From: Mike Rapoport <rppt(a)linux.ibm.com>
Subject: x86/setup: don't remove E820_TYPE_RAM for pfn 0
Patch series "mm: fix initialization of struct page for holes in memory layout", v3.
Commit 73a6e474cb37 ("mm: memmap_init: iterate over
memblock regions rather that check each PFN") exposed several issues with
the memory map initialization and these patches fix those issues.
Initially there were crashes during compaction that Qian Cai reported back
in April [1]. It seemed back then that the problem was fixed, but a few
weeks ago Andrea Arcangeli hit the same bug [2] and there was an additional
discussion at [3].
[1] https://lore.kernel.org/lkml/8C537EB7-85EE-4DCF-943E-3CC0ED0DF56D@lca.pw
[2] https://lore.kernel.org/lkml/20201121194506.13464-1-aarcange@redhat.com
[3] https://lore.kernel.org/mm-commits/20201206005401.qKuAVgOXr%akpm@linux-foun…
This patch (of 2):
The first 4Kb of memory is a BIOS owned area and to avoid its allocation
for the kernel it was not listed in e820 tables as memory. As the result,
pfn 0 was never recognised by the generic memory management and it is not
a part of neither node 0 nor ZONE_DMA.
If set_pfnblock_flags_mask() would be ever called for the pageblock
corresponding to the first 2Mbytes of memory, having pfn 0 outside of
ZONE_DMA would trigger
VM_BUG_ON_PAGE(!zone_spans_pfn(page_zone(page), pfn), page);
Along with reserving the first 4Kb in e820 tables, several first pages are
reserved with memblock in several places during setup_arch(). These
reservations are enough to ensure the kernel does not touch the BIOS area
and it is not necessary to remove E820_TYPE_RAM for pfn 0.
Remove the update of e820 table that changes the type of pfn 0 and move
the comment describing why it was done to trim_low_memory_range() that
reserves the beginning of the memory.
Link: https://lkml.kernel.org/r/20210111194017.22696-2-rppt@kernel.org
Signed-off-by: Mike Rapoport <rppt(a)linux.ibm.com>
Cc: Baoquan He <bhe(a)redhat.com>
Cc: Borislav Petkov <bp(a)alien8.de>
Cc: David Hildenbrand <david(a)redhat.com>
Cc: "H. Peter Anvin" <hpa(a)zytor.com>
Cc: Ingo Molnar <mingo(a)redhat.com>
Cc: Mel Gorman <mgorman(a)suse.de>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: Qian Cai <cai(a)lca.pw>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
arch/x86/kernel/setup.c | 20 +++++++++-----------
1 file changed, 9 insertions(+), 11 deletions(-)
--- a/arch/x86/kernel/setup.c~x86-setup-dont-remove-e820_type_ram-for-pfn-0
+++ a/arch/x86/kernel/setup.c
@@ -661,17 +661,6 @@ static void __init trim_platform_memory_
static void __init trim_bios_range(void)
{
/*
- * A special case is the first 4Kb of memory;
- * This is a BIOS owned area, not kernel ram, but generally
- * not listed as such in the E820 table.
- *
- * This typically reserves additional memory (64KiB by default)
- * since some BIOSes are known to corrupt low memory. See the
- * Kconfig help text for X86_RESERVE_LOW.
- */
- e820__range_update(0, PAGE_SIZE, E820_TYPE_RAM, E820_TYPE_RESERVED);
-
- /*
* special case: Some BIOSes report the PC BIOS
* area (640Kb -> 1Mb) as RAM even though it is not.
* take them out.
@@ -728,6 +717,15 @@ early_param("reservelow", parse_reservel
static void __init trim_low_memory_range(void)
{
+ /*
+ * A special case is the first 4Kb of memory;
+ * This is a BIOS owned area, not kernel ram, but generally
+ * not listed as such in the E820 table.
+ *
+ * This typically reserves additional memory (64KiB by default)
+ * since some BIOSes are known to corrupt low memory. See the
+ * Kconfig help text for X86_RESERVE_LOW.
+ */
memblock_reserve(0, ALIGN(reserve_low, PAGE_SIZE));
}
_
The patch titled
Subject: mm: thp: fix MADV_REMOVE deadlock on shmem THP
has been added to the -mm tree. Its filename is
mm-thp-fix-madv_remove-deadlock-on-shmem-thp.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mm-thp-fix-madv_remove-deadlock-o…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mm-thp-fix-madv_remove-deadlock-o…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Hugh Dickins <hughd(a)google.com>
Subject: mm: thp: fix MADV_REMOVE deadlock on shmem THP
Sergey reported deadlock between kswapd correctly doing its usual
lock_page(page) followed by down_read(page->mapping->i_mmap_rwsem), and
madvise(MADV_REMOVE) on an madvise(MADV_HUGEPAGE) area doing
down_write(page->mapping->i_mmap_rwsem) followed by lock_page(page).
This happened when shmem_fallocate(punch hole)'s unmap_mapping_range()
reaches zap_pmd_range()'s call to __split_huge_pmd(). The same deadlock
could occur when partially truncating a mapped huge tmpfs file, or using
fallocate(FALLOC_FL_PUNCH_HOLE) on it.
__split_huge_pmd()'s page lock was added in 5.8, to make sure that any
concurrent use of reuse_swap_page() (holding page lock) could not catch
the anon THP's mapcounts and swapcounts while they were being split.
Fortunately, reuse_swap_page() is never applied to a shmem or file THP
(not even by khugepaged, which checks PageSwapCache before calling), and
anonymous THPs are never created in shmem or file areas: so that
__split_huge_pmd()'s page lock can only be necessary for anonymous THPs,
on which there is no risk of deadlock with i_mmap_rwsem.
Link: https://lkml.kernel.org/r/alpine.LSU.2.11.2101161409470.2022@eggly.anvils
Fixes: c444eb564fb1 ("mm: thp: make the THP mapcount atomic against __split_huge_pmd_locked()")
Signed-off-by: Hugh Dickins <hughd(a)google.com>
Reported-by: Sergey Senozhatsky <sergey.senozhatsky.work(a)gmail.com>
Reviewed-by: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/huge_memory.c | 37 +++++++++++++++++++++++--------------
1 file changed, 23 insertions(+), 14 deletions(-)
--- a/mm/huge_memory.c~mm-thp-fix-madv_remove-deadlock-on-shmem-thp
+++ a/mm/huge_memory.c
@@ -2202,7 +2202,7 @@ void __split_huge_pmd(struct vm_area_str
{
spinlock_t *ptl;
struct mmu_notifier_range range;
- bool was_locked = false;
+ bool do_unlock_page = false;
pmd_t _pmd;
mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, vma, vma->vm_mm,
@@ -2218,7 +2218,6 @@ void __split_huge_pmd(struct vm_area_str
VM_BUG_ON(freeze && !page);
if (page) {
VM_WARN_ON_ONCE(!PageLocked(page));
- was_locked = true;
if (page != pmd_page(*pmd))
goto out;
}
@@ -2227,19 +2226,29 @@ repeat:
if (pmd_trans_huge(*pmd)) {
if (!page) {
page = pmd_page(*pmd);
- if (unlikely(!trylock_page(page))) {
- get_page(page);
- _pmd = *pmd;
- spin_unlock(ptl);
- lock_page(page);
- spin_lock(ptl);
- if (unlikely(!pmd_same(*pmd, _pmd))) {
- unlock_page(page);
+ /*
+ * An anonymous page must be locked, to ensure that a
+ * concurrent reuse_swap_page() sees stable mapcount;
+ * but reuse_swap_page() is not used on shmem or file,
+ * and page lock must not be taken when zap_pmd_range()
+ * calls __split_huge_pmd() while i_mmap_lock is held.
+ */
+ if (PageAnon(page)) {
+ if (unlikely(!trylock_page(page))) {
+ get_page(page);
+ _pmd = *pmd;
+ spin_unlock(ptl);
+ lock_page(page);
+ spin_lock(ptl);
+ if (unlikely(!pmd_same(*pmd, _pmd))) {
+ unlock_page(page);
+ put_page(page);
+ page = NULL;
+ goto repeat;
+ }
put_page(page);
- page = NULL;
- goto repeat;
}
- put_page(page);
+ do_unlock_page = true;
}
}
if (PageMlocked(page))
@@ -2249,7 +2258,7 @@ repeat:
__split_huge_pmd_locked(vma, pmd, range.start, freeze);
out:
spin_unlock(ptl);
- if (!was_locked && page)
+ if (do_unlock_page)
unlock_page(page);
/*
* No need to double call mmu_notifier->invalidate_range() callback.
_
Patches currently in -mm which might be from hughd(a)google.com are
mm-thp-fix-madv_remove-deadlock-on-shmem-thp.patch
The patch titled
Subject: Revert "mm: memcontrol: avoid workload stalls when lowering memory.high"
has been added to the -mm tree. Its filename is
revert-mm-memcontrol-avoid-workload-stalls-when-lowering-memoryhigh.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/revert-mm-memcontrol-avoid-worklo…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/revert-mm-memcontrol-avoid-worklo…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Johannes Weiner <hannes(a)cmpxchg.org>
Subject: Revert "mm: memcontrol: avoid workload stalls when lowering memory.high"
This reverts commit 536d3bf261a2fc3b05b3e91e7eef7383443015cf, as it can
cause writers to memory.high to get stuck in the kernel forever,
performing page reclaim and consuming excessive amounts of CPU cycles.
Before the patch, a write to memory.high would first put the new limit in
place for the workload, and then reclaim the requested delta. After the
patch, the kernel tries to reclaim the delta before putting the new limit
into place, in order to not overwhelm the workload with a sudden, large
excess over the limit. However, if reclaim is actively racing with new
allocations from the uncurbed workload, it can keep the write() working
inside the kernel indefinitely.
This is causing problems in Facebook production. A privileged
system-level daemon that adjusts memory.high for various workloads running
on a host can get unexpectedly stuck in the kernel and essentially turn
into a sort of involuntary kswapd for one of the workloads. We've
observed that daemon busy-spin in a write() for minutes at a time,
neglecting its other duties on the system, and expending privileged system
resources on behalf of a workload.
To remedy this, we have first considered changing the reclaim logic to
break out after a couple of loops - whether the workload has converged to
the new limit or not - and bound the write() call this way. However, the
root cause that inspired the sequence change in the first place has been
fixed through other means, and so a revert back to the proven
limit-setting sequence, also used by memory.max, is preferable.
The sequence was changed to avoid extreme latencies in the workload when
the limit was lowered: the sudden, large excess created by the limit
lowering would erroneously trigger the penalty sleeping code that is meant
to throttle excessive growth from below. Allocating threads could end up
sleeping long after the write() had already reclaimed the delta for which
they were being punished.
However, erroneous throttling also caused problems in other scenarios at
around the same time. This resulted in commit b3ff92916af3 ("mm, memcg:
reclaim more aggressively before high allocator throttling"), included in
the same release as the offending commit. When allocating threads now
encounter large excess caused by a racing write() to memory.high, instead
of entering punitive sleeps, they will simply be tasked with helping
reclaim down the excess, and will be held no longer than it takes to
accomplish that. This is in line with regular limit enforcement - i.e.
if the workload allocates up against or over an otherwise unchanged limit
from below.
With the patch breaking userspace, and the root cause addressed by other
means already, revert it again.
Link: https://lkml.kernel.org/r/20210122184341.292461-1-hannes@cmpxchg.org
Fixes: 536d3bf261a2 ("mm: memcontrol: avoid workload stalls when lowering memory.high")
Signed-off-by: Johannes Weiner <hannes(a)cmpxchg.org>
Reported-by: Tejun Heo <tj(a)kernel.org>
Cc: Roman Gushchin <guro(a)fb.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: Michal Koutný <mkoutny(a)suse.com>
Cc: <stable(a)vger.kernel.org> [5.8+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/mm/memcontrol.c~revert-mm-memcontrol-avoid-workload-stalls-when-lowering-memoryhigh
+++ a/mm/memcontrol.c
@@ -6271,6 +6271,8 @@ static ssize_t memory_high_write(struct
if (err)
return err;
+ page_counter_set_high(&memcg->memory, high);
+
for (;;) {
unsigned long nr_pages = page_counter_read(&memcg->memory);
@@ -6293,10 +6295,7 @@ static ssize_t memory_high_write(struct
break;
}
- page_counter_set_high(&memcg->memory, high);
-
memcg_wb_domain_size_changed(memcg);
-
return nbytes;
}
_
Patches currently in -mm which might be from hannes(a)cmpxchg.org are
mm-memcontrol-prevent-starvation-when-writing-memoryhigh.patch
revert-mm-memcontrol-avoid-workload-stalls-when-lowering-memoryhigh.patch
The patch titled
Subject: mm/vmalloc: separate put pages and flush VM flags
has been added to the -mm tree. Its filename is
mm-vmalloc-separate-put-pages-and-flush-vm-flags.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mm-vmalloc-separate-put-pages-and…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mm-vmalloc-separate-put-pages-and…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Rick Edgecombe <rick.p.edgecombe(a)intel.com>
Subject: mm/vmalloc: separate put pages and flush VM flags
When VM_MAP_PUT_PAGES was added, it was defined with the same value as
VM_FLUSH_RESET_PERMS. This doesn't seem like it will cause any big
functional problems other than some excess flushing for VM_MAP_PUT_PAGES
allocations.
Redefine VM_MAP_PUT_PAGES to have its own value. Also, rearrange things
so flags are less likely to be missed in the future.
Link: https://lkml.kernel.org/r/20210122233706.9304-1-rick.p.edgecombe@intel.com
Fixes: b944afc9d64d ("mm: add a VM_MAP_PUT_PAGES flag for vmap")
Signed-off-by: Rick Edgecombe <rick.p.edgecombe(a)intel.com>
Suggested-by: Matthew Wilcox <willy(a)infradead.org>
Cc: Miaohe Lin <linmiaohe(a)huawei.com>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: Daniel Axtens <dja(a)axtens.net>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/vmalloc.h | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
--- a/include/linux/vmalloc.h~mm-vmalloc-separate-put-pages-and-flush-vm-flags
+++ a/include/linux/vmalloc.h
@@ -24,7 +24,8 @@ struct notifier_block; /* in notifier.h
#define VM_UNINITIALIZED 0x00000020 /* vm_struct is not fully initialized */
#define VM_NO_GUARD 0x00000040 /* don't add guard page */
#define VM_KASAN 0x00000080 /* has allocated kasan shadow memory */
-#define VM_MAP_PUT_PAGES 0x00000100 /* put pages and free array in vfree */
+#define VM_FLUSH_RESET_PERMS 0x00000100 /* reset direct map and flush TLB on unmap, can't be freed in atomic context */
+#define VM_MAP_PUT_PAGES 0x00000200 /* put pages and free array in vfree */
/*
* VM_KASAN is used slighly differently depending on CONFIG_KASAN_VMALLOC.
@@ -37,12 +38,6 @@ struct notifier_block; /* in notifier.h
* determine which allocations need the module shadow freed.
*/
-/*
- * Memory with VM_FLUSH_RESET_PERMS cannot be freed in an interrupt or with
- * vfree_atomic().
- */
-#define VM_FLUSH_RESET_PERMS 0x00000100 /* Reset direct map and flush TLB on unmap */
-
/* bits [20..32] reserved for arch specific ioremap internals */
/*
_
Patches currently in -mm which might be from rick.p.edgecombe(a)intel.com are
mm-vmalloc-separate-put-pages-and-flush-vm-flags.patch
The patch titled
Subject: mm/vmalloc: reparate put pages and flush VM flags
has been removed from the -mm tree. Its filename was
mm-vmalloc-separate-put-pages-and-flush-vm-flags.patch
This patch was dropped because an updated version will be merged
------------------------------------------------------
From: Rick Edgecombe <rick.p.edgecombe(a)intel.com>
Subject: mm/vmalloc: reparate put pages and flush VM flags
When VM_MAP_PUT_PAGES was added, it was defined with the same value as
VM_FLUSH_RESET_PERMS. This doesn't seem like it will cause any big
functional problems other than some excess flushing for VM_MAP_PUT_PAGES
allocations.
Redefine VM_MAP_PUT_PAGES to have its own value. Also, move the comment
and remove whitespace for VM_KASAN such that the flags lower down are less
likely to be missed in the future.
Link: https://lkml.kernel.org/r/20210121014118.31922-1-rick.p.edgecombe@intel.com
Fixes: b944afc9d64d ("mm: add a VM_MAP_PUT_PAGES flag for vmap")
Signed-off-by: Rick Edgecombe <rick.p.edgecombe(a)intel.com>
Reviewed-by: Miaohe Lin <linmiaohe(a)huawei.com>
Reviewed-by: Christoph Hellwig <hch(a)lst.de>
Cc: Daniel Axtens <dja(a)axtens.net>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/vmalloc.h | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/include/linux/vmalloc.h~mm-vmalloc-separate-put-pages-and-flush-vm-flags
+++ a/include/linux/vmalloc.h
@@ -23,9 +23,6 @@ struct notifier_block; /* in notifier.h
#define VM_DMA_COHERENT 0x00000010 /* dma_alloc_coherent */
#define VM_UNINITIALIZED 0x00000020 /* vm_struct is not fully initialized */
#define VM_NO_GUARD 0x00000040 /* don't add guard page */
-#define VM_KASAN 0x00000080 /* has allocated kasan shadow memory */
-#define VM_MAP_PUT_PAGES 0x00000100 /* put pages and free array in vfree */
-
/*
* VM_KASAN is used slighly differently depending on CONFIG_KASAN_VMALLOC.
*
@@ -36,12 +33,13 @@ struct notifier_block; /* in notifier.h
* Otherwise, VM_KASAN is set for kasan_module_alloc() allocations and used to
* determine which allocations need the module shadow freed.
*/
-
+#define VM_KASAN 0x00000080 /* has allocated kasan shadow memory */
/*
* Memory with VM_FLUSH_RESET_PERMS cannot be freed in an interrupt or with
* vfree_atomic().
*/
#define VM_FLUSH_RESET_PERMS 0x00000100 /* Reset direct map and flush TLB on unmap */
+#define VM_MAP_PUT_PAGES 0x00000200 /* put pages and free array in vfree */
/* bits [20..32] reserved for arch specific ioremap internals */
_
Patches currently in -mm which might be from rick.p.edgecombe(a)intel.com are
I'm announcing the release of the 4.19.170 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 2
drivers/md/dm-bufio.c | 6 ++
drivers/md/dm-integrity.c | 50 +++++++++++++++++--
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2
drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c | 7 --
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 -
drivers/net/usb/rndis_host.c | 2
drivers/spi/spi-cadence.c | 6 +-
drivers/usb/host/ohci-hcd.c | 2
fs/nfsd/nfs3xdr.c | 7 ++
include/linux/compiler-gcc.h | 6 ++
include/linux/dm-bufio.h | 1
include/linux/skbuff.h | 5 +
net/core/skbuff.c | 9 ++-
net/core/sock_reuseport.c | 2
net/dcb/dcbnl.c | 2
net/ipv4/esp4.c | 7 --
net/ipv6/esp6.c | 7 --
net/ipv6/ip6_output.c | 40 ++++++++++++++-
net/ipv6/sit.c | 5 +
net/rxrpc/input.c | 2
net/rxrpc/key.c | 6 +-
net/tipc/link.c | 9 ++-
24 files changed, 147 insertions(+), 43 deletions(-)
Andrey Zhizhikin (1):
rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
Arnd Bergmann (1):
crypto: x86/crc32c - fix building with clang ias
Aya Levin (1):
net: ipv6: Validate GSO SKB before finish IPv6 processing
Baptiste Lepers (2):
udp: Prevent reuseport_select_sock from reading uninitialized socks
rxrpc: Call state should be read with READ_ONCE() under some circumstances
David Howells (1):
rxrpc: Fix handling of an unsupported token type in rxrpc_read()
David Wu (1):
net: stmmac: Fixed mtu channged by cache aligned
Eric Dumazet (1):
net: avoid 32 x truesize under-estimation for tiny skbs
Greg Kroah-Hartman (1):
Linux 4.19.170
Hamish Martin (1):
usb: ohci: Make distrust_firmware param default to false
Hoang Le (1):
tipc: fix NULL deref in tipc_link_xmit()
J. Bruce Fields (1):
nfsd4: readdirplus shouldn't return parent of export
Jakub Kicinski (1):
net: sit: unregister_netdevice on newlink's error path
Jason A. Donenfeld (2):
net: introduce skb_list_walk_safe for skb segment walking
net: skbuff: disambiguate argument and member for skb_list_walk_safe helper
Manish Chopra (1):
netxen_nic: fix MSI/MSI-x interrupts
Michael Hennerich (1):
spi: cadence: cache reference clock rate during probe
Mikulas Patocka (1):
dm integrity: fix flush with external metadata device
Petr Machata (2):
net: dcb: Validate netlink message in DCB handler
net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
Stefan Chulski (1):
net: mvpp2: Remove Pause and Asym_Pause support
Will Deacon (1):
compiler.h: Raise minimum version of GCC to 5.1 for arm64
Willem de Bruijn (1):
esp: avoid unneeded kmap_atomic call
This is the start of the stable review cycle for the 5.10.10 release.
There are 43 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 24 Jan 2021 13:57:23 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.10-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.10-rc1
Michael Hennerich <michael.hennerich(a)analog.com>
spi: cadence: cache reference clock rate during probe
Christophe Leroy <christophe.leroy(a)csgroup.eu>
spi: fsl: Fix driver breakage when SPI_CS_HIGH is not set in spi->mode
Ayush Sawal <ayush.sawal(a)chelsio.com>
cxgb4/chtls: Fix tid stuck due to wrong update of qid
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: dsa: unbind all switches from tree when DSA master unbinds
Lorenzo Bianconi <lorenzo(a)kernel.org>
mac80211: check if atf has been disabled in __ieee80211_schedule_txq
Felix Fietkau <nbd(a)nbd.name>
mac80211: do not drop tx nulldata packets on encrypted links
Antonio Borneo <antonio.borneo(a)st.com>
drm/panel: otm8009a: allow using non-continuous dsi clock
Qinglang Miao <miaoqinglang(a)huawei.com>
can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check
Seb Laveze <sebastien.laveze(a)nxp.com>
net: stmmac: use __napi_schedule() for PREEMPT_RT
David Howells <dhowells(a)redhat.com>
rxrpc: Fix handling of an unsupported token type in rxrpc_read()
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: dsa: clear devlink port type before unregistering slave netdevs
Marco Felsch <m.felsch(a)pengutronix.de>
net: phy: smsc: fix clk error handling
Geert Uytterhoeven <geert+renesas(a)glider.be>
dt-bindings: net: renesas,etheravb: RZ/G2H needs tx-internal-delay-ps
Eric Dumazet <edumazet(a)google.com>
net: avoid 32 x truesize under-estimation for tiny skbs
Yannick Vignon <yannick.vignon(a)nxp.com>
net: stmmac: fix taprio configuration when base_time is in the past
Yannick Vignon <yannick.vignon(a)nxp.com>
net: stmmac: fix taprio schedule configuration
Jakub Kicinski <kuba(a)kernel.org>
net: sit: unregister_netdevice on newlink's error path
David Wu <david.wu(a)rock-chips.com>
net: stmmac: Fixed mtu channged by cache aligned
Cristian Dumitrescu <cristian.dumitrescu(a)intel.com>
i40e: fix potential NULL pointer dereferencing
Baptiste Lepers <baptiste.lepers(a)gmail.com>
rxrpc: Call state should be read with READ_ONCE() under some circumstances
Petr Machata <petrm(a)nvidia.com>
net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
Petr Machata <me(a)pmachata.org>
net: dcb: Validate netlink message in DCB handler
Willem de Bruijn <willemb(a)google.com>
esp: avoid unneeded kmap_atomic call
Andrey Zhizhikin <andrey.zhizhikin(a)leica-geosystems.com>
rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
Stefan Chulski <stefanc(a)marvell.com>
net: mvpp2: Remove Pause and Asym_Pause support
Vadim Pasternak <vadimp(a)nvidia.com>
mlxsw: core: Increase critical threshold for ASIC thermal zone
Vadim Pasternak <vadimp(a)nvidia.com>
mlxsw: core: Add validation of transceiver temperature thresholds
Hoang Le <hoang.h.le(a)dektech.com.au>
tipc: fix NULL deref in tipc_link_xmit()
Aya Levin <ayal(a)nvidia.com>
net: ipv6: Validate GSO SKB before finish IPv6 processing
Manish Chopra <manishc(a)marvell.com>
netxen_nic: fix MSI/MSI-x interrupts
Baptiste Lepers <baptiste.lepers(a)gmail.com>
udp: Prevent reuseport_select_sock from reading uninitialized socks
Dongseok Yi <dseok.yi(a)samsung.com>
net: fix use-after-free when UDP GRO with shared fraglist
Stephan Gerhold <stephan(a)gerhold.net>
net: ipa: modem: add missing SET_NETDEV_DEV() for proper sysfs links
Mircea Cirjaliu <mcirjaliu(a)bitdefender.com>
bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback
Gilad Reti <gilad.reti(a)gmail.com>
bpf: Support PTR_TO_MEM{,_OR_NULL} register spilling
Stanislav Fomichev <sdf(a)google.com>
bpf: Don't leak memory in bpf getsockopt when optlen == 0
J. Bruce Fields <bfields(a)redhat.com>
nfsd4: readdirplus shouldn't return parent of export
Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com>
X.509: Fix crash caused by NULL pointer
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Fix signed_{sub,add32}_overflows type handling
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu/display: drop DCN support for aarch64
Dexuan Cui <decui(a)microsoft.com>
x86/hyperv: Initialize clockevents after LAPIC is initialized
Andrei Matei <andreimatei1(a)gmail.com>
bpf: Fix selftest compilation on clang 11
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "kconfig: remove 'kvmconfig' and 'xenconfig' shorthands"
-------------
Diffstat:
.../devicetree/bindings/net/renesas,etheravb.yaml | 1 +
Makefile | 4 +-
arch/x86/hyperv/hv_init.c | 29 +++++++-
crypto/asymmetric_keys/public_key.c | 3 +-
drivers/gpu/drm/amd/display/Kconfig | 2 +-
drivers/gpu/drm/amd/display/dc/calcs/Makefile | 7 --
drivers/gpu/drm/amd/display/dc/clk_mgr/Makefile | 7 --
drivers/gpu/drm/amd/display/dc/dcn10/Makefile | 7 --
.../gpu/drm/amd/display/dc/dcn10/dcn10_resource.c | 81 +++++++++-------------
drivers/gpu/drm/amd/display/dc/dcn20/Makefile | 4 --
drivers/gpu/drm/amd/display/dc/dcn21/Makefile | 4 --
drivers/gpu/drm/amd/display/dc/dml/Makefile | 13 ----
drivers/gpu/drm/amd/display/dc/dsc/Makefile | 5 --
drivers/gpu/drm/amd/display/dc/os_types.h | 4 --
drivers/gpu/drm/panel/panel-orisetech-otm8009a.c | 2 +-
drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +-
drivers/net/ethernet/chelsio/cxgb4/t4_tcb.h | 7 ++
.../ethernet/chelsio/inline_crypto/chtls/chtls.h | 4 ++
.../chelsio/inline_crypto/chtls/chtls_cm.c | 32 ++++++++-
.../chelsio/inline_crypto/chtls/chtls_hw.c | 41 +++++++++++
drivers/net/ethernet/intel/i40e/i40e_xsk.c | 2 +-
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 -
drivers/net/ethernet/mellanox/mlxsw/core_thermal.c | 13 ++--
.../net/ethernet/qlogic/netxen/netxen_nic_main.c | 7 +-
drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 52 ++------------
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 7 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 20 +++++-
drivers/net/ipa/ipa_modem.c | 1 +
drivers/net/phy/smsc.c | 3 +-
drivers/net/usb/rndis_host.c | 2 +-
drivers/spi/spi-cadence.c | 6 +-
drivers/spi/spi-fsl-spi.c | 5 +-
fs/nfsd/nfs3xdr.c | 7 +-
kernel/bpf/cgroup.c | 5 +-
kernel/bpf/helpers.c | 2 +-
kernel/bpf/verifier.c | 8 ++-
net/core/skbuff.c | 29 +++++++-
net/core/sock_reuseport.c | 2 +-
net/dcb/dcbnl.c | 2 +
net/dsa/dsa2.c | 4 ++
net/dsa/master.c | 10 +++
net/ipv4/esp4.c | 7 +-
net/ipv6/esp6.c | 7 +-
net/ipv6/ip6_output.c | 41 ++++++++++-
net/ipv6/sit.c | 5 +-
net/mac80211/tx.c | 4 +-
net/rxrpc/input.c | 2 +-
net/rxrpc/key.c | 6 +-
net/tipc/link.c | 9 ++-
scripts/kconfig/Makefile | 10 +++
tools/testing/selftests/bpf/progs/profiler.inc.h | 2 +
51 files changed, 323 insertions(+), 218 deletions(-)
This is the start of the stable review cycle for the 5.4.92 release.
There are 33 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 24 Jan 2021 13:57:23 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.92-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.92-rc1
Michael Hennerich <michael.hennerich(a)analog.com>
spi: cadence: cache reference clock rate during probe
Lorenzo Bianconi <lorenzo(a)kernel.org>
mac80211: check if atf has been disabled in __ieee80211_schedule_txq
Felix Fietkau <nbd(a)nbd.name>
mac80211: do not drop tx nulldata packets on encrypted links
Hoang Le <hoang.h.le(a)dektech.com.au>
tipc: fix NULL deref in tipc_link_xmit()
Daniel Borkmann <daniel(a)iogearbox.net>
net, sctp, filter: remap copy_from_user failure error
David Howells <dhowells(a)redhat.com>
rxrpc: Fix handling of an unsupported token type in rxrpc_read()
Eric Dumazet <edumazet(a)google.com>
net: avoid 32 x truesize under-estimation for tiny skbs
Jakub Kicinski <kuba(a)kernel.org>
net: sit: unregister_netdevice on newlink's error path
David Wu <david.wu(a)rock-chips.com>
net: stmmac: Fixed mtu channged by cache aligned
Baptiste Lepers <baptiste.lepers(a)gmail.com>
rxrpc: Call state should be read with READ_ONCE() under some circumstances
Petr Machata <petrm(a)nvidia.com>
net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
Petr Machata <me(a)pmachata.org>
net: dcb: Validate netlink message in DCB handler
Willem de Bruijn <willemb(a)google.com>
esp: avoid unneeded kmap_atomic call
Andrey Zhizhikin <andrey.zhizhikin(a)leica-geosystems.com>
rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
Stefan Chulski <stefanc(a)marvell.com>
net: mvpp2: Remove Pause and Asym_Pause support
Vadim Pasternak <vadimp(a)nvidia.com>
mlxsw: core: Increase critical threshold for ASIC thermal zone
Vadim Pasternak <vadimp(a)nvidia.com>
mlxsw: core: Add validation of transceiver temperature thresholds
Aya Levin <ayal(a)nvidia.com>
net: ipv6: Validate GSO SKB before finish IPv6 processing
Jason A. Donenfeld <Jason(a)zx2c4.com>
net: skbuff: disambiguate argument and member for skb_list_walk_safe helper
Jason A. Donenfeld <Jason(a)zx2c4.com>
net: introduce skb_list_walk_safe for skb segment walking
Manish Chopra <manishc(a)marvell.com>
netxen_nic: fix MSI/MSI-x interrupts
Baptiste Lepers <baptiste.lepers(a)gmail.com>
udp: Prevent reuseport_select_sock from reading uninitialized socks
Mircea Cirjaliu <mcirjaliu(a)bitdefender.com>
bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback
Stanislav Fomichev <sdf(a)google.com>
bpf: Don't leak memory in bpf getsockopt when optlen == 0
J. Bruce Fields <bfields(a)redhat.com>
nfsd4: readdirplus shouldn't return parent of export
Lukas Wunner <lukas(a)wunner.de>
spi: npcm-fiu: Disable clock in probe error path
Qinglang Miao <miaoqinglang(a)huawei.com>
spi: npcm-fiu: simplify the return expression of npcm_fiu_probe()
YueHaibing <yuehaibing(a)huawei.com>
scsi: lpfc: Make lpfc_defer_acc_rsp static
zhengbin <zhengbin13(a)huawei.com>
scsi: lpfc: Make function lpfc_defer_pt2pt_acc static
Arnd Bergmann <arnd(a)arndb.de>
elfcore: fix building with clang
Roger Pau Monne <roger.pau(a)citrix.com>
xen/privcmd: allow fetching resource sizes
Will Deacon <will(a)kernel.org>
compiler.h: Raise minimum version of GCC to 5.1 for arm64
Hamish Martin <hamish.martin(a)alliedtelesis.co.nz>
usb: ohci: Make distrust_firmware param default to false
-------------
Diffstat:
Makefile | 4 +--
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 --
drivers/net/ethernet/mellanox/mlxsw/core_thermal.c | 13 ++++---
.../net/ethernet/qlogic/netxen/netxen_nic_main.c | 7 +---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +-
drivers/net/usb/rndis_host.c | 2 +-
drivers/scsi/lpfc/lpfc_nportdisc.c | 4 +--
drivers/spi/spi-cadence.c | 6 ++--
drivers/spi/spi-npcm-fiu.c | 7 ++--
drivers/usb/host/ohci-hcd.c | 2 +-
drivers/xen/privcmd.c | 25 +++++++++----
fs/nfsd/nfs3xdr.c | 7 +++-
include/linux/compiler-gcc.h | 6 ++++
include/linux/elfcore.h | 22 ++++++++++++
include/linux/skbuff.h | 5 +++
kernel/Makefile | 1 -
kernel/bpf/cgroup.c | 5 +--
kernel/bpf/helpers.c | 2 +-
kernel/elfcore.c | 26 --------------
net/core/filter.c | 2 +-
net/core/skbuff.c | 9 +++--
net/core/sock_reuseport.c | 2 +-
net/dcb/dcbnl.c | 2 ++
net/ipv4/esp4.c | 7 +---
net/ipv6/esp6.c | 7 +---
net/ipv6/ip6_output.c | 41 +++++++++++++++++++++-
net/ipv6/sit.c | 5 ++-
net/mac80211/tx.c | 4 +--
net/rxrpc/input.c | 2 +-
net/rxrpc/key.c | 6 ++--
net/sctp/socket.c | 2 +-
net/tipc/link.c | 9 +++--
32 files changed, 158 insertions(+), 89 deletions(-)
This is the start of the stable review cycle for the 4.4.253 release.
There are 29 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 24 Jan 2021 16:08:14 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.253-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.253-rc2
Michael Hennerich <michael.hennerich(a)analog.com>
spi: cadence: cache reference clock rate during probe
Eric Dumazet <edumazet(a)google.com>
net: avoid 32 x truesize under-estimation for tiny skbs
David Howells <dhowells(a)redhat.com>
rxrpc: Fix handling of an unsupported token type in rxrpc_read()
Jakub Kicinski <kuba(a)kernel.org>
net: sit: unregister_netdevice on newlink's error path
Petr Machata <petrm(a)nvidia.com>
net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
Petr Machata <me(a)pmachata.org>
net: dcb: Validate netlink message in DCB handler
Andrey Zhizhikin <andrey.zhizhikin(a)leica-geosystems.com>
rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
Manish Chopra <manishc(a)marvell.com>
netxen_nic: fix MSI/MSI-x interrupts
Jouni K. Seppänen <jks(a)iki.fi>
net: cdc_ncm: correct overhead in delayed_ndp_size
J. Bruce Fields <bfields(a)redhat.com>
nfsd4: readdirplus shouldn't return parent of export
Nuno Sá <nuno.sa(a)analog.com>
iio: buffer: Fix demux update
Hamish Martin <hamish.martin(a)alliedtelesis.co.nz>
usb: ohci: Make distrust_firmware param default to false
j.nixdorf(a)avm.de <j.nixdorf(a)avm.de>
net: sunrpc: interpret the return value of kstrtou32 correctly
Jann Horn <jannh(a)google.com>
mm, slub: consider rest of partial list if acquire_slab() fails
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp
Jan Kara <jack(a)suse.cz>
ext4: fix superblock checksum failure when setting password salt
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: nfs_igrab_and_active must first reference the superblock
Al Viro <viro(a)zeniv.linux.org.uk>
dump_common_audit_data(): fix racy accesses to ->d_name
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: uinput - avoid FF flush when destroying device
Arnd Bergmann <arnd(a)arndb.de>
ARM: picoxcell: fix missing interrupt-parent properties
Shawn Guo <shawn.guo(a)linaro.org>
ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI
Michael Ellerman <mpe(a)ellerman.id.au>
net: ethernet: fs_enet: Add missing MODULE_LICENSE
Arnd Bergmann <arnd(a)arndb.de>
misdn: dsp: select CONFIG_BITREVERSE
Randy Dunlap <rdunlap(a)infradead.org>
arch/arc: add copy_user_page() to <asm/page.h> to fix build error on ARC
Rasmus Villemoes <rasmus.villemoes(a)prevas.dk>
ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram
Masahiro Yamada <masahiroy(a)kernel.org>
ARC: build: add boot_targets to PHONY
yangerkun <yangerkun(a)huawei.com>
ext4: fix bug for rename with RENAME_WHITEOUT
Miaohe Lin <linmiaohe(a)huawei.com>
mm/hugetlb: fix potential missing huge page size info
Thomas Hebb <tommyhebb(a)gmail.com>
ASoC: dapm: remove widget from dirty list on free
-------------
Diffstat:
Makefile | 4 ++--
arch/arc/Makefile | 1 +
arch/arc/include/asm/page.h | 1 +
arch/arm/boot/dts/picoxcell-pc3x2.dtsi | 4 ++++
drivers/iio/industrialio-buffer.c | 6 +++---
drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 3 +++
drivers/input/ff-core.c | 13 ++++++++++---
drivers/input/misc/uinput.c | 18 ++++++++++++++++++
drivers/isdn/mISDN/Kconfig | 1 +
drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c | 1 +
drivers/net/ethernet/freescale/fs_enet/mii-fec.c | 1 +
drivers/net/ethernet/freescale/ucc_geth.h | 9 ++++++++-
drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c | 7 +------
drivers/net/usb/cdc_ncm.c | 8 ++++++--
drivers/net/usb/rndis_host.c | 2 +-
drivers/spi/spi-cadence.c | 6 ++++--
drivers/usb/host/ohci-hcd.c | 2 +-
fs/ext4/ioctl.c | 3 +++
fs/ext4/namei.c | 16 +++++++++-------
fs/nfs/internal.h | 12 +++++++-----
fs/nfsd/nfs3xdr.c | 7 ++++++-
include/linux/acpi.h | 7 +++++++
include/linux/input.h | 1 +
mm/hugetlb.c | 2 +-
mm/slub.c | 2 +-
net/core/skbuff.c | 9 +++++++--
net/dcb/dcbnl.c | 2 ++
net/ipv6/sit.c | 5 ++++-
net/rxrpc/ar-key.c | 6 ++++--
net/sunrpc/addr.c | 2 +-
security/lsm_audit.c | 7 +++++--
sound/soc/soc-dapm.c | 1 +
32 files changed, 125 insertions(+), 44 deletions(-)
This is the start of the stable review cycle for the 4.19.170 release.
There are 22 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 24 Jan 2021 13:57:23 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.170-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.170-rc1
Michael Hennerich <michael.hennerich(a)analog.com>
spi: cadence: cache reference clock rate during probe
Aya Levin <ayal(a)nvidia.com>
net: ipv6: Validate GSO SKB before finish IPv6 processing
Jason A. Donenfeld <Jason(a)zx2c4.com>
net: skbuff: disambiguate argument and member for skb_list_walk_safe helper
Jason A. Donenfeld <Jason(a)zx2c4.com>
net: introduce skb_list_walk_safe for skb segment walking
Hoang Le <hoang.h.le(a)dektech.com.au>
tipc: fix NULL deref in tipc_link_xmit()
David Howells <dhowells(a)redhat.com>
rxrpc: Fix handling of an unsupported token type in rxrpc_read()
Eric Dumazet <edumazet(a)google.com>
net: avoid 32 x truesize under-estimation for tiny skbs
Jakub Kicinski <kuba(a)kernel.org>
net: sit: unregister_netdevice on newlink's error path
David Wu <david.wu(a)rock-chips.com>
net: stmmac: Fixed mtu channged by cache aligned
Baptiste Lepers <baptiste.lepers(a)gmail.com>
rxrpc: Call state should be read with READ_ONCE() under some circumstances
Petr Machata <petrm(a)nvidia.com>
net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
Petr Machata <me(a)pmachata.org>
net: dcb: Validate netlink message in DCB handler
Willem de Bruijn <willemb(a)google.com>
esp: avoid unneeded kmap_atomic call
Andrey Zhizhikin <andrey.zhizhikin(a)leica-geosystems.com>
rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
Stefan Chulski <stefanc(a)marvell.com>
net: mvpp2: Remove Pause and Asym_Pause support
Manish Chopra <manishc(a)marvell.com>
netxen_nic: fix MSI/MSI-x interrupts
Baptiste Lepers <baptiste.lepers(a)gmail.com>
udp: Prevent reuseport_select_sock from reading uninitialized socks
J. Bruce Fields <bfields(a)redhat.com>
nfsd4: readdirplus shouldn't return parent of export
Arnd Bergmann <arnd(a)arndb.de>
crypto: x86/crc32c - fix building with clang ias
Mikulas Patocka <mpatocka(a)redhat.com>
dm integrity: fix flush with external metadata device
Will Deacon <will(a)kernel.org>
compiler.h: Raise minimum version of GCC to 5.1 for arm64
Hamish Martin <hamish.martin(a)alliedtelesis.co.nz>
usb: ohci: Make distrust_firmware param default to false
-------------
Diffstat:
Makefile | 4 +-
arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 2 +-
drivers/md/dm-bufio.c | 6 +++
drivers/md/dm-integrity.c | 50 +++++++++++++++++++---
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 -
.../net/ethernet/qlogic/netxen/netxen_nic_main.c | 7 +--
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +-
drivers/net/usb/rndis_host.c | 2 +-
drivers/spi/spi-cadence.c | 6 ++-
drivers/usb/host/ohci-hcd.c | 2 +-
fs/nfsd/nfs3xdr.c | 7 ++-
include/linux/compiler-gcc.h | 6 +++
include/linux/dm-bufio.h | 1 +
include/linux/skbuff.h | 5 +++
net/core/skbuff.c | 9 +++-
net/core/sock_reuseport.c | 2 +-
net/dcb/dcbnl.c | 2 +
net/ipv4/esp4.c | 7 +--
net/ipv6/esp6.c | 7 +--
net/ipv6/ip6_output.c | 40 ++++++++++++++++-
net/ipv6/sit.c | 5 ++-
net/rxrpc/input.c | 2 +-
net/rxrpc/key.c | 6 ++-
net/tipc/link.c | 9 +++-
24 files changed, 148 insertions(+), 44 deletions(-)
This is the start of the stable review cycle for the 4.14.217 release.
There are 48 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 24 Jan 2021 16:08:17 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.217-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.217-rc2
Michael Hennerich <michael.hennerich(a)analog.com>
spi: cadence: cache reference clock rate during probe
Aya Levin <ayal(a)nvidia.com>
net: ipv6: Validate GSO SKB before finish IPv6 processing
Jason A. Donenfeld <Jason(a)zx2c4.com>
net: skbuff: disambiguate argument and member for skb_list_walk_safe helper
Jason A. Donenfeld <Jason(a)zx2c4.com>
net: introduce skb_list_walk_safe for skb segment walking
Edward Cree <ecree(a)solarflare.com>
net: use skb_list_del_init() to remove from RX sublists
Hoang Le <hoang.h.le(a)dektech.com.au>
tipc: fix NULL deref in tipc_link_xmit()
David Howells <dhowells(a)redhat.com>
rxrpc: Fix handling of an unsupported token type in rxrpc_read()
Eric Dumazet <edumazet(a)google.com>
net: avoid 32 x truesize under-estimation for tiny skbs
Jakub Kicinski <kuba(a)kernel.org>
net: sit: unregister_netdevice on newlink's error path
David Wu <david.wu(a)rock-chips.com>
net: stmmac: Fixed mtu channged by cache aligned
Petr Machata <petrm(a)nvidia.com>
net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
Petr Machata <me(a)pmachata.org>
net: dcb: Validate netlink message in DCB handler
Willem de Bruijn <willemb(a)google.com>
esp: avoid unneeded kmap_atomic call
Andrey Zhizhikin <andrey.zhizhikin(a)leica-geosystems.com>
rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
Manish Chopra <manishc(a)marvell.com>
netxen_nic: fix MSI/MSI-x interrupts
J. Bruce Fields <bfields(a)redhat.com>
nfsd4: readdirplus shouldn't return parent of export
Hamish Martin <hamish.martin(a)alliedtelesis.co.nz>
usb: ohci: Make distrust_firmware param default to false
Jesper Dangaard Brouer <brouer(a)redhat.com>
netfilter: conntrack: fix reading nf_conntrack_buckets
Geert Uytterhoeven <geert+renesas(a)glider.be>
ALSA: fireface: Fix integer overflow in transmit_midi_msg()
Geert Uytterhoeven <geert+renesas(a)glider.be>
ALSA: firewire-tascam: Fix integer overflow in midi_port_work()
Mike Snitzer <snitzer(a)redhat.com>
dm: eliminate potential source of excessive kernel log noise
j.nixdorf(a)avm.de <j.nixdorf(a)avm.de>
net: sunrpc: interpret the return value of kstrtou32 correctly
Jann Horn <jannh(a)google.com>
mm, slub: consider rest of partial list if acquire_slab() fails
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp
Jan Kara <jack(a)suse.cz>
ext4: fix superblock checksum failure when setting password salt
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: nfs_igrab_and_active must first reference the superblock
Trond Myklebust <trond.myklebust(a)hammerspace.com>
pNFS: Mark layout for return if return-on-close was not sent
Dave Wysochanski <dwysocha(a)redhat.com>
NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock
Dan Carpenter <dan.carpenter(a)oracle.com>
ASoC: Intel: fix error code cnl_set_dsp_D0()
Al Viro <viro(a)zeniv.linux.org.uk>
dump_common_audit_data(): fix racy accesses to ->d_name
Arnd Bergmann <arnd(a)arndb.de>
ARM: picoxcell: fix missing interrupt-parent properties
Shawn Guo <shawn.guo(a)linaro.org>
ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI
Michael Ellerman <mpe(a)ellerman.id.au>
net: ethernet: fs_enet: Add missing MODULE_LICENSE
Arnd Bergmann <arnd(a)arndb.de>
misdn: dsp: select CONFIG_BITREVERSE
Randy Dunlap <rdunlap(a)infradead.org>
arch/arc: add copy_user_page() to <asm/page.h> to fix build error on ARC
Rasmus Villemoes <rasmus.villemoes(a)prevas.dk>
ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix transaction leak and crash after RO remount caused by qgroup rescan
Masahiro Yamada <masahiroy(a)kernel.org>
ARC: build: add boot_targets to PHONY
Masahiro Yamada <masahiroy(a)kernel.org>
ARC: build: add uImage.lzma to the top-level target
Masahiro Yamada <masahiroy(a)kernel.org>
ARC: build: remove non-existing bootpImage from KBUILD_IMAGE
yangerkun <yangerkun(a)huawei.com>
ext4: fix bug for rename with RENAME_WHITEOUT
Leon Schuermann <leon(a)is.currently.online>
r8152: Add Lenovo Powered USB-C Travel Hub
Akilesh Kailash <akailash(a)google.com>
dm snapshot: flush merged data before committing metadata
Miaohe Lin <linmiaohe(a)huawei.com>
mm/hugetlb: fix potential missing huge page size info
Dexuan Cui <decui(a)microsoft.com>
ACPI: scan: Harden acpi_device_add() against device ID overflows
Alexander Lobakin <alobakin(a)pm.me>
MIPS: relocatable: fix possible boot hangup with KASLR enabled
Paul Cercueil <paul(a)crapouillou.net>
MIPS: boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB
Thomas Hebb <tommyhebb(a)gmail.com>
ASoC: dapm: remove widget from dirty list on free
-------------
Diffstat:
Makefile | 4 +--
arch/arc/Makefile | 9 ++---
arch/arc/include/asm/page.h | 1 +
arch/arm/boot/dts/picoxcell-pc3x2.dtsi | 4 +++
arch/mips/boot/compressed/decompress.c | 3 +-
arch/mips/kernel/relocate.c | 10 ++++--
drivers/acpi/internal.h | 2 +-
drivers/acpi/scan.c | 15 +++++++-
drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 3 ++
drivers/isdn/mISDN/Kconfig | 1 +
drivers/md/dm-snap.c | 24 +++++++++++++
drivers/md/dm.c | 2 +-
.../net/ethernet/freescale/fs_enet/mii-bitbang.c | 1 +
drivers/net/ethernet/freescale/fs_enet/mii-fec.c | 1 +
drivers/net/ethernet/freescale/ucc_geth.h | 9 ++++-
.../net/ethernet/qlogic/netxen/netxen_nic_main.c | 7 +---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +-
drivers/net/usb/cdc_ether.c | 7 ++++
drivers/net/usb/r8152.c | 1 +
drivers/net/usb/rndis_host.c | 2 +-
drivers/spi/spi-cadence.c | 6 ++--
drivers/usb/host/ohci-hcd.c | 2 +-
fs/btrfs/qgroup.c | 13 +++++--
fs/btrfs/super.c | 8 +++++
fs/ext4/ioctl.c | 3 ++
fs/ext4/namei.c | 16 +++++----
fs/nfs/internal.h | 12 ++++---
fs/nfs/nfs4proc.c | 2 +-
fs/nfs/pnfs.c | 6 ++++
fs/nfsd/nfs3xdr.c | 7 +++-
include/linux/acpi.h | 7 ++++
include/linux/skbuff.h | 16 +++++++++
mm/hugetlb.c | 2 +-
mm/slub.c | 2 +-
net/core/skbuff.c | 9 +++--
net/dcb/dcbnl.c | 2 ++
net/ipv4/esp4.c | 7 +---
net/ipv6/esp6.c | 7 +---
net/ipv6/ip6_output.c | 40 +++++++++++++++++++++-
net/ipv6/sit.c | 5 ++-
net/netfilter/nf_conntrack_standalone.c | 3 ++
net/rxrpc/key.c | 6 ++--
net/sunrpc/addr.c | 2 +-
net/tipc/link.c | 9 +++--
security/lsm_audit.c | 7 ++--
sound/firewire/fireface/ff-transaction.c | 2 +-
sound/firewire/tascam/tascam-transaction.c | 2 +-
sound/soc/intel/skylake/cnl-sst.c | 1 +
sound/soc/soc-dapm.c | 1 +
49 files changed, 243 insertions(+), 71 deletions(-)
This is the start of the stable review cycle for the 4.9.253 release.
There are 33 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 24 Jan 2021 16:08:20 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.253-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.253-rc2
Michael Hennerich <michael.hennerich(a)analog.com>
spi: cadence: cache reference clock rate during probe
Hoang Le <hoang.h.le(a)dektech.com.au>
tipc: fix NULL deref in tipc_link_xmit()
David Howells <dhowells(a)redhat.com>
rxrpc: Fix handling of an unsupported token type in rxrpc_read()
Eric Dumazet <edumazet(a)google.com>
net: avoid 32 x truesize under-estimation for tiny skbs
Jakub Kicinski <kuba(a)kernel.org>
net: sit: unregister_netdevice on newlink's error path
Petr Machata <petrm(a)nvidia.com>
net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
Petr Machata <me(a)pmachata.org>
net: dcb: Validate netlink message in DCB handler
Andrey Zhizhikin <andrey.zhizhikin(a)leica-geosystems.com>
rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
Manish Chopra <manishc(a)marvell.com>
netxen_nic: fix MSI/MSI-x interrupts
Jouni K. Seppänen <jks(a)iki.fi>
net: cdc_ncm: correct overhead in delayed_ndp_size
J. Bruce Fields <bfields(a)redhat.com>
nfsd4: readdirplus shouldn't return parent of export
Hamish Martin <hamish.martin(a)alliedtelesis.co.nz>
usb: ohci: Make distrust_firmware param default to false
Jesper Dangaard Brouer <brouer(a)redhat.com>
netfilter: conntrack: fix reading nf_conntrack_buckets
j.nixdorf(a)avm.de <j.nixdorf(a)avm.de>
net: sunrpc: interpret the return value of kstrtou32 correctly
Jann Horn <jannh(a)google.com>
mm, slub: consider rest of partial list if acquire_slab() fails
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp
Jan Kara <jack(a)suse.cz>
ext4: fix superblock checksum failure when setting password salt
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: nfs_igrab_and_active must first reference the superblock
Al Viro <viro(a)zeniv.linux.org.uk>
dump_common_audit_data(): fix racy accesses to ->d_name
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: uinput - avoid FF flush when destroying device
Arnd Bergmann <arnd(a)arndb.de>
ARM: picoxcell: fix missing interrupt-parent properties
Shawn Guo <shawn.guo(a)linaro.org>
ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI
Michael Ellerman <mpe(a)ellerman.id.au>
net: ethernet: fs_enet: Add missing MODULE_LICENSE
Arnd Bergmann <arnd(a)arndb.de>
misdn: dsp: select CONFIG_BITREVERSE
Randy Dunlap <rdunlap(a)infradead.org>
arch/arc: add copy_user_page() to <asm/page.h> to fix build error on ARC
Rasmus Villemoes <rasmus.villemoes(a)prevas.dk>
ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram
Masahiro Yamada <masahiroy(a)kernel.org>
ARC: build: add boot_targets to PHONY
yangerkun <yangerkun(a)huawei.com>
ext4: fix bug for rename with RENAME_WHITEOUT
Miaohe Lin <linmiaohe(a)huawei.com>
mm/hugetlb: fix potential missing huge page size info
Dexuan Cui <decui(a)microsoft.com>
ACPI: scan: Harden acpi_device_add() against device ID overflows
Alexander Lobakin <alobakin(a)pm.me>
MIPS: relocatable: fix possible boot hangup with KASLR enabled
Paul Cercueil <paul(a)crapouillou.net>
MIPS: boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB
Thomas Hebb <tommyhebb(a)gmail.com>
ASoC: dapm: remove widget from dirty list on free
-------------
Diffstat:
Makefile | 4 ++--
arch/arc/Makefile | 1 +
arch/arc/include/asm/page.h | 1 +
arch/arm/boot/dts/picoxcell-pc3x2.dtsi | 4 ++++
arch/mips/boot/compressed/decompress.c | 3 ++-
arch/mips/kernel/relocate.c | 10 ++++++++--
drivers/acpi/internal.h | 2 +-
drivers/acpi/scan.c | 15 ++++++++++++++-
drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 3 +++
drivers/input/ff-core.c | 13 ++++++++++---
drivers/input/misc/uinput.c | 18 ++++++++++++++++++
drivers/isdn/mISDN/Kconfig | 1 +
drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c | 1 +
drivers/net/ethernet/freescale/fs_enet/mii-fec.c | 1 +
drivers/net/ethernet/freescale/ucc_geth.h | 9 ++++++++-
drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c | 7 +------
drivers/net/usb/cdc_ncm.c | 8 ++++++--
drivers/net/usb/rndis_host.c | 2 +-
drivers/spi/spi-cadence.c | 6 ++++--
drivers/usb/host/ohci-hcd.c | 2 +-
fs/ext4/ioctl.c | 3 +++
fs/ext4/namei.c | 16 +++++++++-------
fs/nfs/internal.h | 12 +++++++-----
fs/nfsd/nfs3xdr.c | 7 ++++++-
include/linux/acpi.h | 7 +++++++
include/linux/input.h | 1 +
mm/hugetlb.c | 2 +-
mm/slub.c | 2 +-
net/core/skbuff.c | 9 +++++++--
net/dcb/dcbnl.c | 2 ++
net/ipv6/sit.c | 5 ++++-
net/netfilter/nf_conntrack_standalone.c | 3 +++
net/rxrpc/key.c | 6 ++++--
net/sunrpc/addr.c | 2 +-
net/tipc/link.c | 11 +++++++++--
security/lsm_audit.c | 7 +++++--
sound/soc/soc-dapm.c | 1 +
37 files changed, 159 insertions(+), 48 deletions(-)
Hi Saeed,
On 01/22/21 at 05:14pm, Saeed Mirzamohammadi wrote:
> Hi,
>
> > On Jan 21, 2021, at 7:12 PM, Dave Young <dyoung(a)redhat.com> wrote:
> >
> > On 01/22/21 at 09:22am, Dave Young wrote:
> >> Hi John,
> >>
> >> On 01/21/21 at 09:32am, john.p.donnelly(a)oracle.com wrote:
> >>> On 11/22/20 9:47 PM, Dave Young wrote:
> >>>> Hi Guilherme,
> >>>> On 11/22/20 at 12:32pm, Guilherme Piccoli wrote:
> >>>>> Hi Dave and Kairui, thanks for your responses! OK, if that makes sense
> >>>>> to you I'm fine with it. I'd just recommend to test recent kernels in
> >>>>> multiple distros with the minimum "range" to see if 64M is enough for
> >>>>> crashkernel, maybe we'd need to bump that.
> >>>>
> >>>> Giving the different kernel configs and the different userspace
> >>>> initramfs setup it is hard to get an uniform value for all distributions,
> >>>> but we can have an interface/kconfig-option for them to provide a value like this patch
> >>>> is doing. And it could be improved like Kairui said about some known
> >>>> kernel added extra values later, probably some more improvements if
> >>>> doable.
> >>>>
> >>>> Thanks
> >>>> Dave
> >>>>
> >>>
> >>> Hi.
> >>>
> >>> Are we going to move forward with implementing this for X86 and Arm ?
> >>>
> >>> If other platform maintainers want to include this CONFIG option in their
> >>> configuration settings they have a starting point.
> >>
> >> I would expect this become arch independent.
> >
> > Clarify a bit, it can be a general config option under arch/Kconfig and
> > just put the code in general arch independent part.
>
> Does this mean that we need to add the option to def_configs in all archs as well?
>
I think we do not need to add defconfig, something like this will just work?
BTW, it should depend on CRASH_CORE instead of CRASH_DUMP, the logic of
parsing crashkernel is in kernel/crash_core.c
diff --git a/arch/Kconfig b/arch/Kconfig
index af14a567b493..fa6efeb52dc5 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -14,6 +14,11 @@ menu "General architecture-dependent options"
config CRASH_CORE
bool
+config CRASH_AUTO_STR
+ depends on CRASH_CORE
+ string "Memory reserved for crash kernel"
+ default "1G-:128M"
+ ... help text [snip] ...
+
config KEXEC_CORE
select CRASH_CORE
bool
[...]
> Thanks,
> Saeed
>
> >
> >>
> >> Saeed, Kairui, would any of you like to update the patch?
> >>
> >>>
> >>> Thank you,
> >>>
> >>> John.
> >>>
> >>> ( I am not currently on many of the included dist lists in this email, so
> >>> hopefully key contributors are included in this exchange )
> >>>
> >>
> >> Thanks
> >> Dave
>
Thanks
Dave
This is the start of the stable review cycle for the 4.4.253 release.
There are 31 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 24 Jan 2021 13:57:23 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.253-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.253-rc1
Michael Hennerich <michael.hennerich(a)analog.com>
spi: cadence: cache reference clock rate during probe
Eric Dumazet <edumazet(a)google.com>
net: avoid 32 x truesize under-estimation for tiny skbs
David Howells <dhowells(a)redhat.com>
rxrpc: Fix handling of an unsupported token type in rxrpc_read()
Jakub Kicinski <kuba(a)kernel.org>
net: sit: unregister_netdevice on newlink's error path
Petr Machata <petrm(a)nvidia.com>
net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
Petr Machata <me(a)pmachata.org>
net: dcb: Validate netlink message in DCB handler
Andrey Zhizhikin <andrey.zhizhikin(a)leica-geosystems.com>
rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
Manish Chopra <manishc(a)marvell.com>
netxen_nic: fix MSI/MSI-x interrupts
Jouni K. Seppänen <jks(a)iki.fi>
net: cdc_ncm: correct overhead in delayed_ndp_size
J. Bruce Fields <bfields(a)redhat.com>
nfsd4: readdirplus shouldn't return parent of export
Nuno Sá <nuno.sa(a)analog.com>
iio: buffer: Fix demux update
Will Deacon <will(a)kernel.org>
compiler.h: Raise minimum version of GCC to 5.1 for arm64
Hamish Martin <hamish.martin(a)alliedtelesis.co.nz>
usb: ohci: Make distrust_firmware param default to false
j.nixdorf(a)avm.de <j.nixdorf(a)avm.de>
net: sunrpc: interpret the return value of kstrtou32 correctly
Jann Horn <jannh(a)google.com>
mm, slub: consider rest of partial list if acquire_slab() fails
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp
Jan Kara <jack(a)suse.cz>
ext4: fix superblock checksum failure when setting password salt
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: nfs_igrab_and_active must first reference the superblock
Al Viro <viro(a)zeniv.linux.org.uk>
dump_common_audit_data(): fix racy accesses to ->d_name
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: uinput - avoid FF flush when destroying device
Arnd Bergmann <arnd(a)arndb.de>
ARM: picoxcell: fix missing interrupt-parent properties
Shawn Guo <shawn.guo(a)linaro.org>
ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI
Michael Ellerman <mpe(a)ellerman.id.au>
net: ethernet: fs_enet: Add missing MODULE_LICENSE
Arnd Bergmann <arnd(a)arndb.de>
misdn: dsp: select CONFIG_BITREVERSE
Randy Dunlap <rdunlap(a)infradead.org>
arch/arc: add copy_user_page() to <asm/page.h> to fix build error on ARC
Rasmus Villemoes <rasmus.villemoes(a)prevas.dk>
ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram
Masahiro Yamada <masahiroy(a)kernel.org>
ARC: build: add boot_targets to PHONY
yangerkun <yangerkun(a)huawei.com>
ext4: fix bug for rename with RENAME_WHITEOUT
Miaohe Lin <linmiaohe(a)huawei.com>
mm/hugetlb: fix potential missing huge page size info
Al Viro <viro(a)zeniv.linux.org.uk>
MIPS: Fix malformed NT_FILE and NT_SIGINFO in 32bit coredumps
Thomas Hebb <tommyhebb(a)gmail.com>
ASoC: dapm: remove widget from dirty list on free
-------------
Diffstat:
Makefile | 4 ++--
arch/arc/Makefile | 1 +
arch/arc/include/asm/page.h | 1 +
arch/arm/boot/dts/picoxcell-pc3x2.dtsi | 4 ++++
arch/mips/kernel/binfmt_elfn32.c | 7 +++++++
arch/mips/kernel/binfmt_elfo32.c | 7 +++++++
drivers/iio/industrialio-buffer.c | 6 +++---
drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 3 +++
drivers/input/ff-core.c | 13 ++++++++++---
drivers/input/misc/uinput.c | 18 ++++++++++++++++++
drivers/isdn/mISDN/Kconfig | 1 +
drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c | 1 +
drivers/net/ethernet/freescale/fs_enet/mii-fec.c | 1 +
drivers/net/ethernet/freescale/ucc_geth.h | 9 ++++++++-
drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c | 7 +------
drivers/net/usb/cdc_ncm.c | 8 ++++++--
drivers/net/usb/rndis_host.c | 2 +-
drivers/spi/spi-cadence.c | 6 ++++--
drivers/usb/host/ohci-hcd.c | 2 +-
fs/ext4/ioctl.c | 3 +++
fs/ext4/namei.c | 16 +++++++++-------
fs/nfs/internal.h | 12 +++++++-----
fs/nfsd/nfs3xdr.c | 7 ++++++-
include/linux/acpi.h | 7 +++++++
include/linux/compiler-gcc.h | 6 ++++++
include/linux/input.h | 1 +
mm/hugetlb.c | 2 +-
mm/slub.c | 2 +-
net/core/skbuff.c | 9 +++++++--
net/dcb/dcbnl.c | 2 ++
net/ipv6/sit.c | 5 ++++-
net/rxrpc/ar-key.c | 6 ++++--
net/sunrpc/addr.c | 2 +-
security/lsm_audit.c | 7 +++++--
sound/soc/soc-dapm.c | 1 +
35 files changed, 145 insertions(+), 44 deletions(-)
This is the start of the stable review cycle for the 4.9.253 release.
There are 35 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 24 Jan 2021 13:57:23 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.253-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.253-rc1
Michael Hennerich <michael.hennerich(a)analog.com>
spi: cadence: cache reference clock rate during probe
Hoang Le <hoang.h.le(a)dektech.com.au>
tipc: fix NULL deref in tipc_link_xmit()
David Howells <dhowells(a)redhat.com>
rxrpc: Fix handling of an unsupported token type in rxrpc_read()
Eric Dumazet <edumazet(a)google.com>
net: avoid 32 x truesize under-estimation for tiny skbs
Jakub Kicinski <kuba(a)kernel.org>
net: sit: unregister_netdevice on newlink's error path
Petr Machata <petrm(a)nvidia.com>
net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
Petr Machata <me(a)pmachata.org>
net: dcb: Validate netlink message in DCB handler
Andrey Zhizhikin <andrey.zhizhikin(a)leica-geosystems.com>
rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
Manish Chopra <manishc(a)marvell.com>
netxen_nic: fix MSI/MSI-x interrupts
Jouni K. Seppänen <jks(a)iki.fi>
net: cdc_ncm: correct overhead in delayed_ndp_size
J. Bruce Fields <bfields(a)redhat.com>
nfsd4: readdirplus shouldn't return parent of export
Will Deacon <will(a)kernel.org>
compiler.h: Raise minimum version of GCC to 5.1 for arm64
Hamish Martin <hamish.martin(a)alliedtelesis.co.nz>
usb: ohci: Make distrust_firmware param default to false
Jesper Dangaard Brouer <brouer(a)redhat.com>
netfilter: conntrack: fix reading nf_conntrack_buckets
j.nixdorf(a)avm.de <j.nixdorf(a)avm.de>
net: sunrpc: interpret the return value of kstrtou32 correctly
Jann Horn <jannh(a)google.com>
mm, slub: consider rest of partial list if acquire_slab() fails
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp
Jan Kara <jack(a)suse.cz>
ext4: fix superblock checksum failure when setting password salt
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: nfs_igrab_and_active must first reference the superblock
Al Viro <viro(a)zeniv.linux.org.uk>
dump_common_audit_data(): fix racy accesses to ->d_name
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: uinput - avoid FF flush when destroying device
Arnd Bergmann <arnd(a)arndb.de>
ARM: picoxcell: fix missing interrupt-parent properties
Shawn Guo <shawn.guo(a)linaro.org>
ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI
Michael Ellerman <mpe(a)ellerman.id.au>
net: ethernet: fs_enet: Add missing MODULE_LICENSE
Arnd Bergmann <arnd(a)arndb.de>
misdn: dsp: select CONFIG_BITREVERSE
Randy Dunlap <rdunlap(a)infradead.org>
arch/arc: add copy_user_page() to <asm/page.h> to fix build error on ARC
Rasmus Villemoes <rasmus.villemoes(a)prevas.dk>
ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram
Masahiro Yamada <masahiroy(a)kernel.org>
ARC: build: add boot_targets to PHONY
yangerkun <yangerkun(a)huawei.com>
ext4: fix bug for rename with RENAME_WHITEOUT
Miaohe Lin <linmiaohe(a)huawei.com>
mm/hugetlb: fix potential missing huge page size info
Dexuan Cui <decui(a)microsoft.com>
ACPI: scan: Harden acpi_device_add() against device ID overflows
Alexander Lobakin <alobakin(a)pm.me>
MIPS: relocatable: fix possible boot hangup with KASLR enabled
Al Viro <viro(a)zeniv.linux.org.uk>
MIPS: Fix malformed NT_FILE and NT_SIGINFO in 32bit coredumps
Paul Cercueil <paul(a)crapouillou.net>
MIPS: boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB
Thomas Hebb <tommyhebb(a)gmail.com>
ASoC: dapm: remove widget from dirty list on free
-------------
Diffstat:
Makefile | 4 ++--
arch/arc/Makefile | 1 +
arch/arc/include/asm/page.h | 1 +
arch/arm/boot/dts/picoxcell-pc3x2.dtsi | 4 ++++
arch/mips/boot/compressed/decompress.c | 3 ++-
arch/mips/kernel/binfmt_elfn32.c | 7 +++++++
arch/mips/kernel/binfmt_elfo32.c | 7 +++++++
arch/mips/kernel/relocate.c | 10 ++++++++--
drivers/acpi/internal.h | 2 +-
drivers/acpi/scan.c | 15 ++++++++++++++-
drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 3 +++
drivers/input/ff-core.c | 13 ++++++++++---
drivers/input/misc/uinput.c | 18 ++++++++++++++++++
drivers/isdn/mISDN/Kconfig | 1 +
drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c | 1 +
drivers/net/ethernet/freescale/fs_enet/mii-fec.c | 1 +
drivers/net/ethernet/freescale/ucc_geth.h | 9 ++++++++-
drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c | 7 +------
drivers/net/usb/cdc_ncm.c | 8 ++++++--
drivers/net/usb/rndis_host.c | 2 +-
drivers/spi/spi-cadence.c | 6 ++++--
drivers/usb/host/ohci-hcd.c | 2 +-
fs/ext4/ioctl.c | 3 +++
fs/ext4/namei.c | 16 +++++++++-------
fs/nfs/internal.h | 12 +++++++-----
fs/nfsd/nfs3xdr.c | 7 ++++++-
include/linux/acpi.h | 7 +++++++
include/linux/compiler-gcc.h | 6 ++++++
include/linux/input.h | 1 +
mm/hugetlb.c | 2 +-
mm/slub.c | 2 +-
net/core/skbuff.c | 9 +++++++--
net/dcb/dcbnl.c | 2 ++
net/ipv6/sit.c | 5 ++++-
net/netfilter/nf_conntrack_standalone.c | 3 +++
net/rxrpc/key.c | 6 ++++--
net/sunrpc/addr.c | 2 +-
net/tipc/link.c | 11 +++++++++--
security/lsm_audit.c | 7 +++++--
sound/soc/soc-dapm.c | 1 +
40 files changed, 179 insertions(+), 48 deletions(-)
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 698222457465ce343443be81c5512edda86e5914 Mon Sep 17 00:00:00 2001
From: Al Viro <viro(a)zeniv.linux.org.uk>
Date: Thu, 24 Dec 2020 19:44:38 +0000
Subject: [PATCH] MIPS: Fix malformed NT_FILE and NT_SIGINFO in 32bit coredumps
Patches that introduced NT_FILE and NT_SIGINFO notes back in 2012
had taken care of native (fs/binfmt_elf.c) and compat (fs/compat_binfmt_elf.c)
coredumps; unfortunately, compat on mips (which does not go through the
usual compat_binfmt_elf.c) had not been noticed.
As the result, both N32 and O32 coredumps on 64bit mips kernels
have those sections malformed enough to confuse the living hell out of
all gdb and readelf versions (up to and including the tip of binutils-gdb.git).
Longer term solution is to make both O32 and N32 compat use the
regular compat_binfmt_elf.c, but that's too much for backports. The minimal
solution is to do in arch/mips/kernel/binfmt_elf[on]32.c the same thing
those patches have done in fs/compat_binfmt_elf.c
Cc: stable(a)kernel.org # v3.7+
Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk>
Signed-off-by: Thomas Bogendoerfer <tsbogend(a)alpha.franken.de>
diff --git a/arch/mips/kernel/binfmt_elfn32.c b/arch/mips/kernel/binfmt_elfn32.c
index 6ee3f7218c67..c4441416e96b 100644
--- a/arch/mips/kernel/binfmt_elfn32.c
+++ b/arch/mips/kernel/binfmt_elfn32.c
@@ -103,4 +103,11 @@ jiffies_to_old_timeval32(unsigned long jiffies, struct old_timeval32 *value)
#undef ns_to_kernel_old_timeval
#define ns_to_kernel_old_timeval ns_to_old_timeval32
+/*
+ * Some data types as stored in coredump.
+ */
+#define user_long_t compat_long_t
+#define user_siginfo_t compat_siginfo_t
+#define copy_siginfo_to_external copy_siginfo_to_external32
+
#include "../../../fs/binfmt_elf.c"
diff --git a/arch/mips/kernel/binfmt_elfo32.c b/arch/mips/kernel/binfmt_elfo32.c
index 6dd103d3cebb..7b2a23f48c1a 100644
--- a/arch/mips/kernel/binfmt_elfo32.c
+++ b/arch/mips/kernel/binfmt_elfo32.c
@@ -106,4 +106,11 @@ jiffies_to_old_timeval32(unsigned long jiffies, struct old_timeval32 *value)
#undef ns_to_kernel_old_timeval
#define ns_to_kernel_old_timeval ns_to_old_timeval32
+/*
+ * Some data types as stored in coredump.
+ */
+#define user_long_t compat_long_t
+#define user_siginfo_t compat_siginfo_t
+#define copy_siginfo_to_external copy_siginfo_to_external32
+
#include "../../../fs/binfmt_elf.c"
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 698222457465ce343443be81c5512edda86e5914 Mon Sep 17 00:00:00 2001
From: Al Viro <viro(a)zeniv.linux.org.uk>
Date: Thu, 24 Dec 2020 19:44:38 +0000
Subject: [PATCH] MIPS: Fix malformed NT_FILE and NT_SIGINFO in 32bit coredumps
Patches that introduced NT_FILE and NT_SIGINFO notes back in 2012
had taken care of native (fs/binfmt_elf.c) and compat (fs/compat_binfmt_elf.c)
coredumps; unfortunately, compat on mips (which does not go through the
usual compat_binfmt_elf.c) had not been noticed.
As the result, both N32 and O32 coredumps on 64bit mips kernels
have those sections malformed enough to confuse the living hell out of
all gdb and readelf versions (up to and including the tip of binutils-gdb.git).
Longer term solution is to make both O32 and N32 compat use the
regular compat_binfmt_elf.c, but that's too much for backports. The minimal
solution is to do in arch/mips/kernel/binfmt_elf[on]32.c the same thing
those patches have done in fs/compat_binfmt_elf.c
Cc: stable(a)kernel.org # v3.7+
Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk>
Signed-off-by: Thomas Bogendoerfer <tsbogend(a)alpha.franken.de>
diff --git a/arch/mips/kernel/binfmt_elfn32.c b/arch/mips/kernel/binfmt_elfn32.c
index 6ee3f7218c67..c4441416e96b 100644
--- a/arch/mips/kernel/binfmt_elfn32.c
+++ b/arch/mips/kernel/binfmt_elfn32.c
@@ -103,4 +103,11 @@ jiffies_to_old_timeval32(unsigned long jiffies, struct old_timeval32 *value)
#undef ns_to_kernel_old_timeval
#define ns_to_kernel_old_timeval ns_to_old_timeval32
+/*
+ * Some data types as stored in coredump.
+ */
+#define user_long_t compat_long_t
+#define user_siginfo_t compat_siginfo_t
+#define copy_siginfo_to_external copy_siginfo_to_external32
+
#include "../../../fs/binfmt_elf.c"
diff --git a/arch/mips/kernel/binfmt_elfo32.c b/arch/mips/kernel/binfmt_elfo32.c
index 6dd103d3cebb..7b2a23f48c1a 100644
--- a/arch/mips/kernel/binfmt_elfo32.c
+++ b/arch/mips/kernel/binfmt_elfo32.c
@@ -106,4 +106,11 @@ jiffies_to_old_timeval32(unsigned long jiffies, struct old_timeval32 *value)
#undef ns_to_kernel_old_timeval
#define ns_to_kernel_old_timeval ns_to_old_timeval32
+/*
+ * Some data types as stored in coredump.
+ */
+#define user_long_t compat_long_t
+#define user_siginfo_t compat_siginfo_t
+#define copy_siginfo_to_external copy_siginfo_to_external32
+
#include "../../../fs/binfmt_elf.c"
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 698222457465ce343443be81c5512edda86e5914 Mon Sep 17 00:00:00 2001
From: Al Viro <viro(a)zeniv.linux.org.uk>
Date: Thu, 24 Dec 2020 19:44:38 +0000
Subject: [PATCH] MIPS: Fix malformed NT_FILE and NT_SIGINFO in 32bit coredumps
Patches that introduced NT_FILE and NT_SIGINFO notes back in 2012
had taken care of native (fs/binfmt_elf.c) and compat (fs/compat_binfmt_elf.c)
coredumps; unfortunately, compat on mips (which does not go through the
usual compat_binfmt_elf.c) had not been noticed.
As the result, both N32 and O32 coredumps on 64bit mips kernels
have those sections malformed enough to confuse the living hell out of
all gdb and readelf versions (up to and including the tip of binutils-gdb.git).
Longer term solution is to make both O32 and N32 compat use the
regular compat_binfmt_elf.c, but that's too much for backports. The minimal
solution is to do in arch/mips/kernel/binfmt_elf[on]32.c the same thing
those patches have done in fs/compat_binfmt_elf.c
Cc: stable(a)kernel.org # v3.7+
Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk>
Signed-off-by: Thomas Bogendoerfer <tsbogend(a)alpha.franken.de>
diff --git a/arch/mips/kernel/binfmt_elfn32.c b/arch/mips/kernel/binfmt_elfn32.c
index 6ee3f7218c67..c4441416e96b 100644
--- a/arch/mips/kernel/binfmt_elfn32.c
+++ b/arch/mips/kernel/binfmt_elfn32.c
@@ -103,4 +103,11 @@ jiffies_to_old_timeval32(unsigned long jiffies, struct old_timeval32 *value)
#undef ns_to_kernel_old_timeval
#define ns_to_kernel_old_timeval ns_to_old_timeval32
+/*
+ * Some data types as stored in coredump.
+ */
+#define user_long_t compat_long_t
+#define user_siginfo_t compat_siginfo_t
+#define copy_siginfo_to_external copy_siginfo_to_external32
+
#include "../../../fs/binfmt_elf.c"
diff --git a/arch/mips/kernel/binfmt_elfo32.c b/arch/mips/kernel/binfmt_elfo32.c
index 6dd103d3cebb..7b2a23f48c1a 100644
--- a/arch/mips/kernel/binfmt_elfo32.c
+++ b/arch/mips/kernel/binfmt_elfo32.c
@@ -106,4 +106,11 @@ jiffies_to_old_timeval32(unsigned long jiffies, struct old_timeval32 *value)
#undef ns_to_kernel_old_timeval
#define ns_to_kernel_old_timeval ns_to_old_timeval32
+/*
+ * Some data types as stored in coredump.
+ */
+#define user_long_t compat_long_t
+#define user_siginfo_t compat_siginfo_t
+#define copy_siginfo_to_external copy_siginfo_to_external32
+
#include "../../../fs/binfmt_elf.c"
Hi,
Please consider applying the following commit to v5.10:
880ee3b7615e ("drm/panel: otm8009a: allow using non-continuous dsi clock")
A related patch introduced in v5.10 has accidentally broken the display
on stm32mp DK2 boards. This commit resolves the issue.
Fixes: c6d94e37bdbb ("drm/bridge/synopsys: dsi: add support for
non-continuous HS clock")
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b210de4f8c97d57de051e805686248ec4c6cfc52 Mon Sep 17 00:00:00 2001
From: Aya Levin <ayal(a)nvidia.com>
Date: Thu, 7 Jan 2021 15:50:18 +0200
Subject: [PATCH] net: ipv6: Validate GSO SKB before finish IPv6 processing
There are cases where GSO segment's length exceeds the egress MTU:
- Forwarding of a TCP GRO skb, when DF flag is not set.
- Forwarding of an skb that arrived on a virtualisation interface
(virtio-net/vhost/tap) with TSO/GSO size set by other network
stack.
- Local GSO skb transmitted on an NETIF_F_TSO tunnel stacked over an
interface with a smaller MTU.
- Arriving GRO skb (or GSO skb in a virtualised environment) that is
bridged to a NETIF_F_TSO tunnel stacked over an interface with an
insufficient MTU.
If so:
- Consume the SKB and its segments.
- Issue an ICMP packet with 'Packet Too Big' message containing the
MTU, allowing the source host to reduce its Path MTU appropriately.
Note: These cases are handled in the same manner in IPv4 output finish.
This patch aligns the behavior of IPv6 and the one of IPv4.
Fixes: 9e50849054a4 ("netfilter: ipv6: move POSTROUTING invocation before fragmentation")
Signed-off-by: Aya Levin <ayal(a)nvidia.com>
Reviewed-by: Tariq Toukan <tariqt(a)nvidia.com>
Link: https://lore.kernel.org/r/1610027418-30438-1-git-send-email-ayal@nvidia.com
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 749ad72386b2..077d43af8226 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -125,8 +125,43 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
return -EINVAL;
}
+static int
+ip6_finish_output_gso_slowpath_drop(struct net *net, struct sock *sk,
+ struct sk_buff *skb, unsigned int mtu)
+{
+ struct sk_buff *segs, *nskb;
+ netdev_features_t features;
+ int ret = 0;
+
+ /* Please see corresponding comment in ip_finish_output_gso
+ * describing the cases where GSO segment length exceeds the
+ * egress MTU.
+ */
+ features = netif_skb_features(skb);
+ segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
+ if (IS_ERR_OR_NULL(segs)) {
+ kfree_skb(skb);
+ return -ENOMEM;
+ }
+
+ consume_skb(skb);
+
+ skb_list_walk_safe(segs, segs, nskb) {
+ int err;
+
+ skb_mark_not_on_list(segs);
+ err = ip6_fragment(net, sk, segs, ip6_finish_output2);
+ if (err && ret == 0)
+ ret = err;
+ }
+
+ return ret;
+}
+
static int __ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
{
+ unsigned int mtu;
+
#if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
/* Policy lookup after SNAT yielded a new policy */
if (skb_dst(skb)->xfrm) {
@@ -135,7 +170,11 @@ static int __ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff
}
#endif
- if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
+ mtu = ip6_skb_dst_mtu(skb);
+ if (skb_is_gso(skb) && !skb_gso_validate_network_len(skb, mtu))
+ return ip6_finish_output_gso_slowpath_drop(net, sk, skb, mtu);
+
+ if ((skb->len > mtu && !skb_is_gso(skb)) ||
dst_allfrag(skb_dst(skb)) ||
(IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
return ip6_fragment(net, sk, skb, ip6_finish_output2);
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b210de4f8c97d57de051e805686248ec4c6cfc52 Mon Sep 17 00:00:00 2001
From: Aya Levin <ayal(a)nvidia.com>
Date: Thu, 7 Jan 2021 15:50:18 +0200
Subject: [PATCH] net: ipv6: Validate GSO SKB before finish IPv6 processing
There are cases where GSO segment's length exceeds the egress MTU:
- Forwarding of a TCP GRO skb, when DF flag is not set.
- Forwarding of an skb that arrived on a virtualisation interface
(virtio-net/vhost/tap) with TSO/GSO size set by other network
stack.
- Local GSO skb transmitted on an NETIF_F_TSO tunnel stacked over an
interface with a smaller MTU.
- Arriving GRO skb (or GSO skb in a virtualised environment) that is
bridged to a NETIF_F_TSO tunnel stacked over an interface with an
insufficient MTU.
If so:
- Consume the SKB and its segments.
- Issue an ICMP packet with 'Packet Too Big' message containing the
MTU, allowing the source host to reduce its Path MTU appropriately.
Note: These cases are handled in the same manner in IPv4 output finish.
This patch aligns the behavior of IPv6 and the one of IPv4.
Fixes: 9e50849054a4 ("netfilter: ipv6: move POSTROUTING invocation before fragmentation")
Signed-off-by: Aya Levin <ayal(a)nvidia.com>
Reviewed-by: Tariq Toukan <tariqt(a)nvidia.com>
Link: https://lore.kernel.org/r/1610027418-30438-1-git-send-email-ayal@nvidia.com
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 749ad72386b2..077d43af8226 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -125,8 +125,43 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
return -EINVAL;
}
+static int
+ip6_finish_output_gso_slowpath_drop(struct net *net, struct sock *sk,
+ struct sk_buff *skb, unsigned int mtu)
+{
+ struct sk_buff *segs, *nskb;
+ netdev_features_t features;
+ int ret = 0;
+
+ /* Please see corresponding comment in ip_finish_output_gso
+ * describing the cases where GSO segment length exceeds the
+ * egress MTU.
+ */
+ features = netif_skb_features(skb);
+ segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
+ if (IS_ERR_OR_NULL(segs)) {
+ kfree_skb(skb);
+ return -ENOMEM;
+ }
+
+ consume_skb(skb);
+
+ skb_list_walk_safe(segs, segs, nskb) {
+ int err;
+
+ skb_mark_not_on_list(segs);
+ err = ip6_fragment(net, sk, segs, ip6_finish_output2);
+ if (err && ret == 0)
+ ret = err;
+ }
+
+ return ret;
+}
+
static int __ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
{
+ unsigned int mtu;
+
#if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
/* Policy lookup after SNAT yielded a new policy */
if (skb_dst(skb)->xfrm) {
@@ -135,7 +170,11 @@ static int __ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff
}
#endif
- if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
+ mtu = ip6_skb_dst_mtu(skb);
+ if (skb_is_gso(skb) && !skb_gso_validate_network_len(skb, mtu))
+ return ip6_finish_output_gso_slowpath_drop(net, sk, skb, mtu);
+
+ if ((skb->len > mtu && !skb_is_gso(skb)) ||
dst_allfrag(skb_dst(skb)) ||
(IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
return ip6_fragment(net, sk, skb, ip6_finish_output2);
The "ibm,arch-vec-5-platform-support" property is a list of pairs of
bytes representing the options and values supported by the platform
firmware. At boot time, Linux scans this list and activates the
available features it recognizes : Radix and XIVE.
A recent change modified the number of entries to loop on and 8 bytes,
4 pairs of { options, values } entries are always scanned. This is
fine on KVM but not on PowerVM which can advertises less. As a
consequence on this platform, Linux reads extra entries pointing to
random data, interprets these as available features and tries to
activate them, leading to a firmware crash in
ibm,client-architecture-support.
Fix that by using the property length of "ibm,arch-vec-5-platform-support".
Cc: stable(a)vger.kernel.org # v4.20+
Fixes: ab91239942a9 ("powerpc/prom: Remove VLA in prom_check_platform_support()")
Signed-off-by: Cédric Le Goater <clg(a)kaod.org>
---
arch/powerpc/kernel/prom_init.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index e9d4eb6144e1..ccf77b985c8f 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -1331,14 +1331,10 @@ static void __init prom_check_platform_support(void)
if (prop_len > sizeof(vec))
prom_printf("WARNING: ibm,arch-vec-5-platform-support longer than expected (len: %d)\n",
prop_len);
- prom_getprop(prom.chosen, "ibm,arch-vec-5-platform-support",
- &vec, sizeof(vec));
- for (i = 0; i < sizeof(vec); i += 2) {
- prom_debug("%d: index = 0x%x val = 0x%x\n", i / 2
- , vec[i]
- , vec[i + 1]);
- prom_parse_platform_support(vec[i], vec[i + 1],
- &supported);
+ prom_getprop(prom.chosen, "ibm,arch-vec-5-platform-support", &vec, sizeof(vec));
+ for (i = 0; i < prop_len; i += 2) {
+ prom_debug("%d: index = 0x%x val = 0x%x\n", i / 2, vec[i], vec[i + 1]);
+ prom_parse_platform_support(vec[i], vec[i + 1], &supported);
}
}
--
2.26.2
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 7a68d725e4ea384977445e0bcaed3d7de83ab5b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jouni=20K=2E=20Sepp=C3=A4nen?= <jks(a)iki.fi>
Date: Tue, 5 Jan 2021 06:52:49 +0200
Subject: [PATCH] net: cdc_ncm: correct overhead in delayed_ndp_size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Aligning to tx_ndp_modulus is not sufficient because the next align
call can be cdc_ncm_align_tail, which can add up to ctx->tx_modulus +
ctx->tx_remainder - 1 bytes. This used to lead to occasional crashes
on a Huawei 909s-120 LTE module as follows:
- the condition marked /* if there is a remaining skb [...] */ is true
so the swaps happen
- skb_out is set from ctx->tx_curr_skb
- skb_out->len is exactly 0x3f52
- ctx->tx_curr_size is 0x4000 and delayed_ndp_size is 0xac
(note that the sum of skb_out->len and delayed_ndp_size is 0x3ffe)
- the for loop over n is executed once
- the cdc_ncm_align_tail call marked /* align beginning of next frame */
increases skb_out->len to 0x3f56 (the sum is now 0x4002)
- the condition marked /* check if we had enough room left [...] */ is
false so we break out of the loop
- the condition marked /* If requested, put NDP at end of frame. */ is
true so the NDP is written into skb_out
- now skb_out->len is 0x4002, so padding_count is minus two interpreted
as an unsigned number, which is used as the length argument to memset,
leading to a crash with various symptoms but usually including
> Call Trace:
> <IRQ>
> cdc_ncm_fill_tx_frame+0x83a/0x970 [cdc_ncm]
> cdc_mbim_tx_fixup+0x1d9/0x240 [cdc_mbim]
> usbnet_start_xmit+0x5d/0x720 [usbnet]
The cdc_ncm_align_tail call first aligns on a ctx->tx_modulus
boundary (adding at most ctx->tx_modulus-1 bytes), then adds
ctx->tx_remainder bytes. Alternatively, the next alignment call can
occur in cdc_ncm_ndp16 or cdc_ncm_ndp32, in which case at most
ctx->tx_ndp_modulus-1 bytes are added.
A similar problem has occurred before, and the code is nontrivial to
reason about, so add a guard before the crashing call. By that time it
is too late to prevent any memory corruption (we'll have written past
the end of the buffer already) but we can at least try to get a warning
written into an on-disk log by avoiding the hard crash caused by padding
past the buffer with a huge number of zeros.
Signed-off-by: Jouni K. Seppänen <jks(a)iki.fi>
Fixes: 4a0e3e989d66 ("cdc_ncm: Add support for moving NDP to end of NCM frame")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=209407
Reported-by: kernel test robot <lkp(a)intel.com>
Reviewed-by: Bjørn Mork <bjorn(a)mork.no>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 3b816a4731f2..5a78848db93f 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1199,7 +1199,10 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
* accordingly. Otherwise, we should check here.
*/
if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END)
- delayed_ndp_size = ALIGN(ctx->max_ndp_size, ctx->tx_ndp_modulus);
+ delayed_ndp_size = ctx->max_ndp_size +
+ max_t(u32,
+ ctx->tx_ndp_modulus,
+ ctx->tx_modulus + ctx->tx_remainder) - 1;
else
delayed_ndp_size = 0;
@@ -1410,7 +1413,8 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
if (!(dev->driver_info->flags & FLAG_SEND_ZLP) &&
skb_out->len > ctx->min_tx_pkt) {
padding_count = ctx->tx_curr_size - skb_out->len;
- skb_put_zero(skb_out, padding_count);
+ if (!WARN_ON(padding_count > ctx->tx_curr_size))
+ skb_put_zero(skb_out, padding_count);
} else if (skb_out->len < ctx->tx_curr_size &&
(skb_out->len % dev->maxpacket) == 0) {
skb_put_u8(skb_out, 0); /* force short packet */
The first thing the active retirement worker does is decrement the
i915_active count.
The first thing we do during i915_active_wait is try to increment the
i915_active count, but only if already active [non-zero].
The wait may see that the retirement is already started and so marked the
i915_active as idle, and skip waiting for the retirement handler.
However, the caller of i915_active_wait may immediately free the
i915_active upon returning (e.g. i915_vma_destroy) so we must not return
before the concurrent access from the worker are completed. We must
always flush the worker.
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2473
Fixes: 274cbf20fd10 ("drm/i915: Push the i915_active.retire into a worker")
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Matthew Auld <matthew.auld(a)intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com>
Cc: <stable(a)vger.kernel.org> # v5.5+
---
drivers/gpu/drm/i915/i915_active.c | 28 +++++++++++++++-------------
1 file changed, 15 insertions(+), 13 deletions(-)
diff --git a/drivers/gpu/drm/i915/i915_active.c b/drivers/gpu/drm/i915/i915_active.c
index ab4382841c6b..3bc616cc1ad2 100644
--- a/drivers/gpu/drm/i915/i915_active.c
+++ b/drivers/gpu/drm/i915/i915_active.c
@@ -628,24 +628,26 @@ static int flush_lazy_signals(struct i915_active *ref)
int __i915_active_wait(struct i915_active *ref, int state)
{
- int err;
-
might_sleep();
- if (!i915_active_acquire_if_busy(ref))
- return 0;
-
/* Any fence added after the wait begins will not be auto-signaled */
- err = flush_lazy_signals(ref);
- i915_active_release(ref);
- if (err)
- return err;
+ if (i915_active_acquire_if_busy(ref)) {
+ int err;
- if (!i915_active_is_idle(ref) &&
- ___wait_var_event(ref, i915_active_is_idle(ref),
- state, 0, 0, schedule()))
- return -EINTR;
+ err = flush_lazy_signals(ref);
+ i915_active_release(ref);
+ if (err)
+ return err;
+ if (___wait_var_event(ref, i915_active_is_idle(ref),
+ state, 0, 0, schedule()))
+ return -EINTR;
+ }
+
+ /*
+ * After the wait is complete, the caller may free the active.
+ * We have to flush any concurrent retirement before returning.
+ */
flush_work(&ref->work);
return 0;
}
--
2.20.1
The vfio_ap device driver registers a group notifier with VFIO when the
file descriptor for a VFIO mediated device for a KVM guest is opened to
receive notification that the KVM pointer is set (VFIO_GROUP_NOTIFY_SET_KVM
event). When the KVM pointer is set, the vfio_ap driver takes the
following actions:
1. Stashes the KVM pointer in the vfio_ap_mdev struct that holds the state
of the mediated device.
2. Calls the kvm_get_kvm() function to increment its reference counter.
3. Sets the function pointer to the function that handles interception of
the instruction that enables/disables interrupt processing.
4. Sets the masks in the KVM guest's CRYCB to pass AP resources through to
the guest.
In order to avoid memory leaks, when the notifier is called to receive
notification that the KVM pointer has been set to NULL, the vfio_ap device
driver should reverse the actions taken when the KVM pointer was set.
Fixes: 258287c994de ("s390: vfio-ap: implement mediated device open callback")
Cc: stable(a)vger.kernel.org
Signed-off-by: Tony Krowiak <akrowiak(a)linux.ibm.com>
Reviewed-by: Halil Pasic <pasic(a)linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck(a)redhat.com>
---
drivers/s390/crypto/vfio_ap_ops.c | 49 ++++++++++++++++++-------------
1 file changed, 28 insertions(+), 21 deletions(-)
diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c
index e0bde8518745..7339043906cf 100644
--- a/drivers/s390/crypto/vfio_ap_ops.c
+++ b/drivers/s390/crypto/vfio_ap_ops.c
@@ -1037,19 +1037,14 @@ static int vfio_ap_mdev_set_kvm(struct ap_matrix_mdev *matrix_mdev,
{
struct ap_matrix_mdev *m;
- mutex_lock(&matrix_dev->lock);
-
list_for_each_entry(m, &matrix_dev->mdev_list, node) {
- if ((m != matrix_mdev) && (m->kvm == kvm)) {
- mutex_unlock(&matrix_dev->lock);
+ if ((m != matrix_mdev) && (m->kvm == kvm))
return -EPERM;
- }
}
matrix_mdev->kvm = kvm;
kvm_get_kvm(kvm);
kvm->arch.crypto.pqap_hook = &matrix_mdev->pqap_hook;
- mutex_unlock(&matrix_dev->lock);
return 0;
}
@@ -1083,35 +1078,52 @@ static int vfio_ap_mdev_iommu_notifier(struct notifier_block *nb,
return NOTIFY_DONE;
}
+static void vfio_ap_mdev_unset_kvm(struct ap_matrix_mdev *matrix_mdev)
+{
+ kvm_arch_crypto_clear_masks(matrix_mdev->kvm);
+ matrix_mdev->kvm->arch.crypto.pqap_hook = NULL;
+ vfio_ap_mdev_reset_queues(matrix_mdev->mdev);
+ kvm_put_kvm(matrix_mdev->kvm);
+ matrix_mdev->kvm = NULL;
+}
+
static int vfio_ap_mdev_group_notifier(struct notifier_block *nb,
unsigned long action, void *data)
{
- int ret;
+ int ret, notify_rc = NOTIFY_OK;
struct ap_matrix_mdev *matrix_mdev;
if (action != VFIO_GROUP_NOTIFY_SET_KVM)
return NOTIFY_OK;
matrix_mdev = container_of(nb, struct ap_matrix_mdev, group_notifier);
+ mutex_lock(&matrix_dev->lock);
if (!data) {
- matrix_mdev->kvm = NULL;
- return NOTIFY_OK;
+ if (matrix_mdev->kvm)
+ vfio_ap_mdev_unset_kvm(matrix_mdev);
+ goto notify_done;
}
ret = vfio_ap_mdev_set_kvm(matrix_mdev, data);
- if (ret)
- return NOTIFY_DONE;
+ if (ret) {
+ notify_rc = NOTIFY_DONE;
+ goto notify_done;
+ }
/* If there is no CRYCB pointer, then we can't copy the masks */
- if (!matrix_mdev->kvm->arch.crypto.crycbd)
- return NOTIFY_DONE;
+ if (!matrix_mdev->kvm->arch.crypto.crycbd) {
+ notify_rc = NOTIFY_DONE;
+ goto notify_done;
+ }
kvm_arch_crypto_set_masks(matrix_mdev->kvm, matrix_mdev->matrix.apm,
matrix_mdev->matrix.aqm,
matrix_mdev->matrix.adm);
- return NOTIFY_OK;
+notify_done:
+ mutex_unlock(&matrix_dev->lock);
+ return notify_rc;
}
static void vfio_ap_irq_disable_apqn(int apqn)
@@ -1222,13 +1234,8 @@ static void vfio_ap_mdev_release(struct mdev_device *mdev)
struct ap_matrix_mdev *matrix_mdev = mdev_get_drvdata(mdev);
mutex_lock(&matrix_dev->lock);
- if (matrix_mdev->kvm) {
- kvm_arch_crypto_clear_masks(matrix_mdev->kvm);
- matrix_mdev->kvm->arch.crypto.pqap_hook = NULL;
- vfio_ap_mdev_reset_queues(mdev);
- kvm_put_kvm(matrix_mdev->kvm);
- matrix_mdev->kvm = NULL;
- }
+ if (matrix_mdev->kvm)
+ vfio_ap_mdev_unset_kvm(matrix_mdev);
mutex_unlock(&matrix_dev->lock);
vfio_unregister_notifier(mdev_dev(mdev), VFIO_IOMMU_NOTIFY,
--
2.21.1
The accelerated, instruction based implementations of SHA1, SHA2 and
SHA3 are autoloaded based on CPU capabilities, given that the code is
modest in size, and widely used, which means that resolving the algo
name, loading all compatible modules and picking the one with the
highest priority is taken to be suboptimal.
However, if these algorithms are requested before this CPU feature
based matching and autoloading occurs, these modules are not even
considered, and we end up with suboptimal performance.
So add the missing module aliases for the various SHA implementations.
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org>
---
arch/arm64/crypto/sha1-ce-glue.c | 1 +
arch/arm64/crypto/sha2-ce-glue.c | 2 ++
arch/arm64/crypto/sha3-ce-glue.c | 4 ++++
arch/arm64/crypto/sha512-ce-glue.c | 2 ++
4 files changed, 9 insertions(+)
diff --git a/arch/arm64/crypto/sha1-ce-glue.c b/arch/arm64/crypto/sha1-ce-glue.c
index c93121bcfdeb..c1362861765f 100644
--- a/arch/arm64/crypto/sha1-ce-glue.c
+++ b/arch/arm64/crypto/sha1-ce-glue.c
@@ -19,6 +19,7 @@
MODULE_DESCRIPTION("SHA1 secure hash using ARMv8 Crypto Extensions");
MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel(a)linaro.org>");
MODULE_LICENSE("GPL v2");
+MODULE_ALIAS_CRYPTO("sha1");
struct sha1_ce_state {
struct sha1_state sst;
diff --git a/arch/arm64/crypto/sha2-ce-glue.c b/arch/arm64/crypto/sha2-ce-glue.c
index 31ba3da5e61b..ded3a6488f81 100644
--- a/arch/arm64/crypto/sha2-ce-glue.c
+++ b/arch/arm64/crypto/sha2-ce-glue.c
@@ -19,6 +19,8 @@
MODULE_DESCRIPTION("SHA-224/SHA-256 secure hash using ARMv8 Crypto Extensions");
MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel(a)linaro.org>");
MODULE_LICENSE("GPL v2");
+MODULE_ALIAS_CRYPTO("sha224");
+MODULE_ALIAS_CRYPTO("sha256");
struct sha256_ce_state {
struct sha256_state sst;
diff --git a/arch/arm64/crypto/sha3-ce-glue.c b/arch/arm64/crypto/sha3-ce-glue.c
index e5a2936f0886..7288d3046354 100644
--- a/arch/arm64/crypto/sha3-ce-glue.c
+++ b/arch/arm64/crypto/sha3-ce-glue.c
@@ -23,6 +23,10 @@
MODULE_DESCRIPTION("SHA3 secure hash using ARMv8 Crypto Extensions");
MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel(a)linaro.org>");
MODULE_LICENSE("GPL v2");
+MODULE_ALIAS_CRYPTO("sha3-224");
+MODULE_ALIAS_CRYPTO("sha3-256");
+MODULE_ALIAS_CRYPTO("sha3-384");
+MODULE_ALIAS_CRYPTO("sha3-512");
asmlinkage void sha3_ce_transform(u64 *st, const u8 *data, int blocks,
int md_len);
diff --git a/arch/arm64/crypto/sha512-ce-glue.c b/arch/arm64/crypto/sha512-ce-glue.c
index faa83f6cf376..a6b1adf31c56 100644
--- a/arch/arm64/crypto/sha512-ce-glue.c
+++ b/arch/arm64/crypto/sha512-ce-glue.c
@@ -23,6 +23,8 @@
MODULE_DESCRIPTION("SHA-384/SHA-512 secure hash using ARMv8 Crypto Extensions");
MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel(a)linaro.org>");
MODULE_LICENSE("GPL v2");
+MODULE_ALIAS_CRYPTO("sha384");
+MODULE_ALIAS_CRYPTO("sha512");
asmlinkage void sha512_ce_transform(struct sha512_state *sst, u8 const *src,
int blocks);
--
2.17.1
The function ovl_dir_real_file() currently uses the semaphore of the
inode to synchronize write to the upperfile cache field.
However, this function will get called by ovl_ioctl_set_flags(), which
utilizes the inode semaphore too. In this case ovl_dir_real_file() will
try to claim a lock that is owned by a function in its call stack, which
won't get released before ovl_dir_real_file() returns.
Define a dedicated semaphore for the upperfile cache, so that the
deadlock won't happen.
Fixes: 61536bed2149 ("ovl: support [S|G]ETFLAGS and FS[S|G]ETXATTR ioctls for directories")
Cc: stable(a)vger.kernel.org # v5.10
Signed-off-by: Icenowy Zheng <icenowy(a)aosc.io>
---
Changes in v2:
- Fixed missing replacement in error handling path.
Changes in v3:
- Use mutex instead of semaphore.
fs/overlayfs/readdir.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
index 01620ebae1bd..3980f9982f34 100644
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -56,6 +56,7 @@ struct ovl_dir_file {
struct list_head *cursor;
struct file *realfile;
struct file *upperfile;
+ struct mutex upperfile_mutex;
};
static struct ovl_cache_entry *ovl_cache_entry_from_node(struct rb_node *n)
@@ -874,8 +875,6 @@ struct file *ovl_dir_real_file(const struct file *file, bool want_upper)
* Need to check if we started out being a lower dir, but got copied up
*/
if (!od->is_upper) {
- struct inode *inode = file_inode(file);
-
realfile = READ_ONCE(od->upperfile);
if (!realfile) {
struct path upperpath;
@@ -883,10 +882,10 @@ struct file *ovl_dir_real_file(const struct file *file, bool want_upper)
ovl_path_upper(dentry, &upperpath);
realfile = ovl_dir_open_realfile(file, &upperpath);
- inode_lock(inode);
+ mutex_lock(&od->upperfile_mutex);
if (!od->upperfile) {
if (IS_ERR(realfile)) {
- inode_unlock(inode);
+ mutex_unlock(&od->upperfile_mutex);
return realfile;
}
smp_store_release(&od->upperfile, realfile);
@@ -896,7 +895,7 @@ struct file *ovl_dir_real_file(const struct file *file, bool want_upper)
fput(realfile);
realfile = od->upperfile;
}
- inode_unlock(inode);
+ mutex_unlock(&od->upperfile_mutex);
}
}
@@ -959,6 +958,7 @@ static int ovl_dir_open(struct inode *inode, struct file *file)
od->realfile = realfile;
od->is_real = ovl_dir_is_real(file->f_path.dentry);
od->is_upper = OVL_TYPE_UPPER(type);
+ mutex_init(&od->upperfile_mutex);
file->private_data = od;
return 0;
--
2.28.0
On Fri, Nov 20, 2020 at 4:28 AM Saeed Mirzamohammadi
<saeed.mirzamohammadi(a)oracle.com> wrote:
>
> Hi,
>
> And I think crashkernel=auto could be used as an indicator that user
> want the kernel to control the crashkernel size, so some further work
> could be done to adjust the crashkernel more accordingly. eg. when
> memory encryption is enabled, increase the crashkernel value for the
> auto estimation, as it's known to consume more crashkernel memory.
>
> Thanks for the suggestion! I tried to keep it simple and leave it to the user to change Kconfig in case a different range is needed. Based on experience, these ranges work well for most of the regular cases.
Yes, I think the current implementation is a very good start.
There are some use cases, where kernel is expected to reserve more memory, like:
- when memory encryption is enabled, an extra swiotlb size of memory
should be reserved
- on pcc, fadump will expect more memory to be reserved
I believe there are a lot more cases like these.
I tried to come up with some patches to let the kernel reserve more
memory automatically, when such conditions are detected, but changing
the crashkernel= specified value is really weird.
But if we have a crashkernel=auto, then kernel automatically reserve
more memory will make sense.
> But why not make it arch-independent? This crashkernel=auto idea
> should simply work with every arch.
>
>
> Thanks! I’ll be making it arch-independent in the v2 patch.
>
>
> #include <asm/page.h>
> #include <asm/sections.h>
> @@ -41,6 +42,15 @@ static int __init parse_crashkernel_mem(char *cmdline,
> unsigned long long *crash_base)
> {
> char *cur = cmdline, *tmp;
> + unsigned long long total_mem = system_ram;
> +
> + /*
> + * Firmware sometimes reserves some memory regions for it's own use.
> + * so we get less than actual system memory size.
> + * Workaround this by round up the total size to 128M which is
> + * enough for most test cases.
> + */
> + total_mem = roundup(total_mem, SZ_128M);
>
>
> I think this rounding may be better moved to the arch specified part
> where parse_crashkernel is called?
>
>
> Thanks for the suggestion. Could you please elaborate why do we need to do that?
Every arch gets their total memory value using different methods,
(just check every parse_crashkernel call, and the system_ram param is
filled in many different ways), so I'm really not sure if this
rounding is always suitable.
>
> Thanks,
> Saeed
>
>
--
Best Regards,
Kairui Song
The patch titled
Subject: mm/vmalloc: reparate put pages and flush VM flags
has been added to the -mm tree. Its filename is
mm-vmalloc-separate-put-pages-and-flush-vm-flags.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mm-vmalloc-separate-put-pages-and…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mm-vmalloc-separate-put-pages-and…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Rick Edgecombe <rick.p.edgecombe(a)intel.com>
Subject: mm/vmalloc: reparate put pages and flush VM flags
When VM_MAP_PUT_PAGES was added, it was defined with the same value as
VM_FLUSH_RESET_PERMS. This doesn't seem like it will cause any big
functional problems other than some excess flushing for VM_MAP_PUT_PAGES
allocations.
Redefine VM_MAP_PUT_PAGES to have its own value. Also, move the comment
and remove whitespace for VM_KASAN such that the flags lower down are less
likely to be missed in the future.
Link: https://lkml.kernel.org/r/20210121014118.31922-1-rick.p.edgecombe@intel.com
Fixes: b944afc9d64d ("mm: add a VM_MAP_PUT_PAGES flag for vmap")
Signed-off-by: Rick Edgecombe <rick.p.edgecombe(a)intel.com>
Reviewed-by: Miaohe Lin <linmiaohe(a)huawei.com>
Reviewed-by: Christoph Hellwig <hch(a)lst.de>
Cc: Daniel Axtens <dja(a)axtens.net>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/vmalloc.h | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/include/linux/vmalloc.h~mm-vmalloc-separate-put-pages-and-flush-vm-flags
+++ a/include/linux/vmalloc.h
@@ -23,9 +23,6 @@ struct notifier_block; /* in notifier.h
#define VM_DMA_COHERENT 0x00000010 /* dma_alloc_coherent */
#define VM_UNINITIALIZED 0x00000020 /* vm_struct is not fully initialized */
#define VM_NO_GUARD 0x00000040 /* don't add guard page */
-#define VM_KASAN 0x00000080 /* has allocated kasan shadow memory */
-#define VM_MAP_PUT_PAGES 0x00000100 /* put pages and free array in vfree */
-
/*
* VM_KASAN is used slighly differently depending on CONFIG_KASAN_VMALLOC.
*
@@ -36,12 +33,13 @@ struct notifier_block; /* in notifier.h
* Otherwise, VM_KASAN is set for kasan_module_alloc() allocations and used to
* determine which allocations need the module shadow freed.
*/
-
+#define VM_KASAN 0x00000080 /* has allocated kasan shadow memory */
/*
* Memory with VM_FLUSH_RESET_PERMS cannot be freed in an interrupt or with
* vfree_atomic().
*/
#define VM_FLUSH_RESET_PERMS 0x00000100 /* Reset direct map and flush TLB on unmap */
+#define VM_MAP_PUT_PAGES 0x00000200 /* put pages and free array in vfree */
/* bits [20..32] reserved for arch specific ioremap internals */
_
Patches currently in -mm which might be from rick.p.edgecombe(a)intel.com are
mm-vmalloc-separate-put-pages-and-flush-vm-flags.patch
The device link device's name was of the form:
<supplier-dev-name>--<consumer-dev-name>
This can cause name collision as reported here [1] as device names are
not globally unique. Since device names have to be unique within the
bus/class, add the bus/class name as a prefix to the device names used to
construct the device link device name.
So the devuce link device's name will be of the form:
<supplier-bus-name>:<supplier-dev-name>--<consumer-bus-name>:<consumer-dev-name>
[1] - https://lore.kernel.org/lkml/20201229033440.32142-1-michael@walle.cc/
Cc: stable(a)vger.kernel.org
Fixes: 287905e68dd2 ("driver core: Expose device link details in sysfs")
Reported-by: Michael Walle <michael(a)walle.cc>
Tested-by: Michael Walle <michael(a)walle.cc>
Signed-off-by: Saravana Kannan <saravanak(a)google.com>
---
v1:
- Fixed the collision in the device link device name.
v1 -> v2:
- Tried to fixed collision in the supplier: and consumer: symlinks
v2 -> v3:
- Fixed the truncation of the symlink names caused by v2.
v3 -> v4:
- Did all the above fixes for the symlink removal path.
Documentation/ABI/testing/sysfs-class-devlink | 4 +--
.../ABI/testing/sysfs-devices-consumer | 5 ++--
.../ABI/testing/sysfs-devices-supplier | 5 ++--
drivers/base/core.c | 27 ++++++++++---------
include/linux/device.h | 12 +++++++++
5 files changed, 35 insertions(+), 18 deletions(-)
diff --git a/Documentation/ABI/testing/sysfs-class-devlink b/Documentation/ABI/testing/sysfs-class-devlink
index b662f747c83e..8a21ce515f61 100644
--- a/Documentation/ABI/testing/sysfs-class-devlink
+++ b/Documentation/ABI/testing/sysfs-class-devlink
@@ -5,8 +5,8 @@ Description:
Provide a place in sysfs for the device link objects in the
kernel at any given time. The name of a device link directory,
denoted as ... above, is of the form <supplier>--<consumer>
- where <supplier> is the supplier device name and <consumer> is
- the consumer device name.
+ where <supplier> is the supplier bus:device name and <consumer>
+ is the consumer bus:device name.
What: /sys/class/devlink/.../auto_remove_on
Date: May 2020
diff --git a/Documentation/ABI/testing/sysfs-devices-consumer b/Documentation/ABI/testing/sysfs-devices-consumer
index 1f06d74d1c3c..0809fda092e6 100644
--- a/Documentation/ABI/testing/sysfs-devices-consumer
+++ b/Documentation/ABI/testing/sysfs-devices-consumer
@@ -4,5 +4,6 @@ Contact: Saravana Kannan <saravanak(a)google.com>
Description:
The /sys/devices/.../consumer:<consumer> are symlinks to device
links where this device is the supplier. <consumer> denotes the
- name of the consumer in that device link. There can be zero or
- more of these symlinks for a given device.
+ name of the consumer in that device link and is of the form
+ bus:device name. There can be zero or more of these symlinks
+ for a given device.
diff --git a/Documentation/ABI/testing/sysfs-devices-supplier b/Documentation/ABI/testing/sysfs-devices-supplier
index a919e0db5e90..207f5972e98d 100644
--- a/Documentation/ABI/testing/sysfs-devices-supplier
+++ b/Documentation/ABI/testing/sysfs-devices-supplier
@@ -4,5 +4,6 @@ Contact: Saravana Kannan <saravanak(a)google.com>
Description:
The /sys/devices/.../supplier:<supplier> are symlinks to device
links where this device is the consumer. <supplier> denotes the
- name of the supplier in that device link. There can be zero or
- more of these symlinks for a given device.
+ name of the supplier in that device link and is of the form
+ bus:device name. There can be zero or more of these symlinks
+ for a given device.
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 25e08e5f40bd..47a6faf1605a 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -456,7 +456,9 @@ static int devlink_add_symlinks(struct device *dev,
struct device *con = link->consumer;
char *buf;
- len = max(strlen(dev_name(sup)), strlen(dev_name(con)));
+ len = max(strlen(dev_bus_name(sup)) + strlen(dev_name(sup)),
+ strlen(dev_bus_name(con)) + strlen(dev_name(con)));
+ len += strlen(":");
len += strlen("supplier:") + 1;
buf = kzalloc(len, GFP_KERNEL);
if (!buf)
@@ -470,12 +472,12 @@ static int devlink_add_symlinks(struct device *dev,
if (ret)
goto err_con;
- snprintf(buf, len, "consumer:%s", dev_name(con));
+ snprintf(buf, len, "consumer:%s:%s", dev_bus_name(con), dev_name(con));
ret = sysfs_create_link(&sup->kobj, &link->link_dev.kobj, buf);
if (ret)
goto err_con_dev;
- snprintf(buf, len, "supplier:%s", dev_name(sup));
+ snprintf(buf, len, "supplier:%s:%s", dev_bus_name(sup), dev_name(sup));
ret = sysfs_create_link(&con->kobj, &link->link_dev.kobj, buf);
if (ret)
goto err_sup_dev;
@@ -483,7 +485,7 @@ static int devlink_add_symlinks(struct device *dev,
goto out;
err_sup_dev:
- snprintf(buf, len, "consumer:%s", dev_name(con));
+ snprintf(buf, len, "consumer:%s:%s", dev_bus_name(con), dev_name(con));
sysfs_remove_link(&sup->kobj, buf);
err_con_dev:
sysfs_remove_link(&link->link_dev.kobj, "consumer");
@@ -506,7 +508,9 @@ static void devlink_remove_symlinks(struct device *dev,
sysfs_remove_link(&link->link_dev.kobj, "consumer");
sysfs_remove_link(&link->link_dev.kobj, "supplier");
- len = max(strlen(dev_name(sup)), strlen(dev_name(con)));
+ len = max(strlen(dev_bus_name(sup)) + strlen(dev_name(sup)),
+ strlen(dev_bus_name(con)) + strlen(dev_name(con)));
+ len += strlen(":");
len += strlen("supplier:") + 1;
buf = kzalloc(len, GFP_KERNEL);
if (!buf) {
@@ -514,9 +518,9 @@ static void devlink_remove_symlinks(struct device *dev,
return;
}
- snprintf(buf, len, "supplier:%s", dev_name(sup));
+ snprintf(buf, len, "supplier:%s:%s", dev_bus_name(sup), dev_name(sup));
sysfs_remove_link(&con->kobj, buf);
- snprintf(buf, len, "consumer:%s", dev_name(con));
+ snprintf(buf, len, "consumer:%s:%s", dev_bus_name(con), dev_name(con));
sysfs_remove_link(&sup->kobj, buf);
kfree(buf);
}
@@ -737,8 +741,9 @@ struct device_link *device_link_add(struct device *consumer,
link->link_dev.class = &devlink_class;
device_set_pm_not_required(&link->link_dev);
- dev_set_name(&link->link_dev, "%s--%s",
- dev_name(supplier), dev_name(consumer));
+ dev_set_name(&link->link_dev, "%s:%s--%s:%s",
+ dev_bus_name(supplier), dev_name(supplier),
+ dev_bus_name(consumer), dev_name(consumer));
if (device_register(&link->link_dev)) {
put_device(consumer);
put_device(supplier);
@@ -1808,9 +1813,7 @@ const char *dev_driver_string(const struct device *dev)
* never change once they are set, so they don't need special care.
*/
drv = READ_ONCE(dev->driver);
- return drv ? drv->name :
- (dev->bus ? dev->bus->name :
- (dev->class ? dev->class->name : ""));
+ return drv ? drv->name : dev_bus_name(dev);
}
EXPORT_SYMBOL(dev_driver_string);
diff --git a/include/linux/device.h b/include/linux/device.h
index 89bb8b84173e..1779f90eeb4c 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -609,6 +609,18 @@ static inline const char *dev_name(const struct device *dev)
return kobject_name(&dev->kobj);
}
+/**
+ * dev_bus_name - Return a device's bus/class name, if at all possible
+ * @dev: struct device to get the bus/class name of
+ *
+ * Will return the name of the bus/class the device is attached to. If it is
+ * not attached to a bus/class, an empty string will be returned.
+ */
+static inline const char *dev_bus_name(const struct device *dev)
+{
+ return dev->bus ? dev->bus->name : (dev->class ? dev->class->name : "");
+}
+
__printf(2, 3) int dev_set_name(struct device *dev, const char *name, ...);
#ifdef CONFIG_NUMA
--
2.30.0.284.gd98b1dd5eaa7-goog
This is a note to let you know that I've just added the patch titled
intel_th: pci: Add Alder Lake-P support
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From cb5c681ab9037e25fcca20689c82cf034566d610 Mon Sep 17 00:00:00 2001
From: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Date: Fri, 15 Jan 2021 22:59:17 +0300
Subject: intel_th: pci: Add Alder Lake-P support
This adds support for the Trace Hub in Alder Lake-P.
Signed-off-by: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Link: https://lore.kernel.org/r/20210115195917.3184-3-alexander.shishkin@linux.in…
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/hwtracing/intel_th/pci.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index 52acd77438ed..251e75c9ba9d 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -268,6 +268,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x7aa6),
.driver_data = (kernel_ulong_t)&intel_th_2x,
},
+ {
+ /* Alder Lake-P */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x51a6),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
{
/* Alder Lake CPU */
PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x466f),
--
2.30.0
This is a note to let you know that I've just added the patch titled
stm class: Fix module init return on allocation failure
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 927633a6d20af319d986f3e42c3ef9f6d7835008 Mon Sep 17 00:00:00 2001
From: Wang Hui <john.wanghui(a)huawei.com>
Date: Fri, 15 Jan 2021 22:59:16 +0300
Subject: stm class: Fix module init return on allocation failure
In stm_heartbeat_init(): return value gets reset after the first
iteration by stm_source_register_device(), so allocation failures
after that will, after a clean up, return success. Fix that.
Fixes: 119291853038 ("stm class: Add heartbeat stm source device")
Reported-by: Hulk Robot <hulkci(a)huawei.com>
Signed-off-by: Wang Hui <john.wanghui(a)huawei.com>
Signed-off-by: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Link: https://lore.kernel.org/r/20210115195917.3184-2-alexander.shishkin@linux.in…
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/hwtracing/stm/heartbeat.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/hwtracing/stm/heartbeat.c b/drivers/hwtracing/stm/heartbeat.c
index 3e7df1c0477f..81d7b21d31ec 100644
--- a/drivers/hwtracing/stm/heartbeat.c
+++ b/drivers/hwtracing/stm/heartbeat.c
@@ -64,7 +64,7 @@ static void stm_heartbeat_unlink(struct stm_source_data *data)
static int stm_heartbeat_init(void)
{
- int i, ret = -ENOMEM;
+ int i, ret;
if (nr_devs < 0 || nr_devs > STM_HEARTBEAT_MAX)
return -EINVAL;
@@ -72,8 +72,10 @@ static int stm_heartbeat_init(void)
for (i = 0; i < nr_devs; i++) {
stm_heartbeat[i].data.name =
kasprintf(GFP_KERNEL, "heartbeat.%d", i);
- if (!stm_heartbeat[i].data.name)
+ if (!stm_heartbeat[i].data.name) {
+ ret = -ENOMEM;
goto fail_unregister;
+ }
stm_heartbeat[i].data.nr_chans = 1;
stm_heartbeat[i].data.link = stm_heartbeat_link;
--
2.30.0
This is a note to let you know that I've just added the patch titled
driver core: Extend device_is_dependent()
to my driver-core git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git
in the driver-core-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 3d1cf435e201d1fd63e4346b141881aed086effd Mon Sep 17 00:00:00 2001
From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com>
Date: Fri, 15 Jan 2021 19:30:51 +0100
Subject: driver core: Extend device_is_dependent()
If the device passed as the target (second argument) to
device_is_dependent() is not completely registered (that is, it has
been initialized, but not added yet), but the parent pointer of it
is set, it may be missing from the list of the parent's children
and device_for_each_child() called by device_is_dependent() cannot
be relied on to catch that dependency.
For this reason, modify device_is_dependent() to check the ancestors
of the target device by following its parent pointer in addition to
the device_for_each_child() walk.
Fixes: 9ed9895370ae ("driver core: Functional dependencies tracking support")
Reported-by: Stephan Gerhold <stephan(a)gerhold.net>
Tested-by: Stephan Gerhold <stephan(a)gerhold.net>
Reviewed-by: Saravana Kannan <saravanak(a)google.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
Link: https://lore.kernel.org/r/17705994.d592GUb2YH@kreacher
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/base/core.c | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 25e08e5f40bd..3819fd012e27 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -208,6 +208,16 @@ int device_links_read_lock_held(void)
#endif
#endif /* !CONFIG_SRCU */
+static bool device_is_ancestor(struct device *dev, struct device *target)
+{
+ while (target->parent) {
+ target = target->parent;
+ if (dev == target)
+ return true;
+ }
+ return false;
+}
+
/**
* device_is_dependent - Check if one device depends on another one
* @dev: Device to check dependencies for.
@@ -221,7 +231,12 @@ int device_is_dependent(struct device *dev, void *target)
struct device_link *link;
int ret;
- if (dev == target)
+ /*
+ * The "ancestors" check is needed to catch the case when the target
+ * device has not been completely initialized yet and it is still
+ * missing from the list of children of its parent device.
+ */
+ if (dev == target || device_is_ancestor(dev, target))
return 1;
ret = device_for_each_child(dev, target, device_is_dependent);
--
2.30.0
From: Johannes Berg <johannes.berg(a)intel.com>
Since cfg80211 doesn't implement commit, we never really cared about
that code there (and it's configured out w/o CONFIG_WIRELESS_EXT).
After all, since it has no commit, it shouldn't return -EIWCOMMIT to
indicate commit is needed.
However, EIWCOMMIT is actually an alias for EINPROGRESS, which _can_
happen if e.g. we try to change the frequency but we're already in
the process of connecting to some network, and drivers could return
that value (or even cfg80211 itself might).
This then causes us to crash because dev->wireless_handlers is NULL
but we try to check dev->wireless_handlers->standard[0].
Fix this by also checking dev->wireless_handlers. Also simplify the
code a little bit.
Cc: stable(a)vger.kernel.org
Reported-by: syzbot+444248c79e117bc99f46(a)syzkaller.appspotmail.com
Reported-by: syzbot+8b2a88a09653d4084179(a)syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
---
net/wireless/wext-core.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 69102fda9ebd..76a80a41615b 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -896,8 +896,9 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
int call_commit_handler(struct net_device *dev)
{
#ifdef CONFIG_WIRELESS_EXT
- if ((netif_running(dev)) &&
- (dev->wireless_handlers->standard[0] != NULL))
+ if (netif_running(dev) &&
+ dev->wireless_handlers &&
+ dev->wireless_handlers->standard[0])
/* Call the commit handler on the driver */
return dev->wireless_handlers->standard[0](dev, NULL,
NULL, NULL);
--
2.26.2
The default kernel_fpu_begin() doesn't work on systems that support XMM but
haven't yet enabled CR4.OSFXSR. This causes crashes when _mmx_memcpy() is
called too early because LDMXCSR generates #UD when the aforementioned bit
is clear.
Fix it by using kernel_fpu_begin_mask(KFPU_387) explicitly.
Fixes: 7ad816762f9b ("x86/fpu: Reset MXCSR to default in kernel_fpu_begin()")
Cc: <stable(a)vger.kernel.org>
Reported-by: Krzysztof Mazur <krzysiek(a)podlesie.net>
Signed-off-by: Andy Lutomirski <luto(a)kernel.org>
---
arch/x86/lib/mmx_32.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/arch/x86/lib/mmx_32.c b/arch/x86/lib/mmx_32.c
index 4321fa02e18d..ad1dabce931e 100644
--- a/arch/x86/lib/mmx_32.c
+++ b/arch/x86/lib/mmx_32.c
@@ -26,6 +26,16 @@
#include <asm/fpu/api.h>
#include <asm/asm.h>
+/*
+ * Use KFPU_387. MMX instructions are not affected by MXCSR,
+ * but both AMD and Intel documentation states that even integer MMX
+ * operations will result in #MF if an exception is pending in FCW.
+ *
+ * EMMS is not needed afterwards because, after we call kernel_fpu_end(),
+ * any subsequent user of the 387 stack will reinitialize it using
+ * KFPU_387.
+ */
+
void *_mmx_memcpy(void *to, const void *from, size_t len)
{
void *p;
@@ -37,7 +47,7 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
p = to;
i = len >> 6; /* len/64 */
- kernel_fpu_begin();
+ kernel_fpu_begin_mask(KFPU_387);
__asm__ __volatile__ (
"1: prefetch (%0)\n" /* This set is 28 bytes */
@@ -127,7 +137,7 @@ static void fast_clear_page(void *page)
{
int i;
- kernel_fpu_begin();
+ kernel_fpu_begin_mask(KFPU_387);
__asm__ __volatile__ (
" pxor %%mm0, %%mm0\n" : :
@@ -160,7 +170,7 @@ static void fast_copy_page(void *to, void *from)
{
int i;
- kernel_fpu_begin();
+ kernel_fpu_begin_mask(KFPU_387);
/*
* maybe the prefetch stuff can go before the expensive fnsave...
@@ -247,7 +257,7 @@ static void fast_clear_page(void *page)
{
int i;
- kernel_fpu_begin();
+ kernel_fpu_begin_mask(KFPU_387);
__asm__ __volatile__ (
" pxor %%mm0, %%mm0\n" : :
@@ -282,7 +292,7 @@ static void fast_copy_page(void *to, void *from)
{
int i;
- kernel_fpu_begin();
+ kernel_fpu_begin_mask(KFPU_387);
__asm__ __volatile__ (
"1: prefetch (%0)\n"
--
2.29.2
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 19ef7b70ca9487773c29b449adf0c70f540a0aab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nuno=20S=C3=A1?= <nuno.sa(a)analog.com>
Date: Thu, 12 Nov 2020 15:43:22 +0100
Subject: [PATCH] iio: buffer: Fix demux update
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When updating the buffer demux, we will skip a scan element from the
device in the case `in_ind != out_ind` and we enter the while loop.
in_ind should only be refreshed with `find_next_bit()` in the end of the
loop.
Note, to cause problems we need a situation where we are skippig over
an element (channel not enabled) that happens to not have the same size
as the next element. Whilst this is a possible situation we haven't
actually identified any cases in mainline where it happens as most drivers
have consistent channel storage sizes with the exception of the timestamp
which is the last element and hence never skipped over.
Fixes: 5ada4ea9be16 ("staging:iio: add demux optionally to path from device to buffer")
Signed-off-by: Nuno Sá <nuno.sa(a)analog.com>
Link: https://lore.kernel.org/r/20201112144323.28887-1-nuno.sa@analog.com
Cc: <Stable(a)vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 9663dec3dcf3..2f7426a2f47c 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -853,12 +853,12 @@ static int iio_buffer_update_demux(struct iio_dev *indio_dev,
indio_dev->masklength,
in_ind + 1);
while (in_ind != out_ind) {
- in_ind = find_next_bit(indio_dev->active_scan_mask,
- indio_dev->masklength,
- in_ind + 1);
length = iio_storage_bytes_for_si(indio_dev, in_ind);
/* Make sure we are aligned */
in_loc = roundup(in_loc, length) + length;
+ in_ind = find_next_bit(indio_dev->active_scan_mask,
+ indio_dev->masklength,
+ in_ind + 1);
}
length = iio_storage_bytes_for_si(indio_dev, in_ind);
out_loc = roundup(out_loc, length);
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 234266a5168bbe8220d263e3aa7aa80cf921c483 Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas(a)wunner.de>
Date: Mon, 7 Dec 2020 09:17:16 +0100
Subject: [PATCH] spi: npcm-fiu: Disable clock in probe error path
If the call to devm_spi_register_master() fails on probe of the NPCM FIU
SPI driver, the clock "fiu->clk" is erroneously not unprepared and
disabled. Fix it.
Fixes: ace55c411b11 ("spi: npcm-fiu: add NPCM FIU controller driver")
Signed-off-by: Lukas Wunner <lukas(a)wunner.de>
Cc: <stable(a)vger.kernel.org> # v5.4+
Cc: Tomer Maimon <tmaimon77(a)gmail.com>
Link: https://lore.kernel.org/r/9ae62f4e1cfe542bec57ac2743e6fca9f9548f55.16072868…
Signed-off-by: Mark Brown <broonie(a)kernel.org>
diff --git a/drivers/spi/spi-npcm-fiu.c b/drivers/spi/spi-npcm-fiu.c
index 1cb9329de945..b62471ab6d7f 100644
--- a/drivers/spi/spi-npcm-fiu.c
+++ b/drivers/spi/spi-npcm-fiu.c
@@ -677,7 +677,7 @@ static int npcm_fiu_probe(struct platform_device *pdev)
struct npcm_fiu_spi *fiu;
void __iomem *regbase;
struct resource *res;
- int id;
+ int id, ret;
ctrl = devm_spi_alloc_master(dev, sizeof(*fiu));
if (!ctrl)
@@ -735,7 +735,11 @@ static int npcm_fiu_probe(struct platform_device *pdev)
ctrl->num_chipselect = fiu->info->max_cs;
ctrl->dev.of_node = dev->of_node;
- return devm_spi_register_master(dev, ctrl);
+ ret = devm_spi_register_master(dev, ctrl);
+ if (ret)
+ clk_disable_unprepare(fiu->clk);
+
+ return ret;
}
static int npcm_fiu_remove(struct platform_device *pdev)
Dear stable kernel maintainers,
Please consider cherry-picking
commit 44623b2818f4 ("arch/x86/crypto/crc32c-pcl-intel-asm_64.S")
to stable-4.19.y. This will allow us to use LLVM_IAS=1 for Android on
x86_64 allmodconfig. The commit first landed in 5.8. It has already
landed in 5.4.74 as f73328c3192e.
The backport to 5.4.74 (f73328c3192e) will apply cleanly. Jian Cai
sent it to 5.4 for CrOS, but we're trying to be a bit more aggressive
in Android supporting 4.19+ with LLVM_IAS=1.
--
Thanks,
~Nick Desaulniers
On Wed, Jan 20, 2021 at 03:28:10PM -0800, Jian Cai wrote:
> Dear stable kernel maintainers,
>
> Please consider applying the following patch for LLVM_IAS=1 support on
> Chrome OS:
> commit 6e7b64b9dd6d "elfcore: fix building with clang"
>
> Please find in the attached a slightly changed patch due to missing
> upstream commit 7a896028adcf. This patch would fix an issue similar to the
> one fixed by another upstream patch (
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=…)
> that has been included in 5.4.
But 78762b0e79bc ("x86/asm/32: Add ENDs to some functions and relabel
with SYM_CODE_*") is in the 5.4.90 kernel release, so are you sure this
is still correct and will work properly?
And your subject is odd, as again, that commit is already in 5.4.90 :)
thanks,
greg k-h
Sockets and other non-regular files may actually expect short reads to
happen, don't retry reads for them. Because non-reg files don't set
FMODE_BUF_RASYNC and so it won't do second/retry do_read, we can filter
out those cases after first do_read() attempt with ret>0.
Cc: stable(a)vger.kernel.org # 5.9+
Suggested-by: Jens Axboe <axboe(a)kernel.dk>
Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com>
---
v2: essentially same, but a bit cleaner check placement and
extended commit message
fs/io_uring.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 5f6f1e48954e..18920f9785d2 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -3552,7 +3552,7 @@ static int io_read(struct io_kiocb *req, bool force_nonblock,
/* read it all, or we did blocking attempt. no retry. */
if (!iov_iter_count(iter) || !force_nonblock ||
- (req->file->f_flags & O_NONBLOCK))
+ (req->file->f_flags & O_NONBLOCK) || !(req->flags & REQ_F_ISREG))
goto done;
io_size -= ret;
--
2.24.0
Hi,
Can you please apply commit fb3558127cb6 ("bpf: Fix selftest
compilation on clang 11") to the 5.10 tree? Without it, compiling
selftests/bpf with clang-11 fails.
Thanks!
Lorenz
--
Lorenz Bauer | Systems Engineer
6th Floor, County Hall/The Riverside Building, SE1 7PB, UK
www.cloudflare.com
On Wed, Jan 20, 2021 at 8:57 AM Suren Baghdasaryan <surenb(a)google.com> wrote:
>
> On Wed, Jan 20, 2021 at 5:18 AM Jann Horn <jannh(a)google.com> wrote:
> >
> > On Wed, Jan 13, 2021 at 3:22 PM Michal Hocko <mhocko(a)suse.com> wrote:
> > > On Tue 12-01-21 09:51:24, Suren Baghdasaryan wrote:
> > > > On Tue, Jan 12, 2021 at 9:45 AM Oleg Nesterov <oleg(a)redhat.com> wrote:
> > > > >
> > > > > On 01/12, Michal Hocko wrote:
> > > > > >
> > > > > > On Mon 11-01-21 09:06:22, Suren Baghdasaryan wrote:
> > > > > >
> > > > > > > What we want is the ability for one process to influence another process
> > > > > > > in order to optimize performance across the entire system while leaving
> > > > > > > the security boundary intact.
> > > > > > > Replace PTRACE_MODE_ATTACH with a combination of PTRACE_MODE_READ
> > > > > > > and CAP_SYS_NICE. PTRACE_MODE_READ to prevent leaking ASLR metadata
> > > > > > > and CAP_SYS_NICE for influencing process performance.
> > > > > >
> > > > > > I have to say that ptrace modes are rather obscure to me. So I cannot
> > > > > > really judge whether MODE_READ is sufficient. My understanding has
> > > > > > always been that this is requred to RO access to the address space. But
> > > > > > this operation clearly has a visible side effect. Do we have any actual
> > > > > > documentation for the existing modes?
> > > > > >
> > > > > > I would be really curious to hear from Jann and Oleg (now Cced).
> > > > >
> > > > > Can't comment, sorry. I never understood these security checks and never tried.
> > > > > IIUC only selinux/etc can treat ATTACH/READ differently and I have no idea what
> > > > > is the difference.
> >
> > Yama in particular only does its checks on ATTACH and ignores READ,
> > that's the difference you're probably most likely to encounter on a
> > normal desktop system, since some distros turn Yama on by default.
> > Basically the idea there is that running "gdb -p $pid" or "strace -p
> > $pid" as a normal user will usually fail, but reading /proc/$pid/maps
> > still works; so you can see things like detailed memory usage
> > information and such, but you're not supposed to be able to directly
> > peek into a running SSH client and inject data into the existing SSH
> > connection, or steal the cryptographic keys for the current
> > connection, or something like that.
> >
> > > > I haven't seen a written explanation on ptrace modes but when I
> > > > consulted Jann his explanation was:
> > > >
> > > > PTRACE_MODE_READ means you can inspect metadata about processes with
> > > > the specified domain, across UID boundaries.
> > > > PTRACE_MODE_ATTACH means you can fully impersonate processes with the
> > > > specified domain, across UID boundaries.
> > >
> > > Maybe this would be a good start to document expectations. Some more
> > > practical examples where the difference is visible would be great as
> > > well.
> >
> > Before documenting the behavior, it would be a good idea to figure out
> > what to do with perf_event_open(). That one's weird in that it only
> > requires PTRACE_MODE_READ, but actually allows you to sample stuff
> > like userspace stack and register contents (if perf_event_paranoid is
> > 1 or 2). Maybe for SELinux things (and maybe also for Yama), there
> > should be a level in between that allows fully inspecting the process
> > (for purposes like profiling) but without the ability to corrupt its
> > memory or registers or things like that. Or maybe perf_event_open()
> > should just use the ATTACH mode.
>
> Thanks for additional clarifications, Jann!
> Just to clarify, the documentation I'm preparing is a man page for
> process_madvise(2) which will list the required capabilities but won't
> dive into all the security details.
> I believe the above suggestions are for documenting different PTRACE
> modes and will not be included in that man page. Maybe a separate
> document could do that but I'm definitely not qualified to write it.
Folks, I posted the man page here:
https://lore.kernel.org/linux-mm/20210120202337.1481402-1-surenb@google.com/
Also I realized that this patch is not changing at all and if I send a
new version, the only difference would be CC'ing it to stable and
linux-security-module.
I'm CC'ing stable (James already CC'ed LSM), but if I should re-post
it please let me know.
Cc: stable(a)vger.kernel.org # 5.10+
On Thu, 2020-09-24 at 15:08 +0100, David Woodhouse wrote:
> From: David Woodhouse <dwmw(a)amazon.co.uk>
>
> Instead of bailing out completely, such a unit can still be used for
> interrupt remapping.
>
> Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk>
Could we have this for stable too please, along with the trivial
subsequent fixup. They are:
c40aaaac1018 ("iommu/vt-d: Gracefully handle DMAR units with no supported address widths")
9def3b1a07c4 ("iommu/vt-d: Don't dereference iommu_device if IOMMU_API is not built")
They apply fairly straightforwardly when backported; let me know if you
want us to send patches.
Even though the JZ4740 did not have the OSD mode, it had (according to
the documentation) two DMA channels, but there is absolutely no
information about how to select the second DMA channel.
Make the ingenic-drm driver work in non-OSD mode by using the
foreground0 plane (which is bound to the DMA0 channel) as the primary
plane, instead of the foreground1 plane, which is the primary plane
when in OSD mode.
Fixes: 3c9bea4ef32b ("drm/ingenic: Add support for OSD mode")
Cc: <stable(a)vger.kernel.org> # v5.8+
Signed-off-by: Paul Cercueil <paul(a)crapouillou.net>
---
drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
index 158433b4c084..963dcbfeaba2 100644
--- a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
+++ b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
@@ -554,7 +554,7 @@ static void ingenic_drm_plane_atomic_update(struct drm_plane *plane,
height = state->src_h >> 16;
cpp = state->fb->format->cpp[0];
- if (priv->soc_info->has_osd && plane->type == DRM_PLANE_TYPE_OVERLAY)
+ if (!priv->soc_info->has_osd || plane->type == DRM_PLANE_TYPE_OVERLAY)
hwdesc = &priv->dma_hwdescs->hwdesc_f0;
else
hwdesc = &priv->dma_hwdescs->hwdesc_f1;
@@ -826,6 +826,7 @@ static int ingenic_drm_bind(struct device *dev, bool has_components)
const struct jz_soc_info *soc_info;
struct ingenic_drm *priv;
struct clk *parent_clk;
+ struct drm_plane *primary;
struct drm_bridge *bridge;
struct drm_panel *panel;
struct drm_encoder *encoder;
@@ -940,9 +941,11 @@ static int ingenic_drm_bind(struct device *dev, bool has_components)
if (soc_info->has_osd)
priv->ipu_plane = drm_plane_from_index(drm, 0);
- drm_plane_helper_add(&priv->f1, &ingenic_drm_plane_helper_funcs);
+ primary = priv->soc_info->has_osd ? &priv->f1 : &priv->f0;
- ret = drm_universal_plane_init(drm, &priv->f1, 1,
+ drm_plane_helper_add(primary, &ingenic_drm_plane_helper_funcs);
+
+ ret = drm_universal_plane_init(drm, primary, 1,
&ingenic_drm_primary_plane_funcs,
priv->soc_info->formats_f1,
priv->soc_info->num_formats_f1,
@@ -954,7 +957,7 @@ static int ingenic_drm_bind(struct device *dev, bool has_components)
drm_crtc_helper_add(&priv->crtc, &ingenic_drm_crtc_helper_funcs);
- ret = drm_crtc_init_with_planes(drm, &priv->crtc, &priv->f1,
+ ret = drm_crtc_init_with_planes(drm, &priv->crtc, primary,
NULL, &ingenic_drm_crtc_funcs, NULL);
if (ret) {
dev_err(dev, "Failed to init CRTC: %i\n", ret);
--
2.29.2
Since the encoders have been devm-allocated, they will be freed way
before drm_mode_config_cleanup() is called. To avoid use-after-free
conditions, we then must ensure that drm_encoder_cleanup() is called
before the encoders are freed.
v2: Use the new __drmm_simple_encoder_alloc() function
Fixes: c369cb27c267 ("drm/ingenic: Support multiple panels/bridges")
Cc: <stable(a)vger.kernel.org> # 5.8+
Signed-off-by: Paul Cercueil <paul(a)crapouillou.net>
---
Notes:
Use the V1 of this patch to fix v5.11 and older kernels. This V2 only
applies on the current drm-misc-next branch.
drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
index 7bb31fbee29d..158433b4c084 100644
--- a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
+++ b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
@@ -1014,20 +1014,18 @@ static int ingenic_drm_bind(struct device *dev, bool has_components)
bridge = devm_drm_panel_bridge_add_typed(dev, panel,
DRM_MODE_CONNECTOR_DPI);
- encoder = devm_kzalloc(dev, sizeof(*encoder), GFP_KERNEL);
- if (!encoder)
- return -ENOMEM;
+ encoder = __drmm_simple_encoder_alloc(drm, sizeof(*encoder), 0,
+ DRM_MODE_ENCODER_DPI);
+ if (IS_ERR(encoder)) {
+ ret = PTR_ERR(encoder);
+ dev_err(dev, "Failed to init encoder: %d\n", ret);
+ return ret;
+ }
encoder->possible_crtcs = 1;
drm_encoder_helper_add(encoder, &ingenic_drm_encoder_helper_funcs);
- ret = drm_simple_encoder_init(drm, encoder, DRM_MODE_ENCODER_DPI);
- if (ret) {
- dev_err(dev, "Failed to init encoder: %d\n", ret);
- return ret;
- }
-
ret = drm_bridge_attach(encoder, bridge, NULL, 0);
if (ret) {
dev_err(dev, "Unable to attach bridge\n");
--
2.29.2
Overlayfs's volatile option allows the user to bypass all forced sync calls
to the upperdir filesystem. This comes at the cost of safety. We can never
ensure that the user's data is intact, but we can make a best effort to
expose whether or not the data is likely to be in a bad state.
The best way to handle this in the time being is that if an overlayfs's
upperdir experiences an error after a volatile mount occurs, that error
will be returned on fsync, fdatasync, sync, and syncfs. This is
contradictory to the traditional behaviour of VFS which fails the call
once, and only raises an error if a subsequent fsync error has occurred,
and been raised by the filesystem.
One awkward aspect of the patch is that we have to manually set the
superblock's errseq_t after the sync_fs callback as opposed to just
returning an error from syncfs. This is because the call chain looks
something like this:
sys_syncfs ->
sync_filesystem ->
__sync_filesystem ->
/* The return value is ignored here
sb->s_op->sync_fs(sb)
_sync_blockdev
/* Where the VFS fetches the error to raise to userspace */
errseq_check_and_advance
Because of this we call errseq_set every time the sync_fs callback occurs.
Due to the nature of this seen / unseen dichotomy, if the upperdir is an
inconsistent state at the initial mount time, overlayfs will refuse to
mount, as overlayfs cannot get a snapshot of the upperdir's errseq that
will increment on error until the user calls syncfs.
Signed-off-by: Sargun Dhillon <sargun(a)sargun.me>
Suggested-by: Amir Goldstein <amir73il(a)gmail.com>
Reviewed-by: Amir Goldstein <amir73il(a)gmail.com>
Fixes: c86243b090bc ("ovl: provide a mount option "volatile"")
Cc: linux-fsdevel(a)vger.kernel.org
Cc: linux-unionfs(a)vger.kernel.org
Cc: stable(a)vger.kernel.org
Cc: Jeff Layton <jlayton(a)redhat.com>
Cc: Miklos Szeredi <miklos(a)szeredi.hu>
Cc: Amir Goldstein <amir73il(a)gmail.com>
Cc: Vivek Goyal <vgoyal(a)redhat.com>
Cc: Matthew Wilcox <willy(a)infradead.org>
---
Documentation/filesystems/overlayfs.rst | 8 ++++++
fs/overlayfs/file.c | 5 ++--
fs/overlayfs/overlayfs.h | 1 +
fs/overlayfs/ovl_entry.h | 2 ++
fs/overlayfs/readdir.c | 5 ++--
fs/overlayfs/super.c | 34 ++++++++++++++++++++-----
fs/overlayfs/util.c | 27 ++++++++++++++++++++
7 files changed, 71 insertions(+), 11 deletions(-)
diff --git a/Documentation/filesystems/overlayfs.rst b/Documentation/filesystems/overlayfs.rst
index 580ab9a0fe31..137afeb3f581 100644
--- a/Documentation/filesystems/overlayfs.rst
+++ b/Documentation/filesystems/overlayfs.rst
@@ -575,6 +575,14 @@ without significant effort.
The advantage of mounting with the "volatile" option is that all forms of
sync calls to the upper filesystem are omitted.
+In order to avoid a giving a false sense of safety, the syncfs (and fsync)
+semantics of volatile mounts are slightly different than that of the rest of
+VFS. If any writeback error occurs on the upperdir's filesystem after a
+volatile mount takes place, all sync functions will return an error. Once this
+condition is reached, the filesystem will not recover, and every subsequent sync
+call will return an error, even if the upperdir has not experience a new error
+since the last sync call.
+
When overlay is mounted with "volatile" option, the directory
"$workdir/work/incompat/volatile" is created. During next mount, overlay
checks for this directory and refuses to mount if present. This is a strong
diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
index a1f72ac053e5..5c5c3972ebd0 100644
--- a/fs/overlayfs/file.c
+++ b/fs/overlayfs/file.c
@@ -445,8 +445,9 @@ static int ovl_fsync(struct file *file, loff_t start, loff_t end, int datasync)
const struct cred *old_cred;
int ret;
- if (!ovl_should_sync(OVL_FS(file_inode(file)->i_sb)))
- return 0;
+ ret = ovl_sync_status(OVL_FS(file_inode(file)->i_sb));
+ if (ret <= 0)
+ return ret;
ret = ovl_real_fdget_meta(file, &real, !datasync);
if (ret)
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index f8880aa2ba0e..9f7af98ae200 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -322,6 +322,7 @@ int ovl_check_metacopy_xattr(struct ovl_fs *ofs, struct dentry *dentry);
bool ovl_is_metacopy_dentry(struct dentry *dentry);
char *ovl_get_redirect_xattr(struct ovl_fs *ofs, struct dentry *dentry,
int padding);
+int ovl_sync_status(struct ovl_fs *ofs);
static inline bool ovl_is_impuredir(struct super_block *sb,
struct dentry *dentry)
diff --git a/fs/overlayfs/ovl_entry.h b/fs/overlayfs/ovl_entry.h
index 1b5a2094df8e..b208eba5d0b6 100644
--- a/fs/overlayfs/ovl_entry.h
+++ b/fs/overlayfs/ovl_entry.h
@@ -79,6 +79,8 @@ struct ovl_fs {
atomic_long_t last_ino;
/* Whiteout dentry cache */
struct dentry *whiteout;
+ /* r/o snapshot of upperdir sb's only taken on volatile mounts */
+ errseq_t errseq;
};
static inline struct vfsmount *ovl_upper_mnt(struct ovl_fs *ofs)
diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
index 01620ebae1bd..a273ef901e57 100644
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -909,8 +909,9 @@ static int ovl_dir_fsync(struct file *file, loff_t start, loff_t end,
struct file *realfile;
int err;
- if (!ovl_should_sync(OVL_FS(file->f_path.dentry->d_sb)))
- return 0;
+ err = ovl_sync_status(OVL_FS(file->f_path.dentry->d_sb));
+ if (err <= 0)
+ return err;
realfile = ovl_dir_real_file(file, true);
err = PTR_ERR_OR_ZERO(realfile);
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 290983bcfbb3..d23177a53c95 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -261,11 +261,20 @@ static int ovl_sync_fs(struct super_block *sb, int wait)
struct super_block *upper_sb;
int ret;
- if (!ovl_upper_mnt(ofs))
- return 0;
+ ret = ovl_sync_status(ofs);
+ /*
+ * We have to always set the err, because the return value isn't
+ * checked in syncfs, and instead indirectly return an error via
+ * the sb's writeback errseq, which VFS inspects after this call.
+ */
+ if (ret < 0) {
+ errseq_set(&sb->s_wb_err, -EIO);
+ return -EIO;
+ }
+
+ if (!ret)
+ return ret;
- if (!ovl_should_sync(ofs))
- return 0;
/*
* Not called for sync(2) call or an emergency sync (SB_I_SKIP_SYNC).
* All the super blocks will be iterated, including upper_sb.
@@ -1927,6 +1936,8 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
sb->s_op = &ovl_super_operations;
if (ofs->config.upperdir) {
+ struct super_block *upper_sb;
+
if (!ofs->config.workdir) {
pr_err("missing 'workdir'\n");
goto out_err;
@@ -1936,6 +1947,16 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
if (err)
goto out_err;
+ upper_sb = ovl_upper_mnt(ofs)->mnt_sb;
+ if (!ovl_should_sync(ofs)) {
+ ofs->errseq = errseq_sample(&upper_sb->s_wb_err);
+ if (errseq_check(&upper_sb->s_wb_err, ofs->errseq)) {
+ err = -EIO;
+ pr_err("Cannot mount volatile when upperdir has an unseen error. Sync upperdir fs to clear state.\n");
+ goto out_err;
+ }
+ }
+
err = ovl_get_workdir(sb, ofs, &upperpath);
if (err)
goto out_err;
@@ -1943,9 +1964,8 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
if (!ofs->workdir)
sb->s_flags |= SB_RDONLY;
- sb->s_stack_depth = ovl_upper_mnt(ofs)->mnt_sb->s_stack_depth;
- sb->s_time_gran = ovl_upper_mnt(ofs)->mnt_sb->s_time_gran;
-
+ sb->s_stack_depth = upper_sb->s_stack_depth;
+ sb->s_time_gran = upper_sb->s_time_gran;
}
oe = ovl_get_lowerstack(sb, splitlower, numlower, ofs, layers);
err = PTR_ERR(oe);
diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
index 23f475627d07..6e7b8c882045 100644
--- a/fs/overlayfs/util.c
+++ b/fs/overlayfs/util.c
@@ -950,3 +950,30 @@ char *ovl_get_redirect_xattr(struct ovl_fs *ofs, struct dentry *dentry,
kfree(buf);
return ERR_PTR(res);
}
+
+/*
+ * ovl_sync_status() - Check fs sync status for volatile mounts
+ *
+ * Returns 1 if this is not a volatile mount and a real sync is required.
+ *
+ * Returns 0 if syncing can be skipped because mount is volatile, and no errors
+ * have occurred on the upperdir since the mount.
+ *
+ * Returns -errno if it is a volatile mount, and the error that occurred since
+ * the last mount. If the error code changes, it'll return the latest error
+ * code.
+ */
+
+int ovl_sync_status(struct ovl_fs *ofs)
+{
+ struct vfsmount *mnt;
+
+ if (ovl_should_sync(ofs))
+ return 1;
+
+ mnt = ovl_upper_mnt(ofs);
+ if (!mnt)
+ return 0;
+
+ return errseq_check(&mnt->mnt_sb->s_wb_err, ofs->errseq);
+}
--
2.25.1
commit dca5244d2f5b94f1809f0c02a549edf41ccd5493 upstream.
GCC versions >= 4.9 and < 5.1 have been shown to emit memory references
beyond the stack pointer, resulting in memory corruption if an interrupt
is taken after the stack pointer has been adjusted but before the
reference has been executed. This leads to subtle, infrequent data
corruption such as the EXT4 problems reported by Russell King at the
link below.
Life is too short for buggy compilers, so raise the minimum GCC version
required by arm64 to 5.1.
Reported-by: Russell King <linux(a)armlinux.org.uk>
Suggested-by: Arnd Bergmann <arnd(a)kernel.org>
Signed-off-by: Will Deacon <will(a)kernel.org>
Tested-by: Nathan Chancellor <natechancellor(a)gmail.com>
Reviewed-by: Nick Desaulniers <ndesaulniers(a)google.com>
Reviewed-by: Nathan Chancellor <natechancellor(a)gmail.com>
Acked-by: Linus Torvalds <torvalds(a)linux-foundation.org>
Cc: <stable(a)vger.kernel.org> # 4.19.y and 5.4.y only
Cc: Theodore Ts'o <tytso(a)mit.edu>
Cc: Florian Weimer <fweimer(a)redhat.com>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Nick Desaulniers <ndesaulniers(a)google.com>
Link: https://lore.kernel.org/r/20210105154726.GD1551@shell.armlinux.org.uk
Link: https://lore.kernel.org/r/20210112224832.10980-1-will@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com>
[will: backport to 4.19.y/5.4.y]
Signed-off-by: Will Deacon <will(a)kernel.org>
---
include/linux/compiler-gcc.h | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index 14be09537109..a80d6de3c8ad 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -12,6 +12,12 @@
#if GCC_VERSION < 40600
# error Sorry, your compiler is too old - please upgrade it.
+#elif defined(CONFIG_ARM64) && GCC_VERSION < 50100
+/*
+ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63293
+ * https://lore.kernel.org/r/20210107111841.GN1551@shell.armlinux.org.uk
+ */
+# error Sorry, your version of GCC is too old - please use 5.1 or newer.
#endif
/*
--
2.30.0.284.gd98b1dd5eaa7-goog
While reviewing Christian's annotation patch I noticed that we have a
user-after-free for the WAIT_FOR_SUBMIT case: We drop the syncobj
reference before we've completed the waiting.
Of course usually there's nothing bad happening here since userspace
keeps the reference, but we can't rely on userspace to play nice here!
Signed-off-by: Daniel Vetter <daniel.vetter(a)intel.com>
Fixes: bc9c80fe01a2 ("drm/syncobj: use the timeline point in drm_syncobj_find_fence v4")
Cc: Christian König <christian.koenig(a)amd.com>
Cc: Lionel Landwerlin <lionel.g.landwerlin(a)intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com>
Cc: Maxime Ripard <mripard(a)kernel.org>
Cc: Thomas Zimmermann <tzimmermann(a)suse.de>
Cc: David Airlie <airlied(a)linux.ie>
Cc: Daniel Vetter <daniel(a)ffwll.ch>
Cc: dri-devel(a)lists.freedesktop.org
Cc: <stable(a)vger.kernel.org> # v5.2+
---
drivers/gpu/drm/drm_syncobj.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index 6e74e6745eca..349146049849 100644
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -388,19 +388,18 @@ int drm_syncobj_find_fence(struct drm_file *file_private,
return -ENOENT;
*fence = drm_syncobj_fence_get(syncobj);
- drm_syncobj_put(syncobj);
if (*fence) {
ret = dma_fence_chain_find_seqno(fence, point);
if (!ret)
- return 0;
+ goto out;
dma_fence_put(*fence);
} else {
ret = -EINVAL;
}
if (!(flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT))
- return ret;
+ goto out;
memset(&wait, 0, sizeof(wait));
wait.task = current;
@@ -432,6 +431,9 @@ int drm_syncobj_find_fence(struct drm_file *file_private,
if (wait.node.next)
drm_syncobj_remove_wait(syncobj, &wait);
+out:
+ drm_syncobj_put(syncobj);
+
return ret;
}
EXPORT_SYMBOL(drm_syncobj_find_fence);
--
2.30.0
If we enable_breadcrumbs for a request while that request is being
removed from HW; we may see that the request is active as we take the
ce->signal_lock and proceed to attach the request to ce->signals.
However, during unsubmission after marking the request as inactive, we
see that the request has not yet been added to ce->signals and so skip
the removal. Pull the check during cancel_breadcrumbs under the same
spinlock as enabling so that we the two tests are consistent in
enable/cancel.
Otherwise, we may insert a request onto ce->signal that we expect should
not be there:
intel_context_remove_breadcrumbs:488 GEM_BUG_ON(!__i915_request_is_complete(rq))
While updating, we can note that we are always called with
irqs-disabled, due to the engine->active.lock being held at the single
caller, and so remove the irqsave/restore.
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2931
Fixes: c18636f76344 ("drm/i915: Remove requirement for holding i915_request.lock for breadcrumbs")
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com>
Cc: Andi Shyti <andi.shyti(a)intel.com>
Cc: <stable(a)vger.kernel.org> # v5.10+
---
drivers/gpu/drm/i915/gt/intel_breadcrumbs.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_breadcrumbs.c b/drivers/gpu/drm/i915/gt/intel_breadcrumbs.c
index d098fc0c14ec..34a645d6babd 100644
--- a/drivers/gpu/drm/i915/gt/intel_breadcrumbs.c
+++ b/drivers/gpu/drm/i915/gt/intel_breadcrumbs.c
@@ -453,16 +453,17 @@ void i915_request_cancel_breadcrumb(struct i915_request *rq)
{
struct intel_breadcrumbs *b = READ_ONCE(rq->engine)->breadcrumbs;
struct intel_context *ce = rq->context;
- unsigned long flags;
bool release;
- if (!test_and_clear_bit(I915_FENCE_FLAG_SIGNAL, &rq->fence.flags))
+ spin_lock(&ce->signal_lock);
+ if (!test_and_clear_bit(I915_FENCE_FLAG_SIGNAL, &rq->fence.flags)) {
+ spin_unlock(&ce->signal_lock);
return;
+ }
- spin_lock_irqsave(&ce->signal_lock, flags);
list_del_rcu(&rq->signal_link);
release = remove_signaling_context(b, ce);
- spin_unlock_irqrestore(&ce->signal_lock, flags);
+ spin_unlock(&ce->signal_lock);
if (release)
intel_context_put(ce);
--
2.20.1
commit dca5244d2f5b94f1809f0c02a549edf41ccd5493 upstream.
GCC versions >= 4.9 and < 5.1 have been shown to emit memory references
beyond the stack pointer, resulting in memory corruption if an interrupt
is taken after the stack pointer has been adjusted but before the
reference has been executed. This leads to subtle, infrequent data
corruption such as the EXT4 problems reported by Russell King at the
link below.
Life is too short for buggy compilers, so raise the minimum GCC version
required by arm64 to 5.1.
Reported-by: Russell King <linux(a)armlinux.org.uk>
Suggested-by: Arnd Bergmann <arnd(a)kernel.org>
Signed-off-by: Will Deacon <will(a)kernel.org>
Tested-by: Nathan Chancellor <natechancellor(a)gmail.com>
Reviewed-by: Nick Desaulniers <ndesaulniers(a)google.com>
Reviewed-by: Nathan Chancellor <natechancellor(a)gmail.com>
Acked-by: Linus Torvalds <torvalds(a)linux-foundation.org>
Cc: <stable(a)vger.kernel.org> # 4.4.y, 4.9.y and 4.14.y only
Cc: Theodore Ts'o <tytso(a)mit.edu>
Cc: Florian Weimer <fweimer(a)redhat.com>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Nick Desaulniers <ndesaulniers(a)google.com>
Link: https://lore.kernel.org/r/20210105154726.GD1551@shell.armlinux.org.uk
Link: https://lore.kernel.org/r/20210112224832.10980-1-will@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com>
[will: backport to 4.4.y/4.9.y/4.14.y]
Signed-off-by: Will Deacon <will(a)kernel.org>
---
include/linux/compiler-gcc.h | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index af8b4a879934..3cc8adede67b 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -145,6 +145,12 @@
#if GCC_VERSION < 30200
# error Sorry, your compiler is too old - please upgrade it.
+#elif defined(CONFIG_ARM64) && GCC_VERSION < 50100
+/*
+ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63293
+ * https://lore.kernel.org/r/20210107111841.GN1551@shell.armlinux.org.uk
+ */
+# error Sorry, your version of GCC is too old - please use 5.1 or newer.
#endif
#if GCC_VERSION < 30300
--
2.30.0.284.gd98b1dd5eaa7-goog
Once the command ring doorbell is rung the xHC controller will parse all
command TRBs on the command ring that have the cycle bit set properly.
If the driver just started writing the next command TRB to the ring when
hardware finished the previous TRB, then HW might fetch an incomplete TRB
as long as its cycle bit set correctly.
A command TRB is 16 bytes (128 bits) long.
Driver writes the command TRB in four 32 bit chunks, with the chunk
containing the cycle bit last. This does however not guarantee that
chunks actually get written in that order.
This was detected in stress testing when canceling URBs with several
connected USB devices.
Two consecutive "Set TR Dequeue pointer" commands got queued right
after each other, and the second one was only partially written when
the controller parsed it, causing the dequeue pointer to be set
to bogus values. This was seen as error messages:
"Mismatch between completed Set TR Deq Ptr command & xHCI internal state"
Solution is to add a write memory barrier before writing the cycle bit.
Cc: <stable(a)vger.kernel.org>
Tested-by: Ross Zwisler <zwisler(a)google.com>
Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com>
---
drivers/usb/host/xhci-ring.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 5677b81c0915..cf0c93a90200 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2931,6 +2931,8 @@ static void queue_trb(struct xhci_hcd *xhci, struct xhci_ring *ring,
trb->field[0] = cpu_to_le32(field1);
trb->field[1] = cpu_to_le32(field2);
trb->field[2] = cpu_to_le32(field3);
+ /* make sure TRB is fully written before giving it to the controller */
+ wmb();
trb->field[3] = cpu_to_le32(field4);
trace_xhci_queue_trb(ring, trb);
--
2.25.1
Issuing a 'reboot' command in i.MX5 leads to the following flow:
[ 24.557742] [<c0769b78>] (msm_atomic_commit_tail) from [<c06db0b4>]
(commit_tail+0xa4/0x1b0)
[ 24.566349] [<c06db0b4>] (commit_tail) from [<c06dbed0>]
(drm_atomic_helper_commit+0x154/0x188)
[ 24.575193] [<c06dbed0>] (drm_atomic_helper_commit) from
[<c06db604>] (drm_atomic_helper_disable_all+0x154/0x1c0)
[ 24.585599] [<c06db604>] (drm_atomic_helper_disable_all) from
[<c06db704>] (drm_atomic_helper_shutdown+0x94/0x12c)
[ 24.596094] [<c06db704>] (drm_atomic_helper_shutdown) from
In the i.MX5 case, priv->kms is not populated (as i.MX5 does not use any
of the Qualcomm display controllers), causing a NULL pointer
dereference in msm_atomic_commit_tail():
[ 24.268964] 8<--- cut here ---
[ 24.274602] Unable to handle kernel NULL pointer dereference at
virtual address 00000000
[ 24.283434] pgd = (ptrval)
[ 24.286387] [00000000] *pgd=ca212831
[ 24.290788] Internal error: Oops: 17 [#1] SMP ARM
[ 24.295609] Modules linked in:
[ 24.298777] CPU: 0 PID: 197 Comm: init Not tainted 5.11.0-rc2-next-20210111 #333
[ 24.306276] Hardware name: Freescale i.MX53 (Device Tree Support)
[ 24.312442] PC is at msm_atomic_commit_tail+0x54/0xb9c
[ 24.317743] LR is at commit_tail+0xa4/0x1b0
Fix the problem by calling drm_atomic_helper_shutdown() conditionally.
Cc: <stable(a)vger.kernel.org>
Fixes: 9d5cbf5fe46e ("drm/msm: add shutdown support for display platform_driver")
Suggested-by: Rob Clark <robdclark(a)gmail.com>
Signed-off-by: Fabio Estevam <festevam(a)gmail.com>
---
Changes since v1:
- Explain in the commit log that the problem happens after a 'reboot' command.
drivers/gpu/drm/msm/msm_drv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 108c405e03dd..c082b72b9e3b 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -1311,7 +1311,8 @@ static void msm_pdev_shutdown(struct platform_device *pdev)
{
struct drm_device *drm = platform_get_drvdata(pdev);
- drm_atomic_helper_shutdown(drm);
+ if (get_mdp_ver(pdev))
+ drm_atomic_helper_shutdown(drm);
}
static const struct of_device_id dt_match[] = {
--
2.25.1
This patch ensures that when `nvme_map_data()` fails to map the
addresses in a scatter/gather list:
* The addresses are not incorrectly unmapped. The underlying
scatter/gather code unmaps the addresses after detecting a failure.
Thus, unmapping them again in the driver is a bug.
* The DMA pool allocations are not deallocated when they were never
allocated.
The bug that motivated this patch was the following sequence, which
occurred within the NVMe driver, with the kernel flag `swiotlb=force`.
* NVMe driver calls dma_direct_map_sg()
* dma_direct_map_sg() fails part way through the scatter gather/list
* dma_direct_map_sg() calls dma_direct_unmap_sg() to unmap any entries
succeeded.
* NVMe driver calls dma_direct_unmap_sg(), redundantly, leading to a
double unmap, which is a bug.
Before this patch, I observed intermittent application- and VM-level
failures when running a benchmark, fio, in an AMD SEV guest. This patch
resolves the failures.
Tested-by: Marc Orr <marcorr(a)google.com>
Cc: stable(a)vger.kernel.org
Signed-off-by: Marc Orr <marcorr(a)google.com>
---
drivers/nvme/host/pci.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 9b1fc8633cfe..8b504ed08321 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -543,11 +543,14 @@ static void nvme_unmap_data(struct nvme_dev *dev, struct request *req)
WARN_ON_ONCE(!iod->nents);
- if (is_pci_p2pdma_page(sg_page(iod->sg)))
- pci_p2pdma_unmap_sg(dev->dev, iod->sg, iod->nents,
- rq_dma_dir(req));
- else
- dma_unmap_sg(dev->dev, iod->sg, iod->nents, rq_dma_dir(req));
+ if (!dma_mapping_error(dev->dev, iod->first_dma)) {
+ if (is_pci_p2pdma_page(sg_page(iod->sg)))
+ pci_p2pdma_unmap_sg(dev->dev, iod->sg, iod->nents,
+ rq_dma_dir(req));
+ else
+ dma_unmap_sg(dev->dev, iod->sg, iod->nents,
+ rq_dma_dir(req));
+ }
if (iod->npages == 0)
@@ -836,8 +839,11 @@ static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req,
else
nr_mapped = dma_map_sg_attrs(dev->dev, iod->sg, iod->nents,
rq_dma_dir(req), DMA_ATTR_NO_WARN);
- if (!nr_mapped)
+ if (!nr_mapped) {
+ iod->first_dma = DMA_MAPPING_ERROR;
+ iod->npages = -1;
goto out;
+ }
iod->use_sgl = nvme_pci_use_sgls(dev, req);
if (iod->use_sgl)
--
2.30.0.284.gd98b1dd5eaa7-goog
Issuing a 'reboot' command in i.MX5 leads to the following flow:
[ 24.557742] [<c0769b78>] (msm_atomic_commit_tail) from [<c06db0b4>]
(commit_tail+0xa4/0x1b0)
[ 24.566349] [<c06db0b4>] (commit_tail) from [<c06dbed0>]
(drm_atomic_helper_commit+0x154/0x188)
[ 24.575193] [<c06dbed0>] (drm_atomic_helper_commit) from
[<c06db604>] (drm_atomic_helper_disable_all+0x154/0x1c0)
[ 24.585599] [<c06db604>] (drm_atomic_helper_disable_all) from
[<c06db704>] (drm_atomic_helper_shutdown+0x94/0x12c)
[ 24.596094] [<c06db704>] (drm_atomic_helper_shutdown) from
In the i.MX5 case, priv->kms is not populated (as i.MX5 does not use any
of the Qualcomm display controllers), causing a NULL pointer
dereference in msm_atomic_commit_tail():
[ 24.268964] 8<--- cut here ---
[ 24.274602] Unable to handle kernel NULL pointer dereference at
virtual address 00000000
[ 24.283434] pgd = (ptrval)
[ 24.286387] [00000000] *pgd=ca212831
[ 24.290788] Internal error: Oops: 17 [#1] SMP ARM
[ 24.295609] Modules linked in:
[ 24.298777] CPU: 0 PID: 197 Comm: init Not tainted 5.11.0-rc2-next-20210111 #333
[ 24.306276] Hardware name: Freescale i.MX53 (Device Tree Support)
[ 24.312442] PC is at msm_atomic_commit_tail+0x54/0xb9c
[ 24.317743] LR is at commit_tail+0xa4/0x1b0
Fix the problem by calling drm_atomic_helper_shutdown() conditionally.
Cc: <stable(a)vger.kernel.org>
Fixes: 9d5cbf5fe46e ("drm/msm: add shutdown support for display platform_driver")
Suggested-by: Rob Clark <robdclark(a)gmail.com>
Signed-off-by: Fabio Estevam <festevam(a)gmail.com>
---
Changes since v1:
- Explain in the commit log that the problem happens after a 'reboot' command.
drivers/gpu/drm/msm/msm_drv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 108c405e03dd..c082b72b9e3b 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -1311,7 +1311,8 @@ static void msm_pdev_shutdown(struct platform_device *pdev)
{
struct drm_device *drm = platform_get_drvdata(pdev);
- drm_atomic_helper_shutdown(drm);
+ if (get_mdp_ver(pdev))
+ drm_atomic_helper_shutdown(drm);
}
static const struct of_device_id dt_match[] = {
--
2.25.1
In commit d68b295 ("dm crypt: use GFP_ATOMIC when allocating crypto requests
from softirq") I wrongly copy pasted crypto request allocation code from
crypt_alloc_req_skcipher to crypt_alloc_req_aead. It is OK from runtime
perspective as both simple encryption request pointer and AEAD request pointer
are part of a union, but may confuse code reviewers.
Fixes: d68b295 ("dm crypt: use GFP_ATOMIC when allocating crypto requests from softirq")
Cc: stable(a)vger.kernel.org # v5.9+
Reported-by: Pavel Machek <pavel(a)denx.de>
Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com>
---
drivers/md/dm-crypt.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 8c874710f0bc..5a55617a08e6 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1481,9 +1481,9 @@ static int crypt_alloc_req_skcipher(struct crypt_config *cc,
static int crypt_alloc_req_aead(struct crypt_config *cc,
struct convert_context *ctx)
{
- if (!ctx->r.req) {
- ctx->r.req = mempool_alloc(&cc->req_pool, in_interrupt() ? GFP_ATOMIC : GFP_NOIO);
- if (!ctx->r.req)
+ if (!ctx->r.req_aead) {
+ ctx->r.req_aead = mempool_alloc(&cc->req_pool, in_interrupt() ? GFP_ATOMIC : GFP_NOIO);
+ if (!ctx->r.req_aead)
return -ENOMEM;
}
--
2.20.1
The patch titled
Subject: proc_sysctl: fix oops caused by incorrect command parameters
has been added to the -mm tree. Its filename is
proc_sysctl-fix-oops-caused-by-incorrect-command-parameters.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/proc_sysctl-fix-oops-caused-by-in…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/proc_sysctl-fix-oops-caused-by-in…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Xiaoming Ni <nixiaoming(a)huawei.com>
Subject: proc_sysctl: fix oops caused by incorrect command parameters
The process_sysctl_arg() does not check whether val is empty before
invoking strlen(val). If the command line parameter () is incorrectly
configured and val is empty, oops is triggered.
For example:
"hung_task_panic=1" is incorrectly written as "hung_task_panic", oops is
triggered. The call stack is as follows:
Kernel command line: .... hung_task_panic
......
Call trace:
__pi_strlen+0x10/0x98
parse_args+0x278/0x344
do_sysctl_args+0x8c/0xfc
kernel_init+0x5c/0xf4
ret_from_fork+0x10/0x30
To fix it, check whether "val" is empty when "phram" is a sysctl field.
Error codes are returned in the failure branch, and error logs are
generated by parse_args().
Link: https://lkml.kernel.org/r/20210118133029.28580-1-nixiaoming@huawei.com
Fixes: 3db978d480e2843 ("kernel/sysctl: support setting sysctl parameters from kernel command line")
Signed-off-by: Xiaoming Ni <nixiaoming(a)huawei.com>
Acked-by: Vlastimil Babka <vbabka(a)suse.cz>
Cc: Luis Chamberlain <mcgrof(a)kernel.org>
Cc: Kees Cook <keescook(a)chromium.org>
Cc: Iurii Zaikin <yzaikin(a)google.com>
Cc: Alexey Dobriyan <adobriyan(a)gmail.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Masami Hiramatsu <mhiramat(a)kernel.org>
Cc: Heiner Kallweit <hkallweit1(a)gmail.com>
Cc: Randy Dunlap <rdunlap(a)infradead.org>
Cc: <stable(a)vger.kernel.org> [5.8+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/proc/proc_sysctl.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/fs/proc/proc_sysctl.c~proc_sysctl-fix-oops-caused-by-incorrect-command-parameters
+++ a/fs/proc/proc_sysctl.c
@@ -1770,6 +1770,12 @@ static int process_sysctl_arg(char *para
return 0;
}
+ if (!val)
+ return -EINVAL;
+ len = strlen(val);
+ if (len == 0)
+ return -EINVAL;
+
/*
* To set sysctl options, we use a temporary mount of proc, look up the
* respective sys/ file and write to it. To avoid mounting it when no
@@ -1811,7 +1817,6 @@ static int process_sysctl_arg(char *para
file, param, val);
goto out;
}
- len = strlen(val);
wret = kernel_write(file, val, len, &pos);
if (wret < 0) {
err = wret;
_
Patches currently in -mm which might be from nixiaoming(a)huawei.com are
proc_sysctl-fix-oops-caused-by-incorrect-command-parameters.patch