- Linux-stable-mirror - lists.linaro.org

by CKI

Hello, We ran automated tests on a patchset that was proposed for merging into this kernel tree. The patches were applied to: Kernel repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Commit: 8c3f48e8c288 Linux 4.20.1 The results of these automated tests are provided below. Overall result: FAILED (see details below) Patch merge: OK Compile: FAILED We attempted to compile the kernel for multiple architectures, but the compile failed on one or more architectures: s390x: FAILED (build log attached: build_s390.log.gz) powerpc64le: FAILED (build log attached: build_powerpc.log.gz) aarch64: FAILED (build log attached: build_arm64.log.gz) x86_64: FAILED (build log attached: build_x86_64.log.gz) We hope that these logs can help you find the problem quickly. For the full detail on our testing procedures, please scroll to the bottom of this message. Please reply to this email if you have any questions about the tests that we ran or if you have any suggestions on how to make future tests more effective. ,-. ,-. ( C ) ( K ) Continuous `-',-.`-' Kernel ( I ) Integration `-' ______________________________________________________________________________ Merge testing ------------- We cloned this repository and checked out a ref: Repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Ref: 8c3f48e8c288 Linux 4.20.1 We then merged the following patches with `git am`: scsi-zfcp-fix-posting-too-many-status-read-buffers-leading-to-adapter-shutdown.patch scsi-lpfc-do-not-set-queue-page_count-to-0-if-pc_sli4_params.wqpcnt-is-invalid.patch fork-record-start_time-late.patch zram-fix-double-free-backing-device.patch hwpoison-memory_hotplug-allow-hwpoisoned-pages-to-be-offlined.patch mm-devm_memremap_pages-mark-devm_memremap_pages-export_symbol_gpl.patch mm-devm_memremap_pages-kill-mapping-system-ram-support.patch mm-devm_memremap_pages-fix-shutdown-handling.patch hugetlbfs-use-i_mmap_rwsem-for-more-pmd-sharing-synchronization.patch hugetlbfs-use-i_mmap_rwsem-to-fix-page-fault-truncate-race.patch memcg-oom-notify-on-oom-killer-invocation-from-the-charge-path.patch sunrpc-fix-cache_head-leak-due-to-queued-request.patch sunrpc-use-svc_net-in-svcauth_gss_-functions.patch sunrpc-use-after-free-in-svc_process_common.patch mm-devm_memremap_pages-add-memory_device_private-support.patch mm-hmm-use-devm-semantics-for-hmm_devmem_-add-remove.patch mm-hmm-replace-hmm_devmem_pages_create-with-devm_memremap_pages.patch mm-hmm-mark-hmm_devmem_-add-add_resource-export_symbol_gpl.patch mm-swap-fix-swapoff-with-ksm-pages.patch Compile testing --------------- We compiled the kernel for 4 architectures: s390x: make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64 configuration: powerpc64le: make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64 configuration: aarch64: make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64 configuration: x86_64: make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64 configuration: Hardware testing ---------------- We booted each kernel and ran the following tests: s390: powerpc: arm64: x86_64:

6 years, 8 months

1
0
0 0

[PATCH 11/15] mips: fix n32 compat_ipc_parse_version

by Arnd Bergmann

While reading through the sysvipc implementation, I noticed that the n32 semctl/shmctl/msgctl system calls behave differently based on whether o32 support is enabled or not: Without o32, the IPC_64 flag passed by user space is rejected but calls without that flag get IPC_64 behavior. As far as I can tell, this was inadvertently changed by a cleanup patch but never noticed by anyone, possibly nobody has tried using sysvipc on n32 after linux-3.19. Change it back to the old behavior now. Fixes: 78aaf956ba3a ("MIPS: Compat: Fix build error if CONFIG_MIPS32_COMPAT but no compat ABI.") Cc: stable(a)vger.kernel.org Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> --- As stated above, this was only found by inspection, the patch is not tested. Please review accordingly. --- arch/mips/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig index 787290781b8c..0d14f51d0002 100644 --- a/arch/mips/Kconfig +++ b/arch/mips/Kconfig @@ -3155,6 +3155,7 @@ config MIPS32_O32 config MIPS32_N32 bool "Kernel support for n32 binaries" depends on 64BIT + select ARCH_WANT_COMPAT_IPC_PARSE_VERSION select COMPAT select MIPS32_COMPAT select SYSVIPC_COMPAT if SYSVIPC -- 2.20.0

6 years, 8 months

1
0
0 0

[PATCH 04/15] alpha: wire up io_pgetevents system call

by Arnd Bergmann

The io_pgetevents system call was added in linux-4.18 but has no entry for alpha: warning: #warning syscall io_pgetevents not implemented [-Wcpp] Assign a the next system call number here. Cc: stable(a)vger.kernel.org Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> --- arch/alpha/kernel/syscalls/syscall.tbl | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/alpha/kernel/syscalls/syscall.tbl b/arch/alpha/kernel/syscalls/syscall.tbl index 7b56a53be5e3..e09558edae73 100644 --- a/arch/alpha/kernel/syscalls/syscall.tbl +++ b/arch/alpha/kernel/syscalls/syscall.tbl @@ -451,3 +451,4 @@ 520 common preadv2 sys_preadv2 521 common pwritev2 sys_pwritev2 522 common statx sys_statx +523 common io_pgetevents sys_io_pgetevents -- 2.20.0

6 years, 8 months

1
0
0 0

Cross-compiling libbpf from Linux 4.14 tree

by Ignat Korchagin

Good day, We have started to compile libbpf as part of our Linux compilation build plan, however libbpf fails to cross-compile for arm64 on Linux 4.14, but succeeds on Linux 4.19 tree. We compile libbpf with the following command: make -C <whatever>/linux-4.14.91/tools/lib/bpf ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- install And get the below output on 4.14 tree: Auto-detecting system features: ... libelf: [ on ] ... bpf: [ on ] CC /cfsetup_build/build/arm64/libbpf/libbpf.o CC /cfsetup_build/build/arm64/libbpf/bpf.o LD /cfsetup_build/build/arm64/libbpf/libbpf-in.o ld: /cfsetup_build/build/arm64/libbpf/libbpf.o: Relocations in generic ELF (EM: 183) ld: /cfsetup_build/build/arm64/libbpf/libbpf.o: Relocations in generic ELF (EM: 183) ld: /cfsetup_build/build/arm64/libbpf/libbpf.o: Relocations in generic ELF (EM: 183) ld: /cfsetup_build/build/arm64/libbpf/libbpf.o: Relocations in generic ELF (EM: 183) ld: /cfsetup_build/build/arm64/libbpf/libbpf.o: Relocations in generic ELF (EM: 183) ld: /cfsetup_build/build/arm64/libbpf/libbpf.o: Relocations in generic ELF (EM: 183) /cfsetup_build/build/arm64/libbpf/libbpf.o: error adding symbols: File in wrong format /cfsetup_build/build/linux-4.14.91/tools/build/Makefile.build:144: recipe for target '/cfsetup_build/build/arm64/libbpf/libbpf-in.o' failed make[2]: *** [/cfsetup_build/build/arm64/libbpf/libbpf-in.o] Error 1 Makefile:158: recipe for target '/cfsetup_build/build/arm64/libbpf/libbpf-in.o' failed make[1]: *** [/cfsetup_build/build/arm64/libbpf/libbpf-in.o] Error 2 Backporting the following commit fixed the build: 7ed1c1901fe52e6c5828deb155920b44b0adabb1: tools: fix cross-compile var clobbering Can we have it officially applied to the Linux 4.14 tree, please? Regards, Ignat

6 years, 8 months

3
4
0 0

FAILED: patch "[PATCH] sunrpc: use-after-free in svc_process_common()" failed to apply to 4.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From d4b09acf924b84bae77cad090a9d108e70b43643 Mon Sep 17 00:00:00 2001 From: Vasily Averin <vvs(a)virtuozzo.com> Date: Mon, 24 Dec 2018 14:44:52 +0300 Subject: [PATCH] sunrpc: use-after-free in svc_process_common() if node have NFSv41+ mounts inside several net namespaces it can lead to use-after-free in svc_process_common() svc_process_common() /* Setup reply header */ rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); <<< HERE svc_process_common() can use incorrect rqstp->rq_xprt, its caller function bc_svc_process() takes it from serv->sv_bc_xprt. The problem is that serv is global structure but sv_bc_xprt is assigned per-netnamespace. According to Trond, the whole "let's set up rqstp->rq_xprt for the back channel" is nothing but a giant hack in order to work around the fact that svc_process_common() uses it to find the xpt_ops, and perform a couple of (meaningless for the back channel) tests of xpt_flags. All we really need in svc_process_common() is to be able to run rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr() Bruce J Fields points that this xpo_prep_reply_hdr() call is an awfully roundabout way just to do "svc_putnl(resv, 0);" in the tcp case. This patch does not initialiuze rqstp->rq_xprt in bc_svc_process(), now it calls svc_process_common() with rqstp->rq_xprt = NULL. To adjust reply header svc_process_common() just check rqstp->rq_prot and calls svc_tcp_prep_reply_hdr() for tcp case. To handle rqstp->rq_xprt = NULL case in functions called from svc_process_common() patch intruduces net namespace pointer svc_rqst->rq_bc_net and adjust SVC_NET() definition. Some other function was also adopted to properly handle described case. Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com> Cc: stable(a)vger.kernel.org Fixes: 23c20ecd4475 ("NFS: callback up - users counting cleanup") Signed-off-by: J. Bruce Fields <bfields(a)redhat.com> diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h index 73e130a840ce..fdb6b317d974 100644 --- a/include/linux/sunrpc/svc.h +++ b/include/linux/sunrpc/svc.h @@ -295,9 +295,12 @@ struct svc_rqst { struct svc_cacherep * rq_cacherep; /* cache info */ struct task_struct *rq_task; /* service thread */ spinlock_t rq_lock; /* per-request lock */ + struct net *rq_bc_net; /* pointer to backchannel's + * net namespace + */ }; -#define SVC_NET(svc_rqst) (svc_rqst->rq_xprt->xpt_net) +#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net) /* * Rigorous type checking on sockaddr type conversions diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h index 28e384186c35..8617f4fd6b70 100644 --- a/include/trace/events/sunrpc.h +++ b/include/trace/events/sunrpc.h @@ -569,7 +569,8 @@ TRACE_EVENT(svc_process, __field(u32, vers) __field(u32, proc) __string(service, name) - __string(addr, rqst->rq_xprt->xpt_remotebuf) + __string(addr, rqst->rq_xprt ? + rqst->rq_xprt->xpt_remotebuf : "(null)") ), TP_fast_assign( @@ -577,7 +578,8 @@ TRACE_EVENT(svc_process, __entry->vers = rqst->rq_vers; __entry->proc = rqst->rq_proc; __assign_str(service, name); - __assign_str(addr, rqst->rq_xprt->xpt_remotebuf); + __assign_str(addr, rqst->rq_xprt ? + rqst->rq_xprt->xpt_remotebuf : "(null)"); ), TP_printk("addr=%s xid=0x%08x service=%s vers=%u proc=%u", diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c index d13e05f1a990..fb647bc01fc5 100644 --- a/net/sunrpc/svc.c +++ b/net/sunrpc/svc.c @@ -1172,7 +1172,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) clear_bit(RQ_DROPME, &rqstp->rq_flags); /* Setup reply header */ - rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); + if (rqstp->rq_prot == IPPROTO_TCP) + svc_tcp_prep_reply_hdr(rqstp); svc_putu32(resv, rqstp->rq_xid); @@ -1244,7 +1245,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) * for lower versions. RPC_PROG_MISMATCH seems to be the closest * fit. */ - if (versp->vs_need_cong_ctrl && + if (versp->vs_need_cong_ctrl && rqstp->rq_xprt && !test_bit(XPT_CONG_CTRL, &rqstp->rq_xprt->xpt_flags)) goto err_bad_vers; @@ -1336,7 +1337,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) return 0; close: - if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags)) + if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags)) svc_close_xprt(rqstp->rq_xprt); dprintk("svc: svc_process close\n"); return 0; @@ -1459,10 +1460,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req, dprintk("svc: %s(%p)\n", __func__, req); /* Build the svc_rqst used by the common processing routine */ - rqstp->rq_xprt = serv->sv_bc_xprt; rqstp->rq_xid = req->rq_xid; rqstp->rq_prot = req->rq_xprt->prot; rqstp->rq_server = serv; + rqstp->rq_bc_net = req->rq_xprt->xprt_net; rqstp->rq_addrlen = sizeof(req->rq_xprt->addr); memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen); diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c index 51d36230b6e3..bd42da287c26 100644 --- a/net/sunrpc/svc_xprt.c +++ b/net/sunrpc/svc_xprt.c @@ -468,10 +468,11 @@ static struct svc_xprt *svc_xprt_dequeue(struct svc_pool *pool) */ void svc_reserve(struct svc_rqst *rqstp, int space) { + struct svc_xprt *xprt = rqstp->rq_xprt; + space += rqstp->rq_res.head[0].iov_len; - if (space < rqstp->rq_reserved) { - struct svc_xprt *xprt = rqstp->rq_xprt; + if (xprt && space < rqstp->rq_reserved) { atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved); rqstp->rq_reserved = space; diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c index 986f3ed7d1a2..793149ba1bda 100644 --- a/net/sunrpc/svcsock.c +++ b/net/sunrpc/svcsock.c @@ -1173,7 +1173,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp) /* * Setup response header. TCP has a 4B record length field. */ -static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp) +void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp) { struct kvec *resv = &rqstp->rq_res.head[0];

6 years, 8 months

1
0
0 0

FAILED: patch "[PATCH] sunrpc: use-after-free in svc_process_common()" failed to apply to 4.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From d4b09acf924b84bae77cad090a9d108e70b43643 Mon Sep 17 00:00:00 2001 From: Vasily Averin <vvs(a)virtuozzo.com> Date: Mon, 24 Dec 2018 14:44:52 +0300 Subject: [PATCH] sunrpc: use-after-free in svc_process_common() if node have NFSv41+ mounts inside several net namespaces it can lead to use-after-free in svc_process_common() svc_process_common() /* Setup reply header */ rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); <<< HERE svc_process_common() can use incorrect rqstp->rq_xprt, its caller function bc_svc_process() takes it from serv->sv_bc_xprt. The problem is that serv is global structure but sv_bc_xprt is assigned per-netnamespace. According to Trond, the whole "let's set up rqstp->rq_xprt for the back channel" is nothing but a giant hack in order to work around the fact that svc_process_common() uses it to find the xpt_ops, and perform a couple of (meaningless for the back channel) tests of xpt_flags. All we really need in svc_process_common() is to be able to run rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr() Bruce J Fields points that this xpo_prep_reply_hdr() call is an awfully roundabout way just to do "svc_putnl(resv, 0);" in the tcp case. This patch does not initialiuze rqstp->rq_xprt in bc_svc_process(), now it calls svc_process_common() with rqstp->rq_xprt = NULL. To adjust reply header svc_process_common() just check rqstp->rq_prot and calls svc_tcp_prep_reply_hdr() for tcp case. To handle rqstp->rq_xprt = NULL case in functions called from svc_process_common() patch intruduces net namespace pointer svc_rqst->rq_bc_net and adjust SVC_NET() definition. Some other function was also adopted to properly handle described case. Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com> Cc: stable(a)vger.kernel.org Fixes: 23c20ecd4475 ("NFS: callback up - users counting cleanup") Signed-off-by: J. Bruce Fields <bfields(a)redhat.com> diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h index 73e130a840ce..fdb6b317d974 100644 --- a/include/linux/sunrpc/svc.h +++ b/include/linux/sunrpc/svc.h @@ -295,9 +295,12 @@ struct svc_rqst { struct svc_cacherep * rq_cacherep; /* cache info */ struct task_struct *rq_task; /* service thread */ spinlock_t rq_lock; /* per-request lock */ + struct net *rq_bc_net; /* pointer to backchannel's + * net namespace + */ }; -#define SVC_NET(svc_rqst) (svc_rqst->rq_xprt->xpt_net) +#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net) /* * Rigorous type checking on sockaddr type conversions diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h index 28e384186c35..8617f4fd6b70 100644 --- a/include/trace/events/sunrpc.h +++ b/include/trace/events/sunrpc.h @@ -569,7 +569,8 @@ TRACE_EVENT(svc_process, __field(u32, vers) __field(u32, proc) __string(service, name) - __string(addr, rqst->rq_xprt->xpt_remotebuf) + __string(addr, rqst->rq_xprt ? + rqst->rq_xprt->xpt_remotebuf : "(null)") ), TP_fast_assign( @@ -577,7 +578,8 @@ TRACE_EVENT(svc_process, __entry->vers = rqst->rq_vers; __entry->proc = rqst->rq_proc; __assign_str(service, name); - __assign_str(addr, rqst->rq_xprt->xpt_remotebuf); + __assign_str(addr, rqst->rq_xprt ? + rqst->rq_xprt->xpt_remotebuf : "(null)"); ), TP_printk("addr=%s xid=0x%08x service=%s vers=%u proc=%u", diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c index d13e05f1a990..fb647bc01fc5 100644 --- a/net/sunrpc/svc.c +++ b/net/sunrpc/svc.c @@ -1172,7 +1172,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) clear_bit(RQ_DROPME, &rqstp->rq_flags); /* Setup reply header */ - rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); + if (rqstp->rq_prot == IPPROTO_TCP) + svc_tcp_prep_reply_hdr(rqstp); svc_putu32(resv, rqstp->rq_xid); @@ -1244,7 +1245,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) * for lower versions. RPC_PROG_MISMATCH seems to be the closest * fit. */ - if (versp->vs_need_cong_ctrl && + if (versp->vs_need_cong_ctrl && rqstp->rq_xprt && !test_bit(XPT_CONG_CTRL, &rqstp->rq_xprt->xpt_flags)) goto err_bad_vers; @@ -1336,7 +1337,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) return 0; close: - if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags)) + if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags)) svc_close_xprt(rqstp->rq_xprt); dprintk("svc: svc_process close\n"); return 0; @@ -1459,10 +1460,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req, dprintk("svc: %s(%p)\n", __func__, req); /* Build the svc_rqst used by the common processing routine */ - rqstp->rq_xprt = serv->sv_bc_xprt; rqstp->rq_xid = req->rq_xid; rqstp->rq_prot = req->rq_xprt->prot; rqstp->rq_server = serv; + rqstp->rq_bc_net = req->rq_xprt->xprt_net; rqstp->rq_addrlen = sizeof(req->rq_xprt->addr); memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen); diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c index 51d36230b6e3..bd42da287c26 100644 --- a/net/sunrpc/svc_xprt.c +++ b/net/sunrpc/svc_xprt.c @@ -468,10 +468,11 @@ static struct svc_xprt *svc_xprt_dequeue(struct svc_pool *pool) */ void svc_reserve(struct svc_rqst *rqstp, int space) { + struct svc_xprt *xprt = rqstp->rq_xprt; + space += rqstp->rq_res.head[0].iov_len; - if (space < rqstp->rq_reserved) { - struct svc_xprt *xprt = rqstp->rq_xprt; + if (xprt && space < rqstp->rq_reserved) { atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved); rqstp->rq_reserved = space; diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c index 986f3ed7d1a2..793149ba1bda 100644 --- a/net/sunrpc/svcsock.c +++ b/net/sunrpc/svcsock.c @@ -1173,7 +1173,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp) /* * Setup response header. TCP has a 4B record length field. */ -static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp) +void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp) { struct kvec *resv = &rqstp->rq_res.head[0];

6 years, 8 months

1
0
0 0

FAILED: patch "[PATCH] hugetlbfs: Use i_mmap_rwsem to fix page fault/truncate race" failed to apply to 4.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From c86aa7bbfd5568ba8a82d3635d8f7b8a8e06fe54 Mon Sep 17 00:00:00 2001 From: Mike Kravetz <mike.kravetz(a)oracle.com> Date: Fri, 28 Dec 2018 00:39:42 -0800 Subject: [PATCH] hugetlbfs: Use i_mmap_rwsem to fix page fault/truncate race hugetlbfs page faults can race with truncate and hole punch operations. Current code in the page fault path attempts to handle this by 'backing out' operations if we encounter the race. One obvious omission in the current code is removing a page newly added to the page cache. This is pretty straight forward to address, but there is a more subtle and difficult issue of backing out hugetlb reservations. To handle this correctly, the 'reservation state' before page allocation needs to be noted so that it can be properly backed out. There are four distinct possibilities for reservation state: shared/reserved, shared/no-resv, private/reserved and private/no-resv. Backing out a reservation may require memory allocation which could fail so that needs to be taken into account as well. Instead of writing the required complicated code for this rare occurrence, just eliminate the race. i_mmap_rwsem is now held in read mode for the duration of page fault processing. Hold i_mmap_rwsem longer in truncation and hold punch code to cover the call to remove_inode_hugepages. With this modification, code in remove_inode_hugepages checking for races becomes 'dead' as it can not longer happen. Remove the dead code and expand comments to explain reasoning. Similarly, checks for races with truncation in the page fault path can be simplified and removed. [mike.kravetz(a)oracle.com: incorporat suggestions from Kirill] Link: http://lkml.kernel.org/r/20181222223013.22193-3-mike.kravetz@oracle.com Link: http://lkml.kernel.org/r/20181218223557.5202-3-mike.kravetz@oracle.com Fixes: ebed4bfc8da8 ("hugetlb: fix absurd HugePages_Rsvd") Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com> Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Hugh Dickins <hughd(a)google.com> Cc: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com> Cc: "Aneesh Kumar K . V" <aneesh.kumar(a)linux.vnet.ibm.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: Prakash Sangappa <prakash.sangappa(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index 32920a10100e..a2fcea5f8225 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -383,17 +383,16 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end) * truncation is indicated by end of range being LLONG_MAX * In this case, we first scan the range and release found pages. * After releasing pages, hugetlb_unreserve_pages cleans up region/reserv - * maps and global counts. Page faults can not race with truncation - * in this routine. hugetlb_no_page() prevents page faults in the - * truncated range. It checks i_size before allocation, and again after - * with the page table lock for the page held. The same lock must be - * acquired to unmap a page. + * maps and global counts. * hole punch is indicated if end is not LLONG_MAX * In the hole punch case we scan the range and release found pages. * Only when releasing a page is the associated region/reserv map * deleted. The region/reserv map for ranges without associated - * pages are not modified. Page faults can race with hole punch. - * This is indicated if we find a mapped page. + * pages are not modified. + * + * Callers of this routine must hold the i_mmap_rwsem in write mode to prevent + * races with page faults. + * * Note: If the passed end of range value is beyond the end of file, but * not LLONG_MAX this routine still performs a hole punch operation. */ @@ -423,32 +422,14 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart, for (i = 0; i < pagevec_count(&pvec); ++i) { struct page *page = pvec.pages[i]; - u32 hash; index = page->index; - hash = hugetlb_fault_mutex_hash(h, current->mm, - &pseudo_vma, - mapping, index, 0); - mutex_lock(&hugetlb_fault_mutex_table[hash]); - /* - * If page is mapped, it was faulted in after being - * unmapped in caller. Unmap (again) now after taking - * the fault mutex. The mutex will prevent faults - * until we finish removing the page. - * - * This race can only happen in the hole punch case. - * Getting here in a truncate operation is a bug. + * A mapped page is impossible as callers should unmap + * all references before calling. And, i_mmap_rwsem + * prevents the creation of additional mappings. */ - if (unlikely(page_mapped(page))) { - BUG_ON(truncate_op); - - i_mmap_lock_write(mapping); - hugetlb_vmdelete_list(&mapping->i_mmap, - index * pages_per_huge_page(h), - (index + 1) * pages_per_huge_page(h)); - i_mmap_unlock_write(mapping); - } + VM_BUG_ON(page_mapped(page)); lock_page(page); /* @@ -470,7 +451,6 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart, } unlock_page(page); - mutex_unlock(&hugetlb_fault_mutex_table[hash]); } huge_pagevec_release(&pvec); cond_resched(); @@ -482,9 +462,20 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart, static void hugetlbfs_evict_inode(struct inode *inode) { + struct address_space *mapping = inode->i_mapping; struct resv_map *resv_map; + /* + * The vfs layer guarantees that there are no other users of this + * inode. Therefore, it would be safe to call remove_inode_hugepages + * without holding i_mmap_rwsem. We acquire and hold here to be + * consistent with other callers. Since there will be no contention + * on the semaphore, overhead is negligible. + */ + i_mmap_lock_write(mapping); remove_inode_hugepages(inode, 0, LLONG_MAX); + i_mmap_unlock_write(mapping); + resv_map = (struct resv_map *)inode->i_mapping->private_data; /* root inode doesn't have the resv_map, so we should check it */ if (resv_map) @@ -505,8 +496,8 @@ static int hugetlb_vmtruncate(struct inode *inode, loff_t offset) i_mmap_lock_write(mapping); if (!RB_EMPTY_ROOT(&mapping->i_mmap.rb_root)) hugetlb_vmdelete_list(&mapping->i_mmap, pgoff, 0); - i_mmap_unlock_write(mapping); remove_inode_hugepages(inode, offset, LLONG_MAX); + i_mmap_unlock_write(mapping); return 0; } @@ -540,8 +531,8 @@ static long hugetlbfs_punch_hole(struct inode *inode, loff_t offset, loff_t len) hugetlb_vmdelete_list(&mapping->i_mmap, hole_start >> PAGE_SHIFT, hole_end >> PAGE_SHIFT); - i_mmap_unlock_write(mapping); remove_inode_hugepages(inode, hole_start, hole_end); + i_mmap_unlock_write(mapping); inode_unlock(inode); } @@ -624,7 +615,11 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset, /* addr is the offset within the file (zero based) */ addr = index * hpage_size; - /* mutex taken here, fault path and hole punch */ + /* + * fault mutex taken here, protects against fault path + * and hole punch. inode_lock previously taken protects + * against truncation. + */ hash = hugetlb_fault_mutex_hash(h, mm, &pseudo_vma, mapping, index, addr); mutex_lock(&hugetlb_fault_mutex_table[hash]); diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 87fd3ab809c6..e37efd5d8318 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3755,16 +3755,16 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, } /* - * Use page lock to guard against racing truncation - * before we get page_table_lock. + * We can not race with truncation due to holding i_mmap_rwsem. + * Check once here for faults beyond end of file. */ + size = i_size_read(mapping->host) >> huge_page_shift(h); + if (idx >= size) + goto out; + retry: page = find_lock_page(mapping, idx); if (!page) { - size = i_size_read(mapping->host) >> huge_page_shift(h); - if (idx >= size) - goto out; - /* * Check for page in userfault range */ @@ -3854,9 +3854,6 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, } ptl = huge_pte_lock(h, mm, ptep); - size = i_size_read(mapping->host) >> huge_page_shift(h); - if (idx >= size) - goto backout; ret = 0; if (!huge_pte_none(huge_ptep_get(ptep))) @@ -3959,8 +3956,10 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, /* * Acquire i_mmap_rwsem before calling huge_pte_alloc and hold - * until finished with ptep. This prevents huge_pmd_unshare from - * being called elsewhere and making the ptep no longer valid. + * until finished with ptep. This serves two purposes: + * 1) It prevents huge_pmd_unshare from being called elsewhere + * and making the ptep no longer valid. + * 2) It synchronizes us with file truncation. * * ptep could have already be assigned via huge_pte_offset. That * is OK, as huge_pte_alloc will return the same value unless

6 years, 8 months

1
0
0 0

FAILED: patch "[PATCH] hugetlbfs: use i_mmap_rwsem for more pmd sharing" failed to apply to 4.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From b43a9990055958e70347c56f90ea2ae32c67334c Mon Sep 17 00:00:00 2001 From: Mike Kravetz <mike.kravetz(a)oracle.com> Date: Fri, 28 Dec 2018 00:39:38 -0800 Subject: [PATCH] hugetlbfs: use i_mmap_rwsem for more pmd sharing synchronization While looking at BUGs associated with invalid huge page map counts, it was discovered and observed that a huge pte pointer could become 'invalid' and point to another task's page table. Consider the following: A task takes a page fault on a shared hugetlbfs file and calls huge_pte_alloc to get a ptep. Suppose the returned ptep points to a shared pmd. Now, another task truncates the hugetlbfs file. As part of truncation, it unmaps everyone who has the file mapped. If the range being truncated is covered by a shared pmd, huge_pmd_unshare will be called. For all but the last user of the shared pmd, huge_pmd_unshare will clear the pud pointing to the pmd. If the task in the middle of the page fault is not the last user, the ptep returned by huge_pte_alloc now points to another task's page table or worse. This leads to bad things such as incorrect page map/reference counts or invalid memory references. To fix, expand the use of i_mmap_rwsem as follows: - i_mmap_rwsem is held in read mode whenever huge_pmd_share is called. huge_pmd_share is only called via huge_pte_alloc, so callers of huge_pte_alloc take i_mmap_rwsem before calling. In addition, callers of huge_pte_alloc continue to hold the semaphore until finished with the ptep. - i_mmap_rwsem is held in write mode whenever huge_pmd_unshare is called. [mike.kravetz(a)oracle.com: add explicit check for mapping != null] Link: http://lkml.kernel.org/r/20181218223557.5202-2-mike.kravetz@oracle.com Fixes: 39dde65c9940 ("shared page table for hugetlb page") Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com> Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Hugh Dickins <hughd(a)google.com> Cc: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com> Cc: "Aneesh Kumar K . V" <aneesh.kumar(a)linux.vnet.ibm.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: Prakash Sangappa <prakash.sangappa(a)oracle.com> Cc: Colin Ian King <colin.king(a)canonical.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 12000ba5c868..87fd3ab809c6 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3238,6 +3238,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, struct page *ptepage; unsigned long addr; int cow; + struct address_space *mapping = vma->vm_file->f_mapping; struct hstate *h = hstate_vma(vma); unsigned long sz = huge_page_size(h); struct mmu_notifier_range range; @@ -3249,13 +3250,23 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, mmu_notifier_range_init(&range, src, vma->vm_start, vma->vm_end); mmu_notifier_invalidate_range_start(&range); + } else { + /* + * For shared mappings i_mmap_rwsem must be held to call + * huge_pte_alloc, otherwise the returned ptep could go + * away if part of a shared pmd and another thread calls + * huge_pmd_unshare. + */ + i_mmap_lock_read(mapping); } for (addr = vma->vm_start; addr < vma->vm_end; addr += sz) { spinlock_t *src_ptl, *dst_ptl; + src_pte = huge_pte_offset(src, addr, sz); if (!src_pte) continue; + dst_pte = huge_pte_alloc(dst, addr, sz); if (!dst_pte) { ret = -ENOMEM; @@ -3326,6 +3337,8 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, if (cow) mmu_notifier_invalidate_range_end(&range); + else + i_mmap_unlock_read(mapping); return ret; } @@ -3771,14 +3784,18 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, }; /* - * hugetlb_fault_mutex must be dropped before - * handling userfault. Reacquire after handling - * fault to make calling code simpler. + * hugetlb_fault_mutex and i_mmap_rwsem must be + * dropped before handling userfault. Reacquire + * after handling fault to make calling code simpler. */ hash = hugetlb_fault_mutex_hash(h, mm, vma, mapping, idx, haddr); mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); + ret = handle_userfault(&vmf, VM_UFFD_MISSING); + + i_mmap_lock_read(mapping); mutex_lock(&hugetlb_fault_mutex_table[hash]); goto out; } @@ -3926,6 +3943,11 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, ptep = huge_pte_offset(mm, haddr, huge_page_size(h)); if (ptep) { + /* + * Since we hold no locks, ptep could be stale. That is + * OK as we are only making decisions based on content and + * not actually modifying content here. + */ entry = huge_ptep_get(ptep); if (unlikely(is_hugetlb_entry_migration(entry))) { migration_entry_wait_huge(vma, mm, ptep); @@ -3933,20 +3955,31 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, } else if (unlikely(is_hugetlb_entry_hwpoisoned(entry))) return VM_FAULT_HWPOISON_LARGE | VM_FAULT_SET_HINDEX(hstate_index(h)); - } else { - ptep = huge_pte_alloc(mm, haddr, huge_page_size(h)); - if (!ptep) - return VM_FAULT_OOM; } + /* + * Acquire i_mmap_rwsem before calling huge_pte_alloc and hold + * until finished with ptep. This prevents huge_pmd_unshare from + * being called elsewhere and making the ptep no longer valid. + * + * ptep could have already be assigned via huge_pte_offset. That + * is OK, as huge_pte_alloc will return the same value unless + * something changed. + */ mapping = vma->vm_file->f_mapping; - idx = vma_hugecache_offset(h, vma, haddr); + i_mmap_lock_read(mapping); + ptep = huge_pte_alloc(mm, haddr, huge_page_size(h)); + if (!ptep) { + i_mmap_unlock_read(mapping); + return VM_FAULT_OOM; + } /* * Serialize hugepage allocation and instantiation, so that we don't * get spurious allocation failures if two CPUs race to instantiate * the same page in the page cache. */ + idx = vma_hugecache_offset(h, vma, haddr); hash = hugetlb_fault_mutex_hash(h, mm, vma, mapping, idx, haddr); mutex_lock(&hugetlb_fault_mutex_table[hash]); @@ -4034,6 +4067,7 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, } out_mutex: mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); /* * Generally it's safe to hold refcount during waiting page lock. But * here we just wait to defer the next page fault to avoid busy loop and @@ -4638,10 +4672,12 @@ void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, * Search for a shareable pmd page for hugetlb. In any case calls pmd_alloc() * and returns the corresponding pte. While this is not necessary for the * !shared pmd case because we can allocate the pmd later as well, it makes the - * code much cleaner. pmd allocation is essential for the shared case because - * pud has to be populated inside the same i_mmap_rwsem section - otherwise - * racing tasks could either miss the sharing (see huge_pte_offset) or select a - * bad pmd for sharing. + * code much cleaner. + * + * This routine must be called with i_mmap_rwsem held in at least read mode. + * For hugetlbfs, this prevents removal of any page table entries associated + * with the address space. This is important as we are setting up sharing + * based on existing page table entries (mappings). */ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) { @@ -4658,7 +4694,6 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) if (!vma_shareable(vma, addr)) return (pte_t *)pmd_alloc(mm, pud, addr); - i_mmap_lock_write(mapping); vma_interval_tree_foreach(svma, &mapping->i_mmap, idx, idx) { if (svma == vma) continue; @@ -4688,7 +4723,6 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) spin_unlock(ptl); out: pte = (pte_t *)pmd_alloc(mm, pud, addr); - i_mmap_unlock_write(mapping); return pte; } @@ -4699,7 +4733,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) * indicated by page_count > 1, unmap is achieved by clearing pud and * decrementing the ref count. If count == 1, the pte page is not shared. * - * called with page table lock held. + * Called with page table lock held and i_mmap_rwsem held in write mode. * * returns: 1 successfully unmapped a shared pte page * 0 the underlying pte page is not shared, or it is the last user diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 7c72f2a95785..6379fff1a5ff 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -966,7 +966,7 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn, enum ttu_flags ttu = TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS; struct address_space *mapping; LIST_HEAD(tokill); - bool unmap_success; + bool unmap_success = true; int kill = 1, forcekill; struct page *hpage = *hpagep; bool mlocked = PageMlocked(hpage); @@ -1028,7 +1028,19 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn, if (kill) collect_procs(hpage, &tokill, flags & MF_ACTION_REQUIRED); - unmap_success = try_to_unmap(hpage, ttu); + if (!PageHuge(hpage)) { + unmap_success = try_to_unmap(hpage, ttu); + } else if (mapping) { + /* + * For hugetlb pages, try_to_unmap could potentially call + * huge_pmd_unshare. Because of this, take semaphore in + * write mode here and set TTU_RMAP_LOCKED to indicate we + * have taken the lock at this higer level. + */ + i_mmap_lock_write(mapping); + unmap_success = try_to_unmap(hpage, ttu|TTU_RMAP_LOCKED); + i_mmap_unlock_write(mapping); + } if (!unmap_success) pr_err("Memory failure: %#lx: failed to unmap page (mapcount=%d)\n", pfn, page_mapcount(hpage)); diff --git a/mm/migrate.c b/mm/migrate.c index 4389696fba0e..5d1839a9148d 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -1324,8 +1324,19 @@ static int unmap_and_move_huge_page(new_page_t get_new_page, goto put_anon; if (page_mapped(hpage)) { + struct address_space *mapping = page_mapping(hpage); + + /* + * try_to_unmap could potentially call huge_pmd_unshare. + * Because of this, take semaphore in write mode here and + * set TTU_RMAP_LOCKED to let lower levels know we have + * taken the lock. + */ + i_mmap_lock_write(mapping); try_to_unmap(hpage, - TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS); + TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS| + TTU_RMAP_LOCKED); + i_mmap_unlock_write(mapping); page_was_mapped = 1; } diff --git a/mm/rmap.c b/mm/rmap.c index 68a1a5b869a5..21a26cf51114 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -25,6 +25,7 @@ * page->flags PG_locked (lock_page) * hugetlbfs_i_mmap_rwsem_key (in huge_pmd_share) * mapping->i_mmap_rwsem + * hugetlb_fault_mutex (hugetlbfs specific page fault mutex) * anon_vma->rwsem * mm->page_table_lock or pte_lock * zone_lru_lock (in mark_page_accessed, isolate_lru_page) @@ -1378,6 +1379,9 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma, /* * If sharing is possible, start and end will be adjusted * accordingly. + * + * If called for a huge page, caller must hold i_mmap_rwsem + * in write mode as it is possible to call huge_pmd_unshare. */ adjust_range_if_pmd_sharing_possible(vma, &range.start, &range.end); diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c index 458acda96f20..48368589f519 100644 --- a/mm/userfaultfd.c +++ b/mm/userfaultfd.c @@ -267,10 +267,14 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm, VM_BUG_ON(dst_addr & ~huge_page_mask(h)); /* - * Serialize via hugetlb_fault_mutex + * Serialize via i_mmap_rwsem and hugetlb_fault_mutex. + * i_mmap_rwsem ensures the dst_pte remains valid even + * in the case of shared pmds. fault mutex prevents + * races with other faulting threads. */ - idx = linear_page_index(dst_vma, dst_addr); mapping = dst_vma->vm_file->f_mapping; + i_mmap_lock_read(mapping); + idx = linear_page_index(dst_vma, dst_addr); hash = hugetlb_fault_mutex_hash(h, dst_mm, dst_vma, mapping, idx, dst_addr); mutex_lock(&hugetlb_fault_mutex_table[hash]); @@ -279,6 +283,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm, dst_pte = huge_pte_alloc(dst_mm, dst_addr, huge_page_size(h)); if (!dst_pte) { mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); goto out_unlock; } @@ -286,6 +291,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm, dst_pteval = huge_ptep_get(dst_pte); if (!huge_pte_none(dst_pteval)) { mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); goto out_unlock; } @@ -293,6 +299,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm, dst_addr, src_addr, &page); mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); vm_alloc_shared = vm_shared; cond_resched();

6 years, 8 months

1
0
0 0

FAILED: patch "[PATCH] hugetlbfs: use i_mmap_rwsem for more pmd sharing" failed to apply to 4.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From b43a9990055958e70347c56f90ea2ae32c67334c Mon Sep 17 00:00:00 2001 From: Mike Kravetz <mike.kravetz(a)oracle.com> Date: Fri, 28 Dec 2018 00:39:38 -0800 Subject: [PATCH] hugetlbfs: use i_mmap_rwsem for more pmd sharing synchronization While looking at BUGs associated with invalid huge page map counts, it was discovered and observed that a huge pte pointer could become 'invalid' and point to another task's page table. Consider the following: A task takes a page fault on a shared hugetlbfs file and calls huge_pte_alloc to get a ptep. Suppose the returned ptep points to a shared pmd. Now, another task truncates the hugetlbfs file. As part of truncation, it unmaps everyone who has the file mapped. If the range being truncated is covered by a shared pmd, huge_pmd_unshare will be called. For all but the last user of the shared pmd, huge_pmd_unshare will clear the pud pointing to the pmd. If the task in the middle of the page fault is not the last user, the ptep returned by huge_pte_alloc now points to another task's page table or worse. This leads to bad things such as incorrect page map/reference counts or invalid memory references. To fix, expand the use of i_mmap_rwsem as follows: - i_mmap_rwsem is held in read mode whenever huge_pmd_share is called. huge_pmd_share is only called via huge_pte_alloc, so callers of huge_pte_alloc take i_mmap_rwsem before calling. In addition, callers of huge_pte_alloc continue to hold the semaphore until finished with the ptep. - i_mmap_rwsem is held in write mode whenever huge_pmd_unshare is called. [mike.kravetz(a)oracle.com: add explicit check for mapping != null] Link: http://lkml.kernel.org/r/20181218223557.5202-2-mike.kravetz@oracle.com Fixes: 39dde65c9940 ("shared page table for hugetlb page") Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com> Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Hugh Dickins <hughd(a)google.com> Cc: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com> Cc: "Aneesh Kumar K . V" <aneesh.kumar(a)linux.vnet.ibm.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: Prakash Sangappa <prakash.sangappa(a)oracle.com> Cc: Colin Ian King <colin.king(a)canonical.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 12000ba5c868..87fd3ab809c6 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3238,6 +3238,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, struct page *ptepage; unsigned long addr; int cow; + struct address_space *mapping = vma->vm_file->f_mapping; struct hstate *h = hstate_vma(vma); unsigned long sz = huge_page_size(h); struct mmu_notifier_range range; @@ -3249,13 +3250,23 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, mmu_notifier_range_init(&range, src, vma->vm_start, vma->vm_end); mmu_notifier_invalidate_range_start(&range); + } else { + /* + * For shared mappings i_mmap_rwsem must be held to call + * huge_pte_alloc, otherwise the returned ptep could go + * away if part of a shared pmd and another thread calls + * huge_pmd_unshare. + */ + i_mmap_lock_read(mapping); } for (addr = vma->vm_start; addr < vma->vm_end; addr += sz) { spinlock_t *src_ptl, *dst_ptl; + src_pte = huge_pte_offset(src, addr, sz); if (!src_pte) continue; + dst_pte = huge_pte_alloc(dst, addr, sz); if (!dst_pte) { ret = -ENOMEM; @@ -3326,6 +3337,8 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, if (cow) mmu_notifier_invalidate_range_end(&range); + else + i_mmap_unlock_read(mapping); return ret; } @@ -3771,14 +3784,18 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, }; /* - * hugetlb_fault_mutex must be dropped before - * handling userfault. Reacquire after handling - * fault to make calling code simpler. + * hugetlb_fault_mutex and i_mmap_rwsem must be + * dropped before handling userfault. Reacquire + * after handling fault to make calling code simpler. */ hash = hugetlb_fault_mutex_hash(h, mm, vma, mapping, idx, haddr); mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); + ret = handle_userfault(&vmf, VM_UFFD_MISSING); + + i_mmap_lock_read(mapping); mutex_lock(&hugetlb_fault_mutex_table[hash]); goto out; } @@ -3926,6 +3943,11 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, ptep = huge_pte_offset(mm, haddr, huge_page_size(h)); if (ptep) { + /* + * Since we hold no locks, ptep could be stale. That is + * OK as we are only making decisions based on content and + * not actually modifying content here. + */ entry = huge_ptep_get(ptep); if (unlikely(is_hugetlb_entry_migration(entry))) { migration_entry_wait_huge(vma, mm, ptep); @@ -3933,20 +3955,31 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, } else if (unlikely(is_hugetlb_entry_hwpoisoned(entry))) return VM_FAULT_HWPOISON_LARGE | VM_FAULT_SET_HINDEX(hstate_index(h)); - } else { - ptep = huge_pte_alloc(mm, haddr, huge_page_size(h)); - if (!ptep) - return VM_FAULT_OOM; } + /* + * Acquire i_mmap_rwsem before calling huge_pte_alloc and hold + * until finished with ptep. This prevents huge_pmd_unshare from + * being called elsewhere and making the ptep no longer valid. + * + * ptep could have already be assigned via huge_pte_offset. That + * is OK, as huge_pte_alloc will return the same value unless + * something changed. + */ mapping = vma->vm_file->f_mapping; - idx = vma_hugecache_offset(h, vma, haddr); + i_mmap_lock_read(mapping); + ptep = huge_pte_alloc(mm, haddr, huge_page_size(h)); + if (!ptep) { + i_mmap_unlock_read(mapping); + return VM_FAULT_OOM; + } /* * Serialize hugepage allocation and instantiation, so that we don't * get spurious allocation failures if two CPUs race to instantiate * the same page in the page cache. */ + idx = vma_hugecache_offset(h, vma, haddr); hash = hugetlb_fault_mutex_hash(h, mm, vma, mapping, idx, haddr); mutex_lock(&hugetlb_fault_mutex_table[hash]); @@ -4034,6 +4067,7 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, } out_mutex: mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); /* * Generally it's safe to hold refcount during waiting page lock. But * here we just wait to defer the next page fault to avoid busy loop and @@ -4638,10 +4672,12 @@ void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, * Search for a shareable pmd page for hugetlb. In any case calls pmd_alloc() * and returns the corresponding pte. While this is not necessary for the * !shared pmd case because we can allocate the pmd later as well, it makes the - * code much cleaner. pmd allocation is essential for the shared case because - * pud has to be populated inside the same i_mmap_rwsem section - otherwise - * racing tasks could either miss the sharing (see huge_pte_offset) or select a - * bad pmd for sharing. + * code much cleaner. + * + * This routine must be called with i_mmap_rwsem held in at least read mode. + * For hugetlbfs, this prevents removal of any page table entries associated + * with the address space. This is important as we are setting up sharing + * based on existing page table entries (mappings). */ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) { @@ -4658,7 +4694,6 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) if (!vma_shareable(vma, addr)) return (pte_t *)pmd_alloc(mm, pud, addr); - i_mmap_lock_write(mapping); vma_interval_tree_foreach(svma, &mapping->i_mmap, idx, idx) { if (svma == vma) continue; @@ -4688,7 +4723,6 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) spin_unlock(ptl); out: pte = (pte_t *)pmd_alloc(mm, pud, addr); - i_mmap_unlock_write(mapping); return pte; } @@ -4699,7 +4733,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) * indicated by page_count > 1, unmap is achieved by clearing pud and * decrementing the ref count. If count == 1, the pte page is not shared. * - * called with page table lock held. + * Called with page table lock held and i_mmap_rwsem held in write mode. * * returns: 1 successfully unmapped a shared pte page * 0 the underlying pte page is not shared, or it is the last user diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 7c72f2a95785..6379fff1a5ff 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -966,7 +966,7 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn, enum ttu_flags ttu = TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS; struct address_space *mapping; LIST_HEAD(tokill); - bool unmap_success; + bool unmap_success = true; int kill = 1, forcekill; struct page *hpage = *hpagep; bool mlocked = PageMlocked(hpage); @@ -1028,7 +1028,19 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn, if (kill) collect_procs(hpage, &tokill, flags & MF_ACTION_REQUIRED); - unmap_success = try_to_unmap(hpage, ttu); + if (!PageHuge(hpage)) { + unmap_success = try_to_unmap(hpage, ttu); + } else if (mapping) { + /* + * For hugetlb pages, try_to_unmap could potentially call + * huge_pmd_unshare. Because of this, take semaphore in + * write mode here and set TTU_RMAP_LOCKED to indicate we + * have taken the lock at this higer level. + */ + i_mmap_lock_write(mapping); + unmap_success = try_to_unmap(hpage, ttu|TTU_RMAP_LOCKED); + i_mmap_unlock_write(mapping); + } if (!unmap_success) pr_err("Memory failure: %#lx: failed to unmap page (mapcount=%d)\n", pfn, page_mapcount(hpage)); diff --git a/mm/migrate.c b/mm/migrate.c index 4389696fba0e..5d1839a9148d 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -1324,8 +1324,19 @@ static int unmap_and_move_huge_page(new_page_t get_new_page, goto put_anon; if (page_mapped(hpage)) { + struct address_space *mapping = page_mapping(hpage); + + /* + * try_to_unmap could potentially call huge_pmd_unshare. + * Because of this, take semaphore in write mode here and + * set TTU_RMAP_LOCKED to let lower levels know we have + * taken the lock. + */ + i_mmap_lock_write(mapping); try_to_unmap(hpage, - TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS); + TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS| + TTU_RMAP_LOCKED); + i_mmap_unlock_write(mapping); page_was_mapped = 1; } diff --git a/mm/rmap.c b/mm/rmap.c index 68a1a5b869a5..21a26cf51114 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -25,6 +25,7 @@ * page->flags PG_locked (lock_page) * hugetlbfs_i_mmap_rwsem_key (in huge_pmd_share) * mapping->i_mmap_rwsem + * hugetlb_fault_mutex (hugetlbfs specific page fault mutex) * anon_vma->rwsem * mm->page_table_lock or pte_lock * zone_lru_lock (in mark_page_accessed, isolate_lru_page) @@ -1378,6 +1379,9 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma, /* * If sharing is possible, start and end will be adjusted * accordingly. + * + * If called for a huge page, caller must hold i_mmap_rwsem + * in write mode as it is possible to call huge_pmd_unshare. */ adjust_range_if_pmd_sharing_possible(vma, &range.start, &range.end); diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c index 458acda96f20..48368589f519 100644 --- a/mm/userfaultfd.c +++ b/mm/userfaultfd.c @@ -267,10 +267,14 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm, VM_BUG_ON(dst_addr & ~huge_page_mask(h)); /* - * Serialize via hugetlb_fault_mutex + * Serialize via i_mmap_rwsem and hugetlb_fault_mutex. + * i_mmap_rwsem ensures the dst_pte remains valid even + * in the case of shared pmds. fault mutex prevents + * races with other faulting threads. */ - idx = linear_page_index(dst_vma, dst_addr); mapping = dst_vma->vm_file->f_mapping; + i_mmap_lock_read(mapping); + idx = linear_page_index(dst_vma, dst_addr); hash = hugetlb_fault_mutex_hash(h, dst_mm, dst_vma, mapping, idx, dst_addr); mutex_lock(&hugetlb_fault_mutex_table[hash]); @@ -279,6 +283,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm, dst_pte = huge_pte_alloc(dst_mm, dst_addr, huge_page_size(h)); if (!dst_pte) { mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); goto out_unlock; } @@ -286,6 +291,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm, dst_pteval = huge_ptep_get(dst_pte); if (!huge_pte_none(dst_pteval)) { mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); goto out_unlock; } @@ -293,6 +299,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm, dst_addr, src_addr, &page); mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); vm_alloc_shared = vm_shared; cond_resched();

6 years, 8 months

1
0
0 0

FAILED: patch "[PATCH] mm, hmm: replace hmm_devmem_pages_create() with" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From bbecd94e6c514a1559fc1a7749a62715958137b1 Mon Sep 17 00:00:00 2001 From: Dan Williams <dan.j.williams(a)intel.com> Date: Fri, 28 Dec 2018 00:35:11 -0800 Subject: [PATCH] mm, hmm: replace hmm_devmem_pages_create() with devm_memremap_pages() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Commit e8d513483300 ("memremap: change devm_memremap_pages interface to use struct dev_pagemap") refactored devm_memremap_pages() to allow a dev_pagemap instance to be supplied. Passing in a dev_pagemap interface simplifies the design of pgmap type drivers in that they can rely on container_of() to lookup any private data associated with the given dev_pagemap instance. In addition to the cleanups this also gives hmm users multi-order-radix improvements that arrived with commit ab1b597ee0e4 "mm, devm_memremap_pages: use multi-order radix for ZONE_DEVICE lookups" As part of the conversion to the devm_memremap_pages() method of handling the percpu_ref relative to when pages are put, the percpu_ref completion needs to move to hmm_devmem_ref_exit(). See 71389703839e ("mm, zone_device: Replace {get, put}_zone_device_page...") for details. Link: http://lkml.kernel.org/r/154275560053.76910.10870962637383152392.stgit@dwil… Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Jérôme Glisse <jglisse(a)redhat.com> Acked-by: Balbir Singh <bsingharora(a)gmail.com> Cc: Logan Gunthorpe <logang(a)deltatee.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> diff --git a/mm/hmm.c b/mm/hmm.c index 8510881e7b44..bf2495d9de81 100644 --- a/mm/hmm.c +++ b/mm/hmm.c @@ -986,17 +986,16 @@ static void hmm_devmem_ref_exit(void *data) struct hmm_devmem *devmem; devmem = container_of(ref, struct hmm_devmem, ref); + wait_for_completion(&devmem->completion); percpu_ref_exit(ref); } -static void hmm_devmem_ref_kill(void *data) +static void hmm_devmem_ref_kill(struct percpu_ref *ref) { - struct percpu_ref *ref = data; struct hmm_devmem *devmem; devmem = container_of(ref, struct hmm_devmem, ref); percpu_ref_kill(ref); - wait_for_completion(&devmem->completion); } static int hmm_devmem_fault(struct vm_area_struct *vma, @@ -1019,154 +1018,6 @@ static void hmm_devmem_free(struct page *page, void *data) devmem->ops->free(devmem, page); } -static DEFINE_MUTEX(hmm_devmem_lock); -static RADIX_TREE(hmm_devmem_radix, GFP_KERNEL); - -static void hmm_devmem_radix_release(struct resource *resource) -{ - resource_size_t key; - - mutex_lock(&hmm_devmem_lock); - for (key = resource->start; - key <= resource->end; - key += PA_SECTION_SIZE) - radix_tree_delete(&hmm_devmem_radix, key >> PA_SECTION_SHIFT); - mutex_unlock(&hmm_devmem_lock); -} - -static void hmm_devmem_release(void *data) -{ - struct hmm_devmem *devmem = data; - struct resource *resource = devmem->resource; - unsigned long start_pfn, npages; - struct zone *zone; - struct page *page; - - /* pages are dead and unused, undo the arch mapping */ - start_pfn = (resource->start & ~(PA_SECTION_SIZE - 1)) >> PAGE_SHIFT; - npages = ALIGN(resource_size(resource), PA_SECTION_SIZE) >> PAGE_SHIFT; - - page = pfn_to_page(start_pfn); - zone = page_zone(page); - - mem_hotplug_begin(); - if (resource->desc == IORES_DESC_DEVICE_PRIVATE_MEMORY) - __remove_pages(zone, start_pfn, npages, NULL); - else - arch_remove_memory(start_pfn << PAGE_SHIFT, - npages << PAGE_SHIFT, NULL); - mem_hotplug_done(); - - hmm_devmem_radix_release(resource); -} - -static int hmm_devmem_pages_create(struct hmm_devmem *devmem) -{ - resource_size_t key, align_start, align_size, align_end; - struct device *device = devmem->device; - int ret, nid, is_ram; - - align_start = devmem->resource->start & ~(PA_SECTION_SIZE - 1); - align_size = ALIGN(devmem->resource->start + - resource_size(devmem->resource), - PA_SECTION_SIZE) - align_start; - - is_ram = region_intersects(align_start, align_size, - IORESOURCE_SYSTEM_RAM, - IORES_DESC_NONE); - if (is_ram == REGION_MIXED) { - WARN_ONCE(1, "%s attempted on mixed region %pr\n", - __func__, devmem->resource); - return -ENXIO; - } - if (is_ram == REGION_INTERSECTS) - return -ENXIO; - - if (devmem->resource->desc == IORES_DESC_DEVICE_PUBLIC_MEMORY) - devmem->pagemap.type = MEMORY_DEVICE_PUBLIC; - else - devmem->pagemap.type = MEMORY_DEVICE_PRIVATE; - - devmem->pagemap.res = *devmem->resource; - devmem->pagemap.page_fault = hmm_devmem_fault; - devmem->pagemap.page_free = hmm_devmem_free; - devmem->pagemap.dev = devmem->device; - devmem->pagemap.ref = &devmem->ref; - devmem->pagemap.data = devmem; - - mutex_lock(&hmm_devmem_lock); - align_end = align_start + align_size - 1; - for (key = align_start; key <= align_end; key += PA_SECTION_SIZE) { - struct hmm_devmem *dup; - - dup = radix_tree_lookup(&hmm_devmem_radix, - key >> PA_SECTION_SHIFT); - if (dup) { - dev_err(device, "%s: collides with mapping for %s\n", - __func__, dev_name(dup->device)); - mutex_unlock(&hmm_devmem_lock); - ret = -EBUSY; - goto error; - } - ret = radix_tree_insert(&hmm_devmem_radix, - key >> PA_SECTION_SHIFT, - devmem); - if (ret) { - dev_err(device, "%s: failed: %d\n", __func__, ret); - mutex_unlock(&hmm_devmem_lock); - goto error_radix; - } - } - mutex_unlock(&hmm_devmem_lock); - - nid = dev_to_node(device); - if (nid < 0) - nid = numa_mem_id(); - - mem_hotplug_begin(); - /* - * For device private memory we call add_pages() as we only need to - * allocate and initialize struct page for the device memory. More- - * over the device memory is un-accessible thus we do not want to - * create a linear mapping for the memory like arch_add_memory() - * would do. - * - * For device public memory, which is accesible by the CPU, we do - * want the linear mapping and thus use arch_add_memory(). - */ - if (devmem->pagemap.type == MEMORY_DEVICE_PUBLIC) - ret = arch_add_memory(nid, align_start, align_size, NULL, - false); - else - ret = add_pages(nid, align_start >> PAGE_SHIFT, - align_size >> PAGE_SHIFT, NULL, false); - if (ret) { - mem_hotplug_done(); - goto error_add_memory; - } - move_pfn_range_to_zone(&NODE_DATA(nid)->node_zones[ZONE_DEVICE], - align_start >> PAGE_SHIFT, - align_size >> PAGE_SHIFT, NULL); - mem_hotplug_done(); - - /* - * Initialization of the pages has been deferred until now in order - * to allow us to do the work while not holding the hotplug lock. - */ - memmap_init_zone_device(&NODE_DATA(nid)->node_zones[ZONE_DEVICE], - align_start >> PAGE_SHIFT, - align_size >> PAGE_SHIFT, &devmem->pagemap); - - return 0; - -error_add_memory: - untrack_pfn(NULL, PHYS_PFN(align_start), align_size); -error_radix: - hmm_devmem_radix_release(devmem->resource); -error: - return ret; -} - /* * hmm_devmem_add() - hotplug ZONE_DEVICE memory for device memory * @@ -1190,6 +1041,7 @@ struct hmm_devmem *hmm_devmem_add(const struct hmm_devmem_ops *ops, { struct hmm_devmem *devmem; resource_size_t addr; + void *result; int ret; dev_pagemap_get_ops(); @@ -1244,14 +1096,18 @@ struct hmm_devmem *hmm_devmem_add(const struct hmm_devmem_ops *ops, devmem->pfn_last = devmem->pfn_first + (resource_size(devmem->resource) >> PAGE_SHIFT); - ret = hmm_devmem_pages_create(devmem); - if (ret) - return ERR_PTR(ret); - - ret = devm_add_action_or_reset(device, hmm_devmem_release, devmem); - if (ret) - return ERR_PTR(ret); + devmem->pagemap.type = MEMORY_DEVICE_PRIVATE; + devmem->pagemap.res = *devmem->resource; + devmem->pagemap.page_fault = hmm_devmem_fault; + devmem->pagemap.page_free = hmm_devmem_free; + devmem->pagemap.altmap_valid = false; + devmem->pagemap.ref = &devmem->ref; + devmem->pagemap.data = devmem; + devmem->pagemap.kill = hmm_devmem_ref_kill; + result = devm_memremap_pages(devmem->device, &devmem->pagemap); + if (IS_ERR(result)) + return result; return devmem; } EXPORT_SYMBOL(hmm_devmem_add); @@ -1261,6 +1117,7 @@ struct hmm_devmem *hmm_devmem_add_resource(const struct hmm_devmem_ops *ops, struct resource *res) { struct hmm_devmem *devmem; + void *result; int ret; if (res->desc != IORES_DESC_DEVICE_PUBLIC_MEMORY) @@ -1293,19 +1150,18 @@ struct hmm_devmem *hmm_devmem_add_resource(const struct hmm_devmem_ops *ops, devmem->pfn_last = devmem->pfn_first + (resource_size(devmem->resource) >> PAGE_SHIFT); - ret = hmm_devmem_pages_create(devmem); - if (ret) - return ERR_PTR(ret); - - ret = devm_add_action_or_reset(device, hmm_devmem_release, devmem); - if (ret) - return ERR_PTR(ret); - - ret = devm_add_action_or_reset(device, hmm_devmem_ref_kill, - &devmem->ref); - if (ret) - return ERR_PTR(ret); + devmem->pagemap.type = MEMORY_DEVICE_PUBLIC; + devmem->pagemap.res = *devmem->resource; + devmem->pagemap.page_fault = hmm_devmem_fault; + devmem->pagemap.page_free = hmm_devmem_free; + devmem->pagemap.altmap_valid = false; + devmem->pagemap.ref = &devmem->ref; + devmem->pagemap.data = devmem; + devmem->pagemap.kill = hmm_devmem_ref_kill; + result = devm_memremap_pages(devmem->device, &devmem->pagemap); + if (IS_ERR(result)) + return result; return devmem; } EXPORT_SYMBOL(hmm_devmem_add_resource);

6 years, 8 months

1
0
0 0

v4.20.1 build: 0 failures 4 warnings (v4.20.1)

by Build bot for Mark Brown

Tree/Branch: v4.20.1 Git describe: v4.20.1 Commit: 8c3f48e8c2 Linux 4.20.1 Build Time: 130 min 9 sec Passed: 11 / 11 (100.00 %) Failed: 0 / 11 ( 0.00 %) Errors: 0 Warnings: 4 Section Mismatches: 0 ------------------------------------------------------------------------------- defconfigs with issues (other than build errors): 1 warnings 0 mismatches : arm64-allmodconfig 3 warnings 0 mismatches : arm-allmodconfig ------------------------------------------------------------------------------- Warnings Summary: 4 1 ../drivers/staging/erofs/unzip_vle.c:188:29: warning: array subscript is above array bounds [-Warray-bounds] 1 ../drivers/scsi/myrs.c:821:24: warning: 'sshdr.sense_key' may be used uninitialized in this function [-Wmaybe-uninitialized] 1 ../drivers/net/ethernet/mellanox/mlx5/core/en_stats.c:216:1: warning: the frame size of 1064 bytes is larger than 1024 bytes [-Wframe-larger-than=] 1 ../drivers/isdn/hardware/eicon/message.c:5985:1: warning: the frame size of 2064 bytes is larger than 2048 bytes [-Wframe-larger-than=] =============================================================================== Detailed per-defconfig build reports below: ------------------------------------------------------------------------------- arm64-allmodconfig : PASS, 0 errors, 1 warnings, 0 section mismatches Warnings: ../drivers/isdn/hardware/eicon/message.c:5985:1: warning: the frame size of 2064 bytes is larger than 2048 bytes [-Wframe-larger-than=] ------------------------------------------------------------------------------- arm-allmodconfig : PASS, 0 errors, 3 warnings, 0 section mismatches Warnings: ../drivers/net/ethernet/mellanox/mlx5/core/en_stats.c:216:1: warning: the frame size of 1064 bytes is larger than 1024 bytes [-Wframe-larger-than=] ../drivers/scsi/myrs.c:821:24: warning: 'sshdr.sense_key' may be used uninitialized in this function [-Wmaybe-uninitialized] ../drivers/staging/erofs/unzip_vle.c:188:29: warning: array subscript is above array bounds [-Warray-bounds] ------------------------------------------------------------------------------- Passed with no errors, warnings or mismatches: arm64-allnoconfig arm-multi_v5_defconfig arm-multi_v7_defconfig x86_64-defconfig arm-allnoconfig x86_64-allnoconfig arm-multi_v4t_defconfig x86_64-allmodconfig arm64-defconfig

6 years, 8 months

1
0
0 0

[PATCH v4 1/2] crypto: talitos - reorder code in talitos_edesc_alloc()

by Christophe Leroy

This patch moves the mapping of IV after the kmalloc(). This avoids having to unmap in case kmalloc() fails. Signed-off-by: Christophe Leroy <christophe.leroy(a)c-s.fr> --- new in v4 drivers/crypto/talitos.c | 25 +++++++------------------ 1 file changed, 7 insertions(+), 18 deletions(-) diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c index 45e20707cef8..54d80e7edb86 100644 --- a/drivers/crypto/talitos.c +++ b/drivers/crypto/talitos.c @@ -1361,23 +1361,18 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev, struct talitos_private *priv = dev_get_drvdata(dev); bool is_sec1 = has_ftr_sec1(priv); int max_len = is_sec1 ? TALITOS1_MAX_DATA_LEN : TALITOS2_MAX_DATA_LEN; - void *err; if (cryptlen + authsize > max_len) { dev_err(dev, "length exceeds h/w max limit\n"); return ERR_PTR(-EINVAL); } - if (ivsize) - iv_dma = dma_map_single(dev, iv, ivsize, DMA_TO_DEVICE); - if (!dst || dst == src) { src_len = assoclen + cryptlen + authsize; src_nents = sg_nents_for_len(src, src_len); if (src_nents < 0) { dev_err(dev, "Invalid number of src SG.\n"); - err = ERR_PTR(-EINVAL); - goto error_sg; + return ERR_PTR(-EINVAL); } src_nents = (src_nents == 1) ? 0 : src_nents; dst_nents = dst ? src_nents : 0; @@ -1387,16 +1382,14 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev, src_nents = sg_nents_for_len(src, src_len); if (src_nents < 0) { dev_err(dev, "Invalid number of src SG.\n"); - err = ERR_PTR(-EINVAL); - goto error_sg; + return ERR_PTR(-EINVAL); } src_nents = (src_nents == 1) ? 0 : src_nents; dst_len = assoclen + cryptlen + (encrypt ? authsize : 0); dst_nents = sg_nents_for_len(dst, dst_len); if (dst_nents < 0) { dev_err(dev, "Invalid number of dst SG.\n"); - err = ERR_PTR(-EINVAL); - goto error_sg; + return ERR_PTR(-EINVAL); } dst_nents = (dst_nents == 1) ? 0 : dst_nents; } @@ -1425,10 +1418,10 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev, alloc_len += sizeof(struct talitos_desc); edesc = kmalloc(alloc_len, GFP_DMA | flags); - if (!edesc) { - err = ERR_PTR(-ENOMEM); - goto error_sg; - } + if (!edesc) + return ERR_PTR(-ENOMEM); + if (ivsize) + iv_dma = dma_map_single(dev, iv, ivsize, DMA_TO_DEVICE); memset(&edesc->desc, 0, sizeof(edesc->desc)); edesc->src_nents = src_nents; @@ -1445,10 +1438,6 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev, DMA_BIDIRECTIONAL); } return edesc; -error_sg: - if (iv_dma) - dma_unmap_single(dev, iv_dma, ivsize, DMA_TO_DEVICE); - return err; } static struct talitos_edesc *aead_edesc_alloc(struct aead_request *areq, u8 *iv, -- 2.13.3

6 years, 8 months

3
5
0 0

[PATCH] crypto:authencesn: Avoid twice completion call in decrypt path

by Harsh Jain

Authencesn template in decrypt path unconditionally calls aead_request_complete after ahash_verify which leads to following kernel panic in after decryption. [ 338.539800] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004 [ 338.548372] PGD 0 P4D 0 [ 338.551157] Oops: 0000 [#1] SMP PTI [ 338.554919] CPU: 0 PID: 0 Comm: swapper/0 Kdump: loaded Tainted: G W I 4.19.7+ #13 [ 338.564431] Hardware name: Supermicro X8ST3/X8ST3, BIOS 2.0 07/29/10 [ 338.572212] RIP: 0010:esp_input_done2+0x350/0x410 [esp4] [ 338.578030] Code: ff 0f b6 68 10 48 8b 83 c8 00 00 00 e9 8e fe ff ff 8b 04 25 04 00 00 00 83 e8 01 48 98 48 8b 3c c5 10 00 00 00 e9 f7 fd ff ff <8b> 04 25 04 00 00 00 83 e8 01 48 98 4c 8b 24 c5 10 00 00 00 e9 3b [ 338.598547] RSP: 0018:ffff911c97803c00 EFLAGS: 00010246 [ 338.604268] RAX: 0000000000000002 RBX: ffff911c4469ee00 RCX: 0000000000000000 [ 338.612090] RDX: 0000000000000000 RSI: 0000000000000130 RDI: ffff911b87c20400 [ 338.619874] RBP: 0000000000000000 R08: ffff911b87c20498 R09: 000000000000000a [ 338.627610] R10: 0000000000000001 R11: 0000000000000004 R12: 0000000000000000 [ 338.635402] R13: ffff911c89590000 R14: ffff911c91730000 R15: 0000000000000000 [ 338.643234] FS: 0000000000000000(0000) GS:ffff911c97800000(0000) knlGS:0000000000000000 [ 338.652047] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 338.658299] CR2: 0000000000000004 CR3: 00000001ec20a000 CR4: 00000000000006f0 [ 338.666382] Call Trace: [ 338.669051] <IRQ> [ 338.671254] esp_input_done+0x12/0x20 [esp4] [ 338.675922] chcr_handle_resp+0x3b5/0x790 [chcr] [ 338.680949] cpl_fw6_pld_handler+0x37/0x60 [chcr] [ 338.686080] chcr_uld_rx_handler+0x22/0x50 [chcr] [ 338.691233] uldrx_handler+0x8c/0xc0 [cxgb4] [ 338.695923] process_responses+0x2f0/0x5d0 [cxgb4] [ 338.701177] ? bitmap_find_next_zero_area_off+0x3a/0x90 [ 338.706882] ? matrix_alloc_area.constprop.7+0x60/0x90 [ 338.712517] ? apic_update_irq_cfg+0x82/0xf0 [ 338.717177] napi_rx_handler+0x14/0xe0 [cxgb4] [ 338.722015] net_rx_action+0x2aa/0x3e0 [ 338.726136] __do_softirq+0xcb/0x280 [ 338.730054] irq_exit+0xde/0xf0 [ 338.733504] do_IRQ+0x54/0xd0 [ 338.736745] common_interrupt+0xf/0xf Signed-off-by: Harsh Jain <harsh(a)chelsio.com> Cc: stable(a)vger.kernel.org --- crypto/authencesn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/authencesn.c b/crypto/authencesn.c index 80a25cc..4741fe8 100644 --- a/crypto/authencesn.c +++ b/crypto/authencesn.c @@ -279,7 +279,7 @@ static void authenc_esn_verify_ahash_done(struct crypto_async_request *areq, struct aead_request *req = areq->data; err = err ?: crypto_authenc_esn_decrypt_tail(req, 0); - aead_request_complete(req, err); + authenc_esn_request_complete(req, err); } static int crypto_authenc_esn_decrypt(struct aead_request *req) -- 2.1.4

6 years, 8 months

2
1
0 0

genirq: 'HP FlexFabric 554FLB Adapter' not working with the kernel 4.14.88

by Gaoliang

Hi, After upgrading kernel from 4.14.40 to 4.14.88,I found that 'HP FlexFabric 10Gb 2-port 554FLB Adapter' device is not in use. There are erros in dmesg log. The Server is 'HP FlexServer B390'. Device info: lspci -n | grep 04:00 04:00.2 0c04: 19a2:0714 (rev 01) ... 04:00.2 Fibre Channel: Emulex Corporation OneConnect 10Gb FCoE Initiator (be3) (rev 01) Subsystem: Hewlett-Packard Company NC554FLB 10Gb 2-port FlexFabric Converged Network Adapter Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr+ Stepping- SERR- FastB2B- DisINTx+ Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0, Cache Line Size: 64 bytes Interrupt: pin C routed to IRQ 95 ... Kernel driver in use: lpfc The error info: [ 1046.980480] lpfc 0000:04:00.3: 1:1303 Link Up Event x1 received Data: x1 x0 x4 x0 x0 x0 0 [ 1046.980482] lpfc 0000:04:00.3: 1:(0):2753 PLOGI failure DID:020009 Status:x3/x103 [ 1050.435167] lpfc 0000:04:00.2: 0:(0):2753 PLOGI failure DID:010012 Status:x3/x103 [ 1065.713327] lpfc 0000:04:00.3: 1:(0):2753 PLOGI failure DID:040002 Status:x3/x103 [ 1072.331933] lpfc 0000:04:00.2: 0:(0):2753 PLOGI failure DID:030003 Status:x3/x103 [ 1137.628132] lpfc 0000:04:00.2: 0:(0):0748 abort handler timed out waiting for aborting I/O (xri:x64) to complete: ret 0x2003, ID 2, LUN 0 [ 1137.644257] lpfc 0000:04:00.2: 0:(0):0713 SCSI layer issued Device Reset (2, 0) return x2002 [ 1139.676124] lpfc 0000:04:00.3: 1:(0):0748 abort handler timed out waiting for aborting I/O (xri:x464) to complete: ret 0x2003, ID 4, LUN 0 [ 1139.692242] lpfc 0000:04:00.3: 1:(0):0713 SCSI layer issued Device Reset (4, 0) return x2002 [ 1197.664150] lpfc 0000:04:00.2: 0:(0):0724 I/O flush failure for context LUN : cnt x1 [ 1197.664344] lpfc 0000:04:00.2: 0:(0):0723 SCSI layer issued Target Reset (2, 0) return x2002 [ 1199.704116] lpfc 0000:04:00.3: 1:(0):0724 I/O flush failure for context LUN : cnt x1 [ 1199.704368] lpfc 0000:04:00.3: 1:(0):0723 SCSI layer issued Target Reset (4, 0) return x2002 At the beginning, I thought the lpfc driver itself is the cause of the error.But,the error is still seen when 'lpfc driver' updates to the latest version. To find the root cause and fix it, we checked the kernel version from 4.14.41 to 4.14.88, built and tested the kernel for booting. The commit that caused error after bisect is ef86f3a72adb8a7931f67335560740a7ad696d1d,when I removed the commit the issue went away. Commit info: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… During the test, I also found another issue that the system of 'HP FlexServer B390' server failed to boot by "hpsa driver timeout",basically, looks like the hpsa didn't detect the hard drives and udevd is stalled. After upgrading from v4.14.54 to 4.14.55, hp system didn't boot ,but the system is ok when using the v4.14.55 kernel that has removed the commit. The commit of ef86f3a72adb8a7931f67335560740a7ad696d1d also affects the HP Smart Array P220i RAID device.Because the v4.14.88 kernel is ok, I think that subsequent commits may have fixed the hpsa driver issue, but lpfc driver issue is not. If there is any more info I can provide, just ask what would be useful. Any suggestions? Thanks Liang

6 years, 8 months

2
1
0 0

genirq/affinity: missing fix from the stable branch 4.14.y

by Mihai Carabas

Hello, Is there any reason why the fix with commit id 0211e12dd0a5385ecffd3557bc570dbad7fcf245 [1] was not backported to the stable branch 4.14.y? Thank you, Mihai Carabas [1] https://github.com/torvalds/linux/commit/0211e12dd0a5385ecffd3557bc570dbad7…

6 years, 8 months

2
1
0 0

Re: [PATCH] powerpc/powernv/npu: Fix oops in pnv_try_setup_npu_table_group()

by Greg Kurz

On Wed, 9 Jan 2019 16:13:42 +0100 Frederic Barrat <fbarrat(a)linux.ibm.com> wrote: > With a recent change around IOMMU group, a system with an opencapi > adapter is no longer booting and we get a kernel oops: > > BUG: Kernel NULL pointer dereference at 0x00000028 > Faulting instruction address: 0xc0000000000aa38c > Oops: Kernel access of bad area, sig: 7 [#1] > LE SMP NR_CPUS=2048 NUMA PowerNV > Modules linked in: > CPU: 5 PID: 1 Comm: swapper/4 Not tainted 5.0.0-rc1-fxb-00001-g3bd6e94bec12 > NIP: c0000000000aa38c LR: c0000000000a6608 CTR: c000000000097480 > REGS: c000000005783700 TRAP: 0300 Not tainted (5.0.0-rc1-fxb-00001-g3bd6 > MSR: 9000000002009033 <SF,HV,VEC,EE,ME,IR,DR,RI,LE> CR: 28000228 XER: 20 > CFAR: c0000000000a6604 DAR: 0000000000000028 DSISR: 00080000 IRQMASK: 0 > GPR00: c0000000000a6608 c000000005783990 c000000001036100 c0000007bf761860 > GPR04: 0000000000000000 c000000005783834 0000000000000000 0000000000000000 > GPR08: 69626d2c6e707500 0000000000000000 0000000000000000 9000000002001003 > GPR12: 0000000000000000 c0000007bfff8300 c000000000010450 0000000000000000 > GPR16: c000000000ced938 0000000000000100 c000000000ced948 00000000000a0000 > GPR20: 00000000000bfffe c000000000ced9a8 0000000000000200 c000000000ced978 > GPR24: 00000000006080c0 c000000716d09828 c00000002e6fd000 0000000000000000 > GPR28: c0000007bf4aff68 c0000007bf8d0080 c000000000f23938 c0000007bf761860 > NIP [c0000000000aa38c] pnv_try_setup_npu_table_group+0x1c/0x1a0 > LR [c0000000000a6608] pnv_pci_ioda_fixup+0x1f8/0x660 > Call Trace: > [c000000005783990] [c0000000000aa3d0] pnv_try_setup_npu_table_group+0x60/0x > [c0000000057839d0] [c0000000000a661c] pnv_pci_ioda_fixup+0x20c/0x660 > [c000000005783ab0] [c000000000e1d4c0] pcibios_resource_survey+0x2c8/0x31c > [c000000005783b90] [c000000000e1caf4] pcibios_init+0xb0/0xe4 > [c000000005783c10] [c000000000010054] do_one_initcall+0x64/0x264 > [c000000005783ce0] [c000000000e1132c] kernel_init_freeable+0x36c/0x468 > [c000000005783db0] [c000000000010474] kernel_init+0x2c/0x148 > [c000000005783e20] [c00000000000b794] ret_from_kernel_thread+0x5c/0x68 > > An opencapi device is using a device PE, so the current code breaks > because pe->pbus is not defined. > > More generally, there's no need to define an IOMMU group for opencapi, > as the device sends real addresses directly (admittedly, the > virtualization story is yet to be written). So let's fix it by Current plan is to go for mediated VFIO. The real HW stays under the control of the host ocxl driver, and we still don't need an IOMMU group. > skipping the IOMMU group setup for opencapi PHBs. > > Fixes: 0bd971676e68 ("powerpc/powernv/npu: Add compound IOMMU groups") > Signed-off-by: Frederic Barrat <fbarrat(a)linux.ibm.com> > --- Reviewed-by: Greg Kurz <groug(a)kaod.org> and Cc: stable(a)vger.kernel.org # v4.20 > arch/powerpc/platforms/powernv/pci-ioda.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c > index 1d6406a051f1..7db3119f8a5b 100644 > --- a/arch/powerpc/platforms/powernv/pci-ioda.c > +++ b/arch/powerpc/platforms/powernv/pci-ioda.c > @@ -2681,7 +2681,8 @@ static void pnv_pci_ioda_setup_iommu_api(void) > list_for_each_entry(hose, &hose_list, list_node) { > phb = hose->private_data; > > - if (phb->type == PNV_PHB_NPU_NVLINK) > + if (phb->type == PNV_PHB_NPU_NVLINK || > + phb->type == PNV_PHB_NPU_OCAPI) > continue; > > list_for_each_entry(pe, &phb->ioda.pe_list, list) {

6 years, 8 months

4
7
0 0

FAILED: patch "[PATCH] scsi: megaraid_sas: Use 63-bit DMA addressing" failed to apply to 4.20-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.20-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 894169db12463cea08d0e2a9e35f42b291340e5a Mon Sep 17 00:00:00 2001 From: Shivasharan S <shivasharan.srikanteshwara(a)broadcom.com> Date: Tue, 18 Dec 2018 05:59:54 -0800 Subject: [PATCH] scsi: megaraid_sas: Use 63-bit DMA addressing Although MegaRAID controllers support 64-bit DMA addressing, as per hardware design, DMA address with all 64-bits set (0xFFFFFFFF-FFFFFFFF) results in a firmware fault. Driver will set 63-bit DMA mask to ensure the above address will not be used. Cc: stable(a)vger.kernel.org Signed-off-by: Shivasharan S <shivasharan.srikanteshwara(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c index d0f4075fe36e..f7bdd783360a 100644 --- a/drivers/scsi/megaraid/megaraid_sas_base.c +++ b/drivers/scsi/megaraid/megaraid_sas_base.c @@ -6184,13 +6184,13 @@ static int megasas_io_attach(struct megasas_instance *instance) * @instance: Adapter soft state * Description: * - * For Ventura, driver/FW will operate in 64bit DMA addresses. + * For Ventura, driver/FW will operate in 63bit DMA addresses. * * For invader- * By default, driver/FW will operate in 32bit DMA addresses * for consistent DMA mapping but if 32 bit consistent - * DMA mask fails, driver will try with 64 bit consistent - * mask provided FW is true 64bit DMA capable + * DMA mask fails, driver will try with 63 bit consistent + * mask provided FW is true 63bit DMA capable * * For older controllers(Thunderbolt and MFI based adapters)- * driver/FW will operate in 32 bit consistent DMA addresses. @@ -6204,14 +6204,14 @@ megasas_set_dma_mask(struct megasas_instance *instance) pdev = instance->pdev; consistent_mask = (instance->adapter_type >= VENTURA_SERIES) ? - DMA_BIT_MASK(64) : DMA_BIT_MASK(32); + DMA_BIT_MASK(63) : DMA_BIT_MASK(32); if (IS_DMA64) { - if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(64)) && + if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(63)) && dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32))) goto fail_set_dma_mask; - if ((*pdev->dev.dma_mask == DMA_BIT_MASK(64)) && + if ((*pdev->dev.dma_mask == DMA_BIT_MASK(63)) && (dma_set_coherent_mask(&pdev->dev, consistent_mask) && dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)))) { /* @@ -6224,7 +6224,7 @@ megasas_set_dma_mask(struct megasas_instance *instance) if (!(scratch_pad_1 & MR_CAN_HANDLE_64_BIT_DMA_OFFSET)) goto fail_set_dma_mask; else if (dma_set_mask_and_coherent(&pdev->dev, - DMA_BIT_MASK(64))) + DMA_BIT_MASK(63))) goto fail_set_dma_mask; } } else if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32))) @@ -6236,8 +6236,8 @@ megasas_set_dma_mask(struct megasas_instance *instance) instance->consistent_mask_64bit = true; dev_info(&pdev->dev, "%s bit DMA mask and %s bit consistent mask\n", - ((*pdev->dev.dma_mask == DMA_BIT_MASK(64)) ? "64" : "32"), - (instance->consistent_mask_64bit ? "64" : "32")); + ((*pdev->dev.dma_mask == DMA_BIT_MASK(64)) ? "63" : "32"), + (instance->consistent_mask_64bit ? "63" : "32")); return 0;

6 years, 8 months

1
0
0 0

Applied "regulator: max77620: Initialize values for DT properties" to the regulator tree

by Mark Brown

The patch regulator: max77620: Initialize values for DT properties has been applied to the regulator tree at https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator.git All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted. You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed. If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced. Please add any relevant lists and maintainers to the CCs when replying to this mail. Thanks, Mark >From 0ab66b3c326ef8f77dae9f528118966365757c0c Mon Sep 17 00:00:00 2001 From: Mark Zhang <markz(a)nvidia.com> Date: Thu, 10 Jan 2019 12:11:16 +0800 Subject: [PATCH] regulator: max77620: Initialize values for DT properties If regulator DT node doesn't exist, its of_parse_cb callback function isn't called. Then all values for DT properties are filled with zero. This leads to wrong register update for FPS and POK settings. Signed-off-by: Jinyoung Park <jinyoungp(a)nvidia.com> Signed-off-by: Mark Zhang <markz(a)nvidia.com> Signed-off-by: Mark Brown <broonie(a)kernel.org> Cc: stable(a)vger.kernel.org --- drivers/regulator/max77620-regulator.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/regulator/max77620-regulator.c b/drivers/regulator/max77620-regulator.c index b94e3a721721..cd93cf53e23c 100644 --- a/drivers/regulator/max77620-regulator.c +++ b/drivers/regulator/max77620-regulator.c @@ -1,7 +1,7 @@ /* * Maxim MAX77620 Regulator driver * - * Copyright (c) 2016, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2016-2018, NVIDIA CORPORATION. All rights reserved. * * Author: Mallikarjun Kasoju <mkasoju(a)nvidia.com> * Laxman Dewangan <ldewangan(a)nvidia.com> @@ -803,6 +803,14 @@ static int max77620_regulator_probe(struct platform_device *pdev) rdesc = &rinfo[id].desc; pmic->rinfo[id] = &max77620_regs_info[id]; pmic->enable_power_mode[id] = MAX77620_POWER_MODE_NORMAL; + pmic->reg_pdata[id].active_fps_src = -1; + pmic->reg_pdata[id].active_fps_pd_slot = -1; + pmic->reg_pdata[id].active_fps_pu_slot = -1; + pmic->reg_pdata[id].suspend_fps_src = -1; + pmic->reg_pdata[id].suspend_fps_pd_slot = -1; + pmic->reg_pdata[id].suspend_fps_pu_slot = -1; + pmic->reg_pdata[id].power_ok = -1; + pmic->reg_pdata[id].ramp_rate_setting = -1; ret = max77620_read_slew_rate(pmic, id); if (ret < 0) -- 2.20.1

6 years, 8 months

1
0
0 0

[PATCH] gpio: pcf857x: Fix interrupts on multiple instances

by Roger Quadros

When multiple instances of pcf857x chips are present, a fix up message [1] is printed during the probe of the 2nd and later instances. The issue is that the driver is using the same irq_chip data structure between multiple instances. Fix this by allocating the irq_chip data structure per instance. [1] fix up message addressed by this patch [ 1.212100] gpio gpiochip9: (pcf8575): detected irqchip that is shared with multiple gpiochips: please fix the driver. Cc: Stable <stable(a)vger.kernel.org> # 4.20+ Signed-off-by: Roger Quadros <rogerq(a)ti.com> --- drivers/gpio/gpio-pcf857x.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/drivers/gpio/gpio-pcf857x.c b/drivers/gpio/gpio-pcf857x.c index adf72dd..68a35b6 100644 --- a/drivers/gpio/gpio-pcf857x.c +++ b/drivers/gpio/gpio-pcf857x.c @@ -84,6 +84,7 @@ MODULE_DEVICE_TABLE(of, pcf857x_of_table); */ struct pcf857x { struct gpio_chip chip; + struct irq_chip irqchip; struct i2c_client *client; struct mutex lock; /* protect 'out' */ unsigned out; /* software latch */ @@ -252,18 +253,6 @@ static void pcf857x_irq_bus_sync_unlock(struct irq_data *data) mutex_unlock(&gpio->lock); } -static struct irq_chip pcf857x_irq_chip = { - .name = "pcf857x", - .irq_enable = pcf857x_irq_enable, - .irq_disable = pcf857x_irq_disable, - .irq_ack = noop, - .irq_mask = noop, - .irq_unmask = noop, - .irq_set_wake = pcf857x_irq_set_wake, - .irq_bus_lock = pcf857x_irq_bus_lock, - .irq_bus_sync_unlock = pcf857x_irq_bus_sync_unlock, -}; - /*-------------------------------------------------------------------------*/ static int pcf857x_probe(struct i2c_client *client, @@ -376,8 +365,17 @@ static int pcf857x_probe(struct i2c_client *client, /* Enable irqchip if we have an interrupt */ if (client->irq) { + gpio->irqchip.name = "pcf857x", + gpio->irqchip.irq_enable = pcf857x_irq_enable, + gpio->irqchip.irq_disable = pcf857x_irq_disable, + gpio->irqchip.irq_ack = noop, + gpio->irqchip.irq_mask = noop, + gpio->irqchip.irq_unmask = noop, + gpio->irqchip.irq_set_wake = pcf857x_irq_set_wake, + gpio->irqchip.irq_bus_lock = pcf857x_irq_bus_lock, + gpio->irqchip.irq_bus_sync_unlock = pcf857x_irq_bus_sync_unlock, status = gpiochip_irqchip_add_nested(&gpio->chip, - &pcf857x_irq_chip, + &gpio->irqchip, 0, handle_level_irq, IRQ_TYPE_NONE); if (status) { @@ -392,7 +390,7 @@ static int pcf857x_probe(struct i2c_client *client, if (status) goto fail; - gpiochip_set_nested_irqchip(&gpio->chip, &pcf857x_irq_chip, + gpiochip_set_nested_irqchip(&gpio->chip, &gpio->irqchip, client->irq); gpio->irq_parent = client->irq; } -- Texas Instruments Finland Oy, Porkkalankatu 22, 00180 Helsinki. Y-tunnus/Business ID: 0615521-4. Kotipaikka/Domicile: Helsinki

6 years, 8 months

2
1
0 0

v4.19.14 build: 0 failures 2 warnings (v4.19.14)

by Build bot for Mark Brown

Tree/Branch: v4.19.14 Git describe: v4.19.14 Commit: f630d3cc77 Linux 4.19.14 Build Time: 124 min 43 sec Passed: 11 / 11 (100.00 %) Failed: 0 / 11 ( 0.00 %) Errors: 0 Warnings: 2 Section Mismatches: 0 ------------------------------------------------------------------------------- defconfigs with issues (other than build errors): 1 warnings 0 mismatches : arm64-allmodconfig 1 warnings 0 mismatches : arm-allmodconfig ------------------------------------------------------------------------------- Warnings Summary: 2 1 ../drivers/staging/erofs/unzip_vle.c:186:29: warning: array subscript is above array bounds [-Warray-bounds] 1 ../drivers/isdn/hardware/eicon/message.c:5985:1: warning: the frame size of 2064 bytes is larger than 2048 bytes [-Wframe-larger-than=] =============================================================================== Detailed per-defconfig build reports below: ------------------------------------------------------------------------------- arm64-allmodconfig : PASS, 0 errors, 1 warnings, 0 section mismatches Warnings: ../drivers/isdn/hardware/eicon/message.c:5985:1: warning: the frame size of 2064 bytes is larger than 2048 bytes [-Wframe-larger-than=] ------------------------------------------------------------------------------- arm-allmodconfig : PASS, 0 errors, 1 warnings, 0 section mismatches Warnings: ../drivers/staging/erofs/unzip_vle.c:186:29: warning: array subscript is above array bounds [-Warray-bounds] ------------------------------------------------------------------------------- Passed with no errors, warnings or mismatches: arm64-allnoconfig arm-multi_v5_defconfig arm-multi_v7_defconfig x86_64-defconfig arm-allnoconfig x86_64-allnoconfig arm-multi_v4t_defconfig x86_64-allmodconfig arm64-defconfig

6 years, 8 months

1
0
0 0

[PATCH] arm64: dts: allwinner: a64: Fix USB OTG regulator

by Jernej Skrabec

Currently, AXP803 driver assumes that reg_drivevbus is input which is wrong. Unfortunate consequence of that is that none of the USB ports work on the board, even USB HOST port, because USB PHY driver probing fails due to missing regulator. Fix that by adding "x-powers,drive-vbus-en" property to AXP803 node. Fixes: 14ff5d8f9151 ("arm64: dts: allwinner: a64: Orange Pi Win: Enable USB OTG socket") Cc: stable(a)vger.kernel.org Signed-off-by: Jernej Skrabec <jernej.skrabec(a)siol.net> --- arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts index b0c64f75792c..8974b5a1d3b1 100644 --- a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts +++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts @@ -188,6 +188,7 @@ reg = <0x3a3>; interrupt-parent = <&r_intc>; interrupts = <0 IRQ_TYPE_LEVEL_LOW>; + x-powers,drive-vbus-en; /* set N_VBUSEN as output pin */ }; }; -- 2.20.1

6 years, 8 months

2
1
0 0

stable-rc/linux-4.4.y boot: 83 boots: 2 failed, 81 passed (v4.4.169)

by kernelci.org bot

stable-rc/linux-4.4.y boot: 83 boots: 2 failed, 81 passed (v4.4.169) Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.4.y/kernel/v4.4.… Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.4.y/kernel/v4.4.169/ Tree: stable-rc Branch: linux-4.4.y Git Describe: v4.4.169 Git Commit: ba0da581b466dcd333eeb326919a698116926258 Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Tested: 42 unique boards, 19 SoC families, 12 builds out of 187 Boot Failures Detected: arm: multi_v7_defconfig stih410-b2120: 1 failed lab arm64: defconfig qcom-qdf2400: 1 failed lab --- For more info write to <info(a)kernelci.org>

6 years, 8 months

1
0
0 0

[PATCH v2 0/3] kprobes: Fix kretprobe issues

by Masami Hiramatsu

Hello, This is v2 series of fixing kretprobe incorrect stacking order patches. In this version, I fixed a lack of kprobes.h including and added new patch for kretprobe trampoline recursion issue. (and add Cc:stable) (1) kprobe incorrct stacking order problem On recent talk with Andrea, I started more precise investigation on the kernel panic with kretprobes on notrace functions, which Francis had been reported last year ( https://lkml.org/lkml/2017/7/14/466 ). See the investigation details in https://lkml.kernel.org/r/154686789378.15479.2886543882215785247.stgit@devb… When we put a kretprobe on ftrace_ops_assist_func() and put another kretprobe on probed-function, below happens <caller> -><probed-function> ->fentry ->ftrace_ops_assist_func() ->int3 ->kprobe_int3_handler() ...->pre_handler_kretprobe() push the return address (*fentry*) of ftrace_ops_assist_func() to top of the kretprobe list and replace it with kretprobe_trampoline. <-kprobe_int3_handler() <-(int3) ->kprobe_ftrace_handler() ...->pre_handler_kretprobe() push the return address (caller) of probed-function to top of the kretprobe list and replace it with kretprobe_trampoline. <-(kprobe_ftrace_handler()) <-(ftrace_ops_assist_func()) [kretprobe_trampoline] ->tampoline_handler() pop the return address (caller) from top of the kretprobe list <-(trampoline_handler()) <caller> [run caller with incorrect stack information] <-(<caller>) !!KERNEL PANIC!! Therefore, this kernel panic happens only when we put 2 k*ret*probes on ftrace_ops_assist_func() and other functions. If we put kprobes, it doesn't cause any issue, since it doesn't change the return address. To fix (or just avoid) this issue, we can introduce a frame pointer verification to skip wrong order entries. And I also would like to blacklist those functions because those are part of ftrace-based kprobe handling routine. (2) kretprobe trampoline recursion problem This was found by Andrea in the previous thread https://lkml.kernel.org/r/20190107183444.GA5966@xps-13 ---- echo "r:event_1 __fdget" >> kprobe_events echo "r:event_2 _raw_spin_lock_irqsave" >> kprobe_events echo 1 > events/kprobes/enable [DEADLOCK] ---- Because kretprobe trampoline_handler uses spinlock for protecting hash table, if we probe the spinlock itself, it causes deadlock. Thank you Andrea and Steve for discovering this root cause!! This bug has been introduced with the asm-coded trampoline code, since previously it used another kprobe for hooking the function return placeholder (which only has a nop) and trampoline handler was called from that kprobe. To fix this bug, I introduced a dummy kprobe and set it in current_kprobe as we did in old days. Thank you, --- Masami Hiramatsu (3): x86/kprobes: Verify stack frame on kretprobe kprobes: Mark ftrace mcount handler functions nokprobe x86/kprobes: Fix to avoid kretprobe recursion arch/x86/kernel/kprobes/core.c | 48 ++++++++++++++++++++++++++++++++++++++-- include/linux/kprobes.h | 1 + kernel/trace/ftrace.c | 6 ++++- 3 files changed, 52 insertions(+), 3 deletions(-) -- Masami Hiramatsu (Linaro) <mhiramat(a)kernel.org>

6 years, 8 months

3
8
0 0

stable/linux-4.14.y boot: 102 boots: 2 failed, 99 passed with 1 offline (v4.14.92)

by kernelci.org bot

stable/linux-4.14.y boot: 102 boots: 2 failed, 99 passed with 1 offline (v4.14.92) Full Boot Summary: https://kernelci.org/boot/all/job/stable/branch/linux-4.14.y/kernel/v4.14.9… Full Build Summary: https://kernelci.org/build/stable/branch/linux-4.14.y/kernel/v4.14.92/ Tree: stable Branch: linux-4.14.y Git Describe: v4.14.92 Git Commit: 24737fa6bcf1d7ffb71ceb78d7a7c275cb7e1d13 Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git Tested: 59 unique boards, 22 SoC families, 12 builds out of 197 Boot Failures Detected: arm64: defconfig meson-gxl-s905x-libretech-cc: 1 failed lab rk3399-firefly: 1 failed lab Offline Platforms: arm64: defconfig: meson-gxbb-odroidc2: 1 offline lab --- For more info write to <info(a)kernelci.org>

6 years, 8 months

1
0
0 0

[PATCH 4.20 000/145] 4.20.1-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.20.1 release. There are 145 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed Jan 9 10:43:39 UTC 2019. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.20.1-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.20.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.20.1-rc1 Tomas Winkler <tomas.winkler(a)intel.com> tpm: tpm_i2c_nuvoton: use correct command duration for TPM 2.x Tomas Winkler <tomas.winkler(a)intel.com> tpm: tpm_try_transmit() refactor error flow. Helge Deller <deller(a)gmx.de> parisc: Remap hugepage-aligned pages in set_kernel_text_rw() Will Deacon <will.deacon(a)arm.com> arm64: compat: Don't pull syscall number from regs in arm_compat_syscall Will Deacon <will.deacon(a)arm.com> arm64: compat: Avoid sending SIGILL for unallocated syscall numbers Robin Murphy <robin.murphy(a)arm.com> iommu/arm-smmu-v3: Fix big-endian CMD_SYNC writes Gustavo A. R. Silva <gustavo(a)embeddedor.com> KVM: arm/arm64: vgic: Fix off-by-one bug in vgic_get_irq() Christoffer Dall <christoffer.dall(a)arm.com> KVM: arm/arm64: Fix VMID alloc race by reverting to lock-less Christoffer Dall <christoffer.dall(a)arm.com> KVM: arm/arm64: vgic-v2: Set active_source to 0 when restoring state Marc Zyngier <marc.zyngier(a)arm.com> KVM: arm/arm64: vgic: Cap SPIs to the VM-defined maximum Julien Thierry <julien.thierry(a)arm.com> KVM: arm/arm64: vgic: Do not cond_resched_lock() with IRQs disabled Maciej W. Rozycki <macro(a)linux-mips.org> rtc: m41t80: Correct alarm month range with RTC reads Sylwester Nawrocki <s.nawrocki(a)samsung.com> ARM: dts: exynos: Specify I2S assigned clocks in proper node Marc Zyngier <marc.zyngier(a)arm.com> arm/arm64: KVM: vgic: Force VM halt when changing the active state of GICv3 PPIs/SGIs Will Deacon <will.deacon(a)arm.com> arm64: KVM: Avoid setting the upper 32 bits of VTCR_EL2 to 1 Long Li <longli(a)microsoft.com> CIFS: use the correct length when pinning memory for direct I/O for write Long Li <longli(a)microsoft.com> CIFS: return correct errors when pinning memory failed for direct I/O Paul Aurich <paul(a)darkrain42.org> smb3: fix large reads on encrypted connections Georgy A Bystrenin <gkot(a)altlinux.org> CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem Huacai Chen <chenhc(a)lemote.com> MIPS: Fix a R10000_LLSC_WAR logic in atomic.h Aaro Koskinen <aaro.koskinen(a)iki.fi> MIPS: OCTEON: mark RGMII interface disabled on OCTEON III Paul Burton <paul.burton(a)mips.com> MIPS: Expand MIPS32 ASIDs to 64 bits Huacai Chen <chenhc(a)lemote.com> MIPS: Align kernel load address to 64KB Huacai Chen <chenhc(a)lemote.com> MIPS: Ensure pmd_present() returns false after pmd_mknotpresent() Huacai Chen <chenhc(a)lemote.com> MIPS: c-r4k: Add r4k_blast_scache_node for Loongson-3 Paul Burton <paul.burton(a)mips.com> MIPS: math-emu: Write-protect delay slot emulation pages Steven Rostedt (VMware) <rostedt(a)goodmis.org> tools lib traceevent: Fix processing of dereferenced args in bprintk events Ondrej Jirman <megous(a)megous.com> media: v4l2-fwnode: Fix setting V4L2_MBUS_DATA_ACTIVE_HIGH/LOW flag Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: v4l2-tpg: array index could become negative Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: vb2: check memory model for VIDIOC_CREATE_BUFS Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: vim2m: use cancel_delayed_work_sync instead of flush_schedule_work Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: vivid: free bitmap_cap when updating std/timings/etc. Luca Ceresoli <luca(a)lucaceresoli.net> media: imx274: fix stack corruption in imx274_read_reg Sean Young <sean(a)mess.org> media: rc: cec devices do not have a lirc chardev Hans Verkuil <hverkuil(a)xs4all.nl> media: cec-pin: fix broken tx_ignore_nack_until_eom error injection Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: cec: keep track of outstanding transmits Nava kishore Manne <nava.manne(a)xilinx.com> serial: uartps: Fix interrupt mask issue to handle the RX interrupts properly Jaegeuk Kim <jaegeuk(a)kernel.org> f2fs: sanity check of xattr entry size Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> f2fs: fix validation of the block count in sanity_check_raw_super Jaegeuk Kim <jaegeuk(a)kernel.org> f2fs: fix missing unlock(sbi->gc_mutex) Jia Zhu <zhujia13(a)huawei.com> f2fs: fix to update new block address correctly for OPU Pan Bian <bianpan2016(a)163.com> f2fs: read page index before freeing Breno Leitao <leitao(a)debian.org> powerpc/tm: Unset MSR[TS] if not recheckpointing Breno Leitao <leitao(a)debian.org> powerpc/tm: Set MSR[TS] just prior to recheckpoint Eric Biggers <ebiggers(a)google.com> KEYS: fix parsing invalid pkey info string Lyude Paul <lyude(a)redhat.com> brcmfmac: Fix out of bounds memory access during fw load Stijn Tintel <stijn(a)linux-ipv6.be> brcmfmac: fix roamoff=1 modparam Filipe Manana <fdmanana(a)suse.com> Btrfs: send, fix race with transaction commits that create snapshots Josef Bacik <jbacik(a)fb.com> btrfs: run delayed items before dropping the snapshot Filipe Manana <fdmanana(a)suse.com> Btrfs: fix fsync of files with multiple hard links in new directories Lu Fengqi <lufq.fnst(a)cn.fujitsu.com> btrfs: skip file_extent generation check for free_space_inode in run_delalloc_nocow Filipe Manana <fdmanana(a)suse.com> Btrfs: fix deadlock with memory reclaim during scrub Anand Jain <anand.jain(a)oracle.com> btrfs: dev-replace: go back to suspend state if another EXCL_OP is running Anand Jain <anand.jain(a)oracle.com> btrfs: dev-replace: go back to suspended state if target device is missing Macpaul Lin <macpaul.lin(a)mediatek.com> cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader. Todd Kjos <tkjos(a)android.com> binder: fix use-after-free due to ksys_close() during fdget() Tejun Heo <tj(a)kernel.org> cgroup: fix CSS_TASK_ITER_PROCS Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> crypto: cfb - fix decryption Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> crypto: testmgr - add AES-CFB tests Atul Gupta <atul.gupta(a)chelsio.com> crypto: chcr - small packet Tx stalls the queue Wenwen Wang <wang6495(a)umn.edu> crypto: cavium/nitrox - fix a DMA pool free failure Jernej Skrabec <jernej.skrabec(a)siol.net> clk: sunxi-ng: Use u64 for calculation of NM rate Johan Jonker <jbx9999(a)hotmail.com> clk: rockchip: fix typo in rk3188 spdif_frac parent Lukas Wunner <lukas(a)wunner.de> spi: bcm2835: Avoid finishing transfer prematurely in IRQ mode Lukas Wunner <lukas(a)wunner.de> spi: bcm2835: Fix book-keeping of DMA termination Lukas Wunner <lukas(a)wunner.de> spi: bcm2835: Fix race on DMA termination Theodore Ts'o <tytso(a)mit.edu> ext4: check for shutdown and r/o file system in ext4_write_inode() Theodore Ts'o <tytso(a)mit.edu> ext4: force inode writes when nfsd calls commit_metadata() Theodore Ts'o <tytso(a)mit.edu> ext4: avoid declaring fs inconsistent due to invalid file handles Theodore Ts'o <tytso(a)mit.edu> ext4: include terminating u32 in size of xattr entries when expanding inodes ruippan (潘睿) <ruippan(a)tencent.com> ext4: fix EXT4_IOC_GROUP_ADD ioctl Maurizio Lombardi <mlombard(a)redhat.com> ext4: missing unlock/put_page() in ext4_try_to_write_inline_data() Pan Bian <bianpan2016(a)163.com> ext4: fix possible use after free in ext4_quota_enable Theodore Ts'o <tytso(a)mit.edu> ext4: add ext4_sb_bread() to disambiguate ENOMEM cases Greg Kurz <groug(a)kaod.org> ocxl: Fix endiannes bug in read_afu_name() Greg Kurz <groug(a)kaod.org> ocxl: Fix endiannes bug in ocxl_link_update_pe() Arnaldo Carvalho de Melo <acme(a)redhat.com> perf env: Also consider env->arch == NULL as local operation Ben Hutchings <ben(a)decadent.org.uk> perf pmu: Suppress potential format-truncation warning Adrian Hunter <adrian.hunter(a)intel.com> perf script: Use fallbacks for branch stacks Adrian Hunter <adrian.hunter(a)intel.com> perf tools: Use fallback for sample_addr_correlates_sym() cases Adrian Hunter <adrian.hunter(a)intel.com> perf thread: Add fallback functions for cases where cpumode is insufficient Adrian Hunter <adrian.hunter(a)intel.com> perf machine: Record if a arch has a single user/kernel address space Alexey Brodkin <alexey.brodkin(a)synopsys.com> clocksource/drivers/arc_timer: Utilize generic sched_clock Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com> DRM: UDL: get rid of useless vblank initialization Eric Anholt <eric(a)anholt.net> drm/v3d: Skip debugfs dumping GCA on platforms without GCA. Miquel Raynal <miquel.raynal(a)bootlin.com> platform-msi: Free descriptors in platform_msi_domain_free() Sean Christopherson <sean.j.christopherson(a)intel.com> KVM: nVMX: Free the VMREAD/VMWRITE bitmaps if alloc_kvm_area() fails Paul Mackerras <paulus(a)ozlabs.org> KVM: PPC: Book3S HV: Fix race between kvm_unmap_hva_range and MMU mode switch Marc Zyngier <marc.zyngier(a)arm.com> arm64: KVM: Make VHE Stage-2 TLB invalidation operations non-interruptible Sean Christopherson <sean.j.christopherson(a)intel.com> KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup Dan Williams <dan.j.williams(a)intel.com> x86/mm: Drop usage of __flush_tlb_all() in kernel_physical_mapping_init() Michal Hocko <mhocko(a)suse.com> x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off Patrick Dreyer <Patrick(a)Dreyer.name> Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G Sanjeev Chugh <sanjeev_chugh(a)mentor.com> Input: atmel_mxt_ts - don't try to free unallocated kernel memory Sebastian Ott <sebott(a)linux.ibm.com> s390/pci: fix sleeping in atomic during hotplug Hans de Goede <hdegoede(a)redhat.com> ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for Chromebook Gnawty Hans de Goede <hdegoede(a)redhat.com> ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for Chromebook Clapper Dan Carpenter <dan.carpenter(a)oracle.com> staging: bcm2835-audio: double free in init error path Colin Ian King <colin.king(a)canonical.com> staging: wilc1000: fix missing read_write setting when reading data Linus Torvalds <torvalds(a)linux-foundation.org> i915: fix missing user_access_end() in page fault exception case Malcolm Priestley <tvboxspy(a)gmail.com> media: dvb-usb-v2: Fix incorrect use of transfer_flags URB_FREE_BUFFER Heikki Krogerus <heikki.krogerus(a)linux.intel.com> usb: roles: Add a description for the class to Kconfig Stephan Gerhold <stephan(a)gerhold.net> Revert "usb: dwc3: pci: Use devm functions to get the phy GPIOs" Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> usb: dwc2: disable power_down on Amlogic devices Jia-Ju Bai <baijiaju1990(a)gmail.com> usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable() Jörgen Storvist <jorgen.storvist(a)gmail.com> USB: serial: option: add Fibocom NL678 series Scott Chen <scott(a)labau.com.tw> USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays Terin Stock <terin(a)terinstock.com> usb: dwc2: host: use hrtimer for NAK retries Sameer Pujar <spujar(a)nvidia.com> ALSA: hda/tegra: clear pending irq handlers Jian-Hong Pan <jian-hong(a)endlessm.com> ALSA: hda/realtek: Enable the headset mic auto detection for ASUS laptops Takashi Sakamoto <o-takashi(a)sakamocchi.jp> ALSA: firewire-lib: use the same print format for 'without_header' tracepoints Takashi Sakamoto <o-takashi(a)sakamocchi.jp> ALSA: firewire-lib: fix wrong assignment for 'out_packet_without_header' tracepoint Takashi Sakamoto <o-takashi(a)sakamocchi.jp> ALSA: firewire-lib: fix wrong handling payload_length as payload_quadlet Takashi Sakamoto <o-takashi(a)sakamocchi.jp> ALSA: fireface: fix for state to fetch PCM frames Wandrille RONCE <w(a)ndrille.fr> ALSA: hda/realtek: Enable audio jacks of ASUS UX391UA with ALC294 Mantas Mikulėnas <grawity(a)gmail.com> ALSA: hda: add mute LED support for HP EliteBook 840 G4 Boris Brezillon <boris.brezillon(a)bootlin.com> mtd: rawnand: omap2: Pass the parent of pdev to dma_request_chan() Boris Brezillon <boris.brezillon(a)bootlin.com> mtd: rawnand: Fix JEDEC detection Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: marvell: prevent timeouts on a loaded machine Arnd Bergmann <arnd(a)arndb.de> mtd: atmel-quadspi: disallow building on ebsa110 Diana Craciun <diana.craciun(a)nxp.com> powerpc/fsl: Fix spectre_v2 mitigations reporting Gustavo A. R. Silva <gustavo(a)embeddedor.com> ALSA: emux: Fix potential Spectre v1 vulnerabilities Gustavo A. R. Silva <gustavo(a)embeddedor.com> ALSA: pcm: Fix potential Spectre v1 vulnerability Gustavo A. R. Silva <gustavo(a)embeddedor.com> ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities Gustavo A. R. Silva <gustavo(a)embeddedor.com> ALSA: rme9652: Fix potential Spectre v1 vulnerability Michael J. Ruhl <michael.j.ruhl(a)intel.com> IB/hfi1: Incorrect sizing of sge for PIO will OOPs Cong Wang <xiyou.wangcong(a)gmail.com> tipc: fix a double free in tipc_enable_bearer() Deepa Dinamani <deepa.kernel(a)gmail.com> sock: Make sock->sk_stamp thread-safe Cong Wang <xiyou.wangcong(a)gmail.com> ptr_ring: wrap back ->producer in __ptr_ring_swap_queue() Gustavo A. R. Silva <gustavo(a)embeddedor.com> phonet: af_phonet: Fix Spectre v1 vulnerability Willem de Bruijn <willemb(a)google.com> packet: validate address length if non-zero Cong Wang <xiyou.wangcong(a)gmail.com> net/wan: fix a double free in x25_asy_open_tty() Cong Wang <xiyou.wangcong(a)gmail.com> netrom: fix locking in nr_find_socket() Eric Dumazet <edumazet(a)google.com> isdn: fix kernel-infoleak in capi_unlocked_ioctl Eric Dumazet <edumazet(a)google.com> net/hamradio/6pack: use mod_timer() to rearm timers Gustavo A. R. Silva <gustavo(a)embeddedor.com> net: core: Fix Spectre v1 vulnerability Willem de Bruijn <willemb(a)google.com> ip: validate header length on virtual device xmit Willem de Bruijn <willemb(a)google.com> ieee802154: lowpan_header_create check must check daddr Tyrel Datwyler <tyreld(a)linux.vnet.ibm.com> ibmveth: fix DMA unmap error in ibmveth_xmit_start error path Cong Wang <xiyou.wangcong(a)gmail.com> ax25: fix a use-after-free in ax25_fillin_cb() Willem de Bruijn <willemb(a)google.com> tap: call skb_probe_transport_header after setting skb->dev Ivan Mironov <mironov.ivan(a)gmail.com> bnx2x: Fix NULL pointer dereference in bnx2x_del_all_vlans() on some hw Jacopo Mondi <jacopo+renesas(a)jmondi.org> media: ov5640: Fix set format regression Ihab Zhaika <ihab.zhaika(a)intel.com> iwlwifi: add new cards for 9560, 9462, 9461 and killer series Sergey Senozhatsky <sergey.senozhatsky.work(a)gmail.com> panic: avoid deadlocks in re-entrant console drivers ------------- Diffstat: Documentation/admin-guide/kernel-parameters.txt | 3 + Documentation/admin-guide/l1tf.rst | 6 +- Makefile | 4 +- arch/arc/Kconfig | 1 + arch/arm/boot/dts/exynos5422-odroidxu3-audio.dtsi | 9 ++- arch/arm/boot/dts/exynos5422-odroidxu4.dts | 9 ++- arch/arm64/include/asm/kvm_arm.h | 2 +- arch/arm64/include/asm/unistd.h | 5 +- arch/arm64/kernel/sys_compat.c | 11 ++- arch/arm64/kernel/syscall.c | 9 ++- arch/arm64/kvm/hyp/tlb.c | 35 ++++++--- arch/mips/boot/compressed/calc_vmlinuz_load_addr.c | 7 +- arch/mips/cavium-octeon/executive/cvmx-helper.c | 3 +- arch/mips/include/asm/atomic.h | 2 +- arch/mips/include/asm/cpu-info.h | 2 +- arch/mips/include/asm/mach-generic/mmzone.h | 2 + arch/mips/include/asm/mach-loongson64/mmzone.h | 1 + arch/mips/include/asm/mmu.h | 2 +- arch/mips/include/asm/mmu_context.h | 10 ++- arch/mips/include/asm/mmzone.h | 8 +++ arch/mips/include/asm/pgtable-64.h | 5 ++ arch/mips/include/asm/r4kcache.h | 22 ++++++ arch/mips/kernel/vdso.c | 4 +- arch/mips/math-emu/dsemul.c | 38 +++++----- arch/mips/mm/c-r3k.c | 2 +- arch/mips/mm/c-r4k.c | 44 ++++++++++-- arch/parisc/mm/init.c | 4 +- arch/powerpc/kernel/security.c | 2 +- arch/powerpc/kernel/signal_32.c | 38 ++++++++-- arch/powerpc/kernel/signal_64.c | 64 ++++++++++++----- arch/powerpc/kvm/book3s_64_mmu_hv.c | 3 + arch/powerpc/kvm/book3s_hv.c | 17 +++-- arch/s390/pci/pci_clp.c | 2 +- arch/x86/include/asm/kvm_host.h | 2 +- arch/x86/kernel/cpu/bugs.c | 3 +- arch/x86/kvm/vmx.c | 7 +- arch/x86/mm/init.c | 2 +- arch/x86/mm/init_64.c | 6 -- crypto/cfb.c | 2 +- crypto/tcrypt.c | 5 ++ crypto/testmgr.c | 7 ++ crypto/testmgr.h | 76 ++++++++++++++++++++ drivers/android/binder.c | 63 +++++++++++++++- drivers/base/platform-msi.c | 6 +- drivers/char/tpm/tpm-interface.c | 15 ++-- drivers/char/tpm/tpm_i2c_nuvoton.c | 11 +-- drivers/clk/rockchip/clk-rk3188.c | 2 +- drivers/clk/sunxi-ng/ccu_nm.c | 18 ++++- drivers/clocksource/Kconfig | 1 + drivers/clocksource/arc_timer.c | 22 ++++++ drivers/crypto/cavium/nitrox/nitrox_algs.c | 12 ++-- drivers/crypto/cavium/nitrox/nitrox_lib.c | 22 ++++-- drivers/crypto/cavium/nitrox/nitrox_req.h | 7 ++ drivers/crypto/chelsio/chcr_ipsec.c | 5 +- drivers/gpu/drm/i915/i915_gem_execbuffer.c | 1 + drivers/gpu/drm/udl/udl_main.c | 7 +- drivers/gpu/drm/v3d/v3d_debugfs.c | 11 +-- drivers/infiniband/hw/hfi1/verbs.c | 2 + drivers/input/mouse/elan_i2c_core.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 4 +- drivers/iommu/arm-smmu-v3.c | 8 ++- drivers/isdn/capi/kcapi.c | 4 +- drivers/media/cec/cec-adap.c | 27 ++++--- drivers/media/cec/cec-pin.c | 5 +- drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 2 +- drivers/media/common/videobuf2/videobuf2-core.c | 3 + drivers/media/i2c/imx274.c | 7 +- drivers/media/i2c/ov5640.c | 17 +++-- drivers/media/platform/vim2m.c | 3 +- drivers/media/platform/vivid/vivid-vid-cap.c | 2 + drivers/media/rc/rc-main.c | 6 +- drivers/media/usb/dvb-usb-v2/usb_urb.c | 5 +- drivers/media/v4l2-core/v4l2-fwnode.c | 4 +- drivers/misc/ocxl/config.c | 2 +- drivers/misc/ocxl/link.c | 2 +- drivers/mtd/nand/raw/marvell_nand.c | 17 ++++- drivers/mtd/nand/raw/nand_jedec.c | 2 + drivers/mtd/nand/raw/omap2.c | 2 +- drivers/mtd/spi-nor/Kconfig | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 14 ++-- drivers/net/ethernet/ibm/ibmveth.c | 6 +- drivers/net/hamradio/6pack.c | 16 ++--- drivers/net/tap.c | 3 +- drivers/net/wan/x25_asy.c | 2 + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 11 ++- .../broadcom/brcm80211/brcmfmac/cfg80211.h | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 2 +- .../broadcom/brcm80211/brcmfmac/firmware.c | 8 ++- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 50 +++++++++++++ drivers/rtc/rtc-m41t80.c | 2 +- drivers/spi/spi-bcm2835.c | 14 ++-- .../vc04_services/bcm2835-audio/bcm2835-vchiq.c | 1 - drivers/staging/wilc1000/wilc_sdio.c | 1 + drivers/tty/serial/xilinx_uartps.c | 4 +- drivers/usb/Kconfig | 4 -- drivers/usb/class/cdc-acm.c | 10 +++ drivers/usb/class/cdc-acm.h | 1 + drivers/usb/common/Makefile | 1 - drivers/usb/dwc2/hcd.h | 2 +- drivers/usb/dwc2/hcd_queue.c | 19 +++-- drivers/usb/dwc2/params.c | 1 + drivers/usb/dwc3/dwc3-pci.c | 8 +-- drivers/usb/host/r8a66597-hcd.c | 5 +- drivers/usb/roles/Kconfig | 13 ++++ drivers/usb/roles/Makefile | 4 +- drivers/usb/{common/roles.c => roles/class.c} | 0 drivers/usb/serial/option.c | 4 ++ drivers/usb/serial/pl2303.c | 5 ++ drivers/usb/serial/pl2303.h | 5 ++ fs/btrfs/btrfs_inode.h | 6 ++ fs/btrfs/ctree.c | 29 ++++++-- fs/btrfs/dev-replace.c | 6 ++ fs/btrfs/extent-tree.c | 4 ++ fs/btrfs/inode.c | 20 +++++- fs/btrfs/scrub.c | 35 ++++++++- fs/btrfs/tree-log.c | 16 +++++ fs/cifs/file.c | 12 +++- fs/cifs/smb2maperror.c | 4 +- fs/cifs/smb2ops.c | 4 +- fs/ext4/ext4.h | 17 ++++- fs/ext4/ialloc.c | 2 +- fs/ext4/inline.c | 5 +- fs/ext4/inode.c | 63 +++++++++++----- fs/ext4/ioctl.c | 2 +- fs/ext4/migrate.c | 36 +++++----- fs/ext4/namei.c | 4 +- fs/ext4/resize.c | 79 ++++++++++---------- fs/ext4/super.c | 55 ++++++++++---- fs/ext4/xattr.c | 83 +++++++++++----------- fs/f2fs/data.c | 4 +- fs/f2fs/node.c | 4 +- fs/f2fs/super.c | 13 ++-- fs/f2fs/xattr.c | 18 +++-- fs/file.c | 29 ++++++++ include/linux/fdtable.h | 1 + include/linux/msi.h | 2 + include/linux/ptr_ring.h | 2 + include/media/cec.h | 1 + include/net/ip_tunnels.h | 20 ++++++ include/net/sock.h | 38 +++++++++- include/trace/events/ext4.h | 20 ++++++ kernel/cgroup/cgroup.c | 29 ++++---- kernel/panic.c | 6 +- net/ax25/af_ax25.c | 11 ++- net/ax25/ax25_dev.c | 2 + net/compat.c | 15 ++-- net/core/filter.c | 2 + net/core/sock.c | 15 ++-- net/ieee802154/6lowpan/tx.c | 3 + net/ipv4/ip_gre.c | 9 +++ net/ipv4/ip_tunnel.c | 9 --- net/ipv4/ip_vti.c | 12 +++- net/ipv6/ip6_gre.c | 10 ++- net/ipv6/ip6_tunnel.c | 10 +-- net/ipv6/ip6_vti.c | 8 +-- net/ipv6/ip6mr.c | 17 +++-- net/ipv6/sit.c | 3 + net/netrom/af_netrom.c | 15 ++-- net/packet/af_packet.c | 4 +- net/phonet/af_phonet.c | 3 + net/sunrpc/svcsock.c | 2 +- net/tipc/bearer.c | 1 - security/keys/keyctl_pkey.c | 2 + sound/core/pcm.c | 2 + sound/firewire/amdtp-stream-trace.h | 4 +- sound/firewire/amdtp-stream.c | 4 +- sound/firewire/fireface/ff-protocol-ff400.c | 2 +- sound/pci/emu10k1/emufx.c | 5 ++ sound/pci/hda/hda_tegra.c | 2 + sound/pci/hda/patch_conexant.c | 1 + sound/pci/hda/patch_realtek.c | 3 +- sound/pci/rme9652/hdsp.c | 10 +-- sound/soc/intel/boards/cht_bsw_max98090_ti.c | 14 ++++ sound/synth/emux/emux_hwdep.c | 7 +- tools/lib/traceevent/event-parse.c | 1 + tools/perf/arch/common.c | 10 +++ tools/perf/arch/common.h | 1 + tools/perf/builtin-script.c | 12 ++-- tools/perf/util/env.c | 2 +- tools/perf/util/event.c | 29 +++++++- tools/perf/util/machine.c | 27 +++++++ tools/perf/util/machine.h | 3 + tools/perf/util/pmu.c | 8 +-- .../util/scripting-engines/trace-event-python.c | 16 ++--- tools/perf/util/session.c | 4 ++ tools/perf/util/thread.h | 4 ++ virt/kvm/arm/arm.c | 23 +++--- virt/kvm/arm/vgic/vgic-mmio.c | 44 ++++++------ virt/kvm/arm/vgic/vgic.c | 6 +- 189 files changed, 1528 insertions(+), 572 deletions(-)

6 years, 8 months

7
163
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror