The patch titled
Subject: mm: validate inode in mapping_set_error()
has been removed from the -mm tree. Its filename was
mm-validate-inode-in-mapping_set_error.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Minchan Kim <minchan(a)kernel.org>
Subject: mm: validate inode in mapping_set_error()
The swap address_space doesn't have host. Thus, it makes kernel crash once
swap write meets error. Fix it.
Link: https://lkml.kernel.org/r/20201010000650.750063-1-minchan@kernel.org
Fixes: 735e4ae5ba28 ("vfs: track per-sb writeback errors and report them to syncfs")
Signed-off-by: Minchan Kim <minchan(a)kernel.org>
Acked-by: Jeff Layton <jlayton(a)kernel.org>
Cc: Jan Kara <jack(a)suse.cz>
Cc: Andres Freund <andres(a)anarazel.de>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: Al Viro <viro(a)zeniv.linux.org.uk>
Cc: Christoph Hellwig <hch(a)infradead.org>
Cc: Dave Chinner <david(a)fromorbit.com>
Cc: David Howells <dhowells(a)redhat.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/pagemap.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/include/linux/pagemap.h~mm-validate-inode-in-mapping_set_error
+++ a/include/linux/pagemap.h
@@ -54,7 +54,8 @@ static inline void mapping_set_error(str
__filemap_set_wb_err(mapping, error);
/* Record it in superblock */
- errseq_set(&mapping->host->i_sb->s_wb_err, error);
+ if (mapping->host)
+ errseq_set(&mapping->host->i_sb->s_wb_err, error);
/* Record it in flags for now, for legacy callers */
if (error == -ENOSPC)
_
Patches currently in -mm which might be from minchan(a)kernel.org are
mm-madvise-pass-mm-to-do_madvise.patch
pid-move-pidfd_get_pid-to-pidc.patch
mm-madvise-introduce-process_madvise-syscall-an-external-memory-hinting-api.patch
mm-madvise-introduce-process_madvise-syscall-an-external-memory-hinting-api-fix.patch
mm-madvise-introduce-process_madvise-syscall-an-external-memory-hinting-api-fix-fix-fix-fix-fix.patch
mm-madvise-introduce-process_madvise-syscall-an-external-memory-hinting-api-fix-fix-fix-fix-fix-fix-fix.patch
From: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
Currently we leave the cache_level of the initial fb obj
set to NONE. This means on eLLC machines the first pin_to_display()
will try to switch it to WT which requires a vma unbind+bind.
If that happens during the fbdev initialization rcu does not
seem operational which causes the unbind to get stuck. To
most appearances this looks like a dead machine on boot.
Avoid the unbind by already marking the object cache_level
as WT when creating it. We still do an excplicit ggtt pin
which will rewrite the PTEs anyway, so they will match whatever
cache level we set.
Cc: <stable(a)vger.kernel.org> # v5.7+
Suggested-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2381
Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
---
drivers/gpu/drm/i915/display/intel_display.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
index 907e1d155443..00c08600c60a 100644
--- a/drivers/gpu/drm/i915/display/intel_display.c
+++ b/drivers/gpu/drm/i915/display/intel_display.c
@@ -3445,6 +3445,14 @@ initial_plane_vma(struct drm_i915_private *i915,
if (IS_ERR(obj))
return NULL;
+ /*
+ * Mark it WT ahead of time to avoid changing the
+ * cache_level during fbdev initialization. The
+ * unbind there would get stuck waiting for rcu.
+ */
+ i915_gem_object_set_cache_coherency(obj, HAS_WT(i915) ?
+ I915_CACHE_WT : I915_CACHE_NONE);
+
switch (plane_config->tiling) {
case I915_TILING_NONE:
break;
--
2.26.2
Consider a case where host is trying to submit urbs to the
connected device while holding the us->dev_mutex and due to
some reason it is stuck while waiting for the completion of
the urbs. Now the scsi error mechanism kicks in and it calls
the device reset handler which is trying to acquire the same
mutex causing a deadlock situation.
Below is the call stack of the task which acquired the mutex
(0xFFFFFFC660447460) and waiting for completion.
B::v.f_/task_0xFFFFFFC6604DB280
-000|__switch_to(prev = 0xFFFFFFC6604DB280, ?)
-001|prepare_lock_switch(inline)
-001|context_switch(inline)
-001|__schedule(?)
-002|schedule()
-003|schedule_timeout(timeout = 9223372036854775807)
-004|do_wait_for_common(x = 0xFFFFFFC660447570,
action = 0xFFFFFF98ED5A7398, timeout = 9223372036854775807, ?)
-005|spin_unlock_irq(inline)
-005|__wait_for_common(inline)
-005|wait_for_common(inline)
-005|wait_for_completion(x = 0xFFFFFFC660447570)
-006|sg_clean(inline)
-006|usb_sg_wait()
-007|atomic64_andnot(inline)
-007|atomic_long_andnot(inline)
-007|clear_bit(inline)
-007|usb_stor_bulk_transfer_sglist(us = 0xFFFFFFC660447460,
pipe = 3221291648, sg = 0xFFFFFFC65D6415D0, ?, length = 512,
act_len = 0xFFFFFF801258BC90)
-008|scsi_bufflen(inline)
-008|usb_stor_bulk_srb(inline)
-008|usb_stor_Bulk_transport(srb = 0xFFFFFFC65D641438,
us = 0xFFFFFFC660447460)
-009|test_bit(inline)
-009|usb_stor_invoke_transport(srb = 0xFFFFFFC65D641438,
us = 0xFFFFFFC660447460)
-010|usb_stor_transparent_scsi_command(?, ?)
-011|usb_stor_control_thread(__us = 0xFFFFFFC660447460) //us->dev_mutex
-012|kthread(_create = 0xFFFFFFC6604C5E80)
-013|ret_from_fork(asm)
---|end of frame
Below is the call stack of the task which trying to acquire the same
mutex(0xFFFFFFC660447460) in the error handling path.
B::v.f_/task_0xFFFFFFC6609AA1C0
-000|__switch_to(prev = 0xFFFFFFC6609AA1C0, ?)
-001|prepare_lock_switch(inline)
-001|context_switch(inline)
-001|__schedule(?)
-002|schedule()
-003|schedule_preempt_disabled()
-004|__mutex_lock_common(lock = 0xFFFFFFC660447460, state = 2, ?, ?, ?,
?, ?)
-005|__mutex_lock_slowpath(?)
-006|__cmpxchg_acq(inline)
-006|__mutex_trylock_fast(inline)
-006|mutex_lock(lock = 0xFFFFFFC660447460) //us->dev_mutex
-007|device_reset(?)
-008|scsi_try_bus_device_reset(inline)
-008|scsi_eh_bus_device_reset(inline)
-008|scsi_eh_ready_devs(shost = 0xFFFFFFC660446C80,
work_q = 0xFFFFFF80191C3DE8, done_q = 0xFFFFFF80191C3DD8)
-009|scsi_error_handler(data = 0xFFFFFFC660446C80)
-010|kthread(_create = 0xFFFFFFC66042C080)
-011|ret_from_fork(asm)
---|end of frame
Fix this by adding 5 seconds timeout while waiting for completion.
Fixes: 3e35bf39e (USB: fix codingstyle issues in drivers/usb/core/message.c)
Cc: stable(a)vger.kernel.org
Signed-off-by: Pratham Pratap <prathampratap(a)codeaurora.org>
---
drivers/usb/core/message.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index ae1de9c..b1e839c 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -515,15 +515,13 @@ EXPORT_SYMBOL_GPL(usb_sg_init);
*/
void usb_sg_wait(struct usb_sg_request *io)
{
- int i;
+ int i, retval;
int entries = io->entries;
/* queue the urbs. */
spin_lock_irq(&io->lock);
i = 0;
while (i < entries && !io->status) {
- int retval;
-
io->urbs[i]->dev = io->dev;
spin_unlock_irq(&io->lock);
@@ -569,7 +567,13 @@ void usb_sg_wait(struct usb_sg_request *io)
* So could the submit loop above ... but it's easier to
* solve neither problem than to solve both!
*/
- wait_for_completion(&io->complete);
+ retval = wait_for_completion_timeout(&io->complete,
+ msecs_to_jiffies(5000));
+ if (retval == 0) {
+ dev_err(&io->dev->dev, "%s, timed out while waiting for io_complete\n",
+ __func__);
+ usb_sg_cancel(io);
+ }
sg_clean(io);
}
--
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project
This is the start of the stable review cycle for the 4.19.150 release.
There are 38 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 07 Oct 2020 14:20:55 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.150-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.150-rc1
Will McVicker <willmcvicker(a)google.com>
netfilter: ctnetlink: add a range check for l3/l4 protonum
Al Viro <viro(a)zeniv.linux.org.uk>
ep_create_wakeup_source(): dentry name can change under you...
Al Viro <viro(a)zeniv.linux.org.uk>
epoll: EPOLL_CTL_ADD: close the race in decision to take fast path
Al Viro <viro(a)zeniv.linux.org.uk>
epoll: replace ->visited/visited_list with generation count
Al Viro <viro(a)zeniv.linux.org.uk>
epoll: do not insert into poll queues until all sanity checks are done
Or Cohen <orcohen(a)paloaltonetworks.com>
net/packet: fix overflow in tpacket_rcv
Laurent Dufour <ldufour(a)linux.ibm.com>
mm: don't rely on system state to detect hot-plug operations
Laurent Dufour <ldufour(a)linux.ibm.com>
mm: replace memmap_context by meminit_context
Thibaut Sautereau <thibaut.sautereau(a)ssi.gouv.fr>
random32: Restore __latent_entropy attribute on net_rand_state
Vincent Huang <vincent.huang(a)tw.synaptics.com>
Input: trackpoint - enable Synaptics trackpoints
Nicolas VINCENT <nicolas.vincent(a)vossloh.com>
i2c: cpm: Fix i2c_ram structure
Yu Kuai <yukuai3(a)huawei.com>
iommu/exynos: add missing put_device() call in exynos_iommu_of_xlate()
Marek Szyprowski <m.szyprowski(a)samsung.com>
clk: samsung: exynos4: mark 'chipid' clock as CLK_IGNORE_UNUSED
Jeffrey Mitchell <jeffrey.mitchell(a)starlab.io>
nfs: Fix security label length not being reset
Chris Packham <chris.packham(a)alliedtelesis.co.nz>
pinctrl: mvebu: Fix i2c sda definition for 98DX3236
Taiping Lai <taiping.lai(a)unisoc.com>
gpio: sprd: Clear interrupt when setting the type as edge
James Smart <james.smart(a)broadcom.com>
nvme-fc: fail new connections to a deleted host or remote port
Chris Packham <chris.packham(a)alliedtelesis.co.nz>
spi: fsl-espi: Only process interrupts for expected events
Felix Fietkau <nbd(a)nbd.name>
mac80211: do not allow bigger VHT MPDUs than the hardware supports
Xie He <xie.he.0141(a)gmail.com>
drivers/net/wan/hdlc: Set skb->protocol before transmitting
Xie He <xie.he.0141(a)gmail.com>
drivers/net/wan/lapbether: Make skb->protocol consistent with the header
Chaitanya Kulkarni <chaitanya.kulkarni(a)wdc.com>
nvme-core: get/put ctrl and transport module in nvme_dev_open/release()
Olympia Giannou <ogiannou(a)gmail.com>
rndis_host: increase sleep time in the query-response loop
Lucy Yan <lucyyan(a)google.com>
net: dec: de2104x: Increase receive ring size for Tulip
Martin Cerveny <m.cerveny(a)computer.org>
drm/sun4i: mixer: Extend regmap max_register
Xie He <xie.he.0141(a)gmail.com>
drivers/net/wan/hdlc_fr: Add needed_headroom for PVC devices
Jean Delvare <jdelvare(a)suse.de>
drm/amdgpu: restore proper ref count in amdgpu_display_crtc_set_config
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
ftrace: Move RCU is watching check after recursion check
Jiri Kosina <jkosina(a)suse.cz>
Input: i8042 - add nopnp quirk for Acer Aspire 5 A515
Sebastien Boeuf <sebastien.boeuf(a)intel.com>
net: virtio_vsock: Enhance connection semantics
Stefano Garzarella <sgarzare(a)redhat.com>
vsock/virtio: add transport parameter to the virtio_transport_reset_no_sock()
Stefano Garzarella <sgarzare(a)redhat.com>
vsock/virtio: stop workers during the .remove()
Stefano Garzarella <sgarzare(a)redhat.com>
vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock
Dinh Nguyen <dinguyen(a)kernel.org>
clk: socfpga: stratix10: fix the divider for the emac_ptp_free_clk
dillon min <dillon.minfei(a)gmail.com>
gpio: tc35894: fix up tc35894 interrupt configuration
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
gpio: mockup: fix resource leak in error path
Bryan O'Donoghue <bryan.odonoghue(a)linaro.org>
USB: gadget: f_ncm: Fix NDP16 datagram validation
Hans de Goede <hdegoede(a)redhat.com>
mmc: sdhci: Workaround broken command queuing on Intel GLK based IRBIS models
-------------
Diffstat:
Makefile | 4 +-
arch/ia64/mm/init.c | 6 +-
drivers/base/node.c | 84 +++++----
drivers/clk/samsung/clk-exynos4.c | 4 +-
drivers/clk/socfpga/clk-s10.c | 2 +-
drivers/gpio/gpio-mockup.c | 2 +
drivers/gpio/gpio-sprd.c | 3 +
drivers/gpio/gpio-tc3589x.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 2 +-
drivers/gpu/drm/sun4i/sun8i_mixer.c | 2 +-
drivers/i2c/busses/i2c-cpm.c | 3 +
drivers/input/mouse/trackpoint.c | 2 +
drivers/input/serio/i8042-x86ia64io.h | 7 +
drivers/iommu/exynos-iommu.c | 8 +-
drivers/mmc/host/sdhci-pci-core.c | 3 +-
drivers/net/ethernet/dec/tulip/de2104x.c | 2 +-
drivers/net/usb/rndis_host.c | 2 +-
drivers/net/wan/hdlc_cisco.c | 1 +
drivers/net/wan/hdlc_fr.c | 6 +-
drivers/net/wan/hdlc_ppp.c | 1 +
drivers/net/wan/lapbether.c | 4 +-
drivers/nvme/host/core.c | 15 ++
drivers/nvme/host/fc.c | 6 +-
drivers/pinctrl/mvebu/pinctrl-armada-xp.c | 2 +-
drivers/spi/spi-fsl-espi.c | 5 +-
drivers/usb/gadget/function/f_ncm.c | 30 +---
drivers/vhost/vsock.c | 94 +++++-----
fs/eventpoll.c | 71 ++++----
fs/nfs/dir.c | 3 +
include/linux/mm.h | 2 +-
include/linux/mmzone.h | 11 +-
include/linux/node.h | 11 +-
include/linux/virtio_vsock.h | 3 +-
kernel/trace/ftrace.c | 6 +-
lib/random32.c | 2 +-
mm/memory_hotplug.c | 5 +-
mm/page_alloc.c | 11 +-
net/mac80211/vht.c | 8 +-
net/netfilter/nf_conntrack_netlink.c | 2 +
net/packet/af_packet.c | 9 +-
net/vmw_vsock/virtio_transport.c | 265 ++++++++++++++++++----------
net/vmw_vsock/virtio_transport_common.c | 13 +-
42 files changed, 425 insertions(+), 299 deletions(-)