April 2022 - Linux-stable-mirror

[patch 08/14] mm: fix unexpected zeroed page mapping with zram swap

by Andrew Morton

From: Minchan Kim <minchan(a)kernel.org> Subject: mm: fix unexpected zeroed page mapping with zram swap Two processes under CLONE_VM cloning, user process can be corrupted by seeing zeroed page unexpectedly. CPU A CPU B do_swap_page do_swap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage valid data swap_slot_free_notify delete zram entry swap_readpage zeroed(invalid) data pte_lock map the *zero data* to userspace pte_unlock pte_lock if (!pte_same) goto out_nomap; pte_unlock return and next refault will read zeroed data The swap_slot_free_notify is bogus for CLONE_VM case since it doesn't increase the refcount of swap slot at copy_mm so it couldn't catch up whether it's safe or not to discard data from backing device. In the case, only the lock it could rely on to synchronize swap slot freeing is page table lock. Thus, this patch gets rid of the swap_slot_free_notify function. With this patch, CPU A will see correct data. CPU A CPU B do_swap_page do_swap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage original data pte_lock map the original data swap_free swap_range_free bd_disk->fops->swap_slot_free_notify swap_readpage read zeroed data pte_unlock pte_lock if (!pte_same) goto out_nomap; pte_unlock return on next refault will see mapped data by CPU B The concern of the patch would increase memory consumption since it could keep wasted memory with compressed form in zram as well as uncompressed form in address space. However, most of cases of zram uses no readahead and do_swap_page is followed by swap_free so it will free the compressed form from in zram quickly. Link: https://lkml.kernel.org/r/YjTVVxIAsnKAXjTd@google.com Fixes: 0bcac06f27d7 ("mm, swap: skip swapcache for swapin of synchronous device") Reported-by: Ivan Babrou <ivan(a)cloudflare.com> Tested-by: Ivan Babrou <ivan(a)cloudflare.com> Signed-off-by: Minchan Kim <minchan(a)kernel.org> Cc: Nitin Gupta <ngupta(a)vflare.org> Cc: Sergey Senozhatsky <senozhatsky(a)chromium.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: David Hildenbrand <david(a)redhat.com> Cc: <stable(a)vger.kernel.org> [4.14+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/page_io.c | 54 ------------------------------------------------- 1 file changed, 54 deletions(-) --- a/mm/page_io.c~mm-fix-unexpected-zeroed-page-mapping-with-zram-swap +++ a/mm/page_io.c @@ -51,54 +51,6 @@ void end_swap_bio_write(struct bio *bio) bio_put(bio); } -static void swap_slot_free_notify(struct page *page) -{ - struct swap_info_struct *sis; - struct gendisk *disk; - swp_entry_t entry; - - /* - * There is no guarantee that the page is in swap cache - the software - * suspend code (at least) uses end_swap_bio_read() against a non- - * swapcache page. So we must check PG_swapcache before proceeding with - * this optimization. - */ - if (unlikely(!PageSwapCache(page))) - return; - - sis = page_swap_info(page); - if (data_race(!(sis->flags & SWP_BLKDEV))) - return; - - /* - * The swap subsystem performs lazy swap slot freeing, - * expecting that the page will be swapped out again. - * So we can avoid an unnecessary write if the page - * isn't redirtied. - * This is good for real swap storage because we can - * reduce unnecessary I/O and enhance wear-leveling - * if an SSD is used as the as swap device. - * But if in-memory swap device (eg zram) is used, - * this causes a duplicated copy between uncompressed - * data in VM-owned memory and compressed data in - * zram-owned memory. So let's free zram-owned memory - * and make the VM-owned decompressed page *dirty*, - * so the page should be swapped out somewhere again if - * we again wish to reclaim it. - */ - disk = sis->bdev->bd_disk; - entry.val = page_private(page); - if (disk->fops->swap_slot_free_notify && __swap_count(entry) == 1) { - unsigned long offset; - - offset = swp_offset(entry); - - SetPageDirty(page); - disk->fops->swap_slot_free_notify(sis->bdev, - offset); - } -} - static void end_swap_bio_read(struct bio *bio) { struct page *page = bio_first_page_all(bio); @@ -114,7 +66,6 @@ static void end_swap_bio_read(struct bio } SetPageUptodate(page); - swap_slot_free_notify(page); out: unlock_page(page); WRITE_ONCE(bio->bi_private, NULL); @@ -394,11 +345,6 @@ int swap_readpage(struct page *page, boo if (sis->flags & SWP_SYNCHRONOUS_IO) { ret = bdev_read_page(sis->bdev, swap_page_sector(page), page); if (!ret) { - if (trylock_page(page)) { - swap_slot_free_notify(page); - unlock_page(page); - } - count_vm_event(PSWPIN); goto out; } _

3 years, 8 months

1
0
0 0

[patch 07/14] mm, page_alloc: fix build_zonerefs_node()

by Andrew Morton

From: Juergen Gross <jgross(a)suse.com> Subject: mm, page_alloc: fix build_zonerefs_node() Since commit 6aa303defb74 ("mm, vmscan: only allocate and reclaim from zones with pages managed by the buddy allocator") only zones with free memory are included in a built zonelist. This is problematic when e.g. all memory of a zone has been ballooned out when zonelists are being rebuilt. The decision whether to rebuild the zonelists when onlining new memory is done based on populated_zone() returning 0 for the zone the memory will be added to. The new zone is added to the zonelists only, if it has free memory pages (managed_zone() returns a non-zero value) after the memory has been onlined. This implies, that onlining memory will always free the added pages to the allocator immediately, but this is not true in all cases: when e.g. running as a Xen guest the onlined new memory will be added only to the ballooned memory list, it will be freed only when the guest is being ballooned up afterwards. Another problem with using managed_zone() for the decision whether a zone is being added to the zonelists is, that a zone with all memory used will in fact be removed from all zonelists in case the zonelists happen to be rebuilt. Use populated_zone() when building a zonelist as it has been done before that commit. There was a report that QubesOS (based on Xen) is hitting this problem. Xen has switched to use the zone device functionality in kernel 5.9 and QubesOS wants to use memory hotplugging for guests in order to be able to start a guest with minimal memory and expand it as needed. This was the report leading to the patch. Link: https://lkml.kernel.org/r/20220407120637.9035-1-jgross@suse.com Fixes: 6aa303defb74 ("mm, vmscan: only allocate and reclaim from zones with pages managed by the buddy allocator") Signed-off-by: Juergen Gross <jgross(a)suse.com> Reported-by: Marek Marczykowski-G��recki <marmarek(a)invisiblethingslab.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Marek Marczykowski-G��recki <marmarek(a)invisiblethingslab.com> Reviewed-by: Wei Yang <richard.weiyang(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/page_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/mm/page_alloc.c~mm-page_alloc-fix-build_zonerefs_node +++ a/mm/page_alloc.c @@ -6131,7 +6131,7 @@ static int build_zonerefs_node(pg_data_t do { zone_type--; zone = pgdat->node_zones + zone_type; - if (managed_zone(zone)) { + if (populated_zone(zone)) { zoneref_set_zone(zone, &zonerefs[nr_zones++]); check_highest_zone(zone_type); } _

3 years, 8 months

1
0
0 0

[patch 03/14] mm/secretmem: fix panic when growing a memfd_secret

by Andrew Morton

From: Axel Rasmussen <axelrasmussen(a)google.com> Subject: mm/secretmem: fix panic when growing a memfd_secret When one tries to grow an existing memfd_secret with ftruncate, one gets a panic [1]. For example, doing the following reliably induces the panic: fd = memfd_secret(); ftruncate(fd, 10); ptr = mmap(NULL, 10, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); strcpy(ptr, "123456789"); munmap(ptr, 10); ftruncate(fd, 20); The basic reason for this is, when we grow with ftruncate, we call down into simple_setattr, and then truncate_inode_pages_range, and eventually we try to zero part of the memory. The normal truncation code does this via the direct map (i.e., it calls page_address() and hands that to memset()). For memfd_secret though, we specifically don't map our pages via the direct map (i.e. we call set_direct_map_invalid_noflush() on every fault). So the address returned by page_address() isn't useful, and when we try to memset() with it we panic. This patch avoids the panic by implementing a custom setattr for memfd_secret, which detects resizes specifically (setting the size for the first time works just fine, since there are no existing pages to try to zero), and rejects them with EINVAL. One could argue growing should be supported, but I think that will require a significantly more lengthy change. So, I propose a minimal fix for the benefit of stable kernels, and then perhaps to extend memfd_secret to support growing in a separate patch. [1]: [ 774.320433] BUG: unable to handle page fault for address: ffffa0a889277028 [ 774.322297] #PF: supervisor write access in kernel mode [ 774.323306] #PF: error_code(0x0002) - not-present page [ 774.324296] PGD afa01067 P4D afa01067 PUD 83f909067 PMD 83f8bf067 PTE 800ffffef6d88060 [ 774.325841] Oops: 0002 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI [ 774.326934] CPU: 0 PID: 281 Comm: repro Not tainted 5.17.0-dbg-DEV #1 [ 774.328074] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 774.329732] RIP: 0010:memset_erms+0x9/0x10 [ 774.330474] Code: c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 <f3> aa 4c 89 c8 c3 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 01 [ 774.333543] RSP: 0018:ffffb932c09afbf0 EFLAGS: 00010246 [ 774.334404] RAX: 0000000000000000 RBX: ffffda63c4249dc0 RCX: 0000000000000fd8 [ 774.335545] RDX: 0000000000000fd8 RSI: 0000000000000000 RDI: ffffa0a889277028 [ 774.336685] RBP: ffffb932c09afc00 R08: 0000000000001000 R09: ffffa0a889277028 [ 774.337929] R10: 0000000000020023 R11: 0000000000000000 R12: ffffda63c4249dc0 [ 774.339236] R13: ffffa0a890d70d98 R14: 0000000000000028 R15: 0000000000000fd8 [ 774.340356] FS: 00007f7294899580(0000) GS:ffffa0af9bc00000(0000) knlGS:0000000000000000 [ 774.341635] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 774.342535] CR2: ffffa0a889277028 CR3: 0000000107ef6006 CR4: 0000000000370ef0 [ 774.343651] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 774.344780] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 774.345938] Call Trace: [ 774.346334] <TASK> [ 774.346671] ? zero_user_segments+0x82/0x190 [ 774.347346] truncate_inode_partial_folio+0xd4/0x2a0 [ 774.348128] truncate_inode_pages_range+0x380/0x830 [ 774.348904] truncate_setsize+0x63/0x80 [ 774.349530] simple_setattr+0x37/0x60 [ 774.350102] notify_change+0x3d8/0x4d0 [ 774.350681] do_sys_ftruncate+0x162/0x1d0 [ 774.351302] __x64_sys_ftruncate+0x1c/0x20 [ 774.351936] do_syscall_64+0x44/0xa0 [ 774.352486] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 774.353284] RIP: 0033:0x7f72947c392b [ 774.354001] Code: 77 05 c3 0f 1f 40 00 48 8b 15 41 85 0c 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 4d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 11 85 0c 00 f7 d8 [ 774.357938] RSP: 002b:00007ffcad62a1a8 EFLAGS: 00000202 ORIG_RAX: 000000000000004d [ 774.359116] RAX: ffffffffffffffda RBX: 000055f47662b440 RCX: 00007f72947c392b [ 774.360186] RDX: 0000000000000028 RSI: 0000000000000028 RDI: 0000000000000003 [ 774.361246] RBP: 00007ffcad62a1c0 R08: 0000000000000003 R09: 0000000000000000 [ 774.362324] R10: 00007f72946dc230 R11: 0000000000000202 R12: 000055f47662b0e0 [ 774.363393] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 774.364470] </TASK> [ 774.364807] Modules linked in: xhci_pci xhci_hcd virtio_net net_failover failover virtio_blk virtio_balloon uhci_hcd ohci_pci ohci_hcd evdev ehci_pci ehci_hcd 9pnet_virtio 9p netfs 9pnet [ 774.367325] CR2: ffffa0a889277028 [ 774.367838] ---[ end trace 0000000000000000 ]--- [ 774.368543] RIP: 0010:memset_erms+0x9/0x10 [ 774.369187] Code: c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 <f3> aa 4c 89 c8 c3 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 01 [ 774.372282] RSP: 0018:ffffb932c09afbf0 EFLAGS: 00010246 [ 774.373372] RAX: 0000000000000000 RBX: ffffda63c4249dc0 RCX: 0000000000000fd8 [ 774.374814] RDX: 0000000000000fd8 RSI: 0000000000000000 RDI: ffffa0a889277028 [ 774.376248] RBP: ffffb932c09afc00 R08: 0000000000001000 R09: ffffa0a889277028 [ 774.377687] R10: 0000000000020023 R11: 0000000000000000 R12: ffffda63c4249dc0 [ 774.379135] R13: ffffa0a890d70d98 R14: 0000000000000028 R15: 0000000000000fd8 [ 774.380550] FS: 00007f7294899580(0000) GS:ffffa0af9bc00000(0000) knlGS:0000000000000000 [ 774.382177] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 774.383329] CR2: ffffa0a889277028 CR3: 0000000107ef6006 CR4: 0000000000370ef0 [ 774.384763] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 774.386229] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 774.387664] Kernel panic - not syncing: Fatal exception [ 774.388863] Kernel Offset: 0x8000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 774.391014] ---[ end Kernel panic - not syncing: Fatal exception ]--- [lkp(a)intel.com: secretmem_iops can be static] Signed-off-by: kernel test robot <lkp(a)intel.com> [axelrasmussen(a)google.com: return EINVAL] Link: https://lkml.kernel.org/r/20220412193023.279320-1-axelrasmussen@google.com Link: https://lkml.kernel.org/r/20220324210909.1843814-1-axelrasmussen@google.com Signed-off-by: Axel Rasmussen <axelrasmussen(a)google.com> Signed-off-by: Axel Rasmussen <axelrasmussen(a)google.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: <stable(a)vger.kernel.org> Cc: kernel test robot <lkp(a)intel.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/secretmem.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) --- a/mm/secretmem.c~mm-secretmem-fix-panic-when-growing-a-memfd_secret +++ a/mm/secretmem.c @@ -158,6 +158,22 @@ const struct address_space_operations se .isolate_page = secretmem_isolate_page, }; +static int secretmem_setattr(struct user_namespace *mnt_userns, + struct dentry *dentry, struct iattr *iattr) +{ + struct inode *inode = d_inode(dentry); + unsigned int ia_valid = iattr->ia_valid; + + if ((ia_valid & ATTR_SIZE) && inode->i_size) + return -EINVAL; + + return simple_setattr(mnt_userns, dentry, iattr); +} + +static const struct inode_operations secretmem_iops = { + .setattr = secretmem_setattr, +}; + static struct vfsmount *secretmem_mnt; static struct file *secretmem_file_create(unsigned long flags) @@ -177,6 +193,7 @@ static struct file *secretmem_file_creat mapping_set_gfp_mask(inode->i_mapping, GFP_HIGHUSER); mapping_set_unevictable(inode->i_mapping); + inode->i_op = &secretmem_iops; inode->i_mapping->a_ops = &secretmem_aops; /* pretend we are a normal file with zero size */ _

3 years, 8 months

1
0
0 0

stable-rc/queue/4.19 baseline: 100 runs, 3 regressions (v4.19.237-335-ge2984ffcd13c7)

by kernelci.org bot

stable-rc/queue/4.19 baseline: 100 runs, 3 regressions (v4.19.237-335-ge2984ffcd13c7) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions ---------------------+-------+---------------+----------+----------------------------+------------ meson-gxbb-p200 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 meson-gxl-s905d-p230 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 rk3399-gru-kevin | arm64 | lab-collabora | gcc-10 | defconfig+arm64-chromebook | 1 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F4.19/kernel/v4.19.23… Test: baseline Tree: stable-rc Branch: queue/4.19 Describe: v4.19.237-335-ge2984ffcd13c7 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: e2984ffcd13c753c75399a28024253b24fd51322 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions ---------------------+-------+---------------+----------+----------------------------+------------ meson-gxbb-p200 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/62589f5548bff45339ae0682 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.237-335-ge2984ffcd… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.237-335-ge2984ffcd… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.login: https://kernelci.org/test/case/id/62589f5548bff45339ae0683 failing since 14 days (last pass: v4.19.235-17-gd92d6a84236d, first fail: v4.19.235-22-ge34a3fde5b20) platform | arch | lab | compiler | defconfig | regressions ---------------------+-------+---------------+----------+----------------------------+------------ meson-gxl-s905d-p230 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/62589f56fd4f661875ae06b6 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.237-335-ge2984ffcd… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.237-335-ge2984ffcd… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.login: https://kernelci.org/test/case/id/62589f56fd4f661875ae06b7 failing since 8 days (last pass: v4.19.237-15-g3c6b80cc3200, first fail: v4.19.237-256-ge149a8f3cb39) platform | arch | lab | compiler | defconfig | regressions ---------------------+-------+---------------+----------+----------------------------+------------ rk3399-gru-kevin | arm64 | lab-collabora | gcc-10 | defconfig+arm64-chromebook | 1 Details: https://kernelci.org/test/plan/id/62589d308555a40bc0ae067d Results: 83 PASS, 7 FAIL, 0 SKIP Full config: defconfig+arm64-chromebook Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.237-335-ge2984ffcd… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.237-335-ge2984ffcd… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.bootrr.rockchip-i2s1-probed: https://kernelci.org/test/case/id/62589d308555a40bc0ae069f failing since 39 days (last pass: v4.19.232-31-g5cf846953aa2, first fail: v4.19.232-44-gfd65e02206f4) 2022-04-14T22:15:51.430544 /lava-6092325/1/../bin/lava-test-case 2022-04-14T22:15:51.438731 <8>[ 36.910072] <LAVA_SIGNAL_TESTCASE TEST_CASE_ID=rockchip-i2s1-probed RESULT=fail>

3 years, 8 months

1
0
0 0

stable-rc/queue/5.17 baseline: 122 runs, 2 regressions (v5.17.3-7-g363c8c6fd7ed5)

by kernelci.org bot

stable-rc/queue/5.17 baseline: 122 runs, 2 regressions (v5.17.3-7-g363c8c6fd7ed5) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions -------------------+-------+-------------+----------+-------------------+------------ at91sam9g20ek | arm | lab-broonie | gcc-10 | at91_dt_defconfig | 1 kontron-pitx-imx8m | arm64 | lab-kontron | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F5.17/kernel/v5.17.3-… Test: baseline Tree: stable-rc Branch: queue/5.17 Describe: v5.17.3-7-g363c8c6fd7ed5 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: 363c8c6fd7ed5459b0fcf4dde2e4b3c985062bf9 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions -------------------+-------+-------------+----------+-------------------+------------ at91sam9g20ek | arm | lab-broonie | gcc-10 | at91_dt_defconfig | 1 Details: https://kernelci.org/test/plan/id/62589100b40f853e94ae0681 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: at91_dt_defconfig Compiler: gcc-10 (arm-linux-gnueabihf-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-5.17/v5.17.3-7-g363c8c6fd7ed5… HTML log: https://storage.kernelci.org//stable-rc/queue-5.17/v5.17.3-7-g363c8c6fd7ed5… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.login: https://kernelci.org/test/case/id/62589100b40f853e94ae0682 failing since 0 day (last pass: v5.17.2-343-g74625fba2cc43, first fail: v5.17.3-7-g214113ee8b920) platform | arch | lab | compiler | defconfig | regressions -------------------+-------+-------------+----------+-------------------+------------ kontron-pitx-imx8m | arm64 | lab-kontron | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/62589442450e579e33ae070d Results: 51 PASS, 1 FAIL, 1 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-5.17/v5.17.3-7-g363c8c6fd7ed5… HTML log: https://storage.kernelci.org//stable-rc/queue-5.17/v5.17.3-7-g363c8c6fd7ed5… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.bootrr.dwc3-usb1-probed: https://kernelci.org/test/case/id/62589442450e579e33ae0720 new failure (last pass: v5.17.3-7-g214113ee8b920) 2022-04-14T21:37:53.851643 /lava-108813/1/../bin/lava-test-case 2022-04-14T21:37:53.851969 <8>[ 13.473831] <LAVA_SIGNAL_TESTCASE TEST_CASE_ID=dwc3-usb1-probed RESULT=fail> 2022-04-14T21:37:53.852168 /lava-108813/1/../bin/lava-test-case 2022-04-14T21:37:53.852364 <8>[ 13.493615] <LAVA_SIGNAL_TESTCASE TEST_CASE_ID=imx8mq-usb-phy-driver-present RESULT=pass> 2022-04-14T21:37:53.852527 /lava-108813/1/../bin/lava-test-case 2022-04-14T21:37:53.852680 <8>[ 13.514827] <LAVA_SIGNAL_TESTCASE TEST_CASE_ID=imx8mq-usb-phy0-probed RESULT=pass> 2022-04-14T21:37:53.852835 /lava-108813/1/../bin/lava-test-case

3 years, 8 months

1
0
0 0

stable-rc/queue/4.14 baseline: 88 runs, 1 regressions (v4.14.275-260-g695466583e7c4)

by kernelci.org bot

stable-rc/queue/4.14 baseline: 88 runs, 1 regressions (v4.14.275-260-g695466583e7c4) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions ---------------------+-------+--------------+----------+-----------+------------ meson-gxl-s905d-p230 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F4.14/kernel/v4.14.27… Test: baseline Tree: stable-rc Branch: queue/4.14 Describe: v4.14.275-260-g695466583e7c4 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: 695466583e7c4ff61e11c4c3d8c3f3d2db2e0c81 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions ---------------------+-------+--------------+----------+-----------+------------ meson-gxl-s905d-p230 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/62588c412dc4fd60bdae06df Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.275-260-g695466583… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.275-260-g695466583… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.login: https://kernelci.org/test/case/id/62588c412dc4fd60bdae06e0 failing since 8 days (last pass: v4.14.271-23-g28704797a540, first fail: v4.14.275-206-gfa920f352ff15)

3 years, 8 months

1
0
0 0

stable-rc/queue/5.15 baseline: 70 runs, 1 regressions (v5.15.34-8-g941e079ae4c32)

by kernelci.org bot

stable-rc/queue/5.15 baseline: 70 runs, 1 regressions (v5.15.34-8-g941e079ae4c32) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions ----------+------+--------------+----------+---------------------+------------ beagle-xm | arm | lab-baylibre | gcc-10 | omap2plus_defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F5.15/kernel/v5.15.34… Test: baseline Tree: stable-rc Branch: queue/5.15 Describe: v5.15.34-8-g941e079ae4c32 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: 941e079ae4c3236b0cd98ef9633866270abfe26a Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions ----------+------+--------------+----------+---------------------+------------ beagle-xm | arm | lab-baylibre | gcc-10 | omap2plus_defconfig | 1 Details: https://kernelci.org/test/plan/id/625885ef65bdfefe3eae067c Results: 0 PASS, 1 FAIL, 0 SKIP Full config: omap2plus_defconfig Compiler: gcc-10 (arm-linux-gnueabihf-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.34-8-g941e079ae4c3… HTML log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.34-8-g941e079ae4c3… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.login: https://kernelci.org/test/case/id/625885ef65bdfefe3eae067d failing since 15 days (last pass: v5.15.31-2-g57d4301e22c2, first fail: v5.15.31-3-g4ae45332eb9c)

3 years, 8 months

1
0
0 0

stable-rc/queue/4.9 baseline: 44 runs, 1 regressions (v4.9.310-201-g4d7a1adf26695)

by kernelci.org bot

stable-rc/queue/4.9 baseline: 44 runs, 1 regressions (v4.9.310-201-g4d7a1adf26695) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions ----------------+-------+--------------+----------+-----------+------------ meson-gxbb-p200 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F4.9/kernel/v4.9.310-… Test: baseline Tree: stable-rc Branch: queue/4.9 Describe: v4.9.310-201-g4d7a1adf26695 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: 4d7a1adf266955818a797b28f417e09535b1b378 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions ----------------+-------+--------------+----------+-----------+------------ meson-gxbb-p200 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/6258780306c123c473ae06a3 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.9/v4.9.310-201-g4d7a1adf266… HTML log: https://storage.kernelci.org//stable-rc/queue-4.9/v4.9.310-201-g4d7a1adf266… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.login: https://kernelci.org/test/case/id/6258780306c123c473ae06a4 failing since 9 days (last pass: v4.9.306-19-g53cdf8047e71, first fail: v4.9.307-10-g6fa56dc70baa)

3 years, 8 months

1
0
0 0

[PATCH v3 00/18 stable-5.15.y] Fix mmap + page fault deadlocks

by Anand Jain

v3: Fix the patch order and fix the missing symbol compile error when compiled after each patch is applied. v2: Rebase on the latest stable-5.15.33. Adds the following commits to the v1 patchset as they fix issues in the merged commit. ca93e44bfb5f btrfs: fallback to blocking mode when doing async dio over multiple extents fe673d3f5bf1 mm: gup: make fault_in_safe_writeable() use fixup_user_fault() And this set drops the following patch as it is already in the stable-5.15.y. [PATCH 01/17 stable-5.15.y] powerpc/kvm: Fix kvm_use_magic_page ------- original cover letter -------- This set fixes a process hang issue in btrfs and gf2 filesystems. When we do a direct IO read or write when the buffer given by the user is memory-mapped to the file range we are going to do IO, we end up ending in a deadlock. This is triggered by the test case generic/647 from fstests. This fix depends on the iov_iter and iomap changes introduced in the commit c03098d4b9ad ("Merge tag 'gfs2-v5.15-rc5-mmap-fault' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2") and they are part of this set for stable-5.15.y. Please note that patch 2/18 (in v2) (was 3/17 in v1) in the patchset changes the prototype and renames an exported symbol as below. All its references are updated as well. -EXPORT_SYMBOL(iov_iter_fault_in_readable); +EXPORT_SYMBOL(fault_in_iov_iter_readable); Andreas Gruenbacher (14): gup: Turn fault_in_pages_{readable,writeable} into fault_in_{readable,writeable} iov_iter: Turn iov_iter_fault_in_readable into fault_in_iov_iter_readable iov_iter: Introduce fault_in_iov_iter_writeable gfs2: Add wrapper for iomap_file_buffered_write gfs2: Clean up function may_grant gfs2: Move the inode glock locking to gfs2_file_buffered_write gfs2: Eliminate ip->i_gh gfs2: Fix mmap + page fault deadlocks for buffered I/O iomap: Fix iomap_dio_rw return value for user copies iomap: Support partial direct I/O on user copy failures iomap: Add done_before argument to iomap_dio_rw gup: Introduce FOLL_NOFAULT flag to disable page faults iov_iter: Introduce nofault flag to disable page faults gfs2: Fix mmap + page fault deadlocks for direct I/O Bob Peterson (1): gfs2: Introduce flag for glock holder auto-demotion Filipe Manana (2): btrfs: fix deadlock due to page faults during direct IO reads and writes btrfs: fallback to blocking mode when doing async dio over multiple extents Linus Torvalds (1): mm: gup: make fault_in_safe_writeable() use fixup_user_fault() arch/powerpc/kernel/kvm.c | 3 +- arch/powerpc/kernel/signal_32.c | 4 +- arch/powerpc/kernel/signal_64.c | 2 +- arch/x86/kernel/fpu/signal.c | 7 +- drivers/gpu/drm/armada/armada_gem.c | 7 +- fs/btrfs/file.c | 142 ++++++++++-- fs/btrfs/inode.c | 28 +++ fs/btrfs/ioctl.c | 5 +- fs/erofs/data.c | 2 +- fs/ext4/file.c | 5 +- fs/f2fs/file.c | 2 +- fs/fuse/file.c | 2 +- fs/gfs2/bmap.c | 60 +---- fs/gfs2/file.c | 252 +++++++++++++++++++-- fs/gfs2/glock.c | 330 +++++++++++++++++++++------- fs/gfs2/glock.h | 20 ++ fs/gfs2/incore.h | 4 +- fs/iomap/buffered-io.c | 2 +- fs/iomap/direct-io.c | 29 ++- fs/ntfs/file.c | 2 +- fs/ntfs3/file.c | 2 +- fs/xfs/xfs_file.c | 6 +- fs/zonefs/super.c | 4 +- include/linux/iomap.h | 11 +- include/linux/mm.h | 3 +- include/linux/pagemap.h | 58 +---- include/linux/uio.h | 4 +- lib/iov_iter.c | 98 +++++++-- mm/filemap.c | 4 +- mm/gup.c | 120 +++++++++- 30 files changed, 920 insertions(+), 298 deletions(-) -- 2.33.1

3 years, 8 months

1
18
0 0

[PATCH v2 00/18 stable-5.15.y] Fix mmap + page fault deadlocks

by Anand Jain

v2: Rebase on the latest stable-5.15.33. Adds the following commits to the v1 patchset as they fix issues in the merged commit. ca93e44bfb5f btrfs: fallback to blocking mode when doing async dio over multiple extents fe673d3f5bf1 mm: gup: make fault_in_safe_writeable() use fixup_user_fault() And this set drops the following patch as it is already in the stable-5.15.y. [PATCH 01/17 stable-5.15.y] powerpc/kvm: Fix kvm_use_magic_page ------- original cover letter -------- This set fixes a process hang issue in btrfs and gf2 filesystems. When we do a direct IO read or write when the buffer given by the user is memory-mapped to the file range we are going to do IO, we end up ending in a deadlock. This is triggered by the test case generic/647 from fstests. This fix depends on the iov_iter and iomap changes introduced in the commit c03098d4b9ad ("Merge tag 'gfs2-v5.15-rc5-mmap-fault' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2") and they are part of this set for stable-5.15.y. Please note that patch 2/18 (in v2) (was 3/17 in v1) in the patchset changes the prototype and renames an exported symbol as below. All its references are updated as well. -EXPORT_SYMBOL(iov_iter_fault_in_readable); +EXPORT_SYMBOL(fault_in_iov_iter_readable); Andreas Gruenbacher (14): gup: Turn fault_in_pages_{readable,writeable} into fault_in_{readable,writeable} iov_iter: Turn iov_iter_fault_in_readable into fault_in_iov_iter_readable iov_iter: Introduce fault_in_iov_iter_writeable gfs2: Add wrapper for iomap_file_buffered_write gfs2: Clean up function may_grant gfs2: Move the inode glock locking to gfs2_file_buffered_write gfs2: Eliminate ip->i_gh gfs2: Fix mmap + page fault deadlocks for buffered I/O iomap: Fix iomap_dio_rw return value for user copies iomap: Support partial direct I/O on user copy failures iomap: Add done_before argument to iomap_dio_rw gup: Introduce FOLL_NOFAULT flag to disable page faults iov_iter: Introduce nofault flag to disable page faults gfs2: Fix mmap + page fault deadlocks for direct I/O Bob Peterson (1): gfs2: Introduce flag for glock holder auto-demotion Filipe Manana (2): btrfs: fix deadlock due to page faults during direct IO reads and writes btrfs: fallback to blocking mode when doing async dio over multiple extents Linus Torvalds (1): mm: gup: make fault_in_safe_writeable() use fixup_user_fault() arch/powerpc/kernel/kvm.c | 3 +- arch/powerpc/kernel/signal_32.c | 4 +- arch/powerpc/kernel/signal_64.c | 2 +- arch/x86/kernel/fpu/signal.c | 7 +- drivers/gpu/drm/armada/armada_gem.c | 7 +- fs/btrfs/file.c | 142 ++++++++++-- fs/btrfs/inode.c | 28 +++ fs/btrfs/ioctl.c | 5 +- fs/erofs/data.c | 2 +- fs/ext4/file.c | 5 +- fs/f2fs/file.c | 2 +- fs/fuse/file.c | 2 +- fs/gfs2/bmap.c | 60 +---- fs/gfs2/file.c | 252 +++++++++++++++++++-- fs/gfs2/glock.c | 330 +++++++++++++++++++++------- fs/gfs2/glock.h | 20 ++ fs/gfs2/incore.h | 4 +- fs/iomap/buffered-io.c | 2 +- fs/iomap/direct-io.c | 29 ++- fs/ntfs/file.c | 2 +- fs/ntfs3/file.c | 2 +- fs/xfs/xfs_file.c | 6 +- fs/zonefs/super.c | 4 +- include/linux/iomap.h | 11 +- include/linux/mm.h | 3 +- include/linux/pagemap.h | 58 +---- include/linux/uio.h | 4 +- lib/iov_iter.c | 98 +++++++-- mm/filemap.c | 4 +- mm/gup.c | 120 +++++++++- 30 files changed, 920 insertions(+), 298 deletions(-) -- 2.33.1

3 years, 8 months

1
19
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror April 2022