The page_huge_active() can be called from scan_movable_pages() which
do not hold a reference count to the HugeTLB page. So when we call
page_huge_active() from scan_movable_pages(), the HugeTLB page can
be freed parallel. Then we will trigger a BUG_ON which is in the
page_huge_active() when CONFIG_DEBUG_VM is enabled. Just remove the
VM_BUG_ON_PAGE.
Fixes: 7e1f049efb86 ("mm: hugetlb: cleanup using paeg_huge_active()")
Signed-off-by: Muchun Song <songmuchun(a)bytedance.com>
Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: stable(a)vger.kernel.org
---
mm/hugetlb.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index e7ed30afbb8f..5940bf0c49b9 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1360,8 +1360,7 @@ struct hstate *size_to_hstate(unsigned long size)
*/
bool page_huge_active(struct page *page)
{
- VM_BUG_ON_PAGE(!PageHuge(page), page);
- return PageHead(page) && PagePrivate(&page[1]);
+ return PageHeadHuge(page) && PagePrivate(&page[1]);
}
/* never called for tail page */
--
2.11.0
There is a race between isolate_huge_page() and __free_huge_page().
CPU0: CPU1:
if (PageHuge(page))
put_page(page)
__free_huge_page(page)
spin_lock(&hugetlb_lock)
update_and_free_page(page)
set_compound_page_dtor(page,
NULL_COMPOUND_DTOR)
spin_unlock(&hugetlb_lock)
isolate_huge_page(page)
// trigger BUG_ON
VM_BUG_ON_PAGE(!PageHead(page), page)
spin_lock(&hugetlb_lock)
page_huge_active(page)
// trigger BUG_ON
VM_BUG_ON_PAGE(!PageHuge(page), page)
spin_unlock(&hugetlb_lock)
When we isolate a HugeTLB page on CPU0. Meanwhile, we free it to the
buddy allocator on CPU1. Then, we can trigger a BUG_ON on CPU0. Because
it is already freed to the buddy allocator.
Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle hugepage")
Signed-off-by: Muchun Song <songmuchun(a)bytedance.com>
Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: stable(a)vger.kernel.org
---
mm/hugetlb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index a176ceed55f1..e7ed30afbb8f 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -5575,9 +5575,9 @@ bool isolate_huge_page(struct page *page, struct list_head *list)
{
bool ret = true;
- VM_BUG_ON_PAGE(!PageHead(page), page);
spin_lock(&hugetlb_lock);
- if (!page_huge_active(page) || !get_page_unless_zero(page)) {
+ if (!PageHeadHuge(page) || !page_huge_active(page) ||
+ !get_page_unless_zero(page)) {
ret = false;
goto unlock;
}
--
2.11.0
Hi Greg, Sasha,
This series contains some scripts/gdb/ fixes that are already present in
newer stable kernels.
Thanks!
André Draszik (1):
scripts/gdb: make lx-dmesg command work (reliably)
Du Changbin (1):
scripts/gdb: fix lx-version string output
Leonard Crestez (2):
scripts/gdb: lx-dmesg: cast log_buf to void* for addr fetch
scripts/gdb: lx-dmesg: use explicit encoding=utf8 errors=replace
scripts/gdb/linux/dmesg.py | 22 +++++++++++++++-------
scripts/gdb/linux/proc.py | 2 +-
2 files changed, 16 insertions(+), 8 deletions(-)
--
2.25.1
This is the start of the stable review cycle for the 5.10.6 release.
There are 20 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 09 Jan 2021 14:30:35 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.6-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.6-rc1
Zhang Xiaohui <ruc_zhangxiaohui(a)163.com>
mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start
Eric W. Biederman <ebiederm(a)xmission.com>
exec: Transform exec_update_mutex into a rw_semaphore
Eric W. Biederman <ebiederm(a)xmission.com>
rwsem: Implement down_read_interruptible
Eric W. Biederman <ebiederm(a)xmission.com>
rwsem: Implement down_read_killable_nested
peterz(a)infradead.org <peterz(a)infradead.org>
perf: Break deadlock involving exec_update_mutex
Miklos Szeredi <mszeredi(a)redhat.com>
fuse: fix bad inode
Jason Gunthorpe <jgg(a)ziepe.ca>
RDMA/siw,rxe: Make emulated devices virtual in the device tree
Christoph Hellwig <hch(a)lst.de>
RDMA/core: remove use of dma_virt_ops
Stanley Chu <stanley.chu(a)mediatek.com>
scsi: ufs: Re-enable WriteBooster after device reset
Adrian Hunter <adrian.hunter(a)intel.com>
scsi: ufs: Allow an error return value from ->device_reset()
Imre Deak <imre.deak(a)intel.com>
drm/i915/tgl: Fix Combo PHY DPLL fractional divider for 38.4MHz ref clock
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda/hdmi: Fix incorrect mutex unlock in silent_stream_disable()
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek - Modify Dell platform name
Edward Vear <edwardvear(a)gmail.com>
Bluetooth: Fix attempting to set RPA timeout when unsupported
Josh Poimboeuf <jpoimboe(a)redhat.com>
kdev_t: always inline major/minor helper functions
Rasmus Villemoes <rasmus.villemoes(a)prevas.dk>
dt-bindings: rtc: add reset-source property
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
rtc: pcf2127: only use watchdog when explicitly available
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
rtc: pcf2127: move watchdog initialisation to a separate function
Felix Fietkau <nbd(a)nbd.name>
Revert "mtd: spinand: Fix OOB read"
Alex Deucher <alexdeucher(a)gmail.com>
Revert "drm/amd/display: Fix memory leaks in S3 resume"
-------------
Diffstat:
Documentation/devicetree/bindings/rtc/rtc.yaml | 5 ++
Makefile | 4 +-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +-
drivers/gpu/drm/i915/display/intel_dpll_mgr.c | 41 ++++++++-----
drivers/infiniband/core/device.c | 43 ++++++-------
drivers/infiniband/core/rw.c | 5 +-
drivers/infiniband/sw/rdmavt/Kconfig | 1 -
drivers/infiniband/sw/rdmavt/mr.c | 6 +-
drivers/infiniband/sw/rdmavt/vt.c | 8 ---
drivers/infiniband/sw/rxe/Kconfig | 1 -
drivers/infiniband/sw/rxe/rxe_net.c | 12 ----
drivers/infiniband/sw/rxe/rxe_verbs.c | 8 ---
drivers/infiniband/sw/rxe/rxe_verbs.h | 1 -
drivers/infiniband/sw/siw/Kconfig | 1 -
drivers/infiniband/sw/siw/siw.h | 1 -
drivers/infiniband/sw/siw/siw_main.c | 26 +-------
drivers/mtd/nand/spi/core.c | 4 --
drivers/net/wireless/marvell/mwifiex/join.c | 2 +
drivers/nvme/target/rdma.c | 3 +-
drivers/rtc/rtc-pcf2127.c | 57 ++++++++++--------
drivers/scsi/ufs/ufs-mediatek.c | 4 +-
drivers/scsi/ufs/ufs-qcom.c | 6 +-
drivers/scsi/ufs/ufshcd.h | 16 +++--
fs/exec.c | 12 ++--
fs/fuse/acl.c | 6 ++
fs/fuse/dir.c | 37 ++++++++++--
fs/fuse/file.c | 19 +++---
fs/fuse/fuse_i.h | 12 ++++
fs/fuse/inode.c | 4 +-
fs/fuse/readdir.c | 4 +-
fs/fuse/xattr.c | 9 +++
fs/proc/base.c | 10 ++--
include/linux/kdev_t.h | 22 +++----
include/linux/rwsem.h | 3 +
include/linux/sched/signal.h | 11 ++--
include/rdma/ib_verbs.h | 73 ++++++++++++++++-------
init/init_task.c | 2 +-
kernel/events/core.c | 52 ++++++++--------
kernel/fork.c | 6 +-
kernel/kcmp.c | 30 +++++-----
kernel/locking/rwsem.c | 40 +++++++++++++
kernel/pid.c | 4 +-
net/bluetooth/hci_core.c | 2 +-
sound/pci/hda/patch_hdmi.c | 2 +-
sound/pci/hda/patch_realtek.c | 2 +-
45 files changed, 363 insertions(+), 257 deletions(-)
Since commit 55567976629e ("genirq/irqdomain: Allow partial trimming of
irq_data hierarchy") the irq_data chain is valided.
The irq_domain_trim_hierarchy() function doesn't consider the irq + ipi
domain hierarchy as valid, since the ipi domain has the irq domain set
as parent, but the parent domain has no chip set. Hence the boot ends in
a kernel panic.
Set the chip for the parent domain as it is done in the mips gic irq
driver, to have a valid irq_data chain.
Fixes: 3838a547fda2 ("irqchip: mips-cpu: Introduce IPI IRQ domain support")
Cc: <stable(a)vger.kernel.org> # v5.10+
Signed-off-by: Mathias Kresin <dev(a)kresin.me>
---
drivers/irqchip/irq-mips-cpu.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/irqchip/irq-mips-cpu.c b/drivers/irqchip/irq-mips-cpu.c
index 95d4fd8f7a96..0bbb0b2d0dd5 100644
--- a/drivers/irqchip/irq-mips-cpu.c
+++ b/drivers/irqchip/irq-mips-cpu.c
@@ -197,6 +197,13 @@ static int mips_cpu_ipi_alloc(struct irq_domain *domain, unsigned int virq,
if (ret)
return ret;
+ ret = irq_domain_set_hwirq_and_chip(domain->parent, virq + i, hwirq,
+ &mips_mt_cpu_irq_controller,
+ NULL);
+
+ if (ret)
+ return ret;
+
ret = irq_set_irq_type(virq + i, IRQ_TYPE_LEVEL_HIGH);
if (ret)
return ret;
--
2.25.1
On Fri, 8 Jan 2021 10:29:01 -0600, Suman Anna wrote:
> The TI PRUSS INTC irqchip driver handles the local interrupt controller
> which is a child device of it's parent PRUSS/ICSSG device. The driver
> was upstreamed in parallel with the PRUSS platform driver, and was
> configurable independently previously. The PRUSS interrupt controller
> is an integral part of the overall PRUSS software architecture, and is
> not useful at all by itself.
>
> [...]
Applied to irq/irqchip-next, thanks!
[1/1] irqchip: Simplify the TI_PRUSS_INTC Kconfig
commit: b8e594fa20d2e33d40c7a8c7c106549a35c38972
Cheers,
M.
--
Without deviation from the norm, progress is not possible.