April 2024 - Linux-stable-mirror

by Mario Limonciello

Hi, The Framework 13 quirk for s2idle got extended to cover another BIOS version very recently. Can you please backport this to 6.6.y and later as well? f609e7b1b49e ("platform/x86/amd/pmc: Extend Framework 13 quirk to more BIOSes") Thanks,

1 year, 2 months

1
0
0 0

Linux 6.6.28

by Greg Kroah-Hartman

I'm announcing the release of the 6.6.28 kernel. All users of the 6.6 kernel series must upgrade. The updated 6.6.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/admin-guide/hw-vuln/spectre.rst | 22 Documentation/admin-guide/kernel-parameters.txt | 12 Documentation/networking/device_drivers/ethernet/amazon/ena.rst | 1 Makefile | 2 arch/arm/boot/dts/nxp/imx/imx7s-warp.dts | 1 arch/arm/mach-omap2/board-n8x0.c | 23 arch/arm64/boot/dts/freescale/imx8-ss-conn.dtsi | 16 arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi | 36 arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi | 16 arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi | 8 arch/x86/Kconfig | 21 arch/x86/events/core.c | 1 arch/x86/include/asm/apic.h | 3 arch/x86/kernel/apic/apic.c | 6 arch/x86/kernel/cpu/bugs.c | 82 - arch/x86/kernel/cpu/common.c | 48 block/blk-cgroup.c | 9 block/blk-cgroup.h | 2 block/blk-core.c | 2 drivers/accel/ivpu/ivpu_drv.c | 2 drivers/acpi/scan.c | 3 drivers/ata/libata-core.c | 2 drivers/ata/libata-scsi.c | 9 drivers/cxl/core/mbox.c | 5 drivers/cxl/core/regs.c | 5 drivers/firmware/arm_scmi/raw_mode.c | 7 drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 drivers/gpu/drm/amd/amdgpu/soc21.c | 27 drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 1 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 15 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c | 19 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 12 drivers/gpu/drm/ast/ast_dp.c | 3 drivers/gpu/drm/drm_client_modeset.c | 3 drivers/gpu/drm/i915/display/intel_cdclk.c | 7 drivers/gpu/drm/i915/display/intel_cdclk.h | 3 drivers/gpu/drm/i915/display/intel_ddi.c | 5 drivers/gpu/drm/i915/display/intel_vrr.c | 7 drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 10 drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowof.c | 7 drivers/gpu/drm/panfrost/panfrost_mmu.c | 13 drivers/gpu/drm/qxl/qxl_release.c | 50 drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 11 drivers/iommu/intel/perfmon.c | 2 drivers/iommu/intel/svm.c | 2 drivers/md/raid1.c | 2 drivers/media/cec/core/cec-adap.c | 14 drivers/mmc/host/omap.c | 48 drivers/net/dsa/mt7530.c | 229 ++- drivers/net/dsa/mt7530.h | 5 drivers/net/ethernet/amazon/ena/Makefile | 2 drivers/net/ethernet/amazon/ena/ena_com.c | 2 drivers/net/ethernet/amazon/ena/ena_ethtool.c | 1 drivers/net/ethernet/amazon/ena/ena_netdev.c | 688 ---------- drivers/net/ethernet/amazon/ena/ena_netdev.h | 83 - drivers/net/ethernet/amazon/ena/ena_xdp.c | 466 ++++++ drivers/net/ethernet/amazon/ena/ena_xdp.h | 152 ++ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 6 drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 20 drivers/net/ethernet/marvell/octeontx2/nic/qos.c | 1 drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h | 8 drivers/net/ethernet/mellanox/mlx5/core/en/qos.c | 33 drivers/net/ethernet/mellanox/mlx5/core/en/selq.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 7 drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 17 drivers/net/ethernet/mellanox/mlx5/core/main.c | 37 drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c | 4 drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c | 22 drivers/net/ethernet/micrel/ks8851.h | 3 drivers/net/ethernet/micrel/ks8851_common.c | 16 drivers/net/ethernet/micrel/ks8851_par.c | 11 drivers/net/ethernet/micrel/ks8851_spi.c | 11 drivers/net/ethernet/microchip/sparx5/sparx5_port.c | 4 drivers/net/geneve.c | 4 drivers/platform/chrome/cros_ec_uart.c | 28 drivers/scsi/hisi_sas/hisi_sas_main.c | 2 drivers/scsi/qla2xxx/qla_edif.c | 2 drivers/scsi/sg.c | 20 drivers/vhost/vhost.c | 24 fs/btrfs/delayed-inode.c | 3 fs/btrfs/inode.c | 13 fs/btrfs/ioctl.c | 37 fs/btrfs/qgroup.c | 2 fs/btrfs/root-tree.c | 10 fs/btrfs/root-tree.h | 2 fs/btrfs/transaction.c | 17 fs/smb/client/cached_dir.c | 4 include/linux/dma-fence.h | 7 include/linux/irqflags.h | 2 include/linux/u64_stats_sync.h | 9 include/net/addrconf.h | 4 include/net/af_unix.h | 2 include/net/bluetooth/bluetooth.h | 11 include/net/ip_tunnels.h | 33 io_uring/net.c | 1 kernel/cpu.c | 3 kernel/kprobes.c | 18 kernel/power/suspend.c | 6 kernel/trace/ring_buffer.c | 6 kernel/trace/trace_events.c | 4 net/batman-adv/translation-table.c | 2 net/bluetooth/hci_request.c | 4 net/bluetooth/hci_sync.c | 66 net/bluetooth/iso.c | 14 net/bluetooth/l2cap_core.c | 3 net/bluetooth/sco.c | 23 net/ipv4/netfilter/arp_tables.c | 4 net/ipv4/netfilter/ip_tables.c | 4 net/ipv4/route.c | 4 net/ipv6/addrconf.c | 7 net/ipv6/ip6_fib.c | 7 net/ipv6/netfilter/ip6_tables.c | 4 net/openvswitch/conntrack.c | 5 net/unix/af_unix.c | 8 net/unix/garbage.c | 35 net/unix/scm.c | 8 net/xdp/xsk.c | 2 tools/testing/selftests/net/mptcp/mptcp_connect.sh | 53 tools/testing/selftests/net/mptcp/mptcp_join.sh | 30 tools/testing/selftests/timers/posix_timers.c | 2 122 files changed, 1750 insertions(+), 1250 deletions(-) Aaro Koskinen (6): ARM: OMAP2+: fix bogus MMC GPIO labels on Nokia N8x0 ARM: OMAP2+: fix N810 MMC gpiod table mmc: omap: fix broken slot switch lookup mmc: omap: fix deferred probe mmc: omap: restore original power up/down steps ARM: OMAP2+: fix USB regression on Nokia N8x0 Adam Dunlap (1): x86/apic: Force native_apic_mem_read() to use the MOV instruction Alex Constantino (1): Revert "drm/qxl: simplify qxl_fence_wait" Alex Deucher (1): drm/amdgpu: always force full reset for SOC21 Alexander Wetzel (2): scsi: sg: Avoid sg device teardown race scsi: sg: Avoid race in error handling & drop bogus warn Anna-Maria Behnsen (1): PM: s2idle: Make sure CPUs will wakeup directly on resume Archie Pusaka (1): Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit Arnd Bergmann (5): nouveau: fix function cast warning ipv6: fib: hide unused 'pn' variable ipv4/route: avoid unused-but-set-variable warning tracing: hide unused ftrace_event_id_fops irqflags: Explicitly ignore lockdep_hrtimer_exit() argument Arınç ÜNAL (1): net: dsa: mt7530: trap link-local frames regardless of ST Port State Boris Brezillon (1): drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr() Boris Burkov (4): btrfs: qgroup: correctly model root qgroup rsv in convert btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations btrfs: record delayed inode root in transaction btrfs: qgroup: convert PREALLOC to PERTRANS after record_root_in_trans Carolina Jubran (2): net/mlx5e: Fix mlx5e_priv_init() cleanup flow net/mlx5e: HTB, Fix inconsistencies with QoS SQs number Cosmin Ratiu (2): net/mlx5: Properly link new fs rules into the tree net/mlx5: Correctly compare pkt reformat ids Cristian Marussi (1): firmware: arm_scmi: Make raw debugfs entries non-seekable Damien Le Moal (1): ata: libata-scsi: Fix ata_scsi_dev_rescan() error path Dan Carpenter (1): scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() Daniel Machon (1): net: sparx5: fix wrong config being used when reconfiguring PCS Daniel Sneddon (1): x86/bugs: Fix return type of spectre_bhi_state() Dave Jiang (1): cxl/core/regs: Fix usage of map->reg_type in cxl_decode_regblock() before assigned David Arinzon (7): net: ena: Fix potential sign extension issue net: ena: Wrong missing IO completions check order net: ena: Fix incorrect descriptor free behavior net: ena: Move XDP code to its new files net: ena: Pass ena_adapter instead of net_device to ena_xmit_common() net: ena: Use tx_ring instead of xdp_ring for XDP channel TX net: ena: Set tx_info->xdpf value to NULL Dmitry Antipov (1): Bluetooth: Fix memory leak in hci_req_sync_complete() Dmitry Baryshkov (1): drm/msm/dpu: don't allow overriding data from catalog Eric Dumazet (3): xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING geneve: fix header validation in geneve[6]_xmit_skb netfilter: complete validation of user input Fabio Estevam (1): ARM: dts: imx7s-warp: Pass OV2680 link-frequencies Frank Li (7): arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order arm64: dts: imx8qm-ss-dma: fix can lpcg indices arm64: dts: imx8-ss-dma: fix can lpcg indices arm64: dts: imx8-ss-dma: fix adc lpcg indices arm64: dts: imx8-ss-conn: fix usb lpcg indices arm64: dts: imx8-ss-lsio: fix pwm lpcg indices arm64: dts: imx8-ss-dma: fix spi lpcg indices Fudongwang (1): drm/amd/display: fix disable otg wa logic in DCN316 Gavin Shan (2): vhost: Add smp_rmb() in vhost_vq_avail_empty() vhost: Add smp_rmb() in vhost_enable_notify() Geetha sowjanya (1): octeontx2-af: Fix NIX SQ mode and BP config Geliang Tang (1): selftests: mptcp: use += operator to append strings Gerd Bayer (2): s390/ism: fix receive message buffer allocation Revert "s390/ism: fix receive message buffer allocation" Greg Kroah-Hartman (1): Linux 6.6.28 Hans de Goede (1): ACPI: scan: Do not increase dep_unmet for already met dependencies Hariprasad Kelam (1): octeontx2-pf: Fix transmit scheduler resource leak Harish Kasiviswanathan (1): drm/amdkfd: Reset GPU on queue preemption failure Harry Wentland (2): drm/amd/display: Program VSC SDP colorimetry for all DP sinks >= 1.4 drm/amd/display: Set VSC SDP Colorimetry same way for MST and SST Igor Pylypiv (1): ata: libata-core: Allow command duration limits detection for ACS-4 drives Ilya Maximets (1): net: openvswitch: fix unwanted error log on timeout policy probing Ingo Molnar (1): x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' Jacek Lawrynowicz (1): accel/ivpu: Fix deadlock in context_xa Jacob Pan (1): iommu/vt-d: Allocate local memory for page request queue Jammy Huang (1): drm/ast: Fix soft lockup Jiri Benc (1): ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr John Stultz (1): selftests: timers: Fix abs() warning in posix_timers test Josh Poimboeuf (6): x86/bugs: Fix BHI documentation x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES x86/bugs: Fix BHI handling of RRSBA x86/bugs: Clarify that syscall hardening isn't a BHI mitigation x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI Kuniyuki Iwashima (2): af_unix: Clear stale u->oob_skb. af_unix: Do not use atomic ops for unix_sk(sk)->inflight. Kwangjin Ko (1): cxl/core: Fix initialization of mbox_cmd.size_out in get event Lijo Lazar (1): drm/amdgpu: Reset dGPU if suspend got aborted Luiz Augusto von Dentz (5): Bluetooth: ISO: Align broadcast sync_timeout with connection timeout Bluetooth: ISO: Don't reject BT_ISO_QOS if parameters are unset Bluetooth: hci_sync: Use QoS to determine which PHY to scan Bluetooth: hci_sync: Fix using the same interval and window for Coded PHY Bluetooth: SCO: Fix not validating setsockopt user input Marek Vasut (2): net: ks8851: Inline ks8851_rx_skb() net: ks8851: Handle softirqs at the end of IRQ thread to fix hang Michael Liang (1): net/mlx5: offset comp irq index in name by one Michal Luczaj (1): af_unix: Fix garbage collector racing against connect() Ming Lei (1): block: fix q->blkg_list corruption during disk rebind Moshe Shemesh (1): net/mlx5: SF, Stop waiting for FW as teardown was called Namhyung Kim (1): perf/x86: Fix out of range data Nini Song (1): media: cec: core: remove length check of Timer Status Noah Loomans (1): platform/chrome: cros_ec_uart: properly fix race condition Pavan Chebbi (1): bnxt_en: Reset PTP tx_avail after possible firmware reset Pavel Begunkov (1): io_uring/net: restore msg_control on sendzc retry Petr Tesarik (1): u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file Rahul Rameshbabu (1): net/mlx5e: Do not produce metadata freelist entries in Tx port ts WQE xmit Sean Christopherson (1): x86/cpu: Actually turn off mitigations by default for SPECULATION_MITIGATIONS=n Shay Drory (1): net/mlx5: Register devlink first under devlink lock Steve French (1): smb3: fix Open files on server counter going negative Steven Rostedt (Google) (1): ring-buffer: Only update pages_touched when a new page is touched Sven Eckelmann (1): batman-adv: Avoid infinite loop trying to resize local TT Tim Huang (2): drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 drm/amdgpu: fix incorrect number of active RBs for gfx11 Vikas Gupta (2): bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init() bnxt_en: Fix error recovery for RoCE ulp client Ville Syrjälä (4): drm/i915/vrr: Disable VRR when using bigjoiner drm/client: Fully protect modes[] with dev->mode_config.mutex drm/i915/cdclk: Fix CDCLK programming order when pipes are active drm/i915: Disable port sync when bigjoiner is used Xiang Chen (1): scsi: hisi_sas: Modify the deadline for ata_wait_after_reset() Xuchun Shang (1): iommu/vt-d: Fix wrong use of pasid config Yu Kuai (1): raid1: fix use-after-free for original bio in raid1_write_request() Yuquan Wang (1): cxl/mem: Fix for the index of Clear Event Record Handle Zack Rusin (1): drm/vmwgfx: Enable DMA mappings with SEV Zheng Yejian (1): kprobes: Fix possible use-after-free issue on kprobe registration

1 year, 2 months

3
4
0 0

[PATCH 0/4] Please apply these MT7530 DSA subdriver patches to 5.15

by Arınç ÜNAL via B4 Relay

Hello. These are the remaining bugfix patches for the MT7530 DSA subdriver. They didn't apply as is to the 5.15 stable tree so I have submitted the adjusted versions in this thread. Please apply them in the order they were submitted. Signed-off-by: Arınç ÜNAL <arinc.unal(a)arinc9.com> --- Arınç ÜNAL (3): net: dsa: mt7530: set all CPU ports in MT7531_CPU_PMAP net: dsa: mt7530: fix improper frames on all 25MHz and 40MHz XTAL MT7530 net: dsa: mt7530: fix enabling EEE on MT7531 switch on all boards Vladimir Oltean (1): net: dsa: introduce preferred_default_local_cpu_port and use on MT7530 drivers/net/dsa/mt7530.c | 54 ++++++++++++++++++++++++++++++++++-------------- drivers/net/dsa/mt7530.h | 2 ++ include/net/dsa.h | 8 +++++++ net/dsa/dsa2.c | 24 ++++++++++++++++++++- 4 files changed, 71 insertions(+), 17 deletions(-) --- base-commit: c52b9710c83d3b8ab63bb217cc7c8b61e13f12cd change-id: 20240420-for-stable-5-15-backports-d1fca1fee8c9 Best regards, -- Arınç ÜNAL <arinc.unal(a)arinc9.com>

1 year, 2 months

1
4
0 0

Re: Patch "ravb: Group descriptor types used in Rx ring" has been added to the 6.8-stable tree

by Sergey Shtylyov

On 4/19/24 2:47 PM, Sasha Levin wrote: > This is a note to let you know that I've just added the patch titled > > ravb: Group descriptor types used in Rx ring > > to the 6.8-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > ravb-group-descriptor-types-used-in-rx-ring.patch > and it can be found in the queue-6.8 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > > > > commit fb17fd565be203e2aa62544a586a72430c457751 > Author: Niklas Söderlund <niklas.soderlund+renesas(a)ragnatech.se> > Date: Mon Mar 4 12:08:53 2024 +0100 > > ravb: Group descriptor types used in Rx ring > > [ Upstream commit 4123c3fbf8632e5c553222bf1c10b3a3e0a8dc06 ] > > The Rx ring can either be made up of normal or extended descriptors, not > a mix of the two at the same time. Make this explicit by grouping the > two variables in a rx_ring union. > > The extension of the storage for more than one queue of normal > descriptors from a single to NUM_RX_QUEUE queues have no practical > effect. But aids in making the code readable as the code that uses it > already piggyback on other members of struct ravb_private that are > arrays of max length NUM_RX_QUEUE, e.g. rx_desc_dma. This will also make > further refactoring easier. > > While at it, rename the normal descriptor Rx ring to make it clear it's > not strictly related to the GbEthernet E-MAC IP found in RZ/G2L, normal > descriptors could be used on R-Car SoCs too. > > Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas(a)ragnatech.se> > Reviewed-by: Paul Barker <paul.barker.ct(a)bp.renesas.com> > Reviewed-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> > Signed-off-by: David S. Miller <davem(a)davemloft.net> > Stable-dep-of: def52db470df ("net: ravb: Count packets instead of descriptors in R-Car RX path") Hm, I doubt this patch is actually necessary here... > Signed-off-by: Sasha Levin <sashal(a)kernel.org> [...] MBR, Sergey

1 year, 2 months

1
0
0 0

Apparently, the CPU is overheated

by Victor Porton

Since some version of Linux (I think since some 5.x), my computer started to turn off randomly, especially when under a load. A workaround is to put it into power saving mode (using Power in Gnome Settings). This makes it almost 2 times slower. Unmodified Asus X515EA. I recently updated BIOS to Asus's version 315, but this didn't help. Previously we cleared it from dust and replaced the thermal paste, but that didn't fix the problem. I am attaching dmidecode.

1 year, 2 months

1
0
0 0

[PATCH net v2] udp: don't be set unconnected if only UDP cmsg

by Yick Xie

If "udp_cmsg_send()" returned 0 (i.e. only UDP cmsg), "connected" should not be set to 0. Otherwise it stops the connected socket from using the cached route. Fixes: 2e8de8576343 ("udp: add gso segment cmsg") Signed-off-by: Yick Xie <yick.xie(a)gmail.com> Cc: stable(a)vger.kernel.org --- v2: Add Fixes tag v1: https://lore.kernel.org/netdev/20240414195213.106209-1-yick.xie@gmail.com/ --- net/ipv4/udp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index c02bf011d4a6..420905be5f30 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1123,16 +1123,17 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) if (msg->msg_controllen) { err = udp_cmsg_send(sk, msg, &ipc.gso_size); - if (err > 0) + if (err > 0) { err = ip_cmsg_send(sk, msg, &ipc, sk->sk_family == AF_INET6); + connected = 0; + } if (unlikely(err < 0)) { kfree(ipc.opt); return err; } if (ipc.opt) free = 1; - connected = 0; } if (!ipc.opt) { struct ip_options_rcu *inet_opt; -- 2.34.1

1 year, 2 months

4
6
0 0

+ mm-hugetlb-fix-debug_locks_warn_on1-when-dissolve_free_hugetlb_folio.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() has been added to the -mm mm-hotfixes-unstable branch. Its filename is mm-hugetlb-fix-debug_locks_warn_on1-when-dissolve_free_hugetlb_folio.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Miaohe Lin <linmiaohe(a)huawei.com> Subject: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() Date: Fri, 19 Apr 2024 16:58:19 +0800 When I did memory failure tests recently, below warning occurs: DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 8 PID: 1011 at kernel/locking/lockdep.c:232 __lock_acquire+0xccb/0x1ca0 Modules linked in: mce_inject hwpoison_inject CPU: 8 PID: 1011 Comm: bash Kdump: loaded Not tainted 6.9.0-rc3-next-20240410-00012-gdb69f219f4be #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:__lock_acquire+0xccb/0x1ca0 RSP: 0018:ffffa7a1c7fe3bd0 EFLAGS: 00000082 RAX: 0000000000000000 RBX: eb851eb853975fcf RCX: ffffa1ce5fc1c9c8 RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffffa1ce5fc1c9c0 RBP: ffffa1c6865d3280 R08: ffffffffb0f570a8 R09: 0000000000009ffb R10: 0000000000000286 R11: ffffffffb0f2ad50 R12: ffffa1c6865d3d10 R13: ffffa1c6865d3c70 R14: 0000000000000000 R15: 0000000000000004 FS: 00007ff9f32aa740(0000) GS:ffffa1ce5fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff9f3134ba0 CR3: 00000008484e4000 CR4: 00000000000006f0 Call Trace: <TASK> lock_acquire+0xbe/0x2d0 _raw_spin_lock_irqsave+0x3a/0x60 hugepage_subpool_put_pages.part.0+0xe/0xc0 free_huge_folio+0x253/0x3f0 dissolve_free_huge_page+0x147/0x210 __page_handle_poison+0x9/0x70 memory_failure+0x4e6/0x8c0 hard_offline_page_store+0x55/0xa0 kernfs_fop_write_iter+0x12c/0x1d0 vfs_write+0x380/0x540 ksys_write+0x64/0xe0 do_syscall_64+0xbc/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff9f3114887 RSP: 002b:00007ffecbacb458 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007ff9f3114887 RDX: 000000000000000c RSI: 0000564494164e10 RDI: 0000000000000001 RBP: 0000564494164e10 R08: 00007ff9f31d1460 R09: 000000007fffffff R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000c R13: 00007ff9f321b780 R14: 00007ff9f3217600 R15: 00007ff9f3216a00 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ... CPU: 8 PID: 1011 Comm: bash Kdump: loaded Not tainted 6.9.0-rc3-next-20240410-00012-gdb69f219f4be #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> panic+0x326/0x350 check_panic_on_warn+0x4f/0x50 __warn+0x98/0x190 report_bug+0x18e/0x1a0 handle_bug+0x3d/0x70 exc_invalid_op+0x18/0x70 asm_exc_invalid_op+0x1a/0x20 RIP: 0010:__lock_acquire+0xccb/0x1ca0 RSP: 0018:ffffa7a1c7fe3bd0 EFLAGS: 00000082 RAX: 0000000000000000 RBX: eb851eb853975fcf RCX: ffffa1ce5fc1c9c8 RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffffa1ce5fc1c9c0 RBP: ffffa1c6865d3280 R08: ffffffffb0f570a8 R09: 0000000000009ffb R10: 0000000000000286 R11: ffffffffb0f2ad50 R12: ffffa1c6865d3d10 R13: ffffa1c6865d3c70 R14: 0000000000000000 R15: 0000000000000004 lock_acquire+0xbe/0x2d0 _raw_spin_lock_irqsave+0x3a/0x60 hugepage_subpool_put_pages.part.0+0xe/0xc0 free_huge_folio+0x253/0x3f0 dissolve_free_huge_page+0x147/0x210 __page_handle_poison+0x9/0x70 memory_failure+0x4e6/0x8c0 hard_offline_page_store+0x55/0xa0 kernfs_fop_write_iter+0x12c/0x1d0 vfs_write+0x380/0x540 ksys_write+0x64/0xe0 do_syscall_64+0xbc/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff9f3114887 RSP: 002b:00007ffecbacb458 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007ff9f3114887 RDX: 000000000000000c RSI: 0000564494164e10 RDI: 0000000000000001 RBP: 0000564494164e10 R08: 00007ff9f31d1460 R09: 000000007fffffff R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000c R13: 00007ff9f321b780 R14: 00007ff9f3217600 R15: 00007ff9f3216a00 </TASK> After git bisecting and digging into the code, I believe the root cause is that _deferred_list field of folio is unioned with _hugetlb_subpool field. In __update_and_free_hugetlb_folio(), folio->_deferred_list is initialized leading to corrupted folio->_hugetlb_subpool when folio is hugetlb. Later free_huge_folio() will use _hugetlb_subpool and above warning happens. But it is assumed hugetlb flag must have been cleared when calling folio_put() in update_and_free_hugetlb_folio(). This assumption is broken due to below race: CPU1 CPU2 dissolve_free_huge_page update_and_free_pages_bulk update_and_free_hugetlb_folio hugetlb_vmemmap_restore_folios folio_clear_hugetlb_vmemmap_optimized clear_flag = folio_test_hugetlb_vmemmap_optimized if (clear_flag) <-- False, it's already cleared. __folio_clear_hugetlb(folio) <-- Hugetlb is not cleared. folio_put free_huge_folio <-- free_the_page is expected. list_for_each_entry() __folio_clear_hugetlb <-- Too late. Fix this issue by checking whether folio is hugetlb directly instead of checking clear_flag to close the race window. Link: https://lkml.kernel.org/r/20240419085819.1901645-1-linmiaohe@huawei.com Fixes: 32c877191e02 ("hugetlb: do not clear hugetlb dtor until allocating vmemmap") Signed-off-by: Miaohe Lin <linmiaohe(a)huawei.com> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/hugetlb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/mm/hugetlb.c~mm-hugetlb-fix-debug_locks_warn_on1-when-dissolve_free_hugetlb_folio +++ a/mm/hugetlb.c @@ -1781,7 +1781,7 @@ static void __update_and_free_hugetlb_fo * If vmemmap pages were allocated above, then we need to clear the * hugetlb destructor under the hugetlb lock. */ - if (clear_dtor) { + if (folio_test_hugetlb(folio)) { spin_lock_irq(&hugetlb_lock); __clear_hugetlb_destructor(h, folio); spin_unlock_irq(&hugetlb_lock); _ Patches currently in -mm which might be from linmiaohe(a)huawei.com are mm-hugetlb-fix-debug_locks_warn_on1-when-dissolve_free_hugetlb_folio.patch

1 year, 2 months

1
0
0 0

[PATCH net v2] net: b44: set pause params only when interface is up

by Peter Münster

Hi, This patch fixes a kernel panic when using netifd. Could you please apply it also to linux-5.15.y at least? TIA and kind regards, -- Peter

1 year, 2 months

2
1
0 0

[PATCH] mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again

by Zach O'Keefe

(struct dirty_throttle_control *)->thresh is an unsigned long, but is passed as the u32 divisor argument to div_u64(). On architectures where unsigned long is 64 bytes, the argument will be implicitly truncated. Use div64_u64() instead of div_u64() so that the value used in the "is this a safe division" check is the same as the divisor. Also, remove redundant cast of the numerator to u64, as that should happen implicitly. This would be difficult to exploit in memcg domain, given the ratio-based arithmetic domain_drity_limits() uses, but is much easier in global writeback domain with a BDI_CAP_STRICTLIMIT-backing device, using e.g. vm.dirty_bytes=(1<<32)*PAGE_SIZE so that dtc->thresh == (1<<32) Fixes: f6789593d5ce ("mm/page-writeback.c: fix divide by zero in bdi_dirty_limits()") Cc: Maxim Patlasov <MPatlasov(a)parallels.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Zach O'Keefe <zokeefe(a)google.com> --- mm/page-writeback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/page-writeback.c b/mm/page-writeback.c index cd4e4ae77c40a..02147b61712bc 100644 --- a/mm/page-writeback.c +++ b/mm/page-writeback.c @@ -1638,7 +1638,7 @@ static inline void wb_dirty_limits(struct dirty_throttle_control *dtc) */ dtc->wb_thresh = __wb_calc_thresh(dtc); dtc->wb_bg_thresh = dtc->thresh ? - div_u64((u64)dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; + div64_u64(dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; /* * In order to avoid the stacked BDI deadlock we need -- 2.43.0.429.g432eaa2c6b-goog

1 year, 2 months

2
4
0 0

Re: [bug-report] task info hung problem in fb_deferred_io_work()

by Harshit Mogalapalli

Hi Nam, +CC stable( heads up as this is a regression affecting 5.15.y and probably others, Greg: this was reproducible upstream so reported everything w.r.t upstream code but initially found on 5.15.y) On 19/04/24 20:29, Nam Cao wrote: > On 2024-04-18 Harshit Mogalapalli wrote: >> While fuzzing 5.15.y kernel with Syzkaller, we noticed a INFO: task hung >> bug in fb_deferred_io_work() > > I think the problem is because of improper offset address calculation. > The kernel calculate address offset with: > offset = vmf->address - vmf->vma->vm_start > > Now the problem is that your C program mmap the framebuffer at 2 > different offsets: > mmap(ptr, 4096, PROT_WRITE, MAP_FIXED | MAP_SHARED, fd, 0xff000); > mmap(ptr, 4096, PROT_WRITE, MAP_FIXED | MAP_SHARED, fd, 0); > > but the kernel doesn't take these different offsets into account. > So, 2 different pages are mistakenly recognized as the same page. > > Can you try the following patch? This patch works well against the reproducer, this simplified repro and the longer repro which syzkaller generated couldn't trigger any hang with the below patch applied. Thanks, Harshit > > Best regards, > Nam > > diff --git a/drivers/video/fbdev/core/fb_defio.c b/drivers/video/fbdev/core/fb_defio.c > index dae96c9f61cf..d5d6cd9e8b29 100644 > --- a/drivers/video/fbdev/core/fb_defio.c > +++ b/drivers/video/fbdev/core/fb_defio.c > @@ -196,7 +196,8 @@ static vm_fault_t fb_deferred_io_track_page(struct fb_info *info, unsigned long > */ > static vm_fault_t fb_deferred_io_page_mkwrite(struct fb_info *info, struct vm_fault *vmf) > { > - unsigned long offset = vmf->address - vmf->vma->vm_start; > + unsigned long offset = vmf->address - vmf->vma->vm_start > + + (vmf->vma->vm_pgoff << PAGE_SHIFT); > struct page *page = vmf->page; > > file_update_time(vmf->vma->vm_file); > >

1 year, 2 months

2
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror April 2024