- Linux-stable-mirror - lists.linaro.org

by Greg KH

I'm announcing the release of the 4.4.211 kernel. All users of the 4.4 kernel series must upgrade. The updated 4.4.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.4.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/ABI/testing/sysfs-bus-mei | 2 Makefile | 2 arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi | 8 arch/hexagon/kernel/stacktrace.c | 4 arch/x86/boot/compressed/head_64.S | 5 block/blk-settings.c | 2 drivers/block/xen-blkfront.c | 4 drivers/clk/samsung/clk-exynos5420.c | 2 drivers/gpio/gpiolib.c | 5 drivers/hid/hidraw.c | 7 drivers/hid/uhid.c | 5 drivers/iio/imu/adis16480.c | 6 drivers/infiniband/ulp/srpt/ib_srpt.c | 24 ++ drivers/iommu/iommu.c | 1 drivers/md/dm-snap-persistent.c | 2 drivers/md/raid0.c | 2 drivers/media/platform/exynos4-is/fimc-isp-video.c | 2 drivers/media/usb/zr364xx/zr364xx.c | 3 drivers/message/fusion/mptctl.c | 213 ++++----------------- drivers/misc/enclosure.c | 3 drivers/net/ethernet/stmicro/stmmac/common.h | 4 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 drivers/net/macvlan.c | 5 drivers/net/usb/lan78xx.c | 1 drivers/net/usb/r8152.c | 3 drivers/net/wimax/i2400m/op-rfkill.c | 1 drivers/net/wireless/cw1200/fwio.c | 6 drivers/net/wireless/p54/p54usb.c | 43 +--- drivers/net/wireless/realtek/rtlwifi/regd.c | 2 drivers/net/wireless/rsi/rsi_91x_mac80211.c | 1 drivers/platform/x86/asus-wmi.c | 8 drivers/rtc/rtc-msm6242.c | 3 drivers/rtc/rtc-mt6397.c | 47 +++- drivers/scsi/bnx2i/bnx2i_iscsi.c | 2 drivers/scsi/esas2r/esas2r_flash.c | 1 drivers/scsi/fnic/vnic_dev.c | 30 +- drivers/scsi/qla4xxx/ql4_mbx.c | 3 drivers/scsi/scsi_trace.c | 114 +++-------- drivers/scsi/sd.c | 4 drivers/spi/spi-atmel.c | 10 drivers/target/target_core_fabric_lib.c | 2 drivers/tty/serial/imx.c | 2 drivers/tty/serial/pch_uart.c | 5 drivers/usb/core/hub.c | 1 drivers/usb/serial/ch341.c | 6 drivers/usb/serial/io_edgeport.c | 33 +-- drivers/usb/serial/keyspan.c | 4 drivers/usb/serial/opticon.c | 2 drivers/usb/serial/quatech2.c | 6 drivers/usb/serial/usb-serial-simple.c | 2 drivers/usb/serial/usb-serial.c | 3 drivers/xen/balloon.c | 16 + firmware/Makefile | 2 fs/cifs/smb2file.c | 2 fs/ext4/inode.c | 15 + fs/ext4/super.c | 60 +++-- fs/ocfs2/journal.c | 8 fs/proc/meminfo.c | 31 --- include/linux/blkdev.h | 8 include/linux/mm.h | 1 include/linux/regulator/ab8500.h | 2 include/net/cfg80211.h | 11 + mm/page-writeback.c | 4 mm/page_alloc.c | 43 ++++ net/batman-adv/distributed-arp-table.c | 4 net/dccp/feat.c | 7 net/hsr/hsr_device.c | 2 net/ipv4/tcp_input.c | 7 net/mac80211/cfg.c | 55 ----- net/mac80211/sta_info.c | 4 net/netfilter/ipset/ip_set_bitmap_gen.h | 2 net/socket.c | 1 net/wireless/rdev-ops.h | 4 net/wireless/util.c | 45 ++++ sound/core/seq/seq_timer.c | 14 - sound/usb/line6/pcm.c | 19 + tools/perf/util/probe-finder.c | 32 --- tools/testing/selftests/rseq/settings | 1 78 files changed, 528 insertions(+), 532 deletions(-) Alan Stern (1): p54usb: Fix race between disconnect and firmware loading Alexander Usyskin (1): mei: fix modalias documentation Alexandru Ardelean (1): iio: imu: adis16480: assign bias value only if operation succeeded Andy Shevchenko (1): scsi: fnic: use kernel's '%pM' format option to print MAC Ard Biesheuvel (1): x86/efistub: Disable paging at mixed mode entry Arnd Bergmann (2): compat_ioctl: handle SIOCOUTQNSD scsi: fnic: fix invalid stack access Barret Rhoden (1): ext4: fix use-after-free race with debug_want_extra_isize Bart Van Assche (3): RDMA/srpt: Report the SCSI residual to the initiator scsi: target: core: Fix a pr_debug() argument scsi: core: scsi_trace: Use get_unaligned_be*() Cong Wang (1): netfilter: fix a use-after-free in mtype_destroy() Dan Carpenter (3): scsi: mptfusion: Fix double fetch bug in ioctl cw1200: Fix a signedness bug in cw1200_load_firmware() scsi: esas2r: unlock on error in esas2r_nvram_read_direct() Dedy Lansky (1): cfg80211/mac80211: make ieee80211_send_layer2_update a public function Dinh Nguyen (1): arm64: dts: agilex/stratix10: fix pmu interrupt numbers Eric Dumazet (2): macvlan: use skb_reset_mac_header() in macvlan_queue_xmit() net: usb: lan78xx: limit size of local TSO packets Fabian Henneke (1): hidraw: Return EPOLLOUT from hidraw_poll Geert Uytterhoeven (1): gpio: Fix error message on out-of-range GPIO in lookup table Greg Kroah-Hartman (1): Linux 4.4.211 Igor Redko (1): mm/page_alloc.c: calculate 'available' memory in a separate function James Bottomley (1): scsi: enclosure: Fix stale device oops with hot replug Jari Ruusu (1): Fix built-in early-load Intel microcode alignment Jerónimo Borque (1): USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx Jian-Hong Pan (1): platform/x86: asus-wmi: Fix keyboard brightness cannot be set to 0 Jiri Kosina (1): HID: hidraw, uhid: Always report EPOLLOUT Johan Hovold (8): USB: serial: opticon: fix control-message timeouts USB: serial: suppress driver bind attributes USB: serial: ch341: handle unbound port at reset_resume USB: serial: io_edgeport: add missing active-port sanity check USB: serial: quatech2: handle unbound ports USB: serial: io_edgeport: handle unbound ports on URB completion USB: serial: keyspan: handle unbound ports r8152: add missing endpoint sanity check Johannes Berg (1): cfg80211: check for set_wiphy_params John Ogness (1): USB: serial: io_edgeport: use irqsave() in USB's complete callback Jon Derrick (1): iommu: Remove device link to group on failure Jose Abreu (2): net: stmmac: 16KB buffer must be 16 byte aligned net: stmmac: Enable 16KB buffer size Jouni Malinen (1): mac80211: Do not send Layer 2 Update frame before authorization Juergen Gross (1): xen: let alloc_xenballooned_pages() fail if not enough memory free Kai Li (1): ocfs2: call journal flush to mark journal as empty after journal recovery when mount Kars de Jong (1): rtc: msm6242: Fix reading of 10-hour digit Keiya Nobuta (1): usb: core: hub: Improved device recognition on remote wakeup Mans Rullgard (1): spi: atmel: fix handling of cs_change set on non-last xfer Marcel Holtmann (1): HID: hidraw: Fix returning EPOLLOUT from hidraw_poll Marian Mihailescu (1): clk: samsung: exynos5420: Preserve CPU clocks configuration during suspend/resume Masami Hiramatsu (1): perf probe: Fix wrong address verification Mathieu Desnoyers (1): rseq/selftests: Turn off timeout setting Mikulas Patocka (1): block: fix an integer overflow in logical block size Nathan Chancellor (3): cifs: Adjust indentation in smb2_open_file rtlwifi: Remove unnecessary NULL check in rtl_regd_init xen/blkfront: Adjust indentation in xlvbd_alloc_gendisk Navid Emamdoost (2): wimax: i2400: fix memory leak wimax: i2400: Fix memory leak in i2400m_op_rfkill_sw_toggle Nick Desaulniers (1): hexagon: work around compiler crash Pan Bian (2): scsi: qla4xxx: fix double free bug scsi: bnx2i: fix potential use after free Peng Fan (2): tty: serial: imx: use the sg count from dma_map_sg tty: serial: pch_uart: correct usage of dma_unmap_sg Pengcheng Yang (1): tcp: fix marked lost packets not being retransmitted Ran Bi (1): rtc: mt6397: fix alarm register overwrite Sanjay Konduri (1): rsi: add fix for crash during assertions Seung-Woo Kim (1): media: exynos4-is: Fix recursive locking in isp_video_release() Stephan Gerhold (1): regulator: ab8500: Remove SYSCLKREQ from enum ab8505_regulator_id Sven Eckelmann (1): batman-adv: Fix DAT candidate selection on little endian systems Taehee Yoo (1): hsr: reset network header when supervision frame is created Takashi Iwai (3): ALSA: line6: Fix write on zero-sized buffer ALSA: line6: Fix memory leak at line6_init_pcm() error path ALSA: seq: Fix racy access for queue timer in proc read Theodore Ts'o (1): ext4: add more paranoia checking in ext4_expand_extra_isize handling Vandana BN (1): media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap Wen Yang (1): mm/page-writeback.c: avoid potential division by zero in wb_min_max_ratio() Xiang Chen (1): scsi: sd: Clear sdkp->protection_type if disk is reformatted without PI YueHaibing (1): dccp: Fix memleak in __feat_register_sp

5 years, 11 months

1
1
0 0

patch "usb: dwc3: pci: add ID for the Intel Comet Lake -V variant" added to usb-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled usb: dwc3: pci: add ID for the Intel Comet Lake -V variant to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From f5ae8869095552e3396ee3e404f9586cc6a828f0 Mon Sep 17 00:00:00 2001 From: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Date: Fri, 17 Jan 2020 12:30:33 +0300 Subject: usb: dwc3: pci: add ID for the Intel Comet Lake -V variant There is one more Comet Lake PCH variant, CML-V, that has its own PCI ID. Signed-off-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20200117093033.48616-1-heikki.krogerus@linux.inte… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/dwc3/dwc3-pci.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c index 294276f7deb9..7051611229c9 100644 --- a/drivers/usb/dwc3/dwc3-pci.c +++ b/drivers/usb/dwc3/dwc3-pci.c @@ -34,6 +34,7 @@ #define PCI_DEVICE_ID_INTEL_GLK 0x31aa #define PCI_DEVICE_ID_INTEL_CNPLP 0x9dee #define PCI_DEVICE_ID_INTEL_CNPH 0xa36e +#define PCI_DEVICE_ID_INTEL_CNPV 0xa3b0 #define PCI_DEVICE_ID_INTEL_ICLLP 0x34ee #define PCI_DEVICE_ID_INTEL_EHLLP 0x4b7e #define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee @@ -342,6 +343,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CNPH), (kernel_ulong_t) &dwc3_pci_intel_properties, }, + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CNPV), + (kernel_ulong_t) &dwc3_pci_intel_properties, }, + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ICLLP), (kernel_ulong_t) &dwc3_pci_intel_properties, }, -- 2.25.0

5 years, 11 months

1
0
0 0

patch "usb: host: xhci-tegra: set MODULE_FIRMWARE for tegra186" added to usb-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled usb: host: xhci-tegra: set MODULE_FIRMWARE for tegra186 to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From e1f236efd9c579a29d7df75aa052127d0d975267 Mon Sep 17 00:00:00 2001 From: Peter Robinson <pbrobinson(a)gmail.com> Date: Mon, 20 Jan 2020 14:19:10 +0000 Subject: usb: host: xhci-tegra: set MODULE_FIRMWARE for tegra186 Set the MODULE_FIRMWARE for tegra186, it's registered for 124/210 and ensures the firmware is available at the appropriate time such as in the initrd, else if the firmware is unavailable the driver fails with the following errors: tegra-xusb 3530000.usb: Direct firmware load for nvidia/tegra186/xusb.bin failed with error -2 tegra-xusb 3530000.usb: failed to request firmware: -2 tegra-xusb 3530000.usb: failed to load firmware: -2 tegra-xusb: probe of 3530000.usb failed with error -2 Fixes: 5f9be5f3f899 ("usb: host: xhci-tegra: Add Tegra186 XUSB support") Signed-off-by: Peter Robinson <pbrobinson(a)gmail.com> Acked-by: Thierry Reding <treding(a)nvidia.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20200120141910.116097-1-pbrobinson@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/host/xhci-tegra.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c index 0b58ef3a7f7f..8163aefc6c6b 100644 --- a/drivers/usb/host/xhci-tegra.c +++ b/drivers/usb/host/xhci-tegra.c @@ -1744,6 +1744,7 @@ MODULE_FIRMWARE("nvidia/tegra210/xusb.bin"); static const char * const tegra186_supply_names[] = { }; +MODULE_FIRMWARE("nvidia/tegra186/xusb.bin"); static const struct tegra_xusb_phy_type tegra186_phy_types[] = { { .name = "usb3", .num = 3, }, -- 2.25.0

5 years, 11 months

1
0
0 0

patch "staging: most: net: fix buffer overflow" added to staging-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled staging: most: net: fix buffer overflow to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 4d1356ac12f4d5180d0df345d85ff0ee42b89c72 Mon Sep 17 00:00:00 2001 From: Andrey Shvetsov <andrey.shvetsov(a)k2l.de> Date: Thu, 16 Jan 2020 18:22:39 +0100 Subject: staging: most: net: fix buffer overflow If the length of the socket buffer is 0xFFFFFFFF (max size for an unsigned int), then payload_len becomes 0xFFFFFFF1 after subtracting 14 (ETH_HLEN). Then, mdp_len is set to payload_len + 16 (MDP_HDR_LEN) which overflows and results in a value of 2. These values for payload_len and mdp_len will pass current buffer size checks. This patch checks if derived from skb->len sum may overflow. The check is based on the following idea: For any `unsigned V1, V2` and derived `unsigned SUM = V1 + V2`, `V1 + V2` overflows iif `SUM < V1`. Reported-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Andrey Shvetsov <andrey.shvetsov(a)k2l.de> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20200116172238.6046-1-andrey.shvetsov@microchip.c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/staging/most/net/net.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/staging/most/net/net.c b/drivers/staging/most/net/net.c index 8218c9a06cb5..5547e36e09de 100644 --- a/drivers/staging/most/net/net.c +++ b/drivers/staging/most/net/net.c @@ -82,6 +82,11 @@ static int skb_to_mamac(const struct sk_buff *skb, struct mbo *mbo) unsigned int payload_len = skb->len - ETH_HLEN; unsigned int mdp_len = payload_len + MDP_HDR_LEN; + if (mdp_len < skb->len) { + pr_err("drop: too large packet! (%u)\n", skb->len); + return -EINVAL; + } + if (mbo->buffer_length < mdp_len) { pr_err("drop: too small buffer! (%d for %d)\n", mbo->buffer_length, mdp_len); @@ -129,6 +134,11 @@ static int skb_to_mep(const struct sk_buff *skb, struct mbo *mbo) u8 *buff = mbo->virt_address; unsigned int mep_len = skb->len + MEP_HDR_LEN; + if (mep_len < skb->len) { + pr_err("drop: too large packet! (%u)\n", skb->len); + return -EINVAL; + } + if (mbo->buffer_length < mep_len) { pr_err("drop: too small buffer! (%d for %d)\n", mbo->buffer_length, mep_len); -- 2.25.0

5 years, 11 months

1
0
0 0

patch "mei: me: add comet point (lake) H device ids" added to char-misc-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled mei: me: add comet point (lake) H device ids to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 559e575a8946a6561dfe8880de341d4ef78d5994 Mon Sep 17 00:00:00 2001 From: Tomas Winkler <tomas.winkler(a)intel.com> Date: Sun, 19 Jan 2020 11:42:29 +0200 Subject: mei: me: add comet point (lake) H device ids Add Comet Point device IDs for Comet Lake H platforms. Cc: <stable(a)vger.kernel.org> Signed-off-by: Tomas Winkler <tomas.winkler(a)intel.com> Link: https://lore.kernel.org/r/20200119094229.20116-1-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/misc/mei/hw-me-regs.h | 4 ++++ drivers/misc/mei/pci-me.c | 2 ++ 2 files changed, 6 insertions(+) diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h index 7cd67fb2365d..9d24db38e8bc 100644 --- a/drivers/misc/mei/hw-me-regs.h +++ b/drivers/misc/mei/hw-me-regs.h @@ -81,8 +81,12 @@ #define MEI_DEV_ID_CMP_LP 0x02e0 /* Comet Point LP */ #define MEI_DEV_ID_CMP_LP_3 0x02e4 /* Comet Point LP 3 (iTouch) */ + #define MEI_DEV_ID_CMP_V 0xA3BA /* Comet Point Lake V */ +#define MEI_DEV_ID_CMP_H 0x06e0 /* Comet Lake H */ +#define MEI_DEV_ID_CMP_H_3 0x06e4 /* Comet Lake H 3 (iTouch) */ + #define MEI_DEV_ID_ICP_LP 0x34E0 /* Ice Lake Point LP */ #define MEI_DEV_ID_TGP_LP 0xA0E0 /* Tiger Lake Point LP */ diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c index c845b7e40f26..c14261d735db 100644 --- a/drivers/misc/mei/pci-me.c +++ b/drivers/misc/mei/pci-me.c @@ -99,6 +99,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = { {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP, MEI_ME_PCH12_CFG)}, {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP_3, MEI_ME_PCH8_CFG)}, {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_V, MEI_ME_PCH12_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_H, MEI_ME_PCH12_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_H_3, MEI_ME_PCH8_CFG)}, {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)}, -- 2.25.0

5 years, 11 months

1
0
0 0

patch "binder: fix log spam for existing debugfs file creation." added to char-misc-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled binder: fix log spam for existing debugfs file creation. to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From eb143f8756e77c8fcfc4d574922ae9efd3a43ca9 Mon Sep 17 00:00:00 2001 From: Martin Fuzzey <martin.fuzzey(a)flowbird.group> Date: Fri, 10 Jan 2020 16:44:01 +0100 Subject: binder: fix log spam for existing debugfs file creation. Since commit 43e23b6c0b01 ("debugfs: log errors when something goes wrong") debugfs logs attempts to create existing files. However binder attempts to create multiple debugfs files with the same name when a single PID has multiple contexts, this leads to log spamming during an Android boot (17 such messages during boot on my system). Fix this by checking if we already know the PID and only create the debugfs entry for the first context per PID. Do the same thing for binderfs for symmetry. Signed-off-by: Martin Fuzzey <martin.fuzzey(a)flowbird.group> Acked-by: Todd Kjos <tkjos(a)google.com> Fixes: 43e23b6c0b01 ("debugfs: log errors when something goes wrong") Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/1578671054-5982-1-git-send-email-martin.fuzzey@fl… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/android/binder.c | 37 +++++++++++++++++++------------------ 1 file changed, 19 insertions(+), 18 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index b2dad43dbf82..9fcc761031d8 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -5199,10 +5199,11 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma) static int binder_open(struct inode *nodp, struct file *filp) { - struct binder_proc *proc; + struct binder_proc *proc, *itr; struct binder_device *binder_dev; struct binderfs_info *info; struct dentry *binder_binderfs_dir_entry_proc = NULL; + bool existing_pid = false; binder_debug(BINDER_DEBUG_OPEN_CLOSE, "%s: %d:%d\n", __func__, current->group_leader->pid, current->pid); @@ -5235,19 +5236,24 @@ static int binder_open(struct inode *nodp, struct file *filp) filp->private_data = proc; mutex_lock(&binder_procs_lock); + hlist_for_each_entry(itr, &binder_procs, proc_node) { + if (itr->pid == proc->pid) { + existing_pid = true; + break; + } + } hlist_add_head(&proc->proc_node, &binder_procs); mutex_unlock(&binder_procs_lock); - if (binder_debugfs_dir_entry_proc) { + if (binder_debugfs_dir_entry_proc && !existing_pid) { char strbuf[11]; snprintf(strbuf, sizeof(strbuf), "%u", proc->pid); /* - * proc debug entries are shared between contexts, so - * this will fail if the process tries to open the driver - * again with a different context. The priting code will - * anyway print all contexts that a given PID has, so this - * is not a problem. + * proc debug entries are shared between contexts. + * Only create for the first PID to avoid debugfs log spamming + * The printing code will anyway print all contexts for a given + * PID so this is not a problem. */ proc->debugfs_entry = debugfs_create_file(strbuf, 0444, binder_debugfs_dir_entry_proc, @@ -5255,19 +5261,16 @@ static int binder_open(struct inode *nodp, struct file *filp) &proc_fops); } - if (binder_binderfs_dir_entry_proc) { + if (binder_binderfs_dir_entry_proc && !existing_pid) { char strbuf[11]; struct dentry *binderfs_entry; snprintf(strbuf, sizeof(strbuf), "%u", proc->pid); /* * Similar to debugfs, the process specific log file is shared - * between contexts. If the file has already been created for a - * process, the following binderfs_create_file() call will - * fail with error code EEXIST if another context of the same - * process invoked binder_open(). This is ok since same as - * debugfs, the log file will contain information on all - * contexts of a given PID. + * between contexts. Only create for the first PID. + * This is ok since same as debugfs, the log file will contain + * information on all contexts of a given PID. */ binderfs_entry = binderfs_create_file(binder_binderfs_dir_entry_proc, strbuf, &proc_fops, (void *)(unsigned long)proc->pid); @@ -5277,10 +5280,8 @@ static int binder_open(struct inode *nodp, struct file *filp) int error; error = PTR_ERR(binderfs_entry); - if (error != -EEXIST) { - pr_warn("Unable to create file %s in binderfs (error %d)\n", - strbuf, error); - } + pr_warn("Unable to create file %s in binderfs (error %d)\n", + strbuf, error); } } -- 2.25.0

5 years, 11 months

1
0
0 0

[PATCH] mm: move_pages: fix the return value if there are not-migrated pages

by Yang Shi

The do_move_pages_to_node() might return > 0 value, the number of pages that are not migrated, then the value will be returned to userspace directly. But, move_pages() syscall would just return 0 or errno. So, we need reset the return value to 0 for such case as what pre-v4.17 did. Fixes: a49bd4d71637 ("mm, numa: rework do_pages_move") Cc: Michal Hocko <mhocko(a)suse.com> Cc: Wei Yang <richardw.yang(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> [4.17+] Signed-off-by: Yang Shi <yang.shi(a)linux.alibaba.com> --- mm/migrate.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/mm/migrate.c b/mm/migrate.c index 86873b6..3e75432 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -1659,8 +1659,11 @@ static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes, goto out_flush; err = do_move_pages_to_node(mm, &pagelist, current_node); - if (err) + if (err) { + if (err > 0) + err = 0; goto out; + } if (i > start) { err = store_status(status, start, current_node, i - start); if (err) -- 1.8.3.1

5 years, 11 months

3
13
0 0

[PATCH] jffs2: Fix integer underflow in jffs2_rtime_compress

by Richard Weinberger

The rtime compressor assumes that at least two bytes are compressed. If we try to compress just one byte, the loop condition will wrap around and an out-of-bounds write happens. Cc: <stable(a)vger.kernel.org> Signed-off-by: Richard Weinberger <richard(a)nod.at> --- fs/jffs2/compr_rtime.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c index 406d9cc84ba8..cbf700001fc9 100644 --- a/fs/jffs2/compr_rtime.c +++ b/fs/jffs2/compr_rtime.c @@ -39,6 +39,9 @@ static int jffs2_rtime_compress(unsigned char *data_in, memset(positions,0,sizeof(positions)); + if (*dstlen < 2) + return -1; + while (pos < (*sourcelen) && outpos <= (*dstlen)-2) { int backpos, runlen=0; unsigned char value; -- 2.20.0

5 years, 11 months

2
3
0 0

[Patch v4] mm: thp: remove the defer list related code since this will not happen

by Wei Yang

If compound is true, this means it is a PMD mapped THP. Which implies the page is not linked to any defer list. So the first code chunk will not be executed. Also with this reason, it would not be proper to add this page to a defer list. So the second code chunk is not correct. Based on this, we should remove the defer list related code. Fixes: 87eaceb3faa5 ("mm: thp: make deferred split shrinker memcg aware") Signed-off-by: Wei Yang <richardw.yang(a)linux.intel.com> Suggested-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> [5.4+] --- v4: * finally we identified the related code is not necessary and not correct, just remove it * thanks to Kirill T first spot some problem v3: * remove all review/ack tag since rewrite the changelog * use deferred_split_huge_page as the example of race * add cc stable 5.4+ tag as suggested by David Rientjes v2: * move check on compound outside suggested by Alexander * an example of the race condition, suggested by Michal --- mm/memcontrol.c | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 6c83cf4ed970..27c231bf4565 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5340,14 +5340,6 @@ static int mem_cgroup_move_account(struct page *page, __mod_lruvec_state(to_vec, NR_WRITEBACK, nr_pages); } -#ifdef CONFIG_TRANSPARENT_HUGEPAGE - if (compound && !list_empty(page_deferred_list(page))) { - spin_lock(&from->deferred_split_queue.split_queue_lock); - list_del_init(page_deferred_list(page)); - from->deferred_split_queue.split_queue_len--; - spin_unlock(&from->deferred_split_queue.split_queue_lock); - } -#endif /* * It is safe to change page->mem_cgroup here because the page * is referenced, charged, and isolated - we can't race with @@ -5357,16 +5349,6 @@ static int mem_cgroup_move_account(struct page *page, /* caller should have done css_get */ page->mem_cgroup = to; -#ifdef CONFIG_TRANSPARENT_HUGEPAGE - if (compound && list_empty(page_deferred_list(page))) { - spin_lock(&to->deferred_split_queue.split_queue_lock); - list_add_tail(page_deferred_list(page), - &to->deferred_split_queue.split_queue); - to->deferred_split_queue.split_queue_len++; - spin_unlock(&to->deferred_split_queue.split_queue_lock); - } -#endif - spin_unlock_irqrestore(&from->move_lock, flags); ret = 0; -- 2.17.1

5 years, 11 months

5
12
0 0

[PATCH] mm: move_pages: report the number of non-attempted pages

by Yang Shi

Since commit a49bd4d71637 ("mm, numa: rework do_pages_move"), the semantic of move_pages() was changed to return the number of non-migrated pages (failed to migration) and the call would be aborted immediately if migrate_pages() returns positive value. But it didn't report the number of pages that we even haven't attempted to migrate. So, fix it by including non-attempted pages in the return value. Fixes: a49bd4d71637 ("mm, numa: rework do_pages_move") Suggested-by: Michal Hocko <mhocko(a)suse.com> Cc: Wei Yang <richardw.yang(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> [4.17+] Signed-off-by: Yang Shi <yang.shi(a)linux.alibaba.com> --- The patch is based off Wei Yang's cleanup patchset: https://lore.kernel.org/linux-mm/20200122011647.13636-1-richardw.yang@linux… mm/migrate.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/mm/migrate.c b/mm/migrate.c index 591f2e5..51b1b76 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -1582,7 +1582,7 @@ static int add_page_for_migration(struct mm_struct *mm, unsigned long addr, static int move_pages_and_store_status(struct mm_struct *mm, int node, struct list_head *pagelist, int __user *status, - int start, int nr) + int start, int nr, unsigned long total) { int err; @@ -1590,8 +1590,17 @@ static int move_pages_and_store_status(struct mm_struct *mm, int node, return 0; err = do_move_pages_to_node(mm, pagelist, node); - if (err) + if (err) { + /* + * Possitive err means the number of failed pages to + * migrate. Since we are going to abort and return the + * number of non-migrated pages, so need incude the rest + * of the nr_pages that are not attempted as well. + */ + if (err > 0) + err += total - start - nr - 1; return err; + } err = store_status(status, start, node, nr); return err; } @@ -1640,7 +1649,8 @@ static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes, start = i; } else if (node != current_node) { err = move_pages_and_store_status(mm, current_node, - &pagelist, status, start, i - start); + &pagelist, status, start, i - start, + nr_pages); if (err) goto out; start = i; @@ -1670,7 +1680,7 @@ static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes, goto out_flush; err = move_pages_and_store_status(mm, current_node, &pagelist, - status, start, i - start); + status, start, i - start, nr_pages); if (err) goto out; current_node = NUMA_NO_NODE; @@ -1678,7 +1688,7 @@ static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes, out_flush: /* Make sure we do not overwrite the existing error */ err1 = move_pages_and_store_status(mm, current_node, &pagelist, - status, start, i - start); + status, start, i - start, nr_pages); if (err >= 0) err = err1; out: -- 1.8.3.1

5 years, 11 months

2
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror