- Linux-stable-mirror - lists.linaro.org

[Linux-stable-mirror] v4.4.104 build: 0 failures 0 warnings (v4.4.104)

by Build bot for Mark Brown

Tree/Branch: v4.4.104 Git describe: v4.4.104 Commit: bd37993918 Linux 4.4.104 Build Time: 87 min 24 sec Passed: 9 / 9 (100.00 %) Failed: 0 / 9 ( 0.00 %) Errors: 0 Warnings: 0 Section Mismatches: 0 ------------------------------------------------------------------------------- defconfigs with issues (other than build errors): ------------------------------------------------------------------------------- =============================================================================== Detailed per-defconfig build reports below: ------------------------------------------------------------------------------- Passed with no errors, warnings or mismatches: arm64-allnoconfig arm64-allmodconfig arm-multi_v5_defconfig arm-multi_v7_defconfig x86_64-defconfig arm-allmodconfig arm-allnoconfig x86_64-allnoconfig arm64-defconfig close failed in file object destructor: sys.excepthook is missing lost sys.stderr

7 years, 6 months

1
0
0 0

[Linux-stable-mirror] [PATCH 1/2] drm/i915: Flush pending GTT writes before unbinding

by Chris Wilson

>From the shrinker paths, we want to relinquish the GPU and GGTT access to the object, releasing the backing storage back to the system for swapout. As a part of that process we would unpin the pages, marking them for access by the CPU (for the swapout/swapin). However, if that process was interrupted after unbind the vma, we missed a flush of the inflight GGTT writes before we made that GTT space available again for reuse, with the prospect that we would redirect them to another page. The bug dates back to the introduction of multiple GGTT vma, but the code itself dates to commit 02bef8f98d26 ("drm/i915: Unbind closed vma for i915_gem_object_unbind()"). Fixes: 02bef8f98d26 ("drm/i915: Unbind closed vma for i915_gem_object_unbind()") Fixes: c5ad54cf7dd8 ("drm/i915: Use partial view in mmap fault handler") Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk> Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> Cc: stable(a)vger.kernel.org Reviewed-by: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> --- drivers/gpu/drm/i915/i915_gem.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index e083f242b8dc..80b78fb5daac 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -330,17 +330,10 @@ int i915_gem_object_unbind(struct drm_i915_gem_object *obj) * must wait for all rendering to complete to the object (as unbinding * must anyway), and retire the requests. */ - ret = i915_gem_object_wait(obj, - I915_WAIT_INTERRUPTIBLE | - I915_WAIT_LOCKED | - I915_WAIT_ALL, - MAX_SCHEDULE_TIMEOUT, - NULL); + ret = i915_gem_object_set_to_cpu_domain(obj, false); if (ret) return ret; - i915_gem_retire_requests(to_i915(obj->base.dev)); - while ((vma = list_first_entry_or_null(&obj->vma_list, struct i915_vma, obj_link))) { -- 2.15.1

7 years, 6 months

1
0
0 0

[Linux-stable-mirror] [PATCH 1/2] drm/i915: Flush pending GTT writes before unbinding

by Chris Wilson

>From the shrinker paths, we want to relinquish the GPU and GGTT access to the object, releasing the backing storage back to the system for swapout. As a part of that process we would unpin the pages, marking them for access by the CPU (for the swapout/swapin). However, if that process was interrupted after unbind the vma, we missed a flush of the inflight GGTT writes before we made that GTT space available again for reuse, with the prospect that we would redirect them to another page. The bug dates back to the introduction of multiple GGTT vma, but the code itself dates to commit 02bef8f98d26 ("drm/i915: Unbind closed vma for i915_gem_object_unbind()"). Fixes: 02bef8f98d26 ("drm/i915: Unbind closed vma for i915_gem_object_unbind()") Fixes: c5ad54cf7dd8 ("drm/i915: Use partial view in mmap fault handler") Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk> Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> Cc: stable(a)vger.kernel.org Reviewed-by: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> --- drivers/gpu/drm/i915/i915_gem.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index e083f242b8dc..80b78fb5daac 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -330,17 +330,10 @@ int i915_gem_object_unbind(struct drm_i915_gem_object *obj) * must wait for all rendering to complete to the object (as unbinding * must anyway), and retire the requests. */ - ret = i915_gem_object_wait(obj, - I915_WAIT_INTERRUPTIBLE | - I915_WAIT_LOCKED | - I915_WAIT_ALL, - MAX_SCHEDULE_TIMEOUT, - NULL); + ret = i915_gem_object_set_to_cpu_domain(obj, false); if (ret) return ret; - i915_gem_retire_requests(to_i915(obj->base.dev)); - while ((vma = list_first_entry_or_null(&obj->vma_list, struct i915_vma, obj_link))) { -- 2.15.1

7 years, 6 months

1
0
0 0

[Linux-stable-mirror] [PATCH] drm: savely free connectors from connector_iter

by Daniel Vetter

In commit 613051dac40da1751ab269572766d3348d45a197 Author: Daniel Vetter <daniel.vetter(a)ffwll.ch> Date: Wed Dec 14 00:08:06 2016 +0100 drm: locking&new iterators for connector_list we've went to extreme lengths to make sure connector iterations works in any context, without introducing any additional locking context. This worked, except for a small fumble in the implementation: When we actually race with a concurrent connector unplug event, and our temporary connector reference turns out to be the final one, then everything breaks: We call the connector release function from whatever context we happen to be in, which can be an irq/atomic context. And connector freeing grabs all kinds of locks and stuff. Fix this by creating a specially safe put function for connetor_iter, which (in this rare case) punts the cleanup to a worker. Reported-by: Ben Widawsky <ben(a)bwidawsk.net> Cc: Ben Widawsky <ben(a)bwidawsk.net> Fixes: 613051dac40d ("drm: locking&new iterators for connector_list") Cc: Dave Airlie <airlied(a)gmail.com> Cc: Chris Wilson <chris(a)chris-wilson.co.uk> Cc: Sean Paul <seanpaul(a)chromium.org> Cc: <stable(a)vger.kernel.org> # v4.11+ Signed-off-by: Daniel Vetter <daniel.vetter(a)intel.com> --- drivers/gpu/drm/drm_connector.c | 28 ++++++++++++++++++++++++++-- drivers/gpu/drm/drm_mode_config.c | 2 ++ include/drm/drm_connector.h | 8 ++++++++ 3 files changed, 36 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c index 25f4b2e9a44f..482014137953 100644 --- a/drivers/gpu/drm/drm_connector.c +++ b/drivers/gpu/drm/drm_connector.c @@ -152,6 +152,16 @@ static void drm_connector_free(struct kref *kref) connector->funcs->destroy(connector); } +static void drm_connector_free_work_fn(struct work_struct *work) +{ + struct drm_connector *connector = + container_of(work, struct drm_connector, free_work); + struct drm_device *dev = connector->dev; + + drm_mode_object_unregister(dev, &connector->base); + connector->funcs->destroy(connector); +} + /** * drm_connector_init - Init a preallocated connector * @dev: DRM device @@ -181,6 +191,8 @@ int drm_connector_init(struct drm_device *dev, if (ret) return ret; + INIT_WORK(&connector->free_work, drm_connector_free_work_fn); + connector->base.properties = &connector->properties; connector->dev = dev; connector->funcs = funcs; @@ -529,6 +541,18 @@ void drm_connector_list_iter_begin(struct drm_device *dev, } EXPORT_SYMBOL(drm_connector_list_iter_begin); +/* + * Extra-safe connector put function that works in any context. Should only be + * used from the connector_iter functions, where we never really expect to + * actually release the connector when dropping our final reference. + */ +static void +drm_connector_put_safe(struct drm_connector *conn) +{ + if (refcount_dec_and_test(&conn->base.refcount.refcount)) + schedule_work(&conn->free_work); +} + /** * drm_connector_list_iter_next - return next connector * @iter: connectr_list iterator @@ -561,7 +585,7 @@ drm_connector_list_iter_next(struct drm_connector_list_iter *iter) spin_unlock_irqrestore(&config->connector_list_lock, flags); if (old_conn) - drm_connector_put(old_conn); + drm_connector_put_safe(old_conn); return iter->conn; } @@ -580,7 +604,7 @@ void drm_connector_list_iter_end(struct drm_connector_list_iter *iter) { iter->dev = NULL; if (iter->conn) - drm_connector_put(iter->conn); + drm_connector_put_safe(iter->conn); lock_release(&connector_list_iter_dep_map, 0, _RET_IP_); } EXPORT_SYMBOL(drm_connector_list_iter_end); diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c index 7623607c0f1e..346c19c6ce01 100644 --- a/drivers/gpu/drm/drm_mode_config.c +++ b/drivers/gpu/drm/drm_mode_config.c @@ -431,6 +431,8 @@ void drm_mode_config_cleanup(struct drm_device *dev) drm_connector_put(connector); } drm_connector_list_iter_end(&conn_iter); + /* connector_iter drops references in a work item. */ + flush_scheduled_work(); if (WARN_ON(!list_empty(&dev->mode_config.connector_list))) { drm_connector_list_iter_begin(dev, &conn_iter); drm_for_each_connector_iter(connector, &conn_iter) diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h index 66d6c99d15e5..c5c753a1be85 100644 --- a/include/drm/drm_connector.h +++ b/include/drm/drm_connector.h @@ -926,6 +926,14 @@ struct drm_connector { uint8_t num_h_tile, num_v_tile; uint8_t tile_h_loc, tile_v_loc; uint16_t tile_h_size, tile_v_size; + + /** + * @free_work: + * + * Work used only by &drm_connector_iter to be able to clean up a + * connector from any context. + */ + struct work_struct free_work; }; #define obj_to_connector(x) container_of(x, struct drm_connector, base) -- 2.15.0

7 years, 6 months

2
1
0 0

Re: [Linux-stable-mirror] Regression in e1000e since Kernel 4.14.3

by Gabriel C

On 04.12.2017 23:10, rwarsow(a)gmx.de wrote: > Hallo > > someone and I got an regression with e1000e since kernel 4.14.3 and it seems there is 4.14.4 on the way without a fix. > > > bug report is here: > > https://bugzilla.kernel.org/show_bug.cgi?id=198047 ( added stable and netdev to CC ) Yes I have a box with e1000e and it seems something at least breaks NM after 4.14.3. Interesting here , when using connman the connection is stable. Regards, Gabriel C

7 years, 6 months

2
7
0 0

[Linux-stable-mirror] [REGRESSION][v4.13.y][v4.14.y] scsi: libsas: allow async aborts

by Joseph Salisbury

Hi Christoph, A kernel bug report was opened against Ubuntu [0]. After a kernel bisect, it was found that reverting the following commit resolved this bug: 909657615d9b ("scsi: libsas: allow async aborts") The regression was introduced as of v4.12-rc1, and it still exists in 4.14 mainline. I was hoping to get your feedback, since you are the patch author. Do you think gathering any additional data will help diagnose this issue, or would it be best to submit a revert request? Thanks, Joe [0] http://pad.lv/1726519

7 years, 6 months

3
2
0 0

Re: [Linux-stable-mirror] [PATCH for-4.14.y 0/5] e1000e: Upstream fixes for linux-4.14.y

by Greg KH

On Tue, Dec 05, 2017 at 08:23:27AM +0100, Christian Hesse wrote: > Greg KH <gregkh(a)linuxfoundation.org> on Mon, 2017/12/04 19:37: > > On Mon, Dec 04, 2017 at 04:47:00PM +0100, Christian Hesse wrote: > > > Amit Pundir <amit.pundir(a)linaro.org> on Mon, 2017/11/27 18:23: > > > > Hi Greg, > > > > > > > > Found few e100e upstream fixes from Benjamin Poirier in lede > > > > source tree, https://git.lede-project.org/?p=source.git, and > > > > these fixes seem reasonable enough for 4.14.y too. > > > > > > > > Also submitting an e1000e buffer overrun fix by Sasha Neftin. > > > > > > > > Cherry-picked and build tested for linux v4.14.2 for ARCH=arm/arm64. > > > > > > > > Regards, > > > > Amit Pundir > > > > > > > > > > > > Benjamin Poirier (4): > > > > e1000e: Fix error path in link detection > > > > e1000e: Fix return value test > > > > e1000e: Separate signaling for link check/link up > > > > e1000e: Avoid receiver overrun interrupt bursts > > > > > > > > Sasha Neftin (1): > > > > e1000e: fix buffer overrun while the I219 is processing DMA > > > > transactions > > > > > > Hello everybody, > > > > > > looks like one of these breaks connectivity on my Thinkpad X250. > > > Just downgraded to linux 4.14.2 to verify. > > > > Can you try the -rc release I just did? It has a fix for this series in > > it. > > It connects with the notebook's built in ethernet port (did not check with > 4.14.3) but still fails to see a link when placed in docking station. Do you have the same issues with 4.15-rc2? thanks, greg k-h

7 years, 6 months

1
0
0 0

Re: [Linux-stable-mirror] [PATCH v2] sunxi-rsb: Include OF based modalias in device uevent

by Chen-Yu Tsai

Hi, On Tue, Nov 28, 2017 at 11:47 PM, Maxime Ripard <maxime.ripard(a)free-electrons.com> wrote: > On Mon, Nov 27, 2017 at 08:05:34PM +0100, Stefan Brüns wrote: >> Include the OF-based modalias in the uevent sent when registering devices >> on the sunxi RSB bus, so that user space has a chance to autoload the >> kernel module for the device. >> >> Fixes a regression caused by commit 3f241bfa60bd ("arm64: allwinner: a64: >> pine64: Use dcdc1 regulator for mmc0"). When the axp20x-rsb module for >> the AXP803 PMIC is built as a module, it is not loaded and the system >> ends up with an disfunctional MMC controller. >> Tags should be: Fixes: d787dcdb9c8f ("bus: sunxi-rsb: Add driver for Allwinner Reduced Serial Bus") Cc: stable <stable(a)vger.kernel.org> # 4.4.x 7a3b7cd332db of: device: Export of_device_{get_modalias, uvent_modalias} to modules >> Cc: stable <stable(a)vger.kernel.org> >> Signed-off-by: Stefan Brüns <stefan.bruens(a)rwth-aachen.de> > > Acked-by: Maxime Ripard <maxime.ripard(a)free-electrons.com> Acked-by: Chen-Yu Tsai <wens(a)csie.org> Maxime, could you merge this as a fix to get it in fast? ChenYu

7 years, 6 months

1
0
0 0

[Linux-stable-mirror] [PATCH 4.9 00/38] 4.9.67-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.9.67 release. There are 38 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed Dec 6 15:59:56 UTC 2017. Anything received after that time might be too late. The whole patch series can be found in one patch at: kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.67-rc1.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.9.67-rc1 Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Prevent zero length "index" write Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Don't try indexed reads to alternate slave addresses NeilBrown <neilb(a)suse.com> NFS: revalidate "." etc correctly on "open". Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "x86/entry/64: Add missing irqflags tracing to native_load_gs_index()" Rex Zhu <Rex.Zhu(a)amd.com> drm/amd/pp: fix typecast error in powerplay. Christian König <christian.koenig(a)amd.com> drm/ttm: once more fix ttm_buffer_object_transfer Peter Griffin <peter.griffin(a)linaro.org> drm/hisilicon: Ensure LDI regs are properly configured. Jonathan Liu <net147(a)gmail.com> drm/panel: simple: Add missing panel_simple_unprepare() calls Roman Kapl <rka(a)sysgo.com> drm/radeon: fix atombios on big endian Dan Carpenter <dan.carpenter(a)oracle.com> drm/amdgpu: Potential uninitialized variable in amdgpu_vm_update_directories() Dan Carpenter <dan.carpenter(a)oracle.com> drm/amdgpu: potential uninitialized variable in amdgpu_vce_ring_parse_cs() Alex Deucher <alexander.deucher(a)amd.com> Revert "drm/radeon: dont switch vt on suspend" Jeff Lien <jeff.lien(a)wdc.com> nvme-pci: add quirk for delay before CHK RDY for WDC SN200 Peter Rosin <peda(a)axentia.se> hwmon: (jc42) optionally try to disable the SMBUS timeout Huacai Chen <chenhc(a)lemote.com> bcache: Fix building error on MIPS Hans de Goede <hdegoede(a)redhat.com> i2c: i801: Fix Failed to allocate irq -2147483648 error Heiner Kallweit <hkallweit1(a)gmail.com> eeprom: at24: check at24_read/write arguments Bartosz Golaszewski <brgl(a)bgdev.pl> eeprom: at24: correctly set the size for at24mac402 Heiner Kallweit <hkallweit1(a)gmail.com> eeprom: at24: fix reading from 24MAC402/24MAC602 Bastian Stender <bst(a)pengutronix.de> mmc: core: prepend 0x to OCR entry in sysfs Adrian Hunter <adrian.hunter(a)intel.com> mmc: core: Do not leave the block driver in a suspended state Dr. David Alan Gilbert <dgilbert(a)redhat.com> KVM: lapic: Fixup LDR on load in x2apic Dr. David Alan Gilbert <dgilbert(a)redhat.com> KVM: lapic: Split out x2apic ldr calculation Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: inject exceptions produced by x86_decode_insn Liran Alon <liran.alon(a)oracle.com> KVM: x86: Exit to user-mode on #UD intercept when emulator requires Liran Alon <liran.alon(a)oracle.com> KVM: x86: pvclock: Handle first-time write to pvclock-page contains random junk Adam Ford <aford173(a)gmail.com> ARM: OMAP2+: Fix WL1283 Bluetooth Baud Rate Adam Ford <aford173(a)gmail.com> mfd: twl4030-power: Fix pmic for boards that need vmmc1 on reboot Naofumi Honda <honda(a)math.sci.hokudai.ac.jp> nfsd: fix panic in posix_unblock_lock called from nfs4_laundromat Trond Myklebust <trond.myklebust(a)primarydata.com> nfsd: Fix another OPEN stateid race Trond Myklebust <trond.myklebust(a)primarydata.com> nfsd: Fix stateid races between OPEN and CLOSE Josef Bacik <jbacik(a)fb.com> btrfs: clear space cache inode generation always chenjie <chenjie6(a)huawei.com> mm/madvise.c: fix madvise() infinite loop under special circumstances Dan Williams <dan.j.williams(a)intel.com> mm, hugetlbfs: introduce ->split() to vm_operations_struct Mike Kravetz <mike.kravetz(a)oracle.com> mm/cma: fix alloc_contig_range ret code/potential leak Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d() Adam Ford <aford173(a)gmail.com> ARM: dts: omap3: logicpd-torpedo-37xx-devkit: Fix MMC1 cd-gpio Adam Ford <aford173(a)gmail.com> ARM: dts: LogicPD Torpedo: Fix camera pin mux ------------- Diffstat: Documentation/devicetree/bindings/hwmon/jc42.txt | 4 + Makefile | 4 +- arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts | 8 +- arch/arm/mach-omap2/pdata-quirks.c | 2 +- arch/x86/entry/entry_64.S | 10 +-- arch/x86/kvm/lapic.c | 12 ++- arch/x86/kvm/svm.c | 2 + arch/x86/kvm/vmx.c | 2 + arch/x86/kvm/x86.c | 5 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 38 ++++----- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +- .../amd/powerplay/hwmgr/process_pptables_v1_0.c | 4 +- drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c | 3 + drivers/gpu/drm/i915/intel_i2c.c | 4 +- drivers/gpu/drm/panel/panel-simple.c | 2 + drivers/gpu/drm/radeon/atombios_dp.c | 38 ++++----- drivers/gpu/drm/radeon/radeon_fb.c | 1 - drivers/gpu/drm/ttm/ttm_bo_util.c | 1 + drivers/hwmon/jc42.c | 21 +++++ drivers/i2c/busses/i2c-i801.c | 3 + drivers/md/bcache/alloc.c | 2 +- drivers/md/bcache/extents.c | 2 +- drivers/md/bcache/journal.c | 2 +- drivers/mfd/twl4030-power.c | 1 + drivers/misc/eeprom/at24.c | 19 ++++- drivers/mmc/core/bus.c | 3 + drivers/mmc/core/mmc.c | 2 +- drivers/mmc/core/sd.c | 2 +- drivers/nvme/host/nvme.h | 2 +- drivers/nvme/host/pci.c | 2 + fs/btrfs/extent-tree.c | 14 +-- fs/nfs/dir.c | 3 +- fs/nfsd/nfs4state.c | 99 ++++++++++++++++------ include/linux/mm.h | 1 + include/uapi/linux/bcache.h | 2 +- mm/huge_memory.c | 19 ++--- mm/hugetlb.c | 8 ++ mm/madvise.c | 4 +- mm/mmap.c | 8 +- mm/page_alloc.c | 9 +- 41 files changed, 250 insertions(+), 122 deletions(-)

7 years, 6 months

5
33
0 0

[Linux-stable-mirror] [PATCH] skb_array: fix NULL-pointer exception

by George Cherian

While running a multiple VM testscase with each VM running iperf traffic between others the following kernel NULL pointer exception was seen. Race appears when the tun driver instance of one VM calls skb_array_produce (from tun_net_xmit) and the the destined VM's skb_array_consume (from tun_ring_recv), which could run concurrently on another core. Due to which the sock_wfree gets called again from the tun_ring_recv context. The fix is to add write/read barrier calls to be sure that we get proper values in the tun_ring_recv context. Crash log [35321.580227] Unable to handle kernel NULL pointer dereference at virtual address 00000060 [35321.596720] pgd = ffff809ee552f000 [35321.603723] [00000060] *pgd=0000009f514ac003, *pud=0000009f54f7c003, *pmd=0000000000000000 [35321.620588] Internal error: Oops: 96000006 1 SMP [35321.630461] Modules linked in: xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_4 [35321.728501] CPU: 114 PID: 5560 Comm: qemu-system-aar Not tainted 4.11.8-4k-vhe-lse+ #3 [35321.744510] Hardware name: Cavium Inc. Unknown/Unknown, BIOS 1.0 07/24/2017 [35321.758602] task: ffff80bed7fca880 task.stack: ffff80beb5128000 [35321.770600] PC is at sock_wfree+0x24/0x80 [35321.778746] LR is at skb_release_head_state+0x68/0xf8 [35321.788979] pc : [<ffff000008a772fc>] lr : [<ffff000008a79238>] pstate: 40400149 [35321.803930] sp : ffff80beb512bc30 [35321.810648] x29: ffff80beb512bc30 x28: ffff80bed7fca880 [35321.821400] x27: 000000000000004e x26: 0000000000000000 [35321.832156] x25: 000000000000000c x24: 0000000000000000 [35321.842947] x23: ffff809ece3e4900 x22: ffff80beb512be00 [35321.853729] x21: ffff000009138000 x20: 0000000000000144 [35321.864507] x19: 0000000000000000 x18: 0000000000000014 [35321.875276] x17: 0000ffff9d9689a0 x16: ffff00000828b3f8 [35321.886048] x15: 0000504d7b000000 x14: e90ab50c48680a08 [35321.896824] x13: 0101000017773f52 x12: 1080d422c00e5db6 [35321.907595] x11: 68c322bd3930cf7a x10: a8c0d07aa8c0ad16 [35321.918352] x9 : 000000001da4ed90 x8 : b50c48680a080101 [35321.929099] x7 : 000017770c521080 x6 : 000000001d6c13f2 [35321.939865] x5 : 000000001d6c13f2 x4 : 000000000000000e [35321.950619] x3 : 000000085ff97d82 x2 : 0000000000000000 [35321.961376] x1 : ffff000008a772d8 x0 : 0000000000000500 [35321.975193] Process qemu-system-aar (pid: 5560, stack limit = 0xffff80beb5128000) [35321.990347] Stack: (0xffff80beb512bc30 to 0xffff80beb512c000) [35322.001982] bc20: ffff80beb512bc50 ffff000008a79238 [35322.017817] bc40: ffff809e8fd7be00 000000000000004e ffff80beb512bc70 ffff000008a79488 [35322.033651] bc60: ffff809e8fd7be00 ffff00000881307c ffff80beb512bc90 ffff000008a79678 [35322.049489] bc80: ffff809e8fd7be00 ffff80beb512be00 ffff80beb512bcb0 ffff000008812f24 [35322.065321] bca0: ffff809e8fd7be00 000000000000004e ffff80beb512bd50 ffff0000088133f0 [35322.081165] bcc0: ffff809ece3e4900 0000000000011000 ffff80beb512bdd8 ffff80beb512be00 [35322.097001] bce0: 000000001d6c13a4 0000000000000015 0000000000000124 000000000000003f [35322.112866] bd00: ffff000008bc2000 ffff00000847b5ac 0000000000020000 ffff80be00080000 [35322.128701] bd20: 0022000000000001 ffff80bed7fc0010 ffff000008100c38 0000000000000000 [35322.144539] bd40: 0000000000000000 0000000000040b08 ffff80beb512bd80 ffff000008288f80 [35322.160395] bd60: ffff000009138000 ffff809ee7cd3500 0000000000011000 ffff80beb512beb0 [35322.176255] bd80: ffff80beb512be30 ffff00000828a224 0000000000011000 ffff809ee7cd3500 [35322.192109] bda0: 000000001d6c13a4 ffff80beb512beb0 0000000000011000 0000000000000000 [35322.207974] bdc0: 0000000000000000 000000001d6c13a4 0000000000011000 ffff809ee7cd3500 [35322.223822] bde0: 000000000000004e 0000000000000000 0000000000000000 0000000000000000 [35322.239661] be00: ffff80be00000000 000000000000004e 0000000000010fb2 ffff80beb512bdc8 [35322.255519] be20: 0000000000000001 0000000000040b08 ffff80beb512be70 ffff00000828b464 [35322.271392] be40: ffff000009138000 ffff809ee7cd3501 ffff809ee7cd3500 000000001d6c13a4 [35322.287255] be60: 0000000000011000 0000000000000015 0000000000000000 ffff0000080833f0 [35322.303090] be80: 0000000000000000 000080bef0071000 ffffffffffffffff 0000ffff9d9689cc [35322.318951] bea0: 0000000080000000 000080bef0071000 000000000000004e 0000000000040b08 [35322.334771] bec0: 000000000000000e 000000001d6c13a4 0000000000011000 0000ffff9cc89108 [35322.350640] bee0: 0000000000000002 0000ffff9cc89000 0000ffff9cc896f0 0000000000000000 [35322.366500] bf00: 000000000000003f 000000001da4ed90 a8c0d07aa8c0ad16 68c322bd3930cf7a [35322.382358] bf20: 1080d422c00e5db6 0101000017773f52 e90ab50c48680a08 0000504d7b000000 [35322.398209] bf40: 0000000000000000 0000ffff9d9689a0 0000000000000014 0000000000000030 [35322.414063] bf60: 000000001d6c13a4 000000001d6c0db0 000000001d6d1db0 00000000006fbbc8 [35322.429901] bf80: 0000000000011000 000000001d6ab3e8 000000001d6ab3a4 00000000007ee4c8 [35322.445751] bfa0: 0000000000000000 0000fffff363ab70 0000ffff9d9689b8 0000fffff363ab30 [35322.461588] bfc0: 0000ffff9d9689cc 0000000080000000 000000000000000e 000000000000003f [35322.477445] bfe0: 0000000000000000 0000000000000000 ffff809ed043d758 0000000000000000 [35322.493283] Call trace: [35322.498275] Exception stack(0xffff80beb512ba40 to 0xffff80beb512bb70) [35322.511303] ba40: 0000000000000000 0001000000000000 ffff80beb512bc30 ffff000008a772fc [35322.527152] ba60: 0000000040400149 0000000000000049 ffff000008bc2000 ffff80bed7fca880 [35322.542992] ba80: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [35322.558863] baa0: 0000000000000000 000000001d895758 ffff80beb512bb78 0000000000000000 [35322.574702] bac0: 000000050000000b 0000000800000001 0000000a00000001 0000000b00000001 [35322.590550] bae0: 0000000e00000001 0000001800010001 ffff80beb512bbf0 0000000000040b08 [35322.606416] bb00: 0000000000000500 ffff000008a772d8 0000000000000000 000000085ff97d82 [35322.622287] bb20: 000000000000000e 000000001d6c13f2 000000001d6c13f2 000017770c521080 [35322.638144] bb40: b50c48680a080101 000000001da4ed90 a8c0d07aa8c0ad16 68c322bd3930cf7a [35322.653992] bb60: 1080d422c00e5db6 0101000017773f52 [35322.663908] [<ffff000008a772fc>] sock_wfree+0x24/0x80 [35322.674168] [<ffff000008a79238>] skb_release_head_state+0x68/0xf8 [35322.686535] [<ffff000008a79488>] skb_release_all+0x20/0x40 [35322.697663] [<ffff000008a79678>] consume_skb+0x38/0xd8 [35322.708120] [<ffff000008812f24>] tun_do_read.part.9+0x20c/0x4f0 [35322.720149] [<ffff0000088133f0>] tun_chr_read_iter+0xc0/0xe0 [35322.731638] [<ffff000008288f80>] __vfs_read+0x100/0x160 [35322.742249] [<ffff00000828a224>] vfs_read+0x8c/0x148 [35322.752344] [<ffff00000828b464>] SyS_read+0x6c/0xd8 [35322.762263] [<ffff0000080833f0>] el0_svc_naked+0x24/0x28 [35322.773042] Code: d503201f f9400e93 b940e280 91051274 (f9403261) Reported-by: Joseph DeVincentis <Joseph.DeVincentis(a)cavium.com> Signed-off-by: George Cherian <george.cherian(a)cavium.com> Cc: stable(a)vger.kernel.org --- include/linux/skb_array.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/include/linux/skb_array.h b/include/linux/skb_array.h index 8621ffd..1b9c0f8 100644 --- a/include/linux/skb_array.h +++ b/include/linux/skb_array.h @@ -45,6 +45,13 @@ static inline bool skb_array_full(struct skb_array *a) static inline int skb_array_produce(struct skb_array *a, struct sk_buff *skb) { + /* + * This barrier is necessary in order to prevent race condition + * with skb_array_consume(). This issue was seen in VM testcases + * with multiple instances of iperf pumping traffic over tun + * interface. + */ + wmb(); return ptr_ring_produce(&a->ring, skb); } @@ -94,6 +101,8 @@ static inline bool skb_array_empty_any(struct skb_array *a) static inline struct sk_buff *skb_array_consume(struct skb_array *a) { + /* Refer to skb_array_produce() for details */ + rmb(); return ptr_ring_consume(&a->ring); } -- 2.1.4

7 years, 6 months

3
3
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror