ps->dev->actconfig can be NULL and cause NULL-deref in usb_find_alt_setting()
before c9a4cb204e9e. fix this anyway by checking that ps->dev->actconfig is not
NULL, so usb_find_alt_setting() is not called with a known-bad argument.
Signed-off-by: Vladis Dronov <vdronov(a)redhat.com>
Reported-by: syzbot+19c3aaef85a89d451eac(a)syzkaller.appspotmail.com
---
drivers/usb/core/devio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 6ce77b33da61..26047620b003 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -824,7 +824,7 @@ static int check_ctrlrecip(struct usb_dev_state *ps, unsigned int requesttype,
* class specification, which we always want to allow as it is used
* to query things like ink level, etc.
*/
- if (requesttype == 0xa1 && request == 0) {
+ if (requesttype == 0xa1 && request == 0 && ps->dev->actconfig) {
alt_setting = usb_find_alt_setting(ps->dev->actconfig,
index >> 8, index & 0xff);
if (alt_setting
--
2.14.4
The patch titled
Subject: mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings
has been added to the -mm tree. Its filename is
mm-thp-relax-__gfp_thisnode-for-madv_hugepage-mappings.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-thp-relax-__gfp_thisnode-for-ma…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-thp-relax-__gfp_thisnode-for-ma…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Andrea Arcangeli <aarcange(a)redhat.com>
Subject: mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings
THP allocation might be really disruptive when allocated on NUMA system
with the local node full or hard to reclaim. Stefan has posted an
allocation stall report on 4.12 based SLES kernel which suggests the same
issue:
[245513.362669] kvm: page allocation stalls for 194572ms, order:9, mode:0x4740ca(__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_THISNODE|__GFP_MOVABLE|__GFP_DIRECT_RECLAIM), nodemask=(null)
[245513.363983] kvm cpuset=/ mems_allowed=0-1
[245513.364604] CPU: 10 PID: 84752 Comm: kvm Tainted: G W 4.12.0+98-ph <a href="/view.php?id=1" title="[geschlossen] Integration Ramdisk" class="resolved">0000001</a> SLE15 (unreleased)
[245513.365258] Hardware name: Supermicro SYS-1029P-WTRT/X11DDW-NT, BIOS 2.0 12/05/2017
[245513.365905] Call Trace:
[245513.366535] dump_stack+0x5c/0x84
[245513.367148] warn_alloc+0xe0/0x180
[245513.367769] __alloc_pages_slowpath+0x820/0xc90
[245513.368406] ? __slab_free+0xa9/0x2f0
[245513.369048] ? __slab_free+0xa9/0x2f0
[245513.369671] __alloc_pages_nodemask+0x1cc/0x210
[245513.370300] alloc_pages_vma+0x1e5/0x280
[245513.370921] do_huge_pmd_wp_page+0x83f/0xf00
[245513.371554] ? set_huge_zero_page.isra.52.part.53+0x9b/0xb0
[245513.372184] ? do_huge_pmd_anonymous_page+0x631/0x6d0
[245513.372812] __handle_mm_fault+0x93d/0x1060
[245513.373439] handle_mm_fault+0xc6/0x1b0
[245513.374042] __do_page_fault+0x230/0x430
[245513.374679] ? get_vtime_delta+0x13/0xb0
[245513.375411] do_page_fault+0x2a/0x70
[245513.376145] ? page_fault+0x65/0x80
[245513.376882] page_fault+0x7b/0x80
[...]
[245513.382056] Mem-Info:
[245513.382634] active_anon:126315487 inactive_anon:1612476 isolated_anon:5
active_file:60183 inactive_file:245285 isolated_file:0
unevictable:15657 dirty:286 writeback:1 unstable:0
slab_reclaimable:75543 slab_unreclaimable:2509111
mapped:81814 shmem:31764 pagetables:370616 bounce:0
free:32294031 free_pcp:6233 free_cma:0
[245513.386615] Node 0 active_anon:254680388kB inactive_anon:1112760kB active_file:240648kB inactive_file:981168kB unevictable:13368kB isolated(anon):0kB isolated(file):0kB mapped:280240kB dirty:1144kB writeback:0kB shmem:95832kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 81225728kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no
[245513.388650] Node 1 active_anon:250583072kB inactive_anon:5337144kB active_file:84kB inactive_file:0kB unevictable:49260kB isolated(anon):20kB isolated(file):0kB mapped:47016kB dirty:0kB writeback:4kB shmem:31224kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 31897600kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no
The defrag mode is "madvise" and from the above report it is clear that
the THP has been allocated for MADV_HUGEPAGA vma.
Andrea has identified that the main source of the problem is
__GFP_THISNODE usage:
: The problem is that direct compaction combined with the NUMA
: __GFP_THISNODE logic in mempolicy.c is telling reclaim to swap very
: hard the local node, instead of failing the allocation if there's no
: THP available in the local node.
:
: Such logic was ok until __GFP_THISNODE was added to the THP allocation
: path even with MPOL_DEFAULT.
:
: The idea behind the __GFP_THISNODE addition, is that it is better to
: provide local memory in PAGE_SIZE units than to use remote NUMA THP
: backed memory. That largely depends on the remote latency though, on
: threadrippers for example the overhead is relatively low in my
: experience.
:
: The combination of __GFP_THISNODE and __GFP_DIRECT_RECLAIM results in
: extremely slow qemu startup with vfio, if the VM is larger than the
: size of one host NUMA node. This is because it will try very hard to
: unsuccessfully swapout get_user_pages pinned pages as result of the
: __GFP_THISNODE being set, instead of falling back to PAGE_SIZE
: allocations and instead of trying to allocate THP on other nodes (it
: would be even worse without vfio type1 GUP pins of course, except it'd
: be swapping heavily instead).
Fix this by removing __GFP_THISNODE for THP requests which are requesting
the direct reclaim. This effectivelly reverts 5265047ac301 on the grounds
that the zone/node reclaim was known to be disruptive due to premature
reclaim when there was memory free. While it made sense at the time for
HPC workloads without NUMA awareness on rare machines, it was ultimately
harmful in the majority of cases. The existing behaviour is similiar, if
not as widespare as it applies to a corner case but crucially, it cannot
be tuned around like zone_reclaim_mode can. The default behaviour should
always be to cause the least harm for the common case.
If there are specialised use cases out there that want zone_reclaim_mode
in specific cases, then it can be built on top. Longterm we should
consider a memory policy which allows for the node reclaim like behavior
for the specific memory ranges which would allow a
[1] http://lkml.kernel.org/r/20180820032204.9591-1-aarcange@redhat.com
Mel said:
: Both patches look correct to me but I'm responding to this one because
: it's the fix. The change makes sense and moves further away from the
: severe stalling behaviour we used to see with both THP and zone reclaim
: mode.
:
: I put together a basic experiment with usemem configured to reference a
: buffer multiple times that is 80% the size of main memory on a 2-socket
: box with symmetric node sizes and defrag set to "always". The defrag
: setting is not the default but it would be functionally similar to
: accessing a buffer with madvise(MADV_HUGEPAGE). Usemem is configured to
: reference the buffer multiple times and while it's not an interesting
: workload, it would be expected to complete reasonably quickly as it fits
: within memory. The results were;
:
: usemem
: vanilla noreclaim-v1
: Amean Elapsd-1 42.78 ( 0.00%) 26.87 ( 37.18%)
: Amean Elapsd-3 27.55 ( 0.00%) 7.44 ( 73.00%)
: Amean Elapsd-4 5.72 ( 0.00%) 5.69 ( 0.45%)
:
: This shows the elapsed time in seconds for 1 thread, 3 threads and 4
: threads referencing buffers 80% the size of memory. With the patches
: applied, it's 37.18% faster for the single thread and 73% faster with two
: threads. Note that 4 threads showing little difference does not indicate
: the problem is related to thread counts. It's simply the case that 4
: threads gets spread so their workload mostly fits in one node.
:
: The overall view from /proc/vmstats is more startling
:
: 4.19.0-rc1 4.19.0-rc1
: vanillanoreclaim-v1r1
: Minor Faults 35593425 708164
: Major Faults 484088 36
: Swap Ins 3772837 0
: Swap Outs 3932295 0
:
: Massive amounts of swap in/out without the patch
:
: Direct pages scanned 6013214 0
: Kswapd pages scanned 0 0
: Kswapd pages reclaimed 0 0
: Direct pages reclaimed 4033009 0
:
: Lots of reclaim activity without the patch
:
: Kswapd efficiency 100% 100%
: Kswapd velocity 0.000 0.000
: Direct efficiency 67% 100%
: Direct velocity 11191.956 0.000
:
: Mostly from direct reclaim context as you'd expect without the patch.
:
: Page writes by reclaim 3932314.000 0.000
: Page writes file 19 0
: Page writes anon 3932295 0
: Page reclaim immediate 42336 0
:
: Writes from reclaim context is never good but the patch eliminates it.
:
: We should never have default behaviour to thrash the system for such a
: basic workload. If zone reclaim mode behaviour is ever desired but on a
: single task instead of a global basis then the sensible option is to build
: a mempolicy that enforces that behaviour.
[mhocko(a)suse.com: rewrote the changelog based on the one from Andrea]
Link: http://lkml.kernel.org/r/20180925120326.24392-2-mhocko@kernel.org
Fixes: 5265047ac301 ("mm, thp: really limit transparent hugepage allocation to local node")
Signed-off-by: Andrea Arcangeli <aarcange(a)redhat.com>
Signed-off-by: Michal Hocko <mhocko(a)suse.com>
Reported-by: Stefan Priebe <s.priebe(a)profihost.ag>
Debugged-by: Andrea Arcangeli <aarcange(a)redhat.com>
Reported-by: Alex Williamson <alex.williamson(a)redhat.com>
Reviewed-by: Mel Gorman <mgorman(a)techsingularity.net>
Tested-by: Mel Gorman <mgorman(a)techsingularity.net>
Cc: Zi Yan <zi.yan(a)cs.rutgers.edu>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: David Rientjes <rientjes(a)google.com>
Cc: Stefan Priebe - Profihost AG <s.priebe(a)profihost.ag>
Cc: "Kirill A. Shutemov" <kirill(a)shutemov.name>
Cc: <stable(a)vger.kernel.org> [4.1+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/mempolicy.c | 32 ++++++++++++++++++++++++++++++--
1 file changed, 30 insertions(+), 2 deletions(-)
--- a/mm/mempolicy.c~mm-thp-relax-__gfp_thisnode-for-madv_hugepage-mappings
+++ a/mm/mempolicy.c
@@ -2046,8 +2046,36 @@ alloc_pages_vma(gfp_t gfp, int order, st
nmask = policy_nodemask(gfp, pol);
if (!nmask || node_isset(hpage_node, *nmask)) {
mpol_cond_put(pol);
- page = __alloc_pages_node(hpage_node,
- gfp | __GFP_THISNODE, order);
+ /*
+ * We cannot invoke reclaim if __GFP_THISNODE
+ * is set. Invoking reclaim with
+ * __GFP_THISNODE set, would cause THP
+ * allocations to trigger heavy swapping
+ * despite there may be tons of free memory
+ * (including potentially plenty of THP
+ * already available in the buddy) on all the
+ * other NUMA nodes.
+ *
+ * At most we could invoke compaction when
+ * __GFP_THISNODE is set (but we would need to
+ * refrain from invoking reclaim even if
+ * compaction returned COMPACT_SKIPPED because
+ * there wasn't not enough memory to succeed
+ * compaction). For now just avoid
+ * __GFP_THISNODE instead of limiting the
+ * allocation path to a strict and single
+ * compaction invocation.
+ *
+ * Supposedly if direct reclaim was enabled by
+ * the caller, the app prefers THP regardless
+ * of the node it comes from so this would be
+ * more desiderable behavior than only
+ * providing THP originated from the local
+ * node in such case.
+ */
+ if (!(gfp & __GFP_DIRECT_RECLAIM))
+ gfp |= __GFP_THISNODE;
+ page = __alloc_pages_node(hpage_node, gfp, order);
goto out;
}
}
_
Patches currently in -mm which might be from aarcange(a)redhat.com are
mm-thp-relax-__gfp_thisnode-for-madv_hugepage-mappings.patch
userfaultfd-allow-get_mempolicympol_f_nodempol_f_addr-to-trigger-userfaults.patch
This is the start of the stable review cycle for the 4.4.158 release.
There are 70 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Sep 26 11:30:25 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.158-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.158-rc1
Paul Burton <paul.burton(a)imgtec.com>
MIPS: VDSO: Drop gic_get_usm_range() usage
Paul Burton <paul.burton(a)mips.com>
MIPS: VDSO: Match data page cache colouring when D$ aliases
David Rivshin <drivshin(a)allworx.com>
drivers: net: cpsw: fix segfault in case of bad phy-handle
Dan Carpenter <dan.carpenter(a)oracle.com>
mei: bus: type promotion bug in mei_nfc_if_version()
Johan Hovold <johan(a)kernel.org>
USB: serial: ti_usb_3410_5052: fix array underflow in completion handler
Douglas Anderson <dianders(a)chromium.org>
pinctrl: qcom: spmi-gpio: Fix pmic_gpio_config_get() to be compliant
Bart Van Assche <bart.vanassche(a)wdc.com>
IB/nes: Fix a compiler warning
Dan Carpenter <dan.carpenter(a)oracle.com>
drm/panel: type promotion bug in s6e8aa0_read_mtp_id()
John Stultz <john.stultz(a)linaro.org>
selftest: timers: Tweak raw_skew to SKIP when ADJ_OFFSET/other clock adjustments are in progress
Timo Wischer <twischer(a)de.adit-jv.com>
ALSA: pcm: Fix snd_interval_refine first/last with open min/max
Zhouyang Jia <jiazhouyang09(a)gmail.com>
rtc: bq4802: add error handling for devm_ioremap
Wei Lu <wei.lu2(a)amd.com>
drm/amdkfd: Fix error codes in kfd_get_process
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
gpiolib: Mark gpio_suffixes array with __maybe_unused
Robin Murphy <robin.murphy(a)arm.com>
coresight: tpiu: Fix disabling timeouts
Suzuki K Poulose <suzuki.poulose(a)arm.com>
coresight: Handle errors in finding input/output ports
Julia Lawall <Julia.Lawall(a)lip6.fr>
parport: sunbpp: fix error return code
Thierry Reding <treding(a)nvidia.com>
drm/nouveau: tegra: Detach from ARM DMA/IOMMU mapping
Nicholas Mc Guire <hofrat(a)osadl.org>
ARM: hisi: check of_iomap and fix missing of_node_put
Nicholas Mc Guire <hofrat(a)osadl.org>
ARM: hisi: fix error handling and missing of_node_put
Nicholas Mc Guire <hofrat(a)osadl.org>
ARM: hisi: handle of_iomap and fix missing of_node_put
Paul Burton <paul.burton(a)mips.com>
MIPS: loongson64: cs5536: Fix PCI_OHCI_INT_REG reads
Jann Horn <jannh(a)google.com>
mtdchar: fix overflows in adjustment of `count`
Ronny Chevalier <ronny.chevalier(a)hp.com>
audit: fix use-after-free in audit_add_watch
Maciej W. Rozycki <macro(a)mips.com>
binfmt_elf: Respect error return from `regset->active'
Dan Carpenter <dan.carpenter(a)oracle.com>
CIFS: fix wrapping bugs in num_entries()
Dan Carpenter <dan.carpenter(a)oracle.com>
cifs: prevent integer overflow in nxt_dir_entry()
Jia-Ju Bai <baijiaju1990(a)gmail.com>
usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()
Ben Hutchings <ben.hutchings(a)codethink.co.uk>
USB: yurex: Fix buffer over-read in yurex_write()
Jia-Ju Bai <baijiaju1990(a)gmail.com>
usb: misc: uss720: Fix two sleep-in-atomic-context bugs
Johan Hovold <johan(a)kernel.org>
USB: serial: io_ti: fix array underflow in completion handler
Alan Stern <stern(a)rowland.harvard.edu>
USB: net2280: Fix erroneous synchronization change
Maxence Duprès <xpros64(a)hotmail.fr>
USB: add quirk for WORLDE Controller KS49 or Prodipe MIDI 49C USB controller
Jia-Ju Bai <baijiaju1990(a)gmail.com>
usb: host: u132-hcd: Fix a sleep-in-atomic-context bug in u132_get_frame()
Mathias Nyman <mathias.nyman(a)linux.intel.com>
usb: Avoid use-after-free by flushing endpoints early in usb_set_interface()
Tim Anderson <tsa(a)biglakesoftware.com>
USB: Add quirk to support DJI CineSSD
Mathias Nyman <mathias.nyman(a)linux.intel.com>
usb: Don't die twice if PCI xhci host is not responding in resume
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
misc: hmc6352: fix potential Spectre v1
K. Y. Srinivasan <kys(a)microsoft.com>
Tools: hv: Fix a bug in the key delete code
Aaron Knister <aaron.s.knister(a)nasa.gov>
IB/ipoib: Avoid a race condition between start_xmit and cm_rep_handler
Juergen Gross <jgross(a)suse.com>
xen/netfront: fix waiting for xenbus state change
Bin Yang <bin.yang(a)intel.com>
pstore: Fix incorrect persistent ram buffer mapping
Parav Pandit <parav(a)mellanox.com>
RDMA/cma: Protect cma dev list with lock
Xiao Liang <xiliang(a)redhat.com>
xen-netfront: fix warn message as irq device name has '/'
Michael Müller <michael(a)fds-team.de>
crypto: sharah - Unregister correct algorithms for SAHARA 3
Randy Dunlap <rdunlap(a)infradead.org>
platform/x86: toshiba_acpi: Fix defined but not used build warnings
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qeth: reset layer2 attribute on layer switch
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qeth: fix race in used-buffer accounting
Loic Poulain <loic.poulain(a)linaro.org>
arm64: dts: qcom: db410c: Fix Bluetooth LED trigger
Vitaly Kuznetsov <vkuznets(a)redhat.com>
xen-netfront: fix queue name setting
Manikanta Pubbisetty <mpubbise(a)codeaurora.org>
mac80211: restrict delayed tailroom needed decrement
Paul Cercueil <paul(a)crapouillou.net>
MIPS: jz4740: Bump zload address
Nicholas Piggin <npiggin(a)gmail.com>
powerpc/powernv: opal_put_chars partial write fix
Sandipan Das <sandipan(a)linux.ibm.com>
perf powerpc: Fix callchain ip filtering
Krzysztof Kozlowski <krzk(a)kernel.org>
ARM: exynos: Clear global variable on init error path
Fredrik Noring <noring(a)nocrew.org>
fbdev: Distinguish between interlaced and progressive modes
Sandipan Das <sandipan(a)linux.ibm.com>
perf powerpc: Fix callchain ip filtering when return address is in a register
Randy Dunlap <rdunlap(a)infradead.org>
fbdev/via: fix defined but not used warning
Anton Vasilyev <vasilyev(a)ispras.ru>
video: goldfishfb: fix memory leak on driver remove
Dan Carpenter <dan.carpenter(a)oracle.com>
fbdev: omapfb: off by one in omapfb_register_client()
Randy Dunlap <rdunlap(a)infradead.org>
mtd/maps: fix solutionengine.c printk format warnings
Hans Verkuil <hverkuil(a)xs4all.nl>
media: videobuf2-core: check for q->error in vb2_core_qbuf()
Felix Fietkau <nbd(a)nbd.name>
MIPS: ath79: fix system restart
John Keeping <john(a)metanate.com>
dmaengine: pl330: fix irq race with terminate_all
Masahiro Yamada <yamada.masahiro(a)socionext.com>
kbuild: add .DELETE_ON_ERROR special target
Nicholas Mc Guire <hofrat(a)osadl.org>
clk: imx6ul: fix missing of_node_put()
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Special-case rindex for gfs2_grow
YueHaibing <yuehaibing(a)huawei.com>
xfrm: fix 'passing zero to ERR_PTR()' warning
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Fix multiple definitions in AU0828_DEVICE() macro
Takashi Iwai <tiwai(a)suse.de>
ALSA: msnd: Fix the default sample sizes
Miao Zhong <zhongmiao(a)hisilicon.com>
iommu/arm-smmu-v3: sync the OVACKFLG to PRIQ consumer register
-------------
Diffstat:
Makefile | 4 +--
arch/arm/mach-exynos/suspend.c | 1 +
arch/arm/mach-hisi/hotplug.c | 41 ++++++++++++++--------
arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 2 +-
arch/mips/ath79/setup.c | 1 +
arch/mips/include/asm/mach-ath79/ath79.h | 1 +
arch/mips/jz4740/Platform | 2 +-
arch/mips/kernel/vdso.c | 35 ++++++++++++------
arch/mips/loongson64/common/cs5536/cs5536_ohci.c | 2 +-
arch/powerpc/platforms/powernv/opal.c | 2 +-
drivers/clk/imx/clk-imx6ul.c | 1 +
drivers/crypto/sahara.c | 4 +--
drivers/dma/pl330.c | 5 +--
drivers/gpio/gpiolib.h | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_process.c | 2 ++
drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c | 13 +++++++
drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c | 2 +-
drivers/hwtracing/coresight/coresight-tpiu.c | 7 ++--
drivers/hwtracing/coresight/coresight.c | 7 ++--
drivers/infiniband/core/cma.c | 12 ++++---
drivers/infiniband/hw/nes/nes.h | 2 +-
drivers/infiniband/ulp/ipoib/ipoib_cm.c | 2 ++
drivers/iommu/arm-smmu-v3.c | 1 +
drivers/media/v4l2-core/videobuf2-core.c | 5 +++
drivers/misc/hmc6352.c | 2 ++
drivers/misc/mei/bus-fixup.c | 2 +-
drivers/mtd/maps/solutionengine.c | 6 ++--
drivers/mtd/mtdchar.c | 10 ++++--
drivers/net/ethernet/ti/cpsw.c | 37 +++++++++++--------
drivers/net/xen-netfront.c | 30 ++++++++--------
drivers/parport/parport_sunbpp.c | 8 +++--
drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 32 ++++++++++++-----
drivers/platform/x86/toshiba_acpi.c | 3 +-
drivers/rtc/rtc-bq4802.c | 4 +++
drivers/s390/net/qeth_core_main.c | 3 +-
drivers/s390/net/qeth_core_sys.c | 1 +
drivers/usb/class/cdc-wdm.c | 2 +-
drivers/usb/core/hcd-pci.c | 2 --
drivers/usb/core/message.c | 11 ++++++
drivers/usb/core/quirks.c | 7 ++++
drivers/usb/gadget/udc/net2280.c | 16 +++++++--
drivers/usb/host/u132-hcd.c | 2 +-
drivers/usb/misc/uss720.c | 4 +--
drivers/usb/misc/yurex.c | 5 +--
drivers/usb/serial/io_ti.h | 2 +-
drivers/usb/serial/ti_usb_3410_5052.h | 2 +-
drivers/usb/storage/scsiglue.c | 9 +++++
drivers/usb/storage/unusual_devs.h | 7 ++++
drivers/video/fbdev/core/modedb.c | 41 ++++++++++++++++------
drivers/video/fbdev/goldfishfb.c | 1 +
drivers/video/fbdev/omap/omapfb_main.c | 2 +-
drivers/video/fbdev/via/viafbdev.c | 3 +-
fs/binfmt_elf.c | 2 +-
fs/cifs/readdir.c | 11 ++++--
fs/cifs/smb2pdu.c | 25 +++++++------
fs/gfs2/bmap.c | 2 +-
fs/pstore/ram_core.c | 17 +++++++--
kernel/audit_watch.c | 12 ++++++-
net/mac80211/cfg.c | 2 +-
net/mac80211/key.c | 24 ++++++++-----
net/xfrm/xfrm_policy.c | 5 ++-
scripts/Kbuild.include | 3 ++
sound/core/pcm_lib.c | 14 +++++---
sound/isa/msnd/msnd_pinnacle.c | 4 +--
sound/usb/quirks-table.h | 3 +-
tools/hv/hv_kvp_daemon.c | 2 +-
tools/perf/arch/powerpc/util/skip-callchain-idx.c | 10 ++++--
tools/testing/selftests/timers/raw_skew.c | 5 +++
68 files changed, 389 insertions(+), 162 deletions(-)
Hi Srini,
On 09/25/2018 03:29 AM, Srinivas Kandagatla wrote:
> Hi Suman,
>
> On 25/09/18 01:25, Suman Anna wrote:
>> Hi Srinivas,
>>
>> On 06/15/2018 04:59 AM, Srinivas Kandagatla wrote:
>>> Some of the rpmsg devices need to switch on power domains to communicate
>>> with remote processor. For example on Qualcomm DB820c platform LPASS
>>> power domain needs to switched on for any kind of audio services.
>>> This patch adds the missing power domain support in rpmsg core.
>>>
>>> Without this patch attempting to play audio via QDSP on DB820c would
>>> reboot the system.
>>>
>>> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
>>> ---
>>> drivers/rpmsg/rpmsg_core.c | 7 +++++++
>>> 1 file changed, 7 insertions(+)
>>>
>>> diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
>>> index b714a543a91d..8122807db380 100644
>>> --- a/drivers/rpmsg/rpmsg_core.c
>>> +++ b/drivers/rpmsg/rpmsg_core.c
>>> @@ -15,6 +15,7 @@
>>> #include <linux/module.h>
>>> #include <linux/rpmsg.h>
>>> #include <linux/of_device.h>
>>> +#include <linux/pm_domain.h>
>>> #include <linux/slab.h>
>>> #include "rpmsg_internal.h"
>>> @@ -449,6 +450,10 @@ static int rpmsg_dev_probe(struct device *dev)
>>> struct rpmsg_endpoint *ept = NULL;
>>> int err;
>>> + err = dev_pm_domain_attach(dev, true);
>>> + if (err)
>>> + goto out;
>>
>> This patch has broken the virtio-rpmsg stack based rpmsg devices. These
>> devices are non-DT and the rpmsg_dev_probe() is now failing with -19
>> (-ENODEV) error code.
>>
>
> There seems to be some dependency on this patch (
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
> ) which seems to rework the return values from acpi_dev_pm_attach() and
> genpd_dev_pm_attach()
>
OK, I see that dependent commit is part of the 4.18 Linux kernel. So
mainline kernel has no issues, but this patch was picked up in 4.14.71
(don't know why) as commit 1ed3a9307230, so 4.14 stable is broken. So,
how do we proceed here - don't think we can pick all those dependent
patches against stable.
regards
Suman
>
>
> --srini
>
>
>> Loic, Arnaud,
>> Can one of you double-confirm this behavior on ST platforms as well?
>> The patch came through 4.14.71 stable release and broke our downstream
>> kernels.
>>
>> regards
>> Suman
>>
>>> +
>>> if (rpdrv->callback) {
>>> strncpy(chinfo.name, rpdev->id.name, RPMSG_NAME_SIZE);
>>> chinfo.src = rpdev->src;
>>> @@ -490,6 +495,8 @@ static int rpmsg_dev_remove(struct device *dev)
>>> rpdrv->remove(rpdev);
>>> + dev_pm_domain_detach(dev, true);
>>> +
>>> if (rpdev->ept)
>>> rpmsg_destroy_ept(rpdev->ept);
>>>
>>
The trigger for the series is this bug report:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1788432
Changelog:
v1 -> v2:
* improve on commit messages, add cc:stable
RFC -> v1:
* do mutual exclusion on a per device basis in ccw_io_helper()
Halil Pasic (2):
virtio/s390: avoid race on vcdev->config
virtio/s390: fix race in ccw_io_helper()
drivers/s390/virtio/virtio_ccw.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
--
2.16.4
Want editing for your photos? We can help you for this.
We can do cutting out and retouching for your ecommerce photos, jewelry
photos retouching,
portrait photos or wedding photos.
Turnaround time is fast
Send us one photo, we wil do testing for you.
Thanks,
Heather
Want editing for your photos? We can help you for this.
We can do cutting out and retouching for your ecommerce photos, jewelry
photos retouching,
portrait photos or wedding photos.
Turnaround time is fast
Send us one photo, we wil do testing for you.
Thanks,
Heather
This was supposed to be a mask of all known rings, but it is being used
by execbuffer to filter out invalid rings, and so is instead mapping high
unused values onto valid rings. Instead of a mask of all known rings,
we need it to be the mask of all possible rings.
Fixes: 549f7365820a ("drm/i915: Enable SandyBridge blitter ring")
Fixes: de1add360522 ("drm/i915: Decouple execbuf uAPI from internal implementation")
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com>
Cc: <stable(a)vger.kernel.org> # v4.6+
---
include/uapi/drm/i915_drm.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/uapi/drm/i915_drm.h b/include/uapi/drm/i915_drm.h
index adb9fed86ef7..65b0b84419f3 100644
--- a/include/uapi/drm/i915_drm.h
+++ b/include/uapi/drm/i915_drm.h
@@ -984,7 +984,7 @@ struct drm_i915_gem_execbuffer2 {
* struct drm_i915_gem_exec_fence *fences.
*/
__u64 cliprects_ptr;
-#define I915_EXEC_RING_MASK (7<<0)
+#define I915_EXEC_RING_MASK (0x3f)
#define I915_EXEC_DEFAULT (0<<0)
#define I915_EXEC_RENDER (1<<0)
#define I915_EXEC_BSD (2<<0)
--
2.19.0
Changes since v5 [1]:
* Move the percpu-ref kill function to be passed in via @pgmap (Christoph)
* Added Christoph's ack for patches 2 and 4
* Added Jérôme's Reviewed-by for patches 2-6
* Fix MEMORY_DEVICE_PRIVATE support (Jérôme)
[1]: https://lkml.org/lkml/2018/9/13/104
---
Hi Andrew,
Jérôme has reviewed the cleanups, thanks Jérôme. We still disagree on
the EXPORT_SYMBOL_GPL status of the core HMM implementation, but Logan,
Christoph and I continue to support marking all devm_memremap_pages()
derivatives EXPORT_SYMBOL_GPL.
HMM has been upstream for over a year, with no in-tree users it is clear
it was designed first and foremost for out of tree drivers. It takes
advantage of a facility Christoph and I spearheaded to support
persistent memory. It continues to see expanding use cases with no clear
end date when it will stop attracting features / revisions. It is not
suitable to export devm_memremap_pages() as a stable 3rd party driver
api.
devm_memremap_pages() is a facility that can create struct page entries
for any arbitrary range and give out-of-tree drivers the ability to
subvert core aspects of page management. It, and anything derived from
it (e.g. hmm, pcip2p, etc...), is a deep integration point into the core
kernel, and an EXPORT_SYMBOL_GPL() interface.
Commit 31c5bda3a656 "mm: fix exports that inadvertently make put_page()
EXPORT_SYMBOL_GPL" was merged ahead of this series to relieve some of
the pressure from innocent consumers of put_page(), but now we need this
series to address *producers* of device pages.
More details and justification in the changelogs. The 0day
infrastructure has reported success across 152 configs and this survives
the libnvdimm unit test suite. Aside from the controversial bits the
diffstat is compelling at:
7 files changed, 127 insertions(+), 321 deletions(-)
Note that the series has some minor collisions with Alex's recent series
to improve devm_memremap_pages() scalability [2]. So, whichever you take
first the other will need a minor rebase.
[2]: https://www.lkml.org/lkml/2018/9/11/10
---
Dan Williams (7):
mm, devm_memremap_pages: Mark devm_memremap_pages() EXPORT_SYMBOL_GPL
mm, devm_memremap_pages: Kill mapping "System RAM" support
mm, devm_memremap_pages: Fix shutdown handling
mm, devm_memremap_pages: Add MEMORY_DEVICE_PRIVATE support
mm, hmm: Use devm semantics for hmm_devmem_{add,remove}
mm, hmm: Replace hmm_devmem_pages_create() with devm_memremap_pages()
mm, hmm: Mark hmm_devmem_{add,add_resource} EXPORT_SYMBOL_GPL
drivers/dax/pmem.c | 14 --
drivers/nvdimm/pmem.c | 13 +-
include/linux/hmm.h | 4
include/linux/memremap.h | 2
kernel/memremap.c | 95 +++++++-----
mm/hmm.c | 303 +++++--------------------------------
tools/testing/nvdimm/test/iomap.c | 17 ++
7 files changed, 127 insertions(+), 321 deletions(-)
PageTransCompoundMap() returns true for hugetlbfs and THP
hugepages. This behaviour incorrectly leads to stage 2 faults for
unsupported hugepage sizes (e.g., 64K hugepage with 4K pages) to be
treated as THP faults.
Tighten the check to filter out hugetlbfs pages. This also leads to
consistently mapping all unsupported hugepage sizes as PTE level
entries at stage 2.
Signed-off-by: Punit Agrawal <punit.agrawal(a)arm.com>
Cc: Christoffer Dall <christoffer.dall(a)arm.com>
Cc: Marc Zyngier <marc.zyngier(a)arm.com>
Cc: Suzuki Poulose <suzuki.poulose(a)arm.com>
Cc: stable(a)vger.kernel.org # v4.13+
---
virt/kvm/arm/mmu.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
index 7e477b3cae5b..c23a1b323aad 100644
--- a/virt/kvm/arm/mmu.c
+++ b/virt/kvm/arm/mmu.c
@@ -1231,8 +1231,14 @@ static bool transparent_hugepage_adjust(kvm_pfn_t *pfnp, phys_addr_t *ipap)
{
kvm_pfn_t pfn = *pfnp;
gfn_t gfn = *ipap >> PAGE_SHIFT;
+ struct page *page = pfn_to_page(pfn);
- if (PageTransCompoundMap(pfn_to_page(pfn))) {
+ /*
+ * PageTransCompoungMap() returns true for THP and
+ * hugetlbfs. Make sure the adjustment is done only for THP
+ * pages.
+ */
+ if (!PageHuge(page) && PageTransCompoundMap(page)) {
unsigned long mask;
/*
* The address we faulted on is backed by a transparent huge
--
2.18.0
Hi James,
Here's a pair of fixes that need to go upstream asap, please:
(1) Revert an incorrect fix to the keyrings UAPI for a C++ reserved word
used as a struct member name. This change being reverted breaks
existing userspace code and is thus incorrect.
Further, *neither* name is consistent with the one in the keyutils
package public header.
(2) Fix the problem by using a union to make the name from keyutils
available in parallel and make the 'private' name unavailable in C++
with cpp-conditionals.
David
---
David Howells (1):
keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h
Lubomir Rintel (1):
Revert "uapi/linux/keyctl.h: don't use C++ reserved keyword as a struct member name"
include/uapi/linux/keyctl.h | 7 ++++++-
security/keys/dh.c | 2 +-
2 files changed, 7 insertions(+), 2 deletions(-)
From: Paul Mackerras <paulus(a)ozlabs.org>
[ Upstream commit 46dec40fb741f00f1864580130779aeeaf24fb3d ]
This fixes a bug which causes guest virtual addresses to get translated
to guest real addresses incorrectly when the guest is using the HPT MMU
and has more than 256GB of RAM, or more specifically has a HPT larger
than 2GB. This has showed up in testing as a failure of the host to
emulate doorbell instructions correctly on POWER9 for HPT guests with
more than 256GB of RAM.
The bug is that the HPTE index in kvmppc_mmu_book3s_64_hv_xlate()
is stored as an int, and in forming the HPTE address, the index gets
shifted left 4 bits as an int before being signed-extended to 64 bits.
The simple fix is to make the variable a long int, matching the
return type of kvmppc_hv_find_lock_hpte(), which is what calculates
the index.
Fixes: 697d3899dcb4 ("KVM: PPC: Implement MMIO emulation support for Book3S HV guests")
Signed-off-by: Paul Mackerras <paulus(a)ozlabs.org>
Signed-off-by: Sasha Levin <alexander.levin(a)microsoft.com>
---
arch/powerpc/kvm/book3s_64_mmu_hv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index d40770248b6a..191cc3eea0bf 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -449,7 +449,7 @@ static int kvmppc_mmu_book3s_64_hv_xlate(struct kvm_vcpu *vcpu, gva_t eaddr,
unsigned long pp, key;
unsigned long v, gr;
__be64 *hptep;
- int index;
+ long int index;
int virtmode = vcpu->arch.shregs.msr & (data ? MSR_DR : MSR_IR);
/* Get SLB entry */
--
2.17.1
From: Paul Mackerras <paulus(a)ozlabs.org>
[ Upstream commit 46dec40fb741f00f1864580130779aeeaf24fb3d ]
This fixes a bug which causes guest virtual addresses to get translated
to guest real addresses incorrectly when the guest is using the HPT MMU
and has more than 256GB of RAM, or more specifically has a HPT larger
than 2GB. This has showed up in testing as a failure of the host to
emulate doorbell instructions correctly on POWER9 for HPT guests with
more than 256GB of RAM.
The bug is that the HPTE index in kvmppc_mmu_book3s_64_hv_xlate()
is stored as an int, and in forming the HPTE address, the index gets
shifted left 4 bits as an int before being signed-extended to 64 bits.
The simple fix is to make the variable a long int, matching the
return type of kvmppc_hv_find_lock_hpte(), which is what calculates
the index.
Fixes: 697d3899dcb4 ("KVM: PPC: Implement MMIO emulation support for Book3S HV guests")
Signed-off-by: Paul Mackerras <paulus(a)ozlabs.org>
Signed-off-by: Sasha Levin <alexander.levin(a)microsoft.com>
---
arch/powerpc/kvm/book3s_64_mmu_hv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index fb37290a57b4..366965ae37bd 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -314,7 +314,7 @@ static int kvmppc_mmu_book3s_64_hv_xlate(struct kvm_vcpu *vcpu, gva_t eaddr,
unsigned long pp, key;
unsigned long v, gr;
__be64 *hptep;
- int index;
+ long int index;
int virtmode = vcpu->arch.shregs.msr & (data ? MSR_DR : MSR_IR);
/* Get SLB entry */
--
2.17.1
From: Toke Høiland-Jørgensen <toke(a)toke.dk>
[ Upstream commit 77cfaf52eca5cac30ed029507e0cab065f888995 ]
The TXQ teardown code can reference the vif data structures that are
stored in the netdev private memory area if there are still packets on
the queue when it is being freed. Since the TXQ teardown code is run
after the netdevs are freed, this can lead to a use-after-free. Fix this
by moving the TXQ teardown code to earlier in ieee80211_unregister_hw().
Reported-by: Ben Greear <greearb(a)candelatech.com>
Tested-by: Ben Greear <greearb(a)candelatech.com>
Signed-off-by: Toke Høiland-Jørgensen <toke(a)toke.dk>
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
Signed-off-by: Sasha Levin <alexander.levin(a)microsoft.com>
---
net/mac80211/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 2bb6899854d4..6389ce868668 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1164,6 +1164,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
#if IS_ENABLED(CONFIG_IPV6)
unregister_inet6addr_notifier(&local->ifa6_notifier);
#endif
+ ieee80211_txq_teardown_flows(local);
rtnl_lock();
@@ -1191,7 +1192,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
skb_queue_purge(&local->skb_queue);
skb_queue_purge(&local->skb_queue_unreliable);
skb_queue_purge(&local->skb_queue_tdls_chsw);
- ieee80211_txq_teardown_flows(local);
destroy_workqueue(local->workqueue);
wiphy_unregister(local->hw.wiphy);
--
2.17.1
From: Toke Høiland-Jørgensen <toke(a)toke.dk>
[ Upstream commit 77cfaf52eca5cac30ed029507e0cab065f888995 ]
The TXQ teardown code can reference the vif data structures that are
stored in the netdev private memory area if there are still packets on
the queue when it is being freed. Since the TXQ teardown code is run
after the netdevs are freed, this can lead to a use-after-free. Fix this
by moving the TXQ teardown code to earlier in ieee80211_unregister_hw().
Reported-by: Ben Greear <greearb(a)candelatech.com>
Tested-by: Ben Greear <greearb(a)candelatech.com>
Signed-off-by: Toke Høiland-Jørgensen <toke(a)toke.dk>
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
Signed-off-by: Sasha Levin <alexander.levin(a)microsoft.com>
---
net/mac80211/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 8aa1f5b6a051..cb5b22b61388 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1171,6 +1171,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
#if IS_ENABLED(CONFIG_IPV6)
unregister_inet6addr_notifier(&local->ifa6_notifier);
#endif
+ ieee80211_txq_teardown_flows(local);
rtnl_lock();
@@ -1199,7 +1200,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
skb_queue_purge(&local->skb_queue);
skb_queue_purge(&local->skb_queue_unreliable);
skb_queue_purge(&local->skb_queue_tdls_chsw);
- ieee80211_txq_teardown_flows(local);
destroy_workqueue(local->workqueue);
wiphy_unregister(local->hw.wiphy);
--
2.17.1
From: Toke Høiland-Jørgensen <toke(a)toke.dk>
[ Upstream commit 77cfaf52eca5cac30ed029507e0cab065f888995 ]
The TXQ teardown code can reference the vif data structures that are
stored in the netdev private memory area if there are still packets on
the queue when it is being freed. Since the TXQ teardown code is run
after the netdevs are freed, this can lead to a use-after-free. Fix this
by moving the TXQ teardown code to earlier in ieee80211_unregister_hw().
Reported-by: Ben Greear <greearb(a)candelatech.com>
Tested-by: Ben Greear <greearb(a)candelatech.com>
Signed-off-by: Toke Høiland-Jørgensen <toke(a)toke.dk>
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
Signed-off-by: Sasha Levin <alexander.levin(a)microsoft.com>
---
net/mac80211/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index fb73451ed85e..0358f20b675f 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1182,6 +1182,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
#if IS_ENABLED(CONFIG_IPV6)
unregister_inet6addr_notifier(&local->ifa6_notifier);
#endif
+ ieee80211_txq_teardown_flows(local);
rtnl_lock();
@@ -1210,7 +1211,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
skb_queue_purge(&local->skb_queue);
skb_queue_purge(&local->skb_queue_unreliable);
skb_queue_purge(&local->skb_queue_tdls_chsw);
- ieee80211_txq_teardown_flows(local);
destroy_workqueue(local->workqueue);
wiphy_unregister(local->hw.wiphy);
--
2.17.1