- Linux-stable-mirror - lists.linaro.org

[merged] z3fold-fix-use-after-free-when-freeing-handles.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: z3fold: fix use-after-free when freeing handles has been removed from the -mm tree. Its filename was z3fold-fix-use-after-free-when-freeing-handles.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Uladzislau Rezki <uladzislau.rezki(a)sony.com> Subject: z3fold: fix use-after-free when freeing handles free_handle() for a foreign handle may race with inter-page compaction, what can lead to memory corruption. To avoid that, take write lock not read lock in free_handle to be synchronized with __release_z3fold_page(). For example KASAN can detect it: [ 33.723357] ================================================================== [ 33.723401] BUG: KASAN: use-after-free in LZ4_decompress_safe+0x2c4/0x3b8 [ 33.723418] Read of size 1 at addr ffffffc976695ca3 by task GoogleApiHandle/4121 [ 33.723428] [ 33.723449] CPU: 0 PID: 4121 Comm: GoogleApiHandle Tainted: P S OE 4.19.81-perf+ #162 [ 33.723461] Hardware name: Sony Mobile Communications. PDX-203(KONA) (DT) [ 33.723473] Call trace: [ 33.723495] dump_backtrace+0x0/0x288 [ 33.723512] show_stack+0x14/0x20 [ 33.723533] dump_stack+0xe4/0x124 [ 33.723551] print_address_description+0x80/0x2e0 [ 33.723566] kasan_report+0x268/0x2d0 [ 33.723584] __asan_load1+0x4c/0x58 [ 33.723601] LZ4_decompress_safe+0x2c4/0x3b8 [ 33.723619] lz4_decompress_crypto+0x3c/0x70 [ 33.723636] crypto_decompress+0x58/0x70 [ 33.723656] zcomp_decompress+0xd4/0x120 ... Apart from that, initialize zhdr->mapped_count in init_z3fold_page() and remove "newpage" variable because it is not used anywhere. Link: http://lkml.kernel.org/r/20200520082100.28876-1-vitaly.wool@konsulko.com Signed-off-by: Uladzislau Rezki <uladzislau.rezki(a)sony.com> Signed-off-by: Vitaly Wool <vitaly.wool(a)konsulko.com> Cc: Qian Cai <cai(a)lca.pw> Cc: Raymond Jennings <shentino(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/z3fold.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) --- a/mm/z3fold.c~z3fold-fix-use-after-free-when-freeing-handles +++ a/mm/z3fold.c @@ -318,16 +318,16 @@ static inline void free_handle(unsigned slots = handle_to_slots(handle); write_lock(&slots->lock); *(unsigned long *)handle = 0; - write_unlock(&slots->lock); - if (zhdr->slots == slots) + if (zhdr->slots == slots) { + write_unlock(&slots->lock); return; /* simple case, nothing else to do */ + } /* we are freeing a foreign handle if we are here */ zhdr->foreign_handles--; is_free = true; - read_lock(&slots->lock); if (!test_bit(HANDLES_ORPHANED, &slots->pool)) { - read_unlock(&slots->lock); + write_unlock(&slots->lock); return; } for (i = 0; i <= BUDDY_MASK; i++) { @@ -336,7 +336,7 @@ static inline void free_handle(unsigned break; } } - read_unlock(&slots->lock); + write_unlock(&slots->lock); if (is_free) { struct z3fold_pool *pool = slots_to_pool(slots); @@ -422,6 +422,7 @@ static struct z3fold_header *init_z3fold zhdr->start_middle = 0; zhdr->cpu = -1; zhdr->foreign_handles = 0; + zhdr->mapped_count = 0; zhdr->slots = slots; zhdr->pool = pool; INIT_LIST_HEAD(&zhdr->buddy); _ Patches currently in -mm which might be from uladzislau.rezki(a)sony.com are

5 years, 7 months

1
0
0 0

[merged] sparc32-use-pud-rather-than-pgd-to-get-pmd-in-srmmu_nocache_init.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: sparc32: use PUD rather than PGD to get PMD in srmmu_nocache_init() has been removed from the -mm tree. Its filename was sparc32-use-pud-rather-than-pgd-to-get-pmd-in-srmmu_nocache_init.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Mike Rapoport <rppt(a)linux.ibm.com> Subject: sparc32: use PUD rather than PGD to get PMD in srmmu_nocache_init() The kbuild test robot reported the following warning: arch/sparc/mm/srmmu.c: In function 'srmmu_nocache_init': >> arch/sparc/mm/srmmu.c:300:9: error: variable 'pud' set but not used >> [-Werror=unused-but-set-variable] 300 | pud_t *pud; This warning is caused by misprint in the page table traversal in srmmu_nocache_init() function which accessed a PMD entry using PGD rather than PUD. Since sparc32 has only 3 page table levels, the PGD and PUD are essentially the same and usage of __nocache_fix() removed the type checking. Use PUD for the consistency and to silence the compiler warning. Link: http://lkml.kernel.org/r/20200520132005.GM1059226@linux.ibm.com Fixes: 7235db268a2777bc38 ("sparc32: use pgtable-nopud instead of 4level-fixup") Signed-off-by: Mike Rapoport <rppt(a)linux.ibm.com> Reported-by: kbuild test robot <lkp(a)intel.com> Cc: David S. Miller <davem(a)davemloft.net> Cc: Anatoly Pugachev <matorola(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- arch/sparc/mm/srmmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/sparc/mm/srmmu.c~sparc32-use-pud-rather-than-pgd-to-get-pmd-in-srmmu_nocache_init +++ a/arch/sparc/mm/srmmu.c @@ -333,7 +333,7 @@ static void __init srmmu_nocache_init(vo pgd = pgd_offset_k(vaddr); p4d = p4d_offset(__nocache_fix(pgd), vaddr); pud = pud_offset(__nocache_fix(p4d), vaddr); - pmd = pmd_offset(__nocache_fix(pgd), vaddr); + pmd = pmd_offset(__nocache_fix(pud), vaddr); pte = pte_offset_kernel(__nocache_fix(pmd), vaddr); pteval = ((paddr >> 4) | SRMMU_ET_PTE | SRMMU_PRIV); _ Patches currently in -mm which might be from rppt(a)linux.ibm.com are mm-memblock-replace-dereferences-of-memblock_regionnid-with-api-calls.patch mm-make-early_pfn_to_nid-and-related-defintions-close-to-each-other.patch mm-remove-config_have_memblock_node_map-option.patch mm-free_area_init-use-maximal-zone-pfns-rather-than-zone-sizes.patch mm-use-free_area_init-instead-of-free_area_init_nodes.patch alpha-simplify-detection-of-memory-zone-boundaries.patch arm-simplify-detection-of-memory-zone-boundaries.patch arm64-simplify-detection-of-memory-zone-boundaries-for-uma-configs.patch csky-simplify-detection-of-memory-zone-boundaries.patch m68k-mm-simplify-detection-of-memory-zone-boundaries.patch parisc-simplify-detection-of-memory-zone-boundaries.patch sparc32-simplify-detection-of-memory-zone-boundaries.patch unicore32-simplify-detection-of-memory-zone-boundaries.patch xtensa-simplify-detection-of-memory-zone-boundaries.patch mm-remove-early_pfn_in_nid-and-config_nodes_span_other_nodes.patch mm-free_area_init-allow-defining-max_zone_pfn-in-descending-order.patch mm-free_area_init-allow-defining-max_zone_pfn-in-descending-order-fix-2.patch mm-rename-free_area_init_node-to-free_area_init_memoryless_node.patch mm-clean-up-free_area_init_node-and-its-helpers.patch mm-simplify-find_min_pfn_with_active_regions.patch docs-vm-update-memory-models-documentation.patch h8300-remove-usage-of-__arch_use_5level_hack.patch arm-add-support-for-folded-p4d-page-tables.patch arm-add-support-for-folded-p4d-page-tables-fix.patch arm64-add-support-for-folded-p4d-page-tables.patch hexagon-remove-__arch_use_5level_hack.patch ia64-add-support-for-folded-p4d-page-tables.patch nios2-add-support-for-folded-p4d-page-tables.patch openrisc-add-support-for-folded-p4d-page-tables.patch powerpc-add-support-for-folded-p4d-page-tables.patch powerpc-add-support-for-folded-p4d-page-tables-fix.patch powerpc-add-support-for-folded-p4d-page-tables-fix-2.patch sh-drop-__pxd_offset-macros-that-duplicate-pxd_index-ones.patch sh-add-support-for-folded-p4d-page-tables.patch unicore32-remove-__arch_use_5level_hack.patch asm-generic-remove-pgtable-nop4d-hackh.patch mm-remove-__arch_has_5level_hack-and-include-asm-generic-5level-fixuph.patch mm-dont-include-asm-pgtableh-if-linux-mmh-is-already-included.patch mm-introduce-include-linux-pgtableh.patch mm-reorder-includes-after-introduction-of-linux-pgtableh.patch csky-replace-definitions-of-__pxd_offset-with-pxd_index.patch m68k-mm-motorola-move-comment-about-page-table-allocation-funcitons.patch m68k-mm-move-cachenocahe_page-definitions-close-to-their-user.patch x86-mm-simplify-init_trampoline-and-surrounding-logic.patch mm-pgtable-add-shortcuts-for-accessing-kernel-pmd-and-pte.patch mm-pgtable-add-shortcuts-for-accessing-kernel-pmd-and-pte-fix.patch mm-pgtable-add-shortcuts-for-accessing-kernel-pmd-and-pte-fix-2.patch mm-consolidate-pte_index-and-pte_offset_-definitions.patch mm-consolidate-pmd_index-and-pmd_offset-definitions.patch mm-consolidate-pud_index-and-pud_offset-definitions.patch mm-consolidate-pgd_index-and-pgd_offset_k-definitions.patch

5 years, 7 months

1
0
0 0

[merged] sh-include-linux-time_typesh-for-sockios.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: sh: include linux/time_types.h for sockios has been removed from the -mm tree. Its filename was sh-include-linux-time_typesh-for-sockios.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Arnd Bergmann <arnd(a)arndb.de> Subject: sh: include linux/time_types.h for sockios Using the socket ioctls on arch/sh (and only there) causes build time problems when __kernel_old_timeval/__kernel_old_timespec are not already visible to the compiler. Add an explict include line for the header that defines these structures. Link: http://lkml.kernel.org/r/20200519131327.1836482-1-arnd@arndb.de Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Reported-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Tested-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Fixes: 8c709f9a0693 ("y2038: sh: remove timeval/timespec usage from headers") Fixes: 0768e17073dc ("net: socket: implement 64-bit timestamps") Cc: Yoshinori Sato <ysato(a)users.sourceforge.jp> Cc: Rich Felker <dalias(a)libc.org> Cc: "David S. Miller" <davem(a)davemloft.net> Cc: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- arch/sh/include/uapi/asm/sockios.h | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/sh/include/uapi/asm/sockios.h~sh-include-linux-time_typesh-for-sockios +++ a/arch/sh/include/uapi/asm/sockios.h @@ -2,6 +2,8 @@ #ifndef __ASM_SH_SOCKIOS_H #define __ASM_SH_SOCKIOS_H +#include <linux/time_types.h> + /* Socket-level I/O control calls. */ #define FIOGETOWN _IOR('f', 123, int) #define FIOSETOWN _IOW('f', 124, int) _ Patches currently in -mm which might be from arnd(a)arndb.de are drm-remove-drm-specific-kmap_atomic-code-fix.patch bitops-avoid-clang-shift-count-overflow-warnings.patch ubsan-fix-gcc-10-warnings.patch arm64-add-support-for-folded-p4d-page-tables-fix.patch

5 years, 7 months

1
0
0 0

[merged] kasan-disable-branch-tracing-for-core-runtime.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: kasan: disable branch tracing for core runtime has been removed from the -mm tree. Its filename was kasan-disable-branch-tracing-for-core-runtime.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Marco Elver <elver(a)google.com> Subject: kasan: disable branch tracing for core runtime During early boot, while KASAN is not yet initialized, it is possible to enter reporting code-path and end up in kasan_report(). While uninitialized, the branch there prevents generating any reports, however, under certain circumstances when branches are being traced (TRACE_BRANCH_PROFILING), we may recurse deep enough to cause kernel reboots without warning. To prevent similar issues in future, we should disable branch tracing for the core runtime. [elver(a)google.com: remove duplicate DISABLE_BRANCH_PROFILING, per Qian Cai] Link: https://lore.kernel.org/lkml/20200517011732.GE24705@shao2-debian/ Link: http://lkml.kernel.org/r/20200522075207.157349-1-elver@google.com Link: http://lkml.kernel.org/r//20200517011732.GE24705@shao2-debian/ Link: http://lkml.kernel.org/r/20200519182459.87166-1-elver@google.com Signed-off-by: Marco Elver <elver(a)google.com> Reported-by: kernel test robot <rong.a.chen(a)intel.com> Reviewed-by: Andrey Konovalov <andreyknvl(a)google.com> Cc: Dmitry Vyukov <dvyukov(a)google.com> Cc: Alexander Potapenko <glider(a)google.com> Cc: Andrey Ryabinin <aryabinin(a)virtuozzo.com> Cc: Qian Cai <cai(a)lca.pw> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/kasan/Makefile | 16 ++++++++-------- mm/kasan/generic.c | 1 - mm/kasan/tags.c | 1 - 3 files changed, 8 insertions(+), 10 deletions(-) --- a/mm/kasan/generic.c~kasan-disable-branch-tracing-for-core-runtime +++ a/mm/kasan/generic.c @@ -15,7 +15,6 @@ */ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt -#define DISABLE_BRANCH_PROFILING #include <linux/export.h> #include <linux/interrupt.h> --- a/mm/kasan/Makefile~kasan-disable-branch-tracing-for-core-runtime +++ a/mm/kasan/Makefile @@ -15,14 +15,14 @@ CFLAGS_REMOVE_tags_report.o = $(CC_FLAGS # Function splitter causes unnecessary splits in __asan_load1/__asan_store1 # see: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63533 -CFLAGS_common.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -CFLAGS_generic.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -CFLAGS_generic_report.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -CFLAGS_init.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -CFLAGS_quarantine.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -CFLAGS_report.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -CFLAGS_tags.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -CFLAGS_tags_report.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) +CFLAGS_common.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -DDISABLE_BRANCH_PROFILING +CFLAGS_generic.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -DDISABLE_BRANCH_PROFILING +CFLAGS_generic_report.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -DDISABLE_BRANCH_PROFILING +CFLAGS_init.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -DDISABLE_BRANCH_PROFILING +CFLAGS_quarantine.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -DDISABLE_BRANCH_PROFILING +CFLAGS_report.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -DDISABLE_BRANCH_PROFILING +CFLAGS_tags.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -DDISABLE_BRANCH_PROFILING +CFLAGS_tags_report.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -DDISABLE_BRANCH_PROFILING obj-$(CONFIG_KASAN) := common.o init.o report.o obj-$(CONFIG_KASAN_GENERIC) += generic.o generic_report.o quarantine.o --- a/mm/kasan/tags.c~kasan-disable-branch-tracing-for-core-runtime +++ a/mm/kasan/tags.c @@ -12,7 +12,6 @@ */ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt -#define DISABLE_BRANCH_PROFILING #include <linux/export.h> #include <linux/interrupt.h> _ Patches currently in -mm which might be from elver(a)google.com are

5 years, 7 months

1
0
0 0

[merged] rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: rapidio: fix an error in get_user_pages_fast() error handling has been removed from the -mm tree. Its filename was rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: John Hubbard <jhubbard(a)nvidia.com> Subject: rapidio: fix an error in get_user_pages_fast() error handling In the case of get_user_pages_fast() returning fewer pages than requested, rio_dma_transfer() does not quite do the right thing. It attempts to release all the pages that were requested, rather than just the pages that were pinned. Fix the error handling so that only the pages that were successfully pinned are released. Link: http://lkml.kernel.org/r/20200517235620.205225-2-jhubbard@nvidia.com Fixes: e8de370188d0 ("rapidio: add mport char device driver") Signed-off-by: John Hubbard <jhubbard(a)nvidia.com> Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org> Cc: Matt Porter <mporter(a)kernel.crashing.org> Cc: Alexandre Bounine <alex.bou9(a)gmail.com> Cc: Sumit Semwal <sumit.semwal(a)linaro.org> Cc: Dan Carpenter <dan.carpenter(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- drivers/rapidio/devices/rio_mport_cdev.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/rapidio/devices/rio_mport_cdev.c~rapidio-fix-an-error-in-get_user_pages_fast-error-handling +++ a/drivers/rapidio/devices/rio_mport_cdev.c @@ -877,6 +877,11 @@ rio_dma_transfer(struct file *filp, u32 rmcd_error("pinned %ld out of %ld pages", pinned, nr_pages); ret = -EFAULT; + /* + * Set nr_pages up to mean "how many pages to unpin, in + * the error handler: + */ + nr_pages = pinned; goto err_pg; } _ Patches currently in -mm which might be from jhubbard(a)nvidia.com are mm-gup-introduce-pin_user_pages_unlocked.patch ivtv-convert-get_user_pages-pin_user_pages.patch mm-gup-move-__get_user_pages_fast-down-a-few-lines-in-gupc.patch mm-gup-refactor-and-de-duplicate-gup_fast-code.patch mm-gup-refactor-and-de-duplicate-gup_fast-code-fix.patch mm-gup-introduce-pin_user_pages_fast_only.patch drm-i915-convert-get_user_pages-pin_user_pages.patch mm-gup-might_lock_readmmap_sem-in-get_user_pages_fast.patch khugepaged-add-self-test-fix-3.patch rapidio-convert-get_user_pages-pin_user_pages.patch

5 years, 7 months

1
0
0 0

[merged] device-dax-dont-leak-kernel-memory-to-user-space-after-unloading-kmem.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: device-dax: don't leak kernel memory to user space after unloading kmem has been removed from the -mm tree. Its filename was device-dax-dont-leak-kernel-memory-to-user-space-after-unloading-kmem.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: David Hildenbrand <david(a)redhat.com> Subject: device-dax: don't leak kernel memory to user space after unloading kmem Assume we have kmem configured and loaded: [root@localhost ~]# cat /proc/iomem ... 140000000-33fffffff : Persistent Memory$ 140000000-1481fffff : namespace0.0 150000000-33fffffff : dax0.0 150000000-33fffffff : System RAM Assume we try to unload kmem. This force-unloading will work, even if memory cannot get removed from the system. [root@localhost ~]# rmmod kmem [ 86.380228] removing memory fails, because memory [0x0000000150000000-0x0000000157ffffff] is onlined ... [ 86.431225] kmem dax0.0: DAX region [mem 0x150000000-0x33fffffff] cannot be hotremoved until the next reboot Now, we can reconfigure the namespace: [root@localhost ~]# ndctl create-namespace --force --reconfig=namespace0.0 --mode=devdax [ 131.409351] nd_pmem namespace0.0: could not reserve region [mem 0x140000000-0x33fffffff]dax [ 131.410147] nd_pmem: probe of namespace0.0 failed with error -16namespace0.0 --mode=devdax ... This fails as expected due to the busy memory resource, and the memory cannot be used. However, the dax0.0 device is removed, and along its name. The name of the memory resource now points at freed memory (name of the device). [root@localhost ~]# cat /proc/iomem ... 140000000-33fffffff : Persistent Memory 140000000-1481fffff : namespace0.0 150000000-33fffffff : �_�^7_��/_��wR��WQ��^�� ... 150000000-33fffffff : System RAM We have to make sure to duplicate the string. While at it, remove the superfluous setting of the name and fixup a stale comment. Link: http://lkml.kernel.org/r/20200508084217.9160-2-david@redhat.com Fixes: 9f960da72b25 ("device-dax: "Hotremove" persistent memory that is used like normal RAM") Signed-off-by: David Hildenbrand <david(a)redhat.com> Cc: Dan Williams <dan.j.williams(a)intel.com> Cc: Vishal Verma <vishal.l.verma(a)intel.com> Cc: Dave Jiang <dave.jiang(a)intel.com> Cc: Pavel Tatashin <pasha.tatashin(a)soleen.com> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: <stable(a)vger.kernel.org> [5.3] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- drivers/dax/kmem.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) --- a/drivers/dax/kmem.c~device-dax-dont-leak-kernel-memory-to-user-space-after-unloading-kmem +++ a/drivers/dax/kmem.c @@ -22,6 +22,7 @@ int dev_dax_kmem_probe(struct device *de resource_size_t kmem_size; resource_size_t kmem_end; struct resource *new_res; + const char *new_res_name; int numa_node; int rc; @@ -48,11 +49,16 @@ int dev_dax_kmem_probe(struct device *de kmem_size &= ~(memory_block_size_bytes() - 1); kmem_end = kmem_start + kmem_size; - /* Region is permanently reserved. Hot-remove not yet implemented. */ - new_res = request_mem_region(kmem_start, kmem_size, dev_name(dev)); + new_res_name = kstrdup(dev_name(dev), GFP_KERNEL); + if (!new_res_name) + return -ENOMEM; + + /* Region is permanently reserved if hotremove fails. */ + new_res = request_mem_region(kmem_start, kmem_size, new_res_name); if (!new_res) { dev_warn(dev, "could not reserve region [%pa-%pa]\n", &kmem_start, &kmem_end); + kfree(new_res_name); return -EBUSY; } @@ -63,12 +69,12 @@ int dev_dax_kmem_probe(struct device *de * unknown to us that will break add_memory() below. */ new_res->flags = IORESOURCE_SYSTEM_RAM; - new_res->name = dev_name(dev); rc = add_memory(numa_node, new_res->start, resource_size(new_res)); if (rc) { release_resource(new_res); kfree(new_res); + kfree(new_res_name); return rc; } dev_dax->dax_kmem_res = new_res; @@ -83,6 +89,7 @@ static int dev_dax_kmem_remove(struct de struct resource *res = dev_dax->dax_kmem_res; resource_size_t kmem_start = res->start; resource_size_t kmem_size = resource_size(res); + const char *res_name = res->name; int rc; /* @@ -102,6 +109,7 @@ static int dev_dax_kmem_remove(struct de /* Release and free dax resources */ release_resource(res); kfree(res); + kfree(res_name); dev_dax->dax_kmem_res = NULL; return 0; _ Patches currently in -mm which might be from david(a)redhat.com are drivers-base-memoryc-cache-memory-blocks-in-xarray-to-accelerate-lookup-fix.patch powerpc-pseries-hotplug-memory-stop-checking-is_mem_section_removable.patch mm-memory_hotplug-remove-is_mem_section_removable.patch mm-memory_hotplug-set-node_start_pfn-of-hotadded-pgdat-to-0.patch mm-memory_hotplug-handle-memblocks-only-with-config_arch_keep_memblock.patch mm-memory_hotplug-introduce-add_memory_driver_managed.patch kexec_file-dont-place-kexec-images-on-ioresource_mem_driver_managed.patch device-dax-add-memory-via-add_memory_driver_managed.patch

5 years, 7 months

1
0
0 0

[PATCH v4 1/2] mtd: rawnand: brcmnand: fix hamming oob layout

by Álvaro Fernández Rojas

First 2 bytes are used in large-page nand. Fixes: ef5eeea6e911 ("mtd: nand: brcm: switch to mtd_ooblayout_ops") Cc: stable(a)vger.kernel.org Signed-off-by: Álvaro Fernández Rojas <noltari(a)gmail.com> --- v4: no changes v3: invert patch order v2: extend original comment drivers/mtd/nand/raw/brcmnand/brcmnand.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c index e4e3ceeac38f..1c1070111ebc 100644 --- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c +++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c @@ -1116,11 +1116,14 @@ static int brcmnand_hamming_ooblayout_free(struct mtd_info *mtd, int section, if (!section) { /* * Small-page NAND use byte 6 for BBI while large-page - * NAND use byte 0. + * NAND use bytes 0 and 1. */ - if (cfg->page_size > 512) - oobregion->offset++; - oobregion->length--; + if (cfg->page_size > 512) { + oobregion->offset += 2; + oobregion->length -= 2; + } else { + oobregion->length--; + } } } -- 2.26.2

5 years, 7 months

3
2
0 0

[PATCH] mtd: rawnand: Fix nand_gpio_waitrdy()

by Boris Brezillon

Mimic what's done in nand_soft_waitrdy() and add one to the jiffies timeout so we don't end up waiting less than actually required. Reported-by: Tudor Ambarus <tudor.ambarus(a)microchip.com> Fixes: b0e137ad24b6c ("mtd: rawnand: Provide helper for polling GPIO R/B pin") Cc: <stable(a)vger.kernel.org> Signed-off-by: Boris Brezillon <boris.brezillon(a)collabora.com> Reviewed-by: Tudor Ambarus <tudor.ambarus(a)microchip.com> --- drivers/mtd/nand/raw/nand_base.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c index 2d2a216af120..169150a7c140 100644 --- a/drivers/mtd/nand/raw/nand_base.c +++ b/drivers/mtd/nand/raw/nand_base.c @@ -790,8 +790,14 @@ EXPORT_SYMBOL_GPL(nand_soft_waitrdy); int nand_gpio_waitrdy(struct nand_chip *chip, struct gpio_desc *gpiod, unsigned long timeout_ms) { - /* Wait until R/B pin indicates chip is ready or timeout occurs */ - timeout_ms = jiffies + msecs_to_jiffies(timeout_ms); + + /* + * Wait until R/B pin indicates chip is ready or timeout occurs. + * +1 below is necessary because if we are now in the last fraction + * of jiffy and msecs_to_jiffies is 1 then we will wait only that + * small jiffy fraction - possibly leading to false timeout. + */ + timeout_ms = jiffies + msecs_to_jiffies(timeout_ms) + 1; do { if (gpiod_get_value_cansleep(gpiod)) return 0; -- 2.25.4

5 years, 7 months

2
1
0 0

[PATCH v2 12/62] mtd: rawnand: diskonchip: Fix the probe error path

by Miquel Raynal

Not sure nand_cleanup() is the right function to call here but in any case it is not nand_release(). Indeed, even a comment says that calling nand_release() is a bit of a hack as there is no MTD device to unregister. So switch to nand_cleanup() for now and drop this comment. There is no Fixes tag applying here as the use of nand_release() in this driver predates by far the introduction of nand_cleanup() in commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources") which makes this change possible. However, pointing this commit as the culprit for backporting purposes makes sense even if it did not intruce any bug. Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources") Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Cc: stable(a)vger.kernel.org --- drivers/mtd/nand/raw/diskonchip.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/drivers/mtd/nand/raw/diskonchip.c b/drivers/mtd/nand/raw/diskonchip.c index 97f0b05b47c1..f8ccee797645 100644 --- a/drivers/mtd/nand/raw/diskonchip.c +++ b/drivers/mtd/nand/raw/diskonchip.c @@ -1482,13 +1482,10 @@ static int __init doc_probe(unsigned long physadr) numchips = doc2001_init(mtd); if ((ret = nand_scan(nand, numchips)) || (ret = doc->late_init(mtd))) { - /* DBB note: i believe nand_release is necessary here, as + /* DBB note: i believe nand_cleanup is necessary here, as buffers may have been allocated in nand_base. Check with Thomas. FIX ME! */ - /* nand_release will call mtd_device_unregister, but we - haven't yet added it. This is handled without incident by - mtd_device_unregister, as far as I can tell. */ - nand_release(nand); + nand_cleanup(nand); goto fail; } -- 2.20.1

5 years, 7 months

2
2
0 0

[PATCH v2 21/62] mtd: rawnand: ingenic: Fix the probe error path

by Miquel Raynal

nand_release() is supposed be called after MTD device registration. Here, only nand_scan() happened, so use nand_cleanup() instead. There is no real Fixes tag applying here as the use of nand_release() in this driver predates the introduction of nand_cleanup() in commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources") which makes this change possible. Hence, pointing it as the commit to fix for backporting purposes, even if this commit is not introducing any bug makes sense. Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources") Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Cc: stable(a)vger.kernel.org Cc: Paul Cercueil <paul(a)crapouillou.net> Cc: Harvey Hunt <harveyhuntnexus(a)gmail.com> --- drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c b/drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c index e7bd845fdbf5..3bfb6fa8bad9 100644 --- a/drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c +++ b/drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c @@ -376,7 +376,7 @@ static int ingenic_nand_init_chip(struct platform_device *pdev, ret = mtd_device_register(mtd, NULL, 0); if (ret) { - nand_release(chip); + nand_cleanup(chip); return ret; } -- 2.20.1

5 years, 7 months

2
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror