April 2020 - Linux-stable-mirror

[PATCH] x86/mpx: fix recursive munmap() corruption

by Dave Hansen

This is a bit of a mess, to put it mildly. But, it's a bug that seems to have gone unticked up to now, probably because nobody uses MPX. The other alternative to this fix is to just deprecate MPX, even in -stable kernels. MPX has the arch_unmap() hook inside of munmap() because MPX uses bounds tables that protect other areas of memory. When memory is unmapped, there is also a need to unmap the MPX bounds tables. Barring this, unused bounds tables can eat 80% of the address space. But, the recursive do_munmap() that gets called vi arch_unmap() wreaks havoc with __do_munmap()'s state. It can result in freeing populated page tables, accessing bogus VMA state, double-freed VMAs and more. To fix this, call arch_unmap() before __do_unmap() has a chance to do anything meaningful. Also, remove the 'vma' argument and force the MPX code to do its own, independent VMA lookup. For the common success case this is functionally identical to what was there before. For the munmap() failure case, it's possible that some MPX tables will be zapped for memory that continues to be in use. But, this is an extraordinarily unlikely scenario and the harm would be that MPX provides no protection since the bounds table got reset (zeroed). I can't imagine anyone doing this: ptr = mmap(); // use ptr ret = munmap(ptr); if (ret) // oh, there was an error, I'll // keep using ptr. Because if you're doing munmap(), you are *done* with the memory. There's probably no good data in there _anyway_. This passes the original reproducer from Richard Biener as well as the existing mpx selftests/. ==== The long story: munmap() has a couple of pieces: 1. Find the affected VMA(s) 2. Split the start/end one(s) if neceesary 3. Pull the VMAs out of the rbtree 4. Actually zap the memory via unmap_region(), including freeing page tables (or queueing them to be freed). 5. Fixup some of the accounting (like fput()) and actually free the VMA itself. I decided to put the arch_unmap() call right afer #3. This was *just* before mmap_sem looked like it might get downgraded (it won't in this context), but it looked right. It wasn't. Richard Biener reported a test that shows this in dmesg: [1216548.787498] BUG: Bad rss-counter state mm:0000000017ce560b idx:1 val:551 [1216548.787500] BUG: non-zero pgtables_bytes on freeing mm: 24576 What triggered this was the recursive do_munmap() called via arch_unmap(). It was freeing page tables that has not been properly zapped. But, the problem was bigger than this. For one, arch_unmap() can free VMAs. But, the calling __do_munmap() has variables that *point* to VMAs and obviously can't handle them just getting freed while the pointer is still valid. I tried a couple of things here. First, I tried to fix the page table freeing problem in isolation, but I then found the VMA issue. I also tried having the MPX code return a flag if it modified the rbtree which would force __do_munmap() to re-walk to restart. That spiralled out of control in complexity pretty fast. Just moving arch_unmap() and accepting that the bonkers failure case might eat some bounds tables seems like the simplest viable fix. Reported-by: Richard Biener <rguenther(a)suse.de> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Andy Lutomirski <luto(a)amacapital.net> Cc: x86(a)kernel.org Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: linux-kernel(a)vger.kernel.org Cc: linux-mm(a)kvack.org Cc: stable(a)vger.kernel.org --- b/arch/x86/include/asm/mmu_context.h | 6 +++--- b/arch/x86/include/asm/mpx.h | 5 ++--- b/arch/x86/mm/mpx.c | 10 ++++++---- b/include/asm-generic/mm_hooks.h | 1 - b/mm/mmap.c | 15 ++++++++------- 5 files changed, 19 insertions(+), 18 deletions(-) diff -puN mm/mmap.c~mpx-rss-pass-no-vma mm/mmap.c --- a/mm/mmap.c~mpx-rss-pass-no-vma 2019-04-01 06:56:53.409411123 -0700 +++ b/mm/mmap.c 2019-04-01 06:56:53.423411123 -0700 @@ -2731,9 +2731,17 @@ int __do_munmap(struct mm_struct *mm, un return -EINVAL; len = PAGE_ALIGN(len); + end = start + len; if (len == 0) return -EINVAL; + /* + * arch_unmap() might do unmaps itself. It must be called + * and finish any rbtree manipulation before this code + * runs and also starts to manipulate the rbtree. + */ + arch_unmap(mm, start, end); + /* Find the first overlapping VMA */ vma = find_vma(mm, start); if (!vma) @@ -2742,7 +2750,6 @@ int __do_munmap(struct mm_struct *mm, un /* we have start < vma->vm_end */ /* if it doesn't overlap, we have nothing.. */ - end = start + len; if (vma->vm_start >= end) return 0; @@ -2812,12 +2819,6 @@ int __do_munmap(struct mm_struct *mm, un /* Detach vmas from rbtree */ detach_vmas_to_be_unmapped(mm, vma, prev, end); - /* - * mpx unmap needs to be called with mmap_sem held for write. - * It is safe to call it before unmap_region(). - */ - arch_unmap(mm, vma, start, end); - if (downgrade) downgrade_write(&mm->mmap_sem); diff -puN arch/x86/include/asm/mmu_context.h~mpx-rss-pass-no-vma arch/x86/include/asm/mmu_context.h --- a/arch/x86/include/asm/mmu_context.h~mpx-rss-pass-no-vma 2019-04-01 06:56:53.412411123 -0700 +++ b/arch/x86/include/asm/mmu_context.h 2019-04-01 06:56:53.423411123 -0700 @@ -277,8 +277,8 @@ static inline void arch_bprm_mm_init(str mpx_mm_init(mm); } -static inline void arch_unmap(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long start, unsigned long end) +static inline void arch_unmap(struct mm_struct *mm, unsigned long start, + unsigned long end) { /* * mpx_notify_unmap() goes and reads a rarely-hot @@ -298,7 +298,7 @@ static inline void arch_unmap(struct mm_ * consistently wrong. */ if (unlikely(cpu_feature_enabled(X86_FEATURE_MPX))) - mpx_notify_unmap(mm, vma, start, end); + mpx_notify_unmap(mm, start, end); } /* diff -puN include/asm-generic/mm_hooks.h~mpx-rss-pass-no-vma include/asm-generic/mm_hooks.h --- a/include/asm-generic/mm_hooks.h~mpx-rss-pass-no-vma 2019-04-01 06:56:53.414411123 -0700 +++ b/include/asm-generic/mm_hooks.h 2019-04-01 06:56:53.423411123 -0700 @@ -18,7 +18,6 @@ static inline void arch_exit_mmap(struct } static inline void arch_unmap(struct mm_struct *mm, - struct vm_area_struct *vma, unsigned long start, unsigned long end) { } diff -puN arch/x86/mm/mpx.c~mpx-rss-pass-no-vma arch/x86/mm/mpx.c --- a/arch/x86/mm/mpx.c~mpx-rss-pass-no-vma 2019-04-01 06:56:53.416411123 -0700 +++ b/arch/x86/mm/mpx.c 2019-04-01 06:56:53.423411123 -0700 @@ -881,9 +881,10 @@ static int mpx_unmap_tables(struct mm_st * the virtual address region start...end have already been split if * necessary, and the 'vma' is the first vma in this range (start -> end). */ -void mpx_notify_unmap(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long start, unsigned long end) +void mpx_notify_unmap(struct mm_struct *mm, unsigned long start, + unsigned long end) { + struct vm_area_struct *vma; int ret; /* @@ -902,11 +903,12 @@ void mpx_notify_unmap(struct mm_struct * * which should not occur normally. Being strict about it here * helps ensure that we do not have an exploitable stack overflow. */ - do { + vma = find_vma(mm, start); + while (vma && vma->vm_start < end) { if (vma->vm_flags & VM_MPX) return; vma = vma->vm_next; - } while (vma && vma->vm_start < end); + } ret = mpx_unmap_tables(mm, start, end); if (ret) diff -puN arch/x86/include/asm/mpx.h~mpx-rss-pass-no-vma arch/x86/include/asm/mpx.h --- a/arch/x86/include/asm/mpx.h~mpx-rss-pass-no-vma 2019-04-01 06:56:53.418411123 -0700 +++ b/arch/x86/include/asm/mpx.h 2019-04-01 06:56:53.424411123 -0700 @@ -78,8 +78,8 @@ static inline void mpx_mm_init(struct mm */ mm->context.bd_addr = MPX_INVALID_BOUNDS_DIR; } -void mpx_notify_unmap(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long start, unsigned long end); +void mpx_notify_unmap(struct mm_struct *mm, unsigned long start, + unsigned long end); unsigned long mpx_unmapped_area_check(unsigned long addr, unsigned long len, unsigned long flags); @@ -100,7 +100,6 @@ static inline void mpx_mm_init(struct mm { } static inline void mpx_notify_unmap(struct mm_struct *mm, - struct vm_area_struct *vma, unsigned long start, unsigned long end) { } _

4 years, 1 month

7
13
0 0

Re: [PATCH] x86/memcpy: Introduce memcpy_mcsafe_fast

by Andy Lutomirski

--Andy > On Apr 18, 2020, at 12:42 PM, Linus Torvalds <torvalds(a)linux-foundation.org> wrote: > >>> On Fri, Apr 17, 2020 at 5:12 PM Dan Williams <dan.j.williams(a)intel.com> wrote: >>> >>> @@ -106,12 +108,10 @@ static __always_inline __must_check unsigned long >>> memcpy_mcsafe(void *dst, const void *src, size_t cnt) >>> { >>> #ifdef CONFIG_X86_MCE >>> - i(static_branch_unlikely(&mcsafe_key)) >>> - return __memcpy_mcsafe(dst, src, cnt); >>> - else >>> + if (static_branch_unlikely(&mcsafe_slow_key)) >>> + return memcpy_mcsafe_slow(dst, src, cnt); >>> #endif >>> - memcpy(dst, src, cnt); >>> - return 0; >>> + return memcpy_mcsafe_fast(dst, src, cnt); >>> } > > It strikes me that I see no advantages to making this an inline function at all. > > Even for the good case - where it turns into just a memcpy because MCE > is entirely disabled - it doesn't seem to matter. > > The only case that really helps is when the memcpy can be turned into > a single access. Which - and I checked - does exist, with people doing > > r = memcpy_mcsafe(&sb_seq_count, &sb(wc)->seq_count, sizeof(uint64_t)); > > to read a single 64-bit field which looks aligned to me. > > But that code is incredible garbage anyway, since even on a broken > machine, there's no actual reason to use the slow variant for that > whole access that I can tell. The macs-safe copy routines do not do > anything worthwhile for a single access. Maybe I’m missing something obvious, but what’s the alternative? The _mcsafe variants don’t just avoid the REP mess — they also tell the kernel that this particular access is recoverable via extable. With a regular memory access, the CPU may not explode, but do_machine_check() will, at very best, OOPS, and even that requires a certain degree of optimism. A panic is more likely.

4 years, 2 months

6
24
0 0

[PATCH 4.19 00/81] 4.19.80-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.80 release. There are 81 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri 18 Oct 2019 09:43:41 PM UTC. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.80-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.80-rc1 Mark-PK Tsai <mark-pk.tsai(a)mediatek.com> perf/hw_breakpoint: Fix arch_hw_breakpoint use-before-initialization Jon Derrick <jonathan.derrick(a)intel.com> PCI: vmd: Fix config addressing when using bus offsets Janakarajan Natarajan <Janakarajan.Natarajan(a)amd.com> x86/asm: Fix MWAITX C-state hint value Nuno Sá <nuno.sa(a)analog.com> hwmon: Fix HWMON_P_MIN_ALARM mask Steven Rostedt (VMware) <rostedt(a)goodmis.org> tracing: Get trace_array reference for available_tracers files Steven Rostedt (VMware) <rostedt(a)goodmis.org> ftrace: Get a reference counter for the trace_array on filter files Srivatsa S. Bhat (VMware) <srivatsa(a)csail.mit.edu> tracing/hwlat: Don't ignore outer-loop duration when calculating max_latency Srivatsa S. Bhat (VMware) <srivatsa(a)csail.mit.edu> tracing/hwlat: Report total time spent in all NMIs during the sample Masayoshi Mizuma <m.mizuma(a)jp.fujitsu.com> arm64/sve: Fix wrong free for task->thread.sve_state Johan Hovold <johan(a)kernel.org> media: stkwebcam: fix runtime PM after driver unbind Al Viro <viro(a)zeniv.linux.org.uk> Fix the locking in dcache_readdir() and friends Jeremy Linton <jeremy.linton(a)arm.com> arm64: topology: Use PPTT to determine if PE is a thread Jeremy Linton <jeremy.linton(a)arm.com> ACPI/PPTT: Add support for ACPI 6.3 thread flag Erik Schmauss <erik.schmauss(a)intel.com> ACPICA: ACPI 6.3: PPTT add additional fields in Processor Structure Flags Jiaxun Yang <jiaxun.yang(a)flygoat.com> MIPS: elf_hwcap: Export userspace ASEs Paul Burton <paul.burton(a)mips.com> MIPS: Disable Loongson MMI instructions for kernel build Trond Myklebust <trondmy(a)gmail.com> NFS: Fix O_DIRECT accounting of number of bytes read/written Josef Bacik <josef(a)toxicpanda.com> btrfs: fix uninitialized ret in ref-verify Josef Bacik <josef(a)toxicpanda.com> btrfs: fix incorrect updating of log root tree Dave Wysochanski <dwysocha(a)redhat.com> cifs: use cifsInodeInfo->open_file_lock while iterating to avoid a panic Fabrice Gasnier <fabrice.gasnier(a)st.com> iio: adc: stm32-adc: fix a race when using several adcs with dma and irq Fabrice Gasnier <fabrice.gasnier(a)st.com> iio: adc: stm32-adc: move registers definitions Bartosz Golaszewski <bgolaszewski(a)baylibre.com> gpiolib: don't clear FLAG_IS_OUT when emulating open-drain/open-source Brian Norris <briannorris(a)chromium.org> firmware: google: increment VPD key_len properly Dan Carpenter <dan.carpenter(a)oracle.com> mm/vmpressure.c: fix a signedness bug in vmpressure_register_event() Michal Hocko <mhocko(a)suse.com> kernel/sysctl.c: do not override max_threads provided by userspace Pavel Shilovsky <piastryyy(a)gmail.com> CIFS: Force reval dentry if LOOKUP_REVAL flag is set Pavel Shilovsky <piastryyy(a)gmail.com> CIFS: Force revalidate inode when dentry is stale Pavel Shilovsky <piastryyy(a)gmail.com> CIFS: Gracefully handle QueryInfo errors during open Harshad Shirwadkar <harshadshirwadkar(a)gmail.com> blk-wbt: fix performance regression in wbt scale_up/scale_down Steve MacLean <Steve.MacLean(a)microsoft.com> perf inject jit: Fix JIT_CODE_MOVE filename Ian Rogers <irogers(a)google.com> perf llvm: Don't access out-of-scope array Ard Biesheuvel <ard.biesheuvel(a)linaro.org> efivar/ssdt: Don't iterate over EFI vars if no SSDT override was specified David Frey <dpfrey(a)gmail.com> iio: light: opt3001: fix mutex unlock race Hans de Goede <hdegoede(a)redhat.com> iio: adc: axp288: Override TS pin bias current for some models Marco Felsch <m.felsch(a)pengutronix.de> iio: adc: ad799x: fix probe error handling Andreas Klinger <ak(a)it-klinger.de> iio: adc: hx711: fix bug in sampling of data Navid Emamdoost <navid.emamdoost(a)gmail.com> staging: vt6655: Fix memory leak in vt6655_probe Navid Emamdoost <navid.emamdoost(a)gmail.com> Staging: fbtft: fix memory leak in fbtft_framebuffer_alloc Bruce Chen <bruce.chen(a)unisoc.com> gpio: eic: sprd: Fix the incorrect EIC offset when toggling Alexander Usyskin <alexander.usyskin(a)intel.com> mei: avoid FW version request on Ibex Peak and earlier Tomas Winkler <tomas.winkler(a)intel.com> mei: me: add comet point (lake) LP device ids Johan Hovold <johan(a)kernel.org> USB: legousbtower: fix use-after-free on release Johan Hovold <johan(a)kernel.org> USB: legousbtower: fix open after failed reset request Johan Hovold <johan(a)kernel.org> USB: legousbtower: fix potential NULL-deref on disconnect Johan Hovold <johan(a)kernel.org> USB: legousbtower: fix deadlock on disconnect Johan Hovold <johan(a)kernel.org> USB: legousbtower: fix slab info leak at probe Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> usb: renesas_usbhs: gadget: Fix usb_ep_set_{halt,wedge}() behavior Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> usb: renesas_usbhs: gadget: Do not discard queues in usb_ep_set_{halt,wedge}() Jacky.Cao(a)sony.com <Jacky.Cao(a)sony.com> USB: dummy-hcd: fix power budget for SuperSpeed mode Johan Hovold <johan(a)kernel.org> USB: microtek: fix info-leak at probe Johan Hovold <johan(a)kernel.org> USB: usblcd: fix I/O after disconnect Johan Hovold <johan(a)kernel.org> USB: serial: fix runtime PM after driver unbind Reinhard Speyerer <rspmn(a)arcor.de> USB: serial: option: add support for Cinterion CLS8 devices Daniele Palmas <dnlplm(a)gmail.com> USB: serial: option: add Telit FN980 compositions Beni Mahler <beni.mahler(a)gmx.net> USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20 Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix NULL-derefs on open() and write() Randy Dunlap <rdunlap(a)infradead.org> serial: uartlite: fix exit path null pointer Johan Hovold <johan(a)kernel.org> USB: ldusb: fix NULL-derefs on driver unbind Johan Hovold <johan(a)kernel.org> USB: chaoskey: fix use-after-free on release Johan Hovold <johan(a)kernel.org> USB: usblp: fix runtime PM after driver unbind Johan Hovold <johan(a)kernel.org> USB: iowarrior: fix use-after-free after driver unbind Johan Hovold <johan(a)kernel.org> USB: iowarrior: fix use-after-free on release Johan Hovold <johan(a)kernel.org> USB: iowarrior: fix use-after-free on disconnect Johan Hovold <johan(a)kernel.org> USB: adutux: fix use-after-free on release Johan Hovold <johan(a)kernel.org> USB: adutux: fix NULL-derefs on disconnect Johan Hovold <johan(a)kernel.org> USB: adutux: fix use-after-free on disconnect Kai-Heng Feng <kai.heng.feng(a)canonical.com> xhci: Increase STS_SAVE timeout in xhci_suspend() Bill Kuzeja <William.Kuzeja(a)stratus.com> xhci: Prevent deadlock when xhci adapter breaks during init Rick Tseng <rtseng(a)nvidia.com> usb: xhci: wait for CNR controller not ready bit in xhci resume Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: Fix USB 3.1 capability detection on early xHCI 1.1 spec based hosts Jan Schmidt <jan(a)centricular.com> xhci: Check all endpoints for LPM timeout Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: Prevent device initiated U1/U2 link pm if exit latency is too long Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: Fix false warning message about wrong bounce buffer write length Johan Hovold <johan(a)kernel.org> USB: usb-skeleton: fix NULL-deref on disconnect Johan Hovold <johan(a)kernel.org> USB: usb-skeleton: fix runtime PM after driver unbind Johan Hovold <johan(a)kernel.org> USB: yurex: fix NULL-derefs on disconnect Alan Stern <stern(a)rowland.harvard.edu> USB: yurex: Don't retry on unexpected errors Bastien Nocera <hadess(a)hadess.net> USB: rio500: Remove Rio 500 kernel driver Icenowy Zheng <icenowy(a)aosc.io> f2fs: use EINVAL for superblock with invalid magic Will Deacon <will(a)kernel.org> panic: ensure preemption is disabled during panic() ------------- Diffstat: Documentation/usb/rio.txt | 138 -------- MAINTAINERS | 7 - Makefile | 4 +- arch/arm/configs/badge4_defconfig | 1 - arch/arm/configs/corgi_defconfig | 1 - arch/arm/configs/pxa_defconfig | 1 - arch/arm/configs/s3c2410_defconfig | 1 - arch/arm/configs/spitz_defconfig | 1 - arch/arm64/kernel/process.c | 32 +- arch/arm64/kernel/topology.c | 19 +- arch/mips/configs/mtx1_defconfig | 1 - arch/mips/configs/rm200_defconfig | 1 - arch/mips/include/uapi/asm/hwcap.h | 11 + arch/mips/kernel/cpu-probe.c | 33 ++ arch/mips/loongson64/Platform | 4 + arch/mips/vdso/Makefile | 1 + arch/x86/include/asm/mwait.h | 2 +- arch/x86/lib/delay.c | 4 +- block/blk-rq-qos.c | 14 +- block/blk-rq-qos.h | 4 +- block/blk-wbt.c | 6 +- drivers/acpi/pptt.c | 52 +++ drivers/firmware/efi/efi.c | 3 + drivers/firmware/google/vpd_decode.c | 2 +- drivers/gpio/gpio-eic-sprd.c | 7 +- drivers/gpio/gpiolib.c | 27 +- drivers/iio/adc/ad799x.c | 4 +- drivers/iio/adc/axp288_adc.c | 32 ++ drivers/iio/adc/hx711.c | 10 +- drivers/iio/adc/stm32-adc-core.c | 70 ++-- drivers/iio/adc/stm32-adc-core.h | 137 ++++++++ drivers/iio/adc/stm32-adc.c | 109 ------ drivers/iio/light/opt3001.c | 6 +- drivers/media/usb/stkwebcam/stk-webcam.c | 3 +- drivers/misc/mei/bus-fixup.c | 14 +- drivers/misc/mei/hw-me-regs.h | 3 + drivers/misc/mei/hw-me.c | 21 +- drivers/misc/mei/hw-me.h | 8 +- drivers/misc/mei/mei_dev.h | 4 + drivers/misc/mei/pci-me.c | 13 +- drivers/pci/controller/vmd.c | 16 +- drivers/staging/fbtft/fbtft-core.c | 7 +- drivers/staging/vt6655/device_main.c | 4 +- drivers/tty/serial/uartlite.c | 3 +- drivers/usb/class/usblp.c | 8 +- drivers/usb/gadget/udc/dummy_hcd.c | 3 +- drivers/usb/host/xhci-ring.c | 4 +- drivers/usb/host/xhci.c | 70 +++- drivers/usb/image/microtek.c | 4 + drivers/usb/misc/Kconfig | 10 - drivers/usb/misc/Makefile | 1 - drivers/usb/misc/adutux.c | 24 +- drivers/usb/misc/chaoskey.c | 5 +- drivers/usb/misc/iowarrior.c | 16 +- drivers/usb/misc/ldusb.c | 24 +- drivers/usb/misc/legousbtower.c | 58 ++-- drivers/usb/misc/rio500.c | 561 ------------------------------- drivers/usb/misc/rio500_usb.h | 20 -- drivers/usb/misc/usblcd.c | 33 +- drivers/usb/misc/yurex.c | 18 +- drivers/usb/renesas_usbhs/common.h | 1 + drivers/usb/renesas_usbhs/fifo.c | 2 +- drivers/usb/renesas_usbhs/fifo.h | 1 + drivers/usb/renesas_usbhs/mod_gadget.c | 18 +- drivers/usb/renesas_usbhs/pipe.c | 15 + drivers/usb/renesas_usbhs/pipe.h | 1 + drivers/usb/serial/ftdi_sio.c | 3 + drivers/usb/serial/ftdi_sio_ids.h | 9 + drivers/usb/serial/keyspan.c | 4 +- drivers/usb/serial/option.c | 11 + drivers/usb/serial/usb-serial.c | 5 +- drivers/usb/usb-skeleton.c | 15 +- fs/btrfs/ref-verify.c | 2 +- fs/btrfs/tree-log.c | 36 +- fs/cifs/dir.c | 8 +- fs/cifs/file.c | 33 +- fs/cifs/inode.c | 4 + fs/f2fs/super.c | 36 +- fs/libfs.c | 134 ++++---- fs/nfs/direct.c | 78 +++-- include/acpi/actbl2.h | 7 +- include/linux/acpi.h | 5 + include/linux/hwmon.h | 2 +- kernel/events/hw_breakpoint.c | 4 +- kernel/fork.c | 4 +- kernel/panic.c | 1 + kernel/trace/ftrace.c | 27 +- kernel/trace/trace.c | 17 +- kernel/trace/trace_hwlat.c | 4 +- mm/vmpressure.c | 20 +- tools/perf/util/jitdump.c | 6 +- tools/perf/util/llvm-utils.c | 6 +- 92 files changed, 967 insertions(+), 1252 deletions(-)

4 years, 3 months

13
103
0 0

[PATCH] drm: avoid spurious EBUSY due to nonblocking atomic modesets

by Daniel Vetter

When doing an atomic modeset with ALLOW_MODESET drivers are allowed to pull in arbitrary other resources, including CRTCs (e.g. when reconfiguring global resources). But in nonblocking mode userspace has then no idea this happened, which can lead to spurious EBUSY calls, both: - when that other CRTC is currently busy doing a page_flip the ALLOW_MODESET commit can fail with an EBUSY - on the other CRTC a normal atomic flip can fail with EBUSY because of the additional commit inserted by the kernel without userspace's knowledge For blocking commits this isn't a problem, because everyone else will just block until all the CRTC are reconfigured. Only thing userspace can notice is the dropped frames without any reason for why frames got dropped. Consensus is that we need new uapi to handle this properly, but no one has any idea what exactly the new uapi should look like. As a stop-gap plug this problem by demoting nonblocking commits which might cause issues by including CRTCs not in the original request to blocking commits. v2: Add comments and a WARN_ON to enforce this only when allowed - we don't want to silently convert page flips into blocking plane updates just because the driver is buggy. References: https://lists.freedesktop.org/archives/dri-devel/2018-July/182281.html Bugzilla: https://gitlab.freedesktop.org/wayland/weston/issues/24#note_9568 Cc: Daniel Stone <daniel(a)fooishbar.org> Cc: Pekka Paalanen <pekka.paalanen(a)collabora.co.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter(a)intel.com> --- drivers/gpu/drm/drm_atomic.c | 34 +++++++++++++++++++++++++++++++--- 1 file changed, 31 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index d5cefb1cb2a2..058512f14772 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -2018,15 +2018,43 @@ EXPORT_SYMBOL(drm_atomic_commit); int drm_atomic_nonblocking_commit(struct drm_atomic_state *state) { struct drm_mode_config *config = &state->dev->mode_config; - int ret; + unsigned requested_crtc = 0; + unsigned affected_crtc = 0; + struct drm_crtc *crtc; + struct drm_crtc_state *crtc_state; + bool nonblocking = true; + int ret, i; + + /* + * For commits that allow modesets drivers can add other CRTCs to the + * atomic commit, e.g. when they need to reallocate global resources. + * + * But when userspace also requests a nonblocking commit then userspace + * cannot know that the commit affects other CRTCs, which can result in + * spurious EBUSY failures. Until we have better uapi plug this by + * demoting such commits to blocking mode. + */ + for_each_new_crtc_in_state(state, crtc, crtc_state, i) + requested_crtc |= drm_crtc_mask(crtc); ret = drm_atomic_check_only(state); if (ret) return ret; - DRM_DEBUG_ATOMIC("committing %p nonblocking\n", state); + for_each_new_crtc_in_state(state, crtc, crtc_state, i) + affected_crtc |= drm_crtc_mask(crtc); + + if (affected_crtc != requested_crtc) { + /* adding other CRTC is only allowed for modeset commits */ + WARN_ON(state->allow_modeset); + + DRM_DEBUG_ATOMIC("demoting %p to blocking mode to avoid EBUSY\n", state); + nonblocking = false; + } else { + DRM_DEBUG_ATOMIC("committing %p nonblocking\n", state); + } - return config->funcs->atomic_commit(state->dev, state, true); + return config->funcs->atomic_commit(state->dev, state, nonblocking); } EXPORT_SYMBOL(drm_atomic_nonblocking_commit); -- 2.18.0

4 years, 3 months

3
11
0 0

[PATCH] [Patch v2] usbtv: Fix refcounting mixup

by Oliver Neukum

The premature free in the error path is blocked by V4L refcounting, not USB refcounting. Thanks to Ben Hutchings for review. [v2] corrected attributions Signed-off-by: Oliver Neukum <oneukum(a)suse.com> Fixes: 50e704453553 ("media: usbtv: prevent double free in error case") CC: stable(a)vger.kernel.org Reported-by: Ben Hutchings <ben.hutchings(a)codethink.co.uk> --- drivers/media/usb/usbtv/usbtv-core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c index 5095c380b2c1..4a03c4d66314 100644 --- a/drivers/media/usb/usbtv/usbtv-core.c +++ b/drivers/media/usb/usbtv/usbtv-core.c @@ -113,7 +113,8 @@ static int usbtv_probe(struct usb_interface *intf, usbtv_audio_fail: /* we must not free at this point */ - usb_get_dev(usbtv->udev); + v4l2_device_get(&usbtv->v4l2_dev); + /* this will undo the v4l2_device_get() */ usbtv_video_free(usbtv); usbtv_video_fail: -- 2.13.6

4 years, 3 months

3
7
0 0

[PATCH] cxl: Rework error message for incompatible slots

by Frederic Barrat

Improve the error message shown if a capi adapter is plugged on a capi-incompatible slot directly under the PHB (no intermediate switch). Fixes: 5632874311db ("cxl: Add support for POWER9 DD2") Cc: stable(a)vger.kernel.org # 4.14+ Signed-off-by: Frederic Barrat <fbarrat(a)linux.ibm.com> --- drivers/misc/cxl/pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c index 25a9dd9c0c1b..2ba899f5659f 100644 --- a/drivers/misc/cxl/pci.c +++ b/drivers/misc/cxl/pci.c @@ -393,8 +393,8 @@ int cxl_calc_capp_routing(struct pci_dev *dev, u64 *chipid, *capp_unit_id = get_capp_unit_id(np, *phb_index); of_node_put(np); if (!*capp_unit_id) { - pr_err("cxl: invalid capp unit id (phb_index: %d)\n", - *phb_index); + pr_err("cxl: No capp unit found for PHB[%lld,%d]. Make sure the adapter is on a capi-compatible slot\n", + *chipid, *phb_index); return -ENODEV; } -- 2.25.1

4 years, 3 months

3
3
0 0

[PATCH AUTOSEL 4.14 01/33] iommu/arm-smmu: Free context bitmap in the err path of arm_smmu_init_domain_context

by Sasha Levin

From: Liu Xiang <liuxiang_1999(a)126.com> [ Upstream commit 6db7bfb431220d78e34d2d0afdb7c12683323588 ] When alloc_io_pgtable_ops is failed, context bitmap which is just allocated by __arm_smmu_alloc_bitmap should be freed to release the resource. Signed-off-by: Liu Xiang <liuxiang_1999(a)126.com> Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/iommu/arm-smmu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c index c38cf03c099ed..f97c26c90c41f 100644 --- a/drivers/iommu/arm-smmu.c +++ b/drivers/iommu/arm-smmu.c @@ -922,6 +922,7 @@ static int arm_smmu_init_domain_context(struct iommu_domain *domain, return 0; out_clear_smmu: + __arm_smmu_free_bitmap(smmu->context_map, cfg->cbndx); smmu_domain->smmu = NULL; out_unlock: mutex_unlock(&smmu_domain->init_mutex); -- 2.20.1

4 years, 3 months

3
36
0 0

Re: [PATCH 1/2] mm: memcontrol: flush percpu vmstats before releasing memcg

by Roman Gushchin

On Tue, Aug 13, 2019 at 02:27:52PM -0700, Andrew Morton wrote: > On Mon, 12 Aug 2019 15:29:10 -0700 Roman Gushchin <guro(a)fb.com> wrote: > > > Percpu caching of local vmstats with the conditional propagation > > by the cgroup tree leads to an accumulation of errors on non-leaf > > levels. > > > > Let's imagine two nested memory cgroups A and A/B. Say, a process > > belonging to A/B allocates 100 pagecache pages on the CPU 0. > > The percpu cache will spill 3 times, so that 32*3=96 pages will be > > accounted to A/B and A atomic vmstat counters, 4 pages will remain > > in the percpu cache. > > > > Imagine A/B is nearby memory.max, so that every following allocation > > triggers a direct reclaim on the local CPU. Say, each such attempt > > will free 16 pages on a new cpu. That means every percpu cache will > > have -16 pages, except the first one, which will have 4 - 16 = -12. > > A/B and A atomic counters will not be touched at all. > > > > Now a user removes A/B. All percpu caches are freed and corresponding > > vmstat numbers are forgotten. A has 96 pages more than expected. > > > > As memory cgroups are created and destroyed, errors do accumulate. > > Even 1-2 pages differences can accumulate into large numbers. > > > > To fix this issue let's accumulate and propagate percpu vmstat > > values before releasing the memory cgroup. At this point these > > numbers are stable and cannot be changed. > > > > Since on cpu hotplug we do flush percpu vmstats anyway, we can > > iterate only over online cpus. > > > > Fixes: 42a300353577 ("mm: memcontrol: fix recursive statistics correctness & scalabilty") > > Is this not serious enough for a cc:stable? I hope the "Fixes" tag will work, but yeah, my bad, cc:stable is definitely a good idea here. Added stable@ to cc. Thanks!

4 years, 3 months

2
1
0 0

[PATCH 1/2] i2c: i801: Fix runtime PM

by Jarkko Nikula

Commit 9c8088c7988 ("i2c: i801: Don't restore config registers on runtime PM") nullified the runtime PM suspend/resume callback pointers while keeping the runtime PM enabled. This causes that device stays in D0 power state and sysfs /sys/bus/pci/devices/.../power/runtime_status shows "error" when runtime PM framework attempts to autosuspend the device. This is due PCI bus runtime PM which checks for driver runtime PM callbacks and returns with -ENOSYS if they are not set. Fix this by having a shared dummy runtime PM callback that returns with success. Fixes: a9c8088c7988 ("i2c: i801: Don't restore config registers on runtime PM") Reported-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Jarkko Nikula <jarkko.nikula(a)linux.intel.com> --- drivers/i2c/busses/i2c-i801.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c index aa726607645e..3747484c2669 100644 --- a/drivers/i2c/busses/i2c-i801.c +++ b/drivers/i2c/busses/i2c-i801.c @@ -1731,7 +1731,20 @@ static int i801_resume(struct device *dev) } #endif -static SIMPLE_DEV_PM_OPS(i801_pm_ops, i801_suspend, i801_resume); +static int __maybe_unused i801_runtime_nop(struct device *dev) +{ + /* + * PCI core expects runtime PM suspend/resume callbacks return + * successfully before really suspending/resuming the device. + * Have a shared dummy callback that returns with success. + */ + return 0; +} + +static const struct dev_pm_ops i801_pm_ops = { + SET_SYSTEM_SLEEP_PM_OPS(i801_suspend, i801_resume) + SET_RUNTIME_PM_OPS(i801_runtime_nop, i801_runtime_nop, NULL) +}; static struct pci_driver i801_driver = { .name = "i801_smbus", -- 2.18.0

4 years, 3 months

5
6
0 0

[PATCH AUTOSEL 5.4 01/58] ACPI: watchdog: Allow disabling WDAT at boot

by Sasha Levin

From: Jean Delvare <jdelvare(a)suse.de> [ Upstream commit 3f9e12e0df012c4a9a7fd7eb0d3ae69b459d6b2c ] In case the WDAT interface is broken, give the user an option to ignore it to let a native driver bind to the watchdog device instead. Signed-off-by: Jean Delvare <jdelvare(a)suse.de> Acked-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- Documentation/admin-guide/kernel-parameters.txt | 4 ++++ drivers/acpi/acpi_watchdog.c | 12 +++++++++++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 5594c8bf1dcd4..b5c933fa971f3 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -136,6 +136,10 @@ dynamic table installation which will install SSDT tables to /sys/firmware/acpi/tables/dynamic. + acpi_no_watchdog [HW,ACPI,WDT] + Ignore the ACPI-based watchdog interface (WDAT) and let + a native driver control the watchdog device instead. + acpi_rsdp= [ACPI,EFI,KEXEC] Pass the RSDP address to the kernel, mostly used on machines running EFI runtime service to boot the diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c index b5516b04ffc07..ab6e434b4cee0 100644 --- a/drivers/acpi/acpi_watchdog.c +++ b/drivers/acpi/acpi_watchdog.c @@ -55,12 +55,14 @@ static bool acpi_watchdog_uses_rtc(const struct acpi_table_wdat *wdat) } #endif +static bool acpi_no_watchdog; + static const struct acpi_table_wdat *acpi_watchdog_get_wdat(void) { const struct acpi_table_wdat *wdat = NULL; acpi_status status; - if (acpi_disabled) + if (acpi_disabled || acpi_no_watchdog) return NULL; status = acpi_get_table(ACPI_SIG_WDAT, 0, @@ -88,6 +90,14 @@ bool acpi_has_watchdog(void) } EXPORT_SYMBOL_GPL(acpi_has_watchdog); +/* ACPI watchdog can be disabled on boot command line */ +static int __init disable_acpi_watchdog(char *str) +{ + acpi_no_watchdog = true; + return 1; +} +__setup("acpi_no_watchdog", disable_acpi_watchdog); + void __init acpi_watchdog_init(void) { const struct acpi_wdat_entry *entries; -- 2.20.1

4 years, 3 months

2
42
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror April 2020