August 2020 - Linux-stable-mirror

[merged] fs-minix-check-return-value-of-sb_getblk.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: fs/minix: check return value of sb_getblk() has been removed from the -mm tree. Its filename was fs-minix-check-return-value-of-sb_getblk.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Eric Biggers <ebiggers(a)google.com> Subject: fs/minix: check return value of sb_getblk() Patch series "fs/minix: fix syzbot bugs and set s_maxbytes". This series fixes all syzbot bugs in the minix filesystem: KASAN: null-ptr-deref Write in get_block KASAN: use-after-free Write in get_block KASAN: use-after-free Read in get_block WARNING in inc_nlink KMSAN: uninit-value in get_block WARNING in drop_nlink It also fixes the minix filesystem to set s_maxbytes correctly, so that userspace sees the correct behavior when exceeding the max file size. This patch (of 6): sb_getblk() can fail, so check its return value. This fixes a NULL pointer dereference. Originally from Qiujun Huang. Link: http://lkml.kernel.org/r/20200628060846.682158-1-ebiggers@kernel.org Link: http://lkml.kernel.org/r/20200628060846.682158-2-ebiggers@kernel.org Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Biggers <ebiggers(a)google.com> Reported-by: syzbot+4a88b2b9dc280f47baf4(a)syzkaller.appspotmail.com Cc: Qiujun Huang <anenbupt(a)gmail.com> Cc: Alexander Viro <viro(a)zeniv.linux.org.uk> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/minix/itree_common.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) --- a/fs/minix/itree_common.c~fs-minix-check-return-value-of-sb_getblk +++ a/fs/minix/itree_common.c @@ -75,6 +75,7 @@ static int alloc_branch(struct inode *in int n = 0; int i; int parent = minix_new_block(inode); + int err = -ENOSPC; branch[0].key = cpu_to_block(parent); if (parent) for (n = 1; n < num; n++) { @@ -85,6 +86,11 @@ static int alloc_branch(struct inode *in break; branch[n].key = cpu_to_block(nr); bh = sb_getblk(inode->i_sb, parent); + if (!bh) { + minix_free_block(inode, nr); + err = -ENOMEM; + break; + } lock_buffer(bh); memset(bh->b_data, 0, bh->b_size); branch[n].bh = bh; @@ -103,7 +109,7 @@ static int alloc_branch(struct inode *in bforget(branch[i].bh); for (i = 0; i < n; i++) minix_free_block(inode, block_to_cpu(branch[i].key)); - return -ENOSPC; + return err; } static inline int splice_branch(struct inode *inode, _ Patches currently in -mm which might be from ebiggers(a)google.com are

4 years, 5 months

1
0
0 0

[merged] mm-memory_hotplug-fix-unpaired-mem_hotplug_begin-done.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm/memory_hotplug: fix unpaired mem_hotplug_begin/done has been removed from the -mm tree. Its filename was mm-memory_hotplug-fix-unpaired-mem_hotplug_begin-done.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Jia He <justin.he(a)arm.com> Subject: mm/memory_hotplug: fix unpaired mem_hotplug_begin/done When check_memblock_offlined_cb() returns failed rc(e.g. the memblock is online at that time), mem_hotplug_begin/done is unpaired in such case. Therefore a warning: Call Trace: percpu_up_write+0x33/0x40 try_remove_memory+0x66/0x120 ? _cond_resched+0x19/0x30 remove_memory+0x2b/0x40 dev_dax_kmem_remove+0x36/0x72 [kmem] device_release_driver_internal+0xf0/0x1c0 device_release_driver+0x12/0x20 bus_remove_device+0xe1/0x150 device_del+0x17b/0x3e0 unregister_dev_dax+0x29/0x60 devm_action_release+0x15/0x20 release_nodes+0x19a/0x1e0 devres_release_all+0x3f/0x50 device_release_driver_internal+0x100/0x1c0 driver_detach+0x4c/0x8f bus_remove_driver+0x5c/0xd0 driver_unregister+0x31/0x50 dax_pmem_exit+0x10/0xfe0 [dax_pmem] Link: http://lkml.kernel.org/r/20200710031619.18762-3-justin.he@arm.com Fixes: f1037ec0cc8a ("mm/memory_hotplug: fix remove_memory() lockdep splat") Signed-off-by: Jia He <justin.he(a)arm.com> Reviewed-by: David Hildenbrand <david(a)redhat.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Acked-by: Dan Williams <dan.j.williams(a)intel.com> Cc: <stable(a)vger.kernel.org> [5.6+] Cc: Andy Lutomirski <luto(a)kernel.org> Cc: Baoquan He <bhe(a)redhat.com> Cc: Borislav Petkov <bp(a)alien8.de> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Chuhong Yuan <hslester96(a)gmail.com> Cc: Dave Hansen <dave.hansen(a)linux.intel.com> Cc: Dave Jiang <dave.jiang(a)intel.com> Cc: Fenghua Yu <fenghua.yu(a)intel.com> Cc: "H. Peter Anvin" <hpa(a)zytor.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Jonathan Cameron <Jonathan.Cameron(a)Huawei.com> Cc: Kaly Xin <Kaly.Xin(a)arm.com> Cc: Logan Gunthorpe <logang(a)deltatee.com> Cc: Masahiro Yamada <masahiroy(a)kernel.org> Cc: Mike Rapoport <rppt(a)linux.ibm.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Rich Felker <dalias(a)libc.org> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: Tony Luck <tony.luck(a)intel.com> Cc: Vishal Verma <vishal.l.verma(a)intel.com> Cc: Will Deacon <will(a)kernel.org> Cc: Yoshinori Sato <ysato(a)users.sourceforge.jp> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/memory_hotplug.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/mm/memory_hotplug.c~mm-memory_hotplug-fix-unpaired-mem_hotplug_begin-done +++ a/mm/memory_hotplug.c @@ -1757,7 +1757,7 @@ static int __ref try_remove_memory(int n */ rc = walk_memory_blocks(start, size, NULL, check_memblock_offlined_cb); if (rc) - goto done; + return rc; /* remove memmap entry */ firmware_map_remove(start, start + size, "System RAM"); @@ -1781,9 +1781,8 @@ static int __ref try_remove_memory(int n try_offline_node(nid); -done: mem_hotplug_done(); - return rc; + return 0; } /** _ Patches currently in -mm which might be from justin.he(a)arm.com are

4 years, 5 months

1
0
0 0

[merged] cma-dont-quit-at-first-error-when-activating-reserved-areas.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: cma: don't quit at first error when activating reserved areas has been removed from the -mm tree. Its filename was cma-dont-quit-at-first-error-when-activating-reserved-areas.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Mike Kravetz <mike.kravetz(a)oracle.com> Subject: cma: don't quit at first error when activating reserved areas The routine cma_init_reserved_areas is designed to activate all reserved cma areas. It quits when it first encounters an error. This can leave some areas in a state where they are reserved but not activated. There is no feedback to code which performed the reservation. Attempting to allocate memory from areas in such a state will result in a BUG. Modify cma_init_reserved_areas to always attempt to activate all areas. The called routine, cma_activate_area is responsible for leaving the area in a valid state. No one is making active use of returned error codes, so change the routine to void. How to reproduce: This example uses kernelcore, hugetlb and cma as an easy way to reproduce. However, this is a more general cma issue. Two node x86 VM 16GB total, 8GB per node Kernel command line parameters, kernelcore=4G hugetlb_cma=8G Related boot time messages, hugetlb_cma: reserve 8192 MiB, up to 4096 MiB per node cma: Reserved 4096 MiB at 0x0000000100000000 hugetlb_cma: reserved 4096 MiB on node 0 cma: Reserved 4096 MiB at 0x0000000300000000 hugetlb_cma: reserved 4096 MiB on node 1 cma: CMA area hugetlb could not be activated # echo 8 > /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI ... Call Trace: bitmap_find_next_zero_area_off+0x51/0x90 cma_alloc+0x1a5/0x310 alloc_fresh_huge_page+0x78/0x1a0 alloc_pool_huge_page+0x6f/0xf0 set_max_huge_pages+0x10c/0x250 nr_hugepages_store_common+0x92/0x120 ? __kmalloc+0x171/0x270 kernfs_fop_write+0xc1/0x1a0 vfs_write+0xc7/0x1f0 ksys_write+0x5f/0xe0 do_syscall_64+0x4d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Link: http://lkml.kernel.org/r/20200730163123.6451-1-mike.kravetz@oracle.com Fixes: c64be2bb1c6e ("drivers: add Contiguous Memory Allocator") Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com> Reviewed-by: Roman Gushchin <guro(a)fb.com> Acked-by: Barry Song <song.bao.hua(a)hisilicon.com> Cc: Marek Szyprowski <m.szyprowski(a)samsung.com> Cc: Michal Nazarewicz <mina86(a)mina86.com> Cc: Kyungmin Park <kyungmin.park(a)samsung.com> Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/cma.c | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-) --- a/mm/cma.c~cma-dont-quit-at-first-error-when-activating-reserved-areas +++ a/mm/cma.c @@ -93,17 +93,15 @@ static void cma_clear_bitmap(struct cma mutex_unlock(&cma->lock); } -static int __init cma_activate_area(struct cma *cma) +static void __init cma_activate_area(struct cma *cma) { unsigned long base_pfn = cma->base_pfn, pfn = base_pfn; unsigned i = cma->count >> pageblock_order; struct zone *zone; cma->bitmap = bitmap_zalloc(cma_bitmap_maxno(cma), GFP_KERNEL); - if (!cma->bitmap) { - cma->count = 0; - return -ENOMEM; - } + if (!cma->bitmap) + goto out_error; WARN_ON_ONCE(!pfn_valid(pfn)); zone = page_zone(pfn_to_page(pfn)); @@ -133,25 +131,22 @@ static int __init cma_activate_area(stru spin_lock_init(&cma->mem_head_lock); #endif - return 0; + return; not_in_zone: - pr_err("CMA area %s could not be activated\n", cma->name); bitmap_free(cma->bitmap); +out_error: cma->count = 0; - return -EINVAL; + pr_err("CMA area %s could not be activated\n", cma->name); + return; } static int __init cma_init_reserved_areas(void) { int i; - for (i = 0; i < cma_area_count; i++) { - int ret = cma_activate_area(&cma_areas[i]); - - if (ret) - return ret; - } + for (i = 0; i < cma_area_count; i++) + cma_activate_area(&cma_areas[i]); return 0; } _ Patches currently in -mm which might be from mike.kravetz(a)oracle.com are

4 years, 5 months

1
0
0 0

[merged] hugetlbfs-remove-call-to-huge_pte_alloc-without-i_mmap_rwsem.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: hugetlbfs: remove call to huge_pte_alloc without i_mmap_rwsem has been removed from the -mm tree. Its filename was hugetlbfs-remove-call-to-huge_pte_alloc-without-i_mmap_rwsem.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Mike Kravetz <mike.kravetz(a)oracle.com> Subject: hugetlbfs: remove call to huge_pte_alloc without i_mmap_rwsem Commit c0d0381ade79 ("hugetlbfs: use i_mmap_rwsem for more pmd sharing synchronization") requires callers of huge_pte_alloc to hold i_mmap_rwsem in at least read mode. This is because the explicit locking in huge_pmd_share (called by huge_pte_alloc) was removed. When restructuring the code, the call to huge_pte_alloc in the else block at the beginning of hugetlb_fault was missed. Unfortunately, that else clause is exercised when there is no page table entry. This will likely lead to a call to huge_pmd_share. If huge_pmd_share thinks pmd sharing is possible, it will traverse the mapping tree (i_mmap) without holding i_mmap_rwsem. If someone else is modifying the tree, bad things such as addressing exceptions or worse could happen. Simply remove the else clause. It should have been removed previously. The code following the else will call huge_pte_alloc with the appropriate locking. To prevent this type of issue in the future, add routines to assert that i_mmap_rwsem is held, and call these routines in huge pmd sharing routines. Link: http://lkml.kernel.org/r/e670f327-5cf9-1959-96e4-6dc7cc30d3d5@oracle.com Fixes: c0d0381ade79 ("hugetlbfs: use i_mmap_rwsem for more pmd sharing synchronization") Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com> Suggested-by: Matthew Wilcox <willy(a)infradead.org> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Hugh Dickins <hughd(a)google.com> Cc: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com> Cc: "Aneesh Kumar K.V" <aneesh.kumar(a)linux.vnet.ibm.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: "Kirill A.Shutemov" <kirill.shutemov(a)linux.intel.com> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: Prakash Sangappa <prakash.sangappa(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/fs.h | 10 ++++++++++ include/linux/hugetlb.h | 8 +++++--- mm/hugetlb.c | 15 +++++++-------- mm/rmap.c | 2 +- 4 files changed, 23 insertions(+), 12 deletions(-) --- a/include/linux/fs.h~hugetlbfs-remove-call-to-huge_pte_alloc-without-i_mmap_rwsem +++ a/include/linux/fs.h @@ -518,6 +518,16 @@ static inline void i_mmap_unlock_read(st up_read(&mapping->i_mmap_rwsem); } +static inline void i_mmap_assert_locked(struct address_space *mapping) +{ + lockdep_assert_held(&mapping->i_mmap_rwsem); +} + +static inline void i_mmap_assert_write_locked(struct address_space *mapping) +{ + lockdep_assert_held_write(&mapping->i_mmap_rwsem); +} + /* * Might pages of this file be mapped into userspace? */ --- a/include/linux/hugetlb.h~hugetlbfs-remove-call-to-huge_pte_alloc-without-i_mmap_rwsem +++ a/include/linux/hugetlb.h @@ -164,7 +164,8 @@ pte_t *huge_pte_alloc(struct mm_struct * unsigned long addr, unsigned long sz); pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr, unsigned long sz); -int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep); +int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep); void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, unsigned long *start, unsigned long *end); struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address, @@ -203,8 +204,9 @@ static inline struct address_space *huge return NULL; } -static inline int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, - pte_t *ptep) +static inline int huge_pmd_unshare(struct mm_struct *mm, + struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep) { return 0; } --- a/mm/hugetlb.c~hugetlbfs-remove-call-to-huge_pte_alloc-without-i_mmap_rwsem +++ a/mm/hugetlb.c @@ -3967,7 +3967,7 @@ void __unmap_hugepage_range(struct mmu_g continue; ptl = huge_pte_lock(h, mm, ptep); - if (huge_pmd_unshare(mm, &address, ptep)) { + if (huge_pmd_unshare(mm, vma, &address, ptep)) { spin_unlock(ptl); /* * We just unmapped a page of PMDs by clearing a PUD. @@ -4554,10 +4554,6 @@ vm_fault_t hugetlb_fault(struct mm_struc } else if (unlikely(is_hugetlb_entry_hwpoisoned(entry))) return VM_FAULT_HWPOISON_LARGE | VM_FAULT_SET_HINDEX(hstate_index(h)); - } else { - ptep = huge_pte_alloc(mm, haddr, huge_page_size(h)); - if (!ptep) - return VM_FAULT_OOM; } /* @@ -5034,7 +5030,7 @@ unsigned long hugetlb_change_protection( if (!ptep) continue; ptl = huge_pte_lock(h, mm, ptep); - if (huge_pmd_unshare(mm, &address, ptep)) { + if (huge_pmd_unshare(mm, vma, &address, ptep)) { pages++; spin_unlock(ptl); shared_pmd = true; @@ -5415,12 +5411,14 @@ out: * returns: 1 successfully unmapped a shared pte page * 0 the underlying pte page is not shared, or it is the last user */ -int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep) +int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep) { pgd_t *pgd = pgd_offset(mm, *addr); p4d_t *p4d = p4d_offset(pgd, *addr); pud_t *pud = pud_offset(p4d, *addr); + i_mmap_assert_write_locked(vma->vm_file->f_mapping); BUG_ON(page_count(virt_to_page(ptep)) == 0); if (page_count(virt_to_page(ptep)) == 1) return 0; @@ -5438,7 +5436,8 @@ pte_t *huge_pmd_share(struct mm_struct * return NULL; } -int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep) +int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep) { return 0; } --- a/mm/rmap.c~hugetlbfs-remove-call-to-huge_pte_alloc-without-i_mmap_rwsem +++ a/mm/rmap.c @@ -1469,7 +1469,7 @@ static bool try_to_unmap_one(struct page * do this outside rmap routines. */ VM_BUG_ON(!(flags & TTU_RMAP_LOCKED)); - if (huge_pmd_unshare(mm, &address, pvmw.pte)) { + if (huge_pmd_unshare(mm, vma, &address, pvmw.pte)) { /* * huge_pmd_unshare unmapped an entire PMD * page. There is no way of knowing exactly _ Patches currently in -mm which might be from mike.kravetz(a)oracle.com are

4 years, 5 months

1
0
0 0

[PATCH 5.7 5.8] tracing: Move pipe reference to trace array instead of current_tracer

by dann frazier

From: "Steven Rostedt (VMware)" <rostedt(a)goodmis.org> commit 7ef282e05132d56b6f6b71e3873f317664bea78b upstream If a process has the trace_pipe open on a trace_array, the current tracer for that trace array should not be changed. This was original enforced by a global lock, but when instances were introduced, it was moved to the current_trace. But this structure is shared by all instances, and a trace_pipe is for a single instance. There's no reason that a process that has trace_pipe open on one instance should prevent another instance from changing its current tracer. Move the reference counter to the trace_array instead. This is marked as "Fixes" but is more of a clean up than a true fix. Backport if you want, but its not critical. Fixes: cf6ab6d9143b1 ("tracing: Add ref count to tracer for when they are being read by pipe") Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org> --- This addresses an issue we've seen with users trying to change current_tracer when they happen to have rasdaemon installed. rasdaemon uses the trace_pipe interface at runtime, which therefore blocks changing the current tracer. But of course, unless you know about rasdaemon internals, it isn't exactly an obvious failure mode. kernel/trace/trace.c | 12 ++++++------ kernel/trace/trace.h | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index bb62269724d5..6fc6da55b94e 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -5887,7 +5887,7 @@ int tracing_set_tracer(struct trace_array *tr, const char *buf) } /* If trace pipe files are being read, we can't change the tracer */ - if (tr->current_trace->ref) { + if (tr->trace_ref) { ret = -EBUSY; goto out; } @@ -6103,7 +6103,7 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp) nonseekable_open(inode, filp); - tr->current_trace->ref++; + tr->trace_ref++; out: mutex_unlock(&trace_types_lock); return ret; @@ -6122,7 +6122,7 @@ static int tracing_release_pipe(struct inode *inode, struct file *file) mutex_lock(&trace_types_lock); - tr->current_trace->ref--; + tr->trace_ref--; if (iter->trace->pipe_close) iter->trace->pipe_close(iter); @@ -7424,7 +7424,7 @@ static int tracing_buffers_open(struct inode *inode, struct file *filp) filp->private_data = info; - tr->current_trace->ref++; + tr->trace_ref++; mutex_unlock(&trace_types_lock); @@ -7525,7 +7525,7 @@ static int tracing_buffers_release(struct inode *inode, struct file *file) mutex_lock(&trace_types_lock); - iter->tr->current_trace->ref--; + iter->tr->trace_ref--; __trace_array_put(iter->tr); @@ -8733,7 +8733,7 @@ static int __remove_instance(struct trace_array *tr) int i; /* Reference counter for a newly created trace array = 1. */ - if (tr->ref > 1 || (tr->current_trace && tr->current_trace->ref)) + if (tr->ref > 1 || (tr->current_trace && tr->trace_ref)) return -EBUSY; list_del(&tr->list); diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h index 13db4000af3f..f21607f87189 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h @@ -356,6 +356,7 @@ struct trace_array { struct trace_event_file *trace_marker_file; cpumask_var_t tracing_cpumask; /* only trace on set CPUs */ int ref; + int trace_ref; #ifdef CONFIG_FUNCTION_TRACER struct ftrace_ops *ops; struct trace_pid_list __rcu *function_pids; @@ -547,7 +548,6 @@ struct tracer { struct tracer *next; struct tracer_flags *flags; int enabled; - int ref; bool print_max; bool allow_instances; #ifdef CONFIG_TRACER_MAX_TRACE -- 2.28.0

4 years, 5 months

2
2
0 0

WARNING: kernel/rcu/tree.c:618 rcu_eqs_enter.isra.67+0xd8

by Naresh Kamboju

While running kselftests bpf test_verifier on arm64 juno-r2 device the kernel BUG and WARNING noticed. metadata: git branch: linux-5.8.y git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git git commit: b30c8c9d42601af8ebeb3ad42085ff4134a111a0 git describe: v5.8-39-gb30c8c9d4260 make_kernelversion: 5.8.1-rc1 kernel-config: http://snapshots.linaro.org/openembedded/lkft/lkft/sumo/juno/lkft/linux-sta… [ 102.671323] bpf_prog_test_run_xdp+0xf4/0x1b0 [ 102.675688] __do_sys_bpf+0x708/0x1d18 [ 102.679442] __arm64_sys_bpf+0x28/0x38 [ 102.683197] el0_svc_common.constprop.3+0x7c/0x198 [ 102.687995] do_el0_svc+0x34/0xa0 [ 102.691315] el0_sync_handler+0x16c/0x210 [ 102.695329] el0_sync+0x140/0x180 [ 102.698651] Code: d4202000 d4202000 d4202000 d4202000 (d4202000) [ 102.704758] ---[ end trace 14c3fdd625b93f51 ]--- [ 102.709383] note: test_verifier[740] exited with preempt_count 2 [ 102.715399] BUG: sleeping function called from invalid context at /usr/src/kernel/include/linux/percpu-rwsem.h:49 [ 102.725680] in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 740, name: test_verifier [ 102.734219] INFO: lockdep is turned off. [ 102.738146] irq event stamp: 4369860 [ 102.741729] hardirqs last enabled at (4369859): [<ffff80001015ab18>] ktime_get+0xc0/0x178 [ 102.750010] hardirqs last disabled at (4369860): [<ffff800010029a04>] debug_exception_enter+0xac/0xe8 [ 102.759249] softirqs last enabled at (4369842): [<ffff8000102161d4>] bpf_ksym_add+0x12c/0x148 [ 102.767878] softirqs last disabled at (4369840): [<ffff8000102160d4>] bpf_ksym_add+0x2c/0x148 [ 102.776419] CPU: 2 PID: 740 Comm: test_verifier Tainted: G D W 5.8.1-rc1 #1 [ 102.784523] Hardware name: ARM Juno development board (r2) (DT) [ 102.790451] Call trace: [ 102.792900] dump_backtrace+0x0/0x1f8 [ 102.796567] show_stack+0x2c/0x38 [ 102.799889] dump_stack+0xf0/0x16c [ 102.803296] ___might_sleep+0x144/0x208 [ 102.807137] __might_sleep+0x54/0x90 [ 102.810719] exit_signals+0x54/0x3e8 [ 102.814301] do_exit+0xc8/0xae0 [ 102.817446] die+0x200/0x268 [ 102.820329] arm64_notify_die+0xa0/0xc0 [ 102.824172] do_debug_exception+0xf0/0x128 [ 102.828275] el1_sync_handler+0x90/0xf0 [ 102.832116] el1_sync+0x7c/0x100 [ 102.835347] 0xffff8000000129b8 [ 102.838493] bpf_prog_d53bb52e3f4483f9_F+0x38/0x8d0 [ 102.843379] bpf_dispatcher_xdp_func+0x30/0x40 [ 102.847830] bpf_test_run+0x180/0x570 [ 102.851497] bpf_prog_test_run_xdp+0xf4/0x1b0 [ 102.855861] __do_sys_bpf+0x708/0x1d18 [ 102.859615] __arm64_sys_bpf+0x28/0x38 [ 102.863369] el0_svc_common.constprop.3+0x7c/0x198 [ 102.868167] do_el0_svc+0x34/0xa0 [ 102.871486] el0_sync_handler+0x16c/0x210 [ 102.875501] el0_sync+0x140/0x180 [ 102.886823] ------------[ cut here ]------------ [ 102.887376] kauditd_printk_skb: 125 callbacks suppressed [ 102.887387] audit: type=1701 audit(1597081698.472:1942): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=738 comm=\"timeout\" exe=\"/usr/bin/timeout.coreutils\" sig=11 res=1 [ 102.891463] WARNING: CPU: 2 PID: 0 at /usr/src/kernel/kernel/rcu/tree.c:618 rcu_eqs_enter.isra.67+0xd8/0xe0 [ 102.891467] Modules linked in: rfkill tda998x cec drm_kms_helper drm crct10dif_ce fuse [ 102.891486] CPU: 2 PID: 0 Comm: swapper/2 Tainted: G D W 5.8.1-rc1 #1 [ 102.891490] Hardware name: ARM Juno development board (r2) (DT) [ 102.891495] pstate: 200003c5 (nzCv DAIF -PAN -UAO BTYPE=--) [ 102.891501] pc : rcu_eqs_enter.isra.67+0xd8/0xe0 [ 102.891511] lr : rcu_eqs_enter.isra.67+0x10/0xe0 [ 102.957881] sp : ffff800013683f20 [ 102.961198] x29: ffff800013683f20 x28: 0000000000000000 [ 102.966519] x27: 0000000000000000 x26: ffff000973033800 [ 102.971840] x25: ffff00097ef5fc80 x24: ffff800012651410 [ 102.977162] x23: ffff800011f00c78 x22: ffff800012650000 [ 102.982483] x21: ffff800012651000 x20: ffff800011f02000 [ 102.987803] x19: ffff00097ef61ec0 x18: ffffffffffffffff [ 102.993124] x17: 0000000000000000 x16: 0000000000000000 [ 102.998444] x15: 000000000000006c x14: 000000000000002a [ 103.003765] x13: 0000000000000002 x12: 0000000000000000 [ 103.009086] x11: 0000000000000000 x10: ffff80001264b1c8 [ 103.014406] x9 : 0000000000000000 x8 : ffff800012650a88 [ 103.019727] x7 : ffff80001016d09c x6 : 0000000000000000 [ 103.025048] x5 : 0000000000000000 x4 : 0000000000000000 [ 103.030368] x3 : ffff800012650a88 x2 : 00000017f0129f00 [ 103.035689] x1 : 4000000000000002 x0 : 4000000000000000 [ 103.041011] Call trace: [ 103.043461] rcu_eqs_enter.isra.67+0xd8/0xe0 [ 103.047739] rcu_idle_enter+0x44/0x70 [ 103.051406] do_idle+0x214/0x2c0 [ 103.054637] cpu_startup_entry+0x2c/0x70 [ 103.058567] secondary_start_kernel+0x1a8/0x200 [ 103.063103] irq event stamp: 449856 [ 103.066599] hardirqs last enabled at (449855): [<ffff80001016d1ec>] tick_nohz_idle_exit+0x64/0xd0 [ 103.075574] hardirqs last disabled at (449856): [<ffff800011329c08>] __schedule+0xf0/0x8f0 [ 103.083853] softirqs last enabled at (449814): [<ffff8000100019bc>] __do_softirq+0x59c/0x5dc [ 103.092396] softirqs last disabled at (449803): [<ffff80001008fbf4>] irq_exit+0x144/0x150 Full output log: https://qa-reports.linaro.org/lkft/linux-stable-rc-5.8-oe/build/v5.8-39-gb3… -- Linaro LKFT https://lkft.linaro.org

4 years, 5 months

2
1
0 0

[PATCH 04/11] extcon: ptn5150: Fix usage of atomic GPIO with sleeping GPIO chips

by Krzysztof Kozlowski

The driver uses atomic version of gpiod_set_value() without any real reason. It is called in a workqueue under mutex so it could sleep there. Changing it to "can_sleep" flavor allows to use the driver with all GPIO chips. Fixes: 4ed754de2d66 ("extcon: Add support for ptn5150 extcon driver") Cc: <stable(a)vger.kernel.org> Signed-off-by: Krzysztof Kozlowski <krzk(a)kernel.org> --- drivers/extcon/extcon-ptn5150.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/extcon/extcon-ptn5150.c b/drivers/extcon/extcon-ptn5150.c index d1c997599390..5f5252752644 100644 --- a/drivers/extcon/extcon-ptn5150.c +++ b/drivers/extcon/extcon-ptn5150.c @@ -127,7 +127,7 @@ static void ptn5150_irq_work(struct work_struct *work) case PTN5150_DFP_ATTACHED: extcon_set_state_sync(info->edev, EXTCON_USB_HOST, false); - gpiod_set_value(info->vbus_gpiod, 0); + gpiod_set_value_cansleep(info->vbus_gpiod, 0); extcon_set_state_sync(info->edev, EXTCON_USB, true); break; @@ -138,9 +138,9 @@ static void ptn5150_irq_work(struct work_struct *work) PTN5150_REG_CC_VBUS_DETECTION_MASK) >> PTN5150_REG_CC_VBUS_DETECTION_SHIFT); if (vbus) - gpiod_set_value(info->vbus_gpiod, 0); + gpiod_set_value_cansleep(info->vbus_gpiod, 0); else - gpiod_set_value(info->vbus_gpiod, 1); + gpiod_set_value_cansleep(info->vbus_gpiod, 1); extcon_set_state_sync(info->edev, EXTCON_USB_HOST, true); @@ -156,7 +156,7 @@ static void ptn5150_irq_work(struct work_struct *work) EXTCON_USB_HOST, false); extcon_set_state_sync(info->edev, EXTCON_USB, false); - gpiod_set_value(info->vbus_gpiod, 0); + gpiod_set_value_cansleep(info->vbus_gpiod, 0); } } -- 2.17.1

4 years, 5 months

1
0
0 0

[v2, 0/3] add optional reset property arm64: dts: mt7622: add reset node for mmc device mmc: mediatek: add optional module reset property Documentation/devicetree/bindings/mmc/mtk-sd.txt | 2 ++ arch/arm64/boot/dts/mediatek/mt7622.dtsi | 2 ++ drivers/mmc/host/mtk-sd.c | 13 +++++++++++++ 3 files changed, 17 insertions(+)

by Wenbin Mei

-- 2.18.0

4 years, 5 months

3
8
0 0

[PATCH v2] ata: sata_rcar: Fix DMA boundary mask

by Geert Uytterhoeven

Before commit 9495b7e92f716ab2 ("driver core: platform: Initialize dma_parms for platform devices"), the R-Car SATA device didn't have DMA parameters. Hence the DMA boundary mask supplied by its driver was silently ignored, as __scsi_init_queue() doesn't check the return value of dma_set_seg_boundary(), and the default value of 0xffffffff was used. Now the device has gained DMA parameters, the driver-supplied value is used, and the following warning is printed on Salvator-XS: DMA-API: sata_rcar ee300000.sata: mapping sg segment across boundary [start=0x00000000ffffe000] [end=0x00000000ffffefff] [boundary=0x000000001ffffffe] WARNING: CPU: 5 PID: 38 at kernel/dma/debug.c:1233 debug_dma_map_sg+0x298/0x300 (the range of start/end values depend on whether IOMMU support is enabled or not) The issue here is that SATA_RCAR_DMA_BOUNDARY doesn't have bit 0 set, so any typical end value, which is odd, will trigger the check. Fix this by increasing the DMA boundary value by 1. Fixes: 8bfbeed58665dbbf ("sata_rcar: correct 'sata_rcar_sht'") Fixes: 9495b7e92f716ab2 ("driver core: platform: Initialize dma_parms for platform devices") Signed-off-by: Geert Uytterhoeven <geert+renesas(a)glider.be> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Reviewed-by: Sergei Shtylyov <sergei.shtylyov(a)cogentembedded.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> Cc: stable <stable(a)vger.kernel.org> --- v2: - Add Reviewed-by, Tested-by, Cc. This is a fix for a regression in v5.7-rc5 that fell through the cracks. https://lore.kernel.org/linux-ide/20200513110426.22472-1-geert+renesas@glid… As by default the DMA debug code prints the first error only, this issue may be hidden on plain v5.7-rc5, where the FCP driver triggers a similar warning. Merging commit dd844fb8e50b12e6 ("media: platform: fcp: Set appropriate DMA parameters", in v5.8-rc1) from the media tree fixes the FCP issue, and exposes the SATA issue. I added the second fixes tag because that commit is already being backported to stable kernels, and this patch thus needs backporting, too. --- drivers/ata/sata_rcar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c index 141ac600b64c87ef..44b0ed8f6bb8a120 100644 --- a/drivers/ata/sata_rcar.c +++ b/drivers/ata/sata_rcar.c @@ -120,7 +120,7 @@ /* Descriptor table word 0 bit (when DTA32M = 1) */ #define SATA_RCAR_DTEND BIT(0) -#define SATA_RCAR_DMA_BOUNDARY 0x1FFFFFFEUL +#define SATA_RCAR_DMA_BOUNDARY 0x1FFFFFFFUL /* Gen2 Physical Layer Control Registers */ #define RCAR_GEN2_PHY_CTL1_REG 0x1704 -- 2.17.1

4 years, 5 months

2
1
0 0

Re: [PATCH] clk: qcom: clk-rpmh: Wait for completion when enabling clocks

by Doug Anderson

Hi, On Mon, Mar 9, 2020 at 2:11 PM Stephen Boyd <sboyd(a)kernel.org> wrote: > > Quoting Mike Tipton (2020-02-14 18:12:32) > > The current implementation always uses rpmh_write_async, which doesn't > > wait for completion. That's fine for disable requests since there's no > > immediate need for the clocks and they can be disabled in the > > background. However, for enable requests we need to ensure the clocks > > are actually enabled before returning to the client. Otherwise, clients > > can end up accessing their HW before the necessary clocks are enabled, > > which can lead to bus errors. > > > > Use the synchronous version of this API (rpmh_write) for enable requests > > in the active set to ensure completion. > > > > Completion isn't required for sleep/wake sets, since they don't take > > effect until after we enter sleep. All rpmh requests are automatically > > flushed prior to entering sleep. > > > > Fixes: 9c7e47025a6b ("clk: qcom: clk-rpmh: Add QCOM RPMh clock driver") > > Signed-off-by: Mike Tipton <mdtipton(a)codeaurora.org> > > --- > > Applied to clk-next but I squashed in some changes to make it easier for > me to read. This landed upstream as commit dad4e7fda4bd ("clk: qcom: clk-rpmh: Wait for completion when enabling clocks") but seemed to have missed stable. Can stable pick it up? It has a Fixes tag so presumably it should be easy to track down where it needs to go. Thanks! -Doug

4 years, 5 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror August 2020