January 2024 - Linux-stable-mirror

[PATCH] Input: fix atomicity violation in gameport_run_poll_handler

by Gui-Dong Han

In gameport_run_poll_handler(): ... if (gameport->poll_cnt) mod_timer(&gameport->poll_timer, jiffies + ...)); In gameport_stop_polling(): spin_lock(&gameport->timer_lock); if (!--gameport->poll_cnt) del_timer(&gameport->poll_timer); spin_unlock(&gameport->timer_lock); An atomicity violation occurs due to the concurrent execution of gameport_run_poll_handler() and gameport_stop_polling(). The current check for gameport->poll_cnt in gameport_run_poll_handler() is not effective because poll_cnt can be decremented to 0 and del_timer can be called in gameport_stop_polling() before mod_timer is called in gameport_run_poll_handler(). This situation leads to the risk of calling mod_timer for a timer that has already been deleted in gameport_stop_polling(). Since calling mod_timer on a deleted timer reactivates it, this atomicity violation could result in the timer being activated while the poll_cnt value is 0. This possible bug is found by an experimental static analysis tool developed by our team, BassCheck[1]. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. The above possible bug is reported when our tool analyzes the source code of Linux 5.17. To resolve this issue, it is suggested to add a spinlock pair in gameport_run_poll_handler() to ensure atomicity. With this patch applied, our tool no longer reports the bug, with the kernel configuration allyesconfig for x86_64. Due to the absence of the requisite hardware, we are unable to conduct runtime testing of the patch. Therefore, our verification is solely based on code logic analysis. [1] https://sites.google.com/view/basscheck/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Gui-Dong Han <2045gemini(a)gmail.com> --- drivers/input/gameport/gameport.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c index 34f416a3ebcb..12af46d3c059 100644 --- a/drivers/input/gameport/gameport.c +++ b/drivers/input/gameport/gameport.c @@ -202,8 +202,13 @@ static void gameport_run_poll_handler(struct timer_list *t) struct gameport *gameport = from_timer(gameport, t, poll_timer); gameport->poll_handler(gameport); + + spin_lock(&gameport->timer_lock); + if (gameport->poll_cnt) mod_timer(&gameport->poll_timer, jiffies + msecs_to_jiffies(gameport->poll_interval)); + + spin_unlock(&gameport->timer_lock); } /* -- 2.34.1

1 year, 4 months

1
0
0 0

[PATCH] fix hugetlbfs hwpoison handling

by Sidhartha Kumar

has_extra_refcount() makes the assumption that a ref count of 1 means the page is not referenced by other users. Commit a08c7193e4f1 (mm/filemap: remove hugetlb special casing in filemap.c) modifies __filemap_add_folio() by calling folio_ref_add(folio, nr); for all cases (including hugtetlb) where nr is the number of pages in the folio. We should check if the page is not referenced by other users by checking the page count against the number of pages rather than 1. In hugetlbfs_read_iter(), folio_test_has_hwpoisoned() is testing the wrong flag as, in the hugetlb case, memory-failure code calls folio_test_set_hwpoison() to indicate poison. folio_test_hwpoison() is the correct function to test for that flag. After these fixes, the hugetlb hwpoison read selftest passes all cases. Fixes: a08c7193e4f1 ("mm/filemap: remove hugetlb special casing in filemap.c") Closes: https://lore.kernel.org/linux-mm/20230713001833.3778937-1-jiaqiyan@google.c… Cc: <stable(a)vger.kernel.org> # 6.7+ Signed-off-by: Sidhartha Kumar <sidhartha.kumar(a)oracle.com> Reported-by: Muhammad Usama Anjum <usama.anjum(a)collabora.com> Tested-by: Muhammad Usama Anjum <usama.anjum(a)collabora.com> --- fs/hugetlbfs/inode.c | 2 +- mm/memory-failure.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index 36132c9125f9..3a248e4f7e93 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -340,7 +340,7 @@ static ssize_t hugetlbfs_read_iter(struct kiocb *iocb, struct iov_iter *to) } else { folio_unlock(folio); - if (!folio_test_has_hwpoisoned(folio)) + if (!folio_test_hwpoison(folio)) want = nr; else { /* diff --git a/mm/memory-failure.c b/mm/memory-failure.c index d8c853b35dbb..87f6bf7d8bc1 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -973,7 +973,7 @@ struct page_state { static bool has_extra_refcount(struct page_state *ps, struct page *p, bool extra_pins) { - int count = page_count(p) - 1; + int count = page_count(p) - folio_nr_pages(page_folio(p)); if (extra_pins) count -= 1; -- 2.31.1

1 year, 4 months

2
2
0 0

Linux 5.10.206

by Greg Kroah-Hartman

I'm announcing the release of the 5.10.206 kernel. All users of the 5.10 kernel series must upgrade. The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml | 10 Makefile | 2 arch/arm/boot/dts/am33xx.dtsi | 1 arch/arm/mach-omap2/id.c | 5 arch/mips/Kconfig | 2 arch/mips/include/asm/mach-loongson64/boot_param.h | 3 arch/mips/loongson64/env.c | 10 arch/s390/include/asm/fpu/api.h | 2 arch/x86/kernel/alternative.c | 2 drivers/bus/ti-sysc.c | 18 + drivers/i2c/busses/i2c-aspeed.c | 48 ++-- drivers/iio/adc/ti_am335x_adc.c | 4 drivers/iio/common/ms_sensors/ms_sensors_i2c.c | 4 drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 4 drivers/input/keyboard/ipaq-micro-keys.c | 3 drivers/input/misc/soc_button_array.c | 5 drivers/interconnect/core.c | 3 drivers/md/dm-integrity.c | 11 - drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 5 drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 10 drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 drivers/net/ethernet/mellanox/mlx5/core/vport.c | 2 drivers/net/ethernet/micrel/ks8851.h | 3 drivers/net/ethernet/micrel/ks8851_common.c | 20 - drivers/net/ethernet/micrel/ks8851_spi.c | 42 ++- drivers/pinctrl/pinctrl-at91-pio4.c | 8 drivers/reset/core.c | 3 drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 9 drivers/scsi/scsi.c | 2 drivers/scsi/scsi_error.c | 34 +-- drivers/scsi/scsi_lib.c | 38 ++- drivers/scsi/scsi_logging.c | 18 - drivers/scsi/scsi_priv.h | 1 drivers/spi/spi-atmel.c | 133 +++--------- drivers/usb/host/fotg210-hcd.c | 3 drivers/usb/serial/ftdi_sio.c | 6 drivers/usb/serial/ftdi_sio_ids.h | 6 drivers/usb/serial/option.c | 5 fs/afs/cell.c | 6 fs/afs/dynroot.c | 31 +- fs/btrfs/ioctl.c | 9 fs/cifs/misc.c | 4 fs/cifs/smb2misc.c | 26 -- fs/cifs/smb2ops.c | 26 +- fs/cifs/smb2pdu.c | 29 ++ fs/cifs/smb2pdu.h | 2 include/linux/key-type.h | 1 include/net/bluetooth/hci_core.h | 5 include/net/bluetooth/mgmt.h | 2 include/scsi/scsi_cmnd.h | 29 ++ include/scsi/scsi_device.h | 16 - kernel/trace/ring_buffer.c | 12 - kernel/trace/synth_event_gen_test.c | 11 + kernel/trace/trace.c | 20 + lib/vsprintf.c | 11 - net/8021q/vlan_core.c | 9 net/9p/client.c | 7 net/9p/protocol.c | 17 + net/bluetooth/af_bluetooth.c | 7 net/bluetooth/hci_event.c | 3 net/bluetooth/l2cap_core.c | 21 + net/bluetooth/mgmt.c | 35 ++- net/bluetooth/smp.c | 161 ++++++++------- net/bluetooth/smp.h | 6 net/core/dev.c | 8 net/dns_resolver/dns_key.c | 10 net/ife/ife.c | 1 net/mac80211/mesh_plink.c | 10 net/netfilter/nf_tables_api.c | 2 net/rfkill/rfkill-gpio.c | 8 net/rose/af_rose.c | 39 +++ net/wireless/certs/wens.hex | 87 ++++++++ security/keys/gc.c | 31 +- security/keys/internal.h | 11 - security/keys/key.c | 15 - security/keys/proc.c | 2 sound/pci/hda/patch_hdmi.c | 2 78 files changed, 778 insertions(+), 443 deletions(-) Alexander Atanasov (1): scsi: core: Always send batch on reset or error handling command Alexis Lothoré (1): pinctrl: at91-pio4: use dedicated lock class for IRQ Alper Ak (1): USB: serial: option: add Quectel EG912Y module support Archie Pusaka (1): Bluetooth: use inclusive language in SMP Bart Van Assche (3): scsi: core: Introduce scsi_get_sector() scsi: core: Use scsi_cmd_to_rq() instead of scsi_cmnd.request scsi: core: Use a structure member to track the SCSI command submitter Chen-Yu Tsai (1): wifi: cfg80211: Add my certificate Christoffer Sandberg (1): Input: soc_button_array - add mapping for airplane mode button Dan Carpenter (1): usb: fotg210-hcd: delete an incorrect bounds test Dan Sneddon (2): spi: atmel: Switch to transfer_one transfer method spi: atmel: Fix CS and initialization bug David Howells (4): afs: Fix the dynamic root's d_delete to always delete unused dentries afs: Fix dynamic root lookup DNS check keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry afs: Fix overwriting of result of DNS query Eric Dumazet (3): net: sched: ife: fix potential use-after-free net/rose: fix races in rose_kill_by_device() net: check dev->gso_max_size in gso_features_check() Fabio Estevam (1): dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp Fedor Pchelkin (1): net: 9p: avoid freeing uninit memory in p9pdu_vreadf Frédéric Danis (1): Bluetooth: L2CAP: Send reject on command corrupted request Geert Uytterhoeven (1): reset: Fix crash when freeing non-existent optional resets Greg Kroah-Hartman (2): Revert "MIPS: Loongson64: Enable DMA noncoherent support" Linux 5.10.206 Hangyu Hua (1): 9p/net: fix possible memory leak in p9_check_errors() Haoran Liu (1): Input: ipaq-micro-keys - add error handling for devm_kmemdup Heiko Carstens (1): s390/vx: fix save/restore of fpu kernel context Heiner Kallweit (1): net: warn if gso_type isn't set for a GSO SKB Herve Codina (1): lib/vsprintf: Fix %pfwf when current node refcount == 0 Hyunwoo Kim (1): Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg Javier Carrasco (1): iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table Johannes Berg (2): wifi: mac80211: mesh_plink: fix matches_local logic wifi: cfg80211: fix certs build to not depend on file order Josef Bacik (1): btrfs: do not allow non subvolume root targets for snapshot Kai Vehmanen (2): ALSA: hda/hdmi: Add quirk to force pin connectivity on NUC10 ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB Kunwu Chan (1): ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init Liu Jian (1): net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() Luiz Augusto von Dentz (3): Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent Bluetooth: SMP: Convert BT_ERR/BT_DBG to bt_dev_err/bt_dev_dbg Bluetooth: SMP: Fix crash when receiving new connection when debug is enabled Mark Glover (1): USB: serial: ftdi_sio: update Actisense PIDs constant names Martin K. Petersen (2): scsi: core: Add scsi_prot_ref_tag() helper scsi: core: Make scsi_get_lba() return the LBA Mike Tipton (1): interconnect: Treat xlate() returning NULL node as an error Mikulas Patocka (1): dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata() Moshe Shemesh (1): net/mlx5: Fix fw tracer first block check Namjae Jeon (1): ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE Pablo Neira Ayuso (1): netfilter: nf_tables: skip set commit for deleted/destroyed sets Paulo Alcantara (4): smb: client: fix OOB in smb2_query_reparse_point() smb: client: fix NULL deref in asn1_ber_decoder() smb: client: fix OOB in SMB2_query_info_init() smb: client: fix OOB in smbCalcSize() Quan Nguyen (1): i2c: aspeed: Handle the coalesced stop conditions with the start conditions. Rahul Rameshbabu (1): net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors Reinhard Speyerer (1): USB: serial: option: add Quectel RM500Q R13 firmware support Ronald Wahl (1): net: ks8851: Fix TX stall caused by TX buffer overrun Rouven Czerwinski (1): net: rfkill: gpio: set GPIO direction Shifeng Li (1): net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list() Slark Xiao (1): USB: serial: option: add Foxconn T99W265 with new baseline Steven Rostedt (Google) (3): tracing / synthetic: Disable events after testing in synth_event_gen_test_init() ring-buffer: Fix wake ups when buffer_percent is set to 100 tracing: Fix blocked reader of snapshot buffer Su Hui (1): iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw Thomas Gleixner (1): x86/alternatives: Sync core before enabling interrupts Tony Lindgren (2): bus: ti-sysc: Flush posted write only after srst_udelay ARM: dts: Fix occasional boot hang for am3 usb Ville Baillie (1): spi: atmel: Fix PDC transfer setup bug Vlad Buslov (1): Revert "net/mlx5e: fix double free of encap_header" Wadim Egorov (1): iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma() Wei Yongjun (1): scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() Xiao Yao (1): Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE Zhipeng Lu (1): ethernet: atheros: fix a memleak in atl1e_setup_ring_resources

1 year, 4 months

3
6
0 0

[PATCH mm-unstable v1 1/4] mm/mglru: fix underprotected page cache

by Yu Zhao

Unmapped folios accessed through file descriptors can be underprotected. Those folios are added to the oldest generation based on: 1. The fact that they are less costly to reclaim (no need to walk the rmap and flush the TLB) and have less impact on performance (don't cause major PFs and can be non-blocking if needed again). 2. The observation that they are likely to be single-use. E.g., for client use cases like Android, its apps parse configuration files and store the data in heap (anon); for server use cases like MySQL, it reads from InnoDB files and holds the cached data for tables in buffer pools (anon). However, the oldest generation can be very short lived, and if so, it doesn't provide the PID controller with enough time to respond to a surge of refaults. (Note that the PID controller uses weighted refaults and those from evicted generations only take a half of the whole weight.) In other words, for a short lived generation, the moving average smooths out the spike quickly. To fix the problem: 1. For folios that are already on LRU, if they can be beyond the tracking range of tiers, i.e., five accesses through file descriptors, move them to the second oldest generation to give them more time to age. (Note that tiers are used by the PID controller to statistically determine whether folios accessed multiple times through file descriptors are worth protecting.) 2. When adding unmapped folios to LRU, adjust the placement of them so that they are not too close to the tail. The effect of this is similar to the above. On Android, launching 55 apps sequentially: Before After Change workingset_refault_anon 25641024 25598972 0% workingset_refault_file 115016834 106178438 -8% Fixes: ac35a4902374 ("mm: multi-gen LRU: minimal implementation") Signed-off-by: Yu Zhao <yuzhao(a)google.com> Reported-by: Charan Teja Kalla <quic_charante(a)quicinc.com> Tested-by: Kalesh Singh <kaleshsingh(a)google.com> Cc: stable(a)vger.kernel.org --- include/linux/mm_inline.h | 23 ++++++++++++++--------- mm/vmscan.c | 2 +- mm/workingset.c | 6 +++--- 3 files changed, 18 insertions(+), 13 deletions(-) diff --git a/include/linux/mm_inline.h b/include/linux/mm_inline.h index 9ae7def16cb2..f4fe593c1400 100644 --- a/include/linux/mm_inline.h +++ b/include/linux/mm_inline.h @@ -232,22 +232,27 @@ static inline bool lru_gen_add_folio(struct lruvec *lruvec, struct folio *folio, if (folio_test_unevictable(folio) || !lrugen->enabled) return false; /* - * There are three common cases for this page: - * 1. If it's hot, e.g., freshly faulted in or previously hot and - * migrated, add it to the youngest generation. - * 2. If it's cold but can't be evicted immediately, i.e., an anon page - * not in swapcache or a dirty page pending writeback, add it to the - * second oldest generation. - * 3. Everything else (clean, cold) is added to the oldest generation. + * There are four common cases for this page: + * 1. If it's hot, i.e., freshly faulted in, add it to the youngest + * generation, and it's protected over the rest below. + * 2. If it can't be evicted immediately, i.e., a dirty page pending + * writeback, add it to the second youngest generation. + * 3. If it should be evicted first, e.g., cold and clean from + * folio_rotate_reclaimable(), add it to the oldest generation. + * 4. Everything else falls between 2 & 3 above and is added to the + * second oldest generation if it's considered inactive, or the + * oldest generation otherwise. See lru_gen_is_active(). */ if (folio_test_active(folio)) seq = lrugen->max_seq; else if ((type == LRU_GEN_ANON && !folio_test_swapcache(folio)) || (folio_test_reclaim(folio) && (folio_test_dirty(folio) || folio_test_writeback(folio)))) - seq = lrugen->min_seq[type] + 1; - else + seq = lrugen->max_seq - 1; + else if (reclaiming || lrugen->min_seq[type] + MIN_NR_GENS >= lrugen->max_seq) seq = lrugen->min_seq[type]; + else + seq = lrugen->min_seq[type] + 1; gen = lru_gen_from_seq(seq); flags = (gen + 1UL) << LRU_GEN_PGOFF; diff --git a/mm/vmscan.c b/mm/vmscan.c index 4e3b835c6b4a..e67631c60ac0 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -4260,7 +4260,7 @@ static bool sort_folio(struct lruvec *lruvec, struct folio *folio, struct scan_c } /* protected */ - if (tier > tier_idx) { + if (tier > tier_idx || refs == BIT(LRU_REFS_WIDTH)) { int hist = lru_hist_from_seq(lrugen->min_seq[type]); gen = folio_inc_gen(lruvec, folio, false); diff --git a/mm/workingset.c b/mm/workingset.c index 7d3dacab8451..2a2a34234df9 100644 --- a/mm/workingset.c +++ b/mm/workingset.c @@ -313,10 +313,10 @@ static void lru_gen_refault(struct folio *folio, void *shadow) * 1. For pages accessed through page tables, hotter pages pushed out * hot pages which refaulted immediately. * 2. For pages accessed multiple times through file descriptors, - * numbers of accesses might have been out of the range. + * they would have been protected by sort_folio(). */ - if (lru_gen_in_fault() || refs == BIT(LRU_REFS_WIDTH)) { - folio_set_workingset(folio); + if (lru_gen_in_fault() || refs >= BIT(LRU_REFS_WIDTH) - 1) { + set_mask_bits(&folio->flags, 0, LRU_REFS_MASK | BIT(PG_workingset)); mod_lruvec_state(lruvec, WORKINGSET_RESTORE_BASE + type, delta); } unlock: -- 2.43.0.472.g3155946c3a-goog

1 year, 4 months

3
30
0 0

+ selftests-mm-mremap_test-fix-build-warning.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: selftests/mm: mremap_test: fix build warning has been added to the -mm mm-hotfixes-unstable branch. Its filename is selftests-mm-mremap_test-fix-build-warning.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Muhammad Usama Anjum <usama.anjum(a)collabora.com> Subject: selftests/mm: mremap_test: fix build warning Date: Thu, 11 Jan 2024 13:20:38 +0500 Fix following build warning: warning: format `%d' expects argument of type `int', but argument 2 has type `long long unsigned int' Link: https://lkml.kernel.org/r/20240111082039.3398848-1-usama.anjum@collabora.com Fixes: a4cb3b243343 ("selftests: mm: add a test for remapping to area immediately after existing mapping") Signed-off-by: Muhammad Usama Anjum <usama.anjum(a)collabora.com> Cc: Joel Fernandes (Google) <joel(a)joelfernandes.org> Cc: Lorenzo Stoakes <lstoakes(a)gmail.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- tools/testing/selftests/mm/mremap_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/tools/testing/selftests/mm/mremap_test.c~selftests-mm-mremap_test-fix-build-warning +++ a/tools/testing/selftests/mm/mremap_test.c @@ -457,7 +457,7 @@ static long long remap_region(struct con char c = (char) rand(); if (((char *) dest_preamble_addr)[i] != c) { - ksft_print_msg("Preamble data after remap doesn't match at offset %d\n", + ksft_print_msg("Preamble data after remap doesn't match at offset %llu\n", i); ksft_print_msg("Expected: %#x\t Got: %#x\n", c & 0xff, ((char *) dest_preamble_addr)[i] & 0xff); _ Patches currently in -mm which might be from usama.anjum(a)collabora.com are fs-proc-task_mmu-move-mmu-notification-mechanism-inside-mm-lock.patch selftests-mm-mremap_test-fix-build-warning.patch

1 year, 4 months

1
0
0 0

+ fix-hugetlbfs-hwpoison-handling.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: fs/hugetlbfs/inode.c: mm/memory-failure.c has been added to the -mm mm-hotfixes-unstable branch. Its filename is fix-hugetlbfs-hwpoison-handling.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Sidhartha Kumar <sidhartha.kumar(a)oracle.com> Subject: fs/hugetlbfs/inode.c: mm/memory-failure.c fix hugetlbfs hwpoison handling Date: Thu, 11 Jan 2024 11:16:55 -0800 has_extra_refcount() makes the assumption that a ref count of 1 means the page is not referenced by other users. Commit a08c7193e4f1 (mm/filemap: remove hugetlb special casing in filemap.c) modifies __filemap_add_folio() by calling folio_ref_add(folio, nr); for all cases (including hugtetlb) where nr is the number of pages in the folio. We should check if the page is not referenced by other users by checking the page count against the number of pages rather than 1. In hugetlbfs_read_iter(), folio_test_has_hwpoisoned() is testing the wrong flag as, in the hugetlb case, memory-failure code calls folio_test_set_hwpoison() to indicate poison. folio_test_hwpoison() is the correct function to test for that flag. After these fixes, the hugetlb hwpoison read selftest passes all cases. Link: https://lkml.kernel.org/r/20240111191655.295530-1-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar <sidhartha.kumar(a)oracle.com> Fixes: a08c7193e4f1 ("mm/filemap: remove hugetlb special casing in filemap.c") Closes: https://lore.kernel.org/linux-mm/20230713001833.3778937-1-jiaqiyan@google.c… Reported-by: Muhammad Usama Anjum <usama.anjum(a)collabora.com> Tested-by: Muhammad Usama Anjum <usama.anjum(a)collabora.com> Cc: James Houghton <jthoughton(a)google.com> Cc: Jiaqi Yan <jiaqiyan(a)google.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Miaohe Lin <linmiaohe(a)huawei.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Naoya Horiguchi <naoya.horiguchi(a)nec.com> Cc: Yang Shi <shy828301(a)gmail.com> Cc: <stable(a)vger.kernel.org> [6.7+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/hugetlbfs/inode.c | 2 +- mm/memory-failure.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) --- a/fs/hugetlbfs/inode.c~fix-hugetlbfs-hwpoison-handling +++ a/fs/hugetlbfs/inode.c @@ -340,7 +340,7 @@ static ssize_t hugetlbfs_read_iter(struc } else { folio_unlock(folio); - if (!folio_test_has_hwpoisoned(folio)) + if (!folio_test_hwpoison(folio)) want = nr; else { /* --- a/mm/memory-failure.c~fix-hugetlbfs-hwpoison-handling +++ a/mm/memory-failure.c @@ -979,7 +979,7 @@ struct page_state { static bool has_extra_refcount(struct page_state *ps, struct page *p, bool extra_pins) { - int count = page_count(p) - 1; + int count = page_count(p) - folio_nr_pages(page_folio(p)); if (extra_pins) count -= 1; _ Patches currently in -mm which might be from sidhartha.kumar(a)oracle.com are fix-hugetlbfs-hwpoison-handling.patch maple_tree-fix-comment-describing-mas_node_count_gfp.patch

1 year, 4 months

1
0
0 0

[PATCH v2] drm/amd/display: Fix late derefrence 'dsc' check in 'link_set_dsc_pps_packet()'

by Srinivasan Shanmugam

In link_set_dsc_pps_packet(), 'struct display_stream_compressor *dsc' was dereferenced in a DC_LOGGER_INIT(dsc->ctx->logger); before the 'dsc' NULL pointer check. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/dc/link/link_dpms.c:905 link_set_dsc_pps_packet() warn: variable dereferenced before check 'dsc' (see line 903) Cc: stable(a)vger.kernel.org Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Cc: Wenjing Liu <wenjing.liu(a)amd.com> Cc: Qingqing Zhuo <qingqing.zhuo(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> --- v2: - Corrected the logic when !pipe_ctx->stream->timing.flags.DSC is true, still skipping the !dsc NULL check drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c index 3de148004c06..d084ac0d30b2 100644 --- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c +++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c @@ -900,11 +900,15 @@ bool link_set_dsc_pps_packet(struct pipe_ctx *pipe_ctx, bool enable, bool immedi { struct display_stream_compressor *dsc = pipe_ctx->stream_res.dsc; struct dc_stream_state *stream = pipe_ctx->stream; - DC_LOGGER_INIT(dsc->ctx->logger); - if (!pipe_ctx->stream->timing.flags.DSC || !dsc) + if (!pipe_ctx->stream->timing.flags.DSC) + return false; + + if(!dsc) return false; + DC_LOGGER_INIT(dsc->ctx->logger); + if (enable) { struct dsc_config dsc_cfg; uint8_t dsc_packed_pps[128]; -- 2.34.1

1 year, 4 months

2
1
0 0

EXT4-fs: Intermitent segfault with memory corruption

by Allen

Hello Ext4 Developers, I hope this email finds you well. We are reaching out to report a persistent issue that we have been facing on Windows Subsystem for Linux (WSL)[1] with various kernel versions. We have encountered the problem on kernel versions v5.15, v6.1, v6.6 stable kernels, and also the current upstream kernel. While the issue takes longer to reproduce on v5.15, it is consistently observable across these versions. Issue Description: Intermittent segfault with memory corruption. The time of segfault and output can vary, though one of the notable failures manifests as a segfault with the following error message: EXT4-fs error (device sdc): ext4_find_dest_de:2092: inode #32168: block 2334198: comm dpkg: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=4084 fake=0 and EXT4-fs warning (device sdc): dx_probe:890: inode #27771: comm dpkg: dx entry: limit 0 != root limit 508 EXT4-fs warning (device sdc): dx_probe:964: inode #27771: comm dpkg: Corrupt directory, running e2fsck is recommended EXT4-fs error (device sdc): ext4_empty_dir:3098: inode #27753: block 133944722: comm dpkg: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=4096 fake=0 or we see a segfault message where the source can change depending on which command we're testing with (dpkg, apt, gcc..): dpkg[135]: segfault at 0 ip 00007f9209eb6a19 sp 00007ffd8a6a0b08 error 4 in libc-2.31.so[7f9209d6e000+159000] likely on CPU 1 (core 0, socket 0) Reproduction Steps: The steps to reproduce the issue are seemingly straightforward: Run an install or upgrade. The larger the change the better. Installing Gimp has been a go to for testing, though we have reproduced the failure with: - apt upgrade - apt install - dpkg install - gcc building source files Observations: The issue occurs consistently across multiple kernel versions. Reproduction is faster on more recent kernels. Longer intervals are required for v5.15. When adding more debugging options that increases processing time, segfault seems to be harder to hit. When DX_DEBUG is enabled, during the installation process(dpkg install), we observed instances where both rlen and de->name_len values become 0. We wanted to bring this to your attention and seek guidance on how we could proceed with debugging and resolving this issue. Your insights and assistance would be greatly appreciated. Thank you for your time and consideration. [1] What is Windows Subsystem for Linux: https://learn.microsoft.com/en-us/windows/wsl/about -- - Allen

1 year, 4 months

2
1
0 0

[PATCH v4] net: stmmac: Prevent DSA tags from breaking COE

by Romain Gantois

Some DSA tagging protocols change the EtherType field in the MAC header e.g. DSA_TAG_PROTO_(DSA/EDSA/BRCM/MTK/RTL4C_A/SJA1105). On TX these tagged frames are ignored by the checksum offload engine and IP header checker of some stmmac cores. On RX, the stmmac driver wrongly assumes that checksums have been computed for these tagged packets, and sets CHECKSUM_UNNECESSARY. Add an additional check in the stmmac TX and RX hotpaths so that COE is deactivated for packets with ethertypes that will not trigger the COE and IP header checks. Fixes: 6b2c6e4a938f ("net: stmmac: propagate feature flags to vlan") Cc: <stable(a)vger.kernel.org> Reported-by: Richard Tresidder <rtresidd(a)electromag.com.au> Link: https://lore.kernel.org/netdev/e5c6c75f-2dfa-4e50-a1fb-6bf4cdb617c2@electro… Reported-by: Romain Gantois <romain.gantois(a)bootlin.com> Link: https://lore.kernel.org/netdev/c57283ed-6b9b-b0e6-ee12-5655c1c54495@bootlin… Reviewed-by: Vladimir Oltean <vladimir.oltean(a)nxp.com> Signed-off-by: Romain Gantois <romain.gantois(a)bootlin.com> --- Hello everyone, This is the fourth version of my proposed fix for the stmmac checksum offloading issue that has recently been reported. significant changes in v4: - Removed "inline" from declaration of stmmac_has_ip_ethertype significant changes in v3: - Use __vlan_get_protocol to make sure that 8021Q-encapsulated traffic is checked correctly. significant changes in v2: - Replaced the stmmac_link_up-based fix with an ethertype check in the TX and RX hotpaths. The Checksum Offloading Engine of some stmmac cores (e.g. DWMAC1000) computes an incorrect checksum when presented with DSA-tagged packets. This causes all TCP/UDP transfers to break when the stmmac device is connected to the CPU port of a DSA switch. I ran some tests using different tagging protocols with DSA_LOOP, and all of the protocols that set a custom ethertype field in the MAC header caused the checksum offload engine to ignore the tagged packets. On TX, this caused packets to egress with incorrect checksums. On RX, these packets were similarly ignored by the COE, yet the stmmac driver set CHECKSUM_UNNECESSARY, wrongly assuming that their checksums had been verified in hardware. Version 2 of this patch series fixes this issue by checking ethertype fields in both the TX and RX hotpaths of the stmmac driver. On TX, if a non-IP ethertype is detected, the packet is checksummed in software. On RX, the same condition causes stmmac to avoid setting CHECKSUM_UNNECESSARY. To measure the performance degradation to the TX/RX hotpaths, I did some iperf3 runs with 512-byte unfragmented UDP packets. measured degradation on TX: -466 pps (-0.2%) on RX: -338 pps (-1.2%) original performances on TX: 22kpps on RX: 27kpps The performance hit on the RX path can be partly explained by the fact that the stmmac driver doesn't set CHECKSUM_UNNECESSARY anymore. The TX performance degradation observed in v2 seems to have improved. It's not entirely clear to me why that is. Best Regards, Romain Romain Gantois (1): net: stmmac: Prevent DSA tags from breaking COE .../net/ethernet/stmicro/stmmac/stmmac_main.c | 23 ++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) -- 2.43.0 --- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 29 ++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index 37e64283f910..b30dba06dbd1 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -4371,6 +4371,25 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev) return NETDEV_TX_OK; } +/** + * stmmac_has_ip_ethertype() - Check if packet has IP ethertype + * @skb: socket buffer to check + * + * Check if a packet has an ethertype that will trigger the IP header checks + * and IP/TCP checksum engine of the stmmac core. + * + * Return: true if the ethertype can trigger the checksum engine, false otherwise + */ +static bool stmmac_has_ip_ethertype(struct sk_buff *skb) +{ + int depth = 0; + __be16 proto; + + proto = __vlan_get_protocol(skb, eth_header_parse_protocol(skb), &depth); + + return (depth <= ETH_HLEN) && (proto == htons(ETH_P_IP) || proto == htons(ETH_P_IPV6)); +} + /** * stmmac_xmit - Tx entry point of the driver * @skb : the socket buffer @@ -4435,9 +4454,13 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev) /* DWMAC IPs can be synthesized to support tx coe only for a few tx * queues. In that case, checksum offloading for those queues that don't * support tx coe needs to fallback to software checksum calculation. + * + * Packets that won't trigger the COE e.g. most DSA-tagged packets will + * also have to be checksummed in software. */ if (csum_insertion && - priv->plat->tx_queues_cfg[queue].coe_unsupported) { + (priv->plat->tx_queues_cfg[queue].coe_unsupported || + !stmmac_has_ip_ethertype(skb))) { if (unlikely(skb_checksum_help(skb))) goto dma_map_err; csum_insertion = !csum_insertion; @@ -4997,7 +5020,7 @@ static void stmmac_dispatch_skb_zc(struct stmmac_priv *priv, u32 queue, stmmac_rx_vlan(priv->dev, skb); skb->protocol = eth_type_trans(skb, priv->dev); - if (unlikely(!coe)) + if (unlikely(!coe) || !stmmac_has_ip_ethertype(skb)) skb_checksum_none_assert(skb); else skb->ip_summed = CHECKSUM_UNNECESSARY; @@ -5513,7 +5536,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) stmmac_rx_vlan(priv->dev, skb); skb->protocol = eth_type_trans(skb, priv->dev); - if (unlikely(!coe)) + if (unlikely(!coe) || !stmmac_has_ip_ethertype(skb)) skb_checksum_none_assert(skb); else skb->ip_summed = CHECKSUM_UNNECESSARY; --- base-commit: ac631873c9e7a50d2a8de457cfc4b9f86666403e change-id: 20240108-prevent_dsa_tags-7bb0def0db81 Best regards, -- Romain Gantois <romain.gantois(a)bootlin.com>

1 year, 4 months

3
3
0 0

[PATCH v3 6/6] s390/vfio-ap: do not reset queue removed from host config

by Tony Krowiak

When a queue is unbound from the vfio_ap device driver, it is reset to ensure its crypto data is not leaked when it is bound to another device driver. If the queue is unbound due to the fact that the adapter or domain was removed from the host's AP configuration, then attempting to reset it will fail with response code 01 (APID not valid) getting returned from the reset command. Let's ensure that the queue is assigned to the host's configuration before resetting it. Signed-off-by: Tony Krowiak <akrowiak(a)linux.ibm.com> Reviewed-by: Jason J. Herne <jjherne(a)linux.ibm.com> Reviewed-by: Halil Pasic <pasic(a)linux.ibm.com> Fixes: eeb386aeb5b7 ("s390/vfio-ap: handle config changed and scan complete notification") Cc: <stable(a)vger.kernel.org> --- drivers/s390/crypto/vfio_ap_ops.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c index e014108067dc..84decb0d5c97 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2197,6 +2197,8 @@ void vfio_ap_mdev_remove_queue(struct ap_device *apdev) q = dev_get_drvdata(&apdev->device); get_update_locks_for_queue(q); matrix_mdev = q->matrix_mdev; + apid = AP_QID_CARD(q->apqn); + apqi = AP_QID_QUEUE(q->apqn); if (matrix_mdev) { /* If the queue is assigned to the guest's AP configuration */ @@ -2214,8 +2216,16 @@ void vfio_ap_mdev_remove_queue(struct ap_device *apdev) } } - vfio_ap_mdev_reset_queue(q); - flush_work(&q->reset_work); + /* + * If the queue is not in the host's AP configuration, then resetting + * it will fail with response code 01, (APQN not valid); so, let's make + * sure it is in the host's config. + */ + if (test_bit_inv(apid, (unsigned long *)matrix_dev->info.apm) && + test_bit_inv(apqi, (unsigned long *)matrix_dev->info.aqm)) { + vfio_ap_mdev_reset_queue(q); + flush_work(&q->reset_work); + } done: if (matrix_mdev) -- 2.43.0

1 year, 4 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror January 2024