February 2023 - Linux-stable-mirror

+ mm-shrinkers-fix-deadlock-in-shrinker-debugfs.patch added to mm-unstable branch

by Andrew Morton

The patch titled Subject: mm: shrinkers: fix deadlock in shrinker debugfs has been added to the -mm mm-unstable branch. Its filename is mm-shrinkers-fix-deadlock-in-shrinker-debugfs.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Qi Zheng <zhengqi.arch(a)bytedance.com> Subject: mm: shrinkers: fix deadlock in shrinker debugfs Date: Thu, 2 Feb 2023 18:56:12 +0800 The debugfs_remove_recursive() is invoked by unregister_shrinker(), which is holding the write lock of shrinker_rwsem. It will waits for the handler of debugfs file complete. The handler also needs to hold the read lock of shrinker_rwsem to do something. So it may cause the following deadlock: CPU0 CPU1 debugfs_file_get() shrinker_debugfs_count_show()/shrinker_debugfs_scan_write() unregister_shrinker() --> down_write(&shrinker_rwsem); debugfs_remove_recursive() // wait for (A) --> wait_for_completion(); // wait for (B) --> down_read_killable(&shrinker_rwsem) debugfs_file_put() -- (A) up_write() -- (B) The down_read_killable() can be killed, so that the above deadlock can be recovered. But it still requires an extra kill action, otherwise it will block all subsequent shrinker-related operations, so it's better to fix it. Link: https://lkml.kernel.org/r/20230202105612.64641-1-zhengqi.arch@bytedance.com Fixes: 5035ebc644ae ("mm: shrinkers: introduce debugfs interface for memory shrinkers") Signed-off-by: Qi Zheng <zhengqi.arch(a)bytedance.com> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: Kent Overstreet <kent.overstreet(a)gmail.com> Cc: Muchun Song <songmuchun(a)bytedance.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- --- a/include/linux/shrinker.h~mm-shrinkers-fix-deadlock-in-shrinker-debugfs +++ a/include/linux/shrinker.h @@ -107,7 +107,7 @@ extern void synchronize_shrinkers(void); #ifdef CONFIG_SHRINKER_DEBUG extern int shrinker_debugfs_add(struct shrinker *shrinker); -extern void shrinker_debugfs_remove(struct shrinker *shrinker); +extern struct dentry *shrinker_debugfs_remove(struct shrinker *shrinker); extern int __printf(2, 3) shrinker_debugfs_rename(struct shrinker *shrinker, const char *fmt, ...); #else /* CONFIG_SHRINKER_DEBUG */ @@ -115,7 +115,7 @@ static inline int shrinker_debugfs_add(s { return 0; } -static inline void shrinker_debugfs_remove(struct shrinker *shrinker) +static inline struct dentry *shrinker_debugfs_remove(struct shrinker *shrinker) { } static inline __printf(2, 3) --- a/mm/shrinker_debug.c~mm-shrinkers-fix-deadlock-in-shrinker-debugfs +++ a/mm/shrinker_debug.c @@ -246,18 +246,21 @@ int shrinker_debugfs_rename(struct shrin } EXPORT_SYMBOL(shrinker_debugfs_rename); -void shrinker_debugfs_remove(struct shrinker *shrinker) +struct dentry *shrinker_debugfs_remove(struct shrinker *shrinker) { + struct dentry *entry = shrinker->debugfs_entry; + lockdep_assert_held(&shrinker_rwsem); kfree_const(shrinker->name); shrinker->name = NULL; - if (!shrinker->debugfs_entry) - return; + if (entry) { + ida_free(&shrinker_debugfs_ida, shrinker->debugfs_id); + shrinker->debugfs_entry = NULL; + } - debugfs_remove_recursive(shrinker->debugfs_entry); - ida_free(&shrinker_debugfs_ida, shrinker->debugfs_id); + return entry; } static int __init shrinker_debugfs_init(void) --- a/mm/vmscan.c~mm-shrinkers-fix-deadlock-in-shrinker-debugfs +++ a/mm/vmscan.c @@ -747,6 +747,8 @@ EXPORT_SYMBOL(register_shrinker); */ void unregister_shrinker(struct shrinker *shrinker) { + struct dentry *debugfs_entry; + if (!(shrinker->flags & SHRINKER_REGISTERED)) return; @@ -755,9 +757,11 @@ void unregister_shrinker(struct shrinker shrinker->flags &= ~SHRINKER_REGISTERED; if (shrinker->flags & SHRINKER_MEMCG_AWARE) unregister_memcg_shrinker(shrinker); - shrinker_debugfs_remove(shrinker); + debugfs_entry = shrinker_debugfs_remove(shrinker); up_write(&shrinker_rwsem); + debugfs_remove_recursive(debugfs_entry); + kfree(shrinker->nr_deferred); shrinker->nr_deferred = NULL; } _ Patches currently in -mm which might be from zhengqi.arch(a)bytedance.com are mm-shrinkers-fix-deadlock-in-shrinker-debugfs.patch

2 years, 2 months

1
0
0 0

[PATCH 5.15.y v2 0/5] phy: qcom-qmp-combo: Backport some stable fixes

by Stephen Boyd

After the qmp phy driver was split it looks like 5.15.y stable kernels aren't getting fixes like commit 7a7d86d14d07 ("phy: qcom-qmp-combo: fix broken power on") which is tagged for stable 5.10. Trogdor boards use the qmp phy on 5.15.y kernels, so I backported the fixes I could find that looked like we may possibly trip over at some point. USB and DP work on my Trogdor.Lazor board with this set. Changes from v1 (https://lore.kernel.org/r/20230113005405.3992011-1-swboyd@chromium.org): * New patch for memleak on probe deferal to avoid compat issues * Update "fix broken power on" patch for pcie/ufs phy Johan Hovold (5): phy: qcom-qmp-combo: disable runtime PM on unbind phy: qcom-qmp-combo: fix memleak on probe deferral phy: qcom-qmp-usb: fix memleak on probe deferral phy: qcom-qmp-combo: fix broken power on phy: qcom-qmp-combo: fix runtime suspend drivers/phy/qualcomm/phy-qcom-qmp.c | 97 ++++++++++++++++++----------- 1 file changed, 61 insertions(+), 36 deletions(-) Cc: Johan Hovold <johan+linaro(a)kernel.org> Cc: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Cc: Vinod Koul <vkoul(a)kernel.org> base-commit: d57287729e229188e7d07ef0117fe927664e08cb -- https://chromeos.dev

2 years, 2 months

3
9
0 0

[PATCH net,v3] net: mana: Fix accessing freed irq affinity_hint

by Haiyang Zhang

After calling irq_set_affinity_and_hint(), the cpumask pointer is saved in desc->affinity_hint, and will be used later when reading /proc/irq/<num>/affinity_hint. So the cpumask variable needs to be persistent. Otherwise, we are accessing freed memory when reading the affinity_hint file. Also, need to clear affinity_hint before free_irq(), otherwise there is a one-time warning and stack trace during module unloading: [ 243.948687] WARNING: CPU: 10 PID: 1589 at kernel/irq/manage.c:1913 free_irq+0x318/0x360 ... [ 243.948753] Call Trace: [ 243.948754] <TASK> [ 243.948760] mana_gd_remove_irqs+0x78/0xc0 [mana] [ 243.948767] mana_gd_remove+0x3e/0x80 [mana] [ 243.948773] pci_device_remove+0x3d/0xb0 [ 243.948778] device_remove+0x46/0x70 [ 243.948782] device_release_driver_internal+0x1fe/0x280 [ 243.948785] driver_detach+0x4e/0xa0 [ 243.948787] bus_remove_driver+0x70/0xf0 [ 243.948789] driver_unregister+0x35/0x60 [ 243.948792] pci_unregister_driver+0x44/0x90 [ 243.948794] mana_driver_exit+0x14/0x3fe [mana] [ 243.948800] __do_sys_delete_module.constprop.0+0x185/0x2f0 To fix the bug, use the persistent mask, cpumask_of(cpu#), and set affinity_hint to NULL before freeing the IRQ, as required by free_irq(). Cc: stable(a)vger.kernel.org Fixes: 71fa6887eeca ("net: mana: Assign interrupts to CPUs based on NUMA nodes") Signed-off-by: Haiyang Zhang <haiyangz(a)microsoft.com> Reviewed-by: Michael Kelley <mikelley(a)microsoft.com> Reviewed-by: Leon Romanovsky <leonro(a)nvidia.com> --- .../net/ethernet/microsoft/mana/gdma_main.c | 37 ++++++------------- 1 file changed, 11 insertions(+), 26 deletions(-) diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c index b144f2237748..f9b8f372ec8a 100644 --- a/drivers/net/ethernet/microsoft/mana/gdma_main.c +++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c @@ -1217,9 +1217,7 @@ static int mana_gd_setup_irqs(struct pci_dev *pdev) unsigned int max_queues_per_port = num_online_cpus(); struct gdma_context *gc = pci_get_drvdata(pdev); struct gdma_irq_context *gic; - unsigned int max_irqs; - u16 *cpus; - cpumask_var_t req_mask; + unsigned int max_irqs, cpu; int nvec, irq; int err, i = 0, j; @@ -1240,21 +1238,7 @@ static int mana_gd_setup_irqs(struct pci_dev *pdev) goto free_irq_vector; } - if (!zalloc_cpumask_var(&req_mask, GFP_KERNEL)) { - err = -ENOMEM; - goto free_irq; - } - - cpus = kcalloc(nvec, sizeof(*cpus), GFP_KERNEL); - if (!cpus) { - err = -ENOMEM; - goto free_mask; - } - for (i = 0; i < nvec; i++) - cpus[i] = cpumask_local_spread(i, gc->numa_node); - for (i = 0; i < nvec; i++) { - cpumask_set_cpu(cpus[i], req_mask); gic = &gc->irq_contexts[i]; gic->handler = NULL; gic->arg = NULL; @@ -1269,17 +1253,16 @@ static int mana_gd_setup_irqs(struct pci_dev *pdev) irq = pci_irq_vector(pdev, i); if (irq < 0) { err = irq; - goto free_mask; + goto free_irq; } err = request_irq(irq, mana_gd_intr, 0, gic->name, gic); if (err) - goto free_mask; - irq_set_affinity_and_hint(irq, req_mask); - cpumask_clear(req_mask); + goto free_irq; + + cpu = cpumask_local_spread(i, gc->numa_node); + irq_set_affinity_and_hint(irq, cpumask_of(cpu)); } - free_cpumask_var(req_mask); - kfree(cpus); err = mana_gd_alloc_res_map(nvec, &gc->msix_resource); if (err) @@ -1290,13 +1273,12 @@ static int mana_gd_setup_irqs(struct pci_dev *pdev) return 0; -free_mask: - free_cpumask_var(req_mask); - kfree(cpus); free_irq: for (j = i - 1; j >= 0; j--) { irq = pci_irq_vector(pdev, j); gic = &gc->irq_contexts[j]; + + irq_update_affinity_hint(irq, NULL); free_irq(irq, gic); } @@ -1324,6 +1306,9 @@ static void mana_gd_remove_irqs(struct pci_dev *pdev) continue; gic = &gc->irq_contexts[i]; + + /* Need to clear the hint before free_irq */ + irq_update_affinity_hint(irq, NULL); free_irq(irq, gic); } -- 2.25.1

2 years, 2 months

1
0
0 0

[PATCH net,v2] net: mana: Fix accessing freed irq affinity_hint

by Haiyang Zhang

After calling irq_set_affinity_and_hint(), the cpumask pointer is saved in desc->affinity_hint, and will be used later when reading /proc/irq/<num>/affinity_hint. So the cpumask variable needs to be persistent. Otherwise, we are accessing freed memory when reading the affinity_hint file. Also, need to clear affinity_hint before free_irq(), otherwise there is a one-time warning and stack trace during module unloading: [ 243.948687] WARNING: CPU: 10 PID: 1589 at kernel/irq/manage.c:1913 free_irq+0x318/0x360 ... [ 243.948753] Call Trace: [ 243.948754] <TASK> [ 243.948760] mana_gd_remove_irqs+0x78/0xc0 [mana] [ 243.948767] mana_gd_remove+0x3e/0x80 [mana] [ 243.948773] pci_device_remove+0x3d/0xb0 [ 243.948778] device_remove+0x46/0x70 [ 243.948782] device_release_driver_internal+0x1fe/0x280 [ 243.948785] driver_detach+0x4e/0xa0 [ 243.948787] bus_remove_driver+0x70/0xf0 [ 243.948789] driver_unregister+0x35/0x60 [ 243.948792] pci_unregister_driver+0x44/0x90 [ 243.948794] mana_driver_exit+0x14/0x3fe [mana] [ 243.948800] __do_sys_delete_module.constprop.0+0x185/0x2f0 To fix the bug, use the persistent mask, cpumask_of(cpu#), and set affinity_hint to NULL before freeing the IRQ, as required by free_irq(). Cc: stable(a)vger.kernel.org Fixes: 71fa6887eeca ("net: mana: Assign interrupts to CPUs based on NUMA nodes") Signed-off-by: Haiyang Zhang <haiyangz(a)microsoft.com> --- .../net/ethernet/microsoft/mana/gdma_main.c | 35 ++++++------------- 1 file changed, 10 insertions(+), 25 deletions(-) diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c index b144f2237748..a55d42332e20 100644 --- a/drivers/net/ethernet/microsoft/mana/gdma_main.c +++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c @@ -1218,8 +1218,6 @@ static int mana_gd_setup_irqs(struct pci_dev *pdev) struct gdma_context *gc = pci_get_drvdata(pdev); struct gdma_irq_context *gic; unsigned int max_irqs; - u16 *cpus; - cpumask_var_t req_mask; int nvec, irq; int err, i = 0, j; @@ -1240,21 +1238,7 @@ static int mana_gd_setup_irqs(struct pci_dev *pdev) goto free_irq_vector; } - if (!zalloc_cpumask_var(&req_mask, GFP_KERNEL)) { - err = -ENOMEM; - goto free_irq; - } - - cpus = kcalloc(nvec, sizeof(*cpus), GFP_KERNEL); - if (!cpus) { - err = -ENOMEM; - goto free_mask; - } - for (i = 0; i < nvec; i++) - cpus[i] = cpumask_local_spread(i, gc->numa_node); - for (i = 0; i < nvec; i++) { - cpumask_set_cpu(cpus[i], req_mask); gic = &gc->irq_contexts[i]; gic->handler = NULL; gic->arg = NULL; @@ -1269,17 +1253,16 @@ static int mana_gd_setup_irqs(struct pci_dev *pdev) irq = pci_irq_vector(pdev, i); if (irq < 0) { err = irq; - goto free_mask; + goto free_irq; } err = request_irq(irq, mana_gd_intr, 0, gic->name, gic); if (err) - goto free_mask; - irq_set_affinity_and_hint(irq, req_mask); - cpumask_clear(req_mask); + goto free_irq; + + irq_set_affinity_and_hint(irq, cpumask_of(cpumask_local_spread + (i, gc->numa_node))); } - free_cpumask_var(req_mask); - kfree(cpus); err = mana_gd_alloc_res_map(nvec, &gc->msix_resource); if (err) @@ -1290,13 +1273,12 @@ static int mana_gd_setup_irqs(struct pci_dev *pdev) return 0; -free_mask: - free_cpumask_var(req_mask); - kfree(cpus); free_irq: for (j = i - 1; j >= 0; j--) { irq = pci_irq_vector(pdev, j); gic = &gc->irq_contexts[j]; + + irq_update_affinity_hint(irq, NULL); free_irq(irq, gic); } @@ -1324,6 +1306,9 @@ static void mana_gd_remove_irqs(struct pci_dev *pdev) continue; gic = &gc->irq_contexts[i]; + + /* Need to clear the hint before free_irq */ + irq_update_affinity_hint(irq, NULL); free_irq(irq, gic); } -- 2.25.1

2 years, 2 months

4
4
0 0

[PATCH v2] mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type

by Tudor Ambarus

spi_nor_set_erase_type() was used either to set or to mask out an erase type. When we used it to mask out an erase type a shift-out-of-bounds was hit: UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 shift exponent 4294967295 is too large for 32-bit type 'int' size_shift and size_mask were not used anyway when erase size was set to zero, so the functionality was not affected. The setting of the size_{shift, mask} and of the opcode are unnecessary when the erase size is zero, as throughout the code just the erase size is considered to determine whether an erase type is supported or not. Setting the opcode to 0xFF was wrong too as nobody guarantees that 0xFF is an unused opcode. Thus condition the setting of these params by the erase size. This will fix the shift-out-of-bounds too. While here avoid a superfluous dereference and use 'size' directly. Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories") Cc: stable(a)vger.kernel.org Reported-by: Alexander Stein <Alexander.Stein(a)tq-group.com> Suggested-by: Louis Rannou <lrannou(a)baylibre.com> Signed-off-by: Tudor Ambarus <tudor.ambarus(a)linaro.org> --- v1 at https://lore.kernel.org/r/20211106075616.95401-1-tudor.ambarus@microchip.co… drivers/mtd/spi-nor/core.c | 20 ++++++++++++++++---- drivers/mtd/spi-nor/core.h | 1 + drivers/mtd/spi-nor/sfdp.c | 4 ++-- 3 files changed, 19 insertions(+), 6 deletions(-) diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c index 247d1014879a..9b90d941d87a 100644 --- a/drivers/mtd/spi-nor/core.c +++ b/drivers/mtd/spi-nor/core.c @@ -2019,10 +2019,22 @@ void spi_nor_set_erase_type(struct spi_nor_erase_type *erase, u32 size, u8 opcode) { erase->size = size; - erase->opcode = opcode; - /* JEDEC JESD216B Standard imposes erase sizes to be power of 2. */ - erase->size_shift = ffs(erase->size) - 1; - erase->size_mask = (1 << erase->size_shift) - 1; + + if (size) { + erase->opcode = opcode; + /* JEDEC JESD216B imposes erase sizes to be power of 2. */ + erase->size_shift = ffs(size) - 1; + erase->size_mask = (1 << erase->size_shift) - 1; + } +} + +/** + * spi_nor_mask_erase_type() - mask out an SPI NOR erase type + * @erase: pointer to a structure that describes a SPI NOR erase type + */ +void spi_nor_mask_erase_type(struct spi_nor_erase_type *erase) +{ + erase->size = 0; } /** diff --git a/drivers/mtd/spi-nor/core.h b/drivers/mtd/spi-nor/core.h index f6d012e1f681..25423225c29d 100644 --- a/drivers/mtd/spi-nor/core.h +++ b/drivers/mtd/spi-nor/core.h @@ -681,6 +681,7 @@ void spi_nor_set_pp_settings(struct spi_nor_pp_command *pp, u8 opcode, void spi_nor_set_erase_type(struct spi_nor_erase_type *erase, u32 size, u8 opcode); +void spi_nor_mask_erase_type(struct spi_nor_erase_type *erase); struct spi_nor_erase_region * spi_nor_region_next(struct spi_nor_erase_region *region); void spi_nor_init_uniform_erase_map(struct spi_nor_erase_map *map, diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c index fd4daf8fa5df..298ab5e53a8c 100644 --- a/drivers/mtd/spi-nor/sfdp.c +++ b/drivers/mtd/spi-nor/sfdp.c @@ -875,7 +875,7 @@ static int spi_nor_init_non_uniform_erase_map(struct spi_nor *nor, */ for (i = 0; i < SNOR_ERASE_TYPE_MAX; i++) if (!(regions_erase_type & BIT(erase[i].idx))) - spi_nor_set_erase_type(&erase[i], 0, 0xFF); + spi_nor_mask_erase_type(&erase[i]); return 0; } @@ -1089,7 +1089,7 @@ static int spi_nor_parse_4bait(struct spi_nor *nor, erase_type[i].opcode = (dwords[SFDP_DWORD(2)] >> erase_type[i].idx * 8) & 0xFF; else - spi_nor_set_erase_type(&erase_type[i], 0u, 0xFF); + spi_nor_mask_erase_type(&erase_type[i]); } /* -- 2.34.1

2 years, 2 months

1
1
0 0

[PATCH 4.19 00/16] Backport oops_limit to 4.19

by Eric Biggers

This series backports the patchset "exit: Put an upper limit on how often we can oops" (https://lore.kernel.org/linux-mm/20221117233838.give.484-kees@kernel.org/T/…) to 4.19, as recommended at https://googleprojectzero.blogspot.com/2023/01/exploiting-null-dereferences… This follows the backports to 5.10 and 5.15 which already released, and the backport to 5.4 that I just sent out too. This required backporting various prerequisite patches. I've tested that oops_limit and warn_limit work correctly on x86_64. David Gow (1): mm: kasan: do not panic if both panic_on_warn and kasan_multishot set Eric W. Biederman (2): exit: Add and use make_task_dead. objtool: Add a missing comma to avoid string concatenation Jann Horn (1): exit: Put an upper limit on how often we can oops Kees Cook (7): exit: Expose "oops_count" to sysfs exit: Allow oops_limit to be disabled panic: Consolidate open-coded panic_on_warn checks panic: Introduce warn_limit panic: Expose "warn_count" to sysfs docs: Fix path paste-o for /sys/kernel/warn_count exit: Use READ_ONCE() for all oops/warn limit reads Nathan Chancellor (2): hexagon: Fix function name in die() h8300: Fix build errors from do_exit() to make_task_dead() transition Randy Dunlap (1): ia64: make IA64_MCA_RECOVERY bool instead of tristate Tiezhu Yang (1): panic: unset panic_on_warn inside panic() Xiaoming Ni (1): sysctl: add a new register_sysctl_init() interface .../ABI/testing/sysfs-kernel-oops_count | 6 ++ .../ABI/testing/sysfs-kernel-warn_count | 6 ++ Documentation/sysctl/kernel.txt | 20 +++++ arch/alpha/kernel/traps.c | 6 +- arch/alpha/mm/fault.c | 2 +- arch/arm/kernel/traps.c | 2 +- arch/arm/mm/fault.c | 2 +- arch/arm64/kernel/traps.c | 2 +- arch/arm64/mm/fault.c | 2 +- arch/h8300/kernel/traps.c | 3 +- arch/h8300/mm/fault.c | 2 +- arch/hexagon/kernel/traps.c | 2 +- arch/ia64/Kconfig | 2 +- arch/ia64/kernel/mca_drv.c | 2 +- arch/ia64/kernel/traps.c | 2 +- arch/ia64/mm/fault.c | 2 +- arch/m68k/kernel/traps.c | 2 +- arch/m68k/mm/fault.c | 2 +- arch/microblaze/kernel/exceptions.c | 4 +- arch/mips/kernel/traps.c | 2 +- arch/nds32/kernel/traps.c | 8 +- arch/nios2/kernel/traps.c | 4 +- arch/openrisc/kernel/traps.c | 2 +- arch/parisc/kernel/traps.c | 2 +- arch/powerpc/kernel/traps.c | 2 +- arch/riscv/kernel/traps.c | 2 +- arch/riscv/mm/fault.c | 2 +- arch/s390/kernel/dumpstack.c | 2 +- arch/s390/kernel/nmi.c | 2 +- arch/sh/kernel/traps.c | 2 +- arch/sparc/kernel/traps_32.c | 4 +- arch/sparc/kernel/traps_64.c | 4 +- arch/x86/entry/entry_32.S | 6 +- arch/x86/entry/entry_64.S | 6 +- arch/x86/kernel/dumpstack.c | 4 +- arch/xtensa/kernel/traps.c | 2 +- fs/proc/proc_sysctl.c | 33 ++++++++ include/linux/kernel.h | 1 + include/linux/sched/task.h | 1 + include/linux/sysctl.h | 3 + kernel/exit.c | 72 ++++++++++++++++++ kernel/panic.c | 75 ++++++++++++++++--- kernel/sched/core.c | 3 +- mm/kasan/report.c | 4 +- tools/objtool/check.c | 3 +- 45 files changed, 258 insertions(+), 64 deletions(-) create mode 100644 Documentation/ABI/testing/sysfs-kernel-oops_count create mode 100644 Documentation/ABI/testing/sysfs-kernel-warn_count base-commit: b17faf2c4e88ac0deb894f068bda67ace57e9c0a -- 2.39.1

2 years, 2 months

2
17
0 0

[PATCH net 1/1] hv_netvsc: Fix missed pagebuf entries in netvsc_dma_map/unmap()

by Michael Kelley

netvsc_dma_map() and netvsc_dma_unmap() currently check the cp_partial flag and adjust the page_count so that pagebuf entries for the RNDIS portion of the message are skipped when it has already been copied into a send buffer. But this adjustment has already been made by code in netvsc_send(). The duplicate adjustment causes some pagebuf entries to not be mapped. In a normal VM, this doesn't break anything because the mapping doesn’t change the PFN. But in a Confidential VM, dma_map_single() does bounce buffering and provides a different PFN. Failing to do the mapping causes the wrong PFN to be passed to Hyper-V, and various errors ensue. Fix this by removing the duplicate adjustment in netvsc_dma_map() and netvsc_dma_unmap(). Fixes: 846da38de0e8 ("net: netvsc: Add Isolation VM support for netvsc driver") Cc: stable(a)vger.kernel.org Signed-off-by: Michael Kelley <mikelley(a)microsoft.com> --- drivers/net/hyperv/netvsc.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c index 661bbe6..8acfa40 100644 --- a/drivers/net/hyperv/netvsc.c +++ b/drivers/net/hyperv/netvsc.c @@ -949,9 +949,6 @@ static void netvsc_copy_to_send_buf(struct netvsc_device *net_device, void netvsc_dma_unmap(struct hv_device *hv_dev, struct hv_netvsc_packet *packet) { - u32 page_count = packet->cp_partial ? - packet->page_buf_cnt - packet->rmsg_pgcnt : - packet->page_buf_cnt; int i; if (!hv_is_isolation_supported()) @@ -960,7 +957,7 @@ void netvsc_dma_unmap(struct hv_device *hv_dev, if (!packet->dma_range) return; - for (i = 0; i < page_count; i++) + for (i = 0; i < packet->page_buf_cnt; i++) dma_unmap_single(&hv_dev->device, packet->dma_range[i].dma, packet->dma_range[i].mapping_size, DMA_TO_DEVICE); @@ -990,9 +987,7 @@ static int netvsc_dma_map(struct hv_device *hv_dev, struct hv_netvsc_packet *packet, struct hv_page_buffer *pb) { - u32 page_count = packet->cp_partial ? - packet->page_buf_cnt - packet->rmsg_pgcnt : - packet->page_buf_cnt; + u32 page_count = packet->page_buf_cnt; dma_addr_t dma; int i; -- 1.8.3.1

2 years, 2 months

6
6
0 0

[PATCH 5.4 00/17] Backport oops_limit to 5.4

by Eric Biggers

This series backports the patchset "exit: Put an upper limit on how often we can oops" (https://lore.kernel.org/linux-mm/20221117233838.give.484-kees@kernel.org/T/…) to 5.4, as recommended at https://googleprojectzero.blogspot.com/2023/01/exploiting-null-dereferences… This follows the backports to 5.10 and 5.15 which already released. This required backporting various prerequisite patches. I've tested that oops_limit and warn_limit work correctly on x86_64. David Gow (1): mm: kasan: do not panic if both panic_on_warn and kasan_multishot set Eric W. Biederman (2): exit: Add and use make_task_dead. objtool: Add a missing comma to avoid string concatenation Jann Horn (1): exit: Put an upper limit on how often we can oops Kees Cook (7): exit: Expose "oops_count" to sysfs exit: Allow oops_limit to be disabled panic: Consolidate open-coded panic_on_warn checks panic: Introduce warn_limit panic: Expose "warn_count" to sysfs docs: Fix path paste-o for /sys/kernel/warn_count exit: Use READ_ONCE() for all oops/warn limit reads Nathan Chancellor (3): hexagon: Fix function name in die() h8300: Fix build errors from do_exit() to make_task_dead() transition csky: Fix function name in csky_alignment() and die() Randy Dunlap (1): ia64: make IA64_MCA_RECOVERY bool instead of tristate Tiezhu Yang (1): panic: unset panic_on_warn inside panic() Xiaoming Ni (1): sysctl: add a new register_sysctl_init() interface .../ABI/testing/sysfs-kernel-oops_count | 6 ++ .../ABI/testing/sysfs-kernel-warn_count | 6 ++ Documentation/admin-guide/sysctl/kernel.rst | 19 +++++ arch/alpha/kernel/traps.c | 6 +- arch/alpha/mm/fault.c | 2 +- arch/arm/kernel/traps.c | 2 +- arch/arm/mm/fault.c | 2 +- arch/arm64/kernel/traps.c | 2 +- arch/arm64/mm/fault.c | 2 +- arch/csky/abiv1/alignment.c | 2 +- arch/csky/kernel/traps.c | 2 +- arch/h8300/kernel/traps.c | 3 +- arch/h8300/mm/fault.c | 2 +- arch/hexagon/kernel/traps.c | 2 +- arch/ia64/Kconfig | 2 +- arch/ia64/kernel/mca_drv.c | 2 +- arch/ia64/kernel/traps.c | 2 +- arch/ia64/mm/fault.c | 2 +- arch/m68k/kernel/traps.c | 2 +- arch/m68k/mm/fault.c | 2 +- arch/microblaze/kernel/exceptions.c | 4 +- arch/mips/kernel/traps.c | 2 +- arch/nds32/kernel/fpu.c | 2 +- arch/nds32/kernel/traps.c | 8 +- arch/nios2/kernel/traps.c | 4 +- arch/openrisc/kernel/traps.c | 2 +- arch/parisc/kernel/traps.c | 2 +- arch/powerpc/kernel/traps.c | 2 +- arch/riscv/kernel/traps.c | 2 +- arch/riscv/mm/fault.c | 2 +- arch/s390/kernel/dumpstack.c | 2 +- arch/s390/kernel/nmi.c | 2 +- arch/sh/kernel/traps.c | 2 +- arch/sparc/kernel/traps_32.c | 4 +- arch/sparc/kernel/traps_64.c | 4 +- arch/x86/entry/entry_32.S | 6 +- arch/x86/entry/entry_64.S | 6 +- arch/x86/kernel/dumpstack.c | 4 +- arch/xtensa/kernel/traps.c | 2 +- fs/proc/proc_sysctl.c | 33 ++++++++ include/linux/kernel.h | 1 + include/linux/sched/task.h | 1 + include/linux/sysctl.h | 3 + kernel/exit.c | 72 ++++++++++++++++++ kernel/panic.c | 75 ++++++++++++++++--- kernel/sched/core.c | 3 +- mm/kasan/report.c | 4 +- tools/objtool/check.c | 3 +- 48 files changed, 260 insertions(+), 67 deletions(-) create mode 100644 Documentation/ABI/testing/sysfs-kernel-oops_count create mode 100644 Documentation/ABI/testing/sysfs-kernel-warn_count -- 2.39.1

2 years, 2 months

3
21
0 0

RE: Patch "gpiolib: acpi: Allow ignoring wake capability on pins that aren't in _AEI" has been added to the 6.1-stable tree

by Limonciello, Mario

[Public] > -----Original Message----- > From: Sasha Levin <sashal(a)kernel.org> > Sent: Wednesday, February 1, 2023 10:43 > To: stable-commits(a)vger.kernel.org; Limonciello, Mario > <Mario.Limonciello(a)amd.com> > Cc: Mika Westerberg <mika.westerberg(a)linux.intel.com>; Andy Shevchenko > <andriy.shevchenko(a)linux.intel.com>; Linus Walleij > <linus.walleij(a)linaro.org>; Bartosz Golaszewski <brgl(a)bgdev.pl> > Subject: Patch "gpiolib: acpi: Allow ignoring wake capability on pins that aren't > in _AEI" has been added to the 6.1-stable tree > > This is a note to let you know that I've just added the patch titled > > gpiolib: acpi: Allow ignoring wake capability on pins that aren't in _AEI > > to the 6.1-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable- > queue.git;a=summary > > The filename of the patch is: > gpiolib-acpi-allow-ignoring-wake-capability-on-pins-.patch > and it can be found in the queue-6.1 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. Hi Sasha, I suggest you also pick up two other fixes to go with this one. 1) this fix which was in the same series: 4cb786180dfb ("gpiolib: acpi: Add a ignore wakeup quirk for Clevo NL5xRU") 2) This fix which is tangentially related (fixes something from the same original series that exposed the regressions). d63f11c02b8d ("gpiolib-acpi: Don't set GPIOs for wakeup in S3 mode") > > > > commit 832a64f6e1557e017da518199dcab0e5fdca2808 > Author: Mario Limonciello <mario.limonciello(a)amd.com> > Date: Mon Jan 16 13:37:01 2023 -0600 > > gpiolib: acpi: Allow ignoring wake capability on pins that aren't in _AEI > > [ Upstream commit 0e3b175f079247f0d40d2ab695999c309d3a7498 ] > > Using the `ignore_wake` quirk or module parameter doesn't work for any > pin > that has been specified in the _CRS instead of _AEI. > > Extend the `acpi_gpio_irq_is_wake` check to cover both places. > > Suggested-by: Raul Rangel <rrangel(a)chromium.org> > Link: https://gitlab.freedesktop.org/drm/amd/- > /issues/1722#note_1722335 > Signed-off-by: Mario Limonciello <mario.limonciello(a)amd.com> > Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> > Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > > diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c > index a7d2358736fe..27f234637a15 100644 > --- a/drivers/gpio/gpiolib-acpi.c > +++ b/drivers/gpio/gpiolib-acpi.c > @@ -361,7 +361,7 @@ static bool acpi_gpio_in_ignore_list(const char > *ignore_list, const char *contro > } > > static bool acpi_gpio_irq_is_wake(struct device *parent, > - struct acpi_resource_gpio *agpio) > + const struct acpi_resource_gpio *agpio) > { > unsigned int pin = agpio->pin_table[0]; > > @@ -754,7 +754,7 @@ static int acpi_populate_gpio_lookup(struct > acpi_resource *ares, void *data) > lookup->info.pin_config = agpio->pin_config; > lookup->info.debounce = agpio->debounce_timeout; > lookup->info.gpioint = gpioint; > - lookup->info.wake_capable = agpio->wake_capable == > ACPI_WAKE_CAPABLE; > + lookup->info.wake_capable = > acpi_gpio_irq_is_wake(&lookup->info.adev->dev, agpio); > > /* > * Polarity and triggering are only specified for GpioInt

2 years, 2 months

3
3
0 0

[PATCH v2] thermal: intel_powerclamp: Fix cur_state for multi package system

by Srinivas Pandruvada

The powerclamp cooling device cur_state shows actual idle observed by package C-state idle counters. But the implementation is not sufficient for multi package or multi die system. The cur_state value is incorrect. On these systems, these counters must be read from each package/die and somehow aggregate them. But there is no good method for aggregation. It was not a problem when explicit CPU model addition was required to enable intel powerclamp. In this way certain CPU models could have been avoided. But with the removal of CPU model check with the availability of Package C-state counters, the driver is loaded on most of the recent systems. For multi package/die systems, just show the actual target idle state, the system is trying to achieve. In powerclamp this is the user set state minus one. Also there is no use of starting a worker thread for polling package C-state counters and applying any compensation for multiple package or multiple die systems. Fixes: b721ca0d1927 ("thermal/powerclamp: remove cpu whitelist") Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> Cc: stable(a)vger.kernel.org # 4.14+ --- v2: Changed: (true == clamping) to (clamping) Updated commit description for the last paragraph drivers/thermal/intel/intel_powerclamp.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/drivers/thermal/intel/intel_powerclamp.c b/drivers/thermal/intel/intel_powerclamp.c index b80e25ec1261..2f4cbfdf26a0 100644 --- a/drivers/thermal/intel/intel_powerclamp.c +++ b/drivers/thermal/intel/intel_powerclamp.c @@ -57,6 +57,7 @@ static unsigned int target_mwait; static struct dentry *debug_dir; +static bool poll_pkg_cstate_enable; /* user selected target */ static unsigned int set_target_ratio; @@ -261,6 +262,9 @@ static unsigned int get_compensation(int ratio) { unsigned int comp = 0; + if (!poll_pkg_cstate_enable) + return 0; + /* we only use compensation if all adjacent ones are good */ if (ratio == 1 && cal_data[ratio].confidence >= CONFIDENCE_OK && @@ -519,7 +523,8 @@ static int start_power_clamp(void) control_cpu = cpumask_first(cpu_online_mask); clamping = true; - schedule_delayed_work(&poll_pkg_cstate_work, 0); + if (poll_pkg_cstate_enable) + schedule_delayed_work(&poll_pkg_cstate_work, 0); /* start one kthread worker per online cpu */ for_each_online_cpu(cpu) { @@ -585,11 +590,15 @@ static int powerclamp_get_max_state(struct thermal_cooling_device *cdev, static int powerclamp_get_cur_state(struct thermal_cooling_device *cdev, unsigned long *state) { - if (true == clamping) - *state = pkg_cstate_ratio_cur; - else + if (clamping) { + if (poll_pkg_cstate_enable) + *state = pkg_cstate_ratio_cur; + else + *state = set_target_ratio; + } else { /* to save power, do not poll idle ratio while not clamping */ *state = -1; /* indicates invalid state */ + } return 0; } @@ -712,6 +721,9 @@ static int __init powerclamp_init(void) goto exit_unregister; } + if (topology_max_packages() == 1 && topology_max_die_per_package() == 1) + poll_pkg_cstate_enable = true; + cooling_dev = thermal_cooling_device_register("intel_powerclamp", NULL, &powerclamp_cooling_ops); if (IS_ERR(cooling_dev)) { -- 2.39.1

2 years, 2 months

2
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror February 2023