July 2024 - Linux-stable-mirror

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.318 release. There are 66 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 19 Jul 2024 10:10:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.318-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.318-rc3 Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: rcar: bring hardware to known state when probing Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix kernel bug on rename operation of broken directory felix <fuzhen5(a)huawei.com> SUNRPC: Fix RPC client cleaned up the freed pipefs dentries Eric Dumazet <edumazet(a)google.com> tcp: avoid too many retransmit packets Eric Dumazet <edumazet(a)google.com> tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() Menglong Dong <imagedong(a)tencent.com> net: tcp: fix unexcepted socket die when snd_wnd is 0 Eric Dumazet <edumazet(a)google.com> tcp: refactor tcp_retransmit_timer() Ilya Dryomov <idryomov(a)gmail.com> libceph: fix race between delayed_work() and ceph_monc_stop() He Zhe <zhe.he(a)windriver.com> hpet: Support 32-bit userspace Alan Stern <stern(a)rowland.harvard.edu> USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor Lee Jones <lee(a)kernel.org> usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() WangYuli <wangyuli(a)uniontech.com> USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k Vanillan Wang <vanillanwang(a)163.com> USB: serial: option: add Rolling RW350-GL variants Mank Wang <mank.wang(a)netprisma.us> USB: serial: option: add Netprisma LCUK54 series modules Slark Xiao <slark_xiao(a)163.com> USB: serial: option: add support for Foxconn T99W651 Bjørn Mork <bjorn(a)mork.no> USB: serial: option: add Fibocom FM350-GL Daniele Palmas <dnlplm(a)gmail.com> USB: serial: option: add Telit FN912 rmnet compositions Daniele Palmas <dnlplm(a)gmail.com> USB: serial: option: add Telit generic core-dump composition Chen Ni <nichen(a)iscas.ac.cn> ARM: davinci: Convert comma to semicolon Dmitry Antipov <dmantipov(a)yandex.ru> ppp: reject claimed-as-LCP but actually malformed packets Aleksander Jan Bajkowski <olek2(a)wp.pl> net: ethernet: lantiq_etop: fix double free in detach Aleksander Jan Bajkowski <olek2(a)wp.pl> net: lantiq_etop: add blank line after declaration Neal Cardwell <ncardwell(a)google.com> tcp: fix incorrect undo caused by DSACK of TLP retransmit Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/i915: make find_fw_domain work on intel_uncore Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix incorrect inode allocation from reserved inodes Piotr Wojtaszczyk <piotr.wojtaszczyk(a)timesys.com> i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr Mauro Carvalho Chehab <mchehab(a)kernel.org> media: dw2102: fix a potential buffer overflow Ghadi Elie Rahme <ghadi.rahme(a)canonical.com> bnx2x: Fix multiple UBSAN array-index-out-of-bounds Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/atomfirmware: silence UBSAN warning Ma Ke <make24(a)iscas.ac.cn> drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes Jan Kara <jack(a)suse.cz> Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" Jan Kara <jack(a)suse.cz> fsnotify: Do not generate events for O_PATH file descriptors Jimmy Assarsson <extja(a)kvaser.com> can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct Jaganath Kanakkassery <jaganath.k.os(a)gmail.com> Bluetooth: Fix incorrect pointer arithmatic in ext_adv_report_evt Jinliang Zheng <alexjlzheng(a)tencent.com> mm: optimize the redundant loop of mm_update_owner_next() Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: add missing check for inode numbers on directory entries Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix inode number range checks Shigeru Yoshida <syoshida(a)redhat.com> inet_diag: Initialize pad field in struct inet_diag_req_v2 Zijian Zhang <zijianzhang(a)bytedance.com> selftests: make order checking verbose in msg_zerocopy selftest Zijian Zhang <zijianzhang(a)bytedance.com> selftests: fix OOM in msg_zerocopy selftest Sam Sun <samsun1006219(a)gmail.com> bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() Jakub Kicinski <kuba(a)kernel.org> tcp_metrics: validate source addr length Neal Cardwell <ncardwell(a)google.com> UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open() Yuchung Cheng <ycheng(a)google.com> net: tcp better handling of reordering then loss cases Yousuk Seung <ysseung(a)google.com> tcp: add ece_ack flag to reno sack functions zhang kai <zhangkaiheb(a)126.com> tcp: tcp_mark_head_lost is only valid for sack-tcp Eric Dumazet <edumazet(a)google.com> tcp: take care of compressed acks in tcp_add_reno_sack() Holger Dengler <dengler(a)linux.ibm.com> s390/pkey: Wipe sensitive data on failure Wang Yong <wang.yong12(a)zte.com.cn> jffs2: Fix potential illegal address access in jffs2_free_inode Greg Kurz <groug(a)kaod.org> powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#" Mike Marshall <hubcap(a)omnibond.com> orangefs: fix out-of-bounds fsid access Michael Ellerman <mpe(a)ellerman.id.au> powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n Heiner Kallweit <hkallweit1(a)gmail.com> i2c: i801: Annotate apanel_addr as __ro_after_init Ricardo Ribalda <ribalda(a)chromium.org> media: dvb-frontends: tda10048: Fix integer overflow Ricardo Ribalda <ribalda(a)chromium.org> media: s2255: Use refcount_t instead of atomic_t for num_channels Ricardo Ribalda <ribalda(a)chromium.org> media: dvb-frontends: tda18271c2dd: Remove casting during div Simon Horman <horms(a)kernel.org> net: dsa: mv88e6xxx: Correct check for empty list Erick Archer <erick.archer(a)outlook.com> Input: ff-core - prefer struct_size over open coded arithmetic Jean Delvare <jdelvare(a)suse.de> firmware: dmi: Stop decoding on broken entry Erick Archer <erick.archer(a)outlook.com> sctp: prefer struct_size over open coded arithmetic Michael Bunk <micha(a)freedict.org> media: dw2102: Don't translate i2c read into write Alex Hung <alex.hung(a)amd.com> drm/amd/display: Skip finding free audio for unknown engine_id Michael Guralnik <michaelgur(a)nvidia.com> IB/core: Implement a limit on UMAD receive List Ricardo Ribalda <ribalda(a)chromium.org> media: dvb-usb: dib0700_devices: Add missing release_firmware() Ricardo Ribalda <ribalda(a)chromium.org> media: dvb: as102-fe: Fix as10x_register_addr packing Arnd Bergmann <arnd(a)arndb.de> asm-generic: Move common compat types to asm-generic/compat.h ------------- Diffstat: Makefile | 4 +- arch/arm/mach-davinci/pm.c | 2 +- arch/arm64/include/asm/compat.h | 20 +-- arch/mips/include/asm/compat.h | 22 +-- arch/parisc/include/asm/compat.h | 18 +-- arch/powerpc/include/asm/compat.h | 18 +-- arch/powerpc/include/asm/io.h | 2 +- arch/powerpc/xmon/xmon.c | 6 +- arch/s390/include/asm/compat.h | 18 +-- arch/sparc/include/asm/compat.h | 19 +-- arch/x86/include/asm/compat.h | 19 +-- drivers/char/hpet.c | 34 ++++- drivers/firmware/dmi_scan.c | 11 ++ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 + drivers/gpu/drm/amd/include/atomfirmware.h | 2 +- drivers/gpu/drm/i915/intel_uncore.c | 20 +-- drivers/gpu/drm/nouveau/nouveau_connector.c | 3 + drivers/i2c/busses/i2c-i801.c | 2 +- drivers/i2c/busses/i2c-pnx.c | 48 ++----- drivers/i2c/busses/i2c-rcar.c | 17 ++- drivers/infiniband/core/user_mad.c | 21 ++- drivers/input/ff-core.c | 7 +- drivers/media/dvb-frontends/as102_fe_types.h | 2 +- drivers/media/dvb-frontends/tda10048.c | 9 +- drivers/media/dvb-frontends/tda18271c2dd.c | 4 +- drivers/media/usb/dvb-usb/dib0700_devices.c | 18 ++- drivers/media/usb/dvb-usb/dw2102.c | 120 +++++++++------- drivers/media/usb/s2255/s2255drv.c | 20 +-- drivers/net/bonding/bond_options.c | 6 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 1 + drivers/net/dsa/mv88e6xxx/chip.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 2 +- drivers/net/ethernet/lantiq_etop.c | 5 +- drivers/net/ppp/ppp_generic.c | 15 ++ drivers/s390/crypto/pkey_api.c | 4 +- drivers/usb/core/config.c | 18 ++- drivers/usb/core/quirks.c | 3 + drivers/usb/gadget/configfs.c | 3 + drivers/usb/serial/option.c | 38 ++++++ fs/jffs2/super.c | 1 + fs/nilfs2/alloc.c | 18 ++- fs/nilfs2/alloc.h | 4 +- fs/nilfs2/dat.c | 2 +- fs/nilfs2/dir.c | 38 +++++- fs/nilfs2/ifile.c | 7 +- fs/nilfs2/nilfs.h | 10 +- fs/nilfs2/the_nilfs.c | 6 + fs/nilfs2/the_nilfs.h | 2 +- fs/orangefs/super.c | 3 +- include/asm-generic/compat.h | 24 +++- include/linux/compat.h | 2 - include/linux/fsnotify.h | 8 +- include/linux/sunrpc/clnt.h | 1 + kernel/exit.c | 2 + mm/page-writeback.c | 2 +- net/bluetooth/hci_event.c | 2 +- net/ceph/mon_client.c | 14 +- net/ipv4/inet_diag.c | 2 + net/ipv4/tcp_input.c | 158 ++++++++++++---------- net/ipv4/tcp_metrics.c | 1 + net/ipv4/tcp_timer.c | 45 +++++- net/sctp/socket.c | 7 +- net/sunrpc/clnt.c | 5 +- tools/testing/selftests/net/msg_zerocopy.c | 14 +- 64 files changed, 580 insertions(+), 386 deletions(-)

1 year, 3 months

4
4
0 0

[PATCH 6.9 000/143] 6.9.10-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.9.10 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 18 Jul 2024 15:27:21 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.9.10-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.9.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.9.10-rc1 Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> kbuild: rpm-pkg: avoid the warnings with dtb's listed twice Nathan Chancellor <nathan(a)kernel.org> kbuild: Make ld-version.sh more robust against version string changes Alexandre Chartre <alexandre.chartre(a)oracle.com> x86/bhi: Avoid warning in #DB handler due to BHI mitigation Wander Lairson Costa <wander(a)redhat.com> sched/deadline: Fix task_struct reference leak Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: testunit: avoid re-issued work after read message Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: rcar: ensure Gen3+ reset does not disturb local targets Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: mark HostNotify target address as used Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: rcar: clear NO_RXDMA flag after resetting Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: rcar: bring hardware to known state when probing Baokun Li <libaokun1(a)huawei.com> ext4: avoid ptr null pointer dereference Komal Bajaj <quic_kbajaj(a)quicinc.com> Revert "dt-bindings: cache: qcom,llcc: correct QDU1000 reg entries" SeongJae Park <sj(a)kernel.org> mm/damon/core: merge regions aggressively when max_nr_regions is unmet Gavin Shan <gshan(a)redhat.com> mm/shmem: disable PMD-sized page cache if needed Gavin Shan <gshan(a)redhat.com> mm/readahead: limit page cache size in page_cache_ra_order() Ekansh Gupta <quic_ekangupt(a)quicinc.com> misc: fastrpc: Restrict untrusted app to attach to privileged PD Ekansh Gupta <quic_ekangupt(a)quicinc.com> misc: fastrpc: Fix ownership reassignment of remote heap Ekansh Gupta <quic_ekangupt(a)quicinc.com> misc: fastrpc: Fix memory leak in audio daemon attach operation Ekansh Gupta <quic_ekangupt(a)quicinc.com> misc: fastrpc: Copy the complete capability structure to user Ekansh Gupta <quic_ekangupt(a)quicinc.com> misc: fastrpc: Avoid updating PD type for capability request Ekansh Gupta <quic_ekangupt(a)quicinc.com> misc: fastrpc: Fix DSP capabilities request Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: annotate intentional data race in checking empty queue Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: queueing: annotate intentional data race in cpu round robin Helge Deller <deller(a)kernel.org> wireguard: allowedips: avoid unaligned 64-bit memory accesses Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: selftests: use acpi=off instead of -no-acpi for recent QEMU Mario Limonciello <mario.limonciello(a)amd.com> cpufreq: Allow drivers to advertise boost enabled Mario Limonciello <mario.limonciello(a)amd.com> cpufreq: ACPI: Mark boost policy as enabled when setting boost Kuan-Wei Chiu <visitorckw(a)gmail.com> ACPI: processor_idle: Fix invalid comparison with insertion sort for latency Ilya Dryomov <idryomov(a)gmail.com> libceph: fix race between delayed_work() and ceph_monc_stop() Taniya Das <quic_tdas(a)quicinc.com> pmdomain: qcom: rpmhpd: Skip retention level for Power Domains Bastien Curutchet <bastien.curutchet(a)bootlin.com> mmc: davinci_mmc: Prevent transmitted data size from exceeding sgm's length Adrian Hunter <adrian.hunter(a)intel.com> mmc: sdhci: Fix max_seg_size for 64KiB PAGE_SIZE Audra Mitchell <audra(a)redhat.com> Fix userfaultfd_api to return EINVAL as expected Wentong Wu <wentong.wu(a)intel.com> mei: vsc: Utilize the appropriate byte order swap function Wentong Wu <wentong.wu(a)intel.com> mei: vsc: Prevent timeout error with added delay post-firmware download Wentong Wu <wentong.wu(a)intel.com> mei: vsc: Enhance IVSC chipset stability during warm reboot Edson Juliano Drosdeck <edson.drosdeck(a)gmail.com> ALSA: hda/realtek: Limit mic boost on VAIO PRO PX Nazar Bilinskyi <nbilinskyi(a)gmail.com> ALSA: hda/realtek: Enable Mute LED on HP 250 G7 Michał Kopeć <michal.kopec(a)3mdeb.com> ALSA: hda/realtek: add quirk for Clevo V5[46]0TU Rasmus Villemoes <linux(a)rasmusvillemoes.dk> serial: imx: ensure RTS signal is not left active after shutdown Jacky Huang <ychuang3(a)nuvoton.com> tty: serial: ma35d1: Add a NULL check for of_node Armin Wolf <W_Armin(a)gmx.de> platform/x86: toshiba_acpi: Fix array out-of-bounds access Thomas Weißschuh <linux(a)weissschuh.net> nvmem: core: limit cell sysfs permissions to main attribute ones Thomas Weißschuh <linux(a)weissschuh.net> nvmem: core: only change name to fram for current attribute Joy Chakraborty <joychakr(a)google.com> nvmem: meson-efuse: Fix return value of nvmem callbacks Joy Chakraborty <joychakr(a)google.com> nvmem: rmem: Fix return value of rmem_read() Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> arm64: dts: qcom: x1e80100-crd: fix DAI used for headset recording Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> arm64: dts: qcom: x1e80100-crd: fix WCD audio codec TX port mapping Johan Hovold <johan+linaro(a)kernel.org> arm64: dts: qcom: sc8280xp-x13s: fix touchscreen power on Cong Zhang <quic_congzhan(a)quicinc.com> arm64: dts: qcom: sa8775p: Correct IRQ number of EL2 non-secure physical timer João Paulo Gonçalves <joao.goncalves(a)toradex.com> iio: trigger: Fix condition for own trigger Damien Le Moal <dlemoal(a)kernel.org> scsi: sd: Do not repeat the starting disk message Hobin Woo <hobin.woo(a)samsung.com> ksmbd: discard write access to the directory open Gavin Shan <gshan(a)redhat.com> mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray Gavin Shan <gshan(a)redhat.com> mm/filemap: skip to create PMD-sized page cache if needed ZhangPeng <zhangpeng362(a)huawei.com> filemap: replace pte_offset_map() with pte_offset_map_nolock() Hugh Dickins <hughd(a)google.com> mm: fix crashes from deferred split racing folio migration Uladzislau Rezki (Sony) <urezki(a)gmail.com> mm: vmalloc: check if a hash-index is in cpu_possible_mask Nhat Pham <nphamcs(a)gmail.com> cachestat: do not flush stats in recency check Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix kernel bug on rename operation of broken directory Heiko Carstens <hca(a)linux.ibm.com> s390/mm: Add NULL pointer check to crst_table_free() base_crst_free() Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: always resume roothubs if xHC was reset during resume He Zhe <zhe.he(a)windriver.com> hpet: Support 32-bit userspace Joy Chakraborty <joychakr(a)google.com> misc: microchip: pci1xxxx: Fix return value of nvmem callbacks Alan Stern <stern(a)rowland.harvard.edu> USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor Lee Jones <lee(a)kernel.org> usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() Javier Carrasco <javier.carrasco.cruz(a)gmail.com> usb: core: add missing of_node_put() in usb_of_has_devices_or_graph Heikki Krogerus <heikki.krogerus(a)linux.intel.com> usb: dwc3: pci: add support for the Intel Panther Lake WangYuli <wangyuli(a)uniontech.com> USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k Dmitry Smirnov <d.smirnov(a)inbox.lv> USB: serial: mos7840: fix crash on resume Vanillan Wang <vanillanwang(a)163.com> USB: serial: option: add Rolling RW350-GL variants Mank Wang <mank.wang(a)netprisma.us> USB: serial: option: add Netprisma LCUK54 series modules Slark Xiao <slark_xiao(a)163.com> USB: serial: option: add support for Foxconn T99W651 Bjørn Mork <bjorn(a)mork.no> USB: serial: option: add Fibocom FM350-GL Daniele Palmas <dnlplm(a)gmail.com> USB: serial: option: add Telit FN912 rmnet compositions Daniele Palmas <dnlplm(a)gmail.com> USB: serial: option: add Telit generic core-dump composition Ronald Wahl <ronald.wahl(a)raritan.com> net: ks8851: Fix potential TX stall after interface reopen Ronald Wahl <ronald.wahl(a)raritan.com> net: ks8851: Fix deadlock with the SPI chip variant Josh Don <joshdon(a)google.com> Revert "sched/fair: Make sure to try to detach at least one movable task" Steve French <stfrench(a)microsoft.com> cifs: fix setting SecurityFlags to true Satheesh Paul <psatheesh(a)marvell.com> octeontx2-af: fix issue with IPv4 match for RSS Kiran Kumar K <kirankumark(a)marvell.com> octeontx2-af: fix issue with IPv6 ext match for RSS Michal Mazur <mmazur2(a)marvell.com> octeontx2-af: fix detection of IP layer Srujana Challa <schalla(a)marvell.com> octeontx2-af: fix a issue with cpt_lf_alloc mailbox Nithin Dabilpuram <ndabilpuram(a)marvell.com> octeontx2-af: replace cpt slot with lf id on reg write Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> i40e: fix: remove needless retries of NVM update Saeed Mahameed <saeedm(a)nvidia.com> net: ethtool: Fix RSS setting Chen Ni <nichen(a)iscas.ac.cn> ARM: davinci: Convert comma to semicolon Richard Fitzgerald <rf(a)opensource.cirrus.com> firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ASoC: SOF: Intel: hda: fix null deref on system suspend entry Richard Fitzgerald <rf(a)opensource.cirrus.com> firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers Richard Fitzgerald <rf(a)opensource.cirrus.com> firmware: cs_dsp: Validate payload length before processing block Richard Fitzgerald <rf(a)opensource.cirrus.com> firmware: cs_dsp: Return error if block header overflows file Richard Fitzgerald <rf(a)opensource.cirrus.com> firmware: cs_dsp: Fix overflow checking of wmfw header Komal Bajaj <quic_kbajaj(a)quicinc.com> arm64: dts: qcom: qdu1000: Fix LLCC reg property Caleb Connolly <caleb.connolly(a)linaro.org> arm64: dts: qcom: sm6115: add iommu for sdhc_1 Abel Vesa <abel.vesa(a)linaro.org> arm64: dts: qcom: x1e80100: Fix PCIe 6a reg offsets and add MHI Andre Przywara <andre.przywara(a)arm.com> arm64: dts: allwinner: Fix PMIC interrupt number Konrad Dybcio <konrad.dybcio(a)linaro.org> arm64: dts: qcom: x1e80100-*: Allocate some CMA buffers Bjorn Andersson <quic_bjorande(a)quicinc.com> arm64: dts: qcom: sc8180x: Fix LLCC reg property again Daniel Borkmann <daniel(a)iogearbox.net> net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket Chengen Du <chengen.du(a)canonical.com> net/sched: Fix UAF when resolving a clash Kuniyuki Iwashima <kuniyu(a)amazon.com> udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: prefer nft_chain_validate Florian Westphal <fw(a)strlen.de> netfilter: nfnetlink_queue: drop bogus WARN_ON Oleksij Rempel <o.rempel(a)pengutronix.de> ethtool: netlink: do not return SQI value if link is down Dmitry Antipov <dmantipov(a)yandex.ru> ppp: reject claimed-as-LCP but actually malformed packets Jian Hui Lee <jianhui.lee(a)canonical.com> net: ethernet: mtk-star-emac: set mac_managed_pm when probing Eric Dumazet <edumazet(a)google.com> tcp: avoid too many retransmit packets Kumar Kartikeya Dwivedi <memxor(a)gmail.com> bpf: Defer work in bpf_timer_cancel_and_free Kumar Kartikeya Dwivedi <memxor(a)gmail.com> bpf: Fail bpf_timer_cancel when callback is being cancelled Benjamin Tissoires <bentiss(a)kernel.org> bpf: replace bpf_timer_init with a generic helper Benjamin Tissoires <bentiss(a)kernel.org> bpf: make timer data struct more generic Mohammad Shehar Yaar Tausif <sheharyaar48(a)gmail.com> bpf: fix order of args in call to bpf_map_kvcalloc Matthew Wilcox (Oracle) <willy(a)infradead.org> minixfs: Fix minixfs_rename with HIGHMEM Aleksander Jan Bajkowski <olek2(a)wp.pl> net: ethernet: lantiq_etop: fix double free in detach Michal Kubiak <michal.kubiak(a)intel.com> i40e: Fix XDP program unloading while removing the driver Hugh Dickins <hughd(a)google.com> net: fix rc7's __skb_datagram_iter() David Lechner <dlechner(a)baylibre.com> spi: add defer_optimize_message controller flag David Lechner <dlechner(a)baylibre.com> spi: don't unoptimize message in spi_async() Aleksandr Mishin <amishin(a)t-argos.ru> octeontx2-af: Fix incorrect value output on error path in rvu_check_rsrc_availability() Geliang Tang <tanggeliang(a)kylinos.cn> skmsg: Skip zero length skb in sk_msg_recvmsg Oleksij Rempel <o.rempel(a)pengutronix.de> net: phy: microchip: lan87xx: reinit PHY after cable test Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix too early release of tcx_entry Neal Cardwell <ncardwell(a)google.com> tcp: fix incorrect undo caused by DSACK of TLP retransmit Dan Carpenter <dan.carpenter(a)linaro.org> net: bcmasp: Fix error code in probe() Brian Foster <bfoster(a)redhat.com> vfs: don't mod negative dentry count when on shrinker list linke li <lilinke99(a)qq.com> fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading Jeff Layton <jlayton(a)kernel.org> filelock: fix potential use-after-free in posix_lock_inode Christian Eggers <ceggers(a)arri.de> dsa: lan9303: Fix mapping between DSA port number and PHY address Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: dsa: lan9303: provide own phylink MAC operations Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: dsa: allow DSA switch drivers to provide their own phylink mac ops Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: dsa: introduce dsa_phylink_to_port() Jingbo Xu <jefflexu(a)linux.alibaba.com> cachefiles: add missing lock protection when polling Baokun Li <libaokun1(a)huawei.com> cachefiles: cyclic allocation of msg_id to avoid reuse Hou Tao <houtao1(a)huawei.com> cachefiles: wait for ondemand_object_worker to finish when dropping object Baokun Li <libaokun1(a)huawei.com> cachefiles: cancel all requests for the object that is being dropped Baokun Li <libaokun1(a)huawei.com> cachefiles: stop sending new request when dropping object Baokun Li <libaokun1(a)huawei.com> cachefiles: propagate errors from vfs_getxattr() to avoid infinite loop David Lechner <dlechner(a)baylibre.com> spi: axi-spi-engine: fix sleep calculation Yi Liu <yi.l.liu(a)intel.com> vfio/pci: Init the count variable in collecting hot-reset devices Peter Wang <peter.wang(a)mediatek.com> scsi: ufs: core: Fix ufshcd_abort_one racing issue Peter Wang <peter.wang(a)mediatek.com> scsi: ufs: core: Fix ufshcd_clear_cmd racing issue Waiman Long <longman(a)redhat.com> mm: prevent derefencing NULL ptr in pfn_section_valid() ------------- Diffstat: Documentation/admin-guide/cifs/usage.rst | 34 +-- .../devicetree/bindings/cache/qcom,llcc.yaml | 2 +- Makefile | 4 +- arch/arm/mach-davinci/pm.c | 2 +- .../dts/allwinner/sun50i-h64-remix-mini-pc.dts | 2 +- arch/arm64/boot/dts/qcom/qdu1000.dtsi | 16 +- arch/arm64/boot/dts/qcom/sa8775p.dtsi | 2 +- arch/arm64/boot/dts/qcom/sc8180x.dtsi | 11 +- .../dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts | 15 +- arch/arm64/boot/dts/qcom/sm6115.dtsi | 1 + arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 13 +- arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 9 + arch/arm64/boot/dts/qcom/x1e80100.dtsi | 10 +- arch/s390/mm/pgalloc.c | 4 + arch/x86/entry/entry_64_compat.S | 14 +- drivers/acpi/processor_idle.c | 37 ++-- drivers/char/hpet.c | 34 ++- drivers/cpufreq/acpi-cpufreq.c | 4 +- drivers/cpufreq/cpufreq.c | 3 +- drivers/firmware/cirrus/cs_dsp.c | 231 +++++++++++++------ drivers/i2c/busses/i2c-rcar.c | 27 ++- drivers/i2c/i2c-core-base.c | 1 + drivers/i2c/i2c-slave-testunit.c | 7 + drivers/iio/industrialio-trigger.c | 2 +- drivers/misc/fastrpc.c | 41 +++- drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c | 4 - drivers/misc/mei/platform-vsc.c | 4 +- drivers/misc/mei/vsc-tp.c | 16 +- drivers/mmc/host/davinci_mmc.c | 3 + drivers/mmc/host/sdhci.c | 15 ++ drivers/net/dsa/lan9303-core.c | 54 +++-- drivers/net/ethernet/broadcom/asp2/bcmasp.c | 1 + drivers/net/ethernet/intel/i40e/i40e_adminq.h | 4 - drivers/net/ethernet/intel/i40e/i40e_main.c | 9 +- drivers/net/ethernet/lantiq_etop.c | 4 +- drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 2 +- drivers/net/ethernet/marvell/octeontx2/af/npc.h | 8 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- .../net/ethernet/marvell/octeontx2/af/rvu_cpt.c | 23 +- .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 12 +- drivers/net/ethernet/mediatek/mtk_star_emac.c | 7 + drivers/net/ethernet/micrel/ks8851_common.c | 10 +- drivers/net/ethernet/micrel/ks8851_spi.c | 4 +- drivers/net/phy/microchip_t1.c | 2 +- drivers/net/ppp/ppp_generic.c | 15 ++ drivers/net/wireguard/allowedips.c | 4 +- drivers/net/wireguard/queueing.h | 4 +- drivers/net/wireguard/send.c | 2 +- drivers/nvmem/core.c | 7 +- drivers/nvmem/meson-efuse.c | 14 +- drivers/nvmem/rmem.c | 5 +- drivers/platform/x86/toshiba_acpi.c | 1 + drivers/pmdomain/qcom/rpmhpd.c | 7 + drivers/scsi/sd.c | 5 +- drivers/spi/spi-axi-spi-engine.c | 26 ++- drivers/spi/spi-mux.c | 1 + drivers/spi/spi.c | 20 +- drivers/tty/serial/imx.c | 51 +++++ drivers/tty/serial/ma35d1_serial.c | 13 +- drivers/ufs/core/ufs-mcq.c | 11 +- drivers/ufs/core/ufshcd.c | 2 + drivers/usb/core/config.c | 18 +- drivers/usb/core/of.c | 7 +- drivers/usb/core/quirks.c | 3 + drivers/usb/dwc3/dwc3-pci.c | 8 + drivers/usb/gadget/configfs.c | 3 + drivers/usb/host/xhci.c | 16 +- drivers/usb/serial/mos7840.c | 45 ++++ drivers/usb/serial/option.c | 38 ++++ drivers/vfio/pci/vfio_pci_core.c | 2 +- fs/cachefiles/daemon.c | 4 +- fs/cachefiles/internal.h | 3 + fs/cachefiles/ondemand.c | 52 ++++- fs/cachefiles/xattr.c | 5 +- fs/dcache.c | 12 +- fs/ext4/sysfs.c | 2 + fs/locks.c | 2 +- fs/minix/namei.c | 3 +- fs/nilfs2/dir.c | 32 ++- fs/smb/client/cifsglob.h | 4 +- fs/smb/server/smb2pdu.c | 13 +- fs/userfaultfd.c | 7 +- include/linux/mmzone.h | 3 +- include/linux/pagemap.h | 11 +- include/linux/spi/spi.h | 4 + include/linux/swap.h | 3 +- include/net/dsa.h | 11 + include/net/tcx.h | 13 +- include/uapi/misc/fastrpc.h | 3 + kernel/bpf/bpf_local_storage.c | 4 +- kernel/bpf/helpers.c | 245 +++++++++++++++------ kernel/sched/deadline.c | 7 +- kernel/sched/fair.c | 12 +- mm/damon/core.c | 21 +- mm/filemap.c | 10 +- mm/memcontrol.c | 11 - mm/migrate.c | 13 ++ mm/readahead.c | 8 +- mm/shmem.c | 15 +- mm/vmalloc.c | 10 +- mm/workingset.c | 14 +- net/ceph/mon_client.c | 14 +- net/core/datagram.c | 3 +- net/core/skmsg.c | 3 +- net/dsa/dsa.c | 11 + net/dsa/port.c | 38 +++- net/ethtool/ioctl.c | 3 +- net/ethtool/linkstate.c | 41 ++-- net/ipv4/tcp_input.c | 11 +- net/ipv4/tcp_timer.c | 17 +- net/ipv4/udp.c | 4 +- net/netfilter/nf_tables_api.c | 158 ++----------- net/netfilter/nfnetlink_queue.c | 2 +- net/sched/act_ct.c | 8 + net/sched/sch_ingress.c | 12 +- net/sunrpc/xprtsock.c | 7 + scripts/ld-version.sh | 8 +- scripts/package/kernel.spec | 1 - sound/pci/hda/patch_realtek.c | 4 + sound/soc/sof/intel/hda-dai.c | 12 +- tools/testing/selftests/wireguard/qemu/Makefile | 8 +- 121 files changed, 1350 insertions(+), 610 deletions(-)

1 year, 3 months

9
153
0 0

[merged mm-nonmm-stable] watchdog-perf-properly-initialize-the-turbo-mode-timestamp-and-rearm-counter.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: watchdog/perf: properly initialize the turbo mode timestamp and rearm counter has been removed from the -mm tree. Its filename was watchdog-perf-properly-initialize-the-turbo-mode-timestamp-and-rearm-counter.patch This patch was dropped because it was merged into the mm-nonmm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Thomas Gleixner <tglx(a)linutronix.de> Subject: watchdog/perf: properly initialize the turbo mode timestamp and rearm counter Date: Thu, 11 Jul 2024 22:25:21 +0200 For systems on which the performance counter can expire early due to turbo modes the watchdog handler has a safety net in place which validates that since the last watchdog event there has at least 4/5th of the watchdog period elapsed. This works reliably only after the first watchdog event because the per CPU variable which holds the timestamp of the last event is never initialized. So a first spurious event will validate against a timestamp of 0 which results in a delta which is likely to be way over the 4/5 threshold of the period. As this might happen before the first watchdog hrtimer event increments the watchdog counter, this can lead to false positives. Fix this by initializing the timestamp before enabling the hardware event. Reset the rearm counter as well, as that might be non zero after the watchdog was disabled and reenabled. Link: https://lkml.kernel.org/r/87frsfu15a.ffs@tglx Fixes: 7edaeb6841df ("kernel/watchdog: Prevent false positives with turbo modes") Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: Arjan van de Ven <arjan(a)linux.intel.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- kernel/watchdog_perf.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) --- a/kernel/watchdog_perf.c~watchdog-perf-properly-initialize-the-turbo-mode-timestamp-and-rearm-counter +++ a/kernel/watchdog_perf.c @@ -75,11 +75,15 @@ static bool watchdog_check_timestamp(voi __this_cpu_write(last_timestamp, now); return true; } -#else -static inline bool watchdog_check_timestamp(void) + +static void watchdog_init_timestamp(void) { - return true; + __this_cpu_write(nmi_rearmed, 0); + __this_cpu_write(last_timestamp, ktime_get_mono_fast_ns()); } +#else +static inline bool watchdog_check_timestamp(void) { return true; } +static inline void watchdog_init_timestamp(void) { } #endif static struct perf_event_attr wd_hw_attr = { @@ -161,6 +165,7 @@ void watchdog_hardlockup_enable(unsigned if (!atomic_fetch_inc(&watchdog_cpus)) pr_info("Enabled. Permanently consumes one hw-PMU counter.\n"); + watchdog_init_timestamp(); perf_event_enable(this_cpu_read(watchdog_ev)); } _ Patches currently in -mm which might be from tglx(a)linutronix.de are

1 year, 3 months

1
0
0 0

[merged mm-stable] mm-mglru-fix-ineffective-protection-calculation.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/mglru: fix ineffective protection calculation has been removed from the -mm tree. Its filename was mm-mglru-fix-ineffective-protection-calculation.patch This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Yu Zhao <yuzhao(a)google.com> Subject: mm/mglru: fix ineffective protection calculation Date: Fri, 12 Jul 2024 17:29:56 -0600 mem_cgroup_calculate_protection() is not stateless and should only be used as part of a top-down tree traversal. shrink_one() traverses the per-node memcg LRU instead of the root_mem_cgroup tree, and therefore it should not call mem_cgroup_calculate_protection(). The existing misuse in shrink_one() can cause ineffective protection of sub-trees that are grandchildren of root_mem_cgroup. Fix it by reusing lru_gen_age_node(), which already traverses the root_mem_cgroup tree, to calculate the protection. Previously lru_gen_age_node() opportunistically skips the first pass, i.e., when scan_control->priority is DEF_PRIORITY. On the second pass, lruvec_is_sizable() uses appropriate scan_control->priority, set by set_initial_priority() from lru_gen_shrink_node(), to decide whether a memcg is too small to reclaim from. Now lru_gen_age_node() unconditionally traverses the root_mem_cgroup tree. So it should call set_initial_priority() upfront, to make sure lruvec_is_sizable() uses appropriate scan_control->priority on the first pass. Otherwise, lruvec_is_reclaimable() can return false negatives and result in premature OOM kills when min_ttl_ms is used. Link: https://lkml.kernel.org/r/20240712232956.1427127-1-yuzhao@google.com Fixes: e4dde56cd208 ("mm: multi-gen LRU: per-node lru_gen_folio lists") Signed-off-by: Yu Zhao <yuzhao(a)google.com> Reported-by: T.J. Mercier <tjmercier(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/vmscan.c | 82 +++++++++++++++++++++++--------------------------- 1 file changed, 38 insertions(+), 44 deletions(-) --- a/mm/vmscan.c~mm-mglru-fix-ineffective-protection-calculation +++ a/mm/vmscan.c @@ -3915,6 +3915,32 @@ done: * working set protection ******************************************************************************/ +static void set_initial_priority(struct pglist_data *pgdat, struct scan_control *sc) +{ + int priority; + unsigned long reclaimable; + + if (sc->priority != DEF_PRIORITY || sc->nr_to_reclaim < MIN_LRU_BATCH) + return; + /* + * Determine the initial priority based on + * (total >> priority) * reclaimed_to_scanned_ratio = nr_to_reclaim, + * where reclaimed_to_scanned_ratio = inactive / total. + */ + reclaimable = node_page_state(pgdat, NR_INACTIVE_FILE); + if (can_reclaim_anon_pages(NULL, pgdat->node_id, sc)) + reclaimable += node_page_state(pgdat, NR_INACTIVE_ANON); + + /* round down reclaimable and round up sc->nr_to_reclaim */ + priority = fls_long(reclaimable) - 1 - fls_long(sc->nr_to_reclaim - 1); + + /* + * The estimation is based on LRU pages only, so cap it to prevent + * overshoots of shrinker objects by large margins. + */ + sc->priority = clamp(priority, DEF_PRIORITY / 2, DEF_PRIORITY); +} + static bool lruvec_is_sizable(struct lruvec *lruvec, struct scan_control *sc) { int gen, type, zone; @@ -3948,19 +3974,17 @@ static bool lruvec_is_reclaimable(struct struct mem_cgroup *memcg = lruvec_memcg(lruvec); DEFINE_MIN_SEQ(lruvec); - /* see the comment on lru_gen_folio */ - gen = lru_gen_from_seq(min_seq[LRU_GEN_FILE]); - birth = READ_ONCE(lruvec->lrugen.timestamps[gen]); - - if (time_is_after_jiffies(birth + min_ttl)) + if (mem_cgroup_below_min(NULL, memcg)) return false; if (!lruvec_is_sizable(lruvec, sc)) return false; - mem_cgroup_calculate_protection(NULL, memcg); + /* see the comment on lru_gen_folio */ + gen = lru_gen_from_seq(min_seq[LRU_GEN_FILE]); + birth = READ_ONCE(lruvec->lrugen.timestamps[gen]); - return !mem_cgroup_below_min(NULL, memcg); + return time_is_before_jiffies(birth + min_ttl); } /* to protect the working set of the last N jiffies */ @@ -3970,23 +3994,20 @@ static void lru_gen_age_node(struct pgli { struct mem_cgroup *memcg; unsigned long min_ttl = READ_ONCE(lru_gen_min_ttl); + bool reclaimable = !min_ttl; VM_WARN_ON_ONCE(!current_is_kswapd()); - /* check the order to exclude compaction-induced reclaim */ - if (!min_ttl || sc->order || sc->priority == DEF_PRIORITY) - return; + set_initial_priority(pgdat, sc); memcg = mem_cgroup_iter(NULL, NULL, NULL); do { struct lruvec *lruvec = mem_cgroup_lruvec(memcg, pgdat); - if (lruvec_is_reclaimable(lruvec, sc, min_ttl)) { - mem_cgroup_iter_break(NULL, memcg); - return; - } + mem_cgroup_calculate_protection(NULL, memcg); - cond_resched(); + if (!reclaimable) + reclaimable = lruvec_is_reclaimable(lruvec, sc, min_ttl); } while ((memcg = mem_cgroup_iter(NULL, memcg, NULL))); /* @@ -3994,7 +4015,7 @@ static void lru_gen_age_node(struct pgli * younger than min_ttl. However, another possibility is all memcgs are * either too small or below min. */ - if (mutex_trylock(&oom_lock)) { + if (!reclaimable && mutex_trylock(&oom_lock)) { struct oom_control oc = { .gfp_mask = sc->gfp_mask, }; @@ -4786,8 +4807,7 @@ static int shrink_one(struct lruvec *lru struct mem_cgroup *memcg = lruvec_memcg(lruvec); struct pglist_data *pgdat = lruvec_pgdat(lruvec); - mem_cgroup_calculate_protection(NULL, memcg); - + /* lru_gen_age_node() called mem_cgroup_calculate_protection() */ if (mem_cgroup_below_min(NULL, memcg)) return MEMCG_LRU_YOUNG; @@ -4911,32 +4931,6 @@ static void lru_gen_shrink_lruvec(struct blk_finish_plug(&plug); } -static void set_initial_priority(struct pglist_data *pgdat, struct scan_control *sc) -{ - int priority; - unsigned long reclaimable; - - if (sc->priority != DEF_PRIORITY || sc->nr_to_reclaim < MIN_LRU_BATCH) - return; - /* - * Determine the initial priority based on - * (total >> priority) * reclaimed_to_scanned_ratio = nr_to_reclaim, - * where reclaimed_to_scanned_ratio = inactive / total. - */ - reclaimable = node_page_state(pgdat, NR_INACTIVE_FILE); - if (can_reclaim_anon_pages(NULL, pgdat->node_id, sc)) - reclaimable += node_page_state(pgdat, NR_INACTIVE_ANON); - - /* round down reclaimable and round up sc->nr_to_reclaim */ - priority = fls_long(reclaimable) - 1 - fls_long(sc->nr_to_reclaim - 1); - - /* - * The estimation is based on LRU pages only, so cap it to prevent - * overshoots of shrinker objects by large margins. - */ - sc->priority = clamp(priority, DEF_PRIORITY / 2, DEF_PRIORITY); -} - static void lru_gen_shrink_node(struct pglist_data *pgdat, struct scan_control *sc) { struct blk_plug plug; _ Patches currently in -mm which might be from yuzhao(a)google.com are

1 year, 3 months

1
0
0 0

[merged mm-stable] mm-hugetlb-fix-kernel-null-pointer-dereference-when-migrating-hugetlb-folio.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/hugetlb: fix kernel NULL pointer dereference when migrating hugetlb folio has been removed from the -mm tree. Its filename was mm-hugetlb-fix-kernel-null-pointer-dereference-when-migrating-hugetlb-folio.patch This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Miaohe Lin <linmiaohe(a)huawei.com> Subject: mm/hugetlb: fix kernel NULL pointer dereference when migrating hugetlb folio Date: Tue, 9 Jul 2024 20:04:33 +0800 A kernel crash was observed when migrating hugetlb folio: BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 0 P4D 0 Oops: Oops: 0002 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 3435 Comm: bash Not tainted 6.10.0-rc6-00450-g8578ca01f21f #66 RIP: 0010:__folio_undo_large_rmappable+0x70/0xb0 RSP: 0018:ffffb165c98a7b38 EFLAGS: 00000097 RAX: fffffbbc44528090 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffffa30e000a2800 RSI: 0000000000000246 RDI: ffffa3153ffffcc0 RBP: fffffbbc44528000 R08: 0000000000002371 R09: ffffffffbe4e5868 R10: 0000000000000001 R11: 0000000000000001 R12: ffffa3153ffffcc0 R13: fffffbbc44468000 R14: 0000000000000001 R15: 0000000000000001 FS: 00007f5b3a716740(0000) GS:ffffa3151fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000010959a000 CR4: 00000000000006f0 Call Trace: <TASK> __folio_migrate_mapping+0x59e/0x950 __migrate_folio.constprop.0+0x5f/0x120 move_to_new_folio+0xfd/0x250 migrate_pages+0x383/0xd70 soft_offline_page+0x2ab/0x7f0 soft_offline_page_store+0x52/0x90 kernfs_fop_write_iter+0x12c/0x1d0 vfs_write+0x380/0x540 ksys_write+0x64/0xe0 do_syscall_64+0xb9/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5b3a514887 RSP: 002b:00007ffe138fce68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007f5b3a514887 RDX: 000000000000000c RSI: 0000556ab809ee10 RDI: 0000000000000001 RBP: 0000556ab809ee10 R08: 00007f5b3a5d1460 R09: 000000007fffffff R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000c R13: 00007f5b3a61b780 R14: 00007f5b3a617600 R15: 00007f5b3a616a00 It's because hugetlb folio is passed to __folio_undo_large_rmappable() unexpectedly. large_rmappable flag is imperceptibly set to hugetlb folio since commit f6a8dd98a2ce ("hugetlb: convert alloc_buddy_hugetlb_folio to use a folio"). Then commit be9581ea8c05 ("mm: fix crashes from deferred split racing folio migration") makes folio_migrate_mapping() call folio_undo_large_rmappable() triggering the bug. Fix this issue by clearing large_rmappable flag for hugetlb folios. They don't need that flag set anyway. Link: https://lkml.kernel.org/r/20240709120433.4136700-1-linmiaohe@huawei.com Fixes: f6a8dd98a2ce ("hugetlb: convert alloc_buddy_hugetlb_folio to use a folio") Fixes: be9581ea8c05 ("mm: fix crashes from deferred split racing folio migration") Signed-off-by: Miaohe Lin <linmiaohe(a)huawei.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/hugetlb.c | 3 +++ 1 file changed, 3 insertions(+) --- a/mm/hugetlb.c~mm-hugetlb-fix-kernel-null-pointer-dereference-when-migrating-hugetlb-folio +++ a/mm/hugetlb.c @@ -2166,6 +2166,9 @@ static struct folio *alloc_buddy_hugetlb nid = numa_mem_id(); retry: folio = __folio_alloc(gfp_mask, order, nid, nmask); + /* Ensure hugetlb folio won't have large_rmappable flag set. */ + if (folio) + folio_clear_large_rmappable(folio); if (folio && !folio_ref_freeze(folio, 1)) { folio_put(folio); _ Patches currently in -mm which might be from linmiaohe(a)huawei.com are mm-memory-failure-fix-vm_bug_on_pagepagepoisonedpage-when-unpoison-memory.patch

1 year, 3 months

1
0
0 0

[merged mm-stable] mm-hugetlb-fix-possible-recursive-locking-detected-warning.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/hugetlb: fix possible recursive locking detected warning has been removed from the -mm tree. Its filename was mm-hugetlb-fix-possible-recursive-locking-detected-warning.patch This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Miaohe Lin <linmiaohe(a)huawei.com> Subject: mm/hugetlb: fix possible recursive locking detected warning Date: Fri, 12 Jul 2024 11:13:14 +0800 When tries to demote 1G hugetlb folios, a lockdep warning is observed: ============================================ WARNING: possible recursive locking detected 6.10.0-rc6-00452-ga4d0275fa660-dirty #79 Not tainted -------------------------------------------- bash/710 is trying to acquire lock: ffffffff8f0a7850 (&h->resize_lock){+.+.}-{3:3}, at: demote_store+0x244/0x460 but task is already holding lock: ffffffff8f0a6f48 (&h->resize_lock){+.+.}-{3:3}, at: demote_store+0xae/0x460 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&h->resize_lock); lock(&h->resize_lock); *** DEADLOCK *** May be due to missing lock nesting notation 4 locks held by bash/710: #0: ffff8f118439c3f0 (sb_writers#5){.+.+}-{0:0}, at: ksys_write+0x64/0xe0 #1: ffff8f11893b9e88 (&of->mutex#2){+.+.}-{3:3}, at: kernfs_fop_write_iter+0xf8/0x1d0 #2: ffff8f1183dc4428 (kn->active#98){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x100/0x1d0 #3: ffffffff8f0a6f48 (&h->resize_lock){+.+.}-{3:3}, at: demote_store+0xae/0x460 stack backtrace: CPU: 3 PID: 710 Comm: bash Not tainted 6.10.0-rc6-00452-ga4d0275fa660-dirty #79 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x68/0xa0 __lock_acquire+0x10f2/0x1ca0 lock_acquire+0xbe/0x2d0 __mutex_lock+0x6d/0x400 demote_store+0x244/0x460 kernfs_fop_write_iter+0x12c/0x1d0 vfs_write+0x380/0x540 ksys_write+0x64/0xe0 do_syscall_64+0xb9/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa61db14887 RSP: 002b:00007ffc56c48358 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fa61db14887 RDX: 0000000000000002 RSI: 000055a030050220 RDI: 0000000000000001 RBP: 000055a030050220 R08: 00007fa61dbd1460 R09: 000000007fffffff R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 00007fa61dc1b780 R14: 00007fa61dc17600 R15: 00007fa61dc16a00 </TASK> Lockdep considers this an AA deadlock because the different resize_lock mutexes reside in the same lockdep class, but this is a false positive. Place them in distinct classes to avoid these warnings. Link: https://lkml.kernel.org/r/20240712031314.2570452-1-linmiaohe@huawei.com Fixes: 8531fc6f52f5 ("hugetlb: add hugetlb demote page support") Signed-off-by: Miaohe Lin <linmiaohe(a)huawei.com> Acked-by: Muchun Song <muchun.song(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/hugetlb.h | 1 + mm/hugetlb.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) --- a/include/linux/hugetlb.h~mm-hugetlb-fix-possible-recursive-locking-detected-warning +++ a/include/linux/hugetlb.h @@ -663,6 +663,7 @@ HPAGEFLAG(RawHwpUnreliable, raw_hwp_unre /* Defines one hugetlb page size */ struct hstate { struct mutex resize_lock; + struct lock_class_key resize_key; int next_nid_to_alloc; int next_nid_to_free; unsigned int order; --- a/mm/hugetlb.c~mm-hugetlb-fix-possible-recursive-locking-detected-warning +++ a/mm/hugetlb.c @@ -4642,7 +4642,7 @@ void __init hugetlb_add_hstate(unsigned BUG_ON(hugetlb_max_hstate >= HUGE_MAX_HSTATE); BUG_ON(order < order_base_2(__NR_USED_SUBPAGE)); h = &hstates[hugetlb_max_hstate++]; - mutex_init(&h->resize_lock); + __mutex_init(&h->resize_lock, "resize mutex", &h->resize_key); h->order = order; h->mask = ~(huge_page_size(h) - 1); for (i = 0; i < MAX_NUMNODES; ++i) _ Patches currently in -mm which might be from linmiaohe(a)huawei.com are mm-memory-failure-fix-vm_bug_on_pagepagepoisonedpage-when-unpoison-memory.patch

1 year, 3 months

1
0
0 0

[merged mm-stable] mm-numa_balancing-teach-mpol_to_str-about-the-balancing-mode.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/numa_balancing: teach mpol_to_str about the balancing mode has been removed from the -mm tree. Its filename was mm-numa_balancing-teach-mpol_to_str-about-the-balancing-mode.patch This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> Subject: mm/numa_balancing: teach mpol_to_str about the balancing mode Date: Mon, 8 Jul 2024 08:56:32 +0100 Since balancing mode was added in bda420b98505 ("numa balancing: migrate on fault among multiple bound nodes"), it was possible to set this mode but it wouldn't be shown in /proc/<pid>/numa_maps since there was no support for it in the mpol_to_str() helper. Furthermore, because the balancing mode sets the MPOL_F_MORON flag, it would be displayed as 'default' due a workaround introduced a few years earlier in 8790c71a18e5 ("mm/mempolicy.c: fix mempolicy printing in numa_maps"). To tidy this up we implement two changes: Replace the MPOL_F_MORON check by pointer comparison against the preferred_node_policy array. By doing this we generalise the current special casing and replace the incorrect 'default' with the correct 'bind' for the mode. Secondly, we add a string representation and corresponding handling for the MPOL_F_NUMA_BALANCING flag. With the two changes together we start showing the balancing flag when it is set and therefore complete the fix. Representation format chosen is to separate multiple flags with vertical bars, following what existed long time ago in kernel 2.6.25. But as between then and now there wasn't a way to display multiple flags, this patch does not change the format in practice. Some /proc/<pid>/numa_maps output examples: 555559580000 bind=balancing:0-1,3 file=... 555585800000 bind=balancing|static:0,2 file=... 555635240000 prefer=relative:0 file= Link: https://lkml.kernel.org/r/20240708075632.95857-1-tursulin@igalia.com Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> Fixes: bda420b98505 ("numa balancing: migrate on fault among multiple bound nodes") References: 8790c71a18e5 ("mm/mempolicy.c: fix mempolicy printing in numa_maps") Reviewed-by: "Huang, Ying" <ying.huang(a)intel.com> Cc: Mel Gorman <mgorman(a)suse.de> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Rik van Riel <riel(a)surriel.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> Cc: Dave Hansen <dave.hansen(a)intel.com> Cc: Andi Kleen <ak(a)linux.intel.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: David Rientjes <rientjes(a)google.com> Cc: <stable(a)vger.kernel.org> [5.12+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/mempolicy.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) --- a/mm/mempolicy.c~mm-numa_balancing-teach-mpol_to_str-about-the-balancing-mode +++ a/mm/mempolicy.c @@ -3297,8 +3297,9 @@ out: * @pol: pointer to mempolicy to be formatted * * Convert @pol into a string. If @buffer is too short, truncate the string. - * Recommend a @maxlen of at least 32 for the longest mode, "interleave", the - * longest flag, "relative", and to display at least a few node ids. + * Recommend a @maxlen of at least 51 for the longest mode, "weighted + * interleave", plus the longest flag flags, "relative|balancing", and to + * display at least a few node ids. */ void mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol) { @@ -3307,7 +3308,10 @@ void mpol_to_str(char *buffer, int maxle unsigned short mode = MPOL_DEFAULT; unsigned short flags = 0; - if (pol && pol != &default_policy && !(pol->flags & MPOL_F_MORON)) { + if (pol && + pol != &default_policy && + !(pol >= &preferred_node_policy[0] && + pol <= &preferred_node_policy[ARRAY_SIZE(preferred_node_policy) - 1])) { mode = pol->mode; flags = pol->flags; } @@ -3335,12 +3339,18 @@ void mpol_to_str(char *buffer, int maxle p += snprintf(p, buffer + maxlen - p, "="); /* - * Currently, the only defined flags are mutually exclusive + * Static and relative are mutually exclusive. */ if (flags & MPOL_F_STATIC_NODES) p += snprintf(p, buffer + maxlen - p, "static"); else if (flags & MPOL_F_RELATIVE_NODES) p += snprintf(p, buffer + maxlen - p, "relative"); + + if (flags & MPOL_F_NUMA_BALANCING) { + if (!is_power_of_2(flags & MPOL_MODE_FLAGS)) + p += snprintf(p, buffer + maxlen - p, "|"); + p += snprintf(p, buffer + maxlen - p, "balancing"); + } } if (!nodes_empty(nodes)) _ Patches currently in -mm which might be from tvrtko.ursulin(a)igalia.com are

1 year, 3 months

1
0
0 0

+ alloc_tag-outline-and-export-free_reserved_page.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: alloc_tag: outline and export free_reserved_page() has been added to the -mm mm-hotfixes-unstable branch. Its filename is alloc_tag-outline-and-export-free_reserved_page.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Suren Baghdasaryan <surenb(a)google.com> Subject: alloc_tag: outline and export free_reserved_page() Date: Wed, 17 Jul 2024 14:28:44 -0700 Outline and export free_reserved_page() because modules use it and it in turn uses page_ext_{get|put} which should not be exported. The same result could be obtained by outlining {get|put}_page_tag_ref() but that would have higher performance impact as these functions are used in more performance critical paths. Link: https://lkml.kernel.org/r/20240717212844.2749975-1-surenb@google.com Fixes: dcfe378c81f7 ("lib: introduce support for page allocation tagging") Signed-off-by: Suren Baghdasaryan <surenb(a)google.com> Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202407080044.DWMC9N9I-lkp@intel.com/ Suggested-by: Christoph Hellwig <hch(a)infradead.org> Suggested-by: Vlastimil Babka <vbabka(a)suse.cz> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Cc: Kees Cook <keescook(a)chromium.org> Cc: Kent Overstreet <kent.overstreet(a)linux.dev> Cc: Pasha Tatashin <pasha.tatashin(a)soleen.com> Cc: Sourav Panda <souravpanda(a)google.com> Cc: <stable(a)vger.kernel.org> [6.10] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/mm.h | 16 +--------------- mm/page_alloc.c | 17 +++++++++++++++++ 2 files changed, 18 insertions(+), 15 deletions(-) --- a/include/linux/mm.h~alloc_tag-outline-and-export-free_reserved_page +++ a/include/linux/mm.h @@ -3177,21 +3177,7 @@ extern void reserve_bootmem_region(phys_ phys_addr_t end, int nid); /* Free the reserved page into the buddy system, so it gets managed. */ -static inline void free_reserved_page(struct page *page) -{ - if (mem_alloc_profiling_enabled()) { - union codetag_ref *ref = get_page_tag_ref(page); - - if (ref) { - set_codetag_empty(ref); - put_page_tag_ref(ref); - } - } - ClearPageReserved(page); - init_page_count(page); - __free_page(page); - adjust_managed_page_count(page, 1); -} +void free_reserved_page(struct page *page); #define free_highmem_page(page) free_reserved_page(page) static inline void mark_page_reserved(struct page *page) --- a/mm/page_alloc.c~alloc_tag-outline-and-export-free_reserved_page +++ a/mm/page_alloc.c @@ -5805,6 +5805,23 @@ unsigned long free_reserved_area(void *s return pages; } +void free_reserved_page(struct page *page) +{ + if (mem_alloc_profiling_enabled()) { + union codetag_ref *ref = get_page_tag_ref(page); + + if (ref) { + set_codetag_empty(ref); + put_page_tag_ref(ref); + } + } + ClearPageReserved(page); + init_page_count(page); + __free_page(page); + adjust_managed_page_count(page, 1); +} +EXPORT_SYMBOL(free_reserved_page); + static int page_alloc_cpu_dead(unsigned int cpu) { struct zone *zone; _ Patches currently in -mm which might be from surenb(a)google.com are alloc_tag-outline-and-export-free_reserved_page.patch

1 year, 3 months

1
0
0 0

[PATCH v3 0/4] Refine i.MX8QM SATA based on generic PHY callbacks

by Richard Zhu

V3 main changes: - Use GENMASK() macro to define the _MASK. - Refine the macro names. V2 main changes: - Add Rob's reviewed-by in the binding patch. - Re-name the error out lables and new RXWM macro more descriptive. - In #3 patch, add one fix tag, and CC stable kernel. Based on i.MX8QM HSIO PHY driver, refine i.MX8QM SATA driver by using PHY interface. [PATCH v3 1/4] dt-bindings: ata: Add i.MX8QM AHCI compatible string [PATCH v3 2/4] ata: ahci_imx: Clean up code by using i.MX8Q HSIO PHY [PATCH v3 3/4] ata: ahci_imx: Enlarge RX water mark for i.MX8QM SATA [PATCH v3 4/4] ata: ahci_imx: Correct the email address Documentation/devicetree/bindings/ata/imx-sata.yaml | 47 +++++++++++ drivers/ata/ahci_imx.c | 406 ++++++++++++++++++++++++----------------------------------------------------------------- 2 files changed, 155 insertions(+), 298 deletions(-)

1 year, 3 months

4
9
0 0

+ alloc_tag-outline-and-export-free_reserved_page.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: alloc_tag: outline and export free_reserved_page() has been added to the -mm mm-hotfixes-unstable branch. Its filename is alloc_tag-outline-and-export-free_reserved_page.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Suren Baghdasaryan <surenb(a)google.com> Subject: alloc_tag: outline and export free_reserved_page() Date: Wed, 17 Jul 2024 14:28:44 -0700 Outline and export free_reserved_page() because modules use it and it in turn uses page_ext_{get|put} which should not be exported. The same result could be obtained by outlining {get|put}_page_tag_ref() but that would have higher performance impact as these functions are used in more performance critical paths. Link: https://lkml.kernel.org/r/20240717212844.2749975-1-surenb@google.com Fixes: dcfe378c81f7 ("lib: introduce support for page allocation tagging") Signed-off-by: Suren Baghdasaryan <surenb(a)google.com> Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202407080044.DWMC9N9I-lkp@intel.com/ Suggested-by: Christoph Hellwig <hch(a)infradead.org> Suggested-by: Vlastimil Babka <vbabka(a)suse.cz> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Cc: <stable(a)vger.kernel.org> [6.10] Cc: Kees Cook <keescook(a)chromium.org> Cc: Kent Overstreet <kent.overstreet(a)linux.dev> Cc: Pasha Tatashin <pasha.tatashin(a)soleen.com> Cc: Sourav Panda <souravpanda(a)google.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/mm.h | 16 +--------------- mm/page_alloc.c | 17 +++++++++++++++++ 2 files changed, 18 insertions(+), 15 deletions(-) --- a/include/linux/mm.h~alloc_tag-outline-and-export-free_reserved_page +++ a/include/linux/mm.h @@ -3177,21 +3177,7 @@ extern void reserve_bootmem_region(phys_ phys_addr_t end, int nid); /* Free the reserved page into the buddy system, so it gets managed. */ -static inline void free_reserved_page(struct page *page) -{ - if (mem_alloc_profiling_enabled()) { - union codetag_ref *ref = get_page_tag_ref(page); - - if (ref) { - set_codetag_empty(ref); - put_page_tag_ref(ref); - } - } - ClearPageReserved(page); - init_page_count(page); - __free_page(page); - adjust_managed_page_count(page, 1); -} +void free_reserved_page(struct page *page); #define free_highmem_page(page) free_reserved_page(page) static inline void mark_page_reserved(struct page *page) --- a/mm/page_alloc.c~alloc_tag-outline-and-export-free_reserved_page +++ a/mm/page_alloc.c @@ -5805,6 +5805,23 @@ unsigned long free_reserved_area(void *s return pages; } +void free_reserved_page(struct page *page) +{ + if (mem_alloc_profiling_enabled()) { + union codetag_ref *ref = get_page_tag_ref(page); + + if (ref) { + set_codetag_empty(ref); + put_page_tag_ref(ref); + } + } + ClearPageReserved(page); + init_page_count(page); + __free_page(page); + adjust_managed_page_count(page, 1); +} +EXPORT_SYMBOL(free_reserved_page); + static int page_alloc_cpu_dead(unsigned int cpu) { struct zone *zone; _ Patches currently in -mm which might be from surenb(a)google.com are alloc_tag-outline-and-export-free_reserved_page.patch

1 year, 3 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror July 2024