- Linux-stable-mirror - lists.linaro.org

by Greg KH

I'm announcing the release of the 5.4.17 kernel. All users of the 5.4 kernel series must upgrade. The updated 5.4.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arc/plat-eznps/Kconfig | 2 arch/arm/configs/aspeed_g5_defconfig | 1 arch/arm64/kvm/debug.c | 6 arch/um/include/asm/common.lds.S | 2 arch/um/kernel/dyn.lds.S | 1 crypto/af_alg.c | 6 crypto/pcrypt.c | 3 drivers/android/binder.c | 37 +-- drivers/atm/eni.c | 4 drivers/base/component.c | 8 drivers/base/test/test_async_driver_probe.c | 3 drivers/bluetooth/btbcm.c | 6 drivers/bluetooth/btusb.c | 2 drivers/bus/ti-sysc.c | 27 ++ drivers/crypto/caam/ctrl.c | 6 drivers/crypto/chelsio/chcr_algo.c | 16 - drivers/crypto/vmx/aes_xts.c | 3 drivers/extcon/extcon-intel-cht-wc.c | 16 + drivers/gpio/Kconfig | 1 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 45 ++- drivers/hid/hid-asus.c | 3 drivers/hid/hid-ids.h | 3 drivers/hid/hid-ite.c | 3 drivers/hid/hid-multitouch.c | 5 drivers/hid/hid-quirks.c | 1 drivers/hid/hid-steam.c | 4 drivers/hid/i2c-hid/i2c-hid-core.c | 16 + drivers/hid/intel-ish-hid/ipc/hw-ish.h | 2 drivers/hid/intel-ish-hid/ipc/pci-ish.c | 2 drivers/hid/wacom_wac.c | 6 drivers/iio/adc/stm32-dfsdm-adc.c | 2 drivers/iio/gyro/st_gyro_core.c | 75 ++++++ drivers/iommu/amd_iommu.c | 170 ++++++++------- drivers/iommu/amd_iommu_types.h | 2 drivers/iommu/dma-iommu.c | 3 drivers/media/usb/dvb-usb-v2/dvbsky.c | 3 drivers/mfd/intel-lpss-pci.c | 13 + drivers/misc/mei/hdcp/mei_hdcp.c | 33 ++ drivers/misc/mei/hw-me-regs.h | 4 drivers/misc/mei/pci-me.c | 2 drivers/mmc/host/sdhci-pci-core.c | 53 ++++ drivers/mmc/host/sdhci-pci.h | 2 drivers/net/can/m_can/tcan4x5x.c | 27 ++ drivers/net/ethernet/broadcom/b44.c | 9 drivers/net/ethernet/google/gve/gve_rx.c | 2 drivers/net/ethernet/google/gve/gve_tx.c | 6 drivers/net/ethernet/mellanox/mlxsw/minimal.c | 2 drivers/net/ethernet/socionext/netsec.c | 4 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 32 ++ drivers/net/wan/sdla.c | 2 drivers/net/wireless/ath/ath9k/hif_usb.c | 2 drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 4 drivers/net/wireless/intersil/orinoco/orinoco_usb.c | 4 drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 2 drivers/net/wireless/rsi/rsi_91x_hal.c | 12 - drivers/net/wireless/rsi/rsi_91x_usb.c | 37 ++- drivers/net/wireless/zydas/zd1211rw/zd_usb.c | 2 drivers/pci/quirks.c | 34 +++ drivers/perf/fsl_imx8_ddr_perf.c | 63 +++-- drivers/phy/motorola/phy-cpcap-usb.c | 18 + drivers/phy/qualcomm/phy-qcom-qmp.c | 2 drivers/platform/x86/dell-laptop.c | 26 ++ drivers/power/supply/ingenic-battery.c | 15 - drivers/spi/spi-dw.c | 15 + drivers/spi/spi-dw.h | 1 drivers/spi/spi-pxa2xx.c | 4 drivers/staging/most/net/net.c | 10 drivers/staging/mt7621-pci/pci-mt7621.c | 23 +- drivers/staging/vt6656/device.h | 2 drivers/staging/vt6656/int.c | 6 drivers/staging/vt6656/main_usb.c | 1 drivers/staging/vt6656/rxtx.c | 26 +- drivers/staging/wlan-ng/prism2mgmt.c | 2 drivers/tty/serial/8250/8250_bcm2835aux.c | 2 drivers/tty/serial/imx.c | 51 +++- drivers/usb/dwc3/core.c | 3 drivers/usb/dwc3/dwc3-pci.c | 4 drivers/usb/host/xhci-tegra.c | 1 drivers/usb/musb/jz4740.c | 7 drivers/usb/serial/ir-usb.c | 136 +++++++++--- drivers/usb/storage/unusual_uas.h | 7 drivers/usb/typec/tcpm/fusb302.c | 2 drivers/usb/typec/tcpm/wcove.c | 2 drivers/watchdog/Kconfig | 1 drivers/watchdog/orion_wdt.c | 4 drivers/watchdog/rn5t618_wdt.c | 1 fs/cifs/cifsglob.h | 1 fs/cifs/smb2misc.c | 2 fs/cifs/smb2ops.c | 9 fs/cifs/smb2transport.c | 2 fs/cifs/transport.c | 3 fs/debugfs/file.c | 17 - include/linux/platform_data/ti-sysc.h | 2 include/linux/power/smartreflex.h | 3 include/linux/usb/irda.h | 13 + include/media/dvb-usb-ids.h | 1 include/net/pkt_cls.h | 33 +- include/net/sch_generic.h | 3 include/net/udp.h | 3 init/Kconfig | 1 kernel/gcov/Kconfig | 2 net/bluetooth/hci_core.c | 26 ++ net/ipv4/nexthop.c | 4 net/rxrpc/input.c | 12 - net/sched/cls_basic.c | 11 net/sched/cls_bpf.c | 11 net/sched/cls_flower.c | 11 net/sched/cls_fw.c | 11 net/sched/cls_matchall.c | 11 net/sched/cls_route.c | 11 net/sched/cls_rsvp.h | 11 net/sched/cls_tcindex.c | 11 net/sched/cls_u32.c | 11 net/sched/ematch.c | 3 net/sched/sch_api.c | 47 +++- sound/pci/hda/patch_realtek.c | 17 - sound/soc/fsl/fsl_audmix.c | 9 sound/soc/intel/boards/cht_bsw_rt5645.c | 26 +- sound/soc/soc-topology.c | 6 sound/soc/sof/intel/hda-dai.c | 11 sound/soc/sof/ipc.c | 3 tools/testing/selftests/bpf/bpf_helpers.h | 2 tools/testing/selftests/bpf/progs/test_get_stack_rawtp.c | 3 125 files changed, 1161 insertions(+), 423 deletions(-) Aaron Ma (1): HID: multitouch: Add LG MELF0410 I2C touchscreen support Adrian Hunter (1): mmc: sdhci-pci: Add support for Intel JSL Andre Heider (1): Bluetooth: btbcm: Use the BDADDR_PROPERTY quirk Andreas Kemnade (1): watchdog: rn5t618_wdt: fix module aliases Andrew Murray (1): KVM: arm64: Write arch.mdcr_el2 changes since last vcpu_load on VHE Andrey Shvetsov (1): staging: most: net: fix buffer overflow Andrii Nakryiko (1): libbpf: Fix BTF-defined map's __type macro handling of arrays Andy Shevchenko (2): iio: st_gyro: Correct data for LSM9DS0 gyro mfd: intel-lpss: Add Intel Comet Lake PCH-H PCI IDs Arnd Bergmann (1): atm: eni: fix uninitialized variable warning Ben Dooks (1): ARM: OMAP2+: SmartReflex: add omap_sr_pdata definition Bin Liu (1): usb: dwc3: turn off VBUS when leaving host mode Bjorn Andersson (1): phy: qcom-qmp: Increase PHY ready timeout Christophe JAILLET (1): mlxsw: minimal: Fix an error handling path in 'mlxsw_m_port_create()' Chuhong Yuan (1): ASoC: fsl_audmix: add missed pm_runtime_disable Colin Ian King (1): staging: wlan-ng: ensure error return is actually returned Cong Wang (2): net_sched: fix ops->bind_class() implementations net_sched: walk through all child classes in tc_bind_tclass() Daniel Axtens (1): crypto: vmx - reject xts inputs that are too short David Engraf (1): watchdog: max77620_wdt: fix potential build errors David Howells (1): rxrpc: Fix use-after-free in rxrpc_receive_data() Dmitry Osipenko (1): gpio: max77620: Add missing dependency on GPIOLIB_IRQCHIP Dragos Tarcatu (1): ASoC: topology: Prevent use-after-free in snd_soc_get_pcm_runtime() Eric Biggers (1): crypto: chelsio - fix writing tfm flags to wrong place Eric Dumazet (1): net_sched: ematch: reject invalid TCF_EM_SIMPLE Eric Snowberg (1): debugfs: Return -EPERM when locked down Even Xu (1): HID: intel-ish-hid: ipc: add CMP device id Fenghua Yu (1): drivers/net/b44: Change to non-atomic bit operations on pwol_mask Greg Kroah-Hartman (1): Linux 5.4.17 Guenter Roeck (1): driver core: Fix test_async_driver_probe if NUMA is disabled Hans de Goede (2): HID: ite: Add USB id match for Acer SW5-012 keyboard dock HID: asus: Ignore Asus vendor-page usage-code 0xff events Heikki Krogerus (1): usb: dwc3: pci: add ID for the Intel Comet Lake -V variant Herbert Xu (2): crypto: af_alg - Use bh_lock_sock in sk_destruct crypto: pcrypt - Fix user-after-free on module unload Hui Wang (1): ALSA: hda/realtek - Move some alc236 pintbls to fallback table Iuliana Prodan (1): crypto: caam - do not reset pointer size from MCFGR register Jarkko Nikula (1): spi: pxa2xx: Add support for Intel Comet Lake-H Jason Gerecke (1): HID: wacom: Recognize new MobileStudio Pro PID Jiange Zhao (1): drm/amdgpu/SRIOV: add navi12 pci id for SRIOV (v2) Jiping Ma (1): stmmac: debugfs entry name is not be changed when udev rename device name. Joakim Zhang (1): perf/imx_ddr: Add enhanced AXI ID filter support Joel Stanley (1): ARM: config: aspeed-g5: Enable 8250_DW quirks Johan Hovold (14): Bluetooth: btusb: fix non-atomic allocation in completion handler orinoco_usb: fix interface sanity check rsi_91x_usb: fix interface sanity check USB: serial: ir-usb: add missing endpoint sanity check USB: serial: ir-usb: fix link-speed handling USB: serial: ir-usb: fix IrLAP framing ath9k: fix storage endpoint lookup brcmfmac: fix interface sanity check rtl8xxxu: fix interface sanity check zd1211rw: fix storage endpoint lookup rsi: fix use-after-free on failed probe and unbind rsi: fix use-after-free on probe errors rsi: fix memory leak on failed URB submission rsi: fix non-atomic allocation in completion handler Johannes Berg (1): Revert "um: Enable CONFIG_CONSTRUCTORS" Kai Vehmanen (1): ASoC: SOF: fix fault at driver unload after failed probe Krzysztof Kozlowski (1): net: wan: sdla: Fix cast from pointer to integer of different size Laura Abbott (1): usb-storage: Disable UAS on JMicron SATA enclosure Liran Alon (1): net: Google gve: Remove dma_wmb() before ringing doorbell Logan Gunthorpe (2): iommu/amd: Support multiple PCI DMA aliases in device table iommu/amd: Support multiple PCI DMA aliases in IRQ Remapping Lorenzo Bianconi (2): net: socionext: fix possible user-after-free in netsec_process_rx net: socionext: fix xdp_result initialization in netsec_process_rx Lubomir Rintel (1): component: do not dereference opaque pointer in debugfs Lukas Wunner (1): serial: 8250_bcm2835aux: Fix line mismatch on driver unbind Malcolm Priestley (3): staging: vt6656: correct packet types for CTS protect, mode. staging: vt6656: use NULLFUCTION stack on mac80211 staging: vt6656: Fix false Tx excessive retries reporting. Marcel Holtmann (1): Bluetooth: Allow combination of BDADDR_PROPERTY and INVALID_BDADDR quirks Martin Fuzzey (1): binder: fix log spam for existing debugfs file creation. Olivier Moysan (1): iio: adc: stm32-dfsdm: fix single conversion Pacien TRAN-GIRARD (1): platform/x86: dell-laptop: disable kbd backlight on Inspiron 10xx Pan Zhang (1): drivers/hid/hid-multitouch.c: fix a possible null pointer access. Paul Cercueil (2): usb: musb: jz4740: Silence error if code is -EPROBE_DEFER power/supply: ingenic-battery: Don't change scale if there's only one Paulo Alcantara (SUSE) (1): cifs: Fix memory allocation in __smb2_handle_cancelled_cmd() Pavel Balan (1): HID: Add quirk for incorrect input length on Lenovo Y720 Peter Robinson (1): usb: host: xhci-tegra: set MODULE_FIRMWARE for tegra186 Pierre-Louis Bossart (1): ASoC: SOF: Intel: hda: hda-dai: fix oops on hda_link .hw_free Priit Laes (1): HID: Add quirk for Xin-Mo Dual Controller Qian Cai (1): iommu/dma: fix variable 'cookie' set but not used Randy Dunlap (1): arc: eznps: fix allmodconfig kconfig warning Raul E Rangel (1): mmc: sdhci-pci: Quirk for AMD SDHC Device 0x7906 Rodrigo Rivas Costa (1): HID: steam: Fix input device disappearing Ronnie Sahlberg (1): cifs: set correct max-buffer-size for smb2_ioctl_init() Russell King (1): watchdog: orion: fix platform_get_irq() complaints Sam McNally (1): ASoC: Intel: cht_bsw_rt5645: Add quirk for boards using pmc_plt_clk_0 Sean Nyekjaer (1): can: tcan4x5x: tcan4x5x_parse_config(): reset device before register access Sergio Paracuellos (1): staging: mt7621-pci: add quirks for 'E2' revision using 'soc_device_attribute' Slawomir Pawlowski (1): PCI: Add DMA alias quirk for Intel VCA NTB Srinivas Pandruvada (1): HID: intel-ish-hid: ipc: Add Tiger Lake PCI device ID Stephen Worley (1): net: include struct nhmsg size in nh nlmsg size Thomas Anderson (1): drm/amd/display: Reduce HDMI pixel encoding if max clock is exceeded Thomas Hebb (2): usb: typec: wcove: fix "op-sink-microwatt" default that was in mW usb: typec: fusb302: fix "op-sink-microwatt" default that was in mW Thomas Voegtle (1): media: dvbsky: add support for eyeTV Geniatech T2 lite Tomas Winkler (2): mei: hdcp: bind only with i915 on the same PCH mei: me: add comet point (lake) H device ids Tony Lindgren (5): phy: cpcap-usb: Prevent USB line glitches from waking up modem bus: ti-sysc: Handle mstandby quirk and use it for musb bus: ti-sysc: Use swsup quirks also for am335x musb bus: ti-sysc: Add module enable quirk for audio AESS bus: ti-sysc: Fix missing force mstandby quirk handling Uwe Kleine-König (1): serial: imx: fix a race condition in receive path Vincent Whitchurch (1): CIFS: Fix task struct use-after-free on reconnect Willem de Bruijn (1): udp: segment looped gso packets correctly Yauhen Kharuzhy (1): extcon-intel-cht-wc: Don't reset USB data connection at probe wuxu.wu (1): spi: spi-dw: Add lock protect dw_spi rx/tx to prevent concurrent calls

5 years, 9 months

1
1
0 0

Linux 5.5.1

by Greg KH

I'm announcing the release of the 5.5.1 kernel. All users of the 5.5 kernel series must upgrade. The updated 5.5.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.5.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm64/kvm/debug.c | 6 arch/um/include/asm/common.lds.S | 2 arch/um/kernel/dyn.lds.S | 1 crypto/af_alg.c | 6 crypto/pcrypt.c | 3 drivers/android/binder.c | 37 ++-- drivers/base/component.c | 8 - drivers/base/test/test_async_driver_probe.c | 3 drivers/bluetooth/btusb.c | 2 drivers/crypto/caam/ctrl.c | 6 drivers/crypto/chelsio/chcr_algo.c | 16 -- drivers/crypto/vmx/aes_xts.c | 3 drivers/iio/adc/stm32-dfsdm-adc.c | 2 drivers/iio/gyro/st_gyro_core.c | 75 +++++++++ drivers/misc/mei/hdcp/mei_hdcp.c | 33 +++- drivers/misc/mei/hw-me-regs.h | 6 drivers/misc/mei/pci-me.c | 4 drivers/net/ethernet/marvell/mvneta.c | 6 drivers/net/ethernet/mellanox/mlxsw/minimal.c | 2 drivers/net/ethernet/socionext/netsec.c | 4 drivers/net/wireless/ath/ath9k/hif_usb.c | 2 drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 4 drivers/net/wireless/intersil/orinoco/orinoco_usb.c | 4 drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 2 drivers/net/wireless/rsi/rsi_91x_hal.c | 12 - drivers/net/wireless/rsi/rsi_91x_usb.c | 37 +++- drivers/net/wireless/zydas/zd1211rw/zd_usb.c | 2 drivers/power/supply/ingenic-battery.c | 15 + drivers/staging/most/net/net.c | 10 + drivers/staging/vt6656/device.h | 2 drivers/staging/vt6656/int.c | 6 drivers/staging/vt6656/main_usb.c | 1 drivers/staging/vt6656/rxtx.c | 26 +-- drivers/staging/wlan-ng/prism2mgmt.c | 2 drivers/tty/serial/8250/8250_bcm2835aux.c | 2 drivers/tty/serial/imx.c | 51 ++++-- drivers/usb/dwc3/core.c | 3 drivers/usb/dwc3/dwc3-pci.c | 4 drivers/usb/host/xhci-tegra.c | 1 drivers/usb/serial/ir-usb.c | 136 +++++++++++++---- drivers/usb/typec/tcpm/fusb302.c | 2 drivers/usb/typec/tcpm/wcove.c | 2 fs/cifs/cifsglob.h | 1 fs/cifs/smb2misc.c | 2 fs/cifs/smb2ops.c | 9 - fs/cifs/smb2transport.c | 2 fs/cifs/transport.c | 3 fs/debugfs/file.c | 17 +- include/linux/usb/irda.h | 13 + include/net/pkt_cls.h | 33 ++-- include/net/sch_generic.h | 3 include/net/udp.h | 3 init/Kconfig | 1 kernel/gcov/Kconfig | 2 net/ipv4/nexthop.c | 4 net/rxrpc/input.c | 12 - net/sched/cls_basic.c | 11 + net/sched/cls_bpf.c | 11 + net/sched/cls_flower.c | 11 + net/sched/cls_fw.c | 11 + net/sched/cls_matchall.c | 11 + net/sched/cls_route.c | 11 + net/sched/cls_rsvp.h | 11 + net/sched/cls_tcindex.c | 11 + net/sched/cls_u32.c | 11 + net/sched/ematch.c | 3 net/sched/sch_api.c | 47 ++++- 68 files changed, 590 insertions(+), 217 deletions(-) Andrew Murray (1): KVM: arm64: Write arch.mdcr_el2 changes since last vcpu_load on VHE Andrey Shvetsov (1): staging: most: net: fix buffer overflow Andy Shevchenko (1): iio: st_gyro: Correct data for LSM9DS0 gyro Bin Liu (1): usb: dwc3: turn off VBUS when leaving host mode Christophe JAILLET (1): mlxsw: minimal: Fix an error handling path in 'mlxsw_m_port_create()' Colin Ian King (1): staging: wlan-ng: ensure error return is actually returned Cong Wang (2): net_sched: fix ops->bind_class() implementations net_sched: walk through all child classes in tc_bind_tclass() Daniel Axtens (1): crypto: vmx - reject xts inputs that are too short David Howells (1): rxrpc: Fix use-after-free in rxrpc_receive_data() Eric Biggers (1): crypto: chelsio - fix writing tfm flags to wrong place Eric Dumazet (1): net_sched: ematch: reject invalid TCF_EM_SIMPLE Eric Snowberg (1): debugfs: Return -EPERM when locked down Greg Kroah-Hartman (1): Linux 5.5.1 Guenter Roeck (1): driver core: Fix test_async_driver_probe if NUMA is disabled Heikki Krogerus (1): usb: dwc3: pci: add ID for the Intel Comet Lake -V variant Herbert Xu (2): crypto: af_alg - Use bh_lock_sock in sk_destruct crypto: pcrypt - Fix user-after-free on module unload Iuliana Prodan (1): crypto: caam - do not reset pointer size from MCFGR register Johan Hovold (14): Bluetooth: btusb: fix non-atomic allocation in completion handler orinoco_usb: fix interface sanity check rsi_91x_usb: fix interface sanity check USB: serial: ir-usb: add missing endpoint sanity check USB: serial: ir-usb: fix link-speed handling USB: serial: ir-usb: fix IrLAP framing ath9k: fix storage endpoint lookup brcmfmac: fix interface sanity check rtl8xxxu: fix interface sanity check zd1211rw: fix storage endpoint lookup rsi: fix use-after-free on failed probe and unbind rsi: fix use-after-free on probe errors rsi: fix memory leak on failed URB submission rsi: fix non-atomic allocation in completion handler Johannes Berg (1): Revert "um: Enable CONFIG_CONSTRUCTORS" Lorenzo Bianconi (2): net: socionext: fix possible user-after-free in netsec_process_rx net: socionext: fix xdp_result initialization in netsec_process_rx Lubomir Rintel (1): component: do not dereference opaque pointer in debugfs Lukas Wunner (1): serial: 8250_bcm2835aux: Fix line mismatch on driver unbind Malcolm Priestley (3): staging: vt6656: correct packet types for CTS protect, mode. staging: vt6656: use NULLFUCTION stack on mac80211 staging: vt6656: Fix false Tx excessive retries reporting. Martin Fuzzey (1): binder: fix log spam for existing debugfs file creation. Olivier Moysan (1): iio: adc: stm32-dfsdm: fix single conversion Paul Cercueil (1): power/supply: ingenic-battery: Don't change scale if there's only one Paulo Alcantara (SUSE) (1): cifs: Fix memory allocation in __smb2_handle_cancelled_cmd() Peter Robinson (1): usb: host: xhci-tegra: set MODULE_FIRMWARE for tegra186 Ronnie Sahlberg (1): cifs: set correct max-buffer-size for smb2_ioctl_init() Stephen Worley (1): net: include struct nhmsg size in nh nlmsg size Sven Auhagen (1): mvneta driver disallow XDP program on hardware buffer management Thomas Hebb (2): usb: typec: wcove: fix "op-sink-microwatt" default that was in mW usb: typec: fusb302: fix "op-sink-microwatt" default that was in mW Tomas Winkler (3): mei: hdcp: bind only with i915 on the same PCH mei: me: add comet point (lake) H device ids mei: me: add jasper point DID Uwe Kleine-König (1): serial: imx: fix a race condition in receive path Vincent Whitchurch (1): CIFS: Fix task struct use-after-free on reconnect Willem de Bruijn (1): udp: segment looped gso packets correctly

5 years, 9 months

1
1
0 0

[tip: x86/urgent] x86/apic/msi: Plug non-maskable MSI affinity race

by tip-bot2 for Thomas Gleixner

The following commit has been merged into the x86/urgent branch of tip: Commit-ID: 6f1a4891a5928a5969c87fa5a584844c983ec823 Gitweb: https://git.kernel.org/tip/6f1a4891a5928a5969c87fa5a584844c983ec823 Author: Thomas Gleixner <tglx(a)linutronix.de> AuthorDate: Fri, 31 Jan 2020 15:26:52 +01:00 Committer: Thomas Gleixner <tglx(a)linutronix.de> CommitterDate: Sat, 01 Feb 2020 09:31:47 +01:00 x86/apic/msi: Plug non-maskable MSI affinity race Evan tracked down a subtle race between the update of the MSI message and the device raising an interrupt internally on PCI devices which do not support MSI masking. The update of the MSI message is non-atomic and consists of either 2 or 3 sequential 32bit wide writes to the PCI config space. - Write address low 32bits - Write address high 32bits (If supported by device) - Write data When an interrupt is migrated then both address and data might change, so the kernel attempts to mask the MSI interrupt first. But for MSI masking is optional, so there exist devices which do not provide it. That means that if the device raises an interrupt internally between the writes then a MSI message is sent built from half updated state. On x86 this can lead to spurious interrupts on the wrong interrupt vector when the affinity setting changes both address and data. As a consequence the device interrupt can be lost causing the device to become stuck or malfunctioning. Evan tried to handle that by disabling MSI accross an MSI message update. That's not feasible because disabling MSI has issues on its own: If MSI is disabled the PCI device is routing an interrupt to the legacy INTx mechanism. The INTx delivery can be disabled, but the disablement is not working on all devices. Some devices lose interrupts when both MSI and INTx delivery are disabled. Another way to solve this would be to enforce the allocation of the same vector on all CPUs in the system for this kind of screwed devices. That could be done, but it would bring back the vector space exhaustion problems which got solved a few years ago. Fortunately the high address (if supported by the device) is only relevant when X2APIC is enabled which implies interrupt remapping. In the interrupt remapping case the affinity setting is happening at the interrupt remapping unit and the PCI MSI message is programmed only once when the PCI device is initialized. That makes it possible to solve it with a two step update: 1) Target the MSI msg to the new vector on the current target CPU 2) Target the MSI msg to the new vector on the new target CPU In both cases writing the MSI message is only changing a single 32bit word which prevents the issue of inconsistency. After writing the final destination it is necessary to check whether the device issued an interrupt while the intermediate state #1 (new vector, current CPU) was in effect. This is possible because the affinity change is always happening on the current target CPU. The code runs with interrupts disabled, so the interrupt can be detected by checking the IRR of the local APIC. If the vector is pending in the IRR then the interrupt is retriggered on the new target CPU by sending an IPI for the associated vector on the target CPU. This can cause spurious interrupts on both the local and the new target CPU. 1) If the new vector is not in use on the local CPU and the device affected by the affinity change raised an interrupt during the transitional state (step #1 above) then interrupt entry code will ignore that spurious interrupt. The vector is marked so that the 'No irq handler for vector' warning is supressed once. 2) If the new vector is in use already on the local CPU then the IRR check might see an pending interrupt from the device which is using this vector. The IPI to the new target CPU will then invoke the handler of the device, which got the affinity change, even if that device did not issue an interrupt 3) If the new vector is in use already on the local CPU and the device affected by the affinity change raised an interrupt during the transitional state (step #1 above) then the handler of the device which uses that vector on the local CPU will be invoked. expose issues in device driver interrupt handlers which are not prepared to handle a spurious interrupt correctly. This not a regression, it's just exposing something which was already broken as spurious interrupts can happen for a lot of reasons and all driver handlers need to be able to deal with them. Reported-by: Evan Green <evgreen(a)chromium.org> Debugged-by: Evan Green <evgreen(a)chromium.org> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Tested-by: Evan Green <evgreen(a)chromium.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/87imkr4s7n.fsf@nanos.tec.linutronix.de --- arch/x86/include/asm/apic.h | 8 ++- arch/x86/kernel/apic/msi.c | 128 ++++++++++++++++++++++++++++++++++- include/linux/irq.h | 18 +++++- include/linux/irqdomain.h | 7 ++- kernel/irq/debugfs.c | 1 +- kernel/irq/msi.c | 5 +- 6 files changed, 163 insertions(+), 4 deletions(-) diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h index be0b9cf..19e94af 100644 --- a/arch/x86/include/asm/apic.h +++ b/arch/x86/include/asm/apic.h @@ -454,6 +454,14 @@ static inline void ack_APIC_irq(void) apic_eoi(); } + +static inline bool lapic_vector_set_in_irr(unsigned int vector) +{ + u32 irr = apic_read(APIC_IRR + (vector / 32 * 0x10)); + + return !!(irr & (1U << (vector % 32))); +} + static inline unsigned default_get_apic_id(unsigned long x) { unsigned int ver = GET_APIC_VERSION(apic_read(APIC_LVR)); diff --git a/arch/x86/kernel/apic/msi.c b/arch/x86/kernel/apic/msi.c index 7f75334..159bd0c 100644 --- a/arch/x86/kernel/apic/msi.c +++ b/arch/x86/kernel/apic/msi.c @@ -23,10 +23,8 @@ static struct irq_domain *msi_default_domain; -static void irq_msi_compose_msg(struct irq_data *data, struct msi_msg *msg) +static void __irq_msi_compose_msg(struct irq_cfg *cfg, struct msi_msg *msg) { - struct irq_cfg *cfg = irqd_cfg(data); - msg->address_hi = MSI_ADDR_BASE_HI; if (x2apic_enabled()) @@ -47,6 +45,127 @@ static void irq_msi_compose_msg(struct irq_data *data, struct msi_msg *msg) MSI_DATA_VECTOR(cfg->vector); } +static void irq_msi_compose_msg(struct irq_data *data, struct msi_msg *msg) +{ + __irq_msi_compose_msg(irqd_cfg(data), msg); +} + +static void irq_msi_update_msg(struct irq_data *irqd, struct irq_cfg *cfg) +{ + struct msi_msg msg[2] = { [1] = { }, }; + + __irq_msi_compose_msg(cfg, msg); + irq_data_get_irq_chip(irqd)->irq_write_msi_msg(irqd, msg); +} + +static int +msi_set_affinity(struct irq_data *irqd, const struct cpumask *mask, bool force) +{ + struct irq_cfg old_cfg, *cfg = irqd_cfg(irqd); + struct irq_data *parent = irqd->parent_data; + unsigned int cpu; + int ret; + + /* Save the current configuration */ + cpu = cpumask_first(irq_data_get_effective_affinity_mask(irqd)); + old_cfg = *cfg; + + /* Allocate a new target vector */ + ret = parent->chip->irq_set_affinity(parent, mask, force); + if (ret < 0 || ret == IRQ_SET_MASK_OK_DONE) + return ret; + + /* + * For non-maskable and non-remapped MSI interrupts the migration + * to a different destination CPU and a different vector has to be + * done careful to handle the possible stray interrupt which can be + * caused by the non-atomic update of the address/data pair. + * + * Direct update is possible when: + * - The MSI is maskable (remapped MSI does not use this code path)). + * The quirk bit is not set in this case. + * - The new vector is the same as the old vector + * - The old vector is MANAGED_IRQ_SHUTDOWN_VECTOR (interrupt starts up) + * - The new destination CPU is the same as the old destination CPU + */ + if (!irqd_msi_nomask_quirk(irqd) || + cfg->vector == old_cfg.vector || + old_cfg.vector == MANAGED_IRQ_SHUTDOWN_VECTOR || + cfg->dest_apicid == old_cfg.dest_apicid) { + irq_msi_update_msg(irqd, cfg); + return ret; + } + + /* + * Paranoia: Validate that the interrupt target is the local + * CPU. + */ + if (WARN_ON_ONCE(cpu != smp_processor_id())) { + irq_msi_update_msg(irqd, cfg); + return ret; + } + + /* + * Redirect the interrupt to the new vector on the current CPU + * first. This might cause a spurious interrupt on this vector if + * the device raises an interrupt right between this update and the + * update to the final destination CPU. + * + * If the vector is in use then the installed device handler will + * denote it as spurious which is no harm as this is a rare event + * and interrupt handlers have to cope with spurious interrupts + * anyway. If the vector is unused, then it is marked so it won't + * trigger the 'No irq handler for vector' warning in do_IRQ(). + * + * This requires to hold vector lock to prevent concurrent updates to + * the affected vector. + */ + lock_vector_lock(); + + /* + * Mark the new target vector on the local CPU if it is currently + * unused. Reuse the VECTOR_RETRIGGERED state which is also used in + * the CPU hotplug path for a similar purpose. This cannot be + * undone here as the current CPU has interrupts disabled and + * cannot handle the interrupt before the whole set_affinity() + * section is done. In the CPU unplug case, the current CPU is + * about to vanish and will not handle any interrupts anymore. The + * vector is cleaned up when the CPU comes online again. + */ + if (IS_ERR_OR_NULL(this_cpu_read(vector_irq[cfg->vector]))) + this_cpu_write(vector_irq[cfg->vector], VECTOR_RETRIGGERED); + + /* Redirect it to the new vector on the local CPU temporarily */ + old_cfg.vector = cfg->vector; + irq_msi_update_msg(irqd, &old_cfg); + + /* Now transition it to the target CPU */ + irq_msi_update_msg(irqd, cfg); + + /* + * All interrupts after this point are now targeted at the new + * vector/CPU. + * + * Drop vector lock before testing whether the temporary assignment + * to the local CPU was hit by an interrupt raised in the device, + * because the retrigger function acquires vector lock again. + */ + unlock_vector_lock(); + + /* + * Check whether the transition raced with a device interrupt and + * is pending in the local APICs IRR. It is safe to do this outside + * of vector lock as the irq_desc::lock of this interrupt is still + * held and interrupts are disabled: The check is not accessing the + * underlying vector store. It's just checking the local APIC's + * IRR. + */ + if (lapic_vector_set_in_irr(cfg->vector)) + irq_data_get_irq_chip(irqd)->irq_retrigger(irqd); + + return ret; +} + /* * IRQ Chip for MSI PCI/PCI-X/PCI-Express Devices, * which implement the MSI or MSI-X Capability Structure. @@ -58,6 +177,7 @@ static struct irq_chip pci_msi_controller = { .irq_ack = irq_chip_ack_parent, .irq_retrigger = irq_chip_retrigger_hierarchy, .irq_compose_msi_msg = irq_msi_compose_msg, + .irq_set_affinity = msi_set_affinity, .flags = IRQCHIP_SKIP_SET_WAKE, }; @@ -146,6 +266,8 @@ void __init arch_init_msi_domain(struct irq_domain *parent) } if (!msi_default_domain) pr_warn("failed to initialize irqdomain for MSI/MSI-x.\n"); + else + msi_default_domain->flags |= IRQ_DOMAIN_MSI_NOMASK_QUIRK; } #ifdef CONFIG_IRQ_REMAP diff --git a/include/linux/irq.h b/include/linux/irq.h index 7853eb9..3ed5a05 100644 --- a/include/linux/irq.h +++ b/include/linux/irq.h @@ -209,6 +209,8 @@ struct irq_data { * IRQD_SINGLE_TARGET - IRQ allows only a single affinity target * IRQD_DEFAULT_TRIGGER_SET - Expected trigger already been set * IRQD_CAN_RESERVE - Can use reservation mode + * IRQD_MSI_NOMASK_QUIRK - Non-maskable MSI quirk for affinity change + * required */ enum { IRQD_TRIGGER_MASK = 0xf, @@ -231,6 +233,7 @@ enum { IRQD_SINGLE_TARGET = (1 << 24), IRQD_DEFAULT_TRIGGER_SET = (1 << 25), IRQD_CAN_RESERVE = (1 << 26), + IRQD_MSI_NOMASK_QUIRK = (1 << 27), }; #define __irqd_to_state(d) ACCESS_PRIVATE((d)->common, state_use_accessors) @@ -390,6 +393,21 @@ static inline bool irqd_can_reserve(struct irq_data *d) return __irqd_to_state(d) & IRQD_CAN_RESERVE; } +static inline void irqd_set_msi_nomask_quirk(struct irq_data *d) +{ + __irqd_to_state(d) |= IRQD_MSI_NOMASK_QUIRK; +} + +static inline void irqd_clr_msi_nomask_quirk(struct irq_data *d) +{ + __irqd_to_state(d) &= ~IRQD_MSI_NOMASK_QUIRK; +} + +static inline bool irqd_msi_nomask_quirk(struct irq_data *d) +{ + return __irqd_to_state(d) & IRQD_MSI_NOMASK_QUIRK; +} + #undef __irqd_to_state static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d) diff --git a/include/linux/irqdomain.h b/include/linux/irqdomain.h index 3c340db..4da8df5 100644 --- a/include/linux/irqdomain.h +++ b/include/linux/irqdomain.h @@ -207,6 +207,13 @@ enum { IRQ_DOMAIN_FLAG_MSI_REMAP = (1 << 5), /* + * Quirk to handle MSI implementations which do not provide + * masking. Currently known to affect x86, but partially + * handled in core code. + */ + IRQ_DOMAIN_MSI_NOMASK_QUIRK = (1 << 6), + + /* * Flags starting from IRQ_DOMAIN_FLAG_NONCORE are reserved * for implementation specific purposes and ignored by the * core code. diff --git a/kernel/irq/debugfs.c b/kernel/irq/debugfs.c index c1eccd4..a949bd3 100644 --- a/kernel/irq/debugfs.c +++ b/kernel/irq/debugfs.c @@ -114,6 +114,7 @@ static const struct irq_bit_descr irqdata_states[] = { BIT_MASK_DESCR(IRQD_AFFINITY_MANAGED), BIT_MASK_DESCR(IRQD_MANAGED_SHUTDOWN), BIT_MASK_DESCR(IRQD_CAN_RESERVE), + BIT_MASK_DESCR(IRQD_MSI_NOMASK_QUIRK), BIT_MASK_DESCR(IRQD_FORWARDED_TO_VCPU), diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c index ad26fbc..eb95f61 100644 --- a/kernel/irq/msi.c +++ b/kernel/irq/msi.c @@ -453,8 +453,11 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev, continue; irq_data = irq_domain_get_irq_data(domain, desc->irq); - if (!can_reserve) + if (!can_reserve) { irqd_clr_can_reserve(irq_data); + if (domain->flags & IRQ_DOMAIN_MSI_NOMASK_QUIRK) + irqd_set_msi_nomask_quirk(irq_data); + } ret = irq_domain_activate_irq(irq_data, can_reserve); if (ret) goto cleanup;

5 years, 9 months

1
0
0 0

[PATCH v4.14.y] ext4: validate the debug_want_extra_isize mount option at parse time

by Zubin Mithra

From: Theodore Ts'o <tytso(a)mit.edu> commit 9803387c55f7d2ce69aa64340c5fdc6b3027dbc8 upstream. Instead of setting s_want_extra_size and then making sure that it is a valid value afterwards, validate the field before we set it. This avoids races and other problems when remounting the file system. Link: https://lore.kernel.org/r/20191215063020.GA11512@mit.edu Cc: stable(a)kernel.org Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Reported-and-tested-by: syzbot+4a39a025912b265cacef(a)syzkaller.appspotmail.com Signed-off-by: Zubin Mithra <zsm(a)chromium.org> --- Notes: * Syzkaller triggered a UAF on 4.14 kernels with the following stacktrace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xc1/0x111 lib/dump_stack.c:58 print_address_description+0x67/0x22d mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:355 [inline] kasan_report mm/kasan/report.c:413 [inline] kasan_report+0x250/0x28e mm/kasan/report.c:397 ext4_xattr_set_entry+0x45e/0x21d9 fs/ext4/xattr.c:1603 ext4_xattr_ibody_set+0x7d/0x226 fs/ext4/xattr.c:2239 ext4_xattr_set_handle+0x553/0xa8a fs/ext4/xattr.c:2395 ext4_xattr_set+0x16a/0x200 fs/ext4/xattr.c:2507 __vfs_setxattr+0xfc/0x13d fs/xattr.c:150 __vfs_setxattr_noperm+0xf5/0x19c fs/xattr.c:181 vfs_setxattr+0x9c/0xca fs/xattr.c:224 setxattr+0x20e/0x275 fs/xattr.c:453 path_setxattr+0xca/0x144 fs/xattr.c:472 SYSC_lsetxattr fs/xattr.c:494 [inline] SyS_lsetxattr+0x3e/0x46 fs/xattr.c:490 do_syscall_64+0x201/0x23f arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x42/0xb7 * This commit is present in linux-5.4.y. A backport for 4.19.y has been sent separately. * This patch resolves conflicts related to the following commits not being present in linux-4.14.y: 188d20bcd1eb ("vfs: Add file timestamp range support") 4881c4971df0 ("ext4: Initialize timestamps limits") * Tests run: Chrome OS tryjobs, Syzkaller reproducer fs/ext4/super.c | 127 +++++++++++++++++++++++++----------------------- 1 file changed, 66 insertions(+), 61 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 1a0a566479746..93d8aa6ef6611 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -1782,6 +1782,13 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token, arg = JBD2_DEFAULT_MAX_COMMIT_AGE; sbi->s_commit_interval = HZ * arg; } else if (token == Opt_debug_want_extra_isize) { + if ((arg & 1) || + (arg < 4) || + (arg > (sbi->s_inode_size - EXT4_GOOD_OLD_INODE_SIZE))) { + ext4_msg(sb, KERN_ERR, + "Invalid want_extra_isize %d", arg); + return -1; + } sbi->s_want_extra_isize = arg; } else if (token == Opt_max_batch_time) { sbi->s_max_batch_time = arg; @@ -3454,40 +3461,6 @@ int ext4_calculate_overhead(struct super_block *sb) return 0; } -static void ext4_clamp_want_extra_isize(struct super_block *sb) -{ - struct ext4_sb_info *sbi = EXT4_SB(sb); - struct ext4_super_block *es = sbi->s_es; - unsigned def_extra_isize = sizeof(struct ext4_inode) - - EXT4_GOOD_OLD_INODE_SIZE; - - if (sbi->s_inode_size == EXT4_GOOD_OLD_INODE_SIZE) { - sbi->s_want_extra_isize = 0; - return; - } - if (sbi->s_want_extra_isize < 4) { - sbi->s_want_extra_isize = def_extra_isize; - if (ext4_has_feature_extra_isize(sb)) { - if (sbi->s_want_extra_isize < - le16_to_cpu(es->s_want_extra_isize)) - sbi->s_want_extra_isize = - le16_to_cpu(es->s_want_extra_isize); - if (sbi->s_want_extra_isize < - le16_to_cpu(es->s_min_extra_isize)) - sbi->s_want_extra_isize = - le16_to_cpu(es->s_min_extra_isize); - } - } - /* Check if enough inode space is available */ - if ((sbi->s_want_extra_isize > sbi->s_inode_size) || - (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize > - sbi->s_inode_size)) { - sbi->s_want_extra_isize = def_extra_isize; - ext4_msg(sb, KERN_INFO, - "required extra inode space not available"); - } -} - static void ext4_set_resv_clusters(struct super_block *sb) { ext4_fsblk_t resv_clusters; @@ -3695,6 +3668,65 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) */ sbi->s_li_wait_mult = EXT4_DEF_LI_WAIT_MULT; + if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV) { + sbi->s_inode_size = EXT4_GOOD_OLD_INODE_SIZE; + sbi->s_first_ino = EXT4_GOOD_OLD_FIRST_INO; + } else { + sbi->s_inode_size = le16_to_cpu(es->s_inode_size); + sbi->s_first_ino = le32_to_cpu(es->s_first_ino); + if (sbi->s_first_ino < EXT4_GOOD_OLD_FIRST_INO) { + ext4_msg(sb, KERN_ERR, "invalid first ino: %u", + sbi->s_first_ino); + goto failed_mount; + } + if ((sbi->s_inode_size < EXT4_GOOD_OLD_INODE_SIZE) || + (!is_power_of_2(sbi->s_inode_size)) || + (sbi->s_inode_size > blocksize)) { + ext4_msg(sb, KERN_ERR, + "unsupported inode size: %d", + sbi->s_inode_size); + goto failed_mount; + } + /* + * i_atime_extra is the last extra field available for + * [acm]times in struct ext4_inode. Checking for that + * field should suffice to ensure we have extra space + * for all three. + */ + if (sbi->s_inode_size >= offsetof(struct ext4_inode, i_atime_extra) + + sizeof(((struct ext4_inode *)0)->i_atime_extra)) { + sb->s_time_gran = 1; + } else { + sb->s_time_gran = NSEC_PER_SEC; + } + } + if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE) { + sbi->s_want_extra_isize = sizeof(struct ext4_inode) - + EXT4_GOOD_OLD_INODE_SIZE; + if (ext4_has_feature_extra_isize(sb)) { + unsigned v, max = (sbi->s_inode_size - + EXT4_GOOD_OLD_INODE_SIZE); + + v = le16_to_cpu(es->s_want_extra_isize); + if (v > max) { + ext4_msg(sb, KERN_ERR, + "bad s_want_extra_isize: %d", v); + goto failed_mount; + } + if (sbi->s_want_extra_isize < v) + sbi->s_want_extra_isize = v; + + v = le16_to_cpu(es->s_min_extra_isize); + if (v > max) { + ext4_msg(sb, KERN_ERR, + "bad s_min_extra_isize: %d", v); + goto failed_mount; + } + if (sbi->s_want_extra_isize < v) + sbi->s_want_extra_isize = v; + } + } + if (sbi->s_es->s_mount_opts[0]) { char *s_mount_opts = kstrndup(sbi->s_es->s_mount_opts, sizeof(sbi->s_es->s_mount_opts), @@ -3893,29 +3925,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) has_huge_files); sb->s_maxbytes = ext4_max_size(sb->s_blocksize_bits, has_huge_files); - if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV) { - sbi->s_inode_size = EXT4_GOOD_OLD_INODE_SIZE; - sbi->s_first_ino = EXT4_GOOD_OLD_FIRST_INO; - } else { - sbi->s_inode_size = le16_to_cpu(es->s_inode_size); - sbi->s_first_ino = le32_to_cpu(es->s_first_ino); - if (sbi->s_first_ino < EXT4_GOOD_OLD_FIRST_INO) { - ext4_msg(sb, KERN_ERR, "invalid first ino: %u", - sbi->s_first_ino); - goto failed_mount; - } - if ((sbi->s_inode_size < EXT4_GOOD_OLD_INODE_SIZE) || - (!is_power_of_2(sbi->s_inode_size)) || - (sbi->s_inode_size > blocksize)) { - ext4_msg(sb, KERN_ERR, - "unsupported inode size: %d", - sbi->s_inode_size); - goto failed_mount; - } - if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE) - sb->s_time_gran = 1 << (EXT4_EPOCH_BITS - 2); - } - sbi->s_desc_size = le16_to_cpu(es->s_desc_size); if (ext4_has_feature_64bit(sb)) { if (sbi->s_desc_size < EXT4_MIN_DESC_SIZE_64BIT || @@ -4354,8 +4363,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) if (ext4_setup_super(sb, es, sb_rdonly(sb))) sb->s_flags |= MS_RDONLY; - ext4_clamp_want_extra_isize(sb); - ext4_set_resv_clusters(sb); err = ext4_setup_system_zone(sb); @@ -5139,8 +5146,6 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) goto restore_opts; } - ext4_clamp_want_extra_isize(sb); - if ((old_opts.s_mount_opt & EXT4_MOUNT_JOURNAL_CHECKSUM) ^ test_opt(sb, JOURNAL_CHECKSUM)) { ext4_msg(sb, KERN_ERR, "changing journal_checksum " -- 2.25.0.341.g760bfbb309-goog

5 years, 9 months

1
0
0 0

[merged] lib-test_kasanc-fix-memory-leak-in-kmalloc_oob_krealloc_more.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: lib/test_kasan.c: fix memory leak in kmalloc_oob_krealloc_more() has been removed from the -mm tree. Its filename was lib-test_kasanc-fix-memory-leak-in-kmalloc_oob_krealloc_more.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: "Gustavo A. R. Silva" <gustavo(a)embeddedor.com> Subject: lib/test_kasan.c: fix memory leak in kmalloc_oob_krealloc_more() In case memory resources for _ptr2_ were allocated, release them before return. Notice that in case _ptr1_ happens to be NULL, krealloc() behaves exactly like kmalloc(). Addresses-Coverity-ID: 1490594 ("Resource leak") Link: http://lkml.kernel.org/r/20200123160115.GA4202@embeddedor Fixes: 3f15801cdc23 ("lib: add kasan test module") Signed-off-by: Gustavo A. R. Silva <gustavo(a)embeddedor.com> Reviewed-by: Dmitry Vyukov <dvyukov(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/test_kasan.c | 1 + 1 file changed, 1 insertion(+) --- a/lib/test_kasan.c~lib-test_kasanc-fix-memory-leak-in-kmalloc_oob_krealloc_more +++ a/lib/test_kasan.c @@ -158,6 +158,7 @@ static noinline void __init kmalloc_oob_ if (!ptr1 || !ptr2) { pr_err("Allocation failed\n"); kfree(ptr1); + kfree(ptr2); return; } _ Patches currently in -mm which might be from gustavo(a)embeddedor.com are

5 years, 9 months

1
0
0 0

[merged] media-v4l2-core-set-pages-dirty-upon-releasing-dma-buffers.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: media/v4l2-core: set pages dirty upon releasing DMA buffers has been removed from the -mm tree. Its filename was media-v4l2-core-set-pages-dirty-upon-releasing-dma-buffers.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: John Hubbard <jhubbard(a)nvidia.com> Subject: media/v4l2-core: set pages dirty upon releasing DMA buffers After DMA is complete, and the device and CPU caches are synchronized, it's still required to mark the CPU pages as dirty, if the data was coming from the device. However, this driver was just issuing a bare put_page() call, without any set_page_dirty*() call. Fix the problem, by calling set_page_dirty_lock() if the CPU pages were potentially receiving data from the device. Link: http://lkml.kernel.org/r/20200107224558.2362728-11-jhubbard@nvidia.com Signed-off-by: John Hubbard <jhubbard(a)nvidia.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Acked-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Cc: Mauro Carvalho Chehab <mchehab(a)kernel.org> Cc: <stable(a)vger.kernel.org> Cc: Alex Williamson <alex.williamson(a)redhat.com> Cc: Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> Cc: Björn Töpel <bjorn.topel(a)intel.com> Cc: Daniel Vetter <daniel.vetter(a)ffwll.ch> Cc: Dan Williams <dan.j.williams(a)intel.com> Cc: Ira Weiny <ira.weiny(a)intel.com> Cc: Jan Kara <jack(a)suse.cz> Cc: Jason Gunthorpe <jgg(a)mellanox.com> Cc: Jason Gunthorpe <jgg(a)ziepe.ca> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Jerome Glisse <jglisse(a)redhat.com> Cc: Jonathan Corbet <corbet(a)lwn.net> Cc: Kirill A. Shutemov <kirill(a)shutemov.name> Cc: Leon Romanovsky <leonro(a)mellanox.com> Cc: Mike Rapoport <rppt(a)linux.ibm.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- drivers/media/v4l2-core/videobuf-dma-sg.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/drivers/media/v4l2-core/videobuf-dma-sg.c~media-v4l2-core-set-pages-dirty-upon-releasing-dma-buffers +++ a/drivers/media/v4l2-core/videobuf-dma-sg.c @@ -349,8 +349,11 @@ int videobuf_dma_free(struct videobuf_dm BUG_ON(dma->sglen); if (dma->pages) { - for (i = 0; i < dma->nr_pages; i++) + for (i = 0; i < dma->nr_pages; i++) { + if (dma->direction == DMA_FROM_DEVICE) + set_page_dirty_lock(dma->pages[i]); put_page(dma->pages[i]); + } kfree(dma->pages); dma->pages = NULL; } _ Patches currently in -mm which might be from jhubbard(a)nvidia.com are

5 years, 9 months

1
0
0 0

[merged] mm-move_pages-report-the-number-of-non-attempted-pages.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm: move_pages: report the number of non-attempted pages has been removed from the -mm tree. Its filename was mm-move_pages-report-the-number-of-non-attempted-pages.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Yang Shi <yang.shi(a)linux.alibaba.com> Subject: mm: move_pages: report the number of non-attempted pages Since commit a49bd4d71637 ("mm, numa: rework do_pages_move"), the semantic of move_pages() has changed to return the number of non-migrated pages if they were result of a non-fatal reasons (usually a busy page). This was an unintentional change that hasn't been noticed except for LTP tests which checked for the documented behavior. There are two ways to go around this change. We can even get back to the original behavior and return -EAGAIN whenever migrate_pages is not able to migrate pages due to non-fatal reasons. Another option would be to simply continue with the changed semantic and extend move_pages documentation to clarify that -errno is returned on an invalid input or when migration simply cannot succeed (e.g. -ENOMEM, -EBUSY) or the number of pages that couldn't have been migrated due to ephemeral reasons (e.g. page is pinned or locked for other reasons). This patch implements the second option because this behavior is in place for some time without anybody complaining and possibly new users depending on it. Also it allows to have a slightly easier error handling as the caller knows that it is worth to retry when err > 0. But since the new semantic would be aborted immediately if migration is failed due to ephemeral reasons, need include the number of non-attempted pages in the return value too. Link: http://lkml.kernel.org/r/1580160527-109104-1-git-send-email-yang.shi@linux.… Fixes: a49bd4d71637 ("mm, numa: rework do_pages_move") Signed-off-by: Yang Shi <yang.shi(a)linux.alibaba.com> Suggested-by: Michal Hocko <mhocko(a)suse.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Reviewed-by: Wei Yang <richardw.yang(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> [4.17+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/migrate.c | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) --- a/mm/migrate.c~mm-move_pages-report-the-number-of-non-attempted-pages +++ a/mm/migrate.c @@ -1627,8 +1627,19 @@ static int do_pages_move(struct mm_struc start = i; } else if (node != current_node) { err = do_move_pages_to_node(mm, &pagelist, current_node); - if (err) + if (err) { + /* + * Positive err means the number of failed + * pages to migrate. Since we are going to + * abort and return the number of non-migrated + * pages, so need to incude the rest of the + * nr_pages that have not been attempted as + * well. + */ + if (err > 0) + err += nr_pages - i - 1; goto out; + } err = store_status(status, start, current_node, i - start); if (err) goto out; @@ -1659,8 +1670,11 @@ static int do_pages_move(struct mm_struc goto out_flush; err = do_move_pages_to_node(mm, &pagelist, current_node); - if (err) + if (err) { + if (err > 0) + err += nr_pages - i - 1; goto out; + } if (i > start) { err = store_status(status, start, current_node, i - start); if (err) @@ -1674,6 +1688,13 @@ out_flush: /* Make sure we do not overwrite the existing error */ err1 = do_move_pages_to_node(mm, &pagelist, current_node); + /* + * Don't have to report non-attempted pages here since: + * - If the above loop is done gracefully all pages have been + * attempted. + * - If the above loop is aborted it means a fatal error + * happened, should return ret. + */ if (!err1) err1 = store_status(status, start, current_node, i - start); if (err >= 0) _ Patches currently in -mm which might be from yang.shi(a)linux.alibaba.com are

5 years, 9 months

1
0
0 0

[merged] mm-thp-remove-the-defer-list-related-code-since-this-will-not-happen.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm: thp: don't need care deferred split queue in memcg charge move path has been removed from the -mm tree. Its filename was mm-thp-remove-the-defer-list-related-code-since-this-will-not-happen.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Wei Yang <richardw.yang(a)linux.intel.com> Subject: mm: thp: don't need care deferred split queue in memcg charge move path If compound is true, this means it is a PMD mapped THP. Which implies the page is not linked to any defer list. So the first code chunk will not be executed. Also with this reason, it would not be proper to add this page to a defer list. So the second code chunk is not correct. Based on this, we should remove the defer list related code. [yang.shi(a)linux.alibaba.com: better patch title] Link: http://lkml.kernel.org/r/20200117233836.3434-1-richardw.yang@linux.intel.com Fixes: 87eaceb3faa5 ("mm: thp: make deferred split shrinker memcg aware") Signed-off-by: Wei Yang <richardw.yang(a)linux.intel.com> Suggested-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Acked-by: Yang Shi <yang.shi(a)linux.alibaba.com> Cc: David Rientjes <rientjes(a)google.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com> Cc: <stable(a)vger.kernel.org> [5.4+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/memcontrol.c | 18 ------------------ 1 file changed, 18 deletions(-) --- a/mm/memcontrol.c~mm-thp-remove-the-defer-list-related-code-since-this-will-not-happen +++ a/mm/memcontrol.c @@ -5340,14 +5340,6 @@ static int mem_cgroup_move_account(struc __mod_lruvec_state(to_vec, NR_WRITEBACK, nr_pages); } -#ifdef CONFIG_TRANSPARENT_HUGEPAGE - if (compound && !list_empty(page_deferred_list(page))) { - spin_lock(&from->deferred_split_queue.split_queue_lock); - list_del_init(page_deferred_list(page)); - from->deferred_split_queue.split_queue_len--; - spin_unlock(&from->deferred_split_queue.split_queue_lock); - } -#endif /* * It is safe to change page->mem_cgroup here because the page * is referenced, charged, and isolated - we can't race with @@ -5357,16 +5349,6 @@ static int mem_cgroup_move_account(struc /* caller should have done css_get */ page->mem_cgroup = to; -#ifdef CONFIG_TRANSPARENT_HUGEPAGE - if (compound && list_empty(page_deferred_list(page))) { - spin_lock(&to->deferred_split_queue.split_queue_lock); - list_add_tail(page_deferred_list(page), - &to->deferred_split_queue.split_queue); - to->deferred_split_queue.split_queue_len++; - spin_unlock(&to->deferred_split_queue.split_queue_lock); - } -#endif - spin_unlock_irqrestore(&from->move_lock, flags); ret = 0; _ Patches currently in -mm which might be from richardw.yang(a)linux.intel.com are

5 years, 9 months

1
0
0 0

[merged] mm-memory_hotplug-fix-remove_memory-lockdep-splat.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm/memory_hotplug: fix remove_memory() lockdep splat has been removed from the -mm tree. Its filename was mm-memory_hotplug-fix-remove_memory-lockdep-splat.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Dan Williams <dan.j.williams(a)intel.com> Subject: mm/memory_hotplug: fix remove_memory() lockdep splat The daxctl unit test for the dax_kmem driver currently triggers the (false positive) lockdep splat below. It results from the fact that remove_memory_block_devices() is invoked under the mem_hotplug_lock() causing lockdep entanglements with cpu_hotplug_lock() and sysfs (kernfs active state tracking). It is a false positive because the sysfs attribute path triggering the memory remove is not the same attribute path associated with memory-block device. sysfs_break_active_protection() is not applicable since there is no real deadlock conflict, instead move memory-block device removal outside the lock. The mem_hotplug_lock() is not needed to synchronize the memory-block device removal vs the page online state, that is already handled by lock_device_hotplug(). Specifically, lock_device_hotplug() is sufficient to allow try_remove_memory() to check the offline state of the memblocks and be assured that any in progress online attempts are flushed / blocked by kernfs_drain() / attribute removal. The add_memory() path safely creates memblock devices under the mem_hotplug_lock(). There is no kernfs active state synchronization in the memblock device_register() path, so nothing to fix there. This change is only possible thanks to the recent change that refactored memory block device removal out of arch_remove_memory() (commit 4c4b7f9ba948 mm/memory_hotplug: remove memory block devices before arch_remove_memory()), and David's due diligence tracking down the guarantees afforded by kernfs_drain(). Not flagged for -stable since this only impacts ongoing development and lockdep validation, not a runtime issue. ====================================================== WARNING: possible circular locking dependency detected 5.5.0-rc3+ #230 Tainted: G OE ------------------------------------------------------ lt-daxctl/6459 is trying to acquire lock: ffff99c7f0003510 (kn->count#241){++++}, at: kernfs_remove_by_name_ns+0x41/0x80 but task is already holding lock: ffffffffa76a5450 (mem_hotplug_lock.rw_sem){++++}, at: percpu_down_write+0x20/0xe0 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (mem_hotplug_lock.rw_sem){++++}: __lock_acquire+0x39c/0x790 lock_acquire+0xa2/0x1b0 get_online_mems+0x3e/0xb0 kmem_cache_create_usercopy+0x2e/0x260 kmem_cache_create+0x12/0x20 ptlock_cache_init+0x20/0x28 start_kernel+0x243/0x547 secondary_startup_64+0xb6/0xc0 -> #1 (cpu_hotplug_lock.rw_sem){++++}: __lock_acquire+0x39c/0x790 lock_acquire+0xa2/0x1b0 cpus_read_lock+0x3e/0xb0 online_pages+0x37/0x300 memory_subsys_online+0x17d/0x1c0 device_online+0x60/0x80 state_store+0x65/0xd0 kernfs_fop_write+0xcf/0x1c0 vfs_write+0xdb/0x1d0 ksys_write+0x65/0xe0 do_syscall_64+0x5c/0xa0 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #0 (kn->count#241){++++}: check_prev_add+0x98/0xa40 validate_chain+0x576/0x860 __lock_acquire+0x39c/0x790 lock_acquire+0xa2/0x1b0 __kernfs_remove+0x25f/0x2e0 kernfs_remove_by_name_ns+0x41/0x80 remove_files.isra.0+0x30/0x70 sysfs_remove_group+0x3d/0x80 sysfs_remove_groups+0x29/0x40 device_remove_attrs+0x39/0x70 device_del+0x16a/0x3f0 device_unregister+0x16/0x60 remove_memory_block_devices+0x82/0xb0 try_remove_memory+0xb5/0x130 remove_memory+0x26/0x40 dev_dax_kmem_remove+0x44/0x6a [kmem] device_release_driver_internal+0xe4/0x1c0 unbind_store+0xef/0x120 kernfs_fop_write+0xcf/0x1c0 vfs_write+0xdb/0x1d0 ksys_write+0x65/0xe0 do_syscall_64+0x5c/0xa0 entry_SYSCALL_64_after_hwframe+0x49/0xbe other info that might help us debug this: Chain exists of: kn->count#241 --> cpu_hotplug_lock.rw_sem --> mem_hotplug_lock.rw_sem Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(mem_hotplug_lock.rw_sem); lock(cpu_hotplug_lock.rw_sem); lock(mem_hotplug_lock.rw_sem); lock(kn->count#241); *** DEADLOCK *** No fixes tag as this has been a long standing issue that predated the addition of kernfs lockdep annotations. Link: http://lkml.kernel.org/r/157991441887.2763922.4770790047389427325.stgit@dwi… Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Reviewed-by: David Hildenbrand <david(a)redhat.com> Cc: Vishal Verma <vishal.l.verma(a)intel.com> Cc: Pavel Tatashin <pasha.tatashin(a)soleen.com> Cc: Dave Hansen <dave.hansen(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/memory_hotplug.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/mm/memory_hotplug.c~mm-memory_hotplug-fix-remove_memory-lockdep-splat +++ a/mm/memory_hotplug.c @@ -1764,8 +1764,6 @@ static int __ref try_remove_memory(int n BUG_ON(check_hotplug_memory_range(start, size)); - mem_hotplug_begin(); - /* * All memory blocks must be offlined before removing memory. Check * whether all memory blocks in question are offline and return error @@ -1778,9 +1776,14 @@ static int __ref try_remove_memory(int n /* remove memmap entry */ firmware_map_remove(start, start + size, "System RAM"); - /* remove memory block devices before removing memory */ + /* + * Memory block device removal under the device_hotplug_lock is + * a barrier against racing online attempts. + */ remove_memory_block_devices(start, size); + mem_hotplug_begin(); + arch_remove_memory(nid, start, size, NULL); memblock_free(start, size); memblock_remove(start, size); _ Patches currently in -mm which might be from dan.j.williams(a)intel.com are

5 years, 9 months

1
0
0 0

[merged] mm-migratec-also-overwrite-error-when-it-is-bigger-than-zero.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm/migrate.c: also overwrite error when it is bigger than zero has been removed from the -mm tree. Its filename was mm-migratec-also-overwrite-error-when-it-is-bigger-than-zero.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Wei Yang <richardw.yang(a)linux.intel.com> Subject: mm/migrate.c: also overwrite error when it is bigger than zero If we get here after successfully adding page to list, err would be 1 to indicate the page is queued in the list. Current code has two problems: * on success, 0 is not returned * on error, if add_page_for_migratioin() return 1, and the following err1 from do_move_pages_to_node() is set, the err1 is not returned since err is 1 And these behaviors break the user interface. Link: http://lkml.kernel.org/r/20200119065753.21694-1-richardw.yang@linux.intel.c… Fixes: e0153fc2c760 ("mm: move_pages: return valid node id in status if the page is already on the target node"). Signed-off-by: Wei Yang <richardw.yang(a)linux.intel.com> Acked-by: Yang Shi <yang.shi(a)linux.alibaba.com> Cc: John Hubbard <jhubbard(a)nvidia.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Christoph Lameter <cl(a)linux.com> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/migrate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/mm/migrate.c~mm-migratec-also-overwrite-error-when-it-is-bigger-than-zero +++ a/mm/migrate.c @@ -1676,7 +1676,7 @@ out_flush: err1 = do_move_pages_to_node(mm, &pagelist, current_node); if (!err1) err1 = store_status(status, start, current_node, i - start); - if (!err) + if (err >= 0) err = err1; out: return err; _ Patches currently in -mm which might be from richardw.yang(a)linux.intel.com are

5 years, 9 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror