I'm announcing the release of the 4.19.14 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Aaro Koskinen (1):
MIPS: OCTEON: mark RGMII interface disabled on OCTEON III
Adrian Hunter (4):
perf machine: Record if a arch has a single user/kernel address space
perf thread: Add fallback functions for cases where cpumode is insufficient
perf tools: Use fallback for sample_addr_correlates_sym() cases
perf script: Use fallbacks for branch stacks
Alaa Hleihel (1):
net/mlx5e: Remove the false indication of software timestamping support
Alexey Brodkin (1):
clocksource/drivers/arc_timer: Utilize generic sched_clock
Allan W. Nielsen (1):
mscc: Configured MAC entries should be locked.
Anand Jain (2):
btrfs: dev-replace: go back to suspended state if target device is missing
btrfs: dev-replace: go back to suspend state if another EXCL_OP is running
Antoine Tenart (2):
net: mvpp2: 10G modes aren't supported on all ports
net: mvpp2: fix the phylink mode validation
Arnaldo Carvalho de Melo (1):
perf env: Also consider env->arch == NULL as local operation
Arnd Bergmann (1):
mtd: atmel-quadspi: disallow building on ebsa110
Atul Gupta (1):
crypto: chcr - small packet Tx stalls the queue
Ben Hutchings (1):
perf pmu: Suppress potential format-truncation warning
Boris Brezillon (1):
mtd: rawnand: omap2: Pass the parent of pdev to dma_request_chan()
Breno Leitao (1):
powerpc/tm: Unset MSR[TS] if not recheckpointing
Christoffer Dall (1):
KVM: arm/arm64: vgic-v2: Set active_source to 0 when restoring state
Christophe JAILLET (1):
net/ipv6: Fix a test against 'ipv6_find_idev()' return value
Claudiu Beznea (1):
net: macb: restart tx after tx used bit read
Colin Ian King (1):
staging: wilc1000: fix missing read_write setting when reading data
Cong Wang (11):
ax25: fix a use-after-free in ax25_fillin_cb()
ipv6: explicitly initialize udp6_addr in udp_sock_create6()
netrom: fix locking in nr_find_socket()
net/wan: fix a double free in x25_asy_open_tty()
ptr_ring: wrap back ->producer in __ptr_ring_swap_queue()
tipc: check tsk->group in tipc_wait_for_cond()
tipc: compare remote and local protocols in tipc_udp_enable()
tipc: fix a double free in tipc_enable_bearer()
tipc: fix a double kfree_skb()
tipc: use lock_sock() in tipc_sk_reinit()
tipc: check group dests after tipc_wait_for_cond()
Dan Carpenter (1):
net: stmmac: Fix an error code in probe()
Dan Williams (2):
x86/mm: Drop usage of __flush_tlb_all() in kernel_physical_mapping_init()
dax: Use non-exclusive wait in wait_entry_unlocked()
Davide Caratti (1):
net: Use __kernel_clockid_t in uapi net_stamp.h
Deepa Dinamani (1):
sock: Make sock->sk_stamp thread-safe
Diana Craciun (1):
powerpc/fsl: Fix spectre_v2 mitigations reporting
Dmitry Eremin-Solenikov (2):
crypto: testmgr - add AES-CFB tests
crypto: cfb - fix decryption
Eric Anholt (1):
drm/v3d: Skip debugfs dumping GCA on platforms without GCA.
Eric Dumazet (5):
ipv6: tunnels: fix two use-after-free
isdn: fix kernel-infoleak in capi_unlocked_ioctl
net: clear skb->tstamp in forwarding paths
net/hamradio/6pack: use mod_timer() to rearm timers
tcp: fix a race in inet_diag_dump_icsk()
Eugeniy Paltsev (1):
DRM: UDL: get rid of useless vblank initialization
Filipe Manana (2):
Btrfs: fix fsync of files with multiple hard links in new directories
Btrfs: send, fix race with transaction commits that create snapshots
Ganesh Goudar (1):
net/tls: allocate tls context using GFP_ATOMIC
Georgy A Bystrenin (1):
CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem
Greg Kroah-Hartman (1):
Linux 4.19.14
Greg Kurz (2):
ocxl: Fix endiannes bug in ocxl_link_update_pe()
ocxl: Fix endiannes bug in read_afu_name()
Gustavo A. R. Silva (7):
ip6mr: Fix potential Spectre v1 vulnerability
ipv4: Fix potential Spectre v1 vulnerability
ALSA: rme9652: Fix potential Spectre v1 vulnerability
ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities
ALSA: pcm: Fix potential Spectre v1 vulnerability
ALSA: emux: Fix potential Spectre v1 vulnerabilities
KVM: arm/arm64: vgic: Fix off-by-one bug in vgic_get_irq()
Hans Verkuil (5):
media: cec: keep track of outstanding transmits
media: cec-pin: fix broken tx_ignore_nack_until_eom error injection
media: vivid: free bitmap_cap when updating std/timings/etc.
media: vb2: check memory model for VIDIOC_CREATE_BUFS
media: v4l2-tpg: array index could become negative
Hans de Goede (2):
ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for Chromebook Clapper
ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for Chromebook Gnawty
Heikki Krogerus (1):
usb: roles: Add a description for the class to Kconfig
Heiner Kallweit (1):
r8169: fix WoL device wakeup enable
Herbert Xu (1):
ipv6: frags: Fix bogus skb->sk in reassembled packets
Huacai Chen (4):
MIPS: c-r4k: Add r4k_blast_scache_node for Loongson-3
MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()
MIPS: Align kernel load address to 64KB
MIPS: Fix a R10000_LLSC_WAR logic in atomic.h
Jaegeuk Kim (1):
f2fs: sanity check of xattr entry size
Jason Wang (1):
vhost: make sure used idx is seen before log in vhost_add_used_n()
Jernej Skrabec (1):
clk: sunxi-ng: Use u64 for calculation of NM rate
Jia-Ju Bai (1):
usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable()
Jian-Hong Pan (1):
ALSA: hda/realtek: Enable the headset mic auto detection for ASUS laptops
Johan Jonker (1):
clk: rockchip: fix typo in rk3188 spdif_frac parent
Jorgen Hansen (1):
VSOCK: Send reset control packet when socket is partially bound
Josef Bacik (1):
btrfs: run delayed items before dropping the snapshot
Juergen Gross (1):
xen/netfront: tolerate frags with no data
Julien Thierry (1):
KVM: arm/arm64: vgic: Do not cond_resched_lock() with IRQs disabled
Jörgen Storvist (4):
qmi_wwan: Added support for Fibocom NL668 series
qmi_wwan: Added support for Telit LN940 series
qmi_wwan: Add support for Fibocom NL678 series
USB: serial: option: add Fibocom NL678 series
Kunihiko Hayashi (1):
net: phy: Fix the issue that netif always links up after resuming
Lorenzo Bianconi (1):
gro_cell: add napi_disable in gro_cells_destroy
Lu Fengqi (1):
btrfs: skip file_extent generation check for free_space_inode in run_delalloc_nocow
Luca Ceresoli (1):
media: imx274: fix stack corruption in imx274_read_reg
Lukas Wunner (4):
spi: bcm2835: Fix race on DMA termination
spi: bcm2835: Fix book-keeping of DMA termination
spi: bcm2835: Avoid finishing transfer prematurely in IRQ mode
spi: bcm2835: Unbreak the build of esoteric configs
Lyude Paul (1):
brcmfmac: Fix out of bounds memory access during fw load
Maciej W. Rozycki (1):
rtc: m41t80: Correct alarm month range with RTC reads
Macpaul Lin (1):
cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.
Malcolm Priestley (1):
media: dvb-usb-v2: Fix incorrect use of transfer_flags URB_FREE_BUFFER
Mantas Mikulėnas (1):
ALSA: hda: add mute LED support for HP EliteBook 840 G4
Marc Zyngier (3):
arm64: KVM: Make VHE Stage-2 TLB invalidation operations non-interruptible
arm/arm64: KVM: vgic: Force VM halt when changing the active state of GICv3 PPIs/SGIs
KVM: arm/arm64: vgic: Cap SPIs to the VM-defined maximum
Marcin Wojtas (1):
net: mvneta: fix operation for 64K PAGE_SIZE
Martin Blumenstingl (2):
usb: dwc2: disable power_down on Amlogic devices
f2fs: fix validation of the block count in sanity_check_raw_super
Matthew Wilcox (1):
dax: Don't access a freed inode
Maurizio Lombardi (1):
ext4: missing unlock/put_page() in ext4_try_to_write_inline_data()
Michael J. Ruhl (1):
IB/hfi1: Incorrect sizing of sge for PIO will OOPs
Michal Hocko (1):
x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off
Michal Kubecek (1):
net: ipv4: do not handle duplicate fragments as overlapping
Mikhael Goikhman (1):
net/mlx5e: Remove unused UDP GSO remaining counter
Miquel Raynal (2):
mtd: rawnand: marvell: prevent timeouts on a loaded machine
platform-msi: Free descriptors in platform_msi_domain_free()
Moshe Shemesh (1):
net/mlx5e: RX, Verify MPWQE stride size is in range
Myungho Jung (1):
net/smc: fix TCP fallback socket release
Nava kishore Manne (1):
serial: uartps: Fix interrupt mask issue to handle the RX interrupts properly
Pan Bian (2):
ext4: fix possible use after free in ext4_quota_enable
f2fs: read page index before freeing
Patrick Dreyer (1):
Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G
Paul Aurich (1):
smb3: fix large reads on encrypted connections
Paul Burton (3):
MIPS: math-emu: Write-protect delay slot emulation pages
MIPS: Expand MIPS32 ASIDs to 64 bits
MIPS: Only include mmzone.h when CONFIG_NEED_MULTIPLE_NODES=y
Pieter Jansen van Vuuren (1):
nfp: flower: ensure TCP flags can be placed in IPv6 frame
Robin Murphy (1):
iommu/arm-smmu-v3: Fix big-endian CMD_SYNC writes
Sameer Pujar (1):
ALSA: hda/tegra: clear pending irq handlers
Sanjeev Chugh (1):
Input: atmel_mxt_ts - don't try to free unallocated kernel memory
Scott Chen (1):
USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
Sean Christopherson (2):
KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
KVM: nVMX: Free the VMREAD/VMWRITE bitmaps if alloc_kvm_area() fails
Sean Young (1):
media: rc: cec devices do not have a lirc chardev
Sebastian Ott (1):
s390/pci: fix sleeping in atomic during hotplug
Shalom Toledo (1):
mlxsw: core: Increase timeout during firmware flash process
Stefano Brivio (1):
ipv6: route: Fix return value of ip6_neigh_lookup() on neigh_create() error
Stephan Gerhold (1):
Revert "usb: dwc3: pci: Use devm functions to get the phy GPIOs"
Steven Rostedt (VMware) (1):
tools lib traceevent: Fix processing of dereferenced args in bprintk events
Stijn Tintel (1):
brcmfmac: fix roamoff=1 modparam
Sudarsana Reddy Kalluru (1):
qed: Fix command number mismatch between driver and the mfw
Sylwester Nawrocki (1):
ARM: dts: exynos: Specify I2S assigned clocks in proper node
Takashi Sakamoto (4):
ALSA: fireface: fix for state to fetch PCM frames
ALSA: firewire-lib: fix wrong handling payload_length as payload_quadlet
ALSA: firewire-lib: fix wrong assignment for 'out_packet_without_header' tracepoint
ALSA: firewire-lib: use the same print format for 'without_header' tracepoints
Tal Gilboa (1):
net/mlx5e: Cancel DIM work on close SQ
Tariq Toukan (1):
net/mlx5e: RX, Fix wrong early return in receive queue poll
Tejun Heo (1):
cgroup: fix CSS_TASK_ITER_PROCS
Terin Stock (1):
usb: dwc2: host: use hrtimer for NAK retries
Theodore Ts'o (5):
ext4: add ext4_sb_bread() to disambiguate ENOMEM cases
ext4: include terminating u32 in size of xattr entries when expanding inodes
ext4: avoid declaring fs inconsistent due to invalid file handles
ext4: force inode writes when nfsd calls commit_metadata()
ext4: check for shutdown and r/o file system in ext4_write_inode()
Tomas Winkler (2):
tpm: tpm_try_transmit() refactor error flow.
tpm: tpm_i2c_nuvoton: use correct command duration for TPM 2.x
Tyrel Datwyler (1):
ibmveth: fix DMA unmap error in ibmveth_xmit_start error path
Wandrille RONCE (1):
ALSA: hda/realtek: Enable audio jacks of ASUS UX391UA with ALC294
Wenwen Wang (1):
crypto: cavium/nitrox - fix a DMA pool free failure
Will Deacon (2):
arm64: KVM: Avoid setting the upper 32 bits of VTCR_EL2 to 1
arm64: compat: Avoid sending SIGILL for unallocated syscall numbers
Willem de Bruijn (4):
ieee802154: lowpan_header_create check must check daddr
ip: validate header length on virtual device xmit
packet: validate address length
packet: validate address length if non-zero
Xin Long (1):
sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
Yuval Avnery (1):
net/mlx5: Typo fix in del_sw_hw_rule
ruippan (潘睿) (1):
ext4: fix EXT4_IOC_GROUP_ADD ioctl
The patch titled
Subject: mm: page_mapped: don't assume compound page is huge or THP
has been removed from the -mm tree. Its filename was
mm-page_mapped-dont-assume-compound-page-is-huge-or-thp.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Jan Stancek <jstancek(a)redhat.com>
Subject: mm: page_mapped: don't assume compound page is huge or THP
LTP proc01 testcase has been observed to rarely trigger crashes
on arm64:
page_mapped+0x78/0xb4
stable_page_flags+0x27c/0x338
kpageflags_read+0xfc/0x164
proc_reg_read+0x7c/0xb8
__vfs_read+0x58/0x178
vfs_read+0x90/0x14c
SyS_read+0x60/0xc0
Issue is that page_mapped() assumes that if compound page is not huge,
then it must be THP. But if this is 'normal' compound page
(COMPOUND_PAGE_DTOR), then following loop can keep running (for
HPAGE_PMD_NR iterations) until it tries to read from memory that isn't
mapped and triggers a panic:
for (i = 0; i < hpage_nr_pages(page); i++) {
if (atomic_read(&page[i]._mapcount) >= 0)
return true;
}
I could replicate this on x86 (v4.20-rc4-98-g60b548237fed) only
with a custom kernel module [1] which:
- allocates compound page (PAGEC) of order 1
- allocates 2 normal pages (COPY), which are initialized to 0xff
(to satisfy _mapcount >= 0)
- 2 PAGEC page structs are copied to address of first COPY page
- second page of COPY is marked as not present
- call to page_mapped(COPY) now triggers fault on access to 2nd
COPY page at offset 0x30 (_mapcount)
[1] https://github.com/jstancek/reproducers/blob/master/kernel/page_mapped_cras…
Fix the loop to iterate for "1 << compound_order" pages.
Kirrill said "IIRC, sound subsystem can producuce custom mapped compound
pages".
Link: http://lkml.kernel.org/r/c440d69879e34209feba21e12d236d06bc0a25db.154357715…
Fixes: e1534ae95004 ("mm: differentiate page_mapped() from page_mapcount() for compound pages")
Signed-off-by: Jan Stancek <jstancek(a)redhat.com>
Debugged-by: Laszlo Ersek <lersek(a)redhat.com>
Suggested-by: "Kirill A. Shutemov" <kirill(a)shutemov.name>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Reviewed-by: David Hildenbrand <david(a)redhat.com>
Reviewed-by: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/util.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/util.c~mm-page_mapped-dont-assume-compound-page-is-huge-or-thp
+++ a/mm/util.c
@@ -478,7 +478,7 @@ bool page_mapped(struct page *page)
return true;
if (PageHuge(page))
return false;
- for (i = 0; i < hpage_nr_pages(page); i++) {
+ for (i = 0; i < (1 << compound_order(page)); i++) {
if (atomic_read(&page[i]._mapcount) >= 0)
return true;
}
_
Patches currently in -mm which might be from jstancek(a)redhat.com are
The patch titled
Subject: mm, memcg: fix reclaim deadlock with writeback
has been removed from the -mm tree. Its filename was
mm-memcg-fix-reclaim-deadlock-with-writeback.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Michal Hocko <mhocko(a)suse.com>
Subject: mm, memcg: fix reclaim deadlock with writeback
Liu Bo has experienced a deadlock between memcg (legacy) reclaim and the
ext4 writeback
task1:
[<ffffffff811aaa52>] wait_on_page_bit+0x82/0xa0
[<ffffffff811c5777>] shrink_page_list+0x907/0x960
[<ffffffff811c6027>] shrink_inactive_list+0x2c7/0x680
[<ffffffff811c6ba4>] shrink_node_memcg+0x404/0x830
[<ffffffff811c70a8>] shrink_node+0xd8/0x300
[<ffffffff811c73dd>] do_try_to_free_pages+0x10d/0x330
[<ffffffff811c7865>] try_to_free_mem_cgroup_pages+0xd5/0x1b0
[<ffffffff8122df2d>] try_charge+0x14d/0x720
[<ffffffff812320cc>] memcg_kmem_charge_memcg+0x3c/0xa0
[<ffffffff812321ae>] memcg_kmem_charge+0x7e/0xd0
[<ffffffff811b68a8>] __alloc_pages_nodemask+0x178/0x260
[<ffffffff8120bff5>] alloc_pages_current+0x95/0x140
[<ffffffff81074247>] pte_alloc_one+0x17/0x40
[<ffffffff811e34de>] __pte_alloc+0x1e/0x110
[<ffffffffa06739de>] alloc_set_pte+0x5fe/0xc20
[<ffffffff811e5d93>] do_fault+0x103/0x970
[<ffffffff811e6e5e>] handle_mm_fault+0x61e/0xd10
[<ffffffff8106ea02>] __do_page_fault+0x252/0x4d0
[<ffffffff8106ecb0>] do_page_fault+0x30/0x80
[<ffffffff8171bce8>] page_fault+0x28/0x30
[<ffffffffffffffff>] 0xffffffffffffffff
task2:
[<ffffffff811aadc6>] __lock_page+0x86/0xa0
[<ffffffffa02f1e47>] mpage_prepare_extent_to_map+0x2e7/0x310 [ext4]
[<ffffffffa08a2689>] ext4_writepages+0x479/0xd60
[<ffffffff811bbede>] do_writepages+0x1e/0x30
[<ffffffff812725e5>] __writeback_single_inode+0x45/0x320
[<ffffffff81272de2>] writeback_sb_inodes+0x272/0x600
[<ffffffff81273202>] __writeback_inodes_wb+0x92/0xc0
[<ffffffff81273568>] wb_writeback+0x268/0x300
[<ffffffff81273d24>] wb_workfn+0xb4/0x390
[<ffffffff810a2f19>] process_one_work+0x189/0x420
[<ffffffff810a31fe>] worker_thread+0x4e/0x4b0
[<ffffffff810a9786>] kthread+0xe6/0x100
[<ffffffff8171a9a1>] ret_from_fork+0x41/0x50
[<ffffffffffffffff>] 0xffffffffffffffff
He adds
: task1 is waiting for the PageWriteback bit of the page that task2 has
: collected in mpd->io_submit->io_bio, and tasks2 is waiting for the LOCKED
: bit the page which tasks1 has locked.
More precisely task1 is handling a page fault and it has a page locked
while it charges a new page table to a memcg. That in turn hits a memory
limit reclaim and the memcg reclaim for legacy controller is waiting on
the writeback but that is never going to finish because the writeback
itself is waiting for the page locked in the #PF path. So this is
essentially ABBA deadlock:
lock_page(A)
SetPageWriteback(A)
unlock_page(A)
lock_page(B)
lock_page(B)
pte_alloc_pne
shrink_page_list
wait_on_page_writeback(A)
SetPageWriteback(B)
unlock_page(B)
# flush A, B to clear the writeback
This accumulating of more pages to flush is used by several filesystems to
generate a more optimal IO patterns.
Waiting for the writeback in legacy memcg controller is a workaround for
pre-mature OOM killer invocations because there is no dirty IO throttling
available for the controller. There is no easy way around that
unfortunately. Therefore fix this specific issue by pre-allocating the
page table outside of the page lock. We have that handy infrastructure
for that already so simply reuse the fault-around pattern which already
does this.
There are probably other hidden __GFP_ACCOUNT | GFP_KERNEL allocations
from under a fs page locked but they should be really rare. I am not
aware of a better solution unfortunately.
[akpm(a)linux-foundation.org: fix mm/memory.c:__do_fault()]
[akpm(a)linux-foundation.org: coding-style fixes]
[mhocko(a)kernel.org: enhance comment, per Johannes]
Link: http://lkml.kernel.org/r/20181214084948.GA5624@dhcp22.suse.cz
Link: http://lkml.kernel.org/r/20181213092221.27270-1-mhocko@kernel.org
Fixes: c3b94f44fcb0 ("memcg: further prevent OOM with too many dirty pages")
Signed-off-by: Michal Hocko <mhocko(a)suse.com>
Reported-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Debugged-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Acked-by: Johannes Weiner <hannes(a)cmpxchg.org>
Reviewed-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Cc: Jan Kara <jack(a)suse.cz>
Cc: Dave Chinner <david(a)fromorbit.com>
Cc: Theodore Ts'o <tytso(a)mit.edu>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memory.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--- a/mm/memory.c~mm-memcg-fix-reclaim-deadlock-with-writeback
+++ a/mm/memory.c
@@ -2994,6 +2994,28 @@ static vm_fault_t __do_fault(struct vm_f
struct vm_area_struct *vma = vmf->vma;
vm_fault_t ret;
+ /*
+ * Preallocate pte before we take page_lock because this might lead to
+ * deadlocks for memcg reclaim which waits for pages under writeback:
+ * lock_page(A)
+ * SetPageWriteback(A)
+ * unlock_page(A)
+ * lock_page(B)
+ * lock_page(B)
+ * pte_alloc_pne
+ * shrink_page_list
+ * wait_on_page_writeback(A)
+ * SetPageWriteback(B)
+ * unlock_page(B)
+ * # flush A, B to clear the writeback
+ */
+ if (pmd_none(*vmf->pmd) && !vmf->prealloc_pte) {
+ vmf->prealloc_pte = pte_alloc_one(vmf->vma->vm_mm);
+ if (!vmf->prealloc_pte)
+ return VM_FAULT_OOM;
+ smp_wmb(); /* See comment in __pte_alloc() */
+ }
+
ret = vma->vm_ops->fault(vmf);
if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY |
VM_FAULT_DONE_COW)))
_
Patches currently in -mm which might be from mhocko(a)suse.com are
The patch titled
Subject: mm/usercopy.c: no check page span for stack objects
has been removed from the -mm tree. Its filename was
usercopy-no-check-page-span-for-stack-objects.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Qian Cai <cai(a)lca.pw>
Subject: mm/usercopy.c: no check page span for stack objects
It is easy to trigger this with CONFIG_HARDENED_USERCOPY_PAGESPAN=y,
usercopy: Kernel memory overwrite attempt detected to spans multiple
pages (offset 0, size 23)!
kernel BUG at mm/usercopy.c:102!
For example,
print_worker_info
char name[WQ_NAME_LEN] = { };
char desc[WORKER_DESC_LEN] = { };
probe_kernel_read(name, wq->name, sizeof(name) - 1);
probe_kernel_read(desc, worker->desc, sizeof(desc) - 1);
__copy_from_user_inatomic
check_object_size
check_heap_object
check_page_span
This is because on-stack variables could cross PAGE_SIZE boundary, and
failed this check,
if (likely(((unsigned long)ptr & (unsigned long)PAGE_MASK) ==
((unsigned long)end & (unsigned long)PAGE_MASK)))
ptr = FFFF889007D7EFF8
end = FFFF889007D7F00E
Hence, fix it by checking if it is a stack object first.
[keescook(a)chromium.org: improve comments after reorder]
Link: http://lkml.kernel.org/r/20190103165151.GA32845@beast
Link: http://lkml.kernel.org/r/20181231030254.99441-1-cai@lca.pw
Signed-off-by: Qian Cai <cai(a)lca.pw>
Signed-off-by: Kees Cook <keescook(a)chromium.org>
Acked-by: Kees Cook <keescook(a)chromium.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/usercopy.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/mm/usercopy.c~usercopy-no-check-page-span-for-stack-objects
+++ a/mm/usercopy.c
@@ -247,7 +247,8 @@ static DEFINE_STATIC_KEY_FALSE_RO(bypass
/*
* Validates that the given object is:
* - not bogus address
- * - known-safe heap or stack object
+ * - fully contained by stack (or stack frame, when available)
+ * - fully within SLAB object (or object whitelist area, when available)
* - not in kernel text
*/
void __check_object_size(const void *ptr, unsigned long n, bool to_user)
@@ -262,9 +263,6 @@ void __check_object_size(const void *ptr
/* Check for invalid addresses. */
check_bogus_address((const unsigned long)ptr, n, to_user);
- /* Check for bad heap object. */
- check_heap_object(ptr, n, to_user);
-
/* Check for bad stack object. */
switch (check_stack_object(ptr, n)) {
case NOT_STACK:
@@ -282,6 +280,9 @@ void __check_object_size(const void *ptr
usercopy_abort("process stack", NULL, to_user, 0, n);
}
+ /* Check for bad heap object. */
+ check_heap_object(ptr, n, to_user);
+
/* Check for object in kernel to avoid text exposure. */
check_kernel_text_object((const unsigned long)ptr, n, to_user);
}
_
Patches currently in -mm which might be from cai(a)lca.pw are
mm-page_owner-fix-for-deferred-struct-page-init.patch
page_poison-plays-nicely-with-kasan.patch
signal-allow-the-null-signal-in-rt_sigqueueinfo.patch
The patch titled
Subject: slab: alien caches must not be initialized if the allocation of the alien cache failed
has been removed from the -mm tree. Its filename was
slab-alien-caches-must-not-be-initialized-if-the-allocation-of-the-alien-cache-failed.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Christoph Lameter <cl(a)linux.com>
Subject: slab: alien caches must not be initialized if the allocation of the alien cache failed
Callers of __alloc_alien() check for NULL. We must do the same check in
__alloc_alien_cache to avoid NULL pointer dereferences on allocation
failures.
Link: http://lkml.kernel.org/r/010001680f42f192-82b4e12e-1565-4ee0-ae1f-1e9897490…
Fixes: 49dfc304ba241 ("slab: use the lock on alien_cache, instead of the lock on array_cache")
Fixes: c8522a3a5832b ("Slab: introduce alloc_alien")
Signed-off-by: Christoph Lameter <cl(a)linux.com>
Reported-by: syzbot+d6ed4ec679652b4fd4e4(a)syzkaller.appspotmail.com
Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Pekka Enberg <penberg(a)kernel.org>
Cc: David Rientjes <rientjes(a)google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/slab.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/mm/slab.c~slab-alien-caches-must-not-be-initialized-if-the-allocation-of-the-alien-cache-failed
+++ a/mm/slab.c
@@ -666,8 +666,10 @@ static struct alien_cache *__alloc_alien
struct alien_cache *alc = NULL;
alc = kmalloc_node(memsize, gfp, node);
- init_arraycache(&alc->ac, entries, batch);
- spin_lock_init(&alc->lock);
+ if (alc) {
+ init_arraycache(&alc->ac, entries, batch);
+ spin_lock_init(&alc->lock);
+ }
return alc;
}
_
Patches currently in -mm which might be from cl(a)linux.com are
The patch titled
Subject: fork, memcg: fix cached_stacks case
has been removed from the -mm tree. Its filename was
fork-memcg-fix-cached_stacks-case.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Shakeel Butt <shakeelb(a)google.com>
Subject: fork, memcg: fix cached_stacks case
5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on memcg charge
fail") fixes a crash caused due to failed memcg charge of the kernel
stack. However the fix misses the cached_stacks case which this patch
fixes. So, the same crash can happen if the memcg charge of a cached
stack is failed.
Link: http://lkml.kernel.org/r/20190102180145.57406-1-shakeelb@google.com
Fixes: 5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on memcg charge fail")
Signed-off-by: Shakeel Butt <shakeelb(a)google.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Acked-by: Rik van Riel <riel(a)surriel.com>
Cc: Rik van Riel <riel(a)surriel.com>
Cc: Roman Gushchin <guro(a)fb.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Tejun Heo <tj(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
kernel/fork.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/fork.c~fork-memcg-fix-cached_stacks-case
+++ a/kernel/fork.c
@@ -217,6 +217,7 @@ static unsigned long *alloc_thread_stack
memset(s->addr, 0, THREAD_SIZE);
tsk->stack_vm_area = s;
+ tsk->stack = s->addr;
return s->addr;
}
_
Patches currently in -mm which might be from shakeelb(a)google.com are
memcg-localize-memcg_kmem_enabled-check.patch
memcg-schedule-high-reclaim-for-remote-memcgs-on-high_work.patch
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From e1c3743e1a20647c53b719dbf28b48f45d23f2cd Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao(a)debian.org>
Date: Wed, 21 Nov 2018 17:21:09 -0200
Subject: [PATCH] powerpc/tm: Set MSR[TS] just prior to recheckpoint
On a signal handler return, the user could set a context with MSR[TS] bits
set, and these bits would be copied to task regs->msr.
At restore_tm_sigcontexts(), after current task regs->msr[TS] bits are set,
several __get_user() are called and then a recheckpoint is executed.
This is a problem since a page fault (in kernel space) could happen when
calling __get_user(). If it happens, the process MSR[TS] bits were
already set, but recheckpoint was not executed, and SPRs are still invalid.
The page fault can cause the current process to be de-scheduled, with
MSR[TS] active and without tm_recheckpoint() being called. More
importantly, without TEXASR[FS] bit set also.
Since TEXASR might not have the FS bit set, and when the process is
scheduled back, it will try to reclaim, which will be aborted because of
the CPU is not in the suspended state, and, then, recheckpoint. This
recheckpoint will restore thread->texasr into TEXASR SPR, which might be
zero, hitting a BUG_ON().
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
cpu 0xb: Vector: 700 (Program Check) at [c00000041f1576d0]
pc: c000000000054550: restore_gprs+0xb0/0x180
lr: 0000000000000000
sp: c00000041f157950
msr: 8000000100021033
current = 0xc00000041f143000
paca = 0xc00000000fb86300 softe: 0 irq_happened: 0x01
pid = 1021, comm = kworker/11:1
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
Linux version 4.9.0-3-powerpc64le (debian-kernel(a)lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26)
enter ? for help
[c00000041f157b30] c00000000001bc3c tm_recheckpoint.part.11+0x6c/0xa0
[c00000041f157b70] c00000000001d184 __switch_to+0x1e4/0x4c0
[c00000041f157bd0] c00000000082eeb8 __schedule+0x2f8/0x990
[c00000041f157cb0] c00000000082f598 schedule+0x48/0xc0
[c00000041f157ce0] c0000000000f0d28 worker_thread+0x148/0x610
[c00000041f157d80] c0000000000f96b0 kthread+0x120/0x140
[c00000041f157e30] c00000000000c0e0 ret_from_kernel_thread+0x5c/0x7c
This patch simply delays the MSR[TS] set, so, if there is any page fault in
the __get_user() section, it does not have regs->msr[TS] set, since the TM
structures are still invalid, thus avoiding doing TM operations for
in-kernel exceptions and possible process reschedule.
With this patch, the MSR[TS] will only be set just before recheckpointing
and setting TEXASR[FS] = 1, thus avoiding an interrupt with TM registers in
invalid state.
Other than that, if CONFIG_PREEMPT is set, there might be a preemption just
after setting MSR[TS] and before tm_recheckpoint(), thus, this block must
be atomic from a preemption perspective, thus, calling
preempt_disable/enable() on this code.
It is not possible to move tm_recheckpoint to happen earlier, because it is
required to get the checkpointed registers from userspace, with
__get_user(), thus, the only way to avoid this undesired behavior is
delaying the MSR[TS] set.
The 32-bits signal handler seems to be safe this current issue, but, it
might be exposed to the preemption issue, thus, disabling preemption in
this chunk of code.
Changes from v2:
* Run the critical section with preempt_disable.
Fixes: 87b4e5393af7 ("powerpc/tm: Fix return of active 64bit signals")
Cc: stable(a)vger.kernel.org (v3.9+)
Signed-off-by: Breno Leitao <leitao(a)debian.org>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 9d39e0eb03ff..7484f43493d3 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -848,7 +848,23 @@ static long restore_tm_user_regs(struct pt_regs *regs,
/* If TM bits are set to the reserved value, it's an invalid context */
if (MSR_TM_RESV(msr_hi))
return 1;
- /* Pull in the MSR TM bits from the user context */
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /*
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ *
+ * Pull in the MSR TM bits from the user context
+ */
regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK);
/* Now, recheckpoint. This loads up all of the checkpointed (older)
* registers, including FP and V[S]Rs. After recheckpointing, the
@@ -873,6 +889,8 @@ static long restore_tm_user_regs(struct pt_regs *regs,
}
#endif
+ preempt_enable();
+
return 0;
}
#endif
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index e53ad11be385..ba093ec5a21f 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -467,20 +467,6 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
if (MSR_TM_RESV(msr))
return -EINVAL;
- /* pull in MSR TS bits from user context */
- regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
-
- /*
- * Ensure that TM is enabled in regs->msr before we leave the signal
- * handler. It could be the case that (a) user disabled the TM bit
- * through the manipulation of the MSR bits in uc_mcontext or (b) the
- * TM bit was disabled because a sufficient number of context switches
- * happened whilst in the signal handler and load_tm overflowed,
- * disabling the TM bit. In either case we can end up with an illegal
- * TM state leading to a TM Bad Thing when we return to userspace.
- */
- regs->msr |= MSR_TM;
-
/* pull in MSR LE from user context */
regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE);
@@ -572,6 +558,34 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
tm_enable();
/* Make sure the transaction is marked as failed */
tsk->thread.tm_texasr |= TEXASR_FS;
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /* pull in MSR TS bits from user context */
+ regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
+
+ /*
+ * Ensure that TM is enabled in regs->msr before we leave the signal
+ * handler. It could be the case that (a) user disabled the TM bit
+ * through the manipulation of the MSR bits in uc_mcontext or (b) the
+ * TM bit was disabled because a sufficient number of context switches
+ * happened whilst in the signal handler and load_tm overflowed,
+ * disabling the TM bit. In either case we can end up with an illegal
+ * TM state leading to a TM Bad Thing when we return to userspace.
+ *
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ */
+ regs->msr |= MSR_TM;
+
/* This loads the checkpointed FP/VEC state, if used */
tm_recheckpoint(&tsk->thread);
@@ -585,6 +599,8 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
regs->msr |= MSR_VEC;
}
+ preempt_enable();
+
return err;
}
#endif
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From e1c3743e1a20647c53b719dbf28b48f45d23f2cd Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao(a)debian.org>
Date: Wed, 21 Nov 2018 17:21:09 -0200
Subject: [PATCH] powerpc/tm: Set MSR[TS] just prior to recheckpoint
On a signal handler return, the user could set a context with MSR[TS] bits
set, and these bits would be copied to task regs->msr.
At restore_tm_sigcontexts(), after current task regs->msr[TS] bits are set,
several __get_user() are called and then a recheckpoint is executed.
This is a problem since a page fault (in kernel space) could happen when
calling __get_user(). If it happens, the process MSR[TS] bits were
already set, but recheckpoint was not executed, and SPRs are still invalid.
The page fault can cause the current process to be de-scheduled, with
MSR[TS] active and without tm_recheckpoint() being called. More
importantly, without TEXASR[FS] bit set also.
Since TEXASR might not have the FS bit set, and when the process is
scheduled back, it will try to reclaim, which will be aborted because of
the CPU is not in the suspended state, and, then, recheckpoint. This
recheckpoint will restore thread->texasr into TEXASR SPR, which might be
zero, hitting a BUG_ON().
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
cpu 0xb: Vector: 700 (Program Check) at [c00000041f1576d0]
pc: c000000000054550: restore_gprs+0xb0/0x180
lr: 0000000000000000
sp: c00000041f157950
msr: 8000000100021033
current = 0xc00000041f143000
paca = 0xc00000000fb86300 softe: 0 irq_happened: 0x01
pid = 1021, comm = kworker/11:1
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
Linux version 4.9.0-3-powerpc64le (debian-kernel(a)lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26)
enter ? for help
[c00000041f157b30] c00000000001bc3c tm_recheckpoint.part.11+0x6c/0xa0
[c00000041f157b70] c00000000001d184 __switch_to+0x1e4/0x4c0
[c00000041f157bd0] c00000000082eeb8 __schedule+0x2f8/0x990
[c00000041f157cb0] c00000000082f598 schedule+0x48/0xc0
[c00000041f157ce0] c0000000000f0d28 worker_thread+0x148/0x610
[c00000041f157d80] c0000000000f96b0 kthread+0x120/0x140
[c00000041f157e30] c00000000000c0e0 ret_from_kernel_thread+0x5c/0x7c
This patch simply delays the MSR[TS] set, so, if there is any page fault in
the __get_user() section, it does not have regs->msr[TS] set, since the TM
structures are still invalid, thus avoiding doing TM operations for
in-kernel exceptions and possible process reschedule.
With this patch, the MSR[TS] will only be set just before recheckpointing
and setting TEXASR[FS] = 1, thus avoiding an interrupt with TM registers in
invalid state.
Other than that, if CONFIG_PREEMPT is set, there might be a preemption just
after setting MSR[TS] and before tm_recheckpoint(), thus, this block must
be atomic from a preemption perspective, thus, calling
preempt_disable/enable() on this code.
It is not possible to move tm_recheckpoint to happen earlier, because it is
required to get the checkpointed registers from userspace, with
__get_user(), thus, the only way to avoid this undesired behavior is
delaying the MSR[TS] set.
The 32-bits signal handler seems to be safe this current issue, but, it
might be exposed to the preemption issue, thus, disabling preemption in
this chunk of code.
Changes from v2:
* Run the critical section with preempt_disable.
Fixes: 87b4e5393af7 ("powerpc/tm: Fix return of active 64bit signals")
Cc: stable(a)vger.kernel.org (v3.9+)
Signed-off-by: Breno Leitao <leitao(a)debian.org>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 9d39e0eb03ff..7484f43493d3 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -848,7 +848,23 @@ static long restore_tm_user_regs(struct pt_regs *regs,
/* If TM bits are set to the reserved value, it's an invalid context */
if (MSR_TM_RESV(msr_hi))
return 1;
- /* Pull in the MSR TM bits from the user context */
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /*
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ *
+ * Pull in the MSR TM bits from the user context
+ */
regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK);
/* Now, recheckpoint. This loads up all of the checkpointed (older)
* registers, including FP and V[S]Rs. After recheckpointing, the
@@ -873,6 +889,8 @@ static long restore_tm_user_regs(struct pt_regs *regs,
}
#endif
+ preempt_enable();
+
return 0;
}
#endif
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index e53ad11be385..ba093ec5a21f 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -467,20 +467,6 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
if (MSR_TM_RESV(msr))
return -EINVAL;
- /* pull in MSR TS bits from user context */
- regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
-
- /*
- * Ensure that TM is enabled in regs->msr before we leave the signal
- * handler. It could be the case that (a) user disabled the TM bit
- * through the manipulation of the MSR bits in uc_mcontext or (b) the
- * TM bit was disabled because a sufficient number of context switches
- * happened whilst in the signal handler and load_tm overflowed,
- * disabling the TM bit. In either case we can end up with an illegal
- * TM state leading to a TM Bad Thing when we return to userspace.
- */
- regs->msr |= MSR_TM;
-
/* pull in MSR LE from user context */
regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE);
@@ -572,6 +558,34 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
tm_enable();
/* Make sure the transaction is marked as failed */
tsk->thread.tm_texasr |= TEXASR_FS;
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /* pull in MSR TS bits from user context */
+ regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
+
+ /*
+ * Ensure that TM is enabled in regs->msr before we leave the signal
+ * handler. It could be the case that (a) user disabled the TM bit
+ * through the manipulation of the MSR bits in uc_mcontext or (b) the
+ * TM bit was disabled because a sufficient number of context switches
+ * happened whilst in the signal handler and load_tm overflowed,
+ * disabling the TM bit. In either case we can end up with an illegal
+ * TM state leading to a TM Bad Thing when we return to userspace.
+ *
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ */
+ regs->msr |= MSR_TM;
+
/* This loads the checkpointed FP/VEC state, if used */
tm_recheckpoint(&tsk->thread);
@@ -585,6 +599,8 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
regs->msr |= MSR_VEC;
}
+ preempt_enable();
+
return err;
}
#endif
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From e1c3743e1a20647c53b719dbf28b48f45d23f2cd Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao(a)debian.org>
Date: Wed, 21 Nov 2018 17:21:09 -0200
Subject: [PATCH] powerpc/tm: Set MSR[TS] just prior to recheckpoint
On a signal handler return, the user could set a context with MSR[TS] bits
set, and these bits would be copied to task regs->msr.
At restore_tm_sigcontexts(), after current task regs->msr[TS] bits are set,
several __get_user() are called and then a recheckpoint is executed.
This is a problem since a page fault (in kernel space) could happen when
calling __get_user(). If it happens, the process MSR[TS] bits were
already set, but recheckpoint was not executed, and SPRs are still invalid.
The page fault can cause the current process to be de-scheduled, with
MSR[TS] active and without tm_recheckpoint() being called. More
importantly, without TEXASR[FS] bit set also.
Since TEXASR might not have the FS bit set, and when the process is
scheduled back, it will try to reclaim, which will be aborted because of
the CPU is not in the suspended state, and, then, recheckpoint. This
recheckpoint will restore thread->texasr into TEXASR SPR, which might be
zero, hitting a BUG_ON().
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
cpu 0xb: Vector: 700 (Program Check) at [c00000041f1576d0]
pc: c000000000054550: restore_gprs+0xb0/0x180
lr: 0000000000000000
sp: c00000041f157950
msr: 8000000100021033
current = 0xc00000041f143000
paca = 0xc00000000fb86300 softe: 0 irq_happened: 0x01
pid = 1021, comm = kworker/11:1
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
Linux version 4.9.0-3-powerpc64le (debian-kernel(a)lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26)
enter ? for help
[c00000041f157b30] c00000000001bc3c tm_recheckpoint.part.11+0x6c/0xa0
[c00000041f157b70] c00000000001d184 __switch_to+0x1e4/0x4c0
[c00000041f157bd0] c00000000082eeb8 __schedule+0x2f8/0x990
[c00000041f157cb0] c00000000082f598 schedule+0x48/0xc0
[c00000041f157ce0] c0000000000f0d28 worker_thread+0x148/0x610
[c00000041f157d80] c0000000000f96b0 kthread+0x120/0x140
[c00000041f157e30] c00000000000c0e0 ret_from_kernel_thread+0x5c/0x7c
This patch simply delays the MSR[TS] set, so, if there is any page fault in
the __get_user() section, it does not have regs->msr[TS] set, since the TM
structures are still invalid, thus avoiding doing TM operations for
in-kernel exceptions and possible process reschedule.
With this patch, the MSR[TS] will only be set just before recheckpointing
and setting TEXASR[FS] = 1, thus avoiding an interrupt with TM registers in
invalid state.
Other than that, if CONFIG_PREEMPT is set, there might be a preemption just
after setting MSR[TS] and before tm_recheckpoint(), thus, this block must
be atomic from a preemption perspective, thus, calling
preempt_disable/enable() on this code.
It is not possible to move tm_recheckpoint to happen earlier, because it is
required to get the checkpointed registers from userspace, with
__get_user(), thus, the only way to avoid this undesired behavior is
delaying the MSR[TS] set.
The 32-bits signal handler seems to be safe this current issue, but, it
might be exposed to the preemption issue, thus, disabling preemption in
this chunk of code.
Changes from v2:
* Run the critical section with preempt_disable.
Fixes: 87b4e5393af7 ("powerpc/tm: Fix return of active 64bit signals")
Cc: stable(a)vger.kernel.org (v3.9+)
Signed-off-by: Breno Leitao <leitao(a)debian.org>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 9d39e0eb03ff..7484f43493d3 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -848,7 +848,23 @@ static long restore_tm_user_regs(struct pt_regs *regs,
/* If TM bits are set to the reserved value, it's an invalid context */
if (MSR_TM_RESV(msr_hi))
return 1;
- /* Pull in the MSR TM bits from the user context */
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /*
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ *
+ * Pull in the MSR TM bits from the user context
+ */
regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK);
/* Now, recheckpoint. This loads up all of the checkpointed (older)
* registers, including FP and V[S]Rs. After recheckpointing, the
@@ -873,6 +889,8 @@ static long restore_tm_user_regs(struct pt_regs *regs,
}
#endif
+ preempt_enable();
+
return 0;
}
#endif
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index e53ad11be385..ba093ec5a21f 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -467,20 +467,6 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
if (MSR_TM_RESV(msr))
return -EINVAL;
- /* pull in MSR TS bits from user context */
- regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
-
- /*
- * Ensure that TM is enabled in regs->msr before we leave the signal
- * handler. It could be the case that (a) user disabled the TM bit
- * through the manipulation of the MSR bits in uc_mcontext or (b) the
- * TM bit was disabled because a sufficient number of context switches
- * happened whilst in the signal handler and load_tm overflowed,
- * disabling the TM bit. In either case we can end up with an illegal
- * TM state leading to a TM Bad Thing when we return to userspace.
- */
- regs->msr |= MSR_TM;
-
/* pull in MSR LE from user context */
regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE);
@@ -572,6 +558,34 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
tm_enable();
/* Make sure the transaction is marked as failed */
tsk->thread.tm_texasr |= TEXASR_FS;
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /* pull in MSR TS bits from user context */
+ regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
+
+ /*
+ * Ensure that TM is enabled in regs->msr before we leave the signal
+ * handler. It could be the case that (a) user disabled the TM bit
+ * through the manipulation of the MSR bits in uc_mcontext or (b) the
+ * TM bit was disabled because a sufficient number of context switches
+ * happened whilst in the signal handler and load_tm overflowed,
+ * disabling the TM bit. In either case we can end up with an illegal
+ * TM state leading to a TM Bad Thing when we return to userspace.
+ *
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ */
+ regs->msr |= MSR_TM;
+
/* This loads the checkpointed FP/VEC state, if used */
tm_recheckpoint(&tsk->thread);
@@ -585,6 +599,8 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
regs->msr |= MSR_VEC;
}
+ preempt_enable();
+
return err;
}
#endif
The patch below does not apply to the 4.20-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From e1c3743e1a20647c53b719dbf28b48f45d23f2cd Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao(a)debian.org>
Date: Wed, 21 Nov 2018 17:21:09 -0200
Subject: [PATCH] powerpc/tm: Set MSR[TS] just prior to recheckpoint
On a signal handler return, the user could set a context with MSR[TS] bits
set, and these bits would be copied to task regs->msr.
At restore_tm_sigcontexts(), after current task regs->msr[TS] bits are set,
several __get_user() are called and then a recheckpoint is executed.
This is a problem since a page fault (in kernel space) could happen when
calling __get_user(). If it happens, the process MSR[TS] bits were
already set, but recheckpoint was not executed, and SPRs are still invalid.
The page fault can cause the current process to be de-scheduled, with
MSR[TS] active and without tm_recheckpoint() being called. More
importantly, without TEXASR[FS] bit set also.
Since TEXASR might not have the FS bit set, and when the process is
scheduled back, it will try to reclaim, which will be aborted because of
the CPU is not in the suspended state, and, then, recheckpoint. This
recheckpoint will restore thread->texasr into TEXASR SPR, which might be
zero, hitting a BUG_ON().
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
cpu 0xb: Vector: 700 (Program Check) at [c00000041f1576d0]
pc: c000000000054550: restore_gprs+0xb0/0x180
lr: 0000000000000000
sp: c00000041f157950
msr: 8000000100021033
current = 0xc00000041f143000
paca = 0xc00000000fb86300 softe: 0 irq_happened: 0x01
pid = 1021, comm = kworker/11:1
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
Linux version 4.9.0-3-powerpc64le (debian-kernel(a)lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26)
enter ? for help
[c00000041f157b30] c00000000001bc3c tm_recheckpoint.part.11+0x6c/0xa0
[c00000041f157b70] c00000000001d184 __switch_to+0x1e4/0x4c0
[c00000041f157bd0] c00000000082eeb8 __schedule+0x2f8/0x990
[c00000041f157cb0] c00000000082f598 schedule+0x48/0xc0
[c00000041f157ce0] c0000000000f0d28 worker_thread+0x148/0x610
[c00000041f157d80] c0000000000f96b0 kthread+0x120/0x140
[c00000041f157e30] c00000000000c0e0 ret_from_kernel_thread+0x5c/0x7c
This patch simply delays the MSR[TS] set, so, if there is any page fault in
the __get_user() section, it does not have regs->msr[TS] set, since the TM
structures are still invalid, thus avoiding doing TM operations for
in-kernel exceptions and possible process reschedule.
With this patch, the MSR[TS] will only be set just before recheckpointing
and setting TEXASR[FS] = 1, thus avoiding an interrupt with TM registers in
invalid state.
Other than that, if CONFIG_PREEMPT is set, there might be a preemption just
after setting MSR[TS] and before tm_recheckpoint(), thus, this block must
be atomic from a preemption perspective, thus, calling
preempt_disable/enable() on this code.
It is not possible to move tm_recheckpoint to happen earlier, because it is
required to get the checkpointed registers from userspace, with
__get_user(), thus, the only way to avoid this undesired behavior is
delaying the MSR[TS] set.
The 32-bits signal handler seems to be safe this current issue, but, it
might be exposed to the preemption issue, thus, disabling preemption in
this chunk of code.
Changes from v2:
* Run the critical section with preempt_disable.
Fixes: 87b4e5393af7 ("powerpc/tm: Fix return of active 64bit signals")
Cc: stable(a)vger.kernel.org (v3.9+)
Signed-off-by: Breno Leitao <leitao(a)debian.org>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 9d39e0eb03ff..7484f43493d3 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -848,7 +848,23 @@ static long restore_tm_user_regs(struct pt_regs *regs,
/* If TM bits are set to the reserved value, it's an invalid context */
if (MSR_TM_RESV(msr_hi))
return 1;
- /* Pull in the MSR TM bits from the user context */
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /*
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ *
+ * Pull in the MSR TM bits from the user context
+ */
regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK);
/* Now, recheckpoint. This loads up all of the checkpointed (older)
* registers, including FP and V[S]Rs. After recheckpointing, the
@@ -873,6 +889,8 @@ static long restore_tm_user_regs(struct pt_regs *regs,
}
#endif
+ preempt_enable();
+
return 0;
}
#endif
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index e53ad11be385..ba093ec5a21f 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -467,20 +467,6 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
if (MSR_TM_RESV(msr))
return -EINVAL;
- /* pull in MSR TS bits from user context */
- regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
-
- /*
- * Ensure that TM is enabled in regs->msr before we leave the signal
- * handler. It could be the case that (a) user disabled the TM bit
- * through the manipulation of the MSR bits in uc_mcontext or (b) the
- * TM bit was disabled because a sufficient number of context switches
- * happened whilst in the signal handler and load_tm overflowed,
- * disabling the TM bit. In either case we can end up with an illegal
- * TM state leading to a TM Bad Thing when we return to userspace.
- */
- regs->msr |= MSR_TM;
-
/* pull in MSR LE from user context */
regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE);
@@ -572,6 +558,34 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
tm_enable();
/* Make sure the transaction is marked as failed */
tsk->thread.tm_texasr |= TEXASR_FS;
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /* pull in MSR TS bits from user context */
+ regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
+
+ /*
+ * Ensure that TM is enabled in regs->msr before we leave the signal
+ * handler. It could be the case that (a) user disabled the TM bit
+ * through the manipulation of the MSR bits in uc_mcontext or (b) the
+ * TM bit was disabled because a sufficient number of context switches
+ * happened whilst in the signal handler and load_tm overflowed,
+ * disabling the TM bit. In either case we can end up with an illegal
+ * TM state leading to a TM Bad Thing when we return to userspace.
+ *
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ */
+ regs->msr |= MSR_TM;
+
/* This loads the checkpointed FP/VEC state, if used */
tm_recheckpoint(&tsk->thread);
@@ -585,6 +599,8 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
regs->msr |= MSR_VEC;
}
+ preempt_enable();
+
return err;
}
#endif
There is an imbalance between when slab_pre_alloc_hook calls
memcg_kmem_get_cache and when slab_post_alloc_hook calls
memcg_kmem_put_cache.
This can cause a memcg kmem cache to be destroyed right as
an object from that cache is being allocated, which is probably
not good. It could lead to things like a memcg allocating new
kmalloc slabs instead of using freed space in old ones, maybe
memory leaks, and maybe oopses as a memcg kmalloc slab is getting
destroyed on one CPU while another CPU is trying to do an allocation
from that same memcg.
The obvious fix would be to use the same condition for calling
memcg_kmem_put_cache that we also use to decide whether to call
memcg_kmem_get_cache.
I am not sure how long this bug has been around, since the last
changeset to touch that code - 452647784b2f ("mm: memcontrol: cleanup
kmem charge functions") - merely moved the bug from one location to
another. I am still tagging that changeset, because the fix should
automatically apply that far back.
Signed-off-by: Rik van Riel <riel(a)surriel.com>
Fixes: 452647784b2f ("mm: memcontrol: cleanup kmem charge functions")
Cc: kernel-team(a)fb.com
Cc: linux-mm(a)kvack.org
Cc: stable(a)vger.kernel.org
Cc: Alexey Dobriyan <adobriyan(a)gmail.com>
Cc: Christoph Lameter <cl(a)linux.com>
Cc: Pekka Enberg <penberg(a)kernel.org>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: David Rientjes <rientjes(a)google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Tejun Heo <tj(a)kernel.org>
---
mm/slab.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mm/slab.h b/mm/slab.h
index 4190c24ef0e9..ab3d95bef8a0 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -444,7 +444,8 @@ static inline void slab_post_alloc_hook(struct kmem_cache *s, gfp_t flags,
p[i] = kasan_slab_alloc(s, object, flags);
}
- if (memcg_kmem_enabled())
+ if (memcg_kmem_enabled() &&
+ ((flags & __GFP_ACCOUNT) || (s->flags & SLAB_ACCOUNT)))
memcg_kmem_put_cache(s);
}
--
2.17.1
Commit fb544d1ca65a89f7a3895f7531221ceeed74ada7 upstream.
We recently addressed a VMID generation race by introducing a read/write
lock around accesses and updates to the vmid generation values.
However, kvm_arch_vcpu_ioctl_run() also calls need_new_vmid_gen() but
does so without taking the read lock.
As far as I can tell, this can lead to the same kind of race:
VM 0, VCPU 0 VM 0, VCPU 1
------------ ------------
update_vttbr (vmid 254)
update_vttbr (vmid 1) // roll over
read_lock(kvm_vmid_lock);
force_vm_exit()
local_irq_disable
need_new_vmid_gen == false //because vmid gen matches
enter_guest (vmid 254)
kvm_arch.vttbr = <PGD>:<VMID 1>
read_unlock(kvm_vmid_lock);
enter_guest (vmid 1)
Which results in running two VCPUs in the same VM with different VMIDs
and (even worse) other VCPUs from other VMs could now allocate clashing
VMID 254 from the new generation as long as VCPU 0 is not exiting.
Attempt to solve this by making sure vttbr is updated before another CPU
can observe the updated VMID generation.
Change-Id: I40aae6e89a3c8a496e13fcd8ae6bb663d16b057c
Cc: stable(a)vger.kernel.org # v4.14
Fixes: f0cf47d939d0 "KVM: arm/arm64: Close VMID generation race"
Reviewed-by: Julien Thierry <julien.thierry(a)arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall(a)arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier(a)arm.com>
---
virt/kvm/arm/arm.c | 23 +++++++++++------------
1 file changed, 11 insertions(+), 12 deletions(-)
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index ed42b8cf6f5b..32aa88c19b8d 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -61,7 +61,7 @@ static DEFINE_PER_CPU(struct kvm_vcpu *, kvm_arm_running_vcpu);
static atomic64_t kvm_vmid_gen = ATOMIC64_INIT(1);
static u32 kvm_next_vmid;
static unsigned int kvm_vmid_bits __read_mostly;
-static DEFINE_RWLOCK(kvm_vmid_lock);
+static DEFINE_SPINLOCK(kvm_vmid_lock);
static bool vgic_present;
@@ -447,7 +447,9 @@ void force_vm_exit(const cpumask_t *mask)
*/
static bool need_new_vmid_gen(struct kvm *kvm)
{
- return unlikely(kvm->arch.vmid_gen != atomic64_read(&kvm_vmid_gen));
+ u64 current_vmid_gen = atomic64_read(&kvm_vmid_gen);
+ smp_rmb(); /* Orders read of kvm_vmid_gen and kvm->arch.vmid */
+ return unlikely(READ_ONCE(kvm->arch.vmid_gen) != current_vmid_gen);
}
/**
@@ -462,16 +464,11 @@ static void update_vttbr(struct kvm *kvm)
{
phys_addr_t pgd_phys;
u64 vmid;
- bool new_gen;
- read_lock(&kvm_vmid_lock);
- new_gen = need_new_vmid_gen(kvm);
- read_unlock(&kvm_vmid_lock);
-
- if (!new_gen)
+ if (!need_new_vmid_gen(kvm))
return;
- write_lock(&kvm_vmid_lock);
+ spin_lock(&kvm_vmid_lock);
/*
* We need to re-check the vmid_gen here to ensure that if another vcpu
@@ -479,7 +476,7 @@ static void update_vttbr(struct kvm *kvm)
* use the same vmid.
*/
if (!need_new_vmid_gen(kvm)) {
- write_unlock(&kvm_vmid_lock);
+ spin_unlock(&kvm_vmid_lock);
return;
}
@@ -502,7 +499,6 @@ static void update_vttbr(struct kvm *kvm)
kvm_call_hyp(__kvm_flush_vm_context);
}
- kvm->arch.vmid_gen = atomic64_read(&kvm_vmid_gen);
kvm->arch.vmid = kvm_next_vmid;
kvm_next_vmid++;
kvm_next_vmid &= (1 << kvm_vmid_bits) - 1;
@@ -513,7 +509,10 @@ static void update_vttbr(struct kvm *kvm)
vmid = ((u64)(kvm->arch.vmid) << VTTBR_VMID_SHIFT) & VTTBR_VMID_MASK(kvm_vmid_bits);
kvm->arch.vttbr = pgd_phys | vmid;
- write_unlock(&kvm_vmid_lock);
+ smp_wmb();
+ WRITE_ONCE(kvm->arch.vmid_gen, atomic64_read(&kvm_vmid_gen));
+
+ spin_unlock(&kvm_vmid_lock);
}
static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
--
2.18.0
This is the start of the stable review cycle for the 4.9.149 release.
There are 71 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Jan 9 10:53:04 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.149-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.149-rc1
Tomas Winkler <tomas.winkler(a)intel.com>
tpm: tpm_i2c_nuvoton: use correct command duration for TPM 2.x
Maciej W. Rozycki <macro(a)linux-mips.org>
rtc: m41t80: Correct alarm month range with RTC reads
Will Deacon <will.deacon(a)arm.com>
arm64: KVM: Avoid setting the upper 32 bits of VTCR_EL2 to 1
Vitaly Kuznetsov <vkuznets(a)redhat.com>
x86/kvm/vmx: do not use vm-exit instruction length for fast MMIO when running nested
Georgy A Bystrenin <gkot(a)altlinux.org>
CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem
Aaro Koskinen <aaro.koskinen(a)iki.fi>
MIPS: OCTEON: mark RGMII interface disabled on OCTEON III
Huacai Chen <chenhc(a)lemote.com>
MIPS: Align kernel load address to 64KB
Huacai Chen <chenhc(a)lemote.com>
MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: v4l2-tpg: array index could become negative
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: vivid: free bitmap_cap when updating std/timings/etc.
Nava kishore Manne <nava.manne(a)xilinx.com>
serial: uartps: Fix interrupt mask issue to handle the RX interrupts properly
Martin Blumenstingl <martin.blumenstingl(a)googlemail.com>
f2fs: fix validation of the block count in sanity_check_raw_super
Breno Leitao <leitao(a)debian.org>
powerpc/tm: Set MSR[TS] just prior to recheckpoint
Josef Bacik <jbacik(a)fb.com>
btrfs: run delayed items before dropping the snapshot
Filipe Manana <fdmanana(a)suse.com>
Btrfs: fix fsync of files with multiple hard links in new directories
Macpaul Lin <macpaul.lin(a)mediatek.com>
cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.
Johan Jonker <jbx9999(a)hotmail.com>
clk: rockchip: fix typo in rk3188 spdif_frac parent
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Avoid finishing transfer prematurely in IRQ mode
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Fix book-keeping of DMA termination
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Fix race on DMA termination
Theodore Ts'o <tytso(a)mit.edu>
ext4: check for shutdown and r/o file system in ext4_write_inode()
Theodore Ts'o <tytso(a)mit.edu>
ext4: force inode writes when nfsd calls commit_metadata()
Theodore Ts'o <tytso(a)mit.edu>
ext4: include terminating u32 in size of xattr entries when expanding inodes
ruippan (潘睿) <ruippan(a)tencent.com>
ext4: fix EXT4_IOC_GROUP_ADD ioctl
Maurizio Lombardi <mlombard(a)redhat.com>
ext4: missing unlock/put_page() in ext4_try_to_write_inline_data()
Pan Bian <bianpan2016(a)163.com>
ext4: fix possible use after free in ext4_quota_enable
Ben Hutchings <ben(a)decadent.org.uk>
perf pmu: Suppress potential format-truncation warning
Miquel Raynal <miquel.raynal(a)bootlin.com>
platform-msi: Free descriptors in platform_msi_domain_free()
Sean Christopherson <sean.j.christopherson(a)intel.com>
KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
Patrick Dreyer <Patrick(a)Dreyer.name>
Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G
Bjørn Mork <bjorn(a)mork.no>
qmi_wwan: apply SET_DTR quirk to the SIMCOM shared device ID
Colin Ian King <colin.king(a)canonical.com>
staging: wilc1000: fix missing read_write setting when reading data
Jia-Ju Bai <baijiaju1990(a)gmail.com>
usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable()
Jörgen Storvist <jorgen.storvist(a)gmail.com>
USB: serial: option: add Fibocom NL678 series
Scott Chen <scott(a)labau.com.tw>
USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
Sameer Pujar <spujar(a)nvidia.com>
ALSA: hda/tegra: clear pending irq handlers
Mantas Mikulėnas <grawity(a)gmail.com>
ALSA: hda: add mute LED support for HP EliteBook 840 G4
Arnd Bergmann <arnd(a)arndb.de>
mtd: atmel-quadspi: disallow building on ebsa110
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: emux: Fix potential Spectre v1 vulnerabilities
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: pcm: Fix potential Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: rme9652: Fix potential Spectre v1 vulnerability
Cong Wang <xiyou.wangcong(a)gmail.com>
ptr_ring: wrap back ->producer in __ptr_ring_swap_queue()
Deepa Dinamani <deepa.kernel(a)gmail.com>
sock: Make sock->sk_stamp thread-safe
Yuval Avnery <yuvalav(a)mellanox.com>
net/mlx5: Typo fix in del_sw_hw_rule
Alaa Hleihel <alaa(a)mellanox.com>
net/mlx5e: Remove the false indication of software timestamping support
Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com>
gro_cell: add napi_disable in gro_cells_destroy
Cong Wang <xiyou.wangcong(a)gmail.com>
tipc: compare remote and local protocols in tipc_udp_enable()
Cong Wang <xiyou.wangcong(a)gmail.com>
tipc: use lock_sock() in tipc_sk_reinit()
Juergen Gross <jgross(a)suse.com>
xen/netfront: tolerate frags with no data
Jorgen Hansen <jhansen(a)vmware.com>
VSOCK: Send reset control packet when socket is partially bound
Jason Wang <jasowang(a)redhat.com>
vhost: make sure used idx is seen before log in vhost_add_used_n()
Cong Wang <xiyou.wangcong(a)gmail.com>
tipc: fix a double kfree_skb()
Xin Long <lucien.xin(a)gmail.com>
sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
Willem de Bruijn <willemb(a)google.com>
packet: validate address length if non-zero
Willem de Bruijn <willemb(a)google.com>
packet: validate address length
Cong Wang <xiyou.wangcong(a)gmail.com>
net/wan: fix a double free in x25_asy_open_tty()
Cong Wang <xiyou.wangcong(a)gmail.com>
netrom: fix locking in nr_find_socket()
Kunihiko Hayashi <hayashi.kunihiko(a)socionext.com>
net: phy: Fix the issue that netif always links up after resuming
Michal Kubecek <mkubecek(a)suse.cz>
net: ipv4: do not handle duplicate fragments as overlapping
Eric Dumazet <edumazet(a)google.com>
isdn: fix kernel-infoleak in capi_unlocked_ioctl
Eric Dumazet <edumazet(a)google.com>
ipv6: tunnels: fix two use-after-free
Cong Wang <xiyou.wangcong(a)gmail.com>
ipv6: explicitly initialize udp6_addr in udp_sock_create6()
Willem de Bruijn <willemb(a)google.com>
ieee802154: lowpan_header_create check must check daddr
Tyrel Datwyler <tyreld(a)linux.vnet.ibm.com>
ibmveth: fix DMA unmap error in ibmveth_xmit_start error path
Cong Wang <xiyou.wangcong(a)gmail.com>
ax25: fix a use-after-free in ax25_fillin_cb()
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
phonet: af_phonet: Fix Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
net: core: Fix Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ipv4: Fix potential Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ip6mr: Fix potential Spectre v1 vulnerability
Guenter Roeck <linux(a)roeck-us.net>
NFC: nxp-nci: Include unaligned.h instead of access_ok.h
-------------
Diffstat:
Makefile | 4 +-
arch/arm64/include/asm/kvm_arm.h | 2 +-
arch/mips/boot/compressed/calc_vmlinuz_load_addr.c | 7 ++-
arch/mips/cavium-octeon/executive/cvmx-helper.c | 3 +-
arch/mips/include/asm/pgtable-64.h | 5 ++
arch/powerpc/kernel/signal_32.c | 20 ++++++-
arch/powerpc/kernel/signal_64.c | 44 +++++++++-----
arch/x86/include/asm/kvm_host.h | 2 +-
arch/x86/kvm/vmx.c | 19 +++++-
arch/x86/kvm/x86.c | 3 +-
drivers/base/platform-msi.c | 6 +-
drivers/char/tpm/tpm_i2c_nuvoton.c | 11 ++--
drivers/clk/rockchip/clk-rk3188.c | 2 +-
drivers/input/mouse/elan_i2c_core.c | 1 +
drivers/isdn/capi/kcapi.c | 4 +-
drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 2 +-
drivers/media/platform/vivid/vivid-vid-cap.c | 2 +
drivers/mtd/spi-nor/Kconfig | 2 +-
drivers/net/ethernet/ibm/ibmveth.c | 6 +-
.../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 11 +---
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 2 +-
drivers/net/phy/phy_device.c | 7 +--
drivers/net/usb/qmi_wwan.c | 2 +-
drivers/net/wan/x25_asy.c | 2 +
drivers/net/xen-netfront.c | 2 +-
drivers/nfc/nxp-nci/firmware.c | 2 +-
drivers/nfc/nxp-nci/i2c.c | 2 +-
drivers/rtc/rtc-m41t80.c | 2 +-
drivers/spi/spi-bcm2835.c | 14 ++---
drivers/staging/wilc1000/wilc_sdio.c | 1 +
drivers/tty/serial/xilinx_uartps.c | 4 +-
drivers/usb/class/cdc-acm.c | 10 ++++
drivers/usb/class/cdc-acm.h | 1 +
drivers/usb/host/r8a66597-hcd.c | 5 +-
drivers/usb/serial/option.c | 4 ++
drivers/usb/serial/pl2303.c | 5 ++
drivers/usb/serial/pl2303.h | 5 ++
drivers/vhost/vhost.c | 2 +
fs/btrfs/btrfs_inode.h | 6 ++
fs/btrfs/extent-tree.c | 4 ++
fs/btrfs/inode.c | 17 ++++++
fs/btrfs/tree-log.c | 16 ++++++
fs/cifs/smb2maperror.c | 4 +-
fs/ext4/inline.c | 5 +-
fs/ext4/inode.c | 9 ++-
fs/ext4/resize.c | 2 +-
fs/ext4/super.c | 13 ++++-
fs/ext4/xattr.c | 2 +-
fs/f2fs/super.c | 6 +-
include/linux/msi.h | 2 +
include/linux/ptr_ring.h | 2 +
include/net/gro_cells.h | 1 +
include/net/sock.h | 36 +++++++++++-
include/trace/events/ext4.h | 20 +++++++
net/ax25/af_ax25.c | 11 +++-
net/ax25/ax25_dev.c | 2 +
net/compat.c | 15 +++--
net/core/filter.c | 2 +
net/core/sock.c | 3 +
net/ieee802154/6lowpan/tx.c | 3 +
net/ipv4/ip_fragment.c | 18 ++++--
net/ipv4/ipmr.c | 3 +
net/ipv6/ip6_tunnel.c | 1 +
net/ipv6/ip6_udp_tunnel.c | 3 +-
net/ipv6/ip6_vti.c | 1 +
net/ipv6/ip6mr.c | 4 ++
net/netrom/af_netrom.c | 15 +++--
net/packet/af_packet.c | 8 ++-
net/phonet/af_phonet.c | 3 +
net/sctp/ipv6.c | 1 +
net/sunrpc/svcsock.c | 2 +-
net/tipc/socket.c | 8 ++-
net/tipc/udp_media.c | 9 ++-
net/vmw_vsock/vmci_transport.c | 67 ++++++++++++++++------
sound/core/pcm.c | 2 +
sound/pci/emu10k1/emufx.c | 5 ++
sound/pci/hda/hda_tegra.c | 2 +
sound/pci/hda/patch_conexant.c | 1 +
sound/pci/rme9652/hdsp.c | 10 ++--
sound/synth/emux/emux_hwdep.c | 7 ++-
tools/perf/util/pmu.c | 8 +--
81 files changed, 451 insertions(+), 136 deletions(-)
Do you have photos for editing? We asked this because we see your photos on
your website.
We mainly supply service for photos cut out , clipping path, and
retouching.
You may just send us a photo, we can provide you test editing to check
quality.
Thanks,
Jane
Do you have photos for editing? We asked this because we see your photos on
your website.
We mainly supply service for photos cut out , clipping path, and
retouching.
You may just send us a photo, we can provide you test editing to check
quality.
Thanks,
Jane
Do you have photos for editing? We asked this because we see your photos on
your website.
We mainly supply service for photos cut out , clipping path, and
retouching.
You may just send us a photo, we can provide you test editing to check
quality.
Thanks,
Jane
Do you have photos for editing? We asked this because we see your photos on
your website.
We mainly supply service for photos cut out , clipping path, and
retouching.
You may just send us a photo, we can provide you test editing to check
quality.
Thanks,
Jane
We see your photos photos for editing.
Please send us the details of this task.
Do your photos need cut out? Or clipping path, and retouching?
You may give us 1 photo, we will do test for you to check the quality.
Thanks,
Helen
From: Jan Stancek <jstancek(a)redhat.com>
Subject: mm: page_mapped: don't assume compound page is huge or THP
LTP proc01 testcase has been observed to rarely trigger crashes
on arm64:
page_mapped+0x78/0xb4
stable_page_flags+0x27c/0x338
kpageflags_read+0xfc/0x164
proc_reg_read+0x7c/0xb8
__vfs_read+0x58/0x178
vfs_read+0x90/0x14c
SyS_read+0x60/0xc0
Issue is that page_mapped() assumes that if compound page is not huge,
then it must be THP. But if this is 'normal' compound page
(COMPOUND_PAGE_DTOR), then following loop can keep running (for
HPAGE_PMD_NR iterations) until it tries to read from memory that isn't
mapped and triggers a panic:
for (i = 0; i < hpage_nr_pages(page); i++) {
if (atomic_read(&page[i]._mapcount) >= 0)
return true;
}
I could replicate this on x86 (v4.20-rc4-98-g60b548237fed) only
with a custom kernel module [1] which:
- allocates compound page (PAGEC) of order 1
- allocates 2 normal pages (COPY), which are initialized to 0xff
(to satisfy _mapcount >= 0)
- 2 PAGEC page structs are copied to address of first COPY page
- second page of COPY is marked as not present
- call to page_mapped(COPY) now triggers fault on access to 2nd
COPY page at offset 0x30 (_mapcount)
[1] https://github.com/jstancek/reproducers/blob/master/kernel/page_mapped_cras…
Fix the loop to iterate for "1 << compound_order" pages.
Kirrill said "IIRC, sound subsystem can producuce custom mapped compound
pages".
Link: http://lkml.kernel.org/r/c440d69879e34209feba21e12d236d06bc0a25db.154357715…
Fixes: e1534ae95004 ("mm: differentiate page_mapped() from page_mapcount() for compound pages")
Signed-off-by: Jan Stancek <jstancek(a)redhat.com>
Debugged-by: Laszlo Ersek <lersek(a)redhat.com>
Suggested-by: "Kirill A. Shutemov" <kirill(a)shutemov.name>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Reviewed-by: David Hildenbrand <david(a)redhat.com>
Reviewed-by: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/util.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/util.c~mm-page_mapped-dont-assume-compound-page-is-huge-or-thp
+++ a/mm/util.c
@@ -478,7 +478,7 @@ bool page_mapped(struct page *page)
return true;
if (PageHuge(page))
return false;
- for (i = 0; i < hpage_nr_pages(page); i++) {
+ for (i = 0; i < (1 << compound_order(page)); i++) {
if (atomic_read(&page[i]._mapcount) >= 0)
return true;
}
_
From: Michal Hocko <mhocko(a)suse.com>
Subject: mm, memcg: fix reclaim deadlock with writeback
Liu Bo has experienced a deadlock between memcg (legacy) reclaim and the
ext4 writeback
task1:
[<ffffffff811aaa52>] wait_on_page_bit+0x82/0xa0
[<ffffffff811c5777>] shrink_page_list+0x907/0x960
[<ffffffff811c6027>] shrink_inactive_list+0x2c7/0x680
[<ffffffff811c6ba4>] shrink_node_memcg+0x404/0x830
[<ffffffff811c70a8>] shrink_node+0xd8/0x300
[<ffffffff811c73dd>] do_try_to_free_pages+0x10d/0x330
[<ffffffff811c7865>] try_to_free_mem_cgroup_pages+0xd5/0x1b0
[<ffffffff8122df2d>] try_charge+0x14d/0x720
[<ffffffff812320cc>] memcg_kmem_charge_memcg+0x3c/0xa0
[<ffffffff812321ae>] memcg_kmem_charge+0x7e/0xd0
[<ffffffff811b68a8>] __alloc_pages_nodemask+0x178/0x260
[<ffffffff8120bff5>] alloc_pages_current+0x95/0x140
[<ffffffff81074247>] pte_alloc_one+0x17/0x40
[<ffffffff811e34de>] __pte_alloc+0x1e/0x110
[<ffffffffa06739de>] alloc_set_pte+0x5fe/0xc20
[<ffffffff811e5d93>] do_fault+0x103/0x970
[<ffffffff811e6e5e>] handle_mm_fault+0x61e/0xd10
[<ffffffff8106ea02>] __do_page_fault+0x252/0x4d0
[<ffffffff8106ecb0>] do_page_fault+0x30/0x80
[<ffffffff8171bce8>] page_fault+0x28/0x30
[<ffffffffffffffff>] 0xffffffffffffffff
task2:
[<ffffffff811aadc6>] __lock_page+0x86/0xa0
[<ffffffffa02f1e47>] mpage_prepare_extent_to_map+0x2e7/0x310 [ext4]
[<ffffffffa08a2689>] ext4_writepages+0x479/0xd60
[<ffffffff811bbede>] do_writepages+0x1e/0x30
[<ffffffff812725e5>] __writeback_single_inode+0x45/0x320
[<ffffffff81272de2>] writeback_sb_inodes+0x272/0x600
[<ffffffff81273202>] __writeback_inodes_wb+0x92/0xc0
[<ffffffff81273568>] wb_writeback+0x268/0x300
[<ffffffff81273d24>] wb_workfn+0xb4/0x390
[<ffffffff810a2f19>] process_one_work+0x189/0x420
[<ffffffff810a31fe>] worker_thread+0x4e/0x4b0
[<ffffffff810a9786>] kthread+0xe6/0x100
[<ffffffff8171a9a1>] ret_from_fork+0x41/0x50
[<ffffffffffffffff>] 0xffffffffffffffff
He adds
: task1 is waiting for the PageWriteback bit of the page that task2 has
: collected in mpd->io_submit->io_bio, and tasks2 is waiting for the LOCKED
: bit the page which tasks1 has locked.
More precisely task1 is handling a page fault and it has a page locked
while it charges a new page table to a memcg. That in turn hits a memory
limit reclaim and the memcg reclaim for legacy controller is waiting on
the writeback but that is never going to finish because the writeback
itself is waiting for the page locked in the #PF path. So this is
essentially ABBA deadlock:
lock_page(A)
SetPageWriteback(A)
unlock_page(A)
lock_page(B)
lock_page(B)
pte_alloc_pne
shrink_page_list
wait_on_page_writeback(A)
SetPageWriteback(B)
unlock_page(B)
# flush A, B to clear the writeback
This accumulating of more pages to flush is used by several filesystems to
generate a more optimal IO patterns.
Waiting for the writeback in legacy memcg controller is a workaround for
pre-mature OOM killer invocations because there is no dirty IO throttling
available for the controller. There is no easy way around that
unfortunately. Therefore fix this specific issue by pre-allocating the
page table outside of the page lock. We have that handy infrastructure
for that already so simply reuse the fault-around pattern which already
does this.
There are probably other hidden __GFP_ACCOUNT | GFP_KERNEL allocations
from under a fs page locked but they should be really rare. I am not
aware of a better solution unfortunately.
[akpm(a)linux-foundation.org: fix mm/memory.c:__do_fault()]
[akpm(a)linux-foundation.org: coding-style fixes]
[mhocko(a)kernel.org: enhance comment, per Johannes]
Link: http://lkml.kernel.org/r/20181214084948.GA5624@dhcp22.suse.cz
Link: http://lkml.kernel.org/r/20181213092221.27270-1-mhocko@kernel.org
Fixes: c3b94f44fcb0 ("memcg: further prevent OOM with too many dirty pages")
Signed-off-by: Michal Hocko <mhocko(a)suse.com>
Reported-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Debugged-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Acked-by: Johannes Weiner <hannes(a)cmpxchg.org>
Reviewed-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Cc: Jan Kara <jack(a)suse.cz>
Cc: Dave Chinner <david(a)fromorbit.com>
Cc: Theodore Ts'o <tytso(a)mit.edu>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memory.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--- a/mm/memory.c~mm-memcg-fix-reclaim-deadlock-with-writeback
+++ a/mm/memory.c
@@ -2994,6 +2994,28 @@ static vm_fault_t __do_fault(struct vm_f
struct vm_area_struct *vma = vmf->vma;
vm_fault_t ret;
+ /*
+ * Preallocate pte before we take page_lock because this might lead to
+ * deadlocks for memcg reclaim which waits for pages under writeback:
+ * lock_page(A)
+ * SetPageWriteback(A)
+ * unlock_page(A)
+ * lock_page(B)
+ * lock_page(B)
+ * pte_alloc_pne
+ * shrink_page_list
+ * wait_on_page_writeback(A)
+ * SetPageWriteback(B)
+ * unlock_page(B)
+ * # flush A, B to clear the writeback
+ */
+ if (pmd_none(*vmf->pmd) && !vmf->prealloc_pte) {
+ vmf->prealloc_pte = pte_alloc_one(vmf->vma->vm_mm);
+ if (!vmf->prealloc_pte)
+ return VM_FAULT_OOM;
+ smp_wmb(); /* See comment in __pte_alloc() */
+ }
+
ret = vma->vm_ops->fault(vmf);
if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY |
VM_FAULT_DONE_COW)))
_
From: Christoph Lameter <cl(a)linux.com>
Subject: slab: alien caches must not be initialized if the allocation of the alien cache failed
Callers of __alloc_alien() check for NULL. We must do the same check in
__alloc_alien_cache to avoid NULL pointer dereferences on allocation
failures.
Link: http://lkml.kernel.org/r/010001680f42f192-82b4e12e-1565-4ee0-ae1f-1e9897490…
Fixes: 49dfc304ba241 ("slab: use the lock on alien_cache, instead of the lock on array_cache")
Fixes: c8522a3a5832b ("Slab: introduce alloc_alien")
Signed-off-by: Christoph Lameter <cl(a)linux.com>
Reported-by: syzbot+d6ed4ec679652b4fd4e4(a)syzkaller.appspotmail.com
Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Pekka Enberg <penberg(a)kernel.org>
Cc: David Rientjes <rientjes(a)google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/slab.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/mm/slab.c~slab-alien-caches-must-not-be-initialized-if-the-allocation-of-the-alien-cache-failed
+++ a/mm/slab.c
@@ -666,8 +666,10 @@ static struct alien_cache *__alloc_alien
struct alien_cache *alc = NULL;
alc = kmalloc_node(memsize, gfp, node);
- init_arraycache(&alc->ac, entries, batch);
- spin_lock_init(&alc->lock);
+ if (alc) {
+ init_arraycache(&alc->ac, entries, batch);
+ spin_lock_init(&alc->lock);
+ }
return alc;
}
_
From: Shakeel Butt <shakeelb(a)google.com>
Subject: fork, memcg: fix cached_stacks case
5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on memcg charge
fail") fixes a crash caused due to failed memcg charge of the kernel
stack. However the fix misses the cached_stacks case which this patch
fixes. So, the same crash can happen if the memcg charge of a cached
stack is failed.
Link: http://lkml.kernel.org/r/20190102180145.57406-1-shakeelb@google.com
Fixes: 5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on memcg charge fail")
Signed-off-by: Shakeel Butt <shakeelb(a)google.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Acked-by: Rik van Riel <riel(a)surriel.com>
Cc: Rik van Riel <riel(a)surriel.com>
Cc: Roman Gushchin <guro(a)fb.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Tejun Heo <tj(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
kernel/fork.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/fork.c~fork-memcg-fix-cached_stacks-case
+++ a/kernel/fork.c
@@ -217,6 +217,7 @@ static unsigned long *alloc_thread_stack
memset(s->addr, 0, THREAD_SIZE);
tsk->stack_vm_area = s;
+ tsk->stack = s->addr;
return s->addr;
}
_
This is an ugly one unfortunately. Currently, all DRM drivers supporting
atomic modesetting will save the state that userspace had set before
suspending, then attempt to restore that state on resume. This probably
worked very well at one point, like many other things, until DP MST came
into the picture. While it's easy to restore state on normal display
connectors that were disconnected during suspend regardless of their
state post-resume, this can't really be done with MST because of the
fact that setting up a downstream sink requires performing sideband
transactions between the source and the MST hub, sending out the ACT
packets, etc.
Because of this, there isn't really a guarantee that we can restore the
atomic state we had before suspend once we've resumed. This sucks pretty
bad, but so far I haven't run into any compositors that this actually
causes serious issues with. Most compositors will notice the hotplug we
send afterwards, and then reprobe state.
Since nouveau and i915 also don't fail the suspend/resume process due to
failing to restore the atomic state, let's make amdgpu match this
behavior. Better to resume the GPU properly, then to stop the process
half way because of a potentially unavoidable atomic commit failure.
Eventually, we'll have a real fix for this problem on the DRM level. But
we've got some more important low-hanging fruit to deal with first.
Signed-off-by: Lyude Paul <lyude(a)redhat.com>
Reviewed-by: Harry Wentland <harry.wentland(a)amd.com>
Cc: Jerry Zuo <Jerry.Zuo(a)amd.com>
Cc: <stable(a)vger.kernel.org> # v4.15+
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 3f326a2c513b..a3e65e457348 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -912,7 +912,6 @@ static int dm_resume(void *handle)
struct drm_plane_state *new_plane_state;
struct dm_plane_state *dm_new_plane_state;
enum dc_connection_type new_connection_type = dc_connection_none;
- int ret;
int i;
/* power on hardware */
@@ -985,13 +984,13 @@ static int dm_resume(void *handle)
}
}
- ret = drm_atomic_helper_resume(ddev, dm->cached_state);
+ drm_atomic_helper_resume(ddev, dm->cached_state);
dm->cached_state = NULL;
amdgpu_dm_irq_resume_late(adev);
- return ret;
+ return 0;
}
/**
--
2.20.1
drm_dp_mst_topology_mgr_resume() returns whether or not it managed to
find the topology in question after a suspend resume cycle, and the
driver is supposed to check this value and disable MST accordingly if
it's gone-in addition to sending a hotplug in order to notify userspace
that something changed during suspend.
Currently, amdgpu just makes the mistake of ignoring the return code
from drm_dp_mst_topology_mgr_resume() which means that if a topology was
removed in suspend, amdgpu never notices and assumes it's still
connected which leads to all sorts of problems.
So, fix this by actually checking the rc from
drm_dp_mst_topology_mgr_resume(). Also, reformat the rest of the
function while we're at it to fix the over-indenting.
Signed-off-by: Lyude Paul <lyude(a)redhat.com>
Reviewed-by: Harry Wentland <harry.wentland(a)amd.com>
Cc: Jerry Zuo <Jerry.Zuo(a)amd.com>
Cc: <stable(a)vger.kernel.org> # v4.15+
---
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 32 +++++++++++++------
1 file changed, 23 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 8a626d16e8e3..3f326a2c513b 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -699,22 +699,36 @@ static void s3_handle_mst(struct drm_device *dev, bool suspend)
{
struct amdgpu_dm_connector *aconnector;
struct drm_connector *connector;
+ struct drm_dp_mst_topology_mgr *mgr;
+ int ret;
+ bool need_hotplug = false;
drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
- list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
- aconnector = to_amdgpu_dm_connector(connector);
- if (aconnector->dc_link->type == dc_connection_mst_branch &&
- !aconnector->mst_port) {
+ list_for_each_entry(connector, &dev->mode_config.connector_list,
+ head) {
+ aconnector = to_amdgpu_dm_connector(connector);
+ if (aconnector->dc_link->type != dc_connection_mst_branch ||
+ aconnector->mst_port)
+ continue;
+
+ mgr = &aconnector->mst_mgr;
- if (suspend)
- drm_dp_mst_topology_mgr_suspend(&aconnector->mst_mgr);
- else
- drm_dp_mst_topology_mgr_resume(&aconnector->mst_mgr);
- }
+ if (suspend) {
+ drm_dp_mst_topology_mgr_suspend(mgr);
+ } else {
+ ret = drm_dp_mst_topology_mgr_resume(mgr);
+ if (ret < 0) {
+ drm_dp_mst_topology_mgr_set_mst(mgr, false);
+ need_hotplug = true;
+ }
+ }
}
drm_modeset_unlock(&dev->mode_config.connection_mutex);
+
+ if (need_hotplug)
+ drm_kms_helper_hotplug_event(dev);
}
/**
--
2.20.1
From: "Maciej W. Rozycki" <macro(a)linux-mips.org>
[ Upstream commit e4849aff1e169b86c561738daf8ff020e9de1011 ]
The Broadcom SiByte BCM1250, BCM1125, and BCM1125H SOCs have an onchip
DRAM controller that supports memory amounts of up to 16GiB, and due to
how the address decoder has been wired in the SOC any memory beyond 1GiB
is actually mapped starting from 4GiB physical up, that is beyond the
32-bit addressable limit[1]. Consequently if the maximum amount of
memory has been installed, then it will span up to 19GiB.
Many of the evaluation boards we support that are based on one of these
SOCs have their memory soldered and the amount present fits in the
32-bit address range. The BCM91250A SWARM board however has actual DIMM
slots and accepts, depending on the peripherals revision of the SOC, up
to 4GiB or 8GiB of memory in commercially available JEDEC modules[2].
I believe this is also the case with the BCM91250C2 LittleSur board.
This means that up to either 3GiB or 7GiB of memory requires 64-bit
addressing to access.
I believe the BCM91480B BigSur board, which has the BCM1480 SOC instead,
accepts at least as much memory, although I have no documentation or
actual hardware available to verify that.
Both systems have PCI slots installed for use by any PCI option boards,
including ones that only support 32-bit addressing (additionally the
32-bit PCI host bridge of the BCM1250, BCM1125, and BCM1125H SOCs limits
addressing to 32-bits), and there is no IOMMU available. Therefore for
PCI DMA to work in the presence of memory beyond enable swiotlb for the
affected systems.
All the other SOC onchip DMA devices use 40-bit addressing and therefore
can address the whole memory, so only enable swiotlb if PCI support and
support for DMA beyond 4GiB have been both enabled in the configuration
of the kernel.
This shows up as follows:
Broadcom SiByte BCM1250 B2 @ 800 MHz (SB1 rev 2)
Board type: SiByte BCM91250A (SWARM)
Determined physical RAM map:
memory: 000000000fe7fe00 @ 0000000000000000 (usable)
memory: 000000001ffffe00 @ 0000000080000000 (usable)
memory: 000000000ffffe00 @ 00000000c0000000 (usable)
memory: 0000000087fffe00 @ 0000000100000000 (usable)
software IO TLB: mapped [mem 0xcbffc000-0xcfffc000] (64MB)
in the bootstrap log and removes failures like these:
defxx 0000:02:00.0: dma_direct_map_page: overflow 0x0000000185bc6080+4608 of device mask ffffffff bus mask 0
fddi0: Receive buffer allocation failed
fddi0: Adapter open failed!
IP-Config: Failed to open fddi0
defxx 0000:09:08.0: dma_direct_map_page: overflow 0x0000000185bc6080+4608 of device mask ffffffff bus mask 0
fddi1: Receive buffer allocation failed
fddi1: Adapter open failed!
IP-Config: Failed to open fddi1
when memory beyond 4GiB is handed out to devices that can only do 32-bit
addressing.
This updates commit cce335ae47e2 ("[MIPS] 64-bit Sibyte kernels need
DMA32.").
References:
[1] "BCM1250/BCM1125/BCM1125H User Manual", Revision 1250_1125-UM100-R,
Broadcom Corporation, 21 Oct 2002, Section 3: "System Overview",
"Memory Map", pp. 34-38
[2] "BCM91250A User Manual", Revision 91250A-UM100-R, Broadcom
Corporation, 18 May 2004, Section 3: "Physical Description",
"Supported DRAM", p. 23
Signed-off-by: Maciej W. Rozycki <macro(a)linux-mips.org>
[paul.burton(a)mips.com: Remove GPL text from dma.c; SPDX tag covers it]
Signed-off-by: Paul Burton <paul.burton(a)mips.com>
Reviewed-by: Christoph Hellwig <hch(a)lst.de>
Patchwork: https://patchwork.linux-mips.org/patch/21108/
References: cce335ae47e2 ("[MIPS] 64-bit Sibyte kernels need DMA32.")
Cc: Ralf Baechle <ralf(a)linux-mips.org>
Cc: linux-mips(a)linux-mips.org
Cc: linux-kernel(a)vger.kernel.org
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
arch/mips/Kconfig | 3 +++
arch/mips/sibyte/common/Makefile | 1 +
arch/mips/sibyte/common/dma.c | 14 ++++++++++++++
3 files changed, 18 insertions(+)
create mode 100644 arch/mips/sibyte/common/dma.c
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 9536ef912f59..077ae203e8f9 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -627,6 +627,7 @@ config SIBYTE_SWARM
select SYS_SUPPORTS_HIGHMEM
select SYS_SUPPORTS_LITTLE_ENDIAN
select ZONE_DMA32 if 64BIT
+ select SWIOTLB if ARCH_DMA_ADDR_T_64BIT && PCI
config SIBYTE_LITTLESUR
bool "Sibyte BCM91250C2-LittleSur"
@@ -649,6 +650,7 @@ config SIBYTE_SENTOSA
select SYS_HAS_CPU_SB1
select SYS_SUPPORTS_BIG_ENDIAN
select SYS_SUPPORTS_LITTLE_ENDIAN
+ select SWIOTLB if ARCH_DMA_ADDR_T_64BIT && PCI
config SIBYTE_BIGSUR
bool "Sibyte BCM91480B-BigSur"
@@ -662,6 +664,7 @@ config SIBYTE_BIGSUR
select SYS_SUPPORTS_HIGHMEM
select SYS_SUPPORTS_LITTLE_ENDIAN
select ZONE_DMA32 if 64BIT
+ select SWIOTLB if ARCH_DMA_ADDR_T_64BIT && PCI
config SNI_RM
bool "SNI RM200/300/400"
diff --git a/arch/mips/sibyte/common/Makefile b/arch/mips/sibyte/common/Makefile
index b3d6bf23a662..3ef3fb658136 100644
--- a/arch/mips/sibyte/common/Makefile
+++ b/arch/mips/sibyte/common/Makefile
@@ -1,4 +1,5 @@
obj-y := cfe.o
+obj-$(CONFIG_SWIOTLB) += dma.o
obj-$(CONFIG_SIBYTE_BUS_WATCHER) += bus_watcher.o
obj-$(CONFIG_SIBYTE_CFE_CONSOLE) += cfe_console.o
obj-$(CONFIG_SIBYTE_TBPROF) += sb_tbprof.o
diff --git a/arch/mips/sibyte/common/dma.c b/arch/mips/sibyte/common/dma.c
new file mode 100644
index 000000000000..eb47a94f3583
--- /dev/null
+++ b/arch/mips/sibyte/common/dma.c
@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * DMA support for Broadcom SiByte platforms.
+ *
+ * Copyright (c) 2018 Maciej W. Rozycki
+ */
+
+#include <linux/swiotlb.h>
+#include <asm/bootinfo.h>
+
+void __init plat_swiotlb_setup(void)
+{
+ swiotlb_init(1);
+}
--
2.19.1
From: João Paulo Rechi Vita <jprvita(a)gmail.com>
[ Upstream commit 78f3ac76d9e5219589718b9e4733bee21627b3f5 ]
In the past, Asus firmwares would change the panel backlight directly
through the EC when the display off hotkey (Fn+F7) was pressed, and
only notify the OS of such change, with 0x33 when the LCD was ON and
0x34 when the LCD was OFF. These are currently mapped to
KEY_DISPLAYTOGGLE and KEY_DISPLAY_OFF, respectively.
Most recently the EC on Asus most machines lost ability to toggle the
LCD backlight directly, but unless the OS informs the firmware it is
going to handle the display toggle hotkey events, the firmware still
tries change the brightness through the EC, to no effect. The end result
is a long list (at Endless we counted 11) of Asus laptop models where
the display toggle hotkey does not perform any action. Our firmware
engineers contacts at Asus were surprised that there were still machines
out there with the old behavior.
Calling WMNB(ASUS_WMI_DEVID_BACKLIGHT==0x00050011, 2) on the _WDG device
tells the firmware that it should let the OS handle the display toggle
event, in which case it will simply notify the OS of a key press with
0x35, as shown by the DSDT excerpts bellow.
Scope (_SB)
{
(...)
Device (ATKD)
{
(...)
Name (_WDG, Buffer (0x28)
{
/* 0000 */ 0xD0, 0x5E, 0x84, 0x97, 0x6D, 0x4E, 0xDE, 0x11,
/* 0008 */ 0x8A, 0x39, 0x08, 0x00, 0x20, 0x0C, 0x9A, 0x66,
/* 0010 */ 0x4E, 0x42, 0x01, 0x02, 0x35, 0xBB, 0x3C, 0x0B,
/* 0018 */ 0xC2, 0xE3, 0xED, 0x45, 0x91, 0xC2, 0x4C, 0x5A,
/* 0020 */ 0x6D, 0x19, 0x5D, 0x1C, 0xFF, 0x00, 0x01, 0x08
})
Method (WMNB, 3, Serialized)
{
CreateDWordField (Arg2, Zero, IIA0)
CreateDWordField (Arg2, 0x04, IIA1)
Local0 = (Arg1 & 0xFFFFFFFF)
(...)
If ((Local0 == 0x53564544))
{
(...)
If ((IIA0 == 0x00050011))
{
If ((IIA1 == 0x02))
{
^^PCI0.SBRG.EC0.SPIN (0x72, One)
^^PCI0.SBRG.EC0.BLCT = One
}
Return (One)
}
}
(...)
}
(...)
}
(...)
}
(...)
Scope (_SB.PCI0.SBRG.EC0)
{
(...)
Name (BLCT, Zero)
(...)
Method (_Q10, 0, NotSerialized) // _Qxx: EC Query
{
If ((BLCT == Zero))
{
Local0 = One
Local0 = RPIN (0x72)
Local0 ^= One
SPIN (0x72, Local0)
If (ATKP)
{
Local0 = (0x34 - Local0)
^^^^ATKD.IANE (Local0)
}
}
ElseIf ((BLCT == One))
{
If (ATKP)
{
^^^^ATKD.IANE (0x35)
}
}
}
(...)
}
Signed-off-by: João Paulo Rechi Vita <jprvita(a)endlessm.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/platform/x86/asus-wmi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index f96f7b865267..7c1defaef3f5 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -2084,7 +2084,8 @@ static int asus_wmi_add(struct platform_device *pdev)
err = asus_wmi_backlight_init(asus);
if (err && err != -ENODEV)
goto fail_backlight;
- }
+ } else
+ err = asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL);
status = wmi_install_notify_handler(asus->driver->event_guid,
asus_wmi_notify, asus);
--
2.19.1
From: João Paulo Rechi Vita <jprvita(a)gmail.com>
[ Upstream commit 78f3ac76d9e5219589718b9e4733bee21627b3f5 ]
In the past, Asus firmwares would change the panel backlight directly
through the EC when the display off hotkey (Fn+F7) was pressed, and
only notify the OS of such change, with 0x33 when the LCD was ON and
0x34 when the LCD was OFF. These are currently mapped to
KEY_DISPLAYTOGGLE and KEY_DISPLAY_OFF, respectively.
Most recently the EC on Asus most machines lost ability to toggle the
LCD backlight directly, but unless the OS informs the firmware it is
going to handle the display toggle hotkey events, the firmware still
tries change the brightness through the EC, to no effect. The end result
is a long list (at Endless we counted 11) of Asus laptop models where
the display toggle hotkey does not perform any action. Our firmware
engineers contacts at Asus were surprised that there were still machines
out there with the old behavior.
Calling WMNB(ASUS_WMI_DEVID_BACKLIGHT==0x00050011, 2) on the _WDG device
tells the firmware that it should let the OS handle the display toggle
event, in which case it will simply notify the OS of a key press with
0x35, as shown by the DSDT excerpts bellow.
Scope (_SB)
{
(...)
Device (ATKD)
{
(...)
Name (_WDG, Buffer (0x28)
{
/* 0000 */ 0xD0, 0x5E, 0x84, 0x97, 0x6D, 0x4E, 0xDE, 0x11,
/* 0008 */ 0x8A, 0x39, 0x08, 0x00, 0x20, 0x0C, 0x9A, 0x66,
/* 0010 */ 0x4E, 0x42, 0x01, 0x02, 0x35, 0xBB, 0x3C, 0x0B,
/* 0018 */ 0xC2, 0xE3, 0xED, 0x45, 0x91, 0xC2, 0x4C, 0x5A,
/* 0020 */ 0x6D, 0x19, 0x5D, 0x1C, 0xFF, 0x00, 0x01, 0x08
})
Method (WMNB, 3, Serialized)
{
CreateDWordField (Arg2, Zero, IIA0)
CreateDWordField (Arg2, 0x04, IIA1)
Local0 = (Arg1 & 0xFFFFFFFF)
(...)
If ((Local0 == 0x53564544))
{
(...)
If ((IIA0 == 0x00050011))
{
If ((IIA1 == 0x02))
{
^^PCI0.SBRG.EC0.SPIN (0x72, One)
^^PCI0.SBRG.EC0.BLCT = One
}
Return (One)
}
}
(...)
}
(...)
}
(...)
}
(...)
Scope (_SB.PCI0.SBRG.EC0)
{
(...)
Name (BLCT, Zero)
(...)
Method (_Q10, 0, NotSerialized) // _Qxx: EC Query
{
If ((BLCT == Zero))
{
Local0 = One
Local0 = RPIN (0x72)
Local0 ^= One
SPIN (0x72, Local0)
If (ATKP)
{
Local0 = (0x34 - Local0)
^^^^ATKD.IANE (Local0)
}
}
ElseIf ((BLCT == One))
{
If (ATKP)
{
^^^^ATKD.IANE (0x35)
}
}
}
(...)
}
Signed-off-by: João Paulo Rechi Vita <jprvita(a)endlessm.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/platform/x86/asus-wmi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index ed277685da1d..10bd13b30178 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -2154,7 +2154,8 @@ static int asus_wmi_add(struct platform_device *pdev)
err = asus_wmi_backlight_init(asus);
if (err && err != -ENODEV)
goto fail_backlight;
- }
+ } else
+ err = asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL);
status = wmi_install_notify_handler(asus->driver->event_guid,
asus_wmi_notify, asus);
--
2.19.1
commit 6010abf2c2c0e382d7e8ee44bd11f343aae90cce upstream.
Due to lack of ID pin interrupt event on AM335x devices, the musb dsps
driver uses polling to detect usb device attach for dual-role port.
But in the case if a micro-A cable adapter is attached without a USB device
attached to the cable, the musb state machine gets stuck in a_wait_vrise
state waiting for the MUSB_CONNECT interrupt which won't happen due to the
usb device is not attached. The state is stuck in a_wait_vrise even after
the micro-A cable is detached, which could cause VBUS retention if then the
dual-role port is attached to a host port.
To fix the problem, make a_wait_vrise as a transient state, then move the
state to either a_wait_bcon for host port or a_idle state for dual-role
port, if no usb device is attached to the port.
Cc: stable(a)vger.kernel.org # v4.9+
Signed-off-by: Bin Liu <b-liu(a)ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/musb/musb_dsps.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 4fa2456ee801..7cc94410d062 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -244,8 +244,13 @@ static int dsps_check_status(struct musb *musb, void *unused)
switch (musb->xceiv->otg->state) {
case OTG_STATE_A_WAIT_VRISE:
- dsps_mod_timer_optional(glue);
- break;
+ if (musb->port_mode == MUSB_PORT_MODE_HOST) {
+ musb->xceiv->otg->state = OTG_STATE_A_WAIT_BCON;
+ dsps_mod_timer_optional(glue);
+ break;
+ }
+ /* fall through */
+
case OTG_STATE_A_WAIT_BCON:
/* keep VBUS on for host-only mode */
if (musb->port_mode == MUSB_PORT_MODE_HOST) {
--
2.17.1
commit 54578ee883e34d2d1c518d48f1c1e2dd3f387188 upstream.
Since the runtime PM support was added in musb, dsps relies on the timer
calling otg_timer() to activate the usb subsystem. However the driver
doesn't enable the timer for peripheral port, then the peripheral port is
unable to be enumerated by a host if the other usb port is disabled or in
peripheral mode too.
So let's start the timer for peripheral port too.
Fixes: ea2f35c01d5e ("usb: musb: Fix sleeping function called from invalid context for hdrc glue")
Cc: stable(a)vger.kernel.org # v4.9+
Acked-by: Tony Lindgren <tony(a)atomide.com>
Signed-off-by: Bin Liu <b-liu(a)ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/musb/musb_dsps.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index eb93d0103117..49724ec8f55a 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -196,9 +196,11 @@ static void dsps_musb_enable(struct musb *musb)
musb_writel(reg_base, wrp->epintr_set, epmask);
musb_writel(reg_base, wrp->coreintr_set, coremask);
- /* start polling for ID change in dual-role idle mode */
- if (musb->xceiv->otg->state == OTG_STATE_B_IDLE &&
- musb->port_mode == MUSB_PORT_MODE_DUAL_ROLE)
+ /*
+ * start polling for runtime PM active and idle,
+ * and for ID change in dual-role idle mode.
+ */
+ if (musb->xceiv->otg->state == OTG_STATE_B_IDLE)
dsps_mod_timer(glue, -1);
}
@@ -269,6 +271,10 @@ static int dsps_check_status(struct musb *musb, void *unused)
musb_set_otg_state(musb, OTG_STATE_A_IDLE);
MUSB_HST_MODE(musb);
}
+
+ if (musb->port_mode == MUSB_PORT_MODE_GADGET)
+ skip_session = 1;
+
if (!(devctl & MUSB_DEVCTL_SESSION) && !skip_session)
musb_writeb(mregs, MUSB_DEVCTL,
MUSB_DEVCTL_SESSION);
--
2.17.1
Userspace may request pitch alignment that is not supported by GPU.
Some requests 32, but GPU ignores it and uses default 64 when cpp is
4. If GEM object is allocated based on the smaller alignment, GPU
DMA will go out of bound.
For GPU that does frame buffer compression, DMA writing out of bound
memory will cause memory corruption.
Cc: stable(a)vger.kernel.org # v4.2+
Signed-off-by: Yu Zhao <yuzhao(a)google.com>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index 686a26de50f9..883a4df2386d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -527,6 +527,15 @@ amdgpu_display_user_framebuffer_create(struct drm_device *dev,
struct drm_gem_object *obj;
struct amdgpu_framebuffer *amdgpu_fb;
int ret;
+ struct amdgpu_device *adev = dev->dev_private;
+ int cpp = drm_format_plane_cpp(mode_cmd->pixel_format, 0);
+ int pitch = amdgpu_align_pitch(adev, mode_cmd->pitches[0], cpp, false);
+
+ if (mode_cmd->pitches[0] != pitch) {
+ DRM_DEBUG_KMS("Invalid pitch: expecting %d but got %d\n",
+ pitch, mode_cmd->pitches[0]);
+ return ERR_PTR(-EINVAL);
+ }
obj = drm_gem_object_lookup(file_priv, mode_cmd->handles[0]);
if (obj == NULL) {
--
2.20.1.415.g653613c723-goog
SDL 1.2 sets all fields related to the pixel format to zero in some
cases[1]. Prior to commit db05c48197759 ("drm: fb-helper: Reject all
pixel format changing requests"), there was an unintentional workaround
for this that existed for more than a decade. First in device-specific DRM
drivers, then here in drm_fb_helper.c.
Previous code containing this workaround just ignores pixel format fields
from userspace code. Not a good thing either, as this way, driver may
silently use pixel format different from what client actually requested,
and this in turn will lead to displaying garbage on the screen. I think
that returning EINVAL to userspace in this particular case is the right
option, so I decided to left code from problematic commit untouched
instead of just reverting it entirely.
Here is the steps required to reproduce this problem exactly:
1) Compile fceux[2] with SDL 1.2.15 and without GTK or OpenGL
support. SDL should be compiled with fbdev support (which is
on by default).
2) Create /etc/fb.modes with following contents (values seems
not used, and just required to trigger problematic code in
SDL):
mode "test"
geometry 1 1 1 1 1
timings 1 1 1 1 1 1 1
endmode
3) Create ~/.fceux/fceux.cfg with following contents:
SDL.Hotkeys.Quit = 27
SDL.DoubleBuffering = 1
4) Ensure that screen resolution is at least 1280x960 (e.g.
append "video=Virtual-1:1280x960-32" to the kernel cmdline
for qemu/QXL).
5) Try to run fceux on VT with some ROM file[3]:
# ./fceux color_test.nes
[1] SDL 1.2.15 source code, src/video/fbcon/SDL_fbvideo.c,
FB_SetVideoMode()
[2] http://www.fceux.com
[3] Example ROM: https://github.com/bokuweb/rustynes/blob/master/roms/color_test.nes
Reported-by: saahriktu <mail(a)saahriktu.org>
Suggested-by: saahriktu <mail(a)saahriktu.org>
Cc: stable(a)vger.kernel.org
Fixes: db05c48197759 ("drm: fb-helper: Reject all pixel format changing requests")
Signed-off-by: Ivan Mironov <mironov.ivan(a)gmail.com>
---
drivers/gpu/drm/drm_fb_helper.c | 142 ++++++++++++++++++++------------
1 file changed, 89 insertions(+), 53 deletions(-)
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index d3af098b0922..ed7e91423258 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1621,6 +1621,64 @@ static bool drm_fb_pixel_format_equal(const struct fb_var_screeninfo *var_1,
var_1->transp.msb_right == var_2->transp.msb_right;
}
+static void drm_fb_helper_fill_pixel_fmt(struct fb_var_screeninfo *var,
+ u8 depth)
+{
+ switch (depth) {
+ case 8:
+ var->red.offset = 0;
+ var->green.offset = 0;
+ var->blue.offset = 0;
+ var->red.length = 8; /* 8bit DAC */
+ var->green.length = 8;
+ var->blue.length = 8;
+ var->transp.offset = 0;
+ var->transp.length = 0;
+ break;
+ case 15:
+ var->red.offset = 10;
+ var->green.offset = 5;
+ var->blue.offset = 0;
+ var->red.length = 5;
+ var->green.length = 5;
+ var->blue.length = 5;
+ var->transp.offset = 15;
+ var->transp.length = 1;
+ break;
+ case 16:
+ var->red.offset = 11;
+ var->green.offset = 5;
+ var->blue.offset = 0;
+ var->red.length = 5;
+ var->green.length = 6;
+ var->blue.length = 5;
+ var->transp.offset = 0;
+ break;
+ case 24:
+ var->red.offset = 16;
+ var->green.offset = 8;
+ var->blue.offset = 0;
+ var->red.length = 8;
+ var->green.length = 8;
+ var->blue.length = 8;
+ var->transp.offset = 0;
+ var->transp.length = 0;
+ break;
+ case 32:
+ var->red.offset = 16;
+ var->green.offset = 8;
+ var->blue.offset = 0;
+ var->red.length = 8;
+ var->green.length = 8;
+ var->blue.length = 8;
+ var->transp.offset = 24;
+ var->transp.length = 8;
+ break;
+ default:
+ break;
+ }
+}
+
/**
* drm_fb_helper_check_var - implementation for &fb_ops.fb_check_var
* @var: screeninfo to check
@@ -1654,6 +1712,36 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
return -EINVAL;
}
+ /*
+ * Workaround for SDL 1.2, which is known to be setting all pixel format
+ * fields values to zero in some cases. We treat this situation as a
+ * kind of "use some reasonable autodetected values".
+ */
+ if (!var->red.offset && !var->green.offset &&
+ !var->blue.offset && !var->transp.offset &&
+ !var->red.length && !var->green.length &&
+ !var->blue.length && !var->transp.length &&
+ !var->red.msb_right && !var->green.msb_right &&
+ !var->blue.msb_right && !var->transp.msb_right) {
+ /*
+ * There is no way to guess the right value for depth when
+ * bits_per_pixel is 16 or 32. Instead of restoring the
+ * behaviour previously introduced here by commit 785b93ef8c309,
+ * we decided to just use the current depth and do not perform
+ * any guessing.
+ *
+ * Also, if requested bits_per_pixel differs from current,
+ * the next call to drm_fb_pixel_format_equal() will fail
+ * resulting in EINVAL error from ioctl().
+ *
+ * However, this still leaves the theoretical possibility of
+ * situation when userspace app requests different pixel format
+ * and ioctl() call silently succeeds. Garbage will be displayed
+ * in this case.
+ */
+ drm_fb_helper_fill_pixel_fmt(var, fb->format->depth);
+ }
+
/*
* drm fbdev emulation doesn't support changing the pixel format at all,
* so reject all pixel format changing requests.
@@ -1967,59 +2055,7 @@ void drm_fb_helper_fill_var(struct fb_info *info, struct drm_fb_helper *fb_helpe
info->var.yoffset = 0;
info->var.activate = FB_ACTIVATE_NOW;
- switch (fb->format->depth) {
- case 8:
- info->var.red.offset = 0;
- info->var.green.offset = 0;
- info->var.blue.offset = 0;
- info->var.red.length = 8; /* 8bit DAC */
- info->var.green.length = 8;
- info->var.blue.length = 8;
- info->var.transp.offset = 0;
- info->var.transp.length = 0;
- break;
- case 15:
- info->var.red.offset = 10;
- info->var.green.offset = 5;
- info->var.blue.offset = 0;
- info->var.red.length = 5;
- info->var.green.length = 5;
- info->var.blue.length = 5;
- info->var.transp.offset = 15;
- info->var.transp.length = 1;
- break;
- case 16:
- info->var.red.offset = 11;
- info->var.green.offset = 5;
- info->var.blue.offset = 0;
- info->var.red.length = 5;
- info->var.green.length = 6;
- info->var.blue.length = 5;
- info->var.transp.offset = 0;
- break;
- case 24:
- info->var.red.offset = 16;
- info->var.green.offset = 8;
- info->var.blue.offset = 0;
- info->var.red.length = 8;
- info->var.green.length = 8;
- info->var.blue.length = 8;
- info->var.transp.offset = 0;
- info->var.transp.length = 0;
- break;
- case 32:
- info->var.red.offset = 16;
- info->var.green.offset = 8;
- info->var.blue.offset = 0;
- info->var.red.length = 8;
- info->var.green.length = 8;
- info->var.blue.length = 8;
- info->var.transp.offset = 24;
- info->var.transp.length = 8;
- break;
- default:
- break;
- }
+ drm_fb_helper_fill_pixel_fmt(&info->var, fb->format->depth);
info->var.xres = fb_width;
info->var.yres = fb_height;
--
2.20.1
Strict requirement of pixclock to be zero breaks support of SDL 1.2
which contains hardcoded table of supported video modes with non-zero
pixclock values[1].
To better understand which pixclock values are considered valid and how
driver should handle these values, I briefly examined few existing fbdev
drivers and documentation in Documentation/fb/. And it looks like there
are no strict rules on that and actual behaviour varies:
* some drivers treat (pixclock == 0) as "use defaults" (uvesafb.c);
* some treat (pixclock == 0) as invalid value which leads to
-EINVAL (clps711x-fb.c);
* some pass converted pixclock value to hardware (uvesafb.c);
* some are trying to find nearest value from predefined table
(vga16fb.c, video_gx.c).
Given this, I believe that it should be safe to just ignore this value if
changing is not supported. It seems that any portable fbdev application
which was not written only for one specific device working under one
specific kernel version should not rely on any particular behaviour of
pixclock anyway.
However, while enabling SDL1 applications to work out of the box when
there is no /etc/fb.modes with valid settings, this change affects the
video mode choosing logic in SDL. Depending on current screen
resolution, contents of /etc/fb.modes and resolution requested by
application, this may lead to user-visible difference (not always):
image will be displayed in a right way, but it will be aligned to the
left instead of center. There is no "right behaviour" here as well, as
emulated fbdev, opposing to old fbdev drivers, simply ignores any
requsts of video mode changes with resolutions smaller than current.
The easiest way to reproduce this problem is to install sdl-sopwith[2],
remove /etc/fb.modes file if it exists, and then try to run sopwith
from console without X. At least in Fedora 29, sopwith may be simply
installed from standard repositories.
[1] SDL 1.2.15 source code, src/video/fbcon/SDL_fbvideo.c, vesa_timings
[2] http://sdl-sopwith.sourceforge.net/
Signed-off-by: Ivan Mironov <mironov.ivan(a)gmail.com>
Cc: stable(a)vger.kernel.org
Fixes: 79e539453b34e ("DRM: i915: add mode setting support")
Fixes: 771fe6b912fca ("drm/radeon: introduce kernel modesetting for radeon hardware")
Fixes: 785b93ef8c309 ("drm/kms: move driver specific fb common code to helper functions (v2)")
---
drivers/gpu/drm/drm_fb_helper.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index ed7e91423258..2d4c2b38508e 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1690,9 +1690,14 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
struct drm_fb_helper *fb_helper = info->par;
struct drm_framebuffer *fb = fb_helper->fb;
- if (var->pixclock != 0 || in_dbg_master())
+ if (in_dbg_master())
return -EINVAL;
+ if (var->pixclock != 0) {
+ DRM_DEBUG("fbdev emulation doesn't support changing the pixel clock, value of pixclock is ignored\n");
+ var->pixclock = 0;
+ }
+
if ((drm_format_info_block_width(fb->format, 0) > 1) ||
(drm_format_info_block_height(fb->format, 0) > 1))
return -EINVAL;
--
2.20.1
Since virtio-ccw doesn't work with accessing to the config space
inside an interrupt context, this patch series avoids that issue by
moving the config register accesses to the related workqueue contexts.
v3->v4 ChangeLog:
- change virtio32_to_cpu to cpu_to_virtio_32 in send_cmd_id_start;
v2->v3 ChangeLog:
- rename cmd_id_received to cmd_id_received_cache, and have call sites
read the latest value via virtio_balloon_cmd_id_received. (Still
kept Cornelia and Halil's reviewed-by as it's a minor change)
- remove zeroing vb->num_free_page_blocks in probe since vb is
allocated via kzalloc.
v1->v2 ChangeLog:
- add config_read_bitmap to indicate to the workqueue callbacks about
the necessity of reading the related config fields.
Wei Wang (3):
virtio-balloon: tweak config_changed implementation
virtio-balloon: improve update_balloon_size_func
virtio_balloon: remove the unnecessary 0-initialization
drivers/virtio/virtio_balloon.c | 104 ++++++++++++++++++++++++++--------------
1 file changed, 69 insertions(+), 35 deletions(-)
--
2.7.4
This is an ugly one unfortunately. Currently, all DRM drivers supporting
atomic modesetting will save the state that userspace had set before
suspending, then attempt to restore that state on resume. This probably
worked very well at one point, like many other things, until DP MST came
into the picture. While it's easy to restore state on normal display
connectors that were disconnected during suspend regardless of their
state post-resume, this can't really be done with MST because of the
fact that setting up a downstream sink requires performing sideband
transactions between the source and the MST hub, sending out the ACT
packets, etc.
Because of this, there isn't really a guarantee that we can restore the
atomic state we had before suspend once we've resumed. This sucks pretty
bad, but so far I haven't run into any compositors that this actually
causes serious issues with. Most compositors will notice the hotplug we
send afterwards, and then reprobe state.
Since nouveau and i915 also don't fail the suspend/resume process due to
failing to restore the atomic state, let's make amdgpu match this
behavior. Better to resume the GPU properly, then to stop the process
half way because of a potentially unavoidable atomic commit failure.
Eventually, we'll have a real fix for this problem on the DRM level. But
we've got some more important low-hanging fruit to deal with first.
Signed-off-by: Lyude Paul <lyude(a)redhat.com>
Cc: Jerry Zuo <Jerry.Zuo(a)amd.com>
Cc: <stable(a)vger.kernel.org> # v4.15+
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 3f326a2c513b..a3e65e457348 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -912,7 +912,6 @@ static int dm_resume(void *handle)
struct drm_plane_state *new_plane_state;
struct dm_plane_state *dm_new_plane_state;
enum dc_connection_type new_connection_type = dc_connection_none;
- int ret;
int i;
/* power on hardware */
@@ -985,13 +984,13 @@ static int dm_resume(void *handle)
}
}
- ret = drm_atomic_helper_resume(ddev, dm->cached_state);
+ drm_atomic_helper_resume(ddev, dm->cached_state);
dm->cached_state = NULL;
amdgpu_dm_irq_resume_late(adev);
- return ret;
+ return 0;
}
/**
--
2.20.1
drm_dp_mst_topology_mgr_resume() returns whether or not it managed to
find the topology in question after a suspend resume cycle, and the
driver is supposed to check this value and disable MST accordingly if
it's gone-in addition to sending a hotplug in order to notify userspace
that something changed during suspend.
Currently, amdgpu just makes the mistake of ignoring the return code
from drm_dp_mst_topology_mgr_resume() which means that if a topology was
removed in suspend, amdgpu never notices and assumes it's still
connected which leads to all sorts of problems.
So, fix this by actually checking the rc from
drm_dp_mst_topology_mgr_resume(). Also, reformat the rest of the
function while we're at it to fix the over-indenting.
Signed-off-by: Lyude Paul <lyude(a)redhat.com>
Cc: Jerry Zuo <Jerry.Zuo(a)amd.com>
Cc: <stable(a)vger.kernel.org> # v4.15+
---
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 32 +++++++++++++------
1 file changed, 23 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 8a626d16e8e3..3f326a2c513b 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -699,22 +699,36 @@ static void s3_handle_mst(struct drm_device *dev, bool suspend)
{
struct amdgpu_dm_connector *aconnector;
struct drm_connector *connector;
+ struct drm_dp_mst_topology_mgr *mgr;
+ int ret;
+ bool need_hotplug = false;
drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
- list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
- aconnector = to_amdgpu_dm_connector(connector);
- if (aconnector->dc_link->type == dc_connection_mst_branch &&
- !aconnector->mst_port) {
+ list_for_each_entry(connector, &dev->mode_config.connector_list,
+ head) {
+ aconnector = to_amdgpu_dm_connector(connector);
+ if (aconnector->dc_link->type != dc_connection_mst_branch ||
+ aconnector->mst_port)
+ continue;
+
+ mgr = &aconnector->mst_mgr;
- if (suspend)
- drm_dp_mst_topology_mgr_suspend(&aconnector->mst_mgr);
- else
- drm_dp_mst_topology_mgr_resume(&aconnector->mst_mgr);
- }
+ if (suspend) {
+ drm_dp_mst_topology_mgr_suspend(mgr);
+ } else {
+ ret = drm_dp_mst_topology_mgr_resume(mgr);
+ if (ret < 0) {
+ drm_dp_mst_topology_mgr_set_mst(mgr, false);
+ need_hotplug = true;
+ }
+ }
}
drm_modeset_unlock(&dev->mode_config.connection_mutex);
+
+ if (need_hotplug)
+ drm_kms_helper_hotplug_event(dev);
}
/**
--
2.20.1
The patch
ASoC: tlv320aic32x4: Kernel OOPS while entering DAPM standby mode
has been applied to the asoc tree at
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git
All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.
You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.
If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.
Please add any relevant lists and maintainers to the CCs when replying
to this mail.
Thanks,
Mark
>From 667e9334fa64da2273e36ce131b05ac9e47c5769 Mon Sep 17 00:00:00 2001
From: b-ak <anur.bhargav(a)gmail.com>
Date: Mon, 7 Jan 2019 22:30:22 +0530
Subject: [PATCH] ASoC: tlv320aic32x4: Kernel OOPS while entering DAPM standby
mode
During the bootup of the kernel, the DAPM bias level is in the OFF
state. As soon as the DAPM framework kicks in it pushes the codec
into STANDBY state.
The probe function doesn't prepare the clock, and STANDBY state
does a clk_disable_unprepare() without checking the previous state.
This leads to an OOPS.
Not transitioning from an OFF state to the STANDBY state fixes the
problem.
Signed-off-by: b-ak <anur.bhargav(a)gmail.com>
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Cc: stable(a)vger.kernel.org
---
sound/soc/codecs/tlv320aic32x4.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index e2b5a11b16d1..f03195d2ab2e 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -822,6 +822,10 @@ static int aic32x4_set_bias_level(struct snd_soc_component *component,
case SND_SOC_BIAS_PREPARE:
break;
case SND_SOC_BIAS_STANDBY:
+ /* Initial cold start */
+ if (snd_soc_component_get_bias_level(component) == SND_SOC_BIAS_OFF)
+ break;
+
/* Switch off BCLK_N Divider */
snd_soc_component_update_bits(component, AIC32X4_BCLKN,
AIC32X4_BCLKEN, 0);
--
2.20.1
The patch
ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages
has been applied to the asoc tree at
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git
All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.
You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.
If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.
Please add any relevant lists and maintainers to the CCs when replying
to this mail.
Thanks,
Mark
>From 44fabd8cdaaa3acb80ad2bb3b5c61ae2136af661 Mon Sep 17 00:00:00 2001
From: Kangjie Lu <kjlu(a)umn.edu>
Date: Tue, 25 Dec 2018 20:29:48 -0600
Subject: [PATCH] ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages
snd_pcm_lib_malloc_pages() may fail, so let's check its status and
return its error code upstream.
Signed-off-by: Kangjie Lu <kjlu(a)umn.edu>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Cc: stable(a)vger.kernel.org
---
sound/soc/intel/atom/sst-mfld-platform-pcm.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
index afc559866095..91a2436ce952 100644
--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
@@ -399,7 +399,13 @@ static int sst_media_hw_params(struct snd_pcm_substream *substream,
struct snd_pcm_hw_params *params,
struct snd_soc_dai *dai)
{
- snd_pcm_lib_malloc_pages(substream, params_buffer_bytes(params));
+ int ret;
+
+ ret =
+ snd_pcm_lib_malloc_pages(substream,
+ params_buffer_bytes(params));
+ if (ret)
+ return ret;
memset(substream->runtime->dma_area, 0, params_buffer_bytes(params));
return 0;
}
--
2.20.1
Hi,
On Wed, Jan 2, 2019 at 4:11 PM Matthias Kaehlcke <mka(a)chromium.org> wrote:
>
> With commit e16337622016 ("Bluetooth: Handle bt_accept_enqueue() socket
> atomically") lock_sock[_nested]() is used to acquire the socket lock
> before manipulating the socket. lock_sock[_nested]() may block, which
> is problematic since bt_accept_enqueue() can be called in bottom half
> context (e.g. from rfcomm_connect_ind()):
>
> [<ffffff80080d81ec>] __might_sleep+0x4c/0x80
> [<ffffff800876c7b0>] lock_sock_nested+0x24/0x58
> [<ffffff8000d7c27c>] bt_accept_enqueue+0x48/0xd4 [bluetooth]
> [<ffffff8000e67d8c>] rfcomm_connect_ind+0x190/0x218 [rfcomm]
>
> Add a parameter to bt_accept_enqueue() to indicate whether the
> function is called from BH context, and acquire the socket lock
> with bh_lock_sock_nested() if that's the case.
>
> Also adapt all callers of bt_accept_enqueue() to pass the new
> parameter:
>
> - l2cap_sock_new_connection_cb()
> - uses lock_sock() to lock the parent socket => process context
>
> - rfcomm_connect_ind()
> - acquires the parent socket lock with bh_lock_sock() => BH
> context
>
> - __sco_chan_add()
> - called from sco_chan_add(), which is called from sco_connect().
> parent is NULL, hence bt_accept_enqueue() isn't called in this
> code path and we can ignore it
> - also called from sco_conn_ready(). uses bh_lock_sock() to acquire
> the parent lock => BH context
>
> Fixes: e16337622016 ("Bluetooth: Handle bt_accept_enqueue() socket atomically")
> Signed-off-by: Matthias Kaehlcke <mka(a)chromium.org>
> ---
> Changes in v2:
> - use parameter in bt_accept_enqueue() to decide which lock to
> acquire and adapt all callers
> - updated commit message
> ---
> include/net/bluetooth/bluetooth.h | 2 +-
> net/bluetooth/af_bluetooth.c | 16 +++++++++++++---
> net/bluetooth/l2cap_sock.c | 2 +-
> net/bluetooth/rfcomm/sock.c | 2 +-
> net/bluetooth/sco.c | 2 +-
> 5 files changed, 17 insertions(+), 7 deletions(-)
This looks nice to me, thanks!
Cc: stable(a)vger.kernel.org
Reviewed-by: Douglas Anderson <dianders(a)chromium.org>
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: lgdt330x: fix lock status reporting
Author: French, Nicholas A <naf(a)ou.edu>
Date: Sun Dec 9 02:11:18 2018 -0500
A typo in code cleanup commit db9c1007bc07 ("media: lgdt330x: do
some cleanups at status logic") broke the FE_HAS_LOCK reporting
for 3303 chips by inadvertently modifying the register mask.
The broken lock status is critial as it prevents video capture
cards from reporting signal strength, scanning for channels,
and capturing video.
Fix regression by reverting mask change.
Cc: stable(a)vger.kernel.org # Kernel 4.17+
Fixes: db9c1007bc07 ("media: lgdt330x: do some cleanups at status logic")
Signed-off-by: Nick French <naf(a)ou.edu>
Reviewed-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com>
Tested-by: Adam Stylinski <kungfujesus06(a)gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung(a)kernel.org>
drivers/media/dvb-frontends/lgdt330x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---
diff --git a/drivers/media/dvb-frontends/lgdt330x.c b/drivers/media/dvb-frontends/lgdt330x.c
index 96807e134886..8abb1a510a81 100644
--- a/drivers/media/dvb-frontends/lgdt330x.c
+++ b/drivers/media/dvb-frontends/lgdt330x.c
@@ -783,7 +783,7 @@ static int lgdt3303_read_status(struct dvb_frontend *fe,
if ((buf[0] & 0x02) == 0x00)
*status |= FE_HAS_SYNC;
- if ((buf[0] & 0xfd) == 0x01)
+ if ((buf[0] & 0x01) == 0x01)
*status |= FE_HAS_VITERBI | FE_HAS_LOCK;
break;
default:
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 169113ece0f29ebe884a6cfcf57c1ace04d8a36a Mon Sep 17 00:00:00 2001
From: Will Deacon <will.deacon(a)arm.com>
Date: Thu, 3 Jan 2019 17:45:07 +0000
Subject: [PATCH] arm64: compat: Avoid sending SIGILL for unallocated syscall
numbers
The ARM Linux kernel handles the EABI syscall numbers as follows:
0 - NR_SYSCALLS-1 : Invoke syscall via syscall table
NR_SYSCALLS - 0xeffff : -ENOSYS (to be allocated in future)
0xf0000 - 0xf07ff : Private syscall or -ENOSYS if not allocated
> 0xf07ff : SIGILL
Our compat code gets this wrong and ends up sending SIGILL in response
to all syscalls greater than NR_SYSCALLS which have a value greater
than 0x7ff in the bottom 16 bits.
Fix this by defining the end of the ARM private syscall region and
checking the syscall number against that directly. Update the comment
while we're at it.
Cc: <stable(a)vger.kernel.org>
Cc: Dave Martin <Dave.Martin(a)arm.com>
Reported-by: Pi-Hsun Shih <pihsun(a)chromium.org>
Signed-off-by: Will Deacon <will.deacon(a)arm.com>
diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
index b13ca091f833..85d5c1026204 100644
--- a/arch/arm64/include/asm/unistd.h
+++ b/arch/arm64/include/asm/unistd.h
@@ -40,8 +40,9 @@
* The following SVCs are ARM private.
*/
#define __ARM_NR_COMPAT_BASE 0x0f0000
-#define __ARM_NR_compat_cacheflush (__ARM_NR_COMPAT_BASE+2)
-#define __ARM_NR_compat_set_tls (__ARM_NR_COMPAT_BASE+5)
+#define __ARM_NR_compat_cacheflush (__ARM_NR_COMPAT_BASE + 2)
+#define __ARM_NR_compat_set_tls (__ARM_NR_COMPAT_BASE + 5)
+#define __ARM_NR_COMPAT_END (__ARM_NR_COMPAT_BASE + 0x800)
#define __NR_compat_syscalls 399
#endif
diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c
index 32653d156747..a79db4e485a6 100644
--- a/arch/arm64/kernel/sys_compat.c
+++ b/arch/arm64/kernel/sys_compat.c
@@ -102,12 +102,12 @@ long compat_arm_syscall(struct pt_regs *regs)
default:
/*
- * Calls 9f00xx..9f07ff are defined to return -ENOSYS
+ * Calls 0xf0xxx..0xf07ff are defined to return -ENOSYS
* if not implemented, rather than raising SIGILL. This
* way the calling program can gracefully determine whether
* a feature is supported.
*/
- if ((no & 0xffff) <= 0x7ff)
+ if (no < __ARM_NR_COMPAT_END)
return -ENOSYS;
break;
}
This is a partial revert of commit 5c63e407aaab ("fbdev: Convert to
using %pOFn instead of device_node.name"). This is the minimal work to
get a Mac Mini G4 back to a bootable state. The function
offb_init_palette_hacks would need to handle the case where `name` has
been set to NULL.
Cc: Rob Herring <robh(a)kernel.org>
Fixes: 5c63e407aaab ("fbdev: Convert to using %pOFn instead of device_node.name")
Cc: stable(a)vger.kernel.org # v4.19+
Signed-off-by: Mathieu Malaterre <malat(a)debian.org>
---
drivers/video/fbdev/offb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/offb.c b/drivers/video/fbdev/offb.c
index 31f769d67195..6e75851f8142 100644
--- a/drivers/video/fbdev/offb.c
+++ b/drivers/video/fbdev/offb.c
@@ -648,7 +648,7 @@ static void __init offb_init_nodriver(struct device_node *dp, int no_real_node)
/* kludge for valkyrie */
if (strcmp(dp->name, "valkyrie") == 0)
address += 0x1000;
- offb_init_fb(no_real_node ? "bootx" : NULL,
+ offb_init_fb(no_real_node ? "bootx" : dp->name,
width, height, depth, pitch, address,
foreign_endian, no_real_node ? NULL : dp);
}
--
2.19.2
This is a note to let you know that I've just added the patch titled
USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 3483254b89438e60f719937376c5e0ce2bc46761 Mon Sep 17 00:00:00 2001
From: Jack Stocker <jackstocker.93(a)gmail.com>
Date: Thu, 3 Jan 2019 21:56:53 +0000
Subject: USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB
To match the Corsair Strafe RGB, the Corsair K70 RGB also requires
USB_QUIRK_DELAY_CTRL_MSG to completely resolve boot connection issues
discussed here: https://github.com/ckb-next/ckb-next/issues/42.
Otherwise roughly 1 in 10 boots the keyboard will fail to be detected.
Patch that applied delay control quirk for Corsair Strafe RGB:
cb88a0588717 ("usb: quirks: add control message delay for 1b1c:1b20")
Previous K70 RGB patch to add delay-init quirk:
7a1646d92257 ("Add delay-init quirk for Corsair K70 RGB keyboards")
Signed-off-by: Jack Stocker <jackstocker.93(a)gmail.com>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/core/quirks.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 514c5214ddb2..8bc35d53408b 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -394,7 +394,8 @@ static const struct usb_device_id usb_quirk_list[] = {
{ USB_DEVICE(0x1a40, 0x0101), .driver_info = USB_QUIRK_HUB_SLOW_RESET },
/* Corsair K70 RGB */
- { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT |
+ USB_QUIRK_DELAY_CTRL_MSG },
/* Corsair Strafe */
{ USB_DEVICE(0x1b1c, 0x1b15), .driver_info = USB_QUIRK_DELAY_INIT |
--
2.20.1
This is a note to let you know that I've just added the patch titled
usbcore: Select only first configuration for non-UAC3 compliant
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From ff2a8c532c14fd22fb26a36574d9ff199afbbe54 Mon Sep 17 00:00:00 2001
From: Saranya Gopal <saranya.gopal(a)intel.com>
Date: Sun, 6 Jan 2019 08:14:02 +0530
Subject: usbcore: Select only first configuration for non-UAC3 compliant
devices
In most of the UAC1 and UAC2 audio devices, the first
configuration is most often the best configuration.
However, with recent patch to support UAC3 configuration,
second configuration was unintentionally chosen for
some of the UAC1/2 devices that had more than one
configuration. This was because of the existing check
after the audio config check which selected any config
which had a non-vendor class. This patch fixes this issue.
Fixes: f13912d3f014 ("usbcore: Select UAC3 configuration for audio if present")
Reported-by: Con Kolivas <kernel(a)kolivas.org>
Signed-off-by: Saranya Gopal <saranya.gopal(a)intel.com>
Tested-by: Con Kolivas <kernel(a)kolivas.org>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/core/generic.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
index 356b05c82dbc..f713cecc1f41 100644
--- a/drivers/usb/core/generic.c
+++ b/drivers/usb/core/generic.c
@@ -143,9 +143,12 @@ int usb_choose_configuration(struct usb_device *udev)
continue;
}
- if (i > 0 && desc && is_audio(desc) && is_uac3_config(desc)) {
- best = c;
- break;
+ if (i > 0 && desc && is_audio(desc)) {
+ if (is_uac3_config(desc)) {
+ best = c;
+ break;
+ }
+ continue;
}
/* From the remaining configs, choose the first one whose
--
2.20.1
This is a note to let you know that I've just added the patch titled
USB: storage: don't insert sane sense for SPC3+ when bad sense
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From c5603d2fdb424849360fe7e3f8c1befc97571b8c Mon Sep 17 00:00:00 2001
From: Icenowy Zheng <icenowy(a)aosc.io>
Date: Thu, 3 Jan 2019 11:26:17 +0800
Subject: USB: storage: don't insert sane sense for SPC3+ when bad sense
specified
Currently the code will set US_FL_SANE_SENSE flag unconditionally if
device claims SPC3+, however we should allow US_FL_BAD_SENSE flag to
prevent this behavior, because SMI SM3350 UFS-USB bridge controller,
which claims SPC4, will show strange behavior with 96-byte sense
(put the chip into a wrong state that cannot read/write anything).
Check the presence of US_FL_BAD_SENSE when assuming US_FL_SANE_SENSE on
SPC4+ devices.
Signed-off-by: Icenowy Zheng <icenowy(a)aosc.io>
Cc: stable <stable(a)vger.kernel.org>
Acked-by: Alan Stern <stern(a)rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/storage/scsiglue.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index fde2e71a6ade..a73ea495d5a7 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -235,8 +235,12 @@ static int slave_configure(struct scsi_device *sdev)
if (!(us->fflags & US_FL_NEEDS_CAP16))
sdev->try_rc_10_first = 1;
- /* assume SPC3 or latter devices support sense size > 18 */
- if (sdev->scsi_level > SCSI_SPC_2)
+ /*
+ * assume SPC3 or latter devices support sense size > 18
+ * unless US_FL_BAD_SENSE quirk is specified.
+ */
+ if (sdev->scsi_level > SCSI_SPC_2 &&
+ !(us->fflags & US_FL_BAD_SENSE))
us->fflags |= US_FL_SANE_SENSE;
/*
--
2.20.1
This is a note to let you know that I've just added the patch titled
USB: storage: add quirk for SMI SM3350
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 0a99cc4b8ee83885ab9f097a3737d1ab28455ac0 Mon Sep 17 00:00:00 2001
From: Icenowy Zheng <icenowy(a)aosc.io>
Date: Thu, 3 Jan 2019 11:26:18 +0800
Subject: USB: storage: add quirk for SMI SM3350
The SMI SM3350 USB-UFS bridge controller cannot handle long sense request
correctly and will make the chip refuse to do read/write when requested
long sense.
Add a bad sense quirk for it.
Signed-off-by: Icenowy Zheng <icenowy(a)aosc.io>
Cc: stable <stable(a)vger.kernel.org>
Acked-by: Alan Stern <stern(a)rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/storage/unusual_devs.h | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index f7f83b21dc74..ea0d27a94afe 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1265,6 +1265,18 @@ UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff,
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_FIX_CAPACITY ),
+/*
+ * Reported by Icenowy Zheng <icenowy(a)aosc.io>
+ * The SMI SM3350 USB-UFS bridge controller will enter a wrong state
+ * that do not process read/write command if a long sense is requested,
+ * so force to use 18-byte sense.
+ */
+UNUSUAL_DEV( 0x090c, 0x3350, 0x0000, 0xffff,
+ "SMI",
+ "SM3350 UFS-to-USB-Mass-Storage bridge",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_BAD_SENSE ),
+
/*
* Reported by Paul Hartman <paul.hartman+linux(a)gmail.com>
* This card reader returns "Illegal Request, Logical Block Address
--
2.20.1
This is a note to let you know that I've just added the patch titled
usb: cdc-acm: send ZLP for Telit 3G Intel based modems
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 34aabf918717dd14e05051896aaecd3b16b53d95 Mon Sep 17 00:00:00 2001
From: Daniele Palmas <dnlplm(a)gmail.com>
Date: Fri, 28 Dec 2018 16:15:41 +0100
Subject: usb: cdc-acm: send ZLP for Telit 3G Intel based modems
Telit 3G Intel based modems require zero packet to be sent if
out data size is equal to the endpoint max packet size.
Signed-off-by: Daniele Palmas <dnlplm(a)gmail.com>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index ed8c62b2d9d1..739f8960811a 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1865,6 +1865,13 @@ static const struct usb_device_id acm_ids[] = {
.driver_info = IGNORE_DEVICE,
},
+ { USB_DEVICE(0x1bc7, 0x0021), /* Telit 3G ACM only composition */
+ .driver_info = SEND_ZERO_PACKET,
+ },
+ { USB_DEVICE(0x1bc7, 0x0023), /* Telit 3G ACM + ECM composition */
+ .driver_info = SEND_ZERO_PACKET,
+ },
+
/* control interfaces without any protocol set */
{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
USB_CDC_PROTO_NONE) },
--
2.20.1
stable-rc/linux-4.9.y build: 193 builds: 109 failed, 84 passed, 228 errors, 231 warnings (v4.9.148-71-g5799fa356b8c)
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.9.y/kernel/v4.9.148-71-…
Tree: stable-rc
Branch: linux-4.9.y
Git Describe: v4.9.148-71-g5799fa356b8c
Git Commit: 5799fa356b8c6c38d641457c783f2c19730d1d01
Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Built: 6 unique architectures
Build Failures Detected:
arc: arc-linux-gcc (ARCv2 ISA Linux uClibc toolchain 2017.09) 7.1.1 20170710
axs103_defconfig: FAIL
axs103_smp_defconfig: FAIL
vdk_hs38_defconfig: FAIL
vdk_hs38_smp_defconfig: FAIL
arm64: aarch64-linux-gnu-gcc (Debian 7.4.0-1) 7.4.0
defconfig: FAIL
arm: arm-linux-gnueabihf-gcc (Debian 7.4.0-1) 7.4.0
at91_dt_defconfig: FAIL
axm55xx_defconfig: FAIL
badge4_defconfig: FAIL
bcm2835_defconfig: FAIL
cerfcube_defconfig: FAIL
cm_x2xx_defconfig: FAIL
cm_x300_defconfig: FAIL
colibri_pxa300_defconfig: FAIL
davinci_all_defconfig: FAIL
dove_defconfig: FAIL
em_x270_defconfig: FAIL
ep93xx_defconfig: FAIL
eseries_pxa_defconfig: FAIL
exynos_defconfig: FAIL
ezx_defconfig: FAIL
hisi_defconfig: FAIL
imote2_defconfig: FAIL
imx_v4_v5_defconfig: FAIL
imx_v6_v7_defconfig: FAIL
iop13xx_defconfig: FAIL
iop32x_defconfig: FAIL
iop33x_defconfig: FAIL
ixp4xx_defconfig: FAIL
keystone_defconfig: FAIL
lart_defconfig: FAIL
mini2440_defconfig: FAIL
mmp2_defconfig: FAIL
moxart_defconfig: FAIL
multi_v5_defconfig: FAIL
multi_v7_defconfig: FAIL
mv78xx0_defconfig: FAIL
mvebu_v5_defconfig: FAIL
mvebu_v7_defconfig: FAIL
mxs_defconfig: FAIL
nhk8815_defconfig: FAIL
omap1_defconfig: FAIL
omap2plus_defconfig: FAIL
orion5x_defconfig: FAIL
palmz72_defconfig: FAIL
pcm027_defconfig: FAIL
pleb_defconfig: FAIL
pxa_defconfig: FAIL
qcom_defconfig: FAIL
raumfeld_defconfig: FAIL
rpc_defconfig: FAIL
s3c2410_defconfig: FAIL
s3c6400_defconfig: FAIL
sama5_defconfig: FAIL
simpad_defconfig: FAIL
socfpga_defconfig: FAIL
spear13xx_defconfig: FAIL
spear3xx_defconfig: FAIL
spear6xx_defconfig: FAIL
spitz_defconfig: FAIL
sunxi_defconfig: FAIL
tegra_defconfig: FAIL
trizeps4_defconfig: FAIL
u8500_defconfig: FAIL
vexpress_defconfig: FAIL
viper_defconfig: FAIL
vt8500_v6_v7_defconfig: FAIL
zeus_defconfig: FAIL
zx_defconfig: FAIL
mips: mips-linux-gcc (GCC) 6.3.0
bigsur_defconfig: FAIL
bmips_be_defconfig: FAIL
bmips_stb_defconfig: FAIL
capcella_defconfig: FAIL
cavium_octeon_defconfig: FAIL
cobalt_defconfig: FAIL
db1xxx_defconfig: FAIL
decstation_defconfig: FAIL
e55_defconfig: FAIL
fuloong2e_defconfig: FAIL
ip22_defconfig: FAIL
ip27_defconfig: FAIL
ip28_defconfig: FAIL
ip32_defconfig: FAIL
jazz_defconfig: FAIL
lasat_defconfig: FAIL
lemote2f_defconfig: FAIL
loongson1b_defconfig: FAIL
loongson1c_defconfig: FAIL
loongson3_defconfig: FAIL
malta_defconfig: FAIL
malta_kvm_defconfig: FAIL
malta_kvm_guest_defconfig: FAIL
malta_qemu_32r6_defconfig: FAIL
maltaaprp_defconfig: FAIL
maltasmvp_defconfig: FAIL
maltasmvp_eva_defconfig: FAIL
maltaup_defconfig: FAIL
maltaup_xpa_defconfig: FAIL
markeins_defconfig: FAIL
mips_paravirt_defconfig: FAIL
mtx1_defconfig: FAIL
nlm_xlp_defconfig: FAIL
nlm_xlr_defconfig: FAIL
pic32mzda_defconfig: FAIL
pistachio_defconfig: FAIL
qi_lb60_defconfig: FAIL
rm200_defconfig: FAIL
tb0219_defconfig: FAIL
tb0287_defconfig: FAIL
workpad_defconfig: FAIL
Errors and Warnings Detected:
arc: arc-linux-gcc (ARCv2 ISA Linux uClibc toolchain 2017.09) 7.1.1 20170710
allnoconfig: 5 warnings
axs103_defconfig: 2 errors, 19 warnings
axs103_smp_defconfig: 2 errors, 20 warnings
nsim_hs_smp_defconfig: 6 warnings
nsimosci_hs_defconfig: 8 warnings
nsimosci_hs_smp_defconfig: 9 warnings
tinyconfig: 6 warnings
vdk_hs38_defconfig: 2 errors, 20 warnings
vdk_hs38_smp_defconfig: 2 errors, 21 warnings
zebu_hs_defconfig: 5 warnings
zebu_hs_smp_defconfig: 6 warnings
arm64: aarch64-linux-gnu-gcc (Debian 7.4.0-1) 7.4.0
defconfig: 4 errors, 1 warning
arm: arm-linux-gnueabihf-gcc (Debian 7.4.0-1) 7.4.0
at91_dt_defconfig: 2 errors, 1 warning
axm55xx_defconfig: 2 errors, 1 warning
badge4_defconfig: 2 errors, 1 warning
bcm2835_defconfig: 2 errors, 1 warning
cerfcube_defconfig: 2 errors, 1 warning
cm_x2xx_defconfig: 2 errors, 1 warning
cm_x300_defconfig: 2 errors, 1 warning
colibri_pxa300_defconfig: 2 errors, 1 warning
davinci_all_defconfig: 2 errors, 1 warning
dove_defconfig: 2 errors, 1 warning
em_x270_defconfig: 2 errors, 1 warning
ep93xx_defconfig: 2 errors, 1 warning
eseries_pxa_defconfig: 2 errors, 1 warning
exynos_defconfig: 2 errors, 1 warning
ezx_defconfig: 2 errors, 1 warning
hisi_defconfig: 2 errors, 1 warning
imote2_defconfig: 2 errors, 1 warning
imx_v4_v5_defconfig: 2 errors, 1 warning
imx_v6_v7_defconfig: 2 errors, 1 warning
iop13xx_defconfig: 2 errors, 1 warning
iop32x_defconfig: 2 errors, 1 warning
iop33x_defconfig: 2 errors, 1 warning
ixp4xx_defconfig: 2 errors, 1 warning
keystone_defconfig: 2 errors, 1 warning
lart_defconfig: 2 errors, 1 warning
mini2440_defconfig: 2 errors, 1 warning
mmp2_defconfig: 2 errors, 1 warning
moxart_defconfig: 2 errors, 1 warning
multi_v5_defconfig: 2 errors, 1 warning
multi_v7_defconfig: 2 errors, 1 warning
mv78xx0_defconfig: 2 errors, 1 warning
mvebu_v5_defconfig: 2 errors, 1 warning
mvebu_v7_defconfig: 2 errors, 1 warning
mxs_defconfig: 2 errors, 1 warning
nhk8815_defconfig: 2 errors, 1 warning
omap1_defconfig: 2 errors, 1 warning
omap2plus_defconfig: 2 errors, 1 warning
orion5x_defconfig: 2 errors, 1 warning
palmz72_defconfig: 2 errors, 1 warning
pcm027_defconfig: 2 errors, 1 warning
pleb_defconfig: 2 errors, 1 warning
pxa_defconfig: 2 errors, 1 warning
qcom_defconfig: 2 errors, 1 warning
raumfeld_defconfig: 2 errors, 1 warning
rpc_defconfig: 2 errors, 1 warning
s3c2410_defconfig: 2 errors, 1 warning
s3c6400_defconfig: 2 errors, 1 warning
sama5_defconfig: 2 errors, 1 warning
simpad_defconfig: 2 errors, 1 warning
socfpga_defconfig: 2 errors, 1 warning
spear13xx_defconfig: 2 errors, 1 warning
spear3xx_defconfig: 2 errors, 1 warning
spear6xx_defconfig: 2 errors, 1 warning
spitz_defconfig: 2 errors, 1 warning
sunxi_defconfig: 2 errors, 1 warning
tegra_defconfig: 2 errors, 1 warning
trizeps4_defconfig: 2 errors, 1 warning
u8500_defconfig: 2 errors, 1 warning
vexpress_defconfig: 2 errors, 1 warning
viper_defconfig: 2 errors, 1 warning
vt8500_v6_v7_defconfig: 2 errors, 1 warning
zeus_defconfig: 2 errors, 1 warning
zx_defconfig: 2 errors, 1 warning
mips: mips-linux-gcc (GCC) 6.3.0
bigsur_defconfig: 2 errors, 1 warning
bmips_be_defconfig: 2 errors, 1 warning
bmips_stb_defconfig: 2 errors, 1 warning
capcella_defconfig: 2 errors, 1 warning
cavium_octeon_defconfig: 2 errors, 1 warning
cobalt_defconfig: 2 errors, 1 warning
db1xxx_defconfig: 2 errors, 1 warning
decstation_defconfig: 2 errors, 2 warnings
e55_defconfig: 2 errors, 1 warning
fuloong2e_defconfig: 2 errors, 1 warning
ip22_defconfig: 2 errors, 1 warning
ip27_defconfig: 4 errors, 1 warning
ip28_defconfig: 2 errors, 1 warning
ip32_defconfig: 2 errors, 1 warning
jazz_defconfig: 2 errors, 1 warning
lasat_defconfig: 2 errors, 1 warning
lemote2f_defconfig: 4 errors, 1 warning
loongson1b_defconfig: 2 errors, 1 warning
loongson1c_defconfig: 2 errors, 1 warning
loongson3_defconfig: 2 errors, 1 warning
malta_defconfig: 2 errors, 1 warning
malta_kvm_defconfig: 2 errors, 1 warning
malta_kvm_guest_defconfig: 2 errors, 1 warning
malta_qemu_32r6_defconfig: 2 errors, 1 warning
maltaaprp_defconfig: 2 errors, 1 warning
maltasmvp_defconfig: 2 errors, 1 warning
maltasmvp_eva_defconfig: 2 errors, 1 warning
maltaup_defconfig: 2 errors, 1 warning
maltaup_xpa_defconfig: 2 errors, 1 warning
markeins_defconfig: 2 errors, 1 warning
mips_paravirt_defconfig: 2 errors, 1 warning
mtx1_defconfig: 2 errors, 1 warning
nlm_xlp_defconfig: 4 errors, 1 warning
nlm_xlr_defconfig: 4 errors, 1 warning
pic32mzda_defconfig: 2 errors, 1 warning
pistachio_defconfig: 2 errors, 1 warning
qi_lb60_defconfig: 2 errors, 1 warning
rm200_defconfig: 2 errors, 1 warning
tb0219_defconfig: 2 errors, 1 warning
tb0287_defconfig: 2 errors, 1 warning
workpad_defconfig: 2 errors, 1 warning
Errors summary:
109 fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
68 fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
41 fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
5 fs/btrfs/tree-log.c:5563:11: error: 'struct inode' has no member named 'last_link_trans'
5 fs/btrfs/tree-log.c:5562:11: error: 'struct inode' has no member named 'vfs_inode'
Warnings summary:
109 cc1: some warnings being treated as errors
36 fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
12 arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
11 kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
11 include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
9 net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
9 net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
9 include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
7 warning: (ARC) selects HAVE_FUTEX_CMPXCHG which has unmet direct dependencies (FUTEX)
6 fs/posix_acl.c:34:1: warning: control reaches end of non-void function [-Wreturn-type]
5 lib/cpumask.c:211:1: warning: control reaches end of non-void function [-Wreturn-type]
4 block/cfq-iosched.c:3840:1: warning: control reaches end of non-void function [-Wreturn-type]
2 arch/arc/kernel/unwind.c:188:14: warning: 'unw_hdr_alloc' defined but not used [-Wunused-function]
1 drivers/net/ethernet/amd/declance.c:1231:2: warning: 'desc' may be used uninitialized in this function [-Wmaybe-uninitialized]
================================================================================
Detailed per-defconfig build reports:
--------------------------------------------------------------------------------
acs5k_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
acs5k_tiny_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
allnoconfig (x86_64) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
allnoconfig (i386) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
allnoconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
allnoconfig (arm64) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
allnoconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
allnoconfig (arc) — PASS, 0 errors, 5 warnings, 0 section mismatches
Warnings:
warning: (ARC) selects HAVE_FUTEX_CMPXCHG which has unmet direct dependencies (FUTEX)
warning: (ARC) selects HAVE_FUTEX_CMPXCHG which has unmet direct dependencies (FUTEX)
warning: (ARC) selects HAVE_FUTEX_CMPXCHG which has unmet direct dependencies (FUTEX)
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
--------------------------------------------------------------------------------
am200epdkit_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
ar7_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
aspeed_g4_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
aspeed_g5_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
assabet_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
at91_dt_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ath25_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
ath79_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
axm55xx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
axs103_defconfig (arc) — FAIL, 2 errors, 19 warnings, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
cc1: some warnings being treated as errors
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
block/cfq-iosched.c:3840:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
fs/posix_acl.c:34:1: warning: control reaches end of non-void function [-Wreturn-type]
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
axs103_smp_defconfig (arc) — FAIL, 2 errors, 20 warnings, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
cc1: some warnings being treated as errors
block/cfq-iosched.c:3840:1: warning: control reaches end of non-void function [-Wreturn-type]
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
lib/cpumask.c:211:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
fs/posix_acl.c:34:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
badge4_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
bcm2835_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
bcm47xx_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
bcm63xx_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
bigsur_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
bmips_be_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
bmips_stb_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
capcella_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
cavium_octeon_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
cerfcube_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ci20_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
clps711x_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
cm_x2xx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
cm_x300_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
cns3420vb_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
cobalt_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
colibri_pxa270_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
colibri_pxa300_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
collie_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
corgi_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
davinci_all_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
db1xxx_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
decstation_defconfig (mips) — FAIL, 2 errors, 2 warnings, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
drivers/net/ethernet/amd/declance.c:1231:2: warning: 'desc' may be used uninitialized in this function [-Wmaybe-uninitialized]
--------------------------------------------------------------------------------
defconfig (arm64) — FAIL, 4 errors, 1 warning, 0 section mismatches
Errors:
fs/btrfs/tree-log.c:5562:11: error: 'struct inode' has no member named 'vfs_inode'
fs/btrfs/tree-log.c:5563:11: error: 'struct inode' has no member named 'last_link_trans'
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
dove_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
e55_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ebsa110_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
efm32_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
em_x270_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ep93xx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
eseries_pxa_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
exynos_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ezx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
footbridge_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
fuloong2e_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
gpr_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
h3600_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
h5000_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
hackkit_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
hisi_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
imote2_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
imx_v4_v5_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
imx_v6_v7_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
integrator_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
iop13xx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
iop32x_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
iop33x_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ip22_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ip27_defconfig (mips) — FAIL, 4 errors, 1 warning, 0 section mismatches
Errors:
fs/btrfs/tree-log.c:5562:11: error: 'struct inode' has no member named 'vfs_inode'
fs/btrfs/tree-log.c:5563:11: error: 'struct inode' has no member named 'last_link_trans'
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ip28_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ip32_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ixp4xx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
jazz_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
jmr3927_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
jornada720_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
keystone_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ks8695_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
lart_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
lasat_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
lemote2f_defconfig (mips) — FAIL, 4 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
fs/btrfs/tree-log.c:5562:11: error: 'struct inode' has no member named 'vfs_inode'
fs/btrfs/tree-log.c:5563:11: error: 'struct inode' has no member named 'last_link_trans'
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
loongson1b_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
loongson1c_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
loongson3_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
lpc18xx_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
lpc32xx_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
lpd270_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
lubbock_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
magician_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
mainstone_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
malta_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
malta_kvm_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
malta_kvm_guest_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
malta_qemu_32r6_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
maltaaprp_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
maltasmvp_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
maltasmvp_eva_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
maltaup_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
maltaup_xpa_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
markeins_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
mini2440_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
mips_paravirt_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
mmp2_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
moxart_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
mpc30x_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
mps2_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
msp71xx_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
mtx1_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
multi_v4t_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
multi_v5_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
multi_v7_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
mv78xx0_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
mvebu_v5_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
mvebu_v7_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
mxs_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
neponset_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
netwinder_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
netx_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
nhk8815_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
nlm_xlp_defconfig (mips) — FAIL, 4 errors, 1 warning, 0 section mismatches
Errors:
fs/btrfs/tree-log.c:5562:11: error: 'struct inode' has no member named 'vfs_inode'
fs/btrfs/tree-log.c:5563:11: error: 'struct inode' has no member named 'last_link_trans'
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
nlm_xlr_defconfig (mips) — FAIL, 4 errors, 1 warning, 0 section mismatches
Errors:
fs/btrfs/tree-log.c:5562:11: error: 'struct inode' has no member named 'vfs_inode'
fs/btrfs/tree-log.c:5563:11: error: 'struct inode' has no member named 'last_link_trans'
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
nsim_hs_smp_defconfig (arc) — PASS, 0 errors, 6 warnings, 0 section mismatches
Warnings:
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
lib/cpumask.c:211:1: warning: control reaches end of non-void function [-Wreturn-type]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
nsimosci_hs_defconfig (arc) — PASS, 0 errors, 8 warnings, 0 section mismatches
Warnings:
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
fs/posix_acl.c:34:1: warning: control reaches end of non-void function [-Wreturn-type]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
nsimosci_hs_smp_defconfig (arc) — PASS, 0 errors, 9 warnings, 0 section mismatches
Warnings:
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
fs/posix_acl.c:34:1: warning: control reaches end of non-void function [-Wreturn-type]
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
lib/cpumask.c:211:1: warning: control reaches end of non-void function [-Wreturn-type]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
nuc910_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
nuc950_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
nuc960_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
omap1_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
omap2plus_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
orion5x_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
palmz72_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
pcm027_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
pic32mzda_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
pistachio_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
pleb_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
pnx8335_stb225_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
prima2_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
pxa168_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
pxa255-idp_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
pxa3xx_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
pxa910_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
pxa_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
qcom_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
qi_lb60_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
raumfeld_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
rb532_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
rbtx49xx_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
realview_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
rm200_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
rpc_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
rt305x_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
s3c2410_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
s3c6400_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
s5pv210_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
sama5_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
sb1250_swarm_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
shannon_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
shmobile_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
simpad_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
socfpga_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
spear13xx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
spear3xx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
spear6xx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
spitz_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
stm32_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
sunxi_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
tb0219_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
tb0226_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
tb0287_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
tct_hammer_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
tegra_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
tinyconfig (arm64) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
tinyconfig (i386) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
tinyconfig (x86_64) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
tinyconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
tinyconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
tinyconfig (arc) — PASS, 0 errors, 6 warnings, 0 section mismatches
Warnings:
warning: (ARC) selects HAVE_FUTEX_CMPXCHG which has unmet direct dependencies (FUTEX)
warning: (ARC) selects HAVE_FUTEX_CMPXCHG which has unmet direct dependencies (FUTEX)
warning: (ARC) selects HAVE_FUTEX_CMPXCHG which has unmet direct dependencies (FUTEX)
warning: (ARC) selects HAVE_FUTEX_CMPXCHG which has unmet direct dependencies (FUTEX)
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
--------------------------------------------------------------------------------
trizeps4_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
u300_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
u8500_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
vdk_hs38_defconfig (arc) — FAIL, 2 errors, 20 warnings, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
arch/arc/kernel/unwind.c:188:14: warning: 'unw_hdr_alloc' defined but not used [-Wunused-function]
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
block/cfq-iosched.c:3840:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
cc1: some warnings being treated as errors
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
fs/posix_acl.c:34:1: warning: control reaches end of non-void function [-Wreturn-type]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
vdk_hs38_smp_defconfig (arc) — FAIL, 2 errors, 21 warnings, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
arch/arc/kernel/unwind.c:188:14: warning: 'unw_hdr_alloc' defined but not used [-Wunused-function]
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
cc1: some warnings being treated as errors
block/cfq-iosched.c:3840:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
lib/cpumask.c:211:1: warning: control reaches end of non-void function [-Wreturn-type]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
fs/posix_acl.c:34:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
versatile_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
vexpress_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
vf610m4_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
viper_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
vt8500_v6_v7_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
workpad_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
xcep_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
xilfpga_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
xway_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
zebu_hs_defconfig (arc) — PASS, 0 errors, 5 warnings, 0 section mismatches
Warnings:
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
zebu_hs_smp_defconfig (arc) — PASS, 0 errors, 6 warnings, 0 section mismatches
Warnings:
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
lib/cpumask.c:211:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
zeus_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
zx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
---
For more info write to <info(a)kernelci.org>
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 41bd60676923822de1df2c50b3f9a10171f4338a Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Wed, 28 Nov 2018 14:54:28 +0000
Subject: [PATCH] Btrfs: fix fsync of files with multiple hard links in new
directories
The log tree has a long standing problem that when a file is fsync'ed we
only check for new ancestors, created in the current transaction, by
following only the hard link for which the fsync was issued. We follow the
ancestors using the VFS' dget_parent() API. This means that if we create a
new link for a file in a directory that is new (or in an any other new
ancestor directory) and then fsync the file using an old hard link, we end
up not logging the new ancestor, and on log replay that new hard link and
ancestor do not exist. In some cases, involving renames, the file will not
exist at all.
Example:
mkfs.btrfs -f /dev/sdb
mount /dev/sdb /mnt
mkdir /mnt/A
touch /mnt/foo
ln /mnt/foo /mnt/A/bar
xfs_io -c fsync /mnt/foo
<power failure>
In this example after log replay only the hard link named 'foo' exists
and directory A does not exist, which is unexpected. In other major linux
filesystems, such as ext4, xfs and f2fs for example, both hard links exist
and so does directory A after mounting again the filesystem.
Checking if any new ancestors are new and need to be logged was added in
2009 by commit 12fcfd22fe5b ("Btrfs: tree logging unlink/rename fixes"),
however only for the ancestors of the hard link (dentry) for which the
fsync was issued, instead of checking for all ancestors for all of the
inode's hard links.
So fix this by tracking the id of the last transaction where a hard link
was created for an inode and then on fsync fallback to a full transaction
commit when an inode has more than one hard link and at least one new hard
link was created in the current transaction. This is the simplest solution
since this is not a common use case (adding frequently hard links for
which there's an ancestor created in the current transaction and then
fsync the file). In case it ever becomes a common use case, a solution
that consists of iterating the fs/subvol btree for each hard link and
check if any ancestor is new, could be implemented.
This solves many unexpected scenarios reported by Jayashree Mohan and
Vijay Chidambaram, and for which there is a new test case for fstests
under review.
Fixes: 12fcfd22fe5b ("Btrfs: tree logging unlink/rename fixes")
CC: stable(a)vger.kernel.org # 4.4+
Reported-by: Vijay Chidambaram <vvijay03(a)gmail.com>
Reported-by: Jayashree Mohan <jayashree2912(a)gmail.com>
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
index fc25607304f2..6f5d07415dab 100644
--- a/fs/btrfs/btrfs_inode.h
+++ b/fs/btrfs/btrfs_inode.h
@@ -147,6 +147,12 @@ struct btrfs_inode {
*/
u64 last_unlink_trans;
+ /*
+ * Track the transaction id of the last transaction used to create a
+ * hard link for the inode. This is used by the log tree (fsync).
+ */
+ u64 last_link_trans;
+
/*
* Number of bytes outstanding that are going to need csums. This is
* used in ENOSPC accounting.
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index d54bdef16d8d..b4129d9072ec 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3658,6 +3658,21 @@ static int btrfs_read_locked_inode(struct inode *inode,
* inode is not a directory, logging its parent unnecessarily.
*/
BTRFS_I(inode)->last_unlink_trans = BTRFS_I(inode)->last_trans;
+ /*
+ * Similar reasoning for last_link_trans, needs to be set otherwise
+ * for a case like the following:
+ *
+ * mkdir A
+ * touch foo
+ * ln foo A/bar
+ * echo 2 > /proc/sys/vm/drop_caches
+ * fsync foo
+ * <power failure>
+ *
+ * Would result in link bar and directory A not existing after the power
+ * failure.
+ */
+ BTRFS_I(inode)->last_link_trans = BTRFS_I(inode)->last_trans;
path->slots[0]++;
if (inode->i_nlink != 1 ||
@@ -6597,6 +6612,7 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
if (err)
goto fail;
}
+ BTRFS_I(inode)->last_link_trans = trans->transid;
d_instantiate(dentry, inode);
ret = btrfs_log_new_name(trans, BTRFS_I(inode), NULL, parent,
true, NULL);
@@ -9123,6 +9139,7 @@ struct inode *btrfs_alloc_inode(struct super_block *sb)
ei->index_cnt = (u64)-1;
ei->dir_index = 0;
ei->last_unlink_trans = 0;
+ ei->last_link_trans = 0;
ei->last_log_commit = 0;
spin_lock_init(&ei->lock);
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 013d0abcd46b..5baad9bebc62 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -5758,6 +5758,22 @@ static int btrfs_log_inode_parent(struct btrfs_trans_handle *trans,
goto end_trans;
}
+ /*
+ * If a new hard link was added to the inode in the current transaction
+ * and its link count is now greater than 1, we need to fallback to a
+ * transaction commit, otherwise we can end up not logging all its new
+ * parents for all the hard links. Here just from the dentry used to
+ * fsync, we can not visit the ancestor inodes for all the other hard
+ * links to figure out if any is new, so we fallback to a transaction
+ * commit (instead of adding a lot of complexity of scanning a btree,
+ * since this scenario is not a common use case).
+ */
+ if (inode->vfs_inode.i_nlink > 1 &&
+ inode->last_link_trans > last_committed) {
+ ret = -EMLINK;
+ goto end_trans;
+ }
+
while (1) {
if (!parent || d_really_is_negative(parent) || sb != parent->d_sb)
break;
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 18f2c4fcebf2582f96cbd5f2238f4f354a0e4847 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso(a)mit.edu>
Date: Wed, 19 Dec 2018 14:36:58 -0500
Subject: [PATCH] ext4: check for shutdown and r/o file system in
ext4_write_inode()
If the file system has been shut down or is read-only, then
ext4_write_inode() needs to bail out early.
Also use jbd2_complete_transaction() instead of ext4_force_commit() so
we only force a commit if it is needed.
Signed-off-by: Theodore Ts'o <tytso(a)mit.edu>
Cc: stable(a)kernel.org
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 664b434ba836..9affabd07682 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5400,9 +5400,13 @@ int ext4_write_inode(struct inode *inode, struct writeback_control *wbc)
{
int err;
- if (WARN_ON_ONCE(current->flags & PF_MEMALLOC))
+ if (WARN_ON_ONCE(current->flags & PF_MEMALLOC) ||
+ sb_rdonly(inode->i_sb))
return 0;
+ if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb))))
+ return -EIO;
+
if (EXT4_SB(inode->i_sb)->s_journal) {
if (ext4_journal_current_handle()) {
jbd_debug(1, "called recursively, non-PF_MEMALLOC!\n");
@@ -5418,7 +5422,8 @@ int ext4_write_inode(struct inode *inode, struct writeback_control *wbc)
if (wbc->sync_mode != WB_SYNC_ALL || wbc->for_sync)
return 0;
- err = ext4_force_commit(inode->i_sb);
+ err = jbd2_complete_transaction(EXT4_SB(inode->i_sb)->s_journal,
+ EXT4_I(inode)->i_sync_tid);
} else {
struct ext4_iloc iloc;
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 18f2c4fcebf2582f96cbd5f2238f4f354a0e4847 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso(a)mit.edu>
Date: Wed, 19 Dec 2018 14:36:58 -0500
Subject: [PATCH] ext4: check for shutdown and r/o file system in
ext4_write_inode()
If the file system has been shut down or is read-only, then
ext4_write_inode() needs to bail out early.
Also use jbd2_complete_transaction() instead of ext4_force_commit() so
we only force a commit if it is needed.
Signed-off-by: Theodore Ts'o <tytso(a)mit.edu>
Cc: stable(a)kernel.org
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 664b434ba836..9affabd07682 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5400,9 +5400,13 @@ int ext4_write_inode(struct inode *inode, struct writeback_control *wbc)
{
int err;
- if (WARN_ON_ONCE(current->flags & PF_MEMALLOC))
+ if (WARN_ON_ONCE(current->flags & PF_MEMALLOC) ||
+ sb_rdonly(inode->i_sb))
return 0;
+ if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb))))
+ return -EIO;
+
if (EXT4_SB(inode->i_sb)->s_journal) {
if (ext4_journal_current_handle()) {
jbd_debug(1, "called recursively, non-PF_MEMALLOC!\n");
@@ -5418,7 +5422,8 @@ int ext4_write_inode(struct inode *inode, struct writeback_control *wbc)
if (wbc->sync_mode != WB_SYNC_ALL || wbc->for_sync)
return 0;
- err = ext4_force_commit(inode->i_sb);
+ err = jbd2_complete_transaction(EXT4_SB(inode->i_sb)->s_journal,
+ EXT4_I(inode)->i_sync_tid);
} else {
struct ext4_iloc iloc;
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 0568e82dbe2510fc1fa664f58e5c997d3f1e649e Mon Sep 17 00:00:00 2001
From: Josef Bacik <jbacik(a)fb.com>
Date: Fri, 30 Nov 2018 11:52:14 -0500
Subject: [PATCH] btrfs: run delayed items before dropping the snapshot
With my delayed refs patches in place we started seeing a large amount
of aborts in __btrfs_free_extent:
BTRFS error (device sdb1): unable to find ref byte nr 91947008 parent 0 root 35964 owner 1 offset 0
Call Trace:
? btrfs_merge_delayed_refs+0xaf/0x340
__btrfs_run_delayed_refs+0x6ea/0xfc0
? btrfs_set_path_blocking+0x31/0x60
btrfs_run_delayed_refs+0xeb/0x180
btrfs_commit_transaction+0x179/0x7f0
? btrfs_check_space_for_delayed_refs+0x30/0x50
? should_end_transaction.isra.19+0xe/0x40
btrfs_drop_snapshot+0x41c/0x7c0
btrfs_clean_one_deleted_snapshot+0xb5/0xd0
cleaner_kthread+0xf6/0x120
kthread+0xf8/0x130
? btree_invalidatepage+0x90/0x90
? kthread_bind+0x10/0x10
ret_from_fork+0x35/0x40
This was because btrfs_drop_snapshot depends on the root not being
modified while it's dropping the snapshot. It will unlock the root node
(and really every node) as it walks down the tree, only to re-lock it
when it needs to do something. This is a problem because if we modify
the tree we could cow a block in our path, which frees our reference to
that block. Then once we get back to that shared block we'll free our
reference to it again, and get ENOENT when trying to lookup our extent
reference to that block in __btrfs_free_extent.
This is ultimately happening because we have delayed items left to be
processed for our deleted snapshot _after_ all of the inodes are closed
for the snapshot. We only run the delayed inode item if we're deleting
the inode, and even then we do not run the delayed insertions or delayed
removals. These can be run at any point after our final inode does its
last iput, which is what triggers the snapshot deletion. We can end up
with the snapshot deletion happening and then have the delayed items run
on that file system, resulting in the above problem.
This problem has existed forever, however my patches made it much easier
to hit as I wake up the cleaner much more often to deal with delayed
iputs, which made us more likely to start the snapshot dropping work
before the transaction commits, which is when the delayed items would
generally be run. Before, generally speaking, we would run the delayed
items, commit the transaction, and wakeup the cleaner thread to start
deleting snapshots, which means we were less likely to hit this problem.
You could still hit it if you had multiple snapshots to be deleted and
ended up with lots of delayed items, but it was definitely harder.
Fix for now by simply running all the delayed items before starting to
drop the snapshot. We could make this smarter in the future by making
the delayed items per-root, and then simply drop any delayed items for
roots that we are going to delete. But for now just a quick and easy
solution is the safest.
CC: stable(a)vger.kernel.org # 4.4+
Reviewed-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: Josef Bacik <josef(a)toxicpanda.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index de21e0c93eb6..8a9ce33dfdbc 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -9272,6 +9272,10 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
goto out_free;
}
+ err = btrfs_run_delayed_items(trans);
+ if (err)
+ goto out_end_trans;
+
if (block_rsv)
trans->block_rsv = block_rsv;
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 0568e82dbe2510fc1fa664f58e5c997d3f1e649e Mon Sep 17 00:00:00 2001
From: Josef Bacik <jbacik(a)fb.com>
Date: Fri, 30 Nov 2018 11:52:14 -0500
Subject: [PATCH] btrfs: run delayed items before dropping the snapshot
With my delayed refs patches in place we started seeing a large amount
of aborts in __btrfs_free_extent:
BTRFS error (device sdb1): unable to find ref byte nr 91947008 parent 0 root 35964 owner 1 offset 0
Call Trace:
? btrfs_merge_delayed_refs+0xaf/0x340
__btrfs_run_delayed_refs+0x6ea/0xfc0
? btrfs_set_path_blocking+0x31/0x60
btrfs_run_delayed_refs+0xeb/0x180
btrfs_commit_transaction+0x179/0x7f0
? btrfs_check_space_for_delayed_refs+0x30/0x50
? should_end_transaction.isra.19+0xe/0x40
btrfs_drop_snapshot+0x41c/0x7c0
btrfs_clean_one_deleted_snapshot+0xb5/0xd0
cleaner_kthread+0xf6/0x120
kthread+0xf8/0x130
? btree_invalidatepage+0x90/0x90
? kthread_bind+0x10/0x10
ret_from_fork+0x35/0x40
This was because btrfs_drop_snapshot depends on the root not being
modified while it's dropping the snapshot. It will unlock the root node
(and really every node) as it walks down the tree, only to re-lock it
when it needs to do something. This is a problem because if we modify
the tree we could cow a block in our path, which frees our reference to
that block. Then once we get back to that shared block we'll free our
reference to it again, and get ENOENT when trying to lookup our extent
reference to that block in __btrfs_free_extent.
This is ultimately happening because we have delayed items left to be
processed for our deleted snapshot _after_ all of the inodes are closed
for the snapshot. We only run the delayed inode item if we're deleting
the inode, and even then we do not run the delayed insertions or delayed
removals. These can be run at any point after our final inode does its
last iput, which is what triggers the snapshot deletion. We can end up
with the snapshot deletion happening and then have the delayed items run
on that file system, resulting in the above problem.
This problem has existed forever, however my patches made it much easier
to hit as I wake up the cleaner much more often to deal with delayed
iputs, which made us more likely to start the snapshot dropping work
before the transaction commits, which is when the delayed items would
generally be run. Before, generally speaking, we would run the delayed
items, commit the transaction, and wakeup the cleaner thread to start
deleting snapshots, which means we were less likely to hit this problem.
You could still hit it if you had multiple snapshots to be deleted and
ended up with lots of delayed items, but it was definitely harder.
Fix for now by simply running all the delayed items before starting to
drop the snapshot. We could make this smarter in the future by making
the delayed items per-root, and then simply drop any delayed items for
roots that we are going to delete. But for now just a quick and easy
solution is the safest.
CC: stable(a)vger.kernel.org # 4.4+
Reviewed-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: Josef Bacik <josef(a)toxicpanda.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index de21e0c93eb6..8a9ce33dfdbc 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -9272,6 +9272,10 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
goto out_free;
}
+ err = btrfs_run_delayed_items(trans);
+ if (err)
+ goto out_end_trans;
+
if (block_rsv)
trans->block_rsv = block_rsv;
In commit 1a0c10ed7b media: dvb-usb-v2: stop using coherent memory for URBs
incorrectly adds URB_FREE_BUFFER after every urb transfer.
It cannot use this flag because it reconfigures the URBs accordingly
to suit connected devices. In doing a call to usb_free_urb is made and
invertedly frees the buffers.
The stream buffer should remain constant while driver is up.
Signed-off-by: Malcolm Priestley <tvboxspy(a)gmail.com>
CC: stable(a)vger.kernel.org # v4.18+
---
v3 change commit message to the actual cause
drivers/media/usb/dvb-usb-v2/usb_urb.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/media/usb/dvb-usb-v2/usb_urb.c b/drivers/media/usb/dvb-usb-v2/usb_urb.c
index 024c751eb165..2ad2ddeaff51 100644
--- a/drivers/media/usb/dvb-usb-v2/usb_urb.c
+++ b/drivers/media/usb/dvb-usb-v2/usb_urb.c
@@ -155,7 +155,6 @@ static int usb_urb_alloc_bulk_urbs(struct usb_data_stream *stream)
stream->props.u.bulk.buffersize,
usb_urb_complete, stream);
- stream->urb_list[i]->transfer_flags = URB_FREE_BUFFER;
stream->urbs_initialized++;
}
return 0;
@@ -186,7 +185,7 @@ static int usb_urb_alloc_isoc_urbs(struct usb_data_stream *stream)
urb->complete = usb_urb_complete;
urb->pipe = usb_rcvisocpipe(stream->udev,
stream->props.endpoint);
- urb->transfer_flags = URB_ISO_ASAP | URB_FREE_BUFFER;
+ urb->transfer_flags = URB_ISO_ASAP;
urb->interval = stream->props.u.isoc.interval;
urb->number_of_packets = stream->props.u.isoc.framesperurb;
urb->transfer_buffer_length = stream->props.u.isoc.framesize *
@@ -210,7 +209,7 @@ static int usb_free_stream_buffers(struct usb_data_stream *stream)
if (stream->state & USB_STATE_URB_BUF) {
while (stream->buf_num) {
stream->buf_num--;
- stream->buf_list[stream->buf_num] = NULL;
+ kfree(stream->buf_list[stream->buf_num]);
}
}
--
2.19.1
This is a note to let you know that I've just added the patch titled
staging: rtl8188eu: Fix module loading from tasklet for WEP
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 7775665aadc48a562051834a73519129bf717d73 Mon Sep 17 00:00:00 2001
From: Larry Finger <Larry.Finger(a)lwfinger.net>
Date: Wed, 2 Jan 2019 20:12:47 -0600
Subject: staging: rtl8188eu: Fix module loading from tasklet for WEP
encryption
Commit 2b2ea09e74a5 ("staging:r8188eu: Use lib80211 to decrypt WEP-frames")
causes scheduling while atomic bugs followed by a hard freeze whenever
the driver tries to connect to a WEP-encrypted network. Experimentation
showed that the freezes were eliminated when module lib80211 was
preloaded, which can be forced by calling lib80211_get_crypto_ops()
directly rather than indirectly through try_then_request_module().
With this change, no BUG messages are logged.
Fixes: 2b2ea09e74a5 ("staging:r8188eu: Use lib80211 to decrypt WEP-frames")
Cc: Stable <stable(a)vger.kernel.org> # v4.17+
Cc: Michael Straube <straube.linux(a)gmail.com>
Cc: Ivan Safonov <insafonov(a)gmail.com>
Signed-off-by: Larry Finger <Larry.Finger(a)lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/rtl8188eu/core/rtw_security.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/rtl8188eu/core/rtw_security.c b/drivers/staging/rtl8188eu/core/rtw_security.c
index dbb84e00077f..2f90f60f1681 100644
--- a/drivers/staging/rtl8188eu/core/rtw_security.c
+++ b/drivers/staging/rtl8188eu/core/rtw_security.c
@@ -154,7 +154,7 @@ void rtw_wep_encrypt(struct adapter *padapter, u8 *pxmitframe)
pframe = ((struct xmit_frame *)pxmitframe)->buf_addr + hw_hdr_offset;
- crypto_ops = try_then_request_module(lib80211_get_crypto_ops("WEP"), "lib80211_crypt_wep");
+ crypto_ops = lib80211_get_crypto_ops("WEP");
if (!crypto_ops)
return;
@@ -210,7 +210,7 @@ int rtw_wep_decrypt(struct adapter *padapter, u8 *precvframe)
void *crypto_private = NULL;
int status = _SUCCESS;
const int keyindex = prxattrib->key_index;
- struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("WEP"), "lib80211_crypt_wep");
+ struct lib80211_crypto_ops *crypto_ops = lib80211_get_crypto_ops("WEP");
char iv[4], icv[4];
if (!crypto_ops) {
--
2.20.1
This is a note to let you know that I've just added the patch titled
staging: rtl8188eu: Fix module loading from tasklet for CCMP
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 84cad97a717f5749a0236abd5ce68da582ea074f Mon Sep 17 00:00:00 2001
From: Larry Finger <Larry.Finger(a)lwfinger.net>
Date: Wed, 2 Jan 2019 20:12:46 -0600
Subject: staging: rtl8188eu: Fix module loading from tasklet for CCMP
encryption
Commit 6bd082af7e36 ("staging:r8188eu: use lib80211 CCMP decrypt")
causes scheduling while atomic bugs followed by a hard freeze whenever
the driver tries to connect to a CCMP-encrypted network. Experimentation
showed that the freezes were eliminated when module lib80211 was
preloaded, which can be forced by calling lib80211_get_crypto_ops()
directly rather than indirectly through try_then_request_module().
With this change, no BUG messages are logged.
Fixes: 6bd082af7e36 ("staging:r8188eu: use lib80211 CCMP decrypt")
Cc: Stable <stable(a)vger.kernel.org> # v4.17+
Reported-and-tested-by: Michael Straube <straube.linux(a)gmail.com>
Cc: Ivan Safonov <insafonov(a)gmail.com>
Signed-off-by: Larry Finger <Larry.Finger(a)lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/rtl8188eu/core/rtw_security.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8188eu/core/rtw_security.c b/drivers/staging/rtl8188eu/core/rtw_security.c
index 364d6ea14bf8..dbb84e00077f 100644
--- a/drivers/staging/rtl8188eu/core/rtw_security.c
+++ b/drivers/staging/rtl8188eu/core/rtw_security.c
@@ -1291,7 +1291,7 @@ u32 rtw_aes_decrypt(struct adapter *padapter, u8 *precvframe)
struct sk_buff *skb = ((struct recv_frame *)precvframe)->pkt;
void *crypto_private = NULL;
u8 *key, *pframe = skb->data;
- struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("CCMP"), "lib80211_crypt_ccmp");
+ struct lib80211_crypto_ops *crypto_ops = lib80211_get_crypto_ops("CCMP");
struct security_priv *psecuritypriv = &padapter->securitypriv;
char iv[8], icv[8];
--
2.20.1
Originally, cns3xxx used it's own functions for mapping, reading and writing registers.
Commit 802b7c06adc7 ("ARM: cns3xxx: Convert PCI to use generic config accessors")
removed the internal PCI config write function in favor of the generic one:
cns3xxx_pci_write_config() --> pci_generic_config_write()
cns3xxx_pci_write_config() expected aligned addresses, being produced by cns3xxx_pci_map_bus()
while the generic one pci_generic_config_write() actually expects the real address
as both the function and hardware are capable of byte-aligned writes.
This currently leads to pci_generic_config_write() writing
to the wrong registers on some ocasions.
First issue seen due to this:
- driver ath9k gets loaded
- The driver wants to write value 0xA8 to register PCI_LATENCY_TIMER, located at 0x0D
- cns3xxx_pci_map_bus() aligns the address to 0x0C
- pci_generic_config_write() effectively writes 0xA8 into register 0x0C (CACHE_LINE_SIZE)
This seems to cause some slight instability when certain PCI devices are used.
Another issue example caused by this this is the PCI bus numbering,
where the primary bus is higher than the secondary, which is impossible.
Before:
00:00.0 PCI bridge: Cavium, Inc. Device 3400 (rev 01) (prog-if 00 [Normal decode])
Flags: bus master, fast devsel, latency 0, IRQ 255
Bus: primary=02, secondary=01, subordinate=ff, sec-latency=0
After fix:
00:00.0 PCI bridge: Cavium, Inc. Device 3400 (rev 01) (prog-if 00 [Normal decode])
Flags: bus master, fast devsel, latency 0, IRQ 255
Bus: primary=00, secondary=01, subordinate=02, sec-latency=0
And very likely some more ..
Fix all by omitting the alignment being done in the mapping function.
Fixes: 802b7c06adc7 ("ARM: cns3xxx: Convert PCI to use generic config accessors")
Signed-off-by: Koen Vandeputte <koen.vandeputte(a)ncentric.com>
CC: Arnd Bergmann <arnd(a)arndb.de>
CC: Bjorn Helgaas <bhelgaas(a)google.com>
CC: Krzysztof Halasa <khalasa(a)piap.pl>
CC: Olof Johansson <olof(a)lixom.net>
CC: Robin Leblon <robin.leblon(a)ncentric.com>
CC: Rob Herring <robh(a)kernel.org>
CC: Russell King <linux(a)armlinux.org.uk>
CC: Tim Harvey <tharvey(a)gateworks.com>
CC: stable(a)vger.kernel.org # v4.0+
---
arch/arm/mach-cns3xxx/pcie.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/mach-cns3xxx/pcie.c b/arch/arm/mach-cns3xxx/pcie.c
index 318394ed5c7a..5e11ad3164e0 100644
--- a/arch/arm/mach-cns3xxx/pcie.c
+++ b/arch/arm/mach-cns3xxx/pcie.c
@@ -83,7 +83,7 @@ static void __iomem *cns3xxx_pci_map_bus(struct pci_bus *bus,
} else /* remote PCI bus */
base = cnspci->cfg1_regs + ((busno & 0xf) << 20);
- return base + (where & 0xffc) + (devfn << 12);
+ return base + where + (devfn << 12);
}
static int cns3xxx_pci_read_config(struct pci_bus *bus, unsigned int devfn,
--
2.17.1
From: Oliver Hartkopp <socketcan(a)hartkopp.net>
Muyu Yu provided a POC where user root with CAP_NET_ADMIN can create a CAN
frame modification rule that makes the data length code a higher value than
the available CAN frame data size. In combination with a configured checksum
calculation where the result is stored relatively to the end of the data
(e.g. cgw_csum_xor_rel) the tail of the skb (e.g. frag_list pointer in
skb_shared_info) can be rewritten which finally can cause a system crash.
Michael Kubecek suggested to drop frames that have a DLC exceeding the
available space after the modification process and provided a patch that can
handle CAN FD frames too. Within this patch we also limit the length for the
checksum calculations to the maximum of Classic CAN data length (8).
CAN frames that are dropped by these additional checks are counted with the
CGW_DELETED counter which indicates misconfigurations in can-gw rules.
This fixes CVE-2019-3701.
Reported-by: Muyu Yu <ieatmuttonchuan(a)gmail.com>
Reported-by: Marcus Meissner <meissner(a)suse.de>
Suggested-by: Michal Kubecek <mkubecek(a)suse.cz>
Tested-by: Muyu Yu <ieatmuttonchuan(a)gmail.com>
Tested-by: Oliver Hartkopp <socketcan(a)hartkopp.net>
Signed-off-by: Oliver Hartkopp <socketcan(a)hartkopp.net>
Cc: linux-stable <stable(a)vger.kernel.org> # >= v3.2
Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de>
---
Hello,
I've removed the else from dlc length check. Keeps the code and the
patch more readable.
Marc
Changes since v2:
- add newline after goto (Tnx, Oliver)
Changes since v1:
- remove else from dlc length check.
net/can/gw.c | 30 +++++++++++++++++++++++++++---
1 file changed, 27 insertions(+), 3 deletions(-)
diff --git a/net/can/gw.c b/net/can/gw.c
index faa3da88a127..53859346dc9a 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -416,13 +416,29 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data)
while (modidx < MAX_MODFUNCTIONS && gwj->mod.modfunc[modidx])
(*gwj->mod.modfunc[modidx++])(cf, &gwj->mod);
- /* check for checksum updates when the CAN frame has been modified */
+ /* Has the CAN frame been modified? */
if (modidx) {
- if (gwj->mod.csumfunc.crc8)
+ /* get available space for the processed CAN frame type */
+ int max_len = nskb->len - offsetof(struct can_frame, data);
+
+ /* dlc may have changed, make sure it fits to the CAN frame */
+ if (cf->can_dlc > max_len)
+ goto out_delete;
+
+ /* check for checksum updates in classic CAN length only */
+ if (gwj->mod.csumfunc.crc8) {
+ if (cf->can_dlc > 8)
+ goto out_delete;
+
(*gwj->mod.csumfunc.crc8)(cf, &gwj->mod.csum.crc8);
+ }
+
+ if (gwj->mod.csumfunc.xor) {
+ if (cf->can_dlc > 8)
+ goto out_delete;
- if (gwj->mod.csumfunc.xor)
(*gwj->mod.csumfunc.xor)(cf, &gwj->mod.csum.xor);
+ }
}
/* clear the skb timestamp if not configured the other way */
@@ -434,6 +450,14 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data)
gwj->dropped_frames++;
else
gwj->handled_frames++;
+
+ return;
+
+ out_delete:
+ /* delete frame due to misconfiguration */
+ gwj->deleted_frames++;
+ kfree_skb(nskb);
+ return;
}
static inline int cgw_register_filter(struct net *net, struct cgw_job *gwj)
--
2.20.1
Commit '3d035f580699 ("drivers/char/hpet.c: allow user controlled mmap for
user processes")' introduced a new kernel command line parameter hpet_mmap,
that is required to expose the memory map of the HPET registers to
user-space. Unfortunately the kernel command line parameter 'hpet_mmap' is
broken and never takes effect due to missing '=' character in the __setup()
code of hpet_mmap_enable.
Before this patch:
dmesg output with the kernel command line parameter hpet_mmap=1
[ 0.204152] HPET mmap disabled
dmesg output with the kernel command line parameter hpet_mmap=0
[ 0.204192] HPET mmap disabled
After this patch:
dmesg output with the kernel command line parameter hpet_mmap=1
[ 0.203945] HPET mmap enabled
dmesg output with the kernel command line parameter hpet_mmap=0
[ 0.204652] HPET mmap disabled
Fixes: 3d035f580699 ("drivers/char/hpet.c: allow user controlled mmap for user processes")
Signed-off-by: Buland Singh <bsingh(a)redhat.com>
---
drivers/char/hpet.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index 4a22b4b41aef..9bffcd37cc7b 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -377,7 +377,7 @@ static __init int hpet_mmap_enable(char *str)
pr_info("HPET mmap %s\n", hpet_mmap_enabled ? "enabled" : "disabled");
return 1;
}
-__setup("hpet_mmap", hpet_mmap_enable);
+__setup("hpet_mmap=", hpet_mmap_enable);
static int hpet_mmap(struct file *file, struct vm_area_struct *vma)
{
--
2.19.1
stable-rc/linux-4.9.y build: 193 builds: 109 failed, 84 passed, 233 errors, 231 warnings (v4.9.148-72-g1f2b850ae45e)
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.9.y/kernel/v4.9.148-72-…
Tree: stable-rc
Branch: linux-4.9.y
Git Describe: v4.9.148-72-g1f2b850ae45e
Git Commit: 1f2b850ae45ebdd8f3019fa1774e35accecd5734
Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Built: 6 unique architectures
Build Failures Detected:
arc: arc-linux-gcc (ARCv2 ISA Linux uClibc toolchain 2017.09) 7.1.1 20170710
axs103_defconfig: FAIL
axs103_smp_defconfig: FAIL
vdk_hs38_defconfig: FAIL
vdk_hs38_smp_defconfig: FAIL
arm64: aarch64-linux-gnu-gcc (Debian 7.4.0-1) 7.4.0
defconfig: FAIL
arm: arm-linux-gnueabihf-gcc (Debian 7.4.0-1) 7.4.0
at91_dt_defconfig: FAIL
axm55xx_defconfig: FAIL
badge4_defconfig: FAIL
bcm2835_defconfig: FAIL
cerfcube_defconfig: FAIL
cm_x2xx_defconfig: FAIL
cm_x300_defconfig: FAIL
colibri_pxa300_defconfig: FAIL
davinci_all_defconfig: FAIL
dove_defconfig: FAIL
em_x270_defconfig: FAIL
ep93xx_defconfig: FAIL
eseries_pxa_defconfig: FAIL
exynos_defconfig: FAIL
ezx_defconfig: FAIL
hisi_defconfig: FAIL
imote2_defconfig: FAIL
imx_v4_v5_defconfig: FAIL
imx_v6_v7_defconfig: FAIL
iop13xx_defconfig: FAIL
iop32x_defconfig: FAIL
iop33x_defconfig: FAIL
ixp4xx_defconfig: FAIL
keystone_defconfig: FAIL
lart_defconfig: FAIL
mini2440_defconfig: FAIL
mmp2_defconfig: FAIL
moxart_defconfig: FAIL
multi_v5_defconfig: FAIL
multi_v7_defconfig: FAIL
mv78xx0_defconfig: FAIL
mvebu_v5_defconfig: FAIL
mvebu_v7_defconfig: FAIL
mxs_defconfig: FAIL
nhk8815_defconfig: FAIL
omap1_defconfig: FAIL
omap2plus_defconfig: FAIL
orion5x_defconfig: FAIL
palmz72_defconfig: FAIL
pcm027_defconfig: FAIL
pleb_defconfig: FAIL
pxa_defconfig: FAIL
qcom_defconfig: FAIL
raumfeld_defconfig: FAIL
rpc_defconfig: FAIL
s3c2410_defconfig: FAIL
s3c6400_defconfig: FAIL
sama5_defconfig: FAIL
simpad_defconfig: FAIL
socfpga_defconfig: FAIL
spear13xx_defconfig: FAIL
spear3xx_defconfig: FAIL
spear6xx_defconfig: FAIL
spitz_defconfig: FAIL
sunxi_defconfig: FAIL
tegra_defconfig: FAIL
trizeps4_defconfig: FAIL
u8500_defconfig: FAIL
vexpress_defconfig: FAIL
viper_defconfig: FAIL
vt8500_v6_v7_defconfig: FAIL
zeus_defconfig: FAIL
zx_defconfig: FAIL
mips: mips-linux-gcc (GCC) 6.3.0
bigsur_defconfig: FAIL
bmips_be_defconfig: FAIL
bmips_stb_defconfig: FAIL
capcella_defconfig: FAIL
cavium_octeon_defconfig: FAIL
cobalt_defconfig: FAIL
db1xxx_defconfig: FAIL
decstation_defconfig: FAIL
e55_defconfig: FAIL
fuloong2e_defconfig: FAIL
ip22_defconfig: FAIL
ip27_defconfig: FAIL
ip28_defconfig: FAIL
ip32_defconfig: FAIL
jazz_defconfig: FAIL
lasat_defconfig: FAIL
lemote2f_defconfig: FAIL
loongson1b_defconfig: FAIL
loongson1c_defconfig: FAIL
loongson3_defconfig: FAIL
malta_defconfig: FAIL
malta_kvm_defconfig: FAIL
malta_kvm_guest_defconfig: FAIL
malta_qemu_32r6_defconfig: FAIL
maltaaprp_defconfig: FAIL
maltasmvp_defconfig: FAIL
maltasmvp_eva_defconfig: FAIL
maltaup_defconfig: FAIL
maltaup_xpa_defconfig: FAIL
markeins_defconfig: FAIL
mips_paravirt_defconfig: FAIL
mtx1_defconfig: FAIL
nlm_xlp_defconfig: FAIL
nlm_xlr_defconfig: FAIL
pic32mzda_defconfig: FAIL
pistachio_defconfig: FAIL
qi_lb60_defconfig: FAIL
rm200_defconfig: FAIL
tb0219_defconfig: FAIL
tb0287_defconfig: FAIL
workpad_defconfig: FAIL
Errors and Warnings Detected:
arc: arc-linux-gcc (ARCv2 ISA Linux uClibc toolchain 2017.09) 7.1.1 20170710
allnoconfig: 5 warnings
axs103_defconfig: 2 errors, 19 warnings
axs103_smp_defconfig: 2 errors, 20 warnings
nsim_hs_smp_defconfig: 6 warnings
nsimosci_hs_defconfig: 8 warnings
nsimosci_hs_smp_defconfig: 9 warnings
tinyconfig: 6 warnings
vdk_hs38_defconfig: 2 errors, 20 warnings
vdk_hs38_smp_defconfig: 2 errors, 21 warnings
zebu_hs_defconfig: 5 warnings
zebu_hs_smp_defconfig: 6 warnings
arm64: aarch64-linux-gnu-gcc (Debian 7.4.0-1) 7.4.0
defconfig: 5 errors, 1 warning
arm: arm-linux-gnueabihf-gcc (Debian 7.4.0-1) 7.4.0
at91_dt_defconfig: 2 errors, 1 warning
axm55xx_defconfig: 2 errors, 1 warning
badge4_defconfig: 2 errors, 1 warning
bcm2835_defconfig: 2 errors, 1 warning
cerfcube_defconfig: 2 errors, 1 warning
cm_x2xx_defconfig: 2 errors, 1 warning
cm_x300_defconfig: 2 errors, 1 warning
colibri_pxa300_defconfig: 2 errors, 1 warning
davinci_all_defconfig: 2 errors, 1 warning
dove_defconfig: 2 errors, 1 warning
em_x270_defconfig: 2 errors, 1 warning
ep93xx_defconfig: 2 errors, 1 warning
eseries_pxa_defconfig: 2 errors, 1 warning
exynos_defconfig: 2 errors, 1 warning
ezx_defconfig: 2 errors, 1 warning
hisi_defconfig: 2 errors, 1 warning
imote2_defconfig: 2 errors, 1 warning
imx_v4_v5_defconfig: 2 errors, 1 warning
imx_v6_v7_defconfig: 2 errors, 1 warning
iop13xx_defconfig: 2 errors, 1 warning
iop32x_defconfig: 2 errors, 1 warning
iop33x_defconfig: 2 errors, 1 warning
ixp4xx_defconfig: 2 errors, 1 warning
keystone_defconfig: 2 errors, 1 warning
lart_defconfig: 2 errors, 1 warning
mini2440_defconfig: 2 errors, 1 warning
mmp2_defconfig: 2 errors, 1 warning
moxart_defconfig: 2 errors, 1 warning
multi_v5_defconfig: 2 errors, 1 warning
multi_v7_defconfig: 2 errors, 1 warning
mv78xx0_defconfig: 2 errors, 1 warning
mvebu_v5_defconfig: 2 errors, 1 warning
mvebu_v7_defconfig: 2 errors, 1 warning
mxs_defconfig: 2 errors, 1 warning
nhk8815_defconfig: 2 errors, 1 warning
omap1_defconfig: 2 errors, 1 warning
omap2plus_defconfig: 2 errors, 1 warning
orion5x_defconfig: 2 errors, 1 warning
palmz72_defconfig: 2 errors, 1 warning
pcm027_defconfig: 2 errors, 1 warning
pleb_defconfig: 2 errors, 1 warning
pxa_defconfig: 2 errors, 1 warning
qcom_defconfig: 2 errors, 1 warning
raumfeld_defconfig: 2 errors, 1 warning
rpc_defconfig: 2 errors, 1 warning
s3c2410_defconfig: 2 errors, 1 warning
s3c6400_defconfig: 2 errors, 1 warning
sama5_defconfig: 2 errors, 1 warning
simpad_defconfig: 2 errors, 1 warning
socfpga_defconfig: 2 errors, 1 warning
spear13xx_defconfig: 2 errors, 1 warning
spear3xx_defconfig: 2 errors, 1 warning
spear6xx_defconfig: 2 errors, 1 warning
spitz_defconfig: 2 errors, 1 warning
sunxi_defconfig: 2 errors, 1 warning
tegra_defconfig: 2 errors, 1 warning
trizeps4_defconfig: 2 errors, 1 warning
u8500_defconfig: 2 errors, 1 warning
vexpress_defconfig: 2 errors, 1 warning
viper_defconfig: 2 errors, 1 warning
vt8500_v6_v7_defconfig: 2 errors, 1 warning
zeus_defconfig: 2 errors, 1 warning
zx_defconfig: 2 errors, 1 warning
mips: mips-linux-gcc (GCC) 6.3.0
bigsur_defconfig: 2 errors, 1 warning
bmips_be_defconfig: 2 errors, 1 warning
bmips_stb_defconfig: 2 errors, 1 warning
capcella_defconfig: 2 errors, 1 warning
cavium_octeon_defconfig: 2 errors, 1 warning
cobalt_defconfig: 2 errors, 1 warning
db1xxx_defconfig: 2 errors, 1 warning
decstation_defconfig: 2 errors, 2 warnings
e55_defconfig: 2 errors, 1 warning
fuloong2e_defconfig: 2 errors, 1 warning
ip22_defconfig: 2 errors, 1 warning
ip27_defconfig: 5 errors, 1 warning
ip28_defconfig: 2 errors, 1 warning
ip32_defconfig: 2 errors, 1 warning
jazz_defconfig: 2 errors, 1 warning
lasat_defconfig: 2 errors, 1 warning
lemote2f_defconfig: 5 errors, 1 warning
loongson1b_defconfig: 2 errors, 1 warning
loongson1c_defconfig: 2 errors, 1 warning
loongson3_defconfig: 2 errors, 1 warning
malta_defconfig: 2 errors, 1 warning
malta_kvm_defconfig: 2 errors, 1 warning
malta_kvm_guest_defconfig: 2 errors, 1 warning
malta_qemu_32r6_defconfig: 2 errors, 1 warning
maltaaprp_defconfig: 2 errors, 1 warning
maltasmvp_defconfig: 2 errors, 1 warning
maltasmvp_eva_defconfig: 2 errors, 1 warning
maltaup_defconfig: 2 errors, 1 warning
maltaup_xpa_defconfig: 2 errors, 1 warning
markeins_defconfig: 2 errors, 1 warning
mips_paravirt_defconfig: 2 errors, 1 warning
mtx1_defconfig: 2 errors, 1 warning
nlm_xlp_defconfig: 5 errors, 1 warning
nlm_xlr_defconfig: 5 errors, 1 warning
pic32mzda_defconfig: 2 errors, 1 warning
pistachio_defconfig: 2 errors, 1 warning
qi_lb60_defconfig: 2 errors, 1 warning
rm200_defconfig: 2 errors, 1 warning
tb0219_defconfig: 2 errors, 1 warning
tb0287_defconfig: 2 errors, 1 warning
workpad_defconfig: 2 errors, 1 warning
Errors summary:
109 fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
68 fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
41 fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
5 fs/btrfs/tree-log.c:5563:11: error: 'struct inode' has no member named 'last_link_trans'
5 fs/btrfs/tree-log.c:5562:11: error: 'struct inode' has no member named 'vfs_inode'
5 fs/btrfs/extent-tree.c:9255:8: error: too few arguments to function 'btrfs_run_delayed_items'
Warnings summary:
109 cc1: some warnings being treated as errors
36 fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
12 arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
11 kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
11 include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
9 net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
9 net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
9 include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
7 warning: (ARC) selects HAVE_FUTEX_CMPXCHG which has unmet direct dependencies (FUTEX)
6 fs/posix_acl.c:34:1: warning: control reaches end of non-void function [-Wreturn-type]
5 lib/cpumask.c:211:1: warning: control reaches end of non-void function [-Wreturn-type]
4 block/cfq-iosched.c:3840:1: warning: control reaches end of non-void function [-Wreturn-type]
2 arch/arc/kernel/unwind.c:188:14: warning: 'unw_hdr_alloc' defined but not used [-Wunused-function]
1 drivers/net/ethernet/amd/declance.c:1231:2: warning: 'desc' may be used uninitialized in this function [-Wmaybe-uninitialized]
================================================================================
Detailed per-defconfig build reports:
--------------------------------------------------------------------------------
acs5k_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
acs5k_tiny_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
allnoconfig (arm64) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
allnoconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
allnoconfig (x86_64) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
allnoconfig (i386) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
allnoconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
allnoconfig (arc) — PASS, 0 errors, 5 warnings, 0 section mismatches
Warnings:
warning: (ARC) selects HAVE_FUTEX_CMPXCHG which has unmet direct dependencies (FUTEX)
warning: (ARC) selects HAVE_FUTEX_CMPXCHG which has unmet direct dependencies (FUTEX)
warning: (ARC) selects HAVE_FUTEX_CMPXCHG which has unmet direct dependencies (FUTEX)
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
--------------------------------------------------------------------------------
am200epdkit_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
ar7_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
aspeed_g4_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
aspeed_g5_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
assabet_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
at91_dt_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ath25_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
ath79_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
axm55xx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
axs103_defconfig (arc) — FAIL, 2 errors, 19 warnings, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
block/cfq-iosched.c:3840:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
cc1: some warnings being treated as errors
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
fs/posix_acl.c:34:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
axs103_smp_defconfig (arc) — FAIL, 2 errors, 20 warnings, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
cc1: some warnings being treated as errors
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
block/cfq-iosched.c:3840:1: warning: control reaches end of non-void function [-Wreturn-type]
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
fs/posix_acl.c:34:1: warning: control reaches end of non-void function [-Wreturn-type]
lib/cpumask.c:211:1: warning: control reaches end of non-void function [-Wreturn-type]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
badge4_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
bcm2835_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
bcm47xx_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
bcm63xx_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
bigsur_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
bmips_be_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
bmips_stb_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
capcella_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
cavium_octeon_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
cerfcube_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ci20_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
clps711x_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
cm_x2xx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
cm_x300_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
cns3420vb_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
cobalt_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
colibri_pxa270_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
colibri_pxa300_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
collie_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
corgi_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
davinci_all_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
db1xxx_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
decstation_defconfig (mips) — FAIL, 2 errors, 2 warnings, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
drivers/net/ethernet/amd/declance.c:1231:2: warning: 'desc' may be used uninitialized in this function [-Wmaybe-uninitialized]
--------------------------------------------------------------------------------
defconfig (arm64) — FAIL, 5 errors, 1 warning, 0 section mismatches
Errors:
fs/btrfs/extent-tree.c:9255:8: error: too few arguments to function 'btrfs_run_delayed_items'
fs/btrfs/tree-log.c:5562:11: error: 'struct inode' has no member named 'vfs_inode'
fs/btrfs/tree-log.c:5563:11: error: 'struct inode' has no member named 'last_link_trans'
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
dove_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
e55_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ebsa110_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
efm32_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
em_x270_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ep93xx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
eseries_pxa_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
exynos_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ezx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
footbridge_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
fuloong2e_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
gpr_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
h3600_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
h5000_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
hackkit_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
hisi_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
imote2_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
imx_v4_v5_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
imx_v6_v7_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
integrator_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
iop13xx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
iop32x_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
iop33x_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ip22_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ip27_defconfig (mips) — FAIL, 5 errors, 1 warning, 0 section mismatches
Errors:
fs/btrfs/extent-tree.c:9255:8: error: too few arguments to function 'btrfs_run_delayed_items'
fs/btrfs/tree-log.c:5562:11: error: 'struct inode' has no member named 'vfs_inode'
fs/btrfs/tree-log.c:5563:11: error: 'struct inode' has no member named 'last_link_trans'
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ip28_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ip32_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ixp4xx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
jazz_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
jmr3927_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
jornada720_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
keystone_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
ks8695_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
lart_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
lasat_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
lemote2f_defconfig (mips) — FAIL, 5 errors, 1 warning, 0 section mismatches
Errors:
fs/btrfs/extent-tree.c:9255:8: error: too few arguments to function 'btrfs_run_delayed_items'
fs/btrfs/tree-log.c:5562:11: error: 'struct inode' has no member named 'vfs_inode'
fs/btrfs/tree-log.c:5563:11: error: 'struct inode' has no member named 'last_link_trans'
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
loongson1b_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
loongson1c_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
loongson3_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
lpc18xx_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
lpc32xx_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
lpd270_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
lubbock_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
magician_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
mainstone_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
malta_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
malta_kvm_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
malta_kvm_guest_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
malta_qemu_32r6_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
maltaaprp_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
maltasmvp_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
maltasmvp_eva_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
maltaup_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
maltaup_xpa_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
markeins_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
mini2440_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
mips_paravirt_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
mmp2_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
moxart_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
mpc30x_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
mps2_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
msp71xx_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
mtx1_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
multi_v4t_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
multi_v5_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
multi_v7_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
mv78xx0_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
mvebu_v5_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
mvebu_v7_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
mxs_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
neponset_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
netwinder_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
netx_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
nhk8815_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
nlm_xlp_defconfig (mips) — FAIL, 5 errors, 1 warning, 0 section mismatches
Errors:
fs/btrfs/extent-tree.c:9255:8: error: too few arguments to function 'btrfs_run_delayed_items'
fs/btrfs/tree-log.c:5562:11: error: 'struct inode' has no member named 'vfs_inode'
fs/btrfs/tree-log.c:5563:11: error: 'struct inode' has no member named 'last_link_trans'
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
nlm_xlr_defconfig (mips) — FAIL, 5 errors, 1 warning, 0 section mismatches
Errors:
fs/btrfs/extent-tree.c:9255:8: error: too few arguments to function 'btrfs_run_delayed_items'
fs/btrfs/tree-log.c:5562:11: error: 'struct inode' has no member named 'vfs_inode'
fs/btrfs/tree-log.c:5563:11: error: 'struct inode' has no member named 'last_link_trans'
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
nsim_hs_smp_defconfig (arc) — PASS, 0 errors, 6 warnings, 0 section mismatches
Warnings:
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
lib/cpumask.c:211:1: warning: control reaches end of non-void function [-Wreturn-type]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
nsimosci_hs_defconfig (arc) — PASS, 0 errors, 8 warnings, 0 section mismatches
Warnings:
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
fs/posix_acl.c:34:1: warning: control reaches end of non-void function [-Wreturn-type]
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
nsimosci_hs_smp_defconfig (arc) — PASS, 0 errors, 9 warnings, 0 section mismatches
Warnings:
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
fs/posix_acl.c:34:1: warning: control reaches end of non-void function [-Wreturn-type]
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
lib/cpumask.c:211:1: warning: control reaches end of non-void function [-Wreturn-type]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
nuc910_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
nuc950_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
nuc960_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
omap1_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
omap2plus_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
orion5x_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
palmz72_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
pcm027_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
pic32mzda_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
pistachio_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
pleb_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
pnx8335_stb225_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
prima2_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
pxa168_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
pxa255-idp_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
pxa3xx_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
pxa910_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
pxa_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
qcom_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
qi_lb60_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
raumfeld_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
rb532_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
rbtx49xx_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
realview_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
rm200_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
rpc_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
rt305x_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
s3c2410_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
s3c6400_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
s5pv210_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
sama5_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
sb1250_swarm_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
shannon_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
shmobile_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
simpad_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
socfpga_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
spear13xx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
spear3xx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
spear6xx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
spitz_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
stm32_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
sunxi_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
tb0219_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
tb0226_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
tb0287_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
tct_hammer_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
tegra_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
tinyconfig (x86_64) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
tinyconfig (arm64) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
tinyconfig (i386) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
tinyconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
tinyconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
tinyconfig (arc) — PASS, 0 errors, 6 warnings, 0 section mismatches
Warnings:
warning: (ARC) selects HAVE_FUTEX_CMPXCHG which has unmet direct dependencies (FUTEX)
warning: (ARC) selects HAVE_FUTEX_CMPXCHG which has unmet direct dependencies (FUTEX)
warning: (ARC) selects HAVE_FUTEX_CMPXCHG which has unmet direct dependencies (FUTEX)
warning: (ARC) selects HAVE_FUTEX_CMPXCHG which has unmet direct dependencies (FUTEX)
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
--------------------------------------------------------------------------------
trizeps4_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
u300_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
u8500_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
vdk_hs38_defconfig (arc) — FAIL, 2 errors, 20 warnings, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
arch/arc/kernel/unwind.c:188:14: warning: 'unw_hdr_alloc' defined but not used [-Wunused-function]
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
cc1: some warnings being treated as errors
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
block/cfq-iosched.c:3840:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
fs/posix_acl.c:34:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
vdk_hs38_smp_defconfig (arc) — FAIL, 2 errors, 21 warnings, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
arch/arc/kernel/unwind.c:188:14: warning: 'unw_hdr_alloc' defined but not used [-Wunused-function]
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
cc1: some warnings being treated as errors
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
block/cfq-iosched.c:3840:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
fs/ext4/ext4_jbd2.h:430:1: warning: control reaches end of non-void function [-Wreturn-type]
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
fs/posix_acl.c:34:1: warning: control reaches end of non-void function [-Wreturn-type]
lib/cpumask.c:211:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
versatile_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
vexpress_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
vf610m4_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
viper_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
vt8500_v6_v7_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
workpad_defconfig (mips) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown' [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
xcep_defconfig (arm) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
xilfpga_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
xway_defconfig (mips) — PASS, 0 errors, 0 warnings, 0 section mismatches
--------------------------------------------------------------------------------
zebu_hs_defconfig (arc) — PASS, 0 errors, 5 warnings, 0 section mismatches
Warnings:
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
zebu_hs_smp_defconfig (arc) — PASS, 0 errors, 6 warnings, 0 section mismatches
Warnings:
include/linux/kernel.h:740:16: warning: comparison of distinct pointer types lacks a cast
kernel/sched/core.c:3294:1: warning: control reaches end of non-void function [-Wreturn-type]
net/core/ethtool.c:300:1: warning: control reaches end of non-void function [-Wreturn-type]
net/ipv4/tcp_input.c:4325:49: warning: array subscript is above array bounds [-Warray-bounds]
lib/cpumask.c:211:1: warning: control reaches end of non-void function [-Wreturn-type]
include/linux/sunrpc/svc_xprt.h:178:1: warning: control reaches end of non-void function [-Wreturn-type]
--------------------------------------------------------------------------------
zeus_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
--------------------------------------------------------------------------------
zx_defconfig (arm) — FAIL, 2 errors, 1 warning, 0 section mismatches
Errors:
fs/ext4/inode.c:5018:6: error: implicit declaration of function 'sb_rdonly' [-Werror=implicit-function-declaration]
fs/ext4/inode.c:5021:15: error: implicit declaration of function 'ext4_forced_shutdown'; did you mean 'ext4_force_commit'? [-Werror=implicit-function-declaration]
Warnings:
cc1: some warnings being treated as errors
---
For more info write to <info(a)kernelci.org>
Hi Greg,
Kindly review and consider following mm/OOM upstream fixes for stable 4.9.y.
88ed365ea227 ("mm: don't steal highatomic pageblock")
04c8716f7b00 ("mm: try to exhaust highatomic reserve before the OOM")
29fac03bef72 ("mm: make unreserve highatomic functions reliable")
The original 4 patch series is archived here
https://lkml.org/lkml/2016/10/12/77 for review.
One of the patch from this series:
4855e4a7f29d ("mm: prevent double decrease of nr_reserved_highatomic")
has already been picked up for 4.9.y and 4.4.y.
I ran into these fixes in one of the msm-4.9(android) trees.
Cherry-picked and build tested on Linux 4.9.148 for
ARCH=arm/arm64 defconfig.
Only the first patch from this series can be applied cleanly on
v4.4.y, while others fail to apply cleanly due to OOM rework done in
v4.7 release cycle, 0a0337e0d1d1 ("mm, oom: rework oom detection").
Plus I don't see this series backported to v4.4 in any of the
msm-4.4(android) trees either. So I'm skipping it for v4.4.y.
Regards,
Amit Pundir
Delay the drm_modeset_acquire_init() until after we check for an
allocation failure so that we can return immediately upon error without
having to unwind.
WARNING: lock held when returning to user space!
4.20.0+ #174 Not tainted
------------------------------------------------
syz-executor556/8153 is leaving the kernel with locks still held!
1 lock held by syz-executor556/8153:
#0: 000000005100c85c (crtc_ww_class_acquire){+.+.}, at:
set_property_atomic+0xb3/0x330 drivers/gpu/drm/drm_mode_object.c:462
Reported-by: syzbot+6ea337c427f5083ebdf2(a)syzkaller.appspotmail.com
Fixes: 144a7999d633 ("drm: Handle properties in the core for atomic drivers")
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com>
Cc: Sean Paul <sean(a)poorly.run>
Cc: David Airlie <airlied(a)linux.ie>
Cc: <stable(a)vger.kernel.org> # v4.14+
---
drivers/gpu/drm/drm_mode_object.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/drm_mode_object.c b/drivers/gpu/drm/drm_mode_object.c
index bb1dd46496cd..a9005c1c2384 100644
--- a/drivers/gpu/drm/drm_mode_object.c
+++ b/drivers/gpu/drm/drm_mode_object.c
@@ -459,12 +459,13 @@ static int set_property_atomic(struct drm_mode_object *obj,
struct drm_modeset_acquire_ctx ctx;
int ret;
- drm_modeset_acquire_init(&ctx, 0);
-
state = drm_atomic_state_alloc(dev);
if (!state)
return -ENOMEM;
+
+ drm_modeset_acquire_init(&ctx, 0);
state->acquire_ctx = &ctx;
+
retry:
if (prop == state->dev->mode_config.dpms_property) {
if (obj->type != DRM_MODE_OBJECT_CONNECTOR) {
--
2.20.1
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 53290432145a8eb143fe29e06e9c1465d43dc723 Mon Sep 17 00:00:00 2001
From: Will Deacon <will.deacon(a)arm.com>
Date: Thu, 3 Jan 2019 18:00:39 +0000
Subject: [PATCH] arm64: compat: Don't pull syscall number from regs in
arm_compat_syscall
The syscall number may have been changed by a tracer, so we should pass
the actual number in from the caller instead of pulling it from the
saved r7 value directly.
Cc: <stable(a)vger.kernel.org>
Cc: Pi-Hsun Shih <pihsun(a)chromium.org>
Reviewed-by: Dave Martin <Dave.Martin(a)arm.com>
Signed-off-by: Will Deacon <will.deacon(a)arm.com>
diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c
index a79db4e485a6..bc348ab3dd6b 100644
--- a/arch/arm64/kernel/sys_compat.c
+++ b/arch/arm64/kernel/sys_compat.c
@@ -66,12 +66,11 @@ do_compat_cache_op(unsigned long start, unsigned long end, int flags)
/*
* Handle all unrecognised system calls.
*/
-long compat_arm_syscall(struct pt_regs *regs)
+long compat_arm_syscall(struct pt_regs *regs, int scno)
{
- unsigned int no = regs->regs[7];
void __user *addr;
- switch (no) {
+ switch (scno) {
/*
* Flush a region from virtual address 'r0' to virtual address 'r1'
* _exclusive_. There is no alignment requirement on either address;
@@ -107,7 +106,7 @@ long compat_arm_syscall(struct pt_regs *regs)
* way the calling program can gracefully determine whether
* a feature is supported.
*/
- if (no < __ARM_NR_COMPAT_END)
+ if (scno < __ARM_NR_COMPAT_END)
return -ENOSYS;
break;
}
@@ -116,6 +115,6 @@ long compat_arm_syscall(struct pt_regs *regs)
(compat_thumb_mode(regs) ? 2 : 4);
arm64_notify_die("Oops - bad compat syscall(2)", regs,
- SIGILL, ILL_ILLTRP, addr, no);
+ SIGILL, ILL_ILLTRP, addr, scno);
return 0;
}
diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c
index 032d22312881..5610ac01c1ec 100644
--- a/arch/arm64/kernel/syscall.c
+++ b/arch/arm64/kernel/syscall.c
@@ -13,16 +13,15 @@
#include <asm/thread_info.h>
#include <asm/unistd.h>
-long compat_arm_syscall(struct pt_regs *regs);
-
+long compat_arm_syscall(struct pt_regs *regs, int scno);
long sys_ni_syscall(void);
-asmlinkage long do_ni_syscall(struct pt_regs *regs)
+static long do_ni_syscall(struct pt_regs *regs, int scno)
{
#ifdef CONFIG_COMPAT
long ret;
if (is_compat_task()) {
- ret = compat_arm_syscall(regs);
+ ret = compat_arm_syscall(regs, scno);
if (ret != -ENOSYS)
return ret;
}
@@ -47,7 +46,7 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno,
syscall_fn = syscall_table[array_index_nospec(scno, sc_nr)];
ret = __invoke_syscall(regs, syscall_fn);
} else {
- ret = do_ni_syscall(regs);
+ ret = do_ni_syscall(regs, scno);
}
regs->regs[0] = ret;
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 169113ece0f29ebe884a6cfcf57c1ace04d8a36a Mon Sep 17 00:00:00 2001
From: Will Deacon <will.deacon(a)arm.com>
Date: Thu, 3 Jan 2019 17:45:07 +0000
Subject: [PATCH] arm64: compat: Avoid sending SIGILL for unallocated syscall
numbers
The ARM Linux kernel handles the EABI syscall numbers as follows:
0 - NR_SYSCALLS-1 : Invoke syscall via syscall table
NR_SYSCALLS - 0xeffff : -ENOSYS (to be allocated in future)
0xf0000 - 0xf07ff : Private syscall or -ENOSYS if not allocated
> 0xf07ff : SIGILL
Our compat code gets this wrong and ends up sending SIGILL in response
to all syscalls greater than NR_SYSCALLS which have a value greater
than 0x7ff in the bottom 16 bits.
Fix this by defining the end of the ARM private syscall region and
checking the syscall number against that directly. Update the comment
while we're at it.
Cc: <stable(a)vger.kernel.org>
Cc: Dave Martin <Dave.Martin(a)arm.com>
Reported-by: Pi-Hsun Shih <pihsun(a)chromium.org>
Signed-off-by: Will Deacon <will.deacon(a)arm.com>
diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
index b13ca091f833..85d5c1026204 100644
--- a/arch/arm64/include/asm/unistd.h
+++ b/arch/arm64/include/asm/unistd.h
@@ -40,8 +40,9 @@
* The following SVCs are ARM private.
*/
#define __ARM_NR_COMPAT_BASE 0x0f0000
-#define __ARM_NR_compat_cacheflush (__ARM_NR_COMPAT_BASE+2)
-#define __ARM_NR_compat_set_tls (__ARM_NR_COMPAT_BASE+5)
+#define __ARM_NR_compat_cacheflush (__ARM_NR_COMPAT_BASE + 2)
+#define __ARM_NR_compat_set_tls (__ARM_NR_COMPAT_BASE + 5)
+#define __ARM_NR_COMPAT_END (__ARM_NR_COMPAT_BASE + 0x800)
#define __NR_compat_syscalls 399
#endif
diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c
index 32653d156747..a79db4e485a6 100644
--- a/arch/arm64/kernel/sys_compat.c
+++ b/arch/arm64/kernel/sys_compat.c
@@ -102,12 +102,12 @@ long compat_arm_syscall(struct pt_regs *regs)
default:
/*
- * Calls 9f00xx..9f07ff are defined to return -ENOSYS
+ * Calls 0xf0xxx..0xf07ff are defined to return -ENOSYS
* if not implemented, rather than raising SIGILL. This
* way the calling program can gracefully determine whether
* a feature is supported.
*/
- if ((no & 0xffff) <= 0x7ff)
+ if (no < __ARM_NR_COMPAT_END)
return -ENOSYS;
break;
}
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 169113ece0f29ebe884a6cfcf57c1ace04d8a36a Mon Sep 17 00:00:00 2001
From: Will Deacon <will.deacon(a)arm.com>
Date: Thu, 3 Jan 2019 17:45:07 +0000
Subject: [PATCH] arm64: compat: Avoid sending SIGILL for unallocated syscall
numbers
The ARM Linux kernel handles the EABI syscall numbers as follows:
0 - NR_SYSCALLS-1 : Invoke syscall via syscall table
NR_SYSCALLS - 0xeffff : -ENOSYS (to be allocated in future)
0xf0000 - 0xf07ff : Private syscall or -ENOSYS if not allocated
> 0xf07ff : SIGILL
Our compat code gets this wrong and ends up sending SIGILL in response
to all syscalls greater than NR_SYSCALLS which have a value greater
than 0x7ff in the bottom 16 bits.
Fix this by defining the end of the ARM private syscall region and
checking the syscall number against that directly. Update the comment
while we're at it.
Cc: <stable(a)vger.kernel.org>
Cc: Dave Martin <Dave.Martin(a)arm.com>
Reported-by: Pi-Hsun Shih <pihsun(a)chromium.org>
Signed-off-by: Will Deacon <will.deacon(a)arm.com>
diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
index b13ca091f833..85d5c1026204 100644
--- a/arch/arm64/include/asm/unistd.h
+++ b/arch/arm64/include/asm/unistd.h
@@ -40,8 +40,9 @@
* The following SVCs are ARM private.
*/
#define __ARM_NR_COMPAT_BASE 0x0f0000
-#define __ARM_NR_compat_cacheflush (__ARM_NR_COMPAT_BASE+2)
-#define __ARM_NR_compat_set_tls (__ARM_NR_COMPAT_BASE+5)
+#define __ARM_NR_compat_cacheflush (__ARM_NR_COMPAT_BASE + 2)
+#define __ARM_NR_compat_set_tls (__ARM_NR_COMPAT_BASE + 5)
+#define __ARM_NR_COMPAT_END (__ARM_NR_COMPAT_BASE + 0x800)
#define __NR_compat_syscalls 399
#endif
diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c
index 32653d156747..a79db4e485a6 100644
--- a/arch/arm64/kernel/sys_compat.c
+++ b/arch/arm64/kernel/sys_compat.c
@@ -102,12 +102,12 @@ long compat_arm_syscall(struct pt_regs *regs)
default:
/*
- * Calls 9f00xx..9f07ff are defined to return -ENOSYS
+ * Calls 0xf0xxx..0xf07ff are defined to return -ENOSYS
* if not implemented, rather than raising SIGILL. This
* way the calling program can gracefully determine whether
* a feature is supported.
*/
- if ((no & 0xffff) <= 0x7ff)
+ if (no < __ARM_NR_COMPAT_END)
return -ENOSYS;
break;
}
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From fb544d1ca65a89f7a3895f7531221ceeed74ada7 Mon Sep 17 00:00:00 2001
From: Christoffer Dall <christoffer.dall(a)arm.com>
Date: Tue, 11 Dec 2018 13:23:57 +0100
Subject: [PATCH] KVM: arm/arm64: Fix VMID alloc race by reverting to lock-less
We recently addressed a VMID generation race by introducing a read/write
lock around accesses and updates to the vmid generation values.
However, kvm_arch_vcpu_ioctl_run() also calls need_new_vmid_gen() but
does so without taking the read lock.
As far as I can tell, this can lead to the same kind of race:
VM 0, VCPU 0 VM 0, VCPU 1
------------ ------------
update_vttbr (vmid 254)
update_vttbr (vmid 1) // roll over
read_lock(kvm_vmid_lock);
force_vm_exit()
local_irq_disable
need_new_vmid_gen == false //because vmid gen matches
enter_guest (vmid 254)
kvm_arch.vttbr = <PGD>:<VMID 1>
read_unlock(kvm_vmid_lock);
enter_guest (vmid 1)
Which results in running two VCPUs in the same VM with different VMIDs
and (even worse) other VCPUs from other VMs could now allocate clashing
VMID 254 from the new generation as long as VCPU 0 is not exiting.
Attempt to solve this by making sure vttbr is updated before another CPU
can observe the updated VMID generation.
Cc: stable(a)vger.kernel.org
Fixes: f0cf47d939d0 "KVM: arm/arm64: Close VMID generation race"
Reviewed-by: Julien Thierry <julien.thierry(a)arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall(a)arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier(a)arm.com>
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index 4adcee5fc126..d9273f972828 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -66,7 +66,7 @@ static DEFINE_PER_CPU(struct kvm_vcpu *, kvm_arm_running_vcpu);
static atomic64_t kvm_vmid_gen = ATOMIC64_INIT(1);
static u32 kvm_next_vmid;
static unsigned int kvm_vmid_bits __read_mostly;
-static DEFINE_RWLOCK(kvm_vmid_lock);
+static DEFINE_SPINLOCK(kvm_vmid_lock);
static bool vgic_present;
@@ -484,7 +484,9 @@ void force_vm_exit(const cpumask_t *mask)
*/
static bool need_new_vmid_gen(struct kvm *kvm)
{
- return unlikely(kvm->arch.vmid_gen != atomic64_read(&kvm_vmid_gen));
+ u64 current_vmid_gen = atomic64_read(&kvm_vmid_gen);
+ smp_rmb(); /* Orders read of kvm_vmid_gen and kvm->arch.vmid */
+ return unlikely(READ_ONCE(kvm->arch.vmid_gen) != current_vmid_gen);
}
/**
@@ -499,16 +501,11 @@ static void update_vttbr(struct kvm *kvm)
{
phys_addr_t pgd_phys;
u64 vmid, cnp = kvm_cpu_has_cnp() ? VTTBR_CNP_BIT : 0;
- bool new_gen;
- read_lock(&kvm_vmid_lock);
- new_gen = need_new_vmid_gen(kvm);
- read_unlock(&kvm_vmid_lock);
-
- if (!new_gen)
+ if (!need_new_vmid_gen(kvm))
return;
- write_lock(&kvm_vmid_lock);
+ spin_lock(&kvm_vmid_lock);
/*
* We need to re-check the vmid_gen here to ensure that if another vcpu
@@ -516,7 +513,7 @@ static void update_vttbr(struct kvm *kvm)
* use the same vmid.
*/
if (!need_new_vmid_gen(kvm)) {
- write_unlock(&kvm_vmid_lock);
+ spin_unlock(&kvm_vmid_lock);
return;
}
@@ -539,7 +536,6 @@ static void update_vttbr(struct kvm *kvm)
kvm_call_hyp(__kvm_flush_vm_context);
}
- kvm->arch.vmid_gen = atomic64_read(&kvm_vmid_gen);
kvm->arch.vmid = kvm_next_vmid;
kvm_next_vmid++;
kvm_next_vmid &= (1 << kvm_vmid_bits) - 1;
@@ -550,7 +546,10 @@ static void update_vttbr(struct kvm *kvm)
vmid = ((u64)(kvm->arch.vmid) << VTTBR_VMID_SHIFT) & VTTBR_VMID_MASK(kvm_vmid_bits);
kvm->arch.vttbr = kvm_phys_to_vttbr(pgd_phys) | vmid | cnp;
- write_unlock(&kvm_vmid_lock);
+ smp_wmb();
+ WRITE_ONCE(kvm->arch.vmid_gen, atomic64_read(&kvm_vmid_gen));
+
+ spin_unlock(&kvm_vmid_lock);
}
static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From fb544d1ca65a89f7a3895f7531221ceeed74ada7 Mon Sep 17 00:00:00 2001
From: Christoffer Dall <christoffer.dall(a)arm.com>
Date: Tue, 11 Dec 2018 13:23:57 +0100
Subject: [PATCH] KVM: arm/arm64: Fix VMID alloc race by reverting to lock-less
We recently addressed a VMID generation race by introducing a read/write
lock around accesses and updates to the vmid generation values.
However, kvm_arch_vcpu_ioctl_run() also calls need_new_vmid_gen() but
does so without taking the read lock.
As far as I can tell, this can lead to the same kind of race:
VM 0, VCPU 0 VM 0, VCPU 1
------------ ------------
update_vttbr (vmid 254)
update_vttbr (vmid 1) // roll over
read_lock(kvm_vmid_lock);
force_vm_exit()
local_irq_disable
need_new_vmid_gen == false //because vmid gen matches
enter_guest (vmid 254)
kvm_arch.vttbr = <PGD>:<VMID 1>
read_unlock(kvm_vmid_lock);
enter_guest (vmid 1)
Which results in running two VCPUs in the same VM with different VMIDs
and (even worse) other VCPUs from other VMs could now allocate clashing
VMID 254 from the new generation as long as VCPU 0 is not exiting.
Attempt to solve this by making sure vttbr is updated before another CPU
can observe the updated VMID generation.
Cc: stable(a)vger.kernel.org
Fixes: f0cf47d939d0 "KVM: arm/arm64: Close VMID generation race"
Reviewed-by: Julien Thierry <julien.thierry(a)arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall(a)arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier(a)arm.com>
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index 4adcee5fc126..d9273f972828 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -66,7 +66,7 @@ static DEFINE_PER_CPU(struct kvm_vcpu *, kvm_arm_running_vcpu);
static atomic64_t kvm_vmid_gen = ATOMIC64_INIT(1);
static u32 kvm_next_vmid;
static unsigned int kvm_vmid_bits __read_mostly;
-static DEFINE_RWLOCK(kvm_vmid_lock);
+static DEFINE_SPINLOCK(kvm_vmid_lock);
static bool vgic_present;
@@ -484,7 +484,9 @@ void force_vm_exit(const cpumask_t *mask)
*/
static bool need_new_vmid_gen(struct kvm *kvm)
{
- return unlikely(kvm->arch.vmid_gen != atomic64_read(&kvm_vmid_gen));
+ u64 current_vmid_gen = atomic64_read(&kvm_vmid_gen);
+ smp_rmb(); /* Orders read of kvm_vmid_gen and kvm->arch.vmid */
+ return unlikely(READ_ONCE(kvm->arch.vmid_gen) != current_vmid_gen);
}
/**
@@ -499,16 +501,11 @@ static void update_vttbr(struct kvm *kvm)
{
phys_addr_t pgd_phys;
u64 vmid, cnp = kvm_cpu_has_cnp() ? VTTBR_CNP_BIT : 0;
- bool new_gen;
- read_lock(&kvm_vmid_lock);
- new_gen = need_new_vmid_gen(kvm);
- read_unlock(&kvm_vmid_lock);
-
- if (!new_gen)
+ if (!need_new_vmid_gen(kvm))
return;
- write_lock(&kvm_vmid_lock);
+ spin_lock(&kvm_vmid_lock);
/*
* We need to re-check the vmid_gen here to ensure that if another vcpu
@@ -516,7 +513,7 @@ static void update_vttbr(struct kvm *kvm)
* use the same vmid.
*/
if (!need_new_vmid_gen(kvm)) {
- write_unlock(&kvm_vmid_lock);
+ spin_unlock(&kvm_vmid_lock);
return;
}
@@ -539,7 +536,6 @@ static void update_vttbr(struct kvm *kvm)
kvm_call_hyp(__kvm_flush_vm_context);
}
- kvm->arch.vmid_gen = atomic64_read(&kvm_vmid_gen);
kvm->arch.vmid = kvm_next_vmid;
kvm_next_vmid++;
kvm_next_vmid &= (1 << kvm_vmid_bits) - 1;
@@ -550,7 +546,10 @@ static void update_vttbr(struct kvm *kvm)
vmid = ((u64)(kvm->arch.vmid) << VTTBR_VMID_SHIFT) & VTTBR_VMID_MASK(kvm_vmid_bits);
kvm->arch.vttbr = kvm_phys_to_vttbr(pgd_phys) | vmid | cnp;
- write_unlock(&kvm_vmid_lock);
+ smp_wmb();
+ WRITE_ONCE(kvm->arch.vmid_gen, atomic64_read(&kvm_vmid_gen));
+
+ spin_unlock(&kvm_vmid_lock);
}
static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
The following commit fixes freezes in virtio device drivers when KVM
is nested under
VMWare Workstation/ESXi or Hyper-V. I've encountered problems running KVM
inside VMWare since upgrading to Debian 9 (currently testing 4.9.88-1+deb9u1).
d391f1207067268261add0485f0f34503539c5b0
The same issue affects 4.4.y as well. A git-bisect within my
environment stopped at
e9ea5069d9e569c32ab913c39467df32e056b3a7, where the KVM capability was added
that QEMU checks before enabling fast mmio.
Thanks,
Mike
The patch below does not apply to the 3.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From ff4dd232ec45a0e45ea69f28f069f2ab22b4908a Mon Sep 17 00:00:00 2001
From: Paul Burton <paul.burton(a)mips.com>
Date: Tue, 4 Dec 2018 23:44:12 +0000
Subject: [PATCH] MIPS: Expand MIPS32 ASIDs to 64 bits
ASIDs have always been stored as unsigned longs, ie. 32 bits on MIPS32
kernels. This is problematic because it is feasible for the ASID version
to overflow & wrap around to zero.
We currently attempt to handle this overflow by simply setting the ASID
version to 1, using asid_first_version(), but we make no attempt to
account for the fact that there may be mm_structs with stale ASIDs that
have versions which we now reuse due to the overflow & wrap around.
Encountering this requires that:
1) A struct mm_struct X is active on CPU A using ASID (V,n).
2) That mm is not used on CPU A for the length of time that it takes
for CPU A's asid_cache to overflow & wrap around to the same
version V that the mm had in step 1. During this time tasks using
the mm could either be sleeping or only scheduled on other CPUs.
3) Some other mm Y becomes active on CPU A and is allocated the same
ASID (V,n).
4) mm X now becomes active on CPU A again, and now incorrectly has the
same ASID as mm Y.
Where struct mm_struct ASIDs are represented above in the format
(version, EntryHi.ASID), and on a typical MIPS32 system version will be
24 bits wide & EntryHi.ASID will be 8 bits wide.
The length of time required in step 2 is highly dependent upon the CPU &
workload, but for a hypothetical 2GHz CPU running a workload which
generates a new ASID every 10000 cycles this period is around 248 days.
Due to this long period of time & the fact that tasks need to be
scheduled in just the right (or wrong, depending upon your inclination)
way, this is obviously a difficult bug to encounter but it's entirely
possible as evidenced by reports.
In order to fix this, simply extend ASIDs to 64 bits even on MIPS32
builds. This will extend the period of time required for the
hypothetical system above to encounter the problem from 28 days to
around 3 trillion years, which feels safely outside of the realms of
possibility.
The cost of this is slightly more generated code in some commonly
executed paths, but this is pretty minimal:
| Code Size Gain | Percentage
-----------------------|----------------|-------------
decstation_defconfig | +270 | +0.00%
32r2el_defconfig | +652 | +0.01%
32r6el_defconfig | +1000 | +0.01%
I have been unable to measure any change in performance of the LMbench
lat_ctx or lat_proc tests resulting from the 64b ASIDs on either
32r2el_defconfig+interAptiv or 32r6el_defconfig+I6500 systems.
Signed-off-by: Paul Burton <paul.burton(a)mips.com>
Suggested-by: James Hogan <jhogan(a)kernel.org>
References: https://lore.kernel.org/linux-mips/80B78A8B8FEE6145A87579E8435D78C30205D5F3…
References: https://lore.kernel.org/linux-mips/1488684260-18867-1-git-send-email-jiwei.…
Cc: Jiwei Sun <jiwei.sun(a)windriver.com>
Cc: Yu Huabing <yhb(a)ruijie.com.cn>
Cc: stable(a)vger.kernel.org # 2.6.12+
Cc: linux-mips(a)vger.kernel.org
diff --git a/arch/mips/include/asm/cpu-info.h b/arch/mips/include/asm/cpu-info.h
index a41059d47d31..ed7ffe4e63a3 100644
--- a/arch/mips/include/asm/cpu-info.h
+++ b/arch/mips/include/asm/cpu-info.h
@@ -50,7 +50,7 @@ struct guest_info {
#define MIPS_CACHE_PINDEX 0x00000020 /* Physically indexed cache */
struct cpuinfo_mips {
- unsigned long asid_cache;
+ u64 asid_cache;
#ifdef CONFIG_MIPS_ASID_BITS_VARIABLE
unsigned long asid_mask;
#endif
diff --git a/arch/mips/include/asm/mmu.h b/arch/mips/include/asm/mmu.h
index 0740be7d5d4a..24d6b42345fb 100644
--- a/arch/mips/include/asm/mmu.h
+++ b/arch/mips/include/asm/mmu.h
@@ -7,7 +7,7 @@
#include <linux/wait.h>
typedef struct {
- unsigned long asid[NR_CPUS];
+ u64 asid[NR_CPUS];
void *vdso;
atomic_t fp_mode_switching;
diff --git a/arch/mips/include/asm/mmu_context.h b/arch/mips/include/asm/mmu_context.h
index 94414561de0e..a589585be21b 100644
--- a/arch/mips/include/asm/mmu_context.h
+++ b/arch/mips/include/asm/mmu_context.h
@@ -76,14 +76,14 @@ extern unsigned long pgd_current[];
* All unused by hardware upper bits will be considered
* as a software asid extension.
*/
-static unsigned long asid_version_mask(unsigned int cpu)
+static inline u64 asid_version_mask(unsigned int cpu)
{
unsigned long asid_mask = cpu_asid_mask(&cpu_data[cpu]);
- return ~(asid_mask | (asid_mask - 1));
+ return ~(u64)(asid_mask | (asid_mask - 1));
}
-static unsigned long asid_first_version(unsigned int cpu)
+static inline u64 asid_first_version(unsigned int cpu)
{
return ~asid_version_mask(cpu) + 1;
}
@@ -102,14 +102,12 @@ static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
static inline void
get_new_mmu_context(struct mm_struct *mm, unsigned long cpu)
{
- unsigned long asid = asid_cache(cpu);
+ u64 asid = asid_cache(cpu);
if (!((asid += cpu_asid_inc()) & cpu_asid_mask(&cpu_data[cpu]))) {
if (cpu_has_vtag_icache)
flush_icache_all();
local_flush_tlb_all(); /* start new asid cycle */
- if (!asid) /* fix version if needed */
- asid = asid_first_version(cpu);
}
cpu_context(cpu, mm) = asid_cache(cpu) = asid;
diff --git a/arch/mips/mm/c-r3k.c b/arch/mips/mm/c-r3k.c
index 3466fcdae0ca..01848cdf2074 100644
--- a/arch/mips/mm/c-r3k.c
+++ b/arch/mips/mm/c-r3k.c
@@ -245,7 +245,7 @@ static void r3k_flush_cache_page(struct vm_area_struct *vma,
pmd_t *pmdp;
pte_t *ptep;
- pr_debug("cpage[%08lx,%08lx]\n",
+ pr_debug("cpage[%08llx,%08lx]\n",
cpu_context(smp_processor_id(), mm), addr);
/* No ASID => no such page in the cache. */
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From ff4dd232ec45a0e45ea69f28f069f2ab22b4908a Mon Sep 17 00:00:00 2001
From: Paul Burton <paul.burton(a)mips.com>
Date: Tue, 4 Dec 2018 23:44:12 +0000
Subject: [PATCH] MIPS: Expand MIPS32 ASIDs to 64 bits
ASIDs have always been stored as unsigned longs, ie. 32 bits on MIPS32
kernels. This is problematic because it is feasible for the ASID version
to overflow & wrap around to zero.
We currently attempt to handle this overflow by simply setting the ASID
version to 1, using asid_first_version(), but we make no attempt to
account for the fact that there may be mm_structs with stale ASIDs that
have versions which we now reuse due to the overflow & wrap around.
Encountering this requires that:
1) A struct mm_struct X is active on CPU A using ASID (V,n).
2) That mm is not used on CPU A for the length of time that it takes
for CPU A's asid_cache to overflow & wrap around to the same
version V that the mm had in step 1. During this time tasks using
the mm could either be sleeping or only scheduled on other CPUs.
3) Some other mm Y becomes active on CPU A and is allocated the same
ASID (V,n).
4) mm X now becomes active on CPU A again, and now incorrectly has the
same ASID as mm Y.
Where struct mm_struct ASIDs are represented above in the format
(version, EntryHi.ASID), and on a typical MIPS32 system version will be
24 bits wide & EntryHi.ASID will be 8 bits wide.
The length of time required in step 2 is highly dependent upon the CPU &
workload, but for a hypothetical 2GHz CPU running a workload which
generates a new ASID every 10000 cycles this period is around 248 days.
Due to this long period of time & the fact that tasks need to be
scheduled in just the right (or wrong, depending upon your inclination)
way, this is obviously a difficult bug to encounter but it's entirely
possible as evidenced by reports.
In order to fix this, simply extend ASIDs to 64 bits even on MIPS32
builds. This will extend the period of time required for the
hypothetical system above to encounter the problem from 28 days to
around 3 trillion years, which feels safely outside of the realms of
possibility.
The cost of this is slightly more generated code in some commonly
executed paths, but this is pretty minimal:
| Code Size Gain | Percentage
-----------------------|----------------|-------------
decstation_defconfig | +270 | +0.00%
32r2el_defconfig | +652 | +0.01%
32r6el_defconfig | +1000 | +0.01%
I have been unable to measure any change in performance of the LMbench
lat_ctx or lat_proc tests resulting from the 64b ASIDs on either
32r2el_defconfig+interAptiv or 32r6el_defconfig+I6500 systems.
Signed-off-by: Paul Burton <paul.burton(a)mips.com>
Suggested-by: James Hogan <jhogan(a)kernel.org>
References: https://lore.kernel.org/linux-mips/80B78A8B8FEE6145A87579E8435D78C30205D5F3…
References: https://lore.kernel.org/linux-mips/1488684260-18867-1-git-send-email-jiwei.…
Cc: Jiwei Sun <jiwei.sun(a)windriver.com>
Cc: Yu Huabing <yhb(a)ruijie.com.cn>
Cc: stable(a)vger.kernel.org # 2.6.12+
Cc: linux-mips(a)vger.kernel.org
diff --git a/arch/mips/include/asm/cpu-info.h b/arch/mips/include/asm/cpu-info.h
index a41059d47d31..ed7ffe4e63a3 100644
--- a/arch/mips/include/asm/cpu-info.h
+++ b/arch/mips/include/asm/cpu-info.h
@@ -50,7 +50,7 @@ struct guest_info {
#define MIPS_CACHE_PINDEX 0x00000020 /* Physically indexed cache */
struct cpuinfo_mips {
- unsigned long asid_cache;
+ u64 asid_cache;
#ifdef CONFIG_MIPS_ASID_BITS_VARIABLE
unsigned long asid_mask;
#endif
diff --git a/arch/mips/include/asm/mmu.h b/arch/mips/include/asm/mmu.h
index 0740be7d5d4a..24d6b42345fb 100644
--- a/arch/mips/include/asm/mmu.h
+++ b/arch/mips/include/asm/mmu.h
@@ -7,7 +7,7 @@
#include <linux/wait.h>
typedef struct {
- unsigned long asid[NR_CPUS];
+ u64 asid[NR_CPUS];
void *vdso;
atomic_t fp_mode_switching;
diff --git a/arch/mips/include/asm/mmu_context.h b/arch/mips/include/asm/mmu_context.h
index 94414561de0e..a589585be21b 100644
--- a/arch/mips/include/asm/mmu_context.h
+++ b/arch/mips/include/asm/mmu_context.h
@@ -76,14 +76,14 @@ extern unsigned long pgd_current[];
* All unused by hardware upper bits will be considered
* as a software asid extension.
*/
-static unsigned long asid_version_mask(unsigned int cpu)
+static inline u64 asid_version_mask(unsigned int cpu)
{
unsigned long asid_mask = cpu_asid_mask(&cpu_data[cpu]);
- return ~(asid_mask | (asid_mask - 1));
+ return ~(u64)(asid_mask | (asid_mask - 1));
}
-static unsigned long asid_first_version(unsigned int cpu)
+static inline u64 asid_first_version(unsigned int cpu)
{
return ~asid_version_mask(cpu) + 1;
}
@@ -102,14 +102,12 @@ static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
static inline void
get_new_mmu_context(struct mm_struct *mm, unsigned long cpu)
{
- unsigned long asid = asid_cache(cpu);
+ u64 asid = asid_cache(cpu);
if (!((asid += cpu_asid_inc()) & cpu_asid_mask(&cpu_data[cpu]))) {
if (cpu_has_vtag_icache)
flush_icache_all();
local_flush_tlb_all(); /* start new asid cycle */
- if (!asid) /* fix version if needed */
- asid = asid_first_version(cpu);
}
cpu_context(cpu, mm) = asid_cache(cpu) = asid;
diff --git a/arch/mips/mm/c-r3k.c b/arch/mips/mm/c-r3k.c
index 3466fcdae0ca..01848cdf2074 100644
--- a/arch/mips/mm/c-r3k.c
+++ b/arch/mips/mm/c-r3k.c
@@ -245,7 +245,7 @@ static void r3k_flush_cache_page(struct vm_area_struct *vma,
pmd_t *pmdp;
pte_t *ptep;
- pr_debug("cpage[%08lx,%08lx]\n",
+ pr_debug("cpage[%08llx,%08lx]\n",
cpu_context(smp_processor_id(), mm), addr);
/* No ASID => no such page in the cache. */
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From ff4dd232ec45a0e45ea69f28f069f2ab22b4908a Mon Sep 17 00:00:00 2001
From: Paul Burton <paul.burton(a)mips.com>
Date: Tue, 4 Dec 2018 23:44:12 +0000
Subject: [PATCH] MIPS: Expand MIPS32 ASIDs to 64 bits
ASIDs have always been stored as unsigned longs, ie. 32 bits on MIPS32
kernels. This is problematic because it is feasible for the ASID version
to overflow & wrap around to zero.
We currently attempt to handle this overflow by simply setting the ASID
version to 1, using asid_first_version(), but we make no attempt to
account for the fact that there may be mm_structs with stale ASIDs that
have versions which we now reuse due to the overflow & wrap around.
Encountering this requires that:
1) A struct mm_struct X is active on CPU A using ASID (V,n).
2) That mm is not used on CPU A for the length of time that it takes
for CPU A's asid_cache to overflow & wrap around to the same
version V that the mm had in step 1. During this time tasks using
the mm could either be sleeping or only scheduled on other CPUs.
3) Some other mm Y becomes active on CPU A and is allocated the same
ASID (V,n).
4) mm X now becomes active on CPU A again, and now incorrectly has the
same ASID as mm Y.
Where struct mm_struct ASIDs are represented above in the format
(version, EntryHi.ASID), and on a typical MIPS32 system version will be
24 bits wide & EntryHi.ASID will be 8 bits wide.
The length of time required in step 2 is highly dependent upon the CPU &
workload, but for a hypothetical 2GHz CPU running a workload which
generates a new ASID every 10000 cycles this period is around 248 days.
Due to this long period of time & the fact that tasks need to be
scheduled in just the right (or wrong, depending upon your inclination)
way, this is obviously a difficult bug to encounter but it's entirely
possible as evidenced by reports.
In order to fix this, simply extend ASIDs to 64 bits even on MIPS32
builds. This will extend the period of time required for the
hypothetical system above to encounter the problem from 28 days to
around 3 trillion years, which feels safely outside of the realms of
possibility.
The cost of this is slightly more generated code in some commonly
executed paths, but this is pretty minimal:
| Code Size Gain | Percentage
-----------------------|----------------|-------------
decstation_defconfig | +270 | +0.00%
32r2el_defconfig | +652 | +0.01%
32r6el_defconfig | +1000 | +0.01%
I have been unable to measure any change in performance of the LMbench
lat_ctx or lat_proc tests resulting from the 64b ASIDs on either
32r2el_defconfig+interAptiv or 32r6el_defconfig+I6500 systems.
Signed-off-by: Paul Burton <paul.burton(a)mips.com>
Suggested-by: James Hogan <jhogan(a)kernel.org>
References: https://lore.kernel.org/linux-mips/80B78A8B8FEE6145A87579E8435D78C30205D5F3…
References: https://lore.kernel.org/linux-mips/1488684260-18867-1-git-send-email-jiwei.…
Cc: Jiwei Sun <jiwei.sun(a)windriver.com>
Cc: Yu Huabing <yhb(a)ruijie.com.cn>
Cc: stable(a)vger.kernel.org # 2.6.12+
Cc: linux-mips(a)vger.kernel.org
diff --git a/arch/mips/include/asm/cpu-info.h b/arch/mips/include/asm/cpu-info.h
index a41059d47d31..ed7ffe4e63a3 100644
--- a/arch/mips/include/asm/cpu-info.h
+++ b/arch/mips/include/asm/cpu-info.h
@@ -50,7 +50,7 @@ struct guest_info {
#define MIPS_CACHE_PINDEX 0x00000020 /* Physically indexed cache */
struct cpuinfo_mips {
- unsigned long asid_cache;
+ u64 asid_cache;
#ifdef CONFIG_MIPS_ASID_BITS_VARIABLE
unsigned long asid_mask;
#endif
diff --git a/arch/mips/include/asm/mmu.h b/arch/mips/include/asm/mmu.h
index 0740be7d5d4a..24d6b42345fb 100644
--- a/arch/mips/include/asm/mmu.h
+++ b/arch/mips/include/asm/mmu.h
@@ -7,7 +7,7 @@
#include <linux/wait.h>
typedef struct {
- unsigned long asid[NR_CPUS];
+ u64 asid[NR_CPUS];
void *vdso;
atomic_t fp_mode_switching;
diff --git a/arch/mips/include/asm/mmu_context.h b/arch/mips/include/asm/mmu_context.h
index 94414561de0e..a589585be21b 100644
--- a/arch/mips/include/asm/mmu_context.h
+++ b/arch/mips/include/asm/mmu_context.h
@@ -76,14 +76,14 @@ extern unsigned long pgd_current[];
* All unused by hardware upper bits will be considered
* as a software asid extension.
*/
-static unsigned long asid_version_mask(unsigned int cpu)
+static inline u64 asid_version_mask(unsigned int cpu)
{
unsigned long asid_mask = cpu_asid_mask(&cpu_data[cpu]);
- return ~(asid_mask | (asid_mask - 1));
+ return ~(u64)(asid_mask | (asid_mask - 1));
}
-static unsigned long asid_first_version(unsigned int cpu)
+static inline u64 asid_first_version(unsigned int cpu)
{
return ~asid_version_mask(cpu) + 1;
}
@@ -102,14 +102,12 @@ static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
static inline void
get_new_mmu_context(struct mm_struct *mm, unsigned long cpu)
{
- unsigned long asid = asid_cache(cpu);
+ u64 asid = asid_cache(cpu);
if (!((asid += cpu_asid_inc()) & cpu_asid_mask(&cpu_data[cpu]))) {
if (cpu_has_vtag_icache)
flush_icache_all();
local_flush_tlb_all(); /* start new asid cycle */
- if (!asid) /* fix version if needed */
- asid = asid_first_version(cpu);
}
cpu_context(cpu, mm) = asid_cache(cpu) = asid;
diff --git a/arch/mips/mm/c-r3k.c b/arch/mips/mm/c-r3k.c
index 3466fcdae0ca..01848cdf2074 100644
--- a/arch/mips/mm/c-r3k.c
+++ b/arch/mips/mm/c-r3k.c
@@ -245,7 +245,7 @@ static void r3k_flush_cache_page(struct vm_area_struct *vma,
pmd_t *pmdp;
pte_t *ptep;
- pr_debug("cpage[%08lx,%08lx]\n",
+ pr_debug("cpage[%08llx,%08lx]\n",
cpu_context(smp_processor_id(), mm), addr);
/* No ASID => no such page in the cache. */
The patch below does not apply to the 3.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 0ea295dd853e0879a9a30ab61f923c26be35b902 Mon Sep 17 00:00:00 2001
From: Pan Bian <bianpan2016(a)163.com>
Date: Thu, 22 Nov 2018 18:58:46 +0800
Subject: [PATCH] f2fs: read page index before freeing
The function truncate_node frees the page with f2fs_put_page. However,
the page index is read after that. So, the patch reads the index before
freeing the page.
Fixes: bf39c00a9a7f ("f2fs: drop obsolete node page when it is truncated")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Pan Bian <bianpan2016(a)163.com>
Reviewed-by: Chao Yu <yuchao0(a)huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org>
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index e60c7779e114..a2273340991f 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -826,6 +826,7 @@ static int truncate_node(struct dnode_of_data *dn)
struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode);
struct node_info ni;
int err;
+ pgoff_t index;
err = f2fs_get_node_info(sbi, dn->nid, &ni);
if (err)
@@ -845,10 +846,11 @@ static int truncate_node(struct dnode_of_data *dn)
clear_node_page_dirty(dn->node_page);
set_sbi_flag(sbi, SBI_IS_DIRTY);
+ index = dn->node_page->index;
f2fs_put_page(dn->node_page, 1);
invalidate_mapping_pages(NODE_MAPPING(sbi),
- dn->node_page->index, dn->node_page->index);
+ index, index);
dn->node_page = NULL;
trace_f2fs_truncate_node(dn->inode, dn->nid, ni.blk_addr);
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 0ea295dd853e0879a9a30ab61f923c26be35b902 Mon Sep 17 00:00:00 2001
From: Pan Bian <bianpan2016(a)163.com>
Date: Thu, 22 Nov 2018 18:58:46 +0800
Subject: [PATCH] f2fs: read page index before freeing
The function truncate_node frees the page with f2fs_put_page. However,
the page index is read after that. So, the patch reads the index before
freeing the page.
Fixes: bf39c00a9a7f ("f2fs: drop obsolete node page when it is truncated")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Pan Bian <bianpan2016(a)163.com>
Reviewed-by: Chao Yu <yuchao0(a)huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org>
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index e60c7779e114..a2273340991f 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -826,6 +826,7 @@ static int truncate_node(struct dnode_of_data *dn)
struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode);
struct node_info ni;
int err;
+ pgoff_t index;
err = f2fs_get_node_info(sbi, dn->nid, &ni);
if (err)
@@ -845,10 +846,11 @@ static int truncate_node(struct dnode_of_data *dn)
clear_node_page_dirty(dn->node_page);
set_sbi_flag(sbi, SBI_IS_DIRTY);
+ index = dn->node_page->index;
f2fs_put_page(dn->node_page, 1);
invalidate_mapping_pages(NODE_MAPPING(sbi),
- dn->node_page->index, dn->node_page->index);
+ index, index);
dn->node_page = NULL;
trace_f2fs_truncate_node(dn->inode, dn->nid, ni.blk_addr);
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 0ea295dd853e0879a9a30ab61f923c26be35b902 Mon Sep 17 00:00:00 2001
From: Pan Bian <bianpan2016(a)163.com>
Date: Thu, 22 Nov 2018 18:58:46 +0800
Subject: [PATCH] f2fs: read page index before freeing
The function truncate_node frees the page with f2fs_put_page. However,
the page index is read after that. So, the patch reads the index before
freeing the page.
Fixes: bf39c00a9a7f ("f2fs: drop obsolete node page when it is truncated")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Pan Bian <bianpan2016(a)163.com>
Reviewed-by: Chao Yu <yuchao0(a)huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org>
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index e60c7779e114..a2273340991f 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -826,6 +826,7 @@ static int truncate_node(struct dnode_of_data *dn)
struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode);
struct node_info ni;
int err;
+ pgoff_t index;
err = f2fs_get_node_info(sbi, dn->nid, &ni);
if (err)
@@ -845,10 +846,11 @@ static int truncate_node(struct dnode_of_data *dn)
clear_node_page_dirty(dn->node_page);
set_sbi_flag(sbi, SBI_IS_DIRTY);
+ index = dn->node_page->index;
f2fs_put_page(dn->node_page, 1);
invalidate_mapping_pages(NODE_MAPPING(sbi),
- dn->node_page->index, dn->node_page->index);
+ index, index);
dn->node_page = NULL;
trace_f2fs_truncate_node(dn->inode, dn->nid, ni.blk_addr);
From: Ubuntu <ubuntu(a)petilil.segmaas.1ss>
[changelog]
- v2: include patch 5/5 (a very recent fix to patch 4/5) which is
not yet in Linus's tree but it's in nf.git + linux-next.git,
thus should make it shortly. Test results still consistent.
Thanks Florian Westphal for reviewing and pointing that out.
Recently, Alakesh Haloi reported the following issue [1] with stable/4.14:
"""
An iptable rule like the following on a multicore systems will result in
accepting more connections than set in the rule.
iptables -A INPUT -p tcp -m tcp --syn --dport 7777 -m connlimit \
--connlimit-above 2000 --connlimit-mask 0 -j DROP
"""
And proposed a fix that is not in Linus's tree. The discussion went on to
confirm whether the issue was still reproducible with mainline/nf.git tip,
and to either identify the upstream fix or re-submit the non-upstream fix.
Alakesh eventually was able to test with upstream, and reported that issue
was still reproducible [2].
On that, our findinds diverge, at least in my test environment:
First, I verified that the suggested mainline fix for the issue [3] indeed
fixes it, by testing with it applied and reverted on v4.18, a clean revert.
(The issue is reproducible with the commit reverted).
Then, with a consistent reproducer, I moved to nf.git, with HEAD on commit
a007232 ("netfilter: nf_conncount: fix argument order to find_next_bit"),
and the issues was not reproducible (even with 20+ threads on client side,
the number Alakesh reported to achieve 2150+ connections [4], and I tried
spreading the network interface IRQ affinity over more and more CPUs too.)
Either way, the suggested mainline fix does actually fix the issue in 4.14
for at least one environment. So, it might well be the case that Alakesh's
test environment has differences/subtleties that leads to more connections
accepted, and more commits are needed for that particular environment type.
(v2 update: see Florian's reply to v1 thread [1]; these different results
are probably explained by very recent fixes still missing back then.)
But for now, with one bare-metal environment (24-core server, 4-core client)
verified, I thought of submitting the patches for review/comments/testing,
then looking for additional fixes for that environment separately.
The fix is PATCH 4 (needs fix in PATCH 5), and PATCHes 1-3 are helpers for
a cleaner backport.
All backports are simple, and essentially consist of refresh context lines
and use older struct/file names.
Reviews from netfilter maintainers are very appreciated, as I've no previous
experience in this area, and although the backports look simple and build/run
correctly, there's usually stuff that only more experienced people may notice.
Thanks,
Mauricio
Links:
=====
[1] https://www.spinics.net/lists/stable/msg270040.html
[2] https://www.spinics.net/lists/stable/msg273669.html
[3] https://www.spinics.net/lists/stable/msg271300.html
[4] https://www.spinics.net/lists/stable/msg273669.html
[5] https://www.spinics.net/lists/stable/msg276883.html
Test-case:
=========
- v4.14.91 (original): client achieves 2000+ connections (6000 target)
with 3 threads.
server # iptables -F
server # iptables -A INPUT -p tcp -m tcp --syn --dport 7777 -m connlimit --connlimit-above 2000 --connlimit-mask 0 -j DROP
server # iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
DROP tcp -- anywhere anywhere tcp dpt:7777 flags:FIN,SYN,RST,ACK/SYN #conn src/0 > 2000
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
server # ulimit -SHn 65000
server # ruby server.rb
<... listening ...>
client # ulimit -SHn 65000
client # ruby client.rb 10.230.56.100 7777 6000 3
Connecting to ["10.230.56.100"]:7777 6000 times with 3
1
2
3
<...>
2000
<...>
6000
Target reached. Thread finishing
6001
Target reached. Thread finishing
6002
Target reached. Thread finishing
Threads done. 6002 connections
press enter to exit
- v4.14.91 + patches: client only achieved 2000 connections.
server # (same procedure)
client # (same procedure)
Connecting to ["10.230.56.100"]:7777 6000 times with 3
1
2
3
<...>
2000
<... blocked for a while...>
failed to create connection: Connection timed out - connect(2) for "10.230.56.100" port 7777
failed to create connection: Connection timed out - connect(2) for "10.230.56.100" port 7777
failed to create connection: Connection timed out - connect(2) for "10.230.56.100" port 7777
Threads done. 2000 connections
press enter to exit
Florian Westphal (3):
netfilter: xt_connlimit: don't store address in the conn nodes
netfilter: nf_conncount: fix garbage collection confirm race
netfilter: nf_conncount: don't skip eviction when age is negative
Pablo Neira Ayuso (1):
netfilter: nf_conncount: expose connection list interface
Yi-Hung Wei (1):
netfilter: nf_conncount: Fix garbage collection with zones
include/net/netfilter/nf_conntrack_count.h | 15 +++++
net/netfilter/xt_connlimit.c | 99 +++++++++++++++++++++++-------
2 files changed, 91 insertions(+), 23 deletions(-)
create mode 100644 include/net/netfilter/nf_conntrack_count.h
--
2.7.4
The original upstream fix, commit 55e56f06ed71 "dax: Don't access a freed
inode", prompted an immediate cleanup request. Now that the cleanup has
landed, commit d8a706414af4 "dax: Use non-exclusive wait in
wait_entry_unlocked()", backport them both to -stable.
---
Dan Williams (1):
dax: Use non-exclusive wait in wait_entry_unlocked()
Matthew Wilcox (1):
dax: Don't access a freed inode
fs/dax.c | 69 ++++++++++++++++++++++++++++----------------------------------
1 file changed, 31 insertions(+), 38 deletions(-)
On Sun, Jan 6, 2019 at 4:58 AM Sebastian Kemper <sebastian_ml(a)gmx.net> wrote:
> Sorry for probably breaking the thread. This is really in reply to Paul
> Aubrich's patch titled "smb3: fix large reads on encrypted connections".
> I browsed linux-cifs and found Paul's patch. With the patch applied the
> problem is gone, kernel 4.19 works like 4.9 did without encryption.
>
> The patch title suggests that only large reads are not working. Well,
> considering the cutoff is between 13K and 17K I'd say that encryption on
> 4.19 for cifs can be considered broken without this patch. It'd be cool
> if this could make it to stable kernels pronto.
Yes - it is a a very important patch, and is merged in and marked for stable
(for 4.19 and 4.20 kernels). Hopefully can be included soon.
The good news though is that with the improved test automation that
Paulo/Aurelien/Ronnie have been doing, we have added more to
the automated xfstests run before checkin and more importantly
added various different mount configrations that are much
broader (used to be only a very small set that ran) and so would have
caught this (and also other regressions that had made it through over the
past couple years).
Now our next challenge is figuring out how to get automated tests for smb3
to run reasonably regularly against some of the stable kernels and also against
the full backports of cifs.ko to earlier kernels etc. which some need to get the
many security, performance and functional improvements over the past year.
--
Thanks,
Steve
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 18f2c4fcebf2582f96cbd5f2238f4f354a0e4847 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso(a)mit.edu>
Date: Wed, 19 Dec 2018 14:36:58 -0500
Subject: [PATCH] ext4: check for shutdown and r/o file system in
ext4_write_inode()
If the file system has been shut down or is read-only, then
ext4_write_inode() needs to bail out early.
Also use jbd2_complete_transaction() instead of ext4_force_commit() so
we only force a commit if it is needed.
Signed-off-by: Theodore Ts'o <tytso(a)mit.edu>
Cc: stable(a)kernel.org
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 664b434ba836..9affabd07682 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5400,9 +5400,13 @@ int ext4_write_inode(struct inode *inode, struct writeback_control *wbc)
{
int err;
- if (WARN_ON_ONCE(current->flags & PF_MEMALLOC))
+ if (WARN_ON_ONCE(current->flags & PF_MEMALLOC) ||
+ sb_rdonly(inode->i_sb))
return 0;
+ if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb))))
+ return -EIO;
+
if (EXT4_SB(inode->i_sb)->s_journal) {
if (ext4_journal_current_handle()) {
jbd_debug(1, "called recursively, non-PF_MEMALLOC!\n");
@@ -5418,7 +5422,8 @@ int ext4_write_inode(struct inode *inode, struct writeback_control *wbc)
if (wbc->sync_mode != WB_SYNC_ALL || wbc->for_sync)
return 0;
- err = ext4_force_commit(inode->i_sb);
+ err = jbd2_complete_transaction(EXT4_SB(inode->i_sb)->s_journal,
+ EXT4_I(inode)->i_sync_tid);
} else {
struct ext4_iloc iloc;
Hi,
[This is an automated email]
This commit has been processed because it contains a "Fixes:" tag,
fixing commit: 277e4ab7d530 SUNRPC: Simplify TCP receive code by switching to using iterators.
The bot has tested the following trees: v4.20.0,
v4.20.0: Build failed! Errors:
net/sunrpc/xprtsock.c:396:24: error: ‘struct bio_vec’ has no member named ‘page’; did you mean ‘bv_page’?
How should we proceed with this patch?
--
Thanks,
Sasha
On Tue, Dec 11, 2018 at 03:29:31PM -0500, Dietmar May wrote:
>Sasha,
>
>I've verified that 4.9.143 no longer exhibits this problem.
Thanks for confirming!
>The revert hasn't shown up in 4.4 yet; but I'll verify once merged there.
There was no 4.4 release yet; it's coming, I promise :)
--
Thanks,
Sasha
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 0568e82dbe2510fc1fa664f58e5c997d3f1e649e Mon Sep 17 00:00:00 2001
From: Josef Bacik <jbacik(a)fb.com>
Date: Fri, 30 Nov 2018 11:52:14 -0500
Subject: [PATCH] btrfs: run delayed items before dropping the snapshot
With my delayed refs patches in place we started seeing a large amount
of aborts in __btrfs_free_extent:
BTRFS error (device sdb1): unable to find ref byte nr 91947008 parent 0 root 35964 owner 1 offset 0
Call Trace:
? btrfs_merge_delayed_refs+0xaf/0x340
__btrfs_run_delayed_refs+0x6ea/0xfc0
? btrfs_set_path_blocking+0x31/0x60
btrfs_run_delayed_refs+0xeb/0x180
btrfs_commit_transaction+0x179/0x7f0
? btrfs_check_space_for_delayed_refs+0x30/0x50
? should_end_transaction.isra.19+0xe/0x40
btrfs_drop_snapshot+0x41c/0x7c0
btrfs_clean_one_deleted_snapshot+0xb5/0xd0
cleaner_kthread+0xf6/0x120
kthread+0xf8/0x130
? btree_invalidatepage+0x90/0x90
? kthread_bind+0x10/0x10
ret_from_fork+0x35/0x40
This was because btrfs_drop_snapshot depends on the root not being
modified while it's dropping the snapshot. It will unlock the root node
(and really every node) as it walks down the tree, only to re-lock it
when it needs to do something. This is a problem because if we modify
the tree we could cow a block in our path, which frees our reference to
that block. Then once we get back to that shared block we'll free our
reference to it again, and get ENOENT when trying to lookup our extent
reference to that block in __btrfs_free_extent.
This is ultimately happening because we have delayed items left to be
processed for our deleted snapshot _after_ all of the inodes are closed
for the snapshot. We only run the delayed inode item if we're deleting
the inode, and even then we do not run the delayed insertions or delayed
removals. These can be run at any point after our final inode does its
last iput, which is what triggers the snapshot deletion. We can end up
with the snapshot deletion happening and then have the delayed items run
on that file system, resulting in the above problem.
This problem has existed forever, however my patches made it much easier
to hit as I wake up the cleaner much more often to deal with delayed
iputs, which made us more likely to start the snapshot dropping work
before the transaction commits, which is when the delayed items would
generally be run. Before, generally speaking, we would run the delayed
items, commit the transaction, and wakeup the cleaner thread to start
deleting snapshots, which means we were less likely to hit this problem.
You could still hit it if you had multiple snapshots to be deleted and
ended up with lots of delayed items, but it was definitely harder.
Fix for now by simply running all the delayed items before starting to
drop the snapshot. We could make this smarter in the future by making
the delayed items per-root, and then simply drop any delayed items for
roots that we are going to delete. But for now just a quick and easy
solution is the safest.
CC: stable(a)vger.kernel.org # 4.4+
Reviewed-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: Josef Bacik <josef(a)toxicpanda.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index de21e0c93eb6..8a9ce33dfdbc 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -9272,6 +9272,10 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
goto out_free;
}
+ err = btrfs_run_delayed_items(trans);
+ if (err)
+ goto out_end_trans;
+
if (block_rsv)
trans->block_rsv = block_rsv;
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 41bd60676923822de1df2c50b3f9a10171f4338a Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Wed, 28 Nov 2018 14:54:28 +0000
Subject: [PATCH] Btrfs: fix fsync of files with multiple hard links in new
directories
The log tree has a long standing problem that when a file is fsync'ed we
only check for new ancestors, created in the current transaction, by
following only the hard link for which the fsync was issued. We follow the
ancestors using the VFS' dget_parent() API. This means that if we create a
new link for a file in a directory that is new (or in an any other new
ancestor directory) and then fsync the file using an old hard link, we end
up not logging the new ancestor, and on log replay that new hard link and
ancestor do not exist. In some cases, involving renames, the file will not
exist at all.
Example:
mkfs.btrfs -f /dev/sdb
mount /dev/sdb /mnt
mkdir /mnt/A
touch /mnt/foo
ln /mnt/foo /mnt/A/bar
xfs_io -c fsync /mnt/foo
<power failure>
In this example after log replay only the hard link named 'foo' exists
and directory A does not exist, which is unexpected. In other major linux
filesystems, such as ext4, xfs and f2fs for example, both hard links exist
and so does directory A after mounting again the filesystem.
Checking if any new ancestors are new and need to be logged was added in
2009 by commit 12fcfd22fe5b ("Btrfs: tree logging unlink/rename fixes"),
however only for the ancestors of the hard link (dentry) for which the
fsync was issued, instead of checking for all ancestors for all of the
inode's hard links.
So fix this by tracking the id of the last transaction where a hard link
was created for an inode and then on fsync fallback to a full transaction
commit when an inode has more than one hard link and at least one new hard
link was created in the current transaction. This is the simplest solution
since this is not a common use case (adding frequently hard links for
which there's an ancestor created in the current transaction and then
fsync the file). In case it ever becomes a common use case, a solution
that consists of iterating the fs/subvol btree for each hard link and
check if any ancestor is new, could be implemented.
This solves many unexpected scenarios reported by Jayashree Mohan and
Vijay Chidambaram, and for which there is a new test case for fstests
under review.
Fixes: 12fcfd22fe5b ("Btrfs: tree logging unlink/rename fixes")
CC: stable(a)vger.kernel.org # 4.4+
Reported-by: Vijay Chidambaram <vvijay03(a)gmail.com>
Reported-by: Jayashree Mohan <jayashree2912(a)gmail.com>
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
index fc25607304f2..6f5d07415dab 100644
--- a/fs/btrfs/btrfs_inode.h
+++ b/fs/btrfs/btrfs_inode.h
@@ -147,6 +147,12 @@ struct btrfs_inode {
*/
u64 last_unlink_trans;
+ /*
+ * Track the transaction id of the last transaction used to create a
+ * hard link for the inode. This is used by the log tree (fsync).
+ */
+ u64 last_link_trans;
+
/*
* Number of bytes outstanding that are going to need csums. This is
* used in ENOSPC accounting.
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index d54bdef16d8d..b4129d9072ec 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3658,6 +3658,21 @@ static int btrfs_read_locked_inode(struct inode *inode,
* inode is not a directory, logging its parent unnecessarily.
*/
BTRFS_I(inode)->last_unlink_trans = BTRFS_I(inode)->last_trans;
+ /*
+ * Similar reasoning for last_link_trans, needs to be set otherwise
+ * for a case like the following:
+ *
+ * mkdir A
+ * touch foo
+ * ln foo A/bar
+ * echo 2 > /proc/sys/vm/drop_caches
+ * fsync foo
+ * <power failure>
+ *
+ * Would result in link bar and directory A not existing after the power
+ * failure.
+ */
+ BTRFS_I(inode)->last_link_trans = BTRFS_I(inode)->last_trans;
path->slots[0]++;
if (inode->i_nlink != 1 ||
@@ -6597,6 +6612,7 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
if (err)
goto fail;
}
+ BTRFS_I(inode)->last_link_trans = trans->transid;
d_instantiate(dentry, inode);
ret = btrfs_log_new_name(trans, BTRFS_I(inode), NULL, parent,
true, NULL);
@@ -9123,6 +9139,7 @@ struct inode *btrfs_alloc_inode(struct super_block *sb)
ei->index_cnt = (u64)-1;
ei->dir_index = 0;
ei->last_unlink_trans = 0;
+ ei->last_link_trans = 0;
ei->last_log_commit = 0;
spin_lock_init(&ei->lock);
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 013d0abcd46b..5baad9bebc62 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -5758,6 +5758,22 @@ static int btrfs_log_inode_parent(struct btrfs_trans_handle *trans,
goto end_trans;
}
+ /*
+ * If a new hard link was added to the inode in the current transaction
+ * and its link count is now greater than 1, we need to fallback to a
+ * transaction commit, otherwise we can end up not logging all its new
+ * parents for all the hard links. Here just from the dentry used to
+ * fsync, we can not visit the ancestor inodes for all the other hard
+ * links to figure out if any is new, so we fallback to a transaction
+ * commit (instead of adding a lot of complexity of scanning a btree,
+ * since this scenario is not a common use case).
+ */
+ if (inode->vfs_inode.i_nlink > 1 &&
+ inode->last_link_trans > last_committed) {
+ ret = -EMLINK;
+ goto end_trans;
+ }
+
while (1) {
if (!parent || d_really_is_negative(parent) || sb != parent->d_sb)
break;
The patch below does not apply to the 4.20-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 9349e23907be1954ccdf6d771d640e2788da1643 Mon Sep 17 00:00:00 2001
From: "Dmitry V. Levin" <ldv(a)altlinux.org>
Date: Thu, 1 Nov 2018 14:03:08 +0300
Subject: [PATCH] uapi: fix linux/kfd_ioctl.h userspace compilation errors
Consistently use types provided by <linux/types.h> via <drm/drm.h>
to fix the following linux/kfd_ioctl.h userspace compilation errors:
/usr/include/linux/kfd_ioctl.h:250:2: error: unknown type name 'uint32_t'
uint32_t reset_type;
/usr/include/linux/kfd_ioctl.h:251:2: error: unknown type name 'uint32_t'
uint32_t reset_cause;
/usr/include/linux/kfd_ioctl.h:252:2: error: unknown type name 'uint32_t'
uint32_t memory_lost;
/usr/include/linux/kfd_ioctl.h:253:2: error: unknown type name 'uint32_t'
uint32_t gpu_id;
Fixes: 0c119abad7f0d ("drm/amd: Add kfd ioctl defines for hw_exception event")
Cc: <stable(a)vger.kernel.org> # v4.19
Signed-off-by: Dmitry V. Levin <ldv(a)altlinux.org>
Reviewed-by: Felix Kuehling <Felix.Kuehling(a)amd.com>
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
diff --git a/include/uapi/linux/kfd_ioctl.h b/include/uapi/linux/kfd_ioctl.h
index f5ff8a76e208..dae897f38e59 100644
--- a/include/uapi/linux/kfd_ioctl.h
+++ b/include/uapi/linux/kfd_ioctl.h
@@ -255,10 +255,10 @@ struct kfd_hsa_memory_exception_data {
/* hw exception data */
struct kfd_hsa_hw_exception_data {
- uint32_t reset_type;
- uint32_t reset_cause;
- uint32_t memory_lost;
- uint32_t gpu_id;
+ __u32 reset_type;
+ __u32 reset_cause;
+ __u32 memory_lost;
+ __u32 gpu_id;
};
/* Event data */
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 9349e23907be1954ccdf6d771d640e2788da1643 Mon Sep 17 00:00:00 2001
From: "Dmitry V. Levin" <ldv(a)altlinux.org>
Date: Thu, 1 Nov 2018 14:03:08 +0300
Subject: [PATCH] uapi: fix linux/kfd_ioctl.h userspace compilation errors
Consistently use types provided by <linux/types.h> via <drm/drm.h>
to fix the following linux/kfd_ioctl.h userspace compilation errors:
/usr/include/linux/kfd_ioctl.h:250:2: error: unknown type name 'uint32_t'
uint32_t reset_type;
/usr/include/linux/kfd_ioctl.h:251:2: error: unknown type name 'uint32_t'
uint32_t reset_cause;
/usr/include/linux/kfd_ioctl.h:252:2: error: unknown type name 'uint32_t'
uint32_t memory_lost;
/usr/include/linux/kfd_ioctl.h:253:2: error: unknown type name 'uint32_t'
uint32_t gpu_id;
Fixes: 0c119abad7f0d ("drm/amd: Add kfd ioctl defines for hw_exception event")
Cc: <stable(a)vger.kernel.org> # v4.19
Signed-off-by: Dmitry V. Levin <ldv(a)altlinux.org>
Reviewed-by: Felix Kuehling <Felix.Kuehling(a)amd.com>
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
diff --git a/include/uapi/linux/kfd_ioctl.h b/include/uapi/linux/kfd_ioctl.h
index f5ff8a76e208..dae897f38e59 100644
--- a/include/uapi/linux/kfd_ioctl.h
+++ b/include/uapi/linux/kfd_ioctl.h
@@ -255,10 +255,10 @@ struct kfd_hsa_memory_exception_data {
/* hw exception data */
struct kfd_hsa_hw_exception_data {
- uint32_t reset_type;
- uint32_t reset_cause;
- uint32_t memory_lost;
- uint32_t gpu_id;
+ __u32 reset_type;
+ __u32 reset_cause;
+ __u32 memory_lost;
+ __u32 gpu_id;
};
/* Event data */
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 2cd4bd192ee94848695c1c052d87913260e10f36 Mon Sep 17 00:00:00 2001
From: Ram Pai <linuxram(a)us.ibm.com>
Date: Thu, 20 Dec 2018 12:03:30 -0800
Subject: [PATCH] powerpc/pkeys: Fix handling of pkey state across fork()
Protection key tracking information is not copied over to the
mm_struct of the child during fork(). This can cause the child to
erroneously allocate keys that were already allocated. Any allocated
execute-only key is lost aswell.
Add code; called by dup_mmap(), to copy the pkey state from parent to
child explicitly.
This problem was originally found by Dave Hansen on x86, which turns
out to be a problem on powerpc aswell.
Fixes: cf43d3b26452 ("powerpc: Enable pkey subsystem")
Cc: stable(a)vger.kernel.org # v4.16+
Reviewed-by: Thiago Jung Bauermann <bauerman(a)linux.ibm.com>
Signed-off-by: Ram Pai <linuxram(a)us.ibm.com>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h
index c05efd2e8736..e687ed31d85a 100644
--- a/arch/powerpc/include/asm/mmu_context.h
+++ b/arch/powerpc/include/asm/mmu_context.h
@@ -217,12 +217,6 @@ static inline void enter_lazy_tlb(struct mm_struct *mm,
#endif
}
-static inline int arch_dup_mmap(struct mm_struct *oldmm,
- struct mm_struct *mm)
-{
- return 0;
-}
-
#ifdef CONFIG_PPC_BOOK3E_64
static inline void arch_exit_mmap(struct mm_struct *mm)
{
@@ -247,6 +241,7 @@ static inline void arch_bprm_mm_init(struct mm_struct *mm,
#ifdef CONFIG_PPC_MEM_KEYS
bool arch_vma_access_permitted(struct vm_area_struct *vma, bool write,
bool execute, bool foreign);
+void arch_dup_pkeys(struct mm_struct *oldmm, struct mm_struct *mm);
#else /* CONFIG_PPC_MEM_KEYS */
static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
bool write, bool execute, bool foreign)
@@ -259,6 +254,7 @@ static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
#define thread_pkey_regs_save(thread)
#define thread_pkey_regs_restore(new_thread, old_thread)
#define thread_pkey_regs_init(thread)
+#define arch_dup_pkeys(oldmm, mm)
static inline u64 pte_to_hpte_pkey_bits(u64 pteflags)
{
@@ -267,5 +263,12 @@ static inline u64 pte_to_hpte_pkey_bits(u64 pteflags)
#endif /* CONFIG_PPC_MEM_KEYS */
+static inline int arch_dup_mmap(struct mm_struct *oldmm,
+ struct mm_struct *mm)
+{
+ arch_dup_pkeys(oldmm, mm);
+ return 0;
+}
+
#endif /* __KERNEL__ */
#endif /* __ASM_POWERPC_MMU_CONTEXT_H */
diff --git a/arch/powerpc/mm/pkeys.c b/arch/powerpc/mm/pkeys.c
index 04b60a8f6e69..587807763737 100644
--- a/arch/powerpc/mm/pkeys.c
+++ b/arch/powerpc/mm/pkeys.c
@@ -415,3 +415,13 @@ bool arch_vma_access_permitted(struct vm_area_struct *vma, bool write,
return pkey_access_permitted(vma_pkey(vma), write, execute);
}
+
+void arch_dup_pkeys(struct mm_struct *oldmm, struct mm_struct *mm)
+{
+ if (static_branch_likely(&pkey_disabled))
+ return;
+
+ /* Duplicate the oldmm pkey state in mm: */
+ mm_pkey_allocation_map(mm) = mm_pkey_allocation_map(oldmm);
+ mm->context.execute_only_pkey = oldmm->context.execute_only_pkey;
+}
The patch below does not apply to the 4.20-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 2cd4bd192ee94848695c1c052d87913260e10f36 Mon Sep 17 00:00:00 2001
From: Ram Pai <linuxram(a)us.ibm.com>
Date: Thu, 20 Dec 2018 12:03:30 -0800
Subject: [PATCH] powerpc/pkeys: Fix handling of pkey state across fork()
Protection key tracking information is not copied over to the
mm_struct of the child during fork(). This can cause the child to
erroneously allocate keys that were already allocated. Any allocated
execute-only key is lost aswell.
Add code; called by dup_mmap(), to copy the pkey state from parent to
child explicitly.
This problem was originally found by Dave Hansen on x86, which turns
out to be a problem on powerpc aswell.
Fixes: cf43d3b26452 ("powerpc: Enable pkey subsystem")
Cc: stable(a)vger.kernel.org # v4.16+
Reviewed-by: Thiago Jung Bauermann <bauerman(a)linux.ibm.com>
Signed-off-by: Ram Pai <linuxram(a)us.ibm.com>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h
index c05efd2e8736..e687ed31d85a 100644
--- a/arch/powerpc/include/asm/mmu_context.h
+++ b/arch/powerpc/include/asm/mmu_context.h
@@ -217,12 +217,6 @@ static inline void enter_lazy_tlb(struct mm_struct *mm,
#endif
}
-static inline int arch_dup_mmap(struct mm_struct *oldmm,
- struct mm_struct *mm)
-{
- return 0;
-}
-
#ifdef CONFIG_PPC_BOOK3E_64
static inline void arch_exit_mmap(struct mm_struct *mm)
{
@@ -247,6 +241,7 @@ static inline void arch_bprm_mm_init(struct mm_struct *mm,
#ifdef CONFIG_PPC_MEM_KEYS
bool arch_vma_access_permitted(struct vm_area_struct *vma, bool write,
bool execute, bool foreign);
+void arch_dup_pkeys(struct mm_struct *oldmm, struct mm_struct *mm);
#else /* CONFIG_PPC_MEM_KEYS */
static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
bool write, bool execute, bool foreign)
@@ -259,6 +254,7 @@ static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
#define thread_pkey_regs_save(thread)
#define thread_pkey_regs_restore(new_thread, old_thread)
#define thread_pkey_regs_init(thread)
+#define arch_dup_pkeys(oldmm, mm)
static inline u64 pte_to_hpte_pkey_bits(u64 pteflags)
{
@@ -267,5 +263,12 @@ static inline u64 pte_to_hpte_pkey_bits(u64 pteflags)
#endif /* CONFIG_PPC_MEM_KEYS */
+static inline int arch_dup_mmap(struct mm_struct *oldmm,
+ struct mm_struct *mm)
+{
+ arch_dup_pkeys(oldmm, mm);
+ return 0;
+}
+
#endif /* __KERNEL__ */
#endif /* __ASM_POWERPC_MMU_CONTEXT_H */
diff --git a/arch/powerpc/mm/pkeys.c b/arch/powerpc/mm/pkeys.c
index 04b60a8f6e69..587807763737 100644
--- a/arch/powerpc/mm/pkeys.c
+++ b/arch/powerpc/mm/pkeys.c
@@ -415,3 +415,13 @@ bool arch_vma_access_permitted(struct vm_area_struct *vma, bool write,
return pkey_access_permitted(vma_pkey(vma), write, execute);
}
+
+void arch_dup_pkeys(struct mm_struct *oldmm, struct mm_struct *mm)
+{
+ if (static_branch_likely(&pkey_disabled))
+ return;
+
+ /* Duplicate the oldmm pkey state in mm: */
+ mm_pkey_allocation_map(mm) = mm_pkey_allocation_map(oldmm);
+ mm->context.execute_only_pkey = oldmm->context.execute_only_pkey;
+}
The patch below does not apply to the 3.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 6f5b9f018f4c7686fd944d920209d1382d320e4e Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao(a)debian.org>
Date: Mon, 26 Nov 2018 18:12:00 -0200
Subject: [PATCH] powerpc/tm: Unset MSR[TS] if not recheckpointing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
There is a TM Bad Thing bug that can be caused when you return from a
signal context in a suspended transaction but with ucontext MSR[TS] unset.
This forces regs->msr[TS] to be set at syscall entrance (since the CPU
state is transactional). It also calls treclaim() to flush the transaction
state, which is done based on the live (mfmsr) MSR state.
Since user context MSR[TS] is not set, then restore_tm_sigcontexts() is not
called, thus, not executing recheckpoint, keeping the CPU state as not
transactional. When calling rfid, SRR1 will have MSR[TS] set, but the CPU
state is non transactional, causing the TM Bad Thing with the following
stack:
[ 33.862316] Bad kernel stack pointer 3fffd9dce3e0 at c00000000000c47c
cpu 0x8: Vector: 700 (Program Check) at [c00000003ff7fd40]
pc: c00000000000c47c: fast_exception_return+0xac/0xb4
lr: 00003fff865f442c
sp: 3fffd9dce3e0
msr: 8000000102a03031
current = 0xc00000041f68b700
paca = 0xc00000000fb84800 softe: 0 irq_happened: 0x01
pid = 1721, comm = tm-signal-sigre
Linux version 4.9.0-3-powerpc64le (debian-kernel(a)lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26)
WARNING: exception is not recoverable, can't continue
The same problem happens on 32-bits signal handler, and the fix is very
similar, if tm_recheckpoint() is not executed, then regs->msr[TS] should be
zeroed.
This patch also fixes a sparse warning related to lack of indentation when
CONFIG_PPC_TRANSACTIONAL_MEM is set.
Fixes: 2b0a576d15e0e ("powerpc: Add new transactional memory state to the signal context")
CC: Stable <stable(a)vger.kernel.org> # 3.10+
Signed-off-by: Breno Leitao <leitao(a)debian.org>
Tested-by: Michal Suchánek <msuchanek(a)suse.de>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 7484f43493d3..2d47cc79e5b3 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -1158,11 +1158,11 @@ SYSCALL_DEFINE0(rt_sigreturn)
{
struct rt_sigframe __user *rt_sf;
struct pt_regs *regs = current_pt_regs();
+ int tm_restore = 0;
#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
struct ucontext __user *uc_transact;
unsigned long msr_hi;
unsigned long tmp;
- int tm_restore = 0;
#endif
/* Always make any pending restarted system calls return -EINTR */
current->restart_block.fn = do_no_restart_syscall;
@@ -1210,11 +1210,19 @@ SYSCALL_DEFINE0(rt_sigreturn)
goto bad;
}
}
- if (!tm_restore)
- /* Fall through, for non-TM restore */
+ if (!tm_restore) {
+ /*
+ * Unset regs->msr because ucontext MSR TS is not
+ * set, and recheckpoint was not called. This avoid
+ * hitting a TM Bad thing at RFID
+ */
+ regs->msr &= ~MSR_TS_MASK;
+ }
+ /* Fall through, for non-TM restore */
#endif
- if (do_setcontext(&rt_sf->uc, regs, 1))
- goto bad;
+ if (!tm_restore)
+ if (do_setcontext(&rt_sf->uc, regs, 1))
+ goto bad;
/*
* It's not clear whether or why it is desirable to save the
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index ba093ec5a21f..0935fe6c282a 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -757,11 +757,23 @@ SYSCALL_DEFINE0(rt_sigreturn)
&uc_transact->uc_mcontext))
goto badframe;
}
- else
- /* Fall through, for non-TM restore */
#endif
- if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
- goto badframe;
+ /* Fall through, for non-TM restore */
+ if (!MSR_TM_ACTIVE(msr)) {
+ /*
+ * Unset MSR[TS] on the thread regs since MSR from user
+ * context does not have MSR active, and recheckpoint was
+ * not called since restore_tm_sigcontexts() was not called
+ * also.
+ *
+ * If not unsetting it, the code can RFID to userspace with
+ * MSR[TS] set, but without CPU in the proper state,
+ * causing a TM bad thing.
+ */
+ current->thread.regs->msr &= ~MSR_TS_MASK;
+ if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
+ goto badframe;
+ }
if (restore_altstack(&uc->uc_stack))
goto badframe;
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 6f5b9f018f4c7686fd944d920209d1382d320e4e Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao(a)debian.org>
Date: Mon, 26 Nov 2018 18:12:00 -0200
Subject: [PATCH] powerpc/tm: Unset MSR[TS] if not recheckpointing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
There is a TM Bad Thing bug that can be caused when you return from a
signal context in a suspended transaction but with ucontext MSR[TS] unset.
This forces regs->msr[TS] to be set at syscall entrance (since the CPU
state is transactional). It also calls treclaim() to flush the transaction
state, which is done based on the live (mfmsr) MSR state.
Since user context MSR[TS] is not set, then restore_tm_sigcontexts() is not
called, thus, not executing recheckpoint, keeping the CPU state as not
transactional. When calling rfid, SRR1 will have MSR[TS] set, but the CPU
state is non transactional, causing the TM Bad Thing with the following
stack:
[ 33.862316] Bad kernel stack pointer 3fffd9dce3e0 at c00000000000c47c
cpu 0x8: Vector: 700 (Program Check) at [c00000003ff7fd40]
pc: c00000000000c47c: fast_exception_return+0xac/0xb4
lr: 00003fff865f442c
sp: 3fffd9dce3e0
msr: 8000000102a03031
current = 0xc00000041f68b700
paca = 0xc00000000fb84800 softe: 0 irq_happened: 0x01
pid = 1721, comm = tm-signal-sigre
Linux version 4.9.0-3-powerpc64le (debian-kernel(a)lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26)
WARNING: exception is not recoverable, can't continue
The same problem happens on 32-bits signal handler, and the fix is very
similar, if tm_recheckpoint() is not executed, then regs->msr[TS] should be
zeroed.
This patch also fixes a sparse warning related to lack of indentation when
CONFIG_PPC_TRANSACTIONAL_MEM is set.
Fixes: 2b0a576d15e0e ("powerpc: Add new transactional memory state to the signal context")
CC: Stable <stable(a)vger.kernel.org> # 3.10+
Signed-off-by: Breno Leitao <leitao(a)debian.org>
Tested-by: Michal Suchánek <msuchanek(a)suse.de>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 7484f43493d3..2d47cc79e5b3 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -1158,11 +1158,11 @@ SYSCALL_DEFINE0(rt_sigreturn)
{
struct rt_sigframe __user *rt_sf;
struct pt_regs *regs = current_pt_regs();
+ int tm_restore = 0;
#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
struct ucontext __user *uc_transact;
unsigned long msr_hi;
unsigned long tmp;
- int tm_restore = 0;
#endif
/* Always make any pending restarted system calls return -EINTR */
current->restart_block.fn = do_no_restart_syscall;
@@ -1210,11 +1210,19 @@ SYSCALL_DEFINE0(rt_sigreturn)
goto bad;
}
}
- if (!tm_restore)
- /* Fall through, for non-TM restore */
+ if (!tm_restore) {
+ /*
+ * Unset regs->msr because ucontext MSR TS is not
+ * set, and recheckpoint was not called. This avoid
+ * hitting a TM Bad thing at RFID
+ */
+ regs->msr &= ~MSR_TS_MASK;
+ }
+ /* Fall through, for non-TM restore */
#endif
- if (do_setcontext(&rt_sf->uc, regs, 1))
- goto bad;
+ if (!tm_restore)
+ if (do_setcontext(&rt_sf->uc, regs, 1))
+ goto bad;
/*
* It's not clear whether or why it is desirable to save the
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index ba093ec5a21f..0935fe6c282a 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -757,11 +757,23 @@ SYSCALL_DEFINE0(rt_sigreturn)
&uc_transact->uc_mcontext))
goto badframe;
}
- else
- /* Fall through, for non-TM restore */
#endif
- if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
- goto badframe;
+ /* Fall through, for non-TM restore */
+ if (!MSR_TM_ACTIVE(msr)) {
+ /*
+ * Unset MSR[TS] on the thread regs since MSR from user
+ * context does not have MSR active, and recheckpoint was
+ * not called since restore_tm_sigcontexts() was not called
+ * also.
+ *
+ * If not unsetting it, the code can RFID to userspace with
+ * MSR[TS] set, but without CPU in the proper state,
+ * causing a TM bad thing.
+ */
+ current->thread.regs->msr &= ~MSR_TS_MASK;
+ if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
+ goto badframe;
+ }
if (restore_altstack(&uc->uc_stack))
goto badframe;
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 6f5b9f018f4c7686fd944d920209d1382d320e4e Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao(a)debian.org>
Date: Mon, 26 Nov 2018 18:12:00 -0200
Subject: [PATCH] powerpc/tm: Unset MSR[TS] if not recheckpointing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
There is a TM Bad Thing bug that can be caused when you return from a
signal context in a suspended transaction but with ucontext MSR[TS] unset.
This forces regs->msr[TS] to be set at syscall entrance (since the CPU
state is transactional). It also calls treclaim() to flush the transaction
state, which is done based on the live (mfmsr) MSR state.
Since user context MSR[TS] is not set, then restore_tm_sigcontexts() is not
called, thus, not executing recheckpoint, keeping the CPU state as not
transactional. When calling rfid, SRR1 will have MSR[TS] set, but the CPU
state is non transactional, causing the TM Bad Thing with the following
stack:
[ 33.862316] Bad kernel stack pointer 3fffd9dce3e0 at c00000000000c47c
cpu 0x8: Vector: 700 (Program Check) at [c00000003ff7fd40]
pc: c00000000000c47c: fast_exception_return+0xac/0xb4
lr: 00003fff865f442c
sp: 3fffd9dce3e0
msr: 8000000102a03031
current = 0xc00000041f68b700
paca = 0xc00000000fb84800 softe: 0 irq_happened: 0x01
pid = 1721, comm = tm-signal-sigre
Linux version 4.9.0-3-powerpc64le (debian-kernel(a)lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26)
WARNING: exception is not recoverable, can't continue
The same problem happens on 32-bits signal handler, and the fix is very
similar, if tm_recheckpoint() is not executed, then regs->msr[TS] should be
zeroed.
This patch also fixes a sparse warning related to lack of indentation when
CONFIG_PPC_TRANSACTIONAL_MEM is set.
Fixes: 2b0a576d15e0e ("powerpc: Add new transactional memory state to the signal context")
CC: Stable <stable(a)vger.kernel.org> # 3.10+
Signed-off-by: Breno Leitao <leitao(a)debian.org>
Tested-by: Michal Suchánek <msuchanek(a)suse.de>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 7484f43493d3..2d47cc79e5b3 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -1158,11 +1158,11 @@ SYSCALL_DEFINE0(rt_sigreturn)
{
struct rt_sigframe __user *rt_sf;
struct pt_regs *regs = current_pt_regs();
+ int tm_restore = 0;
#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
struct ucontext __user *uc_transact;
unsigned long msr_hi;
unsigned long tmp;
- int tm_restore = 0;
#endif
/* Always make any pending restarted system calls return -EINTR */
current->restart_block.fn = do_no_restart_syscall;
@@ -1210,11 +1210,19 @@ SYSCALL_DEFINE0(rt_sigreturn)
goto bad;
}
}
- if (!tm_restore)
- /* Fall through, for non-TM restore */
+ if (!tm_restore) {
+ /*
+ * Unset regs->msr because ucontext MSR TS is not
+ * set, and recheckpoint was not called. This avoid
+ * hitting a TM Bad thing at RFID
+ */
+ regs->msr &= ~MSR_TS_MASK;
+ }
+ /* Fall through, for non-TM restore */
#endif
- if (do_setcontext(&rt_sf->uc, regs, 1))
- goto bad;
+ if (!tm_restore)
+ if (do_setcontext(&rt_sf->uc, regs, 1))
+ goto bad;
/*
* It's not clear whether or why it is desirable to save the
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index ba093ec5a21f..0935fe6c282a 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -757,11 +757,23 @@ SYSCALL_DEFINE0(rt_sigreturn)
&uc_transact->uc_mcontext))
goto badframe;
}
- else
- /* Fall through, for non-TM restore */
#endif
- if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
- goto badframe;
+ /* Fall through, for non-TM restore */
+ if (!MSR_TM_ACTIVE(msr)) {
+ /*
+ * Unset MSR[TS] on the thread regs since MSR from user
+ * context does not have MSR active, and recheckpoint was
+ * not called since restore_tm_sigcontexts() was not called
+ * also.
+ *
+ * If not unsetting it, the code can RFID to userspace with
+ * MSR[TS] set, but without CPU in the proper state,
+ * causing a TM bad thing.
+ */
+ current->thread.regs->msr &= ~MSR_TS_MASK;
+ if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
+ goto badframe;
+ }
if (restore_altstack(&uc->uc_stack))
goto badframe;
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 6f5b9f018f4c7686fd944d920209d1382d320e4e Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao(a)debian.org>
Date: Mon, 26 Nov 2018 18:12:00 -0200
Subject: [PATCH] powerpc/tm: Unset MSR[TS] if not recheckpointing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
There is a TM Bad Thing bug that can be caused when you return from a
signal context in a suspended transaction but with ucontext MSR[TS] unset.
This forces regs->msr[TS] to be set at syscall entrance (since the CPU
state is transactional). It also calls treclaim() to flush the transaction
state, which is done based on the live (mfmsr) MSR state.
Since user context MSR[TS] is not set, then restore_tm_sigcontexts() is not
called, thus, not executing recheckpoint, keeping the CPU state as not
transactional. When calling rfid, SRR1 will have MSR[TS] set, but the CPU
state is non transactional, causing the TM Bad Thing with the following
stack:
[ 33.862316] Bad kernel stack pointer 3fffd9dce3e0 at c00000000000c47c
cpu 0x8: Vector: 700 (Program Check) at [c00000003ff7fd40]
pc: c00000000000c47c: fast_exception_return+0xac/0xb4
lr: 00003fff865f442c
sp: 3fffd9dce3e0
msr: 8000000102a03031
current = 0xc00000041f68b700
paca = 0xc00000000fb84800 softe: 0 irq_happened: 0x01
pid = 1721, comm = tm-signal-sigre
Linux version 4.9.0-3-powerpc64le (debian-kernel(a)lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26)
WARNING: exception is not recoverable, can't continue
The same problem happens on 32-bits signal handler, and the fix is very
similar, if tm_recheckpoint() is not executed, then regs->msr[TS] should be
zeroed.
This patch also fixes a sparse warning related to lack of indentation when
CONFIG_PPC_TRANSACTIONAL_MEM is set.
Fixes: 2b0a576d15e0e ("powerpc: Add new transactional memory state to the signal context")
CC: Stable <stable(a)vger.kernel.org> # 3.10+
Signed-off-by: Breno Leitao <leitao(a)debian.org>
Tested-by: Michal Suchánek <msuchanek(a)suse.de>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 7484f43493d3..2d47cc79e5b3 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -1158,11 +1158,11 @@ SYSCALL_DEFINE0(rt_sigreturn)
{
struct rt_sigframe __user *rt_sf;
struct pt_regs *regs = current_pt_regs();
+ int tm_restore = 0;
#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
struct ucontext __user *uc_transact;
unsigned long msr_hi;
unsigned long tmp;
- int tm_restore = 0;
#endif
/* Always make any pending restarted system calls return -EINTR */
current->restart_block.fn = do_no_restart_syscall;
@@ -1210,11 +1210,19 @@ SYSCALL_DEFINE0(rt_sigreturn)
goto bad;
}
}
- if (!tm_restore)
- /* Fall through, for non-TM restore */
+ if (!tm_restore) {
+ /*
+ * Unset regs->msr because ucontext MSR TS is not
+ * set, and recheckpoint was not called. This avoid
+ * hitting a TM Bad thing at RFID
+ */
+ regs->msr &= ~MSR_TS_MASK;
+ }
+ /* Fall through, for non-TM restore */
#endif
- if (do_setcontext(&rt_sf->uc, regs, 1))
- goto bad;
+ if (!tm_restore)
+ if (do_setcontext(&rt_sf->uc, regs, 1))
+ goto bad;
/*
* It's not clear whether or why it is desirable to save the
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index ba093ec5a21f..0935fe6c282a 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -757,11 +757,23 @@ SYSCALL_DEFINE0(rt_sigreturn)
&uc_transact->uc_mcontext))
goto badframe;
}
- else
- /* Fall through, for non-TM restore */
#endif
- if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
- goto badframe;
+ /* Fall through, for non-TM restore */
+ if (!MSR_TM_ACTIVE(msr)) {
+ /*
+ * Unset MSR[TS] on the thread regs since MSR from user
+ * context does not have MSR active, and recheckpoint was
+ * not called since restore_tm_sigcontexts() was not called
+ * also.
+ *
+ * If not unsetting it, the code can RFID to userspace with
+ * MSR[TS] set, but without CPU in the proper state,
+ * causing a TM bad thing.
+ */
+ current->thread.regs->msr &= ~MSR_TS_MASK;
+ if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
+ goto badframe;
+ }
if (restore_altstack(&uc->uc_stack))
goto badframe;
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From e1c3743e1a20647c53b719dbf28b48f45d23f2cd Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao(a)debian.org>
Date: Wed, 21 Nov 2018 17:21:09 -0200
Subject: [PATCH] powerpc/tm: Set MSR[TS] just prior to recheckpoint
On a signal handler return, the user could set a context with MSR[TS] bits
set, and these bits would be copied to task regs->msr.
At restore_tm_sigcontexts(), after current task regs->msr[TS] bits are set,
several __get_user() are called and then a recheckpoint is executed.
This is a problem since a page fault (in kernel space) could happen when
calling __get_user(). If it happens, the process MSR[TS] bits were
already set, but recheckpoint was not executed, and SPRs are still invalid.
The page fault can cause the current process to be de-scheduled, with
MSR[TS] active and without tm_recheckpoint() being called. More
importantly, without TEXASR[FS] bit set also.
Since TEXASR might not have the FS bit set, and when the process is
scheduled back, it will try to reclaim, which will be aborted because of
the CPU is not in the suspended state, and, then, recheckpoint. This
recheckpoint will restore thread->texasr into TEXASR SPR, which might be
zero, hitting a BUG_ON().
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
cpu 0xb: Vector: 700 (Program Check) at [c00000041f1576d0]
pc: c000000000054550: restore_gprs+0xb0/0x180
lr: 0000000000000000
sp: c00000041f157950
msr: 8000000100021033
current = 0xc00000041f143000
paca = 0xc00000000fb86300 softe: 0 irq_happened: 0x01
pid = 1021, comm = kworker/11:1
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
Linux version 4.9.0-3-powerpc64le (debian-kernel(a)lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26)
enter ? for help
[c00000041f157b30] c00000000001bc3c tm_recheckpoint.part.11+0x6c/0xa0
[c00000041f157b70] c00000000001d184 __switch_to+0x1e4/0x4c0
[c00000041f157bd0] c00000000082eeb8 __schedule+0x2f8/0x990
[c00000041f157cb0] c00000000082f598 schedule+0x48/0xc0
[c00000041f157ce0] c0000000000f0d28 worker_thread+0x148/0x610
[c00000041f157d80] c0000000000f96b0 kthread+0x120/0x140
[c00000041f157e30] c00000000000c0e0 ret_from_kernel_thread+0x5c/0x7c
This patch simply delays the MSR[TS] set, so, if there is any page fault in
the __get_user() section, it does not have regs->msr[TS] set, since the TM
structures are still invalid, thus avoiding doing TM operations for
in-kernel exceptions and possible process reschedule.
With this patch, the MSR[TS] will only be set just before recheckpointing
and setting TEXASR[FS] = 1, thus avoiding an interrupt with TM registers in
invalid state.
Other than that, if CONFIG_PREEMPT is set, there might be a preemption just
after setting MSR[TS] and before tm_recheckpoint(), thus, this block must
be atomic from a preemption perspective, thus, calling
preempt_disable/enable() on this code.
It is not possible to move tm_recheckpoint to happen earlier, because it is
required to get the checkpointed registers from userspace, with
__get_user(), thus, the only way to avoid this undesired behavior is
delaying the MSR[TS] set.
The 32-bits signal handler seems to be safe this current issue, but, it
might be exposed to the preemption issue, thus, disabling preemption in
this chunk of code.
Changes from v2:
* Run the critical section with preempt_disable.
Fixes: 87b4e5393af7 ("powerpc/tm: Fix return of active 64bit signals")
Cc: stable(a)vger.kernel.org (v3.9+)
Signed-off-by: Breno Leitao <leitao(a)debian.org>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 9d39e0eb03ff..7484f43493d3 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -848,7 +848,23 @@ static long restore_tm_user_regs(struct pt_regs *regs,
/* If TM bits are set to the reserved value, it's an invalid context */
if (MSR_TM_RESV(msr_hi))
return 1;
- /* Pull in the MSR TM bits from the user context */
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /*
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ *
+ * Pull in the MSR TM bits from the user context
+ */
regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK);
/* Now, recheckpoint. This loads up all of the checkpointed (older)
* registers, including FP and V[S]Rs. After recheckpointing, the
@@ -873,6 +889,8 @@ static long restore_tm_user_regs(struct pt_regs *regs,
}
#endif
+ preempt_enable();
+
return 0;
}
#endif
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index e53ad11be385..ba093ec5a21f 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -467,20 +467,6 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
if (MSR_TM_RESV(msr))
return -EINVAL;
- /* pull in MSR TS bits from user context */
- regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
-
- /*
- * Ensure that TM is enabled in regs->msr before we leave the signal
- * handler. It could be the case that (a) user disabled the TM bit
- * through the manipulation of the MSR bits in uc_mcontext or (b) the
- * TM bit was disabled because a sufficient number of context switches
- * happened whilst in the signal handler and load_tm overflowed,
- * disabling the TM bit. In either case we can end up with an illegal
- * TM state leading to a TM Bad Thing when we return to userspace.
- */
- regs->msr |= MSR_TM;
-
/* pull in MSR LE from user context */
regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE);
@@ -572,6 +558,34 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
tm_enable();
/* Make sure the transaction is marked as failed */
tsk->thread.tm_texasr |= TEXASR_FS;
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /* pull in MSR TS bits from user context */
+ regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
+
+ /*
+ * Ensure that TM is enabled in regs->msr before we leave the signal
+ * handler. It could be the case that (a) user disabled the TM bit
+ * through the manipulation of the MSR bits in uc_mcontext or (b) the
+ * TM bit was disabled because a sufficient number of context switches
+ * happened whilst in the signal handler and load_tm overflowed,
+ * disabling the TM bit. In either case we can end up with an illegal
+ * TM state leading to a TM Bad Thing when we return to userspace.
+ *
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ */
+ regs->msr |= MSR_TM;
+
/* This loads the checkpointed FP/VEC state, if used */
tm_recheckpoint(&tsk->thread);
@@ -585,6 +599,8 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
regs->msr |= MSR_VEC;
}
+ preempt_enable();
+
return err;
}
#endif
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From be6821f82c3cc36e026f5afd10249988852b35ea Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Tue, 11 Dec 2018 10:19:45 +0000
Subject: [PATCH] Btrfs: send, fix race with transaction commits that create
snapshots
If we create a snapshot of a snapshot currently being used by a send
operation, we can end up with send failing unexpectedly (returning
-ENOENT error to user space for example). The following diagram shows
how this happens.
CPU 1 CPU2 CPU3
btrfs_ioctl_send()
(...)
create_snapshot()
-> creates snapshot of a
root used by the send
task
btrfs_commit_transaction()
create_pending_snapshot()
__get_inode_info()
btrfs_search_slot()
btrfs_search_slot_get_root()
down_read commit_root_sem
get reference on eb of the
commit root
-> eb with bytenr == X
up_read commit_root_sem
btrfs_cow_block(root node)
btrfs_free_tree_block()
-> creates delayed ref to
free the extent
btrfs_run_delayed_refs()
-> runs the delayed ref,
adds extent to
fs_info->pinned_extents
btrfs_finish_extent_commit()
unpin_extent_range()
-> marks extent as free
in the free space cache
transaction commit finishes
btrfs_start_transaction()
(...)
btrfs_cow_block()
btrfs_alloc_tree_block()
btrfs_reserve_extent()
-> allocates extent at
bytenr == X
btrfs_init_new_buffer(bytenr X)
btrfs_find_create_tree_block()
alloc_extent_buffer(bytenr X)
find_extent_buffer(bytenr X)
-> returns existing eb,
which the send task got
(...)
-> modifies content of the
eb with bytenr == X
-> uses an eb that now
belongs to some other
tree and no more matches
the commit root of the
snapshot, resuts will be
unpredictable
The consequences of this race can be various, and can lead to searches in
the commit root performed by the send task failing unexpectedly (unable to
find inode items, returning -ENOENT to user space, for example) or not
failing because an inode item with the same number was added to the tree
that reused the metadata extent, in which case send can behave incorrectly
in the worst case or just fail later for some reason.
Fix this by performing a copy of the commit root's extent buffer when doing
a search in the context of a send operation.
CC: stable(a)vger.kernel.org # 4.4.x: 1fc28d8e2e9: Btrfs: move get root out of btrfs_search_slot to a helper
CC: stable(a)vger.kernel.org # 4.4.x: f9ddfd0592a: Btrfs: remove unused check of skip_locking
CC: stable(a)vger.kernel.org # 4.4.x
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 72745235896f..4252e89df6ae 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -2587,14 +2587,27 @@ static struct extent_buffer *btrfs_search_slot_get_root(struct btrfs_root *root,
root_lock = BTRFS_READ_LOCK;
if (p->search_commit_root) {
- /* The commit roots are read only so we always do read locks */
- if (p->need_commit_sem)
+ /*
+ * The commit roots are read only so we always do read locks,
+ * and we always must hold the commit_root_sem when doing
+ * searches on them, the only exception is send where we don't
+ * want to block transaction commits for a long time, so
+ * we need to clone the commit root in order to avoid races
+ * with transaction commits that create a snapshot of one of
+ * the roots used by a send operation.
+ */
+ if (p->need_commit_sem) {
down_read(&fs_info->commit_root_sem);
- b = root->commit_root;
- extent_buffer_get(b);
- level = btrfs_header_level(b);
- if (p->need_commit_sem)
+ b = btrfs_clone_extent_buffer(root->commit_root);
up_read(&fs_info->commit_root_sem);
+ if (!b)
+ return ERR_PTR(-ENOMEM);
+
+ } else {
+ b = root->commit_root;
+ extent_buffer_get(b);
+ }
+ level = btrfs_header_level(b);
/*
* Ensure that all callers have set skip_locking when
* p->search_commit_root = 1.
@@ -2720,6 +2733,10 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root,
again:
prev_cmp = -1;
b = btrfs_search_slot_get_root(root, p, write_lock_level);
+ if (IS_ERR(b)) {
+ ret = PTR_ERR(b);
+ goto done;
+ }
while (b) {
level = btrfs_header_level(b);
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From be6821f82c3cc36e026f5afd10249988852b35ea Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Tue, 11 Dec 2018 10:19:45 +0000
Subject: [PATCH] Btrfs: send, fix race with transaction commits that create
snapshots
If we create a snapshot of a snapshot currently being used by a send
operation, we can end up with send failing unexpectedly (returning
-ENOENT error to user space for example). The following diagram shows
how this happens.
CPU 1 CPU2 CPU3
btrfs_ioctl_send()
(...)
create_snapshot()
-> creates snapshot of a
root used by the send
task
btrfs_commit_transaction()
create_pending_snapshot()
__get_inode_info()
btrfs_search_slot()
btrfs_search_slot_get_root()
down_read commit_root_sem
get reference on eb of the
commit root
-> eb with bytenr == X
up_read commit_root_sem
btrfs_cow_block(root node)
btrfs_free_tree_block()
-> creates delayed ref to
free the extent
btrfs_run_delayed_refs()
-> runs the delayed ref,
adds extent to
fs_info->pinned_extents
btrfs_finish_extent_commit()
unpin_extent_range()
-> marks extent as free
in the free space cache
transaction commit finishes
btrfs_start_transaction()
(...)
btrfs_cow_block()
btrfs_alloc_tree_block()
btrfs_reserve_extent()
-> allocates extent at
bytenr == X
btrfs_init_new_buffer(bytenr X)
btrfs_find_create_tree_block()
alloc_extent_buffer(bytenr X)
find_extent_buffer(bytenr X)
-> returns existing eb,
which the send task got
(...)
-> modifies content of the
eb with bytenr == X
-> uses an eb that now
belongs to some other
tree and no more matches
the commit root of the
snapshot, resuts will be
unpredictable
The consequences of this race can be various, and can lead to searches in
the commit root performed by the send task failing unexpectedly (unable to
find inode items, returning -ENOENT to user space, for example) or not
failing because an inode item with the same number was added to the tree
that reused the metadata extent, in which case send can behave incorrectly
in the worst case or just fail later for some reason.
Fix this by performing a copy of the commit root's extent buffer when doing
a search in the context of a send operation.
CC: stable(a)vger.kernel.org # 4.4.x: 1fc28d8e2e9: Btrfs: move get root out of btrfs_search_slot to a helper
CC: stable(a)vger.kernel.org # 4.4.x: f9ddfd0592a: Btrfs: remove unused check of skip_locking
CC: stable(a)vger.kernel.org # 4.4.x
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 72745235896f..4252e89df6ae 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -2587,14 +2587,27 @@ static struct extent_buffer *btrfs_search_slot_get_root(struct btrfs_root *root,
root_lock = BTRFS_READ_LOCK;
if (p->search_commit_root) {
- /* The commit roots are read only so we always do read locks */
- if (p->need_commit_sem)
+ /*
+ * The commit roots are read only so we always do read locks,
+ * and we always must hold the commit_root_sem when doing
+ * searches on them, the only exception is send where we don't
+ * want to block transaction commits for a long time, so
+ * we need to clone the commit root in order to avoid races
+ * with transaction commits that create a snapshot of one of
+ * the roots used by a send operation.
+ */
+ if (p->need_commit_sem) {
down_read(&fs_info->commit_root_sem);
- b = root->commit_root;
- extent_buffer_get(b);
- level = btrfs_header_level(b);
- if (p->need_commit_sem)
+ b = btrfs_clone_extent_buffer(root->commit_root);
up_read(&fs_info->commit_root_sem);
+ if (!b)
+ return ERR_PTR(-ENOMEM);
+
+ } else {
+ b = root->commit_root;
+ extent_buffer_get(b);
+ }
+ level = btrfs_header_level(b);
/*
* Ensure that all callers have set skip_locking when
* p->search_commit_root = 1.
@@ -2720,6 +2733,10 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root,
again:
prev_cmp = -1;
b = btrfs_search_slot_get_root(root, p, write_lock_level);
+ if (IS_ERR(b)) {
+ ret = PTR_ERR(b);
+ goto done;
+ }
while (b) {
level = btrfs_header_level(b);
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From be6821f82c3cc36e026f5afd10249988852b35ea Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Tue, 11 Dec 2018 10:19:45 +0000
Subject: [PATCH] Btrfs: send, fix race with transaction commits that create
snapshots
If we create a snapshot of a snapshot currently being used by a send
operation, we can end up with send failing unexpectedly (returning
-ENOENT error to user space for example). The following diagram shows
how this happens.
CPU 1 CPU2 CPU3
btrfs_ioctl_send()
(...)
create_snapshot()
-> creates snapshot of a
root used by the send
task
btrfs_commit_transaction()
create_pending_snapshot()
__get_inode_info()
btrfs_search_slot()
btrfs_search_slot_get_root()
down_read commit_root_sem
get reference on eb of the
commit root
-> eb with bytenr == X
up_read commit_root_sem
btrfs_cow_block(root node)
btrfs_free_tree_block()
-> creates delayed ref to
free the extent
btrfs_run_delayed_refs()
-> runs the delayed ref,
adds extent to
fs_info->pinned_extents
btrfs_finish_extent_commit()
unpin_extent_range()
-> marks extent as free
in the free space cache
transaction commit finishes
btrfs_start_transaction()
(...)
btrfs_cow_block()
btrfs_alloc_tree_block()
btrfs_reserve_extent()
-> allocates extent at
bytenr == X
btrfs_init_new_buffer(bytenr X)
btrfs_find_create_tree_block()
alloc_extent_buffer(bytenr X)
find_extent_buffer(bytenr X)
-> returns existing eb,
which the send task got
(...)
-> modifies content of the
eb with bytenr == X
-> uses an eb that now
belongs to some other
tree and no more matches
the commit root of the
snapshot, resuts will be
unpredictable
The consequences of this race can be various, and can lead to searches in
the commit root performed by the send task failing unexpectedly (unable to
find inode items, returning -ENOENT to user space, for example) or not
failing because an inode item with the same number was added to the tree
that reused the metadata extent, in which case send can behave incorrectly
in the worst case or just fail later for some reason.
Fix this by performing a copy of the commit root's extent buffer when doing
a search in the context of a send operation.
CC: stable(a)vger.kernel.org # 4.4.x: 1fc28d8e2e9: Btrfs: move get root out of btrfs_search_slot to a helper
CC: stable(a)vger.kernel.org # 4.4.x: f9ddfd0592a: Btrfs: remove unused check of skip_locking
CC: stable(a)vger.kernel.org # 4.4.x
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 72745235896f..4252e89df6ae 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -2587,14 +2587,27 @@ static struct extent_buffer *btrfs_search_slot_get_root(struct btrfs_root *root,
root_lock = BTRFS_READ_LOCK;
if (p->search_commit_root) {
- /* The commit roots are read only so we always do read locks */
- if (p->need_commit_sem)
+ /*
+ * The commit roots are read only so we always do read locks,
+ * and we always must hold the commit_root_sem when doing
+ * searches on them, the only exception is send where we don't
+ * want to block transaction commits for a long time, so
+ * we need to clone the commit root in order to avoid races
+ * with transaction commits that create a snapshot of one of
+ * the roots used by a send operation.
+ */
+ if (p->need_commit_sem) {
down_read(&fs_info->commit_root_sem);
- b = root->commit_root;
- extent_buffer_get(b);
- level = btrfs_header_level(b);
- if (p->need_commit_sem)
+ b = btrfs_clone_extent_buffer(root->commit_root);
up_read(&fs_info->commit_root_sem);
+ if (!b)
+ return ERR_PTR(-ENOMEM);
+
+ } else {
+ b = root->commit_root;
+ extent_buffer_get(b);
+ }
+ level = btrfs_header_level(b);
/*
* Ensure that all callers have set skip_locking when
* p->search_commit_root = 1.
@@ -2720,6 +2733,10 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root,
again:
prev_cmp = -1;
b = btrfs_search_slot_get_root(root, p, write_lock_level);
+ if (IS_ERR(b)) {
+ ret = PTR_ERR(b);
+ goto done;
+ }
while (b) {
level = btrfs_header_level(b);
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From d1051d6ebf8ef3517a5a3cf82bba8436d190f1c2 Mon Sep 17 00:00:00 2001
From: Nikolay Borisov <nborisov(a)suse.com>
Date: Wed, 21 Nov 2018 17:10:52 +0200
Subject: [PATCH] btrfs: Fix error handling in btrfs_cleanup_ordered_extents
Running btrfs/124 in a loop hung up on me sporadically with the
following call trace:
btrfs D 0 5760 5324 0x00000000
Call Trace:
? __schedule+0x243/0x800
schedule+0x33/0x90
btrfs_start_ordered_extent+0x10c/0x1b0 [btrfs]
? wait_woken+0xa0/0xa0
btrfs_wait_ordered_range+0xbb/0x100 [btrfs]
btrfs_relocate_block_group+0x1ff/0x230 [btrfs]
btrfs_relocate_chunk+0x49/0x100 [btrfs]
btrfs_balance+0xbeb/0x1740 [btrfs]
btrfs_ioctl_balance+0x2ee/0x380 [btrfs]
btrfs_ioctl+0x1691/0x3110 [btrfs]
? lockdep_hardirqs_on+0xed/0x180
? __handle_mm_fault+0x8e7/0xfb0
? _raw_spin_unlock+0x24/0x30
? __handle_mm_fault+0x8e7/0xfb0
? do_vfs_ioctl+0xa5/0x6e0
? btrfs_ioctl_get_supported_features+0x30/0x30 [btrfs]
do_vfs_ioctl+0xa5/0x6e0
? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
ksys_ioctl+0x3a/0x70
__x64_sys_ioctl+0x16/0x20
do_syscall_64+0x60/0x1b0
entry_SYSCALL_64_after_hwframe+0x49/0xbe
This happens because during page writeback it's valid for
writepage_delalloc to instantiate a delalloc range which doesn't belong
to the page currently being written back.
The reason this case is valid is due to find_lock_delalloc_range
returning any available range after the passed delalloc_start and
ignoring whether the page under writeback is within that range.
In turn ordered extents (OE) are always created for the returned range
from find_lock_delalloc_range. If, however, a failure occurs while OE
are being created then the clean up code in btrfs_cleanup_ordered_extents
will be called.
Unfortunately the code in btrfs_cleanup_ordered_extents doesn't consider
the case of such 'foreign' range being processed and instead it always
assumes that the range OE are created for belongs to the page. This
leads to the first page of such foregin range to not be cleaned up since
it's deliberately missed and skipped by the current cleaning up code.
Fix this by correctly checking whether the current page belongs to the
range being instantiated and if so adjsut the range parameters passed
for cleaning up. If it doesn't, then just clean the whole OE range
directly.
Fixes: 524272607e88 ("btrfs: Handle delalloc error correctly to avoid ordered extent hang")
CC: stable(a)vger.kernel.org # 4.14+
Reviewed-by: Josef Bacik <josef(a)toxicpanda.com>
Signed-off-by: Nikolay Borisov <nborisov(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index e7b97c699acf..e1451a69432b 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -110,17 +110,17 @@ static void __endio_write_update_ordered(struct inode *inode,
* extent_clear_unlock_delalloc() to clear both the bits EXTENT_DO_ACCOUNTING
* and EXTENT_DELALLOC simultaneously, because that causes the reserved metadata
* to be released, which we want to happen only when finishing the ordered
- * extent (btrfs_finish_ordered_io()). Also note that the caller of
- * btrfs_run_delalloc_range already does proper cleanup for the first page of
- * the range, that is, it invokes the callback writepage_end_io_hook() for the
- * range of the first page.
+ * extent (btrfs_finish_ordered_io()).
*/
static inline void btrfs_cleanup_ordered_extents(struct inode *inode,
- const u64 offset,
- const u64 bytes)
+ struct page *locked_page,
+ u64 offset, u64 bytes)
{
unsigned long index = offset >> PAGE_SHIFT;
unsigned long end_index = (offset + bytes - 1) >> PAGE_SHIFT;
+ u64 page_start = page_offset(locked_page);
+ u64 page_end = page_start + PAGE_SIZE - 1;
+
struct page *page;
while (index <= end_index) {
@@ -131,8 +131,18 @@ static inline void btrfs_cleanup_ordered_extents(struct inode *inode,
ClearPagePrivate2(page);
put_page(page);
}
- return __endio_write_update_ordered(inode, offset + PAGE_SIZE,
- bytes - PAGE_SIZE, false);
+
+ /*
+ * In case this page belongs to the delalloc range being instantiated
+ * then skip it, since the first page of a range is going to be
+ * properly cleaned up by the caller of run_delalloc_range
+ */
+ if (page_start >= offset && page_end <= (offset + bytes - 1)) {
+ offset += PAGE_SIZE;
+ bytes -= PAGE_SIZE;
+ }
+
+ return __endio_write_update_ordered(inode, offset, bytes, false);
}
static int btrfs_dirty_inode(struct inode *inode);
@@ -1603,7 +1613,8 @@ int btrfs_run_delalloc_range(void *private_data, struct page *locked_page,
write_flags);
}
if (ret)
- btrfs_cleanup_ordered_extents(inode, start, end - start + 1);
+ btrfs_cleanup_ordered_extents(inode, locked_page, start,
+ end - start + 1);
return ret;
}
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From d1051d6ebf8ef3517a5a3cf82bba8436d190f1c2 Mon Sep 17 00:00:00 2001
From: Nikolay Borisov <nborisov(a)suse.com>
Date: Wed, 21 Nov 2018 17:10:52 +0200
Subject: [PATCH] btrfs: Fix error handling in btrfs_cleanup_ordered_extents
Running btrfs/124 in a loop hung up on me sporadically with the
following call trace:
btrfs D 0 5760 5324 0x00000000
Call Trace:
? __schedule+0x243/0x800
schedule+0x33/0x90
btrfs_start_ordered_extent+0x10c/0x1b0 [btrfs]
? wait_woken+0xa0/0xa0
btrfs_wait_ordered_range+0xbb/0x100 [btrfs]
btrfs_relocate_block_group+0x1ff/0x230 [btrfs]
btrfs_relocate_chunk+0x49/0x100 [btrfs]
btrfs_balance+0xbeb/0x1740 [btrfs]
btrfs_ioctl_balance+0x2ee/0x380 [btrfs]
btrfs_ioctl+0x1691/0x3110 [btrfs]
? lockdep_hardirqs_on+0xed/0x180
? __handle_mm_fault+0x8e7/0xfb0
? _raw_spin_unlock+0x24/0x30
? __handle_mm_fault+0x8e7/0xfb0
? do_vfs_ioctl+0xa5/0x6e0
? btrfs_ioctl_get_supported_features+0x30/0x30 [btrfs]
do_vfs_ioctl+0xa5/0x6e0
? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
ksys_ioctl+0x3a/0x70
__x64_sys_ioctl+0x16/0x20
do_syscall_64+0x60/0x1b0
entry_SYSCALL_64_after_hwframe+0x49/0xbe
This happens because during page writeback it's valid for
writepage_delalloc to instantiate a delalloc range which doesn't belong
to the page currently being written back.
The reason this case is valid is due to find_lock_delalloc_range
returning any available range after the passed delalloc_start and
ignoring whether the page under writeback is within that range.
In turn ordered extents (OE) are always created for the returned range
from find_lock_delalloc_range. If, however, a failure occurs while OE
are being created then the clean up code in btrfs_cleanup_ordered_extents
will be called.
Unfortunately the code in btrfs_cleanup_ordered_extents doesn't consider
the case of such 'foreign' range being processed and instead it always
assumes that the range OE are created for belongs to the page. This
leads to the first page of such foregin range to not be cleaned up since
it's deliberately missed and skipped by the current cleaning up code.
Fix this by correctly checking whether the current page belongs to the
range being instantiated and if so adjsut the range parameters passed
for cleaning up. If it doesn't, then just clean the whole OE range
directly.
Fixes: 524272607e88 ("btrfs: Handle delalloc error correctly to avoid ordered extent hang")
CC: stable(a)vger.kernel.org # 4.14+
Reviewed-by: Josef Bacik <josef(a)toxicpanda.com>
Signed-off-by: Nikolay Borisov <nborisov(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index e7b97c699acf..e1451a69432b 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -110,17 +110,17 @@ static void __endio_write_update_ordered(struct inode *inode,
* extent_clear_unlock_delalloc() to clear both the bits EXTENT_DO_ACCOUNTING
* and EXTENT_DELALLOC simultaneously, because that causes the reserved metadata
* to be released, which we want to happen only when finishing the ordered
- * extent (btrfs_finish_ordered_io()). Also note that the caller of
- * btrfs_run_delalloc_range already does proper cleanup for the first page of
- * the range, that is, it invokes the callback writepage_end_io_hook() for the
- * range of the first page.
+ * extent (btrfs_finish_ordered_io()).
*/
static inline void btrfs_cleanup_ordered_extents(struct inode *inode,
- const u64 offset,
- const u64 bytes)
+ struct page *locked_page,
+ u64 offset, u64 bytes)
{
unsigned long index = offset >> PAGE_SHIFT;
unsigned long end_index = (offset + bytes - 1) >> PAGE_SHIFT;
+ u64 page_start = page_offset(locked_page);
+ u64 page_end = page_start + PAGE_SIZE - 1;
+
struct page *page;
while (index <= end_index) {
@@ -131,8 +131,18 @@ static inline void btrfs_cleanup_ordered_extents(struct inode *inode,
ClearPagePrivate2(page);
put_page(page);
}
- return __endio_write_update_ordered(inode, offset + PAGE_SIZE,
- bytes - PAGE_SIZE, false);
+
+ /*
+ * In case this page belongs to the delalloc range being instantiated
+ * then skip it, since the first page of a range is going to be
+ * properly cleaned up by the caller of run_delalloc_range
+ */
+ if (page_start >= offset && page_end <= (offset + bytes - 1)) {
+ offset += PAGE_SIZE;
+ bytes -= PAGE_SIZE;
+ }
+
+ return __endio_write_update_ordered(inode, offset, bytes, false);
}
static int btrfs_dirty_inode(struct inode *inode);
@@ -1603,7 +1613,8 @@ int btrfs_run_delalloc_range(void *private_data, struct page *locked_page,
write_flags);
}
if (ret)
- btrfs_cleanup_ordered_extents(inode, start, end - start + 1);
+ btrfs_cleanup_ordered_extents(inode, locked_page, start,
+ end - start + 1);
return ret;
}
The patch below does not apply to the 4.20-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From d1051d6ebf8ef3517a5a3cf82bba8436d190f1c2 Mon Sep 17 00:00:00 2001
From: Nikolay Borisov <nborisov(a)suse.com>
Date: Wed, 21 Nov 2018 17:10:52 +0200
Subject: [PATCH] btrfs: Fix error handling in btrfs_cleanup_ordered_extents
Running btrfs/124 in a loop hung up on me sporadically with the
following call trace:
btrfs D 0 5760 5324 0x00000000
Call Trace:
? __schedule+0x243/0x800
schedule+0x33/0x90
btrfs_start_ordered_extent+0x10c/0x1b0 [btrfs]
? wait_woken+0xa0/0xa0
btrfs_wait_ordered_range+0xbb/0x100 [btrfs]
btrfs_relocate_block_group+0x1ff/0x230 [btrfs]
btrfs_relocate_chunk+0x49/0x100 [btrfs]
btrfs_balance+0xbeb/0x1740 [btrfs]
btrfs_ioctl_balance+0x2ee/0x380 [btrfs]
btrfs_ioctl+0x1691/0x3110 [btrfs]
? lockdep_hardirqs_on+0xed/0x180
? __handle_mm_fault+0x8e7/0xfb0
? _raw_spin_unlock+0x24/0x30
? __handle_mm_fault+0x8e7/0xfb0
? do_vfs_ioctl+0xa5/0x6e0
? btrfs_ioctl_get_supported_features+0x30/0x30 [btrfs]
do_vfs_ioctl+0xa5/0x6e0
? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
ksys_ioctl+0x3a/0x70
__x64_sys_ioctl+0x16/0x20
do_syscall_64+0x60/0x1b0
entry_SYSCALL_64_after_hwframe+0x49/0xbe
This happens because during page writeback it's valid for
writepage_delalloc to instantiate a delalloc range which doesn't belong
to the page currently being written back.
The reason this case is valid is due to find_lock_delalloc_range
returning any available range after the passed delalloc_start and
ignoring whether the page under writeback is within that range.
In turn ordered extents (OE) are always created for the returned range
from find_lock_delalloc_range. If, however, a failure occurs while OE
are being created then the clean up code in btrfs_cleanup_ordered_extents
will be called.
Unfortunately the code in btrfs_cleanup_ordered_extents doesn't consider
the case of such 'foreign' range being processed and instead it always
assumes that the range OE are created for belongs to the page. This
leads to the first page of such foregin range to not be cleaned up since
it's deliberately missed and skipped by the current cleaning up code.
Fix this by correctly checking whether the current page belongs to the
range being instantiated and if so adjsut the range parameters passed
for cleaning up. If it doesn't, then just clean the whole OE range
directly.
Fixes: 524272607e88 ("btrfs: Handle delalloc error correctly to avoid ordered extent hang")
CC: stable(a)vger.kernel.org # 4.14+
Reviewed-by: Josef Bacik <josef(a)toxicpanda.com>
Signed-off-by: Nikolay Borisov <nborisov(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index e7b97c699acf..e1451a69432b 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -110,17 +110,17 @@ static void __endio_write_update_ordered(struct inode *inode,
* extent_clear_unlock_delalloc() to clear both the bits EXTENT_DO_ACCOUNTING
* and EXTENT_DELALLOC simultaneously, because that causes the reserved metadata
* to be released, which we want to happen only when finishing the ordered
- * extent (btrfs_finish_ordered_io()). Also note that the caller of
- * btrfs_run_delalloc_range already does proper cleanup for the first page of
- * the range, that is, it invokes the callback writepage_end_io_hook() for the
- * range of the first page.
+ * extent (btrfs_finish_ordered_io()).
*/
static inline void btrfs_cleanup_ordered_extents(struct inode *inode,
- const u64 offset,
- const u64 bytes)
+ struct page *locked_page,
+ u64 offset, u64 bytes)
{
unsigned long index = offset >> PAGE_SHIFT;
unsigned long end_index = (offset + bytes - 1) >> PAGE_SHIFT;
+ u64 page_start = page_offset(locked_page);
+ u64 page_end = page_start + PAGE_SIZE - 1;
+
struct page *page;
while (index <= end_index) {
@@ -131,8 +131,18 @@ static inline void btrfs_cleanup_ordered_extents(struct inode *inode,
ClearPagePrivate2(page);
put_page(page);
}
- return __endio_write_update_ordered(inode, offset + PAGE_SIZE,
- bytes - PAGE_SIZE, false);
+
+ /*
+ * In case this page belongs to the delalloc range being instantiated
+ * then skip it, since the first page of a range is going to be
+ * properly cleaned up by the caller of run_delalloc_range
+ */
+ if (page_start >= offset && page_end <= (offset + bytes - 1)) {
+ offset += PAGE_SIZE;
+ bytes -= PAGE_SIZE;
+ }
+
+ return __endio_write_update_ordered(inode, offset, bytes, false);
}
static int btrfs_dirty_inode(struct inode *inode);
@@ -1603,7 +1613,8 @@ int btrfs_run_delalloc_range(void *private_data, struct page *locked_page,
write_flags);
}
if (ret)
- btrfs_cleanup_ordered_extents(inode, start, end - start + 1);
+ btrfs_cleanup_ordered_extents(inode, locked_page, start,
+ end - start + 1);
return ret;
}
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From a5fb11429167ee6ddeeacc554efaf5776b36433a Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Mon, 26 Nov 2018 20:07:17 +0000
Subject: [PATCH] Btrfs: fix deadlock with memory reclaim during scrub
When a transaction commit starts, it attempts to pause scrub and it blocks
until the scrub is paused. So while the transaction is blocked waiting for
scrub to pause, we can not do memory allocation with GFP_KERNEL from scrub,
otherwise we risk getting into a deadlock with reclaim.
Checking for scrub pause requests is done early at the beginning of the
while loop of scrub_stripe() and later in the loop, scrub_extent() and
scrub_raid56_parity() are called, which in turn call scrub_pages() and
scrub_pages_for_parity() respectively. These last two functions do memory
allocations using GFP_KERNEL. Same problem could happen while scrubbing
the super blocks, since it calls scrub_pages().
We also can not have any of the worker tasks, created by the scrub task,
doing GFP_KERNEL allocations, because before pausing, the scrub task waits
for all the worker tasks to complete (also done at scrub_stripe()).
So make sure GFP_NOFS is used for the memory allocations because at any
time a scrub pause request can happen from another task that started to
commit a transaction.
Fixes: 58c4e173847a ("btrfs: scrub: use GFP_KERNEL on the submission path")
CC: stable(a)vger.kernel.org # 4.6+
Reviewed-by: Nikolay Borisov <nborisov(a)suse.com>
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 902819d3cf41..bbd1b36f4918 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -322,6 +322,7 @@ static struct full_stripe_lock *insert_full_stripe_lock(
struct rb_node *parent = NULL;
struct full_stripe_lock *entry;
struct full_stripe_lock *ret;
+ unsigned int nofs_flag;
lockdep_assert_held(&locks_root->lock);
@@ -339,8 +340,17 @@ static struct full_stripe_lock *insert_full_stripe_lock(
}
}
- /* Insert new lock */
+ /*
+ * Insert new lock.
+ *
+ * We must use GFP_NOFS because the scrub task might be waiting for a
+ * worker task executing this function and in turn a transaction commit
+ * might be waiting the scrub task to pause (which needs to wait for all
+ * the worker tasks to complete before pausing).
+ */
+ nofs_flag = memalloc_nofs_save();
ret = kmalloc(sizeof(*ret), GFP_KERNEL);
+ memalloc_nofs_restore(nofs_flag);
if (!ret)
return ERR_PTR(-ENOMEM);
ret->logical = fstripe_logical;
@@ -1620,8 +1630,19 @@ static int scrub_add_page_to_wr_bio(struct scrub_ctx *sctx,
mutex_lock(&sctx->wr_lock);
again:
if (!sctx->wr_curr_bio) {
+ unsigned int nofs_flag;
+
+ /*
+ * We must use GFP_NOFS because the scrub task might be waiting
+ * for a worker task executing this function and in turn a
+ * transaction commit might be waiting the scrub task to pause
+ * (which needs to wait for all the worker tasks to complete
+ * before pausing).
+ */
+ nofs_flag = memalloc_nofs_save();
sctx->wr_curr_bio = kzalloc(sizeof(*sctx->wr_curr_bio),
GFP_KERNEL);
+ memalloc_nofs_restore(nofs_flag);
if (!sctx->wr_curr_bio) {
mutex_unlock(&sctx->wr_lock);
return -ENOMEM;
@@ -3772,6 +3793,7 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
struct scrub_ctx *sctx;
int ret;
struct btrfs_device *dev;
+ unsigned int nofs_flag;
if (btrfs_fs_closing(fs_info))
return -EINVAL;
@@ -3875,6 +3897,16 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
atomic_inc(&fs_info->scrubs_running);
mutex_unlock(&fs_info->scrub_lock);
+ /*
+ * In order to avoid deadlock with reclaim when there is a transaction
+ * trying to pause scrub, make sure we use GFP_NOFS for all the
+ * allocations done at btrfs_scrub_pages() and scrub_pages_for_parity()
+ * invoked by our callees. The pausing request is done when the
+ * transaction commit starts, and it blocks the transaction until scrub
+ * is paused (done at specific points at scrub_stripe() or right above
+ * before incrementing fs_info->scrubs_running).
+ */
+ nofs_flag = memalloc_nofs_save();
if (!is_dev_replace) {
/*
* by holding device list mutex, we can
@@ -3887,6 +3919,7 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
if (!ret)
ret = scrub_enumerate_chunks(sctx, dev, start, end);
+ memalloc_nofs_restore(nofs_flag);
wait_event(sctx->list_wait, atomic_read(&sctx->bios_in_flight) == 0);
atomic_dec(&fs_info->scrubs_running);
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From a5fb11429167ee6ddeeacc554efaf5776b36433a Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Mon, 26 Nov 2018 20:07:17 +0000
Subject: [PATCH] Btrfs: fix deadlock with memory reclaim during scrub
When a transaction commit starts, it attempts to pause scrub and it blocks
until the scrub is paused. So while the transaction is blocked waiting for
scrub to pause, we can not do memory allocation with GFP_KERNEL from scrub,
otherwise we risk getting into a deadlock with reclaim.
Checking for scrub pause requests is done early at the beginning of the
while loop of scrub_stripe() and later in the loop, scrub_extent() and
scrub_raid56_parity() are called, which in turn call scrub_pages() and
scrub_pages_for_parity() respectively. These last two functions do memory
allocations using GFP_KERNEL. Same problem could happen while scrubbing
the super blocks, since it calls scrub_pages().
We also can not have any of the worker tasks, created by the scrub task,
doing GFP_KERNEL allocations, because before pausing, the scrub task waits
for all the worker tasks to complete (also done at scrub_stripe()).
So make sure GFP_NOFS is used for the memory allocations because at any
time a scrub pause request can happen from another task that started to
commit a transaction.
Fixes: 58c4e173847a ("btrfs: scrub: use GFP_KERNEL on the submission path")
CC: stable(a)vger.kernel.org # 4.6+
Reviewed-by: Nikolay Borisov <nborisov(a)suse.com>
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 902819d3cf41..bbd1b36f4918 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -322,6 +322,7 @@ static struct full_stripe_lock *insert_full_stripe_lock(
struct rb_node *parent = NULL;
struct full_stripe_lock *entry;
struct full_stripe_lock *ret;
+ unsigned int nofs_flag;
lockdep_assert_held(&locks_root->lock);
@@ -339,8 +340,17 @@ static struct full_stripe_lock *insert_full_stripe_lock(
}
}
- /* Insert new lock */
+ /*
+ * Insert new lock.
+ *
+ * We must use GFP_NOFS because the scrub task might be waiting for a
+ * worker task executing this function and in turn a transaction commit
+ * might be waiting the scrub task to pause (which needs to wait for all
+ * the worker tasks to complete before pausing).
+ */
+ nofs_flag = memalloc_nofs_save();
ret = kmalloc(sizeof(*ret), GFP_KERNEL);
+ memalloc_nofs_restore(nofs_flag);
if (!ret)
return ERR_PTR(-ENOMEM);
ret->logical = fstripe_logical;
@@ -1620,8 +1630,19 @@ static int scrub_add_page_to_wr_bio(struct scrub_ctx *sctx,
mutex_lock(&sctx->wr_lock);
again:
if (!sctx->wr_curr_bio) {
+ unsigned int nofs_flag;
+
+ /*
+ * We must use GFP_NOFS because the scrub task might be waiting
+ * for a worker task executing this function and in turn a
+ * transaction commit might be waiting the scrub task to pause
+ * (which needs to wait for all the worker tasks to complete
+ * before pausing).
+ */
+ nofs_flag = memalloc_nofs_save();
sctx->wr_curr_bio = kzalloc(sizeof(*sctx->wr_curr_bio),
GFP_KERNEL);
+ memalloc_nofs_restore(nofs_flag);
if (!sctx->wr_curr_bio) {
mutex_unlock(&sctx->wr_lock);
return -ENOMEM;
@@ -3772,6 +3793,7 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
struct scrub_ctx *sctx;
int ret;
struct btrfs_device *dev;
+ unsigned int nofs_flag;
if (btrfs_fs_closing(fs_info))
return -EINVAL;
@@ -3875,6 +3897,16 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
atomic_inc(&fs_info->scrubs_running);
mutex_unlock(&fs_info->scrub_lock);
+ /*
+ * In order to avoid deadlock with reclaim when there is a transaction
+ * trying to pause scrub, make sure we use GFP_NOFS for all the
+ * allocations done at btrfs_scrub_pages() and scrub_pages_for_parity()
+ * invoked by our callees. The pausing request is done when the
+ * transaction commit starts, and it blocks the transaction until scrub
+ * is paused (done at specific points at scrub_stripe() or right above
+ * before incrementing fs_info->scrubs_running).
+ */
+ nofs_flag = memalloc_nofs_save();
if (!is_dev_replace) {
/*
* by holding device list mutex, we can
@@ -3887,6 +3919,7 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
if (!ret)
ret = scrub_enumerate_chunks(sctx, dev, start, end);
+ memalloc_nofs_restore(nofs_flag);
wait_event(sctx->list_wait, atomic_read(&sctx->bios_in_flight) == 0);
atomic_dec(&fs_info->scrubs_running);
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 0d228ece59a35a9b9e8ff0d40653234a6d90f61e Mon Sep 17 00:00:00 2001
From: Anand Jain <anand.jain(a)oracle.com>
Date: Sun, 11 Nov 2018 22:22:17 +0800
Subject: [PATCH] btrfs: dev-replace: go back to suspended state if target
device is missing
At the time of forced unmount we place the running replace to
BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED state, so when the system comes
back and expect the target device is missing.
Then let the replace state continue to be in
BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED state instead of
BTRFS_IOCTL_DEV_REPLACE_STATE_STARTED as there isn't any matching scrub
running as part of replace.
Fixes: e93c89c1aaaa ("Btrfs: add new sources for device replace code")
CC: stable(a)vger.kernel.org # 4.4+
Signed-off-by: Anand Jain <anand.jain(a)oracle.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
index 32da6901dc88..11df8f778b63 100644
--- a/fs/btrfs/dev-replace.c
+++ b/fs/btrfs/dev-replace.c
@@ -890,6 +890,8 @@ int btrfs_resume_dev_replace_async(struct btrfs_fs_info *fs_info)
"cannot continue dev_replace, tgtdev is missing");
btrfs_info(fs_info,
"you may cancel the operation after 'mount -o degraded'");
+ dev_replace->replace_state =
+ BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED;
btrfs_dev_replace_write_unlock(dev_replace);
return 0;
}
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 0d228ece59a35a9b9e8ff0d40653234a6d90f61e Mon Sep 17 00:00:00 2001
From: Anand Jain <anand.jain(a)oracle.com>
Date: Sun, 11 Nov 2018 22:22:17 +0800
Subject: [PATCH] btrfs: dev-replace: go back to suspended state if target
device is missing
At the time of forced unmount we place the running replace to
BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED state, so when the system comes
back and expect the target device is missing.
Then let the replace state continue to be in
BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED state instead of
BTRFS_IOCTL_DEV_REPLACE_STATE_STARTED as there isn't any matching scrub
running as part of replace.
Fixes: e93c89c1aaaa ("Btrfs: add new sources for device replace code")
CC: stable(a)vger.kernel.org # 4.4+
Signed-off-by: Anand Jain <anand.jain(a)oracle.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
index 32da6901dc88..11df8f778b63 100644
--- a/fs/btrfs/dev-replace.c
+++ b/fs/btrfs/dev-replace.c
@@ -890,6 +890,8 @@ int btrfs_resume_dev_replace_async(struct btrfs_fs_info *fs_info)
"cannot continue dev_replace, tgtdev is missing");
btrfs_info(fs_info,
"you may cancel the operation after 'mount -o degraded'");
+ dev_replace->replace_state =
+ BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED;
btrfs_dev_replace_write_unlock(dev_replace);
return 0;
}
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 65b6657672388b72822e0367f06d41c1e3ffb5bb Mon Sep 17 00:00:00 2001
From: Jernej Skrabec <jernej.skrabec(a)siol.net>
Date: Sun, 4 Nov 2018 19:26:40 +0100
Subject: [PATCH] clk: sunxi-ng: Use u64 for calculation of NM rate
Allwinner H6 SoC has multiplier N range between 1 and 254. Since parent
rate is 24MHz, intermediate result when calculating final rate easily
overflows 32 bit variable.
Because of that, introduce function for calculating clock rate which
uses 64 bit variable for intermediate result.
Fixes: 6174a1e24b0d ("clk: sunxi-ng: Add N-M-factor clock support")
Fixes: ee28648cb2b4 ("clk: sunxi-ng: Remove the use of rational computations")
CC: <stable(a)vger.kernel.org>
Signed-off-by: Jernej Skrabec <jernej.skrabec(a)siol.net>
Signed-off-by: Maxime Ripard <maxime.ripard(a)bootlin.com>
diff --git a/drivers/clk/sunxi-ng/ccu_nm.c b/drivers/clk/sunxi-ng/ccu_nm.c
index 6fe3c14f7b2d..424d8635b053 100644
--- a/drivers/clk/sunxi-ng/ccu_nm.c
+++ b/drivers/clk/sunxi-ng/ccu_nm.c
@@ -19,6 +19,17 @@ struct _ccu_nm {
unsigned long m, min_m, max_m;
};
+static unsigned long ccu_nm_calc_rate(unsigned long parent,
+ unsigned long n, unsigned long m)
+{
+ u64 rate = parent;
+
+ rate *= n;
+ do_div(rate, m);
+
+ return rate;
+}
+
static void ccu_nm_find_best(unsigned long parent, unsigned long rate,
struct _ccu_nm *nm)
{
@@ -28,7 +39,8 @@ static void ccu_nm_find_best(unsigned long parent, unsigned long rate,
for (_n = nm->min_n; _n <= nm->max_n; _n++) {
for (_m = nm->min_m; _m <= nm->max_m; _m++) {
- unsigned long tmp_rate = parent * _n / _m;
+ unsigned long tmp_rate = ccu_nm_calc_rate(parent,
+ _n, _m);
if (tmp_rate > rate)
continue;
@@ -100,7 +112,7 @@ static unsigned long ccu_nm_recalc_rate(struct clk_hw *hw,
if (ccu_sdm_helper_is_enabled(&nm->common, &nm->sdm))
rate = ccu_sdm_helper_read_rate(&nm->common, &nm->sdm, m, n);
else
- rate = parent_rate * n / m;
+ rate = ccu_nm_calc_rate(parent_rate, n, m);
if (nm->common.features & CCU_FEATURE_FIXED_POSTDIV)
rate /= nm->fixed_post_div;
@@ -149,7 +161,7 @@ static long ccu_nm_round_rate(struct clk_hw *hw, unsigned long rate,
_nm.max_m = nm->m.max ?: 1 << nm->m.width;
ccu_nm_find_best(*parent_rate, rate, &_nm);
- rate = *parent_rate * _nm.n / _nm.m;
+ rate = ccu_nm_calc_rate(*parent_rate, _nm.n, _nm.m);
if (nm->common.features & CCU_FEATURE_FIXED_POSTDIV)
rate /= nm->fixed_post_div;
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 1b3ab5ad1b8ad99bae76ec583809c5f5a31c707c Mon Sep 17 00:00:00 2001
From: Sean Christopherson <sean.j.christopherson(a)intel.com>
Date: Mon, 3 Dec 2018 13:52:51 -0800
Subject: [PATCH] KVM: nVMX: Free the VMREAD/VMWRITE bitmaps if
alloc_kvm_area() fails
Fixes: 34a1cd60d17f ("kvm: x86: vmx: move some vmx setting from vmx_init() to hardware_setup()")
Cc: stable(a)vger.kernel.org
Signed-off-by: Sean Christopherson <sean.j.christopherson(a)intel.com>
Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com>
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index c379d0bfdcba..3ec47b7a94d6 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8037,13 +8037,16 @@ static __init int hardware_setup(void)
kvm_mce_cap_supported |= MCG_LMCE_P;
- return alloc_kvm_area();
+ r = alloc_kvm_area();
+ if (r)
+ goto out;
+ return 0;
out:
for (i = 0; i < VMX_BITMAP_NR; i++)
free_page((unsigned long)vmx_bitmap[i]);
- return r;
+ return r;
}
static __exit void hardware_unsetup(void)
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 1b3ab5ad1b8ad99bae76ec583809c5f5a31c707c Mon Sep 17 00:00:00 2001
From: Sean Christopherson <sean.j.christopherson(a)intel.com>
Date: Mon, 3 Dec 2018 13:52:51 -0800
Subject: [PATCH] KVM: nVMX: Free the VMREAD/VMWRITE bitmaps if
alloc_kvm_area() fails
Fixes: 34a1cd60d17f ("kvm: x86: vmx: move some vmx setting from vmx_init() to hardware_setup()")
Cc: stable(a)vger.kernel.org
Signed-off-by: Sean Christopherson <sean.j.christopherson(a)intel.com>
Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com>
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index c379d0bfdcba..3ec47b7a94d6 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8037,13 +8037,16 @@ static __init int hardware_setup(void)
kvm_mce_cap_supported |= MCG_LMCE_P;
- return alloc_kvm_area();
+ r = alloc_kvm_area();
+ if (r)
+ goto out;
+ return 0;
out:
for (i = 0; i < VMX_BITMAP_NR; i++)
free_page((unsigned long)vmx_bitmap[i]);
- return r;
+ return r;
}
static __exit void hardware_unsetup(void)
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 1b3ab5ad1b8ad99bae76ec583809c5f5a31c707c Mon Sep 17 00:00:00 2001
From: Sean Christopherson <sean.j.christopherson(a)intel.com>
Date: Mon, 3 Dec 2018 13:52:51 -0800
Subject: [PATCH] KVM: nVMX: Free the VMREAD/VMWRITE bitmaps if
alloc_kvm_area() fails
Fixes: 34a1cd60d17f ("kvm: x86: vmx: move some vmx setting from vmx_init() to hardware_setup()")
Cc: stable(a)vger.kernel.org
Signed-off-by: Sean Christopherson <sean.j.christopherson(a)intel.com>
Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com>
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index c379d0bfdcba..3ec47b7a94d6 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8037,13 +8037,16 @@ static __init int hardware_setup(void)
kvm_mce_cap_supported |= MCG_LMCE_P;
- return alloc_kvm_area();
+ r = alloc_kvm_area();
+ if (r)
+ goto out;
+ return 0;
out:
for (i = 0; i < VMX_BITMAP_NR; i++)
free_page((unsigned long)vmx_bitmap[i]);
- return r;
+ return r;
}
static __exit void hardware_unsetup(void)
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 234ff0b729ad882d20f7996591a964965647addf Mon Sep 17 00:00:00 2001
From: Paul Mackerras <paulus(a)ozlabs.org>
Date: Fri, 16 Nov 2018 21:28:18 +1100
Subject: [PATCH] KVM: PPC: Book3S HV: Fix race between kvm_unmap_hva_range and
MMU mode switch
Testing has revealed an occasional crash which appears to be caused
by a race between kvmppc_switch_mmu_to_hpt and kvm_unmap_hva_range_hv.
The symptom is a NULL pointer dereference in __find_linux_pte() called
from kvm_unmap_radix() with kvm->arch.pgtable == NULL.
Looking at kvmppc_switch_mmu_to_hpt(), it does indeed clear
kvm->arch.pgtable (via kvmppc_free_radix()) before setting
kvm->arch.radix to NULL, and there is nothing to prevent
kvm_unmap_hva_range_hv() or the other MMU callback functions from
being called concurrently with kvmppc_switch_mmu_to_hpt() or
kvmppc_switch_mmu_to_radix().
This patch therefore adds calls to spin_lock/unlock on the kvm->mmu_lock
around the assignments to kvm->arch.radix, and makes sure that the
partition-scoped radix tree or HPT is only freed after changing
kvm->arch.radix.
This also takes the kvm->mmu_lock in kvmppc_rmap_reset() to make sure
that the clearing of each rmap array (one per memslot) doesn't happen
concurrently with use of the array in the kvm_unmap_hva_range_hv()
or the other MMU callbacks.
Fixes: 18c3640cefc7 ("KVM: PPC: Book3S HV: Add infrastructure for running HPT guests on radix host")
Cc: stable(a)vger.kernel.org # v4.15+
Signed-off-by: Paul Mackerras <paulus(a)ozlabs.org>
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index c615617e78ac..a18afda3d0f0 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -743,12 +743,15 @@ void kvmppc_rmap_reset(struct kvm *kvm)
srcu_idx = srcu_read_lock(&kvm->srcu);
slots = kvm_memslots(kvm);
kvm_for_each_memslot(memslot, slots) {
+ /* Mutual exclusion with kvm_unmap_hva_range etc. */
+ spin_lock(&kvm->mmu_lock);
/*
* This assumes it is acceptable to lose reference and
* change bits across a reset.
*/
memset(memslot->arch.rmap, 0,
memslot->npages * sizeof(*memslot->arch.rmap));
+ spin_unlock(&kvm->mmu_lock);
}
srcu_read_unlock(&kvm->srcu, srcu_idx);
}
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index a56f8413758a..ab43306c4ea1 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -4532,12 +4532,15 @@ int kvmppc_switch_mmu_to_hpt(struct kvm *kvm)
{
if (nesting_enabled(kvm))
kvmhv_release_all_nested(kvm);
+ kvmppc_rmap_reset(kvm);
+ kvm->arch.process_table = 0;
+ /* Mutual exclusion with kvm_unmap_hva_range etc. */
+ spin_lock(&kvm->mmu_lock);
+ kvm->arch.radix = 0;
+ spin_unlock(&kvm->mmu_lock);
kvmppc_free_radix(kvm);
kvmppc_update_lpcr(kvm, LPCR_VPM1,
LPCR_VPM1 | LPCR_UPRT | LPCR_GTSE | LPCR_HR);
- kvmppc_rmap_reset(kvm);
- kvm->arch.radix = 0;
- kvm->arch.process_table = 0;
return 0;
}
@@ -4549,12 +4552,14 @@ int kvmppc_switch_mmu_to_radix(struct kvm *kvm)
err = kvmppc_init_vm_radix(kvm);
if (err)
return err;
-
+ kvmppc_rmap_reset(kvm);
+ /* Mutual exclusion with kvm_unmap_hva_range etc. */
+ spin_lock(&kvm->mmu_lock);
+ kvm->arch.radix = 1;
+ spin_unlock(&kvm->mmu_lock);
kvmppc_free_hpt(&kvm->arch.hpt);
kvmppc_update_lpcr(kvm, LPCR_UPRT | LPCR_GTSE | LPCR_HR,
LPCR_VPM1 | LPCR_UPRT | LPCR_GTSE | LPCR_HR);
- kvmppc_rmap_reset(kvm);
- kvm->arch.radix = 1;
return 0;
}
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 5b5e4d623ec8a34689df98e42d038a3b594d2ff9 Mon Sep 17 00:00:00 2001
From: Michal Hocko <mhocko(a)suse.com>
Date: Tue, 13 Nov 2018 19:49:10 +0100
Subject: [PATCH] x86/speculation/l1tf: Drop the swap storage limit restriction
when l1tf=off
Swap storage is restricted to max_swapfile_size (~16TB on x86_64) whenever
the system is deemed affected by L1TF vulnerability. Even though the limit
is quite high for most deployments it seems to be too restrictive for
deployments which are willing to live with the mitigation disabled.
We have a customer to deploy 8x 6,4TB PCIe/NVMe SSD swap devices which is
clearly out of the limit.
Drop the swap restriction when l1tf=off is specified. It also doesn't make
much sense to warn about too much memory for the l1tf mitigation when it is
forcefully disabled by the administrator.
[ tglx: Folded the documentation delta change ]
Fixes: 377eeaa8e11f ("x86/speculation/l1tf: Limit swap file size to MAX_PA/2")
Signed-off-by: Michal Hocko <mhocko(a)suse.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Reviewed-by: Pavel Tatashin <pasha.tatashin(a)soleen.com>
Reviewed-by: Andi Kleen <ak(a)linux.intel.com>
Acked-by: Jiri Kosina <jkosina(a)suse.cz>
Cc: Linus Torvalds <torvalds(a)linux-foundation.org>
Cc: Dave Hansen <dave.hansen(a)intel.com>
Cc: Andi Kleen <ak(a)linux.intel.com>
Cc: Borislav Petkov <bp(a)suse.de>
Cc: <linux-mm(a)kvack.org>
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20181113184910.26697-1-mhocko@kernel.org
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 05a252e5178d..835e422572eb 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -2095,6 +2095,9 @@
off
Disables hypervisor mitigations and doesn't
emit any warnings.
+ It also drops the swap size and available
+ RAM limit restriction on both hypervisor and
+ bare metal.
Default is 'flush'.
diff --git a/Documentation/admin-guide/l1tf.rst b/Documentation/admin-guide/l1tf.rst
index b85dd80510b0..9af977384168 100644
--- a/Documentation/admin-guide/l1tf.rst
+++ b/Documentation/admin-guide/l1tf.rst
@@ -405,6 +405,9 @@ time with the option "l1tf=". The valid arguments for this option are:
off Disables hypervisor mitigations and doesn't emit any
warnings.
+ It also drops the swap size and available RAM limit restrictions
+ on both hypervisor and bare metal.
+
============ =============================================================
The default is 'flush'. For details about L1D flushing see :ref:`l1d_flush`.
@@ -576,7 +579,8 @@ Default mitigations
The kernel default mitigations for vulnerable processors are:
- PTE inversion to protect against malicious user space. This is done
- unconditionally and cannot be controlled.
+ unconditionally and cannot be controlled. The swap storage is limited
+ to ~16TB.
- L1D conditional flushing on VMENTER when EPT is enabled for
a guest.
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index a68b32cb845a..58689ac64440 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1002,7 +1002,8 @@ static void __init l1tf_select_mitigation(void)
#endif
half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT;
- if (e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {
+ if (l1tf_mitigation != L1TF_MITIGATION_OFF &&
+ e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {
pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n");
pr_info("You may make it effective by booting the kernel with mem=%llu parameter.\n",
half_pa);
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index ef99f3892e1f..427a955a2cf2 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -931,7 +931,7 @@ unsigned long max_swapfile_size(void)
pages = generic_max_swapfile_size();
- if (boot_cpu_has_bug(X86_BUG_L1TF)) {
+ if (boot_cpu_has_bug(X86_BUG_L1TF) && l1tf_mitigation != L1TF_MITIGATION_OFF) {
/* Limit the swap file size to MAX_PA/2 for L1TF workaround */
unsigned long long l1tf_limit = l1tf_pfn_limit();
/*
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 5b5e4d623ec8a34689df98e42d038a3b594d2ff9 Mon Sep 17 00:00:00 2001
From: Michal Hocko <mhocko(a)suse.com>
Date: Tue, 13 Nov 2018 19:49:10 +0100
Subject: [PATCH] x86/speculation/l1tf: Drop the swap storage limit restriction
when l1tf=off
Swap storage is restricted to max_swapfile_size (~16TB on x86_64) whenever
the system is deemed affected by L1TF vulnerability. Even though the limit
is quite high for most deployments it seems to be too restrictive for
deployments which are willing to live with the mitigation disabled.
We have a customer to deploy 8x 6,4TB PCIe/NVMe SSD swap devices which is
clearly out of the limit.
Drop the swap restriction when l1tf=off is specified. It also doesn't make
much sense to warn about too much memory for the l1tf mitigation when it is
forcefully disabled by the administrator.
[ tglx: Folded the documentation delta change ]
Fixes: 377eeaa8e11f ("x86/speculation/l1tf: Limit swap file size to MAX_PA/2")
Signed-off-by: Michal Hocko <mhocko(a)suse.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Reviewed-by: Pavel Tatashin <pasha.tatashin(a)soleen.com>
Reviewed-by: Andi Kleen <ak(a)linux.intel.com>
Acked-by: Jiri Kosina <jkosina(a)suse.cz>
Cc: Linus Torvalds <torvalds(a)linux-foundation.org>
Cc: Dave Hansen <dave.hansen(a)intel.com>
Cc: Andi Kleen <ak(a)linux.intel.com>
Cc: Borislav Petkov <bp(a)suse.de>
Cc: <linux-mm(a)kvack.org>
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20181113184910.26697-1-mhocko@kernel.org
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 05a252e5178d..835e422572eb 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -2095,6 +2095,9 @@
off
Disables hypervisor mitigations and doesn't
emit any warnings.
+ It also drops the swap size and available
+ RAM limit restriction on both hypervisor and
+ bare metal.
Default is 'flush'.
diff --git a/Documentation/admin-guide/l1tf.rst b/Documentation/admin-guide/l1tf.rst
index b85dd80510b0..9af977384168 100644
--- a/Documentation/admin-guide/l1tf.rst
+++ b/Documentation/admin-guide/l1tf.rst
@@ -405,6 +405,9 @@ time with the option "l1tf=". The valid arguments for this option are:
off Disables hypervisor mitigations and doesn't emit any
warnings.
+ It also drops the swap size and available RAM limit restrictions
+ on both hypervisor and bare metal.
+
============ =============================================================
The default is 'flush'. For details about L1D flushing see :ref:`l1d_flush`.
@@ -576,7 +579,8 @@ Default mitigations
The kernel default mitigations for vulnerable processors are:
- PTE inversion to protect against malicious user space. This is done
- unconditionally and cannot be controlled.
+ unconditionally and cannot be controlled. The swap storage is limited
+ to ~16TB.
- L1D conditional flushing on VMENTER when EPT is enabled for
a guest.
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index a68b32cb845a..58689ac64440 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1002,7 +1002,8 @@ static void __init l1tf_select_mitigation(void)
#endif
half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT;
- if (e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {
+ if (l1tf_mitigation != L1TF_MITIGATION_OFF &&
+ e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {
pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n");
pr_info("You may make it effective by booting the kernel with mem=%llu parameter.\n",
half_pa);
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index ef99f3892e1f..427a955a2cf2 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -931,7 +931,7 @@ unsigned long max_swapfile_size(void)
pages = generic_max_swapfile_size();
- if (boot_cpu_has_bug(X86_BUG_L1TF)) {
+ if (boot_cpu_has_bug(X86_BUG_L1TF) && l1tf_mitigation != L1TF_MITIGATION_OFF) {
/* Limit the swap file size to MAX_PA/2 for L1TF workaround */
unsigned long long l1tf_limit = l1tf_pfn_limit();
/*
Hello!
Please apply commit 102cd9096356 ("qmi_wwan: apply SET_DTR quirk to the
SIMCOM shared device ID") to the v4.9 and v4.14 longterm branches.
Note: There is no point in backporting it to earlier releases, as the
affected devices need the "raw-ip" feature introduced in v4.5.
Thanks,
Bjørn
Build failure log of arm - BeagleBoard-X15 board while make modules
Git branch: linux-4.14.y
Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Git commit: b8b55f8fd937348f867eb0e4098b6d658959d075
In file included from sound/pci/hda/patch_realtek.c:33:0:
sound/pci/hda/patch_realtek.c:6381:48: error: 'ALC294_FIXUP_ASUS_SPK'
undeclared here (not in a function); did you mean
'ALC256_FIXUP_ASUS_MIC'?
SND_PCI_QUIRK(0x1043, 0x10a1, "ASUS UX391UA", ALC294_FIXUP_ASUS_SPK),
^
include/sound/core.h:415:43: note: in definition of macro 'SND_PCI_QUIRK'
{_SND_PCI_QUIRK_ID(vend, dev), .value = (val)}
^~~
CC [M] drivers/cpufreq/highbank-cpufreq.o
scripts/Makefile.build:326: recipe for target
'sound/pci/hda/patch_realtek.o' failed
make[5]: *** [sound/pci/hda/patch_realtek.o] Error 1
- Naresh
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 94ea56cff506c769a509c5dd87904c7fe3806a81 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede(a)redhat.com>
Date: Mon, 3 Dec 2018 21:45:14 +0100
Subject: [PATCH] ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for
Chromebook Gnawty
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The Gnawty model Chromebook uses pmc_plt_clk_0 instead of pmc_plt_clk_3
for the mclk, just like the Clapper and Swanky models.
This commit adds a DMI based quirk for this.
This fixing audio no longer working on these devices after
commit 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL")
that commit fixes us unnecessary keeping unused clocks on, but in case of
the Gnawty that was breaking audio support since we were not using the
right clock in the cht_bsw_max98090_ti machine driver.
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201787
Cc: stable(a)vger.kernel.org
Fixes: 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL")
Reported-and-tested-by: Jaime Pérez <19.jaime.91(a)gmail.com>
Signed-off-by: Hans de Goede <hdegoede(a)redhat.com>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
Signed-off-by: Mark Brown <broonie(a)kernel.org>
diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
index ad0c98383853..08a5152e635a 100644
--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
@@ -396,6 +396,13 @@ static const struct dmi_system_id cht_max98090_quirk_table[] = {
},
.driver_data = (void *)QUIRK_PMC_PLT_CLK_0,
},
+ {
+ /* Gnawty model Chromebook (Acer Chromebook CB3-111) */
+ .matches = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Gnawty"),
+ },
+ .driver_data = (void *)QUIRK_PMC_PLT_CLK_0,
+ },
{
/* Swanky model Chromebook (Toshiba Chromebook 2) */
.matches = {
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 984bfb398a3af6fa9b7e80165e524933b0616686 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede(a)redhat.com>
Date: Sun, 2 Dec 2018 13:21:22 +0100
Subject: [PATCH] ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for
Chromebook Clapper
The Clapper model Chromebook uses pmc_plt_clk_0 instead of pmc_plt_clk_3
for the mclk, just like the Swanky model.
This commit adds a DMI based quirk for this.
This fixing audio no longer working on these devices after
commit 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL")
that commit fixes us unnecessary keeping unused clocks on, but in case of
the Clapper that was breaking audio support since we were not using the
right clock in the cht_bsw_max98090_ti machine driver.
Cc: stable(a)vger.kernel.org
Fixes: 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL")
Signed-off-by: Hans de Goede <hdegoede(a)redhat.com>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
Signed-off-by: Mark Brown <broonie(a)kernel.org>
diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
index 9d9f6e41d81c..ad0c98383853 100644
--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
@@ -389,6 +389,13 @@ static struct snd_soc_card snd_soc_card_cht = {
};
static const struct dmi_system_id cht_max98090_quirk_table[] = {
+ {
+ /* Clapper model Chromebook */
+ .matches = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Clapper"),
+ },
+ .driver_data = (void *)QUIRK_PMC_PLT_CLK_0,
+ },
{
/* Swanky model Chromebook (Toshiba Chromebook 2) */
.matches = {
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b637ef779575a977068025f842ecd480a9671f3f Mon Sep 17 00:00:00 2001
From: Boris Brezillon <boris.brezillon(a)bootlin.com>
Date: Thu, 13 Dec 2018 11:55:26 +0100
Subject: [PATCH] mtd: rawnand: Fix JEDEC detection
nand_jedec_detect() should return 1 when the PARAM page parsing
succeeds, otherwise the core considers JEDEC detection failed and falls
back to ID-based detection.
Fixes: 480139d9229e ("mtd: rawnand: get rid of the JEDEC parameter page in nand_chip")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Boris Brezillon <boris.brezillon(a)bootlin.com>
Acked-by: Miquel Raynal <miquel.raynal(a)bootlin.com>
Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com>
diff --git a/drivers/mtd/nand/raw/nand_jedec.c b/drivers/mtd/nand/raw/nand_jedec.c
index 5c26492c841d..38b5dc22cb30 100644
--- a/drivers/mtd/nand/raw/nand_jedec.c
+++ b/drivers/mtd/nand/raw/nand_jedec.c
@@ -107,6 +107,8 @@ int nand_jedec_detect(struct nand_chip *chip)
pr_warn("Invalid codeword size\n");
}
+ ret = 1;
+
free_jedec_param_page:
kfree(p);
return ret;
On Fri, Jan 04, 2019 at 09:03:10PM +0000, Sasha Levin wrote:
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: a7d85e06ed80 crypto: cfb - add support for Cipher FeedBack mode.
>
> The bot has tested the following trees: v4.20.0, v4.19.13.
>
> v4.20.0: Failed to apply! Possible dependencies:
> 7da66670775d ("crypto: testmgr - add AES-CFB tests")
>
> v4.19.13: Failed to apply! Possible dependencies:
> 7da66670775d ("crypto: testmgr - add AES-CFB tests")
> dfb89ab3f0a7 ("crypto: tcrypt - add OFB functional tests")
>
>
> How should we proceed with this patch?
>
> --
> Thanks,
> Sasha
The following will need to be applied to 4.19 and 4.20 first. Both had Cc stable:
fa4600734b74 ("crypto: cfb - fix decryption")
7da66670775d ("crypto: testmgr - add AES-CFB tests")
Herbert, why was CFB accepted without any test vectors in the first place?
- Eric
The patch titled
Subject: mm/vmalloc: fix size check for remap_vmalloc_range_partial()
has been added to the -mm tree. Its filename is
mm-vmalloc-fix-size-check-for-remap_vmalloc_range_partial.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-vmalloc-fix-size-check-for-rema…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-vmalloc-fix-size-check-for-rema…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Roman Penyaev <rpenyaev(a)suse.de>
Subject: mm/vmalloc: fix size check for remap_vmalloc_range_partial()
When VM_NO_GUARD is not set area->size includes adjacent guard page,
thus for correct size checking get_vm_area_size() should be used, but
not area->size.
This fixes possible kernel oops when userspace tries to mmap an area on
1 page bigger than was allocated by vmalloc_user() call: the size check
inside remap_vmalloc_range_partial() accounts non-existing guard page
also, so check successfully passes but vmalloc_to_page() returns NULL
(guard page does not physically exist).
The following code pattern example should trigger an oops:
static int oops_mmap(struct file *file, struct vm_area_struct *vma)
{
void *mem;
mem = vmalloc_user(4096);
BUG_ON(!mem);
/* Do not care about mem leak */
return remap_vmalloc_range(vma, mem, 0);
}
And userspace simply mmaps size + PAGE_SIZE:
mmap(NULL, 8192, PROT_WRITE|PROT_READ, MAP_PRIVATE, fd, 0);
Possible candidates for oops which do not have any explicit size
checks:
*** drivers/media/usb/stkwebcam/stk-webcam.c:
v4l_stk_mmap[789] ret = remap_vmalloc_range(vma, sbuf->buffer, 0);
Or the following one:
*** drivers/video/fbdev/core/fbmem.c
static int
fb_mmap(struct file *file, struct vm_area_struct * vma)
...
res = fb->fb_mmap(info, vma);
Where fb_mmap callback calls remap_vmalloc_range() directly without any
explicit checks:
*** drivers/video/fbdev/vfb.c
static int vfb_mmap(struct fb_info *info,
struct vm_area_struct *vma)
{
return remap_vmalloc_range(vma, (void *)info->fix.smem_start, vma->vm_pgoff);
}
Link: http://lkml.kernel.org/r/20190103145954.16942-2-rpenyaev@suse.de
Signed-off-by: Roman Penyaev <rpenyaev(a)suse.de>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: Andrey Ryabinin <aryabinin(a)virtuozzo.com>
Cc: Joe Perches <joe(a)perches.com>
Cc: "Luis R. Rodriguez" <mcgrof(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/mm/vmalloc.c~mm-vmalloc-fix-size-check-for-remap_vmalloc_range_partial
+++ a/mm/vmalloc.c
@@ -2248,7 +2248,7 @@ int remap_vmalloc_range_partial(struct v
if (!(area->flags & VM_USERMAP))
return -EINVAL;
- if (kaddr + size > area->addr + area->size)
+ if (kaddr + size > area->addr + get_vm_area_size(area))
return -EINVAL;
do {
_
Patches currently in -mm which might be from rpenyaev(a)suse.de are
epoll-make-sure-all-elements-in-ready-list-are-in-fifo-order.patch
epoll-loosen-irq-safety-in-ep_poll_callback.patch
epoll-unify-awaking-of-wakeup-source-on-ep_poll_callback-path.patch
epoll-use-rwlock-in-order-to-reduce-ep_poll_callback-contention.patch
mm-vmalloc-fix-size-check-for-remap_vmalloc_range_partial.patch
mm-vmalloc-do-not-call-kmemleak_free-on-not-yet-accounted-memory.patch
mm-vmalloc-pass-vm_usermap-flags-directly-to-__vmalloc_node_range.patch
The patch titled
Subject: mm: page_mapped: don't assume compound page is huge or THP
has been added to the -mm tree. Its filename is
mm-page_mapped-dont-assume-compound-page-is-huge-or-thp.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-page_mapped-dont-assume-compoun…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-page_mapped-dont-assume-compoun…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Jan Stancek <jstancek(a)redhat.com>
Subject: mm: page_mapped: don't assume compound page is huge or THP
LTP proc01 testcase has been observed to rarely trigger crashes
on arm64:
page_mapped+0x78/0xb4
stable_page_flags+0x27c/0x338
kpageflags_read+0xfc/0x164
proc_reg_read+0x7c/0xb8
__vfs_read+0x58/0x178
vfs_read+0x90/0x14c
SyS_read+0x60/0xc0
Issue is that page_mapped() assumes that if compound page is not huge,
then it must be THP. But if this is 'normal' compound page
(COMPOUND_PAGE_DTOR), then following loop can keep running (for
HPAGE_PMD_NR iterations) until it tries to read from memory that isn't
mapped and triggers a panic:
for (i = 0; i < hpage_nr_pages(page); i++) {
if (atomic_read(&page[i]._mapcount) >= 0)
return true;
}
I could replicate this on x86 (v4.20-rc4-98-g60b548237fed) only
with a custom kernel module [1] which:
- allocates compound page (PAGEC) of order 1
- allocates 2 normal pages (COPY), which are initialized to 0xff
(to satisfy _mapcount >= 0)
- 2 PAGEC page structs are copied to address of first COPY page
- second page of COPY is marked as not present
- call to page_mapped(COPY) now triggers fault on access to 2nd
COPY page at offset 0x30 (_mapcount)
[1] https://github.com/jstancek/reproducers/blob/master/kernel/page_mapped_cras…
Fix the loop to iterate for "1 << compound_order" pages.
Kirrill said "IIRC, sound subsystem can producuce custom mapped compound
pages".
Link: http://lkml.kernel.org/r/c440d69879e34209feba21e12d236d06bc0a25db.154357715…
Fixes: e1534ae95004 ("mm: differentiate page_mapped() from page_mapcount() for compound pages")
Signed-off-by: Jan Stancek <jstancek(a)redhat.com>
Debugged-by: Laszlo Ersek <lersek(a)redhat.com>
Suggested-by: "Kirill A. Shutemov" <kirill(a)shutemov.name>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Reviewed-by: David Hildenbrand <david(a)redhat.com>
Reviewed-by: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/mm/util.c~mm-page_mapped-dont-assume-compound-page-is-huge-or-thp
+++ a/mm/util.c
@@ -478,7 +478,7 @@ bool page_mapped(struct page *page)
return true;
if (PageHuge(page))
return false;
- for (i = 0; i < hpage_nr_pages(page); i++) {
+ for (i = 0; i < (1 << compound_order(page)); i++) {
if (atomic_read(&page[i]._mapcount) >= 0)
return true;
}
_
Patches currently in -mm which might be from jstancek(a)redhat.com are
mm-page_mapped-dont-assume-compound-page-is-huge-or-thp.patch
Commit 5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on
memcg charge fail") fixes a crash caused due to failed memcg charge of
the kernel stack. However the fix misses the cached_stacks case which
this patch fixes. So, the same crash can happen if the memcg charge of
a cached stack is failed.
Fixes: 5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on memcg charge fail")
Signed-off-by: Shakeel Butt <shakeelb(a)google.com>
Cc: Rik van Riel <riel(a)surriel.com>
Cc: Roman Gushchin <guro(a)fb.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Tejun Heo <tj(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
---
kernel/fork.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/fork.c b/kernel/fork.c
index e4a51124661a..593cd1577dff 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -216,6 +216,7 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
memset(s->addr, 0, THREAD_SIZE);
tsk->stack_vm_area = s;
+ tsk->stack = s->addr;
return s->addr;
}
--
2.20.1.415.g653613c723-goog
From: Oliver Hartkopp <socketcan(a)hartkopp.net>
Muyu Yu provided a POC where user root with CAP_NET_ADMIN can create a CAN
frame modification rule that makes the data length code a higher value than
the available CAN frame data size. In combination with a configured checksum
calculation where the result is stored relatively to the end of the data
(e.g. cgw_csum_xor_rel) the tail of the skb (e.g. frag_list pointer in
skb_shared_info) can be rewritten which finally can cause a system crash.
Michael Kubecek suggested to drop frames that have a DLC exceeding the
available space after the modification process and provided a patch that can
handle CAN FD frames too. Within this patch we also limit the length for the
checksum calculations to the maximum of Classic CAN data length (8).
CAN frames that are dropped by these additional checks are counted with the
CGW_DELETED counter which indicates misconfigurations in can-gw rules.
This fixes CVE-2019-3701.
Reported-by: Muyu Yu <ieatmuttonchuan(a)gmail.com>
Reported-by: Marcus Meissner <meissner(a)suse.de>
Suggested-by: Michal Kubecek <mkubecek(a)suse.cz>
Tested-by: Muyu Yu <ieatmuttonchuan(a)gmail.com>
Tested-by: Oliver Hartkopp <socketcan(a)hartkopp.net>
Signed-off-by: Oliver Hartkopp <socketcan(a)hartkopp.net>
Cc: linux-stable <stable(a)vger.kernel.org> # >= v3.2
Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de>
---
Hello,
I've removed the else from dlc length check. Keeps the code and the
patch more readable.
Marc
net/can/gw.c | 29 ++++++++++++++++++++++++++---
1 file changed, 26 insertions(+), 3 deletions(-)
diff --git a/net/can/gw.c b/net/can/gw.c
index faa3da88a127..bb85d815f092 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -416,13 +416,28 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data)
while (modidx < MAX_MODFUNCTIONS && gwj->mod.modfunc[modidx])
(*gwj->mod.modfunc[modidx++])(cf, &gwj->mod);
- /* check for checksum updates when the CAN frame has been modified */
+ /* Has the CAN frame been modified? */
if (modidx) {
- if (gwj->mod.csumfunc.crc8)
+ /* get available space for the processed CAN frame type */
+ int max_len = nskb->len - offsetof(struct can_frame, data);
+
+ /* dlc may have changed, make sure it fits to the CAN frame */
+ if (cf->can_dlc > max_len)
+ goto out_delete;
+
+ /* check for checksum updates in classic CAN length only */
+ if (gwj->mod.csumfunc.crc8) {
+ if (cf->can_dlc > 8)
+ goto out_delete;
+
(*gwj->mod.csumfunc.crc8)(cf, &gwj->mod.csum.crc8);
+ }
- if (gwj->mod.csumfunc.xor)
+ if (gwj->mod.csumfunc.xor) {
+ if (cf->can_dlc > 8)
+ goto out_delete;
(*gwj->mod.csumfunc.xor)(cf, &gwj->mod.csum.xor);
+ }
}
/* clear the skb timestamp if not configured the other way */
@@ -434,6 +449,14 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data)
gwj->dropped_frames++;
else
gwj->handled_frames++;
+
+ return;
+
+ out_delete:
+ /* delete frame due to misconfiguration */
+ gwj->deleted_frames++;
+ kfree_skb(nskb);
+ return;
}
static inline int cgw_register_filter(struct net *net, struct cgw_job *gwj)
--
2.20.1
Muyu Yu provided a POC where user root with CAP_NET_ADMIN can create a CAN
frame modification rule that makes the data length code a higher value than
the available CAN frame data size. In combination with a configured checksum
calculation where the result is stored relatively to the end of the data
(e.g. cgw_csum_xor_rel) the tail of the skb (e.g. frag_list pointer in
skb_shared_info) can be rewritten which finally can cause a system crash.
Michael Kubecek suggested to drop frames that have a DLC exceeding the
available space after the modification process and provided a patch that can
handle CAN FD frames too. Within this patch we also limit the length for the
checksum calculations to the maximum of Classic CAN data length (8).
CAN frames that are dropped by these additional checks are counted with the
CGW_DELETED counter which indicates misconfigurations in can-gw rules.
This fixes CVE-2019-3701.
Reported-by: Muyu Yu <ieatmuttonchuan(a)gmail.com>
Reported-by: Marcus Meissner <meissner(a)suse.de>
Suggested-by: Michal Kubecek <mkubecek(a)suse.cz>
Tested-by: Muyu Yu <ieatmuttonchuan(a)gmail.com>
Tested-by: Oliver Hartkopp <socketcan(a)hartkopp.net>
Signed-off-by: Oliver Hartkopp <socketcan(a)hartkopp.net>
Cc: linux-stable <stable(a)vger.kernel.org> # >= v3.2
---
net/can/gw.c | 36 +++++++++++++++++++++++++++++++-----
1 file changed, 31 insertions(+), 5 deletions(-)
diff --git a/net/can/gw.c b/net/can/gw.c
index faa3da88a127..180c389af5b1 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -416,13 +416,31 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data)
while (modidx < MAX_MODFUNCTIONS && gwj->mod.modfunc[modidx])
(*gwj->mod.modfunc[modidx++])(cf, &gwj->mod);
- /* check for checksum updates when the CAN frame has been modified */
+ /* Has the CAN frame been modified? */
if (modidx) {
- if (gwj->mod.csumfunc.crc8)
- (*gwj->mod.csumfunc.crc8)(cf, &gwj->mod.csum.crc8);
+ /* get available space for the processed CAN frame type */
+ int max_len = nskb->len - offsetof(struct can_frame, data);
- if (gwj->mod.csumfunc.xor)
- (*gwj->mod.csumfunc.xor)(cf, &gwj->mod.csum.xor);
+ /* dlc may have changed, make sure it fits to the CAN frame */
+ if (cf->can_dlc > max_len)
+ goto out_delete;
+
+ /* check for checksum updates in classic CAN length only */
+ if (gwj->mod.csumfunc.crc8) {
+ if (cf->can_dlc > 8)
+ goto out_delete;
+ else
+ (*gwj->mod.csumfunc.crc8)
+ (cf, &gwj->mod.csum.crc8);
+ }
+
+ if (gwj->mod.csumfunc.xor) {
+ if (cf->can_dlc > 8)
+ goto out_delete;
+ else
+ (*gwj->mod.csumfunc.xor)
+ (cf, &gwj->mod.csum.xor);
+ }
}
/* clear the skb timestamp if not configured the other way */
@@ -434,6 +452,14 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data)
gwj->dropped_frames++;
else
gwj->handled_frames++;
+
+ return;
+
+out_delete:
+ /* delete frame due to misconfiguration */
+ gwj->deleted_frames++;
+ kfree_skb(nskb);
+ return;
}
static inline int cgw_register_filter(struct net *net, struct cgw_job *gwj)
--
2.19.2
The ARM Linux kernel handles the EABI syscall numbers as follows:
0 - NR_SYSCALLS-1 : Invoke syscall via syscall table
NR_SYSCALLS - 0xeffff : -ENOSYS (to be allocated in future)
0xf0000 - 0xf07ff : Private syscall or -ENOSYS if not allocated
> 0xf07ff : SIGILL
Our compat code gets this wrong and ends up sending SIGILL in response
to all syscalls greater than NR_SYSCALLS which have a value greater
than 0x7ff in the bottom 16 bits.
Fix this by defining the end of the ARM private syscall region and
checking the syscall number against that directly. Update the comment
while we're at it.
Cc: <stable(a)vger.kernel.org>
Cc: Dave Martin <Dave.Martin(a)arm.com>
Reported-by: Pi-Hsun Shih <pihsun(a)chromium.org>
Signed-off-by: Will Deacon <will.deacon(a)arm.com>
---
arch/arm64/include/asm/unistd.h | 5 +++--
arch/arm64/kernel/sys_compat.c | 4 ++--
2 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
index b13ca091f833..be66a54ee3a1 100644
--- a/arch/arm64/include/asm/unistd.h
+++ b/arch/arm64/include/asm/unistd.h
@@ -40,8 +40,9 @@
* The following SVCs are ARM private.
*/
#define __ARM_NR_COMPAT_BASE 0x0f0000
-#define __ARM_NR_compat_cacheflush (__ARM_NR_COMPAT_BASE+2)
-#define __ARM_NR_compat_set_tls (__ARM_NR_COMPAT_BASE+5)
+#define __ARM_NR_compat_cacheflush (__ARM_NR_COMPAT_BASE + 2)
+#define __ARM_NR_compat_set_tls (__ARM_NR_COMPAT_BASE + 5)
+#define __ARM_NR_compat_syscall_end (__ARM_NR_COMPAT_BASE + 0x800)
#define __NR_compat_syscalls 399
#endif
diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c
index 32653d156747..5972b7533fa0 100644
--- a/arch/arm64/kernel/sys_compat.c
+++ b/arch/arm64/kernel/sys_compat.c
@@ -102,12 +102,12 @@ long compat_arm_syscall(struct pt_regs *regs)
default:
/*
- * Calls 9f00xx..9f07ff are defined to return -ENOSYS
+ * Calls 0xf0xxx..0xf07ff are defined to return -ENOSYS
* if not implemented, rather than raising SIGILL. This
* way the calling program can gracefully determine whether
* a feature is supported.
*/
- if ((no & 0xffff) <= 0x7ff)
+ if (no < __ARM_NR_compat_syscall_end)
return -ENOSYS;
break;
}
--
2.1.4
The syscall number may have been changed by a tracer, so we should pass
the actual number in from the caller instead of pulling it from the
saved r7 value directly.
Cc: <stable(a)vger.kernel.org>
Cc: Dave Martin <Dave.Martin(a)arm.com>
Cc: Pi-Hsun Shih <pihsun(a)chromium.org>
Signed-off-by: Will Deacon <will.deacon(a)arm.com>
---
arch/arm64/kernel/sys_compat.c | 9 ++++-----
arch/arm64/kernel/syscall.c | 9 ++++-----
2 files changed, 8 insertions(+), 10 deletions(-)
diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c
index 5972b7533fa0..54c29cd38ff9 100644
--- a/arch/arm64/kernel/sys_compat.c
+++ b/arch/arm64/kernel/sys_compat.c
@@ -66,12 +66,11 @@ do_compat_cache_op(unsigned long start, unsigned long end, int flags)
/*
* Handle all unrecognised system calls.
*/
-long compat_arm_syscall(struct pt_regs *regs)
+long compat_arm_syscall(struct pt_regs *regs, int scno)
{
- unsigned int no = regs->regs[7];
void __user *addr;
- switch (no) {
+ switch (scno) {
/*
* Flush a region from virtual address 'r0' to virtual address 'r1'
* _exclusive_. There is no alignment requirement on either address;
@@ -107,7 +106,7 @@ long compat_arm_syscall(struct pt_regs *regs)
* way the calling program can gracefully determine whether
* a feature is supported.
*/
- if (no < __ARM_NR_compat_syscall_end)
+ if (scno < __ARM_NR_compat_syscall_end)
return -ENOSYS;
break;
}
@@ -116,6 +115,6 @@ long compat_arm_syscall(struct pt_regs *regs)
(compat_thumb_mode(regs) ? 2 : 4);
arm64_notify_die("Oops - bad compat syscall(2)", regs,
- SIGILL, ILL_ILLTRP, addr, no);
+ SIGILL, ILL_ILLTRP, addr, scno);
return 0;
}
diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c
index 032d22312881..5610ac01c1ec 100644
--- a/arch/arm64/kernel/syscall.c
+++ b/arch/arm64/kernel/syscall.c
@@ -13,16 +13,15 @@
#include <asm/thread_info.h>
#include <asm/unistd.h>
-long compat_arm_syscall(struct pt_regs *regs);
-
+long compat_arm_syscall(struct pt_regs *regs, int scno);
long sys_ni_syscall(void);
-asmlinkage long do_ni_syscall(struct pt_regs *regs)
+static long do_ni_syscall(struct pt_regs *regs, int scno)
{
#ifdef CONFIG_COMPAT
long ret;
if (is_compat_task()) {
- ret = compat_arm_syscall(regs);
+ ret = compat_arm_syscall(regs, scno);
if (ret != -ENOSYS)
return ret;
}
@@ -47,7 +46,7 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno,
syscall_fn = syscall_table[array_index_nospec(scno, sc_nr)];
ret = __invoke_syscall(regs, syscall_fn);
} else {
- ret = do_ni_syscall(regs);
+ ret = do_ni_syscall(regs, scno);
}
regs->regs[0] = ret;
--
2.1.4
The CAN frame modification rules allow bitwise logical operations which can
be also applied to the can_dlc field. Ensure the manipulation result to
maintain the can_dlc boundaries so that the CAN drivers do not accidently
write arbitrary content beyond the data registers in the CAN controllers
I/O mem when processing can-gw manipulated outgoing frames. When passing these
frames to user space this issue did not have any effect to the kernel or any
leaked data as we always strictly copy sizeof(struct can_frame) bytes.
Reported-by: Muyu Yu <ieatmuttonchuan(a)gmail.com>
Reported-by: Marcus Meissner <meissner(a)suse.de>
Tested-by: Muyu Yu <ieatmuttonchuan(a)gmail.com>
Signed-off-by: Oliver Hartkopp <socketcan(a)hartkopp.net>
Cc: linux-stable <stable(a)vger.kernel.org> # >= v3.2
---
net/can/gw.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/can/gw.c b/net/can/gw.c
index faa3da88a127..9000d9b8a133 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -418,6 +418,10 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data)
/* check for checksum updates when the CAN frame has been modified */
if (modidx) {
+ /* ensure DLC boundaries after the different mods */
+ if (cf->can_dlc > 8)
+ cf->can_dlc = 8;
+
if (gwj->mod.csumfunc.crc8)
(*gwj->mod.csumfunc.crc8)(cf, &gwj->mod.csum.crc8);
--
2.19.2
Editing for photos. Retouching for photos. Cutting out for photos,
We are a photo team of 20 image editors and we can edit your photos today
if you need help,
We mainly work on:
Clipping path - image cut out
Shadow creation
Image masking
Image retouching
Beauty model retouching
Please reply if interested.
Thanks,
Jessica
Editing for photos. Retouching for photos. Cutting out for photos,
We are a photo team of 20 image editors and we can edit your photos today
if you need help,
We mainly work on:
Clipping path - image cut out
Shadow creation
Image masking
Image retouching
Beauty model retouching
Please reply if interested.
Thanks,
Jessica