The original problem was described here:
https://lkml.org/lkml/2020/4/27/1121
There is a possible race when ep_scan_ready_list() leaves ->rdllist
and ->obflist empty for a short period of time although some events
are pending. It is quite likely that ep_events_available() observes
empty lists and goes to sleep. Since 339ddb53d373 ("fs/epoll: remove
unnecessary wakeups of nested epoll") we are conservative in wakeups
(there is only one place for wakeup and this is ep_poll_callback()),
thus ep_events_available() must always observe correct state of
two lists. The easiest and correct way is to do the final check
under the lock. This does not impact the performance, since lock
is taken anyway for adding a wait entry to the wait queue.
In this patch barrierless __set_current_state() is used. This is
safe since waitqueue_active() is called under the same lock on wakeup
side.
Short-circuit for fatal signals (i.e. fatal_signal_pending() check)
is moved to the line just before actual events harvesting routine.
This is fully compliant to what is said in the comment of the patch
where the actual fatal_signal_pending() check was added:
c257a340ede0 ("fs, epoll: short circuit fetching events if thread
has been killed").
Signed-off-by: Roman Penyaev <rpenyaev(a)suse.de>
Reported-by: Jason Baron <jbaron(a)akamai.com>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Khazhismel Kumykov <khazhy(a)google.com>
Cc: Alexander Viro <viro(a)zeniv.linux.org.uk>
Cc: linux-fsdevel(a)vger.kernel.org
Cc: linux-kernel(a)vger.kernel.org
Cc: stable(a)vger.kernel.org
---
fs/eventpoll.c | 48 ++++++++++++++++++++++++++++--------------------
1 file changed, 28 insertions(+), 20 deletions(-)
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index aba03ee749f8..8453e5403283 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1879,34 +1879,33 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
* event delivery.
*/
init_wait(&wait);
- write_lock_irq(&ep->lock);
- __add_wait_queue_exclusive(&ep->wq, &wait);
- write_unlock_irq(&ep->lock);
+ write_lock_irq(&ep->lock);
/*
- * We don't want to sleep if the ep_poll_callback() sends us
- * a wakeup in between. That's why we set the task state
- * to TASK_INTERRUPTIBLE before doing the checks.
+ * Barrierless variant, waitqueue_active() is called under
+ * the same lock on wakeup ep_poll_callback() side, so it
+ * is safe to avoid an explicit barrier.
*/
- set_current_state(TASK_INTERRUPTIBLE);
+ __set_current_state(TASK_INTERRUPTIBLE);
+
/*
- * Always short-circuit for fatal signals to allow
- * threads to make a timely exit without the chance of
- * finding more events available and fetching
- * repeatedly.
+ * Do the final check under the lock. ep_scan_ready_list()
+ * plays with two lists (->rdllist and ->ovflist) and there
+ * is always a race when both lists are empty for short
+ * period of time although events are pending, so lock is
+ * important.
*/
- if (fatal_signal_pending(current)) {
- res = -EINTR;
- break;
+ eavail = ep_events_available(ep);
+ if (!eavail) {
+ if (signal_pending(current))
+ res = -EINTR;
+ else
+ __add_wait_queue_exclusive(&ep->wq, &wait);
}
+ write_unlock_irq(&ep->lock);
- eavail = ep_events_available(ep);
- if (eavail)
- break;
- if (signal_pending(current)) {
- res = -EINTR;
+ if (eavail || res)
break;
- }
if (!schedule_hrtimeout_range(to, slack, HRTIMER_MODE_ABS)) {
timed_out = 1;
@@ -1927,6 +1926,15 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
}
send_events:
+ if (fatal_signal_pending(current))
+ /*
+ * Always short-circuit for fatal signals to allow
+ * threads to make a timely exit without the chance of
+ * finding more events available and fetching
+ * repeatedly.
+ */
+ res = -EINTR;
+
/*
* Try to transfer events to user space. In case we get 0 events and
* there's still timeout left over, we go trying again in search of
--
2.24.1
The patch titled
Subject: epoll: ensure ep_poll() doesn't miss wakeup events
has been removed from the -mm tree. Its filename was
epoll-ensure-ep_poll-doesnt-miss-wakeup-events.patch
This patch was dropped because it was withdrawn
------------------------------------------------------
From: Jason Baron <jbaron(a)akamai.com>
Subject: epoll: ensure ep_poll() doesn't miss wakeup events
Now that the ep_events_available() check is done in a lockless way, and we
no longer perform wakeups from ep_scan_ready_list(), we need to ensure
that either ep->rdllist has items or the overflow list is active. Prior
to: commit 339ddb53d373 ("fs/epoll: remove unnecessary wakeups of nested
epoll"), we did wake_up(&ep->wq) after manipulating the ep->rdllist and
the overflow list. Thus, any waiters would observe the correct state.
However, with that wake_up() now removed we need to be more careful to
ensure that condition.
Here's an example of what could go wrong:
We have epoll fds: epfd1, epfd2. And epfd1 is added to epfd2 and epfd2 is
added to a socket: epfd1->epfd2->socket. Thread a is doing epoll_wait()
on epfd1, and thread b is doing epoll_wait on epfd2. Then:
1) data comes in on socket
ep_poll_callback() wakes up threads a and b
2) thread a runs
ep_poll()
ep_scan_ready_list()
ep_send_events_proc()
ep_item_poll()
ep_scan_ready_list()
list_splice_init(&ep->rdllist, &txlist);
3) now thread b is running
ep_poll()
ep_events_available()
returns false
schedule_hrtimeout_range()
Thus, thread b has now scheduled and missed the wakeup.
Link: http://lkml.kernel.org/r/1588360533-11828-1-git-send-email-jbaron@akamai.com
Fixes: 339ddb53d373 ("fs/epoll: remove unnecessary wakeups of nested epoll")
Signed-off-by: Jason Baron <jbaron(a)akamai.com>
Reviewed-by: Roman Penyaev <rpenyaev(a)suse.de>
Cc: Alexander Viro <viro(a)zeniv.linux.org.uk>
Cc: Heiher <r(a)hev.cc>
Cc: Khazhismel Kumykov <khazhy(a)google.com>
Cc: Davidlohr Bueso <dbueso(a)suse.de>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/eventpoll.c | 23 +++++++++++++++++------
1 file changed, 17 insertions(+), 6 deletions(-)
--- a/fs/eventpoll.c~epoll-ensure-ep_poll-doesnt-miss-wakeup-events
+++ a/fs/eventpoll.c
@@ -704,8 +704,14 @@ static __poll_t ep_scan_ready_list(struc
* in a lockless way.
*/
write_lock_irq(&ep->lock);
- list_splice_init(&ep->rdllist, &txlist);
WRITE_ONCE(ep->ovflist, NULL);
+ /*
+ * In ep_poll() we use ep_events_available() in a lockless way to decide
+ * if events are available. So we need to preserve that either
+ * ep->oflist != EP_UNACTIVE_PTR or there are events on the ep->rdllist.
+ */
+ smp_wmb();
+ list_splice_init(&ep->rdllist, &txlist);
write_unlock_irq(&ep->lock);
/*
@@ -737,16 +743,21 @@ static __poll_t ep_scan_ready_list(struc
}
}
/*
+ * Quickly re-inject items left on "txlist".
+ */
+ list_splice(&txlist, &ep->rdllist);
+ /*
+ * In ep_poll() we use ep_events_available() in a lockless way to decide
+ * if events are available. So we need to preserve that either
+ * ep->oflist != EP_UNACTIVE_PTR or there are events on the ep->rdllist.
+ */
+ smp_wmb();
+ /*
* We need to set back ep->ovflist to EP_UNACTIVE_PTR, so that after
* releasing the lock, events will be queued in the normal way inside
* ep->rdllist.
*/
WRITE_ONCE(ep->ovflist, EP_UNACTIVE_PTR);
-
- /*
- * Quickly re-inject items left on "txlist".
- */
- list_splice(&txlist, &ep->rdllist);
__pm_relax(ep->ws);
write_unlock_irq(&ep->lock);
_
Patches currently in -mm which might be from jbaron(a)akamai.com are
The patch titled
Subject: epoll: call final ep_events_available() check under the lock
has been added to the -mm tree. Its filename is
epoll-call-final-ep_events_available-check-under-the-lock.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/epoll-call-final-ep_events_availab…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/epoll-call-final-ep_events_availab…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Roman Penyaev <rpenyaev(a)suse.de>
Subject: epoll: call final ep_events_available() check under the lock
There is a possible race when ep_scan_ready_list() leaves ->rdllist and
->obflist empty for a short period of time although some events are
pending. It is quite likely that ep_events_available() observes empty
lists and goes to sleep. Since 339ddb53d373 ("fs/epoll: remove
unnecessary wakeups of nested epoll") we are conservative in wakeups
(there is only one place for wakeup and this is ep_poll_callback()), thus
ep_events_available() must always observe correct state of two lists. The
easiest and correct way is to do the final check under the lock. This
does not impact the performance, since lock is taken anyway for adding a
wait entry to the wait queue.
The discussion of the problem can be found here:
https://lore.kernel.org/linux-fsdevel/a2f22c3c-c25a-4bda-8339-a7bdaf17849e@…
In this patch barrierless __set_current_state() is used. This is safe
since waitqueue_active() is called under the same lock on wakeup side.
Short-circuit for fatal signals (i.e. fatal_signal_pending() check) is
moved to the line just before actual events harvesting routine. This is
fully compliant to what is said in the comment of the patch where the
actual fatal_signal_pending() check was added: c257a340ede0 ("fs, epoll:
short circuit fetching events if thread has been killed").
Link: http://lkml.kernel.org/r/20200505145609.1865152-1-rpenyaev@suse.de
Fixes: 339ddb53d373 ("fs/epoll: remove unnecessary wakeups of nested epoll")
Signed-off-by: Roman Penyaev <rpenyaev(a)suse.de>
Reported-by: Jason Baron <jbaron(a)akamai.com>
Reviewed-by: Jason Baron <jbaron(a)akamai.com>
Cc: Khazhismel Kumykov <khazhy(a)google.com>
Cc: Alexander Viro <viro(a)zeniv.linux.org.uk>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/eventpoll.c | 48 +++++++++++++++++++++++++++--------------------
1 file changed, 28 insertions(+), 20 deletions(-)
--- a/fs/eventpoll.c~epoll-call-final-ep_events_available-check-under-the-lock
+++ a/fs/eventpoll.c
@@ -1890,34 +1890,33 @@ fetch_events:
* event delivery.
*/
init_wait(&wait);
- write_lock_irq(&ep->lock);
- __add_wait_queue_exclusive(&ep->wq, &wait);
- write_unlock_irq(&ep->lock);
+ write_lock_irq(&ep->lock);
/*
- * We don't want to sleep if the ep_poll_callback() sends us
- * a wakeup in between. That's why we set the task state
- * to TASK_INTERRUPTIBLE before doing the checks.
+ * Barrierless variant, waitqueue_active() is called under
+ * the same lock on wakeup ep_poll_callback() side, so it
+ * is safe to avoid an explicit barrier.
*/
- set_current_state(TASK_INTERRUPTIBLE);
+ __set_current_state(TASK_INTERRUPTIBLE);
+
/*
- * Always short-circuit for fatal signals to allow
- * threads to make a timely exit without the chance of
- * finding more events available and fetching
- * repeatedly.
+ * Do the final check under the lock. ep_scan_ready_list()
+ * plays with two lists (->rdllist and ->ovflist) and there
+ * is always a race when both lists are empty for short
+ * period of time although events are pending, so lock is
+ * important.
*/
- if (fatal_signal_pending(current)) {
- res = -EINTR;
- break;
+ eavail = ep_events_available(ep);
+ if (!eavail) {
+ if (signal_pending(current))
+ res = -EINTR;
+ else
+ __add_wait_queue_exclusive(&ep->wq, &wait);
}
+ write_unlock_irq(&ep->lock);
- eavail = ep_events_available(ep);
- if (eavail)
- break;
- if (signal_pending(current)) {
- res = -EINTR;
+ if (eavail || res)
break;
- }
if (!schedule_hrtimeout_range(to, slack, HRTIMER_MODE_ABS)) {
timed_out = 1;
@@ -1938,6 +1937,15 @@ fetch_events:
}
send_events:
+ if (fatal_signal_pending(current)) {
+ /*
+ * Always short-circuit for fatal signals to allow
+ * threads to make a timely exit without the chance of
+ * finding more events available and fetching
+ * repeatedly.
+ */
+ res = -EINTR;
+ }
/*
* Try to transfer events to user space. In case we get 0 events and
* there's still timeout left over, we go trying again in search of
_
Patches currently in -mm which might be from rpenyaev(a)suse.de are
kselftests-introduce-new-epoll60-testcase-for-catching-lost-wakeups.patch
epoll-atomically-remove-wait-entry-on-wake-up.patch
epoll-call-final-ep_events_available-check-under-the-lock.patch
This is the start of the stable review cycle for the 5.6.11 release.
There are 73 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 06 May 2020 16:52:55 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.6.11-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.6.11-rc1
Jens Axboe <axboe(a)kernel.dk>
io_uring: statx must grab the file table for valid fd
Vincenzo Frascino <vincenzo.frascino(a)arm.com>
arm64: vdso: Add -fasynchronous-unwind-tables to cflags
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
dmaengine: dmatest: Fix process hang when reading 'wait' parameter
Matt Roper <matthew.d.roper(a)intel.com>
drm/i915: Use proper fault mask in interrupt postinstall too
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
dmaengine: dmatest: Fix iteration non-stop logic
Andreas Gruenbacher <agruenba(a)redhat.com>
nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl
Xiyu Yang <xiyuyang19(a)fudan.edu.cn>
drm/i915/selftests: Fix i915_address_space refcnt leak
Niklas Cassel <niklas.cassel(a)wdc.com>
nvme: prevent double free in nvme_alloc_ns() error handling
David Howells <dhowells(a)redhat.com>
Fix use after free in get_tree_bdev()
Arnd Bergmann <arnd(a)arndb.de>
ALSA: opti9xx: shut up gcc-10 range warning
ryan_chen <ryan_chen(a)aspeedtech.com>
i2c: aspeed: Avoid i2c interrupt status clear race condition.
Suravee Suthikulpanit <suravee.suthikulpanit(a)amd.com>
iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled system
Lu Baolu <baolu.lu(a)linux.intel.com>
iommu/vt-d: Use right Kconfig option name
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
iommu: Properly export iommu_group_get_for_dev()
David Disseldorp <ddiss(a)suse.de>
scsi: target/iblock: fix WRITE SAME zeroing
Dave Jiang <dave.jiang(a)intel.com>
dmaengine: fix channel index enumeration
Grygorii Strashko <grygorii.strashko(a)ti.com>
dmaengine: ti: k3-psil: fix deadlock on error path
Tang Bin <tangbin(a)cmss.chinamobile.com>
iommu/qcom: Fix local_base status check
Sean Christopherson <sean.j.christopherson(a)intel.com>
vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn()
Yan Zhao <yan.y.zhao(a)intel.com>
vfio: avoid possible overflow in vfio_iommu_type1_pin_pages
YueHaibing <yuehaibing(a)huawei.com>
dmaengine: hisilicon: Fix build error without PCI_MSI
Rayagonda Kokatanur <rayagonda.kokatanur(a)broadcom.com>
i2c: iproc: generate stop event for slave writes
Dan Carpenter <dan.carpenter(a)oracle.com>
RDMA/cm: Fix an error check in cm_alloc_id_priv()
Jason Gunthorpe <jgg(a)ziepe.ca>
RDMA/cm: Fix ordering of xa_alloc_cyclic() in ib_create_cm_id()
Leon Romanovsky <leon(a)kernel.org>
RDMA/core: Fix race between destroy and release FD object
Leon Romanovsky <leon(a)kernel.org>
RDMA/core: Fix overwriting of uobj in case of error
Leon Romanovsky <leon(a)kernel.org>
RDMA/core: Prevent mixed use of FDs between shared ufiles
Jason Gunthorpe <jgg(a)ziepe.ca>
RDMA/siw: Fix potential siw_mem refcnt leak in siw_fastreg_mr()
Alaa Hleihel <alaa(a)mellanox.com>
RDMA/mlx4: Initialize ib_spec on the stack
Jason Gunthorpe <jgg(a)ziepe.ca>
RDMA/uverbs: Fix a race with disassociate and exit_mmap()
Aharon Landau <aharonl(a)mellanox.com>
RDMA/mlx5: Set GRH fields in query QP on RoCE
Martin Wilck <mwilck(a)suse.com>
scsi: qla2xxx: check UNLOADING before posting async work
Martin Wilck <mwilck(a)suse.com>
scsi: qla2xxx: set UNLOADING before waiting for session deletion
Christoph Hellwig <hch(a)lst.de>
block: remove the bd_openers checks in blk_drop_partitions
Russell King <rmk+kernel(a)armlinux.org.uk>
ARM: dts: imx6qdl-sr-som-ti: indicate powering off wifi is safe
Gabriel Krisman Bertazi <krisman(a)collabora.com>
dm multipath: use updated MPATHF_QUEUE_IO on mapping for bio-based mpath
Mikulas Patocka <mpatocka(a)redhat.com>
dm writecache: fix data corruption when reloading the target
Sunwook Eom <speed.eom(a)samsung.com>
dm verity fec: fix hash block number in verity_fec_decode
Dexuan Cui <decui(a)microsoft.com>
PM: hibernate: Freeze kernel threads in software_resume()
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
PM: ACPI: Output correct message on target power state
Sudip Mukherjee <sudipm.mukherjee(a)gmail.com>
IB/rdmavt: Always return ERR_PTR from rvt_create_mmap_info()
Paul Moore <paul(a)paul-moore.com>
selinux: properly handle multiple messages in selinux_netlink_send()
Al Viro <viro(a)zeniv.linux.org.uk>
dlmfs_file_write(): fix the bogosity in handling non-zero *ppos
Dexuan Cui <decui(a)microsoft.com>
Drivers: hv: vmbus: Fix Suspend-to-Idle for Generation-2 VM
Dexuan Cui <decui(a)microsoft.com>
x86/hyperv: Suspend/resume the VP assist page for hibernation
Dan Carpenter <dan.carpenter(a)oracle.com>
i2c: amd-mp2-pci: Fix Oops in amd_mp2_pci_init() error handling
Takashi Iwai <tiwai(a)suse.de>
ALSA: pcm: oss: Place the plugin buffer overflow checks correctly
Vasily Khoruzhick <anarsoul(a)gmail.com>
ALSA: line6: Fix POD HD500 audio playback
Wu Bo <wubo40(a)huawei.com>
ALSA: hda/hdmi: fix without unlocked before return
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Correct a typo of NuPrime DAC-10 USB ID
Hui Wang <hui.wang(a)canonical.com>
ALSA: hda/realtek - Two front mics on a Lenovo ThinkCenter
Iuliana Prodan <iuliana.prodan(a)nxp.com>
crypto: caam - fix the address of the last entry of S/G
Martin Blumenstingl <martin.blumenstingl(a)googlemail.com>
mmc: meson-mx-sdio: remove the broken ->card_busy() op
Martin Blumenstingl <martin.blumenstingl(a)googlemail.com>
mmc: meson-mx-sdio: Set MMC_CAP_WAIT_WHILE_BUSY
Veerabhadrarao Badiganti <vbadigan(a)codeaurora.org>
mmc: sdhci-msm: Enable host capabilities pertains to R1b response
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: sdhci-pci: Fix eMMC driver strength for BYT-based controllers
Marek Behún <marek.behun(a)nic.cz>
mmc: sdhci-xenon: fix annoying 1.8V regulator warning
Douglas Anderson <dianders(a)chromium.org>
mmc: cqhci: Avoid false "cqhci: CQE stuck on" by not open-coding timeout loop
Qu Wenruo <wqu(a)suse.com>
btrfs: transaction: Avoid deadlock due to bad initialization timing of fs_info::journal_info
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix partial loss of prealloc extent past i_size after fsync
Xiyu Yang <xiyuyang19(a)fudan.edu.cn>
btrfs: fix block group leak when removing fails
Xiyu Yang <xiyuyang19(a)fudan.edu.cn>
btrfs: fix transaction leak in btrfs_recover_relocation
Olga Kornievskaia <olga.kornievskaia(a)gmail.com>
NFSv4.1: fix handling of backchannel binding in BIND_CONN_TO_SESSION
Vasily Averin <vvs(a)virtuozzo.com>
drm/qxl: qxl_release use after free
Vasily Averin <vvs(a)virtuozzo.com>
drm/qxl: qxl_release leak in qxl_hw_surface_alloc()
Vasily Averin <vvs(a)virtuozzo.com>
drm/qxl: qxl_release leak in qxl_draw_dirty_fb()
Chris Wilson <chris(a)chris-wilson.co.uk>
drm/i915/gt: Check cacheline is valid before acquiring
Chris Wilson <chris(a)chris-wilson.co.uk>
drm/i915/gem: Hold obj->vma.lock over for_each_ggtt_vma()
Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com>
drm/amd/display: Fix green screen issue after suspend
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/edid: Fix off-by-one in DispID DTD pixel clock
Marek Olšák <marek.olsak(a)amd.com>
drm/amdgpu: invalidate L2 before SDMA IBs (v2)
Daniel Vetter <daniel.vetter(a)intel.com>
dma-buf: Fix SET_NAME ioctl uapi
Christian König <christian.koenig(a)amd.com>
drm/scheduler: fix drm_sched_get_cleanup_job
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/imx6qdl-sr-som-ti.dtsi | 1 +
arch/arm64/kernel/vdso/Makefile | 2 +-
arch/x86/hyperv/hv_init.c | 12 +++-
block/partition-generic.c | 2 +-
drivers/acpi/device_pm.c | 4 +-
drivers/crypto/caam/caamalg.c | 2 +-
drivers/dma-buf/dma-buf.c | 3 +-
drivers/dma/Kconfig | 3 +-
drivers/dma/dmaengine.c | 60 +++++++++----------
drivers/dma/dmatest.c | 6 +-
drivers/dma/ti/k3-psil.c | 1 +
drivers/gpu/drm/amd/amdgpu/navi10_sdma_pkt_open.h | 16 ++++++
drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 14 ++++-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 38 +++++++++---
drivers/gpu/drm/drm_edid.c | 2 +-
drivers/gpu/drm/i915/gem/i915_gem_tiling.c | 20 ++++++-
drivers/gpu/drm/i915/gem/selftests/huge_pages.c | 12 ++--
drivers/gpu/drm/i915/gt/intel_timeline.c | 2 +
drivers/gpu/drm/i915/i915_irq.c | 6 +-
drivers/gpu/drm/i915/i915_vma.c | 10 ++--
drivers/gpu/drm/qxl/qxl_cmd.c | 10 ++--
drivers/gpu/drm/qxl/qxl_display.c | 6 +-
drivers/gpu/drm/qxl/qxl_draw.c | 7 ++-
drivers/gpu/drm/qxl/qxl_ioctl.c | 5 +-
drivers/gpu/drm/scheduler/sched_main.c | 2 +-
drivers/hv/vmbus_drv.c | 43 +++++++++++---
drivers/i2c/busses/i2c-amd-mp2-pci.c | 2 +-
drivers/i2c/busses/i2c-aspeed.c | 5 +-
drivers/i2c/busses/i2c-bcm-iproc.c | 3 +
drivers/infiniband/core/cm.c | 27 ++++-----
drivers/infiniband/core/rdma_core.c | 9 ++-
drivers/infiniband/core/uverbs_main.c | 4 ++
drivers/infiniband/hw/mlx4/main.c | 3 +-
drivers/infiniband/hw/mlx5/qp.c | 4 +-
drivers/infiniband/sw/rdmavt/cq.c | 4 +-
drivers/infiniband/sw/rdmavt/mmap.c | 4 +-
drivers/infiniband/sw/rdmavt/qp.c | 4 +-
drivers/infiniband/sw/rdmavt/srq.c | 4 +-
drivers/infiniband/sw/siw/siw_qp_tx.c | 15 +++--
drivers/iommu/amd_iommu_init.c | 2 +-
drivers/iommu/intel-iommu.c | 4 +-
drivers/iommu/iommu.c | 2 +-
drivers/iommu/qcom_iommu.c | 5 +-
drivers/md/dm-mpath.c | 6 +-
drivers/md/dm-verity-fec.c | 2 +-
drivers/md/dm-writecache.c | 52 ++++++++++++-----
drivers/mmc/host/cqhci.c | 21 ++++---
drivers/mmc/host/meson-mx-sdio.c | 11 +---
drivers/mmc/host/sdhci-msm.c | 2 +
drivers/mmc/host/sdhci-pci-core.c | 3 +
drivers/mmc/host/sdhci-xenon.c | 10 ++++
drivers/nvme/host/core.c | 2 +
drivers/scsi/qla2xxx/qla_os.c | 35 ++++++------
drivers/target/target_core_iblock.c | 2 +-
drivers/vfio/vfio_iommu_type1.c | 6 +-
fs/btrfs/block-group.c | 16 ++++--
fs/btrfs/relocation.c | 1 +
fs/btrfs/transaction.c | 13 ++++-
fs/btrfs/tree-log.c | 43 +++++++++++++-
fs/io_uring.c | 12 +++-
fs/nfs/nfs3acl.c | 22 ++++---
fs/nfs/nfs4proc.c | 8 +++
fs/ocfs2/dlmfs/dlmfs.c | 27 ++++-----
fs/super.c | 2 +-
include/linux/dmaengine.h | 4 +-
include/linux/nfs_xdr.h | 2 +
include/linux/sunrpc/clnt.h | 5 ++
include/uapi/linux/dma-buf.h | 6 ++
kernel/power/hibernate.c | 7 +++
security/selinux/hooks.c | 70 +++++++++++++++--------
sound/core/oss/pcm_plugin.c | 20 ++++---
sound/isa/opti9xx/miro.c | 9 ++-
sound/isa/opti9xx/opti92x-ad1848.c | 9 ++-
sound/pci/hda/patch_hdmi.c | 4 +-
sound/pci/hda/patch_realtek.c | 1 +
sound/usb/line6/podhd.c | 22 ++-----
sound/usb/quirks.c | 2 +-
78 files changed, 554 insertions(+), 297 deletions(-)
From: Sean Paul <seanpaul(a)chromium.org>
The SRM cleanup in 79643fddd6eb2 ("drm/hdcp: optimizing the srm
handling") inadvertently altered the behavior of HDCP auth when
the SRM firmware is missing. Before that patch, missing SRM was
interpreted as the device having no revoked keys. With that patch,
if the SRM fw file is missing we reject _all_ keys.
This patch fixes that regression by returning success if the file
cannot be found.
Fixes: 79643fddd6eb ("drm/hdcp: optimizing the srm handling")
Cc: stable(a)vger.kernel.org
Cc: Ramalingam C <ramalingam.c(a)intel.com>
Cc: Sean Paul <sean(a)poorly.run>
Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com>
Cc: Maxime Ripard <mripard(a)kernel.org>
Cc: Thomas Zimmermann <tzimmermann(a)suse.de>
Cc: David Airlie <airlied(a)linux.ie>
Cc: Daniel Vetter <daniel(a)ffwll.ch>
Cc: dri-devel(a)lists.freedesktop.org
Signed-off-by: Sean Paul <seanpaul(a)chromium.org>
---
drivers/gpu/drm/drm_hdcp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_hdcp.c b/drivers/gpu/drm/drm_hdcp.c
index 7f386adcf872..3c36005d367b 100644
--- a/drivers/gpu/drm/drm_hdcp.c
+++ b/drivers/gpu/drm/drm_hdcp.c
@@ -241,8 +241,10 @@ static int drm_hdcp_request_srm(struct drm_device *drm_dev,
ret = request_firmware_direct(&fw, (const char *)fw_name,
drm_dev->dev);
- if (ret < 0)
+ if (ret < 0) {
+ ret = 0;
goto exit;
+ }
if (fw->size && fw->data)
ret = drm_hdcp_srm_update(fw->data, fw->size, revoked_ksv_list,
--
Sean Paul, Software Engineer, Google / Chromium OS
This is the start of the stable review cycle for the 4.9.222 release.
There are 18 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 06 May 2020 16:52:55 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.222-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.222-rc1
Vasily Averin <vvs(a)virtuozzo.com>
drm/qxl: qxl_release use after free
Paul Moore <paul(a)paul-moore.com>
selinux: properly handle multiple messages in selinux_netlink_send()
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
dmaengine: dmatest: Fix iteration non-stop logic
Andreas Gruenbacher <agruenba(a)redhat.com>
nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl
Arnd Bergmann <arnd(a)arndb.de>
ALSA: opti9xx: shut up gcc-10 range warning
Suravee Suthikulpanit <suravee.suthikulpanit(a)amd.com>
iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled system
Sean Christopherson <sean.j.christopherson(a)intel.com>
vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn()
Alaa Hleihel <alaa(a)mellanox.com>
RDMA/mlx4: Initialize ib_spec on the stack
Sunwook Eom <speed.eom(a)samsung.com>
dm verity fec: fix hash block number in verity_fec_decode
Dexuan Cui <decui(a)microsoft.com>
PM: hibernate: Freeze kernel threads in software_resume()
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
PM: ACPI: Output correct message on target power state
Takashi Iwai <tiwai(a)suse.de>
ALSA: pcm: oss: Place the plugin buffer overflow checks correctly
Wu Bo <wubo40(a)huawei.com>
ALSA: hda/hdmi: fix without unlocked before return
Xiyu Yang <xiyuyang19(a)fudan.edu.cn>
btrfs: fix block group leak when removing fails
Vasily Averin <vvs(a)virtuozzo.com>
drm/qxl: qxl_release leak in qxl_hw_surface_alloc()
Vasily Averin <vvs(a)virtuozzo.com>
drm/qxl: qxl_release leak in qxl_draw_dirty_fb()
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/edid: Fix off-by-one in DispID DTD pixel clock
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix special inode number checks in __ext4_iget()
-------------
Diffstat:
Makefile | 4 +--
drivers/acpi/device_pm.c | 4 +--
drivers/dma/dmatest.c | 4 +--
drivers/gpu/drm/drm_edid.c | 2 +-
drivers/gpu/drm/qxl/qxl_cmd.c | 10 +++---
drivers/gpu/drm/qxl/qxl_display.c | 8 ++---
drivers/gpu/drm/qxl/qxl_draw.c | 13 ++++----
drivers/gpu/drm/qxl/qxl_ioctl.c | 5 +--
drivers/infiniband/hw/mlx4/main.c | 3 +-
drivers/iommu/amd_iommu_init.c | 2 +-
drivers/md/dm-verity-fec.c | 2 +-
drivers/vfio/vfio_iommu_type1.c | 4 +--
fs/btrfs/extent-tree.c | 16 +++++----
fs/ext4/inode.c | 2 +-
fs/nfs/nfs3acl.c | 22 ++++++++----
kernel/power/hibernate.c | 7 ++++
security/selinux/hooks.c | 68 ++++++++++++++++++++++++--------------
sound/core/oss/pcm_plugin.c | 20 ++++++-----
sound/isa/opti9xx/miro.c | 9 +++--
sound/isa/opti9xx/opti92x-ad1848.c | 9 +++--
sound/pci/hda/patch_hdmi.c | 4 ++-
21 files changed, 134 insertions(+), 84 deletions(-)
This is the start of the stable review cycle for the 4.14.179 release.
There are 26 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 06 May 2020 16:52:55 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.179-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.179-rc1
Paul Moore <paul(a)paul-moore.com>
selinux: properly handle multiple messages in selinux_netlink_send()
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
dmaengine: dmatest: Fix iteration non-stop logic
Andreas Gruenbacher <agruenba(a)redhat.com>
nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl
Arnd Bergmann <arnd(a)arndb.de>
ALSA: opti9xx: shut up gcc-10 range warning
Suravee Suthikulpanit <suravee.suthikulpanit(a)amd.com>
iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled system
David Disseldorp <ddiss(a)suse.de>
scsi: target/iblock: fix WRITE SAME zeroing
Tang Bin <tangbin(a)cmss.chinamobile.com>
iommu/qcom: Fix local_base status check
Sean Christopherson <sean.j.christopherson(a)intel.com>
vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn()
Yan Zhao <yan.y.zhao(a)intel.com>
vfio: avoid possible overflow in vfio_iommu_type1_pin_pages
Alaa Hleihel <alaa(a)mellanox.com>
RDMA/mlx4: Initialize ib_spec on the stack
Aharon Landau <aharonl(a)mellanox.com>
RDMA/mlx5: Set GRH fields in query QP on RoCE
Sunwook Eom <speed.eom(a)samsung.com>
dm verity fec: fix hash block number in verity_fec_decode
Dexuan Cui <decui(a)microsoft.com>
PM: hibernate: Freeze kernel threads in software_resume()
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
PM: ACPI: Output correct message on target power state
Takashi Iwai <tiwai(a)suse.de>
ALSA: pcm: oss: Place the plugin buffer overflow checks correctly
Wu Bo <wubo40(a)huawei.com>
ALSA: hda/hdmi: fix without unlocked before return
Hui Wang <hui.wang(a)canonical.com>
ALSA: hda/realtek - Two front mics on a Lenovo ThinkCenter
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: sdhci-pci: Fix eMMC driver strength for BYT-based controllers
Marek Behún <marek.behun(a)nic.cz>
mmc: sdhci-xenon: fix annoying 1.8V regulator warning
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix partial loss of prealloc extent past i_size after fsync
Xiyu Yang <xiyuyang19(a)fudan.edu.cn>
btrfs: fix block group leak when removing fails
Vasily Averin <vvs(a)virtuozzo.com>
drm/qxl: qxl_release use after free
Vasily Averin <vvs(a)virtuozzo.com>
drm/qxl: qxl_release leak in qxl_hw_surface_alloc()
Vasily Averin <vvs(a)virtuozzo.com>
drm/qxl: qxl_release leak in qxl_draw_dirty_fb()
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/edid: Fix off-by-one in DispID DTD pixel clock
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix special inode number checks in __ext4_iget()
-------------
Diffstat:
Makefile | 4 +--
drivers/acpi/device_pm.c | 4 +--
drivers/dma/dmatest.c | 4 +--
drivers/gpu/drm/drm_edid.c | 2 +-
drivers/gpu/drm/qxl/qxl_cmd.c | 10 +++---
drivers/gpu/drm/qxl/qxl_display.c | 6 ++--
drivers/gpu/drm/qxl/qxl_draw.c | 13 +++----
drivers/gpu/drm/qxl/qxl_ioctl.c | 5 +--
drivers/infiniband/hw/mlx4/main.c | 3 +-
drivers/infiniband/hw/mlx5/qp.c | 4 ++-
drivers/iommu/amd_iommu_init.c | 2 +-
drivers/iommu/qcom_iommu.c | 5 ++-
drivers/md/dm-verity-fec.c | 2 +-
drivers/mmc/host/sdhci-pci-core.c | 3 ++
drivers/mmc/host/sdhci-xenon.c | 10 ++++++
drivers/target/target_core_iblock.c | 2 +-
drivers/vfio/vfio_iommu_type1.c | 6 ++--
fs/btrfs/extent-tree.c | 16 +++++----
fs/btrfs/tree-log.c | 43 +++++++++++++++++++++--
fs/ext4/inode.c | 2 +-
fs/nfs/nfs3acl.c | 22 ++++++++----
kernel/power/hibernate.c | 7 ++++
security/selinux/hooks.c | 68 ++++++++++++++++++++++++-------------
sound/core/oss/pcm_plugin.c | 20 ++++++-----
sound/isa/opti9xx/miro.c | 9 +++--
sound/isa/opti9xx/opti92x-ad1848.c | 9 +++--
sound/pci/hda/patch_hdmi.c | 4 ++-
sound/pci/hda/patch_realtek.c | 1 +
28 files changed, 196 insertions(+), 90 deletions(-)