The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From d4a8061a7c5f7c27a2dc002ee4cb89b3e6637e44 Mon Sep 17 00:00:00 2001
From: Heyi Guo <guoheyi(a)huawei.com>
Date: Tue, 27 Aug 2019 12:26:50 +0100
Subject: [PATCH] KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is
long
If the ap_list is longer than 256 entries, merge_final() in list_sort()
will call the comparison callback with the same element twice, causing
a deadlock in vgic_irq_cmp().
Fix it by returning early when irqa == irqb.
Cc: stable(a)vger.kernel.org # 4.7+
Fixes: 8e4447457965 ("KVM: arm/arm64: vgic-new: Add IRQ sorting")
Signed-off-by: Zenghui Yu <yuzenghui(a)huawei.com>
Signed-off-by: Heyi Guo <guoheyi(a)huawei.com>
[maz: massaged commit log and patch, added Fixes and Cc-stable]
Signed-off-by: Marc Zyngier <maz(a)kernel.org>
Signed-off-by: Will Deacon <will(a)kernel.org>
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index 04786c8ec77e..ca5e6c6866a4 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -254,6 +254,13 @@ static int vgic_irq_cmp(void *priv, struct list_head *a, struct list_head *b)
bool penda, pendb;
int ret;
+ /*
+ * list_sort may call this function with the same element when
+ * the list is fairly long.
+ */
+ if (unlikely(irqa == irqb))
+ return 0;
+
raw_spin_lock(&irqa->irq_lock);
raw_spin_lock_nested(&irqb->irq_lock, SINGLE_DEPTH_NESTING);
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From d4a8061a7c5f7c27a2dc002ee4cb89b3e6637e44 Mon Sep 17 00:00:00 2001
From: Heyi Guo <guoheyi(a)huawei.com>
Date: Tue, 27 Aug 2019 12:26:50 +0100
Subject: [PATCH] KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is
long
If the ap_list is longer than 256 entries, merge_final() in list_sort()
will call the comparison callback with the same element twice, causing
a deadlock in vgic_irq_cmp().
Fix it by returning early when irqa == irqb.
Cc: stable(a)vger.kernel.org # 4.7+
Fixes: 8e4447457965 ("KVM: arm/arm64: vgic-new: Add IRQ sorting")
Signed-off-by: Zenghui Yu <yuzenghui(a)huawei.com>
Signed-off-by: Heyi Guo <guoheyi(a)huawei.com>
[maz: massaged commit log and patch, added Fixes and Cc-stable]
Signed-off-by: Marc Zyngier <maz(a)kernel.org>
Signed-off-by: Will Deacon <will(a)kernel.org>
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index 04786c8ec77e..ca5e6c6866a4 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -254,6 +254,13 @@ static int vgic_irq_cmp(void *priv, struct list_head *a, struct list_head *b)
bool penda, pendb;
int ret;
+ /*
+ * list_sort may call this function with the same element when
+ * the list is fairly long.
+ */
+ if (unlikely(irqa == irqb))
+ return 0;
+
raw_spin_lock(&irqa->irq_lock);
raw_spin_lock_nested(&irqb->irq_lock, SINGLE_DEPTH_NESTING);
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From ddfd151f3def9258397fcde7a372205a2d661903 Mon Sep 17 00:00:00 2001
From: Alexey Kardashevskiy <aik(a)ozlabs.ru>
Date: Mon, 26 Aug 2019 14:55:20 +1000
Subject: [PATCH] KVM: PPC: Book3S: Fix incorrect guest-to-user-translation
error handling
H_PUT_TCE_INDIRECT handlers receive a page with up to 512 TCEs from
a guest. Although we verify correctness of TCEs before we do anything
with the existing tables, there is a small window when a check in
kvmppc_tce_validate might pass and right after that the guest alters
the page of TCEs, causing an early exit from the handler and leaving
srcu_read_lock(&vcpu->kvm->srcu) (virtual mode) or lock_rmap(rmap)
(real mode) locked.
This fixes the bug by jumping to the common exit code with an appropriate
unlock.
Cc: stable(a)vger.kernel.org # v4.11+
Fixes: 121f80ba68f1 ("KVM: PPC: VFIO: Add in-kernel acceleration for VFIO")
Signed-off-by: Alexey Kardashevskiy <aik(a)ozlabs.ru>
Signed-off-by: Paul Mackerras <paulus(a)ozlabs.org>
diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
index e99a14798ab0..c4b606fe73eb 100644
--- a/arch/powerpc/kvm/book3s_64_vio.c
+++ b/arch/powerpc/kvm/book3s_64_vio.c
@@ -660,8 +660,10 @@ long kvmppc_h_put_tce_indirect(struct kvm_vcpu *vcpu,
}
tce = be64_to_cpu(tce);
- if (kvmppc_tce_to_ua(vcpu->kvm, tce, &ua))
- return H_PARAMETER;
+ if (kvmppc_tce_to_ua(vcpu->kvm, tce, &ua)) {
+ ret = H_PARAMETER;
+ goto unlock_exit;
+ }
list_for_each_entry_lockless(stit, &stt->iommu_tables, next) {
ret = kvmppc_tce_iommu_map(vcpu->kvm, stt,
diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c
index f50bbeedfc66..b4f20f13b860 100644
--- a/arch/powerpc/kvm/book3s_64_vio_hv.c
+++ b/arch/powerpc/kvm/book3s_64_vio_hv.c
@@ -556,8 +556,10 @@ long kvmppc_rm_h_put_tce_indirect(struct kvm_vcpu *vcpu,
unsigned long tce = be64_to_cpu(((u64 *)tces)[i]);
ua = 0;
- if (kvmppc_rm_tce_to_ua(vcpu->kvm, tce, &ua, NULL))
- return H_PARAMETER;
+ if (kvmppc_rm_tce_to_ua(vcpu->kvm, tce, &ua, NULL)) {
+ ret = H_PARAMETER;
+ goto unlock_exit;
+ }
list_for_each_entry_lockless(stit, &stt->iommu_tables, next) {
ret = kvmppc_rm_tce_iommu_map(vcpu->kvm, stt,
The patch titled
Subject: mm: memcontrol: fix percpu vmstats and vmevents flush
has been removed from the -mm tree. Its filename was
mm-memcontrol-fix-percpu-vmstats-and-vmevents-flush.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Shakeel Butt <shakeelb(a)google.com>
Subject: mm: memcontrol: fix percpu vmstats and vmevents flush
Instead of using raw_cpu_read() use per_cpu() to read the actual data of
the corresponding cpu otherwise we will be reading the data of the current
cpu for the number of online CPUs.
Link: http://lkml.kernel.org/r/20190829203110.129263-1-shakeelb@google.com
Fixes: bb65f89b7d3d ("mm: memcontrol: flush percpu vmevents before releasing memcg")
Fixes: c350a99ea2b1 ("mm: memcontrol: flush percpu vmstats before releasing memcg")
Signed-off-by: Shakeel Butt <shakeelb(a)google.com>
Acked-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/mm/memcontrol.c~mm-memcontrol-fix-percpu-vmstats-and-vmevents-flush
+++ a/mm/memcontrol.c
@@ -3278,7 +3278,7 @@ static void memcg_flush_percpu_vmstats(s
for_each_online_cpu(cpu)
for (i = min_idx; i < max_idx; i++)
- stat[i] += raw_cpu_read(memcg->vmstats_percpu->stat[i]);
+ stat[i] += per_cpu(memcg->vmstats_percpu->stat[i], cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = min_idx; i < max_idx; i++)
@@ -3296,8 +3296,8 @@ static void memcg_flush_percpu_vmstats(s
for_each_online_cpu(cpu)
for (i = min_idx; i < max_idx; i++)
- stat[i] += raw_cpu_read(
- pn->lruvec_stat_cpu->count[i]);
+ stat[i] += per_cpu(
+ pn->lruvec_stat_cpu->count[i], cpu);
for (pi = pn; pi; pi = parent_nodeinfo(pi, node))
for (i = min_idx; i < max_idx; i++)
@@ -3316,8 +3316,8 @@ static void memcg_flush_percpu_vmevents(
for_each_online_cpu(cpu)
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
- events[i] += raw_cpu_read(
- memcg->vmstats_percpu->events[i]);
+ events[i] += per_cpu(memcg->vmstats_percpu->events[i],
+ cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
_
Patches currently in -mm which might be from shakeelb(a)google.com are
The patch titled
Subject: mm, memcg: partially revert "mm/memcontrol.c: keep local VM counters in sync with the hierarchical ones"
has been removed from the -mm tree. Its filename was
partially-revert-mm-memcontrolc-keep-local-vm-counters-in-sync-with-the-hierarchical-ones.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Roman Gushchin <guro(a)fb.com>
Subject: mm, memcg: partially revert "mm/memcontrol.c: keep local VM counters in sync with the hierarchical ones"
Commit 766a4c19d880 ("mm/memcontrol.c: keep local VM counters in sync with
the hierarchical ones") effectively decreased the precision of per-memcg
vmstats_local and per-memcg-per-node lruvec percpu counters.
That's good for displaying in memory.stat, but brings a serious regression
into the reclaim process.
One issue I've discovered and debugged is the following: lruvec_lru_size()
can return 0 instead of the actual number of pages in the lru list,
preventing the kernel to reclaim last remaining pages. Result is yet
another dying memory cgroups flooding. The opposite is also happening:
scanning an empty lru list is the waste of cpu time.
Also, inactive_list_is_low() can return incorrect values, preventing the
active lru from being scanned and freed. It can fail both because the
size of active and inactive lists are inaccurate, and because the number
of workingset refaults isn't precise. In other words, the result is
pretty random.
I'm not sure, if using the approximate number of slab pages in
count_shadow_number() is acceptable, but issues described above are enough
to partially revert the patch.
Let's keep per-memcg vmstat_local batched (they are only used for
displaying stats to the userspace), but keep lruvec stats precise. This
change fixes the dead memcg flooding on my setup.
Link: http://lkml.kernel.org/r/20190817004726.2530670-1-guro@fb.com
Fixes: 766a4c19d880 ("mm/memcontrol.c: keep local VM counters in sync with the hierarchical ones")
Signed-off-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Yafang Shao <laoar.shao(a)gmail.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/mm/memcontrol.c~partially-revert-mm-memcontrolc-keep-local-vm-counters-in-sync-with-the-hierarchical-ones
+++ a/mm/memcontrol.c
@@ -752,15 +752,13 @@ void __mod_lruvec_state(struct lruvec *l
/* Update memcg */
__mod_memcg_state(memcg, idx, val);
+ /* Update lruvec */
+ __this_cpu_add(pn->lruvec_stat_local->count[idx], val);
+
x = val + __this_cpu_read(pn->lruvec_stat_cpu->count[idx]);
if (unlikely(abs(x) > MEMCG_CHARGE_BATCH)) {
struct mem_cgroup_per_node *pi;
- /*
- * Batch local counters to keep them in sync with
- * the hierarchical ones.
- */
- __this_cpu_add(pn->lruvec_stat_local->count[idx], x);
for (pi = pn; pi; pi = parent_nodeinfo(pi, pgdat->node_id))
atomic_long_add(x, &pi->lruvec_stat[idx]);
x = 0;
_
Patches currently in -mm which might be from guro(a)fb.com are
mm-memcontrol-switch-to-rcu-protection-in-drain_all_stock.patch
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/141232
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
We grabbed the d5e0e6a34f8b commit of the stable queue repository.
We then merged the patchset with `git am`:
dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch
afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch
fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch
afs-fix-off-by-one-in-afs_rename-expected-data-versi.patch
afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch
afs-fix-missing-dentry-data-version-updating.patch
nvmet-fix-use-after-free-bug-when-a-port-is-removed.patch
nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch
nvmet-file-fix-nvmet_file_flush-always-returning-an-.patch
nvme-core-fix-extra-device_put-call-on-error-path.patch
nvme-fix-a-possible-deadlock-when-passthru-commands-.patch
nvme-rdma-fix-possible-use-after-free-in-connect-err.patch
nvme-fix-controller-removal-race-with-scan-work.patch
nvme-pci-fix-async-probe-remove-race.patch
soundwire-cadence_master-fix-register-definition-for.patch
soundwire-cadence_master-fix-definitions-for-intstat.patch
auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
btrfs-trim-check-the-range-passed-into-to-prevent-ov.patch
ib-mlx5-fix-implicit-mr-release-flow.patch
dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch
omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch
iommu-dma-handle-sg-length-overflow-better.patch
dma-direct-don-t-truncate-dma_required_mask-to-bus-a.patch
usb-gadget-composite-clear-suspended-on-reset-discon.patch
usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
habanalabs-fix-dram-usage-accounting-on-context-tear.patch
habanalabs-fix-endianness-handling-for-packets-from-.patch
habanalabs-fix-completion-queue-handling-when-host-i.patch
habanalabs-fix-endianness-handling-for-internal-qman.patch
habanalabs-fix-device-irq-unmasking-for-be-host.patch
xen-blkback-fix-memory-leaks.patch
arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch
riscv-fix-flush_tlb_range-end-address-for-flush_tlb_.patch
i2c-rcar-avoid-race-when-unregistering-slave-client.patch
i2c-emev2-avoid-race-when-unregistering-slave-client.patch
drm-scheduler-use-job-count-instead-of-peek.patch
drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
usb-host-fotg2-restart-hcd-after-port-reset.patch
tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch
tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
locking-rwsem-add-missing-acquire-to-read_slowpath-e.patch
lcoking-rwsem-add-missing-acquire-to-read_slowpath-s.patch
watchdog-bcm2835_wdt-fix-module-autoload.patch
selftests-bpf-install-files-test_xdp_vlan.sh.patch
drm-bridge-tfp410-fix-memleak-in-get_modes.patch
mt76-usb-fix-rx-a-msdu-support.patch
ipv6-addrconf-allow-adding-multicast-addr-if-ifa_f_mcautojoin-is-set.patch
ipv6-fix-return-value-of-ipv6_mc_may_pull-for-malformed-packets.patch
net-cpsw-fix-null-pointer-exception-in-the-probe-error-path.patch
net-fix-__ip_mc_inc_group-usage.patch
net-smc-make-sure-epollout-is-raised.patch
tcp-make-sure-epollout-wont-be-missed.patch
ipv4-mpls-fix-mpls_xmit-for-iptunnel.patch
openvswitch-fix-conntrack-cache-with-timeout.patch
ipv4-icmp-fix-rt-dst-dev-null-pointer-dereference.patch
xfrm-xfrm_policy-fix-dst-dev-null-pointer-dereference-in-collect_md-mode.patch
mm-zsmalloc.c-fix-build-when-config_compaction-n.patch
alsa-usb-audio-check-mixer-unit-bitmap-yet-more-strictly.patch
alsa-hda-ca0132-add-new-sbz-quirk.patch
alsa-line6-fix-memory-leak-at-line6_init_pcm-error-path.patch
alsa-hda-fixes-inverted-conexant-gpio-mic-mute-led.patch
alsa-seq-fix-potential-concurrent-access-to-the-deleted-pool.patch
alsa-usb-audio-fix-invalid-null-check-in-snd_emuusb_set_samplerate.patch
alsa-usb-audio-add-implicit-fb-quirk-for-behringer-ufx1604.patch
kvm-x86-skip-populating-logical-dest-map-if-apic-is-not-sw-enabled.patch
kvm-x86-hyper-v-don-t-crash-on-kvm_get_supported_hv_cpuid-when-kvm_intel.nested-is-disabled.patch
kvm-x86-don-t-update-rip-or-do-single-step-on-faulting-emulation.patch
uprobes-x86-fix-detection-of-32-bit-user-mode.patch
x86-mm-cpa-prevent-large-page-split-when-ftrace-flips-rw-on-kernel-text.patch
x86-apic-do-not-initialize-ldr-and-dfr-for-bigsmp.patch
x86-apic-include-the-ldr-when-clearing-out-apic-registers.patch
hid-logitech-hidpp-remove-support-for-the-g700-over-.patch
ftrace-fix-null-pointer-dereference-in-t_probe_next.patch
ftrace-check-for-successful-allocation-of-hash.patch
ftrace-check-for-empty-hash-and-comment-the-race-with-registering-probes.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ Networking: igmp conformance test [8]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ Usex - version 1.9-29 [13]
✅ stress: stress-ng [14]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns transport [17]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
🚧 ✅ trace: ftrace/tracer [18]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [19]
🚧 ✅ Storage blktests [20]
ppc64le:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ Usex - version 1.9-29 [13]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
🚧 ✅ trace: ftrace/tracer [18]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [19]
🚧 ✅ Storage blktests [20]
x86_64:
Host 1:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ Networking: igmp conformance test [8]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ pciutils: sanity smoke test [21]
✅ Usex - version 1.9-29 [13]
✅ stress: stress-ng [14]
🚧 ⚡⚡⚡ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns transport [17]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
🚧 ✅ trace: ftrace/tracer [18]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [19]
🚧 ✅ Storage blktests [20]
🚧 ✅ IOMMU boot test [22]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#networking/i…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#memory/funct…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#trace/ftrace…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[21]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
[22]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/iommu/boot
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/140992
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
We grabbed the 87cde3375279 commit of the stable queue repository.
We then merged the patchset with `git am`:
dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch
afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch
fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch
afs-fix-off-by-one-in-afs_rename-expected-data-versi.patch
afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch
afs-fix-missing-dentry-data-version-updating.patch
nvmet-fix-use-after-free-bug-when-a-port-is-removed.patch
nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch
nvmet-file-fix-nvmet_file_flush-always-returning-an-.patch
nvme-core-fix-extra-device_put-call-on-error-path.patch
nvme-fix-a-possible-deadlock-when-passthru-commands-.patch
nvme-rdma-fix-possible-use-after-free-in-connect-err.patch
nvme-fix-controller-removal-race-with-scan-work.patch
nvme-pci-fix-async-probe-remove-race.patch
soundwire-cadence_master-fix-register-definition-for.patch
soundwire-cadence_master-fix-definitions-for-intstat.patch
auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
btrfs-trim-check-the-range-passed-into-to-prevent-ov.patch
ib-mlx5-fix-implicit-mr-release-flow.patch
dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch
omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch
iommu-dma-handle-sg-length-overflow-better.patch
dma-direct-don-t-truncate-dma_required_mask-to-bus-a.patch
usb-gadget-composite-clear-suspended-on-reset-discon.patch
usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
habanalabs-fix-dram-usage-accounting-on-context-tear.patch
habanalabs-fix-endianness-handling-for-packets-from-.patch
habanalabs-fix-completion-queue-handling-when-host-i.patch
habanalabs-fix-endianness-handling-for-internal-qman.patch
habanalabs-fix-device-irq-unmasking-for-be-host.patch
xen-blkback-fix-memory-leaks.patch
arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch
riscv-fix-flush_tlb_range-end-address-for-flush_tlb_.patch
i2c-rcar-avoid-race-when-unregistering-slave-client.patch
i2c-emev2-avoid-race-when-unregistering-slave-client.patch
drm-scheduler-use-job-count-instead-of-peek.patch
drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
usb-host-fotg2-restart-hcd-after-port-reset.patch
tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch
tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
locking-rwsem-add-missing-acquire-to-read_slowpath-e.patch
lcoking-rwsem-add-missing-acquire-to-read_slowpath-s.patch
watchdog-bcm2835_wdt-fix-module-autoload.patch
selftests-bpf-install-files-test_xdp_vlan.sh.patch
drm-bridge-tfp410-fix-memleak-in-get_modes.patch
mt76-usb-fix-rx-a-msdu-support.patch
ipv6-addrconf-allow-adding-multicast-addr-if-ifa_f_mcautojoin-is-set.patch
ipv6-fix-return-value-of-ipv6_mc_may_pull-for-malformed-packets.patch
net-cpsw-fix-null-pointer-exception-in-the-probe-error-path.patch
net-fix-__ip_mc_inc_group-usage.patch
net-smc-make-sure-epollout-is-raised.patch
tcp-make-sure-epollout-wont-be-missed.patch
ipv4-mpls-fix-mpls_xmit-for-iptunnel.patch
openvswitch-fix-conntrack-cache-with-timeout.patch
ipv4-icmp-fix-rt-dst-dev-null-pointer-dereference.patch
xfrm-xfrm_policy-fix-dst-dev-null-pointer-dereference-in-collect_md-mode.patch
mm-zsmalloc.c-fix-build-when-config_compaction-n.patch
alsa-usb-audio-check-mixer-unit-bitmap-yet-more-strictly.patch
alsa-hda-ca0132-add-new-sbz-quirk.patch
alsa-line6-fix-memory-leak-at-line6_init_pcm-error-path.patch
alsa-hda-fixes-inverted-conexant-gpio-mic-mute-led.patch
alsa-seq-fix-potential-concurrent-access-to-the-deleted-pool.patch
alsa-usb-audio-fix-invalid-null-check-in-snd_emuusb_set_samplerate.patch
alsa-usb-audio-add-implicit-fb-quirk-for-behringer-ufx1604.patch
kvm-x86-skip-populating-logical-dest-map-if-apic-is-not-sw-enabled.patch
kvm-x86-hyper-v-don-t-crash-on-kvm_get_supported_hv_cpuid-when-kvm_intel.nested-is-disabled.patch
kvm-x86-don-t-update-rip-or-do-single-step-on-faulting-emulation.patch
uprobes-x86-fix-detection-of-32-bit-user-mode.patch
x86-mm-cpa-prevent-large-page-split-when-ftrace-flips-rw-on-kernel-text.patch
x86-apic-do-not-initialize-ldr-and-dfr-for-bigsmp.patch
x86-apic-include-the-ldr-when-clearing-out-apic-registers.patch
hid-logitech-hidpp-remove-support-for-the-g700-over-.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ Ethernet drivers sanity [8]
✅ Networking socket: fuzz [9]
✅ Networking: igmp conformance test [10]
✅ audit: audit testsuite test [11]
✅ httpd: mod_ssl smoke sanity [12]
✅ iotop: sanity [13]
✅ tuned: tune-processes-through-perf [14]
✅ Usex - version 1.9-29 [15]
✅ stress: stress-ng [16]
🚧 ✅ LTP lite [17]
🚧 ✅ Memory function: kaslr [18]
🚧 ✅ Networking ipsec: basic netns transport [19]
🚧 ✅ Networking ipsec: basic netns tunnel [19]
ppc64le:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ Ethernet drivers sanity [8]
✅ Networking socket: fuzz [9]
✅ audit: audit testsuite test [11]
✅ httpd: mod_ssl smoke sanity [12]
✅ iotop: sanity [13]
✅ tuned: tune-processes-through-perf [14]
✅ Usex - version 1.9-29 [15]
🚧 ✅ LTP lite [17]
🚧 ✅ Memory function: kaslr [18]
🚧 ✅ Networking ipsec: basic netns tunnel [19]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ❌ Storage blktests [2]
x86_64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ Ethernet drivers sanity [8]
✅ Networking socket: fuzz [9]
✅ Networking: igmp conformance test [10]
✅ audit: audit testsuite test [11]
✅ httpd: mod_ssl smoke sanity [12]
✅ iotop: sanity [13]
✅ tuned: tune-processes-through-perf [14]
✅ pciutils: sanity smoke test [20]
✅ Usex - version 1.9-29 [15]
✅ stress: stress-ng [16]
🚧 ✅ LTP lite [17]
🚧 ✅ Memory function: kaslr [18]
🚧 ✅ Networking ipsec: basic netns transport [19]
🚧 ✅ Networking ipsec: basic netns tunnel [19]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
🚧 ✅ IOMMU boot test [21]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#networking/i…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#memory/funct…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
[21]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/iommu/boot
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
Hi,
I also tried to reproduce this in a targeted way, and run into the
same difficulty as you: satisfying the first condition “
(sk->sk_wmem_queued >> 1) > limit “.
I will not have bandwidth the coming days to try and reproduce it in
this way. Maybe simply forcing a very small send buffer using sysctl
net.ipv4.tcp_wmem might even do the trick?
I suspect that the bug is easier to trigger with the MPTCP patch like
I did originally, due to the way this patch manages the tcp subflow
buffers (it can temporarily overfill the buffers, satisfying that
first condition more often).
another thing, the stacktrace you shared before seems caused by
another issue (corrupted socket?), it will not be solved by the patch
we submitted.
kind regards,
Tim
On Tue, Sep 3, 2019 at 5:22 AM maowenan <maowenan(a)huawei.com> wrote:
>
> Hi Tim,
>
>
>
> I try to reproduce it with packetdrill or user application, but I can’t.
>
> The first condition “ (sk->sk_wmem_queued >> 1) > limit “ can’t be satisfied,
>
> This condition is to avoid tiny SO_SNDBUF values set by user.
>
> It also adds the some room due to the fact that tcp_sendmsg()
>
> and tcp_sendpage() might overshoot sk_wmem_queued by about one full
>
> TSO skb (64KB size).
>
>
>
> limit = sk->sk_sndbuf + 2 * SKB_TRUESIZE(GSO_MAX_SIZE);
>
> if (unlikely((sk->sk_wmem_queued >> 1) > limit &&
>
> skb != tcp_rtx_queue_head(sk) &&
>
> skb != tcp_rtx_queue_tail(sk))) {
>
> NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPWQUEUETOOBIG);
>
> return -ENOMEM;
>
> }
>
>
>
> Can you try to reproduce it with packetdrill or C socket application?
>
>
--
Tim Froidcoeur | R&D engineer HAG
tim.froidcoeur(a)tessares.net
Tessares SA | Hybrid Access Solutions
www.tessares.net
1 Avenue Jean Monnet, 1348 Louvain-la-Neuve, Belgium
--
Disclaimer: https://www.tessares.net/mail-disclaimer/
<https://www.tessares.net/mail-disclaimer/>
The following commit has been merged into the sched/urgent branch of tip:
Commit-ID: 5e2d2cc2588bd3307ce3937acbc2ed03c830a861
Gitweb: https://git.kernel.org/tip/5e2d2cc2588bd3307ce3937acbc2ed03c830a861
Author: Liangyan <liangyan.peng(a)linux.alibaba.com>
AuthorDate: Mon, 26 Aug 2019 20:16:33 +08:00
Committer: Ingo Molnar <mingo(a)kernel.org>
CommitterDate: Tue, 03 Sep 2019 08:55:07 +02:00
sched/fair: Don't assign runtime for throttled cfs_rq
do_sched_cfs_period_timer() will refill cfs_b runtime and call
distribute_cfs_runtime to unthrottle cfs_rq, sometimes cfs_b->runtime
will allocate all quota to one cfs_rq incorrectly, then other cfs_rqs
attached to this cfs_b can't get runtime and will be throttled.
We find that one throttled cfs_rq has non-negative
cfs_rq->runtime_remaining and cause an unexpetced cast from s64 to u64
in snippet:
distribute_cfs_runtime() {
runtime = -cfs_rq->runtime_remaining + 1;
}
The runtime here will change to a large number and consume all
cfs_b->runtime in this cfs_b period.
According to Ben Segall, the throttled cfs_rq can have
account_cfs_rq_runtime called on it because it is throttled before
idle_balance, and the idle_balance calls update_rq_clock to add time
that is accounted to the task.
This commit prevents cfs_rq to be assgined new runtime if it has been
throttled until that distribute_cfs_runtime is called.
Signed-off-by: Liangyan <liangyan.peng(a)linux.alibaba.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Reviewed-by: Valentin Schneider <valentin.schneider(a)arm.com>
Reviewed-by: Ben Segall <bsegall(a)google.com>
Cc: Linus Torvalds <torvalds(a)linux-foundation.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: shanpeic(a)linux.alibaba.com
Cc: stable(a)vger.kernel.org
Cc: xlpang(a)linux.alibaba.com
Fixes: d3d9dc330236 ("sched: Throttle entities exceeding their allowed bandwidth")
Link: https://lkml.kernel.org/r/20190826121633.6538-1-liangyan.peng@linux.alibaba…
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
---
kernel/sched/fair.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index bc9cfea..500f5db 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -4470,6 +4470,8 @@ static void __account_cfs_rq_runtime(struct cfs_rq *cfs_rq, u64 delta_exec)
if (likely(cfs_rq->runtime_remaining > 0))
return;
+ if (cfs_rq->throttled)
+ return;
/*
* if we're unable to extend our runtime we resched so that the active
* hierarchy can be throttled
@@ -4673,6 +4675,9 @@ static u64 distribute_cfs_runtime(struct cfs_bandwidth *cfs_b,
if (!cfs_rq_throttled(cfs_rq))
goto next;
+ /* By the above check, this should never be true */
+ SCHED_WARN_ON(cfs_rq->runtime_remaining > 0);
+
runtime = -cfs_rq->runtime_remaining + 1;
if (runtime > remaining)
runtime = remaining;
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/140276
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
We grabbed the a72cf2e32965 commit of the stable queue repository.
We then merged the patchset with `git am`:
dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch
afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch
fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch
afs-fix-off-by-one-in-afs_rename-expected-data-versi.patch
afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch
afs-fix-missing-dentry-data-version-updating.patch
nvmet-fix-use-after-free-bug-when-a-port-is-removed.patch
nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch
nvmet-file-fix-nvmet_file_flush-always-returning-an-.patch
nvme-core-fix-extra-device_put-call-on-error-path.patch
nvme-fix-a-possible-deadlock-when-passthru-commands-.patch
nvme-rdma-fix-possible-use-after-free-in-connect-err.patch
nvme-fix-controller-removal-race-with-scan-work.patch
nvme-pci-fix-async-probe-remove-race.patch
soundwire-cadence_master-fix-register-definition-for.patch
soundwire-cadence_master-fix-definitions-for-intstat.patch
auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
btrfs-trim-check-the-range-passed-into-to-prevent-ov.patch
ib-mlx5-fix-implicit-mr-release-flow.patch
dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch
omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch
iommu-dma-handle-sg-length-overflow-better.patch
dma-direct-don-t-truncate-dma_required_mask-to-bus-a.patch
usb-gadget-composite-clear-suspended-on-reset-discon.patch
usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
habanalabs-fix-dram-usage-accounting-on-context-tear.patch
habanalabs-fix-endianness-handling-for-packets-from-.patch
habanalabs-fix-completion-queue-handling-when-host-i.patch
habanalabs-fix-endianness-handling-for-internal-qman.patch
habanalabs-fix-device-irq-unmasking-for-be-host.patch
xen-blkback-fix-memory-leaks.patch
arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch
riscv-fix-flush_tlb_range-end-address-for-flush_tlb_.patch
i2c-rcar-avoid-race-when-unregistering-slave-client.patch
i2c-emev2-avoid-race-when-unregistering-slave-client.patch
drm-scheduler-use-job-count-instead-of-peek.patch
drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
usb-host-fotg2-restart-hcd-after-port-reset.patch
tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch
tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
locking-rwsem-add-missing-acquire-to-read_slowpath-e.patch
lcoking-rwsem-add-missing-acquire-to-read_slowpath-s.patch
watchdog-bcm2835_wdt-fix-module-autoload.patch
selftests-bpf-install-files-test_xdp_vlan.sh.patch
drm-bridge-tfp410-fix-memleak-in-get_modes.patch
mt76-usb-fix-rx-a-msdu-support.patch
ipv6-addrconf-allow-adding-multicast-addr-if-ifa_f_mcautojoin-is-set.patch
ipv6-fix-return-value-of-ipv6_mc_may_pull-for-malformed-packets.patch
net-cpsw-fix-null-pointer-exception-in-the-probe-error-path.patch
net-fix-__ip_mc_inc_group-usage.patch
net-smc-make-sure-epollout-is-raised.patch
tcp-make-sure-epollout-wont-be-missed.patch
ipv4-mpls-fix-mpls_xmit-for-iptunnel.patch
openvswitch-fix-conntrack-cache-with-timeout.patch
ipv4-icmp-fix-rt-dst-dev-null-pointer-dereference.patch
xfrm-xfrm_policy-fix-dst-dev-null-pointer-dereference-in-collect_md-mode.patch
mm-zsmalloc.c-fix-build-when-config_compaction-n.patch
alsa-usb-audio-check-mixer-unit-bitmap-yet-more-strictly.patch
alsa-hda-ca0132-add-new-sbz-quirk.patch
alsa-line6-fix-memory-leak-at-line6_init_pcm-error-path.patch
alsa-hda-fixes-inverted-conexant-gpio-mic-mute-led.patch
alsa-seq-fix-potential-concurrent-access-to-the-deleted-pool.patch
alsa-usb-audio-fix-invalid-null-check-in-snd_emuusb_set_samplerate.patch
alsa-usb-audio-add-implicit-fb-quirk-for-behringer-ufx1604.patch
kvm-x86-skip-populating-logical-dest-map-if-apic-is-not-sw-enabled.patch
kvm-x86-hyper-v-don-t-crash-on-kvm_get_supported_hv_cpuid-when-kvm_intel.nested-is-disabled.patch
kvm-x86-don-t-update-rip-or-do-single-step-on-faulting-emulation.patch
uprobes-x86-fix-detection-of-32-bit-user-mode.patch
x86-mm-cpa-prevent-large-page-split-when-ftrace-flips-rw-on-kernel-text.patch
x86-apic-do-not-initialize-ldr-and-dfr-for-bigsmp.patch
x86-apic-include-the-ldr-when-clearing-out-apic-registers.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ Networking: igmp conformance test [8]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ Usex - version 1.9-29 [13]
✅ stress: stress-ng [14]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns transport [17]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [18]
🚧 ✅ Storage blktests [19]
ppc64le:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [18]
🚧 ✅ Storage blktests [19]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ Usex - version 1.9-29 [13]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
x86_64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [18]
🚧 ✅ Storage blktests [19]
🚧 ❌ IOMMU boot test [20]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ Networking: igmp conformance test [8]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ pciutils: sanity smoke test [21]
✅ Usex - version 1.9-29 [13]
✅ stress: stress-ng [14]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns transport [17]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#networking/i…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#memory/funct…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/iommu/boot
[21]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 9212ec7d8357ea630031e89d0d399c761421c83b Mon Sep 17 00:00:00 2001
From: Sebastian Mayr <me(a)sam.st>
Date: Sun, 28 Jul 2019 17:26:17 +0200
Subject: [PATCH] uprobes/x86: Fix detection of 32-bit user mode
32-bit processes running on a 64-bit kernel are not always detected
correctly, causing the process to crash when uretprobes are installed.
The reason for the crash is that in_ia32_syscall() is used to determine the
process's mode, which only works correctly when called from a syscall.
In the case of uretprobes, however, the function is called from a exception
and always returns 'false' on a 64-bit kernel. In consequence this leads to
corruption of the process's return address.
Fix this by using user_64bit_mode() instead of in_ia32_syscall(), which
is correct in any situation.
[ tglx: Add a comment and the following historical info ]
This should have been detected by the rename which happened in commit
abfb9498ee13 ("x86/entry: Rename is_{ia32,x32}_task() to in_{ia32,x32}_syscall()")
which states in the changelog:
The is_ia32_task()/is_x32_task() function names are a big misnomer: they
suggests that the compat-ness of a system call is a task property, which
is not true, the compatness of a system call purely depends on how it
was invoked through the system call layer.
.....
and then it went and blindly renamed every call site.
Sadly enough this was already mentioned here:
8faaed1b9f50 ("uprobes/x86: Introduce sizeof_long(), cleanup adjust_ret_addr() and
arch_uretprobe_hijack_return_addr()")
where the changelog says:
TODO: is_ia32_task() is not what we actually want, TS_COMPAT does
not necessarily mean 32bit. Fortunately syscall-like insns can't be
probed so it actually works, but it would be better to rename and
use is_ia32_frame().
and goes all the way back to:
0326f5a94dde ("uprobes/core: Handle breakpoint and singlestep exceptions")
Oh well. 7+ years until someone actually tried a uretprobe on a 32bit
process on a 64bit kernel....
Fixes: 0326f5a94dde ("uprobes/core: Handle breakpoint and singlestep exceptions")
Signed-off-by: Sebastian Mayr <me(a)sam.st>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Masami Hiramatsu <mhiramat(a)kernel.org>
Cc: Dmitry Safonov <dsafonov(a)virtuozzo.com>
Cc: Oleg Nesterov <oleg(a)redhat.com>
Cc: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com>
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20190728152617.7308-1-me@sam.st
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index d8359ebeea70..8cd745ef8c7b 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -508,9 +508,12 @@ struct uprobe_xol_ops {
void (*abort)(struct arch_uprobe *, struct pt_regs *);
};
-static inline int sizeof_long(void)
+static inline int sizeof_long(struct pt_regs *regs)
{
- return in_ia32_syscall() ? 4 : 8;
+ /*
+ * Check registers for mode as in_xxx_syscall() does not apply here.
+ */
+ return user_64bit_mode(regs) ? 8 : 4;
}
static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
@@ -521,9 +524,9 @@ static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
static int emulate_push_stack(struct pt_regs *regs, unsigned long val)
{
- unsigned long new_sp = regs->sp - sizeof_long();
+ unsigned long new_sp = regs->sp - sizeof_long(regs);
- if (copy_to_user((void __user *)new_sp, &val, sizeof_long()))
+ if (copy_to_user((void __user *)new_sp, &val, sizeof_long(regs)))
return -EFAULT;
regs->sp = new_sp;
@@ -556,7 +559,7 @@ static int default_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs
long correction = utask->vaddr - utask->xol_vaddr;
regs->ip += correction;
} else if (auprobe->defparam.fixups & UPROBE_FIX_CALL) {
- regs->sp += sizeof_long(); /* Pop incorrect return address */
+ regs->sp += sizeof_long(regs); /* Pop incorrect return address */
if (emulate_push_stack(regs, utask->vaddr + auprobe->defparam.ilen))
return -ERESTART;
}
@@ -675,7 +678,7 @@ static int branch_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
* "call" insn was executed out-of-line. Just restore ->sp and restart.
* We could also restore ->ip and try to call branch_emulate_op() again.
*/
- regs->sp += sizeof_long();
+ regs->sp += sizeof_long(regs);
return -ERESTART;
}
@@ -1056,7 +1059,7 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
unsigned long
arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs *regs)
{
- int rasize = sizeof_long(), nleft;
+ int rasize = sizeof_long(regs), nleft;
unsigned long orig_ret_vaddr = 0; /* clear high bits for 32-bit apps */
if (copy_from_user(&orig_ret_vaddr, (void __user *)regs->sp, rasize))
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 701d678599d0c1623aaf4139c03eea260a75b027 Mon Sep 17 00:00:00 2001
From: Henry Burns <henryburns(a)google.com>
Date: Sat, 24 Aug 2019 17:55:06 -0700
Subject: [PATCH] mm/zsmalloc.c: fix race condition in zs_destroy_pool
In zs_destroy_pool() we call flush_work(&pool->free_work). However, we
have no guarantee that migration isn't happening in the background at
that time.
Since migration can't directly free pages, it relies on free_work being
scheduled to free the pages. But there's nothing preventing an
in-progress migrate from queuing the work *after*
zs_unregister_migration() has called flush_work(). Which would mean
pages still pointing at the inode when we free it.
Since we know at destroy time all objects should be free, no new
migrations can come in (since zs_page_isolate() fails for fully-free
zspages). This means it is sufficient to track a "# isolated zspages"
count by class, and have the destroy logic ensure all such pages have
drained before proceeding. Keeping that state under the class spinlock
keeps the logic straightforward.
In this case a memory leak could lead to an eventual crash if compaction
hits the leaked page. This crash would only occur if people are
changing their zswap backend at runtime (which eventually starts
destruction).
Link: http://lkml.kernel.org/r/20190809181751.219326-2-henryburns@google.com
Fixes: 48b4800a1c6a ("zsmalloc: page migration support")
Signed-off-by: Henry Burns <henryburns(a)google.com>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky(a)gmail.com>
Cc: Henry Burns <henrywolfeburns(a)gmail.com>
Cc: Minchan Kim <minchan(a)kernel.org>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: Jonathan Adams <jwadams(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 5105b9b66653..08def3a0d200 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -54,6 +54,7 @@
#include <linux/mount.h>
#include <linux/pseudo_fs.h>
#include <linux/migrate.h>
+#include <linux/wait.h>
#include <linux/pagemap.h>
#include <linux/fs.h>
@@ -268,6 +269,10 @@ struct zs_pool {
#ifdef CONFIG_COMPACTION
struct inode *inode;
struct work_struct free_work;
+ /* A wait queue for when migration races with async_free_zspage() */
+ struct wait_queue_head migration_wait;
+ atomic_long_t isolated_pages;
+ bool destroying;
#endif
};
@@ -1874,6 +1879,19 @@ static void putback_zspage_deferred(struct zs_pool *pool,
}
+static inline void zs_pool_dec_isolated(struct zs_pool *pool)
+{
+ VM_BUG_ON(atomic_long_read(&pool->isolated_pages) <= 0);
+ atomic_long_dec(&pool->isolated_pages);
+ /*
+ * There's no possibility of racing, since wait_for_isolated_drain()
+ * checks the isolated count under &class->lock after enqueuing
+ * on migration_wait.
+ */
+ if (atomic_long_read(&pool->isolated_pages) == 0 && pool->destroying)
+ wake_up_all(&pool->migration_wait);
+}
+
static void replace_sub_page(struct size_class *class, struct zspage *zspage,
struct page *newpage, struct page *oldpage)
{
@@ -1943,6 +1961,7 @@ static bool zs_page_isolate(struct page *page, isolate_mode_t mode)
*/
if (!list_empty(&zspage->list) && !is_zspage_isolated(zspage)) {
get_zspage_mapping(zspage, &class_idx, &fullness);
+ atomic_long_inc(&pool->isolated_pages);
remove_zspage(class, zspage, fullness);
}
@@ -2042,8 +2061,16 @@ static int zs_page_migrate(struct address_space *mapping, struct page *newpage,
* Page migration is done so let's putback isolated zspage to
* the list if @page is final isolated subpage in the zspage.
*/
- if (!is_zspage_isolated(zspage))
+ if (!is_zspage_isolated(zspage)) {
+ /*
+ * We cannot race with zs_destroy_pool() here because we wait
+ * for isolation to hit zero before we start destroying.
+ * Also, we ensure that everyone can see pool->destroying before
+ * we start waiting.
+ */
putback_zspage_deferred(pool, class, zspage);
+ zs_pool_dec_isolated(pool);
+ }
reset_page(page);
put_page(page);
@@ -2094,8 +2121,8 @@ static void zs_page_putback(struct page *page)
* so let's defer.
*/
putback_zspage_deferred(pool, class, zspage);
+ zs_pool_dec_isolated(pool);
}
-
spin_unlock(&class->lock);
}
@@ -2118,8 +2145,36 @@ static int zs_register_migration(struct zs_pool *pool)
return 0;
}
+static bool pool_isolated_are_drained(struct zs_pool *pool)
+{
+ return atomic_long_read(&pool->isolated_pages) == 0;
+}
+
+/* Function for resolving migration */
+static void wait_for_isolated_drain(struct zs_pool *pool)
+{
+
+ /*
+ * We're in the process of destroying the pool, so there are no
+ * active allocations. zs_page_isolate() fails for completely free
+ * zspages, so we need only wait for the zs_pool's isolated
+ * count to hit zero.
+ */
+ wait_event(pool->migration_wait,
+ pool_isolated_are_drained(pool));
+}
+
static void zs_unregister_migration(struct zs_pool *pool)
{
+ pool->destroying = true;
+ /*
+ * We need a memory barrier here to ensure global visibility of
+ * pool->destroying. Thus pool->isolated pages will either be 0 in which
+ * case we don't care, or it will be > 0 and pool->destroying will
+ * ensure that we wake up once isolation hits 0.
+ */
+ smp_mb();
+ wait_for_isolated_drain(pool); /* This can block */
flush_work(&pool->free_work);
iput(pool->inode);
}
@@ -2357,6 +2412,8 @@ struct zs_pool *zs_create_pool(const char *name)
if (!pool->name)
goto err;
+ init_waitqueue_head(&pool->migration_wait);
+
if (create_cache(pool))
goto err;
The patch below does not apply to the 5.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From a3384b8d9f63cc042711293bb97bdc92dca0391d Mon Sep 17 00:00:00 2001
From: Benjamin Tissoires <benjamin.tissoires(a)redhat.com>
Date: Tue, 13 Aug 2019 15:38:07 +0200
Subject: [PATCH] HID: logitech-hidpp: remove support for the G700 over USB
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The G700 suffers from the same issue than the G502:
when plugging it in, the driver tries to contact it but it fails.
This timeout is problematic as it introduce a delay in the boot,
and having only the mouse event node means that the hardware
macros keys can not be relayed to the userspace.
Link: https://github.com/libratbag/libratbag/issues/797
Fixes: 91cf9a98ae41 ("HID: logitech-hidpp: make .probe usbhid capable")
Cc: stable(a)vger.kernel.org # v5.2
Reviewed-by: Filipe Laíns <lains(a)archlinux.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com>
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 343052b117a9..0179f7ed77e5 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -3751,8 +3751,6 @@ static const struct hid_device_id hidpp_devices[] = {
{ /* Logitech G403 Wireless Gaming Mouse over USB */
HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC082) },
- { /* Logitech G700 Gaming Mouse over USB */
- HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC06B) },
{ /* Logitech G703 Gaming Mouse over USB */
HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC087) },
{ /* Logitech G703 Hero Gaming Mouse over USB */
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/139934
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
We grabbed the 8e60272ede63 commit of the stable queue repository.
We then merged the patchset with `git am`:
dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch
afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch
fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch
afs-fix-off-by-one-in-afs_rename-expected-data-versi.patch
afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch
afs-fix-missing-dentry-data-version-updating.patch
nvmet-fix-use-after-free-bug-when-a-port-is-removed.patch
nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch
nvmet-file-fix-nvmet_file_flush-always-returning-an-.patch
nvme-core-fix-extra-device_put-call-on-error-path.patch
nvme-fix-a-possible-deadlock-when-passthru-commands-.patch
nvme-rdma-fix-possible-use-after-free-in-connect-err.patch
nvme-fix-controller-removal-race-with-scan-work.patch
nvme-pci-fix-async-probe-remove-race.patch
soundwire-cadence_master-fix-register-definition-for.patch
soundwire-cadence_master-fix-definitions-for-intstat.patch
auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
btrfs-trim-check-the-range-passed-into-to-prevent-ov.patch
ib-mlx5-fix-implicit-mr-release-flow.patch
dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch
omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch
iommu-dma-handle-sg-length-overflow-better.patch
dma-direct-don-t-truncate-dma_required_mask-to-bus-a.patch
usb-gadget-composite-clear-suspended-on-reset-discon.patch
usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
habanalabs-fix-dram-usage-accounting-on-context-tear.patch
habanalabs-fix-endianness-handling-for-packets-from-.patch
habanalabs-fix-completion-queue-handling-when-host-i.patch
habanalabs-fix-endianness-handling-for-internal-qman.patch
habanalabs-fix-device-irq-unmasking-for-be-host.patch
xen-blkback-fix-memory-leaks.patch
arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch
riscv-fix-flush_tlb_range-end-address-for-flush_tlb_.patch
i2c-rcar-avoid-race-when-unregistering-slave-client.patch
i2c-emev2-avoid-race-when-unregistering-slave-client.patch
drm-scheduler-use-job-count-instead-of-peek.patch
drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
usb-host-fotg2-restart-hcd-after-port-reset.patch
tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch
tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
locking-rwsem-add-missing-acquire-to-read_slowpath-e.patch
lcoking-rwsem-add-missing-acquire-to-read_slowpath-s.patch
watchdog-bcm2835_wdt-fix-module-autoload.patch
selftests-bpf-install-files-test_xdp_vlan.sh.patch
drm-bridge-tfp410-fix-memleak-in-get_modes.patch
mt76-usb-fix-rx-a-msdu-support.patch
ipv6-addrconf-allow-adding-multicast-addr-if-ifa_f_mcautojoin-is-set.patch
ipv6-fix-return-value-of-ipv6_mc_may_pull-for-malformed-packets.patch
net-cpsw-fix-null-pointer-exception-in-the-probe-error-path.patch
net-fix-__ip_mc_inc_group-usage.patch
net-smc-make-sure-epollout-is-raised.patch
tcp-make-sure-epollout-wont-be-missed.patch
ipv4-mpls-fix-mpls_xmit-for-iptunnel.patch
openvswitch-fix-conntrack-cache-with-timeout.patch
ipv4-icmp-fix-rt-dst-dev-null-pointer-dereference.patch
xfrm-xfrm_policy-fix-dst-dev-null-pointer-dereference-in-collect_md-mode.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ Ethernet drivers sanity [8]
✅ Networking socket: fuzz [9]
✅ Networking: igmp conformance test [10]
✅ audit: audit testsuite test [11]
✅ httpd: mod_ssl smoke sanity [12]
✅ iotop: sanity [13]
✅ tuned: tune-processes-through-perf [14]
✅ Usex - version 1.9-29 [15]
✅ stress: stress-ng [16]
🚧 ✅ LTP lite [17]
🚧 ✅ Networking ipsec: basic netns transport [18]
🚧 ✅ Networking ipsec: basic netns tunnel [18]
ppc64le:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ Ethernet drivers sanity [8]
✅ Networking socket: fuzz [9]
✅ audit: audit testsuite test [11]
✅ httpd: mod_ssl smoke sanity [12]
✅ iotop: sanity [13]
✅ tuned: tune-processes-through-perf [14]
✅ Usex - version 1.9-29 [15]
🚧 ✅ LTP lite [17]
🚧 ✅ Networking ipsec: basic netns tunnel [18]
x86_64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ Ethernet drivers sanity [8]
✅ Networking socket: fuzz [9]
✅ Networking: igmp conformance test [10]
✅ audit: audit testsuite test [11]
✅ httpd: mod_ssl smoke sanity [12]
✅ iotop: sanity [13]
✅ tuned: tune-processes-through-perf [14]
✅ pciutils: sanity smoke test [19]
✅ Usex - version 1.9-29 [15]
✅ stress: stress-ng [16]
🚧 ✅ LTP lite [17]
🚧 ✅ Networking ipsec: basic netns transport [18]
🚧 ✅ Networking ipsec: basic netns tunnel [18]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
🚧 ✅ IOMMU boot test [20]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#networking/i…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/iommu/boot
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 9212ec7d8357ea630031e89d0d399c761421c83b Mon Sep 17 00:00:00 2001
From: Sebastian Mayr <me(a)sam.st>
Date: Sun, 28 Jul 2019 17:26:17 +0200
Subject: [PATCH] uprobes/x86: Fix detection of 32-bit user mode
32-bit processes running on a 64-bit kernel are not always detected
correctly, causing the process to crash when uretprobes are installed.
The reason for the crash is that in_ia32_syscall() is used to determine the
process's mode, which only works correctly when called from a syscall.
In the case of uretprobes, however, the function is called from a exception
and always returns 'false' on a 64-bit kernel. In consequence this leads to
corruption of the process's return address.
Fix this by using user_64bit_mode() instead of in_ia32_syscall(), which
is correct in any situation.
[ tglx: Add a comment and the following historical info ]
This should have been detected by the rename which happened in commit
abfb9498ee13 ("x86/entry: Rename is_{ia32,x32}_task() to in_{ia32,x32}_syscall()")
which states in the changelog:
The is_ia32_task()/is_x32_task() function names are a big misnomer: they
suggests that the compat-ness of a system call is a task property, which
is not true, the compatness of a system call purely depends on how it
was invoked through the system call layer.
.....
and then it went and blindly renamed every call site.
Sadly enough this was already mentioned here:
8faaed1b9f50 ("uprobes/x86: Introduce sizeof_long(), cleanup adjust_ret_addr() and
arch_uretprobe_hijack_return_addr()")
where the changelog says:
TODO: is_ia32_task() is not what we actually want, TS_COMPAT does
not necessarily mean 32bit. Fortunately syscall-like insns can't be
probed so it actually works, but it would be better to rename and
use is_ia32_frame().
and goes all the way back to:
0326f5a94dde ("uprobes/core: Handle breakpoint and singlestep exceptions")
Oh well. 7+ years until someone actually tried a uretprobe on a 32bit
process on a 64bit kernel....
Fixes: 0326f5a94dde ("uprobes/core: Handle breakpoint and singlestep exceptions")
Signed-off-by: Sebastian Mayr <me(a)sam.st>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Masami Hiramatsu <mhiramat(a)kernel.org>
Cc: Dmitry Safonov <dsafonov(a)virtuozzo.com>
Cc: Oleg Nesterov <oleg(a)redhat.com>
Cc: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com>
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20190728152617.7308-1-me@sam.st
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index d8359ebeea70..8cd745ef8c7b 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -508,9 +508,12 @@ struct uprobe_xol_ops {
void (*abort)(struct arch_uprobe *, struct pt_regs *);
};
-static inline int sizeof_long(void)
+static inline int sizeof_long(struct pt_regs *regs)
{
- return in_ia32_syscall() ? 4 : 8;
+ /*
+ * Check registers for mode as in_xxx_syscall() does not apply here.
+ */
+ return user_64bit_mode(regs) ? 8 : 4;
}
static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
@@ -521,9 +524,9 @@ static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
static int emulate_push_stack(struct pt_regs *regs, unsigned long val)
{
- unsigned long new_sp = regs->sp - sizeof_long();
+ unsigned long new_sp = regs->sp - sizeof_long(regs);
- if (copy_to_user((void __user *)new_sp, &val, sizeof_long()))
+ if (copy_to_user((void __user *)new_sp, &val, sizeof_long(regs)))
return -EFAULT;
regs->sp = new_sp;
@@ -556,7 +559,7 @@ static int default_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs
long correction = utask->vaddr - utask->xol_vaddr;
regs->ip += correction;
} else if (auprobe->defparam.fixups & UPROBE_FIX_CALL) {
- regs->sp += sizeof_long(); /* Pop incorrect return address */
+ regs->sp += sizeof_long(regs); /* Pop incorrect return address */
if (emulate_push_stack(regs, utask->vaddr + auprobe->defparam.ilen))
return -ERESTART;
}
@@ -675,7 +678,7 @@ static int branch_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
* "call" insn was executed out-of-line. Just restore ->sp and restart.
* We could also restore ->ip and try to call branch_emulate_op() again.
*/
- regs->sp += sizeof_long();
+ regs->sp += sizeof_long(regs);
return -ERESTART;
}
@@ -1056,7 +1059,7 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
unsigned long
arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs *regs)
{
- int rasize = sizeof_long(), nleft;
+ int rasize = sizeof_long(regs), nleft;
unsigned long orig_ret_vaddr = 0; /* clear high bits for 32-bit apps */
if (copy_from_user(&orig_ret_vaddr, (void __user *)regs->sp, rasize))
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 9212ec7d8357ea630031e89d0d399c761421c83b Mon Sep 17 00:00:00 2001
From: Sebastian Mayr <me(a)sam.st>
Date: Sun, 28 Jul 2019 17:26:17 +0200
Subject: [PATCH] uprobes/x86: Fix detection of 32-bit user mode
32-bit processes running on a 64-bit kernel are not always detected
correctly, causing the process to crash when uretprobes are installed.
The reason for the crash is that in_ia32_syscall() is used to determine the
process's mode, which only works correctly when called from a syscall.
In the case of uretprobes, however, the function is called from a exception
and always returns 'false' on a 64-bit kernel. In consequence this leads to
corruption of the process's return address.
Fix this by using user_64bit_mode() instead of in_ia32_syscall(), which
is correct in any situation.
[ tglx: Add a comment and the following historical info ]
This should have been detected by the rename which happened in commit
abfb9498ee13 ("x86/entry: Rename is_{ia32,x32}_task() to in_{ia32,x32}_syscall()")
which states in the changelog:
The is_ia32_task()/is_x32_task() function names are a big misnomer: they
suggests that the compat-ness of a system call is a task property, which
is not true, the compatness of a system call purely depends on how it
was invoked through the system call layer.
.....
and then it went and blindly renamed every call site.
Sadly enough this was already mentioned here:
8faaed1b9f50 ("uprobes/x86: Introduce sizeof_long(), cleanup adjust_ret_addr() and
arch_uretprobe_hijack_return_addr()")
where the changelog says:
TODO: is_ia32_task() is not what we actually want, TS_COMPAT does
not necessarily mean 32bit. Fortunately syscall-like insns can't be
probed so it actually works, but it would be better to rename and
use is_ia32_frame().
and goes all the way back to:
0326f5a94dde ("uprobes/core: Handle breakpoint and singlestep exceptions")
Oh well. 7+ years until someone actually tried a uretprobe on a 32bit
process on a 64bit kernel....
Fixes: 0326f5a94dde ("uprobes/core: Handle breakpoint and singlestep exceptions")
Signed-off-by: Sebastian Mayr <me(a)sam.st>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Masami Hiramatsu <mhiramat(a)kernel.org>
Cc: Dmitry Safonov <dsafonov(a)virtuozzo.com>
Cc: Oleg Nesterov <oleg(a)redhat.com>
Cc: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com>
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20190728152617.7308-1-me@sam.st
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index d8359ebeea70..8cd745ef8c7b 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -508,9 +508,12 @@ struct uprobe_xol_ops {
void (*abort)(struct arch_uprobe *, struct pt_regs *);
};
-static inline int sizeof_long(void)
+static inline int sizeof_long(struct pt_regs *regs)
{
- return in_ia32_syscall() ? 4 : 8;
+ /*
+ * Check registers for mode as in_xxx_syscall() does not apply here.
+ */
+ return user_64bit_mode(regs) ? 8 : 4;
}
static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
@@ -521,9 +524,9 @@ static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
static int emulate_push_stack(struct pt_regs *regs, unsigned long val)
{
- unsigned long new_sp = regs->sp - sizeof_long();
+ unsigned long new_sp = regs->sp - sizeof_long(regs);
- if (copy_to_user((void __user *)new_sp, &val, sizeof_long()))
+ if (copy_to_user((void __user *)new_sp, &val, sizeof_long(regs)))
return -EFAULT;
regs->sp = new_sp;
@@ -556,7 +559,7 @@ static int default_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs
long correction = utask->vaddr - utask->xol_vaddr;
regs->ip += correction;
} else if (auprobe->defparam.fixups & UPROBE_FIX_CALL) {
- regs->sp += sizeof_long(); /* Pop incorrect return address */
+ regs->sp += sizeof_long(regs); /* Pop incorrect return address */
if (emulate_push_stack(regs, utask->vaddr + auprobe->defparam.ilen))
return -ERESTART;
}
@@ -675,7 +678,7 @@ static int branch_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
* "call" insn was executed out-of-line. Just restore ->sp and restart.
* We could also restore ->ip and try to call branch_emulate_op() again.
*/
- regs->sp += sizeof_long();
+ regs->sp += sizeof_long(regs);
return -ERESTART;
}
@@ -1056,7 +1059,7 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
unsigned long
arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs *regs)
{
- int rasize = sizeof_long(), nleft;
+ int rasize = sizeof_long(regs), nleft;
unsigned long orig_ret_vaddr = 0; /* clear high bits for 32-bit apps */
if (copy_from_user(&orig_ret_vaddr, (void __user *)regs->sp, rasize))
Please consider
commit b14c876b994f208b6b95c222056e1deb0a45de0e
Author: Radim Krcmar <rkrcmar(a)redhat.com>
Date: Tue Aug 13 23:37:37 2019 -0400
kvm: x86: skip populating logical dest map if apic is not sw enabled
This fixes 1e08ec4a130e2745d96df169e67c58df98a07311 that was introduced in v3.7.
The bug is that the KVM lapic is not considering whether the guest apic is enabled before
populating the apic in the logical destination table.
Thanks,
Bandan
The ADC in the JZ4740 can work either in high-precision mode with a 2.5V
range, or in low-precision mode with a 7.5V range. The code in place in
this driver will select the proper scale according to the maximum
voltage of the battery.
The JZ4770 however only has one mode, with a 6.6V range. If only one
scale is available, there's no need to change it (and nothing to change
it to), and trying to do so will fail with -EINVAL.
Fixes commit fb24ccfbe1e0 ("power: supply: add Ingenic JZ47xx battery
driver.")
Signed-off-by: Paul Cercueil <paul(a)crapouillou.net>
Cc: stable(a)vger.kernel.org
---
drivers/power/supply/ingenic-battery.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/power/supply/ingenic-battery.c b/drivers/power/supply/ingenic-battery.c
index 35816d4b3012..5a53057b4f64 100644
--- a/drivers/power/supply/ingenic-battery.c
+++ b/drivers/power/supply/ingenic-battery.c
@@ -80,6 +80,10 @@ static int ingenic_battery_set_scale(struct ingenic_battery *bat)
if (ret != IIO_AVAIL_LIST || scale_type != IIO_VAL_FRACTIONAL_LOG2)
return -EINVAL;
+ /* Only one (fractional) entry - nothing to change */
+ if (scale_len == 2)
+ return 0;
+
max_mV = bat->info.voltage_max_design_uv / 1000;
for (i = 0; i < scale_len; i += 2) {
--
2.21.0.593.g511ec345e18
The following patch causes a build failure:
Author: Henry Burns <henryburns(a)google.com>
Date: Sat Aug 24 17:55:06 2019 -0700
mm/zsmalloc.c: fix race condition in zs_destroy_pool
I get this error:
CALL scripts/checksyscalls.sh
CALL scripts/atomic/check-atomics.sh
DESCEND objtool
CHK include/generated/compile.h
CC mm/zsmalloc.o
In file included from ./include/linux/mmzone.h:10:0,
from ./include/linux/gfp.h:6,
from ./include/linux/umh.h:4,
from ./include/linux/kmod.h:9,
from ./include/linux/module.h:13,
from mm/zsmalloc.c:33:
mm/zsmalloc.c: In function ‘zs_create_pool’:
mm/zsmalloc.c:2435:27: error: ‘struct zs_pool’ has no member named
‘migration_wait’
init_waitqueue_head(&pool->migration_wait);
^
./include/linux/wait.h:67:26: note: in definition of macro ‘init_waitqueue_head’
__init_waitqueue_head((wq_head), #wq_head, &__key); \
^~~~~~~
scripts/Makefile.build:278: recipe for target 'mm/zsmalloc.o' failed
make[1]: *** [mm/zsmalloc.o] Error 1
Makefile:1073: recipe for target 'mm' failed
You can find my configuration file attached.
Does anybody have any idea about this ?
Thanks in advance,
François Valenduc
On Fri, Aug 30, 2019 at 05:51:17PM -0400, Hui Peng wrote:
> This is the backported patch for the following fix to v4.4.x and v4.14.x:
> 19bce474c45b ("ALSA: usb-audio: Fix a stack buffer overflow bug in
> check_input_term")
Now queued up, thanks.
greg k-h
On Fri, Aug 30, 2019 at 05:49:59PM -0400, Hui Peng wrote:
> This is the backported patch of the following bug to v4.4.x and v4.14.x:
> daac07156b33 ("ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit")
Thanks, also now queued up to 4.9.y, you forgot that one :)
greg k-h
From: Dexuan Cui <decui(a)microsoft.com>
[ Upstream commit 685703b497bacea8765bb409d6b73455b73c540e ]
There is a race condition for an established connection that is being closed
by the guest: the refcnt is 4 at the end of hvs_release() (Note: here the
'remove_sock' is false):
1 for the initial value;
1 for the sk being in the bound list;
1 for the sk being in the connected list;
1 for the delayed close_work.
After hvs_release() finishes, __vsock_release() -> sock_put(sk) *may*
decrease the refcnt to 3.
Concurrently, hvs_close_connection() runs in another thread:
calls vsock_remove_sock() to decrease the refcnt by 2;
call sock_put() to decrease the refcnt to 0, and free the sk;
next, the "release_sock(sk)" may hang due to use-after-free.
In the above, after hvs_release() finishes, if hvs_close_connection() runs
faster than "__vsock_release() -> sock_put(sk)", then there is not any issue,
because at the beginning of hvs_close_connection(), the refcnt is still 4.
The issue can be resolved if an extra reference is taken when the
connection is established.
Fixes: a9eeb998c28d ("hv_sock: Add support for delayed close")
Signed-off-by: Dexuan Cui <decui(a)microsoft.com>
Reviewed-by: Sunil Muthuswamy <sunilmut(a)microsoft.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
net/vmw_vsock/hyperv_transport.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
index 9c7da811d130f..98f193fd5315e 100644
--- a/net/vmw_vsock/hyperv_transport.c
+++ b/net/vmw_vsock/hyperv_transport.c
@@ -320,6 +320,11 @@ static void hvs_close_connection(struct vmbus_channel *chan)
lock_sock(sk);
hvs_do_close_lock_held(vsock_sk(sk), true);
release_sock(sk);
+
+ /* Release the refcnt for the channel that's opened in
+ * hvs_open_connection().
+ */
+ sock_put(sk);
}
static void hvs_open_connection(struct vmbus_channel *chan)
@@ -388,6 +393,9 @@ static void hvs_open_connection(struct vmbus_channel *chan)
}
set_per_channel_state(chan, conn_from_host ? new : sk);
+
+ /* This reference will be dropped by hvs_close_connection(). */
+ sock_hold(conn_from_host ? new : sk);
vmbus_set_chn_rescind_callback(chan, hvs_close_connection);
/* Set the pending send size to max packet size to always get
--
2.20.1
From: "John S. Gruber" <JohnSGruber(a)gmail.com>
commit a90118c445cc ("x86/boot: Save fields explicitly, zero out everything
else") now zeros the secure boot information passed by the boot loader or
by the kernel's efi handover mechanism. Include boot-params.secure_boot
in the preserve field list.
I noted a change in my computers between running signed 5.3-rc4 and 5.3-rc6
with signed kernels using the efi handoff protocol with grub. The kernel
log message "Secure boot enabled" becomes "Secure boot could not be
determined". The efi_main function in arch/x86/boot/compressed/eboot.c sets
this field early but it is subsequently zeroed by the above referenced
commit in the file arch/x86/include/asm/bootparam_utils.h
Fixes: commit a90118c445cc ("x86/boot: Save fields explicitly, zero
out everything else")
Signed-off-by: John S. Gruber <JohnSGruber(a)gmail.com>
---
Adjusted the patch for John Hubbard's comments.
arch/x86/include/asm/bootparam_utils.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/include/asm/bootparam_utils.h
b/arch/x86/include/asm/bootparam_utils.h
index 9e5f3c7..981fe92 100644
--- a/arch/x86/include/asm/bootparam_utils.h
+++ b/arch/x86/include/asm/bootparam_utils.h
@@ -70,6 +70,7 @@ static void sanitize_boot_params(struct boot_params
*boot_params)
BOOT_PARAM_PRESERVE(eddbuf_entries),
BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries),
BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer),
+ BOOT_PARAM_PRESERVE(secure_boot),
BOOT_PARAM_PRESERVE(hdr),
BOOT_PARAM_PRESERVE(e820_table),
BOOT_PARAM_PRESERVE(eddbuf),
--
2.7.4
the type flag is stored in the chip->flags field not in the
client->flags field. This currently leads to never using the ti
specific health function as client->flags doesn't use that bit.
So it's always falling back to the general one.
Fixes: 76b16f4cdfb8 ("power: supply: sbs-battery: don't assume
MANUFACTURER_DATA formats")
Signed-off-by: Michael Nosthoff <committed(a)heine.so>
Reviewed-by: Brian Norris <briannorris(a)chromium.org>
Cc: <stable(a)vger.kernel.org>
---
Changes since v1:
* Changed comment according to Brian's suggestions
* Added Fixes tag
* Added reviewed and cc stable
drivers/power/supply/sbs-battery.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/power/supply/sbs-battery.c b/drivers/power/supply/sbs-battery.c
index 048d205d7074..2e86cc1e0e35 100644
--- a/drivers/power/supply/sbs-battery.c
+++ b/drivers/power/supply/sbs-battery.c
@@ -620,7 +620,7 @@ static int sbs_get_property(struct power_supply *psy,
switch (psp) {
case POWER_SUPPLY_PROP_PRESENT:
case POWER_SUPPLY_PROP_HEALTH:
- if (client->flags & SBS_FLAGS_TI_BQ20Z75)
+ if (chip->flags & SBS_FLAGS_TI_BQ20Z75)
ret = sbs_get_ti_battery_presence_and_health(client,
psp, val);
else
--
2.20.1
when the battery is set to sbs-mode and no gpio detection is enabled
"health" is always returning a value even when the battery is not present.
All other fields return "not present".
This leads to a scenario where the driver is constantly switching between
"present" and "not present" state. This generates a lot of constant
traffic on the i2c.
This commit changes the response of "health" to an error when the battery
is not responding leading to a consistent "not present" state.
Fixes: 76b16f4cdfb8 ("power: supply: sbs-battery: don't assume
MANUFACTURER_DATA formats")
Signed-off-by: Michael Nosthoff <committed(a)heine.so>
Cc: Brian Norris <briannorris(a)chromium.org>
Cc: <stable(a)vger.kernel.org>
---
drivers/power/supply/sbs-battery.c | 25 ++++++++++++++++---------
1 file changed, 16 insertions(+), 9 deletions(-)
diff --git a/drivers/power/supply/sbs-battery.c b/drivers/power/supply/sbs-battery.c
index 2e86cc1e0e35..f8d74e9f7931 100644
--- a/drivers/power/supply/sbs-battery.c
+++ b/drivers/power/supply/sbs-battery.c
@@ -314,17 +314,22 @@ static int sbs_get_battery_presence_and_health(
{
int ret;
- if (psp == POWER_SUPPLY_PROP_PRESENT) {
- /* Dummy command; if it succeeds, battery is present. */
- ret = sbs_read_word_data(client, sbs_data[REG_STATUS].addr);
- if (ret < 0)
- val->intval = 0; /* battery disconnected */
- else
- val->intval = 1; /* battery present */
- } else { /* POWER_SUPPLY_PROP_HEALTH */
+ /* Dummy command; if it succeeds, battery is present. */
+ ret = sbs_read_word_data(client, sbs_data[REG_STATUS].addr);
+
+ if (ret < 0) { /* battery not present*/
+ if (psp == POWER_SUPPLY_PROP_PRESENT) {
+ val->intval = 0;
+ return 0;
+ }
+ return ret;
+ }
+
+ if (psp == POWER_SUPPLY_PROP_PRESENT)
+ val->intval = 1; /* battery present */
+ else /* POWER_SUPPLY_PROP_HEALTH */
/* SBS spec doesn't have a general health command. */
val->intval = POWER_SUPPLY_HEALTH_UNKNOWN;
- }
return 0;
}
@@ -626,6 +631,8 @@ static int sbs_get_property(struct power_supply *psy,
else
ret = sbs_get_battery_presence_and_health(client, psp,
val);
+
+ /* this can only be true if no gpio is used */
if (psp == POWER_SUPPLY_PROP_PRESENT)
return 0;
break;
--
2.20.1
The `uac_mixer_unit_descriptor` shown as below is read from the
device side. In `parse_audio_mixer_unit`, `baSourceID` field is
accessed from index 0 to `bNrInPins` - 1, the current implementation
assumes that descriptor is always valid (the length of descriptor
is no shorter than 5 + `bNrInPins`). If a descriptor read from
the device side is invalid, it may trigger out-of-bound memory
access.
```
struct uac_mixer_unit_descriptor {
__u8 bLength;
__u8 bDescriptorType;
__u8 bDescriptorSubtype;
__u8 bUnitID;
__u8 bNrInPins;
__u8 baSourceID[];
}
```
This patch fixes the bug by add a sanity check on the length of
the descriptor.
CVE: CVE-2018-15117
Reported-by: Hui Peng <benquike(a)gmail.com>
Reported-by: Mathias Payer <mathias.payer(a)nebelwelt.net>
Signed-off-by: Hui Peng <benquike(a)gmail.com>
---
sound/usb/mixer.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 1f7eb3816cd7..10ddec76f906 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1628,6 +1628,7 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid,
int pin, ich, err;
if (desc->bLength < 11 || !(input_pins = desc->bNrInPins) ||
+ desc->bLength < sizeof(*desc) + desc->bNrInPins ||
!(num_outs = uac_mixer_unit_bNrChannels(desc))) {
usb_audio_err(state->chip,
"invalid MIXER UNIT descriptor %d\n",
--
2.17.1
On 9/1/19 8:38 AM, John S Gruber wrote:
> From: "John S. Gruber" <JohnSGruber(a)gmail.com>
>
> commit a90118c445cc ("x86/boot: Save fields explicitly, zero out everything
> else") now zeros the secure boot information passed by the boot loader or
> by the kernel's efi handover mechanism.
>
> Include boot-params.secure_boot in the preserve field list.
>
> Signed-off-by: John S. Gruber <JohnSGruber(a)gmail.com>
> ---
>
> I noted a change in my computers between running signed 5.3-rc4 and 5.3-rc6
> with signed kernels using the efi handoff protocol with grub. The kernel
> log message "Secure boot enabled" becomes "Secure boot could not be
> determined". The efi_main function in arch/x86/boot/compressed/eboot.c sets
> this field early but it is subsequently zeroed by the above referenced commit
> in the file arch/x86/include/asm/bootparam_utils.h
>
> Applies to 5.3-rc6.
>
Hi,
The fix itself looks good, so you can add:
Reviewed-by: John Hubbard <jhubbard(a)nvidia.com>
...but note that the commit description should get a few tweaks:
1. Your description above is actually well-suited for the commit log,
so please add that in. Especially the symptoms are desirable to have
on record.
2. This should Cc: stable(a)vger.kernel.org, because the whole thing
made it into -stable and those kernels need this fix.
3. Also need a Fixes tag:
Fixes: commit a90118c445cc ("x86/boot: Save fields explicitly, zero out everything else")
thanks,
--
John Hubbard
NVIDIA
> arch/x86/include/asm/bootparam_utils.h | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/arch/x86/include/asm/bootparam_utils.h
> b/arch/x86/include/asm/bootparam_utils.h
> index 9e5f3c7..981fe92 100644
> --- a/arch/x86/include/asm/bootparam_utils.h
> +++ b/arch/x86/include/asm/bootparam_utils.h
> @@ -70,6 +70,7 @@ static void sanitize_boot_params(struct boot_params
> *boot_params)
> BOOT_PARAM_PRESERVE(eddbuf_entries),
> BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries),
> BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer),
> + BOOT_PARAM_PRESERVE(secure_boot),
> BOOT_PARAM_PRESERVE(hdr),
> BOOT_PARAM_PRESERVE(e820_table),
> BOOT_PARAM_PRESERVE(eddbuf),
>
This is the start of the stable review cycle for the 4.14.138 release.
There are 33 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat 10 Aug 2019 07:03:19 PM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.138-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.138-rc1
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Fix 3-wire mode if DMA is enabled
Tejun Heo <tj(a)kernel.org>
cgroup: Fix css_task_iter_advance_css_set() cset skip condition
Tejun Heo <tj(a)kernel.org>
cgroup: css_task_iter_skip()'d iterators must be advanced before accessed
Tejun Heo <tj(a)kernel.org>
cgroup: Include dying leaders with live threads in PROCS iterations
Tejun Heo <tj(a)kernel.org>
cgroup: Implement css_task_iter_skip()
Tejun Heo <tj(a)kernel.org>
cgroup: Call cgroup_release() before __exit_signal()
Sudarsana Reddy Kalluru <skalluru(a)marvell.com>
bnx2x: Disable multi-cos feature.
Matteo Croce <mcroce(a)redhat.com>
mvpp2: refactor MTU change code
Alexis Bauvin <abauvin(a)scaleway.com>
tun: mark small packets as owned by the tap sock
Ariel Levkovich <lariel(a)mellanox.com>
net/mlx5e: Prevent encap flow counter update async to user query
Arnd Bergmann <arnd(a)arndb.de>
compat_ioctl: pppoe: fix PPPOEIOCSFWD handling
Taras Kondratiuk <takondra(a)cisco.com>
tipc: compat: allow tipc commands without arguments
Johan Hovold <johan(a)kernel.org>
NFC: nfcmrvl: fix gpio-handling regression
Jia-Ju Bai <baijiaju1990(a)gmail.com>
net: sched: Fix a possible null-pointer dereference in dequeue_func()
René van Dorst <opensource(a)vdorst.com>
net: phylink: Fix flow control for fixed-link
Mark Zhang <markz(a)mellanox.com>
net/mlx5: Use reversed order when unregister devices
Jiri Pirko <jiri(a)mellanox.com>
net: fix ifindex collision during namespace removal
Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com>
net: bridge: mcast: don't delete permanent entries when fast leave is enabled
Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com>
net: bridge: delete local fdb on device init failure
Haishuang Yan <yanhaishuang(a)cmss.chinamobile.com>
ip6_tunnel: fix possible use-after-free on xmit
Cong Wang <xiyou.wangcong(a)gmail.com>
ife: error out when nla attributes are empty
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
atm: iphase: Fix Spectre v1 vulnerability
Josh Poimboeuf <jpoimboe(a)redhat.com>
objtool: Add rewind_stack_do_exit() to the noreturn list
Josh Poimboeuf <jpoimboe(a)redhat.com>
objtool: Add machine_real_restart() to the noreturn list
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
IB: directly cast the sockaddr union to aockaddr
Jason Gunthorpe <jgg(a)mellanox.com>
RDMA: Directly cast the sockaddr union to sockaddr
Sebastian Parschauer <s.parschauer(a)gmx.de>
HID: Add quirk for HP X1200 PIXART OEM mouse
Aaron Armstrong Skomra <skomra(a)gmail.com>
HID: wacom: fix bit shift for Cintiq Companion 2
Will Deacon <will(a)kernel.org>
arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG}
Eric Dumazet <edumazet(a)google.com>
tcp: be more careful in tcp_fragment()
Adam Ford <aford173(a)gmail.com>
ARM: dts: Add pinmuxing for i2c2 and i2c3 for LogicPD torpedo
Adam Ford <aford173(a)gmail.com>
ARM: dts: Add pinmuxing for i2c2 and i2c3 for LogicPD SOM-LV
Hannes Reinecke <hare(a)suse.de>
scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/logicpd-som-lv.dtsi | 16 ++++
arch/arm/boot/dts/logicpd-torpedo-som.dtsi | 16 ++++
arch/arm64/include/asm/cpufeature.h | 7 +-
arch/arm64/kernel/cpufeature.c | 8 +-
drivers/atm/iphase.c | 8 +-
drivers/hid/hid-ids.h | 1 +
drivers/hid/usbhid/hid-quirks.c | 1 +
drivers/hid/wacom_wac.c | 12 +--
drivers/infiniband/core/addr.c | 15 ++-
drivers/infiniband/core/sa_query.c | 10 +-
drivers/infiniband/hw/ocrdma/ocrdma_ah.c | 5 +-
drivers/infiniband/hw/ocrdma/ocrdma_hw.c | 5 +-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 2 +-
drivers/net/ethernet/marvell/mvpp2.c | 41 +++-----
drivers/net/ethernet/mellanox/mlx5/core/dev.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +-
.../net/ethernet/mellanox/mlx5/core/fs_counters.c | 5 +
drivers/net/phy/phylink.c | 2 +
drivers/net/ppp/pppoe.c | 3 +
drivers/net/ppp/pppox.c | 13 +++
drivers/net/ppp/pptp.c | 3 +
drivers/net/tun.c | 1 +
drivers/nfc/nfcmrvl/main.c | 4 +-
drivers/nfc/nfcmrvl/uart.c | 4 +-
drivers/nfc/nfcmrvl/usb.c | 1 +
drivers/scsi/fcoe/fcoe_ctlr.c | 51 ++++------
drivers/scsi/libfc/fc_rport.c | 5 +-
drivers/spi/spi-bcm2835.c | 3 +-
fs/compat_ioctl.c | 3 -
include/linux/cgroup-defs.h | 1 +
include/linux/cgroup.h | 4 +
include/linux/if_pppox.h | 3 +
include/linux/mlx5/fs.h | 1 +
include/net/tcp.h | 17 ++++
include/scsi/libfcoe.h | 1 +
kernel/cgroup/cgroup.c | 106 +++++++++++++++------
kernel/exit.c | 2 +-
net/bridge/br_multicast.c | 3 +
net/bridge/br_vlan.c | 5 +
net/core/dev.c | 2 +
net/ipv4/tcp_output.c | 11 ++-
net/ipv6/ip6_tunnel.c | 6 +-
net/l2tp/l2tp_ppp.c | 3 +
net/sched/act_ife.c | 3 +
net/sched/sch_codel.c | 6 +-
net/tipc/netlink_compat.c | 11 ++-
tools/objtool/check.c | 2 +
48 files changed, 293 insertions(+), 149 deletions(-)
From: "Naveen N. Rao" <naveen.n.rao(a)linux.vnet.ibm.com>
In register_ftrace_function_probe(), we are not checking the return
value of alloc_and_copy_ftrace_hash(). The subsequent call to
ftrace_match_records() may end up dereferencing the same. Add a check to
ensure this doesn't happen.
Link: http://lkml.kernel.org/r/26e92574f25ad23e7cafa3cf5f7a819de1832cbe.156224952…
Cc: stable(a)vger.kernel.org
Fixes: 1ec3a81a0cf42 ("ftrace: Have each function probe use its own ftrace_ops")
Signed-off-by: Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
---
kernel/trace/ftrace.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 6200a6fe10e3..f9821a3374e9 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -4338,6 +4338,11 @@ register_ftrace_function_probe(char *glob, struct trace_array *tr,
old_hash = *orig_hash;
hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, old_hash);
+ if (!hash) {
+ ret = -ENOMEM;
+ goto out;
+ }
+
ret = ftrace_match_records(hash, glob, strlen(glob));
/* Nothing found? */
--
2.20.1
From: "Steven Rostedt (VMware)" <rostedt(a)goodmis.org>
The race between adding a function probe and reading the probes that exist
is very subtle. It needs a comment. Also, the issue can also happen if the
probe has has the EMPTY_HASH as its func_hash.
Cc: stable(a)vger.kernel.org
Fixes: 7b60f3d876156 ("ftrace: Dynamically create the probe ftrace_ops for the trace_array")
Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
---
kernel/trace/ftrace.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 80beed2cf0da..6200a6fe10e3 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -3096,7 +3096,11 @@ t_probe_next(struct seq_file *m, loff_t *pos)
hash = iter->probe->ops.func_hash->filter_hash;
- if (!hash)
+ /*
+ * A probe being registered may temporarily have an empty hash
+ * and it's at the end of the func_probes list.
+ */
+ if (!hash || hash == EMPTY_HASH)
return NULL;
size = 1 << hash->size_bits;
@@ -4324,6 +4328,10 @@ register_ftrace_function_probe(char *glob, struct trace_array *tr,
mutex_unlock(&ftrace_lock);
+ /*
+ * Note, there's a small window here that the func_hash->filter_hash
+ * may be NULL or empty. Need to be carefule when reading the loop.
+ */
mutex_lock(&probe->ops.func_hash->regex_lock);
orig_hash = &probe->ops.func_hash->filter_hash;
--
2.20.1
From: "Naveen N. Rao" <naveen.n.rao(a)linux.vnet.ibm.com>
LTP testsuite on powerpc results in the below crash:
Unable to handle kernel paging request for data at address 0x00000000
Faulting instruction address: 0xc00000000029d800
Oops: Kernel access of bad area, sig: 11 [#1]
LE SMP NR_CPUS=2048 NUMA PowerNV
...
CPU: 68 PID: 96584 Comm: cat Kdump: loaded Tainted: G W
NIP: c00000000029d800 LR: c00000000029dac4 CTR: c0000000001e6ad0
REGS: c0002017fae8ba10 TRAP: 0300 Tainted: G W
MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 28022422 XER: 20040000
CFAR: c00000000029d90c DAR: 0000000000000000 DSISR: 40000000 IRQMASK: 0
...
NIP [c00000000029d800] t_probe_next+0x60/0x180
LR [c00000000029dac4] t_mod_start+0x1a4/0x1f0
Call Trace:
[c0002017fae8bc90] [c000000000cdbc40] _cond_resched+0x10/0xb0 (unreliable)
[c0002017fae8bce0] [c0000000002a15b0] t_start+0xf0/0x1c0
[c0002017fae8bd30] [c0000000004ec2b4] seq_read+0x184/0x640
[c0002017fae8bdd0] [c0000000004a57bc] sys_read+0x10c/0x300
[c0002017fae8be30] [c00000000000b388] system_call+0x5c/0x70
The test (ftrace_set_ftrace_filter.sh) is part of ftrace stress tests
and the crash happens when the test does 'cat
$TRACING_PATH/set_ftrace_filter'.
The address points to the second line below, in t_probe_next(), where
filter_hash is dereferenced:
hash = iter->probe->ops.func_hash->filter_hash;
size = 1 << hash->size_bits;
This happens due to a race with register_ftrace_function_probe(). A new
ftrace_func_probe is created and added into the func_probes list in
trace_array under ftrace_lock. However, before initializing the filter,
we drop ftrace_lock, and re-acquire it after acquiring regex_lock. If
another process is trying to read set_ftrace_filter, it will be able to
acquire ftrace_lock during this window and it will end up seeing a NULL
filter_hash.
Fix this by just checking for a NULL filter_hash in t_probe_next(). If
the filter_hash is NULL, then this probe is just being added and we can
simply return from here.
Link: http://lkml.kernel.org/r/05e021f757625cbbb006fad41380323dbe4e3b43.156224952…
Cc: stable(a)vger.kernel.org
Fixes: 7b60f3d876156 ("ftrace: Dynamically create the probe ftrace_ops for the trace_array")
Signed-off-by: Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
---
kernel/trace/ftrace.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index eca34503f178..80beed2cf0da 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -3095,6 +3095,10 @@ t_probe_next(struct seq_file *m, loff_t *pos)
hnd = &iter->probe_entry->hlist;
hash = iter->probe->ops.func_hash->filter_hash;
+
+ if (!hash)
+ return NULL;
+
size = 1 << hash->size_bits;
retry:
--
2.20.1
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
The results of these automated tests are provided below.
Overall result: FAILED (see details below)
Merge: OK
Compile: OK
Tests: FAILED
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/133683
One or more kernel tests failed:
aarch64:
❌ Boot test
We hope that these logs can help you find the problem quickly. For the full
detail on our testing procedures, please scroll to the bottom of this message.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
We grabbed the 3f740c3323de commit of the stable queue repository.
We then merged the patchset with `git am`:
dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch
afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch
fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch
afs-fix-off-by-one-in-afs_rename-expected-data-versi.patch
afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch
afs-fix-missing-dentry-data-version-updating.patch
nvmet-fix-use-after-free-bug-when-a-port-is-removed.patch
nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch
nvmet-file-fix-nvmet_file_flush-always-returning-an-.patch
nvme-core-fix-extra-device_put-call-on-error-path.patch
nvme-fix-a-possible-deadlock-when-passthru-commands-.patch
nvme-rdma-fix-possible-use-after-free-in-connect-err.patch
nvme-fix-controller-removal-race-with-scan-work.patch
nvme-pci-fix-async-probe-remove-race.patch
soundwire-cadence_master-fix-register-definition-for.patch
soundwire-cadence_master-fix-definitions-for-intstat.patch
auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
btrfs-trim-check-the-range-passed-into-to-prevent-ov.patch
ib-mlx5-fix-implicit-mr-release-flow.patch
dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch
omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch
iommu-dma-handle-sg-length-overflow-better.patch
dma-direct-don-t-truncate-dma_required_mask-to-bus-a.patch
usb-gadget-composite-clear-suspended-on-reset-discon.patch
usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
habanalabs-fix-dram-usage-accounting-on-context-tear.patch
habanalabs-fix-endianness-handling-for-packets-from-.patch
habanalabs-fix-completion-queue-handling-when-host-i.patch
habanalabs-fix-endianness-handling-for-internal-qman.patch
habanalabs-fix-device-irq-unmasking-for-be-host.patch
xen-blkback-fix-memory-leaks.patch
arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch
riscv-fix-flush_tlb_range-end-address-for-flush_tlb_.patch
i2c-rcar-avoid-race-when-unregistering-slave-client.patch
i2c-emev2-avoid-race-when-unregistering-slave-client.patch
drm-scheduler-use-job-count-instead-of-peek.patch
drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
usb-host-fotg2-restart-hcd-after-port-reset.patch
tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch
tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
locking-rwsem-add-missing-acquire-to-read_slowpath-e.patch
lcoking-rwsem-add-missing-acquire-to-read_slowpath-s.patch
watchdog-bcm2835_wdt-fix-module-autoload.patch
selftests-bpf-install-files-test_xdp_vlan.sh.patch
drm-bridge-tfp410-fix-memleak-in-get_modes.patch
mt76-usb-fix-rx-a-msdu-support.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
Host 2:
❌ Boot test [0]
⚡⚡⚡ Podman system integration test (as root) [3]
⚡⚡⚡ Podman system integration test (as user) [3]
⚡⚡⚡ Loopdev Sanity [4]
⚡⚡⚡ jvm test suite [5]
⚡⚡⚡ AMTU (Abstract Machine Test Utility) [6]
⚡⚡⚡ LTP: openposix test suite [7]
⚡⚡⚡ audit: audit testsuite test [8]
⚡⚡⚡ httpd: mod_ssl smoke sanity [9]
⚡⚡⚡ iotop: sanity [10]
⚡⚡⚡ tuned: tune-processes-through-perf [11]
⚡⚡⚡ Usex - version 1.9-29 [12]
⚡⚡⚡ stress: stress-ng [13]
🚧 ⚡⚡⚡ LTP lite [14]
ppc64le:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ audit: audit testsuite test [8]
✅ httpd: mod_ssl smoke sanity [9]
✅ iotop: sanity [10]
✅ tuned: tune-processes-through-perf [11]
✅ Usex - version 1.9-29 [12]
🚧 ✅ LTP lite [14]
x86_64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
🚧 ✅ IOMMU boot test [15]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ audit: audit testsuite test [8]
✅ httpd: mod_ssl smoke sanity [9]
✅ iotop: sanity [10]
✅ tuned: tune-processes-through-perf [11]
✅ pciutils: sanity smoke test [16]
✅ Usex - version 1.9-29 [12]
✅ stress: stress-ng [13]
🚧 ✅ LTP lite [14]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/iommu/boot
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
From: Shakeel Butt <shakeelb(a)google.com>
Subject: mm: memcontrol: fix percpu vmstats and vmevents flush
Instead of using raw_cpu_read() use per_cpu() to read the actual data of
the corresponding cpu otherwise we will be reading the data of the current
cpu for the number of online CPUs.
Link: http://lkml.kernel.org/r/20190829203110.129263-1-shakeelb@google.com
Fixes: bb65f89b7d3d ("mm: memcontrol: flush percpu vmevents before releasing memcg")
Fixes: c350a99ea2b1 ("mm: memcontrol: flush percpu vmstats before releasing memcg")
Signed-off-by: Shakeel Butt <shakeelb(a)google.com>
Acked-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/mm/memcontrol.c~mm-memcontrol-fix-percpu-vmstats-and-vmevents-flush
+++ a/mm/memcontrol.c
@@ -3278,7 +3278,7 @@ static void memcg_flush_percpu_vmstats(s
for_each_online_cpu(cpu)
for (i = min_idx; i < max_idx; i++)
- stat[i] += raw_cpu_read(memcg->vmstats_percpu->stat[i]);
+ stat[i] += per_cpu(memcg->vmstats_percpu->stat[i], cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = min_idx; i < max_idx; i++)
@@ -3296,8 +3296,8 @@ static void memcg_flush_percpu_vmstats(s
for_each_online_cpu(cpu)
for (i = min_idx; i < max_idx; i++)
- stat[i] += raw_cpu_read(
- pn->lruvec_stat_cpu->count[i]);
+ stat[i] += per_cpu(
+ pn->lruvec_stat_cpu->count[i], cpu);
for (pi = pn; pi; pi = parent_nodeinfo(pi, node))
for (i = min_idx; i < max_idx; i++)
@@ -3316,8 +3316,8 @@ static void memcg_flush_percpu_vmevents(
for_each_online_cpu(cpu)
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
- events[i] += raw_cpu_read(
- memcg->vmstats_percpu->events[i]);
+ events[i] += per_cpu(memcg->vmstats_percpu->events[i],
+ cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
_
From: Roman Gushchin <guro(a)fb.com>
Subject: mm, memcg: partially revert "mm/memcontrol.c: keep local VM counters in sync with the hierarchical ones"
Commit 766a4c19d880 ("mm/memcontrol.c: keep local VM counters in sync with
the hierarchical ones") effectively decreased the precision of per-memcg
vmstats_local and per-memcg-per-node lruvec percpu counters.
That's good for displaying in memory.stat, but brings a serious regression
into the reclaim process.
One issue I've discovered and debugged is the following: lruvec_lru_size()
can return 0 instead of the actual number of pages in the lru list,
preventing the kernel to reclaim last remaining pages. Result is yet
another dying memory cgroups flooding. The opposite is also happening:
scanning an empty lru list is the waste of cpu time.
Also, inactive_list_is_low() can return incorrect values, preventing the
active lru from being scanned and freed. It can fail both because the
size of active and inactive lists are inaccurate, and because the number
of workingset refaults isn't precise. In other words, the result is
pretty random.
I'm not sure, if using the approximate number of slab pages in
count_shadow_number() is acceptable, but issues described above are enough
to partially revert the patch.
Let's keep per-memcg vmstat_local batched (they are only used for
displaying stats to the userspace), but keep lruvec stats precise. This
change fixes the dead memcg flooding on my setup.
Link: http://lkml.kernel.org/r/20190817004726.2530670-1-guro@fb.com
Fixes: 766a4c19d880 ("mm/memcontrol.c: keep local VM counters in sync with the hierarchical ones")
Signed-off-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Yafang Shao <laoar.shao(a)gmail.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/mm/memcontrol.c~partially-revert-mm-memcontrolc-keep-local-vm-counters-in-sync-with-the-hierarchical-ones
+++ a/mm/memcontrol.c
@@ -752,15 +752,13 @@ void __mod_lruvec_state(struct lruvec *l
/* Update memcg */
__mod_memcg_state(memcg, idx, val);
+ /* Update lruvec */
+ __this_cpu_add(pn->lruvec_stat_local->count[idx], val);
+
x = val + __this_cpu_read(pn->lruvec_stat_cpu->count[idx]);
if (unlikely(abs(x) > MEMCG_CHARGE_BATCH)) {
struct mem_cgroup_per_node *pi;
- /*
- * Batch local counters to keep them in sync with
- * the hierarchical ones.
- */
- __this_cpu_add(pn->lruvec_stat_local->count[idx], x);
for (pi = pn; pi; pi = parent_nodeinfo(pi, pgdat->node_id))
atomic_long_add(x, &pi->lruvec_stat[idx]);
x = 0;
_
set_msi_sid_cb() is used to determine whether device aliases share the
same bus, but it can provide false indications that aliases use the same
bus when in fact they do not. The reason is that set_msi_sid_cb()
assumes that pdev is fixed, while actually pci_for_each_dma_alias() can
call fn() when pdev is set to a subordinate device.
As a result, running an VM on ESX with VT-d emulation enabled can
results in the log warning such as:
DMAR: [INTR-REMAP] Request device [00:11.0] fault index 3b [fault reason 38] Blocked an interrupt request due to source-id verification failure
This seems to cause additional ata errors such as:
ata3.00: qc timeout (cmd 0xa1)
ata3.00: failed to IDENTIFY (I/O error, err_mask=0x4)
These timeouts also cause boot to be much longer and other errors.
Fix it by checking comparing the alias with the previous one instead.
Fixes: 3f0c625c6ae71 ("iommu/vt-d: Allow interrupts from the entire bus for aliased devices")
Cc: stable(a)vger.kernel.org
Cc: Logan Gunthorpe <logang(a)deltatee.com>
Cc: David Woodhouse <dwmw2(a)infradead.org>
Cc: Joerg Roedel <joro(a)8bytes.org>
Cc: Jacob Pan <jacob.jun.pan(a)linux.intel.com>
Signed-off-by: Nadav Amit <namit(a)vmware.com>
---
drivers/iommu/intel_irq_remapping.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
index 4786ca061e31..81e43c1df7ec 100644
--- a/drivers/iommu/intel_irq_remapping.c
+++ b/drivers/iommu/intel_irq_remapping.c
@@ -376,13 +376,13 @@ static int set_msi_sid_cb(struct pci_dev *pdev, u16 alias, void *opaque)
{
struct set_msi_sid_data *data = opaque;
+ if (data->count == 0 || PCI_BUS_NUM(alias) == PCI_BUS_NUM(data->alias))
+ data->busmatch_count++;
+
data->pdev = pdev;
data->alias = alias;
data->count++;
- if (PCI_BUS_NUM(alias) == pdev->bus->number)
- data->busmatch_count++;
-
return 0;
}
--
2.17.1
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/132631
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
We grabbed the 39e22066fa51 commit of the stable queue repository.
We then merged the patchset with `git am`:
dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch
afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch
fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch
afs-fix-off-by-one-in-afs_rename-expected-data-versi.patch
afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch
afs-fix-missing-dentry-data-version-updating.patch
nvmet-fix-use-after-free-bug-when-a-port-is-removed.patch
nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch
nvmet-file-fix-nvmet_file_flush-always-returning-an-.patch
nvme-core-fix-extra-device_put-call-on-error-path.patch
nvme-fix-a-possible-deadlock-when-passthru-commands-.patch
nvme-rdma-fix-possible-use-after-free-in-connect-err.patch
nvme-fix-controller-removal-race-with-scan-work.patch
nvme-pci-fix-async-probe-remove-race.patch
soundwire-cadence_master-fix-register-definition-for.patch
soundwire-cadence_master-fix-definitions-for-intstat.patch
auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
btrfs-trim-check-the-range-passed-into-to-prevent-ov.patch
ib-mlx5-fix-implicit-mr-release-flow.patch
dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch
omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch
iommu-dma-handle-sg-length-overflow-better.patch
dma-direct-don-t-truncate-dma_required_mask-to-bus-a.patch
usb-gadget-composite-clear-suspended-on-reset-discon.patch
usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
habanalabs-fix-dram-usage-accounting-on-context-tear.patch
habanalabs-fix-endianness-handling-for-packets-from-.patch
habanalabs-fix-completion-queue-handling-when-host-i.patch
habanalabs-fix-endianness-handling-for-internal-qman.patch
habanalabs-fix-device-irq-unmasking-for-be-host.patch
xen-blkback-fix-memory-leaks.patch
arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch
riscv-fix-flush_tlb_range-end-address-for-flush_tlb_.patch
i2c-rcar-avoid-race-when-unregistering-slave-client.patch
i2c-emev2-avoid-race-when-unregistering-slave-client.patch
drm-scheduler-use-job-count-instead-of-peek.patch
drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
usb-host-fotg2-restart-hcd-after-port-reset.patch
tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch
tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
locking-rwsem-add-missing-acquire-to-read_slowpath-e.patch
lcoking-rwsem-add-missing-acquire-to-read_slowpath-s.patch
watchdog-bcm2835_wdt-fix-module-autoload.patch
selftests-bpf-install-files-test_xdp_vlan.sh.patch
drm-bridge-tfp410-fix-memleak-in-get_modes.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ audit: audit testsuite test [8]
✅ httpd: mod_ssl smoke sanity [9]
✅ iotop: sanity [10]
✅ tuned: tune-processes-through-perf [11]
✅ Usex - version 1.9-29 [12]
🚧 ✅ LTP lite [13]
ppc64le:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ audit: audit testsuite test [8]
✅ httpd: mod_ssl smoke sanity [9]
✅ iotop: sanity [10]
✅ tuned: tune-processes-through-perf [11]
✅ Usex - version 1.9-29 [12]
🚧 ✅ LTP lite [13]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
x86_64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ audit: audit testsuite test [8]
✅ httpd: mod_ssl smoke sanity [9]
✅ iotop: sanity [10]
✅ tuned: tune-processes-through-perf [11]
✅ pciutils: sanity smoke test [14]
✅ Usex - version 1.9-29 [12]
✅ stress: stress-ng [15]
🚧 ✅ LTP lite [13]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
🚧 ✅ IOMMU boot test [16]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/iommu/boot
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
From: Sven Eckelmann <sven(a)narfation.org>
[ Upstream commit fa3a03da549a889fc9dbc0d3c5908eb7882cac8f ]
The bucket variable is only updated outside the loop over the mcast_flags
buckets. It will only be updated during a dumping run when the dumping has
to be interrupted and a new message has to be started.
This could result in repeated or missing entries when the multicast flags
are dumped to userspace.
Fixes: d2d489b7d851 ("batman-adv: Add inconsistent multicast netlink dump detection")
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
net/batman-adv/multicast.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index ec54e236e3454..50fe9dfb088b6 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -1653,7 +1653,7 @@ __batadv_mcast_flags_dump(struct sk_buff *msg, u32 portid,
while (bucket_tmp < hash->size) {
if (batadv_mcast_flags_dump_bucket(msg, portid, cb, hash,
- *bucket, &idx_tmp))
+ bucket_tmp, &idx_tmp))
break;
bucket_tmp++;
--
2.20.1
Hi.
I'd like to get 2a92b08b1855 squeezed into a stable tree since it fixes
the following splat in the kernel log when using an MTK-based Wi-Fi
access point:
[135577.311588] usb 1-3: rx data too big 2044
[135577.311689] usb 1-3: rx data too big 2044
[135578.166351] usb 1-3: rx data too big 2044
See also: https://bugzilla.kernel.org/show_bug.cgi?id=203789
The patch applies to the v5.2.x series without conficts.
Lorenzo, are you fine with this?
Thanks.
--
Best regards,
Oleksandr Natalenko (post-factum)
Senior Software Maintenance Engineer
From: Dexuan Cui <decui(a)microsoft.com>
[ Upstream commit 685703b497bacea8765bb409d6b73455b73c540e ]
There is a race condition for an established connection that is being closed
by the guest: the refcnt is 4 at the end of hvs_release() (Note: here the
'remove_sock' is false):
1 for the initial value;
1 for the sk being in the bound list;
1 for the sk being in the connected list;
1 for the delayed close_work.
After hvs_release() finishes, __vsock_release() -> sock_put(sk) *may*
decrease the refcnt to 3.
Concurrently, hvs_close_connection() runs in another thread:
calls vsock_remove_sock() to decrease the refcnt by 2;
call sock_put() to decrease the refcnt to 0, and free the sk;
next, the "release_sock(sk)" may hang due to use-after-free.
In the above, after hvs_release() finishes, if hvs_close_connection() runs
faster than "__vsock_release() -> sock_put(sk)", then there is not any issue,
because at the beginning of hvs_close_connection(), the refcnt is still 4.
The issue can be resolved if an extra reference is taken when the
connection is established.
Fixes: a9eeb998c28d ("hv_sock: Add support for delayed close")
Signed-off-by: Dexuan Cui <decui(a)microsoft.com>
Reviewed-by: Sunil Muthuswamy <sunilmut(a)microsoft.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
net/vmw_vsock/hyperv_transport.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
index 52ac3e49c7efd..ec72a5edaa1b8 100644
--- a/net/vmw_vsock/hyperv_transport.c
+++ b/net/vmw_vsock/hyperv_transport.c
@@ -320,6 +320,11 @@ static void hvs_close_connection(struct vmbus_channel *chan)
lock_sock(sk);
hvs_do_close_lock_held(vsock_sk(sk), true);
release_sock(sk);
+
+ /* Release the refcnt for the channel that's opened in
+ * hvs_open_connection().
+ */
+ sock_put(sk);
}
static void hvs_open_connection(struct vmbus_channel *chan)
@@ -389,6 +394,9 @@ static void hvs_open_connection(struct vmbus_channel *chan)
}
set_per_channel_state(chan, conn_from_host ? new : sk);
+
+ /* This reference will be dropped by hvs_close_connection(). */
+ sock_hold(conn_from_host ? new : sk);
vmbus_set_chn_rescind_callback(chan, hvs_close_connection);
/* Set the pending send size to max packet size to always get
--
2.20.1
Instead of using raw_cpu_read() use per_cpu() to read the actual data of
the corresponding cpu otherwise we will be reading the data of the
current cpu for the number of online CPUs.
Fixes: bb65f89b7d3d ("mm: memcontrol: flush percpu vmevents before releasing memcg")
Fixes: c350a99ea2b1 ("mm: memcontrol: flush percpu vmstats before releasing memcg")
Signed-off-by: Shakeel Butt <shakeelb(a)google.com>
Cc: Roman Gushchin <guro(a)fb.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: <stable(a)vger.kernel.org>
---
Note: The buggy patches were marked for stable therefore adding Cc to
stable.
mm/memcontrol.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 26e2999af608..f4e60ee8b845 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3271,7 +3271,7 @@ static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg)
for_each_online_cpu(cpu)
for (i = 0; i < MEMCG_NR_STAT; i++)
- stat[i] += raw_cpu_read(memcg->vmstats_percpu->stat[i]);
+ stat[i] += per_cpu(memcg->vmstats_percpu->stat[i], cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = 0; i < MEMCG_NR_STAT; i++)
@@ -3286,8 +3286,8 @@ static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg)
for_each_online_cpu(cpu)
for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++)
- stat[i] += raw_cpu_read(
- pn->lruvec_stat_cpu->count[i]);
+ stat[i] += per_cpu(
+ pn->lruvec_stat_cpu->count[i], cpu);
for (pi = pn; pi; pi = parent_nodeinfo(pi, node))
for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++)
@@ -3306,8 +3306,8 @@ static void memcg_flush_percpu_vmevents(struct mem_cgroup *memcg)
for_each_online_cpu(cpu)
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
- events[i] += raw_cpu_read(
- memcg->vmstats_percpu->events[i]);
+ events[i] += per_cpu(memcg->vmstats_percpu->events[i],
+ cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
--
2.23.0.187.g17f5b7556c-goog
From: Andre Przywara <andre.przywara(a)arm.com>
In our VGIC implementation we limit the number of SPIs to a number
that the userland application told us. Accordingly we limit the
allocation of memory for virtual IRQs to that number.
However in our MMIO dispatcher we didn't check if we ever access an
IRQ beyond that limit, leading to out-of-bound accesses.
Add a test against the number of allocated SPIs in check_region().
Adjust the VGIC_ADDR_TO_INT macro to avoid an actual division, which
is not implemented on ARM(32).
[maz: cleaned-up original patch]
Cc: stable(a)vger.kernel.org
Reviewed-by: Christoffer Dall <christoffer.dall(a)linaro.org>
Signed-off-by: Andre Przywara <andre.przywara(a)arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier(a)arm.com>
---
virt/kvm/arm/vgic/vgic-mmio.c | 41 +++++++++++++++++++++++------------
virt/kvm/arm/vgic/vgic-mmio.h | 14 ++++++------
2 files changed, 34 insertions(+), 21 deletions(-)
diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c
index 3bad3c5ed..d1b080ca8 100644
--- a/virt/kvm/arm/vgic/vgic-mmio.c
+++ b/virt/kvm/arm/vgic/vgic-mmio.c
@@ -453,17 +453,33 @@ struct vgic_io_device *kvm_to_vgic_iodev(const struct kvm_io_device *dev)
return container_of(dev, struct vgic_io_device, dev);
}
-static bool check_region(const struct vgic_register_region *region,
+static bool check_region(const struct kvm *kvm,
+ const struct vgic_register_region *region,
gpa_t addr, int len)
{
- if ((region->access_flags & VGIC_ACCESS_8bit) && len == 1)
- return true;
- if ((region->access_flags & VGIC_ACCESS_32bit) &&
- len == sizeof(u32) && !(addr & 3))
- return true;
- if ((region->access_flags & VGIC_ACCESS_64bit) &&
- len == sizeof(u64) && !(addr & 7))
- return true;
+ int flags, nr_irqs = kvm->arch.vgic.nr_spis + VGIC_NR_PRIVATE_IRQS;
+
+ switch (len) {
+ case sizeof(u8):
+ flags = VGIC_ACCESS_8bit;
+ break;
+ case sizeof(u32):
+ flags = VGIC_ACCESS_32bit;
+ break;
+ case sizeof(u64):
+ flags = VGIC_ACCESS_64bit;
+ break;
+ default:
+ return false;
+ }
+
+ if ((region->access_flags & flags) && IS_ALIGNED(addr, len)) {
+ if (!region->bits_per_irq)
+ return true;
+
+ /* Do we access a non-allocated IRQ? */
+ return VGIC_ADDR_TO_INTID(addr, region->bits_per_irq) < nr_irqs;
+ }
return false;
}
@@ -477,7 +493,7 @@ static int dispatch_mmio_read(struct kvm_vcpu *vcpu, struct kvm_io_device *dev,
region = vgic_find_mmio_region(iodev->regions, iodev->nr_regions,
addr - iodev->base_addr);
- if (!region || !check_region(region, addr, len)) {
+ if (!region || !check_region(vcpu->kvm, region, addr, len)) {
memset(val, 0, len);
return 0;
}
@@ -510,10 +526,7 @@ static int dispatch_mmio_write(struct kvm_vcpu *vcpu, struct kvm_io_device *dev,
region = vgic_find_mmio_region(iodev->regions, iodev->nr_regions,
addr - iodev->base_addr);
- if (!region)
- return 0;
-
- if (!check_region(region, addr, len))
+ if (!region || !check_region(vcpu->kvm, region, addr, len))
return 0;
switch (iodev->iodev_type) {
diff --git a/virt/kvm/arm/vgic/vgic-mmio.h b/virt/kvm/arm/vgic/vgic-mmio.h
index 0b3ecf9d1..ba63d91d2 100644
--- a/virt/kvm/arm/vgic/vgic-mmio.h
+++ b/virt/kvm/arm/vgic/vgic-mmio.h
@@ -50,15 +50,15 @@ extern struct kvm_io_device_ops kvm_io_gic_ops;
#define VGIC_ADDR_IRQ_MASK(bits) (((bits) * 1024 / 8) - 1)
/*
- * (addr & mask) gives us the byte offset for the INT ID, so we want to
- * divide this with 'bytes per irq' to get the INT ID, which is given
- * by '(bits) / 8'. But we do this with fixed-point-arithmetic and
- * take advantage of the fact that division by a fraction equals
- * multiplication with the inverted fraction, and scale up both the
- * numerator and denominator with 8 to support at most 64 bits per IRQ:
+ * (addr & mask) gives us the _byte_ offset for the INT ID.
+ * We multiply this by 8 the get the _bit_ offset, then divide this by
+ * the number of bits to learn the actual INT ID.
+ * But instead of a division (which requires a "long long div" implementation),
+ * we shift by the binary logarithm of <bits>.
+ * This assumes that <bits> is a power of two.
*/
#define VGIC_ADDR_TO_INTID(addr, bits) (((addr) & VGIC_ADDR_IRQ_MASK(bits)) * \
- 64 / (bits) / 8)
+ 8 >> ilog2(bits))
/*
* Some VGIC registers store per-IRQ information, with a different number
--
2.17.1
The patch titled
Subject: mm: memcontrol: fix percpu vmstats and vmevents flush
has been added to the -mm tree. Its filename is
mm-memcontrol-fix-percpu-vmstats-and-vmevents-flush.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-memcontrol-fix-percpu-vmstats-a…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-memcontrol-fix-percpu-vmstats-a…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Shakeel Butt <shakeelb(a)google.com>
Subject: mm: memcontrol: fix percpu vmstats and vmevents flush
Instead of using raw_cpu_read() use per_cpu() to read the actual data of
the corresponding cpu otherwise we will be reading the data of the current
cpu for the number of online CPUs.
Link: http://lkml.kernel.org/r/20190829203110.129263-1-shakeelb@google.com
Fixes: bb65f89b7d3d ("mm: memcontrol: flush percpu vmevents before releasing memcg")
Fixes: c350a99ea2b1 ("mm: memcontrol: flush percpu vmstats before releasing memcg")
Signed-off-by: Shakeel Butt <shakeelb(a)google.com>
Acked-by: Roman Gushchin <guro(a)fb.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/mm/memcontrol.c~mm-memcontrol-fix-percpu-vmstats-and-vmevents-flush
+++ a/mm/memcontrol.c
@@ -3278,7 +3278,7 @@ static void memcg_flush_percpu_vmstats(s
for_each_online_cpu(cpu)
for (i = min_idx; i < max_idx; i++)
- stat[i] += raw_cpu_read(memcg->vmstats_percpu->stat[i]);
+ stat[i] += per_cpu(memcg->vmstats_percpu->stat[i], cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = min_idx; i < max_idx; i++)
@@ -3296,8 +3296,8 @@ static void memcg_flush_percpu_vmstats(s
for_each_online_cpu(cpu)
for (i = min_idx; i < max_idx; i++)
- stat[i] += raw_cpu_read(
- pn->lruvec_stat_cpu->count[i]);
+ stat[i] += per_cpu(
+ pn->lruvec_stat_cpu->count[i], cpu);
for (pi = pn; pi; pi = parent_nodeinfo(pi, node))
for (i = min_idx; i < max_idx; i++)
@@ -3316,8 +3316,8 @@ static void memcg_flush_percpu_vmevents(
for_each_online_cpu(cpu)
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
- events[i] += raw_cpu_read(
- memcg->vmstats_percpu->events[i]);
+ events[i] += per_cpu(memcg->vmstats_percpu->events[i],
+ cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
_
Patches currently in -mm which might be from shakeelb(a)google.com are
mm-memcontrol-fix-percpu-vmstats-and-vmevents-flush.patch
commit 215e06f0d18d5d653d6ea269e4dfc684854d48bf upstream.
The commit 5e6acc3e678e ("bcm2835-pm: Move bcm2835-watchdog's DT probe
to an MFD.") broke module autoloading on Raspberry Pi. So add a
module alias this fix this.
Fixes: 5e6acc3e678e ("bcm2835-pm: Move bcm2835-watchdog's DT probe to an MFD.")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Stefan Wahren <wahrenst(a)gmx.net>
Reviewed-by: Guenter Roeck <linux(a)roeck-us.net>
Signed-off-by: Guenter Roeck <linux(a)roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim(a)linux-watchdog.org>
---
drivers/watchdog/bcm2835_wdt.c | 1 +
1 file changed, 1 insertion(+)
Hi Greg,
please apply to the Linux 5.2 stable branch, because without this patch
the Raspberry Pi might not be able to reboot.
Regards
Stefan
diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
index 560c1c5..f4937a9 100644
--- a/drivers/watchdog/bcm2835_wdt.c
+++ b/drivers/watchdog/bcm2835_wdt.c
@@ -240,6 +240,7 @@ module_param(nowayout, bool, 0);
MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
__MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
+MODULE_ALIAS("platform:bcm2835-wdt");
MODULE_AUTHOR("Lubomir Rintel <lkundrak(a)v3.sk>");
MODULE_DESCRIPTION("Driver for Broadcom BCM2835 watchdog timer");
MODULE_LICENSE("GPL");
--
2.7.4
From: "Steven Rostedt (VMware)" <rostedt(a)goodmis.org>
If the re-allocation of tep->cmdlines succeeds, then the previous allocation
of tep->cmdlines will be freed. If we later fail in add_new_comm(), we must
not free cmdlines, and also should assign tep->cmdlines to the new
allocation. Otherwise when freeing tep, the tep->cmdlines will be pointing
to garbage.
Cc: stable(a)vger.kernel.org
Fixes: a6d2a61ac653a ("tools lib traceevent: Remove some die() calls")
Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
---
tools/lib/traceevent/event-parse.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
index b36b536a9fcb..13fd9fdf91e0 100644
--- a/tools/lib/traceevent/event-parse.c
+++ b/tools/lib/traceevent/event-parse.c
@@ -269,10 +269,10 @@ static int add_new_comm(struct tep_handle *tep,
errno = ENOMEM;
return -1;
}
+ tep->cmdlines = cmdlines;
cmdlines[tep->cmdline_count].comm = strdup(comm);
if (!cmdlines[tep->cmdline_count].comm) {
- free(cmdlines);
errno = ENOMEM;
return -1;
}
@@ -283,7 +283,6 @@ static int add_new_comm(struct tep_handle *tep,
tep->cmdline_count++;
qsort(cmdlines, tep->cmdline_count, sizeof(*cmdlines), cmdline_cmp);
- tep->cmdlines = cmdlines;
return 0;
}
--
2.20.1
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: 7af0145067bc429a09ac4047b167c0971c9f0dc7
Gitweb: https://git.kernel.org/tip/7af0145067bc429a09ac4047b167c0971c9f0dc7
Author: Thomas Gleixner <tglx(a)linutronix.de>
AuthorDate: Thu, 29 Aug 2019 00:31:34 +02:00
Committer: Thomas Gleixner <tglx(a)linutronix.de>
CommitterDate: Thu, 29 Aug 2019 20:48:44 +02:00
x86/mm/cpa: Prevent large page split when ftrace flips RW on kernel text
ftrace does not use text_poke() for enabling trace functionality. It uses
its own mechanism and flips the whole kernel text to RW and back to RO.
The CPA rework removed a loop based check of 4k pages which tried to
preserve a large page by checking each 4k page whether the change would
actually cover all pages in the large page.
This resulted in endless loops for nothing as in testing it turned out that
it actually never preserved anything. Of course testing missed to include
ftrace, which is the one and only case which benefitted from the 4k loop.
As a consequence enabling function tracing or ftrace based kprobes results
in a full 4k split of the kernel text, which affects iTLB performance.
The kernel RO protection is the only valid case where this can actually
preserve large pages.
All other static protections (RO data, data NX, PCI, BIOS) are truly
static. So a conflict with those protections which results in a split
should only ever happen when a change of memory next to a protected region
is attempted. But these conflicts are rightfully splitting the large page
to preserve the protected regions. In fact a change to the protected
regions itself is a bug and is warned about.
Add an exception for the static protection check for kernel text RO when
the to be changed region spawns a full large page which allows to preserve
the large mappings. This also prevents the syslog to be spammed about CPA
violations when ftrace is used.
The exception needs to be removed once ftrace switched over to text_poke()
which avoids the whole issue.
Fixes: 585948f4f695 ("x86/mm/cpa: Avoid the 4k pages check completely")
Reported-by: Song Liu <songliubraving(a)fb.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Tested-by: Song Liu <songliubraving(a)fb.com>
Reviewed-by: Song Liu <songliubraving(a)fb.com>
Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1908282355340.1938@nanos.tec.linu…
---
arch/x86/mm/pageattr.c | 26 ++++++++++++++++++--------
1 file changed, 18 insertions(+), 8 deletions(-)
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 6a9a77a..e14e95e 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -516,7 +516,7 @@ static inline void check_conflict(int warnlvl, pgprot_t prot, pgprotval_t val,
*/
static inline pgprot_t static_protections(pgprot_t prot, unsigned long start,
unsigned long pfn, unsigned long npg,
- int warnlvl)
+ unsigned long lpsize, int warnlvl)
{
pgprotval_t forbidden, res;
unsigned long end;
@@ -535,9 +535,17 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long start,
check_conflict(warnlvl, prot, res, start, end, pfn, "Text NX");
forbidden = res;
- res = protect_kernel_text_ro(start, end);
- check_conflict(warnlvl, prot, res, start, end, pfn, "Text RO");
- forbidden |= res;
+ /*
+ * Special case to preserve a large page. If the change spawns the
+ * full large page mapping then there is no point to split it
+ * up. Happens with ftrace and is going to be removed once ftrace
+ * switched to text_poke().
+ */
+ if (lpsize != (npg * PAGE_SIZE) || (start & (lpsize - 1))) {
+ res = protect_kernel_text_ro(start, end);
+ check_conflict(warnlvl, prot, res, start, end, pfn, "Text RO");
+ forbidden |= res;
+ }
/* Check the PFN directly */
res = protect_pci_bios(pfn, pfn + npg - 1);
@@ -819,7 +827,7 @@ static int __should_split_large_page(pte_t *kpte, unsigned long address,
* extra conditional required here.
*/
chk_prot = static_protections(old_prot, lpaddr, old_pfn, numpages,
- CPA_CONFLICT);
+ psize, CPA_CONFLICT);
if (WARN_ON_ONCE(pgprot_val(chk_prot) != pgprot_val(old_prot))) {
/*
@@ -855,7 +863,7 @@ static int __should_split_large_page(pte_t *kpte, unsigned long address,
* protection requirement in the large page.
*/
new_prot = static_protections(req_prot, lpaddr, old_pfn, numpages,
- CPA_DETECT);
+ psize, CPA_DETECT);
/*
* If there is a conflict, split the large page.
@@ -906,7 +914,8 @@ static void split_set_pte(struct cpa_data *cpa, pte_t *pte, unsigned long pfn,
if (!cpa->force_static_prot)
goto set;
- prot = static_protections(ref_prot, address, pfn, npg, CPA_PROTECT);
+ /* Hand in lpsize = 0 to enforce the protection mechanism */
+ prot = static_protections(ref_prot, address, pfn, npg, 0, CPA_PROTECT);
if (pgprot_val(prot) == pgprot_val(ref_prot))
goto set;
@@ -1503,7 +1512,8 @@ static int __change_page_attr(struct cpa_data *cpa, int primary)
pgprot_val(new_prot) |= pgprot_val(cpa->mask_set);
cpa_inc_4k_install();
- new_prot = static_protections(new_prot, address, pfn, 1,
+ /* Hand in lpsize = 0 to enforce the protection mechanism */
+ new_prot = static_protections(new_prot, address, pfn, 1, 0,
CPA_PROTECT);
new_prot = pgprot_clear_protnone_bits(new_prot);
From: Jan Stancek <jstancek(a)redhat.com>
[ Upstream commit e1b98fa316648420d0434d9ff5b92ad6609ba6c3 ]
LTP mtest06 has been observed to occasionally hit "still mapped when
deleted" and following BUG_ON on arm64.
The extra mapcount originated from pagefault handler, which handled
pagefault for vma that has already been detached. vma is detached
under mmap_sem write lock by detach_vmas_to_be_unmapped(), which
also invalidates vmacache.
When the pagefault handler (under mmap_sem read lock) calls
find_vma(), vmacache_valid() wrongly reports vmacache as valid.
After rwsem down_read() returns via 'queue empty' path (as of v5.2),
it does so without an ACQUIRE on sem->count:
down_read()
__down_read()
rwsem_down_read_failed()
__rwsem_down_read_failed_common()
raw_spin_lock_irq(&sem->wait_lock);
if (list_empty(&sem->wait_list)) {
if (atomic_long_read(&sem->count) >= 0) {
raw_spin_unlock_irq(&sem->wait_lock);
return sem;
The problem can be reproduced by running LTP mtest06 in a loop and
building the kernel (-j $NCPUS) in parallel. It does reproduces since
v4.20 on arm64 HPE Apollo 70 (224 CPUs, 256GB RAM, 2 nodes). It
triggers reliably in about an hour.
The patched kernel ran fine for 10+ hours.
Signed-off-by: Jan Stancek <jstancek(a)redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Reviewed-by: Will Deacon <will(a)kernel.org>
Acked-by: Waiman Long <longman(a)redhat.com>
Cc: Linus Torvalds <torvalds(a)linux-foundation.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: dbueso(a)suse.de
Fixes: 4b486b535c33 ("locking/rwsem: Exit read lock slowpath if queue empty & no writer")
Link: https://lkml.kernel.org/r/50b8914e20d1d62bb2dee42d342836c2c16ebee7.15634380…
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
This is a backport for the v5.2 stable tree. There were multiple reports
of this issue being hit.
Given that there were a few changes to the code around this, I'd
appreciate an ack before pulling it in.
kernel/locking/rwsem-xadd.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c
index 0b1f779572402..397dedc58432d 100644
--- a/kernel/locking/rwsem-xadd.c
+++ b/kernel/locking/rwsem-xadd.c
@@ -454,6 +454,8 @@ __rwsem_down_read_failed_common(struct rw_semaphore *sem, int state)
* been set in the count.
*/
if (atomic_long_read(&sem->count) >= 0) {
+ /* Provide lock ACQUIRE */
+ smp_acquire__after_ctrl_dep();
raw_spin_unlock_irq(&sem->wait_lock);
rwsem_set_reader_owned(sem);
lockevent_inc(rwsem_rlock_fast);
--
2.20.1
When filtering xattr list for reading, presence of trusted xattr
results in a security audit log. However, if there is other content
no errno will be set, and if there isn't, the errno will be -ENODATA
and not -EPERM as is usually associated with a lack of capability.
The check does not block the request to list the xattrs present.
Switch to ns_capable_noaudit to reflect a more appropriate check.
Signed-off-by: Mark Salyzyn <salyzyn(a)android.com>
Cc: linux-kernel(a)vger.kernel.orga
Cc: linux-security-module(a)vger.kernel.org
Cc: kernel-team(a)android.com
Cc: stable(a)vger.kernel.org # 4.4, 4.9, 4.14 & 4.19
---
fs/overlayfs/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index 7663aeb85fa3..bc14781886bf 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -383,7 +383,8 @@ static bool ovl_can_list(const char *s)
return true;
/* Never list trusted.overlay, list other trusted for superuser only */
- return !ovl_is_private_xattr(s) && capable(CAP_SYS_ADMIN);
+ return !ovl_is_private_xattr(s) &&
+ ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN);
}
ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
--
2.23.0.187.g17f5b7556c-goog
Hi ARM-SoC team,
Please consider to pull the following fixes.
Thanks!
Best Regards,
Wei
---
The following changes since commit 5f9e832c137075045d15cd6899ab0505cfb2ca4b:
Linus 5.3-rc1 (2019-07-21 14:05:38 -0700)
are available in the Git repository at:
git://github.com/hisilicon/linux-hisi.git tags/hisi-fixes-for-5.3
for you to fetch changes up to 10e62b47973b0b0ceda076255bcb147b83e20517:
bus: hisi_lpc: Add .remove method to avoid driver unbind crash
(2019-08-13 14:54:34 +0800)
----------------------------------------------------------------
Hisilicon fixes for v5.3-rc
- Fixed RCU usage in logical PIO
- Added a function to unregister a logical PIO range in logical PIO
to support the fixes in the hisi-lpc driver
- Fixed and optimized hisi-lpc driver to avoid potential use-after-free
and driver unbind crash
----------------------------------------------------------------
John Garry (5):
lib: logic_pio: Fix RCU usage
lib: logic_pio: Avoid possible overlap for unregistering regions
lib: logic_pio: Add logic_pio_unregister_range()
bus: hisi_lpc: Unregister logical PIO range to avoid potential
use-after-free
bus: hisi_lpc: Add .remove method to avoid driver unbind crash
drivers/bus/hisi_lpc.c | 47 ++++++++++++++++++++++++++----
include/linux/logic_pio.h | 1 +
lib/logic_pio.c | 73
+++++++++++++++++++++++++++++++++++------------
3 files changed, 96 insertions(+), 25 deletions(-)
From: "Steven Rostedt (VMware)" <rostedt(a)goodmis.org>
If the re-allocation of tep->cmdlines succeeds, then the previous
allocation of tep->cmdlines will be freed. If we later fail in
add_new_comm(), we must not free cmdlines, and also should assign
tep->cmdlines to the new allocation. Otherwise when freeing tep, the
tep->cmdlines will be pointing to garbage.
Fixes: a6d2a61ac653a ("tools lib traceevent: Remove some die() calls")
Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Jiri Olsa <jolsa(a)redhat.com>
Cc: Namhyung Kim <namhyung(a)kernel.org>
Cc: linux-trace-devel(a)vger.kernel.org
Cc: stable(a)vger.kernel.org
Link: http://lkml.kernel.org/r/20190828191819.970121417@goodmis.org
Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com>
---
tools/lib/traceevent/event-parse.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
index b36b536a9fcb..13fd9fdf91e0 100644
--- a/tools/lib/traceevent/event-parse.c
+++ b/tools/lib/traceevent/event-parse.c
@@ -269,10 +269,10 @@ static int add_new_comm(struct tep_handle *tep,
errno = ENOMEM;
return -1;
}
+ tep->cmdlines = cmdlines;
cmdlines[tep->cmdline_count].comm = strdup(comm);
if (!cmdlines[tep->cmdline_count].comm) {
- free(cmdlines);
errno = ENOMEM;
return -1;
}
@@ -283,7 +283,6 @@ static int add_new_comm(struct tep_handle *tep,
tep->cmdline_count++;
qsort(cmdlines, tep->cmdline_count, sizeof(*cmdlines), cmdline_cmp);
- tep->cmdlines = cmdlines;
return 0;
}
--
2.21.0
The IP datasheet says this controller is compatible with SD Host
Specification Version v4.00.
As it turned out, the ADMA of this IP does not work with 64-bit mode
when it is in the Version 3.00 compatible mode; it understands the
old 64-bit descriptor table (as defined in SDHCI v2), but the ADMA
System Address Register (SDHCI_ADMA_ADDRESS) cannot point to the
64-bit address.
I noticed this issue only after commit bd2e75633c80 ("dma-contiguous:
use fallback alloc_pages for single pages"). Prior to that commit,
dma_set_mask_and_coherent() returned the dma address that fits in
32-bit range, at least for the default arm64 configuration
(arch/arm64/configs/defconfig). Now the host->adma_addr exceeds the
32-bit limit, causing the real problem for the Socionext SoCs.
(As a side-note, I was also able to reproduce the issue for older
kernels by turning off CONFIG_DMA_CMA.)
Call sdhci_enable_v4_mode() to fix this.
I think it is better to back-port this, but only possible for v4.20+.
When this driver was merged (v4.10), the v4 mode support did not exist.
It was added by commit b3f80b434f72 ("mmc: sdhci: Add sd host v4 mode")
i.e. v4.20.
Cc: <stable(a)vger.kernel.org> # v4.20+
Signed-off-by: Masahiro Yamada <yamada.masahiro(a)socionext.com>
---
drivers/mmc/host/sdhci-cadence.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mmc/host/sdhci-cadence.c b/drivers/mmc/host/sdhci-cadence.c
index 163d1cf4367e..44139fceac24 100644
--- a/drivers/mmc/host/sdhci-cadence.c
+++ b/drivers/mmc/host/sdhci-cadence.c
@@ -369,6 +369,7 @@ static int sdhci_cdns_probe(struct platform_device *pdev)
host->mmc_host_ops.execute_tuning = sdhci_cdns_execute_tuning;
host->mmc_host_ops.hs400_enhanced_strobe =
sdhci_cdns_hs400_enhanced_strobe;
+ sdhci_enable_v4_mode(host);
sdhci_get_of_property(pdev);
--
2.17.1
Hi,
I recently wrote a script which identifies patches potentially missing
in downstream kernel branches. The idea is to identify patches backported/
applied to a downstream branch for which patches tagged with Fixes: are
available in the upstream kernel, but those fixes are missing from the
downstream branch. The script workflow is something like:
- Identify locally applied patches in downstream branch
- For each patch, identify the matching upstream SHA
- Search the upstream kernel for Fixes: tags with this SHA
- If one or more patches with matching Fixes: tags are found, check
if the patch was applied to the downstream branch.
- If the patch was not applied to the downstream branch, report
Running this script on chromeos-4.19 identified, not surprisingly, a number
of such patches. However, and more surprisingly, it also identified several
patches applied to v4.19.y for which fixes are available in the upstream
kernel, but those fixes have not been applied to v4.19.y. Some of those
are on the cosmetic side, but several seem to be relevant. I didn't
cross-check all of them, but the ones I tried did apply to linux-4.19.y.
The complete list is attached below.
Question: Do Sasha's automated scripts identify such patches ? If not,
would it make sense to do it ? Or is there some reason why the patches
have not been applied to v4.19.y ?
Thanks,
Guenter
---
SHA ce081fc137c8 [ce49d8436cff] ('perf strbuf: Match va_{add,copy} with va_end')
fixed by upstream commit 099be748865e
Fix is missing from chromeos-4.19 and applies cleanly
SHA c21099be0233 [ae61cf5b9913] ('uio: ensure class is registered before devices')
fixed by upstream commit 6011002c1584
Fix is missing from chromeos-4.19 and applies cleanly
SHA 3252b60cf810 [578bdaabd015] ('crypto: speck - remove Speck')
fixed by upstream commit 733ac4f9935c
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA 0858d74e8845 [bcc71cc3cde1] ('scsi: qla2xxx: Fix for double free of SRB structure')
fixed by upstream commit ef801f07e7b3
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA 3d8c2945fcbf [8985167ecf57] ('clk: s2mps11: Fix matching when built as module and DT node contains compatible')
fixed by upstream commit 9c940bbe2bb4
Fix is missing from chromeos-4.19 and applies cleanly
SHA 67a19f87a02b [ac5b2c18911f] ('mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings')
fixed by upstream commit 2f0799a0ffc0
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA f55e301ec4d5 [a74cfffb03b7] ('x86/speculation: Rework SMT state change')
fixed by upstream commit 34d66caf251d
Fix is missing from chromeos-4.19 and applies cleanly
SHA 84d2023c14ea [e949b6db51dc] ('riscv/function_graph: Simplify with function_graph_enter()')
fixed by upstream commit 397182e0db56
Fix is missing from chromeos-4.19 and applies cleanly
SHA 0e79e30e6121 [4cff280a5fcc] ('nvme-fc: resolve io failures during connect')
fixed by upstream commit 8730c1ddb69b
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA 52da87f0e2e8 [ae3b7361dc0e] ('afs: Fix validation/callback interaction')
fixed by upstream commit 61c347ba5511
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA cd50eeeb6646 [3e9efc3299dd] ('i2c: aspeed: fix build warning')
fixed by upstream commit 2be6b47211e1
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA 2658687568cd [7aa54be29765] ('locking/qspinlock, x86: Provide liveness guarantee')
fixed by upstream commit b987ffc18fb3
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA 6ffd9f25c0e9 [c3494801cd17] ('bpf: check pending signals while verifying programs')
fixed by upstream commit 86edaed37963
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA 53471f0d893d [04f05230c5c1] ('bnx2x: Remove configured vlans as part of unload sequence.')
fixed by upstream commit 4a4d2d372fb9
Fix is missing from chromeos-4.19 and applies cleanly
SHA 341b8840435a [308c6cafde01] ('net: hns: All ports can not work when insmod hns ko after rmmod.')
fixed by upstream commit c77804be5336
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA ba1fe90be68f [6977f95e63b9] ('powerpc: avoid -mno-sched-epilog on GCC 4.9 and newer')
fixed by upstream commit 1a49b2fd8f58
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA 7398668b3110 [4be9bd10e22d] ('drm/fb_helper: Allow leaking fbdev smem_start')
fixed by upstream commit b31a3ca745a4
Fix is missing from chromeos-4.19 and applies cleanly
SHA ad7013cd6d6a [8cc4ccf58379] ('netfilter: ipset: Allow matching on destination MAC address for mac and ipmac sets')
fixed by upstream commit b89d15480d0c
Fix is missing from chromeos-4.19 and applies cleanly
SHA ad7013cd6d6a [8cc4ccf58379] ('netfilter: ipset: Allow matching on destination MAC address for mac and ipmac sets')
fixed by upstream commit 1b4a75108d5b
Fix is missing from chromeos-4.19 and applies cleanly
SHA 38b17eee7074 [d189dd70e255] ('btrfs: fix use-after-free due to race between replace start and cancel')
fixed by upstream commit 669e859b5ea7
Fix is missing from chromeos-4.19 and applies cleanly
SHA 9d51378a6893 [5a86d68bcf02] ('netfilter: ipt_CLUSTERIP: fix deadlock in netns exit routine')
fixed by upstream commit dddaf89e2fbc
Fix is missing from chromeos-4.19 and applies cleanly
SHA b18931c5fe0d [11189c1089da] ('acpi/nfit: Fix command-supported detection')
fixed by upstream commit 0171b6b78131
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA 91e46947d02f [ca95f802ef51] ('IB/hfi1: Unreserve a reserved request when it is completed')
fixed by upstream commit 2b74c878b0ea
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA 4cd197bfa6e1 [36d65be9a880] ('bnxt_en: Disable MSIX before re-reserving NQs/CMPL rings.')
fixed by upstream commit 0b815023a1d4
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA c709eeb02c04 [0d640732dbeb] ('arm64: KVM: Skip MMIO insn after emulation')
fixed by upstream commit 2113c5f62b74
Fix is missing from chromeos-4.19 and applies cleanly
SHA 7371994d6cfa [2a418cf3f5f1] ('x86/uaccess: Don't leak the AC flag into __put_user() value evaluation')
fixed by upstream commit 6ae865615fc4
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA 8ce41db0dcfc [dd9ee3444014] ('vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel')
fixed by upstream commit 01ce31c57b3f
Fix is missing from chromeos-4.19 and applies cleanly
SHA 3355d641269f [2035f3ff8eaa] ('netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present')
fixed by upstream commit 3b48300d5cc7
Fix is missing from chromeos-4.19 and applies cleanly
SHA 33e83ea302c0 [2c2ade81741c] ('mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs')
fixed by upstream commit 8644772637de
Fix is missing from chromeos-4.19 and applies cleanly
SHA 4ab78f4d75c6 [500e0b28ecd3] ('f2fs: fix to check inline_xattr_size boundary correctly')
fixed by upstream commit 70db5b04cbe1
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA 54fb5c9da6cd [272e5326c783] ('btrfs: prop: fix vanished compression property after failed set')
fixed by upstream commit aa53e3bfac72
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA c963475972f6 [ef05bcb60c1a] ('arm64: dts: rockchip: fix vcc_host1_5v pin assign on rk3328-rock64')
fixed by upstream commit 26e2d7b03ea7
Fix is missing from chromeos-4.19 and applies cleanly
SHA e434fbf4f049 [8ac51bbc4cfe] ('ALSA: hda: fix front speakers on Huawei MBXP')
fixed by upstream commit 0fbf21c3b36a
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA a1da981f6643 [131ac62253db] ('staging: most: core: use device description as name')
fixed by upstream commit 3970d0d81816
Fix is missing from chromeos-4.19 and applies cleanly
SHA 6ff17bc5936e [04f5866e41fb] ('coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping')
fixed by upstream commit 46d0b24c5ee1
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA f7ab4818f74e [c01908a14bf7] ('HID: input: add mapping for "Toggle Display" key')
fixed by upstream commit 1c703b53e5bf
Fix is missing from chromeos-4.19 and applies cleanly
SHA 7b115755fb9d [3c79107631db] ('netfilter: ctnetlink: don't use conntrack/expect object addresses as id')
fixed by upstream commit 656c8e9cc1ba
Fix is missing from chromeos-4.19 and applies cleanly
SHA 8b13bb911f0c [c2d1b3aae336] ('btrfs: Honour FITRIM range constraints during free space trim')
fixed by upstream commit 8103d10b7161
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA 0388d45afc50 [03628cdbc64d] ('Btrfs: do not start a transaction during fiemap')
fixed by upstream commit a6d155d2e363
Fix is missing from chromeos-4.19 and applies cleanly
SHA 2d2017675b1a [b5b5a27bee58] ('media: stm32-dcmi: return appropriate error codes during probe')
fixed by upstream commit dbb9fcc8c2d8
Fix is missing from chromeos-4.19 and applies cleanly
SHA 8715ce033eb3 [f2c65fb3221a] ('x86/modules: Avoid breaking W^X while loading modules')
fixed by upstream commit 2eef1399a866
Fix is missing from chromeos-4.19 and applies cleanly
SHA 8034a6b89990 [95f18c9d1310] ('bcache: avoid potential memleak of list of journal_replay(s) in the CACHE_SYNC branch of run_cache_set')
fixed by upstream commit cdca22bcbc64
Fix is missing from chromeos-4.19 and applies cleanly
SHA cd83c78897d5 [631207314d88] ('bcache: fix failure in journal relplay')
fixed by upstream commit 2d5abb9a1e8e
Fix is missing from chromeos-4.19 and applies cleanly
SHA fec8a09f79ec [56c46bba9bbf] ('powerpc/64: Fix booting large kernels with STRICT_KERNEL_RWX')
fixed by upstream commit 9c4e4c90ec24
Fix is missing from chromeos-4.19 and applies cleanly
SHA 5d5652b51c87 [09f11b6c99fe] ('thunderbolt: Take domain lock in switch sysfs attribute callbacks')
fixed by upstream commit 4f7c2e0d8765
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA 9d57cfd4e9d8 [5cec2d2e5839] ('binder: fix race between munmap() and direct reclaim')
fixed by upstream commit 60d488571083
Fix is missing from chromeos-4.19 and applies cleanly
SHA 6fa953c94882 [d2a68c4effd8] ('x86/ftrace: Do not call function graph from dynamic trampolines')
fixed by upstream commit 745cfeaac09c
Fix is missing from chromeos-4.19 and applies cleanly
SHA 25511676362d [54c7a8916a88] ('initramfs: free initrd memory if opening /initrd.image fails')
fixed by upstream commit 5d59aa8f9ce9
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA 525b5265fd75 [fbc2a15e3433] ('blk-mq: move cancel of requeue_work into blk_mq_release')
fixed by upstream commit e26cc08265dd
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA 3e1d7417b4d6 [fc82d93e57e3] ('selftests: fib_rule_tests: fix local IPv4 address typo')
fixed by upstream commit 34632975cafd
Fix is missing from chromeos-4.19 and applies cleanly
SHA ca4c34037bb9 [e3ff9c3678b4] ('timekeeping: Repair ktime_get_coarse*() granularity')
fixed by upstream commit 0354c1a3cdf3
Fix is missing from chromeos-4.19 and applies cleanly
SHA ccf6a155844b [33d915d9e8ce] ('{nl,mac}80211: allow 4addr AP operation on crypto controlled devices')
fixed by upstream commit e6f4051123fd
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA 027e043f9c78 [652b8b086538] ('drm: panel-orientation-quirks: Add quirk for GPD MicroPC')
fixed by upstream commit dae1ccee012e
Fix is missing from chromeos-4.19 and applies cleanly
SHA c854d9b6ef8d [d5b844a2cf50] ('ftrace/x86: Remove possible deadlock between register_kprobe() and ftrace_run_update_code()')
fixed by upstream commit 074376ac0e1d
Fix is missing from chromeos-4.19 and applies cleanly
SHA c854d9b6ef8d [d5b844a2cf50] ('ftrace/x86: Remove possible deadlock between register_kprobe() and ftrace_run_update_code()')
fixed by upstream commit f1c6ece23729
Fix is missing from chromeos-4.19 and applies cleanly
SHA 3ae98dc2db1e [a3fb01ba5af0] ('blk-iolatency: only account submitted bios')
fixed by upstream commit c9b3007feca0
Fix may be missing from chromeos-4.19; trying to apply it results in conflicts/errors
SHA 025eb12bb4b0 [bd293d071ffe] ('dm bufio: fix deadlock with loop device')
fixed by upstream commit cf3591ef8329
Fix is missing from chromeos-4.19 and applies cleanly
SHA 9d3586bcdae3 [a9eeb998c28d] ('hv_sock: Add support for delayed close')
fixed by upstream commit 685703b497ba
Fix is missing from chromeos-4.19 and applies cleanly
SHA 9e441c7844a6 [c7944ebb9ce9] ('NFSv4: Fix lookup revalidate of regular files')
fixed by upstream commit 42f72cf368c5
Fix is missing from chromeos-4.19 and applies cleanly
SHA 3d180fe5cd76 [883a2a80f79c] ('Input: elantech - enable SMBus on new (2018+) systems')
fixed by upstream commit f3b5720cabaf
Fix is missing from chromeos-4.19 and applies cleanly
From: Mikulas Patocka <mpatocka(a)redhat.com>
[ Upstream commit cf3591ef832915892f2499b7e54b51d4c578b28c ]
Revert the commit bd293d071ffe65e645b4d8104f9d8fe15ea13862. The proper
fix has been made available with commit d0a255e795ab ("loop: set
PF_MEMALLOC_NOIO for the worker thread").
Note that the fix offered by commit bd293d071ffe doesn't really prevent
the deadlock from occuring - if we look at the stacktrace reported by
Junxiao Bi, we see that it hangs in bit_wait_io and not on the mutex -
i.e. it has already successfully taken the mutex. Changing the mutex
from mutex_lock to mutex_trylock won't help with deadlocks that happen
afterwards.
PID: 474 TASK: ffff8813e11f4600 CPU: 10 COMMAND: "kswapd0"
#0 [ffff8813dedfb938] __schedule at ffffffff8173f405
#1 [ffff8813dedfb990] schedule at ffffffff8173fa27
#2 [ffff8813dedfb9b0] schedule_timeout at ffffffff81742fec
#3 [ffff8813dedfba60] io_schedule_timeout at ffffffff8173f186
#4 [ffff8813dedfbaa0] bit_wait_io at ffffffff8174034f
#5 [ffff8813dedfbac0] __wait_on_bit at ffffffff8173fec8
#6 [ffff8813dedfbb10] out_of_line_wait_on_bit at ffffffff8173ff81
#7 [ffff8813dedfbb90] __make_buffer_clean at ffffffffa038736f [dm_bufio]
#8 [ffff8813dedfbbb0] __try_evict_buffer at ffffffffa0387bb8 [dm_bufio]
#9 [ffff8813dedfbbd0] dm_bufio_shrink_scan at ffffffffa0387cc3 [dm_bufio]
#10 [ffff8813dedfbc40] shrink_slab at ffffffff811a87ce
#11 [ffff8813dedfbd30] shrink_zone at ffffffff811ad778
#12 [ffff8813dedfbdc0] kswapd at ffffffff811ae92f
#13 [ffff8813dedfbec0] kthread at ffffffff810a8428
#14 [ffff8813dedfbf50] ret_from_fork at ffffffff81745242
Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com>
Cc: stable(a)vger.kernel.org
Fixes: bd293d071ffe ("dm bufio: fix deadlock with loop device")
Depends-on: d0a255e795ab ("loop: set PF_MEMALLOC_NOIO for the worker thread")
Signed-off-by: Mike Snitzer <snitzer(a)redhat.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/md/dm-bufio.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 8a6e7646e1c98..b1d5fa0bc8f7b 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1561,7 +1561,9 @@ dm_bufio_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
unsigned long freed;
c = container_of(shrink, struct dm_bufio_client, shrinker);
- if (!dm_bufio_trylock(c))
+ if (sc->gfp_mask & __GFP_FS)
+ dm_bufio_lock(c);
+ else if (!dm_bufio_trylock(c))
return SHRINK_STOP;
freed = __scan(c, sc->nr_to_scan, sc->gfp_mask);
--
2.20.1
From: Mikulas Patocka <mpatocka(a)redhat.com>
[ Upstream commit cf3591ef832915892f2499b7e54b51d4c578b28c ]
Revert the commit bd293d071ffe65e645b4d8104f9d8fe15ea13862. The proper
fix has been made available with commit d0a255e795ab ("loop: set
PF_MEMALLOC_NOIO for the worker thread").
Note that the fix offered by commit bd293d071ffe doesn't really prevent
the deadlock from occuring - if we look at the stacktrace reported by
Junxiao Bi, we see that it hangs in bit_wait_io and not on the mutex -
i.e. it has already successfully taken the mutex. Changing the mutex
from mutex_lock to mutex_trylock won't help with deadlocks that happen
afterwards.
PID: 474 TASK: ffff8813e11f4600 CPU: 10 COMMAND: "kswapd0"
#0 [ffff8813dedfb938] __schedule at ffffffff8173f405
#1 [ffff8813dedfb990] schedule at ffffffff8173fa27
#2 [ffff8813dedfb9b0] schedule_timeout at ffffffff81742fec
#3 [ffff8813dedfba60] io_schedule_timeout at ffffffff8173f186
#4 [ffff8813dedfbaa0] bit_wait_io at ffffffff8174034f
#5 [ffff8813dedfbac0] __wait_on_bit at ffffffff8173fec8
#6 [ffff8813dedfbb10] out_of_line_wait_on_bit at ffffffff8173ff81
#7 [ffff8813dedfbb90] __make_buffer_clean at ffffffffa038736f [dm_bufio]
#8 [ffff8813dedfbbb0] __try_evict_buffer at ffffffffa0387bb8 [dm_bufio]
#9 [ffff8813dedfbbd0] dm_bufio_shrink_scan at ffffffffa0387cc3 [dm_bufio]
#10 [ffff8813dedfbc40] shrink_slab at ffffffff811a87ce
#11 [ffff8813dedfbd30] shrink_zone at ffffffff811ad778
#12 [ffff8813dedfbdc0] kswapd at ffffffff811ae92f
#13 [ffff8813dedfbec0] kthread at ffffffff810a8428
#14 [ffff8813dedfbf50] ret_from_fork at ffffffff81745242
Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com>
Cc: stable(a)vger.kernel.org
Fixes: bd293d071ffe ("dm bufio: fix deadlock with loop device")
Depends-on: d0a255e795ab ("loop: set PF_MEMALLOC_NOIO for the worker thread")
Signed-off-by: Mike Snitzer <snitzer(a)redhat.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/md/dm-bufio.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 673ce38735ff7..c837defb5e4dd 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1585,7 +1585,9 @@ dm_bufio_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
unsigned long freed;
c = container_of(shrink, struct dm_bufio_client, shrinker);
- if (!dm_bufio_trylock(c))
+ if (sc->gfp_mask & __GFP_FS)
+ dm_bufio_lock(c);
+ else if (!dm_bufio_trylock(c))
return SHRINK_STOP;
freed = __scan(c, sc->nr_to_scan, sc->gfp_mask);
--
2.20.1
Commit aea447141c7e ("powerpc: Disable -Wbuiltin-requires-header when
setjmp is used") disabled -Wbuiltin-requires-header because of a warning
about the setjmp and longjmp declarations.
r367387 in clang added another diagnostic around this, complaining that
there is no jmp_buf declaration.
In file included from ../arch/powerpc/xmon/xmon.c:47:
../arch/powerpc/include/asm/setjmp.h:10:13: error: declaration of
built-in function 'setjmp' requires the declaration of the 'jmp_buf'
type, commonly provided in the header <setjmp.h>.
[-Werror,-Wincomplete-setjmp-declaration]
extern long setjmp(long *);
^
../arch/powerpc/include/asm/setjmp.h:11:13: error: declaration of
built-in function 'longjmp' requires the declaration of the 'jmp_buf'
type, commonly provided in the header <setjmp.h>.
[-Werror,-Wincomplete-setjmp-declaration]
extern void longjmp(long *, long);
^
2 errors generated.
Take the same approach as the above commit by disabling the warning for
the same reason, we provide our own longjmp/setjmp function.
Cc: stable(a)vger.kernel.org # 4.19+
Link: https://github.com/ClangBuiltLinux/linux/issues/625
Link: https://github.com/llvm/llvm-project/commit/3be25e79477db2d31ac46493d97eca8…
Signed-off-by: Nathan Chancellor <natechancellor(a)gmail.com>
---
It may be worth using -fno-builtin-setjmp and -fno-builtin-longjmp
instead as it makes it clear to clang that we are not using the builtin
longjmp and setjmp functions, which I think is why these warnings are
appearing (at least according to the commit that introduced this waring).
Sample patch:
https://github.com/ClangBuiltLinux/linux/issues/625#issuecomment-519251372
However, this is the most conservative approach, as I have already had
someone notice this error when building LLVM with PGO on tip of tree
LLVM.
arch/powerpc/kernel/Makefile | 5 +++--
arch/powerpc/xmon/Makefile | 5 +++--
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index ea0c69236789..44e340ed4722 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -5,8 +5,9 @@
CFLAGS_ptrace.o += -DUTS_MACHINE='"$(UTS_MACHINE)"'
-# Disable clang warning for using setjmp without setjmp.h header
-CFLAGS_crash.o += $(call cc-disable-warning, builtin-requires-header)
+# Avoid clang warnings about longjmp and setjmp built-ins (inclusion of setjmp.h and declaration of jmp_buf type)
+CFLAGS_crash.o += $(call cc-disable-warning, builtin-requires-header) \
+ $(call cc-disable-warning, incomplete-setjmp-declaration)
ifdef CONFIG_PPC64
CFLAGS_prom_init.o += $(NO_MINIMAL_TOC)
diff --git a/arch/powerpc/xmon/Makefile b/arch/powerpc/xmon/Makefile
index f142570ad860..53f341391210 100644
--- a/arch/powerpc/xmon/Makefile
+++ b/arch/powerpc/xmon/Makefile
@@ -1,8 +1,9 @@
# SPDX-License-Identifier: GPL-2.0
# Makefile for xmon
-# Disable clang warning for using setjmp without setjmp.h header
-subdir-ccflags-y := $(call cc-disable-warning, builtin-requires-header)
+# Avoid clang warnings about longjmp and setjmp built-ins (inclusion of setjmp.h and declaration of jmp_buf type)
+subdir-ccflags-y := $(call cc-disable-warning, builtin-requires-header) \
+ $(call cc-disable-warning, incomplete-setjmp-declaration)
GCOV_PROFILE := n
KCOV_INSTRUMENT := n
--
2.23.0.rc2
Am I the only one, who is not seeing it getting reflected on
kernel.org???
Well, I have tried it 2 different browsers.....cleared caches several
times(heck) .....3 different devices .....and importantly 3 different
networks.
Wondering!
Thanks,
Bhaskar
This is a note to let you know that I've just added the patch titled
fsi: scom: Don't abort operations for minor errors
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 8919dfcb31161fae7d607bbef5247e5e82fd6457 Mon Sep 17 00:00:00 2001
From: Eddie James <eajames(a)linux.ibm.com>
Date: Tue, 27 Aug 2019 12:12:49 +0800
Subject: fsi: scom: Don't abort operations for minor errors
The scom driver currently fails out of operations if certain system
errors are flagged in the status register; system checkstop, special
attention, or recoverable error. These errors won't impact the ability
of the scom engine to perform operations, so the driver should continue
under these conditions.
Also, don't do a PIB reset for these conditions, since it won't help.
Fixes: 6b293258cded ("fsi: scom: Major overhaul")
Signed-off-by: Eddie James <eajames(a)linux.ibm.com>
Cc: stable <stable(a)vger.kernel.org>
Acked-by: Jeremy Kerr <jk(a)ozlabs.org>
Acked-by: Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
Signed-off-by: Joel Stanley <joel(a)jms.id.au>
Link: https://lore.kernel.org/r/20190827041249.13381-1-jk@ozlabs.org
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/fsi/fsi-scom.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/drivers/fsi/fsi-scom.c b/drivers/fsi/fsi-scom.c
index 343153d47e5b..004dc03ccf09 100644
--- a/drivers/fsi/fsi-scom.c
+++ b/drivers/fsi/fsi-scom.c
@@ -38,8 +38,7 @@
#define SCOM_STATUS_PIB_RESP_MASK 0x00007000
#define SCOM_STATUS_PIB_RESP_SHIFT 12
-#define SCOM_STATUS_ANY_ERR (SCOM_STATUS_ERR_SUMMARY | \
- SCOM_STATUS_PROTECTION | \
+#define SCOM_STATUS_ANY_ERR (SCOM_STATUS_PROTECTION | \
SCOM_STATUS_PARITY | \
SCOM_STATUS_PIB_ABORT | \
SCOM_STATUS_PIB_RESP_MASK)
@@ -251,11 +250,6 @@ static int handle_fsi2pib_status(struct scom_device *scom, uint32_t status)
/* Return -EBUSY on PIB abort to force a retry */
if (status & SCOM_STATUS_PIB_ABORT)
return -EBUSY;
- if (status & SCOM_STATUS_ERR_SUMMARY) {
- fsi_device_write(scom->fsi_dev, SCOM_FSI2PIB_RESET_REG, &dummy,
- sizeof(uint32_t));
- return -EIO;
- }
return 0;
}
--
2.23.0