The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b1f382178d150f256c1cf95b9341fda6eb764459 Mon Sep 17 00:00:00 2001
From: Ross Zwisler <zwisler(a)kernel.org>
Date: Tue, 11 Sep 2018 13:31:16 -0400
Subject: [PATCH] ext4: close race between direct IO and ext4_break_layouts()
If the refcount of a page is lowered between the time that it is returned
by dax_busy_page() and when the refcount is again checked in
ext4_break_layouts() => ___wait_var_event(), the waiting function
ext4_wait_dax_page() will never be called. This means that
ext4_break_layouts() will still have 'retry' set to false, so we'll stop
looping and never check the refcount of other pages in this inode.
Instead, always continue looping as long as dax_layout_busy_page() gives us
a page which it found with an elevated refcount.
Signed-off-by: Ross Zwisler <ross.zwisler(a)linux.intel.com>
Reviewed-by: Jan Kara <jack(a)suse.cz>
Signed-off-by: Jan Kara <jack(a)suse.cz>
Signed-off-by: Theodore Ts'o <tytso(a)mit.edu>
Cc: stable(a)vger.kernel.org
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 694f31364206..723058bfe43b 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4195,9 +4195,8 @@ int ext4_update_disksize_before_punch(struct inode *inode, loff_t offset,
return 0;
}
-static void ext4_wait_dax_page(struct ext4_inode_info *ei, bool *did_unlock)
+static void ext4_wait_dax_page(struct ext4_inode_info *ei)
{
- *did_unlock = true;
up_write(&ei->i_mmap_sem);
schedule();
down_write(&ei->i_mmap_sem);
@@ -4207,14 +4206,12 @@ int ext4_break_layouts(struct inode *inode)
{
struct ext4_inode_info *ei = EXT4_I(inode);
struct page *page;
- bool retry;
int error;
if (WARN_ON_ONCE(!rwsem_is_locked(&ei->i_mmap_sem)))
return -EINVAL;
do {
- retry = false;
page = dax_layout_busy_page(inode->i_mapping);
if (!page)
return 0;
@@ -4222,8 +4219,8 @@ int ext4_break_layouts(struct inode *inode)
error = ___wait_var_event(&page->_refcount,
atomic_read(&page->_refcount) == 1,
TASK_INTERRUPTIBLE, 0, 0,
- ext4_wait_dax_page(ei, &retry));
- } while (error == 0 && retry);
+ ext4_wait_dax_page(ei));
+ } while (error == 0);
return error;
}
We attempt to get fences earlier in the hopes that everything will
already have fences and no callbacks will be needed. If we do succeed
in getting a fence, getting one a second time will result in a duplicate
ref with no unref. This is causing memory leaks in Vulkan applications
that create a lot of fences; playing for a few hours can, apparently,
bring down the system.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107899
Signed-off-by: Jason Ekstrand <jason(a)jlekstrand.net>
Cc: stable(a)vger.kernel.org
---
drivers/gpu/drm/drm_syncobj.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index adb3cb27d31e..759278fef35a 100644
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -97,6 +97,8 @@ static int drm_syncobj_fence_get_or_add_callback(struct drm_syncobj *syncobj,
{
int ret;
+ WARN_ON(*fence);
+
*fence = drm_syncobj_fence_get(syncobj);
if (*fence)
return 1;
@@ -743,6 +745,9 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs,
if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) {
for (i = 0; i < count; ++i) {
+ if (entries[i].fence)
+ continue;
+
drm_syncobj_fence_get_or_add_callback(syncobjs[i],
&entries[i].fence,
&entries[i].syncobj_cb,
--
2.17.1
From: Zachary Zhang <zhangzg(a)marvell.com>
commit 91a2968e245d6ba616db37001fa1a043078b1a65 usptream.
The PCIE I/O and MEM resource allocation mechanism is that root bus
goes through the following steps:
1. Check PCI bridges' range and computes I/O and Mem base/limits.
2. Sort all subordinate devices I/O and MEM resource requirements and
allocate the resources and writes/updates subordinate devices'
requirements to PCI bridges I/O and Mem MEM/limits registers.
Currently, PCI Aardvark driver only handles the second step and lacks
the first step, so there is an I/O and MEM resource allocation failure
when using a PCI switch. This commit fixes that by sizing bridges
before doing the resource allocation.
Fixes: 8c39d710363c1 ("PCI: aardvark: Add Aardvark PCI host controller
driver")
Signed-off-by: Zachary Zhang <zhangzg(a)marvell.com>
[Thomas: edit commit log.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni(a)bootlin.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi(a)arm.com>
Cc: <stable(a)vger.kernel.org>
---
drivers/pci/host/pci-aardvark.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c
index 9bfc22b5da4b..5f3048e75bec 100644
--- a/drivers/pci/host/pci-aardvark.c
+++ b/drivers/pci/host/pci-aardvark.c
@@ -954,6 +954,7 @@ static int advk_pcie_probe(struct platform_device *pdev)
bus = bridge->bus;
+ pci_bus_size_bridges(bus);
pci_bus_assign_resources(bus);
list_for_each_entry(child, &bus->children, node)
--
2.14.4
From: Zachary Zhang <zhangzg(a)marvell.com>
commit 91a2968e245d6ba616db37001fa1a043078b1a65 usptream.
The PCIE I/O and MEM resource allocation mechanism is that root bus
goes through the following steps:
1. Check PCI bridges' range and computes I/O and Mem base/limits.
2. Sort all subordinate devices I/O and MEM resource requirements and
allocate the resources and writes/updates subordinate devices'
requirements to PCI bridges I/O and Mem MEM/limits registers.
Currently, PCI Aardvark driver only handles the second step and lacks
the first step, so there is an I/O and MEM resource allocation failure
when using a PCI switch. This commit fixes that by sizing bridges
before doing the resource allocation.
Fixes: 8c39d710363c1 ("PCI: aardvark: Add Aardvark PCI host controller
driver")
Signed-off-by: Zachary Zhang <zhangzg(a)marvell.com>
[Thomas: edit commit log.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni(a)bootlin.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi(a)arm.com>
Cc: <stable(a)vger.kernel.org>
---
drivers/pci/host/pci-aardvark.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c
index 11bad826683e..1dbd09c91a7c 100644
--- a/drivers/pci/host/pci-aardvark.c
+++ b/drivers/pci/host/pci-aardvark.c
@@ -976,6 +976,7 @@ static int advk_pcie_probe(struct platform_device *pdev)
return -ENOMEM;
}
+ pci_bus_size_bridges(bus);
pci_bus_assign_resources(bus);
list_for_each_entry(child, &bus->children, node)
--
2.14.4
From: Catalin Marinas <catalin.marinas(a)arm.com>
commit db3899a6477a4dccd26cbfb7f408b6be2cc068e0 upstream.
When a kernel is built with CONFIG_TRACE_IRQFLAGS the following warning
is produced when entering userspace for the first time:
WARNING: at /work/Linux/linux-2.6-aarch64/kernel/locking/lockdep.c:3519
Modules linked in:
CPU: 1 PID: 1 Comm: systemd Not tainted 4.4.0-rc3+ #639
Hardware name: Juno (DT)
task: ffffffc9768a0000 ti: ffffffc9768a8000 task.ti: ffffffc9768a8000
PC is at check_flags.part.22+0x19c/0x1a8
LR is at check_flags.part.22+0x19c/0x1a8
pc : [<ffffffc0000fba6c>] lr : [<ffffffc0000fba6c>] pstate: 600001c5
sp : ffffffc9768abe10
x29: ffffffc9768abe10 x28: ffffffc9768a8000
x27: 0000000000000000 x26: 0000000000000001
x25: 00000000000000a6 x24: ffffffc00064be6c
x23: ffffffc0009f249e x22: ffffffc9768a0000
x21: ffffffc97fea5480 x20: 00000000000001c0
x19: ffffffc00169a000 x18: 0000005558cc7b58
x17: 0000007fb78e3180 x16: 0000005558d2e238
x15: ffffffffffffffff x14: 0ffffffffffffffd
x13: 0000000000000008 x12: 0101010101010101
x11: 7f7f7f7f7f7f7f7f x10: fefefefefefeff63
x9 : 7f7f7f7f7f7f7f7f x8 : 6e655f7371726964
x7 : 0000000000000001 x6 : ffffffc0001079c4
x5 : 0000000000000000 x4 : 0000000000000001
x3 : ffffffc001698438 x2 : 0000000000000000
x1 : ffffffc9768a0000 x0 : 000000000000002e
Call trace:
[<ffffffc0000fba6c>] check_flags.part.22+0x19c/0x1a8
[<ffffffc0000fc440>] lock_is_held+0x80/0x98
[<ffffffc00064bafc>] __schedule+0x404/0x730
[<ffffffc00064be6c>] schedule+0x44/0xb8
[<ffffffc000085bb0>] ret_to_user+0x0/0x24
possible reason: unannotated irqs-off.
irq event stamp: 502169
hardirqs last enabled at (502169): [<ffffffc000085a98>] el0_irq_naked+0x1c/0x24
hardirqs last disabled at (502167): [<ffffffc0000bb3bc>] __do_softirq+0x17c/0x298
softirqs last enabled at (502168): [<ffffffc0000bb43c>] __do_softirq+0x1fc/0x298
softirqs last disabled at (502143): [<ffffffc0000bb830>] irq_exit+0xa0/0xf0
This happens because we disable interrupts in ret_to_user before calling
schedule() in work_resched. This patch adds the necessary
trace_hardirqs_off annotation.
Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com>
Reported-by: Mark Rutland <mark.rutland(a)arm.com>
Cc: Will Deacon <will.deacon(a)arm.com>
Signed-off-by: Will Deacon <will.deacon(a)arm.com>
---
Without this patch and CONFIG_TRACE_IRQFLAGS enabled, the mentioned warning
is seen in v3.18.y and v4.4.y. The patch applies cleanly to both releases.
I confirmed that the problem is gone after applying it.
arch/arm64/kernel/entry.S | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 7ed3d75f6304..e5b25389c48f 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -634,6 +634,9 @@ work_pending:
bl do_notify_resume
b ret_to_user
work_resched:
+#ifdef CONFIG_TRACE_IRQFLAGS
+ bl trace_hardirqs_off // the IRQs are off here, inform the tracing code
+#endif
bl schedule
/*
--
2.7.4
Please pick up the following commit which has merged to Linus' tree:
commit d0cdb3ce8834332d918fc9c8ff74f8a169ec9abe
Author: Steve Muckle <smuckle(a)google.com>
Date: Fri Aug 31 15:42:17 2018 -0700
sched/fair: Fix vruntime_normalized() for remote non-migration wakeup
This commit is 3 lines in diffs. It fixes an issue where, during certain
usecases, a task's vruntime may be greatly inflated, causing it to not
execute with the priority that it should.
The commit it fixes went into 4.7 so the fix should go into 4.9, 4.14,
and 4.18. I have verified the commit applies cleanly to 4.9.128,
4.14.71, and 4.18.9.
thanks,
Steve
The patch below does not apply to the 4.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b1f382178d150f256c1cf95b9341fda6eb764459 Mon Sep 17 00:00:00 2001
From: Ross Zwisler <zwisler(a)kernel.org>
Date: Tue, 11 Sep 2018 13:31:16 -0400
Subject: [PATCH] ext4: close race between direct IO and ext4_break_layouts()
If the refcount of a page is lowered between the time that it is returned
by dax_busy_page() and when the refcount is again checked in
ext4_break_layouts() => ___wait_var_event(), the waiting function
ext4_wait_dax_page() will never be called. This means that
ext4_break_layouts() will still have 'retry' set to false, so we'll stop
looping and never check the refcount of other pages in this inode.
Instead, always continue looping as long as dax_layout_busy_page() gives us
a page which it found with an elevated refcount.
Signed-off-by: Ross Zwisler <ross.zwisler(a)linux.intel.com>
Reviewed-by: Jan Kara <jack(a)suse.cz>
Signed-off-by: Jan Kara <jack(a)suse.cz>
Signed-off-by: Theodore Ts'o <tytso(a)mit.edu>
Cc: stable(a)vger.kernel.org
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 694f31364206..723058bfe43b 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4195,9 +4195,8 @@ int ext4_update_disksize_before_punch(struct inode *inode, loff_t offset,
return 0;
}
-static void ext4_wait_dax_page(struct ext4_inode_info *ei, bool *did_unlock)
+static void ext4_wait_dax_page(struct ext4_inode_info *ei)
{
- *did_unlock = true;
up_write(&ei->i_mmap_sem);
schedule();
down_write(&ei->i_mmap_sem);
@@ -4207,14 +4206,12 @@ int ext4_break_layouts(struct inode *inode)
{
struct ext4_inode_info *ei = EXT4_I(inode);
struct page *page;
- bool retry;
int error;
if (WARN_ON_ONCE(!rwsem_is_locked(&ei->i_mmap_sem)))
return -EINVAL;
do {
- retry = false;
page = dax_layout_busy_page(inode->i_mapping);
if (!page)
return 0;
@@ -4222,8 +4219,8 @@ int ext4_break_layouts(struct inode *inode)
error = ___wait_var_event(&page->_refcount,
atomic_read(&page->_refcount) == 1,
TASK_INTERRUPTIBLE, 0, 0,
- ext4_wait_dax_page(ei, &retry));
- } while (error == 0 && retry);
+ ext4_wait_dax_page(ei));
+ } while (error == 0);
return error;
}
The patch below does not apply to the 4.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From e71cf591876536f7dd5a54ef68d631278ca6faa1 Mon Sep 17 00:00:00 2001
From: Thomas Hellstrom <thellstrom(a)vmware.com>
Date: Fri, 14 Sep 2018 09:24:19 +0200
Subject: [PATCH] drm/vmwgfx: Fix buffer object eviction
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Commit 19be55701071 ("drm/ttm: add operation ctx to ttm_bo_validate v2")
introduced a regression where the vmwgfx driver refused to evict a
buffer that was still busy instead of waiting for it to become idle.
Fix this.
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Thomas Hellstrom <thellstrom(a)vmware.com>
Reviewed-by: Christian König <christian.koenig(a)amd.com>
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 1f134570b759..f0ab6b2313bb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -3729,7 +3729,7 @@ int vmw_validate_single_buffer(struct vmw_private *dev_priv,
{
struct vmw_buffer_object *vbo =
container_of(bo, struct vmw_buffer_object, base);
- struct ttm_operation_ctx ctx = { interruptible, true };
+ struct ttm_operation_ctx ctx = { interruptible, false };
int ret;
if (vbo->pin_count > 0)
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 8c39e2699f8acb2e29782a834e56306da24937fe Mon Sep 17 00:00:00 2001
From: Vincent Pelletier <plr.vincent(a)gmail.com>
Date: Sun, 9 Sep 2018 04:09:27 +0000
Subject: [PATCH] scsi: target: iscsi: Use bin2hex instead of a
re-implementation
Signed-off-by: Vincent Pelletier <plr.vincent(a)gmail.com>
Reviewed-by: Mike Christie <mchristi(a)redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
index 6c3b4c022894..4e680d753941 100644
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -26,15 +26,6 @@
#include "iscsi_target_nego.h"
#include "iscsi_target_auth.h"
-static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len)
-{
- int i;
-
- for (i = 0; i < src_len; i++) {
- sprintf(&dst[i*2], "%02x", (int) src[i] & 0xff);
- }
-}
-
static int chap_gen_challenge(
struct iscsi_conn *conn,
int caller,
@@ -50,7 +41,7 @@ static int chap_gen_challenge(
ret = get_random_bytes_wait(chap->challenge, CHAP_CHALLENGE_LENGTH);
if (unlikely(ret))
return ret;
- chap_binaryhex_to_asciihex(challenge_asciihex, chap->challenge,
+ bin2hex(challenge_asciihex, chap->challenge,
CHAP_CHALLENGE_LENGTH);
/*
* Set CHAP_C, and copy the generated challenge into c_str.
@@ -289,7 +280,7 @@ static int chap_server_compute_md5(
goto out;
}
- chap_binaryhex_to_asciihex(response, server_digest, MD5_SIGNATURE_SIZE);
+ bin2hex(response, server_digest, MD5_SIGNATURE_SIZE);
pr_debug("[server] MD5 Server Digest: %s\n", response);
if (memcmp(server_digest, client_digest, MD5_SIGNATURE_SIZE) != 0) {
@@ -411,7 +402,7 @@ static int chap_server_compute_md5(
/*
* Convert response from binary hex to ascii hext.
*/
- chap_binaryhex_to_asciihex(response, digest, MD5_SIGNATURE_SIZE);
+ bin2hex(response, digest, MD5_SIGNATURE_SIZE);
*nr_out_len += sprintf(nr_out_ptr + *nr_out_len, "CHAP_R=0x%s",
response);
*nr_out_len += 1;
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 8c39e2699f8acb2e29782a834e56306da24937fe Mon Sep 17 00:00:00 2001
From: Vincent Pelletier <plr.vincent(a)gmail.com>
Date: Sun, 9 Sep 2018 04:09:27 +0000
Subject: [PATCH] scsi: target: iscsi: Use bin2hex instead of a
re-implementation
Signed-off-by: Vincent Pelletier <plr.vincent(a)gmail.com>
Reviewed-by: Mike Christie <mchristi(a)redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
index 6c3b4c022894..4e680d753941 100644
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -26,15 +26,6 @@
#include "iscsi_target_nego.h"
#include "iscsi_target_auth.h"
-static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len)
-{
- int i;
-
- for (i = 0; i < src_len; i++) {
- sprintf(&dst[i*2], "%02x", (int) src[i] & 0xff);
- }
-}
-
static int chap_gen_challenge(
struct iscsi_conn *conn,
int caller,
@@ -50,7 +41,7 @@ static int chap_gen_challenge(
ret = get_random_bytes_wait(chap->challenge, CHAP_CHALLENGE_LENGTH);
if (unlikely(ret))
return ret;
- chap_binaryhex_to_asciihex(challenge_asciihex, chap->challenge,
+ bin2hex(challenge_asciihex, chap->challenge,
CHAP_CHALLENGE_LENGTH);
/*
* Set CHAP_C, and copy the generated challenge into c_str.
@@ -289,7 +280,7 @@ static int chap_server_compute_md5(
goto out;
}
- chap_binaryhex_to_asciihex(response, server_digest, MD5_SIGNATURE_SIZE);
+ bin2hex(response, server_digest, MD5_SIGNATURE_SIZE);
pr_debug("[server] MD5 Server Digest: %s\n", response);
if (memcmp(server_digest, client_digest, MD5_SIGNATURE_SIZE) != 0) {
@@ -411,7 +402,7 @@ static int chap_server_compute_md5(
/*
* Convert response from binary hex to ascii hext.
*/
- chap_binaryhex_to_asciihex(response, digest, MD5_SIGNATURE_SIZE);
+ bin2hex(response, digest, MD5_SIGNATURE_SIZE);
*nr_out_len += sprintf(nr_out_ptr + *nr_out_len, "CHAP_R=0x%s",
response);
*nr_out_len += 1;
Quoting Jason Ekstrand (2018-09-26 10:43:59)
> On Wed, Sep 26, 2018 at 3:18 AM Chris Wilson <chris(a)chris-wilson.co.uk> wrote:
>
> Quoting Jason Ekstrand (2018-09-26 08:17:03)
> > We attempt to get fences earlier in the hopes that everything will
> > already have fences and no callbacks will be needed. If we do succeed
> > in getting a fence, getting one a second time will result in a duplicate
> > ref with no unref. This is causing memory leaks in Vulkan applications
> > that create a lot of fences; playing for a few hours can, apparently,
> > bring down the system.
> >
> > Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107899
> > Signed-off-by: Jason Ekstrand <jason(a)jlekstrand.net>
> > Cc: stable(a)vger.kernel.org
> > ---
> > drivers/gpu/drm/drm_syncobj.c | 5 +++++
> > 1 file changed, 5 insertions(+)
> >
> > diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/
> drm_syncobj.c
> > index adb3cb27d31e..759278fef35a 100644
> > --- a/drivers/gpu/drm/drm_syncobj.c
> > +++ b/drivers/gpu/drm/drm_syncobj.c
> > @@ -97,6 +97,8 @@ static int drm_syncobj_fence_get_or_add_callback(struct
> drm_syncobj *syncobj,
> > {
> > int ret;
> >
> > + WARN_ON(*fence);
>
> I would have just put if (*fence) return; since the function is tied to
> the array_wait implementation.
>
>
> I considered doing that but marginally liked this better. If you have a
> preference, I'm happy to change itl.
Patch works, the difference is insignificant, land the patch and close
the bug.
-Chris
The patch below does not apply to the 4.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 5223c9c1cbfc0cd4d0a1b50758e0949af3290fa1 Mon Sep 17 00:00:00 2001
From: Angelo Dureghello <angelo(a)sysam.it>
Date: Sat, 18 Aug 2018 01:51:58 +0200
Subject: [PATCH] spi: spi-fsl-dspi: fix broken DSPI_EOQ_MODE
This patch fixes the dspi_eoq_write function used by the
ColdFire mcf5441x family. The 16 bit cmd part must be re-set at
each data transfer.
Also, now that fifo_size variables are used for eoq_read/write,
a proper fifo size must be set (16 slots for the ColdFire dspi
module version).
Signed-off-by: Angelo Dureghello <angelo(a)sysam.it>
Acked-by: Esben Haabendal <esben(a)haabendal.dk>
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Cc: stable(a)vger.kernel.org
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 7cb3ab0a35a0..3082e72e4f6c 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -30,7 +30,11 @@
#define DRIVER_NAME "fsl-dspi"
+#ifdef CONFIG_M5441x
+#define DSPI_FIFO_SIZE 16
+#else
#define DSPI_FIFO_SIZE 4
+#endif
#define DSPI_DMA_BUFSIZE (DSPI_FIFO_SIZE * 1024)
#define SPI_MCR 0x00
@@ -623,9 +627,11 @@ static void dspi_tcfq_read(struct fsl_dspi *dspi)
static void dspi_eoq_write(struct fsl_dspi *dspi)
{
int fifo_size = DSPI_FIFO_SIZE;
+ u16 xfer_cmd = dspi->tx_cmd;
/* Fill TX FIFO with as many transfers as possible */
while (dspi->len && fifo_size--) {
+ dspi->tx_cmd = xfer_cmd;
/* Request EOQF for last transfer in FIFO */
if (dspi->len == dspi->bytes_per_word || fifo_size == 0)
dspi->tx_cmd |= SPI_PUSHR_CMD_EOQ;
The patch below does not apply to the 4.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 85516a9881a31e2c7a8d10f4697f3adcccc7cef1 Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal(a)bootlin.com>
Date: Fri, 7 Sep 2018 16:35:54 +0200
Subject: [PATCH] mtd: partitions: fix unbalanced of_node_get/put()
While at first mtd_part_of_parse() would just call
of_get_chil_by_name(), it has been patched to deal with sub-partitions
and will now directly manipulate the node returned by mtd_get_of_node()
if the MTD device is a partition.
A of_node_put() was a bit below in the code, to balance the
of_get_child_by_name(). However, despite its name, mtd_get_of_node()
does not take a reference on the OF node. It is a simple helper hiding
some pointer logic to retrieve the OF node related to an MTD
device.
The direct effect of such unbalanced reference counting is visible by
rmmod'ing any module that would have added MTD partitions:
OF: ERROR: Bad of_node_put() on <of_path_to_partition>
As it seems normal to get a reference on the OF node during the
of_property_for_each_string() that follows, add a call to
of_node_get() when relevant.
Fixes: 76a832254ab0 ("mtd: partitions: use DT info for parsing partitions with "compatible" prop")
Cc: stable(a)vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com>
Signed-off-by: Boris Brezillon <boris.brezillon(a)bootlin.com>
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 52e2cb35fc79..99c460facd5e 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -873,8 +873,11 @@ static int mtd_part_of_parse(struct mtd_info *master,
int ret, err = 0;
np = mtd_get_of_node(master);
- if (!mtd_is_partition(master))
+ if (mtd_is_partition(master))
+ of_node_get(np);
+ else
np = of_get_child_by_name(np, "partitions");
+
of_property_for_each_string(np, "compatible", prop, compat) {
parser = mtd_part_get_compatible_parser(compat);
if (!parser)
drm_mode_setcrtc() retries modesetting in case one of the functions it
calls returns -EDEADLK. connector_set, mode and fb are freed before
retrying, but they are not set to NULL. This can cause
drm_mode_setcrtc() to use those variables.
For example: On the first try __drm_mode_set_config_internal() returns
-EDEADLK. connector_set, mode and fb are freed. Next retry starts, and
drm_modeset_lock_all_ctx() returns -EDEADLK, and we jump to 'out'. The
code will happily try to release all three again.
This leads to crashes of different kinds, depending on the sequence the
EDEADLKs happen.
Fix this by setting the three variables to NULL at the start of the
retry loop.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ti.com>
Cc: stable(a)vger.kernel.org
---
drivers/gpu/drm/drm_crtc.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 2f6c877299e4..2ad14593fb23 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -570,9 +570,9 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
struct drm_mode_crtc *crtc_req = data;
struct drm_crtc *crtc;
struct drm_plane *plane;
- struct drm_connector **connector_set = NULL, *connector;
- struct drm_framebuffer *fb = NULL;
- struct drm_display_mode *mode = NULL;
+ struct drm_connector **connector_set, *connector;
+ struct drm_framebuffer *fb;
+ struct drm_display_mode *mode;
struct drm_mode_set set;
uint32_t __user *set_connectors_ptr;
struct drm_modeset_acquire_ctx ctx;
@@ -601,6 +601,10 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
mutex_lock(&crtc->dev->mode_config.mutex);
drm_modeset_acquire_init(&ctx, DRM_MODESET_ACQUIRE_INTERRUPTIBLE);
retry:
+ connector_set = NULL;
+ fb = NULL;
+ mode = NULL;
+
ret = drm_modeset_lock_all_ctx(crtc->dev, &ctx);
if (ret)
goto out;
--
Texas Instruments Finland Oy, Porkkalankatu 22, 00180 Helsinki.
Y-tunnus/Business ID: 0615521-4. Kotipaikka/Domicile: Helsinki
ps->dev->actconfig can be NULL and cause NULL-deref in usb_find_alt_setting()
before c9a4cb204e9e. fix this anyway by checking that ps->dev->actconfig is not
NULL, so usb_find_alt_setting() is not called with a known-bad argument.
Signed-off-by: Vladis Dronov <vdronov(a)redhat.com>
Reported-by: syzbot+19c3aaef85a89d451eac(a)syzkaller.appspotmail.com
---
drivers/usb/core/devio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 6ce77b33da61..26047620b003 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -824,7 +824,7 @@ static int check_ctrlrecip(struct usb_dev_state *ps, unsigned int requesttype,
* class specification, which we always want to allow as it is used
* to query things like ink level, etc.
*/
- if (requesttype == 0xa1 && request == 0) {
+ if (requesttype == 0xa1 && request == 0 && ps->dev->actconfig) {
alt_setting = usb_find_alt_setting(ps->dev->actconfig,
index >> 8, index & 0xff);
if (alt_setting
--
2.14.4
The patch titled
Subject: mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings
has been added to the -mm tree. Its filename is
mm-thp-relax-__gfp_thisnode-for-madv_hugepage-mappings.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-thp-relax-__gfp_thisnode-for-ma…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-thp-relax-__gfp_thisnode-for-ma…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Andrea Arcangeli <aarcange(a)redhat.com>
Subject: mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings
THP allocation might be really disruptive when allocated on NUMA system
with the local node full or hard to reclaim. Stefan has posted an
allocation stall report on 4.12 based SLES kernel which suggests the same
issue:
[245513.362669] kvm: page allocation stalls for 194572ms, order:9, mode:0x4740ca(__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_THISNODE|__GFP_MOVABLE|__GFP_DIRECT_RECLAIM), nodemask=(null)
[245513.363983] kvm cpuset=/ mems_allowed=0-1
[245513.364604] CPU: 10 PID: 84752 Comm: kvm Tainted: G W 4.12.0+98-ph <a href="/view.php?id=1" title="[geschlossen] Integration Ramdisk" class="resolved">0000001</a> SLE15 (unreleased)
[245513.365258] Hardware name: Supermicro SYS-1029P-WTRT/X11DDW-NT, BIOS 2.0 12/05/2017
[245513.365905] Call Trace:
[245513.366535] dump_stack+0x5c/0x84
[245513.367148] warn_alloc+0xe0/0x180
[245513.367769] __alloc_pages_slowpath+0x820/0xc90
[245513.368406] ? __slab_free+0xa9/0x2f0
[245513.369048] ? __slab_free+0xa9/0x2f0
[245513.369671] __alloc_pages_nodemask+0x1cc/0x210
[245513.370300] alloc_pages_vma+0x1e5/0x280
[245513.370921] do_huge_pmd_wp_page+0x83f/0xf00
[245513.371554] ? set_huge_zero_page.isra.52.part.53+0x9b/0xb0
[245513.372184] ? do_huge_pmd_anonymous_page+0x631/0x6d0
[245513.372812] __handle_mm_fault+0x93d/0x1060
[245513.373439] handle_mm_fault+0xc6/0x1b0
[245513.374042] __do_page_fault+0x230/0x430
[245513.374679] ? get_vtime_delta+0x13/0xb0
[245513.375411] do_page_fault+0x2a/0x70
[245513.376145] ? page_fault+0x65/0x80
[245513.376882] page_fault+0x7b/0x80
[...]
[245513.382056] Mem-Info:
[245513.382634] active_anon:126315487 inactive_anon:1612476 isolated_anon:5
active_file:60183 inactive_file:245285 isolated_file:0
unevictable:15657 dirty:286 writeback:1 unstable:0
slab_reclaimable:75543 slab_unreclaimable:2509111
mapped:81814 shmem:31764 pagetables:370616 bounce:0
free:32294031 free_pcp:6233 free_cma:0
[245513.386615] Node 0 active_anon:254680388kB inactive_anon:1112760kB active_file:240648kB inactive_file:981168kB unevictable:13368kB isolated(anon):0kB isolated(file):0kB mapped:280240kB dirty:1144kB writeback:0kB shmem:95832kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 81225728kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no
[245513.388650] Node 1 active_anon:250583072kB inactive_anon:5337144kB active_file:84kB inactive_file:0kB unevictable:49260kB isolated(anon):20kB isolated(file):0kB mapped:47016kB dirty:0kB writeback:4kB shmem:31224kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 31897600kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no
The defrag mode is "madvise" and from the above report it is clear that
the THP has been allocated for MADV_HUGEPAGA vma.
Andrea has identified that the main source of the problem is
__GFP_THISNODE usage:
: The problem is that direct compaction combined with the NUMA
: __GFP_THISNODE logic in mempolicy.c is telling reclaim to swap very
: hard the local node, instead of failing the allocation if there's no
: THP available in the local node.
:
: Such logic was ok until __GFP_THISNODE was added to the THP allocation
: path even with MPOL_DEFAULT.
:
: The idea behind the __GFP_THISNODE addition, is that it is better to
: provide local memory in PAGE_SIZE units than to use remote NUMA THP
: backed memory. That largely depends on the remote latency though, on
: threadrippers for example the overhead is relatively low in my
: experience.
:
: The combination of __GFP_THISNODE and __GFP_DIRECT_RECLAIM results in
: extremely slow qemu startup with vfio, if the VM is larger than the
: size of one host NUMA node. This is because it will try very hard to
: unsuccessfully swapout get_user_pages pinned pages as result of the
: __GFP_THISNODE being set, instead of falling back to PAGE_SIZE
: allocations and instead of trying to allocate THP on other nodes (it
: would be even worse without vfio type1 GUP pins of course, except it'd
: be swapping heavily instead).
Fix this by removing __GFP_THISNODE for THP requests which are requesting
the direct reclaim. This effectivelly reverts 5265047ac301 on the grounds
that the zone/node reclaim was known to be disruptive due to premature
reclaim when there was memory free. While it made sense at the time for
HPC workloads without NUMA awareness on rare machines, it was ultimately
harmful in the majority of cases. The existing behaviour is similiar, if
not as widespare as it applies to a corner case but crucially, it cannot
be tuned around like zone_reclaim_mode can. The default behaviour should
always be to cause the least harm for the common case.
If there are specialised use cases out there that want zone_reclaim_mode
in specific cases, then it can be built on top. Longterm we should
consider a memory policy which allows for the node reclaim like behavior
for the specific memory ranges which would allow a
[1] http://lkml.kernel.org/r/20180820032204.9591-1-aarcange@redhat.com
Mel said:
: Both patches look correct to me but I'm responding to this one because
: it's the fix. The change makes sense and moves further away from the
: severe stalling behaviour we used to see with both THP and zone reclaim
: mode.
:
: I put together a basic experiment with usemem configured to reference a
: buffer multiple times that is 80% the size of main memory on a 2-socket
: box with symmetric node sizes and defrag set to "always". The defrag
: setting is not the default but it would be functionally similar to
: accessing a buffer with madvise(MADV_HUGEPAGE). Usemem is configured to
: reference the buffer multiple times and while it's not an interesting
: workload, it would be expected to complete reasonably quickly as it fits
: within memory. The results were;
:
: usemem
: vanilla noreclaim-v1
: Amean Elapsd-1 42.78 ( 0.00%) 26.87 ( 37.18%)
: Amean Elapsd-3 27.55 ( 0.00%) 7.44 ( 73.00%)
: Amean Elapsd-4 5.72 ( 0.00%) 5.69 ( 0.45%)
:
: This shows the elapsed time in seconds for 1 thread, 3 threads and 4
: threads referencing buffers 80% the size of memory. With the patches
: applied, it's 37.18% faster for the single thread and 73% faster with two
: threads. Note that 4 threads showing little difference does not indicate
: the problem is related to thread counts. It's simply the case that 4
: threads gets spread so their workload mostly fits in one node.
:
: The overall view from /proc/vmstats is more startling
:
: 4.19.0-rc1 4.19.0-rc1
: vanillanoreclaim-v1r1
: Minor Faults 35593425 708164
: Major Faults 484088 36
: Swap Ins 3772837 0
: Swap Outs 3932295 0
:
: Massive amounts of swap in/out without the patch
:
: Direct pages scanned 6013214 0
: Kswapd pages scanned 0 0
: Kswapd pages reclaimed 0 0
: Direct pages reclaimed 4033009 0
:
: Lots of reclaim activity without the patch
:
: Kswapd efficiency 100% 100%
: Kswapd velocity 0.000 0.000
: Direct efficiency 67% 100%
: Direct velocity 11191.956 0.000
:
: Mostly from direct reclaim context as you'd expect without the patch.
:
: Page writes by reclaim 3932314.000 0.000
: Page writes file 19 0
: Page writes anon 3932295 0
: Page reclaim immediate 42336 0
:
: Writes from reclaim context is never good but the patch eliminates it.
:
: We should never have default behaviour to thrash the system for such a
: basic workload. If zone reclaim mode behaviour is ever desired but on a
: single task instead of a global basis then the sensible option is to build
: a mempolicy that enforces that behaviour.
[mhocko(a)suse.com: rewrote the changelog based on the one from Andrea]
Link: http://lkml.kernel.org/r/20180925120326.24392-2-mhocko@kernel.org
Fixes: 5265047ac301 ("mm, thp: really limit transparent hugepage allocation to local node")
Signed-off-by: Andrea Arcangeli <aarcange(a)redhat.com>
Signed-off-by: Michal Hocko <mhocko(a)suse.com>
Reported-by: Stefan Priebe <s.priebe(a)profihost.ag>
Debugged-by: Andrea Arcangeli <aarcange(a)redhat.com>
Reported-by: Alex Williamson <alex.williamson(a)redhat.com>
Reviewed-by: Mel Gorman <mgorman(a)techsingularity.net>
Tested-by: Mel Gorman <mgorman(a)techsingularity.net>
Cc: Zi Yan <zi.yan(a)cs.rutgers.edu>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: David Rientjes <rientjes(a)google.com>
Cc: Stefan Priebe - Profihost AG <s.priebe(a)profihost.ag>
Cc: "Kirill A. Shutemov" <kirill(a)shutemov.name>
Cc: <stable(a)vger.kernel.org> [4.1+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/mempolicy.c | 32 ++++++++++++++++++++++++++++++--
1 file changed, 30 insertions(+), 2 deletions(-)
--- a/mm/mempolicy.c~mm-thp-relax-__gfp_thisnode-for-madv_hugepage-mappings
+++ a/mm/mempolicy.c
@@ -2046,8 +2046,36 @@ alloc_pages_vma(gfp_t gfp, int order, st
nmask = policy_nodemask(gfp, pol);
if (!nmask || node_isset(hpage_node, *nmask)) {
mpol_cond_put(pol);
- page = __alloc_pages_node(hpage_node,
- gfp | __GFP_THISNODE, order);
+ /*
+ * We cannot invoke reclaim if __GFP_THISNODE
+ * is set. Invoking reclaim with
+ * __GFP_THISNODE set, would cause THP
+ * allocations to trigger heavy swapping
+ * despite there may be tons of free memory
+ * (including potentially plenty of THP
+ * already available in the buddy) on all the
+ * other NUMA nodes.
+ *
+ * At most we could invoke compaction when
+ * __GFP_THISNODE is set (but we would need to
+ * refrain from invoking reclaim even if
+ * compaction returned COMPACT_SKIPPED because
+ * there wasn't not enough memory to succeed
+ * compaction). For now just avoid
+ * __GFP_THISNODE instead of limiting the
+ * allocation path to a strict and single
+ * compaction invocation.
+ *
+ * Supposedly if direct reclaim was enabled by
+ * the caller, the app prefers THP regardless
+ * of the node it comes from so this would be
+ * more desiderable behavior than only
+ * providing THP originated from the local
+ * node in such case.
+ */
+ if (!(gfp & __GFP_DIRECT_RECLAIM))
+ gfp |= __GFP_THISNODE;
+ page = __alloc_pages_node(hpage_node, gfp, order);
goto out;
}
}
_
Patches currently in -mm which might be from aarcange(a)redhat.com are
mm-thp-relax-__gfp_thisnode-for-madv_hugepage-mappings.patch
userfaultfd-allow-get_mempolicympol_f_nodempol_f_addr-to-trigger-userfaults.patch
This is the start of the stable review cycle for the 4.4.158 release.
There are 70 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Sep 26 11:30:25 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.158-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.158-rc1
Paul Burton <paul.burton(a)imgtec.com>
MIPS: VDSO: Drop gic_get_usm_range() usage
Paul Burton <paul.burton(a)mips.com>
MIPS: VDSO: Match data page cache colouring when D$ aliases
David Rivshin <drivshin(a)allworx.com>
drivers: net: cpsw: fix segfault in case of bad phy-handle
Dan Carpenter <dan.carpenter(a)oracle.com>
mei: bus: type promotion bug in mei_nfc_if_version()
Johan Hovold <johan(a)kernel.org>
USB: serial: ti_usb_3410_5052: fix array underflow in completion handler
Douglas Anderson <dianders(a)chromium.org>
pinctrl: qcom: spmi-gpio: Fix pmic_gpio_config_get() to be compliant
Bart Van Assche <bart.vanassche(a)wdc.com>
IB/nes: Fix a compiler warning
Dan Carpenter <dan.carpenter(a)oracle.com>
drm/panel: type promotion bug in s6e8aa0_read_mtp_id()
John Stultz <john.stultz(a)linaro.org>
selftest: timers: Tweak raw_skew to SKIP when ADJ_OFFSET/other clock adjustments are in progress
Timo Wischer <twischer(a)de.adit-jv.com>
ALSA: pcm: Fix snd_interval_refine first/last with open min/max
Zhouyang Jia <jiazhouyang09(a)gmail.com>
rtc: bq4802: add error handling for devm_ioremap
Wei Lu <wei.lu2(a)amd.com>
drm/amdkfd: Fix error codes in kfd_get_process
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
gpiolib: Mark gpio_suffixes array with __maybe_unused
Robin Murphy <robin.murphy(a)arm.com>
coresight: tpiu: Fix disabling timeouts
Suzuki K Poulose <suzuki.poulose(a)arm.com>
coresight: Handle errors in finding input/output ports
Julia Lawall <Julia.Lawall(a)lip6.fr>
parport: sunbpp: fix error return code
Thierry Reding <treding(a)nvidia.com>
drm/nouveau: tegra: Detach from ARM DMA/IOMMU mapping
Nicholas Mc Guire <hofrat(a)osadl.org>
ARM: hisi: check of_iomap and fix missing of_node_put
Nicholas Mc Guire <hofrat(a)osadl.org>
ARM: hisi: fix error handling and missing of_node_put
Nicholas Mc Guire <hofrat(a)osadl.org>
ARM: hisi: handle of_iomap and fix missing of_node_put
Paul Burton <paul.burton(a)mips.com>
MIPS: loongson64: cs5536: Fix PCI_OHCI_INT_REG reads
Jann Horn <jannh(a)google.com>
mtdchar: fix overflows in adjustment of `count`
Ronny Chevalier <ronny.chevalier(a)hp.com>
audit: fix use-after-free in audit_add_watch
Maciej W. Rozycki <macro(a)mips.com>
binfmt_elf: Respect error return from `regset->active'
Dan Carpenter <dan.carpenter(a)oracle.com>
CIFS: fix wrapping bugs in num_entries()
Dan Carpenter <dan.carpenter(a)oracle.com>
cifs: prevent integer overflow in nxt_dir_entry()
Jia-Ju Bai <baijiaju1990(a)gmail.com>
usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()
Ben Hutchings <ben.hutchings(a)codethink.co.uk>
USB: yurex: Fix buffer over-read in yurex_write()
Jia-Ju Bai <baijiaju1990(a)gmail.com>
usb: misc: uss720: Fix two sleep-in-atomic-context bugs
Johan Hovold <johan(a)kernel.org>
USB: serial: io_ti: fix array underflow in completion handler
Alan Stern <stern(a)rowland.harvard.edu>
USB: net2280: Fix erroneous synchronization change
Maxence Duprès <xpros64(a)hotmail.fr>
USB: add quirk for WORLDE Controller KS49 or Prodipe MIDI 49C USB controller
Jia-Ju Bai <baijiaju1990(a)gmail.com>
usb: host: u132-hcd: Fix a sleep-in-atomic-context bug in u132_get_frame()
Mathias Nyman <mathias.nyman(a)linux.intel.com>
usb: Avoid use-after-free by flushing endpoints early in usb_set_interface()
Tim Anderson <tsa(a)biglakesoftware.com>
USB: Add quirk to support DJI CineSSD
Mathias Nyman <mathias.nyman(a)linux.intel.com>
usb: Don't die twice if PCI xhci host is not responding in resume
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
misc: hmc6352: fix potential Spectre v1
K. Y. Srinivasan <kys(a)microsoft.com>
Tools: hv: Fix a bug in the key delete code
Aaron Knister <aaron.s.knister(a)nasa.gov>
IB/ipoib: Avoid a race condition between start_xmit and cm_rep_handler
Juergen Gross <jgross(a)suse.com>
xen/netfront: fix waiting for xenbus state change
Bin Yang <bin.yang(a)intel.com>
pstore: Fix incorrect persistent ram buffer mapping
Parav Pandit <parav(a)mellanox.com>
RDMA/cma: Protect cma dev list with lock
Xiao Liang <xiliang(a)redhat.com>
xen-netfront: fix warn message as irq device name has '/'
Michael Müller <michael(a)fds-team.de>
crypto: sharah - Unregister correct algorithms for SAHARA 3
Randy Dunlap <rdunlap(a)infradead.org>
platform/x86: toshiba_acpi: Fix defined but not used build warnings
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qeth: reset layer2 attribute on layer switch
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qeth: fix race in used-buffer accounting
Loic Poulain <loic.poulain(a)linaro.org>
arm64: dts: qcom: db410c: Fix Bluetooth LED trigger
Vitaly Kuznetsov <vkuznets(a)redhat.com>
xen-netfront: fix queue name setting
Manikanta Pubbisetty <mpubbise(a)codeaurora.org>
mac80211: restrict delayed tailroom needed decrement
Paul Cercueil <paul(a)crapouillou.net>
MIPS: jz4740: Bump zload address
Nicholas Piggin <npiggin(a)gmail.com>
powerpc/powernv: opal_put_chars partial write fix
Sandipan Das <sandipan(a)linux.ibm.com>
perf powerpc: Fix callchain ip filtering
Krzysztof Kozlowski <krzk(a)kernel.org>
ARM: exynos: Clear global variable on init error path
Fredrik Noring <noring(a)nocrew.org>
fbdev: Distinguish between interlaced and progressive modes
Sandipan Das <sandipan(a)linux.ibm.com>
perf powerpc: Fix callchain ip filtering when return address is in a register
Randy Dunlap <rdunlap(a)infradead.org>
fbdev/via: fix defined but not used warning
Anton Vasilyev <vasilyev(a)ispras.ru>
video: goldfishfb: fix memory leak on driver remove
Dan Carpenter <dan.carpenter(a)oracle.com>
fbdev: omapfb: off by one in omapfb_register_client()
Randy Dunlap <rdunlap(a)infradead.org>
mtd/maps: fix solutionengine.c printk format warnings
Hans Verkuil <hverkuil(a)xs4all.nl>
media: videobuf2-core: check for q->error in vb2_core_qbuf()
Felix Fietkau <nbd(a)nbd.name>
MIPS: ath79: fix system restart
John Keeping <john(a)metanate.com>
dmaengine: pl330: fix irq race with terminate_all
Masahiro Yamada <yamada.masahiro(a)socionext.com>
kbuild: add .DELETE_ON_ERROR special target
Nicholas Mc Guire <hofrat(a)osadl.org>
clk: imx6ul: fix missing of_node_put()
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Special-case rindex for gfs2_grow
YueHaibing <yuehaibing(a)huawei.com>
xfrm: fix 'passing zero to ERR_PTR()' warning
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Fix multiple definitions in AU0828_DEVICE() macro
Takashi Iwai <tiwai(a)suse.de>
ALSA: msnd: Fix the default sample sizes
Miao Zhong <zhongmiao(a)hisilicon.com>
iommu/arm-smmu-v3: sync the OVACKFLG to PRIQ consumer register
-------------
Diffstat:
Makefile | 4 +--
arch/arm/mach-exynos/suspend.c | 1 +
arch/arm/mach-hisi/hotplug.c | 41 ++++++++++++++--------
arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 2 +-
arch/mips/ath79/setup.c | 1 +
arch/mips/include/asm/mach-ath79/ath79.h | 1 +
arch/mips/jz4740/Platform | 2 +-
arch/mips/kernel/vdso.c | 35 ++++++++++++------
arch/mips/loongson64/common/cs5536/cs5536_ohci.c | 2 +-
arch/powerpc/platforms/powernv/opal.c | 2 +-
drivers/clk/imx/clk-imx6ul.c | 1 +
drivers/crypto/sahara.c | 4 +--
drivers/dma/pl330.c | 5 +--
drivers/gpio/gpiolib.h | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_process.c | 2 ++
drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c | 13 +++++++
drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c | 2 +-
drivers/hwtracing/coresight/coresight-tpiu.c | 7 ++--
drivers/hwtracing/coresight/coresight.c | 7 ++--
drivers/infiniband/core/cma.c | 12 ++++---
drivers/infiniband/hw/nes/nes.h | 2 +-
drivers/infiniband/ulp/ipoib/ipoib_cm.c | 2 ++
drivers/iommu/arm-smmu-v3.c | 1 +
drivers/media/v4l2-core/videobuf2-core.c | 5 +++
drivers/misc/hmc6352.c | 2 ++
drivers/misc/mei/bus-fixup.c | 2 +-
drivers/mtd/maps/solutionengine.c | 6 ++--
drivers/mtd/mtdchar.c | 10 ++++--
drivers/net/ethernet/ti/cpsw.c | 37 +++++++++++--------
drivers/net/xen-netfront.c | 30 ++++++++--------
drivers/parport/parport_sunbpp.c | 8 +++--
drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 32 ++++++++++++-----
drivers/platform/x86/toshiba_acpi.c | 3 +-
drivers/rtc/rtc-bq4802.c | 4 +++
drivers/s390/net/qeth_core_main.c | 3 +-
drivers/s390/net/qeth_core_sys.c | 1 +
drivers/usb/class/cdc-wdm.c | 2 +-
drivers/usb/core/hcd-pci.c | 2 --
drivers/usb/core/message.c | 11 ++++++
drivers/usb/core/quirks.c | 7 ++++
drivers/usb/gadget/udc/net2280.c | 16 +++++++--
drivers/usb/host/u132-hcd.c | 2 +-
drivers/usb/misc/uss720.c | 4 +--
drivers/usb/misc/yurex.c | 5 +--
drivers/usb/serial/io_ti.h | 2 +-
drivers/usb/serial/ti_usb_3410_5052.h | 2 +-
drivers/usb/storage/scsiglue.c | 9 +++++
drivers/usb/storage/unusual_devs.h | 7 ++++
drivers/video/fbdev/core/modedb.c | 41 ++++++++++++++++------
drivers/video/fbdev/goldfishfb.c | 1 +
drivers/video/fbdev/omap/omapfb_main.c | 2 +-
drivers/video/fbdev/via/viafbdev.c | 3 +-
fs/binfmt_elf.c | 2 +-
fs/cifs/readdir.c | 11 ++++--
fs/cifs/smb2pdu.c | 25 +++++++------
fs/gfs2/bmap.c | 2 +-
fs/pstore/ram_core.c | 17 +++++++--
kernel/audit_watch.c | 12 ++++++-
net/mac80211/cfg.c | 2 +-
net/mac80211/key.c | 24 ++++++++-----
net/xfrm/xfrm_policy.c | 5 ++-
scripts/Kbuild.include | 3 ++
sound/core/pcm_lib.c | 14 +++++---
sound/isa/msnd/msnd_pinnacle.c | 4 +--
sound/usb/quirks-table.h | 3 +-
tools/hv/hv_kvp_daemon.c | 2 +-
tools/perf/arch/powerpc/util/skip-callchain-idx.c | 10 ++++--
tools/testing/selftests/timers/raw_skew.c | 5 +++
68 files changed, 389 insertions(+), 162 deletions(-)
Hi Srini,
On 09/25/2018 03:29 AM, Srinivas Kandagatla wrote:
> Hi Suman,
>
> On 25/09/18 01:25, Suman Anna wrote:
>> Hi Srinivas,
>>
>> On 06/15/2018 04:59 AM, Srinivas Kandagatla wrote:
>>> Some of the rpmsg devices need to switch on power domains to communicate
>>> with remote processor. For example on Qualcomm DB820c platform LPASS
>>> power domain needs to switched on for any kind of audio services.
>>> This patch adds the missing power domain support in rpmsg core.
>>>
>>> Without this patch attempting to play audio via QDSP on DB820c would
>>> reboot the system.
>>>
>>> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
>>> ---
>>> drivers/rpmsg/rpmsg_core.c | 7 +++++++
>>> 1 file changed, 7 insertions(+)
>>>
>>> diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
>>> index b714a543a91d..8122807db380 100644
>>> --- a/drivers/rpmsg/rpmsg_core.c
>>> +++ b/drivers/rpmsg/rpmsg_core.c
>>> @@ -15,6 +15,7 @@
>>> #include <linux/module.h>
>>> #include <linux/rpmsg.h>
>>> #include <linux/of_device.h>
>>> +#include <linux/pm_domain.h>
>>> #include <linux/slab.h>
>>> #include "rpmsg_internal.h"
>>> @@ -449,6 +450,10 @@ static int rpmsg_dev_probe(struct device *dev)
>>> struct rpmsg_endpoint *ept = NULL;
>>> int err;
>>> + err = dev_pm_domain_attach(dev, true);
>>> + if (err)
>>> + goto out;
>>
>> This patch has broken the virtio-rpmsg stack based rpmsg devices. These
>> devices are non-DT and the rpmsg_dev_probe() is now failing with -19
>> (-ENODEV) error code.
>>
>
> There seems to be some dependency on this patch (
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
> ) which seems to rework the return values from acpi_dev_pm_attach() and
> genpd_dev_pm_attach()
>
OK, I see that dependent commit is part of the 4.18 Linux kernel. So
mainline kernel has no issues, but this patch was picked up in 4.14.71
(don't know why) as commit 1ed3a9307230, so 4.14 stable is broken. So,
how do we proceed here - don't think we can pick all those dependent
patches against stable.
regards
Suman
>
>
> --srini
>
>
>> Loic, Arnaud,
>> Can one of you double-confirm this behavior on ST platforms as well?
>> The patch came through 4.14.71 stable release and broke our downstream
>> kernels.
>>
>> regards
>> Suman
>>
>>> +
>>> if (rpdrv->callback) {
>>> strncpy(chinfo.name, rpdev->id.name, RPMSG_NAME_SIZE);
>>> chinfo.src = rpdev->src;
>>> @@ -490,6 +495,8 @@ static int rpmsg_dev_remove(struct device *dev)
>>> rpdrv->remove(rpdev);
>>> + dev_pm_domain_detach(dev, true);
>>> +
>>> if (rpdev->ept)
>>> rpmsg_destroy_ept(rpdev->ept);
>>>
>>
The trigger for the series is this bug report:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1788432
Changelog:
v1 -> v2:
* improve on commit messages, add cc:stable
RFC -> v1:
* do mutual exclusion on a per device basis in ccw_io_helper()
Halil Pasic (2):
virtio/s390: avoid race on vcdev->config
virtio/s390: fix race in ccw_io_helper()
drivers/s390/virtio/virtio_ccw.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
--
2.16.4
Want editing for your photos? We can help you for this.
We can do cutting out and retouching for your ecommerce photos, jewelry
photos retouching,
portrait photos or wedding photos.
Turnaround time is fast
Send us one photo, we wil do testing for you.
Thanks,
Heather
Want editing for your photos? We can help you for this.
We can do cutting out and retouching for your ecommerce photos, jewelry
photos retouching,
portrait photos or wedding photos.
Turnaround time is fast
Send us one photo, we wil do testing for you.
Thanks,
Heather
This was supposed to be a mask of all known rings, but it is being used
by execbuffer to filter out invalid rings, and so is instead mapping high
unused values onto valid rings. Instead of a mask of all known rings,
we need it to be the mask of all possible rings.
Fixes: 549f7365820a ("drm/i915: Enable SandyBridge blitter ring")
Fixes: de1add360522 ("drm/i915: Decouple execbuf uAPI from internal implementation")
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com>
Cc: <stable(a)vger.kernel.org> # v4.6+
---
include/uapi/drm/i915_drm.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/uapi/drm/i915_drm.h b/include/uapi/drm/i915_drm.h
index adb9fed86ef7..65b0b84419f3 100644
--- a/include/uapi/drm/i915_drm.h
+++ b/include/uapi/drm/i915_drm.h
@@ -984,7 +984,7 @@ struct drm_i915_gem_execbuffer2 {
* struct drm_i915_gem_exec_fence *fences.
*/
__u64 cliprects_ptr;
-#define I915_EXEC_RING_MASK (7<<0)
+#define I915_EXEC_RING_MASK (0x3f)
#define I915_EXEC_DEFAULT (0<<0)
#define I915_EXEC_RENDER (1<<0)
#define I915_EXEC_BSD (2<<0)
--
2.19.0
Changes since v5 [1]:
* Move the percpu-ref kill function to be passed in via @pgmap (Christoph)
* Added Christoph's ack for patches 2 and 4
* Added Jérôme's Reviewed-by for patches 2-6
* Fix MEMORY_DEVICE_PRIVATE support (Jérôme)
[1]: https://lkml.org/lkml/2018/9/13/104
---
Hi Andrew,
Jérôme has reviewed the cleanups, thanks Jérôme. We still disagree on
the EXPORT_SYMBOL_GPL status of the core HMM implementation, but Logan,
Christoph and I continue to support marking all devm_memremap_pages()
derivatives EXPORT_SYMBOL_GPL.
HMM has been upstream for over a year, with no in-tree users it is clear
it was designed first and foremost for out of tree drivers. It takes
advantage of a facility Christoph and I spearheaded to support
persistent memory. It continues to see expanding use cases with no clear
end date when it will stop attracting features / revisions. It is not
suitable to export devm_memremap_pages() as a stable 3rd party driver
api.
devm_memremap_pages() is a facility that can create struct page entries
for any arbitrary range and give out-of-tree drivers the ability to
subvert core aspects of page management. It, and anything derived from
it (e.g. hmm, pcip2p, etc...), is a deep integration point into the core
kernel, and an EXPORT_SYMBOL_GPL() interface.
Commit 31c5bda3a656 "mm: fix exports that inadvertently make put_page()
EXPORT_SYMBOL_GPL" was merged ahead of this series to relieve some of
the pressure from innocent consumers of put_page(), but now we need this
series to address *producers* of device pages.
More details and justification in the changelogs. The 0day
infrastructure has reported success across 152 configs and this survives
the libnvdimm unit test suite. Aside from the controversial bits the
diffstat is compelling at:
7 files changed, 127 insertions(+), 321 deletions(-)
Note that the series has some minor collisions with Alex's recent series
to improve devm_memremap_pages() scalability [2]. So, whichever you take
first the other will need a minor rebase.
[2]: https://www.lkml.org/lkml/2018/9/11/10
---
Dan Williams (7):
mm, devm_memremap_pages: Mark devm_memremap_pages() EXPORT_SYMBOL_GPL
mm, devm_memremap_pages: Kill mapping "System RAM" support
mm, devm_memremap_pages: Fix shutdown handling
mm, devm_memremap_pages: Add MEMORY_DEVICE_PRIVATE support
mm, hmm: Use devm semantics for hmm_devmem_{add,remove}
mm, hmm: Replace hmm_devmem_pages_create() with devm_memremap_pages()
mm, hmm: Mark hmm_devmem_{add,add_resource} EXPORT_SYMBOL_GPL
drivers/dax/pmem.c | 14 --
drivers/nvdimm/pmem.c | 13 +-
include/linux/hmm.h | 4
include/linux/memremap.h | 2
kernel/memremap.c | 95 +++++++-----
mm/hmm.c | 303 +++++--------------------------------
tools/testing/nvdimm/test/iomap.c | 17 ++
7 files changed, 127 insertions(+), 321 deletions(-)
PageTransCompoundMap() returns true for hugetlbfs and THP
hugepages. This behaviour incorrectly leads to stage 2 faults for
unsupported hugepage sizes (e.g., 64K hugepage with 4K pages) to be
treated as THP faults.
Tighten the check to filter out hugetlbfs pages. This also leads to
consistently mapping all unsupported hugepage sizes as PTE level
entries at stage 2.
Signed-off-by: Punit Agrawal <punit.agrawal(a)arm.com>
Cc: Christoffer Dall <christoffer.dall(a)arm.com>
Cc: Marc Zyngier <marc.zyngier(a)arm.com>
Cc: Suzuki Poulose <suzuki.poulose(a)arm.com>
Cc: stable(a)vger.kernel.org # v4.13+
---
virt/kvm/arm/mmu.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
index 7e477b3cae5b..c23a1b323aad 100644
--- a/virt/kvm/arm/mmu.c
+++ b/virt/kvm/arm/mmu.c
@@ -1231,8 +1231,14 @@ static bool transparent_hugepage_adjust(kvm_pfn_t *pfnp, phys_addr_t *ipap)
{
kvm_pfn_t pfn = *pfnp;
gfn_t gfn = *ipap >> PAGE_SHIFT;
+ struct page *page = pfn_to_page(pfn);
- if (PageTransCompoundMap(pfn_to_page(pfn))) {
+ /*
+ * PageTransCompoungMap() returns true for THP and
+ * hugetlbfs. Make sure the adjustment is done only for THP
+ * pages.
+ */
+ if (!PageHuge(page) && PageTransCompoundMap(page)) {
unsigned long mask;
/*
* The address we faulted on is backed by a transparent huge
--
2.18.0
Hi James,
Here's a pair of fixes that need to go upstream asap, please:
(1) Revert an incorrect fix to the keyrings UAPI for a C++ reserved word
used as a struct member name. This change being reverted breaks
existing userspace code and is thus incorrect.
Further, *neither* name is consistent with the one in the keyutils
package public header.
(2) Fix the problem by using a union to make the name from keyutils
available in parallel and make the 'private' name unavailable in C++
with cpp-conditionals.
David
---
David Howells (1):
keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h
Lubomir Rintel (1):
Revert "uapi/linux/keyctl.h: don't use C++ reserved keyword as a struct member name"
include/uapi/linux/keyctl.h | 7 ++++++-
security/keys/dh.c | 2 +-
2 files changed, 7 insertions(+), 2 deletions(-)
From: Paul Mackerras <paulus(a)ozlabs.org>
[ Upstream commit 46dec40fb741f00f1864580130779aeeaf24fb3d ]
This fixes a bug which causes guest virtual addresses to get translated
to guest real addresses incorrectly when the guest is using the HPT MMU
and has more than 256GB of RAM, or more specifically has a HPT larger
than 2GB. This has showed up in testing as a failure of the host to
emulate doorbell instructions correctly on POWER9 for HPT guests with
more than 256GB of RAM.
The bug is that the HPTE index in kvmppc_mmu_book3s_64_hv_xlate()
is stored as an int, and in forming the HPTE address, the index gets
shifted left 4 bits as an int before being signed-extended to 64 bits.
The simple fix is to make the variable a long int, matching the
return type of kvmppc_hv_find_lock_hpte(), which is what calculates
the index.
Fixes: 697d3899dcb4 ("KVM: PPC: Implement MMIO emulation support for Book3S HV guests")
Signed-off-by: Paul Mackerras <paulus(a)ozlabs.org>
Signed-off-by: Sasha Levin <alexander.levin(a)microsoft.com>
---
arch/powerpc/kvm/book3s_64_mmu_hv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index d40770248b6a..191cc3eea0bf 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -449,7 +449,7 @@ static int kvmppc_mmu_book3s_64_hv_xlate(struct kvm_vcpu *vcpu, gva_t eaddr,
unsigned long pp, key;
unsigned long v, gr;
__be64 *hptep;
- int index;
+ long int index;
int virtmode = vcpu->arch.shregs.msr & (data ? MSR_DR : MSR_IR);
/* Get SLB entry */
--
2.17.1
From: Paul Mackerras <paulus(a)ozlabs.org>
[ Upstream commit 46dec40fb741f00f1864580130779aeeaf24fb3d ]
This fixes a bug which causes guest virtual addresses to get translated
to guest real addresses incorrectly when the guest is using the HPT MMU
and has more than 256GB of RAM, or more specifically has a HPT larger
than 2GB. This has showed up in testing as a failure of the host to
emulate doorbell instructions correctly on POWER9 for HPT guests with
more than 256GB of RAM.
The bug is that the HPTE index in kvmppc_mmu_book3s_64_hv_xlate()
is stored as an int, and in forming the HPTE address, the index gets
shifted left 4 bits as an int before being signed-extended to 64 bits.
The simple fix is to make the variable a long int, matching the
return type of kvmppc_hv_find_lock_hpte(), which is what calculates
the index.
Fixes: 697d3899dcb4 ("KVM: PPC: Implement MMIO emulation support for Book3S HV guests")
Signed-off-by: Paul Mackerras <paulus(a)ozlabs.org>
Signed-off-by: Sasha Levin <alexander.levin(a)microsoft.com>
---
arch/powerpc/kvm/book3s_64_mmu_hv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index fb37290a57b4..366965ae37bd 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -314,7 +314,7 @@ static int kvmppc_mmu_book3s_64_hv_xlate(struct kvm_vcpu *vcpu, gva_t eaddr,
unsigned long pp, key;
unsigned long v, gr;
__be64 *hptep;
- int index;
+ long int index;
int virtmode = vcpu->arch.shregs.msr & (data ? MSR_DR : MSR_IR);
/* Get SLB entry */
--
2.17.1
From: Toke Høiland-Jørgensen <toke(a)toke.dk>
[ Upstream commit 77cfaf52eca5cac30ed029507e0cab065f888995 ]
The TXQ teardown code can reference the vif data structures that are
stored in the netdev private memory area if there are still packets on
the queue when it is being freed. Since the TXQ teardown code is run
after the netdevs are freed, this can lead to a use-after-free. Fix this
by moving the TXQ teardown code to earlier in ieee80211_unregister_hw().
Reported-by: Ben Greear <greearb(a)candelatech.com>
Tested-by: Ben Greear <greearb(a)candelatech.com>
Signed-off-by: Toke Høiland-Jørgensen <toke(a)toke.dk>
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
Signed-off-by: Sasha Levin <alexander.levin(a)microsoft.com>
---
net/mac80211/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 2bb6899854d4..6389ce868668 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1164,6 +1164,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
#if IS_ENABLED(CONFIG_IPV6)
unregister_inet6addr_notifier(&local->ifa6_notifier);
#endif
+ ieee80211_txq_teardown_flows(local);
rtnl_lock();
@@ -1191,7 +1192,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
skb_queue_purge(&local->skb_queue);
skb_queue_purge(&local->skb_queue_unreliable);
skb_queue_purge(&local->skb_queue_tdls_chsw);
- ieee80211_txq_teardown_flows(local);
destroy_workqueue(local->workqueue);
wiphy_unregister(local->hw.wiphy);
--
2.17.1
From: Toke Høiland-Jørgensen <toke(a)toke.dk>
[ Upstream commit 77cfaf52eca5cac30ed029507e0cab065f888995 ]
The TXQ teardown code can reference the vif data structures that are
stored in the netdev private memory area if there are still packets on
the queue when it is being freed. Since the TXQ teardown code is run
after the netdevs are freed, this can lead to a use-after-free. Fix this
by moving the TXQ teardown code to earlier in ieee80211_unregister_hw().
Reported-by: Ben Greear <greearb(a)candelatech.com>
Tested-by: Ben Greear <greearb(a)candelatech.com>
Signed-off-by: Toke Høiland-Jørgensen <toke(a)toke.dk>
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
Signed-off-by: Sasha Levin <alexander.levin(a)microsoft.com>
---
net/mac80211/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 8aa1f5b6a051..cb5b22b61388 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1171,6 +1171,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
#if IS_ENABLED(CONFIG_IPV6)
unregister_inet6addr_notifier(&local->ifa6_notifier);
#endif
+ ieee80211_txq_teardown_flows(local);
rtnl_lock();
@@ -1199,7 +1200,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
skb_queue_purge(&local->skb_queue);
skb_queue_purge(&local->skb_queue_unreliable);
skb_queue_purge(&local->skb_queue_tdls_chsw);
- ieee80211_txq_teardown_flows(local);
destroy_workqueue(local->workqueue);
wiphy_unregister(local->hw.wiphy);
--
2.17.1
From: Toke Høiland-Jørgensen <toke(a)toke.dk>
[ Upstream commit 77cfaf52eca5cac30ed029507e0cab065f888995 ]
The TXQ teardown code can reference the vif data structures that are
stored in the netdev private memory area if there are still packets on
the queue when it is being freed. Since the TXQ teardown code is run
after the netdevs are freed, this can lead to a use-after-free. Fix this
by moving the TXQ teardown code to earlier in ieee80211_unregister_hw().
Reported-by: Ben Greear <greearb(a)candelatech.com>
Tested-by: Ben Greear <greearb(a)candelatech.com>
Signed-off-by: Toke Høiland-Jørgensen <toke(a)toke.dk>
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
Signed-off-by: Sasha Levin <alexander.levin(a)microsoft.com>
---
net/mac80211/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index fb73451ed85e..0358f20b675f 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1182,6 +1182,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
#if IS_ENABLED(CONFIG_IPV6)
unregister_inet6addr_notifier(&local->ifa6_notifier);
#endif
+ ieee80211_txq_teardown_flows(local);
rtnl_lock();
@@ -1210,7 +1211,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
skb_queue_purge(&local->skb_queue);
skb_queue_purge(&local->skb_queue_unreliable);
skb_queue_purge(&local->skb_queue_tdls_chsw);
- ieee80211_txq_teardown_flows(local);
destroy_workqueue(local->workqueue);
wiphy_unregister(local->hw.wiphy);
--
2.17.1