- Linux-stable-mirror - lists.linaro.org

zram: Unable to handle kernel NULL pointer dereference at virtual address

by Naresh Kamboju

While running kselftest zram test case on qemu arm this kernel warning. This has been reported on stable rc 5.4, 5.5 and 5.6 and mainline and next. [ 1277.176612] kselftest: Running tests in zram [ 1277.375891] zram: Added device: zram0 [ 1278.505516] zram0: detected capacity change from 0 to 2097152 [ 1278.545644] 8<--- cut here --- [ 1278.547036] Unable to handle kernel NULL pointer dereference at virtual address 00000000 [ 1278.550494] pgd = 385dcf93 [ 1278.551571] [00000000] *pgd=68116003, *pmd=1352f5003 [ 1278.553632] Internal error: Oops: 207 [#1] SMP ARM [ 1278.555463] Modules linked in: zram act_mirred cls_u32 nf_tables nfnetlink sch_etf sit ip_tables x_tables cls_bpf sch_fq algif_hash crc32_arm_ce sha2_arm_ce sha256_arm sha1_arm_ce sha1_arm aes_arm_ce crypto_simd fuse [last unloaded: test_user_copy] [ 1278.564699] CPU: 0 PID: 11598 Comm: mkfs.ext4 Not tainted 5.4.31-rc2 #1 [ 1278.567731] Hardware name: Generic DT based system [ 1278.569977] PC is at zs_map_object+0xc8/0x2ac [ 1278.572001] LR is at 0xe6058000 [ 1278.573603] pc : [<c0696858>] lr : [<e6058000>] psr: 600d0013 [ 1278.576602] sp : e6059a40 ip : 00000000 fp : e6059a84 [ 1278.579066] r10: 00000000 r9 : 00000002 r8 : 00000000 [ 1278.581600] r7 : ecff9000 r6 : ffed05e0 r5 : c20086c8 r4 : e4907000 [ 1278.584686] r3 : ecec95e0 r2 : c2842040 r1 : 00000030 r0 : 39aca001 [ 1278.587767] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user [ 1278.591171] Control: 30c5383d Table: 66f8d780 DAC: fffffffd [ 1278.593918] Process mkfs.ext4 (pid: 11598, stack limit = 0xb0888730) [ 1278.596941] Stack: (0xe6059a40 to 0xe605a000) [ 1278.599017] 9a40: c08c1e80 efec95e0 e6059aa8 e6059a58 c04228c4 bf1b31a7 e6059a84 e64bf400 [ 1278.602884] 9a60: d89c2000 00000008 e544f000 e5713680 c20086c8 e544f000 e6059adc e6059a88 [ 1278.606739] 9a80: bf0bad70 c069679c 00000000 00000001 ed496460 00000001 e55e8000 00017e3b [ 1278.610593] 9aa0: 00000001 c20086c8 00000041 bf1b31a7 00000000 00000000 00001000 00000001 [ 1278.614445] 9ac0: 00001000 e182d840 e64bf400 00001000 e6059b34 e6059ae0 bf0bb56c bf0ba9a4 [ 1278.618312] 9ae0: e182d840 c20086c8 c04cdd4c 00000000 c20086c8 00000000 ed496460 00001000 [ 1278.622227] 9b00: 00000000 bf1b31a7 c064f294 e55e8000 ffffe000 e182d840 00000000 c2043828 [ 1278.626154] 9b20: ffffffff c21db2a0 e6059b94 e6059b38 c091fc7c bf0bb3d8 c040f2a0 c040dca4 [ 1278.629802] 9b40: c20086c8 00000000 c20086c8 e6059b54 c06ee318 00000000 00000000 00000000 [ 1278.633759] 9b60: 00000000 bf1b31a7 c04cdf38 c20086c8 e182d840 00000801 00000800 00000008 [ 1278.637713] 9b80: 00000000 e58dfc68 e6059c04 e6059b98 c091ffc0 c091fb70 c05713c8 e182d840 [ 1278.641609] 9ba0: e54dc038 00001000 00000000 c06ee318 e54dc04c 00000000 e6059c04 e6059bc8 [ 1278.645549] 9bc0: c06ee0b0 c04cdb0c 00000001 00000000 c06ee318 bf1b31a7 00000000 e5a88580 [ 1278.649501] 9be0: e182d840 00000801 00000800 00000000 00000000 e58dfc68 e6059c2c e6059c08 [ 1278.653423] 9c00: c06ee354 c091ff78 00000001 e5a88580 e5a88580 e6059e58 00000800 00000000 [ 1278.657215] 9c20: e6059ca4 e6059c30 c06ee700 c06ee1c4 e6059e58 00000000 c06eeda0 e6059c48 [ 1278.661069] 9c40: c040dd24 c06f248c 00001000 c06ec500 c1bb920c 00000000 c20086c8 e6059e58 [ 1278.664917] 9c60: 00000800 ed496460 c140993c 00000000 e6059ca4 bf1b31a7 c05713c8 e58dfc68 [ 1278.668758] 9c80: ed496460 600d0013 e58dfd0c c06f2564 00000001 00000000 e6059cec e6059ca8 [ 1278.672618] 9ca0: c06eeda0 c06ee390 c06ec500 00000000 c06f2564 00000001 e6059e58 c06f248c [ 1278.676447] 9cc0: e54df048 e58dfdd8 00000002 c1b9e48c e6059d5c 00000001 e6059e58 e58dfdd8 [ 1278.680295] 9ce0: e6059cfc e6059cf0 c06f2564 c06eec1c e6059d14 e6059d00 c05f9820 c06f254c [ 1278.684100] 9d00: ed496460 00000002 e6059dcc e6059d18 c05fd4bc c05f9808 00000002 00000001 [ 1278.689217] 9d20: e6059d5c 00000000 00000001 c20086c8 c21dafe7 00000002 00000000 ffffffff [ 1278.693068] 9d40: e58dfdd8 c05f97fc c20086f4 ffffe000 c21dd694 00000010 000001f4 c06f000f [ 1278.696929] 9d60: ed6dcb50 ed496460 ed723590 ed6ef630 ed6e97e0 ed728360 ed726890 ed5b03d0 [ 1278.700775] 9d80: ed7841c0 ed451070 ed77b400 ed71fa80 ed493fd0 ed6f5a20 ed6a4570 bf1b31a7 [ 1278.704586] 9da0: ed723590 c20086c8 e58dfdd8 e6059e58 c1bacbec c20086c8 c05f97fc e58dfdd8 [ 1278.708401] 9dc0: e6059e04 e6059dd0 c05fd8c8 c05fd28c e6059dd0 e6059dd0 e6059dd8 e6059dd8 [ 1278.712208] 9de0: 00000000 bf1b31a7 e58dfc68 e6059e58 e58dfdd8 ffffffff e6059e14 e6059e08 [ 1278.716078] 9e00: c06f2514 c05fd870 e6059e54 e6059e18 c05fe524 c06f2508 e6059e54 e6059e28 [ 1278.719910] 9e20: c06da1ac c1410518 c141015c bf1b31a7 c20086c8 e58dfc68 ffffffff 7fffffff [ 1278.723755] 9e40: 00000000 00000000 e6059ecc e6059e58 c05f1570 c05fe4d4 7ffffffe 00000000 [ 1278.727581] 9e60: 00000000 00000000 ffffffff 7fffffff 00000001 00000000 00000000 00000000 [ 1278.731409] 9e80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 bf1b31a7 [ 1278.735228] 9ea0: e6059f34 ffffffff e58dfdd8 e676d7c0 7fffffff 00000000 00000000 00000076 [ 1278.739109] 9ec0: e6059f04 e6059ed0 c05f2cac c05f1480 ffffffff 7fffffff 00000001 00000000 [ 1278.742970] 9ee0: e676d7c8 ffffffff 7fffffff e58dfc68 c04011c4 e6058000 e6059f2c e6059f08 [ 1278.746848] 9f00: c06f1f20 c05f2c58 ffffffff 7fffffff e676d7c0 e676d7c0 00000000 ffffffff [ 1278.750806] 9f20: e6059f64 e6059f30 c06e437c c06f1f00 ffffffff 7fffffff 00000000 00000000 [ 1278.754698] 9f40: c06c6a98 c06c59dc e676d7c0 e676d7c0 00000000 00000076 e6059f94 e6059f68 [ 1278.758553] 9f60: c06e4444 c06e433c ffffffff 7fffffff 00000000 c0401100 e6059fac 0003b8f0 [ 1278.762465] 9f80: 0003b7e8 00000000 e6059fa4 e6059f98 c06e4764 c06e4404 00000000 e6059fa8 [ 1278.766315] 9fa0: c0401000 c06e4754 0003b8f0 0003b7e8 00000005 00046a80 00000064 00000000 [ 1278.770146] 9fc0: 0003b8f0 0003b7e8 00000000 00000076 00000000 bea318f8 bea318e8 bea318f0 [ 1278.773976] 9fe0: b6da85ec bea31898 b6eea0d0 b6da8614 600d0010 00000005 00000000 00000000 [ 1278.777818] Backtrace: [ 1278.779056] [<c0696790>] (zs_map_object) from [<bf0bad70>] (zram_bvec_rw.constprop.2+0x3d8/0xa34 [zram]) [ 1278.783562] r10:e544f000 r9:c20086c8 r8:e5713680 r7:e544f000 r6:00000008 r5:d89c2000 [ 1278.787300] r4:e64bf400 [ 1278.788619] [<bf0ba998>] (zram_bvec_rw.constprop.2 [zram]) from [<bf0bb56c>] (zram_make_request+0x1a0/0x494 [zram]) [ 1278.793537] r10:00001000 r9:e64bf400 r8:e182d840 r7:00001000 r6:00000001 r5:00001000 [ 1278.797252] r4:00000000 [ 1278.798512] [<bf0bb3cc>] (zram_make_request [zram]) from [<c091fc7c>] (generic_make_request+0x118/0x408) [ 1278.803535] r10:c21db2a0 r9:ffffffff r8:c2043828 r7:00000000 r6:e182d840 r5:ffffe000 [ 1278.807294] r4:e55e8000 [ 1278.808572] [<c091fb64>] (generic_make_request) from [<c091ffc0>] (submit_bio+0x54/0x1c4) [ 1278.812454] r10:e58dfc68 r9:00000000 r8:00000008 r7:00000800 r6:00000801 r5:e182d840 [ 1278.816137] r4:c20086c8 [ 1278.817417] [<c091ff6c>] (submit_bio) from [<c06ee354>] (submit_bh_wbc+0x19c/0x1cc) [ 1278.821098] r10:e58dfc68 r9:00000000 r8:00000000 r7:00000800 r6:00000801 r5:e182d840 [ 1278.824858] r4:e5a88580 [ 1278.826122] [<c06ee1b8>] (submit_bh_wbc) from [<c06ee700>] (__block_write_full_page+0x37c/0x6f0) [ 1278.830284] r9:00000000 r8:00000800 r7:e6059e58 r6:e5a88580 r5:e5a88580 r4:00000001 [ 1278.833968] [<c06ee384>] (__block_write_full_page) from [<c06eeda0>] (block_write_full_page+0x190/0x198) [ 1278.838448] r10:00000000 r9:00000001 r8:c06f2564 r7:e58dfd0c r6:600d0013 r5:ed496460 [ 1278.842157] r4:e58dfc68 [ 1278.843410] [<c06eec10>] (block_write_full_page) from [<c06f2564>] (blkdev_writepage+0x24/0x28) [ 1278.847528] r10:e58dfdd8 r9:e6059e58 r8:00000001 r7:e6059d5c r6:c1b9e48c r5:00000002 [ 1278.851241] r4:e58dfdd8 [ 1278.852509] [<c06f2540>] (blkdev_writepage) from [<c05f9820>] (__writepage+0x24/0x5c) [ 1278.856201] [<c05f97fc>] (__writepage) from [<c05fd4bc>] (write_cache_pages+0x23c/0x5e4) [ 1278.860010] r5:00000002 r4:ed496460 [ 1278.861756] [<c05fd280>] (write_cache_pages) from [<c05fd8c8>] (generic_writepages+0x64/0x90) [ 1278.865824] r10:e58dfdd8 r9:c05f97fc r8:c20086c8 r7:c1bacbec r6:e6059e58 r5:e58dfdd8 [ 1278.869552] r4:c20086c8 [ 1278.870805] [<c05fd864>] (generic_writepages) from [<c06f2514>] (blkdev_writepages+0x18/0x1c) [ 1278.874871] r6:ffffffff r5:e58dfdd8 r4:e6059e58 [ 1278.877398] [<c06f24fc>] (blkdev_writepages) from [<c05fe524>] (do_writepages+0x5c/0x108) [ 1278.881292] [<c05fe4c8>] (do_writepages) from [<c05f1570>] (__filemap_fdatawrite_range+0xfc/0x128) [ 1278.885538] r9:00000000 r8:00000000 r7:7fffffff r6:ffffffff r5:e58dfc68 r4:c20086c8 [ 1278.889480] [<c05f1474>] (__filemap_fdatawrite_range) from [<c05f2cac>] (file_write_and_wait_range+0x60/0xb4) [ 1278.894166] r10:00000076 r9:00000000 r8:00000000 r7:7fffffff r6:e676d7c0 r5:e58dfdd8 [ 1278.897979] r4:ffffffff [ 1278.899227] [<c05f2c4c>] (file_write_and_wait_range) from [<c06f1f20>] (blkdev_fsync+0x2c/0x58) [ 1278.903348] r9:e6058000 r8:c04011c4 r6:e58dfc68 r5:7fffffff r4:ffffffff [ 1278.906618] [<c06f1ef4>] (blkdev_fsync) from [<c06e437c>] (vfs_fsync_range+0x4c/0x8c) [ 1278.910366] r6:ffffffff r5:00000000 r4:e676d7c0 [ 1278.912646] [<c06e4330>] (vfs_fsync_range) from [<c06e4444>] (do_fsync+0x4c/0x74) [ 1278.916241] r7:00000076 r6:00000000 r5:e676d7c0 r4:e676d7c0 [ 1278.918974] [<c06e43f8>] (do_fsync) from [<c06e4764>] (sys_fsync+0x1c/0x20) [ 1278.922350] r6:00000000 r5:0003b7e8 r4:0003b8f0 [ 1278.924675] [<c06e4748>] (sys_fsync) from [<c0401000>] (ret_fast_syscall+0x0/0x28) [ 1278.928344] Exception stack(0xe6059fa8 to 0xe6059ff0) [ 1278.930781] 9fa0: 0003b8f0 0003b7e8 00000005 00046a80 00000064 00000000 [ 1278.934719] 9fc0: 0003b8f0 0003b7e8 00000000 00000076 00000000 bea318f8 bea318e8 bea318f0 [ 1278.938627] 9fe0: b6da85ec bea31898 b6eea0d0 b6da8614 [ 1278.941101] Code: e5927000 e0060391 e0873006 e5938018 (e5982000) [ 1278.944270] ---[ end trace 2de575b2ace669f8 ]--- [ 1278.947457] note: mkfs.ext4[11598] exited with preempt_count 2 Full test log, https://lkft.validation.linaro.org/scheduler/job/1350791#L15827 https://lkft.validation.linaro.org/scheduler/job/1351118#L15840 https://lkft.validation.linaro.org/scheduler/job/1350630#L16995 -- Linaro LKFT https://lkft.linaro.org

5 years, 8 months

2
1
0 0

[PATCH] i2c: designware: platdrv: Remove DPM_FLAG_SMART_SUSPEND flag on BYT and CHT

by Hans de Goede

We already set DPM_FLAG_SMART_PREPARE, so we completely skip all callbacks (other then prepare) where possible, quoting from dw_i2c_plat_prepare(): /* * If the ACPI companion device object is present for this device, it * may be accessed during suspend and resume of other devices via I2C * operation regions, so tell the PM core and middle layers to avoid * skipping system suspend/resume callbacks for it in that case. */ return !has_acpi_companion(dev); Also setting the DPM_FLAG_SMART_SUSPEND will cause acpi_subsys_suspend() to leave the controller runtime-suspended even if dw_i2c_plat_prepare() returned 0. Leaving the controller runtime-suspended normally, when the I2C controller is suspended during the suspend_late phase, is not an issue because the pm_runtime_get_sync() done by i2c_dw_xfer() will (runtime-)resume it. But for dw I2C controllers on Bay- and Cherry-Trail devices acpi_lpss.c leaves the controller alive until the suspend_noirq phase, because it may be used by the _PS3 ACPI methods of PCI devices and PCI devices are left powered on until the suspend_noirq phase. Between the suspend_late and resume_early phases runtime-pm is disabled. So for any ACPI I2C OPRegion accesses done after the suspend_late phase, the pm_runtime_get_sync() done by i2c_dw_xfer() is a no-op and the controller is left runtime-suspended. i2c_dw_xfer() has a check to catch this condition (rather then waiting for the I2C transfer to timeout because the controller is suspended). acpi_subsys_suspend() leaving the controller runtime-suspended in combination with an ACPI I2C OPRegion access done after the suspend_late phase triggers this check, leading to the following error being logged on a Bay Trail based Lenovo Thinkpad 8 tablet: [ 93.275882] i2c_designware 80860F41:00: Transfer while suspended [ 93.275993] WARNING: CPU: 0 PID: 412 at drivers/i2c/busses/i2c-designware-master.c:429 i2c_dw_xfer+0x239/0x280 ... [ 93.276252] Workqueue: kacpi_notify acpi_os_execute_deferred [ 93.276267] RIP: 0010:i2c_dw_xfer+0x239/0x280 ... [ 93.276340] Call Trace: [ 93.276366] __i2c_transfer+0x121/0x520 [ 93.276379] i2c_transfer+0x4c/0x100 [ 93.276392] i2c_acpi_space_handler+0x219/0x510 [ 93.276408] ? up+0x40/0x60 [ 93.276419] ? i2c_acpi_notify+0x130/0x130 [ 93.276433] acpi_ev_address_space_dispatch+0x1e1/0x252 ... So since on BYT and CHT platforms we want ACPI I2c OPRegion accesses to work until the suspend_noirq phase, we need the controller to be runtime-resumed during the suspend phase if it is runtime-suspended suspended at that time. This means that we must not set the DPM_FLAG_SMART_SUSPEND on these platforms. On BYT and CHT we already have a special ACCESS_NO_IRQ_SUSPEND flag to make sure the controller stays functional until the suspend_noirq phase. This commit makes the driver not set the DPM_FLAG_SMART_SUSPEND flag when that flag is set. Cc: stable(a)vger.kernel.org Fixes: b30f2f65568f ("i2c: designware: Set IRQF_NO_SUSPEND flag for all BYT and CHT controllers") Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> --- drivers/i2c/busses/i2c-designware-platdrv.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c index 3b7d58c2fe85..15b4b965b443 100644 --- a/drivers/i2c/busses/i2c-designware-platdrv.c +++ b/drivers/i2c/busses/i2c-designware-platdrv.c @@ -371,10 +371,16 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) adap->dev.of_node = pdev->dev.of_node; adap->nr = -1; - dev_pm_set_driver_flags(&pdev->dev, - DPM_FLAG_SMART_PREPARE | - DPM_FLAG_SMART_SUSPEND | - DPM_FLAG_LEAVE_SUSPENDED); + if (dev->flags & ACCESS_NO_IRQ_SUSPEND) { + dev_pm_set_driver_flags(&pdev->dev, + DPM_FLAG_SMART_PREPARE | + DPM_FLAG_LEAVE_SUSPENDED); + } else { + dev_pm_set_driver_flags(&pdev->dev, + DPM_FLAG_SMART_PREPARE | + DPM_FLAG_SMART_SUSPEND | + DPM_FLAG_LEAVE_SUSPENDED); + } /* The code below assumes runtime PM to be disabled. */ WARN_ON(pm_runtime_enabled(&pdev->dev)); -- 2.26.0

5 years, 8 months

5
4
0 0

[PATCHES] Networking

by David Miller

Please queue up the following networking bug fixes for v5.5 and v5.6 -stable, respectively. Also, there is a Realtek PHY patch attached which should be queued up for v5.4. Thank you.

5 years, 8 months

2
1
0 0

[PATCH for 4.4.y] xen-netfront: Update features after registering netdev

by Nobuhiro Iwamatsu

From: Ross Lagerwall <ross.lagerwall(a)citrix.com> commit 45c8184c1bed1ca8a7f02918552063a00b909bf5 upstream. Update the features after calling register_netdev() otherwise the device features are not set up correctly and it not possible to change the MTU of the device. After this change, the features reported by ethtool match the device's features before the commit which introduced the issue and it is possible to change the device's MTU. Fixes: f599c64fdf7d ("xen-netfront: Fix race between device setup and open") Reported-by: Liam Shepherd <liam(a)dancer.es> Signed-off-by: Ross Lagerwall <ross.lagerwall(a)citrix.com> Reviewed-by: Juergen Gross <jgross(a)suse.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu(a)toshiba.co.jp> --- drivers/net/xen-netfront.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c index 744b111cff6a3..e99a07d5fda71 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -1982,10 +1982,6 @@ static int xennet_connect(struct net_device *dev) /* talk_to_netback() sets the correct number of queues */ num_queues = dev->real_num_tx_queues; - rtnl_lock(); - netdev_update_features(dev); - rtnl_unlock(); - if (dev->reg_state == NETREG_UNINITIALIZED) { err = register_netdev(dev); if (err) { @@ -1995,6 +1991,10 @@ static int xennet_connect(struct net_device *dev) } } + rtnl_lock(); + netdev_update_features(dev); + rtnl_unlock(); + /* * All public and private state should now be sane. Get * ready to start sending and receiving packets and give the driver -- 2.26.0

5 years, 8 months

1
0
0 0

[PATCH for 4.4.y] xen-netfront: Fix mismatched rtnl_unlock

by Nobuhiro Iwamatsu

From: Ross Lagerwall <ross.lagerwall(a)citrix.com> commit cb257783c2927b73614b20f915a91ff78aa6f3e8 upstream. Fixes: f599c64fdf7d ("xen-netfront: Fix race between device setup and open") Reported-by: Ben Hutchings <ben.hutchings(a)codethink.co.uk> Signed-off-by: Ross Lagerwall <ross.lagerwall(a)citrix.com> Reviewed-by: Juergen Gross <jgross(a)suse.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu(a)toshiba.co.jp> --- drivers/net/xen-netfront.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c index 89eec6fead753..744b111cff6a3 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -1835,7 +1835,7 @@ static int talk_to_netback(struct xenbus_device *dev, err = xen_net_read_mac(dev, info->netdev->dev_addr); if (err) { xenbus_dev_fatal(dev, err, "parsing %s/mac", dev->nodename); - goto out; + goto out_unlocked; } rtnl_lock(); @@ -1950,6 +1950,7 @@ abort_transaction_no_dev_fatal: xennet_destroy_queues(info); out: rtnl_unlock(); +out_unlocked: device_unregister(&dev->dev); return err; } -- 2.26.0

5 years, 8 months

1
0
0 0

+ ocfs2-no-need-try-to-truncate-file-beyond-i_size.patch added to -mm tree

by Andrew Morton

The patch titled Subject: ocfs2: no need try to truncate file beyond i_size has been added to the -mm tree. Its filename is ocfs2-no-need-try-to-truncate-file-beyond-i_size.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/ocfs2-no-need-try-to-truncate-file… and later at http://ozlabs.org/~akpm/mmotm/broken-out/ocfs2-no-need-try-to-truncate-file… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Changwei Ge <chge(a)linux.alibaba.com> Subject: ocfs2: no need try to truncate file beyond i_size Linux fallocate(2) with FALLOC_FL_PUNCH_HOLE mode set, its offset can exceed inode size. Ocfs2 now does't allow that offset beyond inode size. This restriction is not necessary and voilates fallocate(2) semantics. If fallocate(2) offset is beyond inode size, just return success and do nothing further. Otherwise, ocfs2 will crash the kernel. kernel BUG at fs/ocfs2//alloc.c:7264! ocfs2_truncate_inline+0x20f/0x360 [ocfs2] ? ocfs2_read_blocks+0x2f3/0x5f0 [ocfs2] ocfs2_remove_inode_range+0x23c/0xcb0 [ocfs2] ? ocfs2_read_inode_block+0x10/0x20 [ocfs2] ? ocfs2_allocate_extend_trans+0x1a0/0x1a0 [ocfs2] __ocfs2_change_file_space+0x4a5/0x650 [ocfs2] ocfs2_fallocate+0x83/0xa0 [ocfs2] ? __audit_syscall_entry+0xb8/0x100 ? __sb_start_write+0x3b/0x70 vfs_fallocate+0x148/0x230 SyS_fallocate+0x48/0x80 do_syscall_64+0x79/0x170 Link: http://lkml.kernel.org/r/20200407082754.17565-1-chge@linux.alibaba.com Signed-off-by: Changwei Ge <chge(a)linux.alibaba.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/ocfs2/alloc.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/fs/ocfs2/alloc.c~ocfs2-no-need-try-to-truncate-file-beyond-i_size +++ a/fs/ocfs2/alloc.c @@ -7402,6 +7402,10 @@ int ocfs2_truncate_inline(struct inode * struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data; struct ocfs2_inline_data *idata = &di->id2.i_data; + /* No need to punch hole beyond i_size. */ + if (start >= i_size_read(inode)) + return 0; + if (end > i_size_read(inode)) end = i_size_read(inode); _ Patches currently in -mm which might be from chge(a)linux.alibaba.com are ocfs2-no-need-try-to-truncate-file-beyond-i_size.patch

5 years, 8 months

1
0
0 0

[nacked] list-prevent-compiler-reloads-inside-safe-list-iteration.patch removed from -mm tree

by Andrew Morton

The patch titled Subject: lib/list: prevent compiler reloads inside 'safe' list iteration has been removed from the -mm tree. Its filename was list-prevent-compiler-reloads-inside-safe-list-iteration.patch This patch was dropped because it was nacked ------------------------------------------------------ From: Chris Wilson <chris(a)chris-wilson.co.uk> Subject: lib/list: prevent compiler reloads inside 'safe' list iteration Instruct the compiler to read the next element in the list iteration once, and that it is not allowed to reload the value from the stale element later. This is important as during the course of the safe iteration, the stale element may be poisoned (unbeknownst to the compiler). This helps prevent kcsan warnings over 'unsafe' conduct in releasing the list elements during list_for_each_entry_safe() and friends. Link: http://lkml.kernel.org/r/20200310092119.14965-1-chris@chris-wilson.co.uk Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk> Reviewed-by: Paul E. McKenney <paulmck(a)kernel.org> Cc: Randy Dunlap <rdunlap(a)infradead.org> Cc: David Laight <David.Laight(a)ACULAB.COM> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Marco Elver <elver(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/list.h | 50 +++++++++++++++++++++++++++++------------ 1 file changed, 36 insertions(+), 14 deletions(-) --- a/include/linux/list.h~list-prevent-compiler-reloads-inside-safe-list-iteration +++ a/include/linux/list.h @@ -537,6 +537,17 @@ static inline void list_splice_tail_init list_entry((pos)->member.next, typeof(*(pos)), member) /** + * list_next_entry_safe - get the next element in list [once] + * @pos: the type * to cursor + * @member: the name of the list_head within the struct. + * + * Like list_next_entry() but prevents the compiler from reloading the + * next element. + */ +#define list_next_entry_safe(pos, member) \ + list_entry(READ_ONCE((pos)->member.next), typeof(*(pos)), member) + +/** * list_prev_entry - get the prev element in list * @pos: the type * to cursor * @member: the name of the list_head within the struct. @@ -545,6 +556,17 @@ static inline void list_splice_tail_init list_entry((pos)->member.prev, typeof(*(pos)), member) /** + * list_prev_entry_safe - get the prev element in list [once] + * @pos: the type * to cursor + * @member: the name of the list_head within the struct. + * + * Like list_prev_entry() but prevents the compiler from reloading the + * previous element. + */ +#define list_prev_entry_safe(pos, member) \ + list_entry(READ_ONCE((pos)->member.prev), typeof(*(pos)), member) + +/** * list_for_each - iterate over a list * @pos: the &struct list_head to use as a loop cursor. * @head: the head for your list. @@ -686,9 +708,9 @@ static inline void list_splice_tail_init */ #define list_for_each_entry_safe(pos, n, head, member) \ for (pos = list_first_entry(head, typeof(*pos), member), \ - n = list_next_entry(pos, member); \ + n = list_next_entry_safe(pos, member); \ &pos->member != (head); \ - pos = n, n = list_next_entry(n, member)) + pos = n, n = list_next_entry_safe(n, member)) /** * list_for_each_entry_safe_continue - continue list iteration safe against removal @@ -700,11 +722,11 @@ static inline void list_splice_tail_init * Iterate over list of given type, continuing after current point, * safe against removal of list entry. */ -#define list_for_each_entry_safe_continue(pos, n, head, member) \ - for (pos = list_next_entry(pos, member), \ - n = list_next_entry(pos, member); \ - &pos->member != (head); \ - pos = n, n = list_next_entry(n, member)) +#define list_for_each_entry_safe_continue(pos, n, head, member) \ + for (pos = list_next_entry(pos, member), \ + n = list_next_entry_safe(pos, member); \ + &pos->member != (head); \ + pos = n, n = list_next_entry_safe(n, member)) /** * list_for_each_entry_safe_from - iterate over list from current point safe against removal @@ -716,10 +738,10 @@ static inline void list_splice_tail_init * Iterate over list of given type from current point, safe against * removal of list entry. */ -#define list_for_each_entry_safe_from(pos, n, head, member) \ - for (n = list_next_entry(pos, member); \ - &pos->member != (head); \ - pos = n, n = list_next_entry(n, member)) +#define list_for_each_entry_safe_from(pos, n, head, member) \ + for (n = list_next_entry_safe(pos, member); \ + &pos->member != (head); \ + pos = n, n = list_next_entry_safe(n, member)) /** * list_for_each_entry_safe_reverse - iterate backwards over list safe against removal @@ -733,9 +755,9 @@ static inline void list_splice_tail_init */ #define list_for_each_entry_safe_reverse(pos, n, head, member) \ for (pos = list_last_entry(head, typeof(*pos), member), \ - n = list_prev_entry(pos, member); \ + n = list_prev_entry_safe(pos, member); \ &pos->member != (head); \ - pos = n, n = list_prev_entry(n, member)) + pos = n, n = list_prev_entry_safe(n, member)) /** * list_safe_reset_next - reset a stale list_for_each_entry_safe loop @@ -750,7 +772,7 @@ static inline void list_splice_tail_init * completing the current iteration of the loop body. */ #define list_safe_reset_next(pos, n, member) \ - n = list_next_entry(pos, member) + n = list_next_entry_safe(pos, member) /* * Double linked lists with a single pointer list head. _ Patches currently in -mm which might be from chris(a)chris-wilson.co.uk are

5 years, 8 months

1
0
0 0

[patch 125/166] lib/list: prevent compiler reloads inside 'safe' list iteration

by Andrew Morton

From: Chris Wilson <chris(a)chris-wilson.co.uk> Subject: lib/list: prevent compiler reloads inside 'safe' list iteration Instruct the compiler to read the next element in the list iteration once, and that it is not allowed to reload the value from the stale element later. This is important as during the course of the safe iteration, the stale element may be poisoned (unbeknownst to the compiler). This helps prevent kcsan warnings over 'unsafe' conduct in releasing the list elements during list_for_each_entry_safe() and friends. Link: http://lkml.kernel.org/r/20200310092119.14965-1-chris@chris-wilson.co.uk Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk> Reviewed-by: Paul E. McKenney <paulmck(a)kernel.org> Cc: Randy Dunlap <rdunlap(a)infradead.org> Cc: David Laight <David.Laight(a)ACULAB.COM> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Marco Elver <elver(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/list.h | 50 +++++++++++++++++++++++++++++------------ 1 file changed, 36 insertions(+), 14 deletions(-) --- a/include/linux/list.h~list-prevent-compiler-reloads-inside-safe-list-iteration +++ a/include/linux/list.h @@ -537,6 +537,17 @@ static inline void list_splice_tail_init list_entry((pos)->member.next, typeof(*(pos)), member) /** + * list_next_entry_safe - get the next element in list [once] + * @pos: the type * to cursor + * @member: the name of the list_head within the struct. + * + * Like list_next_entry() but prevents the compiler from reloading the + * next element. + */ +#define list_next_entry_safe(pos, member) \ + list_entry(READ_ONCE((pos)->member.next), typeof(*(pos)), member) + +/** * list_prev_entry - get the prev element in list * @pos: the type * to cursor * @member: the name of the list_head within the struct. @@ -545,6 +556,17 @@ static inline void list_splice_tail_init list_entry((pos)->member.prev, typeof(*(pos)), member) /** + * list_prev_entry_safe - get the prev element in list [once] + * @pos: the type * to cursor + * @member: the name of the list_head within the struct. + * + * Like list_prev_entry() but prevents the compiler from reloading the + * previous element. + */ +#define list_prev_entry_safe(pos, member) \ + list_entry(READ_ONCE((pos)->member.prev), typeof(*(pos)), member) + +/** * list_for_each - iterate over a list * @pos: the &struct list_head to use as a loop cursor. * @head: the head for your list. @@ -686,9 +708,9 @@ static inline void list_splice_tail_init */ #define list_for_each_entry_safe(pos, n, head, member) \ for (pos = list_first_entry(head, typeof(*pos), member), \ - n = list_next_entry(pos, member); \ + n = list_next_entry_safe(pos, member); \ &pos->member != (head); \ - pos = n, n = list_next_entry(n, member)) + pos = n, n = list_next_entry_safe(n, member)) /** * list_for_each_entry_safe_continue - continue list iteration safe against removal @@ -700,11 +722,11 @@ static inline void list_splice_tail_init * Iterate over list of given type, continuing after current point, * safe against removal of list entry. */ -#define list_for_each_entry_safe_continue(pos, n, head, member) \ - for (pos = list_next_entry(pos, member), \ - n = list_next_entry(pos, member); \ - &pos->member != (head); \ - pos = n, n = list_next_entry(n, member)) +#define list_for_each_entry_safe_continue(pos, n, head, member) \ + for (pos = list_next_entry(pos, member), \ + n = list_next_entry_safe(pos, member); \ + &pos->member != (head); \ + pos = n, n = list_next_entry_safe(n, member)) /** * list_for_each_entry_safe_from - iterate over list from current point safe against removal @@ -716,10 +738,10 @@ static inline void list_splice_tail_init * Iterate over list of given type from current point, safe against * removal of list entry. */ -#define list_for_each_entry_safe_from(pos, n, head, member) \ - for (n = list_next_entry(pos, member); \ - &pos->member != (head); \ - pos = n, n = list_next_entry(n, member)) +#define list_for_each_entry_safe_from(pos, n, head, member) \ + for (n = list_next_entry_safe(pos, member); \ + &pos->member != (head); \ + pos = n, n = list_next_entry_safe(n, member)) /** * list_for_each_entry_safe_reverse - iterate backwards over list safe against removal @@ -733,9 +755,9 @@ static inline void list_splice_tail_init */ #define list_for_each_entry_safe_reverse(pos, n, head, member) \ for (pos = list_last_entry(head, typeof(*pos), member), \ - n = list_prev_entry(pos, member); \ + n = list_prev_entry_safe(pos, member); \ &pos->member != (head); \ - pos = n, n = list_prev_entry(n, member)) + pos = n, n = list_prev_entry_safe(n, member)) /** * list_safe_reset_next - reset a stale list_for_each_entry_safe loop @@ -750,7 +772,7 @@ static inline void list_splice_tail_init * completing the current iteration of the loop body. */ #define list_safe_reset_next(pos, n, member) \ - n = list_next_entry(pos, member) + n = list_next_entry_safe(pos, member) /* * Double linked lists with a single pointer list head. _

5 years, 8 months

5
13
0 0

[PATCH] smack: avoid unused 'sip' variable warning

by Arnd Bergmann

The mix of IS_ENABLED() and #ifdef checks has left a combination that causes a warning about an unused variable: security/smack/smack_lsm.c: In function 'smack_socket_connect': security/smack/smack_lsm.c:2838:24: error: unused variable 'sip' [-Werror=unused-variable] 2838 | struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap; Change the code to use C-style checks consistently so the compiler can handle it correctly. Fixes: 87fbfffcc89b ("broken ping to ipv6 linklocal addresses on debian buster") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> --- There are lots of ways of addressing this, if you prefer a different way, please just treat this patch as a bug report and apply the replacement patch directly. --- security/smack/smack.h | 6 ------ security/smack/smack_lsm.c | 25 ++++++++----------------- 2 files changed, 8 insertions(+), 23 deletions(-) diff --git a/security/smack/smack.h b/security/smack/smack.h index 62529f382942..335d2411abe4 100644 --- a/security/smack/smack.h +++ b/security/smack/smack.h @@ -148,7 +148,6 @@ struct smk_net4addr { struct smack_known *smk_label; /* label */ }; -#if IS_ENABLED(CONFIG_IPV6) /* * An entry in the table identifying IPv6 hosts. */ @@ -159,9 +158,7 @@ struct smk_net6addr { int smk_masks; /* mask size */ struct smack_known *smk_label; /* label */ }; -#endif /* CONFIG_IPV6 */ -#ifdef SMACK_IPV6_PORT_LABELING /* * An entry in the table identifying ports. */ @@ -174,7 +171,6 @@ struct smk_port_label { short smk_sock_type; /* Socket type */ short smk_can_reuse; }; -#endif /* SMACK_IPV6_PORT_LABELING */ struct smack_known_list_elem { struct list_head list; @@ -335,9 +331,7 @@ extern struct smack_known smack_known_web; extern struct mutex smack_known_lock; extern struct list_head smack_known_list; extern struct list_head smk_net4addr_list; -#if IS_ENABLED(CONFIG_IPV6) extern struct list_head smk_net6addr_list; -#endif /* CONFIG_IPV6 */ extern struct mutex smack_onlycap_lock; extern struct list_head smack_onlycap_list; diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 8c61d175e195..e193b0db0271 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -50,10 +50,8 @@ #define SMK_RECEIVING 1 #define SMK_SENDING 2 -#ifdef SMACK_IPV6_PORT_LABELING -DEFINE_MUTEX(smack_ipv6_lock); +static DEFINE_MUTEX(smack_ipv6_lock); static LIST_HEAD(smk_ipv6_port_list); -#endif static struct kmem_cache *smack_inode_cache; struct kmem_cache *smack_rule_cache; int smack_enabled; @@ -2320,7 +2318,6 @@ static struct smack_known *smack_ipv4host_label(struct sockaddr_in *sip) return NULL; } -#if IS_ENABLED(CONFIG_IPV6) /* * smk_ipv6_localhost - Check for local ipv6 host address * @sip: the address @@ -2388,7 +2385,6 @@ static struct smack_known *smack_ipv6host_label(struct sockaddr_in6 *sip) return NULL; } -#endif /* CONFIG_IPV6 */ /** * smack_netlabel - Set the secattr on a socket @@ -2477,7 +2473,6 @@ static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap) return smack_netlabel(sk, sk_lbl); } -#if IS_ENABLED(CONFIG_IPV6) /** * smk_ipv6_check - check Smack access * @subject: subject Smack label @@ -2510,7 +2505,6 @@ static int smk_ipv6_check(struct smack_known *subject, rc = smk_bu_note("IPv6 check", subject, object, MAY_WRITE, rc); return rc; } -#endif /* CONFIG_IPV6 */ #ifdef SMACK_IPV6_PORT_LABELING /** @@ -2599,6 +2593,7 @@ static void smk_ipv6_port_label(struct socket *sock, struct sockaddr *address) mutex_unlock(&smack_ipv6_lock); return; } +#endif /** * smk_ipv6_port_check - check Smack port access @@ -2661,7 +2656,6 @@ static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address, return smk_ipv6_check(skp, object, address, act); } -#endif /* SMACK_IPV6_PORT_LABELING */ /** * smack_inode_setsecurity - set smack xattrs @@ -2836,24 +2830,21 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap, return 0; if (IS_ENABLED(CONFIG_IPV6) && sap->sa_family == AF_INET6) { struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap; -#ifdef SMACK_IPV6_SECMARK_LABELING - struct smack_known *rsp; -#endif + struct smack_known *rsp = NULL; if (addrlen < SIN6_LEN_RFC2133) return 0; -#ifdef SMACK_IPV6_SECMARK_LABELING - rsp = smack_ipv6host_label(sip); + if (__is_defined(SMACK_IPV6_SECMARK_LABELING)) + rsp = smack_ipv6host_label(sip); if (rsp != NULL) { struct socket_smack *ssp = sock->sk->sk_security; rc = smk_ipv6_check(ssp->smk_out, rsp, sip, SMK_CONNECTING); } -#endif -#ifdef SMACK_IPV6_PORT_LABELING - rc = smk_ipv6_port_check(sock->sk, sip, SMK_CONNECTING); -#endif + if (__is_defined(SMACK_IPV6_PORT_LABELING)) + rc = smk_ipv6_port_check(sock->sk, sip, SMK_CONNECTING); + return rc; } if (sap->sa_family != AF_INET || addrlen < sizeof(struct sockaddr_in)) -- 2.26.0

5 years, 8 months

2
1
0 0

[PATCH] drm: avoid spurious EBUSY due to nonblocking atomic modesets

by Daniel Vetter

When doing an atomic modeset with ALLOW_MODESET drivers are allowed to pull in arbitrary other resources, including CRTCs (e.g. when reconfiguring global resources). But in nonblocking mode userspace has then no idea this happened, which can lead to spurious EBUSY calls, both: - when that other CRTC is currently busy doing a page_flip the ALLOW_MODESET commit can fail with an EBUSY - on the other CRTC a normal atomic flip can fail with EBUSY because of the additional commit inserted by the kernel without userspace's knowledge For blocking commits this isn't a problem, because everyone else will just block until all the CRTC are reconfigured. Only thing userspace can notice is the dropped frames without any reason for why frames got dropped. Consensus is that we need new uapi to handle this properly, but no one has any idea what exactly the new uapi should look like. As a stop-gap plug this problem by demoting nonblocking commits which might cause issues by including CRTCs not in the original request to blocking commits. v2: Add comments and a WARN_ON to enforce this only when allowed - we don't want to silently convert page flips into blocking plane updates just because the driver is buggy. v3: Fix inverted WARN_ON (Pekka). References: https://lists.freedesktop.org/archives/dri-devel/2018-July/182281.html Bugzilla: https://gitlab.freedesktop.org/wayland/weston/issues/24#note_9568 Cc: Daniel Stone <daniel(a)fooishbar.org> Cc: Pekka Paalanen <pekka.paalanen(a)collabora.co.uk> Cc: stable(a)vger.kernel.org Reviewed-by: Daniel Stone <daniels(a)collabora.com> Signed-off-by: Daniel Vetter <daniel.vetter(a)intel.com> --- drivers/gpu/drm/drm_atomic.c | 34 +++++++++++++++++++++++++++++++--- 1 file changed, 31 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index 9ccfbf213d72..4c035abf98b8 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -1362,15 +1362,43 @@ EXPORT_SYMBOL(drm_atomic_commit); int drm_atomic_nonblocking_commit(struct drm_atomic_state *state) { struct drm_mode_config *config = &state->dev->mode_config; - int ret; + unsigned requested_crtc = 0; + unsigned affected_crtc = 0; + struct drm_crtc *crtc; + struct drm_crtc_state *crtc_state; + bool nonblocking = true; + int ret, i; + + /* + * For commits that allow modesets drivers can add other CRTCs to the + * atomic commit, e.g. when they need to reallocate global resources. + * + * But when userspace also requests a nonblocking commit then userspace + * cannot know that the commit affects other CRTCs, which can result in + * spurious EBUSY failures. Until we have better uapi plug this by + * demoting such commits to blocking mode. + */ + for_each_new_crtc_in_state(state, crtc, crtc_state, i) + requested_crtc |= drm_crtc_mask(crtc); ret = drm_atomic_check_only(state); if (ret) return ret; - DRM_DEBUG_ATOMIC("committing %p nonblocking\n", state); + for_each_new_crtc_in_state(state, crtc, crtc_state, i) + affected_crtc |= drm_crtc_mask(crtc); + + if (affected_crtc != requested_crtc) { + /* adding other CRTC is only allowed for modeset commits */ + WARN_ON(!state->allow_modeset); + + DRM_DEBUG_ATOMIC("demoting %p to blocking mode to avoid EBUSY\n", state); + nonblocking = false; + } else { + DRM_DEBUG_ATOMIC("committing %p nonblocking\n", state); + } - return config->funcs->atomic_commit(state->dev, state, true); + return config->funcs->atomic_commit(state->dev, state, nonblocking); } EXPORT_SYMBOL(drm_atomic_nonblocking_commit); -- 2.24.1

5 years, 8 months

2
5
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror