8b36cded ("perf header: Add die information in CPU topology") > b74d8686a18b ("perf cpumap: Retrieve die id information") > db5742b6849e ("perf stat: Support per-die aggregation") > f854839ba2a5 ("perf cpu_map: Rename struct cpu_map to struct perf_cpu_map") > > v4.19.74: Failed to apply! Possible dependencies: > 121dd9ea0116 ("perf bench: Add epoll parallel epoll_wait benchmark") > 1c839a5a4061 ("perf cs-etm: Configure timestamp generation in CPU-wide mode") > 231457ec7074 ("perf bench: Add epoll_ctl(2) benchmark") > 32dcd021d004 ("perf evsel: Rename struct perf_evsel to struct evsel") > 3399ad9ac234 ("perf cs-etm: Configure contextID tracing in CPU-wide mode") > 6ca9a082b190 ("perf stat: Pass a 'struct perf_stat_config' argument to global print functions") > 6f6b6594b5f3 ("perf stat: Move *_aggr_* data to 'struct perf_stat_config'") > 77e0faf8552c ("perf stat: Pass 'evlist' to aggr_update_shadow()") > 8897a8916efb ("perf stat: Move ru_* data to 'struct perf_stat_config'") > ae2d7da554f0 ("perf stat: Pass 'struct perf_stat_config' to first_shadow_cpu()") > d97ae04b3d52 ("perf stat: Move 'run_count' to 'struct perf_stat_config'") > df4f7b4d4b1e ("perf stat: Move 'unit_width' to 'struct perf_stat_config'") > f3ca50e61ff4 ("perf stat: Pass 'struct perf_stat_config' argument to local print functions") > f854839ba2a5 ("perf cpu_map: Rename struct cpu_map to struct perf_cpu_map") > fa4e819bbca9 ("perf arm cs-etm: Use event attributes to send sink information to kernel") > fa7070a38676 ("perf stat: Move csv_* to 'struct perf_stat_config'") > As suggested by Arnaldo, I am adding my patch which applies and builds well on v5.2.16 and v4.14.145. This one differs from the one committed by Arnaldo with respect to structure name change. Meanwhile I will investigate on v4.14.145 v4.9.193 v4.4.193 and get back to to you. -- Thanks and Regards Srikar Dronamraju ---->8------------8<----------------- >From b63fd11cced17fcb8e133def29001b0f6aaa5e06 Mon Sep 17 00:00:00 2001 From: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com> Date: Wed, 4 Sep 2019 15:17:37 +0530 Subject: [PATCH 1/2] perf stat: Reset previous counts on repeat with interval When using 'perf stat' with repeat and interval option, it shows wrong values for events. The wrong values will be shown for the first interval on the second and subsequent repetitions. Without the fix: # perf stat -r 3 -I 2000 -e faults -e sched:sched_switch -a sleep 5 2.000282489 53 faults 2.000282489 513 sched:sched_switch 4.005478208 3,721 faults 4.005478208 2,666 sched:sched_switch 5.025470933 395 faults 5.025470933 1,307 sched:sched_switch 2.009602825 1,84,46,74,40,73,70,95,47,520 faults <------ 2.009602825 1,84,46,74,40,73,70,95,49,568 sched:sched_switch <------ 4.019612206 4,730 faults 4.019612206 2,746 sched:sched_switch 5.039615484 3,953 faults 5.039615484 1,496 sched:sched_switch 2.000274620 1,84,46,74,40,73,70,95,47,520 faults <------ 2.000274620 1,84,46,74,40,73,70,95,47,520 sched:sched_switch <------ 4.000480342 4,282 faults 4.000480342 2,303 sched:sched_switch 5.000916811 1,322 faults 5.000916811 1,064 sched:sched_switch # prev_raw_counts is allocated when using intervals. This is used when calculating the difference in the counts of events when using interval. The current counts are stored in prev_raw_counts to calculate the differences in the next iteration. On the first interval of the second and subsequent repetitions, prev_raw_counts would be the values stored in the last interval of the previous repetitions, while the current counts will only be for the first interval of the current repetition. Hence there is a possibility of events showing up as big number. Fix this by resetting prev_raw_counts whenever perf stat repeats the command. With the fix: # perf stat -r 3 -I 2000 -e faults -e sched:sched_switch -a sleep 5 2.019349347 2,597 faults 2.019349347 2,753 sched:sched_switch 4.019577372 3,098 faults 4.019577372 2,532 sched:sched_switch 5.019415481 1,879 faults 5.019415481 1,356 sched:sched_switch 2.000178813 8,468 faults 2.000178813 2,254 sched:sched_switch 4.000404621 7,440 faults 4.000404621 1,266 sched:sched_switch 5.040196079 2,458 faults 5.040196079 556 sched:sched_switch 2.000191939 6,870 faults 2.000191939 1,170 sched:sched_switch 4.000414103 541 faults 4.000414103 902 sched:sched_switch 5.000809863 450 faults 5.000809863 364 sched:sched_switch # Committer notes: This was broken since the cset introducing the --interval feature, i.e. --repeat + --interval wasn't tested at that point, add the Fixes tag so that automatic scripts can pick this up. Fixes: 13370a9b5bb8 ("perf stat: Add interval printing") Signed-off-by: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com> Acked-by: Jiri Olsa <jolsa(a)kernel.org> Tested-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Tested-by: Ravi Bangoria <ravi.bangoria(a)linux.ibm.com> Cc: Namhyung Kim <namhyung(a)kernel.org> Cc: Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com> Cc: Stephane Eranian <eranian(a)google.com> Cc: stable(a)vger.kernel.org # v3.9+ Link: http://lore.kernel.org/lkml/20190904094738.9558-2-srikar@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> --- tools/perf/builtin-stat.c | 3 +++ tools/perf/util/stat.c | 17 +++++++++++++++++ tools/perf/util/stat.h | 1 + 3 files changed, 21 insertions(+) diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c index 352cf39d7c2f..eda451842bfd 100644 --- a/tools/perf/builtin-stat.c +++ b/tools/perf/builtin-stat.c @@ -1961,6 +1961,9 @@ int cmd_stat(int argc, const char **argv) fprintf(output, "[ perf stat: executing run #%d ... ]\n", run_idx + 1); + if (run_idx != 0) + perf_evlist__reset_prev_raw_counts(evsel_list); + status = run_perf_stat(argc, argv, run_idx); if (forever && status != -1) { print_counters(NULL, argc, argv); diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c index db8a6cf336be..773f29d4f6a7 100644 --- a/tools/perf/util/stat.c +++ b/tools/perf/util/stat.c @@ -155,6 +155,15 @@ static void perf_evsel__free_prev_raw_counts(struct perf_evsel *evsel) evsel->prev_raw_counts = NULL; } +static void perf_evsel__reset_prev_raw_counts(struct perf_evsel *evsel) +{ + if (evsel->prev_raw_counts) { + evsel->prev_raw_counts->aggr.val = 0; + evsel->prev_raw_counts->aggr.ena = 0; + evsel->prev_raw_counts->aggr.run = 0; + } +} + static int perf_evsel__alloc_stats(struct perf_evsel *evsel, bool alloc_raw) { int ncpus = perf_evsel__nr_cpus(evsel); @@ -205,6 +214,14 @@ void perf_evlist__reset_stats(struct perf_evlist *evlist) } } +void perf_evlist__reset_prev_raw_counts(struct perf_evlist *evlist) +{ + struct perf_evsel *evsel; + + evlist__for_each_entry(evlist, evsel) + perf_evsel__reset_prev_raw_counts(evsel); +} + static void zero_per_pkg(struct perf_evsel *counter) { if (counter->per_pkg_mask) diff --git a/tools/perf/util/stat.h b/tools/perf/util/stat.h index 0f9c9f6e2041..edbeb2f63e8d 100644 --- a/tools/perf/util/stat.h +++ b/tools/perf/util/stat.h @@ -194,6 +194,7 @@ void perf_stat__collect_metric_expr(struct perf_evlist *); int perf_evlist__alloc_stats(struct perf_evlist *evlist, bool alloc_raw); void perf_evlist__free_stats(struct perf_evlist *evlist); void perf_evlist__reset_stats(struct perf_evlist *evlist); +void perf_evlist__reset_prev_raw_counts(struct perf_evlist *evlist); int perf_stat_process_counter(struct perf_stat_config *config, struct perf_evsel *counter); -- 2.18.1

5 years

1
0
0 0

[patch 084/134] memcg, oom: don't require __GFP_FS when invoking memcg OOM killer

by akpm＠linux-foundation.org

From: Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp> Subject: memcg, oom: don't require __GFP_FS when invoking memcg OOM killer Masoud Sharbiani noticed that commit 29ef680ae7c21110 ("memcg, oom: move out_of_memory back to the charge path") broke memcg OOM called from __xfs_filemap_fault() path. It turned out that try_charge() is retrying forever without making forward progress because mem_cgroup_oom(GFP_NOFS) cannot invoke the OOM killer due to commit 3da88fb3bacfaa33 ("mm, oom: move GFP_NOFS check to out_of_memory"). Allowing forced charge due to being unable to invoke memcg OOM killer will lead to global OOM situation. Also, just returning -ENOMEM will be risky because OOM path is lost and some paths (e.g. get_user_pages()) will leak -ENOMEM. Therefore, invoking memcg OOM killer (despite GFP_NOFS) will be the only choice we can choose for now. Until 29ef680ae7c21110, we were able to invoke memcg OOM killer when GFP_KERNEL reclaim failed [1]. But since 29ef680ae7c21110, we need to invoke memcg OOM killer when GFP_NOFS reclaim failed [2]. Although in the past we did invoke memcg OOM killer for GFP_NOFS [3], we might get pre-mature memcg OOM reports due to this patch. [1] leaker invoked oom-killer: gfp_mask=0x6200ca(GFP_HIGHUSER_MOVABLE), nodemask=(null), order=0, oom_score_adj=0 CPU: 0 PID: 2746 Comm: leaker Not tainted 4.18.0+ #19 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/13/2018 Call Trace: dump_stack+0x63/0x88 dump_header+0x67/0x27a ? mem_cgroup_scan_tasks+0x91/0xf0 oom_kill_process+0x210/0x410 out_of_memory+0x10a/0x2c0 mem_cgroup_out_of_memory+0x46/0x80 mem_cgroup_oom_synchronize+0x2e4/0x310 ? high_work_func+0x20/0x20 pagefault_out_of_memory+0x31/0x76 mm_fault_error+0x55/0x115 ? handle_mm_fault+0xfd/0x220 __do_page_fault+0x433/0x4e0 do_page_fault+0x22/0x30 ? page_fault+0x8/0x30 page_fault+0x1e/0x30 RIP: 0033:0x4009f0 Code: 03 00 00 00 e8 71 fd ff ff 48 83 f8 ff 49 89 c6 74 74 48 89 c6 bf c0 0c 40 00 31 c0 e8 69 fd ff ff 45 85 ff 7e 21 31 c9 66 90 <41> 0f be 14 0e 01 d3 f7 c1 ff 0f 00 00 75 05 41 c6 04 0e 2a 48 83 RSP: 002b:00007ffe29ae96f0 EFLAGS: 00010206 RAX: 000000000000001b RBX: 0000000000000000 RCX: 0000000001ce1000 RDX: 0000000000000000 RSI: 000000007fffffe5 RDI: 0000000000000000 RBP: 000000000000000c R08: 0000000000000000 R09: 00007f94be09220d R10: 0000000000000002 R11: 0000000000000246 R12: 00000000000186a0 R13: 0000000000000003 R14: 00007f949d845000 R15: 0000000002800000 Task in /leaker killed as a result of limit of /leaker memory: usage 524288kB, limit 524288kB, failcnt 158965 memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 kmem: usage 2016kB, limit 9007199254740988kB, failcnt 0 Memory cgroup stats for /leaker: cache:844KB rss:521136KB rss_huge:0KB shmem:0KB mapped_file:0KB dirty:132KB writeback:0KB inactive_anon:0KB active_anon:521224KB inactive_file:1012KB active_file:8KB unevictable:0KB Memory cgroup out of memory: Kill process 2746 (leaker) score 998 or sacrifice child Killed process 2746 (leaker) total-vm:536704kB, anon-rss:521176kB, file-rss:1208kB, shmem-rss:0kB oom_reaper: reaped process 2746 (leaker), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB [2] leaker invoked oom-killer: gfp_mask=0x600040(GFP_NOFS), nodemask=(null), order=0, oom_score_adj=0 CPU: 1 PID: 2746 Comm: leaker Not tainted 4.18.0+ #20 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/13/2018 Call Trace: dump_stack+0x63/0x88 dump_header+0x67/0x27a ? mem_cgroup_scan_tasks+0x91/0xf0 oom_kill_process+0x210/0x410 out_of_memory+0x109/0x2d0 mem_cgroup_out_of_memory+0x46/0x80 try_charge+0x58d/0x650 ? __radix_tree_replace+0x81/0x100 mem_cgroup_try_charge+0x7a/0x100 __add_to_page_cache_locked+0x92/0x180 add_to_page_cache_lru+0x4d/0xf0 iomap_readpages_actor+0xde/0x1b0 ? iomap_zero_range_actor+0x1d0/0x1d0 iomap_apply+0xaf/0x130 iomap_readpages+0x9f/0x150 ? iomap_zero_range_actor+0x1d0/0x1d0 xfs_vm_readpages+0x18/0x20 [xfs] read_pages+0x60/0x140 __do_page_cache_readahead+0x193/0x1b0 ondemand_readahead+0x16d/0x2c0 page_cache_async_readahead+0x9a/0xd0 filemap_fault+0x403/0x620 ? alloc_set_pte+0x12c/0x540 ? _cond_resched+0x14/0x30 __xfs_filemap_fault+0x66/0x180 [xfs] xfs_filemap_fault+0x27/0x30 [xfs] __do_fault+0x19/0x40 __handle_mm_fault+0x8e8/0xb60 handle_mm_fault+0xfd/0x220 __do_page_fault+0x238/0x4e0 do_page_fault+0x22/0x30 ? page_fault+0x8/0x30 page_fault+0x1e/0x30 RIP: 0033:0x4009f0 Code: 03 00 00 00 e8 71 fd ff ff 48 83 f8 ff 49 89 c6 74 74 48 89 c6 bf c0 0c 40 00 31 c0 e8 69 fd ff ff 45 85 ff 7e 21 31 c9 66 90 <41> 0f be 14 0e 01 d3 f7 c1 ff 0f 00 00 75 05 41 c6 04 0e 2a 48 83 RSP: 002b:00007ffda45c9290 EFLAGS: 00010206 RAX: 000000000000001b RBX: 0000000000000000 RCX: 0000000001a1e000 RDX: 0000000000000000 RSI: 000000007fffffe5 RDI: 0000000000000000 RBP: 000000000000000c R08: 0000000000000000 R09: 00007f6d061ff20d R10: 0000000000000002 R11: 0000000000000246 R12: 00000000000186a0 R13: 0000000000000003 R14: 00007f6ce59b2000 R15: 0000000002800000 Task in /leaker killed as a result of limit of /leaker memory: usage 524288kB, limit 524288kB, failcnt 7221 memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 kmem: usage 1944kB, limit 9007199254740988kB, failcnt 0 Memory cgroup stats for /leaker: cache:3632KB rss:518232KB rss_huge:0KB shmem:0KB mapped_file:0KB dirty:0KB writeback:0KB inactive_anon:0KB active_anon:518408KB inactive_file:3908KB active_file:12KB unevictable:0KB Memory cgroup out of memory: Kill process 2746 (leaker) score 992 or sacrifice child Killed process 2746 (leaker) total-vm:536704kB, anon-rss:518264kB, file-rss:1188kB, shmem-rss:0kB oom_reaper: reaped process 2746 (leaker), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB [3] leaker invoked oom-killer: gfp_mask=0x50, order=0, oom_score_adj=0 leaker cpuset=/ mems_allowed=0 CPU: 1 PID: 3206 Comm: leaker Not tainted 3.10.0-957.27.2.el7.x86_64 #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/13/2018 Call Trace: [<ffffffffaf364147>] dump_stack+0x19/0x1b [<ffffffffaf35eb6a>] dump_header+0x90/0x229 [<ffffffffaedbb456>] ? find_lock_task_mm+0x56/0xc0 [<ffffffffaee32a38>] ? try_get_mem_cgroup_from_mm+0x28/0x60 [<ffffffffaedbb904>] oom_kill_process+0x254/0x3d0 [<ffffffffaee36c36>] mem_cgroup_oom_synchronize+0x546/0x570 [<ffffffffaee360b0>] ? mem_cgroup_charge_common+0xc0/0xc0 [<ffffffffaedbc194>] pagefault_out_of_memory+0x14/0x90 [<ffffffffaf35d072>] mm_fault_error+0x6a/0x157 [<ffffffffaf3717c8>] __do_page_fault+0x3c8/0x4f0 [<ffffffffaf371925>] do_page_fault+0x35/0x90 [<ffffffffaf36d768>] page_fault+0x28/0x30 Task in /leaker killed as a result of limit of /leaker memory: usage 524288kB, limit 524288kB, failcnt 20628 memory+swap: usage 524288kB, limit 9007199254740988kB, failcnt 0 kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 Memory cgroup stats for /leaker: cache:840KB rss:523448KB rss_huge:0KB mapped_file:0KB swap:0KB inactive_anon:0KB active_anon:523448KB inactive_file:464KB active_file:376KB unevictable:0KB Memory cgroup out of memory: Kill process 3206 (leaker) score 970 or sacrifice child Killed process 3206 (leaker) total-vm:536692kB, anon-rss:523304kB, file-rss:412kB, shmem-rss:0kB Bisected by Masoud Sharbiani. Link: http://lkml.kernel.org/r/cbe54ed1-b6ba-a056-8899-2dc42526371d@i-love.sakura… Fixes: 3da88fb3bacfaa33 ("mm, oom: move GFP_NOFS check to out_of_memory") [necessary after 29ef680ae7c21110] Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: Masoud Sharbiani <msharbiani(a)apple.com> Tested-by: Masoud Sharbiani <msharbiani(a)apple.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Cc: David Rientjes <rientjes(a)google.com> Cc: <stable(a)vger.kernel.org> [4.19+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/oom_kill.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/mm/oom_kill.c~memcg-oom-dont-require-__gfp_fs-when-invoking-memcg-oom-killer +++ a/mm/oom_kill.c @@ -1069,9 +1069,10 @@ bool out_of_memory(struct oom_control *o * The OOM killer does not compensate for IO-less reclaim. * pagefault_out_of_memory lost its gfp context so we have to * make sure exclude 0 mask - all other users should have at least - * ___GFP_DIRECT_RECLAIM to get here. + * ___GFP_DIRECT_RECLAIM to get here. But mem_cgroup_oom() has to + * invoke the OOM killer even if it is a GFP_NOFS allocation. */ - if (oc->gfp_mask && !(oc->gfp_mask & __GFP_FS)) + if (oc->gfp_mask && !(oc->gfp_mask & __GFP_FS) && !is_memcg_oom(oc)) return true; /* _

5 years

1
0
0 0

[patch 080/134] mm/compaction.c: clear total_{migrate,free}_scanned before scanning a new zone

by akpm＠linux-foundation.org

From: Yafang Shao <laoar.shao(a)gmail.com> Subject: mm/compaction.c: clear total_{migrate,free}_scanned before scanning a new zone total_{migrate,free}_scanned will be added to COMPACTMIGRATE_SCANNED and COMPACTFREE_SCANNED in compact_zone(). We should clear them before scanning a new zone. In the proc triggered compaction, we forgot clearing them. [laoar.shao(a)gmail.com: introduce a helper compact_zone_counters_init()] Link: http://lkml.kernel.org/r/1563869295-25748-1-git-send-email-laoar.shao@gmail… [akpm(a)linux-foundation.org: expand compact_zone_counters_init() into its single callsite, per mhocko] [vbabka(a)suse.cz: squash compact_zone() list_head init as well] Link: http://lkml.kernel.org/r/1fb6f7da-f776-9e42-22f8-bbb79b030b98@suse.cz [akpm(a)linux-foundation.org: kcompactd_do_work(): avoid unnecessary initialization of cc.zone] Link: http://lkml.kernel.org/r/1563789275-9639-1-git-send-email-laoar.shao@gmail.… Fixes: 7f354a548d1c ("mm, compaction: add vmstats for kcompactd work") Signed-off-by: Yafang Shao <laoar.shao(a)gmail.com> Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz> Reviewed-by: Vlastimil Babka <vbabka(a)suse.cz> Cc: David Rientjes <rientjes(a)google.com> Cc: Yafang Shao <shaoyafang(a)didiglobal.com> Cc: Mel Gorman <mgorman(a)techsingularity.net> Cc: Michal Hocko <mhocko(a)suse.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/compaction.c | 35 +++++++++++++---------------------- 1 file changed, 13 insertions(+), 22 deletions(-) --- a/mm/compaction.c~mm-compaction-clear-total_migratefree_scanned-before-scanning-a-new-zone +++ a/mm/compaction.c @@ -2078,6 +2078,17 @@ compact_zone(struct compact_control *cc, const bool sync = cc->mode != MIGRATE_ASYNC; bool update_cached; + /* + * These counters track activities during zone compaction. Initialize + * them before compacting a new zone. + */ + cc->total_migrate_scanned = 0; + cc->total_free_scanned = 0; + cc->nr_migratepages = 0; + cc->nr_freepages = 0; + INIT_LIST_HEAD(&cc->freepages); + INIT_LIST_HEAD(&cc->migratepages); + cc->migratetype = gfpflags_to_migratetype(cc->gfp_mask); ret = compaction_suitable(cc->zone, cc->order, cc->alloc_flags, cc->classzone_idx); @@ -2281,10 +2292,6 @@ static enum compact_result compact_zone_ { enum compact_result ret; struct compact_control cc = { - .nr_freepages = 0, - .nr_migratepages = 0, - .total_migrate_scanned = 0, - .total_free_scanned = 0, .order = order, .search_order = order, .gfp_mask = gfp_mask, @@ -2305,8 +2312,6 @@ static enum compact_result compact_zone_ if (capture) current->capture_control = &capc; - INIT_LIST_HEAD(&cc.freepages); - INIT_LIST_HEAD(&cc.migratepages); ret = compact_zone(&cc, &capc); @@ -2408,8 +2413,6 @@ static void compact_node(int nid) struct zone *zone; struct compact_control cc = { .order = -1, - .total_migrate_scanned = 0, - .total_free_scanned = 0, .mode = MIGRATE_SYNC, .ignore_skip_hint = true, .whole_zone = true, @@ -2423,11 +2426,7 @@ static void compact_node(int nid) if (!populated_zone(zone)) continue; - cc.nr_freepages = 0; - cc.nr_migratepages = 0; cc.zone = zone; - INIT_LIST_HEAD(&cc.freepages); - INIT_LIST_HEAD(&cc.migratepages); compact_zone(&cc, NULL); @@ -2529,8 +2528,6 @@ static void kcompactd_do_work(pg_data_t struct compact_control cc = { .order = pgdat->kcompactd_max_order, .search_order = pgdat->kcompactd_max_order, - .total_migrate_scanned = 0, - .total_free_scanned = 0, .classzone_idx = pgdat->kcompactd_classzone_idx, .mode = MIGRATE_SYNC_LIGHT, .ignore_skip_hint = false, @@ -2554,16 +2551,10 @@ static void kcompactd_do_work(pg_data_t COMPACT_CONTINUE) continue; - cc.nr_freepages = 0; - cc.nr_migratepages = 0; - cc.total_migrate_scanned = 0; - cc.total_free_scanned = 0; - cc.zone = zone; - INIT_LIST_HEAD(&cc.freepages); - INIT_LIST_HEAD(&cc.migratepages); - if (kthread_should_stop()) return; + + cc.zone = zone; status = compact_zone(&cc, NULL); if (status == COMPACT_SUCCESS) { _

5 years

1
0
0 0

[patch 079/134] z3fold: fix memory leak in kmem cache

by akpm＠linux-foundation.org

From: Vitaly Wool <vitalywool(a)gmail.com> Subject: z3fold: fix memory leak in kmem cache Currently there is a leak in init_z3fold_page() -- it allocates handles from kmem cache even for headless pages, but then they are never used and never freed, so eventually kmem cache may get exhausted. This patch provides a fix for that. Link: http://lkml.kernel.org/r/20190917185352.44cf285d3ebd9e64548de5de@gmail.com Signed-off-by: Vitaly Wool <vitalywool(a)gmail.com> Reported-by: Markus Linnala <markus.linnala(a)gmail.com> Tested-by: Markus Linnala <markus.linnala(a)gmail.com> Cc: Dan Streetman <ddstreet(a)ieee.org> Cc: Henry Burns <henrywolfeburns(a)gmail.com> Cc: Shakeel Butt <shakeelb(a)google.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/z3fold.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) --- a/mm/z3fold.c~z3fold-fix-memory-leak-in-kmem-cache +++ a/mm/z3fold.c @@ -295,14 +295,11 @@ static void z3fold_unregister_migration( } /* Initializes the z3fold header of a newly allocated z3fold page */ -static struct z3fold_header *init_z3fold_page(struct page *page, +static struct z3fold_header *init_z3fold_page(struct page *page, bool headless, struct z3fold_pool *pool, gfp_t gfp) { struct z3fold_header *zhdr = page_address(page); - struct z3fold_buddy_slots *slots = alloc_slots(pool, gfp); - - if (!slots) - return NULL; + struct z3fold_buddy_slots *slots; INIT_LIST_HEAD(&page->lru); clear_bit(PAGE_HEADLESS, &page->private); @@ -310,6 +307,12 @@ static struct z3fold_header *init_z3fold clear_bit(NEEDS_COMPACTING, &page->private); clear_bit(PAGE_STALE, &page->private); clear_bit(PAGE_CLAIMED, &page->private); + if (headless) + return zhdr; + + slots = alloc_slots(pool, gfp); + if (!slots) + return NULL; spin_lock_init(&zhdr->page_lock); kref_init(&zhdr->refcount); @@ -930,7 +933,7 @@ retry: if (!page) return -ENOMEM; - zhdr = init_z3fold_page(page, pool, gfp); + zhdr = init_z3fold_page(page, bud == HEADLESS, pool, gfp); if (!zhdr) { __free_page(page); return -ENOMEM; _

5 years

1
0
0 0

[patch 004/134] z3fold: fix retry mechanism in page reclaim

by akpm＠linux-foundation.org

From: Vitaly Wool <vitalywool(a)gmail.com> Subject: z3fold: fix retry mechanism in page reclaim z3fold_page_reclaim()'s retry mechanism is broken: on a second iteration it will have zhdr from the first one so that zhdr is no longer in line with struct page. That leads to crashes when the system is stressed. Fix that by moving zhdr assignment up. While at it, protect against using already freed handles by using own local slots structure in z3fold_page_reclaim(). Link: http://lkml.kernel.org/r/20190908162919.830388dc7404d1e2c80f4095@gmail.com Signed-off-by: Vitaly Wool <vitalywool(a)gmail.com> Reported-by: Markus Linnala <markus.linnala(a)gmail.com> Reported-by: Chris Murphy <bugzilla(a)colorremedies.com> Reported-by: Agustin Dall'Alba <agustin(a)dallalba.com.ar> Cc: "Maciej S. Szmigiero" <mail(a)maciej.szmigiero.name> Cc: Shakeel Butt <shakeelb(a)google.com> Cc: Henry Burns <henrywolfeburns(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/z3fold.c | 49 ++++++++++++++++++++++++++++++++++--------------- 1 file changed, 34 insertions(+), 15 deletions(-) --- a/mm/z3fold.c~z3fold-fix-retry-mechanism-in-page-reclaim +++ a/mm/z3fold.c @@ -366,9 +366,10 @@ static inline int __idx(struct z3fold_he * Encodes the handle of a particular buddy within a z3fold page * Pool lock should be held as this function accesses first_num */ -static unsigned long encode_handle(struct z3fold_header *zhdr, enum buddy bud) +static unsigned long __encode_handle(struct z3fold_header *zhdr, + struct z3fold_buddy_slots *slots, + enum buddy bud) { - struct z3fold_buddy_slots *slots; unsigned long h = (unsigned long)zhdr; int idx = 0; @@ -385,11 +386,15 @@ static unsigned long encode_handle(struc if (bud == LAST) h |= (zhdr->last_chunks << BUDDY_SHIFT); - slots = zhdr->slots; slots->slot[idx] = h; return (unsigned long)&slots->slot[idx]; } +static unsigned long encode_handle(struct z3fold_header *zhdr, enum buddy bud) +{ + return __encode_handle(zhdr, zhdr->slots, bud); +} + /* Returns the z3fold page where a given handle is stored */ static inline struct z3fold_header *handle_to_z3fold_header(unsigned long h) { @@ -624,6 +629,7 @@ static void do_compact_page(struct z3fol } if (unlikely(PageIsolated(page) || + test_bit(PAGE_CLAIMED, &page->private) || test_bit(PAGE_STALE, &page->private))) { z3fold_page_unlock(zhdr); return; @@ -1100,6 +1106,7 @@ static int z3fold_reclaim_page(struct z3 struct z3fold_header *zhdr = NULL; struct page *page = NULL; struct list_head *pos; + struct z3fold_buddy_slots slots; unsigned long first_handle = 0, middle_handle = 0, last_handle = 0; spin_lock(&pool->lock); @@ -1118,16 +1125,22 @@ static int z3fold_reclaim_page(struct z3 /* this bit could have been set by free, in which case * we pass over to the next page in the pool. */ - if (test_and_set_bit(PAGE_CLAIMED, &page->private)) + if (test_and_set_bit(PAGE_CLAIMED, &page->private)) { + page = NULL; continue; + } - if (unlikely(PageIsolated(page))) + if (unlikely(PageIsolated(page))) { + clear_bit(PAGE_CLAIMED, &page->private); + page = NULL; continue; + } + zhdr = page_address(page); if (test_bit(PAGE_HEADLESS, &page->private)) break; - zhdr = page_address(page); if (!z3fold_page_trylock(zhdr)) { + clear_bit(PAGE_CLAIMED, &page->private); zhdr = NULL; continue; /* can't evict at this point */ } @@ -1145,26 +1158,30 @@ static int z3fold_reclaim_page(struct z3 if (!test_bit(PAGE_HEADLESS, &page->private)) { /* - * We need encode the handles before unlocking, since - * we can race with free that will set - * (first|last)_chunks to 0 + * We need encode the handles before unlocking, and + * use our local slots structure because z3fold_free + * can zero out zhdr->slots and we can't do much + * about that */ first_handle = 0; last_handle = 0; middle_handle = 0; if (zhdr->first_chunks) - first_handle = encode_handle(zhdr, FIRST); + first_handle = __encode_handle(zhdr, &slots, + FIRST); if (zhdr->middle_chunks) - middle_handle = encode_handle(zhdr, MIDDLE); + middle_handle = __encode_handle(zhdr, &slots, + MIDDLE); if (zhdr->last_chunks) - last_handle = encode_handle(zhdr, LAST); + last_handle = __encode_handle(zhdr, &slots, + LAST); /* * it's safe to unlock here because we hold a * reference to this page */ z3fold_page_unlock(zhdr); } else { - first_handle = encode_handle(zhdr, HEADLESS); + first_handle = __encode_handle(zhdr, &slots, HEADLESS); last_handle = middle_handle = 0; } @@ -1194,9 +1211,9 @@ next: spin_lock(&pool->lock); list_add(&page->lru, &pool->lru); spin_unlock(&pool->lock); + clear_bit(PAGE_CLAIMED, &page->private); } else { z3fold_page_lock(zhdr); - clear_bit(PAGE_CLAIMED, &page->private); if (kref_put(&zhdr->refcount, release_z3fold_page_locked)) { atomic64_dec(&pool->pages_nr); @@ -1211,6 +1228,7 @@ next: list_add(&page->lru, &pool->lru); spin_unlock(&pool->lock); z3fold_page_unlock(zhdr); + clear_bit(PAGE_CLAIMED, &page->private); } /* We started off locked to we need to lock the pool back */ @@ -1315,7 +1333,8 @@ static bool z3fold_page_isolate(struct p VM_BUG_ON_PAGE(!PageMovable(page), page); VM_BUG_ON_PAGE(PageIsolated(page), page); - if (test_bit(PAGE_HEADLESS, &page->private)) + if (test_bit(PAGE_HEADLESS, &page->private) || + test_bit(PAGE_CLAIMED, &page->private)) return false; zhdr = page_address(page); _

5 years

1
0
0 0

[patch 002/134] Revert "mm/z3fold.c: fix race between migration and destruction"

by akpm＠linux-foundation.org

From: Vitaly Wool <vitalywool(a)gmail.com> Subject: Revert "mm/z3fold.c: fix race between migration and destruction" With the original commit applied, z3fold_zpool_destroy() may get blocked on wait_event() for indefinite time. Revert this commit for the time being to get rid of this problem since the issue the original commit addresses is less severe. Link: http://lkml.kernel.org/r/20190910123142.7a9c8d2de4d0acbc0977c602@gmail.com Fixes: d776aaa9895eb6eb77 ("mm/z3fold.c: fix race between migration and destruction") Reported-by: Agust�n Dall'Alba <agustin(a)dallalba.com.ar> Signed-off-by: Vitaly Wool <vitalywool(a)gmail.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Vitaly Wool <vitalywool(a)gmail.com> Cc: Shakeel Butt <shakeelb(a)google.com> Cc: Jonathan Adams <jwadams(a)google.com> Cc: Henry Burns <henrywolfeburns(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/z3fold.c | 90 -------------------------------------------------- 1 file changed, 90 deletions(-) --- a/mm/z3fold.c~revert-mm-z3foldc-fix-race-between-migration-and-destruction +++ a/mm/z3fold.c @@ -41,7 +41,6 @@ #include <linux/workqueue.h> #include <linux/slab.h> #include <linux/spinlock.h> -#include <linux/wait.h> #include <linux/zpool.h> #include <linux/magic.h> @@ -146,8 +145,6 @@ struct z3fold_header { * @release_wq: workqueue for safe page release * @work: work_struct for safe page release * @inode: inode for z3fold pseudo filesystem - * @destroying: bool to stop migration once we start destruction - * @isolated: int to count the number of pages currently in isolation * * This structure is allocated at pool creation time and maintains metadata * pertaining to a particular z3fold pool. @@ -166,11 +163,8 @@ struct z3fold_pool { const struct zpool_ops *zpool_ops; struct workqueue_struct *compact_wq; struct workqueue_struct *release_wq; - struct wait_queue_head isolate_wait; struct work_struct work; struct inode *inode; - bool destroying; - int isolated; }; /* @@ -775,7 +769,6 @@ static struct z3fold_pool *z3fold_create goto out_c; spin_lock_init(&pool->lock); spin_lock_init(&pool->stale_lock); - init_waitqueue_head(&pool->isolate_wait); pool->unbuddied = __alloc_percpu(sizeof(struct list_head)*NCHUNKS, 2); if (!pool->unbuddied) goto out_pool; @@ -815,15 +808,6 @@ out: return NULL; } -static bool pool_isolated_are_drained(struct z3fold_pool *pool) -{ - bool ret; - - spin_lock(&pool->lock); - ret = pool->isolated == 0; - spin_unlock(&pool->lock); - return ret; -} /** * z3fold_destroy_pool() - destroys an existing z3fold pool * @pool: the z3fold pool to be destroyed @@ -833,22 +817,6 @@ static bool pool_isolated_are_drained(st static void z3fold_destroy_pool(struct z3fold_pool *pool) { kmem_cache_destroy(pool->c_handle); - /* - * We set pool-> destroying under lock to ensure that - * z3fold_page_isolate() sees any changes to destroying. This way we - * avoid the need for any memory barriers. - */ - - spin_lock(&pool->lock); - pool->destroying = true; - spin_unlock(&pool->lock); - - /* - * We need to ensure that no pages are being migrated while we destroy - * these workqueues, as migration can queue work on either of the - * workqueues. - */ - wait_event(pool->isolate_wait, !pool_isolated_are_drained(pool)); /* * We need to destroy pool->compact_wq before pool->release_wq, @@ -1339,28 +1307,6 @@ static u64 z3fold_get_pool_size(struct z return atomic64_read(&pool->pages_nr); } -/* - * z3fold_dec_isolated() expects to be called while pool->lock is held. - */ -static void z3fold_dec_isolated(struct z3fold_pool *pool) -{ - assert_spin_locked(&pool->lock); - VM_BUG_ON(pool->isolated <= 0); - pool->isolated--; - - /* - * If we have no more isolated pages, we have to see if - * z3fold_destroy_pool() is waiting for a signal. - */ - if (pool->isolated == 0 && waitqueue_active(&pool->isolate_wait)) - wake_up_all(&pool->isolate_wait); -} - -static void z3fold_inc_isolated(struct z3fold_pool *pool) -{ - pool->isolated++; -} - static bool z3fold_page_isolate(struct page *page, isolate_mode_t mode) { struct z3fold_header *zhdr; @@ -1387,34 +1333,6 @@ static bool z3fold_page_isolate(struct p spin_lock(&pool->lock); if (!list_empty(&page->lru)) list_del(&page->lru); - /* - * We need to check for destruction while holding pool->lock, as - * otherwise destruction could see 0 isolated pages, and - * proceed. - */ - if (unlikely(pool->destroying)) { - spin_unlock(&pool->lock); - /* - * If this page isn't stale, somebody else holds a - * reference to it. Let't drop our refcount so that they - * can call the release logic. - */ - if (unlikely(kref_put(&zhdr->refcount, - release_z3fold_page_locked))) { - /* - * If we get here we have kref problems, so we - * should freak out. - */ - WARN(1, "Z3fold is experiencing kref problems\n"); - z3fold_page_unlock(zhdr); - return false; - } - z3fold_page_unlock(zhdr); - return false; - } - - - z3fold_inc_isolated(pool); spin_unlock(&pool->lock); z3fold_page_unlock(zhdr); return true; @@ -1483,10 +1401,6 @@ static int z3fold_page_migrate(struct ad queue_work_on(new_zhdr->cpu, pool->compact_wq, &new_zhdr->work); - spin_lock(&pool->lock); - z3fold_dec_isolated(pool); - spin_unlock(&pool->lock); - page_mapcount_reset(page); put_page(page); return 0; @@ -1506,14 +1420,10 @@ static void z3fold_page_putback(struct p INIT_LIST_HEAD(&page->lru); if (kref_put(&zhdr->refcount, release_z3fold_page_locked)) { atomic64_dec(&pool->pages_nr); - spin_lock(&pool->lock); - z3fold_dec_isolated(pool); - spin_unlock(&pool->lock); return; } spin_lock(&pool->lock); list_add(&page->lru, &pool->lru); - z3fold_dec_isolated(pool); spin_unlock(&pool->lock); z3fold_page_unlock(zhdr); } _

5 years

1
0
0 0

[PATCH] Revert "ARM: bcm283x: Switch V3D over to using the PM driver instead of firmware."

by Stefan Wahren

Since release of the new BCM2835 PM driver there has been several reports of V3D probing issues. This is caused by timeouts during powering-up the GRAFX PM domain: bcm2835-power: Timeout waiting for grafx power OK I was able to reproduce this reliable on my Raspberry Pi 3B+ after setting force_turbo=1 in the firmware configuration. Since there are no issues using the firmware PM driver with the same setup, there must be an issue in the BCM2835 PM driver. Unfortunately there hasn't been much progress in identifying the root cause since June (mostly in the lack of documentation), so i decided to switch back until the issue in the BCM2835 PM driver is fixed. Link: https://github.com/raspberrypi/linux/issues/3046 Fixes: e1dc2b2e1bef (" ARM: bcm283x: Switch V3D over to using the PM driver instead of firmware.") Cc: stable(a)vger.kernel.org Signed-off-by: Stefan Wahren <wahrenst(a)gmx.net> --- arch/arm/boot/dts/bcm2835-rpi.dtsi | 4 ++++ arch/arm/boot/dts/bcm283x.dtsi | 4 +--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/arch/arm/boot/dts/bcm2835-rpi.dtsi b/arch/arm/boot/dts/bcm2835-rpi.dtsi index 6c6a7f6..b909e3b 100644 --- a/arch/arm/boot/dts/bcm2835-rpi.dtsi +++ b/arch/arm/boot/dts/bcm2835-rpi.dtsi @@ -67,6 +67,10 @@ power-domains = <&power RPI_POWER_DOMAIN_USB>; }; +&v3d { + power-domains = <&power RPI_POWER_DOMAIN_V3D>; +}; + &vec { power-domains = <&power RPI_POWER_DOMAIN_VEC>; status = "okay"; diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi index 2d191fc..b238567 100644 --- a/arch/arm/boot/dts/bcm283x.dtsi +++ b/arch/arm/boot/dts/bcm283x.dtsi @@ -3,7 +3,6 @@ #include <dt-bindings/clock/bcm2835-aux.h> #include <dt-bindings/gpio/gpio.h> #include <dt-bindings/interrupt-controller/irq.h> -#include <dt-bindings/soc/bcm2835-pm.h> /* firmware-provided startup stubs live here, where the secondary CPUs are * spinning. @@ -121,7 +120,7 @@ #interrupt-cells = <2>; }; - pm: watchdog@7e100000 { + watchdog@7e100000 { compatible = "brcm,bcm2835-pm", "brcm,bcm2835-pm-wdt"; #power-domain-cells = <1>; #reset-cells = <1>; @@ -641,7 +640,6 @@ compatible = "brcm,bcm2835-v3d"; reg = <0x7ec00000 0x1000>; interrupts = <1 10>; - power-domains = <&pm BCM2835_POWER_DOMAIN_GRAFX_V3D>; }; vc4: gpu { -- 2.7.4

5 years

3
4
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror September 2019