The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 4561ffca88c546f96367f94b8f1e4715a9c62314 Mon Sep 17 00:00:00 2001
From: Joe Thornber <ejt(a)redhat.com>
Date: Mon, 24 Sep 2018 16:19:30 -0400
Subject: [PATCH] dm cache metadata: ignore hints array being too small during
resize
Commit fd2fa9541 ("dm cache metadata: save in-core policy_hint_size to
on-disk superblock") enabled previously written policy hints to be
used after a cache is reactivated. But in doing so the cache
metadata's hint array was left exposed to out of bounds access because
on resize the metadata's on-disk hint array wasn't ever extended.
Fix this by ignoring that there are no on-disk hints associated with the
newly added cache blocks. An expanded on-disk hint array is later
rewritten upon the next clean shutdown of the cache.
Fixes: fd2fa9541 ("dm cache metadata: save in-core policy_hint_size to on-disk superblock")
Cc: stable(a)vger.kernel.org
Signed-off-by: Joe Thornber <ejt(a)redhat.com>
Signed-off-by: Mike Snitzer <snitzer(a)redhat.com>
diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
index 69dddeab124c..5936de71883f 100644
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -1455,8 +1455,8 @@ static int __load_mappings(struct dm_cache_metadata *cmd,
if (hints_valid) {
r = dm_array_cursor_next(&cmd->hint_cursor);
if (r) {
- DMERR("dm_array_cursor_next for hint failed");
- goto out;
+ dm_array_cursor_end(&cmd->hint_cursor);
+ hints_valid = false;
}
}
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 0f843e65d9eef4936929bb036c5f771fb261eea4 Mon Sep 17 00:00:00 2001
From: Guoju Fang <fangguoju(a)gmail.com>
Date: Thu, 27 Sep 2018 23:41:46 +0800
Subject: [PATCH] bcache: add separate workqueue for journal_write to avoid
deadlock
After write SSD completed, bcache schedules journal_write work to
system_wq, which is a public workqueue in system, without WQ_MEM_RECLAIM
flag. system_wq is also a bound wq, and there may be no idle kworker on
current processor. Creating a new kworker may unfortunately need to
reclaim memory first, by shrinking cache and slab used by vfs, which
depends on bcache device. That's a deadlock.
This patch create a new workqueue for journal_write with WQ_MEM_RECLAIM
flag. It's rescuer thread will work to avoid the deadlock.
Signed-off-by: Guoju Fang <fangguoju(a)gmail.com>
Cc: stable(a)vger.kernel.org
Signed-off-by: Coly Li <colyli(a)suse.de>
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index 83504dd8100a..954dad29e6e8 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -965,6 +965,7 @@ void bch_prio_write(struct cache *ca);
void bch_write_bdev_super(struct cached_dev *dc, struct closure *parent);
extern struct workqueue_struct *bcache_wq;
+extern struct workqueue_struct *bch_journal_wq;
extern struct mutex bch_register_lock;
extern struct list_head bch_cache_sets;
diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
index 6116bbf870d8..522c7426f3a0 100644
--- a/drivers/md/bcache/journal.c
+++ b/drivers/md/bcache/journal.c
@@ -485,7 +485,7 @@ static void do_journal_discard(struct cache *ca)
closure_get(&ca->set->cl);
INIT_WORK(&ja->discard_work, journal_discard_work);
- schedule_work(&ja->discard_work);
+ queue_work(bch_journal_wq, &ja->discard_work);
}
}
@@ -592,7 +592,7 @@ static void journal_write_done(struct closure *cl)
: &j->w[0];
__closure_wake_up(&w->wait);
- continue_at_nobarrier(cl, journal_write, system_wq);
+ continue_at_nobarrier(cl, journal_write, bch_journal_wq);
}
static void journal_write_unlock(struct closure *cl)
@@ -627,7 +627,7 @@ static void journal_write_unlocked(struct closure *cl)
spin_unlock(&c->journal.lock);
btree_flush_write(c);
- continue_at(cl, journal_write, system_wq);
+ continue_at(cl, journal_write, bch_journal_wq);
return;
}
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 94c756c66bd7..30ba9aeb5ee8 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -47,6 +47,7 @@ static int bcache_major;
static DEFINE_IDA(bcache_device_idx);
static wait_queue_head_t unregister_wait;
struct workqueue_struct *bcache_wq;
+struct workqueue_struct *bch_journal_wq;
#define BTREE_MAX_PAGES (256 * 1024 / PAGE_SIZE)
/* limitation of partitions number on single bcache device */
@@ -2341,6 +2342,9 @@ static void bcache_exit(void)
kobject_put(bcache_kobj);
if (bcache_wq)
destroy_workqueue(bcache_wq);
+ if (bch_journal_wq)
+ destroy_workqueue(bch_journal_wq);
+
if (bcache_major)
unregister_blkdev(bcache_major, "bcache");
unregister_reboot_notifier(&reboot);
@@ -2370,6 +2374,10 @@ static int __init bcache_init(void)
if (!bcache_wq)
goto err;
+ bch_journal_wq = alloc_workqueue("bch_journal", WQ_MEM_RECLAIM, 0);
+ if (!bch_journal_wq)
+ goto err;
+
bcache_kobj = kobject_create_and_add("bcache", fs_kobj);
if (!bcache_kobj)
goto err;
The patch below does not apply to the 4.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 0f843e65d9eef4936929bb036c5f771fb261eea4 Mon Sep 17 00:00:00 2001
From: Guoju Fang <fangguoju(a)gmail.com>
Date: Thu, 27 Sep 2018 23:41:46 +0800
Subject: [PATCH] bcache: add separate workqueue for journal_write to avoid
deadlock
After write SSD completed, bcache schedules journal_write work to
system_wq, which is a public workqueue in system, without WQ_MEM_RECLAIM
flag. system_wq is also a bound wq, and there may be no idle kworker on
current processor. Creating a new kworker may unfortunately need to
reclaim memory first, by shrinking cache and slab used by vfs, which
depends on bcache device. That's a deadlock.
This patch create a new workqueue for journal_write with WQ_MEM_RECLAIM
flag. It's rescuer thread will work to avoid the deadlock.
Signed-off-by: Guoju Fang <fangguoju(a)gmail.com>
Cc: stable(a)vger.kernel.org
Signed-off-by: Coly Li <colyli(a)suse.de>
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index 83504dd8100a..954dad29e6e8 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -965,6 +965,7 @@ void bch_prio_write(struct cache *ca);
void bch_write_bdev_super(struct cached_dev *dc, struct closure *parent);
extern struct workqueue_struct *bcache_wq;
+extern struct workqueue_struct *bch_journal_wq;
extern struct mutex bch_register_lock;
extern struct list_head bch_cache_sets;
diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
index 6116bbf870d8..522c7426f3a0 100644
--- a/drivers/md/bcache/journal.c
+++ b/drivers/md/bcache/journal.c
@@ -485,7 +485,7 @@ static void do_journal_discard(struct cache *ca)
closure_get(&ca->set->cl);
INIT_WORK(&ja->discard_work, journal_discard_work);
- schedule_work(&ja->discard_work);
+ queue_work(bch_journal_wq, &ja->discard_work);
}
}
@@ -592,7 +592,7 @@ static void journal_write_done(struct closure *cl)
: &j->w[0];
__closure_wake_up(&w->wait);
- continue_at_nobarrier(cl, journal_write, system_wq);
+ continue_at_nobarrier(cl, journal_write, bch_journal_wq);
}
static void journal_write_unlock(struct closure *cl)
@@ -627,7 +627,7 @@ static void journal_write_unlocked(struct closure *cl)
spin_unlock(&c->journal.lock);
btree_flush_write(c);
- continue_at(cl, journal_write, system_wq);
+ continue_at(cl, journal_write, bch_journal_wq);
return;
}
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 94c756c66bd7..30ba9aeb5ee8 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -47,6 +47,7 @@ static int bcache_major;
static DEFINE_IDA(bcache_device_idx);
static wait_queue_head_t unregister_wait;
struct workqueue_struct *bcache_wq;
+struct workqueue_struct *bch_journal_wq;
#define BTREE_MAX_PAGES (256 * 1024 / PAGE_SIZE)
/* limitation of partitions number on single bcache device */
@@ -2341,6 +2342,9 @@ static void bcache_exit(void)
kobject_put(bcache_kobj);
if (bcache_wq)
destroy_workqueue(bcache_wq);
+ if (bch_journal_wq)
+ destroy_workqueue(bch_journal_wq);
+
if (bcache_major)
unregister_blkdev(bcache_major, "bcache");
unregister_reboot_notifier(&reboot);
@@ -2370,6 +2374,10 @@ static int __init bcache_init(void)
if (!bcache_wq)
goto err;
+ bch_journal_wq = alloc_workqueue("bch_journal", WQ_MEM_RECLAIM, 0);
+ if (!bch_journal_wq)
+ goto err;
+
bcache_kobj = kobject_create_and_add("bcache", fs_kobj);
if (!bcache_kobj)
goto err;
The patch below does not apply to the 4.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 2cf7ea9f40fabee0f8b40db4eb2d1e85cc6c0a95 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini(a)redhat.com>
Date: Wed, 3 Oct 2018 10:34:00 +0200
Subject: [PATCH] KVM: VMX: hide flexpriority from guest when disabled at the
module level
As of commit 8d860bbeedef ("kvm: vmx: Basic APIC virtualization controls
have three settings"), KVM will disable VIRTUALIZE_APIC_ACCESSES when
a nested guest writes APIC_BASE MSR and kvm-intel.flexpriority=0,
whereas previously KVM would allow a nested guest to enable
VIRTUALIZE_APIC_ACCESSES so long as it's supported in hardware. That is,
KVM now advertises VIRTUALIZE_APIC_ACCESSES to a guest but doesn't
(always) allow setting it when kvm-intel.flexpriority=0, and may even
initially allow the control and then clear it when the nested guest
writes APIC_BASE MSR, which is decidedly odd even if it doesn't cause
functional issues.
Hide the control completely when the module parameter is cleared.
reported-by: Sean Christopherson <sean.j.christopherson(a)intel.com>
Fixes: 8d860bbeedef ("kvm: vmx: Basic APIC virtualization controls have three settings")
Cc: Jim Mattson <jmattson(a)google.com>
Cc: stable(a)vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com>
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 764ae031054f..55b62760b694 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -3589,12 +3589,12 @@ static void nested_vmx_setup_ctls_msrs(struct nested_vmx_msrs *msrs, bool apicv)
msrs->secondary_ctls_high);
msrs->secondary_ctls_low = 0;
msrs->secondary_ctls_high &=
- SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
SECONDARY_EXEC_DESC |
SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
SECONDARY_EXEC_APIC_REGISTER_VIRT |
SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
SECONDARY_EXEC_WBINVD_EXITING;
+
/*
* We can emulate "VMCS shadowing," even if the hardware
* doesn't support it.
@@ -3651,6 +3651,10 @@ static void nested_vmx_setup_ctls_msrs(struct nested_vmx_msrs *msrs, bool apicv)
msrs->secondary_ctls_high |=
SECONDARY_EXEC_UNRESTRICTED_GUEST;
+ if (flexpriority_enabled)
+ msrs->secondary_ctls_high |=
+ SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
+
/* miscellaneous data */
rdmsr(MSR_IA32_VMX_MISC,
msrs->misc_low,
The patch titled
Subject: mm/mmap.c: don't clobber partially overlapping VMA with MAP_FIXED_NOREPLACE
has been added to the -mm tree. Its filename is
mm-dont-clobber-partially-overlapping-vma-with-map_fixed_noreplace.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-dont-clobber-partially-overlapp…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-dont-clobber-partially-overlapp…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Jann Horn <jannh(a)google.com>
Subject: mm/mmap.c: don't clobber partially overlapping VMA with MAP_FIXED_NOREPLACE
Daniel Micay reports that attempting to use MAP_FIXED_NOREPLACE in an
application causes that application to randomly crash. The existing check
for handling MAP_FIXED_NOREPLACE looks up the first VMA that either
overlaps or follows the requested region, and then bails out if that VMA
overlaps *the start* of the requested region. It does not bail out if the
VMA only overlaps another part of the requested region.
Fix it by checking that the found VMA only starts at or after the end of
the requested region, in which case there is no overlap.
Test case:
user@debian:~$ cat mmap_fixed_simple.c
#include <sys/mman.h>
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#ifndef MAP_FIXED_NOREPLACE
#define MAP_FIXED_NOREPLACE 0x100000
#endif
int main(void) {
char *p;
errno = 0;
p = mmap((void*)0x10001000, 0x4000, PROT_NONE,
MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0);
printf("p1=%p err=%m\n", p);
errno = 0;
p = mmap((void*)0x10000000, 0x2000, PROT_READ,
MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0);
printf("p2=%p err=%m\n", p);
char cmd[100];
sprintf(cmd, "cat /proc/%d/maps", getpid());
system(cmd);
return 0;
}
user@debian:~$ gcc -o mmap_fixed_simple mmap_fixed_simple.c
user@debian:~$ ./mmap_fixed_simple
p1=0x10001000 err=Success
p2=0x10000000 err=Success
10000000-10002000 r--p 00000000 00:00 0
10002000-10005000 ---p 00000000 00:00 0
564a9a06f000-564a9a070000 r-xp 00000000 fe:01 264004
/home/user/mmap_fixed_simple
564a9a26f000-564a9a270000 r--p 00000000 fe:01 264004
/home/user/mmap_fixed_simple
564a9a270000-564a9a271000 rw-p 00001000 fe:01 264004
/home/user/mmap_fixed_simple
564a9a54a000-564a9a56b000 rw-p 00000000 00:00 0 [heap]
7f8eba447000-7f8eba5dc000 r-xp 00000000 fe:01 405885
/lib/x86_64-linux-gnu/libc-2.24.so
7f8eba5dc000-7f8eba7dc000 ---p 00195000 fe:01 405885
/lib/x86_64-linux-gnu/libc-2.24.so
7f8eba7dc000-7f8eba7e0000 r--p 00195000 fe:01 405885
/lib/x86_64-linux-gnu/libc-2.24.so
7f8eba7e0000-7f8eba7e2000 rw-p 00199000 fe:01 405885
/lib/x86_64-linux-gnu/libc-2.24.so
7f8eba7e2000-7f8eba7e6000 rw-p 00000000 00:00 0
7f8eba7e6000-7f8eba809000 r-xp 00000000 fe:01 405876
/lib/x86_64-linux-gnu/ld-2.24.so
7f8eba9e9000-7f8eba9eb000 rw-p 00000000 00:00 0
7f8ebaa06000-7f8ebaa09000 rw-p 00000000 00:00 0
7f8ebaa09000-7f8ebaa0a000 r--p 00023000 fe:01 405876
/lib/x86_64-linux-gnu/ld-2.24.so
7f8ebaa0a000-7f8ebaa0b000 rw-p 00024000 fe:01 405876
/lib/x86_64-linux-gnu/ld-2.24.so
7f8ebaa0b000-7f8ebaa0c000 rw-p 00000000 00:00 0
7ffcc99fa000-7ffcc9a1b000 rw-p 00000000 00:00 0 [stack]
7ffcc9b44000-7ffcc9b47000 r--p 00000000 00:00 0 [vvar]
7ffcc9b47000-7ffcc9b49000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0
[vsyscall]
user@debian:~$ uname -a
Linux debian 4.19.0-rc6+ #181 SMP Wed Oct 3 23:43:42 CEST 2018 x86_64 GNU/Linux
user@debian:~$
As you can see, the first page of the mapping at 0x10001000 was clobbered.
Link: http://lkml.kernel.org/r/20181010152736.99475-1-jannh@google.com
Fixes: a4ff8e8620d3 ("mm: introduce MAP_FIXED_NOREPLACE")
Signed-off-by: Jann Horn <jannh(a)google.com>
Reported-by: Daniel Micay <danielmicay(a)gmail.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Acked-by: John Hubbard <jhubbard(a)nvidia.com>
Acked-by: Kees Cook <keescook(a)chromium.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
diff -puN mm/mmap.c~mm-dont-clobber-partially-overlapping-vma-with-map_fixed_noreplace mm/mmap.c
--- a/mm/mmap.c~mm-dont-clobber-partially-overlapping-vma-with-map_fixed_noreplace
+++ a/mm/mmap.c
@@ -1410,7 +1410,7 @@ unsigned long do_mmap(struct file *file,
if (flags & MAP_FIXED_NOREPLACE) {
struct vm_area_struct *vma = find_vma(mm, addr);
- if (vma && vma->vm_start <= addr)
+ if (vma && vma->vm_start < addr + len)
return -EEXIST;
}
_
Patches currently in -mm which might be from jannh(a)google.com are
mm-dont-clobber-partially-overlapping-vma-with-map_fixed_noreplace.patch
mm-vmstat-assert-that-vmstat_text-is-in-sync-with-stat_items_size.patch
reiserfs-propagate-errors-from-fill_with_dentries-properly.patch
Linus (aka Greg),
It was reported that trace_printk() was not reporting properly
values that came after a dereference pointer.
trace_printk() utilizes vbin_printf() and bstr_printf() to keep the
overhead of tracing down. vbin_printf() does not do any conversions
and just stors the string format and the raw arguments into the
buffer. bstr_printf() is used to read the buffer and does the conversions
to complete the printf() output.
This can be troublesome with dereferenced pointers because the reference
may be different from the time vbin_printf() is called to the time
bstr_printf() is called. To fix this, a prior commit changed vbin_printf()
to convert dereferenced pointers into strings and load the converted
string into the buffer. But the change to bstr_printf() had an off-by-one
error and didn't account for the nul character at the end of the string
and this corrupted the rest of the values in the format that came after
a dereferenced pointer.
Please pull the latest trace-v4.19-rc5 tree, which can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git
trace-v4.19-rc5
Tag SHA1: b5fc80d980ae316323e88c165084deef39afd168
Head SHA1: 62165600ae73ebd76e2d9b992b36360408d570d8
Steven Rostedt (VMware) (1):
vsprintf: Fix off-by-one bug in bstr_printf() processing dereferenced pointers
----
lib/vsprintf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---------------------------
commit 62165600ae73ebd76e2d9b992b36360408d570d8
Author: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
Date: Fri Oct 5 10:08:03 2018 -0400
vsprintf: Fix off-by-one bug in bstr_printf() processing dereferenced pointers
The functions vbin_printf() and bstr_printf() are used by trace_printk() to
try to keep the overhead down during printing. trace_printk() uses
vbin_printf() at the time of execution, as it only scans the fmt string to
record the printf values into the buffer, and then uses vbin_printf() to do
the conversions to print the string based on the format and the saved
values in the buffer.
This is an issue for dereferenced pointers, as before commit 841a915d20c7b,
the processing of the pointer could happen some time after the pointer value
was recorded (reading the trace buffer). This means the processing of the
value at a later time could show different results, or even crash the
system, if the pointer no longer existed.
Commit 841a915d20c7b addressed this by processing dereferenced pointers at
the time of execution and save the result in the ring buffer as a string.
The bstr_printf() would then treat these pointers as normal strings, and
print the value. But there was an off-by-one bug here, where after
processing the argument, it move the pointer only "strlen(arg)" which made
the arg pointer not point to the next argument in the ring buffer, but
instead point to the nul character of the last argument. This causes any
values after a dereferenced pointer to be corrupted.
Cc: stable(a)vger.kernel.org
Fixes: 841a915d20c7b ("vsprintf: Do not have bprintf dereference pointers")
Reported-by: Nikolay Borisov <nborisov(a)suse.com>
Tested-by: Nikolay Borisov <nborisov(a)suse.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index d5b3a3f95c01..812e59e13fe6 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -2794,7 +2794,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
copy = end - str;
memcpy(str, args, copy);
str += len;
- args += len;
+ args += len + 1;
}
}
if (process)
Currently we return NOTIFY_DONE for any event which we don't think is
ours. However, many laptops will send more then just an ATIF event and
will also send an ACPI_VIDEO_NOTIFY_PROBE event as well. Since we don't
check for this, we return NOTIFY_DONE which causes a keypress for the
ACPI event to be propogated to userspace. This is the equivalent of
someone pressing the display key on a laptop every time there's a
hotplug event.
So, check for ACPI_VIDEO_NOTIFY_PROBE events and suppress keypresses
from them.
Signed-off-by: Lyude Paul <lyude(a)redhat.com>
Cc: stable(a)vger.kernel.org
---
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index 353993218f21..f008804f0b97 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -358,7 +358,9 @@ static int amdgpu_atif_get_sbios_requests(struct amdgpu_atif *atif,
*
* Checks the acpi event and if it matches an atif event,
* handles it.
- * Returns NOTIFY code
+ *
+ * Returns:
+ * NOTIFY_BAD or NOTIFY_DONE, depending on the event.
*/
static int amdgpu_atif_handler(struct amdgpu_device *adev,
struct acpi_bus_event *event)
@@ -372,11 +374,16 @@ static int amdgpu_atif_handler(struct amdgpu_device *adev,
if (strcmp(event->device_class, ACPI_VIDEO_CLASS) != 0)
return NOTIFY_DONE;
+ /* Is this actually our event? */
if (!atif ||
!atif->notification_cfg.enabled ||
- event->type != atif->notification_cfg.command_code)
- /* Not our event */
- return NOTIFY_DONE;
+ event->type != atif->notification_cfg.command_code) {
+ /* These events will generate keypresses otherwise */
+ if (event->type == ACPI_VIDEO_NOTIFY_PROBE)
+ return NOTIFY_BAD;
+ else
+ return NOTIFY_DONE;
+ }
if (atif->functions.sbios_requests) {
struct atif_sbios_requests req;
@@ -385,7 +392,7 @@ static int amdgpu_atif_handler(struct amdgpu_device *adev,
count = amdgpu_atif_get_sbios_requests(atif, &req);
if (count <= 0)
- return NOTIFY_DONE;
+ return NOTIFY_BAD;
DRM_DEBUG_DRIVER("ATIF: %d pending SBIOS requests\n", count);
--
2.17.1
xen_qlock_wait() isn't safe for nested calls due to interrupts. A call
of xen_qlock_kick() might be ignored in case a deeper nesting level
was active right before the call of xen_poll_irq():
CPU 1: CPU 2:
spin_lock(lock1)
spin_lock(lock1)
-> xen_qlock_wait()
-> xen_clear_irq_pending()
Interrupt happens
spin_unlock(lock1)
-> xen_qlock_kick(CPU 2)
spin_lock_irqsave(lock2)
spin_lock_irqsave(lock2)
-> xen_qlock_wait()
-> xen_clear_irq_pending()
clears kick for lock1
-> xen_poll_irq()
spin_unlock_irq_restore(lock2)
-> xen_qlock_kick(CPU 2)
wakes up
spin_unlock_irq_restore(lock2)
IRET
resumes in xen_qlock_wait()
-> xen_poll_irq()
never wakes up
The solution is to disable interrupts in xen_qlock_wait() and not to
poll for the irq in case xen_qlock_wait() is called in nmi context.
Cc: stable(a)vger.kernel.org
Cc: Waiman.Long(a)hp.com
Cc: peterz(a)infradead.org
Signed-off-by: Juergen Gross <jgross(a)suse.com>
---
arch/x86/xen/spinlock.c | 24 ++++++++++--------------
1 file changed, 10 insertions(+), 14 deletions(-)
diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
index cd210a4ba7b1..e8d880e98057 100644
--- a/arch/x86/xen/spinlock.c
+++ b/arch/x86/xen/spinlock.c
@@ -39,29 +39,25 @@ static void xen_qlock_kick(int cpu)
*/
static void xen_qlock_wait(u8 *byte, u8 val)
{
+ unsigned long flags;
int irq = __this_cpu_read(lock_kicker_irq);
/* If kicker interrupts not initialized yet, just spin */
- if (irq == -1)
+ if (irq == -1 || in_nmi())
return;
- /* If irq pending already clear it and return. */
+ /* Guard against reentry. */
+ local_irq_save(flags);
+
+ /* If irq pending already clear it. */
if (xen_test_irq_pending(irq)) {
xen_clear_irq_pending(irq);
- return;
+ } else if (READ_ONCE(*byte) == val) {
+ /* Block until irq becomes pending (or a spurious wakeup) */
+ xen_poll_irq(irq);
}
- if (READ_ONCE(*byte) != val)
- return;
-
- /*
- * If an interrupt happens here, it will leave the wakeup irq
- * pending, which will cause xen_poll_irq() to return
- * immediately.
- */
-
- /* Block until irq becomes pending (or perhaps a spurious wakeup) */
- xen_poll_irq(irq);
+ local_irq_restore(flags);
}
static irqreturn_t dummy_handler(int irq, void *dev_id)
--
2.16.4
Hi,
https://www.kernel.org is either down or very slow for me(based in The Netherlands, Europe).
I do understand this is not the right ML to report this issue, but the contact page doesn't load for
me and as a result I could find the right communication channel.
Cheers,
Pavlos
The boot loader version reported via sysfs is wrong in case of the
kernel being booted via the Xen PVH boot entry. it should be 2.12
(0x020c), but it is reported to be 2.18 (0x0212).
As the current way to set the version is error prone use the more
readable variant (2 << 8) | 12.
Cc: <stable(a)vger.kernel.org> # 4.12
Signed-off-by: Juergen Gross <jgross(a)suse.com>
---
arch/x86/xen/enlighten_pvh.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/xen/enlighten_pvh.c b/arch/x86/xen/enlighten_pvh.c
index c85d1a88f476..f7f77023288a 100644
--- a/arch/x86/xen/enlighten_pvh.c
+++ b/arch/x86/xen/enlighten_pvh.c
@@ -75,7 +75,7 @@ static void __init init_pvh_bootparams(void)
* Version 2.12 supports Xen entry point but we will use default x86/PC
* environment (i.e. hardware_subarch 0).
*/
- pvh_bootparams.hdr.version = 0x212;
+ pvh_bootparams.hdr.version = (2 << 8) | 12;
pvh_bootparams.hdr.type_of_loader = (9 << 4) | 0; /* Xen loader */
x86_init.acpi.get_root_pointer = pvh_get_root_pointer;
--
2.16.4
This is the start of the stable review cycle for the 4.9.132 release.
There are 59 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Oct 10 17:55:28 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.132-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.132-rc1
Ashish Samant <ashish.samant(a)oracle.com>
ocfs2: fix locking for res->tracking and dlm->tracking_list
Jann Horn <jannh(a)google.com>
proc: restrict kernel stack dumps to root
Ricardo Ribalda Delgado <ricardo.ribalda(a)gmail.com>
gpiolib: Free the last requested descriptor
Leonard Crestez <leonard.crestez(a)nxp.com>
crypto: mxs-dcp - Fix wait logic on chan threads
Waiman Long <longman(a)redhat.com>
crypto: qat - Fix KASAN stack-out-of-bounds bug in adf_probe()
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
ALSA: hda/realtek - Cannot adjust speaker's volume on Dell XPS 27 7760
Aurelien Aptel <aaptel(a)suse.com>
smb2: fix missing files in root share directory listing
Andreas Gruenbacher <agruenba(a)redhat.com>
sysfs: Do not return POSIX ACL xattrs via listxattr
Josh Abraham <j.abraham1776(a)gmail.com>
xen: fix GCC warning and remove duplicate EVTCHN_ROW/EVTCHN_COL usage
Olaf Hering <olaf(a)aepfle.de>
xen: avoid crash in disable_hotplug_cpu
Vitaly Kuznetsov <vkuznets(a)redhat.com>
xen/manage: don't complain about an empty value in control/sysrq node
Dan Carpenter <dan.carpenter(a)oracle.com>
cifs: read overflow in is_valid_oplock_break()
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qeth: don't dump past end of unknown HW header
Wenjia Zhang <wenjia(a)linux.ibm.com>
s390/qeth: use vzalloc for QUERY OAT buffer
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED
Miguel Ojeda <miguel.ojeda.sandonis(a)gmail.com>
arm64: jump_label.h: use asm_volatile_goto macro instead of "asm goto"
Randy Dunlap <rdunlap(a)infradead.org>
hexagon: modify ffs() and fls() to return int
Randy Dunlap <rdunlap(a)infradead.org>
arch/hexagon: fix kernel/dma.c build warning
Joe Thornber <ejt(a)redhat.com>
dm thin metadata: try to avoid ever aborting transactions
Jacek Tomaka <jacek.tomaka(a)poczta.fm>
perf/x86/intel: Add support/quirk for the MISPREDICT bit on Knights Landing CPUs
Netanel Belgazal <netanel(a)amazon.com>
net: ena: fix driver when PAGE_SIZE == 64kB
Stephen Rothwell <sfr(a)canb.auug.org.au>
fs/cifs: suppress a string overflow warning
Heinz Mauelshagen <heinzm(a)redhat.com>
dm raid: fix rebuild of specific devices by updating superblock
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/TBDdevinit: don't fail when PMU/PRE_OS is missing from VBIOS
Daniel Jurgens <danielj(a)mellanox.com>
net/mlx5: Consider PCI domain in search for next dev
Sagi Grimberg <sagi(a)grimberg.me>
nvmet-rdma: fix possible bogus dereference under heavy load
Ben Hutchings <ben.hutchings(a)codethink.co.uk>
USB: yurex: Check for truncation in yurex_read()
Jann Horn <jannh(a)google.com>
RDMA/ucma: check fd type in ucma_migrate_id()
Sandipan Das <sandipan(a)linux.ibm.com>
perf probe powerpc: Ignore SyS symbols irrespective of endianness
Hisao Tanabe <xtanabe(a)gmail.com>
perf evsel: Fix potential null pointer dereference in perf_evsel__new_idx()
Harry Mallon <hjmallon(a)gmail.com>
HID: hid-saitek: Add device ID for RAT 7 Contagion
Stephen Boyd <swboyd(a)chromium.org>
pinctrl: msm: Really mask level interrupts to prevent latching
Anton Vasilyev <vasilyev(a)ispras.ru>
usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i]
Sean O'Brien <seobrien(a)chromium.org>
HID: add support for Apple Magic Keyboards
Daniel Black <daniel(a)linux.ibm.com>
mm: madvise(MADV_DODUMP): allow hugetlbfs pages
Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com>
tools/vm/page-types.c: fix "defined but not used" warning
Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com>
tools/vm/slabinfo.c: fix sign-compare warning
Emmanuel Grumbach <emmanuel.grumbach(a)intel.com>
mac80211: shorten the IBSS debug messages
Emmanuel Grumbach <emmanuel.grumbach(a)intel.com>
mac80211: don't Tx a deauth frame if the AP forbade Tx
Ilan Peer <ilan.peer(a)intel.com>
mac80211: Fix station bandwidth setting after channel switch
Emmanuel Grumbach <emmanuel.grumbach(a)intel.com>
mac80211: fix a race between restart and CSA flows
Dan Carpenter <dan.carpenter(a)oracle.com>
cfg80211: fix a type issue in ieee80211_chandef_to_operating_class()
Jon Kuhn <jkuhn(a)barracuda.com>
fs/cifs: don't translate SFM_SLASH (U+F026) to backslash
Jia-Ju Bai <baijiaju1990(a)gmail.com>
net: cadence: Fix a sleep-in-atomic-context bug in macb_halt_tx()
Masahiro Yamada <yamada.masahiro(a)socionext.com>
i2c: uniphier-f: issue STOP only for last message or I2C_M_STOP
Masahiro Yamada <yamada.masahiro(a)socionext.com>
i2c: uniphier: issue STOP only for last message or I2C_M_STOP
Xiao Ni <xni(a)redhat.com>
RAID10 BUG_ON in raise_barrier when force is true and conf->barrier is 0
Will Deacon <will.deacon(a)arm.com>
ARC: atomics: unbork atomic_fetch_##op()
Vincent Whitchurch <vincent.whitchurch(a)axis.com>
gpio: Fix crash due to registration race
Arunk Khandavalli <akhandav(a)codeaurora.org>
cfg80211: nl80211_update_ft_ies() to validate NL80211_ATTR_IE
Peng Li <lipeng321(a)huawei.com>
net: hns: add netif_carrier_off before change speed and duplex
Yuan-Chi Pang <fu3mo6goo(a)gmail.com>
mac80211: mesh: fix HWMP sequence numbering to follow standard
Michael Hennerich <michael.hennerich(a)analog.com>
gpio: adp5588: Fix sleep-in-atomic-context bug
Danek Duvall <duvall(a)comfychair.org>
mac80211_hwsim: correct use of IEEE80211_VHT_CAP_RXSTBC_X
Danek Duvall <duvall(a)comfychair.org>
mac80211: correct use of IEEE80211_VHT_CAP_RXSTBC_X
Paul Mackerras <paulus(a)ozlabs.org>
KVM: PPC: Book3S HV: Don't truncate HPTE index in xlate function
Toke Høiland-Jørgensen <toke(a)toke.dk>
mac80211: Run TXQ teardown code before de-registering interfaces
Frederic Weisbecker <fweisbec(a)gmail.com>
time: Introduce jiffies64_to_nsecs()
Jan Kiszka <jan.kiszka(a)siemens.com>
serial: mvebu-uart: Fix reporting of effective CSIZE to userspace
-------------
Diffstat:
Makefile | 4 +-
arch/arc/include/asm/atomic.h | 2 +-
arch/arm64/include/asm/jump_label.h | 4 +-
arch/hexagon/include/asm/bitops.h | 4 +-
arch/hexagon/kernel/dma.c | 2 +-
arch/powerpc/kvm/book3s_64_mmu_hv.c | 2 +-
arch/x86/events/intel/lbr.c | 4 ++
drivers/crypto/mxs-dcp.c | 53 +++++++++-------
drivers/crypto/qat/qat_c3xxx/adf_drv.c | 6 +-
drivers/crypto/qat/qat_c3xxxvf/adf_drv.c | 6 +-
drivers/crypto/qat/qat_c62x/adf_drv.c | 6 +-
drivers/crypto/qat/qat_c62xvf/adf_drv.c | 6 +-
drivers/crypto/qat/qat_dh895xcc/adf_drv.c | 6 +-
drivers/crypto/qat/qat_dh895xccvf/adf_drv.c | 6 +-
drivers/gpio/gpio-adp5588.c | 24 +++++--
drivers/gpio/gpiolib-of.c | 1 +
drivers/gpio/gpiolib.c | 2 +-
.../gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c | 3 +-
drivers/hid/hid-apple.c | 9 ++-
drivers/hid/hid-ids.h | 3 +
drivers/hid/hid-saitek.c | 2 +
drivers/i2c/busses/i2c-uniphier-f.c | 7 +--
drivers/i2c/busses/i2c-uniphier.c | 7 +--
drivers/infiniband/core/ucma.c | 6 ++
drivers/md/dm-raid.c | 5 ++
drivers/md/dm-thin-metadata.c | 36 ++++++++++-
drivers/md/dm-thin.c | 73 +++++++++++++++++++---
drivers/md/raid10.c | 5 +-
drivers/net/ethernet/amazon/ena/ena_netdev.c | 10 +--
drivers/net/ethernet/amazon/ena/ena_netdev.h | 11 ++++
drivers/net/ethernet/cadence/macb.c | 2 +-
drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 2 +
drivers/net/ethernet/mellanox/mlx5/core/dev.c | 7 ++-
drivers/net/ethernet/realtek/r8169.c | 9 ++-
drivers/net/wireless/mac80211_hwsim.c | 3 -
drivers/nvme/target/rdma.c | 27 +++++++-
drivers/pinctrl/qcom/pinctrl-msm.c | 24 +++++++
drivers/s390/net/qeth_core_main.c | 5 +-
drivers/s390/net/qeth_l2_main.c | 2 +-
drivers/s390/net/qeth_l3_main.c | 2 +-
drivers/tty/serial/mvebu-uart.c | 4 +-
drivers/usb/gadget/udc/fotg210-udc.c | 15 +++--
drivers/usb/misc/yurex.c | 3 +
drivers/xen/cpu_hotplug.c | 15 ++---
drivers/xen/events/events_base.c | 2 +-
drivers/xen/manage.c | 6 +-
fs/cifs/cifs_unicode.c | 3 -
fs/cifs/cifssmb.c | 11 +++-
fs/cifs/misc.c | 8 +++
fs/cifs/smb2ops.c | 2 +-
fs/ocfs2/dlm/dlmmaster.c | 4 +-
fs/proc/base.c | 14 +++++
fs/xattr.c | 24 +++----
include/linux/jiffies.h | 2 +
kernel/time/time.c | 10 +++
kernel/time/timeconst.bc | 6 ++
mm/madvise.c | 2 +-
net/mac80211/ibss.c | 22 +++----
net/mac80211/main.c | 28 +++++++--
net/mac80211/mesh_hwmp.c | 4 ++
net/mac80211/mlme.c | 70 ++++++++++++++++++++-
net/wireless/nl80211.c | 1 +
net/wireless/util.c | 2 +-
sound/pci/hda/patch_realtek.c | 1 +
tools/perf/arch/powerpc/util/sym-handling.c | 4 +-
tools/perf/util/evsel.c | 5 +-
tools/vm/page-types.c | 6 --
tools/vm/slabinfo.c | 4 +-
68 files changed, 510 insertions(+), 166 deletions(-)