Now tuning reset will be done when the timing is MMC_TIMING_LEGACY/
MMC_TIMING_MMC_HS/MMC_TIMING_SD_HS. But for timing MMC_TIMING_MMC_HS,
we can not do tuning reset, otherwise HS400 timing is not right.
Here is the process of init HS400, first finish tuning in HS200 mode,
then switch to HS mode and 8 bit DDR mode, finally switch to HS400
mode. If we do tuning reset in HS mode, this will cause HS400 mode
lost the tuning setting, which will cause CRC error.
This fix commit d9370424c948 ("mmc: sdhci-esdhc-imx: reset tuning
circuit when power on mmc card").
Signed-off-by: Haibo Chen <haibo.chen(a)nxp.com>
Cc: stable(a)vger.kernel.org # v4.12+
---
drivers/mmc/host/sdhci-esdhc-imx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index d0d319398a54..984cc1a788cb 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -979,6 +979,7 @@ static void esdhc_set_uhs_signaling(struct sdhci_host *host, unsigned timing)
case MMC_TIMING_UHS_SDR25:
case MMC_TIMING_UHS_SDR50:
case MMC_TIMING_UHS_SDR104:
+ case MMC_TIMING_MMC_HS:
case MMC_TIMING_MMC_HS200:
writel(m, host->ioaddr + ESDHC_MIX_CTRL);
break;
--
2.17.1
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 1b3922a8bc74231f9a767d1be6d9a061a4d4eeab Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu(a)suse.com>
Date: Tue, 8 Jan 2019 14:08:18 +0800
Subject: [PATCH] btrfs: Use real device structure to verify dev extent
[BUG]
Linux v5.0-rc1 will fail fstests/btrfs/163 with the following kernel
message:
BTRFS error (device dm-6): dev extent devid 1 physical offset 13631488 len 8388608 is beyond device boundary 0
BTRFS error (device dm-6): failed to verify dev extents against chunks: -117
BTRFS error (device dm-6): open_ctree failed
[CAUSE]
Commit cf90d884b347 ("btrfs: Introduce mount time chunk <-> dev extent
mapping check") introduced strict check on dev extents.
We use btrfs_find_device() with dev uuid and fs uuid set to NULL, and
only dependent on @devid to find the real device.
For seed devices, we call clone_fs_devices() in open_seed_devices() to
allow us search seed devices directly.
However clone_fs_devices() just populates devices with devid and dev
uuid, without populating other essential members, like disk_total_bytes.
This makes any device returned by btrfs_find_device(fs_info, devid,
NULL, NULL) is just a dummy, with 0 disk_total_bytes, and any dev
extents on the seed device will not pass the device boundary check.
[FIX]
This patch will try to verify the device returned by btrfs_find_device()
and if it's a dummy then re-search in seed devices.
Fixes: cf90d884b347 ("btrfs: Introduce mount time chunk <-> dev extent mapping check")
CC: stable(a)vger.kernel.org # 4.19+
Reported-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: Qu Wenruo <wqu(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 2576b1a379c9..3e4f8f88353e 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -7825,6 +7825,18 @@ static int verify_one_dev_extent(struct btrfs_fs_info *fs_info,
ret = -EUCLEAN;
goto out;
}
+
+ /* It's possible this device is a dummy for seed device */
+ if (dev->disk_total_bytes == 0) {
+ dev = find_device(fs_info->fs_devices->seed, devid, NULL);
+ if (!dev) {
+ btrfs_err(fs_info, "failed to find seed devid %llu",
+ devid);
+ ret = -EUCLEAN;
+ goto out;
+ }
+ }
+
if (physical_offset + physical_len > dev->disk_total_bytes) {
btrfs_err(fs_info,
"dev extent devid %llu physical offset %llu len %llu is beyond device boundary %llu",
Commit e1c3743e1a20 ("powerpc/tm: Set MSR[TS] just prior to recheckpoint")
moved a code block around and this block uses a 'msr' variable outside of
the CONFIG_PPC_TRANSACTIONAL_MEM, however the 'msr' variable is declared
inside a CONFIG_PPC_TRANSACTIONAL_MEM block, causing a possible error when
CONFIG_PPC_TRANSACTION_MEM is not defined.
error: 'msr' undeclared (first use in this function)
This is not causing a compilation error in the mainline kernel, because
'msr' is being used as an argument of MSR_TM_ACTIVE(), which is defined as
the following when CONFIG_PPC_TRANSACTIONAL_MEM is *not* set:
#define MSR_TM_ACTIVE(x) 0
This patch just fixes this issue avoiding the 'msr' variable usage outside
the CONFIG_PPC_TRANSACTIONAL_MEM block, avoiding trusting in the
MSR_TM_ACTIVE() definition.
Cc: stable(a)vger.kernel.org
Reported-by: Christoph Biedl <linux-kernel.bfrz(a)manchmal.in-ulm.de>
Fixes: e1c3743e1a20 ("powerpc/tm: Set MSR[TS] just prior to recheckpoint")
Signed-off-by: Breno Leitao <leitao(a)debian.org>
---
NB: Since stable kernels didn't cherry picked 5c784c8414fba ('powerpc/tm:
Remove msr_tm_active()), MSR_TM_ACTIVE() is not defined as 0 for
CONFIG_PPC_TRANSACTIONAL_MEM=n case, thus triggering the compilation error
above.
Tested against stable kernel 4.19.13-rc2 and problem is now fixed when
CONFIG_PPC_TRANSACTIONAL_MEM=n
arch/powerpc/kernel/signal_64.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index daa28cb72272..8fe698162ab9 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -739,11 +739,12 @@ SYSCALL_DEFINE0(rt_sigreturn)
if (restore_tm_sigcontexts(current, &uc->uc_mcontext,
&uc_transact->uc_mcontext))
goto badframe;
- }
+ } else
#endif
- /* Fall through, for non-TM restore */
- if (!MSR_TM_ACTIVE(msr)) {
+ {
/*
+ * Fall through, for non-TM restore
+ *
* Unset MSR[TS] on the thread regs since MSR from user
* context does not have MSR active, and recheckpoint was
* not called since restore_tm_sigcontexts() was not called
--
2.19.0
The patch below does not apply to the 4.20-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 1b3922a8bc74231f9a767d1be6d9a061a4d4eeab Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu(a)suse.com>
Date: Tue, 8 Jan 2019 14:08:18 +0800
Subject: [PATCH] btrfs: Use real device structure to verify dev extent
[BUG]
Linux v5.0-rc1 will fail fstests/btrfs/163 with the following kernel
message:
BTRFS error (device dm-6): dev extent devid 1 physical offset 13631488 len 8388608 is beyond device boundary 0
BTRFS error (device dm-6): failed to verify dev extents against chunks: -117
BTRFS error (device dm-6): open_ctree failed
[CAUSE]
Commit cf90d884b347 ("btrfs: Introduce mount time chunk <-> dev extent
mapping check") introduced strict check on dev extents.
We use btrfs_find_device() with dev uuid and fs uuid set to NULL, and
only dependent on @devid to find the real device.
For seed devices, we call clone_fs_devices() in open_seed_devices() to
allow us search seed devices directly.
However clone_fs_devices() just populates devices with devid and dev
uuid, without populating other essential members, like disk_total_bytes.
This makes any device returned by btrfs_find_device(fs_info, devid,
NULL, NULL) is just a dummy, with 0 disk_total_bytes, and any dev
extents on the seed device will not pass the device boundary check.
[FIX]
This patch will try to verify the device returned by btrfs_find_device()
and if it's a dummy then re-search in seed devices.
Fixes: cf90d884b347 ("btrfs: Introduce mount time chunk <-> dev extent mapping check")
CC: stable(a)vger.kernel.org # 4.19+
Reported-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: Qu Wenruo <wqu(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 2576b1a379c9..3e4f8f88353e 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -7825,6 +7825,18 @@ static int verify_one_dev_extent(struct btrfs_fs_info *fs_info,
ret = -EUCLEAN;
goto out;
}
+
+ /* It's possible this device is a dummy for seed device */
+ if (dev->disk_total_bytes == 0) {
+ dev = find_device(fs_info->fs_devices->seed, devid, NULL);
+ if (!dev) {
+ btrfs_err(fs_info, "failed to find seed devid %llu",
+ devid);
+ ret = -EUCLEAN;
+ goto out;
+ }
+ }
+
if (physical_offset + physical_len > dev->disk_total_bytes) {
btrfs_err(fs_info,
"dev extent devid %llu physical offset %llu len %llu is beyond device boundary %llu",
This is the start of the stable review cycle for the 4.20.2 release.
There are 65 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun Jan 13 13:10:14 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.20.2-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.20.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.20.2-rc1
Enric Balletbo i Serra <enric.balletbo(a)collabora.com>
drm/rockchip: psr: do not dereference encoder before it is null checked.
Boris Brezillon <boris.brezillon(a)bootlin.com>
drm/vc4: Set ->is_yuv to false when num_planes == 1
Lyude Paul <lyude(a)redhat.com>
drm/nouveau/drm/nouveau: Check rc from drm_dp_mst_topology_mgr_resume()
Christophe Leroy <christophe.leroy(a)c-s.fr>
lib: fix build failure in CONFIG_DEBUG_VIRTUAL test
Frank Rowand <frank.rowand(a)sony.com>
of: __of_detach_node() - remove node from phandle cache
Frank Rowand <frank.rowand(a)sony.com>
of: of_node_get()/of_node_put() nodes held in phandle cache
Lubomir Rintel <lkundrak(a)v3.sk>
power: supply: olpc_battery: correct the temperature units
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: msu: Fix an off-by-one in attribute store
Christian Borntraeger <borntraeger(a)de.ibm.com>
genwqe: Fix size check
Shuah Khan <shuah(a)kernel.org>
selftests: Fix test errors related to lib.mk khdr target
Christian Lamparter <chunkeey(a)gmail.com>
powerpc/4xx/ocm: Fix compilation error due to PAGE_KERNEL usage
Shaokun Zhang <zhangshaokun(a)hisilicon.com>
drivers/perf: hisi: Fixup one DDRC PMU register offset
YueHaibing <yuehaibing(a)huawei.com>
video: fbdev: pxafb: Fix "WARNING: invalid free of devm_ allocated data"
Yan, Zheng <zyan(a)redhat.com>
ceph: don't update importing cap's mseq when handing cap export
Linus Torvalds <torvalds(a)linux-foundation.org>
sched/fair: Fix infinite loop in update_blocked_averages() by reverting a9e7f6544b9c
Sohil Mehta <sohil.mehta(a)intel.com>
iommu/vt-d: Handle domain agaw being less than iommu agaw
Steve Wise <swise(a)opengridcomputing.com>
RDMA/iwcm: Don't copy past the end of dev_name() string
Bart Van Assche <bvanassche(a)acm.org>
RDMA/srpt: Fix a use-after-free in the channel release code
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
stm class: Fix a module refcount leak in policy creation error path
Sagi Grimberg <sagi(a)grimberg.me>
rxe: fix error completion wr_id and qp_num
Dominique Martinet <dominique.martinet(a)cea.fr>
9p/net: put a lower bound on msize
Mircea Caprioru <mircea.caprioru(a)analog.com>
iio: dac: ad5686: fix bit shift read register
Evan Green <evgreen(a)chromium.org>
iio: adc: qcom-spmi-adc5: Initialize prescale properly
Breno Leitao <leitao(a)debian.org>
powerpc/tm: Set MSR[TS] just prior to recheckpoint
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "powerpc/tm: Unset MSR[TS] if not recheckpointing"
J. Bruce Fields <bfields(a)redhat.com>
nfsd4: zero-length WRITE should succeed
Chuck Lever <chuck.lever(a)oracle.com>
xprtrdma: Yet another double DMA-unmap
Benjamin Coddington <bcodding(a)redhat.com>
lockd: Show pid of lockd for remote locks
Jarkko Nikula <jarkko.nikula(a)linux.intel.com>
PCI / PM: Allow runtime PM without callback functions
Ondrej Mosnacek <omosnace(a)redhat.com>
selinux: policydb - fix byte order and alignment issues
Larry Finger <Larry.Finger(a)lwfinger.net>
b43: Fix error in cordic routine
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Fix loop in gfs2_rbm_find
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Get rid of potential double-freeing in gfs2_create_inode
Vasily Averin <vvs(a)virtuozzo.com>
dlm: memory leaks on error path in dlm_user_request()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: possible memory leak on error path in create_lkb()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: fixed memory leaks after failed ls_remove_names allocation
Jaegeuk Kim <jaegeuk(a)kernel.org>
dm: do not allow readahead to limit IO size
Damien Le Moal <damien.lemoal(a)wdc.com>
block: mq-deadline: Fix write completion handling
Ming Lei <ming.lei(a)redhat.com>
block: deactivate blk_stat timer in wbt_disable_default()
Matthew Wilcox <willy(a)infradead.org>
Fix failure path in alloc_pid()
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
driver core: Add missing dev->bus->need_parent_lock checks
Dennis Krein <Dennis.Krein(a)netapp.com>
srcu: Lock srcu_data structure in srcu_gp_start()
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Always check descriptor sizes in parser code
Hui Peng <benquike(a)163.com>
ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Check mixer unit descriptors more strictly
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
Dan Carpenter <dan.carpenter(a)oracle.com>
ALSA: cs46xx: Potential NULL dereference in probe
Brad Love <brad(a)nextdimension.cc>
media: cx23885: only reset DMA on problematic CPUs
Huang Ying <ying.huang(a)intel.com>
mm, swap: fix swapoff with KSM pages
Dan Williams <dan.j.williams(a)intel.com>
mm, hmm: mark hmm_devmem_{add, add_resource} EXPORT_SYMBOL_GPL
Dan Williams <dan.j.williams(a)intel.com>
mm, hmm: replace hmm_devmem_pages_create() with devm_memremap_pages()
Dan Williams <dan.j.williams(a)intel.com>
mm, hmm: use devm semantics for hmm_devmem_{add, remove}
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: add MEMORY_DEVICE_PRIVATE support
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: use SVC_NET() in svcauth_gss_* functions
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: fix cache_head leak due to queued request
Michal Hocko <mhocko(a)suse.com>
memcg, oom: notify on oom killer invocation from the charge path
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: fix shutdown handling
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: kill mapping "System RAM" support
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL
Michal Hocko <mhocko(a)suse.com>
hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
Minchan Kim <minchan(a)kernel.org>
zram: fix double free backing device
David Herrmann <dh.herrmann(a)gmail.com>
fork: record start_time late
Ewan D. Milne <emilne(a)redhat.com>
scsi: lpfc: do not set queue->page_count to 0 if pc_sli4_params.wqpcnt is invalid
Steffen Maier <maier(a)linux.ibm.com>
scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
-------------
Diffstat:
Makefile | 4 +-
arch/powerpc/kernel/signal_32.c | 38 ++-
arch/powerpc/kernel/signal_64.c | 64 +++--
arch/powerpc/platforms/4xx/ocm.c | 4 +-
block/blk-mq-sched.c | 3 +-
block/blk-mq-sched.h | 1 +
block/blk-stat.h | 5 +
block/blk-wbt.c | 4 +-
block/mq-deadline.c | 12 +-
drivers/base/dd.c | 4 +-
drivers/block/zram/zram_drv.c | 4 +-
drivers/dax/pmem.c | 14 +-
drivers/gpu/drm/nouveau/dispnv50/disp.c | 12 +-
drivers/gpu/drm/rockchip/rockchip_drm_psr.c | 4 +-
drivers/gpu/drm/vc4/vc4_plane.c | 1 +
drivers/hwtracing/intel_th/msu.c | 3 +-
drivers/hwtracing/stm/policy.c | 12 +-
drivers/iio/adc/qcom-spmi-adc5.c | 58 ++--
drivers/iio/dac/ad5686.c | 3 +-
drivers/infiniband/core/iwcm.c | 12 +-
drivers/infiniband/sw/rxe/rxe_resp.c | 13 +-
drivers/infiniband/ulp/srpt/ib_srpt.c | 18 +-
drivers/iommu/intel-iommu.c | 4 +-
drivers/md/dm-table.c | 3 +
drivers/media/pci/cx23885/cx23885-core.c | 55 +++-
drivers/media/pci/cx23885/cx23885.h | 2 +
drivers/misc/genwqe/card_utils.c | 2 +-
drivers/net/wireless/broadcom/b43/phy_common.c | 2 +-
drivers/nvdimm/pmem.c | 13 +-
drivers/of/base.c | 101 +++++--
drivers/of/dynamic.c | 3 +
drivers/of/of_private.h | 4 +
drivers/pci/p2pdma.c | 10 +-
drivers/pci/pci-driver.c | 27 +-
drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c | 4 +-
drivers/power/supply/olpc_battery.c | 4 +-
drivers/s390/scsi/zfcp_aux.c | 6 +-
drivers/scsi/lpfc/lpfc_sli.c | 3 +-
drivers/video/fbdev/pxafb.c | 4 +-
fs/ceph/caps.c | 1 -
fs/dlm/lock.c | 17 +-
fs/dlm/lockspace.c | 2 +-
fs/gfs2/inode.c | 18 +-
fs/gfs2/rgrp.c | 2 +-
fs/lockd/clntproc.c | 2 +-
fs/lockd/xdr.c | 4 +-
fs/lockd/xdr4.c | 4 +-
fs/nfsd/nfs4proc.c | 2 -
include/linux/hmm.h | 4 +-
include/linux/memremap.h | 2 +
kernel/fork.c | 13 +-
kernel/memremap.c | 94 ++++---
kernel/pid.c | 6 +-
kernel/rcu/srcutree.c | 2 +
kernel/sched/fair.c | 43 +--
lib/test_debug_virtual.c | 1 +
mm/hmm.c | 305 +++------------------
mm/memcontrol.c | 20 +-
mm/memory_hotplug.c | 16 ++
mm/swapfile.c | 3 +-
net/9p/client.c | 21 ++
net/sunrpc/auth_gss/svcauth_gss.c | 8 +-
net/sunrpc/cache.c | 10 +-
net/sunrpc/xprtrdma/frwr_ops.c | 6 +-
net/sunrpc/xprtrdma/verbs.c | 9 +-
security/selinux/ss/policydb.c | 51 +++-
sound/pci/cs46xx/dsp_spos.c | 3 +
sound/usb/card.c | 2 +-
sound/usb/mixer.c | 29 +-
sound/usb/quirks-table.h | 6 +
sound/usb/stream.c | 36 ++-
tools/testing/nvdimm/test/iomap.c | 17 +-
tools/testing/selftests/android/Makefile | 2 +-
tools/testing/selftests/futex/functional/Makefile | 1 +
tools/testing/selftests/gpio/Makefile | 6 +-
tools/testing/selftests/kvm/Makefile | 2 +-
tools/testing/selftests/lib.mk | 8 +-
.../selftests/networking/timestamping/Makefile | 1 +
tools/testing/selftests/tc-testing/bpf/Makefile | 1 +
tools/testing/selftests/vm/Makefile | 1 +
80 files changed, 710 insertions(+), 611 deletions(-)
This is a note to let you know that I've just added the patch titled
mei: me: add denverton innovation engine device IDs
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From f7ee8ead151f9d0b8dac6ab6c3ff49bbe809c564 Mon Sep 17 00:00:00 2001
From: Tomas Winkler <tomas.winkler(a)intel.com>
Date: Sun, 13 Jan 2019 14:24:48 +0200
Subject: mei: me: add denverton innovation engine device IDs
Add the Denverton innovation engine (IE) device ids.
The IE is an ME-like device which provides HW security
offloading.
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Tomas Winkler <tomas.winkler(a)intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin(a)intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/misc/mei/hw-me-regs.h | 2 ++
drivers/misc/mei/pci-me.c | 2 ++
2 files changed, 4 insertions(+)
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index e4b10b2d1a08..23739a60517f 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -127,6 +127,8 @@
#define MEI_DEV_ID_BXT_M 0x1A9A /* Broxton M */
#define MEI_DEV_ID_APL_I 0x5A9A /* Apollo Lake I */
+#define MEI_DEV_ID_DNV_IE 0x19E5 /* Denverton IE */
+
#define MEI_DEV_ID_GLK 0x319A /* Gemini Lake */
#define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index c2bf3e99955e..e89497f858ae 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -93,6 +93,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
{MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, MEI_ME_PCH8_CFG)},
{MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, MEI_ME_PCH8_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_DNV_IE, MEI_ME_PCH8_CFG)},
+
{MEI_PCI_DEVICE(MEI_DEV_ID_GLK, MEI_ME_PCH8_CFG)},
{MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
--
2.20.1
This is a note to let you know that I've just added the patch titled
mei: me: mark LBG devices as having dma support
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 173436ba800d01178a8b19e5de4a8cb02c0db760 Mon Sep 17 00:00:00 2001
From: Alexander Usyskin <alexander.usyskin(a)intel.com>
Date: Sun, 13 Jan 2019 14:24:47 +0200
Subject: mei: me: mark LBG devices as having dma support
The LBG server platform sports DMA support.
Cc: <stable(a)vger.kernel.org> #v5.0+
Signed-off-by: Alexander Usyskin <alexander.usyskin(a)intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler(a)intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/misc/mei/pci-me.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 73ace2d59dea..c2bf3e99955e 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -88,7 +88,7 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, MEI_ME_PCH8_CFG)},
{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, MEI_ME_PCH8_SPS_CFG)},
{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, MEI_ME_PCH8_SPS_CFG)},
- {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH8_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH12_CFG)},
{MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, MEI_ME_PCH8_CFG)},
{MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, MEI_ME_PCH8_CFG)},
--
2.20.1
This is a note to let you know that I've just added the patch titled
mei: dma: silent the reject message
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 82e59cbe5fdc0d521f9037861af21af6d5814afd Mon Sep 17 00:00:00 2001
From: Tomas Winkler <tomas.winkler(a)intel.com>
Date: Sun, 13 Jan 2019 14:24:46 +0200
Subject: mei: dma: silent the reject message
Not all FW versions support DMA on their first release,
hence it is normal behavior to receive a reject response
upon DMA setup request.
In order to prevent confusion, the DMA setup reject message
is printed only in debug level.
Cc: <stable(a)vger.kernel.org> #v5.0+
Signed-off-by: Tomas Winkler <tomas.winkler(a)intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/misc/mei/hbm.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index 78c26cebf5d4..8f7616557c97 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -1187,9 +1187,15 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
dma_setup_res = (struct hbm_dma_setup_response *)mei_msg;
if (dma_setup_res->status) {
- dev_info(dev->dev, "hbm: dma setup response: failure = %d %s\n",
- dma_setup_res->status,
- mei_hbm_status_str(dma_setup_res->status));
+ u8 status = dma_setup_res->status;
+
+ if (status == MEI_HBMS_NOT_ALLOWED) {
+ dev_dbg(dev->dev, "hbm: dma setup not allowed\n");
+ } else {
+ dev_info(dev->dev, "hbm: dma setup response: failure = %d %s\n",
+ status,
+ mei_hbm_status_str(status));
+ }
dev->hbm_f_dr_supported = 0;
mei_dmam_ring_free(dev);
}
--
2.20.1
Kyungtae Kim detected a potential integer overflow in bcm_[rx|tx]_setup() when
the conversion into ktime multiplies the given value with NSEC_PER_USEC (1000).
Reference: https://marc.info/?l=linux-can&m=154732118819828&w=2
Add a check for the given tv_usec, so that the value stays below one second.
Additionally limit the tv_sec value to a reasonable value for CAN related
use-cases of 15 minutes.
Reported-by: Kyungtae Kim <kt0755(a)gmail.com>
Tested-by: Oliver Hartkopp <socketcan(a)hartkopp.net>
Signed-off-by: Oliver Hartkopp <socketcan(a)hartkopp.net>
Cc: linux-stable <stable(a)vger.kernel.org> # >= 2.6.26
---
net/can/bcm.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 0af8f0db892a..ff3799be077b 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -67,6 +67,9 @@
*/
#define MAX_NFRAMES 256
+/* limit timers to 15 minutes for sending/timeouts */
+#define BCM_TIMER_SEC_MAX (15*60)
+
/* use of last_frames[index].flags */
#define RX_RECV 0x40 /* received data for this element */
#define RX_THR 0x80 /* element not been sent due to throttle feature */
@@ -140,6 +143,18 @@ static inline ktime_t bcm_timeval_to_ktime(struct bcm_timeval tv)
return ktime_set(tv.tv_sec, tv.tv_usec * NSEC_PER_USEC);
}
+/* check limitations for timeval provided by user */
+static int bcm_is_invalid_tv(struct bcm_msg_head *msg_head)
+{
+ if ((msg_head->ival1.tv_sec > BCM_TIMER_SEC_MAX) ||
+ (msg_head->ival1.tv_usec >= USEC_PER_SEC) ||
+ (msg_head->ival2.tv_sec > BCM_TIMER_SEC_MAX) ||
+ (msg_head->ival2.tv_usec >= USEC_PER_SEC))
+ return 1;
+
+ return 0;
+}
+
#define CFSIZ(flags) ((flags & CAN_FD_FRAME) ? CANFD_MTU : CAN_MTU)
#define OPSIZ sizeof(struct bcm_op)
#define MHSIZ sizeof(struct bcm_msg_head)
@@ -873,6 +888,10 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
if (msg_head->nframes < 1 || msg_head->nframes > MAX_NFRAMES)
return -EINVAL;
+ /* check timeval limitations */
+ if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head))
+ return -EINVAL;
+
/* check the given can_id */
op = bcm_find_op(&bo->tx_ops, msg_head, ifindex);
if (op) {
@@ -1053,6 +1072,10 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
(!(msg_head->can_id & CAN_RTR_FLAG))))
return -EINVAL;
+ /* check timeval limitations */
+ if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head))
+ return -EINVAL;
+
/* check the given can_id */
op = bcm_find_op(&bo->rx_ops, msg_head, ifindex);
if (op) {
--
2.20.1
I'm announcing the release of the 4.9.150 kernel.
All users of the 4.9 kernel series must upgrade.
The updated 4.9.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y
and can be browsed at the normal kernel.org git web browser:
http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/arm/boot/dts/imx7d-nitrogen7.dts | 9
arch/arm/mach-imx/cpuidle-imx6sx.c | 2
arch/mips/kernel/vdso.c | 4
arch/mips/math-emu/dsemul.c | 38 +-
arch/powerpc/boot/crt0.S | 4
arch/powerpc/kernel/signal_32.c | 20 +
arch/powerpc/kernel/signal_64.c | 44 ++-
arch/x86/crypto/chacha20_glue.c | 1
drivers/gpu/drm/vc4/vc4_plane.c | 1
drivers/hwtracing/intel_th/msu.c | 3
drivers/infiniband/hw/hfi1/verbs.c | 2
drivers/infiniband/sw/rxe/rxe_resp.c | 13 -
drivers/input/keyboard/omap4-keypad.c | 16 -
drivers/iommu/intel-iommu.c | 4
drivers/misc/genwqe/card_utils.c | 2
drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 3
drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 1
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 54 +++-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h | 4
drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 3
drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c | 14 -
drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 15 +
drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 246 +++++++++----------
drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h | 13 -
drivers/net/ethernet/hisilicon/hns/hns_enet.c | 43 +++
drivers/net/ethernet/neterion/vxge/vxge-config.c | 2
drivers/net/ethernet/nuvoton/w90p910_ether.c | 2
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | 3
drivers/net/usb/lan78xx.c | 4
drivers/net/wireless/broadcom/b43/phy_common.c | 2
drivers/pinctrl/meson/pinctrl-meson.c | 3
drivers/power/supply/olpc_battery.c | 4
drivers/s390/scsi/zfcp_aux.c | 6
drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 2
drivers/target/iscsi/cxgbit/cxgbit_cm.c | 5
drivers/target/iscsi/cxgbit/cxgbit_main.c | 1
drivers/tty/serial/sunsu.c | 31 ++
drivers/vhost/vsock.c | 2
fs/ceph/caps.c | 1
fs/dlm/lock.c | 17 -
fs/dlm/lockspace.c | 2
fs/gfs2/inode.c | 18 -
fs/gfs2/rgrp.c | 2
include/uapi/linux/input-event-codes.h | 9
kernel/fork.c | 13 -
kernel/memremap.c | 11
mm/memory_hotplug.c | 16 +
net/9p/client.c | 21 +
net/ceph/auth_x.c | 2
net/netfilter/ipset/ip_set_list_set.c | 2
net/netfilter/nf_conntrack_seqadj.c | 7
net/sunrpc/auth_gss/svcauth_gss.c | 8
net/sunrpc/cache.c | 10
net/sunrpc/xprtsock.c | 4
net/xfrm/xfrm_state.c | 2
scripts/checkstack.pl | 4
sound/pci/cs46xx/dsp_spos.c | 3
sound/usb/mixer.c | 10
sound/usb/quirks-table.h | 3
tools/testing/nvdimm/test/iomap.c | 2
61 files changed, 522 insertions(+), 273 deletions(-)
Alexander Shishkin (1):
intel_th: msu: Fix an off-by-one in attribute store
Andreas Gruenbacher (2):
gfs2: Get rid of potential double-freeing in gfs2_create_inode
gfs2: Fix loop in gfs2_rbm_find
Anson Huang (1):
ARM: imx: update the cpu power up timing setting on i.mx6sx
Arnd Bergmann (1):
w90p910_ether: remove incorrect __init annotation
Benjamin Poirier (1):
xfrm: Fix bucket count reported to userspace
Boris Brezillon (1):
drm/vc4: Set ->is_yuv to false when num_planes == 1
Breno Leitao (1):
powerpc/tm: Set MSR[TS] just prior to recheckpoint
Christian Borntraeger (1):
genwqe: Fix size check
Colin Ian King (1):
vxge: ensure data0 is initialized in when fetching firmware version information
Dan Carpenter (2):
scsi: bnx2fc: Fix NULL dereference in error handling
ALSA: cs46xx: Potential NULL dereference in probe
Dan Williams (2):
mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL
mm, devm_memremap_pages: kill mapping "System RAM" support
David Herrmann (1):
fork: record start_time late
Dominique Martinet (1):
9p/net: put a lower bound on msize
Eric Biggers (1):
crypto: x86/chacha20 - avoid sleeping with preemption disabled
Fabio Estevam (1):
ARM: dts: imx7d-nitrogen7: Fix the description of the Wifi clock
Florian Westphal (1):
netfilter: seqadj: re-load tcp header pointer after possible head reallocation
Greg Kroah-Hartman (1):
Linux 4.9.150
Hui Peng (1):
ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
Ilya Dryomov (1):
libceph: fix CEPH_FEATURE_CEPHX_V2 check in calc_signature()
Ivan Mironov (1):
bnx2x: Fix NULL pointer dereference in bnx2x_del_all_vlans() on some hw
Jason Martinsen (1):
lan78xx: Resolve issue with changing MAC address
Jerome Brunet (1):
pinctrl: meson: fix pull enable register calculation
Kangjie Lu (1):
net: netxen: fix a missing check and an uninitialized use
Larry Finger (1):
b43: Fix error in cordic routine
Lubomir Rintel (1):
power: supply: olpc_battery: correct the temperature units
Michael J. Ruhl (1):
IB/hfi1: Incorrect sizing of sge for PIO will OOPs
Michal Hocko (1):
hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
Nathan Chancellor (1):
drivers: net: xgene: Remove unnecessary forward declarations
Pan Bian (1):
netfilter: ipset: do not call ipset_nest_end after nla_nest_cancel
Paul Burton (1):
MIPS: math-emu: Write-protect delay slot emulation pages
Paul Mackerras (1):
powerpc: Fix COFF zImage booting on old powermacs
Peter Hutterer (1):
Input: restore EV_ABS ABS_RESERVED
Qian Cai (1):
checkstack.pl: fix for aarch64
Sagi Grimberg (1):
rxe: fix error completion wr_id and qp_num
Sohil Mehta (1):
iommu/vt-d: Handle domain agaw being less than iommu agaw
Stefan Hajnoczi (1):
vhost/vsock: fix uninitialized vhost_vsock->guest_cid
Steffen Maier (1):
scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
Sudarsana Reddy Kalluru (3):
bnx2x: Clear fip MAC when fcoe offload support is disabled
bnx2x: Remove configured vlans as part of unload sequence.
bnx2x: Send update-svid ramrod with retry/poll flags enabled
Takashi Iwai (1):
ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
Tony Lindgren (1):
Input: omap-keypad - fix idle configuration to not block SoC idle states
Trond Myklebust (1):
SUNRPC: Fix a race with XPRT_CONNECTING
Varun Prakash (2):
scsi: target: iscsi: cxgbit: fix csk leak
scsi: target: iscsi: cxgbit: add missing spin_lock_init()
Vasily Averin (6):
sunrpc: fix cache_head leak due to queued request
sunrpc: use SVC_NET() in svcauth_gss_* functions
dlm: fixed memory leaks after failed ls_remove_names allocation
dlm: possible memory leak on error path in create_lkb()
dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
dlm: memory leaks on error path in dlm_user_request()
Yan, Zheng (1):
ceph: don't update importing cap's mseq when handing cap export
Yangtao Li (1):
serial/sunsu: fix refcount leak
Yonglong Liu (9):
net: hns: Incorrect offset address used for some registers.
net: hns: All ports can not work when insmod hns ko after rmmod.
net: hns: Some registers use wrong address according to the datasheet.
net: hns: Fixed bug that netdev was opened twice
net: hns: Clean rx fbd when ae stopped.
net: hns: Free irq when exit from abnormal branch
net: hns: Avoid net reset caused by pause frames storm
net: hns: Fix ntuple-filters status error.
net: hns: Add mac pcs config when enable|disable mac
I'm announcing the release of the 3.18.132 kernel.
All users of the 3.18 kernel series must upgrade.
The updated 3.18.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-3.18.y
and can be browsed at the normal kernel.org git web browser:
http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/mips/boot/compressed/calc_vmlinuz_load_addr.c | 7 +-
arch/mips/include/asm/pgtable-64.h | 5 +
arch/x86/include/asm/kvm_host.h | 2
arch/x86/kernel/cpu/mtrr/if.c | 2
drivers/gpio/gpio-max7301.c | 12 ---
drivers/hv/vmbus_drv.c | 20 ++++++
drivers/isdn/capi/kcapi.c | 4 -
drivers/media/platform/vivid/vivid-vid-cap.c | 2
drivers/misc/genwqe/card_utils.c | 2
drivers/mmc/core/mmc.c | 4 -
drivers/mmc/host/omap_hsmmc.c | 12 +++
drivers/net/ethernet/ibm/ibmveth.c | 6 +
drivers/net/usb/hso.c | 18 +++++
drivers/net/wireless/b43/phy_common.c | 2
drivers/net/xen-netfront.c | 2
drivers/power/olpc_battery.c | 4 -
drivers/s390/scsi/zfcp_aux.c | 6 -
drivers/usb/class/cdc-acm.c | 10 +++
drivers/usb/class/cdc-acm.h | 1
drivers/usb/host/r8a66597-hcd.c | 5 +
drivers/usb/serial/option.c | 7 +-
drivers/usb/serial/pl2303.c | 5 +
drivers/usb/serial/pl2303.h | 5 +
drivers/vhost/vhost.c | 2
fs/ceph/caps.c | 1
fs/cifs/smb2maperror.c | 4 -
fs/dlm/lock.c | 17 +++--
fs/dlm/lockspace.c | 2
fs/ext4/inline.c | 5 +
fs/ext4/super.c | 13 +++-
fs/gfs2/rgrp.c | 2
include/net/sock.h | 36 ++++++++++-
include/trace/events/ext4.h | 20 ++++++
kernel/fork.c | 13 +++-
net/9p/client.c | 21 ++++++
net/ax25/af_ax25.c | 11 ++-
net/ax25/ax25_dev.c | 2
net/compat.c | 15 ++--
net/core/sock.c | 3
net/ipv6/ip6_udp_tunnel.c | 3
net/netrom/af_netrom.c | 15 +++-
net/packet/af_packet.c | 8 +-
net/sctp/ipv6.c | 1
net/sunrpc/auth_gss/svcauth_gss.c | 8 +-
net/sunrpc/cache.c | 9 ++
net/sunrpc/svcsock.c | 2
net/vmw_vsock/vmci_transport.c | 67 +++++++++++++++------
sound/pci/cs46xx/dsp_spos.c | 3
sound/usb/mixer.c | 10 ++-
sound/usb/quirks-table.h | 3
51 files changed, 351 insertions(+), 90 deletions(-)
Andreas Gruenbacher (1):
gfs2: Fix loop in gfs2_rbm_find
Christian Borntraeger (1):
genwqe: Fix size check
Christophe Leroy (1):
gpio: max7301: fix driver for use with CONFIG_VMAP_STACK
Colin Ian King (1):
x86/mtrr: Don't copy uninitialized gentry fields back to userspace
Cong Wang (3):
ax25: fix a use-after-free in ax25_fillin_cb()
ipv6: explicitly initialize udp6_addr in udp_sock_create6()
netrom: fix locking in nr_find_socket()
Dan Carpenter (1):
ALSA: cs46xx: Potential NULL dereference in probe
David Herrmann (1):
fork: record start_time late
Deepa Dinamani (1):
sock: Make sock->sk_stamp thread-safe
Dexuan Cui (1):
Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels
Dominique Martinet (1):
9p/net: put a lower bound on msize
Eric Dumazet (1):
isdn: fix kernel-infoleak in capi_unlocked_ioctl
Georgy A Bystrenin (1):
CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem
Greg Kroah-Hartman (1):
Linux 3.18.132
Hans Verkuil (1):
media: vivid: free bitmap_cap when updating std/timings/etc.
Huacai Chen (2):
MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()
MIPS: Align kernel load address to 64KB
Hui Peng (2):
USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
Jason Wang (1):
vhost: make sure used idx is seen before log in vhost_add_used_n()
Jia-Ju Bai (1):
usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable()
Jorgen Hansen (1):
VSOCK: Send reset control packet when socket is partially bound
Juergen Gross (1):
xen/netfront: tolerate frags with no data
Larry Finger (1):
b43: Fix error in cordic routine
Lubomir Rintel (1):
power: supply: olpc_battery: correct the temperature units
Macpaul Lin (1):
cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.
Maurizio Lombardi (1):
ext4: missing unlock/put_page() in ext4_try_to_write_inline_data()
Pan Bian (1):
ext4: fix possible use after free in ext4_quota_enable
Russell King (1):
mmc: omap_hsmmc: fix DMA API warning
Scott Chen (1):
USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
Sean Christopherson (1):
KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
Steffen Maier (1):
scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
Takashi Iwai (1):
ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
Theodore Ts'o (1):
ext4: force inode writes when nfsd calls commit_metadata()
Tore Anderson (1):
USB: serial: option: add HP lt4132
Tyrel Datwyler (1):
ibmveth: fix DMA unmap error in ibmveth_xmit_start error path
Ulf Hansson (1):
mmc: core: Reset HPI enabled state during re-init and in case of errors
Vasily Averin (6):
sunrpc: fix cache_head leak due to queued request
sunrpc: use SVC_NET() in svcauth_gss_* functions
dlm: fixed memory leaks after failed ls_remove_names allocation
dlm: possible memory leak on error path in create_lkb()
dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
dlm: memory leaks on error path in dlm_user_request()
Willem de Bruijn (2):
packet: validate address length
packet: validate address length if non-zero
Xin Long (1):
sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
Yan, Zheng (1):
ceph: don't update importing cap's mseq when handing cap export
This is the start of the stable review cycle for the 3.18.132 release.
There are 47 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun Jan 13 13:09:31 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.132-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 3.18.132-rc1
Lubomir Rintel <lkundrak(a)v3.sk>
power: supply: olpc_battery: correct the temperature units
Christian Borntraeger <borntraeger(a)de.ibm.com>
genwqe: Fix size check
Yan, Zheng <zyan(a)redhat.com>
ceph: don't update importing cap's mseq when handing cap export
Dominique Martinet <dominique.martinet(a)cea.fr>
9p/net: put a lower bound on msize
Larry Finger <Larry.Finger(a)lwfinger.net>
b43: Fix error in cordic routine
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Fix loop in gfs2_rbm_find
Vasily Averin <vvs(a)virtuozzo.com>
dlm: memory leaks on error path in dlm_user_request()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: possible memory leak on error path in create_lkb()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: fixed memory leaks after failed ls_remove_names allocation
Hui Peng <benquike(a)163.com>
ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
Dan Carpenter <dan.carpenter(a)oracle.com>
ALSA: cs46xx: Potential NULL dereference in probe
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: use SVC_NET() in svcauth_gss_* functions
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: fix cache_head leak due to queued request
David Herrmann <dh.herrmann(a)gmail.com>
fork: record start_time late
Steffen Maier <maier(a)linux.ibm.com>
scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
Georgy A Bystrenin <gkot(a)altlinux.org>
CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem
Huacai Chen <chenhc(a)lemote.com>
MIPS: Align kernel load address to 64KB
Huacai Chen <chenhc(a)lemote.com>
MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: vivid: free bitmap_cap when updating std/timings/etc.
Macpaul Lin <macpaul.lin(a)mediatek.com>
cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.
Theodore Ts'o <tytso(a)mit.edu>
ext4: force inode writes when nfsd calls commit_metadata()
Maurizio Lombardi <mlombard(a)redhat.com>
ext4: missing unlock/put_page() in ext4_try_to_write_inline_data()
Pan Bian <bianpan2016(a)163.com>
ext4: fix possible use after free in ext4_quota_enable
Sean Christopherson <sean.j.christopherson(a)intel.com>
KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
Jia-Ju Bai <baijiaju1990(a)gmail.com>
usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable()
Scott Chen <scott(a)labau.com.tw>
USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
Deepa Dinamani <deepa.kernel(a)gmail.com>
sock: Make sock->sk_stamp thread-safe
Juergen Gross <jgross(a)suse.com>
xen/netfront: tolerate frags with no data
Jorgen Hansen <jhansen(a)vmware.com>
VSOCK: Send reset control packet when socket is partially bound
Jason Wang <jasowang(a)redhat.com>
vhost: make sure used idx is seen before log in vhost_add_used_n()
Xin Long <lucien.xin(a)gmail.com>
sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
Willem de Bruijn <willemb(a)google.com>
packet: validate address length if non-zero
Willem de Bruijn <willemb(a)google.com>
packet: validate address length
Cong Wang <xiyou.wangcong(a)gmail.com>
netrom: fix locking in nr_find_socket()
Eric Dumazet <edumazet(a)google.com>
isdn: fix kernel-infoleak in capi_unlocked_ioctl
Cong Wang <xiyou.wangcong(a)gmail.com>
ipv6: explicitly initialize udp6_addr in udp_sock_create6()
Tyrel Datwyler <tyreld(a)linux.vnet.ibm.com>
ibmveth: fix DMA unmap error in ibmveth_xmit_start error path
Cong Wang <xiyou.wangcong(a)gmail.com>
ax25: fix a use-after-free in ax25_fillin_cb()
Colin Ian King <colin.king(a)canonical.com>
x86/mtrr: Don't copy uninitialized gentry fields back to userspace
Dexuan Cui <decui(a)microsoft.com>
Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels
Christophe Leroy <christophe.leroy(a)c-s.fr>
gpio: max7301: fix driver for use with CONFIG_VMAP_STACK
Russell King <rmk+kernel(a)armlinux.org.uk>
mmc: omap_hsmmc: fix DMA API warning
Ulf Hansson <ulf.hansson(a)linaro.org>
mmc: core: Reset HPI enabled state during re-init and in case of errors
Tore Anderson <tore(a)fud.no>
USB: serial: option: add HP lt4132
Hui Peng <benquike(a)gmail.com>
USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
-------------
Diffstat:
Makefile | 4 +-
arch/mips/boot/compressed/calc_vmlinuz_load_addr.c | 7 ++-
arch/mips/include/asm/pgtable-64.h | 5 ++
arch/x86/include/asm/kvm_host.h | 2 +-
arch/x86/kernel/cpu/mtrr/if.c | 2 +
drivers/gpio/gpio-max7301.c | 12 +---
drivers/hv/vmbus_drv.c | 20 +++++++
drivers/isdn/capi/kcapi.c | 4 +-
drivers/media/platform/vivid/vivid-vid-cap.c | 2 +
drivers/misc/genwqe/card_utils.c | 2 +-
drivers/mmc/core/mmc.c | 4 +-
drivers/mmc/host/omap_hsmmc.c | 12 +++-
drivers/net/ethernet/ibm/ibmveth.c | 6 +-
drivers/net/usb/hso.c | 18 +++++-
drivers/net/wireless/b43/phy_common.c | 2 +-
drivers/net/xen-netfront.c | 2 +-
drivers/power/olpc_battery.c | 4 +-
drivers/s390/scsi/zfcp_aux.c | 6 +-
drivers/usb/class/cdc-acm.c | 10 ++++
drivers/usb/class/cdc-acm.h | 1 +
drivers/usb/host/r8a66597-hcd.c | 5 +-
drivers/usb/serial/option.c | 7 ++-
drivers/usb/serial/pl2303.c | 5 ++
drivers/usb/serial/pl2303.h | 5 ++
drivers/vhost/vhost.c | 2 +
fs/ceph/caps.c | 1 -
fs/cifs/smb2maperror.c | 4 +-
fs/dlm/lock.c | 17 +++---
fs/dlm/lockspace.c | 2 +-
fs/ext4/inline.c | 5 +-
fs/ext4/super.c | 13 ++++-
fs/gfs2/rgrp.c | 2 +-
include/net/sock.h | 36 +++++++++++-
include/trace/events/ext4.h | 20 +++++++
kernel/fork.c | 13 ++++-
net/9p/client.c | 21 +++++++
net/ax25/af_ax25.c | 11 +++-
net/ax25/ax25_dev.c | 2 +
net/compat.c | 15 +++--
net/core/sock.c | 3 +
net/ipv6/ip6_udp_tunnel.c | 3 +-
net/netrom/af_netrom.c | 15 +++--
net/packet/af_packet.c | 8 ++-
net/sctp/ipv6.c | 1 +
net/sunrpc/auth_gss/svcauth_gss.c | 8 +--
net/sunrpc/cache.c | 9 ++-
net/sunrpc/svcsock.c | 2 +-
net/vmw_vsock/vmci_transport.c | 67 ++++++++++++++++------
sound/pci/cs46xx/dsp_spos.c | 3 +
sound/usb/mixer.c | 10 +++-
sound/usb/quirks-table.h | 3 +
51 files changed, 352 insertions(+), 91 deletions(-)
This is the start of the stable review cycle for the 4.14.93 release.
There are 105 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun Jan 13 13:10:07 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.93-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.93-rc1
Boris Brezillon <boris.brezillon(a)bootlin.com>
drm/vc4: Set ->is_yuv to false when num_planes == 1
Christophe Leroy <christophe.leroy(a)c-s.fr>
lib: fix build failure in CONFIG_DEBUG_VIRTUAL test
Lubomir Rintel <lkundrak(a)v3.sk>
power: supply: olpc_battery: correct the temperature units
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: msu: Fix an off-by-one in attribute store
Christian Borntraeger <borntraeger(a)de.ibm.com>
genwqe: Fix size check
Yan, Zheng <zyan(a)redhat.com>
ceph: don't update importing cap's mseq when handing cap export
Linus Torvalds <torvalds(a)linux-foundation.org>
sched/fair: Fix infinite loop in update_blocked_averages() by reverting a9e7f6544b9c
Sohil Mehta <sohil.mehta(a)intel.com>
iommu/vt-d: Handle domain agaw being less than iommu agaw
Sagi Grimberg <sagi(a)grimberg.me>
rxe: fix error completion wr_id and qp_num
Dominique Martinet <dominique.martinet(a)cea.fr>
9p/net: put a lower bound on msize
Breno Leitao <leitao(a)debian.org>
powerpc/tm: Set MSR[TS] just prior to recheckpoint
Ard Biesheuvel <ard.biesheuvel(a)linaro.org>
arm64: relocatable: fix inconsistencies in linker script and options
Ard Biesheuvel <ard.biesheuvel(a)linaro.org>
arm64: drop linker script hack to hide __efistub_ symbols
Benjamin Coddington <bcodding(a)redhat.com>
lockd: Show pid of lockd for remote locks
Ondrej Mosnacek <omosnace(a)redhat.com>
selinux: policydb - fix byte order and alignment issues
Larry Finger <Larry.Finger(a)lwfinger.net>
b43: Fix error in cordic routine
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Fix loop in gfs2_rbm_find
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Get rid of potential double-freeing in gfs2_create_inode
Vasily Averin <vvs(a)virtuozzo.com>
dlm: memory leaks on error path in dlm_user_request()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: possible memory leak on error path in create_lkb()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: fixed memory leaks after failed ls_remove_names allocation
Hui Peng <benquike(a)163.com>
ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
Dan Carpenter <dan.carpenter(a)oracle.com>
ALSA: cs46xx: Potential NULL dereference in probe
Damien Le Moal <damien.lemoal(a)wdc.com>
dm zoned: Fix target BIO completion handling
Mikulas Patocka <mpatocka(a)redhat.com>
dm verity: fix crash on bufio buffer that was allocated with vmalloc
Stefan Hajnoczi <stefanha(a)redhat.com>
vhost/vsock: fix uninitialized vhost_vsock->guest_cid
Joel Stanley <joel(a)jms.id.au>
raid6/ppc: Fix build for clang
Joel Stanley <joel(a)jms.id.au>
powerpc/boot: Set target when cross-compiling for clang
Joel Stanley <joel(a)jms.id.au>
Makefile: Export clang toolchain variables
Masahiro Yamada <yamada.masahiro(a)socionext.com>
kbuild: consolidate Clang compiler flags
Masahiro Yamada <yamada.masahiro(a)socionext.com>
kbuild: add -no-integrated-as Clang option unconditionally
Matthias Kaehlcke <mka(a)chromium.org>
md: raid10: remove VLAIS
Joel Stanley <joel(a)jms.id.au>
ftrace: Build with CPPFLAGS to get -Qunused-arguments
Joel Stanley <joel(a)jms.id.au>
powerpc: Disable -Wbuiltin-requires-header when setjmp is used
Nicholas Piggin <npiggin(a)gmail.com>
powerpc: avoid -mno-sched-epilog on GCC 4.9 and newer
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: use SVC_NET() in svcauth_gss_* functions
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: fix cache_head leak due to queued request
Huang Ying <ying.huang(a)intel.com>
mm, swap: fix swapoff with KSM pages
Dan Williams <dan.j.williams(a)intel.com>
mm, hmm: mark hmm_devmem_{add, add_resource} EXPORT_SYMBOL_GPL
Dan Williams <dan.j.williams(a)intel.com>
mm, hmm: use devm semantics for hmm_devmem_{add, remove}
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: kill mapping "System RAM" support
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL
Michal Hocko <mhocko(a)suse.com>
hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
Minchan Kim <minchan(a)kernel.org>
zram: fix double free backing device
David Herrmann <dh.herrmann(a)gmail.com>
fork: record start_time late
Martin Kelly <martin(a)martingkelly.com>
tools: fix cross-compile var clobbering
Thomas Gleixner <tglx(a)linutronix.de>
genirq/affinity: Don't return with empty affinity masks on error
Ewan D. Milne <emilne(a)redhat.com>
scsi: lpfc: do not set queue->page_count to 0 if pc_sli4_params.wqpcnt is invalid
Steffen Maier <maier(a)linux.ibm.com>
scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
Yangtao Li <tiny.windzz(a)gmail.com>
serial/sunsu: fix refcount leak
Daniele Palmas <dnlplm(a)gmail.com>
qmi_wwan: Fix qmap header retrieval in qmimux_rx_fixup
Kangjie Lu <kjlu(a)umn.edu>
net: netxen: fix a missing check and an uninitialized use
Mantas Mikulėnas <grawity(a)gmail.com>
Input: synaptics - enable SMBus for HP EliteBook 840 G4
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
gpio: mvebu: only fail on missing clk if pwm is actually to be used
Michael S. Tsirkin <mst(a)redhat.com>
virtio: fix test build after uio.h change
Masahiro Yamada <yamada.masahiro(a)socionext.com>
kbuild: fix false positive warning/error about missing libelf
Sara Sharon <sara.sharon(a)intel.com>
mac80211: free skb fraglist before freeing the skb
Colin Ian King <colin.king(a)canonical.com>
vxge: ensure data0 is initialized in when fetching firmware version information
Jason Martinsen <jasonmartinsen(a)msn.com>
lan78xx: Resolve issue with changing MAC address
Anssi Hannula <anssi.hannula(a)bitwise.fi>
net: macb: fix dropped RX frames due to a race
Anssi Hannula <anssi.hannula(a)bitwise.fi>
net: macb: fix random memory corruption on RX with 64-bit DMA
Dan Carpenter <dan.carpenter(a)oracle.com>
qed: Fix an error code qed_ll2_start_xmit()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Fix a race with XPRT_CONNECTING
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Fix ping failed when use net bridge and send multicast
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Add mac pcs config when enable|disable mac
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Fix ntuple-filters status error.
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Avoid net reset caused by pause frames storm
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Free irq when exit from abnormal branch
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Clean rx fbd when ae stopped.
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Fixed bug that netdev was opened twice
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Some registers use wrong address according to the datasheet.
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: All ports can not work when insmod hns ko after rmmod.
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Incorrect offset address used for some registers.
Arnd Bergmann <arnd(a)arndb.de>
w90p910_ether: remove incorrect __init annotation
Nathan Chancellor <natechancellor(a)gmail.com>
drivers: net: xgene: Remove unnecessary forward declarations
Sinan Kaya <okaya(a)kernel.org>
x86, hyperv: remove PCI dependency
Varun Prakash <varun(a)chelsio.com>
scsi: target: iscsi: cxgbit: add missing spin_lock_init()
Varun Prakash <varun(a)chelsio.com>
scsi: target: iscsi: cxgbit: fix csk leak
Sudarsana Reddy Kalluru <sudarsana.kalluru(a)cavium.com>
bnx2x: Send update-svid ramrod with retry/poll flags enabled
Sudarsana Reddy Kalluru <sudarsana.kalluru(a)cavium.com>
bnx2x: Remove configured vlans as part of unload sequence.
Sudarsana Reddy Kalluru <sudarsana.kalluru(a)cavium.com>
bnx2x: Clear fip MAC when fcoe offload support is disabled
Florian Westphal <fw(a)strlen.de>
netfilter: nat: can't use dst_hold on noref dst
Pan Bian <bianpan2016(a)163.com>
netfilter: ipset: do not call ipset_nest_end after nla_nest_cancel
Stefan Assmann <sassmann(a)kpanic.de>
i40e: fix mac filter delete when setting mac address
Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
x86/dump_pagetables: Fix LDT remap address marker
Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
x86/mm: Fix guard hole handling
YueHaibing <yuehaibing(a)huawei.com>
ieee802154: ca8210: fix possible u8 overflow in ca8210_rx_done
Thomas Falcon <tlfalcon(a)linux.ibm.com>
ibmvnic: Fix non-atomic memory allocation in IRQ context
Yussuf Khalil <dev(a)pp3345.net>
Input: synaptics - enable RMI on ThinkPad T560
Tony Lindgren <tony(a)atomide.com>
Input: omap-keypad - fix idle configuration to not block SoC idle states
Dan Carpenter <dan.carpenter(a)oracle.com>
scsi: bnx2fc: Fix NULL dereference in error handling
Florian Westphal <fw(a)strlen.de>
netfilter: seqadj: re-load tcp header pointer after possible head reallocation
Steffen Klassert <steffen.klassert(a)secunet.com>
xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force clears the dst_entry.
Benjamin Poirier <bpoirier(a)suse.com>
xfrm: Fix bucket count reported to userspace
Wei Yongjun <weiyongjun1(a)huawei.com>
xfrm: Fix error return code in xfrm_output_one()
Qian Cai <cai(a)lca.pw>
checkstack.pl: fix for aarch64
Peter Hutterer <peter.hutterer(a)who-t.net>
Input: restore EV_ABS ABS_RESERVED
Fabio Estevam <festevam(a)gmail.com>
ARM: dts: imx7d-nitrogen7: Fix the description of the Wifi clock
Anson Huang <anson.huang(a)nxp.com>
ARM: imx: update the cpu power up timing setting on i.mx6sx
Hans de Goede <hdegoede(a)redhat.com>
HID: ite: Add USB id match for another ITE based keyboard rfkill key quirk
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc/mm: Fix linux page tables build with some configs
Paul Mackerras <paulus(a)ozlabs.org>
powerpc: Fix COFF zImage booting on old powermacs
Jerome Brunet <jbrunet(a)baylibre.com>
pinctrl: meson: fix pull enable register calculation
-------------
Diffstat:
Makefile | 31 +-
arch/arm/boot/dts/imx7d-nitrogen7.dts | 9 +-
arch/arm/mach-imx/cpuidle-imx6sx.c | 2 +-
arch/arm64/Makefile | 2 +-
arch/arm64/kernel/image.h | 44 +-
arch/arm64/kernel/vmlinux.lds.S | 9 +-
arch/powerpc/Makefile | 7 +-
arch/powerpc/boot/Makefile | 5 +
arch/powerpc/boot/crt0.S | 4 +-
arch/powerpc/kernel/Makefile | 3 +
arch/powerpc/kernel/signal_32.c | 20 +-
arch/powerpc/kernel/signal_64.c | 44 +-
arch/powerpc/mm/dump_linuxpagetables.c | 1 +
arch/powerpc/xmon/Makefile | 5 +-
arch/x86/include/asm/pgtable_64_types.h | 5 +
arch/x86/mm/dump_pagetables.c | 15 +-
arch/x86/xen/mmu_pv.c | 11 +-
drivers/block/zram/zram_drv.c | 4 +-
drivers/gpio/gpio-mvebu.c | 6 +-
drivers/gpu/drm/vc4/vc4_plane.c | 1 +
drivers/hid/hid-ids.h | 3 +
drivers/hid/hid-ite.c | 1 +
drivers/hv/Kconfig | 2 +-
drivers/hwtracing/intel_th/msu.c | 3 +-
drivers/infiniband/sw/rxe/rxe_resp.c | 13 +-
drivers/input/keyboard/omap4-keypad.c | 16 +-
drivers/input/mouse/synaptics.c | 2 +
drivers/iommu/intel-iommu.c | 4 +-
drivers/md/dm-verity-target.c | 24 +-
drivers/md/dm-zoned-target.c | 122 ++---
drivers/md/raid10.c | 15 +-
drivers/misc/genwqe/card_utils.c | 2 +-
drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 3 -
drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 1 +
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 48 +-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h | 4 +-
drivers/net/ethernet/cadence/macb_main.c | 14 +-
drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 3 +
drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c | 14 +-
drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 15 +
drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 503 ++++++++++++++-------
drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h | 13 +-
drivers/net/ethernet/hisilicon/hns/hns_enet.c | 43 +-
drivers/net/ethernet/ibm/ibmvnic.c | 2 +-
drivers/net/ethernet/intel/i40e/i40e_main.c | 14 +-
drivers/net/ethernet/neterion/vxge/vxge-config.c | 2 +-
drivers/net/ethernet/nuvoton/w90p910_ether.c | 2 +-
.../net/ethernet/qlogic/netxen/netxen_nic_init.c | 3 +-
drivers/net/ethernet/qlogic/qed/qed_ll2.c | 1 +
drivers/net/ieee802154/ca8210.c | 4 +-
drivers/net/usb/lan78xx.c | 4 +
drivers/net/usb/qmi_wwan.c | 15 +-
drivers/net/wireless/broadcom/b43/phy_common.c | 2 +-
drivers/pinctrl/meson/pinctrl-meson.c | 3 +-
drivers/power/supply/olpc_battery.c | 4 +-
drivers/s390/scsi/zfcp_aux.c | 6 +-
drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 2 +-
drivers/scsi/lpfc/lpfc_sli.c | 3 +-
drivers/target/iscsi/cxgbit/cxgbit_cm.c | 5 +-
drivers/target/iscsi/cxgbit/cxgbit_main.c | 1 +
drivers/tty/serial/sunsu.c | 31 +-
drivers/vhost/vsock.c | 2 +
fs/ceph/caps.c | 1 -
fs/dlm/lock.c | 17 +-
fs/dlm/lockspace.c | 2 +-
fs/gfs2/inode.c | 18 +-
fs/gfs2/rgrp.c | 2 +-
fs/lockd/clntproc.c | 2 +-
fs/lockd/xdr.c | 4 +-
fs/lockd/xdr4.c | 4 +-
include/linux/hmm.h | 4 +-
include/uapi/linux/input-event-codes.h | 9 +
kernel/fork.c | 13 +-
kernel/irq/affinity.c | 15 +-
kernel/memremap.c | 11 +-
kernel/sched/fair.c | 43 +-
lib/raid6/Makefile | 15 +
lib/test_debug_virtual.c | 1 +
mm/hmm.c | 131 ++----
mm/memory_hotplug.c | 16 +
mm/swapfile.c | 3 +-
net/9p/client.c | 21 +
net/mac80211/status.c | 5 +
net/netfilter/ipset/ip_set_list_set.c | 2 +-
net/netfilter/nf_conntrack_seqadj.c | 7 +-
net/netfilter/nf_nat_core.c | 3 +-
net/sunrpc/auth_gss/svcauth_gss.c | 8 +-
net/sunrpc/cache.c | 10 +-
net/sunrpc/xprtsock.c | 4 +-
net/xfrm/xfrm_input.c | 7 +-
net/xfrm/xfrm_output.c | 1 +
net/xfrm/xfrm_state.c | 2 +-
scripts/Makefile.build | 2 +-
scripts/checkstack.pl | 4 +-
security/selinux/ss/policydb.c | 51 ++-
sound/pci/cs46xx/dsp_spos.c | 3 +
sound/usb/mixer.c | 10 +-
sound/usb/quirks-table.h | 3 +
tools/cgroup/Makefile | 1 -
tools/gpio/Makefile | 2 -
tools/hv/Makefile | 1 -
tools/iio/Makefile | 2 -
tools/laptop/freefall/Makefile | 1 -
tools/leds/Makefile | 1 -
tools/perf/Makefile.perf | 6 -
tools/power/acpi/Makefile.config | 3 -
tools/scripts/Makefile.include | 18 +
tools/spi/Makefile | 2 -
tools/testing/nvdimm/test/iomap.c | 2 +-
tools/usb/Makefile | 1 -
tools/virtio/linux/kernel.h | 4 +
tools/vm/Makefile | 1 -
112 files changed, 1035 insertions(+), 666 deletions(-)
When building using GCC 4.7 or older, -ffunction-sections & the -pg flag
used by ftrace are incompatible. This causes warnings or build failures
(where -Werror applies) such as the following:
arch/mips/generic/init.c:
error: -ffunction-sections disabled; it makes profiling impossible
This used to be taken into account by the ordering of calls to cc-option
from within the top-level Makefile, which was introduced by commit
90ad4052e85c ("kbuild: avoid conflict between -ffunction-sections and
-pg on gcc-4.7"). Unfortunately this was broken when the
CONFIG_LD_DEAD_CODE_DATA_ELIMINATION cc-option check was moved to
Kconfig in commit e85d1d65cd8a ("kbuild: test dead code/data elimination
support in Kconfig"), because the flags used by this check no longer
include -pg.
Fix this by not allowing CONFIG_LD_DEAD_CODE_DATA_ELIMINATION to be
enabled at the same time as ftrace/CONFIG_FUNCTION_TRACER when building
using GCC 4.7 or older.
Signed-off-by: Paul Burton <paul.burton(a)mips.com>
Fixes: e85d1d65cd8a ("kbuild: test dead code/data elimination support in Kconfig")
Reported-by: Geert Uytterhoeven <geert(a)linux-m68k.org>
Cc: Masahiro Yamada <yamada.masahiro(a)socionext.com>
Cc: Nicholas Piggin <npiggin(a)gmail.com>
Cc: stable(a)vger.kernel.org # v4.19+
---
init/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/init/Kconfig b/init/Kconfig
index d47cb77a220e..c787f782148d 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1124,6 +1124,7 @@ config LD_DEAD_CODE_DATA_ELIMINATION
bool "Dead code and data elimination (EXPERIMENTAL)"
depends on HAVE_LD_DEAD_CODE_DATA_ELIMINATION
depends on EXPERT
+ depends on !FUNCTION_TRACER || !CC_IS_GCC || GCC_VERSION >= 40800
depends on $(cc-option,-ffunction-sections -fdata-sections)
depends on $(ld-option,--gc-sections)
help
--
2.20.1
This is the start of the stable review cycle for the 4.9.150 release.
There are 63 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun Jan 13 13:10:03 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.150-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.150-rc1
Boris Brezillon <boris.brezillon(a)bootlin.com>
drm/vc4: Set ->is_yuv to false when num_planes == 1
Lubomir Rintel <lkundrak(a)v3.sk>
power: supply: olpc_battery: correct the temperature units
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: msu: Fix an off-by-one in attribute store
Christian Borntraeger <borntraeger(a)de.ibm.com>
genwqe: Fix size check
Yan, Zheng <zyan(a)redhat.com>
ceph: don't update importing cap's mseq when handing cap export
Sohil Mehta <sohil.mehta(a)intel.com>
iommu/vt-d: Handle domain agaw being less than iommu agaw
Sagi Grimberg <sagi(a)grimberg.me>
rxe: fix error completion wr_id and qp_num
Dominique Martinet <dominique.martinet(a)cea.fr>
9p/net: put a lower bound on msize
Breno Leitao <leitao(a)debian.org>
powerpc/tm: Set MSR[TS] just prior to recheckpoint
Larry Finger <Larry.Finger(a)lwfinger.net>
b43: Fix error in cordic routine
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Fix loop in gfs2_rbm_find
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Get rid of potential double-freeing in gfs2_create_inode
Vasily Averin <vvs(a)virtuozzo.com>
dlm: memory leaks on error path in dlm_user_request()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: possible memory leak on error path in create_lkb()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: fixed memory leaks after failed ls_remove_names allocation
Hui Peng <benquike(a)163.com>
ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
Dan Carpenter <dan.carpenter(a)oracle.com>
ALSA: cs46xx: Potential NULL dereference in probe
Michael J. Ruhl <michael.j.ruhl(a)intel.com>
IB/hfi1: Incorrect sizing of sge for PIO will OOPs
Stefan Hajnoczi <stefanha(a)redhat.com>
vhost/vsock: fix uninitialized vhost_vsock->guest_cid
Eric Biggers <ebiggers(a)google.com>
crypto: x86/chacha20 - avoid sleeping with preemption disabled
Paul Burton <paul.burton(a)mips.com>
MIPS: math-emu: Write-protect delay slot emulation pages
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: use SVC_NET() in svcauth_gss_* functions
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: fix cache_head leak due to queued request
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: kill mapping "System RAM" support
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL
Michal Hocko <mhocko(a)suse.com>
hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
David Herrmann <dh.herrmann(a)gmail.com>
fork: record start_time late
Ilya Dryomov <idryomov(a)gmail.com>
libceph: fix CEPH_FEATURE_CEPHX_V2 check in calc_signature()
Steffen Maier <maier(a)linux.ibm.com>
scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
Yangtao Li <tiny.windzz(a)gmail.com>
serial/sunsu: fix refcount leak
Kangjie Lu <kjlu(a)umn.edu>
net: netxen: fix a missing check and an uninitialized use
Colin Ian King <colin.king(a)canonical.com>
vxge: ensure data0 is initialized in when fetching firmware version information
Jason Martinsen <jasonmartinsen(a)msn.com>
lan78xx: Resolve issue with changing MAC address
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Fix a race with XPRT_CONNECTING
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Add mac pcs config when enable|disable mac
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Fix ntuple-filters status error.
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Avoid net reset caused by pause frames storm
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Free irq when exit from abnormal branch
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Clean rx fbd when ae stopped.
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Fixed bug that netdev was opened twice
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Some registers use wrong address according to the datasheet.
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: All ports can not work when insmod hns ko after rmmod.
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Incorrect offset address used for some registers.
Arnd Bergmann <arnd(a)arndb.de>
w90p910_ether: remove incorrect __init annotation
Nathan Chancellor <natechancellor(a)gmail.com>
drivers: net: xgene: Remove unnecessary forward declarations
Varun Prakash <varun(a)chelsio.com>
scsi: target: iscsi: cxgbit: add missing spin_lock_init()
Varun Prakash <varun(a)chelsio.com>
scsi: target: iscsi: cxgbit: fix csk leak
Sudarsana Reddy Kalluru <sudarsana.kalluru(a)cavium.com>
bnx2x: Send update-svid ramrod with retry/poll flags enabled
Sudarsana Reddy Kalluru <sudarsana.kalluru(a)cavium.com>
bnx2x: Remove configured vlans as part of unload sequence.
Sudarsana Reddy Kalluru <sudarsana.kalluru(a)cavium.com>
bnx2x: Clear fip MAC when fcoe offload support is disabled
Pan Bian <bianpan2016(a)163.com>
netfilter: ipset: do not call ipset_nest_end after nla_nest_cancel
Tony Lindgren <tony(a)atomide.com>
Input: omap-keypad - fix idle configuration to not block SoC idle states
Dan Carpenter <dan.carpenter(a)oracle.com>
scsi: bnx2fc: Fix NULL dereference in error handling
Florian Westphal <fw(a)strlen.de>
netfilter: seqadj: re-load tcp header pointer after possible head reallocation
Benjamin Poirier <bpoirier(a)suse.com>
xfrm: Fix bucket count reported to userspace
Qian Cai <cai(a)lca.pw>
checkstack.pl: fix for aarch64
Peter Hutterer <peter.hutterer(a)who-t.net>
Input: restore EV_ABS ABS_RESERVED
Fabio Estevam <festevam(a)gmail.com>
ARM: dts: imx7d-nitrogen7: Fix the description of the Wifi clock
Anson Huang <anson.huang(a)nxp.com>
ARM: imx: update the cpu power up timing setting on i.mx6sx
Paul Mackerras <paulus(a)ozlabs.org>
powerpc: Fix COFF zImage booting on old powermacs
Jerome Brunet <jbrunet(a)baylibre.com>
pinctrl: meson: fix pull enable register calculation
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/imx7d-nitrogen7.dts | 9 +-
arch/arm/mach-imx/cpuidle-imx6sx.c | 2 +-
arch/mips/kernel/vdso.c | 4 +-
arch/mips/math-emu/dsemul.c | 38 ++--
arch/powerpc/boot/crt0.S | 4 +-
arch/powerpc/kernel/signal_32.c | 20 +-
arch/powerpc/kernel/signal_64.c | 44 ++--
arch/x86/crypto/chacha20_glue.c | 1 +
drivers/gpu/drm/vc4/vc4_plane.c | 1 +
drivers/hwtracing/intel_th/msu.c | 3 +-
drivers/infiniband/hw/hfi1/verbs.c | 2 +
drivers/infiniband/sw/rxe/rxe_resp.c | 13 +-
drivers/input/keyboard/omap4-keypad.c | 16 +-
drivers/iommu/intel-iommu.c | 4 +-
drivers/misc/genwqe/card_utils.c | 2 +-
drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 3 -
drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 1 +
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 48 +++-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h | 4 +-
drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 3 +
drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c | 14 +-
drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 15 ++
drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 246 ++++++++++-----------
drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h | 13 +-
drivers/net/ethernet/hisilicon/hns/hns_enet.c | 43 +++-
drivers/net/ethernet/neterion/vxge/vxge-config.c | 2 +-
drivers/net/ethernet/nuvoton/w90p910_ether.c | 2 +-
.../net/ethernet/qlogic/netxen/netxen_nic_init.c | 3 +-
drivers/net/usb/lan78xx.c | 4 +
drivers/net/wireless/broadcom/b43/phy_common.c | 2 +-
drivers/pinctrl/meson/pinctrl-meson.c | 3 +-
drivers/power/supply/olpc_battery.c | 4 +-
drivers/s390/scsi/zfcp_aux.c | 6 +-
drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 2 +-
drivers/target/iscsi/cxgbit/cxgbit_cm.c | 5 +-
drivers/target/iscsi/cxgbit/cxgbit_main.c | 1 +
drivers/tty/serial/sunsu.c | 31 ++-
drivers/vhost/vsock.c | 2 +
fs/ceph/caps.c | 1 -
fs/dlm/lock.c | 17 +-
fs/dlm/lockspace.c | 2 +-
fs/gfs2/inode.c | 18 +-
fs/gfs2/rgrp.c | 2 +-
include/uapi/linux/input-event-codes.h | 9 +
kernel/fork.c | 13 +-
kernel/memremap.c | 11 +-
mm/memory_hotplug.c | 16 ++
net/9p/client.c | 21 ++
net/ceph/auth_x.c | 2 +-
net/netfilter/ipset/ip_set_list_set.c | 2 +-
net/netfilter/nf_conntrack_seqadj.c | 7 +-
net/sunrpc/auth_gss/svcauth_gss.c | 8 +-
net/sunrpc/cache.c | 10 +-
net/sunrpc/xprtsock.c | 4 +-
net/xfrm/xfrm_state.c | 2 +-
scripts/checkstack.pl | 4 +-
sound/pci/cs46xx/dsp_spos.c | 3 +
sound/usb/mixer.c | 10 +-
sound/usb/quirks-table.h | 3 +
tools/testing/nvdimm/test/iomap.c | 2 +-
61 files changed, 517 insertions(+), 274 deletions(-)
This is the start of the stable review cycle for the 4.4.170 release.
There are 88 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun Jan 13 13:09:58 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.170-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.170-rc1
Lubomir Rintel <lkundrak(a)v3.sk>
power: supply: olpc_battery: correct the temperature units
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: msu: Fix an off-by-one in attribute store
Christian Borntraeger <borntraeger(a)de.ibm.com>
genwqe: Fix size check
Yan, Zheng <zyan(a)redhat.com>
ceph: don't update importing cap's mseq when handing cap export
Sohil Mehta <sohil.mehta(a)intel.com>
iommu/vt-d: Handle domain agaw being less than iommu agaw
Dominique Martinet <dominique.martinet(a)cea.fr>
9p/net: put a lower bound on msize
Larry Finger <Larry.Finger(a)lwfinger.net>
b43: Fix error in cordic routine
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Fix loop in gfs2_rbm_find
Vasily Averin <vvs(a)virtuozzo.com>
dlm: memory leaks on error path in dlm_user_request()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: possible memory leak on error path in create_lkb()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: fixed memory leaks after failed ls_remove_names allocation
Hui Peng <benquike(a)163.com>
ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
Dan Carpenter <dan.carpenter(a)oracle.com>
ALSA: cs46xx: Potential NULL dereference in probe
Ming Lei <ming.lei(a)redhat.com>
block: don't deal with discard limit in blkdev_issue_discard()
Jens Axboe <axboe(a)kernel.dk>
block: break discard submissions into the user defined size
Eric Biggers <ebiggers(a)google.com>
crypto: x86/chacha20 - avoid sleeping with preemption disabled
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: use SVC_NET() in svcauth_gss_* functions
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: fix cache_head leak due to queued request
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: kill mapping "System RAM" support
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL
Michal Hocko <mhocko(a)suse.com>
hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
David Herrmann <dh.herrmann(a)gmail.com>
fork: record start_time late
Steffen Maier <maier(a)linux.ibm.com>
scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
Tony Lindgren <tony(a)atomide.com>
Input: omap-keypad - fix idle configuration to not block SoC idle states
Dan Carpenter <dan.carpenter(a)oracle.com>
scsi: bnx2fc: Fix NULL dereference in error handling
Benjamin Poirier <bpoirier(a)suse.com>
xfrm: Fix bucket count reported to userspace
Qian Cai <cai(a)lca.pw>
checkstack.pl: fix for aarch64
Peter Hutterer <peter.hutterer(a)who-t.net>
Input: restore EV_ABS ABS_RESERVED
Anson Huang <anson.huang(a)nxp.com>
ARM: imx: update the cpu power up timing setting on i.mx6sx
Paul Mackerras <paulus(a)ozlabs.org>
powerpc: Fix COFF zImage booting on old powermacs
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Unbreak the build of esoteric configs
Vitaly Kuznetsov <vkuznets(a)redhat.com>
x86/kvm/vmx: do not use vm-exit instruction length for fast MMIO when running nested
Georgy A Bystrenin <gkot(a)altlinux.org>
CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem
Huacai Chen <chenhc(a)lemote.com>
MIPS: Align kernel load address to 64KB
Huacai Chen <chenhc(a)lemote.com>
MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: vivid: free bitmap_cap when updating std/timings/etc.
Macpaul Lin <macpaul.lin(a)mediatek.com>
cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Avoid finishing transfer prematurely in IRQ mode
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Fix book-keeping of DMA termination
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Fix race on DMA termination
Theodore Ts'o <tytso(a)mit.edu>
ext4: force inode writes when nfsd calls commit_metadata()
ruippan (潘睿) <ruippan(a)tencent.com>
ext4: fix EXT4_IOC_GROUP_ADD ioctl
Maurizio Lombardi <mlombard(a)redhat.com>
ext4: missing unlock/put_page() in ext4_try_to_write_inline_data()
Pan Bian <bianpan2016(a)163.com>
ext4: fix possible use after free in ext4_quota_enable
Ben Hutchings <ben(a)decadent.org.uk>
perf pmu: Suppress potential format-truncation warning
Sean Christopherson <sean.j.christopherson(a)intel.com>
KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
Patrick Dreyer <Patrick(a)Dreyer.name>
Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G
Jia-Ju Bai <baijiaju1990(a)gmail.com>
usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable()
Jörgen Storvist <jorgen.storvist(a)gmail.com>
USB: serial: option: add Fibocom NL678 series
Scott Chen <scott(a)labau.com.tw>
USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
Sameer Pujar <spujar(a)nvidia.com>
ALSA: hda/tegra: clear pending irq handlers
Mantas Mikulėnas <grawity(a)gmail.com>
ALSA: hda: add mute LED support for HP EliteBook 840 G4
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: emux: Fix potential Spectre v1 vulnerabilities
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: pcm: Fix potential Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: rme9652: Fix potential Spectre v1 vulnerability
Deepa Dinamani <deepa.kernel(a)gmail.com>
sock: Make sock->sk_stamp thread-safe
Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com>
gro_cell: add napi_disable in gro_cells_destroy
Juergen Gross <jgross(a)suse.com>
xen/netfront: tolerate frags with no data
Jorgen Hansen <jhansen(a)vmware.com>
VSOCK: Send reset control packet when socket is partially bound
Jason Wang <jasowang(a)redhat.com>
vhost: make sure used idx is seen before log in vhost_add_used_n()
Xin Long <lucien.xin(a)gmail.com>
sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
Willem de Bruijn <willemb(a)google.com>
packet: validate address length if non-zero
Willem de Bruijn <willemb(a)google.com>
packet: validate address length
Cong Wang <xiyou.wangcong(a)gmail.com>
netrom: fix locking in nr_find_socket()
Eric Dumazet <edumazet(a)google.com>
isdn: fix kernel-infoleak in capi_unlocked_ioctl
Cong Wang <xiyou.wangcong(a)gmail.com>
ipv6: explicitly initialize udp6_addr in udp_sock_create6()
Willem de Bruijn <willemb(a)google.com>
ieee802154: lowpan_header_create check must check daddr
Tyrel Datwyler <tyreld(a)linux.vnet.ibm.com>
ibmveth: fix DMA unmap error in ibmveth_xmit_start error path
Cong Wang <xiyou.wangcong(a)gmail.com>
ax25: fix a use-after-free in ax25_fillin_cb()
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ipv4: Fix potential Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ip6mr: Fix potential Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
drm/ioctl: Fix Spectre v1 vulnerabilities
Colin Ian King <colin.king(a)canonical.com>
x86/mtrr: Don't copy uninitialized gentry fields back to userspace
Dexuan Cui <decui(a)microsoft.com>
Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels
Christophe Leroy <christophe.leroy(a)c-s.fr>
gpio: max7301: fix driver for use with CONFIG_VMAP_STACK
Russell King <rmk+kernel(a)armlinux.org.uk>
mmc: omap_hsmmc: fix DMA API warning
Ulf Hansson <ulf.hansson(a)linaro.org>
mmc: core: Reset HPI enabled state during re-init and in case of errors
Jörgen Storvist <jorgen.storvist(a)gmail.com>
USB: serial: option: add Telit LN940 series
Jörgen Storvist <jorgen.storvist(a)gmail.com>
USB: serial: option: add Fibocom NL668 series
Jörgen Storvist <jorgen.storvist(a)gmail.com>
USB: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode)
Tore Anderson <tore(a)fud.no>
USB: serial: option: add HP lt4132
Jörgen Storvist <jorgen.storvist(a)gmail.com>
USB: serial: option: add GosunCn ZTE WeLink ME3630
Mathias Nyman <mathias.nyman(a)linux.intel.com>
xhci: Don't prevent USB2 bus suspend in state check intended for USB3 only
Hui Peng <benquike(a)gmail.com>
USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
-------------
Diffstat:
Makefile | 4 +-
arch/arm/mach-imx/cpuidle-imx6sx.c | 2 +-
arch/mips/boot/compressed/calc_vmlinuz_load_addr.c | 7 ++-
arch/mips/include/asm/pgtable-64.h | 5 ++
arch/powerpc/boot/crt0.S | 4 +-
arch/x86/crypto/chacha20_glue.c | 1 +
arch/x86/include/asm/kvm_host.h | 2 +-
arch/x86/kernel/cpu/mtrr/if.c | 2 +
arch/x86/kvm/vmx.c | 19 +++++-
arch/x86/kvm/x86.c | 3 +-
block/blk-lib.c | 26 ++-------
drivers/gpio/gpio-max7301.c | 12 +---
drivers/gpu/drm/drm_ioctl.c | 10 +++-
drivers/hv/vmbus_drv.c | 20 +++++++
drivers/hwtracing/intel_th/msu.c | 3 +-
drivers/input/keyboard/omap4-keypad.c | 16 ++----
drivers/input/mouse/elan_i2c_core.c | 1 +
drivers/iommu/intel-iommu.c | 4 +-
drivers/isdn/capi/kcapi.c | 4 +-
drivers/media/platform/vivid/vivid-vid-cap.c | 2 +
drivers/misc/genwqe/card_utils.c | 2 +-
drivers/mmc/core/mmc.c | 4 +-
drivers/mmc/host/omap_hsmmc.c | 12 +++-
drivers/net/ethernet/ibm/ibmveth.c | 6 +-
drivers/net/usb/hso.c | 18 +++++-
drivers/net/wireless/b43/phy_common.c | 2 +-
drivers/net/xen-netfront.c | 2 +-
drivers/power/olpc_battery.c | 4 +-
drivers/s390/scsi/zfcp_aux.c | 6 +-
drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 2 +-
drivers/spi/spi-bcm2835.c | 16 +++---
drivers/usb/class/cdc-acm.c | 10 ++++
drivers/usb/class/cdc-acm.h | 1 +
drivers/usb/host/r8a66597-hcd.c | 5 +-
drivers/usb/host/xhci-hub.c | 3 +-
drivers/usb/serial/option.c | 20 ++++++-
drivers/usb/serial/pl2303.c | 5 ++
drivers/usb/serial/pl2303.h | 5 ++
drivers/vhost/vhost.c | 2 +
fs/ceph/caps.c | 1 -
fs/cifs/smb2maperror.c | 4 +-
fs/dlm/lock.c | 17 +++---
fs/dlm/lockspace.c | 2 +-
fs/ext4/inline.c | 5 +-
fs/ext4/resize.c | 2 +-
fs/ext4/super.c | 13 ++++-
fs/gfs2/rgrp.c | 2 +-
include/net/gro_cells.h | 1 +
include/net/sock.h | 36 +++++++++++-
include/trace/events/ext4.h | 20 +++++++
include/uapi/linux/input-event-codes.h | 9 +++
kernel/fork.c | 13 ++++-
kernel/memremap.c | 11 ++--
mm/memory_hotplug.c | 16 ++++++
net/9p/client.c | 21 +++++++
net/ax25/af_ax25.c | 11 +++-
net/ax25/ax25_dev.c | 2 +
net/compat.c | 15 +++--
net/core/sock.c | 3 +
net/ieee802154/6lowpan/tx.c | 3 +
net/ipv4/ipmr.c | 2 +
net/ipv6/ip6_udp_tunnel.c | 3 +-
net/ipv6/ip6mr.c | 4 ++
net/netrom/af_netrom.c | 15 +++--
net/packet/af_packet.c | 8 ++-
net/sctp/ipv6.c | 1 +
net/sunrpc/auth_gss/svcauth_gss.c | 8 +--
net/sunrpc/cache.c | 10 +++-
net/sunrpc/svcsock.c | 2 +-
net/vmw_vsock/vmci_transport.c | 67 ++++++++++++++++------
net/xfrm/xfrm_state.c | 2 +-
scripts/checkstack.pl | 4 +-
sound/core/pcm.c | 2 +
sound/pci/cs46xx/dsp_spos.c | 3 +
sound/pci/emu10k1/emufx.c | 5 ++
sound/pci/hda/hda_tegra.c | 2 +
sound/pci/hda/patch_conexant.c | 1 +
sound/pci/rme9652/hdsp.c | 10 ++--
sound/synth/emux/emux_hwdep.c | 7 ++-
sound/usb/mixer.c | 10 +++-
sound/usb/quirks-table.h | 3 +
tools/perf/util/pmu.c | 8 +--
82 files changed, 489 insertions(+), 167 deletions(-)
Do you need to edit your photos?
Here are the editing service we mostly for the photos from our clients.
Photos cut out background , clipping path, and also retouching.
You may send some photos to us. we will let our editing staffs to work on
them.
Thanks,
Ruby
area->size can include adjacent guard page but get_vm_area_size()
returns actual size of the area.
This fixes possible kernel crash when userspace tries to map area
on 1 page bigger: size check passes but the following vmalloc_to_page()
returns NULL on last guard (non-existing) page.
Signed-off-by: Roman Penyaev <rpenyaev(a)suse.de>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Andrey Ryabinin <aryabinin(a)virtuozzo.com>
Cc: Joe Perches <joe(a)perches.com>
Cc: "Luis R. Rodriguez" <mcgrof(a)kernel.org>
Cc: linux-mm(a)kvack.org
Cc: linux-kernel(a)vger.kernel.org
Cc: stable(a)vger.kernel.org
---
mm/vmalloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 871e41c55e23..2cd24186ba84 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -2248,7 +2248,7 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
if (!(area->flags & VM_USERMAP))
return -EINVAL;
- if (kaddr + size > area->addr + area->size)
+ if (kaddr + size > area->addr + get_vm_area_size(area))
return -EINVAL;
do {
--
2.19.1
While mapping DMA for scatter list when a scsi command is queued the
existing call to dma_alloc_coherent() in our map_sg_data() function
passes zero for the gfp_flags parameter. We are most definitly in atomic
context at this point as queue_command() is called in softirq context
and further we have a spinlock holding the scsi host lock.
Fix this by passing GFP_ATOMIC to dma_alloc_coherent() to prevent any
sort of sleeping in atomic context deadlock.
Fixes: 4dddbc26c389 ("[SCSI] ibmvscsi: handle large scatter/gather lists")
Cc: stable(a)vger.kernel.org
Signed-off-by: Tyrel Datwyler <tyreld(a)linux.vnet.ibm.com>
---
drivers/scsi/ibmvscsi/ibmvscsi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index 1135e74..cb8535e 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -731,7 +731,7 @@ static int map_sg_data(struct scsi_cmnd *cmd,
evt_struct->ext_list = (struct srp_direct_buf *)
dma_alloc_coherent(dev,
SG_ALL * sizeof(struct srp_direct_buf),
- &evt_struct->ext_list_token, 0);
+ &evt_struct->ext_list_token, GFP_ATOMIC);
if (!evt_struct->ext_list) {
if (!firmware_has_feature(FW_FEATURE_CMO))
sdev_printk(KERN_ERR, cmd->device,
--
1.8.3.1
From: Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
Nested interrupts run inside the calling thread's context and the top
half handler is never called which means that we never read the
timestamp.
This issue came up when trying to read line events from a gpiochip
using regmap_irq_chip for interrupts.
Fix it by reading the timestamp from the irq thread function if it's
still 0 by the time the second handler is called.
Fixes: d58f2bf261fd ("gpio: Timestamp events in hardirq handler")
Cc: stable(a)vger.kernel.org
Signed-off-by: Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
---
v1 -> v2:
- add Fixes: to the commit message and Cc stable
- directly assing ktime_get_real_ns() to ge.timestamp
drivers/gpio/gpiolib.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 1651d7f0a303..d1adfdf50fb3 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -828,7 +828,14 @@ static irqreturn_t lineevent_irq_thread(int irq, void *p)
/* Do not leak kernel stack to userspace */
memset(&ge, 0, sizeof(ge));
- ge.timestamp = le->timestamp;
+ /*
+ * We may be running from a nested threaded interrupt in which case
+ * we didn't get the timestamp from lineevent_irq_handler().
+ */
+ if (!le->timestamp)
+ ge.timestamp = ktime_get_real_ns();
+ else
+ ge.timestamp = le->timestamp;
if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE
&& le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE) {
--
2.19.1
This is a note to let you know that I've just added the patch titled
tty: Don't hold ldisc lock in tty_reopen() if ldisc present
to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From d3736d82e8169768218ee0ef68718875918091a0 Mon Sep 17 00:00:00 2001
From: Dmitry Safonov <dima(a)arista.com>
Date: Wed, 9 Jan 2019 01:17:40 +0000
Subject: tty: Don't hold ldisc lock in tty_reopen() if ldisc present
Try to get reference for ldisc during tty_reopen().
If ldisc present, we don't need to do tty_ldisc_reinit() and lock the
write side for line discipline semaphore.
Effectively, it optimizes fast-path for tty_reopen(), but more
importantly it won't interrupt ongoing IO on the tty as no ldisc change
is needed.
Fixes user-visible issue when tty_reopen() interrupted login process for
user with a long password, observed and reported by Lukas.
Fixes: c96cf923a98d ("tty: Don't block on IO when ldisc change is pending")
Fixes: 83d817f41070 ("tty: Hold tty_ldisc_lock() during tty_reopen()")
Cc: Jiri Slaby <jslaby(a)suse.com>
Reported-by: Lukas F. Hartmann <lukas(a)mntmn.com>
Tested-by: Lukas F. Hartmann <lukas(a)mntmn.com>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Dmitry Safonov <dima(a)arista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/tty_io.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index bfe9ad85b362..23c6fd238422 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1256,7 +1256,8 @@ static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *
static int tty_reopen(struct tty_struct *tty)
{
struct tty_driver *driver = tty->driver;
- int retval;
+ struct tty_ldisc *ld;
+ int retval = 0;
if (driver->type == TTY_DRIVER_TYPE_PTY &&
driver->subtype == PTY_TYPE_MASTER)
@@ -1268,13 +1269,18 @@ static int tty_reopen(struct tty_struct *tty)
if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
return -EBUSY;
- retval = tty_ldisc_lock(tty, 5 * HZ);
- if (retval)
- return retval;
+ ld = tty_ldisc_ref_wait(tty);
+ if (ld) {
+ tty_ldisc_deref(ld);
+ } else {
+ retval = tty_ldisc_lock(tty, 5 * HZ);
+ if (retval)
+ return retval;
- if (!tty->ldisc)
- retval = tty_ldisc_reinit(tty, tty->termios.c_line);
- tty_ldisc_unlock(tty);
+ if (!tty->ldisc)
+ retval = tty_ldisc_reinit(tty, tty->termios.c_line);
+ tty_ldisc_unlock(tty);
+ }
if (retval == 0)
tty->count++;
--
2.20.1
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 283ac6d5fb2a47f12bcef7806b78acf6ad89907e Mon Sep 17 00:00:00 2001
From: Shuah Khan <shuah(a)kernel.org>
Date: Wed, 12 Dec 2018 20:25:14 -0700
Subject: [PATCH] selftests: Fix test errors related to lib.mk khdr target
Commit b2d35fa5fc80 ("selftests: add headers_install to lib.mk") added
khdr target to run headers_install target from the main Makefile. The
logic uses KSFT_KHDR_INSTALL and top_srcdir as controls to initialize
variables and include files to run headers_install from the top level
Makefile. There are a few problems with this logic.
1. Exposes top_srcdir to all tests
2. Common logic impacts all tests
3. Uses KSFT_KHDR_INSTALL, top_srcdir, and khdr in an adhoc way. Tests
add "khdr" dependency in their Makefiles to TEST_PROGS_EXTENDED in
some cases, and STATIC_LIBS in other cases. This makes this framework
confusing to use.
The common logic that runs for all tests even when KSFT_KHDR_INSTALL
isn't defined by the test. top_srcdir is initialized to a default value
when test doesn't initialize it. It works for all tests without a sub-dir
structure and tests with sub-dir structure fail to build.
e.g: make -C sparc64/drivers/ or make -C drivers/dma-buf
../../lib.mk:20: ../../../../scripts/subarch.include: No such file or directory
make: *** No rule to make target '../../../../scripts/subarch.include'. Stop.
There is no reason to require all tests to define top_srcdir and there is
no need to require tests to add khdr dependency using adhoc changes to
TEST_* and other variables.
Fix it with a consistent use of KSFT_KHDR_INSTALL and top_srcdir from tests
that have the dependency on headers_install.
Change common logic to include khdr target define and "all" target with
dependency on khdr when KSFT_KHDR_INSTALL is defined.
Only tests that have dependency on headers_install have to define just
the KSFT_KHDR_INSTALL, and top_srcdir variables and there is no need to
specify khdr dependency in the test Makefiles.
Fixes: b2d35fa5fc80 ("selftests: add headers_install to lib.mk")
Cc: stable(a)vger.kernel.org
Signed-off-by: Shuah Khan <shuah(a)kernel.org>
Reviewed-by: Khalid Aziz <khalid.aziz(a)oracle.com>
Reviewed-by: Anders Roxell <anders.roxell(a)linaro.org>
Signed-off-by: Shuah Khan <shuah(a)kernel.org>
diff --git a/tools/testing/selftests/android/Makefile b/tools/testing/selftests/android/Makefile
index d9a725478375..72c25a3cb658 100644
--- a/tools/testing/selftests/android/Makefile
+++ b/tools/testing/selftests/android/Makefile
@@ -6,7 +6,7 @@ TEST_PROGS := run.sh
include ../lib.mk
-all: khdr
+all:
@for DIR in $(SUBDIRS); do \
BUILD_TARGET=$(OUTPUT)/$$DIR; \
mkdir $$BUILD_TARGET -p; \
diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile
index ad1eeb14fda7..30996306cabc 100644
--- a/tools/testing/selftests/futex/functional/Makefile
+++ b/tools/testing/selftests/futex/functional/Makefile
@@ -19,6 +19,7 @@ TEST_GEN_FILES := \
TEST_PROGS := run.sh
top_srcdir = ../../../../..
+KSFT_KHDR_INSTALL := 1
include ../../lib.mk
$(TEST_GEN_FILES): $(HEADERS)
diff --git a/tools/testing/selftests/gpio/Makefile b/tools/testing/selftests/gpio/Makefile
index f22b22aef7bf..0bb80619db58 100644
--- a/tools/testing/selftests/gpio/Makefile
+++ b/tools/testing/selftests/gpio/Makefile
@@ -16,8 +16,6 @@ TEST_PROGS_EXTENDED := gpio-mockup-chardev
GPIODIR := $(realpath ../../../gpio)
GPIOOBJ := gpio-utils.o
-include ../lib.mk
-
all: $(TEST_PROGS_EXTENDED)
override define CLEAN
@@ -25,7 +23,9 @@ override define CLEAN
$(MAKE) -C $(GPIODIR) OUTPUT=$(GPIODIR)/ clean
endef
-$(TEST_PROGS_EXTENDED):| khdr
+KSFT_KHDR_INSTALL := 1
+include ../lib.mk
+
$(TEST_PROGS_EXTENDED): $(GPIODIR)/$(GPIOOBJ)
$(GPIODIR)/$(GPIOOBJ):
diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile
index 01a219229238..52bfe5e76907 100644
--- a/tools/testing/selftests/kvm/Makefile
+++ b/tools/testing/selftests/kvm/Makefile
@@ -1,6 +1,7 @@
all:
top_srcdir = ../../../..
+KSFT_KHDR_INSTALL := 1
UNAME_M := $(shell uname -m)
LIBKVM = lib/assert.c lib/elf.c lib/io.c lib/kvm_util.c lib/ucall.c lib/sparsebit.c
@@ -44,7 +45,6 @@ $(OUTPUT)/libkvm.a: $(LIBKVM_OBJ)
all: $(STATIC_LIBS)
$(TEST_GEN_PROGS): $(STATIC_LIBS)
-$(STATIC_LIBS):| khdr
cscope: include_paths = $(LINUX_TOOL_INCLUDE) $(LINUX_HDR_PATH) include lib ..
cscope:
diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
index 0a8e75886224..8b0f16409ed7 100644
--- a/tools/testing/selftests/lib.mk
+++ b/tools/testing/selftests/lib.mk
@@ -16,18 +16,18 @@ TEST_GEN_PROGS := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_PROGS))
TEST_GEN_PROGS_EXTENDED := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_PROGS_EXTENDED))
TEST_GEN_FILES := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_FILES))
+ifdef KSFT_KHDR_INSTALL
top_srcdir ?= ../../../..
include $(top_srcdir)/scripts/subarch.include
ARCH ?= $(SUBARCH)
-all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
-
.PHONY: khdr
khdr:
make ARCH=$(ARCH) -C $(top_srcdir) headers_install
-ifdef KSFT_KHDR_INSTALL
-$(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES):| khdr
+all: khdr $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
+else
+all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
endif
.ONESHELL:
diff --git a/tools/testing/selftests/networking/timestamping/Makefile b/tools/testing/selftests/networking/timestamping/Makefile
index 14cfcf006936..c46c0eefab9e 100644
--- a/tools/testing/selftests/networking/timestamping/Makefile
+++ b/tools/testing/selftests/networking/timestamping/Makefile
@@ -6,6 +6,7 @@ TEST_PROGS := hwtstamp_config rxtimestamp timestamping txtimestamp
all: $(TEST_PROGS)
top_srcdir = ../../../../..
+KSFT_KHDR_INSTALL := 1
include ../../lib.mk
clean:
diff --git a/tools/testing/selftests/tc-testing/bpf/Makefile b/tools/testing/selftests/tc-testing/bpf/Makefile
index dc92eb271d9a..be5a5e542804 100644
--- a/tools/testing/selftests/tc-testing/bpf/Makefile
+++ b/tools/testing/selftests/tc-testing/bpf/Makefile
@@ -4,6 +4,7 @@ APIDIR := ../../../../include/uapi
TEST_GEN_FILES = action.o
top_srcdir = ../../../../..
+KSFT_KHDR_INSTALL := 1
include ../../lib.mk
CLANG ?= clang
diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile
index 6e67e726e5a5..e13eb6cc8901 100644
--- a/tools/testing/selftests/vm/Makefile
+++ b/tools/testing/selftests/vm/Makefile
@@ -25,6 +25,7 @@ TEST_GEN_FILES += virtual_address_range
TEST_PROGS := run_vmtests
+KSFT_KHDR_INSTALL := 1
include ../lib.mk
$(OUTPUT)/userfaultfd: LDLIBS += -lpthread
on i386 or x86_64:
Lots of build errors for drivers/pinctrl/mediatek/pinctrl-moore.c when
CONFIG_OF is not enabled (but COMPILE_TEST is).
first this:
WARNING: unmet direct dependencies detected for PINCTRL_MTK_MOORE
Depends on [n]: PINCTRL [=y] && (ARCH_MEDIATEK || COMPILE_TEST [=y]) && OF [=n]
Selected by [y]:
- PINCTRL_MT7623 [=y] && PINCTRL [=y] && (ARCH_MEDIATEK || COMPILE_TEST [=y]) && (MACH_MT7623 || COMPILE_TEST [=y])
and then:
../drivers/pinctrl/mediatek/pinctrl-moore.c:22:44: error: array type has incomplete element type
static const struct pinconf_generic_params mtk_custom_bindings[] = {
^
../drivers/pinctrl/mediatek/pinctrl-moore.c: In function 'mtk_pinmux_set_mux':
../drivers/pinctrl/mediatek/pinctrl-moore.c:46:2: error: implicit declaration of function 'pinmux_generic_get_function' [-Werror=implicit-function-declaration]
func = pinmux_generic_get_function(pctldev, selector);
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:46:7: warning: assignment makes pointer from integer without a cast [enabled by default]
func = pinmux_generic_get_function(pctldev, selector);
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:50:2: error: implicit declaration of function 'pinctrl_generic_get_group' [-Werror=implicit-function-declaration]
grp = pinctrl_generic_get_group(pctldev, group);
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:50:6: warning: assignment makes pointer from integer without a cast [enabled by default]
grp = pinctrl_generic_get_group(pctldev, group);
^
In file included from ../include/linux/printk.h:331:0,
from ../include/linux/kernel.h:14,
from ../include/linux/list.h:9,
from ../include/linux/kobject.h:19,
from ../include/linux/device.h:16,
from ../include/linux/gpio/driver.h:5,
from ../drivers/pinctrl/mediatek/pinctrl-moore.c:11:
../drivers/pinctrl/mediatek/pinctrl-moore.c:55:7: error: dereferencing pointer to incomplete type
func->name, grp->name);
^
../include/linux/dynamic_debug.h:136:9: note: in definition of macro 'dynamic_dev_dbg'
##__VA_ARGS__); \
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:54:2: note: in expansion of macro 'dev_dbg'
dev_dbg(pctldev->dev, "enable function %s group %s\n",
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:55:18: error: dereferencing pointer to incomplete type
func->name, grp->name);
^
../include/linux/dynamic_debug.h:136:9: note: in definition of macro 'dynamic_dev_dbg'
##__VA_ARGS__); \
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:54:2: note: in expansion of macro 'dev_dbg'
dev_dbg(pctldev->dev, "enable function %s group %s\n",
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:57:21: error: dereferencing pointer to incomplete type
for (i = 0; i < grp->num_pins; i++) {
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:59:23: error: dereferencing pointer to incomplete type
int *pin_modes = grp->data;
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:60:16: error: dereferencing pointer to incomplete type
int pin = grp->pins[i];
^
../drivers/pinctrl/mediatek/pinctrl-moore.c: In function 'mtk_pinconf_group_get':
../drivers/pinctrl/mediatek/pinctrl-moore.c:357:2: error: implicit declaration of function 'pinctrl_generic_get_group_pins' [-Werror=implicit-function-declaration]
ret = pinctrl_generic_get_group_pins(pctldev, group, &pins, &npins);
^
../drivers/pinctrl/mediatek/pinctrl-moore.c: At top level:
../drivers/pinctrl/mediatek/pinctrl-moore.c:397:22: error: 'pinctrl_generic_get_group_count' undeclared here (not in a function)
.get_groups_count = pinctrl_generic_get_group_count,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:398:20: error: 'pinctrl_generic_get_group_name' undeclared here (not in a function)
.get_group_name = pinctrl_generic_get_group_name,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:399:20: error: 'pinctrl_generic_get_group_pins' undeclared here (not in a function)
.get_group_pins = pinctrl_generic_get_group_pins,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:400:20: error: 'pinconf_generic_dt_node_to_map_all' undeclared here (not in a function)
.dt_node_to_map = pinconf_generic_dt_node_to_map_all,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:401:17: error: 'pinconf_generic_dt_free_map' undeclared here (not in a function)
.dt_free_map = pinconf_generic_dt_free_map,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:405:25: error: 'pinmux_generic_get_function_count' undeclared here (not in a function)
.get_functions_count = pinmux_generic_get_function_count,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:406:23: error: 'pinmux_generic_get_function_name' undeclared here (not in a function)
.get_function_name = pinmux_generic_get_function_name,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:407:25: error: 'pinmux_generic_get_function_groups' undeclared here (not in a function)
.get_function_groups = pinmux_generic_get_function_groups,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c: In function 'mtk_build_gpiochip':
../drivers/pinctrl/mediatek/pinctrl-moore.c:521:6: error: 'struct gpio_chip' has no member named 'of_node'
chip->of_node = np;
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:522:6: error: 'struct gpio_chip' has no member named 'of_gpio_n_cells'
chip->of_gpio_n_cells = 2;
^
../drivers/pinctrl/mediatek/pinctrl-moore.c: In function 'mtk_build_groups':
../drivers/pinctrl/mediatek/pinctrl-moore.c:552:16: error: invalid use of undefined type 'struct group_desc'
const struct group_desc *group = hw->soc->grps + i;
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:554:3: error: implicit declaration of function 'pinctrl_generic_add_group' [-Werror=implicit-function-declaration]
err = pinctrl_generic_add_group(hw->pctrl, group->name,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:554:51: error: dereferencing pointer to incomplete type
err = pinctrl_generic_add_group(hw->pctrl, group->name,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:555:12: error: dereferencing pointer to incomplete type
group->pins, group->num_pins,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:555:25: error: dereferencing pointer to incomplete type
group->pins, group->num_pins,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:556:12: error: dereferencing pointer to incomplete type
group->data);
^
In file included from ../include/linux/gpio/driver.h:5:0,
from ../drivers/pinctrl/mediatek/pinctrl-moore.c:11:
../drivers/pinctrl/mediatek/pinctrl-moore.c:559:10: error: dereferencing pointer to incomplete type
group->name);
^
../include/linux/device.h:1463:32: note: in definition of macro 'dev_err'
_dev_err(dev, dev_fmt(fmt), ##__VA_ARGS__)
^
../drivers/pinctrl/mediatek/pinctrl-moore.c: In function 'mtk_build_functions':
../drivers/pinctrl/mediatek/pinctrl-moore.c:572:16: error: invalid use of undefined type 'struct function_desc'
const struct function_desc *func = hw->soc->funcs + i;
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:574:3: error: implicit declaration of function 'pinmux_generic_add_function' [-Werror=implicit-function-declaration]
err = pinmux_generic_add_function(hw->pctrl, func->name,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:574:52: error: dereferencing pointer to incomplete type
err = pinmux_generic_add_function(hw->pctrl, func->name,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:575:13: error: dereferencing pointer to incomplete type
func->group_names,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:576:13: error: dereferencing pointer to incomplete type
func->num_group_names,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:577:13: error: dereferencing pointer to incomplete type
func->data);
^
In file included from ../include/linux/gpio/driver.h:5:0,
from ../drivers/pinctrl/mediatek/pinctrl-moore.c:11:
../drivers/pinctrl/mediatek/pinctrl-moore.c:580:9: error: dereferencing pointer to incomplete type
func->name);
^
../include/linux/device.h:1463:32: note: in definition of macro 'dev_err'
_dev_err(dev, dev_fmt(fmt), ##__VA_ARGS__)
^
In file included from ../include/linux/kernel.h:15:0,
from ../include/linux/list.h:9,
from ../include/linux/kobject.h:19,
from ../include/linux/device.h:16,
from ../include/linux/gpio/driver.h:5,
from ../drivers/pinctrl/mediatek/pinctrl-moore.c:11:
../drivers/pinctrl/mediatek/pinctrl-moore.c: In function 'mtk_moore_pinctrl_probe':
../include/linux/build_bug.h:16:45: error: bit-field '<anonymous>' width not an integer constant
#define BUILD_BUG_ON_ZERO(e) (sizeof(struct { int:(-!!(e)); }))
^
../include/linux/compiler.h:349:28: note: in expansion of macro 'BUILD_BUG_ON_ZERO'
#define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
^
../include/linux/kernel.h:72:59: note: in expansion of macro '__must_be_array'
#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:643:31: note: in expansion of macro 'ARRAY_SIZE'
mtk_desc.num_custom_params = ARRAY_SIZE(mtk_custom_bindings);
^
../drivers/pinctrl/mediatek/pinctrl-moore.c: At top level:
../drivers/pinctrl/mediatek/pinctrl-moore.c:22:44: warning: 'mtk_custom_bindings' defined but not used [-Wunused-variable]
static const struct pinconf_generic_params mtk_custom_bindings[] = {
^
cc1: some warnings being treated as errors
../scripts/Makefile.build:276: recipe for target 'drivers/pinctrl/mediatek/pinctrl-moore.o' failed
make[4]: *** [drivers/pinctrl/mediatek/pinctrl-moore.o] Error 1
Fixes: b5af33df50e9 ("pinctrl: mediatek: improve Kconfig dependencies")
Cc: stable(a)vger.kernel.org
Reported-by: Randy Dunlap <rdunlap(a)infradead.org>
Signed-off-by: Ryder Lee <ryder.lee(a)mediatek.com>
---
drivers/pinctrl/mediatek/Kconfig | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/pinctrl/mediatek/Kconfig b/drivers/pinctrl/mediatek/Kconfig
index 1817786..a005cbc 100644
--- a/drivers/pinctrl/mediatek/Kconfig
+++ b/drivers/pinctrl/mediatek/Kconfig
@@ -45,12 +45,14 @@ config PINCTRL_MT2701
config PINCTRL_MT7623
bool "Mediatek MT7623 pin control with generic binding"
depends on MACH_MT7623 || COMPILE_TEST
+ depends on OF
default MACH_MT7623
select PINCTRL_MTK_MOORE
config PINCTRL_MT7629
bool "Mediatek MT7629 pin control"
depends on MACH_MT7629 || COMPILE_TEST
+ depends on OF
default MACH_MT7629
select PINCTRL_MTK_MOORE
@@ -92,6 +94,7 @@ config PINCTRL_MT6797
config PINCTRL_MT7622
bool "MediaTek MT7622 pin control"
+ depends on OF
depends on ARM64 || COMPILE_TEST
default ARM64 && ARCH_MEDIATEK
select PINCTRL_MTK_MOORE
--
1.9.1
Hi,
Here is a series of kprobes blacklist bugfix and improvements mainly
on x86 (since I started testing on qemu-x86).
This has been started from discussion about KPROBE_ENENTS_ON_NOTRACE
configuration. I tried to find notrace functions which can cause kernel
crash with kprobes using following script.
====
#!/bin/sh
i=0;
cat notrace_functions | while read f ; do
if echo p:event$i $f >> /sys/kernel/debug/tracing/kprobe_events; then
echo "Probing on $f"
echo 1 > /sys/kernel/debug/tracing/events/kprobes/event$i/enable
fi
i=$((i+1))
done
====
And I found several functions which must be blacklisted.
- optprobe template code, which is just a template code and
never be executed. Moreover, since it can be copied and
reused, if we probe it, it modifies the template code and
can cause a crash. ([1/9][2/9])
- functions which is called before kprobe_int3_handler()
handles kprobes. This can cause a breakpoint recursion. ([3/9])
- IRQ entry text, which should not be probed since register/pagetable
status has not been stable at that point. ([4/9])
- Suffixed symbols, like .constprop, .part etc. Those suffixed
symbols never be blacklisted even if the non-suffixed version
has been blacklisted. ([5/9])
- hardirq tracer also works before int3 handling. ([6/9])
- preempt_check debug function also is involved in int3 handling.
([7/9])
- RCU debug routine is also called before kprobe_int3_handler().
([8/9])
- Some lockdep functions are also involved in int3 handling.
([9/9])
Of course there still may be some functions which can be called
by configuration change, I'll continue to test it.
Thank you,
---
Masami Hiramatsu (9):
x86/kprobes: Prohibit probing on optprobe template code
x86/kprobes: Move trampoline code into RODATA
x86/kprobes: Prohibit probing on functions before kprobe_int3_handler()
x86/kprobes: Prohibit probing on IRQ handlers directly
kprobes: Search non-suffixed symbol in blacklist
kprobes: Prohibit probing on hardirq tracers
kprobes: Prohibit probing on preempt_check debug functions
kprobes: Prohibit probing on RCU debug routine
kprobes: Prohibit probing on lockdep functions
arch/x86/kernel/alternative.c | 3 ++-
arch/x86/kernel/ftrace.c | 3 ++-
arch/x86/kernel/kprobes/core.c | 7 +++++++
arch/x86/kernel/kprobes/opt.c | 4 ++--
arch/x86/kernel/traps.c | 1 +
kernel/kprobes.c | 21 ++++++++++++++++++++-
kernel/locking/lockdep.c | 7 ++++++-
kernel/rcu/tree.c | 2 ++
kernel/rcu/update.c | 2 ++
kernel/trace/trace_irqsoff.c | 9 +++++++--
kernel/trace/trace_preemptirq.c | 5 +++++
lib/smp_processor_id.c | 7 +++++--
12 files changed, 61 insertions(+), 10 deletions(-)
--
Masami Hiramatsu (Linaro) <mhiramat(a)kernel.org>
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 4eda776c3cefcb1f01b2d85bd8753f67606282b5 Mon Sep 17 00:00:00 2001
From: Enric Balletbo i Serra <enric.balletbo(a)collabora.com>
Date: Sat, 13 Oct 2018 12:56:54 +0200
Subject: [PATCH] drm/rockchip: psr: do not dereference encoder before it is
null checked.
'encoder' is dereferenced before it is null sanity checked, hence we
potentially have a null pointer dereference bug. Instead, initialise
drm_drv from encoder->dev->dev_private after we are sure 'encoder' is
not null.
Fixes: 5182c1a556d7f ("drm/rockchip: add an common abstracted PSR driver")
Cc: stable(a)vger.kernel.org
Signed-off-by: Enric Balletbo i Serra <enric.balletbo(a)collabora.com>
Signed-off-by: Heiko Stuebner <heiko(a)sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20181013105654.11827-1-enric.…
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_psr.c b/drivers/gpu/drm/rockchip/rockchip_drm_psr.c
index 79d00d861a31..01ff3c858875 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_psr.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_psr.c
@@ -189,12 +189,14 @@ EXPORT_SYMBOL(rockchip_drm_psr_flush_all);
int rockchip_drm_psr_register(struct drm_encoder *encoder,
int (*psr_set)(struct drm_encoder *, bool enable))
{
- struct rockchip_drm_private *drm_drv = encoder->dev->dev_private;
+ struct rockchip_drm_private *drm_drv;
struct psr_drv *psr;
if (!encoder || !psr_set)
return -EINVAL;
+ drm_drv = encoder->dev->dev_private;
+
psr = kzalloc(sizeof(struct psr_drv), GFP_KERNEL);
if (!psr)
return -ENOMEM;
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 4eda776c3cefcb1f01b2d85bd8753f67606282b5 Mon Sep 17 00:00:00 2001
From: Enric Balletbo i Serra <enric.balletbo(a)collabora.com>
Date: Sat, 13 Oct 2018 12:56:54 +0200
Subject: [PATCH] drm/rockchip: psr: do not dereference encoder before it is
null checked.
'encoder' is dereferenced before it is null sanity checked, hence we
potentially have a null pointer dereference bug. Instead, initialise
drm_drv from encoder->dev->dev_private after we are sure 'encoder' is
not null.
Fixes: 5182c1a556d7f ("drm/rockchip: add an common abstracted PSR driver")
Cc: stable(a)vger.kernel.org
Signed-off-by: Enric Balletbo i Serra <enric.balletbo(a)collabora.com>
Signed-off-by: Heiko Stuebner <heiko(a)sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20181013105654.11827-1-enric.…
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_psr.c b/drivers/gpu/drm/rockchip/rockchip_drm_psr.c
index 79d00d861a31..01ff3c858875 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_psr.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_psr.c
@@ -189,12 +189,14 @@ EXPORT_SYMBOL(rockchip_drm_psr_flush_all);
int rockchip_drm_psr_register(struct drm_encoder *encoder,
int (*psr_set)(struct drm_encoder *, bool enable))
{
- struct rockchip_drm_private *drm_drv = encoder->dev->dev_private;
+ struct rockchip_drm_private *drm_drv;
struct psr_drv *psr;
if (!encoder || !psr_set)
return -EINVAL;
+ drm_drv = encoder->dev->dev_private;
+
psr = kzalloc(sizeof(struct psr_drv), GFP_KERNEL);
if (!psr)
return -ENOMEM;
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 211929fd3f7c8de4d541b1cc243b82830e5ea1e8 Mon Sep 17 00:00:00 2001
From: Shuah Khan <shuah(a)kernel.org>
Date: Wed, 12 Dec 2018 20:25:14 -0700
Subject: [PATCH] selftests: Fix test errors related to lib.mk khdr target
Commit b2d35fa5fc80 ("selftests: add headers_install to lib.mk") added
khdr target to run headers_install target from the main Makefile. The
logic uses KSFT_KHDR_INSTALL and top_srcdir as controls to initialize
variables and include files to run headers_install from the top level
Makefile. There are a few problems with this logic.
1. Exposes top_srcdir to all tests
2. Common logic impacts all tests
3. Uses KSFT_KHDR_INSTALL, top_srcdir, and khdr in an adhoc way. Tests
add "khdr" dependency in their Makefiles to TEST_PROGS_EXTENDED in
some cases, and STATIC_LIBS in other cases. This makes this framework
confusing to use.
The common logic that runs for all tests even when KSFT_KHDR_INSTALL
isn't defined by the test. top_srcdir is initialized to a default value
when test doesn't initialize it. It works for all tests without a sub-dir
structure and tests with sub-dir structure fail to build.
e.g: make -C sparc64/drivers/ or make -C drivers/dma-buf
../../lib.mk:20: ../../../../scripts/subarch.include: No such file or directory
make: *** No rule to make target '../../../../scripts/subarch.include'. Stop.
There is no reason to require all tests to define top_srcdir and there is
no need to require tests to add khdr dependency using adhoc changes to
TEST_* and other variables.
Fix it with a consistent use of KSFT_KHDR_INSTALL and top_srcdir from tests
that have the dependency on headers_install.
Change common logic to include khdr target define and "all" target with
dependency on khdr when KSFT_KHDR_INSTALL is defined.
Only tests that have dependency on headers_install have to define just
the KSFT_KHDR_INSTALL, and top_srcdir variables and there is no need to
specify khdr dependency in the test Makefiles.
Fixes: b2d35fa5fc80 ("selftests: add headers_install to lib.mk")
Cc: stable(a)vger.kernel.org
Signed-off-by: Shuah Khan <shuah(a)kernel.org>
diff --git a/tools/testing/selftests/android/Makefile b/tools/testing/selftests/android/Makefile
index d9a725478375..72c25a3cb658 100644
--- a/tools/testing/selftests/android/Makefile
+++ b/tools/testing/selftests/android/Makefile
@@ -6,7 +6,7 @@ TEST_PROGS := run.sh
include ../lib.mk
-all: khdr
+all:
@for DIR in $(SUBDIRS); do \
BUILD_TARGET=$(OUTPUT)/$$DIR; \
mkdir $$BUILD_TARGET -p; \
diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile
index ad1eeb14fda7..30996306cabc 100644
--- a/tools/testing/selftests/futex/functional/Makefile
+++ b/tools/testing/selftests/futex/functional/Makefile
@@ -19,6 +19,7 @@ TEST_GEN_FILES := \
TEST_PROGS := run.sh
top_srcdir = ../../../../..
+KSFT_KHDR_INSTALL := 1
include ../../lib.mk
$(TEST_GEN_FILES): $(HEADERS)
diff --git a/tools/testing/selftests/gpio/Makefile b/tools/testing/selftests/gpio/Makefile
index 46648427d537..07f572a1bd3f 100644
--- a/tools/testing/selftests/gpio/Makefile
+++ b/tools/testing/selftests/gpio/Makefile
@@ -10,8 +10,6 @@ TEST_PROGS_EXTENDED := gpio-mockup-chardev
GPIODIR := $(realpath ../../../gpio)
GPIOOBJ := gpio-utils.o
-include ../lib.mk
-
all: $(TEST_PROGS_EXTENDED)
override define CLEAN
@@ -19,7 +17,9 @@ override define CLEAN
$(MAKE) -C $(GPIODIR) OUTPUT=$(GPIODIR)/ clean
endef
-$(TEST_PROGS_EXTENDED):| khdr
+KSFT_KHDR_INSTALL := 1
+include ../lib.mk
+
$(TEST_PROGS_EXTENDED): $(GPIODIR)/$(GPIOOBJ)
$(GPIODIR)/$(GPIOOBJ):
diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile
index 01a219229238..52bfe5e76907 100644
--- a/tools/testing/selftests/kvm/Makefile
+++ b/tools/testing/selftests/kvm/Makefile
@@ -1,6 +1,7 @@
all:
top_srcdir = ../../../..
+KSFT_KHDR_INSTALL := 1
UNAME_M := $(shell uname -m)
LIBKVM = lib/assert.c lib/elf.c lib/io.c lib/kvm_util.c lib/ucall.c lib/sparsebit.c
@@ -44,7 +45,6 @@ $(OUTPUT)/libkvm.a: $(LIBKVM_OBJ)
all: $(STATIC_LIBS)
$(TEST_GEN_PROGS): $(STATIC_LIBS)
-$(STATIC_LIBS):| khdr
cscope: include_paths = $(LINUX_TOOL_INCLUDE) $(LINUX_HDR_PATH) include lib ..
cscope:
diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
index 0a8e75886224..8b0f16409ed7 100644
--- a/tools/testing/selftests/lib.mk
+++ b/tools/testing/selftests/lib.mk
@@ -16,18 +16,18 @@ TEST_GEN_PROGS := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_PROGS))
TEST_GEN_PROGS_EXTENDED := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_PROGS_EXTENDED))
TEST_GEN_FILES := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_FILES))
+ifdef KSFT_KHDR_INSTALL
top_srcdir ?= ../../../..
include $(top_srcdir)/scripts/subarch.include
ARCH ?= $(SUBARCH)
-all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
-
.PHONY: khdr
khdr:
make ARCH=$(ARCH) -C $(top_srcdir) headers_install
-ifdef KSFT_KHDR_INSTALL
-$(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES):| khdr
+all: khdr $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
+else
+all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
endif
.ONESHELL:
diff --git a/tools/testing/selftests/networking/timestamping/Makefile b/tools/testing/selftests/networking/timestamping/Makefile
index 14cfcf006936..c46c0eefab9e 100644
--- a/tools/testing/selftests/networking/timestamping/Makefile
+++ b/tools/testing/selftests/networking/timestamping/Makefile
@@ -6,6 +6,7 @@ TEST_PROGS := hwtstamp_config rxtimestamp timestamping txtimestamp
all: $(TEST_PROGS)
top_srcdir = ../../../../..
+KSFT_KHDR_INSTALL := 1
include ../../lib.mk
clean:
diff --git a/tools/testing/selftests/tc-testing/bpf/Makefile b/tools/testing/selftests/tc-testing/bpf/Makefile
index dc92eb271d9a..be5a5e542804 100644
--- a/tools/testing/selftests/tc-testing/bpf/Makefile
+++ b/tools/testing/selftests/tc-testing/bpf/Makefile
@@ -4,6 +4,7 @@ APIDIR := ../../../../include/uapi
TEST_GEN_FILES = action.o
top_srcdir = ../../../../..
+KSFT_KHDR_INSTALL := 1
include ../../lib.mk
CLANG ?= clang
diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile
index 6e67e726e5a5..e13eb6cc8901 100644
--- a/tools/testing/selftests/vm/Makefile
+++ b/tools/testing/selftests/vm/Makefile
@@ -25,6 +25,7 @@ TEST_GEN_FILES += virtual_address_range
TEST_PROGS := run_vmtests
+KSFT_KHDR_INSTALL := 1
include ../lib.mk
$(OUTPUT)/userfaultfd: LDLIBS += -lpthread
On Wed, 2019-01-09 at 15:52 +0000, Sasha Levin wrote:
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: 79e539453b34 DRM: i915: add mode setting support.
>
> The bot has tested the following trees: v4.20.0, v4.19.13, v4.14.91, v4.9.148, v4.4.169, v3.18.131.
>
> v4.20.0: Failed to apply! Possible dependencies:
> 042bf753842d ("drm/fourcc: Add char_per_block, block_w and block_h in drm_format_info")
> 9c71a6686bfa ("drm: fourcc: Convert drm_format_info kerneldoc to in-line member documentation")
>
> v4.19.13: Failed to apply! Possible dependencies:
> 042bf753842d ("drm/fourcc: Add char_per_block, block_w and block_h in drm_format_info")
> 9c71a6686bfa ("drm: fourcc: Convert drm_format_info kerneldoc to in-line member documentation")
> c76abab59b3c ("drm: Use horizontal and vertical chroma subsampling factor while calculating offsets in the physical address of framebuffer")
>
> v4.14.91: Failed to apply! Possible dependencies:
> 042bf753842d ("drm/fourcc: Add char_per_block, block_w and block_h in drm_format_info")
> 4cc4e1b40f3f ("drm/fourcc: Add a alpha field to drm_format_info")
> 9c71a6686bfa ("drm: fourcc: Convert drm_format_info kerneldoc to in-line member documentation")
> c76abab59b3c ("drm: Use horizontal and vertical chroma subsampling factor while calculating offsets in the physical address of framebuffer")
> ce2d54619a10 ("drm/fourcc: Add is_yuv field to drm_format_info to denote if the format is yuv")
>
> v4.9.148: Failed to apply! Possible dependencies:
> 042bf753842d ("drm/fourcc: Add char_per_block, block_w and block_h in drm_format_info")
> 05fc03217e08 ("drm/mm: Some doc polish")
> 06df8ac682e6 ("drm: kselftest for drm_mm_debug()")
> 14d7f96f90fb ("drm/fb_cma_helper: Add drm_fb_cma_prepare_fb() helper")
> 2bd966d106e3 ("drm: kselftest for drm_mm_replace_node()")
> 2fba0de0a9ec ("drm: kselftest for drm_mm_insert_node_in_range()")
> 393b50f30566 ("drm: kselftest for drm_mm_init()")
> 4636ce93d5b2 ("drm/fb-cma-helper: Add drm_fb_cma_get_gem_addr()")
> 50f0033d1a0f ("drm: Add some kselftests for the DRM range manager (struct drm_mm)")
> 5628648df755 ("drm/fb-cma-helper: Use drm_gem_framebuffer_helper")
> 5705670d0463 ("drm: Track drm_mm allocators and show leaks on shutdown")
> 6259a56ba0e1 ("drm: Add asserts to catch overflow in drm_mm_init() and drm_mm_init_scan()")
> 62a0d98a188c ("drm: allow to use mmuless SoC")
> 72a93e8dd52c ("drm: Take ownership of the dmabuf->obj when exporting")
> 7886692a5804 ("drm: kselftest for drm_mm_insert_node()")
> 900537dc3889 ("drm: kselftest for drm_mm_reserve_node()")
> 940eba2d58a7 ("drm/gem|prime|mm: Use recommened kerneldoc for struct member refs")
> 9a71e277888b ("drm: Extract struct drm_mm_scan from struct drm_mm")
> 9b26f2ed29f8 ("drm: kselftest for drm_mm and alignment")
> b112481bb327 ("drm/cma-helper: simplify setup for drivers with ->dirty callbacks")
> b3ee963fe41d ("drm: Compile time enabling for asserts in drm_mm")
> ba004e39b199 ("drm: Fix kerneldoc for drm_mm_scan_remove_block()")
> c76abab59b3c ("drm: Use horizontal and vertical chroma subsampling factor while calculating offsets in the physical address of framebuffer")
> e6b62714e87c ("drm: Introduce drm_gem_object_{get,put}()")
>
> v4.4.169: Failed to apply! Possible dependencies:
> 042bf753842d ("drm/fourcc: Add char_per_block, block_w and block_h in drm_format_info")
> 14d7f96f90fb ("drm/fb_cma_helper: Add drm_fb_cma_prepare_fb() helper")
> 199c77179c87 ("drm/fb-cma-helper: Add fb_deferred_io support")
> 1eb83451ba55 ("drm: Pass the user drm_mode_fb_cmd2 as const to .fb_create()")
> 4636ce93d5b2 ("drm/fb-cma-helper: Add drm_fb_cma_get_gem_addr()")
> 5628648df755 ("drm/fb-cma-helper: Use drm_gem_framebuffer_helper")
> 70c0616d5a84 ("drm/fb_cma_helper: remove duplicate const from drm_fb_cma_alloc")
> b112481bb327 ("drm/cma-helper: simplify setup for drivers with ->dirty callbacks")
> c76abab59b3c ("drm: Use horizontal and vertical chroma subsampling factor while calculating offsets in the physical address of framebuffer")
> ce0c57576810 ("drm/fb_cma_helper: Implement fb_mmap callback")
> fdce184609ee ("drm/fb-cma-helper: Use const for drm_framebuffer_funcs argument")
>
> v3.18.131: Failed to apply! Possible dependencies:
> 042bf753842d ("drm/fourcc: Add char_per_block, block_w and block_h in drm_format_info")
> 14d7f96f90fb ("drm/fb_cma_helper: Add drm_fb_cma_prepare_fb() helper")
> 199c77179c87 ("drm/fb-cma-helper: Add fb_deferred_io support")
> 1a396789f65a ("drm: add Atmel HLCDC Display Controller support")
> 1eb83451ba55 ("drm: Pass the user drm_mode_fb_cmd2 as const to .fb_create()")
> 2a8cb4894540 ("drm/exynos: merge exynos_drm_buf.c to exynos_drm_gem.c")
> 2b8376c803c4 ("drm/exynos: remove struct exynos_drm_encoder layer")
> 39a839f2e651 ("drm/exynos: s/exynos_gem_obj/obj in exynos_drm_fbdev.c")
> 421ee18d4e04 ("drm/exynos: fix null pointer dereference issue")
> 4636ce93d5b2 ("drm/fb-cma-helper: Add drm_fb_cma_get_gem_addr()")
> 4846e4520849 ("drm/exynos: clean up machine compatible string check")
> 5628648df755 ("drm/fb-cma-helper: Use drm_gem_framebuffer_helper")
> 5cbb37df378d ("drm/exynos: resolve infinite loop issue on multi-platform")
> 70c0616d5a84 ("drm/fb_cma_helper: remove duplicate const from drm_fb_cma_alloc")
> 7239067795dc ("drm/exynos: remove ifdeferry from initialization code")
> 7ded85885d49 ("drm/exynos: remove superfluous error messages")
> 813fd67b57ff ("drm/exynos: cleanup name of gem object for exynos_drm")
> 820687befec4 ("drm/exynos: move Exynos platform drivers registration to init")
> 94e30d93f936 ("drm/exynos: remove exynos_drm_fb_set_buf_cnt()")
> 96976c3d9aff ("drm/exynos: Add DECON driver")
> b74ea6a97e82 ("drm/exynos: remove DRM_EXYNOS_DMABUF config")
> c76abab59b3c ("drm: Use horizontal and vertical chroma subsampling factor while calculating offsets in the physical address of framebuffer")
> ce0c57576810 ("drm/fb_cma_helper: Implement fb_mmap callback")
> cf67cc9a29ac ("drm/exynos: remove struct exynos_drm_display")
> d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
> d56125afcbdf ("drm/exynos: update exynos_drm_framebuffer_init() for multiple buffers")
> e9fbdcb45a36 ("drm/exynos: fix possible infinite loop issue")
>
>
> How should we proceed with this patch?
>
> --
> Thanks,
> Sasha
Hi,
I'm new to kernel development, so: what exactly I'm supposed to do in
such case? Rebase my patch on top of older versions and then resend
patches somewhere?
Just checked the v3.18.131. Apparently code in question was not changed
since then, so manual rebase would be trivial.
On 29/11/2018 02:22, Hans van Kranenburg wrote:
> Hi,
>
> As also seen at:
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914951
>
> Attached there are two serial console output logs. One is starting with
> Xen 4.11 (from debian unstable) as dom0, and the other one without Xen.
>
> [ 2.085543] BUG: unable to handle kernel paging request at
> ffff888d9fffc000
> [ 2.085610] PGD 200c067 P4D 200c067 PUD 0
> [ 2.085674] Oops: 0000 [#1] SMP NOPTI
> [ 2.085736] CPU: 1 PID: 1 Comm: swapper/0 Not tainted
> 4.19.0-trunk-amd64 #1 Debian 4.19.5-1~exp1+pvh1
> [ 2.085823] Hardware name: HP ProLiant DL360 G7, BIOS P68 05/21/2018
> [ 2.085895] RIP: e030:ptdump_walk_pgd_level_core+0x1fd/0x490
> [...]
The offending stable commit is 4074ca7d8a1832921c865d250bbd08f3441b3657
("x86/mm: Move LDT remap out of KASLR region on 5-level paging"), this
is commit d52888aa2753e3063a9d3a0c9f72f94aa9809c15 upstream.
Current upstream kernel is booting fine under Xen, so in general the
patch should be fine. Using an upstream kernel built from above commit
(with the then needed Xen fixup patch 1457d8cf7664f34c4ba534) is fine,
too.
Kirill, are you aware of any prerequisite patch from 4.20 which could be
missing in 4.19.5?
Juergen
Hi,
please pick commit 9aec30371fb095a0c9415f3f0146ae269c3713d8 (leds: pwm:
silently error out on EPROBE_DEFER) from the 4.20 release to the stable
LTS version 4.19.
I own a Odroid HC1 and run Debian testing (with kernel 4.19) on it. It
produces these kernel warnings:
[ 14.718000] leds_pwm pwmleds: unable to request PWM for blue:heartbeat: -517
[ 14.752948] leds_pwm pwmleds: unable to request PWM for blue:heartbeat: -517
[ 14.771394] leds_pwm pwmleds: unable to request PWM for blue:heartbeat: -517
[ 14.799319] leds_pwm pwmleds: unable to request PWM for blue:heartbeat: -517
These messages were misleading me thinking that the blue heartbeat LED
isn't work (it works, but it is off by default).
--
Benjamin Drung
Debian & Ubuntu Developer
Hi Greg and Sasha,
Would you mind picking up this lone patch for 4.19 and 4.14 stable branches?
Attached are backports for 4.19 (applied cleanly) and 4.14 (needed to
be manually backported). Let me know if you'd prefer me to just send
2 emails (one for each patch). I considered using mbox files, but
seems like kind of a waste for a lone patch.
(Note that Autosel already picked up Upstream commit
3bbd3db86470c701091fb1d67f1fab6621debf50 which I would have included
with this one otherwise).
--
Thanks,
~Nick Desaulniers
Hi Greg and Sasha,
Attached is an mbox with a series of patches to allow building the
powerpc kernel with Clang. We have been running continuous integration
that builds and boots the kernel in QEMU for almost two months now with
no regressions. This is on top of 4.19.14, there should be no conflicts
but let me know if I messed something up.
I will send a series for 4.14 in a little bit as well.
Thank you,
Nathan
OUT endpoint requests may somtimes have this flag set when
preparing to be submitted to HW indicating that there is an
additional TRB chained to the request for alignment purposes.
If that request is removed before the controller can execute the
transfer (e.g. ep_dequeue/ep_disable), the request will not go
through the dwc3_gadget_ep_cleanup_completed_request() handler
and will not have its needs_extra_trb flag cleared when
dwc3_gadget_giveback() is called. This same request could be
later requeued for a new transfer that does not require an
extra TRB and if it is successfully completed, the cleanup
and TRB reclamation will incorrectly process the additional TRB
which belongs to the next request, and incorrectly advances the
TRB dequeue pointer, thereby messing up calculation of the next
requeust's actual/remaining count when it completes.
The right thing to do here is to ensure that the flag is cleared
before it is given back to the function driver. A good place
to do that is in dwc3_gadget_del_and_unmap_request().
Fixes: c6267a51639b ("usb: dwc3: gadget: align transfers to wMaxPacketSize")
Cc: stable(a)vger.kernel.org
Signed-off-by: Jack Pham <jackp(a)codeaurora.org>
---
v2: Added Fixes tag and Cc: stable
Felipe, as I mentioned in the cover for v1, for stable (from 4.11 where
c6267a51639b first landed through 4.20), the fix needs to be modified to
assign to the separate req->unaligned and req->zero flags in lieu of
needs_extra_trb which appeared in 5.0-rc1 in:
commit 1a22ec643580626f439c8583edafdcc73798f2fb
Author: Felipe Balbi <felipe.balbi(a)linux.intel.com>
Date: Wed Aug 1 13:15:05 2018 +0300
usb: dwc3: gadget: combine unaligned and zero flags
Do I need to send a separate patch for <= 4.20 or will you handle it?
It's straightforward really, the code change should instead be
+ req->unaligned = false;
+ req->zero = false;
Thanks,
Jack
drivers/usb/dwc3/gadget.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 2ecde30ad0b7..e97b14f444c8 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -177,6 +177,7 @@ static void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep,
req->started = false;
list_del(&req->list);
req->remaining = 0;
+ req->needs_extra_trb = false;
if (req->request.status == -EINPROGRESS)
req->request.status = status;
--
The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From c6d6e9b0f6b4201c77f2cea3964dd122697e3543 Mon Sep 17 00:00:00 2001
From: Jaegeuk Kim <jaegeuk(a)kernel.org>
Date: Tue, 18 Dec 2018 09:25:37 -0800
Subject: [PATCH] dm: do not allow readahead to limit IO size
Update DM to set the bdi's io_pages. This fixes reads to be capped at
the device's max request size (even if user's read IO exceeds the
established readahead setting).
Fixes: 9491ae4a ("mm: don't cap request size based on read-ahead setting")
Cc: stable(a)vger.kernel.org
Reviewed-by: Jens Axboe <axboe(a)kernel.dk>
Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org>
Signed-off-by: Mike Snitzer <snitzer(a)redhat.com>
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 844f7d0f2ef8..4b1be754cc41 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1927,6 +1927,9 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
*/
if (blk_queue_is_zoned(q))
blk_revalidate_disk_zones(t->md->disk);
+
+ /* Allow reads to exceed readahead limits */
+ q->backing_dev_info->io_pages = limits->max_sectors >> (PAGE_SHIFT - 9);
}
unsigned int dm_table_get_num_targets(struct dm_table *t)
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From c6d6e9b0f6b4201c77f2cea3964dd122697e3543 Mon Sep 17 00:00:00 2001
From: Jaegeuk Kim <jaegeuk(a)kernel.org>
Date: Tue, 18 Dec 2018 09:25:37 -0800
Subject: [PATCH] dm: do not allow readahead to limit IO size
Update DM to set the bdi's io_pages. This fixes reads to be capped at
the device's max request size (even if user's read IO exceeds the
established readahead setting).
Fixes: 9491ae4a ("mm: don't cap request size based on read-ahead setting")
Cc: stable(a)vger.kernel.org
Reviewed-by: Jens Axboe <axboe(a)kernel.dk>
Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org>
Signed-off-by: Mike Snitzer <snitzer(a)redhat.com>
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 844f7d0f2ef8..4b1be754cc41 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1927,6 +1927,9 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
*/
if (blk_queue_is_zoned(q))
blk_revalidate_disk_zones(t->md->disk);
+
+ /* Allow reads to exceed readahead limits */
+ q->backing_dev_info->io_pages = limits->max_sectors >> (PAGE_SHIFT - 9);
}
unsigned int dm_table_get_num_targets(struct dm_table *t)
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 0bfe5e434e6665b3590575ec3c5e4f86a1ce51c9 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai(a)suse.de>
Date: Wed, 19 Dec 2018 14:04:47 +0100
Subject: [PATCH] ALSA: usb-audio: Check mixer unit descriptors more strictly
We've had some sanity checks of the mixer unit descriptors but they
are too loose and some corner cases are overlooked. Add more strict
checks in uac_mixer_unit_get_channels() for avoiding possible OOB
accesses by malformed descriptors.
This also changes the semantics of uac_mixer_unit_get_channels()
slightly. Now it returns zero for the cases where the descriptor
lacks of bmControls instead of -EINVAL. Then the caller side skips
the mixer creation for such unit while it keeps parsing it.
This corresponds to the case like Maya44.
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai(a)suse.de>
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 0131de348cf6..dfd918891e69 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -753,8 +753,9 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
struct uac_mixer_unit_descriptor *desc)
{
int mu_channels;
+ void *c;
- if (desc->bLength < 11)
+ if (desc->bLength < sizeof(*desc))
return -EINVAL;
if (!desc->bNrInPins)
return -EINVAL;
@@ -763,6 +764,8 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
case UAC_VERSION_1:
case UAC_VERSION_2:
default:
+ if (desc->bLength < sizeof(*desc) + desc->bNrInPins + 1)
+ return 0; /* no bmControls -> skip */
mu_channels = uac_mixer_unit_bNrChannels(desc);
break;
case UAC_VERSION_3:
@@ -772,7 +775,11 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
}
if (!mu_channels)
- return -EINVAL;
+ return 0;
+
+ c = uac_mixer_unit_bmControls(desc, state->mixer->protocol);
+ if (c - (void *)desc + (mu_channels - 1) / 8 >= desc->bLength)
+ return 0; /* no bmControls -> skip */
return mu_channels;
}
@@ -944,7 +951,7 @@ static int check_input_term(struct mixer_build *state, int id,
struct uac_mixer_unit_descriptor *d = p1;
err = uac_mixer_unit_get_channels(state, d);
- if (err < 0)
+ if (err <= 0)
return err;
term->channels = err;
@@ -2118,7 +2125,7 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid,
if (err < 0)
continue;
/* no bmControls field (e.g. Maya44) -> ignore */
- if (desc->bLength <= 10 + input_pins)
+ if (!num_outs)
continue;
err = check_input_term(state, desc->baSourceID[pin], &iterm);
if (err < 0)
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 0bfe5e434e6665b3590575ec3c5e4f86a1ce51c9 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai(a)suse.de>
Date: Wed, 19 Dec 2018 14:04:47 +0100
Subject: [PATCH] ALSA: usb-audio: Check mixer unit descriptors more strictly
We've had some sanity checks of the mixer unit descriptors but they
are too loose and some corner cases are overlooked. Add more strict
checks in uac_mixer_unit_get_channels() for avoiding possible OOB
accesses by malformed descriptors.
This also changes the semantics of uac_mixer_unit_get_channels()
slightly. Now it returns zero for the cases where the descriptor
lacks of bmControls instead of -EINVAL. Then the caller side skips
the mixer creation for such unit while it keeps parsing it.
This corresponds to the case like Maya44.
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai(a)suse.de>
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 0131de348cf6..dfd918891e69 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -753,8 +753,9 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
struct uac_mixer_unit_descriptor *desc)
{
int mu_channels;
+ void *c;
- if (desc->bLength < 11)
+ if (desc->bLength < sizeof(*desc))
return -EINVAL;
if (!desc->bNrInPins)
return -EINVAL;
@@ -763,6 +764,8 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
case UAC_VERSION_1:
case UAC_VERSION_2:
default:
+ if (desc->bLength < sizeof(*desc) + desc->bNrInPins + 1)
+ return 0; /* no bmControls -> skip */
mu_channels = uac_mixer_unit_bNrChannels(desc);
break;
case UAC_VERSION_3:
@@ -772,7 +775,11 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
}
if (!mu_channels)
- return -EINVAL;
+ return 0;
+
+ c = uac_mixer_unit_bmControls(desc, state->mixer->protocol);
+ if (c - (void *)desc + (mu_channels - 1) / 8 >= desc->bLength)
+ return 0; /* no bmControls -> skip */
return mu_channels;
}
@@ -944,7 +951,7 @@ static int check_input_term(struct mixer_build *state, int id,
struct uac_mixer_unit_descriptor *d = p1;
err = uac_mixer_unit_get_channels(state, d);
- if (err < 0)
+ if (err <= 0)
return err;
term->channels = err;
@@ -2118,7 +2125,7 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid,
if (err < 0)
continue;
/* no bmControls field (e.g. Maya44) -> ignore */
- if (desc->bLength <= 10 + input_pins)
+ if (!num_outs)
continue;
err = check_input_term(state, desc->baSourceID[pin], &iterm);
if (err < 0)
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 0bfe5e434e6665b3590575ec3c5e4f86a1ce51c9 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai(a)suse.de>
Date: Wed, 19 Dec 2018 14:04:47 +0100
Subject: [PATCH] ALSA: usb-audio: Check mixer unit descriptors more strictly
We've had some sanity checks of the mixer unit descriptors but they
are too loose and some corner cases are overlooked. Add more strict
checks in uac_mixer_unit_get_channels() for avoiding possible OOB
accesses by malformed descriptors.
This also changes the semantics of uac_mixer_unit_get_channels()
slightly. Now it returns zero for the cases where the descriptor
lacks of bmControls instead of -EINVAL. Then the caller side skips
the mixer creation for such unit while it keeps parsing it.
This corresponds to the case like Maya44.
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai(a)suse.de>
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 0131de348cf6..dfd918891e69 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -753,8 +753,9 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
struct uac_mixer_unit_descriptor *desc)
{
int mu_channels;
+ void *c;
- if (desc->bLength < 11)
+ if (desc->bLength < sizeof(*desc))
return -EINVAL;
if (!desc->bNrInPins)
return -EINVAL;
@@ -763,6 +764,8 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
case UAC_VERSION_1:
case UAC_VERSION_2:
default:
+ if (desc->bLength < sizeof(*desc) + desc->bNrInPins + 1)
+ return 0; /* no bmControls -> skip */
mu_channels = uac_mixer_unit_bNrChannels(desc);
break;
case UAC_VERSION_3:
@@ -772,7 +775,11 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
}
if (!mu_channels)
- return -EINVAL;
+ return 0;
+
+ c = uac_mixer_unit_bmControls(desc, state->mixer->protocol);
+ if (c - (void *)desc + (mu_channels - 1) / 8 >= desc->bLength)
+ return 0; /* no bmControls -> skip */
return mu_channels;
}
@@ -944,7 +951,7 @@ static int check_input_term(struct mixer_build *state, int id,
struct uac_mixer_unit_descriptor *d = p1;
err = uac_mixer_unit_get_channels(state, d);
- if (err < 0)
+ if (err <= 0)
return err;
term->channels = err;
@@ -2118,7 +2125,7 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid,
if (err < 0)
continue;
/* no bmControls field (e.g. Maya44) -> ignore */
- if (desc->bLength <= 10 + input_pins)
+ if (!num_outs)
continue;
err = check_input_term(state, desc->baSourceID[pin], &iterm);
if (err < 0)
commit b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm
race")
An iptable rule like the following on a multicore systems will result in
accepting more connections than set in the rule.
iptables -A INPUT -p tcp -m tcp --syn --dport 7777 -m connlimit \
--connlimit-above 2000 --connlimit-mask 0 -j DROP
In check_hlist function, connections that are found in saved connections
but not in netfilter conntrack are deleted, assuming that those
connections do not exist anymore. But for multi core systems, there exists
a small time window, when a connection has been added to the xt_connlimit
maintained rb-tree but has not yet made to netfilter conntrack table. This
causes concurrent connections to return incorrect counts and go over limit
set in iptable rule.
The fix has been partially backported from the above mentioned upstream
commit. Introduce timestamp and the owning cpu.
Signed-off-by: Alakesh Haloi <alakeshh(a)amazon.com>
Cc: Pablo Neira Ayuso <pablo(a)netfilter.org>
Cc: Jozsef Kadlecsik <kadlec(a)blackhole.kfki.hu>
Cc: Florian Westphal <fw(a)strlen.de>
Cc: "David S. Miller" <davem(a)davemloft.net>
Cc: stable(a)vger.kernel.org # v4.15 and before
Cc: netdev(a)vger.kernel.org
Cc: Dmitry Andrianov <dmitry.andrianov(a)alertme.com>
Cc: Justin Pettit <jpettit(a)vmware.com>
Cc: Yi-Hung Wei <yihung.wei(a)gmail.com>
---
net/netfilter/xt_connlimit.c | 28 ++++++++++++++++++++++++++--
1 file changed, 26 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index ffa8eec..e7b092b 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -47,6 +47,8 @@ struct xt_connlimit_conn {
struct hlist_node node;
struct nf_conntrack_tuple tuple;
union nf_inet_addr addr;
+ int cpu;
+ u32 jiffies32;
};
struct xt_connlimit_rb {
@@ -126,6 +128,8 @@ static bool add_hlist(struct hlist_head *head,
return false;
conn->tuple = *tuple;
conn->addr = *addr;
+ conn->cpu = raw_smp_processor_id();
+ conn->jiffies32 = (u32)jiffies;
hlist_add_head(&conn->node, head);
return true;
}
@@ -148,8 +152,26 @@ static unsigned int check_hlist(struct net *net,
hlist_for_each_entry_safe(conn, n, head, node) {
found = nf_conntrack_find_get(net, zone, &conn->tuple);
if (found == NULL) {
- hlist_del(&conn->node);
- kmem_cache_free(connlimit_conn_cachep, conn);
+ /* If connection is not found, it may be because
+ * it has not made into conntrack table yet. We
+ * check if it is a recently created connection
+ * on a different core and do not delete it in that
+ * case.
+ */
+
+ unsigned long a, b;
+ int cpu = raw_smp_processor_id();
+ __u32 age;
+
+ b = conn->jiffies;
+ a = (u32)jiffies;
+ age = a - b;
+ if (conn->cpu != cpu && age <= 2) {
+ length++;
+ } else {
+ hlist_del(&conn->node);
+ kmem_cache_free(connlimit_conn_cachep, conn);
+ }
continue;
}
@@ -271,6 +293,8 @@ static void tree_nodes_free(struct rb_root *root,
conn->tuple = *tuple;
conn->addr = *addr;
+ conn->cpu = raw_smp_processor_id();
+ conn->jiffies32 = (u32)jiffies;
rbconn->addr = *addr;
INIT_HLIST_HEAD(&rbconn->hhead);
--
1.8.3.1
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From d57f9da890696af1484f4a47f7f123560197865a Mon Sep 17 00:00:00 2001
From: Damien Le Moal <damien.lemoal(a)wdc.com>
Date: Fri, 30 Nov 2018 15:31:48 +0900
Subject: [PATCH] dm zoned: Fix target BIO completion handling
struct bioctx includes the ref refcount_t to track the number of I/O
fragments used to process a target BIO as well as ensure that the zone
of the BIO is kept in the active state throughout the lifetime of the
BIO. However, since decrementing of this reference count is done in the
target .end_io method, the function bio_endio() must be called multiple
times for read and write target BIOs, which causes problems with the
value of the __bi_remaining struct bio field for chained BIOs (e.g. the
clone BIO passed by dm core is large and splits into fragments by the
block layer), resulting in incorrect values and inconsistencies with the
BIO_CHAIN flag setting. This is turn triggers the BUG_ON() call:
BUG_ON(atomic_read(&bio->__bi_remaining) <= 0);
in bio_remaining_done() called from bio_endio().
Fix this ensuring that bio_endio() is called only once for any target
BIO by always using internal clone BIOs for processing any read or
write target BIO. This allows reference counting using the target BIO
context counter to trigger the target BIO completion bio_endio() call
once all data, metadata and other zone work triggered by the BIO
complete.
Overall, this simplifies the code too as the target .end_io becomes
unnecessary and differences between read and write BIO issuing and
completion processing disappear.
Fixes: 3b1a94c88b79 ("dm zoned: drive-managed zoned block device target")
Cc: stable(a)vger.kernel.org
Signed-off-by: Damien Le Moal <damien.lemoal(a)wdc.com>
Signed-off-by: Mike Snitzer <snitzer(a)redhat.com>
diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c
index 981154e59461..6af5babe6837 100644
--- a/drivers/md/dm-zoned-target.c
+++ b/drivers/md/dm-zoned-target.c
@@ -20,7 +20,6 @@ struct dmz_bioctx {
struct dm_zone *zone;
struct bio *bio;
refcount_t ref;
- blk_status_t status;
};
/*
@@ -78,65 +77,66 @@ static inline void dmz_bio_endio(struct bio *bio, blk_status_t status)
{
struct dmz_bioctx *bioctx = dm_per_bio_data(bio, sizeof(struct dmz_bioctx));
- if (bioctx->status == BLK_STS_OK && status != BLK_STS_OK)
- bioctx->status = status;
- bio_endio(bio);
+ if (status != BLK_STS_OK && bio->bi_status == BLK_STS_OK)
+ bio->bi_status = status;
+
+ if (refcount_dec_and_test(&bioctx->ref)) {
+ struct dm_zone *zone = bioctx->zone;
+
+ if (zone) {
+ if (bio->bi_status != BLK_STS_OK &&
+ bio_op(bio) == REQ_OP_WRITE &&
+ dmz_is_seq(zone))
+ set_bit(DMZ_SEQ_WRITE_ERR, &zone->flags);
+ dmz_deactivate_zone(zone);
+ }
+ bio_endio(bio);
+ }
}
/*
- * Partial clone read BIO completion callback. This terminates the
+ * Completion callback for an internally cloned target BIO. This terminates the
* target BIO when there are no more references to its context.
*/
-static void dmz_read_bio_end_io(struct bio *bio)
+static void dmz_clone_endio(struct bio *clone)
{
- struct dmz_bioctx *bioctx = bio->bi_private;
- blk_status_t status = bio->bi_status;
+ struct dmz_bioctx *bioctx = clone->bi_private;
+ blk_status_t status = clone->bi_status;
- bio_put(bio);
+ bio_put(clone);
dmz_bio_endio(bioctx->bio, status);
}
/*
- * Issue a BIO to a zone. The BIO may only partially process the
+ * Issue a clone of a target BIO. The clone may only partially process the
* original target BIO.
*/
-static int dmz_submit_read_bio(struct dmz_target *dmz, struct dm_zone *zone,
- struct bio *bio, sector_t chunk_block,
- unsigned int nr_blocks)
+static int dmz_submit_bio(struct dmz_target *dmz, struct dm_zone *zone,
+ struct bio *bio, sector_t chunk_block,
+ unsigned int nr_blocks)
{
struct dmz_bioctx *bioctx = dm_per_bio_data(bio, sizeof(struct dmz_bioctx));
- sector_t sector;
struct bio *clone;
- /* BIO remap sector */
- sector = dmz_start_sect(dmz->metadata, zone) + dmz_blk2sect(chunk_block);
-
- /* If the read is not partial, there is no need to clone the BIO */
- if (nr_blocks == dmz_bio_blocks(bio)) {
- /* Setup and submit the BIO */
- bio->bi_iter.bi_sector = sector;
- refcount_inc(&bioctx->ref);
- generic_make_request(bio);
- return 0;
- }
-
- /* Partial BIO: we need to clone the BIO */
clone = bio_clone_fast(bio, GFP_NOIO, &dmz->bio_set);
if (!clone)
return -ENOMEM;
- /* Setup the clone */
- clone->bi_iter.bi_sector = sector;
+ bio_set_dev(clone, dmz->dev->bdev);
+ clone->bi_iter.bi_sector =
+ dmz_start_sect(dmz->metadata, zone) + dmz_blk2sect(chunk_block);
clone->bi_iter.bi_size = dmz_blk2sect(nr_blocks) << SECTOR_SHIFT;
- clone->bi_end_io = dmz_read_bio_end_io;
+ clone->bi_end_io = dmz_clone_endio;
clone->bi_private = bioctx;
bio_advance(bio, clone->bi_iter.bi_size);
- /* Submit the clone */
refcount_inc(&bioctx->ref);
generic_make_request(clone);
+ if (bio_op(bio) == REQ_OP_WRITE && dmz_is_seq(zone))
+ zone->wp_block += nr_blocks;
+
return 0;
}
@@ -214,7 +214,7 @@ static int dmz_handle_read(struct dmz_target *dmz, struct dm_zone *zone,
if (nr_blocks) {
/* Valid blocks found: read them */
nr_blocks = min_t(unsigned int, nr_blocks, end_block - chunk_block);
- ret = dmz_submit_read_bio(dmz, rzone, bio, chunk_block, nr_blocks);
+ ret = dmz_submit_bio(dmz, rzone, bio, chunk_block, nr_blocks);
if (ret)
return ret;
chunk_block += nr_blocks;
@@ -228,25 +228,6 @@ static int dmz_handle_read(struct dmz_target *dmz, struct dm_zone *zone,
return 0;
}
-/*
- * Issue a write BIO to a zone.
- */
-static void dmz_submit_write_bio(struct dmz_target *dmz, struct dm_zone *zone,
- struct bio *bio, sector_t chunk_block,
- unsigned int nr_blocks)
-{
- struct dmz_bioctx *bioctx = dm_per_bio_data(bio, sizeof(struct dmz_bioctx));
-
- /* Setup and submit the BIO */
- bio_set_dev(bio, dmz->dev->bdev);
- bio->bi_iter.bi_sector = dmz_start_sect(dmz->metadata, zone) + dmz_blk2sect(chunk_block);
- refcount_inc(&bioctx->ref);
- generic_make_request(bio);
-
- if (dmz_is_seq(zone))
- zone->wp_block += nr_blocks;
-}
-
/*
* Write blocks directly in a data zone, at the write pointer.
* If a buffer zone is assigned, invalidate the blocks written
@@ -265,7 +246,9 @@ static int dmz_handle_direct_write(struct dmz_target *dmz,
return -EROFS;
/* Submit write */
- dmz_submit_write_bio(dmz, zone, bio, chunk_block, nr_blocks);
+ ret = dmz_submit_bio(dmz, zone, bio, chunk_block, nr_blocks);
+ if (ret)
+ return ret;
/*
* Validate the blocks in the data zone and invalidate
@@ -301,7 +284,9 @@ static int dmz_handle_buffered_write(struct dmz_target *dmz,
return -EROFS;
/* Submit write */
- dmz_submit_write_bio(dmz, bzone, bio, chunk_block, nr_blocks);
+ ret = dmz_submit_bio(dmz, bzone, bio, chunk_block, nr_blocks);
+ if (ret)
+ return ret;
/*
* Validate the blocks in the buffer zone
@@ -600,7 +585,6 @@ static int dmz_map(struct dm_target *ti, struct bio *bio)
bioctx->zone = NULL;
bioctx->bio = bio;
refcount_set(&bioctx->ref, 1);
- bioctx->status = BLK_STS_OK;
/* Set the BIO pending in the flush list */
if (!nr_sectors && bio_op(bio) == REQ_OP_WRITE) {
@@ -623,35 +607,6 @@ static int dmz_map(struct dm_target *ti, struct bio *bio)
return DM_MAPIO_SUBMITTED;
}
-/*
- * Completed target BIO processing.
- */
-static int dmz_end_io(struct dm_target *ti, struct bio *bio, blk_status_t *error)
-{
- struct dmz_bioctx *bioctx = dm_per_bio_data(bio, sizeof(struct dmz_bioctx));
-
- if (bioctx->status == BLK_STS_OK && *error)
- bioctx->status = *error;
-
- if (!refcount_dec_and_test(&bioctx->ref))
- return DM_ENDIO_INCOMPLETE;
-
- /* Done */
- bio->bi_status = bioctx->status;
-
- if (bioctx->zone) {
- struct dm_zone *zone = bioctx->zone;
-
- if (*error && bio_op(bio) == REQ_OP_WRITE) {
- if (dmz_is_seq(zone))
- set_bit(DMZ_SEQ_WRITE_ERR, &zone->flags);
- }
- dmz_deactivate_zone(zone);
- }
-
- return DM_ENDIO_DONE;
-}
-
/*
* Get zoned device information.
*/
@@ -946,7 +901,6 @@ static struct target_type dmz_type = {
.ctr = dmz_ctr,
.dtr = dmz_dtr,
.map = dmz_map,
- .end_io = dmz_end_io,
.io_hints = dmz_io_hints,
.prepare_ioctl = dmz_prepare_ioctl,
.postsuspend = dmz_suspend,
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 744889b7cbb56a64f957e65ade7cb65fe3f35714 Mon Sep 17 00:00:00 2001
From: Ming Lei <ming.lei(a)redhat.com>
Date: Fri, 12 Oct 2018 15:53:10 +0800
Subject: [PATCH] block: don't deal with discard limit in
blkdev_issue_discard()
blk_queue_split() does respect this limit via bio splitting, so no
need to do that in blkdev_issue_discard(), then we can align to
normal bio submit(bio_add_page() & submit_bio()).
More importantly, this patch fixes one issue introduced in a22c4d7e34402cc
("block: re-add discard_granularity and alignment checks"), in which
zero discard bio may be generated in case of zero alignment.
Fixes: a22c4d7e34402ccdf3 ("block: re-add discard_granularity and alignment checks")
Cc: stable(a)vger.kernel.org
Cc: Ming Lin <ming.l(a)ssi.samsung.com>
Cc: Mike Snitzer <snitzer(a)redhat.com>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: Xiao Ni <xni(a)redhat.com>
Tested-by: Mariusz Dabrowski <mariusz.dabrowski(a)intel.com>
Signed-off-by: Ming Lei <ming.lei(a)redhat.com>
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
diff --git a/block/blk-lib.c b/block/blk-lib.c
index d1b9dd03da25..bbd44666f2b5 100644
--- a/block/blk-lib.c
+++ b/block/blk-lib.c
@@ -29,9 +29,7 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
{
struct request_queue *q = bdev_get_queue(bdev);
struct bio *bio = *biop;
- unsigned int granularity;
unsigned int op;
- int alignment;
sector_t bs_mask;
if (!q)
@@ -54,38 +52,16 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
if ((sector | nr_sects) & bs_mask)
return -EINVAL;
- /* Zero-sector (unknown) and one-sector granularities are the same. */
- granularity = max(q->limits.discard_granularity >> 9, 1U);
- alignment = (bdev_discard_alignment(bdev) >> 9) % granularity;
-
while (nr_sects) {
- unsigned int req_sects;
- sector_t end_sect, tmp;
+ unsigned int req_sects = nr_sects;
+ sector_t end_sect;
- /*
- * Issue in chunks of the user defined max discard setting,
- * ensuring that bi_size doesn't overflow
- */
- req_sects = min_t(sector_t, nr_sects,
- q->limits.max_discard_sectors);
if (!req_sects)
goto fail;
if (req_sects > UINT_MAX >> 9)
req_sects = UINT_MAX >> 9;
- /*
- * If splitting a request, and the next starting sector would be
- * misaligned, stop the discard at the previous aligned sector.
- */
end_sect = sector + req_sects;
- tmp = end_sect;
- if (req_sects < nr_sects &&
- sector_div(tmp, granularity) != alignment) {
- end_sect = end_sect - alignment;
- sector_div(end_sect, granularity);
- end_sect = end_sect * granularity + alignment;
- req_sects = end_sect - sector;
- }
bio = next_bio(bio, 0, gfp_mask);
bio->bi_iter.bi_sector = sector;
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From e4b069e0945fa14c71cf8b5b89f8b1b2aa68dbc2 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka(a)redhat.com>
Date: Wed, 22 Aug 2018 12:45:51 -0400
Subject: [PATCH] dm verity: fix crash on bufio buffer that was allocated with
vmalloc
Since commit d1ac3ff008fb ("dm verity: switch to using asynchronous hash
crypto API") dm-verity uses asynchronous crypto calls for verification,
so that it can use hardware with asynchronous processing of crypto
operations.
These asynchronous calls don't support vmalloc memory, but the buffer data
can be allocated with vmalloc if dm-bufio is short of memory and uses a
reserved buffer that was preallocated in dm_bufio_client_create().
Fix verity_hash_update() so that it deals with vmalloc'd memory
correctly.
Reported-by: "Xiao, Jin" <jin.xiao(a)intel.com>
Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com>
Fixes: d1ac3ff008fb ("dm verity: switch to using asynchronous hash crypto API")
Cc: stable(a)vger.kernel.org # 4.12+
Signed-off-by: Mike Snitzer <snitzer(a)redhat.com>
diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
index 12decdbd722d..fc65f0dedf7f 100644
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -99,10 +99,26 @@ static int verity_hash_update(struct dm_verity *v, struct ahash_request *req,
{
struct scatterlist sg;
- sg_init_one(&sg, data, len);
- ahash_request_set_crypt(req, &sg, NULL, len);
-
- return crypto_wait_req(crypto_ahash_update(req), wait);
+ if (likely(!is_vmalloc_addr(data))) {
+ sg_init_one(&sg, data, len);
+ ahash_request_set_crypt(req, &sg, NULL, len);
+ return crypto_wait_req(crypto_ahash_update(req), wait);
+ } else {
+ do {
+ int r;
+ size_t this_step = min_t(size_t, len, PAGE_SIZE - offset_in_page(data));
+ flush_kernel_vmap_range((void *)data, this_step);
+ sg_init_table(&sg, 1);
+ sg_set_page(&sg, vmalloc_to_page(data), this_step, offset_in_page(data));
+ ahash_request_set_crypt(req, &sg, NULL, this_step);
+ r = crypto_wait_req(crypto_ahash_update(req), wait);
+ if (unlikely(r))
+ return r;
+ data += this_step;
+ len -= this_step;
+ } while (len);
+ return 0;
+ }
}
/*
On 1/3/19 5:52 AM, Sasha Levin wrote:
> This commit has been processed because it contains a -stable tag.
> The stable tag indicates that it's relevant for the following trees: all
>
> The bot has tested the following trees: v4.20.0, v4.19.13, v4.14.91, v4.9.148, v4.4.169, v3.18.131,
>
> v4.20.0: Build OK!
> v4.19.13: Build OK!
> v4.14.91: Build OK!
> v4.9.148: Failed to apply! Possible dependencies:
> f50b4878329a ("x86/pkeys/selftests: Fix pkey exhaustion test off-by-one")
Protection keys was merged in 4.8. We can ignore any of the selftests
changes before that.
But, it looks like the 4.9 selftests are a bit behind mainline.
Probably because I didn't cc stable@ on f50b4878329a. I don't have a
strong opinion as to how up-to-date we want to keep the -stable
selftests. Shua, is there a usual way that folks do this?
commit c92a54cfa0257e8ffd66b2a17d49e9c0bd4b769f upstream
This fix appears in 4.20, but dma_direct_supported() was changed in 4.20
such that the original version of the fix will not apply to previous
versions of the kernel. The fix only applies to the 4.19-stable tree and
has been backported for that tree.
The dma_direct_supported() function intends to check the DMA mask against
specific values. However, the phys_to_dma() function includes the SME
encryption mask, which defeats the intended purpose of the check. This
results in drivers that support less than 48-bit DMA (SME encryption mask
is bit 47) from being able to set the DMA mask successfully when SME is
active, which results in the driver failing to initialize.
Change the function used to check the mask from phys_to_dma() to
__phys_to_dma() so that the SME encryption mask is not part of the check.
Fixes: c1d0af1a1d5d ("kernel/dma/direct: take DMA offset into account in dma_direct_supported")
Cc: <stable(a)vger.kernel.org> # 4.19.x
Signed-off-by: Tom Lendacky <thomas.lendacky(a)amd.com>
---
kernel/dma/direct.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c
index de87b02..1d2f147 100644
--- a/kernel/dma/direct.c
+++ b/kernel/dma/direct.c
@@ -168,7 +168,12 @@ int dma_direct_map_sg(struct device *dev, struct scatterlist *sgl, int nents,
int dma_direct_supported(struct device *dev, u64 mask)
{
#ifdef CONFIG_ZONE_DMA
- if (mask < phys_to_dma(dev, DMA_BIT_MASK(ARCH_ZONE_DMA_BITS)))
+ /*
+ * This check needs to be against the actual bit mask value, so
+ * use __phys_to_dma() here so that the SME encryption mask isn't
+ * part of the check.
+ */
+ if (mask < __phys_to_dma(dev, DMA_BIT_MASK(ARCH_ZONE_DMA_BITS)))
return 0;
#else
/*
@@ -176,8 +181,12 @@ int dma_direct_supported(struct device *dev, u64 mask)
* to be able to satisfy them - either by not supporting more physical
* memory, or by providing a ZONE_DMA32. If neither is the case, the
* architecture needs to use an IOMMU instead of the direct mapping.
+ *
+ * This check needs to be against the actual bit mask value, so
+ * use __phys_to_dma() here so that the SME encryption mask isn't
+ * part of the check.
*/
- if (mask < phys_to_dma(dev, DMA_BIT_MASK(32)))
+ if (mask < __phys_to_dma(dev, DMA_BIT_MASK(32)))
return 0;
#endif
/*
--
1.9.1
Please apply mainline commit a72b69dc083a931422cc8a5e33841aff7d5312f2
("vhost/vsock: fix uninitialized vhost_vsock->guest_cid") to the v4.9
and v4.14 stable branches.
I believe this is the root cause of an issue uncovered by applying
"vhost/vsock: fix use-after-free in network stack callers" in these
branches. I sometimes see a crash in hash_del_rcu() with vsock in the
call stack, and that call is protected by a newly-added check of
vsock->guest_cid, which was uninitialized before this commit.
v4.4 doesn't have vsock, and v4.19 already has this commit, so they
don't need to be fixed.
Thanks,
-- Daniel
From: Eric Biggers <ebiggers(a)google.com>
Hi Greg, please consider applying this to 4.9-stable and 4.4-stable.
It's a minimal fix for a bug that was fixed incidentally by a large
refactoring in v4.11.
>8------------------------------------------------------8<
In chacha20-simd, clear the MAY_SLEEP flag in the blkcipher_desc to
prevent sleeping with preemption disabled, under kernel_fpu_begin().
This was fixed upstream incidentally by a large refactoring,
commit 9ae433bc79f9 ("crypto: chacha20 - convert generic and x86
versions to skcipher"). But syzkaller easily trips over this when
running on older kernels, as it's easily reachable via AF_ALG.
Therefore, this patch makes the minimal fix for older kernels.
Fixes: c9320b6dcb89 ("crypto: chacha20 - Add a SSSE3 SIMD variant for x86_64")
Cc: linux-crypto(a)vger.kernel.org
Cc: Martin Willi <martin(a)strongswan.org>
Cc: Ard Biesheuvel <ard.biesheuvel(a)linaro.org>
Signed-off-by: Eric Biggers <ebiggers(a)google.com>
---
arch/x86/crypto/chacha20_glue.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/crypto/chacha20_glue.c b/arch/x86/crypto/chacha20_glue.c
index f910d1d449f00..0a5fedf43bdc8 100644
--- a/arch/x86/crypto/chacha20_glue.c
+++ b/arch/x86/crypto/chacha20_glue.c
@@ -77,6 +77,7 @@ static int chacha20_simd(struct blkcipher_desc *desc, struct scatterlist *dst,
blkcipher_walk_init(&walk, dst, src, nbytes);
err = blkcipher_walk_virt_block(desc, &walk, CHACHA20_BLOCK_SIZE);
+ desc->flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
crypto_chacha20_init(state, crypto_blkcipher_ctx(desc->tfm), walk.iv);
--
2.20.1.97.g81188d93c3-goog
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From adcc81f148d733b7e8e641300c5590a2cdc13bf3 Mon Sep 17 00:00:00 2001
From: Paul Burton <paul.burton(a)mips.com>
Date: Thu, 20 Dec 2018 17:45:43 +0000
Subject: [PATCH] MIPS: math-emu: Write-protect delay slot emulation pages
Mapping the delay slot emulation page as both writeable & executable
presents a security risk, in that if an exploit can write to & jump into
the page then it can be used as an easy way to execute arbitrary code.
Prevent this by mapping the page read-only for userland, and using
access_process_vm() with the FOLL_FORCE flag to write to it from
mips_dsemul().
This will likely be less efficient due to copy_to_user_page() performing
cache maintenance on a whole page, rather than a single line as in the
previous use of flush_cache_sigtramp(). However this delay slot
emulation code ought not to be running in any performance critical paths
anyway so this isn't really a problem, and we can probably do better in
copy_to_user_page() anyway in future.
A major advantage of this approach is that the fix is small & simple to
backport to stable kernels.
Reported-by: Andy Lutomirski <luto(a)kernel.org>
Signed-off-by: Paul Burton <paul.burton(a)mips.com>
Fixes: 432c6bacbd0c ("MIPS: Use per-mm page to execute branch delay slot instructions")
Cc: stable(a)vger.kernel.org # v4.8+
Cc: linux-mips(a)vger.kernel.org
Cc: linux-kernel(a)vger.kernel.org
Cc: Rich Felker <dalias(a)libc.org>
Cc: David Daney <david.daney(a)cavium.com>
diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c
index 48a9c6b90e07..9df3ebdc7b0f 100644
--- a/arch/mips/kernel/vdso.c
+++ b/arch/mips/kernel/vdso.c
@@ -126,8 +126,8 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
/* Map delay slot emulation page */
base = mmap_region(NULL, STACK_TOP, PAGE_SIZE,
- VM_READ|VM_WRITE|VM_EXEC|
- VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC,
+ VM_READ | VM_EXEC |
+ VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC,
0, NULL);
if (IS_ERR_VALUE(base)) {
ret = base;
diff --git a/arch/mips/math-emu/dsemul.c b/arch/mips/math-emu/dsemul.c
index 5450f4d1c920..e2d46cb93ca9 100644
--- a/arch/mips/math-emu/dsemul.c
+++ b/arch/mips/math-emu/dsemul.c
@@ -214,8 +214,9 @@ int mips_dsemul(struct pt_regs *regs, mips_instruction ir,
{
int isa16 = get_isa16_mode(regs->cp0_epc);
mips_instruction break_math;
- struct emuframe __user *fr;
- int err, fr_idx;
+ unsigned long fr_uaddr;
+ struct emuframe fr;
+ int fr_idx, ret;
/* NOP is easy */
if (ir == 0)
@@ -250,27 +251,31 @@ int mips_dsemul(struct pt_regs *regs, mips_instruction ir,
fr_idx = alloc_emuframe();
if (fr_idx == BD_EMUFRAME_NONE)
return SIGBUS;
- fr = &dsemul_page()[fr_idx];
/* Retrieve the appropriately encoded break instruction */
break_math = BREAK_MATH(isa16);
/* Write the instructions to the frame */
if (isa16) {
- err = __put_user(ir >> 16,
- (u16 __user *)(&fr->emul));
- err |= __put_user(ir & 0xffff,
- (u16 __user *)((long)(&fr->emul) + 2));
- err |= __put_user(break_math >> 16,
- (u16 __user *)(&fr->badinst));
- err |= __put_user(break_math & 0xffff,
- (u16 __user *)((long)(&fr->badinst) + 2));
+ union mips_instruction _emul = {
+ .halfword = { ir >> 16, ir }
+ };
+ union mips_instruction _badinst = {
+ .halfword = { break_math >> 16, break_math }
+ };
+
+ fr.emul = _emul.word;
+ fr.badinst = _badinst.word;
} else {
- err = __put_user(ir, &fr->emul);
- err |= __put_user(break_math, &fr->badinst);
+ fr.emul = ir;
+ fr.badinst = break_math;
}
- if (unlikely(err)) {
+ /* Write the frame to user memory */
+ fr_uaddr = (unsigned long)&dsemul_page()[fr_idx];
+ ret = access_process_vm(current, fr_uaddr, &fr, sizeof(fr),
+ FOLL_FORCE | FOLL_WRITE);
+ if (unlikely(ret != sizeof(fr))) {
MIPS_FPU_EMU_INC_STATS(errors);
free_emuframe(fr_idx, current->mm);
return SIGBUS;
@@ -282,10 +287,7 @@ int mips_dsemul(struct pt_regs *regs, mips_instruction ir,
atomic_set(¤t->thread.bd_emu_frame, fr_idx);
/* Change user register context to execute the frame */
- regs->cp0_epc = (unsigned long)&fr->emul | isa16;
-
- /* Ensure the icache observes our newly written frame */
- flush_cache_sigtramp((unsigned long)&fr->emul);
+ regs->cp0_epc = fr_uaddr | isa16;
return 0;
}
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From d4b09acf924b84bae77cad090a9d108e70b43643 Mon Sep 17 00:00:00 2001
From: Vasily Averin <vvs(a)virtuozzo.com>
Date: Mon, 24 Dec 2018 14:44:52 +0300
Subject: [PATCH] sunrpc: use-after-free in svc_process_common()
if node have NFSv41+ mounts inside several net namespaces
it can lead to use-after-free in svc_process_common()
svc_process_common()
/* Setup reply header */
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); <<< HERE
svc_process_common() can use incorrect rqstp->rq_xprt,
its caller function bc_svc_process() takes it from serv->sv_bc_xprt.
The problem is that serv is global structure but sv_bc_xprt
is assigned per-netnamespace.
According to Trond, the whole "let's set up rqstp->rq_xprt
for the back channel" is nothing but a giant hack in order
to work around the fact that svc_process_common() uses it
to find the xpt_ops, and perform a couple of (meaningless
for the back channel) tests of xpt_flags.
All we really need in svc_process_common() is to be able to run
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr()
Bruce J Fields points that this xpo_prep_reply_hdr() call
is an awfully roundabout way just to do "svc_putnl(resv, 0);"
in the tcp case.
This patch does not initialiuze rqstp->rq_xprt in bc_svc_process(),
now it calls svc_process_common() with rqstp->rq_xprt = NULL.
To adjust reply header svc_process_common() just check
rqstp->rq_prot and calls svc_tcp_prep_reply_hdr() for tcp case.
To handle rqstp->rq_xprt = NULL case in functions called from
svc_process_common() patch intruduces net namespace pointer
svc_rqst->rq_bc_net and adjust SVC_NET() definition.
Some other function was also adopted to properly handle described case.
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
Cc: stable(a)vger.kernel.org
Fixes: 23c20ecd4475 ("NFS: callback up - users counting cleanup")
Signed-off-by: J. Bruce Fields <bfields(a)redhat.com>
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 73e130a840ce..fdb6b317d974 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -295,9 +295,12 @@ struct svc_rqst {
struct svc_cacherep * rq_cacherep; /* cache info */
struct task_struct *rq_task; /* service thread */
spinlock_t rq_lock; /* per-request lock */
+ struct net *rq_bc_net; /* pointer to backchannel's
+ * net namespace
+ */
};
-#define SVC_NET(svc_rqst) (svc_rqst->rq_xprt->xpt_net)
+#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net)
/*
* Rigorous type checking on sockaddr type conversions
diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
index 28e384186c35..8617f4fd6b70 100644
--- a/include/trace/events/sunrpc.h
+++ b/include/trace/events/sunrpc.h
@@ -569,7 +569,8 @@ TRACE_EVENT(svc_process,
__field(u32, vers)
__field(u32, proc)
__string(service, name)
- __string(addr, rqst->rq_xprt->xpt_remotebuf)
+ __string(addr, rqst->rq_xprt ?
+ rqst->rq_xprt->xpt_remotebuf : "(null)")
),
TP_fast_assign(
@@ -577,7 +578,8 @@ TRACE_EVENT(svc_process,
__entry->vers = rqst->rq_vers;
__entry->proc = rqst->rq_proc;
__assign_str(service, name);
- __assign_str(addr, rqst->rq_xprt->xpt_remotebuf);
+ __assign_str(addr, rqst->rq_xprt ?
+ rqst->rq_xprt->xpt_remotebuf : "(null)");
),
TP_printk("addr=%s xid=0x%08x service=%s vers=%u proc=%u",
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index d13e05f1a990..fb647bc01fc5 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1172,7 +1172,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
clear_bit(RQ_DROPME, &rqstp->rq_flags);
/* Setup reply header */
- rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp);
+ if (rqstp->rq_prot == IPPROTO_TCP)
+ svc_tcp_prep_reply_hdr(rqstp);
svc_putu32(resv, rqstp->rq_xid);
@@ -1244,7 +1245,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
* for lower versions. RPC_PROG_MISMATCH seems to be the closest
* fit.
*/
- if (versp->vs_need_cong_ctrl &&
+ if (versp->vs_need_cong_ctrl && rqstp->rq_xprt &&
!test_bit(XPT_CONG_CTRL, &rqstp->rq_xprt->xpt_flags))
goto err_bad_vers;
@@ -1336,7 +1337,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
return 0;
close:
- if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
+ if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
svc_close_xprt(rqstp->rq_xprt);
dprintk("svc: svc_process close\n");
return 0;
@@ -1459,10 +1460,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
dprintk("svc: %s(%p)\n", __func__, req);
/* Build the svc_rqst used by the common processing routine */
- rqstp->rq_xprt = serv->sv_bc_xprt;
rqstp->rq_xid = req->rq_xid;
rqstp->rq_prot = req->rq_xprt->prot;
rqstp->rq_server = serv;
+ rqstp->rq_bc_net = req->rq_xprt->xprt_net;
rqstp->rq_addrlen = sizeof(req->rq_xprt->addr);
memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 51d36230b6e3..bd42da287c26 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -468,10 +468,11 @@ static struct svc_xprt *svc_xprt_dequeue(struct svc_pool *pool)
*/
void svc_reserve(struct svc_rqst *rqstp, int space)
{
+ struct svc_xprt *xprt = rqstp->rq_xprt;
+
space += rqstp->rq_res.head[0].iov_len;
- if (space < rqstp->rq_reserved) {
- struct svc_xprt *xprt = rqstp->rq_xprt;
+ if (xprt && space < rqstp->rq_reserved) {
atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved);
rqstp->rq_reserved = space;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 986f3ed7d1a2..793149ba1bda 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1173,7 +1173,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp)
/*
* Setup response header. TCP has a 4B record length field.
*/
-static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
+void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
{
struct kvec *resv = &rqstp->rq_res.head[0];
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From d4b09acf924b84bae77cad090a9d108e70b43643 Mon Sep 17 00:00:00 2001
From: Vasily Averin <vvs(a)virtuozzo.com>
Date: Mon, 24 Dec 2018 14:44:52 +0300
Subject: [PATCH] sunrpc: use-after-free in svc_process_common()
if node have NFSv41+ mounts inside several net namespaces
it can lead to use-after-free in svc_process_common()
svc_process_common()
/* Setup reply header */
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); <<< HERE
svc_process_common() can use incorrect rqstp->rq_xprt,
its caller function bc_svc_process() takes it from serv->sv_bc_xprt.
The problem is that serv is global structure but sv_bc_xprt
is assigned per-netnamespace.
According to Trond, the whole "let's set up rqstp->rq_xprt
for the back channel" is nothing but a giant hack in order
to work around the fact that svc_process_common() uses it
to find the xpt_ops, and perform a couple of (meaningless
for the back channel) tests of xpt_flags.
All we really need in svc_process_common() is to be able to run
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr()
Bruce J Fields points that this xpo_prep_reply_hdr() call
is an awfully roundabout way just to do "svc_putnl(resv, 0);"
in the tcp case.
This patch does not initialiuze rqstp->rq_xprt in bc_svc_process(),
now it calls svc_process_common() with rqstp->rq_xprt = NULL.
To adjust reply header svc_process_common() just check
rqstp->rq_prot and calls svc_tcp_prep_reply_hdr() for tcp case.
To handle rqstp->rq_xprt = NULL case in functions called from
svc_process_common() patch intruduces net namespace pointer
svc_rqst->rq_bc_net and adjust SVC_NET() definition.
Some other function was also adopted to properly handle described case.
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
Cc: stable(a)vger.kernel.org
Fixes: 23c20ecd4475 ("NFS: callback up - users counting cleanup")
Signed-off-by: J. Bruce Fields <bfields(a)redhat.com>
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 73e130a840ce..fdb6b317d974 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -295,9 +295,12 @@ struct svc_rqst {
struct svc_cacherep * rq_cacherep; /* cache info */
struct task_struct *rq_task; /* service thread */
spinlock_t rq_lock; /* per-request lock */
+ struct net *rq_bc_net; /* pointer to backchannel's
+ * net namespace
+ */
};
-#define SVC_NET(svc_rqst) (svc_rqst->rq_xprt->xpt_net)
+#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net)
/*
* Rigorous type checking on sockaddr type conversions
diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
index 28e384186c35..8617f4fd6b70 100644
--- a/include/trace/events/sunrpc.h
+++ b/include/trace/events/sunrpc.h
@@ -569,7 +569,8 @@ TRACE_EVENT(svc_process,
__field(u32, vers)
__field(u32, proc)
__string(service, name)
- __string(addr, rqst->rq_xprt->xpt_remotebuf)
+ __string(addr, rqst->rq_xprt ?
+ rqst->rq_xprt->xpt_remotebuf : "(null)")
),
TP_fast_assign(
@@ -577,7 +578,8 @@ TRACE_EVENT(svc_process,
__entry->vers = rqst->rq_vers;
__entry->proc = rqst->rq_proc;
__assign_str(service, name);
- __assign_str(addr, rqst->rq_xprt->xpt_remotebuf);
+ __assign_str(addr, rqst->rq_xprt ?
+ rqst->rq_xprt->xpt_remotebuf : "(null)");
),
TP_printk("addr=%s xid=0x%08x service=%s vers=%u proc=%u",
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index d13e05f1a990..fb647bc01fc5 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1172,7 +1172,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
clear_bit(RQ_DROPME, &rqstp->rq_flags);
/* Setup reply header */
- rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp);
+ if (rqstp->rq_prot == IPPROTO_TCP)
+ svc_tcp_prep_reply_hdr(rqstp);
svc_putu32(resv, rqstp->rq_xid);
@@ -1244,7 +1245,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
* for lower versions. RPC_PROG_MISMATCH seems to be the closest
* fit.
*/
- if (versp->vs_need_cong_ctrl &&
+ if (versp->vs_need_cong_ctrl && rqstp->rq_xprt &&
!test_bit(XPT_CONG_CTRL, &rqstp->rq_xprt->xpt_flags))
goto err_bad_vers;
@@ -1336,7 +1337,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
return 0;
close:
- if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
+ if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
svc_close_xprt(rqstp->rq_xprt);
dprintk("svc: svc_process close\n");
return 0;
@@ -1459,10 +1460,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
dprintk("svc: %s(%p)\n", __func__, req);
/* Build the svc_rqst used by the common processing routine */
- rqstp->rq_xprt = serv->sv_bc_xprt;
rqstp->rq_xid = req->rq_xid;
rqstp->rq_prot = req->rq_xprt->prot;
rqstp->rq_server = serv;
+ rqstp->rq_bc_net = req->rq_xprt->xprt_net;
rqstp->rq_addrlen = sizeof(req->rq_xprt->addr);
memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 51d36230b6e3..bd42da287c26 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -468,10 +468,11 @@ static struct svc_xprt *svc_xprt_dequeue(struct svc_pool *pool)
*/
void svc_reserve(struct svc_rqst *rqstp, int space)
{
+ struct svc_xprt *xprt = rqstp->rq_xprt;
+
space += rqstp->rq_res.head[0].iov_len;
- if (space < rqstp->rq_reserved) {
- struct svc_xprt *xprt = rqstp->rq_xprt;
+ if (xprt && space < rqstp->rq_reserved) {
atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved);
rqstp->rq_reserved = space;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 986f3ed7d1a2..793149ba1bda 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1173,7 +1173,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp)
/*
* Setup response header. TCP has a 4B record length field.
*/
-static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
+void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
{
struct kvec *resv = &rqstp->rq_res.head[0];
The patch below does not apply to the 4.20-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From d4b09acf924b84bae77cad090a9d108e70b43643 Mon Sep 17 00:00:00 2001
From: Vasily Averin <vvs(a)virtuozzo.com>
Date: Mon, 24 Dec 2018 14:44:52 +0300
Subject: [PATCH] sunrpc: use-after-free in svc_process_common()
if node have NFSv41+ mounts inside several net namespaces
it can lead to use-after-free in svc_process_common()
svc_process_common()
/* Setup reply header */
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); <<< HERE
svc_process_common() can use incorrect rqstp->rq_xprt,
its caller function bc_svc_process() takes it from serv->sv_bc_xprt.
The problem is that serv is global structure but sv_bc_xprt
is assigned per-netnamespace.
According to Trond, the whole "let's set up rqstp->rq_xprt
for the back channel" is nothing but a giant hack in order
to work around the fact that svc_process_common() uses it
to find the xpt_ops, and perform a couple of (meaningless
for the back channel) tests of xpt_flags.
All we really need in svc_process_common() is to be able to run
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr()
Bruce J Fields points that this xpo_prep_reply_hdr() call
is an awfully roundabout way just to do "svc_putnl(resv, 0);"
in the tcp case.
This patch does not initialiuze rqstp->rq_xprt in bc_svc_process(),
now it calls svc_process_common() with rqstp->rq_xprt = NULL.
To adjust reply header svc_process_common() just check
rqstp->rq_prot and calls svc_tcp_prep_reply_hdr() for tcp case.
To handle rqstp->rq_xprt = NULL case in functions called from
svc_process_common() patch intruduces net namespace pointer
svc_rqst->rq_bc_net and adjust SVC_NET() definition.
Some other function was also adopted to properly handle described case.
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
Cc: stable(a)vger.kernel.org
Fixes: 23c20ecd4475 ("NFS: callback up - users counting cleanup")
Signed-off-by: J. Bruce Fields <bfields(a)redhat.com>
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 73e130a840ce..fdb6b317d974 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -295,9 +295,12 @@ struct svc_rqst {
struct svc_cacherep * rq_cacherep; /* cache info */
struct task_struct *rq_task; /* service thread */
spinlock_t rq_lock; /* per-request lock */
+ struct net *rq_bc_net; /* pointer to backchannel's
+ * net namespace
+ */
};
-#define SVC_NET(svc_rqst) (svc_rqst->rq_xprt->xpt_net)
+#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net)
/*
* Rigorous type checking on sockaddr type conversions
diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
index 28e384186c35..8617f4fd6b70 100644
--- a/include/trace/events/sunrpc.h
+++ b/include/trace/events/sunrpc.h
@@ -569,7 +569,8 @@ TRACE_EVENT(svc_process,
__field(u32, vers)
__field(u32, proc)
__string(service, name)
- __string(addr, rqst->rq_xprt->xpt_remotebuf)
+ __string(addr, rqst->rq_xprt ?
+ rqst->rq_xprt->xpt_remotebuf : "(null)")
),
TP_fast_assign(
@@ -577,7 +578,8 @@ TRACE_EVENT(svc_process,
__entry->vers = rqst->rq_vers;
__entry->proc = rqst->rq_proc;
__assign_str(service, name);
- __assign_str(addr, rqst->rq_xprt->xpt_remotebuf);
+ __assign_str(addr, rqst->rq_xprt ?
+ rqst->rq_xprt->xpt_remotebuf : "(null)");
),
TP_printk("addr=%s xid=0x%08x service=%s vers=%u proc=%u",
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index d13e05f1a990..fb647bc01fc5 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1172,7 +1172,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
clear_bit(RQ_DROPME, &rqstp->rq_flags);
/* Setup reply header */
- rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp);
+ if (rqstp->rq_prot == IPPROTO_TCP)
+ svc_tcp_prep_reply_hdr(rqstp);
svc_putu32(resv, rqstp->rq_xid);
@@ -1244,7 +1245,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
* for lower versions. RPC_PROG_MISMATCH seems to be the closest
* fit.
*/
- if (versp->vs_need_cong_ctrl &&
+ if (versp->vs_need_cong_ctrl && rqstp->rq_xprt &&
!test_bit(XPT_CONG_CTRL, &rqstp->rq_xprt->xpt_flags))
goto err_bad_vers;
@@ -1336,7 +1337,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
return 0;
close:
- if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
+ if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
svc_close_xprt(rqstp->rq_xprt);
dprintk("svc: svc_process close\n");
return 0;
@@ -1459,10 +1460,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
dprintk("svc: %s(%p)\n", __func__, req);
/* Build the svc_rqst used by the common processing routine */
- rqstp->rq_xprt = serv->sv_bc_xprt;
rqstp->rq_xid = req->rq_xid;
rqstp->rq_prot = req->rq_xprt->prot;
rqstp->rq_server = serv;
+ rqstp->rq_bc_net = req->rq_xprt->xprt_net;
rqstp->rq_addrlen = sizeof(req->rq_xprt->addr);
memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 51d36230b6e3..bd42da287c26 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -468,10 +468,11 @@ static struct svc_xprt *svc_xprt_dequeue(struct svc_pool *pool)
*/
void svc_reserve(struct svc_rqst *rqstp, int space)
{
+ struct svc_xprt *xprt = rqstp->rq_xprt;
+
space += rqstp->rq_res.head[0].iov_len;
- if (space < rqstp->rq_reserved) {
- struct svc_xprt *xprt = rqstp->rq_xprt;
+ if (xprt && space < rqstp->rq_reserved) {
atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved);
rqstp->rq_reserved = space;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 986f3ed7d1a2..793149ba1bda 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1173,7 +1173,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp)
/*
* Setup response header. TCP has a 4B record length field.
*/
-static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
+void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
{
struct kvec *resv = &rqstp->rq_res.head[0];
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From c86aa7bbfd5568ba8a82d3635d8f7b8a8e06fe54 Mon Sep 17 00:00:00 2001
From: Mike Kravetz <mike.kravetz(a)oracle.com>
Date: Fri, 28 Dec 2018 00:39:42 -0800
Subject: [PATCH] hugetlbfs: Use i_mmap_rwsem to fix page fault/truncate race
hugetlbfs page faults can race with truncate and hole punch operations.
Current code in the page fault path attempts to handle this by 'backing
out' operations if we encounter the race. One obvious omission in the
current code is removing a page newly added to the page cache. This is
pretty straight forward to address, but there is a more subtle and
difficult issue of backing out hugetlb reservations. To handle this
correctly, the 'reservation state' before page allocation needs to be
noted so that it can be properly backed out. There are four distinct
possibilities for reservation state: shared/reserved, shared/no-resv,
private/reserved and private/no-resv. Backing out a reservation may
require memory allocation which could fail so that needs to be taken into
account as well.
Instead of writing the required complicated code for this rare occurrence,
just eliminate the race. i_mmap_rwsem is now held in read mode for the
duration of page fault processing. Hold i_mmap_rwsem longer in truncation
and hold punch code to cover the call to remove_inode_hugepages.
With this modification, code in remove_inode_hugepages checking for races
becomes 'dead' as it can not longer happen. Remove the dead code and
expand comments to explain reasoning. Similarly, checks for races with
truncation in the page fault path can be simplified and removed.
[mike.kravetz(a)oracle.com: incorporat suggestions from Kirill]
Link: http://lkml.kernel.org/r/20181222223013.22193-3-mike.kravetz@oracle.com
Link: http://lkml.kernel.org/r/20181218223557.5202-3-mike.kravetz@oracle.com
Fixes: ebed4bfc8da8 ("hugetlb: fix absurd HugePages_Rsvd")
Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: Hugh Dickins <hughd(a)google.com>
Cc: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com>
Cc: "Aneesh Kumar K . V" <aneesh.kumar(a)linux.vnet.ibm.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Davidlohr Bueso <dave(a)stgolabs.net>
Cc: Prakash Sangappa <prakash.sangappa(a)oracle.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 32920a10100e..a2fcea5f8225 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -383,17 +383,16 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end)
* truncation is indicated by end of range being LLONG_MAX
* In this case, we first scan the range and release found pages.
* After releasing pages, hugetlb_unreserve_pages cleans up region/reserv
- * maps and global counts. Page faults can not race with truncation
- * in this routine. hugetlb_no_page() prevents page faults in the
- * truncated range. It checks i_size before allocation, and again after
- * with the page table lock for the page held. The same lock must be
- * acquired to unmap a page.
+ * maps and global counts.
* hole punch is indicated if end is not LLONG_MAX
* In the hole punch case we scan the range and release found pages.
* Only when releasing a page is the associated region/reserv map
* deleted. The region/reserv map for ranges without associated
- * pages are not modified. Page faults can race with hole punch.
- * This is indicated if we find a mapped page.
+ * pages are not modified.
+ *
+ * Callers of this routine must hold the i_mmap_rwsem in write mode to prevent
+ * races with page faults.
+ *
* Note: If the passed end of range value is beyond the end of file, but
* not LLONG_MAX this routine still performs a hole punch operation.
*/
@@ -423,32 +422,14 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
for (i = 0; i < pagevec_count(&pvec); ++i) {
struct page *page = pvec.pages[i];
- u32 hash;
index = page->index;
- hash = hugetlb_fault_mutex_hash(h, current->mm,
- &pseudo_vma,
- mapping, index, 0);
- mutex_lock(&hugetlb_fault_mutex_table[hash]);
-
/*
- * If page is mapped, it was faulted in after being
- * unmapped in caller. Unmap (again) now after taking
- * the fault mutex. The mutex will prevent faults
- * until we finish removing the page.
- *
- * This race can only happen in the hole punch case.
- * Getting here in a truncate operation is a bug.
+ * A mapped page is impossible as callers should unmap
+ * all references before calling. And, i_mmap_rwsem
+ * prevents the creation of additional mappings.
*/
- if (unlikely(page_mapped(page))) {
- BUG_ON(truncate_op);
-
- i_mmap_lock_write(mapping);
- hugetlb_vmdelete_list(&mapping->i_mmap,
- index * pages_per_huge_page(h),
- (index + 1) * pages_per_huge_page(h));
- i_mmap_unlock_write(mapping);
- }
+ VM_BUG_ON(page_mapped(page));
lock_page(page);
/*
@@ -470,7 +451,6 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
}
unlock_page(page);
- mutex_unlock(&hugetlb_fault_mutex_table[hash]);
}
huge_pagevec_release(&pvec);
cond_resched();
@@ -482,9 +462,20 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
static void hugetlbfs_evict_inode(struct inode *inode)
{
+ struct address_space *mapping = inode->i_mapping;
struct resv_map *resv_map;
+ /*
+ * The vfs layer guarantees that there are no other users of this
+ * inode. Therefore, it would be safe to call remove_inode_hugepages
+ * without holding i_mmap_rwsem. We acquire and hold here to be
+ * consistent with other callers. Since there will be no contention
+ * on the semaphore, overhead is negligible.
+ */
+ i_mmap_lock_write(mapping);
remove_inode_hugepages(inode, 0, LLONG_MAX);
+ i_mmap_unlock_write(mapping);
+
resv_map = (struct resv_map *)inode->i_mapping->private_data;
/* root inode doesn't have the resv_map, so we should check it */
if (resv_map)
@@ -505,8 +496,8 @@ static int hugetlb_vmtruncate(struct inode *inode, loff_t offset)
i_mmap_lock_write(mapping);
if (!RB_EMPTY_ROOT(&mapping->i_mmap.rb_root))
hugetlb_vmdelete_list(&mapping->i_mmap, pgoff, 0);
- i_mmap_unlock_write(mapping);
remove_inode_hugepages(inode, offset, LLONG_MAX);
+ i_mmap_unlock_write(mapping);
return 0;
}
@@ -540,8 +531,8 @@ static long hugetlbfs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
hugetlb_vmdelete_list(&mapping->i_mmap,
hole_start >> PAGE_SHIFT,
hole_end >> PAGE_SHIFT);
- i_mmap_unlock_write(mapping);
remove_inode_hugepages(inode, hole_start, hole_end);
+ i_mmap_unlock_write(mapping);
inode_unlock(inode);
}
@@ -624,7 +615,11 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
/* addr is the offset within the file (zero based) */
addr = index * hpage_size;
- /* mutex taken here, fault path and hole punch */
+ /*
+ * fault mutex taken here, protects against fault path
+ * and hole punch. inode_lock previously taken protects
+ * against truncation.
+ */
hash = hugetlb_fault_mutex_hash(h, mm, &pseudo_vma, mapping,
index, addr);
mutex_lock(&hugetlb_fault_mutex_table[hash]);
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 87fd3ab809c6..e37efd5d8318 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3755,16 +3755,16 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm,
}
/*
- * Use page lock to guard against racing truncation
- * before we get page_table_lock.
+ * We can not race with truncation due to holding i_mmap_rwsem.
+ * Check once here for faults beyond end of file.
*/
+ size = i_size_read(mapping->host) >> huge_page_shift(h);
+ if (idx >= size)
+ goto out;
+
retry:
page = find_lock_page(mapping, idx);
if (!page) {
- size = i_size_read(mapping->host) >> huge_page_shift(h);
- if (idx >= size)
- goto out;
-
/*
* Check for page in userfault range
*/
@@ -3854,9 +3854,6 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm,
}
ptl = huge_pte_lock(h, mm, ptep);
- size = i_size_read(mapping->host) >> huge_page_shift(h);
- if (idx >= size)
- goto backout;
ret = 0;
if (!huge_pte_none(huge_ptep_get(ptep)))
@@ -3959,8 +3956,10 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
/*
* Acquire i_mmap_rwsem before calling huge_pte_alloc and hold
- * until finished with ptep. This prevents huge_pmd_unshare from
- * being called elsewhere and making the ptep no longer valid.
+ * until finished with ptep. This serves two purposes:
+ * 1) It prevents huge_pmd_unshare from being called elsewhere
+ * and making the ptep no longer valid.
+ * 2) It synchronizes us with file truncation.
*
* ptep could have already be assigned via huge_pte_offset. That
* is OK, as huge_pte_alloc will return the same value unless
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 8c3f48e8c288 Linux 4.20.1
The results of these automated tests are provided below.
Overall result: FAILED (see details below)
Patch merge: OK
Compile: FAILED
We attempted to compile the kernel for multiple architectures, but the compile
failed on one or more architectures:
s390x: FAILED (build log attached: build_s390.log.gz)
powerpc64le: FAILED (build log attached: build_powerpc.log.gz)
aarch64: FAILED (build log attached: build_arm64.log.gz)
x86_64: FAILED (build log attached: build_x86_64.log.gz)
We hope that these logs can help you find the problem quickly. For the full
detail on our testing procedures, please scroll to the bottom of this message.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out a ref:
Repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Ref: 8c3f48e8c288 Linux 4.20.1
We then merged the following patches with `git am`:
scsi-zfcp-fix-posting-too-many-status-read-buffers-leading-to-adapter-shutdown.patch
scsi-lpfc-do-not-set-queue-page_count-to-0-if-pc_sli4_params.wqpcnt-is-invalid.patch
fork-record-start_time-late.patch
zram-fix-double-free-backing-device.patch
hwpoison-memory_hotplug-allow-hwpoisoned-pages-to-be-offlined.patch
mm-devm_memremap_pages-mark-devm_memremap_pages-export_symbol_gpl.patch
mm-devm_memremap_pages-kill-mapping-system-ram-support.patch
mm-devm_memremap_pages-fix-shutdown-handling.patch
hugetlbfs-use-i_mmap_rwsem-for-more-pmd-sharing-synchronization.patch
hugetlbfs-use-i_mmap_rwsem-to-fix-page-fault-truncate-race.patch
memcg-oom-notify-on-oom-killer-invocation-from-the-charge-path.patch
sunrpc-fix-cache_head-leak-due-to-queued-request.patch
sunrpc-use-svc_net-in-svcauth_gss_-functions.patch
sunrpc-use-after-free-in-svc_process_common.patch
mm-devm_memremap_pages-add-memory_device_private-support.patch
mm-hmm-use-devm-semantics-for-hmm_devmem_-add-remove.patch
mm-hmm-replace-hmm_devmem_pages_create-with-devm_memremap_pages.patch
mm-hmm-mark-hmm_devmem_-add-add_resource-export_symbol_gpl.patch
mm-swap-fix-swapoff-with-ksm-pages.patch
Compile testing
---------------
We compiled the kernel for 4 architectures:
s390x:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration:
powerpc64le:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration:
aarch64:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration:
x86_64:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration:
Hardware testing
----------------
We booted each kernel and ran the following tests:
s390:
powerpc:
arm64:
x86_64:
While reading through the sysvipc implementation, I noticed that the n32
semctl/shmctl/msgctl system calls behave differently based on whether
o32 support is enabled or not: Without o32, the IPC_64 flag passed by
user space is rejected but calls without that flag get IPC_64 behavior.
As far as I can tell, this was inadvertently changed by a cleanup patch
but never noticed by anyone, possibly nobody has tried using sysvipc
on n32 after linux-3.19.
Change it back to the old behavior now.
Fixes: 78aaf956ba3a ("MIPS: Compat: Fix build error if CONFIG_MIPS32_COMPAT but no compat ABI.")
Cc: stable(a)vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
---
As stated above, this was only found by inspection, the patch is not
tested. Please review accordingly.
---
arch/mips/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 787290781b8c..0d14f51d0002 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -3155,6 +3155,7 @@ config MIPS32_O32
config MIPS32_N32
bool "Kernel support for n32 binaries"
depends on 64BIT
+ select ARCH_WANT_COMPAT_IPC_PARSE_VERSION
select COMPAT
select MIPS32_COMPAT
select SYSVIPC_COMPAT if SYSVIPC
--
2.20.0
The io_pgetevents system call was added in linux-4.18 but has
no entry for alpha:
warning: #warning syscall io_pgetevents not implemented [-Wcpp]
Assign a the next system call number here.
Cc: stable(a)vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
---
arch/alpha/kernel/syscalls/syscall.tbl | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/alpha/kernel/syscalls/syscall.tbl b/arch/alpha/kernel/syscalls/syscall.tbl
index 7b56a53be5e3..e09558edae73 100644
--- a/arch/alpha/kernel/syscalls/syscall.tbl
+++ b/arch/alpha/kernel/syscalls/syscall.tbl
@@ -451,3 +451,4 @@
520 common preadv2 sys_preadv2
521 common pwritev2 sys_pwritev2
522 common statx sys_statx
+523 common io_pgetevents sys_io_pgetevents
--
2.20.0
Good day,
We have started to compile libbpf as part of our Linux compilation
build plan, however libbpf fails to cross-compile for arm64 on Linux
4.14, but succeeds on Linux 4.19 tree.
We compile libbpf with the following command:
make -C <whatever>/linux-4.14.91/tools/lib/bpf ARCH=arm64
CROSS_COMPILE=aarch64-linux-gnu- install
And get the below output on 4.14 tree:
Auto-detecting system features:
... libelf: [ on ]
... bpf: [ on ]
CC /cfsetup_build/build/arm64/libbpf/libbpf.o
CC /cfsetup_build/build/arm64/libbpf/bpf.o
LD /cfsetup_build/build/arm64/libbpf/libbpf-in.o
ld: /cfsetup_build/build/arm64/libbpf/libbpf.o: Relocations in generic
ELF (EM: 183)
ld: /cfsetup_build/build/arm64/libbpf/libbpf.o: Relocations in generic
ELF (EM: 183)
ld: /cfsetup_build/build/arm64/libbpf/libbpf.o: Relocations in generic
ELF (EM: 183)
ld: /cfsetup_build/build/arm64/libbpf/libbpf.o: Relocations in generic
ELF (EM: 183)
ld: /cfsetup_build/build/arm64/libbpf/libbpf.o: Relocations in generic
ELF (EM: 183)
ld: /cfsetup_build/build/arm64/libbpf/libbpf.o: Relocations in generic
ELF (EM: 183)
/cfsetup_build/build/arm64/libbpf/libbpf.o: error adding symbols: File
in wrong format
/cfsetup_build/build/linux-4.14.91/tools/build/Makefile.build:144:
recipe for target '/cfsetup_build/build/arm64/libbpf/libbpf-in.o'
failed
make[2]: *** [/cfsetup_build/build/arm64/libbpf/libbpf-in.o] Error 1
Makefile:158: recipe for target
'/cfsetup_build/build/arm64/libbpf/libbpf-in.o' failed
make[1]: *** [/cfsetup_build/build/arm64/libbpf/libbpf-in.o] Error 2
Backporting the following commit fixed the build:
7ed1c1901fe52e6c5828deb155920b44b0adabb1: tools: fix cross-compile var
clobbering
Can we have it officially applied to the Linux 4.14 tree, please?
Regards,
Ignat
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From d4b09acf924b84bae77cad090a9d108e70b43643 Mon Sep 17 00:00:00 2001
From: Vasily Averin <vvs(a)virtuozzo.com>
Date: Mon, 24 Dec 2018 14:44:52 +0300
Subject: [PATCH] sunrpc: use-after-free in svc_process_common()
if node have NFSv41+ mounts inside several net namespaces
it can lead to use-after-free in svc_process_common()
svc_process_common()
/* Setup reply header */
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); <<< HERE
svc_process_common() can use incorrect rqstp->rq_xprt,
its caller function bc_svc_process() takes it from serv->sv_bc_xprt.
The problem is that serv is global structure but sv_bc_xprt
is assigned per-netnamespace.
According to Trond, the whole "let's set up rqstp->rq_xprt
for the back channel" is nothing but a giant hack in order
to work around the fact that svc_process_common() uses it
to find the xpt_ops, and perform a couple of (meaningless
for the back channel) tests of xpt_flags.
All we really need in svc_process_common() is to be able to run
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr()
Bruce J Fields points that this xpo_prep_reply_hdr() call
is an awfully roundabout way just to do "svc_putnl(resv, 0);"
in the tcp case.
This patch does not initialiuze rqstp->rq_xprt in bc_svc_process(),
now it calls svc_process_common() with rqstp->rq_xprt = NULL.
To adjust reply header svc_process_common() just check
rqstp->rq_prot and calls svc_tcp_prep_reply_hdr() for tcp case.
To handle rqstp->rq_xprt = NULL case in functions called from
svc_process_common() patch intruduces net namespace pointer
svc_rqst->rq_bc_net and adjust SVC_NET() definition.
Some other function was also adopted to properly handle described case.
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
Cc: stable(a)vger.kernel.org
Fixes: 23c20ecd4475 ("NFS: callback up - users counting cleanup")
Signed-off-by: J. Bruce Fields <bfields(a)redhat.com>
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 73e130a840ce..fdb6b317d974 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -295,9 +295,12 @@ struct svc_rqst {
struct svc_cacherep * rq_cacherep; /* cache info */
struct task_struct *rq_task; /* service thread */
spinlock_t rq_lock; /* per-request lock */
+ struct net *rq_bc_net; /* pointer to backchannel's
+ * net namespace
+ */
};
-#define SVC_NET(svc_rqst) (svc_rqst->rq_xprt->xpt_net)
+#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net)
/*
* Rigorous type checking on sockaddr type conversions
diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
index 28e384186c35..8617f4fd6b70 100644
--- a/include/trace/events/sunrpc.h
+++ b/include/trace/events/sunrpc.h
@@ -569,7 +569,8 @@ TRACE_EVENT(svc_process,
__field(u32, vers)
__field(u32, proc)
__string(service, name)
- __string(addr, rqst->rq_xprt->xpt_remotebuf)
+ __string(addr, rqst->rq_xprt ?
+ rqst->rq_xprt->xpt_remotebuf : "(null)")
),
TP_fast_assign(
@@ -577,7 +578,8 @@ TRACE_EVENT(svc_process,
__entry->vers = rqst->rq_vers;
__entry->proc = rqst->rq_proc;
__assign_str(service, name);
- __assign_str(addr, rqst->rq_xprt->xpt_remotebuf);
+ __assign_str(addr, rqst->rq_xprt ?
+ rqst->rq_xprt->xpt_remotebuf : "(null)");
),
TP_printk("addr=%s xid=0x%08x service=%s vers=%u proc=%u",
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index d13e05f1a990..fb647bc01fc5 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1172,7 +1172,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
clear_bit(RQ_DROPME, &rqstp->rq_flags);
/* Setup reply header */
- rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp);
+ if (rqstp->rq_prot == IPPROTO_TCP)
+ svc_tcp_prep_reply_hdr(rqstp);
svc_putu32(resv, rqstp->rq_xid);
@@ -1244,7 +1245,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
* for lower versions. RPC_PROG_MISMATCH seems to be the closest
* fit.
*/
- if (versp->vs_need_cong_ctrl &&
+ if (versp->vs_need_cong_ctrl && rqstp->rq_xprt &&
!test_bit(XPT_CONG_CTRL, &rqstp->rq_xprt->xpt_flags))
goto err_bad_vers;
@@ -1336,7 +1337,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
return 0;
close:
- if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
+ if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
svc_close_xprt(rqstp->rq_xprt);
dprintk("svc: svc_process close\n");
return 0;
@@ -1459,10 +1460,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
dprintk("svc: %s(%p)\n", __func__, req);
/* Build the svc_rqst used by the common processing routine */
- rqstp->rq_xprt = serv->sv_bc_xprt;
rqstp->rq_xid = req->rq_xid;
rqstp->rq_prot = req->rq_xprt->prot;
rqstp->rq_server = serv;
+ rqstp->rq_bc_net = req->rq_xprt->xprt_net;
rqstp->rq_addrlen = sizeof(req->rq_xprt->addr);
memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 51d36230b6e3..bd42da287c26 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -468,10 +468,11 @@ static struct svc_xprt *svc_xprt_dequeue(struct svc_pool *pool)
*/
void svc_reserve(struct svc_rqst *rqstp, int space)
{
+ struct svc_xprt *xprt = rqstp->rq_xprt;
+
space += rqstp->rq_res.head[0].iov_len;
- if (space < rqstp->rq_reserved) {
- struct svc_xprt *xprt = rqstp->rq_xprt;
+ if (xprt && space < rqstp->rq_reserved) {
atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved);
rqstp->rq_reserved = space;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 986f3ed7d1a2..793149ba1bda 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1173,7 +1173,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp)
/*
* Setup response header. TCP has a 4B record length field.
*/
-static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
+void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
{
struct kvec *resv = &rqstp->rq_res.head[0];
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From d4b09acf924b84bae77cad090a9d108e70b43643 Mon Sep 17 00:00:00 2001
From: Vasily Averin <vvs(a)virtuozzo.com>
Date: Mon, 24 Dec 2018 14:44:52 +0300
Subject: [PATCH] sunrpc: use-after-free in svc_process_common()
if node have NFSv41+ mounts inside several net namespaces
it can lead to use-after-free in svc_process_common()
svc_process_common()
/* Setup reply header */
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); <<< HERE
svc_process_common() can use incorrect rqstp->rq_xprt,
its caller function bc_svc_process() takes it from serv->sv_bc_xprt.
The problem is that serv is global structure but sv_bc_xprt
is assigned per-netnamespace.
According to Trond, the whole "let's set up rqstp->rq_xprt
for the back channel" is nothing but a giant hack in order
to work around the fact that svc_process_common() uses it
to find the xpt_ops, and perform a couple of (meaningless
for the back channel) tests of xpt_flags.
All we really need in svc_process_common() is to be able to run
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr()
Bruce J Fields points that this xpo_prep_reply_hdr() call
is an awfully roundabout way just to do "svc_putnl(resv, 0);"
in the tcp case.
This patch does not initialiuze rqstp->rq_xprt in bc_svc_process(),
now it calls svc_process_common() with rqstp->rq_xprt = NULL.
To adjust reply header svc_process_common() just check
rqstp->rq_prot and calls svc_tcp_prep_reply_hdr() for tcp case.
To handle rqstp->rq_xprt = NULL case in functions called from
svc_process_common() patch intruduces net namespace pointer
svc_rqst->rq_bc_net and adjust SVC_NET() definition.
Some other function was also adopted to properly handle described case.
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
Cc: stable(a)vger.kernel.org
Fixes: 23c20ecd4475 ("NFS: callback up - users counting cleanup")
Signed-off-by: J. Bruce Fields <bfields(a)redhat.com>
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 73e130a840ce..fdb6b317d974 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -295,9 +295,12 @@ struct svc_rqst {
struct svc_cacherep * rq_cacherep; /* cache info */
struct task_struct *rq_task; /* service thread */
spinlock_t rq_lock; /* per-request lock */
+ struct net *rq_bc_net; /* pointer to backchannel's
+ * net namespace
+ */
};
-#define SVC_NET(svc_rqst) (svc_rqst->rq_xprt->xpt_net)
+#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net)
/*
* Rigorous type checking on sockaddr type conversions
diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
index 28e384186c35..8617f4fd6b70 100644
--- a/include/trace/events/sunrpc.h
+++ b/include/trace/events/sunrpc.h
@@ -569,7 +569,8 @@ TRACE_EVENT(svc_process,
__field(u32, vers)
__field(u32, proc)
__string(service, name)
- __string(addr, rqst->rq_xprt->xpt_remotebuf)
+ __string(addr, rqst->rq_xprt ?
+ rqst->rq_xprt->xpt_remotebuf : "(null)")
),
TP_fast_assign(
@@ -577,7 +578,8 @@ TRACE_EVENT(svc_process,
__entry->vers = rqst->rq_vers;
__entry->proc = rqst->rq_proc;
__assign_str(service, name);
- __assign_str(addr, rqst->rq_xprt->xpt_remotebuf);
+ __assign_str(addr, rqst->rq_xprt ?
+ rqst->rq_xprt->xpt_remotebuf : "(null)");
),
TP_printk("addr=%s xid=0x%08x service=%s vers=%u proc=%u",
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index d13e05f1a990..fb647bc01fc5 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1172,7 +1172,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
clear_bit(RQ_DROPME, &rqstp->rq_flags);
/* Setup reply header */
- rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp);
+ if (rqstp->rq_prot == IPPROTO_TCP)
+ svc_tcp_prep_reply_hdr(rqstp);
svc_putu32(resv, rqstp->rq_xid);
@@ -1244,7 +1245,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
* for lower versions. RPC_PROG_MISMATCH seems to be the closest
* fit.
*/
- if (versp->vs_need_cong_ctrl &&
+ if (versp->vs_need_cong_ctrl && rqstp->rq_xprt &&
!test_bit(XPT_CONG_CTRL, &rqstp->rq_xprt->xpt_flags))
goto err_bad_vers;
@@ -1336,7 +1337,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
return 0;
close:
- if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
+ if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
svc_close_xprt(rqstp->rq_xprt);
dprintk("svc: svc_process close\n");
return 0;
@@ -1459,10 +1460,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
dprintk("svc: %s(%p)\n", __func__, req);
/* Build the svc_rqst used by the common processing routine */
- rqstp->rq_xprt = serv->sv_bc_xprt;
rqstp->rq_xid = req->rq_xid;
rqstp->rq_prot = req->rq_xprt->prot;
rqstp->rq_server = serv;
+ rqstp->rq_bc_net = req->rq_xprt->xprt_net;
rqstp->rq_addrlen = sizeof(req->rq_xprt->addr);
memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 51d36230b6e3..bd42da287c26 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -468,10 +468,11 @@ static struct svc_xprt *svc_xprt_dequeue(struct svc_pool *pool)
*/
void svc_reserve(struct svc_rqst *rqstp, int space)
{
+ struct svc_xprt *xprt = rqstp->rq_xprt;
+
space += rqstp->rq_res.head[0].iov_len;
- if (space < rqstp->rq_reserved) {
- struct svc_xprt *xprt = rqstp->rq_xprt;
+ if (xprt && space < rqstp->rq_reserved) {
atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved);
rqstp->rq_reserved = space;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 986f3ed7d1a2..793149ba1bda 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1173,7 +1173,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp)
/*
* Setup response header. TCP has a 4B record length field.
*/
-static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
+void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
{
struct kvec *resv = &rqstp->rq_res.head[0];
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From c86aa7bbfd5568ba8a82d3635d8f7b8a8e06fe54 Mon Sep 17 00:00:00 2001
From: Mike Kravetz <mike.kravetz(a)oracle.com>
Date: Fri, 28 Dec 2018 00:39:42 -0800
Subject: [PATCH] hugetlbfs: Use i_mmap_rwsem to fix page fault/truncate race
hugetlbfs page faults can race with truncate and hole punch operations.
Current code in the page fault path attempts to handle this by 'backing
out' operations if we encounter the race. One obvious omission in the
current code is removing a page newly added to the page cache. This is
pretty straight forward to address, but there is a more subtle and
difficult issue of backing out hugetlb reservations. To handle this
correctly, the 'reservation state' before page allocation needs to be
noted so that it can be properly backed out. There are four distinct
possibilities for reservation state: shared/reserved, shared/no-resv,
private/reserved and private/no-resv. Backing out a reservation may
require memory allocation which could fail so that needs to be taken into
account as well.
Instead of writing the required complicated code for this rare occurrence,
just eliminate the race. i_mmap_rwsem is now held in read mode for the
duration of page fault processing. Hold i_mmap_rwsem longer in truncation
and hold punch code to cover the call to remove_inode_hugepages.
With this modification, code in remove_inode_hugepages checking for races
becomes 'dead' as it can not longer happen. Remove the dead code and
expand comments to explain reasoning. Similarly, checks for races with
truncation in the page fault path can be simplified and removed.
[mike.kravetz(a)oracle.com: incorporat suggestions from Kirill]
Link: http://lkml.kernel.org/r/20181222223013.22193-3-mike.kravetz@oracle.com
Link: http://lkml.kernel.org/r/20181218223557.5202-3-mike.kravetz@oracle.com
Fixes: ebed4bfc8da8 ("hugetlb: fix absurd HugePages_Rsvd")
Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: Hugh Dickins <hughd(a)google.com>
Cc: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com>
Cc: "Aneesh Kumar K . V" <aneesh.kumar(a)linux.vnet.ibm.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Davidlohr Bueso <dave(a)stgolabs.net>
Cc: Prakash Sangappa <prakash.sangappa(a)oracle.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 32920a10100e..a2fcea5f8225 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -383,17 +383,16 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end)
* truncation is indicated by end of range being LLONG_MAX
* In this case, we first scan the range and release found pages.
* After releasing pages, hugetlb_unreserve_pages cleans up region/reserv
- * maps and global counts. Page faults can not race with truncation
- * in this routine. hugetlb_no_page() prevents page faults in the
- * truncated range. It checks i_size before allocation, and again after
- * with the page table lock for the page held. The same lock must be
- * acquired to unmap a page.
+ * maps and global counts.
* hole punch is indicated if end is not LLONG_MAX
* In the hole punch case we scan the range and release found pages.
* Only when releasing a page is the associated region/reserv map
* deleted. The region/reserv map for ranges without associated
- * pages are not modified. Page faults can race with hole punch.
- * This is indicated if we find a mapped page.
+ * pages are not modified.
+ *
+ * Callers of this routine must hold the i_mmap_rwsem in write mode to prevent
+ * races with page faults.
+ *
* Note: If the passed end of range value is beyond the end of file, but
* not LLONG_MAX this routine still performs a hole punch operation.
*/
@@ -423,32 +422,14 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
for (i = 0; i < pagevec_count(&pvec); ++i) {
struct page *page = pvec.pages[i];
- u32 hash;
index = page->index;
- hash = hugetlb_fault_mutex_hash(h, current->mm,
- &pseudo_vma,
- mapping, index, 0);
- mutex_lock(&hugetlb_fault_mutex_table[hash]);
-
/*
- * If page is mapped, it was faulted in after being
- * unmapped in caller. Unmap (again) now after taking
- * the fault mutex. The mutex will prevent faults
- * until we finish removing the page.
- *
- * This race can only happen in the hole punch case.
- * Getting here in a truncate operation is a bug.
+ * A mapped page is impossible as callers should unmap
+ * all references before calling. And, i_mmap_rwsem
+ * prevents the creation of additional mappings.
*/
- if (unlikely(page_mapped(page))) {
- BUG_ON(truncate_op);
-
- i_mmap_lock_write(mapping);
- hugetlb_vmdelete_list(&mapping->i_mmap,
- index * pages_per_huge_page(h),
- (index + 1) * pages_per_huge_page(h));
- i_mmap_unlock_write(mapping);
- }
+ VM_BUG_ON(page_mapped(page));
lock_page(page);
/*
@@ -470,7 +451,6 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
}
unlock_page(page);
- mutex_unlock(&hugetlb_fault_mutex_table[hash]);
}
huge_pagevec_release(&pvec);
cond_resched();
@@ -482,9 +462,20 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
static void hugetlbfs_evict_inode(struct inode *inode)
{
+ struct address_space *mapping = inode->i_mapping;
struct resv_map *resv_map;
+ /*
+ * The vfs layer guarantees that there are no other users of this
+ * inode. Therefore, it would be safe to call remove_inode_hugepages
+ * without holding i_mmap_rwsem. We acquire and hold here to be
+ * consistent with other callers. Since there will be no contention
+ * on the semaphore, overhead is negligible.
+ */
+ i_mmap_lock_write(mapping);
remove_inode_hugepages(inode, 0, LLONG_MAX);
+ i_mmap_unlock_write(mapping);
+
resv_map = (struct resv_map *)inode->i_mapping->private_data;
/* root inode doesn't have the resv_map, so we should check it */
if (resv_map)
@@ -505,8 +496,8 @@ static int hugetlb_vmtruncate(struct inode *inode, loff_t offset)
i_mmap_lock_write(mapping);
if (!RB_EMPTY_ROOT(&mapping->i_mmap.rb_root))
hugetlb_vmdelete_list(&mapping->i_mmap, pgoff, 0);
- i_mmap_unlock_write(mapping);
remove_inode_hugepages(inode, offset, LLONG_MAX);
+ i_mmap_unlock_write(mapping);
return 0;
}
@@ -540,8 +531,8 @@ static long hugetlbfs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
hugetlb_vmdelete_list(&mapping->i_mmap,
hole_start >> PAGE_SHIFT,
hole_end >> PAGE_SHIFT);
- i_mmap_unlock_write(mapping);
remove_inode_hugepages(inode, hole_start, hole_end);
+ i_mmap_unlock_write(mapping);
inode_unlock(inode);
}
@@ -624,7 +615,11 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
/* addr is the offset within the file (zero based) */
addr = index * hpage_size;
- /* mutex taken here, fault path and hole punch */
+ /*
+ * fault mutex taken here, protects against fault path
+ * and hole punch. inode_lock previously taken protects
+ * against truncation.
+ */
hash = hugetlb_fault_mutex_hash(h, mm, &pseudo_vma, mapping,
index, addr);
mutex_lock(&hugetlb_fault_mutex_table[hash]);
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 87fd3ab809c6..e37efd5d8318 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3755,16 +3755,16 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm,
}
/*
- * Use page lock to guard against racing truncation
- * before we get page_table_lock.
+ * We can not race with truncation due to holding i_mmap_rwsem.
+ * Check once here for faults beyond end of file.
*/
+ size = i_size_read(mapping->host) >> huge_page_shift(h);
+ if (idx >= size)
+ goto out;
+
retry:
page = find_lock_page(mapping, idx);
if (!page) {
- size = i_size_read(mapping->host) >> huge_page_shift(h);
- if (idx >= size)
- goto out;
-
/*
* Check for page in userfault range
*/
@@ -3854,9 +3854,6 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm,
}
ptl = huge_pte_lock(h, mm, ptep);
- size = i_size_read(mapping->host) >> huge_page_shift(h);
- if (idx >= size)
- goto backout;
ret = 0;
if (!huge_pte_none(huge_ptep_get(ptep)))
@@ -3959,8 +3956,10 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
/*
* Acquire i_mmap_rwsem before calling huge_pte_alloc and hold
- * until finished with ptep. This prevents huge_pmd_unshare from
- * being called elsewhere and making the ptep no longer valid.
+ * until finished with ptep. This serves two purposes:
+ * 1) It prevents huge_pmd_unshare from being called elsewhere
+ * and making the ptep no longer valid.
+ * 2) It synchronizes us with file truncation.
*
* ptep could have already be assigned via huge_pte_offset. That
* is OK, as huge_pte_alloc will return the same value unless
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b43a9990055958e70347c56f90ea2ae32c67334c Mon Sep 17 00:00:00 2001
From: Mike Kravetz <mike.kravetz(a)oracle.com>
Date: Fri, 28 Dec 2018 00:39:38 -0800
Subject: [PATCH] hugetlbfs: use i_mmap_rwsem for more pmd sharing
synchronization
While looking at BUGs associated with invalid huge page map counts, it was
discovered and observed that a huge pte pointer could become 'invalid' and
point to another task's page table. Consider the following:
A task takes a page fault on a shared hugetlbfs file and calls
huge_pte_alloc to get a ptep. Suppose the returned ptep points to a
shared pmd.
Now, another task truncates the hugetlbfs file. As part of truncation, it
unmaps everyone who has the file mapped. If the range being truncated is
covered by a shared pmd, huge_pmd_unshare will be called. For all but the
last user of the shared pmd, huge_pmd_unshare will clear the pud pointing
to the pmd. If the task in the middle of the page fault is not the last
user, the ptep returned by huge_pte_alloc now points to another task's
page table or worse. This leads to bad things such as incorrect page
map/reference counts or invalid memory references.
To fix, expand the use of i_mmap_rwsem as follows:
- i_mmap_rwsem is held in read mode whenever huge_pmd_share is called.
huge_pmd_share is only called via huge_pte_alloc, so callers of
huge_pte_alloc take i_mmap_rwsem before calling. In addition, callers
of huge_pte_alloc continue to hold the semaphore until finished with the
ptep.
- i_mmap_rwsem is held in write mode whenever huge_pmd_unshare is
called.
[mike.kravetz(a)oracle.com: add explicit check for mapping != null]
Link: http://lkml.kernel.org/r/20181218223557.5202-2-mike.kravetz@oracle.com
Fixes: 39dde65c9940 ("shared page table for hugetlb page")
Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: Hugh Dickins <hughd(a)google.com>
Cc: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com>
Cc: "Aneesh Kumar K . V" <aneesh.kumar(a)linux.vnet.ibm.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Davidlohr Bueso <dave(a)stgolabs.net>
Cc: Prakash Sangappa <prakash.sangappa(a)oracle.com>
Cc: Colin Ian King <colin.king(a)canonical.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 12000ba5c868..87fd3ab809c6 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3238,6 +3238,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
struct page *ptepage;
unsigned long addr;
int cow;
+ struct address_space *mapping = vma->vm_file->f_mapping;
struct hstate *h = hstate_vma(vma);
unsigned long sz = huge_page_size(h);
struct mmu_notifier_range range;
@@ -3249,13 +3250,23 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
mmu_notifier_range_init(&range, src, vma->vm_start,
vma->vm_end);
mmu_notifier_invalidate_range_start(&range);
+ } else {
+ /*
+ * For shared mappings i_mmap_rwsem must be held to call
+ * huge_pte_alloc, otherwise the returned ptep could go
+ * away if part of a shared pmd and another thread calls
+ * huge_pmd_unshare.
+ */
+ i_mmap_lock_read(mapping);
}
for (addr = vma->vm_start; addr < vma->vm_end; addr += sz) {
spinlock_t *src_ptl, *dst_ptl;
+
src_pte = huge_pte_offset(src, addr, sz);
if (!src_pte)
continue;
+
dst_pte = huge_pte_alloc(dst, addr, sz);
if (!dst_pte) {
ret = -ENOMEM;
@@ -3326,6 +3337,8 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
if (cow)
mmu_notifier_invalidate_range_end(&range);
+ else
+ i_mmap_unlock_read(mapping);
return ret;
}
@@ -3771,14 +3784,18 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm,
};
/*
- * hugetlb_fault_mutex must be dropped before
- * handling userfault. Reacquire after handling
- * fault to make calling code simpler.
+ * hugetlb_fault_mutex and i_mmap_rwsem must be
+ * dropped before handling userfault. Reacquire
+ * after handling fault to make calling code simpler.
*/
hash = hugetlb_fault_mutex_hash(h, mm, vma, mapping,
idx, haddr);
mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ i_mmap_unlock_read(mapping);
+
ret = handle_userfault(&vmf, VM_UFFD_MISSING);
+
+ i_mmap_lock_read(mapping);
mutex_lock(&hugetlb_fault_mutex_table[hash]);
goto out;
}
@@ -3926,6 +3943,11 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
ptep = huge_pte_offset(mm, haddr, huge_page_size(h));
if (ptep) {
+ /*
+ * Since we hold no locks, ptep could be stale. That is
+ * OK as we are only making decisions based on content and
+ * not actually modifying content here.
+ */
entry = huge_ptep_get(ptep);
if (unlikely(is_hugetlb_entry_migration(entry))) {
migration_entry_wait_huge(vma, mm, ptep);
@@ -3933,20 +3955,31 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
} else if (unlikely(is_hugetlb_entry_hwpoisoned(entry)))
return VM_FAULT_HWPOISON_LARGE |
VM_FAULT_SET_HINDEX(hstate_index(h));
- } else {
- ptep = huge_pte_alloc(mm, haddr, huge_page_size(h));
- if (!ptep)
- return VM_FAULT_OOM;
}
+ /*
+ * Acquire i_mmap_rwsem before calling huge_pte_alloc and hold
+ * until finished with ptep. This prevents huge_pmd_unshare from
+ * being called elsewhere and making the ptep no longer valid.
+ *
+ * ptep could have already be assigned via huge_pte_offset. That
+ * is OK, as huge_pte_alloc will return the same value unless
+ * something changed.
+ */
mapping = vma->vm_file->f_mapping;
- idx = vma_hugecache_offset(h, vma, haddr);
+ i_mmap_lock_read(mapping);
+ ptep = huge_pte_alloc(mm, haddr, huge_page_size(h));
+ if (!ptep) {
+ i_mmap_unlock_read(mapping);
+ return VM_FAULT_OOM;
+ }
/*
* Serialize hugepage allocation and instantiation, so that we don't
* get spurious allocation failures if two CPUs race to instantiate
* the same page in the page cache.
*/
+ idx = vma_hugecache_offset(h, vma, haddr);
hash = hugetlb_fault_mutex_hash(h, mm, vma, mapping, idx, haddr);
mutex_lock(&hugetlb_fault_mutex_table[hash]);
@@ -4034,6 +4067,7 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
}
out_mutex:
mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ i_mmap_unlock_read(mapping);
/*
* Generally it's safe to hold refcount during waiting page lock. But
* here we just wait to defer the next page fault to avoid busy loop and
@@ -4638,10 +4672,12 @@ void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
* Search for a shareable pmd page for hugetlb. In any case calls pmd_alloc()
* and returns the corresponding pte. While this is not necessary for the
* !shared pmd case because we can allocate the pmd later as well, it makes the
- * code much cleaner. pmd allocation is essential for the shared case because
- * pud has to be populated inside the same i_mmap_rwsem section - otherwise
- * racing tasks could either miss the sharing (see huge_pte_offset) or select a
- * bad pmd for sharing.
+ * code much cleaner.
+ *
+ * This routine must be called with i_mmap_rwsem held in at least read mode.
+ * For hugetlbfs, this prevents removal of any page table entries associated
+ * with the address space. This is important as we are setting up sharing
+ * based on existing page table entries (mappings).
*/
pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
{
@@ -4658,7 +4694,6 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
if (!vma_shareable(vma, addr))
return (pte_t *)pmd_alloc(mm, pud, addr);
- i_mmap_lock_write(mapping);
vma_interval_tree_foreach(svma, &mapping->i_mmap, idx, idx) {
if (svma == vma)
continue;
@@ -4688,7 +4723,6 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
spin_unlock(ptl);
out:
pte = (pte_t *)pmd_alloc(mm, pud, addr);
- i_mmap_unlock_write(mapping);
return pte;
}
@@ -4699,7 +4733,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
* indicated by page_count > 1, unmap is achieved by clearing pud and
* decrementing the ref count. If count == 1, the pte page is not shared.
*
- * called with page table lock held.
+ * Called with page table lock held and i_mmap_rwsem held in write mode.
*
* returns: 1 successfully unmapped a shared pte page
* 0 the underlying pte page is not shared, or it is the last user
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 7c72f2a95785..6379fff1a5ff 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -966,7 +966,7 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn,
enum ttu_flags ttu = TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS;
struct address_space *mapping;
LIST_HEAD(tokill);
- bool unmap_success;
+ bool unmap_success = true;
int kill = 1, forcekill;
struct page *hpage = *hpagep;
bool mlocked = PageMlocked(hpage);
@@ -1028,7 +1028,19 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn,
if (kill)
collect_procs(hpage, &tokill, flags & MF_ACTION_REQUIRED);
- unmap_success = try_to_unmap(hpage, ttu);
+ if (!PageHuge(hpage)) {
+ unmap_success = try_to_unmap(hpage, ttu);
+ } else if (mapping) {
+ /*
+ * For hugetlb pages, try_to_unmap could potentially call
+ * huge_pmd_unshare. Because of this, take semaphore in
+ * write mode here and set TTU_RMAP_LOCKED to indicate we
+ * have taken the lock at this higer level.
+ */
+ i_mmap_lock_write(mapping);
+ unmap_success = try_to_unmap(hpage, ttu|TTU_RMAP_LOCKED);
+ i_mmap_unlock_write(mapping);
+ }
if (!unmap_success)
pr_err("Memory failure: %#lx: failed to unmap page (mapcount=%d)\n",
pfn, page_mapcount(hpage));
diff --git a/mm/migrate.c b/mm/migrate.c
index 4389696fba0e..5d1839a9148d 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1324,8 +1324,19 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
goto put_anon;
if (page_mapped(hpage)) {
+ struct address_space *mapping = page_mapping(hpage);
+
+ /*
+ * try_to_unmap could potentially call huge_pmd_unshare.
+ * Because of this, take semaphore in write mode here and
+ * set TTU_RMAP_LOCKED to let lower levels know we have
+ * taken the lock.
+ */
+ i_mmap_lock_write(mapping);
try_to_unmap(hpage,
- TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS);
+ TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS|
+ TTU_RMAP_LOCKED);
+ i_mmap_unlock_write(mapping);
page_was_mapped = 1;
}
diff --git a/mm/rmap.c b/mm/rmap.c
index 68a1a5b869a5..21a26cf51114 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -25,6 +25,7 @@
* page->flags PG_locked (lock_page)
* hugetlbfs_i_mmap_rwsem_key (in huge_pmd_share)
* mapping->i_mmap_rwsem
+ * hugetlb_fault_mutex (hugetlbfs specific page fault mutex)
* anon_vma->rwsem
* mm->page_table_lock or pte_lock
* zone_lru_lock (in mark_page_accessed, isolate_lru_page)
@@ -1378,6 +1379,9 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
/*
* If sharing is possible, start and end will be adjusted
* accordingly.
+ *
+ * If called for a huge page, caller must hold i_mmap_rwsem
+ * in write mode as it is possible to call huge_pmd_unshare.
*/
adjust_range_if_pmd_sharing_possible(vma, &range.start,
&range.end);
diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 458acda96f20..48368589f519 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -267,10 +267,14 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
VM_BUG_ON(dst_addr & ~huge_page_mask(h));
/*
- * Serialize via hugetlb_fault_mutex
+ * Serialize via i_mmap_rwsem and hugetlb_fault_mutex.
+ * i_mmap_rwsem ensures the dst_pte remains valid even
+ * in the case of shared pmds. fault mutex prevents
+ * races with other faulting threads.
*/
- idx = linear_page_index(dst_vma, dst_addr);
mapping = dst_vma->vm_file->f_mapping;
+ i_mmap_lock_read(mapping);
+ idx = linear_page_index(dst_vma, dst_addr);
hash = hugetlb_fault_mutex_hash(h, dst_mm, dst_vma, mapping,
idx, dst_addr);
mutex_lock(&hugetlb_fault_mutex_table[hash]);
@@ -279,6 +283,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
dst_pte = huge_pte_alloc(dst_mm, dst_addr, huge_page_size(h));
if (!dst_pte) {
mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ i_mmap_unlock_read(mapping);
goto out_unlock;
}
@@ -286,6 +291,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
dst_pteval = huge_ptep_get(dst_pte);
if (!huge_pte_none(dst_pteval)) {
mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ i_mmap_unlock_read(mapping);
goto out_unlock;
}
@@ -293,6 +299,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
dst_addr, src_addr, &page);
mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ i_mmap_unlock_read(mapping);
vm_alloc_shared = vm_shared;
cond_resched();
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b43a9990055958e70347c56f90ea2ae32c67334c Mon Sep 17 00:00:00 2001
From: Mike Kravetz <mike.kravetz(a)oracle.com>
Date: Fri, 28 Dec 2018 00:39:38 -0800
Subject: [PATCH] hugetlbfs: use i_mmap_rwsem for more pmd sharing
synchronization
While looking at BUGs associated with invalid huge page map counts, it was
discovered and observed that a huge pte pointer could become 'invalid' and
point to another task's page table. Consider the following:
A task takes a page fault on a shared hugetlbfs file and calls
huge_pte_alloc to get a ptep. Suppose the returned ptep points to a
shared pmd.
Now, another task truncates the hugetlbfs file. As part of truncation, it
unmaps everyone who has the file mapped. If the range being truncated is
covered by a shared pmd, huge_pmd_unshare will be called. For all but the
last user of the shared pmd, huge_pmd_unshare will clear the pud pointing
to the pmd. If the task in the middle of the page fault is not the last
user, the ptep returned by huge_pte_alloc now points to another task's
page table or worse. This leads to bad things such as incorrect page
map/reference counts or invalid memory references.
To fix, expand the use of i_mmap_rwsem as follows:
- i_mmap_rwsem is held in read mode whenever huge_pmd_share is called.
huge_pmd_share is only called via huge_pte_alloc, so callers of
huge_pte_alloc take i_mmap_rwsem before calling. In addition, callers
of huge_pte_alloc continue to hold the semaphore until finished with the
ptep.
- i_mmap_rwsem is held in write mode whenever huge_pmd_unshare is
called.
[mike.kravetz(a)oracle.com: add explicit check for mapping != null]
Link: http://lkml.kernel.org/r/20181218223557.5202-2-mike.kravetz@oracle.com
Fixes: 39dde65c9940 ("shared page table for hugetlb page")
Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: Hugh Dickins <hughd(a)google.com>
Cc: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com>
Cc: "Aneesh Kumar K . V" <aneesh.kumar(a)linux.vnet.ibm.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Davidlohr Bueso <dave(a)stgolabs.net>
Cc: Prakash Sangappa <prakash.sangappa(a)oracle.com>
Cc: Colin Ian King <colin.king(a)canonical.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 12000ba5c868..87fd3ab809c6 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3238,6 +3238,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
struct page *ptepage;
unsigned long addr;
int cow;
+ struct address_space *mapping = vma->vm_file->f_mapping;
struct hstate *h = hstate_vma(vma);
unsigned long sz = huge_page_size(h);
struct mmu_notifier_range range;
@@ -3249,13 +3250,23 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
mmu_notifier_range_init(&range, src, vma->vm_start,
vma->vm_end);
mmu_notifier_invalidate_range_start(&range);
+ } else {
+ /*
+ * For shared mappings i_mmap_rwsem must be held to call
+ * huge_pte_alloc, otherwise the returned ptep could go
+ * away if part of a shared pmd and another thread calls
+ * huge_pmd_unshare.
+ */
+ i_mmap_lock_read(mapping);
}
for (addr = vma->vm_start; addr < vma->vm_end; addr += sz) {
spinlock_t *src_ptl, *dst_ptl;
+
src_pte = huge_pte_offset(src, addr, sz);
if (!src_pte)
continue;
+
dst_pte = huge_pte_alloc(dst, addr, sz);
if (!dst_pte) {
ret = -ENOMEM;
@@ -3326,6 +3337,8 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
if (cow)
mmu_notifier_invalidate_range_end(&range);
+ else
+ i_mmap_unlock_read(mapping);
return ret;
}
@@ -3771,14 +3784,18 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm,
};
/*
- * hugetlb_fault_mutex must be dropped before
- * handling userfault. Reacquire after handling
- * fault to make calling code simpler.
+ * hugetlb_fault_mutex and i_mmap_rwsem must be
+ * dropped before handling userfault. Reacquire
+ * after handling fault to make calling code simpler.
*/
hash = hugetlb_fault_mutex_hash(h, mm, vma, mapping,
idx, haddr);
mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ i_mmap_unlock_read(mapping);
+
ret = handle_userfault(&vmf, VM_UFFD_MISSING);
+
+ i_mmap_lock_read(mapping);
mutex_lock(&hugetlb_fault_mutex_table[hash]);
goto out;
}
@@ -3926,6 +3943,11 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
ptep = huge_pte_offset(mm, haddr, huge_page_size(h));
if (ptep) {
+ /*
+ * Since we hold no locks, ptep could be stale. That is
+ * OK as we are only making decisions based on content and
+ * not actually modifying content here.
+ */
entry = huge_ptep_get(ptep);
if (unlikely(is_hugetlb_entry_migration(entry))) {
migration_entry_wait_huge(vma, mm, ptep);
@@ -3933,20 +3955,31 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
} else if (unlikely(is_hugetlb_entry_hwpoisoned(entry)))
return VM_FAULT_HWPOISON_LARGE |
VM_FAULT_SET_HINDEX(hstate_index(h));
- } else {
- ptep = huge_pte_alloc(mm, haddr, huge_page_size(h));
- if (!ptep)
- return VM_FAULT_OOM;
}
+ /*
+ * Acquire i_mmap_rwsem before calling huge_pte_alloc and hold
+ * until finished with ptep. This prevents huge_pmd_unshare from
+ * being called elsewhere and making the ptep no longer valid.
+ *
+ * ptep could have already be assigned via huge_pte_offset. That
+ * is OK, as huge_pte_alloc will return the same value unless
+ * something changed.
+ */
mapping = vma->vm_file->f_mapping;
- idx = vma_hugecache_offset(h, vma, haddr);
+ i_mmap_lock_read(mapping);
+ ptep = huge_pte_alloc(mm, haddr, huge_page_size(h));
+ if (!ptep) {
+ i_mmap_unlock_read(mapping);
+ return VM_FAULT_OOM;
+ }
/*
* Serialize hugepage allocation and instantiation, so that we don't
* get spurious allocation failures if two CPUs race to instantiate
* the same page in the page cache.
*/
+ idx = vma_hugecache_offset(h, vma, haddr);
hash = hugetlb_fault_mutex_hash(h, mm, vma, mapping, idx, haddr);
mutex_lock(&hugetlb_fault_mutex_table[hash]);
@@ -4034,6 +4067,7 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
}
out_mutex:
mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ i_mmap_unlock_read(mapping);
/*
* Generally it's safe to hold refcount during waiting page lock. But
* here we just wait to defer the next page fault to avoid busy loop and
@@ -4638,10 +4672,12 @@ void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
* Search for a shareable pmd page for hugetlb. In any case calls pmd_alloc()
* and returns the corresponding pte. While this is not necessary for the
* !shared pmd case because we can allocate the pmd later as well, it makes the
- * code much cleaner. pmd allocation is essential for the shared case because
- * pud has to be populated inside the same i_mmap_rwsem section - otherwise
- * racing tasks could either miss the sharing (see huge_pte_offset) or select a
- * bad pmd for sharing.
+ * code much cleaner.
+ *
+ * This routine must be called with i_mmap_rwsem held in at least read mode.
+ * For hugetlbfs, this prevents removal of any page table entries associated
+ * with the address space. This is important as we are setting up sharing
+ * based on existing page table entries (mappings).
*/
pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
{
@@ -4658,7 +4694,6 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
if (!vma_shareable(vma, addr))
return (pte_t *)pmd_alloc(mm, pud, addr);
- i_mmap_lock_write(mapping);
vma_interval_tree_foreach(svma, &mapping->i_mmap, idx, idx) {
if (svma == vma)
continue;
@@ -4688,7 +4723,6 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
spin_unlock(ptl);
out:
pte = (pte_t *)pmd_alloc(mm, pud, addr);
- i_mmap_unlock_write(mapping);
return pte;
}
@@ -4699,7 +4733,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
* indicated by page_count > 1, unmap is achieved by clearing pud and
* decrementing the ref count. If count == 1, the pte page is not shared.
*
- * called with page table lock held.
+ * Called with page table lock held and i_mmap_rwsem held in write mode.
*
* returns: 1 successfully unmapped a shared pte page
* 0 the underlying pte page is not shared, or it is the last user
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 7c72f2a95785..6379fff1a5ff 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -966,7 +966,7 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn,
enum ttu_flags ttu = TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS;
struct address_space *mapping;
LIST_HEAD(tokill);
- bool unmap_success;
+ bool unmap_success = true;
int kill = 1, forcekill;
struct page *hpage = *hpagep;
bool mlocked = PageMlocked(hpage);
@@ -1028,7 +1028,19 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn,
if (kill)
collect_procs(hpage, &tokill, flags & MF_ACTION_REQUIRED);
- unmap_success = try_to_unmap(hpage, ttu);
+ if (!PageHuge(hpage)) {
+ unmap_success = try_to_unmap(hpage, ttu);
+ } else if (mapping) {
+ /*
+ * For hugetlb pages, try_to_unmap could potentially call
+ * huge_pmd_unshare. Because of this, take semaphore in
+ * write mode here and set TTU_RMAP_LOCKED to indicate we
+ * have taken the lock at this higer level.
+ */
+ i_mmap_lock_write(mapping);
+ unmap_success = try_to_unmap(hpage, ttu|TTU_RMAP_LOCKED);
+ i_mmap_unlock_write(mapping);
+ }
if (!unmap_success)
pr_err("Memory failure: %#lx: failed to unmap page (mapcount=%d)\n",
pfn, page_mapcount(hpage));
diff --git a/mm/migrate.c b/mm/migrate.c
index 4389696fba0e..5d1839a9148d 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1324,8 +1324,19 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
goto put_anon;
if (page_mapped(hpage)) {
+ struct address_space *mapping = page_mapping(hpage);
+
+ /*
+ * try_to_unmap could potentially call huge_pmd_unshare.
+ * Because of this, take semaphore in write mode here and
+ * set TTU_RMAP_LOCKED to let lower levels know we have
+ * taken the lock.
+ */
+ i_mmap_lock_write(mapping);
try_to_unmap(hpage,
- TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS);
+ TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS|
+ TTU_RMAP_LOCKED);
+ i_mmap_unlock_write(mapping);
page_was_mapped = 1;
}
diff --git a/mm/rmap.c b/mm/rmap.c
index 68a1a5b869a5..21a26cf51114 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -25,6 +25,7 @@
* page->flags PG_locked (lock_page)
* hugetlbfs_i_mmap_rwsem_key (in huge_pmd_share)
* mapping->i_mmap_rwsem
+ * hugetlb_fault_mutex (hugetlbfs specific page fault mutex)
* anon_vma->rwsem
* mm->page_table_lock or pte_lock
* zone_lru_lock (in mark_page_accessed, isolate_lru_page)
@@ -1378,6 +1379,9 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
/*
* If sharing is possible, start and end will be adjusted
* accordingly.
+ *
+ * If called for a huge page, caller must hold i_mmap_rwsem
+ * in write mode as it is possible to call huge_pmd_unshare.
*/
adjust_range_if_pmd_sharing_possible(vma, &range.start,
&range.end);
diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 458acda96f20..48368589f519 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -267,10 +267,14 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
VM_BUG_ON(dst_addr & ~huge_page_mask(h));
/*
- * Serialize via hugetlb_fault_mutex
+ * Serialize via i_mmap_rwsem and hugetlb_fault_mutex.
+ * i_mmap_rwsem ensures the dst_pte remains valid even
+ * in the case of shared pmds. fault mutex prevents
+ * races with other faulting threads.
*/
- idx = linear_page_index(dst_vma, dst_addr);
mapping = dst_vma->vm_file->f_mapping;
+ i_mmap_lock_read(mapping);
+ idx = linear_page_index(dst_vma, dst_addr);
hash = hugetlb_fault_mutex_hash(h, dst_mm, dst_vma, mapping,
idx, dst_addr);
mutex_lock(&hugetlb_fault_mutex_table[hash]);
@@ -279,6 +283,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
dst_pte = huge_pte_alloc(dst_mm, dst_addr, huge_page_size(h));
if (!dst_pte) {
mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ i_mmap_unlock_read(mapping);
goto out_unlock;
}
@@ -286,6 +291,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
dst_pteval = huge_ptep_get(dst_pte);
if (!huge_pte_none(dst_pteval)) {
mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ i_mmap_unlock_read(mapping);
goto out_unlock;
}
@@ -293,6 +299,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
dst_addr, src_addr, &page);
mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ i_mmap_unlock_read(mapping);
vm_alloc_shared = vm_shared;
cond_resched();
Hi,
After upgrading kernel from 4.14.40 to 4.14.88,I found that 'HP FlexFabric 10Gb 2-port 554FLB Adapter' device is not in use. There are erros in dmesg log.
The Server is 'HP FlexServer B390'.
Device info:
lspci -n | grep 04:00
04:00.2 0c04: 19a2:0714 (rev 01)
...
04:00.2 Fibre Channel: Emulex Corporation OneConnect 10Gb FCoE Initiator (be3) (rev 01)
Subsystem: Hewlett-Packard Company NC554FLB 10Gb 2-port FlexFabric Converged Network Adapter
Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr+ Stepping- SERR- FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0, Cache Line Size: 64 bytes
Interrupt: pin C routed to IRQ 95
...
Kernel driver in use: lpfc
The error info:
[ 1046.980480] lpfc 0000:04:00.3: 1:1303 Link Up Event x1 received Data: x1 x0 x4 x0 x0 x0 0
[ 1046.980482] lpfc 0000:04:00.3: 1:(0):2753 PLOGI failure DID:020009 Status:x3/x103
[ 1050.435167] lpfc 0000:04:00.2: 0:(0):2753 PLOGI failure DID:010012 Status:x3/x103
[ 1065.713327] lpfc 0000:04:00.3: 1:(0):2753 PLOGI failure DID:040002 Status:x3/x103
[ 1072.331933] lpfc 0000:04:00.2: 0:(0):2753 PLOGI failure DID:030003 Status:x3/x103
[ 1137.628132] lpfc 0000:04:00.2: 0:(0):0748 abort handler timed out waiting for aborting I/O (xri:x64) to complete: ret 0x2003, ID 2, LUN 0
[ 1137.644257] lpfc 0000:04:00.2: 0:(0):0713 SCSI layer issued Device Reset (2, 0) return x2002
[ 1139.676124] lpfc 0000:04:00.3: 1:(0):0748 abort handler timed out waiting for aborting I/O (xri:x464) to complete: ret 0x2003, ID 4, LUN 0
[ 1139.692242] lpfc 0000:04:00.3: 1:(0):0713 SCSI layer issued Device Reset (4, 0) return x2002
[ 1197.664150] lpfc 0000:04:00.2: 0:(0):0724 I/O flush failure for context LUN : cnt x1
[ 1197.664344] lpfc 0000:04:00.2: 0:(0):0723 SCSI layer issued Target Reset (2, 0) return x2002
[ 1199.704116] lpfc 0000:04:00.3: 1:(0):0724 I/O flush failure for context LUN : cnt x1
[ 1199.704368] lpfc 0000:04:00.3: 1:(0):0723 SCSI layer issued Target Reset (4, 0) return x2002
At the beginning, I thought the lpfc driver itself is the cause of the error.But,the error is still seen when 'lpfc driver' updates to the latest version.
To find the root cause and fix it, we checked the kernel version from 4.14.41 to 4.14.88, built and tested the kernel for booting.
The commit that caused error after bisect is ef86f3a72adb8a7931f67335560740a7ad696d1d,when I removed the commit the issue went away.
Commit info:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=…
During the test, I also found another issue that the system of 'HP FlexServer B390' server failed to boot by "hpsa driver timeout",basically, looks like the hpsa didn't detect the hard drives and udevd is stalled.
After upgrading from v4.14.54 to 4.14.55, hp system didn't boot ,but the system is ok when using the v4.14.55 kernel that has removed the commit.
The commit of ef86f3a72adb8a7931f67335560740a7ad696d1d also affects the HP Smart Array P220i RAID device.Because the v4.14.88 kernel is ok, I think that subsequent commits may have fixed the hpsa driver issue, but lpfc driver issue is not.
If there is any more info I can provide, just ask what would be useful. Any suggestions?
Thanks
Liang
The patch below does not apply to the 4.20-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 894169db12463cea08d0e2a9e35f42b291340e5a Mon Sep 17 00:00:00 2001
From: Shivasharan S <shivasharan.srikanteshwara(a)broadcom.com>
Date: Tue, 18 Dec 2018 05:59:54 -0800
Subject: [PATCH] scsi: megaraid_sas: Use 63-bit DMA addressing
Although MegaRAID controllers support 64-bit DMA addressing, as per
hardware design, DMA address with all 64-bits set
(0xFFFFFFFF-FFFFFFFF) results in a firmware fault.
Driver will set 63-bit DMA mask to ensure the above address will not be
used.
Cc: stable(a)vger.kernel.org
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara(a)broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index d0f4075fe36e..f7bdd783360a 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -6184,13 +6184,13 @@ static int megasas_io_attach(struct megasas_instance *instance)
* @instance: Adapter soft state
* Description:
*
- * For Ventura, driver/FW will operate in 64bit DMA addresses.
+ * For Ventura, driver/FW will operate in 63bit DMA addresses.
*
* For invader-
* By default, driver/FW will operate in 32bit DMA addresses
* for consistent DMA mapping but if 32 bit consistent
- * DMA mask fails, driver will try with 64 bit consistent
- * mask provided FW is true 64bit DMA capable
+ * DMA mask fails, driver will try with 63 bit consistent
+ * mask provided FW is true 63bit DMA capable
*
* For older controllers(Thunderbolt and MFI based adapters)-
* driver/FW will operate in 32 bit consistent DMA addresses.
@@ -6204,14 +6204,14 @@ megasas_set_dma_mask(struct megasas_instance *instance)
pdev = instance->pdev;
consistent_mask = (instance->adapter_type >= VENTURA_SERIES) ?
- DMA_BIT_MASK(64) : DMA_BIT_MASK(32);
+ DMA_BIT_MASK(63) : DMA_BIT_MASK(32);
if (IS_DMA64) {
- if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(64)) &&
+ if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(63)) &&
dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)))
goto fail_set_dma_mask;
- if ((*pdev->dev.dma_mask == DMA_BIT_MASK(64)) &&
+ if ((*pdev->dev.dma_mask == DMA_BIT_MASK(63)) &&
(dma_set_coherent_mask(&pdev->dev, consistent_mask) &&
dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)))) {
/*
@@ -6224,7 +6224,7 @@ megasas_set_dma_mask(struct megasas_instance *instance)
if (!(scratch_pad_1 & MR_CAN_HANDLE_64_BIT_DMA_OFFSET))
goto fail_set_dma_mask;
else if (dma_set_mask_and_coherent(&pdev->dev,
- DMA_BIT_MASK(64)))
+ DMA_BIT_MASK(63)))
goto fail_set_dma_mask;
}
} else if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)))
@@ -6236,8 +6236,8 @@ megasas_set_dma_mask(struct megasas_instance *instance)
instance->consistent_mask_64bit = true;
dev_info(&pdev->dev, "%s bit DMA mask and %s bit consistent mask\n",
- ((*pdev->dev.dma_mask == DMA_BIT_MASK(64)) ? "64" : "32"),
- (instance->consistent_mask_64bit ? "64" : "32"));
+ ((*pdev->dev.dma_mask == DMA_BIT_MASK(64)) ? "63" : "32"),
+ (instance->consistent_mask_64bit ? "63" : "32"));
return 0;
The patch
regulator: max77620: Initialize values for DT properties
has been applied to the regulator tree at
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator.git
All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.
You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.
If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.
Please add any relevant lists and maintainers to the CCs when replying
to this mail.
Thanks,
Mark
>From 0ab66b3c326ef8f77dae9f528118966365757c0c Mon Sep 17 00:00:00 2001
From: Mark Zhang <markz(a)nvidia.com>
Date: Thu, 10 Jan 2019 12:11:16 +0800
Subject: [PATCH] regulator: max77620: Initialize values for DT properties
If regulator DT node doesn't exist, its of_parse_cb callback
function isn't called. Then all values for DT properties are
filled with zero. This leads to wrong register update for
FPS and POK settings.
Signed-off-by: Jinyoung Park <jinyoungp(a)nvidia.com>
Signed-off-by: Mark Zhang <markz(a)nvidia.com>
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Cc: stable(a)vger.kernel.org
---
drivers/regulator/max77620-regulator.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/regulator/max77620-regulator.c b/drivers/regulator/max77620-regulator.c
index b94e3a721721..cd93cf53e23c 100644
--- a/drivers/regulator/max77620-regulator.c
+++ b/drivers/regulator/max77620-regulator.c
@@ -1,7 +1,7 @@
/*
* Maxim MAX77620 Regulator driver
*
- * Copyright (c) 2016, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2016-2018, NVIDIA CORPORATION. All rights reserved.
*
* Author: Mallikarjun Kasoju <mkasoju(a)nvidia.com>
* Laxman Dewangan <ldewangan(a)nvidia.com>
@@ -803,6 +803,14 @@ static int max77620_regulator_probe(struct platform_device *pdev)
rdesc = &rinfo[id].desc;
pmic->rinfo[id] = &max77620_regs_info[id];
pmic->enable_power_mode[id] = MAX77620_POWER_MODE_NORMAL;
+ pmic->reg_pdata[id].active_fps_src = -1;
+ pmic->reg_pdata[id].active_fps_pd_slot = -1;
+ pmic->reg_pdata[id].active_fps_pu_slot = -1;
+ pmic->reg_pdata[id].suspend_fps_src = -1;
+ pmic->reg_pdata[id].suspend_fps_pd_slot = -1;
+ pmic->reg_pdata[id].suspend_fps_pu_slot = -1;
+ pmic->reg_pdata[id].power_ok = -1;
+ pmic->reg_pdata[id].ramp_rate_setting = -1;
ret = max77620_read_slew_rate(pmic, id);
if (ret < 0)
--
2.20.1
Currently, AXP803 driver assumes that reg_drivevbus is input which is
wrong. Unfortunate consequence of that is that none of the USB ports
work on the board, even USB HOST port, because USB PHY driver probing
fails due to missing regulator.
Fix that by adding "x-powers,drive-vbus-en" property to AXP803 node.
Fixes: 14ff5d8f9151 ("arm64: dts: allwinner: a64: Orange Pi Win: Enable USB OTG socket")
Cc: stable(a)vger.kernel.org
Signed-off-by: Jernej Skrabec <jernej.skrabec(a)siol.net>
---
arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
index b0c64f75792c..8974b5a1d3b1 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
@@ -188,6 +188,7 @@
reg = <0x3a3>;
interrupt-parent = <&r_intc>;
interrupts = <0 IRQ_TYPE_LEVEL_LOW>;
+ x-powers,drive-vbus-en; /* set N_VBUSEN as output pin */
};
};
--
2.20.1
Hello,
This is v2 series of fixing kretprobe incorrect stacking order patches.
In this version, I fixed a lack of kprobes.h including and added new
patch for kretprobe trampoline recursion issue. (and add Cc:stable)
(1) kprobe incorrct stacking order problem
On recent talk with Andrea, I started more precise investigation on
the kernel panic with kretprobes on notrace functions, which Francis
had been reported last year ( https://lkml.org/lkml/2017/7/14/466 ).
See the investigation details in
https://lkml.kernel.org/r/154686789378.15479.2886543882215785247.stgit@devb…
When we put a kretprobe on ftrace_ops_assist_func() and put another
kretprobe on probed-function, below happens
<caller>
-><probed-function>
->fentry
->ftrace_ops_assist_func()
->int3
->kprobe_int3_handler()
...->pre_handler_kretprobe()
push the return address (*fentry*) of ftrace_ops_assist_func() to
top of the kretprobe list and replace it with kretprobe_trampoline.
<-kprobe_int3_handler()
<-(int3)
->kprobe_ftrace_handler()
...->pre_handler_kretprobe()
push the return address (caller) of probed-function to top of the
kretprobe list and replace it with kretprobe_trampoline.
<-(kprobe_ftrace_handler())
<-(ftrace_ops_assist_func())
[kretprobe_trampoline]
->tampoline_handler()
pop the return address (caller) from top of the kretprobe list
<-(trampoline_handler())
<caller>
[run caller with incorrect stack information]
<-(<caller>)
!!KERNEL PANIC!!
Therefore, this kernel panic happens only when we put 2 k*ret*probes on
ftrace_ops_assist_func() and other functions. If we put kprobes, it
doesn't cause any issue, since it doesn't change the return address.
To fix (or just avoid) this issue, we can introduce a frame pointer
verification to skip wrong order entries. And I also would like to
blacklist those functions because those are part of ftrace-based
kprobe handling routine.
(2) kretprobe trampoline recursion problem
This was found by Andrea in the previous thread
https://lkml.kernel.org/r/20190107183444.GA5966@xps-13
----
echo "r:event_1 __fdget" >> kprobe_events
echo "r:event_2 _raw_spin_lock_irqsave" >> kprobe_events
echo 1 > events/kprobes/enable
[DEADLOCK]
----
Because kretprobe trampoline_handler uses spinlock for protecting
hash table, if we probe the spinlock itself, it causes deadlock.
Thank you Andrea and Steve for discovering this root cause!!
This bug has been introduced with the asm-coded trampoline
code, since previously it used another kprobe for hooking
the function return placeholder (which only has a nop) and
trampoline handler was called from that kprobe.
To fix this bug, I introduced a dummy kprobe and set it in
current_kprobe as we did in old days.
Thank you,
---
Masami Hiramatsu (3):
x86/kprobes: Verify stack frame on kretprobe
kprobes: Mark ftrace mcount handler functions nokprobe
x86/kprobes: Fix to avoid kretprobe recursion
arch/x86/kernel/kprobes/core.c | 48 ++++++++++++++++++++++++++++++++++++++--
include/linux/kprobes.h | 1 +
kernel/trace/ftrace.c | 6 ++++-
3 files changed, 52 insertions(+), 3 deletions(-)
--
Masami Hiramatsu (Linaro) <mhiramat(a)kernel.org>
The patch titled
Subject: mm/hugetlb.c: teach follow_hugetlb_page() to handle FOLL_NOWAIT
has been added to the -mm tree. Its filename is
mm-hugetlbc-teach-follow_hugetlb_page-to-handle-foll_nowait.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-hugetlbc-teach-follow_hugetlb_p…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-hugetlbc-teach-follow_hugetlb_p…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Andrea Arcangeli <aarcange(a)redhat.com>
Subject: mm/hugetlb.c: teach follow_hugetlb_page() to handle FOLL_NOWAIT
hugetlb needs the same fix as faultin_nopage (which was applied in
96312e61282ae ("mm/gup.c: teach get_user_pages_unlocked to handle
FOLL_NOWAIT")) or KVM hangs because it thinks the mmap_sem was already
released by hugetlb_fault() if it returned VM_FAULT_RETRY, but it wasn't
in the FOLL_NOWAIT case.
Link: http://lkml.kernel.org/r/20190109020203.26669-2-aarcange@redhat.com
Fixes: ce53053ce378 ("kvm: switch get_user_page_nowait() to get_user_pages_unlocked()")
Signed-off-by: Andrea Arcangeli <aarcange(a)redhat.com>
Tested-by: "Dr. David Alan Gilbert" <dgilbert(a)redhat.com>
Reported-by: "Dr. David Alan Gilbert" <dgilbert(a)redhat.com>
Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Reviewed-by: Peter Xu <peterx(a)redhat.com>
Cc: Mike Rapoport <rppt(a)linux.vnet.ibm.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/hugetlb.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/mm/hugetlb.c~mm-hugetlbc-teach-follow_hugetlb_page-to-handle-foll_nowait
+++ a/mm/hugetlb.c
@@ -4268,7 +4268,8 @@ long follow_hugetlb_page(struct mm_struc
break;
}
if (ret & VM_FAULT_RETRY) {
- if (nonblocking)
+ if (nonblocking &&
+ !(fault_flags & FAULT_FLAG_RETRY_NOWAIT))
*nonblocking = 0;
*nr_pages = 0;
/*
_
Patches currently in -mm which might be from aarcange(a)redhat.com are
mm-hugetlbc-teach-follow_hugetlb_page-to-handle-foll_nowait.patch
The patch titled
Subject: mm/hugetlb.c: teach follow_hugetlb_page() to handle FOLL_NOWAIT
has been added to the -mm tree. Its filename is
mm-hugetlbc-teach-follow_hugetlb_page-to-handle-foll_nowait.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-hugetlbc-teach-follow_hugetlb_p…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-hugetlbc-teach-follow_hugetlb_p…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Andrea Arcangeli <aarcange(a)redhat.com>
Subject: mm/hugetlb.c: teach follow_hugetlb_page() to handle FOLL_NOWAIT
hugetlb needs the same fix as faultin_nopage (which was applied in
96312e61282ae ("mm/gup.c: teach get_user_pages_unlocked to handle
FOLL_NOWAIT")) or KVM hangs because it thinks the mmap_sem was already
released by hugetlb_fault() if it returned VM_FAULT_RETRY, but it wasn't
in the FOLL_NOWAIT case.
Link: http://lkml.kernel.org/r/20190109020203.26669-2-aarcange@redhat.com
Fixes: ce53053ce378 ("kvm: switch get_user_page_nowait() to get_user_pages_unlocked()")
Signed-off-by: Andrea Arcangeli <aarcange(a)redhat.com>
Tested-by: "Dr. David Alan Gilbert" <dgilbert(a)redhat.com>
Reported-by: "Dr. David Alan Gilbert" <dgilbert(a)redhat.com>
Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Reviewed-by: Peter Xu <peterx(a)redhat.com>
Cc: Mike Rapoport <rppt(a)linux.vnet.ibm.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/hugetlb.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/mm/hugetlb.c~mm-hugetlbc-teach-follow_hugetlb_page-to-handle-foll_nowait
+++ a/mm/hugetlb.c
@@ -4268,7 +4268,8 @@ long follow_hugetlb_page(struct mm_struc
break;
}
if (ret & VM_FAULT_RETRY) {
- if (nonblocking)
+ if (nonblocking &&
+ !(fault_flags & FAULT_FLAG_RETRY_NOWAIT))
*nonblocking = 0;
*nr_pages = 0;
/*
_
Patches currently in -mm which might be from aarcange(a)redhat.com are
mm-hugetlbc-teach-follow_hugetlb_page-to-handle-foll_nowait.patch
I'm announcing the release of the 4.19.14 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Aaro Koskinen (1):
MIPS: OCTEON: mark RGMII interface disabled on OCTEON III
Adrian Hunter (4):
perf machine: Record if a arch has a single user/kernel address space
perf thread: Add fallback functions for cases where cpumode is insufficient
perf tools: Use fallback for sample_addr_correlates_sym() cases
perf script: Use fallbacks for branch stacks
Alaa Hleihel (1):
net/mlx5e: Remove the false indication of software timestamping support
Alexey Brodkin (1):
clocksource/drivers/arc_timer: Utilize generic sched_clock
Allan W. Nielsen (1):
mscc: Configured MAC entries should be locked.
Anand Jain (2):
btrfs: dev-replace: go back to suspended state if target device is missing
btrfs: dev-replace: go back to suspend state if another EXCL_OP is running
Antoine Tenart (2):
net: mvpp2: 10G modes aren't supported on all ports
net: mvpp2: fix the phylink mode validation
Arnaldo Carvalho de Melo (1):
perf env: Also consider env->arch == NULL as local operation
Arnd Bergmann (1):
mtd: atmel-quadspi: disallow building on ebsa110
Atul Gupta (1):
crypto: chcr - small packet Tx stalls the queue
Ben Hutchings (1):
perf pmu: Suppress potential format-truncation warning
Boris Brezillon (1):
mtd: rawnand: omap2: Pass the parent of pdev to dma_request_chan()
Breno Leitao (1):
powerpc/tm: Unset MSR[TS] if not recheckpointing
Christoffer Dall (1):
KVM: arm/arm64: vgic-v2: Set active_source to 0 when restoring state
Christophe JAILLET (1):
net/ipv6: Fix a test against 'ipv6_find_idev()' return value
Claudiu Beznea (1):
net: macb: restart tx after tx used bit read
Colin Ian King (1):
staging: wilc1000: fix missing read_write setting when reading data
Cong Wang (11):
ax25: fix a use-after-free in ax25_fillin_cb()
ipv6: explicitly initialize udp6_addr in udp_sock_create6()
netrom: fix locking in nr_find_socket()
net/wan: fix a double free in x25_asy_open_tty()
ptr_ring: wrap back ->producer in __ptr_ring_swap_queue()
tipc: check tsk->group in tipc_wait_for_cond()
tipc: compare remote and local protocols in tipc_udp_enable()
tipc: fix a double free in tipc_enable_bearer()
tipc: fix a double kfree_skb()
tipc: use lock_sock() in tipc_sk_reinit()
tipc: check group dests after tipc_wait_for_cond()
Dan Carpenter (1):
net: stmmac: Fix an error code in probe()
Dan Williams (2):
x86/mm: Drop usage of __flush_tlb_all() in kernel_physical_mapping_init()
dax: Use non-exclusive wait in wait_entry_unlocked()
Davide Caratti (1):
net: Use __kernel_clockid_t in uapi net_stamp.h
Deepa Dinamani (1):
sock: Make sock->sk_stamp thread-safe
Diana Craciun (1):
powerpc/fsl: Fix spectre_v2 mitigations reporting
Dmitry Eremin-Solenikov (2):
crypto: testmgr - add AES-CFB tests
crypto: cfb - fix decryption
Eric Anholt (1):
drm/v3d: Skip debugfs dumping GCA on platforms without GCA.
Eric Dumazet (5):
ipv6: tunnels: fix two use-after-free
isdn: fix kernel-infoleak in capi_unlocked_ioctl
net: clear skb->tstamp in forwarding paths
net/hamradio/6pack: use mod_timer() to rearm timers
tcp: fix a race in inet_diag_dump_icsk()
Eugeniy Paltsev (1):
DRM: UDL: get rid of useless vblank initialization
Filipe Manana (2):
Btrfs: fix fsync of files with multiple hard links in new directories
Btrfs: send, fix race with transaction commits that create snapshots
Ganesh Goudar (1):
net/tls: allocate tls context using GFP_ATOMIC
Georgy A Bystrenin (1):
CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem
Greg Kroah-Hartman (1):
Linux 4.19.14
Greg Kurz (2):
ocxl: Fix endiannes bug in ocxl_link_update_pe()
ocxl: Fix endiannes bug in read_afu_name()
Gustavo A. R. Silva (7):
ip6mr: Fix potential Spectre v1 vulnerability
ipv4: Fix potential Spectre v1 vulnerability
ALSA: rme9652: Fix potential Spectre v1 vulnerability
ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities
ALSA: pcm: Fix potential Spectre v1 vulnerability
ALSA: emux: Fix potential Spectre v1 vulnerabilities
KVM: arm/arm64: vgic: Fix off-by-one bug in vgic_get_irq()
Hans Verkuil (5):
media: cec: keep track of outstanding transmits
media: cec-pin: fix broken tx_ignore_nack_until_eom error injection
media: vivid: free bitmap_cap when updating std/timings/etc.
media: vb2: check memory model for VIDIOC_CREATE_BUFS
media: v4l2-tpg: array index could become negative
Hans de Goede (2):
ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for Chromebook Clapper
ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for Chromebook Gnawty
Heikki Krogerus (1):
usb: roles: Add a description for the class to Kconfig
Heiner Kallweit (1):
r8169: fix WoL device wakeup enable
Herbert Xu (1):
ipv6: frags: Fix bogus skb->sk in reassembled packets
Huacai Chen (4):
MIPS: c-r4k: Add r4k_blast_scache_node for Loongson-3
MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()
MIPS: Align kernel load address to 64KB
MIPS: Fix a R10000_LLSC_WAR logic in atomic.h
Jaegeuk Kim (1):
f2fs: sanity check of xattr entry size
Jason Wang (1):
vhost: make sure used idx is seen before log in vhost_add_used_n()
Jernej Skrabec (1):
clk: sunxi-ng: Use u64 for calculation of NM rate
Jia-Ju Bai (1):
usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable()
Jian-Hong Pan (1):
ALSA: hda/realtek: Enable the headset mic auto detection for ASUS laptops
Johan Jonker (1):
clk: rockchip: fix typo in rk3188 spdif_frac parent
Jorgen Hansen (1):
VSOCK: Send reset control packet when socket is partially bound
Josef Bacik (1):
btrfs: run delayed items before dropping the snapshot
Juergen Gross (1):
xen/netfront: tolerate frags with no data
Julien Thierry (1):
KVM: arm/arm64: vgic: Do not cond_resched_lock() with IRQs disabled
Jörgen Storvist (4):
qmi_wwan: Added support for Fibocom NL668 series
qmi_wwan: Added support for Telit LN940 series
qmi_wwan: Add support for Fibocom NL678 series
USB: serial: option: add Fibocom NL678 series
Kunihiko Hayashi (1):
net: phy: Fix the issue that netif always links up after resuming
Lorenzo Bianconi (1):
gro_cell: add napi_disable in gro_cells_destroy
Lu Fengqi (1):
btrfs: skip file_extent generation check for free_space_inode in run_delalloc_nocow
Luca Ceresoli (1):
media: imx274: fix stack corruption in imx274_read_reg
Lukas Wunner (4):
spi: bcm2835: Fix race on DMA termination
spi: bcm2835: Fix book-keeping of DMA termination
spi: bcm2835: Avoid finishing transfer prematurely in IRQ mode
spi: bcm2835: Unbreak the build of esoteric configs
Lyude Paul (1):
brcmfmac: Fix out of bounds memory access during fw load
Maciej W. Rozycki (1):
rtc: m41t80: Correct alarm month range with RTC reads
Macpaul Lin (1):
cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.
Malcolm Priestley (1):
media: dvb-usb-v2: Fix incorrect use of transfer_flags URB_FREE_BUFFER
Mantas Mikulėnas (1):
ALSA: hda: add mute LED support for HP EliteBook 840 G4
Marc Zyngier (3):
arm64: KVM: Make VHE Stage-2 TLB invalidation operations non-interruptible
arm/arm64: KVM: vgic: Force VM halt when changing the active state of GICv3 PPIs/SGIs
KVM: arm/arm64: vgic: Cap SPIs to the VM-defined maximum
Marcin Wojtas (1):
net: mvneta: fix operation for 64K PAGE_SIZE
Martin Blumenstingl (2):
usb: dwc2: disable power_down on Amlogic devices
f2fs: fix validation of the block count in sanity_check_raw_super
Matthew Wilcox (1):
dax: Don't access a freed inode
Maurizio Lombardi (1):
ext4: missing unlock/put_page() in ext4_try_to_write_inline_data()
Michael J. Ruhl (1):
IB/hfi1: Incorrect sizing of sge for PIO will OOPs
Michal Hocko (1):
x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off
Michal Kubecek (1):
net: ipv4: do not handle duplicate fragments as overlapping
Mikhael Goikhman (1):
net/mlx5e: Remove unused UDP GSO remaining counter
Miquel Raynal (2):
mtd: rawnand: marvell: prevent timeouts on a loaded machine
platform-msi: Free descriptors in platform_msi_domain_free()
Moshe Shemesh (1):
net/mlx5e: RX, Verify MPWQE stride size is in range
Myungho Jung (1):
net/smc: fix TCP fallback socket release
Nava kishore Manne (1):
serial: uartps: Fix interrupt mask issue to handle the RX interrupts properly
Pan Bian (2):
ext4: fix possible use after free in ext4_quota_enable
f2fs: read page index before freeing
Patrick Dreyer (1):
Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G
Paul Aurich (1):
smb3: fix large reads on encrypted connections
Paul Burton (3):
MIPS: math-emu: Write-protect delay slot emulation pages
MIPS: Expand MIPS32 ASIDs to 64 bits
MIPS: Only include mmzone.h when CONFIG_NEED_MULTIPLE_NODES=y
Pieter Jansen van Vuuren (1):
nfp: flower: ensure TCP flags can be placed in IPv6 frame
Robin Murphy (1):
iommu/arm-smmu-v3: Fix big-endian CMD_SYNC writes
Sameer Pujar (1):
ALSA: hda/tegra: clear pending irq handlers
Sanjeev Chugh (1):
Input: atmel_mxt_ts - don't try to free unallocated kernel memory
Scott Chen (1):
USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
Sean Christopherson (2):
KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
KVM: nVMX: Free the VMREAD/VMWRITE bitmaps if alloc_kvm_area() fails
Sean Young (1):
media: rc: cec devices do not have a lirc chardev
Sebastian Ott (1):
s390/pci: fix sleeping in atomic during hotplug
Shalom Toledo (1):
mlxsw: core: Increase timeout during firmware flash process
Stefano Brivio (1):
ipv6: route: Fix return value of ip6_neigh_lookup() on neigh_create() error
Stephan Gerhold (1):
Revert "usb: dwc3: pci: Use devm functions to get the phy GPIOs"
Steven Rostedt (VMware) (1):
tools lib traceevent: Fix processing of dereferenced args in bprintk events
Stijn Tintel (1):
brcmfmac: fix roamoff=1 modparam
Sudarsana Reddy Kalluru (1):
qed: Fix command number mismatch between driver and the mfw
Sylwester Nawrocki (1):
ARM: dts: exynos: Specify I2S assigned clocks in proper node
Takashi Sakamoto (4):
ALSA: fireface: fix for state to fetch PCM frames
ALSA: firewire-lib: fix wrong handling payload_length as payload_quadlet
ALSA: firewire-lib: fix wrong assignment for 'out_packet_without_header' tracepoint
ALSA: firewire-lib: use the same print format for 'without_header' tracepoints
Tal Gilboa (1):
net/mlx5e: Cancel DIM work on close SQ
Tariq Toukan (1):
net/mlx5e: RX, Fix wrong early return in receive queue poll
Tejun Heo (1):
cgroup: fix CSS_TASK_ITER_PROCS
Terin Stock (1):
usb: dwc2: host: use hrtimer for NAK retries
Theodore Ts'o (5):
ext4: add ext4_sb_bread() to disambiguate ENOMEM cases
ext4: include terminating u32 in size of xattr entries when expanding inodes
ext4: avoid declaring fs inconsistent due to invalid file handles
ext4: force inode writes when nfsd calls commit_metadata()
ext4: check for shutdown and r/o file system in ext4_write_inode()
Tomas Winkler (2):
tpm: tpm_try_transmit() refactor error flow.
tpm: tpm_i2c_nuvoton: use correct command duration for TPM 2.x
Tyrel Datwyler (1):
ibmveth: fix DMA unmap error in ibmveth_xmit_start error path
Wandrille RONCE (1):
ALSA: hda/realtek: Enable audio jacks of ASUS UX391UA with ALC294
Wenwen Wang (1):
crypto: cavium/nitrox - fix a DMA pool free failure
Will Deacon (2):
arm64: KVM: Avoid setting the upper 32 bits of VTCR_EL2 to 1
arm64: compat: Avoid sending SIGILL for unallocated syscall numbers
Willem de Bruijn (4):
ieee802154: lowpan_header_create check must check daddr
ip: validate header length on virtual device xmit
packet: validate address length
packet: validate address length if non-zero
Xin Long (1):
sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
Yuval Avnery (1):
net/mlx5: Typo fix in del_sw_hw_rule
ruippan (潘睿) (1):
ext4: fix EXT4_IOC_GROUP_ADD ioctl
The patch titled
Subject: mm: page_mapped: don't assume compound page is huge or THP
has been removed from the -mm tree. Its filename was
mm-page_mapped-dont-assume-compound-page-is-huge-or-thp.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Jan Stancek <jstancek(a)redhat.com>
Subject: mm: page_mapped: don't assume compound page is huge or THP
LTP proc01 testcase has been observed to rarely trigger crashes
on arm64:
page_mapped+0x78/0xb4
stable_page_flags+0x27c/0x338
kpageflags_read+0xfc/0x164
proc_reg_read+0x7c/0xb8
__vfs_read+0x58/0x178
vfs_read+0x90/0x14c
SyS_read+0x60/0xc0
Issue is that page_mapped() assumes that if compound page is not huge,
then it must be THP. But if this is 'normal' compound page
(COMPOUND_PAGE_DTOR), then following loop can keep running (for
HPAGE_PMD_NR iterations) until it tries to read from memory that isn't
mapped and triggers a panic:
for (i = 0; i < hpage_nr_pages(page); i++) {
if (atomic_read(&page[i]._mapcount) >= 0)
return true;
}
I could replicate this on x86 (v4.20-rc4-98-g60b548237fed) only
with a custom kernel module [1] which:
- allocates compound page (PAGEC) of order 1
- allocates 2 normal pages (COPY), which are initialized to 0xff
(to satisfy _mapcount >= 0)
- 2 PAGEC page structs are copied to address of first COPY page
- second page of COPY is marked as not present
- call to page_mapped(COPY) now triggers fault on access to 2nd
COPY page at offset 0x30 (_mapcount)
[1] https://github.com/jstancek/reproducers/blob/master/kernel/page_mapped_cras…
Fix the loop to iterate for "1 << compound_order" pages.
Kirrill said "IIRC, sound subsystem can producuce custom mapped compound
pages".
Link: http://lkml.kernel.org/r/c440d69879e34209feba21e12d236d06bc0a25db.154357715…
Fixes: e1534ae95004 ("mm: differentiate page_mapped() from page_mapcount() for compound pages")
Signed-off-by: Jan Stancek <jstancek(a)redhat.com>
Debugged-by: Laszlo Ersek <lersek(a)redhat.com>
Suggested-by: "Kirill A. Shutemov" <kirill(a)shutemov.name>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Reviewed-by: David Hildenbrand <david(a)redhat.com>
Reviewed-by: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/util.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/util.c~mm-page_mapped-dont-assume-compound-page-is-huge-or-thp
+++ a/mm/util.c
@@ -478,7 +478,7 @@ bool page_mapped(struct page *page)
return true;
if (PageHuge(page))
return false;
- for (i = 0; i < hpage_nr_pages(page); i++) {
+ for (i = 0; i < (1 << compound_order(page)); i++) {
if (atomic_read(&page[i]._mapcount) >= 0)
return true;
}
_
Patches currently in -mm which might be from jstancek(a)redhat.com are
The patch titled
Subject: mm, memcg: fix reclaim deadlock with writeback
has been removed from the -mm tree. Its filename was
mm-memcg-fix-reclaim-deadlock-with-writeback.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Michal Hocko <mhocko(a)suse.com>
Subject: mm, memcg: fix reclaim deadlock with writeback
Liu Bo has experienced a deadlock between memcg (legacy) reclaim and the
ext4 writeback
task1:
[<ffffffff811aaa52>] wait_on_page_bit+0x82/0xa0
[<ffffffff811c5777>] shrink_page_list+0x907/0x960
[<ffffffff811c6027>] shrink_inactive_list+0x2c7/0x680
[<ffffffff811c6ba4>] shrink_node_memcg+0x404/0x830
[<ffffffff811c70a8>] shrink_node+0xd8/0x300
[<ffffffff811c73dd>] do_try_to_free_pages+0x10d/0x330
[<ffffffff811c7865>] try_to_free_mem_cgroup_pages+0xd5/0x1b0
[<ffffffff8122df2d>] try_charge+0x14d/0x720
[<ffffffff812320cc>] memcg_kmem_charge_memcg+0x3c/0xa0
[<ffffffff812321ae>] memcg_kmem_charge+0x7e/0xd0
[<ffffffff811b68a8>] __alloc_pages_nodemask+0x178/0x260
[<ffffffff8120bff5>] alloc_pages_current+0x95/0x140
[<ffffffff81074247>] pte_alloc_one+0x17/0x40
[<ffffffff811e34de>] __pte_alloc+0x1e/0x110
[<ffffffffa06739de>] alloc_set_pte+0x5fe/0xc20
[<ffffffff811e5d93>] do_fault+0x103/0x970
[<ffffffff811e6e5e>] handle_mm_fault+0x61e/0xd10
[<ffffffff8106ea02>] __do_page_fault+0x252/0x4d0
[<ffffffff8106ecb0>] do_page_fault+0x30/0x80
[<ffffffff8171bce8>] page_fault+0x28/0x30
[<ffffffffffffffff>] 0xffffffffffffffff
task2:
[<ffffffff811aadc6>] __lock_page+0x86/0xa0
[<ffffffffa02f1e47>] mpage_prepare_extent_to_map+0x2e7/0x310 [ext4]
[<ffffffffa08a2689>] ext4_writepages+0x479/0xd60
[<ffffffff811bbede>] do_writepages+0x1e/0x30
[<ffffffff812725e5>] __writeback_single_inode+0x45/0x320
[<ffffffff81272de2>] writeback_sb_inodes+0x272/0x600
[<ffffffff81273202>] __writeback_inodes_wb+0x92/0xc0
[<ffffffff81273568>] wb_writeback+0x268/0x300
[<ffffffff81273d24>] wb_workfn+0xb4/0x390
[<ffffffff810a2f19>] process_one_work+0x189/0x420
[<ffffffff810a31fe>] worker_thread+0x4e/0x4b0
[<ffffffff810a9786>] kthread+0xe6/0x100
[<ffffffff8171a9a1>] ret_from_fork+0x41/0x50
[<ffffffffffffffff>] 0xffffffffffffffff
He adds
: task1 is waiting for the PageWriteback bit of the page that task2 has
: collected in mpd->io_submit->io_bio, and tasks2 is waiting for the LOCKED
: bit the page which tasks1 has locked.
More precisely task1 is handling a page fault and it has a page locked
while it charges a new page table to a memcg. That in turn hits a memory
limit reclaim and the memcg reclaim for legacy controller is waiting on
the writeback but that is never going to finish because the writeback
itself is waiting for the page locked in the #PF path. So this is
essentially ABBA deadlock:
lock_page(A)
SetPageWriteback(A)
unlock_page(A)
lock_page(B)
lock_page(B)
pte_alloc_pne
shrink_page_list
wait_on_page_writeback(A)
SetPageWriteback(B)
unlock_page(B)
# flush A, B to clear the writeback
This accumulating of more pages to flush is used by several filesystems to
generate a more optimal IO patterns.
Waiting for the writeback in legacy memcg controller is a workaround for
pre-mature OOM killer invocations because there is no dirty IO throttling
available for the controller. There is no easy way around that
unfortunately. Therefore fix this specific issue by pre-allocating the
page table outside of the page lock. We have that handy infrastructure
for that already so simply reuse the fault-around pattern which already
does this.
There are probably other hidden __GFP_ACCOUNT | GFP_KERNEL allocations
from under a fs page locked but they should be really rare. I am not
aware of a better solution unfortunately.
[akpm(a)linux-foundation.org: fix mm/memory.c:__do_fault()]
[akpm(a)linux-foundation.org: coding-style fixes]
[mhocko(a)kernel.org: enhance comment, per Johannes]
Link: http://lkml.kernel.org/r/20181214084948.GA5624@dhcp22.suse.cz
Link: http://lkml.kernel.org/r/20181213092221.27270-1-mhocko@kernel.org
Fixes: c3b94f44fcb0 ("memcg: further prevent OOM with too many dirty pages")
Signed-off-by: Michal Hocko <mhocko(a)suse.com>
Reported-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Debugged-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Acked-by: Johannes Weiner <hannes(a)cmpxchg.org>
Reviewed-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Cc: Jan Kara <jack(a)suse.cz>
Cc: Dave Chinner <david(a)fromorbit.com>
Cc: Theodore Ts'o <tytso(a)mit.edu>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memory.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--- a/mm/memory.c~mm-memcg-fix-reclaim-deadlock-with-writeback
+++ a/mm/memory.c
@@ -2994,6 +2994,28 @@ static vm_fault_t __do_fault(struct vm_f
struct vm_area_struct *vma = vmf->vma;
vm_fault_t ret;
+ /*
+ * Preallocate pte before we take page_lock because this might lead to
+ * deadlocks for memcg reclaim which waits for pages under writeback:
+ * lock_page(A)
+ * SetPageWriteback(A)
+ * unlock_page(A)
+ * lock_page(B)
+ * lock_page(B)
+ * pte_alloc_pne
+ * shrink_page_list
+ * wait_on_page_writeback(A)
+ * SetPageWriteback(B)
+ * unlock_page(B)
+ * # flush A, B to clear the writeback
+ */
+ if (pmd_none(*vmf->pmd) && !vmf->prealloc_pte) {
+ vmf->prealloc_pte = pte_alloc_one(vmf->vma->vm_mm);
+ if (!vmf->prealloc_pte)
+ return VM_FAULT_OOM;
+ smp_wmb(); /* See comment in __pte_alloc() */
+ }
+
ret = vma->vm_ops->fault(vmf);
if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY |
VM_FAULT_DONE_COW)))
_
Patches currently in -mm which might be from mhocko(a)suse.com are
The patch titled
Subject: mm/usercopy.c: no check page span for stack objects
has been removed from the -mm tree. Its filename was
usercopy-no-check-page-span-for-stack-objects.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Qian Cai <cai(a)lca.pw>
Subject: mm/usercopy.c: no check page span for stack objects
It is easy to trigger this with CONFIG_HARDENED_USERCOPY_PAGESPAN=y,
usercopy: Kernel memory overwrite attempt detected to spans multiple
pages (offset 0, size 23)!
kernel BUG at mm/usercopy.c:102!
For example,
print_worker_info
char name[WQ_NAME_LEN] = { };
char desc[WORKER_DESC_LEN] = { };
probe_kernel_read(name, wq->name, sizeof(name) - 1);
probe_kernel_read(desc, worker->desc, sizeof(desc) - 1);
__copy_from_user_inatomic
check_object_size
check_heap_object
check_page_span
This is because on-stack variables could cross PAGE_SIZE boundary, and
failed this check,
if (likely(((unsigned long)ptr & (unsigned long)PAGE_MASK) ==
((unsigned long)end & (unsigned long)PAGE_MASK)))
ptr = FFFF889007D7EFF8
end = FFFF889007D7F00E
Hence, fix it by checking if it is a stack object first.
[keescook(a)chromium.org: improve comments after reorder]
Link: http://lkml.kernel.org/r/20190103165151.GA32845@beast
Link: http://lkml.kernel.org/r/20181231030254.99441-1-cai@lca.pw
Signed-off-by: Qian Cai <cai(a)lca.pw>
Signed-off-by: Kees Cook <keescook(a)chromium.org>
Acked-by: Kees Cook <keescook(a)chromium.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/usercopy.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/mm/usercopy.c~usercopy-no-check-page-span-for-stack-objects
+++ a/mm/usercopy.c
@@ -247,7 +247,8 @@ static DEFINE_STATIC_KEY_FALSE_RO(bypass
/*
* Validates that the given object is:
* - not bogus address
- * - known-safe heap or stack object
+ * - fully contained by stack (or stack frame, when available)
+ * - fully within SLAB object (or object whitelist area, when available)
* - not in kernel text
*/
void __check_object_size(const void *ptr, unsigned long n, bool to_user)
@@ -262,9 +263,6 @@ void __check_object_size(const void *ptr
/* Check for invalid addresses. */
check_bogus_address((const unsigned long)ptr, n, to_user);
- /* Check for bad heap object. */
- check_heap_object(ptr, n, to_user);
-
/* Check for bad stack object. */
switch (check_stack_object(ptr, n)) {
case NOT_STACK:
@@ -282,6 +280,9 @@ void __check_object_size(const void *ptr
usercopy_abort("process stack", NULL, to_user, 0, n);
}
+ /* Check for bad heap object. */
+ check_heap_object(ptr, n, to_user);
+
/* Check for object in kernel to avoid text exposure. */
check_kernel_text_object((const unsigned long)ptr, n, to_user);
}
_
Patches currently in -mm which might be from cai(a)lca.pw are
mm-page_owner-fix-for-deferred-struct-page-init.patch
page_poison-plays-nicely-with-kasan.patch
signal-allow-the-null-signal-in-rt_sigqueueinfo.patch
The patch titled
Subject: slab: alien caches must not be initialized if the allocation of the alien cache failed
has been removed from the -mm tree. Its filename was
slab-alien-caches-must-not-be-initialized-if-the-allocation-of-the-alien-cache-failed.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Christoph Lameter <cl(a)linux.com>
Subject: slab: alien caches must not be initialized if the allocation of the alien cache failed
Callers of __alloc_alien() check for NULL. We must do the same check in
__alloc_alien_cache to avoid NULL pointer dereferences on allocation
failures.
Link: http://lkml.kernel.org/r/010001680f42f192-82b4e12e-1565-4ee0-ae1f-1e9897490…
Fixes: 49dfc304ba241 ("slab: use the lock on alien_cache, instead of the lock on array_cache")
Fixes: c8522a3a5832b ("Slab: introduce alloc_alien")
Signed-off-by: Christoph Lameter <cl(a)linux.com>
Reported-by: syzbot+d6ed4ec679652b4fd4e4(a)syzkaller.appspotmail.com
Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Pekka Enberg <penberg(a)kernel.org>
Cc: David Rientjes <rientjes(a)google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/slab.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/mm/slab.c~slab-alien-caches-must-not-be-initialized-if-the-allocation-of-the-alien-cache-failed
+++ a/mm/slab.c
@@ -666,8 +666,10 @@ static struct alien_cache *__alloc_alien
struct alien_cache *alc = NULL;
alc = kmalloc_node(memsize, gfp, node);
- init_arraycache(&alc->ac, entries, batch);
- spin_lock_init(&alc->lock);
+ if (alc) {
+ init_arraycache(&alc->ac, entries, batch);
+ spin_lock_init(&alc->lock);
+ }
return alc;
}
_
Patches currently in -mm which might be from cl(a)linux.com are
The patch titled
Subject: fork, memcg: fix cached_stacks case
has been removed from the -mm tree. Its filename was
fork-memcg-fix-cached_stacks-case.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Shakeel Butt <shakeelb(a)google.com>
Subject: fork, memcg: fix cached_stacks case
5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on memcg charge
fail") fixes a crash caused due to failed memcg charge of the kernel
stack. However the fix misses the cached_stacks case which this patch
fixes. So, the same crash can happen if the memcg charge of a cached
stack is failed.
Link: http://lkml.kernel.org/r/20190102180145.57406-1-shakeelb@google.com
Fixes: 5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on memcg charge fail")
Signed-off-by: Shakeel Butt <shakeelb(a)google.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Acked-by: Rik van Riel <riel(a)surriel.com>
Cc: Rik van Riel <riel(a)surriel.com>
Cc: Roman Gushchin <guro(a)fb.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Tejun Heo <tj(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
kernel/fork.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/fork.c~fork-memcg-fix-cached_stacks-case
+++ a/kernel/fork.c
@@ -217,6 +217,7 @@ static unsigned long *alloc_thread_stack
memset(s->addr, 0, THREAD_SIZE);
tsk->stack_vm_area = s;
+ tsk->stack = s->addr;
return s->addr;
}
_
Patches currently in -mm which might be from shakeelb(a)google.com are
memcg-localize-memcg_kmem_enabled-check.patch
memcg-schedule-high-reclaim-for-remote-memcgs-on-high_work.patch
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From e1c3743e1a20647c53b719dbf28b48f45d23f2cd Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao(a)debian.org>
Date: Wed, 21 Nov 2018 17:21:09 -0200
Subject: [PATCH] powerpc/tm: Set MSR[TS] just prior to recheckpoint
On a signal handler return, the user could set a context with MSR[TS] bits
set, and these bits would be copied to task regs->msr.
At restore_tm_sigcontexts(), after current task regs->msr[TS] bits are set,
several __get_user() are called and then a recheckpoint is executed.
This is a problem since a page fault (in kernel space) could happen when
calling __get_user(). If it happens, the process MSR[TS] bits were
already set, but recheckpoint was not executed, and SPRs are still invalid.
The page fault can cause the current process to be de-scheduled, with
MSR[TS] active and without tm_recheckpoint() being called. More
importantly, without TEXASR[FS] bit set also.
Since TEXASR might not have the FS bit set, and when the process is
scheduled back, it will try to reclaim, which will be aborted because of
the CPU is not in the suspended state, and, then, recheckpoint. This
recheckpoint will restore thread->texasr into TEXASR SPR, which might be
zero, hitting a BUG_ON().
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
cpu 0xb: Vector: 700 (Program Check) at [c00000041f1576d0]
pc: c000000000054550: restore_gprs+0xb0/0x180
lr: 0000000000000000
sp: c00000041f157950
msr: 8000000100021033
current = 0xc00000041f143000
paca = 0xc00000000fb86300 softe: 0 irq_happened: 0x01
pid = 1021, comm = kworker/11:1
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
Linux version 4.9.0-3-powerpc64le (debian-kernel(a)lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26)
enter ? for help
[c00000041f157b30] c00000000001bc3c tm_recheckpoint.part.11+0x6c/0xa0
[c00000041f157b70] c00000000001d184 __switch_to+0x1e4/0x4c0
[c00000041f157bd0] c00000000082eeb8 __schedule+0x2f8/0x990
[c00000041f157cb0] c00000000082f598 schedule+0x48/0xc0
[c00000041f157ce0] c0000000000f0d28 worker_thread+0x148/0x610
[c00000041f157d80] c0000000000f96b0 kthread+0x120/0x140
[c00000041f157e30] c00000000000c0e0 ret_from_kernel_thread+0x5c/0x7c
This patch simply delays the MSR[TS] set, so, if there is any page fault in
the __get_user() section, it does not have regs->msr[TS] set, since the TM
structures are still invalid, thus avoiding doing TM operations for
in-kernel exceptions and possible process reschedule.
With this patch, the MSR[TS] will only be set just before recheckpointing
and setting TEXASR[FS] = 1, thus avoiding an interrupt with TM registers in
invalid state.
Other than that, if CONFIG_PREEMPT is set, there might be a preemption just
after setting MSR[TS] and before tm_recheckpoint(), thus, this block must
be atomic from a preemption perspective, thus, calling
preempt_disable/enable() on this code.
It is not possible to move tm_recheckpoint to happen earlier, because it is
required to get the checkpointed registers from userspace, with
__get_user(), thus, the only way to avoid this undesired behavior is
delaying the MSR[TS] set.
The 32-bits signal handler seems to be safe this current issue, but, it
might be exposed to the preemption issue, thus, disabling preemption in
this chunk of code.
Changes from v2:
* Run the critical section with preempt_disable.
Fixes: 87b4e5393af7 ("powerpc/tm: Fix return of active 64bit signals")
Cc: stable(a)vger.kernel.org (v3.9+)
Signed-off-by: Breno Leitao <leitao(a)debian.org>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 9d39e0eb03ff..7484f43493d3 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -848,7 +848,23 @@ static long restore_tm_user_regs(struct pt_regs *regs,
/* If TM bits are set to the reserved value, it's an invalid context */
if (MSR_TM_RESV(msr_hi))
return 1;
- /* Pull in the MSR TM bits from the user context */
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /*
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ *
+ * Pull in the MSR TM bits from the user context
+ */
regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK);
/* Now, recheckpoint. This loads up all of the checkpointed (older)
* registers, including FP and V[S]Rs. After recheckpointing, the
@@ -873,6 +889,8 @@ static long restore_tm_user_regs(struct pt_regs *regs,
}
#endif
+ preempt_enable();
+
return 0;
}
#endif
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index e53ad11be385..ba093ec5a21f 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -467,20 +467,6 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
if (MSR_TM_RESV(msr))
return -EINVAL;
- /* pull in MSR TS bits from user context */
- regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
-
- /*
- * Ensure that TM is enabled in regs->msr before we leave the signal
- * handler. It could be the case that (a) user disabled the TM bit
- * through the manipulation of the MSR bits in uc_mcontext or (b) the
- * TM bit was disabled because a sufficient number of context switches
- * happened whilst in the signal handler and load_tm overflowed,
- * disabling the TM bit. In either case we can end up with an illegal
- * TM state leading to a TM Bad Thing when we return to userspace.
- */
- regs->msr |= MSR_TM;
-
/* pull in MSR LE from user context */
regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE);
@@ -572,6 +558,34 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
tm_enable();
/* Make sure the transaction is marked as failed */
tsk->thread.tm_texasr |= TEXASR_FS;
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /* pull in MSR TS bits from user context */
+ regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
+
+ /*
+ * Ensure that TM is enabled in regs->msr before we leave the signal
+ * handler. It could be the case that (a) user disabled the TM bit
+ * through the manipulation of the MSR bits in uc_mcontext or (b) the
+ * TM bit was disabled because a sufficient number of context switches
+ * happened whilst in the signal handler and load_tm overflowed,
+ * disabling the TM bit. In either case we can end up with an illegal
+ * TM state leading to a TM Bad Thing when we return to userspace.
+ *
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ */
+ regs->msr |= MSR_TM;
+
/* This loads the checkpointed FP/VEC state, if used */
tm_recheckpoint(&tsk->thread);
@@ -585,6 +599,8 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
regs->msr |= MSR_VEC;
}
+ preempt_enable();
+
return err;
}
#endif
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From e1c3743e1a20647c53b719dbf28b48f45d23f2cd Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao(a)debian.org>
Date: Wed, 21 Nov 2018 17:21:09 -0200
Subject: [PATCH] powerpc/tm: Set MSR[TS] just prior to recheckpoint
On a signal handler return, the user could set a context with MSR[TS] bits
set, and these bits would be copied to task regs->msr.
At restore_tm_sigcontexts(), after current task regs->msr[TS] bits are set,
several __get_user() are called and then a recheckpoint is executed.
This is a problem since a page fault (in kernel space) could happen when
calling __get_user(). If it happens, the process MSR[TS] bits were
already set, but recheckpoint was not executed, and SPRs are still invalid.
The page fault can cause the current process to be de-scheduled, with
MSR[TS] active and without tm_recheckpoint() being called. More
importantly, without TEXASR[FS] bit set also.
Since TEXASR might not have the FS bit set, and when the process is
scheduled back, it will try to reclaim, which will be aborted because of
the CPU is not in the suspended state, and, then, recheckpoint. This
recheckpoint will restore thread->texasr into TEXASR SPR, which might be
zero, hitting a BUG_ON().
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
cpu 0xb: Vector: 700 (Program Check) at [c00000041f1576d0]
pc: c000000000054550: restore_gprs+0xb0/0x180
lr: 0000000000000000
sp: c00000041f157950
msr: 8000000100021033
current = 0xc00000041f143000
paca = 0xc00000000fb86300 softe: 0 irq_happened: 0x01
pid = 1021, comm = kworker/11:1
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
Linux version 4.9.0-3-powerpc64le (debian-kernel(a)lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26)
enter ? for help
[c00000041f157b30] c00000000001bc3c tm_recheckpoint.part.11+0x6c/0xa0
[c00000041f157b70] c00000000001d184 __switch_to+0x1e4/0x4c0
[c00000041f157bd0] c00000000082eeb8 __schedule+0x2f8/0x990
[c00000041f157cb0] c00000000082f598 schedule+0x48/0xc0
[c00000041f157ce0] c0000000000f0d28 worker_thread+0x148/0x610
[c00000041f157d80] c0000000000f96b0 kthread+0x120/0x140
[c00000041f157e30] c00000000000c0e0 ret_from_kernel_thread+0x5c/0x7c
This patch simply delays the MSR[TS] set, so, if there is any page fault in
the __get_user() section, it does not have regs->msr[TS] set, since the TM
structures are still invalid, thus avoiding doing TM operations for
in-kernel exceptions and possible process reschedule.
With this patch, the MSR[TS] will only be set just before recheckpointing
and setting TEXASR[FS] = 1, thus avoiding an interrupt with TM registers in
invalid state.
Other than that, if CONFIG_PREEMPT is set, there might be a preemption just
after setting MSR[TS] and before tm_recheckpoint(), thus, this block must
be atomic from a preemption perspective, thus, calling
preempt_disable/enable() on this code.
It is not possible to move tm_recheckpoint to happen earlier, because it is
required to get the checkpointed registers from userspace, with
__get_user(), thus, the only way to avoid this undesired behavior is
delaying the MSR[TS] set.
The 32-bits signal handler seems to be safe this current issue, but, it
might be exposed to the preemption issue, thus, disabling preemption in
this chunk of code.
Changes from v2:
* Run the critical section with preempt_disable.
Fixes: 87b4e5393af7 ("powerpc/tm: Fix return of active 64bit signals")
Cc: stable(a)vger.kernel.org (v3.9+)
Signed-off-by: Breno Leitao <leitao(a)debian.org>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 9d39e0eb03ff..7484f43493d3 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -848,7 +848,23 @@ static long restore_tm_user_regs(struct pt_regs *regs,
/* If TM bits are set to the reserved value, it's an invalid context */
if (MSR_TM_RESV(msr_hi))
return 1;
- /* Pull in the MSR TM bits from the user context */
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /*
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ *
+ * Pull in the MSR TM bits from the user context
+ */
regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK);
/* Now, recheckpoint. This loads up all of the checkpointed (older)
* registers, including FP and V[S]Rs. After recheckpointing, the
@@ -873,6 +889,8 @@ static long restore_tm_user_regs(struct pt_regs *regs,
}
#endif
+ preempt_enable();
+
return 0;
}
#endif
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index e53ad11be385..ba093ec5a21f 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -467,20 +467,6 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
if (MSR_TM_RESV(msr))
return -EINVAL;
- /* pull in MSR TS bits from user context */
- regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
-
- /*
- * Ensure that TM is enabled in regs->msr before we leave the signal
- * handler. It could be the case that (a) user disabled the TM bit
- * through the manipulation of the MSR bits in uc_mcontext or (b) the
- * TM bit was disabled because a sufficient number of context switches
- * happened whilst in the signal handler and load_tm overflowed,
- * disabling the TM bit. In either case we can end up with an illegal
- * TM state leading to a TM Bad Thing when we return to userspace.
- */
- regs->msr |= MSR_TM;
-
/* pull in MSR LE from user context */
regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE);
@@ -572,6 +558,34 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
tm_enable();
/* Make sure the transaction is marked as failed */
tsk->thread.tm_texasr |= TEXASR_FS;
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /* pull in MSR TS bits from user context */
+ regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
+
+ /*
+ * Ensure that TM is enabled in regs->msr before we leave the signal
+ * handler. It could be the case that (a) user disabled the TM bit
+ * through the manipulation of the MSR bits in uc_mcontext or (b) the
+ * TM bit was disabled because a sufficient number of context switches
+ * happened whilst in the signal handler and load_tm overflowed,
+ * disabling the TM bit. In either case we can end up with an illegal
+ * TM state leading to a TM Bad Thing when we return to userspace.
+ *
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ */
+ regs->msr |= MSR_TM;
+
/* This loads the checkpointed FP/VEC state, if used */
tm_recheckpoint(&tsk->thread);
@@ -585,6 +599,8 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
regs->msr |= MSR_VEC;
}
+ preempt_enable();
+
return err;
}
#endif
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From e1c3743e1a20647c53b719dbf28b48f45d23f2cd Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao(a)debian.org>
Date: Wed, 21 Nov 2018 17:21:09 -0200
Subject: [PATCH] powerpc/tm: Set MSR[TS] just prior to recheckpoint
On a signal handler return, the user could set a context with MSR[TS] bits
set, and these bits would be copied to task regs->msr.
At restore_tm_sigcontexts(), after current task regs->msr[TS] bits are set,
several __get_user() are called and then a recheckpoint is executed.
This is a problem since a page fault (in kernel space) could happen when
calling __get_user(). If it happens, the process MSR[TS] bits were
already set, but recheckpoint was not executed, and SPRs are still invalid.
The page fault can cause the current process to be de-scheduled, with
MSR[TS] active and without tm_recheckpoint() being called. More
importantly, without TEXASR[FS] bit set also.
Since TEXASR might not have the FS bit set, and when the process is
scheduled back, it will try to reclaim, which will be aborted because of
the CPU is not in the suspended state, and, then, recheckpoint. This
recheckpoint will restore thread->texasr into TEXASR SPR, which might be
zero, hitting a BUG_ON().
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
cpu 0xb: Vector: 700 (Program Check) at [c00000041f1576d0]
pc: c000000000054550: restore_gprs+0xb0/0x180
lr: 0000000000000000
sp: c00000041f157950
msr: 8000000100021033
current = 0xc00000041f143000
paca = 0xc00000000fb86300 softe: 0 irq_happened: 0x01
pid = 1021, comm = kworker/11:1
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
Linux version 4.9.0-3-powerpc64le (debian-kernel(a)lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26)
enter ? for help
[c00000041f157b30] c00000000001bc3c tm_recheckpoint.part.11+0x6c/0xa0
[c00000041f157b70] c00000000001d184 __switch_to+0x1e4/0x4c0
[c00000041f157bd0] c00000000082eeb8 __schedule+0x2f8/0x990
[c00000041f157cb0] c00000000082f598 schedule+0x48/0xc0
[c00000041f157ce0] c0000000000f0d28 worker_thread+0x148/0x610
[c00000041f157d80] c0000000000f96b0 kthread+0x120/0x140
[c00000041f157e30] c00000000000c0e0 ret_from_kernel_thread+0x5c/0x7c
This patch simply delays the MSR[TS] set, so, if there is any page fault in
the __get_user() section, it does not have regs->msr[TS] set, since the TM
structures are still invalid, thus avoiding doing TM operations for
in-kernel exceptions and possible process reschedule.
With this patch, the MSR[TS] will only be set just before recheckpointing
and setting TEXASR[FS] = 1, thus avoiding an interrupt with TM registers in
invalid state.
Other than that, if CONFIG_PREEMPT is set, there might be a preemption just
after setting MSR[TS] and before tm_recheckpoint(), thus, this block must
be atomic from a preemption perspective, thus, calling
preempt_disable/enable() on this code.
It is not possible to move tm_recheckpoint to happen earlier, because it is
required to get the checkpointed registers from userspace, with
__get_user(), thus, the only way to avoid this undesired behavior is
delaying the MSR[TS] set.
The 32-bits signal handler seems to be safe this current issue, but, it
might be exposed to the preemption issue, thus, disabling preemption in
this chunk of code.
Changes from v2:
* Run the critical section with preempt_disable.
Fixes: 87b4e5393af7 ("powerpc/tm: Fix return of active 64bit signals")
Cc: stable(a)vger.kernel.org (v3.9+)
Signed-off-by: Breno Leitao <leitao(a)debian.org>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 9d39e0eb03ff..7484f43493d3 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -848,7 +848,23 @@ static long restore_tm_user_regs(struct pt_regs *regs,
/* If TM bits are set to the reserved value, it's an invalid context */
if (MSR_TM_RESV(msr_hi))
return 1;
- /* Pull in the MSR TM bits from the user context */
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /*
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ *
+ * Pull in the MSR TM bits from the user context
+ */
regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK);
/* Now, recheckpoint. This loads up all of the checkpointed (older)
* registers, including FP and V[S]Rs. After recheckpointing, the
@@ -873,6 +889,8 @@ static long restore_tm_user_regs(struct pt_regs *regs,
}
#endif
+ preempt_enable();
+
return 0;
}
#endif
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index e53ad11be385..ba093ec5a21f 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -467,20 +467,6 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
if (MSR_TM_RESV(msr))
return -EINVAL;
- /* pull in MSR TS bits from user context */
- regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
-
- /*
- * Ensure that TM is enabled in regs->msr before we leave the signal
- * handler. It could be the case that (a) user disabled the TM bit
- * through the manipulation of the MSR bits in uc_mcontext or (b) the
- * TM bit was disabled because a sufficient number of context switches
- * happened whilst in the signal handler and load_tm overflowed,
- * disabling the TM bit. In either case we can end up with an illegal
- * TM state leading to a TM Bad Thing when we return to userspace.
- */
- regs->msr |= MSR_TM;
-
/* pull in MSR LE from user context */
regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE);
@@ -572,6 +558,34 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
tm_enable();
/* Make sure the transaction is marked as failed */
tsk->thread.tm_texasr |= TEXASR_FS;
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /* pull in MSR TS bits from user context */
+ regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
+
+ /*
+ * Ensure that TM is enabled in regs->msr before we leave the signal
+ * handler. It could be the case that (a) user disabled the TM bit
+ * through the manipulation of the MSR bits in uc_mcontext or (b) the
+ * TM bit was disabled because a sufficient number of context switches
+ * happened whilst in the signal handler and load_tm overflowed,
+ * disabling the TM bit. In either case we can end up with an illegal
+ * TM state leading to a TM Bad Thing when we return to userspace.
+ *
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ */
+ regs->msr |= MSR_TM;
+
/* This loads the checkpointed FP/VEC state, if used */
tm_recheckpoint(&tsk->thread);
@@ -585,6 +599,8 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
regs->msr |= MSR_VEC;
}
+ preempt_enable();
+
return err;
}
#endif
The patch below does not apply to the 4.20-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From e1c3743e1a20647c53b719dbf28b48f45d23f2cd Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao(a)debian.org>
Date: Wed, 21 Nov 2018 17:21:09 -0200
Subject: [PATCH] powerpc/tm: Set MSR[TS] just prior to recheckpoint
On a signal handler return, the user could set a context with MSR[TS] bits
set, and these bits would be copied to task regs->msr.
At restore_tm_sigcontexts(), after current task regs->msr[TS] bits are set,
several __get_user() are called and then a recheckpoint is executed.
This is a problem since a page fault (in kernel space) could happen when
calling __get_user(). If it happens, the process MSR[TS] bits were
already set, but recheckpoint was not executed, and SPRs are still invalid.
The page fault can cause the current process to be de-scheduled, with
MSR[TS] active and without tm_recheckpoint() being called. More
importantly, without TEXASR[FS] bit set also.
Since TEXASR might not have the FS bit set, and when the process is
scheduled back, it will try to reclaim, which will be aborted because of
the CPU is not in the suspended state, and, then, recheckpoint. This
recheckpoint will restore thread->texasr into TEXASR SPR, which might be
zero, hitting a BUG_ON().
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
cpu 0xb: Vector: 700 (Program Check) at [c00000041f1576d0]
pc: c000000000054550: restore_gprs+0xb0/0x180
lr: 0000000000000000
sp: c00000041f157950
msr: 8000000100021033
current = 0xc00000041f143000
paca = 0xc00000000fb86300 softe: 0 irq_happened: 0x01
pid = 1021, comm = kworker/11:1
kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434!
Linux version 4.9.0-3-powerpc64le (debian-kernel(a)lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26)
enter ? for help
[c00000041f157b30] c00000000001bc3c tm_recheckpoint.part.11+0x6c/0xa0
[c00000041f157b70] c00000000001d184 __switch_to+0x1e4/0x4c0
[c00000041f157bd0] c00000000082eeb8 __schedule+0x2f8/0x990
[c00000041f157cb0] c00000000082f598 schedule+0x48/0xc0
[c00000041f157ce0] c0000000000f0d28 worker_thread+0x148/0x610
[c00000041f157d80] c0000000000f96b0 kthread+0x120/0x140
[c00000041f157e30] c00000000000c0e0 ret_from_kernel_thread+0x5c/0x7c
This patch simply delays the MSR[TS] set, so, if there is any page fault in
the __get_user() section, it does not have regs->msr[TS] set, since the TM
structures are still invalid, thus avoiding doing TM operations for
in-kernel exceptions and possible process reschedule.
With this patch, the MSR[TS] will only be set just before recheckpointing
and setting TEXASR[FS] = 1, thus avoiding an interrupt with TM registers in
invalid state.
Other than that, if CONFIG_PREEMPT is set, there might be a preemption just
after setting MSR[TS] and before tm_recheckpoint(), thus, this block must
be atomic from a preemption perspective, thus, calling
preempt_disable/enable() on this code.
It is not possible to move tm_recheckpoint to happen earlier, because it is
required to get the checkpointed registers from userspace, with
__get_user(), thus, the only way to avoid this undesired behavior is
delaying the MSR[TS] set.
The 32-bits signal handler seems to be safe this current issue, but, it
might be exposed to the preemption issue, thus, disabling preemption in
this chunk of code.
Changes from v2:
* Run the critical section with preempt_disable.
Fixes: 87b4e5393af7 ("powerpc/tm: Fix return of active 64bit signals")
Cc: stable(a)vger.kernel.org (v3.9+)
Signed-off-by: Breno Leitao <leitao(a)debian.org>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 9d39e0eb03ff..7484f43493d3 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -848,7 +848,23 @@ static long restore_tm_user_regs(struct pt_regs *regs,
/* If TM bits are set to the reserved value, it's an invalid context */
if (MSR_TM_RESV(msr_hi))
return 1;
- /* Pull in the MSR TM bits from the user context */
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /*
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ *
+ * Pull in the MSR TM bits from the user context
+ */
regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK);
/* Now, recheckpoint. This loads up all of the checkpointed (older)
* registers, including FP and V[S]Rs. After recheckpointing, the
@@ -873,6 +889,8 @@ static long restore_tm_user_regs(struct pt_regs *regs,
}
#endif
+ preempt_enable();
+
return 0;
}
#endif
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index e53ad11be385..ba093ec5a21f 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -467,20 +467,6 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
if (MSR_TM_RESV(msr))
return -EINVAL;
- /* pull in MSR TS bits from user context */
- regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
-
- /*
- * Ensure that TM is enabled in regs->msr before we leave the signal
- * handler. It could be the case that (a) user disabled the TM bit
- * through the manipulation of the MSR bits in uc_mcontext or (b) the
- * TM bit was disabled because a sufficient number of context switches
- * happened whilst in the signal handler and load_tm overflowed,
- * disabling the TM bit. In either case we can end up with an illegal
- * TM state leading to a TM Bad Thing when we return to userspace.
- */
- regs->msr |= MSR_TM;
-
/* pull in MSR LE from user context */
regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE);
@@ -572,6 +558,34 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
tm_enable();
/* Make sure the transaction is marked as failed */
tsk->thread.tm_texasr |= TEXASR_FS;
+
+ /*
+ * Disabling preemption, since it is unsafe to be preempted
+ * with MSR[TS] set without recheckpointing.
+ */
+ preempt_disable();
+
+ /* pull in MSR TS bits from user context */
+ regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
+
+ /*
+ * Ensure that TM is enabled in regs->msr before we leave the signal
+ * handler. It could be the case that (a) user disabled the TM bit
+ * through the manipulation of the MSR bits in uc_mcontext or (b) the
+ * TM bit was disabled because a sufficient number of context switches
+ * happened whilst in the signal handler and load_tm overflowed,
+ * disabling the TM bit. In either case we can end up with an illegal
+ * TM state leading to a TM Bad Thing when we return to userspace.
+ *
+ * CAUTION:
+ * After regs->MSR[TS] being updated, make sure that get_user(),
+ * put_user() or similar functions are *not* called. These
+ * functions can generate page faults which will cause the process
+ * to be de-scheduled with MSR[TS] set but without calling
+ * tm_recheckpoint(). This can cause a bug.
+ */
+ regs->msr |= MSR_TM;
+
/* This loads the checkpointed FP/VEC state, if used */
tm_recheckpoint(&tsk->thread);
@@ -585,6 +599,8 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
regs->msr |= MSR_VEC;
}
+ preempt_enable();
+
return err;
}
#endif
There is an imbalance between when slab_pre_alloc_hook calls
memcg_kmem_get_cache and when slab_post_alloc_hook calls
memcg_kmem_put_cache.
This can cause a memcg kmem cache to be destroyed right as
an object from that cache is being allocated, which is probably
not good. It could lead to things like a memcg allocating new
kmalloc slabs instead of using freed space in old ones, maybe
memory leaks, and maybe oopses as a memcg kmalloc slab is getting
destroyed on one CPU while another CPU is trying to do an allocation
from that same memcg.
The obvious fix would be to use the same condition for calling
memcg_kmem_put_cache that we also use to decide whether to call
memcg_kmem_get_cache.
I am not sure how long this bug has been around, since the last
changeset to touch that code - 452647784b2f ("mm: memcontrol: cleanup
kmem charge functions") - merely moved the bug from one location to
another. I am still tagging that changeset, because the fix should
automatically apply that far back.
Signed-off-by: Rik van Riel <riel(a)surriel.com>
Fixes: 452647784b2f ("mm: memcontrol: cleanup kmem charge functions")
Cc: kernel-team(a)fb.com
Cc: linux-mm(a)kvack.org
Cc: stable(a)vger.kernel.org
Cc: Alexey Dobriyan <adobriyan(a)gmail.com>
Cc: Christoph Lameter <cl(a)linux.com>
Cc: Pekka Enberg <penberg(a)kernel.org>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: David Rientjes <rientjes(a)google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Tejun Heo <tj(a)kernel.org>
---
mm/slab.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mm/slab.h b/mm/slab.h
index 4190c24ef0e9..ab3d95bef8a0 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -444,7 +444,8 @@ static inline void slab_post_alloc_hook(struct kmem_cache *s, gfp_t flags,
p[i] = kasan_slab_alloc(s, object, flags);
}
- if (memcg_kmem_enabled())
+ if (memcg_kmem_enabled() &&
+ ((flags & __GFP_ACCOUNT) || (s->flags & SLAB_ACCOUNT)))
memcg_kmem_put_cache(s);
}
--
2.17.1
Commit fb544d1ca65a89f7a3895f7531221ceeed74ada7 upstream.
We recently addressed a VMID generation race by introducing a read/write
lock around accesses and updates to the vmid generation values.
However, kvm_arch_vcpu_ioctl_run() also calls need_new_vmid_gen() but
does so without taking the read lock.
As far as I can tell, this can lead to the same kind of race:
VM 0, VCPU 0 VM 0, VCPU 1
------------ ------------
update_vttbr (vmid 254)
update_vttbr (vmid 1) // roll over
read_lock(kvm_vmid_lock);
force_vm_exit()
local_irq_disable
need_new_vmid_gen == false //because vmid gen matches
enter_guest (vmid 254)
kvm_arch.vttbr = <PGD>:<VMID 1>
read_unlock(kvm_vmid_lock);
enter_guest (vmid 1)
Which results in running two VCPUs in the same VM with different VMIDs
and (even worse) other VCPUs from other VMs could now allocate clashing
VMID 254 from the new generation as long as VCPU 0 is not exiting.
Attempt to solve this by making sure vttbr is updated before another CPU
can observe the updated VMID generation.
Change-Id: I40aae6e89a3c8a496e13fcd8ae6bb663d16b057c
Cc: stable(a)vger.kernel.org # v4.14
Fixes: f0cf47d939d0 "KVM: arm/arm64: Close VMID generation race"
Reviewed-by: Julien Thierry <julien.thierry(a)arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall(a)arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier(a)arm.com>
---
virt/kvm/arm/arm.c | 23 +++++++++++------------
1 file changed, 11 insertions(+), 12 deletions(-)
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index ed42b8cf6f5b..32aa88c19b8d 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -61,7 +61,7 @@ static DEFINE_PER_CPU(struct kvm_vcpu *, kvm_arm_running_vcpu);
static atomic64_t kvm_vmid_gen = ATOMIC64_INIT(1);
static u32 kvm_next_vmid;
static unsigned int kvm_vmid_bits __read_mostly;
-static DEFINE_RWLOCK(kvm_vmid_lock);
+static DEFINE_SPINLOCK(kvm_vmid_lock);
static bool vgic_present;
@@ -447,7 +447,9 @@ void force_vm_exit(const cpumask_t *mask)
*/
static bool need_new_vmid_gen(struct kvm *kvm)
{
- return unlikely(kvm->arch.vmid_gen != atomic64_read(&kvm_vmid_gen));
+ u64 current_vmid_gen = atomic64_read(&kvm_vmid_gen);
+ smp_rmb(); /* Orders read of kvm_vmid_gen and kvm->arch.vmid */
+ return unlikely(READ_ONCE(kvm->arch.vmid_gen) != current_vmid_gen);
}
/**
@@ -462,16 +464,11 @@ static void update_vttbr(struct kvm *kvm)
{
phys_addr_t pgd_phys;
u64 vmid;
- bool new_gen;
- read_lock(&kvm_vmid_lock);
- new_gen = need_new_vmid_gen(kvm);
- read_unlock(&kvm_vmid_lock);
-
- if (!new_gen)
+ if (!need_new_vmid_gen(kvm))
return;
- write_lock(&kvm_vmid_lock);
+ spin_lock(&kvm_vmid_lock);
/*
* We need to re-check the vmid_gen here to ensure that if another vcpu
@@ -479,7 +476,7 @@ static void update_vttbr(struct kvm *kvm)
* use the same vmid.
*/
if (!need_new_vmid_gen(kvm)) {
- write_unlock(&kvm_vmid_lock);
+ spin_unlock(&kvm_vmid_lock);
return;
}
@@ -502,7 +499,6 @@ static void update_vttbr(struct kvm *kvm)
kvm_call_hyp(__kvm_flush_vm_context);
}
- kvm->arch.vmid_gen = atomic64_read(&kvm_vmid_gen);
kvm->arch.vmid = kvm_next_vmid;
kvm_next_vmid++;
kvm_next_vmid &= (1 << kvm_vmid_bits) - 1;
@@ -513,7 +509,10 @@ static void update_vttbr(struct kvm *kvm)
vmid = ((u64)(kvm->arch.vmid) << VTTBR_VMID_SHIFT) & VTTBR_VMID_MASK(kvm_vmid_bits);
kvm->arch.vttbr = pgd_phys | vmid;
- write_unlock(&kvm_vmid_lock);
+ smp_wmb();
+ WRITE_ONCE(kvm->arch.vmid_gen, atomic64_read(&kvm_vmid_gen));
+
+ spin_unlock(&kvm_vmid_lock);
}
static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
--
2.18.0
This is the start of the stable review cycle for the 4.9.149 release.
There are 71 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Jan 9 10:53:04 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.149-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.149-rc1
Tomas Winkler <tomas.winkler(a)intel.com>
tpm: tpm_i2c_nuvoton: use correct command duration for TPM 2.x
Maciej W. Rozycki <macro(a)linux-mips.org>
rtc: m41t80: Correct alarm month range with RTC reads
Will Deacon <will.deacon(a)arm.com>
arm64: KVM: Avoid setting the upper 32 bits of VTCR_EL2 to 1
Vitaly Kuznetsov <vkuznets(a)redhat.com>
x86/kvm/vmx: do not use vm-exit instruction length for fast MMIO when running nested
Georgy A Bystrenin <gkot(a)altlinux.org>
CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem
Aaro Koskinen <aaro.koskinen(a)iki.fi>
MIPS: OCTEON: mark RGMII interface disabled on OCTEON III
Huacai Chen <chenhc(a)lemote.com>
MIPS: Align kernel load address to 64KB
Huacai Chen <chenhc(a)lemote.com>
MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: v4l2-tpg: array index could become negative
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: vivid: free bitmap_cap when updating std/timings/etc.
Nava kishore Manne <nava.manne(a)xilinx.com>
serial: uartps: Fix interrupt mask issue to handle the RX interrupts properly
Martin Blumenstingl <martin.blumenstingl(a)googlemail.com>
f2fs: fix validation of the block count in sanity_check_raw_super
Breno Leitao <leitao(a)debian.org>
powerpc/tm: Set MSR[TS] just prior to recheckpoint
Josef Bacik <jbacik(a)fb.com>
btrfs: run delayed items before dropping the snapshot
Filipe Manana <fdmanana(a)suse.com>
Btrfs: fix fsync of files with multiple hard links in new directories
Macpaul Lin <macpaul.lin(a)mediatek.com>
cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.
Johan Jonker <jbx9999(a)hotmail.com>
clk: rockchip: fix typo in rk3188 spdif_frac parent
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Avoid finishing transfer prematurely in IRQ mode
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Fix book-keeping of DMA termination
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Fix race on DMA termination
Theodore Ts'o <tytso(a)mit.edu>
ext4: check for shutdown and r/o file system in ext4_write_inode()
Theodore Ts'o <tytso(a)mit.edu>
ext4: force inode writes when nfsd calls commit_metadata()
Theodore Ts'o <tytso(a)mit.edu>
ext4: include terminating u32 in size of xattr entries when expanding inodes
ruippan (潘睿) <ruippan(a)tencent.com>
ext4: fix EXT4_IOC_GROUP_ADD ioctl
Maurizio Lombardi <mlombard(a)redhat.com>
ext4: missing unlock/put_page() in ext4_try_to_write_inline_data()
Pan Bian <bianpan2016(a)163.com>
ext4: fix possible use after free in ext4_quota_enable
Ben Hutchings <ben(a)decadent.org.uk>
perf pmu: Suppress potential format-truncation warning
Miquel Raynal <miquel.raynal(a)bootlin.com>
platform-msi: Free descriptors in platform_msi_domain_free()
Sean Christopherson <sean.j.christopherson(a)intel.com>
KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
Patrick Dreyer <Patrick(a)Dreyer.name>
Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G
Bjørn Mork <bjorn(a)mork.no>
qmi_wwan: apply SET_DTR quirk to the SIMCOM shared device ID
Colin Ian King <colin.king(a)canonical.com>
staging: wilc1000: fix missing read_write setting when reading data
Jia-Ju Bai <baijiaju1990(a)gmail.com>
usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable()
Jörgen Storvist <jorgen.storvist(a)gmail.com>
USB: serial: option: add Fibocom NL678 series
Scott Chen <scott(a)labau.com.tw>
USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
Sameer Pujar <spujar(a)nvidia.com>
ALSA: hda/tegra: clear pending irq handlers
Mantas Mikulėnas <grawity(a)gmail.com>
ALSA: hda: add mute LED support for HP EliteBook 840 G4
Arnd Bergmann <arnd(a)arndb.de>
mtd: atmel-quadspi: disallow building on ebsa110
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: emux: Fix potential Spectre v1 vulnerabilities
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: pcm: Fix potential Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: rme9652: Fix potential Spectre v1 vulnerability
Cong Wang <xiyou.wangcong(a)gmail.com>
ptr_ring: wrap back ->producer in __ptr_ring_swap_queue()
Deepa Dinamani <deepa.kernel(a)gmail.com>
sock: Make sock->sk_stamp thread-safe
Yuval Avnery <yuvalav(a)mellanox.com>
net/mlx5: Typo fix in del_sw_hw_rule
Alaa Hleihel <alaa(a)mellanox.com>
net/mlx5e: Remove the false indication of software timestamping support
Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com>
gro_cell: add napi_disable in gro_cells_destroy
Cong Wang <xiyou.wangcong(a)gmail.com>
tipc: compare remote and local protocols in tipc_udp_enable()
Cong Wang <xiyou.wangcong(a)gmail.com>
tipc: use lock_sock() in tipc_sk_reinit()
Juergen Gross <jgross(a)suse.com>
xen/netfront: tolerate frags with no data
Jorgen Hansen <jhansen(a)vmware.com>
VSOCK: Send reset control packet when socket is partially bound
Jason Wang <jasowang(a)redhat.com>
vhost: make sure used idx is seen before log in vhost_add_used_n()
Cong Wang <xiyou.wangcong(a)gmail.com>
tipc: fix a double kfree_skb()
Xin Long <lucien.xin(a)gmail.com>
sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
Willem de Bruijn <willemb(a)google.com>
packet: validate address length if non-zero
Willem de Bruijn <willemb(a)google.com>
packet: validate address length
Cong Wang <xiyou.wangcong(a)gmail.com>
net/wan: fix a double free in x25_asy_open_tty()
Cong Wang <xiyou.wangcong(a)gmail.com>
netrom: fix locking in nr_find_socket()
Kunihiko Hayashi <hayashi.kunihiko(a)socionext.com>
net: phy: Fix the issue that netif always links up after resuming
Michal Kubecek <mkubecek(a)suse.cz>
net: ipv4: do not handle duplicate fragments as overlapping
Eric Dumazet <edumazet(a)google.com>
isdn: fix kernel-infoleak in capi_unlocked_ioctl
Eric Dumazet <edumazet(a)google.com>
ipv6: tunnels: fix two use-after-free
Cong Wang <xiyou.wangcong(a)gmail.com>
ipv6: explicitly initialize udp6_addr in udp_sock_create6()
Willem de Bruijn <willemb(a)google.com>
ieee802154: lowpan_header_create check must check daddr
Tyrel Datwyler <tyreld(a)linux.vnet.ibm.com>
ibmveth: fix DMA unmap error in ibmveth_xmit_start error path
Cong Wang <xiyou.wangcong(a)gmail.com>
ax25: fix a use-after-free in ax25_fillin_cb()
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
phonet: af_phonet: Fix Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
net: core: Fix Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ipv4: Fix potential Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ip6mr: Fix potential Spectre v1 vulnerability
Guenter Roeck <linux(a)roeck-us.net>
NFC: nxp-nci: Include unaligned.h instead of access_ok.h
-------------
Diffstat:
Makefile | 4 +-
arch/arm64/include/asm/kvm_arm.h | 2 +-
arch/mips/boot/compressed/calc_vmlinuz_load_addr.c | 7 ++-
arch/mips/cavium-octeon/executive/cvmx-helper.c | 3 +-
arch/mips/include/asm/pgtable-64.h | 5 ++
arch/powerpc/kernel/signal_32.c | 20 ++++++-
arch/powerpc/kernel/signal_64.c | 44 +++++++++-----
arch/x86/include/asm/kvm_host.h | 2 +-
arch/x86/kvm/vmx.c | 19 +++++-
arch/x86/kvm/x86.c | 3 +-
drivers/base/platform-msi.c | 6 +-
drivers/char/tpm/tpm_i2c_nuvoton.c | 11 ++--
drivers/clk/rockchip/clk-rk3188.c | 2 +-
drivers/input/mouse/elan_i2c_core.c | 1 +
drivers/isdn/capi/kcapi.c | 4 +-
drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 2 +-
drivers/media/platform/vivid/vivid-vid-cap.c | 2 +
drivers/mtd/spi-nor/Kconfig | 2 +-
drivers/net/ethernet/ibm/ibmveth.c | 6 +-
.../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 11 +---
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 2 +-
drivers/net/phy/phy_device.c | 7 +--
drivers/net/usb/qmi_wwan.c | 2 +-
drivers/net/wan/x25_asy.c | 2 +
drivers/net/xen-netfront.c | 2 +-
drivers/nfc/nxp-nci/firmware.c | 2 +-
drivers/nfc/nxp-nci/i2c.c | 2 +-
drivers/rtc/rtc-m41t80.c | 2 +-
drivers/spi/spi-bcm2835.c | 14 ++---
drivers/staging/wilc1000/wilc_sdio.c | 1 +
drivers/tty/serial/xilinx_uartps.c | 4 +-
drivers/usb/class/cdc-acm.c | 10 ++++
drivers/usb/class/cdc-acm.h | 1 +
drivers/usb/host/r8a66597-hcd.c | 5 +-
drivers/usb/serial/option.c | 4 ++
drivers/usb/serial/pl2303.c | 5 ++
drivers/usb/serial/pl2303.h | 5 ++
drivers/vhost/vhost.c | 2 +
fs/btrfs/btrfs_inode.h | 6 ++
fs/btrfs/extent-tree.c | 4 ++
fs/btrfs/inode.c | 17 ++++++
fs/btrfs/tree-log.c | 16 ++++++
fs/cifs/smb2maperror.c | 4 +-
fs/ext4/inline.c | 5 +-
fs/ext4/inode.c | 9 ++-
fs/ext4/resize.c | 2 +-
fs/ext4/super.c | 13 ++++-
fs/ext4/xattr.c | 2 +-
fs/f2fs/super.c | 6 +-
include/linux/msi.h | 2 +
include/linux/ptr_ring.h | 2 +
include/net/gro_cells.h | 1 +
include/net/sock.h | 36 +++++++++++-
include/trace/events/ext4.h | 20 +++++++
net/ax25/af_ax25.c | 11 +++-
net/ax25/ax25_dev.c | 2 +
net/compat.c | 15 +++--
net/core/filter.c | 2 +
net/core/sock.c | 3 +
net/ieee802154/6lowpan/tx.c | 3 +
net/ipv4/ip_fragment.c | 18 ++++--
net/ipv4/ipmr.c | 3 +
net/ipv6/ip6_tunnel.c | 1 +
net/ipv6/ip6_udp_tunnel.c | 3 +-
net/ipv6/ip6_vti.c | 1 +
net/ipv6/ip6mr.c | 4 ++
net/netrom/af_netrom.c | 15 +++--
net/packet/af_packet.c | 8 ++-
net/phonet/af_phonet.c | 3 +
net/sctp/ipv6.c | 1 +
net/sunrpc/svcsock.c | 2 +-
net/tipc/socket.c | 8 ++-
net/tipc/udp_media.c | 9 ++-
net/vmw_vsock/vmci_transport.c | 67 ++++++++++++++++------
sound/core/pcm.c | 2 +
sound/pci/emu10k1/emufx.c | 5 ++
sound/pci/hda/hda_tegra.c | 2 +
sound/pci/hda/patch_conexant.c | 1 +
sound/pci/rme9652/hdsp.c | 10 ++--
sound/synth/emux/emux_hwdep.c | 7 ++-
tools/perf/util/pmu.c | 8 +--
81 files changed, 451 insertions(+), 136 deletions(-)
Do you have photos for editing? We asked this because we see your photos on
your website.
We mainly supply service for photos cut out , clipping path, and
retouching.
You may just send us a photo, we can provide you test editing to check
quality.
Thanks,
Jane
Do you have photos for editing? We asked this because we see your photos on
your website.
We mainly supply service for photos cut out , clipping path, and
retouching.
You may just send us a photo, we can provide you test editing to check
quality.
Thanks,
Jane
Do you have photos for editing? We asked this because we see your photos on
your website.
We mainly supply service for photos cut out , clipping path, and
retouching.
You may just send us a photo, we can provide you test editing to check
quality.
Thanks,
Jane