When VHE is not present, KVM needs to save and restores PMSCR_EL1 when
possible. If SPE is used by the host, value of PMSCR_EL1 cannot be saved
for the guest.
If the host starts using SPE between two save+restore on the same vcpu,
restore will write the value of PMSCR_EL1 read during the first save.
Make sure __debug_save_spe_nvhe clears the value of the saved PMSCR_EL1
when the guest cannot use SPE.
Signed-off-by: Julien Thierry <julien.thierry(a)arm.com>
Cc: Christoffer Dall <christoffer.dall(a)linaro.org>
Cc: Marc Zyngier <marc.zyngier(a)arm.com>
Cc: Catalin Marinas <catalin.marinas(a)arm.com>
Cc: Will Deacon <will.deacon(a)arm.com>
Cc: <stable(a)vger.kernel.org>
---
arch/arm64/kvm/hyp/debug-sr.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm64/kvm/hyp/debug-sr.c b/arch/arm64/kvm/hyp/debug-sr.c
index 321c9c0..f4363d4 100644
--- a/arch/arm64/kvm/hyp/debug-sr.c
+++ b/arch/arm64/kvm/hyp/debug-sr.c
@@ -74,6 +74,9 @@ static void __hyp_text __debug_save_spe_nvhe(u64 *pmscr_el1)
{
u64 reg;
+ /* Clear pmscr in case of early return */
+ *pmscr_el1 = 0;
+
/* SPE present on this CPU? */
if (!cpuid_feature_extract_unsigned_field(read_sysreg(id_aa64dfr0_el1),
ID_AA64DFR0_PMSVER_SHIFT))
--
1.9.1
This is a note to let you know that I've just added the patch titled
powerpc/kprobes: Disable preemption before invoking probe handler for optprobes
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
powerpc-kprobes-disable-preemption-before-invoking-probe-handler-for-optprobes.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 8a2d71a3f2737e2448aa68de2b6052cb570d3d2a Mon Sep 17 00:00:00 2001
From: "Naveen N. Rao" <naveen.n.rao(a)linux.vnet.ibm.com>
Date: Mon, 23 Oct 2017 22:07:38 +0530
Subject: powerpc/kprobes: Disable preemption before invoking probe handler for optprobes
From: Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
commit 8a2d71a3f2737e2448aa68de2b6052cb570d3d2a upstream.
Per Documentation/kprobes.txt, probe handlers need to be invoked with
preemption disabled. Update optimized_callback() to do so. Also move
get_kprobe_ctlblk() invocation post preemption disable, since it
accesses pre-cpu data.
This was not an issue so far since optprobes wasn't selected if
CONFIG_PREEMPT was enabled. Commit a30b85df7d599f ("kprobes: Use
synchronize_rcu_tasks() for optprobe with CONFIG_PREEMPT=y") changes
this.
Signed-off-by: Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
Acked-by: Masami Hiramatsu <mhiramat(a)kernel.org>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
arch/powerpc/kernel/optprobes.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/arch/powerpc/kernel/optprobes.c
+++ b/arch/powerpc/kernel/optprobes.c
@@ -115,7 +115,6 @@ static unsigned long can_optimize(struct
static void optimized_callback(struct optimized_kprobe *op,
struct pt_regs *regs)
{
- struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
unsigned long flags;
/* This is possible if op is under delayed unoptimizing */
@@ -124,13 +123,14 @@ static void optimized_callback(struct op
local_irq_save(flags);
hard_irq_disable();
+ preempt_disable();
if (kprobe_running()) {
kprobes_inc_nmissed_count(&op->kp);
} else {
__this_cpu_write(current_kprobe, &op->kp);
regs->nip = (unsigned long)op->kp.addr;
- kcb->kprobe_status = KPROBE_HIT_ACTIVE;
+ get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE;
opt_pre_handler(&op->kp, regs);
__this_cpu_write(current_kprobe, NULL);
}
@@ -140,6 +140,7 @@ static void optimized_callback(struct op
* local_irq_restore() will re-enable interrupts,
* if they were hard disabled.
*/
+ preempt_enable_no_resched();
local_irq_restore(flags);
}
NOKPROBE_SYMBOL(optimized_callback);
Patches currently in stable-queue which might be from naveen.n.rao(a)linux.vnet.ibm.com are
queue-4.14/kprobes-use-synchronize_rcu_tasks-for-optprobe-with-config_preempt-y.patch
queue-4.14/powerpc-kprobes-disable-preemption-before-invoking-probe-handler-for-optprobes.patch
queue-4.14/powerpc-jprobes-disable-preemption-when-triggered-through-ftrace.patch
This is a note to let you know that I've just added the patch titled
powerpc/jprobes: Disable preemption when triggered through ftrace
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
powerpc-jprobes-disable-preemption-when-triggered-through-ftrace.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 6baea433bc84cd148af1c524389a8d756f67412e Mon Sep 17 00:00:00 2001
From: "Naveen N. Rao" <naveen.n.rao(a)linux.vnet.ibm.com>
Date: Fri, 22 Sep 2017 14:40:47 +0530
Subject: powerpc/jprobes: Disable preemption when triggered through ftrace
From: Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
commit 6baea433bc84cd148af1c524389a8d756f67412e upstream.
KPROBES_SANITY_TEST throws the below splat when CONFIG_PREEMPT is
enabled:
Kprobe smoke test: started
DEBUG_LOCKS_WARN_ON(val > preempt_count())
------------[ cut here ]------------
WARNING: CPU: 19 PID: 1 at kernel/sched/core.c:3094 preempt_count_sub+0xcc/0x140
Modules linked in:
CPU: 19 PID: 1 Comm: swapper/0 Not tainted 4.13.0-rc7-nnr+ #97
task: c0000000fea80000 task.stack: c0000000feb00000
NIP: c00000000011d3dc LR: c00000000011d3d8 CTR: c000000000a090d0
REGS: c0000000feb03400 TRAP: 0700 Not tainted (4.13.0-rc7-nnr+)
MSR: 8000000000021033 <SF,ME,IR,DR,RI,LE> CR: 28000282 XER: 00000000
CFAR: c00000000015aa18 SOFTE: 0
<snip>
NIP preempt_count_sub+0xcc/0x140
LR preempt_count_sub+0xc8/0x140
Call Trace:
preempt_count_sub+0xc8/0x140 (unreliable)
kprobe_handler+0x228/0x4b0
program_check_exception+0x58/0x3b0
program_check_common+0x16c/0x170
--- interrupt: 0 at kprobe_target+0x8/0x20
LR = init_test_probes+0x248/0x7d0
kp+0x0/0x80 (unreliable)
livepatch_handler+0x38/0x74
init_kprobes+0x1d8/0x208
do_one_initcall+0x68/0x1d0
kernel_init_freeable+0x298/0x374
kernel_init+0x24/0x160
ret_from_kernel_thread+0x5c/0x70
Instruction dump:
419effdc 3d22001b 39299240 81290000 2f890000 409effc8 3c82ffcb 3c62ffcb
3884bc68 3863bc18 4803d5fd 60000000 <0fe00000> 4bffffa8 60000000 60000000
---[ end trace 432dd46b4ce3d29f ]---
Kprobe smoke test: passed successfully
The issue is that we aren't disabling preemption in
kprobe_ftrace_handler(). Disable it.
Fixes: ead514d5fb30a0 ("powerpc/kprobes: Add support for KPROBES_ON_FTRACE")
Acked-by: Masami Hiramatsu <mhiramat(a)kernel.org>
Signed-off-by: Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
[mpe: Trim oops a little for formatting]
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
arch/powerpc/kernel/kprobes-ftrace.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
--- a/arch/powerpc/kernel/kprobes-ftrace.c
+++ b/arch/powerpc/kernel/kprobes-ftrace.c
@@ -65,6 +65,7 @@ void kprobe_ftrace_handler(unsigned long
/* Disable irq for emulating a breakpoint and avoiding preempt */
local_irq_save(flags);
hard_irq_disable();
+ preempt_disable();
p = get_kprobe((kprobe_opcode_t *)nip);
if (unlikely(!p) || kprobe_disabled(p))
@@ -86,12 +87,18 @@ void kprobe_ftrace_handler(unsigned long
kcb->kprobe_status = KPROBE_HIT_ACTIVE;
if (!p->pre_handler || !p->pre_handler(p, regs))
__skip_singlestep(p, regs, kcb, orig_nip);
- /*
- * If pre_handler returns !0, it sets regs->nip and
- * resets current kprobe.
- */
+ else {
+ /*
+ * If pre_handler returns !0, it sets regs->nip and
+ * resets current kprobe. In this case, we still need
+ * to restore irq, but not preemption.
+ */
+ local_irq_restore(flags);
+ return;
+ }
}
end:
+ preempt_enable_no_resched();
local_irq_restore(flags);
}
NOKPROBE_SYMBOL(kprobe_ftrace_handler);
Patches currently in stable-queue which might be from naveen.n.rao(a)linux.vnet.ibm.com are
queue-4.14/kprobes-use-synchronize_rcu_tasks-for-optprobe-with-config_preempt-y.patch
queue-4.14/powerpc-kprobes-disable-preemption-before-invoking-probe-handler-for-optprobes.patch
queue-4.14/powerpc-jprobes-disable-preemption-when-triggered-through-ftrace.patch
This is a note to let you know that I've just added the patch titled
kprobes: Use synchronize_rcu_tasks() for optprobe with CONFIG_PREEMPT=y
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
kprobes-use-synchronize_rcu_tasks-for-optprobe-with-config_preempt-y.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Wed Dec 6 18:04:41 CET 2017
From: Masami Hiramatsu <mhiramat(a)kernel.org>
Date: Fri, 20 Oct 2017 08:43:39 +0900
Subject: kprobes: Use synchronize_rcu_tasks() for optprobe with CONFIG_PREEMPT=y
From: Masami Hiramatsu <mhiramat(a)kernel.org>
[ Upstream commit a30b85df7d599f626973e9cd3056fe755bd778e0 ]
We want to wait for all potentially preempted kprobes trampoline
execution to have completed. This guarantees that any freed
trampoline memory is not in use by any task in the system anymore.
synchronize_rcu_tasks() gives such a guarantee, so use it.
Also, this guarantees to wait for all potentially preempted tasks
on the instructions which will be replaced with a jump.
Since this becomes a problem only when CONFIG_PREEMPT=y, enable
CONFIG_TASKS_RCU=y for synchronize_rcu_tasks() in that case.
Signed-off-by: Masami Hiramatsu <mhiramat(a)kernel.org>
Acked-by: Paul E. McKenney <paulmck(a)linux.vnet.ibm.com>
Cc: Ananth N Mavinakayanahalli <ananth(a)linux.vnet.ibm.com>
Cc: Linus Torvalds <torvalds(a)linux-foundation.org>
Cc: Naveen N . Rao <naveen.n.rao(a)linux.vnet.ibm.com>
Cc: Paul E . McKenney <paulmck(a)linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Steven Rostedt <rostedt(a)goodmis.org>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Link: http://lkml.kernel.org/r/150845661962.5443.17724352636247312231.stgit@devbox
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
arch/Kconfig | 2 +-
kernel/kprobes.c | 14 ++++++++------
2 files changed, 9 insertions(+), 7 deletions(-)
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -91,7 +91,7 @@ config STATIC_KEYS_SELFTEST
config OPTPROBES
def_bool y
depends on KPROBES && HAVE_OPTPROBES
- depends on !PREEMPT
+ select TASKS_RCU if PREEMPT
config KPROBES_ON_FTRACE
def_bool y
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -573,13 +573,15 @@ static void kprobe_optimizer(struct work
do_unoptimize_kprobes();
/*
- * Step 2: Wait for quiesence period to ensure all running interrupts
- * are done. Because optprobe may modify multiple instructions
- * there is a chance that Nth instruction is interrupted. In that
- * case, running interrupt can return to 2nd-Nth byte of jump
- * instruction. This wait is for avoiding it.
+ * Step 2: Wait for quiesence period to ensure all potentially
+ * preempted tasks to have normally scheduled. Because optprobe
+ * may modify multiple instructions, there is a chance that Nth
+ * instruction is preempted. In that case, such tasks can return
+ * to 2nd-Nth byte of jump instruction. This wait is for avoiding it.
+ * Note that on non-preemptive kernel, this is transparently converted
+ * to synchronoze_sched() to wait for all interrupts to have completed.
*/
- synchronize_sched();
+ synchronize_rcu_tasks();
/* Step 3: Optimize kprobes after quiesence period */
do_optimize_kprobes();
Patches currently in stable-queue which might be from mhiramat(a)kernel.org are
queue-4.14/kprobes-use-synchronize_rcu_tasks-for-optprobe-with-config_preempt-y.patch
queue-4.14/kprobes-x86-disable-preemption-in-ftrace-based-jprobes.patch
This is the start of the stable review cycle for the 4.14.4 release.
There are 95 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Dec 6 16:00:27 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.4-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.4-rc1
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "x86/entry/64: Add missing irqflags tracing to native_load_gs_index()"
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/i915: Prevent zero length "index" write
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/i915: Don't try indexed reads to alternate slave addresses
Xiong Zhang <xiong.y.zhang(a)intel.com>
drm/i915/gvt: Correct ADDR_4K/2M/1G_MASK definition
Chris Wilson <chris(a)chris-wilson.co.uk>
drm/i915/fbdev: Serialise early hotplug events with async fbdev config
Hans de Goede <j.w.r.degoede(a)gmail.com>
drm/i915: Re-register PMIC bus access notifier on runtime resume
Hans de Goede <j.w.r.degoede(a)gmail.com>
drm/i915: Fix false-positive assert_rpm_wakelock_held in i915_pmic_bus_access_notifier v2
NeilBrown <neilb(a)suse.com>
md: forbid a RAID5 from having both a bitmap and a journal.
Sasha Neftin <sasha.neftin(a)intel.com>
e1000e: fix the use of magic numbers for buffer overrun issue
Don Hiatt <don.hiatt(a)intel.com>
IB/hfi1: Do not warn on lid conversions for OPA
Don Hiatt <don.hiatt(a)intel.com>
IB/core: Do not warn on lid conversions for OPA
Sandipan Das <sandipan(a)linux.vnet.ibm.com>
include/linux/compiler-clang.h: handle randomizable anonymous structs
Michel Dänzer <michel.daenzer(a)amd.com>
drm/amdgpu: Set adev->vcn.irq.num_types for VCN
Leo Liu <leo.liu(a)amd.com>
drm/amdgpu: move UVD/VCE and VCN structure out from union
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/edid: Don't send non-zero YQ in AVI infoframe for HDMI 1.x sinks
Laurent Pinchart <laurent.pinchart+renesas(a)ideasonboard.com>
drm/fsl-dcu: Don't set connector DPMS property
Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com>
drm/fb_helper: Disable all crtc's when initial setup fails.
Rex Zhu <Rex.Zhu(a)amd.com>
drm/amd/pp: fix typecast error in powerplay.
Christian König <christian.koenig(a)amd.com>
drm/ttm: once more fix ttm_buffer_object_transfer
Peter Griffin <peter.griffin(a)linaro.org>
drm/hisilicon: Ensure LDI regs are properly configured.
Jonathan Liu <net147(a)gmail.com>
drm/panel: simple: Add missing panel_simple_unprepare() calls
Roman Kapl <rka(a)sysgo.com>
drm/radeon: fix atombios on big endian
Jyri Sarha <jsarha(a)ti.com>
drm/tilcdc: Precalculate total frametime in tilcdc_crtc_set_mode()
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/vblank: Tune drm_crtc_accurate_vblank_count() WARN down to a debug
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/vblank: Fix flip event vblank count
Michel Dänzer <michel.daenzer(a)amd.com>
drm/ttm: Always and only destroy bo->ttm_resv in ttm_bo_release_list
Christian König <christian.koenig(a)amd.com>
drm/amdgpu: reserve root PD while releasing it
Christian König <christian.koenig(a)amd.com>
dma-buf: make reservation_object_copy_fences rcu save
Christian König <christian.koenig(a)amd.com>
drm/ttm: fix ttm_bo_cleanup_refs_or_queue once more
Ken Wang <Ken.Wang(a)amd.com>
drm/amdgpu: Remove check which is not valid for certain VBIOS
ozeng <oak.zeng(a)amd.com>
drm/amdgpu: Properly allocate VM invalidate eng v2
Christian König <christian.koenig(a)amd.com>
drm/amdgpu: fix error handling in amdgpu_bo_do_create
Ken Wang <Ken.Wang(a)amd.com>
drm/amdgpu: correct reference clock value on vega10
Dan Carpenter <dan.carpenter(a)oracle.com>
drm/amdgpu: Potential uninitialized variable in amdgpu_vm_update_directories()
Dan Carpenter <dan.carpenter(a)oracle.com>
drm/amdgpu: potential uninitialized variable in amdgpu_vce_ring_parse_cs()
Alex Deucher <alexander.deucher(a)amd.com>
Revert "drm/radeon: dont switch vt on suspend"
Jeff Lien <jeff.lien(a)wdc.com>
nvme-pci: add quirk for delay before CHK RDY for WDC SN200
Peter Rosin <peda(a)axentia.se>
hwmon: (jc42) optionally try to disable the SMBUS timeout
Rui Hua <huarui.dev(a)gmail.com>
bcache: recover data from backing when data is clean
Coly Li <colyli(a)suse.de>
bcache: only permit to recovery read error when cache device is clean
Huacai Chen <chenhc(a)lemote.com>
bcache: Fix building error on MIPS
Vaibhav Jain <vaibhav(a)linux.vnet.ibm.com>
cxl: Check if vphb exists before iterating over AFU devices
Hans de Goede <hdegoede(a)redhat.com>
i2c: i801: Fix Failed to allocate irq -2147483648 error
Heiner Kallweit <hkallweit1(a)gmail.com>
eeprom: at24: check at24_read/write arguments
Bartosz Golaszewski <brgl(a)bgdev.pl>
eeprom: at24: correctly set the size for at24mac402
Heiner Kallweit <hkallweit1(a)gmail.com>
eeprom: at24: fix reading from 24MAC402/24MAC602
Lv Zheng <lv.zheng(a)intel.com>
ACPI / EC: Fix regression related to PM ops support in ECDT device
Bastian Stender <bst(a)pengutronix.de>
mmc: core: prepend 0x to OCR entry in sysfs
Bastian Stender <bst(a)pengutronix.de>
mmc: core: prepend 0x to pre_eol_info entry in sysfs
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Ensure that debugfs files are removed
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: core: Do not leave the block driver in a suspended state
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Check return value of blk_get_request()
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Fix missing blk_put_request()
Ulf Hansson <ulf.hansson(a)linaro.org>
mmc: sdhci: Avoid swiotlb buffer being full
Dr. David Alan Gilbert <dgilbert(a)redhat.com>
KVM: lapic: Fixup LDR on load in x2apic
Dr. David Alan Gilbert <dgilbert(a)redhat.com>
KVM: lapic: Split out x2apic ldr calculation
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: x86: inject exceptions produced by x86_decode_insn
Liran Alon <liran.alon(a)oracle.com>
KVM: x86: Exit to user-mode on #UD intercept when emulator requires
Liran Alon <liran.alon(a)oracle.com>
KVM: x86: pvclock: Handle first-time write to pvclock-page contains random junk
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc/kexec: Fix kexec/kdump in P9 guest kernels
Mahesh Salgaonkar <mahesh(a)linux.vnet.ibm.com>
powerpc/powernv: Fix kexec crashes caused by tlbie tracing
Ard Biesheuvel <ard.biesheuvel(a)linaro.org>
arm64: ftrace: emit ftrace-mod.o contents through code
Ard Biesheuvel <ard.biesheuvel(a)linaro.org>
arm64: module-plts: factor out PLT generation code for ftrace
John Johansen <john.johansen(a)canonical.com>
apparmor: fix oops in audit_signal_cb hook
Peter Ujfalusi <peter.ujfalusi(a)ti.com>
omapdrm: hdmi4: Correct the SoC revision matching
Laurent Pinchart <laurent.pinchart(a)ideasonboard.com>
drm: omapdrm: Fix DPI on platforms using the DSI VDDS
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: revert ELF_ET_DYN_BASE base changes
Vasily Averin <vvs(a)virtuozzo.com>
lockd: lost rollback of set_grace_period() in lockd_down_net()
Ondrej Mosnáček <omosnacek(a)gmail.com>
crypto: skcipher - Fix skcipher_walk_aead_common
Stephan Mueller <smueller(a)chronox.de>
crypto: af_alg - remove locking in async callback
Stephan Mueller <smueller(a)chronox.de>
crypto: algif_aead - skip SGL entries with NULL page
Naofumi Honda <honda(a)math.sci.hokudai.ac.jp>
nfsd: fix panic in posix_unblock_lock called from nfs4_laundromat
Trond Myklebust <trond.myklebust(a)primarydata.com>
nfsd: Fix another OPEN stateid race
Trond Myklebust <trond.myklebust(a)primarydata.com>
nfsd: Fix stateid races between OPEN and CLOSE
Josef Bacik <jbacik(a)fb.com>
btrfs: clear space cache inode generation always
Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
mm/hugetlb: fix NULL-pointer dereference on 5-level paging machine
Ian Kent <raven(a)themaw.net>
autofs: revert "autofs: fix AT_NO_AUTOMOUNT not being honored"
Ian Kent <raven(a)themaw.net>
autofs: revert "autofs: take more care to not update last_used on path walk"
OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp>
fs/fat/inode.c: fix sb_rdonly() change
Shakeel Butt <shakeelb(a)google.com>
mm, memcg: fix mem_cgroup_swapout() for THPs
Zi Yan <zi.yan(a)cs.rutgers.edu>
mm: migrate: fix an incorrect call of prep_transhuge_page()
chenjie <chenjie6(a)huawei.com>
mm/madvise.c: fix madvise() infinite loop under special circumstances
Kees Cook <keescook(a)chromium.org>
exec: avoid RLIMIT_STACK races with prlimit()
Dan Williams <dan.j.williams(a)intel.com>
IB/core: disable memory registration of filesystem-dax vmas
Dan Williams <dan.j.williams(a)intel.com>
v4l2: disable filesystem-dax mapping support
Dan Williams <dan.j.williams(a)intel.com>
mm: fail get_vaddr_frames() for filesystem-dax mappings
Dan Williams <dan.j.williams(a)intel.com>
mm: introduce get_user_pages_longterm
Dan Williams <dan.j.williams(a)intel.com>
device-dax: implement ->split() to catch invalid munmap attempts
Dan Williams <dan.j.williams(a)intel.com>
mm, hugetlbfs: introduce ->split() to vm_operations_struct
Dan Williams <dan.j.williams(a)intel.com>
mm: fix device-dax pud write-faults triggered by get_user_pages()
Mike Kravetz <mike.kravetz(a)oracle.com>
mm/cma: fix alloc_contig_range ret code/potential leak
Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()
Wang Nan <wangnan0(a)huawei.com>
mm, oom_reaper: gather each vma to prevent leaking TLB entry
Michal Hocko <mhocko(a)suse.com>
mm, memory_hotplug: do not back off draining pcp free pages from kworker context
Stefan Brüns <stefan.bruens(a)rwth-aachen.de>
platform/x86: hp-wmi: Fix tablet mode detection for convertibles
-------------
Diffstat:
Documentation/devicetree/bindings/hwmon/jc42.txt | 4 +
Makefile | 4 +-
arch/arm64/Makefile | 3 -
arch/arm64/include/asm/module.h | 46 +++++++++-
arch/arm64/kernel/Makefile | 3 -
arch/arm64/kernel/ftrace-mod.S | 18 ----
arch/arm64/kernel/ftrace.c | 14 +--
arch/arm64/kernel/module-plts.c | 50 +++--------
arch/arm64/kernel/module.lds | 1 +
arch/powerpc/kernel/misc_64.S | 2 +
arch/powerpc/mm/hash_native_64.c | 15 +++-
arch/s390/include/asm/elf.h | 15 ++--
arch/x86/entry/entry_64.S | 10 +--
arch/x86/include/asm/pgtable.h | 6 ++
arch/x86/kvm/lapic.c | 12 ++-
arch/x86/kvm/svm.c | 2 +
arch/x86/kvm/vmx.c | 2 +
arch/x86/kvm/x86.c | 5 ++
crypto/af_alg.c | 21 +++--
crypto/algif_aead.c | 56 +++++++-----
crypto/algif_skcipher.c | 23 ++---
crypto/skcipher.c | 3 +
drivers/acpi/ec.c | 69 +++++++++------
drivers/acpi/internal.h | 1 +
drivers/acpi/scan.c | 21 +++++
drivers/dax/device.c | 12 +++
drivers/dma-buf/reservation.c | 56 +++++++++---
drivers/gpu/drm/amd/amdgpu/amdgpu.h | 20 ++---
drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 38 ++++-----
drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 6 --
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 6 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 15 +++-
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 15 +++-
drivers/gpu/drm/amd/amdgpu/soc15.c | 5 +-
drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 2 +-
.../amd/powerplay/hwmgr/process_pptables_v1_0.c | 4 +-
drivers/gpu/drm/drm_edid.c | 12 ++-
drivers/gpu/drm/drm_fb_helper.c | 4 +
drivers/gpu/drm/drm_vblank.c | 6 +-
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c | 5 --
drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c | 3 +
drivers/gpu/drm/i915/gvt/gtt.c | 6 +-
drivers/gpu/drm/i915/i915_drv.c | 2 +
drivers/gpu/drm/i915/intel_fbdev.c | 10 ++-
drivers/gpu/drm/i915/intel_hdmi.c | 3 +-
drivers/gpu/drm/i915/intel_i2c.c | 4 +-
drivers/gpu/drm/i915/intel_uncore.c | 13 +++
drivers/gpu/drm/i915/intel_uncore.h | 1 +
drivers/gpu/drm/omapdrm/dss/dpi.c | 4 +-
drivers/gpu/drm/omapdrm/dss/hdmi4_core.c | 23 +++--
drivers/gpu/drm/panel/panel-simple.c | 2 +
drivers/gpu/drm/radeon/atombios_dp.c | 38 ++++-----
drivers/gpu/drm/radeon/radeon_fb.c | 1 -
drivers/gpu/drm/tilcdc/tilcdc_crtc.c | 13 ++-
drivers/gpu/drm/ttm/ttm_bo.c | 43 +++++-----
drivers/gpu/drm/ttm/ttm_bo_util.c | 1 +
drivers/gpu/drm/vc4/vc4_hdmi.c | 3 +-
drivers/hwmon/jc42.c | 21 +++++
drivers/i2c/busses/i2c-i801.c | 3 +
drivers/infiniband/core/umem.c | 2 +-
drivers/infiniband/core/user_mad.c | 11 ++-
drivers/infiniband/hw/hfi1/mad.c | 7 +-
drivers/md/bcache/alloc.c | 2 +-
drivers/md/bcache/extents.c | 2 +-
drivers/md/bcache/journal.c | 2 +-
drivers/md/bcache/request.c | 9 +-
drivers/md/bitmap.c | 6 ++
drivers/md/md.c | 2 +-
drivers/md/raid5.c | 7 ++
drivers/media/v4l2-core/videobuf-dma-sg.c | 5 +-
drivers/misc/cxl/pci.c | 12 ++-
drivers/misc/eeprom/at24.c | 19 ++++-
drivers/mmc/core/block.c | 67 +++++++++++++--
drivers/mmc/core/bus.c | 3 +
drivers/mmc/core/debugfs.c | 1 +
drivers/mmc/core/mmc.c | 4 +-
drivers/mmc/core/sd.c | 2 +-
drivers/mmc/host/sdhci.c | 28 +++---
drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 +-
drivers/net/ethernet/intel/e1000e/netdev.c | 9 +-
drivers/nvme/host/nvme.h | 2 +-
drivers/nvme/host/pci.c | 2 +
drivers/platform/x86/hp-wmi.c | 2 +-
fs/autofs4/root.c | 17 ++--
fs/btrfs/extent-tree.c | 14 +--
fs/exec.c | 7 +-
fs/fat/inode.c | 2 +-
fs/lockd/svc.c | 2 +
fs/namei.c | 15 +---
fs/nfsd/nfs4state.c | 99 ++++++++++++++++------
include/acpi/acpi_bus.h | 1 +
include/acpi/acpi_drivers.h | 1 +
include/asm-generic/pgtable.h | 8 ++
include/crypto/if_alg.h | 1 +
include/drm/drm_edid.h | 3 +-
include/linux/compiler-clang.h | 3 +
include/linux/fs.h | 17 +++-
include/linux/hugetlb.h | 8 --
include/linux/migrate.h | 2 +-
include/linux/mm.h | 14 +++
include/uapi/linux/bcache.h | 2 +-
mm/frame_vector.c | 12 +++
mm/gup.c | 64 ++++++++++++++
mm/huge_memory.c | 36 +++-----
mm/hugetlb.c | 12 ++-
mm/madvise.c | 4 +-
mm/memcontrol.c | 2 +-
mm/mmap.c | 8 +-
mm/oom_kill.c | 7 +-
mm/page_alloc.c | 13 +--
security/apparmor/include/audit.h | 12 +--
112 files changed, 958 insertions(+), 445 deletions(-)
0-day reported this build error:
arch/x86/boot/compressed/pgtable_64.o: In function `l5_paging_required':
pgtable_64.c:(.text+0x22): undefined reference to `__force_order'
The issue is only with GCC < 5 and when KASLR is disabled. Newer GCC
works fine.
__force_order is used by special_insns.h asm code to force instruction
serialization.
It doesn't actually referenced from the code, but GCC < 5 with -fPIE
would still generate undefined symbol.
I didn't noticed this before and failed to move __force_order definition
from pagetable.c (which compiles only with KASLR enabled) to
pgtable_64.c.
Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Fixes: 10c9a5346f72 ("x86/boot/compressed/64: Detect and handle 5-level paging at boot-time")
Cc: stable(a)vger.kernel.org
---
arch/x86/boot/compressed/pagetable.c | 3 ---
arch/x86/boot/compressed/pgtable_64.c | 11 +++++++++++
2 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/arch/x86/boot/compressed/pagetable.c b/arch/x86/boot/compressed/pagetable.c
index 6bd51de4475c..250826ac216e 100644
--- a/arch/x86/boot/compressed/pagetable.c
+++ b/arch/x86/boot/compressed/pagetable.c
@@ -38,9 +38,6 @@
#define __PAGE_OFFSET __PAGE_OFFSET_BASE
#include "../../mm/ident_map.c"
-/* Used by pgtable.h asm code to force instruction serialization. */
-unsigned long __force_order;
-
/* Used to track our page table allocation area. */
struct alloc_pgt_data {
unsigned char *pgt_buf;
diff --git a/arch/x86/boot/compressed/pgtable_64.c b/arch/x86/boot/compressed/pgtable_64.c
index 7bcf03b376da..491fa2d08bca 100644
--- a/arch/x86/boot/compressed/pgtable_64.c
+++ b/arch/x86/boot/compressed/pgtable_64.c
@@ -1,5 +1,16 @@
#include <asm/processor.h>
+/*
+ * __force_order is used by special_insns.h asm code to force instruction
+ * serialization.
+ *
+ * It doesn't actually referenced from the code, but GCC < 5 with -fPIE
+ * would still generate undefined symbol.
+ *
+ * Let's workaround this by defining the variable.
+ */
+unsigned long __force_order;
+
int l5_paging_required(void)
{
/* Check if leaf 7 is supported. */
--
2.15.0
On Wed, 2017-12-06 at 00:17 +0300, ptikhomirov wrote:
> I mean threads in scsi_dec_host_busy() the part under rcu_read_lock are
> divided into two groups: a) finished before call_rcu, b) beginning rcu
> section after call_rcu. So first, in scsi_eh_inc_host_failed() we will
> see all changes to host busy from group (a), second, all threads in group
> (b) will see our change to host_failed. Either there is nobody in (b) and
> we will start EH, or the thread from (b) which entered spin_lock last will
> start EH.
>
> In your case tasks from b does not see host_failed was incremented, and
> will not start EH.
Hello Pavel,
What does "your case" mean? In my previous e-mail I explained a scenario that
cannot happen so it's not clear to me what "your case" refers to?
Additionally, it seems like you are assuming that RCU guarantees ordering of
RCU read-locked sections against call_rcu()? That's not how RCU works. RCU
guarantees serialization of read-locked sections against grace periods. The
function scsi_eh_inc_host_failed() is invoked through call_rcu() and hence
will be called during a grace period.
Anyway, the different scenarios I see are as follows:
(a) scsi_dec_host_busy() finishes before scsi_eh_inc_host_failed() starts.
(b) scsi_dec_host_busy() starts after scsi_eh_inc_host_failed() has
finished.
In case (a) scsi_eh_inc_host_failed() will wake up the error handler. And in
case (b) scsi_dec_host_busy() will wake up the error handler. So it's not
clear to me why you think that there is a scenario in which the EH won't be
woken up?
Bart.
The patch titled
Subject: fs/proc/kcore.c: use probe_kernel_read() instead of memcpy()
has been added to the -mm tree. Its filename is
fs-proc-kcorec-use-probe_kernel_read-instead-of-memcpy.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/fs-proc-kcorec-use-probe_kernel_re…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/fs-proc-kcorec-use-probe_kernel_re…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Heiko Carstens <heiko.carstens(a)de.ibm.com>
Subject: fs/proc/kcore.c: use probe_kernel_read() instead of memcpy()
df04abfd181a ("fs/proc/kcore.c: Add bounce buffer for ktext data") added a
bounce buffer to avoid hardened usercopy checks. Copying to the bounce
buffer was implemented with a simple memcpy() assuming that it is always
valid to read from kernel memory iff the kern_addr_valid() check passed.
A simple, but pointless, test case like "dd if=/proc/kcore of=/dev/null"
now can easily crash the kernel, since the former execption handling on
invalid kernel addresses now doesn't work anymore.
Also adding a kern_addr_valid() implementation wouldn't help here. Most
architectures simply return 1 here, while a couple implemented a page
table walk to figure out if something is mapped at the address in
question.
With DEBUG_PAGEALLOC active mappings are established and removed all the
time, so that relying on the result of kern_addr_valid() before executing
the memcpy() also doesn't work.
Therefore simply use probe_kernel_read() to copy to the bounce buffer.
This also allows to simplify read_kcore().
At least on s390 this fixes the observed crashes and doesn't introduce
warnings that were removed with df04abfd181a ("fs/proc/kcore.c: Add bounce
buffer for ktext data"), even though the generic probe_kernel_read()
implementation uses uaccess functions.
While looking into this I'm also wondering if kern_addr_valid() could be
completely removed...(?)
Link: http://lkml.kernel.org/r/20171202132739.99971-1-heiko.carstens@de.ibm.com
Fixes: df04abfd181a ("fs/proc/kcore.c: Add bounce buffer for ktext data")
Fixes: f5509cc18daa ("mm: Hardened usercopy")
Signed-off-by: Heiko Carstens <heiko.carstens(a)de.ibm.com>
Acked-by: Kees Cook <keescook(a)chromium.org>
Cc: Jiri Olsa <jolsa(a)kernel.org>
Cc: Al Viro <viro(a)ZenIV.linux.org.uk>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/proc/kcore.c | 18 +++++-------------
1 file changed, 5 insertions(+), 13 deletions(-)
diff -puN fs/proc/kcore.c~fs-proc-kcorec-use-probe_kernel_read-instead-of-memcpy fs/proc/kcore.c
--- a/fs/proc/kcore.c~fs-proc-kcorec-use-probe_kernel_read-instead-of-memcpy
+++ a/fs/proc/kcore.c
@@ -512,23 +512,15 @@ read_kcore(struct file *file, char __use
return -EFAULT;
} else {
if (kern_addr_valid(start)) {
- unsigned long n;
-
/*
* Using bounce buffer to bypass the
* hardened user copy kernel text checks.
*/
- memcpy(buf, (char *) start, tsz);
- n = copy_to_user(buffer, buf, tsz);
- /*
- * We cannot distinguish between fault on source
- * and fault on destination. When this happens
- * we clear too and hope it will trigger the
- * EFAULT again.
- */
- if (n) {
- if (clear_user(buffer + tsz - n,
- n))
+ if (probe_kernel_read(buf, (void *) start, tsz)) {
+ if (clear_user(buffer, tsz))
+ return -EFAULT;
+ } else {
+ if (copy_to_user(buffer, buf, tsz))
return -EFAULT;
}
} else {
_
Patches currently in -mm which might be from heiko.carstens(a)de.ibm.com are
fs-proc-kcorec-use-probe_kernel_read-instead-of-memcpy.patch