- Linux-stable-mirror - lists.linaro.org

Patch "bonding: process the err returned by dev_set_allmulti properly in bond_enslave" has been added to the 4.9-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled bonding: process the err returned by dev_set_allmulti properly in bond_enslave to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: bonding-process-the-err-returned-by-dev_set_allmulti-properly-in-bond_enslave.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From foo@baz Wed Apr 11 10:26:56 CEST 2018 From: Xin Long <lucien.xin(a)gmail.com> Date: Mon, 26 Mar 2018 01:16:47 +0800 Subject: bonding: process the err returned by dev_set_allmulti properly in bond_enslave From: Xin Long <lucien.xin(a)gmail.com> [ Upstream commit 9f5a90c107741b864398f4ac0014711a8c1d8474 ] When dev_set_promiscuity(1) succeeds but dev_set_allmulti(1) fails, dev_set_promiscuity(-1) should be done before going to the err path. Otherwise, dev->promiscuity will leak. Fixes: 7e1a1ac1fbaa ("bonding: Check return of dev_set_promiscuity/allmulti") Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Acked-by: Andy Gospodarek <andy(a)greyhouse.net> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/net/bonding/bond_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -1700,8 +1700,11 @@ int bond_enslave(struct net_device *bond /* set allmulti level to new slave */ if (bond_dev->flags & IFF_ALLMULTI) { res = dev_set_allmulti(slave_dev, 1); - if (res) + if (res) { + if (bond_dev->flags & IFF_PROMISC) + dev_set_promiscuity(slave_dev, -1); goto err_sysfs_del; + } } netif_addr_lock_bh(bond_dev); Patches currently in stable-queue which might be from lucien.xin(a)gmail.com are queue-4.9/team-move-dev_mc_sync-after-master_upper_dev_link-in-team_port_add.patch queue-4.9/bonding-process-the-err-returned-by-dev_set_allmulti-properly-in-bond_enslave.patch queue-4.9/bonding-fix-the-err-path-for-dev-hwaddr-sync-in-bond_enslave.patch queue-4.9/bonding-move-dev_mc_sync-after-master_upper_dev_link-in-bond_enslave.patch queue-4.9/route-check-sysctl_fib_multipath_use_neigh-earlier-than-hash.patch queue-4.9/sctp-fix-recursive-locking-warning-in-sctp_do_peeloff.patch

7 years, 7 months

1
0
0 0

Patch "bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave" has been added to the 4.9-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: bonding-move-dev_mc_sync-after-master_upper_dev_link-in-bond_enslave.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From foo@baz Wed Apr 11 10:26:56 CEST 2018 From: Xin Long <lucien.xin(a)gmail.com> Date: Mon, 26 Mar 2018 01:16:46 +0800 Subject: bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave From: Xin Long <lucien.xin(a)gmail.com> [ Upstream commit ae42cc62a9f07f1f6979054ed92606b9c30f4a2e ] Beniamino found a crash when adding vlan as slave of bond which is also the parent link: ip link add bond1 type bond ip link set bond1 up ip link add link bond1 vlan1 type vlan id 80 ip link set vlan1 master bond1 The call trace is as below: [<ffffffffa850842a>] queued_spin_lock_slowpath+0xb/0xf [<ffffffffa8515680>] _raw_spin_lock+0x20/0x30 [<ffffffffa83f6f07>] dev_mc_sync+0x37/0x80 [<ffffffffc08687dc>] vlan_dev_set_rx_mode+0x1c/0x30 [8021q] [<ffffffffa83efd2a>] __dev_set_rx_mode+0x5a/0xa0 [<ffffffffa83f7138>] dev_mc_sync_multiple+0x78/0x80 [<ffffffffc084127c>] bond_enslave+0x67c/0x1190 [bonding] [<ffffffffa8401909>] do_setlink+0x9c9/0xe50 [<ffffffffa8403bf2>] rtnl_newlink+0x522/0x880 [<ffffffffa8403ff7>] rtnetlink_rcv_msg+0xa7/0x260 [<ffffffffa8424ecb>] netlink_rcv_skb+0xab/0xc0 [<ffffffffa83fe498>] rtnetlink_rcv+0x28/0x30 [<ffffffffa8424850>] netlink_unicast+0x170/0x210 [<ffffffffa8424bf8>] netlink_sendmsg+0x308/0x420 [<ffffffffa83cc396>] sock_sendmsg+0xb6/0xf0 This is actually a dead lock caused by sync slave hwaddr from master when the master is the slave's 'slave'. This dead loop check is actually done by netdev_master_upper_dev_link. However, Commit 1f718f0f4f97 ("bonding: populate neighbour's private on enslave") moved it after dev_mc_sync. This patch is to fix it by moving dev_mc_sync after master_upper_dev_link, so that this loop check would be earlier than dev_mc_sync. It also moves if (mode == BOND_MODE_8023AD) into if (!bond_uses_primary) clause as an improvement. Note team driver also has this issue, I will fix it in another patch. Fixes: 1f718f0f4f97 ("bonding: populate neighbour's private on enslave") Reported-by: Beniamino Galvani <bgalvani(a)redhat.com> Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Acked-by: Andy Gospodarek <andy(a)greyhouse.net> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/net/bonding/bond_main.c | 73 +++++++++++++++++++--------------------- 1 file changed, 35 insertions(+), 38 deletions(-) --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -1524,44 +1524,11 @@ int bond_enslave(struct net_device *bond goto err_close; } - /* If the mode uses primary, then the following is handled by - * bond_change_active_slave(). - */ - if (!bond_uses_primary(bond)) { - /* set promiscuity level to new slave */ - if (bond_dev->flags & IFF_PROMISC) { - res = dev_set_promiscuity(slave_dev, 1); - if (res) - goto err_close; - } - - /* set allmulti level to new slave */ - if (bond_dev->flags & IFF_ALLMULTI) { - res = dev_set_allmulti(slave_dev, 1); - if (res) - goto err_close; - } - - netif_addr_lock_bh(bond_dev); - - dev_mc_sync_multiple(slave_dev, bond_dev); - dev_uc_sync_multiple(slave_dev, bond_dev); - - netif_addr_unlock_bh(bond_dev); - } - - if (BOND_MODE(bond) == BOND_MODE_8023AD) { - /* add lacpdu mc addr to mc list */ - u8 lacpdu_multicast[ETH_ALEN] = MULTICAST_LACPDU_ADDR; - - dev_mc_add(slave_dev, lacpdu_multicast); - } - res = vlan_vids_add_by_dev(slave_dev, bond_dev); if (res) { netdev_err(bond_dev, "Couldn't add bond vlan ids to %s\n", slave_dev->name); - goto err_hwaddr_unsync; + goto err_close; } prev_slave = bond_last_slave(bond); @@ -1719,6 +1686,37 @@ int bond_enslave(struct net_device *bond goto err_upper_unlink; } + /* If the mode uses primary, then the following is handled by + * bond_change_active_slave(). + */ + if (!bond_uses_primary(bond)) { + /* set promiscuity level to new slave */ + if (bond_dev->flags & IFF_PROMISC) { + res = dev_set_promiscuity(slave_dev, 1); + if (res) + goto err_sysfs_del; + } + + /* set allmulti level to new slave */ + if (bond_dev->flags & IFF_ALLMULTI) { + res = dev_set_allmulti(slave_dev, 1); + if (res) + goto err_sysfs_del; + } + + netif_addr_lock_bh(bond_dev); + dev_mc_sync_multiple(slave_dev, bond_dev); + dev_uc_sync_multiple(slave_dev, bond_dev); + netif_addr_unlock_bh(bond_dev); + + if (BOND_MODE(bond) == BOND_MODE_8023AD) { + /* add lacpdu mc addr to mc list */ + u8 lacpdu_multicast[ETH_ALEN] = MULTICAST_LACPDU_ADDR; + + dev_mc_add(slave_dev, lacpdu_multicast); + } + } + bond->slave_cnt++; bond_compute_features(bond); bond_set_carrier(bond); @@ -1742,6 +1740,9 @@ int bond_enslave(struct net_device *bond return 0; /* Undo stages on error */ +err_sysfs_del: + bond_sysfs_slave_del(new_slave); + err_upper_unlink: bond_upper_dev_unlink(bond, new_slave); @@ -1762,10 +1763,6 @@ err_detach: synchronize_rcu(); slave_disable_netpoll(new_slave); -err_hwaddr_unsync: - if (!bond_uses_primary(bond)) - bond_hw_addr_flush(bond_dev, slave_dev); - err_close: slave_dev->priv_flags &= ~IFF_BONDING; dev_close(slave_dev); Patches currently in stable-queue which might be from lucien.xin(a)gmail.com are queue-4.9/team-move-dev_mc_sync-after-master_upper_dev_link-in-team_port_add.patch queue-4.9/bonding-process-the-err-returned-by-dev_set_allmulti-properly-in-bond_enslave.patch queue-4.9/bonding-fix-the-err-path-for-dev-hwaddr-sync-in-bond_enslave.patch queue-4.9/bonding-move-dev_mc_sync-after-master_upper_dev_link-in-bond_enslave.patch queue-4.9/route-check-sysctl_fib_multipath_use_neigh-earlier-than-hash.patch queue-4.9/sctp-fix-recursive-locking-warning-in-sctp_do_peeloff.patch

7 years, 7 months

1
0
0 0

Patch "bonding: fix the err path for dev hwaddr sync in bond_enslave" has been added to the 4.9-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled bonding: fix the err path for dev hwaddr sync in bond_enslave to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: bonding-fix-the-err-path-for-dev-hwaddr-sync-in-bond_enslave.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From foo@baz Wed Apr 11 10:26:56 CEST 2018 From: Xin Long <lucien.xin(a)gmail.com> Date: Mon, 26 Mar 2018 01:16:45 +0800 Subject: bonding: fix the err path for dev hwaddr sync in bond_enslave From: Xin Long <lucien.xin(a)gmail.com> [ Upstream commit 5c78f6bfae2b10ff70e21d343e64584ea6280c26 ] vlan_vids_add_by_dev is called right after dev hwaddr sync, so on the err path it should unsync dev hwaddr. Otherwise, the slave dev's hwaddr will never be unsync when this err happens. Fixes: 1ff412ad7714 ("bonding: change the bond's vlan syncing functions with the standard ones") Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Reviewed-by: Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com> Acked-by: Andy Gospodarek <andy(a)greyhouse.net> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/net/bonding/bond_main.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -1561,7 +1561,7 @@ int bond_enslave(struct net_device *bond if (res) { netdev_err(bond_dev, "Couldn't add bond vlan ids to %s\n", slave_dev->name); - goto err_close; + goto err_hwaddr_unsync; } prev_slave = bond_last_slave(bond); @@ -1749,9 +1749,6 @@ err_unregister: netdev_rx_handler_unregister(slave_dev); err_detach: - if (!bond_uses_primary(bond)) - bond_hw_addr_flush(bond_dev, slave_dev); - vlan_vids_del_by_dev(slave_dev, bond_dev); if (rcu_access_pointer(bond->primary_slave) == new_slave) RCU_INIT_POINTER(bond->primary_slave, NULL); @@ -1765,6 +1762,10 @@ err_detach: synchronize_rcu(); slave_disable_netpoll(new_slave); +err_hwaddr_unsync: + if (!bond_uses_primary(bond)) + bond_hw_addr_flush(bond_dev, slave_dev); + err_close: slave_dev->priv_flags &= ~IFF_BONDING; dev_close(slave_dev); Patches currently in stable-queue which might be from lucien.xin(a)gmail.com are queue-4.9/team-move-dev_mc_sync-after-master_upper_dev_link-in-team_port_add.patch queue-4.9/bonding-process-the-err-returned-by-dev_set_allmulti-properly-in-bond_enslave.patch queue-4.9/bonding-fix-the-err-path-for-dev-hwaddr-sync-in-bond_enslave.patch queue-4.9/bonding-move-dev_mc_sync-after-master_upper_dev_link-in-bond_enslave.patch queue-4.9/route-check-sysctl_fib_multipath_use_neigh-earlier-than-hash.patch queue-4.9/sctp-fix-recursive-locking-warning-in-sctp_do_peeloff.patch

7 years, 7 months

1
0
0 0

Patch "arp: fix arp_filter on l3slave devices" has been added to the 4.9-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled arp: fix arp_filter on l3slave devices to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: arp-fix-arp_filter-on-l3slave-devices.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From foo@baz Wed Apr 11 10:26:56 CEST 2018 From: Miguel Fadon Perlines <mfadon(a)teldat.com> Date: Thu, 5 Apr 2018 10:25:38 +0200 Subject: arp: fix arp_filter on l3slave devices From: Miguel Fadon Perlines <mfadon(a)teldat.com> [ Upstream commit 58b35f27689b5eb514fc293c332966c226b1b6e4 ] arp_filter performs an ip_route_output search for arp source address and checks if output device is the same where the arp request was received, if it is not, the arp request is not answered. This route lookup is always done on main route table so l3slave devices never find the proper route and arp is not answered. Passing l3mdev_master_ifindex_rcu(dev) return value as oif fixes the lookup for l3slave devices while maintaining same behavior for non l3slave devices as this function returns 0 in that case. Fixes: 613d09b30f8b ("net: Use VRF device index for lookups on TX") Signed-off-by: Miguel Fadon Perlines <mfadon(a)teldat.com> Acked-by: David Ahern <dsa(a)cumulusnetworks.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- net/ipv4/arp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/ipv4/arp.c +++ b/net/ipv4/arp.c @@ -437,7 +437,7 @@ static int arp_filter(__be32 sip, __be32 /*unsigned long now; */ struct net *net = dev_net(dev); - rt = ip_route_output(net, sip, tip, 0, 0); + rt = ip_route_output(net, sip, tip, 0, l3mdev_master_ifindex_rcu(dev)); if (IS_ERR(rt)) return 1; if (rt->dst.dev != dev) { Patches currently in stable-queue which might be from mfadon(a)teldat.com are queue-4.9/arp-fix-arp_filter-on-l3slave-devices.patch

7 years, 7 months

1
0
0 0

Re: [PATCH] writeback: safer lock nesting

by Greg Thelen

On Tue, Apr 10, 2018 at 7:44 PM Wang Long <wanglong19(a)meituan.com> wrote: > > Hi, > > > > [This is an automated email] > > > > This commit has been processed by the -stable helper bot and determined > > to be a high probability candidate for -stable trees. (score: 44.5575) > > > > The bot has tested the following trees: v4.16.1, v4.15.16, v4.14.33, v4.9.93, v4.4.127. > > > > v4.16.1: Build OK! > > v4.15.16: Build OK! > > v4.14.33: Build OK! > > v4.9.93: Build OK! > > v4.4.127: Failed to apply! Possible dependencies: > > 62cccb8c8e7a ("mm: simplify lock_page_memcg()") > Hi Sasha, > I test the memory cgroup in lts v4.4, for this issue, 62cccb8c8e7a ("mm: > simplify lock_page_memcg()") > need to adjust and there are several other places that need to be fixed. > I will make the patch for lts v4.4 if no one did. I'm testing a 4.4-stable patch right now. ETA is a few hours.

7 years, 7 months

1
2
0 0

[PATCH v4] writeback: safer lock nesting

by Greg Thelen

lock_page_memcg()/unlock_page_memcg() use spin_lock_irqsave/restore() if the page's memcg is undergoing move accounting, which occurs when a process leaves its memcg for a new one that has memory.move_charge_at_immigrate set. unlocked_inode_to_wb_begin,end() use spin_lock_irq/spin_unlock_irq() if the given inode is switching writeback domains. Switches occur when enough writes are issued from a new domain. This existing pattern is thus suspicious: lock_page_memcg(page); unlocked_inode_to_wb_begin(inode, &locked); ... unlocked_inode_to_wb_end(inode, locked); unlock_page_memcg(page); If both inode switch and process memcg migration are both in-flight then unlocked_inode_to_wb_end() will unconditionally enable interrupts while still holding the lock_page_memcg() irq spinlock. This suggests the possibility of deadlock if an interrupt occurs before unlock_page_memcg(). truncate __cancel_dirty_page lock_page_memcg unlocked_inode_to_wb_begin unlocked_inode_to_wb_end <interrupts mistakenly enabled> <interrupt> end_page_writeback test_clear_page_writeback lock_page_memcg <deadlock> unlock_page_memcg Due to configuration limitations this deadlock is not currently possible because we don't mix cgroup writeback (a cgroupv2 feature) and memory.move_charge_at_immigrate (a cgroupv1 feature). If the kernel is hacked to always claim inode switching and memcg moving_account, then this script triggers lockup in less than a minute: cd /mnt/cgroup/memory mkdir a b echo 1 > a/memory.move_charge_at_immigrate echo 1 > b/memory.move_charge_at_immigrate ( echo $BASHPID > a/cgroup.procs while true; do dd if=/dev/zero of=/mnt/big bs=1M count=256 done ) & while true; do sync done & sleep 1h & SLEEP=$! while true; do echo $SLEEP > a/cgroup.procs echo $SLEEP > b/cgroup.procs done The deadlock does not seem possible, so it's debatable if there's any reason to modify the kernel. I suggest we should to prevent future surprises. And Wang Long said "this deadlock occurs three times in our environment", so there's more reason to apply this, even to stable. Stable 4.4 has minor conflicts applying this patch. For a clean 4.4 patch see "[PATCH for-4.4] writeback: safer lock nesting" https://lkml.org/lkml/2018/4/11/146 Fixes: 682aa8e1a6a1 ("writeback: implement unlocked_inode_to_wb transaction and use it for stat updates") Cc: stable(a)vger.kernel.org # v4.2+ Reported-by: Wang Long <wanglong19(a)meituan.com> Signed-off-by: Greg Thelen <gthelen(a)google.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Acked-by: Wang Long <wanglong19(a)meituan.com> --- Changelog since v3: - initialize wb_lock_cookie wiht {} rather than {0}. - comment grammar fix - commit log footer cleanup (-Change-Id, +Fixes, +Acks, +stable), though patch does not cleanly apply to 4.4. I'll post a 4.4-stable specific patch. Changelog since v2: - explicitly initialize wb_lock_cookie to silence compiler warnings. Changelog since v1: - add wb_lock_cookie to record lock context. fs/fs-writeback.c | 7 ++++--- include/linux/backing-dev-defs.h | 5 +++++ include/linux/backing-dev.h | 31 +++++++++++++++++-------------- mm/page-writeback.c | 18 +++++++++--------- 4 files changed, 35 insertions(+), 26 deletions(-) diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c index 1280f915079b..b1178acfcb08 100644 --- a/fs/fs-writeback.c +++ b/fs/fs-writeback.c @@ -745,11 +745,12 @@ int inode_congested(struct inode *inode, int cong_bits) */ if (inode && inode_to_wb_is_valid(inode)) { struct bdi_writeback *wb; - bool locked, congested; + struct wb_lock_cookie lock_cookie = {}; + bool congested; - wb = unlocked_inode_to_wb_begin(inode, &locked); + wb = unlocked_inode_to_wb_begin(inode, &lock_cookie); congested = wb_congested(wb, cong_bits); - unlocked_inode_to_wb_end(inode, locked); + unlocked_inode_to_wb_end(inode, &lock_cookie); return congested; } diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h index bfe86b54f6c1..0bd432a4d7bd 100644 --- a/include/linux/backing-dev-defs.h +++ b/include/linux/backing-dev-defs.h @@ -223,6 +223,11 @@ static inline void set_bdi_congested(struct backing_dev_info *bdi, int sync) set_wb_congested(bdi->wb.congested, sync); } +struct wb_lock_cookie { + bool locked; + unsigned long flags; +}; + #ifdef CONFIG_CGROUP_WRITEBACK /** diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h index 3e4ce54d84ab..96f4a3ddfb81 100644 --- a/include/linux/backing-dev.h +++ b/include/linux/backing-dev.h @@ -346,7 +346,7 @@ static inline struct bdi_writeback *inode_to_wb(const struct inode *inode) /** * unlocked_inode_to_wb_begin - begin unlocked inode wb access transaction * @inode: target inode - * @lockedp: temp bool output param, to be passed to the end function + * @cookie: output param, to be passed to the end function * * The caller wants to access the wb associated with @inode but isn't * holding inode->i_lock, mapping->tree_lock or wb->list_lock. This @@ -354,12 +354,12 @@ static inline struct bdi_writeback *inode_to_wb(const struct inode *inode) * association doesn't change until the transaction is finished with * unlocked_inode_to_wb_end(). * - * The caller must call unlocked_inode_to_wb_end() with *@lockdep - * afterwards and can't sleep during transaction. IRQ may or may not be - * disabled on return. + * The caller must call unlocked_inode_to_wb_end() with *@cookie afterwards and + * can't sleep during the transaction. IRQs may or may not be disabled on + * return. */ static inline struct bdi_writeback * -unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp) +unlocked_inode_to_wb_begin(struct inode *inode, struct wb_lock_cookie *cookie) { rcu_read_lock(); @@ -367,10 +367,10 @@ unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp) * Paired with store_release in inode_switch_wb_work_fn() and * ensures that we see the new wb if we see cleared I_WB_SWITCH. */ - *lockedp = smp_load_acquire(&inode->i_state) & I_WB_SWITCH; + cookie->locked = smp_load_acquire(&inode->i_state) & I_WB_SWITCH; - if (unlikely(*lockedp)) - spin_lock_irq(&inode->i_mapping->tree_lock); + if (unlikely(cookie->locked)) + spin_lock_irqsave(&inode->i_mapping->tree_lock, cookie->flags); /* * Protected by either !I_WB_SWITCH + rcu_read_lock() or tree_lock. @@ -382,12 +382,14 @@ unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp) /** * unlocked_inode_to_wb_end - end inode wb access transaction * @inode: target inode - * @locked: *@lockedp from unlocked_inode_to_wb_begin() + * @cookie: @cookie from unlocked_inode_to_wb_begin() */ -static inline void unlocked_inode_to_wb_end(struct inode *inode, bool locked) +static inline void unlocked_inode_to_wb_end(struct inode *inode, + struct wb_lock_cookie *cookie) { - if (unlikely(locked)) - spin_unlock_irq(&inode->i_mapping->tree_lock); + if (unlikely(cookie->locked)) + spin_unlock_irqrestore(&inode->i_mapping->tree_lock, + cookie->flags); rcu_read_unlock(); } @@ -434,12 +436,13 @@ static inline struct bdi_writeback *inode_to_wb(struct inode *inode) } static inline struct bdi_writeback * -unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp) +unlocked_inode_to_wb_begin(struct inode *inode, struct wb_lock_cookie *cookie) { return inode_to_wb(inode); } -static inline void unlocked_inode_to_wb_end(struct inode *inode, bool locked) +static inline void unlocked_inode_to_wb_end(struct inode *inode, + struct wb_lock_cookie *cookie) { } diff --git a/mm/page-writeback.c b/mm/page-writeback.c index 586f31261c83..8369572e1f7d 100644 --- a/mm/page-writeback.c +++ b/mm/page-writeback.c @@ -2501,13 +2501,13 @@ void account_page_redirty(struct page *page) if (mapping && mapping_cap_account_dirty(mapping)) { struct inode *inode = mapping->host; struct bdi_writeback *wb; - bool locked; + struct wb_lock_cookie cookie = {}; - wb = unlocked_inode_to_wb_begin(inode, &locked); + wb = unlocked_inode_to_wb_begin(inode, &cookie); current->nr_dirtied--; dec_node_page_state(page, NR_DIRTIED); dec_wb_stat(wb, WB_DIRTIED); - unlocked_inode_to_wb_end(inode, locked); + unlocked_inode_to_wb_end(inode, &cookie); } } EXPORT_SYMBOL(account_page_redirty); @@ -2613,15 +2613,15 @@ void __cancel_dirty_page(struct page *page) if (mapping_cap_account_dirty(mapping)) { struct inode *inode = mapping->host; struct bdi_writeback *wb; - bool locked; + struct wb_lock_cookie cookie = {}; lock_page_memcg(page); - wb = unlocked_inode_to_wb_begin(inode, &locked); + wb = unlocked_inode_to_wb_begin(inode, &cookie); if (TestClearPageDirty(page)) account_page_cleaned(page, mapping, wb); - unlocked_inode_to_wb_end(inode, locked); + unlocked_inode_to_wb_end(inode, &cookie); unlock_page_memcg(page); } else { ClearPageDirty(page); @@ -2653,7 +2653,7 @@ int clear_page_dirty_for_io(struct page *page) if (mapping && mapping_cap_account_dirty(mapping)) { struct inode *inode = mapping->host; struct bdi_writeback *wb; - bool locked; + struct wb_lock_cookie cookie = {}; /* * Yes, Virginia, this is indeed insane. @@ -2690,14 +2690,14 @@ int clear_page_dirty_for_io(struct page *page) * always locked coming in here, so we get the desired * exclusion. */ - wb = unlocked_inode_to_wb_begin(inode, &locked); + wb = unlocked_inode_to_wb_begin(inode, &cookie); if (TestClearPageDirty(page)) { dec_lruvec_page_state(page, NR_FILE_DIRTY); dec_zone_page_state(page, NR_ZONE_WRITE_PENDING); dec_wb_stat(wb, WB_RECLAIMABLE); ret = 1; } - unlocked_inode_to_wb_end(inode, locked); + unlocked_inode_to_wb_end(inode, &cookie); return ret; } return TestClearPageDirty(page); -- 2.17.0.484.g0c8726318c-goog

7 years, 7 months

1
0
0 0

FAILED: patch "[PATCH] vrf: Fix use after free and double free in vrf_finish_output" failed to apply to 4.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 82dd0d2a9a76fc8fa2b18d80b987d455728bf83a Mon Sep 17 00:00:00 2001 From: David Ahern <dsahern(a)gmail.com> Date: Thu, 29 Mar 2018 12:49:52 -0700 Subject: [PATCH] vrf: Fix use after free and double free in vrf_finish_output Miguel reported an skb use after free / double free in vrf_finish_output when neigh_output returns an error. The vrf driver should return after the call to neigh_output as it takes over the skb on error path as well. Patch is a simplified version of Miguel's patch which was written for 4.9, and updated to top of tree. Fixes: 8f58336d3f78a ("net: Add ethernet header for pass through VRF device") Signed-off-by: Miguel Fadon Perlines <mfadon(a)teldat.com> Signed-off-by: David Ahern <dsahern(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c index 139c61c8244a..ac40924fe437 100644 --- a/drivers/net/vrf.c +++ b/drivers/net/vrf.c @@ -578,12 +578,13 @@ static int vrf_finish_output(struct net *net, struct sock *sk, struct sk_buff *s if (!IS_ERR(neigh)) { sock_confirm_neigh(skb, neigh); ret = neigh_output(neigh, skb); + rcu_read_unlock_bh(); + return ret; } rcu_read_unlock_bh(); err: - if (unlikely(ret < 0)) - vrf_tx_error(skb->dev, skb); + vrf_tx_error(skb->dev, skb); return ret; }

7 years, 7 months

1
0
0 0

[PATCH 0/4] usb: gadget: udc: renesas_usb3: fix some major issues

by Yoshihiro Shimoda

This patch set is based on v4.16. (I should have realized these issues in v4.16-rc cycle though...) Yoshihiro Shimoda (4): usb: gadget: udc: renesas_usb3: fix double phy_put() usb: gadget: udc: renesas_usb3: should remove debugfs usb: gadget: udc: renesas_usb3: should call pm_runtime_enable() before add udc usb: gadget: udc: renesas_usb3: should call devm_phy_get() before add udc drivers/usb/gadget/udc/renesas_usb3.c | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) -- 1.9.1

7 years, 7 months

3
16
0 0

v4.4.127 build: 3 failures 0 warnings (v4.4.127)

by Build bot for Mark Brown

Tree/Branch: v4.4.127 Git describe: v4.4.127 Commit: 2cad7a1d13 Linux 4.4.127 Build Time: 60 min 20 sec Passed: 7 / 10 ( 70.00 %) Failed: 3 / 10 ( 30.00 %) Errors: 37 Warnings: 0 Section Mismatches: 0 Failed defconfigs: arm-allmodconfig arm-multi_v7_defconfig arm-multi_v5_defconfig Errors: arm-allmodconfig ../net/core/sock.c:724:7: error: 'SO_REUSEPORT' undeclared (first use in this function) ../net/core/sock.c:922:7: error: 'SO_ATTACH_BPF' undeclared (first use in this function) ../net/core/sock.c:939:7: error: 'SO_LOCK_FILTER' undeclared (first use in this function) ../net/core/sock.c:978:7: error: 'SO_SELECT_ERR_QUEUE' undeclared (first use in this function) ../net/core/sock.c:983:7: error: 'SO_BUSY_POLL' undeclared (first use in this function) ../net/core/sock.c:996:7: error: 'SO_MAX_PACING_RATE' undeclared (first use in this function) ../net/core/sock.c:1002:7: error: 'SO_INCOMING_CPU' undeclared (first use in this function) ../net/core/sock.c:1075:7: error: 'SO_REUSEPORT' undeclared (first use in this function) ../net/core/sock.c:1233:7: error: 'SO_GET_FILTER' undeclared (first use in this function) ../net/core/sock.c:1240:7: error: 'SO_LOCK_FILTER' undeclared (first use in this function) ../net/core/sock.c:1244:7: error: 'SO_BPF_EXTENSIONS' undeclared (first use in this function) ../net/core/sock.c:1248:7: error: 'SO_SELECT_ERR_QUEUE' undeclared (first use in this function) ../net/core/sock.c:1253:7: error: 'SO_BUSY_POLL' undeclared (first use in this function) ../net/core/sock.c:1258:7: error: 'SO_MAX_PACING_RATE' undeclared (first use in this function) ../net/core/sock.c:1262:7: error: 'SO_INCOMING_CPU' undeclared (first use in this function) Error: ../arch/arm/boot/dts/uniphier-ph1-pro4-sanji.dts:0.55-1.1 syntax error Error: ../arch/arm/boot/dts/tegra30.dtsi:1.1-9 syntax error Error: ../arch/arm/boot/dts/omap4-panda.dts:10.1-9 syntax error Error: ../arch/arm/boot/dts/tegra20.dtsi:1.1-9 syntax error Error: ../arch/arm/boot/dts/emev2.dtsi:11.1-9 syntax error Error: ../arch/arm/boot/dts/tegra20.dtsi:1.1-9 syntax error Error: ../arch/arm/boot/dts/tegra20.dtsi:1.1-9 syntax error ../arch/arm/boot/dts/omap3-gta04.dts:132:57: error: unterminated comment ../arch/arm/boot/dts/ccu8540.dts:13:23: fatal error: dbx5x0.dtsi: No such file or directory Error: ../arch/arm/boot/dts/r8a7740-armadillo800eva-reference.dts:203.16-17 syntax error Error: ../arch/arm/boot/dts/uniphier-ph1-pro4-ace.dts:0.53-1.1 syntax error Error: ../arch/arm/boot/dts/arm-realview-eb-11mp-revb.dts:0.57-1.1 syntax error Error: ../arch/arm/boot/dts/tegra20.dtsi:1.1-9 syntax error Error: ../arch/arm/boot/dts/tegra30.dtsi:1.1-9 syntax error Error: ../arch/arm/boot/dts/tegra20.dtsi:1.1-9 syntax error Error: ../arch/arm/boot/dts/r8a7790.dtsi:13.1-9 syntax error Error: ../arch/arm/boot/dts/omap4.dtsi:9.1-9 syntax error Error: ../arch/arm/boot/dts/vf610-colibri.dts:91.5-6 syntax error ../net/sunrpc/xprtsock.c:1738:38: error: 'SO_REUSEPORT' undeclared (first use in this function) ../arch/arm/include/asm/parport.h:12:22: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'parport_pc_find_isa_ports' ../arch/arm/include/asm/parport.h:13:22: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'parport_pc_find_nonpci_ports' ../drivers/parport/parport_pc.c:3070:2: error: implicit declaration of function 'parport_pc_find_nonpci_ports' [-Werror=implicit-function-declaration] ERROR (phandle_references): Reference to non-existent node or label "tc3589x_gpio" ERROR (phandle_references): Reference to non-existent node or label "tc3589x_gpio" ERROR (phandle_references): Reference to non-existent node or label "tc3589x_gpio" ERROR (phandle_references): Reference to non-existent node or label "tc3589x_gpio" ERROR: Input tree has errors, aborting (use -f to force output) ERROR (phandle_references): Reference to non-existent node or label "tc3589x_gpio" ERROR: Input tree has errors, aborting (use -f to force output) ERROR (phandle_references): Reference to non-existent node or label "mainpllclk" ERROR (phandle_references): Reference to non-existent node or label "refclksys" ERROR (phandle_references): Reference to non-existent node or label "papllclk" ERROR: Input tree has errors, aborting (use -f to force output) arm-multi_v7_defconfig ../net/core/sock.c:724:7: error: 'SO_REUSEPORT' undeclared (first use in this function) ../net/core/sock.c:922:7: error: 'SO_ATTACH_BPF' undeclared (first use in this function) ../net/core/sock.c:939:7: error: 'SO_LOCK_FILTER' undeclared (first use in this function) ../net/core/sock.c:978:7: error: 'SO_SELECT_ERR_QUEUE' undeclared (first use in this function) ../net/core/sock.c:983:7: error: 'SO_BUSY_POLL' undeclared (first use in this function) ../net/core/sock.c:996:7: error: 'SO_MAX_PACING_RATE' undeclared (first use in this function) ../net/core/sock.c:1002:7: error: 'SO_INCOMING_CPU' undeclared (first use in this function) ../net/core/sock.c:1075:7: error: 'SO_REUSEPORT' undeclared (first use in this function) ../net/core/sock.c:1233:7: error: 'SO_GET_FILTER' undeclared (first use in this function) ../net/core/sock.c:1240:7: error: 'SO_LOCK_FILTER' undeclared (first use in this function) ../net/core/sock.c:1244:7: error: 'SO_BPF_EXTENSIONS' undeclared (first use in this function) ../net/core/sock.c:1248:7: error: 'SO_SELECT_ERR_QUEUE' undeclared (first use in this function) ../net/core/sock.c:1253:7: error: 'SO_BUSY_POLL' undeclared (first use in this function) ../net/core/sock.c:1258:7: error: 'SO_MAX_PACING_RATE' undeclared (first use in this function) ../net/core/sock.c:1262:7: error: 'SO_INCOMING_CPU' undeclared (first use in this function) ../net/sunrpc/xprtsock.c:1738:38: error: 'SO_REUSEPORT' undeclared (first use in this function) arm-multi_v5_defconfig ../net/core/sock.c:724:7: error: 'SO_REUSEPORT' undeclared (first use in this function) ../net/core/sock.c:922:7: error: 'SO_ATTACH_BPF' undeclared (first use in this function) ../net/core/sock.c:939:7: error: 'SO_LOCK_FILTER' undeclared (first use in this function) ../net/core/sock.c:978:7: error: 'SO_SELECT_ERR_QUEUE' undeclared (first use in this function) ../net/core/sock.c:983:7: error: 'SO_BUSY_POLL' undeclared (first use in this function) ../net/core/sock.c:996:7: error: 'SO_MAX_PACING_RATE' undeclared (first use in this function) ../net/core/sock.c:1002:7: error: 'SO_INCOMING_CPU' undeclared (first use in this function) ../net/core/sock.c:1075:7: error: 'SO_REUSEPORT' undeclared (first use in this function) ../net/core/sock.c:1233:7: error: 'SO_GET_FILTER' undeclared (first use in this function) ../net/core/sock.c:1240:7: error: 'SO_LOCK_FILTER' undeclared (first use in this function) ../net/core/sock.c:1244:7: error: 'SO_BPF_EXTENSIONS' undeclared (first use in this function) ../net/core/sock.c:1248:7: error: 'SO_SELECT_ERR_QUEUE' undeclared (first use in this function) ../net/core/sock.c:1253:7: error: 'SO_BUSY_POLL' undeclared (first use in this function) ../net/core/sock.c:1258:7: error: 'SO_MAX_PACING_RATE' undeclared (first use in this function) ../net/core/sock.c:1262:7: error: 'SO_INCOMING_CPU' undeclared (first use in this function) ../net/sunrpc/xprtsock.c:1738:38: error: 'SO_REUSEPORT' undeclared (first use in this function) ------------------------------------------------------------------------------- defconfigs with issues (other than build errors): ------------------------------------------------------------------------------- Errors summary: 37 5 Error: ../arch/arm/boot/dts/tegra20.dtsi:1.1-9 syntax error 5 ERROR (phandle_references): Reference to non-existent node or label "tc3589x_gpio" 3 ERROR: Input tree has errors, aborting (use -f to force output) 3 ../net/sunrpc/xprtsock.c:1738:38: error: 'SO_REUSEPORT' undeclared (first use in this function) 3 ../net/core/sock.c:996:7: error: 'SO_MAX_PACING_RATE' undeclared (first use in this function) 3 ../net/core/sock.c:983:7: error: 'SO_BUSY_POLL' undeclared (first use in this function) 3 ../net/core/sock.c:978:7: error: 'SO_SELECT_ERR_QUEUE' undeclared (first use in this function) 3 ../net/core/sock.c:939:7: error: 'SO_LOCK_FILTER' undeclared (first use in this function) 3 ../net/core/sock.c:922:7: error: 'SO_ATTACH_BPF' undeclared (first use in this function) 3 ../net/core/sock.c:724:7: error: 'SO_REUSEPORT' undeclared (first use in this function) 3 ../net/core/sock.c:1262:7: error: 'SO_INCOMING_CPU' undeclared (first use in this function) 3 ../net/core/sock.c:1258:7: error: 'SO_MAX_PACING_RATE' undeclared (first use in this function) 3 ../net/core/sock.c:1253:7: error: 'SO_BUSY_POLL' undeclared (first use in this function) 3 ../net/core/sock.c:1248:7: error: 'SO_SELECT_ERR_QUEUE' undeclared (first use in this function) 3 ../net/core/sock.c:1244:7: error: 'SO_BPF_EXTENSIONS' undeclared (first use in this function) 3 ../net/core/sock.c:1240:7: error: 'SO_LOCK_FILTER' undeclared (first use in this function) 3 ../net/core/sock.c:1233:7: error: 'SO_GET_FILTER' undeclared (first use in this function) 3 ../net/core/sock.c:1075:7: error: 'SO_REUSEPORT' undeclared (first use in this function) 3 ../net/core/sock.c:1002:7: error: 'SO_INCOMING_CPU' undeclared (first use in this function) 2 Error: ../arch/arm/boot/dts/tegra30.dtsi:1.1-9 syntax error 1 Error: ../arch/arm/boot/dts/vf610-colibri.dts:91.5-6 syntax error 1 Error: ../arch/arm/boot/dts/uniphier-ph1-pro4-sanji.dts:0.55-1.1 syntax error 1 Error: ../arch/arm/boot/dts/uniphier-ph1-pro4-ace.dts:0.53-1.1 syntax error 1 Error: ../arch/arm/boot/dts/r8a7790.dtsi:13.1-9 syntax error 1 Error: ../arch/arm/boot/dts/r8a7740-armadillo800eva-reference.dts:203.16-17 syntax error 1 Error: ../arch/arm/boot/dts/omap4.dtsi:9.1-9 syntax error 1 Error: ../arch/arm/boot/dts/omap4-panda.dts:10.1-9 syntax error 1 Error: ../arch/arm/boot/dts/emev2.dtsi:11.1-9 syntax error 1 Error: ../arch/arm/boot/dts/arm-realview-eb-11mp-revb.dts:0.57-1.1 syntax error 1 ERROR (phandle_references): Reference to non-existent node or label "refclksys" 1 ERROR (phandle_references): Reference to non-existent node or label "papllclk" 1 ERROR (phandle_references): Reference to non-existent node or label "mainpllclk" 1 ../drivers/parport/parport_pc.c:3070:2: error: implicit declaration of function 'parport_pc_find_nonpci_ports' [-Werror=implicit-function-declaration] 1 ../arch/arm/include/asm/parport.h:13:22: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'parport_pc_find_nonpci_ports' 1 ../arch/arm/include/asm/parport.h:12:22: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'parport_pc_find_isa_ports' 1 ../arch/arm/boot/dts/omap3-gta04.dts:132:57: error: unterminated comment 1 ../arch/arm/boot/dts/ccu8540.dts:13:23: fatal error: dbx5x0.dtsi: No such file or directory =============================================================================== Detailed per-defconfig build reports below: ------------------------------------------------------------------------------- arm-allmodconfig : FAIL, 48 errors, 0 warnings, 0 section mismatches Errors: ../net/core/sock.c:724:7: error: 'SO_REUSEPORT' undeclared (first use in this function) ../net/core/sock.c:922:7: error: 'SO_ATTACH_BPF' undeclared (first use in this function) ../net/core/sock.c:939:7: error: 'SO_LOCK_FILTER' undeclared (first use in this function) ../net/core/sock.c:978:7: error: 'SO_SELECT_ERR_QUEUE' undeclared (first use in this function) ../net/core/sock.c:983:7: error: 'SO_BUSY_POLL' undeclared (first use in this function) ../net/core/sock.c:996:7: error: 'SO_MAX_PACING_RATE' undeclared (first use in this function) ../net/core/sock.c:1002:7: error: 'SO_INCOMING_CPU' undeclared (first use in this function) ../net/core/sock.c:1075:7: error: 'SO_REUSEPORT' undeclared (first use in this function) ../net/core/sock.c:1233:7: error: 'SO_GET_FILTER' undeclared (first use in this function) ../net/core/sock.c:1240:7: error: 'SO_LOCK_FILTER' undeclared (first use in this function) ../net/core/sock.c:1244:7: error: 'SO_BPF_EXTENSIONS' undeclared (first use in this function) ../net/core/sock.c:1248:7: error: 'SO_SELECT_ERR_QUEUE' undeclared (first use in this function) ../net/core/sock.c:1253:7: error: 'SO_BUSY_POLL' undeclared (first use in this function) ../net/core/sock.c:1258:7: error: 'SO_MAX_PACING_RATE' undeclared (first use in this function) ../net/core/sock.c:1262:7: error: 'SO_INCOMING_CPU' undeclared (first use in this function) Error: ../arch/arm/boot/dts/uniphier-ph1-pro4-sanji.dts:0.55-1.1 syntax error Error: ../arch/arm/boot/dts/tegra30.dtsi:1.1-9 syntax error Error: ../arch/arm/boot/dts/omap4-panda.dts:10.1-9 syntax error Error: ../arch/arm/boot/dts/tegra20.dtsi:1.1-9 syntax error Error: ../arch/arm/boot/dts/emev2.dtsi:11.1-9 syntax error Error: ../arch/arm/boot/dts/tegra20.dtsi:1.1-9 syntax error Error: ../arch/arm/boot/dts/tegra20.dtsi:1.1-9 syntax error ../arch/arm/boot/dts/omap3-gta04.dts:132:57: error: unterminated comment ../arch/arm/boot/dts/ccu8540.dts:13:23: fatal error: dbx5x0.dtsi: No such file or directory Error: ../arch/arm/boot/dts/r8a7740-armadillo800eva-reference.dts:203.16-17 syntax error Error: ../arch/arm/boot/dts/uniphier-ph1-pro4-ace.dts:0.53-1.1 syntax error Error: ../arch/arm/boot/dts/arm-realview-eb-11mp-revb.dts:0.57-1.1 syntax error Error: ../arch/arm/boot/dts/tegra20.dtsi:1.1-9 syntax error Error: ../arch/arm/boot/dts/tegra30.dtsi:1.1-9 syntax error Error: ../arch/arm/boot/dts/tegra20.dtsi:1.1-9 syntax error Error: ../arch/arm/boot/dts/r8a7790.dtsi:13.1-9 syntax error Error: ../arch/arm/boot/dts/omap4.dtsi:9.1-9 syntax error Error: ../arch/arm/boot/dts/vf610-colibri.dts:91.5-6 syntax error ../net/sunrpc/xprtsock.c:1738:38: error: 'SO_REUSEPORT' undeclared (first use in this function) ../arch/arm/include/asm/parport.h:12:22: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'parport_pc_find_isa_ports' ../arch/arm/include/asm/parport.h:13:22: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'parport_pc_find_nonpci_ports' ../drivers/parport/parport_pc.c:3070:2: error: implicit declaration of function 'parport_pc_find_nonpci_ports' [-Werror=implicit-function-declaration] ERROR (phandle_references): Reference to non-existent node or label "tc3589x_gpio" ERROR (phandle_references): Reference to non-existent node or label "tc3589x_gpio" ERROR (phandle_references): Reference to non-existent node or label "tc3589x_gpio" ERROR (phandle_references): Reference to non-existent node or label "tc3589x_gpio" ERROR: Input tree has errors, aborting (use -f to force output) ERROR (phandle_references): Reference to non-existent node or label "tc3589x_gpio" ERROR: Input tree has errors, aborting (use -f to force output) ERROR (phandle_references): Reference to non-existent node or label "mainpllclk" ERROR (phandle_references): Reference to non-existent node or label "refclksys" ERROR (phandle_references): Reference to non-existent node or label "papllclk" ERROR: Input tree has errors, aborting (use -f to force output) ------------------------------------------------------------------------------- arm-multi_v7_defconfig : FAIL, 16 errors, 0 warnings, 0 section mismatches Errors: ../net/core/sock.c:724:7: error: 'SO_REUSEPORT' undeclared (first use in this function) ../net/core/sock.c:922:7: error: 'SO_ATTACH_BPF' undeclared (first use in this function) ../net/core/sock.c:939:7: error: 'SO_LOCK_FILTER' undeclared (first use in this function) ../net/core/sock.c:978:7: error: 'SO_SELECT_ERR_QUEUE' undeclared (first use in this function) ../net/core/sock.c:983:7: error: 'SO_BUSY_POLL' undeclared (first use in this function) ../net/core/sock.c:996:7: error: 'SO_MAX_PACING_RATE' undeclared (first use in this function) ../net/core/sock.c:1002:7: error: 'SO_INCOMING_CPU' undeclared (first use in this function) ../net/core/sock.c:1075:7: error: 'SO_REUSEPORT' undeclared (first use in this function) ../net/core/sock.c:1233:7: error: 'SO_GET_FILTER' undeclared (first use in this function) ../net/core/sock.c:1240:7: error: 'SO_LOCK_FILTER' undeclared (first use in this function) ../net/core/sock.c:1244:7: error: 'SO_BPF_EXTENSIONS' undeclared (first use in this function) ../net/core/sock.c:1248:7: error: 'SO_SELECT_ERR_QUEUE' undeclared (first use in this function) ../net/core/sock.c:1253:7: error: 'SO_BUSY_POLL' undeclared (first use in this function) ../net/core/sock.c:1258:7: error: 'SO_MAX_PACING_RATE' undeclared (first use in this function) ../net/core/sock.c:1262:7: error: 'SO_INCOMING_CPU' undeclared (first use in this function) ../net/sunrpc/xprtsock.c:1738:38: error: 'SO_REUSEPORT' undeclared (first use in this function) ------------------------------------------------------------------------------- arm-multi_v5_defconfig : FAIL, 16 errors, 0 warnings, 0 section mismatches Errors: ../net/core/sock.c:724:7: error: 'SO_REUSEPORT' undeclared (first use in this function) ../net/core/sock.c:922:7: error: 'SO_ATTACH_BPF' undeclared (first use in this function) ../net/core/sock.c:939:7: error: 'SO_LOCK_FILTER' undeclared (first use in this function) ../net/core/sock.c:978:7: error: 'SO_SELECT_ERR_QUEUE' undeclared (first use in this function) ../net/core/sock.c:983:7: error: 'SO_BUSY_POLL' undeclared (first use in this function) ../net/core/sock.c:996:7: error: 'SO_MAX_PACING_RATE' undeclared (first use in this function) ../net/core/sock.c:1002:7: error: 'SO_INCOMING_CPU' undeclared (first use in this function) ../net/core/sock.c:1075:7: error: 'SO_REUSEPORT' undeclared (first use in this function) ../net/core/sock.c:1233:7: error: 'SO_GET_FILTER' undeclared (first use in this function) ../net/core/sock.c:1240:7: error: 'SO_LOCK_FILTER' undeclared (first use in this function) ../net/core/sock.c:1244:7: error: 'SO_BPF_EXTENSIONS' undeclared (first use in this function) ../net/core/sock.c:1248:7: error: 'SO_SELECT_ERR_QUEUE' undeclared (first use in this function) ../net/core/sock.c:1253:7: error: 'SO_BUSY_POLL' undeclared (first use in this function) ../net/core/sock.c:1258:7: error: 'SO_MAX_PACING_RATE' undeclared (first use in this function) ../net/core/sock.c:1262:7: error: 'SO_INCOMING_CPU' undeclared (first use in this function) ../net/sunrpc/xprtsock.c:1738:38: error: 'SO_REUSEPORT' undeclared (first use in this function) ------------------------------------------------------------------------------- Passed with no errors, warnings or mismatches: arm64-allnoconfig arm64-allmodconfig x86_64-defconfig arm-allnoconfig x86_64-allnoconfig x86_64-allmodconfig arm64-defconfig

7 years, 7 months

1
0
0 0

[PATCH v2 1/2] Fix NULL pointer in page_cache_tree_insert

by Matthew Wilcox

From: Matthew Wilcox <mawilcox(a)microsoft.com> f2fs specifies the __GFP_ZERO flag for allocating some of its pages. Unfortunately, the page cache also uses the mapping's GFP flags for allocating radix tree nodes. It always masked off the __GFP_HIGHMEM flag, and masks off __GFP_ZERO in some paths, but not all. That causes radix tree nodes to be allocated with a NULL list_head, which causes backtraces like: [<ffffff80086f4de0>] __list_del_entry+0x30/0xd0 [<ffffff8008362018>] list_lru_del+0xac/0x1ac [<ffffff800830f04c>] page_cache_tree_insert+0xd8/0x110 The __GFP_DMA and __GFP_DMA32 flags would also be able to sneak through if they are ever used. Fix them all by using GFP_RECLAIM_MASK at the innermost location, and remove it from earlier in the callchain. Fixes: 449dd6984d0e ("mm: keep page cache radix tree nodes in check") Reported-by: Chris Fries <cfries(a)google.com> Debugged-by: Minchan Kim <minchan(a)kernel.org> Signed-off-by: Matthew Wilcox <mawilcox(a)microsoft.com> Acked-by: Johannes Weiner <hannes(a)cmpxchg.org> Acked-by: Michal Hocko <mhocko(a)suse.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Cc: stable(a)vger.kernel.org --- mm/filemap.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/mm/filemap.c b/mm/filemap.c index c2147682f4c3..1a4bfc5ed3dc 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -785,7 +785,7 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask) VM_BUG_ON_PAGE(!PageLocked(new), new); VM_BUG_ON_PAGE(new->mapping, new); - error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM); + error = radix_tree_preload(gfp_mask & GFP_RECLAIM_MASK); if (!error) { struct address_space *mapping = old->mapping; void (*freepage)(struct page *); @@ -841,7 +841,7 @@ static int __add_to_page_cache_locked(struct page *page, return error; } - error = radix_tree_maybe_preload(gfp_mask & ~__GFP_HIGHMEM); + error = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK); if (error) { if (!huge) mem_cgroup_cancel_charge(page, memcg, false); @@ -1574,8 +1574,7 @@ struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset, if (fgp_flags & FGP_ACCESSED) __SetPageReferenced(page); - err = add_to_page_cache_lru(page, mapping, offset, - gfp_mask & GFP_RECLAIM_MASK); + err = add_to_page_cache_lru(page, mapping, offset, gfp_mask); if (unlikely(err)) { put_page(page); page = NULL; @@ -2378,7 +2377,7 @@ static int page_cache_read(struct file *file, pgoff_t offset, gfp_t gfp_mask) if (!page) return -ENOMEM; - ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask & GFP_KERNEL); + ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask); if (ret == 0) ret = mapping->a_ops->readpage(file, page); else if (ret == -EEXIST) -- 2.16.3

7 years, 7 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror