January 2019 - Linux-stable-mirror

[PATCH v2 for-4.4-stable] s390/smp: Fix calling smp_call_ipl_cpu() from ipl CPU

by David Hildenbrand

commit 60f1bf29c0b2519989927cae640cd1f50f59dc7f upstream. When calling smp_call_ipl_cpu() from the IPL CPU, we will try to read from pcpu_devices->lowcore. However, due to prefixing, that will result in reading from absolute address 0 on that CPU. We have to go via the actual lowcore instead. This means that right now, we will read lc->nodat_stack == 0 and therfore work on a very wrong stack. This BUG essentially broke rebooting under QEMU TCG (which will report a low address protection exception). And checking under KVM, it is also broken under KVM. With 1 VCPU it can be easily triggered. :/# echo 1 > /proc/sys/kernel/sysrq :/# echo b > /proc/sysrq-trigger [ 28.476745] sysrq: SysRq : Resetting [ 28.476793] Kernel stack overflow. [ 28.476817] CPU: 0 PID: 424 Comm: sh Not tainted 5.0.0-rc1+ #13 [ 28.476820] Hardware name: IBM 2964 NE1 716 (KVM/Linux) [ 28.476826] Krnl PSW : 0400c00180000000 0000000000115c0c (pcpu_delegate+0x12c/0x140) [ 28.476861] R:0 T:1 IO:0 EX:0 Key:0 M:0 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3 [ 28.476863] Krnl GPRS: ffffffffffffffff 0000000000000000 000000000010dff8 0000000000000000 [ 28.476864] 0000000000000000 0000000000000000 0000000000ab7090 000003e0006efbf0 [ 28.476864] 000000000010dff8 0000000000000000 0000000000000000 0000000000000000 [ 28.476865] 000000007fffc000 0000000000730408 000003e0006efc58 0000000000000000 [ 28.476887] Krnl Code: 0000000000115bfe: 4170f000 la %r7,0(%r15) [ 28.476887] 0000000000115c02: 41f0a000 la %r15,0(%r10) [ 28.476887] #0000000000115c06: e370f0980024 stg %r7,152(%r15) [ 28.476887] >0000000000115c0c: c0e5fffff86e brasl %r14,114ce8 [ 28.476887] 0000000000115c12: 41f07000 la %r15,0(%r7) [ 28.476887] 0000000000115c16: a7f4ffa8 brc 15,115b66 [ 28.476887] 0000000000115c1a: 0707 bcr 0,%r7 [ 28.476887] 0000000000115c1c: 0707 bcr 0,%r7 [ 28.476901] Call Trace: [ 28.476902] Last Breaking-Event-Address: [ 28.476920] [<0000000000a01c4a>] arch_call_rest_init+0x22/0x80 [ 28.476927] Kernel panic - not syncing: Corrupt kernel stack, can't continue. [ 28.476930] CPU: 0 PID: 424 Comm: sh Not tainted 5.0.0-rc1+ #13 [ 28.476932] Hardware name: IBM 2964 NE1 716 (KVM/Linux) [ 28.476932] Call Trace: Fixes: 2f859d0dad81 ("s390/smp: reduce size of struct pcpu") Cc: stable(a)vger.kernel.org # 4.0+ Reported-by: Cornelia Huck <cohuck(a)redhat.com> Signed-off-by: David Hildenbrand <david(a)redhat.com> Signed-off-by: Martin Schwidefsky <schwidefsky(a)de.ibm.com> --- arch/s390/kernel/smp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c index 77f4f334a465..f5bfd9d95da1 100644 --- a/arch/s390/kernel/smp.c +++ b/arch/s390/kernel/smp.c @@ -360,9 +360,13 @@ void smp_call_online_cpu(void (*func)(void *), void *data) */ void smp_call_ipl_cpu(void (*func)(void *), void *data) { + struct _lowcore *lc = pcpu_devices->lowcore; + + if (pcpu_devices[0].address == stap()) + lc = &S390_lowcore; + pcpu_delegate(&pcpu_devices[0], func, data, - pcpu_devices->lowcore->panic_stack - - PANIC_FRAME_OFFSET + PAGE_SIZE); + lc->panic_stack - PANIC_FRAME_OFFSET + PAGE_SIZE); } int smp_find_processor_id(u16 address) -- 2.17.2

5 years, 4 months

2
1
0 0

[PATCH 4.20 000/117] 4.20.6-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.20.6 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu Jan 31 11:31:34 UTC 2019. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.20.6-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.20.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.20.6-rc1 Christoph Hellwig <hch(a)lst.de> ide: fix a typo in the settings proc file name Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com> mt76x0: phy: unify calibration between mt76x0u and mt76x0e Stanislaw Gruszka <sgruszka(a)redhat.com> mt76x0: antenna select corrections Stanislaw Gruszka <sgruszka(a)redhat.com> mt76x0: do not perform MCU calibration for MT7630 Stanislaw Gruszka <sgruszka(a)redhat.com> mt76x02: assure we update gain after scan Stanislaw Gruszka <sgruszka(a)redhat.com> mt76x02: run calibration after scanning Stanislaw Gruszka <sgruszka(a)redhat.com> mt76x0: use band parameter for LC calibration Stanislaw Gruszka <sgruszka(a)redhat.com> mt76x0: do not overwrite other MT_BBP(AGC, 8) fields Jack Pham <jackp(a)codeaurora.org> usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup Michal Hocko <mhocko(a)suse.com> Revert "mm, memory_hotplug: initialize struct pages for the full memory section" Dexuan Cui <decui(a)microsoft.com> vmbus: fix subchannel removal Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Remove the useless API vmbus_get_outgoing_channel() Daniel Borkmann <daniel(a)iogearbox.net> bpf: fix inner map masking to prevent oob under speculation Daniel Borkmann <daniel(a)iogearbox.net> bpf: fix sanitation of alu op with pointer / scalar type from different paths Daniel Borkmann <daniel(a)iogearbox.net> bpf: prevent out of bounds speculation on pointer arithmetic Daniel Borkmann <daniel(a)iogearbox.net> bpf: fix check_map_access smin_value test when pointer contains offset Daniel Borkmann <daniel(a)iogearbox.net> bpf: restrict unknown scalars of mixed signed bounds for unprivileged Daniel Borkmann <daniel(a)iogearbox.net> bpf: restrict stack pointer arithmetic for unprivileged Daniel Borkmann <daniel(a)iogearbox.net> bpf: restrict map value pointer arithmetic for unprivileged Daniel Borkmann <daniel(a)iogearbox.net> bpf: enable access to ax register also from verifier rewrite Raju Rangoju <rajur(a)chelsio.com> nvmet-rdma: fix null dereference under heavy load Israel Rukshin <israelr(a)mellanox.com> nvmet-rdma: Add unlikely for response allocated check Daniel Borkmann <daniel(a)iogearbox.net> bpf: move tmp variable into ax register in interpreter Daniel Borkmann <daniel(a)iogearbox.net> bpf: move {prev_,}insn_idx into verifier env Neil Armstrong <narmstrong(a)baylibre.com> drm/meson: Fix atomic mode switching regression Nicolas Pitre <nicolas.pitre(a)linaro.org> vt: invoke notifier on screen size change Nicolas Pitre <nicolas.pitre(a)linaro.org> vt: always call notifier with the console lock held Nicolas Pitre <nicolas.pitre(a)linaro.org> vt: make vt_console_print() compatible with the unicode screen buffer Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> can: flexcan: fix NULL pointer exception during bringup Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: check timer values before ktime conversion Manfred Schlaegl <manfred.schlaegl(a)ginzinger.com> can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by removing it Marc Zyngier <marc.zyngier(a)arm.com> irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size Thomas Gleixner <tglx(a)linutronix.de> net: sun: cassini: Cleanup license conflict Thomas Gleixner <tglx(a)linutronix.de> posix-cpu-timers: Unbreak timer rearming Jan Beulich <JBeulich(a)suse.com> x86/entry/64/compat: Fix stack switching for XEN PV Daniel Drake <drake(a)endlessm.com> x86/kaslr: Fix incorrect i8254 outb() parameters Dave Hansen <dave.hansen(a)linux.intel.com> x86/selftests/pkeys: Fork() to check for state being preserved Dave Hansen <dave.hansen(a)linux.intel.com> x86/pkeys: Properly copy pkey state at fork() Tom Roeder <tmroeder(a)google.com> kvm: x86/vmx: Use kzalloc for cached_vmcs12 Sean Christopherson <sean.j.christopherson(a)intel.com> KVM: x86: WARN_ONCE if sending a PV IPI returns a fatal error Sean Christopherson <sean.j.christopherson(a)intel.com> KVM: x86: Fix PV IPIs for 32-bit KVM host Alexander Popov <alex.popov(a)linux.com> KVM: x86: Fix single-step debugging Thor Thayer <thor.thayer(a)linux.intel.com> EDAC, altera: Fix S10 persistent register offset Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: Add APTX quirk for Lenovo laptop Milan Broz <gmazyland(a)gmail.com> dm crypt: fix parsing of extended IV arguments Joe Thornber <ejt(a)redhat.com> dm thin: fix passdown_double_checking_shared_status() Marc Gonzalez <marc.w.gonzalez(a)free.fr> scsi: ufs: Use explicit access size in ufshcd_dump_regs Dan Williams <dan.j.williams(a)intel.com> acpi/nfit: Fix command-supported detection Dan Williams <dan.j.williams(a)intel.com> acpi/nfit: Block function zero DSMs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: uinput - fix undefined behavior in uinput_validate_absinfo() Deepa Dinamani <deepa.kernel(a)gmail.com> Input: input_event - provide override for sparc64 Tom Panfil <tom(a)steelseries.com> Input: xpad - add support for SteelSeries Stratus Duo Ronnie Sahlberg <lsahlber(a)redhat.com> smb3: add credits we receive from oplock/break PDUs Pavel Shilovsky <pshilov(a)microsoft.com> CIFS: Do not reconnect TCP session in add_credits() Pavel Shilovsky <pshilov(a)microsoft.com> CIFS: Fix credit calculation for encrypted reads with errors Pavel Shilovsky <pshilov(a)microsoft.com> CIFS: Fix credits calculations for reads with errors Pavel Shilovsky <pshilov(a)microsoft.com> CIFS: Fix possible hang during async MTU reads and writes Nicolas Pitre <nicolas.pitre(a)linaro.org> vgacon: unconfuse vc_origin when using soft scrollback Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Check for ring when getting debug info Vitaly Kuznetsov <vkuznets(a)redhat.com> hv_balloon: avoid touching uninitialized struct page during tail onlining Paul Fulghum <paulkf(a)microgate.com> tty/n_hdlc: fix __might_sleep warning Samir Virmani <samir(a)embedur.com> uart: Fix crash in uart_write and uart_put_char Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> tty: Handle problem if line discipline does not have receive_buf Michael Straube <straube.linux(a)gmail.com> staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1 Remi Pommarel <repk(a)triplefau.lt> mmc: meson-gx: Free irq in release() callback Liming Sun <lsun(a)mellanox.com> mmc: dw_mmc-bluefield: : Fix the license information Stefan Wahren <stefan.wahren(a)i2se.com> mmc: sdhci-iproc: handle mmc_of_parse() errors during probe Gustavo A. R. Silva <gustavo(a)embeddedor.com> char/mwave: fix potential Spectre v1 vulnerability Gustavo A. R. Silva <gustavo(a)embeddedor.com> misc: ibmvsm: Fix potential NULL pointer dereference David Hildenbrand <david(a)redhat.com> s390/smp: Fix calling smp_call_ipl_cpu() from ipl CPU Gerald Schaefer <gerald.schaefer(a)de.ibm.com> s390/smp: fix CPU hotplug deadlock with CPU rescan Christian Borntraeger <borntraeger(a)de.ibm.com> s390/early: improve machine detection Martin Schwidefsky <schwidefsky(a)de.ibm.com> s390/mm: always force a load of the primary ASCE on context switch Vasily Gorbik <gor(a)linux.ibm.com> s390/vdso: correct vdso mapping for compat tasks Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com> ARC: perf: map generic branches to correct hardware condition Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com> ARC: adjust memblock_reserve of kernel memory Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com> ARCv2: lib: memeset: fix doing prefetchw outside of buffer Anthony Wong <anthony.wong(a)canonical.com> ALSA: hda - Add mute LED support for HP ProBook 470 G5 Kailang Yang <kailang(a)realtek.com> ALSA: hda/realtek - Fix typo for ALC225 model Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> inotify: Fix fd refcount leak in inotify_add_watch(). Dinh Nguyen <dinguyen(a)kernel.org> clk: socfpga: stratix10: fix naming convention for the fixed-clocks Dinh Nguyen <dinguyen(a)kernel.org> clk: socfpga: stratix10: fix rate calculation for pll clocks Gustavo A. R. Silva <gustavo(a)embeddedor.com> clk: zynqmp: Fix memory allocation in zynqmp_clk_setup b-ak <anur.bhargav(a)gmail.com> ASoC: tlv320aic32x4: Kernel OOPS while entering DAPM standby mode Gustavo A. R. Silva <gustavo(a)embeddedor.com> ASoC: rt5514-spi: Fix potential NULL pointer dereference Kangjie Lu <kjlu(a)umn.edu> ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages Yan, Zheng <zyan(a)redhat.com> ceph: clear inode pointer when snap realm gets dropped by its inode Charles Yeh <charlesyeh522(a)gmail.com> USB: serial: pl2303: add new PID to support PL2303TB Max Schulze <max.schulze(a)posteo.de> USB: serial: simple: add Motorola Tetra TPG2200 device id Karoly Pados <pados(a)pados.hu> USB: serial: ftdi_sio: fix GPIO not working in autosuspend Lubomir Rintel <lkundrak(a)v3.sk> USB: EHCI: ehci-mv: add MODULE_DEVICE_TABLE Christian Lamparter <chunkeey(a)gmail.com> USB: leds: fix regression in usbport led trigger Tomas Winkler <tomas.winkler(a)intel.com> mei: me: add denverton innovation engine device IDs Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: mark LBG devices as having dma support Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Address Kerberos performance/behavior regression Russell King <rmk+kernel(a)armlinux.org.uk> ARM: fix the cockup in the previous patch Willem de Bruijn <willemb(a)google.com> tcp: allow MSG_ZEROCOPY transmission also in CLOSE_WAIT state Hangbin Liu <liuhangbin(a)gmail.com> ip6_gre: update version related info when changing link Andrew Lunn <andrew(a)lunn.ch> net: phy: marvell: Fix deadlock from wrong locking Xin Long <lucien.xin(a)gmail.com> erspan: build the header with the right proto according to erspan_ver Olivier Matz <olivier.matz(a)6wind.com> ip6_gre: fix tunnel list corruption for x-netns Willem de Bruijn <willemb(a)google.com> udp: with udp_segment release on error path Ivan Vecera <ivecera(a)redhat.com> net/sched: cls_flower: allocate mask dynamically in fl_change() Ido Schimmel <idosch(a)mellanox.com> mlxsw: pci: Ring CQ's doorbell before RDQ's Nir Dotan <nird(a)mellanox.com> mlxsw: spectrum_fid: Update dummy FID index Ido Schimmel <idosch(a)mellanox.com> net: ipv4: Fix memory leak in network namespace dismantle Nir Dotan <nird(a)mellanox.com> mlxsw: pci: Increase PCI SW reset timeout Jason Wang <jasowang(a)redhat.com> vhost: log dirty page correctly Ross Lagerwall <ross.lagerwall(a)citrix.com> openvswitch: Avoid OOB read when parsing flow nlattrs Cong Wang <xiyou.wangcong(a)gmail.com> net_sched: refetch skb protocol for each filter Davide Caratti <dcaratti(a)redhat.com> net/sched: act_tunnel_key: fix memory leak in case of action replace Camelia Groza <camelia.groza(a)nxp.com> net: phy: phy driver features are mandatory Thomas Petazzoni <thomas.petazzoni(a)bootlin.com> net: phy: mdio_bus: add missing device_del() in mdiobus_register() error handling Andrew Lunn <andrew(a)lunn.ch> net: phy: marvell: Errata for mv88e6390 internal PHYs Ross Lagerwall <ross.lagerwall(a)citrix.com> net: Fix usage of pskb_trim_rcsum Yunjian Wang <wangyunjian(a)huawei.com> net: bridge: Fix ethernet header pointer before check skb forwardable Lendacky, Thomas <Thomas.Lendacky(a)amd.com> amd-xgbe: Fix mdio access for non-zero ports and clause 45 PHYs ------------- Diffstat: Makefile | 4 +- arch/arc/include/asm/perf_event.h | 3 +- arch/arc/lib/memset-archs.S | 40 ++- arch/arc/mm/init.c | 3 +- arch/arm/mm/proc-macros.S | 4 +- arch/s390/include/asm/mmu_context.h | 7 +- arch/s390/kernel/early.c | 4 +- arch/s390/kernel/setup.c | 2 + arch/s390/kernel/smp.c | 11 +- arch/s390/kernel/vdso.c | 5 +- arch/x86/entry/entry_64_compat.S | 6 +- arch/x86/include/asm/mmu_context.h | 18 + arch/x86/kernel/kvm.c | 7 +- arch/x86/kvm/vmx.c | 12 +- arch/x86/kvm/x86.c | 5 +- arch/x86/lib/kaslr.c | 4 +- drivers/acpi/nfit/core.c | 61 +++- drivers/char/mwave/mwavedd.c | 7 + drivers/clk/socfpga/clk-pll-s10.c | 2 +- drivers/clk/socfpga/clk-s10.c | 20 +- drivers/clk/zynqmp/clkc.c | 4 +- drivers/edac/altera_edac.h | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 1 + drivers/gpu/drm/meson/meson_crtc.c | 23 +- drivers/gpu/drm/meson/meson_drv.c | 5 + drivers/hv/channel.c | 10 +- drivers/hv/channel_mgmt.c | 44 --- drivers/hv/hv_balloon.c | 10 +- drivers/hv/ring_buffer.c | 31 +- drivers/hv/vmbus_drv.c | 91 +++-- drivers/ide/ide-proc.c | 2 +- drivers/input/joystick/xpad.c | 3 + drivers/input/misc/uinput.c | 5 +- drivers/irqchip/irq-gic-v3-its.c | 25 +- drivers/md/dm-crypt.c | 25 +- drivers/md/dm-thin-metadata.c | 4 +- drivers/md/dm-thin-metadata.h | 2 +- drivers/md/dm-thin.c | 10 +- drivers/misc/ibmvmc.c | 7 +- drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 4 +- drivers/mmc/host/dw_mmc-bluefield.c | 5 - drivers/mmc/host/meson-gx-mmc.c | 18 +- drivers/mmc/host/sdhci-iproc.c | 5 +- drivers/net/can/dev.c | 27 +- drivers/net/can/flexcan.c | 2 +- drivers/net/ethernet/amd/xgbe/xgbe-common.h | 2 - drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 22 +- drivers/net/ethernet/mellanox/mlxsw/pci.c | 12 +- drivers/net/ethernet/mellanox/mlxsw/pci_hw.h | 3 +- drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c | 4 +- drivers/net/ethernet/sun/cassini.c | 15 +- drivers/net/ethernet/sun/cassini.h | 15 +- drivers/net/phy/marvell.c | 37 ++- drivers/net/phy/mdio_bus.c | 1 + drivers/net/phy/phy_device.c | 5 + drivers/net/ppp/pppoe.c | 1 + drivers/net/wireless/mediatek/mt76/mt76.h | 1 + drivers/net/wireless/mediatek/mt76/mt76x0/main.c | 9 +- drivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h | 5 + drivers/net/wireless/mediatek/mt76/mt76x0/phy.c | 170 +++------- drivers/net/wireless/mediatek/mt76/mt76x0/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt76x02.h | 1 + .../net/wireless/mediatek/mt76/mt76x02_eeprom.h | 10 +- drivers/net/wireless/mediatek/mt76/mt76x02_phy.c | 1 + .../net/wireless/mediatek/mt76/mt76x2/usb_main.c | 3 + drivers/nvme/target/rdma.c | 17 +- drivers/s390/char/sclp_config.c | 2 + drivers/scsi/ufs/ufshcd.c | 10 +- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + drivers/tty/n_hdlc.c | 1 + drivers/tty/serial/serial_core.c | 12 +- drivers/tty/tty_io.c | 3 +- drivers/tty/vt/vt.c | 50 +-- drivers/usb/core/ledtrig-usbport.c | 17 +- drivers/usb/dwc3/gadget.c | 2 + drivers/usb/host/ehci-mv.c | 1 + drivers/usb/serial/ftdi_sio.c | 15 +- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 2 + drivers/usb/serial/usb-serial-simple.c | 3 +- drivers/vhost/net.c | 3 +- drivers/vhost/vhost.c | 97 +++++- drivers/vhost/vhost.h | 3 +- drivers/video/console/vgacon.c | 7 +- fs/ceph/caps.c | 2 + fs/cifs/cifssmb.c | 35 +- fs/cifs/connect.c | 21 ++ fs/cifs/smb2misc.c | 7 + fs/cifs/smb2ops.c | 62 ++-- fs/notify/inotify/inotify_user.c | 6 +- include/linux/bpf_verifier.h | 13 + include/linux/filter.h | 10 +- include/linux/hyperv.h | 22 +- include/linux/phy.h | 4 +- include/linux/skbuff.h | 1 + include/net/ip_fib.h | 2 +- include/uapi/linux/input.h | 6 +- kernel/bpf/core.c | 54 ++- kernel/bpf/map_in_map.c | 17 +- kernel/bpf/verifier.c | 369 +++++++++++++++++---- kernel/time/posix-cpu-timers.c | 1 + mm/page_alloc.c | 12 - net/bridge/br_forward.c | 9 +- net/bridge/br_netfilter_ipv6.c | 1 + net/bridge/netfilter/nft_reject_bridge.c | 1 + net/can/bcm.c | 27 ++ net/ipv4/fib_frontend.c | 4 +- net/ipv4/fib_trie.c | 15 +- net/ipv4/ip_gre.c | 23 +- net/ipv4/ip_input.c | 1 + net/ipv4/tcp.c | 2 +- net/ipv4/udp.c | 16 +- net/ipv6/ip6_gre.c | 14 +- net/ipv6/udp.c | 16 +- net/openvswitch/flow_netlink.c | 2 +- net/sched/act_tunnel_key.c | 19 +- net/sched/cls_api.c | 3 +- net/sched/cls_flower.c | 19 +- net/sunrpc/xprt.c | 2 +- sound/pci/hda/patch_conexant.c | 1 + sound/pci/hda/patch_realtek.c | 2 +- sound/soc/codecs/rt5514-spi.c | 2 + sound/soc/codecs/tlv320aic32x4.c | 4 + sound/soc/intel/atom/sst-mfld-platform-pcm.c | 8 +- tools/testing/selftests/x86/protection_keys.c | 41 ++- 126 files changed, 1326 insertions(+), 709 deletions(-)

5 years, 4 months

4
123
0 0

RE: [PATCH] nfit: acpi_nfit_ctl(): check out_obj->type in the right place

by Dexuan Cui

> From: Sasha Levin <sashal(a)kernel.org> > Sent: Wednesday, January 30, 2019 6:05 PM > To: Sasha Levin <sashal(a)kernel.org>; Dexuan Cui <decui(a)microsoft.com>; > Dan Williams <dan.j.williams(a)intel.com> > Cc: Josh Poulson <jopoulso(a)microsoft.com>; stable(a)vger.kernel.org; > stable(a)vger.kernel.org > Subject: Re: [PATCH] nfit: acpi_nfit_ctl(): check out_obj->type in the right place > > Hi, > > [This is an automated email] > > This commit has been processed because it contains a "Fixes:" tag, > fixing commit: 31eca76ba2fc nfit, libnvdimm: limited/whitelisted dimm > command marshaling mechanism. > > The bot has tested the following trees: v4.20.5, v4.19.18, v4.14.96, v4.9.153. > > v4.20.5: Build OK! > v4.19.18: Build OK! > v4.14.96: Failed to apply! Possible dependencies: > 06e8ccdab15f ("acpi: nfit: Add support for detect platform CPU cache > flush on power loss") > b37b3fd33d03 ("acpi nfit: Enable to show what feature is supported via > ND_CMD_CALL for nfit_test") > b814735f5ca4 ("acpi, nfit: remove redundant __func__ in dev_dbg") > > v4.9.153: Failed to apply! Possible dependencies: > 010426079ec1 ("sched/headers: Prepare for new header dependencies > before moving more code to <linux/sched/mm.h>") > 06e8ccdab15f ("acpi: nfit: Add support for detect platform CPU cache > flush on power loss") > 0b277961f448 ("libnvdimm, pmem: disable dax flushing when pmem is > fronting a volatile region") > 39bc88e5e38e ("arm64: Disable TTBR0_EL1 during normal kernel > execution") > 3f07c0144132 ("sched/headers: Prepare for new header dependencies > before moving code to <linux/sched/signal.h>") > 50d34394cee6 ("sched/headers: Prepare to remove the <linux/magic.h> > include from <linux/sched/task_stack.h>") > 68db0cf10678 ("sched/headers: Prepare for new header dependencies > before moving code to <linux/sched/task_stack.h>") > 7699a6a36b82 ("acpi, nfit: kill ACPI_NFIT_DEBUG") > 7b6be8444e0f ("dax: refactor dax-fs into a generic provider of 'struct > dax_device' instances") > 7c0f6ba682b9 ("Replace <asm/uaccess.h> with <linux/uaccess.h> > globally") > 9cf09d68b89a ("arm64: xen: Enable user access before a privcmd hvc > call") > b37b3fd33d03 ("acpi nfit: Enable to show what feature is supported via > ND_CMD_CALL for nfit_test") > b814735f5ca4 ("acpi, nfit: remove redundant __func__ in dev_dbg") > bd38967d406f ("arm64: Factor out PAN enabling/disabling into separate > uaccess_* macros") > c1d6e828a35d ("pmem: add dax_operations support") > caa603aae0cc ("acpi, nfit: collate health state flags") > > > How should we proceed with this patch? > > -- > Thanks, > Sasha It's a small pach and I can quickly rebase it to v4.14.96 and v4.9.153 once it goes into Linus's tree. Thanks, -- Dexuan

5 years, 4 months

1
0
0 0

Re: [PATCH v1] pinctrl: mediatek: improve Kconfig dependencies

by Ryder Lee

CC: stable(a)vger.kernel.org On Fri, 2018-12-21 at 18:17 +0800, Linus Walleij wrote: > On Thu, Dec 13, 2018 at 3:28 AM Ryder Lee <ryder.lee(a)mediatek.com> wrote: > > > Remove prompts to make all pinctrl cores to non-visible symbols and > > make sure the target SoCs would be coupled with the corresponding > > cores. > > > > Signed-off-by: Ryder Lee <ryder.lee(a)mediatek.com> > > Patch applied with ACK and Tested-by. > > Yours, > Linus Walleij I forgot to add stable-kernel into CC list. This patch should be applied to stable-rc linux-4.20.y. Sorry for the inconvenience. Ryder

5 years, 4 months

1
1
0 0

patch "staging: erofs: keep corrupted fs from crashing kernel in" added to staging-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled staging: erofs: keep corrupted fs from crashing kernel in to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. >From d4104c5e783f5d053b97268fb92001d785de7dd5 Mon Sep 17 00:00:00 2001 From: Gao Xiang <gaoxiang25(a)huawei.com> Date: Tue, 29 Jan 2019 23:55:40 +0800 Subject: staging: erofs: keep corrupted fs from crashing kernel in erofs_namei() As Al pointed out, " ... and while we are at it, what happens to unsigned int nameoff = le16_to_cpu(de[mid].nameoff); unsigned int matched = min(startprfx, endprfx); struct qstr dname = QSTR_INIT(data + nameoff, unlikely(mid >= ndirents - 1) ? maxsize - nameoff : le16_to_cpu(de[mid + 1].nameoff) - nameoff); /* string comparison without already matched prefix */ int ret = dirnamecmp(name, &dname, &matched); if le16_to_cpu(de[...].nameoff) is not monotonically increasing? I.e. what's to prevent e.g. (unsigned)-1 ending up in dname.len? Corrupted fs image shouldn't oops the kernel.. " Revisit the related lookup flow to address the issue. Fixes: d72d1ce60174 ("staging: erofs: add namei functions") Cc: <stable(a)vger.kernel.org> # 4.19+ Suggested-by: Al Viro <viro(a)ZenIV.linux.org.uk> Signed-off-by: Gao Xiang <gaoxiang25(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/staging/erofs/namei.c | 167 ++++++++++++++++++---------------- 1 file changed, 89 insertions(+), 78 deletions(-) diff --git a/drivers/staging/erofs/namei.c b/drivers/staging/erofs/namei.c index 5596c52e246d..a1300c420e63 100644 --- a/drivers/staging/erofs/namei.c +++ b/drivers/staging/erofs/namei.c @@ -15,74 +15,76 @@ #include <trace/events/erofs.h> -/* based on the value of qn->len is accurate */ -static inline int dirnamecmp(struct qstr *qn, - struct qstr *qd, unsigned int *matched) +struct erofs_qstr { + const unsigned char *name; + const unsigned char *end; +}; + +/* based on the end of qn is accurate and it must have the trailing '\0' */ +static inline int dirnamecmp(const struct erofs_qstr *qn, + const struct erofs_qstr *qd, + unsigned int *matched) { - unsigned int i = *matched, len = min(qn->len, qd->len); -loop: - if (unlikely(i >= len)) { - *matched = i; - if (qn->len < qd->len) { - /* - * actually (qn->len == qd->len) - * when qd->name[i] == '\0' - */ - return qd->name[i] == '\0' ? 0 : -1; + unsigned int i = *matched; + + /* + * on-disk error, let's only BUG_ON in the debugging mode. + * otherwise, it will return 1 to just skip the invalid name + * and go on (in consideration of the lookup performance). + */ + DBG_BUGON(qd->name > qd->end); + + /* qd could not have trailing '\0' */ + /* However it is absolutely safe if < qd->end */ + while (qd->name + i < qd->end && qd->name[i] != '\0') { + if (qn->name[i] != qd->name[i]) { + *matched = i; + return qn->name[i] > qd->name[i] ? 1 : -1; } - return (qn->len > qd->len); + ++i; } - - if (qn->name[i] != qd->name[i]) { - *matched = i; - return qn->name[i] > qd->name[i] ? 1 : -1; - } - - ++i; - goto loop; + *matched = i; + /* See comments in __d_alloc on the terminating NUL character */ + return qn->name[i] == '\0' ? 0 : 1; } -static struct erofs_dirent *find_target_dirent( - struct qstr *name, - u8 *data, int maxsize) +#define nameoff_from_disk(off, sz) (le16_to_cpu(off) & ((sz) - 1)) + +static struct erofs_dirent *find_target_dirent(struct erofs_qstr *name, + u8 *data, + unsigned int dirblksize, + const int ndirents) { - unsigned int ndirents, head, back; + int head, back; unsigned int startprfx, endprfx; struct erofs_dirent *const de = (struct erofs_dirent *)data; - /* make sure that maxsize is valid */ - BUG_ON(maxsize < sizeof(struct erofs_dirent)); - - ndirents = le16_to_cpu(de->nameoff) / sizeof(*de); - - /* corrupted dir (may be unnecessary...) */ - BUG_ON(!ndirents); - head = 0; back = ndirents - 1; startprfx = endprfx = 0; while (head <= back) { - unsigned int mid = head + (back - head) / 2; - unsigned int nameoff = le16_to_cpu(de[mid].nameoff); + const int mid = head + (back - head) / 2; + const int nameoff = nameoff_from_disk(de[mid].nameoff, + dirblksize); unsigned int matched = min(startprfx, endprfx); - - struct qstr dname = QSTR_INIT(data + nameoff, - unlikely(mid >= ndirents - 1) ? - maxsize - nameoff : - le16_to_cpu(de[mid + 1].nameoff) - nameoff); + struct erofs_qstr dname = { + .name = data + nameoff, + .end = unlikely(mid >= ndirents - 1) ? + data + dirblksize : + data + nameoff_from_disk(de[mid + 1].nameoff, + dirblksize) + }; /* string comparison without already matched prefix */ int ret = dirnamecmp(name, &dname, &matched); - if (unlikely(!ret)) + if (unlikely(!ret)) { return de + mid; - else if (ret > 0) { + } else if (ret > 0) { head = mid + 1; startprfx = matched; - } else if (unlikely(mid < 1)) /* fix "mid" overflow */ - break; - else { + } else { back = mid - 1; endprfx = matched; } @@ -91,12 +93,13 @@ static struct erofs_dirent *find_target_dirent( return ERR_PTR(-ENOENT); } -static struct page *find_target_block_classic( - struct inode *dir, - struct qstr *name, int *_diff) +static struct page *find_target_block_classic(struct inode *dir, + struct erofs_qstr *name, + int *_diff, + int *_ndirents) { unsigned int startprfx, endprfx; - unsigned int head, back; + int head, back; struct address_space *const mapping = dir->i_mapping; struct page *candidate = ERR_PTR(-ENOENT); @@ -105,33 +108,34 @@ static struct page *find_target_block_classic( back = inode_datablocks(dir) - 1; while (head <= back) { - unsigned int mid = head + (back - head) / 2; + const int mid = head + (back - head) / 2; struct page *page = read_mapping_page(mapping, mid, NULL); - if (IS_ERR(page)) { -exact_out: - if (!IS_ERR(candidate)) /* valid candidate */ - put_page(candidate); - return page; - } else { - int diff; - unsigned int ndirents, matched; - struct qstr dname; + if (!IS_ERR(page)) { struct erofs_dirent *de = kmap_atomic(page); - unsigned int nameoff = le16_to_cpu(de->nameoff); - - ndirents = nameoff / sizeof(*de); + const int nameoff = nameoff_from_disk(de->nameoff, + EROFS_BLKSIZ); + const int ndirents = nameoff / sizeof(*de); + int diff; + unsigned int matched; + struct erofs_qstr dname; - /* corrupted dir (should have one entry at least) */ - BUG_ON(!ndirents || nameoff > PAGE_SIZE); + if (unlikely(!ndirents)) { + DBG_BUGON(1); + put_page(page); + page = ERR_PTR(-EIO); + goto out; + } matched = min(startprfx, endprfx); dname.name = (u8 *)de + nameoff; - dname.len = ndirents == 1 ? - /* since the rest of the last page is 0 */ - EROFS_BLKSIZ - nameoff - : le16_to_cpu(de[1].nameoff) - nameoff; + if (ndirents == 1) + dname.end = (u8 *)de + EROFS_BLKSIZ; + else + dname.end = (u8 *)de + + nameoff_from_disk(de[1].nameoff, + EROFS_BLKSIZ); /* string comparison without already matched prefix */ diff = dirnamecmp(name, &dname, &matched); @@ -139,7 +143,7 @@ static struct page *find_target_block_classic( if (unlikely(!diff)) { *_diff = 0; - goto exact_out; + goto out; } else if (diff > 0) { head = mid + 1; startprfx = matched; @@ -147,35 +151,42 @@ static struct page *find_target_block_classic( if (likely(!IS_ERR(candidate))) put_page(candidate); candidate = page; + *_ndirents = ndirents; } else { put_page(page); - if (unlikely(mid < 1)) /* fix "mid" overflow */ - break; - back = mid - 1; endprfx = matched; } + continue; } +out: /* free if the candidate is valid */ + if (!IS_ERR(candidate)) + put_page(candidate); + return page; } *_diff = 1; return candidate; } int erofs_namei(struct inode *dir, - struct qstr *name, - erofs_nid_t *nid, unsigned int *d_type) + struct qstr *name, + erofs_nid_t *nid, unsigned int *d_type) { - int diff; + int diff, ndirents; struct page *page; u8 *data; struct erofs_dirent *de; + struct erofs_qstr qn; if (unlikely(!dir->i_size)) return -ENOENT; + qn.name = name->name; + qn.end = name->name + name->len; + diff = 1; - page = find_target_block_classic(dir, name, &diff); + page = find_target_block_classic(dir, &qn, &diff, &ndirents); if (unlikely(IS_ERR(page))) return PTR_ERR(page); @@ -184,7 +195,7 @@ int erofs_namei(struct inode *dir, /* the target page has been mapped */ de = likely(diff) ? /* since the rest of the last page is 0 */ - find_target_dirent(name, data, EROFS_BLKSIZ) : + find_target_dirent(&qn, data, EROFS_BLKSIZ, ndirents) : (struct erofs_dirent *)data; if (likely(!IS_ERR(de))) { -- 2.20.1

5 years, 4 months

5
5
0 0

+ huegtlbfs-fix-page-leak-during-migration-of-file-pages.patch added to -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: huegtlbfs: fix page leak during migration of file pages has been added to the -mm tree. Its filename is huegtlbfs-fix-page-leak-during-migration-of-file-pages.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/huegtlbfs-fix-page-leak-during-mig… and later at http://ozlabs.org/~akpm/mmotm/broken-out/huegtlbfs-fix-page-leak-during-mig… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Mike Kravetz <mike.kravetz(a)oracle.com> Subject: huegtlbfs: fix page leak during migration of file pages Files can be created and mapped in an explicitly mounted hugetlbfs filesystem. If pages in such files are migrated, the filesystem usage will not be decremented for the associated pages. This can result in mmap or page allocation failures as it appears there are fewer pages in the filesystem than there should be. For example, a test program which hole punches, faults and migrates pages in such a file (1G in size) will eventually fail because it can not allocate a page. Reported counts and usage at time of failure: node0 537 free_hugepages 1024 nr_hugepages 0 surplus_hugepages node1 1000 free_hugepages 1024 nr_hugepages 0 surplus_hugepages Filesystem Size Used Avail Use% Mounted on nodev 4.0G 4.0G 0 100% /var/opt/hugepool Note that the filesystem shows 4G of pages used, while actual usage is 511 pages (just under 1G). Failed trying to allocate page 512. If a hugetlb page is associated with an explicitly mounted filesystem, this information in contained in the page_private field. At migration time, this information is not preserved. To fix, simply transfer page_private from old to new page at migration time if necessary. Also, migrate_page_states() unconditionally clears page_private and PagePrivate of the old page. It is unlikely, but possible that these fields could be non-NULL and are needed at hugetlb free page time. So, do not touch these fields for hugetlb pages. Link: http://lkml.kernel.org/r/20190130211443.16678-1-mike.kravetz@oracle.com Fixes: 290408d4a250 ("hugetlb: hugepage migration core") Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: "Kirill A . Shutemov" <kirill.shutemov(a)linux.intel.com> Cc: Mel Gorman <mgorman(a)techsingularity.net> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/hugetlbfs/inode.c | 10 ++++++++++ mm/migrate.c | 10 ++++++++-- 2 files changed, 18 insertions(+), 2 deletions(-) --- a/fs/hugetlbfs/inode.c~huegtlbfs-fix-page-leak-during-migration-of-file-pages +++ a/fs/hugetlbfs/inode.c @@ -859,6 +859,16 @@ static int hugetlbfs_migrate_page(struct rc = migrate_huge_page_move_mapping(mapping, newpage, page); if (rc != MIGRATEPAGE_SUCCESS) return rc; + + /* + * page_private is subpool pointer in hugetlb pages, transfer + * if needed. + */ + if (page_private(page) && !page_private(newpage)) { + set_page_private(newpage, page_private(page)); + set_page_private(page, 0); + } + if (mode != MIGRATE_SYNC_NO_COPY) migrate_page_copy(newpage, page); else --- a/mm/migrate.c~huegtlbfs-fix-page-leak-during-migration-of-file-pages +++ a/mm/migrate.c @@ -641,8 +641,14 @@ void migrate_page_states(struct page *ne */ if (PageSwapCache(page)) ClearPageSwapCache(page); - ClearPagePrivate(page); - set_page_private(page, 0); + /* + * Unlikely, but PagePrivate and page_private could potentially + * contain information needed at hugetlb free page time. + */ + if (!PageHuge(page)) { + ClearPagePrivate(page); + set_page_private(page, 0); + } /* * If any waiters have accumulated on the new page then _ Patches currently in -mm which might be from mike.kravetz(a)oracle.com are huegtlbfs-fix-page-leak-during-migration-of-file-pages.patch

5 years, 4 months

1
0
0 0

[PATCH] gfs2: Fix loop in gfs2_rbm_find (2)

by Andreas Gruenbacher

The fix from commit 2d29f6b96d8f introduced an unexpected performance regression when allocating blocks. Fix by rewriting the overly complicated wrap-around logic in gfs2_rbm_find in a more reasonable way. Discovered and verified with iozone. Fixes: 2d29f6b96d8f ("gfs2: Fix loop in gfs2_rbm_find") Cc: stable(a)vger.kernel.org # v3.13+ Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> --- fs/gfs2/rgrp.c | 40 +++++++++++++--------------------------- 1 file changed, 13 insertions(+), 27 deletions(-) diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c index 831d7cb5a49c4..3f16411d885d9 100644 --- a/fs/gfs2/rgrp.c +++ b/fs/gfs2/rgrp.c @@ -1730,25 +1730,15 @@ static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 *minext, const struct gfs2_inode *ip, bool nowrap) { struct buffer_head *bh; - int initial_bii; - u32 initial_offset; int first_bii = rbm->bii; u32 first_offset = rbm->offset; u32 offset; u8 *buffer; - int n = 0; - int iters = rbm->rgd->rd_length; + bool wrapped = false; int ret; struct gfs2_bitmap *bi; struct gfs2_extent maxext = { .rbm.rgd = rbm->rgd, }; - /* If we are not starting at the beginning of a bitmap, then we - * need to add one to the bitmap count to ensure that we search - * the starting bitmap twice. - */ - if (rbm->offset != 0) - iters++; - while(1) { bi = rbm_bi(rbm); if ((ip == NULL || !gfs2_rs_active(&ip->i_res)) && @@ -1761,47 +1751,43 @@ static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 *minext, WARN_ON(!buffer_uptodate(bh)); if (state != GFS2_BLKST_UNLINKED && bi->bi_clone) buffer = bi->bi_clone + bi->bi_offset; - initial_offset = rbm->offset; offset = gfs2_bitfit(buffer, bi->bi_bytes, rbm->offset, state); - if (offset == BFITNOENT) - goto bitmap_full; + if (offset == BFITNOENT) { + if (state == GFS2_BLKST_FREE && rbm->offset == 0) + set_bit(GBF_FULL, &bi->bi_flags); + goto next_bitmap; + } rbm->offset = offset; if (ip == NULL) return 0; - initial_bii = rbm->bii; ret = gfs2_reservation_check_and_update(rbm, ip, minext ? *minext : 0, &maxext); if (ret == 0) return 0; - if (ret > 0) { - n += (rbm->bii - initial_bii); + if (ret > 0) goto next_iter; - } if (ret == -E2BIG) { - n += rbm->bii - initial_bii; rbm->bii = 0; rbm->offset = 0; goto res_covered_end_of_rgrp; } return ret; -bitmap_full: /* Mark bitmap as full and fall through */ - if ((state == GFS2_BLKST_FREE) && initial_offset == 0) - set_bit(GBF_FULL, &bi->bi_flags); - next_bitmap: /* Find next bitmap in the rgrp */ rbm->offset = 0; rbm->bii++; if (rbm->bii == rbm->rgd->rd_length) rbm->bii = 0; res_covered_end_of_rgrp: - if ((rbm->bii == 0) && nowrap) - break; - n++; + if (rbm->bii == 0) { + if (nowrap) + break; + wrapped = true; + } next_iter: - if (n >= iters) + if (wrapped && rbm->bii > first_bii) break; } -- 2.20.1

5 years, 4 months

3
4
0 0

[RESEND PATCH v4 1/3] fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb()

by Waiman Long

The nr_dentry_unused per-cpu counter tracks dentries in both the LRU lists and the shrink lists where the DCACHE_LRU_LIST bit is set. The shrink_dcache_sb() function moves dentries from the LRU list to a shrink list and subtracts the dentry count from nr_dentry_unused. This is incorrect as the nr_dentry_unused count Will also be decremented in shrink_dentry_list() via d_shrink_del(). To fix this double decrement, the decrement in the shrink_dcache_sb() function is taken out. Fixes: 4e717f5c1083 ("list_lru: remove special case function list_lru_dispose_all." Cc: stable(a)vger.kernel.org Signed-off-by: Waiman Long <longman(a)redhat.com> Reviewed-by: Dave Chinner <dchinner(a)redhat.com> --- fs/dcache.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/fs/dcache.c b/fs/dcache.c index 2593153..44e5652 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -1188,15 +1188,11 @@ static enum lru_status dentry_lru_isolate_shrink(struct list_head *item, */ void shrink_dcache_sb(struct super_block *sb) { - long freed; - do { LIST_HEAD(dispose); - freed = list_lru_walk(&sb->s_dentry_lru, + list_lru_walk(&sb->s_dentry_lru, dentry_lru_isolate_shrink, &dispose, 1024); - - this_cpu_sub(nr_dentry_unused, freed); shrink_dentry_list(&dispose); } while (list_lru_count(&sb->s_dentry_lru) > 0); } -- 1.8.3.1

5 years, 4 months

1
0
0 0

[PATCH 1/1] usb: phy: Kconfig: change FSL_USB2_OTG as tristate

by Peter Chen

It depends on USB_OTG_FSM, but USB_OTG_FSM can be module, so FSL_USB2_OTG should be tristate. It fixes below build warning: drivers/usb/phy/phy-fsl-usb.o: In function `fsl_otg_ioctl': phy-fsl-usb.c:(.text+0x5e4): undefined reference to `otg_statemachine' drivers/usb/phy/phy-fsl-usb.o: In function `fsl_otg_start_srp': phy-fsl-usb.c:(.text+0x680): undefined reference to `otg_statemachine' drivers/usb/phy/phy-fsl-usb.o: In function `fsl_otg_set_host': phy-fsl-usb.c:(.text+0x800): undefined reference to `otg_statemachine' drivers/usb/phy/phy-fsl-usb.o: In function `fsl_otg_start_hnp': phy-fsl-usb.c:(.text+0x88c): undefined reference to `otg_statemachine' drivers/usb/phy/phy-fsl-usb.o: In function `show_fsl_usb2_otg_state': phy-fsl-usb.c:(.text+0xa44): undefined reference to `usb_otg_state_string' drivers/usb/phy/phy-fsl-usb.o: In function `a_wait_enum': phy-fsl-usb.c:(.text+0x1718): undefined reference to `otg_statemachine' drivers/usb/phy/phy-fsl-usb.o: In function `fsl_otg_set_peripheral': phy-fsl-usb.c:(.text+0x1f20): undefined reference to `usb_gadget_vbus_disconnect' phy-fsl-usb.c:(.text+0x1f40): undefined reference to `otg_statemachine' Cc: <stable(a)vger.kernel.org> #v4.1+ Cc: Li Yang <leoyang.li(a)nxp.com> Reported-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Peter Chen <peter.chen(a)nxp.com> --- drivers/usb/phy/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig index d7312eed6088..5444d2437475 100644 --- a/drivers/usb/phy/Kconfig +++ b/drivers/usb/phy/Kconfig @@ -20,7 +20,7 @@ config AB8500_USB in host mode, low speed. config FSL_USB2_OTG - bool "Freescale USB OTG Transceiver Driver" + tristate "Freescale USB OTG Transceiver Driver" depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM && PM depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y' select USB_PHY -- 2.14.1

5 years, 4 months

2
1
0 0

[PATCH] iommu/io-pgtable-arm-v7s: only kmemleak_ignore L2 tables

by Nicolas Boichat

L1 tables are allocated with __get_dma_pages, and therefore already ignored by kmemleak. Without this, the kernel would print this error message on boot, when the first L1 table is allocated: [ 2.810533] kmemleak: Trying to color unknown object at 0xffffffd652388000 as Black [ 2.818190] CPU: 5 PID: 39 Comm: kworker/5:0 Tainted: G S 4.19.16 #8 [ 2.831227] Workqueue: events deferred_probe_work_func [ 2.836353] Call trace: ... [ 2.852532] paint_ptr+0xa0/0xa8 [ 2.855750] kmemleak_ignore+0x38/0x6c [ 2.859490] __arm_v7s_alloc_table+0x168/0x1f4 [ 2.863922] arm_v7s_alloc_pgtable+0x114/0x17c [ 2.868354] alloc_io_pgtable_ops+0x3c/0x78 ... Fixes: e5fc9753b1a8314 ("iommu/io-pgtable: Add ARMv7 short descriptor support") Signed-off-by: Nicolas Boichat <drinkcat(a)chromium.org> --- I only tested this on top of my other series (https://patchwork.kernel.org/patch/10720495/), but I think the same fix applies. I'm still a bit confused as to why this only shows up now, as IIUC, the kmemleak_ignore call was always wrong with L1 tables. drivers/iommu/io-pgtable-arm-v7s.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c index cec29bf45c9bd7..98a4a4a0dfb0c1 100644 --- a/drivers/iommu/io-pgtable-arm-v7s.c +++ b/drivers/iommu/io-pgtable-arm-v7s.c @@ -217,7 +217,8 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp, if (dma != phys) goto out_unmap; } - kmemleak_ignore(table); + if (lvl == 2) + kmemleak_ignore(table); return table; out_unmap: -- 2.20.1.495.gaa96b0ce6b-goog

5 years, 4 months

3
2
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror January 2019