The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 74d6a5d5662975aed7f25952f62efbb6f6dadd29 Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38(a)huawei.com>
Date: Fri, 12 Jun 2020 17:08:33 +0800
Subject: [PATCH] 9p/trans_fd: Fix concurrency del of req_list in
p9_fd_cancelled/p9_read_work
p9_read_work and p9_fd_cancelled may be called concurrently.
In some cases, req->req_list may be deleted by both p9_read_work
and p9_fd_cancelled.
We can fix it by ignoring replies associated with a cancelled
request and ignoring cancelled request if message has been received
before lock.
Link: http://lkml.kernel.org/r/20200612090833.36149-1-wanghai38@huawei.com
Fixes: 60ff779c4abb ("9p: client: remove unused code and any reference to "cancelled" function")
Cc: <stable(a)vger.kernel.org> # v3.12+
Reported-by: syzbot+77a25acfa0382e06ab23(a)syzkaller.appspotmail.com
Signed-off-by: Wang Hai <wanghai38(a)huawei.com>
Signed-off-by: Dominique Martinet <asmadeus(a)codewreck.org>
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 9c9196d30a59..12ecacf0c55f 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -362,6 +362,10 @@ static void p9_read_work(struct work_struct *work)
if (m->rreq->status == REQ_STATUS_SENT) {
list_del(&m->rreq->req_list);
p9_client_cb(m->client, m->rreq, REQ_STATUS_RCVD);
+ } else if (m->rreq->status == REQ_STATUS_FLSHD) {
+ /* Ignore replies associated with a cancelled request. */
+ p9_debug(P9_DEBUG_TRANS,
+ "Ignore replies associated with a cancelled request\n");
} else {
spin_unlock(&m->client->lock);
p9_debug(P9_DEBUG_ERROR,
@@ -703,11 +707,20 @@ static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req)
{
p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req);
+ spin_lock(&client->lock);
+ /* Ignore cancelled request if message has been received
+ * before lock.
+ */
+ if (req->status == REQ_STATUS_RCVD) {
+ spin_unlock(&client->lock);
+ return 0;
+ }
+
/* we haven't received a response for oldreq,
* remove it from the list.
*/
- spin_lock(&client->lock);
list_del(&req->req_list);
+ req->status = REQ_STATUS_FLSHD;
spin_unlock(&client->lock);
p9_req_put(req);
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 74d6a5d5662975aed7f25952f62efbb6f6dadd29 Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38(a)huawei.com>
Date: Fri, 12 Jun 2020 17:08:33 +0800
Subject: [PATCH] 9p/trans_fd: Fix concurrency del of req_list in
p9_fd_cancelled/p9_read_work
p9_read_work and p9_fd_cancelled may be called concurrently.
In some cases, req->req_list may be deleted by both p9_read_work
and p9_fd_cancelled.
We can fix it by ignoring replies associated with a cancelled
request and ignoring cancelled request if message has been received
before lock.
Link: http://lkml.kernel.org/r/20200612090833.36149-1-wanghai38@huawei.com
Fixes: 60ff779c4abb ("9p: client: remove unused code and any reference to "cancelled" function")
Cc: <stable(a)vger.kernel.org> # v3.12+
Reported-by: syzbot+77a25acfa0382e06ab23(a)syzkaller.appspotmail.com
Signed-off-by: Wang Hai <wanghai38(a)huawei.com>
Signed-off-by: Dominique Martinet <asmadeus(a)codewreck.org>
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 9c9196d30a59..12ecacf0c55f 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -362,6 +362,10 @@ static void p9_read_work(struct work_struct *work)
if (m->rreq->status == REQ_STATUS_SENT) {
list_del(&m->rreq->req_list);
p9_client_cb(m->client, m->rreq, REQ_STATUS_RCVD);
+ } else if (m->rreq->status == REQ_STATUS_FLSHD) {
+ /* Ignore replies associated with a cancelled request. */
+ p9_debug(P9_DEBUG_TRANS,
+ "Ignore replies associated with a cancelled request\n");
} else {
spin_unlock(&m->client->lock);
p9_debug(P9_DEBUG_ERROR,
@@ -703,11 +707,20 @@ static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req)
{
p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req);
+ spin_lock(&client->lock);
+ /* Ignore cancelled request if message has been received
+ * before lock.
+ */
+ if (req->status == REQ_STATUS_RCVD) {
+ spin_unlock(&client->lock);
+ return 0;
+ }
+
/* we haven't received a response for oldreq,
* remove it from the list.
*/
- spin_lock(&client->lock);
list_del(&req->req_list);
+ req->status = REQ_STATUS_FLSHD;
spin_unlock(&client->lock);
p9_req_put(req);
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 74d6a5d5662975aed7f25952f62efbb6f6dadd29 Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38(a)huawei.com>
Date: Fri, 12 Jun 2020 17:08:33 +0800
Subject: [PATCH] 9p/trans_fd: Fix concurrency del of req_list in
p9_fd_cancelled/p9_read_work
p9_read_work and p9_fd_cancelled may be called concurrently.
In some cases, req->req_list may be deleted by both p9_read_work
and p9_fd_cancelled.
We can fix it by ignoring replies associated with a cancelled
request and ignoring cancelled request if message has been received
before lock.
Link: http://lkml.kernel.org/r/20200612090833.36149-1-wanghai38@huawei.com
Fixes: 60ff779c4abb ("9p: client: remove unused code and any reference to "cancelled" function")
Cc: <stable(a)vger.kernel.org> # v3.12+
Reported-by: syzbot+77a25acfa0382e06ab23(a)syzkaller.appspotmail.com
Signed-off-by: Wang Hai <wanghai38(a)huawei.com>
Signed-off-by: Dominique Martinet <asmadeus(a)codewreck.org>
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 9c9196d30a59..12ecacf0c55f 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -362,6 +362,10 @@ static void p9_read_work(struct work_struct *work)
if (m->rreq->status == REQ_STATUS_SENT) {
list_del(&m->rreq->req_list);
p9_client_cb(m->client, m->rreq, REQ_STATUS_RCVD);
+ } else if (m->rreq->status == REQ_STATUS_FLSHD) {
+ /* Ignore replies associated with a cancelled request. */
+ p9_debug(P9_DEBUG_TRANS,
+ "Ignore replies associated with a cancelled request\n");
} else {
spin_unlock(&m->client->lock);
p9_debug(P9_DEBUG_ERROR,
@@ -703,11 +707,20 @@ static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req)
{
p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req);
+ spin_lock(&client->lock);
+ /* Ignore cancelled request if message has been received
+ * before lock.
+ */
+ if (req->status == REQ_STATUS_RCVD) {
+ spin_unlock(&client->lock);
+ return 0;
+ }
+
/* we haven't received a response for oldreq,
* remove it from the list.
*/
- spin_lock(&client->lock);
list_del(&req->req_list);
+ req->status = REQ_STATUS_FLSHD;
spin_unlock(&client->lock);
p9_req_put(req);
Hello,
The commit fixed by this patch[1] was merged in v5.1 and this patch was merged
in the mainline in v5.7 (5c72feee3e45b40a3c96c7145ec422899d0e8964). Thus, the
issue affects [v5.1, v5.6]. I was also able to reproduce the issue and confirm
the fix works on v5.4 based kernels.
However, I couldn't find this fix in neither latest stable/linux-5.4.y, nor
stable-queue/master. Could you please put this patch in the queue?
[1] https://lore.kernel.org/linux-mm/20200212101356.30759-1-jack@suse.cz/
Thanks,
SeongJae Park
On Wed, 12 Feb 2020 11:13:56 +0100 Jan Kara <jack(a)suse.cz> wrote:
> When handling a page fault, we drop mmap_sem to start async readahead so
> that we don't block on IO submission with mmap_sem held. However
> there's no point to drop mmap_sem in case readahead is disabled. Handle
> that case to avoid pointless dropping of mmap_sem and retrying the
> fault. This was actually reported to block mlockall(MCL_CURRENT)
> indefinitely.
>
> Fixes: 6b4c9f446981 ("filemap: drop the mmap_sem for all blocking operations")
> Reported-by: Minchan Kim <minchan(a)kernel.org>
> Reported-by: Robert Stupp <snazy(a)gmx.de>
> Signed-off-by: Jan Kara <jack(a)suse.cz>
> ---
> mm/filemap.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> Andrew, could you please pick up this patch? Minchan also tripped over this
> bug...
>
> diff --git a/mm/filemap.c b/mm/filemap.c
> index 1146fcfa3215..3d39c437b07e 100644
> --- a/mm/filemap.c
> +++ b/mm/filemap.c
> @@ -2458,7 +2458,7 @@ static struct file *do_async_mmap_readahead(struct vm_fault *vmf,
> pgoff_t offset = vmf->pgoff;
>
> /* If we don't want any read-ahead, don't bother */
> - if (vmf->vma->vm_flags & VM_RAND_READ)
> + if (vmf->vma->vm_flags & VM_RAND_READ || !ra->ra_pages)
> return fpin;
> if (ra->mmap_miss > 0)
> ra->mmap_miss--;
> --
> 2.16.4
I would like to nominate the following commit, now in mainline, for
stable. This fixes an issue exposed by commit 66ff14e59e8a ("PCI/ASPM:
Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges") and so should go
into all stable branches which that was backported to (which appears
to be all of the currently maintained releases).
commit b361663c5a40c8bc758b7f7f2239f7a192180e7c
Author: Robert Hancock <hancockrwd(a)gmail.com>
Date: Tue Jul 21 20:18:03 2020 -0600
PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge
Recently ASPM handling was changed to allow ASPM on PCIe-to-PCI/PCI-X
bridges. Unfortunately the ASMedia ASM1083/1085 PCIe to PCI bridge device
doesn't seem to function properly with ASPM enabled. On an Asus PRIME
H270-PRO motherboard, it causes errors like these:
pcieport 0000:00:1c.0: AER: PCIe Bus Error: severity=Corrected,
type=Data Link Layer, (Transmitter ID)
pcieport 0000:00:1c.0: AER: device [8086:a292] error
status/mask=00003000/00002000
pcieport 0000:00:1c.0: AER: [12] Timeout
pcieport 0000:00:1c.0: AER: Corrected error received: 0000:00:1c.0
pcieport 0000:00:1c.0: AER: can't find device of ID00e0
In addition to flooding the kernel log, this also causes the machine to
wake up immediately after suspend is initiated.
The device advertises ASPM L0s and L1 support in the Link Capabilities
register, but the ASMedia web page for ASM1083 [1] claims "No PCIe ASPM
support".
Windows 10 (build 2004) enables L0s, but it also logs correctable PCIe
errors.
Add a quirk to disable ASPM for this device.
[1] https://www.asmedia.com.tw/eng/e_show_products.php?cate_index=169&item=114
[bhelgaas: commit log]
Fixes: 66ff14e59e8a ("PCI/ASPM: Allow ASPM on links to
PCIe-to-PCI/PCI-X Bridges")
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=208667
Link: https://lore.kernel.org/r/20200722021803.17958-1-hancockrwd@gmail.com
Signed-off-by: Robert Hancock <hancockrwd(a)gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com>
From: Abhishek Ambure <aambure(a)codeaurora.org>
commit cc78dc3b790619aa05f22a86a9152986bd73698c upstream.
This commit fixes the regression caused by
commit 6ddc3860a566 ("ath10k: add support for ack rssi value of data tx packets")
in linux-5.4.y branch.
ath10k_is_rssi_enable() always returns 0 for QCA9984 and this will cause
the ppdu_info_offset to hold invalid value in ath10k_htt_rx_tx_compl_ind().
This leads to CE corruption for HTC endpoints to cause WMI command failures
with insufficient HTC credits. Below warnings are seen due to beacon
command failure in QCA9984.
[ 675.939638] ath10k_pci 0000:03:00.0: SWBA overrun on vdev 0, skipped old beacon
[ 675.947828] ath10k_pci 0000:04:00.0: SWBA overrun on vdev 1, skipped old beacon
Tested HW: QCA9984
Tested FW: 10.4-3.10-00047
Tested Kernel version: 5.4.22
Fixes: 6ddc3860a566 ("ath10k: add support for ack rssi value of data tx packets")
Signed-off-by: Abhishek Ambure <aambure(a)codeaurora.org>
Signed-off-by: Balaji Pothunoori <bpothuno(a)codeaurora.org>
[kvalo(a)codeaurora.org: improve commit log]
Signed-off-by: Kalle Valo <kvalo(a)codeaurora.org>
Signed-off-by: Sathishkumar Muruganandam <murugana(a)codeaurora.org>
---
drivers/net/wireless/ath/ath10k/hw.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/ath/ath10k/hw.c b/drivers/net/wireless/ath/ath10k/hw.c
index c415e971735b..004af89a02b8 100644
--- a/drivers/net/wireless/ath/ath10k/hw.c
+++ b/drivers/net/wireless/ath/ath10k/hw.c
@@ -1145,6 +1145,7 @@ static bool ath10k_qca99x0_rx_desc_msdu_limit_error(struct htt_rx_desc *rxd)
const struct ath10k_hw_ops qca99x0_ops = {
.rx_desc_get_l3_pad_bytes = ath10k_qca99x0_rx_desc_get_l3_pad_bytes,
.rx_desc_get_msdu_limit_error = ath10k_qca99x0_rx_desc_msdu_limit_error,
+ .is_rssi_enable = ath10k_htt_tx_rssi_enable,
};
const struct ath10k_hw_ops qca6174_ops = {
--
2.17.1