This is the start of the stable review cycle for the 4.19.8 release.
There are 41 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Dec 8 14:29:30 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.8-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.8-rc1
Guoqing Jiang <gqjiang(a)suse.com>
tipc: use destination length for copy string
Alexey Brodkin <abrodkin(a)synopsys.com>
arc: [devboards] Add support of NFSv3 ACL
Kevin Hilman <khilman(a)baylibre.com>
ARC: change defconfig defaults to ARCv2
Qu Wenruo <wqu(a)suse.com>
btrfs: tree-checker: Don't check max block group size as current max chunk size limit is unreliable
Adam Wong <adam(a)adamwong.me>
Input: elan_i2c - add support for ELAN0621 touchpad
Noah Westervelt <nwestervelt(a)outlook.com>
Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15ARR
Patrick Gaskin <patrick(a)pgaskin.net>
Input: elan_i2c - add ELAN0620 to the ACPI table
Brian Norris <briannorris(a)chromium.org>
Input: cros_ec_keyb - fix button/switch capability reports
Christian Hoff <christian_hoff(a)gmx.net>
Input: matrix_keypad - check for errors from of_get_named_gpio()
Lyude Paul <lyude(a)redhat.com>
Input: synaptics - add PNP ID for ThinkPad P50 to SMBus
Cameron Gutman <aicommander(a)gmail.com>
Input: xpad - quirk all PDP Xbox One gamepads
Martin Wilck <mwilck(a)suse.com>
scsi: lpfc: fix block guard enablement on SLI3 adapters
Lihong Yang <lihong.yang(a)intel.com>
i40e: Fix deletion of MAC filters
Paul Moore <paul(a)paul-moore.com>
selinux: add support for RTM_NEWCHAIN, RTM_DELCHAIN, and RTM_GETCHAIN
Wei Wang <wawei(a)amazon.de>
svm: Add mutex_lock to protect apic_access_page_done on AMD systems
Laura Abbott <labbott(a)redhat.com>
kgdboc: Fix warning with module build
Laura Abbott <labbott(a)redhat.com>
kgdboc: Fix restrict error
Andrea Arcangeli <aarcange(a)redhat.com>
userfaultfd: shmem: UFFDIO_COPY: set the page dirty if VM_WRITE is not set
Andrea Arcangeli <aarcange(a)redhat.com>
userfaultfd: shmem: add i_size checks
Andrea Arcangeli <aarcange(a)redhat.com>
userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem
Andrea Arcangeli <aarcange(a)redhat.com>
userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails
Lyude Paul <lyude(a)redhat.com>
drm/meson: Fix OOB memory accesses in meson_viu_set_osd_lut()
Lyude Paul <lyude(a)redhat.com>
drm/meson: Enable fast_io in meson_dw_hdmi_regmap_config
Neil Armstrong <narmstrong(a)baylibre.com>
drm/meson: Fixes for drm_crtc_vblank_on/off support
Sergio Correia <sergio(a)correia.cc>
drm: set is_master to 0 upon drm_new_set_master() failure
Lyude Paul <lyude(a)redhat.com>
drm/amd/dm: Understand why attaching path/tile properties are needed
Lyude Paul <lyude(a)redhat.com>
drm/amd/dm: Don't forget to attach MST encoders
Sam Bobroff <sbobroff(a)linux.ibm.com>
drm/ast: Fix incorrect free on ioregs
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracing/fgraph: Fix set_graph_function from showing interrupts
Michael Guralnik <michaelgur(a)mellanox.com>
IB/mlx5: Avoid load failure due to unknown link width
Dmitry V. Levin <ldv(a)altlinux.org>
mips: fix mips_get_syscall_arg o32 check
Mathias Kresin <dev(a)kresin.me>
MIPS: ralink: Fix mt7620 nd_sd pinmux
Zenghui Yu <yuzenghui(a)huawei.com>
tracepoint: Use __idx instead of idx in DO_TRACE macro to make it unique
Pavankumar Kondeti <pkondeti(a)codeaurora.org>
sched, trace: Fix prev_state output in sched_switch tracepoint
Masami Hiramatsu <mhiramat(a)kernel.org>
arm64: ftrace: Fix to enable syscall events on arm64
Frieder Schrempf <frieder.schrempf(a)kontron.de>
mtd: nand: Fix memory allocation in nanddev_bbt_init()
Andrea Parri <andrea.parri(a)amarulasolutions.com>
uprobes: Fix handle_swbp() vs. unregister() + register() race once more
Sagi Grimberg <sagi(a)grimberg.me>
iser: set sector for ambiguous mr status errors
Linus Torvalds <torvalds(a)linux-foundation.org>
unifdef: use memcpy instead of strncpy
Linus Torvalds <torvalds(a)linux-foundation.org>
test_hexdump: use memcpy instead of strncpy
Jens Axboe <axboe(a)kernel.dk>
blk-mq: fix corruption with direct issue
-------------
Diffstat:
Makefile | 4 +-
arch/arc/Kconfig | 2 +-
arch/arc/Makefile | 2 +-
arch/arc/configs/axs101_defconfig | 2 +
arch/arc/configs/axs103_defconfig | 1 +
arch/arc/configs/axs103_smp_defconfig | 1 +
arch/arc/configs/hsdk_defconfig | 1 +
arch/arc/configs/nps_defconfig | 2 +
arch/arc/configs/nsim_700_defconfig | 1 +
arch/arc/configs/nsimosci_defconfig | 2 +
arch/arc/configs/nsimosci_hs_defconfig | 1 +
arch/arc/configs/nsimosci_hs_smp_defconfig | 1 +
arch/arc/configs/tb10x_defconfig | 1 +
arch/arc/configs/vdk_hs38_defconfig | 1 +
arch/arc/configs/vdk_hs38_smp_defconfig | 1 +
arch/arm64/include/asm/ftrace.h | 13 +++++
arch/mips/include/asm/syscall.h | 2 +-
arch/mips/ralink/mt7620.c | 2 +-
arch/x86/kvm/svm.c | 19 +++++---
block/blk-mq.c | 26 +++++++++-
.../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 5 +-
drivers/gpu/drm/ast/ast_main.c | 3 +-
drivers/gpu/drm/drm_auth.c | 2 +
drivers/gpu/drm/meson/meson_crtc.c | 27 +++++++++-
drivers/gpu/drm/meson/meson_dw_hdmi.c | 1 +
drivers/gpu/drm/meson/meson_venc.c | 3 ++
drivers/gpu/drm/meson/meson_viu.c | 12 ++---
drivers/infiniband/hw/mlx5/main.c | 29 +++++------
drivers/infiniband/ulp/iser/iser_verbs.c | 7 ++-
drivers/input/joystick/xpad.c | 16 +++---
drivers/input/keyboard/cros_ec_keyb.c | 3 +-
drivers/input/keyboard/matrix_keypad.c | 23 +++++----
drivers/input/mouse/elan_i2c_core.c | 3 ++
drivers/input/mouse/synaptics.c | 1 +
drivers/mtd/nand/bbt.c | 3 +-
drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +-
drivers/scsi/lpfc/lpfc_init.c | 6 ++-
drivers/scsi/lpfc/lpfc_sli.c | 1 -
drivers/tty/serial/kgdboc.c | 43 ++++++++--------
fs/btrfs/tree-checker.c | 8 ++-
include/linux/tracepoint.h | 6 +--
include/trace/events/sched.h | 12 ++++-
kernel/events/uprobes.c | 12 ++++-
kernel/trace/trace.h | 57 ++++++++++++++++++++--
kernel/trace/trace_functions_graph.c | 4 ++
kernel/trace/trace_irqsoff.c | 2 +
kernel/trace/trace_sched_wakeup.c | 2 +
lib/test_hexdump.c | 2 +-
mm/hugetlb.c | 2 +-
mm/shmem.c | 31 ++++++++++--
mm/userfaultfd.c | 47 +++++++++++++++---
net/tipc/topsrv.c | 2 +-
scripts/unifdef.c | 4 +-
security/selinux/nlmsgtab.c | 13 ++++-
54 files changed, 354 insertions(+), 125 deletions(-)
Commit 07115449919383548d094ff83cc27bd08639a8a1 is on Linux-Next and
this fixes an issue on 4.19.y which fixes an issue where changing for
image size fails.
Can you please apply this patch to 4.19.y?
Thank you
adam
Currently, xattrs values must match the xmatch DFA to match a profile.
This lets users construct profiles to match a file with a specific key
and value with a basic regex.
profile test xattrs(security.apparmor=/usr/bin/*) {}
The xmatch DFA doesn't handle null characters in the xattrs value, since
this is the special character used to indicate that the DFA is transitioning
from matching the profile path to matching the xattr value.
However, both IMA and EVM xattr values hold signatures which potentially
have a null character. It's currently impossible to write a profile that
requires a the presence of an EVM signature without checking the value.
profile test xattrs(security.evm security.apparmor=/usr/bin/*) {}
Add an additional "xattr_keys" array to the profile that only checks the
presence of extended attributes, and not their values.
A modified apparmor_parser that was used to test these changes can be found at:
https://gitlab.com/ericchiang/apparmor/commits/parser-xattrs-keys
To test, build the parser and run the following command:
$ echo '/usr/bin/* xattrs=(user.foo user.bar=bar) {}' | \
./apparmor_parser -r
$ setfattr -n "user.foo" -v "foo" /usr/bin/whoami
$ setfattr -n "user.bar" -v "bar" /usr/bin/whoami
$ whoami # command fails
Signed-off-by: Eric Chiang <ericchiang(a)google.com>
CC: stable(a)vger.kernel.org
---
security/apparmor/domain.c | 22 +++++++++++++++++++---
security/apparmor/include/policy.h | 6 ++++++
security/apparmor/policy.c | 3 +++
security/apparmor/policy_unpack.c | 18 ++++++++++++++++++
4 files changed, 46 insertions(+), 3 deletions(-)
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 08c88de0ffda..53c46e3e01f0 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -319,14 +319,30 @@ static int aa_xattrs_match(const struct linux_binprm *bprm,
char *value = NULL;
int value_size = 0, ret = profile->xattr_count;
- if (!bprm || !profile->xattr_count)
+ if (!bprm)
return 0;
+ d = bprm->file->f_path.dentry;
+
+ if (profile->xattr_keys_count) {
+ /* validate that these attributes are present, ignore values */
+ for (i = 0; i < profile->xattr_keys_count; i++) {
+ size = vfs_getxattr_alloc(d, profile->xattr_keys[i],
+ &value, value_size,
+ GFP_KERNEL);
+ if (size < 0) {
+ ret = -EINVAL;
+ goto out;
+ }
+ }
+ }
+
+ if (!profile->xattr_count)
+ goto out;
+
/* transition from exec match to xattr set */
state = aa_dfa_null_transition(profile->xmatch, state);
- d = bprm->file->f_path.dentry;
-
for (i = 0; i < profile->xattr_count; i++) {
size = vfs_getxattr_alloc(d, profile->xattrs[i], &value,
value_size, GFP_KERNEL);
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index 8e6707c837be..8ed1d30de7ce 100644
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -112,6 +112,10 @@ struct aa_data {
* @policy: general match rules governing policy
* @file: The set of rules governing basic file access and domain transitions
* @caps: capabilities for the profile
+ * @xattr_count: number of xattrs values
+ * @xattrs: extended attributes whose values must match the xmatch
+ * @xattr_keys_count: number of xattr keys values
+ * @xattr_keys: extended attributes that must be present to match the profile
* @rlimits: rlimits for the profile
*
* @dents: dentries for the profiles file entries in apparmorfs
@@ -152,6 +156,8 @@ struct aa_profile {
int xattr_count;
char **xattrs;
+ int xattr_keys_count;
+ char **xattr_keys;
struct aa_rlimit rlimits;
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index df9c5890a878..e0f9cf8b8318 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -231,6 +231,9 @@ void aa_free_profile(struct aa_profile *profile)
for (i = 0; i < profile->xattr_count; i++)
kzfree(profile->xattrs[i]);
kzfree(profile->xattrs);
+ for (i = 0; i < profile->xattr_keys_count; i++)
+ kzfree(profile->xattr_keys[i]);
+ kzfree(profile->xattr_keys);
for (i = 0; i < profile->secmark_count; i++)
kzfree(profile->secmark[i].label);
kzfree(profile->secmark);
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 379682e2a8d5..d1fd75093260 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -535,6 +535,24 @@ static bool unpack_xattrs(struct aa_ext *e, struct aa_profile *profile)
goto fail;
}
+ if (unpack_nameX(e, AA_STRUCT, "xattr_keys")) {
+ int i, size;
+
+ size = unpack_array(e, NULL);
+ profile->xattr_keys_count = size;
+ profile->xattr_keys = kcalloc(size, sizeof(char *), GFP_KERNEL);
+ if (!profile->xattr_keys)
+ goto fail;
+ for (i = 0; i < size; i++) {
+ if (!unpack_strdup(e, &profile->xattr_keys[i], NULL))
+ goto fail;
+ }
+ if (!unpack_nameX(e, AA_ARRAYEND, NULL))
+ goto fail;
+ if (!unpack_nameX(e, AA_STRUCTEND, NULL))
+ goto fail;
+ }
+
return 1;
fail:
--
2.20.0.rc2.403.gdbc3b29805-goog
The patch titled
Subject: hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
has been added to the -mm tree. Its filename is
hwpoison-memory_hotplug-allow-hwpoisoned-pages-to-be-offlined.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/hwpoison-memory_hotplug-allow-hwpo…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/hwpoison-memory_hotplug-allow-hwpo…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Michal Hocko <mhocko(a)suse.com>
Subject: hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
We have received a bug report that an injected MCE about faulty memory
prevents memory offline to succeed on 4.4 base kernel. The underlying
reason was that the HWPoison page has an elevated reference count and the
migration keeps failing. There are two problems with that. First of all
it is dubious to migrate the poisoned page because we know that accessing
that memory is possible to fail. Secondly it doesn't make any sense to
migrate a potentially broken content and preserve the memory corruption
over to a new location.
Oscar has found out that 4.4 and the current upstream kernels behave
slightly differently with his simply testcase
===
int main(void)
{
int ret;
int i;
int fd;
char *array = malloc(4096);
char *array_locked = malloc(4096);
fd = open("/tmp/data", O_RDONLY);
read(fd, array, 4095);
for (i = 0; i < 4096; i++)
array_locked[i] = 'd';
ret = mlock((void *)PAGE_ALIGN((unsigned long)array_locked), sizeof(array_locked));
if (ret)
perror("mlock");
sleep (20);
ret = madvise((void *)PAGE_ALIGN((unsigned long)array_locked), 4096, MADV_HWPOISON);
if (ret)
perror("madvise");
for (i = 0; i < 4096; i++)
array_locked[i] = 'd';
return 0;
}
===
+ offline this memory.
In 4.4 kernels he saw the hwpoisoned page to be returned back to the LRU
list
kernel: [<ffffffff81019ac9>] dump_trace+0x59/0x340
kernel: [<ffffffff81019e9a>] show_stack_log_lvl+0xea/0x170
kernel: [<ffffffff8101ac71>] show_stack+0x21/0x40
kernel: [<ffffffff8132bb90>] dump_stack+0x5c/0x7c
kernel: [<ffffffff810815a1>] warn_slowpath_common+0x81/0xb0
kernel: [<ffffffff811a275c>] __pagevec_lru_add_fn+0x14c/0x160
kernel: [<ffffffff811a2eed>] pagevec_lru_move_fn+0xad/0x100
kernel: [<ffffffff811a334c>] __lru_cache_add+0x6c/0xb0
kernel: [<ffffffff81195236>] add_to_page_cache_lru+0x46/0x70
kernel: [<ffffffffa02b4373>] extent_readpages+0xc3/0x1a0 [btrfs]
kernel: [<ffffffff811a16d7>] __do_page_cache_readahead+0x177/0x200
kernel: [<ffffffff811a18c8>] ondemand_readahead+0x168/0x2a0
kernel: [<ffffffff8119673f>] generic_file_read_iter+0x41f/0x660
kernel: [<ffffffff8120e50d>] __vfs_read+0xcd/0x140
kernel: [<ffffffff8120e9ea>] vfs_read+0x7a/0x120
kernel: [<ffffffff8121404b>] kernel_read+0x3b/0x50
kernel: [<ffffffff81215c80>] do_execveat_common.isra.29+0x490/0x6f0
kernel: [<ffffffff81215f08>] do_execve+0x28/0x30
kernel: [<ffffffff81095ddb>] call_usermodehelper_exec_async+0xfb/0x130
kernel: [<ffffffff8161c045>] ret_from_fork+0x55/0x80
And that latter confuses the hotremove path because an LRU page is
attempted to be migrated and that fails due to an elevated reference
count. It is quite possible that the reuse of the HWPoisoned page is some
kind of fixed race condition but I am not really sure about that.
With the upstream kernel the failure is slightly different. The page
doesn't seem to have LRU bit set but isolate_movable_page simply fails and
do_migrate_range simply puts all the isolated pages back to LRU and
therefore no progress is made and scan_movable_pages finds same set of
pages over and over again.
Fix both cases by explicitly checking HWPoisoned pages before we even try
to get reference on the page, try to unmap it if it is still mapped. As
explained by Naoya:
: Hwpoison code never unmapped those for no big reason because
: Ksm pages never dominate memory, so we simply didn't have strong
: motivation to save the pages.
Also put WARN_ON(PageLRU) in case there is a race and we can hit LRU
HWPoison pages which shouldn't happen but I couldn't convince myself about
that. Naoya has noted the following:
: Theoretically no such gurantee, because try_to_unmap() doesn't have a
: guarantee of success and then memory_failure() returns immediately
: when hwpoison_user_mappings fails.
: Or the following code (comes after hwpoison_user_mappings block) also impli=
: es
: that the target page can still have PageLRU flag.
:
: /*
: * Torn down by someone else?
: */
: if (PageLRU(p) && !PageSwapCache(p) && p->mapping =3D=3D NULL) {
: action_result(pfn, MF_MSG_TRUNCATED_LRU, MF_IGNORED);
: res =3D -EBUSY;
: goto out;
: }
:
: So I think it's OK to keep "if (WARN_ON(PageLRU(page)))" block in
: current version of your patch.
Link: http://lkml.kernel.org/r/20181206120135.14079-1-mhocko@kernel.org
Signed-off-by: Michal Hocko <mhocko(a)suse.com>
Reviewed-by: Oscar Salvador <osalvador(a)suse.com>
Debugged-by: Oscar Salvador <osalvador(a)suse.com>
Tested-by: Oscar Salvador <osalvador(a)suse.com>
Acked-by: David Hildenbrand <david(a)redhat.com>
Acked-by: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memory_hotplug.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/mm/memory_hotplug.c~hwpoison-memory_hotplug-allow-hwpoisoned-pages-to-be-offlined
+++ a/mm/memory_hotplug.c
@@ -34,6 +34,7 @@
#include <linux/hugetlb.h>
#include <linux/memblock.h>
#include <linux/compaction.h>
+#include <linux/rmap.h>
#include <asm/tlbflush.h>
@@ -1343,6 +1344,21 @@ do_migrate_range(unsigned long start_pfn
pfn = page_to_pfn(compound_head(page))
+ hpage_nr_pages(page) - 1;
+ /*
+ * HWPoison pages have elevated reference counts so the migration would
+ * fail on them. It also doesn't make any sense to migrate them in the
+ * first place. Still try to unmap such a page in case it is still mapped
+ * (e.g. current hwpoison implementation doesn't unmap KSM pages but keep
+ * the unmap as the catch all safety net).
+ */
+ if (PageHWPoison(page)) {
+ if (WARN_ON(PageLRU(page)))
+ isolate_lru_page(page);
+ if (page_mapped(page))
+ try_to_unmap(page, TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS);
+ continue;
+ }
+
if (!get_page_unless_zero(page))
continue;
/*
_
Patches currently in -mm which might be from mhocko(a)suse.com are
mm-print-more-information-about-mapping-in-__dump_page.patch
mm-lower-the-printk-loglevel-for-__dump_page-messages.patch
mm-memory_hotplug-drop-pointless-block-alignment-checks-from-__offline_pages.patch
mm-memory_hotplug-print-reason-for-the-offlining-failure.patch
mm-memory_hotplug-be-more-verbose-for-memory-offline-failures.patch
mm-memory_hotplug-be-more-verbose-for-memory-offline-failures-update.patch
mm-memory_hotplug-do-not-clear-numa_node-association-after-hot_remove.patch
hwpoison-memory_hotplug-allow-hwpoisoned-pages-to-be-offlined.patch