The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 5ae17501bc62a49b0b193dcce003f16375f16654 Mon Sep 17 00:00:00 2001
From: "Ewan D. Milne" <emilne(a)redhat.com>
Date: Fri, 29 Oct 2021 15:43:10 -0400
Subject: [PATCH] scsi: core: Avoid leaving shost->last_reset with stale value
if EH does not run
The changes to issue the abort from the scmd->abort_work instead of the EH
thread introduced a problem if eh_deadline is used. If aborting the
command(s) is successful, and there are never any scmds added to the
shost->eh_cmd_q, there is no code path which will reset the ->last_reset
value back to zero.
The effect of this is that after a successful abort with no EH thread
activity, a subsequent timeout, perhaps a long time later, might
immediately be considered past a user-set eh_deadline time, and the host
will be reset with no attempt at recovery.
Fix this by resetting ->last_reset back to zero in scmd_eh_abort_handler()
if it is determined that the EH thread will not run to do this.
Thanks to Gopinath Marappan for investigating this problem.
Link: https://lore.kernel.org/r/20211029194311.17504-2-emilne@redhat.com
Fixes: e494f6a72839 ("[SCSI] improved eh timeout handler")
Cc: stable(a)vger.kernel.org
Signed-off-by: Ewan D. Milne <emilne(a)redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index 17aef936bc90..2cb7163e24cc 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -387,6 +387,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
shost->shost_state = SHOST_CREATED;
INIT_LIST_HEAD(&shost->__devices);
INIT_LIST_HEAD(&shost->__targets);
+ INIT_LIST_HEAD(&shost->eh_abort_list);
INIT_LIST_HEAD(&shost->eh_cmd_q);
INIT_LIST_HEAD(&shost->starved_list);
init_waitqueue_head(&shost->host_wait);
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 3de03925550e..bdf782d9cb86 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -133,6 +133,23 @@ static bool scsi_eh_should_retry_cmd(struct scsi_cmnd *cmd)
return true;
}
+static void scsi_eh_complete_abort(struct scsi_cmnd *scmd, struct Scsi_Host *shost)
+{
+ unsigned long flags;
+
+ spin_lock_irqsave(shost->host_lock, flags);
+ list_del_init(&scmd->eh_entry);
+ /*
+ * If the abort succeeds, and there is no further
+ * EH action, clear the ->last_reset time.
+ */
+ if (list_empty(&shost->eh_abort_list) &&
+ list_empty(&shost->eh_cmd_q))
+ if (shost->eh_deadline != -1)
+ shost->last_reset = 0;
+ spin_unlock_irqrestore(shost->host_lock, flags);
+}
+
/**
* scmd_eh_abort_handler - Handle command aborts
* @work: command to be aborted.
@@ -150,6 +167,7 @@ scmd_eh_abort_handler(struct work_struct *work)
container_of(work, struct scsi_cmnd, abort_work.work);
struct scsi_device *sdev = scmd->device;
enum scsi_disposition rtn;
+ unsigned long flags;
if (scsi_host_eh_past_deadline(sdev->host)) {
SCSI_LOG_ERROR_RECOVERY(3,
@@ -173,12 +191,14 @@ scmd_eh_abort_handler(struct work_struct *work)
SCSI_LOG_ERROR_RECOVERY(3,
scmd_printk(KERN_WARNING, scmd,
"retry aborted command\n"));
+ scsi_eh_complete_abort(scmd, sdev->host);
scsi_queue_insert(scmd, SCSI_MLQUEUE_EH_RETRY);
return;
} else {
SCSI_LOG_ERROR_RECOVERY(3,
scmd_printk(KERN_WARNING, scmd,
"finish aborted command\n"));
+ scsi_eh_complete_abort(scmd, sdev->host);
scsi_finish_command(scmd);
return;
}
@@ -191,6 +211,9 @@ scmd_eh_abort_handler(struct work_struct *work)
}
}
+ spin_lock_irqsave(sdev->host->host_lock, flags);
+ list_del_init(&scmd->eh_entry);
+ spin_unlock_irqrestore(sdev->host->host_lock, flags);
scsi_eh_scmd_add(scmd);
}
@@ -221,6 +244,8 @@ scsi_abort_command(struct scsi_cmnd *scmd)
spin_lock_irqsave(shost->host_lock, flags);
if (shost->eh_deadline != -1 && !shost->last_reset)
shost->last_reset = jiffies;
+ BUG_ON(!list_empty(&scmd->eh_entry));
+ list_add_tail(&scmd->eh_entry, &shost->eh_abort_list);
spin_unlock_irqrestore(shost->host_lock, flags);
scmd->eh_eflags |= SCSI_EH_ABORT_SCHEDULED;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index d0b7c6dc74f8..c851c05d6091 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1143,6 +1143,7 @@ void scsi_init_command(struct scsi_device *dev, struct scsi_cmnd *cmd)
cmd->sense_buffer = buf;
cmd->prot_sdb = prot;
cmd->flags = flags;
+ INIT_LIST_HEAD(&cmd->eh_entry);
INIT_DELAYED_WORK(&cmd->abort_work, scmd_eh_abort_handler);
cmd->jiffies_at_alloc = jiffies_at_alloc;
cmd->retries = retries;
diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
index 7958a604f979..29ac40cf1aae 100644
--- a/include/scsi/scsi_cmnd.h
+++ b/include/scsi/scsi_cmnd.h
@@ -73,7 +73,7 @@ enum scsi_cmnd_submitter {
struct scsi_cmnd {
struct scsi_request req;
struct scsi_device *device;
- struct list_head eh_entry; /* entry for the host eh_cmd_q */
+ struct list_head eh_entry; /* entry for the host eh_abort_list/eh_cmd_q */
struct delayed_work abort_work;
struct rcu_head rcu;
diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h
index ae715959f886..ebe059badba0 100644
--- a/include/scsi/scsi_host.h
+++ b/include/scsi/scsi_host.h
@@ -551,6 +551,7 @@ struct Scsi_Host {
struct mutex scan_mutex;/* serialize scanning activity */
+ struct list_head eh_abort_list;
struct list_head eh_cmd_q;
struct task_struct * ehandler; /* Error recovery thread. */
struct completion * eh_action; /* Wait for specific actions on the
The patch below does not apply to the 5.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 20aaef52eb08f1d987d46ad26edb8f142f74d83a Mon Sep 17 00:00:00 2001
From: Tadeusz Struk <tadeusz.struk(a)linaro.org>
Date: Wed, 3 Nov 2021 10:06:58 -0700
Subject: [PATCH] scsi: scsi_ioctl: Validate command size
Need to make sure the command size is valid before copying the command from
user space.
Link: https://lore.kernel.org/r/20211103170659.22151-1-tadeusz.struk@linaro.org
Cc: Bart Van Assche <bvanassche(a)acm.org>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: James E.J. Bottomley <jejb(a)linux.ibm.com>
Cc: Martin K. Petersen <martin.petersen(a)oracle.com>
Cc: <linux-scsi(a)vger.kernel.org>
Cc: <linux-kernel(a)vger.kernel.org>
Cc: <stable(a)vger.kernel.org> # 5.15, 5.14, 5.10
Signed-off-by: Tadeusz Struk <tadeusz.struk(a)linaro.org>
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
diff --git a/drivers/scsi/scsi_ioctl.c b/drivers/scsi/scsi_ioctl.c
index 6ff2207bd45a..a06c61f22742 100644
--- a/drivers/scsi/scsi_ioctl.c
+++ b/drivers/scsi/scsi_ioctl.c
@@ -347,6 +347,8 @@ static int scsi_fill_sghdr_rq(struct scsi_device *sdev, struct request *rq,
{
struct scsi_request *req = scsi_req(rq);
+ if (hdr->cmd_len < 6)
+ return -EMSGSIZE;
if (copy_from_user(req->cmd, hdr->cmdp, hdr->cmd_len))
return -EFAULT;
if (!scsi_cmd_allowed(req->cmd, mode))
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 20aaef52eb08f1d987d46ad26edb8f142f74d83a Mon Sep 17 00:00:00 2001
From: Tadeusz Struk <tadeusz.struk(a)linaro.org>
Date: Wed, 3 Nov 2021 10:06:58 -0700
Subject: [PATCH] scsi: scsi_ioctl: Validate command size
Need to make sure the command size is valid before copying the command from
user space.
Link: https://lore.kernel.org/r/20211103170659.22151-1-tadeusz.struk@linaro.org
Cc: Bart Van Assche <bvanassche(a)acm.org>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: James E.J. Bottomley <jejb(a)linux.ibm.com>
Cc: Martin K. Petersen <martin.petersen(a)oracle.com>
Cc: <linux-scsi(a)vger.kernel.org>
Cc: <linux-kernel(a)vger.kernel.org>
Cc: <stable(a)vger.kernel.org> # 5.15, 5.14, 5.10
Signed-off-by: Tadeusz Struk <tadeusz.struk(a)linaro.org>
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
diff --git a/drivers/scsi/scsi_ioctl.c b/drivers/scsi/scsi_ioctl.c
index 6ff2207bd45a..a06c61f22742 100644
--- a/drivers/scsi/scsi_ioctl.c
+++ b/drivers/scsi/scsi_ioctl.c
@@ -347,6 +347,8 @@ static int scsi_fill_sghdr_rq(struct scsi_device *sdev, struct request *rq,
{
struct scsi_request *req = scsi_req(rq);
+ if (hdr->cmd_len < 6)
+ return -EMSGSIZE;
if (copy_from_user(req->cmd, hdr->cmdp, hdr->cmd_len))
return -EFAULT;
if (!scsi_cmd_allowed(req->cmd, mode))
This is the start of the stable review cycle for the 5.4.159 release.
There are 17 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 12 Nov 2021 18:19:54 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.159-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.159-rc1
Johan Hovold <johan(a)kernel.org>
rsi: fix control-message timeout
Gustavo A. R. Silva <gustavoars(a)kernel.org>
media: staging/intel-ipu3: css: Fix wrong size comparison imgu_css_fw_init
Johan Hovold <johan(a)kernel.org>
staging: rtl8192u: fix control-message timeouts
Johan Hovold <johan(a)kernel.org>
staging: r8712u: fix control-message timeout
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix bulk and interrupt message timeouts
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix bulk-buffer overflow
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix transfer-buffer overflows
Johan Hovold <johan(a)kernel.org>
comedi: ni_usb6501: fix NULL-deref in command paths
Johan Hovold <johan(a)kernel.org>
comedi: dt9812: fix DMA buffers on stack
Jan Kara <jack(a)suse.cz>
isofs: Fix out of bound access for corrupted isofs image
Petr Mladek <pmladek(a)suse.com>
printk/console: Allow to disable console output by using console="" or console=null
Todd Kjos <tkjos(a)google.com>
binder: don't detect sender/target during buffer cleanup
James Buren <braewoods+lkml(a)braewoods.net>
usb-storage: Add compatibility quirk flags for iODD 2531/2541
Viraj Shah <viraj.shah(a)linutronix.de>
usb: musb: Balance list entry in musb_gadget_queue
Geert Uytterhoeven <geert(a)linux-m68k.org>
usb: gadget: Mark USB_FSL_QE broken on 64-bit
Neal Liu <neal_liu(a)aspeedtech.com>
usb: ehci: handshake CMD_RUN instead of STS_HALT
Juergen Gross <jgross(a)suse.com>
Revert "x86/kvm: fix vcpu-id indexed array sizes"
-------------
Diffstat:
Makefile | 4 +-
arch/x86/kvm/ioapic.c | 2 +-
arch/x86/kvm/ioapic.h | 4 +-
drivers/android/binder.c | 14 ++--
drivers/net/wireless/rsi/rsi_91x_usb.c | 2 +-
drivers/staging/comedi/drivers/dt9812.c | 115 +++++++++++++++++++++-------
drivers/staging/comedi/drivers/ni_usb6501.c | 10 +++
drivers/staging/comedi/drivers/vmk80xx.c | 28 +++----
drivers/staging/media/ipu3/ipu3-css-fw.c | 7 +-
drivers/staging/media/ipu3/ipu3-css-fw.h | 2 +-
drivers/staging/rtl8192u/r8192U_core.c | 18 ++---
drivers/staging/rtl8712/usb_ops_linux.c | 2 +-
drivers/usb/gadget/udc/Kconfig | 1 +
drivers/usb/host/ehci-hcd.c | 11 ++-
drivers/usb/host/ehci-platform.c | 6 ++
drivers/usb/host/ehci.h | 1 +
drivers/usb/musb/musb_gadget.c | 4 +-
drivers/usb/storage/unusual_devs.h | 10 +++
fs/isofs/inode.c | 2 +
kernel/printk/printk.c | 9 ++-
20 files changed, 179 insertions(+), 73 deletions(-)
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: e629fc1407a63dbb748f828f9814463ffc2a0af0
Gitweb: https://git.kernel.org/tip/e629fc1407a63dbb748f828f9814463ffc2a0af0
Author: Dave Jones <davej(a)codemonkey.org.uk>
AuthorDate: Fri, 29 Oct 2021 16:57:59 -04:00
Committer: Dave Hansen <dave.hansen(a)linux.intel.com>
CommitterDate: Fri, 12 Nov 2021 11:43:35 -08:00
x86/mce: Add errata workaround for Skylake SKX37
Errata SKX37 is word-for-word identical to the other errata listed in
this workaround. I happened to notice this after investigating a CMCI
storm on a Skylake host. While I can't confirm this was the root cause,
spurious corrected errors does sound like a likely suspect.
Fixes: 2976908e4198 ("x86/mce: Do not log spurious corrected mce errors")
Signed-off-by: Dave Jones <davej(a)codemonkey.org.uk>
Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com>
Reviewed-by: Tony Luck <tony.luck(a)intel.com>
Cc: <stable(a)vger.kernel.org>
Link: https://lkml.kernel.org/r/20211029205759.GA7385@codemonkey.org.uk
---
arch/x86/kernel/cpu/mce/intel.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kernel/cpu/mce/intel.c b/arch/x86/kernel/cpu/mce/intel.c
index acfd5d9..bb9a46a 100644
--- a/arch/x86/kernel/cpu/mce/intel.c
+++ b/arch/x86/kernel/cpu/mce/intel.c
@@ -547,12 +547,13 @@ bool intel_filter_mce(struct mce *m)
{
struct cpuinfo_x86 *c = &boot_cpu_data;
- /* MCE errata HSD131, HSM142, HSW131, BDM48, and HSM142 */
+ /* MCE errata HSD131, HSM142, HSW131, BDM48, HSM142 and SKX37 */
if ((c->x86 == 6) &&
((c->x86_model == INTEL_FAM6_HASWELL) ||
(c->x86_model == INTEL_FAM6_HASWELL_L) ||
(c->x86_model == INTEL_FAM6_BROADWELL) ||
- (c->x86_model == INTEL_FAM6_HASWELL_G)) &&
+ (c->x86_model == INTEL_FAM6_HASWELL_G) ||
+ (c->x86_model == INTEL_FAM6_SKYLAKE_X)) &&
(m->bank == 0) &&
((m->status & 0xa0000000ffffffff) == 0x80000000000f0005))
return true;
This is the start of the stable review cycle for the 4.19.217 release.
There are 16 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 12 Nov 2021 18:19:54 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.217-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.217-rc1
Johan Hovold <johan(a)kernel.org>
rsi: fix control-message timeout
Johan Hovold <johan(a)kernel.org>
staging: rtl8192u: fix control-message timeouts
Johan Hovold <johan(a)kernel.org>
staging: r8712u: fix control-message timeout
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix bulk and interrupt message timeouts
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix bulk-buffer overflow
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix transfer-buffer overflows
Johan Hovold <johan(a)kernel.org>
comedi: ni_usb6501: fix NULL-deref in command paths
Johan Hovold <johan(a)kernel.org>
comedi: dt9812: fix DMA buffers on stack
Jan Kara <jack(a)suse.cz>
isofs: Fix out of bound access for corrupted isofs image
Petr Mladek <pmladek(a)suse.com>
printk/console: Allow to disable console output by using console="" or console=null
James Buren <braewoods+lkml(a)braewoods.net>
usb-storage: Add compatibility quirk flags for iODD 2531/2541
Viraj Shah <viraj.shah(a)linutronix.de>
usb: musb: Balance list entry in musb_gadget_queue
Geert Uytterhoeven <geert(a)linux-m68k.org>
usb: gadget: Mark USB_FSL_QE broken on 64-bit
Neal Liu <neal_liu(a)aspeedtech.com>
usb: ehci: handshake CMD_RUN instead of STS_HALT
Juergen Gross <jgross(a)suse.com>
Revert "x86/kvm: fix vcpu-id indexed array sizes"
Ming Lei <ming.lei(a)redhat.com>
block: introduce multi-page bvec helpers
-------------
Diffstat:
Makefile | 4 +-
arch/x86/kvm/ioapic.c | 2 +-
arch/x86/kvm/ioapic.h | 4 +-
drivers/net/wireless/rsi/rsi_91x_usb.c | 2 +-
drivers/staging/comedi/drivers/dt9812.c | 115 +++++++++++++++++++++-------
drivers/staging/comedi/drivers/ni_usb6501.c | 10 +++
drivers/staging/comedi/drivers/vmk80xx.c | 28 +++----
drivers/staging/rtl8192u/r8192U_core.c | 18 ++---
drivers/staging/rtl8712/usb_ops_linux.c | 2 +-
drivers/usb/gadget/udc/Kconfig | 1 +
drivers/usb/host/ehci-hcd.c | 11 ++-
drivers/usb/host/ehci-platform.c | 6 ++
drivers/usb/host/ehci.h | 1 +
drivers/usb/musb/musb_gadget.c | 4 +-
drivers/usb/storage/unusual_devs.h | 10 +++
fs/isofs/inode.c | 2 +
include/linux/bvec.h | 30 +++++++-
kernel/printk/printk.c | 9 ++-
18 files changed, 195 insertions(+), 64 deletions(-)
From: Amit Kumar Mahapatra <amit.kumar-mahapatra(a)xilinx.com>
[ Upstream commit 167721a5909f867f8c18c8e78ea58e705ad9bbd4 ]
In kernel 5.4, support has been added for reading MTD devices via the nvmem
API.
For this the mtd devices are registered as read-only NVMEM providers under
sysfs with the same name as the flash partition label property.
So if flash partition label property of multiple flash devices are
identical then the second mtd device fails to get registered as a NVMEM
provider.
This patch fixes the issue by having different label property for different
flashes.
Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra(a)xilinx.com>
Signed-off-by: Michal Simek <michal.simek(a)xilinx.com>
Link: https://lore.kernel.org/r/6c4b9b9232b93d9e316a63c086540fd5bf6b8687.16236842…
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts
index 4a86efa32d687..f7124e15f0ff6 100644
--- a/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts
+++ b/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts
@@ -131,7 +131,7 @@
reg = <0>;
partition@0 {
- label = "data";
+ label = "spi0-data";
reg = <0x0 0x100000>;
};
};
@@ -149,7 +149,7 @@
reg = <0>;
partition@0 {
- label = "data";
+ label = "spi1-data";
reg = <0x0 0x84000>;
};
};
--
2.33.0
From: Guo Ren <guoren(a)linux.alibaba.com>
When using "devm_request_threaded_irq(,,,,IRQF_ONESHOT,,)" in the driver,
only the first interrupt could be handled, and continue irq is blocked by
hw. Because the riscv plic couldn't complete masked irq source which has
been disabled in enable register. The bug was firstly reported in [1].
Here is the description of Interrupt Completion in PLIC spec [2]:
The PLIC signals it has completed executing an interrupt handler by
writing the interrupt ID it received from the claim to the claim/complete
register. The PLIC does not check whether the completion ID is the same
as the last claim ID for that target. If the completion ID does not match
an interrupt source that is currently enabled for the target, the
^^ ^^^^^^^^^ ^^^^^^^
completion is silently ignored.
[1] http://lists.infradead.org/pipermail/linux-riscv/2021-July/007441.html
[2] https://github.com/riscv/riscv-plic-spec/blob/8bc15a35d07c9edf7b5d23fec9728…
Fixes: bb0fed1c60cc ("irqchip/sifive-plic: Switch to fasteoi flow")
Reported-by: Vincent Pelletier <plr.vincent(a)gmail.com>
Tested-by: Nikita Shubin <nikita.shubin(a)maquefel.me>
Signed-off-by: Guo Ren <guoren(a)linux.alibaba.com>
Cc: stable(a)vger.kernel.org
Cc: Anup Patel <anup(a)brainfault.org>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Marc Zyngier <maz(a)kernel.org>
Cc: Palmer Dabbelt <palmer(a)dabbelt.com>
Cc: Atish Patra <atish.patra(a)wdc.com>
Cc: Nikita Shubin <nikita.shubin(a)maquefel.me>
Cc: incent Pelletier <plr.vincent(a)gmail.com>
---
Changes since V7:
- Add Fixes tag
- Add Tested-by
- Add Cc stable
Changes since V6:
- Propagate to plic_irq_eoi for all riscv,plic by Nikita Shubin
- Remove thead related codes
Changes since V5:
- Move back to mask/unmask
- Fixup the problem in eoi callback
- Remove allwinner,sun20i-d1 IRQCHIP_DECLARE
- Rewrite comment log
Changes since V4:
- Update comment by Anup
Changes since V3:
- Rename "c9xx" to "c900"
- Add sifive_plic_chip and thead_plic_chip for difference
Changes since V2:
- Add a separate compatible string "thead,c9xx-plic"
- set irq_mask/unmask of "plic_chip" to NULL and point
irq_enable/disable of "plic_chip" to plic_irq_mask/unmask
- Add a detailed comment block in plic_init() about the
differences in Claim/Completion process of RISC-V PLIC and C9xx
PLIC.
---
drivers/irqchip/irq-sifive-plic.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
index cf74cfa82045..259065d271ef 100644
--- a/drivers/irqchip/irq-sifive-plic.c
+++ b/drivers/irqchip/irq-sifive-plic.c
@@ -163,7 +163,13 @@ static void plic_irq_eoi(struct irq_data *d)
{
struct plic_handler *handler = this_cpu_ptr(&plic_handlers);
- writel(d->hwirq, handler->hart_base + CONTEXT_CLAIM);
+ if (irqd_irq_masked(d)) {
+ plic_irq_unmask(d);
+ writel(d->hwirq, handler->hart_base + CONTEXT_CLAIM);
+ plic_irq_mask(d);
+ } else {
+ writel(d->hwirq, handler->hart_base + CONTEXT_CLAIM);
+ }
}
static struct irq_chip plic_chip = {
--
2.25.1
This is the start of the stable review cycle for the 5.15.2 release.
There are 26 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 12 Nov 2021 18:19:54 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.2-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.15.2-rc1
Johan Hovold <johan(a)kernel.org>
rsi: fix control-message timeout
Gustavo A. R. Silva <gustavoars(a)kernel.org>
media: staging/intel-ipu3: css: Fix wrong size comparison imgu_css_fw_init
Martin Kaiser <martin(a)kaiser.cx>
staging: r8188eu: fix memleak in rtw_wx_set_enc_ext
Johan Hovold <johan(a)kernel.org>
staging: rtl8192u: fix control-message timeouts
Johan Hovold <johan(a)kernel.org>
staging: r8712u: fix control-message timeout
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix bulk and interrupt message timeouts
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix bulk-buffer overflow
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix transfer-buffer overflows
Johan Hovold <johan(a)kernel.org>
comedi: ni_usb6501: fix NULL-deref in command paths
Johan Hovold <johan(a)kernel.org>
comedi: dt9812: fix DMA buffers on stack
Jan Kara <jack(a)suse.cz>
isofs: Fix out of bound access for corrupted isofs image
Pavel Skripkin <paskripkin(a)gmail.com>
staging: rtl8712: fix use-after-free in rtl8712_dl_fw
Linus Torvalds <torvalds(a)linux-foundation.org>
btrfs: fix lzo_decompress_bio() kmap leakage
Marco Elver <elver(a)google.com>
kfence: default to dynamic branch instead of static keys mode
Marco Elver <elver(a)google.com>
kfence: always use static branches to guard kfence_alloc()
Todd Kjos <tkjos(a)google.com>
binder: don't detect sender/target during buffer cleanup
Todd Kjos <tkjos(a)google.com>
binder: use cred instead of task for getsecid
Todd Kjos <tkjos(a)google.com>
binder: use cred instead of task for selinux checks
Todd Kjos <tkjos(a)google.com>
binder: use euid from cred instead of using task
Kees Cook <keescook(a)chromium.org>
Revert "proc/wchan: use printk format instead of lookup_symbol_name()"
James Buren <braewoods+lkml(a)braewoods.net>
usb-storage: Add compatibility quirk flags for iODD 2531/2541
Viraj Shah <viraj.shah(a)linutronix.de>
usb: musb: Balance list entry in musb_gadget_queue
Geert Uytterhoeven <geert(a)linux-m68k.org>
usb: gadget: Mark USB_FSL_QE broken on 64-bit
Neal Liu <neal_liu(a)aspeedtech.com>
usb: ehci: handshake CMD_RUN instead of STS_HALT
Juergen Gross <jgross(a)suse.com>
Revert "x86/kvm: fix vcpu-id indexed array sizes"
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: x86: avoid warning with -Wbitwise-instead-of-logical
-------------
Diffstat:
Documentation/dev-tools/kfence.rst | 12 ++-
Makefile | 4 +-
arch/x86/kvm/ioapic.c | 2 +-
arch/x86/kvm/ioapic.h | 4 +-
arch/x86/kvm/mmu/spte.h | 7 +-
drivers/android/binder.c | 41 ++++------
drivers/android/binder_internal.h | 4 +
drivers/comedi/drivers/dt9812.c | 115 ++++++++++++++++++++-------
drivers/comedi/drivers/ni_usb6501.c | 10 +++
drivers/comedi/drivers/vmk80xx.c | 28 ++++---
drivers/net/wireless/rsi/rsi_91x_usb.c | 2 +-
drivers/staging/media/ipu3/ipu3-css-fw.c | 7 +-
drivers/staging/media/ipu3/ipu3-css-fw.h | 2 +-
drivers/staging/r8188eu/os_dep/ioctl_linux.c | 5 +-
drivers/staging/rtl8192u/r8192U_core.c | 18 ++---
drivers/staging/rtl8712/usb_intf.c | 4 +-
drivers/staging/rtl8712/usb_ops_linux.c | 2 +-
drivers/usb/gadget/udc/Kconfig | 1 +
drivers/usb/host/ehci-hcd.c | 11 ++-
drivers/usb/host/ehci-platform.c | 6 ++
drivers/usb/host/ehci.h | 1 +
drivers/usb/musb/musb_gadget.c | 4 +-
drivers/usb/storage/unusual_devs.h | 10 +++
fs/btrfs/lzo.c | 3 +-
fs/isofs/inode.c | 2 +
fs/proc/base.c | 19 +++--
include/linux/kfence.h | 21 ++---
include/linux/lsm_hook_defs.h | 14 ++--
include/linux/lsm_hooks.h | 14 ++--
include/linux/security.h | 33 ++++----
lib/Kconfig.kfence | 26 +++---
mm/kfence/core.c | 16 ++--
security/security.c | 14 ++--
security/selinux/hooks.c | 48 +++--------
34 files changed, 298 insertions(+), 212 deletions(-)
This is the start of the stable review cycle for the 5.14.18 release.
There are 24 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 12 Nov 2021 18:19:54 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.18-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.14.18-rc1
Johan Hovold <johan(a)kernel.org>
rsi: fix control-message timeout
Gustavo A. R. Silva <gustavoars(a)kernel.org>
media: staging/intel-ipu3: css: Fix wrong size comparison imgu_css_fw_init
Johan Hovold <johan(a)kernel.org>
staging: rtl8192u: fix control-message timeouts
Johan Hovold <johan(a)kernel.org>
staging: r8712u: fix control-message timeout
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix bulk and interrupt message timeouts
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix bulk-buffer overflow
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix transfer-buffer overflows
Johan Hovold <johan(a)kernel.org>
comedi: ni_usb6501: fix NULL-deref in command paths
Johan Hovold <johan(a)kernel.org>
comedi: dt9812: fix DMA buffers on stack
Jan Kara <jack(a)suse.cz>
isofs: Fix out of bound access for corrupted isofs image
Pavel Skripkin <paskripkin(a)gmail.com>
staging: rtl8712: fix use-after-free in rtl8712_dl_fw
Todd Kjos <tkjos(a)google.com>
binder: don't detect sender/target during buffer cleanup
Todd Kjos <tkjos(a)google.com>
binder: use cred instead of task for getsecid
Todd Kjos <tkjos(a)google.com>
binder: use cred instead of task for selinux checks
Todd Kjos <tkjos(a)google.com>
binder: use euid from cred instead of using task
Kees Cook <keescook(a)chromium.org>
Revert "proc/wchan: use printk format instead of lookup_symbol_name()"
James Buren <braewoods+lkml(a)braewoods.net>
usb-storage: Add compatibility quirk flags for iODD 2531/2541
Viraj Shah <viraj.shah(a)linutronix.de>
usb: musb: Balance list entry in musb_gadget_queue
Geert Uytterhoeven <geert(a)linux-m68k.org>
usb: gadget: Mark USB_FSL_QE broken on 64-bit
Neal Liu <neal_liu(a)aspeedtech.com>
usb: ehci: handshake CMD_RUN instead of STS_HALT
Juergen Gross <jgross(a)suse.com>
Revert "x86/kvm: fix vcpu-id indexed array sizes"
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: x86: avoid warning with -Wbitwise-instead-of-logical
Takashi Iwai <tiwai(a)suse.de>
ALSA: pci: cs46xx: Fix set up buffer type properly
Takashi Iwai <tiwai(a)suse.de>
ALSA: pcm: Check mmap capability of runtime dma buffer at first
-------------
Diffstat:
Makefile | 4 +-
arch/x86/kvm/ioapic.c | 2 +-
arch/x86/kvm/ioapic.h | 4 +-
arch/x86/kvm/mmu/spte.h | 7 +-
drivers/android/binder.c | 41 +++++------
drivers/android/binder_internal.h | 4 ++
drivers/comedi/drivers/dt9812.c | 115 +++++++++++++++++++++++--------
drivers/comedi/drivers/ni_usb6501.c | 10 +++
drivers/comedi/drivers/vmk80xx.c | 28 ++++----
drivers/net/wireless/rsi/rsi_91x_usb.c | 2 +-
drivers/staging/media/ipu3/ipu3-css-fw.c | 7 +-
drivers/staging/media/ipu3/ipu3-css-fw.h | 2 +-
drivers/staging/rtl8192u/r8192U_core.c | 18 ++---
drivers/staging/rtl8712/usb_intf.c | 4 +-
drivers/staging/rtl8712/usb_ops_linux.c | 2 +-
drivers/usb/gadget/udc/Kconfig | 1 +
drivers/usb/host/ehci-hcd.c | 11 ++-
drivers/usb/host/ehci-platform.c | 6 ++
drivers/usb/host/ehci.h | 1 +
drivers/usb/musb/musb_gadget.c | 4 +-
drivers/usb/storage/unusual_devs.h | 10 +++
fs/isofs/inode.c | 2 +
fs/proc/base.c | 19 ++---
include/linux/lsm_hook_defs.h | 14 ++--
include/linux/lsm_hooks.h | 14 ++--
include/linux/security.h | 33 +++++----
security/security.c | 14 ++--
security/selinux/hooks.c | 48 ++++---------
sound/core/pcm_native.c | 9 ++-
sound/pci/cs46xx/cs46xx_lib.c | 30 +++-----
30 files changed, 267 insertions(+), 199 deletions(-)
This is the start of the stable review cycle for the 4.14.255 release.
There are 22 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 12 Nov 2021 18:19:54 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.255-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.255-rc1
Johan Hovold <johan(a)kernel.org>
rsi: fix control-message timeout
Johan Hovold <johan(a)kernel.org>
staging: rtl8192u: fix control-message timeouts
Johan Hovold <johan(a)kernel.org>
staging: r8712u: fix control-message timeout
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix bulk and interrupt message timeouts
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix bulk-buffer overflow
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix transfer-buffer overflows
Johan Hovold <johan(a)kernel.org>
comedi: ni_usb6501: fix NULL-deref in command paths
Johan Hovold <johan(a)kernel.org>
comedi: dt9812: fix DMA buffers on stack
Jan Kara <jack(a)suse.cz>
isofs: Fix out of bound access for corrupted isofs image
Petr Mladek <pmladek(a)suse.com>
printk/console: Allow to disable console output by using console="" or console=null
James Buren <braewoods+lkml(a)braewoods.net>
usb-storage: Add compatibility quirk flags for iODD 2531/2541
Viraj Shah <viraj.shah(a)linutronix.de>
usb: musb: Balance list entry in musb_gadget_queue
Geert Uytterhoeven <geert(a)linux-m68k.org>
usb: gadget: Mark USB_FSL_QE broken on 64-bit
Juergen Gross <jgross(a)suse.com>
Revert "x86/kvm: fix vcpu-id indexed array sizes"
Ming Lei <ming.lei(a)redhat.com>
block: introduce multi-page bvec helpers
Mike Marciniszyn <mike.marciniszyn(a)cornelisnetworks.com>
IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
IB/qib: Use struct_size() helper
Wang Kefeng <wangkefeng.wang(a)huawei.com>
ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
Arnd Bergmann <arnd(a)arndb.de>
arch: pgtable: define MAX_POSSIBLE_PHYSMEM_BITS where needed
Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
mm/zsmalloc: Prepare to variable MAX_PHYSMEM_BITS
Dan Carpenter <dan.carpenter(a)oracle.com>
media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
Ming Lei <ming.lei(a)redhat.com>
scsi: core: Put LLD module refcnt after SCSI device is released
-------------
Diffstat:
Makefile | 4 +-
arch/arc/include/asm/pgtable.h | 2 +
arch/arm/include/asm/pgtable-2level.h | 2 +
arch/arm/include/asm/pgtable-3level.h | 2 +
arch/mips/include/asm/pgtable-32.h | 3 +
arch/powerpc/include/asm/pte-common.h | 2 +
arch/x86/include/asm/pgtable-3level_types.h | 1 +
arch/x86/include/asm/pgtable_64_types.h | 2 +
arch/x86/kvm/ioapic.c | 2 +-
arch/x86/kvm/ioapic.h | 4 +-
drivers/amba/bus.c | 3 -
drivers/infiniband/hw/qib/qib_user_sdma.c | 35 ++++++---
drivers/media/firewire/firedtv-avc.c | 14 +++-
drivers/media/firewire/firedtv-ci.c | 2 +
drivers/net/wireless/rsi/rsi_91x_usb.c | 2 +-
drivers/scsi/scsi.c | 4 +-
drivers/scsi/scsi_sysfs.c | 9 +++
drivers/staging/comedi/drivers/dt9812.c | 115 +++++++++++++++++++++-------
drivers/staging/comedi/drivers/ni_usb6501.c | 10 +++
drivers/staging/comedi/drivers/vmk80xx.c | 28 +++----
drivers/staging/rtl8192u/r8192U_core.c | 18 ++---
drivers/staging/rtl8712/usb_ops_linux.c | 2 +-
drivers/usb/gadget/udc/Kconfig | 1 +
drivers/usb/musb/musb_gadget.c | 4 +-
drivers/usb/storage/unusual_devs.h | 10 +++
fs/isofs/inode.c | 2 +
include/asm-generic/pgtable.h | 13 ++++
include/linux/bvec.h | 30 +++++++-
kernel/printk/printk.c | 9 ++-
mm/zsmalloc.c | 13 ++--
30 files changed, 262 insertions(+), 86 deletions(-)
This is the start of the stable review cycle for the 4.9.290 release.
There are 22 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 12 Nov 2021 18:19:54 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.290-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.290-rc1
Johan Hovold <johan(a)kernel.org>
rsi: fix control-message timeout
Johan Hovold <johan(a)kernel.org>
staging: rtl8192u: fix control-message timeouts
Johan Hovold <johan(a)kernel.org>
staging: r8712u: fix control-message timeout
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix bulk and interrupt message timeouts
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix bulk-buffer overflow
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix transfer-buffer overflows
Johan Hovold <johan(a)kernel.org>
comedi: ni_usb6501: fix NULL-deref in command paths
Johan Hovold <johan(a)kernel.org>
comedi: dt9812: fix DMA buffers on stack
Jan Kara <jack(a)suse.cz>
isofs: Fix out of bound access for corrupted isofs image
Petr Mladek <pmladek(a)suse.com>
printk/console: Allow to disable console output by using console="" or console=null
James Buren <braewoods+lkml(a)braewoods.net>
usb-storage: Add compatibility quirk flags for iODD 2531/2541
Viraj Shah <viraj.shah(a)linutronix.de>
usb: musb: Balance list entry in musb_gadget_queue
Geert Uytterhoeven <geert(a)linux-m68k.org>
usb: gadget: Mark USB_FSL_QE broken on 64-bit
Mike Marciniszyn <mike.marciniszyn(a)cornelisnetworks.com>
IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
IB/qib: Use struct_size() helper
Juergen Gross <jgross(a)suse.com>
Revert "x86/kvm: fix vcpu-id indexed array sizes"
Dongliang Mu <mudongliangabcd(a)gmail.com>
usb: hso: fix error handling code of hso_create_net_device
Andreas Kemnade <andreas(a)kemnade.info>
net: hso: register netdev later to avoid a race condition
Wang Kefeng <wangkefeng.wang(a)huawei.com>
ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
Arnd Bergmann <arnd(a)arndb.de>
arch: pgtable: define MAX_POSSIBLE_PHYSMEM_BITS where needed
Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
mm/zsmalloc: Prepare to variable MAX_PHYSMEM_BITS
Ming Lei <ming.lei(a)redhat.com>
scsi: core: Put LLD module refcnt after SCSI device is released
-------------
Diffstat:
Makefile | 4 +-
arch/arc/include/asm/pgtable.h | 2 +
arch/arm/include/asm/pgtable-2level.h | 2 +
arch/arm/include/asm/pgtable-3level.h | 2 +
arch/mips/include/asm/pgtable-32.h | 3 +
arch/powerpc/include/asm/pte-common.h | 2 +
arch/x86/include/asm/pgtable-3level_types.h | 1 +
arch/x86/kvm/ioapic.c | 2 +-
arch/x86/kvm/ioapic.h | 4 +-
drivers/amba/bus.c | 3 -
drivers/infiniband/hw/qib/qib_user_sdma.c | 35 ++++++---
drivers/net/usb/hso.c | 45 +++++++----
drivers/net/wireless/rsi/rsi_91x_usb.c | 2 +-
drivers/scsi/scsi.c | 4 +-
drivers/scsi/scsi_sysfs.c | 9 +++
drivers/staging/comedi/drivers/dt9812.c | 115 +++++++++++++++++++++-------
drivers/staging/comedi/drivers/ni_usb6501.c | 10 +++
drivers/staging/comedi/drivers/vmk80xx.c | 28 +++----
drivers/staging/rtl8192u/r8192U_core.c | 18 ++---
drivers/staging/rtl8712/usb_ops_linux.c | 2 +-
drivers/usb/gadget/udc/Kconfig | 1 +
drivers/usb/musb/musb_gadget.c | 4 +-
drivers/usb/storage/unusual_devs.h | 10 +++
fs/isofs/inode.c | 2 +
include/asm-generic/pgtable.h | 13 ++++
kernel/printk/printk.c | 9 ++-
mm/zsmalloc.c | 13 ++--
27 files changed, 249 insertions(+), 96 deletions(-)
This is the start of the stable review cycle for the 5.10.79 release.
There are 21 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 12 Nov 2021 18:19:54 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.79-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.79-rc1
Johan Hovold <johan(a)kernel.org>
rsi: fix control-message timeout
Gustavo A. R. Silva <gustavoars(a)kernel.org>
media: staging/intel-ipu3: css: Fix wrong size comparison imgu_css_fw_init
Johan Hovold <johan(a)kernel.org>
staging: rtl8192u: fix control-message timeouts
Johan Hovold <johan(a)kernel.org>
staging: r8712u: fix control-message timeout
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix bulk and interrupt message timeouts
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix bulk-buffer overflow
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix transfer-buffer overflows
Johan Hovold <johan(a)kernel.org>
comedi: ni_usb6501: fix NULL-deref in command paths
Johan Hovold <johan(a)kernel.org>
comedi: dt9812: fix DMA buffers on stack
Jan Kara <jack(a)suse.cz>
isofs: Fix out of bound access for corrupted isofs image
Pavel Skripkin <paskripkin(a)gmail.com>
staging: rtl8712: fix use-after-free in rtl8712_dl_fw
Petr Mladek <pmladek(a)suse.com>
printk/console: Allow to disable console output by using console="" or console=null
Todd Kjos <tkjos(a)google.com>
binder: don't detect sender/target during buffer cleanup
James Buren <braewoods+lkml(a)braewoods.net>
usb-storage: Add compatibility quirk flags for iODD 2531/2541
Viraj Shah <viraj.shah(a)linutronix.de>
usb: musb: Balance list entry in musb_gadget_queue
Geert Uytterhoeven <geert(a)linux-m68k.org>
usb: gadget: Mark USB_FSL_QE broken on 64-bit
Yang Shi <shy828301(a)gmail.com>
mm: filemap: check if THP has hwpoisoned subpage for PMD page fault
Yang Shi <shy828301(a)gmail.com>
mm: hwpoison: remove the unnecessary THP check
Neal Liu <neal_liu(a)aspeedtech.com>
usb: ehci: handshake CMD_RUN instead of STS_HALT
Juergen Gross <jgross(a)suse.com>
Revert "x86/kvm: fix vcpu-id indexed array sizes"
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: x86: avoid warning with -Wbitwise-instead-of-logical
-------------
Diffstat:
Makefile | 4 +-
arch/x86/kvm/ioapic.c | 2 +-
arch/x86/kvm/ioapic.h | 4 +-
arch/x86/kvm/mmu/mmu.c | 2 +-
drivers/android/binder.c | 14 ++--
drivers/net/wireless/rsi/rsi_91x_usb.c | 2 +-
drivers/staging/comedi/drivers/dt9812.c | 115 +++++++++++++++++++++-------
drivers/staging/comedi/drivers/ni_usb6501.c | 10 +++
drivers/staging/comedi/drivers/vmk80xx.c | 28 +++----
drivers/staging/media/ipu3/ipu3-css-fw.c | 7 +-
drivers/staging/media/ipu3/ipu3-css-fw.h | 2 +-
drivers/staging/rtl8192u/r8192U_core.c | 18 ++---
drivers/staging/rtl8712/usb_intf.c | 4 +-
drivers/staging/rtl8712/usb_ops_linux.c | 2 +-
drivers/usb/gadget/udc/Kconfig | 1 +
drivers/usb/host/ehci-hcd.c | 11 ++-
drivers/usb/host/ehci-platform.c | 6 ++
drivers/usb/host/ehci.h | 1 +
drivers/usb/musb/musb_gadget.c | 4 +-
drivers/usb/storage/unusual_devs.h | 10 +++
fs/isofs/inode.c | 2 +
include/linux/page-flags.h | 23 ++++++
kernel/printk/printk.c | 9 ++-
mm/huge_memory.c | 2 +
mm/memory-failure.c | 28 +++----
mm/memory.c | 9 +++
mm/page_alloc.c | 4 +-
27 files changed, 233 insertions(+), 91 deletions(-)
This is the start of the stable review cycle for the 4.4.292 release.
There are 19 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 12 Nov 2021 18:19:54 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.292-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.292-rc1
Johan Hovold <johan(a)kernel.org>
rsi: fix control-message timeout
Johan Hovold <johan(a)kernel.org>
staging: rtl8192u: fix control-message timeouts
Johan Hovold <johan(a)kernel.org>
staging: r8712u: fix control-message timeout
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix bulk and interrupt message timeouts
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix bulk-buffer overflow
Johan Hovold <johan(a)kernel.org>
comedi: vmk80xx: fix transfer-buffer overflows
Cheah Kok Cheong <thrust73(a)gmail.com>
staging: comedi: drivers: replace le16_to_cpu() with usb_endpoint_maxp()
Johan Hovold <johan(a)kernel.org>
comedi: ni_usb6501: fix NULL-deref in command paths
Johan Hovold <johan(a)kernel.org>
comedi: dt9812: fix DMA buffers on stack
Jan Kara <jack(a)suse.cz>
isofs: Fix out of bound access for corrupted isofs image
Dongliang Mu <mudongliangabcd(a)gmail.com>
usb: hso: fix error handling code of hso_create_net_device
Petr Mladek <pmladek(a)suse.com>
printk/console: Allow to disable console output by using console="" or console=null
James Buren <braewoods+lkml(a)braewoods.net>
usb-storage: Add compatibility quirk flags for iODD 2531/2541
Geert Uytterhoeven <geert(a)linux-m68k.org>
usb: gadget: Mark USB_FSL_QE broken on 64-bit
Mike Marciniszyn <mike.marciniszyn(a)cornelisnetworks.com>
IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
IB/qib: Use struct_size() helper
Andreas Kemnade <andreas(a)kemnade.info>
net: hso: register netdev later to avoid a race condition
Wang Kefeng <wangkefeng.wang(a)huawei.com>
ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
Ming Lei <ming.lei(a)redhat.com>
scsi: core: Put LLD module refcnt after SCSI device is released
-------------
Diffstat:
Makefile | 4 +-
drivers/amba/bus.c | 3 -
drivers/infiniband/hw/qib/qib_user_sdma.c | 35 +++++---
drivers/net/usb/hso.c | 45 +++++++----
drivers/net/wireless/rsi/rsi_91x_usb.c | 2 +-
drivers/scsi/scsi.c | 4 +-
drivers/scsi/scsi_sysfs.c | 9 +++
drivers/staging/comedi/drivers/dt9812.c | 119 ++++++++++++++++++++--------
drivers/staging/comedi/drivers/ni_usb6501.c | 14 +++-
drivers/staging/comedi/drivers/vmk80xx.c | 34 ++++----
drivers/staging/rtl8192u/r8192U_core.c | 18 ++---
drivers/staging/rtl8712/usb_ops_linux.c | 2 +-
drivers/usb/gadget/udc/Kconfig | 1 +
drivers/usb/storage/unusual_devs.h | 10 +++
fs/isofs/inode.c | 2 +
kernel/printk/printk.c | 9 ++-
16 files changed, 218 insertions(+), 93 deletions(-)
I'm announcing the release of the 4.4.292 kernel.
All users of the 4.4 kernel series must upgrade.
The updated 4.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
drivers/amba/bus.c | 3
drivers/infiniband/hw/qib/qib_user_sdma.c | 35 +++++---
drivers/net/usb/hso.c | 45 ++++++----
drivers/net/wireless/rsi/rsi_91x_usb.c | 2
drivers/scsi/scsi.c | 4
drivers/scsi/scsi_sysfs.c | 9 ++
drivers/staging/comedi/drivers/dt9812.c | 119 ++++++++++++++++++++--------
drivers/staging/comedi/drivers/ni_usb6501.c | 14 ++-
drivers/staging/comedi/drivers/vmk80xx.c | 34 ++++----
drivers/staging/rtl8192u/r8192U_core.c | 18 ++--
drivers/staging/rtl8712/usb_ops_linux.c | 2
drivers/usb/gadget/udc/Kconfig | 1
drivers/usb/storage/unusual_devs.h | 10 ++
fs/isofs/inode.c | 2
kernel/printk/printk.c | 9 +-
16 files changed, 217 insertions(+), 92 deletions(-)
Andreas Kemnade (1):
net: hso: register netdev later to avoid a race condition
Cheah Kok Cheong (1):
staging: comedi: drivers: replace le16_to_cpu() with usb_endpoint_maxp()
Dongliang Mu (1):
usb: hso: fix error handling code of hso_create_net_device
Geert Uytterhoeven (1):
usb: gadget: Mark USB_FSL_QE broken on 64-bit
Greg Kroah-Hartman (1):
Linux 4.4.292
Gustavo A. R. Silva (1):
IB/qib: Use struct_size() helper
James Buren (1):
usb-storage: Add compatibility quirk flags for iODD 2531/2541
Jan Kara (1):
isofs: Fix out of bound access for corrupted isofs image
Johan Hovold (8):
comedi: dt9812: fix DMA buffers on stack
comedi: ni_usb6501: fix NULL-deref in command paths
comedi: vmk80xx: fix transfer-buffer overflows
comedi: vmk80xx: fix bulk-buffer overflow
comedi: vmk80xx: fix bulk and interrupt message timeouts
staging: r8712u: fix control-message timeout
staging: rtl8192u: fix control-message timeouts
rsi: fix control-message timeout
Mike Marciniszyn (1):
IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
Ming Lei (1):
scsi: core: Put LLD module refcnt after SCSI device is released
Petr Mladek (1):
printk/console: Allow to disable console output by using console="" or console=null
Wang Kefeng (1):
ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
A test of the form:
while true; do modprobe -r cxl_pmem; modprobe cxl_pmem; done
May lead to a crash signature of the form:
BUG: unable to handle page fault for address: ffffffffc0660030
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
[..]
Workqueue: cxl_pmem 0xffffffffc0660030
RIP: 0010:0xffffffffc0660030
Code: Unable to access opcode bytes at RIP 0xffffffffc0660006.
[..]
Call Trace:
? process_one_work+0x4ec/0x9c0
? pwq_dec_nr_in_flight+0x100/0x100
? rwlock_bug.part.0+0x60/0x60
? worker_thread+0x2eb/0x700
In that report the 0xffffffffc0660030 address corresponds to the former
function address of cxl_nvb_update_state() from a previous load of the
module, not the current address. Fix that by arranging for ->state_work
in the 'struct cxl_nvdimm_bridge' object to be reinitialized on cxl_pmem
module reload.
Details:
Recall that CXL subsystem wants to link a CXL memory expander device to
an NVDIMM sub-hierarchy when both a persistent memory range has been
registered by the CXL platform driver (cxl_acpi) *and* when that CXL
memory expander has published persistent memory capacity (Get Partition
Info). To this end the cxl_nvdimm_bridge driver arranges to rescan the
CXL bus when either of those conditions change. The helper
bus_rescan_devices() can not be called underneath the device_lock() for
any device on that bus, so the cxl_nvdimm_bridge driver uses a workqueue
for the rescan.
Typically a driver allocates driver data to hold a 'struct work_struct'
for a driven device, but for a workqueue that may run after ->remove()
returns, driver data will have been freed. The 'struct
cxl_nvdimm_bridge' object holds the state and work_struct directly.
Unfortunately it was only arranging for that infrastructure to be
initialized once per device creation rather than the necessary once per
workqueue (cxl_pmem_wq) creation.
Introduce is_cxl_nvdimm_bridge() and cxl_nvdimm_bridge_reset() in
support of invalidating stale references to a recently destroyed
cxl_pmem_wq.
Cc: <stable(a)vger.kernel.org>
Fixes: 8fdcb1704f61 ("cxl/pmem: Add initial infrastructure for pmem support")
Reported-by: Vishal Verma <vishal.l.verma(a)intel.com>
Signed-off-by: Dan Williams <dan.j.williams(a)intel.com>
---
drivers/cxl/core/pmem.c | 8 +++++++-
drivers/cxl/cxl.h | 8 ++++++++
drivers/cxl/pmem.c | 29 +++++++++++++++++++++++++++--
3 files changed, 42 insertions(+), 3 deletions(-)
diff --git a/drivers/cxl/core/pmem.c b/drivers/cxl/core/pmem.c
index 76a4fa39834c..cc402cb7a905 100644
--- a/drivers/cxl/core/pmem.c
+++ b/drivers/cxl/core/pmem.c
@@ -51,10 +51,16 @@ struct cxl_nvdimm_bridge *to_cxl_nvdimm_bridge(struct device *dev)
}
EXPORT_SYMBOL_NS_GPL(to_cxl_nvdimm_bridge, CXL);
-__mock int match_nvdimm_bridge(struct device *dev, const void *data)
+bool is_cxl_nvdimm_bridge(struct device *dev)
{
return dev->type == &cxl_nvdimm_bridge_type;
}
+EXPORT_SYMBOL_NS_GPL(is_cxl_nvdimm_bridge, CXL);
+
+__mock int match_nvdimm_bridge(struct device *dev, const void *data)
+{
+ return is_cxl_nvdimm_bridge(dev);
+}
struct cxl_nvdimm_bridge *cxl_find_nvdimm_bridge(struct cxl_nvdimm *cxl_nvd)
{
diff --git a/drivers/cxl/cxl.h b/drivers/cxl/cxl.h
index 5e2e93451928..ca979ee11017 100644
--- a/drivers/cxl/cxl.h
+++ b/drivers/cxl/cxl.h
@@ -221,6 +221,13 @@ struct cxl_decoder {
};
+/**
+ * enum cxl_nvdimm_brige_state - state machine for managing bus rescans
+ * @CXL_NVB_NEW: Set at bridge create and after cxl_pmem_wq is destroyed
+ * @CXL_NVB_DEAD: Set at brige unregistration to preclude async probing
+ * @CXL_NVB_ONLINE: Target state after successful ->probe()
+ * @CXL_NVB_OFFLINE: Target state after ->remove() or failed ->probe()
+ */
enum cxl_nvdimm_brige_state {
CXL_NVB_NEW,
CXL_NVB_DEAD,
@@ -333,6 +340,7 @@ struct cxl_nvdimm_bridge *devm_cxl_add_nvdimm_bridge(struct device *host,
struct cxl_port *port);
struct cxl_nvdimm *to_cxl_nvdimm(struct device *dev);
bool is_cxl_nvdimm(struct device *dev);
+bool is_cxl_nvdimm_bridge(struct device *dev);
int devm_cxl_add_nvdimm(struct device *host, struct cxl_memdev *cxlmd);
struct cxl_nvdimm_bridge *cxl_find_nvdimm_bridge(struct cxl_nvdimm *cxl_nvd);
diff --git a/drivers/cxl/pmem.c b/drivers/cxl/pmem.c
index 17e82ae90456..b65a272a2d6d 100644
--- a/drivers/cxl/pmem.c
+++ b/drivers/cxl/pmem.c
@@ -315,6 +315,31 @@ static struct cxl_driver cxl_nvdimm_bridge_driver = {
.id = CXL_DEVICE_NVDIMM_BRIDGE,
};
+/*
+ * Return all bridges to the CXL_NVB_NEW state to invalidate any
+ * ->state_work referring to the now destroyed cxl_pmem_wq.
+ */
+static int cxl_nvdimm_bridge_reset(struct device *dev, void *data)
+{
+ struct cxl_nvdimm_bridge *cxl_nvb;
+
+ if (!is_cxl_nvdimm_bridge(dev))
+ return 0;
+
+ cxl_nvb = to_cxl_nvdimm_bridge(dev);
+ device_lock(dev);
+ cxl_nvb->state = CXL_NVB_NEW;
+ device_unlock(dev);
+
+ return 0;
+}
+
+static void destroy_cxl_pmem_wq(void)
+{
+ destroy_workqueue(cxl_pmem_wq);
+ bus_for_each_dev(&cxl_bus_type, NULL, NULL, cxl_nvdimm_bridge_reset);
+}
+
static __init int cxl_pmem_init(void)
{
int rc;
@@ -340,7 +365,7 @@ static __init int cxl_pmem_init(void)
err_nvdimm:
cxl_driver_unregister(&cxl_nvdimm_bridge_driver);
err_bridge:
- destroy_workqueue(cxl_pmem_wq);
+ destroy_cxl_pmem_wq();
return rc;
}
@@ -348,7 +373,7 @@ static __exit void cxl_pmem_exit(void)
{
cxl_driver_unregister(&cxl_nvdimm_driver);
cxl_driver_unregister(&cxl_nvdimm_bridge_driver);
- destroy_workqueue(cxl_pmem_wq);
+ destroy_cxl_pmem_wq();
}
MODULE_LICENSE("GPL v2");
From: Mark Rutland <mark.rutland(a)arm.com>
Since ARMv8.0 the upper 32 bits of ESR_ELx have been RES0, and recently
some of the upper bits gained a meaning and can be non-zero. For
example, when FEAT_LS64 is implemented, ESR_ELx[36:32] contain ISS2,
which for an ST64BV or ST64BV0 can be non-zero. This can be seen in ARM
DDI 0487G.b, page D13-3145, section D13.2.37.
Generally, we must not rely on RES0 bit remaining zero in future, and
when extracting ESR_ELx.EC we must mask out all other bits.
All C code uses the ESR_ELx_EC() macro, which masks out the irrelevant
bits, and therefore no alterations are required to C code to avoid
consuming irrelevant bits.
In a couple of places the KVM assembly extracts ESR_ELx.EC using LSR on
an X register, and so could in theory consume previously RES0 bits. In
both cases this is for comparison with EC values ESR_ELx_EC_HVC32 and
ESR_ELx_EC_HVC64, for which the upper bits of ESR_ELx must currently be
zero, but this could change in future.
This patch adjusts the KVM vectors to use UBFX rather than LSR to
extract ESR_ELx.EC, ensuring these are robust to future additions to
ESR_ELx.
Cc: stable(a)vger.kernel.org
Signed-off-by: Mark Rutland <mark.rutland(a)arm.com>
Cc: Alexandru Elisei <alexandru.elisei(a)arm.com>
Cc: Catalin Marinas <catalin.marinas(a)arm.com>
Cc: James Morse <james.morse(a)arm.com>
Cc: Marc Zyngier <maz(a)kernel.org>
Cc: Suzuki K Poulose <suzuki.poulose(a)arm.com>
Cc: Will Deacon <will(a)kernel.org>
Acked-by: Will Deacon <will(a)kernel.org>
Signed-off-by: Marc Zyngier <maz(a)kernel.org>
Link: https://lore.kernel.org/r/20211103110545.4613-1-mark.rutland@arm.com
---
arch/arm64/include/asm/esr.h | 1 +
arch/arm64/kvm/hyp/hyp-entry.S | 2 +-
arch/arm64/kvm/hyp/nvhe/host.S | 2 +-
3 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/include/asm/esr.h b/arch/arm64/include/asm/esr.h
index 29f97eb3dad4..8f59bbeba7a7 100644
--- a/arch/arm64/include/asm/esr.h
+++ b/arch/arm64/include/asm/esr.h
@@ -68,6 +68,7 @@
#define ESR_ELx_EC_MAX (0x3F)
#define ESR_ELx_EC_SHIFT (26)
+#define ESR_ELx_EC_WIDTH (6)
#define ESR_ELx_EC_MASK (UL(0x3F) << ESR_ELx_EC_SHIFT)
#define ESR_ELx_EC(esr) (((esr) & ESR_ELx_EC_MASK) >> ESR_ELx_EC_SHIFT)
diff --git a/arch/arm64/kvm/hyp/hyp-entry.S b/arch/arm64/kvm/hyp/hyp-entry.S
index 9aa9b73475c9..b6b6801d96d5 100644
--- a/arch/arm64/kvm/hyp/hyp-entry.S
+++ b/arch/arm64/kvm/hyp/hyp-entry.S
@@ -44,7 +44,7 @@
el1_sync: // Guest trapped into EL2
mrs x0, esr_el2
- lsr x0, x0, #ESR_ELx_EC_SHIFT
+ ubfx x0, x0, #ESR_ELx_EC_SHIFT, #ESR_ELx_EC_WIDTH
cmp x0, #ESR_ELx_EC_HVC64
ccmp x0, #ESR_ELx_EC_HVC32, #4, ne
b.ne el1_trap
diff --git a/arch/arm64/kvm/hyp/nvhe/host.S b/arch/arm64/kvm/hyp/nvhe/host.S
index 0c6116d34e18..3d613e721a75 100644
--- a/arch/arm64/kvm/hyp/nvhe/host.S
+++ b/arch/arm64/kvm/hyp/nvhe/host.S
@@ -141,7 +141,7 @@ SYM_FUNC_END(__host_hvc)
.L__vect_start\@:
stp x0, x1, [sp, #-16]!
mrs x0, esr_el2
- lsr x0, x0, #ESR_ELx_EC_SHIFT
+ ubfx x0, x0, #ESR_ELx_EC_SHIFT, #ESR_ELx_EC_WIDTH
cmp x0, #ESR_ELx_EC_HVC64
b.eq __host_hvc
b __host_exit
--
2.30.2
When reporting IOMAP_INLINE extents, filesystems set iomap->length to
the length of iomap->inline_data. For reading that into the page cache,
function iomap_read_inline_data copies the inline data, zeroes out the
rest of the page, and marks the entire page up-to-date.
Before commit 740499c78408 ("iomap: fix the iomap_readpage_actor return
value for inline data"), when hitting an IOMAP_INLINE extent,
iomap_readpage_actor would report having read the entire page. Since
then, it only reports having read the inline data (iomap->length).
This will force iomap_readpage into another iteration, and the
filesystem will report an unaligned hole after the IOMAP_INLINE extent.
But iomap_readpage_actor (now iomap_readpage_iter) isn't prepared to
deal with unaligned extents, it will get things wrong on filesystems
with a block size smaller than the page size, and we'll eventually run
into the following warning in iomap_iter_advance:
WARN_ON_ONCE(iter->processed > iomap_length(iter));
Fix that by changing iomap_readpage_iter back to report that we've read
the entire page, which avoids having to deal with unaligned extents. To
prevent iomap from complaining about running past the end of the extent,
fix up the extent size as well.
Fixes: 740499c78408 ("iomap: fix the iomap_readpage_actor return value for inline data")
Cc: stable(a)vger.kernel.org # v5.15+
Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com>
---
fs/iomap/buffered-io.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
index 1753c26c8e76..de3fcd2522a2 100644
--- a/fs/iomap/buffered-io.c
+++ b/fs/iomap/buffered-io.c
@@ -244,10 +244,10 @@ static inline bool iomap_block_needs_zeroing(const struct iomap_iter *iter,
pos >= i_size_read(iter->inode);
}
-static loff_t iomap_readpage_iter(const struct iomap_iter *iter,
+static loff_t iomap_readpage_iter(struct iomap_iter *iter,
struct iomap_readpage_ctx *ctx, loff_t offset)
{
- const struct iomap *iomap = &iter->iomap;
+ struct iomap *iomap = &iter->iomap;
loff_t pos = iter->pos + offset;
loff_t length = iomap_length(iter) - offset;
struct page *page = ctx->cur_page;
@@ -256,8 +256,15 @@ static loff_t iomap_readpage_iter(const struct iomap_iter *iter,
unsigned poff, plen;
sector_t sector;
- if (iomap->type == IOMAP_INLINE)
- return min(iomap_read_inline_data(iter, page), length);
+ if (iomap->type == IOMAP_INLINE) {
+ /*
+ * The filesystem sets iomap->length to the size of the inline
+ * data. We're at the end of the file, so we know that the
+ * rest of the page needs to be zeroed out.
+ */
+ iomap->length = iomap_read_inline_data(iter, page);
+ return iomap->length;
+ }
/* zero post-eof blocks as the page may be mapped */
iop = iomap_page_create(iter->inode, page);
@@ -352,7 +359,7 @@ iomap_readpage(struct page *page, const struct iomap_ops *ops)
}
EXPORT_SYMBOL_GPL(iomap_readpage);
-static loff_t iomap_readahead_iter(const struct iomap_iter *iter,
+static loff_t iomap_readahead_iter(struct iomap_iter *iter,
struct iomap_readpage_ctx *ctx)
{
loff_t length = iomap_length(iter);
--
2.31.1
Hi Linus,
My testing has been failing for the last few days. Last good test was
with 6f2b76a4a384 and I started seeing the failure with ce840177930f5
where boot timeout.
Last good test - https://openqa.qa.codethink.co.uk/tests/323
Failing test - https://openqa.qa.codethink.co.uk/tests/335
Saw a similar issue with 5.10.79-rc1 today and bisect showed the
problem with 8615ff6dd1ac but that was already in the last good test I
had.
I will do a bisect tonight and let you know the result.
--
Regards
Sudip
Commit 6098475d4cb4 ("spi: Fix deadlock when adding SPI controllers on
SPI buses") introduced a per-controller mutex. But mutex_unlock() of
said lock is called after the controller is already freed:
spi_unregister_controller(ctlr)
-> put_device(&ctlr->dev)
-> spi_controller_release(dev)
-> mutex_unlock(&ctrl->add_lock)
Move the put_device() after the mutex_unlock().
Fixes: 6098475d4cb4 ("spi: Fix deadlock when adding SPI controllers on SPI buses")
Signed-off-by: Michael Walle <michael(a)walle.cc>
Reviewed-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
Reviewed-by: Lukas Wunner <lukas(a)wunner.de>
Cc: stable(a)vger.kernel.org # v5.15
---
changes since RFC:
- fix call graph indendation in commit message
drivers/spi/spi.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index b23e675953e1..fdd530b150a7 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -3099,12 +3099,6 @@ void spi_unregister_controller(struct spi_controller *ctlr)
device_del(&ctlr->dev);
- /* Release the last reference on the controller if its driver
- * has not yet been converted to devm_spi_alloc_master/slave().
- */
- if (!ctlr->devm_allocated)
- put_device(&ctlr->dev);
-
/* free bus id */
mutex_lock(&board_lock);
if (found == ctlr)
@@ -3113,6 +3107,12 @@ void spi_unregister_controller(struct spi_controller *ctlr)
if (IS_ENABLED(CONFIG_SPI_DYNAMIC))
mutex_unlock(&ctlr->add_lock);
+
+ /* Release the last reference on the controller if its driver
+ * has not yet been converted to devm_spi_alloc_master/slave().
+ */
+ if (!ctlr->devm_allocated)
+ put_device(&ctlr->dev);
}
EXPORT_SYMBOL_GPL(spi_unregister_controller);
--
2.30.2
Hi Sjoerd,
On 05/11/2021 08:10, Sjoerd Simons wrote:
> Hostfs was not setting up the backing device information, which means it
> uses the noop bdi. The noop bdi does not have the writeback capability
> enabled, which in turns means dirty pages never got written back to
> storage.
>
> In other words programs using mmap to write to files on hostfs never
> actually got their data written out...
>
> Fix this by simply setting up the bdi with default settings as all the
> required code for writeback is already in place.
>
> Signed-off-by: Sjoerd Simons <sjoerd(a)collabora.com>
Cc: stable(a)vger.kernel.org
Reviewed-by: Christopher Obbard <chris.obbard(a)collabora.com>
...replying mainly as I wonder if adding the stable tag in a reply will
make the patch appear in stable (obviously once it is in mainline) ? :-)
>
> ---
>
> fs/hostfs/hostfs_kern.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
> index d5c9d886cd9f..ef481c3d9019 100644
> --- a/fs/hostfs/hostfs_kern.c
> +++ b/fs/hostfs/hostfs_kern.c
> @@ -924,6 +924,9 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent)
> sb->s_op = &hostfs_sbops;
> sb->s_d_op = &simple_dentry_operations;
> sb->s_maxbytes = MAX_LFS_FILESIZE;
> + err = super_setup_bdi(sb);
> + if (err)
> + goto out;
>
> /* NULL is printed as '(null)' by printf(): avoid that. */
> if (req_root == NULL)
>
The efifb and simplefb drivers just render to a pre-allocated frame buffer
and rely on the display hardware being initialized before the kernel boots.
But if another driver already probed correctly and registered a fbdev, the
generic drivers shouldn't be probed since an actual driver for the display
hardware is already present.
This is more likely to occur after commit d391c5827107 ("drivers/firmware:
move x86 Generic System Framebuffers support") since the "efi-framebuffer"
and "simple-framebuffer" platform devices are registered at a later time.
Link: https://lore.kernel.org/r/20211110200253.rfudkt3edbd3nsyj@lahvuun/
Fixes: d391c5827107 ("drivers/firmware: move x86 Generic System Framebuffers support")
Reported-by: Ilya Trukhanov <lahvuun(a)gmail.com>
Cc: <stable(a)vger.kernel.org> # 5.15.x
Signed-off-by: Javier Martinez Canillas <javierm(a)redhat.com>
Reviewed-by: Daniel Vetter <daniel.vetter(a)ffwll.ch>
---
Changes in v3:
- Cc <stable(a)vger.kernel.org> since a Fixes: tag is not enough (gregkh).
Changes in v2:
- Add a Link: tag with a reference to the bug report (Thorsten Leemhuis).
- Add a comment explaining why the probe fails earlier (Daniel Vetter).
- Add a Fixes: tag for stable to pick the fix (Daniel Vetter).
- Add Daniel Vetter's Reviewed-by: tag.
- Improve the commit message and mention the culprit commit
drivers/video/fbdev/efifb.c | 11 +++++++++++
drivers/video/fbdev/simplefb.c | 11 +++++++++++
2 files changed, 22 insertions(+)
diff --git drivers/video/fbdev/efifb.c drivers/video/fbdev/efifb.c
index edca3703b964..ea42ba6445b2 100644
--- drivers/video/fbdev/efifb.c
+++ drivers/video/fbdev/efifb.c
@@ -351,6 +351,17 @@ static int efifb_probe(struct platform_device *dev)
char *option = NULL;
efi_memory_desc_t md;
+ /*
+ * Generic drivers must not be registered if a framebuffer exists.
+ * If a native driver was probed, the display hardware was already
+ * taken and attempting to use the system framebuffer is dangerous.
+ */
+ if (num_registered_fb > 0) {
+ dev_err(&dev->dev,
+ "efifb: a framebuffer is already registered\n");
+ return -EINVAL;
+ }
+
if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI || pci_dev_disabled)
return -ENODEV;
diff --git drivers/video/fbdev/simplefb.c drivers/video/fbdev/simplefb.c
index 62f0ded70681..b63074fd892e 100644
--- drivers/video/fbdev/simplefb.c
+++ drivers/video/fbdev/simplefb.c
@@ -407,6 +407,17 @@ static int simplefb_probe(struct platform_device *pdev)
struct simplefb_par *par;
struct resource *mem;
+ /*
+ * Generic drivers must not be registered if a framebuffer exists.
+ * If a native driver was probed, the display hardware was already
+ * taken and attempting to use the system framebuffer is dangerous.
+ */
+ if (num_registered_fb > 0) {
+ dev_err(&pdev->dev,
+ "simplefb: a framebuffer is already registered\n");
+ return -EINVAL;
+ }
+
if (fb_get_options("simplefb", NULL))
return -ENODEV;
--
2.33.1
Suspend-to-RAM with elogind under Wayland stopped working in 5.15.
This occurs with 5.15, 5.15.1 and latest master at
89d714ab6043bca7356b5c823f5335f5dce1f930. 5.14 and earlier releases work
fine.
git bisect gives d391c58271072d0b0fad93c82018d495b2633448.
To reproduce:
- Use elogind and Linux 5.15.1 with CONFIG_SYSFB_SIMPLEFB=n.
- Start a Wayland session. I tested sway and weston, neither worked.
- In a terminal emulator (I used alacritty) execute `loginctl suspend`.
Normally after the last step the system would suspend, but it no longer
does so after I upgraded to Linux 5.15. After running `loginctl suspend`
in dmesg I get the following:
[ 103.098782] elogind-daemon[2357]: Suspending system...
[ 103.098794] PM: suspend entry (deep)
[ 103.124621] Filesystems sync: 0.025 seconds
But nothing happens afterwards.
Suspend works as expected if I do any of the following:
- Revert d391c58271072d0b0fad93c82018d495b2633448.
- Build with CONFIG_SYSFB_SIMPLEFB=y.
- Suspend from tty, even if a Wayland session is running in parallel.
- Suspend from under an X11 session.
- Suspend with `echo mem > /sys/power/state`.
If I attach strace to the elogind-daemon process after running
`loginctl suspend` then the system immediately suspends. However, if
I attach strace *prior* to running `loginctl suspend` then no suspend,
and the process gets stuck on a write syscall to `/sys/power/state`.
I "traced" a little bit with printk (sorry, I don't know of a better
way) and the call chain is as follows:
state_store -> pm_suspend -> enter_state -> suspend_prepare
-> pm_prepare_console -> vt_move_to_console -> vt_waitactive
-> __vt_event_wait
__vt_event_wait just waits until wait_event_interruptible completes, but
it never does (not until I attach to elogind-daemon with strace, at
least). I did not follow the chain further.
- Linux version 5.15.1 (lahvuun@lahvuun) (gcc (Gentoo 11.2.0 p1) 11.2.0,
GNU ld (Gentoo 2.37_p1 p0) 2.37) #51 SMP PREEMPT Tue Nov 9 23:39:25
EET 2021
- Gentoo Linux 2.8
- x86_64 AuthenticAMD
- dmesg: https://pastebin.com/duj33bY8
- .config: https://pastebin.com/7Hew1g0T
Newer DMUB firmware on Renoir and Green Sardine do not need to disable dmcu
and this actually causes problems with DP-C alt mode for a number of machines.
Backport the fix from this from mainline. It's a hand modified backport because
mainline switched to IP version checking which doesn't exist in linux-stable.
BugLink: https://gitlab.freedesktop.org/drm/amd/-/issues/1772
BugLink: https://gitlab.freedesktop.org/drm/amd/-/issues/1735
Signed-off-by: Mario Limonciello <mario.limonciello(a)amd.com>
Reviewed-by: Alex Deucher <alexander.deucher(a)amd.com>
---
Resend, also pick up Alex's tag from last submission
This was previously sent to stable(a)kernel.org not stable(a)vger.kernel.org.
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 1ea31dcc7a8b..084491afe540 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -1141,8 +1141,15 @@ static int amdgpu_dm_init(struct amdgpu_device *adev)
case CHIP_RAVEN:
case CHIP_RENOIR:
init_data.flags.gpu_vm_support = true;
- if (ASICREV_IS_GREEN_SARDINE(adev->external_rev_id))
+ switch (adev->dm.dmcub_fw_version) {
+ case 0: /* development */
+ case 0x1: /* linux-firmware.git hash 6d9f399 */
+ case 0x01000000: /* linux-firmware.git hash 9a0b0f4 */
+ init_data.flags.disable_dmcu = false;
+ break;
+ default:
init_data.flags.disable_dmcu = true;
+ }
break;
case CHIP_VANGOGH:
case CHIP_YELLOW_CARP:
--
2.25.1
The SGX driver maintains a single global free page counter,
sgx_nr_free_pages, that reflects the number of free pages available
across all NUMA nodes. Correspondingly, a list of free pages is
associated with each NUMA node and sgx_nr_free_pages is updated
every time a page is added or removed from any of the free page
lists. The main usage of sgx_nr_free_pages is by the reclaimer
that will run when it (sgx_nr_free_pages) goes below a watermark
to ensure that there are always some free pages available to, for
example, support efficient page faults.
With sgx_nr_free_pages accessed and modified from a few places
it is essential to ensure that these accesses are done safely but
this is not the case. sgx_nr_free_pages is read without any
protection and updated with inconsistent protection by any one
of the spin locks associated with the individual NUMA nodes.
For example:
CPU_A CPU_B
----- -----
spin_lock(&nodeA->lock); spin_lock(&nodeB->lock);
... ...
sgx_nr_free_pages--; /* NOT SAFE */ sgx_nr_free_pages--;
spin_unlock(&nodeA->lock); spin_unlock(&nodeB->lock);
The consequence of sgx_nr_free_pages not being protected is that
its value may not accurately reflect the actual number of free
pages on the system, impacting the availability of free pages in
support of many flows. The problematic scenario is when the
reclaimer does not run because it believes there to be sufficient
free pages while any attempt to allocate a page fails because there
are no free pages available.
The worst scenario observed was a user space hang because of
repeated page faults caused by no free pages made available.
The following flow was encountered:
asm_exc_page_fault
...
sgx_vma_fault()
sgx_encl_load_page()
sgx_encl_eldu() // Encrypted page needs to be loaded from backing
// storage into newly allocated SGX memory page
sgx_alloc_epc_page() // Allocate a page of SGX memory
__sgx_alloc_epc_page() // Fails, no free SGX memory
...
if (sgx_should_reclaim(SGX_NR_LOW_PAGES)) // Wake reclaimer
wake_up(&ksgxd_waitq);
return -EBUSY; // Return -EBUSY giving reclaimer time to run
return -EBUSY;
return -EBUSY;
return VM_FAULT_NOPAGE;
The reclaimer is triggered in above flow with the following code:
static bool sgx_should_reclaim(unsigned long watermark)
{
return sgx_nr_free_pages < watermark &&
!list_empty(&sgx_active_page_list);
}
In the problematic scenario there were no free pages available yet the
value of sgx_nr_free_pages was above the watermark. The allocation of
SGX memory thus always failed because of a lack of free pages while no
free pages were made available because the reclaimer is never started
because of sgx_nr_free_pages' incorrect value. The consequence was that
user space kept encountering VM_FAULT_NOPAGE that caused the same
address to be accessed repeatedly with the same result.
Change the global free page counter to an atomic type that
ensures simultaneous updates are done safely. While doing so, move
the updating of the variable outside of the spin lock critical
section to which it does not belong.
Cc: stable(a)vger.kernel.org
Fixes: 901ddbb9ecf5 ("x86/sgx: Add a basic NUMA allocation scheme to sgx_alloc_epc_page()")
Suggested-by: Dave Hansen <dave.hansen(a)linux.intel.com>
Reviewed-by: Tony Luck <tony.luck(a)intel.com>
Signed-off-by: Reinette Chatre <reinette.chatre(a)intel.com>
---
Changes since V1:
- V1:
https://lore.kernel.org/lkml/373992d869cd356ce9e9afe43ef4934b70d604fd.16360…
- Add static to definition of sgx_nr_free_pages (Tony).
- Add Tony's signature.
- Provide detail about error scenario in changelog (Jarkko).
arch/x86/kernel/cpu/sgx/main.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c
index 63d3de02bbcc..8471a8b9b48e 100644
--- a/arch/x86/kernel/cpu/sgx/main.c
+++ b/arch/x86/kernel/cpu/sgx/main.c
@@ -28,8 +28,7 @@ static DECLARE_WAIT_QUEUE_HEAD(ksgxd_waitq);
static LIST_HEAD(sgx_active_page_list);
static DEFINE_SPINLOCK(sgx_reclaimer_lock);
-/* The free page list lock protected variables prepend the lock. */
-static unsigned long sgx_nr_free_pages;
+static atomic_long_t sgx_nr_free_pages = ATOMIC_LONG_INIT(0);
/* Nodes with one or more EPC sections. */
static nodemask_t sgx_numa_mask;
@@ -403,14 +402,15 @@ static void sgx_reclaim_pages(void)
spin_lock(&node->lock);
list_add_tail(&epc_page->list, &node->free_page_list);
- sgx_nr_free_pages++;
spin_unlock(&node->lock);
+ atomic_long_inc(&sgx_nr_free_pages);
}
}
static bool sgx_should_reclaim(unsigned long watermark)
{
- return sgx_nr_free_pages < watermark && !list_empty(&sgx_active_page_list);
+ return atomic_long_read(&sgx_nr_free_pages) < watermark &&
+ !list_empty(&sgx_active_page_list);
}
static int ksgxd(void *p)
@@ -471,9 +471,9 @@ static struct sgx_epc_page *__sgx_alloc_epc_page_from_node(int nid)
page = list_first_entry(&node->free_page_list, struct sgx_epc_page, list);
list_del_init(&page->list);
- sgx_nr_free_pages--;
spin_unlock(&node->lock);
+ atomic_long_dec(&sgx_nr_free_pages);
return page;
}
@@ -625,9 +625,9 @@ void sgx_free_epc_page(struct sgx_epc_page *page)
spin_lock(&node->lock);
list_add_tail(&page->list, &node->free_page_list);
- sgx_nr_free_pages++;
spin_unlock(&node->lock);
+ atomic_long_inc(&sgx_nr_free_pages);
}
static bool __init sgx_setup_epc_section(u64 phys_addr, u64 size,
--
2.25.1
The patch titled
Subject: mm, thp: fix incorrect unmap behavior for private pages
has been removed from the -mm tree. Its filename was
mm-thp-fix-incorrect-unmap-behavior-for-private-pages.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Rongwei Wang <rongwei.wang(a)linux.alibaba.com>
Subject: mm, thp: fix incorrect unmap behavior for private pages
When truncating pagecache on file THP, the private pages of a process
should not be unmapped mapping. This incorrect behavior on a dynamic
shared libraries which will cause related processes to happen core dump.
A simple test for a DSO (Prerequisite is the DSO mapped in file THP):
int main(int argc, char *argv[])
{
int fd;
fd = open(argv[1], O_WRONLY);
if (fd < 0) {
perror("open");
}
close(fd);
return 0;
}
The test only to open a target DSO, and do nothing. But this operation
will lead one or more process to happen core dump. This patch mainly to
fix this bug.
Link: https://lkml.kernel.org/r/20211025092134.18562-3-rongwei.wang@linux.alibaba…
Fixes: eb6ecbed0aa2 ("mm, thp: relax the VM_DENYWRITE constraint on file-backed THPs")
Signed-off-by: Rongwei Wang <rongwei.wang(a)linux.alibaba.com>
Tested-by: Xu Yu <xuyu(a)linux.alibaba.com>
Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org>
Cc: Song Liu <song(a)kernel.org>
Cc: William Kucharski <william.kucharski(a)oracle.com>
Cc: Hugh Dickins <hughd(a)google.com>
Cc: Yang Shi <shy828301(a)gmail.com>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Collin Fijalkovich <cfijalkovich(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/open.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/fs/open.c~mm-thp-fix-incorrect-unmap-behavior-for-private-pages
+++ a/fs/open.c
@@ -857,8 +857,17 @@ static int do_dentry_open(struct file *f
*/
smp_mb();
if (filemap_nr_thps(inode->i_mapping)) {
+ struct address_space *mapping = inode->i_mapping;
+
filemap_invalidate_lock(inode->i_mapping);
- truncate_pagecache(inode, 0);
+ /*
+ * unmap_mapping_range just need to be called once
+ * here, because the private pages is not need to be
+ * unmapped mapping (e.g. data segment of dynamic
+ * shared libraries here).
+ */
+ unmap_mapping_range(mapping, 0, 0, 0);
+ truncate_inode_pages(mapping, 0);
filemap_invalidate_unlock(inode->i_mapping);
}
}
_
Patches currently in -mm which might be from rongwei.wang(a)linux.alibaba.com are
The patch titled
Subject: memcg: prohibit unconditional exceeding the limit of dying tasks
has been removed from the -mm tree. Its filename was
memcg-prohibit-unconditional-exceeding-the-limit-of-dying-tasks.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Vasily Averin <vvs(a)virtuozzo.com>
Subject: memcg: prohibit unconditional exceeding the limit of dying tasks
Memory cgroup charging allows killed or exiting tasks to exceed the hard
limit. It is assumed that the amount of the memory charged by those tasks
is bound and most of the memory will get released while the task is
exiting. This is resembling a heuristic for the global OOM situation when
tasks get access to memory reserves. There is no global memory shortage
at the memcg level so the memcg heuristic is more relieved.
The above assumption is overly optimistic though. E.g. vmalloc can scale
to really large requests and the heuristic would allow that. We used to
have an early break in the vmalloc allocator for killed tasks but this has
been reverted by commit b8c8a338f75e ("Revert "vmalloc: back off when the
current task is killed""). There are likely other similar code paths
which do not check for fatal signals in an allocation&charge loop. Also
there are some kernel objects charged to a memcg which are not bound to a
process life time.
It has been observed that it is not really hard to trigger these bypasses
and cause global OOM situation.
One potential way to address these runaways would be to limit the amount
of excess (similar to the global OOM with limited oom reserves). This is
certainly possible but it is not really clear how much of an excess is
desirable and still protects from global OOMs as that would have to
consider the overall memcg configuration.
This patch is addressing the problem by removing the heuristic altogether.
Bypass is only allowed for requests which either cannot fail or where the
failure is not desirable while excess should be still limited (e.g.
atomic requests). Implementation wise a killed or dying task fails to
charge if it has passed the OOM killer stage. That should give all forms
of reclaim chance to restore the limit before the failure (ENOMEM) and
tell the caller to back off.
In addition, this patch renames should_force_charge() helper to
task_is_dying() because now its use is not associated witch forced
charging.
This patch depends on pagefault_out_of_memory() to not trigger
out_of_memory(), because then a memcg failure can unwind to VM_FAULT_OOM
and cause a global OOM killer.
Link: https://lkml.kernel.org/r/8f5cebbb-06da-4902-91f0-6566fc4b4203@virtuozzo.com
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
Suggested-by: Michal Hocko <mhocko(a)suse.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: Roman Gushchin <guro(a)fb.com>
Cc: Uladzislau Rezki <urezki(a)gmail.com>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: Mel Gorman <mgorman(a)techsingularity.net>
Cc: Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 27 ++++++++-------------------
1 file changed, 8 insertions(+), 19 deletions(-)
--- a/mm/memcontrol.c~memcg-prohibit-unconditional-exceeding-the-limit-of-dying-tasks
+++ a/mm/memcontrol.c
@@ -234,7 +234,7 @@ enum res_type {
iter != NULL; \
iter = mem_cgroup_iter(NULL, iter, NULL))
-static inline bool should_force_charge(void)
+static inline bool task_is_dying(void)
{
return tsk_is_oom_victim(current) || fatal_signal_pending(current) ||
(current->flags & PF_EXITING);
@@ -1624,7 +1624,7 @@ static bool mem_cgroup_out_of_memory(str
* A few threads which were not waiting at mutex_lock_killable() can
* fail to bail out. Therefore, check again after holding oom_lock.
*/
- ret = should_force_charge() || out_of_memory(&oc);
+ ret = task_is_dying() || out_of_memory(&oc);
unlock:
mutex_unlock(&oom_lock);
@@ -2579,6 +2579,7 @@ static int try_charge_memcg(struct mem_c
struct page_counter *counter;
enum oom_status oom_status;
unsigned long nr_reclaimed;
+ bool passed_oom = false;
bool may_swap = true;
bool drained = false;
unsigned long pflags;
@@ -2614,15 +2615,6 @@ retry:
goto force;
/*
- * Unlike in global OOM situations, memcg is not in a physical
- * memory shortage. Allow dying and OOM-killed tasks to
- * bypass the last charges so that they can exit quickly and
- * free their memory.
- */
- if (unlikely(should_force_charge()))
- goto force;
-
- /*
* Prevent unbounded recursion when reclaim operations need to
* allocate memory. This might exceed the limits temporarily,
* but we prefer facilitating memory reclaim and getting back
@@ -2679,8 +2671,9 @@ retry:
if (gfp_mask & __GFP_RETRY_MAYFAIL)
goto nomem;
- if (fatal_signal_pending(current))
- goto force;
+ /* Avoid endless loop for tasks bypassed by the oom killer */
+ if (passed_oom && task_is_dying())
+ goto nomem;
/*
* keep retrying as long as the memcg oom killer is able to make
@@ -2689,14 +2682,10 @@ retry:
*/
oom_status = mem_cgroup_oom(mem_over_limit, gfp_mask,
get_order(nr_pages * PAGE_SIZE));
- switch (oom_status) {
- case OOM_SUCCESS:
+ if (oom_status == OOM_SUCCESS) {
+ passed_oom = true;
nr_retries = MAX_RECLAIM_RETRIES;
goto retry;
- case OOM_FAILED:
- goto force;
- default:
- goto nomem;
}
nomem:
if (!(gfp_mask & __GFP_NOFAIL))
_
Patches currently in -mm which might be from vvs(a)virtuozzo.com are
The patch titled
Subject: mm, oom: do not trigger out_of_memory from the #PF
has been removed from the -mm tree. Its filename was
mm-oom-do-not-trigger-out_of_memory-from-the-pf.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Michal Hocko <mhocko(a)suse.com>
Subject: mm, oom: do not trigger out_of_memory from the #PF
Any allocation failure during the #PF path will return with VM_FAULT_OOM
which in turn results in pagefault_out_of_memory. This can happen for 2
different reasons. a) Memcg is out of memory and we rely on
mem_cgroup_oom_synchronize to perform the memcg OOM handling or b) normal
allocation fails.
The latter is quite problematic because allocation paths already trigger
out_of_memory and the page allocator tries really hard to not fail
allocations. Anyway, if the OOM killer has been already invoked there is
no reason to invoke it again from the #PF path. Especially when the OOM
condition might be gone by that time and we have no way to find out other
than allocate.
Moreover if the allocation failed and the OOM killer hasn't been invoked
then we are unlikely to do the right thing from the #PF context because we
have already lost the allocation context and restictions and therefore
might oom kill a task from a different NUMA domain.
This all suggests that there is no legitimate reason to trigger
out_of_memory from pagefault_out_of_memory so drop it. Just to be sure
that no #PF path returns with VM_FAULT_OOM without allocation print a
warning that this is happening before we restart the #PF.
[VvS: #PF allocation can hit into limit of cgroup v1 kmem controller.
This is a local problem related to memcg, however, it causes unnecessary
global OOM kills that are repeated over and over again and escalate into a
real disaster. This has been broken since kmem accounting has been
introduced for cgroup v1 (3.8). There was no kmem specific reclaim for
the separate limit so the only way to handle kmem hard limit was to return
with ENOMEM. In upstream the problem will be fixed by removing the
outdated kmem limit, however stable and LTS kernels cannot do it and are
still affected. This patch fixes the problem and should be backported
into stable/LTS.]
Link: https://lkml.kernel.org/r/f5fd8dd8-0ad4-c524-5f65-920b01972a42@virtuozzo.com
Signed-off-by: Michal Hocko <mhocko(a)suse.com>
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Mel Gorman <mgorman(a)techsingularity.net>
Cc: Roman Gushchin <guro(a)fb.com>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp>
Cc: Uladzislau Rezki <urezki(a)gmail.com>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/oom_kill.c | 22 ++++++++--------------
1 file changed, 8 insertions(+), 14 deletions(-)
--- a/mm/oom_kill.c~mm-oom-do-not-trigger-out_of_memory-from-the-pf
+++ a/mm/oom_kill.c
@@ -1120,19 +1120,15 @@ bool out_of_memory(struct oom_control *o
}
/*
- * The pagefault handler calls here because it is out of memory, so kill a
- * memory-hogging task. If oom_lock is held by somebody else, a parallel oom
- * killing is already in progress so do nothing.
+ * The pagefault handler calls here because some allocation has failed. We have
+ * to take care of the memcg OOM here because this is the only safe context without
+ * any locks held but let the oom killer triggered from the allocation context care
+ * about the global OOM.
*/
void pagefault_out_of_memory(void)
{
- struct oom_control oc = {
- .zonelist = NULL,
- .nodemask = NULL,
- .memcg = NULL,
- .gfp_mask = 0,
- .order = 0,
- };
+ static DEFINE_RATELIMIT_STATE(pfoom_rs, DEFAULT_RATELIMIT_INTERVAL,
+ DEFAULT_RATELIMIT_BURST);
if (mem_cgroup_oom_synchronize(true))
return;
@@ -1140,10 +1136,8 @@ void pagefault_out_of_memory(void)
if (fatal_signal_pending(current))
return;
- if (!mutex_trylock(&oom_lock))
- return;
- out_of_memory(&oc);
- mutex_unlock(&oom_lock);
+ if (__ratelimit(&pfoom_rs))
+ pr_warn("Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF\n");
}
SYSCALL_DEFINE2(process_mrelease, int, pidfd, unsigned int, flags)
_
Patches currently in -mm which might be from mhocko(a)suse.com are
The patch titled
Subject: mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
has been removed from the -mm tree. Its filename was
mm-oom-pagefault_out_of_memory-dont-force-global-oom-for-dying-tasks.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Vasily Averin <vvs(a)virtuozzo.com>
Subject: mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
Patch series "memcg: prohibit unconditional exceeding the limit of dying tasks", v3.
Memory cgroup charging allows killed or exiting tasks to exceed the hard
limit. It can be misused and allowed to trigger global OOM from inside a
memcg-limited container. On the other hand if memcg fails allocation,
called from inside #PF handler it triggers global OOM from inside
pagefault_out_of_memory().
To prevent these problems this patchset:
a) removes execution of out_of_memory() from pagefault_out_of_memory(),
becasue nobody can explain why it is necessary.
b) allow memcg to fail allocation of dying/killed tasks.
This patch (of 3):
Any allocation failure during the #PF path will return with VM_FAULT_OOM
which in turn results in pagefault_out_of_memory which in turn executes
out_out_memory() and can kill a random task.
An allocation might fail when the current task is the oom victim and there
are no memory reserves left. The OOM killer is already handled at the
page allocator level for the global OOM and at the charging level for the
memcg one. Both have much more information about the scope of
allocation/charge request. This means that either the OOM killer has been
invoked properly and didn't lead to the allocation success or it has been
skipped because it couldn't have been invoked. In both cases triggering
it from here is pointless and even harmful.
It makes much more sense to let the killed task die rather than to wake up
an eternally hungry oom-killer and send him to choose a fatter victim for
breakfast.
Link: https://lkml.kernel.org/r/0828a149-786e-7c06-b70a-52d086818ea3@virtuozzo.com
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
Suggested-by: Michal Hocko <mhocko(a)suse.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Mel Gorman <mgorman(a)techsingularity.net>
Cc: Roman Gushchin <guro(a)fb.com>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp>
Cc: Uladzislau Rezki <urezki(a)gmail.com>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/oom_kill.c | 3 +++
1 file changed, 3 insertions(+)
--- a/mm/oom_kill.c~mm-oom-pagefault_out_of_memory-dont-force-global-oom-for-dying-tasks
+++ a/mm/oom_kill.c
@@ -1137,6 +1137,9 @@ void pagefault_out_of_memory(void)
if (mem_cgroup_oom_synchronize(true))
return;
+ if (fatal_signal_pending(current))
+ return;
+
if (!mutex_trylock(&oom_lock))
return;
out_of_memory(&oc);
_
Patches currently in -mm which might be from vvs(a)virtuozzo.com are
The patch titled
Subject: mm/filemap.c: remove bogus VM_BUG_ON
has been removed from the -mm tree. Its filename was
mm-remove-bogus-vm_bug_on.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org>
Subject: mm/filemap.c: remove bogus VM_BUG_ON
It is not safe to check page->index without holding the page lock. It can
be changed if the page is moved between the swap cache and the page cache
for a shmem file, for example. There is a VM_BUG_ON below which checks
page->index is correct after taking the page lock.
Link: https://lkml.kernel.org/r/20210818144932.940640-1-willy@infradead.org
Fixes: 5c211ba29deb ("mm: add and use find_lock_entries")
Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org>
Reported-by: <syzbot+c87be4f669d920c76330(a)syzkaller.appspotmail.com>
Cc: Hugh Dickins <hughd(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/filemap.c | 1 -
1 file changed, 1 deletion(-)
--- a/mm/filemap.c~mm-remove-bogus-vm_bug_on
+++ a/mm/filemap.c
@@ -2093,7 +2093,6 @@ unsigned find_lock_entries(struct addres
if (!xa_is_value(page)) {
if (page->index < start)
goto put;
- VM_BUG_ON_PAGE(page->index != xas.xa_index, page);
if (page->index + thp_nr_pages(page) - 1 > end)
goto put;
if (!trylock_page(page))
_
Patches currently in -mm which might be from willy(a)infradead.org are
hitting-bug_on-trap-in-read_pages-mm-optimise-put_pages_list.patch
The patch titled
Subject: ocfs2: fix data corruption on truncate
has been removed from the -mm tree. Its filename was
ocfs2-fix-data-corruption-on-truncate.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Jan Kara <jack(a)suse.cz>
Subject: ocfs2: fix data corruption on truncate
Patch series "ocfs2: Truncate data corruption fix".
As further testing has shown, commit 5314454ea3f ("ocfs2: fix data
corruption after conversion from inline format") didn't fix all the data
corruption issues the customer started observing after 6dbf7bb55598 ("fs:
Don't invalidate page buffers in block_write_full_page()") This time I
have tracked them down to two bugs in ocfs2 truncation code.
One bug (truncating page cache before clearing tail cluster and setting
i_size) could cause data corruption even before 6dbf7bb55598, but before
that commit it needed a race with page fault, after 6dbf7bb55598 it
started to be pretty deterministic.
Another bug (zeroing pages beyond old i_size) used to be harmless
inefficiency before commit 6dbf7bb55598. But after commit 6dbf7bb55598 in
combination with the first bug it resulted in deterministic data
corruption.
Although fixing only the first problem is needed to stop data corruption,
I've fixed both issues to make the code more robust.
This patch (of 2):
ocfs2_truncate_file() did unmap invalidate page cache pages before zeroing
partial tail cluster and setting i_size. Thus some pages could be left
(and likely have left if the cluster zeroing happened) in the page cache
beyond i_size after truncate finished letting user possibly see stale data
once the file was extended again. Also the tail cluster zeroing was not
guaranteed to finish before truncate finished causing possible stale data
exposure. The problem started to be particularly easy to hit after commit
6dbf7bb55598 "fs: Don't invalidate page buffers in
block_write_full_page()" stopped invalidation of pages beyond i_size from
page writeback path.
Fix these problems by unmapping and invalidating pages in the page cache
after the i_size is reduced and tail cluster is zeroed out.
Link: https://lkml.kernel.org/r/20211025150008.29002-1-jack@suse.cz
Link: https://lkml.kernel.org/r/20211025151332.11301-1-jack@suse.cz
Fixes: ccd979bdbce9 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Jan Kara <jack(a)suse.cz>
Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com>
Cc: Mark Fasheh <mark(a)fasheh.com>
Cc: Joel Becker <jlbec(a)evilplan.org>
Cc: Junxiao Bi <junxiao.bi(a)oracle.com>
Cc: Changwei Ge <gechangwei(a)live.cn>
Cc: Gang He <ghe(a)suse.com>
Cc: Jun Piao <piaojun(a)huawei.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/ocfs2/file.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/fs/ocfs2/file.c~ocfs2-fix-data-corruption-on-truncate
+++ a/fs/ocfs2/file.c
@@ -476,10 +476,11 @@ int ocfs2_truncate_file(struct inode *in
* greater than page size, so we have to truncate them
* anyway.
*/
- unmap_mapping_range(inode->i_mapping, new_i_size + PAGE_SIZE - 1, 0, 1);
- truncate_inode_pages(inode->i_mapping, new_i_size);
if (OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
+ unmap_mapping_range(inode->i_mapping,
+ new_i_size + PAGE_SIZE - 1, 0, 1);
+ truncate_inode_pages(inode->i_mapping, new_i_size);
status = ocfs2_truncate_inline(inode, di_bh, new_i_size,
i_size_read(inode), 1);
if (status)
@@ -498,6 +499,9 @@ int ocfs2_truncate_file(struct inode *in
goto bail_unlock_sem;
}
+ unmap_mapping_range(inode->i_mapping, new_i_size + PAGE_SIZE - 1, 0, 1);
+ truncate_inode_pages(inode->i_mapping, new_i_size);
+
status = ocfs2_commit_truncate(osb, inode, di_bh);
if (status < 0) {
mlog_errno(status);
_
Patches currently in -mm which might be from jack(a)suse.cz are
From: "Steven Rostedt (VMware)" <rostedt(a)goodmis.org>
The resetting of the entire ring buffer use to simply go through and reset
each individual CPU buffer that had its own protection and synchronization.
But this was very slow, due to performing a synchronization for each CPU.
The code was reshuffled to do one disabling of all CPU buffers, followed
by a single RCU synchronization, and then the resetting of each of the CPU
buffers. But unfortunately, the mutex that prevented multiple occurrences
of resetting the buffer was not moved to the upper function, and there is
nothing to protect from it.
Take the ring buffer mutex around the global reset.
Cc: stable(a)vger.kernel.org
Fixes: b23d7a5f4a07a ("ring-buffer: speed up buffer resets by avoiding synchronize_rcu for each CPU")
Reported-by: "Tzvetomir Stoyanov (VMware)" <tz.stoyanov(a)gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
---
kernel/trace/ring_buffer.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index f6520d0a4c8c..2699e9e562b1 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -5228,6 +5228,9 @@ void ring_buffer_reset(struct trace_buffer *buffer)
struct ring_buffer_per_cpu *cpu_buffer;
int cpu;
+ /* prevent another thread from changing buffer sizes */
+ mutex_lock(&buffer->mutex);
+
for_each_buffer_cpu(buffer, cpu) {
cpu_buffer = buffer->buffers[cpu];
@@ -5246,6 +5249,8 @@ void ring_buffer_reset(struct trace_buffer *buffer)
atomic_dec(&cpu_buffer->record_disabled);
atomic_dec(&cpu_buffer->resize_disabled);
}
+
+ mutex_unlock(&buffer->mutex);
}
EXPORT_SYMBOL_GPL(ring_buffer_reset);
--
2.33.0