Hi Jonathan, Jacopo,
On Mon, Aug 5, 2019 at 7:15 PM Jonathan Cameron <jic23(a)kernel.org> wrote:
> On Mon, 5 Aug 2019 17:55:15 +0200
> Jacopo Mondi <jacopo+renesas(a)jmondi.org> wrote:
>
> > The max9611 driver reads the die temperature at probe time to validate
> > the communication channel. Use the actual read value to perform the test
> > instead of the read function return value, which was mistakenly used so
> > far.
> >
> > The temperature reading test was only successful because the 0 return
> > value is in the range of supported temperatures.
> >
> > Fixes: 69780a3bbc0b ("iio: adc: Add Maxim max9611 ADC driver")
> > Signed-off-by: Jacopo Mondi <jacopo+renesas(a)jmondi.org>
>
> Applied to the fixes-togreg branch of iio.git and marked for
> stable. That'll be a bit fiddly given other changes around this
> so we may need to do backports.
This is now commit b9ddd5091160793e ("iio: adc: max9611: Fix temperature
reading in probe") in v5.3-rc5, and has been backported to 4.14, 4.19,
and 5.2.
> > --- a/drivers/iio/adc/max9611.c
> > +++ b/drivers/iio/adc/max9611.c
> > @@ -480,7 +480,7 @@ static int max9611_init(struct max9611_dev *max9611)
> > if (ret)
> > return ret;
> >
> > - regval = ret & MAX9611_TEMP_MASK;
> > + regval &= MAX9611_TEMP_MASK;
> >
> > if ((regval > MAX9611_TEMP_MAX_POS &&
> > regval < MAX9611_TEMP_MIN_NEG) ||
While this did fix a bug, it also introduced a regression: on Salvator-XS,
which has two max9611 instances, I now see intermittent failures
max9611 4-007c: Invalid value received from ADC 0x8000: aborting
max9611: probe of 4-007c failed with error -5
and/or
max9611 4-007f: Invalid value received from ADC 0x8000: aborting
max9611: probe of 4-007f failed with error -5
during boot.
Retrying on failure fixes the issue, e.g.:
max9611_init:483: regval = 0x8000
max9611 4-007f: Invalid value received from ADC 0x8000: aborting
max9611_init:483: regval = 0x2780
According to the datasheet, 0x8000 is the Power-On Reset value.
Looks like it should be ignored, and retried?
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert(a)linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
From: Ding Xiang <dingxiang(a)cmss.chinamobile.com>
In the error path of stm_source_register_device(), the kfree is
unnecessary, as the put_device() before it ends up calling
stm_source_device_release() to free stm_source_device, leading to
a double free at the outer kfree() call. Remove it.
Signed-off-by: Ding Xiang <dingxiang(a)cmss.chinamobile.com>
Signed-off-by: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Fixes: 7bd1d4093c2fa ("stm class: Introduce an abstraction for System Trace Module devices")
Link: https://lore.kernel.org/linux-arm-kernel/1563354988-23826-1-git-send-email-…
Cc: stable(a)vger.kernel.org # v4.4+
---
drivers/hwtracing/stm/core.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index e55b902560de..181e7ff1ec4f 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -1276,7 +1276,6 @@ int stm_source_register_device(struct device *parent,
err:
put_device(&src->dev);
- kfree(src);
return err;
}
--
2.23.0.rc1
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: aad39e30fb9e - Linux 5.2.9
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/113217
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: aad39e30fb9e - Linux 5.2.9
We grabbed the 55ce78ffefc2 commit of the stable queue repository.
We then merged the patchset with `git am`:
keys-trusted-allow-module-init-if-tpm-is-inactive-or-deactivated.patch
sh-kernel-hw_breakpoint-fix-missing-break-in-switch-statement.patch
seq_file-fix-problem-when-seeking-mid-record.patch
mm-hmm-fix-bad-subpage-pointer-in-try_to_unmap_one.patch
mm-mempolicy-make-the-behavior-consistent-when-mpol_mf_move-and-mpol_mf_strict-were-specified.patch
mm-mempolicy-handle-vma-with-unmovable-pages-mapped-correctly-in-mbind.patch
mm-z3fold.c-fix-z3fold_destroy_pool-ordering.patch
mm-z3fold.c-fix-z3fold_destroy_pool-race-condition.patch
mm-memcontrol.c-fix-use-after-free-in-mem_cgroup_iter.patch
mm-usercopy-use-memory-range-to-be-accessed-for-wraparound-check.patch
mm-vmscan-do-not-special-case-slab-reclaim-when-watermarks-are-boosted.patch
cpufreq-schedutil-don-t-skip-freq-update-when-limits-change.patch
drm-amdgpu-fix-gfx9-soft-recovery.patch
drm-nouveau-only-recalculate-pbn-vcpi-on-mode-connector-changes.patch
xtensa-add-missing-isync-to-the-cpu_reset-tlb-code.patch
arm64-ftrace-ensure-module-ftrace-trampoline-is-coherent-with-i-side.patch
alsa-hda-realtek-add-quirk-for-hp-envy-x360.patch
alsa-usb-audio-fix-a-stack-buffer-overflow-bug-in-check_input_term.patch
alsa-usb-audio-fix-an-oob-bug-in-parse_audio_mixer_unit.patch
alsa-hda-apply-workaround-for-another-amd-chip-1022-1487.patch
alsa-hda-fix-a-memory-leak-bug.patch
alsa-hda-add-a-generic-reboot_notify.patch
alsa-hda-let-all-conexant-codec-enter-d3-when-rebooting.patch
hid-holtek-test-for-sanity-of-intfdata.patch
hid-hiddev-avoid-opening-a-disconnected-device.patch
hid-hiddev-do-cleanup-in-failure-of-opening-a-device.patch
input-kbtab-sanity-check-for-endpoint-type.patch
input-iforce-add-sanity-checks.patch
net-usb-pegasus-fix-improper-read-if-get_registers-fail.patch
bpf-fix-access-to-skb_shared_info-gso_segs.patch
netfilter-ebtables-also-count-base-chain-policies.patch
riscv-correct-the-initialized-flow-of-fp-register.patch
riscv-make-__fstate_clean-work-correctly.patch
revert-i2c-imx-improve-the-error-handling-in-i2c_imx_dma_request.patch
blk-mq-move-cancel-of-requeue_work-to-the-front-of-blk_exit_queue.patch
io_uring-fix-manual-setup-of-iov_iter-for-fixed-buffers.patch
rdma-hns-fix-sg-offset-non-zero-issue.patch
ib-mlx5-replace-kfree-with-kvfree.patch
clk-at91-generated-truncate-divisor-to-generated_max.patch
clk-sprd-select-regmap_mmio-to-avoid-compile-errors.patch
clk-renesas-cpg-mssr-fix-reset-control-race-conditio.patch
dma-mapping-check-pfn-validity-in-dma_common_-mmap-g.patch
platform-x86-pcengines-apuv2-fix-softdep-statement.patch
platform-x86-intel_pmc_core-add-icl-nnpi-support-to-.patch
mm-hmm-always-return-ebusy-for-invalid-ranges-in-hmm.patch
xen-pciback-remove-set-but-not-used-variable-old_sta.patch
irqchip-gic-v3-its-free-unused-vpt_page-when-alloc-v.patch
irqchip-irq-imx-gpcv2-forward-irq-type-to-parent.patch
f2fs-fix-to-read-source-block-before-invalidating-it.patch
tools-perf-beauty-fix-usbdevfs_ioctl-table-generator.patch
perf-header-fix-divide-by-zero-error-if-f_header.att.patch
perf-header-fix-use-of-unitialized-value-warning.patch
rdma-qedr-fix-the-hca_type-and-hca_rev-returned-in-d.patch
alsa-pcm-fix-lost-wakeup-event-scenarios-in-snd_pcm_.patch
libata-zpodd-fix-small-read-overflow-in-zpodd_get_me.patch
powerpc-nvdimm-pick-nearby-online-node-if-the-device.patch
drm-bridge-lvds-encoder-fix-build-error-while-config.patch
drm-bridge-tc358764-fix-build-error.patch
btrfs-fix-deadlock-between-fiemap-and-transaction-co.patch
scsi-hpsa-correct-scsi-command-status-issue-after-re.patch
scsi-qla2xxx-fix-possible-fcport-null-pointer-derefe.patch
tracing-fix-header-include-guards-in-trace-event-hea.patch
drm-amdkfd-fix-byte-align-on-vegam.patch
drm-amd-powerplay-fix-null-pointer-dereference-aroun.patch
drm-amdgpu-fix-error-handling-in-amdgpu_cs_process_f.patch
drm-amdgpu-fix-a-potential-information-leaking-bug.patch
ata-libahci-do-not-complain-in-case-of-deferred-prob.patch
kbuild-modpost-handle-kbuild_extra_symbols-only-for-.patch
kbuild-check-for-unknown-options-with-cc-option-usag.patch
arm64-efi-fix-variable-si-set-but-not-used.patch
riscv-fix-perf-record-without-libelf-support.patch
arm64-lower-priority-mask-for-gic_prio_irqon.patch
arm64-unwind-prohibit-probing-on-return_address.patch
arm64-mm-fix-variable-pud-set-but-not-used.patch
arm64-mm-fix-variable-tag-set-but-not-used.patch
ib-core-add-mitigation-for-spectre-v1.patch
ib-mlx5-fix-mr-registration-flow-to-use-umr-properly.patch
rdma-restrack-track-driver-qp-types-in-resource-trac.patch
ib-mad-fix-use-after-free-in-ib-mad-completion-handl.patch
rdma-mlx5-release-locks-during-notifier-unregister.patch
drm-msm-fix-add_gpu_components.patch
rdma-hns-fix-error-return-code-in-hns_roce_v1_rsv_lp.patch
drm-exynos-fix-missing-decrement-of-retry-counter.patch
arm64-kprobes-recover-pstate.d-in-single-step-except.patch
arm64-make-debug-exception-handlers-visible-from-rcu.patch
revert-kmemleak-allow-to-coexist-with-fault-injectio.patch
ocfs2-remove-set-but-not-used-variable-last_hash.patch
page-flags-prioritize-kasan-bits-over-last-cpuid.patch
asm-generic-fix-wtype-limits-compiler-warnings.patch
tpm-tpm_ibm_vtpm-fix-unallocated-banks.patch
arm64-kvm-regmap-fix-unexpected-switch-fall-through.patch
staging-comedi-dt3000-fix-signed-integer-overflow-divider-base.patch
staging-comedi-dt3000-fix-rounding-up-of-timer-divisor.patch
iio-adc-max9611-fix-temperature-reading-in-probe.patch
x86-boot-save-fields-explicitly-zero-out-everything-else.patch
usb-core-fix-races-in-character-device-registration-and-deregistraion.patch
usb-gadget-udc-renesas_usb3-fix-sysfs-interface-of-role.patch
usb-cdc-acm-make-sure-a-refcount-is-taken-early-enough.patch
usb-cdc-fix-sanity-checks-in-cdc-union-parser.patch
usb-serial-option-add-d-link-dwm-222-device-id.patch
usb-serial-option-add-support-for-zte-mf871a.patch
usb-serial-option-add-the-broadmobi-bm818-card.patch
usb-serial-option-add-motorola-modem-uarts.patch
usb-setup-authorized_default-attributes-using-usb_bus_notify.patch
netfilter-conntrack-use-consistent-ct-id-hash-calculation.patch
iwlwifi-add-support-for-sar-south-korea-limitation.patch
input-psmouse-fix-build-error-of-multiple-definition.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ xfstests: xfs [1]
✅ selinux-policy: serge-testsuite [2]
✅ lvm thinp sanity [3]
✅ storage: software RAID testing [4]
🚧 ✅ Storage blktests [5]
ppc64le:
Host 1:
✅ Boot test [0]
✅ xfstests: xfs [1]
✅ selinux-policy: serge-testsuite [2]
✅ lvm thinp sanity [3]
✅ storage: software RAID testing [4]
🚧 ✅ Storage blktests [5]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [6]
✅ Podman system integration test (as user) [6]
✅ LTP lite [7]
✅ Loopdev Sanity [8]
✅ jvm test suite [9]
✅ AMTU (Abstract Machine Test Utility) [10]
✅ LTP: openposix test suite [11]
✅ Networking socket: fuzz [12]
✅ audit: audit testsuite test [13]
✅ httpd: mod_ssl smoke sanity [14]
✅ iotop: sanity [15]
✅ tuned: tune-processes-through-perf [16]
✅ Usex - version 1.9-29 [17]
x86_64:
Host 1:
✅ Boot test [0]
✅ xfstests: xfs [1]
✅ selinux-policy: serge-testsuite [2]
✅ lvm thinp sanity [3]
✅ storage: software RAID testing [4]
🚧 ✅ Storage blktests [5]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [6]
✅ Podman system integration test (as user) [6]
✅ LTP lite [7]
✅ Loopdev Sanity [8]
✅ jvm test suite [9]
✅ AMTU (Abstract Machine Test Utility) [10]
✅ LTP: openposix test suite [11]
✅ Networking socket: fuzz [12]
✅ audit: audit testsuite test [13]
✅ httpd: mod_ssl smoke sanity [14]
✅ iotop: sanity [15]
✅ tuned: tune-processes-through-perf [16]
✅ pciutils: sanity smoke test [18]
✅ Usex - version 1.9-29 [17]
✅ storage: SCSI VPD [19]
✅ stress: stress-ng [20]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/filesystems…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/lvm/…
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/swra…
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/scsi…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
This is a note to let you know that I've just added the patch titled
staging: erofs: avoid endless loop of invalid lookback distance 0
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the staging-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 07ae24a38ac0254a5d955e4646806b756a426c0c Mon Sep 17 00:00:00 2001
From: Gao Xiang <gaoxiang25(a)huawei.com>
Date: Mon, 19 Aug 2019 18:34:26 +0800
Subject: staging: erofs: avoid endless loop of invalid lookback distance 0
As reported by erofs-utils fuzzer, Lookback distance should
be a positive number, so it should be actually looked back
rather than spinning.
Fixes: 02827e1796b3 ("staging: erofs: add erofs_map_blocks_iter")
Cc: <stable(a)vger.kernel.org> # 4.19+
Signed-off-by: Gao Xiang <gaoxiang25(a)huawei.com>
Reviewed-by: Chao Yu <yuchao0(a)huawei.com>
Link: https://lore.kernel.org/r/20190819103426.87579-7-gaoxiang25@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/erofs/zmap.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/staging/erofs/zmap.c b/drivers/staging/erofs/zmap.c
index 7408e86823a4..774dacbc5b32 100644
--- a/drivers/staging/erofs/zmap.c
+++ b/drivers/staging/erofs/zmap.c
@@ -350,6 +350,12 @@ static int vle_extent_lookback(struct z_erofs_maprecorder *m,
switch (m->type) {
case Z_EROFS_VLE_CLUSTER_TYPE_NONHEAD:
+ if (unlikely(!m->delta[0])) {
+ errln("invalid lookback distance 0 at nid %llu",
+ vi->nid);
+ DBG_BUGON(1);
+ return -EFSCORRUPTED;
+ }
return vle_extent_lookback(m, m->delta[0]);
case Z_EROFS_VLE_CLUSTER_TYPE_PLAIN:
map->m_flags &= ~EROFS_MAP_ZIPPED;
--
2.23.0
This is a note to let you know that I've just added the patch titled
staging: erofs: add two missing erofs_workgroup_put for corrupted
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the staging-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 138e1a0990e80db486ab9f6c06bd5c01f9a97999 Mon Sep 17 00:00:00 2001
From: Gao Xiang <gaoxiang25(a)huawei.com>
Date: Mon, 19 Aug 2019 18:34:23 +0800
Subject: staging: erofs: add two missing erofs_workgroup_put for corrupted
images
As reported by erofs-utils fuzzer, these error handling
path will be entered to handle corrupted images.
Lack of erofs_workgroup_puts will cause unmounting
unsuccessfully.
Fix these return values to EFSCORRUPTED as well.
Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
Cc: <stable(a)vger.kernel.org> # 4.19+
Signed-off-by: Gao Xiang <gaoxiang25(a)huawei.com>
Reviewed-by: Chao Yu <yuchao0(a)huawei.com>
Link: https://lore.kernel.org/r/20190819103426.87579-4-gaoxiang25@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/erofs/zdata.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/erofs/zdata.c b/drivers/staging/erofs/zdata.c
index 87b0c96caf8f..23283c97fd3b 100644
--- a/drivers/staging/erofs/zdata.c
+++ b/drivers/staging/erofs/zdata.c
@@ -357,14 +357,16 @@ static struct z_erofs_collection *cllookup(struct z_erofs_collector *clt,
cl = z_erofs_primarycollection(pcl);
if (unlikely(cl->pageofs != (map->m_la & ~PAGE_MASK))) {
DBG_BUGON(1);
- return ERR_PTR(-EIO);
+ erofs_workgroup_put(grp);
+ return ERR_PTR(-EFSCORRUPTED);
}
length = READ_ONCE(pcl->length);
if (length & Z_EROFS_PCLUSTER_FULL_LENGTH) {
if ((map->m_llen << Z_EROFS_PCLUSTER_LENGTH_BIT) > length) {
DBG_BUGON(1);
- return ERR_PTR(-EIO);
+ erofs_workgroup_put(grp);
+ return ERR_PTR(-EFSCORRUPTED);
}
} else {
unsigned int llen = map->m_llen << Z_EROFS_PCLUSTER_LENGTH_BIT;
--
2.23.0
This is a note to let you know that I've just added the patch titled
staging: erofs: cannot set EROFS_V_Z_INITED_BIT if fill_inode_lazy
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the staging-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 3407a4198faf01c9d7596c45b8606834b8dfc2b7 Mon Sep 17 00:00:00 2001
From: Gao Xiang <gaoxiang25(a)huawei.com>
Date: Mon, 19 Aug 2019 18:34:22 +0800
Subject: staging: erofs: cannot set EROFS_V_Z_INITED_BIT if fill_inode_lazy
fails
As reported by erofs-utils fuzzer, unsupported compressed
clustersize will make fill_inode_lazy fail, for such case
we cannot set EROFS_V_Z_INITED_BIT since we need return
failure for each z_erofs_map_blocks_iter().
Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support")
Cc: <stable(a)vger.kernel.org> # 5.3+
Signed-off-by: Gao Xiang <gaoxiang25(a)huawei.com>
Reviewed-by: Chao Yu <yuchao0(a)huawei.com>
Link: https://lore.kernel.org/r/20190819103426.87579-3-gaoxiang25@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/erofs/zmap.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/staging/erofs/zmap.c b/drivers/staging/erofs/zmap.c
index b61b9b5950ac..7408e86823a4 100644
--- a/drivers/staging/erofs/zmap.c
+++ b/drivers/staging/erofs/zmap.c
@@ -85,12 +85,11 @@ static int fill_inode_lazy(struct inode *inode)
vi->z_physical_clusterbits[1] = vi->z_logical_clusterbits +
((h->h_clusterbits >> 5) & 7);
+ set_bit(EROFS_V_Z_INITED_BIT, &vi->flags);
unmap_done:
kunmap_atomic(kaddr);
unlock_page(page);
put_page(page);
-
- set_bit(EROFS_V_Z_INITED_BIT, &vi->flags);
out_unlock:
clear_and_wake_up_bit(EROFS_V_BL_Z_BIT, &vi->flags);
return err;
--
2.23.0
This is a note to let you know that I've just added the patch titled
staging: erofs: some compressed cluster should be submitted for
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the staging-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From ee45197c807895e156b2be0abcaebdfc116487c8 Mon Sep 17 00:00:00 2001
From: Gao Xiang <gaoxiang25(a)huawei.com>
Date: Mon, 19 Aug 2019 18:34:21 +0800
Subject: staging: erofs: some compressed cluster should be submitted for
corrupted images
As reported by erofs_utils fuzzer, a logical page can belong
to at most 2 compressed clusters, if one compressed cluster
is corrupted, but the other has been ready in submitting chain.
The chain needs to submit anyway in order to keep the page
working properly (page unlocked with PG_error set, PG_uptodate
not set).
Let's fix it now.
Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
Cc: <stable(a)vger.kernel.org> # 4.19+
Signed-off-by: Gao Xiang <gaoxiang25(a)huawei.com>
Reviewed-by: Chao Yu <yuchao0(a)huawei.com>
Link: https://lore.kernel.org/r/20190819103426.87579-2-gaoxiang25@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/erofs/zdata.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/drivers/staging/erofs/zdata.c b/drivers/staging/erofs/zdata.c
index 2d7aaf98f7de..87b0c96caf8f 100644
--- a/drivers/staging/erofs/zdata.c
+++ b/drivers/staging/erofs/zdata.c
@@ -1307,19 +1307,18 @@ static int z_erofs_vle_normalaccess_readpage(struct file *file,
err = z_erofs_do_read_page(&f, page, &pagepool);
(void)z_erofs_collector_end(&f.clt);
- if (err) {
+ /* if some compressed cluster ready, need submit them anyway */
+ z_erofs_submit_and_unzip(inode->i_sb, &f.clt, &pagepool, true);
+
+ if (err)
errln("%s, failed to read, err [%d]", __func__, err);
- goto out;
- }
- z_erofs_submit_and_unzip(inode->i_sb, &f.clt, &pagepool, true);
-out:
if (f.map.mpage)
put_page(f.map.mpage);
/* clean up the remaining free pages */
put_pages_list(&pagepool);
- return 0;
+ return err;
}
static bool should_decompress_synchronously(struct erofs_sb_info *sbi,
--
2.23.0
This is a note to let you know that I've just added the patch titled
staging: erofs: fix an error handling in erofs_readdir()
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the staging-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From acb383f1dcb4f1e79b66d4be3a0b6f519a957b0d Mon Sep 17 00:00:00 2001
From: Gao Xiang <gaoxiang25(a)huawei.com>
Date: Sun, 18 Aug 2019 20:54:57 +0800
Subject: staging: erofs: fix an error handling in erofs_readdir()
Richard observed a forever loop of erofs_read_raw_page() [1]
which can be generated by forcely setting ->u.i_blkaddr
to 0xdeadbeef (as my understanding block layer can
handle access beyond end of device correctly).
After digging into that, it seems the problem is highly
related with directories and then I found the root cause
is an improper error handling in erofs_readdir().
Let's fix it now.
[1] https://lore.kernel.org/r/1163995781.68824.1566084358245.JavaMail.zimbra@no…
Reported-by: Richard Weinberger <richard(a)nod.at>
Fixes: 3aa8ec716e52 ("staging: erofs: add directory operations")
Cc: <stable(a)vger.kernel.org> # 4.19+
Reviewed-by: Chao Yu <yuchao0(a)huawei.com>
Signed-off-by: Gao Xiang <gaoxiang25(a)huawei.com>
Link: https://lore.kernel.org/r/20190818125457.25906-1-hsiangkao@aol.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/erofs/dir.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/erofs/dir.c b/drivers/staging/erofs/dir.c
index 5f38382637e6..77ef856df9f3 100644
--- a/drivers/staging/erofs/dir.c
+++ b/drivers/staging/erofs/dir.c
@@ -82,8 +82,15 @@ static int erofs_readdir(struct file *f, struct dir_context *ctx)
unsigned int nameoff, maxsize;
dentry_page = read_mapping_page(mapping, i, NULL);
- if (IS_ERR(dentry_page))
- continue;
+ if (dentry_page == ERR_PTR(-ENOMEM)) {
+ err = -ENOMEM;
+ break;
+ } else if (IS_ERR(dentry_page)) {
+ errln("fail to readdir of logical block %u of nid %llu",
+ i, EROFS_V(dir)->nid);
+ err = -EFSCORRUPTED;
+ break;
+ }
de = (struct erofs_dirent *)kmap(dentry_page);
--
2.23.0
Various notifications of type "BUG kmalloc-4096 () : Redzone
overwritten" have been observed recently in various parts of
the kernel. After some time, it has been made a relation with
the use of BTRFS filesystem.
[ 22.809700] BUG kmalloc-4096 (Tainted: G W ): Redzone overwritten
[ 22.809971] -----------------------------------------------------------------------------
[ 22.810286] INFO: 0xbe1a5921-0xfbfc06cd. First byte 0x0 instead of 0xcc
[ 22.810866] INFO: Allocated in __load_free_space_cache+0x588/0x780 [btrfs] age=22 cpu=0 pid=224
[ 22.811193] __slab_alloc.constprop.26+0x44/0x70
[ 22.811345] kmem_cache_alloc_trace+0xf0/0x2ec
[ 22.811588] __load_free_space_cache+0x588/0x780 [btrfs]
[ 22.811848] load_free_space_cache+0xf4/0x1b0 [btrfs]
[ 22.812090] cache_block_group+0x1d0/0x3d0 [btrfs]
[ 22.812321] find_free_extent+0x680/0x12a4 [btrfs]
[ 22.812549] btrfs_reserve_extent+0xec/0x220 [btrfs]
[ 22.812785] btrfs_alloc_tree_block+0x178/0x5f4 [btrfs]
[ 22.813032] __btrfs_cow_block+0x150/0x5d4 [btrfs]
[ 22.813262] btrfs_cow_block+0x194/0x298 [btrfs]
[ 22.813484] commit_cowonly_roots+0x44/0x294 [btrfs]
[ 22.813718] btrfs_commit_transaction+0x63c/0xc0c [btrfs]
[ 22.813973] close_ctree+0xf8/0x2a4 [btrfs]
[ 22.814107] generic_shutdown_super+0x80/0x110
[ 22.814250] kill_anon_super+0x18/0x30
[ 22.814437] btrfs_kill_super+0x18/0x90 [btrfs]
[ 22.814590] INFO: Freed in proc_cgroup_show+0xc0/0x248 age=41 cpu=0 pid=83
[ 22.814841] proc_cgroup_show+0xc0/0x248
[ 22.814967] proc_single_show+0x54/0x98
[ 22.815086] seq_read+0x278/0x45c
[ 22.815190] __vfs_read+0x28/0x17c
[ 22.815289] vfs_read+0xa8/0x14c
[ 22.815381] ksys_read+0x50/0x94
[ 22.815475] ret_from_syscall+0x0/0x38
Commit 69d2480456d1 ("btrfs: use copy_page for copying pages instead
of memcpy") changed the way bitmap blocks are copied. But allthough
bitmaps have the size of a page, they were allocated with kzalloc().
Most of the time, kzalloc() allocates aligned blocks of memory, so
copy_page() can be used. But when some debug options like SLAB_DEBUG
are activated, kzalloc() may return unaligned pointer.
On powerpc, memcpy(), copy_page() and other copying functions use
'dcbz' instruction which provides an entire zeroed cacheline to avoid
memory read when the intention is to overwrite a full line. Functions
like memcpy() are writen to care about partial cachelines at the start
and end of the destination, but copy_page() assumes it gets pages. As
pages are naturally cache aligned, copy_page() doesn't care about
partial lines. This means that when copy_page() is called with a
misaligned pointer, a few leading bytes are zeroed.
To fix it, allocate bitmaps with get_zeroed_page() instead of kzalloc()
Reported-by: Erhard F. <erhard_f(a)mailbox.org>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=204371
Fixes: 69d2480456d1 ("btrfs: use copy_page for copying pages instead of memcpy")
Cc: stable(a)vger.kernel.org
Signed-off-by: Christophe Leroy <christophe.leroy(a)c-s.fr>
Tested-by: Erhard F. <erhard_f(a)mailbox.org>
---
fs/btrfs/free-space-cache.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 062be9dde4c6..3229a058e025 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -764,7 +764,7 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
} else {
ASSERT(num_bitmaps);
num_bitmaps--;
- e->bitmap = kzalloc(PAGE_SIZE, GFP_NOFS);
+ e->bitmap = (void *)get_zeroed_page(GFP_NOFS);
if (!e->bitmap) {
kmem_cache_free(
btrfs_free_space_cachep, e);
@@ -1881,7 +1881,7 @@ static void free_bitmap(struct btrfs_free_space_ctl *ctl,
struct btrfs_free_space *bitmap_info)
{
unlink_free_space(ctl, bitmap_info);
- kfree(bitmap_info->bitmap);
+ free_page((unsigned long)bitmap_info->bitmap);
kmem_cache_free(btrfs_free_space_cachep, bitmap_info);
ctl->total_bitmaps--;
ctl->op->recalc_thresholds(ctl);
@@ -2135,7 +2135,7 @@ static int insert_into_bitmap(struct btrfs_free_space_ctl *ctl,
}
/* allocate the bitmap */
- info->bitmap = kzalloc(PAGE_SIZE, GFP_NOFS);
+ info->bitmap = (void *)get_zeroed_page(GFP_NOFS);
spin_lock(&ctl->tree_lock);
if (!info->bitmap) {
ret = -ENOMEM;
@@ -2146,7 +2146,7 @@ static int insert_into_bitmap(struct btrfs_free_space_ctl *ctl,
out:
if (info) {
- kfree(info->bitmap);
+ free_page((unsigned long)info->bitmap);
kmem_cache_free(btrfs_free_space_cachep, info);
}
@@ -2802,7 +2802,7 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
if (entry->bytes == 0) {
ctl->free_extents--;
if (entry->bitmap) {
- kfree(entry->bitmap);
+ free_page((unsigned long)entry->bitmap);
ctl->total_bitmaps--;
ctl->op->recalc_thresholds(ctl);
}
@@ -3606,7 +3606,7 @@ int test_add_free_space_entry(struct btrfs_block_group_cache *cache,
}
if (!map) {
- map = kzalloc(PAGE_SIZE, GFP_NOFS);
+ map = (void *)get_zeroed_page(GFP_NOFS);
if (!map) {
kmem_cache_free(btrfs_free_space_cachep, info);
return -ENOMEM;
@@ -3635,7 +3635,7 @@ int test_add_free_space_entry(struct btrfs_block_group_cache *cache,
if (info)
kmem_cache_free(btrfs_free_space_cachep, info);
- kfree(map);
+ free_page((unsigned long)map);
return 0;
}
--
2.17.1
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: aad39e30fb9e - Linux 5.2.9
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/113189
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: aad39e30fb9e - Linux 5.2.9
We grabbed the 95a0538f001f commit of the stable queue repository.
We then merged the patchset with `git am`:
keys-trusted-allow-module-init-if-tpm-is-inactive-or-deactivated.patch
sh-kernel-hw_breakpoint-fix-missing-break-in-switch-statement.patch
seq_file-fix-problem-when-seeking-mid-record.patch
mm-hmm-fix-bad-subpage-pointer-in-try_to_unmap_one.patch
mm-mempolicy-make-the-behavior-consistent-when-mpol_mf_move-and-mpol_mf_strict-were-specified.patch
mm-mempolicy-handle-vma-with-unmovable-pages-mapped-correctly-in-mbind.patch
mm-z3fold.c-fix-z3fold_destroy_pool-ordering.patch
mm-z3fold.c-fix-z3fold_destroy_pool-race-condition.patch
mm-memcontrol.c-fix-use-after-free-in-mem_cgroup_iter.patch
mm-usercopy-use-memory-range-to-be-accessed-for-wraparound-check.patch
mm-vmscan-do-not-special-case-slab-reclaim-when-watermarks-are-boosted.patch
cpufreq-schedutil-don-t-skip-freq-update-when-limits-change.patch
drm-amdgpu-fix-gfx9-soft-recovery.patch
drm-nouveau-only-recalculate-pbn-vcpi-on-mode-connector-changes.patch
xtensa-add-missing-isync-to-the-cpu_reset-tlb-code.patch
arm64-ftrace-ensure-module-ftrace-trampoline-is-coherent-with-i-side.patch
alsa-hda-realtek-add-quirk-for-hp-envy-x360.patch
alsa-usb-audio-fix-a-stack-buffer-overflow-bug-in-check_input_term.patch
alsa-usb-audio-fix-an-oob-bug-in-parse_audio_mixer_unit.patch
alsa-hda-apply-workaround-for-another-amd-chip-1022-1487.patch
alsa-hda-fix-a-memory-leak-bug.patch
alsa-hda-add-a-generic-reboot_notify.patch
alsa-hda-let-all-conexant-codec-enter-d3-when-rebooting.patch
hid-holtek-test-for-sanity-of-intfdata.patch
hid-hiddev-avoid-opening-a-disconnected-device.patch
hid-hiddev-do-cleanup-in-failure-of-opening-a-device.patch
input-kbtab-sanity-check-for-endpoint-type.patch
input-iforce-add-sanity-checks.patch
net-usb-pegasus-fix-improper-read-if-get_registers-fail.patch
bpf-fix-access-to-skb_shared_info-gso_segs.patch
netfilter-ebtables-also-count-base-chain-policies.patch
riscv-correct-the-initialized-flow-of-fp-register.patch
riscv-make-__fstate_clean-work-correctly.patch
revert-i2c-imx-improve-the-error-handling-in-i2c_imx_dma_request.patch
blk-mq-move-cancel-of-requeue_work-to-the-front-of-blk_exit_queue.patch
io_uring-fix-manual-setup-of-iov_iter-for-fixed-buffers.patch
rdma-hns-fix-sg-offset-non-zero-issue.patch
ib-mlx5-replace-kfree-with-kvfree.patch
clk-at91-generated-truncate-divisor-to-generated_max.patch
clk-sprd-select-regmap_mmio-to-avoid-compile-errors.patch
clk-renesas-cpg-mssr-fix-reset-control-race-conditio.patch
dma-mapping-check-pfn-validity-in-dma_common_-mmap-g.patch
platform-x86-pcengines-apuv2-fix-softdep-statement.patch
platform-x86-intel_pmc_core-add-icl-nnpi-support-to-.patch
mm-hmm-always-return-ebusy-for-invalid-ranges-in-hmm.patch
xen-pciback-remove-set-but-not-used-variable-old_sta.patch
irqchip-gic-v3-its-free-unused-vpt_page-when-alloc-v.patch
irqchip-irq-imx-gpcv2-forward-irq-type-to-parent.patch
f2fs-fix-to-read-source-block-before-invalidating-it.patch
tools-perf-beauty-fix-usbdevfs_ioctl-table-generator.patch
perf-header-fix-divide-by-zero-error-if-f_header.att.patch
perf-header-fix-use-of-unitialized-value-warning.patch
rdma-qedr-fix-the-hca_type-and-hca_rev-returned-in-d.patch
alsa-pcm-fix-lost-wakeup-event-scenarios-in-snd_pcm_.patch
libata-zpodd-fix-small-read-overflow-in-zpodd_get_me.patch
powerpc-nvdimm-pick-nearby-online-node-if-the-device.patch
drm-bridge-lvds-encoder-fix-build-error-while-config.patch
drm-bridge-tc358764-fix-build-error.patch
btrfs-fix-deadlock-between-fiemap-and-transaction-co.patch
scsi-hpsa-correct-scsi-command-status-issue-after-re.patch
scsi-qla2xxx-fix-possible-fcport-null-pointer-derefe.patch
tracing-fix-header-include-guards-in-trace-event-hea.patch
drm-amdkfd-fix-byte-align-on-vegam.patch
drm-amd-powerplay-fix-null-pointer-dereference-aroun.patch
drm-amdgpu-fix-error-handling-in-amdgpu_cs_process_f.patch
drm-amdgpu-fix-a-potential-information-leaking-bug.patch
ata-libahci-do-not-complain-in-case-of-deferred-prob.patch
kbuild-modpost-handle-kbuild_extra_symbols-only-for-.patch
kbuild-check-for-unknown-options-with-cc-option-usag.patch
arm64-efi-fix-variable-si-set-but-not-used.patch
riscv-fix-perf-record-without-libelf-support.patch
arm64-lower-priority-mask-for-gic_prio_irqon.patch
arm64-unwind-prohibit-probing-on-return_address.patch
arm64-mm-fix-variable-pud-set-but-not-used.patch
arm64-mm-fix-variable-tag-set-but-not-used.patch
ib-core-add-mitigation-for-spectre-v1.patch
ib-mlx5-fix-mr-registration-flow-to-use-umr-properly.patch
rdma-restrack-track-driver-qp-types-in-resource-trac.patch
ib-mad-fix-use-after-free-in-ib-mad-completion-handl.patch
rdma-mlx5-release-locks-during-notifier-unregister.patch
drm-msm-fix-add_gpu_components.patch
rdma-hns-fix-error-return-code-in-hns_roce_v1_rsv_lp.patch
drm-exynos-fix-missing-decrement-of-retry-counter.patch
arm64-kprobes-recover-pstate.d-in-single-step-except.patch
arm64-make-debug-exception-handlers-visible-from-rcu.patch
revert-kmemleak-allow-to-coexist-with-fault-injectio.patch
ocfs2-remove-set-but-not-used-variable-last_hash.patch
page-flags-prioritize-kasan-bits-over-last-cpuid.patch
asm-generic-fix-wtype-limits-compiler-warnings.patch
tpm-tpm_ibm_vtpm-fix-unallocated-banks.patch
arm64-kvm-regmap-fix-unexpected-switch-fall-through.patch
staging-comedi-dt3000-fix-signed-integer-overflow-divider-base.patch
staging-comedi-dt3000-fix-rounding-up-of-timer-divisor.patch
iio-adc-max9611-fix-temperature-reading-in-probe.patch
x86-boot-save-fields-explicitly-zero-out-everything-else.patch
usb-core-fix-races-in-character-device-registration-and-deregistraion.patch
usb-gadget-udc-renesas_usb3-fix-sysfs-interface-of-role.patch
usb-cdc-acm-make-sure-a-refcount-is-taken-early-enough.patch
usb-cdc-fix-sanity-checks-in-cdc-union-parser.patch
usb-serial-option-add-d-link-dwm-222-device-id.patch
usb-serial-option-add-support-for-zte-mf871a.patch
usb-serial-option-add-the-broadmobi-bm818-card.patch
usb-serial-option-add-motorola-modem-uarts.patch
usb-setup-authorized_default-attributes-using-usb_bus_notify.patch
netfilter-conntrack-use-consistent-ct-id-hash-calculation.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
ppc64le:
Host 1:
✅ Boot test [0]
✅ xfstests: xfs [1]
✅ selinux-policy: serge-testsuite [2]
✅ lvm thinp sanity [3]
✅ storage: software RAID testing [4]
🚧 ✅ Storage blktests [5]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [6]
✅ Podman system integration test (as user) [6]
✅ LTP lite [7]
✅ Loopdev Sanity [8]
✅ jvm test suite [9]
✅ AMTU (Abstract Machine Test Utility) [10]
✅ LTP: openposix test suite [11]
✅ Networking socket: fuzz [12]
✅ audit: audit testsuite test [13]
✅ httpd: mod_ssl smoke sanity [14]
✅ iotop: sanity [15]
✅ tuned: tune-processes-through-perf [16]
✅ Usex - version 1.9-29 [17]
x86_64:
Host 1:
✅ Boot test [0]
✅ xfstests: xfs [1]
✅ selinux-policy: serge-testsuite [2]
✅ lvm thinp sanity [3]
✅ storage: software RAID testing [4]
🚧 ✅ Storage blktests [5]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [6]
✅ Podman system integration test (as user) [6]
✅ LTP lite [7]
✅ Loopdev Sanity [8]
✅ jvm test suite [9]
✅ AMTU (Abstract Machine Test Utility) [10]
✅ LTP: openposix test suite [11]
✅ Networking socket: fuzz [12]
✅ audit: audit testsuite test [13]
✅ httpd: mod_ssl smoke sanity [14]
✅ iotop: sanity [15]
✅ tuned: tune-processes-through-perf [16]
✅ pciutils: sanity smoke test [18]
✅ Usex - version 1.9-29 [17]
✅ storage: SCSI VPD [19]
✅ stress: stress-ng [20]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/filesystems…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/lvm/…
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/swra…
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/scsi…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
I'm announcing the release of the 3.16.73 kernel.
All users of the 3.16 kernel series should upgrade.
The updated 3.16.y git tree can be found at:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-3.16.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git
The diff from 3.16.72 is attached to this message.
Ben.
------------
Documentation/siphash.txt | 75 +++++++++++
Makefile | 2 +-
fs/ext4/indirect.c | 43 ++++---
include/linux/siphash.h | 57 +++++++-
include/net/tcp.h | 3 +
lib/siphash.c | 321 +++++++++++++++++++++++++++++++++++++++++++++-
lib/test_siphash.c | 98 +++++++++++++-
7 files changed, 572 insertions(+), 27 deletions(-)
Ben Hutchings (2):
tcp: Clear sk_send_head after purging the write queue
Linux 3.16.73
Jason A. Donenfeld (1):
siphash: implement HalfSipHash1-3 for hash tables
zhangyi (F) (2):
ext4: brelse all indirect buffer in ext4_ind_remove_space()
ext4: cleanup bh release code in ext4_ind_remove_space()
--
Ben Hutchings
Experience is what causes a person to make new mistakes
instead of old ones.
Please apply commit 3c047057d120 ("asm-generic: default BUG_ON(x) to if(x)BUG()")
to linux-4.4.y.
The commit is somewhat related to commit 173a3efd3edb ("bug.h: work
around GCC PR82365 in BUG()") which has already been applied to v4.4.y.
That patch assumes that commit 3c047057d120 is applied as well.
Commit 3c047057d120 avoids warnings such as
arch/x86/kernel/irqinit.c:157:2: warning: if statement has empty body [-Wempty-body]
which are reported randomly by 0day build reports. Besides, as Arnd
points out in the commit, it avoids random behavior with CONFIG_BUG=n.
Thanks,
Guenter
From: Arnd Bergmann <arnd(a)arndb.de>
[ Upstream commit 5d6fb560729a5d5554e23db8d00eb57cd0021083 ]
clang-9 points out that there are two variables that depending on the
configuration may only be used in an ARRAY_SIZE() expression but not
referenced:
drivers/dma/ste_dma40.c:145:12: error: variable 'd40_backup_regs' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
static u32 d40_backup_regs[] = {
^
drivers/dma/ste_dma40.c:214:12: error: variable 'd40_backup_regs_chan' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
static u32 d40_backup_regs_chan[] = {
Mark these __maybe_unused to shut up the warning.
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
Reviewed-by: Nathan Chancellor <natechancellor(a)gmail.com>
Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org>
Link: https://lore.kernel.org/r/20190712091357.744515-1-arnd@arndb.de
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/dma/ste_dma40.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index 89d710899010d..de8bfd9a76e9e 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -142,7 +142,7 @@ enum d40_events {
* when the DMA hw is powered off.
* TODO: Add save/restore of D40_DREG_GCC on dma40 v3 or later, if that works.
*/
-static u32 d40_backup_regs[] = {
+static __maybe_unused u32 d40_backup_regs[] = {
D40_DREG_LCPA,
D40_DREG_LCLA,
D40_DREG_PRMSE,
@@ -211,7 +211,7 @@ static u32 d40_backup_regs_v4b[] = {
#define BACKUP_REGS_SZ_V4B ARRAY_SIZE(d40_backup_regs_v4b)
-static u32 d40_backup_regs_chan[] = {
+static __maybe_unused u32 d40_backup_regs_chan[] = {
D40_CHAN_REG_SSCFG,
D40_CHAN_REG_SSELT,
D40_CHAN_REG_SSPTR,
--
2.20.1
From: Arnd Bergmann <arnd(a)arndb.de>
[ Upstream commit 5d6fb560729a5d5554e23db8d00eb57cd0021083 ]
clang-9 points out that there are two variables that depending on the
configuration may only be used in an ARRAY_SIZE() expression but not
referenced:
drivers/dma/ste_dma40.c:145:12: error: variable 'd40_backup_regs' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
static u32 d40_backup_regs[] = {
^
drivers/dma/ste_dma40.c:214:12: error: variable 'd40_backup_regs_chan' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
static u32 d40_backup_regs_chan[] = {
Mark these __maybe_unused to shut up the warning.
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
Reviewed-by: Nathan Chancellor <natechancellor(a)gmail.com>
Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org>
Link: https://lore.kernel.org/r/20190712091357.744515-1-arnd@arndb.de
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/dma/ste_dma40.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index f4edfc56f34ef..3d55405c49cac 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -142,7 +142,7 @@ enum d40_events {
* when the DMA hw is powered off.
* TODO: Add save/restore of D40_DREG_GCC on dma40 v3 or later, if that works.
*/
-static u32 d40_backup_regs[] = {
+static __maybe_unused u32 d40_backup_regs[] = {
D40_DREG_LCPA,
D40_DREG_LCLA,
D40_DREG_PRMSE,
@@ -211,7 +211,7 @@ static u32 d40_backup_regs_v4b[] = {
#define BACKUP_REGS_SZ_V4B ARRAY_SIZE(d40_backup_regs_v4b)
-static u32 d40_backup_regs_chan[] = {
+static __maybe_unused u32 d40_backup_regs_chan[] = {
D40_CHAN_REG_SSCFG,
D40_CHAN_REG_SSELT,
D40_CHAN_REG_SSPTR,
--
2.20.1
From: "Steven Rostedt (VMware)" <rostedt(a)goodmis.org>
The tools/lib/traceevent/Makefile had a test added to it to detect a failure
of the "nm" when making the dynamic list file (whatever that is). The
problem is that the test sorts the values "U W w" and some versions of sort
will place "w" ahead of "W" (even though it has a higher ASCII value, and
break the test.
Add 'tr "w" "W"' to merge the two and not worry about the ordering.
Reported-by: Tzvetomir Stoyanov <tstoyanov(a)vmware.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Cc: David Carrillo-Cisneros <davidcc(a)google.com>
Cc: He Kuang <hekuang(a)huawei.com>
Cc: Jiri Olsa <jolsa(a)kernel.org>
Cc: Michal rarek <mmarek(a)suse.com>
Cc: Paul Turner <pjt(a)google.com>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Stephane Eranian <eranian(a)google.com>
Cc: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
Cc: Wang Nan <wangnan0(a)huawei.com>
Cc: stable(a)vger.kernel.org
Fixes: 6467753d61399 ("tools lib traceevent: Robustify do_generate_dynamic_list_file")
Link: http://lkml.kernel.org/r/20190805130150.25acfeb1@gandalf.local.home
Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com>
---
tools/lib/traceevent/Makefile | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile
index 3292c290654f..8352d53dcb5a 100644
--- a/tools/lib/traceevent/Makefile
+++ b/tools/lib/traceevent/Makefile
@@ -266,8 +266,8 @@ endef
define do_generate_dynamic_list_file
symbol_type=`$(NM) -u -D $1 | awk 'NF>1 {print $$1}' | \
- xargs echo "U W w" | tr ' ' '\n' | sort -u | xargs echo`;\
- if [ "$$symbol_type" = "U W w" ];then \
+ xargs echo "U w W" | tr 'w ' 'W\n' | sort -u | xargs echo`;\
+ if [ "$$symbol_type" = "U W" ];then \
(echo '{'; \
$(NM) -u -D $1 | awk 'NF>1 {print "\t"$$2";"}' | sort -u;\
echo '};'; \
--
2.21.0
This fixes a bug added in 4.10 with commit:
commit 9561a7ade0c205bc2ee035a2ac880478dcc1a024
Author: Josef Bacik <jbacik(a)fb.com>
Date: Tue Nov 22 14:04:40 2016 -0500
nbd: add multi-connection support
that limited the number of devices to 256. Before the patch we could
create 1000s of devices, but the patch switched us from using our
own thread to using a work queue which has a default limit of 256
active works.
The problem is that our recv_work function sits in a loop until
disconnection but only handles IO for one connection. The work is
started when the connection is started/restarted, but if we end up
creating 257 or more connections, the queue_work call just queues
connection257+'s recv_work and that waits for connection 1 - 256's
recv_work to be disconnected and that work instance completing.
Instead of reverting back to kthreads, this has us allocate a
workqueue_struct per device, so we can block in the work.
Cc: stable(a)vger.kernel.org
Signed-off-by: Mike Christie <mchristi(a)redhat.com>
---
drivers/block/nbd.c | 39 +++++++++++++++++++++++++--------------
1 file changed, 25 insertions(+), 14 deletions(-)
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 9bcde2325893..cc4b2ae57409 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -108,6 +108,7 @@ struct nbd_device {
struct nbd_config *config;
struct mutex config_lock;
struct gendisk *disk;
+ struct workqueue_struct *recv_workq;
struct list_head list;
struct task_struct *task_recv;
@@ -138,7 +139,6 @@ static struct dentry *nbd_dbg_dir;
static unsigned int nbds_max = 16;
static int max_part = 16;
-static struct workqueue_struct *recv_workqueue;
static int part_shift;
static int nbd_dev_dbg_init(struct nbd_device *nbd);
@@ -1036,7 +1036,7 @@ static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg)
/* We take the tx_mutex in an error path in the recv_work, so we
* need to queue_work outside of the tx_mutex.
*/
- queue_work(recv_workqueue, &args->work);
+ queue_work(nbd->recv_workq, &args->work);
atomic_inc(&config->live_connections);
wake_up(&config->conn_wait);
@@ -1137,6 +1137,10 @@ static void nbd_config_put(struct nbd_device *nbd)
kfree(nbd->config);
nbd->config = NULL;
+ if (nbd->recv_workq)
+ destroy_workqueue(nbd->recv_workq);
+ nbd->recv_workq = NULL;
+
nbd->tag_set.timeout = 0;
nbd->disk->queue->limits.discard_granularity = 0;
nbd->disk->queue->limits.discard_alignment = 0;
@@ -1165,6 +1169,14 @@ static int nbd_start_device(struct nbd_device *nbd)
return -EINVAL;
}
+ nbd->recv_workq = alloc_workqueue("knbd%d-recv",
+ WQ_MEM_RECLAIM | WQ_HIGHPRI |
+ WQ_UNBOUND, 0, nbd->index);
+ if (!nbd->recv_workq) {
+ dev_err(disk_to_dev(nbd->disk), "Could not allocate knbd recv work queue.\n");
+ return -ENOMEM;
+ }
+
blk_mq_update_nr_hw_queues(&nbd->tag_set, config->num_connections);
nbd->task_recv = current;
@@ -1195,7 +1207,7 @@ static int nbd_start_device(struct nbd_device *nbd)
INIT_WORK(&args->work, recv_work);
args->nbd = nbd;
args->index = i;
- queue_work(recv_workqueue, &args->work);
+ queue_work(nbd->recv_workq, &args->work);
}
nbd_size_update(nbd);
return error;
@@ -1215,8 +1227,10 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b
mutex_unlock(&nbd->config_lock);
ret = wait_event_interruptible(config->recv_wq,
atomic_read(&config->recv_threads) == 0);
- if (ret)
+ if (ret) {
sock_shutdown(nbd);
+ flush_workqueue(nbd->recv_workq);
+ }
mutex_lock(&nbd->config_lock);
nbd_bdev_reset(bdev);
/* user requested, ignore socket errors */
@@ -1875,6 +1889,12 @@ static void nbd_disconnect_and_put(struct nbd_device *nbd)
nbd_disconnect(nbd);
nbd_clear_sock(nbd);
mutex_unlock(&nbd->config_lock);
+ /*
+ * Make sure recv thread has finished, so it does not drop the last
+ * config ref and try to destroy the workqueue from inside the work
+ * queue.
+ */
+ flush_workqueue(nbd->recv_workq);
if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
&nbd->config->runtime_flags))
nbd_config_put(nbd);
@@ -2261,20 +2281,12 @@ static int __init nbd_init(void)
if (nbds_max > 1UL << (MINORBITS - part_shift))
return -EINVAL;
- recv_workqueue = alloc_workqueue("knbd-recv",
- WQ_MEM_RECLAIM | WQ_HIGHPRI |
- WQ_UNBOUND, 0);
- if (!recv_workqueue)
- return -ENOMEM;
- if (register_blkdev(NBD_MAJOR, "nbd")) {
- destroy_workqueue(recv_workqueue);
+ if (register_blkdev(NBD_MAJOR, "nbd"))
return -EIO;
- }
if (genl_register_family(&nbd_genl_family)) {
unregister_blkdev(NBD_MAJOR, "nbd");
- destroy_workqueue(recv_workqueue);
return -EINVAL;
}
nbd_dbg_init();
@@ -2316,7 +2328,6 @@ static void __exit nbd_cleanup(void)
idr_destroy(&nbd_index_idr);
genl_unregister_family(&nbd_genl_family);
- destroy_workqueue(recv_workqueue);
unregister_blkdev(NBD_MAJOR, "nbd");
}
--
2.20.1
The code like this:
ptr = kmalloc(size, GFP_KERNEL);
page = virt_to_page(ptr);
offset = offset_in_page(ptr);
kfree(page_address(page) + offset);
may produce false-positive invalid-free reports on the kernel with
CONFIG_KASAN_SW_TAGS=y.
In the example above we loose the original tag assigned to 'ptr',
so kfree() gets the pointer with 0xFF tag. In kfree() we check that
0xFF tag is different from the tag in shadow hence print false report.
Instead of just comparing tags, do the following:
1) Check that shadow doesn't contain KASAN_TAG_INVALID. Otherwise it's
double-free and it doesn't matter what tag the pointer have.
2) If pointer tag is different from 0xFF, make sure that tag in the shadow
is the same as in the pointer.
Fixes: 7f94ffbc4c6a ("kasan: add hooks implementation for tag-based mode")
Signed-off-by: Andrey Ryabinin <aryabinin(a)virtuozzo.com>
Reported-by: Walter Wu <walter-zh.wu(a)mediatek.com>
Reported-by: Mark Rutland <mark.rutland(a)arm.com>
Cc: <stable(a)vger.kernel.org>
---
mm/kasan/common.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/mm/kasan/common.c b/mm/kasan/common.c
index 895dc5e2b3d5..3b8cde0cb5b2 100644
--- a/mm/kasan/common.c
+++ b/mm/kasan/common.c
@@ -406,8 +406,14 @@ static inline bool shadow_invalid(u8 tag, s8 shadow_byte)
if (IS_ENABLED(CONFIG_KASAN_GENERIC))
return shadow_byte < 0 ||
shadow_byte >= KASAN_SHADOW_SCALE_SIZE;
- else
- return tag != (u8)shadow_byte;
+
+ /* else CONFIG_KASAN_SW_TAGS: */
+ if ((u8)shadow_byte == KASAN_TAG_INVALID)
+ return true;
+ if ((tag != KASAN_TAG_KERNEL) && (tag != (u8)shadow_byte))
+ return true;
+
+ return false;
}
static bool __kasan_slab_free(struct kmem_cache *cache, void *object,
--
2.21.0
pti_clone_pgtable() increases addr by PUD_SIZE for pud_none(*pud) case.
This is not accurate because addr may not be PUD_SIZE aligned.
In our x86_64 kernel, pti_clone_pgtable() fails to clone 7 PMDs because
of this issuse, including PMD for the irq entry table. For a memcache
like workload, this introduces about 4.5x more iTLB-load and about 2.5x
more iTLB-load-misses on a Skylake CPU.
This patch fixes this issue by adding PMD_SIZE to addr for pud_none()
case.
Cc: stable(a)vger.kernel.org # v4.19+
Fixes: 16a3fe634f6a ("x86/mm/pti: Clone kernel-image on PTE level for 32 bit")
Signed-off-by: Song Liu <songliubraving(a)fb.com>
Cc: Joerg Roedel <jroedel(a)suse.de>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Dave Hansen <dave.hansen(a)linux.intel.com>
Cc: Andy Lutomirski <luto(a)kernel.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
---
arch/x86/mm/pti.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
index b196524759ec..5a67c3015f59 100644
--- a/arch/x86/mm/pti.c
+++ b/arch/x86/mm/pti.c
@@ -330,7 +330,7 @@ pti_clone_pgtable(unsigned long start, unsigned long end,
pud = pud_offset(p4d, addr);
if (pud_none(*pud)) {
- addr += PUD_SIZE;
+ addr += PMD_SIZE;
continue;
}
--
2.17.1
From: Alastair D'Silva <alastair(a)d-silva.org>
Heads Up: This patch cannot be submitted to Linus's tree, as the affected
assembler functions have already been converted to C.
When calling flush_(inval_)dcache_range with a size >4GB, we were masking
off the upper 32 bits, so we would incorrectly flush a range smaller
than intended.
This patch replaces the 32 bit shifts with 64 bit ones, so that
the full size is accounted for.
Signed-off-by: Alastair D'Silva <alastair(a)d-silva.org>
---
arch/powerpc/kernel/misc_64.S | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
index 1ad4089dd110..d4d096f80f4b 100644
--- a/arch/powerpc/kernel/misc_64.S
+++ b/arch/powerpc/kernel/misc_64.S
@@ -130,7 +130,7 @@ _GLOBAL_TOC(flush_dcache_range)
subf r8,r6,r4 /* compute length */
add r8,r8,r5 /* ensure we get enough */
lwz r9,DCACHEL1LOGBLOCKSIZE(r10) /* Get log-2 of dcache block size */
- srw. r8,r8,r9 /* compute line count */
+ srd. r8,r8,r9 /* compute line count */
beqlr /* nothing to do? */
mtctr r8
0: dcbst 0,r6
@@ -148,7 +148,7 @@ _GLOBAL(flush_inval_dcache_range)
subf r8,r6,r4 /* compute length */
add r8,r8,r5 /* ensure we get enough */
lwz r9,DCACHEL1LOGBLOCKSIZE(r10)/* Get log-2 of dcache block size */
- srw. r8,r8,r9 /* compute line count */
+ srd. r8,r8,r9 /* compute line count */
beqlr /* nothing to do? */
sync
isync
--
2.21.0
Hi,
please consider applying the following two patches from v4.9.y to v4.4.y.
fe5844365ec6 ("Backport minimal compiler_attributes.h to support GCC 9")
2c34c215c102 ("include/linux/module.h: copy __init/__exit attrs to init/cleanup_module")
(upstream commit a6e60d84989f)
... to enable compiling v4.4.y with gcc 9.x.
This already works for the most part, but alpha:allmodconfig and
arm:allmodconfig fail to compile. The above two patches fix the problem.
Thanks,
Guenter
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b6143d10d23ebb4a77af311e8b8b7f019d0163e6 Mon Sep 17 00:00:00 2001
From: Will Deacon <will(a)kernel.org>
Date: Fri, 16 Aug 2019 14:57:43 +0100
Subject: [PATCH] arm64: ftrace: Ensure module ftrace trampoline is coherent
with I-side
The initial support for dynamic ftrace trampolines in modules made use
of an indirect branch which loaded its target from the beginning of
a special section (e71a4e1bebaf7 ("arm64: ftrace: add support for far
branches to dynamic ftrace")). Since no instructions were being patched,
no cache maintenance was needed. However, later in be0f272bfc83 ("arm64:
ftrace: emit ftrace-mod.o contents through code") this code was reworked
to output the trampoline instructions directly into the PLT entry but,
unfortunately, the necessary cache maintenance was overlooked.
Add a call to __flush_icache_range() after writing the new trampoline
instructions but before patching in the branch to the trampoline.
Cc: Ard Biesheuvel <ard.biesheuvel(a)linaro.org>
Cc: James Morse <james.morse(a)arm.com>
Cc: <stable(a)vger.kernel.org>
Fixes: be0f272bfc83 ("arm64: ftrace: emit ftrace-mod.o contents through code")
Signed-off-by: Will Deacon <will(a)kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com>
diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c
index 1285c7b2947f..171773257974 100644
--- a/arch/arm64/kernel/ftrace.c
+++ b/arch/arm64/kernel/ftrace.c
@@ -73,7 +73,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
if (offset < -SZ_128M || offset >= SZ_128M) {
#ifdef CONFIG_ARM64_MODULE_PLTS
- struct plt_entry trampoline;
+ struct plt_entry trampoline, *dst;
struct module *mod;
/*
@@ -106,23 +106,27 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
* to check if the actual opcodes are in fact identical,
* regardless of the offset in memory so use memcmp() instead.
*/
- trampoline = get_plt_entry(addr, mod->arch.ftrace_trampoline);
- if (memcmp(mod->arch.ftrace_trampoline, &trampoline,
- sizeof(trampoline))) {
- if (plt_entry_is_initialized(mod->arch.ftrace_trampoline)) {
+ dst = mod->arch.ftrace_trampoline;
+ trampoline = get_plt_entry(addr, dst);
+ if (memcmp(dst, &trampoline, sizeof(trampoline))) {
+ if (plt_entry_is_initialized(dst)) {
pr_err("ftrace: far branches to multiple entry points unsupported inside a single module\n");
return -EINVAL;
}
/* point the trampoline to our ftrace entry point */
module_disable_ro(mod);
- *mod->arch.ftrace_trampoline = trampoline;
+ *dst = trampoline;
module_enable_ro(mod, true);
- /* update trampoline before patching in the branch */
- smp_wmb();
+ /*
+ * Ensure updated trampoline is visible to instruction
+ * fetch before we patch in the branch.
+ */
+ __flush_icache_range((unsigned long)&dst[0],
+ (unsigned long)&dst[1]);
}
- addr = (unsigned long)(void *)mod->arch.ftrace_trampoline;
+ addr = (unsigned long)dst;
#else /* CONFIG_ARM64_MODULE_PLTS */
return -EINVAL;
#endif /* CONFIG_ARM64_MODULE_PLTS */
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 849adec41203ac5837c40c2d7e08490ffdef3c2c Mon Sep 17 00:00:00 2001
From: Will Deacon <will(a)kernel.org>
Date: Mon, 29 Jul 2019 11:06:17 +0100
Subject: [PATCH] arm64: compat: Allow single-byte watchpoints on all addresses
Commit d968d2b801d8 ("ARM: 7497/1: hw_breakpoint: allow single-byte
watchpoints on all addresses") changed the validation requirements for
hardware watchpoints on arch/arm/. Update our compat layer to implement
the same relaxation.
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Will Deacon <will(a)kernel.org>
diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c
index dceb84520948..67b3bae50b92 100644
--- a/arch/arm64/kernel/hw_breakpoint.c
+++ b/arch/arm64/kernel/hw_breakpoint.c
@@ -536,13 +536,14 @@ int hw_breakpoint_arch_parse(struct perf_event *bp,
/* Aligned */
break;
case 1:
- /* Allow single byte watchpoint. */
- if (hw->ctrl.len == ARM_BREAKPOINT_LEN_1)
- break;
case 2:
/* Allow halfword watchpoints and breakpoints. */
if (hw->ctrl.len == ARM_BREAKPOINT_LEN_2)
break;
+ case 3:
+ /* Allow single byte watchpoint. */
+ if (hw->ctrl.len == ARM_BREAKPOINT_LEN_1)
+ break;
default:
return -EINVAL;
}
Hi
In Debian bug https://bugs.debian.org/934331 ran into issues which
match the upstream commit bcb44433bba5 ("dm: disable DISCARD if the
underlying storage no longer supports it").
This commit was CC'ed to stable, but only got applied in v5.0.8 (and
later on backported by Ben Hutchings to v3.16.72).
Mike, I have not checked how easily that would be for older stable
versions, but can the backport be considered for versions down to 4.9?
Apparently Ben did succeed with some changes needed. To 4.19 it should
apply with a small conflict in drivers/md/dm-core.h AFAICS.
Regards,
Salvatore
I searched through https://github.com/Xilinx/linux-xlnx/tree/xlnx_rebase_v4.9
for commits that got backported from mainline, and categorized them
to see if we want them in an LTS kernel.
Most of the contents are specific to xilinx hardware, but some changes are for
generic drivers.
These commits look like we should have them in the LTS kernel, and
they apply cleanly:
d86c5a676e5b ("usb: dwc3: gadget: always try to prepare on
started_list first")
63b7c83ebea0 ("microblaze: Fix return value from xilinx_timer_init")
7181e5590e5b ("microblaze: Add missing syscalls")
8ee80500ad78 ("microblaze: Add missing release version code v9.6 and v10")
3400606d8ffd ("microblaze: Add new fpga families")
26b54be568ad ("PCI: xilinx-nwl: Remove mask for messages not
supported by AXI")
acf6ef1d6c96 ("i2c: mux: pca954x: Export OF device ID table as
module aliases")
dbe4d69d252e ("i2c: mux: pca954x: Add missing pca9546 definition to
chip_desc")
360a3a90c626 ("[media] uvcvideo: Fix empty packet statistic")
a753499d4360 ("microblaze: mm: Flush TLB to ensure correct mapping
when higmem ON")
faf154cd49ba ("microblaze: Separate GP registers from MSR handling")
14ef905bb2ee ("microblaze: Fix MSR flags when returning from exception")
8064c616984e ("i2c: cadance: fix ctrl/addr reg write order")
48767fd8982d ("spi: cadence: change sequence of calling runtime_enable")
802740890c42 ("spi: cadence: Add support for context loss")
e11de4de28c0 ("gpio: zynq: Add support for suspend resume")
a5685781dfe9 ("cpufreq: dt: Add zynqmp to the cpufreq dt platdev")
5c8f124893c4 ("mfd: Kconfig: Add missing Kconfig dependency for TPS65086")
d15c56cad0e6 ("arm64: dts: xilinx: fix PCI bus dtc warnings")
17e76f95a4be ("arm64: zynqmp: Add dcc console for zynqmp")
8c50b1e435d1 ("arm64: zynqmp: Add CCI-400 node")
e199f2cc1e55 ("arm64: zynqmp: Correct IRQ nr for the SMMU")
db202f4d5c24 ("watchdog: cadence_wdt: Enable access to module parameters")
3df3e41c3152 ("video: fbdev: Enable Xilinx FB for ZynqMP")
1d67243a8e77 ("tty: xilinx_uartps: move to arch_initcall for earlier console")
3c48d62de237 ("dmaengine: zynqmp_dma: Fix warning variable 'val' set
but not used")
8d90035e379c ("dmaengine: zynqmp_dma: Fix issues with overflow interrupt")
23059408b6a3 ("dmaengine: xilinx_dma: Fix race condition in the
driver for multiple descriptor scenario")
48c62fb051af ("dmaengine: xilinx_dma: properly configure the SG mode
bit in the driver for cdma")
4b597c634a2a ("dmaengine: xilinx_dma: Fix warning variable prev set
but not used")
1fd4c45d6cd3 ("usb: gadget: udc-xilinx: remove redundant pointer udc")
These look useful, but require a backport to apply:
06aa09081d44 ("gpio: zynq: Provided workaround for GPIO")
6e037fb77086 ("ata: ceva: Correct the AXI bus configuration for SATA ports")
f8251f1dfda9 ("i2c: mux: pca954x: Add missing pca9542 definition to chip_desc")
25cd9721c2b1 ("usb: gadget: f_hid: fix: Don't access hidg->req without
spinlock held")
51218298a25e ("alarmtimer: Ensure RTC module is not unloaded")
These seem harmless but not necessary for stable backports, they could easily
get applied if there is a reason for them:
99c494077e2d ("idr: add ida_is_empty")
f59d4418c420 ("[media] media: adv7604: fix bindings inconsistency for
default-input")
6ab1a322dcaf ("[media] vivid: Enable 4k resolution for webcam capture device")
10eeb5e645b5 ("net: xilinx: constify net_device_ops structure")
e0d4fa5f7a50 ("microblaze: Update defconfigs")
17f4977ccd2b ("microblaze: Enabling CONFIGS related to MTD")
e16f1ad442e2 ("microblaze: Enabling CONFIG_BRIDGE in mmu_defconfig")
3638bd4a066c ("gpio: zynq: Clarify quirk and provide helper function")
9a181e1093af ("PCI: xilinx-nwl: Modify IRQ chip for legacy interrupts")
fdc71ce97c13 ("PCI: xilinx: Make of_device_ids const")
011e29e7d93d ("watchdog: cadence_wdt: make of_device_ids const.")
ce0d37614083 ("iio: adc: xadc: Fix coding style violations")
ef2b56df5a8a ("char: xilinx_hwicap: Fix kernel doc warnings")
4cb4142ba02c ("pinctrl: zynq: Fix kernel doc warnings")
6c2c9bd27cc5 ("pinctrl: zynq: Fix warnings in the driver")
6ae5104cbaa5 ("gpio: zynq: Fix kernel doc warnings")
2717cfcaf564 ("gpio: zynq: Fix warnings in the driver")
b09034892210 ("arm: zynq: Add adv7511 on i2c bus for zc70x")
e5e6f6872c7a ("arm: zynq: Add device-type property for zynq ethernet phy nodes")
3c220bf42090 ("arm: zynq: Label whole PL part as fpga_full region")
1188c024f216 ("arm: zynq: Use C pre-processor for includes in dts")
21ad06cc9e63 ("arm: zynq: Remove earlycon from bootargs")
26db4d8bc7cb ("arm64: zynqmp: Remove leading 0s from mtd table for spi flashes")
63301178e9a9 ("arm64: zynqmp: Move nodes which have no reg property out of bus")
400e188fa895 ("arm64: zynqmp: Add references to cpu nodes")
1e4e25c8ae8f ("arm64: zynqmp: Add idle state for ZynqMP")
e31b7bb8e21e ("arm64: zynqmp: Add operating points")
4a6514d523b5 ("arm64: zynqmp: Adding prefetchable memory space to pcie node")
7fb7820c579b ("arm64: zynqmp: Add support for RTC")
27af3993f77d ("arm64: zynqmp: Add new uartps compatible string")
2f9ed1999a41 ("arm64: zynqmp: Set status disabled in dtsi")
932bd0d8dbe8 ("arm64: zynqmp: Add fpd/lpd dmas")
e881e58709a7 ("arm64: zynqmp: Use C pre-processor for includes")
05e0bd10a9ee ("arm64: zynqmp: Added clocks to DT for ep108")
142574873e2b ("arm64: zynqmp: Enable can1 for ep108")
0286f3ea26a4 ("arm64: zynqmp: Add missing mmc aliases in ep108")
b6bc41645547 ("watchdog: of_xilinx_wdt: Add support for reading freq via CCF")
6f671c6b6288 ("watchdog: of_xilinx_wdt: Add suspend/resume support")
c7a03599b58f ("dmaengine: xilinx_dma: Differentiate probe based on the ip type")
025ba1841e5d ("ARM: dts: zynq: Add mmc alias for zc702/zc706/zed/zybo")
e7abd89466df ("arm64: dts: zynqmp: Add DDRC node")
c2df3de0d07e ("gpio: zynq: properly support runtime PM for GPIO used
as interrupts")
d2920ef5d094 ("dt-bindings: spi: Add device tree binding documentation
for Zynq QSPI controller")
67dca5e580f1 ("spi: spi-mem: Add support for Zynq QSPI controller")
And finally, these were backported into the xilinx tree, but are clearly not
material for an lts kernel.
0f57dc6ae1ff ("remoteproc: Keep local copy of firmware name")
2aefbef04149 ("remoteproc: Add a sysfs interface for firmware and state")
2bfc311a57f5 ("remoteproc: Drop wait in __rproc_boot()")
dbf499cf720a ("usb: gadget: f_hid add super speed support")
39a842e22c1b ("of/overlay: add of overlay notifications")
9dce0287a60d ("fpga: add method to get fpga manager from device")
40e83578fd1e ("doc: fpga-mgr: add fpga image info to api")
a33ddf80b67a ("fpga: add bindings document for fpga region")
1df2865f8dd9 ("fpga-mgr: add fpga image information struct")
12e2508213ac ("add sysfs document for fpga bridge class")
21aeda950c5f ("fpga: add fpga bridge framework")
0fa20cdfcc1f ("fpga: fpga-region: device tree control for FPGA")
1930c2865108 ("fpga zynq: Add missing \n to messages")
80baf649c277 ("fpga zynq: Remove priv->dev")
340c0c53ea30 ("fpga zynq: Fix incorrect ISR state on bootup")
7fe91fccc49f ("ARM: zynq: Remove skeleton.dtsi")
da457d57594b ("ARM: zynq: Fix W=1 dtc 1.4 warnings")
5935a2b3a57c ("serial: xuartps: Enable uart loopback mode")
6f05afcbb031 ("scripts/dtc: Update to upstream version 0931cea3ba20")
608d792192d7 ("remoteproc: Add RPROC_DELETED state")
7a20c64ddb3d ("remoteproc: Reduce asynchronous request_firmware to
auto-boot only")
f2114795f721 ("i2c: mux: pca954x: Add interrupt controller support")
ae3696c167cc ("net: macb: fix phy interrupt parsing")
52276df0b1ce ("[media] uvcvideo: Don't record timespec_sub")
89d123106a97 ("scripts/dtc: Update to upstream version v1.4.4-8-g756ffc4f52f6")
d62100f1aac2 ("serial: xilinx_uartps: Add pm runtime support")
81e33b51ed69 ("serial: xuartps: Cleanup the clock enable")
ecfc5771ef06 ("serial: xuartps: Enable clocks in the pm disable case also")
d653c43aefed ("serial: xilinx_uartps: Fix the error path")
094094a9373f ("serial: uartps: Fix kernel doc warnings")
f3a7f6f67fc7 ("watchdog: cadence_wdt: Show information when driver is probed")
00a0af9a6b04 ("video: fbdev: Fix multiple style issues in xilinxfb")
9053f4b9855c ("devicetree: bindings: Add sata port phy config
parameters in ahci-ceva")
fe8365bbf8ac ("ata: ceva: Move sata port phy oob settings to device-tree")
e8fc8b858cd8 ("ata: ceva: Add gen 3 mode support in driver")
ff0d63778ca0 ("ata: ceva: Disable Device Sleep capability")
05e890d84386 ("ata: ceva: Make RxWaterMark value as module parameter")
3bc867de85b5 ("ata: ceva: Add CCI support for SATA if CCI is enabled")
26bf3b6658a2 ("ata: ceva: Correct the suspend and resume logic for SATA")
f0a559aae57c ("ata: ceva: Add SMMU support for SATA IP")
b2b60bcc7d09 ("media: imx274: device tree binding file")
64c6f7da8c2c ("dmaengine: zynqmp_dma: Add runtime pm support")
30df4574e432 ("dmaengine: zynqmp_dma: Fix kernel doc-format")
49a83f002731 ("net: emaclite: Fix block comments style")
da7bf20e7758 ("tty: serial: uartlite: Add structure for private data")
14288befeb57 ("tty: serial: uartlite: Add clock adaptation")
a3a10614ca0f ("tty: serial: uartlite: Add support for suspend and resume")
From: Arnd Bergmann <arnd(a)arndb.de>
[ Upstream commit 5d6fb560729a5d5554e23db8d00eb57cd0021083 ]
clang-9 points out that there are two variables that depending on the
configuration may only be used in an ARRAY_SIZE() expression but not
referenced:
drivers/dma/ste_dma40.c:145:12: error: variable 'd40_backup_regs' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
static u32 d40_backup_regs[] = {
^
drivers/dma/ste_dma40.c:214:12: error: variable 'd40_backup_regs_chan' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
static u32 d40_backup_regs_chan[] = {
Mark these __maybe_unused to shut up the warning.
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
Reviewed-by: Nathan Chancellor <natechancellor(a)gmail.com>
Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org>
Link: https://lore.kernel.org/r/20190712091357.744515-1-arnd@arndb.de
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/dma/ste_dma40.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index dd3e7ba273ad0..0fede051f4e1c 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -142,7 +142,7 @@ enum d40_events {
* when the DMA hw is powered off.
* TODO: Add save/restore of D40_DREG_GCC on dma40 v3 or later, if that works.
*/
-static u32 d40_backup_regs[] = {
+static __maybe_unused u32 d40_backup_regs[] = {
D40_DREG_LCPA,
D40_DREG_LCLA,
D40_DREG_PRMSE,
@@ -211,7 +211,7 @@ static u32 d40_backup_regs_v4b[] = {
#define BACKUP_REGS_SZ_V4B ARRAY_SIZE(d40_backup_regs_v4b)
-static u32 d40_backup_regs_chan[] = {
+static __maybe_unused u32 d40_backup_regs_chan[] = {
D40_CHAN_REG_SSCFG,
D40_CHAN_REG_SSELT,
D40_CHAN_REG_SSPTR,
--
2.20.1
From: Arnd Bergmann <arnd(a)arndb.de>
[ Upstream commit 5d6fb560729a5d5554e23db8d00eb57cd0021083 ]
clang-9 points out that there are two variables that depending on the
configuration may only be used in an ARRAY_SIZE() expression but not
referenced:
drivers/dma/ste_dma40.c:145:12: error: variable 'd40_backup_regs' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
static u32 d40_backup_regs[] = {
^
drivers/dma/ste_dma40.c:214:12: error: variable 'd40_backup_regs_chan' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
static u32 d40_backup_regs_chan[] = {
Mark these __maybe_unused to shut up the warning.
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
Reviewed-by: Nathan Chancellor <natechancellor(a)gmail.com>
Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org>
Link: https://lore.kernel.org/r/20190712091357.744515-1-arnd@arndb.de
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/dma/ste_dma40.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index 8684d11b29bba..68b41daab3a8f 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -142,7 +142,7 @@ enum d40_events {
* when the DMA hw is powered off.
* TODO: Add save/restore of D40_DREG_GCC on dma40 v3 or later, if that works.
*/
-static u32 d40_backup_regs[] = {
+static __maybe_unused u32 d40_backup_regs[] = {
D40_DREG_LCPA,
D40_DREG_LCLA,
D40_DREG_PRMSE,
@@ -211,7 +211,7 @@ static u32 d40_backup_regs_v4b[] = {
#define BACKUP_REGS_SZ_V4B ARRAY_SIZE(d40_backup_regs_v4b)
-static u32 d40_backup_regs_chan[] = {
+static __maybe_unused u32 d40_backup_regs_chan[] = {
D40_CHAN_REG_SSCFG,
D40_CHAN_REG_SSELT,
D40_CHAN_REG_SSPTR,
--
2.20.1
From: Arnd Bergmann <arnd(a)arndb.de>
[ Upstream commit 5d6fb560729a5d5554e23db8d00eb57cd0021083 ]
clang-9 points out that there are two variables that depending on the
configuration may only be used in an ARRAY_SIZE() expression but not
referenced:
drivers/dma/ste_dma40.c:145:12: error: variable 'd40_backup_regs' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
static u32 d40_backup_regs[] = {
^
drivers/dma/ste_dma40.c:214:12: error: variable 'd40_backup_regs_chan' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
static u32 d40_backup_regs_chan[] = {
Mark these __maybe_unused to shut up the warning.
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
Reviewed-by: Nathan Chancellor <natechancellor(a)gmail.com>
Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org>
Link: https://lore.kernel.org/r/20190712091357.744515-1-arnd@arndb.de
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/dma/ste_dma40.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index c2b089af04208..90feb6a05e59b 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -142,7 +142,7 @@ enum d40_events {
* when the DMA hw is powered off.
* TODO: Add save/restore of D40_DREG_GCC on dma40 v3 or later, if that works.
*/
-static u32 d40_backup_regs[] = {
+static __maybe_unused u32 d40_backup_regs[] = {
D40_DREG_LCPA,
D40_DREG_LCLA,
D40_DREG_PRMSE,
@@ -211,7 +211,7 @@ static u32 d40_backup_regs_v4b[] = {
#define BACKUP_REGS_SZ_V4B ARRAY_SIZE(d40_backup_regs_v4b)
-static u32 d40_backup_regs_chan[] = {
+static __maybe_unused u32 d40_backup_regs_chan[] = {
D40_CHAN_REG_SSCFG,
D40_CHAN_REG_SSELT,
D40_CHAN_REG_SSPTR,
--
2.20.1
Denis Andzakovic discovered a potential use-after-free in older kernel
versions, using syzkaller. tcp_write_queue_purge() frees all skbs in
the TCP write queue and can leave sk->sk_send_head pointing to freed
memory. tcp_disconnect() clears that pointer after calling
tcp_write_queue_purge(), but tcp_connect() does not. It is
(surprisingly) possible to add to the write queue between
disconnection and reconnection, so this needs to be done in both
places.
This bug was introduced by backports of commit 7f582b248d0a ("tcp:
purge write queue in tcp_connect_init()") and does not exist upstream
because of earlier changes in commit 75c119afe14f ("tcp: implement
rb-tree based retransmit queue"). The latter is a major change that's
not suitable for stable.
Reported-by: Denis Andzakovic <denis.andzakovic(a)pulsesecurity.co.nz>
Bisected-by: Salvatore Bonaccorso <carnil(a)debian.org>
Fixes: 7f582b248d0a ("tcp: purge write queue in tcp_connect_init()")
Cc: <stable(a)vger.kernel.org> # before 4.15
Cc: Eric Dumazet <edumazet(a)google.com>
Signed-off-by: Ben Hutchings <ben(a)decadent.org.uk>
---
include/net/tcp.h | 3 +++
1 file changed, 3 insertions(+)
diff --git a/include/net/tcp.h b/include/net/tcp.h
index fed2a78fb8cb..f9b985d4d779 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1517,6 +1517,8 @@ struct tcp_fastopen_context {
struct rcu_head rcu;
};
+static inline void tcp_init_send_head(struct sock *sk);
+
/* write queue abstraction */
static inline void tcp_write_queue_purge(struct sock *sk)
{
@@ -1524,6 +1526,7 @@ static inline void tcp_write_queue_purge(struct sock *sk)
while ((skb = __skb_dequeue(&sk->sk_write_queue)) != NULL)
sk_wmem_free_skb(sk, skb);
+ tcp_init_send_head(sk);
sk_mem_reclaim(sk);
tcp_clear_all_retrans_hints(tcp_sk(sk));
inet_csk(sk)->icsk_backoff = 0;
THP splitting path is missing the split_page_owner() call that split_page()
has. As a result, split THP pages are wrongly reported in the page_owner file
as order-9 pages. Furthermore when the former head page is freed, the remaining
former tail pages are not listed in the page_owner file at all. This patch
fixes that by adding the split_page_owner() call into __split_huge_page().
Fixes: a9627bc5e34e ("mm/page_owner: introduce split_page_owner and replace manual handling")
Reported-by: Kirill A. Shutemov <kirill(a)shutemov.name>
Cc: stable(a)vger.kernel.org
Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz>
---
mm/huge_memory.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 738065f765ab..de1f15969e27 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -32,6 +32,7 @@
#include <linux/shmem_fs.h>
#include <linux/oom.h>
#include <linux/numa.h>
+#include <linux/page_owner.h>
#include <asm/tlb.h>
#include <asm/pgalloc.h>
@@ -2516,6 +2517,9 @@ static void __split_huge_page(struct page *page, struct list_head *list,
}
ClearPageCompound(head);
+
+ split_page_owner(head, HPAGE_PMD_ORDER);
+
/* See comment in __split_huge_page_tail() */
if (PageAnon(head)) {
/* Additional pin to swap cache */
--
2.22.0
From: Ding Xiang <dingxiang(a)cmss.chinamobile.com>
In the error path of stm_source_register_device(), the kfree is
unnecessary, as the put_device() before it ends up calling
stm_source_device_release() to free stm_source_device, leading to
a double free at the outer kfree() call. Remove it.
Signed-off-by: Ding Xiang <dingxiang(a)cmss.chinamobile.com>
Signed-off-by: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Fixes: 7bd1d4093c2fa ("stm class: Introduce an abstraction for System Trace Module devices")
Link: https://lore.kernel.org/linux-arm-kernel/1563354988-23826-1-git-send-email-…
Cc: stable(a)vger.kernel.org # v4.4+
---
drivers/hwtracing/stm/core.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index e55b902560de..181e7ff1ec4f 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -1276,7 +1276,6 @@ int stm_source_register_device(struct device *parent,
err:
put_device(&src->dev);
- kfree(src);
return err;
}
--
2.23.0.rc1
From: Gao Xiang <gaoxiang25(a)huawei.com>
Richard observed a forever loop of erofs_read_raw_page() [1]
which can be generated by forcely setting ->u.i_blkaddr
to 0xdeadbeef (as my understanding block layer can
handle access beyond end of device correctly).
After digging into that, it seems the problem is highly
related with directories and then I found the root cause
is an improper error handling in erofs_readdir().
Let's fix it now.
[1] https://lore.kernel.org/r/1746679415.68815.1566076790942.JavaMail.zimbra@no…
Reported-by: Richard Weinberger <richard(a)nod.at>
Fixes: 3aa8ec716e52 ("staging: erofs: add directory operations")
Cc: <stable(a)vger.kernel.org> # 4.19+
Signed-off-by: Gao Xiang <gaoxiang25(a)huawei.com>
---
Which is based on the following patch as well
https://lore.kernel.org/r/20190816071142.8633-1-gaoxiang25@huawei.com/
and
https://lore.kernel.org/r/20190817082313.21040-1-hsiangkao@aol.com/
can still be properly applied after this patch.
drivers/staging/erofs/dir.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/erofs/dir.c b/drivers/staging/erofs/dir.c
index 5f38382637e6..f2d7539589e4 100644
--- a/drivers/staging/erofs/dir.c
+++ b/drivers/staging/erofs/dir.c
@@ -82,8 +82,12 @@ static int erofs_readdir(struct file *f, struct dir_context *ctx)
unsigned int nameoff, maxsize;
dentry_page = read_mapping_page(mapping, i, NULL);
- if (IS_ERR(dentry_page))
- continue;
+ if (IS_ERR(dentry_page)) {
+ errln("fail to readdir of logical block %u of nid %llu",
+ i, EROFS_V(dir)->nid);
+ err = PTR_ERR(dentry_page);
+ break;
+ }
de = (struct erofs_dirent *)kmap(dentry_page);
--
2.17.1
After _gadget_stop_activity is executed, we can consider the hardware
operation for gadget has finished, and the udc can be stopped and enter
low power mode. So, any later hardware operations (from usb_ep_ops APIs
or usb_gadget_ops APIs) should be considered invalid, any deinitializatons
has been covered at _gadget_stop_activity.
I meet this problem when I plug out usb cable from PC using mass_storage
gadget, my callstack like: vbus interrupt->.vbus_session->
composite_disconnect ->pm_runtime_put_sync(&_gadget->dev),
the composite_disconnect will call fsg_disable, but fsg_disable calls
usb_ep_disable using async way, there are register accesses for
usb_ep_disable. So sometimes, I get system hang due to visit register
without clock, sometimes not.
The Linux Kernel USB maintainer Alan Stern suggests this kinds of solution.
See: http://marc.info/?l=linux-usb&m=138541769810983&w=2.
Cc: <stable(a)vger.kernel.org> #v4.9+
Signed-off-by: Peter Chen <peter.chen(a)nxp.com>
---
This patch is at NXP internal tree long time, and no issues have found.
Submit to mainline kenrel.
drivers/usb/chipidea/udc.c | 32 ++++++++++++++++++++++++--------
1 file changed, 24 insertions(+), 8 deletions(-)
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 053432d79bf7..8f18e7b6cadf 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -709,12 +709,6 @@ static int _gadget_stop_activity(struct usb_gadget *gadget)
struct ci_hdrc *ci = container_of(gadget, struct ci_hdrc, gadget);
unsigned long flags;
- spin_lock_irqsave(&ci->lock, flags);
- ci->gadget.speed = USB_SPEED_UNKNOWN;
- ci->remote_wakeup = 0;
- ci->suspended = 0;
- spin_unlock_irqrestore(&ci->lock, flags);
-
/* flush all endpoints */
gadget_for_each_ep(ep, gadget) {
usb_ep_fifo_flush(ep);
@@ -732,6 +726,12 @@ static int _gadget_stop_activity(struct usb_gadget *gadget)
ci->status = NULL;
}
+ spin_lock_irqsave(&ci->lock, flags);
+ ci->gadget.speed = USB_SPEED_UNKNOWN;
+ ci->remote_wakeup = 0;
+ ci->suspended = 0;
+ spin_unlock_irqrestore(&ci->lock, flags);
+
return 0;
}
@@ -1303,6 +1303,10 @@ static int ep_disable(struct usb_ep *ep)
return -EBUSY;
spin_lock_irqsave(hwep->lock, flags);
+ if (hwep->ci->gadget.speed == USB_SPEED_UNKNOWN) {
+ spin_unlock_irqrestore(hwep->lock, flags);
+ return 0;
+ }
/* only internal SW should disable ctrl endpts */
@@ -1392,6 +1396,10 @@ static int ep_queue(struct usb_ep *ep, struct usb_request *req,
return -EINVAL;
spin_lock_irqsave(hwep->lock, flags);
+ if (hwep->ci->gadget.speed == USB_SPEED_UNKNOWN) {
+ spin_unlock_irqrestore(hwep->lock, flags);
+ return 0;
+ }
retval = _ep_queue(ep, req, gfp_flags);
spin_unlock_irqrestore(hwep->lock, flags);
return retval;
@@ -1415,8 +1423,8 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
return -EINVAL;
spin_lock_irqsave(hwep->lock, flags);
-
- hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
+ if (hwep->ci->gadget.speed != USB_SPEED_UNKNOWN)
+ hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
list_for_each_entry_safe(node, tmpnode, &hwreq->tds, td) {
dma_pool_free(hwep->td_pool, node->ptr, node->dma);
@@ -1487,6 +1495,10 @@ static void ep_fifo_flush(struct usb_ep *ep)
}
spin_lock_irqsave(hwep->lock, flags);
+ if (hwep->ci->gadget.speed == USB_SPEED_UNKNOWN) {
+ spin_unlock_irqrestore(hwep->lock, flags);
+ return;
+ }
hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
@@ -1559,6 +1571,10 @@ static int ci_udc_wakeup(struct usb_gadget *_gadget)
int ret = 0;
spin_lock_irqsave(&ci->lock, flags);
+ if (ci->gadget.speed == USB_SPEED_UNKNOWN) {
+ spin_unlock_irqrestore(&ci->lock, flags);
+ return 0;
+ }
if (!ci->remote_wakeup) {
ret = -EOPNOTSUPP;
goto out;
--
2.17.1
Fix a regression introduced by upstream commit fee109901f39
('signal/drbd: Use send_sig not force_sig').
Currently, when a thread is initialized, all signals are set to be
ignored by default. DRBD uses SIGHUP to end its threads, which means it
is now no longer possible to bring down a DRBD resource because the
signals do not make it through to the thread in question.
This circumstance was previously hidden by the fact that DRBD used
force_sig() to kill its threads. The aforementioned upstream commit
changed this to send_sig(), which means the effects of the signals being
ignored by default are now becoming visible.
Thus, issue an allow_signal() at the start of the thread to explicitly
allow the desired signals.
Signed-off-by: Christoph Böhmwalder <christoph.boehmwalder(a)linbit.com>
Signed-off-by: Philipp Reisner <philipp.reisner(a)linbit.com>
Fixes: fee109901f39 ("signal/drbd: Use send_sig not force_sig")
Cc: stable(a)vger.kernel.org
---
drivers/block/drbd/drbd_main.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 9bd4ddd12b25..b8b986df6814 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -318,6 +318,9 @@ static int drbd_thread_setup(void *arg)
unsigned long flags;
int retval;
+ allow_signal(DRBD_SIGKILL);
+ allow_signal(SIGXCPU);
+
snprintf(current->comm, sizeof(current->comm), "drbd_%c_%s",
thi->name[0],
resource->name);
--
2.22.0
Similar to vmstats, percpu caching of local vmevents leads to an
accumulation of errors on non-leaf levels. This happens because some
leftovers may remain in percpu caches, so that they are never propagated
up by the cgroup tree and just disappear into nonexistence with on
releasing of the memory cgroup.
To fix this issue let's accumulate and propagate percpu vmevents values
before releasing the memory cgroup similar to what we're doing with
vmstats.
Since on cpu hotplug we do flush percpu vmstats anyway, we can iterate
only over online cpus.
Fixes: 42a300353577 ("mm: memcontrol: fix recursive statistics correctness & scalabilty")
Signed-off-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
---
mm/memcontrol.c | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 818165d8de3f..f98c5293adae 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3418,6 +3418,25 @@ static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg)
}
}
+static void memcg_flush_percpu_vmevents(struct mem_cgroup *memcg)
+{
+ unsigned long events[NR_VM_EVENT_ITEMS];
+ struct mem_cgroup *mi;
+ int cpu, i;
+
+ for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
+ events[i] = 0;
+
+ for_each_online_cpu(cpu)
+ for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
+ events[i] += raw_cpu_read(
+ memcg->vmstats_percpu->events[i]);
+
+ for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
+ for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
+ atomic_long_add(events[i], &mi->vmevents[i]);
+}
+
#ifdef CONFIG_MEMCG_KMEM
static int memcg_online_kmem(struct mem_cgroup *memcg)
{
@@ -4841,10 +4860,11 @@ static void __mem_cgroup_free(struct mem_cgroup *memcg)
int node;
/*
- * Flush percpu vmstats to guarantee the value correctness
+ * Flush percpu vmstats and vmevents to guarantee the value correctness
* on parent's and all ancestor levels.
*/
memcg_flush_percpu_vmstats(memcg);
+ memcg_flush_percpu_vmevents(memcg);
for_each_node(node)
free_mem_cgroup_per_node_info(memcg, node);
free_percpu(memcg->vmstats_percpu);
--
2.21.0
Percpu caching of local vmstats with the conditional propagation by the
cgroup tree leads to an accumulation of errors on non-leaf levels.
Let's imagine two nested memory cgroups A and A/B. Say, a process
belonging to A/B allocates 100 pagecache pages on the CPU 0. The percpu
cache will spill 3 times, so that 32*3=96 pages will be accounted to A/B
and A atomic vmstat counters, 4 pages will remain in the percpu cache.
Imagine A/B is nearby memory.max, so that every following allocation
triggers a direct reclaim on the local CPU. Say, each such attempt will
free 16 pages on a new cpu. That means every percpu cache will have -16
pages, except the first one, which will have 4 - 16 = -12. A/B and A
atomic counters will not be touched at all.
Now a user removes A/B. All percpu caches are freed and corresponding
vmstat numbers are forgotten. A has 96 pages more than expected.
As memory cgroups are created and destroyed, errors do accumulate. Even
1-2 pages differences can accumulate into large numbers.
To fix this issue let's accumulate and propagate percpu vmstat values
before releasing the memory cgroup. At this point these numbers are
stable and cannot be changed.
Since on cpu hotplug we do flush percpu vmstats anyway, we can iterate
only over online cpus.
Fixes: 42a300353577 ("mm: memcontrol: fix recursive statistics correctness & scalabilty")
Signed-off-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
---
mm/memcontrol.c | 40 ++++++++++++++++++++++++++++++++++++++++
1 file changed, 40 insertions(+)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 3e821f34399f..818165d8de3f 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3383,6 +3383,41 @@ static u64 mem_cgroup_read_u64(struct cgroup_subsys_state *css,
}
}
+static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg)
+{
+ unsigned long stat[MEMCG_NR_STAT];
+ struct mem_cgroup *mi;
+ int node, cpu, i;
+
+ for (i = 0; i < MEMCG_NR_STAT; i++)
+ stat[i] = 0;
+
+ for_each_online_cpu(cpu)
+ for (i = 0; i < MEMCG_NR_STAT; i++)
+ stat[i] += raw_cpu_read(memcg->vmstats_percpu->stat[i]);
+
+ for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
+ for (i = 0; i < MEMCG_NR_STAT; i++)
+ atomic_long_add(stat[i], &mi->vmstats[i]);
+
+ for_each_node(node) {
+ struct mem_cgroup_per_node *pn = memcg->nodeinfo[node];
+ struct mem_cgroup_per_node *pi;
+
+ for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++)
+ stat[i] = 0;
+
+ for_each_online_cpu(cpu)
+ for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++)
+ stat[i] += raw_cpu_read(
+ pn->lruvec_stat_cpu->count[i]);
+
+ for (pi = pn; pi; pi = parent_nodeinfo(pi, node))
+ for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++)
+ atomic_long_add(stat[i], &pi->lruvec_stat[i]);
+ }
+}
+
#ifdef CONFIG_MEMCG_KMEM
static int memcg_online_kmem(struct mem_cgroup *memcg)
{
@@ -4805,6 +4840,11 @@ static void __mem_cgroup_free(struct mem_cgroup *memcg)
{
int node;
+ /*
+ * Flush percpu vmstats to guarantee the value correctness
+ * on parent's and all ancestor levels.
+ */
+ memcg_flush_percpu_vmstats(memcg);
for_each_node(node)
free_mem_cgroup_per_node_info(memcg, node);
free_percpu(memcg->vmstats_percpu);
--
2.21.0
The patch titled
Subject: mm: memcontrol: flush percpu vmevents before releasing memcg
has been added to the -mm tree. Its filename is
mm-memcontrol-flush-percpu-vmevents-before-releasing-memcg.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-memcontrol-flush-percpu-vmevent…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-memcontrol-flush-percpu-vmevent…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Roman Gushchin <guro(a)fb.com>
Subject: mm: memcontrol: flush percpu vmevents before releasing memcg
Similar to vmstats, percpu caching of local vmevents leads to an
accumulation of errors on non-leaf levels. This happens because some
leftovers may remain in percpu caches, so that they are never propagated
up by the cgroup tree and just disappear into nonexistence with on
releasing of the memory cgroup.
To fix this issue let's accumulate and propagate percpu vmevents values
before releasing the memory cgroup similar to what we're doing with
vmstats.
Since on cpu hotplug we do flush percpu vmstats anyway, we can iterate
only over online cpus.
Link: http://lkml.kernel.org/r/20190819202338.363363-4-guro@fb.com
Fixes: 42a300353577 ("mm: memcontrol: fix recursive statistics correctness & scalabilty")
Signed-off-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
--- a/mm/memcontrol.c~mm-memcontrol-flush-percpu-vmevents-before-releasing-memcg
+++ a/mm/memcontrol.c
@@ -3307,6 +3307,25 @@ static void memcg_flush_percpu_vmstats(s
}
}
+static void memcg_flush_percpu_vmevents(struct mem_cgroup *memcg)
+{
+ unsigned long events[NR_VM_EVENT_ITEMS];
+ struct mem_cgroup *mi;
+ int cpu, i;
+
+ for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
+ events[i] = 0;
+
+ for_each_online_cpu(cpu)
+ for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
+ events[i] += raw_cpu_read(
+ memcg->vmstats_percpu->events[i]);
+
+ for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
+ for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
+ atomic_long_add(events[i], &mi->vmevents[i]);
+}
+
#ifdef CONFIG_MEMCG_KMEM
static int memcg_online_kmem(struct mem_cgroup *memcg)
{
@@ -4737,10 +4756,11 @@ static void __mem_cgroup_free(struct mem
int node;
/*
- * Flush percpu vmstats to guarantee the value correctness
+ * Flush percpu vmstats and vmevents to guarantee the value correctness
* on parent's and all ancestor levels.
*/
memcg_flush_percpu_vmstats(memcg, false);
+ memcg_flush_percpu_vmevents(memcg);
for_each_node(node)
free_mem_cgroup_per_node_info(memcg, node);
free_percpu(memcg->vmstats_percpu);
_
Patches currently in -mm which might be from guro(a)fb.com are
mm-memcontrol-flush-percpu-vmstats-before-releasing-memcg.patch
mm-memcontrol-flush-percpu-slab-vmstats-on-kmem-offlining.patch
mm-memcontrol-flush-percpu-vmevents-before-releasing-memcg.patch
mm-memcontrol-switch-to-rcu-protection-in-drain_all_stock.patch
The patch titled
Subject: mm: memcontrol: flush percpu vmstats before releasing memcg
has been added to the -mm tree. Its filename is
mm-memcontrol-flush-percpu-vmstats-before-releasing-memcg.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-memcontrol-flush-percpu-vmstats…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-memcontrol-flush-percpu-vmstats…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Roman Gushchin <guro(a)fb.com>
Subject: mm: memcontrol: flush percpu vmstats before releasing memcg
Percpu caching of local vmstats with the conditional propagation by the
cgroup tree leads to an accumulation of errors on non-leaf levels.
Let's imagine two nested memory cgroups A and A/B. Say, a process
belonging to A/B allocates 100 pagecache pages on the CPU 0. The percpu
cache will spill 3 times, so that 32*3=96 pages will be accounted to A/B
and A atomic vmstat counters, 4 pages will remain in the percpu cache.
Imagine A/B is nearby memory.max, so that every following allocation
triggers a direct reclaim on the local CPU. Say, each such attempt will
free 16 pages on a new cpu. That means every percpu cache will have -16
pages, except the first one, which will have 4 - 16 = -12. A/B and A
atomic counters will not be touched at all.
Now a user removes A/B. All percpu caches are freed and corresponding
vmstat numbers are forgotten. A has 96 pages more than expected.
As memory cgroups are created and destroyed, errors do accumulate. Even
1-2 pages differences can accumulate into large numbers.
To fix this issue let's accumulate and propagate percpu vmstat values
before releasing the memory cgroup. At this point these numbers are
stable and cannot be changed.
Since on cpu hotplug we do flush percpu vmstats anyway, we can iterate
only over online cpus.
Link: http://lkml.kernel.org/r/20190819202338.363363-2-guro@fb.com
Fixes: 42a300353577 ("mm: memcontrol: fix recursive statistics correctness & scalabilty")
Signed-off-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 40 ++++++++++++++++++++++++++++++++++++++++
1 file changed, 40 insertions(+)
--- a/mm/memcontrol.c~mm-memcontrol-flush-percpu-vmstats-before-releasing-memcg
+++ a/mm/memcontrol.c
@@ -3260,6 +3260,41 @@ static u64 mem_cgroup_read_u64(struct cg
}
}
+static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg)
+{
+ unsigned long stat[MEMCG_NR_STAT];
+ struct mem_cgroup *mi;
+ int node, cpu, i;
+
+ for (i = 0; i < MEMCG_NR_STAT; i++)
+ stat[i] = 0;
+
+ for_each_online_cpu(cpu)
+ for (i = 0; i < MEMCG_NR_STAT; i++)
+ stat[i] += raw_cpu_read(memcg->vmstats_percpu->stat[i]);
+
+ for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
+ for (i = 0; i < MEMCG_NR_STAT; i++)
+ atomic_long_add(stat[i], &mi->vmstats[i]);
+
+ for_each_node(node) {
+ struct mem_cgroup_per_node *pn = memcg->nodeinfo[node];
+ struct mem_cgroup_per_node *pi;
+
+ for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++)
+ stat[i] = 0;
+
+ for_each_online_cpu(cpu)
+ for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++)
+ stat[i] += raw_cpu_read(
+ pn->lruvec_stat_cpu->count[i]);
+
+ for (pi = pn; pi; pi = parent_nodeinfo(pi, node))
+ for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++)
+ atomic_long_add(stat[i], &pi->lruvec_stat[i]);
+ }
+}
+
#ifdef CONFIG_MEMCG_KMEM
static int memcg_online_kmem(struct mem_cgroup *memcg)
{
@@ -4682,6 +4717,11 @@ static void __mem_cgroup_free(struct mem
{
int node;
+ /*
+ * Flush percpu vmstats to guarantee the value correctness
+ * on parent's and all ancestor levels.
+ */
+ memcg_flush_percpu_vmstats(memcg);
for_each_node(node)
free_mem_cgroup_per_node_info(memcg, node);
free_percpu(memcg->vmstats_percpu);
_
Patches currently in -mm which might be from guro(a)fb.com are
mm-memcontrol-flush-percpu-vmstats-before-releasing-memcg.patch
mm-memcontrol-flush-percpu-slab-vmstats-on-kmem-offlining.patch
mm-memcontrol-flush-percpu-vmevents-before-releasing-memcg.patch
mm-memcontrol-switch-to-rcu-protection-in-drain_all_stock.patch
The patch titled
Subject: mm: memcontrol: flush percpu vmevents before releasing memcg
has been removed from the -mm tree. Its filename was
mm-memcontrol-flush-percpu-vmevents-before-releasing-memcg.patch
This patch was dropped because an updated version will be merged
------------------------------------------------------
From: Roman Gushchin <guro(a)fb.com>
Subject: mm: memcontrol: flush percpu vmevents before releasing memcg
Similar to vmstats, percpu caching of local vmevents leads to an
accumulation of errors on non-leaf levels. This happens because some
leftovers may remain in percpu caches, so that they are never propagated
up by the cgroup tree and just disappear into nonexistence with on
releasing of the memory cgroup.
To fix this issue let's accumulate and propagate percpu vmevents values
before releasing the memory cgroup similar to what we're doing with
vmstats.
Since on cpu hotplug we do flush percpu vmstats anyway, we can iterate
only over online cpus.
Link: http://lkml.kernel.org/r/20190812233754.2570543-1-guro@fb.com
Fixes: 42a300353577 ("mm: memcontrol: fix recursive statistics correctness & scalabilty")
Signed-off-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
--- a/mm/memcontrol.c~mm-memcontrol-flush-percpu-vmevents-before-releasing-memcg
+++ a/mm/memcontrol.c
@@ -3336,6 +3336,25 @@ static void memcg_flush_percpu_vmstats(s
}
}
+static void memcg_flush_percpu_vmevents(struct mem_cgroup *memcg)
+{
+ unsigned long events[NR_VM_EVENT_ITEMS];
+ struct mem_cgroup *mi;
+ int cpu, i;
+
+ for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
+ events[i] = 0;
+
+ for_each_online_cpu(cpu)
+ for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
+ events[i] += raw_cpu_read(
+ memcg->vmstats_percpu->events[i]);
+
+ for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
+ for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
+ atomic_long_add(events[i], &mi->vmevents[i]);
+}
+
static void memcg_offline_kmem(struct mem_cgroup *memcg)
{
struct cgroup_subsys_state *css;
@@ -4737,10 +4756,11 @@ static void __mem_cgroup_free(struct mem
int node;
/*
- * Flush percpu vmstats to guarantee the value correctness
+ * Flush percpu vmstats and vmevents to guarantee the value correctness
* on parent's and all ancestor levels.
*/
memcg_flush_percpu_vmstats(memcg, false);
+ memcg_flush_percpu_vmevents(memcg);
for_each_node(node)
free_mem_cgroup_per_node_info(memcg, node);
free_percpu(memcg->vmstats_percpu);
_
Patches currently in -mm which might be from guro(a)fb.com are
mm-memcontrol-switch-to-rcu-protection-in-drain_all_stock.patch
The patch titled
Subject: mm: memcontrol: flush percpu vmstats before releasing memcg
has been removed from the -mm tree. Its filename was
mm-memcontrol-flush-percpu-vmstats-before-releasing-memcg.patch
This patch was dropped because an updated version will be merged
------------------------------------------------------
From: Roman Gushchin <guro(a)fb.com>
Subject: mm: memcontrol: flush percpu vmstats before releasing memcg
Percpu caching of local vmstats with the conditional propagation by the
cgroup tree leads to an accumulation of errors on non-leaf levels.
Let's imagine two nested memory cgroups A and A/B. Say, a process
belonging to A/B allocates 100 pagecache pages on the CPU 0. The percpu
cache will spill 3 times, so that 32*3=96 pages will be accounted to A/B
and A atomic vmstat counters, 4 pages will remain in the percpu cache.
Imagine A/B is nearby memory.max, so that every following allocation
triggers a direct reclaim on the local CPU. Say, each such attempt will
free 16 pages on a new cpu. That means every percpu cache will have -16
pages, except the first one, which will have 4 - 16 = -12. A/B and A
atomic counters will not be touched at all.
Now a user removes A/B. All percpu caches are freed and corresponding
vmstat numbers are forgotten. A has 96 pages more than expected.
As memory cgroups are created and destroyed, errors do accumulate. Even
1-2 pages differences can accumulate into large numbers.
To fix this issue let's accumulate and propagate percpu vmstat values
before releasing the memory cgroup. At this point these numbers are
stable and cannot be changed.
Since on cpu hotplug we do flush percpu vmstats anyway, we can iterate
only over online cpus.
Link: http://lkml.kernel.org/r/20190812222911.2364802-2-guro@fb.com
Fixes: 42a300353577 ("mm: memcontrol: fix recursive statistics correctness & scalabilty")
Signed-off-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 40 ++++++++++++++++++++++++++++++++++++++++
1 file changed, 40 insertions(+)
--- a/mm/memcontrol.c~mm-memcontrol-flush-percpu-vmstats-before-releasing-memcg
+++ a/mm/memcontrol.c
@@ -3289,6 +3289,41 @@ static int memcg_online_kmem(struct mem_
return 0;
}
+static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg)
+{
+ unsigned long stat[MEMCG_NR_STAT];
+ struct mem_cgroup *mi;
+ int node, cpu, i;
+
+ for (i = 0; i < MEMCG_NR_STAT; i++)
+ stat[i] = 0;
+
+ for_each_online_cpu(cpu)
+ for (i = 0; i < MEMCG_NR_STAT; i++)
+ stat[i] += raw_cpu_read(memcg->vmstats_percpu->stat[i]);
+
+ for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
+ for (i = 0; i < MEMCG_NR_STAT; i++)
+ atomic_long_add(stat[i], &mi->vmstats[i]);
+
+ for_each_node(node) {
+ struct mem_cgroup_per_node *pn = memcg->nodeinfo[node];
+ struct mem_cgroup_per_node *pi;
+
+ for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++)
+ stat[i] = 0;
+
+ for_each_online_cpu(cpu)
+ for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++)
+ stat[i] += raw_cpu_read(
+ pn->lruvec_stat_cpu->count[i]);
+
+ for (pi = pn; pi; pi = parent_nodeinfo(pi, node))
+ for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++)
+ atomic_long_add(stat[i], &pi->lruvec_stat[i]);
+ }
+}
+
static void memcg_offline_kmem(struct mem_cgroup *memcg)
{
struct cgroup_subsys_state *css;
@@ -4682,6 +4717,11 @@ static void __mem_cgroup_free(struct mem
{
int node;
+ /*
+ * Flush percpu vmstats to guarantee the value correctness
+ * on parent's and all ancestor levels.
+ */
+ memcg_flush_percpu_vmstats(memcg);
for_each_node(node)
free_mem_cgroup_per_node_info(memcg, node);
free_percpu(memcg->vmstats_percpu);
_
Patches currently in -mm which might be from guro(a)fb.com are
mm-memcontrol-flush-percpu-slab-vmstats-on-kmem-offlining.patch
mm-memcontrol-flush-percpu-slab-vmstats-on-kmem-offlining-fix.patch
mm-memcontrol-flush-percpu-vmevents-before-releasing-memcg.patch
mm-memcontrol-switch-to-rcu-protection-in-drain_all_stock.patch
From: Sasha Levin <sashal(a)kernel.org> Sent: Monday, August 19, 2019 2:28 PM
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: ecb3f394c5db genirq: Expose interrupt information through sysfs.
>
> The bot has tested the following trees: v5.2.9, v4.19.67, v4.14.139, v4.9.189.
>
> v5.2.9: Build failed! Errors:
> kernel/irq/irqdesc.c:446:6: error: ‘irq_kobj_base’ undeclared (first use in this function);
> did you mean ‘irq_kobj_type’?
>
> v4.19.67: Build failed! Errors:
> kernel/irq/irqdesc.c:445:6: error: ‘irq_kobj_base’ undeclared (first use in this function);
> did you mean ‘irq_kobj_type’?
>
> v4.14.139: Build failed! Errors:
> kernel/irq/irqdesc.c:428:6: error: ‘irq_kobj_base’ undeclared (first use in this function);
> did you mean ‘irq_kobj_type’?
>
> v4.9.189: Build failed! Errors:
> kernel/irq/irqdesc.c:414:6: error: ‘irq_kobj_base’ undeclared (first use in this function);
> did you mean ‘irq_kobj_type’?
>
>
> NOTE: The patch will not be queued to stable trees until it is upstream.
>
> How should we proceed with this patch?
Compile error occurs when CONFIG_SYSFS is not selected. It's probably cleanest to
revert the current patch. I'll send out a new version that fixes the problem.
Michael
Similar to vmstats, percpu caching of local vmevents leads to an
accumulation of errors on non-leaf levels. This happens because some
leftovers may remain in percpu caches, so that they are never propagated
up by the cgroup tree and just disappear into nonexistence with on
releasing of the memory cgroup.
To fix this issue let's accumulate and propagate percpu vmevents values
before releasing the memory cgroup similar to what we're doing with
vmstats.
Since on cpu hotplug we do flush percpu vmstats anyway, we can iterate
only over online cpus.
Fixes: 42a300353577 ("mm: memcontrol: fix recursive statistics correctness & scalabilty")
Signed-off-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
---
mm/memcontrol.c | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index ebd72b80c90b..3137de6a46f0 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3430,6 +3430,25 @@ static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg, bool slab_only)
}
}
+static void memcg_flush_percpu_vmevents(struct mem_cgroup *memcg)
+{
+ unsigned long events[NR_VM_EVENT_ITEMS];
+ struct mem_cgroup *mi;
+ int cpu, i;
+
+ for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
+ events[i] = 0;
+
+ for_each_online_cpu(cpu)
+ for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
+ events[i] += raw_cpu_read(
+ memcg->vmstats_percpu->events[i]);
+
+ for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
+ for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
+ atomic_long_add(events[i], &mi->vmevents[i]);
+}
+
#ifdef CONFIG_MEMCG_KMEM
static int memcg_online_kmem(struct mem_cgroup *memcg)
{
@@ -4860,10 +4879,11 @@ static void __mem_cgroup_free(struct mem_cgroup *memcg)
int node;
/*
- * Flush percpu vmstats to guarantee the value correctness
+ * Flush percpu vmstats and vmevents to guarantee the value correctness
* on parent's and all ancestor levels.
*/
memcg_flush_percpu_vmstats(memcg, false);
+ memcg_flush_percpu_vmevents(memcg);
for_each_node(node)
free_mem_cgroup_per_node_info(memcg, node);
free_percpu(memcg->vmstats_percpu);
--
2.21.0