- Linux-stable-mirror - lists.linaro.org

FAILED: patch "[PATCH] perf stat: Fix a segmentation fault when using repeat forever" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 443f2d5ba13d65ccfd879460f77941875159d154 Mon Sep 17 00:00:00 2001 From: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com> Date: Wed, 4 Sep 2019 15:17:38 +0530 Subject: [PATCH] perf stat: Fix a segmentation fault when using repeat forever Observe a segmentation fault when 'perf stat' is asked to repeat forever with the interval option. Without fix: # perf stat -r 0 -I 5000 -e cycles -a sleep 10 # time counts unit events 5.000211692 3,13,89,82,34,157 cycles 10.000380119 1,53,98,52,22,294 cycles 10.040467280 17,16,79,265 cycles Segmentation fault This problem was only observed when we use forever option aka -r 0 and works with limited repeats. Calling print_counter with ts being set to NULL, is not a correct option when interval is set. Hence avoid print_counter(NULL,..) if interval is set. With fix: # perf stat -r 0 -I 5000 -e cycles -a sleep 10 # time counts unit events 5.019866622 3,15,14,43,08,697 cycles 10.039865756 3,15,16,31,95,261 cycles 10.059950628 1,26,05,47,158 cycles 5.009902655 3,14,52,62,33,932 cycles 10.019880228 3,14,52,22,89,154 cycles 10.030543876 66,90,18,333 cycles 5.009848281 3,14,51,98,25,437 cycles 10.029854402 3,15,14,93,04,918 cycles 5.009834177 3,14,51,95,92,316 cycles Committer notes: Did the 'git bisect' to find the cset introducing the problem to add the Fixes tag below, and at that time the problem reproduced as: (gdb) run stat -r0 -I500 sleep 1 <SNIP> Program received signal SIGSEGV, Segmentation fault. print_interval (prefix=prefix@entry=0x7fffffffc8d0 "", ts=ts@entry=0x0) at builtin-stat.c:866 866 sprintf(prefix, "%6lu.%09lu%s", ts->tv_sec, ts->tv_nsec, csv_sep); (gdb) bt #0 print_interval (prefix=prefix@entry=0x7fffffffc8d0 "", ts=ts@entry=0x0) at builtin-stat.c:866 #1 0x000000000041860a in print_counters (ts=ts@entry=0x0, argc=argc@entry=2, argv=argv@entry=0x7fffffffd640) at builtin-stat.c:938 #2 0x0000000000419a7f in cmd_stat (argc=2, argv=0x7fffffffd640, prefix=<optimized out>) at builtin-stat.c:1411 #3 0x000000000045c65a in run_builtin (p=p@entry=0x6291b8 <commands+216>, argc=argc@entry=5, argv=argv@entry=0x7fffffffd640) at perf.c:370 #4 0x000000000045c893 in handle_internal_command (argc=5, argv=0x7fffffffd640) at perf.c:429 #5 0x000000000045c8f1 in run_argv (argcp=argcp@entry=0x7fffffffd4ac, argv=argv@entry=0x7fffffffd4a0) at perf.c:473 #6 0x000000000045cac9 in main (argc=<optimized out>, argv=<optimized out>) at perf.c:588 (gdb) Mostly the same as just before this patch: Program received signal SIGSEGV, Segmentation fault. 0x00000000005874a7 in print_interval (config=0xa1f2a0 <stat_config>, evlist=0xbc9b90, prefix=0x7fffffffd1c0 "`", ts=0x0) at util/stat-display.c:964 964 sprintf(prefix, "%6lu.%09lu%s", ts->tv_sec, ts->tv_nsec, config->csv_sep); (gdb) bt #0 0x00000000005874a7 in print_interval (config=0xa1f2a0 <stat_config>, evlist=0xbc9b90, prefix=0x7fffffffd1c0 "`", ts=0x0) at util/stat-display.c:964 #1 0x0000000000588047 in perf_evlist__print_counters (evlist=0xbc9b90, config=0xa1f2a0 <stat_config>, _target=0xa1f0c0 <target>, ts=0x0, argc=2, argv=0x7fffffffd670) at util/stat-display.c:1172 #2 0x000000000045390f in print_counters (ts=0x0, argc=2, argv=0x7fffffffd670) at builtin-stat.c:656 #3 0x0000000000456bb5 in cmd_stat (argc=2, argv=0x7fffffffd670) at builtin-stat.c:1960 #4 0x00000000004dd2e0 in run_builtin (p=0xa30e00 <commands+288>, argc=5, argv=0x7fffffffd670) at perf.c:310 #5 0x00000000004dd54d in handle_internal_command (argc=5, argv=0x7fffffffd670) at perf.c:362 #6 0x00000000004dd694 in run_argv (argcp=0x7fffffffd4cc, argv=0x7fffffffd4c0) at perf.c:406 #7 0x00000000004dda11 in main (argc=5, argv=0x7fffffffd670) at perf.c:531 (gdb) Fixes: d4f63a4741a8 ("perf stat: Introduce print_counters function") Signed-off-by: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com> Acked-by: Jiri Olsa <jolsa(a)kernel.org> Tested-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Tested-by: Ravi Bangoria <ravi.bangoria(a)linux.ibm.com> Cc: Namhyung Kim <namhyung(a)kernel.org> Cc: Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com> Cc: stable(a)vger.kernel.org # v4.2+ Link: http://lore.kernel.org/lkml/20190904094738.9558-3-srikar@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c index fa4b148ecfca..60cdd383af81 100644 --- a/tools/perf/builtin-stat.c +++ b/tools/perf/builtin-stat.c @@ -1956,7 +1956,7 @@ int cmd_stat(int argc, const char **argv) perf_evlist__reset_prev_raw_counts(evsel_list); status = run_perf_stat(argc, argv, run_idx); - if (forever && status != -1) { + if (forever && status != -1 && !interval) { print_counters(NULL, argc, argv); perf_stat__reset_stats(); }

5 years, 9 months

2
1
0 0

[PATCH 4.19 000/106] 4.19.78-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.78 release. There are 106 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue 08 Oct 2019 05:07:10 PM UTC. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.78-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.78-rc1 Bharath Vedartham <linux.bhar(a)gmail.com> 9p/cache.c: Fix memory leak in v9fs_cache_session_get_cookie Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kexec: bail out upon SIGKILL when allocating memory. Andrey Konovalov <andreyknvl(a)google.com> NFC: fix attrs checks in netlink interface Eric Biggers <ebiggers(a)google.com> smack: use GFP_NOFS while holding inode_smack::smk_lock Jann Horn <jannh(a)google.com> Smack: Don't ignore other bprm->unsafe flags if LSM_UNSAFE_PTRACE is set Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> soundwire: fix regmap dependencies and align with other serial links Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> soundwire: Kconfig: fix help format Eric Dumazet <edumazet(a)google.com> sch_cbq: validate TCA_CBQ_WRROPT to avoid crash Tuong Lien <tuong.t.lien(a)dektech.com.au> tipc: fix unlimited bundling of small messages Dongli Zhang <dongli.zhang(a)oracle.com> xen-netfront: do not use ~0U as error return value for xennet_fill_frags() Dotan Barak <dotanb(a)dev.mellanox.co.il> net/rds: Fix error handling in rds_ib_add_one() Josh Hunt <johunt(a)akamai.com> udp: only do GSO if # of segs > 1 Linus Walleij <linus.walleij(a)linaro.org> net: dsa: rtl8366: Check VLAN ID and not ports Dexuan Cui <decui(a)microsoft.com> vsock: Fix a lockdep warning in __vsock_release() Josh Hunt <johunt(a)akamai.com> udp: fix gso_segs calculations Eric Dumazet <edumazet(a)google.com> sch_dsmark: fix potential NULL deref in dsmark_init() David Howells <dhowells(a)redhat.com> rxrpc: Fix rxrpc_recvmsg tracepoint Reinhard Speyerer <rspmn(a)arcor.de> qmi_wwan: add support for Cinterion CLS8 devices Eric Dumazet <edumazet(a)google.com> nfc: fix memory leak in llcp_sock_bind() Martin KaFai Lau <kafai(a)fb.com> net: Unpublish sk from sk_reuseport_cb before call_rcu Navid Emamdoost <navid.emamdoost(a)gmail.com> net: qlogic: Fix memory leak in ql_alloc_large_buffers Paolo Abeni <pabeni(a)redhat.com> net: ipv4: avoid mixed n_redirects and rate_tokens usage David Ahern <dsahern(a)gmail.com> ipv6: Handle missing host route in __ipv6_ifa_notify Eric Dumazet <edumazet(a)google.com> ipv6: drop incoming packets having a v4mapped source address Johan Hovold <johan(a)kernel.org> hso: fix NULL-deref on tty open Haishuang Yan <yanhaishuang(a)cmss.chinamobile.com> erspan: remove the incorrect mtu limit for erspan Vishal Kulkarni <vishal(a)chelsio.com> cxgb4:Fix out-of-bounds MSI-X info array access Daniel Borkmann <daniel(a)iogearbox.net> bpf: fix use after free in prog symbol exposure Damien Le Moal <damien.lemoal(a)wdc.com> block: mq-deadline: Fix queue restart handling Alexandre Ghiti <alex(a)ghiti.fr> arm: use STACK_TOP when computing mmap base address Alexandre Ghiti <alex(a)ghiti.fr> arm: properly account for stack randomization and stack guard gap Alexandre Ghiti <alex(a)ghiti.fr> mips: properly account for stack randomization and stack guard gap Alexandre Ghiti <alex(a)ghiti.fr> arm64: consider stack randomization for mmap base only when necessary Nicolas Boichat <drinkcat(a)chromium.org> kmemleak: increase DEBUG_KMEMLEAK_EARLY_LOG_SIZE default to 16K Changwei Ge <gechangwei(a)live.cn> ocfs2: wait for recovering done after direct unlock request Greg Thelen <gthelen(a)google.com> kbuild: clean compressed initramfs image Yunfeng Ye <yeyunfeng(a)huawei.com> crypto: hisilicon - Fix double free in sec_free_hw_sgl() David Howells <dhowells(a)redhat.com> hypfs: Fix error number left in struct pointer member Jens Axboe <axboe(a)kernel.dk> pktcdvd: remove warning on attempting to register non-passthrough dev OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp> fat: work around race with userspace's read via blockdev while mounting Mike Rapoport <mike.rapoport(a)gmail.com> ARM: 8903/1: ensure that usable memory in bank 0 starts from a PMD-aligned address Jia-Ju Bai <baijiaju1990(a)gmail.com> security: smack: Fix possible null-pointer dereferences in smack_socket_sock_rcv_skb() Thierry Reding <treding(a)nvidia.com> PCI: exynos: Propagate errors for optional PHYs Thierry Reding <treding(a)nvidia.com> PCI: imx6: Propagate errors for optional regulators Thierry Reding <treding(a)nvidia.com> PCI: histb: Propagate errors for optional regulators Thierry Reding <treding(a)nvidia.com> PCI: rockchip: Propagate errors for optional regulators Joao Moreno <mail(a)joaomoreno.com> HID: apple: Fix stuck function keys when using FN Biwen Li <biwen.li(a)nxp.com> rtc: pcf85363/pcf85263: fix regmap error in set_time Anson Huang <Anson.Huang(a)nxp.com> rtc: snvs: fix possible race condition Nick Desaulniers <ndesaulniers(a)google.com> ARM: 8875/1: Kconfig: default to AEABI w/ Clang Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> soundwire: intel: fix channel number reported by hardware Will Deacon <will(a)kernel.org> ARM: 8898/1: mm: Don't treat faults reported from cache maintenance as writes Miroslav Benes <mbenes(a)suse.cz> livepatch: Nullify obj->mod in klp_module_coming()'s error path Jason Gerecke <killertofu(a)gmail.com> HID: wacom: Fix several minor compiler warnings Nishka Dasgupta <nishkadg.linux(a)gmail.com> PCI: tegra: Fix OF node reference leak Kai-Heng Feng <kai.heng.feng(a)canonical.com> mfd: intel-lpss: Remove D3cold delay Hans de Goede <hdegoede(a)redhat.com> i2c-cht-wc: Fix lockdep warning Nathan Chancellor <natechancellor(a)gmail.com> MIPS: tlbex: Explicitly cast _PAGE_NO_EXEC to a boolean Zhou Yanjie <zhouyanjie(a)zoho.com> MIPS: Ingenic: Disable broken BTB lookup optimization. zhangyi (F) <yi.zhang(a)huawei.com> ext4: fix potential use after free after remounting with noblock_validity Chris Wilson <chris(a)chris-wilson.co.uk> dma-buf/sw_sync: Synchronize signal vs syncpt free Bart Van Assche <bvanassche(a)acm.org> scsi: core: Reduce memory required for SCSI logging Chunyan Zhang <chunyan.zhang(a)unisoc.com> clk: sprd: add missing kfree Jorge Ramirez-Ortiz <jorge.ramirez-ortiz(a)linaro.org> mbox: qcom: add APCS child device for QCS404 Ganesh Goudar <ganeshgr(a)linux.ibm.com> powerpc: dump kernel log before carrying out fadump or kdump Eugen Hristev <eugen.hristev(a)microchip.com> clk: at91: select parent if main oscillator or bypass is enabled Arnd Bergmann <arnd(a)arndb.de> arm64: fix unreachable code issue with cmpxchg Otto Meier <gf435(a)gmx.net> pinctrl: meson-gxbb: Fix wrong pinning definition for uart_c Nathan Lynch <nathanl(a)linux.ibm.com> powerpc/pseries: correctly track irq state in default idle Stephen Boyd <swboyd(a)chromium.org> clk: qcom: gcc-sdm845: Use floor ops for sdcc clks Deepa Dinamani <deepa.kernel(a)gmail.com> pstore: fs superblock limits Nicholas Piggin <npiggin(a)gmail.com> powerpc/64s/exception: machine check use correct cfar for late handler Jean Delvare <jdelvare(a)suse.de> drm/amdgpu/si: fix ASIC tests Charlene Liu <charlene.liu(a)amd.com> drm/amd/display: support spdif Geert Uytterhoeven <geert+renesas(a)glider.be> clk: renesas: cpg-mssr: Set GENPD_FLAG_ALWAYS_ON for clock domain Geert Uytterhoeven <geert+renesas(a)glider.be> clk: renesas: mstp: Set GENPD_FLAG_ALWAYS_ON for clock domain Daniel Drake <drake(a)endlessm.com> pinctrl: amd: disable spurious-firing GPIO IRQs Mark Menzynski <mmenzyns(a)redhat.com> drm/nouveau/volt: Fix for some cards having 0 maximum voltage hexin <hexin.op(a)gmail.com> vfio_pci: Restore original state on release Sam Bobroff <sbobroff(a)linux.ibm.com> powerpc/eeh: Clear stale EEH_DEV_NO_HANDLER flag Sowjanya Komatineni <skomatineni(a)nvidia.com> pinctrl: tegra: Fix write barrier placement in pmx_writel Nathan Lynch <nathanl(a)linux.ibm.com> powerpc/pseries/mobility: use cond_resched when updating device tree Christophe Leroy <christophe.leroy(a)c-s.fr> powerpc/futex: Fix warning: 'oldval' may be used uninitialized in this function Nathan Lynch <nathanl(a)linux.ibm.com> powerpc/rtas: use device model APIs and serialization during LPM Cédric Le Goater <clg(a)kaod.org> powerpc/xmon: Check for HV mode when dumping XIVE info from OPAL Stephen Boyd <sboyd(a)kernel.org> clk: zx296718: Don't reference clk_init_data after registration Stephen Boyd <sboyd(a)kernel.org> clk: sprd: Don't reference clk_init_data after registration Stephen Boyd <sboyd(a)kernel.org> clk: sirf: Don't reference clk_init_data after registration Stephen Boyd <sboyd(a)kernel.org> clk: actions: Don't reference clk_init_data after registration Alexey Kardashevskiy <aik(a)ozlabs.ru> powerpc/powernv/ioda2: Allocate TCE table levels on demand for default DMA window Lewis Huang <Lewis.Huang(a)amd.com> drm/amd/display: reprogram VM config when system resume Anthony Koo <Anthony.Koo(a)amd.com> drm/amd/display: fix issue where 252-255 values are clipped Icenowy Zheng <icenowy(a)aosc.io> clk: sunxi-ng: v3s: add missing clock slices for MMC2 module clocks Nathan Huckleberry <nhuck(a)google.com> clk: qoriq: Fix -Wunused-const-variable Corey Minyard <cminyard(a)mvista.com> ipmi_si: Only schedule continuously in the thread in maintenance mode Nathan Chancellor <natechancellor(a)gmail.com> PCI: rpaphp: Avoid a sometimes-uninitialized warning Jia-Ju Bai <baijiaju1990(a)gmail.com> gpu: drm: radeon: Fix a possible null-pointer dereference in radeon_connector_set_property() KyleMahlkuch <kmahlkuc(a)linux.vnet.ibm.com> drm/radeon: Fix EEH during kexec Sean Paul <seanpaul(a)chromium.org> drm/rockchip: Check for fast link training before enabling psr Navid Emamdoost <navid.emamdoost(a)gmail.com> drm/panel: check failure cases in the probe func Ahmad Fatoum <a.fatoum(a)pengutronix.de> drm/stm: attach gem fence to atomic state Marko Kohtala <marko.kohtala(a)okoko.fi> video: ssd1307fb: Start page range at page_offset Lucas Stach <l.stach(a)pengutronix.de> drm/panel: simple: fix AUO g185han01 horizontal blanking Andrey Smirnov <andrew.smirnov(a)gmail.com> drm/bridge: tc358767: Increase AUX transfer length limit Vadim Sukhomlinov <sukhomlinov(a)google.com> tpm: Fix TPM 1.2 Shutdown sequence to prevent future TPM operations Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com> tpm: use tpm_try_get_ops() in tpm-sysfs.c. ------------- Diffstat: Makefile | 4 +- arch/arm/Kconfig | 5 +- arch/arm/mm/fault.c | 4 +- arch/arm/mm/fault.h | 1 + arch/arm/mm/mmap.c | 16 +- arch/arm/mm/mmu.c | 16 ++ arch/arm64/include/asm/cmpxchg.h | 6 +- arch/arm64/mm/mmap.c | 6 +- arch/mips/include/asm/mipsregs.h | 4 + arch/mips/kernel/cpu-probe.c | 7 + arch/mips/mm/mmap.c | 14 +- arch/mips/mm/tlbex.c | 2 +- arch/powerpc/include/asm/futex.h | 3 +- arch/powerpc/kernel/eeh_driver.c | 11 +- arch/powerpc/kernel/exceptions-64s.S | 4 + arch/powerpc/kernel/rtas.c | 11 +- arch/powerpc/kernel/traps.c | 1 + arch/powerpc/platforms/powernv/pci-ioda-tce.c | 20 +-- arch/powerpc/platforms/powernv/pci.h | 2 +- arch/powerpc/platforms/pseries/mobility.c | 9 + arch/powerpc/platforms/pseries/setup.c | 3 + arch/powerpc/xmon/xmon.c | 15 +- arch/s390/hypfs/inode.c | 9 +- block/mq-deadline.c | 23 +-- drivers/base/regmap/Kconfig | 2 +- drivers/block/pktcdvd.c | 1 - drivers/char/ipmi/ipmi_si_intf.c | 24 ++- drivers/char/tpm/tpm-chip.c | 5 +- drivers/char/tpm/tpm-sysfs.c | 134 +++++++++------ drivers/clk/actions/owl-common.c | 5 +- drivers/clk/at91/clk-main.c | 10 +- drivers/clk/clk-qoriq.c | 2 +- drivers/clk/qcom/gcc-sdm845.c | 4 +- drivers/clk/renesas/clk-mstp.c | 3 +- drivers/clk/renesas/renesas-cpg-mssr.c | 3 +- drivers/clk/sirf/clk-common.c | 12 +- drivers/clk/sprd/common.c | 5 +- drivers/clk/sprd/pll.c | 2 + drivers/clk/sunxi-ng/ccu-sun8i-v3s.c | 3 + drivers/clk/zte/clk-zx296718.c | 109 ++++++------ drivers/crypto/hisilicon/sec/sec_algs.c | 13 +- drivers/dma-buf/sw_sync.c | 16 +- drivers/gpu/drm/amd/amdgpu/si.c | 6 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 8 + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 17 +- drivers/gpu/drm/amd/display/dc/dce/dce_audio.c | 4 +- .../gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 3 +- drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 9 +- drivers/gpu/drm/bridge/tc358767.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/bios/volt.c | 2 + .../gpu/drm/panel/panel-raspberrypi-touchscreen.c | 13 ++ drivers/gpu/drm/panel/panel-simple.c | 6 +- drivers/gpu/drm/radeon/radeon_connectors.c | 2 +- drivers/gpu/drm/radeon/radeon_drv.c | 8 + drivers/gpu/drm/stm/ltdc.c | 2 + drivers/hid/hid-apple.c | 49 +++--- drivers/hid/wacom_sys.c | 7 +- drivers/hid/wacom_wac.c | 4 +- drivers/i2c/busses/i2c-cht-wc.c | 46 +++++ drivers/mailbox/qcom-apcs-ipc-mailbox.c | 8 +- drivers/mfd/intel-lpss-pci.c | 2 + drivers/net/dsa/rtl8366.c | 11 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c | 9 +- drivers/net/ethernet/qlogic/qla3xxx.c | 1 + drivers/net/usb/hso.c | 12 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/xen-netfront.c | 17 +- drivers/pci/controller/dwc/pci-exynos.c | 2 +- drivers/pci/controller/dwc/pci-imx6.c | 4 +- drivers/pci/controller/dwc/pcie-histb.c | 4 +- drivers/pci/controller/pci-tegra.c | 22 ++- drivers/pci/controller/pcie-rockchip-host.c | 16 +- drivers/pci/hotplug/rpaphp_core.c | 18 +- drivers/pinctrl/meson/pinctrl-meson-gxbb.c | 12 +- drivers/pinctrl/pinctrl-amd.c | 12 +- drivers/pinctrl/tegra/pinctrl-tegra.c | 4 +- drivers/rtc/rtc-pcf85363.c | 7 +- drivers/rtc/rtc-snvs.c | 11 +- drivers/scsi/scsi_logging.c | 48 +----- drivers/soundwire/Kconfig | 9 +- drivers/soundwire/Makefile | 2 +- drivers/soundwire/intel.c | 10 ++ drivers/vfio/pci/vfio_pci.c | 17 +- drivers/video/fbdev/ssd1307fb.c | 2 +- fs/9p/cache.c | 2 + fs/ext4/block_validity.c | 189 +++++++++++++++------ fs/ext4/ext4.h | 10 +- fs/fat/dir.c | 13 +- fs/fat/fatent.c | 3 + fs/ocfs2/dlm/dlmunlock.c | 23 ++- fs/pstore/ram.c | 2 + include/scsi/scsi_dbg.h | 2 - include/trace/events/rxrpc.h | 2 +- kernel/bpf/syscall.c | 28 +-- kernel/kexec_core.c | 2 + kernel/livepatch/core.c | 1 + lib/Kconfig.debug | 2 +- net/core/sock.c | 11 +- net/ipv4/ip_gre.c | 1 + net/ipv4/route.c | 5 +- net/ipv4/udp.c | 11 +- net/ipv6/addrconf.c | 17 +- net/ipv6/ip6_input.c | 10 ++ net/ipv6/udp.c | 9 +- net/nfc/llcp_sock.c | 7 +- net/nfc/netlink.c | 6 +- net/rds/ib.c | 6 +- net/sched/sch_cbq.c | 40 +++-- net/sched/sch_dsmark.c | 2 + net/tipc/link.c | 29 ++-- net/tipc/msg.c | 5 +- net/vmw_vsock/af_vsock.c | 16 +- net/vmw_vsock/hyperv_transport.c | 2 +- net/vmw_vsock/virtio_transport_common.c | 2 +- security/smack/smack_access.c | 6 +- security/smack/smack_lsm.c | 7 +- tools/testing/selftests/net/udpgso.c | 16 +- usr/Makefile | 3 + 118 files changed, 965 insertions(+), 523 deletions(-)

5 years, 9 months

9
122
0 0

FAILED: patch "[PATCH] perf tools: Fix segfault in cpu_cache_level__read()" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 0216234c2eed1367a318daeb9f4a97d8217412a0 Mon Sep 17 00:00:00 2001 From: Jiri Olsa <jolsa(a)kernel.org> Date: Thu, 12 Sep 2019 12:52:35 +0200 Subject: [PATCH] perf tools: Fix segfault in cpu_cache_level__read() We release wrong pointer on error path in cpu_cache_level__read function, leading to segfault: (gdb) r record ls Starting program: /root/perf/tools/perf/perf record ls ... [ perf record: Woken up 1 times to write data ] double free or corruption (out) Thread 1 "perf" received signal SIGABRT, Aborted. 0x00007ffff7463798 in raise () from /lib64/power9/libc.so.6 (gdb) bt #0 0x00007ffff7463798 in raise () from /lib64/power9/libc.so.6 #1 0x00007ffff7443bac in abort () from /lib64/power9/libc.so.6 #2 0x00007ffff74af8bc in __libc_message () from /lib64/power9/libc.so.6 #3 0x00007ffff74b92b8 in malloc_printerr () from /lib64/power9/libc.so.6 #4 0x00007ffff74bb874 in _int_free () from /lib64/power9/libc.so.6 #5 0x0000000010271260 in __zfree (ptr=0x7fffffffa0b0) at ../../lib/zalloc.. #6 0x0000000010139340 in cpu_cache_level__read (cache=0x7fffffffa090, cac.. #7 0x0000000010143c90 in build_caches (cntp=0x7fffffffa118, size=<optimiz.. ... Releasing the proper pointer. Fixes: 720e98b5faf1 ("perf tools: Add perf data cache feature") Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com> Cc: Michael Petlan <mpetlan(a)redhat.com> Cc: Namhyung Kim <namhyung(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org: # v4.6+ Link: http://lore.kernel.org/lkml/20190912105235.10689-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c index 5722ff717777..0167f9697172 100644 --- a/tools/perf/util/header.c +++ b/tools/perf/util/header.c @@ -1073,7 +1073,7 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev scnprintf(file, PATH_MAX, "%s/shared_cpu_list", path); if (sysfs__read_str(file, &cache->map, &len)) { - zfree(&cache->map); + zfree(&cache->size); zfree(&cache->type); return -1; }

5 years, 9 months

2
1
0 0

[PATCH] tpm: add check after commands attribs tab allocation

by Tadeusz Struk

devm_kcalloc() can fail and return NULL so we need to check for that. Fixes: 58472f5cd4f6f ("tpm: validate TPM 2.0 commands") Signed-off-by: Tadeusz Struk <tadeusz.struk(a)intel.com> --- drivers/char/tpm/tpm2-cmd.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c index ba9acae83bff..5817dfe5c5d2 100644 --- a/drivers/char/tpm/tpm2-cmd.c +++ b/drivers/char/tpm/tpm2-cmd.c @@ -939,6 +939,10 @@ static int tpm2_get_cc_attrs_tbl(struct tpm_chip *chip) chip->cc_attrs_tbl = devm_kcalloc(&chip->dev, 4, nr_commands, GFP_KERNEL); + if (!chip->cc_attrs_tbl) { + rc = -ENOMEM; + goto out; + } rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY); if (rc)

5 years, 9 months

3
2
0 0

FAILED: patch "[PATCH] PCI: hv: Avoid use of hv_pci_dev->pci_slot after freeing it" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 533ca1feed98b0bf024779a14760694c7cb4d431 Mon Sep 17 00:00:00 2001 From: Dexuan Cui <decui(a)microsoft.com> Date: Fri, 2 Aug 2019 22:50:20 +0000 Subject: [PATCH] PCI: hv: Avoid use of hv_pci_dev->pci_slot after freeing it The slot must be removed before the pci_dev is removed, otherwise a panic can happen due to use-after-free. Fixes: 15becc2b56c6 ("PCI: hv: Add hv_pci_remove_slots() when we unload the driver") Signed-off-by: Dexuan Cui <decui(a)microsoft.com> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi(a)arm.com> Cc: stable(a)vger.kernel.org diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c index 40b625458afa..2b53976cd9f9 100644 --- a/drivers/pci/controller/pci-hyperv.c +++ b/drivers/pci/controller/pci-hyperv.c @@ -2701,8 +2701,8 @@ static int hv_pci_remove(struct hv_device *hdev) /* Remove the bus from PCI's point of view. */ pci_lock_rescan_remove(); pci_stop_root_bus(hbus->pci_bus); - pci_remove_root_bus(hbus->pci_bus); hv_pci_remove_slots(hbus); + pci_remove_root_bus(hbus->pci_bus); pci_unlock_rescan_remove(); hbus->state = hv_pcibus_removed; }

5 years, 9 months

3
2
0 0

FAILED: patch "[PATCH] PCI: hv: Avoid use of hv_pci_dev->pci_slot after freeing it" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 533ca1feed98b0bf024779a14760694c7cb4d431 Mon Sep 17 00:00:00 2001 From: Dexuan Cui <decui(a)microsoft.com> Date: Fri, 2 Aug 2019 22:50:20 +0000 Subject: [PATCH] PCI: hv: Avoid use of hv_pci_dev->pci_slot after freeing it The slot must be removed before the pci_dev is removed, otherwise a panic can happen due to use-after-free. Fixes: 15becc2b56c6 ("PCI: hv: Add hv_pci_remove_slots() when we unload the driver") Signed-off-by: Dexuan Cui <decui(a)microsoft.com> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi(a)arm.com> Cc: stable(a)vger.kernel.org diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c index 40b625458afa..2b53976cd9f9 100644 --- a/drivers/pci/controller/pci-hyperv.c +++ b/drivers/pci/controller/pci-hyperv.c @@ -2701,8 +2701,8 @@ static int hv_pci_remove(struct hv_device *hdev) /* Remove the bus from PCI's point of view. */ pci_lock_rescan_remove(); pci_stop_root_bus(hbus->pci_bus); - pci_remove_root_bus(hbus->pci_bus); hv_pci_remove_slots(hbus); + pci_remove_root_bus(hbus->pci_bus); pci_unlock_rescan_remove(); hbus->state = hv_pcibus_removed; }

5 years, 9 months

2
1
0 0

FAILED: patch "[PATCH] tick: broadcast-hrtimer: Fix a race in bc_set_next" failed to apply to 5.3-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.3-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From b9023b91dd020ad7e093baa5122b6968c48cc9e0 Mon Sep 17 00:00:00 2001 From: Balasubramani Vivekanandan <balasubramani_vivekanandan(a)mentor.com> Date: Thu, 26 Sep 2019 15:51:01 +0200 Subject: [PATCH] tick: broadcast-hrtimer: Fix a race in bc_set_next When a cpu requests broadcasting, before starting the tick broadcast hrtimer, bc_set_next() checks if the timer callback (bc_handler) is active using hrtimer_try_to_cancel(). But hrtimer_try_to_cancel() does not provide the required synchronization when the callback is active on other core. The callback could have already executed tick_handle_oneshot_broadcast() and could have also returned. But still there is a small time window where the hrtimer_try_to_cancel() returns -1. In that case bc_set_next() returns without doing anything, but the next_event of the tick broadcast clock device is already set to a timeout value. In the race condition diagram below, CPU #1 is running the timer callback and CPU #2 is entering idle state and so calls bc_set_next(). In the worst case, the next_event will contain an expiry time, but the hrtimer will not be started which happens when the racing callback returns HRTIMER_NORESTART. The hrtimer might never recover if all further requests from the CPUs to subscribe to tick broadcast have timeout greater than the next_event of tick broadcast clock device. This leads to cascading of failures and finally noticed as rcu stall warnings Here is a depiction of the race condition CPU #1 (Running timer callback) CPU #2 (Enter idle and subscribe to tick broadcast) --------------------- --------------------- __run_hrtimer() tick_broadcast_enter() bc_handler() __tick_broadcast_oneshot_control() tick_handle_oneshot_broadcast() raw_spin_lock(&tick_broadcast_lock); dev->next_event = KTIME_MAX; //wait for tick_broadcast_lock //next_event for tick broadcast clock set to KTIME_MAX since no other cores subscribed to tick broadcasting raw_spin_unlock(&tick_broadcast_lock); if (dev->next_event == KTIME_MAX) return HRTIMER_NORESTART // callback function exits without restarting the hrtimer //tick_broadcast_lock acquired raw_spin_lock(&tick_broadcast_lock); tick_broadcast_set_event() clockevents_program_event() dev->next_event = expires; bc_set_next() hrtimer_try_to_cancel() //returns -1 since the timer callback is active. Exits without restarting the timer cpu_base->running = NULL; The comment that hrtimer cannot be armed from within the callback is wrong. It is fine to start the hrtimer from within the callback. Also it is safe to start the hrtimer from the enter/exit idle code while the broadcast handler is active. The enter/exit idle code and the broadcast handler are synchronized using tick_broadcast_lock. So there is no need for the existing try to cancel logic. All this can be removed which will eliminate the race condition as well. Fixes: 5d1638acb9f6 ("tick: Introduce hrtimer based broadcast") Originally-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Balasubramani Vivekanandan <balasubramani_vivekanandan(a)mentor.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lkml.kernel.org/r/20190926135101.12102-2-balasubramani_vivekanandan… diff --git a/kernel/time/tick-broadcast-hrtimer.c b/kernel/time/tick-broadcast-hrtimer.c index c1f5bb590b5e..b5a65e212df2 100644 --- a/kernel/time/tick-broadcast-hrtimer.c +++ b/kernel/time/tick-broadcast-hrtimer.c @@ -42,39 +42,39 @@ static int bc_shutdown(struct clock_event_device *evt) */ static int bc_set_next(ktime_t expires, struct clock_event_device *bc) { - int bc_moved; /* - * We try to cancel the timer first. If the callback is on - * flight on some other cpu then we let it handle it. If we - * were able to cancel the timer nothing can rearm it as we - * own broadcast_lock. + * This is called either from enter/exit idle code or from the + * broadcast handler. In all cases tick_broadcast_lock is held. * - * However we can also be called from the event handler of - * ce_broadcast_hrtimer itself when it expires. We cannot - * restart the timer because we are in the callback, but we - * can set the expiry time and let the callback return - * HRTIMER_RESTART. + * hrtimer_cancel() cannot be called here neither from the + * broadcast handler nor from the enter/exit idle code. The idle + * code can run into the problem described in bc_shutdown() and the + * broadcast handler cannot wait for itself to complete for obvious + * reasons. * - * Since we are in the idle loop at this point and because - * hrtimer_{start/cancel} functions call into tracing, - * calls to these functions must be bound within RCU_NONIDLE. + * Each caller tries to arm the hrtimer on its own CPU, but if the + * hrtimer callbback function is currently running, then + * hrtimer_start() cannot move it and the timer stays on the CPU on + * which it is assigned at the moment. + * + * As this can be called from idle code, the hrtimer_start() + * invocation has to be wrapped with RCU_NONIDLE() as + * hrtimer_start() can call into tracing. */ - RCU_NONIDLE( - { - bc_moved = hrtimer_try_to_cancel(&bctimer) >= 0; - if (bc_moved) { - hrtimer_start(&bctimer, expires, - HRTIMER_MODE_ABS_PINNED_HARD); - } - } - ); - - if (bc_moved) { - /* Bind the "device" to the cpu */ - bc->bound_on = smp_processor_id(); - } else if (bc->bound_on == smp_processor_id()) { - hrtimer_set_expires(&bctimer, expires); - } + RCU_NONIDLE( { + hrtimer_start(&bctimer, expires, HRTIMER_MODE_ABS_PINNED_HARD); + /* + * The core tick broadcast mode expects bc->bound_on to be set + * correctly to prevent a CPU which has the broadcast hrtimer + * armed from going deep idle. + * + * As tick_broadcast_lock is held, nothing can change the cpu + * base which was just established in hrtimer_start() above. So + * the below access is safe even without holding the hrtimer + * base lock. + */ + bc->bound_on = bctimer.base->cpu_base->cpu; + } ); return 0; } @@ -100,10 +100,6 @@ static enum hrtimer_restart bc_handler(struct hrtimer *t) { ce_broadcast_hrtimer.event_handler(&ce_broadcast_hrtimer); - if (clockevent_state_oneshot(&ce_broadcast_hrtimer)) - if (ce_broadcast_hrtimer.next_event != KTIME_MAX) - return HRTIMER_RESTART; - return HRTIMER_NORESTART; }

5 years, 9 months

2
1
0 0

FAILED: patch "[PATCH] tools lib traceevent: Do not free tep->cmdlines in" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From b0215e2d6a18d8331b2d4a8b38ccf3eff783edb1 Mon Sep 17 00:00:00 2001 From: "Steven Rostedt (VMware)" <rostedt(a)goodmis.org> Date: Wed, 28 Aug 2019 15:05:28 -0400 Subject: [PATCH] tools lib traceevent: Do not free tep->cmdlines in add_new_comm() on failure If the re-allocation of tep->cmdlines succeeds, then the previous allocation of tep->cmdlines will be freed. If we later fail in add_new_comm(), we must not free cmdlines, and also should assign tep->cmdlines to the new allocation. Otherwise when freeing tep, the tep->cmdlines will be pointing to garbage. Fixes: a6d2a61ac653a ("tools lib traceevent: Remove some die() calls") Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: Jiri Olsa <jolsa(a)redhat.com> Cc: Namhyung Kim <namhyung(a)kernel.org> Cc: linux-trace-devel(a)vger.kernel.org Cc: stable(a)vger.kernel.org Link: http://lkml.kernel.org/r/20190828191819.970121417@goodmis.org Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c index b36b536a9fcb..13fd9fdf91e0 100644 --- a/tools/lib/traceevent/event-parse.c +++ b/tools/lib/traceevent/event-parse.c @@ -269,10 +269,10 @@ static int add_new_comm(struct tep_handle *tep, errno = ENOMEM; return -1; } + tep->cmdlines = cmdlines; cmdlines[tep->cmdline_count].comm = strdup(comm); if (!cmdlines[tep->cmdline_count].comm) { - free(cmdlines); errno = ENOMEM; return -1; } @@ -283,7 +283,6 @@ static int add_new_comm(struct tep_handle *tep, tep->cmdline_count++; qsort(cmdlines, tep->cmdline_count, sizeof(*cmdlines), cmdline_cmp); - tep->cmdlines = cmdlines; return 0; }

5 years, 9 months

2
1
0 0

FAILED: patch "[PATCH] powerpc/book3s64/radix: Rename CPU_FTR_P9_TLBIE_BUG feature" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 09ce98cacd51fcd0fa0af2f79d1e1d3192f4cbb0 Mon Sep 17 00:00:00 2001 From: "Aneesh Kumar K.V" <aneesh.kumar(a)linux.ibm.com> Date: Tue, 24 Sep 2019 09:22:52 +0530 Subject: [PATCH] powerpc/book3s64/radix: Rename CPU_FTR_P9_TLBIE_BUG feature flag Rename the #define to indicate this is related to store vs tlbie ordering issue. In the next patch, we will be adding another feature flag that is used to handles ERAT flush vs tlbie ordering issue. Fixes: a5d4b5891c2f ("powerpc/mm: Fixup tlbie vs store ordering issue on POWER9") Cc: stable(a)vger.kernel.org # v4.16+ Signed-off-by: Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://lore.kernel.org/r/20190924035254.24612-2-aneesh.kumar@linux.ibm.com diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h index a1ebcbc3931f..f080fba48619 100644 --- a/arch/powerpc/include/asm/cputable.h +++ b/arch/powerpc/include/asm/cputable.h @@ -209,7 +209,7 @@ static inline void cpu_feature_keys_init(void) { } #define CPU_FTR_POWER9_DD2_1 LONG_ASM_CONST(0x0000080000000000) #define CPU_FTR_P9_TM_HV_ASSIST LONG_ASM_CONST(0x0000100000000000) #define CPU_FTR_P9_TM_XER_SO_BUG LONG_ASM_CONST(0x0000200000000000) -#define CPU_FTR_P9_TLBIE_BUG LONG_ASM_CONST(0x0000400000000000) +#define CPU_FTR_P9_TLBIE_STQ_BUG LONG_ASM_CONST(0x0000400000000000) #define CPU_FTR_P9_TIDR LONG_ASM_CONST(0x0000800000000000) #ifndef __ASSEMBLY__ @@ -457,7 +457,7 @@ static inline void cpu_feature_keys_init(void) { } CPU_FTR_CFAR | CPU_FTR_HVMODE | CPU_FTR_VMX_COPY | \ CPU_FTR_DBELL | CPU_FTR_HAS_PPR | CPU_FTR_ARCH_207S | \ CPU_FTR_TM_COMP | CPU_FTR_ARCH_300 | CPU_FTR_PKEY | \ - CPU_FTR_P9_TLBIE_BUG | CPU_FTR_P9_TIDR) + CPU_FTR_P9_TLBIE_STQ_BUG | CPU_FTR_P9_TIDR) #define CPU_FTRS_POWER9_DD2_0 CPU_FTRS_POWER9 #define CPU_FTRS_POWER9_DD2_1 (CPU_FTRS_POWER9 | CPU_FTR_POWER9_DD2_1) #define CPU_FTRS_POWER9_DD2_2 (CPU_FTRS_POWER9 | CPU_FTR_POWER9_DD2_1 | \ diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c index 5fc1b527de46..a86486390c70 100644 --- a/arch/powerpc/kernel/dt_cpu_ftrs.c +++ b/arch/powerpc/kernel/dt_cpu_ftrs.c @@ -706,14 +706,14 @@ static __init void update_tlbie_feature_flag(unsigned long pvr) if ((pvr & 0xe000) == 0) { /* Nimbus */ if ((pvr & 0xfff) < 0x203) - cur_cpu_spec->cpu_features |= CPU_FTR_P9_TLBIE_BUG; + cur_cpu_spec->cpu_features |= CPU_FTR_P9_TLBIE_STQ_BUG; } else if ((pvr & 0xc000) == 0) { /* Cumulus */ if ((pvr & 0xfff) < 0x103) - cur_cpu_spec->cpu_features |= CPU_FTR_P9_TLBIE_BUG; + cur_cpu_spec->cpu_features |= CPU_FTR_P9_TLBIE_STQ_BUG; } else { WARN_ONCE(1, "Unknown PVR"); - cur_cpu_spec->cpu_features |= CPU_FTR_P9_TLBIE_BUG; + cur_cpu_spec->cpu_features |= CPU_FTR_P9_TLBIE_STQ_BUG; } } } diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c index 7186c65c61c9..cfdf232aac34 100644 --- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c +++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c @@ -451,7 +451,7 @@ static void do_tlbies(struct kvm *kvm, unsigned long *rbvalues, "r" (rbvalues[i]), "r" (kvm->arch.lpid)); } - if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG)) { + if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) { /* * Need the extra ptesync to make sure we don't * re-order the tlbie diff --git a/arch/powerpc/mm/book3s64/hash_native.c b/arch/powerpc/mm/book3s64/hash_native.c index 90ab4f31e2b3..02568dae4695 100644 --- a/arch/powerpc/mm/book3s64/hash_native.c +++ b/arch/powerpc/mm/book3s64/hash_native.c @@ -199,7 +199,7 @@ static inline unsigned long ___tlbie(unsigned long vpn, int psize, static inline void fixup_tlbie(unsigned long vpn, int psize, int apsize, int ssize) { - if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG)) { + if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) { /* Need the extra ptesync to ensure we don't reorder tlbie*/ asm volatile("ptesync": : :"memory"); ___tlbie(vpn, psize, apsize, ssize); diff --git a/arch/powerpc/mm/book3s64/radix_tlb.c b/arch/powerpc/mm/book3s64/radix_tlb.c index 631be42abd33..69fdc004d83f 100644 --- a/arch/powerpc/mm/book3s64/radix_tlb.c +++ b/arch/powerpc/mm/book3s64/radix_tlb.c @@ -201,7 +201,7 @@ static inline void fixup_tlbie(void) unsigned long pid = 0; unsigned long va = ((1UL << 52) - 1); - if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG)) { + if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) { asm volatile("ptesync": : :"memory"); __tlbie_va(va, pid, mmu_get_ap(MMU_PAGE_64K), RIC_FLUSH_TLB); } @@ -211,7 +211,7 @@ static inline void fixup_tlbie_lpid(unsigned long lpid) { unsigned long va = ((1UL << 52) - 1); - if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG)) { + if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) { asm volatile("ptesync": : :"memory"); __tlbie_lpid_va(va, lpid, mmu_get_ap(MMU_PAGE_64K), RIC_FLUSH_TLB); }

5 years, 9 months

2
1
0 0

FAILED: patch "[PATCH] powerpc/pseries: Fix cpu_hotplug_lock acquisition in" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From c784be435d5dae28d3b03db31753dd7a18733f0c Mon Sep 17 00:00:00 2001 From: "Gautham R. Shenoy" <ego(a)linux.vnet.ibm.com> Date: Wed, 15 May 2019 13:15:52 +0530 Subject: [PATCH] powerpc/pseries: Fix cpu_hotplug_lock acquisition in resize_hpt() The calls to arch_add_memory()/arch_remove_memory() are always made with the read-side cpu_hotplug_lock acquired via memory_hotplug_begin(). On pSeries, arch_add_memory()/arch_remove_memory() eventually call resize_hpt() which in turn calls stop_machine() which acquires the read-side cpu_hotplug_lock again, thereby resulting in the recursive acquisition of this lock. In the absence of CONFIG_PROVE_LOCKING, we hadn't observed a system lockup during a memory hotplug operation because cpus_read_lock() is a per-cpu rwsem read, which, in the fast-path (in the absence of the writer, which in our case is a CPU-hotplug operation) simply increments the read_count on the semaphore. Thus a recursive read in the fast-path doesn't cause any problems. However, we can hit this problem in practice if there is a concurrent CPU-Hotplug operation in progress which is waiting to acquire the write-side of the lock. This will cause the second recursive read to block until the writer finishes. While the writer is blocked since the first read holds the lock. Thus both the reader as well as the writers fail to make any progress thereby blocking both CPU-Hotplug as well as Memory Hotplug operations. Memory-Hotplug CPU-Hotplug CPU 0 CPU 1 ------ ------ 1. down_read(cpu_hotplug_lock.rw_sem) [memory_hotplug_begin] 2. down_write(cpu_hotplug_lock.rw_sem) [cpu_up/cpu_down] 3. down_read(cpu_hotplug_lock.rw_sem) [stop_machine()] Lockdep complains as follows in these code-paths. swapper/0/1 is trying to acquire lock: (____ptrval____) (cpu_hotplug_lock.rw_sem){++++}, at: stop_machine+0x2c/0x60 but task is already holding lock: (____ptrval____) (cpu_hotplug_lock.rw_sem){++++}, at: mem_hotplug_begin+0x20/0x50 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(cpu_hotplug_lock.rw_sem); lock(cpu_hotplug_lock.rw_sem); *** DEADLOCK *** May be due to missing lock nesting notation 3 locks held by swapper/0/1: #0: (____ptrval____) (&dev->mutex){....}, at: __driver_attach+0x12c/0x1b0 #1: (____ptrval____) (cpu_hotplug_lock.rw_sem){++++}, at: mem_hotplug_begin+0x20/0x50 #2: (____ptrval____) (mem_hotplug_lock.rw_sem){++++}, at: percpu_down_write+0x54/0x1a0 stack backtrace: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.0.0-rc5-58373-gbc99402235f3-dirty #166 Call Trace: dump_stack+0xe8/0x164 (unreliable) __lock_acquire+0x1110/0x1c70 lock_acquire+0x240/0x290 cpus_read_lock+0x64/0xf0 stop_machine+0x2c/0x60 pseries_lpar_resize_hpt+0x19c/0x2c0 resize_hpt_for_hotplug+0x70/0xd0 arch_add_memory+0x58/0xfc devm_memremap_pages+0x5e8/0x8f0 pmem_attach_disk+0x764/0x830 nvdimm_bus_probe+0x118/0x240 really_probe+0x230/0x4b0 driver_probe_device+0x16c/0x1e0 __driver_attach+0x148/0x1b0 bus_for_each_dev+0x90/0x130 driver_attach+0x34/0x50 bus_add_driver+0x1a8/0x360 driver_register+0x108/0x170 __nd_driver_register+0xd0/0xf0 nd_pmem_driver_init+0x34/0x48 do_one_initcall+0x1e0/0x45c kernel_init_freeable+0x540/0x64c kernel_init+0x2c/0x160 ret_from_kernel_thread+0x5c/0x68 Fix this issue by 1) Requiring all the calls to pseries_lpar_resize_hpt() be made with cpu_hotplug_lock held. 2) In pseries_lpar_resize_hpt() invoke stop_machine_cpuslocked() as a consequence of 1) 3) To satisfy 1), in hpt_order_set(), call mmu_hash_ops.resize_hpt() with cpu_hotplug_lock held. Fixes: dbcf929c0062 ("powerpc/pseries: Add support for hash table resizing") Cc: stable(a)vger.kernel.org # v4.11+ Reported-by: Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> Signed-off-by: Gautham R. Shenoy <ego(a)linux.vnet.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://lore.kernel.org/r/1557906352-29048-1-git-send-email-ego@linux.vnet.… diff --git a/arch/powerpc/mm/book3s64/hash_utils.c b/arch/powerpc/mm/book3s64/hash_utils.c index e6d471058597..c363e850550e 100644 --- a/arch/powerpc/mm/book3s64/hash_utils.c +++ b/arch/powerpc/mm/book3s64/hash_utils.c @@ -34,6 +34,7 @@ #include <linux/libfdt.h> #include <linux/pkeys.h> #include <linux/hugetlb.h> +#include <linux/cpu.h> #include <asm/debugfs.h> #include <asm/processor.h> @@ -1931,10 +1932,16 @@ static int hpt_order_get(void *data, u64 *val) static int hpt_order_set(void *data, u64 val) { + int ret; + if (!mmu_hash_ops.resize_hpt) return -ENODEV; - return mmu_hash_ops.resize_hpt(val); + cpus_read_lock(); + ret = mmu_hash_ops.resize_hpt(val); + cpus_read_unlock(); + + return ret; } DEFINE_DEBUGFS_ATTRIBUTE(fops_hpt_order, hpt_order_get, hpt_order_set, "%llu\n"); diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c index 09bb878c21e0..4f76e5f30c97 100644 --- a/arch/powerpc/platforms/pseries/lpar.c +++ b/arch/powerpc/platforms/pseries/lpar.c @@ -1413,7 +1413,10 @@ static int pseries_lpar_resize_hpt_commit(void *data) return 0; } -/* Must be called in user context */ +/* + * Must be called in process context. The caller must hold the + * cpus_lock. + */ static int pseries_lpar_resize_hpt(unsigned long shift) { struct hpt_resize_state state = { @@ -1467,7 +1470,8 @@ static int pseries_lpar_resize_hpt(unsigned long shift) t1 = ktime_get(); - rc = stop_machine(pseries_lpar_resize_hpt_commit, &state, NULL); + rc = stop_machine_cpuslocked(pseries_lpar_resize_hpt_commit, + &state, NULL); t2 = ktime_get();

5 years, 9 months

2
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror